xref: /qemu/target/i386/kvm/kvm.c (revision 73d24074078a2cefb5305047e3bf50b73daa3f98)
1 /*
2  * QEMU KVM support
3  *
4  * Copyright (C) 2006-2008 Qumranet Technologies
5  * Copyright IBM, Corp. 2008
6  *
7  * Authors:
8  *  Anthony Liguori   <aliguori@us.ibm.com>
9  *
10  * This work is licensed under the terms of the GNU GPL, version 2 or later.
11  * See the COPYING file in the top-level directory.
12  *
13  */
14 
15 #include "qemu/osdep.h"
16 #include "qapi/qapi-events-run-state.h"
17 #include "qapi/error.h"
18 #include <sys/ioctl.h>
19 #include <sys/utsname.h>
20 #include <sys/syscall.h>
21 
22 #include <linux/kvm.h>
23 #include "standard-headers/asm-x86/kvm_para.h"
24 
25 #include "cpu.h"
26 #include "host-cpu.h"
27 #include "sysemu/sysemu.h"
28 #include "sysemu/hw_accel.h"
29 #include "sysemu/kvm_int.h"
30 #include "sysemu/runstate.h"
31 #include "kvm_i386.h"
32 #include "sev.h"
33 #include "hyperv.h"
34 #include "hyperv-proto.h"
35 
36 #include "exec/gdbstub.h"
37 #include "qemu/host-utils.h"
38 #include "qemu/main-loop.h"
39 #include "qemu/config-file.h"
40 #include "qemu/error-report.h"
41 #include "qemu/memalign.h"
42 #include "hw/i386/x86.h"
43 #include "hw/i386/apic.h"
44 #include "hw/i386/apic_internal.h"
45 #include "hw/i386/apic-msidef.h"
46 #include "hw/i386/intel_iommu.h"
47 #include "hw/i386/x86-iommu.h"
48 #include "hw/i386/e820_memory_layout.h"
49 
50 #include "hw/pci/pci.h"
51 #include "hw/pci/msi.h"
52 #include "hw/pci/msix.h"
53 #include "migration/blocker.h"
54 #include "exec/memattrs.h"
55 #include "trace.h"
56 
57 //#define DEBUG_KVM
58 
59 #ifdef DEBUG_KVM
60 #define DPRINTF(fmt, ...) \
61     do { fprintf(stderr, fmt, ## __VA_ARGS__); } while (0)
62 #else
63 #define DPRINTF(fmt, ...) \
64     do { } while (0)
65 #endif
66 
67 /* From arch/x86/kvm/lapic.h */
68 #define KVM_APIC_BUS_CYCLE_NS       1
69 #define KVM_APIC_BUS_FREQUENCY      (1000000000ULL / KVM_APIC_BUS_CYCLE_NS)
70 
71 #define MSR_KVM_WALL_CLOCK  0x11
72 #define MSR_KVM_SYSTEM_TIME 0x12
73 
74 /* A 4096-byte buffer can hold the 8-byte kvm_msrs header, plus
75  * 255 kvm_msr_entry structs */
76 #define MSR_BUF_SIZE 4096
77 
78 static void kvm_init_msrs(X86CPU *cpu);
79 
80 const KVMCapabilityInfo kvm_arch_required_capabilities[] = {
81     KVM_CAP_INFO(SET_TSS_ADDR),
82     KVM_CAP_INFO(EXT_CPUID),
83     KVM_CAP_INFO(MP_STATE),
84     KVM_CAP_LAST_INFO
85 };
86 
87 static bool has_msr_star;
88 static bool has_msr_hsave_pa;
89 static bool has_msr_tsc_aux;
90 static bool has_msr_tsc_adjust;
91 static bool has_msr_tsc_deadline;
92 static bool has_msr_feature_control;
93 static bool has_msr_misc_enable;
94 static bool has_msr_smbase;
95 static bool has_msr_bndcfgs;
96 static int lm_capable_kernel;
97 static bool has_msr_hv_hypercall;
98 static bool has_msr_hv_crash;
99 static bool has_msr_hv_reset;
100 static bool has_msr_hv_vpindex;
101 static bool hv_vpindex_settable;
102 static bool has_msr_hv_runtime;
103 static bool has_msr_hv_synic;
104 static bool has_msr_hv_stimer;
105 static bool has_msr_hv_frequencies;
106 static bool has_msr_hv_reenlightenment;
107 static bool has_msr_hv_syndbg_options;
108 static bool has_msr_xss;
109 static bool has_msr_umwait;
110 static bool has_msr_spec_ctrl;
111 static bool has_tsc_scale_msr;
112 static bool has_msr_tsx_ctrl;
113 static bool has_msr_virt_ssbd;
114 static bool has_msr_smi_count;
115 static bool has_msr_arch_capabs;
116 static bool has_msr_core_capabs;
117 static bool has_msr_vmx_vmfunc;
118 static bool has_msr_ucode_rev;
119 static bool has_msr_vmx_procbased_ctls2;
120 static bool has_msr_perf_capabs;
121 static bool has_msr_pkrs;
122 
123 static uint32_t has_architectural_pmu_version;
124 static uint32_t num_architectural_pmu_gp_counters;
125 static uint32_t num_architectural_pmu_fixed_counters;
126 
127 static int has_xsave;
128 static int has_xsave2;
129 static int has_xcrs;
130 static int has_pit_state2;
131 static int has_sregs2;
132 static int has_exception_payload;
133 
134 static bool has_msr_mcg_ext_ctl;
135 
136 static struct kvm_cpuid2 *cpuid_cache;
137 static struct kvm_cpuid2 *hv_cpuid_cache;
138 static struct kvm_msr_list *kvm_feature_msrs;
139 
140 #define BUS_LOCK_SLICE_TIME 1000000000ULL /* ns */
141 static RateLimit bus_lock_ratelimit_ctrl;
142 
143 int kvm_has_pit_state2(void)
144 {
145     return has_pit_state2;
146 }
147 
148 bool kvm_has_smm(void)
149 {
150     return kvm_vm_check_extension(kvm_state, KVM_CAP_X86_SMM);
151 }
152 
153 bool kvm_has_adjust_clock_stable(void)
154 {
155     int ret = kvm_check_extension(kvm_state, KVM_CAP_ADJUST_CLOCK);
156 
157     return (ret == KVM_CLOCK_TSC_STABLE);
158 }
159 
160 bool kvm_has_adjust_clock(void)
161 {
162     return kvm_check_extension(kvm_state, KVM_CAP_ADJUST_CLOCK);
163 }
164 
165 bool kvm_has_exception_payload(void)
166 {
167     return has_exception_payload;
168 }
169 
170 static bool kvm_x2apic_api_set_flags(uint64_t flags)
171 {
172     KVMState *s = KVM_STATE(current_accel());
173 
174     return !kvm_vm_enable_cap(s, KVM_CAP_X2APIC_API, 0, flags);
175 }
176 
177 #define MEMORIZE(fn, _result) \
178     ({ \
179         static bool _memorized; \
180         \
181         if (_memorized) { \
182             return _result; \
183         } \
184         _memorized = true; \
185         _result = fn; \
186     })
187 
188 static bool has_x2apic_api;
189 
190 bool kvm_has_x2apic_api(void)
191 {
192     return has_x2apic_api;
193 }
194 
195 bool kvm_enable_x2apic(void)
196 {
197     return MEMORIZE(
198              kvm_x2apic_api_set_flags(KVM_X2APIC_API_USE_32BIT_IDS |
199                                       KVM_X2APIC_API_DISABLE_BROADCAST_QUIRK),
200              has_x2apic_api);
201 }
202 
203 bool kvm_hv_vpindex_settable(void)
204 {
205     return hv_vpindex_settable;
206 }
207 
208 static int kvm_get_tsc(CPUState *cs)
209 {
210     X86CPU *cpu = X86_CPU(cs);
211     CPUX86State *env = &cpu->env;
212     struct {
213         struct kvm_msrs info;
214         struct kvm_msr_entry entries[1];
215     } msr_data = {};
216     int ret;
217 
218     if (env->tsc_valid) {
219         return 0;
220     }
221 
222     memset(&msr_data, 0, sizeof(msr_data));
223     msr_data.info.nmsrs = 1;
224     msr_data.entries[0].index = MSR_IA32_TSC;
225     env->tsc_valid = !runstate_is_running();
226 
227     ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_MSRS, &msr_data);
228     if (ret < 0) {
229         return ret;
230     }
231 
232     assert(ret == 1);
233     env->tsc = msr_data.entries[0].data;
234     return 0;
235 }
236 
237 static inline void do_kvm_synchronize_tsc(CPUState *cpu, run_on_cpu_data arg)
238 {
239     kvm_get_tsc(cpu);
240 }
241 
242 void kvm_synchronize_all_tsc(void)
243 {
244     CPUState *cpu;
245 
246     if (kvm_enabled()) {
247         CPU_FOREACH(cpu) {
248             run_on_cpu(cpu, do_kvm_synchronize_tsc, RUN_ON_CPU_NULL);
249         }
250     }
251 }
252 
253 static struct kvm_cpuid2 *try_get_cpuid(KVMState *s, int max)
254 {
255     struct kvm_cpuid2 *cpuid;
256     int r, size;
257 
258     size = sizeof(*cpuid) + max * sizeof(*cpuid->entries);
259     cpuid = g_malloc0(size);
260     cpuid->nent = max;
261     r = kvm_ioctl(s, KVM_GET_SUPPORTED_CPUID, cpuid);
262     if (r == 0 && cpuid->nent >= max) {
263         r = -E2BIG;
264     }
265     if (r < 0) {
266         if (r == -E2BIG) {
267             g_free(cpuid);
268             return NULL;
269         } else {
270             fprintf(stderr, "KVM_GET_SUPPORTED_CPUID failed: %s\n",
271                     strerror(-r));
272             exit(1);
273         }
274     }
275     return cpuid;
276 }
277 
278 /* Run KVM_GET_SUPPORTED_CPUID ioctl(), allocating a buffer large enough
279  * for all entries.
280  */
281 static struct kvm_cpuid2 *get_supported_cpuid(KVMState *s)
282 {
283     struct kvm_cpuid2 *cpuid;
284     int max = 1;
285 
286     if (cpuid_cache != NULL) {
287         return cpuid_cache;
288     }
289     while ((cpuid = try_get_cpuid(s, max)) == NULL) {
290         max *= 2;
291     }
292     cpuid_cache = cpuid;
293     return cpuid;
294 }
295 
296 static bool host_tsx_broken(void)
297 {
298     int family, model, stepping;\
299     char vendor[CPUID_VENDOR_SZ + 1];
300 
301     host_cpu_vendor_fms(vendor, &family, &model, &stepping);
302 
303     /* Check if we are running on a Haswell host known to have broken TSX */
304     return !strcmp(vendor, CPUID_VENDOR_INTEL) &&
305            (family == 6) &&
306            ((model == 63 && stepping < 4) ||
307             model == 60 || model == 69 || model == 70);
308 }
309 
310 /* Returns the value for a specific register on the cpuid entry
311  */
312 static uint32_t cpuid_entry_get_reg(struct kvm_cpuid_entry2 *entry, int reg)
313 {
314     uint32_t ret = 0;
315     switch (reg) {
316     case R_EAX:
317         ret = entry->eax;
318         break;
319     case R_EBX:
320         ret = entry->ebx;
321         break;
322     case R_ECX:
323         ret = entry->ecx;
324         break;
325     case R_EDX:
326         ret = entry->edx;
327         break;
328     }
329     return ret;
330 }
331 
332 /* Find matching entry for function/index on kvm_cpuid2 struct
333  */
334 static struct kvm_cpuid_entry2 *cpuid_find_entry(struct kvm_cpuid2 *cpuid,
335                                                  uint32_t function,
336                                                  uint32_t index)
337 {
338     int i;
339     for (i = 0; i < cpuid->nent; ++i) {
340         if (cpuid->entries[i].function == function &&
341             cpuid->entries[i].index == index) {
342             return &cpuid->entries[i];
343         }
344     }
345     /* not found: */
346     return NULL;
347 }
348 
349 uint32_t kvm_arch_get_supported_cpuid(KVMState *s, uint32_t function,
350                                       uint32_t index, int reg)
351 {
352     struct kvm_cpuid2 *cpuid;
353     uint32_t ret = 0;
354     uint32_t cpuid_1_edx;
355     uint64_t bitmask;
356 
357     cpuid = get_supported_cpuid(s);
358 
359     struct kvm_cpuid_entry2 *entry = cpuid_find_entry(cpuid, function, index);
360     if (entry) {
361         ret = cpuid_entry_get_reg(entry, reg);
362     }
363 
364     /* Fixups for the data returned by KVM, below */
365 
366     if (function == 1 && reg == R_EDX) {
367         /* KVM before 2.6.30 misreports the following features */
368         ret |= CPUID_MTRR | CPUID_PAT | CPUID_MCE | CPUID_MCA;
369     } else if (function == 1 && reg == R_ECX) {
370         /* We can set the hypervisor flag, even if KVM does not return it on
371          * GET_SUPPORTED_CPUID
372          */
373         ret |= CPUID_EXT_HYPERVISOR;
374         /* tsc-deadline flag is not returned by GET_SUPPORTED_CPUID, but it
375          * can be enabled if the kernel has KVM_CAP_TSC_DEADLINE_TIMER,
376          * and the irqchip is in the kernel.
377          */
378         if (kvm_irqchip_in_kernel() &&
379                 kvm_check_extension(s, KVM_CAP_TSC_DEADLINE_TIMER)) {
380             ret |= CPUID_EXT_TSC_DEADLINE_TIMER;
381         }
382 
383         /* x2apic is reported by GET_SUPPORTED_CPUID, but it can't be enabled
384          * without the in-kernel irqchip
385          */
386         if (!kvm_irqchip_in_kernel()) {
387             ret &= ~CPUID_EXT_X2APIC;
388         }
389 
390         if (enable_cpu_pm) {
391             int disable_exits = kvm_check_extension(s,
392                                                     KVM_CAP_X86_DISABLE_EXITS);
393 
394             if (disable_exits & KVM_X86_DISABLE_EXITS_MWAIT) {
395                 ret |= CPUID_EXT_MONITOR;
396             }
397         }
398     } else if (function == 6 && reg == R_EAX) {
399         ret |= CPUID_6_EAX_ARAT; /* safe to allow because of emulated APIC */
400     } else if (function == 7 && index == 0 && reg == R_EBX) {
401         if (host_tsx_broken()) {
402             ret &= ~(CPUID_7_0_EBX_RTM | CPUID_7_0_EBX_HLE);
403         }
404     } else if (function == 7 && index == 0 && reg == R_EDX) {
405         /*
406          * Linux v4.17-v4.20 incorrectly return ARCH_CAPABILITIES on SVM hosts.
407          * We can detect the bug by checking if MSR_IA32_ARCH_CAPABILITIES is
408          * returned by KVM_GET_MSR_INDEX_LIST.
409          */
410         if (!has_msr_arch_capabs) {
411             ret &= ~CPUID_7_0_EDX_ARCH_CAPABILITIES;
412         }
413     } else if (function == 0xd && index == 0 &&
414                (reg == R_EAX || reg == R_EDX)) {
415         /*
416          * The value returned by KVM_GET_SUPPORTED_CPUID does not include
417          * features that still have to be enabled with the arch_prctl
418          * system call.  QEMU needs the full value, which is retrieved
419          * with KVM_GET_DEVICE_ATTR.
420          */
421         struct kvm_device_attr attr = {
422             .group = 0,
423             .attr = KVM_X86_XCOMP_GUEST_SUPP,
424             .addr = (unsigned long) &bitmask
425         };
426 
427         bool sys_attr = kvm_check_extension(s, KVM_CAP_SYS_ATTRIBUTES);
428         if (!sys_attr) {
429             return ret;
430         }
431 
432         int rc = kvm_ioctl(s, KVM_GET_DEVICE_ATTR, &attr);
433         if (rc < 0) {
434             if (rc != -ENXIO) {
435                 warn_report("KVM_GET_DEVICE_ATTR(0, KVM_X86_XCOMP_GUEST_SUPP) "
436                             "error: %d", rc);
437             }
438             return ret;
439         }
440         ret = (reg == R_EAX) ? bitmask : bitmask >> 32;
441     } else if (function == 0x80000001 && reg == R_ECX) {
442         /*
443          * It's safe to enable TOPOEXT even if it's not returned by
444          * GET_SUPPORTED_CPUID.  Unconditionally enabling TOPOEXT here allows
445          * us to keep CPU models including TOPOEXT runnable on older kernels.
446          */
447         ret |= CPUID_EXT3_TOPOEXT;
448     } else if (function == 0x80000001 && reg == R_EDX) {
449         /* On Intel, kvm returns cpuid according to the Intel spec,
450          * so add missing bits according to the AMD spec:
451          */
452         cpuid_1_edx = kvm_arch_get_supported_cpuid(s, 1, 0, R_EDX);
453         ret |= cpuid_1_edx & CPUID_EXT2_AMD_ALIASES;
454     } else if (function == KVM_CPUID_FEATURES && reg == R_EAX) {
455         /* kvm_pv_unhalt is reported by GET_SUPPORTED_CPUID, but it can't
456          * be enabled without the in-kernel irqchip
457          */
458         if (!kvm_irqchip_in_kernel()) {
459             ret &= ~(1U << KVM_FEATURE_PV_UNHALT);
460         }
461         if (kvm_irqchip_is_split()) {
462             ret |= 1U << KVM_FEATURE_MSI_EXT_DEST_ID;
463         }
464     } else if (function == KVM_CPUID_FEATURES && reg == R_EDX) {
465         ret |= 1U << KVM_HINTS_REALTIME;
466     }
467 
468     return ret;
469 }
470 
471 uint64_t kvm_arch_get_supported_msr_feature(KVMState *s, uint32_t index)
472 {
473     struct {
474         struct kvm_msrs info;
475         struct kvm_msr_entry entries[1];
476     } msr_data = {};
477     uint64_t value;
478     uint32_t ret, can_be_one, must_be_one;
479 
480     if (kvm_feature_msrs == NULL) { /* Host doesn't support feature MSRs */
481         return 0;
482     }
483 
484     /* Check if requested MSR is supported feature MSR */
485     int i;
486     for (i = 0; i < kvm_feature_msrs->nmsrs; i++)
487         if (kvm_feature_msrs->indices[i] == index) {
488             break;
489         }
490     if (i == kvm_feature_msrs->nmsrs) {
491         return 0; /* if the feature MSR is not supported, simply return 0 */
492     }
493 
494     msr_data.info.nmsrs = 1;
495     msr_data.entries[0].index = index;
496 
497     ret = kvm_ioctl(s, KVM_GET_MSRS, &msr_data);
498     if (ret != 1) {
499         error_report("KVM get MSR (index=0x%x) feature failed, %s",
500             index, strerror(-ret));
501         exit(1);
502     }
503 
504     value = msr_data.entries[0].data;
505     switch (index) {
506     case MSR_IA32_VMX_PROCBASED_CTLS2:
507         if (!has_msr_vmx_procbased_ctls2) {
508             /* KVM forgot to add these bits for some time, do this ourselves. */
509             if (kvm_arch_get_supported_cpuid(s, 0xD, 1, R_ECX) &
510                 CPUID_XSAVE_XSAVES) {
511                 value |= (uint64_t)VMX_SECONDARY_EXEC_XSAVES << 32;
512             }
513             if (kvm_arch_get_supported_cpuid(s, 1, 0, R_ECX) &
514                 CPUID_EXT_RDRAND) {
515                 value |= (uint64_t)VMX_SECONDARY_EXEC_RDRAND_EXITING << 32;
516             }
517             if (kvm_arch_get_supported_cpuid(s, 7, 0, R_EBX) &
518                 CPUID_7_0_EBX_INVPCID) {
519                 value |= (uint64_t)VMX_SECONDARY_EXEC_ENABLE_INVPCID << 32;
520             }
521             if (kvm_arch_get_supported_cpuid(s, 7, 0, R_EBX) &
522                 CPUID_7_0_EBX_RDSEED) {
523                 value |= (uint64_t)VMX_SECONDARY_EXEC_RDSEED_EXITING << 32;
524             }
525             if (kvm_arch_get_supported_cpuid(s, 0x80000001, 0, R_EDX) &
526                 CPUID_EXT2_RDTSCP) {
527                 value |= (uint64_t)VMX_SECONDARY_EXEC_RDTSCP << 32;
528             }
529         }
530         /* fall through */
531     case MSR_IA32_VMX_TRUE_PINBASED_CTLS:
532     case MSR_IA32_VMX_TRUE_PROCBASED_CTLS:
533     case MSR_IA32_VMX_TRUE_ENTRY_CTLS:
534     case MSR_IA32_VMX_TRUE_EXIT_CTLS:
535         /*
536          * Return true for bits that can be one, but do not have to be one.
537          * The SDM tells us which bits could have a "must be one" setting,
538          * so we can do the opposite transformation in make_vmx_msr_value.
539          */
540         must_be_one = (uint32_t)value;
541         can_be_one = (uint32_t)(value >> 32);
542         return can_be_one & ~must_be_one;
543 
544     default:
545         return value;
546     }
547 }
548 
549 static int kvm_get_mce_cap_supported(KVMState *s, uint64_t *mce_cap,
550                                      int *max_banks)
551 {
552     int r;
553 
554     r = kvm_check_extension(s, KVM_CAP_MCE);
555     if (r > 0) {
556         *max_banks = r;
557         return kvm_ioctl(s, KVM_X86_GET_MCE_CAP_SUPPORTED, mce_cap);
558     }
559     return -ENOSYS;
560 }
561 
562 static void kvm_mce_inject(X86CPU *cpu, hwaddr paddr, int code)
563 {
564     CPUState *cs = CPU(cpu);
565     CPUX86State *env = &cpu->env;
566     uint64_t status = MCI_STATUS_VAL | MCI_STATUS_UC | MCI_STATUS_EN |
567                       MCI_STATUS_MISCV | MCI_STATUS_ADDRV | MCI_STATUS_S;
568     uint64_t mcg_status = MCG_STATUS_MCIP;
569     int flags = 0;
570 
571     if (code == BUS_MCEERR_AR) {
572         status |= MCI_STATUS_AR | 0x134;
573         mcg_status |= MCG_STATUS_RIPV | MCG_STATUS_EIPV;
574     } else {
575         status |= 0xc0;
576         mcg_status |= MCG_STATUS_RIPV;
577     }
578 
579     flags = cpu_x86_support_mca_broadcast(env) ? MCE_INJECT_BROADCAST : 0;
580     /* We need to read back the value of MSR_EXT_MCG_CTL that was set by the
581      * guest kernel back into env->mcg_ext_ctl.
582      */
583     cpu_synchronize_state(cs);
584     if (env->mcg_ext_ctl & MCG_EXT_CTL_LMCE_EN) {
585         mcg_status |= MCG_STATUS_LMCE;
586         flags = 0;
587     }
588 
589     cpu_x86_inject_mce(NULL, cpu, 9, status, mcg_status, paddr,
590                        (MCM_ADDR_PHYS << 6) | 0xc, flags);
591 }
592 
593 static void emit_hypervisor_memory_failure(MemoryFailureAction action, bool ar)
594 {
595     MemoryFailureFlags mff = {.action_required = ar, .recursive = false};
596 
597     qapi_event_send_memory_failure(MEMORY_FAILURE_RECIPIENT_HYPERVISOR, action,
598                                    &mff);
599 }
600 
601 static void hardware_memory_error(void *host_addr)
602 {
603     emit_hypervisor_memory_failure(MEMORY_FAILURE_ACTION_FATAL, true);
604     error_report("QEMU got Hardware memory error at addr %p", host_addr);
605     exit(1);
606 }
607 
608 void kvm_arch_on_sigbus_vcpu(CPUState *c, int code, void *addr)
609 {
610     X86CPU *cpu = X86_CPU(c);
611     CPUX86State *env = &cpu->env;
612     ram_addr_t ram_addr;
613     hwaddr paddr;
614 
615     /* If we get an action required MCE, it has been injected by KVM
616      * while the VM was running.  An action optional MCE instead should
617      * be coming from the main thread, which qemu_init_sigbus identifies
618      * as the "early kill" thread.
619      */
620     assert(code == BUS_MCEERR_AR || code == BUS_MCEERR_AO);
621 
622     if ((env->mcg_cap & MCG_SER_P) && addr) {
623         ram_addr = qemu_ram_addr_from_host(addr);
624         if (ram_addr != RAM_ADDR_INVALID &&
625             kvm_physical_memory_addr_from_host(c->kvm_state, addr, &paddr)) {
626             kvm_hwpoison_page_add(ram_addr);
627             kvm_mce_inject(cpu, paddr, code);
628 
629             /*
630              * Use different logging severity based on error type.
631              * If there is additional MCE reporting on the hypervisor, QEMU VA
632              * could be another source to identify the PA and MCE details.
633              */
634             if (code == BUS_MCEERR_AR) {
635                 error_report("Guest MCE Memory Error at QEMU addr %p and "
636                     "GUEST addr 0x%" HWADDR_PRIx " of type %s injected",
637                     addr, paddr, "BUS_MCEERR_AR");
638             } else {
639                  warn_report("Guest MCE Memory Error at QEMU addr %p and "
640                      "GUEST addr 0x%" HWADDR_PRIx " of type %s injected",
641                      addr, paddr, "BUS_MCEERR_AO");
642             }
643 
644             return;
645         }
646 
647         if (code == BUS_MCEERR_AO) {
648             warn_report("Hardware memory error at addr %p of type %s "
649                 "for memory used by QEMU itself instead of guest system!",
650                  addr, "BUS_MCEERR_AO");
651         }
652     }
653 
654     if (code == BUS_MCEERR_AR) {
655         hardware_memory_error(addr);
656     }
657 
658     /* Hope we are lucky for AO MCE, just notify a event */
659     emit_hypervisor_memory_failure(MEMORY_FAILURE_ACTION_IGNORE, false);
660 }
661 
662 static void kvm_reset_exception(CPUX86State *env)
663 {
664     env->exception_nr = -1;
665     env->exception_pending = 0;
666     env->exception_injected = 0;
667     env->exception_has_payload = false;
668     env->exception_payload = 0;
669 }
670 
671 static void kvm_queue_exception(CPUX86State *env,
672                                 int32_t exception_nr,
673                                 uint8_t exception_has_payload,
674                                 uint64_t exception_payload)
675 {
676     assert(env->exception_nr == -1);
677     assert(!env->exception_pending);
678     assert(!env->exception_injected);
679     assert(!env->exception_has_payload);
680 
681     env->exception_nr = exception_nr;
682 
683     if (has_exception_payload) {
684         env->exception_pending = 1;
685 
686         env->exception_has_payload = exception_has_payload;
687         env->exception_payload = exception_payload;
688     } else {
689         env->exception_injected = 1;
690 
691         if (exception_nr == EXCP01_DB) {
692             assert(exception_has_payload);
693             env->dr[6] = exception_payload;
694         } else if (exception_nr == EXCP0E_PAGE) {
695             assert(exception_has_payload);
696             env->cr[2] = exception_payload;
697         } else {
698             assert(!exception_has_payload);
699         }
700     }
701 }
702 
703 static int kvm_inject_mce_oldstyle(X86CPU *cpu)
704 {
705     CPUX86State *env = &cpu->env;
706 
707     if (!kvm_has_vcpu_events() && env->exception_nr == EXCP12_MCHK) {
708         unsigned int bank, bank_num = env->mcg_cap & 0xff;
709         struct kvm_x86_mce mce;
710 
711         kvm_reset_exception(env);
712 
713         /*
714          * There must be at least one bank in use if an MCE is pending.
715          * Find it and use its values for the event injection.
716          */
717         for (bank = 0; bank < bank_num; bank++) {
718             if (env->mce_banks[bank * 4 + 1] & MCI_STATUS_VAL) {
719                 break;
720             }
721         }
722         assert(bank < bank_num);
723 
724         mce.bank = bank;
725         mce.status = env->mce_banks[bank * 4 + 1];
726         mce.mcg_status = env->mcg_status;
727         mce.addr = env->mce_banks[bank * 4 + 2];
728         mce.misc = env->mce_banks[bank * 4 + 3];
729 
730         return kvm_vcpu_ioctl(CPU(cpu), KVM_X86_SET_MCE, &mce);
731     }
732     return 0;
733 }
734 
735 static void cpu_update_state(void *opaque, bool running, RunState state)
736 {
737     CPUX86State *env = opaque;
738 
739     if (running) {
740         env->tsc_valid = false;
741     }
742 }
743 
744 unsigned long kvm_arch_vcpu_id(CPUState *cs)
745 {
746     X86CPU *cpu = X86_CPU(cs);
747     return cpu->apic_id;
748 }
749 
750 #ifndef KVM_CPUID_SIGNATURE_NEXT
751 #define KVM_CPUID_SIGNATURE_NEXT                0x40000100
752 #endif
753 
754 static bool hyperv_enabled(X86CPU *cpu)
755 {
756     return kvm_check_extension(kvm_state, KVM_CAP_HYPERV) > 0 &&
757         ((cpu->hyperv_spinlock_attempts != HYPERV_SPINLOCK_NEVER_NOTIFY) ||
758          cpu->hyperv_features || cpu->hyperv_passthrough);
759 }
760 
761 /*
762  * Check whether target_freq is within conservative
763  * ntp correctable bounds (250ppm) of freq
764  */
765 static inline bool freq_within_bounds(int freq, int target_freq)
766 {
767         int max_freq = freq + (freq * 250 / 1000000);
768         int min_freq = freq - (freq * 250 / 1000000);
769 
770         if (target_freq >= min_freq && target_freq <= max_freq) {
771                 return true;
772         }
773 
774         return false;
775 }
776 
777 static int kvm_arch_set_tsc_khz(CPUState *cs)
778 {
779     X86CPU *cpu = X86_CPU(cs);
780     CPUX86State *env = &cpu->env;
781     int r, cur_freq;
782     bool set_ioctl = false;
783 
784     if (!env->tsc_khz) {
785         return 0;
786     }
787 
788     cur_freq = kvm_check_extension(cs->kvm_state, KVM_CAP_GET_TSC_KHZ) ?
789                kvm_vcpu_ioctl(cs, KVM_GET_TSC_KHZ) : -ENOTSUP;
790 
791     /*
792      * If TSC scaling is supported, attempt to set TSC frequency.
793      */
794     if (kvm_check_extension(cs->kvm_state, KVM_CAP_TSC_CONTROL)) {
795         set_ioctl = true;
796     }
797 
798     /*
799      * If desired TSC frequency is within bounds of NTP correction,
800      * attempt to set TSC frequency.
801      */
802     if (cur_freq != -ENOTSUP && freq_within_bounds(cur_freq, env->tsc_khz)) {
803         set_ioctl = true;
804     }
805 
806     r = set_ioctl ?
807         kvm_vcpu_ioctl(cs, KVM_SET_TSC_KHZ, env->tsc_khz) :
808         -ENOTSUP;
809 
810     if (r < 0) {
811         /* When KVM_SET_TSC_KHZ fails, it's an error only if the current
812          * TSC frequency doesn't match the one we want.
813          */
814         cur_freq = kvm_check_extension(cs->kvm_state, KVM_CAP_GET_TSC_KHZ) ?
815                    kvm_vcpu_ioctl(cs, KVM_GET_TSC_KHZ) :
816                    -ENOTSUP;
817         if (cur_freq <= 0 || cur_freq != env->tsc_khz) {
818             warn_report("TSC frequency mismatch between "
819                         "VM (%" PRId64 " kHz) and host (%d kHz), "
820                         "and TSC scaling unavailable",
821                         env->tsc_khz, cur_freq);
822             return r;
823         }
824     }
825 
826     return 0;
827 }
828 
829 static bool tsc_is_stable_and_known(CPUX86State *env)
830 {
831     if (!env->tsc_khz) {
832         return false;
833     }
834     return (env->features[FEAT_8000_0007_EDX] & CPUID_APM_INVTSC)
835         || env->user_tsc_khz;
836 }
837 
838 static struct {
839     const char *desc;
840     struct {
841         uint32_t func;
842         int reg;
843         uint32_t bits;
844     } flags[2];
845     uint64_t dependencies;
846 } kvm_hyperv_properties[] = {
847     [HYPERV_FEAT_RELAXED] = {
848         .desc = "relaxed timing (hv-relaxed)",
849         .flags = {
850             {.func = HV_CPUID_ENLIGHTMENT_INFO, .reg = R_EAX,
851              .bits = HV_RELAXED_TIMING_RECOMMENDED}
852         }
853     },
854     [HYPERV_FEAT_VAPIC] = {
855         .desc = "virtual APIC (hv-vapic)",
856         .flags = {
857             {.func = HV_CPUID_FEATURES, .reg = R_EAX,
858              .bits = HV_APIC_ACCESS_AVAILABLE}
859         }
860     },
861     [HYPERV_FEAT_TIME] = {
862         .desc = "clocksources (hv-time)",
863         .flags = {
864             {.func = HV_CPUID_FEATURES, .reg = R_EAX,
865              .bits = HV_TIME_REF_COUNT_AVAILABLE | HV_REFERENCE_TSC_AVAILABLE}
866         }
867     },
868     [HYPERV_FEAT_CRASH] = {
869         .desc = "crash MSRs (hv-crash)",
870         .flags = {
871             {.func = HV_CPUID_FEATURES, .reg = R_EDX,
872              .bits = HV_GUEST_CRASH_MSR_AVAILABLE}
873         }
874     },
875     [HYPERV_FEAT_RESET] = {
876         .desc = "reset MSR (hv-reset)",
877         .flags = {
878             {.func = HV_CPUID_FEATURES, .reg = R_EAX,
879              .bits = HV_RESET_AVAILABLE}
880         }
881     },
882     [HYPERV_FEAT_VPINDEX] = {
883         .desc = "VP_INDEX MSR (hv-vpindex)",
884         .flags = {
885             {.func = HV_CPUID_FEATURES, .reg = R_EAX,
886              .bits = HV_VP_INDEX_AVAILABLE}
887         }
888     },
889     [HYPERV_FEAT_RUNTIME] = {
890         .desc = "VP_RUNTIME MSR (hv-runtime)",
891         .flags = {
892             {.func = HV_CPUID_FEATURES, .reg = R_EAX,
893              .bits = HV_VP_RUNTIME_AVAILABLE}
894         }
895     },
896     [HYPERV_FEAT_SYNIC] = {
897         .desc = "synthetic interrupt controller (hv-synic)",
898         .flags = {
899             {.func = HV_CPUID_FEATURES, .reg = R_EAX,
900              .bits = HV_SYNIC_AVAILABLE}
901         }
902     },
903     [HYPERV_FEAT_STIMER] = {
904         .desc = "synthetic timers (hv-stimer)",
905         .flags = {
906             {.func = HV_CPUID_FEATURES, .reg = R_EAX,
907              .bits = HV_SYNTIMERS_AVAILABLE}
908         },
909         .dependencies = BIT(HYPERV_FEAT_SYNIC) | BIT(HYPERV_FEAT_TIME)
910     },
911     [HYPERV_FEAT_FREQUENCIES] = {
912         .desc = "frequency MSRs (hv-frequencies)",
913         .flags = {
914             {.func = HV_CPUID_FEATURES, .reg = R_EAX,
915              .bits = HV_ACCESS_FREQUENCY_MSRS},
916             {.func = HV_CPUID_FEATURES, .reg = R_EDX,
917              .bits = HV_FREQUENCY_MSRS_AVAILABLE}
918         }
919     },
920     [HYPERV_FEAT_REENLIGHTENMENT] = {
921         .desc = "reenlightenment MSRs (hv-reenlightenment)",
922         .flags = {
923             {.func = HV_CPUID_FEATURES, .reg = R_EAX,
924              .bits = HV_ACCESS_REENLIGHTENMENTS_CONTROL}
925         }
926     },
927     [HYPERV_FEAT_TLBFLUSH] = {
928         .desc = "paravirtualized TLB flush (hv-tlbflush)",
929         .flags = {
930             {.func = HV_CPUID_ENLIGHTMENT_INFO, .reg = R_EAX,
931              .bits = HV_REMOTE_TLB_FLUSH_RECOMMENDED |
932              HV_EX_PROCESSOR_MASKS_RECOMMENDED}
933         },
934         .dependencies = BIT(HYPERV_FEAT_VPINDEX)
935     },
936     [HYPERV_FEAT_EVMCS] = {
937         .desc = "enlightened VMCS (hv-evmcs)",
938         .flags = {
939             {.func = HV_CPUID_ENLIGHTMENT_INFO, .reg = R_EAX,
940              .bits = HV_ENLIGHTENED_VMCS_RECOMMENDED}
941         },
942         .dependencies = BIT(HYPERV_FEAT_VAPIC)
943     },
944     [HYPERV_FEAT_IPI] = {
945         .desc = "paravirtualized IPI (hv-ipi)",
946         .flags = {
947             {.func = HV_CPUID_ENLIGHTMENT_INFO, .reg = R_EAX,
948              .bits = HV_CLUSTER_IPI_RECOMMENDED |
949              HV_EX_PROCESSOR_MASKS_RECOMMENDED}
950         },
951         .dependencies = BIT(HYPERV_FEAT_VPINDEX)
952     },
953     [HYPERV_FEAT_STIMER_DIRECT] = {
954         .desc = "direct mode synthetic timers (hv-stimer-direct)",
955         .flags = {
956             {.func = HV_CPUID_FEATURES, .reg = R_EDX,
957              .bits = HV_STIMER_DIRECT_MODE_AVAILABLE}
958         },
959         .dependencies = BIT(HYPERV_FEAT_STIMER)
960     },
961     [HYPERV_FEAT_AVIC] = {
962         .desc = "AVIC/APICv support (hv-avic/hv-apicv)",
963         .flags = {
964             {.func = HV_CPUID_ENLIGHTMENT_INFO, .reg = R_EAX,
965              .bits = HV_DEPRECATING_AEOI_RECOMMENDED}
966         }
967     },
968     [HYPERV_FEAT_SYNDBG] = {
969         .desc = "Enable synthetic kernel debugger channel (hv-syndbg)",
970         .flags = {
971             {.func = HV_CPUID_FEATURES, .reg = R_EDX,
972              .bits = HV_FEATURE_DEBUG_MSRS_AVAILABLE}
973         },
974         .dependencies = BIT(HYPERV_FEAT_SYNIC) | BIT(HYPERV_FEAT_RELAXED)
975     },
976 };
977 
978 static struct kvm_cpuid2 *try_get_hv_cpuid(CPUState *cs, int max,
979                                            bool do_sys_ioctl)
980 {
981     struct kvm_cpuid2 *cpuid;
982     int r, size;
983 
984     size = sizeof(*cpuid) + max * sizeof(*cpuid->entries);
985     cpuid = g_malloc0(size);
986     cpuid->nent = max;
987 
988     if (do_sys_ioctl) {
989         r = kvm_ioctl(kvm_state, KVM_GET_SUPPORTED_HV_CPUID, cpuid);
990     } else {
991         r = kvm_vcpu_ioctl(cs, KVM_GET_SUPPORTED_HV_CPUID, cpuid);
992     }
993     if (r == 0 && cpuid->nent >= max) {
994         r = -E2BIG;
995     }
996     if (r < 0) {
997         if (r == -E2BIG) {
998             g_free(cpuid);
999             return NULL;
1000         } else {
1001             fprintf(stderr, "KVM_GET_SUPPORTED_HV_CPUID failed: %s\n",
1002                     strerror(-r));
1003             exit(1);
1004         }
1005     }
1006     return cpuid;
1007 }
1008 
1009 /*
1010  * Run KVM_GET_SUPPORTED_HV_CPUID ioctl(), allocating a buffer large enough
1011  * for all entries.
1012  */
1013 static struct kvm_cpuid2 *get_supported_hv_cpuid(CPUState *cs)
1014 {
1015     struct kvm_cpuid2 *cpuid;
1016     /* 0x40000000..0x40000005, 0x4000000A, 0x40000080..0x40000082 leaves */
1017     int max = 11;
1018     int i;
1019     bool do_sys_ioctl;
1020 
1021     do_sys_ioctl =
1022         kvm_check_extension(kvm_state, KVM_CAP_SYS_HYPERV_CPUID) > 0;
1023 
1024     /*
1025      * Non-empty KVM context is needed when KVM_CAP_SYS_HYPERV_CPUID is
1026      * unsupported, kvm_hyperv_expand_features() checks for that.
1027      */
1028     assert(do_sys_ioctl || cs->kvm_state);
1029 
1030     /*
1031      * When the buffer is too small, KVM_GET_SUPPORTED_HV_CPUID fails with
1032      * -E2BIG, however, it doesn't report back the right size. Keep increasing
1033      * it and re-trying until we succeed.
1034      */
1035     while ((cpuid = try_get_hv_cpuid(cs, max, do_sys_ioctl)) == NULL) {
1036         max++;
1037     }
1038 
1039     /*
1040      * KVM_GET_SUPPORTED_HV_CPUID does not set EVMCS CPUID bit before
1041      * KVM_CAP_HYPERV_ENLIGHTENED_VMCS is enabled but we want to get the
1042      * information early, just check for the capability and set the bit
1043      * manually.
1044      */
1045     if (!do_sys_ioctl && kvm_check_extension(cs->kvm_state,
1046                             KVM_CAP_HYPERV_ENLIGHTENED_VMCS) > 0) {
1047         for (i = 0; i < cpuid->nent; i++) {
1048             if (cpuid->entries[i].function == HV_CPUID_ENLIGHTMENT_INFO) {
1049                 cpuid->entries[i].eax |= HV_ENLIGHTENED_VMCS_RECOMMENDED;
1050             }
1051         }
1052     }
1053 
1054     return cpuid;
1055 }
1056 
1057 /*
1058  * When KVM_GET_SUPPORTED_HV_CPUID is not supported we fill CPUID feature
1059  * leaves from KVM_CAP_HYPERV* and present MSRs data.
1060  */
1061 static struct kvm_cpuid2 *get_supported_hv_cpuid_legacy(CPUState *cs)
1062 {
1063     X86CPU *cpu = X86_CPU(cs);
1064     struct kvm_cpuid2 *cpuid;
1065     struct kvm_cpuid_entry2 *entry_feat, *entry_recomm;
1066 
1067     /* HV_CPUID_FEATURES, HV_CPUID_ENLIGHTMENT_INFO */
1068     cpuid = g_malloc0(sizeof(*cpuid) + 2 * sizeof(*cpuid->entries));
1069     cpuid->nent = 2;
1070 
1071     /* HV_CPUID_VENDOR_AND_MAX_FUNCTIONS */
1072     entry_feat = &cpuid->entries[0];
1073     entry_feat->function = HV_CPUID_FEATURES;
1074 
1075     entry_recomm = &cpuid->entries[1];
1076     entry_recomm->function = HV_CPUID_ENLIGHTMENT_INFO;
1077     entry_recomm->ebx = cpu->hyperv_spinlock_attempts;
1078 
1079     if (kvm_check_extension(cs->kvm_state, KVM_CAP_HYPERV) > 0) {
1080         entry_feat->eax |= HV_HYPERCALL_AVAILABLE;
1081         entry_feat->eax |= HV_APIC_ACCESS_AVAILABLE;
1082         entry_feat->edx |= HV_CPU_DYNAMIC_PARTITIONING_AVAILABLE;
1083         entry_recomm->eax |= HV_RELAXED_TIMING_RECOMMENDED;
1084         entry_recomm->eax |= HV_APIC_ACCESS_RECOMMENDED;
1085     }
1086 
1087     if (kvm_check_extension(cs->kvm_state, KVM_CAP_HYPERV_TIME) > 0) {
1088         entry_feat->eax |= HV_TIME_REF_COUNT_AVAILABLE;
1089         entry_feat->eax |= HV_REFERENCE_TSC_AVAILABLE;
1090     }
1091 
1092     if (has_msr_hv_frequencies) {
1093         entry_feat->eax |= HV_ACCESS_FREQUENCY_MSRS;
1094         entry_feat->edx |= HV_FREQUENCY_MSRS_AVAILABLE;
1095     }
1096 
1097     if (has_msr_hv_crash) {
1098         entry_feat->edx |= HV_GUEST_CRASH_MSR_AVAILABLE;
1099     }
1100 
1101     if (has_msr_hv_reenlightenment) {
1102         entry_feat->eax |= HV_ACCESS_REENLIGHTENMENTS_CONTROL;
1103     }
1104 
1105     if (has_msr_hv_reset) {
1106         entry_feat->eax |= HV_RESET_AVAILABLE;
1107     }
1108 
1109     if (has_msr_hv_vpindex) {
1110         entry_feat->eax |= HV_VP_INDEX_AVAILABLE;
1111     }
1112 
1113     if (has_msr_hv_runtime) {
1114         entry_feat->eax |= HV_VP_RUNTIME_AVAILABLE;
1115     }
1116 
1117     if (has_msr_hv_synic) {
1118         unsigned int cap = cpu->hyperv_synic_kvm_only ?
1119             KVM_CAP_HYPERV_SYNIC : KVM_CAP_HYPERV_SYNIC2;
1120 
1121         if (kvm_check_extension(cs->kvm_state, cap) > 0) {
1122             entry_feat->eax |= HV_SYNIC_AVAILABLE;
1123         }
1124     }
1125 
1126     if (has_msr_hv_stimer) {
1127         entry_feat->eax |= HV_SYNTIMERS_AVAILABLE;
1128     }
1129 
1130     if (has_msr_hv_syndbg_options) {
1131         entry_feat->edx |= HV_GUEST_DEBUGGING_AVAILABLE;
1132         entry_feat->edx |= HV_FEATURE_DEBUG_MSRS_AVAILABLE;
1133         entry_feat->ebx |= HV_PARTITION_DEBUGGING_ALLOWED;
1134     }
1135 
1136     if (kvm_check_extension(cs->kvm_state,
1137                             KVM_CAP_HYPERV_TLBFLUSH) > 0) {
1138         entry_recomm->eax |= HV_REMOTE_TLB_FLUSH_RECOMMENDED;
1139         entry_recomm->eax |= HV_EX_PROCESSOR_MASKS_RECOMMENDED;
1140     }
1141 
1142     if (kvm_check_extension(cs->kvm_state,
1143                             KVM_CAP_HYPERV_ENLIGHTENED_VMCS) > 0) {
1144         entry_recomm->eax |= HV_ENLIGHTENED_VMCS_RECOMMENDED;
1145     }
1146 
1147     if (kvm_check_extension(cs->kvm_state,
1148                             KVM_CAP_HYPERV_SEND_IPI) > 0) {
1149         entry_recomm->eax |= HV_CLUSTER_IPI_RECOMMENDED;
1150         entry_recomm->eax |= HV_EX_PROCESSOR_MASKS_RECOMMENDED;
1151     }
1152 
1153     return cpuid;
1154 }
1155 
1156 static uint32_t hv_cpuid_get_host(CPUState *cs, uint32_t func, int reg)
1157 {
1158     struct kvm_cpuid_entry2 *entry;
1159     struct kvm_cpuid2 *cpuid;
1160 
1161     if (hv_cpuid_cache) {
1162         cpuid = hv_cpuid_cache;
1163     } else {
1164         if (kvm_check_extension(kvm_state, KVM_CAP_HYPERV_CPUID) > 0) {
1165             cpuid = get_supported_hv_cpuid(cs);
1166         } else {
1167             /*
1168              * 'cs->kvm_state' may be NULL when Hyper-V features are expanded
1169              * before KVM context is created but this is only done when
1170              * KVM_CAP_SYS_HYPERV_CPUID is supported and it implies
1171              * KVM_CAP_HYPERV_CPUID.
1172              */
1173             assert(cs->kvm_state);
1174 
1175             cpuid = get_supported_hv_cpuid_legacy(cs);
1176         }
1177         hv_cpuid_cache = cpuid;
1178     }
1179 
1180     if (!cpuid) {
1181         return 0;
1182     }
1183 
1184     entry = cpuid_find_entry(cpuid, func, 0);
1185     if (!entry) {
1186         return 0;
1187     }
1188 
1189     return cpuid_entry_get_reg(entry, reg);
1190 }
1191 
1192 static bool hyperv_feature_supported(CPUState *cs, int feature)
1193 {
1194     uint32_t func, bits;
1195     int i, reg;
1196 
1197     for (i = 0; i < ARRAY_SIZE(kvm_hyperv_properties[feature].flags); i++) {
1198 
1199         func = kvm_hyperv_properties[feature].flags[i].func;
1200         reg = kvm_hyperv_properties[feature].flags[i].reg;
1201         bits = kvm_hyperv_properties[feature].flags[i].bits;
1202 
1203         if (!func) {
1204             continue;
1205         }
1206 
1207         if ((hv_cpuid_get_host(cs, func, reg) & bits) != bits) {
1208             return false;
1209         }
1210     }
1211 
1212     return true;
1213 }
1214 
1215 /* Checks that all feature dependencies are enabled */
1216 static bool hv_feature_check_deps(X86CPU *cpu, int feature, Error **errp)
1217 {
1218     uint64_t deps;
1219     int dep_feat;
1220 
1221     deps = kvm_hyperv_properties[feature].dependencies;
1222     while (deps) {
1223         dep_feat = ctz64(deps);
1224         if (!(hyperv_feat_enabled(cpu, dep_feat))) {
1225             error_setg(errp, "Hyper-V %s requires Hyper-V %s",
1226                        kvm_hyperv_properties[feature].desc,
1227                        kvm_hyperv_properties[dep_feat].desc);
1228             return false;
1229         }
1230         deps &= ~(1ull << dep_feat);
1231     }
1232 
1233     return true;
1234 }
1235 
1236 static uint32_t hv_build_cpuid_leaf(CPUState *cs, uint32_t func, int reg)
1237 {
1238     X86CPU *cpu = X86_CPU(cs);
1239     uint32_t r = 0;
1240     int i, j;
1241 
1242     for (i = 0; i < ARRAY_SIZE(kvm_hyperv_properties); i++) {
1243         if (!hyperv_feat_enabled(cpu, i)) {
1244             continue;
1245         }
1246 
1247         for (j = 0; j < ARRAY_SIZE(kvm_hyperv_properties[i].flags); j++) {
1248             if (kvm_hyperv_properties[i].flags[j].func != func) {
1249                 continue;
1250             }
1251             if (kvm_hyperv_properties[i].flags[j].reg != reg) {
1252                 continue;
1253             }
1254 
1255             r |= kvm_hyperv_properties[i].flags[j].bits;
1256         }
1257     }
1258 
1259     return r;
1260 }
1261 
1262 /*
1263  * Expand Hyper-V CPU features. In partucular, check that all the requested
1264  * features are supported by the host and the sanity of the configuration
1265  * (that all the required dependencies are included). Also, this takes care
1266  * of 'hv_passthrough' mode and fills the environment with all supported
1267  * Hyper-V features.
1268  */
1269 bool kvm_hyperv_expand_features(X86CPU *cpu, Error **errp)
1270 {
1271     CPUState *cs = CPU(cpu);
1272     Error *local_err = NULL;
1273     int feat;
1274 
1275     if (!hyperv_enabled(cpu))
1276         return true;
1277 
1278     /*
1279      * When kvm_hyperv_expand_features is called at CPU feature expansion
1280      * time per-CPU kvm_state is not available yet so we can only proceed
1281      * when KVM_CAP_SYS_HYPERV_CPUID is supported.
1282      */
1283     if (!cs->kvm_state &&
1284         !kvm_check_extension(kvm_state, KVM_CAP_SYS_HYPERV_CPUID))
1285         return true;
1286 
1287     if (cpu->hyperv_passthrough) {
1288         cpu->hyperv_vendor_id[0] =
1289             hv_cpuid_get_host(cs, HV_CPUID_VENDOR_AND_MAX_FUNCTIONS, R_EBX);
1290         cpu->hyperv_vendor_id[1] =
1291             hv_cpuid_get_host(cs, HV_CPUID_VENDOR_AND_MAX_FUNCTIONS, R_ECX);
1292         cpu->hyperv_vendor_id[2] =
1293             hv_cpuid_get_host(cs, HV_CPUID_VENDOR_AND_MAX_FUNCTIONS, R_EDX);
1294         cpu->hyperv_vendor = g_realloc(cpu->hyperv_vendor,
1295                                        sizeof(cpu->hyperv_vendor_id) + 1);
1296         memcpy(cpu->hyperv_vendor, cpu->hyperv_vendor_id,
1297                sizeof(cpu->hyperv_vendor_id));
1298         cpu->hyperv_vendor[sizeof(cpu->hyperv_vendor_id)] = 0;
1299 
1300         cpu->hyperv_interface_id[0] =
1301             hv_cpuid_get_host(cs, HV_CPUID_INTERFACE, R_EAX);
1302         cpu->hyperv_interface_id[1] =
1303             hv_cpuid_get_host(cs, HV_CPUID_INTERFACE, R_EBX);
1304         cpu->hyperv_interface_id[2] =
1305             hv_cpuid_get_host(cs, HV_CPUID_INTERFACE, R_ECX);
1306         cpu->hyperv_interface_id[3] =
1307             hv_cpuid_get_host(cs, HV_CPUID_INTERFACE, R_EDX);
1308 
1309         cpu->hyperv_ver_id_build =
1310             hv_cpuid_get_host(cs, HV_CPUID_VERSION, R_EAX);
1311         cpu->hyperv_ver_id_major =
1312             hv_cpuid_get_host(cs, HV_CPUID_VERSION, R_EBX) >> 16;
1313         cpu->hyperv_ver_id_minor =
1314             hv_cpuid_get_host(cs, HV_CPUID_VERSION, R_EBX) & 0xffff;
1315         cpu->hyperv_ver_id_sp =
1316             hv_cpuid_get_host(cs, HV_CPUID_VERSION, R_ECX);
1317         cpu->hyperv_ver_id_sb =
1318             hv_cpuid_get_host(cs, HV_CPUID_VERSION, R_EDX) >> 24;
1319         cpu->hyperv_ver_id_sn =
1320             hv_cpuid_get_host(cs, HV_CPUID_VERSION, R_EDX) & 0xffffff;
1321 
1322         cpu->hv_max_vps = hv_cpuid_get_host(cs, HV_CPUID_IMPLEMENT_LIMITS,
1323                                             R_EAX);
1324         cpu->hyperv_limits[0] =
1325             hv_cpuid_get_host(cs, HV_CPUID_IMPLEMENT_LIMITS, R_EBX);
1326         cpu->hyperv_limits[1] =
1327             hv_cpuid_get_host(cs, HV_CPUID_IMPLEMENT_LIMITS, R_ECX);
1328         cpu->hyperv_limits[2] =
1329             hv_cpuid_get_host(cs, HV_CPUID_IMPLEMENT_LIMITS, R_EDX);
1330 
1331         cpu->hyperv_spinlock_attempts =
1332             hv_cpuid_get_host(cs, HV_CPUID_ENLIGHTMENT_INFO, R_EBX);
1333 
1334         /*
1335          * Mark feature as enabled in 'cpu->hyperv_features' as
1336          * hv_build_cpuid_leaf() uses this info to build guest CPUIDs.
1337          */
1338         for (feat = 0; feat < ARRAY_SIZE(kvm_hyperv_properties); feat++) {
1339             if (hyperv_feature_supported(cs, feat)) {
1340                 cpu->hyperv_features |= BIT(feat);
1341             }
1342         }
1343     } else {
1344         /* Check features availability and dependencies */
1345         for (feat = 0; feat < ARRAY_SIZE(kvm_hyperv_properties); feat++) {
1346             /* If the feature was not requested skip it. */
1347             if (!hyperv_feat_enabled(cpu, feat)) {
1348                 continue;
1349             }
1350 
1351             /* Check if the feature is supported by KVM */
1352             if (!hyperv_feature_supported(cs, feat)) {
1353                 error_setg(errp, "Hyper-V %s is not supported by kernel",
1354                            kvm_hyperv_properties[feat].desc);
1355                 return false;
1356             }
1357 
1358             /* Check dependencies */
1359             if (!hv_feature_check_deps(cpu, feat, &local_err)) {
1360                 error_propagate(errp, local_err);
1361                 return false;
1362             }
1363         }
1364     }
1365 
1366     /* Additional dependencies not covered by kvm_hyperv_properties[] */
1367     if (hyperv_feat_enabled(cpu, HYPERV_FEAT_SYNIC) &&
1368         !cpu->hyperv_synic_kvm_only &&
1369         !hyperv_feat_enabled(cpu, HYPERV_FEAT_VPINDEX)) {
1370         error_setg(errp, "Hyper-V %s requires Hyper-V %s",
1371                    kvm_hyperv_properties[HYPERV_FEAT_SYNIC].desc,
1372                    kvm_hyperv_properties[HYPERV_FEAT_VPINDEX].desc);
1373         return false;
1374     }
1375 
1376     return true;
1377 }
1378 
1379 /*
1380  * Fill in Hyper-V CPUIDs. Returns the number of entries filled in cpuid_ent.
1381  */
1382 static int hyperv_fill_cpuids(CPUState *cs,
1383                               struct kvm_cpuid_entry2 *cpuid_ent)
1384 {
1385     X86CPU *cpu = X86_CPU(cs);
1386     struct kvm_cpuid_entry2 *c;
1387     uint32_t signature[3];
1388     uint32_t cpuid_i = 0, max_cpuid_leaf = 0;
1389 
1390     max_cpuid_leaf = HV_CPUID_IMPLEMENT_LIMITS;
1391     if (hyperv_feat_enabled(cpu, HYPERV_FEAT_EVMCS)) {
1392         max_cpuid_leaf = MAX(max_cpuid_leaf, HV_CPUID_NESTED_FEATURES);
1393     }
1394 
1395     if (hyperv_feat_enabled(cpu, HYPERV_FEAT_SYNDBG)) {
1396         max_cpuid_leaf =
1397             MAX(max_cpuid_leaf, HV_CPUID_SYNDBG_PLATFORM_CAPABILITIES);
1398     }
1399 
1400     c = &cpuid_ent[cpuid_i++];
1401     c->function = HV_CPUID_VENDOR_AND_MAX_FUNCTIONS;
1402     c->eax = max_cpuid_leaf;
1403     c->ebx = cpu->hyperv_vendor_id[0];
1404     c->ecx = cpu->hyperv_vendor_id[1];
1405     c->edx = cpu->hyperv_vendor_id[2];
1406 
1407     c = &cpuid_ent[cpuid_i++];
1408     c->function = HV_CPUID_INTERFACE;
1409     c->eax = cpu->hyperv_interface_id[0];
1410     c->ebx = cpu->hyperv_interface_id[1];
1411     c->ecx = cpu->hyperv_interface_id[2];
1412     c->edx = cpu->hyperv_interface_id[3];
1413 
1414     c = &cpuid_ent[cpuid_i++];
1415     c->function = HV_CPUID_VERSION;
1416     c->eax = cpu->hyperv_ver_id_build;
1417     c->ebx = (uint32_t)cpu->hyperv_ver_id_major << 16 |
1418         cpu->hyperv_ver_id_minor;
1419     c->ecx = cpu->hyperv_ver_id_sp;
1420     c->edx = (uint32_t)cpu->hyperv_ver_id_sb << 24 |
1421         (cpu->hyperv_ver_id_sn & 0xffffff);
1422 
1423     c = &cpuid_ent[cpuid_i++];
1424     c->function = HV_CPUID_FEATURES;
1425     c->eax = hv_build_cpuid_leaf(cs, HV_CPUID_FEATURES, R_EAX);
1426     c->ebx = hv_build_cpuid_leaf(cs, HV_CPUID_FEATURES, R_EBX);
1427     c->edx = hv_build_cpuid_leaf(cs, HV_CPUID_FEATURES, R_EDX);
1428 
1429     /* Unconditionally required with any Hyper-V enlightenment */
1430     c->eax |= HV_HYPERCALL_AVAILABLE;
1431 
1432     /* SynIC and Vmbus devices require messages/signals hypercalls */
1433     if (hyperv_feat_enabled(cpu, HYPERV_FEAT_SYNIC) &&
1434         !cpu->hyperv_synic_kvm_only) {
1435         c->ebx |= HV_POST_MESSAGES | HV_SIGNAL_EVENTS;
1436     }
1437 
1438 
1439     /* Not exposed by KVM but needed to make CPU hotplug in Windows work */
1440     c->edx |= HV_CPU_DYNAMIC_PARTITIONING_AVAILABLE;
1441 
1442     c = &cpuid_ent[cpuid_i++];
1443     c->function = HV_CPUID_ENLIGHTMENT_INFO;
1444     c->eax = hv_build_cpuid_leaf(cs, HV_CPUID_ENLIGHTMENT_INFO, R_EAX);
1445     c->ebx = cpu->hyperv_spinlock_attempts;
1446 
1447     if (hyperv_feat_enabled(cpu, HYPERV_FEAT_VAPIC) &&
1448         !hyperv_feat_enabled(cpu, HYPERV_FEAT_AVIC)) {
1449         c->eax |= HV_APIC_ACCESS_RECOMMENDED;
1450     }
1451 
1452     if (cpu->hyperv_no_nonarch_cs == ON_OFF_AUTO_ON) {
1453         c->eax |= HV_NO_NONARCH_CORESHARING;
1454     } else if (cpu->hyperv_no_nonarch_cs == ON_OFF_AUTO_AUTO) {
1455         c->eax |= hv_cpuid_get_host(cs, HV_CPUID_ENLIGHTMENT_INFO, R_EAX) &
1456             HV_NO_NONARCH_CORESHARING;
1457     }
1458 
1459     c = &cpuid_ent[cpuid_i++];
1460     c->function = HV_CPUID_IMPLEMENT_LIMITS;
1461     c->eax = cpu->hv_max_vps;
1462     c->ebx = cpu->hyperv_limits[0];
1463     c->ecx = cpu->hyperv_limits[1];
1464     c->edx = cpu->hyperv_limits[2];
1465 
1466     if (hyperv_feat_enabled(cpu, HYPERV_FEAT_EVMCS)) {
1467         uint32_t function;
1468 
1469         /* Create zeroed 0x40000006..0x40000009 leaves */
1470         for (function = HV_CPUID_IMPLEMENT_LIMITS + 1;
1471              function < HV_CPUID_NESTED_FEATURES; function++) {
1472             c = &cpuid_ent[cpuid_i++];
1473             c->function = function;
1474         }
1475 
1476         c = &cpuid_ent[cpuid_i++];
1477         c->function = HV_CPUID_NESTED_FEATURES;
1478         c->eax = cpu->hyperv_nested[0];
1479     }
1480 
1481     if (hyperv_feat_enabled(cpu, HYPERV_FEAT_SYNDBG)) {
1482         c = &cpuid_ent[cpuid_i++];
1483         c->function = HV_CPUID_SYNDBG_VENDOR_AND_MAX_FUNCTIONS;
1484         c->eax = hyperv_feat_enabled(cpu, HYPERV_FEAT_EVMCS) ?
1485             HV_CPUID_NESTED_FEATURES : HV_CPUID_IMPLEMENT_LIMITS;
1486         memcpy(signature, "Microsoft VS", 12);
1487         c->eax = 0;
1488         c->ebx = signature[0];
1489         c->ecx = signature[1];
1490         c->edx = signature[2];
1491 
1492         c = &cpuid_ent[cpuid_i++];
1493         c->function = HV_CPUID_SYNDBG_INTERFACE;
1494         memcpy(signature, "VS#1\0\0\0\0\0\0\0\0", 12);
1495         c->eax = signature[0];
1496         c->ebx = 0;
1497         c->ecx = 0;
1498         c->edx = 0;
1499 
1500         c = &cpuid_ent[cpuid_i++];
1501         c->function = HV_CPUID_SYNDBG_PLATFORM_CAPABILITIES;
1502         c->eax = HV_SYNDBG_CAP_ALLOW_KERNEL_DEBUGGING;
1503         c->ebx = 0;
1504         c->ecx = 0;
1505         c->edx = 0;
1506     }
1507 
1508     return cpuid_i;
1509 }
1510 
1511 static Error *hv_passthrough_mig_blocker;
1512 static Error *hv_no_nonarch_cs_mig_blocker;
1513 
1514 /* Checks that the exposed eVMCS version range is supported by KVM */
1515 static bool evmcs_version_supported(uint16_t evmcs_version,
1516                                     uint16_t supported_evmcs_version)
1517 {
1518     uint8_t min_version = evmcs_version & 0xff;
1519     uint8_t max_version = evmcs_version >> 8;
1520     uint8_t min_supported_version = supported_evmcs_version & 0xff;
1521     uint8_t max_supported_version = supported_evmcs_version >> 8;
1522 
1523     return (min_version >= min_supported_version) &&
1524         (max_version <= max_supported_version);
1525 }
1526 
1527 #define DEFAULT_EVMCS_VERSION ((1 << 8) | 1)
1528 
1529 static int hyperv_init_vcpu(X86CPU *cpu)
1530 {
1531     CPUState *cs = CPU(cpu);
1532     Error *local_err = NULL;
1533     int ret;
1534 
1535     if (cpu->hyperv_passthrough && hv_passthrough_mig_blocker == NULL) {
1536         error_setg(&hv_passthrough_mig_blocker,
1537                    "'hv-passthrough' CPU flag prevents migration, use explicit"
1538                    " set of hv-* flags instead");
1539         ret = migrate_add_blocker(hv_passthrough_mig_blocker, &local_err);
1540         if (ret < 0) {
1541             error_report_err(local_err);
1542             return ret;
1543         }
1544     }
1545 
1546     if (cpu->hyperv_no_nonarch_cs == ON_OFF_AUTO_AUTO &&
1547         hv_no_nonarch_cs_mig_blocker == NULL) {
1548         error_setg(&hv_no_nonarch_cs_mig_blocker,
1549                    "'hv-no-nonarch-coresharing=auto' CPU flag prevents migration"
1550                    " use explicit 'hv-no-nonarch-coresharing=on' instead (but"
1551                    " make sure SMT is disabled and/or that vCPUs are properly"
1552                    " pinned)");
1553         ret = migrate_add_blocker(hv_no_nonarch_cs_mig_blocker, &local_err);
1554         if (ret < 0) {
1555             error_report_err(local_err);
1556             return ret;
1557         }
1558     }
1559 
1560     if (hyperv_feat_enabled(cpu, HYPERV_FEAT_VPINDEX) && !hv_vpindex_settable) {
1561         /*
1562          * the kernel doesn't support setting vp_index; assert that its value
1563          * is in sync
1564          */
1565         struct {
1566             struct kvm_msrs info;
1567             struct kvm_msr_entry entries[1];
1568         } msr_data = {
1569             .info.nmsrs = 1,
1570             .entries[0].index = HV_X64_MSR_VP_INDEX,
1571         };
1572 
1573         ret = kvm_vcpu_ioctl(cs, KVM_GET_MSRS, &msr_data);
1574         if (ret < 0) {
1575             return ret;
1576         }
1577         assert(ret == 1);
1578 
1579         if (msr_data.entries[0].data != hyperv_vp_index(CPU(cpu))) {
1580             error_report("kernel's vp_index != QEMU's vp_index");
1581             return -ENXIO;
1582         }
1583     }
1584 
1585     if (hyperv_feat_enabled(cpu, HYPERV_FEAT_SYNIC)) {
1586         uint32_t synic_cap = cpu->hyperv_synic_kvm_only ?
1587             KVM_CAP_HYPERV_SYNIC : KVM_CAP_HYPERV_SYNIC2;
1588         ret = kvm_vcpu_enable_cap(cs, synic_cap, 0);
1589         if (ret < 0) {
1590             error_report("failed to turn on HyperV SynIC in KVM: %s",
1591                          strerror(-ret));
1592             return ret;
1593         }
1594 
1595         if (!cpu->hyperv_synic_kvm_only) {
1596             ret = hyperv_x86_synic_add(cpu);
1597             if (ret < 0) {
1598                 error_report("failed to create HyperV SynIC: %s",
1599                              strerror(-ret));
1600                 return ret;
1601             }
1602         }
1603     }
1604 
1605     if (hyperv_feat_enabled(cpu, HYPERV_FEAT_EVMCS)) {
1606         uint16_t evmcs_version = DEFAULT_EVMCS_VERSION;
1607         uint16_t supported_evmcs_version;
1608 
1609         ret = kvm_vcpu_enable_cap(cs, KVM_CAP_HYPERV_ENLIGHTENED_VMCS, 0,
1610                                   (uintptr_t)&supported_evmcs_version);
1611 
1612         /*
1613          * KVM is required to support EVMCS ver.1. as that's what 'hv-evmcs'
1614          * option sets. Note: we hardcode the maximum supported eVMCS version
1615          * to '1' as well so 'hv-evmcs' feature is migratable even when (and if)
1616          * ver.2 is implemented. A new option (e.g. 'hv-evmcs=2') will then have
1617          * to be added.
1618          */
1619         if (ret < 0) {
1620             error_report("Hyper-V %s is not supported by kernel",
1621                          kvm_hyperv_properties[HYPERV_FEAT_EVMCS].desc);
1622             return ret;
1623         }
1624 
1625         if (!evmcs_version_supported(evmcs_version, supported_evmcs_version)) {
1626             error_report("eVMCS version range [%d..%d] is not supported by "
1627                          "kernel (supported: [%d..%d])", evmcs_version & 0xff,
1628                          evmcs_version >> 8, supported_evmcs_version & 0xff,
1629                          supported_evmcs_version >> 8);
1630             return -ENOTSUP;
1631         }
1632 
1633         cpu->hyperv_nested[0] = evmcs_version;
1634     }
1635 
1636     if (cpu->hyperv_enforce_cpuid) {
1637         ret = kvm_vcpu_enable_cap(cs, KVM_CAP_HYPERV_ENFORCE_CPUID, 0, 1);
1638         if (ret < 0) {
1639             error_report("failed to enable KVM_CAP_HYPERV_ENFORCE_CPUID: %s",
1640                          strerror(-ret));
1641             return ret;
1642         }
1643     }
1644 
1645     return 0;
1646 }
1647 
1648 static Error *invtsc_mig_blocker;
1649 
1650 #define KVM_MAX_CPUID_ENTRIES  100
1651 
1652 static void kvm_init_xsave(CPUX86State *env)
1653 {
1654     if (has_xsave2) {
1655         env->xsave_buf_len = QEMU_ALIGN_UP(has_xsave2, 4096);
1656     } else if (has_xsave) {
1657         env->xsave_buf_len = sizeof(struct kvm_xsave);
1658     } else {
1659         return;
1660     }
1661 
1662     env->xsave_buf = qemu_memalign(4096, env->xsave_buf_len);
1663     memset(env->xsave_buf, 0, env->xsave_buf_len);
1664     /*
1665      * The allocated storage must be large enough for all of the
1666      * possible XSAVE state components.
1667      */
1668     assert(kvm_arch_get_supported_cpuid(kvm_state, 0xd, 0, R_ECX) <=
1669            env->xsave_buf_len);
1670 }
1671 
1672 int kvm_arch_init_vcpu(CPUState *cs)
1673 {
1674     struct {
1675         struct kvm_cpuid2 cpuid;
1676         struct kvm_cpuid_entry2 entries[KVM_MAX_CPUID_ENTRIES];
1677     } cpuid_data;
1678     /*
1679      * The kernel defines these structs with padding fields so there
1680      * should be no extra padding in our cpuid_data struct.
1681      */
1682     QEMU_BUILD_BUG_ON(sizeof(cpuid_data) !=
1683                       sizeof(struct kvm_cpuid2) +
1684                       sizeof(struct kvm_cpuid_entry2) * KVM_MAX_CPUID_ENTRIES);
1685 
1686     X86CPU *cpu = X86_CPU(cs);
1687     CPUX86State *env = &cpu->env;
1688     uint32_t limit, i, j, cpuid_i;
1689     uint32_t unused;
1690     struct kvm_cpuid_entry2 *c;
1691     uint32_t signature[3];
1692     int kvm_base = KVM_CPUID_SIGNATURE;
1693     int max_nested_state_len;
1694     int r;
1695     Error *local_err = NULL;
1696 
1697     memset(&cpuid_data, 0, sizeof(cpuid_data));
1698 
1699     cpuid_i = 0;
1700 
1701     has_xsave2 = kvm_check_extension(cs->kvm_state, KVM_CAP_XSAVE2);
1702 
1703     r = kvm_arch_set_tsc_khz(cs);
1704     if (r < 0) {
1705         return r;
1706     }
1707 
1708     /* vcpu's TSC frequency is either specified by user, or following
1709      * the value used by KVM if the former is not present. In the
1710      * latter case, we query it from KVM and record in env->tsc_khz,
1711      * so that vcpu's TSC frequency can be migrated later via this field.
1712      */
1713     if (!env->tsc_khz) {
1714         r = kvm_check_extension(cs->kvm_state, KVM_CAP_GET_TSC_KHZ) ?
1715             kvm_vcpu_ioctl(cs, KVM_GET_TSC_KHZ) :
1716             -ENOTSUP;
1717         if (r > 0) {
1718             env->tsc_khz = r;
1719         }
1720     }
1721 
1722     env->apic_bus_freq = KVM_APIC_BUS_FREQUENCY;
1723 
1724     /*
1725      * kvm_hyperv_expand_features() is called here for the second time in case
1726      * KVM_CAP_SYS_HYPERV_CPUID is not supported. While we can't possibly handle
1727      * 'query-cpu-model-expansion' in this case as we don't have a KVM vCPU to
1728      * check which Hyper-V enlightenments are supported and which are not, we
1729      * can still proceed and check/expand Hyper-V enlightenments here so legacy
1730      * behavior is preserved.
1731      */
1732     if (!kvm_hyperv_expand_features(cpu, &local_err)) {
1733         error_report_err(local_err);
1734         return -ENOSYS;
1735     }
1736 
1737     if (hyperv_enabled(cpu)) {
1738         r = hyperv_init_vcpu(cpu);
1739         if (r) {
1740             return r;
1741         }
1742 
1743         cpuid_i = hyperv_fill_cpuids(cs, cpuid_data.entries);
1744         kvm_base = KVM_CPUID_SIGNATURE_NEXT;
1745         has_msr_hv_hypercall = true;
1746     }
1747 
1748     if (cpu->expose_kvm) {
1749         memcpy(signature, "KVMKVMKVM\0\0\0", 12);
1750         c = &cpuid_data.entries[cpuid_i++];
1751         c->function = KVM_CPUID_SIGNATURE | kvm_base;
1752         c->eax = KVM_CPUID_FEATURES | kvm_base;
1753         c->ebx = signature[0];
1754         c->ecx = signature[1];
1755         c->edx = signature[2];
1756 
1757         c = &cpuid_data.entries[cpuid_i++];
1758         c->function = KVM_CPUID_FEATURES | kvm_base;
1759         c->eax = env->features[FEAT_KVM];
1760         c->edx = env->features[FEAT_KVM_HINTS];
1761     }
1762 
1763     cpu_x86_cpuid(env, 0, 0, &limit, &unused, &unused, &unused);
1764 
1765     if (cpu->kvm_pv_enforce_cpuid) {
1766         r = kvm_vcpu_enable_cap(cs, KVM_CAP_ENFORCE_PV_FEATURE_CPUID, 0, 1);
1767         if (r < 0) {
1768             fprintf(stderr,
1769                     "failed to enable KVM_CAP_ENFORCE_PV_FEATURE_CPUID: %s",
1770                     strerror(-r));
1771             abort();
1772         }
1773     }
1774 
1775     for (i = 0; i <= limit; i++) {
1776         if (cpuid_i == KVM_MAX_CPUID_ENTRIES) {
1777             fprintf(stderr, "unsupported level value: 0x%x\n", limit);
1778             abort();
1779         }
1780         c = &cpuid_data.entries[cpuid_i++];
1781 
1782         switch (i) {
1783         case 2: {
1784             /* Keep reading function 2 till all the input is received */
1785             int times;
1786 
1787             c->function = i;
1788             c->flags = KVM_CPUID_FLAG_STATEFUL_FUNC |
1789                        KVM_CPUID_FLAG_STATE_READ_NEXT;
1790             cpu_x86_cpuid(env, i, 0, &c->eax, &c->ebx, &c->ecx, &c->edx);
1791             times = c->eax & 0xff;
1792 
1793             for (j = 1; j < times; ++j) {
1794                 if (cpuid_i == KVM_MAX_CPUID_ENTRIES) {
1795                     fprintf(stderr, "cpuid_data is full, no space for "
1796                             "cpuid(eax:2):eax & 0xf = 0x%x\n", times);
1797                     abort();
1798                 }
1799                 c = &cpuid_data.entries[cpuid_i++];
1800                 c->function = i;
1801                 c->flags = KVM_CPUID_FLAG_STATEFUL_FUNC;
1802                 cpu_x86_cpuid(env, i, 0, &c->eax, &c->ebx, &c->ecx, &c->edx);
1803             }
1804             break;
1805         }
1806         case 0x1f:
1807             if (env->nr_dies < 2) {
1808                 break;
1809             }
1810             /* fallthrough */
1811         case 4:
1812         case 0xb:
1813         case 0xd:
1814             for (j = 0; ; j++) {
1815                 if (i == 0xd && j == 64) {
1816                     break;
1817                 }
1818 
1819                 if (i == 0x1f && j == 64) {
1820                     break;
1821                 }
1822 
1823                 c->function = i;
1824                 c->flags = KVM_CPUID_FLAG_SIGNIFCANT_INDEX;
1825                 c->index = j;
1826                 cpu_x86_cpuid(env, i, j, &c->eax, &c->ebx, &c->ecx, &c->edx);
1827 
1828                 if (i == 4 && c->eax == 0) {
1829                     break;
1830                 }
1831                 if (i == 0xb && !(c->ecx & 0xff00)) {
1832                     break;
1833                 }
1834                 if (i == 0x1f && !(c->ecx & 0xff00)) {
1835                     break;
1836                 }
1837                 if (i == 0xd && c->eax == 0) {
1838                     continue;
1839                 }
1840                 if (cpuid_i == KVM_MAX_CPUID_ENTRIES) {
1841                     fprintf(stderr, "cpuid_data is full, no space for "
1842                             "cpuid(eax:0x%x,ecx:0x%x)\n", i, j);
1843                     abort();
1844                 }
1845                 c = &cpuid_data.entries[cpuid_i++];
1846             }
1847             break;
1848         case 0x7:
1849         case 0x12:
1850             for (j = 0; ; j++) {
1851                 c->function = i;
1852                 c->flags = KVM_CPUID_FLAG_SIGNIFCANT_INDEX;
1853                 c->index = j;
1854                 cpu_x86_cpuid(env, i, j, &c->eax, &c->ebx, &c->ecx, &c->edx);
1855 
1856                 if (j > 1 && (c->eax & 0xf) != 1) {
1857                     break;
1858                 }
1859 
1860                 if (cpuid_i == KVM_MAX_CPUID_ENTRIES) {
1861                     fprintf(stderr, "cpuid_data is full, no space for "
1862                                 "cpuid(eax:0x12,ecx:0x%x)\n", j);
1863                     abort();
1864                 }
1865                 c = &cpuid_data.entries[cpuid_i++];
1866             }
1867             break;
1868         case 0x14:
1869         case 0x1d:
1870         case 0x1e: {
1871             uint32_t times;
1872 
1873             c->function = i;
1874             c->index = 0;
1875             c->flags = KVM_CPUID_FLAG_SIGNIFCANT_INDEX;
1876             cpu_x86_cpuid(env, i, 0, &c->eax, &c->ebx, &c->ecx, &c->edx);
1877             times = c->eax;
1878 
1879             for (j = 1; j <= times; ++j) {
1880                 if (cpuid_i == KVM_MAX_CPUID_ENTRIES) {
1881                     fprintf(stderr, "cpuid_data is full, no space for "
1882                                 "cpuid(eax:0x%x,ecx:0x%x)\n", i, j);
1883                     abort();
1884                 }
1885                 c = &cpuid_data.entries[cpuid_i++];
1886                 c->function = i;
1887                 c->index = j;
1888                 c->flags = KVM_CPUID_FLAG_SIGNIFCANT_INDEX;
1889                 cpu_x86_cpuid(env, i, j, &c->eax, &c->ebx, &c->ecx, &c->edx);
1890             }
1891             break;
1892         }
1893         default:
1894             c->function = i;
1895             c->flags = 0;
1896             cpu_x86_cpuid(env, i, 0, &c->eax, &c->ebx, &c->ecx, &c->edx);
1897             if (!c->eax && !c->ebx && !c->ecx && !c->edx) {
1898                 /*
1899                  * KVM already returns all zeroes if a CPUID entry is missing,
1900                  * so we can omit it and avoid hitting KVM's 80-entry limit.
1901                  */
1902                 cpuid_i--;
1903             }
1904             break;
1905         }
1906     }
1907 
1908     if (limit >= 0x0a) {
1909         uint32_t eax, edx;
1910 
1911         cpu_x86_cpuid(env, 0x0a, 0, &eax, &unused, &unused, &edx);
1912 
1913         has_architectural_pmu_version = eax & 0xff;
1914         if (has_architectural_pmu_version > 0) {
1915             num_architectural_pmu_gp_counters = (eax & 0xff00) >> 8;
1916 
1917             /* Shouldn't be more than 32, since that's the number of bits
1918              * available in EBX to tell us _which_ counters are available.
1919              * Play it safe.
1920              */
1921             if (num_architectural_pmu_gp_counters > MAX_GP_COUNTERS) {
1922                 num_architectural_pmu_gp_counters = MAX_GP_COUNTERS;
1923             }
1924 
1925             if (has_architectural_pmu_version > 1) {
1926                 num_architectural_pmu_fixed_counters = edx & 0x1f;
1927 
1928                 if (num_architectural_pmu_fixed_counters > MAX_FIXED_COUNTERS) {
1929                     num_architectural_pmu_fixed_counters = MAX_FIXED_COUNTERS;
1930                 }
1931             }
1932         }
1933     }
1934 
1935     cpu_x86_cpuid(env, 0x80000000, 0, &limit, &unused, &unused, &unused);
1936 
1937     for (i = 0x80000000; i <= limit; i++) {
1938         if (cpuid_i == KVM_MAX_CPUID_ENTRIES) {
1939             fprintf(stderr, "unsupported xlevel value: 0x%x\n", limit);
1940             abort();
1941         }
1942         c = &cpuid_data.entries[cpuid_i++];
1943 
1944         switch (i) {
1945         case 0x8000001d:
1946             /* Query for all AMD cache information leaves */
1947             for (j = 0; ; j++) {
1948                 c->function = i;
1949                 c->flags = KVM_CPUID_FLAG_SIGNIFCANT_INDEX;
1950                 c->index = j;
1951                 cpu_x86_cpuid(env, i, j, &c->eax, &c->ebx, &c->ecx, &c->edx);
1952 
1953                 if (c->eax == 0) {
1954                     break;
1955                 }
1956                 if (cpuid_i == KVM_MAX_CPUID_ENTRIES) {
1957                     fprintf(stderr, "cpuid_data is full, no space for "
1958                             "cpuid(eax:0x%x,ecx:0x%x)\n", i, j);
1959                     abort();
1960                 }
1961                 c = &cpuid_data.entries[cpuid_i++];
1962             }
1963             break;
1964         default:
1965             c->function = i;
1966             c->flags = 0;
1967             cpu_x86_cpuid(env, i, 0, &c->eax, &c->ebx, &c->ecx, &c->edx);
1968             if (!c->eax && !c->ebx && !c->ecx && !c->edx) {
1969                 /*
1970                  * KVM already returns all zeroes if a CPUID entry is missing,
1971                  * so we can omit it and avoid hitting KVM's 80-entry limit.
1972                  */
1973                 cpuid_i--;
1974             }
1975             break;
1976         }
1977     }
1978 
1979     /* Call Centaur's CPUID instructions they are supported. */
1980     if (env->cpuid_xlevel2 > 0) {
1981         cpu_x86_cpuid(env, 0xC0000000, 0, &limit, &unused, &unused, &unused);
1982 
1983         for (i = 0xC0000000; i <= limit; i++) {
1984             if (cpuid_i == KVM_MAX_CPUID_ENTRIES) {
1985                 fprintf(stderr, "unsupported xlevel2 value: 0x%x\n", limit);
1986                 abort();
1987             }
1988             c = &cpuid_data.entries[cpuid_i++];
1989 
1990             c->function = i;
1991             c->flags = 0;
1992             cpu_x86_cpuid(env, i, 0, &c->eax, &c->ebx, &c->ecx, &c->edx);
1993         }
1994     }
1995 
1996     cpuid_data.cpuid.nent = cpuid_i;
1997 
1998     if (((env->cpuid_version >> 8)&0xF) >= 6
1999         && (env->features[FEAT_1_EDX] & (CPUID_MCE | CPUID_MCA)) ==
2000            (CPUID_MCE | CPUID_MCA)
2001         && kvm_check_extension(cs->kvm_state, KVM_CAP_MCE) > 0) {
2002         uint64_t mcg_cap, unsupported_caps;
2003         int banks;
2004         int ret;
2005 
2006         ret = kvm_get_mce_cap_supported(cs->kvm_state, &mcg_cap, &banks);
2007         if (ret < 0) {
2008             fprintf(stderr, "kvm_get_mce_cap_supported: %s", strerror(-ret));
2009             return ret;
2010         }
2011 
2012         if (banks < (env->mcg_cap & MCG_CAP_BANKS_MASK)) {
2013             error_report("kvm: Unsupported MCE bank count (QEMU = %d, KVM = %d)",
2014                          (int)(env->mcg_cap & MCG_CAP_BANKS_MASK), banks);
2015             return -ENOTSUP;
2016         }
2017 
2018         unsupported_caps = env->mcg_cap & ~(mcg_cap | MCG_CAP_BANKS_MASK);
2019         if (unsupported_caps) {
2020             if (unsupported_caps & MCG_LMCE_P) {
2021                 error_report("kvm: LMCE not supported");
2022                 return -ENOTSUP;
2023             }
2024             warn_report("Unsupported MCG_CAP bits: 0x%" PRIx64,
2025                         unsupported_caps);
2026         }
2027 
2028         env->mcg_cap &= mcg_cap | MCG_CAP_BANKS_MASK;
2029         ret = kvm_vcpu_ioctl(cs, KVM_X86_SETUP_MCE, &env->mcg_cap);
2030         if (ret < 0) {
2031             fprintf(stderr, "KVM_X86_SETUP_MCE: %s", strerror(-ret));
2032             return ret;
2033         }
2034     }
2035 
2036     cpu->vmsentry = qemu_add_vm_change_state_handler(cpu_update_state, env);
2037 
2038     c = cpuid_find_entry(&cpuid_data.cpuid, 1, 0);
2039     if (c) {
2040         has_msr_feature_control = !!(c->ecx & CPUID_EXT_VMX) ||
2041                                   !!(c->ecx & CPUID_EXT_SMX);
2042     }
2043 
2044     c = cpuid_find_entry(&cpuid_data.cpuid, 7, 0);
2045     if (c && (c->ebx & CPUID_7_0_EBX_SGX)) {
2046         has_msr_feature_control = true;
2047     }
2048 
2049     if (env->mcg_cap & MCG_LMCE_P) {
2050         has_msr_mcg_ext_ctl = has_msr_feature_control = true;
2051     }
2052 
2053     if (!env->user_tsc_khz) {
2054         if ((env->features[FEAT_8000_0007_EDX] & CPUID_APM_INVTSC) &&
2055             invtsc_mig_blocker == NULL) {
2056             error_setg(&invtsc_mig_blocker,
2057                        "State blocked by non-migratable CPU device"
2058                        " (invtsc flag)");
2059             r = migrate_add_blocker(invtsc_mig_blocker, &local_err);
2060             if (r < 0) {
2061                 error_report_err(local_err);
2062                 return r;
2063             }
2064         }
2065     }
2066 
2067     if (cpu->vmware_cpuid_freq
2068         /* Guests depend on 0x40000000 to detect this feature, so only expose
2069          * it if KVM exposes leaf 0x40000000. (Conflicts with Hyper-V) */
2070         && cpu->expose_kvm
2071         && kvm_base == KVM_CPUID_SIGNATURE
2072         /* TSC clock must be stable and known for this feature. */
2073         && tsc_is_stable_and_known(env)) {
2074 
2075         c = &cpuid_data.entries[cpuid_i++];
2076         c->function = KVM_CPUID_SIGNATURE | 0x10;
2077         c->eax = env->tsc_khz;
2078         c->ebx = env->apic_bus_freq / 1000; /* Hz to KHz */
2079         c->ecx = c->edx = 0;
2080 
2081         c = cpuid_find_entry(&cpuid_data.cpuid, kvm_base, 0);
2082         c->eax = MAX(c->eax, KVM_CPUID_SIGNATURE | 0x10);
2083     }
2084 
2085     cpuid_data.cpuid.nent = cpuid_i;
2086 
2087     cpuid_data.cpuid.padding = 0;
2088     r = kvm_vcpu_ioctl(cs, KVM_SET_CPUID2, &cpuid_data);
2089     if (r) {
2090         goto fail;
2091     }
2092     kvm_init_xsave(env);
2093 
2094     max_nested_state_len = kvm_max_nested_state_length();
2095     if (max_nested_state_len > 0) {
2096         assert(max_nested_state_len >= offsetof(struct kvm_nested_state, data));
2097 
2098         if (cpu_has_vmx(env) || cpu_has_svm(env)) {
2099             struct kvm_vmx_nested_state_hdr *vmx_hdr;
2100 
2101             env->nested_state = g_malloc0(max_nested_state_len);
2102             env->nested_state->size = max_nested_state_len;
2103 
2104             if (cpu_has_vmx(env)) {
2105                 env->nested_state->format = KVM_STATE_NESTED_FORMAT_VMX;
2106                 vmx_hdr = &env->nested_state->hdr.vmx;
2107                 vmx_hdr->vmxon_pa = -1ull;
2108                 vmx_hdr->vmcs12_pa = -1ull;
2109             } else {
2110                 env->nested_state->format = KVM_STATE_NESTED_FORMAT_SVM;
2111             }
2112         }
2113     }
2114 
2115     cpu->kvm_msr_buf = g_malloc0(MSR_BUF_SIZE);
2116 
2117     if (!(env->features[FEAT_8000_0001_EDX] & CPUID_EXT2_RDTSCP)) {
2118         has_msr_tsc_aux = false;
2119     }
2120 
2121     kvm_init_msrs(cpu);
2122 
2123     return 0;
2124 
2125  fail:
2126     migrate_del_blocker(invtsc_mig_blocker);
2127 
2128     return r;
2129 }
2130 
2131 int kvm_arch_destroy_vcpu(CPUState *cs)
2132 {
2133     X86CPU *cpu = X86_CPU(cs);
2134     CPUX86State *env = &cpu->env;
2135 
2136     g_free(env->xsave_buf);
2137 
2138     if (cpu->kvm_msr_buf) {
2139         g_free(cpu->kvm_msr_buf);
2140         cpu->kvm_msr_buf = NULL;
2141     }
2142 
2143     if (env->nested_state) {
2144         g_free(env->nested_state);
2145         env->nested_state = NULL;
2146     }
2147 
2148     qemu_del_vm_change_state_handler(cpu->vmsentry);
2149 
2150     return 0;
2151 }
2152 
2153 void kvm_arch_reset_vcpu(X86CPU *cpu)
2154 {
2155     CPUX86State *env = &cpu->env;
2156 
2157     env->xcr0 = 1;
2158     if (kvm_irqchip_in_kernel()) {
2159         env->mp_state = cpu_is_bsp(cpu) ? KVM_MP_STATE_RUNNABLE :
2160                                           KVM_MP_STATE_UNINITIALIZED;
2161     } else {
2162         env->mp_state = KVM_MP_STATE_RUNNABLE;
2163     }
2164 
2165     if (hyperv_feat_enabled(cpu, HYPERV_FEAT_SYNIC)) {
2166         int i;
2167         for (i = 0; i < ARRAY_SIZE(env->msr_hv_synic_sint); i++) {
2168             env->msr_hv_synic_sint[i] = HV_SINT_MASKED;
2169         }
2170 
2171         hyperv_x86_synic_reset(cpu);
2172     }
2173     /* enabled by default */
2174     env->poll_control_msr = 1;
2175 
2176     sev_es_set_reset_vector(CPU(cpu));
2177 }
2178 
2179 void kvm_arch_do_init_vcpu(X86CPU *cpu)
2180 {
2181     CPUX86State *env = &cpu->env;
2182 
2183     /* APs get directly into wait-for-SIPI state.  */
2184     if (env->mp_state == KVM_MP_STATE_UNINITIALIZED) {
2185         env->mp_state = KVM_MP_STATE_INIT_RECEIVED;
2186     }
2187 }
2188 
2189 static int kvm_get_supported_feature_msrs(KVMState *s)
2190 {
2191     int ret = 0;
2192 
2193     if (kvm_feature_msrs != NULL) {
2194         return 0;
2195     }
2196 
2197     if (!kvm_check_extension(s, KVM_CAP_GET_MSR_FEATURES)) {
2198         return 0;
2199     }
2200 
2201     struct kvm_msr_list msr_list;
2202 
2203     msr_list.nmsrs = 0;
2204     ret = kvm_ioctl(s, KVM_GET_MSR_FEATURE_INDEX_LIST, &msr_list);
2205     if (ret < 0 && ret != -E2BIG) {
2206         error_report("Fetch KVM feature MSR list failed: %s",
2207             strerror(-ret));
2208         return ret;
2209     }
2210 
2211     assert(msr_list.nmsrs > 0);
2212     kvm_feature_msrs = (struct kvm_msr_list *) \
2213         g_malloc0(sizeof(msr_list) +
2214                  msr_list.nmsrs * sizeof(msr_list.indices[0]));
2215 
2216     kvm_feature_msrs->nmsrs = msr_list.nmsrs;
2217     ret = kvm_ioctl(s, KVM_GET_MSR_FEATURE_INDEX_LIST, kvm_feature_msrs);
2218 
2219     if (ret < 0) {
2220         error_report("Fetch KVM feature MSR list failed: %s",
2221             strerror(-ret));
2222         g_free(kvm_feature_msrs);
2223         kvm_feature_msrs = NULL;
2224         return ret;
2225     }
2226 
2227     return 0;
2228 }
2229 
2230 static int kvm_get_supported_msrs(KVMState *s)
2231 {
2232     int ret = 0;
2233     struct kvm_msr_list msr_list, *kvm_msr_list;
2234 
2235     /*
2236      *  Obtain MSR list from KVM.  These are the MSRs that we must
2237      *  save/restore.
2238      */
2239     msr_list.nmsrs = 0;
2240     ret = kvm_ioctl(s, KVM_GET_MSR_INDEX_LIST, &msr_list);
2241     if (ret < 0 && ret != -E2BIG) {
2242         return ret;
2243     }
2244     /*
2245      * Old kernel modules had a bug and could write beyond the provided
2246      * memory. Allocate at least a safe amount of 1K.
2247      */
2248     kvm_msr_list = g_malloc0(MAX(1024, sizeof(msr_list) +
2249                                           msr_list.nmsrs *
2250                                           sizeof(msr_list.indices[0])));
2251 
2252     kvm_msr_list->nmsrs = msr_list.nmsrs;
2253     ret = kvm_ioctl(s, KVM_GET_MSR_INDEX_LIST, kvm_msr_list);
2254     if (ret >= 0) {
2255         int i;
2256 
2257         for (i = 0; i < kvm_msr_list->nmsrs; i++) {
2258             switch (kvm_msr_list->indices[i]) {
2259             case MSR_STAR:
2260                 has_msr_star = true;
2261                 break;
2262             case MSR_VM_HSAVE_PA:
2263                 has_msr_hsave_pa = true;
2264                 break;
2265             case MSR_TSC_AUX:
2266                 has_msr_tsc_aux = true;
2267                 break;
2268             case MSR_TSC_ADJUST:
2269                 has_msr_tsc_adjust = true;
2270                 break;
2271             case MSR_IA32_TSCDEADLINE:
2272                 has_msr_tsc_deadline = true;
2273                 break;
2274             case MSR_IA32_SMBASE:
2275                 has_msr_smbase = true;
2276                 break;
2277             case MSR_SMI_COUNT:
2278                 has_msr_smi_count = true;
2279                 break;
2280             case MSR_IA32_MISC_ENABLE:
2281                 has_msr_misc_enable = true;
2282                 break;
2283             case MSR_IA32_BNDCFGS:
2284                 has_msr_bndcfgs = true;
2285                 break;
2286             case MSR_IA32_XSS:
2287                 has_msr_xss = true;
2288                 break;
2289             case MSR_IA32_UMWAIT_CONTROL:
2290                 has_msr_umwait = true;
2291                 break;
2292             case HV_X64_MSR_CRASH_CTL:
2293                 has_msr_hv_crash = true;
2294                 break;
2295             case HV_X64_MSR_RESET:
2296                 has_msr_hv_reset = true;
2297                 break;
2298             case HV_X64_MSR_VP_INDEX:
2299                 has_msr_hv_vpindex = true;
2300                 break;
2301             case HV_X64_MSR_VP_RUNTIME:
2302                 has_msr_hv_runtime = true;
2303                 break;
2304             case HV_X64_MSR_SCONTROL:
2305                 has_msr_hv_synic = true;
2306                 break;
2307             case HV_X64_MSR_STIMER0_CONFIG:
2308                 has_msr_hv_stimer = true;
2309                 break;
2310             case HV_X64_MSR_TSC_FREQUENCY:
2311                 has_msr_hv_frequencies = true;
2312                 break;
2313             case HV_X64_MSR_REENLIGHTENMENT_CONTROL:
2314                 has_msr_hv_reenlightenment = true;
2315                 break;
2316             case HV_X64_MSR_SYNDBG_OPTIONS:
2317                 has_msr_hv_syndbg_options = true;
2318                 break;
2319             case MSR_IA32_SPEC_CTRL:
2320                 has_msr_spec_ctrl = true;
2321                 break;
2322             case MSR_AMD64_TSC_RATIO:
2323                 has_tsc_scale_msr = true;
2324                 break;
2325             case MSR_IA32_TSX_CTRL:
2326                 has_msr_tsx_ctrl = true;
2327                 break;
2328             case MSR_VIRT_SSBD:
2329                 has_msr_virt_ssbd = true;
2330                 break;
2331             case MSR_IA32_ARCH_CAPABILITIES:
2332                 has_msr_arch_capabs = true;
2333                 break;
2334             case MSR_IA32_CORE_CAPABILITY:
2335                 has_msr_core_capabs = true;
2336                 break;
2337             case MSR_IA32_PERF_CAPABILITIES:
2338                 has_msr_perf_capabs = true;
2339                 break;
2340             case MSR_IA32_VMX_VMFUNC:
2341                 has_msr_vmx_vmfunc = true;
2342                 break;
2343             case MSR_IA32_UCODE_REV:
2344                 has_msr_ucode_rev = true;
2345                 break;
2346             case MSR_IA32_VMX_PROCBASED_CTLS2:
2347                 has_msr_vmx_procbased_ctls2 = true;
2348                 break;
2349             case MSR_IA32_PKRS:
2350                 has_msr_pkrs = true;
2351                 break;
2352             }
2353         }
2354     }
2355 
2356     g_free(kvm_msr_list);
2357 
2358     return ret;
2359 }
2360 
2361 static Notifier smram_machine_done;
2362 static KVMMemoryListener smram_listener;
2363 static AddressSpace smram_address_space;
2364 static MemoryRegion smram_as_root;
2365 static MemoryRegion smram_as_mem;
2366 
2367 static void register_smram_listener(Notifier *n, void *unused)
2368 {
2369     MemoryRegion *smram =
2370         (MemoryRegion *) object_resolve_path("/machine/smram", NULL);
2371 
2372     /* Outer container... */
2373     memory_region_init(&smram_as_root, OBJECT(kvm_state), "mem-container-smram", ~0ull);
2374     memory_region_set_enabled(&smram_as_root, true);
2375 
2376     /* ... with two regions inside: normal system memory with low
2377      * priority, and...
2378      */
2379     memory_region_init_alias(&smram_as_mem, OBJECT(kvm_state), "mem-smram",
2380                              get_system_memory(), 0, ~0ull);
2381     memory_region_add_subregion_overlap(&smram_as_root, 0, &smram_as_mem, 0);
2382     memory_region_set_enabled(&smram_as_mem, true);
2383 
2384     if (smram) {
2385         /* ... SMRAM with higher priority */
2386         memory_region_add_subregion_overlap(&smram_as_root, 0, smram, 10);
2387         memory_region_set_enabled(smram, true);
2388     }
2389 
2390     address_space_init(&smram_address_space, &smram_as_root, "KVM-SMRAM");
2391     kvm_memory_listener_register(kvm_state, &smram_listener,
2392                                  &smram_address_space, 1, "kvm-smram");
2393 }
2394 
2395 int kvm_arch_init(MachineState *ms, KVMState *s)
2396 {
2397     uint64_t identity_base = 0xfffbc000;
2398     uint64_t shadow_mem;
2399     int ret;
2400     struct utsname utsname;
2401     Error *local_err = NULL;
2402 
2403     /*
2404      * Initialize SEV context, if required
2405      *
2406      * If no memory encryption is requested (ms->cgs == NULL) this is
2407      * a no-op.
2408      *
2409      * It's also a no-op if a non-SEV confidential guest support
2410      * mechanism is selected.  SEV is the only mechanism available to
2411      * select on x86 at present, so this doesn't arise, but if new
2412      * mechanisms are supported in future (e.g. TDX), they'll need
2413      * their own initialization either here or elsewhere.
2414      */
2415     ret = sev_kvm_init(ms->cgs, &local_err);
2416     if (ret < 0) {
2417         error_report_err(local_err);
2418         return ret;
2419     }
2420 
2421     if (!kvm_check_extension(s, KVM_CAP_IRQ_ROUTING)) {
2422         error_report("kvm: KVM_CAP_IRQ_ROUTING not supported by KVM");
2423         return -ENOTSUP;
2424     }
2425 
2426     has_xsave = kvm_check_extension(s, KVM_CAP_XSAVE);
2427     has_xcrs = kvm_check_extension(s, KVM_CAP_XCRS);
2428     has_pit_state2 = kvm_check_extension(s, KVM_CAP_PIT_STATE2);
2429     has_sregs2 = kvm_check_extension(s, KVM_CAP_SREGS2) > 0;
2430 
2431     hv_vpindex_settable = kvm_check_extension(s, KVM_CAP_HYPERV_VP_INDEX);
2432 
2433     has_exception_payload = kvm_check_extension(s, KVM_CAP_EXCEPTION_PAYLOAD);
2434     if (has_exception_payload) {
2435         ret = kvm_vm_enable_cap(s, KVM_CAP_EXCEPTION_PAYLOAD, 0, true);
2436         if (ret < 0) {
2437             error_report("kvm: Failed to enable exception payload cap: %s",
2438                          strerror(-ret));
2439             return ret;
2440         }
2441     }
2442 
2443     ret = kvm_get_supported_msrs(s);
2444     if (ret < 0) {
2445         return ret;
2446     }
2447 
2448     kvm_get_supported_feature_msrs(s);
2449 
2450     uname(&utsname);
2451     lm_capable_kernel = strcmp(utsname.machine, "x86_64") == 0;
2452 
2453     /*
2454      * On older Intel CPUs, KVM uses vm86 mode to emulate 16-bit code directly.
2455      * In order to use vm86 mode, an EPT identity map and a TSS  are needed.
2456      * Since these must be part of guest physical memory, we need to allocate
2457      * them, both by setting their start addresses in the kernel and by
2458      * creating a corresponding e820 entry. We need 4 pages before the BIOS.
2459      *
2460      * Older KVM versions may not support setting the identity map base. In
2461      * that case we need to stick with the default, i.e. a 256K maximum BIOS
2462      * size.
2463      */
2464     if (kvm_check_extension(s, KVM_CAP_SET_IDENTITY_MAP_ADDR)) {
2465         /* Allows up to 16M BIOSes. */
2466         identity_base = 0xfeffc000;
2467 
2468         ret = kvm_vm_ioctl(s, KVM_SET_IDENTITY_MAP_ADDR, &identity_base);
2469         if (ret < 0) {
2470             return ret;
2471         }
2472     }
2473 
2474     /* Set TSS base one page after EPT identity map. */
2475     ret = kvm_vm_ioctl(s, KVM_SET_TSS_ADDR, identity_base + 0x1000);
2476     if (ret < 0) {
2477         return ret;
2478     }
2479 
2480     /* Tell fw_cfg to notify the BIOS to reserve the range. */
2481     ret = e820_add_entry(identity_base, 0x4000, E820_RESERVED);
2482     if (ret < 0) {
2483         fprintf(stderr, "e820_add_entry() table is full\n");
2484         return ret;
2485     }
2486 
2487     shadow_mem = object_property_get_int(OBJECT(s), "kvm-shadow-mem", &error_abort);
2488     if (shadow_mem != -1) {
2489         shadow_mem /= 4096;
2490         ret = kvm_vm_ioctl(s, KVM_SET_NR_MMU_PAGES, shadow_mem);
2491         if (ret < 0) {
2492             return ret;
2493         }
2494     }
2495 
2496     if (kvm_check_extension(s, KVM_CAP_X86_SMM) &&
2497         object_dynamic_cast(OBJECT(ms), TYPE_X86_MACHINE) &&
2498         x86_machine_is_smm_enabled(X86_MACHINE(ms))) {
2499         smram_machine_done.notify = register_smram_listener;
2500         qemu_add_machine_init_done_notifier(&smram_machine_done);
2501     }
2502 
2503     if (enable_cpu_pm) {
2504         int disable_exits = kvm_check_extension(s, KVM_CAP_X86_DISABLE_EXITS);
2505         int ret;
2506 
2507 /* Work around for kernel header with a typo. TODO: fix header and drop. */
2508 #if defined(KVM_X86_DISABLE_EXITS_HTL) && !defined(KVM_X86_DISABLE_EXITS_HLT)
2509 #define KVM_X86_DISABLE_EXITS_HLT KVM_X86_DISABLE_EXITS_HTL
2510 #endif
2511         if (disable_exits) {
2512             disable_exits &= (KVM_X86_DISABLE_EXITS_MWAIT |
2513                               KVM_X86_DISABLE_EXITS_HLT |
2514                               KVM_X86_DISABLE_EXITS_PAUSE |
2515                               KVM_X86_DISABLE_EXITS_CSTATE);
2516         }
2517 
2518         ret = kvm_vm_enable_cap(s, KVM_CAP_X86_DISABLE_EXITS, 0,
2519                                 disable_exits);
2520         if (ret < 0) {
2521             error_report("kvm: guest stopping CPU not supported: %s",
2522                          strerror(-ret));
2523         }
2524     }
2525 
2526     if (object_dynamic_cast(OBJECT(ms), TYPE_X86_MACHINE)) {
2527         X86MachineState *x86ms = X86_MACHINE(ms);
2528 
2529         if (x86ms->bus_lock_ratelimit > 0) {
2530             ret = kvm_check_extension(s, KVM_CAP_X86_BUS_LOCK_EXIT);
2531             if (!(ret & KVM_BUS_LOCK_DETECTION_EXIT)) {
2532                 error_report("kvm: bus lock detection unsupported");
2533                 return -ENOTSUP;
2534             }
2535             ret = kvm_vm_enable_cap(s, KVM_CAP_X86_BUS_LOCK_EXIT, 0,
2536                                     KVM_BUS_LOCK_DETECTION_EXIT);
2537             if (ret < 0) {
2538                 error_report("kvm: Failed to enable bus lock detection cap: %s",
2539                              strerror(-ret));
2540                 return ret;
2541             }
2542             ratelimit_init(&bus_lock_ratelimit_ctrl);
2543             ratelimit_set_speed(&bus_lock_ratelimit_ctrl,
2544                                 x86ms->bus_lock_ratelimit, BUS_LOCK_SLICE_TIME);
2545         }
2546     }
2547 
2548     return 0;
2549 }
2550 
2551 static void set_v8086_seg(struct kvm_segment *lhs, const SegmentCache *rhs)
2552 {
2553     lhs->selector = rhs->selector;
2554     lhs->base = rhs->base;
2555     lhs->limit = rhs->limit;
2556     lhs->type = 3;
2557     lhs->present = 1;
2558     lhs->dpl = 3;
2559     lhs->db = 0;
2560     lhs->s = 1;
2561     lhs->l = 0;
2562     lhs->g = 0;
2563     lhs->avl = 0;
2564     lhs->unusable = 0;
2565 }
2566 
2567 static void set_seg(struct kvm_segment *lhs, const SegmentCache *rhs)
2568 {
2569     unsigned flags = rhs->flags;
2570     lhs->selector = rhs->selector;
2571     lhs->base = rhs->base;
2572     lhs->limit = rhs->limit;
2573     lhs->type = (flags >> DESC_TYPE_SHIFT) & 15;
2574     lhs->present = (flags & DESC_P_MASK) != 0;
2575     lhs->dpl = (flags >> DESC_DPL_SHIFT) & 3;
2576     lhs->db = (flags >> DESC_B_SHIFT) & 1;
2577     lhs->s = (flags & DESC_S_MASK) != 0;
2578     lhs->l = (flags >> DESC_L_SHIFT) & 1;
2579     lhs->g = (flags & DESC_G_MASK) != 0;
2580     lhs->avl = (flags & DESC_AVL_MASK) != 0;
2581     lhs->unusable = !lhs->present;
2582     lhs->padding = 0;
2583 }
2584 
2585 static void get_seg(SegmentCache *lhs, const struct kvm_segment *rhs)
2586 {
2587     lhs->selector = rhs->selector;
2588     lhs->base = rhs->base;
2589     lhs->limit = rhs->limit;
2590     lhs->flags = (rhs->type << DESC_TYPE_SHIFT) |
2591                  ((rhs->present && !rhs->unusable) * DESC_P_MASK) |
2592                  (rhs->dpl << DESC_DPL_SHIFT) |
2593                  (rhs->db << DESC_B_SHIFT) |
2594                  (rhs->s * DESC_S_MASK) |
2595                  (rhs->l << DESC_L_SHIFT) |
2596                  (rhs->g * DESC_G_MASK) |
2597                  (rhs->avl * DESC_AVL_MASK);
2598 }
2599 
2600 static void kvm_getput_reg(__u64 *kvm_reg, target_ulong *qemu_reg, int set)
2601 {
2602     if (set) {
2603         *kvm_reg = *qemu_reg;
2604     } else {
2605         *qemu_reg = *kvm_reg;
2606     }
2607 }
2608 
2609 static int kvm_getput_regs(X86CPU *cpu, int set)
2610 {
2611     CPUX86State *env = &cpu->env;
2612     struct kvm_regs regs;
2613     int ret = 0;
2614 
2615     if (!set) {
2616         ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_REGS, &regs);
2617         if (ret < 0) {
2618             return ret;
2619         }
2620     }
2621 
2622     kvm_getput_reg(&regs.rax, &env->regs[R_EAX], set);
2623     kvm_getput_reg(&regs.rbx, &env->regs[R_EBX], set);
2624     kvm_getput_reg(&regs.rcx, &env->regs[R_ECX], set);
2625     kvm_getput_reg(&regs.rdx, &env->regs[R_EDX], set);
2626     kvm_getput_reg(&regs.rsi, &env->regs[R_ESI], set);
2627     kvm_getput_reg(&regs.rdi, &env->regs[R_EDI], set);
2628     kvm_getput_reg(&regs.rsp, &env->regs[R_ESP], set);
2629     kvm_getput_reg(&regs.rbp, &env->regs[R_EBP], set);
2630 #ifdef TARGET_X86_64
2631     kvm_getput_reg(&regs.r8, &env->regs[8], set);
2632     kvm_getput_reg(&regs.r9, &env->regs[9], set);
2633     kvm_getput_reg(&regs.r10, &env->regs[10], set);
2634     kvm_getput_reg(&regs.r11, &env->regs[11], set);
2635     kvm_getput_reg(&regs.r12, &env->regs[12], set);
2636     kvm_getput_reg(&regs.r13, &env->regs[13], set);
2637     kvm_getput_reg(&regs.r14, &env->regs[14], set);
2638     kvm_getput_reg(&regs.r15, &env->regs[15], set);
2639 #endif
2640 
2641     kvm_getput_reg(&regs.rflags, &env->eflags, set);
2642     kvm_getput_reg(&regs.rip, &env->eip, set);
2643 
2644     if (set) {
2645         ret = kvm_vcpu_ioctl(CPU(cpu), KVM_SET_REGS, &regs);
2646     }
2647 
2648     return ret;
2649 }
2650 
2651 static int kvm_put_fpu(X86CPU *cpu)
2652 {
2653     CPUX86State *env = &cpu->env;
2654     struct kvm_fpu fpu;
2655     int i;
2656 
2657     memset(&fpu, 0, sizeof fpu);
2658     fpu.fsw = env->fpus & ~(7 << 11);
2659     fpu.fsw |= (env->fpstt & 7) << 11;
2660     fpu.fcw = env->fpuc;
2661     fpu.last_opcode = env->fpop;
2662     fpu.last_ip = env->fpip;
2663     fpu.last_dp = env->fpdp;
2664     for (i = 0; i < 8; ++i) {
2665         fpu.ftwx |= (!env->fptags[i]) << i;
2666     }
2667     memcpy(fpu.fpr, env->fpregs, sizeof env->fpregs);
2668     for (i = 0; i < CPU_NB_REGS; i++) {
2669         stq_p(&fpu.xmm[i][0], env->xmm_regs[i].ZMM_Q(0));
2670         stq_p(&fpu.xmm[i][8], env->xmm_regs[i].ZMM_Q(1));
2671     }
2672     fpu.mxcsr = env->mxcsr;
2673 
2674     return kvm_vcpu_ioctl(CPU(cpu), KVM_SET_FPU, &fpu);
2675 }
2676 
2677 static int kvm_put_xsave(X86CPU *cpu)
2678 {
2679     CPUX86State *env = &cpu->env;
2680     void *xsave = env->xsave_buf;
2681 
2682     if (!has_xsave) {
2683         return kvm_put_fpu(cpu);
2684     }
2685     x86_cpu_xsave_all_areas(cpu, xsave, env->xsave_buf_len);
2686 
2687     return kvm_vcpu_ioctl(CPU(cpu), KVM_SET_XSAVE, xsave);
2688 }
2689 
2690 static int kvm_put_xcrs(X86CPU *cpu)
2691 {
2692     CPUX86State *env = &cpu->env;
2693     struct kvm_xcrs xcrs = {};
2694 
2695     if (!has_xcrs) {
2696         return 0;
2697     }
2698 
2699     xcrs.nr_xcrs = 1;
2700     xcrs.flags = 0;
2701     xcrs.xcrs[0].xcr = 0;
2702     xcrs.xcrs[0].value = env->xcr0;
2703     return kvm_vcpu_ioctl(CPU(cpu), KVM_SET_XCRS, &xcrs);
2704 }
2705 
2706 static int kvm_put_sregs(X86CPU *cpu)
2707 {
2708     CPUX86State *env = &cpu->env;
2709     struct kvm_sregs sregs;
2710 
2711     /*
2712      * The interrupt_bitmap is ignored because KVM_SET_SREGS is
2713      * always followed by KVM_SET_VCPU_EVENTS.
2714      */
2715     memset(sregs.interrupt_bitmap, 0, sizeof(sregs.interrupt_bitmap));
2716 
2717     if ((env->eflags & VM_MASK)) {
2718         set_v8086_seg(&sregs.cs, &env->segs[R_CS]);
2719         set_v8086_seg(&sregs.ds, &env->segs[R_DS]);
2720         set_v8086_seg(&sregs.es, &env->segs[R_ES]);
2721         set_v8086_seg(&sregs.fs, &env->segs[R_FS]);
2722         set_v8086_seg(&sregs.gs, &env->segs[R_GS]);
2723         set_v8086_seg(&sregs.ss, &env->segs[R_SS]);
2724     } else {
2725         set_seg(&sregs.cs, &env->segs[R_CS]);
2726         set_seg(&sregs.ds, &env->segs[R_DS]);
2727         set_seg(&sregs.es, &env->segs[R_ES]);
2728         set_seg(&sregs.fs, &env->segs[R_FS]);
2729         set_seg(&sregs.gs, &env->segs[R_GS]);
2730         set_seg(&sregs.ss, &env->segs[R_SS]);
2731     }
2732 
2733     set_seg(&sregs.tr, &env->tr);
2734     set_seg(&sregs.ldt, &env->ldt);
2735 
2736     sregs.idt.limit = env->idt.limit;
2737     sregs.idt.base = env->idt.base;
2738     memset(sregs.idt.padding, 0, sizeof sregs.idt.padding);
2739     sregs.gdt.limit = env->gdt.limit;
2740     sregs.gdt.base = env->gdt.base;
2741     memset(sregs.gdt.padding, 0, sizeof sregs.gdt.padding);
2742 
2743     sregs.cr0 = env->cr[0];
2744     sregs.cr2 = env->cr[2];
2745     sregs.cr3 = env->cr[3];
2746     sregs.cr4 = env->cr[4];
2747 
2748     sregs.cr8 = cpu_get_apic_tpr(cpu->apic_state);
2749     sregs.apic_base = cpu_get_apic_base(cpu->apic_state);
2750 
2751     sregs.efer = env->efer;
2752 
2753     return kvm_vcpu_ioctl(CPU(cpu), KVM_SET_SREGS, &sregs);
2754 }
2755 
2756 static int kvm_put_sregs2(X86CPU *cpu)
2757 {
2758     CPUX86State *env = &cpu->env;
2759     struct kvm_sregs2 sregs;
2760     int i;
2761 
2762     sregs.flags = 0;
2763 
2764     if ((env->eflags & VM_MASK)) {
2765         set_v8086_seg(&sregs.cs, &env->segs[R_CS]);
2766         set_v8086_seg(&sregs.ds, &env->segs[R_DS]);
2767         set_v8086_seg(&sregs.es, &env->segs[R_ES]);
2768         set_v8086_seg(&sregs.fs, &env->segs[R_FS]);
2769         set_v8086_seg(&sregs.gs, &env->segs[R_GS]);
2770         set_v8086_seg(&sregs.ss, &env->segs[R_SS]);
2771     } else {
2772         set_seg(&sregs.cs, &env->segs[R_CS]);
2773         set_seg(&sregs.ds, &env->segs[R_DS]);
2774         set_seg(&sregs.es, &env->segs[R_ES]);
2775         set_seg(&sregs.fs, &env->segs[R_FS]);
2776         set_seg(&sregs.gs, &env->segs[R_GS]);
2777         set_seg(&sregs.ss, &env->segs[R_SS]);
2778     }
2779 
2780     set_seg(&sregs.tr, &env->tr);
2781     set_seg(&sregs.ldt, &env->ldt);
2782 
2783     sregs.idt.limit = env->idt.limit;
2784     sregs.idt.base = env->idt.base;
2785     memset(sregs.idt.padding, 0, sizeof sregs.idt.padding);
2786     sregs.gdt.limit = env->gdt.limit;
2787     sregs.gdt.base = env->gdt.base;
2788     memset(sregs.gdt.padding, 0, sizeof sregs.gdt.padding);
2789 
2790     sregs.cr0 = env->cr[0];
2791     sregs.cr2 = env->cr[2];
2792     sregs.cr3 = env->cr[3];
2793     sregs.cr4 = env->cr[4];
2794 
2795     sregs.cr8 = cpu_get_apic_tpr(cpu->apic_state);
2796     sregs.apic_base = cpu_get_apic_base(cpu->apic_state);
2797 
2798     sregs.efer = env->efer;
2799 
2800     if (env->pdptrs_valid) {
2801         for (i = 0; i < 4; i++) {
2802             sregs.pdptrs[i] = env->pdptrs[i];
2803         }
2804         sregs.flags |= KVM_SREGS2_FLAGS_PDPTRS_VALID;
2805     }
2806 
2807     return kvm_vcpu_ioctl(CPU(cpu), KVM_SET_SREGS2, &sregs);
2808 }
2809 
2810 
2811 static void kvm_msr_buf_reset(X86CPU *cpu)
2812 {
2813     memset(cpu->kvm_msr_buf, 0, MSR_BUF_SIZE);
2814 }
2815 
2816 static void kvm_msr_entry_add(X86CPU *cpu, uint32_t index, uint64_t value)
2817 {
2818     struct kvm_msrs *msrs = cpu->kvm_msr_buf;
2819     void *limit = ((void *)msrs) + MSR_BUF_SIZE;
2820     struct kvm_msr_entry *entry = &msrs->entries[msrs->nmsrs];
2821 
2822     assert((void *)(entry + 1) <= limit);
2823 
2824     entry->index = index;
2825     entry->reserved = 0;
2826     entry->data = value;
2827     msrs->nmsrs++;
2828 }
2829 
2830 static int kvm_put_one_msr(X86CPU *cpu, int index, uint64_t value)
2831 {
2832     kvm_msr_buf_reset(cpu);
2833     kvm_msr_entry_add(cpu, index, value);
2834 
2835     return kvm_vcpu_ioctl(CPU(cpu), KVM_SET_MSRS, cpu->kvm_msr_buf);
2836 }
2837 
2838 void kvm_put_apicbase(X86CPU *cpu, uint64_t value)
2839 {
2840     int ret;
2841 
2842     ret = kvm_put_one_msr(cpu, MSR_IA32_APICBASE, value);
2843     assert(ret == 1);
2844 }
2845 
2846 static int kvm_put_tscdeadline_msr(X86CPU *cpu)
2847 {
2848     CPUX86State *env = &cpu->env;
2849     int ret;
2850 
2851     if (!has_msr_tsc_deadline) {
2852         return 0;
2853     }
2854 
2855     ret = kvm_put_one_msr(cpu, MSR_IA32_TSCDEADLINE, env->tsc_deadline);
2856     if (ret < 0) {
2857         return ret;
2858     }
2859 
2860     assert(ret == 1);
2861     return 0;
2862 }
2863 
2864 /*
2865  * Provide a separate write service for the feature control MSR in order to
2866  * kick the VCPU out of VMXON or even guest mode on reset. This has to be done
2867  * before writing any other state because forcibly leaving nested mode
2868  * invalidates the VCPU state.
2869  */
2870 static int kvm_put_msr_feature_control(X86CPU *cpu)
2871 {
2872     int ret;
2873 
2874     if (!has_msr_feature_control) {
2875         return 0;
2876     }
2877 
2878     ret = kvm_put_one_msr(cpu, MSR_IA32_FEATURE_CONTROL,
2879                           cpu->env.msr_ia32_feature_control);
2880     if (ret < 0) {
2881         return ret;
2882     }
2883 
2884     assert(ret == 1);
2885     return 0;
2886 }
2887 
2888 static uint64_t make_vmx_msr_value(uint32_t index, uint32_t features)
2889 {
2890     uint32_t default1, can_be_one, can_be_zero;
2891     uint32_t must_be_one;
2892 
2893     switch (index) {
2894     case MSR_IA32_VMX_TRUE_PINBASED_CTLS:
2895         default1 = 0x00000016;
2896         break;
2897     case MSR_IA32_VMX_TRUE_PROCBASED_CTLS:
2898         default1 = 0x0401e172;
2899         break;
2900     case MSR_IA32_VMX_TRUE_ENTRY_CTLS:
2901         default1 = 0x000011ff;
2902         break;
2903     case MSR_IA32_VMX_TRUE_EXIT_CTLS:
2904         default1 = 0x00036dff;
2905         break;
2906     case MSR_IA32_VMX_PROCBASED_CTLS2:
2907         default1 = 0;
2908         break;
2909     default:
2910         abort();
2911     }
2912 
2913     /* If a feature bit is set, the control can be either set or clear.
2914      * Otherwise the value is limited to either 0 or 1 by default1.
2915      */
2916     can_be_one = features | default1;
2917     can_be_zero = features | ~default1;
2918     must_be_one = ~can_be_zero;
2919 
2920     /*
2921      * Bit 0:31 -> 0 if the control bit can be zero (i.e. 1 if it must be one).
2922      * Bit 32:63 -> 1 if the control bit can be one.
2923      */
2924     return must_be_one | (((uint64_t)can_be_one) << 32);
2925 }
2926 
2927 static void kvm_msr_entry_add_vmx(X86CPU *cpu, FeatureWordArray f)
2928 {
2929     uint64_t kvm_vmx_basic =
2930         kvm_arch_get_supported_msr_feature(kvm_state,
2931                                            MSR_IA32_VMX_BASIC);
2932 
2933     if (!kvm_vmx_basic) {
2934         /* If the kernel doesn't support VMX feature (kvm_intel.nested=0),
2935          * then kvm_vmx_basic will be 0 and KVM_SET_MSR will fail.
2936          */
2937         return;
2938     }
2939 
2940     uint64_t kvm_vmx_misc =
2941         kvm_arch_get_supported_msr_feature(kvm_state,
2942                                            MSR_IA32_VMX_MISC);
2943     uint64_t kvm_vmx_ept_vpid =
2944         kvm_arch_get_supported_msr_feature(kvm_state,
2945                                            MSR_IA32_VMX_EPT_VPID_CAP);
2946 
2947     /*
2948      * If the guest is 64-bit, a value of 1 is allowed for the host address
2949      * space size vmexit control.
2950      */
2951     uint64_t fixed_vmx_exit = f[FEAT_8000_0001_EDX] & CPUID_EXT2_LM
2952         ? (uint64_t)VMX_VM_EXIT_HOST_ADDR_SPACE_SIZE << 32 : 0;
2953 
2954     /*
2955      * Bits 0-30, 32-44 and 50-53 come from the host.  KVM should
2956      * not change them for backwards compatibility.
2957      */
2958     uint64_t fixed_vmx_basic = kvm_vmx_basic &
2959         (MSR_VMX_BASIC_VMCS_REVISION_MASK |
2960          MSR_VMX_BASIC_VMXON_REGION_SIZE_MASK |
2961          MSR_VMX_BASIC_VMCS_MEM_TYPE_MASK);
2962 
2963     /*
2964      * Same for bits 0-4 and 25-27.  Bits 16-24 (CR3 target count) can
2965      * change in the future but are always zero for now, clear them to be
2966      * future proof.  Bits 32-63 in theory could change, though KVM does
2967      * not support dual-monitor treatment and probably never will; mask
2968      * them out as well.
2969      */
2970     uint64_t fixed_vmx_misc = kvm_vmx_misc &
2971         (MSR_VMX_MISC_PREEMPTION_TIMER_SHIFT_MASK |
2972          MSR_VMX_MISC_MAX_MSR_LIST_SIZE_MASK);
2973 
2974     /*
2975      * EPT memory types should not change either, so we do not bother
2976      * adding features for them.
2977      */
2978     uint64_t fixed_vmx_ept_mask =
2979             (f[FEAT_VMX_SECONDARY_CTLS] & VMX_SECONDARY_EXEC_ENABLE_EPT ?
2980              MSR_VMX_EPT_UC | MSR_VMX_EPT_WB : 0);
2981     uint64_t fixed_vmx_ept_vpid = kvm_vmx_ept_vpid & fixed_vmx_ept_mask;
2982 
2983     kvm_msr_entry_add(cpu, MSR_IA32_VMX_TRUE_PROCBASED_CTLS,
2984                       make_vmx_msr_value(MSR_IA32_VMX_TRUE_PROCBASED_CTLS,
2985                                          f[FEAT_VMX_PROCBASED_CTLS]));
2986     kvm_msr_entry_add(cpu, MSR_IA32_VMX_TRUE_PINBASED_CTLS,
2987                       make_vmx_msr_value(MSR_IA32_VMX_TRUE_PINBASED_CTLS,
2988                                          f[FEAT_VMX_PINBASED_CTLS]));
2989     kvm_msr_entry_add(cpu, MSR_IA32_VMX_TRUE_EXIT_CTLS,
2990                       make_vmx_msr_value(MSR_IA32_VMX_TRUE_EXIT_CTLS,
2991                                          f[FEAT_VMX_EXIT_CTLS]) | fixed_vmx_exit);
2992     kvm_msr_entry_add(cpu, MSR_IA32_VMX_TRUE_ENTRY_CTLS,
2993                       make_vmx_msr_value(MSR_IA32_VMX_TRUE_ENTRY_CTLS,
2994                                          f[FEAT_VMX_ENTRY_CTLS]));
2995     kvm_msr_entry_add(cpu, MSR_IA32_VMX_PROCBASED_CTLS2,
2996                       make_vmx_msr_value(MSR_IA32_VMX_PROCBASED_CTLS2,
2997                                          f[FEAT_VMX_SECONDARY_CTLS]));
2998     kvm_msr_entry_add(cpu, MSR_IA32_VMX_EPT_VPID_CAP,
2999                       f[FEAT_VMX_EPT_VPID_CAPS] | fixed_vmx_ept_vpid);
3000     kvm_msr_entry_add(cpu, MSR_IA32_VMX_BASIC,
3001                       f[FEAT_VMX_BASIC] | fixed_vmx_basic);
3002     kvm_msr_entry_add(cpu, MSR_IA32_VMX_MISC,
3003                       f[FEAT_VMX_MISC] | fixed_vmx_misc);
3004     if (has_msr_vmx_vmfunc) {
3005         kvm_msr_entry_add(cpu, MSR_IA32_VMX_VMFUNC, f[FEAT_VMX_VMFUNC]);
3006     }
3007 
3008     /*
3009      * Just to be safe, write these with constant values.  The CRn_FIXED1
3010      * MSRs are generated by KVM based on the vCPU's CPUID.
3011      */
3012     kvm_msr_entry_add(cpu, MSR_IA32_VMX_CR0_FIXED0,
3013                       CR0_PE_MASK | CR0_PG_MASK | CR0_NE_MASK);
3014     kvm_msr_entry_add(cpu, MSR_IA32_VMX_CR4_FIXED0,
3015                       CR4_VMXE_MASK);
3016 
3017     if (f[FEAT_VMX_SECONDARY_CTLS] & VMX_SECONDARY_EXEC_TSC_SCALING) {
3018         /* TSC multiplier (0x2032).  */
3019         kvm_msr_entry_add(cpu, MSR_IA32_VMX_VMCS_ENUM, 0x32);
3020     } else {
3021         /* Preemption timer (0x482E).  */
3022         kvm_msr_entry_add(cpu, MSR_IA32_VMX_VMCS_ENUM, 0x2E);
3023     }
3024 }
3025 
3026 static void kvm_msr_entry_add_perf(X86CPU *cpu, FeatureWordArray f)
3027 {
3028     uint64_t kvm_perf_cap =
3029         kvm_arch_get_supported_msr_feature(kvm_state,
3030                                            MSR_IA32_PERF_CAPABILITIES);
3031 
3032     if (kvm_perf_cap) {
3033         kvm_msr_entry_add(cpu, MSR_IA32_PERF_CAPABILITIES,
3034                         kvm_perf_cap & f[FEAT_PERF_CAPABILITIES]);
3035     }
3036 }
3037 
3038 static int kvm_buf_set_msrs(X86CPU *cpu)
3039 {
3040     int ret = kvm_vcpu_ioctl(CPU(cpu), KVM_SET_MSRS, cpu->kvm_msr_buf);
3041     if (ret < 0) {
3042         return ret;
3043     }
3044 
3045     if (ret < cpu->kvm_msr_buf->nmsrs) {
3046         struct kvm_msr_entry *e = &cpu->kvm_msr_buf->entries[ret];
3047         error_report("error: failed to set MSR 0x%" PRIx32 " to 0x%" PRIx64,
3048                      (uint32_t)e->index, (uint64_t)e->data);
3049     }
3050 
3051     assert(ret == cpu->kvm_msr_buf->nmsrs);
3052     return 0;
3053 }
3054 
3055 static void kvm_init_msrs(X86CPU *cpu)
3056 {
3057     CPUX86State *env = &cpu->env;
3058 
3059     kvm_msr_buf_reset(cpu);
3060     if (has_msr_arch_capabs) {
3061         kvm_msr_entry_add(cpu, MSR_IA32_ARCH_CAPABILITIES,
3062                           env->features[FEAT_ARCH_CAPABILITIES]);
3063     }
3064 
3065     if (has_msr_core_capabs) {
3066         kvm_msr_entry_add(cpu, MSR_IA32_CORE_CAPABILITY,
3067                           env->features[FEAT_CORE_CAPABILITY]);
3068     }
3069 
3070     if (has_msr_perf_capabs && cpu->enable_pmu) {
3071         kvm_msr_entry_add_perf(cpu, env->features);
3072     }
3073 
3074     if (has_msr_ucode_rev) {
3075         kvm_msr_entry_add(cpu, MSR_IA32_UCODE_REV, cpu->ucode_rev);
3076     }
3077 
3078     /*
3079      * Older kernels do not include VMX MSRs in KVM_GET_MSR_INDEX_LIST, but
3080      * all kernels with MSR features should have them.
3081      */
3082     if (kvm_feature_msrs && cpu_has_vmx(env)) {
3083         kvm_msr_entry_add_vmx(cpu, env->features);
3084     }
3085 
3086     assert(kvm_buf_set_msrs(cpu) == 0);
3087 }
3088 
3089 static int kvm_put_msrs(X86CPU *cpu, int level)
3090 {
3091     CPUX86State *env = &cpu->env;
3092     int i;
3093 
3094     kvm_msr_buf_reset(cpu);
3095 
3096     kvm_msr_entry_add(cpu, MSR_IA32_SYSENTER_CS, env->sysenter_cs);
3097     kvm_msr_entry_add(cpu, MSR_IA32_SYSENTER_ESP, env->sysenter_esp);
3098     kvm_msr_entry_add(cpu, MSR_IA32_SYSENTER_EIP, env->sysenter_eip);
3099     kvm_msr_entry_add(cpu, MSR_PAT, env->pat);
3100     if (has_msr_star) {
3101         kvm_msr_entry_add(cpu, MSR_STAR, env->star);
3102     }
3103     if (has_msr_hsave_pa) {
3104         kvm_msr_entry_add(cpu, MSR_VM_HSAVE_PA, env->vm_hsave);
3105     }
3106     if (has_msr_tsc_aux) {
3107         kvm_msr_entry_add(cpu, MSR_TSC_AUX, env->tsc_aux);
3108     }
3109     if (has_msr_tsc_adjust) {
3110         kvm_msr_entry_add(cpu, MSR_TSC_ADJUST, env->tsc_adjust);
3111     }
3112     if (has_msr_misc_enable) {
3113         kvm_msr_entry_add(cpu, MSR_IA32_MISC_ENABLE,
3114                           env->msr_ia32_misc_enable);
3115     }
3116     if (has_msr_smbase) {
3117         kvm_msr_entry_add(cpu, MSR_IA32_SMBASE, env->smbase);
3118     }
3119     if (has_msr_smi_count) {
3120         kvm_msr_entry_add(cpu, MSR_SMI_COUNT, env->msr_smi_count);
3121     }
3122     if (has_msr_pkrs) {
3123         kvm_msr_entry_add(cpu, MSR_IA32_PKRS, env->pkrs);
3124     }
3125     if (has_msr_bndcfgs) {
3126         kvm_msr_entry_add(cpu, MSR_IA32_BNDCFGS, env->msr_bndcfgs);
3127     }
3128     if (has_msr_xss) {
3129         kvm_msr_entry_add(cpu, MSR_IA32_XSS, env->xss);
3130     }
3131     if (has_msr_umwait) {
3132         kvm_msr_entry_add(cpu, MSR_IA32_UMWAIT_CONTROL, env->umwait);
3133     }
3134     if (has_msr_spec_ctrl) {
3135         kvm_msr_entry_add(cpu, MSR_IA32_SPEC_CTRL, env->spec_ctrl);
3136     }
3137     if (has_tsc_scale_msr) {
3138         kvm_msr_entry_add(cpu, MSR_AMD64_TSC_RATIO, env->amd_tsc_scale_msr);
3139     }
3140 
3141     if (has_msr_tsx_ctrl) {
3142         kvm_msr_entry_add(cpu, MSR_IA32_TSX_CTRL, env->tsx_ctrl);
3143     }
3144     if (has_msr_virt_ssbd) {
3145         kvm_msr_entry_add(cpu, MSR_VIRT_SSBD, env->virt_ssbd);
3146     }
3147 
3148 #ifdef TARGET_X86_64
3149     if (lm_capable_kernel) {
3150         kvm_msr_entry_add(cpu, MSR_CSTAR, env->cstar);
3151         kvm_msr_entry_add(cpu, MSR_KERNELGSBASE, env->kernelgsbase);
3152         kvm_msr_entry_add(cpu, MSR_FMASK, env->fmask);
3153         kvm_msr_entry_add(cpu, MSR_LSTAR, env->lstar);
3154     }
3155 #endif
3156 
3157     /*
3158      * The following MSRs have side effects on the guest or are too heavy
3159      * for normal writeback. Limit them to reset or full state updates.
3160      */
3161     if (level >= KVM_PUT_RESET_STATE) {
3162         kvm_msr_entry_add(cpu, MSR_IA32_TSC, env->tsc);
3163         kvm_msr_entry_add(cpu, MSR_KVM_SYSTEM_TIME, env->system_time_msr);
3164         kvm_msr_entry_add(cpu, MSR_KVM_WALL_CLOCK, env->wall_clock_msr);
3165         if (env->features[FEAT_KVM] & (1 << KVM_FEATURE_ASYNC_PF_INT)) {
3166             kvm_msr_entry_add(cpu, MSR_KVM_ASYNC_PF_INT, env->async_pf_int_msr);
3167         }
3168         if (env->features[FEAT_KVM] & (1 << KVM_FEATURE_ASYNC_PF)) {
3169             kvm_msr_entry_add(cpu, MSR_KVM_ASYNC_PF_EN, env->async_pf_en_msr);
3170         }
3171         if (env->features[FEAT_KVM] & (1 << KVM_FEATURE_PV_EOI)) {
3172             kvm_msr_entry_add(cpu, MSR_KVM_PV_EOI_EN, env->pv_eoi_en_msr);
3173         }
3174         if (env->features[FEAT_KVM] & (1 << KVM_FEATURE_STEAL_TIME)) {
3175             kvm_msr_entry_add(cpu, MSR_KVM_STEAL_TIME, env->steal_time_msr);
3176         }
3177 
3178         if (env->features[FEAT_KVM] & (1 << KVM_FEATURE_POLL_CONTROL)) {
3179             kvm_msr_entry_add(cpu, MSR_KVM_POLL_CONTROL, env->poll_control_msr);
3180         }
3181 
3182         if (has_architectural_pmu_version > 0) {
3183             if (has_architectural_pmu_version > 1) {
3184                 /* Stop the counter.  */
3185                 kvm_msr_entry_add(cpu, MSR_CORE_PERF_FIXED_CTR_CTRL, 0);
3186                 kvm_msr_entry_add(cpu, MSR_CORE_PERF_GLOBAL_CTRL, 0);
3187             }
3188 
3189             /* Set the counter values.  */
3190             for (i = 0; i < num_architectural_pmu_fixed_counters; i++) {
3191                 kvm_msr_entry_add(cpu, MSR_CORE_PERF_FIXED_CTR0 + i,
3192                                   env->msr_fixed_counters[i]);
3193             }
3194             for (i = 0; i < num_architectural_pmu_gp_counters; i++) {
3195                 kvm_msr_entry_add(cpu, MSR_P6_PERFCTR0 + i,
3196                                   env->msr_gp_counters[i]);
3197                 kvm_msr_entry_add(cpu, MSR_P6_EVNTSEL0 + i,
3198                                   env->msr_gp_evtsel[i]);
3199             }
3200             if (has_architectural_pmu_version > 1) {
3201                 kvm_msr_entry_add(cpu, MSR_CORE_PERF_GLOBAL_STATUS,
3202                                   env->msr_global_status);
3203                 kvm_msr_entry_add(cpu, MSR_CORE_PERF_GLOBAL_OVF_CTRL,
3204                                   env->msr_global_ovf_ctrl);
3205 
3206                 /* Now start the PMU.  */
3207                 kvm_msr_entry_add(cpu, MSR_CORE_PERF_FIXED_CTR_CTRL,
3208                                   env->msr_fixed_ctr_ctrl);
3209                 kvm_msr_entry_add(cpu, MSR_CORE_PERF_GLOBAL_CTRL,
3210                                   env->msr_global_ctrl);
3211             }
3212         }
3213         /*
3214          * Hyper-V partition-wide MSRs: to avoid clearing them on cpu hot-add,
3215          * only sync them to KVM on the first cpu
3216          */
3217         if (current_cpu == first_cpu) {
3218             if (has_msr_hv_hypercall) {
3219                 kvm_msr_entry_add(cpu, HV_X64_MSR_GUEST_OS_ID,
3220                                   env->msr_hv_guest_os_id);
3221                 kvm_msr_entry_add(cpu, HV_X64_MSR_HYPERCALL,
3222                                   env->msr_hv_hypercall);
3223             }
3224             if (hyperv_feat_enabled(cpu, HYPERV_FEAT_TIME)) {
3225                 kvm_msr_entry_add(cpu, HV_X64_MSR_REFERENCE_TSC,
3226                                   env->msr_hv_tsc);
3227             }
3228             if (hyperv_feat_enabled(cpu, HYPERV_FEAT_REENLIGHTENMENT)) {
3229                 kvm_msr_entry_add(cpu, HV_X64_MSR_REENLIGHTENMENT_CONTROL,
3230                                   env->msr_hv_reenlightenment_control);
3231                 kvm_msr_entry_add(cpu, HV_X64_MSR_TSC_EMULATION_CONTROL,
3232                                   env->msr_hv_tsc_emulation_control);
3233                 kvm_msr_entry_add(cpu, HV_X64_MSR_TSC_EMULATION_STATUS,
3234                                   env->msr_hv_tsc_emulation_status);
3235             }
3236             if (hyperv_feat_enabled(cpu, HYPERV_FEAT_SYNDBG) &&
3237                 has_msr_hv_syndbg_options) {
3238                 kvm_msr_entry_add(cpu, HV_X64_MSR_SYNDBG_OPTIONS,
3239                                   hyperv_syndbg_query_options());
3240             }
3241         }
3242         if (hyperv_feat_enabled(cpu, HYPERV_FEAT_VAPIC)) {
3243             kvm_msr_entry_add(cpu, HV_X64_MSR_APIC_ASSIST_PAGE,
3244                               env->msr_hv_vapic);
3245         }
3246         if (has_msr_hv_crash) {
3247             int j;
3248 
3249             for (j = 0; j < HV_CRASH_PARAMS; j++)
3250                 kvm_msr_entry_add(cpu, HV_X64_MSR_CRASH_P0 + j,
3251                                   env->msr_hv_crash_params[j]);
3252 
3253             kvm_msr_entry_add(cpu, HV_X64_MSR_CRASH_CTL, HV_CRASH_CTL_NOTIFY);
3254         }
3255         if (has_msr_hv_runtime) {
3256             kvm_msr_entry_add(cpu, HV_X64_MSR_VP_RUNTIME, env->msr_hv_runtime);
3257         }
3258         if (hyperv_feat_enabled(cpu, HYPERV_FEAT_VPINDEX)
3259             && hv_vpindex_settable) {
3260             kvm_msr_entry_add(cpu, HV_X64_MSR_VP_INDEX,
3261                               hyperv_vp_index(CPU(cpu)));
3262         }
3263         if (hyperv_feat_enabled(cpu, HYPERV_FEAT_SYNIC)) {
3264             int j;
3265 
3266             kvm_msr_entry_add(cpu, HV_X64_MSR_SVERSION, HV_SYNIC_VERSION);
3267 
3268             kvm_msr_entry_add(cpu, HV_X64_MSR_SCONTROL,
3269                               env->msr_hv_synic_control);
3270             kvm_msr_entry_add(cpu, HV_X64_MSR_SIEFP,
3271                               env->msr_hv_synic_evt_page);
3272             kvm_msr_entry_add(cpu, HV_X64_MSR_SIMP,
3273                               env->msr_hv_synic_msg_page);
3274 
3275             for (j = 0; j < ARRAY_SIZE(env->msr_hv_synic_sint); j++) {
3276                 kvm_msr_entry_add(cpu, HV_X64_MSR_SINT0 + j,
3277                                   env->msr_hv_synic_sint[j]);
3278             }
3279         }
3280         if (has_msr_hv_stimer) {
3281             int j;
3282 
3283             for (j = 0; j < ARRAY_SIZE(env->msr_hv_stimer_config); j++) {
3284                 kvm_msr_entry_add(cpu, HV_X64_MSR_STIMER0_CONFIG + j * 2,
3285                                 env->msr_hv_stimer_config[j]);
3286             }
3287 
3288             for (j = 0; j < ARRAY_SIZE(env->msr_hv_stimer_count); j++) {
3289                 kvm_msr_entry_add(cpu, HV_X64_MSR_STIMER0_COUNT + j * 2,
3290                                 env->msr_hv_stimer_count[j]);
3291             }
3292         }
3293         if (env->features[FEAT_1_EDX] & CPUID_MTRR) {
3294             uint64_t phys_mask = MAKE_64BIT_MASK(0, cpu->phys_bits);
3295 
3296             kvm_msr_entry_add(cpu, MSR_MTRRdefType, env->mtrr_deftype);
3297             kvm_msr_entry_add(cpu, MSR_MTRRfix64K_00000, env->mtrr_fixed[0]);
3298             kvm_msr_entry_add(cpu, MSR_MTRRfix16K_80000, env->mtrr_fixed[1]);
3299             kvm_msr_entry_add(cpu, MSR_MTRRfix16K_A0000, env->mtrr_fixed[2]);
3300             kvm_msr_entry_add(cpu, MSR_MTRRfix4K_C0000, env->mtrr_fixed[3]);
3301             kvm_msr_entry_add(cpu, MSR_MTRRfix4K_C8000, env->mtrr_fixed[4]);
3302             kvm_msr_entry_add(cpu, MSR_MTRRfix4K_D0000, env->mtrr_fixed[5]);
3303             kvm_msr_entry_add(cpu, MSR_MTRRfix4K_D8000, env->mtrr_fixed[6]);
3304             kvm_msr_entry_add(cpu, MSR_MTRRfix4K_E0000, env->mtrr_fixed[7]);
3305             kvm_msr_entry_add(cpu, MSR_MTRRfix4K_E8000, env->mtrr_fixed[8]);
3306             kvm_msr_entry_add(cpu, MSR_MTRRfix4K_F0000, env->mtrr_fixed[9]);
3307             kvm_msr_entry_add(cpu, MSR_MTRRfix4K_F8000, env->mtrr_fixed[10]);
3308             for (i = 0; i < MSR_MTRRcap_VCNT; i++) {
3309                 /* The CPU GPs if we write to a bit above the physical limit of
3310                  * the host CPU (and KVM emulates that)
3311                  */
3312                 uint64_t mask = env->mtrr_var[i].mask;
3313                 mask &= phys_mask;
3314 
3315                 kvm_msr_entry_add(cpu, MSR_MTRRphysBase(i),
3316                                   env->mtrr_var[i].base);
3317                 kvm_msr_entry_add(cpu, MSR_MTRRphysMask(i), mask);
3318             }
3319         }
3320         if (env->features[FEAT_7_0_EBX] & CPUID_7_0_EBX_INTEL_PT) {
3321             int addr_num = kvm_arch_get_supported_cpuid(kvm_state,
3322                                                     0x14, 1, R_EAX) & 0x7;
3323 
3324             kvm_msr_entry_add(cpu, MSR_IA32_RTIT_CTL,
3325                             env->msr_rtit_ctrl);
3326             kvm_msr_entry_add(cpu, MSR_IA32_RTIT_STATUS,
3327                             env->msr_rtit_status);
3328             kvm_msr_entry_add(cpu, MSR_IA32_RTIT_OUTPUT_BASE,
3329                             env->msr_rtit_output_base);
3330             kvm_msr_entry_add(cpu, MSR_IA32_RTIT_OUTPUT_MASK,
3331                             env->msr_rtit_output_mask);
3332             kvm_msr_entry_add(cpu, MSR_IA32_RTIT_CR3_MATCH,
3333                             env->msr_rtit_cr3_match);
3334             for (i = 0; i < addr_num; i++) {
3335                 kvm_msr_entry_add(cpu, MSR_IA32_RTIT_ADDR0_A + i,
3336                             env->msr_rtit_addrs[i]);
3337             }
3338         }
3339 
3340         if (env->features[FEAT_7_0_ECX] & CPUID_7_0_ECX_SGX_LC) {
3341             kvm_msr_entry_add(cpu, MSR_IA32_SGXLEPUBKEYHASH0,
3342                               env->msr_ia32_sgxlepubkeyhash[0]);
3343             kvm_msr_entry_add(cpu, MSR_IA32_SGXLEPUBKEYHASH1,
3344                               env->msr_ia32_sgxlepubkeyhash[1]);
3345             kvm_msr_entry_add(cpu, MSR_IA32_SGXLEPUBKEYHASH2,
3346                               env->msr_ia32_sgxlepubkeyhash[2]);
3347             kvm_msr_entry_add(cpu, MSR_IA32_SGXLEPUBKEYHASH3,
3348                               env->msr_ia32_sgxlepubkeyhash[3]);
3349         }
3350 
3351         if (env->features[FEAT_XSAVE] & CPUID_D_1_EAX_XFD) {
3352             kvm_msr_entry_add(cpu, MSR_IA32_XFD,
3353                               env->msr_xfd);
3354             kvm_msr_entry_add(cpu, MSR_IA32_XFD_ERR,
3355                               env->msr_xfd_err);
3356         }
3357 
3358         /* Note: MSR_IA32_FEATURE_CONTROL is written separately, see
3359          *       kvm_put_msr_feature_control. */
3360     }
3361 
3362     if (env->mcg_cap) {
3363         int i;
3364 
3365         kvm_msr_entry_add(cpu, MSR_MCG_STATUS, env->mcg_status);
3366         kvm_msr_entry_add(cpu, MSR_MCG_CTL, env->mcg_ctl);
3367         if (has_msr_mcg_ext_ctl) {
3368             kvm_msr_entry_add(cpu, MSR_MCG_EXT_CTL, env->mcg_ext_ctl);
3369         }
3370         for (i = 0; i < (env->mcg_cap & 0xff) * 4; i++) {
3371             kvm_msr_entry_add(cpu, MSR_MC0_CTL + i, env->mce_banks[i]);
3372         }
3373     }
3374 
3375     return kvm_buf_set_msrs(cpu);
3376 }
3377 
3378 
3379 static int kvm_get_fpu(X86CPU *cpu)
3380 {
3381     CPUX86State *env = &cpu->env;
3382     struct kvm_fpu fpu;
3383     int i, ret;
3384 
3385     ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_FPU, &fpu);
3386     if (ret < 0) {
3387         return ret;
3388     }
3389 
3390     env->fpstt = (fpu.fsw >> 11) & 7;
3391     env->fpus = fpu.fsw;
3392     env->fpuc = fpu.fcw;
3393     env->fpop = fpu.last_opcode;
3394     env->fpip = fpu.last_ip;
3395     env->fpdp = fpu.last_dp;
3396     for (i = 0; i < 8; ++i) {
3397         env->fptags[i] = !((fpu.ftwx >> i) & 1);
3398     }
3399     memcpy(env->fpregs, fpu.fpr, sizeof env->fpregs);
3400     for (i = 0; i < CPU_NB_REGS; i++) {
3401         env->xmm_regs[i].ZMM_Q(0) = ldq_p(&fpu.xmm[i][0]);
3402         env->xmm_regs[i].ZMM_Q(1) = ldq_p(&fpu.xmm[i][8]);
3403     }
3404     env->mxcsr = fpu.mxcsr;
3405 
3406     return 0;
3407 }
3408 
3409 static int kvm_get_xsave(X86CPU *cpu)
3410 {
3411     CPUX86State *env = &cpu->env;
3412     void *xsave = env->xsave_buf;
3413     int type, ret;
3414 
3415     if (!has_xsave) {
3416         return kvm_get_fpu(cpu);
3417     }
3418 
3419     type = has_xsave2 ? KVM_GET_XSAVE2 : KVM_GET_XSAVE;
3420     ret = kvm_vcpu_ioctl(CPU(cpu), type, xsave);
3421     if (ret < 0) {
3422         return ret;
3423     }
3424     x86_cpu_xrstor_all_areas(cpu, xsave, env->xsave_buf_len);
3425 
3426     return 0;
3427 }
3428 
3429 static int kvm_get_xcrs(X86CPU *cpu)
3430 {
3431     CPUX86State *env = &cpu->env;
3432     int i, ret;
3433     struct kvm_xcrs xcrs;
3434 
3435     if (!has_xcrs) {
3436         return 0;
3437     }
3438 
3439     ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_XCRS, &xcrs);
3440     if (ret < 0) {
3441         return ret;
3442     }
3443 
3444     for (i = 0; i < xcrs.nr_xcrs; i++) {
3445         /* Only support xcr0 now */
3446         if (xcrs.xcrs[i].xcr == 0) {
3447             env->xcr0 = xcrs.xcrs[i].value;
3448             break;
3449         }
3450     }
3451     return 0;
3452 }
3453 
3454 static int kvm_get_sregs(X86CPU *cpu)
3455 {
3456     CPUX86State *env = &cpu->env;
3457     struct kvm_sregs sregs;
3458     int ret;
3459 
3460     ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_SREGS, &sregs);
3461     if (ret < 0) {
3462         return ret;
3463     }
3464 
3465     /*
3466      * The interrupt_bitmap is ignored because KVM_GET_SREGS is
3467      * always preceded by KVM_GET_VCPU_EVENTS.
3468      */
3469 
3470     get_seg(&env->segs[R_CS], &sregs.cs);
3471     get_seg(&env->segs[R_DS], &sregs.ds);
3472     get_seg(&env->segs[R_ES], &sregs.es);
3473     get_seg(&env->segs[R_FS], &sregs.fs);
3474     get_seg(&env->segs[R_GS], &sregs.gs);
3475     get_seg(&env->segs[R_SS], &sregs.ss);
3476 
3477     get_seg(&env->tr, &sregs.tr);
3478     get_seg(&env->ldt, &sregs.ldt);
3479 
3480     env->idt.limit = sregs.idt.limit;
3481     env->idt.base = sregs.idt.base;
3482     env->gdt.limit = sregs.gdt.limit;
3483     env->gdt.base = sregs.gdt.base;
3484 
3485     env->cr[0] = sregs.cr0;
3486     env->cr[2] = sregs.cr2;
3487     env->cr[3] = sregs.cr3;
3488     env->cr[4] = sregs.cr4;
3489 
3490     env->efer = sregs.efer;
3491 
3492     /* changes to apic base and cr8/tpr are read back via kvm_arch_post_run */
3493     x86_update_hflags(env);
3494 
3495     return 0;
3496 }
3497 
3498 static int kvm_get_sregs2(X86CPU *cpu)
3499 {
3500     CPUX86State *env = &cpu->env;
3501     struct kvm_sregs2 sregs;
3502     int i, ret;
3503 
3504     ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_SREGS2, &sregs);
3505     if (ret < 0) {
3506         return ret;
3507     }
3508 
3509     get_seg(&env->segs[R_CS], &sregs.cs);
3510     get_seg(&env->segs[R_DS], &sregs.ds);
3511     get_seg(&env->segs[R_ES], &sregs.es);
3512     get_seg(&env->segs[R_FS], &sregs.fs);
3513     get_seg(&env->segs[R_GS], &sregs.gs);
3514     get_seg(&env->segs[R_SS], &sregs.ss);
3515 
3516     get_seg(&env->tr, &sregs.tr);
3517     get_seg(&env->ldt, &sregs.ldt);
3518 
3519     env->idt.limit = sregs.idt.limit;
3520     env->idt.base = sregs.idt.base;
3521     env->gdt.limit = sregs.gdt.limit;
3522     env->gdt.base = sregs.gdt.base;
3523 
3524     env->cr[0] = sregs.cr0;
3525     env->cr[2] = sregs.cr2;
3526     env->cr[3] = sregs.cr3;
3527     env->cr[4] = sregs.cr4;
3528 
3529     env->efer = sregs.efer;
3530 
3531     env->pdptrs_valid = sregs.flags & KVM_SREGS2_FLAGS_PDPTRS_VALID;
3532 
3533     if (env->pdptrs_valid) {
3534         for (i = 0; i < 4; i++) {
3535             env->pdptrs[i] = sregs.pdptrs[i];
3536         }
3537     }
3538 
3539     /* changes to apic base and cr8/tpr are read back via kvm_arch_post_run */
3540     x86_update_hflags(env);
3541 
3542     return 0;
3543 }
3544 
3545 static int kvm_get_msrs(X86CPU *cpu)
3546 {
3547     CPUX86State *env = &cpu->env;
3548     struct kvm_msr_entry *msrs = cpu->kvm_msr_buf->entries;
3549     int ret, i;
3550     uint64_t mtrr_top_bits;
3551 
3552     kvm_msr_buf_reset(cpu);
3553 
3554     kvm_msr_entry_add(cpu, MSR_IA32_SYSENTER_CS, 0);
3555     kvm_msr_entry_add(cpu, MSR_IA32_SYSENTER_ESP, 0);
3556     kvm_msr_entry_add(cpu, MSR_IA32_SYSENTER_EIP, 0);
3557     kvm_msr_entry_add(cpu, MSR_PAT, 0);
3558     if (has_msr_star) {
3559         kvm_msr_entry_add(cpu, MSR_STAR, 0);
3560     }
3561     if (has_msr_hsave_pa) {
3562         kvm_msr_entry_add(cpu, MSR_VM_HSAVE_PA, 0);
3563     }
3564     if (has_msr_tsc_aux) {
3565         kvm_msr_entry_add(cpu, MSR_TSC_AUX, 0);
3566     }
3567     if (has_msr_tsc_adjust) {
3568         kvm_msr_entry_add(cpu, MSR_TSC_ADJUST, 0);
3569     }
3570     if (has_msr_tsc_deadline) {
3571         kvm_msr_entry_add(cpu, MSR_IA32_TSCDEADLINE, 0);
3572     }
3573     if (has_msr_misc_enable) {
3574         kvm_msr_entry_add(cpu, MSR_IA32_MISC_ENABLE, 0);
3575     }
3576     if (has_msr_smbase) {
3577         kvm_msr_entry_add(cpu, MSR_IA32_SMBASE, 0);
3578     }
3579     if (has_msr_smi_count) {
3580         kvm_msr_entry_add(cpu, MSR_SMI_COUNT, 0);
3581     }
3582     if (has_msr_feature_control) {
3583         kvm_msr_entry_add(cpu, MSR_IA32_FEATURE_CONTROL, 0);
3584     }
3585     if (has_msr_pkrs) {
3586         kvm_msr_entry_add(cpu, MSR_IA32_PKRS, 0);
3587     }
3588     if (has_msr_bndcfgs) {
3589         kvm_msr_entry_add(cpu, MSR_IA32_BNDCFGS, 0);
3590     }
3591     if (has_msr_xss) {
3592         kvm_msr_entry_add(cpu, MSR_IA32_XSS, 0);
3593     }
3594     if (has_msr_umwait) {
3595         kvm_msr_entry_add(cpu, MSR_IA32_UMWAIT_CONTROL, 0);
3596     }
3597     if (has_msr_spec_ctrl) {
3598         kvm_msr_entry_add(cpu, MSR_IA32_SPEC_CTRL, 0);
3599     }
3600     if (has_tsc_scale_msr) {
3601         kvm_msr_entry_add(cpu, MSR_AMD64_TSC_RATIO, 0);
3602     }
3603 
3604     if (has_msr_tsx_ctrl) {
3605         kvm_msr_entry_add(cpu, MSR_IA32_TSX_CTRL, 0);
3606     }
3607     if (has_msr_virt_ssbd) {
3608         kvm_msr_entry_add(cpu, MSR_VIRT_SSBD, 0);
3609     }
3610     if (!env->tsc_valid) {
3611         kvm_msr_entry_add(cpu, MSR_IA32_TSC, 0);
3612         env->tsc_valid = !runstate_is_running();
3613     }
3614 
3615 #ifdef TARGET_X86_64
3616     if (lm_capable_kernel) {
3617         kvm_msr_entry_add(cpu, MSR_CSTAR, 0);
3618         kvm_msr_entry_add(cpu, MSR_KERNELGSBASE, 0);
3619         kvm_msr_entry_add(cpu, MSR_FMASK, 0);
3620         kvm_msr_entry_add(cpu, MSR_LSTAR, 0);
3621     }
3622 #endif
3623     kvm_msr_entry_add(cpu, MSR_KVM_SYSTEM_TIME, 0);
3624     kvm_msr_entry_add(cpu, MSR_KVM_WALL_CLOCK, 0);
3625     if (env->features[FEAT_KVM] & (1 << KVM_FEATURE_ASYNC_PF_INT)) {
3626         kvm_msr_entry_add(cpu, MSR_KVM_ASYNC_PF_INT, 0);
3627     }
3628     if (env->features[FEAT_KVM] & (1 << KVM_FEATURE_ASYNC_PF)) {
3629         kvm_msr_entry_add(cpu, MSR_KVM_ASYNC_PF_EN, 0);
3630     }
3631     if (env->features[FEAT_KVM] & (1 << KVM_FEATURE_PV_EOI)) {
3632         kvm_msr_entry_add(cpu, MSR_KVM_PV_EOI_EN, 0);
3633     }
3634     if (env->features[FEAT_KVM] & (1 << KVM_FEATURE_STEAL_TIME)) {
3635         kvm_msr_entry_add(cpu, MSR_KVM_STEAL_TIME, 0);
3636     }
3637     if (env->features[FEAT_KVM] & (1 << KVM_FEATURE_POLL_CONTROL)) {
3638         kvm_msr_entry_add(cpu, MSR_KVM_POLL_CONTROL, 1);
3639     }
3640     if (has_architectural_pmu_version > 0) {
3641         if (has_architectural_pmu_version > 1) {
3642             kvm_msr_entry_add(cpu, MSR_CORE_PERF_FIXED_CTR_CTRL, 0);
3643             kvm_msr_entry_add(cpu, MSR_CORE_PERF_GLOBAL_CTRL, 0);
3644             kvm_msr_entry_add(cpu, MSR_CORE_PERF_GLOBAL_STATUS, 0);
3645             kvm_msr_entry_add(cpu, MSR_CORE_PERF_GLOBAL_OVF_CTRL, 0);
3646         }
3647         for (i = 0; i < num_architectural_pmu_fixed_counters; i++) {
3648             kvm_msr_entry_add(cpu, MSR_CORE_PERF_FIXED_CTR0 + i, 0);
3649         }
3650         for (i = 0; i < num_architectural_pmu_gp_counters; i++) {
3651             kvm_msr_entry_add(cpu, MSR_P6_PERFCTR0 + i, 0);
3652             kvm_msr_entry_add(cpu, MSR_P6_EVNTSEL0 + i, 0);
3653         }
3654     }
3655 
3656     if (env->mcg_cap) {
3657         kvm_msr_entry_add(cpu, MSR_MCG_STATUS, 0);
3658         kvm_msr_entry_add(cpu, MSR_MCG_CTL, 0);
3659         if (has_msr_mcg_ext_ctl) {
3660             kvm_msr_entry_add(cpu, MSR_MCG_EXT_CTL, 0);
3661         }
3662         for (i = 0; i < (env->mcg_cap & 0xff) * 4; i++) {
3663             kvm_msr_entry_add(cpu, MSR_MC0_CTL + i, 0);
3664         }
3665     }
3666 
3667     if (has_msr_hv_hypercall) {
3668         kvm_msr_entry_add(cpu, HV_X64_MSR_HYPERCALL, 0);
3669         kvm_msr_entry_add(cpu, HV_X64_MSR_GUEST_OS_ID, 0);
3670     }
3671     if (hyperv_feat_enabled(cpu, HYPERV_FEAT_VAPIC)) {
3672         kvm_msr_entry_add(cpu, HV_X64_MSR_APIC_ASSIST_PAGE, 0);
3673     }
3674     if (hyperv_feat_enabled(cpu, HYPERV_FEAT_TIME)) {
3675         kvm_msr_entry_add(cpu, HV_X64_MSR_REFERENCE_TSC, 0);
3676     }
3677     if (hyperv_feat_enabled(cpu, HYPERV_FEAT_REENLIGHTENMENT)) {
3678         kvm_msr_entry_add(cpu, HV_X64_MSR_REENLIGHTENMENT_CONTROL, 0);
3679         kvm_msr_entry_add(cpu, HV_X64_MSR_TSC_EMULATION_CONTROL, 0);
3680         kvm_msr_entry_add(cpu, HV_X64_MSR_TSC_EMULATION_STATUS, 0);
3681     }
3682     if (has_msr_hv_syndbg_options) {
3683         kvm_msr_entry_add(cpu, HV_X64_MSR_SYNDBG_OPTIONS, 0);
3684     }
3685     if (has_msr_hv_crash) {
3686         int j;
3687 
3688         for (j = 0; j < HV_CRASH_PARAMS; j++) {
3689             kvm_msr_entry_add(cpu, HV_X64_MSR_CRASH_P0 + j, 0);
3690         }
3691     }
3692     if (has_msr_hv_runtime) {
3693         kvm_msr_entry_add(cpu, HV_X64_MSR_VP_RUNTIME, 0);
3694     }
3695     if (hyperv_feat_enabled(cpu, HYPERV_FEAT_SYNIC)) {
3696         uint32_t msr;
3697 
3698         kvm_msr_entry_add(cpu, HV_X64_MSR_SCONTROL, 0);
3699         kvm_msr_entry_add(cpu, HV_X64_MSR_SIEFP, 0);
3700         kvm_msr_entry_add(cpu, HV_X64_MSR_SIMP, 0);
3701         for (msr = HV_X64_MSR_SINT0; msr <= HV_X64_MSR_SINT15; msr++) {
3702             kvm_msr_entry_add(cpu, msr, 0);
3703         }
3704     }
3705     if (has_msr_hv_stimer) {
3706         uint32_t msr;
3707 
3708         for (msr = HV_X64_MSR_STIMER0_CONFIG; msr <= HV_X64_MSR_STIMER3_COUNT;
3709              msr++) {
3710             kvm_msr_entry_add(cpu, msr, 0);
3711         }
3712     }
3713     if (env->features[FEAT_1_EDX] & CPUID_MTRR) {
3714         kvm_msr_entry_add(cpu, MSR_MTRRdefType, 0);
3715         kvm_msr_entry_add(cpu, MSR_MTRRfix64K_00000, 0);
3716         kvm_msr_entry_add(cpu, MSR_MTRRfix16K_80000, 0);
3717         kvm_msr_entry_add(cpu, MSR_MTRRfix16K_A0000, 0);
3718         kvm_msr_entry_add(cpu, MSR_MTRRfix4K_C0000, 0);
3719         kvm_msr_entry_add(cpu, MSR_MTRRfix4K_C8000, 0);
3720         kvm_msr_entry_add(cpu, MSR_MTRRfix4K_D0000, 0);
3721         kvm_msr_entry_add(cpu, MSR_MTRRfix4K_D8000, 0);
3722         kvm_msr_entry_add(cpu, MSR_MTRRfix4K_E0000, 0);
3723         kvm_msr_entry_add(cpu, MSR_MTRRfix4K_E8000, 0);
3724         kvm_msr_entry_add(cpu, MSR_MTRRfix4K_F0000, 0);
3725         kvm_msr_entry_add(cpu, MSR_MTRRfix4K_F8000, 0);
3726         for (i = 0; i < MSR_MTRRcap_VCNT; i++) {
3727             kvm_msr_entry_add(cpu, MSR_MTRRphysBase(i), 0);
3728             kvm_msr_entry_add(cpu, MSR_MTRRphysMask(i), 0);
3729         }
3730     }
3731 
3732     if (env->features[FEAT_7_0_EBX] & CPUID_7_0_EBX_INTEL_PT) {
3733         int addr_num =
3734             kvm_arch_get_supported_cpuid(kvm_state, 0x14, 1, R_EAX) & 0x7;
3735 
3736         kvm_msr_entry_add(cpu, MSR_IA32_RTIT_CTL, 0);
3737         kvm_msr_entry_add(cpu, MSR_IA32_RTIT_STATUS, 0);
3738         kvm_msr_entry_add(cpu, MSR_IA32_RTIT_OUTPUT_BASE, 0);
3739         kvm_msr_entry_add(cpu, MSR_IA32_RTIT_OUTPUT_MASK, 0);
3740         kvm_msr_entry_add(cpu, MSR_IA32_RTIT_CR3_MATCH, 0);
3741         for (i = 0; i < addr_num; i++) {
3742             kvm_msr_entry_add(cpu, MSR_IA32_RTIT_ADDR0_A + i, 0);
3743         }
3744     }
3745 
3746     if (env->features[FEAT_7_0_ECX] & CPUID_7_0_ECX_SGX_LC) {
3747         kvm_msr_entry_add(cpu, MSR_IA32_SGXLEPUBKEYHASH0, 0);
3748         kvm_msr_entry_add(cpu, MSR_IA32_SGXLEPUBKEYHASH1, 0);
3749         kvm_msr_entry_add(cpu, MSR_IA32_SGXLEPUBKEYHASH2, 0);
3750         kvm_msr_entry_add(cpu, MSR_IA32_SGXLEPUBKEYHASH3, 0);
3751     }
3752 
3753     if (env->features[FEAT_XSAVE] & CPUID_D_1_EAX_XFD) {
3754         kvm_msr_entry_add(cpu, MSR_IA32_XFD, 0);
3755         kvm_msr_entry_add(cpu, MSR_IA32_XFD_ERR, 0);
3756     }
3757 
3758     ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_MSRS, cpu->kvm_msr_buf);
3759     if (ret < 0) {
3760         return ret;
3761     }
3762 
3763     if (ret < cpu->kvm_msr_buf->nmsrs) {
3764         struct kvm_msr_entry *e = &cpu->kvm_msr_buf->entries[ret];
3765         error_report("error: failed to get MSR 0x%" PRIx32,
3766                      (uint32_t)e->index);
3767     }
3768 
3769     assert(ret == cpu->kvm_msr_buf->nmsrs);
3770     /*
3771      * MTRR masks: Each mask consists of 5 parts
3772      * a  10..0: must be zero
3773      * b  11   : valid bit
3774      * c n-1.12: actual mask bits
3775      * d  51..n: reserved must be zero
3776      * e  63.52: reserved must be zero
3777      *
3778      * 'n' is the number of physical bits supported by the CPU and is
3779      * apparently always <= 52.   We know our 'n' but don't know what
3780      * the destinations 'n' is; it might be smaller, in which case
3781      * it masks (c) on loading. It might be larger, in which case
3782      * we fill 'd' so that d..c is consistent irrespetive of the 'n'
3783      * we're migrating to.
3784      */
3785 
3786     if (cpu->fill_mtrr_mask) {
3787         QEMU_BUILD_BUG_ON(TARGET_PHYS_ADDR_SPACE_BITS > 52);
3788         assert(cpu->phys_bits <= TARGET_PHYS_ADDR_SPACE_BITS);
3789         mtrr_top_bits = MAKE_64BIT_MASK(cpu->phys_bits, 52 - cpu->phys_bits);
3790     } else {
3791         mtrr_top_bits = 0;
3792     }
3793 
3794     for (i = 0; i < ret; i++) {
3795         uint32_t index = msrs[i].index;
3796         switch (index) {
3797         case MSR_IA32_SYSENTER_CS:
3798             env->sysenter_cs = msrs[i].data;
3799             break;
3800         case MSR_IA32_SYSENTER_ESP:
3801             env->sysenter_esp = msrs[i].data;
3802             break;
3803         case MSR_IA32_SYSENTER_EIP:
3804             env->sysenter_eip = msrs[i].data;
3805             break;
3806         case MSR_PAT:
3807             env->pat = msrs[i].data;
3808             break;
3809         case MSR_STAR:
3810             env->star = msrs[i].data;
3811             break;
3812 #ifdef TARGET_X86_64
3813         case MSR_CSTAR:
3814             env->cstar = msrs[i].data;
3815             break;
3816         case MSR_KERNELGSBASE:
3817             env->kernelgsbase = msrs[i].data;
3818             break;
3819         case MSR_FMASK:
3820             env->fmask = msrs[i].data;
3821             break;
3822         case MSR_LSTAR:
3823             env->lstar = msrs[i].data;
3824             break;
3825 #endif
3826         case MSR_IA32_TSC:
3827             env->tsc = msrs[i].data;
3828             break;
3829         case MSR_TSC_AUX:
3830             env->tsc_aux = msrs[i].data;
3831             break;
3832         case MSR_TSC_ADJUST:
3833             env->tsc_adjust = msrs[i].data;
3834             break;
3835         case MSR_IA32_TSCDEADLINE:
3836             env->tsc_deadline = msrs[i].data;
3837             break;
3838         case MSR_VM_HSAVE_PA:
3839             env->vm_hsave = msrs[i].data;
3840             break;
3841         case MSR_KVM_SYSTEM_TIME:
3842             env->system_time_msr = msrs[i].data;
3843             break;
3844         case MSR_KVM_WALL_CLOCK:
3845             env->wall_clock_msr = msrs[i].data;
3846             break;
3847         case MSR_MCG_STATUS:
3848             env->mcg_status = msrs[i].data;
3849             break;
3850         case MSR_MCG_CTL:
3851             env->mcg_ctl = msrs[i].data;
3852             break;
3853         case MSR_MCG_EXT_CTL:
3854             env->mcg_ext_ctl = msrs[i].data;
3855             break;
3856         case MSR_IA32_MISC_ENABLE:
3857             env->msr_ia32_misc_enable = msrs[i].data;
3858             break;
3859         case MSR_IA32_SMBASE:
3860             env->smbase = msrs[i].data;
3861             break;
3862         case MSR_SMI_COUNT:
3863             env->msr_smi_count = msrs[i].data;
3864             break;
3865         case MSR_IA32_FEATURE_CONTROL:
3866             env->msr_ia32_feature_control = msrs[i].data;
3867             break;
3868         case MSR_IA32_BNDCFGS:
3869             env->msr_bndcfgs = msrs[i].data;
3870             break;
3871         case MSR_IA32_XSS:
3872             env->xss = msrs[i].data;
3873             break;
3874         case MSR_IA32_UMWAIT_CONTROL:
3875             env->umwait = msrs[i].data;
3876             break;
3877         case MSR_IA32_PKRS:
3878             env->pkrs = msrs[i].data;
3879             break;
3880         default:
3881             if (msrs[i].index >= MSR_MC0_CTL &&
3882                 msrs[i].index < MSR_MC0_CTL + (env->mcg_cap & 0xff) * 4) {
3883                 env->mce_banks[msrs[i].index - MSR_MC0_CTL] = msrs[i].data;
3884             }
3885             break;
3886         case MSR_KVM_ASYNC_PF_EN:
3887             env->async_pf_en_msr = msrs[i].data;
3888             break;
3889         case MSR_KVM_ASYNC_PF_INT:
3890             env->async_pf_int_msr = msrs[i].data;
3891             break;
3892         case MSR_KVM_PV_EOI_EN:
3893             env->pv_eoi_en_msr = msrs[i].data;
3894             break;
3895         case MSR_KVM_STEAL_TIME:
3896             env->steal_time_msr = msrs[i].data;
3897             break;
3898         case MSR_KVM_POLL_CONTROL: {
3899             env->poll_control_msr = msrs[i].data;
3900             break;
3901         }
3902         case MSR_CORE_PERF_FIXED_CTR_CTRL:
3903             env->msr_fixed_ctr_ctrl = msrs[i].data;
3904             break;
3905         case MSR_CORE_PERF_GLOBAL_CTRL:
3906             env->msr_global_ctrl = msrs[i].data;
3907             break;
3908         case MSR_CORE_PERF_GLOBAL_STATUS:
3909             env->msr_global_status = msrs[i].data;
3910             break;
3911         case MSR_CORE_PERF_GLOBAL_OVF_CTRL:
3912             env->msr_global_ovf_ctrl = msrs[i].data;
3913             break;
3914         case MSR_CORE_PERF_FIXED_CTR0 ... MSR_CORE_PERF_FIXED_CTR0 + MAX_FIXED_COUNTERS - 1:
3915             env->msr_fixed_counters[index - MSR_CORE_PERF_FIXED_CTR0] = msrs[i].data;
3916             break;
3917         case MSR_P6_PERFCTR0 ... MSR_P6_PERFCTR0 + MAX_GP_COUNTERS - 1:
3918             env->msr_gp_counters[index - MSR_P6_PERFCTR0] = msrs[i].data;
3919             break;
3920         case MSR_P6_EVNTSEL0 ... MSR_P6_EVNTSEL0 + MAX_GP_COUNTERS - 1:
3921             env->msr_gp_evtsel[index - MSR_P6_EVNTSEL0] = msrs[i].data;
3922             break;
3923         case HV_X64_MSR_HYPERCALL:
3924             env->msr_hv_hypercall = msrs[i].data;
3925             break;
3926         case HV_X64_MSR_GUEST_OS_ID:
3927             env->msr_hv_guest_os_id = msrs[i].data;
3928             break;
3929         case HV_X64_MSR_APIC_ASSIST_PAGE:
3930             env->msr_hv_vapic = msrs[i].data;
3931             break;
3932         case HV_X64_MSR_REFERENCE_TSC:
3933             env->msr_hv_tsc = msrs[i].data;
3934             break;
3935         case HV_X64_MSR_CRASH_P0 ... HV_X64_MSR_CRASH_P4:
3936             env->msr_hv_crash_params[index - HV_X64_MSR_CRASH_P0] = msrs[i].data;
3937             break;
3938         case HV_X64_MSR_VP_RUNTIME:
3939             env->msr_hv_runtime = msrs[i].data;
3940             break;
3941         case HV_X64_MSR_SCONTROL:
3942             env->msr_hv_synic_control = msrs[i].data;
3943             break;
3944         case HV_X64_MSR_SIEFP:
3945             env->msr_hv_synic_evt_page = msrs[i].data;
3946             break;
3947         case HV_X64_MSR_SIMP:
3948             env->msr_hv_synic_msg_page = msrs[i].data;
3949             break;
3950         case HV_X64_MSR_SINT0 ... HV_X64_MSR_SINT15:
3951             env->msr_hv_synic_sint[index - HV_X64_MSR_SINT0] = msrs[i].data;
3952             break;
3953         case HV_X64_MSR_STIMER0_CONFIG:
3954         case HV_X64_MSR_STIMER1_CONFIG:
3955         case HV_X64_MSR_STIMER2_CONFIG:
3956         case HV_X64_MSR_STIMER3_CONFIG:
3957             env->msr_hv_stimer_config[(index - HV_X64_MSR_STIMER0_CONFIG)/2] =
3958                                 msrs[i].data;
3959             break;
3960         case HV_X64_MSR_STIMER0_COUNT:
3961         case HV_X64_MSR_STIMER1_COUNT:
3962         case HV_X64_MSR_STIMER2_COUNT:
3963         case HV_X64_MSR_STIMER3_COUNT:
3964             env->msr_hv_stimer_count[(index - HV_X64_MSR_STIMER0_COUNT)/2] =
3965                                 msrs[i].data;
3966             break;
3967         case HV_X64_MSR_REENLIGHTENMENT_CONTROL:
3968             env->msr_hv_reenlightenment_control = msrs[i].data;
3969             break;
3970         case HV_X64_MSR_TSC_EMULATION_CONTROL:
3971             env->msr_hv_tsc_emulation_control = msrs[i].data;
3972             break;
3973         case HV_X64_MSR_TSC_EMULATION_STATUS:
3974             env->msr_hv_tsc_emulation_status = msrs[i].data;
3975             break;
3976         case HV_X64_MSR_SYNDBG_OPTIONS:
3977             env->msr_hv_syndbg_options = msrs[i].data;
3978             break;
3979         case MSR_MTRRdefType:
3980             env->mtrr_deftype = msrs[i].data;
3981             break;
3982         case MSR_MTRRfix64K_00000:
3983             env->mtrr_fixed[0] = msrs[i].data;
3984             break;
3985         case MSR_MTRRfix16K_80000:
3986             env->mtrr_fixed[1] = msrs[i].data;
3987             break;
3988         case MSR_MTRRfix16K_A0000:
3989             env->mtrr_fixed[2] = msrs[i].data;
3990             break;
3991         case MSR_MTRRfix4K_C0000:
3992             env->mtrr_fixed[3] = msrs[i].data;
3993             break;
3994         case MSR_MTRRfix4K_C8000:
3995             env->mtrr_fixed[4] = msrs[i].data;
3996             break;
3997         case MSR_MTRRfix4K_D0000:
3998             env->mtrr_fixed[5] = msrs[i].data;
3999             break;
4000         case MSR_MTRRfix4K_D8000:
4001             env->mtrr_fixed[6] = msrs[i].data;
4002             break;
4003         case MSR_MTRRfix4K_E0000:
4004             env->mtrr_fixed[7] = msrs[i].data;
4005             break;
4006         case MSR_MTRRfix4K_E8000:
4007             env->mtrr_fixed[8] = msrs[i].data;
4008             break;
4009         case MSR_MTRRfix4K_F0000:
4010             env->mtrr_fixed[9] = msrs[i].data;
4011             break;
4012         case MSR_MTRRfix4K_F8000:
4013             env->mtrr_fixed[10] = msrs[i].data;
4014             break;
4015         case MSR_MTRRphysBase(0) ... MSR_MTRRphysMask(MSR_MTRRcap_VCNT - 1):
4016             if (index & 1) {
4017                 env->mtrr_var[MSR_MTRRphysIndex(index)].mask = msrs[i].data |
4018                                                                mtrr_top_bits;
4019             } else {
4020                 env->mtrr_var[MSR_MTRRphysIndex(index)].base = msrs[i].data;
4021             }
4022             break;
4023         case MSR_IA32_SPEC_CTRL:
4024             env->spec_ctrl = msrs[i].data;
4025             break;
4026         case MSR_AMD64_TSC_RATIO:
4027             env->amd_tsc_scale_msr = msrs[i].data;
4028             break;
4029         case MSR_IA32_TSX_CTRL:
4030             env->tsx_ctrl = msrs[i].data;
4031             break;
4032         case MSR_VIRT_SSBD:
4033             env->virt_ssbd = msrs[i].data;
4034             break;
4035         case MSR_IA32_RTIT_CTL:
4036             env->msr_rtit_ctrl = msrs[i].data;
4037             break;
4038         case MSR_IA32_RTIT_STATUS:
4039             env->msr_rtit_status = msrs[i].data;
4040             break;
4041         case MSR_IA32_RTIT_OUTPUT_BASE:
4042             env->msr_rtit_output_base = msrs[i].data;
4043             break;
4044         case MSR_IA32_RTIT_OUTPUT_MASK:
4045             env->msr_rtit_output_mask = msrs[i].data;
4046             break;
4047         case MSR_IA32_RTIT_CR3_MATCH:
4048             env->msr_rtit_cr3_match = msrs[i].data;
4049             break;
4050         case MSR_IA32_RTIT_ADDR0_A ... MSR_IA32_RTIT_ADDR3_B:
4051             env->msr_rtit_addrs[index - MSR_IA32_RTIT_ADDR0_A] = msrs[i].data;
4052             break;
4053         case MSR_IA32_SGXLEPUBKEYHASH0 ... MSR_IA32_SGXLEPUBKEYHASH3:
4054             env->msr_ia32_sgxlepubkeyhash[index - MSR_IA32_SGXLEPUBKEYHASH0] =
4055                            msrs[i].data;
4056             break;
4057         case MSR_IA32_XFD:
4058             env->msr_xfd = msrs[i].data;
4059             break;
4060         case MSR_IA32_XFD_ERR:
4061             env->msr_xfd_err = msrs[i].data;
4062             break;
4063         }
4064     }
4065 
4066     return 0;
4067 }
4068 
4069 static int kvm_put_mp_state(X86CPU *cpu)
4070 {
4071     struct kvm_mp_state mp_state = { .mp_state = cpu->env.mp_state };
4072 
4073     return kvm_vcpu_ioctl(CPU(cpu), KVM_SET_MP_STATE, &mp_state);
4074 }
4075 
4076 static int kvm_get_mp_state(X86CPU *cpu)
4077 {
4078     CPUState *cs = CPU(cpu);
4079     CPUX86State *env = &cpu->env;
4080     struct kvm_mp_state mp_state;
4081     int ret;
4082 
4083     ret = kvm_vcpu_ioctl(cs, KVM_GET_MP_STATE, &mp_state);
4084     if (ret < 0) {
4085         return ret;
4086     }
4087     env->mp_state = mp_state.mp_state;
4088     if (kvm_irqchip_in_kernel()) {
4089         cs->halted = (mp_state.mp_state == KVM_MP_STATE_HALTED);
4090     }
4091     return 0;
4092 }
4093 
4094 static int kvm_get_apic(X86CPU *cpu)
4095 {
4096     DeviceState *apic = cpu->apic_state;
4097     struct kvm_lapic_state kapic;
4098     int ret;
4099 
4100     if (apic && kvm_irqchip_in_kernel()) {
4101         ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_LAPIC, &kapic);
4102         if (ret < 0) {
4103             return ret;
4104         }
4105 
4106         kvm_get_apic_state(apic, &kapic);
4107     }
4108     return 0;
4109 }
4110 
4111 static int kvm_put_vcpu_events(X86CPU *cpu, int level)
4112 {
4113     CPUState *cs = CPU(cpu);
4114     CPUX86State *env = &cpu->env;
4115     struct kvm_vcpu_events events = {};
4116 
4117     if (!kvm_has_vcpu_events()) {
4118         return 0;
4119     }
4120 
4121     events.flags = 0;
4122 
4123     if (has_exception_payload) {
4124         events.flags |= KVM_VCPUEVENT_VALID_PAYLOAD;
4125         events.exception.pending = env->exception_pending;
4126         events.exception_has_payload = env->exception_has_payload;
4127         events.exception_payload = env->exception_payload;
4128     }
4129     events.exception.nr = env->exception_nr;
4130     events.exception.injected = env->exception_injected;
4131     events.exception.has_error_code = env->has_error_code;
4132     events.exception.error_code = env->error_code;
4133 
4134     events.interrupt.injected = (env->interrupt_injected >= 0);
4135     events.interrupt.nr = env->interrupt_injected;
4136     events.interrupt.soft = env->soft_interrupt;
4137 
4138     events.nmi.injected = env->nmi_injected;
4139     events.nmi.pending = env->nmi_pending;
4140     events.nmi.masked = !!(env->hflags2 & HF2_NMI_MASK);
4141 
4142     events.sipi_vector = env->sipi_vector;
4143 
4144     if (has_msr_smbase) {
4145         events.smi.smm = !!(env->hflags & HF_SMM_MASK);
4146         events.smi.smm_inside_nmi = !!(env->hflags2 & HF2_SMM_INSIDE_NMI_MASK);
4147         if (kvm_irqchip_in_kernel()) {
4148             /* As soon as these are moved to the kernel, remove them
4149              * from cs->interrupt_request.
4150              */
4151             events.smi.pending = cs->interrupt_request & CPU_INTERRUPT_SMI;
4152             events.smi.latched_init = cs->interrupt_request & CPU_INTERRUPT_INIT;
4153             cs->interrupt_request &= ~(CPU_INTERRUPT_INIT | CPU_INTERRUPT_SMI);
4154         } else {
4155             /* Keep these in cs->interrupt_request.  */
4156             events.smi.pending = 0;
4157             events.smi.latched_init = 0;
4158         }
4159         /* Stop SMI delivery on old machine types to avoid a reboot
4160          * on an inward migration of an old VM.
4161          */
4162         if (!cpu->kvm_no_smi_migration) {
4163             events.flags |= KVM_VCPUEVENT_VALID_SMM;
4164         }
4165     }
4166 
4167     if (level >= KVM_PUT_RESET_STATE) {
4168         events.flags |= KVM_VCPUEVENT_VALID_NMI_PENDING;
4169         if (env->mp_state == KVM_MP_STATE_SIPI_RECEIVED) {
4170             events.flags |= KVM_VCPUEVENT_VALID_SIPI_VECTOR;
4171         }
4172     }
4173 
4174     return kvm_vcpu_ioctl(CPU(cpu), KVM_SET_VCPU_EVENTS, &events);
4175 }
4176 
4177 static int kvm_get_vcpu_events(X86CPU *cpu)
4178 {
4179     CPUX86State *env = &cpu->env;
4180     struct kvm_vcpu_events events;
4181     int ret;
4182 
4183     if (!kvm_has_vcpu_events()) {
4184         return 0;
4185     }
4186 
4187     memset(&events, 0, sizeof(events));
4188     ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_VCPU_EVENTS, &events);
4189     if (ret < 0) {
4190        return ret;
4191     }
4192 
4193     if (events.flags & KVM_VCPUEVENT_VALID_PAYLOAD) {
4194         env->exception_pending = events.exception.pending;
4195         env->exception_has_payload = events.exception_has_payload;
4196         env->exception_payload = events.exception_payload;
4197     } else {
4198         env->exception_pending = 0;
4199         env->exception_has_payload = false;
4200     }
4201     env->exception_injected = events.exception.injected;
4202     env->exception_nr =
4203         (env->exception_pending || env->exception_injected) ?
4204         events.exception.nr : -1;
4205     env->has_error_code = events.exception.has_error_code;
4206     env->error_code = events.exception.error_code;
4207 
4208     env->interrupt_injected =
4209         events.interrupt.injected ? events.interrupt.nr : -1;
4210     env->soft_interrupt = events.interrupt.soft;
4211 
4212     env->nmi_injected = events.nmi.injected;
4213     env->nmi_pending = events.nmi.pending;
4214     if (events.nmi.masked) {
4215         env->hflags2 |= HF2_NMI_MASK;
4216     } else {
4217         env->hflags2 &= ~HF2_NMI_MASK;
4218     }
4219 
4220     if (events.flags & KVM_VCPUEVENT_VALID_SMM) {
4221         if (events.smi.smm) {
4222             env->hflags |= HF_SMM_MASK;
4223         } else {
4224             env->hflags &= ~HF_SMM_MASK;
4225         }
4226         if (events.smi.pending) {
4227             cpu_interrupt(CPU(cpu), CPU_INTERRUPT_SMI);
4228         } else {
4229             cpu_reset_interrupt(CPU(cpu), CPU_INTERRUPT_SMI);
4230         }
4231         if (events.smi.smm_inside_nmi) {
4232             env->hflags2 |= HF2_SMM_INSIDE_NMI_MASK;
4233         } else {
4234             env->hflags2 &= ~HF2_SMM_INSIDE_NMI_MASK;
4235         }
4236         if (events.smi.latched_init) {
4237             cpu_interrupt(CPU(cpu), CPU_INTERRUPT_INIT);
4238         } else {
4239             cpu_reset_interrupt(CPU(cpu), CPU_INTERRUPT_INIT);
4240         }
4241     }
4242 
4243     env->sipi_vector = events.sipi_vector;
4244 
4245     return 0;
4246 }
4247 
4248 static int kvm_guest_debug_workarounds(X86CPU *cpu)
4249 {
4250     CPUState *cs = CPU(cpu);
4251     CPUX86State *env = &cpu->env;
4252     int ret = 0;
4253     unsigned long reinject_trap = 0;
4254 
4255     if (!kvm_has_vcpu_events()) {
4256         if (env->exception_nr == EXCP01_DB) {
4257             reinject_trap = KVM_GUESTDBG_INJECT_DB;
4258         } else if (env->exception_injected == EXCP03_INT3) {
4259             reinject_trap = KVM_GUESTDBG_INJECT_BP;
4260         }
4261         kvm_reset_exception(env);
4262     }
4263 
4264     /*
4265      * Kernels before KVM_CAP_X86_ROBUST_SINGLESTEP overwrote flags.TF
4266      * injected via SET_GUEST_DEBUG while updating GP regs. Work around this
4267      * by updating the debug state once again if single-stepping is on.
4268      * Another reason to call kvm_update_guest_debug here is a pending debug
4269      * trap raise by the guest. On kernels without SET_VCPU_EVENTS we have to
4270      * reinject them via SET_GUEST_DEBUG.
4271      */
4272     if (reinject_trap ||
4273         (!kvm_has_robust_singlestep() && cs->singlestep_enabled)) {
4274         ret = kvm_update_guest_debug(cs, reinject_trap);
4275     }
4276     return ret;
4277 }
4278 
4279 static int kvm_put_debugregs(X86CPU *cpu)
4280 {
4281     CPUX86State *env = &cpu->env;
4282     struct kvm_debugregs dbgregs;
4283     int i;
4284 
4285     if (!kvm_has_debugregs()) {
4286         return 0;
4287     }
4288 
4289     memset(&dbgregs, 0, sizeof(dbgregs));
4290     for (i = 0; i < 4; i++) {
4291         dbgregs.db[i] = env->dr[i];
4292     }
4293     dbgregs.dr6 = env->dr[6];
4294     dbgregs.dr7 = env->dr[7];
4295     dbgregs.flags = 0;
4296 
4297     return kvm_vcpu_ioctl(CPU(cpu), KVM_SET_DEBUGREGS, &dbgregs);
4298 }
4299 
4300 static int kvm_get_debugregs(X86CPU *cpu)
4301 {
4302     CPUX86State *env = &cpu->env;
4303     struct kvm_debugregs dbgregs;
4304     int i, ret;
4305 
4306     if (!kvm_has_debugregs()) {
4307         return 0;
4308     }
4309 
4310     ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_DEBUGREGS, &dbgregs);
4311     if (ret < 0) {
4312         return ret;
4313     }
4314     for (i = 0; i < 4; i++) {
4315         env->dr[i] = dbgregs.db[i];
4316     }
4317     env->dr[4] = env->dr[6] = dbgregs.dr6;
4318     env->dr[5] = env->dr[7] = dbgregs.dr7;
4319 
4320     return 0;
4321 }
4322 
4323 static int kvm_put_nested_state(X86CPU *cpu)
4324 {
4325     CPUX86State *env = &cpu->env;
4326     int max_nested_state_len = kvm_max_nested_state_length();
4327 
4328     if (!env->nested_state) {
4329         return 0;
4330     }
4331 
4332     /*
4333      * Copy flags that are affected by reset from env->hflags and env->hflags2.
4334      */
4335     if (env->hflags & HF_GUEST_MASK) {
4336         env->nested_state->flags |= KVM_STATE_NESTED_GUEST_MODE;
4337     } else {
4338         env->nested_state->flags &= ~KVM_STATE_NESTED_GUEST_MODE;
4339     }
4340 
4341     /* Don't set KVM_STATE_NESTED_GIF_SET on VMX as it is illegal */
4342     if (cpu_has_svm(env) && (env->hflags2 & HF2_GIF_MASK)) {
4343         env->nested_state->flags |= KVM_STATE_NESTED_GIF_SET;
4344     } else {
4345         env->nested_state->flags &= ~KVM_STATE_NESTED_GIF_SET;
4346     }
4347 
4348     assert(env->nested_state->size <= max_nested_state_len);
4349     return kvm_vcpu_ioctl(CPU(cpu), KVM_SET_NESTED_STATE, env->nested_state);
4350 }
4351 
4352 static int kvm_get_nested_state(X86CPU *cpu)
4353 {
4354     CPUX86State *env = &cpu->env;
4355     int max_nested_state_len = kvm_max_nested_state_length();
4356     int ret;
4357 
4358     if (!env->nested_state) {
4359         return 0;
4360     }
4361 
4362     /*
4363      * It is possible that migration restored a smaller size into
4364      * nested_state->hdr.size than what our kernel support.
4365      * We preserve migration origin nested_state->hdr.size for
4366      * call to KVM_SET_NESTED_STATE but wish that our next call
4367      * to KVM_GET_NESTED_STATE will use max size our kernel support.
4368      */
4369     env->nested_state->size = max_nested_state_len;
4370 
4371     ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_NESTED_STATE, env->nested_state);
4372     if (ret < 0) {
4373         return ret;
4374     }
4375 
4376     /*
4377      * Copy flags that are affected by reset to env->hflags and env->hflags2.
4378      */
4379     if (env->nested_state->flags & KVM_STATE_NESTED_GUEST_MODE) {
4380         env->hflags |= HF_GUEST_MASK;
4381     } else {
4382         env->hflags &= ~HF_GUEST_MASK;
4383     }
4384 
4385     /* Keep HF2_GIF_MASK set on !SVM as x86_cpu_pending_interrupt() needs it */
4386     if (cpu_has_svm(env)) {
4387         if (env->nested_state->flags & KVM_STATE_NESTED_GIF_SET) {
4388             env->hflags2 |= HF2_GIF_MASK;
4389         } else {
4390             env->hflags2 &= ~HF2_GIF_MASK;
4391         }
4392     }
4393 
4394     return ret;
4395 }
4396 
4397 int kvm_arch_put_registers(CPUState *cpu, int level)
4398 {
4399     X86CPU *x86_cpu = X86_CPU(cpu);
4400     int ret;
4401 
4402     assert(cpu_is_stopped(cpu) || qemu_cpu_is_self(cpu));
4403 
4404     /* must be before kvm_put_nested_state so that EFER.SVME is set */
4405     ret = has_sregs2 ? kvm_put_sregs2(x86_cpu) : kvm_put_sregs(x86_cpu);
4406     if (ret < 0) {
4407         return ret;
4408     }
4409 
4410     if (level >= KVM_PUT_RESET_STATE) {
4411         ret = kvm_put_nested_state(x86_cpu);
4412         if (ret < 0) {
4413             return ret;
4414         }
4415 
4416         ret = kvm_put_msr_feature_control(x86_cpu);
4417         if (ret < 0) {
4418             return ret;
4419         }
4420     }
4421 
4422     if (level == KVM_PUT_FULL_STATE) {
4423         /* We don't check for kvm_arch_set_tsc_khz() errors here,
4424          * because TSC frequency mismatch shouldn't abort migration,
4425          * unless the user explicitly asked for a more strict TSC
4426          * setting (e.g. using an explicit "tsc-freq" option).
4427          */
4428         kvm_arch_set_tsc_khz(cpu);
4429     }
4430 
4431     ret = kvm_getput_regs(x86_cpu, 1);
4432     if (ret < 0) {
4433         return ret;
4434     }
4435     ret = kvm_put_xsave(x86_cpu);
4436     if (ret < 0) {
4437         return ret;
4438     }
4439     ret = kvm_put_xcrs(x86_cpu);
4440     if (ret < 0) {
4441         return ret;
4442     }
4443     /* must be before kvm_put_msrs */
4444     ret = kvm_inject_mce_oldstyle(x86_cpu);
4445     if (ret < 0) {
4446         return ret;
4447     }
4448     ret = kvm_put_msrs(x86_cpu, level);
4449     if (ret < 0) {
4450         return ret;
4451     }
4452     ret = kvm_put_vcpu_events(x86_cpu, level);
4453     if (ret < 0) {
4454         return ret;
4455     }
4456     if (level >= KVM_PUT_RESET_STATE) {
4457         ret = kvm_put_mp_state(x86_cpu);
4458         if (ret < 0) {
4459             return ret;
4460         }
4461     }
4462 
4463     ret = kvm_put_tscdeadline_msr(x86_cpu);
4464     if (ret < 0) {
4465         return ret;
4466     }
4467     ret = kvm_put_debugregs(x86_cpu);
4468     if (ret < 0) {
4469         return ret;
4470     }
4471     /* must be last */
4472     ret = kvm_guest_debug_workarounds(x86_cpu);
4473     if (ret < 0) {
4474         return ret;
4475     }
4476     return 0;
4477 }
4478 
4479 int kvm_arch_get_registers(CPUState *cs)
4480 {
4481     X86CPU *cpu = X86_CPU(cs);
4482     int ret;
4483 
4484     assert(cpu_is_stopped(cs) || qemu_cpu_is_self(cs));
4485 
4486     ret = kvm_get_vcpu_events(cpu);
4487     if (ret < 0) {
4488         goto out;
4489     }
4490     /*
4491      * KVM_GET_MPSTATE can modify CS and RIP, call it before
4492      * KVM_GET_REGS and KVM_GET_SREGS.
4493      */
4494     ret = kvm_get_mp_state(cpu);
4495     if (ret < 0) {
4496         goto out;
4497     }
4498     ret = kvm_getput_regs(cpu, 0);
4499     if (ret < 0) {
4500         goto out;
4501     }
4502     ret = kvm_get_xsave(cpu);
4503     if (ret < 0) {
4504         goto out;
4505     }
4506     ret = kvm_get_xcrs(cpu);
4507     if (ret < 0) {
4508         goto out;
4509     }
4510     ret = has_sregs2 ? kvm_get_sregs2(cpu) : kvm_get_sregs(cpu);
4511     if (ret < 0) {
4512         goto out;
4513     }
4514     ret = kvm_get_msrs(cpu);
4515     if (ret < 0) {
4516         goto out;
4517     }
4518     ret = kvm_get_apic(cpu);
4519     if (ret < 0) {
4520         goto out;
4521     }
4522     ret = kvm_get_debugregs(cpu);
4523     if (ret < 0) {
4524         goto out;
4525     }
4526     ret = kvm_get_nested_state(cpu);
4527     if (ret < 0) {
4528         goto out;
4529     }
4530     ret = 0;
4531  out:
4532     cpu_sync_bndcs_hflags(&cpu->env);
4533     return ret;
4534 }
4535 
4536 void kvm_arch_pre_run(CPUState *cpu, struct kvm_run *run)
4537 {
4538     X86CPU *x86_cpu = X86_CPU(cpu);
4539     CPUX86State *env = &x86_cpu->env;
4540     int ret;
4541 
4542     /* Inject NMI */
4543     if (cpu->interrupt_request & (CPU_INTERRUPT_NMI | CPU_INTERRUPT_SMI)) {
4544         if (cpu->interrupt_request & CPU_INTERRUPT_NMI) {
4545             qemu_mutex_lock_iothread();
4546             cpu->interrupt_request &= ~CPU_INTERRUPT_NMI;
4547             qemu_mutex_unlock_iothread();
4548             DPRINTF("injected NMI\n");
4549             ret = kvm_vcpu_ioctl(cpu, KVM_NMI);
4550             if (ret < 0) {
4551                 fprintf(stderr, "KVM: injection failed, NMI lost (%s)\n",
4552                         strerror(-ret));
4553             }
4554         }
4555         if (cpu->interrupt_request & CPU_INTERRUPT_SMI) {
4556             qemu_mutex_lock_iothread();
4557             cpu->interrupt_request &= ~CPU_INTERRUPT_SMI;
4558             qemu_mutex_unlock_iothread();
4559             DPRINTF("injected SMI\n");
4560             ret = kvm_vcpu_ioctl(cpu, KVM_SMI);
4561             if (ret < 0) {
4562                 fprintf(stderr, "KVM: injection failed, SMI lost (%s)\n",
4563                         strerror(-ret));
4564             }
4565         }
4566     }
4567 
4568     if (!kvm_pic_in_kernel()) {
4569         qemu_mutex_lock_iothread();
4570     }
4571 
4572     /* Force the VCPU out of its inner loop to process any INIT requests
4573      * or (for userspace APIC, but it is cheap to combine the checks here)
4574      * pending TPR access reports.
4575      */
4576     if (cpu->interrupt_request & (CPU_INTERRUPT_INIT | CPU_INTERRUPT_TPR)) {
4577         if ((cpu->interrupt_request & CPU_INTERRUPT_INIT) &&
4578             !(env->hflags & HF_SMM_MASK)) {
4579             cpu->exit_request = 1;
4580         }
4581         if (cpu->interrupt_request & CPU_INTERRUPT_TPR) {
4582             cpu->exit_request = 1;
4583         }
4584     }
4585 
4586     if (!kvm_pic_in_kernel()) {
4587         /* Try to inject an interrupt if the guest can accept it */
4588         if (run->ready_for_interrupt_injection &&
4589             (cpu->interrupt_request & CPU_INTERRUPT_HARD) &&
4590             (env->eflags & IF_MASK)) {
4591             int irq;
4592 
4593             cpu->interrupt_request &= ~CPU_INTERRUPT_HARD;
4594             irq = cpu_get_pic_interrupt(env);
4595             if (irq >= 0) {
4596                 struct kvm_interrupt intr;
4597 
4598                 intr.irq = irq;
4599                 DPRINTF("injected interrupt %d\n", irq);
4600                 ret = kvm_vcpu_ioctl(cpu, KVM_INTERRUPT, &intr);
4601                 if (ret < 0) {
4602                     fprintf(stderr,
4603                             "KVM: injection failed, interrupt lost (%s)\n",
4604                             strerror(-ret));
4605                 }
4606             }
4607         }
4608 
4609         /* If we have an interrupt but the guest is not ready to receive an
4610          * interrupt, request an interrupt window exit.  This will
4611          * cause a return to userspace as soon as the guest is ready to
4612          * receive interrupts. */
4613         if ((cpu->interrupt_request & CPU_INTERRUPT_HARD)) {
4614             run->request_interrupt_window = 1;
4615         } else {
4616             run->request_interrupt_window = 0;
4617         }
4618 
4619         DPRINTF("setting tpr\n");
4620         run->cr8 = cpu_get_apic_tpr(x86_cpu->apic_state);
4621 
4622         qemu_mutex_unlock_iothread();
4623     }
4624 }
4625 
4626 static void kvm_rate_limit_on_bus_lock(void)
4627 {
4628     uint64_t delay_ns = ratelimit_calculate_delay(&bus_lock_ratelimit_ctrl, 1);
4629 
4630     if (delay_ns) {
4631         g_usleep(delay_ns / SCALE_US);
4632     }
4633 }
4634 
4635 MemTxAttrs kvm_arch_post_run(CPUState *cpu, struct kvm_run *run)
4636 {
4637     X86CPU *x86_cpu = X86_CPU(cpu);
4638     CPUX86State *env = &x86_cpu->env;
4639 
4640     if (run->flags & KVM_RUN_X86_SMM) {
4641         env->hflags |= HF_SMM_MASK;
4642     } else {
4643         env->hflags &= ~HF_SMM_MASK;
4644     }
4645     if (run->if_flag) {
4646         env->eflags |= IF_MASK;
4647     } else {
4648         env->eflags &= ~IF_MASK;
4649     }
4650     if (run->flags & KVM_RUN_X86_BUS_LOCK) {
4651         kvm_rate_limit_on_bus_lock();
4652     }
4653 
4654     /* We need to protect the apic state against concurrent accesses from
4655      * different threads in case the userspace irqchip is used. */
4656     if (!kvm_irqchip_in_kernel()) {
4657         qemu_mutex_lock_iothread();
4658     }
4659     cpu_set_apic_tpr(x86_cpu->apic_state, run->cr8);
4660     cpu_set_apic_base(x86_cpu->apic_state, run->apic_base);
4661     if (!kvm_irqchip_in_kernel()) {
4662         qemu_mutex_unlock_iothread();
4663     }
4664     return cpu_get_mem_attrs(env);
4665 }
4666 
4667 int kvm_arch_process_async_events(CPUState *cs)
4668 {
4669     X86CPU *cpu = X86_CPU(cs);
4670     CPUX86State *env = &cpu->env;
4671 
4672     if (cs->interrupt_request & CPU_INTERRUPT_MCE) {
4673         /* We must not raise CPU_INTERRUPT_MCE if it's not supported. */
4674         assert(env->mcg_cap);
4675 
4676         cs->interrupt_request &= ~CPU_INTERRUPT_MCE;
4677 
4678         kvm_cpu_synchronize_state(cs);
4679 
4680         if (env->exception_nr == EXCP08_DBLE) {
4681             /* this means triple fault */
4682             qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
4683             cs->exit_request = 1;
4684             return 0;
4685         }
4686         kvm_queue_exception(env, EXCP12_MCHK, 0, 0);
4687         env->has_error_code = 0;
4688 
4689         cs->halted = 0;
4690         if (kvm_irqchip_in_kernel() && env->mp_state == KVM_MP_STATE_HALTED) {
4691             env->mp_state = KVM_MP_STATE_RUNNABLE;
4692         }
4693     }
4694 
4695     if ((cs->interrupt_request & CPU_INTERRUPT_INIT) &&
4696         !(env->hflags & HF_SMM_MASK)) {
4697         kvm_cpu_synchronize_state(cs);
4698         do_cpu_init(cpu);
4699     }
4700 
4701     if (kvm_irqchip_in_kernel()) {
4702         return 0;
4703     }
4704 
4705     if (cs->interrupt_request & CPU_INTERRUPT_POLL) {
4706         cs->interrupt_request &= ~CPU_INTERRUPT_POLL;
4707         apic_poll_irq(cpu->apic_state);
4708     }
4709     if (((cs->interrupt_request & CPU_INTERRUPT_HARD) &&
4710          (env->eflags & IF_MASK)) ||
4711         (cs->interrupt_request & CPU_INTERRUPT_NMI)) {
4712         cs->halted = 0;
4713     }
4714     if (cs->interrupt_request & CPU_INTERRUPT_SIPI) {
4715         kvm_cpu_synchronize_state(cs);
4716         do_cpu_sipi(cpu);
4717     }
4718     if (cs->interrupt_request & CPU_INTERRUPT_TPR) {
4719         cs->interrupt_request &= ~CPU_INTERRUPT_TPR;
4720         kvm_cpu_synchronize_state(cs);
4721         apic_handle_tpr_access_report(cpu->apic_state, env->eip,
4722                                       env->tpr_access_type);
4723     }
4724 
4725     return cs->halted;
4726 }
4727 
4728 static int kvm_handle_halt(X86CPU *cpu)
4729 {
4730     CPUState *cs = CPU(cpu);
4731     CPUX86State *env = &cpu->env;
4732 
4733     if (!((cs->interrupt_request & CPU_INTERRUPT_HARD) &&
4734           (env->eflags & IF_MASK)) &&
4735         !(cs->interrupt_request & CPU_INTERRUPT_NMI)) {
4736         cs->halted = 1;
4737         return EXCP_HLT;
4738     }
4739 
4740     return 0;
4741 }
4742 
4743 static int kvm_handle_tpr_access(X86CPU *cpu)
4744 {
4745     CPUState *cs = CPU(cpu);
4746     struct kvm_run *run = cs->kvm_run;
4747 
4748     apic_handle_tpr_access_report(cpu->apic_state, run->tpr_access.rip,
4749                                   run->tpr_access.is_write ? TPR_ACCESS_WRITE
4750                                                            : TPR_ACCESS_READ);
4751     return 1;
4752 }
4753 
4754 int kvm_arch_insert_sw_breakpoint(CPUState *cs, struct kvm_sw_breakpoint *bp)
4755 {
4756     static const uint8_t int3 = 0xcc;
4757 
4758     if (cpu_memory_rw_debug(cs, bp->pc, (uint8_t *)&bp->saved_insn, 1, 0) ||
4759         cpu_memory_rw_debug(cs, bp->pc, (uint8_t *)&int3, 1, 1)) {
4760         return -EINVAL;
4761     }
4762     return 0;
4763 }
4764 
4765 int kvm_arch_remove_sw_breakpoint(CPUState *cs, struct kvm_sw_breakpoint *bp)
4766 {
4767     uint8_t int3;
4768 
4769     if (cpu_memory_rw_debug(cs, bp->pc, &int3, 1, 0)) {
4770         return -EINVAL;
4771     }
4772     if (int3 != 0xcc) {
4773         return 0;
4774     }
4775     if (cpu_memory_rw_debug(cs, bp->pc, (uint8_t *)&bp->saved_insn, 1, 1)) {
4776         return -EINVAL;
4777     }
4778     return 0;
4779 }
4780 
4781 static struct {
4782     target_ulong addr;
4783     int len;
4784     int type;
4785 } hw_breakpoint[4];
4786 
4787 static int nb_hw_breakpoint;
4788 
4789 static int find_hw_breakpoint(target_ulong addr, int len, int type)
4790 {
4791     int n;
4792 
4793     for (n = 0; n < nb_hw_breakpoint; n++) {
4794         if (hw_breakpoint[n].addr == addr && hw_breakpoint[n].type == type &&
4795             (hw_breakpoint[n].len == len || len == -1)) {
4796             return n;
4797         }
4798     }
4799     return -1;
4800 }
4801 
4802 int kvm_arch_insert_hw_breakpoint(target_ulong addr,
4803                                   target_ulong len, int type)
4804 {
4805     switch (type) {
4806     case GDB_BREAKPOINT_HW:
4807         len = 1;
4808         break;
4809     case GDB_WATCHPOINT_WRITE:
4810     case GDB_WATCHPOINT_ACCESS:
4811         switch (len) {
4812         case 1:
4813             break;
4814         case 2:
4815         case 4:
4816         case 8:
4817             if (addr & (len - 1)) {
4818                 return -EINVAL;
4819             }
4820             break;
4821         default:
4822             return -EINVAL;
4823         }
4824         break;
4825     default:
4826         return -ENOSYS;
4827     }
4828 
4829     if (nb_hw_breakpoint == 4) {
4830         return -ENOBUFS;
4831     }
4832     if (find_hw_breakpoint(addr, len, type) >= 0) {
4833         return -EEXIST;
4834     }
4835     hw_breakpoint[nb_hw_breakpoint].addr = addr;
4836     hw_breakpoint[nb_hw_breakpoint].len = len;
4837     hw_breakpoint[nb_hw_breakpoint].type = type;
4838     nb_hw_breakpoint++;
4839 
4840     return 0;
4841 }
4842 
4843 int kvm_arch_remove_hw_breakpoint(target_ulong addr,
4844                                   target_ulong len, int type)
4845 {
4846     int n;
4847 
4848     n = find_hw_breakpoint(addr, (type == GDB_BREAKPOINT_HW) ? 1 : len, type);
4849     if (n < 0) {
4850         return -ENOENT;
4851     }
4852     nb_hw_breakpoint--;
4853     hw_breakpoint[n] = hw_breakpoint[nb_hw_breakpoint];
4854 
4855     return 0;
4856 }
4857 
4858 void kvm_arch_remove_all_hw_breakpoints(void)
4859 {
4860     nb_hw_breakpoint = 0;
4861 }
4862 
4863 static CPUWatchpoint hw_watchpoint;
4864 
4865 static int kvm_handle_debug(X86CPU *cpu,
4866                             struct kvm_debug_exit_arch *arch_info)
4867 {
4868     CPUState *cs = CPU(cpu);
4869     CPUX86State *env = &cpu->env;
4870     int ret = 0;
4871     int n;
4872 
4873     if (arch_info->exception == EXCP01_DB) {
4874         if (arch_info->dr6 & DR6_BS) {
4875             if (cs->singlestep_enabled) {
4876                 ret = EXCP_DEBUG;
4877             }
4878         } else {
4879             for (n = 0; n < 4; n++) {
4880                 if (arch_info->dr6 & (1 << n)) {
4881                     switch ((arch_info->dr7 >> (16 + n*4)) & 0x3) {
4882                     case 0x0:
4883                         ret = EXCP_DEBUG;
4884                         break;
4885                     case 0x1:
4886                         ret = EXCP_DEBUG;
4887                         cs->watchpoint_hit = &hw_watchpoint;
4888                         hw_watchpoint.vaddr = hw_breakpoint[n].addr;
4889                         hw_watchpoint.flags = BP_MEM_WRITE;
4890                         break;
4891                     case 0x3:
4892                         ret = EXCP_DEBUG;
4893                         cs->watchpoint_hit = &hw_watchpoint;
4894                         hw_watchpoint.vaddr = hw_breakpoint[n].addr;
4895                         hw_watchpoint.flags = BP_MEM_ACCESS;
4896                         break;
4897                     }
4898                 }
4899             }
4900         }
4901     } else if (kvm_find_sw_breakpoint(cs, arch_info->pc)) {
4902         ret = EXCP_DEBUG;
4903     }
4904     if (ret == 0) {
4905         cpu_synchronize_state(cs);
4906         assert(env->exception_nr == -1);
4907 
4908         /* pass to guest */
4909         kvm_queue_exception(env, arch_info->exception,
4910                             arch_info->exception == EXCP01_DB,
4911                             arch_info->dr6);
4912         env->has_error_code = 0;
4913     }
4914 
4915     return ret;
4916 }
4917 
4918 void kvm_arch_update_guest_debug(CPUState *cpu, struct kvm_guest_debug *dbg)
4919 {
4920     const uint8_t type_code[] = {
4921         [GDB_BREAKPOINT_HW] = 0x0,
4922         [GDB_WATCHPOINT_WRITE] = 0x1,
4923         [GDB_WATCHPOINT_ACCESS] = 0x3
4924     };
4925     const uint8_t len_code[] = {
4926         [1] = 0x0, [2] = 0x1, [4] = 0x3, [8] = 0x2
4927     };
4928     int n;
4929 
4930     if (kvm_sw_breakpoints_active(cpu)) {
4931         dbg->control |= KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP;
4932     }
4933     if (nb_hw_breakpoint > 0) {
4934         dbg->control |= KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_HW_BP;
4935         dbg->arch.debugreg[7] = 0x0600;
4936         for (n = 0; n < nb_hw_breakpoint; n++) {
4937             dbg->arch.debugreg[n] = hw_breakpoint[n].addr;
4938             dbg->arch.debugreg[7] |= (2 << (n * 2)) |
4939                 (type_code[hw_breakpoint[n].type] << (16 + n*4)) |
4940                 ((uint32_t)len_code[hw_breakpoint[n].len] << (18 + n*4));
4941         }
4942     }
4943 }
4944 
4945 static bool has_sgx_provisioning;
4946 
4947 static bool __kvm_enable_sgx_provisioning(KVMState *s)
4948 {
4949     int fd, ret;
4950 
4951     if (!kvm_vm_check_extension(s, KVM_CAP_SGX_ATTRIBUTE)) {
4952         return false;
4953     }
4954 
4955     fd = qemu_open_old("/dev/sgx_provision", O_RDONLY);
4956     if (fd < 0) {
4957         return false;
4958     }
4959 
4960     ret = kvm_vm_enable_cap(s, KVM_CAP_SGX_ATTRIBUTE, 0, fd);
4961     if (ret) {
4962         error_report("Could not enable SGX PROVISIONKEY: %s", strerror(-ret));
4963         exit(1);
4964     }
4965     close(fd);
4966     return true;
4967 }
4968 
4969 bool kvm_enable_sgx_provisioning(KVMState *s)
4970 {
4971     return MEMORIZE(__kvm_enable_sgx_provisioning(s), has_sgx_provisioning);
4972 }
4973 
4974 static bool host_supports_vmx(void)
4975 {
4976     uint32_t ecx, unused;
4977 
4978     host_cpuid(1, 0, &unused, &unused, &ecx, &unused);
4979     return ecx & CPUID_EXT_VMX;
4980 }
4981 
4982 #define VMX_INVALID_GUEST_STATE 0x80000021
4983 
4984 int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
4985 {
4986     X86CPU *cpu = X86_CPU(cs);
4987     uint64_t code;
4988     int ret;
4989 
4990     switch (run->exit_reason) {
4991     case KVM_EXIT_HLT:
4992         DPRINTF("handle_hlt\n");
4993         qemu_mutex_lock_iothread();
4994         ret = kvm_handle_halt(cpu);
4995         qemu_mutex_unlock_iothread();
4996         break;
4997     case KVM_EXIT_SET_TPR:
4998         ret = 0;
4999         break;
5000     case KVM_EXIT_TPR_ACCESS:
5001         qemu_mutex_lock_iothread();
5002         ret = kvm_handle_tpr_access(cpu);
5003         qemu_mutex_unlock_iothread();
5004         break;
5005     case KVM_EXIT_FAIL_ENTRY:
5006         code = run->fail_entry.hardware_entry_failure_reason;
5007         fprintf(stderr, "KVM: entry failed, hardware error 0x%" PRIx64 "\n",
5008                 code);
5009         if (host_supports_vmx() && code == VMX_INVALID_GUEST_STATE) {
5010             fprintf(stderr,
5011                     "\nIf you're running a guest on an Intel machine without "
5012                         "unrestricted mode\n"
5013                     "support, the failure can be most likely due to the guest "
5014                         "entering an invalid\n"
5015                     "state for Intel VT. For example, the guest maybe running "
5016                         "in big real mode\n"
5017                     "which is not supported on less recent Intel processors."
5018                         "\n\n");
5019         }
5020         ret = -1;
5021         break;
5022     case KVM_EXIT_EXCEPTION:
5023         fprintf(stderr, "KVM: exception %d exit (error code 0x%x)\n",
5024                 run->ex.exception, run->ex.error_code);
5025         ret = -1;
5026         break;
5027     case KVM_EXIT_DEBUG:
5028         DPRINTF("kvm_exit_debug\n");
5029         qemu_mutex_lock_iothread();
5030         ret = kvm_handle_debug(cpu, &run->debug.arch);
5031         qemu_mutex_unlock_iothread();
5032         break;
5033     case KVM_EXIT_HYPERV:
5034         ret = kvm_hv_handle_exit(cpu, &run->hyperv);
5035         break;
5036     case KVM_EXIT_IOAPIC_EOI:
5037         ioapic_eoi_broadcast(run->eoi.vector);
5038         ret = 0;
5039         break;
5040     case KVM_EXIT_X86_BUS_LOCK:
5041         /* already handled in kvm_arch_post_run */
5042         ret = 0;
5043         break;
5044     default:
5045         fprintf(stderr, "KVM: unknown exit reason %d\n", run->exit_reason);
5046         ret = -1;
5047         break;
5048     }
5049 
5050     return ret;
5051 }
5052 
5053 bool kvm_arch_stop_on_emulation_error(CPUState *cs)
5054 {
5055     X86CPU *cpu = X86_CPU(cs);
5056     CPUX86State *env = &cpu->env;
5057 
5058     kvm_cpu_synchronize_state(cs);
5059     return !(env->cr[0] & CR0_PE_MASK) ||
5060            ((env->segs[R_CS].selector  & 3) != 3);
5061 }
5062 
5063 void kvm_arch_init_irq_routing(KVMState *s)
5064 {
5065     /* We know at this point that we're using the in-kernel
5066      * irqchip, so we can use irqfds, and on x86 we know
5067      * we can use msi via irqfd and GSI routing.
5068      */
5069     kvm_msi_via_irqfd_allowed = true;
5070     kvm_gsi_routing_allowed = true;
5071 
5072     if (kvm_irqchip_is_split()) {
5073         KVMRouteChange c = kvm_irqchip_begin_route_changes(s);
5074         int i;
5075 
5076         /* If the ioapic is in QEMU and the lapics are in KVM, reserve
5077            MSI routes for signaling interrupts to the local apics. */
5078         for (i = 0; i < IOAPIC_NUM_PINS; i++) {
5079             if (kvm_irqchip_add_msi_route(&c, 0, NULL) < 0) {
5080                 error_report("Could not enable split IRQ mode.");
5081                 exit(1);
5082             }
5083         }
5084         kvm_irqchip_commit_route_changes(&c);
5085     }
5086 }
5087 
5088 int kvm_arch_irqchip_create(KVMState *s)
5089 {
5090     int ret;
5091     if (kvm_kernel_irqchip_split()) {
5092         ret = kvm_vm_enable_cap(s, KVM_CAP_SPLIT_IRQCHIP, 0, 24);
5093         if (ret) {
5094             error_report("Could not enable split irqchip mode: %s",
5095                          strerror(-ret));
5096             exit(1);
5097         } else {
5098             DPRINTF("Enabled KVM_CAP_SPLIT_IRQCHIP\n");
5099             kvm_split_irqchip = true;
5100             return 1;
5101         }
5102     } else {
5103         return 0;
5104     }
5105 }
5106 
5107 uint64_t kvm_swizzle_msi_ext_dest_id(uint64_t address)
5108 {
5109     CPUX86State *env;
5110     uint64_t ext_id;
5111 
5112     if (!first_cpu) {
5113         return address;
5114     }
5115     env = &X86_CPU(first_cpu)->env;
5116     if (!(env->features[FEAT_KVM] & (1 << KVM_FEATURE_MSI_EXT_DEST_ID))) {
5117         return address;
5118     }
5119 
5120     /*
5121      * If the remappable format bit is set, or the upper bits are
5122      * already set in address_hi, or the low extended bits aren't
5123      * there anyway, do nothing.
5124      */
5125     ext_id = address & (0xff << MSI_ADDR_DEST_IDX_SHIFT);
5126     if (!ext_id || (ext_id & (1 << MSI_ADDR_DEST_IDX_SHIFT)) || (address >> 32)) {
5127         return address;
5128     }
5129 
5130     address &= ~ext_id;
5131     address |= ext_id << 35;
5132     return address;
5133 }
5134 
5135 int kvm_arch_fixup_msi_route(struct kvm_irq_routing_entry *route,
5136                              uint64_t address, uint32_t data, PCIDevice *dev)
5137 {
5138     X86IOMMUState *iommu = x86_iommu_get_default();
5139 
5140     if (iommu) {
5141         X86IOMMUClass *class = X86_IOMMU_DEVICE_GET_CLASS(iommu);
5142 
5143         if (class->int_remap) {
5144             int ret;
5145             MSIMessage src, dst;
5146 
5147             src.address = route->u.msi.address_hi;
5148             src.address <<= VTD_MSI_ADDR_HI_SHIFT;
5149             src.address |= route->u.msi.address_lo;
5150             src.data = route->u.msi.data;
5151 
5152             ret = class->int_remap(iommu, &src, &dst, dev ?     \
5153                                    pci_requester_id(dev) :      \
5154                                    X86_IOMMU_SID_INVALID);
5155             if (ret) {
5156                 trace_kvm_x86_fixup_msi_error(route->gsi);
5157                 return 1;
5158             }
5159 
5160             /*
5161              * Handled untranslated compatibilty format interrupt with
5162              * extended destination ID in the low bits 11-5. */
5163             dst.address = kvm_swizzle_msi_ext_dest_id(dst.address);
5164 
5165             route->u.msi.address_hi = dst.address >> VTD_MSI_ADDR_HI_SHIFT;
5166             route->u.msi.address_lo = dst.address & VTD_MSI_ADDR_LO_MASK;
5167             route->u.msi.data = dst.data;
5168             return 0;
5169         }
5170     }
5171 
5172     address = kvm_swizzle_msi_ext_dest_id(address);
5173     route->u.msi.address_hi = address >> VTD_MSI_ADDR_HI_SHIFT;
5174     route->u.msi.address_lo = address & VTD_MSI_ADDR_LO_MASK;
5175     return 0;
5176 }
5177 
5178 typedef struct MSIRouteEntry MSIRouteEntry;
5179 
5180 struct MSIRouteEntry {
5181     PCIDevice *dev;             /* Device pointer */
5182     int vector;                 /* MSI/MSIX vector index */
5183     int virq;                   /* Virtual IRQ index */
5184     QLIST_ENTRY(MSIRouteEntry) list;
5185 };
5186 
5187 /* List of used GSI routes */
5188 static QLIST_HEAD(, MSIRouteEntry) msi_route_list = \
5189     QLIST_HEAD_INITIALIZER(msi_route_list);
5190 
5191 static void kvm_update_msi_routes_all(void *private, bool global,
5192                                       uint32_t index, uint32_t mask)
5193 {
5194     int cnt = 0, vector;
5195     MSIRouteEntry *entry;
5196     MSIMessage msg;
5197     PCIDevice *dev;
5198 
5199     /* TODO: explicit route update */
5200     QLIST_FOREACH(entry, &msi_route_list, list) {
5201         cnt++;
5202         vector = entry->vector;
5203         dev = entry->dev;
5204         if (msix_enabled(dev) && !msix_is_masked(dev, vector)) {
5205             msg = msix_get_message(dev, vector);
5206         } else if (msi_enabled(dev) && !msi_is_masked(dev, vector)) {
5207             msg = msi_get_message(dev, vector);
5208         } else {
5209             /*
5210              * Either MSI/MSIX is disabled for the device, or the
5211              * specific message was masked out.  Skip this one.
5212              */
5213             continue;
5214         }
5215         kvm_irqchip_update_msi_route(kvm_state, entry->virq, msg, dev);
5216     }
5217     kvm_irqchip_commit_routes(kvm_state);
5218     trace_kvm_x86_update_msi_routes(cnt);
5219 }
5220 
5221 int kvm_arch_add_msi_route_post(struct kvm_irq_routing_entry *route,
5222                                 int vector, PCIDevice *dev)
5223 {
5224     static bool notify_list_inited = false;
5225     MSIRouteEntry *entry;
5226 
5227     if (!dev) {
5228         /* These are (possibly) IOAPIC routes only used for split
5229          * kernel irqchip mode, while what we are housekeeping are
5230          * PCI devices only. */
5231         return 0;
5232     }
5233 
5234     entry = g_new0(MSIRouteEntry, 1);
5235     entry->dev = dev;
5236     entry->vector = vector;
5237     entry->virq = route->gsi;
5238     QLIST_INSERT_HEAD(&msi_route_list, entry, list);
5239 
5240     trace_kvm_x86_add_msi_route(route->gsi);
5241 
5242     if (!notify_list_inited) {
5243         /* For the first time we do add route, add ourselves into
5244          * IOMMU's IEC notify list if needed. */
5245         X86IOMMUState *iommu = x86_iommu_get_default();
5246         if (iommu) {
5247             x86_iommu_iec_register_notifier(iommu,
5248                                             kvm_update_msi_routes_all,
5249                                             NULL);
5250         }
5251         notify_list_inited = true;
5252     }
5253     return 0;
5254 }
5255 
5256 int kvm_arch_release_virq_post(int virq)
5257 {
5258     MSIRouteEntry *entry, *next;
5259     QLIST_FOREACH_SAFE(entry, &msi_route_list, list, next) {
5260         if (entry->virq == virq) {
5261             trace_kvm_x86_remove_msi_route(virq);
5262             QLIST_REMOVE(entry, list);
5263             g_free(entry);
5264             break;
5265         }
5266     }
5267     return 0;
5268 }
5269 
5270 int kvm_arch_msi_data_to_gsi(uint32_t data)
5271 {
5272     abort();
5273 }
5274 
5275 bool kvm_has_waitpkg(void)
5276 {
5277     return has_msr_umwait;
5278 }
5279 
5280 bool kvm_arch_cpu_check_are_resettable(void)
5281 {
5282     return !sev_es_enabled();
5283 }
5284 
5285 #define ARCH_REQ_XCOMP_GUEST_PERM       0x1025
5286 
5287 void kvm_request_xsave_components(X86CPU *cpu, uint64_t mask)
5288 {
5289     KVMState *s = kvm_state;
5290     uint64_t supported;
5291 
5292     mask &= XSTATE_DYNAMIC_MASK;
5293     if (!mask) {
5294         return;
5295     }
5296     /*
5297      * Just ignore bits that are not in CPUID[EAX=0xD,ECX=0].
5298      * ARCH_REQ_XCOMP_GUEST_PERM would fail, and QEMU has warned
5299      * about them already because they are not supported features.
5300      */
5301     supported = kvm_arch_get_supported_cpuid(s, 0xd, 0, R_EAX);
5302     supported |= (uint64_t)kvm_arch_get_supported_cpuid(s, 0xd, 0, R_EDX) << 32;
5303     mask &= supported;
5304 
5305     while (mask) {
5306         int bit = ctz64(mask);
5307         int rc = syscall(SYS_arch_prctl, ARCH_REQ_XCOMP_GUEST_PERM, bit);
5308         if (rc) {
5309             /*
5310              * Older kernel version (<5.17) do not support
5311              * ARCH_REQ_XCOMP_GUEST_PERM, but also do not return
5312              * any dynamic feature from kvm_arch_get_supported_cpuid.
5313              */
5314             warn_report("prctl(ARCH_REQ_XCOMP_GUEST_PERM) failure "
5315                         "for feature bit %d", bit);
5316         }
5317         mask &= ~BIT_ULL(bit);
5318     }
5319 }
5320