xref: /openbmc/qemu/accel/kvm/kvm-all.c (revision 966f2ec3)
1 /*
2  * QEMU KVM support
3  *
4  * Copyright IBM, Corp. 2008
5  *           Red Hat, Inc. 2008
6  *
7  * Authors:
8  *  Anthony Liguori   <aliguori@us.ibm.com>
9  *  Glauber Costa     <gcosta@redhat.com>
10  *
11  * This work is licensed under the terms of the GNU GPL, version 2 or later.
12  * See the COPYING file in the top-level directory.
13  *
14  */
15 
16 #include "qemu/osdep.h"
17 #include <sys/ioctl.h>
18 
19 #include <linux/kvm.h>
20 
21 #include "qemu-common.h"
22 #include "qemu/atomic.h"
23 #include "qemu/option.h"
24 #include "qemu/config-file.h"
25 #include "qemu/error-report.h"
26 #include "qapi/error.h"
27 #include "hw/hw.h"
28 #include "hw/pci/msi.h"
29 #include "hw/pci/msix.h"
30 #include "hw/s390x/adapter.h"
31 #include "exec/gdbstub.h"
32 #include "sysemu/kvm_int.h"
33 #include "sysemu/cpus.h"
34 #include "qemu/bswap.h"
35 #include "exec/memory.h"
36 #include "exec/ram_addr.h"
37 #include "exec/address-spaces.h"
38 #include "qemu/event_notifier.h"
39 #include "trace.h"
40 #include "hw/irq.h"
41 #include "sysemu/sev.h"
42 #include "sysemu/balloon.h"
43 
44 #include "hw/boards.h"
45 
46 /* This check must be after config-host.h is included */
47 #ifdef CONFIG_EVENTFD
48 #include <sys/eventfd.h>
49 #endif
50 
51 /* KVM uses PAGE_SIZE in its definition of KVM_COALESCED_MMIO_MAX. We
52  * need to use the real host PAGE_SIZE, as that's what KVM will use.
53  */
54 #define PAGE_SIZE getpagesize()
55 
56 //#define DEBUG_KVM
57 
58 #ifdef DEBUG_KVM
59 #define DPRINTF(fmt, ...) \
60     do { fprintf(stderr, fmt, ## __VA_ARGS__); } while (0)
61 #else
62 #define DPRINTF(fmt, ...) \
63     do { } while (0)
64 #endif
65 
66 #define KVM_MSI_HASHTAB_SIZE    256
67 
68 struct KVMParkedVcpu {
69     unsigned long vcpu_id;
70     int kvm_fd;
71     QLIST_ENTRY(KVMParkedVcpu) node;
72 };
73 
74 struct KVMState
75 {
76     AccelState parent_obj;
77 
78     int nr_slots;
79     int fd;
80     int vmfd;
81     int coalesced_mmio;
82     struct kvm_coalesced_mmio_ring *coalesced_mmio_ring;
83     bool coalesced_flush_in_progress;
84     int vcpu_events;
85     int robust_singlestep;
86     int debugregs;
87 #ifdef KVM_CAP_SET_GUEST_DEBUG
88     struct kvm_sw_breakpoint_head kvm_sw_breakpoints;
89 #endif
90     int many_ioeventfds;
91     int intx_set_mask;
92     bool sync_mmu;
93     /* The man page (and posix) say ioctl numbers are signed int, but
94      * they're not.  Linux, glibc and *BSD all treat ioctl numbers as
95      * unsigned, and treating them as signed here can break things */
96     unsigned irq_set_ioctl;
97     unsigned int sigmask_len;
98     GHashTable *gsimap;
99 #ifdef KVM_CAP_IRQ_ROUTING
100     struct kvm_irq_routing *irq_routes;
101     int nr_allocated_irq_routes;
102     unsigned long *used_gsi_bitmap;
103     unsigned int gsi_count;
104     QTAILQ_HEAD(msi_hashtab, KVMMSIRoute) msi_hashtab[KVM_MSI_HASHTAB_SIZE];
105 #endif
106     KVMMemoryListener memory_listener;
107     QLIST_HEAD(, KVMParkedVcpu) kvm_parked_vcpus;
108 
109     /* memory encryption */
110     void *memcrypt_handle;
111     int (*memcrypt_encrypt_data)(void *handle, uint8_t *ptr, uint64_t len);
112 };
113 
114 KVMState *kvm_state;
115 bool kvm_kernel_irqchip;
116 bool kvm_split_irqchip;
117 bool kvm_async_interrupts_allowed;
118 bool kvm_halt_in_kernel_allowed;
119 bool kvm_eventfds_allowed;
120 bool kvm_irqfds_allowed;
121 bool kvm_resamplefds_allowed;
122 bool kvm_msi_via_irqfd_allowed;
123 bool kvm_gsi_routing_allowed;
124 bool kvm_gsi_direct_mapping;
125 bool kvm_allowed;
126 bool kvm_readonly_mem_allowed;
127 bool kvm_vm_attributes_allowed;
128 bool kvm_direct_msi_allowed;
129 bool kvm_ioeventfd_any_length_allowed;
130 bool kvm_msi_use_devid;
131 static bool kvm_immediate_exit;
132 
133 static const KVMCapabilityInfo kvm_required_capabilites[] = {
134     KVM_CAP_INFO(USER_MEMORY),
135     KVM_CAP_INFO(DESTROY_MEMORY_REGION_WORKS),
136     KVM_CAP_INFO(JOIN_MEMORY_REGIONS_WORKS),
137     KVM_CAP_LAST_INFO
138 };
139 
140 int kvm_get_max_memslots(void)
141 {
142     KVMState *s = KVM_STATE(current_machine->accelerator);
143 
144     return s->nr_slots;
145 }
146 
147 bool kvm_memcrypt_enabled(void)
148 {
149     if (kvm_state && kvm_state->memcrypt_handle) {
150         return true;
151     }
152 
153     return false;
154 }
155 
156 int kvm_memcrypt_encrypt_data(uint8_t *ptr, uint64_t len)
157 {
158     if (kvm_state->memcrypt_handle &&
159         kvm_state->memcrypt_encrypt_data) {
160         return kvm_state->memcrypt_encrypt_data(kvm_state->memcrypt_handle,
161                                               ptr, len);
162     }
163 
164     return 1;
165 }
166 
167 static KVMSlot *kvm_get_free_slot(KVMMemoryListener *kml)
168 {
169     KVMState *s = kvm_state;
170     int i;
171 
172     for (i = 0; i < s->nr_slots; i++) {
173         if (kml->slots[i].memory_size == 0) {
174             return &kml->slots[i];
175         }
176     }
177 
178     return NULL;
179 }
180 
181 bool kvm_has_free_slot(MachineState *ms)
182 {
183     KVMState *s = KVM_STATE(ms->accelerator);
184 
185     return kvm_get_free_slot(&s->memory_listener);
186 }
187 
188 static KVMSlot *kvm_alloc_slot(KVMMemoryListener *kml)
189 {
190     KVMSlot *slot = kvm_get_free_slot(kml);
191 
192     if (slot) {
193         return slot;
194     }
195 
196     fprintf(stderr, "%s: no free slot available\n", __func__);
197     abort();
198 }
199 
200 static KVMSlot *kvm_lookup_matching_slot(KVMMemoryListener *kml,
201                                          hwaddr start_addr,
202                                          hwaddr size)
203 {
204     KVMState *s = kvm_state;
205     int i;
206 
207     for (i = 0; i < s->nr_slots; i++) {
208         KVMSlot *mem = &kml->slots[i];
209 
210         if (start_addr == mem->start_addr && size == mem->memory_size) {
211             return mem;
212         }
213     }
214 
215     return NULL;
216 }
217 
218 /*
219  * Calculate and align the start address and the size of the section.
220  * Return the size. If the size is 0, the aligned section is empty.
221  */
222 static hwaddr kvm_align_section(MemoryRegionSection *section,
223                                 hwaddr *start)
224 {
225     hwaddr size = int128_get64(section->size);
226     hwaddr delta, aligned;
227 
228     /* kvm works in page size chunks, but the function may be called
229        with sub-page size and unaligned start address. Pad the start
230        address to next and truncate size to previous page boundary. */
231     aligned = ROUND_UP(section->offset_within_address_space,
232                        qemu_real_host_page_size);
233     delta = aligned - section->offset_within_address_space;
234     *start = aligned;
235     if (delta > size) {
236         return 0;
237     }
238 
239     return (size - delta) & qemu_real_host_page_mask;
240 }
241 
242 int kvm_physical_memory_addr_from_host(KVMState *s, void *ram,
243                                        hwaddr *phys_addr)
244 {
245     KVMMemoryListener *kml = &s->memory_listener;
246     int i;
247 
248     for (i = 0; i < s->nr_slots; i++) {
249         KVMSlot *mem = &kml->slots[i];
250 
251         if (ram >= mem->ram && ram < mem->ram + mem->memory_size) {
252             *phys_addr = mem->start_addr + (ram - mem->ram);
253             return 1;
254         }
255     }
256 
257     return 0;
258 }
259 
260 static int kvm_set_user_memory_region(KVMMemoryListener *kml, KVMSlot *slot, bool new)
261 {
262     KVMState *s = kvm_state;
263     struct kvm_userspace_memory_region mem;
264     int ret;
265 
266     mem.slot = slot->slot | (kml->as_id << 16);
267     mem.guest_phys_addr = slot->start_addr;
268     mem.userspace_addr = (unsigned long)slot->ram;
269     mem.flags = slot->flags;
270 
271     if (slot->memory_size && !new && (mem.flags ^ slot->old_flags) & KVM_MEM_READONLY) {
272         /* Set the slot size to 0 before setting the slot to the desired
273          * value. This is needed based on KVM commit 75d61fbc. */
274         mem.memory_size = 0;
275         kvm_vm_ioctl(s, KVM_SET_USER_MEMORY_REGION, &mem);
276     }
277     mem.memory_size = slot->memory_size;
278     ret = kvm_vm_ioctl(s, KVM_SET_USER_MEMORY_REGION, &mem);
279     slot->old_flags = mem.flags;
280     trace_kvm_set_user_memory(mem.slot, mem.flags, mem.guest_phys_addr,
281                               mem.memory_size, mem.userspace_addr, ret);
282     return ret;
283 }
284 
285 int kvm_destroy_vcpu(CPUState *cpu)
286 {
287     KVMState *s = kvm_state;
288     long mmap_size;
289     struct KVMParkedVcpu *vcpu = NULL;
290     int ret = 0;
291 
292     DPRINTF("kvm_destroy_vcpu\n");
293 
294     mmap_size = kvm_ioctl(s, KVM_GET_VCPU_MMAP_SIZE, 0);
295     if (mmap_size < 0) {
296         ret = mmap_size;
297         DPRINTF("KVM_GET_VCPU_MMAP_SIZE failed\n");
298         goto err;
299     }
300 
301     ret = munmap(cpu->kvm_run, mmap_size);
302     if (ret < 0) {
303         goto err;
304     }
305 
306     vcpu = g_malloc0(sizeof(*vcpu));
307     vcpu->vcpu_id = kvm_arch_vcpu_id(cpu);
308     vcpu->kvm_fd = cpu->kvm_fd;
309     QLIST_INSERT_HEAD(&kvm_state->kvm_parked_vcpus, vcpu, node);
310 err:
311     return ret;
312 }
313 
314 static int kvm_get_vcpu(KVMState *s, unsigned long vcpu_id)
315 {
316     struct KVMParkedVcpu *cpu;
317 
318     QLIST_FOREACH(cpu, &s->kvm_parked_vcpus, node) {
319         if (cpu->vcpu_id == vcpu_id) {
320             int kvm_fd;
321 
322             QLIST_REMOVE(cpu, node);
323             kvm_fd = cpu->kvm_fd;
324             g_free(cpu);
325             return kvm_fd;
326         }
327     }
328 
329     return kvm_vm_ioctl(s, KVM_CREATE_VCPU, (void *)vcpu_id);
330 }
331 
332 int kvm_init_vcpu(CPUState *cpu)
333 {
334     KVMState *s = kvm_state;
335     long mmap_size;
336     int ret;
337 
338     DPRINTF("kvm_init_vcpu\n");
339 
340     ret = kvm_get_vcpu(s, kvm_arch_vcpu_id(cpu));
341     if (ret < 0) {
342         DPRINTF("kvm_create_vcpu failed\n");
343         goto err;
344     }
345 
346     cpu->kvm_fd = ret;
347     cpu->kvm_state = s;
348     cpu->vcpu_dirty = true;
349 
350     mmap_size = kvm_ioctl(s, KVM_GET_VCPU_MMAP_SIZE, 0);
351     if (mmap_size < 0) {
352         ret = mmap_size;
353         DPRINTF("KVM_GET_VCPU_MMAP_SIZE failed\n");
354         goto err;
355     }
356 
357     cpu->kvm_run = mmap(NULL, mmap_size, PROT_READ | PROT_WRITE, MAP_SHARED,
358                         cpu->kvm_fd, 0);
359     if (cpu->kvm_run == MAP_FAILED) {
360         ret = -errno;
361         DPRINTF("mmap'ing vcpu state failed\n");
362         goto err;
363     }
364 
365     if (s->coalesced_mmio && !s->coalesced_mmio_ring) {
366         s->coalesced_mmio_ring =
367             (void *)cpu->kvm_run + s->coalesced_mmio * PAGE_SIZE;
368     }
369 
370     ret = kvm_arch_init_vcpu(cpu);
371 err:
372     return ret;
373 }
374 
375 /*
376  * dirty pages logging control
377  */
378 
379 static int kvm_mem_flags(MemoryRegion *mr)
380 {
381     bool readonly = mr->readonly || memory_region_is_romd(mr);
382     int flags = 0;
383 
384     if (memory_region_get_dirty_log_mask(mr) != 0) {
385         flags |= KVM_MEM_LOG_DIRTY_PAGES;
386     }
387     if (readonly && kvm_readonly_mem_allowed) {
388         flags |= KVM_MEM_READONLY;
389     }
390     return flags;
391 }
392 
393 static int kvm_slot_update_flags(KVMMemoryListener *kml, KVMSlot *mem,
394                                  MemoryRegion *mr)
395 {
396     mem->flags = kvm_mem_flags(mr);
397 
398     /* If nothing changed effectively, no need to issue ioctl */
399     if (mem->flags == mem->old_flags) {
400         return 0;
401     }
402 
403     return kvm_set_user_memory_region(kml, mem, false);
404 }
405 
406 static int kvm_section_update_flags(KVMMemoryListener *kml,
407                                     MemoryRegionSection *section)
408 {
409     hwaddr start_addr, size;
410     KVMSlot *mem;
411 
412     size = kvm_align_section(section, &start_addr);
413     if (!size) {
414         return 0;
415     }
416 
417     mem = kvm_lookup_matching_slot(kml, start_addr, size);
418     if (!mem) {
419         /* We don't have a slot if we want to trap every access. */
420         return 0;
421     }
422 
423     return kvm_slot_update_flags(kml, mem, section->mr);
424 }
425 
426 static void kvm_log_start(MemoryListener *listener,
427                           MemoryRegionSection *section,
428                           int old, int new)
429 {
430     KVMMemoryListener *kml = container_of(listener, KVMMemoryListener, listener);
431     int r;
432 
433     if (old != 0) {
434         return;
435     }
436 
437     r = kvm_section_update_flags(kml, section);
438     if (r < 0) {
439         abort();
440     }
441 }
442 
443 static void kvm_log_stop(MemoryListener *listener,
444                           MemoryRegionSection *section,
445                           int old, int new)
446 {
447     KVMMemoryListener *kml = container_of(listener, KVMMemoryListener, listener);
448     int r;
449 
450     if (new != 0) {
451         return;
452     }
453 
454     r = kvm_section_update_flags(kml, section);
455     if (r < 0) {
456         abort();
457     }
458 }
459 
460 /* get kvm's dirty pages bitmap and update qemu's */
461 static int kvm_get_dirty_pages_log_range(MemoryRegionSection *section,
462                                          unsigned long *bitmap)
463 {
464     ram_addr_t start = section->offset_within_region +
465                        memory_region_get_ram_addr(section->mr);
466     ram_addr_t pages = int128_get64(section->size) / getpagesize();
467 
468     cpu_physical_memory_set_dirty_lebitmap(bitmap, start, pages);
469     return 0;
470 }
471 
472 #define ALIGN(x, y)  (((x)+(y)-1) & ~((y)-1))
473 
474 /**
475  * kvm_physical_sync_dirty_bitmap - Grab dirty bitmap from kernel space
476  * This function updates qemu's dirty bitmap using
477  * memory_region_set_dirty().  This means all bits are set
478  * to dirty.
479  *
480  * @start_add: start of logged region.
481  * @end_addr: end of logged region.
482  */
483 static int kvm_physical_sync_dirty_bitmap(KVMMemoryListener *kml,
484                                           MemoryRegionSection *section)
485 {
486     KVMState *s = kvm_state;
487     struct kvm_dirty_log d = {};
488     KVMSlot *mem;
489     hwaddr start_addr, size;
490 
491     size = kvm_align_section(section, &start_addr);
492     if (size) {
493         mem = kvm_lookup_matching_slot(kml, start_addr, size);
494         if (!mem) {
495             /* We don't have a slot if we want to trap every access. */
496             return 0;
497         }
498 
499         /* XXX bad kernel interface alert
500          * For dirty bitmap, kernel allocates array of size aligned to
501          * bits-per-long.  But for case when the kernel is 64bits and
502          * the userspace is 32bits, userspace can't align to the same
503          * bits-per-long, since sizeof(long) is different between kernel
504          * and user space.  This way, userspace will provide buffer which
505          * may be 4 bytes less than the kernel will use, resulting in
506          * userspace memory corruption (which is not detectable by valgrind
507          * too, in most cases).
508          * So for now, let's align to 64 instead of HOST_LONG_BITS here, in
509          * a hope that sizeof(long) won't become >8 any time soon.
510          */
511         size = ALIGN(((mem->memory_size) >> TARGET_PAGE_BITS),
512                      /*HOST_LONG_BITS*/ 64) / 8;
513         d.dirty_bitmap = g_malloc0(size);
514 
515         d.slot = mem->slot | (kml->as_id << 16);
516         if (kvm_vm_ioctl(s, KVM_GET_DIRTY_LOG, &d) == -1) {
517             DPRINTF("ioctl failed %d\n", errno);
518             g_free(d.dirty_bitmap);
519             return -1;
520         }
521 
522         kvm_get_dirty_pages_log_range(section, d.dirty_bitmap);
523         g_free(d.dirty_bitmap);
524     }
525 
526     return 0;
527 }
528 
529 static void kvm_coalesce_mmio_region(MemoryListener *listener,
530                                      MemoryRegionSection *secion,
531                                      hwaddr start, hwaddr size)
532 {
533     KVMState *s = kvm_state;
534 
535     if (s->coalesced_mmio) {
536         struct kvm_coalesced_mmio_zone zone;
537 
538         zone.addr = start;
539         zone.size = size;
540         zone.pad = 0;
541 
542         (void)kvm_vm_ioctl(s, KVM_REGISTER_COALESCED_MMIO, &zone);
543     }
544 }
545 
546 static void kvm_uncoalesce_mmio_region(MemoryListener *listener,
547                                        MemoryRegionSection *secion,
548                                        hwaddr start, hwaddr size)
549 {
550     KVMState *s = kvm_state;
551 
552     if (s->coalesced_mmio) {
553         struct kvm_coalesced_mmio_zone zone;
554 
555         zone.addr = start;
556         zone.size = size;
557         zone.pad = 0;
558 
559         (void)kvm_vm_ioctl(s, KVM_UNREGISTER_COALESCED_MMIO, &zone);
560     }
561 }
562 
563 int kvm_check_extension(KVMState *s, unsigned int extension)
564 {
565     int ret;
566 
567     ret = kvm_ioctl(s, KVM_CHECK_EXTENSION, extension);
568     if (ret < 0) {
569         ret = 0;
570     }
571 
572     return ret;
573 }
574 
575 int kvm_vm_check_extension(KVMState *s, unsigned int extension)
576 {
577     int ret;
578 
579     ret = kvm_vm_ioctl(s, KVM_CHECK_EXTENSION, extension);
580     if (ret < 0) {
581         /* VM wide version not implemented, use global one instead */
582         ret = kvm_check_extension(s, extension);
583     }
584 
585     return ret;
586 }
587 
588 static uint32_t adjust_ioeventfd_endianness(uint32_t val, uint32_t size)
589 {
590 #if defined(HOST_WORDS_BIGENDIAN) != defined(TARGET_WORDS_BIGENDIAN)
591     /* The kernel expects ioeventfd values in HOST_WORDS_BIGENDIAN
592      * endianness, but the memory core hands them in target endianness.
593      * For example, PPC is always treated as big-endian even if running
594      * on KVM and on PPC64LE.  Correct here.
595      */
596     switch (size) {
597     case 2:
598         val = bswap16(val);
599         break;
600     case 4:
601         val = bswap32(val);
602         break;
603     }
604 #endif
605     return val;
606 }
607 
608 static int kvm_set_ioeventfd_mmio(int fd, hwaddr addr, uint32_t val,
609                                   bool assign, uint32_t size, bool datamatch)
610 {
611     int ret;
612     struct kvm_ioeventfd iofd = {
613         .datamatch = datamatch ? adjust_ioeventfd_endianness(val, size) : 0,
614         .addr = addr,
615         .len = size,
616         .flags = 0,
617         .fd = fd,
618     };
619 
620     if (!kvm_enabled()) {
621         return -ENOSYS;
622     }
623 
624     if (datamatch) {
625         iofd.flags |= KVM_IOEVENTFD_FLAG_DATAMATCH;
626     }
627     if (!assign) {
628         iofd.flags |= KVM_IOEVENTFD_FLAG_DEASSIGN;
629     }
630 
631     ret = kvm_vm_ioctl(kvm_state, KVM_IOEVENTFD, &iofd);
632 
633     if (ret < 0) {
634         return -errno;
635     }
636 
637     return 0;
638 }
639 
640 static int kvm_set_ioeventfd_pio(int fd, uint16_t addr, uint16_t val,
641                                  bool assign, uint32_t size, bool datamatch)
642 {
643     struct kvm_ioeventfd kick = {
644         .datamatch = datamatch ? adjust_ioeventfd_endianness(val, size) : 0,
645         .addr = addr,
646         .flags = KVM_IOEVENTFD_FLAG_PIO,
647         .len = size,
648         .fd = fd,
649     };
650     int r;
651     if (!kvm_enabled()) {
652         return -ENOSYS;
653     }
654     if (datamatch) {
655         kick.flags |= KVM_IOEVENTFD_FLAG_DATAMATCH;
656     }
657     if (!assign) {
658         kick.flags |= KVM_IOEVENTFD_FLAG_DEASSIGN;
659     }
660     r = kvm_vm_ioctl(kvm_state, KVM_IOEVENTFD, &kick);
661     if (r < 0) {
662         return r;
663     }
664     return 0;
665 }
666 
667 
668 static int kvm_check_many_ioeventfds(void)
669 {
670     /* Userspace can use ioeventfd for io notification.  This requires a host
671      * that supports eventfd(2) and an I/O thread; since eventfd does not
672      * support SIGIO it cannot interrupt the vcpu.
673      *
674      * Older kernels have a 6 device limit on the KVM io bus.  Find out so we
675      * can avoid creating too many ioeventfds.
676      */
677 #if defined(CONFIG_EVENTFD)
678     int ioeventfds[7];
679     int i, ret = 0;
680     for (i = 0; i < ARRAY_SIZE(ioeventfds); i++) {
681         ioeventfds[i] = eventfd(0, EFD_CLOEXEC);
682         if (ioeventfds[i] < 0) {
683             break;
684         }
685         ret = kvm_set_ioeventfd_pio(ioeventfds[i], 0, i, true, 2, true);
686         if (ret < 0) {
687             close(ioeventfds[i]);
688             break;
689         }
690     }
691 
692     /* Decide whether many devices are supported or not */
693     ret = i == ARRAY_SIZE(ioeventfds);
694 
695     while (i-- > 0) {
696         kvm_set_ioeventfd_pio(ioeventfds[i], 0, i, false, 2, true);
697         close(ioeventfds[i]);
698     }
699     return ret;
700 #else
701     return 0;
702 #endif
703 }
704 
705 static const KVMCapabilityInfo *
706 kvm_check_extension_list(KVMState *s, const KVMCapabilityInfo *list)
707 {
708     while (list->name) {
709         if (!kvm_check_extension(s, list->value)) {
710             return list;
711         }
712         list++;
713     }
714     return NULL;
715 }
716 
717 static void kvm_set_phys_mem(KVMMemoryListener *kml,
718                              MemoryRegionSection *section, bool add)
719 {
720     KVMSlot *mem;
721     int err;
722     MemoryRegion *mr = section->mr;
723     bool writeable = !mr->readonly && !mr->rom_device;
724     hwaddr start_addr, size;
725     void *ram;
726 
727     if (!memory_region_is_ram(mr)) {
728         if (writeable || !kvm_readonly_mem_allowed) {
729             return;
730         } else if (!mr->romd_mode) {
731             /* If the memory device is not in romd_mode, then we actually want
732              * to remove the kvm memory slot so all accesses will trap. */
733             add = false;
734         }
735     }
736 
737     size = kvm_align_section(section, &start_addr);
738     if (!size) {
739         return;
740     }
741 
742     /* use aligned delta to align the ram address */
743     ram = memory_region_get_ram_ptr(mr) + section->offset_within_region +
744           (start_addr - section->offset_within_address_space);
745 
746     if (!add) {
747         mem = kvm_lookup_matching_slot(kml, start_addr, size);
748         if (!mem) {
749             return;
750         }
751         if (mem->flags & KVM_MEM_LOG_DIRTY_PAGES) {
752             kvm_physical_sync_dirty_bitmap(kml, section);
753         }
754 
755         /* unregister the slot */
756         mem->memory_size = 0;
757         mem->flags = 0;
758         err = kvm_set_user_memory_region(kml, mem, false);
759         if (err) {
760             fprintf(stderr, "%s: error unregistering slot: %s\n",
761                     __func__, strerror(-err));
762             abort();
763         }
764         return;
765     }
766 
767     /* register the new slot */
768     mem = kvm_alloc_slot(kml);
769     mem->memory_size = size;
770     mem->start_addr = start_addr;
771     mem->ram = ram;
772     mem->flags = kvm_mem_flags(mr);
773 
774     err = kvm_set_user_memory_region(kml, mem, true);
775     if (err) {
776         fprintf(stderr, "%s: error registering slot: %s\n", __func__,
777                 strerror(-err));
778         abort();
779     }
780 }
781 
782 static void kvm_region_add(MemoryListener *listener,
783                            MemoryRegionSection *section)
784 {
785     KVMMemoryListener *kml = container_of(listener, KVMMemoryListener, listener);
786 
787     memory_region_ref(section->mr);
788     kvm_set_phys_mem(kml, section, true);
789 }
790 
791 static void kvm_region_del(MemoryListener *listener,
792                            MemoryRegionSection *section)
793 {
794     KVMMemoryListener *kml = container_of(listener, KVMMemoryListener, listener);
795 
796     kvm_set_phys_mem(kml, section, false);
797     memory_region_unref(section->mr);
798 }
799 
800 static void kvm_log_sync(MemoryListener *listener,
801                          MemoryRegionSection *section)
802 {
803     KVMMemoryListener *kml = container_of(listener, KVMMemoryListener, listener);
804     int r;
805 
806     r = kvm_physical_sync_dirty_bitmap(kml, section);
807     if (r < 0) {
808         abort();
809     }
810 }
811 
812 static void kvm_mem_ioeventfd_add(MemoryListener *listener,
813                                   MemoryRegionSection *section,
814                                   bool match_data, uint64_t data,
815                                   EventNotifier *e)
816 {
817     int fd = event_notifier_get_fd(e);
818     int r;
819 
820     r = kvm_set_ioeventfd_mmio(fd, section->offset_within_address_space,
821                                data, true, int128_get64(section->size),
822                                match_data);
823     if (r < 0) {
824         fprintf(stderr, "%s: error adding ioeventfd: %s\n",
825                 __func__, strerror(-r));
826         abort();
827     }
828 }
829 
830 static void kvm_mem_ioeventfd_del(MemoryListener *listener,
831                                   MemoryRegionSection *section,
832                                   bool match_data, uint64_t data,
833                                   EventNotifier *e)
834 {
835     int fd = event_notifier_get_fd(e);
836     int r;
837 
838     r = kvm_set_ioeventfd_mmio(fd, section->offset_within_address_space,
839                                data, false, int128_get64(section->size),
840                                match_data);
841     if (r < 0) {
842         abort();
843     }
844 }
845 
846 static void kvm_io_ioeventfd_add(MemoryListener *listener,
847                                  MemoryRegionSection *section,
848                                  bool match_data, uint64_t data,
849                                  EventNotifier *e)
850 {
851     int fd = event_notifier_get_fd(e);
852     int r;
853 
854     r = kvm_set_ioeventfd_pio(fd, section->offset_within_address_space,
855                               data, true, int128_get64(section->size),
856                               match_data);
857     if (r < 0) {
858         fprintf(stderr, "%s: error adding ioeventfd: %s\n",
859                 __func__, strerror(-r));
860         abort();
861     }
862 }
863 
864 static void kvm_io_ioeventfd_del(MemoryListener *listener,
865                                  MemoryRegionSection *section,
866                                  bool match_data, uint64_t data,
867                                  EventNotifier *e)
868 
869 {
870     int fd = event_notifier_get_fd(e);
871     int r;
872 
873     r = kvm_set_ioeventfd_pio(fd, section->offset_within_address_space,
874                               data, false, int128_get64(section->size),
875                               match_data);
876     if (r < 0) {
877         abort();
878     }
879 }
880 
881 void kvm_memory_listener_register(KVMState *s, KVMMemoryListener *kml,
882                                   AddressSpace *as, int as_id)
883 {
884     int i;
885 
886     kml->slots = g_malloc0(s->nr_slots * sizeof(KVMSlot));
887     kml->as_id = as_id;
888 
889     for (i = 0; i < s->nr_slots; i++) {
890         kml->slots[i].slot = i;
891     }
892 
893     kml->listener.region_add = kvm_region_add;
894     kml->listener.region_del = kvm_region_del;
895     kml->listener.log_start = kvm_log_start;
896     kml->listener.log_stop = kvm_log_stop;
897     kml->listener.log_sync = kvm_log_sync;
898     kml->listener.priority = 10;
899 
900     memory_listener_register(&kml->listener, as);
901 }
902 
903 static MemoryListener kvm_io_listener = {
904     .eventfd_add = kvm_io_ioeventfd_add,
905     .eventfd_del = kvm_io_ioeventfd_del,
906     .priority = 10,
907 };
908 
909 int kvm_set_irq(KVMState *s, int irq, int level)
910 {
911     struct kvm_irq_level event;
912     int ret;
913 
914     assert(kvm_async_interrupts_enabled());
915 
916     event.level = level;
917     event.irq = irq;
918     ret = kvm_vm_ioctl(s, s->irq_set_ioctl, &event);
919     if (ret < 0) {
920         perror("kvm_set_irq");
921         abort();
922     }
923 
924     return (s->irq_set_ioctl == KVM_IRQ_LINE) ? 1 : event.status;
925 }
926 
927 #ifdef KVM_CAP_IRQ_ROUTING
928 typedef struct KVMMSIRoute {
929     struct kvm_irq_routing_entry kroute;
930     QTAILQ_ENTRY(KVMMSIRoute) entry;
931 } KVMMSIRoute;
932 
933 static void set_gsi(KVMState *s, unsigned int gsi)
934 {
935     set_bit(gsi, s->used_gsi_bitmap);
936 }
937 
938 static void clear_gsi(KVMState *s, unsigned int gsi)
939 {
940     clear_bit(gsi, s->used_gsi_bitmap);
941 }
942 
943 void kvm_init_irq_routing(KVMState *s)
944 {
945     int gsi_count, i;
946 
947     gsi_count = kvm_check_extension(s, KVM_CAP_IRQ_ROUTING) - 1;
948     if (gsi_count > 0) {
949         /* Round up so we can search ints using ffs */
950         s->used_gsi_bitmap = bitmap_new(gsi_count);
951         s->gsi_count = gsi_count;
952     }
953 
954     s->irq_routes = g_malloc0(sizeof(*s->irq_routes));
955     s->nr_allocated_irq_routes = 0;
956 
957     if (!kvm_direct_msi_allowed) {
958         for (i = 0; i < KVM_MSI_HASHTAB_SIZE; i++) {
959             QTAILQ_INIT(&s->msi_hashtab[i]);
960         }
961     }
962 
963     kvm_arch_init_irq_routing(s);
964 }
965 
966 void kvm_irqchip_commit_routes(KVMState *s)
967 {
968     int ret;
969 
970     if (kvm_gsi_direct_mapping()) {
971         return;
972     }
973 
974     if (!kvm_gsi_routing_enabled()) {
975         return;
976     }
977 
978     s->irq_routes->flags = 0;
979     trace_kvm_irqchip_commit_routes();
980     ret = kvm_vm_ioctl(s, KVM_SET_GSI_ROUTING, s->irq_routes);
981     assert(ret == 0);
982 }
983 
984 static void kvm_add_routing_entry(KVMState *s,
985                                   struct kvm_irq_routing_entry *entry)
986 {
987     struct kvm_irq_routing_entry *new;
988     int n, size;
989 
990     if (s->irq_routes->nr == s->nr_allocated_irq_routes) {
991         n = s->nr_allocated_irq_routes * 2;
992         if (n < 64) {
993             n = 64;
994         }
995         size = sizeof(struct kvm_irq_routing);
996         size += n * sizeof(*new);
997         s->irq_routes = g_realloc(s->irq_routes, size);
998         s->nr_allocated_irq_routes = n;
999     }
1000     n = s->irq_routes->nr++;
1001     new = &s->irq_routes->entries[n];
1002 
1003     *new = *entry;
1004 
1005     set_gsi(s, entry->gsi);
1006 }
1007 
1008 static int kvm_update_routing_entry(KVMState *s,
1009                                     struct kvm_irq_routing_entry *new_entry)
1010 {
1011     struct kvm_irq_routing_entry *entry;
1012     int n;
1013 
1014     for (n = 0; n < s->irq_routes->nr; n++) {
1015         entry = &s->irq_routes->entries[n];
1016         if (entry->gsi != new_entry->gsi) {
1017             continue;
1018         }
1019 
1020         if(!memcmp(entry, new_entry, sizeof *entry)) {
1021             return 0;
1022         }
1023 
1024         *entry = *new_entry;
1025 
1026         return 0;
1027     }
1028 
1029     return -ESRCH;
1030 }
1031 
1032 void kvm_irqchip_add_irq_route(KVMState *s, int irq, int irqchip, int pin)
1033 {
1034     struct kvm_irq_routing_entry e = {};
1035 
1036     assert(pin < s->gsi_count);
1037 
1038     e.gsi = irq;
1039     e.type = KVM_IRQ_ROUTING_IRQCHIP;
1040     e.flags = 0;
1041     e.u.irqchip.irqchip = irqchip;
1042     e.u.irqchip.pin = pin;
1043     kvm_add_routing_entry(s, &e);
1044 }
1045 
1046 void kvm_irqchip_release_virq(KVMState *s, int virq)
1047 {
1048     struct kvm_irq_routing_entry *e;
1049     int i;
1050 
1051     if (kvm_gsi_direct_mapping()) {
1052         return;
1053     }
1054 
1055     for (i = 0; i < s->irq_routes->nr; i++) {
1056         e = &s->irq_routes->entries[i];
1057         if (e->gsi == virq) {
1058             s->irq_routes->nr--;
1059             *e = s->irq_routes->entries[s->irq_routes->nr];
1060         }
1061     }
1062     clear_gsi(s, virq);
1063     kvm_arch_release_virq_post(virq);
1064     trace_kvm_irqchip_release_virq(virq);
1065 }
1066 
1067 static unsigned int kvm_hash_msi(uint32_t data)
1068 {
1069     /* This is optimized for IA32 MSI layout. However, no other arch shall
1070      * repeat the mistake of not providing a direct MSI injection API. */
1071     return data & 0xff;
1072 }
1073 
1074 static void kvm_flush_dynamic_msi_routes(KVMState *s)
1075 {
1076     KVMMSIRoute *route, *next;
1077     unsigned int hash;
1078 
1079     for (hash = 0; hash < KVM_MSI_HASHTAB_SIZE; hash++) {
1080         QTAILQ_FOREACH_SAFE(route, &s->msi_hashtab[hash], entry, next) {
1081             kvm_irqchip_release_virq(s, route->kroute.gsi);
1082             QTAILQ_REMOVE(&s->msi_hashtab[hash], route, entry);
1083             g_free(route);
1084         }
1085     }
1086 }
1087 
1088 static int kvm_irqchip_get_virq(KVMState *s)
1089 {
1090     int next_virq;
1091 
1092     /*
1093      * PIC and IOAPIC share the first 16 GSI numbers, thus the available
1094      * GSI numbers are more than the number of IRQ route. Allocating a GSI
1095      * number can succeed even though a new route entry cannot be added.
1096      * When this happens, flush dynamic MSI entries to free IRQ route entries.
1097      */
1098     if (!kvm_direct_msi_allowed && s->irq_routes->nr == s->gsi_count) {
1099         kvm_flush_dynamic_msi_routes(s);
1100     }
1101 
1102     /* Return the lowest unused GSI in the bitmap */
1103     next_virq = find_first_zero_bit(s->used_gsi_bitmap, s->gsi_count);
1104     if (next_virq >= s->gsi_count) {
1105         return -ENOSPC;
1106     } else {
1107         return next_virq;
1108     }
1109 }
1110 
1111 static KVMMSIRoute *kvm_lookup_msi_route(KVMState *s, MSIMessage msg)
1112 {
1113     unsigned int hash = kvm_hash_msi(msg.data);
1114     KVMMSIRoute *route;
1115 
1116     QTAILQ_FOREACH(route, &s->msi_hashtab[hash], entry) {
1117         if (route->kroute.u.msi.address_lo == (uint32_t)msg.address &&
1118             route->kroute.u.msi.address_hi == (msg.address >> 32) &&
1119             route->kroute.u.msi.data == le32_to_cpu(msg.data)) {
1120             return route;
1121         }
1122     }
1123     return NULL;
1124 }
1125 
1126 int kvm_irqchip_send_msi(KVMState *s, MSIMessage msg)
1127 {
1128     struct kvm_msi msi;
1129     KVMMSIRoute *route;
1130 
1131     if (kvm_direct_msi_allowed) {
1132         msi.address_lo = (uint32_t)msg.address;
1133         msi.address_hi = msg.address >> 32;
1134         msi.data = le32_to_cpu(msg.data);
1135         msi.flags = 0;
1136         memset(msi.pad, 0, sizeof(msi.pad));
1137 
1138         return kvm_vm_ioctl(s, KVM_SIGNAL_MSI, &msi);
1139     }
1140 
1141     route = kvm_lookup_msi_route(s, msg);
1142     if (!route) {
1143         int virq;
1144 
1145         virq = kvm_irqchip_get_virq(s);
1146         if (virq < 0) {
1147             return virq;
1148         }
1149 
1150         route = g_malloc0(sizeof(KVMMSIRoute));
1151         route->kroute.gsi = virq;
1152         route->kroute.type = KVM_IRQ_ROUTING_MSI;
1153         route->kroute.flags = 0;
1154         route->kroute.u.msi.address_lo = (uint32_t)msg.address;
1155         route->kroute.u.msi.address_hi = msg.address >> 32;
1156         route->kroute.u.msi.data = le32_to_cpu(msg.data);
1157 
1158         kvm_add_routing_entry(s, &route->kroute);
1159         kvm_irqchip_commit_routes(s);
1160 
1161         QTAILQ_INSERT_TAIL(&s->msi_hashtab[kvm_hash_msi(msg.data)], route,
1162                            entry);
1163     }
1164 
1165     assert(route->kroute.type == KVM_IRQ_ROUTING_MSI);
1166 
1167     return kvm_set_irq(s, route->kroute.gsi, 1);
1168 }
1169 
1170 int kvm_irqchip_add_msi_route(KVMState *s, int vector, PCIDevice *dev)
1171 {
1172     struct kvm_irq_routing_entry kroute = {};
1173     int virq;
1174     MSIMessage msg = {0, 0};
1175 
1176     if (pci_available && dev) {
1177         msg = pci_get_msi_message(dev, vector);
1178     }
1179 
1180     if (kvm_gsi_direct_mapping()) {
1181         return kvm_arch_msi_data_to_gsi(msg.data);
1182     }
1183 
1184     if (!kvm_gsi_routing_enabled()) {
1185         return -ENOSYS;
1186     }
1187 
1188     virq = kvm_irqchip_get_virq(s);
1189     if (virq < 0) {
1190         return virq;
1191     }
1192 
1193     kroute.gsi = virq;
1194     kroute.type = KVM_IRQ_ROUTING_MSI;
1195     kroute.flags = 0;
1196     kroute.u.msi.address_lo = (uint32_t)msg.address;
1197     kroute.u.msi.address_hi = msg.address >> 32;
1198     kroute.u.msi.data = le32_to_cpu(msg.data);
1199     if (pci_available && kvm_msi_devid_required()) {
1200         kroute.flags = KVM_MSI_VALID_DEVID;
1201         kroute.u.msi.devid = pci_requester_id(dev);
1202     }
1203     if (kvm_arch_fixup_msi_route(&kroute, msg.address, msg.data, dev)) {
1204         kvm_irqchip_release_virq(s, virq);
1205         return -EINVAL;
1206     }
1207 
1208     trace_kvm_irqchip_add_msi_route(dev ? dev->name : (char *)"N/A",
1209                                     vector, virq);
1210 
1211     kvm_add_routing_entry(s, &kroute);
1212     kvm_arch_add_msi_route_post(&kroute, vector, dev);
1213     kvm_irqchip_commit_routes(s);
1214 
1215     return virq;
1216 }
1217 
1218 int kvm_irqchip_update_msi_route(KVMState *s, int virq, MSIMessage msg,
1219                                  PCIDevice *dev)
1220 {
1221     struct kvm_irq_routing_entry kroute = {};
1222 
1223     if (kvm_gsi_direct_mapping()) {
1224         return 0;
1225     }
1226 
1227     if (!kvm_irqchip_in_kernel()) {
1228         return -ENOSYS;
1229     }
1230 
1231     kroute.gsi = virq;
1232     kroute.type = KVM_IRQ_ROUTING_MSI;
1233     kroute.flags = 0;
1234     kroute.u.msi.address_lo = (uint32_t)msg.address;
1235     kroute.u.msi.address_hi = msg.address >> 32;
1236     kroute.u.msi.data = le32_to_cpu(msg.data);
1237     if (pci_available && kvm_msi_devid_required()) {
1238         kroute.flags = KVM_MSI_VALID_DEVID;
1239         kroute.u.msi.devid = pci_requester_id(dev);
1240     }
1241     if (kvm_arch_fixup_msi_route(&kroute, msg.address, msg.data, dev)) {
1242         return -EINVAL;
1243     }
1244 
1245     trace_kvm_irqchip_update_msi_route(virq);
1246 
1247     return kvm_update_routing_entry(s, &kroute);
1248 }
1249 
1250 static int kvm_irqchip_assign_irqfd(KVMState *s, int fd, int rfd, int virq,
1251                                     bool assign)
1252 {
1253     struct kvm_irqfd irqfd = {
1254         .fd = fd,
1255         .gsi = virq,
1256         .flags = assign ? 0 : KVM_IRQFD_FLAG_DEASSIGN,
1257     };
1258 
1259     if (rfd != -1) {
1260         irqfd.flags |= KVM_IRQFD_FLAG_RESAMPLE;
1261         irqfd.resamplefd = rfd;
1262     }
1263 
1264     if (!kvm_irqfds_enabled()) {
1265         return -ENOSYS;
1266     }
1267 
1268     return kvm_vm_ioctl(s, KVM_IRQFD, &irqfd);
1269 }
1270 
1271 int kvm_irqchip_add_adapter_route(KVMState *s, AdapterInfo *adapter)
1272 {
1273     struct kvm_irq_routing_entry kroute = {};
1274     int virq;
1275 
1276     if (!kvm_gsi_routing_enabled()) {
1277         return -ENOSYS;
1278     }
1279 
1280     virq = kvm_irqchip_get_virq(s);
1281     if (virq < 0) {
1282         return virq;
1283     }
1284 
1285     kroute.gsi = virq;
1286     kroute.type = KVM_IRQ_ROUTING_S390_ADAPTER;
1287     kroute.flags = 0;
1288     kroute.u.adapter.summary_addr = adapter->summary_addr;
1289     kroute.u.adapter.ind_addr = adapter->ind_addr;
1290     kroute.u.adapter.summary_offset = adapter->summary_offset;
1291     kroute.u.adapter.ind_offset = adapter->ind_offset;
1292     kroute.u.adapter.adapter_id = adapter->adapter_id;
1293 
1294     kvm_add_routing_entry(s, &kroute);
1295 
1296     return virq;
1297 }
1298 
1299 int kvm_irqchip_add_hv_sint_route(KVMState *s, uint32_t vcpu, uint32_t sint)
1300 {
1301     struct kvm_irq_routing_entry kroute = {};
1302     int virq;
1303 
1304     if (!kvm_gsi_routing_enabled()) {
1305         return -ENOSYS;
1306     }
1307     if (!kvm_check_extension(s, KVM_CAP_HYPERV_SYNIC)) {
1308         return -ENOSYS;
1309     }
1310     virq = kvm_irqchip_get_virq(s);
1311     if (virq < 0) {
1312         return virq;
1313     }
1314 
1315     kroute.gsi = virq;
1316     kroute.type = KVM_IRQ_ROUTING_HV_SINT;
1317     kroute.flags = 0;
1318     kroute.u.hv_sint.vcpu = vcpu;
1319     kroute.u.hv_sint.sint = sint;
1320 
1321     kvm_add_routing_entry(s, &kroute);
1322     kvm_irqchip_commit_routes(s);
1323 
1324     return virq;
1325 }
1326 
1327 #else /* !KVM_CAP_IRQ_ROUTING */
1328 
1329 void kvm_init_irq_routing(KVMState *s)
1330 {
1331 }
1332 
1333 void kvm_irqchip_release_virq(KVMState *s, int virq)
1334 {
1335 }
1336 
1337 int kvm_irqchip_send_msi(KVMState *s, MSIMessage msg)
1338 {
1339     abort();
1340 }
1341 
1342 int kvm_irqchip_add_msi_route(KVMState *s, int vector, PCIDevice *dev)
1343 {
1344     return -ENOSYS;
1345 }
1346 
1347 int kvm_irqchip_add_adapter_route(KVMState *s, AdapterInfo *adapter)
1348 {
1349     return -ENOSYS;
1350 }
1351 
1352 int kvm_irqchip_add_hv_sint_route(KVMState *s, uint32_t vcpu, uint32_t sint)
1353 {
1354     return -ENOSYS;
1355 }
1356 
1357 static int kvm_irqchip_assign_irqfd(KVMState *s, int fd, int virq, bool assign)
1358 {
1359     abort();
1360 }
1361 
1362 int kvm_irqchip_update_msi_route(KVMState *s, int virq, MSIMessage msg)
1363 {
1364     return -ENOSYS;
1365 }
1366 #endif /* !KVM_CAP_IRQ_ROUTING */
1367 
1368 int kvm_irqchip_add_irqfd_notifier_gsi(KVMState *s, EventNotifier *n,
1369                                        EventNotifier *rn, int virq)
1370 {
1371     return kvm_irqchip_assign_irqfd(s, event_notifier_get_fd(n),
1372            rn ? event_notifier_get_fd(rn) : -1, virq, true);
1373 }
1374 
1375 int kvm_irqchip_remove_irqfd_notifier_gsi(KVMState *s, EventNotifier *n,
1376                                           int virq)
1377 {
1378     return kvm_irqchip_assign_irqfd(s, event_notifier_get_fd(n), -1, virq,
1379            false);
1380 }
1381 
1382 int kvm_irqchip_add_irqfd_notifier(KVMState *s, EventNotifier *n,
1383                                    EventNotifier *rn, qemu_irq irq)
1384 {
1385     gpointer key, gsi;
1386     gboolean found = g_hash_table_lookup_extended(s->gsimap, irq, &key, &gsi);
1387 
1388     if (!found) {
1389         return -ENXIO;
1390     }
1391     return kvm_irqchip_add_irqfd_notifier_gsi(s, n, rn, GPOINTER_TO_INT(gsi));
1392 }
1393 
1394 int kvm_irqchip_remove_irqfd_notifier(KVMState *s, EventNotifier *n,
1395                                       qemu_irq irq)
1396 {
1397     gpointer key, gsi;
1398     gboolean found = g_hash_table_lookup_extended(s->gsimap, irq, &key, &gsi);
1399 
1400     if (!found) {
1401         return -ENXIO;
1402     }
1403     return kvm_irqchip_remove_irqfd_notifier_gsi(s, n, GPOINTER_TO_INT(gsi));
1404 }
1405 
1406 void kvm_irqchip_set_qemuirq_gsi(KVMState *s, qemu_irq irq, int gsi)
1407 {
1408     g_hash_table_insert(s->gsimap, irq, GINT_TO_POINTER(gsi));
1409 }
1410 
1411 static void kvm_irqchip_create(MachineState *machine, KVMState *s)
1412 {
1413     int ret;
1414 
1415     if (kvm_check_extension(s, KVM_CAP_IRQCHIP)) {
1416         ;
1417     } else if (kvm_check_extension(s, KVM_CAP_S390_IRQCHIP)) {
1418         ret = kvm_vm_enable_cap(s, KVM_CAP_S390_IRQCHIP, 0);
1419         if (ret < 0) {
1420             fprintf(stderr, "Enable kernel irqchip failed: %s\n", strerror(-ret));
1421             exit(1);
1422         }
1423     } else {
1424         return;
1425     }
1426 
1427     /* First probe and see if there's a arch-specific hook to create the
1428      * in-kernel irqchip for us */
1429     ret = kvm_arch_irqchip_create(machine, s);
1430     if (ret == 0) {
1431         if (machine_kernel_irqchip_split(machine)) {
1432             perror("Split IRQ chip mode not supported.");
1433             exit(1);
1434         } else {
1435             ret = kvm_vm_ioctl(s, KVM_CREATE_IRQCHIP);
1436         }
1437     }
1438     if (ret < 0) {
1439         fprintf(stderr, "Create kernel irqchip failed: %s\n", strerror(-ret));
1440         exit(1);
1441     }
1442 
1443     kvm_kernel_irqchip = true;
1444     /* If we have an in-kernel IRQ chip then we must have asynchronous
1445      * interrupt delivery (though the reverse is not necessarily true)
1446      */
1447     kvm_async_interrupts_allowed = true;
1448     kvm_halt_in_kernel_allowed = true;
1449 
1450     kvm_init_irq_routing(s);
1451 
1452     s->gsimap = g_hash_table_new(g_direct_hash, g_direct_equal);
1453 }
1454 
1455 /* Find number of supported CPUs using the recommended
1456  * procedure from the kernel API documentation to cope with
1457  * older kernels that may be missing capabilities.
1458  */
1459 static int kvm_recommended_vcpus(KVMState *s)
1460 {
1461     int ret = kvm_vm_check_extension(s, KVM_CAP_NR_VCPUS);
1462     return (ret) ? ret : 4;
1463 }
1464 
1465 static int kvm_max_vcpus(KVMState *s)
1466 {
1467     int ret = kvm_check_extension(s, KVM_CAP_MAX_VCPUS);
1468     return (ret) ? ret : kvm_recommended_vcpus(s);
1469 }
1470 
1471 static int kvm_max_vcpu_id(KVMState *s)
1472 {
1473     int ret = kvm_check_extension(s, KVM_CAP_MAX_VCPU_ID);
1474     return (ret) ? ret : kvm_max_vcpus(s);
1475 }
1476 
1477 bool kvm_vcpu_id_is_valid(int vcpu_id)
1478 {
1479     KVMState *s = KVM_STATE(current_machine->accelerator);
1480     return vcpu_id >= 0 && vcpu_id < kvm_max_vcpu_id(s);
1481 }
1482 
1483 static int kvm_init(MachineState *ms)
1484 {
1485     MachineClass *mc = MACHINE_GET_CLASS(ms);
1486     static const char upgrade_note[] =
1487         "Please upgrade to at least kernel 2.6.29 or recent kvm-kmod\n"
1488         "(see http://sourceforge.net/projects/kvm).\n";
1489     struct {
1490         const char *name;
1491         int num;
1492     } num_cpus[] = {
1493         { "SMP",          smp_cpus },
1494         { "hotpluggable", max_cpus },
1495         { NULL, }
1496     }, *nc = num_cpus;
1497     int soft_vcpus_limit, hard_vcpus_limit;
1498     KVMState *s;
1499     const KVMCapabilityInfo *missing_cap;
1500     int ret;
1501     int type = 0;
1502     const char *kvm_type;
1503 
1504     s = KVM_STATE(ms->accelerator);
1505 
1506     /*
1507      * On systems where the kernel can support different base page
1508      * sizes, host page size may be different from TARGET_PAGE_SIZE,
1509      * even with KVM.  TARGET_PAGE_SIZE is assumed to be the minimum
1510      * page size for the system though.
1511      */
1512     assert(TARGET_PAGE_SIZE <= getpagesize());
1513 
1514     s->sigmask_len = 8;
1515 
1516 #ifdef KVM_CAP_SET_GUEST_DEBUG
1517     QTAILQ_INIT(&s->kvm_sw_breakpoints);
1518 #endif
1519     QLIST_INIT(&s->kvm_parked_vcpus);
1520     s->vmfd = -1;
1521     s->fd = qemu_open("/dev/kvm", O_RDWR);
1522     if (s->fd == -1) {
1523         fprintf(stderr, "Could not access KVM kernel module: %m\n");
1524         ret = -errno;
1525         goto err;
1526     }
1527 
1528     ret = kvm_ioctl(s, KVM_GET_API_VERSION, 0);
1529     if (ret < KVM_API_VERSION) {
1530         if (ret >= 0) {
1531             ret = -EINVAL;
1532         }
1533         fprintf(stderr, "kvm version too old\n");
1534         goto err;
1535     }
1536 
1537     if (ret > KVM_API_VERSION) {
1538         ret = -EINVAL;
1539         fprintf(stderr, "kvm version not supported\n");
1540         goto err;
1541     }
1542 
1543     kvm_immediate_exit = kvm_check_extension(s, KVM_CAP_IMMEDIATE_EXIT);
1544     s->nr_slots = kvm_check_extension(s, KVM_CAP_NR_MEMSLOTS);
1545 
1546     /* If unspecified, use the default value */
1547     if (!s->nr_slots) {
1548         s->nr_slots = 32;
1549     }
1550 
1551     kvm_type = qemu_opt_get(qemu_get_machine_opts(), "kvm-type");
1552     if (mc->kvm_type) {
1553         type = mc->kvm_type(kvm_type);
1554     } else if (kvm_type) {
1555         ret = -EINVAL;
1556         fprintf(stderr, "Invalid argument kvm-type=%s\n", kvm_type);
1557         goto err;
1558     }
1559 
1560     do {
1561         ret = kvm_ioctl(s, KVM_CREATE_VM, type);
1562     } while (ret == -EINTR);
1563 
1564     if (ret < 0) {
1565         fprintf(stderr, "ioctl(KVM_CREATE_VM) failed: %d %s\n", -ret,
1566                 strerror(-ret));
1567 
1568 #ifdef TARGET_S390X
1569         if (ret == -EINVAL) {
1570             fprintf(stderr,
1571                     "Host kernel setup problem detected. Please verify:\n");
1572             fprintf(stderr, "- for kernels supporting the switch_amode or"
1573                     " user_mode parameters, whether\n");
1574             fprintf(stderr,
1575                     "  user space is running in primary address space\n");
1576             fprintf(stderr,
1577                     "- for kernels supporting the vm.allocate_pgste sysctl, "
1578                     "whether it is enabled\n");
1579         }
1580 #endif
1581         goto err;
1582     }
1583 
1584     s->vmfd = ret;
1585 
1586     /* check the vcpu limits */
1587     soft_vcpus_limit = kvm_recommended_vcpus(s);
1588     hard_vcpus_limit = kvm_max_vcpus(s);
1589 
1590     while (nc->name) {
1591         if (nc->num > soft_vcpus_limit) {
1592             warn_report("Number of %s cpus requested (%d) exceeds "
1593                         "the recommended cpus supported by KVM (%d)",
1594                         nc->name, nc->num, soft_vcpus_limit);
1595 
1596             if (nc->num > hard_vcpus_limit) {
1597                 fprintf(stderr, "Number of %s cpus requested (%d) exceeds "
1598                         "the maximum cpus supported by KVM (%d)\n",
1599                         nc->name, nc->num, hard_vcpus_limit);
1600                 exit(1);
1601             }
1602         }
1603         nc++;
1604     }
1605 
1606     missing_cap = kvm_check_extension_list(s, kvm_required_capabilites);
1607     if (!missing_cap) {
1608         missing_cap =
1609             kvm_check_extension_list(s, kvm_arch_required_capabilities);
1610     }
1611     if (missing_cap) {
1612         ret = -EINVAL;
1613         fprintf(stderr, "kvm does not support %s\n%s",
1614                 missing_cap->name, upgrade_note);
1615         goto err;
1616     }
1617 
1618     s->coalesced_mmio = kvm_check_extension(s, KVM_CAP_COALESCED_MMIO);
1619 
1620 #ifdef KVM_CAP_VCPU_EVENTS
1621     s->vcpu_events = kvm_check_extension(s, KVM_CAP_VCPU_EVENTS);
1622 #endif
1623 
1624     s->robust_singlestep =
1625         kvm_check_extension(s, KVM_CAP_X86_ROBUST_SINGLESTEP);
1626 
1627 #ifdef KVM_CAP_DEBUGREGS
1628     s->debugregs = kvm_check_extension(s, KVM_CAP_DEBUGREGS);
1629 #endif
1630 
1631 #ifdef KVM_CAP_IRQ_ROUTING
1632     kvm_direct_msi_allowed = (kvm_check_extension(s, KVM_CAP_SIGNAL_MSI) > 0);
1633 #endif
1634 
1635     s->intx_set_mask = kvm_check_extension(s, KVM_CAP_PCI_2_3);
1636 
1637     s->irq_set_ioctl = KVM_IRQ_LINE;
1638     if (kvm_check_extension(s, KVM_CAP_IRQ_INJECT_STATUS)) {
1639         s->irq_set_ioctl = KVM_IRQ_LINE_STATUS;
1640     }
1641 
1642     kvm_readonly_mem_allowed =
1643         (kvm_check_extension(s, KVM_CAP_READONLY_MEM) > 0);
1644 
1645     kvm_eventfds_allowed =
1646         (kvm_check_extension(s, KVM_CAP_IOEVENTFD) > 0);
1647 
1648     kvm_irqfds_allowed =
1649         (kvm_check_extension(s, KVM_CAP_IRQFD) > 0);
1650 
1651     kvm_resamplefds_allowed =
1652         (kvm_check_extension(s, KVM_CAP_IRQFD_RESAMPLE) > 0);
1653 
1654     kvm_vm_attributes_allowed =
1655         (kvm_check_extension(s, KVM_CAP_VM_ATTRIBUTES) > 0);
1656 
1657     kvm_ioeventfd_any_length_allowed =
1658         (kvm_check_extension(s, KVM_CAP_IOEVENTFD_ANY_LENGTH) > 0);
1659 
1660     kvm_state = s;
1661 
1662     /*
1663      * if memory encryption object is specified then initialize the memory
1664      * encryption context.
1665      */
1666     if (ms->memory_encryption) {
1667         kvm_state->memcrypt_handle = sev_guest_init(ms->memory_encryption);
1668         if (!kvm_state->memcrypt_handle) {
1669             ret = -1;
1670             goto err;
1671         }
1672 
1673         kvm_state->memcrypt_encrypt_data = sev_encrypt_data;
1674     }
1675 
1676     ret = kvm_arch_init(ms, s);
1677     if (ret < 0) {
1678         goto err;
1679     }
1680 
1681     if (machine_kernel_irqchip_allowed(ms)) {
1682         kvm_irqchip_create(ms, s);
1683     }
1684 
1685     if (kvm_eventfds_allowed) {
1686         s->memory_listener.listener.eventfd_add = kvm_mem_ioeventfd_add;
1687         s->memory_listener.listener.eventfd_del = kvm_mem_ioeventfd_del;
1688     }
1689     s->memory_listener.listener.coalesced_mmio_add = kvm_coalesce_mmio_region;
1690     s->memory_listener.listener.coalesced_mmio_del = kvm_uncoalesce_mmio_region;
1691 
1692     kvm_memory_listener_register(s, &s->memory_listener,
1693                                  &address_space_memory, 0);
1694     memory_listener_register(&kvm_io_listener,
1695                              &address_space_io);
1696 
1697     s->many_ioeventfds = kvm_check_many_ioeventfds();
1698 
1699     s->sync_mmu = !!kvm_vm_check_extension(kvm_state, KVM_CAP_SYNC_MMU);
1700     if (!s->sync_mmu) {
1701         qemu_balloon_inhibit(true);
1702     }
1703 
1704     return 0;
1705 
1706 err:
1707     assert(ret < 0);
1708     if (s->vmfd >= 0) {
1709         close(s->vmfd);
1710     }
1711     if (s->fd != -1) {
1712         close(s->fd);
1713     }
1714     g_free(s->memory_listener.slots);
1715 
1716     return ret;
1717 }
1718 
1719 void kvm_set_sigmask_len(KVMState *s, unsigned int sigmask_len)
1720 {
1721     s->sigmask_len = sigmask_len;
1722 }
1723 
1724 static void kvm_handle_io(uint16_t port, MemTxAttrs attrs, void *data, int direction,
1725                           int size, uint32_t count)
1726 {
1727     int i;
1728     uint8_t *ptr = data;
1729 
1730     for (i = 0; i < count; i++) {
1731         address_space_rw(&address_space_io, port, attrs,
1732                          ptr, size,
1733                          direction == KVM_EXIT_IO_OUT);
1734         ptr += size;
1735     }
1736 }
1737 
1738 static int kvm_handle_internal_error(CPUState *cpu, struct kvm_run *run)
1739 {
1740     fprintf(stderr, "KVM internal error. Suberror: %d\n",
1741             run->internal.suberror);
1742 
1743     if (kvm_check_extension(kvm_state, KVM_CAP_INTERNAL_ERROR_DATA)) {
1744         int i;
1745 
1746         for (i = 0; i < run->internal.ndata; ++i) {
1747             fprintf(stderr, "extra data[%d]: %"PRIx64"\n",
1748                     i, (uint64_t)run->internal.data[i]);
1749         }
1750     }
1751     if (run->internal.suberror == KVM_INTERNAL_ERROR_EMULATION) {
1752         fprintf(stderr, "emulation failure\n");
1753         if (!kvm_arch_stop_on_emulation_error(cpu)) {
1754             cpu_dump_state(cpu, stderr, fprintf, CPU_DUMP_CODE);
1755             return EXCP_INTERRUPT;
1756         }
1757     }
1758     /* FIXME: Should trigger a qmp message to let management know
1759      * something went wrong.
1760      */
1761     return -1;
1762 }
1763 
1764 void kvm_flush_coalesced_mmio_buffer(void)
1765 {
1766     KVMState *s = kvm_state;
1767 
1768     if (s->coalesced_flush_in_progress) {
1769         return;
1770     }
1771 
1772     s->coalesced_flush_in_progress = true;
1773 
1774     if (s->coalesced_mmio_ring) {
1775         struct kvm_coalesced_mmio_ring *ring = s->coalesced_mmio_ring;
1776         while (ring->first != ring->last) {
1777             struct kvm_coalesced_mmio *ent;
1778 
1779             ent = &ring->coalesced_mmio[ring->first];
1780 
1781             cpu_physical_memory_write(ent->phys_addr, ent->data, ent->len);
1782             smp_wmb();
1783             ring->first = (ring->first + 1) % KVM_COALESCED_MMIO_MAX;
1784         }
1785     }
1786 
1787     s->coalesced_flush_in_progress = false;
1788 }
1789 
1790 static void do_kvm_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg)
1791 {
1792     if (!cpu->vcpu_dirty) {
1793         kvm_arch_get_registers(cpu);
1794         cpu->vcpu_dirty = true;
1795     }
1796 }
1797 
1798 void kvm_cpu_synchronize_state(CPUState *cpu)
1799 {
1800     if (!cpu->vcpu_dirty) {
1801         run_on_cpu(cpu, do_kvm_cpu_synchronize_state, RUN_ON_CPU_NULL);
1802     }
1803 }
1804 
1805 static void do_kvm_cpu_synchronize_post_reset(CPUState *cpu, run_on_cpu_data arg)
1806 {
1807     kvm_arch_put_registers(cpu, KVM_PUT_RESET_STATE);
1808     cpu->vcpu_dirty = false;
1809 }
1810 
1811 void kvm_cpu_synchronize_post_reset(CPUState *cpu)
1812 {
1813     run_on_cpu(cpu, do_kvm_cpu_synchronize_post_reset, RUN_ON_CPU_NULL);
1814 }
1815 
1816 static void do_kvm_cpu_synchronize_post_init(CPUState *cpu, run_on_cpu_data arg)
1817 {
1818     kvm_arch_put_registers(cpu, KVM_PUT_FULL_STATE);
1819     cpu->vcpu_dirty = false;
1820 }
1821 
1822 void kvm_cpu_synchronize_post_init(CPUState *cpu)
1823 {
1824     run_on_cpu(cpu, do_kvm_cpu_synchronize_post_init, RUN_ON_CPU_NULL);
1825 }
1826 
1827 static void do_kvm_cpu_synchronize_pre_loadvm(CPUState *cpu, run_on_cpu_data arg)
1828 {
1829     cpu->vcpu_dirty = true;
1830 }
1831 
1832 void kvm_cpu_synchronize_pre_loadvm(CPUState *cpu)
1833 {
1834     run_on_cpu(cpu, do_kvm_cpu_synchronize_pre_loadvm, RUN_ON_CPU_NULL);
1835 }
1836 
1837 #ifdef KVM_HAVE_MCE_INJECTION
1838 static __thread void *pending_sigbus_addr;
1839 static __thread int pending_sigbus_code;
1840 static __thread bool have_sigbus_pending;
1841 #endif
1842 
1843 static void kvm_cpu_kick(CPUState *cpu)
1844 {
1845     atomic_set(&cpu->kvm_run->immediate_exit, 1);
1846 }
1847 
1848 static void kvm_cpu_kick_self(void)
1849 {
1850     if (kvm_immediate_exit) {
1851         kvm_cpu_kick(current_cpu);
1852     } else {
1853         qemu_cpu_kick_self();
1854     }
1855 }
1856 
1857 static void kvm_eat_signals(CPUState *cpu)
1858 {
1859     struct timespec ts = { 0, 0 };
1860     siginfo_t siginfo;
1861     sigset_t waitset;
1862     sigset_t chkset;
1863     int r;
1864 
1865     if (kvm_immediate_exit) {
1866         atomic_set(&cpu->kvm_run->immediate_exit, 0);
1867         /* Write kvm_run->immediate_exit before the cpu->exit_request
1868          * write in kvm_cpu_exec.
1869          */
1870         smp_wmb();
1871         return;
1872     }
1873 
1874     sigemptyset(&waitset);
1875     sigaddset(&waitset, SIG_IPI);
1876 
1877     do {
1878         r = sigtimedwait(&waitset, &siginfo, &ts);
1879         if (r == -1 && !(errno == EAGAIN || errno == EINTR)) {
1880             perror("sigtimedwait");
1881             exit(1);
1882         }
1883 
1884         r = sigpending(&chkset);
1885         if (r == -1) {
1886             perror("sigpending");
1887             exit(1);
1888         }
1889     } while (sigismember(&chkset, SIG_IPI));
1890 }
1891 
1892 int kvm_cpu_exec(CPUState *cpu)
1893 {
1894     struct kvm_run *run = cpu->kvm_run;
1895     int ret, run_ret;
1896 
1897     DPRINTF("kvm_cpu_exec()\n");
1898 
1899     if (kvm_arch_process_async_events(cpu)) {
1900         atomic_set(&cpu->exit_request, 0);
1901         return EXCP_HLT;
1902     }
1903 
1904     qemu_mutex_unlock_iothread();
1905     cpu_exec_start(cpu);
1906 
1907     do {
1908         MemTxAttrs attrs;
1909 
1910         if (cpu->vcpu_dirty) {
1911             kvm_arch_put_registers(cpu, KVM_PUT_RUNTIME_STATE);
1912             cpu->vcpu_dirty = false;
1913         }
1914 
1915         kvm_arch_pre_run(cpu, run);
1916         if (atomic_read(&cpu->exit_request)) {
1917             DPRINTF("interrupt exit requested\n");
1918             /*
1919              * KVM requires us to reenter the kernel after IO exits to complete
1920              * instruction emulation. This self-signal will ensure that we
1921              * leave ASAP again.
1922              */
1923             kvm_cpu_kick_self();
1924         }
1925 
1926         /* Read cpu->exit_request before KVM_RUN reads run->immediate_exit.
1927          * Matching barrier in kvm_eat_signals.
1928          */
1929         smp_rmb();
1930 
1931         run_ret = kvm_vcpu_ioctl(cpu, KVM_RUN, 0);
1932 
1933         attrs = kvm_arch_post_run(cpu, run);
1934 
1935 #ifdef KVM_HAVE_MCE_INJECTION
1936         if (unlikely(have_sigbus_pending)) {
1937             qemu_mutex_lock_iothread();
1938             kvm_arch_on_sigbus_vcpu(cpu, pending_sigbus_code,
1939                                     pending_sigbus_addr);
1940             have_sigbus_pending = false;
1941             qemu_mutex_unlock_iothread();
1942         }
1943 #endif
1944 
1945         if (run_ret < 0) {
1946             if (run_ret == -EINTR || run_ret == -EAGAIN) {
1947                 DPRINTF("io window exit\n");
1948                 kvm_eat_signals(cpu);
1949                 ret = EXCP_INTERRUPT;
1950                 break;
1951             }
1952             fprintf(stderr, "error: kvm run failed %s\n",
1953                     strerror(-run_ret));
1954 #ifdef TARGET_PPC
1955             if (run_ret == -EBUSY) {
1956                 fprintf(stderr,
1957                         "This is probably because your SMT is enabled.\n"
1958                         "VCPU can only run on primary threads with all "
1959                         "secondary threads offline.\n");
1960             }
1961 #endif
1962             ret = -1;
1963             break;
1964         }
1965 
1966         trace_kvm_run_exit(cpu->cpu_index, run->exit_reason);
1967         switch (run->exit_reason) {
1968         case KVM_EXIT_IO:
1969             DPRINTF("handle_io\n");
1970             /* Called outside BQL */
1971             kvm_handle_io(run->io.port, attrs,
1972                           (uint8_t *)run + run->io.data_offset,
1973                           run->io.direction,
1974                           run->io.size,
1975                           run->io.count);
1976             ret = 0;
1977             break;
1978         case KVM_EXIT_MMIO:
1979             DPRINTF("handle_mmio\n");
1980             /* Called outside BQL */
1981             address_space_rw(&address_space_memory,
1982                              run->mmio.phys_addr, attrs,
1983                              run->mmio.data,
1984                              run->mmio.len,
1985                              run->mmio.is_write);
1986             ret = 0;
1987             break;
1988         case KVM_EXIT_IRQ_WINDOW_OPEN:
1989             DPRINTF("irq_window_open\n");
1990             ret = EXCP_INTERRUPT;
1991             break;
1992         case KVM_EXIT_SHUTDOWN:
1993             DPRINTF("shutdown\n");
1994             qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
1995             ret = EXCP_INTERRUPT;
1996             break;
1997         case KVM_EXIT_UNKNOWN:
1998             fprintf(stderr, "KVM: unknown exit, hardware reason %" PRIx64 "\n",
1999                     (uint64_t)run->hw.hardware_exit_reason);
2000             ret = -1;
2001             break;
2002         case KVM_EXIT_INTERNAL_ERROR:
2003             ret = kvm_handle_internal_error(cpu, run);
2004             break;
2005         case KVM_EXIT_SYSTEM_EVENT:
2006             switch (run->system_event.type) {
2007             case KVM_SYSTEM_EVENT_SHUTDOWN:
2008                 qemu_system_shutdown_request(SHUTDOWN_CAUSE_GUEST_SHUTDOWN);
2009                 ret = EXCP_INTERRUPT;
2010                 break;
2011             case KVM_SYSTEM_EVENT_RESET:
2012                 qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
2013                 ret = EXCP_INTERRUPT;
2014                 break;
2015             case KVM_SYSTEM_EVENT_CRASH:
2016                 kvm_cpu_synchronize_state(cpu);
2017                 qemu_mutex_lock_iothread();
2018                 qemu_system_guest_panicked(cpu_get_crash_info(cpu));
2019                 qemu_mutex_unlock_iothread();
2020                 ret = 0;
2021                 break;
2022             default:
2023                 DPRINTF("kvm_arch_handle_exit\n");
2024                 ret = kvm_arch_handle_exit(cpu, run);
2025                 break;
2026             }
2027             break;
2028         default:
2029             DPRINTF("kvm_arch_handle_exit\n");
2030             ret = kvm_arch_handle_exit(cpu, run);
2031             break;
2032         }
2033     } while (ret == 0);
2034 
2035     cpu_exec_end(cpu);
2036     qemu_mutex_lock_iothread();
2037 
2038     if (ret < 0) {
2039         cpu_dump_state(cpu, stderr, fprintf, CPU_DUMP_CODE);
2040         vm_stop(RUN_STATE_INTERNAL_ERROR);
2041     }
2042 
2043     atomic_set(&cpu->exit_request, 0);
2044     return ret;
2045 }
2046 
2047 int kvm_ioctl(KVMState *s, int type, ...)
2048 {
2049     int ret;
2050     void *arg;
2051     va_list ap;
2052 
2053     va_start(ap, type);
2054     arg = va_arg(ap, void *);
2055     va_end(ap);
2056 
2057     trace_kvm_ioctl(type, arg);
2058     ret = ioctl(s->fd, type, arg);
2059     if (ret == -1) {
2060         ret = -errno;
2061     }
2062     return ret;
2063 }
2064 
2065 int kvm_vm_ioctl(KVMState *s, int type, ...)
2066 {
2067     int ret;
2068     void *arg;
2069     va_list ap;
2070 
2071     va_start(ap, type);
2072     arg = va_arg(ap, void *);
2073     va_end(ap);
2074 
2075     trace_kvm_vm_ioctl(type, arg);
2076     ret = ioctl(s->vmfd, type, arg);
2077     if (ret == -1) {
2078         ret = -errno;
2079     }
2080     return ret;
2081 }
2082 
2083 int kvm_vcpu_ioctl(CPUState *cpu, int type, ...)
2084 {
2085     int ret;
2086     void *arg;
2087     va_list ap;
2088 
2089     va_start(ap, type);
2090     arg = va_arg(ap, void *);
2091     va_end(ap);
2092 
2093     trace_kvm_vcpu_ioctl(cpu->cpu_index, type, arg);
2094     ret = ioctl(cpu->kvm_fd, type, arg);
2095     if (ret == -1) {
2096         ret = -errno;
2097     }
2098     return ret;
2099 }
2100 
2101 int kvm_device_ioctl(int fd, int type, ...)
2102 {
2103     int ret;
2104     void *arg;
2105     va_list ap;
2106 
2107     va_start(ap, type);
2108     arg = va_arg(ap, void *);
2109     va_end(ap);
2110 
2111     trace_kvm_device_ioctl(fd, type, arg);
2112     ret = ioctl(fd, type, arg);
2113     if (ret == -1) {
2114         ret = -errno;
2115     }
2116     return ret;
2117 }
2118 
2119 int kvm_vm_check_attr(KVMState *s, uint32_t group, uint64_t attr)
2120 {
2121     int ret;
2122     struct kvm_device_attr attribute = {
2123         .group = group,
2124         .attr = attr,
2125     };
2126 
2127     if (!kvm_vm_attributes_allowed) {
2128         return 0;
2129     }
2130 
2131     ret = kvm_vm_ioctl(s, KVM_HAS_DEVICE_ATTR, &attribute);
2132     /* kvm returns 0 on success for HAS_DEVICE_ATTR */
2133     return ret ? 0 : 1;
2134 }
2135 
2136 int kvm_device_check_attr(int dev_fd, uint32_t group, uint64_t attr)
2137 {
2138     struct kvm_device_attr attribute = {
2139         .group = group,
2140         .attr = attr,
2141         .flags = 0,
2142     };
2143 
2144     return kvm_device_ioctl(dev_fd, KVM_HAS_DEVICE_ATTR, &attribute) ? 0 : 1;
2145 }
2146 
2147 int kvm_device_access(int fd, int group, uint64_t attr,
2148                       void *val, bool write, Error **errp)
2149 {
2150     struct kvm_device_attr kvmattr;
2151     int err;
2152 
2153     kvmattr.flags = 0;
2154     kvmattr.group = group;
2155     kvmattr.attr = attr;
2156     kvmattr.addr = (uintptr_t)val;
2157 
2158     err = kvm_device_ioctl(fd,
2159                            write ? KVM_SET_DEVICE_ATTR : KVM_GET_DEVICE_ATTR,
2160                            &kvmattr);
2161     if (err < 0) {
2162         error_setg_errno(errp, -err,
2163                          "KVM_%s_DEVICE_ATTR failed: Group %d "
2164                          "attr 0x%016" PRIx64,
2165                          write ? "SET" : "GET", group, attr);
2166     }
2167     return err;
2168 }
2169 
2170 bool kvm_has_sync_mmu(void)
2171 {
2172     return kvm_state->sync_mmu;
2173 }
2174 
2175 int kvm_has_vcpu_events(void)
2176 {
2177     return kvm_state->vcpu_events;
2178 }
2179 
2180 int kvm_has_robust_singlestep(void)
2181 {
2182     return kvm_state->robust_singlestep;
2183 }
2184 
2185 int kvm_has_debugregs(void)
2186 {
2187     return kvm_state->debugregs;
2188 }
2189 
2190 int kvm_has_many_ioeventfds(void)
2191 {
2192     if (!kvm_enabled()) {
2193         return 0;
2194     }
2195     return kvm_state->many_ioeventfds;
2196 }
2197 
2198 int kvm_has_gsi_routing(void)
2199 {
2200 #ifdef KVM_CAP_IRQ_ROUTING
2201     return kvm_check_extension(kvm_state, KVM_CAP_IRQ_ROUTING);
2202 #else
2203     return false;
2204 #endif
2205 }
2206 
2207 int kvm_has_intx_set_mask(void)
2208 {
2209     return kvm_state->intx_set_mask;
2210 }
2211 
2212 bool kvm_arm_supports_user_irq(void)
2213 {
2214     return kvm_check_extension(kvm_state, KVM_CAP_ARM_USER_IRQ);
2215 }
2216 
2217 #ifdef KVM_CAP_SET_GUEST_DEBUG
2218 struct kvm_sw_breakpoint *kvm_find_sw_breakpoint(CPUState *cpu,
2219                                                  target_ulong pc)
2220 {
2221     struct kvm_sw_breakpoint *bp;
2222 
2223     QTAILQ_FOREACH(bp, &cpu->kvm_state->kvm_sw_breakpoints, entry) {
2224         if (bp->pc == pc) {
2225             return bp;
2226         }
2227     }
2228     return NULL;
2229 }
2230 
2231 int kvm_sw_breakpoints_active(CPUState *cpu)
2232 {
2233     return !QTAILQ_EMPTY(&cpu->kvm_state->kvm_sw_breakpoints);
2234 }
2235 
2236 struct kvm_set_guest_debug_data {
2237     struct kvm_guest_debug dbg;
2238     int err;
2239 };
2240 
2241 static void kvm_invoke_set_guest_debug(CPUState *cpu, run_on_cpu_data data)
2242 {
2243     struct kvm_set_guest_debug_data *dbg_data =
2244         (struct kvm_set_guest_debug_data *) data.host_ptr;
2245 
2246     dbg_data->err = kvm_vcpu_ioctl(cpu, KVM_SET_GUEST_DEBUG,
2247                                    &dbg_data->dbg);
2248 }
2249 
2250 int kvm_update_guest_debug(CPUState *cpu, unsigned long reinject_trap)
2251 {
2252     struct kvm_set_guest_debug_data data;
2253 
2254     data.dbg.control = reinject_trap;
2255 
2256     if (cpu->singlestep_enabled) {
2257         data.dbg.control |= KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_SINGLESTEP;
2258     }
2259     kvm_arch_update_guest_debug(cpu, &data.dbg);
2260 
2261     run_on_cpu(cpu, kvm_invoke_set_guest_debug,
2262                RUN_ON_CPU_HOST_PTR(&data));
2263     return data.err;
2264 }
2265 
2266 int kvm_insert_breakpoint(CPUState *cpu, target_ulong addr,
2267                           target_ulong len, int type)
2268 {
2269     struct kvm_sw_breakpoint *bp;
2270     int err;
2271 
2272     if (type == GDB_BREAKPOINT_SW) {
2273         bp = kvm_find_sw_breakpoint(cpu, addr);
2274         if (bp) {
2275             bp->use_count++;
2276             return 0;
2277         }
2278 
2279         bp = g_malloc(sizeof(struct kvm_sw_breakpoint));
2280         bp->pc = addr;
2281         bp->use_count = 1;
2282         err = kvm_arch_insert_sw_breakpoint(cpu, bp);
2283         if (err) {
2284             g_free(bp);
2285             return err;
2286         }
2287 
2288         QTAILQ_INSERT_HEAD(&cpu->kvm_state->kvm_sw_breakpoints, bp, entry);
2289     } else {
2290         err = kvm_arch_insert_hw_breakpoint(addr, len, type);
2291         if (err) {
2292             return err;
2293         }
2294     }
2295 
2296     CPU_FOREACH(cpu) {
2297         err = kvm_update_guest_debug(cpu, 0);
2298         if (err) {
2299             return err;
2300         }
2301     }
2302     return 0;
2303 }
2304 
2305 int kvm_remove_breakpoint(CPUState *cpu, target_ulong addr,
2306                           target_ulong len, int type)
2307 {
2308     struct kvm_sw_breakpoint *bp;
2309     int err;
2310 
2311     if (type == GDB_BREAKPOINT_SW) {
2312         bp = kvm_find_sw_breakpoint(cpu, addr);
2313         if (!bp) {
2314             return -ENOENT;
2315         }
2316 
2317         if (bp->use_count > 1) {
2318             bp->use_count--;
2319             return 0;
2320         }
2321 
2322         err = kvm_arch_remove_sw_breakpoint(cpu, bp);
2323         if (err) {
2324             return err;
2325         }
2326 
2327         QTAILQ_REMOVE(&cpu->kvm_state->kvm_sw_breakpoints, bp, entry);
2328         g_free(bp);
2329     } else {
2330         err = kvm_arch_remove_hw_breakpoint(addr, len, type);
2331         if (err) {
2332             return err;
2333         }
2334     }
2335 
2336     CPU_FOREACH(cpu) {
2337         err = kvm_update_guest_debug(cpu, 0);
2338         if (err) {
2339             return err;
2340         }
2341     }
2342     return 0;
2343 }
2344 
2345 void kvm_remove_all_breakpoints(CPUState *cpu)
2346 {
2347     struct kvm_sw_breakpoint *bp, *next;
2348     KVMState *s = cpu->kvm_state;
2349     CPUState *tmpcpu;
2350 
2351     QTAILQ_FOREACH_SAFE(bp, &s->kvm_sw_breakpoints, entry, next) {
2352         if (kvm_arch_remove_sw_breakpoint(cpu, bp) != 0) {
2353             /* Try harder to find a CPU that currently sees the breakpoint. */
2354             CPU_FOREACH(tmpcpu) {
2355                 if (kvm_arch_remove_sw_breakpoint(tmpcpu, bp) == 0) {
2356                     break;
2357                 }
2358             }
2359         }
2360         QTAILQ_REMOVE(&s->kvm_sw_breakpoints, bp, entry);
2361         g_free(bp);
2362     }
2363     kvm_arch_remove_all_hw_breakpoints();
2364 
2365     CPU_FOREACH(cpu) {
2366         kvm_update_guest_debug(cpu, 0);
2367     }
2368 }
2369 
2370 #else /* !KVM_CAP_SET_GUEST_DEBUG */
2371 
2372 int kvm_update_guest_debug(CPUState *cpu, unsigned long reinject_trap)
2373 {
2374     return -EINVAL;
2375 }
2376 
2377 int kvm_insert_breakpoint(CPUState *cpu, target_ulong addr,
2378                           target_ulong len, int type)
2379 {
2380     return -EINVAL;
2381 }
2382 
2383 int kvm_remove_breakpoint(CPUState *cpu, target_ulong addr,
2384                           target_ulong len, int type)
2385 {
2386     return -EINVAL;
2387 }
2388 
2389 void kvm_remove_all_breakpoints(CPUState *cpu)
2390 {
2391 }
2392 #endif /* !KVM_CAP_SET_GUEST_DEBUG */
2393 
2394 static int kvm_set_signal_mask(CPUState *cpu, const sigset_t *sigset)
2395 {
2396     KVMState *s = kvm_state;
2397     struct kvm_signal_mask *sigmask;
2398     int r;
2399 
2400     sigmask = g_malloc(sizeof(*sigmask) + sizeof(*sigset));
2401 
2402     sigmask->len = s->sigmask_len;
2403     memcpy(sigmask->sigset, sigset, sizeof(*sigset));
2404     r = kvm_vcpu_ioctl(cpu, KVM_SET_SIGNAL_MASK, sigmask);
2405     g_free(sigmask);
2406 
2407     return r;
2408 }
2409 
2410 static void kvm_ipi_signal(int sig)
2411 {
2412     if (current_cpu) {
2413         assert(kvm_immediate_exit);
2414         kvm_cpu_kick(current_cpu);
2415     }
2416 }
2417 
2418 void kvm_init_cpu_signals(CPUState *cpu)
2419 {
2420     int r;
2421     sigset_t set;
2422     struct sigaction sigact;
2423 
2424     memset(&sigact, 0, sizeof(sigact));
2425     sigact.sa_handler = kvm_ipi_signal;
2426     sigaction(SIG_IPI, &sigact, NULL);
2427 
2428     pthread_sigmask(SIG_BLOCK, NULL, &set);
2429 #if defined KVM_HAVE_MCE_INJECTION
2430     sigdelset(&set, SIGBUS);
2431     pthread_sigmask(SIG_SETMASK, &set, NULL);
2432 #endif
2433     sigdelset(&set, SIG_IPI);
2434     if (kvm_immediate_exit) {
2435         r = pthread_sigmask(SIG_SETMASK, &set, NULL);
2436     } else {
2437         r = kvm_set_signal_mask(cpu, &set);
2438     }
2439     if (r) {
2440         fprintf(stderr, "kvm_set_signal_mask: %s\n", strerror(-r));
2441         exit(1);
2442     }
2443 }
2444 
2445 /* Called asynchronously in VCPU thread.  */
2446 int kvm_on_sigbus_vcpu(CPUState *cpu, int code, void *addr)
2447 {
2448 #ifdef KVM_HAVE_MCE_INJECTION
2449     if (have_sigbus_pending) {
2450         return 1;
2451     }
2452     have_sigbus_pending = true;
2453     pending_sigbus_addr = addr;
2454     pending_sigbus_code = code;
2455     atomic_set(&cpu->exit_request, 1);
2456     return 0;
2457 #else
2458     return 1;
2459 #endif
2460 }
2461 
2462 /* Called synchronously (via signalfd) in main thread.  */
2463 int kvm_on_sigbus(int code, void *addr)
2464 {
2465 #ifdef KVM_HAVE_MCE_INJECTION
2466     /* Action required MCE kills the process if SIGBUS is blocked.  Because
2467      * that's what happens in the I/O thread, where we handle MCE via signalfd,
2468      * we can only get action optional here.
2469      */
2470     assert(code != BUS_MCEERR_AR);
2471     kvm_arch_on_sigbus_vcpu(first_cpu, code, addr);
2472     return 0;
2473 #else
2474     return 1;
2475 #endif
2476 }
2477 
2478 int kvm_create_device(KVMState *s, uint64_t type, bool test)
2479 {
2480     int ret;
2481     struct kvm_create_device create_dev;
2482 
2483     create_dev.type = type;
2484     create_dev.fd = -1;
2485     create_dev.flags = test ? KVM_CREATE_DEVICE_TEST : 0;
2486 
2487     if (!kvm_check_extension(s, KVM_CAP_DEVICE_CTRL)) {
2488         return -ENOTSUP;
2489     }
2490 
2491     ret = kvm_vm_ioctl(s, KVM_CREATE_DEVICE, &create_dev);
2492     if (ret) {
2493         return ret;
2494     }
2495 
2496     return test ? 0 : create_dev.fd;
2497 }
2498 
2499 bool kvm_device_supported(int vmfd, uint64_t type)
2500 {
2501     struct kvm_create_device create_dev = {
2502         .type = type,
2503         .fd = -1,
2504         .flags = KVM_CREATE_DEVICE_TEST,
2505     };
2506 
2507     if (ioctl(vmfd, KVM_CHECK_EXTENSION, KVM_CAP_DEVICE_CTRL) <= 0) {
2508         return false;
2509     }
2510 
2511     return (ioctl(vmfd, KVM_CREATE_DEVICE, &create_dev) >= 0);
2512 }
2513 
2514 int kvm_set_one_reg(CPUState *cs, uint64_t id, void *source)
2515 {
2516     struct kvm_one_reg reg;
2517     int r;
2518 
2519     reg.id = id;
2520     reg.addr = (uintptr_t) source;
2521     r = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
2522     if (r) {
2523         trace_kvm_failed_reg_set(id, strerror(-r));
2524     }
2525     return r;
2526 }
2527 
2528 int kvm_get_one_reg(CPUState *cs, uint64_t id, void *target)
2529 {
2530     struct kvm_one_reg reg;
2531     int r;
2532 
2533     reg.id = id;
2534     reg.addr = (uintptr_t) target;
2535     r = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
2536     if (r) {
2537         trace_kvm_failed_reg_get(id, strerror(-r));
2538     }
2539     return r;
2540 }
2541 
2542 static void kvm_accel_class_init(ObjectClass *oc, void *data)
2543 {
2544     AccelClass *ac = ACCEL_CLASS(oc);
2545     ac->name = "KVM";
2546     ac->init_machine = kvm_init;
2547     ac->allowed = &kvm_allowed;
2548 }
2549 
2550 static const TypeInfo kvm_accel_type = {
2551     .name = TYPE_KVM_ACCEL,
2552     .parent = TYPE_ACCEL,
2553     .class_init = kvm_accel_class_init,
2554     .instance_size = sizeof(KVMState),
2555 };
2556 
2557 static void kvm_type_init(void)
2558 {
2559     type_register_static(&kvm_accel_type);
2560 }
2561 
2562 type_init(kvm_type_init);
2563