target/i386/kvm.c

   1 /*
   2  * QEMU KVM support
   3  *
   4  * Copyright (C) 2006-2008 Qumranet Technologies
   5  * Copyright IBM, Corp. 2008
   6  *
   7  * Authors:
   8  *  Anthony Liguori   <aliguori@us.ibm.com>
   9  *
  10  * This work is licensed under the terms of the GNU GPL, version 2 or later.
  11  * See the COPYING file in the top-level directory.
  12  *
  13  */
  14
  15 #include "qemu/osdep.h"
  16 #include "qapi/error.h"
  17 #include <sys/ioctl.h>
  18 #include <sys/utsname.h>
  19
  20 #include <linux/kvm.h>
  21 #include "standard-headers/asm-x86/kvm_para.h"
  22
  23 #include "qemu-common.h"
  24 #include "cpu.h"
  25 #include "sysemu/sysemu.h"
  26 #include "sysemu/hw_accel.h"
  27 #include "sysemu/kvm_int.h"
  28 #include "kvm_i386.h"
  29 #include "hyperv.h"
  30 #include "hyperv-proto.h"
  31
  32 #include "exec/gdbstub.h"
  33 #include "qemu/host-utils.h"
  34 #include "qemu/config-file.h"
  35 #include "qemu/error-report.h"
  36 #include "hw/i386/pc.h"
  37 #include "hw/i386/apic.h"
  38 #include "hw/i386/apic_internal.h"
  39 #include "hw/i386/apic-msidef.h"
  40 #include "hw/i386/intel_iommu.h"
  41 #include "hw/i386/x86-iommu.h"
  42
  43 #include "hw/pci/pci.h"
  44 #include "hw/pci/msi.h"
  45 #include "hw/pci/msix.h"
  46 #include "migration/blocker.h"
  47 #include "exec/memattrs.h"
  48 #include "trace.h"
  49
  50 //#define DEBUG_KVM
  51
  52 #ifdef DEBUG_KVM
  53 #define DPRINTF(fmt, ...) \
  54     do { fprintf(stderr, fmt, ## __VA_ARGS__); } while (0)
  55 #else
  56 #define DPRINTF(fmt, ...) \
  57     do { } while (0)
  58 #endif
  59
  60 #define MSR_KVM_WALL_CLOCK  0x11
  61 #define MSR_KVM_SYSTEM_TIME 0x12
  62
  63 /* A 4096-byte buffer can hold the 8-byte kvm_msrs header, plus
  64  * 255 kvm_msr_entry structs */
  65 #define MSR_BUF_SIZE 4096
  66
  67 const KVMCapabilityInfo kvm_arch_required_capabilities[] = {
  68     KVM_CAP_INFO(SET_TSS_ADDR),
  69     KVM_CAP_INFO(EXT_CPUID),
  70     KVM_CAP_INFO(MP_STATE),
  71     KVM_CAP_LAST_INFO
  72 };
  73
  74 static bool has_msr_star;
  75 static bool has_msr_hsave_pa;
  76 static bool has_msr_tsc_aux;
  77 static bool has_msr_tsc_adjust;
  78 static bool has_msr_tsc_deadline;
  79 static bool has_msr_feature_control;
  80 static bool has_msr_misc_enable;
  81 static bool has_msr_smbase;
  82 static bool has_msr_bndcfgs;
  83 static int lm_capable_kernel;
  84 static bool has_msr_hv_hypercall;
  85 static bool has_msr_hv_crash;
  86 static bool has_msr_hv_reset;
  87 static bool has_msr_hv_vpindex;
  88 static bool hv_vpindex_settable;
  89 static bool has_msr_hv_runtime;
  90 static bool has_msr_hv_synic;
  91 static bool has_msr_hv_stimer;
  92 static bool has_msr_hv_frequencies;
  93 static bool has_msr_hv_reenlightenment;
  94 static bool has_msr_xss;
  95 static bool has_msr_spec_ctrl;
  96 static bool has_msr_virt_ssbd;
  97 static bool has_msr_smi_count;
  98
  99 static uint32_t has_architectural_pmu_version;
 100 static uint32_t num_architectural_pmu_gp_counters;
 101 static uint32_t num_architectural_pmu_fixed_counters;
 102
 103 static int has_xsave;
 104 static int has_xcrs;
 105 static int has_pit_state2;
 106
 107 static bool has_msr_mcg_ext_ctl;
 108
 109 static struct kvm_cpuid2 *cpuid_cache;
 110
 111 int kvm_has_pit_state2(void)
 112 {
 113     return has_pit_state2;
 114 }
 115
 116 bool kvm_has_smm(void)
 117 {
 118     return kvm_check_extension(kvm_state, KVM_CAP_X86_SMM);
 119 }
 120
 121 bool kvm_has_adjust_clock_stable(void)
 122 {
 123     int ret = kvm_check_extension(kvm_state, KVM_CAP_ADJUST_CLOCK);
 124
 125     return (ret == KVM_CLOCK_TSC_STABLE);
 126 }
 127
 128 bool kvm_allows_irq0_override(void)
 129 {
 130     return !kvm_irqchip_in_kernel() || kvm_has_gsi_routing();
 131 }
 132
 133 static bool kvm_x2apic_api_set_flags(uint64_t flags)
 134 {
 135     KVMState *s = KVM_STATE(current_machine->accelerator);
 136
 137     return !kvm_vm_enable_cap(s, KVM_CAP_X2APIC_API, 0, flags);
 138 }
 139
 140 #define MEMORIZE(fn, _result) \
 141     ({ \
 142         static bool _memorized; \
 143         \
 144         if (_memorized) { \
 145             return _result; \
 146         } \
 147         _memorized = true; \
 148         _result = fn; \
 149     })
 150
 151 static bool has_x2apic_api;
 152
 153 bool kvm_has_x2apic_api(void)
 154 {
 155     return has_x2apic_api;
 156 }
 157
 158 bool kvm_enable_x2apic(void)
 159 {
 160     return MEMORIZE(
 161              kvm_x2apic_api_set_flags(KVM_X2APIC_API_USE_32BIT_IDS |
 162                                       KVM_X2APIC_API_DISABLE_BROADCAST_QUIRK),
 163              has_x2apic_api);
 164 }
 165
 166 bool kvm_hv_vpindex_settable(void)
 167 {
 168     return hv_vpindex_settable;
 169 }
 170
 171 static int kvm_get_tsc(CPUState *cs)
 172 {
 173     X86CPU *cpu = X86_CPU(cs);
 174     CPUX86State *env = &cpu->env;
 175     struct {
 176         struct kvm_msrs info;
 177         struct kvm_msr_entry entries[1];
 178     } msr_data;
 179     int ret;
 180
 181     if (env->tsc_valid) {
 182         return 0;
 183     }
 184
 185     msr_data.info.nmsrs = 1;
 186     msr_data.entries[0].index = MSR_IA32_TSC;
 187     env->tsc_valid = !runstate_is_running();
 188
 189     ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_MSRS, &msr_data);
 190     if (ret < 0) {
 191         return ret;
 192     }
 193
 194     assert(ret == 1);
 195     env->tsc = msr_data.entries[0].data;
 196     return 0;
 197 }
 198
 199 static inline void do_kvm_synchronize_tsc(CPUState *cpu, run_on_cpu_data arg)
 200 {
 201     kvm_get_tsc(cpu);
 202 }
 203
 204 void kvm_synchronize_all_tsc(void)
 205 {
 206     CPUState *cpu;
 207
 208     if (kvm_enabled()) {
 209         CPU_FOREACH(cpu) {
 210             run_on_cpu(cpu, do_kvm_synchronize_tsc, RUN_ON_CPU_NULL);
 211         }
 212     }
 213 }
 214
 215 static struct kvm_cpuid2 *try_get_cpuid(KVMState *s, int max)
 216 {
 217     struct kvm_cpuid2 *cpuid;
 218     int r, size;
 219
 220     size = sizeof(*cpuid) + max * sizeof(*cpuid->entries);
 221     cpuid = g_malloc0(size);
 222     cpuid->nent = max;
 223     r = kvm_ioctl(s, KVM_GET_SUPPORTED_CPUID, cpuid);
 224     if (r == 0 && cpuid->nent >= max) {
 225         r = -E2BIG;
 226     }
 227     if (r < 0) {
 228         if (r == -E2BIG) {
 229             g_free(cpuid);
 230             return NULL;
 231         } else {
 232             fprintf(stderr, "KVM_GET_SUPPORTED_CPUID failed: %s\n",
 233                     strerror(-r));
 234             exit(1);
 235         }
 236     }
 237     return cpuid;
 238 }
 239
 240 /* Run KVM_GET_SUPPORTED_CPUID ioctl(), allocating a buffer large enough
 241  * for all entries.
 242  */
 243 static struct kvm_cpuid2 *get_supported_cpuid(KVMState *s)
 244 {
 245     struct kvm_cpuid2 *cpuid;
 246     int max = 1;
 247
 248     if (cpuid_cache != NULL) {
 249         return cpuid_cache;
 250     }
 251     while ((cpuid = try_get_cpuid(s, max)) == NULL) {
 252         max *= 2;
 253     }
 254     cpuid_cache = cpuid;
 255     return cpuid;
 256 }
 257
 258 static const struct kvm_para_features {
 259     int cap;
 260     int feature;
 261 } para_features[] = {
 262     { KVM_CAP_CLOCKSOURCE, KVM_FEATURE_CLOCKSOURCE },
 263     { KVM_CAP_NOP_IO_DELAY, KVM_FEATURE_NOP_IO_DELAY },
 264     { KVM_CAP_PV_MMU, KVM_FEATURE_MMU_OP },
 265     { KVM_CAP_ASYNC_PF, KVM_FEATURE_ASYNC_PF },
 266 };
 267
 268 static int get_para_features(KVMState *s)
 269 {
 270     int i, features = 0;
 271
 272     for (i = 0; i < ARRAY_SIZE(para_features); i++) {
 273         if (kvm_check_extension(s, para_features[i].cap)) {
 274             features |= (1 << para_features[i].feature);
 275         }
 276     }
 277
 278     return features;
 279 }
 280
 281 static bool host_tsx_blacklisted(void)
 282 {
 283     int family, model, stepping;\
 284     char vendor[CPUID_VENDOR_SZ + 1];
 285
 286     host_vendor_fms(vendor, &family, &model, &stepping);
 287
 288     /* Check if we are running on a Haswell host known to have broken TSX */
 289     return !strcmp(vendor, CPUID_VENDOR_INTEL) &&
 290            (family == 6) &&
 291            ((model == 63 && stepping < 4) ||
 292             model == 60 || model == 69 || model == 70);
 293 }
 294
 295 /* Returns the value for a specific register on the cpuid entry
 296  */
 297 static uint32_t cpuid_entry_get_reg(struct kvm_cpuid_entry2 *entry, int reg)
 298 {
 299     uint32_t ret = 0;
 300     switch (reg) {
 301     case R_EAX:
 302         ret = entry->eax;
 303         break;
 304     case R_EBX:
 305         ret = entry->ebx;
 306         break;
 307     case R_ECX:
 308         ret = entry->ecx;
 309         break;
 310     case R_EDX:
 311         ret = entry->edx;
 312         break;
 313     }
 314     return ret;
 315 }
 316
 317 /* Find matching entry for function/index on kvm_cpuid2 struct
 318  */
 319 static struct kvm_cpuid_entry2 *cpuid_find_entry(struct kvm_cpuid2 *cpuid,
 320                                                  uint32_t function,
 321                                                  uint32_t index)
 322 {
 323     int i;
 324     for (i = 0; i < cpuid->nent; ++i) {
 325         if (cpuid->entries[i].function == function &&
 326             cpuid->entries[i].index == index) {
 327             return &cpuid->entries[i];
 328         }
 329     }
 330     /* not found: */
 331     return NULL;
 332 }
 333
 334 uint32_t kvm_arch_get_supported_cpuid(KVMState *s, uint32_t function,
 335                                       uint32_t index, int reg)
 336 {
 337     struct kvm_cpuid2 *cpuid;
 338     uint32_t ret = 0;
 339     uint32_t cpuid_1_edx;
 340     bool found = false;
 341
 342     cpuid = get_supported_cpuid(s);
 343
 344     struct kvm_cpuid_entry2 *entry = cpuid_find_entry(cpuid, function, index);
 345     if (entry) {
 346         found = true;
 347         ret = cpuid_entry_get_reg(entry, reg);
 348     }
 349
 350     /* Fixups for the data returned by KVM, below */
 351
 352     if (function == 1 && reg == R_EDX) {
 353         /* KVM before 2.6.30 misreports the following features */
 354         ret |= CPUID_MTRR | CPUID_PAT | CPUID_MCE | CPUID_MCA;
 355     } else if (function == 1 && reg == R_ECX) {
 356         /* We can set the hypervisor flag, even if KVM does not return it on
 357          * GET_SUPPORTED_CPUID
 358          */
 359         ret |= CPUID_EXT_HYPERVISOR;
 360         /* tsc-deadline flag is not returned by GET_SUPPORTED_CPUID, but it
 361          * can be enabled if the kernel has KVM_CAP_TSC_DEADLINE_TIMER,
 362          * and the irqchip is in the kernel.
 363          */
 364         if (kvm_irqchip_in_kernel() &&
 365                 kvm_check_extension(s, KVM_CAP_TSC_DEADLINE_TIMER)) {
 366             ret |= CPUID_EXT_TSC_DEADLINE_TIMER;
 367         }
 368
 369         /* x2apic is reported by GET_SUPPORTED_CPUID, but it can't be enabled
 370          * without the in-kernel irqchip
 371          */
 372         if (!kvm_irqchip_in_kernel()) {
 373             ret &= ~CPUID_EXT_X2APIC;
 374         }
 375
 376         if (enable_cpu_pm) {
 377             int disable_exits = kvm_check_extension(s,
 378                                                     KVM_CAP_X86_DISABLE_EXITS);
 379
 380             if (disable_exits & KVM_X86_DISABLE_EXITS_MWAIT) {
 381                 ret |= CPUID_EXT_MONITOR;
 382             }
 383         }
 384     } else if (function == 6 && reg == R_EAX) {
 385         ret |= CPUID_6_EAX_ARAT; /* safe to allow because of emulated APIC */
 386     } else if (function == 7 && index == 0 && reg == R_EBX) {
 387         if (host_tsx_blacklisted()) {
 388             ret &= ~(CPUID_7_0_EBX_RTM | CPUID_7_0_EBX_HLE);
 389         }
 390     } else if (function == 0x80000001 && reg == R_ECX) {
 391         /*
 392          * It's safe to enable TOPOEXT even if it's not returned by
 393          * GET_SUPPORTED_CPUID.  Unconditionally enabling TOPOEXT here allows
 394          * us to keep CPU models including TOPOEXT runnable on older kernels.
 395          */
 396         ret |= CPUID_EXT3_TOPOEXT;
 397     } else if (function == 0x80000001 && reg == R_EDX) {
 398         /* On Intel, kvm returns cpuid according to the Intel spec,
 399          * so add missing bits according to the AMD spec:
 400          */
 401         cpuid_1_edx = kvm_arch_get_supported_cpuid(s, 1, 0, R_EDX);
 402         ret |= cpuid_1_edx & CPUID_EXT2_AMD_ALIASES;
 403     } else if (function == KVM_CPUID_FEATURES && reg == R_EAX) {
 404         /* kvm_pv_unhalt is reported by GET_SUPPORTED_CPUID, but it can't
 405          * be enabled without the in-kernel irqchip
 406          */
 407         if (!kvm_irqchip_in_kernel()) {
 408             ret &= ~(1U << KVM_FEATURE_PV_UNHALT);
 409         }
 410     } else if (function == KVM_CPUID_FEATURES && reg == R_EDX) {
 411         ret |= 1U << KVM_HINTS_REALTIME;
 412         found = 1;
 413     }
 414
 415     /* fallback for older kernels */
 416     if ((function == KVM_CPUID_FEATURES) && !found) {
 417         ret = get_para_features(s);
 418     }
 419
 420     return ret;
 421 }
 422
 423 typedef struct HWPoisonPage {
 424     ram_addr_t ram_addr;
 425     QLIST_ENTRY(HWPoisonPage) list;
 426 } HWPoisonPage;
 427
 428 static QLIST_HEAD(, HWPoisonPage) hwpoison_page_list =
 429     QLIST_HEAD_INITIALIZER(hwpoison_page_list);
 430
 431 static void kvm_unpoison_all(void *param)
 432 {
 433     HWPoisonPage *page, *next_page;
 434
 435     QLIST_FOREACH_SAFE(page, &hwpoison_page_list, list, next_page) {
 436         QLIST_REMOVE(page, list);
 437         qemu_ram_remap(page->ram_addr, TARGET_PAGE_SIZE);
 438         g_free(page);
 439     }
 440 }
 441
 442 static void kvm_hwpoison_page_add(ram_addr_t ram_addr)
 443 {
 444     HWPoisonPage *page;
 445
 446     QLIST_FOREACH(page, &hwpoison_page_list, list) {
 447         if (page->ram_addr == ram_addr) {
 448             return;
 449         }
 450     }
 451     page = g_new(HWPoisonPage, 1);
 452     page->ram_addr = ram_addr;
 453     QLIST_INSERT_HEAD(&hwpoison_page_list, page, list);
 454 }
 455
 456 static int kvm_get_mce_cap_supported(KVMState *s, uint64_t *mce_cap,
 457                                      int *max_banks)
 458 {
 459     int r;
 460
 461     r = kvm_check_extension(s, KVM_CAP_MCE);
 462     if (r > 0) {
 463         *max_banks = r;
 464         return kvm_ioctl(s, KVM_X86_GET_MCE_CAP_SUPPORTED, mce_cap);
 465     }
 466     return -ENOSYS;
 467 }
 468
 469 static void kvm_mce_inject(X86CPU *cpu, hwaddr paddr, int code)
 470 {
 471     CPUState *cs = CPU(cpu);
 472     CPUX86State *env = &cpu->env;
 473     uint64_t status = MCI_STATUS_VAL | MCI_STATUS_UC | MCI_STATUS_EN |
 474                       MCI_STATUS_MISCV | MCI_STATUS_ADDRV | MCI_STATUS_S;
 475     uint64_t mcg_status = MCG_STATUS_MCIP;
 476     int flags = 0;
 477
 478     if (code == BUS_MCEERR_AR) {
 479         status |= MCI_STATUS_AR | 0x134;
 480         mcg_status |= MCG_STATUS_EIPV;
 481     } else {
 482         status |= 0xc0;
 483         mcg_status |= MCG_STATUS_RIPV;
 484     }
 485
 486     flags = cpu_x86_support_mca_broadcast(env) ? MCE_INJECT_BROADCAST : 0;
 487     /* We need to read back the value of MSR_EXT_MCG_CTL that was set by the
 488      * guest kernel back into env->mcg_ext_ctl.
 489      */
 490     cpu_synchronize_state(cs);
 491     if (env->mcg_ext_ctl & MCG_EXT_CTL_LMCE_EN) {
 492         mcg_status |= MCG_STATUS_LMCE;
 493         flags = 0;
 494     }
 495
 496     cpu_x86_inject_mce(NULL, cpu, 9, status, mcg_status, paddr,
 497                        (MCM_ADDR_PHYS << 6) | 0xc, flags);
 498 }
 499
 500 static void hardware_memory_error(void)
 501 {
 502     fprintf(stderr, "Hardware memory error!\n");
 503     exit(1);
 504 }
 505
 506 void kvm_arch_on_sigbus_vcpu(CPUState *c, int code, void *addr)
 507 {
 508     X86CPU *cpu = X86_CPU(c);
 509     CPUX86State *env = &cpu->env;
 510     ram_addr_t ram_addr;
 511     hwaddr paddr;
 512
 513     /* If we get an action required MCE, it has been injected by KVM
 514      * while the VM was running.  An action optional MCE instead should
 515      * be coming from the main thread, which qemu_init_sigbus identifies
 516      * as the "early kill" thread.
 517      */
 518     assert(code == BUS_MCEERR_AR || code == BUS_MCEERR_AO);
 519
 520     if ((env->mcg_cap & MCG_SER_P) && addr) {
 521         ram_addr = qemu_ram_addr_from_host(addr);
 522         if (ram_addr != RAM_ADDR_INVALID &&
 523             kvm_physical_memory_addr_from_host(c->kvm_state, addr, &paddr)) {
 524             kvm_hwpoison_page_add(ram_addr);
 525             kvm_mce_inject(cpu, paddr, code);
 526             return;
 527         }
 528
 529         fprintf(stderr, "Hardware memory error for memory used by "
 530                 "QEMU itself instead of guest system!\n");
 531     }
 532
 533     if (code == BUS_MCEERR_AR) {
 534         hardware_memory_error();
 535     }
 536
 537     /* Hope we are lucky for AO MCE */
 538 }
 539
 540 static int kvm_inject_mce_oldstyle(X86CPU *cpu)
 541 {
 542     CPUX86State *env = &cpu->env;
 543
 544     if (!kvm_has_vcpu_events() && env->exception_injected == EXCP12_MCHK) {
 545         unsigned int bank, bank_num = env->mcg_cap & 0xff;
 546         struct kvm_x86_mce mce;
 547
 548         env->exception_injected = -1;
 549
 550         /*
 551          * There must be at least one bank in use if an MCE is pending.
 552          * Find it and use its values for the event injection.
 553          */
 554         for (bank = 0; bank < bank_num; bank++) {
 555             if (env->mce_banks[bank * 4 + 1] & MCI_STATUS_VAL) {
 556                 break;
 557             }
 558         }
 559         assert(bank < bank_num);
 560
 561         mce.bank = bank;
 562         mce.status = env->mce_banks[bank * 4 + 1];
 563         mce.mcg_status = env->mcg_status;
 564         mce.addr = env->mce_banks[bank * 4 + 2];
 565         mce.misc = env->mce_banks[bank * 4 + 3];
 566
 567         return kvm_vcpu_ioctl(CPU(cpu), KVM_X86_SET_MCE, &mce);
 568     }
 569     return 0;
 570 }
 571
 572 static void cpu_update_state(void *opaque, int running, RunState state)
 573 {
 574     CPUX86State *env = opaque;
 575
 576     if (running) {
 577         env->tsc_valid = false;
 578     }
 579 }
 580
 581 unsigned long kvm_arch_vcpu_id(CPUState *cs)
 582 {
 583     X86CPU *cpu = X86_CPU(cs);
 584     return cpu->apic_id;
 585 }
 586
 587 #ifndef KVM_CPUID_SIGNATURE_NEXT
 588 #define KVM_CPUID_SIGNATURE_NEXT                0x40000100
 589 #endif
 590
 591 static bool hyperv_hypercall_available(X86CPU *cpu)
 592 {
 593     return cpu->hyperv_vapic ||
 594            (cpu->hyperv_spinlock_attempts != HYPERV_SPINLOCK_NEVER_RETRY);
 595 }
 596
 597 static bool hyperv_enabled(X86CPU *cpu)
 598 {
 599     CPUState *cs = CPU(cpu);
 600     return kvm_check_extension(cs->kvm_state, KVM_CAP_HYPERV) > 0 &&
 601            (hyperv_hypercall_available(cpu) ||
 602             cpu->hyperv_time  ||
 603             cpu->hyperv_relaxed_timing ||
 604             cpu->hyperv_crash ||
 605             cpu->hyperv_reset ||
 606             cpu->hyperv_vpindex ||
 607             cpu->hyperv_runtime ||
 608             cpu->hyperv_synic ||
 609             cpu->hyperv_stimer ||
 610             cpu->hyperv_reenlightenment ||
 611             cpu->hyperv_tlbflush ||
 612             cpu->hyperv_ipi);
 613 }
 614
 615 static int kvm_arch_set_tsc_khz(CPUState *cs)
 616 {
 617     X86CPU *cpu = X86_CPU(cs);
 618     CPUX86State *env = &cpu->env;
 619     int r;
 620
 621     if (!env->tsc_khz) {
 622         return 0;
 623     }
 624
 625     r = kvm_check_extension(cs->kvm_state, KVM_CAP_TSC_CONTROL) ?
 626         kvm_vcpu_ioctl(cs, KVM_SET_TSC_KHZ, env->tsc_khz) :
 627         -ENOTSUP;
 628     if (r < 0) {
 629         /* When KVM_SET_TSC_KHZ fails, it's an error only if the current
 630          * TSC frequency doesn't match the one we want.
 631          */
 632         int cur_freq = kvm_check_extension(cs->kvm_state, KVM_CAP_GET_TSC_KHZ) ?
 633                        kvm_vcpu_ioctl(cs, KVM_GET_TSC_KHZ) :
 634                        -ENOTSUP;
 635         if (cur_freq <= 0 || cur_freq != env->tsc_khz) {
 636             warn_report("TSC frequency mismatch between "
 637                         "VM (%" PRId64 " kHz) and host (%d kHz), "
 638                         "and TSC scaling unavailable",
 639                         env->tsc_khz, cur_freq);
 640             return r;
 641         }
 642     }
 643
 644     return 0;
 645 }
 646
 647 static bool tsc_is_stable_and_known(CPUX86State *env)
 648 {
 649     if (!env->tsc_khz) {
 650         return false;
 651     }
 652     return (env->features[FEAT_8000_0007_EDX] & CPUID_APM_INVTSC)
 653         || env->user_tsc_khz;
 654 }
 655
 656 static int hyperv_handle_properties(CPUState *cs)
 657 {
 658     X86CPU *cpu = X86_CPU(cs);
 659     CPUX86State *env = &cpu->env;
 660
 661     if (cpu->hyperv_relaxed_timing) {
 662         env->features[FEAT_HYPERV_EAX] |= HV_HYPERCALL_AVAILABLE;
 663     }
 664     if (cpu->hyperv_vapic) {
 665         env->features[FEAT_HYPERV_EAX] |= HV_HYPERCALL_AVAILABLE;
 666         env->features[FEAT_HYPERV_EAX] |= HV_APIC_ACCESS_AVAILABLE;
 667     }
 668     if (cpu->hyperv_time) {
 669         if (kvm_check_extension(cs->kvm_state, KVM_CAP_HYPERV_TIME) <= 0) {
 670             fprintf(stderr, "Hyper-V clocksources "
 671                     "(requested by 'hv-time' cpu flag) "
 672                     "are not supported by kernel\n");
 673             return -ENOSYS;
 674         }
 675         env->features[FEAT_HYPERV_EAX] |= HV_HYPERCALL_AVAILABLE;
 676         env->features[FEAT_HYPERV_EAX] |= HV_TIME_REF_COUNT_AVAILABLE;
 677         env->features[FEAT_HYPERV_EAX] |= HV_REFERENCE_TSC_AVAILABLE;
 678     }
 679     if (cpu->hyperv_frequencies) {
 680         if (!has_msr_hv_frequencies) {
 681             fprintf(stderr, "Hyper-V frequency MSRs "
 682                     "(requested by 'hv-frequencies' cpu flag) "
 683                     "are not supported by kernel\n");
 684             return -ENOSYS;
 685         }
 686         env->features[FEAT_HYPERV_EAX] |= HV_ACCESS_FREQUENCY_MSRS;
 687         env->features[FEAT_HYPERV_EDX] |= HV_FREQUENCY_MSRS_AVAILABLE;
 688     }
 689     if (cpu->hyperv_crash) {
 690         if (!has_msr_hv_crash) {
 691             fprintf(stderr, "Hyper-V crash MSRs "
 692                     "(requested by 'hv-crash' cpu flag) "
 693                     "are not supported by kernel\n");
 694             return -ENOSYS;
 695         }
 696         env->features[FEAT_HYPERV_EDX] |= HV_GUEST_CRASH_MSR_AVAILABLE;
 697     }
 698     if (cpu->hyperv_reenlightenment) {
 699         if (!has_msr_hv_reenlightenment) {
 700             fprintf(stderr,
 701                     "Hyper-V Reenlightenment MSRs "
 702                     "(requested by 'hv-reenlightenment' cpu flag) "
 703                     "are not supported by kernel\n");
 704             return -ENOSYS;
 705         }
 706         env->features[FEAT_HYPERV_EAX] |= HV_ACCESS_REENLIGHTENMENTS_CONTROL;
 707     }
 708     env->features[FEAT_HYPERV_EDX] |= HV_CPU_DYNAMIC_PARTITIONING_AVAILABLE;
 709     if (cpu->hyperv_reset) {
 710         if (!has_msr_hv_reset) {
 711             fprintf(stderr, "Hyper-V reset MSR "
 712                     "(requested by 'hv-reset' cpu flag) "
 713                     "is not supported by kernel\n");
 714             return -ENOSYS;
 715         }
 716         env->features[FEAT_HYPERV_EAX] |= HV_RESET_AVAILABLE;
 717     }
 718     if (cpu->hyperv_vpindex) {
 719         if (!has_msr_hv_vpindex) {
 720             fprintf(stderr, "Hyper-V VP_INDEX MSR "
 721                     "(requested by 'hv-vpindex' cpu flag) "
 722                     "is not supported by kernel\n");
 723             return -ENOSYS;
 724         }
 725         env->features[FEAT_HYPERV_EAX] |= HV_VP_INDEX_AVAILABLE;
 726     }
 727     if (cpu->hyperv_runtime) {
 728         if (!has_msr_hv_runtime) {
 729             fprintf(stderr, "Hyper-V VP_RUNTIME MSR "
 730                     "(requested by 'hv-runtime' cpu flag) "
 731                     "is not supported by kernel\n");
 732             return -ENOSYS;
 733         }
 734         env->features[FEAT_HYPERV_EAX] |= HV_VP_RUNTIME_AVAILABLE;
 735     }
 736     if (cpu->hyperv_synic) {
 737         if (!has_msr_hv_synic ||
 738             kvm_vcpu_enable_cap(cs, KVM_CAP_HYPERV_SYNIC, 0)) {
 739             fprintf(stderr, "Hyper-V SynIC is not supported by kernel\n");
 740             return -ENOSYS;
 741         }
 742
 743         env->features[FEAT_HYPERV_EAX] |= HV_SYNIC_AVAILABLE;
 744     }
 745     if (cpu->hyperv_stimer) {
 746         if (!has_msr_hv_stimer) {
 747             fprintf(stderr, "Hyper-V timers aren't supported by kernel\n");
 748             return -ENOSYS;
 749         }
 750         env->features[FEAT_HYPERV_EAX] |= HV_SYNTIMERS_AVAILABLE;
 751     }
 752     return 0;
 753 }
 754
 755 static int hyperv_init_vcpu(X86CPU *cpu)
 756 {
 757     if (cpu->hyperv_vpindex && !hv_vpindex_settable) {
 758         /*
 759          * the kernel doesn't support setting vp_index; assert that its value
 760          * is in sync
 761          */
 762         int ret;
 763         struct {
 764             struct kvm_msrs info;
 765             struct kvm_msr_entry entries[1];
 766         } msr_data = {
 767             .info.nmsrs = 1,
 768             .entries[0].index = HV_X64_MSR_VP_INDEX,
 769         };
 770
 771         ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_MSRS, &msr_data);
 772         if (ret < 0) {
 773             return ret;
 774         }
 775         assert(ret == 1);
 776
 777         if (msr_data.entries[0].data != hyperv_vp_index(CPU(cpu))) {
 778             error_report("kernel's vp_index != QEMU's vp_index");
 779             return -ENXIO;
 780         }
 781     }
 782
 783     return 0;
 784 }
 785
 786 static Error *invtsc_mig_blocker;
 787
 788 #define KVM_MAX_CPUID_ENTRIES  100
 789
 790 int kvm_arch_init_vcpu(CPUState *cs)
 791 {
 792     struct {
 793         struct kvm_cpuid2 cpuid;
 794         struct kvm_cpuid_entry2 entries[KVM_MAX_CPUID_ENTRIES];
 795     } QEMU_PACKED cpuid_data;
 796     X86CPU *cpu = X86_CPU(cs);
 797     CPUX86State *env = &cpu->env;
 798     uint32_t limit, i, j, cpuid_i;
 799     uint32_t unused;
 800     struct kvm_cpuid_entry2 *c;
 801     uint32_t signature[3];
 802     int kvm_base = KVM_CPUID_SIGNATURE;
 803     int r;
 804     Error *local_err = NULL;
 805
 806     memset(&cpuid_data, 0, sizeof(cpuid_data));
 807
 808     cpuid_i = 0;
 809
 810     r = kvm_arch_set_tsc_khz(cs);
 811     if (r < 0) {
 812         goto fail;
 813     }
 814
 815     /* vcpu's TSC frequency is either specified by user, or following
 816      * the value used by KVM if the former is not present. In the
 817      * latter case, we query it from KVM and record in env->tsc_khz,
 818      * so that vcpu's TSC frequency can be migrated later via this field.
 819      */
 820     if (!env->tsc_khz) {
 821         r = kvm_check_extension(cs->kvm_state, KVM_CAP_GET_TSC_KHZ) ?
 822             kvm_vcpu_ioctl(cs, KVM_GET_TSC_KHZ) :
 823             -ENOTSUP;
 824         if (r > 0) {
 825             env->tsc_khz = r;
 826         }
 827     }
 828
 829     /* Paravirtualization CPUIDs */
 830     if (hyperv_enabled(cpu)) {
 831         c = &cpuid_data.entries[cpuid_i++];
 832         c->function = HV_CPUID_VENDOR_AND_MAX_FUNCTIONS;
 833         if (!cpu->hyperv_vendor_id) {
 834             memcpy(signature, "Microsoft Hv", 12);
 835         } else {
 836             size_t len = strlen(cpu->hyperv_vendor_id);
 837
 838             if (len > 12) {
 839                 error_report("hv-vendor-id truncated to 12 characters");
 840                 len = 12;
 841             }
 842             memset(signature, 0, 12);
 843             memcpy(signature, cpu->hyperv_vendor_id, len);
 844         }
 845         c->eax = HV_CPUID_MIN;
 846         c->ebx = signature[0];
 847         c->ecx = signature[1];
 848         c->edx = signature[2];
 849
 850         c = &cpuid_data.entries[cpuid_i++];
 851         c->function = HV_CPUID_INTERFACE;
 852         memcpy(signature, "Hv#1\0\0\0\0\0\0\0\0", 12);
 853         c->eax = signature[0];
 854         c->ebx = 0;
 855         c->ecx = 0;
 856         c->edx = 0;
 857
 858         c = &cpuid_data.entries[cpuid_i++];
 859         c->function = HV_CPUID_VERSION;
 860         c->eax = 0x00001bbc;
 861         c->ebx = 0x00060001;
 862
 863         c = &cpuid_data.entries[cpuid_i++];
 864         c->function = HV_CPUID_FEATURES;
 865         r = hyperv_handle_properties(cs);
 866         if (r) {
 867             return r;
 868         }
 869         c->eax = env->features[FEAT_HYPERV_EAX];
 870         c->ebx = env->features[FEAT_HYPERV_EBX];
 871         c->edx = env->features[FEAT_HYPERV_EDX];
 872
 873         c = &cpuid_data.entries[cpuid_i++];
 874         c->function = HV_CPUID_ENLIGHTMENT_INFO;
 875         if (cpu->hyperv_relaxed_timing) {
 876             c->eax |= HV_RELAXED_TIMING_RECOMMENDED;
 877         }
 878         if (cpu->hyperv_vapic) {
 879             c->eax |= HV_APIC_ACCESS_RECOMMENDED;
 880         }
 881         if (cpu->hyperv_tlbflush) {
 882             if (kvm_check_extension(cs->kvm_state,
 883                                     KVM_CAP_HYPERV_TLBFLUSH) <= 0) {
 884                 fprintf(stderr, "Hyper-V TLB flush support "
 885                         "(requested by 'hv-tlbflush' cpu flag) "
 886                         " is not supported by kernel\n");
 887                 return -ENOSYS;
 888             }
 889             c->eax |= HV_REMOTE_TLB_FLUSH_RECOMMENDED;
 890             c->eax |= HV_EX_PROCESSOR_MASKS_RECOMMENDED;
 891         }
 892         if (cpu->hyperv_ipi) {
 893             if (kvm_check_extension(cs->kvm_state,
 894                                     KVM_CAP_HYPERV_SEND_IPI) <= 0) {
 895                 fprintf(stderr, "Hyper-V IPI send support "
 896                         "(requested by 'hv-ipi' cpu flag) "
 897                         " is not supported by kernel\n");
 898                 return -ENOSYS;
 899             }
 900             c->eax |= HV_CLUSTER_IPI_RECOMMENDED;
 901             c->eax |= HV_EX_PROCESSOR_MASKS_RECOMMENDED;
 902         }
 903
 904         c->ebx = cpu->hyperv_spinlock_attempts;
 905
 906         c = &cpuid_data.entries[cpuid_i++];
 907         c->function = HV_CPUID_IMPLEMENT_LIMITS;
 908
 909         c->eax = cpu->hv_max_vps;
 910         c->ebx = 0x40;
 911
 912         kvm_base = KVM_CPUID_SIGNATURE_NEXT;
 913         has_msr_hv_hypercall = true;
 914     }
 915
 916     if (cpu->expose_kvm) {
 917         memcpy(signature, "KVMKVMKVM\0\0\0", 12);
 918         c = &cpuid_data.entries[cpuid_i++];
 919         c->function = KVM_CPUID_SIGNATURE | kvm_base;
 920         c->eax = KVM_CPUID_FEATURES | kvm_base;
 921         c->ebx = signature[0];
 922         c->ecx = signature[1];
 923         c->edx = signature[2];
 924
 925         c = &cpuid_data.entries[cpuid_i++];
 926         c->function = KVM_CPUID_FEATURES | kvm_base;
 927         c->eax = env->features[FEAT_KVM];
 928         c->edx = env->features[FEAT_KVM_HINTS];
 929     }
 930
 931     cpu_x86_cpuid(env, 0, 0, &limit, &unused, &unused, &unused);
 932
 933     for (i = 0; i <= limit; i++) {
 934         if (cpuid_i == KVM_MAX_CPUID_ENTRIES) {
 935             fprintf(stderr, "unsupported level value: 0x%x\n", limit);
 936             abort();
 937         }
 938         c = &cpuid_data.entries[cpuid_i++];
 939
 940         switch (i) {
 941         case 2: {
 942             /* Keep reading function 2 till all the input is received */
 943             int times;
 944
 945             c->function = i;
 946             c->flags = KVM_CPUID_FLAG_STATEFUL_FUNC |
 947                        KVM_CPUID_FLAG_STATE_READ_NEXT;
 948             cpu_x86_cpuid(env, i, 0, &c->eax, &c->ebx, &c->ecx, &c->edx);
 949             times = c->eax & 0xff;
 950
 951             for (j = 1; j < times; ++j) {
 952                 if (cpuid_i == KVM_MAX_CPUID_ENTRIES) {
 953                     fprintf(stderr, "cpuid_data is full, no space for "
 954                             "cpuid(eax:2):eax & 0xf = 0x%x\n", times);
 955                     abort();
 956                 }
 957                 c = &cpuid_data.entries[cpuid_i++];
 958                 c->function = i;
 959                 c->flags = KVM_CPUID_FLAG_STATEFUL_FUNC;
 960                 cpu_x86_cpuid(env, i, 0, &c->eax, &c->ebx, &c->ecx, &c->edx);
 961             }
 962             break;
 963         }
 964         case 4:
 965         case 0xb:
 966         case 0xd:
 967             for (j = 0; ; j++) {
 968                 if (i == 0xd && j == 64) {
 969                     break;
 970                 }
 971                 c->function = i;
 972                 c->flags = KVM_CPUID_FLAG_SIGNIFCANT_INDEX;
 973                 c->index = j;
 974                 cpu_x86_cpuid(env, i, j, &c->eax, &c->ebx, &c->ecx, &c->edx);
 975
 976                 if (i == 4 && c->eax == 0) {
 977                     break;
 978                 }
 979                 if (i == 0xb && !(c->ecx & 0xff00)) {
 980                     break;
 981                 }
 982                 if (i == 0xd && c->eax == 0) {
 983                     continue;
 984                 }
 985                 if (cpuid_i == KVM_MAX_CPUID_ENTRIES) {
 986                     fprintf(stderr, "cpuid_data is full, no space for "
 987                             "cpuid(eax:0x%x,ecx:0x%x)\n", i, j);
 988                     abort();
 989                 }
 990                 c = &cpuid_data.entries[cpuid_i++];
 991             }
 992             break;
 993         case 0x14: {
 994             uint32_t times;
 995
 996             c->function = i;
 997             c->index = 0;
 998             c->flags = KVM_CPUID_FLAG_SIGNIFCANT_INDEX;
 999             cpu_x86_cpuid(env, i, 0, &c->eax, &c->ebx, &c->ecx, &c->edx);
1000             times = c->eax;
1001
1002             for (j = 1; j <= times; ++j) {
1003                 if (cpuid_i == KVM_MAX_CPUID_ENTRIES) {
1004                     fprintf(stderr, "cpuid_data is full, no space for "
1005                                 "cpuid(eax:0x14,ecx:0x%x)\n", j);
1006                     abort();
1007                 }
1008                 c = &cpuid_data.entries[cpuid_i++];
1009                 c->function = i;
1010                 c->index = j;
1011                 c->flags = KVM_CPUID_FLAG_SIGNIFCANT_INDEX;
1012                 cpu_x86_cpuid(env, i, j, &c->eax, &c->ebx, &c->ecx, &c->edx);
1013             }
1014             break;
1015         }
1016         default:
1017             c->function = i;
1018             c->flags = 0;
1019             cpu_x86_cpuid(env, i, 0, &c->eax, &c->ebx, &c->ecx, &c->edx);
1020             break;
1021         }
1022     }
1023
1024     if (limit >= 0x0a) {
1025         uint32_t eax, edx;
1026
1027         cpu_x86_cpuid(env, 0x0a, 0, &eax, &unused, &unused, &edx);
1028
1029         has_architectural_pmu_version = eax & 0xff;
1030         if (has_architectural_pmu_version > 0) {
1031             num_architectural_pmu_gp_counters = (eax & 0xff00) >> 8;
1032
1033             /* Shouldn't be more than 32, since that's the number of bits
1034              * available in EBX to tell us _which_ counters are available.
1035              * Play it safe.
1036              */
1037             if (num_architectural_pmu_gp_counters > MAX_GP_COUNTERS) {
1038                 num_architectural_pmu_gp_counters = MAX_GP_COUNTERS;
1039             }
1040
1041             if (has_architectural_pmu_version > 1) {
1042                 num_architectural_pmu_fixed_counters = edx & 0x1f;
1043
1044                 if (num_architectural_pmu_fixed_counters > MAX_FIXED_COUNTERS) {
1045                     num_architectural_pmu_fixed_counters = MAX_FIXED_COUNTERS;
1046                 }
1047             }
1048         }
1049     }
1050
1051     cpu_x86_cpuid(env, 0x80000000, 0, &limit, &unused, &unused, &unused);
1052
1053     for (i = 0x80000000; i <= limit; i++) {
1054         if (cpuid_i == KVM_MAX_CPUID_ENTRIES) {
1055             fprintf(stderr, "unsupported xlevel value: 0x%x\n", limit);
1056             abort();
1057         }
1058         c = &cpuid_data.entries[cpuid_i++];
1059
1060         switch (i) {
1061         case 0x8000001d:
1062             /* Query for all AMD cache information leaves */
1063             for (j = 0; ; j++) {
1064                 c->function = i;
1065                 c->flags = KVM_CPUID_FLAG_SIGNIFCANT_INDEX;
1066                 c->index = j;
1067                 cpu_x86_cpuid(env, i, j, &c->eax, &c->ebx, &c->ecx, &c->edx);
1068
1069                 if (c->eax == 0) {
1070                     break;
1071                 }
1072                 if (cpuid_i == KVM_MAX_CPUID_ENTRIES) {
1073                     fprintf(stderr, "cpuid_data is full, no space for "
1074                             "cpuid(eax:0x%x,ecx:0x%x)\n", i, j);
1075                     abort();
1076                 }
1077                 c = &cpuid_data.entries[cpuid_i++];
1078             }
1079             break;
1080         default:
1081             c->function = i;
1082             c->flags = 0;
1083             cpu_x86_cpuid(env, i, 0, &c->eax, &c->ebx, &c->ecx, &c->edx);
1084             break;
1085         }
1086     }
1087
1088     /* Call Centaur's CPUID instructions they are supported. */
1089     if (env->cpuid_xlevel2 > 0) {
1090         cpu_x86_cpuid(env, 0xC0000000, 0, &limit, &unused, &unused, &unused);
1091
1092         for (i = 0xC0000000; i <= limit; i++) {
1093             if (cpuid_i == KVM_MAX_CPUID_ENTRIES) {
1094                 fprintf(stderr, "unsupported xlevel2 value: 0x%x\n", limit);
1095                 abort();
1096             }
1097             c = &cpuid_data.entries[cpuid_i++];
1098
1099             c->function = i;
1100             c->flags = 0;
1101             cpu_x86_cpuid(env, i, 0, &c->eax, &c->ebx, &c->ecx, &c->edx);
1102         }
1103     }
1104
1105     cpuid_data.cpuid.nent = cpuid_i;
1106
1107     if (((env->cpuid_version >> 8)&0xF) >= 6
1108         && (env->features[FEAT_1_EDX] & (CPUID_MCE | CPUID_MCA)) ==
1109            (CPUID_MCE | CPUID_MCA)
1110         && kvm_check_extension(cs->kvm_state, KVM_CAP_MCE) > 0) {
1111         uint64_t mcg_cap, unsupported_caps;
1112         int banks;
1113         int ret;
1114
1115         ret = kvm_get_mce_cap_supported(cs->kvm_state, &mcg_cap, &banks);
1116         if (ret < 0) {
1117             fprintf(stderr, "kvm_get_mce_cap_supported: %s", strerror(-ret));
1118             return ret;
1119         }
1120
1121         if (banks < (env->mcg_cap & MCG_CAP_BANKS_MASK)) {
1122             error_report("kvm: Unsupported MCE bank count (QEMU = %d, KVM = %d)",
1123                          (int)(env->mcg_cap & MCG_CAP_BANKS_MASK), banks);
1124             return -ENOTSUP;
1125         }
1126
1127         unsupported_caps = env->mcg_cap & ~(mcg_cap | MCG_CAP_BANKS_MASK);
1128         if (unsupported_caps) {
1129             if (unsupported_caps & MCG_LMCE_P) {
1130                 error_report("kvm: LMCE not supported");
1131                 return -ENOTSUP;
1132             }
1133             warn_report("Unsupported MCG_CAP bits: 0x%" PRIx64,
1134                         unsupported_caps);
1135         }
1136
1137         env->mcg_cap &= mcg_cap | MCG_CAP_BANKS_MASK;
1138         ret = kvm_vcpu_ioctl(cs, KVM_X86_SETUP_MCE, &env->mcg_cap);
1139         if (ret < 0) {
1140             fprintf(stderr, "KVM_X86_SETUP_MCE: %s", strerror(-ret));
1141             return ret;
1142         }
1143     }
1144
1145     qemu_add_vm_change_state_handler(cpu_update_state, env);
1146
1147     c = cpuid_find_entry(&cpuid_data.cpuid, 1, 0);
1148     if (c) {
1149         has_msr_feature_control = !!(c->ecx & CPUID_EXT_VMX) ||
1150                                   !!(c->ecx & CPUID_EXT_SMX);
1151     }
1152
1153     if (env->mcg_cap & MCG_LMCE_P) {
1154         has_msr_mcg_ext_ctl = has_msr_feature_control = true;
1155     }
1156
1157     if (!env->user_tsc_khz) {
1158         if ((env->features[FEAT_8000_0007_EDX] & CPUID_APM_INVTSC) &&
1159             invtsc_mig_blocker == NULL) {
1160             /* for migration */
1161             error_setg(&invtsc_mig_blocker,
1162                        "State blocked by non-migratable CPU device"
1163                        " (invtsc flag)");
1164             r = migrate_add_blocker(invtsc_mig_blocker, &local_err);
1165             if (local_err) {
1166                 error_report_err(local_err);
1167                 error_free(invtsc_mig_blocker);
1168                 goto fail;
1169             }
1170             /* for savevm */
1171             vmstate_x86_cpu.unmigratable = 1;
1172         }
1173     }
1174
1175     if (cpu->vmware_cpuid_freq
1176         /* Guests depend on 0x40000000 to detect this feature, so only expose
1177          * it if KVM exposes leaf 0x40000000. (Conflicts with Hyper-V) */
1178         && cpu->expose_kvm
1179         && kvm_base == KVM_CPUID_SIGNATURE
1180         /* TSC clock must be stable and known for this feature. */
1181         && tsc_is_stable_and_known(env)) {
1182
1183         c = &cpuid_data.entries[cpuid_i++];
1184         c->function = KVM_CPUID_SIGNATURE | 0x10;
1185         c->eax = env->tsc_khz;
1186         /* LAPIC resolution of 1ns (freq: 1GHz) is hardcoded in KVM's
1187          * APIC_BUS_CYCLE_NS */
1188         c->ebx = 1000000;
1189         c->ecx = c->edx = 0;
1190
1191         c = cpuid_find_entry(&cpuid_data.cpuid, kvm_base, 0);
1192         c->eax = MAX(c->eax, KVM_CPUID_SIGNATURE | 0x10);
1193     }
1194
1195     cpuid_data.cpuid.nent = cpuid_i;
1196
1197     cpuid_data.cpuid.padding = 0;
1198     r = kvm_vcpu_ioctl(cs, KVM_SET_CPUID2, &cpuid_data);
1199     if (r) {
1200         goto fail;
1201     }
1202
1203     if (has_xsave) {
1204         env->xsave_buf = qemu_memalign(4096, sizeof(struct kvm_xsave));
1205     }
1206     cpu->kvm_msr_buf = g_malloc0(MSR_BUF_SIZE);
1207
1208     if (!(env->features[FEAT_8000_0001_EDX] & CPUID_EXT2_RDTSCP)) {
1209         has_msr_tsc_aux = false;
1210     }
1211
1212     r = hyperv_init_vcpu(cpu);
1213     if (r) {
1214         goto fail;
1215     }
1216
1217     return 0;
1218
1219  fail:
1220     migrate_del_blocker(invtsc_mig_blocker);
1221     return r;
1222 }
1223
1224 void kvm_arch_reset_vcpu(X86CPU *cpu)
1225 {
1226     CPUX86State *env = &cpu->env;
1227
1228     env->xcr0 = 1;
1229     if (kvm_irqchip_in_kernel()) {
1230         env->mp_state = cpu_is_bsp(cpu) ? KVM_MP_STATE_RUNNABLE :
1231                                           KVM_MP_STATE_UNINITIALIZED;
1232     } else {
1233         env->mp_state = KVM_MP_STATE_RUNNABLE;
1234     }
1235
1236     if (cpu->hyperv_synic) {
1237         int i;
1238         for (i = 0; i < ARRAY_SIZE(env->msr_hv_synic_sint); i++) {
1239             env->msr_hv_synic_sint[i] = HV_SINT_MASKED;
1240         }
1241     }
1242 }
1243
1244 void kvm_arch_do_init_vcpu(X86CPU *cpu)
1245 {
1246     CPUX86State *env = &cpu->env;
1247
1248     /* APs get directly into wait-for-SIPI state.  */
1249     if (env->mp_state == KVM_MP_STATE_UNINITIALIZED) {
1250         env->mp_state = KVM_MP_STATE_INIT_RECEIVED;
1251     }
1252 }
1253
1254 static int kvm_get_supported_msrs(KVMState *s)
1255 {
1256     static int kvm_supported_msrs;
1257     int ret = 0;
1258
1259     /* first time */
1260     if (kvm_supported_msrs == 0) {
1261         struct kvm_msr_list msr_list, *kvm_msr_list;
1262
1263         kvm_supported_msrs = -1;
1264
1265         /* Obtain MSR list from KVM.  These are the MSRs that we must
1266          * save/restore */
1267         msr_list.nmsrs = 0;
1268         ret = kvm_ioctl(s, KVM_GET_MSR_INDEX_LIST, &msr_list);
1269         if (ret < 0 && ret != -E2BIG) {
1270             return ret;
1271         }
1272         /* Old kernel modules had a bug and could write beyond the provided
1273            memory. Allocate at least a safe amount of 1K. */
1274         kvm_msr_list = g_malloc0(MAX(1024, sizeof(msr_list) +
1275                                               msr_list.nmsrs *
1276                                               sizeof(msr_list.indices[0])));
1277
1278         kvm_msr_list->nmsrs = msr_list.nmsrs;
1279         ret = kvm_ioctl(s, KVM_GET_MSR_INDEX_LIST, kvm_msr_list);
1280         if (ret >= 0) {
1281             int i;
1282
1283             for (i = 0; i < kvm_msr_list->nmsrs; i++) {
1284                 switch (kvm_msr_list->indices[i]) {
1285                 case MSR_STAR:
1286                     has_msr_star = true;
1287                     break;
1288                 case MSR_VM_HSAVE_PA:
1289                     has_msr_hsave_pa = true;
1290                     break;
1291                 case MSR_TSC_AUX:
1292                     has_msr_tsc_aux = true;
1293                     break;
1294                 case MSR_TSC_ADJUST:
1295                     has_msr_tsc_adjust = true;
1296                     break;
1297                 case MSR_IA32_TSCDEADLINE:
1298                     has_msr_tsc_deadline = true;
1299                     break;
1300                 case MSR_IA32_SMBASE:
1301                     has_msr_smbase = true;
1302                     break;
1303                 case MSR_SMI_COUNT:
1304                     has_msr_smi_count = true;
1305                     break;
1306                 case MSR_IA32_MISC_ENABLE:
1307                     has_msr_misc_enable = true;
1308                     break;
1309                 case MSR_IA32_BNDCFGS:
1310                     has_msr_bndcfgs = true;
1311                     break;
1312                 case MSR_IA32_XSS:
1313                     has_msr_xss = true;
1314                     break;
1315                 case HV_X64_MSR_CRASH_CTL:
1316                     has_msr_hv_crash = true;
1317                     break;
1318                 case HV_X64_MSR_RESET:
1319                     has_msr_hv_reset = true;
1320                     break;
1321                 case HV_X64_MSR_VP_INDEX:
1322                     has_msr_hv_vpindex = true;
1323                     break;
1324                 case HV_X64_MSR_VP_RUNTIME:
1325                     has_msr_hv_runtime = true;
1326                     break;
1327                 case HV_X64_MSR_SCONTROL:
1328                     has_msr_hv_synic = true;
1329                     break;
1330                 case HV_X64_MSR_STIMER0_CONFIG:
1331                     has_msr_hv_stimer = true;
1332                     break;
1333                 case HV_X64_MSR_TSC_FREQUENCY:
1334                     has_msr_hv_frequencies = true;
1335                     break;
1336                 case HV_X64_MSR_REENLIGHTENMENT_CONTROL:
1337                     has_msr_hv_reenlightenment = true;
1338                     break;
1339                 case MSR_IA32_SPEC_CTRL:
1340                     has_msr_spec_ctrl = true;
1341                     break;
1342                 case MSR_VIRT_SSBD:
1343                     has_msr_virt_ssbd = true;
1344                     break;
1345                 }
1346             }
1347         }
1348
1349         g_free(kvm_msr_list);
1350     }
1351
1352     return ret;
1353 }
1354
1355 static Notifier smram_machine_done;
1356 static KVMMemoryListener smram_listener;
1357 static AddressSpace smram_address_space;
1358 static MemoryRegion smram_as_root;
1359 static MemoryRegion smram_as_mem;
1360
1361 static void register_smram_listener(Notifier *n, void *unused)
1362 {
1363     MemoryRegion *smram =
1364         (MemoryRegion *) object_resolve_path("/machine/smram", NULL);
1365
1366     /* Outer container... */
1367     memory_region_init(&smram_as_root, OBJECT(kvm_state), "mem-container-smram", ~0ull);
1368     memory_region_set_enabled(&smram_as_root, true);
1369
1370     /* ... with two regions inside: normal system memory with low
1371      * priority, and...
1372      */
1373     memory_region_init_alias(&smram_as_mem, OBJECT(kvm_state), "mem-smram",
1374                              get_system_memory(), 0, ~0ull);
1375     memory_region_add_subregion_overlap(&smram_as_root, 0, &smram_as_mem, 0);
1376     memory_region_set_enabled(&smram_as_mem, true);
1377
1378     if (smram) {
1379         /* ... SMRAM with higher priority */
1380         memory_region_add_subregion_overlap(&smram_as_root, 0, smram, 10);
1381         memory_region_set_enabled(smram, true);
1382     }
1383
1384     address_space_init(&smram_address_space, &smram_as_root, "KVM-SMRAM");
1385     kvm_memory_listener_register(kvm_state, &smram_listener,
1386                                  &smram_address_space, 1);
1387 }
1388
1389 int kvm_arch_init(MachineState *ms, KVMState *s)
1390 {
1391     uint64_t identity_base = 0xfffbc000;
1392     uint64_t shadow_mem;
1393     int ret;
1394     struct utsname utsname;
1395
1396     has_xsave = kvm_check_extension(s, KVM_CAP_XSAVE);
1397     has_xcrs = kvm_check_extension(s, KVM_CAP_XCRS);
1398     has_pit_state2 = kvm_check_extension(s, KVM_CAP_PIT_STATE2);
1399
1400     hv_vpindex_settable = kvm_check_extension(s, KVM_CAP_HYPERV_VP_INDEX);
1401
1402     ret = kvm_get_supported_msrs(s);
1403     if (ret < 0) {
1404         return ret;
1405     }
1406
1407     uname(&utsname);
1408     lm_capable_kernel = strcmp(utsname.machine, "x86_64") == 0;
1409
1410     /*
1411      * On older Intel CPUs, KVM uses vm86 mode to emulate 16-bit code directly.
1412      * In order to use vm86 mode, an EPT identity map and a TSS  are needed.
1413      * Since these must be part of guest physical memory, we need to allocate
1414      * them, both by setting their start addresses in the kernel and by
1415      * creating a corresponding e820 entry. We need 4 pages before the BIOS.
1416      *
1417      * Older KVM versions may not support setting the identity map base. In
1418      * that case we need to stick with the default, i.e. a 256K maximum BIOS
1419      * size.
1420      */
1421     if (kvm_check_extension(s, KVM_CAP_SET_IDENTITY_MAP_ADDR)) {
1422         /* Allows up to 16M BIOSes. */
1423         identity_base = 0xfeffc000;
1424
1425         ret = kvm_vm_ioctl(s, KVM_SET_IDENTITY_MAP_ADDR, &identity_base);
1426         if (ret < 0) {
1427             return ret;
1428         }
1429     }
1430
1431     /* Set TSS base one page after EPT identity map. */
1432     ret = kvm_vm_ioctl(s, KVM_SET_TSS_ADDR, identity_base + 0x1000);
1433     if (ret < 0) {
1434         return ret;
1435     }
1436
1437     /* Tell fw_cfg to notify the BIOS to reserve the range. */
1438     ret = e820_add_entry(identity_base, 0x4000, E820_RESERVED);
1439     if (ret < 0) {
1440         fprintf(stderr, "e820_add_entry() table is full\n");
1441         return ret;
1442     }
1443     qemu_register_reset(kvm_unpoison_all, NULL);
1444
1445     shadow_mem = machine_kvm_shadow_mem(ms);
1446     if (shadow_mem != -1) {
1447         shadow_mem /= 4096;
1448         ret = kvm_vm_ioctl(s, KVM_SET_NR_MMU_PAGES, shadow_mem);
1449         if (ret < 0) {
1450             return ret;
1451         }
1452     }
1453
1454     if (kvm_check_extension(s, KVM_CAP_X86_SMM) &&
1455         object_dynamic_cast(OBJECT(ms), TYPE_PC_MACHINE) &&
1456         pc_machine_is_smm_enabled(PC_MACHINE(ms))) {
1457         smram_machine_done.notify = register_smram_listener;
1458         qemu_add_machine_init_done_notifier(&smram_machine_done);
1459     }
1460
1461     if (enable_cpu_pm) {
1462         int disable_exits = kvm_check_extension(s, KVM_CAP_X86_DISABLE_EXITS);
1463         int ret;
1464
1465 /* Work around for kernel header with a typo. TODO: fix header and drop. */
1466 #if defined(KVM_X86_DISABLE_EXITS_HTL) && !defined(KVM_X86_DISABLE_EXITS_HLT)
1467 #define KVM_X86_DISABLE_EXITS_HLT KVM_X86_DISABLE_EXITS_HTL
1468 #endif
1469         if (disable_exits) {
1470             disable_exits &= (KVM_X86_DISABLE_EXITS_MWAIT |
1471                               KVM_X86_DISABLE_EXITS_HLT |
1472                               KVM_X86_DISABLE_EXITS_PAUSE);
1473         }
1474
1475         ret = kvm_vm_enable_cap(s, KVM_CAP_X86_DISABLE_EXITS, 0,
1476                                 disable_exits);
1477         if (ret < 0) {
1478             error_report("kvm: guest stopping CPU not supported: %s",
1479                          strerror(-ret));
1480         }
1481     }
1482
1483     return 0;
1484 }
1485
1486 static void set_v8086_seg(struct kvm_segment *lhs, const SegmentCache *rhs)
1487 {
1488     lhs->selector = rhs->selector;
1489     lhs->base = rhs->base;
1490     lhs->limit = rhs->limit;
1491     lhs->type = 3;
1492     lhs->present = 1;
1493     lhs->dpl = 3;
1494     lhs->db = 0;
1495     lhs->s = 1;
1496     lhs->l = 0;
1497     lhs->g = 0;
1498     lhs->avl = 0;
1499     lhs->unusable = 0;
1500 }
1501
1502 static void set_seg(struct kvm_segment *lhs, const SegmentCache *rhs)
1503 {
1504     unsigned flags = rhs->flags;
1505     lhs->selector = rhs->selector;
1506     lhs->base = rhs->base;
1507     lhs->limit = rhs->limit;
1508     lhs->type = (flags >> DESC_TYPE_SHIFT) & 15;
1509     lhs->present = (flags & DESC_P_MASK) != 0;
1510     lhs->dpl = (flags >> DESC_DPL_SHIFT) & 3;
1511     lhs->db = (flags >> DESC_B_SHIFT) & 1;
1512     lhs->s = (flags & DESC_S_MASK) != 0;
1513     lhs->l = (flags >> DESC_L_SHIFT) & 1;
1514     lhs->g = (flags & DESC_G_MASK) != 0;
1515     lhs->avl = (flags & DESC_AVL_MASK) != 0;
1516     lhs->unusable = !lhs->present;
1517     lhs->padding = 0;
1518 }
1519
1520 static void get_seg(SegmentCache *lhs, const struct kvm_segment *rhs)
1521 {
1522     lhs->selector = rhs->selector;
1523     lhs->base = rhs->base;
1524     lhs->limit = rhs->limit;
1525     lhs->flags = (rhs->type << DESC_TYPE_SHIFT) |
1526                  ((rhs->present && !rhs->unusable) * DESC_P_MASK) |
1527                  (rhs->dpl << DESC_DPL_SHIFT) |
1528                  (rhs->db << DESC_B_SHIFT) |
1529                  (rhs->s * DESC_S_MASK) |
1530                  (rhs->l << DESC_L_SHIFT) |
1531                  (rhs->g * DESC_G_MASK) |
1532                  (rhs->avl * DESC_AVL_MASK);
1533 }
1534
1535 static void kvm_getput_reg(__u64 *kvm_reg, target_ulong *qemu_reg, int set)
1536 {
1537     if (set) {
1538         *kvm_reg = *qemu_reg;
1539     } else {
1540         *qemu_reg = *kvm_reg;
1541     }
1542 }
1543
1544 static int kvm_getput_regs(X86CPU *cpu, int set)
1545 {
1546     CPUX86State *env = &cpu->env;
1547     struct kvm_regs regs;
1548     int ret = 0;
1549
1550     if (!set) {
1551         ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_REGS, &regs);
1552         if (ret < 0) {
1553             return ret;
1554         }
1555     }
1556
1557     kvm_getput_reg(&regs.rax, &env->regs[R_EAX], set);
1558     kvm_getput_reg(&regs.rbx, &env->regs[R_EBX], set);
1559     kvm_getput_reg(&regs.rcx, &env->regs[R_ECX], set);
1560     kvm_getput_reg(&regs.rdx, &env->regs[R_EDX], set);
1561     kvm_getput_reg(&regs.rsi, &env->regs[R_ESI], set);
1562     kvm_getput_reg(&regs.rdi, &env->regs[R_EDI], set);
1563     kvm_getput_reg(&regs.rsp, &env->regs[R_ESP], set);
1564     kvm_getput_reg(&regs.rbp, &env->regs[R_EBP], set);
1565 #ifdef TARGET_X86_64
1566     kvm_getput_reg(&regs.r8, &env->regs[8], set);
1567     kvm_getput_reg(&regs.r9, &env->regs[9], set);
1568     kvm_getput_reg(&regs.r10, &env->regs[10], set);
1569     kvm_getput_reg(&regs.r11, &env->regs[11], set);
1570     kvm_getput_reg(&regs.r12, &env->regs[12], set);
1571     kvm_getput_reg(&regs.r13, &env->regs[13], set);
1572     kvm_getput_reg(&regs.r14, &env->regs[14], set);
1573     kvm_getput_reg(&regs.r15, &env->regs[15], set);
1574 #endif
1575
1576     kvm_getput_reg(&regs.rflags, &env->eflags, set);
1577     kvm_getput_reg(&regs.rip, &env->eip, set);
1578
1579     if (set) {
1580         ret = kvm_vcpu_ioctl(CPU(cpu), KVM_SET_REGS, &regs);
1581     }
1582
1583     return ret;
1584 }
1585
1586 static int kvm_put_fpu(X86CPU *cpu)
1587 {
1588     CPUX86State *env = &cpu->env;
1589     struct kvm_fpu fpu;
1590     int i;
1591
1592     memset(&fpu, 0, sizeof fpu);
1593     fpu.fsw = env->fpus & ~(7 << 11);
1594     fpu.fsw |= (env->fpstt & 7) << 11;
1595     fpu.fcw = env->fpuc;
1596     fpu.last_opcode = env->fpop;
1597     fpu.last_ip = env->fpip;
1598     fpu.last_dp = env->fpdp;
1599     for (i = 0; i < 8; ++i) {
1600         fpu.ftwx |= (!env->fptags[i]) << i;
1601     }
1602     memcpy(fpu.fpr, env->fpregs, sizeof env->fpregs);
1603     for (i = 0; i < CPU_NB_REGS; i++) {
1604         stq_p(&fpu.xmm[i][0], env->xmm_regs[i].ZMM_Q(0));
1605         stq_p(&fpu.xmm[i][8], env->xmm_regs[i].ZMM_Q(1));
1606     }
1607     fpu.mxcsr = env->mxcsr;
1608
1609     return kvm_vcpu_ioctl(CPU(cpu), KVM_SET_FPU, &fpu);
1610 }
1611
1612 #define XSAVE_FCW_FSW     0
1613 #define XSAVE_FTW_FOP     1
1614 #define XSAVE_CWD_RIP     2
1615 #define XSAVE_CWD_RDP     4
1616 #define XSAVE_MXCSR       6
1617 #define XSAVE_ST_SPACE    8
1618 #define XSAVE_XMM_SPACE   40
1619 #define XSAVE_XSTATE_BV   128
1620 #define XSAVE_YMMH_SPACE  144
1621 #define XSAVE_BNDREGS     240
1622 #define XSAVE_BNDCSR      256
1623 #define XSAVE_OPMASK      272
1624 #define XSAVE_ZMM_Hi256   288
1625 #define XSAVE_Hi16_ZMM    416
1626 #define XSAVE_PKRU        672
1627
1628 #define XSAVE_BYTE_OFFSET(word_offset) \
1629     ((word_offset) * sizeof_field(struct kvm_xsave, region[0]))
1630
1631 #define ASSERT_OFFSET(word_offset, field) \
1632     QEMU_BUILD_BUG_ON(XSAVE_BYTE_OFFSET(word_offset) != \
1633                       offsetof(X86XSaveArea, field))
1634
1635 ASSERT_OFFSET(XSAVE_FCW_FSW, legacy.fcw);
1636 ASSERT_OFFSET(XSAVE_FTW_FOP, legacy.ftw);
1637 ASSERT_OFFSET(XSAVE_CWD_RIP, legacy.fpip);
1638 ASSERT_OFFSET(XSAVE_CWD_RDP, legacy.fpdp);
1639 ASSERT_OFFSET(XSAVE_MXCSR, legacy.mxcsr);
1640 ASSERT_OFFSET(XSAVE_ST_SPACE, legacy.fpregs);
1641 ASSERT_OFFSET(XSAVE_XMM_SPACE, legacy.xmm_regs);
1642 ASSERT_OFFSET(XSAVE_XSTATE_BV, header.xstate_bv);
1643 ASSERT_OFFSET(XSAVE_YMMH_SPACE, avx_state);
1644 ASSERT_OFFSET(XSAVE_BNDREGS, bndreg_state);
1645 ASSERT_OFFSET(XSAVE_BNDCSR, bndcsr_state);
1646 ASSERT_OFFSET(XSAVE_OPMASK, opmask_state);
1647 ASSERT_OFFSET(XSAVE_ZMM_Hi256, zmm_hi256_state);
1648 ASSERT_OFFSET(XSAVE_Hi16_ZMM, hi16_zmm_state);
1649 ASSERT_OFFSET(XSAVE_PKRU, pkru_state);
1650
1651 static int kvm_put_xsave(X86CPU *cpu)
1652 {
1653     CPUX86State *env = &cpu->env;
1654     X86XSaveArea *xsave = env->xsave_buf;
1655
1656     if (!has_xsave) {
1657         return kvm_put_fpu(cpu);
1658     }
1659     x86_cpu_xsave_all_areas(cpu, xsave);
1660
1661     return kvm_vcpu_ioctl(CPU(cpu), KVM_SET_XSAVE, xsave);
1662 }
1663
1664 static int kvm_put_xcrs(X86CPU *cpu)
1665 {
1666     CPUX86State *env = &cpu->env;
1667     struct kvm_xcrs xcrs = {};
1668
1669     if (!has_xcrs) {
1670         return 0;
1671     }
1672
1673     xcrs.nr_xcrs = 1;
1674     xcrs.flags = 0;
1675     xcrs.xcrs[0].xcr = 0;
1676     xcrs.xcrs[0].value = env->xcr0;
1677     return kvm_vcpu_ioctl(CPU(cpu), KVM_SET_XCRS, &xcrs);
1678 }
1679
1680 static int kvm_put_sregs(X86CPU *cpu)
1681 {
1682     CPUX86State *env = &cpu->env;
1683     struct kvm_sregs sregs;
1684
1685     memset(sregs.interrupt_bitmap, 0, sizeof(sregs.interrupt_bitmap));
1686     if (env->interrupt_injected >= 0) {
1687         sregs.interrupt_bitmap[env->interrupt_injected / 64] |=
1688                 (uint64_t)1 << (env->interrupt_injected % 64);
1689     }
1690
1691     if ((env->eflags & VM_MASK)) {
1692         set_v8086_seg(&sregs.cs, &env->segs[R_CS]);
1693         set_v8086_seg(&sregs.ds, &env->segs[R_DS]);
1694         set_v8086_seg(&sregs.es, &env->segs[R_ES]);
1695         set_v8086_seg(&sregs.fs, &env->segs[R_FS]);
1696         set_v8086_seg(&sregs.gs, &env->segs[R_GS]);
1697         set_v8086_seg(&sregs.ss, &env->segs[R_SS]);
1698     } else {
1699         set_seg(&sregs.cs, &env->segs[R_CS]);
1700         set_seg(&sregs.ds, &env->segs[R_DS]);
1701         set_seg(&sregs.es, &env->segs[R_ES]);
1702         set_seg(&sregs.fs, &env->segs[R_FS]);
1703         set_seg(&sregs.gs, &env->segs[R_GS]);
1704         set_seg(&sregs.ss, &env->segs[R_SS]);
1705     }
1706
1707     set_seg(&sregs.tr, &env->tr);
1708     set_seg(&sregs.ldt, &env->ldt);
1709
1710     sregs.idt.limit = env->idt.limit;
1711     sregs.idt.base = env->idt.base;
1712     memset(sregs.idt.padding, 0, sizeof sregs.idt.padding);
1713     sregs.gdt.limit = env->gdt.limit;
1714     sregs.gdt.base = env->gdt.base;
1715     memset(sregs.gdt.padding, 0, sizeof sregs.gdt.padding);
1716
1717     sregs.cr0 = env->cr[0];
1718     sregs.cr2 = env->cr[2];
1719     sregs.cr3 = env->cr[3];
1720     sregs.cr4 = env->cr[4];
1721
1722     sregs.cr8 = cpu_get_apic_tpr(cpu->apic_state);
1723     sregs.apic_base = cpu_get_apic_base(cpu->apic_state);
1724
1725     sregs.efer = env->efer;
1726
1727     return kvm_vcpu_ioctl(CPU(cpu), KVM_SET_SREGS, &sregs);
1728 }
1729
1730 static void kvm_msr_buf_reset(X86CPU *cpu)
1731 {
1732     memset(cpu->kvm_msr_buf, 0, MSR_BUF_SIZE);
1733 }
1734
1735 static void kvm_msr_entry_add(X86CPU *cpu, uint32_t index, uint64_t value)
1736 {
1737     struct kvm_msrs *msrs = cpu->kvm_msr_buf;
1738     void *limit = ((void *)msrs) + MSR_BUF_SIZE;
1739     struct kvm_msr_entry *entry = &msrs->entries[msrs->nmsrs];
1740
1741     assert((void *)(entry + 1) <= limit);
1742
1743     entry->index = index;
1744     entry->reserved = 0;
1745     entry->data = value;
1746     msrs->nmsrs++;
1747 }
1748
1749 static int kvm_put_one_msr(X86CPU *cpu, int index, uint64_t value)
1750 {
1751     kvm_msr_buf_reset(cpu);
1752     kvm_msr_entry_add(cpu, index, value);
1753
1754     return kvm_vcpu_ioctl(CPU(cpu), KVM_SET_MSRS, cpu->kvm_msr_buf);
1755 }
1756
1757 void kvm_put_apicbase(X86CPU *cpu, uint64_t value)
1758 {
1759     int ret;
1760
1761     ret = kvm_put_one_msr(cpu, MSR_IA32_APICBASE, value);
1762     assert(ret == 1);
1763 }
1764
1765 static int kvm_put_tscdeadline_msr(X86CPU *cpu)
1766 {
1767     CPUX86State *env = &cpu->env;
1768     int ret;
1769
1770     if (!has_msr_tsc_deadline) {
1771         return 0;
1772     }
1773
1774     ret = kvm_put_one_msr(cpu, MSR_IA32_TSCDEADLINE, env->tsc_deadline);
1775     if (ret < 0) {
1776         return ret;
1777     }
1778
1779     assert(ret == 1);
1780     return 0;
1781 }
1782
1783 /*
1784  * Provide a separate write service for the feature control MSR in order to
1785  * kick the VCPU out of VMXON or even guest mode on reset. This has to be done
1786  * before writing any other state because forcibly leaving nested mode
1787  * invalidates the VCPU state.
1788  */
1789 static int kvm_put_msr_feature_control(X86CPU *cpu)
1790 {
1791     int ret;
1792
1793     if (!has_msr_feature_control) {
1794         return 0;
1795     }
1796
1797     ret = kvm_put_one_msr(cpu, MSR_IA32_FEATURE_CONTROL,
1798                           cpu->env.msr_ia32_feature_control);
1799     if (ret < 0) {
1800         return ret;
1801     }
1802
1803     assert(ret == 1);
1804     return 0;
1805 }
1806
1807 static int kvm_put_msrs(X86CPU *cpu, int level)
1808 {
1809     CPUX86State *env = &cpu->env;
1810     int i;
1811     int ret;
1812
1813     kvm_msr_buf_reset(cpu);
1814
1815     kvm_msr_entry_add(cpu, MSR_IA32_SYSENTER_CS, env->sysenter_cs);
1816     kvm_msr_entry_add(cpu, MSR_IA32_SYSENTER_ESP, env->sysenter_esp);
1817     kvm_msr_entry_add(cpu, MSR_IA32_SYSENTER_EIP, env->sysenter_eip);
1818     kvm_msr_entry_add(cpu, MSR_PAT, env->pat);
1819     if (has_msr_star) {
1820         kvm_msr_entry_add(cpu, MSR_STAR, env->star);
1821     }
1822     if (has_msr_hsave_pa) {
1823         kvm_msr_entry_add(cpu, MSR_VM_HSAVE_PA, env->vm_hsave);
1824     }
1825     if (has_msr_tsc_aux) {
1826         kvm_msr_entry_add(cpu, MSR_TSC_AUX, env->tsc_aux);
1827     }
1828     if (has_msr_tsc_adjust) {
1829         kvm_msr_entry_add(cpu, MSR_TSC_ADJUST, env->tsc_adjust);
1830     }
1831     if (has_msr_misc_enable) {
1832         kvm_msr_entry_add(cpu, MSR_IA32_MISC_ENABLE,
1833                           env->msr_ia32_misc_enable);
1834     }
1835     if (has_msr_smbase) {
1836         kvm_msr_entry_add(cpu, MSR_IA32_SMBASE, env->smbase);
1837     }
1838     if (has_msr_smi_count) {
1839         kvm_msr_entry_add(cpu, MSR_SMI_COUNT, env->msr_smi_count);
1840     }
1841     if (has_msr_bndcfgs) {
1842         kvm_msr_entry_add(cpu, MSR_IA32_BNDCFGS, env->msr_bndcfgs);
1843     }
1844     if (has_msr_xss) {
1845         kvm_msr_entry_add(cpu, MSR_IA32_XSS, env->xss);
1846     }
1847     if (has_msr_spec_ctrl) {
1848         kvm_msr_entry_add(cpu, MSR_IA32_SPEC_CTRL, env->spec_ctrl);
1849     }
1850     if (has_msr_virt_ssbd) {
1851         kvm_msr_entry_add(cpu, MSR_VIRT_SSBD, env->virt_ssbd);
1852     }
1853
1854 #ifdef TARGET_X86_64
1855     if (lm_capable_kernel) {
1856         kvm_msr_entry_add(cpu, MSR_CSTAR, env->cstar);
1857         kvm_msr_entry_add(cpu, MSR_KERNELGSBASE, env->kernelgsbase);
1858         kvm_msr_entry_add(cpu, MSR_FMASK, env->fmask);
1859         kvm_msr_entry_add(cpu, MSR_LSTAR, env->lstar);
1860     }
1861 #endif
1862
1863     /*
1864      * The following MSRs have side effects on the guest or are too heavy
1865      * for normal writeback. Limit them to reset or full state updates.
1866      */
1867     if (level >= KVM_PUT_RESET_STATE) {
1868         kvm_msr_entry_add(cpu, MSR_IA32_TSC, env->tsc);
1869         kvm_msr_entry_add(cpu, MSR_KVM_SYSTEM_TIME, env->system_time_msr);
1870         kvm_msr_entry_add(cpu, MSR_KVM_WALL_CLOCK, env->wall_clock_msr);
1871         if (env->features[FEAT_KVM] & (1 << KVM_FEATURE_ASYNC_PF)) {
1872             kvm_msr_entry_add(cpu, MSR_KVM_ASYNC_PF_EN, env->async_pf_en_msr);
1873         }
1874         if (env->features[FEAT_KVM] & (1 << KVM_FEATURE_PV_EOI)) {
1875             kvm_msr_entry_add(cpu, MSR_KVM_PV_EOI_EN, env->pv_eoi_en_msr);
1876         }
1877         if (env->features[FEAT_KVM] & (1 << KVM_FEATURE_STEAL_TIME)) {
1878             kvm_msr_entry_add(cpu, MSR_KVM_STEAL_TIME, env->steal_time_msr);
1879         }
1880         if (has_architectural_pmu_version > 0) {
1881             if (has_architectural_pmu_version > 1) {
1882                 /* Stop the counter.  */
1883                 kvm_msr_entry_add(cpu, MSR_CORE_PERF_FIXED_CTR_CTRL, 0);
1884                 kvm_msr_entry_add(cpu, MSR_CORE_PERF_GLOBAL_CTRL, 0);
1885             }
1886
1887             /* Set the counter values.  */
1888             for (i = 0; i < num_architectural_pmu_fixed_counters; i++) {
1889                 kvm_msr_entry_add(cpu, MSR_CORE_PERF_FIXED_CTR0 + i,
1890                                   env->msr_fixed_counters[i]);
1891             }
1892             for (i = 0; i < num_architectural_pmu_gp_counters; i++) {
1893                 kvm_msr_entry_add(cpu, MSR_P6_PERFCTR0 + i,
1894                                   env->msr_gp_counters[i]);
1895                 kvm_msr_entry_add(cpu, MSR_P6_EVNTSEL0 + i,
1896                                   env->msr_gp_evtsel[i]);
1897             }
1898             if (has_architectural_pmu_version > 1) {
1899                 kvm_msr_entry_add(cpu, MSR_CORE_PERF_GLOBAL_STATUS,
1900                                   env->msr_global_status);
1901                 kvm_msr_entry_add(cpu, MSR_CORE_PERF_GLOBAL_OVF_CTRL,
1902                                   env->msr_global_ovf_ctrl);
1903
1904                 /* Now start the PMU.  */
1905                 kvm_msr_entry_add(cpu, MSR_CORE_PERF_FIXED_CTR_CTRL,
1906                                   env->msr_fixed_ctr_ctrl);
1907                 kvm_msr_entry_add(cpu, MSR_CORE_PERF_GLOBAL_CTRL,
1908                                   env->msr_global_ctrl);
1909             }
1910         }
1911         /*
1912          * Hyper-V partition-wide MSRs: to avoid clearing them on cpu hot-add,
1913          * only sync them to KVM on the first cpu
1914          */
1915         if (current_cpu == first_cpu) {
1916             if (has_msr_hv_hypercall) {
1917                 kvm_msr_entry_add(cpu, HV_X64_MSR_GUEST_OS_ID,
1918                                   env->msr_hv_guest_os_id);
1919                 kvm_msr_entry_add(cpu, HV_X64_MSR_HYPERCALL,
1920                                   env->msr_hv_hypercall);
1921             }
1922             if (cpu->hyperv_time) {
1923                 kvm_msr_entry_add(cpu, HV_X64_MSR_REFERENCE_TSC,
1924                                   env->msr_hv_tsc);
1925             }
1926             if (cpu->hyperv_reenlightenment) {
1927                 kvm_msr_entry_add(cpu, HV_X64_MSR_REENLIGHTENMENT_CONTROL,
1928                                   env->msr_hv_reenlightenment_control);
1929                 kvm_msr_entry_add(cpu, HV_X64_MSR_TSC_EMULATION_CONTROL,
1930                                   env->msr_hv_tsc_emulation_control);
1931                 kvm_msr_entry_add(cpu, HV_X64_MSR_TSC_EMULATION_STATUS,
1932                                   env->msr_hv_tsc_emulation_status);
1933             }
1934         }
1935         if (cpu->hyperv_vapic) {
1936             kvm_msr_entry_add(cpu, HV_X64_MSR_APIC_ASSIST_PAGE,
1937                               env->msr_hv_vapic);
1938         }
1939         if (has_msr_hv_crash) {
1940             int j;
1941
1942             for (j = 0; j < HV_CRASH_PARAMS; j++)
1943                 kvm_msr_entry_add(cpu, HV_X64_MSR_CRASH_P0 + j,
1944                                   env->msr_hv_crash_params[j]);
1945
1946             kvm_msr_entry_add(cpu, HV_X64_MSR_CRASH_CTL, HV_CRASH_CTL_NOTIFY);
1947         }
1948         if (has_msr_hv_runtime) {
1949             kvm_msr_entry_add(cpu, HV_X64_MSR_VP_RUNTIME, env->msr_hv_runtime);
1950         }
1951         if (cpu->hyperv_vpindex && hv_vpindex_settable) {
1952             kvm_msr_entry_add(cpu, HV_X64_MSR_VP_INDEX,
1953                               hyperv_vp_index(CPU(cpu)));
1954         }
1955         if (cpu->hyperv_synic) {
1956             int j;
1957
1958             kvm_msr_entry_add(cpu, HV_X64_MSR_SVERSION, HV_SYNIC_VERSION);
1959
1960             kvm_msr_entry_add(cpu, HV_X64_MSR_SCONTROL,
1961                               env->msr_hv_synic_control);
1962             kvm_msr_entry_add(cpu, HV_X64_MSR_SIEFP,
1963                               env->msr_hv_synic_evt_page);
1964             kvm_msr_entry_add(cpu, HV_X64_MSR_SIMP,
1965                               env->msr_hv_synic_msg_page);
1966
1967             for (j = 0; j < ARRAY_SIZE(env->msr_hv_synic_sint); j++) {
1968                 kvm_msr_entry_add(cpu, HV_X64_MSR_SINT0 + j,
1969                                   env->msr_hv_synic_sint[j]);
1970             }
1971         }
1972         if (has_msr_hv_stimer) {
1973             int j;
1974
1975             for (j = 0; j < ARRAY_SIZE(env->msr_hv_stimer_config); j++) {
1976                 kvm_msr_entry_add(cpu, HV_X64_MSR_STIMER0_CONFIG + j * 2,
1977                                 env->msr_hv_stimer_config[j]);
1978             }
1979
1980             for (j = 0; j < ARRAY_SIZE(env->msr_hv_stimer_count); j++) {
1981                 kvm_msr_entry_add(cpu, HV_X64_MSR_STIMER0_COUNT + j * 2,
1982                                 env->msr_hv_stimer_count[j]);
1983             }
1984         }
1985         if (env->features[FEAT_1_EDX] & CPUID_MTRR) {
1986             uint64_t phys_mask = MAKE_64BIT_MASK(0, cpu->phys_bits);
1987
1988             kvm_msr_entry_add(cpu, MSR_MTRRdefType, env->mtrr_deftype);
1989             kvm_msr_entry_add(cpu, MSR_MTRRfix64K_00000, env->mtrr_fixed[0]);
1990             kvm_msr_entry_add(cpu, MSR_MTRRfix16K_80000, env->mtrr_fixed[1]);
1991             kvm_msr_entry_add(cpu, MSR_MTRRfix16K_A0000, env->mtrr_fixed[2]);
1992             kvm_msr_entry_add(cpu, MSR_MTRRfix4K_C0000, env->mtrr_fixed[3]);
1993             kvm_msr_entry_add(cpu, MSR_MTRRfix4K_C8000, env->mtrr_fixed[4]);
1994             kvm_msr_entry_add(cpu, MSR_MTRRfix4K_D0000, env->mtrr_fixed[5]);
1995             kvm_msr_entry_add(cpu, MSR_MTRRfix4K_D8000, env->mtrr_fixed[6]);
1996             kvm_msr_entry_add(cpu, MSR_MTRRfix4K_E0000, env->mtrr_fixed[7]);
1997             kvm_msr_entry_add(cpu, MSR_MTRRfix4K_E8000, env->mtrr_fixed[8]);
1998             kvm_msr_entry_add(cpu, MSR_MTRRfix4K_F0000, env->mtrr_fixed[9]);
1999             kvm_msr_entry_add(cpu, MSR_MTRRfix4K_F8000, env->mtrr_fixed[10]);
2000             for (i = 0; i < MSR_MTRRcap_VCNT; i++) {
2001                 /* The CPU GPs if we write to a bit above the physical limit of
2002                  * the host CPU (and KVM emulates that)
2003                  */
2004                 uint64_t mask = env->mtrr_var[i].mask;
2005                 mask &= phys_mask;
2006
2007                 kvm_msr_entry_add(cpu, MSR_MTRRphysBase(i),
2008                                   env->mtrr_var[i].base);
2009                 kvm_msr_entry_add(cpu, MSR_MTRRphysMask(i), mask);
2010             }
2011         }
2012         if (env->features[FEAT_7_0_EBX] & CPUID_7_0_EBX_INTEL_PT) {
2013             int addr_num = kvm_arch_get_supported_cpuid(kvm_state,
2014                                                     0x14, 1, R_EAX) & 0x7;
2015
2016             kvm_msr_entry_add(cpu, MSR_IA32_RTIT_CTL,
2017                             env->msr_rtit_ctrl);
2018             kvm_msr_entry_add(cpu, MSR_IA32_RTIT_STATUS,
2019                             env->msr_rtit_status);
2020             kvm_msr_entry_add(cpu, MSR_IA32_RTIT_OUTPUT_BASE,
2021                             env->msr_rtit_output_base);
2022             kvm_msr_entry_add(cpu, MSR_IA32_RTIT_OUTPUT_MASK,
2023                             env->msr_rtit_output_mask);
2024             kvm_msr_entry_add(cpu, MSR_IA32_RTIT_CR3_MATCH,
2025                             env->msr_rtit_cr3_match);
2026             for (i = 0; i < addr_num; i++) {
2027                 kvm_msr_entry_add(cpu, MSR_IA32_RTIT_ADDR0_A + i,
2028                             env->msr_rtit_addrs[i]);
2029             }
2030         }
2031
2032         /* Note: MSR_IA32_FEATURE_CONTROL is written separately, see
2033          *       kvm_put_msr_feature_control. */
2034     }
2035     if (env->mcg_cap) {
2036         int i;
2037
2038         kvm_msr_entry_add(cpu, MSR_MCG_STATUS, env->mcg_status);
2039         kvm_msr_entry_add(cpu, MSR_MCG_CTL, env->mcg_ctl);
2040         if (has_msr_mcg_ext_ctl) {
2041             kvm_msr_entry_add(cpu, MSR_MCG_EXT_CTL, env->mcg_ext_ctl);
2042         }
2043         for (i = 0; i < (env->mcg_cap & 0xff) * 4; i++) {
2044             kvm_msr_entry_add(cpu, MSR_MC0_CTL + i, env->mce_banks[i]);
2045         }
2046     }
2047
2048     ret = kvm_vcpu_ioctl(CPU(cpu), KVM_SET_MSRS, cpu->kvm_msr_buf);
2049     if (ret < 0) {
2050         return ret;
2051     }
2052
2053     if (ret < cpu->kvm_msr_buf->nmsrs) {
2054         struct kvm_msr_entry *e = &cpu->kvm_msr_buf->entries[ret];
2055         error_report("error: failed to set MSR 0x%" PRIx32 " to 0x%" PRIx64,
2056                      (uint32_t)e->index, (uint64_t)e->data);
2057     }
2058
2059     assert(ret == cpu->kvm_msr_buf->nmsrs);
2060     return 0;
2061 }
2062
2063
2064 static int kvm_get_fpu(X86CPU *cpu)
2065 {
2066     CPUX86State *env = &cpu->env;
2067     struct kvm_fpu fpu;
2068     int i, ret;
2069
2070     ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_FPU, &fpu);
2071     if (ret < 0) {
2072         return ret;
2073     }
2074
2075     env->fpstt = (fpu.fsw >> 11) & 7;
2076     env->fpus = fpu.fsw;
2077     env->fpuc = fpu.fcw;
2078     env->fpop = fpu.last_opcode;
2079     env->fpip = fpu.last_ip;
2080     env->fpdp = fpu.last_dp;
2081     for (i = 0; i < 8; ++i) {
2082         env->fptags[i] = !((fpu.ftwx >> i) & 1);
2083     }
2084     memcpy(env->fpregs, fpu.fpr, sizeof env->fpregs);
2085     for (i = 0; i < CPU_NB_REGS; i++) {
2086         env->xmm_regs[i].ZMM_Q(0) = ldq_p(&fpu.xmm[i][0]);
2087         env->xmm_regs[i].ZMM_Q(1) = ldq_p(&fpu.xmm[i][8]);
2088     }
2089     env->mxcsr = fpu.mxcsr;
2090
2091     return 0;
2092 }
2093
2094 static int kvm_get_xsave(X86CPU *cpu)
2095 {
2096     CPUX86State *env = &cpu->env;
2097     X86XSaveArea *xsave = env->xsave_buf;
2098     int ret;
2099
2100     if (!has_xsave) {
2101         return kvm_get_fpu(cpu);
2102     }
2103
2104     ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_XSAVE, xsave);
2105     if (ret < 0) {
2106         return ret;
2107     }
2108     x86_cpu_xrstor_all_areas(cpu, xsave);
2109
2110     return 0;
2111 }
2112
2113 static int kvm_get_xcrs(X86CPU *cpu)
2114 {
2115     CPUX86State *env = &cpu->env;
2116     int i, ret;
2117     struct kvm_xcrs xcrs;
2118
2119     if (!has_xcrs) {
2120         return 0;
2121     }
2122
2123     ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_XCRS, &xcrs);
2124     if (ret < 0) {
2125         return ret;
2126     }
2127
2128     for (i = 0; i < xcrs.nr_xcrs; i++) {
2129         /* Only support xcr0 now */
2130         if (xcrs.xcrs[i].xcr == 0) {
2131             env->xcr0 = xcrs.xcrs[i].value;
2132             break;
2133         }
2134     }
2135     return 0;
2136 }
2137
2138 static int kvm_get_sregs(X86CPU *cpu)
2139 {
2140     CPUX86State *env = &cpu->env;
2141     struct kvm_sregs sregs;
2142     int bit, i, ret;
2143
2144     ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_SREGS, &sregs);
2145     if (ret < 0) {
2146         return ret;
2147     }
2148
2149     /* There can only be one pending IRQ set in the bitmap at a time, so try
2150        to find it and save its number instead (-1 for none). */
2151     env->interrupt_injected = -1;
2152     for (i = 0; i < ARRAY_SIZE(sregs.interrupt_bitmap); i++) {
2153         if (sregs.interrupt_bitmap[i]) {
2154             bit = ctz64(sregs.interrupt_bitmap[i]);
2155             env->interrupt_injected = i * 64 + bit;
2156             break;
2157         }
2158     }
2159
2160     get_seg(&env->segs[R_CS], &sregs.cs);
2161     get_seg(&env->segs[R_DS], &sregs.ds);
2162     get_seg(&env->segs[R_ES], &sregs.es);
2163     get_seg(&env->segs[R_FS], &sregs.fs);
2164     get_seg(&env->segs[R_GS], &sregs.gs);
2165     get_seg(&env->segs[R_SS], &sregs.ss);
2166
2167     get_seg(&env->tr, &sregs.tr);
2168     get_seg(&env->ldt, &sregs.ldt);
2169
2170     env->idt.limit = sregs.idt.limit;
2171     env->idt.base = sregs.idt.base;
2172     env->gdt.limit = sregs.gdt.limit;
2173     env->gdt.base = sregs.gdt.base;
2174
2175     env->cr[0] = sregs.cr0;
2176     env->cr[2] = sregs.cr2;
2177     env->cr[3] = sregs.cr3;
2178     env->cr[4] = sregs.cr4;
2179
2180     env->efer = sregs.efer;
2181
2182     /* changes to apic base and cr8/tpr are read back via kvm_arch_post_run */
2183     x86_update_hflags(env);
2184
2185     return 0;
2186 }
2187
2188 static int kvm_get_msrs(X86CPU *cpu)
2189 {
2190     CPUX86State *env = &cpu->env;
2191     struct kvm_msr_entry *msrs = cpu->kvm_msr_buf->entries;
2192     int ret, i;
2193     uint64_t mtrr_top_bits;
2194
2195     kvm_msr_buf_reset(cpu);
2196
2197     kvm_msr_entry_add(cpu, MSR_IA32_SYSENTER_CS, 0);
2198     kvm_msr_entry_add(cpu, MSR_IA32_SYSENTER_ESP, 0);
2199     kvm_msr_entry_add(cpu, MSR_IA32_SYSENTER_EIP, 0);
2200     kvm_msr_entry_add(cpu, MSR_PAT, 0);
2201     if (has_msr_star) {
2202         kvm_msr_entry_add(cpu, MSR_STAR, 0);
2203     }
2204     if (has_msr_hsave_pa) {
2205         kvm_msr_entry_add(cpu, MSR_VM_HSAVE_PA, 0);
2206     }
2207     if (has_msr_tsc_aux) {
2208         kvm_msr_entry_add(cpu, MSR_TSC_AUX, 0);
2209     }
2210     if (has_msr_tsc_adjust) {
2211         kvm_msr_entry_add(cpu, MSR_TSC_ADJUST, 0);
2212     }
2213     if (has_msr_tsc_deadline) {
2214         kvm_msr_entry_add(cpu, MSR_IA32_TSCDEADLINE, 0);
2215     }
2216     if (has_msr_misc_enable) {
2217         kvm_msr_entry_add(cpu, MSR_IA32_MISC_ENABLE, 0);
2218     }
2219     if (has_msr_smbase) {
2220         kvm_msr_entry_add(cpu, MSR_IA32_SMBASE, 0);
2221     }
2222     if (has_msr_smi_count) {
2223         kvm_msr_entry_add(cpu, MSR_SMI_COUNT, 0);
2224     }
2225     if (has_msr_feature_control) {
2226         kvm_msr_entry_add(cpu, MSR_IA32_FEATURE_CONTROL, 0);
2227     }
2228     if (has_msr_bndcfgs) {
2229         kvm_msr_entry_add(cpu, MSR_IA32_BNDCFGS, 0);
2230     }
2231     if (has_msr_xss) {
2232         kvm_msr_entry_add(cpu, MSR_IA32_XSS, 0);
2233     }
2234     if (has_msr_spec_ctrl) {
2235         kvm_msr_entry_add(cpu, MSR_IA32_SPEC_CTRL, 0);
2236     }
2237     if (has_msr_virt_ssbd) {
2238         kvm_msr_entry_add(cpu, MSR_VIRT_SSBD, 0);
2239     }
2240     if (!env->tsc_valid) {
2241         kvm_msr_entry_add(cpu, MSR_IA32_TSC, 0);
2242         env->tsc_valid = !runstate_is_running();
2243     }
2244
2245 #ifdef TARGET_X86_64
2246     if (lm_capable_kernel) {
2247         kvm_msr_entry_add(cpu, MSR_CSTAR, 0);
2248         kvm_msr_entry_add(cpu, MSR_KERNELGSBASE, 0);
2249         kvm_msr_entry_add(cpu, MSR_FMASK, 0);
2250         kvm_msr_entry_add(cpu, MSR_LSTAR, 0);
2251     }
2252 #endif
2253     kvm_msr_entry_add(cpu, MSR_KVM_SYSTEM_TIME, 0);
2254     kvm_msr_entry_add(cpu, MSR_KVM_WALL_CLOCK, 0);
2255     if (env->features[FEAT_KVM] & (1 << KVM_FEATURE_ASYNC_PF)) {
2256         kvm_msr_entry_add(cpu, MSR_KVM_ASYNC_PF_EN, 0);
2257     }
2258     if (env->features[FEAT_KVM] & (1 << KVM_FEATURE_PV_EOI)) {
2259         kvm_msr_entry_add(cpu, MSR_KVM_PV_EOI_EN, 0);
2260     }
2261     if (env->features[FEAT_KVM] & (1 << KVM_FEATURE_STEAL_TIME)) {
2262         kvm_msr_entry_add(cpu, MSR_KVM_STEAL_TIME, 0);
2263     }
2264     if (has_architectural_pmu_version > 0) {
2265         if (has_architectural_pmu_version > 1) {
2266             kvm_msr_entry_add(cpu, MSR_CORE_PERF_FIXED_CTR_CTRL, 0);
2267             kvm_msr_entry_add(cpu, MSR_CORE_PERF_GLOBAL_CTRL, 0);
2268             kvm_msr_entry_add(cpu, MSR_CORE_PERF_GLOBAL_STATUS, 0);
2269             kvm_msr_entry_add(cpu, MSR_CORE_PERF_GLOBAL_OVF_CTRL, 0);
2270         }
2271         for (i = 0; i < num_architectural_pmu_fixed_counters; i++) {
2272             kvm_msr_entry_add(cpu, MSR_CORE_PERF_FIXED_CTR0 + i, 0);
2273         }
2274         for (i = 0; i < num_architectural_pmu_gp_counters; i++) {
2275             kvm_msr_entry_add(cpu, MSR_P6_PERFCTR0 + i, 0);
2276             kvm_msr_entry_add(cpu, MSR_P6_EVNTSEL0 + i, 0);
2277         }
2278     }
2279
2280     if (env->mcg_cap) {
2281         kvm_msr_entry_add(cpu, MSR_MCG_STATUS, 0);
2282         kvm_msr_entry_add(cpu, MSR_MCG_CTL, 0);
2283         if (has_msr_mcg_ext_ctl) {
2284             kvm_msr_entry_add(cpu, MSR_MCG_EXT_CTL, 0);
2285         }
2286         for (i = 0; i < (env->mcg_cap & 0xff) * 4; i++) {
2287             kvm_msr_entry_add(cpu, MSR_MC0_CTL + i, 0);
2288         }
2289     }
2290
2291     if (has_msr_hv_hypercall) {
2292         kvm_msr_entry_add(cpu, HV_X64_MSR_HYPERCALL, 0);
2293         kvm_msr_entry_add(cpu, HV_X64_MSR_GUEST_OS_ID, 0);
2294     }
2295     if (cpu->hyperv_vapic) {
2296         kvm_msr_entry_add(cpu, HV_X64_MSR_APIC_ASSIST_PAGE, 0);
2297     }
2298     if (cpu->hyperv_time) {
2299         kvm_msr_entry_add(cpu, HV_X64_MSR_REFERENCE_TSC, 0);
2300     }
2301     if (cpu->hyperv_reenlightenment) {
2302         kvm_msr_entry_add(cpu, HV_X64_MSR_REENLIGHTENMENT_CONTROL, 0);
2303         kvm_msr_entry_add(cpu, HV_X64_MSR_TSC_EMULATION_CONTROL, 0);
2304         kvm_msr_entry_add(cpu, HV_X64_MSR_TSC_EMULATION_STATUS, 0);
2305     }
2306     if (has_msr_hv_crash) {
2307         int j;
2308
2309         for (j = 0; j < HV_CRASH_PARAMS; j++) {
2310             kvm_msr_entry_add(cpu, HV_X64_MSR_CRASH_P0 + j, 0);
2311         }
2312     }
2313     if (has_msr_hv_runtime) {
2314         kvm_msr_entry_add(cpu, HV_X64_MSR_VP_RUNTIME, 0);
2315     }
2316     if (cpu->hyperv_synic) {
2317         uint32_t msr;
2318
2319         kvm_msr_entry_add(cpu, HV_X64_MSR_SCONTROL, 0);
2320         kvm_msr_entry_add(cpu, HV_X64_MSR_SIEFP, 0);
2321         kvm_msr_entry_add(cpu, HV_X64_MSR_SIMP, 0);
2322         for (msr = HV_X64_MSR_SINT0; msr <= HV_X64_MSR_SINT15; msr++) {
2323             kvm_msr_entry_add(cpu, msr, 0);
2324         }
2325     }
2326     if (has_msr_hv_stimer) {
2327         uint32_t msr;
2328
2329         for (msr = HV_X64_MSR_STIMER0_CONFIG; msr <= HV_X64_MSR_STIMER3_COUNT;
2330              msr++) {
2331             kvm_msr_entry_add(cpu, msr, 0);
2332         }
2333     }
2334     if (env->features[FEAT_1_EDX] & CPUID_MTRR) {
2335         kvm_msr_entry_add(cpu, MSR_MTRRdefType, 0);
2336         kvm_msr_entry_add(cpu, MSR_MTRRfix64K_00000, 0);
2337         kvm_msr_entry_add(cpu, MSR_MTRRfix16K_80000, 0);
2338         kvm_msr_entry_add(cpu, MSR_MTRRfix16K_A0000, 0);
2339         kvm_msr_entry_add(cpu, MSR_MTRRfix4K_C0000, 0);
2340         kvm_msr_entry_add(cpu, MSR_MTRRfix4K_C8000, 0);
2341         kvm_msr_entry_add(cpu, MSR_MTRRfix4K_D0000, 0);
2342         kvm_msr_entry_add(cpu, MSR_MTRRfix4K_D8000, 0);
2343         kvm_msr_entry_add(cpu, MSR_MTRRfix4K_E0000, 0);
2344         kvm_msr_entry_add(cpu, MSR_MTRRfix4K_E8000, 0);
2345         kvm_msr_entry_add(cpu, MSR_MTRRfix4K_F0000, 0);
2346         kvm_msr_entry_add(cpu, MSR_MTRRfix4K_F8000, 0);
2347         for (i = 0; i < MSR_MTRRcap_VCNT; i++) {
2348             kvm_msr_entry_add(cpu, MSR_MTRRphysBase(i), 0);
2349             kvm_msr_entry_add(cpu, MSR_MTRRphysMask(i), 0);
2350         }
2351     }
2352
2353     if (env->features[FEAT_7_0_EBX] & CPUID_7_0_EBX_INTEL_PT) {
2354         int addr_num =
2355             kvm_arch_get_supported_cpuid(kvm_state, 0x14, 1, R_EAX) & 0x7;
2356
2357         kvm_msr_entry_add(cpu, MSR_IA32_RTIT_CTL, 0);
2358         kvm_msr_entry_add(cpu, MSR_IA32_RTIT_STATUS, 0);
2359         kvm_msr_entry_add(cpu, MSR_IA32_RTIT_OUTPUT_BASE, 0);
2360         kvm_msr_entry_add(cpu, MSR_IA32_RTIT_OUTPUT_MASK, 0);
2361         kvm_msr_entry_add(cpu, MSR_IA32_RTIT_CR3_MATCH, 0);
2362         for (i = 0; i < addr_num; i++) {
2363             kvm_msr_entry_add(cpu, MSR_IA32_RTIT_ADDR0_A + i, 0);
2364         }
2365     }
2366
2367     ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_MSRS, cpu->kvm_msr_buf);
2368     if (ret < 0) {
2369         return ret;
2370     }
2371
2372     if (ret < cpu->kvm_msr_buf->nmsrs) {
2373         struct kvm_msr_entry *e = &cpu->kvm_msr_buf->entries[ret];
2374         error_report("error: failed to get MSR 0x%" PRIx32,
2375                      (uint32_t)e->index);
2376     }
2377
2378     assert(ret == cpu->kvm_msr_buf->nmsrs);
2379     /*
2380      * MTRR masks: Each mask consists of 5 parts
2381      * a  10..0: must be zero
2382      * b  11   : valid bit
2383      * c n-1.12: actual mask bits
2384      * d  51..n: reserved must be zero
2385      * e  63.52: reserved must be zero
2386      *
2387      * 'n' is the number of physical bits supported by the CPU and is
2388      * apparently always <= 52.   We know our 'n' but don't know what
2389      * the destinations 'n' is; it might be smaller, in which case
2390      * it masks (c) on loading. It might be larger, in which case
2391      * we fill 'd' so that d..c is consistent irrespetive of the 'n'
2392      * we're migrating to.
2393      */
2394
2395     if (cpu->fill_mtrr_mask) {
2396         QEMU_BUILD_BUG_ON(TARGET_PHYS_ADDR_SPACE_BITS > 52);
2397         assert(cpu->phys_bits <= TARGET_PHYS_ADDR_SPACE_BITS);
2398         mtrr_top_bits = MAKE_64BIT_MASK(cpu->phys_bits, 52 - cpu->phys_bits);
2399     } else {
2400         mtrr_top_bits = 0;
2401     }
2402
2403     for (i = 0; i < ret; i++) {
2404         uint32_t index = msrs[i].index;
2405         switch (index) {
2406         case MSR_IA32_SYSENTER_CS:
2407             env->sysenter_cs = msrs[i].data;
2408             break;
2409         case MSR_IA32_SYSENTER_ESP:
2410             env->sysenter_esp = msrs[i].data;
2411             break;
2412         case MSR_IA32_SYSENTER_EIP:
2413             env->sysenter_eip = msrs[i].data;
2414             break;
2415         case MSR_PAT:
2416             env->pat = msrs[i].data;
2417             break;
2418         case MSR_STAR:
2419             env->star = msrs[i].data;
2420             break;
2421 #ifdef TARGET_X86_64
2422         case MSR_CSTAR:
2423             env->cstar = msrs[i].data;
2424             break;
2425         case MSR_KERNELGSBASE:
2426             env->kernelgsbase = msrs[i].data;
2427             break;
2428         case MSR_FMASK:
2429             env->fmask = msrs[i].data;
2430             break;
2431         case MSR_LSTAR:
2432             env->lstar = msrs[i].data;
2433             break;
2434 #endif
2435         case MSR_IA32_TSC:
2436             env->tsc = msrs[i].data;
2437             break;
2438         case MSR_TSC_AUX:
2439             env->tsc_aux = msrs[i].data;
2440             break;
2441         case MSR_TSC_ADJUST:
2442             env->tsc_adjust = msrs[i].data;
2443             break;
2444         case MSR_IA32_TSCDEADLINE:
2445             env->tsc_deadline = msrs[i].data;
2446             break;
2447         case MSR_VM_HSAVE_PA:
2448             env->vm_hsave = msrs[i].data;
2449             break;
2450         case MSR_KVM_SYSTEM_TIME:
2451             env->system_time_msr = msrs[i].data;
2452             break;
2453         case MSR_KVM_WALL_CLOCK:
2454             env->wall_clock_msr = msrs[i].data;
2455             break;
2456         case MSR_MCG_STATUS:
2457             env->mcg_status = msrs[i].data;
2458             break;
2459         case MSR_MCG_CTL:
2460             env->mcg_ctl = msrs[i].data;
2461             break;
2462         case MSR_MCG_EXT_CTL:
2463             env->mcg_ext_ctl = msrs[i].data;
2464             break;
2465         case MSR_IA32_MISC_ENABLE:
2466             env->msr_ia32_misc_enable = msrs[i].data;
2467             break;
2468         case MSR_IA32_SMBASE:
2469             env->smbase = msrs[i].data;
2470             break;
2471         case MSR_SMI_COUNT:
2472             env->msr_smi_count = msrs[i].data;
2473             break;
2474         case MSR_IA32_FEATURE_CONTROL:
2475             env->msr_ia32_feature_control = msrs[i].data;
2476             break;
2477         case MSR_IA32_BNDCFGS:
2478             env->msr_bndcfgs = msrs[i].data;
2479             break;
2480         case MSR_IA32_XSS:
2481             env->xss = msrs[i].data;
2482             break;
2483         default:
2484             if (msrs[i].index >= MSR_MC0_CTL &&
2485                 msrs[i].index < MSR_MC0_CTL + (env->mcg_cap & 0xff) * 4) {
2486                 env->mce_banks[msrs[i].index - MSR_MC0_CTL] = msrs[i].data;
2487             }
2488             break;
2489         case MSR_KVM_ASYNC_PF_EN:
2490             env->async_pf_en_msr = msrs[i].data;
2491             break;
2492         case MSR_KVM_PV_EOI_EN:
2493             env->pv_eoi_en_msr = msrs[i].data;
2494             break;
2495         case MSR_KVM_STEAL_TIME:
2496             env->steal_time_msr = msrs[i].data;
2497             break;
2498         case MSR_CORE_PERF_FIXED_CTR_CTRL:
2499             env->msr_fixed_ctr_ctrl = msrs[i].data;
2500             break;
2501         case MSR_CORE_PERF_GLOBAL_CTRL:
2502             env->msr_global_ctrl = msrs[i].data;
2503             break;
2504         case MSR_CORE_PERF_GLOBAL_STATUS:
2505             env->msr_global_status = msrs[i].data;
2506             break;
2507         case MSR_CORE_PERF_GLOBAL_OVF_CTRL:
2508             env->msr_global_ovf_ctrl = msrs[i].data;
2509             break;
2510         case MSR_CORE_PERF_FIXED_CTR0 ... MSR_CORE_PERF_FIXED_CTR0 + MAX_FIXED_COUNTERS - 1:
2511             env->msr_fixed_counters[index - MSR_CORE_PERF_FIXED_CTR0] = msrs[i].data;
2512             break;
2513         case MSR_P6_PERFCTR0 ... MSR_P6_PERFCTR0 + MAX_GP_COUNTERS - 1:
2514             env->msr_gp_counters[index - MSR_P6_PERFCTR0] = msrs[i].data;
2515             break;
2516         case MSR_P6_EVNTSEL0 ... MSR_P6_EVNTSEL0 + MAX_GP_COUNTERS - 1:
2517             env->msr_gp_evtsel[index - MSR_P6_EVNTSEL0] = msrs[i].data;
2518             break;
2519         case HV_X64_MSR_HYPERCALL:
2520             env->msr_hv_hypercall = msrs[i].data;
2521             break;
2522         case HV_X64_MSR_GUEST_OS_ID:
2523             env->msr_hv_guest_os_id = msrs[i].data;
2524             break;
2525         case HV_X64_MSR_APIC_ASSIST_PAGE:
2526             env->msr_hv_vapic = msrs[i].data;
2527             break;
2528         case HV_X64_MSR_REFERENCE_TSC:
2529             env->msr_hv_tsc = msrs[i].data;
2530             break;
2531         case HV_X64_MSR_CRASH_P0 ... HV_X64_MSR_CRASH_P4:
2532             env->msr_hv_crash_params[index - HV_X64_MSR_CRASH_P0] = msrs[i].data;
2533             break;
2534         case HV_X64_MSR_VP_RUNTIME:
2535             env->msr_hv_runtime = msrs[i].data;
2536             break;
2537         case HV_X64_MSR_SCONTROL:
2538             env->msr_hv_synic_control = msrs[i].data;
2539             break;
2540         case HV_X64_MSR_SIEFP:
2541             env->msr_hv_synic_evt_page = msrs[i].data;
2542             break;
2543         case HV_X64_MSR_SIMP:
2544             env->msr_hv_synic_msg_page = msrs[i].data;
2545             break;
2546         case HV_X64_MSR_SINT0 ... HV_X64_MSR_SINT15:
2547             env->msr_hv_synic_sint[index - HV_X64_MSR_SINT0] = msrs[i].data;
2548             break;
2549         case HV_X64_MSR_STIMER0_CONFIG:
2550         case HV_X64_MSR_STIMER1_CONFIG:
2551         case HV_X64_MSR_STIMER2_CONFIG:
2552         case HV_X64_MSR_STIMER3_CONFIG:
2553             env->msr_hv_stimer_config[(index - HV_X64_MSR_STIMER0_CONFIG)/2] =
2554                                 msrs[i].data;
2555             break;
2556         case HV_X64_MSR_STIMER0_COUNT:
2557         case HV_X64_MSR_STIMER1_COUNT:
2558         case HV_X64_MSR_STIMER2_COUNT:
2559         case HV_X64_MSR_STIMER3_COUNT:
2560             env->msr_hv_stimer_count[(index - HV_X64_MSR_STIMER0_COUNT)/2] =
2561                                 msrs[i].data;
2562             break;
2563         case HV_X64_MSR_REENLIGHTENMENT_CONTROL:
2564             env->msr_hv_reenlightenment_control = msrs[i].data;
2565             break;
2566         case HV_X64_MSR_TSC_EMULATION_CONTROL:
2567             env->msr_hv_tsc_emulation_control = msrs[i].data;
2568             break;
2569         case HV_X64_MSR_TSC_EMULATION_STATUS:
2570             env->msr_hv_tsc_emulation_status = msrs[i].data;
2571             break;
2572         case MSR_MTRRdefType:
2573             env->mtrr_deftype = msrs[i].data;
2574             break;
2575         case MSR_MTRRfix64K_00000:
2576             env->mtrr_fixed[0] = msrs[i].data;
2577             break;
2578         case MSR_MTRRfix16K_80000:
2579             env->mtrr_fixed[1] = msrs[i].data;
2580             break;
2581         case MSR_MTRRfix16K_A0000:
2582             env->mtrr_fixed[2] = msrs[i].data;
2583             break;
2584         case MSR_MTRRfix4K_C0000:
2585             env->mtrr_fixed[3] = msrs[i].data;
2586             break;
2587         case MSR_MTRRfix4K_C8000:
2588             env->mtrr_fixed[4] = msrs[i].data;
2589             break;
2590         case MSR_MTRRfix4K_D0000:
2591             env->mtrr_fixed[5] = msrs[i].data;
2592             break;
2593         case MSR_MTRRfix4K_D8000:
2594             env->mtrr_fixed[6] = msrs[i].data;
2595             break;
2596         case MSR_MTRRfix4K_E0000:
2597             env->mtrr_fixed[7] = msrs[i].data;
2598             break;
2599         case MSR_MTRRfix4K_E8000:
2600             env->mtrr_fixed[8] = msrs[i].data;
2601             break;
2602         case MSR_MTRRfix4K_F0000:
2603             env->mtrr_fixed[9] = msrs[i].data;
2604             break;
2605         case MSR_MTRRfix4K_F8000:
2606             env->mtrr_fixed[10] = msrs[i].data;
2607             break;
2608         case MSR_MTRRphysBase(0) ... MSR_MTRRphysMask(MSR_MTRRcap_VCNT - 1):
2609             if (index & 1) {
2610                 env->mtrr_var[MSR_MTRRphysIndex(index)].mask = msrs[i].data |
2611                                                                mtrr_top_bits;
2612             } else {
2613                 env->mtrr_var[MSR_MTRRphysIndex(index)].base = msrs[i].data;
2614             }
2615             break;
2616         case MSR_IA32_SPEC_CTRL:
2617             env->spec_ctrl = msrs[i].data;
2618             break;
2619         case MSR_VIRT_SSBD:
2620             env->virt_ssbd = msrs[i].data;
2621             break;
2622         case MSR_IA32_RTIT_CTL:
2623             env->msr_rtit_ctrl = msrs[i].data;
2624             break;
2625         case MSR_IA32_RTIT_STATUS:
2626             env->msr_rtit_status = msrs[i].data;
2627             break;
2628         case MSR_IA32_RTIT_OUTPUT_BASE:
2629             env->msr_rtit_output_base = msrs[i].data;
2630             break;
2631         case MSR_IA32_RTIT_OUTPUT_MASK:
2632             env->msr_rtit_output_mask = msrs[i].data;
2633             break;
2634         case MSR_IA32_RTIT_CR3_MATCH:
2635             env->msr_rtit_cr3_match = msrs[i].data;
2636             break;
2637         case MSR_IA32_RTIT_ADDR0_A ... MSR_IA32_RTIT_ADDR3_B:
2638             env->msr_rtit_addrs[index - MSR_IA32_RTIT_ADDR0_A] = msrs[i].data;
2639             break;
2640         }
2641     }
2642
2643     return 0;
2644 }
2645
2646 static int kvm_put_mp_state(X86CPU *cpu)
2647 {
2648     struct kvm_mp_state mp_state = { .mp_state = cpu->env.mp_state };
2649
2650     return kvm_vcpu_ioctl(CPU(cpu), KVM_SET_MP_STATE, &mp_state);
2651 }
2652
2653 static int kvm_get_mp_state(X86CPU *cpu)
2654 {
2655     CPUState *cs = CPU(cpu);
2656     CPUX86State *env = &cpu->env;
2657     struct kvm_mp_state mp_state;
2658     int ret;
2659
2660     ret = kvm_vcpu_ioctl(cs, KVM_GET_MP_STATE, &mp_state);
2661     if (ret < 0) {
2662         return ret;
2663     }
2664     env->mp_state = mp_state.mp_state;
2665     if (kvm_irqchip_in_kernel()) {
2666         cs->halted = (mp_state.mp_state == KVM_MP_STATE_HALTED);
2667     }
2668     return 0;
2669 }
2670
2671 static int kvm_get_apic(X86CPU *cpu)
2672 {
2673     DeviceState *apic = cpu->apic_state;
2674     struct kvm_lapic_state kapic;
2675     int ret;
2676
2677     if (apic && kvm_irqchip_in_kernel()) {
2678         ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_LAPIC, &kapic);
2679         if (ret < 0) {
2680             return ret;
2681         }
2682
2683         kvm_get_apic_state(apic, &kapic);
2684     }
2685     return 0;
2686 }
2687
2688 static int kvm_put_vcpu_events(X86CPU *cpu, int level)
2689 {
2690     CPUState *cs = CPU(cpu);
2691     CPUX86State *env = &cpu->env;
2692     struct kvm_vcpu_events events = {};
2693
2694     if (!kvm_has_vcpu_events()) {
2695         return 0;
2696     }
2697
2698     events.exception.injected = (env->exception_injected >= 0);
2699     events.exception.nr = env->exception_injected;
2700     events.exception.has_error_code = env->has_error_code;
2701     events.exception.error_code = env->error_code;
2702
2703     events.interrupt.injected = (env->interrupt_injected >= 0);
2704     events.interrupt.nr = env->interrupt_injected;
2705     events.interrupt.soft = env->soft_interrupt;
2706
2707     events.nmi.injected = env->nmi_injected;
2708     events.nmi.pending = env->nmi_pending;
2709     events.nmi.masked = !!(env->hflags2 & HF2_NMI_MASK);
2710
2711     events.sipi_vector = env->sipi_vector;
2712     events.flags = 0;
2713
2714     if (has_msr_smbase) {
2715         events.smi.smm = !!(env->hflags & HF_SMM_MASK);
2716         events.smi.smm_inside_nmi = !!(env->hflags2 & HF2_SMM_INSIDE_NMI_MASK);
2717         if (kvm_irqchip_in_kernel()) {
2718             /* As soon as these are moved to the kernel, remove them
2719              * from cs->interrupt_request.
2720              */
2721             events.smi.pending = cs->interrupt_request & CPU_INTERRUPT_SMI;
2722             events.smi.latched_init = cs->interrupt_request & CPU_INTERRUPT_INIT;
2723             cs->interrupt_request &= ~(CPU_INTERRUPT_INIT | CPU_INTERRUPT_SMI);
2724         } else {
2725             /* Keep these in cs->interrupt_request.  */
2726             events.smi.pending = 0;
2727             events.smi.latched_init = 0;
2728         }
2729         /* Stop SMI delivery on old machine types to avoid a reboot
2730          * on an inward migration of an old VM.
2731          */
2732         if (!cpu->kvm_no_smi_migration) {
2733             events.flags |= KVM_VCPUEVENT_VALID_SMM;
2734         }
2735     }
2736
2737     if (level >= KVM_PUT_RESET_STATE) {
2738         events.flags |= KVM_VCPUEVENT_VALID_NMI_PENDING;
2739         if (env->mp_state == KVM_MP_STATE_SIPI_RECEIVED) {
2740             events.flags |= KVM_VCPUEVENT_VALID_SIPI_VECTOR;
2741         }
2742     }
2743
2744     return kvm_vcpu_ioctl(CPU(cpu), KVM_SET_VCPU_EVENTS, &events);
2745 }
2746
2747 static int kvm_get_vcpu_events(X86CPU *cpu)
2748 {
2749     CPUX86State *env = &cpu->env;
2750     struct kvm_vcpu_events events;
2751     int ret;
2752
2753     if (!kvm_has_vcpu_events()) {
2754         return 0;
2755     }
2756
2757     memset(&events, 0, sizeof(events));
2758     ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_VCPU_EVENTS, &events);
2759     if (ret < 0) {
2760        return ret;
2761     }
2762     env->exception_injected =
2763        events.exception.injected ? events.exception.nr : -1;
2764     env->has_error_code = events.exception.has_error_code;
2765     env->error_code = events.exception.error_code;
2766
2767     env->interrupt_injected =
2768         events.interrupt.injected ? events.interrupt.nr : -1;
2769     env->soft_interrupt = events.interrupt.soft;
2770
2771     env->nmi_injected = events.nmi.injected;
2772     env->nmi_pending = events.nmi.pending;
2773     if (events.nmi.masked) {
2774         env->hflags2 |= HF2_NMI_MASK;
2775     } else {
2776         env->hflags2 &= ~HF2_NMI_MASK;
2777     }
2778
2779     if (events.flags & KVM_VCPUEVENT_VALID_SMM) {
2780         if (events.smi.smm) {
2781             env->hflags |= HF_SMM_MASK;
2782         } else {
2783             env->hflags &= ~HF_SMM_MASK;
2784         }
2785         if (events.smi.pending) {
2786             cpu_interrupt(CPU(cpu), CPU_INTERRUPT_SMI);
2787         } else {
2788             cpu_reset_interrupt(CPU(cpu), CPU_INTERRUPT_SMI);
2789         }
2790         if (events.smi.smm_inside_nmi) {
2791             env->hflags2 |= HF2_SMM_INSIDE_NMI_MASK;
2792         } else {
2793             env->hflags2 &= ~HF2_SMM_INSIDE_NMI_MASK;
2794         }
2795         if (events.smi.latched_init) {
2796             cpu_interrupt(CPU(cpu), CPU_INTERRUPT_INIT);
2797         } else {
2798             cpu_reset_interrupt(CPU(cpu), CPU_INTERRUPT_INIT);
2799         }
2800     }
2801
2802     env->sipi_vector = events.sipi_vector;
2803
2804     return 0;
2805 }
2806
2807 static int kvm_guest_debug_workarounds(X86CPU *cpu)
2808 {
2809     CPUState *cs = CPU(cpu);
2810     CPUX86State *env = &cpu->env;
2811     int ret = 0;
2812     unsigned long reinject_trap = 0;
2813
2814     if (!kvm_has_vcpu_events()) {
2815         if (env->exception_injected == 1) {
2816             reinject_trap = KVM_GUESTDBG_INJECT_DB;
2817         } else if (env->exception_injected == 3) {
2818             reinject_trap = KVM_GUESTDBG_INJECT_BP;
2819         }
2820         env->exception_injected = -1;
2821     }
2822
2823     /*
2824      * Kernels before KVM_CAP_X86_ROBUST_SINGLESTEP overwrote flags.TF
2825      * injected via SET_GUEST_DEBUG while updating GP regs. Work around this
2826      * by updating the debug state once again if single-stepping is on.
2827      * Another reason to call kvm_update_guest_debug here is a pending debug
2828      * trap raise by the guest. On kernels without SET_VCPU_EVENTS we have to
2829      * reinject them via SET_GUEST_DEBUG.
2830      */
2831     if (reinject_trap ||
2832         (!kvm_has_robust_singlestep() && cs->singlestep_enabled)) {
2833         ret = kvm_update_guest_debug(cs, reinject_trap);
2834     }
2835     return ret;
2836 }
2837
2838 static int kvm_put_debugregs(X86CPU *cpu)
2839 {
2840     CPUX86State *env = &cpu->env;
2841     struct kvm_debugregs dbgregs;
2842     int i;
2843
2844     if (!kvm_has_debugregs()) {
2845         return 0;
2846     }
2847
2848     for (i = 0; i < 4; i++) {
2849         dbgregs.db[i] = env->dr[i];
2850     }
2851     dbgregs.dr6 = env->dr[6];
2852     dbgregs.dr7 = env->dr[7];
2853     dbgregs.flags = 0;
2854
2855     return kvm_vcpu_ioctl(CPU(cpu), KVM_SET_DEBUGREGS, &dbgregs);
2856 }
2857
2858 static int kvm_get_debugregs(X86CPU *cpu)
2859 {
2860     CPUX86State *env = &cpu->env;
2861     struct kvm_debugregs dbgregs;
2862     int i, ret;
2863
2864     if (!kvm_has_debugregs()) {
2865         return 0;
2866     }
2867
2868     ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_DEBUGREGS, &dbgregs);
2869     if (ret < 0) {
2870         return ret;
2871     }
2872     for (i = 0; i < 4; i++) {
2873         env->dr[i] = dbgregs.db[i];
2874     }
2875     env->dr[4] = env->dr[6] = dbgregs.dr6;
2876     env->dr[5] = env->dr[7] = dbgregs.dr7;
2877
2878     return 0;
2879 }
2880
2881 int kvm_arch_put_registers(CPUState *cpu, int level)
2882 {
2883     X86CPU *x86_cpu = X86_CPU(cpu);
2884     int ret;
2885
2886     assert(cpu_is_stopped(cpu) || qemu_cpu_is_self(cpu));
2887
2888     if (level >= KVM_PUT_RESET_STATE) {
2889         ret = kvm_put_msr_feature_control(x86_cpu);
2890         if (ret < 0) {
2891             return ret;
2892         }
2893     }
2894
2895     if (level == KVM_PUT_FULL_STATE) {
2896         /* We don't check for kvm_arch_set_tsc_khz() errors here,
2897          * because TSC frequency mismatch shouldn't abort migration,
2898          * unless the user explicitly asked for a more strict TSC
2899          * setting (e.g. using an explicit "tsc-freq" option).
2900          */
2901         kvm_arch_set_tsc_khz(cpu);
2902     }
2903
2904     ret = kvm_getput_regs(x86_cpu, 1);
2905     if (ret < 0) {
2906         return ret;
2907     }
2908     ret = kvm_put_xsave(x86_cpu);
2909     if (ret < 0) {
2910         return ret;
2911     }
2912     ret = kvm_put_xcrs(x86_cpu);
2913     if (ret < 0) {
2914         return ret;
2915     }
2916     ret = kvm_put_sregs(x86_cpu);
2917     if (ret < 0) {
2918         return ret;
2919     }
2920     /* must be before kvm_put_msrs */
2921     ret = kvm_inject_mce_oldstyle(x86_cpu);
2922     if (ret < 0) {
2923         return ret;
2924     }
2925     ret = kvm_put_msrs(x86_cpu, level);
2926     if (ret < 0) {
2927         return ret;
2928     }
2929     ret = kvm_put_vcpu_events(x86_cpu, level);
2930     if (ret < 0) {
2931         return ret;
2932     }
2933     if (level >= KVM_PUT_RESET_STATE) {
2934         ret = kvm_put_mp_state(x86_cpu);
2935         if (ret < 0) {
2936             return ret;
2937         }
2938     }
2939
2940     ret = kvm_put_tscdeadline_msr(x86_cpu);
2941     if (ret < 0) {
2942         return ret;
2943     }
2944     ret = kvm_put_debugregs(x86_cpu);
2945     if (ret < 0) {
2946         return ret;
2947     }
2948     /* must be last */
2949     ret = kvm_guest_debug_workarounds(x86_cpu);
2950     if (ret < 0) {
2951         return ret;
2952     }
2953     return 0;
2954 }
2955
2956 int kvm_arch_get_registers(CPUState *cs)
2957 {
2958     X86CPU *cpu = X86_CPU(cs);
2959     int ret;
2960
2961     assert(cpu_is_stopped(cs) || qemu_cpu_is_self(cs));
2962
2963     ret = kvm_get_vcpu_events(cpu);
2964     if (ret < 0) {
2965         goto out;
2966     }
2967     /*
2968      * KVM_GET_MPSTATE can modify CS and RIP, call it before
2969      * KVM_GET_REGS and KVM_GET_SREGS.
2970      */
2971     ret = kvm_get_mp_state(cpu);
2972     if (ret < 0) {
2973         goto out;
2974     }
2975     ret = kvm_getput_regs(cpu, 0);
2976     if (ret < 0) {
2977         goto out;
2978     }
2979     ret = kvm_get_xsave(cpu);
2980     if (ret < 0) {
2981         goto out;
2982     }
2983     ret = kvm_get_xcrs(cpu);
2984     if (ret < 0) {
2985         goto out;
2986     }
2987     ret = kvm_get_sregs(cpu);
2988     if (ret < 0) {
2989         goto out;
2990     }
2991     ret = kvm_get_msrs(cpu);
2992     if (ret < 0) {
2993         goto out;
2994     }
2995     ret = kvm_get_apic(cpu);
2996     if (ret < 0) {
2997         goto out;
2998     }
2999     ret = kvm_get_debugregs(cpu);
3000     if (ret < 0) {
3001         goto out;
3002     }
3003     ret = 0;
3004  out:
3005     cpu_sync_bndcs_hflags(&cpu->env);
3006     return ret;
3007 }
3008
3009 void kvm_arch_pre_run(CPUState *cpu, struct kvm_run *run)
3010 {
3011     X86CPU *x86_cpu = X86_CPU(cpu);
3012     CPUX86State *env = &x86_cpu->env;
3013     int ret;
3014
3015     /* Inject NMI */
3016     if (cpu->interrupt_request & (CPU_INTERRUPT_NMI | CPU_INTERRUPT_SMI)) {
3017         if (cpu->interrupt_request & CPU_INTERRUPT_NMI) {
3018             qemu_mutex_lock_iothread();
3019             cpu->interrupt_request &= ~CPU_INTERRUPT_NMI;
3020             qemu_mutex_unlock_iothread();
3021             DPRINTF("injected NMI\n");
3022             ret = kvm_vcpu_ioctl(cpu, KVM_NMI);
3023             if (ret < 0) {
3024                 fprintf(stderr, "KVM: injection failed, NMI lost (%s)\n",
3025                         strerror(-ret));
3026             }
3027         }
3028         if (cpu->interrupt_request & CPU_INTERRUPT_SMI) {
3029             qemu_mutex_lock_iothread();
3030             cpu->interrupt_request &= ~CPU_INTERRUPT_SMI;
3031             qemu_mutex_unlock_iothread();
3032             DPRINTF("injected SMI\n");
3033             ret = kvm_vcpu_ioctl(cpu, KVM_SMI);
3034             if (ret < 0) {
3035                 fprintf(stderr, "KVM: injection failed, SMI lost (%s)\n",
3036                         strerror(-ret));
3037             }
3038         }
3039     }
3040
3041     if (!kvm_pic_in_kernel()) {
3042         qemu_mutex_lock_iothread();
3043     }
3044
3045     /* Force the VCPU out of its inner loop to process any INIT requests
3046      * or (for userspace APIC, but it is cheap to combine the checks here)
3047      * pending TPR access reports.
3048      */
3049     if (cpu->interrupt_request & (CPU_INTERRUPT_INIT | CPU_INTERRUPT_TPR)) {
3050         if ((cpu->interrupt_request & CPU_INTERRUPT_INIT) &&
3051             !(env->hflags & HF_SMM_MASK)) {
3052             cpu->exit_request = 1;
3053         }
3054         if (cpu->interrupt_request & CPU_INTERRUPT_TPR) {
3055             cpu->exit_request = 1;
3056         }
3057     }
3058
3059     if (!kvm_pic_in_kernel()) {
3060         /* Try to inject an interrupt if the guest can accept it */
3061         if (run->ready_for_interrupt_injection &&
3062             (cpu->interrupt_request & CPU_INTERRUPT_HARD) &&
3063             (env->eflags & IF_MASK)) {
3064             int irq;
3065
3066             cpu->interrupt_request &= ~CPU_INTERRUPT_HARD;
3067             irq = cpu_get_pic_interrupt(env);
3068             if (irq >= 0) {
3069                 struct kvm_interrupt intr;
3070
3071                 intr.irq = irq;
3072                 DPRINTF("injected interrupt %d\n", irq);
3073                 ret = kvm_vcpu_ioctl(cpu, KVM_INTERRUPT, &intr);
3074                 if (ret < 0) {
3075                     fprintf(stderr,
3076                             "KVM: injection failed, interrupt lost (%s)\n",
3077                             strerror(-ret));
3078                 }
3079             }
3080         }
3081
3082         /* If we have an interrupt but the guest is not ready to receive an
3083          * interrupt, request an interrupt window exit.  This will
3084          * cause a return to userspace as soon as the guest is ready to
3085          * receive interrupts. */
3086         if ((cpu->interrupt_request & CPU_INTERRUPT_HARD)) {
3087             run->request_interrupt_window = 1;
3088         } else {
3089             run->request_interrupt_window = 0;
3090         }
3091
3092         DPRINTF("setting tpr\n");
3093         run->cr8 = cpu_get_apic_tpr(x86_cpu->apic_state);
3094
3095         qemu_mutex_unlock_iothread();
3096     }
3097 }
3098
3099 MemTxAttrs kvm_arch_post_run(CPUState *cpu, struct kvm_run *run)
3100 {
3101     X86CPU *x86_cpu = X86_CPU(cpu);
3102     CPUX86State *env = &x86_cpu->env;
3103
3104     if (run->flags & KVM_RUN_X86_SMM) {
3105         env->hflags |= HF_SMM_MASK;
3106     } else {
3107         env->hflags &= ~HF_SMM_MASK;
3108     }
3109     if (run->if_flag) {
3110         env->eflags |= IF_MASK;
3111     } else {
3112         env->eflags &= ~IF_MASK;
3113     }
3114
3115     /* We need to protect the apic state against concurrent accesses from
3116      * different threads in case the userspace irqchip is used. */
3117     if (!kvm_irqchip_in_kernel()) {
3118         qemu_mutex_lock_iothread();
3119     }
3120     cpu_set_apic_tpr(x86_cpu->apic_state, run->cr8);
3121     cpu_set_apic_base(x86_cpu->apic_state, run->apic_base);
3122     if (!kvm_irqchip_in_kernel()) {
3123         qemu_mutex_unlock_iothread();
3124     }
3125     return cpu_get_mem_attrs(env);
3126 }
3127
3128 int kvm_arch_process_async_events(CPUState *cs)
3129 {
3130     X86CPU *cpu = X86_CPU(cs);
3131     CPUX86State *env = &cpu->env;
3132
3133     if (cs->interrupt_request & CPU_INTERRUPT_MCE) {
3134         /* We must not raise CPU_INTERRUPT_MCE if it's not supported. */
3135         assert(env->mcg_cap);
3136
3137         cs->interrupt_request &= ~CPU_INTERRUPT_MCE;
3138
3139         kvm_cpu_synchronize_state(cs);
3140
3141         if (env->exception_injected == EXCP08_DBLE) {
3142             /* this means triple fault */
3143             qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
3144             cs->exit_request = 1;
3145             return 0;
3146         }
3147         env->exception_injected = EXCP12_MCHK;
3148         env->has_error_code = 0;
3149
3150         cs->halted = 0;
3151         if (kvm_irqchip_in_kernel() && env->mp_state == KVM_MP_STATE_HALTED) {
3152             env->mp_state = KVM_MP_STATE_RUNNABLE;
3153         }
3154     }
3155
3156     if ((cs->interrupt_request & CPU_INTERRUPT_INIT) &&
3157         !(env->hflags & HF_SMM_MASK)) {
3158         kvm_cpu_synchronize_state(cs);
3159         do_cpu_init(cpu);
3160     }
3161
3162     if (kvm_irqchip_in_kernel()) {
3163         return 0;
3164     }
3165
3166     if (cs->interrupt_request & CPU_INTERRUPT_POLL) {
3167         cs->interrupt_request &= ~CPU_INTERRUPT_POLL;
3168         apic_poll_irq(cpu->apic_state);
3169     }
3170     if (((cs->interrupt_request & CPU_INTERRUPT_HARD) &&
3171          (env->eflags & IF_MASK)) ||
3172         (cs->interrupt_request & CPU_INTERRUPT_NMI)) {
3173         cs->halted = 0;
3174     }
3175     if (cs->interrupt_request & CPU_INTERRUPT_SIPI) {
3176         kvm_cpu_synchronize_state(cs);
3177         do_cpu_sipi(cpu);
3178     }
3179     if (cs->interrupt_request & CPU_INTERRUPT_TPR) {
3180         cs->interrupt_request &= ~CPU_INTERRUPT_TPR;
3181         kvm_cpu_synchronize_state(cs);
3182         apic_handle_tpr_access_report(cpu->apic_state, env->eip,
3183                                       env->tpr_access_type);
3184     }
3185
3186     return cs->halted;
3187 }
3188
3189 static int kvm_handle_halt(X86CPU *cpu)
3190 {
3191     CPUState *cs = CPU(cpu);
3192     CPUX86State *env = &cpu->env;
3193
3194     if (!((cs->interrupt_request & CPU_INTERRUPT_HARD) &&
3195           (env->eflags & IF_MASK)) &&
3196         !(cs->interrupt_request & CPU_INTERRUPT_NMI)) {
3197         cs->halted = 1;
3198         return EXCP_HLT;
3199     }
3200
3201     return 0;
3202 }
3203
3204 static int kvm_handle_tpr_access(X86CPU *cpu)
3205 {
3206     CPUState *cs = CPU(cpu);
3207     struct kvm_run *run = cs->kvm_run;
3208
3209     apic_handle_tpr_access_report(cpu->apic_state, run->tpr_access.rip,
3210                                   run->tpr_access.is_write ? TPR_ACCESS_WRITE
3211                                                            : TPR_ACCESS_READ);
3212     return 1;
3213 }
3214
3215 int kvm_arch_insert_sw_breakpoint(CPUState *cs, struct kvm_sw_breakpoint *bp)
3216 {
3217     static const uint8_t int3 = 0xcc;
3218
3219     if (cpu_memory_rw_debug(cs, bp->pc, (uint8_t *)&bp->saved_insn, 1, 0) ||
3220         cpu_memory_rw_debug(cs, bp->pc, (uint8_t *)&int3, 1, 1)) {
3221         return -EINVAL;
3222     }
3223     return 0;
3224 }
3225
3226 int kvm_arch_remove_sw_breakpoint(CPUState *cs, struct kvm_sw_breakpoint *bp)
3227 {
3228     uint8_t int3;
3229
3230     if (cpu_memory_rw_debug(cs, bp->pc, &int3, 1, 0) || int3 != 0xcc ||
3231         cpu_memory_rw_debug(cs, bp->pc, (uint8_t *)&bp->saved_insn, 1, 1)) {
3232         return -EINVAL;
3233     }
3234     return 0;
3235 }
3236
3237 static struct {
3238     target_ulong addr;
3239     int len;
3240     int type;
3241 } hw_breakpoint[4];
3242
3243 static int nb_hw_breakpoint;
3244
3245 static int find_hw_breakpoint(target_ulong addr, int len, int type)
3246 {
3247     int n;
3248
3249     for (n = 0; n < nb_hw_breakpoint; n++) {
3250         if (hw_breakpoint[n].addr == addr && hw_breakpoint[n].type == type &&
3251             (hw_breakpoint[n].len == len || len == -1)) {
3252             return n;
3253         }
3254     }
3255     return -1;
3256 }
3257
3258 int kvm_arch_insert_hw_breakpoint(target_ulong addr,
3259                                   target_ulong len, int type)
3260 {
3261     switch (type) {
3262     case GDB_BREAKPOINT_HW:
3263         len = 1;
3264         break;
3265     case GDB_WATCHPOINT_WRITE:
3266     case GDB_WATCHPOINT_ACCESS:
3267         switch (len) {
3268         case 1:
3269             break;
3270         case 2:
3271         case 4:
3272         case 8:
3273             if (addr & (len - 1)) {
3274                 return -EINVAL;
3275             }
3276             break;
3277         default:
3278             return -EINVAL;
3279         }
3280         break;
3281     default:
3282         return -ENOSYS;
3283     }
3284
3285     if (nb_hw_breakpoint == 4) {
3286         return -ENOBUFS;
3287     }
3288     if (find_hw_breakpoint(addr, len, type) >= 0) {
3289         return -EEXIST;
3290     }
3291     hw_breakpoint[nb_hw_breakpoint].addr = addr;
3292     hw_breakpoint[nb_hw_breakpoint].len = len;
3293     hw_breakpoint[nb_hw_breakpoint].type = type;
3294     nb_hw_breakpoint++;
3295
3296     return 0;
3297 }
3298
3299 int kvm_arch_remove_hw_breakpoint(target_ulong addr,
3300                                   target_ulong len, int type)
3301 {
3302     int n;
3303
3304     n = find_hw_breakpoint(addr, (type == GDB_BREAKPOINT_HW) ? 1 : len, type);
3305     if (n < 0) {
3306         return -ENOENT;
3307     }
3308     nb_hw_breakpoint--;
3309     hw_breakpoint[n] = hw_breakpoint[nb_hw_breakpoint];
3310
3311     return 0;
3312 }
3313
3314 void kvm_arch_remove_all_hw_breakpoints(void)
3315 {
3316     nb_hw_breakpoint = 0;
3317 }
3318
3319 static CPUWatchpoint hw_watchpoint;
3320
3321 static int kvm_handle_debug(X86CPU *cpu,
3322                             struct kvm_debug_exit_arch *arch_info)
3323 {
3324     CPUState *cs = CPU(cpu);
3325     CPUX86State *env = &cpu->env;
3326     int ret = 0;
3327     int n;
3328
3329     if (arch_info->exception == 1) {
3330         if (arch_info->dr6 & (1 << 14)) {
3331             if (cs->singlestep_enabled) {
3332                 ret = EXCP_DEBUG;
3333             }
3334         } else {
3335             for (n = 0; n < 4; n++) {
3336                 if (arch_info->dr6 & (1 << n)) {
3337                     switch ((arch_info->dr7 >> (16 + n*4)) & 0x3) {
3338                     case 0x0:
3339                         ret = EXCP_DEBUG;
3340                         break;
3341                     case 0x1:
3342                         ret = EXCP_DEBUG;
3343                         cs->watchpoint_hit = &hw_watchpoint;
3344                         hw_watchpoint.vaddr = hw_breakpoint[n].addr;
3345                         hw_watchpoint.flags = BP_MEM_WRITE;
3346                         break;
3347                     case 0x3:
3348                         ret = EXCP_DEBUG;
3349                         cs->watchpoint_hit = &hw_watchpoint;
3350                         hw_watchpoint.vaddr = hw_breakpoint[n].addr;
3351                         hw_watchpoint.flags = BP_MEM_ACCESS;
3352                         break;
3353                     }
3354                 }
3355             }
3356         }
3357     } else if (kvm_find_sw_breakpoint(cs, arch_info->pc)) {
3358         ret = EXCP_DEBUG;
3359     }
3360     if (ret == 0) {
3361         cpu_synchronize_state(cs);
3362         assert(env->exception_injected == -1);
3363
3364         /* pass to guest */
3365         env->exception_injected = arch_info->exception;
3366         env->has_error_code = 0;
3367     }
3368
3369     return ret;
3370 }
3371
3372 void kvm_arch_update_guest_debug(CPUState *cpu, struct kvm_guest_debug *dbg)
3373 {
3374     const uint8_t type_code[] = {
3375         [GDB_BREAKPOINT_HW] = 0x0,
3376         [GDB_WATCHPOINT_WRITE] = 0x1,
3377         [GDB_WATCHPOINT_ACCESS] = 0x3
3378     };
3379     const uint8_t len_code[] = {
3380         [1] = 0x0, [2] = 0x1, [4] = 0x3, [8] = 0x2
3381     };
3382     int n;
3383
3384     if (kvm_sw_breakpoints_active(cpu)) {
3385         dbg->control |= KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP;
3386     }
3387     if (nb_hw_breakpoint > 0) {
3388         dbg->control |= KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_HW_BP;
3389         dbg->arch.debugreg[7] = 0x0600;
3390         for (n = 0; n < nb_hw_breakpoint; n++) {
3391             dbg->arch.debugreg[n] = hw_breakpoint[n].addr;
3392             dbg->arch.debugreg[7] |= (2 << (n * 2)) |
3393                 (type_code[hw_breakpoint[n].type] << (16 + n*4)) |
3394                 ((uint32_t)len_code[hw_breakpoint[n].len] << (18 + n*4));
3395         }
3396     }
3397 }
3398
3399 static bool host_supports_vmx(void)
3400 {
3401     uint32_t ecx, unused;
3402
3403     host_cpuid(1, 0, &unused, &unused, &ecx, &unused);
3404     return ecx & CPUID_EXT_VMX;
3405 }
3406
3407 #define VMX_INVALID_GUEST_STATE 0x80000021
3408
3409 int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
3410 {
3411     X86CPU *cpu = X86_CPU(cs);
3412     uint64_t code;
3413     int ret;
3414
3415     switch (run->exit_reason) {
3416     case KVM_EXIT_HLT:
3417         DPRINTF("handle_hlt\n");
3418         qemu_mutex_lock_iothread();
3419         ret = kvm_handle_halt(cpu);
3420         qemu_mutex_unlock_iothread();
3421         break;
3422     case KVM_EXIT_SET_TPR:
3423         ret = 0;
3424         break;
3425     case KVM_EXIT_TPR_ACCESS:
3426         qemu_mutex_lock_iothread();
3427         ret = kvm_handle_tpr_access(cpu);
3428         qemu_mutex_unlock_iothread();
3429         break;
3430     case KVM_EXIT_FAIL_ENTRY:
3431         code = run->fail_entry.hardware_entry_failure_reason;
3432         fprintf(stderr, "KVM: entry failed, hardware error 0x%" PRIx64 "\n",
3433                 code);
3434         if (host_supports_vmx() && code == VMX_INVALID_GUEST_STATE) {
3435             fprintf(stderr,
3436                     "\nIf you're running a guest on an Intel machine without "
3437                         "unrestricted mode\n"
3438                     "support, the failure can be most likely due to the guest "
3439                         "entering an invalid\n"
3440                     "state for Intel VT. For example, the guest maybe running "
3441                         "in big real mode\n"
3442                     "which is not supported on less recent Intel processors."
3443                         "\n\n");
3444         }
3445         ret = -1;
3446         break;
3447     case KVM_EXIT_EXCEPTION:
3448         fprintf(stderr, "KVM: exception %d exit (error code 0x%x)\n",
3449                 run->ex.exception, run->ex.error_code);
3450         ret = -1;
3451         break;
3452     case KVM_EXIT_DEBUG:
3453         DPRINTF("kvm_exit_debug\n");
3454         qemu_mutex_lock_iothread();
3455         ret = kvm_handle_debug(cpu, &run->debug.arch);
3456         qemu_mutex_unlock_iothread();
3457         break;
3458     case KVM_EXIT_HYPERV:
3459         ret = kvm_hv_handle_exit(cpu, &run->hyperv);
3460         break;
3461     case KVM_EXIT_IOAPIC_EOI:
3462         ioapic_eoi_broadcast(run->eoi.vector);
3463         ret = 0;
3464         break;
3465     default:
3466         fprintf(stderr, "KVM: unknown exit reason %d\n", run->exit_reason);
3467         ret = -1;
3468         break;
3469     }
3470
3471     return ret;
3472 }
3473
3474 bool kvm_arch_stop_on_emulation_error(CPUState *cs)
3475 {
3476     X86CPU *cpu = X86_CPU(cs);
3477     CPUX86State *env = &cpu->env;
3478
3479     kvm_cpu_synchronize_state(cs);
3480     return !(env->cr[0] & CR0_PE_MASK) ||
3481            ((env->segs[R_CS].selector  & 3) != 3);
3482 }
3483
3484 void kvm_arch_init_irq_routing(KVMState *s)
3485 {
3486     if (!kvm_check_extension(s, KVM_CAP_IRQ_ROUTING)) {
3487         /* If kernel can't do irq routing, interrupt source
3488          * override 0->2 cannot be set up as required by HPET.
3489          * So we have to disable it.
3490          */
3491         no_hpet = 1;
3492     }
3493     /* We know at this point that we're using the in-kernel
3494      * irqchip, so we can use irqfds, and on x86 we know
3495      * we can use msi via irqfd and GSI routing.
3496      */
3497     kvm_msi_via_irqfd_allowed = true;
3498     kvm_gsi_routing_allowed = true;
3499
3500     if (kvm_irqchip_is_split()) {
3501         int i;
3502
3503         /* If the ioapic is in QEMU and the lapics are in KVM, reserve
3504            MSI routes for signaling interrupts to the local apics. */
3505         for (i = 0; i < IOAPIC_NUM_PINS; i++) {
3506             if (kvm_irqchip_add_msi_route(s, 0, NULL) < 0) {
3507                 error_report("Could not enable split IRQ mode.");
3508                 exit(1);
3509             }
3510         }
3511     }
3512 }
3513
3514 int kvm_arch_irqchip_create(MachineState *ms, KVMState *s)
3515 {
3516     int ret;
3517     if (machine_kernel_irqchip_split(ms)) {
3518         ret = kvm_vm_enable_cap(s, KVM_CAP_SPLIT_IRQCHIP, 0, 24);
3519         if (ret) {
3520             error_report("Could not enable split irqchip mode: %s",
3521                          strerror(-ret));
3522             exit(1);
3523         } else {
3524             DPRINTF("Enabled KVM_CAP_SPLIT_IRQCHIP\n");
3525             kvm_split_irqchip = true;
3526             return 1;
3527         }
3528     } else {
3529         return 0;
3530     }
3531 }
3532
3533 /* Classic KVM device assignment interface. Will remain x86 only. */
3534 int kvm_device_pci_assign(KVMState *s, PCIHostDeviceAddress *dev_addr,
3535                           uint32_t flags, uint32_t *dev_id)
3536 {
3537     struct kvm_assigned_pci_dev dev_data = {
3538         .segnr = dev_addr->domain,
3539         .busnr = dev_addr->bus,
3540         .devfn = PCI_DEVFN(dev_addr->slot, dev_addr->function),
3541         .flags = flags,
3542     };
3543     int ret;
3544
3545     dev_data.assigned_dev_id =
3546         (dev_addr->domain << 16) | (dev_addr->bus << 8) | dev_data.devfn;
3547
3548     ret = kvm_vm_ioctl(s, KVM_ASSIGN_PCI_DEVICE, &dev_data);
3549     if (ret < 0) {
3550         return ret;
3551     }
3552
3553     *dev_id = dev_data.assigned_dev_id;
3554
3555     return 0;
3556 }
3557
3558 int kvm_device_pci_deassign(KVMState *s, uint32_t dev_id)
3559 {
3560     struct kvm_assigned_pci_dev dev_data = {
3561         .assigned_dev_id = dev_id,
3562     };
3563
3564     return kvm_vm_ioctl(s, KVM_DEASSIGN_PCI_DEVICE, &dev_data);
3565 }
3566
3567 static int kvm_assign_irq_internal(KVMState *s, uint32_t dev_id,
3568                                    uint32_t irq_type, uint32_t guest_irq)
3569 {
3570     struct kvm_assigned_irq assigned_irq = {
3571         .assigned_dev_id = dev_id,
3572         .guest_irq = guest_irq,
3573         .flags = irq_type,
3574     };
3575
3576     if (kvm_check_extension(s, KVM_CAP_ASSIGN_DEV_IRQ)) {
3577         return kvm_vm_ioctl(s, KVM_ASSIGN_DEV_IRQ, &assigned_irq);
3578     } else {
3579         return kvm_vm_ioctl(s, KVM_ASSIGN_IRQ, &assigned_irq);
3580     }
3581 }
3582
3583 int kvm_device_intx_assign(KVMState *s, uint32_t dev_id, bool use_host_msi,
3584                            uint32_t guest_irq)
3585 {
3586     uint32_t irq_type = KVM_DEV_IRQ_GUEST_INTX |
3587         (use_host_msi ? KVM_DEV_IRQ_HOST_MSI : KVM_DEV_IRQ_HOST_INTX);
3588
3589     return kvm_assign_irq_internal(s, dev_id, irq_type, guest_irq);
3590 }
3591
3592 int kvm_device_intx_set_mask(KVMState *s, uint32_t dev_id, bool masked)
3593 {
3594     struct kvm_assigned_pci_dev dev_data = {
3595         .assigned_dev_id = dev_id,
3596         .flags = masked ? KVM_DEV_ASSIGN_MASK_INTX : 0,
3597     };
3598
3599     return kvm_vm_ioctl(s, KVM_ASSIGN_SET_INTX_MASK, &dev_data);
3600 }
3601
3602 static int kvm_deassign_irq_internal(KVMState *s, uint32_t dev_id,
3603                                      uint32_t type)
3604 {
3605     struct kvm_assigned_irq assigned_irq = {
3606         .assigned_dev_id = dev_id,
3607         .flags = type,
3608     };
3609
3610     return kvm_vm_ioctl(s, KVM_DEASSIGN_DEV_IRQ, &assigned_irq);
3611 }
3612
3613 int kvm_device_intx_deassign(KVMState *s, uint32_t dev_id, bool use_host_msi)
3614 {
3615     return kvm_deassign_irq_internal(s, dev_id, KVM_DEV_IRQ_GUEST_INTX |
3616         (use_host_msi ? KVM_DEV_IRQ_HOST_MSI : KVM_DEV_IRQ_HOST_INTX));
3617 }
3618
3619 int kvm_device_msi_assign(KVMState *s, uint32_t dev_id, int virq)
3620 {
3621     return kvm_assign_irq_internal(s, dev_id, KVM_DEV_IRQ_HOST_MSI |
3622                                               KVM_DEV_IRQ_GUEST_MSI, virq);
3623 }
3624
3625 int kvm_device_msi_deassign(KVMState *s, uint32_t dev_id)
3626 {
3627     return kvm_deassign_irq_internal(s, dev_id, KVM_DEV_IRQ_GUEST_MSI |
3628                                                 KVM_DEV_IRQ_HOST_MSI);
3629 }
3630
3631 bool kvm_device_msix_supported(KVMState *s)
3632 {
3633     /* The kernel lacks a corresponding KVM_CAP, so we probe by calling
3634      * KVM_ASSIGN_SET_MSIX_NR with an invalid parameter. */
3635     return kvm_vm_ioctl(s, KVM_ASSIGN_SET_MSIX_NR, NULL) == -EFAULT;
3636 }
3637
3638 int kvm_device_msix_init_vectors(KVMState *s, uint32_t dev_id,
3639                                  uint32_t nr_vectors)
3640 {
3641     struct kvm_assigned_msix_nr msix_nr = {
3642         .assigned_dev_id = dev_id,
3643         .entry_nr = nr_vectors,
3644     };
3645
3646     return kvm_vm_ioctl(s, KVM_ASSIGN_SET_MSIX_NR, &msix_nr);
3647 }
3648
3649 int kvm_device_msix_set_vector(KVMState *s, uint32_t dev_id, uint32_t vector,
3650                                int virq)
3651 {
3652     struct kvm_assigned_msix_entry msix_entry = {
3653         .assigned_dev_id = dev_id,
3654         .gsi = virq,
3655         .entry = vector,
3656     };
3657
3658     return kvm_vm_ioctl(s, KVM_ASSIGN_SET_MSIX_ENTRY, &msix_entry);
3659 }
3660
3661 int kvm_device_msix_assign(KVMState *s, uint32_t dev_id)
3662 {
3663     return kvm_assign_irq_internal(s, dev_id, KVM_DEV_IRQ_HOST_MSIX |
3664                                               KVM_DEV_IRQ_GUEST_MSIX, 0);
3665 }
3666
3667 int kvm_device_msix_deassign(KVMState *s, uint32_t dev_id)
3668 {
3669     return kvm_deassign_irq_internal(s, dev_id, KVM_DEV_IRQ_GUEST_MSIX |
3670                                                 KVM_DEV_IRQ_HOST_MSIX);
3671 }
3672
3673 int kvm_arch_fixup_msi_route(struct kvm_irq_routing_entry *route,
3674                              uint64_t address, uint32_t data, PCIDevice *dev)
3675 {
3676     X86IOMMUState *iommu = x86_iommu_get_default();
3677
3678     if (iommu) {
3679         int ret;
3680         MSIMessage src, dst;
3681         X86IOMMUClass *class = X86_IOMMU_GET_CLASS(iommu);
3682
3683         if (!class->int_remap) {
3684             return 0;
3685         }
3686
3687         src.address = route->u.msi.address_hi;
3688         src.address <<= VTD_MSI_ADDR_HI_SHIFT;
3689         src.address |= route->u.msi.address_lo;
3690         src.data = route->u.msi.data;
3691
3692         ret = class->int_remap(iommu, &src, &dst, dev ? \
3693                                pci_requester_id(dev) : \
3694                                X86_IOMMU_SID_INVALID);
3695         if (ret) {
3696             trace_kvm_x86_fixup_msi_error(route->gsi);
3697             return 1;
3698         }
3699
3700         route->u.msi.address_hi = dst.address >> VTD_MSI_ADDR_HI_SHIFT;
3701         route->u.msi.address_lo = dst.address & VTD_MSI_ADDR_LO_MASK;
3702         route->u.msi.data = dst.data;
3703     }
3704
3705     return 0;
3706 }
3707
3708 typedef struct MSIRouteEntry MSIRouteEntry;
3709
3710 struct MSIRouteEntry {
3711     PCIDevice *dev;             /* Device pointer */
3712     int vector;                 /* MSI/MSIX vector index */
3713     int virq;                   /* Virtual IRQ index */
3714     QLIST_ENTRY(MSIRouteEntry) list;
3715 };
3716
3717 /* List of used GSI routes */
3718 static QLIST_HEAD(, MSIRouteEntry) msi_route_list = \
3719     QLIST_HEAD_INITIALIZER(msi_route_list);
3720
3721 static void kvm_update_msi_routes_all(void *private, bool global,
3722                                       uint32_t index, uint32_t mask)
3723 {
3724     int cnt = 0;
3725     MSIRouteEntry *entry;
3726     MSIMessage msg;
3727     PCIDevice *dev;
3728
3729     /* TODO: explicit route update */
3730     QLIST_FOREACH(entry, &msi_route_list, list) {
3731         cnt++;
3732         dev = entry->dev;
3733         if (!msix_enabled(dev) && !msi_enabled(dev)) {
3734             continue;
3735         }
3736         msg = pci_get_msi_message(dev, entry->vector);
3737         kvm_irqchip_update_msi_route(kvm_state, entry->virq, msg, dev);
3738     }
3739     kvm_irqchip_commit_routes(kvm_state);
3740     trace_kvm_x86_update_msi_routes(cnt);
3741 }
3742
3743 int kvm_arch_add_msi_route_post(struct kvm_irq_routing_entry *route,
3744                                 int vector, PCIDevice *dev)
3745 {
3746     static bool notify_list_inited = false;
3747     MSIRouteEntry *entry;
3748
3749     if (!dev) {
3750         /* These are (possibly) IOAPIC routes only used for split
3751          * kernel irqchip mode, while what we are housekeeping are
3752          * PCI devices only. */
3753         return 0;
3754     }
3755
3756     entry = g_new0(MSIRouteEntry, 1);
3757     entry->dev = dev;
3758     entry->vector = vector;
3759     entry->virq = route->gsi;
3760     QLIST_INSERT_HEAD(&msi_route_list, entry, list);
3761
3762     trace_kvm_x86_add_msi_route(route->gsi);
3763
3764     if (!notify_list_inited) {
3765         /* For the first time we do add route, add ourselves into
3766          * IOMMU's IEC notify list if needed. */
3767         X86IOMMUState *iommu = x86_iommu_get_default();
3768         if (iommu) {
3769             x86_iommu_iec_register_notifier(iommu,
3770                                             kvm_update_msi_routes_all,
3771                                             NULL);
3772         }
3773         notify_list_inited = true;
3774     }
3775     return 0;
3776 }
3777
3778 int kvm_arch_release_virq_post(int virq)
3779 {
3780     MSIRouteEntry *entry, *next;
3781     QLIST_FOREACH_SAFE(entry, &msi_route_list, list, next) {
3782         if (entry->virq == virq) {
3783             trace_kvm_x86_remove_msi_route(virq);
3784             QLIST_REMOVE(entry, list);
3785             g_free(entry);
3786             break;
3787         }
3788     }
3789     return 0;
3790 }
3791
3792 int kvm_arch_msi_data_to_gsi(uint32_t data)
3793 {
3794     abort();
3795 }