xref: /openbmc/qemu/target/arm/kvm.c (revision 77dd098a5e790e3ede0dea5ddd5f690086fe608c)
1 /*
2  * ARM implementation of KVM hooks
3  *
4  * Copyright Christoffer Dall 2009-2010
5  * Copyright Mian-M. Hamayun 2013, Virtual Open Systems
6  * Copyright Alex Bennée 2014, Linaro
7  *
8  * This work is licensed under the terms of the GNU GPL, version 2 or later.
9  * See the COPYING file in the top-level directory.
10  *
11  */
12 
13 #include "qemu/osdep.h"
14 #include <sys/ioctl.h>
15 
16 #include <linux/kvm.h>
17 
18 #include "qemu/timer.h"
19 #include "qemu/error-report.h"
20 #include "qemu/main-loop.h"
21 #include "qom/object.h"
22 #include "qapi/error.h"
23 #include "sysemu/sysemu.h"
24 #include "sysemu/runstate.h"
25 #include "sysemu/kvm.h"
26 #include "sysemu/kvm_int.h"
27 #include "kvm_arm.h"
28 #include "cpu.h"
29 #include "trace.h"
30 #include "internals.h"
31 #include "hw/pci/pci.h"
32 #include "exec/memattrs.h"
33 #include "exec/address-spaces.h"
34 #include "gdbstub/enums.h"
35 #include "hw/boards.h"
36 #include "hw/irq.h"
37 #include "qapi/visitor.h"
38 #include "qemu/log.h"
39 #include "hw/acpi/acpi.h"
40 #include "hw/acpi/ghes.h"
41 #include "target/arm/gtimer.h"
42 #include "migration/blocker.h"
43 
44 const KVMCapabilityInfo kvm_arch_required_capabilities[] = {
45     KVM_CAP_LAST_INFO
46 };
47 
48 static bool cap_has_mp_state;
49 static bool cap_has_inject_serror_esr;
50 static bool cap_has_inject_ext_dabt;
51 
52 /**
53  * ARMHostCPUFeatures: information about the host CPU (identified
54  * by asking the host kernel)
55  */
56 typedef struct ARMHostCPUFeatures {
57     ARMISARegisters isar;
58     uint64_t features;
59     uint32_t target;
60     const char *dtb_compatible;
61 } ARMHostCPUFeatures;
62 
63 static ARMHostCPUFeatures arm_host_cpu_features;
64 
65 /**
66  * kvm_arm_vcpu_init:
67  * @cpu: ARMCPU
68  *
69  * Initialize (or reinitialize) the VCPU by invoking the
70  * KVM_ARM_VCPU_INIT ioctl with the CPU type and feature
71  * bitmask specified in the CPUState.
72  *
73  * Returns: 0 if success else < 0 error code
74  */
75 static int kvm_arm_vcpu_init(ARMCPU *cpu)
76 {
77     struct kvm_vcpu_init init;
78 
79     init.target = cpu->kvm_target;
80     memcpy(init.features, cpu->kvm_init_features, sizeof(init.features));
81 
82     return kvm_vcpu_ioctl(CPU(cpu), KVM_ARM_VCPU_INIT, &init);
83 }
84 
85 /**
86  * kvm_arm_vcpu_finalize:
87  * @cpu: ARMCPU
88  * @feature: feature to finalize
89  *
90  * Finalizes the configuration of the specified VCPU feature by
91  * invoking the KVM_ARM_VCPU_FINALIZE ioctl. Features requiring
92  * this are documented in the "KVM_ARM_VCPU_FINALIZE" section of
93  * KVM's API documentation.
94  *
95  * Returns: 0 if success else < 0 error code
96  */
97 static int kvm_arm_vcpu_finalize(ARMCPU *cpu, int feature)
98 {
99     return kvm_vcpu_ioctl(CPU(cpu), KVM_ARM_VCPU_FINALIZE, &feature);
100 }
101 
102 bool kvm_arm_create_scratch_host_vcpu(const uint32_t *cpus_to_try,
103                                       int *fdarray,
104                                       struct kvm_vcpu_init *init)
105 {
106     int ret = 0, kvmfd = -1, vmfd = -1, cpufd = -1;
107     int max_vm_pa_size;
108 
109     kvmfd = qemu_open_old("/dev/kvm", O_RDWR);
110     if (kvmfd < 0) {
111         goto err;
112     }
113     max_vm_pa_size = ioctl(kvmfd, KVM_CHECK_EXTENSION, KVM_CAP_ARM_VM_IPA_SIZE);
114     if (max_vm_pa_size < 0) {
115         max_vm_pa_size = 0;
116     }
117     do {
118         vmfd = ioctl(kvmfd, KVM_CREATE_VM, max_vm_pa_size);
119     } while (vmfd == -1 && errno == EINTR);
120     if (vmfd < 0) {
121         goto err;
122     }
123 
124     /*
125      * The MTE capability must be enabled by the VMM before creating
126      * any VCPUs in order to allow the MTE bits of the ID_AA64PFR1
127      * register to be probed correctly, as they are masked if MTE
128      * is not enabled.
129      */
130     if (kvm_arm_mte_supported()) {
131         KVMState kvm_state;
132 
133         kvm_state.fd = kvmfd;
134         kvm_state.vmfd = vmfd;
135         kvm_vm_enable_cap(&kvm_state, KVM_CAP_ARM_MTE, 0);
136     }
137 
138     cpufd = ioctl(vmfd, KVM_CREATE_VCPU, 0);
139     if (cpufd < 0) {
140         goto err;
141     }
142 
143     if (!init) {
144         /* Caller doesn't want the VCPU to be initialized, so skip it */
145         goto finish;
146     }
147 
148     if (init->target == -1) {
149         struct kvm_vcpu_init preferred;
150 
151         ret = ioctl(vmfd, KVM_ARM_PREFERRED_TARGET, &preferred);
152         if (!ret) {
153             init->target = preferred.target;
154         }
155     }
156     if (ret >= 0) {
157         ret = ioctl(cpufd, KVM_ARM_VCPU_INIT, init);
158         if (ret < 0) {
159             goto err;
160         }
161     } else if (cpus_to_try) {
162         /* Old kernel which doesn't know about the
163          * PREFERRED_TARGET ioctl: we know it will only support
164          * creating one kind of guest CPU which is its preferred
165          * CPU type.
166          */
167         struct kvm_vcpu_init try;
168 
169         while (*cpus_to_try != QEMU_KVM_ARM_TARGET_NONE) {
170             try.target = *cpus_to_try++;
171             memcpy(try.features, init->features, sizeof(init->features));
172             ret = ioctl(cpufd, KVM_ARM_VCPU_INIT, &try);
173             if (ret >= 0) {
174                 break;
175             }
176         }
177         if (ret < 0) {
178             goto err;
179         }
180         init->target = try.target;
181     } else {
182         /* Treat a NULL cpus_to_try argument the same as an empty
183          * list, which means we will fail the call since this must
184          * be an old kernel which doesn't support PREFERRED_TARGET.
185          */
186         goto err;
187     }
188 
189 finish:
190     fdarray[0] = kvmfd;
191     fdarray[1] = vmfd;
192     fdarray[2] = cpufd;
193 
194     return true;
195 
196 err:
197     if (cpufd >= 0) {
198         close(cpufd);
199     }
200     if (vmfd >= 0) {
201         close(vmfd);
202     }
203     if (kvmfd >= 0) {
204         close(kvmfd);
205     }
206 
207     return false;
208 }
209 
210 void kvm_arm_destroy_scratch_host_vcpu(int *fdarray)
211 {
212     int i;
213 
214     for (i = 2; i >= 0; i--) {
215         close(fdarray[i]);
216     }
217 }
218 
219 static int read_sys_reg32(int fd, uint32_t *pret, uint64_t id)
220 {
221     uint64_t ret;
222     struct kvm_one_reg idreg = { .id = id, .addr = (uintptr_t)&ret };
223     int err;
224 
225     assert((id & KVM_REG_SIZE_MASK) == KVM_REG_SIZE_U64);
226     err = ioctl(fd, KVM_GET_ONE_REG, &idreg);
227     if (err < 0) {
228         return -1;
229     }
230     *pret = ret;
231     return 0;
232 }
233 
234 static int read_sys_reg64(int fd, uint64_t *pret, uint64_t id)
235 {
236     struct kvm_one_reg idreg = { .id = id, .addr = (uintptr_t)pret };
237 
238     assert((id & KVM_REG_SIZE_MASK) == KVM_REG_SIZE_U64);
239     return ioctl(fd, KVM_GET_ONE_REG, &idreg);
240 }
241 
242 static bool kvm_arm_pauth_supported(void)
243 {
244     return (kvm_check_extension(kvm_state, KVM_CAP_ARM_PTRAUTH_ADDRESS) &&
245             kvm_check_extension(kvm_state, KVM_CAP_ARM_PTRAUTH_GENERIC));
246 }
247 
248 static bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
249 {
250     /* Identify the feature bits corresponding to the host CPU, and
251      * fill out the ARMHostCPUClass fields accordingly. To do this
252      * we have to create a scratch VM, create a single CPU inside it,
253      * and then query that CPU for the relevant ID registers.
254      */
255     int fdarray[3];
256     bool sve_supported;
257     bool pmu_supported = false;
258     uint64_t features = 0;
259     int err;
260 
261     /* Old kernels may not know about the PREFERRED_TARGET ioctl: however
262      * we know these will only support creating one kind of guest CPU,
263      * which is its preferred CPU type. Fortunately these old kernels
264      * support only a very limited number of CPUs.
265      */
266     static const uint32_t cpus_to_try[] = {
267         KVM_ARM_TARGET_AEM_V8,
268         KVM_ARM_TARGET_FOUNDATION_V8,
269         KVM_ARM_TARGET_CORTEX_A57,
270         QEMU_KVM_ARM_TARGET_NONE
271     };
272     /*
273      * target = -1 informs kvm_arm_create_scratch_host_vcpu()
274      * to use the preferred target
275      */
276     struct kvm_vcpu_init init = { .target = -1, };
277 
278     /*
279      * Ask for SVE if supported, so that we can query ID_AA64ZFR0,
280      * which is otherwise RAZ.
281      */
282     sve_supported = kvm_arm_sve_supported();
283     if (sve_supported) {
284         init.features[0] |= 1 << KVM_ARM_VCPU_SVE;
285     }
286 
287     /*
288      * Ask for Pointer Authentication if supported, so that we get
289      * the unsanitized field values for AA64ISAR1_EL1.
290      */
291     if (kvm_arm_pauth_supported()) {
292         init.features[0] |= (1 << KVM_ARM_VCPU_PTRAUTH_ADDRESS |
293                              1 << KVM_ARM_VCPU_PTRAUTH_GENERIC);
294     }
295 
296     if (kvm_arm_pmu_supported()) {
297         init.features[0] |= 1 << KVM_ARM_VCPU_PMU_V3;
298         pmu_supported = true;
299         features |= 1ULL << ARM_FEATURE_PMU;
300     }
301 
302     if (!kvm_arm_create_scratch_host_vcpu(cpus_to_try, fdarray, &init)) {
303         return false;
304     }
305 
306     ahcf->target = init.target;
307     ahcf->dtb_compatible = "arm,arm-v8";
308 
309     err = read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64pfr0,
310                          ARM64_SYS_REG(3, 0, 0, 4, 0));
311     if (unlikely(err < 0)) {
312         /*
313          * Before v4.15, the kernel only exposed a limited number of system
314          * registers, not including any of the interesting AArch64 ID regs.
315          * For the most part we could leave these fields as zero with minimal
316          * effect, since this does not affect the values seen by the guest.
317          *
318          * However, it could cause problems down the line for QEMU,
319          * so provide a minimal v8.0 default.
320          *
321          * ??? Could read MIDR and use knowledge from cpu64.c.
322          * ??? Could map a page of memory into our temp guest and
323          *     run the tiniest of hand-crafted kernels to extract
324          *     the values seen by the guest.
325          * ??? Either of these sounds like too much effort just
326          *     to work around running a modern host kernel.
327          */
328         ahcf->isar.id_aa64pfr0 = 0x00000011; /* EL1&0, AArch64 only */
329         err = 0;
330     } else {
331         err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64pfr1,
332                               ARM64_SYS_REG(3, 0, 0, 4, 1));
333         err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64smfr0,
334                               ARM64_SYS_REG(3, 0, 0, 4, 5));
335         err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64dfr0,
336                               ARM64_SYS_REG(3, 0, 0, 5, 0));
337         err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64dfr1,
338                               ARM64_SYS_REG(3, 0, 0, 5, 1));
339         err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64isar0,
340                               ARM64_SYS_REG(3, 0, 0, 6, 0));
341         err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64isar1,
342                               ARM64_SYS_REG(3, 0, 0, 6, 1));
343         err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64isar2,
344                               ARM64_SYS_REG(3, 0, 0, 6, 2));
345         err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64mmfr0,
346                               ARM64_SYS_REG(3, 0, 0, 7, 0));
347         err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64mmfr1,
348                               ARM64_SYS_REG(3, 0, 0, 7, 1));
349         err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64mmfr2,
350                               ARM64_SYS_REG(3, 0, 0, 7, 2));
351         err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64mmfr3,
352                               ARM64_SYS_REG(3, 0, 0, 7, 3));
353 
354         /*
355          * Note that if AArch32 support is not present in the host,
356          * the AArch32 sysregs are present to be read, but will
357          * return UNKNOWN values.  This is neither better nor worse
358          * than skipping the reads and leaving 0, as we must avoid
359          * considering the values in every case.
360          */
361         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_pfr0,
362                               ARM64_SYS_REG(3, 0, 0, 1, 0));
363         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_pfr1,
364                               ARM64_SYS_REG(3, 0, 0, 1, 1));
365         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_dfr0,
366                               ARM64_SYS_REG(3, 0, 0, 1, 2));
367         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_mmfr0,
368                               ARM64_SYS_REG(3, 0, 0, 1, 4));
369         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_mmfr1,
370                               ARM64_SYS_REG(3, 0, 0, 1, 5));
371         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_mmfr2,
372                               ARM64_SYS_REG(3, 0, 0, 1, 6));
373         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_mmfr3,
374                               ARM64_SYS_REG(3, 0, 0, 1, 7));
375         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar0,
376                               ARM64_SYS_REG(3, 0, 0, 2, 0));
377         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar1,
378                               ARM64_SYS_REG(3, 0, 0, 2, 1));
379         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar2,
380                               ARM64_SYS_REG(3, 0, 0, 2, 2));
381         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar3,
382                               ARM64_SYS_REG(3, 0, 0, 2, 3));
383         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar4,
384                               ARM64_SYS_REG(3, 0, 0, 2, 4));
385         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar5,
386                               ARM64_SYS_REG(3, 0, 0, 2, 5));
387         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_mmfr4,
388                               ARM64_SYS_REG(3, 0, 0, 2, 6));
389         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar6,
390                               ARM64_SYS_REG(3, 0, 0, 2, 7));
391 
392         err |= read_sys_reg32(fdarray[2], &ahcf->isar.mvfr0,
393                               ARM64_SYS_REG(3, 0, 0, 3, 0));
394         err |= read_sys_reg32(fdarray[2], &ahcf->isar.mvfr1,
395                               ARM64_SYS_REG(3, 0, 0, 3, 1));
396         err |= read_sys_reg32(fdarray[2], &ahcf->isar.mvfr2,
397                               ARM64_SYS_REG(3, 0, 0, 3, 2));
398         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_pfr2,
399                               ARM64_SYS_REG(3, 0, 0, 3, 4));
400         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_dfr1,
401                               ARM64_SYS_REG(3, 0, 0, 3, 5));
402         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_mmfr5,
403                               ARM64_SYS_REG(3, 0, 0, 3, 6));
404 
405         /*
406          * DBGDIDR is a bit complicated because the kernel doesn't
407          * provide an accessor for it in 64-bit mode, which is what this
408          * scratch VM is in, and there's no architected "64-bit sysreg
409          * which reads the same as the 32-bit register" the way there is
410          * for other ID registers. Instead we synthesize a value from the
411          * AArch64 ID_AA64DFR0, the same way the kernel code in
412          * arch/arm64/kvm/sys_regs.c:trap_dbgidr() does.
413          * We only do this if the CPU supports AArch32 at EL1.
414          */
415         if (FIELD_EX32(ahcf->isar.id_aa64pfr0, ID_AA64PFR0, EL1) >= 2) {
416             int wrps = FIELD_EX64(ahcf->isar.id_aa64dfr0, ID_AA64DFR0, WRPS);
417             int brps = FIELD_EX64(ahcf->isar.id_aa64dfr0, ID_AA64DFR0, BRPS);
418             int ctx_cmps =
419                 FIELD_EX64(ahcf->isar.id_aa64dfr0, ID_AA64DFR0, CTX_CMPS);
420             int version = 6; /* ARMv8 debug architecture */
421             bool has_el3 =
422                 !!FIELD_EX32(ahcf->isar.id_aa64pfr0, ID_AA64PFR0, EL3);
423             uint32_t dbgdidr = 0;
424 
425             dbgdidr = FIELD_DP32(dbgdidr, DBGDIDR, WRPS, wrps);
426             dbgdidr = FIELD_DP32(dbgdidr, DBGDIDR, BRPS, brps);
427             dbgdidr = FIELD_DP32(dbgdidr, DBGDIDR, CTX_CMPS, ctx_cmps);
428             dbgdidr = FIELD_DP32(dbgdidr, DBGDIDR, VERSION, version);
429             dbgdidr = FIELD_DP32(dbgdidr, DBGDIDR, NSUHD_IMP, has_el3);
430             dbgdidr = FIELD_DP32(dbgdidr, DBGDIDR, SE_IMP, has_el3);
431             dbgdidr |= (1 << 15); /* RES1 bit */
432             ahcf->isar.dbgdidr = dbgdidr;
433         }
434 
435         if (pmu_supported) {
436             /* PMCR_EL0 is only accessible if the vCPU has feature PMU_V3 */
437             err |= read_sys_reg64(fdarray[2], &ahcf->isar.reset_pmcr_el0,
438                                   ARM64_SYS_REG(3, 3, 9, 12, 0));
439         }
440 
441         if (sve_supported) {
442             /*
443              * There is a range of kernels between kernel commit 73433762fcae
444              * and f81cb2c3ad41 which have a bug where the kernel doesn't
445              * expose SYS_ID_AA64ZFR0_EL1 via the ONE_REG API unless the VM has
446              * enabled SVE support, which resulted in an error rather than RAZ.
447              * So only read the register if we set KVM_ARM_VCPU_SVE above.
448              */
449             err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64zfr0,
450                                   ARM64_SYS_REG(3, 0, 0, 4, 4));
451         }
452     }
453 
454     kvm_arm_destroy_scratch_host_vcpu(fdarray);
455 
456     if (err < 0) {
457         return false;
458     }
459 
460     /*
461      * We can assume any KVM supporting CPU is at least a v8
462      * with VFPv4+Neon; this in turn implies most of the other
463      * feature bits.
464      */
465     features |= 1ULL << ARM_FEATURE_V8;
466     features |= 1ULL << ARM_FEATURE_NEON;
467     features |= 1ULL << ARM_FEATURE_AARCH64;
468     features |= 1ULL << ARM_FEATURE_GENERIC_TIMER;
469 
470     ahcf->features = features;
471 
472     return true;
473 }
474 
475 void kvm_arm_set_cpu_features_from_host(ARMCPU *cpu)
476 {
477     CPUARMState *env = &cpu->env;
478 
479     if (!arm_host_cpu_features.dtb_compatible) {
480         if (!kvm_enabled() ||
481             !kvm_arm_get_host_cpu_features(&arm_host_cpu_features)) {
482             /* We can't report this error yet, so flag that we need to
483              * in arm_cpu_realizefn().
484              */
485             cpu->kvm_target = QEMU_KVM_ARM_TARGET_NONE;
486             cpu->host_cpu_probe_failed = true;
487             return;
488         }
489     }
490 
491     cpu->kvm_target = arm_host_cpu_features.target;
492     cpu->dtb_compatible = arm_host_cpu_features.dtb_compatible;
493     cpu->isar = arm_host_cpu_features.isar;
494     env->features = arm_host_cpu_features.features;
495 }
496 
497 static bool kvm_no_adjvtime_get(Object *obj, Error **errp)
498 {
499     return !ARM_CPU(obj)->kvm_adjvtime;
500 }
501 
502 static void kvm_no_adjvtime_set(Object *obj, bool value, Error **errp)
503 {
504     ARM_CPU(obj)->kvm_adjvtime = !value;
505 }
506 
507 static bool kvm_steal_time_get(Object *obj, Error **errp)
508 {
509     return ARM_CPU(obj)->kvm_steal_time != ON_OFF_AUTO_OFF;
510 }
511 
512 static void kvm_steal_time_set(Object *obj, bool value, Error **errp)
513 {
514     ARM_CPU(obj)->kvm_steal_time = value ? ON_OFF_AUTO_ON : ON_OFF_AUTO_OFF;
515 }
516 
517 /* KVM VCPU properties should be prefixed with "kvm-". */
518 void kvm_arm_add_vcpu_properties(ARMCPU *cpu)
519 {
520     CPUARMState *env = &cpu->env;
521     Object *obj = OBJECT(cpu);
522 
523     if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) {
524         cpu->kvm_adjvtime = true;
525         object_property_add_bool(obj, "kvm-no-adjvtime", kvm_no_adjvtime_get,
526                                  kvm_no_adjvtime_set);
527         object_property_set_description(obj, "kvm-no-adjvtime",
528                                         "Set on to disable the adjustment of "
529                                         "the virtual counter. VM stopped time "
530                                         "will be counted.");
531     }
532 
533     cpu->kvm_steal_time = ON_OFF_AUTO_AUTO;
534     object_property_add_bool(obj, "kvm-steal-time", kvm_steal_time_get,
535                              kvm_steal_time_set);
536     object_property_set_description(obj, "kvm-steal-time",
537                                     "Set off to disable KVM steal time.");
538 }
539 
540 bool kvm_arm_pmu_supported(void)
541 {
542     return kvm_check_extension(kvm_state, KVM_CAP_ARM_PMU_V3);
543 }
544 
545 int kvm_arm_get_max_vm_ipa_size(MachineState *ms, bool *fixed_ipa)
546 {
547     KVMState *s = KVM_STATE(ms->accelerator);
548     int ret;
549 
550     ret = kvm_check_extension(s, KVM_CAP_ARM_VM_IPA_SIZE);
551     *fixed_ipa = ret <= 0;
552 
553     return ret > 0 ? ret : 40;
554 }
555 
556 int kvm_arch_get_default_type(MachineState *ms)
557 {
558     bool fixed_ipa;
559     int size = kvm_arm_get_max_vm_ipa_size(ms, &fixed_ipa);
560     return fixed_ipa ? 0 : size;
561 }
562 
563 int kvm_arch_init(MachineState *ms, KVMState *s)
564 {
565     int ret = 0;
566     /* For ARM interrupt delivery is always asynchronous,
567      * whether we are using an in-kernel VGIC or not.
568      */
569     kvm_async_interrupts_allowed = true;
570 
571     /*
572      * PSCI wakes up secondary cores, so we always need to
573      * have vCPUs waiting in kernel space
574      */
575     kvm_halt_in_kernel_allowed = true;
576 
577     cap_has_mp_state = kvm_check_extension(s, KVM_CAP_MP_STATE);
578 
579     /* Check whether user space can specify guest syndrome value */
580     cap_has_inject_serror_esr =
581         kvm_check_extension(s, KVM_CAP_ARM_INJECT_SERROR_ESR);
582 
583     if (ms->smp.cpus > 256 &&
584         !kvm_check_extension(s, KVM_CAP_ARM_IRQ_LINE_LAYOUT_2)) {
585         error_report("Using more than 256 vcpus requires a host kernel "
586                      "with KVM_CAP_ARM_IRQ_LINE_LAYOUT_2");
587         ret = -EINVAL;
588     }
589 
590     if (kvm_check_extension(s, KVM_CAP_ARM_NISV_TO_USER)) {
591         if (kvm_vm_enable_cap(s, KVM_CAP_ARM_NISV_TO_USER, 0)) {
592             error_report("Failed to enable KVM_CAP_ARM_NISV_TO_USER cap");
593         } else {
594             /* Set status for supporting the external dabt injection */
595             cap_has_inject_ext_dabt = kvm_check_extension(s,
596                                     KVM_CAP_ARM_INJECT_EXT_DABT);
597         }
598     }
599 
600     if (s->kvm_eager_split_size) {
601         uint32_t sizes;
602 
603         sizes = kvm_vm_check_extension(s, KVM_CAP_ARM_SUPPORTED_BLOCK_SIZES);
604         if (!sizes) {
605             s->kvm_eager_split_size = 0;
606             warn_report("Eager Page Split support not available");
607         } else if (!(s->kvm_eager_split_size & sizes)) {
608             error_report("Eager Page Split requested chunk size not valid");
609             ret = -EINVAL;
610         } else {
611             ret = kvm_vm_enable_cap(s, KVM_CAP_ARM_EAGER_SPLIT_CHUNK_SIZE, 0,
612                                     s->kvm_eager_split_size);
613             if (ret < 0) {
614                 error_report("Enabling of Eager Page Split failed: %s",
615                              strerror(-ret));
616             }
617         }
618     }
619 
620     max_hw_wps = kvm_check_extension(s, KVM_CAP_GUEST_DEBUG_HW_WPS);
621     hw_watchpoints = g_array_sized_new(true, true,
622                                        sizeof(HWWatchpoint), max_hw_wps);
623 
624     max_hw_bps = kvm_check_extension(s, KVM_CAP_GUEST_DEBUG_HW_BPS);
625     hw_breakpoints = g_array_sized_new(true, true,
626                                        sizeof(HWBreakpoint), max_hw_bps);
627 
628     return ret;
629 }
630 
631 unsigned long kvm_arch_vcpu_id(CPUState *cpu)
632 {
633     return cpu->cpu_index;
634 }
635 
636 /* We track all the KVM devices which need their memory addresses
637  * passing to the kernel in a list of these structures.
638  * When board init is complete we run through the list and
639  * tell the kernel the base addresses of the memory regions.
640  * We use a MemoryListener to track mapping and unmapping of
641  * the regions during board creation, so the board models don't
642  * need to do anything special for the KVM case.
643  *
644  * Sometimes the address must be OR'ed with some other fields
645  * (for example for KVM_VGIC_V3_ADDR_TYPE_REDIST_REGION).
646  * @kda_addr_ormask aims at storing the value of those fields.
647  */
648 typedef struct KVMDevice {
649     struct kvm_arm_device_addr kda;
650     struct kvm_device_attr kdattr;
651     uint64_t kda_addr_ormask;
652     MemoryRegion *mr;
653     QSLIST_ENTRY(KVMDevice) entries;
654     int dev_fd;
655 } KVMDevice;
656 
657 static QSLIST_HEAD(, KVMDevice) kvm_devices_head;
658 
659 static void kvm_arm_devlistener_add(MemoryListener *listener,
660                                     MemoryRegionSection *section)
661 {
662     KVMDevice *kd;
663 
664     QSLIST_FOREACH(kd, &kvm_devices_head, entries) {
665         if (section->mr == kd->mr) {
666             kd->kda.addr = section->offset_within_address_space;
667         }
668     }
669 }
670 
671 static void kvm_arm_devlistener_del(MemoryListener *listener,
672                                     MemoryRegionSection *section)
673 {
674     KVMDevice *kd;
675 
676     QSLIST_FOREACH(kd, &kvm_devices_head, entries) {
677         if (section->mr == kd->mr) {
678             kd->kda.addr = -1;
679         }
680     }
681 }
682 
683 static MemoryListener devlistener = {
684     .name = "kvm-arm",
685     .region_add = kvm_arm_devlistener_add,
686     .region_del = kvm_arm_devlistener_del,
687     .priority = MEMORY_LISTENER_PRIORITY_MIN,
688 };
689 
690 static void kvm_arm_set_device_addr(KVMDevice *kd)
691 {
692     struct kvm_device_attr *attr = &kd->kdattr;
693     int ret;
694 
695     /* If the device control API is available and we have a device fd on the
696      * KVMDevice struct, let's use the newer API
697      */
698     if (kd->dev_fd >= 0) {
699         uint64_t addr = kd->kda.addr;
700 
701         addr |= kd->kda_addr_ormask;
702         attr->addr = (uintptr_t)&addr;
703         ret = kvm_device_ioctl(kd->dev_fd, KVM_SET_DEVICE_ATTR, attr);
704     } else {
705         ret = kvm_vm_ioctl(kvm_state, KVM_ARM_SET_DEVICE_ADDR, &kd->kda);
706     }
707 
708     if (ret < 0) {
709         fprintf(stderr, "Failed to set device address: %s\n",
710                 strerror(-ret));
711         abort();
712     }
713 }
714 
715 static void kvm_arm_machine_init_done(Notifier *notifier, void *data)
716 {
717     KVMDevice *kd, *tkd;
718 
719     QSLIST_FOREACH_SAFE(kd, &kvm_devices_head, entries, tkd) {
720         if (kd->kda.addr != -1) {
721             kvm_arm_set_device_addr(kd);
722         }
723         memory_region_unref(kd->mr);
724         QSLIST_REMOVE_HEAD(&kvm_devices_head, entries);
725         g_free(kd);
726     }
727     memory_listener_unregister(&devlistener);
728 }
729 
730 static Notifier notify = {
731     .notify = kvm_arm_machine_init_done,
732 };
733 
734 void kvm_arm_register_device(MemoryRegion *mr, uint64_t devid, uint64_t group,
735                              uint64_t attr, int dev_fd, uint64_t addr_ormask)
736 {
737     KVMDevice *kd;
738 
739     if (!kvm_irqchip_in_kernel()) {
740         return;
741     }
742 
743     if (QSLIST_EMPTY(&kvm_devices_head)) {
744         memory_listener_register(&devlistener, &address_space_memory);
745         qemu_add_machine_init_done_notifier(&notify);
746     }
747     kd = g_new0(KVMDevice, 1);
748     kd->mr = mr;
749     kd->kda.id = devid;
750     kd->kda.addr = -1;
751     kd->kdattr.flags = 0;
752     kd->kdattr.group = group;
753     kd->kdattr.attr = attr;
754     kd->dev_fd = dev_fd;
755     kd->kda_addr_ormask = addr_ormask;
756     QSLIST_INSERT_HEAD(&kvm_devices_head, kd, entries);
757     memory_region_ref(kd->mr);
758 }
759 
760 static int compare_u64(const void *a, const void *b)
761 {
762     if (*(uint64_t *)a > *(uint64_t *)b) {
763         return 1;
764     }
765     if (*(uint64_t *)a < *(uint64_t *)b) {
766         return -1;
767     }
768     return 0;
769 }
770 
771 /*
772  * cpreg_values are sorted in ascending order by KVM register ID
773  * (see kvm_arm_init_cpreg_list). This allows us to cheaply find
774  * the storage for a KVM register by ID with a binary search.
775  */
776 static uint64_t *kvm_arm_get_cpreg_ptr(ARMCPU *cpu, uint64_t regidx)
777 {
778     uint64_t *res;
779 
780     res = bsearch(&regidx, cpu->cpreg_indexes, cpu->cpreg_array_len,
781                   sizeof(uint64_t), compare_u64);
782     assert(res);
783 
784     return &cpu->cpreg_values[res - cpu->cpreg_indexes];
785 }
786 
787 /**
788  * kvm_arm_reg_syncs_via_cpreg_list:
789  * @regidx: KVM register index
790  *
791  * Return true if this KVM register should be synchronized via the
792  * cpreg list of arbitrary system registers, false if it is synchronized
793  * by hand using code in kvm_arch_get/put_registers().
794  */
795 static bool kvm_arm_reg_syncs_via_cpreg_list(uint64_t regidx)
796 {
797     switch (regidx & KVM_REG_ARM_COPROC_MASK) {
798     case KVM_REG_ARM_CORE:
799     case KVM_REG_ARM64_SVE:
800         return false;
801     default:
802         return true;
803     }
804 }
805 
806 /**
807  * kvm_arm_init_cpreg_list:
808  * @cpu: ARMCPU
809  *
810  * Initialize the ARMCPU cpreg list according to the kernel's
811  * definition of what CPU registers it knows about (and throw away
812  * the previous TCG-created cpreg list).
813  *
814  * Returns: 0 if success, else < 0 error code
815  */
816 static int kvm_arm_init_cpreg_list(ARMCPU *cpu)
817 {
818     struct kvm_reg_list rl;
819     struct kvm_reg_list *rlp;
820     int i, ret, arraylen;
821     CPUState *cs = CPU(cpu);
822 
823     rl.n = 0;
824     ret = kvm_vcpu_ioctl(cs, KVM_GET_REG_LIST, &rl);
825     if (ret != -E2BIG) {
826         return ret;
827     }
828     rlp = g_malloc(sizeof(struct kvm_reg_list) + rl.n * sizeof(uint64_t));
829     rlp->n = rl.n;
830     ret = kvm_vcpu_ioctl(cs, KVM_GET_REG_LIST, rlp);
831     if (ret) {
832         goto out;
833     }
834     /* Sort the list we get back from the kernel, since cpreg_tuples
835      * must be in strictly ascending order.
836      */
837     qsort(&rlp->reg, rlp->n, sizeof(rlp->reg[0]), compare_u64);
838 
839     for (i = 0, arraylen = 0; i < rlp->n; i++) {
840         if (!kvm_arm_reg_syncs_via_cpreg_list(rlp->reg[i])) {
841             continue;
842         }
843         switch (rlp->reg[i] & KVM_REG_SIZE_MASK) {
844         case KVM_REG_SIZE_U32:
845         case KVM_REG_SIZE_U64:
846             break;
847         default:
848             fprintf(stderr, "Can't handle size of register in kernel list\n");
849             ret = -EINVAL;
850             goto out;
851         }
852 
853         arraylen++;
854     }
855 
856     cpu->cpreg_indexes = g_renew(uint64_t, cpu->cpreg_indexes, arraylen);
857     cpu->cpreg_values = g_renew(uint64_t, cpu->cpreg_values, arraylen);
858     cpu->cpreg_vmstate_indexes = g_renew(uint64_t, cpu->cpreg_vmstate_indexes,
859                                          arraylen);
860     cpu->cpreg_vmstate_values = g_renew(uint64_t, cpu->cpreg_vmstate_values,
861                                         arraylen);
862     cpu->cpreg_array_len = arraylen;
863     cpu->cpreg_vmstate_array_len = arraylen;
864 
865     for (i = 0, arraylen = 0; i < rlp->n; i++) {
866         uint64_t regidx = rlp->reg[i];
867         if (!kvm_arm_reg_syncs_via_cpreg_list(regidx)) {
868             continue;
869         }
870         cpu->cpreg_indexes[arraylen] = regidx;
871         arraylen++;
872     }
873     assert(cpu->cpreg_array_len == arraylen);
874 
875     if (!write_kvmstate_to_list(cpu)) {
876         /* Shouldn't happen unless kernel is inconsistent about
877          * what registers exist.
878          */
879         fprintf(stderr, "Initial read of kernel register state failed\n");
880         ret = -EINVAL;
881         goto out;
882     }
883 
884 out:
885     g_free(rlp);
886     return ret;
887 }
888 
889 /**
890  * kvm_arm_cpreg_level:
891  * @regidx: KVM register index
892  *
893  * Return the level of this coprocessor/system register.  Return value is
894  * either KVM_PUT_RUNTIME_STATE, KVM_PUT_RESET_STATE, or KVM_PUT_FULL_STATE.
895  */
896 static int kvm_arm_cpreg_level(uint64_t regidx)
897 {
898     /*
899      * All system registers are assumed to be level KVM_PUT_RUNTIME_STATE.
900      * If a register should be written less often, you must add it here
901      * with a state of either KVM_PUT_RESET_STATE or KVM_PUT_FULL_STATE.
902      */
903     switch (regidx) {
904     case KVM_REG_ARM_TIMER_CNT:
905     case KVM_REG_ARM_PTIMER_CNT:
906         return KVM_PUT_FULL_STATE;
907     }
908     return KVM_PUT_RUNTIME_STATE;
909 }
910 
911 bool write_kvmstate_to_list(ARMCPU *cpu)
912 {
913     CPUState *cs = CPU(cpu);
914     int i;
915     bool ok = true;
916 
917     for (i = 0; i < cpu->cpreg_array_len; i++) {
918         uint64_t regidx = cpu->cpreg_indexes[i];
919         uint32_t v32;
920         int ret;
921 
922         switch (regidx & KVM_REG_SIZE_MASK) {
923         case KVM_REG_SIZE_U32:
924             ret = kvm_get_one_reg(cs, regidx, &v32);
925             if (!ret) {
926                 cpu->cpreg_values[i] = v32;
927             }
928             break;
929         case KVM_REG_SIZE_U64:
930             ret = kvm_get_one_reg(cs, regidx, cpu->cpreg_values + i);
931             break;
932         default:
933             g_assert_not_reached();
934         }
935         if (ret) {
936             ok = false;
937         }
938     }
939     return ok;
940 }
941 
942 bool write_list_to_kvmstate(ARMCPU *cpu, int level)
943 {
944     CPUState *cs = CPU(cpu);
945     int i;
946     bool ok = true;
947 
948     for (i = 0; i < cpu->cpreg_array_len; i++) {
949         uint64_t regidx = cpu->cpreg_indexes[i];
950         uint32_t v32;
951         int ret;
952 
953         if (kvm_arm_cpreg_level(regidx) > level) {
954             continue;
955         }
956 
957         switch (regidx & KVM_REG_SIZE_MASK) {
958         case KVM_REG_SIZE_U32:
959             v32 = cpu->cpreg_values[i];
960             ret = kvm_set_one_reg(cs, regidx, &v32);
961             break;
962         case KVM_REG_SIZE_U64:
963             ret = kvm_set_one_reg(cs, regidx, cpu->cpreg_values + i);
964             break;
965         default:
966             g_assert_not_reached();
967         }
968         if (ret) {
969             /* We might fail for "unknown register" and also for
970              * "you tried to set a register which is constant with
971              * a different value from what it actually contains".
972              */
973             ok = false;
974         }
975     }
976     return ok;
977 }
978 
979 void kvm_arm_cpu_pre_save(ARMCPU *cpu)
980 {
981     /* KVM virtual time adjustment */
982     if (cpu->kvm_vtime_dirty) {
983         *kvm_arm_get_cpreg_ptr(cpu, KVM_REG_ARM_TIMER_CNT) = cpu->kvm_vtime;
984     }
985 }
986 
987 void kvm_arm_cpu_post_load(ARMCPU *cpu)
988 {
989     /* KVM virtual time adjustment */
990     if (cpu->kvm_adjvtime) {
991         cpu->kvm_vtime = *kvm_arm_get_cpreg_ptr(cpu, KVM_REG_ARM_TIMER_CNT);
992         cpu->kvm_vtime_dirty = true;
993     }
994 }
995 
996 void kvm_arm_reset_vcpu(ARMCPU *cpu)
997 {
998     int ret;
999 
1000     /* Re-init VCPU so that all registers are set to
1001      * their respective reset values.
1002      */
1003     ret = kvm_arm_vcpu_init(cpu);
1004     if (ret < 0) {
1005         fprintf(stderr, "kvm_arm_vcpu_init failed: %s\n", strerror(-ret));
1006         abort();
1007     }
1008     if (!write_kvmstate_to_list(cpu)) {
1009         fprintf(stderr, "write_kvmstate_to_list failed\n");
1010         abort();
1011     }
1012     /*
1013      * Sync the reset values also into the CPUState. This is necessary
1014      * because the next thing we do will be a kvm_arch_put_registers()
1015      * which will update the list values from the CPUState before copying
1016      * the list values back to KVM. It's OK to ignore failure returns here
1017      * for the same reason we do so in kvm_arch_get_registers().
1018      */
1019     write_list_to_cpustate(cpu);
1020 }
1021 
1022 /*
1023  * Update KVM's MP_STATE based on what QEMU thinks it is
1024  */
1025 static int kvm_arm_sync_mpstate_to_kvm(ARMCPU *cpu)
1026 {
1027     if (cap_has_mp_state) {
1028         struct kvm_mp_state mp_state = {
1029             .mp_state = (cpu->power_state == PSCI_OFF) ?
1030             KVM_MP_STATE_STOPPED : KVM_MP_STATE_RUNNABLE
1031         };
1032         return kvm_vcpu_ioctl(CPU(cpu), KVM_SET_MP_STATE, &mp_state);
1033     }
1034     return 0;
1035 }
1036 
1037 /*
1038  * Sync the KVM MP_STATE into QEMU
1039  */
1040 static int kvm_arm_sync_mpstate_to_qemu(ARMCPU *cpu)
1041 {
1042     if (cap_has_mp_state) {
1043         struct kvm_mp_state mp_state;
1044         int ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_MP_STATE, &mp_state);
1045         if (ret) {
1046             return ret;
1047         }
1048         cpu->power_state = (mp_state.mp_state == KVM_MP_STATE_STOPPED) ?
1049             PSCI_OFF : PSCI_ON;
1050     }
1051     return 0;
1052 }
1053 
1054 /**
1055  * kvm_arm_get_virtual_time:
1056  * @cpu: ARMCPU
1057  *
1058  * Gets the VCPU's virtual counter and stores it in the KVM CPU state.
1059  */
1060 static void kvm_arm_get_virtual_time(ARMCPU *cpu)
1061 {
1062     int ret;
1063 
1064     if (cpu->kvm_vtime_dirty) {
1065         return;
1066     }
1067 
1068     ret = kvm_get_one_reg(CPU(cpu), KVM_REG_ARM_TIMER_CNT, &cpu->kvm_vtime);
1069     if (ret) {
1070         error_report("Failed to get KVM_REG_ARM_TIMER_CNT");
1071         abort();
1072     }
1073 
1074     cpu->kvm_vtime_dirty = true;
1075 }
1076 
1077 /**
1078  * kvm_arm_put_virtual_time:
1079  * @cpu: ARMCPU
1080  *
1081  * Sets the VCPU's virtual counter to the value stored in the KVM CPU state.
1082  */
1083 static void kvm_arm_put_virtual_time(ARMCPU *cpu)
1084 {
1085     int ret;
1086 
1087     if (!cpu->kvm_vtime_dirty) {
1088         return;
1089     }
1090 
1091     ret = kvm_set_one_reg(CPU(cpu), KVM_REG_ARM_TIMER_CNT, &cpu->kvm_vtime);
1092     if (ret) {
1093         error_report("Failed to set KVM_REG_ARM_TIMER_CNT");
1094         abort();
1095     }
1096 
1097     cpu->kvm_vtime_dirty = false;
1098 }
1099 
1100 /**
1101  * kvm_put_vcpu_events:
1102  * @cpu: ARMCPU
1103  *
1104  * Put VCPU related state to kvm.
1105  *
1106  * Returns: 0 if success else < 0 error code
1107  */
1108 static int kvm_put_vcpu_events(ARMCPU *cpu)
1109 {
1110     CPUARMState *env = &cpu->env;
1111     struct kvm_vcpu_events events;
1112     int ret;
1113 
1114     if (!kvm_has_vcpu_events()) {
1115         return 0;
1116     }
1117 
1118     memset(&events, 0, sizeof(events));
1119     events.exception.serror_pending = env->serror.pending;
1120 
1121     /* Inject SError to guest with specified syndrome if host kernel
1122      * supports it, otherwise inject SError without syndrome.
1123      */
1124     if (cap_has_inject_serror_esr) {
1125         events.exception.serror_has_esr = env->serror.has_esr;
1126         events.exception.serror_esr = env->serror.esr;
1127     }
1128 
1129     ret = kvm_vcpu_ioctl(CPU(cpu), KVM_SET_VCPU_EVENTS, &events);
1130     if (ret) {
1131         error_report("failed to put vcpu events");
1132     }
1133 
1134     return ret;
1135 }
1136 
1137 /**
1138  * kvm_get_vcpu_events:
1139  * @cpu: ARMCPU
1140  *
1141  * Get VCPU related state from kvm.
1142  *
1143  * Returns: 0 if success else < 0 error code
1144  */
1145 static int kvm_get_vcpu_events(ARMCPU *cpu)
1146 {
1147     CPUARMState *env = &cpu->env;
1148     struct kvm_vcpu_events events;
1149     int ret;
1150 
1151     if (!kvm_has_vcpu_events()) {
1152         return 0;
1153     }
1154 
1155     memset(&events, 0, sizeof(events));
1156     ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_VCPU_EVENTS, &events);
1157     if (ret) {
1158         error_report("failed to get vcpu events");
1159         return ret;
1160     }
1161 
1162     env->serror.pending = events.exception.serror_pending;
1163     env->serror.has_esr = events.exception.serror_has_esr;
1164     env->serror.esr = events.exception.serror_esr;
1165 
1166     return 0;
1167 }
1168 
1169 #define ARM64_REG_ESR_EL1 ARM64_SYS_REG(3, 0, 5, 2, 0)
1170 #define ARM64_REG_TCR_EL1 ARM64_SYS_REG(3, 0, 2, 0, 2)
1171 
1172 /*
1173  * ESR_EL1
1174  * ISS encoding
1175  * AARCH64: DFSC,   bits [5:0]
1176  * AARCH32:
1177  *      TTBCR.EAE == 0
1178  *          FS[4]   - DFSR[10]
1179  *          FS[3:0] - DFSR[3:0]
1180  *      TTBCR.EAE == 1
1181  *          FS, bits [5:0]
1182  */
1183 #define ESR_DFSC(aarch64, lpae, v)        \
1184     ((aarch64 || (lpae)) ? ((v) & 0x3F)   \
1185                : (((v) >> 6) | ((v) & 0x1F)))
1186 
1187 #define ESR_DFSC_EXTABT(aarch64, lpae) \
1188     ((aarch64) ? 0x10 : (lpae) ? 0x10 : 0x8)
1189 
1190 /**
1191  * kvm_arm_verify_ext_dabt_pending:
1192  * @cpu: ARMCPU
1193  *
1194  * Verify the fault status code wrt the Ext DABT injection
1195  *
1196  * Returns: true if the fault status code is as expected, false otherwise
1197  */
1198 static bool kvm_arm_verify_ext_dabt_pending(ARMCPU *cpu)
1199 {
1200     CPUState *cs = CPU(cpu);
1201     uint64_t dfsr_val;
1202 
1203     if (!kvm_get_one_reg(cs, ARM64_REG_ESR_EL1, &dfsr_val)) {
1204         CPUARMState *env = &cpu->env;
1205         int aarch64_mode = arm_feature(env, ARM_FEATURE_AARCH64);
1206         int lpae = 0;
1207 
1208         if (!aarch64_mode) {
1209             uint64_t ttbcr;
1210 
1211             if (!kvm_get_one_reg(cs, ARM64_REG_TCR_EL1, &ttbcr)) {
1212                 lpae = arm_feature(env, ARM_FEATURE_LPAE)
1213                         && (ttbcr & TTBCR_EAE);
1214             }
1215         }
1216         /*
1217          * The verification here is based on the DFSC bits
1218          * of the ESR_EL1 reg only
1219          */
1220          return (ESR_DFSC(aarch64_mode, lpae, dfsr_val) ==
1221                 ESR_DFSC_EXTABT(aarch64_mode, lpae));
1222     }
1223     return false;
1224 }
1225 
1226 void kvm_arch_pre_run(CPUState *cs, struct kvm_run *run)
1227 {
1228     ARMCPU *cpu = ARM_CPU(cs);
1229     CPUARMState *env = &cpu->env;
1230 
1231     if (unlikely(env->ext_dabt_raised)) {
1232         /*
1233          * Verifying that the ext DABT has been properly injected,
1234          * otherwise risking indefinitely re-running the faulting instruction
1235          * Covering a very narrow case for kernels 5.5..5.5.4
1236          * when injected abort was misconfigured to be
1237          * an IMPLEMENTATION DEFINED exception (for 32-bit EL1)
1238          */
1239         if (!arm_feature(env, ARM_FEATURE_AARCH64) &&
1240             unlikely(!kvm_arm_verify_ext_dabt_pending(cpu))) {
1241 
1242             error_report("Data abort exception with no valid ISS generated by "
1243                    "guest memory access. KVM unable to emulate faulting "
1244                    "instruction. Failed to inject an external data abort "
1245                    "into the guest.");
1246             abort();
1247        }
1248        /* Clear the status */
1249        env->ext_dabt_raised = 0;
1250     }
1251 }
1252 
1253 MemTxAttrs kvm_arch_post_run(CPUState *cs, struct kvm_run *run)
1254 {
1255     ARMCPU *cpu;
1256     uint32_t switched_level;
1257 
1258     if (kvm_irqchip_in_kernel()) {
1259         /*
1260          * We only need to sync timer states with user-space interrupt
1261          * controllers, so return early and save cycles if we don't.
1262          */
1263         return MEMTXATTRS_UNSPECIFIED;
1264     }
1265 
1266     cpu = ARM_CPU(cs);
1267 
1268     /* Synchronize our shadowed in-kernel device irq lines with the kvm ones */
1269     if (run->s.regs.device_irq_level != cpu->device_irq_level) {
1270         switched_level = cpu->device_irq_level ^ run->s.regs.device_irq_level;
1271 
1272         bql_lock();
1273 
1274         if (switched_level & KVM_ARM_DEV_EL1_VTIMER) {
1275             qemu_set_irq(cpu->gt_timer_outputs[GTIMER_VIRT],
1276                          !!(run->s.regs.device_irq_level &
1277                             KVM_ARM_DEV_EL1_VTIMER));
1278             switched_level &= ~KVM_ARM_DEV_EL1_VTIMER;
1279         }
1280 
1281         if (switched_level & KVM_ARM_DEV_EL1_PTIMER) {
1282             qemu_set_irq(cpu->gt_timer_outputs[GTIMER_PHYS],
1283                          !!(run->s.regs.device_irq_level &
1284                             KVM_ARM_DEV_EL1_PTIMER));
1285             switched_level &= ~KVM_ARM_DEV_EL1_PTIMER;
1286         }
1287 
1288         if (switched_level & KVM_ARM_DEV_PMU) {
1289             qemu_set_irq(cpu->pmu_interrupt,
1290                          !!(run->s.regs.device_irq_level & KVM_ARM_DEV_PMU));
1291             switched_level &= ~KVM_ARM_DEV_PMU;
1292         }
1293 
1294         if (switched_level) {
1295             qemu_log_mask(LOG_UNIMP, "%s: unhandled in-kernel device IRQ %x\n",
1296                           __func__, switched_level);
1297         }
1298 
1299         /* We also mark unknown levels as processed to not waste cycles */
1300         cpu->device_irq_level = run->s.regs.device_irq_level;
1301         bql_unlock();
1302     }
1303 
1304     return MEMTXATTRS_UNSPECIFIED;
1305 }
1306 
1307 static void kvm_arm_vm_state_change(void *opaque, bool running, RunState state)
1308 {
1309     ARMCPU *cpu = opaque;
1310 
1311     if (running) {
1312         if (cpu->kvm_adjvtime) {
1313             kvm_arm_put_virtual_time(cpu);
1314         }
1315     } else {
1316         if (cpu->kvm_adjvtime) {
1317             kvm_arm_get_virtual_time(cpu);
1318         }
1319     }
1320 }
1321 
1322 /**
1323  * kvm_arm_handle_dabt_nisv:
1324  * @cpu: ARMCPU
1325  * @esr_iss: ISS encoding (limited) for the exception from Data Abort
1326  *           ISV bit set to '0b0' -> no valid instruction syndrome
1327  * @fault_ipa: faulting address for the synchronous data abort
1328  *
1329  * Returns: 0 if the exception has been handled, < 0 otherwise
1330  */
1331 static int kvm_arm_handle_dabt_nisv(ARMCPU *cpu, uint64_t esr_iss,
1332                                     uint64_t fault_ipa)
1333 {
1334     CPUARMState *env = &cpu->env;
1335     /*
1336      * Request KVM to inject the external data abort into the guest
1337      */
1338     if (cap_has_inject_ext_dabt) {
1339         struct kvm_vcpu_events events = { };
1340         /*
1341          * The external data abort event will be handled immediately by KVM
1342          * using the address fault that triggered the exit on given VCPU.
1343          * Requesting injection of the external data abort does not rely
1344          * on any other VCPU state. Therefore, in this particular case, the VCPU
1345          * synchronization can be exceptionally skipped.
1346          */
1347         events.exception.ext_dabt_pending = 1;
1348         /* KVM_CAP_ARM_INJECT_EXT_DABT implies KVM_CAP_VCPU_EVENTS */
1349         if (!kvm_vcpu_ioctl(CPU(cpu), KVM_SET_VCPU_EVENTS, &events)) {
1350             env->ext_dabt_raised = 1;
1351             return 0;
1352         }
1353     } else {
1354         error_report("Data abort exception triggered by guest memory access "
1355                      "at physical address: 0x"  TARGET_FMT_lx,
1356                      (target_ulong)fault_ipa);
1357         error_printf("KVM unable to emulate faulting instruction.\n");
1358     }
1359     return -1;
1360 }
1361 
1362 /**
1363  * kvm_arm_handle_debug:
1364  * @cpu: ARMCPU
1365  * @debug_exit: debug part of the KVM exit structure
1366  *
1367  * Returns: TRUE if the debug exception was handled.
1368  *
1369  * See v8 ARM ARM D7.2.27 ESR_ELx, Exception Syndrome Register
1370  *
1371  * To minimise translating between kernel and user-space the kernel
1372  * ABI just provides user-space with the full exception syndrome
1373  * register value to be decoded in QEMU.
1374  */
1375 static bool kvm_arm_handle_debug(ARMCPU *cpu,
1376                                  struct kvm_debug_exit_arch *debug_exit)
1377 {
1378     int hsr_ec = syn_get_ec(debug_exit->hsr);
1379     CPUState *cs = CPU(cpu);
1380     CPUARMState *env = &cpu->env;
1381 
1382     /* Ensure PC is synchronised */
1383     kvm_cpu_synchronize_state(cs);
1384 
1385     switch (hsr_ec) {
1386     case EC_SOFTWARESTEP:
1387         if (cs->singlestep_enabled) {
1388             return true;
1389         } else {
1390             /*
1391              * The kernel should have suppressed the guest's ability to
1392              * single step at this point so something has gone wrong.
1393              */
1394             error_report("%s: guest single-step while debugging unsupported"
1395                          " (%"PRIx64", %"PRIx32")",
1396                          __func__, env->pc, debug_exit->hsr);
1397             return false;
1398         }
1399         break;
1400     case EC_AA64_BKPT:
1401         if (kvm_find_sw_breakpoint(cs, env->pc)) {
1402             return true;
1403         }
1404         break;
1405     case EC_BREAKPOINT:
1406         if (find_hw_breakpoint(cs, env->pc)) {
1407             return true;
1408         }
1409         break;
1410     case EC_WATCHPOINT:
1411     {
1412         CPUWatchpoint *wp = find_hw_watchpoint(cs, debug_exit->far);
1413         if (wp) {
1414             cs->watchpoint_hit = wp;
1415             return true;
1416         }
1417         break;
1418     }
1419     default:
1420         error_report("%s: unhandled debug exit (%"PRIx32", %"PRIx64")",
1421                      __func__, debug_exit->hsr, env->pc);
1422     }
1423 
1424     /* If we are not handling the debug exception it must belong to
1425      * the guest. Let's re-use the existing TCG interrupt code to set
1426      * everything up properly.
1427      */
1428     cs->exception_index = EXCP_BKPT;
1429     env->exception.syndrome = debug_exit->hsr;
1430     env->exception.vaddress = debug_exit->far;
1431     env->exception.target_el = 1;
1432     bql_lock();
1433     arm_cpu_do_interrupt(cs);
1434     bql_unlock();
1435 
1436     return false;
1437 }
1438 
1439 int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
1440 {
1441     ARMCPU *cpu = ARM_CPU(cs);
1442     int ret = 0;
1443 
1444     switch (run->exit_reason) {
1445     case KVM_EXIT_DEBUG:
1446         if (kvm_arm_handle_debug(cpu, &run->debug.arch)) {
1447             ret = EXCP_DEBUG;
1448         } /* otherwise return to guest */
1449         break;
1450     case KVM_EXIT_ARM_NISV:
1451         /* External DABT with no valid iss to decode */
1452         ret = kvm_arm_handle_dabt_nisv(cpu, run->arm_nisv.esr_iss,
1453                                        run->arm_nisv.fault_ipa);
1454         break;
1455     default:
1456         qemu_log_mask(LOG_UNIMP, "%s: un-handled exit reason %d\n",
1457                       __func__, run->exit_reason);
1458         break;
1459     }
1460     return ret;
1461 }
1462 
1463 bool kvm_arch_stop_on_emulation_error(CPUState *cs)
1464 {
1465     return true;
1466 }
1467 
1468 int kvm_arch_process_async_events(CPUState *cs)
1469 {
1470     return 0;
1471 }
1472 
1473 /**
1474  * kvm_arm_hw_debug_active:
1475  * @cpu: ARMCPU
1476  *
1477  * Return: TRUE if any hardware breakpoints in use.
1478  */
1479 static bool kvm_arm_hw_debug_active(ARMCPU *cpu)
1480 {
1481     return ((cur_hw_wps > 0) || (cur_hw_bps > 0));
1482 }
1483 
1484 /**
1485  * kvm_arm_copy_hw_debug_data:
1486  * @ptr: kvm_guest_debug_arch structure
1487  *
1488  * Copy the architecture specific debug registers into the
1489  * kvm_guest_debug ioctl structure.
1490  */
1491 static void kvm_arm_copy_hw_debug_data(struct kvm_guest_debug_arch *ptr)
1492 {
1493     int i;
1494     memset(ptr, 0, sizeof(struct kvm_guest_debug_arch));
1495 
1496     for (i = 0; i < max_hw_wps; i++) {
1497         HWWatchpoint *wp = get_hw_wp(i);
1498         ptr->dbg_wcr[i] = wp->wcr;
1499         ptr->dbg_wvr[i] = wp->wvr;
1500     }
1501     for (i = 0; i < max_hw_bps; i++) {
1502         HWBreakpoint *bp = get_hw_bp(i);
1503         ptr->dbg_bcr[i] = bp->bcr;
1504         ptr->dbg_bvr[i] = bp->bvr;
1505     }
1506 }
1507 
1508 void kvm_arch_update_guest_debug(CPUState *cs, struct kvm_guest_debug *dbg)
1509 {
1510     if (kvm_sw_breakpoints_active(cs)) {
1511         dbg->control |= KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP;
1512     }
1513     if (kvm_arm_hw_debug_active(ARM_CPU(cs))) {
1514         dbg->control |= KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_HW;
1515         kvm_arm_copy_hw_debug_data(&dbg->arch);
1516     }
1517 }
1518 
1519 void kvm_arch_init_irq_routing(KVMState *s)
1520 {
1521 }
1522 
1523 int kvm_arch_irqchip_create(KVMState *s)
1524 {
1525     if (kvm_kernel_irqchip_split()) {
1526         error_report("-machine kernel_irqchip=split is not supported on ARM.");
1527         exit(1);
1528     }
1529 
1530     /* If we can create the VGIC using the newer device control API, we
1531      * let the device do this when it initializes itself, otherwise we
1532      * fall back to the old API */
1533     return kvm_check_extension(s, KVM_CAP_DEVICE_CTRL);
1534 }
1535 
1536 int kvm_arm_vgic_probe(void)
1537 {
1538     int val = 0;
1539 
1540     if (kvm_create_device(kvm_state,
1541                           KVM_DEV_TYPE_ARM_VGIC_V3, true) == 0) {
1542         val |= KVM_ARM_VGIC_V3;
1543     }
1544     if (kvm_create_device(kvm_state,
1545                           KVM_DEV_TYPE_ARM_VGIC_V2, true) == 0) {
1546         val |= KVM_ARM_VGIC_V2;
1547     }
1548     return val;
1549 }
1550 
1551 int kvm_arm_set_irq(int cpu, int irqtype, int irq, int level)
1552 {
1553     int kvm_irq = (irqtype << KVM_ARM_IRQ_TYPE_SHIFT) | irq;
1554     int cpu_idx1 = cpu % 256;
1555     int cpu_idx2 = cpu / 256;
1556 
1557     kvm_irq |= (cpu_idx1 << KVM_ARM_IRQ_VCPU_SHIFT) |
1558                (cpu_idx2 << KVM_ARM_IRQ_VCPU2_SHIFT);
1559 
1560     return kvm_set_irq(kvm_state, kvm_irq, !!level);
1561 }
1562 
1563 int kvm_arch_fixup_msi_route(struct kvm_irq_routing_entry *route,
1564                              uint64_t address, uint32_t data, PCIDevice *dev)
1565 {
1566     AddressSpace *as = pci_device_iommu_address_space(dev);
1567     hwaddr xlat, len, doorbell_gpa;
1568     MemoryRegionSection mrs;
1569     MemoryRegion *mr;
1570 
1571     if (as == &address_space_memory) {
1572         return 0;
1573     }
1574 
1575     /* MSI doorbell address is translated by an IOMMU */
1576 
1577     RCU_READ_LOCK_GUARD();
1578 
1579     mr = address_space_translate(as, address, &xlat, &len, true,
1580                                  MEMTXATTRS_UNSPECIFIED);
1581 
1582     if (!mr) {
1583         return 1;
1584     }
1585 
1586     mrs = memory_region_find(mr, xlat, 1);
1587 
1588     if (!mrs.mr) {
1589         return 1;
1590     }
1591 
1592     doorbell_gpa = mrs.offset_within_address_space;
1593     memory_region_unref(mrs.mr);
1594 
1595     route->u.msi.address_lo = doorbell_gpa;
1596     route->u.msi.address_hi = doorbell_gpa >> 32;
1597 
1598     trace_kvm_arm_fixup_msi_route(address, doorbell_gpa);
1599 
1600     return 0;
1601 }
1602 
1603 int kvm_arch_add_msi_route_post(struct kvm_irq_routing_entry *route,
1604                                 int vector, PCIDevice *dev)
1605 {
1606     return 0;
1607 }
1608 
1609 int kvm_arch_release_virq_post(int virq)
1610 {
1611     return 0;
1612 }
1613 
1614 int kvm_arch_msi_data_to_gsi(uint32_t data)
1615 {
1616     return (data - 32) & 0xffff;
1617 }
1618 
1619 static void kvm_arch_get_eager_split_size(Object *obj, Visitor *v,
1620                                           const char *name, void *opaque,
1621                                           Error **errp)
1622 {
1623     KVMState *s = KVM_STATE(obj);
1624     uint64_t value = s->kvm_eager_split_size;
1625 
1626     visit_type_size(v, name, &value, errp);
1627 }
1628 
1629 static void kvm_arch_set_eager_split_size(Object *obj, Visitor *v,
1630                                           const char *name, void *opaque,
1631                                           Error **errp)
1632 {
1633     KVMState *s = KVM_STATE(obj);
1634     uint64_t value;
1635 
1636     if (s->fd != -1) {
1637         error_setg(errp, "Unable to set early-split-size after KVM has been initialized");
1638         return;
1639     }
1640 
1641     if (!visit_type_size(v, name, &value, errp)) {
1642         return;
1643     }
1644 
1645     if (value && !is_power_of_2(value)) {
1646         error_setg(errp, "early-split-size must be a power of two");
1647         return;
1648     }
1649 
1650     s->kvm_eager_split_size = value;
1651 }
1652 
1653 void kvm_arch_accel_class_init(ObjectClass *oc)
1654 {
1655     object_class_property_add(oc, "eager-split-size", "size",
1656                               kvm_arch_get_eager_split_size,
1657                               kvm_arch_set_eager_split_size, NULL, NULL);
1658 
1659     object_class_property_set_description(oc, "eager-split-size",
1660         "Eager Page Split chunk size for hugepages. (default: 0, disabled)");
1661 }
1662 
1663 int kvm_arch_insert_hw_breakpoint(vaddr addr, vaddr len, int type)
1664 {
1665     switch (type) {
1666     case GDB_BREAKPOINT_HW:
1667         return insert_hw_breakpoint(addr);
1668         break;
1669     case GDB_WATCHPOINT_READ:
1670     case GDB_WATCHPOINT_WRITE:
1671     case GDB_WATCHPOINT_ACCESS:
1672         return insert_hw_watchpoint(addr, len, type);
1673     default:
1674         return -ENOSYS;
1675     }
1676 }
1677 
1678 int kvm_arch_remove_hw_breakpoint(vaddr addr, vaddr len, int type)
1679 {
1680     switch (type) {
1681     case GDB_BREAKPOINT_HW:
1682         return delete_hw_breakpoint(addr);
1683     case GDB_WATCHPOINT_READ:
1684     case GDB_WATCHPOINT_WRITE:
1685     case GDB_WATCHPOINT_ACCESS:
1686         return delete_hw_watchpoint(addr, len, type);
1687     default:
1688         return -ENOSYS;
1689     }
1690 }
1691 
1692 void kvm_arch_remove_all_hw_breakpoints(void)
1693 {
1694     if (cur_hw_wps > 0) {
1695         g_array_remove_range(hw_watchpoints, 0, cur_hw_wps);
1696     }
1697     if (cur_hw_bps > 0) {
1698         g_array_remove_range(hw_breakpoints, 0, cur_hw_bps);
1699     }
1700 }
1701 
1702 static bool kvm_arm_set_device_attr(ARMCPU *cpu, struct kvm_device_attr *attr,
1703                                     const char *name)
1704 {
1705     int err;
1706 
1707     err = kvm_vcpu_ioctl(CPU(cpu), KVM_HAS_DEVICE_ATTR, attr);
1708     if (err != 0) {
1709         error_report("%s: KVM_HAS_DEVICE_ATTR: %s", name, strerror(-err));
1710         return false;
1711     }
1712 
1713     err = kvm_vcpu_ioctl(CPU(cpu), KVM_SET_DEVICE_ATTR, attr);
1714     if (err != 0) {
1715         error_report("%s: KVM_SET_DEVICE_ATTR: %s", name, strerror(-err));
1716         return false;
1717     }
1718 
1719     return true;
1720 }
1721 
1722 void kvm_arm_pmu_init(ARMCPU *cpu)
1723 {
1724     struct kvm_device_attr attr = {
1725         .group = KVM_ARM_VCPU_PMU_V3_CTRL,
1726         .attr = KVM_ARM_VCPU_PMU_V3_INIT,
1727     };
1728 
1729     if (!cpu->has_pmu) {
1730         return;
1731     }
1732     if (!kvm_arm_set_device_attr(cpu, &attr, "PMU")) {
1733         error_report("failed to init PMU");
1734         abort();
1735     }
1736 }
1737 
1738 void kvm_arm_pmu_set_irq(ARMCPU *cpu, int irq)
1739 {
1740     struct kvm_device_attr attr = {
1741         .group = KVM_ARM_VCPU_PMU_V3_CTRL,
1742         .addr = (intptr_t)&irq,
1743         .attr = KVM_ARM_VCPU_PMU_V3_IRQ,
1744     };
1745 
1746     if (!cpu->has_pmu) {
1747         return;
1748     }
1749     if (!kvm_arm_set_device_attr(cpu, &attr, "PMU")) {
1750         error_report("failed to set irq for PMU");
1751         abort();
1752     }
1753 }
1754 
1755 void kvm_arm_pvtime_init(ARMCPU *cpu, uint64_t ipa)
1756 {
1757     struct kvm_device_attr attr = {
1758         .group = KVM_ARM_VCPU_PVTIME_CTRL,
1759         .attr = KVM_ARM_VCPU_PVTIME_IPA,
1760         .addr = (uint64_t)&ipa,
1761     };
1762 
1763     if (cpu->kvm_steal_time == ON_OFF_AUTO_OFF) {
1764         return;
1765     }
1766     if (!kvm_arm_set_device_attr(cpu, &attr, "PVTIME IPA")) {
1767         error_report("failed to init PVTIME IPA");
1768         abort();
1769     }
1770 }
1771 
1772 void kvm_arm_steal_time_finalize(ARMCPU *cpu, Error **errp)
1773 {
1774     bool has_steal_time = kvm_check_extension(kvm_state, KVM_CAP_STEAL_TIME);
1775 
1776     if (cpu->kvm_steal_time == ON_OFF_AUTO_AUTO) {
1777         if (!has_steal_time || !arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
1778             cpu->kvm_steal_time = ON_OFF_AUTO_OFF;
1779         } else {
1780             cpu->kvm_steal_time = ON_OFF_AUTO_ON;
1781         }
1782     } else if (cpu->kvm_steal_time == ON_OFF_AUTO_ON) {
1783         if (!has_steal_time) {
1784             error_setg(errp, "'kvm-steal-time' cannot be enabled "
1785                              "on this host");
1786             return;
1787         } else if (!arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
1788             /*
1789              * DEN0057A chapter 2 says "This specification only covers
1790              * systems in which the Execution state of the hypervisor
1791              * as well as EL1 of virtual machines is AArch64.". And,
1792              * to ensure that, the smc/hvc calls are only specified as
1793              * smc64/hvc64.
1794              */
1795             error_setg(errp, "'kvm-steal-time' cannot be enabled "
1796                              "for AArch32 guests");
1797             return;
1798         }
1799     }
1800 }
1801 
1802 bool kvm_arm_aarch32_supported(void)
1803 {
1804     return kvm_check_extension(kvm_state, KVM_CAP_ARM_EL1_32BIT);
1805 }
1806 
1807 bool kvm_arm_sve_supported(void)
1808 {
1809     return kvm_check_extension(kvm_state, KVM_CAP_ARM_SVE);
1810 }
1811 
1812 bool kvm_arm_mte_supported(void)
1813 {
1814     return kvm_check_extension(kvm_state, KVM_CAP_ARM_MTE);
1815 }
1816 
1817 QEMU_BUILD_BUG_ON(KVM_ARM64_SVE_VQ_MIN != 1);
1818 
1819 uint32_t kvm_arm_sve_get_vls(ARMCPU *cpu)
1820 {
1821     /* Only call this function if kvm_arm_sve_supported() returns true. */
1822     static uint64_t vls[KVM_ARM64_SVE_VLS_WORDS];
1823     static bool probed;
1824     uint32_t vq = 0;
1825     int i;
1826 
1827     /*
1828      * KVM ensures all host CPUs support the same set of vector lengths.
1829      * So we only need to create the scratch VCPUs once and then cache
1830      * the results.
1831      */
1832     if (!probed) {
1833         struct kvm_vcpu_init init = {
1834             .target = -1,
1835             .features[0] = (1 << KVM_ARM_VCPU_SVE),
1836         };
1837         struct kvm_one_reg reg = {
1838             .id = KVM_REG_ARM64_SVE_VLS,
1839             .addr = (uint64_t)&vls[0],
1840         };
1841         int fdarray[3], ret;
1842 
1843         probed = true;
1844 
1845         if (!kvm_arm_create_scratch_host_vcpu(NULL, fdarray, &init)) {
1846             error_report("failed to create scratch VCPU with SVE enabled");
1847             abort();
1848         }
1849         ret = ioctl(fdarray[2], KVM_GET_ONE_REG, &reg);
1850         kvm_arm_destroy_scratch_host_vcpu(fdarray);
1851         if (ret) {
1852             error_report("failed to get KVM_REG_ARM64_SVE_VLS: %s",
1853                          strerror(errno));
1854             abort();
1855         }
1856 
1857         for (i = KVM_ARM64_SVE_VLS_WORDS - 1; i >= 0; --i) {
1858             if (vls[i]) {
1859                 vq = 64 - clz64(vls[i]) + i * 64;
1860                 break;
1861             }
1862         }
1863         if (vq > ARM_MAX_VQ) {
1864             warn_report("KVM supports vector lengths larger than "
1865                         "QEMU can enable");
1866             vls[0] &= MAKE_64BIT_MASK(0, ARM_MAX_VQ);
1867         }
1868     }
1869 
1870     return vls[0];
1871 }
1872 
1873 static int kvm_arm_sve_set_vls(ARMCPU *cpu)
1874 {
1875     uint64_t vls[KVM_ARM64_SVE_VLS_WORDS] = { cpu->sve_vq.map };
1876 
1877     assert(cpu->sve_max_vq <= KVM_ARM64_SVE_VQ_MAX);
1878 
1879     return kvm_set_one_reg(CPU(cpu), KVM_REG_ARM64_SVE_VLS, &vls[0]);
1880 }
1881 
1882 #define ARM_CPU_ID_MPIDR       3, 0, 0, 0, 5
1883 
1884 int kvm_arch_init_vcpu(CPUState *cs)
1885 {
1886     int ret;
1887     uint64_t mpidr;
1888     ARMCPU *cpu = ARM_CPU(cs);
1889     CPUARMState *env = &cpu->env;
1890     uint64_t psciver;
1891 
1892     if (cpu->kvm_target == QEMU_KVM_ARM_TARGET_NONE ||
1893         !object_dynamic_cast(OBJECT(cpu), TYPE_AARCH64_CPU)) {
1894         error_report("KVM is not supported for this guest CPU type");
1895         return -EINVAL;
1896     }
1897 
1898     qemu_add_vm_change_state_handler(kvm_arm_vm_state_change, cpu);
1899 
1900     /* Determine init features for this CPU */
1901     memset(cpu->kvm_init_features, 0, sizeof(cpu->kvm_init_features));
1902     if (cs->start_powered_off) {
1903         cpu->kvm_init_features[0] |= 1 << KVM_ARM_VCPU_POWER_OFF;
1904     }
1905     if (kvm_check_extension(cs->kvm_state, KVM_CAP_ARM_PSCI_0_2)) {
1906         cpu->psci_version = QEMU_PSCI_VERSION_0_2;
1907         cpu->kvm_init_features[0] |= 1 << KVM_ARM_VCPU_PSCI_0_2;
1908     }
1909     if (!arm_feature(env, ARM_FEATURE_AARCH64)) {
1910         cpu->kvm_init_features[0] |= 1 << KVM_ARM_VCPU_EL1_32BIT;
1911     }
1912     if (cpu->has_pmu) {
1913         cpu->kvm_init_features[0] |= 1 << KVM_ARM_VCPU_PMU_V3;
1914     }
1915     if (cpu_isar_feature(aa64_sve, cpu)) {
1916         assert(kvm_arm_sve_supported());
1917         cpu->kvm_init_features[0] |= 1 << KVM_ARM_VCPU_SVE;
1918     }
1919     if (cpu_isar_feature(aa64_pauth, cpu)) {
1920         cpu->kvm_init_features[0] |= (1 << KVM_ARM_VCPU_PTRAUTH_ADDRESS |
1921                                       1 << KVM_ARM_VCPU_PTRAUTH_GENERIC);
1922     }
1923 
1924     /* Do KVM_ARM_VCPU_INIT ioctl */
1925     ret = kvm_arm_vcpu_init(cpu);
1926     if (ret) {
1927         return ret;
1928     }
1929 
1930     if (cpu_isar_feature(aa64_sve, cpu)) {
1931         ret = kvm_arm_sve_set_vls(cpu);
1932         if (ret) {
1933             return ret;
1934         }
1935         ret = kvm_arm_vcpu_finalize(cpu, KVM_ARM_VCPU_SVE);
1936         if (ret) {
1937             return ret;
1938         }
1939     }
1940 
1941     /*
1942      * KVM reports the exact PSCI version it is implementing via a
1943      * special sysreg. If it is present, use its contents to determine
1944      * what to report to the guest in the dtb (it is the PSCI version,
1945      * in the same 15-bits major 16-bits minor format that PSCI_VERSION
1946      * returns).
1947      */
1948     if (!kvm_get_one_reg(cs, KVM_REG_ARM_PSCI_VERSION, &psciver)) {
1949         cpu->psci_version = psciver;
1950     }
1951 
1952     /*
1953      * When KVM is in use, PSCI is emulated in-kernel and not by qemu.
1954      * Currently KVM has its own idea about MPIDR assignment, so we
1955      * override our defaults with what we get from KVM.
1956      */
1957     ret = kvm_get_one_reg(cs, ARM64_SYS_REG(ARM_CPU_ID_MPIDR), &mpidr);
1958     if (ret) {
1959         return ret;
1960     }
1961     cpu->mp_affinity = mpidr & ARM64_AFFINITY_MASK;
1962 
1963     return kvm_arm_init_cpreg_list(cpu);
1964 }
1965 
1966 int kvm_arch_destroy_vcpu(CPUState *cs)
1967 {
1968     return 0;
1969 }
1970 
1971 /* Callers must hold the iothread mutex lock */
1972 static void kvm_inject_arm_sea(CPUState *c)
1973 {
1974     ARMCPU *cpu = ARM_CPU(c);
1975     CPUARMState *env = &cpu->env;
1976     uint32_t esr;
1977     bool same_el;
1978 
1979     c->exception_index = EXCP_DATA_ABORT;
1980     env->exception.target_el = 1;
1981 
1982     /*
1983      * Set the DFSC to synchronous external abort and set FnV to not valid,
1984      * this will tell guest the FAR_ELx is UNKNOWN for this abort.
1985      */
1986     same_el = arm_current_el(env) == env->exception.target_el;
1987     esr = syn_data_abort_no_iss(same_el, 1, 0, 0, 0, 0, 0x10);
1988 
1989     env->exception.syndrome = esr;
1990 
1991     arm_cpu_do_interrupt(c);
1992 }
1993 
1994 #define AARCH64_CORE_REG(x)   (KVM_REG_ARM64 | KVM_REG_SIZE_U64 | \
1995                  KVM_REG_ARM_CORE | KVM_REG_ARM_CORE_REG(x))
1996 
1997 #define AARCH64_SIMD_CORE_REG(x)   (KVM_REG_ARM64 | KVM_REG_SIZE_U128 | \
1998                  KVM_REG_ARM_CORE | KVM_REG_ARM_CORE_REG(x))
1999 
2000 #define AARCH64_SIMD_CTRL_REG(x)   (KVM_REG_ARM64 | KVM_REG_SIZE_U32 | \
2001                  KVM_REG_ARM_CORE | KVM_REG_ARM_CORE_REG(x))
2002 
2003 static int kvm_arch_put_fpsimd(CPUState *cs)
2004 {
2005     CPUARMState *env = &ARM_CPU(cs)->env;
2006     int i, ret;
2007 
2008     for (i = 0; i < 32; i++) {
2009         uint64_t *q = aa64_vfp_qreg(env, i);
2010 #if HOST_BIG_ENDIAN
2011         uint64_t fp_val[2] = { q[1], q[0] };
2012         ret = kvm_set_one_reg(cs, AARCH64_SIMD_CORE_REG(fp_regs.vregs[i]),
2013                                                         fp_val);
2014 #else
2015         ret = kvm_set_one_reg(cs, AARCH64_SIMD_CORE_REG(fp_regs.vregs[i]), q);
2016 #endif
2017         if (ret) {
2018             return ret;
2019         }
2020     }
2021 
2022     return 0;
2023 }
2024 
2025 /*
2026  * KVM SVE registers come in slices where ZREGs have a slice size of 2048 bits
2027  * and PREGS and the FFR have a slice size of 256 bits. However we simply hard
2028  * code the slice index to zero for now as it's unlikely we'll need more than
2029  * one slice for quite some time.
2030  */
2031 static int kvm_arch_put_sve(CPUState *cs)
2032 {
2033     ARMCPU *cpu = ARM_CPU(cs);
2034     CPUARMState *env = &cpu->env;
2035     uint64_t tmp[ARM_MAX_VQ * 2];
2036     uint64_t *r;
2037     int n, ret;
2038 
2039     for (n = 0; n < KVM_ARM64_SVE_NUM_ZREGS; ++n) {
2040         r = sve_bswap64(tmp, &env->vfp.zregs[n].d[0], cpu->sve_max_vq * 2);
2041         ret = kvm_set_one_reg(cs, KVM_REG_ARM64_SVE_ZREG(n, 0), r);
2042         if (ret) {
2043             return ret;
2044         }
2045     }
2046 
2047     for (n = 0; n < KVM_ARM64_SVE_NUM_PREGS; ++n) {
2048         r = sve_bswap64(tmp, r = &env->vfp.pregs[n].p[0],
2049                         DIV_ROUND_UP(cpu->sve_max_vq * 2, 8));
2050         ret = kvm_set_one_reg(cs, KVM_REG_ARM64_SVE_PREG(n, 0), r);
2051         if (ret) {
2052             return ret;
2053         }
2054     }
2055 
2056     r = sve_bswap64(tmp, &env->vfp.pregs[FFR_PRED_NUM].p[0],
2057                     DIV_ROUND_UP(cpu->sve_max_vq * 2, 8));
2058     ret = kvm_set_one_reg(cs, KVM_REG_ARM64_SVE_FFR(0), r);
2059     if (ret) {
2060         return ret;
2061     }
2062 
2063     return 0;
2064 }
2065 
2066 int kvm_arch_put_registers(CPUState *cs, int level, Error **errp)
2067 {
2068     uint64_t val;
2069     uint32_t fpr;
2070     int i, ret;
2071     unsigned int el;
2072 
2073     ARMCPU *cpu = ARM_CPU(cs);
2074     CPUARMState *env = &cpu->env;
2075 
2076     /* If we are in AArch32 mode then we need to copy the AArch32 regs to the
2077      * AArch64 registers before pushing them out to 64-bit KVM.
2078      */
2079     if (!is_a64(env)) {
2080         aarch64_sync_32_to_64(env);
2081     }
2082 
2083     for (i = 0; i < 31; i++) {
2084         ret = kvm_set_one_reg(cs, AARCH64_CORE_REG(regs.regs[i]),
2085                               &env->xregs[i]);
2086         if (ret) {
2087             return ret;
2088         }
2089     }
2090 
2091     /* KVM puts SP_EL0 in regs.sp and SP_EL1 in regs.sp_el1. On the
2092      * QEMU side we keep the current SP in xregs[31] as well.
2093      */
2094     aarch64_save_sp(env, 1);
2095 
2096     ret = kvm_set_one_reg(cs, AARCH64_CORE_REG(regs.sp), &env->sp_el[0]);
2097     if (ret) {
2098         return ret;
2099     }
2100 
2101     ret = kvm_set_one_reg(cs, AARCH64_CORE_REG(sp_el1), &env->sp_el[1]);
2102     if (ret) {
2103         return ret;
2104     }
2105 
2106     /* Note that KVM thinks pstate is 64 bit but we use a uint32_t */
2107     if (is_a64(env)) {
2108         val = pstate_read(env);
2109     } else {
2110         val = cpsr_read(env);
2111     }
2112     ret = kvm_set_one_reg(cs, AARCH64_CORE_REG(regs.pstate), &val);
2113     if (ret) {
2114         return ret;
2115     }
2116 
2117     ret = kvm_set_one_reg(cs, AARCH64_CORE_REG(regs.pc), &env->pc);
2118     if (ret) {
2119         return ret;
2120     }
2121 
2122     ret = kvm_set_one_reg(cs, AARCH64_CORE_REG(elr_el1), &env->elr_el[1]);
2123     if (ret) {
2124         return ret;
2125     }
2126 
2127     /* Saved Program State Registers
2128      *
2129      * Before we restore from the banked_spsr[] array we need to
2130      * ensure that any modifications to env->spsr are correctly
2131      * reflected in the banks.
2132      */
2133     el = arm_current_el(env);
2134     if (el > 0 && !is_a64(env)) {
2135         i = bank_number(env->uncached_cpsr & CPSR_M);
2136         env->banked_spsr[i] = env->spsr;
2137     }
2138 
2139     /* KVM 0-4 map to QEMU banks 1-5 */
2140     for (i = 0; i < KVM_NR_SPSR; i++) {
2141         ret = kvm_set_one_reg(cs, AARCH64_CORE_REG(spsr[i]),
2142                               &env->banked_spsr[i + 1]);
2143         if (ret) {
2144             return ret;
2145         }
2146     }
2147 
2148     if (cpu_isar_feature(aa64_sve, cpu)) {
2149         ret = kvm_arch_put_sve(cs);
2150     } else {
2151         ret = kvm_arch_put_fpsimd(cs);
2152     }
2153     if (ret) {
2154         return ret;
2155     }
2156 
2157     fpr = vfp_get_fpsr(env);
2158     ret = kvm_set_one_reg(cs, AARCH64_SIMD_CTRL_REG(fp_regs.fpsr), &fpr);
2159     if (ret) {
2160         return ret;
2161     }
2162 
2163     fpr = vfp_get_fpcr(env);
2164     ret = kvm_set_one_reg(cs, AARCH64_SIMD_CTRL_REG(fp_regs.fpcr), &fpr);
2165     if (ret) {
2166         return ret;
2167     }
2168 
2169     write_cpustate_to_list(cpu, true);
2170 
2171     if (!write_list_to_kvmstate(cpu, level)) {
2172         return -EINVAL;
2173     }
2174 
2175    /*
2176     * Setting VCPU events should be triggered after syncing the registers
2177     * to avoid overwriting potential changes made by KVM upon calling
2178     * KVM_SET_VCPU_EVENTS ioctl
2179     */
2180     ret = kvm_put_vcpu_events(cpu);
2181     if (ret) {
2182         return ret;
2183     }
2184 
2185     return kvm_arm_sync_mpstate_to_kvm(cpu);
2186 }
2187 
2188 static int kvm_arch_get_fpsimd(CPUState *cs)
2189 {
2190     CPUARMState *env = &ARM_CPU(cs)->env;
2191     int i, ret;
2192 
2193     for (i = 0; i < 32; i++) {
2194         uint64_t *q = aa64_vfp_qreg(env, i);
2195         ret = kvm_get_one_reg(cs, AARCH64_SIMD_CORE_REG(fp_regs.vregs[i]), q);
2196         if (ret) {
2197             return ret;
2198         } else {
2199 #if HOST_BIG_ENDIAN
2200             uint64_t t;
2201             t = q[0], q[0] = q[1], q[1] = t;
2202 #endif
2203         }
2204     }
2205 
2206     return 0;
2207 }
2208 
2209 /*
2210  * KVM SVE registers come in slices where ZREGs have a slice size of 2048 bits
2211  * and PREGS and the FFR have a slice size of 256 bits. However we simply hard
2212  * code the slice index to zero for now as it's unlikely we'll need more than
2213  * one slice for quite some time.
2214  */
2215 static int kvm_arch_get_sve(CPUState *cs)
2216 {
2217     ARMCPU *cpu = ARM_CPU(cs);
2218     CPUARMState *env = &cpu->env;
2219     uint64_t *r;
2220     int n, ret;
2221 
2222     for (n = 0; n < KVM_ARM64_SVE_NUM_ZREGS; ++n) {
2223         r = &env->vfp.zregs[n].d[0];
2224         ret = kvm_get_one_reg(cs, KVM_REG_ARM64_SVE_ZREG(n, 0), r);
2225         if (ret) {
2226             return ret;
2227         }
2228         sve_bswap64(r, r, cpu->sve_max_vq * 2);
2229     }
2230 
2231     for (n = 0; n < KVM_ARM64_SVE_NUM_PREGS; ++n) {
2232         r = &env->vfp.pregs[n].p[0];
2233         ret = kvm_get_one_reg(cs, KVM_REG_ARM64_SVE_PREG(n, 0), r);
2234         if (ret) {
2235             return ret;
2236         }
2237         sve_bswap64(r, r, DIV_ROUND_UP(cpu->sve_max_vq * 2, 8));
2238     }
2239 
2240     r = &env->vfp.pregs[FFR_PRED_NUM].p[0];
2241     ret = kvm_get_one_reg(cs, KVM_REG_ARM64_SVE_FFR(0), r);
2242     if (ret) {
2243         return ret;
2244     }
2245     sve_bswap64(r, r, DIV_ROUND_UP(cpu->sve_max_vq * 2, 8));
2246 
2247     return 0;
2248 }
2249 
2250 int kvm_arch_get_registers(CPUState *cs, Error **errp)
2251 {
2252     uint64_t val;
2253     unsigned int el;
2254     uint32_t fpr;
2255     int i, ret;
2256 
2257     ARMCPU *cpu = ARM_CPU(cs);
2258     CPUARMState *env = &cpu->env;
2259 
2260     for (i = 0; i < 31; i++) {
2261         ret = kvm_get_one_reg(cs, AARCH64_CORE_REG(regs.regs[i]),
2262                               &env->xregs[i]);
2263         if (ret) {
2264             return ret;
2265         }
2266     }
2267 
2268     ret = kvm_get_one_reg(cs, AARCH64_CORE_REG(regs.sp), &env->sp_el[0]);
2269     if (ret) {
2270         return ret;
2271     }
2272 
2273     ret = kvm_get_one_reg(cs, AARCH64_CORE_REG(sp_el1), &env->sp_el[1]);
2274     if (ret) {
2275         return ret;
2276     }
2277 
2278     ret = kvm_get_one_reg(cs, AARCH64_CORE_REG(regs.pstate), &val);
2279     if (ret) {
2280         return ret;
2281     }
2282 
2283     env->aarch64 = ((val & PSTATE_nRW) == 0);
2284     if (is_a64(env)) {
2285         pstate_write(env, val);
2286     } else {
2287         cpsr_write(env, val, 0xffffffff, CPSRWriteRaw);
2288     }
2289 
2290     /* KVM puts SP_EL0 in regs.sp and SP_EL1 in regs.sp_el1. On the
2291      * QEMU side we keep the current SP in xregs[31] as well.
2292      */
2293     aarch64_restore_sp(env, 1);
2294 
2295     ret = kvm_get_one_reg(cs, AARCH64_CORE_REG(regs.pc), &env->pc);
2296     if (ret) {
2297         return ret;
2298     }
2299 
2300     /* If we are in AArch32 mode then we need to sync the AArch32 regs with the
2301      * incoming AArch64 regs received from 64-bit KVM.
2302      * We must perform this after all of the registers have been acquired from
2303      * the kernel.
2304      */
2305     if (!is_a64(env)) {
2306         aarch64_sync_64_to_32(env);
2307     }
2308 
2309     ret = kvm_get_one_reg(cs, AARCH64_CORE_REG(elr_el1), &env->elr_el[1]);
2310     if (ret) {
2311         return ret;
2312     }
2313 
2314     /* Fetch the SPSR registers
2315      *
2316      * KVM SPSRs 0-4 map to QEMU banks 1-5
2317      */
2318     for (i = 0; i < KVM_NR_SPSR; i++) {
2319         ret = kvm_get_one_reg(cs, AARCH64_CORE_REG(spsr[i]),
2320                               &env->banked_spsr[i + 1]);
2321         if (ret) {
2322             return ret;
2323         }
2324     }
2325 
2326     el = arm_current_el(env);
2327     if (el > 0 && !is_a64(env)) {
2328         i = bank_number(env->uncached_cpsr & CPSR_M);
2329         env->spsr = env->banked_spsr[i];
2330     }
2331 
2332     if (cpu_isar_feature(aa64_sve, cpu)) {
2333         ret = kvm_arch_get_sve(cs);
2334     } else {
2335         ret = kvm_arch_get_fpsimd(cs);
2336     }
2337     if (ret) {
2338         return ret;
2339     }
2340 
2341     ret = kvm_get_one_reg(cs, AARCH64_SIMD_CTRL_REG(fp_regs.fpsr), &fpr);
2342     if (ret) {
2343         return ret;
2344     }
2345     vfp_set_fpsr(env, fpr);
2346 
2347     ret = kvm_get_one_reg(cs, AARCH64_SIMD_CTRL_REG(fp_regs.fpcr), &fpr);
2348     if (ret) {
2349         return ret;
2350     }
2351     vfp_set_fpcr(env, fpr);
2352 
2353     ret = kvm_get_vcpu_events(cpu);
2354     if (ret) {
2355         return ret;
2356     }
2357 
2358     if (!write_kvmstate_to_list(cpu)) {
2359         return -EINVAL;
2360     }
2361     /* Note that it's OK to have registers which aren't in CPUState,
2362      * so we can ignore a failure return here.
2363      */
2364     write_list_to_cpustate(cpu);
2365 
2366     ret = kvm_arm_sync_mpstate_to_qemu(cpu);
2367 
2368     /* TODO: other registers */
2369     return ret;
2370 }
2371 
2372 void kvm_arch_on_sigbus_vcpu(CPUState *c, int code, void *addr)
2373 {
2374     ram_addr_t ram_addr;
2375     hwaddr paddr;
2376 
2377     assert(code == BUS_MCEERR_AR || code == BUS_MCEERR_AO);
2378 
2379     if (acpi_ghes_present() && addr) {
2380         ram_addr = qemu_ram_addr_from_host(addr);
2381         if (ram_addr != RAM_ADDR_INVALID &&
2382             kvm_physical_memory_addr_from_host(c->kvm_state, addr, &paddr)) {
2383             kvm_hwpoison_page_add(ram_addr);
2384             /*
2385              * If this is a BUS_MCEERR_AR, we know we have been called
2386              * synchronously from the vCPU thread, so we can easily
2387              * synchronize the state and inject an error.
2388              *
2389              * TODO: we currently don't tell the guest at all about
2390              * BUS_MCEERR_AO. In that case we might either be being
2391              * called synchronously from the vCPU thread, or a bit
2392              * later from the main thread, so doing the injection of
2393              * the error would be more complicated.
2394              */
2395             if (code == BUS_MCEERR_AR) {
2396                 kvm_cpu_synchronize_state(c);
2397                 if (!acpi_ghes_record_errors(ACPI_HEST_SRC_ID_SEA, paddr)) {
2398                     kvm_inject_arm_sea(c);
2399                 } else {
2400                     error_report("failed to record the error");
2401                     abort();
2402                 }
2403             }
2404             return;
2405         }
2406         if (code == BUS_MCEERR_AO) {
2407             error_report("Hardware memory error at addr %p for memory used by "
2408                 "QEMU itself instead of guest system!", addr);
2409         }
2410     }
2411 
2412     if (code == BUS_MCEERR_AR) {
2413         error_report("Hardware memory error!");
2414         exit(1);
2415     }
2416 }
2417 
2418 /* C6.6.29 BRK instruction */
2419 static const uint32_t brk_insn = 0xd4200000;
2420 
2421 int kvm_arch_insert_sw_breakpoint(CPUState *cs, struct kvm_sw_breakpoint *bp)
2422 {
2423     if (cpu_memory_rw_debug(cs, bp->pc, (uint8_t *)&bp->saved_insn, 4, 0) ||
2424         cpu_memory_rw_debug(cs, bp->pc, (uint8_t *)&brk_insn, 4, 1)) {
2425         return -EINVAL;
2426     }
2427     return 0;
2428 }
2429 
2430 int kvm_arch_remove_sw_breakpoint(CPUState *cs, struct kvm_sw_breakpoint *bp)
2431 {
2432     static uint32_t brk;
2433 
2434     if (cpu_memory_rw_debug(cs, bp->pc, (uint8_t *)&brk, 4, 0) ||
2435         brk != brk_insn ||
2436         cpu_memory_rw_debug(cs, bp->pc, (uint8_t *)&bp->saved_insn, 4, 1)) {
2437         return -EINVAL;
2438     }
2439     return 0;
2440 }
2441 
2442 void kvm_arm_enable_mte(Object *cpuobj, Error **errp)
2443 {
2444     static bool tried_to_enable;
2445     static bool succeeded_to_enable;
2446     Error *mte_migration_blocker = NULL;
2447     ARMCPU *cpu = ARM_CPU(cpuobj);
2448     int ret;
2449 
2450     if (!tried_to_enable) {
2451         /*
2452          * MTE on KVM is enabled on a per-VM basis (and retrying doesn't make
2453          * sense), and we only want a single migration blocker as well.
2454          */
2455         tried_to_enable = true;
2456 
2457         ret = kvm_vm_enable_cap(kvm_state, KVM_CAP_ARM_MTE, 0);
2458         if (ret) {
2459             error_setg_errno(errp, -ret, "Failed to enable KVM_CAP_ARM_MTE");
2460             return;
2461         }
2462 
2463         /* TODO: Add migration support with MTE enabled */
2464         error_setg(&mte_migration_blocker,
2465                    "Live migration disabled due to MTE enabled");
2466         if (migrate_add_blocker(&mte_migration_blocker, errp)) {
2467             error_free(mte_migration_blocker);
2468             return;
2469         }
2470 
2471         succeeded_to_enable = true;
2472     }
2473 
2474     if (succeeded_to_enable) {
2475         cpu->kvm_mte = true;
2476     }
2477 }
2478