xref: /openbmc/qemu/target/i386/cpu.c (revision 70b75667)
1 /*
2  *  i386 CPUID helper functions
3  *
4  *  Copyright (c) 2003 Fabrice Bellard
5  *
6  * This library is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU Lesser General Public
8  * License as published by the Free Software Foundation; either
9  * version 2.1 of the License, or (at your option) any later version.
10  *
11  * This library is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
14  * Lesser General Public License for more details.
15  *
16  * You should have received a copy of the GNU Lesser General Public
17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18  */
19 
20 #include "qemu/osdep.h"
21 #include "qemu/units.h"
22 #include "qemu/cutils.h"
23 #include "qemu/bitops.h"
24 #include "qemu/qemu-print.h"
25 
26 #include "cpu.h"
27 #include "exec/exec-all.h"
28 #include "sysemu/kvm.h"
29 #include "sysemu/reset.h"
30 #include "sysemu/hvf.h"
31 #include "sysemu/cpus.h"
32 #include "sysemu/xen.h"
33 #include "sysemu/whpx.h"
34 #include "kvm_i386.h"
35 #include "sev_i386.h"
36 
37 #include "qemu/error-report.h"
38 #include "qemu/module.h"
39 #include "qemu/option.h"
40 #include "qemu/config-file.h"
41 #include "qapi/error.h"
42 #include "qapi/qapi-visit-machine.h"
43 #include "qapi/qapi-visit-run-state.h"
44 #include "qapi/qmp/qdict.h"
45 #include "qapi/qmp/qerror.h"
46 #include "qapi/visitor.h"
47 #include "qom/qom-qobject.h"
48 #include "sysemu/arch_init.h"
49 #include "qapi/qapi-commands-machine-target.h"
50 
51 #include "standard-headers/asm-x86/kvm_para.h"
52 
53 #include "sysemu/sysemu.h"
54 #include "sysemu/tcg.h"
55 #include "hw/qdev-properties.h"
56 #include "hw/i386/topology.h"
57 #ifndef CONFIG_USER_ONLY
58 #include "exec/address-spaces.h"
59 #include "hw/i386/apic_internal.h"
60 #include "hw/boards.h"
61 #endif
62 
63 #include "disas/capstone.h"
64 
65 /* Helpers for building CPUID[2] descriptors: */
66 
67 struct CPUID2CacheDescriptorInfo {
68     enum CacheType type;
69     int level;
70     int size;
71     int line_size;
72     int associativity;
73 };
74 
75 /*
76  * Known CPUID 2 cache descriptors.
77  * From Intel SDM Volume 2A, CPUID instruction
78  */
79 struct CPUID2CacheDescriptorInfo cpuid2_cache_descriptors[] = {
80     [0x06] = { .level = 1, .type = INSTRUCTION_CACHE, .size =   8 * KiB,
81                .associativity = 4,  .line_size = 32, },
82     [0x08] = { .level = 1, .type = INSTRUCTION_CACHE, .size =  16 * KiB,
83                .associativity = 4,  .line_size = 32, },
84     [0x09] = { .level = 1, .type = INSTRUCTION_CACHE, .size =  32 * KiB,
85                .associativity = 4,  .line_size = 64, },
86     [0x0A] = { .level = 1, .type = DATA_CACHE,        .size =   8 * KiB,
87                .associativity = 2,  .line_size = 32, },
88     [0x0C] = { .level = 1, .type = DATA_CACHE,        .size =  16 * KiB,
89                .associativity = 4,  .line_size = 32, },
90     [0x0D] = { .level = 1, .type = DATA_CACHE,        .size =  16 * KiB,
91                .associativity = 4,  .line_size = 64, },
92     [0x0E] = { .level = 1, .type = DATA_CACHE,        .size =  24 * KiB,
93                .associativity = 6,  .line_size = 64, },
94     [0x1D] = { .level = 2, .type = UNIFIED_CACHE,     .size = 128 * KiB,
95                .associativity = 2,  .line_size = 64, },
96     [0x21] = { .level = 2, .type = UNIFIED_CACHE,     .size = 256 * KiB,
97                .associativity = 8,  .line_size = 64, },
98     /* lines per sector is not supported cpuid2_cache_descriptor(),
99     * so descriptors 0x22, 0x23 are not included
100     */
101     [0x24] = { .level = 2, .type = UNIFIED_CACHE,     .size =   1 * MiB,
102                .associativity = 16, .line_size = 64, },
103     /* lines per sector is not supported cpuid2_cache_descriptor(),
104     * so descriptors 0x25, 0x20 are not included
105     */
106     [0x2C] = { .level = 1, .type = DATA_CACHE,        .size =  32 * KiB,
107                .associativity = 8,  .line_size = 64, },
108     [0x30] = { .level = 1, .type = INSTRUCTION_CACHE, .size =  32 * KiB,
109                .associativity = 8,  .line_size = 64, },
110     [0x41] = { .level = 2, .type = UNIFIED_CACHE,     .size = 128 * KiB,
111                .associativity = 4,  .line_size = 32, },
112     [0x42] = { .level = 2, .type = UNIFIED_CACHE,     .size = 256 * KiB,
113                .associativity = 4,  .line_size = 32, },
114     [0x43] = { .level = 2, .type = UNIFIED_CACHE,     .size = 512 * KiB,
115                .associativity = 4,  .line_size = 32, },
116     [0x44] = { .level = 2, .type = UNIFIED_CACHE,     .size =   1 * MiB,
117                .associativity = 4,  .line_size = 32, },
118     [0x45] = { .level = 2, .type = UNIFIED_CACHE,     .size =   2 * MiB,
119                .associativity = 4,  .line_size = 32, },
120     [0x46] = { .level = 3, .type = UNIFIED_CACHE,     .size =   4 * MiB,
121                .associativity = 4,  .line_size = 64, },
122     [0x47] = { .level = 3, .type = UNIFIED_CACHE,     .size =   8 * MiB,
123                .associativity = 8,  .line_size = 64, },
124     [0x48] = { .level = 2, .type = UNIFIED_CACHE,     .size =   3 * MiB,
125                .associativity = 12, .line_size = 64, },
126     /* Descriptor 0x49 depends on CPU family/model, so it is not included */
127     [0x4A] = { .level = 3, .type = UNIFIED_CACHE,     .size =   6 * MiB,
128                .associativity = 12, .line_size = 64, },
129     [0x4B] = { .level = 3, .type = UNIFIED_CACHE,     .size =   8 * MiB,
130                .associativity = 16, .line_size = 64, },
131     [0x4C] = { .level = 3, .type = UNIFIED_CACHE,     .size =  12 * MiB,
132                .associativity = 12, .line_size = 64, },
133     [0x4D] = { .level = 3, .type = UNIFIED_CACHE,     .size =  16 * MiB,
134                .associativity = 16, .line_size = 64, },
135     [0x4E] = { .level = 2, .type = UNIFIED_CACHE,     .size =   6 * MiB,
136                .associativity = 24, .line_size = 64, },
137     [0x60] = { .level = 1, .type = DATA_CACHE,        .size =  16 * KiB,
138                .associativity = 8,  .line_size = 64, },
139     [0x66] = { .level = 1, .type = DATA_CACHE,        .size =   8 * KiB,
140                .associativity = 4,  .line_size = 64, },
141     [0x67] = { .level = 1, .type = DATA_CACHE,        .size =  16 * KiB,
142                .associativity = 4,  .line_size = 64, },
143     [0x68] = { .level = 1, .type = DATA_CACHE,        .size =  32 * KiB,
144                .associativity = 4,  .line_size = 64, },
145     [0x78] = { .level = 2, .type = UNIFIED_CACHE,     .size =   1 * MiB,
146                .associativity = 4,  .line_size = 64, },
147     /* lines per sector is not supported cpuid2_cache_descriptor(),
148     * so descriptors 0x79, 0x7A, 0x7B, 0x7C are not included.
149     */
150     [0x7D] = { .level = 2, .type = UNIFIED_CACHE,     .size =   2 * MiB,
151                .associativity = 8,  .line_size = 64, },
152     [0x7F] = { .level = 2, .type = UNIFIED_CACHE,     .size = 512 * KiB,
153                .associativity = 2,  .line_size = 64, },
154     [0x80] = { .level = 2, .type = UNIFIED_CACHE,     .size = 512 * KiB,
155                .associativity = 8,  .line_size = 64, },
156     [0x82] = { .level = 2, .type = UNIFIED_CACHE,     .size = 256 * KiB,
157                .associativity = 8,  .line_size = 32, },
158     [0x83] = { .level = 2, .type = UNIFIED_CACHE,     .size = 512 * KiB,
159                .associativity = 8,  .line_size = 32, },
160     [0x84] = { .level = 2, .type = UNIFIED_CACHE,     .size =   1 * MiB,
161                .associativity = 8,  .line_size = 32, },
162     [0x85] = { .level = 2, .type = UNIFIED_CACHE,     .size =   2 * MiB,
163                .associativity = 8,  .line_size = 32, },
164     [0x86] = { .level = 2, .type = UNIFIED_CACHE,     .size = 512 * KiB,
165                .associativity = 4,  .line_size = 64, },
166     [0x87] = { .level = 2, .type = UNIFIED_CACHE,     .size =   1 * MiB,
167                .associativity = 8,  .line_size = 64, },
168     [0xD0] = { .level = 3, .type = UNIFIED_CACHE,     .size = 512 * KiB,
169                .associativity = 4,  .line_size = 64, },
170     [0xD1] = { .level = 3, .type = UNIFIED_CACHE,     .size =   1 * MiB,
171                .associativity = 4,  .line_size = 64, },
172     [0xD2] = { .level = 3, .type = UNIFIED_CACHE,     .size =   2 * MiB,
173                .associativity = 4,  .line_size = 64, },
174     [0xD6] = { .level = 3, .type = UNIFIED_CACHE,     .size =   1 * MiB,
175                .associativity = 8,  .line_size = 64, },
176     [0xD7] = { .level = 3, .type = UNIFIED_CACHE,     .size =   2 * MiB,
177                .associativity = 8,  .line_size = 64, },
178     [0xD8] = { .level = 3, .type = UNIFIED_CACHE,     .size =   4 * MiB,
179                .associativity = 8,  .line_size = 64, },
180     [0xDC] = { .level = 3, .type = UNIFIED_CACHE,     .size = 1.5 * MiB,
181                .associativity = 12, .line_size = 64, },
182     [0xDD] = { .level = 3, .type = UNIFIED_CACHE,     .size =   3 * MiB,
183                .associativity = 12, .line_size = 64, },
184     [0xDE] = { .level = 3, .type = UNIFIED_CACHE,     .size =   6 * MiB,
185                .associativity = 12, .line_size = 64, },
186     [0xE2] = { .level = 3, .type = UNIFIED_CACHE,     .size =   2 * MiB,
187                .associativity = 16, .line_size = 64, },
188     [0xE3] = { .level = 3, .type = UNIFIED_CACHE,     .size =   4 * MiB,
189                .associativity = 16, .line_size = 64, },
190     [0xE4] = { .level = 3, .type = UNIFIED_CACHE,     .size =   8 * MiB,
191                .associativity = 16, .line_size = 64, },
192     [0xEA] = { .level = 3, .type = UNIFIED_CACHE,     .size =  12 * MiB,
193                .associativity = 24, .line_size = 64, },
194     [0xEB] = { .level = 3, .type = UNIFIED_CACHE,     .size =  18 * MiB,
195                .associativity = 24, .line_size = 64, },
196     [0xEC] = { .level = 3, .type = UNIFIED_CACHE,     .size =  24 * MiB,
197                .associativity = 24, .line_size = 64, },
198 };
199 
200 /*
201  * "CPUID leaf 2 does not report cache descriptor information,
202  * use CPUID leaf 4 to query cache parameters"
203  */
204 #define CACHE_DESCRIPTOR_UNAVAILABLE 0xFF
205 
206 /*
207  * Return a CPUID 2 cache descriptor for a given cache.
208  * If no known descriptor is found, return CACHE_DESCRIPTOR_UNAVAILABLE
209  */
210 static uint8_t cpuid2_cache_descriptor(CPUCacheInfo *cache)
211 {
212     int i;
213 
214     assert(cache->size > 0);
215     assert(cache->level > 0);
216     assert(cache->line_size > 0);
217     assert(cache->associativity > 0);
218     for (i = 0; i < ARRAY_SIZE(cpuid2_cache_descriptors); i++) {
219         struct CPUID2CacheDescriptorInfo *d = &cpuid2_cache_descriptors[i];
220         if (d->level == cache->level && d->type == cache->type &&
221             d->size == cache->size && d->line_size == cache->line_size &&
222             d->associativity == cache->associativity) {
223                 return i;
224             }
225     }
226 
227     return CACHE_DESCRIPTOR_UNAVAILABLE;
228 }
229 
230 /* CPUID Leaf 4 constants: */
231 
232 /* EAX: */
233 #define CACHE_TYPE_D    1
234 #define CACHE_TYPE_I    2
235 #define CACHE_TYPE_UNIFIED   3
236 
237 #define CACHE_LEVEL(l)        (l << 5)
238 
239 #define CACHE_SELF_INIT_LEVEL (1 << 8)
240 
241 /* EDX: */
242 #define CACHE_NO_INVD_SHARING   (1 << 0)
243 #define CACHE_INCLUSIVE       (1 << 1)
244 #define CACHE_COMPLEX_IDX     (1 << 2)
245 
246 /* Encode CacheType for CPUID[4].EAX */
247 #define CACHE_TYPE(t) (((t) == DATA_CACHE) ? CACHE_TYPE_D : \
248                        ((t) == INSTRUCTION_CACHE) ? CACHE_TYPE_I : \
249                        ((t) == UNIFIED_CACHE) ? CACHE_TYPE_UNIFIED : \
250                        0 /* Invalid value */)
251 
252 
253 /* Encode cache info for CPUID[4] */
254 static void encode_cache_cpuid4(CPUCacheInfo *cache,
255                                 int num_apic_ids, int num_cores,
256                                 uint32_t *eax, uint32_t *ebx,
257                                 uint32_t *ecx, uint32_t *edx)
258 {
259     assert(cache->size == cache->line_size * cache->associativity *
260                           cache->partitions * cache->sets);
261 
262     assert(num_apic_ids > 0);
263     *eax = CACHE_TYPE(cache->type) |
264            CACHE_LEVEL(cache->level) |
265            (cache->self_init ? CACHE_SELF_INIT_LEVEL : 0) |
266            ((num_cores - 1) << 26) |
267            ((num_apic_ids - 1) << 14);
268 
269     assert(cache->line_size > 0);
270     assert(cache->partitions > 0);
271     assert(cache->associativity > 0);
272     /* We don't implement fully-associative caches */
273     assert(cache->associativity < cache->sets);
274     *ebx = (cache->line_size - 1) |
275            ((cache->partitions - 1) << 12) |
276            ((cache->associativity - 1) << 22);
277 
278     assert(cache->sets > 0);
279     *ecx = cache->sets - 1;
280 
281     *edx = (cache->no_invd_sharing ? CACHE_NO_INVD_SHARING : 0) |
282            (cache->inclusive ? CACHE_INCLUSIVE : 0) |
283            (cache->complex_indexing ? CACHE_COMPLEX_IDX : 0);
284 }
285 
286 /* Encode cache info for CPUID[0x80000005].ECX or CPUID[0x80000005].EDX */
287 static uint32_t encode_cache_cpuid80000005(CPUCacheInfo *cache)
288 {
289     assert(cache->size % 1024 == 0);
290     assert(cache->lines_per_tag > 0);
291     assert(cache->associativity > 0);
292     assert(cache->line_size > 0);
293     return ((cache->size / 1024) << 24) | (cache->associativity << 16) |
294            (cache->lines_per_tag << 8) | (cache->line_size);
295 }
296 
297 #define ASSOC_FULL 0xFF
298 
299 /* AMD associativity encoding used on CPUID Leaf 0x80000006: */
300 #define AMD_ENC_ASSOC(a) (a <=   1 ? a   : \
301                           a ==   2 ? 0x2 : \
302                           a ==   4 ? 0x4 : \
303                           a ==   8 ? 0x6 : \
304                           a ==  16 ? 0x8 : \
305                           a ==  32 ? 0xA : \
306                           a ==  48 ? 0xB : \
307                           a ==  64 ? 0xC : \
308                           a ==  96 ? 0xD : \
309                           a == 128 ? 0xE : \
310                           a == ASSOC_FULL ? 0xF : \
311                           0 /* invalid value */)
312 
313 /*
314  * Encode cache info for CPUID[0x80000006].ECX and CPUID[0x80000006].EDX
315  * @l3 can be NULL.
316  */
317 static void encode_cache_cpuid80000006(CPUCacheInfo *l2,
318                                        CPUCacheInfo *l3,
319                                        uint32_t *ecx, uint32_t *edx)
320 {
321     assert(l2->size % 1024 == 0);
322     assert(l2->associativity > 0);
323     assert(l2->lines_per_tag > 0);
324     assert(l2->line_size > 0);
325     *ecx = ((l2->size / 1024) << 16) |
326            (AMD_ENC_ASSOC(l2->associativity) << 12) |
327            (l2->lines_per_tag << 8) | (l2->line_size);
328 
329     if (l3) {
330         assert(l3->size % (512 * 1024) == 0);
331         assert(l3->associativity > 0);
332         assert(l3->lines_per_tag > 0);
333         assert(l3->line_size > 0);
334         *edx = ((l3->size / (512 * 1024)) << 18) |
335                (AMD_ENC_ASSOC(l3->associativity) << 12) |
336                (l3->lines_per_tag << 8) | (l3->line_size);
337     } else {
338         *edx = 0;
339     }
340 }
341 
342 /* Encode cache info for CPUID[8000001D] */
343 static void encode_cache_cpuid8000001d(CPUCacheInfo *cache,
344                                        X86CPUTopoInfo *topo_info,
345                                        uint32_t *eax, uint32_t *ebx,
346                                        uint32_t *ecx, uint32_t *edx)
347 {
348     uint32_t l3_threads;
349     assert(cache->size == cache->line_size * cache->associativity *
350                           cache->partitions * cache->sets);
351 
352     *eax = CACHE_TYPE(cache->type) | CACHE_LEVEL(cache->level) |
353                (cache->self_init ? CACHE_SELF_INIT_LEVEL : 0);
354 
355     /* L3 is shared among multiple cores */
356     if (cache->level == 3) {
357         l3_threads = topo_info->cores_per_die * topo_info->threads_per_core;
358         *eax |= (l3_threads - 1) << 14;
359     } else {
360         *eax |= ((topo_info->threads_per_core - 1) << 14);
361     }
362 
363     assert(cache->line_size > 0);
364     assert(cache->partitions > 0);
365     assert(cache->associativity > 0);
366     /* We don't implement fully-associative caches */
367     assert(cache->associativity < cache->sets);
368     *ebx = (cache->line_size - 1) |
369            ((cache->partitions - 1) << 12) |
370            ((cache->associativity - 1) << 22);
371 
372     assert(cache->sets > 0);
373     *ecx = cache->sets - 1;
374 
375     *edx = (cache->no_invd_sharing ? CACHE_NO_INVD_SHARING : 0) |
376            (cache->inclusive ? CACHE_INCLUSIVE : 0) |
377            (cache->complex_indexing ? CACHE_COMPLEX_IDX : 0);
378 }
379 
380 /* Encode cache info for CPUID[8000001E] */
381 static void encode_topo_cpuid8000001e(X86CPU *cpu, X86CPUTopoInfo *topo_info,
382                                       uint32_t *eax, uint32_t *ebx,
383                                       uint32_t *ecx, uint32_t *edx)
384 {
385     X86CPUTopoIDs topo_ids;
386 
387     x86_topo_ids_from_apicid(cpu->apic_id, topo_info, &topo_ids);
388 
389     *eax = cpu->apic_id;
390 
391     /*
392      * CPUID_Fn8000001E_EBX [Core Identifiers] (CoreId)
393      * Read-only. Reset: 0000_XXXXh.
394      * See Core::X86::Cpuid::ExtApicId.
395      * Core::X86::Cpuid::CoreId_lthree[1:0]_core[3:0]_thread[1:0];
396      * Bits Description
397      * 31:16 Reserved.
398      * 15:8 ThreadsPerCore: threads per core. Read-only. Reset: XXh.
399      *      The number of threads per core is ThreadsPerCore+1.
400      *  7:0 CoreId: core ID. Read-only. Reset: XXh.
401      *
402      *  NOTE: CoreId is already part of apic_id. Just use it. We can
403      *  use all the 8 bits to represent the core_id here.
404      */
405     *ebx = ((topo_info->threads_per_core - 1) << 8) | (topo_ids.core_id & 0xFF);
406 
407     /*
408      * CPUID_Fn8000001E_ECX [Node Identifiers] (NodeId)
409      * Read-only. Reset: 0000_0XXXh.
410      * Core::X86::Cpuid::NodeId_lthree[1:0]_core[3:0]_thread[1:0];
411      * Bits Description
412      * 31:11 Reserved.
413      * 10:8 NodesPerProcessor: Node per processor. Read-only. Reset: XXXb.
414      *      ValidValues:
415      *      Value Description
416      *      000b  1 node per processor.
417      *      001b  2 nodes per processor.
418      *      010b Reserved.
419      *      011b 4 nodes per processor.
420      *      111b-100b Reserved.
421      *  7:0 NodeId: Node ID. Read-only. Reset: XXh.
422      *
423      * NOTE: Hardware reserves 3 bits for number of nodes per processor.
424      * But users can create more nodes than the actual hardware can
425      * support. To genaralize we can use all the upper 8 bits for nodes.
426      * NodeId is combination of node and socket_id which is already decoded
427      * in apic_id. Just use it by shifting.
428      */
429     *ecx = ((topo_info->dies_per_pkg - 1) << 8) |
430            ((cpu->apic_id >> apicid_die_offset(topo_info)) & 0xFF);
431 
432     *edx = 0;
433 }
434 
435 /*
436  * Definitions of the hardcoded cache entries we expose:
437  * These are legacy cache values. If there is a need to change any
438  * of these values please use builtin_x86_defs
439  */
440 
441 /* L1 data cache: */
442 static CPUCacheInfo legacy_l1d_cache = {
443     .type = DATA_CACHE,
444     .level = 1,
445     .size = 32 * KiB,
446     .self_init = 1,
447     .line_size = 64,
448     .associativity = 8,
449     .sets = 64,
450     .partitions = 1,
451     .no_invd_sharing = true,
452 };
453 
454 /*FIXME: CPUID leaf 0x80000005 is inconsistent with leaves 2 & 4 */
455 static CPUCacheInfo legacy_l1d_cache_amd = {
456     .type = DATA_CACHE,
457     .level = 1,
458     .size = 64 * KiB,
459     .self_init = 1,
460     .line_size = 64,
461     .associativity = 2,
462     .sets = 512,
463     .partitions = 1,
464     .lines_per_tag = 1,
465     .no_invd_sharing = true,
466 };
467 
468 /* L1 instruction cache: */
469 static CPUCacheInfo legacy_l1i_cache = {
470     .type = INSTRUCTION_CACHE,
471     .level = 1,
472     .size = 32 * KiB,
473     .self_init = 1,
474     .line_size = 64,
475     .associativity = 8,
476     .sets = 64,
477     .partitions = 1,
478     .no_invd_sharing = true,
479 };
480 
481 /*FIXME: CPUID leaf 0x80000005 is inconsistent with leaves 2 & 4 */
482 static CPUCacheInfo legacy_l1i_cache_amd = {
483     .type = INSTRUCTION_CACHE,
484     .level = 1,
485     .size = 64 * KiB,
486     .self_init = 1,
487     .line_size = 64,
488     .associativity = 2,
489     .sets = 512,
490     .partitions = 1,
491     .lines_per_tag = 1,
492     .no_invd_sharing = true,
493 };
494 
495 /* Level 2 unified cache: */
496 static CPUCacheInfo legacy_l2_cache = {
497     .type = UNIFIED_CACHE,
498     .level = 2,
499     .size = 4 * MiB,
500     .self_init = 1,
501     .line_size = 64,
502     .associativity = 16,
503     .sets = 4096,
504     .partitions = 1,
505     .no_invd_sharing = true,
506 };
507 
508 /*FIXME: CPUID leaf 2 descriptor is inconsistent with CPUID leaf 4 */
509 static CPUCacheInfo legacy_l2_cache_cpuid2 = {
510     .type = UNIFIED_CACHE,
511     .level = 2,
512     .size = 2 * MiB,
513     .line_size = 64,
514     .associativity = 8,
515 };
516 
517 
518 /*FIXME: CPUID leaf 0x80000006 is inconsistent with leaves 2 & 4 */
519 static CPUCacheInfo legacy_l2_cache_amd = {
520     .type = UNIFIED_CACHE,
521     .level = 2,
522     .size = 512 * KiB,
523     .line_size = 64,
524     .lines_per_tag = 1,
525     .associativity = 16,
526     .sets = 512,
527     .partitions = 1,
528 };
529 
530 /* Level 3 unified cache: */
531 static CPUCacheInfo legacy_l3_cache = {
532     .type = UNIFIED_CACHE,
533     .level = 3,
534     .size = 16 * MiB,
535     .line_size = 64,
536     .associativity = 16,
537     .sets = 16384,
538     .partitions = 1,
539     .lines_per_tag = 1,
540     .self_init = true,
541     .inclusive = true,
542     .complex_indexing = true,
543 };
544 
545 /* TLB definitions: */
546 
547 #define L1_DTLB_2M_ASSOC       1
548 #define L1_DTLB_2M_ENTRIES   255
549 #define L1_DTLB_4K_ASSOC       1
550 #define L1_DTLB_4K_ENTRIES   255
551 
552 #define L1_ITLB_2M_ASSOC       1
553 #define L1_ITLB_2M_ENTRIES   255
554 #define L1_ITLB_4K_ASSOC       1
555 #define L1_ITLB_4K_ENTRIES   255
556 
557 #define L2_DTLB_2M_ASSOC       0 /* disabled */
558 #define L2_DTLB_2M_ENTRIES     0 /* disabled */
559 #define L2_DTLB_4K_ASSOC       4
560 #define L2_DTLB_4K_ENTRIES   512
561 
562 #define L2_ITLB_2M_ASSOC       0 /* disabled */
563 #define L2_ITLB_2M_ENTRIES     0 /* disabled */
564 #define L2_ITLB_4K_ASSOC       4
565 #define L2_ITLB_4K_ENTRIES   512
566 
567 /* CPUID Leaf 0x14 constants: */
568 #define INTEL_PT_MAX_SUBLEAF     0x1
569 /*
570  * bit[00]: IA32_RTIT_CTL.CR3 filter can be set to 1 and IA32_RTIT_CR3_MATCH
571  *          MSR can be accessed;
572  * bit[01]: Support Configurable PSB and Cycle-Accurate Mode;
573  * bit[02]: Support IP Filtering, TraceStop filtering, and preservation
574  *          of Intel PT MSRs across warm reset;
575  * bit[03]: Support MTC timing packet and suppression of COFI-based packets;
576  */
577 #define INTEL_PT_MINIMAL_EBX     0xf
578 /*
579  * bit[00]: Tracing can be enabled with IA32_RTIT_CTL.ToPA = 1 and
580  *          IA32_RTIT_OUTPUT_BASE and IA32_RTIT_OUTPUT_MASK_PTRS MSRs can be
581  *          accessed;
582  * bit[01]: ToPA tables can hold any number of output entries, up to the
583  *          maximum allowed by the MaskOrTableOffset field of
584  *          IA32_RTIT_OUTPUT_MASK_PTRS;
585  * bit[02]: Support Single-Range Output scheme;
586  */
587 #define INTEL_PT_MINIMAL_ECX     0x7
588 /* generated packets which contain IP payloads have LIP values */
589 #define INTEL_PT_IP_LIP          (1 << 31)
590 #define INTEL_PT_ADDR_RANGES_NUM 0x2 /* Number of configurable address ranges */
591 #define INTEL_PT_ADDR_RANGES_NUM_MASK 0x3
592 #define INTEL_PT_MTC_BITMAP      (0x0249 << 16) /* Support ART(0,3,6,9) */
593 #define INTEL_PT_CYCLE_BITMAP    0x1fff         /* Support 0,2^(0~11) */
594 #define INTEL_PT_PSB_BITMAP      (0x003f << 16) /* Support 2K,4K,8K,16K,32K,64K */
595 
596 static void x86_cpu_vendor_words2str(char *dst, uint32_t vendor1,
597                                      uint32_t vendor2, uint32_t vendor3)
598 {
599     int i;
600     for (i = 0; i < 4; i++) {
601         dst[i] = vendor1 >> (8 * i);
602         dst[i + 4] = vendor2 >> (8 * i);
603         dst[i + 8] = vendor3 >> (8 * i);
604     }
605     dst[CPUID_VENDOR_SZ] = '\0';
606 }
607 
608 #define I486_FEATURES (CPUID_FP87 | CPUID_VME | CPUID_PSE)
609 #define PENTIUM_FEATURES (I486_FEATURES | CPUID_DE | CPUID_TSC | \
610           CPUID_MSR | CPUID_MCE | CPUID_CX8 | CPUID_MMX | CPUID_APIC)
611 #define PENTIUM2_FEATURES (PENTIUM_FEATURES | CPUID_PAE | CPUID_SEP | \
612           CPUID_MTRR | CPUID_PGE | CPUID_MCA | CPUID_CMOV | CPUID_PAT | \
613           CPUID_PSE36 | CPUID_FXSR)
614 #define PENTIUM3_FEATURES (PENTIUM2_FEATURES | CPUID_SSE)
615 #define PPRO_FEATURES (CPUID_FP87 | CPUID_DE | CPUID_PSE | CPUID_TSC | \
616           CPUID_MSR | CPUID_MCE | CPUID_CX8 | CPUID_PGE | CPUID_CMOV | \
617           CPUID_PAT | CPUID_FXSR | CPUID_MMX | CPUID_SSE | CPUID_SSE2 | \
618           CPUID_PAE | CPUID_SEP | CPUID_APIC)
619 
620 #define TCG_FEATURES (CPUID_FP87 | CPUID_PSE | CPUID_TSC | CPUID_MSR | \
621           CPUID_PAE | CPUID_MCE | CPUID_CX8 | CPUID_APIC | CPUID_SEP | \
622           CPUID_MTRR | CPUID_PGE | CPUID_MCA | CPUID_CMOV | CPUID_PAT | \
623           CPUID_PSE36 | CPUID_CLFLUSH | CPUID_ACPI | CPUID_MMX | \
624           CPUID_FXSR | CPUID_SSE | CPUID_SSE2 | CPUID_SS | CPUID_DE)
625           /* partly implemented:
626           CPUID_MTRR, CPUID_MCA, CPUID_CLFLUSH (needed for Win64) */
627           /* missing:
628           CPUID_VME, CPUID_DTS, CPUID_SS, CPUID_HT, CPUID_TM, CPUID_PBE */
629 #define TCG_EXT_FEATURES (CPUID_EXT_SSE3 | CPUID_EXT_PCLMULQDQ | \
630           CPUID_EXT_MONITOR | CPUID_EXT_SSSE3 | CPUID_EXT_CX16 | \
631           CPUID_EXT_SSE41 | CPUID_EXT_SSE42 | CPUID_EXT_POPCNT | \
632           CPUID_EXT_XSAVE | /* CPUID_EXT_OSXSAVE is dynamic */   \
633           CPUID_EXT_MOVBE | CPUID_EXT_AES | CPUID_EXT_HYPERVISOR | \
634           CPUID_EXT_RDRAND)
635           /* missing:
636           CPUID_EXT_DTES64, CPUID_EXT_DSCPL, CPUID_EXT_VMX, CPUID_EXT_SMX,
637           CPUID_EXT_EST, CPUID_EXT_TM2, CPUID_EXT_CID, CPUID_EXT_FMA,
638           CPUID_EXT_XTPR, CPUID_EXT_PDCM, CPUID_EXT_PCID, CPUID_EXT_DCA,
639           CPUID_EXT_X2APIC, CPUID_EXT_TSC_DEADLINE_TIMER, CPUID_EXT_AVX,
640           CPUID_EXT_F16C */
641 
642 #ifdef TARGET_X86_64
643 #define TCG_EXT2_X86_64_FEATURES (CPUID_EXT2_SYSCALL | CPUID_EXT2_LM)
644 #else
645 #define TCG_EXT2_X86_64_FEATURES 0
646 #endif
647 
648 #define TCG_EXT2_FEATURES ((TCG_FEATURES & CPUID_EXT2_AMD_ALIASES) | \
649           CPUID_EXT2_NX | CPUID_EXT2_MMXEXT | CPUID_EXT2_RDTSCP | \
650           CPUID_EXT2_3DNOW | CPUID_EXT2_3DNOWEXT | CPUID_EXT2_PDPE1GB | \
651           TCG_EXT2_X86_64_FEATURES)
652 #define TCG_EXT3_FEATURES (CPUID_EXT3_LAHF_LM | CPUID_EXT3_SVM | \
653           CPUID_EXT3_CR8LEG | CPUID_EXT3_ABM | CPUID_EXT3_SSE4A)
654 #define TCG_EXT4_FEATURES 0
655 #define TCG_SVM_FEATURES CPUID_SVM_NPT
656 #define TCG_KVM_FEATURES 0
657 #define TCG_7_0_EBX_FEATURES (CPUID_7_0_EBX_SMEP | CPUID_7_0_EBX_SMAP | \
658           CPUID_7_0_EBX_BMI1 | CPUID_7_0_EBX_BMI2 | CPUID_7_0_EBX_ADX | \
659           CPUID_7_0_EBX_PCOMMIT | CPUID_7_0_EBX_CLFLUSHOPT |            \
660           CPUID_7_0_EBX_CLWB | CPUID_7_0_EBX_MPX | CPUID_7_0_EBX_FSGSBASE | \
661           CPUID_7_0_EBX_ERMS)
662           /* missing:
663           CPUID_7_0_EBX_HLE, CPUID_7_0_EBX_AVX2,
664           CPUID_7_0_EBX_INVPCID, CPUID_7_0_EBX_RTM,
665           CPUID_7_0_EBX_RDSEED */
666 #define TCG_7_0_ECX_FEATURES (CPUID_7_0_ECX_PKU | \
667           /* CPUID_7_0_ECX_OSPKE is dynamic */ \
668           CPUID_7_0_ECX_LA57)
669 #define TCG_7_0_EDX_FEATURES 0
670 #define TCG_7_1_EAX_FEATURES 0
671 #define TCG_APM_FEATURES 0
672 #define TCG_6_EAX_FEATURES CPUID_6_EAX_ARAT
673 #define TCG_XSAVE_FEATURES (CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XGETBV1)
674           /* missing:
675           CPUID_XSAVE_XSAVEC, CPUID_XSAVE_XSAVES */
676 #define TCG_14_0_ECX_FEATURES 0
677 
678 typedef enum FeatureWordType {
679    CPUID_FEATURE_WORD,
680    MSR_FEATURE_WORD,
681 } FeatureWordType;
682 
683 typedef struct FeatureWordInfo {
684     FeatureWordType type;
685     /* feature flags names are taken from "Intel Processor Identification and
686      * the CPUID Instruction" and AMD's "CPUID Specification".
687      * In cases of disagreement between feature naming conventions,
688      * aliases may be added.
689      */
690     const char *feat_names[64];
691     union {
692         /* If type==CPUID_FEATURE_WORD */
693         struct {
694             uint32_t eax;   /* Input EAX for CPUID */
695             bool needs_ecx; /* CPUID instruction uses ECX as input */
696             uint32_t ecx;   /* Input ECX value for CPUID */
697             int reg;        /* output register (R_* constant) */
698         } cpuid;
699         /* If type==MSR_FEATURE_WORD */
700         struct {
701             uint32_t index;
702         } msr;
703     };
704     uint64_t tcg_features; /* Feature flags supported by TCG */
705     uint64_t unmigratable_flags; /* Feature flags known to be unmigratable */
706     uint64_t migratable_flags; /* Feature flags known to be migratable */
707     /* Features that shouldn't be auto-enabled by "-cpu host" */
708     uint64_t no_autoenable_flags;
709 } FeatureWordInfo;
710 
711 static FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
712     [FEAT_1_EDX] = {
713         .type = CPUID_FEATURE_WORD,
714         .feat_names = {
715             "fpu", "vme", "de", "pse",
716             "tsc", "msr", "pae", "mce",
717             "cx8", "apic", NULL, "sep",
718             "mtrr", "pge", "mca", "cmov",
719             "pat", "pse36", "pn" /* Intel psn */, "clflush" /* Intel clfsh */,
720             NULL, "ds" /* Intel dts */, "acpi", "mmx",
721             "fxsr", "sse", "sse2", "ss",
722             "ht" /* Intel htt */, "tm", "ia64", "pbe",
723         },
724         .cpuid = {.eax = 1, .reg = R_EDX, },
725         .tcg_features = TCG_FEATURES,
726     },
727     [FEAT_1_ECX] = {
728         .type = CPUID_FEATURE_WORD,
729         .feat_names = {
730             "pni" /* Intel,AMD sse3 */, "pclmulqdq", "dtes64", "monitor",
731             "ds-cpl", "vmx", "smx", "est",
732             "tm2", "ssse3", "cid", NULL,
733             "fma", "cx16", "xtpr", "pdcm",
734             NULL, "pcid", "dca", "sse4.1",
735             "sse4.2", "x2apic", "movbe", "popcnt",
736             "tsc-deadline", "aes", "xsave", NULL /* osxsave */,
737             "avx", "f16c", "rdrand", "hypervisor",
738         },
739         .cpuid = { .eax = 1, .reg = R_ECX, },
740         .tcg_features = TCG_EXT_FEATURES,
741     },
742     /* Feature names that are already defined on feature_name[] but
743      * are set on CPUID[8000_0001].EDX on AMD CPUs don't have their
744      * names on feat_names below. They are copied automatically
745      * to features[FEAT_8000_0001_EDX] if and only if CPU vendor is AMD.
746      */
747     [FEAT_8000_0001_EDX] = {
748         .type = CPUID_FEATURE_WORD,
749         .feat_names = {
750             NULL /* fpu */, NULL /* vme */, NULL /* de */, NULL /* pse */,
751             NULL /* tsc */, NULL /* msr */, NULL /* pae */, NULL /* mce */,
752             NULL /* cx8 */, NULL /* apic */, NULL, "syscall",
753             NULL /* mtrr */, NULL /* pge */, NULL /* mca */, NULL /* cmov */,
754             NULL /* pat */, NULL /* pse36 */, NULL, NULL /* Linux mp */,
755             "nx", NULL, "mmxext", NULL /* mmx */,
756             NULL /* fxsr */, "fxsr-opt", "pdpe1gb", "rdtscp",
757             NULL, "lm", "3dnowext", "3dnow",
758         },
759         .cpuid = { .eax = 0x80000001, .reg = R_EDX, },
760         .tcg_features = TCG_EXT2_FEATURES,
761     },
762     [FEAT_8000_0001_ECX] = {
763         .type = CPUID_FEATURE_WORD,
764         .feat_names = {
765             "lahf-lm", "cmp-legacy", "svm", "extapic",
766             "cr8legacy", "abm", "sse4a", "misalignsse",
767             "3dnowprefetch", "osvw", "ibs", "xop",
768             "skinit", "wdt", NULL, "lwp",
769             "fma4", "tce", NULL, "nodeid-msr",
770             NULL, "tbm", "topoext", "perfctr-core",
771             "perfctr-nb", NULL, NULL, NULL,
772             NULL, NULL, NULL, NULL,
773         },
774         .cpuid = { .eax = 0x80000001, .reg = R_ECX, },
775         .tcg_features = TCG_EXT3_FEATURES,
776         /*
777          * TOPOEXT is always allowed but can't be enabled blindly by
778          * "-cpu host", as it requires consistent cache topology info
779          * to be provided so it doesn't confuse guests.
780          */
781         .no_autoenable_flags = CPUID_EXT3_TOPOEXT,
782     },
783     [FEAT_C000_0001_EDX] = {
784         .type = CPUID_FEATURE_WORD,
785         .feat_names = {
786             NULL, NULL, "xstore", "xstore-en",
787             NULL, NULL, "xcrypt", "xcrypt-en",
788             "ace2", "ace2-en", "phe", "phe-en",
789             "pmm", "pmm-en", NULL, NULL,
790             NULL, NULL, NULL, NULL,
791             NULL, NULL, NULL, NULL,
792             NULL, NULL, NULL, NULL,
793             NULL, NULL, NULL, NULL,
794         },
795         .cpuid = { .eax = 0xC0000001, .reg = R_EDX, },
796         .tcg_features = TCG_EXT4_FEATURES,
797     },
798     [FEAT_KVM] = {
799         .type = CPUID_FEATURE_WORD,
800         .feat_names = {
801             "kvmclock", "kvm-nopiodelay", "kvm-mmu", "kvmclock",
802             "kvm-asyncpf", "kvm-steal-time", "kvm-pv-eoi", "kvm-pv-unhalt",
803             NULL, "kvm-pv-tlb-flush", NULL, "kvm-pv-ipi",
804             "kvm-poll-control", "kvm-pv-sched-yield", "kvm-asyncpf-int", "kvm-msi-ext-dest-id",
805             NULL, NULL, NULL, NULL,
806             NULL, NULL, NULL, NULL,
807             "kvmclock-stable-bit", NULL, NULL, NULL,
808             NULL, NULL, NULL, NULL,
809         },
810         .cpuid = { .eax = KVM_CPUID_FEATURES, .reg = R_EAX, },
811         .tcg_features = TCG_KVM_FEATURES,
812     },
813     [FEAT_KVM_HINTS] = {
814         .type = CPUID_FEATURE_WORD,
815         .feat_names = {
816             "kvm-hint-dedicated", NULL, NULL, NULL,
817             NULL, NULL, NULL, NULL,
818             NULL, NULL, NULL, NULL,
819             NULL, NULL, NULL, NULL,
820             NULL, NULL, NULL, NULL,
821             NULL, NULL, NULL, NULL,
822             NULL, NULL, NULL, NULL,
823             NULL, NULL, NULL, NULL,
824         },
825         .cpuid = { .eax = KVM_CPUID_FEATURES, .reg = R_EDX, },
826         .tcg_features = TCG_KVM_FEATURES,
827         /*
828          * KVM hints aren't auto-enabled by -cpu host, they need to be
829          * explicitly enabled in the command-line.
830          */
831         .no_autoenable_flags = ~0U,
832     },
833     /*
834      * .feat_names are commented out for Hyper-V enlightenments because we
835      * don't want to have two different ways for enabling them on QEMU command
836      * line. Some features (e.g. "hyperv_time", "hyperv_vapic", ...) require
837      * enabling several feature bits simultaneously, exposing these bits
838      * individually may just confuse guests.
839      */
840     [FEAT_HYPERV_EAX] = {
841         .type = CPUID_FEATURE_WORD,
842         .feat_names = {
843             NULL /* hv_msr_vp_runtime_access */, NULL /* hv_msr_time_refcount_access */,
844             NULL /* hv_msr_synic_access */, NULL /* hv_msr_stimer_access */,
845             NULL /* hv_msr_apic_access */, NULL /* hv_msr_hypercall_access */,
846             NULL /* hv_vpindex_access */, NULL /* hv_msr_reset_access */,
847             NULL /* hv_msr_stats_access */, NULL /* hv_reftsc_access */,
848             NULL /* hv_msr_idle_access */, NULL /* hv_msr_frequency_access */,
849             NULL /* hv_msr_debug_access */, NULL /* hv_msr_reenlightenment_access */,
850             NULL, NULL,
851             NULL, NULL, NULL, NULL,
852             NULL, NULL, NULL, NULL,
853             NULL, NULL, NULL, NULL,
854             NULL, NULL, NULL, NULL,
855         },
856         .cpuid = { .eax = 0x40000003, .reg = R_EAX, },
857     },
858     [FEAT_HYPERV_EBX] = {
859         .type = CPUID_FEATURE_WORD,
860         .feat_names = {
861             NULL /* hv_create_partitions */, NULL /* hv_access_partition_id */,
862             NULL /* hv_access_memory_pool */, NULL /* hv_adjust_message_buffers */,
863             NULL /* hv_post_messages */, NULL /* hv_signal_events */,
864             NULL /* hv_create_port */, NULL /* hv_connect_port */,
865             NULL /* hv_access_stats */, NULL, NULL, NULL /* hv_debugging */,
866             NULL /* hv_cpu_power_management */, NULL /* hv_configure_profiler */,
867             NULL, NULL,
868             NULL, NULL, NULL, NULL,
869             NULL, NULL, NULL, NULL,
870             NULL, NULL, NULL, NULL,
871             NULL, NULL, NULL, NULL,
872         },
873         .cpuid = { .eax = 0x40000003, .reg = R_EBX, },
874     },
875     [FEAT_HYPERV_EDX] = {
876         .type = CPUID_FEATURE_WORD,
877         .feat_names = {
878             NULL /* hv_mwait */, NULL /* hv_guest_debugging */,
879             NULL /* hv_perf_monitor */, NULL /* hv_cpu_dynamic_part */,
880             NULL /* hv_hypercall_params_xmm */, NULL /* hv_guest_idle_state */,
881             NULL, NULL,
882             NULL, NULL, NULL /* hv_guest_crash_msr */, NULL,
883             NULL, NULL, NULL, NULL,
884             NULL, NULL, NULL, NULL,
885             NULL, NULL, NULL, NULL,
886             NULL, NULL, NULL, NULL,
887             NULL, NULL, NULL, NULL,
888         },
889         .cpuid = { .eax = 0x40000003, .reg = R_EDX, },
890     },
891     [FEAT_HV_RECOMM_EAX] = {
892         .type = CPUID_FEATURE_WORD,
893         .feat_names = {
894             NULL /* hv_recommend_pv_as_switch */,
895             NULL /* hv_recommend_pv_tlbflush_local */,
896             NULL /* hv_recommend_pv_tlbflush_remote */,
897             NULL /* hv_recommend_msr_apic_access */,
898             NULL /* hv_recommend_msr_reset */,
899             NULL /* hv_recommend_relaxed_timing */,
900             NULL /* hv_recommend_dma_remapping */,
901             NULL /* hv_recommend_int_remapping */,
902             NULL /* hv_recommend_x2apic_msrs */,
903             NULL /* hv_recommend_autoeoi_deprecation */,
904             NULL /* hv_recommend_pv_ipi */,
905             NULL /* hv_recommend_ex_hypercalls */,
906             NULL /* hv_hypervisor_is_nested */,
907             NULL /* hv_recommend_int_mbec */,
908             NULL /* hv_recommend_evmcs */,
909             NULL,
910             NULL, NULL, NULL, NULL,
911             NULL, NULL, NULL, NULL,
912             NULL, NULL, NULL, NULL,
913             NULL, NULL, NULL, NULL,
914         },
915         .cpuid = { .eax = 0x40000004, .reg = R_EAX, },
916     },
917     [FEAT_HV_NESTED_EAX] = {
918         .type = CPUID_FEATURE_WORD,
919         .cpuid = { .eax = 0x4000000A, .reg = R_EAX, },
920     },
921     [FEAT_SVM] = {
922         .type = CPUID_FEATURE_WORD,
923         .feat_names = {
924             "npt", "lbrv", "svm-lock", "nrip-save",
925             "tsc-scale", "vmcb-clean",  "flushbyasid", "decodeassists",
926             NULL, NULL, "pause-filter", NULL,
927             "pfthreshold", NULL, NULL, NULL,
928             NULL, NULL, NULL, NULL,
929             NULL, NULL, NULL, NULL,
930             NULL, NULL, NULL, NULL,
931             NULL, NULL, NULL, NULL,
932         },
933         .cpuid = { .eax = 0x8000000A, .reg = R_EDX, },
934         .tcg_features = TCG_SVM_FEATURES,
935     },
936     [FEAT_7_0_EBX] = {
937         .type = CPUID_FEATURE_WORD,
938         .feat_names = {
939             "fsgsbase", "tsc-adjust", NULL, "bmi1",
940             "hle", "avx2", NULL, "smep",
941             "bmi2", "erms", "invpcid", "rtm",
942             NULL, NULL, "mpx", NULL,
943             "avx512f", "avx512dq", "rdseed", "adx",
944             "smap", "avx512ifma", "pcommit", "clflushopt",
945             "clwb", "intel-pt", "avx512pf", "avx512er",
946             "avx512cd", "sha-ni", "avx512bw", "avx512vl",
947         },
948         .cpuid = {
949             .eax = 7,
950             .needs_ecx = true, .ecx = 0,
951             .reg = R_EBX,
952         },
953         .tcg_features = TCG_7_0_EBX_FEATURES,
954     },
955     [FEAT_7_0_ECX] = {
956         .type = CPUID_FEATURE_WORD,
957         .feat_names = {
958             NULL, "avx512vbmi", "umip", "pku",
959             NULL /* ospke */, "waitpkg", "avx512vbmi2", NULL,
960             "gfni", "vaes", "vpclmulqdq", "avx512vnni",
961             "avx512bitalg", NULL, "avx512-vpopcntdq", NULL,
962             "la57", NULL, NULL, NULL,
963             NULL, NULL, "rdpid", NULL,
964             NULL, "cldemote", NULL, "movdiri",
965             "movdir64b", NULL, NULL, NULL,
966         },
967         .cpuid = {
968             .eax = 7,
969             .needs_ecx = true, .ecx = 0,
970             .reg = R_ECX,
971         },
972         .tcg_features = TCG_7_0_ECX_FEATURES,
973     },
974     [FEAT_7_0_EDX] = {
975         .type = CPUID_FEATURE_WORD,
976         .feat_names = {
977             NULL, NULL, "avx512-4vnniw", "avx512-4fmaps",
978             "fsrm", NULL, NULL, NULL,
979             "avx512-vp2intersect", NULL, "md-clear", NULL,
980             NULL, NULL, "serialize", NULL,
981             "tsx-ldtrk", NULL, NULL /* pconfig */, NULL,
982             NULL, NULL, NULL, NULL,
983             NULL, NULL, "spec-ctrl", "stibp",
984             NULL, "arch-capabilities", "core-capability", "ssbd",
985         },
986         .cpuid = {
987             .eax = 7,
988             .needs_ecx = true, .ecx = 0,
989             .reg = R_EDX,
990         },
991         .tcg_features = TCG_7_0_EDX_FEATURES,
992     },
993     [FEAT_7_1_EAX] = {
994         .type = CPUID_FEATURE_WORD,
995         .feat_names = {
996             NULL, NULL, NULL, NULL,
997             NULL, "avx512-bf16", NULL, NULL,
998             NULL, NULL, NULL, NULL,
999             NULL, NULL, NULL, NULL,
1000             NULL, NULL, NULL, NULL,
1001             NULL, NULL, NULL, NULL,
1002             NULL, NULL, NULL, NULL,
1003             NULL, NULL, NULL, NULL,
1004         },
1005         .cpuid = {
1006             .eax = 7,
1007             .needs_ecx = true, .ecx = 1,
1008             .reg = R_EAX,
1009         },
1010         .tcg_features = TCG_7_1_EAX_FEATURES,
1011     },
1012     [FEAT_8000_0007_EDX] = {
1013         .type = CPUID_FEATURE_WORD,
1014         .feat_names = {
1015             NULL, NULL, NULL, NULL,
1016             NULL, NULL, NULL, NULL,
1017             "invtsc", NULL, NULL, NULL,
1018             NULL, NULL, NULL, NULL,
1019             NULL, NULL, NULL, NULL,
1020             NULL, NULL, NULL, NULL,
1021             NULL, NULL, NULL, NULL,
1022             NULL, NULL, NULL, NULL,
1023         },
1024         .cpuid = { .eax = 0x80000007, .reg = R_EDX, },
1025         .tcg_features = TCG_APM_FEATURES,
1026         .unmigratable_flags = CPUID_APM_INVTSC,
1027     },
1028     [FEAT_8000_0008_EBX] = {
1029         .type = CPUID_FEATURE_WORD,
1030         .feat_names = {
1031             "clzero", NULL, "xsaveerptr", NULL,
1032             NULL, NULL, NULL, NULL,
1033             NULL, "wbnoinvd", NULL, NULL,
1034             "ibpb", NULL, NULL, "amd-stibp",
1035             NULL, NULL, NULL, NULL,
1036             NULL, NULL, NULL, NULL,
1037             "amd-ssbd", "virt-ssbd", "amd-no-ssb", NULL,
1038             NULL, NULL, NULL, NULL,
1039         },
1040         .cpuid = { .eax = 0x80000008, .reg = R_EBX, },
1041         .tcg_features = 0,
1042         .unmigratable_flags = 0,
1043     },
1044     [FEAT_XSAVE] = {
1045         .type = CPUID_FEATURE_WORD,
1046         .feat_names = {
1047             "xsaveopt", "xsavec", "xgetbv1", "xsaves",
1048             NULL, NULL, NULL, NULL,
1049             NULL, NULL, NULL, NULL,
1050             NULL, NULL, NULL, NULL,
1051             NULL, NULL, NULL, NULL,
1052             NULL, NULL, NULL, NULL,
1053             NULL, NULL, NULL, NULL,
1054             NULL, NULL, NULL, NULL,
1055         },
1056         .cpuid = {
1057             .eax = 0xd,
1058             .needs_ecx = true, .ecx = 1,
1059             .reg = R_EAX,
1060         },
1061         .tcg_features = TCG_XSAVE_FEATURES,
1062     },
1063     [FEAT_6_EAX] = {
1064         .type = CPUID_FEATURE_WORD,
1065         .feat_names = {
1066             NULL, NULL, "arat", NULL,
1067             NULL, NULL, NULL, NULL,
1068             NULL, NULL, NULL, NULL,
1069             NULL, NULL, NULL, NULL,
1070             NULL, NULL, NULL, NULL,
1071             NULL, NULL, NULL, NULL,
1072             NULL, NULL, NULL, NULL,
1073             NULL, NULL, NULL, NULL,
1074         },
1075         .cpuid = { .eax = 6, .reg = R_EAX, },
1076         .tcg_features = TCG_6_EAX_FEATURES,
1077     },
1078     [FEAT_XSAVE_COMP_LO] = {
1079         .type = CPUID_FEATURE_WORD,
1080         .cpuid = {
1081             .eax = 0xD,
1082             .needs_ecx = true, .ecx = 0,
1083             .reg = R_EAX,
1084         },
1085         .tcg_features = ~0U,
1086         .migratable_flags = XSTATE_FP_MASK | XSTATE_SSE_MASK |
1087             XSTATE_YMM_MASK | XSTATE_BNDREGS_MASK | XSTATE_BNDCSR_MASK |
1088             XSTATE_OPMASK_MASK | XSTATE_ZMM_Hi256_MASK | XSTATE_Hi16_ZMM_MASK |
1089             XSTATE_PKRU_MASK,
1090     },
1091     [FEAT_XSAVE_COMP_HI] = {
1092         .type = CPUID_FEATURE_WORD,
1093         .cpuid = {
1094             .eax = 0xD,
1095             .needs_ecx = true, .ecx = 0,
1096             .reg = R_EDX,
1097         },
1098         .tcg_features = ~0U,
1099     },
1100     /*Below are MSR exposed features*/
1101     [FEAT_ARCH_CAPABILITIES] = {
1102         .type = MSR_FEATURE_WORD,
1103         .feat_names = {
1104             "rdctl-no", "ibrs-all", "rsba", "skip-l1dfl-vmentry",
1105             "ssb-no", "mds-no", "pschange-mc-no", "tsx-ctrl",
1106             "taa-no", NULL, NULL, NULL,
1107             NULL, NULL, NULL, NULL,
1108             NULL, NULL, NULL, NULL,
1109             NULL, NULL, NULL, NULL,
1110             NULL, NULL, NULL, NULL,
1111             NULL, NULL, NULL, NULL,
1112         },
1113         .msr = {
1114             .index = MSR_IA32_ARCH_CAPABILITIES,
1115         },
1116     },
1117     [FEAT_CORE_CAPABILITY] = {
1118         .type = MSR_FEATURE_WORD,
1119         .feat_names = {
1120             NULL, NULL, NULL, NULL,
1121             NULL, "split-lock-detect", NULL, NULL,
1122             NULL, NULL, NULL, NULL,
1123             NULL, NULL, NULL, NULL,
1124             NULL, NULL, NULL, NULL,
1125             NULL, NULL, NULL, NULL,
1126             NULL, NULL, NULL, NULL,
1127             NULL, NULL, NULL, NULL,
1128         },
1129         .msr = {
1130             .index = MSR_IA32_CORE_CAPABILITY,
1131         },
1132     },
1133     [FEAT_PERF_CAPABILITIES] = {
1134         .type = MSR_FEATURE_WORD,
1135         .feat_names = {
1136             NULL, NULL, NULL, NULL,
1137             NULL, NULL, NULL, NULL,
1138             NULL, NULL, NULL, NULL,
1139             NULL, "full-width-write", NULL, NULL,
1140             NULL, NULL, NULL, NULL,
1141             NULL, NULL, NULL, NULL,
1142             NULL, NULL, NULL, NULL,
1143             NULL, NULL, NULL, NULL,
1144         },
1145         .msr = {
1146             .index = MSR_IA32_PERF_CAPABILITIES,
1147         },
1148     },
1149 
1150     [FEAT_VMX_PROCBASED_CTLS] = {
1151         .type = MSR_FEATURE_WORD,
1152         .feat_names = {
1153             NULL, NULL, "vmx-vintr-pending", "vmx-tsc-offset",
1154             NULL, NULL, NULL, "vmx-hlt-exit",
1155             NULL, "vmx-invlpg-exit", "vmx-mwait-exit", "vmx-rdpmc-exit",
1156             "vmx-rdtsc-exit", NULL, NULL, "vmx-cr3-load-noexit",
1157             "vmx-cr3-store-noexit", NULL, NULL, "vmx-cr8-load-exit",
1158             "vmx-cr8-store-exit", "vmx-flexpriority", "vmx-vnmi-pending", "vmx-movdr-exit",
1159             "vmx-io-exit", "vmx-io-bitmap", NULL, "vmx-mtf",
1160             "vmx-msr-bitmap", "vmx-monitor-exit", "vmx-pause-exit", "vmx-secondary-ctls",
1161         },
1162         .msr = {
1163             .index = MSR_IA32_VMX_TRUE_PROCBASED_CTLS,
1164         }
1165     },
1166 
1167     [FEAT_VMX_SECONDARY_CTLS] = {
1168         .type = MSR_FEATURE_WORD,
1169         .feat_names = {
1170             "vmx-apicv-xapic", "vmx-ept", "vmx-desc-exit", "vmx-rdtscp-exit",
1171             "vmx-apicv-x2apic", "vmx-vpid", "vmx-wbinvd-exit", "vmx-unrestricted-guest",
1172             "vmx-apicv-register", "vmx-apicv-vid", "vmx-ple", "vmx-rdrand-exit",
1173             "vmx-invpcid-exit", "vmx-vmfunc", "vmx-shadow-vmcs", "vmx-encls-exit",
1174             "vmx-rdseed-exit", "vmx-pml", NULL, NULL,
1175             "vmx-xsaves", NULL, NULL, NULL,
1176             NULL, NULL, NULL, NULL,
1177             NULL, NULL, NULL, NULL,
1178         },
1179         .msr = {
1180             .index = MSR_IA32_VMX_PROCBASED_CTLS2,
1181         }
1182     },
1183 
1184     [FEAT_VMX_PINBASED_CTLS] = {
1185         .type = MSR_FEATURE_WORD,
1186         .feat_names = {
1187             "vmx-intr-exit", NULL, NULL, "vmx-nmi-exit",
1188             NULL, "vmx-vnmi", "vmx-preemption-timer", "vmx-posted-intr",
1189             NULL, NULL, NULL, NULL,
1190             NULL, NULL, NULL, NULL,
1191             NULL, NULL, NULL, NULL,
1192             NULL, NULL, NULL, NULL,
1193             NULL, NULL, NULL, NULL,
1194             NULL, NULL, NULL, NULL,
1195         },
1196         .msr = {
1197             .index = MSR_IA32_VMX_TRUE_PINBASED_CTLS,
1198         }
1199     },
1200 
1201     [FEAT_VMX_EXIT_CTLS] = {
1202         .type = MSR_FEATURE_WORD,
1203         /*
1204          * VMX_VM_EXIT_HOST_ADDR_SPACE_SIZE is copied from
1205          * the LM CPUID bit.
1206          */
1207         .feat_names = {
1208             NULL, NULL, "vmx-exit-nosave-debugctl", NULL,
1209             NULL, NULL, NULL, NULL,
1210             NULL, NULL /* vmx-exit-host-addr-space-size */, NULL, NULL,
1211             "vmx-exit-load-perf-global-ctrl", NULL, NULL, "vmx-exit-ack-intr",
1212             NULL, NULL, "vmx-exit-save-pat", "vmx-exit-load-pat",
1213             "vmx-exit-save-efer", "vmx-exit-load-efer",
1214                 "vmx-exit-save-preemption-timer", "vmx-exit-clear-bndcfgs",
1215             NULL, "vmx-exit-clear-rtit-ctl", NULL, NULL,
1216             NULL, NULL, NULL, NULL,
1217         },
1218         .msr = {
1219             .index = MSR_IA32_VMX_TRUE_EXIT_CTLS,
1220         }
1221     },
1222 
1223     [FEAT_VMX_ENTRY_CTLS] = {
1224         .type = MSR_FEATURE_WORD,
1225         .feat_names = {
1226             NULL, NULL, "vmx-entry-noload-debugctl", NULL,
1227             NULL, NULL, NULL, NULL,
1228             NULL, "vmx-entry-ia32e-mode", NULL, NULL,
1229             NULL, "vmx-entry-load-perf-global-ctrl", "vmx-entry-load-pat", "vmx-entry-load-efer",
1230             "vmx-entry-load-bndcfgs", NULL, "vmx-entry-load-rtit-ctl", NULL,
1231             NULL, NULL, NULL, NULL,
1232             NULL, NULL, NULL, NULL,
1233             NULL, NULL, NULL, NULL,
1234         },
1235         .msr = {
1236             .index = MSR_IA32_VMX_TRUE_ENTRY_CTLS,
1237         }
1238     },
1239 
1240     [FEAT_VMX_MISC] = {
1241         .type = MSR_FEATURE_WORD,
1242         .feat_names = {
1243             NULL, NULL, NULL, NULL,
1244             NULL, "vmx-store-lma", "vmx-activity-hlt", "vmx-activity-shutdown",
1245             "vmx-activity-wait-sipi", NULL, NULL, NULL,
1246             NULL, NULL, NULL, NULL,
1247             NULL, NULL, NULL, NULL,
1248             NULL, NULL, NULL, NULL,
1249             NULL, NULL, NULL, NULL,
1250             NULL, "vmx-vmwrite-vmexit-fields", "vmx-zero-len-inject", NULL,
1251         },
1252         .msr = {
1253             .index = MSR_IA32_VMX_MISC,
1254         }
1255     },
1256 
1257     [FEAT_VMX_EPT_VPID_CAPS] = {
1258         .type = MSR_FEATURE_WORD,
1259         .feat_names = {
1260             "vmx-ept-execonly", NULL, NULL, NULL,
1261             NULL, NULL, "vmx-page-walk-4", "vmx-page-walk-5",
1262             NULL, NULL, NULL, NULL,
1263             NULL, NULL, NULL, NULL,
1264             "vmx-ept-2mb", "vmx-ept-1gb", NULL, NULL,
1265             "vmx-invept", "vmx-eptad", "vmx-ept-advanced-exitinfo", NULL,
1266             NULL, "vmx-invept-single-context", "vmx-invept-all-context", NULL,
1267             NULL, NULL, NULL, NULL,
1268             "vmx-invvpid", NULL, NULL, NULL,
1269             NULL, NULL, NULL, NULL,
1270             "vmx-invvpid-single-addr", "vmx-invept-single-context",
1271                 "vmx-invvpid-all-context", "vmx-invept-single-context-noglobals",
1272             NULL, NULL, NULL, NULL,
1273             NULL, NULL, NULL, NULL,
1274             NULL, NULL, NULL, NULL,
1275             NULL, NULL, NULL, NULL,
1276             NULL, NULL, NULL, NULL,
1277         },
1278         .msr = {
1279             .index = MSR_IA32_VMX_EPT_VPID_CAP,
1280         }
1281     },
1282 
1283     [FEAT_VMX_BASIC] = {
1284         .type = MSR_FEATURE_WORD,
1285         .feat_names = {
1286             [54] = "vmx-ins-outs",
1287             [55] = "vmx-true-ctls",
1288         },
1289         .msr = {
1290             .index = MSR_IA32_VMX_BASIC,
1291         },
1292         /* Just to be safe - we don't support setting the MSEG version field.  */
1293         .no_autoenable_flags = MSR_VMX_BASIC_DUAL_MONITOR,
1294     },
1295 
1296     [FEAT_VMX_VMFUNC] = {
1297         .type = MSR_FEATURE_WORD,
1298         .feat_names = {
1299             [0] = "vmx-eptp-switching",
1300         },
1301         .msr = {
1302             .index = MSR_IA32_VMX_VMFUNC,
1303         }
1304     },
1305 
1306     [FEAT_14_0_ECX] = {
1307         .type = CPUID_FEATURE_WORD,
1308         .feat_names = {
1309             NULL, NULL, NULL, NULL,
1310             NULL, NULL, NULL, NULL,
1311             NULL, NULL, NULL, NULL,
1312             NULL, NULL, NULL, NULL,
1313             NULL, NULL, NULL, NULL,
1314             NULL, NULL, NULL, NULL,
1315             NULL, NULL, NULL, NULL,
1316             NULL, NULL, NULL, "intel-pt-lip",
1317         },
1318         .cpuid = {
1319             .eax = 0x14,
1320             .needs_ecx = true, .ecx = 0,
1321             .reg = R_ECX,
1322         },
1323         .tcg_features = TCG_14_0_ECX_FEATURES,
1324      },
1325 
1326 };
1327 
1328 typedef struct FeatureMask {
1329     FeatureWord index;
1330     uint64_t mask;
1331 } FeatureMask;
1332 
1333 typedef struct FeatureDep {
1334     FeatureMask from, to;
1335 } FeatureDep;
1336 
1337 static FeatureDep feature_dependencies[] = {
1338     {
1339         .from = { FEAT_7_0_EDX,             CPUID_7_0_EDX_ARCH_CAPABILITIES },
1340         .to = { FEAT_ARCH_CAPABILITIES,     ~0ull },
1341     },
1342     {
1343         .from = { FEAT_7_0_EDX,             CPUID_7_0_EDX_CORE_CAPABILITY },
1344         .to = { FEAT_CORE_CAPABILITY,       ~0ull },
1345     },
1346     {
1347         .from = { FEAT_1_ECX,             CPUID_EXT_PDCM },
1348         .to = { FEAT_PERF_CAPABILITIES,       ~0ull },
1349     },
1350     {
1351         .from = { FEAT_1_ECX,               CPUID_EXT_VMX },
1352         .to = { FEAT_VMX_PROCBASED_CTLS,    ~0ull },
1353     },
1354     {
1355         .from = { FEAT_1_ECX,               CPUID_EXT_VMX },
1356         .to = { FEAT_VMX_PINBASED_CTLS,     ~0ull },
1357     },
1358     {
1359         .from = { FEAT_1_ECX,               CPUID_EXT_VMX },
1360         .to = { FEAT_VMX_EXIT_CTLS,         ~0ull },
1361     },
1362     {
1363         .from = { FEAT_1_ECX,               CPUID_EXT_VMX },
1364         .to = { FEAT_VMX_ENTRY_CTLS,        ~0ull },
1365     },
1366     {
1367         .from = { FEAT_1_ECX,               CPUID_EXT_VMX },
1368         .to = { FEAT_VMX_MISC,              ~0ull },
1369     },
1370     {
1371         .from = { FEAT_1_ECX,               CPUID_EXT_VMX },
1372         .to = { FEAT_VMX_BASIC,             ~0ull },
1373     },
1374     {
1375         .from = { FEAT_8000_0001_EDX,       CPUID_EXT2_LM },
1376         .to = { FEAT_VMX_ENTRY_CTLS,        VMX_VM_ENTRY_IA32E_MODE },
1377     },
1378     {
1379         .from = { FEAT_VMX_PROCBASED_CTLS,  VMX_CPU_BASED_ACTIVATE_SECONDARY_CONTROLS },
1380         .to = { FEAT_VMX_SECONDARY_CTLS,    ~0ull },
1381     },
1382     {
1383         .from = { FEAT_XSAVE,               CPUID_XSAVE_XSAVES },
1384         .to = { FEAT_VMX_SECONDARY_CTLS,    VMX_SECONDARY_EXEC_XSAVES },
1385     },
1386     {
1387         .from = { FEAT_1_ECX,               CPUID_EXT_RDRAND },
1388         .to = { FEAT_VMX_SECONDARY_CTLS,    VMX_SECONDARY_EXEC_RDRAND_EXITING },
1389     },
1390     {
1391         .from = { FEAT_7_0_EBX,             CPUID_7_0_EBX_INVPCID },
1392         .to = { FEAT_VMX_SECONDARY_CTLS,    VMX_SECONDARY_EXEC_ENABLE_INVPCID },
1393     },
1394     {
1395         .from = { FEAT_7_0_EBX,             CPUID_7_0_EBX_RDSEED },
1396         .to = { FEAT_VMX_SECONDARY_CTLS,    VMX_SECONDARY_EXEC_RDSEED_EXITING },
1397     },
1398     {
1399         .from = { FEAT_7_0_EBX,             CPUID_7_0_EBX_INTEL_PT },
1400         .to = { FEAT_14_0_ECX,              ~0ull },
1401     },
1402     {
1403         .from = { FEAT_8000_0001_EDX,       CPUID_EXT2_RDTSCP },
1404         .to = { FEAT_VMX_SECONDARY_CTLS,    VMX_SECONDARY_EXEC_RDTSCP },
1405     },
1406     {
1407         .from = { FEAT_VMX_SECONDARY_CTLS,  VMX_SECONDARY_EXEC_ENABLE_EPT },
1408         .to = { FEAT_VMX_EPT_VPID_CAPS,     0xffffffffull },
1409     },
1410     {
1411         .from = { FEAT_VMX_SECONDARY_CTLS,  VMX_SECONDARY_EXEC_ENABLE_EPT },
1412         .to = { FEAT_VMX_SECONDARY_CTLS,    VMX_SECONDARY_EXEC_UNRESTRICTED_GUEST },
1413     },
1414     {
1415         .from = { FEAT_VMX_SECONDARY_CTLS,  VMX_SECONDARY_EXEC_ENABLE_VPID },
1416         .to = { FEAT_VMX_EPT_VPID_CAPS,     0xffffffffull << 32 },
1417     },
1418     {
1419         .from = { FEAT_VMX_SECONDARY_CTLS,  VMX_SECONDARY_EXEC_ENABLE_VMFUNC },
1420         .to = { FEAT_VMX_VMFUNC,            ~0ull },
1421     },
1422     {
1423         .from = { FEAT_8000_0001_ECX,       CPUID_EXT3_SVM },
1424         .to = { FEAT_SVM,                   ~0ull },
1425     },
1426 };
1427 
1428 typedef struct X86RegisterInfo32 {
1429     /* Name of register */
1430     const char *name;
1431     /* QAPI enum value register */
1432     X86CPURegister32 qapi_enum;
1433 } X86RegisterInfo32;
1434 
1435 #define REGISTER(reg) \
1436     [R_##reg] = { .name = #reg, .qapi_enum = X86_CPU_REGISTER32_##reg }
1437 static const X86RegisterInfo32 x86_reg_info_32[CPU_NB_REGS32] = {
1438     REGISTER(EAX),
1439     REGISTER(ECX),
1440     REGISTER(EDX),
1441     REGISTER(EBX),
1442     REGISTER(ESP),
1443     REGISTER(EBP),
1444     REGISTER(ESI),
1445     REGISTER(EDI),
1446 };
1447 #undef REGISTER
1448 
1449 typedef struct ExtSaveArea {
1450     uint32_t feature, bits;
1451     uint32_t offset, size;
1452 } ExtSaveArea;
1453 
1454 static const ExtSaveArea x86_ext_save_areas[] = {
1455     [XSTATE_FP_BIT] = {
1456         /* x87 FP state component is always enabled if XSAVE is supported */
1457         .feature = FEAT_1_ECX, .bits = CPUID_EXT_XSAVE,
1458         /* x87 state is in the legacy region of the XSAVE area */
1459         .offset = 0,
1460         .size = sizeof(X86LegacyXSaveArea) + sizeof(X86XSaveHeader),
1461     },
1462     [XSTATE_SSE_BIT] = {
1463         /* SSE state component is always enabled if XSAVE is supported */
1464         .feature = FEAT_1_ECX, .bits = CPUID_EXT_XSAVE,
1465         /* SSE state is in the legacy region of the XSAVE area */
1466         .offset = 0,
1467         .size = sizeof(X86LegacyXSaveArea) + sizeof(X86XSaveHeader),
1468     },
1469     [XSTATE_YMM_BIT] =
1470           { .feature = FEAT_1_ECX, .bits = CPUID_EXT_AVX,
1471             .offset = offsetof(X86XSaveArea, avx_state),
1472             .size = sizeof(XSaveAVX) },
1473     [XSTATE_BNDREGS_BIT] =
1474           { .feature = FEAT_7_0_EBX, .bits = CPUID_7_0_EBX_MPX,
1475             .offset = offsetof(X86XSaveArea, bndreg_state),
1476             .size = sizeof(XSaveBNDREG)  },
1477     [XSTATE_BNDCSR_BIT] =
1478           { .feature = FEAT_7_0_EBX, .bits = CPUID_7_0_EBX_MPX,
1479             .offset = offsetof(X86XSaveArea, bndcsr_state),
1480             .size = sizeof(XSaveBNDCSR)  },
1481     [XSTATE_OPMASK_BIT] =
1482           { .feature = FEAT_7_0_EBX, .bits = CPUID_7_0_EBX_AVX512F,
1483             .offset = offsetof(X86XSaveArea, opmask_state),
1484             .size = sizeof(XSaveOpmask) },
1485     [XSTATE_ZMM_Hi256_BIT] =
1486           { .feature = FEAT_7_0_EBX, .bits = CPUID_7_0_EBX_AVX512F,
1487             .offset = offsetof(X86XSaveArea, zmm_hi256_state),
1488             .size = sizeof(XSaveZMM_Hi256) },
1489     [XSTATE_Hi16_ZMM_BIT] =
1490           { .feature = FEAT_7_0_EBX, .bits = CPUID_7_0_EBX_AVX512F,
1491             .offset = offsetof(X86XSaveArea, hi16_zmm_state),
1492             .size = sizeof(XSaveHi16_ZMM) },
1493     [XSTATE_PKRU_BIT] =
1494           { .feature = FEAT_7_0_ECX, .bits = CPUID_7_0_ECX_PKU,
1495             .offset = offsetof(X86XSaveArea, pkru_state),
1496             .size = sizeof(XSavePKRU) },
1497 };
1498 
1499 static uint32_t xsave_area_size(uint64_t mask)
1500 {
1501     int i;
1502     uint64_t ret = 0;
1503 
1504     for (i = 0; i < ARRAY_SIZE(x86_ext_save_areas); i++) {
1505         const ExtSaveArea *esa = &x86_ext_save_areas[i];
1506         if ((mask >> i) & 1) {
1507             ret = MAX(ret, esa->offset + esa->size);
1508         }
1509     }
1510     return ret;
1511 }
1512 
1513 static inline bool accel_uses_host_cpuid(void)
1514 {
1515     return kvm_enabled() || hvf_enabled();
1516 }
1517 
1518 static inline uint64_t x86_cpu_xsave_components(X86CPU *cpu)
1519 {
1520     return ((uint64_t)cpu->env.features[FEAT_XSAVE_COMP_HI]) << 32 |
1521            cpu->env.features[FEAT_XSAVE_COMP_LO];
1522 }
1523 
1524 const char *get_register_name_32(unsigned int reg)
1525 {
1526     if (reg >= CPU_NB_REGS32) {
1527         return NULL;
1528     }
1529     return x86_reg_info_32[reg].name;
1530 }
1531 
1532 /*
1533  * Returns the set of feature flags that are supported and migratable by
1534  * QEMU, for a given FeatureWord.
1535  */
1536 static uint64_t x86_cpu_get_migratable_flags(FeatureWord w)
1537 {
1538     FeatureWordInfo *wi = &feature_word_info[w];
1539     uint64_t r = 0;
1540     int i;
1541 
1542     for (i = 0; i < 64; i++) {
1543         uint64_t f = 1ULL << i;
1544 
1545         /* If the feature name is known, it is implicitly considered migratable,
1546          * unless it is explicitly set in unmigratable_flags */
1547         if ((wi->migratable_flags & f) ||
1548             (wi->feat_names[i] && !(wi->unmigratable_flags & f))) {
1549             r |= f;
1550         }
1551     }
1552     return r;
1553 }
1554 
1555 void host_cpuid(uint32_t function, uint32_t count,
1556                 uint32_t *eax, uint32_t *ebx, uint32_t *ecx, uint32_t *edx)
1557 {
1558     uint32_t vec[4];
1559 
1560 #ifdef __x86_64__
1561     asm volatile("cpuid"
1562                  : "=a"(vec[0]), "=b"(vec[1]),
1563                    "=c"(vec[2]), "=d"(vec[3])
1564                  : "0"(function), "c"(count) : "cc");
1565 #elif defined(__i386__)
1566     asm volatile("pusha \n\t"
1567                  "cpuid \n\t"
1568                  "mov %%eax, 0(%2) \n\t"
1569                  "mov %%ebx, 4(%2) \n\t"
1570                  "mov %%ecx, 8(%2) \n\t"
1571                  "mov %%edx, 12(%2) \n\t"
1572                  "popa"
1573                  : : "a"(function), "c"(count), "S"(vec)
1574                  : "memory", "cc");
1575 #else
1576     abort();
1577 #endif
1578 
1579     if (eax)
1580         *eax = vec[0];
1581     if (ebx)
1582         *ebx = vec[1];
1583     if (ecx)
1584         *ecx = vec[2];
1585     if (edx)
1586         *edx = vec[3];
1587 }
1588 
1589 void host_vendor_fms(char *vendor, int *family, int *model, int *stepping)
1590 {
1591     uint32_t eax, ebx, ecx, edx;
1592 
1593     host_cpuid(0x0, 0, &eax, &ebx, &ecx, &edx);
1594     x86_cpu_vendor_words2str(vendor, ebx, edx, ecx);
1595 
1596     host_cpuid(0x1, 0, &eax, &ebx, &ecx, &edx);
1597     if (family) {
1598         *family = ((eax >> 8) & 0x0F) + ((eax >> 20) & 0xFF);
1599     }
1600     if (model) {
1601         *model = ((eax >> 4) & 0x0F) | ((eax & 0xF0000) >> 12);
1602     }
1603     if (stepping) {
1604         *stepping = eax & 0x0F;
1605     }
1606 }
1607 
1608 /* CPU class name definitions: */
1609 
1610 /* Return type name for a given CPU model name
1611  * Caller is responsible for freeing the returned string.
1612  */
1613 static char *x86_cpu_type_name(const char *model_name)
1614 {
1615     return g_strdup_printf(X86_CPU_TYPE_NAME("%s"), model_name);
1616 }
1617 
1618 static ObjectClass *x86_cpu_class_by_name(const char *cpu_model)
1619 {
1620     g_autofree char *typename = x86_cpu_type_name(cpu_model);
1621     return object_class_by_name(typename);
1622 }
1623 
1624 static char *x86_cpu_class_get_model_name(X86CPUClass *cc)
1625 {
1626     const char *class_name = object_class_get_name(OBJECT_CLASS(cc));
1627     assert(g_str_has_suffix(class_name, X86_CPU_TYPE_SUFFIX));
1628     return g_strndup(class_name,
1629                      strlen(class_name) - strlen(X86_CPU_TYPE_SUFFIX));
1630 }
1631 
1632 typedef struct PropValue {
1633     const char *prop, *value;
1634 } PropValue;
1635 
1636 typedef struct X86CPUVersionDefinition {
1637     X86CPUVersion version;
1638     const char *alias;
1639     const char *note;
1640     PropValue *props;
1641 } X86CPUVersionDefinition;
1642 
1643 /* Base definition for a CPU model */
1644 typedef struct X86CPUDefinition {
1645     const char *name;
1646     uint32_t level;
1647     uint32_t xlevel;
1648     /* vendor is zero-terminated, 12 character ASCII string */
1649     char vendor[CPUID_VENDOR_SZ + 1];
1650     int family;
1651     int model;
1652     int stepping;
1653     FeatureWordArray features;
1654     const char *model_id;
1655     CPUCaches *cache_info;
1656     /*
1657      * Definitions for alternative versions of CPU model.
1658      * List is terminated by item with version == 0.
1659      * If NULL, version 1 will be registered automatically.
1660      */
1661     const X86CPUVersionDefinition *versions;
1662     const char *deprecation_note;
1663 } X86CPUDefinition;
1664 
1665 /* Reference to a specific CPU model version */
1666 struct X86CPUModel {
1667     /* Base CPU definition */
1668     X86CPUDefinition *cpudef;
1669     /* CPU model version */
1670     X86CPUVersion version;
1671     const char *note;
1672     /*
1673      * If true, this is an alias CPU model.
1674      * This matters only for "-cpu help" and query-cpu-definitions
1675      */
1676     bool is_alias;
1677 };
1678 
1679 /* Get full model name for CPU version */
1680 static char *x86_cpu_versioned_model_name(X86CPUDefinition *cpudef,
1681                                           X86CPUVersion version)
1682 {
1683     assert(version > 0);
1684     return g_strdup_printf("%s-v%d", cpudef->name, (int)version);
1685 }
1686 
1687 static const X86CPUVersionDefinition *x86_cpu_def_get_versions(X86CPUDefinition *def)
1688 {
1689     /* When X86CPUDefinition::versions is NULL, we register only v1 */
1690     static const X86CPUVersionDefinition default_version_list[] = {
1691         { 1 },
1692         { /* end of list */ }
1693     };
1694 
1695     return def->versions ?: default_version_list;
1696 }
1697 
1698 static CPUCaches epyc_cache_info = {
1699     .l1d_cache = &(CPUCacheInfo) {
1700         .type = DATA_CACHE,
1701         .level = 1,
1702         .size = 32 * KiB,
1703         .line_size = 64,
1704         .associativity = 8,
1705         .partitions = 1,
1706         .sets = 64,
1707         .lines_per_tag = 1,
1708         .self_init = 1,
1709         .no_invd_sharing = true,
1710     },
1711     .l1i_cache = &(CPUCacheInfo) {
1712         .type = INSTRUCTION_CACHE,
1713         .level = 1,
1714         .size = 64 * KiB,
1715         .line_size = 64,
1716         .associativity = 4,
1717         .partitions = 1,
1718         .sets = 256,
1719         .lines_per_tag = 1,
1720         .self_init = 1,
1721         .no_invd_sharing = true,
1722     },
1723     .l2_cache = &(CPUCacheInfo) {
1724         .type = UNIFIED_CACHE,
1725         .level = 2,
1726         .size = 512 * KiB,
1727         .line_size = 64,
1728         .associativity = 8,
1729         .partitions = 1,
1730         .sets = 1024,
1731         .lines_per_tag = 1,
1732     },
1733     .l3_cache = &(CPUCacheInfo) {
1734         .type = UNIFIED_CACHE,
1735         .level = 3,
1736         .size = 8 * MiB,
1737         .line_size = 64,
1738         .associativity = 16,
1739         .partitions = 1,
1740         .sets = 8192,
1741         .lines_per_tag = 1,
1742         .self_init = true,
1743         .inclusive = true,
1744         .complex_indexing = true,
1745     },
1746 };
1747 
1748 static CPUCaches epyc_rome_cache_info = {
1749     .l1d_cache = &(CPUCacheInfo) {
1750         .type = DATA_CACHE,
1751         .level = 1,
1752         .size = 32 * KiB,
1753         .line_size = 64,
1754         .associativity = 8,
1755         .partitions = 1,
1756         .sets = 64,
1757         .lines_per_tag = 1,
1758         .self_init = 1,
1759         .no_invd_sharing = true,
1760     },
1761     .l1i_cache = &(CPUCacheInfo) {
1762         .type = INSTRUCTION_CACHE,
1763         .level = 1,
1764         .size = 32 * KiB,
1765         .line_size = 64,
1766         .associativity = 8,
1767         .partitions = 1,
1768         .sets = 64,
1769         .lines_per_tag = 1,
1770         .self_init = 1,
1771         .no_invd_sharing = true,
1772     },
1773     .l2_cache = &(CPUCacheInfo) {
1774         .type = UNIFIED_CACHE,
1775         .level = 2,
1776         .size = 512 * KiB,
1777         .line_size = 64,
1778         .associativity = 8,
1779         .partitions = 1,
1780         .sets = 1024,
1781         .lines_per_tag = 1,
1782     },
1783     .l3_cache = &(CPUCacheInfo) {
1784         .type = UNIFIED_CACHE,
1785         .level = 3,
1786         .size = 16 * MiB,
1787         .line_size = 64,
1788         .associativity = 16,
1789         .partitions = 1,
1790         .sets = 16384,
1791         .lines_per_tag = 1,
1792         .self_init = true,
1793         .inclusive = true,
1794         .complex_indexing = true,
1795     },
1796 };
1797 
1798 /* The following VMX features are not supported by KVM and are left out in the
1799  * CPU definitions:
1800  *
1801  *  Dual-monitor support (all processors)
1802  *  Entry to SMM
1803  *  Deactivate dual-monitor treatment
1804  *  Number of CR3-target values
1805  *  Shutdown activity state
1806  *  Wait-for-SIPI activity state
1807  *  PAUSE-loop exiting (Westmere and newer)
1808  *  EPT-violation #VE (Broadwell and newer)
1809  *  Inject event with insn length=0 (Skylake and newer)
1810  *  Conceal non-root operation from PT
1811  *  Conceal VM exits from PT
1812  *  Conceal VM entries from PT
1813  *  Enable ENCLS exiting
1814  *  Mode-based execute control (XS/XU)
1815  s  TSC scaling (Skylake Server and newer)
1816  *  GPA translation for PT (IceLake and newer)
1817  *  User wait and pause
1818  *  ENCLV exiting
1819  *  Load IA32_RTIT_CTL
1820  *  Clear IA32_RTIT_CTL
1821  *  Advanced VM-exit information for EPT violations
1822  *  Sub-page write permissions
1823  *  PT in VMX operation
1824  */
1825 
1826 static X86CPUDefinition builtin_x86_defs[] = {
1827     {
1828         .name = "qemu64",
1829         .level = 0xd,
1830         .vendor = CPUID_VENDOR_AMD,
1831         .family = 6,
1832         .model = 6,
1833         .stepping = 3,
1834         .features[FEAT_1_EDX] =
1835             PPRO_FEATURES |
1836             CPUID_MTRR | CPUID_CLFLUSH | CPUID_MCA |
1837             CPUID_PSE36,
1838         .features[FEAT_1_ECX] =
1839             CPUID_EXT_SSE3 | CPUID_EXT_CX16,
1840         .features[FEAT_8000_0001_EDX] =
1841             CPUID_EXT2_LM | CPUID_EXT2_SYSCALL | CPUID_EXT2_NX,
1842         .features[FEAT_8000_0001_ECX] =
1843             CPUID_EXT3_LAHF_LM | CPUID_EXT3_SVM,
1844         .xlevel = 0x8000000A,
1845         .model_id = "QEMU Virtual CPU version " QEMU_HW_VERSION,
1846     },
1847     {
1848         .name = "phenom",
1849         .level = 5,
1850         .vendor = CPUID_VENDOR_AMD,
1851         .family = 16,
1852         .model = 2,
1853         .stepping = 3,
1854         /* Missing: CPUID_HT */
1855         .features[FEAT_1_EDX] =
1856             PPRO_FEATURES |
1857             CPUID_MTRR | CPUID_CLFLUSH | CPUID_MCA |
1858             CPUID_PSE36 | CPUID_VME,
1859         .features[FEAT_1_ECX] =
1860             CPUID_EXT_SSE3 | CPUID_EXT_MONITOR | CPUID_EXT_CX16 |
1861             CPUID_EXT_POPCNT,
1862         .features[FEAT_8000_0001_EDX] =
1863             CPUID_EXT2_LM | CPUID_EXT2_SYSCALL | CPUID_EXT2_NX |
1864             CPUID_EXT2_3DNOW | CPUID_EXT2_3DNOWEXT | CPUID_EXT2_MMXEXT |
1865             CPUID_EXT2_FFXSR | CPUID_EXT2_PDPE1GB | CPUID_EXT2_RDTSCP,
1866         /* Missing: CPUID_EXT3_CMP_LEG, CPUID_EXT3_EXTAPIC,
1867                     CPUID_EXT3_CR8LEG,
1868                     CPUID_EXT3_MISALIGNSSE, CPUID_EXT3_3DNOWPREFETCH,
1869                     CPUID_EXT3_OSVW, CPUID_EXT3_IBS */
1870         .features[FEAT_8000_0001_ECX] =
1871             CPUID_EXT3_LAHF_LM | CPUID_EXT3_SVM |
1872             CPUID_EXT3_ABM | CPUID_EXT3_SSE4A,
1873         /* Missing: CPUID_SVM_LBRV */
1874         .features[FEAT_SVM] =
1875             CPUID_SVM_NPT,
1876         .xlevel = 0x8000001A,
1877         .model_id = "AMD Phenom(tm) 9550 Quad-Core Processor"
1878     },
1879     {
1880         .name = "core2duo",
1881         .level = 10,
1882         .vendor = CPUID_VENDOR_INTEL,
1883         .family = 6,
1884         .model = 15,
1885         .stepping = 11,
1886         /* Missing: CPUID_DTS, CPUID_HT, CPUID_TM, CPUID_PBE */
1887         .features[FEAT_1_EDX] =
1888             PPRO_FEATURES |
1889             CPUID_MTRR | CPUID_CLFLUSH | CPUID_MCA |
1890             CPUID_PSE36 | CPUID_VME | CPUID_ACPI | CPUID_SS,
1891         /* Missing: CPUID_EXT_DTES64, CPUID_EXT_DSCPL, CPUID_EXT_EST,
1892          * CPUID_EXT_TM2, CPUID_EXT_XTPR, CPUID_EXT_PDCM, CPUID_EXT_VMX */
1893         .features[FEAT_1_ECX] =
1894             CPUID_EXT_SSE3 | CPUID_EXT_MONITOR | CPUID_EXT_SSSE3 |
1895             CPUID_EXT_CX16,
1896         .features[FEAT_8000_0001_EDX] =
1897             CPUID_EXT2_LM | CPUID_EXT2_SYSCALL | CPUID_EXT2_NX,
1898         .features[FEAT_8000_0001_ECX] =
1899             CPUID_EXT3_LAHF_LM,
1900         .features[FEAT_VMX_BASIC] = MSR_VMX_BASIC_INS_OUTS,
1901         .features[FEAT_VMX_ENTRY_CTLS] = VMX_VM_ENTRY_IA32E_MODE,
1902         .features[FEAT_VMX_EXIT_CTLS] = VMX_VM_EXIT_ACK_INTR_ON_EXIT,
1903         .features[FEAT_VMX_MISC] = MSR_VMX_MISC_ACTIVITY_HLT,
1904         .features[FEAT_VMX_PINBASED_CTLS] = VMX_PIN_BASED_EXT_INTR_MASK |
1905              VMX_PIN_BASED_NMI_EXITING | VMX_PIN_BASED_VIRTUAL_NMIS,
1906         .features[FEAT_VMX_PROCBASED_CTLS] = VMX_CPU_BASED_VIRTUAL_INTR_PENDING |
1907              VMX_CPU_BASED_USE_TSC_OFFSETING | VMX_CPU_BASED_HLT_EXITING |
1908              VMX_CPU_BASED_INVLPG_EXITING | VMX_CPU_BASED_MWAIT_EXITING |
1909              VMX_CPU_BASED_RDPMC_EXITING | VMX_CPU_BASED_RDTSC_EXITING |
1910              VMX_CPU_BASED_CR8_LOAD_EXITING | VMX_CPU_BASED_CR8_STORE_EXITING |
1911              VMX_CPU_BASED_TPR_SHADOW | VMX_CPU_BASED_MOV_DR_EXITING |
1912              VMX_CPU_BASED_UNCOND_IO_EXITING | VMX_CPU_BASED_USE_IO_BITMAPS |
1913              VMX_CPU_BASED_MONITOR_EXITING | VMX_CPU_BASED_PAUSE_EXITING |
1914              VMX_CPU_BASED_VIRTUAL_NMI_PENDING | VMX_CPU_BASED_USE_MSR_BITMAPS |
1915              VMX_CPU_BASED_ACTIVATE_SECONDARY_CONTROLS,
1916         .features[FEAT_VMX_SECONDARY_CTLS] =
1917              VMX_SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES,
1918         .xlevel = 0x80000008,
1919         .model_id = "Intel(R) Core(TM)2 Duo CPU     T7700  @ 2.40GHz",
1920     },
1921     {
1922         .name = "kvm64",
1923         .level = 0xd,
1924         .vendor = CPUID_VENDOR_INTEL,
1925         .family = 15,
1926         .model = 6,
1927         .stepping = 1,
1928         /* Missing: CPUID_HT */
1929         .features[FEAT_1_EDX] =
1930             PPRO_FEATURES | CPUID_VME |
1931             CPUID_MTRR | CPUID_CLFLUSH | CPUID_MCA |
1932             CPUID_PSE36,
1933         /* Missing: CPUID_EXT_POPCNT, CPUID_EXT_MONITOR */
1934         .features[FEAT_1_ECX] =
1935             CPUID_EXT_SSE3 | CPUID_EXT_CX16,
1936         /* Missing: CPUID_EXT2_PDPE1GB, CPUID_EXT2_RDTSCP */
1937         .features[FEAT_8000_0001_EDX] =
1938             CPUID_EXT2_LM | CPUID_EXT2_SYSCALL | CPUID_EXT2_NX,
1939         /* Missing: CPUID_EXT3_LAHF_LM, CPUID_EXT3_CMP_LEG, CPUID_EXT3_EXTAPIC,
1940                     CPUID_EXT3_CR8LEG, CPUID_EXT3_ABM, CPUID_EXT3_SSE4A,
1941                     CPUID_EXT3_MISALIGNSSE, CPUID_EXT3_3DNOWPREFETCH,
1942                     CPUID_EXT3_OSVW, CPUID_EXT3_IBS, CPUID_EXT3_SVM */
1943         .features[FEAT_8000_0001_ECX] =
1944             0,
1945         /* VMX features from Cedar Mill/Prescott */
1946         .features[FEAT_VMX_ENTRY_CTLS] = VMX_VM_ENTRY_IA32E_MODE,
1947         .features[FEAT_VMX_EXIT_CTLS] = VMX_VM_EXIT_ACK_INTR_ON_EXIT,
1948         .features[FEAT_VMX_MISC] = MSR_VMX_MISC_ACTIVITY_HLT,
1949         .features[FEAT_VMX_PINBASED_CTLS] = VMX_PIN_BASED_EXT_INTR_MASK |
1950              VMX_PIN_BASED_NMI_EXITING,
1951         .features[FEAT_VMX_PROCBASED_CTLS] = VMX_CPU_BASED_VIRTUAL_INTR_PENDING |
1952              VMX_CPU_BASED_USE_TSC_OFFSETING | VMX_CPU_BASED_HLT_EXITING |
1953              VMX_CPU_BASED_INVLPG_EXITING | VMX_CPU_BASED_MWAIT_EXITING |
1954              VMX_CPU_BASED_RDPMC_EXITING | VMX_CPU_BASED_RDTSC_EXITING |
1955              VMX_CPU_BASED_CR8_LOAD_EXITING | VMX_CPU_BASED_CR8_STORE_EXITING |
1956              VMX_CPU_BASED_TPR_SHADOW | VMX_CPU_BASED_MOV_DR_EXITING |
1957              VMX_CPU_BASED_UNCOND_IO_EXITING | VMX_CPU_BASED_USE_IO_BITMAPS |
1958              VMX_CPU_BASED_MONITOR_EXITING | VMX_CPU_BASED_PAUSE_EXITING,
1959         .xlevel = 0x80000008,
1960         .model_id = "Common KVM processor"
1961     },
1962     {
1963         .name = "qemu32",
1964         .level = 4,
1965         .vendor = CPUID_VENDOR_INTEL,
1966         .family = 6,
1967         .model = 6,
1968         .stepping = 3,
1969         .features[FEAT_1_EDX] =
1970             PPRO_FEATURES,
1971         .features[FEAT_1_ECX] =
1972             CPUID_EXT_SSE3,
1973         .xlevel = 0x80000004,
1974         .model_id = "QEMU Virtual CPU version " QEMU_HW_VERSION,
1975     },
1976     {
1977         .name = "kvm32",
1978         .level = 5,
1979         .vendor = CPUID_VENDOR_INTEL,
1980         .family = 15,
1981         .model = 6,
1982         .stepping = 1,
1983         .features[FEAT_1_EDX] =
1984             PPRO_FEATURES | CPUID_VME |
1985             CPUID_MTRR | CPUID_CLFLUSH | CPUID_MCA | CPUID_PSE36,
1986         .features[FEAT_1_ECX] =
1987             CPUID_EXT_SSE3,
1988         .features[FEAT_8000_0001_ECX] =
1989             0,
1990         /* VMX features from Yonah */
1991         .features[FEAT_VMX_ENTRY_CTLS] = VMX_VM_ENTRY_IA32E_MODE,
1992         .features[FEAT_VMX_EXIT_CTLS] = VMX_VM_EXIT_ACK_INTR_ON_EXIT,
1993         .features[FEAT_VMX_MISC] = MSR_VMX_MISC_ACTIVITY_HLT,
1994         .features[FEAT_VMX_PINBASED_CTLS] = VMX_PIN_BASED_EXT_INTR_MASK |
1995              VMX_PIN_BASED_NMI_EXITING,
1996         .features[FEAT_VMX_PROCBASED_CTLS] = VMX_CPU_BASED_VIRTUAL_INTR_PENDING |
1997              VMX_CPU_BASED_USE_TSC_OFFSETING | VMX_CPU_BASED_HLT_EXITING |
1998              VMX_CPU_BASED_INVLPG_EXITING | VMX_CPU_BASED_MWAIT_EXITING |
1999              VMX_CPU_BASED_RDPMC_EXITING | VMX_CPU_BASED_RDTSC_EXITING |
2000              VMX_CPU_BASED_MOV_DR_EXITING | VMX_CPU_BASED_UNCOND_IO_EXITING |
2001              VMX_CPU_BASED_USE_IO_BITMAPS | VMX_CPU_BASED_MONITOR_EXITING |
2002              VMX_CPU_BASED_PAUSE_EXITING | VMX_CPU_BASED_USE_MSR_BITMAPS,
2003         .xlevel = 0x80000008,
2004         .model_id = "Common 32-bit KVM processor"
2005     },
2006     {
2007         .name = "coreduo",
2008         .level = 10,
2009         .vendor = CPUID_VENDOR_INTEL,
2010         .family = 6,
2011         .model = 14,
2012         .stepping = 8,
2013         /* Missing: CPUID_DTS, CPUID_HT, CPUID_TM, CPUID_PBE */
2014         .features[FEAT_1_EDX] =
2015             PPRO_FEATURES | CPUID_VME |
2016             CPUID_MTRR | CPUID_CLFLUSH | CPUID_MCA | CPUID_ACPI |
2017             CPUID_SS,
2018         /* Missing: CPUID_EXT_EST, CPUID_EXT_TM2 , CPUID_EXT_XTPR,
2019          * CPUID_EXT_PDCM, CPUID_EXT_VMX */
2020         .features[FEAT_1_ECX] =
2021             CPUID_EXT_SSE3 | CPUID_EXT_MONITOR,
2022         .features[FEAT_8000_0001_EDX] =
2023             CPUID_EXT2_NX,
2024         .features[FEAT_VMX_ENTRY_CTLS] = VMX_VM_ENTRY_IA32E_MODE,
2025         .features[FEAT_VMX_EXIT_CTLS] = VMX_VM_EXIT_ACK_INTR_ON_EXIT,
2026         .features[FEAT_VMX_MISC] = MSR_VMX_MISC_ACTIVITY_HLT,
2027         .features[FEAT_VMX_PINBASED_CTLS] = VMX_PIN_BASED_EXT_INTR_MASK |
2028              VMX_PIN_BASED_NMI_EXITING,
2029         .features[FEAT_VMX_PROCBASED_CTLS] = VMX_CPU_BASED_VIRTUAL_INTR_PENDING |
2030              VMX_CPU_BASED_USE_TSC_OFFSETING | VMX_CPU_BASED_HLT_EXITING |
2031              VMX_CPU_BASED_INVLPG_EXITING | VMX_CPU_BASED_MWAIT_EXITING |
2032              VMX_CPU_BASED_RDPMC_EXITING | VMX_CPU_BASED_RDTSC_EXITING |
2033              VMX_CPU_BASED_MOV_DR_EXITING | VMX_CPU_BASED_UNCOND_IO_EXITING |
2034              VMX_CPU_BASED_USE_IO_BITMAPS | VMX_CPU_BASED_MONITOR_EXITING |
2035              VMX_CPU_BASED_PAUSE_EXITING | VMX_CPU_BASED_USE_MSR_BITMAPS,
2036         .xlevel = 0x80000008,
2037         .model_id = "Genuine Intel(R) CPU           T2600  @ 2.16GHz",
2038     },
2039     {
2040         .name = "486",
2041         .level = 1,
2042         .vendor = CPUID_VENDOR_INTEL,
2043         .family = 4,
2044         .model = 8,
2045         .stepping = 0,
2046         .features[FEAT_1_EDX] =
2047             I486_FEATURES,
2048         .xlevel = 0,
2049         .model_id = "",
2050     },
2051     {
2052         .name = "pentium",
2053         .level = 1,
2054         .vendor = CPUID_VENDOR_INTEL,
2055         .family = 5,
2056         .model = 4,
2057         .stepping = 3,
2058         .features[FEAT_1_EDX] =
2059             PENTIUM_FEATURES,
2060         .xlevel = 0,
2061         .model_id = "",
2062     },
2063     {
2064         .name = "pentium2",
2065         .level = 2,
2066         .vendor = CPUID_VENDOR_INTEL,
2067         .family = 6,
2068         .model = 5,
2069         .stepping = 2,
2070         .features[FEAT_1_EDX] =
2071             PENTIUM2_FEATURES,
2072         .xlevel = 0,
2073         .model_id = "",
2074     },
2075     {
2076         .name = "pentium3",
2077         .level = 3,
2078         .vendor = CPUID_VENDOR_INTEL,
2079         .family = 6,
2080         .model = 7,
2081         .stepping = 3,
2082         .features[FEAT_1_EDX] =
2083             PENTIUM3_FEATURES,
2084         .xlevel = 0,
2085         .model_id = "",
2086     },
2087     {
2088         .name = "athlon",
2089         .level = 2,
2090         .vendor = CPUID_VENDOR_AMD,
2091         .family = 6,
2092         .model = 2,
2093         .stepping = 3,
2094         .features[FEAT_1_EDX] =
2095             PPRO_FEATURES | CPUID_PSE36 | CPUID_VME | CPUID_MTRR |
2096             CPUID_MCA,
2097         .features[FEAT_8000_0001_EDX] =
2098             CPUID_EXT2_MMXEXT | CPUID_EXT2_3DNOW | CPUID_EXT2_3DNOWEXT,
2099         .xlevel = 0x80000008,
2100         .model_id = "QEMU Virtual CPU version " QEMU_HW_VERSION,
2101     },
2102     {
2103         .name = "n270",
2104         .level = 10,
2105         .vendor = CPUID_VENDOR_INTEL,
2106         .family = 6,
2107         .model = 28,
2108         .stepping = 2,
2109         /* Missing: CPUID_DTS, CPUID_HT, CPUID_TM, CPUID_PBE */
2110         .features[FEAT_1_EDX] =
2111             PPRO_FEATURES |
2112             CPUID_MTRR | CPUID_CLFLUSH | CPUID_MCA | CPUID_VME |
2113             CPUID_ACPI | CPUID_SS,
2114             /* Some CPUs got no CPUID_SEP */
2115         /* Missing: CPUID_EXT_DSCPL, CPUID_EXT_EST, CPUID_EXT_TM2,
2116          * CPUID_EXT_XTPR */
2117         .features[FEAT_1_ECX] =
2118             CPUID_EXT_SSE3 | CPUID_EXT_MONITOR | CPUID_EXT_SSSE3 |
2119             CPUID_EXT_MOVBE,
2120         .features[FEAT_8000_0001_EDX] =
2121             CPUID_EXT2_NX,
2122         .features[FEAT_8000_0001_ECX] =
2123             CPUID_EXT3_LAHF_LM,
2124         .xlevel = 0x80000008,
2125         .model_id = "Intel(R) Atom(TM) CPU N270   @ 1.60GHz",
2126     },
2127     {
2128         .name = "Conroe",
2129         .level = 10,
2130         .vendor = CPUID_VENDOR_INTEL,
2131         .family = 6,
2132         .model = 15,
2133         .stepping = 3,
2134         .features[FEAT_1_EDX] =
2135             CPUID_VME | CPUID_SSE2 | CPUID_SSE | CPUID_FXSR | CPUID_MMX |
2136             CPUID_CLFLUSH | CPUID_PSE36 | CPUID_PAT | CPUID_CMOV | CPUID_MCA |
2137             CPUID_PGE | CPUID_MTRR | CPUID_SEP | CPUID_APIC | CPUID_CX8 |
2138             CPUID_MCE | CPUID_PAE | CPUID_MSR | CPUID_TSC | CPUID_PSE |
2139             CPUID_DE | CPUID_FP87,
2140         .features[FEAT_1_ECX] =
2141             CPUID_EXT_SSSE3 | CPUID_EXT_SSE3,
2142         .features[FEAT_8000_0001_EDX] =
2143             CPUID_EXT2_LM | CPUID_EXT2_NX | CPUID_EXT2_SYSCALL,
2144         .features[FEAT_8000_0001_ECX] =
2145             CPUID_EXT3_LAHF_LM,
2146         .features[FEAT_VMX_BASIC] = MSR_VMX_BASIC_INS_OUTS,
2147         .features[FEAT_VMX_ENTRY_CTLS] = VMX_VM_ENTRY_IA32E_MODE,
2148         .features[FEAT_VMX_EXIT_CTLS] = VMX_VM_EXIT_ACK_INTR_ON_EXIT,
2149         .features[FEAT_VMX_MISC] = MSR_VMX_MISC_ACTIVITY_HLT,
2150         .features[FEAT_VMX_PINBASED_CTLS] = VMX_PIN_BASED_EXT_INTR_MASK |
2151              VMX_PIN_BASED_NMI_EXITING | VMX_PIN_BASED_VIRTUAL_NMIS,
2152         .features[FEAT_VMX_PROCBASED_CTLS] = VMX_CPU_BASED_VIRTUAL_INTR_PENDING |
2153              VMX_CPU_BASED_USE_TSC_OFFSETING | VMX_CPU_BASED_HLT_EXITING |
2154              VMX_CPU_BASED_INVLPG_EXITING | VMX_CPU_BASED_MWAIT_EXITING |
2155              VMX_CPU_BASED_RDPMC_EXITING | VMX_CPU_BASED_RDTSC_EXITING |
2156              VMX_CPU_BASED_CR8_LOAD_EXITING | VMX_CPU_BASED_CR8_STORE_EXITING |
2157              VMX_CPU_BASED_TPR_SHADOW | VMX_CPU_BASED_MOV_DR_EXITING |
2158              VMX_CPU_BASED_UNCOND_IO_EXITING | VMX_CPU_BASED_USE_IO_BITMAPS |
2159              VMX_CPU_BASED_MONITOR_EXITING | VMX_CPU_BASED_PAUSE_EXITING |
2160              VMX_CPU_BASED_VIRTUAL_NMI_PENDING | VMX_CPU_BASED_USE_MSR_BITMAPS |
2161              VMX_CPU_BASED_ACTIVATE_SECONDARY_CONTROLS,
2162         .features[FEAT_VMX_SECONDARY_CTLS] =
2163              VMX_SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES,
2164         .xlevel = 0x80000008,
2165         .model_id = "Intel Celeron_4x0 (Conroe/Merom Class Core 2)",
2166     },
2167     {
2168         .name = "Penryn",
2169         .level = 10,
2170         .vendor = CPUID_VENDOR_INTEL,
2171         .family = 6,
2172         .model = 23,
2173         .stepping = 3,
2174         .features[FEAT_1_EDX] =
2175             CPUID_VME | CPUID_SSE2 | CPUID_SSE | CPUID_FXSR | CPUID_MMX |
2176             CPUID_CLFLUSH | CPUID_PSE36 | CPUID_PAT | CPUID_CMOV | CPUID_MCA |
2177             CPUID_PGE | CPUID_MTRR | CPUID_SEP | CPUID_APIC | CPUID_CX8 |
2178             CPUID_MCE | CPUID_PAE | CPUID_MSR | CPUID_TSC | CPUID_PSE |
2179             CPUID_DE | CPUID_FP87,
2180         .features[FEAT_1_ECX] =
2181             CPUID_EXT_SSE41 | CPUID_EXT_CX16 | CPUID_EXT_SSSE3 |
2182             CPUID_EXT_SSE3,
2183         .features[FEAT_8000_0001_EDX] =
2184             CPUID_EXT2_LM | CPUID_EXT2_NX | CPUID_EXT2_SYSCALL,
2185         .features[FEAT_8000_0001_ECX] =
2186             CPUID_EXT3_LAHF_LM,
2187         .features[FEAT_VMX_BASIC] = MSR_VMX_BASIC_INS_OUTS,
2188         .features[FEAT_VMX_ENTRY_CTLS] = VMX_VM_ENTRY_IA32E_MODE |
2189              VMX_VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL,
2190         .features[FEAT_VMX_EXIT_CTLS] = VMX_VM_EXIT_ACK_INTR_ON_EXIT |
2191              VMX_VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL,
2192         .features[FEAT_VMX_MISC] = MSR_VMX_MISC_ACTIVITY_HLT,
2193         .features[FEAT_VMX_PINBASED_CTLS] = VMX_PIN_BASED_EXT_INTR_MASK |
2194              VMX_PIN_BASED_NMI_EXITING | VMX_PIN_BASED_VIRTUAL_NMIS,
2195         .features[FEAT_VMX_PROCBASED_CTLS] = VMX_CPU_BASED_VIRTUAL_INTR_PENDING |
2196              VMX_CPU_BASED_USE_TSC_OFFSETING | VMX_CPU_BASED_HLT_EXITING |
2197              VMX_CPU_BASED_INVLPG_EXITING | VMX_CPU_BASED_MWAIT_EXITING |
2198              VMX_CPU_BASED_RDPMC_EXITING | VMX_CPU_BASED_RDTSC_EXITING |
2199              VMX_CPU_BASED_CR8_LOAD_EXITING | VMX_CPU_BASED_CR8_STORE_EXITING |
2200              VMX_CPU_BASED_TPR_SHADOW | VMX_CPU_BASED_MOV_DR_EXITING |
2201              VMX_CPU_BASED_UNCOND_IO_EXITING | VMX_CPU_BASED_USE_IO_BITMAPS |
2202              VMX_CPU_BASED_MONITOR_EXITING | VMX_CPU_BASED_PAUSE_EXITING |
2203              VMX_CPU_BASED_VIRTUAL_NMI_PENDING | VMX_CPU_BASED_USE_MSR_BITMAPS |
2204              VMX_CPU_BASED_ACTIVATE_SECONDARY_CONTROLS,
2205         .features[FEAT_VMX_SECONDARY_CTLS] =
2206              VMX_SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
2207              VMX_SECONDARY_EXEC_WBINVD_EXITING,
2208         .xlevel = 0x80000008,
2209         .model_id = "Intel Core 2 Duo P9xxx (Penryn Class Core 2)",
2210     },
2211     {
2212         .name = "Nehalem",
2213         .level = 11,
2214         .vendor = CPUID_VENDOR_INTEL,
2215         .family = 6,
2216         .model = 26,
2217         .stepping = 3,
2218         .features[FEAT_1_EDX] =
2219             CPUID_VME | CPUID_SSE2 | CPUID_SSE | CPUID_FXSR | CPUID_MMX |
2220             CPUID_CLFLUSH | CPUID_PSE36 | CPUID_PAT | CPUID_CMOV | CPUID_MCA |
2221             CPUID_PGE | CPUID_MTRR | CPUID_SEP | CPUID_APIC | CPUID_CX8 |
2222             CPUID_MCE | CPUID_PAE | CPUID_MSR | CPUID_TSC | CPUID_PSE |
2223             CPUID_DE | CPUID_FP87,
2224         .features[FEAT_1_ECX] =
2225             CPUID_EXT_POPCNT | CPUID_EXT_SSE42 | CPUID_EXT_SSE41 |
2226             CPUID_EXT_CX16 | CPUID_EXT_SSSE3 | CPUID_EXT_SSE3,
2227         .features[FEAT_8000_0001_EDX] =
2228             CPUID_EXT2_LM | CPUID_EXT2_SYSCALL | CPUID_EXT2_NX,
2229         .features[FEAT_8000_0001_ECX] =
2230             CPUID_EXT3_LAHF_LM,
2231         .features[FEAT_VMX_BASIC] = MSR_VMX_BASIC_INS_OUTS |
2232              MSR_VMX_BASIC_TRUE_CTLS,
2233         .features[FEAT_VMX_ENTRY_CTLS] = VMX_VM_ENTRY_IA32E_MODE |
2234              VMX_VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL | VMX_VM_ENTRY_LOAD_IA32_PAT |
2235              VMX_VM_ENTRY_LOAD_DEBUG_CONTROLS | VMX_VM_ENTRY_LOAD_IA32_EFER,
2236         .features[FEAT_VMX_EPT_VPID_CAPS] = MSR_VMX_EPT_EXECONLY |
2237              MSR_VMX_EPT_PAGE_WALK_LENGTH_4 | MSR_VMX_EPT_WB | MSR_VMX_EPT_2MB |
2238              MSR_VMX_EPT_1GB | MSR_VMX_EPT_INVEPT |
2239              MSR_VMX_EPT_INVEPT_SINGLE_CONTEXT | MSR_VMX_EPT_INVEPT_ALL_CONTEXT |
2240              MSR_VMX_EPT_INVVPID | MSR_VMX_EPT_INVVPID_SINGLE_ADDR |
2241              MSR_VMX_EPT_INVVPID_SINGLE_CONTEXT | MSR_VMX_EPT_INVVPID_ALL_CONTEXT |
2242              MSR_VMX_EPT_INVVPID_SINGLE_CONTEXT_NOGLOBALS,
2243         .features[FEAT_VMX_EXIT_CTLS] =
2244              VMX_VM_EXIT_ACK_INTR_ON_EXIT | VMX_VM_EXIT_SAVE_DEBUG_CONTROLS |
2245              VMX_VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL |
2246              VMX_VM_EXIT_LOAD_IA32_PAT | VMX_VM_EXIT_LOAD_IA32_EFER |
2247              VMX_VM_EXIT_SAVE_IA32_PAT | VMX_VM_EXIT_SAVE_IA32_EFER |
2248              VMX_VM_EXIT_SAVE_VMX_PREEMPTION_TIMER,
2249         .features[FEAT_VMX_MISC] = MSR_VMX_MISC_ACTIVITY_HLT,
2250         .features[FEAT_VMX_PINBASED_CTLS] = VMX_PIN_BASED_EXT_INTR_MASK |
2251              VMX_PIN_BASED_NMI_EXITING | VMX_PIN_BASED_VIRTUAL_NMIS |
2252              VMX_PIN_BASED_VMX_PREEMPTION_TIMER,
2253         .features[FEAT_VMX_PROCBASED_CTLS] = VMX_CPU_BASED_VIRTUAL_INTR_PENDING |
2254              VMX_CPU_BASED_USE_TSC_OFFSETING | VMX_CPU_BASED_HLT_EXITING |
2255              VMX_CPU_BASED_INVLPG_EXITING | VMX_CPU_BASED_MWAIT_EXITING |
2256              VMX_CPU_BASED_RDPMC_EXITING | VMX_CPU_BASED_RDTSC_EXITING |
2257              VMX_CPU_BASED_CR8_LOAD_EXITING | VMX_CPU_BASED_CR8_STORE_EXITING |
2258              VMX_CPU_BASED_TPR_SHADOW | VMX_CPU_BASED_MOV_DR_EXITING |
2259              VMX_CPU_BASED_UNCOND_IO_EXITING | VMX_CPU_BASED_USE_IO_BITMAPS |
2260              VMX_CPU_BASED_MONITOR_EXITING | VMX_CPU_BASED_PAUSE_EXITING |
2261              VMX_CPU_BASED_VIRTUAL_NMI_PENDING | VMX_CPU_BASED_USE_MSR_BITMAPS |
2262              VMX_CPU_BASED_CR3_LOAD_EXITING | VMX_CPU_BASED_CR3_STORE_EXITING |
2263              VMX_CPU_BASED_MONITOR_TRAP_FLAG |
2264              VMX_CPU_BASED_ACTIVATE_SECONDARY_CONTROLS,
2265         .features[FEAT_VMX_SECONDARY_CTLS] =
2266              VMX_SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
2267              VMX_SECONDARY_EXEC_WBINVD_EXITING | VMX_SECONDARY_EXEC_ENABLE_EPT |
2268              VMX_SECONDARY_EXEC_DESC | VMX_SECONDARY_EXEC_RDTSCP |
2269              VMX_SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |
2270              VMX_SECONDARY_EXEC_ENABLE_VPID,
2271         .xlevel = 0x80000008,
2272         .model_id = "Intel Core i7 9xx (Nehalem Class Core i7)",
2273         .versions = (X86CPUVersionDefinition[]) {
2274             { .version = 1 },
2275             {
2276                 .version = 2,
2277                 .alias = "Nehalem-IBRS",
2278                 .props = (PropValue[]) {
2279                     { "spec-ctrl", "on" },
2280                     { "model-id",
2281                       "Intel Core i7 9xx (Nehalem Core i7, IBRS update)" },
2282                     { /* end of list */ }
2283                 }
2284             },
2285             { /* end of list */ }
2286         }
2287     },
2288     {
2289         .name = "Westmere",
2290         .level = 11,
2291         .vendor = CPUID_VENDOR_INTEL,
2292         .family = 6,
2293         .model = 44,
2294         .stepping = 1,
2295         .features[FEAT_1_EDX] =
2296             CPUID_VME | CPUID_SSE2 | CPUID_SSE | CPUID_FXSR | CPUID_MMX |
2297             CPUID_CLFLUSH | CPUID_PSE36 | CPUID_PAT | CPUID_CMOV | CPUID_MCA |
2298             CPUID_PGE | CPUID_MTRR | CPUID_SEP | CPUID_APIC | CPUID_CX8 |
2299             CPUID_MCE | CPUID_PAE | CPUID_MSR | CPUID_TSC | CPUID_PSE |
2300             CPUID_DE | CPUID_FP87,
2301         .features[FEAT_1_ECX] =
2302             CPUID_EXT_AES | CPUID_EXT_POPCNT | CPUID_EXT_SSE42 |
2303             CPUID_EXT_SSE41 | CPUID_EXT_CX16 | CPUID_EXT_SSSE3 |
2304             CPUID_EXT_PCLMULQDQ | CPUID_EXT_SSE3,
2305         .features[FEAT_8000_0001_EDX] =
2306             CPUID_EXT2_LM | CPUID_EXT2_SYSCALL | CPUID_EXT2_NX,
2307         .features[FEAT_8000_0001_ECX] =
2308             CPUID_EXT3_LAHF_LM,
2309         .features[FEAT_6_EAX] =
2310             CPUID_6_EAX_ARAT,
2311         .features[FEAT_VMX_BASIC] = MSR_VMX_BASIC_INS_OUTS |
2312              MSR_VMX_BASIC_TRUE_CTLS,
2313         .features[FEAT_VMX_ENTRY_CTLS] = VMX_VM_ENTRY_IA32E_MODE |
2314              VMX_VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL | VMX_VM_ENTRY_LOAD_IA32_PAT |
2315              VMX_VM_ENTRY_LOAD_DEBUG_CONTROLS | VMX_VM_ENTRY_LOAD_IA32_EFER,
2316         .features[FEAT_VMX_EPT_VPID_CAPS] = MSR_VMX_EPT_EXECONLY |
2317              MSR_VMX_EPT_PAGE_WALK_LENGTH_4 | MSR_VMX_EPT_WB | MSR_VMX_EPT_2MB |
2318              MSR_VMX_EPT_1GB | MSR_VMX_EPT_INVEPT |
2319              MSR_VMX_EPT_INVEPT_SINGLE_CONTEXT | MSR_VMX_EPT_INVEPT_ALL_CONTEXT |
2320              MSR_VMX_EPT_INVVPID | MSR_VMX_EPT_INVVPID_SINGLE_ADDR |
2321              MSR_VMX_EPT_INVVPID_SINGLE_CONTEXT | MSR_VMX_EPT_INVVPID_ALL_CONTEXT |
2322              MSR_VMX_EPT_INVVPID_SINGLE_CONTEXT_NOGLOBALS,
2323         .features[FEAT_VMX_EXIT_CTLS] =
2324              VMX_VM_EXIT_ACK_INTR_ON_EXIT | VMX_VM_EXIT_SAVE_DEBUG_CONTROLS |
2325              VMX_VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL |
2326              VMX_VM_EXIT_LOAD_IA32_PAT | VMX_VM_EXIT_LOAD_IA32_EFER |
2327              VMX_VM_EXIT_SAVE_IA32_PAT | VMX_VM_EXIT_SAVE_IA32_EFER |
2328              VMX_VM_EXIT_SAVE_VMX_PREEMPTION_TIMER,
2329         .features[FEAT_VMX_MISC] = MSR_VMX_MISC_ACTIVITY_HLT |
2330              MSR_VMX_MISC_STORE_LMA,
2331         .features[FEAT_VMX_PINBASED_CTLS] = VMX_PIN_BASED_EXT_INTR_MASK |
2332              VMX_PIN_BASED_NMI_EXITING | VMX_PIN_BASED_VIRTUAL_NMIS |
2333              VMX_PIN_BASED_VMX_PREEMPTION_TIMER,
2334         .features[FEAT_VMX_PROCBASED_CTLS] = VMX_CPU_BASED_VIRTUAL_INTR_PENDING |
2335              VMX_CPU_BASED_USE_TSC_OFFSETING | VMX_CPU_BASED_HLT_EXITING |
2336              VMX_CPU_BASED_INVLPG_EXITING | VMX_CPU_BASED_MWAIT_EXITING |
2337              VMX_CPU_BASED_RDPMC_EXITING | VMX_CPU_BASED_RDTSC_EXITING |
2338              VMX_CPU_BASED_CR8_LOAD_EXITING | VMX_CPU_BASED_CR8_STORE_EXITING |
2339              VMX_CPU_BASED_TPR_SHADOW | VMX_CPU_BASED_MOV_DR_EXITING |
2340              VMX_CPU_BASED_UNCOND_IO_EXITING | VMX_CPU_BASED_USE_IO_BITMAPS |
2341              VMX_CPU_BASED_MONITOR_EXITING | VMX_CPU_BASED_PAUSE_EXITING |
2342              VMX_CPU_BASED_VIRTUAL_NMI_PENDING | VMX_CPU_BASED_USE_MSR_BITMAPS |
2343              VMX_CPU_BASED_CR3_LOAD_EXITING | VMX_CPU_BASED_CR3_STORE_EXITING |
2344              VMX_CPU_BASED_MONITOR_TRAP_FLAG |
2345              VMX_CPU_BASED_ACTIVATE_SECONDARY_CONTROLS,
2346         .features[FEAT_VMX_SECONDARY_CTLS] =
2347              VMX_SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
2348              VMX_SECONDARY_EXEC_WBINVD_EXITING | VMX_SECONDARY_EXEC_ENABLE_EPT |
2349              VMX_SECONDARY_EXEC_DESC | VMX_SECONDARY_EXEC_RDTSCP |
2350              VMX_SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |
2351              VMX_SECONDARY_EXEC_ENABLE_VPID | VMX_SECONDARY_EXEC_UNRESTRICTED_GUEST,
2352         .xlevel = 0x80000008,
2353         .model_id = "Westmere E56xx/L56xx/X56xx (Nehalem-C)",
2354         .versions = (X86CPUVersionDefinition[]) {
2355             { .version = 1 },
2356             {
2357                 .version = 2,
2358                 .alias = "Westmere-IBRS",
2359                 .props = (PropValue[]) {
2360                     { "spec-ctrl", "on" },
2361                     { "model-id",
2362                       "Westmere E56xx/L56xx/X56xx (IBRS update)" },
2363                     { /* end of list */ }
2364                 }
2365             },
2366             { /* end of list */ }
2367         }
2368     },
2369     {
2370         .name = "SandyBridge",
2371         .level = 0xd,
2372         .vendor = CPUID_VENDOR_INTEL,
2373         .family = 6,
2374         .model = 42,
2375         .stepping = 1,
2376         .features[FEAT_1_EDX] =
2377             CPUID_VME | CPUID_SSE2 | CPUID_SSE | CPUID_FXSR | CPUID_MMX |
2378             CPUID_CLFLUSH | CPUID_PSE36 | CPUID_PAT | CPUID_CMOV | CPUID_MCA |
2379             CPUID_PGE | CPUID_MTRR | CPUID_SEP | CPUID_APIC | CPUID_CX8 |
2380             CPUID_MCE | CPUID_PAE | CPUID_MSR | CPUID_TSC | CPUID_PSE |
2381             CPUID_DE | CPUID_FP87,
2382         .features[FEAT_1_ECX] =
2383             CPUID_EXT_AVX | CPUID_EXT_XSAVE | CPUID_EXT_AES |
2384             CPUID_EXT_TSC_DEADLINE_TIMER | CPUID_EXT_POPCNT |
2385             CPUID_EXT_X2APIC | CPUID_EXT_SSE42 | CPUID_EXT_SSE41 |
2386             CPUID_EXT_CX16 | CPUID_EXT_SSSE3 | CPUID_EXT_PCLMULQDQ |
2387             CPUID_EXT_SSE3,
2388         .features[FEAT_8000_0001_EDX] =
2389             CPUID_EXT2_LM | CPUID_EXT2_RDTSCP | CPUID_EXT2_NX |
2390             CPUID_EXT2_SYSCALL,
2391         .features[FEAT_8000_0001_ECX] =
2392             CPUID_EXT3_LAHF_LM,
2393         .features[FEAT_XSAVE] =
2394             CPUID_XSAVE_XSAVEOPT,
2395         .features[FEAT_6_EAX] =
2396             CPUID_6_EAX_ARAT,
2397         .features[FEAT_VMX_BASIC] = MSR_VMX_BASIC_INS_OUTS |
2398              MSR_VMX_BASIC_TRUE_CTLS,
2399         .features[FEAT_VMX_ENTRY_CTLS] = VMX_VM_ENTRY_IA32E_MODE |
2400              VMX_VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL | VMX_VM_ENTRY_LOAD_IA32_PAT |
2401              VMX_VM_ENTRY_LOAD_DEBUG_CONTROLS | VMX_VM_ENTRY_LOAD_IA32_EFER,
2402         .features[FEAT_VMX_EPT_VPID_CAPS] = MSR_VMX_EPT_EXECONLY |
2403              MSR_VMX_EPT_PAGE_WALK_LENGTH_4 | MSR_VMX_EPT_WB | MSR_VMX_EPT_2MB |
2404              MSR_VMX_EPT_1GB | MSR_VMX_EPT_INVEPT |
2405              MSR_VMX_EPT_INVEPT_SINGLE_CONTEXT | MSR_VMX_EPT_INVEPT_ALL_CONTEXT |
2406              MSR_VMX_EPT_INVVPID | MSR_VMX_EPT_INVVPID_SINGLE_ADDR |
2407              MSR_VMX_EPT_INVVPID_SINGLE_CONTEXT | MSR_VMX_EPT_INVVPID_ALL_CONTEXT |
2408              MSR_VMX_EPT_INVVPID_SINGLE_CONTEXT_NOGLOBALS,
2409         .features[FEAT_VMX_EXIT_CTLS] =
2410              VMX_VM_EXIT_ACK_INTR_ON_EXIT | VMX_VM_EXIT_SAVE_DEBUG_CONTROLS |
2411              VMX_VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL |
2412              VMX_VM_EXIT_LOAD_IA32_PAT | VMX_VM_EXIT_LOAD_IA32_EFER |
2413              VMX_VM_EXIT_SAVE_IA32_PAT | VMX_VM_EXIT_SAVE_IA32_EFER |
2414              VMX_VM_EXIT_SAVE_VMX_PREEMPTION_TIMER,
2415         .features[FEAT_VMX_MISC] = MSR_VMX_MISC_ACTIVITY_HLT |
2416              MSR_VMX_MISC_STORE_LMA,
2417         .features[FEAT_VMX_PINBASED_CTLS] = VMX_PIN_BASED_EXT_INTR_MASK |
2418              VMX_PIN_BASED_NMI_EXITING | VMX_PIN_BASED_VIRTUAL_NMIS |
2419              VMX_PIN_BASED_VMX_PREEMPTION_TIMER,
2420         .features[FEAT_VMX_PROCBASED_CTLS] = VMX_CPU_BASED_VIRTUAL_INTR_PENDING |
2421              VMX_CPU_BASED_USE_TSC_OFFSETING | VMX_CPU_BASED_HLT_EXITING |
2422              VMX_CPU_BASED_INVLPG_EXITING | VMX_CPU_BASED_MWAIT_EXITING |
2423              VMX_CPU_BASED_RDPMC_EXITING | VMX_CPU_BASED_RDTSC_EXITING |
2424              VMX_CPU_BASED_CR8_LOAD_EXITING | VMX_CPU_BASED_CR8_STORE_EXITING |
2425              VMX_CPU_BASED_TPR_SHADOW | VMX_CPU_BASED_MOV_DR_EXITING |
2426              VMX_CPU_BASED_UNCOND_IO_EXITING | VMX_CPU_BASED_USE_IO_BITMAPS |
2427              VMX_CPU_BASED_MONITOR_EXITING | VMX_CPU_BASED_PAUSE_EXITING |
2428              VMX_CPU_BASED_VIRTUAL_NMI_PENDING | VMX_CPU_BASED_USE_MSR_BITMAPS |
2429              VMX_CPU_BASED_CR3_LOAD_EXITING | VMX_CPU_BASED_CR3_STORE_EXITING |
2430              VMX_CPU_BASED_MONITOR_TRAP_FLAG |
2431              VMX_CPU_BASED_ACTIVATE_SECONDARY_CONTROLS,
2432         .features[FEAT_VMX_SECONDARY_CTLS] =
2433              VMX_SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
2434              VMX_SECONDARY_EXEC_WBINVD_EXITING | VMX_SECONDARY_EXEC_ENABLE_EPT |
2435              VMX_SECONDARY_EXEC_DESC | VMX_SECONDARY_EXEC_RDTSCP |
2436              VMX_SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |
2437              VMX_SECONDARY_EXEC_ENABLE_VPID | VMX_SECONDARY_EXEC_UNRESTRICTED_GUEST,
2438         .xlevel = 0x80000008,
2439         .model_id = "Intel Xeon E312xx (Sandy Bridge)",
2440         .versions = (X86CPUVersionDefinition[]) {
2441             { .version = 1 },
2442             {
2443                 .version = 2,
2444                 .alias = "SandyBridge-IBRS",
2445                 .props = (PropValue[]) {
2446                     { "spec-ctrl", "on" },
2447                     { "model-id",
2448                       "Intel Xeon E312xx (Sandy Bridge, IBRS update)" },
2449                     { /* end of list */ }
2450                 }
2451             },
2452             { /* end of list */ }
2453         }
2454     },
2455     {
2456         .name = "IvyBridge",
2457         .level = 0xd,
2458         .vendor = CPUID_VENDOR_INTEL,
2459         .family = 6,
2460         .model = 58,
2461         .stepping = 9,
2462         .features[FEAT_1_EDX] =
2463             CPUID_VME | CPUID_SSE2 | CPUID_SSE | CPUID_FXSR | CPUID_MMX |
2464             CPUID_CLFLUSH | CPUID_PSE36 | CPUID_PAT | CPUID_CMOV | CPUID_MCA |
2465             CPUID_PGE | CPUID_MTRR | CPUID_SEP | CPUID_APIC | CPUID_CX8 |
2466             CPUID_MCE | CPUID_PAE | CPUID_MSR | CPUID_TSC | CPUID_PSE |
2467             CPUID_DE | CPUID_FP87,
2468         .features[FEAT_1_ECX] =
2469             CPUID_EXT_AVX | CPUID_EXT_XSAVE | CPUID_EXT_AES |
2470             CPUID_EXT_TSC_DEADLINE_TIMER | CPUID_EXT_POPCNT |
2471             CPUID_EXT_X2APIC | CPUID_EXT_SSE42 | CPUID_EXT_SSE41 |
2472             CPUID_EXT_CX16 | CPUID_EXT_SSSE3 | CPUID_EXT_PCLMULQDQ |
2473             CPUID_EXT_SSE3 | CPUID_EXT_F16C | CPUID_EXT_RDRAND,
2474         .features[FEAT_7_0_EBX] =
2475             CPUID_7_0_EBX_FSGSBASE | CPUID_7_0_EBX_SMEP |
2476             CPUID_7_0_EBX_ERMS,
2477         .features[FEAT_8000_0001_EDX] =
2478             CPUID_EXT2_LM | CPUID_EXT2_RDTSCP | CPUID_EXT2_NX |
2479             CPUID_EXT2_SYSCALL,
2480         .features[FEAT_8000_0001_ECX] =
2481             CPUID_EXT3_LAHF_LM,
2482         .features[FEAT_XSAVE] =
2483             CPUID_XSAVE_XSAVEOPT,
2484         .features[FEAT_6_EAX] =
2485             CPUID_6_EAX_ARAT,
2486         .features[FEAT_VMX_BASIC] = MSR_VMX_BASIC_INS_OUTS |
2487              MSR_VMX_BASIC_TRUE_CTLS,
2488         .features[FEAT_VMX_ENTRY_CTLS] = VMX_VM_ENTRY_IA32E_MODE |
2489              VMX_VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL | VMX_VM_ENTRY_LOAD_IA32_PAT |
2490              VMX_VM_ENTRY_LOAD_DEBUG_CONTROLS | VMX_VM_ENTRY_LOAD_IA32_EFER,
2491         .features[FEAT_VMX_EPT_VPID_CAPS] = MSR_VMX_EPT_EXECONLY |
2492              MSR_VMX_EPT_PAGE_WALK_LENGTH_4 | MSR_VMX_EPT_WB | MSR_VMX_EPT_2MB |
2493              MSR_VMX_EPT_1GB | MSR_VMX_EPT_INVEPT |
2494              MSR_VMX_EPT_INVEPT_SINGLE_CONTEXT | MSR_VMX_EPT_INVEPT_ALL_CONTEXT |
2495              MSR_VMX_EPT_INVVPID | MSR_VMX_EPT_INVVPID_SINGLE_ADDR |
2496              MSR_VMX_EPT_INVVPID_SINGLE_CONTEXT | MSR_VMX_EPT_INVVPID_ALL_CONTEXT |
2497              MSR_VMX_EPT_INVVPID_SINGLE_CONTEXT_NOGLOBALS,
2498         .features[FEAT_VMX_EXIT_CTLS] =
2499              VMX_VM_EXIT_ACK_INTR_ON_EXIT | VMX_VM_EXIT_SAVE_DEBUG_CONTROLS |
2500              VMX_VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL |
2501              VMX_VM_EXIT_LOAD_IA32_PAT | VMX_VM_EXIT_LOAD_IA32_EFER |
2502              VMX_VM_EXIT_SAVE_IA32_PAT | VMX_VM_EXIT_SAVE_IA32_EFER |
2503              VMX_VM_EXIT_SAVE_VMX_PREEMPTION_TIMER,
2504         .features[FEAT_VMX_MISC] = MSR_VMX_MISC_ACTIVITY_HLT |
2505              MSR_VMX_MISC_STORE_LMA,
2506         .features[FEAT_VMX_PINBASED_CTLS] = VMX_PIN_BASED_EXT_INTR_MASK |
2507              VMX_PIN_BASED_NMI_EXITING | VMX_PIN_BASED_VIRTUAL_NMIS |
2508              VMX_PIN_BASED_VMX_PREEMPTION_TIMER | VMX_PIN_BASED_POSTED_INTR,
2509         .features[FEAT_VMX_PROCBASED_CTLS] = VMX_CPU_BASED_VIRTUAL_INTR_PENDING |
2510              VMX_CPU_BASED_USE_TSC_OFFSETING | VMX_CPU_BASED_HLT_EXITING |
2511              VMX_CPU_BASED_INVLPG_EXITING | VMX_CPU_BASED_MWAIT_EXITING |
2512              VMX_CPU_BASED_RDPMC_EXITING | VMX_CPU_BASED_RDTSC_EXITING |
2513              VMX_CPU_BASED_CR8_LOAD_EXITING | VMX_CPU_BASED_CR8_STORE_EXITING |
2514              VMX_CPU_BASED_TPR_SHADOW | VMX_CPU_BASED_MOV_DR_EXITING |
2515              VMX_CPU_BASED_UNCOND_IO_EXITING | VMX_CPU_BASED_USE_IO_BITMAPS |
2516              VMX_CPU_BASED_MONITOR_EXITING | VMX_CPU_BASED_PAUSE_EXITING |
2517              VMX_CPU_BASED_VIRTUAL_NMI_PENDING | VMX_CPU_BASED_USE_MSR_BITMAPS |
2518              VMX_CPU_BASED_CR3_LOAD_EXITING | VMX_CPU_BASED_CR3_STORE_EXITING |
2519              VMX_CPU_BASED_MONITOR_TRAP_FLAG |
2520              VMX_CPU_BASED_ACTIVATE_SECONDARY_CONTROLS,
2521         .features[FEAT_VMX_SECONDARY_CTLS] =
2522              VMX_SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
2523              VMX_SECONDARY_EXEC_WBINVD_EXITING | VMX_SECONDARY_EXEC_ENABLE_EPT |
2524              VMX_SECONDARY_EXEC_DESC | VMX_SECONDARY_EXEC_RDTSCP |
2525              VMX_SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |
2526              VMX_SECONDARY_EXEC_ENABLE_VPID | VMX_SECONDARY_EXEC_UNRESTRICTED_GUEST |
2527              VMX_SECONDARY_EXEC_APIC_REGISTER_VIRT |
2528              VMX_SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |
2529              VMX_SECONDARY_EXEC_RDRAND_EXITING,
2530         .xlevel = 0x80000008,
2531         .model_id = "Intel Xeon E3-12xx v2 (Ivy Bridge)",
2532         .versions = (X86CPUVersionDefinition[]) {
2533             { .version = 1 },
2534             {
2535                 .version = 2,
2536                 .alias = "IvyBridge-IBRS",
2537                 .props = (PropValue[]) {
2538                     { "spec-ctrl", "on" },
2539                     { "model-id",
2540                       "Intel Xeon E3-12xx v2 (Ivy Bridge, IBRS)" },
2541                     { /* end of list */ }
2542                 }
2543             },
2544             { /* end of list */ }
2545         }
2546     },
2547     {
2548         .name = "Haswell",
2549         .level = 0xd,
2550         .vendor = CPUID_VENDOR_INTEL,
2551         .family = 6,
2552         .model = 60,
2553         .stepping = 4,
2554         .features[FEAT_1_EDX] =
2555             CPUID_VME | CPUID_SSE2 | CPUID_SSE | CPUID_FXSR | CPUID_MMX |
2556             CPUID_CLFLUSH | CPUID_PSE36 | CPUID_PAT | CPUID_CMOV | CPUID_MCA |
2557             CPUID_PGE | CPUID_MTRR | CPUID_SEP | CPUID_APIC | CPUID_CX8 |
2558             CPUID_MCE | CPUID_PAE | CPUID_MSR | CPUID_TSC | CPUID_PSE |
2559             CPUID_DE | CPUID_FP87,
2560         .features[FEAT_1_ECX] =
2561             CPUID_EXT_AVX | CPUID_EXT_XSAVE | CPUID_EXT_AES |
2562             CPUID_EXT_POPCNT | CPUID_EXT_X2APIC | CPUID_EXT_SSE42 |
2563             CPUID_EXT_SSE41 | CPUID_EXT_CX16 | CPUID_EXT_SSSE3 |
2564             CPUID_EXT_PCLMULQDQ | CPUID_EXT_SSE3 |
2565             CPUID_EXT_TSC_DEADLINE_TIMER | CPUID_EXT_FMA | CPUID_EXT_MOVBE |
2566             CPUID_EXT_PCID | CPUID_EXT_F16C | CPUID_EXT_RDRAND,
2567         .features[FEAT_8000_0001_EDX] =
2568             CPUID_EXT2_LM | CPUID_EXT2_RDTSCP | CPUID_EXT2_NX |
2569             CPUID_EXT2_SYSCALL,
2570         .features[FEAT_8000_0001_ECX] =
2571             CPUID_EXT3_ABM | CPUID_EXT3_LAHF_LM,
2572         .features[FEAT_7_0_EBX] =
2573             CPUID_7_0_EBX_FSGSBASE | CPUID_7_0_EBX_BMI1 |
2574             CPUID_7_0_EBX_HLE | CPUID_7_0_EBX_AVX2 | CPUID_7_0_EBX_SMEP |
2575             CPUID_7_0_EBX_BMI2 | CPUID_7_0_EBX_ERMS | CPUID_7_0_EBX_INVPCID |
2576             CPUID_7_0_EBX_RTM,
2577         .features[FEAT_XSAVE] =
2578             CPUID_XSAVE_XSAVEOPT,
2579         .features[FEAT_6_EAX] =
2580             CPUID_6_EAX_ARAT,
2581         .features[FEAT_VMX_BASIC] = MSR_VMX_BASIC_INS_OUTS |
2582              MSR_VMX_BASIC_TRUE_CTLS,
2583         .features[FEAT_VMX_ENTRY_CTLS] = VMX_VM_ENTRY_IA32E_MODE |
2584              VMX_VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL | VMX_VM_ENTRY_LOAD_IA32_PAT |
2585              VMX_VM_ENTRY_LOAD_DEBUG_CONTROLS | VMX_VM_ENTRY_LOAD_IA32_EFER,
2586         .features[FEAT_VMX_EPT_VPID_CAPS] = MSR_VMX_EPT_EXECONLY |
2587              MSR_VMX_EPT_PAGE_WALK_LENGTH_4 | MSR_VMX_EPT_WB | MSR_VMX_EPT_2MB |
2588              MSR_VMX_EPT_1GB | MSR_VMX_EPT_INVEPT |
2589              MSR_VMX_EPT_INVEPT_SINGLE_CONTEXT | MSR_VMX_EPT_INVEPT_ALL_CONTEXT |
2590              MSR_VMX_EPT_INVVPID | MSR_VMX_EPT_INVVPID_SINGLE_ADDR |
2591              MSR_VMX_EPT_INVVPID_SINGLE_CONTEXT | MSR_VMX_EPT_INVVPID_ALL_CONTEXT |
2592              MSR_VMX_EPT_INVVPID_SINGLE_CONTEXT_NOGLOBALS | MSR_VMX_EPT_AD_BITS,
2593         .features[FEAT_VMX_EXIT_CTLS] =
2594              VMX_VM_EXIT_ACK_INTR_ON_EXIT | VMX_VM_EXIT_SAVE_DEBUG_CONTROLS |
2595              VMX_VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL |
2596              VMX_VM_EXIT_LOAD_IA32_PAT | VMX_VM_EXIT_LOAD_IA32_EFER |
2597              VMX_VM_EXIT_SAVE_IA32_PAT | VMX_VM_EXIT_SAVE_IA32_EFER |
2598              VMX_VM_EXIT_SAVE_VMX_PREEMPTION_TIMER,
2599         .features[FEAT_VMX_MISC] = MSR_VMX_MISC_ACTIVITY_HLT |
2600              MSR_VMX_MISC_STORE_LMA | MSR_VMX_MISC_VMWRITE_VMEXIT,
2601         .features[FEAT_VMX_PINBASED_CTLS] = VMX_PIN_BASED_EXT_INTR_MASK |
2602              VMX_PIN_BASED_NMI_EXITING | VMX_PIN_BASED_VIRTUAL_NMIS |
2603              VMX_PIN_BASED_VMX_PREEMPTION_TIMER | VMX_PIN_BASED_POSTED_INTR,
2604         .features[FEAT_VMX_PROCBASED_CTLS] = VMX_CPU_BASED_VIRTUAL_INTR_PENDING |
2605              VMX_CPU_BASED_USE_TSC_OFFSETING | VMX_CPU_BASED_HLT_EXITING |
2606              VMX_CPU_BASED_INVLPG_EXITING | VMX_CPU_BASED_MWAIT_EXITING |
2607              VMX_CPU_BASED_RDPMC_EXITING | VMX_CPU_BASED_RDTSC_EXITING |
2608              VMX_CPU_BASED_CR8_LOAD_EXITING | VMX_CPU_BASED_CR8_STORE_EXITING |
2609              VMX_CPU_BASED_TPR_SHADOW | VMX_CPU_BASED_MOV_DR_EXITING |
2610              VMX_CPU_BASED_UNCOND_IO_EXITING | VMX_CPU_BASED_USE_IO_BITMAPS |
2611              VMX_CPU_BASED_MONITOR_EXITING | VMX_CPU_BASED_PAUSE_EXITING |
2612              VMX_CPU_BASED_VIRTUAL_NMI_PENDING | VMX_CPU_BASED_USE_MSR_BITMAPS |
2613              VMX_CPU_BASED_CR3_LOAD_EXITING | VMX_CPU_BASED_CR3_STORE_EXITING |
2614              VMX_CPU_BASED_MONITOR_TRAP_FLAG |
2615              VMX_CPU_BASED_ACTIVATE_SECONDARY_CONTROLS,
2616         .features[FEAT_VMX_SECONDARY_CTLS] =
2617              VMX_SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
2618              VMX_SECONDARY_EXEC_WBINVD_EXITING | VMX_SECONDARY_EXEC_ENABLE_EPT |
2619              VMX_SECONDARY_EXEC_DESC | VMX_SECONDARY_EXEC_RDTSCP |
2620              VMX_SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |
2621              VMX_SECONDARY_EXEC_ENABLE_VPID | VMX_SECONDARY_EXEC_UNRESTRICTED_GUEST |
2622              VMX_SECONDARY_EXEC_APIC_REGISTER_VIRT |
2623              VMX_SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |
2624              VMX_SECONDARY_EXEC_RDRAND_EXITING | VMX_SECONDARY_EXEC_ENABLE_INVPCID |
2625              VMX_SECONDARY_EXEC_ENABLE_VMFUNC | VMX_SECONDARY_EXEC_SHADOW_VMCS,
2626         .features[FEAT_VMX_VMFUNC] = MSR_VMX_VMFUNC_EPT_SWITCHING,
2627         .xlevel = 0x80000008,
2628         .model_id = "Intel Core Processor (Haswell)",
2629         .versions = (X86CPUVersionDefinition[]) {
2630             { .version = 1 },
2631             {
2632                 .version = 2,
2633                 .alias = "Haswell-noTSX",
2634                 .props = (PropValue[]) {
2635                     { "hle", "off" },
2636                     { "rtm", "off" },
2637                     { "stepping", "1" },
2638                     { "model-id", "Intel Core Processor (Haswell, no TSX)", },
2639                     { /* end of list */ }
2640                 },
2641             },
2642             {
2643                 .version = 3,
2644                 .alias = "Haswell-IBRS",
2645                 .props = (PropValue[]) {
2646                     /* Restore TSX features removed by -v2 above */
2647                     { "hle", "on" },
2648                     { "rtm", "on" },
2649                     /*
2650                      * Haswell and Haswell-IBRS had stepping=4 in
2651                      * QEMU 4.0 and older
2652                      */
2653                     { "stepping", "4" },
2654                     { "spec-ctrl", "on" },
2655                     { "model-id",
2656                       "Intel Core Processor (Haswell, IBRS)" },
2657                     { /* end of list */ }
2658                 }
2659             },
2660             {
2661                 .version = 4,
2662                 .alias = "Haswell-noTSX-IBRS",
2663                 .props = (PropValue[]) {
2664                     { "hle", "off" },
2665                     { "rtm", "off" },
2666                     /* spec-ctrl was already enabled by -v3 above */
2667                     { "stepping", "1" },
2668                     { "model-id",
2669                       "Intel Core Processor (Haswell, no TSX, IBRS)" },
2670                     { /* end of list */ }
2671                 }
2672             },
2673             { /* end of list */ }
2674         }
2675     },
2676     {
2677         .name = "Broadwell",
2678         .level = 0xd,
2679         .vendor = CPUID_VENDOR_INTEL,
2680         .family = 6,
2681         .model = 61,
2682         .stepping = 2,
2683         .features[FEAT_1_EDX] =
2684             CPUID_VME | CPUID_SSE2 | CPUID_SSE | CPUID_FXSR | CPUID_MMX |
2685             CPUID_CLFLUSH | CPUID_PSE36 | CPUID_PAT | CPUID_CMOV | CPUID_MCA |
2686             CPUID_PGE | CPUID_MTRR | CPUID_SEP | CPUID_APIC | CPUID_CX8 |
2687             CPUID_MCE | CPUID_PAE | CPUID_MSR | CPUID_TSC | CPUID_PSE |
2688             CPUID_DE | CPUID_FP87,
2689         .features[FEAT_1_ECX] =
2690             CPUID_EXT_AVX | CPUID_EXT_XSAVE | CPUID_EXT_AES |
2691             CPUID_EXT_POPCNT | CPUID_EXT_X2APIC | CPUID_EXT_SSE42 |
2692             CPUID_EXT_SSE41 | CPUID_EXT_CX16 | CPUID_EXT_SSSE3 |
2693             CPUID_EXT_PCLMULQDQ | CPUID_EXT_SSE3 |
2694             CPUID_EXT_TSC_DEADLINE_TIMER | CPUID_EXT_FMA | CPUID_EXT_MOVBE |
2695             CPUID_EXT_PCID | CPUID_EXT_F16C | CPUID_EXT_RDRAND,
2696         .features[FEAT_8000_0001_EDX] =
2697             CPUID_EXT2_LM | CPUID_EXT2_RDTSCP | CPUID_EXT2_NX |
2698             CPUID_EXT2_SYSCALL,
2699         .features[FEAT_8000_0001_ECX] =
2700             CPUID_EXT3_ABM | CPUID_EXT3_LAHF_LM | CPUID_EXT3_3DNOWPREFETCH,
2701         .features[FEAT_7_0_EBX] =
2702             CPUID_7_0_EBX_FSGSBASE | CPUID_7_0_EBX_BMI1 |
2703             CPUID_7_0_EBX_HLE | CPUID_7_0_EBX_AVX2 | CPUID_7_0_EBX_SMEP |
2704             CPUID_7_0_EBX_BMI2 | CPUID_7_0_EBX_ERMS | CPUID_7_0_EBX_INVPCID |
2705             CPUID_7_0_EBX_RTM | CPUID_7_0_EBX_RDSEED | CPUID_7_0_EBX_ADX |
2706             CPUID_7_0_EBX_SMAP,
2707         .features[FEAT_XSAVE] =
2708             CPUID_XSAVE_XSAVEOPT,
2709         .features[FEAT_6_EAX] =
2710             CPUID_6_EAX_ARAT,
2711         .features[FEAT_VMX_BASIC] = MSR_VMX_BASIC_INS_OUTS |
2712              MSR_VMX_BASIC_TRUE_CTLS,
2713         .features[FEAT_VMX_ENTRY_CTLS] = VMX_VM_ENTRY_IA32E_MODE |
2714              VMX_VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL | VMX_VM_ENTRY_LOAD_IA32_PAT |
2715              VMX_VM_ENTRY_LOAD_DEBUG_CONTROLS | VMX_VM_ENTRY_LOAD_IA32_EFER,
2716         .features[FEAT_VMX_EPT_VPID_CAPS] = MSR_VMX_EPT_EXECONLY |
2717              MSR_VMX_EPT_PAGE_WALK_LENGTH_4 | MSR_VMX_EPT_WB | MSR_VMX_EPT_2MB |
2718              MSR_VMX_EPT_1GB | MSR_VMX_EPT_INVEPT |
2719              MSR_VMX_EPT_INVEPT_SINGLE_CONTEXT | MSR_VMX_EPT_INVEPT_ALL_CONTEXT |
2720              MSR_VMX_EPT_INVVPID | MSR_VMX_EPT_INVVPID_SINGLE_ADDR |
2721              MSR_VMX_EPT_INVVPID_SINGLE_CONTEXT | MSR_VMX_EPT_INVVPID_ALL_CONTEXT |
2722              MSR_VMX_EPT_INVVPID_SINGLE_CONTEXT_NOGLOBALS | MSR_VMX_EPT_AD_BITS,
2723         .features[FEAT_VMX_EXIT_CTLS] =
2724              VMX_VM_EXIT_ACK_INTR_ON_EXIT | VMX_VM_EXIT_SAVE_DEBUG_CONTROLS |
2725              VMX_VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL |
2726              VMX_VM_EXIT_LOAD_IA32_PAT | VMX_VM_EXIT_LOAD_IA32_EFER |
2727              VMX_VM_EXIT_SAVE_IA32_PAT | VMX_VM_EXIT_SAVE_IA32_EFER |
2728              VMX_VM_EXIT_SAVE_VMX_PREEMPTION_TIMER,
2729         .features[FEAT_VMX_MISC] = MSR_VMX_MISC_ACTIVITY_HLT |
2730              MSR_VMX_MISC_STORE_LMA | MSR_VMX_MISC_VMWRITE_VMEXIT,
2731         .features[FEAT_VMX_PINBASED_CTLS] = VMX_PIN_BASED_EXT_INTR_MASK |
2732              VMX_PIN_BASED_NMI_EXITING | VMX_PIN_BASED_VIRTUAL_NMIS |
2733              VMX_PIN_BASED_VMX_PREEMPTION_TIMER | VMX_PIN_BASED_POSTED_INTR,
2734         .features[FEAT_VMX_PROCBASED_CTLS] = VMX_CPU_BASED_VIRTUAL_INTR_PENDING |
2735              VMX_CPU_BASED_USE_TSC_OFFSETING | VMX_CPU_BASED_HLT_EXITING |
2736              VMX_CPU_BASED_INVLPG_EXITING | VMX_CPU_BASED_MWAIT_EXITING |
2737              VMX_CPU_BASED_RDPMC_EXITING | VMX_CPU_BASED_RDTSC_EXITING |
2738              VMX_CPU_BASED_CR8_LOAD_EXITING | VMX_CPU_BASED_CR8_STORE_EXITING |
2739              VMX_CPU_BASED_TPR_SHADOW | VMX_CPU_BASED_MOV_DR_EXITING |
2740              VMX_CPU_BASED_UNCOND_IO_EXITING | VMX_CPU_BASED_USE_IO_BITMAPS |
2741              VMX_CPU_BASED_MONITOR_EXITING | VMX_CPU_BASED_PAUSE_EXITING |
2742              VMX_CPU_BASED_VIRTUAL_NMI_PENDING | VMX_CPU_BASED_USE_MSR_BITMAPS |
2743              VMX_CPU_BASED_CR3_LOAD_EXITING | VMX_CPU_BASED_CR3_STORE_EXITING |
2744              VMX_CPU_BASED_MONITOR_TRAP_FLAG |
2745              VMX_CPU_BASED_ACTIVATE_SECONDARY_CONTROLS,
2746         .features[FEAT_VMX_SECONDARY_CTLS] =
2747              VMX_SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
2748              VMX_SECONDARY_EXEC_WBINVD_EXITING | VMX_SECONDARY_EXEC_ENABLE_EPT |
2749              VMX_SECONDARY_EXEC_DESC | VMX_SECONDARY_EXEC_RDTSCP |
2750              VMX_SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |
2751              VMX_SECONDARY_EXEC_ENABLE_VPID | VMX_SECONDARY_EXEC_UNRESTRICTED_GUEST |
2752              VMX_SECONDARY_EXEC_APIC_REGISTER_VIRT |
2753              VMX_SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |
2754              VMX_SECONDARY_EXEC_RDRAND_EXITING | VMX_SECONDARY_EXEC_ENABLE_INVPCID |
2755              VMX_SECONDARY_EXEC_ENABLE_VMFUNC | VMX_SECONDARY_EXEC_SHADOW_VMCS |
2756              VMX_SECONDARY_EXEC_RDSEED_EXITING | VMX_SECONDARY_EXEC_ENABLE_PML,
2757         .features[FEAT_VMX_VMFUNC] = MSR_VMX_VMFUNC_EPT_SWITCHING,
2758         .xlevel = 0x80000008,
2759         .model_id = "Intel Core Processor (Broadwell)",
2760         .versions = (X86CPUVersionDefinition[]) {
2761             { .version = 1 },
2762             {
2763                 .version = 2,
2764                 .alias = "Broadwell-noTSX",
2765                 .props = (PropValue[]) {
2766                     { "hle", "off" },
2767                     { "rtm", "off" },
2768                     { "model-id", "Intel Core Processor (Broadwell, no TSX)", },
2769                     { /* end of list */ }
2770                 },
2771             },
2772             {
2773                 .version = 3,
2774                 .alias = "Broadwell-IBRS",
2775                 .props = (PropValue[]) {
2776                     /* Restore TSX features removed by -v2 above */
2777                     { "hle", "on" },
2778                     { "rtm", "on" },
2779                     { "spec-ctrl", "on" },
2780                     { "model-id",
2781                       "Intel Core Processor (Broadwell, IBRS)" },
2782                     { /* end of list */ }
2783                 }
2784             },
2785             {
2786                 .version = 4,
2787                 .alias = "Broadwell-noTSX-IBRS",
2788                 .props = (PropValue[]) {
2789                     { "hle", "off" },
2790                     { "rtm", "off" },
2791                     /* spec-ctrl was already enabled by -v3 above */
2792                     { "model-id",
2793                       "Intel Core Processor (Broadwell, no TSX, IBRS)" },
2794                     { /* end of list */ }
2795                 }
2796             },
2797             { /* end of list */ }
2798         }
2799     },
2800     {
2801         .name = "Skylake-Client",
2802         .level = 0xd,
2803         .vendor = CPUID_VENDOR_INTEL,
2804         .family = 6,
2805         .model = 94,
2806         .stepping = 3,
2807         .features[FEAT_1_EDX] =
2808             CPUID_VME | CPUID_SSE2 | CPUID_SSE | CPUID_FXSR | CPUID_MMX |
2809             CPUID_CLFLUSH | CPUID_PSE36 | CPUID_PAT | CPUID_CMOV | CPUID_MCA |
2810             CPUID_PGE | CPUID_MTRR | CPUID_SEP | CPUID_APIC | CPUID_CX8 |
2811             CPUID_MCE | CPUID_PAE | CPUID_MSR | CPUID_TSC | CPUID_PSE |
2812             CPUID_DE | CPUID_FP87,
2813         .features[FEAT_1_ECX] =
2814             CPUID_EXT_AVX | CPUID_EXT_XSAVE | CPUID_EXT_AES |
2815             CPUID_EXT_POPCNT | CPUID_EXT_X2APIC | CPUID_EXT_SSE42 |
2816             CPUID_EXT_SSE41 | CPUID_EXT_CX16 | CPUID_EXT_SSSE3 |
2817             CPUID_EXT_PCLMULQDQ | CPUID_EXT_SSE3 |
2818             CPUID_EXT_TSC_DEADLINE_TIMER | CPUID_EXT_FMA | CPUID_EXT_MOVBE |
2819             CPUID_EXT_PCID | CPUID_EXT_F16C | CPUID_EXT_RDRAND,
2820         .features[FEAT_8000_0001_EDX] =
2821             CPUID_EXT2_LM | CPUID_EXT2_RDTSCP | CPUID_EXT2_NX |
2822             CPUID_EXT2_SYSCALL,
2823         .features[FEAT_8000_0001_ECX] =
2824             CPUID_EXT3_ABM | CPUID_EXT3_LAHF_LM | CPUID_EXT3_3DNOWPREFETCH,
2825         .features[FEAT_7_0_EBX] =
2826             CPUID_7_0_EBX_FSGSBASE | CPUID_7_0_EBX_BMI1 |
2827             CPUID_7_0_EBX_HLE | CPUID_7_0_EBX_AVX2 | CPUID_7_0_EBX_SMEP |
2828             CPUID_7_0_EBX_BMI2 | CPUID_7_0_EBX_ERMS | CPUID_7_0_EBX_INVPCID |
2829             CPUID_7_0_EBX_RTM | CPUID_7_0_EBX_RDSEED | CPUID_7_0_EBX_ADX |
2830             CPUID_7_0_EBX_SMAP,
2831         /* Missing: XSAVES (not supported by some Linux versions,
2832          * including v4.1 to v4.12).
2833          * KVM doesn't yet expose any XSAVES state save component,
2834          * and the only one defined in Skylake (processor tracing)
2835          * probably will block migration anyway.
2836          */
2837         .features[FEAT_XSAVE] =
2838             CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC |
2839             CPUID_XSAVE_XGETBV1,
2840         .features[FEAT_6_EAX] =
2841             CPUID_6_EAX_ARAT,
2842         /* Missing: Mode-based execute control (XS/XU), processor tracing, TSC scaling */
2843         .features[FEAT_VMX_BASIC] = MSR_VMX_BASIC_INS_OUTS |
2844              MSR_VMX_BASIC_TRUE_CTLS,
2845         .features[FEAT_VMX_ENTRY_CTLS] = VMX_VM_ENTRY_IA32E_MODE |
2846              VMX_VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL | VMX_VM_ENTRY_LOAD_IA32_PAT |
2847              VMX_VM_ENTRY_LOAD_DEBUG_CONTROLS | VMX_VM_ENTRY_LOAD_IA32_EFER,
2848         .features[FEAT_VMX_EPT_VPID_CAPS] = MSR_VMX_EPT_EXECONLY |
2849              MSR_VMX_EPT_PAGE_WALK_LENGTH_4 | MSR_VMX_EPT_WB | MSR_VMX_EPT_2MB |
2850              MSR_VMX_EPT_1GB | MSR_VMX_EPT_INVEPT |
2851              MSR_VMX_EPT_INVEPT_SINGLE_CONTEXT | MSR_VMX_EPT_INVEPT_ALL_CONTEXT |
2852              MSR_VMX_EPT_INVVPID | MSR_VMX_EPT_INVVPID_SINGLE_ADDR |
2853              MSR_VMX_EPT_INVVPID_SINGLE_CONTEXT | MSR_VMX_EPT_INVVPID_ALL_CONTEXT |
2854              MSR_VMX_EPT_INVVPID_SINGLE_CONTEXT_NOGLOBALS | MSR_VMX_EPT_AD_BITS,
2855         .features[FEAT_VMX_EXIT_CTLS] =
2856              VMX_VM_EXIT_ACK_INTR_ON_EXIT | VMX_VM_EXIT_SAVE_DEBUG_CONTROLS |
2857              VMX_VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL |
2858              VMX_VM_EXIT_LOAD_IA32_PAT | VMX_VM_EXIT_LOAD_IA32_EFER |
2859              VMX_VM_EXIT_SAVE_IA32_PAT | VMX_VM_EXIT_SAVE_IA32_EFER |
2860              VMX_VM_EXIT_SAVE_VMX_PREEMPTION_TIMER,
2861         .features[FEAT_VMX_MISC] = MSR_VMX_MISC_ACTIVITY_HLT |
2862              MSR_VMX_MISC_STORE_LMA | MSR_VMX_MISC_VMWRITE_VMEXIT,
2863         .features[FEAT_VMX_PINBASED_CTLS] = VMX_PIN_BASED_EXT_INTR_MASK |
2864              VMX_PIN_BASED_NMI_EXITING | VMX_PIN_BASED_VIRTUAL_NMIS |
2865              VMX_PIN_BASED_VMX_PREEMPTION_TIMER,
2866         .features[FEAT_VMX_PROCBASED_CTLS] = VMX_CPU_BASED_VIRTUAL_INTR_PENDING |
2867              VMX_CPU_BASED_USE_TSC_OFFSETING | VMX_CPU_BASED_HLT_EXITING |
2868              VMX_CPU_BASED_INVLPG_EXITING | VMX_CPU_BASED_MWAIT_EXITING |
2869              VMX_CPU_BASED_RDPMC_EXITING | VMX_CPU_BASED_RDTSC_EXITING |
2870              VMX_CPU_BASED_CR8_LOAD_EXITING | VMX_CPU_BASED_CR8_STORE_EXITING |
2871              VMX_CPU_BASED_TPR_SHADOW | VMX_CPU_BASED_MOV_DR_EXITING |
2872              VMX_CPU_BASED_UNCOND_IO_EXITING | VMX_CPU_BASED_USE_IO_BITMAPS |
2873              VMX_CPU_BASED_MONITOR_EXITING | VMX_CPU_BASED_PAUSE_EXITING |
2874              VMX_CPU_BASED_VIRTUAL_NMI_PENDING | VMX_CPU_BASED_USE_MSR_BITMAPS |
2875              VMX_CPU_BASED_CR3_LOAD_EXITING | VMX_CPU_BASED_CR3_STORE_EXITING |
2876              VMX_CPU_BASED_MONITOR_TRAP_FLAG |
2877              VMX_CPU_BASED_ACTIVATE_SECONDARY_CONTROLS,
2878         .features[FEAT_VMX_SECONDARY_CTLS] =
2879              VMX_SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
2880              VMX_SECONDARY_EXEC_WBINVD_EXITING | VMX_SECONDARY_EXEC_ENABLE_EPT |
2881              VMX_SECONDARY_EXEC_DESC | VMX_SECONDARY_EXEC_RDTSCP |
2882              VMX_SECONDARY_EXEC_ENABLE_VPID | VMX_SECONDARY_EXEC_UNRESTRICTED_GUEST |
2883              VMX_SECONDARY_EXEC_RDRAND_EXITING | VMX_SECONDARY_EXEC_ENABLE_INVPCID |
2884              VMX_SECONDARY_EXEC_ENABLE_VMFUNC | VMX_SECONDARY_EXEC_SHADOW_VMCS |
2885              VMX_SECONDARY_EXEC_RDSEED_EXITING | VMX_SECONDARY_EXEC_ENABLE_PML,
2886         .features[FEAT_VMX_VMFUNC] = MSR_VMX_VMFUNC_EPT_SWITCHING,
2887         .xlevel = 0x80000008,
2888         .model_id = "Intel Core Processor (Skylake)",
2889         .versions = (X86CPUVersionDefinition[]) {
2890             { .version = 1 },
2891             {
2892                 .version = 2,
2893                 .alias = "Skylake-Client-IBRS",
2894                 .props = (PropValue[]) {
2895                     { "spec-ctrl", "on" },
2896                     { "model-id",
2897                       "Intel Core Processor (Skylake, IBRS)" },
2898                     { /* end of list */ }
2899                 }
2900             },
2901             {
2902                 .version = 3,
2903                 .alias = "Skylake-Client-noTSX-IBRS",
2904                 .props = (PropValue[]) {
2905                     { "hle", "off" },
2906                     { "rtm", "off" },
2907                     { "model-id",
2908                       "Intel Core Processor (Skylake, IBRS, no TSX)" },
2909                     { /* end of list */ }
2910                 }
2911             },
2912             { /* end of list */ }
2913         }
2914     },
2915     {
2916         .name = "Skylake-Server",
2917         .level = 0xd,
2918         .vendor = CPUID_VENDOR_INTEL,
2919         .family = 6,
2920         .model = 85,
2921         .stepping = 4,
2922         .features[FEAT_1_EDX] =
2923             CPUID_VME | CPUID_SSE2 | CPUID_SSE | CPUID_FXSR | CPUID_MMX |
2924             CPUID_CLFLUSH | CPUID_PSE36 | CPUID_PAT | CPUID_CMOV | CPUID_MCA |
2925             CPUID_PGE | CPUID_MTRR | CPUID_SEP | CPUID_APIC | CPUID_CX8 |
2926             CPUID_MCE | CPUID_PAE | CPUID_MSR | CPUID_TSC | CPUID_PSE |
2927             CPUID_DE | CPUID_FP87,
2928         .features[FEAT_1_ECX] =
2929             CPUID_EXT_AVX | CPUID_EXT_XSAVE | CPUID_EXT_AES |
2930             CPUID_EXT_POPCNT | CPUID_EXT_X2APIC | CPUID_EXT_SSE42 |
2931             CPUID_EXT_SSE41 | CPUID_EXT_CX16 | CPUID_EXT_SSSE3 |
2932             CPUID_EXT_PCLMULQDQ | CPUID_EXT_SSE3 |
2933             CPUID_EXT_TSC_DEADLINE_TIMER | CPUID_EXT_FMA | CPUID_EXT_MOVBE |
2934             CPUID_EXT_PCID | CPUID_EXT_F16C | CPUID_EXT_RDRAND,
2935         .features[FEAT_8000_0001_EDX] =
2936             CPUID_EXT2_LM | CPUID_EXT2_PDPE1GB | CPUID_EXT2_RDTSCP |
2937             CPUID_EXT2_NX | CPUID_EXT2_SYSCALL,
2938         .features[FEAT_8000_0001_ECX] =
2939             CPUID_EXT3_ABM | CPUID_EXT3_LAHF_LM | CPUID_EXT3_3DNOWPREFETCH,
2940         .features[FEAT_7_0_EBX] =
2941             CPUID_7_0_EBX_FSGSBASE | CPUID_7_0_EBX_BMI1 |
2942             CPUID_7_0_EBX_HLE | CPUID_7_0_EBX_AVX2 | CPUID_7_0_EBX_SMEP |
2943             CPUID_7_0_EBX_BMI2 | CPUID_7_0_EBX_ERMS | CPUID_7_0_EBX_INVPCID |
2944             CPUID_7_0_EBX_RTM | CPUID_7_0_EBX_RDSEED | CPUID_7_0_EBX_ADX |
2945             CPUID_7_0_EBX_SMAP | CPUID_7_0_EBX_CLWB |
2946             CPUID_7_0_EBX_AVX512F | CPUID_7_0_EBX_AVX512DQ |
2947             CPUID_7_0_EBX_AVX512BW | CPUID_7_0_EBX_AVX512CD |
2948             CPUID_7_0_EBX_AVX512VL | CPUID_7_0_EBX_CLFLUSHOPT,
2949         .features[FEAT_7_0_ECX] =
2950             CPUID_7_0_ECX_PKU,
2951         /* Missing: XSAVES (not supported by some Linux versions,
2952          * including v4.1 to v4.12).
2953          * KVM doesn't yet expose any XSAVES state save component,
2954          * and the only one defined in Skylake (processor tracing)
2955          * probably will block migration anyway.
2956          */
2957         .features[FEAT_XSAVE] =
2958             CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC |
2959             CPUID_XSAVE_XGETBV1,
2960         .features[FEAT_6_EAX] =
2961             CPUID_6_EAX_ARAT,
2962         /* Missing: Mode-based execute control (XS/XU), processor tracing, TSC scaling */
2963         .features[FEAT_VMX_BASIC] = MSR_VMX_BASIC_INS_OUTS |
2964              MSR_VMX_BASIC_TRUE_CTLS,
2965         .features[FEAT_VMX_ENTRY_CTLS] = VMX_VM_ENTRY_IA32E_MODE |
2966              VMX_VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL | VMX_VM_ENTRY_LOAD_IA32_PAT |
2967              VMX_VM_ENTRY_LOAD_DEBUG_CONTROLS | VMX_VM_ENTRY_LOAD_IA32_EFER,
2968         .features[FEAT_VMX_EPT_VPID_CAPS] = MSR_VMX_EPT_EXECONLY |
2969              MSR_VMX_EPT_PAGE_WALK_LENGTH_4 | MSR_VMX_EPT_WB | MSR_VMX_EPT_2MB |
2970              MSR_VMX_EPT_1GB | MSR_VMX_EPT_INVEPT |
2971              MSR_VMX_EPT_INVEPT_SINGLE_CONTEXT | MSR_VMX_EPT_INVEPT_ALL_CONTEXT |
2972              MSR_VMX_EPT_INVVPID | MSR_VMX_EPT_INVVPID_SINGLE_ADDR |
2973              MSR_VMX_EPT_INVVPID_SINGLE_CONTEXT | MSR_VMX_EPT_INVVPID_ALL_CONTEXT |
2974              MSR_VMX_EPT_INVVPID_SINGLE_CONTEXT_NOGLOBALS | MSR_VMX_EPT_AD_BITS,
2975         .features[FEAT_VMX_EXIT_CTLS] =
2976              VMX_VM_EXIT_ACK_INTR_ON_EXIT | VMX_VM_EXIT_SAVE_DEBUG_CONTROLS |
2977              VMX_VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL |
2978              VMX_VM_EXIT_LOAD_IA32_PAT | VMX_VM_EXIT_LOAD_IA32_EFER |
2979              VMX_VM_EXIT_SAVE_IA32_PAT | VMX_VM_EXIT_SAVE_IA32_EFER |
2980              VMX_VM_EXIT_SAVE_VMX_PREEMPTION_TIMER,
2981         .features[FEAT_VMX_MISC] = MSR_VMX_MISC_ACTIVITY_HLT |
2982              MSR_VMX_MISC_STORE_LMA | MSR_VMX_MISC_VMWRITE_VMEXIT,
2983         .features[FEAT_VMX_PINBASED_CTLS] = VMX_PIN_BASED_EXT_INTR_MASK |
2984              VMX_PIN_BASED_NMI_EXITING | VMX_PIN_BASED_VIRTUAL_NMIS |
2985              VMX_PIN_BASED_VMX_PREEMPTION_TIMER | VMX_PIN_BASED_POSTED_INTR,
2986         .features[FEAT_VMX_PROCBASED_CTLS] = VMX_CPU_BASED_VIRTUAL_INTR_PENDING |
2987              VMX_CPU_BASED_USE_TSC_OFFSETING | VMX_CPU_BASED_HLT_EXITING |
2988              VMX_CPU_BASED_INVLPG_EXITING | VMX_CPU_BASED_MWAIT_EXITING |
2989              VMX_CPU_BASED_RDPMC_EXITING | VMX_CPU_BASED_RDTSC_EXITING |
2990              VMX_CPU_BASED_CR8_LOAD_EXITING | VMX_CPU_BASED_CR8_STORE_EXITING |
2991              VMX_CPU_BASED_TPR_SHADOW | VMX_CPU_BASED_MOV_DR_EXITING |
2992              VMX_CPU_BASED_UNCOND_IO_EXITING | VMX_CPU_BASED_USE_IO_BITMAPS |
2993              VMX_CPU_BASED_MONITOR_EXITING | VMX_CPU_BASED_PAUSE_EXITING |
2994              VMX_CPU_BASED_VIRTUAL_NMI_PENDING | VMX_CPU_BASED_USE_MSR_BITMAPS |
2995              VMX_CPU_BASED_CR3_LOAD_EXITING | VMX_CPU_BASED_CR3_STORE_EXITING |
2996              VMX_CPU_BASED_MONITOR_TRAP_FLAG |
2997              VMX_CPU_BASED_ACTIVATE_SECONDARY_CONTROLS,
2998         .features[FEAT_VMX_SECONDARY_CTLS] =
2999              VMX_SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
3000              VMX_SECONDARY_EXEC_WBINVD_EXITING | VMX_SECONDARY_EXEC_ENABLE_EPT |
3001              VMX_SECONDARY_EXEC_DESC | VMX_SECONDARY_EXEC_RDTSCP |
3002              VMX_SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |
3003              VMX_SECONDARY_EXEC_ENABLE_VPID | VMX_SECONDARY_EXEC_UNRESTRICTED_GUEST |
3004              VMX_SECONDARY_EXEC_APIC_REGISTER_VIRT |
3005              VMX_SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |
3006              VMX_SECONDARY_EXEC_RDRAND_EXITING | VMX_SECONDARY_EXEC_ENABLE_INVPCID |
3007              VMX_SECONDARY_EXEC_ENABLE_VMFUNC | VMX_SECONDARY_EXEC_SHADOW_VMCS |
3008              VMX_SECONDARY_EXEC_RDSEED_EXITING | VMX_SECONDARY_EXEC_ENABLE_PML,
3009         .xlevel = 0x80000008,
3010         .model_id = "Intel Xeon Processor (Skylake)",
3011         .versions = (X86CPUVersionDefinition[]) {
3012             { .version = 1 },
3013             {
3014                 .version = 2,
3015                 .alias = "Skylake-Server-IBRS",
3016                 .props = (PropValue[]) {
3017                     /* clflushopt was not added to Skylake-Server-IBRS */
3018                     /* TODO: add -v3 including clflushopt */
3019                     { "clflushopt", "off" },
3020                     { "spec-ctrl", "on" },
3021                     { "model-id",
3022                       "Intel Xeon Processor (Skylake, IBRS)" },
3023                     { /* end of list */ }
3024                 }
3025             },
3026             {
3027                 .version = 3,
3028                 .alias = "Skylake-Server-noTSX-IBRS",
3029                 .props = (PropValue[]) {
3030                     { "hle", "off" },
3031                     { "rtm", "off" },
3032                     { "model-id",
3033                       "Intel Xeon Processor (Skylake, IBRS, no TSX)" },
3034                     { /* end of list */ }
3035                 }
3036             },
3037             {
3038                 .version = 4,
3039                 .props = (PropValue[]) {
3040                     { "vmx-eptp-switching", "on" },
3041                     { /* end of list */ }
3042                 }
3043             },
3044             { /* end of list */ }
3045         }
3046     },
3047     {
3048         .name = "Cascadelake-Server",
3049         .level = 0xd,
3050         .vendor = CPUID_VENDOR_INTEL,
3051         .family = 6,
3052         .model = 85,
3053         .stepping = 6,
3054         .features[FEAT_1_EDX] =
3055             CPUID_VME | CPUID_SSE2 | CPUID_SSE | CPUID_FXSR | CPUID_MMX |
3056             CPUID_CLFLUSH | CPUID_PSE36 | CPUID_PAT | CPUID_CMOV | CPUID_MCA |
3057             CPUID_PGE | CPUID_MTRR | CPUID_SEP | CPUID_APIC | CPUID_CX8 |
3058             CPUID_MCE | CPUID_PAE | CPUID_MSR | CPUID_TSC | CPUID_PSE |
3059             CPUID_DE | CPUID_FP87,
3060         .features[FEAT_1_ECX] =
3061             CPUID_EXT_AVX | CPUID_EXT_XSAVE | CPUID_EXT_AES |
3062             CPUID_EXT_POPCNT | CPUID_EXT_X2APIC | CPUID_EXT_SSE42 |
3063             CPUID_EXT_SSE41 | CPUID_EXT_CX16 | CPUID_EXT_SSSE3 |
3064             CPUID_EXT_PCLMULQDQ | CPUID_EXT_SSE3 |
3065             CPUID_EXT_TSC_DEADLINE_TIMER | CPUID_EXT_FMA | CPUID_EXT_MOVBE |
3066             CPUID_EXT_PCID | CPUID_EXT_F16C | CPUID_EXT_RDRAND,
3067         .features[FEAT_8000_0001_EDX] =
3068             CPUID_EXT2_LM | CPUID_EXT2_PDPE1GB | CPUID_EXT2_RDTSCP |
3069             CPUID_EXT2_NX | CPUID_EXT2_SYSCALL,
3070         .features[FEAT_8000_0001_ECX] =
3071             CPUID_EXT3_ABM | CPUID_EXT3_LAHF_LM | CPUID_EXT3_3DNOWPREFETCH,
3072         .features[FEAT_7_0_EBX] =
3073             CPUID_7_0_EBX_FSGSBASE | CPUID_7_0_EBX_BMI1 |
3074             CPUID_7_0_EBX_HLE | CPUID_7_0_EBX_AVX2 | CPUID_7_0_EBX_SMEP |
3075             CPUID_7_0_EBX_BMI2 | CPUID_7_0_EBX_ERMS | CPUID_7_0_EBX_INVPCID |
3076             CPUID_7_0_EBX_RTM | CPUID_7_0_EBX_RDSEED | CPUID_7_0_EBX_ADX |
3077             CPUID_7_0_EBX_SMAP | CPUID_7_0_EBX_CLWB |
3078             CPUID_7_0_EBX_AVX512F | CPUID_7_0_EBX_AVX512DQ |
3079             CPUID_7_0_EBX_AVX512BW | CPUID_7_0_EBX_AVX512CD |
3080             CPUID_7_0_EBX_AVX512VL | CPUID_7_0_EBX_CLFLUSHOPT,
3081         .features[FEAT_7_0_ECX] =
3082             CPUID_7_0_ECX_PKU |
3083             CPUID_7_0_ECX_AVX512VNNI,
3084         .features[FEAT_7_0_EDX] =
3085             CPUID_7_0_EDX_SPEC_CTRL | CPUID_7_0_EDX_SPEC_CTRL_SSBD,
3086         /* Missing: XSAVES (not supported by some Linux versions,
3087                 * including v4.1 to v4.12).
3088                 * KVM doesn't yet expose any XSAVES state save component,
3089                 * and the only one defined in Skylake (processor tracing)
3090                 * probably will block migration anyway.
3091                 */
3092         .features[FEAT_XSAVE] =
3093             CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC |
3094             CPUID_XSAVE_XGETBV1,
3095         .features[FEAT_6_EAX] =
3096             CPUID_6_EAX_ARAT,
3097         /* Missing: Mode-based execute control (XS/XU), processor tracing, TSC scaling */
3098         .features[FEAT_VMX_BASIC] = MSR_VMX_BASIC_INS_OUTS |
3099              MSR_VMX_BASIC_TRUE_CTLS,
3100         .features[FEAT_VMX_ENTRY_CTLS] = VMX_VM_ENTRY_IA32E_MODE |
3101              VMX_VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL | VMX_VM_ENTRY_LOAD_IA32_PAT |
3102              VMX_VM_ENTRY_LOAD_DEBUG_CONTROLS | VMX_VM_ENTRY_LOAD_IA32_EFER,
3103         .features[FEAT_VMX_EPT_VPID_CAPS] = MSR_VMX_EPT_EXECONLY |
3104              MSR_VMX_EPT_PAGE_WALK_LENGTH_4 | MSR_VMX_EPT_WB | MSR_VMX_EPT_2MB |
3105              MSR_VMX_EPT_1GB | MSR_VMX_EPT_INVEPT |
3106              MSR_VMX_EPT_INVEPT_SINGLE_CONTEXT | MSR_VMX_EPT_INVEPT_ALL_CONTEXT |
3107              MSR_VMX_EPT_INVVPID | MSR_VMX_EPT_INVVPID_SINGLE_ADDR |
3108              MSR_VMX_EPT_INVVPID_SINGLE_CONTEXT | MSR_VMX_EPT_INVVPID_ALL_CONTEXT |
3109              MSR_VMX_EPT_INVVPID_SINGLE_CONTEXT_NOGLOBALS | MSR_VMX_EPT_AD_BITS,
3110         .features[FEAT_VMX_EXIT_CTLS] =
3111              VMX_VM_EXIT_ACK_INTR_ON_EXIT | VMX_VM_EXIT_SAVE_DEBUG_CONTROLS |
3112              VMX_VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL |
3113              VMX_VM_EXIT_LOAD_IA32_PAT | VMX_VM_EXIT_LOAD_IA32_EFER |
3114              VMX_VM_EXIT_SAVE_IA32_PAT | VMX_VM_EXIT_SAVE_IA32_EFER |
3115              VMX_VM_EXIT_SAVE_VMX_PREEMPTION_TIMER,
3116         .features[FEAT_VMX_MISC] = MSR_VMX_MISC_ACTIVITY_HLT |
3117              MSR_VMX_MISC_STORE_LMA | MSR_VMX_MISC_VMWRITE_VMEXIT,
3118         .features[FEAT_VMX_PINBASED_CTLS] = VMX_PIN_BASED_EXT_INTR_MASK |
3119              VMX_PIN_BASED_NMI_EXITING | VMX_PIN_BASED_VIRTUAL_NMIS |
3120              VMX_PIN_BASED_VMX_PREEMPTION_TIMER | VMX_PIN_BASED_POSTED_INTR,
3121         .features[FEAT_VMX_PROCBASED_CTLS] = VMX_CPU_BASED_VIRTUAL_INTR_PENDING |
3122              VMX_CPU_BASED_USE_TSC_OFFSETING | VMX_CPU_BASED_HLT_EXITING |
3123              VMX_CPU_BASED_INVLPG_EXITING | VMX_CPU_BASED_MWAIT_EXITING |
3124              VMX_CPU_BASED_RDPMC_EXITING | VMX_CPU_BASED_RDTSC_EXITING |
3125              VMX_CPU_BASED_CR8_LOAD_EXITING | VMX_CPU_BASED_CR8_STORE_EXITING |
3126              VMX_CPU_BASED_TPR_SHADOW | VMX_CPU_BASED_MOV_DR_EXITING |
3127              VMX_CPU_BASED_UNCOND_IO_EXITING | VMX_CPU_BASED_USE_IO_BITMAPS |
3128              VMX_CPU_BASED_MONITOR_EXITING | VMX_CPU_BASED_PAUSE_EXITING |
3129              VMX_CPU_BASED_VIRTUAL_NMI_PENDING | VMX_CPU_BASED_USE_MSR_BITMAPS |
3130              VMX_CPU_BASED_CR3_LOAD_EXITING | VMX_CPU_BASED_CR3_STORE_EXITING |
3131              VMX_CPU_BASED_MONITOR_TRAP_FLAG |
3132              VMX_CPU_BASED_ACTIVATE_SECONDARY_CONTROLS,
3133         .features[FEAT_VMX_SECONDARY_CTLS] =
3134              VMX_SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
3135              VMX_SECONDARY_EXEC_WBINVD_EXITING | VMX_SECONDARY_EXEC_ENABLE_EPT |
3136              VMX_SECONDARY_EXEC_DESC | VMX_SECONDARY_EXEC_RDTSCP |
3137              VMX_SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |
3138              VMX_SECONDARY_EXEC_ENABLE_VPID | VMX_SECONDARY_EXEC_UNRESTRICTED_GUEST |
3139              VMX_SECONDARY_EXEC_APIC_REGISTER_VIRT |
3140              VMX_SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |
3141              VMX_SECONDARY_EXEC_RDRAND_EXITING | VMX_SECONDARY_EXEC_ENABLE_INVPCID |
3142              VMX_SECONDARY_EXEC_ENABLE_VMFUNC | VMX_SECONDARY_EXEC_SHADOW_VMCS |
3143              VMX_SECONDARY_EXEC_RDSEED_EXITING | VMX_SECONDARY_EXEC_ENABLE_PML,
3144         .xlevel = 0x80000008,
3145         .model_id = "Intel Xeon Processor (Cascadelake)",
3146         .versions = (X86CPUVersionDefinition[]) {
3147             { .version = 1 },
3148             { .version = 2,
3149               .note = "ARCH_CAPABILITIES",
3150               .props = (PropValue[]) {
3151                   { "arch-capabilities", "on" },
3152                   { "rdctl-no", "on" },
3153                   { "ibrs-all", "on" },
3154                   { "skip-l1dfl-vmentry", "on" },
3155                   { "mds-no", "on" },
3156                   { /* end of list */ }
3157               },
3158             },
3159             { .version = 3,
3160               .alias = "Cascadelake-Server-noTSX",
3161               .note = "ARCH_CAPABILITIES, no TSX",
3162               .props = (PropValue[]) {
3163                   { "hle", "off" },
3164                   { "rtm", "off" },
3165                   { /* end of list */ }
3166               },
3167             },
3168             { .version = 4,
3169               .note = "ARCH_CAPABILITIES, no TSX",
3170               .props = (PropValue[]) {
3171                   { "vmx-eptp-switching", "on" },
3172                   { /* end of list */ }
3173               },
3174             },
3175             { /* end of list */ }
3176         }
3177     },
3178     {
3179         .name = "Cooperlake",
3180         .level = 0xd,
3181         .vendor = CPUID_VENDOR_INTEL,
3182         .family = 6,
3183         .model = 85,
3184         .stepping = 10,
3185         .features[FEAT_1_EDX] =
3186             CPUID_VME | CPUID_SSE2 | CPUID_SSE | CPUID_FXSR | CPUID_MMX |
3187             CPUID_CLFLUSH | CPUID_PSE36 | CPUID_PAT | CPUID_CMOV | CPUID_MCA |
3188             CPUID_PGE | CPUID_MTRR | CPUID_SEP | CPUID_APIC | CPUID_CX8 |
3189             CPUID_MCE | CPUID_PAE | CPUID_MSR | CPUID_TSC | CPUID_PSE |
3190             CPUID_DE | CPUID_FP87,
3191         .features[FEAT_1_ECX] =
3192             CPUID_EXT_AVX | CPUID_EXT_XSAVE | CPUID_EXT_AES |
3193             CPUID_EXT_POPCNT | CPUID_EXT_X2APIC | CPUID_EXT_SSE42 |
3194             CPUID_EXT_SSE41 | CPUID_EXT_CX16 | CPUID_EXT_SSSE3 |
3195             CPUID_EXT_PCLMULQDQ | CPUID_EXT_SSE3 |
3196             CPUID_EXT_TSC_DEADLINE_TIMER | CPUID_EXT_FMA | CPUID_EXT_MOVBE |
3197             CPUID_EXT_PCID | CPUID_EXT_F16C | CPUID_EXT_RDRAND,
3198         .features[FEAT_8000_0001_EDX] =
3199             CPUID_EXT2_LM | CPUID_EXT2_PDPE1GB | CPUID_EXT2_RDTSCP |
3200             CPUID_EXT2_NX | CPUID_EXT2_SYSCALL,
3201         .features[FEAT_8000_0001_ECX] =
3202             CPUID_EXT3_ABM | CPUID_EXT3_LAHF_LM | CPUID_EXT3_3DNOWPREFETCH,
3203         .features[FEAT_7_0_EBX] =
3204             CPUID_7_0_EBX_FSGSBASE | CPUID_7_0_EBX_BMI1 |
3205             CPUID_7_0_EBX_HLE | CPUID_7_0_EBX_AVX2 | CPUID_7_0_EBX_SMEP |
3206             CPUID_7_0_EBX_BMI2 | CPUID_7_0_EBX_ERMS | CPUID_7_0_EBX_INVPCID |
3207             CPUID_7_0_EBX_RTM | CPUID_7_0_EBX_RDSEED | CPUID_7_0_EBX_ADX |
3208             CPUID_7_0_EBX_SMAP | CPUID_7_0_EBX_CLWB |
3209             CPUID_7_0_EBX_AVX512F | CPUID_7_0_EBX_AVX512DQ |
3210             CPUID_7_0_EBX_AVX512BW | CPUID_7_0_EBX_AVX512CD |
3211             CPUID_7_0_EBX_AVX512VL | CPUID_7_0_EBX_CLFLUSHOPT,
3212         .features[FEAT_7_0_ECX] =
3213             CPUID_7_0_ECX_PKU |
3214             CPUID_7_0_ECX_AVX512VNNI,
3215         .features[FEAT_7_0_EDX] =
3216             CPUID_7_0_EDX_SPEC_CTRL | CPUID_7_0_EDX_STIBP |
3217             CPUID_7_0_EDX_SPEC_CTRL_SSBD | CPUID_7_0_EDX_ARCH_CAPABILITIES,
3218         .features[FEAT_ARCH_CAPABILITIES] =
3219             MSR_ARCH_CAP_RDCL_NO | MSR_ARCH_CAP_IBRS_ALL |
3220             MSR_ARCH_CAP_SKIP_L1DFL_VMENTRY | MSR_ARCH_CAP_MDS_NO |
3221             MSR_ARCH_CAP_PSCHANGE_MC_NO | MSR_ARCH_CAP_TAA_NO,
3222         .features[FEAT_7_1_EAX] =
3223             CPUID_7_1_EAX_AVX512_BF16,
3224         /*
3225          * Missing: XSAVES (not supported by some Linux versions,
3226          * including v4.1 to v4.12).
3227          * KVM doesn't yet expose any XSAVES state save component,
3228          * and the only one defined in Skylake (processor tracing)
3229          * probably will block migration anyway.
3230          */
3231         .features[FEAT_XSAVE] =
3232             CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC |
3233             CPUID_XSAVE_XGETBV1,
3234         .features[FEAT_6_EAX] =
3235             CPUID_6_EAX_ARAT,
3236         /* Missing: Mode-based execute control (XS/XU), processor tracing, TSC scaling */
3237         .features[FEAT_VMX_BASIC] = MSR_VMX_BASIC_INS_OUTS |
3238              MSR_VMX_BASIC_TRUE_CTLS,
3239         .features[FEAT_VMX_ENTRY_CTLS] = VMX_VM_ENTRY_IA32E_MODE |
3240              VMX_VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL | VMX_VM_ENTRY_LOAD_IA32_PAT |
3241              VMX_VM_ENTRY_LOAD_DEBUG_CONTROLS | VMX_VM_ENTRY_LOAD_IA32_EFER,
3242         .features[FEAT_VMX_EPT_VPID_CAPS] = MSR_VMX_EPT_EXECONLY |
3243              MSR_VMX_EPT_PAGE_WALK_LENGTH_4 | MSR_VMX_EPT_WB | MSR_VMX_EPT_2MB |
3244              MSR_VMX_EPT_1GB | MSR_VMX_EPT_INVEPT |
3245              MSR_VMX_EPT_INVEPT_SINGLE_CONTEXT | MSR_VMX_EPT_INVEPT_ALL_CONTEXT |
3246              MSR_VMX_EPT_INVVPID | MSR_VMX_EPT_INVVPID_SINGLE_ADDR |
3247              MSR_VMX_EPT_INVVPID_SINGLE_CONTEXT | MSR_VMX_EPT_INVVPID_ALL_CONTEXT |
3248              MSR_VMX_EPT_INVVPID_SINGLE_CONTEXT_NOGLOBALS | MSR_VMX_EPT_AD_BITS,
3249         .features[FEAT_VMX_EXIT_CTLS] =
3250              VMX_VM_EXIT_ACK_INTR_ON_EXIT | VMX_VM_EXIT_SAVE_DEBUG_CONTROLS |
3251              VMX_VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL |
3252              VMX_VM_EXIT_LOAD_IA32_PAT | VMX_VM_EXIT_LOAD_IA32_EFER |
3253              VMX_VM_EXIT_SAVE_IA32_PAT | VMX_VM_EXIT_SAVE_IA32_EFER |
3254              VMX_VM_EXIT_SAVE_VMX_PREEMPTION_TIMER,
3255         .features[FEAT_VMX_MISC] = MSR_VMX_MISC_ACTIVITY_HLT |
3256              MSR_VMX_MISC_STORE_LMA | MSR_VMX_MISC_VMWRITE_VMEXIT,
3257         .features[FEAT_VMX_PINBASED_CTLS] = VMX_PIN_BASED_EXT_INTR_MASK |
3258              VMX_PIN_BASED_NMI_EXITING | VMX_PIN_BASED_VIRTUAL_NMIS |
3259              VMX_PIN_BASED_VMX_PREEMPTION_TIMER | VMX_PIN_BASED_POSTED_INTR,
3260         .features[FEAT_VMX_PROCBASED_CTLS] = VMX_CPU_BASED_VIRTUAL_INTR_PENDING |
3261              VMX_CPU_BASED_USE_TSC_OFFSETING | VMX_CPU_BASED_HLT_EXITING |
3262              VMX_CPU_BASED_INVLPG_EXITING | VMX_CPU_BASED_MWAIT_EXITING |
3263              VMX_CPU_BASED_RDPMC_EXITING | VMX_CPU_BASED_RDTSC_EXITING |
3264              VMX_CPU_BASED_CR8_LOAD_EXITING | VMX_CPU_BASED_CR8_STORE_EXITING |
3265              VMX_CPU_BASED_TPR_SHADOW | VMX_CPU_BASED_MOV_DR_EXITING |
3266              VMX_CPU_BASED_UNCOND_IO_EXITING | VMX_CPU_BASED_USE_IO_BITMAPS |
3267              VMX_CPU_BASED_MONITOR_EXITING | VMX_CPU_BASED_PAUSE_EXITING |
3268              VMX_CPU_BASED_VIRTUAL_NMI_PENDING | VMX_CPU_BASED_USE_MSR_BITMAPS |
3269              VMX_CPU_BASED_CR3_LOAD_EXITING | VMX_CPU_BASED_CR3_STORE_EXITING |
3270              VMX_CPU_BASED_MONITOR_TRAP_FLAG |
3271              VMX_CPU_BASED_ACTIVATE_SECONDARY_CONTROLS,
3272         .features[FEAT_VMX_SECONDARY_CTLS] =
3273              VMX_SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
3274              VMX_SECONDARY_EXEC_WBINVD_EXITING | VMX_SECONDARY_EXEC_ENABLE_EPT |
3275              VMX_SECONDARY_EXEC_DESC | VMX_SECONDARY_EXEC_RDTSCP |
3276              VMX_SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |
3277              VMX_SECONDARY_EXEC_ENABLE_VPID | VMX_SECONDARY_EXEC_UNRESTRICTED_GUEST |
3278              VMX_SECONDARY_EXEC_APIC_REGISTER_VIRT |
3279              VMX_SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |
3280              VMX_SECONDARY_EXEC_RDRAND_EXITING | VMX_SECONDARY_EXEC_ENABLE_INVPCID |
3281              VMX_SECONDARY_EXEC_ENABLE_VMFUNC | VMX_SECONDARY_EXEC_SHADOW_VMCS |
3282              VMX_SECONDARY_EXEC_RDSEED_EXITING | VMX_SECONDARY_EXEC_ENABLE_PML,
3283         .features[FEAT_VMX_VMFUNC] = MSR_VMX_VMFUNC_EPT_SWITCHING,
3284         .xlevel = 0x80000008,
3285         .model_id = "Intel Xeon Processor (Cooperlake)",
3286     },
3287     {
3288         .name = "Icelake-Client",
3289         .level = 0xd,
3290         .vendor = CPUID_VENDOR_INTEL,
3291         .family = 6,
3292         .model = 126,
3293         .stepping = 0,
3294         .features[FEAT_1_EDX] =
3295             CPUID_VME | CPUID_SSE2 | CPUID_SSE | CPUID_FXSR | CPUID_MMX |
3296             CPUID_CLFLUSH | CPUID_PSE36 | CPUID_PAT | CPUID_CMOV | CPUID_MCA |
3297             CPUID_PGE | CPUID_MTRR | CPUID_SEP | CPUID_APIC | CPUID_CX8 |
3298             CPUID_MCE | CPUID_PAE | CPUID_MSR | CPUID_TSC | CPUID_PSE |
3299             CPUID_DE | CPUID_FP87,
3300         .features[FEAT_1_ECX] =
3301             CPUID_EXT_AVX | CPUID_EXT_XSAVE | CPUID_EXT_AES |
3302             CPUID_EXT_POPCNT | CPUID_EXT_X2APIC | CPUID_EXT_SSE42 |
3303             CPUID_EXT_SSE41 | CPUID_EXT_CX16 | CPUID_EXT_SSSE3 |
3304             CPUID_EXT_PCLMULQDQ | CPUID_EXT_SSE3 |
3305             CPUID_EXT_TSC_DEADLINE_TIMER | CPUID_EXT_FMA | CPUID_EXT_MOVBE |
3306             CPUID_EXT_PCID | CPUID_EXT_F16C | CPUID_EXT_RDRAND,
3307         .features[FEAT_8000_0001_EDX] =
3308             CPUID_EXT2_LM | CPUID_EXT2_RDTSCP | CPUID_EXT2_NX |
3309             CPUID_EXT2_SYSCALL,
3310         .features[FEAT_8000_0001_ECX] =
3311             CPUID_EXT3_ABM | CPUID_EXT3_LAHF_LM | CPUID_EXT3_3DNOWPREFETCH,
3312         .features[FEAT_8000_0008_EBX] =
3313             CPUID_8000_0008_EBX_WBNOINVD,
3314         .features[FEAT_7_0_EBX] =
3315             CPUID_7_0_EBX_FSGSBASE | CPUID_7_0_EBX_BMI1 |
3316             CPUID_7_0_EBX_HLE | CPUID_7_0_EBX_AVX2 | CPUID_7_0_EBX_SMEP |
3317             CPUID_7_0_EBX_BMI2 | CPUID_7_0_EBX_ERMS | CPUID_7_0_EBX_INVPCID |
3318             CPUID_7_0_EBX_RTM | CPUID_7_0_EBX_RDSEED | CPUID_7_0_EBX_ADX |
3319             CPUID_7_0_EBX_SMAP,
3320         .features[FEAT_7_0_ECX] =
3321             CPUID_7_0_ECX_AVX512_VBMI | CPUID_7_0_ECX_UMIP | CPUID_7_0_ECX_PKU |
3322             CPUID_7_0_ECX_AVX512_VBMI2 | CPUID_7_0_ECX_GFNI |
3323             CPUID_7_0_ECX_VAES | CPUID_7_0_ECX_VPCLMULQDQ |
3324             CPUID_7_0_ECX_AVX512VNNI | CPUID_7_0_ECX_AVX512BITALG |
3325             CPUID_7_0_ECX_AVX512_VPOPCNTDQ,
3326         .features[FEAT_7_0_EDX] =
3327             CPUID_7_0_EDX_SPEC_CTRL | CPUID_7_0_EDX_SPEC_CTRL_SSBD,
3328         /* Missing: XSAVES (not supported by some Linux versions,
3329                 * including v4.1 to v4.12).
3330                 * KVM doesn't yet expose any XSAVES state save component,
3331                 * and the only one defined in Skylake (processor tracing)
3332                 * probably will block migration anyway.
3333                 */
3334         .features[FEAT_XSAVE] =
3335             CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC |
3336             CPUID_XSAVE_XGETBV1,
3337         .features[FEAT_6_EAX] =
3338             CPUID_6_EAX_ARAT,
3339         /* Missing: Mode-based execute control (XS/XU), processor tracing, TSC scaling */
3340         .features[FEAT_VMX_BASIC] = MSR_VMX_BASIC_INS_OUTS |
3341              MSR_VMX_BASIC_TRUE_CTLS,
3342         .features[FEAT_VMX_ENTRY_CTLS] = VMX_VM_ENTRY_IA32E_MODE |
3343              VMX_VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL | VMX_VM_ENTRY_LOAD_IA32_PAT |
3344              VMX_VM_ENTRY_LOAD_DEBUG_CONTROLS | VMX_VM_ENTRY_LOAD_IA32_EFER,
3345         .features[FEAT_VMX_EPT_VPID_CAPS] = MSR_VMX_EPT_EXECONLY |
3346              MSR_VMX_EPT_PAGE_WALK_LENGTH_4 | MSR_VMX_EPT_WB | MSR_VMX_EPT_2MB |
3347              MSR_VMX_EPT_1GB | MSR_VMX_EPT_INVEPT |
3348              MSR_VMX_EPT_INVEPT_SINGLE_CONTEXT | MSR_VMX_EPT_INVEPT_ALL_CONTEXT |
3349              MSR_VMX_EPT_INVVPID | MSR_VMX_EPT_INVVPID_SINGLE_ADDR |
3350              MSR_VMX_EPT_INVVPID_SINGLE_CONTEXT | MSR_VMX_EPT_INVVPID_ALL_CONTEXT |
3351              MSR_VMX_EPT_INVVPID_SINGLE_CONTEXT_NOGLOBALS | MSR_VMX_EPT_AD_BITS,
3352         .features[FEAT_VMX_EXIT_CTLS] =
3353              VMX_VM_EXIT_ACK_INTR_ON_EXIT | VMX_VM_EXIT_SAVE_DEBUG_CONTROLS |
3354              VMX_VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL |
3355              VMX_VM_EXIT_LOAD_IA32_PAT | VMX_VM_EXIT_LOAD_IA32_EFER |
3356              VMX_VM_EXIT_SAVE_IA32_PAT | VMX_VM_EXIT_SAVE_IA32_EFER |
3357              VMX_VM_EXIT_SAVE_VMX_PREEMPTION_TIMER,
3358         .features[FEAT_VMX_MISC] = MSR_VMX_MISC_ACTIVITY_HLT |
3359              MSR_VMX_MISC_STORE_LMA | MSR_VMX_MISC_VMWRITE_VMEXIT,
3360         .features[FEAT_VMX_PINBASED_CTLS] = VMX_PIN_BASED_EXT_INTR_MASK |
3361              VMX_PIN_BASED_NMI_EXITING | VMX_PIN_BASED_VIRTUAL_NMIS |
3362              VMX_PIN_BASED_VMX_PREEMPTION_TIMER,
3363         .features[FEAT_VMX_PROCBASED_CTLS] = VMX_CPU_BASED_VIRTUAL_INTR_PENDING |
3364              VMX_CPU_BASED_USE_TSC_OFFSETING | VMX_CPU_BASED_HLT_EXITING |
3365              VMX_CPU_BASED_INVLPG_EXITING | VMX_CPU_BASED_MWAIT_EXITING |
3366              VMX_CPU_BASED_RDPMC_EXITING | VMX_CPU_BASED_RDTSC_EXITING |
3367              VMX_CPU_BASED_CR8_LOAD_EXITING | VMX_CPU_BASED_CR8_STORE_EXITING |
3368              VMX_CPU_BASED_TPR_SHADOW | VMX_CPU_BASED_MOV_DR_EXITING |
3369              VMX_CPU_BASED_UNCOND_IO_EXITING | VMX_CPU_BASED_USE_IO_BITMAPS |
3370              VMX_CPU_BASED_MONITOR_EXITING | VMX_CPU_BASED_PAUSE_EXITING |
3371              VMX_CPU_BASED_VIRTUAL_NMI_PENDING | VMX_CPU_BASED_USE_MSR_BITMAPS |
3372              VMX_CPU_BASED_CR3_LOAD_EXITING | VMX_CPU_BASED_CR3_STORE_EXITING |
3373              VMX_CPU_BASED_MONITOR_TRAP_FLAG |
3374              VMX_CPU_BASED_ACTIVATE_SECONDARY_CONTROLS,
3375         .features[FEAT_VMX_SECONDARY_CTLS] =
3376              VMX_SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
3377              VMX_SECONDARY_EXEC_WBINVD_EXITING | VMX_SECONDARY_EXEC_ENABLE_EPT |
3378              VMX_SECONDARY_EXEC_DESC | VMX_SECONDARY_EXEC_RDTSCP |
3379              VMX_SECONDARY_EXEC_ENABLE_VPID | VMX_SECONDARY_EXEC_UNRESTRICTED_GUEST |
3380              VMX_SECONDARY_EXEC_RDRAND_EXITING | VMX_SECONDARY_EXEC_ENABLE_INVPCID |
3381              VMX_SECONDARY_EXEC_ENABLE_VMFUNC | VMX_SECONDARY_EXEC_SHADOW_VMCS |
3382              VMX_SECONDARY_EXEC_RDSEED_EXITING | VMX_SECONDARY_EXEC_ENABLE_PML,
3383         .features[FEAT_VMX_VMFUNC] = MSR_VMX_VMFUNC_EPT_SWITCHING,
3384         .xlevel = 0x80000008,
3385         .model_id = "Intel Core Processor (Icelake)",
3386         .versions = (X86CPUVersionDefinition[]) {
3387             {
3388                 .version = 1,
3389                 .note = "deprecated"
3390             },
3391             {
3392                 .version = 2,
3393                 .note = "no TSX, deprecated",
3394                 .alias = "Icelake-Client-noTSX",
3395                 .props = (PropValue[]) {
3396                     { "hle", "off" },
3397                     { "rtm", "off" },
3398                     { /* end of list */ }
3399                 },
3400             },
3401             { /* end of list */ }
3402         },
3403         .deprecation_note = "use Icelake-Server instead"
3404     },
3405     {
3406         .name = "Icelake-Server",
3407         .level = 0xd,
3408         .vendor = CPUID_VENDOR_INTEL,
3409         .family = 6,
3410         .model = 134,
3411         .stepping = 0,
3412         .features[FEAT_1_EDX] =
3413             CPUID_VME | CPUID_SSE2 | CPUID_SSE | CPUID_FXSR | CPUID_MMX |
3414             CPUID_CLFLUSH | CPUID_PSE36 | CPUID_PAT | CPUID_CMOV | CPUID_MCA |
3415             CPUID_PGE | CPUID_MTRR | CPUID_SEP | CPUID_APIC | CPUID_CX8 |
3416             CPUID_MCE | CPUID_PAE | CPUID_MSR | CPUID_TSC | CPUID_PSE |
3417             CPUID_DE | CPUID_FP87,
3418         .features[FEAT_1_ECX] =
3419             CPUID_EXT_AVX | CPUID_EXT_XSAVE | CPUID_EXT_AES |
3420             CPUID_EXT_POPCNT | CPUID_EXT_X2APIC | CPUID_EXT_SSE42 |
3421             CPUID_EXT_SSE41 | CPUID_EXT_CX16 | CPUID_EXT_SSSE3 |
3422             CPUID_EXT_PCLMULQDQ | CPUID_EXT_SSE3 |
3423             CPUID_EXT_TSC_DEADLINE_TIMER | CPUID_EXT_FMA | CPUID_EXT_MOVBE |
3424             CPUID_EXT_PCID | CPUID_EXT_F16C | CPUID_EXT_RDRAND,
3425         .features[FEAT_8000_0001_EDX] =
3426             CPUID_EXT2_LM | CPUID_EXT2_PDPE1GB | CPUID_EXT2_RDTSCP |
3427             CPUID_EXT2_NX | CPUID_EXT2_SYSCALL,
3428         .features[FEAT_8000_0001_ECX] =
3429             CPUID_EXT3_ABM | CPUID_EXT3_LAHF_LM | CPUID_EXT3_3DNOWPREFETCH,
3430         .features[FEAT_8000_0008_EBX] =
3431             CPUID_8000_0008_EBX_WBNOINVD,
3432         .features[FEAT_7_0_EBX] =
3433             CPUID_7_0_EBX_FSGSBASE | CPUID_7_0_EBX_BMI1 |
3434             CPUID_7_0_EBX_HLE | CPUID_7_0_EBX_AVX2 | CPUID_7_0_EBX_SMEP |
3435             CPUID_7_0_EBX_BMI2 | CPUID_7_0_EBX_ERMS | CPUID_7_0_EBX_INVPCID |
3436             CPUID_7_0_EBX_RTM | CPUID_7_0_EBX_RDSEED | CPUID_7_0_EBX_ADX |
3437             CPUID_7_0_EBX_SMAP | CPUID_7_0_EBX_CLWB |
3438             CPUID_7_0_EBX_AVX512F | CPUID_7_0_EBX_AVX512DQ |
3439             CPUID_7_0_EBX_AVX512BW | CPUID_7_0_EBX_AVX512CD |
3440             CPUID_7_0_EBX_AVX512VL | CPUID_7_0_EBX_CLFLUSHOPT,
3441         .features[FEAT_7_0_ECX] =
3442             CPUID_7_0_ECX_AVX512_VBMI | CPUID_7_0_ECX_UMIP | CPUID_7_0_ECX_PKU |
3443             CPUID_7_0_ECX_AVX512_VBMI2 | CPUID_7_0_ECX_GFNI |
3444             CPUID_7_0_ECX_VAES | CPUID_7_0_ECX_VPCLMULQDQ |
3445             CPUID_7_0_ECX_AVX512VNNI | CPUID_7_0_ECX_AVX512BITALG |
3446             CPUID_7_0_ECX_AVX512_VPOPCNTDQ | CPUID_7_0_ECX_LA57,
3447         .features[FEAT_7_0_EDX] =
3448             CPUID_7_0_EDX_SPEC_CTRL | CPUID_7_0_EDX_SPEC_CTRL_SSBD,
3449         /* Missing: XSAVES (not supported by some Linux versions,
3450                 * including v4.1 to v4.12).
3451                 * KVM doesn't yet expose any XSAVES state save component,
3452                 * and the only one defined in Skylake (processor tracing)
3453                 * probably will block migration anyway.
3454                 */
3455         .features[FEAT_XSAVE] =
3456             CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC |
3457             CPUID_XSAVE_XGETBV1,
3458         .features[FEAT_6_EAX] =
3459             CPUID_6_EAX_ARAT,
3460         /* Missing: Mode-based execute control (XS/XU), processor tracing, TSC scaling */
3461         .features[FEAT_VMX_BASIC] = MSR_VMX_BASIC_INS_OUTS |
3462              MSR_VMX_BASIC_TRUE_CTLS,
3463         .features[FEAT_VMX_ENTRY_CTLS] = VMX_VM_ENTRY_IA32E_MODE |
3464              VMX_VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL | VMX_VM_ENTRY_LOAD_IA32_PAT |
3465              VMX_VM_ENTRY_LOAD_DEBUG_CONTROLS | VMX_VM_ENTRY_LOAD_IA32_EFER,
3466         .features[FEAT_VMX_EPT_VPID_CAPS] = MSR_VMX_EPT_EXECONLY |
3467              MSR_VMX_EPT_PAGE_WALK_LENGTH_4 | MSR_VMX_EPT_WB | MSR_VMX_EPT_2MB |
3468              MSR_VMX_EPT_1GB | MSR_VMX_EPT_INVEPT |
3469              MSR_VMX_EPT_INVEPT_SINGLE_CONTEXT | MSR_VMX_EPT_INVEPT_ALL_CONTEXT |
3470              MSR_VMX_EPT_INVVPID | MSR_VMX_EPT_INVVPID_SINGLE_ADDR |
3471              MSR_VMX_EPT_INVVPID_SINGLE_CONTEXT | MSR_VMX_EPT_INVVPID_ALL_CONTEXT |
3472              MSR_VMX_EPT_INVVPID_SINGLE_CONTEXT_NOGLOBALS | MSR_VMX_EPT_AD_BITS,
3473         .features[FEAT_VMX_EXIT_CTLS] =
3474              VMX_VM_EXIT_ACK_INTR_ON_EXIT | VMX_VM_EXIT_SAVE_DEBUG_CONTROLS |
3475              VMX_VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL |
3476              VMX_VM_EXIT_LOAD_IA32_PAT | VMX_VM_EXIT_LOAD_IA32_EFER |
3477              VMX_VM_EXIT_SAVE_IA32_PAT | VMX_VM_EXIT_SAVE_IA32_EFER |
3478              VMX_VM_EXIT_SAVE_VMX_PREEMPTION_TIMER,
3479         .features[FEAT_VMX_MISC] = MSR_VMX_MISC_ACTIVITY_HLT |
3480              MSR_VMX_MISC_STORE_LMA | MSR_VMX_MISC_VMWRITE_VMEXIT,
3481         .features[FEAT_VMX_PINBASED_CTLS] = VMX_PIN_BASED_EXT_INTR_MASK |
3482              VMX_PIN_BASED_NMI_EXITING | VMX_PIN_BASED_VIRTUAL_NMIS |
3483              VMX_PIN_BASED_VMX_PREEMPTION_TIMER | VMX_PIN_BASED_POSTED_INTR,
3484         .features[FEAT_VMX_PROCBASED_CTLS] = VMX_CPU_BASED_VIRTUAL_INTR_PENDING |
3485              VMX_CPU_BASED_USE_TSC_OFFSETING | VMX_CPU_BASED_HLT_EXITING |
3486              VMX_CPU_BASED_INVLPG_EXITING | VMX_CPU_BASED_MWAIT_EXITING |
3487              VMX_CPU_BASED_RDPMC_EXITING | VMX_CPU_BASED_RDTSC_EXITING |
3488              VMX_CPU_BASED_CR8_LOAD_EXITING | VMX_CPU_BASED_CR8_STORE_EXITING |
3489              VMX_CPU_BASED_TPR_SHADOW | VMX_CPU_BASED_MOV_DR_EXITING |
3490              VMX_CPU_BASED_UNCOND_IO_EXITING | VMX_CPU_BASED_USE_IO_BITMAPS |
3491              VMX_CPU_BASED_MONITOR_EXITING | VMX_CPU_BASED_PAUSE_EXITING |
3492              VMX_CPU_BASED_VIRTUAL_NMI_PENDING | VMX_CPU_BASED_USE_MSR_BITMAPS |
3493              VMX_CPU_BASED_CR3_LOAD_EXITING | VMX_CPU_BASED_CR3_STORE_EXITING |
3494              VMX_CPU_BASED_MONITOR_TRAP_FLAG |
3495              VMX_CPU_BASED_ACTIVATE_SECONDARY_CONTROLS,
3496         .features[FEAT_VMX_SECONDARY_CTLS] =
3497              VMX_SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
3498              VMX_SECONDARY_EXEC_WBINVD_EXITING | VMX_SECONDARY_EXEC_ENABLE_EPT |
3499              VMX_SECONDARY_EXEC_DESC | VMX_SECONDARY_EXEC_RDTSCP |
3500              VMX_SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |
3501              VMX_SECONDARY_EXEC_ENABLE_VPID | VMX_SECONDARY_EXEC_UNRESTRICTED_GUEST |
3502              VMX_SECONDARY_EXEC_APIC_REGISTER_VIRT |
3503              VMX_SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |
3504              VMX_SECONDARY_EXEC_RDRAND_EXITING | VMX_SECONDARY_EXEC_ENABLE_INVPCID |
3505              VMX_SECONDARY_EXEC_ENABLE_VMFUNC | VMX_SECONDARY_EXEC_SHADOW_VMCS,
3506         .xlevel = 0x80000008,
3507         .model_id = "Intel Xeon Processor (Icelake)",
3508         .versions = (X86CPUVersionDefinition[]) {
3509             { .version = 1 },
3510             {
3511                 .version = 2,
3512                 .note = "no TSX",
3513                 .alias = "Icelake-Server-noTSX",
3514                 .props = (PropValue[]) {
3515                     { "hle", "off" },
3516                     { "rtm", "off" },
3517                     { /* end of list */ }
3518                 },
3519             },
3520             {
3521                 .version = 3,
3522                 .props = (PropValue[]) {
3523                     { "arch-capabilities", "on" },
3524                     { "rdctl-no", "on" },
3525                     { "ibrs-all", "on" },
3526                     { "skip-l1dfl-vmentry", "on" },
3527                     { "mds-no", "on" },
3528                     { "pschange-mc-no", "on" },
3529                     { "taa-no", "on" },
3530                     { /* end of list */ }
3531                 },
3532             },
3533             {
3534                 .version = 4,
3535                 .props = (PropValue[]) {
3536                     { "sha-ni", "on" },
3537                     { "avx512ifma", "on" },
3538                     { "rdpid", "on" },
3539                     { "fsrm", "on" },
3540                     { "vmx-rdseed-exit", "on" },
3541                     { "vmx-pml", "on" },
3542                     { "vmx-eptp-switching", "on" },
3543                     { "model", "106" },
3544                     { /* end of list */ }
3545                 },
3546             },
3547             { /* end of list */ }
3548         }
3549     },
3550     {
3551         .name = "Denverton",
3552         .level = 21,
3553         .vendor = CPUID_VENDOR_INTEL,
3554         .family = 6,
3555         .model = 95,
3556         .stepping = 1,
3557         .features[FEAT_1_EDX] =
3558             CPUID_FP87 | CPUID_VME | CPUID_DE | CPUID_PSE | CPUID_TSC |
3559             CPUID_MSR | CPUID_PAE | CPUID_MCE | CPUID_CX8 | CPUID_APIC |
3560             CPUID_SEP | CPUID_MTRR | CPUID_PGE | CPUID_MCA | CPUID_CMOV |
3561             CPUID_PAT | CPUID_PSE36 | CPUID_CLFLUSH | CPUID_MMX | CPUID_FXSR |
3562             CPUID_SSE | CPUID_SSE2,
3563         .features[FEAT_1_ECX] =
3564             CPUID_EXT_SSE3 | CPUID_EXT_PCLMULQDQ | CPUID_EXT_MONITOR |
3565             CPUID_EXT_SSSE3 | CPUID_EXT_CX16 | CPUID_EXT_SSE41 |
3566             CPUID_EXT_SSE42 | CPUID_EXT_X2APIC | CPUID_EXT_MOVBE |
3567             CPUID_EXT_POPCNT | CPUID_EXT_TSC_DEADLINE_TIMER |
3568             CPUID_EXT_AES | CPUID_EXT_XSAVE | CPUID_EXT_RDRAND,
3569         .features[FEAT_8000_0001_EDX] =
3570             CPUID_EXT2_SYSCALL | CPUID_EXT2_NX | CPUID_EXT2_PDPE1GB |
3571             CPUID_EXT2_RDTSCP | CPUID_EXT2_LM,
3572         .features[FEAT_8000_0001_ECX] =
3573             CPUID_EXT3_LAHF_LM | CPUID_EXT3_3DNOWPREFETCH,
3574         .features[FEAT_7_0_EBX] =
3575             CPUID_7_0_EBX_FSGSBASE | CPUID_7_0_EBX_SMEP | CPUID_7_0_EBX_ERMS |
3576             CPUID_7_0_EBX_MPX | CPUID_7_0_EBX_RDSEED | CPUID_7_0_EBX_SMAP |
3577             CPUID_7_0_EBX_CLFLUSHOPT | CPUID_7_0_EBX_SHA_NI,
3578         .features[FEAT_7_0_EDX] =
3579             CPUID_7_0_EDX_SPEC_CTRL | CPUID_7_0_EDX_ARCH_CAPABILITIES |
3580             CPUID_7_0_EDX_SPEC_CTRL_SSBD,
3581         /*
3582          * Missing: XSAVES (not supported by some Linux versions,
3583          * including v4.1 to v4.12).
3584          * KVM doesn't yet expose any XSAVES state save component,
3585          * and the only one defined in Skylake (processor tracing)
3586          * probably will block migration anyway.
3587          */
3588         .features[FEAT_XSAVE] =
3589             CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC | CPUID_XSAVE_XGETBV1,
3590         .features[FEAT_6_EAX] =
3591             CPUID_6_EAX_ARAT,
3592         .features[FEAT_ARCH_CAPABILITIES] =
3593             MSR_ARCH_CAP_RDCL_NO | MSR_ARCH_CAP_SKIP_L1DFL_VMENTRY,
3594         .features[FEAT_VMX_BASIC] = MSR_VMX_BASIC_INS_OUTS |
3595              MSR_VMX_BASIC_TRUE_CTLS,
3596         .features[FEAT_VMX_ENTRY_CTLS] = VMX_VM_ENTRY_IA32E_MODE |
3597              VMX_VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL | VMX_VM_ENTRY_LOAD_IA32_PAT |
3598              VMX_VM_ENTRY_LOAD_DEBUG_CONTROLS | VMX_VM_ENTRY_LOAD_IA32_EFER,
3599         .features[FEAT_VMX_EPT_VPID_CAPS] = MSR_VMX_EPT_EXECONLY |
3600              MSR_VMX_EPT_PAGE_WALK_LENGTH_4 | MSR_VMX_EPT_WB | MSR_VMX_EPT_2MB |
3601              MSR_VMX_EPT_1GB | MSR_VMX_EPT_INVEPT |
3602              MSR_VMX_EPT_INVEPT_SINGLE_CONTEXT | MSR_VMX_EPT_INVEPT_ALL_CONTEXT |
3603              MSR_VMX_EPT_INVVPID | MSR_VMX_EPT_INVVPID_SINGLE_ADDR |
3604              MSR_VMX_EPT_INVVPID_SINGLE_CONTEXT | MSR_VMX_EPT_INVVPID_ALL_CONTEXT |
3605              MSR_VMX_EPT_INVVPID_SINGLE_CONTEXT_NOGLOBALS | MSR_VMX_EPT_AD_BITS,
3606         .features[FEAT_VMX_EXIT_CTLS] =
3607              VMX_VM_EXIT_ACK_INTR_ON_EXIT | VMX_VM_EXIT_SAVE_DEBUG_CONTROLS |
3608              VMX_VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL |
3609              VMX_VM_EXIT_LOAD_IA32_PAT | VMX_VM_EXIT_LOAD_IA32_EFER |
3610              VMX_VM_EXIT_SAVE_IA32_PAT | VMX_VM_EXIT_SAVE_IA32_EFER |
3611              VMX_VM_EXIT_SAVE_VMX_PREEMPTION_TIMER,
3612         .features[FEAT_VMX_MISC] = MSR_VMX_MISC_ACTIVITY_HLT |
3613              MSR_VMX_MISC_STORE_LMA | MSR_VMX_MISC_VMWRITE_VMEXIT,
3614         .features[FEAT_VMX_PINBASED_CTLS] = VMX_PIN_BASED_EXT_INTR_MASK |
3615              VMX_PIN_BASED_NMI_EXITING | VMX_PIN_BASED_VIRTUAL_NMIS |
3616              VMX_PIN_BASED_VMX_PREEMPTION_TIMER | VMX_PIN_BASED_POSTED_INTR,
3617         .features[FEAT_VMX_PROCBASED_CTLS] = VMX_CPU_BASED_VIRTUAL_INTR_PENDING |
3618              VMX_CPU_BASED_USE_TSC_OFFSETING | VMX_CPU_BASED_HLT_EXITING |
3619              VMX_CPU_BASED_INVLPG_EXITING | VMX_CPU_BASED_MWAIT_EXITING |
3620              VMX_CPU_BASED_RDPMC_EXITING | VMX_CPU_BASED_RDTSC_EXITING |
3621              VMX_CPU_BASED_CR8_LOAD_EXITING | VMX_CPU_BASED_CR8_STORE_EXITING |
3622              VMX_CPU_BASED_TPR_SHADOW | VMX_CPU_BASED_MOV_DR_EXITING |
3623              VMX_CPU_BASED_UNCOND_IO_EXITING | VMX_CPU_BASED_USE_IO_BITMAPS |
3624              VMX_CPU_BASED_MONITOR_EXITING | VMX_CPU_BASED_PAUSE_EXITING |
3625              VMX_CPU_BASED_VIRTUAL_NMI_PENDING | VMX_CPU_BASED_USE_MSR_BITMAPS |
3626              VMX_CPU_BASED_CR3_LOAD_EXITING | VMX_CPU_BASED_CR3_STORE_EXITING |
3627              VMX_CPU_BASED_MONITOR_TRAP_FLAG |
3628              VMX_CPU_BASED_ACTIVATE_SECONDARY_CONTROLS,
3629         .features[FEAT_VMX_SECONDARY_CTLS] =
3630              VMX_SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
3631              VMX_SECONDARY_EXEC_WBINVD_EXITING | VMX_SECONDARY_EXEC_ENABLE_EPT |
3632              VMX_SECONDARY_EXEC_DESC | VMX_SECONDARY_EXEC_RDTSCP |
3633              VMX_SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |
3634              VMX_SECONDARY_EXEC_ENABLE_VPID | VMX_SECONDARY_EXEC_UNRESTRICTED_GUEST |
3635              VMX_SECONDARY_EXEC_APIC_REGISTER_VIRT |
3636              VMX_SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |
3637              VMX_SECONDARY_EXEC_RDRAND_EXITING | VMX_SECONDARY_EXEC_ENABLE_INVPCID |
3638              VMX_SECONDARY_EXEC_ENABLE_VMFUNC | VMX_SECONDARY_EXEC_SHADOW_VMCS |
3639              VMX_SECONDARY_EXEC_RDSEED_EXITING | VMX_SECONDARY_EXEC_ENABLE_PML,
3640         .features[FEAT_VMX_VMFUNC] = MSR_VMX_VMFUNC_EPT_SWITCHING,
3641         .xlevel = 0x80000008,
3642         .model_id = "Intel Atom Processor (Denverton)",
3643         .versions = (X86CPUVersionDefinition[]) {
3644             { .version = 1 },
3645             {
3646                 .version = 2,
3647                 .note = "no MPX, no MONITOR",
3648                 .props = (PropValue[]) {
3649                     { "monitor", "off" },
3650                     { "mpx", "off" },
3651                     { /* end of list */ },
3652                 },
3653             },
3654             { /* end of list */ },
3655         },
3656     },
3657     {
3658         .name = "Snowridge",
3659         .level = 27,
3660         .vendor = CPUID_VENDOR_INTEL,
3661         .family = 6,
3662         .model = 134,
3663         .stepping = 1,
3664         .features[FEAT_1_EDX] =
3665             /* missing: CPUID_PN CPUID_IA64 */
3666             /* missing: CPUID_DTS, CPUID_HT, CPUID_TM, CPUID_PBE */
3667             CPUID_FP87 | CPUID_VME | CPUID_DE | CPUID_PSE |
3668             CPUID_TSC | CPUID_MSR | CPUID_PAE | CPUID_MCE |
3669             CPUID_CX8 | CPUID_APIC | CPUID_SEP |
3670             CPUID_MTRR | CPUID_PGE | CPUID_MCA | CPUID_CMOV |
3671             CPUID_PAT | CPUID_PSE36 | CPUID_CLFLUSH |
3672             CPUID_MMX |
3673             CPUID_FXSR | CPUID_SSE | CPUID_SSE2,
3674         .features[FEAT_1_ECX] =
3675             CPUID_EXT_SSE3 | CPUID_EXT_PCLMULQDQ | CPUID_EXT_MONITOR |
3676             CPUID_EXT_SSSE3 |
3677             CPUID_EXT_CX16 |
3678             CPUID_EXT_SSE41 |
3679             CPUID_EXT_SSE42 | CPUID_EXT_X2APIC | CPUID_EXT_MOVBE |
3680             CPUID_EXT_POPCNT |
3681             CPUID_EXT_TSC_DEADLINE_TIMER | CPUID_EXT_AES | CPUID_EXT_XSAVE |
3682             CPUID_EXT_RDRAND,
3683         .features[FEAT_8000_0001_EDX] =
3684             CPUID_EXT2_SYSCALL |
3685             CPUID_EXT2_NX |
3686             CPUID_EXT2_PDPE1GB | CPUID_EXT2_RDTSCP |
3687             CPUID_EXT2_LM,
3688         .features[FEAT_8000_0001_ECX] =
3689             CPUID_EXT3_LAHF_LM |
3690             CPUID_EXT3_3DNOWPREFETCH,
3691         .features[FEAT_7_0_EBX] =
3692             CPUID_7_0_EBX_FSGSBASE |
3693             CPUID_7_0_EBX_SMEP |
3694             CPUID_7_0_EBX_ERMS |
3695             CPUID_7_0_EBX_MPX |  /* missing bits 13, 15 */
3696             CPUID_7_0_EBX_RDSEED |
3697             CPUID_7_0_EBX_SMAP | CPUID_7_0_EBX_CLFLUSHOPT |
3698             CPUID_7_0_EBX_CLWB |
3699             CPUID_7_0_EBX_SHA_NI,
3700         .features[FEAT_7_0_ECX] =
3701             CPUID_7_0_ECX_UMIP |
3702             /* missing bit 5 */
3703             CPUID_7_0_ECX_GFNI |
3704             CPUID_7_0_ECX_MOVDIRI | CPUID_7_0_ECX_CLDEMOTE |
3705             CPUID_7_0_ECX_MOVDIR64B,
3706         .features[FEAT_7_0_EDX] =
3707             CPUID_7_0_EDX_SPEC_CTRL |
3708             CPUID_7_0_EDX_ARCH_CAPABILITIES | CPUID_7_0_EDX_SPEC_CTRL_SSBD |
3709             CPUID_7_0_EDX_CORE_CAPABILITY,
3710         .features[FEAT_CORE_CAPABILITY] =
3711             MSR_CORE_CAP_SPLIT_LOCK_DETECT,
3712         /*
3713          * Missing: XSAVES (not supported by some Linux versions,
3714          * including v4.1 to v4.12).
3715          * KVM doesn't yet expose any XSAVES state save component,
3716          * and the only one defined in Skylake (processor tracing)
3717          * probably will block migration anyway.
3718          */
3719         .features[FEAT_XSAVE] =
3720             CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC |
3721             CPUID_XSAVE_XGETBV1,
3722         .features[FEAT_6_EAX] =
3723             CPUID_6_EAX_ARAT,
3724         .features[FEAT_VMX_BASIC] = MSR_VMX_BASIC_INS_OUTS |
3725              MSR_VMX_BASIC_TRUE_CTLS,
3726         .features[FEAT_VMX_ENTRY_CTLS] = VMX_VM_ENTRY_IA32E_MODE |
3727              VMX_VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL | VMX_VM_ENTRY_LOAD_IA32_PAT |
3728              VMX_VM_ENTRY_LOAD_DEBUG_CONTROLS | VMX_VM_ENTRY_LOAD_IA32_EFER,
3729         .features[FEAT_VMX_EPT_VPID_CAPS] = MSR_VMX_EPT_EXECONLY |
3730              MSR_VMX_EPT_PAGE_WALK_LENGTH_4 | MSR_VMX_EPT_WB | MSR_VMX_EPT_2MB |
3731              MSR_VMX_EPT_1GB | MSR_VMX_EPT_INVEPT |
3732              MSR_VMX_EPT_INVEPT_SINGLE_CONTEXT | MSR_VMX_EPT_INVEPT_ALL_CONTEXT |
3733              MSR_VMX_EPT_INVVPID | MSR_VMX_EPT_INVVPID_SINGLE_ADDR |
3734              MSR_VMX_EPT_INVVPID_SINGLE_CONTEXT | MSR_VMX_EPT_INVVPID_ALL_CONTEXT |
3735              MSR_VMX_EPT_INVVPID_SINGLE_CONTEXT_NOGLOBALS | MSR_VMX_EPT_AD_BITS,
3736         .features[FEAT_VMX_EXIT_CTLS] =
3737              VMX_VM_EXIT_ACK_INTR_ON_EXIT | VMX_VM_EXIT_SAVE_DEBUG_CONTROLS |
3738              VMX_VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL |
3739              VMX_VM_EXIT_LOAD_IA32_PAT | VMX_VM_EXIT_LOAD_IA32_EFER |
3740              VMX_VM_EXIT_SAVE_IA32_PAT | VMX_VM_EXIT_SAVE_IA32_EFER |
3741              VMX_VM_EXIT_SAVE_VMX_PREEMPTION_TIMER,
3742         .features[FEAT_VMX_MISC] = MSR_VMX_MISC_ACTIVITY_HLT |
3743              MSR_VMX_MISC_STORE_LMA | MSR_VMX_MISC_VMWRITE_VMEXIT,
3744         .features[FEAT_VMX_PINBASED_CTLS] = VMX_PIN_BASED_EXT_INTR_MASK |
3745              VMX_PIN_BASED_NMI_EXITING | VMX_PIN_BASED_VIRTUAL_NMIS |
3746              VMX_PIN_BASED_VMX_PREEMPTION_TIMER | VMX_PIN_BASED_POSTED_INTR,
3747         .features[FEAT_VMX_PROCBASED_CTLS] = VMX_CPU_BASED_VIRTUAL_INTR_PENDING |
3748              VMX_CPU_BASED_USE_TSC_OFFSETING | VMX_CPU_BASED_HLT_EXITING |
3749              VMX_CPU_BASED_INVLPG_EXITING | VMX_CPU_BASED_MWAIT_EXITING |
3750              VMX_CPU_BASED_RDPMC_EXITING | VMX_CPU_BASED_RDTSC_EXITING |
3751              VMX_CPU_BASED_CR8_LOAD_EXITING | VMX_CPU_BASED_CR8_STORE_EXITING |
3752              VMX_CPU_BASED_TPR_SHADOW | VMX_CPU_BASED_MOV_DR_EXITING |
3753              VMX_CPU_BASED_UNCOND_IO_EXITING | VMX_CPU_BASED_USE_IO_BITMAPS |
3754              VMX_CPU_BASED_MONITOR_EXITING | VMX_CPU_BASED_PAUSE_EXITING |
3755              VMX_CPU_BASED_VIRTUAL_NMI_PENDING | VMX_CPU_BASED_USE_MSR_BITMAPS |
3756              VMX_CPU_BASED_CR3_LOAD_EXITING | VMX_CPU_BASED_CR3_STORE_EXITING |
3757              VMX_CPU_BASED_MONITOR_TRAP_FLAG |
3758              VMX_CPU_BASED_ACTIVATE_SECONDARY_CONTROLS,
3759         .features[FEAT_VMX_SECONDARY_CTLS] =
3760              VMX_SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
3761              VMX_SECONDARY_EXEC_WBINVD_EXITING | VMX_SECONDARY_EXEC_ENABLE_EPT |
3762              VMX_SECONDARY_EXEC_DESC | VMX_SECONDARY_EXEC_RDTSCP |
3763              VMX_SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |
3764              VMX_SECONDARY_EXEC_ENABLE_VPID | VMX_SECONDARY_EXEC_UNRESTRICTED_GUEST |
3765              VMX_SECONDARY_EXEC_APIC_REGISTER_VIRT |
3766              VMX_SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |
3767              VMX_SECONDARY_EXEC_RDRAND_EXITING | VMX_SECONDARY_EXEC_ENABLE_INVPCID |
3768              VMX_SECONDARY_EXEC_ENABLE_VMFUNC | VMX_SECONDARY_EXEC_SHADOW_VMCS |
3769              VMX_SECONDARY_EXEC_RDSEED_EXITING | VMX_SECONDARY_EXEC_ENABLE_PML,
3770         .features[FEAT_VMX_VMFUNC] = MSR_VMX_VMFUNC_EPT_SWITCHING,
3771         .xlevel = 0x80000008,
3772         .model_id = "Intel Atom Processor (SnowRidge)",
3773         .versions = (X86CPUVersionDefinition[]) {
3774             { .version = 1 },
3775             {
3776                 .version = 2,
3777                 .props = (PropValue[]) {
3778                     { "mpx", "off" },
3779                     { "model-id", "Intel Atom Processor (Snowridge, no MPX)" },
3780                     { /* end of list */ },
3781                 },
3782             },
3783             { /* end of list */ },
3784         },
3785     },
3786     {
3787         .name = "KnightsMill",
3788         .level = 0xd,
3789         .vendor = CPUID_VENDOR_INTEL,
3790         .family = 6,
3791         .model = 133,
3792         .stepping = 0,
3793         .features[FEAT_1_EDX] =
3794             CPUID_VME | CPUID_SS | CPUID_SSE2 | CPUID_SSE | CPUID_FXSR |
3795             CPUID_MMX | CPUID_CLFLUSH | CPUID_PSE36 | CPUID_PAT | CPUID_CMOV |
3796             CPUID_MCA | CPUID_PGE | CPUID_MTRR | CPUID_SEP | CPUID_APIC |
3797             CPUID_CX8 | CPUID_MCE | CPUID_PAE | CPUID_MSR | CPUID_TSC |
3798             CPUID_PSE | CPUID_DE | CPUID_FP87,
3799         .features[FEAT_1_ECX] =
3800             CPUID_EXT_AVX | CPUID_EXT_XSAVE | CPUID_EXT_AES |
3801             CPUID_EXT_POPCNT | CPUID_EXT_X2APIC | CPUID_EXT_SSE42 |
3802             CPUID_EXT_SSE41 | CPUID_EXT_CX16 | CPUID_EXT_SSSE3 |
3803             CPUID_EXT_PCLMULQDQ | CPUID_EXT_SSE3 |
3804             CPUID_EXT_TSC_DEADLINE_TIMER | CPUID_EXT_FMA | CPUID_EXT_MOVBE |
3805             CPUID_EXT_F16C | CPUID_EXT_RDRAND,
3806         .features[FEAT_8000_0001_EDX] =
3807             CPUID_EXT2_LM | CPUID_EXT2_PDPE1GB | CPUID_EXT2_RDTSCP |
3808             CPUID_EXT2_NX | CPUID_EXT2_SYSCALL,
3809         .features[FEAT_8000_0001_ECX] =
3810             CPUID_EXT3_ABM | CPUID_EXT3_LAHF_LM | CPUID_EXT3_3DNOWPREFETCH,
3811         .features[FEAT_7_0_EBX] =
3812             CPUID_7_0_EBX_FSGSBASE | CPUID_7_0_EBX_BMI1 | CPUID_7_0_EBX_AVX2 |
3813             CPUID_7_0_EBX_SMEP | CPUID_7_0_EBX_BMI2 | CPUID_7_0_EBX_ERMS |
3814             CPUID_7_0_EBX_RDSEED | CPUID_7_0_EBX_ADX | CPUID_7_0_EBX_AVX512F |
3815             CPUID_7_0_EBX_AVX512CD | CPUID_7_0_EBX_AVX512PF |
3816             CPUID_7_0_EBX_AVX512ER,
3817         .features[FEAT_7_0_ECX] =
3818             CPUID_7_0_ECX_AVX512_VPOPCNTDQ,
3819         .features[FEAT_7_0_EDX] =
3820             CPUID_7_0_EDX_AVX512_4VNNIW | CPUID_7_0_EDX_AVX512_4FMAPS,
3821         .features[FEAT_XSAVE] =
3822             CPUID_XSAVE_XSAVEOPT,
3823         .features[FEAT_6_EAX] =
3824             CPUID_6_EAX_ARAT,
3825         .xlevel = 0x80000008,
3826         .model_id = "Intel Xeon Phi Processor (Knights Mill)",
3827     },
3828     {
3829         .name = "Opteron_G1",
3830         .level = 5,
3831         .vendor = CPUID_VENDOR_AMD,
3832         .family = 15,
3833         .model = 6,
3834         .stepping = 1,
3835         .features[FEAT_1_EDX] =
3836             CPUID_VME | CPUID_SSE2 | CPUID_SSE | CPUID_FXSR | CPUID_MMX |
3837             CPUID_CLFLUSH | CPUID_PSE36 | CPUID_PAT | CPUID_CMOV | CPUID_MCA |
3838             CPUID_PGE | CPUID_MTRR | CPUID_SEP | CPUID_APIC | CPUID_CX8 |
3839             CPUID_MCE | CPUID_PAE | CPUID_MSR | CPUID_TSC | CPUID_PSE |
3840             CPUID_DE | CPUID_FP87,
3841         .features[FEAT_1_ECX] =
3842             CPUID_EXT_SSE3,
3843         .features[FEAT_8000_0001_EDX] =
3844             CPUID_EXT2_LM | CPUID_EXT2_NX | CPUID_EXT2_SYSCALL,
3845         .xlevel = 0x80000008,
3846         .model_id = "AMD Opteron 240 (Gen 1 Class Opteron)",
3847     },
3848     {
3849         .name = "Opteron_G2",
3850         .level = 5,
3851         .vendor = CPUID_VENDOR_AMD,
3852         .family = 15,
3853         .model = 6,
3854         .stepping = 1,
3855         .features[FEAT_1_EDX] =
3856             CPUID_VME | CPUID_SSE2 | CPUID_SSE | CPUID_FXSR | CPUID_MMX |
3857             CPUID_CLFLUSH | CPUID_PSE36 | CPUID_PAT | CPUID_CMOV | CPUID_MCA |
3858             CPUID_PGE | CPUID_MTRR | CPUID_SEP | CPUID_APIC | CPUID_CX8 |
3859             CPUID_MCE | CPUID_PAE | CPUID_MSR | CPUID_TSC | CPUID_PSE |
3860             CPUID_DE | CPUID_FP87,
3861         .features[FEAT_1_ECX] =
3862             CPUID_EXT_CX16 | CPUID_EXT_SSE3,
3863         .features[FEAT_8000_0001_EDX] =
3864             CPUID_EXT2_LM | CPUID_EXT2_NX | CPUID_EXT2_SYSCALL,
3865         .features[FEAT_8000_0001_ECX] =
3866             CPUID_EXT3_SVM | CPUID_EXT3_LAHF_LM,
3867         .xlevel = 0x80000008,
3868         .model_id = "AMD Opteron 22xx (Gen 2 Class Opteron)",
3869     },
3870     {
3871         .name = "Opteron_G3",
3872         .level = 5,
3873         .vendor = CPUID_VENDOR_AMD,
3874         .family = 16,
3875         .model = 2,
3876         .stepping = 3,
3877         .features[FEAT_1_EDX] =
3878             CPUID_VME | CPUID_SSE2 | CPUID_SSE | CPUID_FXSR | CPUID_MMX |
3879             CPUID_CLFLUSH | CPUID_PSE36 | CPUID_PAT | CPUID_CMOV | CPUID_MCA |
3880             CPUID_PGE | CPUID_MTRR | CPUID_SEP | CPUID_APIC | CPUID_CX8 |
3881             CPUID_MCE | CPUID_PAE | CPUID_MSR | CPUID_TSC | CPUID_PSE |
3882             CPUID_DE | CPUID_FP87,
3883         .features[FEAT_1_ECX] =
3884             CPUID_EXT_POPCNT | CPUID_EXT_CX16 | CPUID_EXT_MONITOR |
3885             CPUID_EXT_SSE3,
3886         .features[FEAT_8000_0001_EDX] =
3887             CPUID_EXT2_LM | CPUID_EXT2_NX | CPUID_EXT2_SYSCALL |
3888             CPUID_EXT2_RDTSCP,
3889         .features[FEAT_8000_0001_ECX] =
3890             CPUID_EXT3_MISALIGNSSE | CPUID_EXT3_SSE4A |
3891             CPUID_EXT3_ABM | CPUID_EXT3_SVM | CPUID_EXT3_LAHF_LM,
3892         .xlevel = 0x80000008,
3893         .model_id = "AMD Opteron 23xx (Gen 3 Class Opteron)",
3894     },
3895     {
3896         .name = "Opteron_G4",
3897         .level = 0xd,
3898         .vendor = CPUID_VENDOR_AMD,
3899         .family = 21,
3900         .model = 1,
3901         .stepping = 2,
3902         .features[FEAT_1_EDX] =
3903             CPUID_VME | CPUID_SSE2 | CPUID_SSE | CPUID_FXSR | CPUID_MMX |
3904             CPUID_CLFLUSH | CPUID_PSE36 | CPUID_PAT | CPUID_CMOV | CPUID_MCA |
3905             CPUID_PGE | CPUID_MTRR | CPUID_SEP | CPUID_APIC | CPUID_CX8 |
3906             CPUID_MCE | CPUID_PAE | CPUID_MSR | CPUID_TSC | CPUID_PSE |
3907             CPUID_DE | CPUID_FP87,
3908         .features[FEAT_1_ECX] =
3909             CPUID_EXT_AVX | CPUID_EXT_XSAVE | CPUID_EXT_AES |
3910             CPUID_EXT_POPCNT | CPUID_EXT_SSE42 | CPUID_EXT_SSE41 |
3911             CPUID_EXT_CX16 | CPUID_EXT_SSSE3 | CPUID_EXT_PCLMULQDQ |
3912             CPUID_EXT_SSE3,
3913         .features[FEAT_8000_0001_EDX] =
3914             CPUID_EXT2_LM | CPUID_EXT2_PDPE1GB | CPUID_EXT2_NX |
3915             CPUID_EXT2_SYSCALL | CPUID_EXT2_RDTSCP,
3916         .features[FEAT_8000_0001_ECX] =
3917             CPUID_EXT3_FMA4 | CPUID_EXT3_XOP |
3918             CPUID_EXT3_3DNOWPREFETCH | CPUID_EXT3_MISALIGNSSE |
3919             CPUID_EXT3_SSE4A | CPUID_EXT3_ABM | CPUID_EXT3_SVM |
3920             CPUID_EXT3_LAHF_LM,
3921         .features[FEAT_SVM] =
3922             CPUID_SVM_NPT | CPUID_SVM_NRIPSAVE,
3923         /* no xsaveopt! */
3924         .xlevel = 0x8000001A,
3925         .model_id = "AMD Opteron 62xx class CPU",
3926     },
3927     {
3928         .name = "Opteron_G5",
3929         .level = 0xd,
3930         .vendor = CPUID_VENDOR_AMD,
3931         .family = 21,
3932         .model = 2,
3933         .stepping = 0,
3934         .features[FEAT_1_EDX] =
3935             CPUID_VME | CPUID_SSE2 | CPUID_SSE | CPUID_FXSR | CPUID_MMX |
3936             CPUID_CLFLUSH | CPUID_PSE36 | CPUID_PAT | CPUID_CMOV | CPUID_MCA |
3937             CPUID_PGE | CPUID_MTRR | CPUID_SEP | CPUID_APIC | CPUID_CX8 |
3938             CPUID_MCE | CPUID_PAE | CPUID_MSR | CPUID_TSC | CPUID_PSE |
3939             CPUID_DE | CPUID_FP87,
3940         .features[FEAT_1_ECX] =
3941             CPUID_EXT_F16C | CPUID_EXT_AVX | CPUID_EXT_XSAVE |
3942             CPUID_EXT_AES | CPUID_EXT_POPCNT | CPUID_EXT_SSE42 |
3943             CPUID_EXT_SSE41 | CPUID_EXT_CX16 | CPUID_EXT_FMA |
3944             CPUID_EXT_SSSE3 | CPUID_EXT_PCLMULQDQ | CPUID_EXT_SSE3,
3945         .features[FEAT_8000_0001_EDX] =
3946             CPUID_EXT2_LM | CPUID_EXT2_PDPE1GB | CPUID_EXT2_NX |
3947             CPUID_EXT2_SYSCALL | CPUID_EXT2_RDTSCP,
3948         .features[FEAT_8000_0001_ECX] =
3949             CPUID_EXT3_TBM | CPUID_EXT3_FMA4 | CPUID_EXT3_XOP |
3950             CPUID_EXT3_3DNOWPREFETCH | CPUID_EXT3_MISALIGNSSE |
3951             CPUID_EXT3_SSE4A | CPUID_EXT3_ABM | CPUID_EXT3_SVM |
3952             CPUID_EXT3_LAHF_LM,
3953         .features[FEAT_SVM] =
3954             CPUID_SVM_NPT | CPUID_SVM_NRIPSAVE,
3955         /* no xsaveopt! */
3956         .xlevel = 0x8000001A,
3957         .model_id = "AMD Opteron 63xx class CPU",
3958     },
3959     {
3960         .name = "EPYC",
3961         .level = 0xd,
3962         .vendor = CPUID_VENDOR_AMD,
3963         .family = 23,
3964         .model = 1,
3965         .stepping = 2,
3966         .features[FEAT_1_EDX] =
3967             CPUID_SSE2 | CPUID_SSE | CPUID_FXSR | CPUID_MMX | CPUID_CLFLUSH |
3968             CPUID_PSE36 | CPUID_PAT | CPUID_CMOV | CPUID_MCA | CPUID_PGE |
3969             CPUID_MTRR | CPUID_SEP | CPUID_APIC | CPUID_CX8 | CPUID_MCE |
3970             CPUID_PAE | CPUID_MSR | CPUID_TSC | CPUID_PSE | CPUID_DE |
3971             CPUID_VME | CPUID_FP87,
3972         .features[FEAT_1_ECX] =
3973             CPUID_EXT_RDRAND | CPUID_EXT_F16C | CPUID_EXT_AVX |
3974             CPUID_EXT_XSAVE | CPUID_EXT_AES |  CPUID_EXT_POPCNT |
3975             CPUID_EXT_MOVBE | CPUID_EXT_SSE42 | CPUID_EXT_SSE41 |
3976             CPUID_EXT_CX16 | CPUID_EXT_FMA | CPUID_EXT_SSSE3 |
3977             CPUID_EXT_MONITOR | CPUID_EXT_PCLMULQDQ | CPUID_EXT_SSE3,
3978         .features[FEAT_8000_0001_EDX] =
3979             CPUID_EXT2_LM | CPUID_EXT2_RDTSCP | CPUID_EXT2_PDPE1GB |
3980             CPUID_EXT2_FFXSR | CPUID_EXT2_MMXEXT | CPUID_EXT2_NX |
3981             CPUID_EXT2_SYSCALL,
3982         .features[FEAT_8000_0001_ECX] =
3983             CPUID_EXT3_OSVW | CPUID_EXT3_3DNOWPREFETCH |
3984             CPUID_EXT3_MISALIGNSSE | CPUID_EXT3_SSE4A | CPUID_EXT3_ABM |
3985             CPUID_EXT3_CR8LEG | CPUID_EXT3_SVM | CPUID_EXT3_LAHF_LM |
3986             CPUID_EXT3_TOPOEXT,
3987         .features[FEAT_7_0_EBX] =
3988             CPUID_7_0_EBX_FSGSBASE | CPUID_7_0_EBX_BMI1 | CPUID_7_0_EBX_AVX2 |
3989             CPUID_7_0_EBX_SMEP | CPUID_7_0_EBX_BMI2 | CPUID_7_0_EBX_RDSEED |
3990             CPUID_7_0_EBX_ADX | CPUID_7_0_EBX_SMAP | CPUID_7_0_EBX_CLFLUSHOPT |
3991             CPUID_7_0_EBX_SHA_NI,
3992         .features[FEAT_XSAVE] =
3993             CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC |
3994             CPUID_XSAVE_XGETBV1,
3995         .features[FEAT_6_EAX] =
3996             CPUID_6_EAX_ARAT,
3997         .features[FEAT_SVM] =
3998             CPUID_SVM_NPT | CPUID_SVM_NRIPSAVE,
3999         .xlevel = 0x8000001E,
4000         .model_id = "AMD EPYC Processor",
4001         .cache_info = &epyc_cache_info,
4002         .versions = (X86CPUVersionDefinition[]) {
4003             { .version = 1 },
4004             {
4005                 .version = 2,
4006                 .alias = "EPYC-IBPB",
4007                 .props = (PropValue[]) {
4008                     { "ibpb", "on" },
4009                     { "model-id",
4010                       "AMD EPYC Processor (with IBPB)" },
4011                     { /* end of list */ }
4012                 }
4013             },
4014             {
4015                 .version = 3,
4016                 .props = (PropValue[]) {
4017                     { "ibpb", "on" },
4018                     { "perfctr-core", "on" },
4019                     { "clzero", "on" },
4020                     { "xsaveerptr", "on" },
4021                     { "xsaves", "on" },
4022                     { "model-id",
4023                       "AMD EPYC Processor" },
4024                     { /* end of list */ }
4025                 }
4026             },
4027             { /* end of list */ }
4028         }
4029     },
4030     {
4031         .name = "Dhyana",
4032         .level = 0xd,
4033         .vendor = CPUID_VENDOR_HYGON,
4034         .family = 24,
4035         .model = 0,
4036         .stepping = 1,
4037         .features[FEAT_1_EDX] =
4038             CPUID_SSE2 | CPUID_SSE | CPUID_FXSR | CPUID_MMX | CPUID_CLFLUSH |
4039             CPUID_PSE36 | CPUID_PAT | CPUID_CMOV | CPUID_MCA | CPUID_PGE |
4040             CPUID_MTRR | CPUID_SEP | CPUID_APIC | CPUID_CX8 | CPUID_MCE |
4041             CPUID_PAE | CPUID_MSR | CPUID_TSC | CPUID_PSE | CPUID_DE |
4042             CPUID_VME | CPUID_FP87,
4043         .features[FEAT_1_ECX] =
4044             CPUID_EXT_RDRAND | CPUID_EXT_F16C | CPUID_EXT_AVX |
4045             CPUID_EXT_XSAVE | CPUID_EXT_POPCNT |
4046             CPUID_EXT_MOVBE | CPUID_EXT_SSE42 | CPUID_EXT_SSE41 |
4047             CPUID_EXT_CX16 | CPUID_EXT_FMA | CPUID_EXT_SSSE3 |
4048             CPUID_EXT_MONITOR | CPUID_EXT_SSE3,
4049         .features[FEAT_8000_0001_EDX] =
4050             CPUID_EXT2_LM | CPUID_EXT2_RDTSCP | CPUID_EXT2_PDPE1GB |
4051             CPUID_EXT2_FFXSR | CPUID_EXT2_MMXEXT | CPUID_EXT2_NX |
4052             CPUID_EXT2_SYSCALL,
4053         .features[FEAT_8000_0001_ECX] =
4054             CPUID_EXT3_OSVW | CPUID_EXT3_3DNOWPREFETCH |
4055             CPUID_EXT3_MISALIGNSSE | CPUID_EXT3_SSE4A | CPUID_EXT3_ABM |
4056             CPUID_EXT3_CR8LEG | CPUID_EXT3_SVM | CPUID_EXT3_LAHF_LM |
4057             CPUID_EXT3_TOPOEXT,
4058         .features[FEAT_8000_0008_EBX] =
4059             CPUID_8000_0008_EBX_IBPB,
4060         .features[FEAT_7_0_EBX] =
4061             CPUID_7_0_EBX_FSGSBASE | CPUID_7_0_EBX_BMI1 | CPUID_7_0_EBX_AVX2 |
4062             CPUID_7_0_EBX_SMEP | CPUID_7_0_EBX_BMI2 | CPUID_7_0_EBX_RDSEED |
4063             CPUID_7_0_EBX_ADX | CPUID_7_0_EBX_SMAP | CPUID_7_0_EBX_CLFLUSHOPT,
4064         /*
4065          * Missing: XSAVES (not supported by some Linux versions,
4066          * including v4.1 to v4.12).
4067          * KVM doesn't yet expose any XSAVES state save component.
4068          */
4069         .features[FEAT_XSAVE] =
4070             CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC |
4071             CPUID_XSAVE_XGETBV1,
4072         .features[FEAT_6_EAX] =
4073             CPUID_6_EAX_ARAT,
4074         .features[FEAT_SVM] =
4075             CPUID_SVM_NPT | CPUID_SVM_NRIPSAVE,
4076         .xlevel = 0x8000001E,
4077         .model_id = "Hygon Dhyana Processor",
4078         .cache_info = &epyc_cache_info,
4079     },
4080     {
4081         .name = "EPYC-Rome",
4082         .level = 0xd,
4083         .vendor = CPUID_VENDOR_AMD,
4084         .family = 23,
4085         .model = 49,
4086         .stepping = 0,
4087         .features[FEAT_1_EDX] =
4088             CPUID_SSE2 | CPUID_SSE | CPUID_FXSR | CPUID_MMX | CPUID_CLFLUSH |
4089             CPUID_PSE36 | CPUID_PAT | CPUID_CMOV | CPUID_MCA | CPUID_PGE |
4090             CPUID_MTRR | CPUID_SEP | CPUID_APIC | CPUID_CX8 | CPUID_MCE |
4091             CPUID_PAE | CPUID_MSR | CPUID_TSC | CPUID_PSE | CPUID_DE |
4092             CPUID_VME | CPUID_FP87,
4093         .features[FEAT_1_ECX] =
4094             CPUID_EXT_RDRAND | CPUID_EXT_F16C | CPUID_EXT_AVX |
4095             CPUID_EXT_XSAVE | CPUID_EXT_AES |  CPUID_EXT_POPCNT |
4096             CPUID_EXT_MOVBE | CPUID_EXT_SSE42 | CPUID_EXT_SSE41 |
4097             CPUID_EXT_CX16 | CPUID_EXT_FMA | CPUID_EXT_SSSE3 |
4098             CPUID_EXT_MONITOR | CPUID_EXT_PCLMULQDQ | CPUID_EXT_SSE3,
4099         .features[FEAT_8000_0001_EDX] =
4100             CPUID_EXT2_LM | CPUID_EXT2_RDTSCP | CPUID_EXT2_PDPE1GB |
4101             CPUID_EXT2_FFXSR | CPUID_EXT2_MMXEXT | CPUID_EXT2_NX |
4102             CPUID_EXT2_SYSCALL,
4103         .features[FEAT_8000_0001_ECX] =
4104             CPUID_EXT3_OSVW | CPUID_EXT3_3DNOWPREFETCH |
4105             CPUID_EXT3_MISALIGNSSE | CPUID_EXT3_SSE4A | CPUID_EXT3_ABM |
4106             CPUID_EXT3_CR8LEG | CPUID_EXT3_SVM | CPUID_EXT3_LAHF_LM |
4107             CPUID_EXT3_TOPOEXT | CPUID_EXT3_PERFCORE,
4108         .features[FEAT_8000_0008_EBX] =
4109             CPUID_8000_0008_EBX_CLZERO | CPUID_8000_0008_EBX_XSAVEERPTR |
4110             CPUID_8000_0008_EBX_WBNOINVD | CPUID_8000_0008_EBX_IBPB |
4111             CPUID_8000_0008_EBX_STIBP,
4112         .features[FEAT_7_0_EBX] =
4113             CPUID_7_0_EBX_FSGSBASE | CPUID_7_0_EBX_BMI1 | CPUID_7_0_EBX_AVX2 |
4114             CPUID_7_0_EBX_SMEP | CPUID_7_0_EBX_BMI2 | CPUID_7_0_EBX_RDSEED |
4115             CPUID_7_0_EBX_ADX | CPUID_7_0_EBX_SMAP | CPUID_7_0_EBX_CLFLUSHOPT |
4116             CPUID_7_0_EBX_SHA_NI | CPUID_7_0_EBX_CLWB,
4117         .features[FEAT_7_0_ECX] =
4118             CPUID_7_0_ECX_UMIP | CPUID_7_0_ECX_RDPID,
4119         .features[FEAT_XSAVE] =
4120             CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC |
4121             CPUID_XSAVE_XGETBV1 | CPUID_XSAVE_XSAVES,
4122         .features[FEAT_6_EAX] =
4123             CPUID_6_EAX_ARAT,
4124         .features[FEAT_SVM] =
4125             CPUID_SVM_NPT | CPUID_SVM_NRIPSAVE,
4126         .xlevel = 0x8000001E,
4127         .model_id = "AMD EPYC-Rome Processor",
4128         .cache_info = &epyc_rome_cache_info,
4129     },
4130 };
4131 
4132 /* KVM-specific features that are automatically added/removed
4133  * from all CPU models when KVM is enabled.
4134  */
4135 static PropValue kvm_default_props[] = {
4136     { "kvmclock", "on" },
4137     { "kvm-nopiodelay", "on" },
4138     { "kvm-asyncpf", "on" },
4139     { "kvm-steal-time", "on" },
4140     { "kvm-pv-eoi", "on" },
4141     { "kvmclock-stable-bit", "on" },
4142     { "x2apic", "on" },
4143     { "kvm-msi-ext-dest-id", "off" },
4144     { "acpi", "off" },
4145     { "monitor", "off" },
4146     { "svm", "off" },
4147     { NULL, NULL },
4148 };
4149 
4150 /* TCG-specific defaults that override all CPU models when using TCG
4151  */
4152 static PropValue tcg_default_props[] = {
4153     { "vme", "off" },
4154     { NULL, NULL },
4155 };
4156 
4157 
4158 /*
4159  * We resolve CPU model aliases using -v1 when using "-machine
4160  * none", but this is just for compatibility while libvirt isn't
4161  * adapted to resolve CPU model versions before creating VMs.
4162  * See "Runnability guarantee of CPU models" at
4163  * docs/system/deprecated.rst.
4164  */
4165 X86CPUVersion default_cpu_version = 1;
4166 
4167 void x86_cpu_set_default_version(X86CPUVersion version)
4168 {
4169     /* Translating CPU_VERSION_AUTO to CPU_VERSION_AUTO doesn't make sense */
4170     assert(version != CPU_VERSION_AUTO);
4171     default_cpu_version = version;
4172 }
4173 
4174 static X86CPUVersion x86_cpu_model_last_version(const X86CPUModel *model)
4175 {
4176     int v = 0;
4177     const X86CPUVersionDefinition *vdef =
4178         x86_cpu_def_get_versions(model->cpudef);
4179     while (vdef->version) {
4180         v = vdef->version;
4181         vdef++;
4182     }
4183     return v;
4184 }
4185 
4186 /* Return the actual version being used for a specific CPU model */
4187 static X86CPUVersion x86_cpu_model_resolve_version(const X86CPUModel *model)
4188 {
4189     X86CPUVersion v = model->version;
4190     if (v == CPU_VERSION_AUTO) {
4191         v = default_cpu_version;
4192     }
4193     if (v == CPU_VERSION_LATEST) {
4194         return x86_cpu_model_last_version(model);
4195     }
4196     return v;
4197 }
4198 
4199 void x86_cpu_change_kvm_default(const char *prop, const char *value)
4200 {
4201     PropValue *pv;
4202     for (pv = kvm_default_props; pv->prop; pv++) {
4203         if (!strcmp(pv->prop, prop)) {
4204             pv->value = value;
4205             break;
4206         }
4207     }
4208 
4209     /* It is valid to call this function only for properties that
4210      * are already present in the kvm_default_props table.
4211      */
4212     assert(pv->prop);
4213 }
4214 
4215 static bool lmce_supported(void)
4216 {
4217     uint64_t mce_cap = 0;
4218 
4219 #ifdef CONFIG_KVM
4220     if (kvm_ioctl(kvm_state, KVM_X86_GET_MCE_CAP_SUPPORTED, &mce_cap) < 0) {
4221         return false;
4222     }
4223 #endif
4224 
4225     return !!(mce_cap & MCG_LMCE_P);
4226 }
4227 
4228 #define CPUID_MODEL_ID_SZ 48
4229 
4230 /**
4231  * cpu_x86_fill_model_id:
4232  * Get CPUID model ID string from host CPU.
4233  *
4234  * @str should have at least CPUID_MODEL_ID_SZ bytes
4235  *
4236  * The function does NOT add a null terminator to the string
4237  * automatically.
4238  */
4239 static int cpu_x86_fill_model_id(char *str)
4240 {
4241     uint32_t eax = 0, ebx = 0, ecx = 0, edx = 0;
4242     int i;
4243 
4244     for (i = 0; i < 3; i++) {
4245         host_cpuid(0x80000002 + i, 0, &eax, &ebx, &ecx, &edx);
4246         memcpy(str + i * 16 +  0, &eax, 4);
4247         memcpy(str + i * 16 +  4, &ebx, 4);
4248         memcpy(str + i * 16 +  8, &ecx, 4);
4249         memcpy(str + i * 16 + 12, &edx, 4);
4250     }
4251     return 0;
4252 }
4253 
4254 static Property max_x86_cpu_properties[] = {
4255     DEFINE_PROP_BOOL("migratable", X86CPU, migratable, true),
4256     DEFINE_PROP_BOOL("host-cache-info", X86CPU, cache_info_passthrough, false),
4257     DEFINE_PROP_END_OF_LIST()
4258 };
4259 
4260 static void max_x86_cpu_class_init(ObjectClass *oc, void *data)
4261 {
4262     DeviceClass *dc = DEVICE_CLASS(oc);
4263     X86CPUClass *xcc = X86_CPU_CLASS(oc);
4264 
4265     xcc->ordering = 9;
4266 
4267     xcc->model_description =
4268         "Enables all features supported by the accelerator in the current host";
4269 
4270     device_class_set_props(dc, max_x86_cpu_properties);
4271 }
4272 
4273 static void max_x86_cpu_initfn(Object *obj)
4274 {
4275     X86CPU *cpu = X86_CPU(obj);
4276     CPUX86State *env = &cpu->env;
4277     KVMState *s = kvm_state;
4278 
4279     /* We can't fill the features array here because we don't know yet if
4280      * "migratable" is true or false.
4281      */
4282     cpu->max_features = true;
4283 
4284     if (accel_uses_host_cpuid()) {
4285         char vendor[CPUID_VENDOR_SZ + 1] = { 0 };
4286         char model_id[CPUID_MODEL_ID_SZ + 1] = { 0 };
4287         int family, model, stepping;
4288 
4289         host_vendor_fms(vendor, &family, &model, &stepping);
4290         cpu_x86_fill_model_id(model_id);
4291 
4292         object_property_set_str(OBJECT(cpu), "vendor", vendor, &error_abort);
4293         object_property_set_int(OBJECT(cpu), "family", family, &error_abort);
4294         object_property_set_int(OBJECT(cpu), "model", model, &error_abort);
4295         object_property_set_int(OBJECT(cpu), "stepping", stepping,
4296                                 &error_abort);
4297         object_property_set_str(OBJECT(cpu), "model-id", model_id,
4298                                 &error_abort);
4299 
4300         if (kvm_enabled()) {
4301             env->cpuid_min_level =
4302                 kvm_arch_get_supported_cpuid(s, 0x0, 0, R_EAX);
4303             env->cpuid_min_xlevel =
4304                 kvm_arch_get_supported_cpuid(s, 0x80000000, 0, R_EAX);
4305             env->cpuid_min_xlevel2 =
4306                 kvm_arch_get_supported_cpuid(s, 0xC0000000, 0, R_EAX);
4307         } else {
4308             env->cpuid_min_level =
4309                 hvf_get_supported_cpuid(0x0, 0, R_EAX);
4310             env->cpuid_min_xlevel =
4311                 hvf_get_supported_cpuid(0x80000000, 0, R_EAX);
4312             env->cpuid_min_xlevel2 =
4313                 hvf_get_supported_cpuid(0xC0000000, 0, R_EAX);
4314         }
4315 
4316         if (lmce_supported()) {
4317             object_property_set_bool(OBJECT(cpu), "lmce", true, &error_abort);
4318         }
4319     } else {
4320         object_property_set_str(OBJECT(cpu), "vendor", CPUID_VENDOR_AMD,
4321                                 &error_abort);
4322         object_property_set_int(OBJECT(cpu), "family", 6, &error_abort);
4323         object_property_set_int(OBJECT(cpu), "model", 6, &error_abort);
4324         object_property_set_int(OBJECT(cpu), "stepping", 3, &error_abort);
4325         object_property_set_str(OBJECT(cpu), "model-id",
4326                                 "QEMU TCG CPU version " QEMU_HW_VERSION,
4327                                 &error_abort);
4328     }
4329 
4330     object_property_set_bool(OBJECT(cpu), "pmu", true, &error_abort);
4331 }
4332 
4333 static const TypeInfo max_x86_cpu_type_info = {
4334     .name = X86_CPU_TYPE_NAME("max"),
4335     .parent = TYPE_X86_CPU,
4336     .instance_init = max_x86_cpu_initfn,
4337     .class_init = max_x86_cpu_class_init,
4338 };
4339 
4340 #if defined(CONFIG_KVM) || defined(CONFIG_HVF)
4341 static void host_x86_cpu_class_init(ObjectClass *oc, void *data)
4342 {
4343     X86CPUClass *xcc = X86_CPU_CLASS(oc);
4344 
4345     xcc->host_cpuid_required = true;
4346     xcc->ordering = 8;
4347 
4348 #if defined(CONFIG_KVM)
4349     xcc->model_description =
4350         "KVM processor with all supported host features ";
4351 #elif defined(CONFIG_HVF)
4352     xcc->model_description =
4353         "HVF processor with all supported host features ";
4354 #endif
4355 }
4356 
4357 static const TypeInfo host_x86_cpu_type_info = {
4358     .name = X86_CPU_TYPE_NAME("host"),
4359     .parent = X86_CPU_TYPE_NAME("max"),
4360     .class_init = host_x86_cpu_class_init,
4361 };
4362 
4363 #endif
4364 
4365 static char *feature_word_description(FeatureWordInfo *f, uint32_t bit)
4366 {
4367     assert(f->type == CPUID_FEATURE_WORD || f->type == MSR_FEATURE_WORD);
4368 
4369     switch (f->type) {
4370     case CPUID_FEATURE_WORD:
4371         {
4372             const char *reg = get_register_name_32(f->cpuid.reg);
4373             assert(reg);
4374             return g_strdup_printf("CPUID.%02XH:%s",
4375                                    f->cpuid.eax, reg);
4376         }
4377     case MSR_FEATURE_WORD:
4378         return g_strdup_printf("MSR(%02XH)",
4379                                f->msr.index);
4380     }
4381 
4382     return NULL;
4383 }
4384 
4385 static bool x86_cpu_have_filtered_features(X86CPU *cpu)
4386 {
4387     FeatureWord w;
4388 
4389     for (w = 0; w < FEATURE_WORDS; w++) {
4390         if (cpu->filtered_features[w]) {
4391             return true;
4392         }
4393     }
4394 
4395     return false;
4396 }
4397 
4398 static void mark_unavailable_features(X86CPU *cpu, FeatureWord w, uint64_t mask,
4399                                       const char *verbose_prefix)
4400 {
4401     CPUX86State *env = &cpu->env;
4402     FeatureWordInfo *f = &feature_word_info[w];
4403     int i;
4404 
4405     if (!cpu->force_features) {
4406         env->features[w] &= ~mask;
4407     }
4408     cpu->filtered_features[w] |= mask;
4409 
4410     if (!verbose_prefix) {
4411         return;
4412     }
4413 
4414     for (i = 0; i < 64; ++i) {
4415         if ((1ULL << i) & mask) {
4416             g_autofree char *feat_word_str = feature_word_description(f, i);
4417             warn_report("%s: %s%s%s [bit %d]",
4418                         verbose_prefix,
4419                         feat_word_str,
4420                         f->feat_names[i] ? "." : "",
4421                         f->feat_names[i] ? f->feat_names[i] : "", i);
4422         }
4423     }
4424 }
4425 
4426 static void x86_cpuid_version_get_family(Object *obj, Visitor *v,
4427                                          const char *name, void *opaque,
4428                                          Error **errp)
4429 {
4430     X86CPU *cpu = X86_CPU(obj);
4431     CPUX86State *env = &cpu->env;
4432     int64_t value;
4433 
4434     value = (env->cpuid_version >> 8) & 0xf;
4435     if (value == 0xf) {
4436         value += (env->cpuid_version >> 20) & 0xff;
4437     }
4438     visit_type_int(v, name, &value, errp);
4439 }
4440 
4441 static void x86_cpuid_version_set_family(Object *obj, Visitor *v,
4442                                          const char *name, void *opaque,
4443                                          Error **errp)
4444 {
4445     X86CPU *cpu = X86_CPU(obj);
4446     CPUX86State *env = &cpu->env;
4447     const int64_t min = 0;
4448     const int64_t max = 0xff + 0xf;
4449     int64_t value;
4450 
4451     if (!visit_type_int(v, name, &value, errp)) {
4452         return;
4453     }
4454     if (value < min || value > max) {
4455         error_setg(errp, QERR_PROPERTY_VALUE_OUT_OF_RANGE, "",
4456                    name ? name : "null", value, min, max);
4457         return;
4458     }
4459 
4460     env->cpuid_version &= ~0xff00f00;
4461     if (value > 0x0f) {
4462         env->cpuid_version |= 0xf00 | ((value - 0x0f) << 20);
4463     } else {
4464         env->cpuid_version |= value << 8;
4465     }
4466 }
4467 
4468 static void x86_cpuid_version_get_model(Object *obj, Visitor *v,
4469                                         const char *name, void *opaque,
4470                                         Error **errp)
4471 {
4472     X86CPU *cpu = X86_CPU(obj);
4473     CPUX86State *env = &cpu->env;
4474     int64_t value;
4475 
4476     value = (env->cpuid_version >> 4) & 0xf;
4477     value |= ((env->cpuid_version >> 16) & 0xf) << 4;
4478     visit_type_int(v, name, &value, errp);
4479 }
4480 
4481 static void x86_cpuid_version_set_model(Object *obj, Visitor *v,
4482                                         const char *name, void *opaque,
4483                                         Error **errp)
4484 {
4485     X86CPU *cpu = X86_CPU(obj);
4486     CPUX86State *env = &cpu->env;
4487     const int64_t min = 0;
4488     const int64_t max = 0xff;
4489     int64_t value;
4490 
4491     if (!visit_type_int(v, name, &value, errp)) {
4492         return;
4493     }
4494     if (value < min || value > max) {
4495         error_setg(errp, QERR_PROPERTY_VALUE_OUT_OF_RANGE, "",
4496                    name ? name : "null", value, min, max);
4497         return;
4498     }
4499 
4500     env->cpuid_version &= ~0xf00f0;
4501     env->cpuid_version |= ((value & 0xf) << 4) | ((value >> 4) << 16);
4502 }
4503 
4504 static void x86_cpuid_version_get_stepping(Object *obj, Visitor *v,
4505                                            const char *name, void *opaque,
4506                                            Error **errp)
4507 {
4508     X86CPU *cpu = X86_CPU(obj);
4509     CPUX86State *env = &cpu->env;
4510     int64_t value;
4511 
4512     value = env->cpuid_version & 0xf;
4513     visit_type_int(v, name, &value, errp);
4514 }
4515 
4516 static void x86_cpuid_version_set_stepping(Object *obj, Visitor *v,
4517                                            const char *name, void *opaque,
4518                                            Error **errp)
4519 {
4520     X86CPU *cpu = X86_CPU(obj);
4521     CPUX86State *env = &cpu->env;
4522     const int64_t min = 0;
4523     const int64_t max = 0xf;
4524     int64_t value;
4525 
4526     if (!visit_type_int(v, name, &value, errp)) {
4527         return;
4528     }
4529     if (value < min || value > max) {
4530         error_setg(errp, QERR_PROPERTY_VALUE_OUT_OF_RANGE, "",
4531                    name ? name : "null", value, min, max);
4532         return;
4533     }
4534 
4535     env->cpuid_version &= ~0xf;
4536     env->cpuid_version |= value & 0xf;
4537 }
4538 
4539 static char *x86_cpuid_get_vendor(Object *obj, Error **errp)
4540 {
4541     X86CPU *cpu = X86_CPU(obj);
4542     CPUX86State *env = &cpu->env;
4543     char *value;
4544 
4545     value = g_malloc(CPUID_VENDOR_SZ + 1);
4546     x86_cpu_vendor_words2str(value, env->cpuid_vendor1, env->cpuid_vendor2,
4547                              env->cpuid_vendor3);
4548     return value;
4549 }
4550 
4551 static void x86_cpuid_set_vendor(Object *obj, const char *value,
4552                                  Error **errp)
4553 {
4554     X86CPU *cpu = X86_CPU(obj);
4555     CPUX86State *env = &cpu->env;
4556     int i;
4557 
4558     if (strlen(value) != CPUID_VENDOR_SZ) {
4559         error_setg(errp, QERR_PROPERTY_VALUE_BAD, "", "vendor", value);
4560         return;
4561     }
4562 
4563     env->cpuid_vendor1 = 0;
4564     env->cpuid_vendor2 = 0;
4565     env->cpuid_vendor3 = 0;
4566     for (i = 0; i < 4; i++) {
4567         env->cpuid_vendor1 |= ((uint8_t)value[i    ]) << (8 * i);
4568         env->cpuid_vendor2 |= ((uint8_t)value[i + 4]) << (8 * i);
4569         env->cpuid_vendor3 |= ((uint8_t)value[i + 8]) << (8 * i);
4570     }
4571 }
4572 
4573 static char *x86_cpuid_get_model_id(Object *obj, Error **errp)
4574 {
4575     X86CPU *cpu = X86_CPU(obj);
4576     CPUX86State *env = &cpu->env;
4577     char *value;
4578     int i;
4579 
4580     value = g_malloc(48 + 1);
4581     for (i = 0; i < 48; i++) {
4582         value[i] = env->cpuid_model[i >> 2] >> (8 * (i & 3));
4583     }
4584     value[48] = '\0';
4585     return value;
4586 }
4587 
4588 static void x86_cpuid_set_model_id(Object *obj, const char *model_id,
4589                                    Error **errp)
4590 {
4591     X86CPU *cpu = X86_CPU(obj);
4592     CPUX86State *env = &cpu->env;
4593     int c, len, i;
4594 
4595     if (model_id == NULL) {
4596         model_id = "";
4597     }
4598     len = strlen(model_id);
4599     memset(env->cpuid_model, 0, 48);
4600     for (i = 0; i < 48; i++) {
4601         if (i >= len) {
4602             c = '\0';
4603         } else {
4604             c = (uint8_t)model_id[i];
4605         }
4606         env->cpuid_model[i >> 2] |= c << (8 * (i & 3));
4607     }
4608 }
4609 
4610 static void x86_cpuid_get_tsc_freq(Object *obj, Visitor *v, const char *name,
4611                                    void *opaque, Error **errp)
4612 {
4613     X86CPU *cpu = X86_CPU(obj);
4614     int64_t value;
4615 
4616     value = cpu->env.tsc_khz * 1000;
4617     visit_type_int(v, name, &value, errp);
4618 }
4619 
4620 static void x86_cpuid_set_tsc_freq(Object *obj, Visitor *v, const char *name,
4621                                    void *opaque, Error **errp)
4622 {
4623     X86CPU *cpu = X86_CPU(obj);
4624     const int64_t min = 0;
4625     const int64_t max = INT64_MAX;
4626     int64_t value;
4627 
4628     if (!visit_type_int(v, name, &value, errp)) {
4629         return;
4630     }
4631     if (value < min || value > max) {
4632         error_setg(errp, QERR_PROPERTY_VALUE_OUT_OF_RANGE, "",
4633                    name ? name : "null", value, min, max);
4634         return;
4635     }
4636 
4637     cpu->env.tsc_khz = cpu->env.user_tsc_khz = value / 1000;
4638 }
4639 
4640 /* Generic getter for "feature-words" and "filtered-features" properties */
4641 static void x86_cpu_get_feature_words(Object *obj, Visitor *v,
4642                                       const char *name, void *opaque,
4643                                       Error **errp)
4644 {
4645     uint64_t *array = (uint64_t *)opaque;
4646     FeatureWord w;
4647     X86CPUFeatureWordInfo word_infos[FEATURE_WORDS] = { };
4648     X86CPUFeatureWordInfoList list_entries[FEATURE_WORDS] = { };
4649     X86CPUFeatureWordInfoList *list = NULL;
4650 
4651     for (w = 0; w < FEATURE_WORDS; w++) {
4652         FeatureWordInfo *wi = &feature_word_info[w];
4653         /*
4654                 * We didn't have MSR features when "feature-words" was
4655                 *  introduced. Therefore skipped other type entries.
4656                 */
4657         if (wi->type != CPUID_FEATURE_WORD) {
4658             continue;
4659         }
4660         X86CPUFeatureWordInfo *qwi = &word_infos[w];
4661         qwi->cpuid_input_eax = wi->cpuid.eax;
4662         qwi->has_cpuid_input_ecx = wi->cpuid.needs_ecx;
4663         qwi->cpuid_input_ecx = wi->cpuid.ecx;
4664         qwi->cpuid_register = x86_reg_info_32[wi->cpuid.reg].qapi_enum;
4665         qwi->features = array[w];
4666 
4667         /* List will be in reverse order, but order shouldn't matter */
4668         list_entries[w].next = list;
4669         list_entries[w].value = &word_infos[w];
4670         list = &list_entries[w];
4671     }
4672 
4673     visit_type_X86CPUFeatureWordInfoList(v, "feature-words", &list, errp);
4674 }
4675 
4676 /* Convert all '_' in a feature string option name to '-', to make feature
4677  * name conform to QOM property naming rule, which uses '-' instead of '_'.
4678  */
4679 static inline void feat2prop(char *s)
4680 {
4681     while ((s = strchr(s, '_'))) {
4682         *s = '-';
4683     }
4684 }
4685 
4686 /* Return the feature property name for a feature flag bit */
4687 static const char *x86_cpu_feature_name(FeatureWord w, int bitnr)
4688 {
4689     const char *name;
4690     /* XSAVE components are automatically enabled by other features,
4691      * so return the original feature name instead
4692      */
4693     if (w == FEAT_XSAVE_COMP_LO || w == FEAT_XSAVE_COMP_HI) {
4694         int comp = (w == FEAT_XSAVE_COMP_HI) ? bitnr + 32 : bitnr;
4695 
4696         if (comp < ARRAY_SIZE(x86_ext_save_areas) &&
4697             x86_ext_save_areas[comp].bits) {
4698             w = x86_ext_save_areas[comp].feature;
4699             bitnr = ctz32(x86_ext_save_areas[comp].bits);
4700         }
4701     }
4702 
4703     assert(bitnr < 64);
4704     assert(w < FEATURE_WORDS);
4705     name = feature_word_info[w].feat_names[bitnr];
4706     assert(bitnr < 32 || !(name && feature_word_info[w].type == CPUID_FEATURE_WORD));
4707     return name;
4708 }
4709 
4710 /* Compatibily hack to maintain legacy +-feat semantic,
4711  * where +-feat overwrites any feature set by
4712  * feat=on|feat even if the later is parsed after +-feat
4713  * (i.e. "-x2apic,x2apic=on" will result in x2apic disabled)
4714  */
4715 static GList *plus_features, *minus_features;
4716 
4717 static gint compare_string(gconstpointer a, gconstpointer b)
4718 {
4719     return g_strcmp0(a, b);
4720 }
4721 
4722 /* Parse "+feature,-feature,feature=foo" CPU feature string
4723  */
4724 static void x86_cpu_parse_featurestr(const char *typename, char *features,
4725                                      Error **errp)
4726 {
4727     char *featurestr; /* Single 'key=value" string being parsed */
4728     static bool cpu_globals_initialized;
4729     bool ambiguous = false;
4730 
4731     if (cpu_globals_initialized) {
4732         return;
4733     }
4734     cpu_globals_initialized = true;
4735 
4736     if (!features) {
4737         return;
4738     }
4739 
4740     for (featurestr = strtok(features, ",");
4741          featurestr;
4742          featurestr = strtok(NULL, ",")) {
4743         const char *name;
4744         const char *val = NULL;
4745         char *eq = NULL;
4746         char num[32];
4747         GlobalProperty *prop;
4748 
4749         /* Compatibility syntax: */
4750         if (featurestr[0] == '+') {
4751             plus_features = g_list_append(plus_features,
4752                                           g_strdup(featurestr + 1));
4753             continue;
4754         } else if (featurestr[0] == '-') {
4755             minus_features = g_list_append(minus_features,
4756                                            g_strdup(featurestr + 1));
4757             continue;
4758         }
4759 
4760         eq = strchr(featurestr, '=');
4761         if (eq) {
4762             *eq++ = 0;
4763             val = eq;
4764         } else {
4765             val = "on";
4766         }
4767 
4768         feat2prop(featurestr);
4769         name = featurestr;
4770 
4771         if (g_list_find_custom(plus_features, name, compare_string)) {
4772             warn_report("Ambiguous CPU model string. "
4773                         "Don't mix both \"+%s\" and \"%s=%s\"",
4774                         name, name, val);
4775             ambiguous = true;
4776         }
4777         if (g_list_find_custom(minus_features, name, compare_string)) {
4778             warn_report("Ambiguous CPU model string. "
4779                         "Don't mix both \"-%s\" and \"%s=%s\"",
4780                         name, name, val);
4781             ambiguous = true;
4782         }
4783 
4784         /* Special case: */
4785         if (!strcmp(name, "tsc-freq")) {
4786             int ret;
4787             uint64_t tsc_freq;
4788 
4789             ret = qemu_strtosz_metric(val, NULL, &tsc_freq);
4790             if (ret < 0 || tsc_freq > INT64_MAX) {
4791                 error_setg(errp, "bad numerical value %s", val);
4792                 return;
4793             }
4794             snprintf(num, sizeof(num), "%" PRId64, tsc_freq);
4795             val = num;
4796             name = "tsc-frequency";
4797         }
4798 
4799         prop = g_new0(typeof(*prop), 1);
4800         prop->driver = typename;
4801         prop->property = g_strdup(name);
4802         prop->value = g_strdup(val);
4803         qdev_prop_register_global(prop);
4804     }
4805 
4806     if (ambiguous) {
4807         warn_report("Compatibility of ambiguous CPU model "
4808                     "strings won't be kept on future QEMU versions");
4809     }
4810 }
4811 
4812 static void x86_cpu_expand_features(X86CPU *cpu, Error **errp);
4813 static void x86_cpu_filter_features(X86CPU *cpu, bool verbose);
4814 
4815 /* Build a list with the name of all features on a feature word array */
4816 static void x86_cpu_list_feature_names(FeatureWordArray features,
4817                                        strList **feat_names)
4818 {
4819     FeatureWord w;
4820     strList **next = feat_names;
4821 
4822     for (w = 0; w < FEATURE_WORDS; w++) {
4823         uint64_t filtered = features[w];
4824         int i;
4825         for (i = 0; i < 64; i++) {
4826             if (filtered & (1ULL << i)) {
4827                 strList *new = g_new0(strList, 1);
4828                 new->value = g_strdup(x86_cpu_feature_name(w, i));
4829                 *next = new;
4830                 next = &new->next;
4831             }
4832         }
4833     }
4834 }
4835 
4836 static void x86_cpu_get_unavailable_features(Object *obj, Visitor *v,
4837                                              const char *name, void *opaque,
4838                                              Error **errp)
4839 {
4840     X86CPU *xc = X86_CPU(obj);
4841     strList *result = NULL;
4842 
4843     x86_cpu_list_feature_names(xc->filtered_features, &result);
4844     visit_type_strList(v, "unavailable-features", &result, errp);
4845 }
4846 
4847 /* Check for missing features that may prevent the CPU class from
4848  * running using the current machine and accelerator.
4849  */
4850 static void x86_cpu_class_check_missing_features(X86CPUClass *xcc,
4851                                                  strList **missing_feats)
4852 {
4853     X86CPU *xc;
4854     Error *err = NULL;
4855     strList **next = missing_feats;
4856 
4857     if (xcc->host_cpuid_required && !accel_uses_host_cpuid()) {
4858         strList *new = g_new0(strList, 1);
4859         new->value = g_strdup("kvm");
4860         *missing_feats = new;
4861         return;
4862     }
4863 
4864     xc = X86_CPU(object_new_with_class(OBJECT_CLASS(xcc)));
4865 
4866     x86_cpu_expand_features(xc, &err);
4867     if (err) {
4868         /* Errors at x86_cpu_expand_features should never happen,
4869          * but in case it does, just report the model as not
4870          * runnable at all using the "type" property.
4871          */
4872         strList *new = g_new0(strList, 1);
4873         new->value = g_strdup("type");
4874         *next = new;
4875         next = &new->next;
4876         error_free(err);
4877     }
4878 
4879     x86_cpu_filter_features(xc, false);
4880 
4881     x86_cpu_list_feature_names(xc->filtered_features, next);
4882 
4883     object_unref(OBJECT(xc));
4884 }
4885 
4886 /* Print all cpuid feature names in featureset
4887  */
4888 static void listflags(GList *features)
4889 {
4890     size_t len = 0;
4891     GList *tmp;
4892 
4893     for (tmp = features; tmp; tmp = tmp->next) {
4894         const char *name = tmp->data;
4895         if ((len + strlen(name) + 1) >= 75) {
4896             qemu_printf("\n");
4897             len = 0;
4898         }
4899         qemu_printf("%s%s", len == 0 ? "  " : " ", name);
4900         len += strlen(name) + 1;
4901     }
4902     qemu_printf("\n");
4903 }
4904 
4905 /* Sort alphabetically by type name, respecting X86CPUClass::ordering. */
4906 static gint x86_cpu_list_compare(gconstpointer a, gconstpointer b)
4907 {
4908     ObjectClass *class_a = (ObjectClass *)a;
4909     ObjectClass *class_b = (ObjectClass *)b;
4910     X86CPUClass *cc_a = X86_CPU_CLASS(class_a);
4911     X86CPUClass *cc_b = X86_CPU_CLASS(class_b);
4912     int ret;
4913 
4914     if (cc_a->ordering != cc_b->ordering) {
4915         ret = cc_a->ordering - cc_b->ordering;
4916     } else {
4917         g_autofree char *name_a = x86_cpu_class_get_model_name(cc_a);
4918         g_autofree char *name_b = x86_cpu_class_get_model_name(cc_b);
4919         ret = strcmp(name_a, name_b);
4920     }
4921     return ret;
4922 }
4923 
4924 static GSList *get_sorted_cpu_model_list(void)
4925 {
4926     GSList *list = object_class_get_list(TYPE_X86_CPU, false);
4927     list = g_slist_sort(list, x86_cpu_list_compare);
4928     return list;
4929 }
4930 
4931 static char *x86_cpu_class_get_model_id(X86CPUClass *xc)
4932 {
4933     Object *obj = object_new_with_class(OBJECT_CLASS(xc));
4934     char *r = object_property_get_str(obj, "model-id", &error_abort);
4935     object_unref(obj);
4936     return r;
4937 }
4938 
4939 static char *x86_cpu_class_get_alias_of(X86CPUClass *cc)
4940 {
4941     X86CPUVersion version;
4942 
4943     if (!cc->model || !cc->model->is_alias) {
4944         return NULL;
4945     }
4946     version = x86_cpu_model_resolve_version(cc->model);
4947     if (version <= 0) {
4948         return NULL;
4949     }
4950     return x86_cpu_versioned_model_name(cc->model->cpudef, version);
4951 }
4952 
4953 static void x86_cpu_list_entry(gpointer data, gpointer user_data)
4954 {
4955     ObjectClass *oc = data;
4956     X86CPUClass *cc = X86_CPU_CLASS(oc);
4957     g_autofree char *name = x86_cpu_class_get_model_name(cc);
4958     g_autofree char *desc = g_strdup(cc->model_description);
4959     g_autofree char *alias_of = x86_cpu_class_get_alias_of(cc);
4960     g_autofree char *model_id = x86_cpu_class_get_model_id(cc);
4961 
4962     if (!desc && alias_of) {
4963         if (cc->model && cc->model->version == CPU_VERSION_AUTO) {
4964             desc = g_strdup("(alias configured by machine type)");
4965         } else {
4966             desc = g_strdup_printf("(alias of %s)", alias_of);
4967         }
4968     }
4969     if (!desc && cc->model && cc->model->note) {
4970         desc = g_strdup_printf("%s [%s]", model_id, cc->model->note);
4971     }
4972     if (!desc) {
4973         desc = g_strdup_printf("%s", model_id);
4974     }
4975 
4976     qemu_printf("x86 %-20s  %-58s\n", name, desc);
4977 }
4978 
4979 /* list available CPU models and flags */
4980 void x86_cpu_list(void)
4981 {
4982     int i, j;
4983     GSList *list;
4984     GList *names = NULL;
4985 
4986     qemu_printf("Available CPUs:\n");
4987     list = get_sorted_cpu_model_list();
4988     g_slist_foreach(list, x86_cpu_list_entry, NULL);
4989     g_slist_free(list);
4990 
4991     names = NULL;
4992     for (i = 0; i < ARRAY_SIZE(feature_word_info); i++) {
4993         FeatureWordInfo *fw = &feature_word_info[i];
4994         for (j = 0; j < 64; j++) {
4995             if (fw->feat_names[j]) {
4996                 names = g_list_append(names, (gpointer)fw->feat_names[j]);
4997             }
4998         }
4999     }
5000 
5001     names = g_list_sort(names, (GCompareFunc)strcmp);
5002 
5003     qemu_printf("\nRecognized CPUID flags:\n");
5004     listflags(names);
5005     qemu_printf("\n");
5006     g_list_free(names);
5007 }
5008 
5009 static void x86_cpu_definition_entry(gpointer data, gpointer user_data)
5010 {
5011     ObjectClass *oc = data;
5012     X86CPUClass *cc = X86_CPU_CLASS(oc);
5013     CpuDefinitionInfoList **cpu_list = user_data;
5014     CpuDefinitionInfoList *entry;
5015     CpuDefinitionInfo *info;
5016 
5017     info = g_malloc0(sizeof(*info));
5018     info->name = x86_cpu_class_get_model_name(cc);
5019     x86_cpu_class_check_missing_features(cc, &info->unavailable_features);
5020     info->has_unavailable_features = true;
5021     info->q_typename = g_strdup(object_class_get_name(oc));
5022     info->migration_safe = cc->migration_safe;
5023     info->has_migration_safe = true;
5024     info->q_static = cc->static_model;
5025     if (cc->model && cc->model->cpudef->deprecation_note) {
5026         info->deprecated = true;
5027     } else {
5028         info->deprecated = false;
5029     }
5030     /*
5031      * Old machine types won't report aliases, so that alias translation
5032      * doesn't break compatibility with previous QEMU versions.
5033      */
5034     if (default_cpu_version != CPU_VERSION_LEGACY) {
5035         info->alias_of = x86_cpu_class_get_alias_of(cc);
5036         info->has_alias_of = !!info->alias_of;
5037     }
5038 
5039     entry = g_malloc0(sizeof(*entry));
5040     entry->value = info;
5041     entry->next = *cpu_list;
5042     *cpu_list = entry;
5043 }
5044 
5045 CpuDefinitionInfoList *qmp_query_cpu_definitions(Error **errp)
5046 {
5047     CpuDefinitionInfoList *cpu_list = NULL;
5048     GSList *list = get_sorted_cpu_model_list();
5049     g_slist_foreach(list, x86_cpu_definition_entry, &cpu_list);
5050     g_slist_free(list);
5051     return cpu_list;
5052 }
5053 
5054 static uint64_t x86_cpu_get_supported_feature_word(FeatureWord w,
5055                                                    bool migratable_only)
5056 {
5057     FeatureWordInfo *wi = &feature_word_info[w];
5058     uint64_t r = 0;
5059 
5060     if (kvm_enabled()) {
5061         switch (wi->type) {
5062         case CPUID_FEATURE_WORD:
5063             r = kvm_arch_get_supported_cpuid(kvm_state, wi->cpuid.eax,
5064                                                         wi->cpuid.ecx,
5065                                                         wi->cpuid.reg);
5066             break;
5067         case MSR_FEATURE_WORD:
5068             r = kvm_arch_get_supported_msr_feature(kvm_state,
5069                         wi->msr.index);
5070             break;
5071         }
5072     } else if (hvf_enabled()) {
5073         if (wi->type != CPUID_FEATURE_WORD) {
5074             return 0;
5075         }
5076         r = hvf_get_supported_cpuid(wi->cpuid.eax,
5077                                     wi->cpuid.ecx,
5078                                     wi->cpuid.reg);
5079     } else if (tcg_enabled()) {
5080         r = wi->tcg_features;
5081     } else {
5082         return ~0;
5083     }
5084     if (migratable_only) {
5085         r &= x86_cpu_get_migratable_flags(w);
5086     }
5087     return r;
5088 }
5089 
5090 static void x86_cpu_apply_props(X86CPU *cpu, PropValue *props)
5091 {
5092     PropValue *pv;
5093     for (pv = props; pv->prop; pv++) {
5094         if (!pv->value) {
5095             continue;
5096         }
5097         object_property_parse(OBJECT(cpu), pv->prop, pv->value,
5098                               &error_abort);
5099     }
5100 }
5101 
5102 /* Apply properties for the CPU model version specified in model */
5103 static void x86_cpu_apply_version_props(X86CPU *cpu, X86CPUModel *model)
5104 {
5105     const X86CPUVersionDefinition *vdef;
5106     X86CPUVersion version = x86_cpu_model_resolve_version(model);
5107 
5108     if (version == CPU_VERSION_LEGACY) {
5109         return;
5110     }
5111 
5112     for (vdef = x86_cpu_def_get_versions(model->cpudef); vdef->version; vdef++) {
5113         PropValue *p;
5114 
5115         for (p = vdef->props; p && p->prop; p++) {
5116             object_property_parse(OBJECT(cpu), p->prop, p->value,
5117                                   &error_abort);
5118         }
5119 
5120         if (vdef->version == version) {
5121             break;
5122         }
5123     }
5124 
5125     /*
5126      * If we reached the end of the list, version number was invalid
5127      */
5128     assert(vdef->version == version);
5129 }
5130 
5131 /* Load data from X86CPUDefinition into a X86CPU object
5132  */
5133 static void x86_cpu_load_model(X86CPU *cpu, X86CPUModel *model)
5134 {
5135     X86CPUDefinition *def = model->cpudef;
5136     CPUX86State *env = &cpu->env;
5137     const char *vendor;
5138     char host_vendor[CPUID_VENDOR_SZ + 1];
5139     FeatureWord w;
5140 
5141     /*NOTE: any property set by this function should be returned by
5142      * x86_cpu_static_props(), so static expansion of
5143      * query-cpu-model-expansion is always complete.
5144      */
5145 
5146     /* CPU models only set _minimum_ values for level/xlevel: */
5147     object_property_set_uint(OBJECT(cpu), "min-level", def->level,
5148                              &error_abort);
5149     object_property_set_uint(OBJECT(cpu), "min-xlevel", def->xlevel,
5150                              &error_abort);
5151 
5152     object_property_set_int(OBJECT(cpu), "family", def->family, &error_abort);
5153     object_property_set_int(OBJECT(cpu), "model", def->model, &error_abort);
5154     object_property_set_int(OBJECT(cpu), "stepping", def->stepping,
5155                             &error_abort);
5156     object_property_set_str(OBJECT(cpu), "model-id", def->model_id,
5157                             &error_abort);
5158     for (w = 0; w < FEATURE_WORDS; w++) {
5159         env->features[w] = def->features[w];
5160     }
5161 
5162     /* legacy-cache defaults to 'off' if CPU model provides cache info */
5163     cpu->legacy_cache = !def->cache_info;
5164 
5165     /* Special cases not set in the X86CPUDefinition structs: */
5166     /* TODO: in-kernel irqchip for hvf */
5167     if (kvm_enabled()) {
5168         if (!kvm_irqchip_in_kernel()) {
5169             x86_cpu_change_kvm_default("x2apic", "off");
5170         } else if (kvm_irqchip_is_split() && kvm_enable_x2apic()) {
5171             x86_cpu_change_kvm_default("kvm-msi-ext-dest-id", "on");
5172         }
5173 
5174         x86_cpu_apply_props(cpu, kvm_default_props);
5175     } else if (tcg_enabled()) {
5176         x86_cpu_apply_props(cpu, tcg_default_props);
5177     }
5178 
5179     env->features[FEAT_1_ECX] |= CPUID_EXT_HYPERVISOR;
5180 
5181     /* sysenter isn't supported in compatibility mode on AMD,
5182      * syscall isn't supported in compatibility mode on Intel.
5183      * Normally we advertise the actual CPU vendor, but you can
5184      * override this using the 'vendor' property if you want to use
5185      * KVM's sysenter/syscall emulation in compatibility mode and
5186      * when doing cross vendor migration
5187      */
5188     vendor = def->vendor;
5189     if (accel_uses_host_cpuid()) {
5190         uint32_t  ebx = 0, ecx = 0, edx = 0;
5191         host_cpuid(0, 0, NULL, &ebx, &ecx, &edx);
5192         x86_cpu_vendor_words2str(host_vendor, ebx, edx, ecx);
5193         vendor = host_vendor;
5194     }
5195 
5196     object_property_set_str(OBJECT(cpu), "vendor", vendor, &error_abort);
5197 
5198     x86_cpu_apply_version_props(cpu, model);
5199 
5200     /*
5201      * Properties in versioned CPU model are not user specified features.
5202      * We can simply clear env->user_features here since it will be filled later
5203      * in x86_cpu_expand_features() based on plus_features and minus_features.
5204      */
5205     memset(&env->user_features, 0, sizeof(env->user_features));
5206 }
5207 
5208 #ifndef CONFIG_USER_ONLY
5209 /* Return a QDict containing keys for all properties that can be included
5210  * in static expansion of CPU models. All properties set by x86_cpu_load_model()
5211  * must be included in the dictionary.
5212  */
5213 static QDict *x86_cpu_static_props(void)
5214 {
5215     FeatureWord w;
5216     int i;
5217     static const char *props[] = {
5218         "min-level",
5219         "min-xlevel",
5220         "family",
5221         "model",
5222         "stepping",
5223         "model-id",
5224         "vendor",
5225         "lmce",
5226         NULL,
5227     };
5228     static QDict *d;
5229 
5230     if (d) {
5231         return d;
5232     }
5233 
5234     d = qdict_new();
5235     for (i = 0; props[i]; i++) {
5236         qdict_put_null(d, props[i]);
5237     }
5238 
5239     for (w = 0; w < FEATURE_WORDS; w++) {
5240         FeatureWordInfo *fi = &feature_word_info[w];
5241         int bit;
5242         for (bit = 0; bit < 64; bit++) {
5243             if (!fi->feat_names[bit]) {
5244                 continue;
5245             }
5246             qdict_put_null(d, fi->feat_names[bit]);
5247         }
5248     }
5249 
5250     return d;
5251 }
5252 
5253 /* Add an entry to @props dict, with the value for property. */
5254 static void x86_cpu_expand_prop(X86CPU *cpu, QDict *props, const char *prop)
5255 {
5256     QObject *value = object_property_get_qobject(OBJECT(cpu), prop,
5257                                                  &error_abort);
5258 
5259     qdict_put_obj(props, prop, value);
5260 }
5261 
5262 /* Convert CPU model data from X86CPU object to a property dictionary
5263  * that can recreate exactly the same CPU model.
5264  */
5265 static void x86_cpu_to_dict(X86CPU *cpu, QDict *props)
5266 {
5267     QDict *sprops = x86_cpu_static_props();
5268     const QDictEntry *e;
5269 
5270     for (e = qdict_first(sprops); e; e = qdict_next(sprops, e)) {
5271         const char *prop = qdict_entry_key(e);
5272         x86_cpu_expand_prop(cpu, props, prop);
5273     }
5274 }
5275 
5276 /* Convert CPU model data from X86CPU object to a property dictionary
5277  * that can recreate exactly the same CPU model, including every
5278  * writeable QOM property.
5279  */
5280 static void x86_cpu_to_dict_full(X86CPU *cpu, QDict *props)
5281 {
5282     ObjectPropertyIterator iter;
5283     ObjectProperty *prop;
5284 
5285     object_property_iter_init(&iter, OBJECT(cpu));
5286     while ((prop = object_property_iter_next(&iter))) {
5287         /* skip read-only or write-only properties */
5288         if (!prop->get || !prop->set) {
5289             continue;
5290         }
5291 
5292         /* "hotplugged" is the only property that is configurable
5293          * on the command-line but will be set differently on CPUs
5294          * created using "-cpu ... -smp ..." and by CPUs created
5295          * on the fly by x86_cpu_from_model() for querying. Skip it.
5296          */
5297         if (!strcmp(prop->name, "hotplugged")) {
5298             continue;
5299         }
5300         x86_cpu_expand_prop(cpu, props, prop->name);
5301     }
5302 }
5303 
5304 static void object_apply_props(Object *obj, QDict *props, Error **errp)
5305 {
5306     const QDictEntry *prop;
5307 
5308     for (prop = qdict_first(props); prop; prop = qdict_next(props, prop)) {
5309         if (!object_property_set_qobject(obj, qdict_entry_key(prop),
5310                                          qdict_entry_value(prop), errp)) {
5311             break;
5312         }
5313     }
5314 }
5315 
5316 /* Create X86CPU object according to model+props specification */
5317 static X86CPU *x86_cpu_from_model(const char *model, QDict *props, Error **errp)
5318 {
5319     X86CPU *xc = NULL;
5320     X86CPUClass *xcc;
5321     Error *err = NULL;
5322 
5323     xcc = X86_CPU_CLASS(cpu_class_by_name(TYPE_X86_CPU, model));
5324     if (xcc == NULL) {
5325         error_setg(&err, "CPU model '%s' not found", model);
5326         goto out;
5327     }
5328 
5329     xc = X86_CPU(object_new_with_class(OBJECT_CLASS(xcc)));
5330     if (props) {
5331         object_apply_props(OBJECT(xc), props, &err);
5332         if (err) {
5333             goto out;
5334         }
5335     }
5336 
5337     x86_cpu_expand_features(xc, &err);
5338     if (err) {
5339         goto out;
5340     }
5341 
5342 out:
5343     if (err) {
5344         error_propagate(errp, err);
5345         object_unref(OBJECT(xc));
5346         xc = NULL;
5347     }
5348     return xc;
5349 }
5350 
5351 CpuModelExpansionInfo *
5352 qmp_query_cpu_model_expansion(CpuModelExpansionType type,
5353                                                       CpuModelInfo *model,
5354                                                       Error **errp)
5355 {
5356     X86CPU *xc = NULL;
5357     Error *err = NULL;
5358     CpuModelExpansionInfo *ret = g_new0(CpuModelExpansionInfo, 1);
5359     QDict *props = NULL;
5360     const char *base_name;
5361 
5362     xc = x86_cpu_from_model(model->name,
5363                             model->has_props ?
5364                                 qobject_to(QDict, model->props) :
5365                                 NULL, &err);
5366     if (err) {
5367         goto out;
5368     }
5369 
5370     props = qdict_new();
5371     ret->model = g_new0(CpuModelInfo, 1);
5372     ret->model->props = QOBJECT(props);
5373     ret->model->has_props = true;
5374 
5375     switch (type) {
5376     case CPU_MODEL_EXPANSION_TYPE_STATIC:
5377         /* Static expansion will be based on "base" only */
5378         base_name = "base";
5379         x86_cpu_to_dict(xc, props);
5380     break;
5381     case CPU_MODEL_EXPANSION_TYPE_FULL:
5382         /* As we don't return every single property, full expansion needs
5383          * to keep the original model name+props, and add extra
5384          * properties on top of that.
5385          */
5386         base_name = model->name;
5387         x86_cpu_to_dict_full(xc, props);
5388     break;
5389     default:
5390         error_setg(&err, "Unsupported expansion type");
5391         goto out;
5392     }
5393 
5394     x86_cpu_to_dict(xc, props);
5395 
5396     ret->model->name = g_strdup(base_name);
5397 
5398 out:
5399     object_unref(OBJECT(xc));
5400     if (err) {
5401         error_propagate(errp, err);
5402         qapi_free_CpuModelExpansionInfo(ret);
5403         ret = NULL;
5404     }
5405     return ret;
5406 }
5407 #endif  /* !CONFIG_USER_ONLY */
5408 
5409 static gchar *x86_gdb_arch_name(CPUState *cs)
5410 {
5411 #ifdef TARGET_X86_64
5412     return g_strdup("i386:x86-64");
5413 #else
5414     return g_strdup("i386");
5415 #endif
5416 }
5417 
5418 static void x86_cpu_cpudef_class_init(ObjectClass *oc, void *data)
5419 {
5420     X86CPUModel *model = data;
5421     X86CPUClass *xcc = X86_CPU_CLASS(oc);
5422     CPUClass *cc = CPU_CLASS(oc);
5423 
5424     xcc->model = model;
5425     xcc->migration_safe = true;
5426     cc->deprecation_note = model->cpudef->deprecation_note;
5427 }
5428 
5429 static void x86_register_cpu_model_type(const char *name, X86CPUModel *model)
5430 {
5431     g_autofree char *typename = x86_cpu_type_name(name);
5432     TypeInfo ti = {
5433         .name = typename,
5434         .parent = TYPE_X86_CPU,
5435         .class_init = x86_cpu_cpudef_class_init,
5436         .class_data = model,
5437     };
5438 
5439     type_register(&ti);
5440 }
5441 
5442 static void x86_register_cpudef_types(X86CPUDefinition *def)
5443 {
5444     X86CPUModel *m;
5445     const X86CPUVersionDefinition *vdef;
5446 
5447     /* AMD aliases are handled at runtime based on CPUID vendor, so
5448      * they shouldn't be set on the CPU model table.
5449      */
5450     assert(!(def->features[FEAT_8000_0001_EDX] & CPUID_EXT2_AMD_ALIASES));
5451     /* catch mistakes instead of silently truncating model_id when too long */
5452     assert(def->model_id && strlen(def->model_id) <= 48);
5453 
5454     /* Unversioned model: */
5455     m = g_new0(X86CPUModel, 1);
5456     m->cpudef = def;
5457     m->version = CPU_VERSION_AUTO;
5458     m->is_alias = true;
5459     x86_register_cpu_model_type(def->name, m);
5460 
5461     /* Versioned models: */
5462 
5463     for (vdef = x86_cpu_def_get_versions(def); vdef->version; vdef++) {
5464         X86CPUModel *m = g_new0(X86CPUModel, 1);
5465         g_autofree char *name =
5466             x86_cpu_versioned_model_name(def, vdef->version);
5467         m->cpudef = def;
5468         m->version = vdef->version;
5469         m->note = vdef->note;
5470         x86_register_cpu_model_type(name, m);
5471 
5472         if (vdef->alias) {
5473             X86CPUModel *am = g_new0(X86CPUModel, 1);
5474             am->cpudef = def;
5475             am->version = vdef->version;
5476             am->is_alias = true;
5477             x86_register_cpu_model_type(vdef->alias, am);
5478         }
5479     }
5480 
5481 }
5482 
5483 #if !defined(CONFIG_USER_ONLY)
5484 
5485 void cpu_clear_apic_feature(CPUX86State *env)
5486 {
5487     env->features[FEAT_1_EDX] &= ~CPUID_APIC;
5488 }
5489 
5490 #endif /* !CONFIG_USER_ONLY */
5491 
5492 void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
5493                    uint32_t *eax, uint32_t *ebx,
5494                    uint32_t *ecx, uint32_t *edx)
5495 {
5496     X86CPU *cpu = env_archcpu(env);
5497     CPUState *cs = env_cpu(env);
5498     uint32_t die_offset;
5499     uint32_t limit;
5500     uint32_t signature[3];
5501     X86CPUTopoInfo topo_info;
5502 
5503     topo_info.dies_per_pkg = env->nr_dies;
5504     topo_info.cores_per_die = cs->nr_cores;
5505     topo_info.threads_per_core = cs->nr_threads;
5506 
5507     /* Calculate & apply limits for different index ranges */
5508     if (index >= 0xC0000000) {
5509         limit = env->cpuid_xlevel2;
5510     } else if (index >= 0x80000000) {
5511         limit = env->cpuid_xlevel;
5512     } else if (index >= 0x40000000) {
5513         limit = 0x40000001;
5514     } else {
5515         limit = env->cpuid_level;
5516     }
5517 
5518     if (index > limit) {
5519         /* Intel documentation states that invalid EAX input will
5520          * return the same information as EAX=cpuid_level
5521          * (Intel SDM Vol. 2A - Instruction Set Reference - CPUID)
5522          */
5523         index = env->cpuid_level;
5524     }
5525 
5526     switch(index) {
5527     case 0:
5528         *eax = env->cpuid_level;
5529         *ebx = env->cpuid_vendor1;
5530         *edx = env->cpuid_vendor2;
5531         *ecx = env->cpuid_vendor3;
5532         break;
5533     case 1:
5534         *eax = env->cpuid_version;
5535         *ebx = (cpu->apic_id << 24) |
5536                8 << 8; /* CLFLUSH size in quad words, Linux wants it. */
5537         *ecx = env->features[FEAT_1_ECX];
5538         if ((*ecx & CPUID_EXT_XSAVE) && (env->cr[4] & CR4_OSXSAVE_MASK)) {
5539             *ecx |= CPUID_EXT_OSXSAVE;
5540         }
5541         *edx = env->features[FEAT_1_EDX];
5542         if (cs->nr_cores * cs->nr_threads > 1) {
5543             *ebx |= (cs->nr_cores * cs->nr_threads) << 16;
5544             *edx |= CPUID_HT;
5545         }
5546         if (!cpu->enable_pmu) {
5547             *ecx &= ~CPUID_EXT_PDCM;
5548         }
5549         break;
5550     case 2:
5551         /* cache info: needed for Pentium Pro compatibility */
5552         if (cpu->cache_info_passthrough) {
5553             host_cpuid(index, 0, eax, ebx, ecx, edx);
5554             break;
5555         }
5556         *eax = 1; /* Number of CPUID[EAX=2] calls required */
5557         *ebx = 0;
5558         if (!cpu->enable_l3_cache) {
5559             *ecx = 0;
5560         } else {
5561             *ecx = cpuid2_cache_descriptor(env->cache_info_cpuid2.l3_cache);
5562         }
5563         *edx = (cpuid2_cache_descriptor(env->cache_info_cpuid2.l1d_cache) << 16) |
5564                (cpuid2_cache_descriptor(env->cache_info_cpuid2.l1i_cache) <<  8) |
5565                (cpuid2_cache_descriptor(env->cache_info_cpuid2.l2_cache));
5566         break;
5567     case 4:
5568         /* cache info: needed for Core compatibility */
5569         if (cpu->cache_info_passthrough) {
5570             host_cpuid(index, count, eax, ebx, ecx, edx);
5571             /* QEMU gives out its own APIC IDs, never pass down bits 31..26.  */
5572             *eax &= ~0xFC000000;
5573             if ((*eax & 31) && cs->nr_cores > 1) {
5574                 *eax |= (cs->nr_cores - 1) << 26;
5575             }
5576         } else {
5577             *eax = 0;
5578             switch (count) {
5579             case 0: /* L1 dcache info */
5580                 encode_cache_cpuid4(env->cache_info_cpuid4.l1d_cache,
5581                                     1, cs->nr_cores,
5582                                     eax, ebx, ecx, edx);
5583                 break;
5584             case 1: /* L1 icache info */
5585                 encode_cache_cpuid4(env->cache_info_cpuid4.l1i_cache,
5586                                     1, cs->nr_cores,
5587                                     eax, ebx, ecx, edx);
5588                 break;
5589             case 2: /* L2 cache info */
5590                 encode_cache_cpuid4(env->cache_info_cpuid4.l2_cache,
5591                                     cs->nr_threads, cs->nr_cores,
5592                                     eax, ebx, ecx, edx);
5593                 break;
5594             case 3: /* L3 cache info */
5595                 die_offset = apicid_die_offset(&topo_info);
5596                 if (cpu->enable_l3_cache) {
5597                     encode_cache_cpuid4(env->cache_info_cpuid4.l3_cache,
5598                                         (1 << die_offset), cs->nr_cores,
5599                                         eax, ebx, ecx, edx);
5600                     break;
5601                 }
5602                 /* fall through */
5603             default: /* end of info */
5604                 *eax = *ebx = *ecx = *edx = 0;
5605                 break;
5606             }
5607         }
5608         break;
5609     case 5:
5610         /* MONITOR/MWAIT Leaf */
5611         *eax = cpu->mwait.eax; /* Smallest monitor-line size in bytes */
5612         *ebx = cpu->mwait.ebx; /* Largest monitor-line size in bytes */
5613         *ecx = cpu->mwait.ecx; /* flags */
5614         *edx = cpu->mwait.edx; /* mwait substates */
5615         break;
5616     case 6:
5617         /* Thermal and Power Leaf */
5618         *eax = env->features[FEAT_6_EAX];
5619         *ebx = 0;
5620         *ecx = 0;
5621         *edx = 0;
5622         break;
5623     case 7:
5624         /* Structured Extended Feature Flags Enumeration Leaf */
5625         if (count == 0) {
5626             /* Maximum ECX value for sub-leaves */
5627             *eax = env->cpuid_level_func7;
5628             *ebx = env->features[FEAT_7_0_EBX]; /* Feature flags */
5629             *ecx = env->features[FEAT_7_0_ECX]; /* Feature flags */
5630             if ((*ecx & CPUID_7_0_ECX_PKU) && env->cr[4] & CR4_PKE_MASK) {
5631                 *ecx |= CPUID_7_0_ECX_OSPKE;
5632             }
5633             *edx = env->features[FEAT_7_0_EDX]; /* Feature flags */
5634         } else if (count == 1) {
5635             *eax = env->features[FEAT_7_1_EAX];
5636             *ebx = 0;
5637             *ecx = 0;
5638             *edx = 0;
5639         } else {
5640             *eax = 0;
5641             *ebx = 0;
5642             *ecx = 0;
5643             *edx = 0;
5644         }
5645         break;
5646     case 9:
5647         /* Direct Cache Access Information Leaf */
5648         *eax = 0; /* Bits 0-31 in DCA_CAP MSR */
5649         *ebx = 0;
5650         *ecx = 0;
5651         *edx = 0;
5652         break;
5653     case 0xA:
5654         /* Architectural Performance Monitoring Leaf */
5655         if (kvm_enabled() && cpu->enable_pmu) {
5656             KVMState *s = cs->kvm_state;
5657 
5658             *eax = kvm_arch_get_supported_cpuid(s, 0xA, count, R_EAX);
5659             *ebx = kvm_arch_get_supported_cpuid(s, 0xA, count, R_EBX);
5660             *ecx = kvm_arch_get_supported_cpuid(s, 0xA, count, R_ECX);
5661             *edx = kvm_arch_get_supported_cpuid(s, 0xA, count, R_EDX);
5662         } else if (hvf_enabled() && cpu->enable_pmu) {
5663             *eax = hvf_get_supported_cpuid(0xA, count, R_EAX);
5664             *ebx = hvf_get_supported_cpuid(0xA, count, R_EBX);
5665             *ecx = hvf_get_supported_cpuid(0xA, count, R_ECX);
5666             *edx = hvf_get_supported_cpuid(0xA, count, R_EDX);
5667         } else {
5668             *eax = 0;
5669             *ebx = 0;
5670             *ecx = 0;
5671             *edx = 0;
5672         }
5673         break;
5674     case 0xB:
5675         /* Extended Topology Enumeration Leaf */
5676         if (!cpu->enable_cpuid_0xb) {
5677                 *eax = *ebx = *ecx = *edx = 0;
5678                 break;
5679         }
5680 
5681         *ecx = count & 0xff;
5682         *edx = cpu->apic_id;
5683 
5684         switch (count) {
5685         case 0:
5686             *eax = apicid_core_offset(&topo_info);
5687             *ebx = cs->nr_threads;
5688             *ecx |= CPUID_TOPOLOGY_LEVEL_SMT;
5689             break;
5690         case 1:
5691             *eax = apicid_pkg_offset(&topo_info);
5692             *ebx = cs->nr_cores * cs->nr_threads;
5693             *ecx |= CPUID_TOPOLOGY_LEVEL_CORE;
5694             break;
5695         default:
5696             *eax = 0;
5697             *ebx = 0;
5698             *ecx |= CPUID_TOPOLOGY_LEVEL_INVALID;
5699         }
5700 
5701         assert(!(*eax & ~0x1f));
5702         *ebx &= 0xffff; /* The count doesn't need to be reliable. */
5703         break;
5704     case 0x1F:
5705         /* V2 Extended Topology Enumeration Leaf */
5706         if (env->nr_dies < 2) {
5707             *eax = *ebx = *ecx = *edx = 0;
5708             break;
5709         }
5710 
5711         *ecx = count & 0xff;
5712         *edx = cpu->apic_id;
5713         switch (count) {
5714         case 0:
5715             *eax = apicid_core_offset(&topo_info);
5716             *ebx = cs->nr_threads;
5717             *ecx |= CPUID_TOPOLOGY_LEVEL_SMT;
5718             break;
5719         case 1:
5720             *eax = apicid_die_offset(&topo_info);
5721             *ebx = cs->nr_cores * cs->nr_threads;
5722             *ecx |= CPUID_TOPOLOGY_LEVEL_CORE;
5723             break;
5724         case 2:
5725             *eax = apicid_pkg_offset(&topo_info);
5726             *ebx = env->nr_dies * cs->nr_cores * cs->nr_threads;
5727             *ecx |= CPUID_TOPOLOGY_LEVEL_DIE;
5728             break;
5729         default:
5730             *eax = 0;
5731             *ebx = 0;
5732             *ecx |= CPUID_TOPOLOGY_LEVEL_INVALID;
5733         }
5734         assert(!(*eax & ~0x1f));
5735         *ebx &= 0xffff; /* The count doesn't need to be reliable. */
5736         break;
5737     case 0xD: {
5738         /* Processor Extended State */
5739         *eax = 0;
5740         *ebx = 0;
5741         *ecx = 0;
5742         *edx = 0;
5743         if (!(env->features[FEAT_1_ECX] & CPUID_EXT_XSAVE)) {
5744             break;
5745         }
5746 
5747         if (count == 0) {
5748             *ecx = xsave_area_size(x86_cpu_xsave_components(cpu));
5749             *eax = env->features[FEAT_XSAVE_COMP_LO];
5750             *edx = env->features[FEAT_XSAVE_COMP_HI];
5751             /*
5752              * The initial value of xcr0 and ebx == 0, On host without kvm
5753              * commit 412a3c41(e.g., CentOS 6), the ebx's value always == 0
5754              * even through guest update xcr0, this will crash some legacy guest
5755              * (e.g., CentOS 6), So set ebx == ecx to workaroud it.
5756              */
5757             *ebx = kvm_enabled() ? *ecx : xsave_area_size(env->xcr0);
5758         } else if (count == 1) {
5759             *eax = env->features[FEAT_XSAVE];
5760         } else if (count < ARRAY_SIZE(x86_ext_save_areas)) {
5761             if ((x86_cpu_xsave_components(cpu) >> count) & 1) {
5762                 const ExtSaveArea *esa = &x86_ext_save_areas[count];
5763                 *eax = esa->size;
5764                 *ebx = esa->offset;
5765             }
5766         }
5767         break;
5768     }
5769     case 0x14: {
5770         /* Intel Processor Trace Enumeration */
5771         *eax = 0;
5772         *ebx = 0;
5773         *ecx = 0;
5774         *edx = 0;
5775         if (!(env->features[FEAT_7_0_EBX] & CPUID_7_0_EBX_INTEL_PT) ||
5776             !kvm_enabled()) {
5777             break;
5778         }
5779 
5780         if (count == 0) {
5781             *eax = INTEL_PT_MAX_SUBLEAF;
5782             *ebx = INTEL_PT_MINIMAL_EBX;
5783             *ecx = INTEL_PT_MINIMAL_ECX;
5784             if (env->features[FEAT_14_0_ECX] & CPUID_14_0_ECX_LIP) {
5785                 *ecx |= CPUID_14_0_ECX_LIP;
5786             }
5787         } else if (count == 1) {
5788             *eax = INTEL_PT_MTC_BITMAP | INTEL_PT_ADDR_RANGES_NUM;
5789             *ebx = INTEL_PT_PSB_BITMAP | INTEL_PT_CYCLE_BITMAP;
5790         }
5791         break;
5792     }
5793     case 0x40000000:
5794         /*
5795          * CPUID code in kvm_arch_init_vcpu() ignores stuff
5796          * set here, but we restrict to TCG none the less.
5797          */
5798         if (tcg_enabled() && cpu->expose_tcg) {
5799             memcpy(signature, "TCGTCGTCGTCG", 12);
5800             *eax = 0x40000001;
5801             *ebx = signature[0];
5802             *ecx = signature[1];
5803             *edx = signature[2];
5804         } else {
5805             *eax = 0;
5806             *ebx = 0;
5807             *ecx = 0;
5808             *edx = 0;
5809         }
5810         break;
5811     case 0x40000001:
5812         *eax = 0;
5813         *ebx = 0;
5814         *ecx = 0;
5815         *edx = 0;
5816         break;
5817     case 0x80000000:
5818         *eax = env->cpuid_xlevel;
5819         *ebx = env->cpuid_vendor1;
5820         *edx = env->cpuid_vendor2;
5821         *ecx = env->cpuid_vendor3;
5822         break;
5823     case 0x80000001:
5824         *eax = env->cpuid_version;
5825         *ebx = 0;
5826         *ecx = env->features[FEAT_8000_0001_ECX];
5827         *edx = env->features[FEAT_8000_0001_EDX];
5828 
5829         /* The Linux kernel checks for the CMPLegacy bit and
5830          * discards multiple thread information if it is set.
5831          * So don't set it here for Intel to make Linux guests happy.
5832          */
5833         if (cs->nr_cores * cs->nr_threads > 1) {
5834             if (env->cpuid_vendor1 != CPUID_VENDOR_INTEL_1 ||
5835                 env->cpuid_vendor2 != CPUID_VENDOR_INTEL_2 ||
5836                 env->cpuid_vendor3 != CPUID_VENDOR_INTEL_3) {
5837                 *ecx |= 1 << 1;    /* CmpLegacy bit */
5838             }
5839         }
5840         break;
5841     case 0x80000002:
5842     case 0x80000003:
5843     case 0x80000004:
5844         *eax = env->cpuid_model[(index - 0x80000002) * 4 + 0];
5845         *ebx = env->cpuid_model[(index - 0x80000002) * 4 + 1];
5846         *ecx = env->cpuid_model[(index - 0x80000002) * 4 + 2];
5847         *edx = env->cpuid_model[(index - 0x80000002) * 4 + 3];
5848         break;
5849     case 0x80000005:
5850         /* cache info (L1 cache) */
5851         if (cpu->cache_info_passthrough) {
5852             host_cpuid(index, 0, eax, ebx, ecx, edx);
5853             break;
5854         }
5855         *eax = (L1_DTLB_2M_ASSOC << 24) | (L1_DTLB_2M_ENTRIES << 16) |
5856                (L1_ITLB_2M_ASSOC <<  8) | (L1_ITLB_2M_ENTRIES);
5857         *ebx = (L1_DTLB_4K_ASSOC << 24) | (L1_DTLB_4K_ENTRIES << 16) |
5858                (L1_ITLB_4K_ASSOC <<  8) | (L1_ITLB_4K_ENTRIES);
5859         *ecx = encode_cache_cpuid80000005(env->cache_info_amd.l1d_cache);
5860         *edx = encode_cache_cpuid80000005(env->cache_info_amd.l1i_cache);
5861         break;
5862     case 0x80000006:
5863         /* cache info (L2 cache) */
5864         if (cpu->cache_info_passthrough) {
5865             host_cpuid(index, 0, eax, ebx, ecx, edx);
5866             break;
5867         }
5868         *eax = (AMD_ENC_ASSOC(L2_DTLB_2M_ASSOC) << 28) |
5869                (L2_DTLB_2M_ENTRIES << 16) |
5870                (AMD_ENC_ASSOC(L2_ITLB_2M_ASSOC) << 12) |
5871                (L2_ITLB_2M_ENTRIES);
5872         *ebx = (AMD_ENC_ASSOC(L2_DTLB_4K_ASSOC) << 28) |
5873                (L2_DTLB_4K_ENTRIES << 16) |
5874                (AMD_ENC_ASSOC(L2_ITLB_4K_ASSOC) << 12) |
5875                (L2_ITLB_4K_ENTRIES);
5876         encode_cache_cpuid80000006(env->cache_info_amd.l2_cache,
5877                                    cpu->enable_l3_cache ?
5878                                    env->cache_info_amd.l3_cache : NULL,
5879                                    ecx, edx);
5880         break;
5881     case 0x80000007:
5882         *eax = 0;
5883         *ebx = 0;
5884         *ecx = 0;
5885         *edx = env->features[FEAT_8000_0007_EDX];
5886         break;
5887     case 0x80000008:
5888         /* virtual & phys address size in low 2 bytes. */
5889         if (env->features[FEAT_8000_0001_EDX] & CPUID_EXT2_LM) {
5890             /* 64 bit processor */
5891             *eax = cpu->phys_bits; /* configurable physical bits */
5892             if  (env->features[FEAT_7_0_ECX] & CPUID_7_0_ECX_LA57) {
5893                 *eax |= 0x00003900; /* 57 bits virtual */
5894             } else {
5895                 *eax |= 0x00003000; /* 48 bits virtual */
5896             }
5897         } else {
5898             *eax = cpu->phys_bits;
5899         }
5900         *ebx = env->features[FEAT_8000_0008_EBX];
5901         if (cs->nr_cores * cs->nr_threads > 1) {
5902             /*
5903              * Bits 15:12 is "The number of bits in the initial
5904              * Core::X86::Apic::ApicId[ApicId] value that indicate
5905              * thread ID within a package".
5906              * Bits 7:0 is "The number of threads in the package is NC+1"
5907              */
5908             *ecx = (apicid_pkg_offset(&topo_info) << 12) |
5909                    ((cs->nr_cores * cs->nr_threads) - 1);
5910         } else {
5911             *ecx = 0;
5912         }
5913         *edx = 0;
5914         break;
5915     case 0x8000000A:
5916         if (env->features[FEAT_8000_0001_ECX] & CPUID_EXT3_SVM) {
5917             *eax = 0x00000001; /* SVM Revision */
5918             *ebx = 0x00000010; /* nr of ASIDs */
5919             *ecx = 0;
5920             *edx = env->features[FEAT_SVM]; /* optional features */
5921         } else {
5922             *eax = 0;
5923             *ebx = 0;
5924             *ecx = 0;
5925             *edx = 0;
5926         }
5927         break;
5928     case 0x8000001D:
5929         *eax = 0;
5930         if (cpu->cache_info_passthrough) {
5931             host_cpuid(index, count, eax, ebx, ecx, edx);
5932             break;
5933         }
5934         switch (count) {
5935         case 0: /* L1 dcache info */
5936             encode_cache_cpuid8000001d(env->cache_info_amd.l1d_cache,
5937                                        &topo_info, eax, ebx, ecx, edx);
5938             break;
5939         case 1: /* L1 icache info */
5940             encode_cache_cpuid8000001d(env->cache_info_amd.l1i_cache,
5941                                        &topo_info, eax, ebx, ecx, edx);
5942             break;
5943         case 2: /* L2 cache info */
5944             encode_cache_cpuid8000001d(env->cache_info_amd.l2_cache,
5945                                        &topo_info, eax, ebx, ecx, edx);
5946             break;
5947         case 3: /* L3 cache info */
5948             encode_cache_cpuid8000001d(env->cache_info_amd.l3_cache,
5949                                        &topo_info, eax, ebx, ecx, edx);
5950             break;
5951         default: /* end of info */
5952             *eax = *ebx = *ecx = *edx = 0;
5953             break;
5954         }
5955         break;
5956     case 0x8000001E:
5957         if (cpu->core_id <= 255) {
5958             encode_topo_cpuid8000001e(cpu, &topo_info, eax, ebx, ecx, edx);
5959         } else {
5960             *eax = 0;
5961             *ebx = 0;
5962             *ecx = 0;
5963             *edx = 0;
5964         }
5965         break;
5966     case 0xC0000000:
5967         *eax = env->cpuid_xlevel2;
5968         *ebx = 0;
5969         *ecx = 0;
5970         *edx = 0;
5971         break;
5972     case 0xC0000001:
5973         /* Support for VIA CPU's CPUID instruction */
5974         *eax = env->cpuid_version;
5975         *ebx = 0;
5976         *ecx = 0;
5977         *edx = env->features[FEAT_C000_0001_EDX];
5978         break;
5979     case 0xC0000002:
5980     case 0xC0000003:
5981     case 0xC0000004:
5982         /* Reserved for the future, and now filled with zero */
5983         *eax = 0;
5984         *ebx = 0;
5985         *ecx = 0;
5986         *edx = 0;
5987         break;
5988     case 0x8000001F:
5989         *eax = sev_enabled() ? 0x2 : 0;
5990         *ebx = sev_get_cbit_position();
5991         *ebx |= sev_get_reduced_phys_bits() << 6;
5992         *ecx = 0;
5993         *edx = 0;
5994         break;
5995     default:
5996         /* reserved values: zero */
5997         *eax = 0;
5998         *ebx = 0;
5999         *ecx = 0;
6000         *edx = 0;
6001         break;
6002     }
6003 }
6004 
6005 static void x86_cpu_reset(DeviceState *dev)
6006 {
6007     CPUState *s = CPU(dev);
6008     X86CPU *cpu = X86_CPU(s);
6009     X86CPUClass *xcc = X86_CPU_GET_CLASS(cpu);
6010     CPUX86State *env = &cpu->env;
6011     target_ulong cr4;
6012     uint64_t xcr0;
6013     int i;
6014 
6015     xcc->parent_reset(dev);
6016 
6017     memset(env, 0, offsetof(CPUX86State, end_reset_fields));
6018 
6019     env->old_exception = -1;
6020 
6021     /* init to reset state */
6022 
6023     env->hflags2 |= HF2_GIF_MASK;
6024     env->hflags &= ~HF_GUEST_MASK;
6025 
6026     cpu_x86_update_cr0(env, 0x60000010);
6027     env->a20_mask = ~0x0;
6028     env->smbase = 0x30000;
6029     env->msr_smi_count = 0;
6030 
6031     env->idt.limit = 0xffff;
6032     env->gdt.limit = 0xffff;
6033     env->ldt.limit = 0xffff;
6034     env->ldt.flags = DESC_P_MASK | (2 << DESC_TYPE_SHIFT);
6035     env->tr.limit = 0xffff;
6036     env->tr.flags = DESC_P_MASK | (11 << DESC_TYPE_SHIFT);
6037 
6038     cpu_x86_load_seg_cache(env, R_CS, 0xf000, 0xffff0000, 0xffff,
6039                            DESC_P_MASK | DESC_S_MASK | DESC_CS_MASK |
6040                            DESC_R_MASK | DESC_A_MASK);
6041     cpu_x86_load_seg_cache(env, R_DS, 0, 0, 0xffff,
6042                            DESC_P_MASK | DESC_S_MASK | DESC_W_MASK |
6043                            DESC_A_MASK);
6044     cpu_x86_load_seg_cache(env, R_ES, 0, 0, 0xffff,
6045                            DESC_P_MASK | DESC_S_MASK | DESC_W_MASK |
6046                            DESC_A_MASK);
6047     cpu_x86_load_seg_cache(env, R_SS, 0, 0, 0xffff,
6048                            DESC_P_MASK | DESC_S_MASK | DESC_W_MASK |
6049                            DESC_A_MASK);
6050     cpu_x86_load_seg_cache(env, R_FS, 0, 0, 0xffff,
6051                            DESC_P_MASK | DESC_S_MASK | DESC_W_MASK |
6052                            DESC_A_MASK);
6053     cpu_x86_load_seg_cache(env, R_GS, 0, 0, 0xffff,
6054                            DESC_P_MASK | DESC_S_MASK | DESC_W_MASK |
6055                            DESC_A_MASK);
6056 
6057     env->eip = 0xfff0;
6058     env->regs[R_EDX] = env->cpuid_version;
6059 
6060     env->eflags = 0x2;
6061 
6062     /* FPU init */
6063     for (i = 0; i < 8; i++) {
6064         env->fptags[i] = 1;
6065     }
6066     cpu_set_fpuc(env, 0x37f);
6067 
6068     env->mxcsr = 0x1f80;
6069     /* All units are in INIT state.  */
6070     env->xstate_bv = 0;
6071 
6072     env->pat = 0x0007040600070406ULL;
6073     env->msr_ia32_misc_enable = MSR_IA32_MISC_ENABLE_DEFAULT;
6074     if (env->features[FEAT_1_ECX] & CPUID_EXT_MONITOR) {
6075         env->msr_ia32_misc_enable |= MSR_IA32_MISC_ENABLE_MWAIT;
6076     }
6077 
6078     memset(env->dr, 0, sizeof(env->dr));
6079     env->dr[6] = DR6_FIXED_1;
6080     env->dr[7] = DR7_FIXED_1;
6081     cpu_breakpoint_remove_all(s, BP_CPU);
6082     cpu_watchpoint_remove_all(s, BP_CPU);
6083 
6084     cr4 = 0;
6085     xcr0 = XSTATE_FP_MASK;
6086 
6087 #ifdef CONFIG_USER_ONLY
6088     /* Enable all the features for user-mode.  */
6089     if (env->features[FEAT_1_EDX] & CPUID_SSE) {
6090         xcr0 |= XSTATE_SSE_MASK;
6091     }
6092     for (i = 2; i < ARRAY_SIZE(x86_ext_save_areas); i++) {
6093         const ExtSaveArea *esa = &x86_ext_save_areas[i];
6094         if (env->features[esa->feature] & esa->bits) {
6095             xcr0 |= 1ull << i;
6096         }
6097     }
6098 
6099     if (env->features[FEAT_1_ECX] & CPUID_EXT_XSAVE) {
6100         cr4 |= CR4_OSFXSR_MASK | CR4_OSXSAVE_MASK;
6101     }
6102     if (env->features[FEAT_7_0_EBX] & CPUID_7_0_EBX_FSGSBASE) {
6103         cr4 |= CR4_FSGSBASE_MASK;
6104     }
6105 #endif
6106 
6107     env->xcr0 = xcr0;
6108     cpu_x86_update_cr4(env, cr4);
6109 
6110     /*
6111      * SDM 11.11.5 requires:
6112      *  - IA32_MTRR_DEF_TYPE MSR.E = 0
6113      *  - IA32_MTRR_PHYSMASKn.V = 0
6114      * All other bits are undefined.  For simplification, zero it all.
6115      */
6116     env->mtrr_deftype = 0;
6117     memset(env->mtrr_var, 0, sizeof(env->mtrr_var));
6118     memset(env->mtrr_fixed, 0, sizeof(env->mtrr_fixed));
6119 
6120     env->interrupt_injected = -1;
6121     env->exception_nr = -1;
6122     env->exception_pending = 0;
6123     env->exception_injected = 0;
6124     env->exception_has_payload = false;
6125     env->exception_payload = 0;
6126     env->nmi_injected = false;
6127 #if !defined(CONFIG_USER_ONLY)
6128     /* We hard-wire the BSP to the first CPU. */
6129     apic_designate_bsp(cpu->apic_state, s->cpu_index == 0);
6130 
6131     s->halted = !cpu_is_bsp(cpu);
6132 
6133     if (kvm_enabled()) {
6134         kvm_arch_reset_vcpu(cpu);
6135     }
6136 #endif
6137 }
6138 
6139 #ifndef CONFIG_USER_ONLY
6140 bool cpu_is_bsp(X86CPU *cpu)
6141 {
6142     return cpu_get_apic_base(cpu->apic_state) & MSR_IA32_APICBASE_BSP;
6143 }
6144 
6145 /* TODO: remove me, when reset over QOM tree is implemented */
6146 static void x86_cpu_machine_reset_cb(void *opaque)
6147 {
6148     X86CPU *cpu = opaque;
6149     cpu_reset(CPU(cpu));
6150 }
6151 #endif
6152 
6153 static void mce_init(X86CPU *cpu)
6154 {
6155     CPUX86State *cenv = &cpu->env;
6156     unsigned int bank;
6157 
6158     if (((cenv->cpuid_version >> 8) & 0xf) >= 6
6159         && (cenv->features[FEAT_1_EDX] & (CPUID_MCE | CPUID_MCA)) ==
6160             (CPUID_MCE | CPUID_MCA)) {
6161         cenv->mcg_cap = MCE_CAP_DEF | MCE_BANKS_DEF |
6162                         (cpu->enable_lmce ? MCG_LMCE_P : 0);
6163         cenv->mcg_ctl = ~(uint64_t)0;
6164         for (bank = 0; bank < MCE_BANKS_DEF; bank++) {
6165             cenv->mce_banks[bank * 4] = ~(uint64_t)0;
6166         }
6167     }
6168 }
6169 
6170 #ifndef CONFIG_USER_ONLY
6171 APICCommonClass *apic_get_class(void)
6172 {
6173     const char *apic_type = "apic";
6174 
6175     /* TODO: in-kernel irqchip for hvf */
6176     if (kvm_apic_in_kernel()) {
6177         apic_type = "kvm-apic";
6178     } else if (xen_enabled()) {
6179         apic_type = "xen-apic";
6180     } else if (whpx_apic_in_platform()) {
6181         apic_type = "whpx-apic";
6182     }
6183 
6184     return APIC_COMMON_CLASS(object_class_by_name(apic_type));
6185 }
6186 
6187 static void x86_cpu_apic_create(X86CPU *cpu, Error **errp)
6188 {
6189     APICCommonState *apic;
6190     ObjectClass *apic_class = OBJECT_CLASS(apic_get_class());
6191 
6192     cpu->apic_state = DEVICE(object_new_with_class(apic_class));
6193 
6194     object_property_add_child(OBJECT(cpu), "lapic",
6195                               OBJECT(cpu->apic_state));
6196     object_unref(OBJECT(cpu->apic_state));
6197 
6198     qdev_prop_set_uint32(cpu->apic_state, "id", cpu->apic_id);
6199     /* TODO: convert to link<> */
6200     apic = APIC_COMMON(cpu->apic_state);
6201     apic->cpu = cpu;
6202     apic->apicbase = APIC_DEFAULT_ADDRESS | MSR_IA32_APICBASE_ENABLE;
6203 }
6204 
6205 static void x86_cpu_apic_realize(X86CPU *cpu, Error **errp)
6206 {
6207     APICCommonState *apic;
6208     static bool apic_mmio_map_once;
6209 
6210     if (cpu->apic_state == NULL) {
6211         return;
6212     }
6213     qdev_realize(DEVICE(cpu->apic_state), NULL, errp);
6214 
6215     /* Map APIC MMIO area */
6216     apic = APIC_COMMON(cpu->apic_state);
6217     if (!apic_mmio_map_once) {
6218         memory_region_add_subregion_overlap(get_system_memory(),
6219                                             apic->apicbase &
6220                                             MSR_IA32_APICBASE_BASE,
6221                                             &apic->io_memory,
6222                                             0x1000);
6223         apic_mmio_map_once = true;
6224      }
6225 }
6226 
6227 static void x86_cpu_machine_done(Notifier *n, void *unused)
6228 {
6229     X86CPU *cpu = container_of(n, X86CPU, machine_done);
6230     MemoryRegion *smram =
6231         (MemoryRegion *) object_resolve_path("/machine/smram", NULL);
6232 
6233     if (smram) {
6234         cpu->smram = g_new(MemoryRegion, 1);
6235         memory_region_init_alias(cpu->smram, OBJECT(cpu), "smram",
6236                                  smram, 0, 4 * GiB);
6237         memory_region_set_enabled(cpu->smram, true);
6238         memory_region_add_subregion_overlap(cpu->cpu_as_root, 0, cpu->smram, 1);
6239     }
6240 }
6241 #else
6242 static void x86_cpu_apic_realize(X86CPU *cpu, Error **errp)
6243 {
6244 }
6245 #endif
6246 
6247 /* Note: Only safe for use on x86(-64) hosts */
6248 static uint32_t x86_host_phys_bits(void)
6249 {
6250     uint32_t eax;
6251     uint32_t host_phys_bits;
6252 
6253     host_cpuid(0x80000000, 0, &eax, NULL, NULL, NULL);
6254     if (eax >= 0x80000008) {
6255         host_cpuid(0x80000008, 0, &eax, NULL, NULL, NULL);
6256         /* Note: According to AMD doc 25481 rev 2.34 they have a field
6257          * at 23:16 that can specify a maximum physical address bits for
6258          * the guest that can override this value; but I've not seen
6259          * anything with that set.
6260          */
6261         host_phys_bits = eax & 0xff;
6262     } else {
6263         /* It's an odd 64 bit machine that doesn't have the leaf for
6264          * physical address bits; fall back to 36 that's most older
6265          * Intel.
6266          */
6267         host_phys_bits = 36;
6268     }
6269 
6270     return host_phys_bits;
6271 }
6272 
6273 static void x86_cpu_adjust_level(X86CPU *cpu, uint32_t *min, uint32_t value)
6274 {
6275     if (*min < value) {
6276         *min = value;
6277     }
6278 }
6279 
6280 /* Increase cpuid_min_{level,xlevel,xlevel2} automatically, if appropriate */
6281 static void x86_cpu_adjust_feat_level(X86CPU *cpu, FeatureWord w)
6282 {
6283     CPUX86State *env = &cpu->env;
6284     FeatureWordInfo *fi = &feature_word_info[w];
6285     uint32_t eax = fi->cpuid.eax;
6286     uint32_t region = eax & 0xF0000000;
6287 
6288     assert(feature_word_info[w].type == CPUID_FEATURE_WORD);
6289     if (!env->features[w]) {
6290         return;
6291     }
6292 
6293     switch (region) {
6294     case 0x00000000:
6295         x86_cpu_adjust_level(cpu, &env->cpuid_min_level, eax);
6296     break;
6297     case 0x80000000:
6298         x86_cpu_adjust_level(cpu, &env->cpuid_min_xlevel, eax);
6299     break;
6300     case 0xC0000000:
6301         x86_cpu_adjust_level(cpu, &env->cpuid_min_xlevel2, eax);
6302     break;
6303     }
6304 
6305     if (eax == 7) {
6306         x86_cpu_adjust_level(cpu, &env->cpuid_min_level_func7,
6307                              fi->cpuid.ecx);
6308     }
6309 }
6310 
6311 /* Calculate XSAVE components based on the configured CPU feature flags */
6312 static void x86_cpu_enable_xsave_components(X86CPU *cpu)
6313 {
6314     CPUX86State *env = &cpu->env;
6315     int i;
6316     uint64_t mask;
6317 
6318     if (!(env->features[FEAT_1_ECX] & CPUID_EXT_XSAVE)) {
6319         env->features[FEAT_XSAVE_COMP_LO] = 0;
6320         env->features[FEAT_XSAVE_COMP_HI] = 0;
6321         return;
6322     }
6323 
6324     mask = 0;
6325     for (i = 0; i < ARRAY_SIZE(x86_ext_save_areas); i++) {
6326         const ExtSaveArea *esa = &x86_ext_save_areas[i];
6327         if (env->features[esa->feature] & esa->bits) {
6328             mask |= (1ULL << i);
6329         }
6330     }
6331 
6332     env->features[FEAT_XSAVE_COMP_LO] = mask;
6333     env->features[FEAT_XSAVE_COMP_HI] = mask >> 32;
6334 }
6335 
6336 /***** Steps involved on loading and filtering CPUID data
6337  *
6338  * When initializing and realizing a CPU object, the steps
6339  * involved in setting up CPUID data are:
6340  *
6341  * 1) Loading CPU model definition (X86CPUDefinition). This is
6342  *    implemented by x86_cpu_load_model() and should be completely
6343  *    transparent, as it is done automatically by instance_init.
6344  *    No code should need to look at X86CPUDefinition structs
6345  *    outside instance_init.
6346  *
6347  * 2) CPU expansion. This is done by realize before CPUID
6348  *    filtering, and will make sure host/accelerator data is
6349  *    loaded for CPU models that depend on host capabilities
6350  *    (e.g. "host"). Done by x86_cpu_expand_features().
6351  *
6352  * 3) CPUID filtering. This initializes extra data related to
6353  *    CPUID, and checks if the host supports all capabilities
6354  *    required by the CPU. Runnability of a CPU model is
6355  *    determined at this step. Done by x86_cpu_filter_features().
6356  *
6357  * Some operations don't require all steps to be performed.
6358  * More precisely:
6359  *
6360  * - CPU instance creation (instance_init) will run only CPU
6361  *   model loading. CPU expansion can't run at instance_init-time
6362  *   because host/accelerator data may be not available yet.
6363  * - CPU realization will perform both CPU model expansion and CPUID
6364  *   filtering, and return an error in case one of them fails.
6365  * - query-cpu-definitions needs to run all 3 steps. It needs
6366  *   to run CPUID filtering, as the 'unavailable-features'
6367  *   field is set based on the filtering results.
6368  * - The query-cpu-model-expansion QMP command only needs to run
6369  *   CPU model loading and CPU expansion. It should not filter
6370  *   any CPUID data based on host capabilities.
6371  */
6372 
6373 /* Expand CPU configuration data, based on configured features
6374  * and host/accelerator capabilities when appropriate.
6375  */
6376 static void x86_cpu_expand_features(X86CPU *cpu, Error **errp)
6377 {
6378     CPUX86State *env = &cpu->env;
6379     FeatureWord w;
6380     int i;
6381     GList *l;
6382 
6383     for (l = plus_features; l; l = l->next) {
6384         const char *prop = l->data;
6385         if (!object_property_set_bool(OBJECT(cpu), prop, true, errp)) {
6386             return;
6387         }
6388     }
6389 
6390     for (l = minus_features; l; l = l->next) {
6391         const char *prop = l->data;
6392         if (!object_property_set_bool(OBJECT(cpu), prop, false, errp)) {
6393             return;
6394         }
6395     }
6396 
6397     /*TODO: Now cpu->max_features doesn't overwrite features
6398      * set using QOM properties, and we can convert
6399      * plus_features & minus_features to global properties
6400      * inside x86_cpu_parse_featurestr() too.
6401      */
6402     if (cpu->max_features) {
6403         for (w = 0; w < FEATURE_WORDS; w++) {
6404             /* Override only features that weren't set explicitly
6405              * by the user.
6406              */
6407             env->features[w] |=
6408                 x86_cpu_get_supported_feature_word(w, cpu->migratable) &
6409                 ~env->user_features[w] &
6410                 ~feature_word_info[w].no_autoenable_flags;
6411         }
6412     }
6413 
6414     for (i = 0; i < ARRAY_SIZE(feature_dependencies); i++) {
6415         FeatureDep *d = &feature_dependencies[i];
6416         if (!(env->features[d->from.index] & d->from.mask)) {
6417             uint64_t unavailable_features = env->features[d->to.index] & d->to.mask;
6418 
6419             /* Not an error unless the dependent feature was added explicitly.  */
6420             mark_unavailable_features(cpu, d->to.index,
6421                                       unavailable_features & env->user_features[d->to.index],
6422                                       "This feature depends on other features that were not requested");
6423 
6424             env->features[d->to.index] &= ~unavailable_features;
6425         }
6426     }
6427 
6428     if (!kvm_enabled() || !cpu->expose_kvm) {
6429         env->features[FEAT_KVM] = 0;
6430     }
6431 
6432     x86_cpu_enable_xsave_components(cpu);
6433 
6434     /* CPUID[EAX=7,ECX=0].EBX always increased level automatically: */
6435     x86_cpu_adjust_feat_level(cpu, FEAT_7_0_EBX);
6436     if (cpu->full_cpuid_auto_level) {
6437         x86_cpu_adjust_feat_level(cpu, FEAT_1_EDX);
6438         x86_cpu_adjust_feat_level(cpu, FEAT_1_ECX);
6439         x86_cpu_adjust_feat_level(cpu, FEAT_6_EAX);
6440         x86_cpu_adjust_feat_level(cpu, FEAT_7_0_ECX);
6441         x86_cpu_adjust_feat_level(cpu, FEAT_7_1_EAX);
6442         x86_cpu_adjust_feat_level(cpu, FEAT_8000_0001_EDX);
6443         x86_cpu_adjust_feat_level(cpu, FEAT_8000_0001_ECX);
6444         x86_cpu_adjust_feat_level(cpu, FEAT_8000_0007_EDX);
6445         x86_cpu_adjust_feat_level(cpu, FEAT_8000_0008_EBX);
6446         x86_cpu_adjust_feat_level(cpu, FEAT_C000_0001_EDX);
6447         x86_cpu_adjust_feat_level(cpu, FEAT_SVM);
6448         x86_cpu_adjust_feat_level(cpu, FEAT_XSAVE);
6449 
6450         /* Intel Processor Trace requires CPUID[0x14] */
6451         if ((env->features[FEAT_7_0_EBX] & CPUID_7_0_EBX_INTEL_PT)) {
6452             if (cpu->intel_pt_auto_level) {
6453                 x86_cpu_adjust_level(cpu, &cpu->env.cpuid_min_level, 0x14);
6454             } else if (cpu->env.cpuid_min_level < 0x14) {
6455                 mark_unavailable_features(cpu, FEAT_7_0_EBX,
6456                     CPUID_7_0_EBX_INTEL_PT,
6457                     "Intel PT need CPUID leaf 0x14, please set by \"-cpu ...,+intel-pt,min-level=0x14\"");
6458             }
6459         }
6460 
6461         /* CPU topology with multi-dies support requires CPUID[0x1F] */
6462         if (env->nr_dies > 1) {
6463             x86_cpu_adjust_level(cpu, &env->cpuid_min_level, 0x1F);
6464         }
6465 
6466         /* SVM requires CPUID[0x8000000A] */
6467         if (env->features[FEAT_8000_0001_ECX] & CPUID_EXT3_SVM) {
6468             x86_cpu_adjust_level(cpu, &env->cpuid_min_xlevel, 0x8000000A);
6469         }
6470 
6471         /* SEV requires CPUID[0x8000001F] */
6472         if (sev_enabled()) {
6473             x86_cpu_adjust_level(cpu, &env->cpuid_min_xlevel, 0x8000001F);
6474         }
6475     }
6476 
6477     /* Set cpuid_*level* based on cpuid_min_*level, if not explicitly set */
6478     if (env->cpuid_level_func7 == UINT32_MAX) {
6479         env->cpuid_level_func7 = env->cpuid_min_level_func7;
6480     }
6481     if (env->cpuid_level == UINT32_MAX) {
6482         env->cpuid_level = env->cpuid_min_level;
6483     }
6484     if (env->cpuid_xlevel == UINT32_MAX) {
6485         env->cpuid_xlevel = env->cpuid_min_xlevel;
6486     }
6487     if (env->cpuid_xlevel2 == UINT32_MAX) {
6488         env->cpuid_xlevel2 = env->cpuid_min_xlevel2;
6489     }
6490 }
6491 
6492 /*
6493  * Finishes initialization of CPUID data, filters CPU feature
6494  * words based on host availability of each feature.
6495  *
6496  * Returns: 0 if all flags are supported by the host, non-zero otherwise.
6497  */
6498 static void x86_cpu_filter_features(X86CPU *cpu, bool verbose)
6499 {
6500     CPUX86State *env = &cpu->env;
6501     FeatureWord w;
6502     const char *prefix = NULL;
6503 
6504     if (verbose) {
6505         prefix = accel_uses_host_cpuid()
6506                  ? "host doesn't support requested feature"
6507                  : "TCG doesn't support requested feature";
6508     }
6509 
6510     for (w = 0; w < FEATURE_WORDS; w++) {
6511         uint64_t host_feat =
6512             x86_cpu_get_supported_feature_word(w, false);
6513         uint64_t requested_features = env->features[w];
6514         uint64_t unavailable_features = requested_features & ~host_feat;
6515         mark_unavailable_features(cpu, w, unavailable_features, prefix);
6516     }
6517 
6518     if ((env->features[FEAT_7_0_EBX] & CPUID_7_0_EBX_INTEL_PT) &&
6519         kvm_enabled()) {
6520         KVMState *s = CPU(cpu)->kvm_state;
6521         uint32_t eax_0 = kvm_arch_get_supported_cpuid(s, 0x14, 0, R_EAX);
6522         uint32_t ebx_0 = kvm_arch_get_supported_cpuid(s, 0x14, 0, R_EBX);
6523         uint32_t ecx_0 = kvm_arch_get_supported_cpuid(s, 0x14, 0, R_ECX);
6524         uint32_t eax_1 = kvm_arch_get_supported_cpuid(s, 0x14, 1, R_EAX);
6525         uint32_t ebx_1 = kvm_arch_get_supported_cpuid(s, 0x14, 1, R_EBX);
6526 
6527         if (!eax_0 ||
6528            ((ebx_0 & INTEL_PT_MINIMAL_EBX) != INTEL_PT_MINIMAL_EBX) ||
6529            ((ecx_0 & INTEL_PT_MINIMAL_ECX) != INTEL_PT_MINIMAL_ECX) ||
6530            ((eax_1 & INTEL_PT_MTC_BITMAP) != INTEL_PT_MTC_BITMAP) ||
6531            ((eax_1 & INTEL_PT_ADDR_RANGES_NUM_MASK) <
6532                                            INTEL_PT_ADDR_RANGES_NUM) ||
6533            ((ebx_1 & (INTEL_PT_PSB_BITMAP | INTEL_PT_CYCLE_BITMAP)) !=
6534                 (INTEL_PT_PSB_BITMAP | INTEL_PT_CYCLE_BITMAP)) ||
6535            ((ecx_0 & CPUID_14_0_ECX_LIP) !=
6536                 (env->features[FEAT_14_0_ECX] & CPUID_14_0_ECX_LIP))) {
6537             /*
6538              * Processor Trace capabilities aren't configurable, so if the
6539              * host can't emulate the capabilities we report on
6540              * cpu_x86_cpuid(), intel-pt can't be enabled on the current host.
6541              */
6542             mark_unavailable_features(cpu, FEAT_7_0_EBX, CPUID_7_0_EBX_INTEL_PT, prefix);
6543         }
6544     }
6545 }
6546 
6547 static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
6548 {
6549     CPUState *cs = CPU(dev);
6550     X86CPU *cpu = X86_CPU(dev);
6551     X86CPUClass *xcc = X86_CPU_GET_CLASS(dev);
6552     CPUX86State *env = &cpu->env;
6553     Error *local_err = NULL;
6554     static bool ht_warned;
6555 
6556     if (xcc->host_cpuid_required) {
6557         if (!accel_uses_host_cpuid()) {
6558             g_autofree char *name = x86_cpu_class_get_model_name(xcc);
6559             error_setg(&local_err, "CPU model '%s' requires KVM", name);
6560             goto out;
6561         }
6562     }
6563 
6564     if (cpu->max_features && accel_uses_host_cpuid()) {
6565         if (enable_cpu_pm) {
6566             host_cpuid(5, 0, &cpu->mwait.eax, &cpu->mwait.ebx,
6567                        &cpu->mwait.ecx, &cpu->mwait.edx);
6568             env->features[FEAT_1_ECX] |= CPUID_EXT_MONITOR;
6569             if (kvm_enabled() && kvm_has_waitpkg()) {
6570                 env->features[FEAT_7_0_ECX] |= CPUID_7_0_ECX_WAITPKG;
6571             }
6572         }
6573         if (kvm_enabled() && cpu->ucode_rev == 0) {
6574             cpu->ucode_rev = kvm_arch_get_supported_msr_feature(kvm_state,
6575                                                                 MSR_IA32_UCODE_REV);
6576         }
6577     }
6578 
6579     if (cpu->ucode_rev == 0) {
6580         /* The default is the same as KVM's.  */
6581         if (IS_AMD_CPU(env)) {
6582             cpu->ucode_rev = 0x01000065;
6583         } else {
6584             cpu->ucode_rev = 0x100000000ULL;
6585         }
6586     }
6587 
6588     /* mwait extended info: needed for Core compatibility */
6589     /* We always wake on interrupt even if host does not have the capability */
6590     cpu->mwait.ecx |= CPUID_MWAIT_EMX | CPUID_MWAIT_IBE;
6591 
6592     if (cpu->apic_id == UNASSIGNED_APIC_ID) {
6593         error_setg(errp, "apic-id property was not initialized properly");
6594         return;
6595     }
6596 
6597     x86_cpu_expand_features(cpu, &local_err);
6598     if (local_err) {
6599         goto out;
6600     }
6601 
6602     x86_cpu_filter_features(cpu, cpu->check_cpuid || cpu->enforce_cpuid);
6603 
6604     if (cpu->enforce_cpuid && x86_cpu_have_filtered_features(cpu)) {
6605         error_setg(&local_err,
6606                    accel_uses_host_cpuid() ?
6607                        "Host doesn't support requested features" :
6608                        "TCG doesn't support requested features");
6609         goto out;
6610     }
6611 
6612     /* On AMD CPUs, some CPUID[8000_0001].EDX bits must match the bits on
6613      * CPUID[1].EDX.
6614      */
6615     if (IS_AMD_CPU(env)) {
6616         env->features[FEAT_8000_0001_EDX] &= ~CPUID_EXT2_AMD_ALIASES;
6617         env->features[FEAT_8000_0001_EDX] |= (env->features[FEAT_1_EDX]
6618            & CPUID_EXT2_AMD_ALIASES);
6619     }
6620 
6621     /* For 64bit systems think about the number of physical bits to present.
6622      * ideally this should be the same as the host; anything other than matching
6623      * the host can cause incorrect guest behaviour.
6624      * QEMU used to pick the magic value of 40 bits that corresponds to
6625      * consumer AMD devices but nothing else.
6626      */
6627     if (env->features[FEAT_8000_0001_EDX] & CPUID_EXT2_LM) {
6628         if (accel_uses_host_cpuid()) {
6629             uint32_t host_phys_bits = x86_host_phys_bits();
6630             static bool warned;
6631 
6632             /* Print a warning if the user set it to a value that's not the
6633              * host value.
6634              */
6635             if (cpu->phys_bits != host_phys_bits && cpu->phys_bits != 0 &&
6636                 !warned) {
6637                 warn_report("Host physical bits (%u)"
6638                             " does not match phys-bits property (%u)",
6639                             host_phys_bits, cpu->phys_bits);
6640                 warned = true;
6641             }
6642 
6643             if (cpu->host_phys_bits) {
6644                 /* The user asked for us to use the host physical bits */
6645                 cpu->phys_bits = host_phys_bits;
6646                 if (cpu->host_phys_bits_limit &&
6647                     cpu->phys_bits > cpu->host_phys_bits_limit) {
6648                     cpu->phys_bits = cpu->host_phys_bits_limit;
6649                 }
6650             }
6651 
6652             if (cpu->phys_bits &&
6653                 (cpu->phys_bits > TARGET_PHYS_ADDR_SPACE_BITS ||
6654                 cpu->phys_bits < 32)) {
6655                 error_setg(errp, "phys-bits should be between 32 and %u "
6656                                  " (but is %u)",
6657                                  TARGET_PHYS_ADDR_SPACE_BITS, cpu->phys_bits);
6658                 return;
6659             }
6660         } else {
6661             if (cpu->phys_bits && cpu->phys_bits != TCG_PHYS_ADDR_BITS) {
6662                 error_setg(errp, "TCG only supports phys-bits=%u",
6663                                   TCG_PHYS_ADDR_BITS);
6664                 return;
6665             }
6666         }
6667         /* 0 means it was not explicitly set by the user (or by machine
6668          * compat_props or by the host code above). In this case, the default
6669          * is the value used by TCG (40).
6670          */
6671         if (cpu->phys_bits == 0) {
6672             cpu->phys_bits = TCG_PHYS_ADDR_BITS;
6673         }
6674     } else {
6675         /* For 32 bit systems don't use the user set value, but keep
6676          * phys_bits consistent with what we tell the guest.
6677          */
6678         if (cpu->phys_bits != 0) {
6679             error_setg(errp, "phys-bits is not user-configurable in 32 bit");
6680             return;
6681         }
6682 
6683         if (env->features[FEAT_1_EDX] & CPUID_PSE36) {
6684             cpu->phys_bits = 36;
6685         } else {
6686             cpu->phys_bits = 32;
6687         }
6688     }
6689 
6690     /* Cache information initialization */
6691     if (!cpu->legacy_cache) {
6692         if (!xcc->model || !xcc->model->cpudef->cache_info) {
6693             g_autofree char *name = x86_cpu_class_get_model_name(xcc);
6694             error_setg(errp,
6695                        "CPU model '%s' doesn't support legacy-cache=off", name);
6696             return;
6697         }
6698         env->cache_info_cpuid2 = env->cache_info_cpuid4 = env->cache_info_amd =
6699             *xcc->model->cpudef->cache_info;
6700     } else {
6701         /* Build legacy cache information */
6702         env->cache_info_cpuid2.l1d_cache = &legacy_l1d_cache;
6703         env->cache_info_cpuid2.l1i_cache = &legacy_l1i_cache;
6704         env->cache_info_cpuid2.l2_cache = &legacy_l2_cache_cpuid2;
6705         env->cache_info_cpuid2.l3_cache = &legacy_l3_cache;
6706 
6707         env->cache_info_cpuid4.l1d_cache = &legacy_l1d_cache;
6708         env->cache_info_cpuid4.l1i_cache = &legacy_l1i_cache;
6709         env->cache_info_cpuid4.l2_cache = &legacy_l2_cache;
6710         env->cache_info_cpuid4.l3_cache = &legacy_l3_cache;
6711 
6712         env->cache_info_amd.l1d_cache = &legacy_l1d_cache_amd;
6713         env->cache_info_amd.l1i_cache = &legacy_l1i_cache_amd;
6714         env->cache_info_amd.l2_cache = &legacy_l2_cache_amd;
6715         env->cache_info_amd.l3_cache = &legacy_l3_cache;
6716     }
6717 
6718 
6719     cpu_exec_realizefn(cs, &local_err);
6720     if (local_err != NULL) {
6721         error_propagate(errp, local_err);
6722         return;
6723     }
6724 
6725 #ifndef CONFIG_USER_ONLY
6726     MachineState *ms = MACHINE(qdev_get_machine());
6727     qemu_register_reset(x86_cpu_machine_reset_cb, cpu);
6728 
6729     if (cpu->env.features[FEAT_1_EDX] & CPUID_APIC || ms->smp.cpus > 1) {
6730         x86_cpu_apic_create(cpu, &local_err);
6731         if (local_err != NULL) {
6732             goto out;
6733         }
6734     }
6735 #endif
6736 
6737     mce_init(cpu);
6738 
6739 #ifndef CONFIG_USER_ONLY
6740     if (tcg_enabled()) {
6741         cpu->cpu_as_mem = g_new(MemoryRegion, 1);
6742         cpu->cpu_as_root = g_new(MemoryRegion, 1);
6743 
6744         /* Outer container... */
6745         memory_region_init(cpu->cpu_as_root, OBJECT(cpu), "memory", ~0ull);
6746         memory_region_set_enabled(cpu->cpu_as_root, true);
6747 
6748         /* ... with two regions inside: normal system memory with low
6749          * priority, and...
6750          */
6751         memory_region_init_alias(cpu->cpu_as_mem, OBJECT(cpu), "memory",
6752                                  get_system_memory(), 0, ~0ull);
6753         memory_region_add_subregion_overlap(cpu->cpu_as_root, 0, cpu->cpu_as_mem, 0);
6754         memory_region_set_enabled(cpu->cpu_as_mem, true);
6755 
6756         cs->num_ases = 2;
6757         cpu_address_space_init(cs, 0, "cpu-memory", cs->memory);
6758         cpu_address_space_init(cs, 1, "cpu-smm", cpu->cpu_as_root);
6759 
6760         /* ... SMRAM with higher priority, linked from /machine/smram.  */
6761         cpu->machine_done.notify = x86_cpu_machine_done;
6762         qemu_add_machine_init_done_notifier(&cpu->machine_done);
6763     }
6764 #endif
6765 
6766     qemu_init_vcpu(cs);
6767 
6768     /*
6769      * Most Intel and certain AMD CPUs support hyperthreading. Even though QEMU
6770      * fixes this issue by adjusting CPUID_0000_0001_EBX and CPUID_8000_0008_ECX
6771      * based on inputs (sockets,cores,threads), it is still better to give
6772      * users a warning.
6773      *
6774      * NOTE: the following code has to follow qemu_init_vcpu(). Otherwise
6775      * cs->nr_threads hasn't be populated yet and the checking is incorrect.
6776      */
6777     if (IS_AMD_CPU(env) &&
6778         !(env->features[FEAT_8000_0001_ECX] & CPUID_EXT3_TOPOEXT) &&
6779         cs->nr_threads > 1 && !ht_warned) {
6780             warn_report("This family of AMD CPU doesn't support "
6781                         "hyperthreading(%d)",
6782                         cs->nr_threads);
6783             error_printf("Please configure -smp options properly"
6784                          " or try enabling topoext feature.\n");
6785             ht_warned = true;
6786     }
6787 
6788     x86_cpu_apic_realize(cpu, &local_err);
6789     if (local_err != NULL) {
6790         goto out;
6791     }
6792     cpu_reset(cs);
6793 
6794     xcc->parent_realize(dev, &local_err);
6795 
6796 out:
6797     if (local_err != NULL) {
6798         error_propagate(errp, local_err);
6799         return;
6800     }
6801 }
6802 
6803 static void x86_cpu_unrealizefn(DeviceState *dev)
6804 {
6805     X86CPU *cpu = X86_CPU(dev);
6806     X86CPUClass *xcc = X86_CPU_GET_CLASS(dev);
6807 
6808 #ifndef CONFIG_USER_ONLY
6809     cpu_remove_sync(CPU(dev));
6810     qemu_unregister_reset(x86_cpu_machine_reset_cb, dev);
6811 #endif
6812 
6813     if (cpu->apic_state) {
6814         object_unparent(OBJECT(cpu->apic_state));
6815         cpu->apic_state = NULL;
6816     }
6817 
6818     xcc->parent_unrealize(dev);
6819 }
6820 
6821 typedef struct BitProperty {
6822     FeatureWord w;
6823     uint64_t mask;
6824 } BitProperty;
6825 
6826 static void x86_cpu_get_bit_prop(Object *obj, Visitor *v, const char *name,
6827                                  void *opaque, Error **errp)
6828 {
6829     X86CPU *cpu = X86_CPU(obj);
6830     BitProperty *fp = opaque;
6831     uint64_t f = cpu->env.features[fp->w];
6832     bool value = (f & fp->mask) == fp->mask;
6833     visit_type_bool(v, name, &value, errp);
6834 }
6835 
6836 static void x86_cpu_set_bit_prop(Object *obj, Visitor *v, const char *name,
6837                                  void *opaque, Error **errp)
6838 {
6839     DeviceState *dev = DEVICE(obj);
6840     X86CPU *cpu = X86_CPU(obj);
6841     BitProperty *fp = opaque;
6842     bool value;
6843 
6844     if (dev->realized) {
6845         qdev_prop_set_after_realize(dev, name, errp);
6846         return;
6847     }
6848 
6849     if (!visit_type_bool(v, name, &value, errp)) {
6850         return;
6851     }
6852 
6853     if (value) {
6854         cpu->env.features[fp->w] |= fp->mask;
6855     } else {
6856         cpu->env.features[fp->w] &= ~fp->mask;
6857     }
6858     cpu->env.user_features[fp->w] |= fp->mask;
6859 }
6860 
6861 /* Register a boolean property to get/set a single bit in a uint32_t field.
6862  *
6863  * The same property name can be registered multiple times to make it affect
6864  * multiple bits in the same FeatureWord. In that case, the getter will return
6865  * true only if all bits are set.
6866  */
6867 static void x86_cpu_register_bit_prop(X86CPUClass *xcc,
6868                                       const char *prop_name,
6869                                       FeatureWord w,
6870                                       int bitnr)
6871 {
6872     ObjectClass *oc = OBJECT_CLASS(xcc);
6873     BitProperty *fp;
6874     ObjectProperty *op;
6875     uint64_t mask = (1ULL << bitnr);
6876 
6877     op = object_class_property_find(oc, prop_name);
6878     if (op) {
6879         fp = op->opaque;
6880         assert(fp->w == w);
6881         fp->mask |= mask;
6882     } else {
6883         fp = g_new0(BitProperty, 1);
6884         fp->w = w;
6885         fp->mask = mask;
6886         object_class_property_add(oc, prop_name, "bool",
6887                                   x86_cpu_get_bit_prop,
6888                                   x86_cpu_set_bit_prop,
6889                                   NULL, fp);
6890     }
6891 }
6892 
6893 static void x86_cpu_register_feature_bit_props(X86CPUClass *xcc,
6894                                                FeatureWord w,
6895                                                int bitnr)
6896 {
6897     FeatureWordInfo *fi = &feature_word_info[w];
6898     const char *name = fi->feat_names[bitnr];
6899 
6900     if (!name) {
6901         return;
6902     }
6903 
6904     /* Property names should use "-" instead of "_".
6905      * Old names containing underscores are registered as aliases
6906      * using object_property_add_alias()
6907      */
6908     assert(!strchr(name, '_'));
6909     /* aliases don't use "|" delimiters anymore, they are registered
6910      * manually using object_property_add_alias() */
6911     assert(!strchr(name, '|'));
6912     x86_cpu_register_bit_prop(xcc, name, w, bitnr);
6913 }
6914 
6915 #if !defined(CONFIG_USER_ONLY)
6916 static GuestPanicInformation *x86_cpu_get_crash_info(CPUState *cs)
6917 {
6918     X86CPU *cpu = X86_CPU(cs);
6919     CPUX86State *env = &cpu->env;
6920     GuestPanicInformation *panic_info = NULL;
6921 
6922     if (env->features[FEAT_HYPERV_EDX] & HV_GUEST_CRASH_MSR_AVAILABLE) {
6923         panic_info = g_malloc0(sizeof(GuestPanicInformation));
6924 
6925         panic_info->type = GUEST_PANIC_INFORMATION_TYPE_HYPER_V;
6926 
6927         assert(HV_CRASH_PARAMS >= 5);
6928         panic_info->u.hyper_v.arg1 = env->msr_hv_crash_params[0];
6929         panic_info->u.hyper_v.arg2 = env->msr_hv_crash_params[1];
6930         panic_info->u.hyper_v.arg3 = env->msr_hv_crash_params[2];
6931         panic_info->u.hyper_v.arg4 = env->msr_hv_crash_params[3];
6932         panic_info->u.hyper_v.arg5 = env->msr_hv_crash_params[4];
6933     }
6934 
6935     return panic_info;
6936 }
6937 static void x86_cpu_get_crash_info_qom(Object *obj, Visitor *v,
6938                                        const char *name, void *opaque,
6939                                        Error **errp)
6940 {
6941     CPUState *cs = CPU(obj);
6942     GuestPanicInformation *panic_info;
6943 
6944     if (!cs->crash_occurred) {
6945         error_setg(errp, "No crash occured");
6946         return;
6947     }
6948 
6949     panic_info = x86_cpu_get_crash_info(cs);
6950     if (panic_info == NULL) {
6951         error_setg(errp, "No crash information");
6952         return;
6953     }
6954 
6955     visit_type_GuestPanicInformation(v, "crash-information", &panic_info,
6956                                      errp);
6957     qapi_free_GuestPanicInformation(panic_info);
6958 }
6959 #endif /* !CONFIG_USER_ONLY */
6960 
6961 static void x86_cpu_initfn(Object *obj)
6962 {
6963     X86CPU *cpu = X86_CPU(obj);
6964     X86CPUClass *xcc = X86_CPU_GET_CLASS(obj);
6965     CPUX86State *env = &cpu->env;
6966 
6967     env->nr_dies = 1;
6968     cpu_set_cpustate_pointers(cpu);
6969 
6970     object_property_add(obj, "feature-words", "X86CPUFeatureWordInfo",
6971                         x86_cpu_get_feature_words,
6972                         NULL, NULL, (void *)env->features);
6973     object_property_add(obj, "filtered-features", "X86CPUFeatureWordInfo",
6974                         x86_cpu_get_feature_words,
6975                         NULL, NULL, (void *)cpu->filtered_features);
6976 
6977     object_property_add_alias(obj, "sse3", obj, "pni");
6978     object_property_add_alias(obj, "pclmuldq", obj, "pclmulqdq");
6979     object_property_add_alias(obj, "sse4-1", obj, "sse4.1");
6980     object_property_add_alias(obj, "sse4-2", obj, "sse4.2");
6981     object_property_add_alias(obj, "xd", obj, "nx");
6982     object_property_add_alias(obj, "ffxsr", obj, "fxsr-opt");
6983     object_property_add_alias(obj, "i64", obj, "lm");
6984 
6985     object_property_add_alias(obj, "ds_cpl", obj, "ds-cpl");
6986     object_property_add_alias(obj, "tsc_adjust", obj, "tsc-adjust");
6987     object_property_add_alias(obj, "fxsr_opt", obj, "fxsr-opt");
6988     object_property_add_alias(obj, "lahf_lm", obj, "lahf-lm");
6989     object_property_add_alias(obj, "cmp_legacy", obj, "cmp-legacy");
6990     object_property_add_alias(obj, "nodeid_msr", obj, "nodeid-msr");
6991     object_property_add_alias(obj, "perfctr_core", obj, "perfctr-core");
6992     object_property_add_alias(obj, "perfctr_nb", obj, "perfctr-nb");
6993     object_property_add_alias(obj, "kvm_nopiodelay", obj, "kvm-nopiodelay");
6994     object_property_add_alias(obj, "kvm_mmu", obj, "kvm-mmu");
6995     object_property_add_alias(obj, "kvm_asyncpf", obj, "kvm-asyncpf");
6996     object_property_add_alias(obj, "kvm_asyncpf_int", obj, "kvm-asyncpf-int");
6997     object_property_add_alias(obj, "kvm_steal_time", obj, "kvm-steal-time");
6998     object_property_add_alias(obj, "kvm_pv_eoi", obj, "kvm-pv-eoi");
6999     object_property_add_alias(obj, "kvm_pv_unhalt", obj, "kvm-pv-unhalt");
7000     object_property_add_alias(obj, "kvm_poll_control", obj, "kvm-poll-control");
7001     object_property_add_alias(obj, "svm_lock", obj, "svm-lock");
7002     object_property_add_alias(obj, "nrip_save", obj, "nrip-save");
7003     object_property_add_alias(obj, "tsc_scale", obj, "tsc-scale");
7004     object_property_add_alias(obj, "vmcb_clean", obj, "vmcb-clean");
7005     object_property_add_alias(obj, "pause_filter", obj, "pause-filter");
7006     object_property_add_alias(obj, "sse4_1", obj, "sse4.1");
7007     object_property_add_alias(obj, "sse4_2", obj, "sse4.2");
7008 
7009     if (xcc->model) {
7010         x86_cpu_load_model(cpu, xcc->model);
7011     }
7012 }
7013 
7014 static int64_t x86_cpu_get_arch_id(CPUState *cs)
7015 {
7016     X86CPU *cpu = X86_CPU(cs);
7017 
7018     return cpu->apic_id;
7019 }
7020 
7021 static bool x86_cpu_get_paging_enabled(const CPUState *cs)
7022 {
7023     X86CPU *cpu = X86_CPU(cs);
7024 
7025     return cpu->env.cr[0] & CR0_PG_MASK;
7026 }
7027 
7028 static void x86_cpu_set_pc(CPUState *cs, vaddr value)
7029 {
7030     X86CPU *cpu = X86_CPU(cs);
7031 
7032     cpu->env.eip = value;
7033 }
7034 
7035 static void x86_cpu_synchronize_from_tb(CPUState *cs, TranslationBlock *tb)
7036 {
7037     X86CPU *cpu = X86_CPU(cs);
7038 
7039     cpu->env.eip = tb->pc - tb->cs_base;
7040 }
7041 
7042 int x86_cpu_pending_interrupt(CPUState *cs, int interrupt_request)
7043 {
7044     X86CPU *cpu = X86_CPU(cs);
7045     CPUX86State *env = &cpu->env;
7046 
7047 #if !defined(CONFIG_USER_ONLY)
7048     if (interrupt_request & CPU_INTERRUPT_POLL) {
7049         return CPU_INTERRUPT_POLL;
7050     }
7051 #endif
7052     if (interrupt_request & CPU_INTERRUPT_SIPI) {
7053         return CPU_INTERRUPT_SIPI;
7054     }
7055 
7056     if (env->hflags2 & HF2_GIF_MASK) {
7057         if ((interrupt_request & CPU_INTERRUPT_SMI) &&
7058             !(env->hflags & HF_SMM_MASK)) {
7059             return CPU_INTERRUPT_SMI;
7060         } else if ((interrupt_request & CPU_INTERRUPT_NMI) &&
7061                    !(env->hflags2 & HF2_NMI_MASK)) {
7062             return CPU_INTERRUPT_NMI;
7063         } else if (interrupt_request & CPU_INTERRUPT_MCE) {
7064             return CPU_INTERRUPT_MCE;
7065         } else if ((interrupt_request & CPU_INTERRUPT_HARD) &&
7066                    (((env->hflags2 & HF2_VINTR_MASK) &&
7067                      (env->hflags2 & HF2_HIF_MASK)) ||
7068                     (!(env->hflags2 & HF2_VINTR_MASK) &&
7069                      (env->eflags & IF_MASK &&
7070                       !(env->hflags & HF_INHIBIT_IRQ_MASK))))) {
7071             return CPU_INTERRUPT_HARD;
7072 #if !defined(CONFIG_USER_ONLY)
7073         } else if ((interrupt_request & CPU_INTERRUPT_VIRQ) &&
7074                    (env->eflags & IF_MASK) &&
7075                    !(env->hflags & HF_INHIBIT_IRQ_MASK)) {
7076             return CPU_INTERRUPT_VIRQ;
7077 #endif
7078         }
7079     }
7080 
7081     return 0;
7082 }
7083 
7084 static bool x86_cpu_has_work(CPUState *cs)
7085 {
7086     return x86_cpu_pending_interrupt(cs, cs->interrupt_request) != 0;
7087 }
7088 
7089 static void x86_disas_set_info(CPUState *cs, disassemble_info *info)
7090 {
7091     X86CPU *cpu = X86_CPU(cs);
7092     CPUX86State *env = &cpu->env;
7093 
7094     info->mach = (env->hflags & HF_CS64_MASK ? bfd_mach_x86_64
7095                   : env->hflags & HF_CS32_MASK ? bfd_mach_i386_i386
7096                   : bfd_mach_i386_i8086);
7097     info->print_insn = print_insn_i386;
7098 
7099     info->cap_arch = CS_ARCH_X86;
7100     info->cap_mode = (env->hflags & HF_CS64_MASK ? CS_MODE_64
7101                       : env->hflags & HF_CS32_MASK ? CS_MODE_32
7102                       : CS_MODE_16);
7103     info->cap_insn_unit = 1;
7104     info->cap_insn_split = 8;
7105 }
7106 
7107 void x86_update_hflags(CPUX86State *env)
7108 {
7109    uint32_t hflags;
7110 #define HFLAG_COPY_MASK \
7111     ~( HF_CPL_MASK | HF_PE_MASK | HF_MP_MASK | HF_EM_MASK | \
7112        HF_TS_MASK | HF_TF_MASK | HF_VM_MASK | HF_IOPL_MASK | \
7113        HF_OSFXSR_MASK | HF_LMA_MASK | HF_CS32_MASK | \
7114        HF_SS32_MASK | HF_CS64_MASK | HF_ADDSEG_MASK)
7115 
7116     hflags = env->hflags & HFLAG_COPY_MASK;
7117     hflags |= (env->segs[R_SS].flags >> DESC_DPL_SHIFT) & HF_CPL_MASK;
7118     hflags |= (env->cr[0] & CR0_PE_MASK) << (HF_PE_SHIFT - CR0_PE_SHIFT);
7119     hflags |= (env->cr[0] << (HF_MP_SHIFT - CR0_MP_SHIFT)) &
7120                 (HF_MP_MASK | HF_EM_MASK | HF_TS_MASK);
7121     hflags |= (env->eflags & (HF_TF_MASK | HF_VM_MASK | HF_IOPL_MASK));
7122 
7123     if (env->cr[4] & CR4_OSFXSR_MASK) {
7124         hflags |= HF_OSFXSR_MASK;
7125     }
7126 
7127     if (env->efer & MSR_EFER_LMA) {
7128         hflags |= HF_LMA_MASK;
7129     }
7130 
7131     if ((hflags & HF_LMA_MASK) && (env->segs[R_CS].flags & DESC_L_MASK)) {
7132         hflags |= HF_CS32_MASK | HF_SS32_MASK | HF_CS64_MASK;
7133     } else {
7134         hflags |= (env->segs[R_CS].flags & DESC_B_MASK) >>
7135                     (DESC_B_SHIFT - HF_CS32_SHIFT);
7136         hflags |= (env->segs[R_SS].flags & DESC_B_MASK) >>
7137                     (DESC_B_SHIFT - HF_SS32_SHIFT);
7138         if (!(env->cr[0] & CR0_PE_MASK) || (env->eflags & VM_MASK) ||
7139             !(hflags & HF_CS32_MASK)) {
7140             hflags |= HF_ADDSEG_MASK;
7141         } else {
7142             hflags |= ((env->segs[R_DS].base | env->segs[R_ES].base |
7143                         env->segs[R_SS].base) != 0) << HF_ADDSEG_SHIFT;
7144         }
7145     }
7146     env->hflags = hflags;
7147 }
7148 
7149 static Property x86_cpu_properties[] = {
7150 #ifdef CONFIG_USER_ONLY
7151     /* apic_id = 0 by default for *-user, see commit 9886e834 */
7152     DEFINE_PROP_UINT32("apic-id", X86CPU, apic_id, 0),
7153     DEFINE_PROP_INT32("thread-id", X86CPU, thread_id, 0),
7154     DEFINE_PROP_INT32("core-id", X86CPU, core_id, 0),
7155     DEFINE_PROP_INT32("die-id", X86CPU, die_id, 0),
7156     DEFINE_PROP_INT32("socket-id", X86CPU, socket_id, 0),
7157 #else
7158     DEFINE_PROP_UINT32("apic-id", X86CPU, apic_id, UNASSIGNED_APIC_ID),
7159     DEFINE_PROP_INT32("thread-id", X86CPU, thread_id, -1),
7160     DEFINE_PROP_INT32("core-id", X86CPU, core_id, -1),
7161     DEFINE_PROP_INT32("die-id", X86CPU, die_id, -1),
7162     DEFINE_PROP_INT32("socket-id", X86CPU, socket_id, -1),
7163 #endif
7164     DEFINE_PROP_INT32("node-id", X86CPU, node_id, CPU_UNSET_NUMA_NODE_ID),
7165     DEFINE_PROP_BOOL("pmu", X86CPU, enable_pmu, false),
7166 
7167     DEFINE_PROP_UINT32("hv-spinlocks", X86CPU, hyperv_spinlock_attempts,
7168                        HYPERV_SPINLOCK_NEVER_NOTIFY),
7169     DEFINE_PROP_BIT64("hv-relaxed", X86CPU, hyperv_features,
7170                       HYPERV_FEAT_RELAXED, 0),
7171     DEFINE_PROP_BIT64("hv-vapic", X86CPU, hyperv_features,
7172                       HYPERV_FEAT_VAPIC, 0),
7173     DEFINE_PROP_BIT64("hv-time", X86CPU, hyperv_features,
7174                       HYPERV_FEAT_TIME, 0),
7175     DEFINE_PROP_BIT64("hv-crash", X86CPU, hyperv_features,
7176                       HYPERV_FEAT_CRASH, 0),
7177     DEFINE_PROP_BIT64("hv-reset", X86CPU, hyperv_features,
7178                       HYPERV_FEAT_RESET, 0),
7179     DEFINE_PROP_BIT64("hv-vpindex", X86CPU, hyperv_features,
7180                       HYPERV_FEAT_VPINDEX, 0),
7181     DEFINE_PROP_BIT64("hv-runtime", X86CPU, hyperv_features,
7182                       HYPERV_FEAT_RUNTIME, 0),
7183     DEFINE_PROP_BIT64("hv-synic", X86CPU, hyperv_features,
7184                       HYPERV_FEAT_SYNIC, 0),
7185     DEFINE_PROP_BIT64("hv-stimer", X86CPU, hyperv_features,
7186                       HYPERV_FEAT_STIMER, 0),
7187     DEFINE_PROP_BIT64("hv-frequencies", X86CPU, hyperv_features,
7188                       HYPERV_FEAT_FREQUENCIES, 0),
7189     DEFINE_PROP_BIT64("hv-reenlightenment", X86CPU, hyperv_features,
7190                       HYPERV_FEAT_REENLIGHTENMENT, 0),
7191     DEFINE_PROP_BIT64("hv-tlbflush", X86CPU, hyperv_features,
7192                       HYPERV_FEAT_TLBFLUSH, 0),
7193     DEFINE_PROP_BIT64("hv-evmcs", X86CPU, hyperv_features,
7194                       HYPERV_FEAT_EVMCS, 0),
7195     DEFINE_PROP_BIT64("hv-ipi", X86CPU, hyperv_features,
7196                       HYPERV_FEAT_IPI, 0),
7197     DEFINE_PROP_BIT64("hv-stimer-direct", X86CPU, hyperv_features,
7198                       HYPERV_FEAT_STIMER_DIRECT, 0),
7199     DEFINE_PROP_ON_OFF_AUTO("hv-no-nonarch-coresharing", X86CPU,
7200                             hyperv_no_nonarch_cs, ON_OFF_AUTO_OFF),
7201     DEFINE_PROP_BOOL("hv-passthrough", X86CPU, hyperv_passthrough, false),
7202 
7203     DEFINE_PROP_BOOL("check", X86CPU, check_cpuid, true),
7204     DEFINE_PROP_BOOL("enforce", X86CPU, enforce_cpuid, false),
7205     DEFINE_PROP_BOOL("x-force-features", X86CPU, force_features, false),
7206     DEFINE_PROP_BOOL("kvm", X86CPU, expose_kvm, true),
7207     DEFINE_PROP_UINT32("phys-bits", X86CPU, phys_bits, 0),
7208     DEFINE_PROP_BOOL("host-phys-bits", X86CPU, host_phys_bits, false),
7209     DEFINE_PROP_UINT8("host-phys-bits-limit", X86CPU, host_phys_bits_limit, 0),
7210     DEFINE_PROP_BOOL("fill-mtrr-mask", X86CPU, fill_mtrr_mask, true),
7211     DEFINE_PROP_UINT32("level-func7", X86CPU, env.cpuid_level_func7,
7212                        UINT32_MAX),
7213     DEFINE_PROP_UINT32("level", X86CPU, env.cpuid_level, UINT32_MAX),
7214     DEFINE_PROP_UINT32("xlevel", X86CPU, env.cpuid_xlevel, UINT32_MAX),
7215     DEFINE_PROP_UINT32("xlevel2", X86CPU, env.cpuid_xlevel2, UINT32_MAX),
7216     DEFINE_PROP_UINT32("min-level", X86CPU, env.cpuid_min_level, 0),
7217     DEFINE_PROP_UINT32("min-xlevel", X86CPU, env.cpuid_min_xlevel, 0),
7218     DEFINE_PROP_UINT32("min-xlevel2", X86CPU, env.cpuid_min_xlevel2, 0),
7219     DEFINE_PROP_UINT64("ucode-rev", X86CPU, ucode_rev, 0),
7220     DEFINE_PROP_BOOL("full-cpuid-auto-level", X86CPU, full_cpuid_auto_level, true),
7221     DEFINE_PROP_STRING("hv-vendor-id", X86CPU, hyperv_vendor_id),
7222     DEFINE_PROP_BOOL("cpuid-0xb", X86CPU, enable_cpuid_0xb, true),
7223     DEFINE_PROP_BOOL("lmce", X86CPU, enable_lmce, false),
7224     DEFINE_PROP_BOOL("l3-cache", X86CPU, enable_l3_cache, true),
7225     DEFINE_PROP_BOOL("kvm-no-smi-migration", X86CPU, kvm_no_smi_migration,
7226                      false),
7227     DEFINE_PROP_BOOL("vmware-cpuid-freq", X86CPU, vmware_cpuid_freq, true),
7228     DEFINE_PROP_BOOL("tcg-cpuid", X86CPU, expose_tcg, true),
7229     DEFINE_PROP_BOOL("x-migrate-smi-count", X86CPU, migrate_smi_count,
7230                      true),
7231     /*
7232      * lecacy_cache defaults to true unless the CPU model provides its
7233      * own cache information (see x86_cpu_load_def()).
7234      */
7235     DEFINE_PROP_BOOL("legacy-cache", X86CPU, legacy_cache, true),
7236 
7237     /*
7238      * From "Requirements for Implementing the Microsoft
7239      * Hypervisor Interface":
7240      * https://docs.microsoft.com/en-us/virtualization/hyper-v-on-windows/reference/tlfs
7241      *
7242      * "Starting with Windows Server 2012 and Windows 8, if
7243      * CPUID.40000005.EAX contains a value of -1, Windows assumes that
7244      * the hypervisor imposes no specific limit to the number of VPs.
7245      * In this case, Windows Server 2012 guest VMs may use more than
7246      * 64 VPs, up to the maximum supported number of processors applicable
7247      * to the specific Windows version being used."
7248      */
7249     DEFINE_PROP_INT32("x-hv-max-vps", X86CPU, hv_max_vps, -1),
7250     DEFINE_PROP_BOOL("x-hv-synic-kvm-only", X86CPU, hyperv_synic_kvm_only,
7251                      false),
7252     DEFINE_PROP_BOOL("x-intel-pt-auto-level", X86CPU, intel_pt_auto_level,
7253                      true),
7254     DEFINE_PROP_END_OF_LIST()
7255 };
7256 
7257 static void x86_cpu_common_class_init(ObjectClass *oc, void *data)
7258 {
7259     X86CPUClass *xcc = X86_CPU_CLASS(oc);
7260     CPUClass *cc = CPU_CLASS(oc);
7261     DeviceClass *dc = DEVICE_CLASS(oc);
7262     FeatureWord w;
7263 
7264     device_class_set_parent_realize(dc, x86_cpu_realizefn,
7265                                     &xcc->parent_realize);
7266     device_class_set_parent_unrealize(dc, x86_cpu_unrealizefn,
7267                                       &xcc->parent_unrealize);
7268     device_class_set_props(dc, x86_cpu_properties);
7269 
7270     device_class_set_parent_reset(dc, x86_cpu_reset, &xcc->parent_reset);
7271     cc->reset_dump_flags = CPU_DUMP_FPU | CPU_DUMP_CCOP;
7272 
7273     cc->class_by_name = x86_cpu_class_by_name;
7274     cc->parse_features = x86_cpu_parse_featurestr;
7275     cc->has_work = x86_cpu_has_work;
7276 #ifdef CONFIG_TCG
7277     cc->do_interrupt = x86_cpu_do_interrupt;
7278     cc->cpu_exec_interrupt = x86_cpu_exec_interrupt;
7279 #endif
7280     cc->dump_state = x86_cpu_dump_state;
7281     cc->set_pc = x86_cpu_set_pc;
7282     cc->synchronize_from_tb = x86_cpu_synchronize_from_tb;
7283     cc->gdb_read_register = x86_cpu_gdb_read_register;
7284     cc->gdb_write_register = x86_cpu_gdb_write_register;
7285     cc->get_arch_id = x86_cpu_get_arch_id;
7286     cc->get_paging_enabled = x86_cpu_get_paging_enabled;
7287 #ifndef CONFIG_USER_ONLY
7288     cc->asidx_from_attrs = x86_asidx_from_attrs;
7289     cc->get_memory_mapping = x86_cpu_get_memory_mapping;
7290     cc->get_phys_page_attrs_debug = x86_cpu_get_phys_page_attrs_debug;
7291     cc->get_crash_info = x86_cpu_get_crash_info;
7292     cc->write_elf64_note = x86_cpu_write_elf64_note;
7293     cc->write_elf64_qemunote = x86_cpu_write_elf64_qemunote;
7294     cc->write_elf32_note = x86_cpu_write_elf32_note;
7295     cc->write_elf32_qemunote = x86_cpu_write_elf32_qemunote;
7296     cc->vmsd = &vmstate_x86_cpu;
7297 #endif
7298     cc->gdb_arch_name = x86_gdb_arch_name;
7299 #ifdef TARGET_X86_64
7300     cc->gdb_core_xml_file = "i386-64bit.xml";
7301     cc->gdb_num_core_regs = 66;
7302 #else
7303     cc->gdb_core_xml_file = "i386-32bit.xml";
7304     cc->gdb_num_core_regs = 50;
7305 #endif
7306 #if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
7307     cc->debug_excp_handler = breakpoint_handler;
7308 #endif
7309     cc->cpu_exec_enter = x86_cpu_exec_enter;
7310     cc->cpu_exec_exit = x86_cpu_exec_exit;
7311 #ifdef CONFIG_TCG
7312     cc->tcg_initialize = tcg_x86_init;
7313     cc->tlb_fill = x86_cpu_tlb_fill;
7314 #endif
7315     cc->disas_set_info = x86_disas_set_info;
7316 
7317     dc->user_creatable = true;
7318 
7319     object_class_property_add(oc, "family", "int",
7320                               x86_cpuid_version_get_family,
7321                               x86_cpuid_version_set_family, NULL, NULL);
7322     object_class_property_add(oc, "model", "int",
7323                               x86_cpuid_version_get_model,
7324                               x86_cpuid_version_set_model, NULL, NULL);
7325     object_class_property_add(oc, "stepping", "int",
7326                               x86_cpuid_version_get_stepping,
7327                               x86_cpuid_version_set_stepping, NULL, NULL);
7328     object_class_property_add_str(oc, "vendor",
7329                                   x86_cpuid_get_vendor,
7330                                   x86_cpuid_set_vendor);
7331     object_class_property_add_str(oc, "model-id",
7332                                   x86_cpuid_get_model_id,
7333                                   x86_cpuid_set_model_id);
7334     object_class_property_add(oc, "tsc-frequency", "int",
7335                               x86_cpuid_get_tsc_freq,
7336                               x86_cpuid_set_tsc_freq, NULL, NULL);
7337     /*
7338      * The "unavailable-features" property has the same semantics as
7339      * CpuDefinitionInfo.unavailable-features on the "query-cpu-definitions"
7340      * QMP command: they list the features that would have prevented the
7341      * CPU from running if the "enforce" flag was set.
7342      */
7343     object_class_property_add(oc, "unavailable-features", "strList",
7344                               x86_cpu_get_unavailable_features,
7345                               NULL, NULL, NULL);
7346 
7347 #if !defined(CONFIG_USER_ONLY)
7348     object_class_property_add(oc, "crash-information", "GuestPanicInformation",
7349                               x86_cpu_get_crash_info_qom, NULL, NULL, NULL);
7350 #endif
7351 
7352     for (w = 0; w < FEATURE_WORDS; w++) {
7353         int bitnr;
7354         for (bitnr = 0; bitnr < 64; bitnr++) {
7355             x86_cpu_register_feature_bit_props(xcc, w, bitnr);
7356         }
7357     }
7358 }
7359 
7360 static const TypeInfo x86_cpu_type_info = {
7361     .name = TYPE_X86_CPU,
7362     .parent = TYPE_CPU,
7363     .instance_size = sizeof(X86CPU),
7364     .instance_init = x86_cpu_initfn,
7365     .abstract = true,
7366     .class_size = sizeof(X86CPUClass),
7367     .class_init = x86_cpu_common_class_init,
7368 };
7369 
7370 
7371 /* "base" CPU model, used by query-cpu-model-expansion */
7372 static void x86_cpu_base_class_init(ObjectClass *oc, void *data)
7373 {
7374     X86CPUClass *xcc = X86_CPU_CLASS(oc);
7375 
7376     xcc->static_model = true;
7377     xcc->migration_safe = true;
7378     xcc->model_description = "base CPU model type with no features enabled";
7379     xcc->ordering = 8;
7380 }
7381 
7382 static const TypeInfo x86_base_cpu_type_info = {
7383         .name = X86_CPU_TYPE_NAME("base"),
7384         .parent = TYPE_X86_CPU,
7385         .class_init = x86_cpu_base_class_init,
7386 };
7387 
7388 static void x86_cpu_register_types(void)
7389 {
7390     int i;
7391 
7392     type_register_static(&x86_cpu_type_info);
7393     for (i = 0; i < ARRAY_SIZE(builtin_x86_defs); i++) {
7394         x86_register_cpudef_types(&builtin_x86_defs[i]);
7395     }
7396     type_register_static(&max_x86_cpu_type_info);
7397     type_register_static(&x86_base_cpu_type_info);
7398 #if defined(CONFIG_KVM) || defined(CONFIG_HVF)
7399     type_register_static(&host_x86_cpu_type_info);
7400 #endif
7401 }
7402 
7403 type_init(x86_cpu_register_types)
7404