[PATCH v6 1/8] i386: Add Intel RDT device and State to config.

[PATCH v6 1/8] i386: Add Intel RDT device and State to config.

[Hendrik Wuethrich]

Change config to show RDT, add minimal code to the rdt.c module to make
sure things still compile.

Signed-off-by: Hendrik Wuethrich <whendrik@google.com>
---
 hw/i386/Kconfig       |  4 ++
 hw/i386/meson.build   |  1 +
 hw/i386/rdt.c         | 97 +++++++++++++++++++++++++++++++++++++++++++
 include/hw/i386/rdt.h | 35 ++++++++++++++++
 target/i386/cpu.h     |  4 ++
 5 files changed, 141 insertions(+)
 create mode 100644 hw/i386/rdt.c
 create mode 100644 include/hw/i386/rdt.h

diff --git a/hw/i386/Kconfig b/hw/i386/Kconfig
index d34ce07b21..a3a6b2259c 100644
--- a/hw/i386/Kconfig
+++ b/hw/i386/Kconfig
@@ -10,6 +10,9 @@ config SGX
     bool
     depends on KVM
 
+config RDT
+    bool
+
 config PC
     bool
     imply APPLESMC
@@ -26,6 +29,7 @@ config PC
     imply QXL
     imply SEV
     imply SGX
+    imply RDT
     imply TEST_DEVICES
     imply TPM_CRB
     imply TPM_TIS_ISA
diff --git a/hw/i386/meson.build b/hw/i386/meson.build
index 10bdfde27c..3a697dcc03 100644
--- a/hw/i386/meson.build
+++ b/hw/i386/meson.build
@@ -22,6 +22,7 @@ i386_ss.add(when: 'CONFIG_VMPORT', if_true: files('vmport.c'))
 i386_ss.add(when: 'CONFIG_VTD', if_true: files('intel_iommu.c'))
 i386_ss.add(when: 'CONFIG_SGX', if_true: files('sgx-epc.c','sgx.c'),
                                 if_false: files('sgx-stub.c'))
+i386_ss.add(when: 'CONFIG_RDT', if_true: files('rdt.c'))
 
 i386_ss.add(when: 'CONFIG_ACPI', if_true: files('acpi-common.c'))
 i386_ss.add(when: 'CONFIG_PC', if_true: files(
diff --git a/hw/i386/rdt.c b/hw/i386/rdt.c
new file mode 100644
index 0000000000..76a253902b
--- /dev/null
+++ b/hw/i386/rdt.c
@@ -0,0 +1,97 @@
+/*
+ * Intel Resource Director Technology (RDT).
+ *
+ * Copyright 2025 Google LLC
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+#include "hw/i386/rdt.h"
+#include "qemu/osdep.h" /* Needs to be included before isa.h */
+#include "hw/isa/isa.h"
+#include "hw/qdev-properties.h"
+#include "qom/object.h"
+
+#define TYPE_RDT "rdt"
+#define RDT_NUM_RMID_PROP "rmids"
+
+OBJECT_DECLARE_TYPE(RDTState, RDTStateClass, RDT);
+
+struct RDTMonitor {
+    uint64_t count_local;
+    uint64_t count_remote;
+    uint64_t count_l3;
+};
+
+struct RDTAllocation {
+    QemuMutex lock;
+    uint32_t active_cos;
+};
+
+struct RDTStatePerCore {
+    QemuMutex lock;
+    uint32_t active_rmid;
+};
+
+struct RDTStatePerL3Cache {
+    QemuMutex lock;
+
+    RDTMonitor *monitors;
+
+    /* RDT Allocation bitmask MSRs */
+    uint32_t msr_L3_ia32_mask_n[RDT_MAX_L3_MASK_COUNT];
+    uint32_t msr_L2_ia32_mask_n[RDT_MAX_L2_MASK_COUNT];
+    uint32_t ia32_L2_qos_ext_bw_thrtl_n[RDT_MAX_MBA_THRTL_COUNT];
+
+    /* Parent RDTState */
+    RDTState *rdtstate;
+};
+
+/* One instance of RDT-internal state to be shared by all cores */
+struct RDTState {
+    ISADevice parent;
+
+    /* Max amount of RMIDs */
+    uint32_t rmids;
+
+    uint16_t l3_caches;
+
+    RDTStatePerL3Cache *rdtInstances;
+    RDTAllocation *allocations;
+};
+
+struct RDTStateClass {
+};
+
+OBJECT_DEFINE_TYPE(RDTState, rdt, RDT, ISA_DEVICE);
+
+static Property rdt_properties[] = {
+    DEFINE_PROP_UINT32(RDT_NUM_RMID_PROP, RDTState, rmids, 256),
+};
+
+static void rdt_init(Object *obj)
+{
+}
+
+static void rdt_finalize(Object *obj)
+{
+}
+
+static void rdt_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->hotpluggable = false;
+    dc->desc = "RDT";
+    dc->user_creatable = true;
+
+    device_class_set_props(dc, rdt_properties);
+}
diff --git a/include/hw/i386/rdt.h b/include/hw/i386/rdt.h
new file mode 100644
index 0000000000..1f99f98f7f
--- /dev/null
+++ b/include/hw/i386/rdt.h
@@ -0,0 +1,35 @@
+/*
+ * Intel Resource Director Technology (RDT).
+ *
+ * Copyright 2025 Google LLC
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+#ifndef HW_RDT_H
+#define HW_RDT_H
+
+/* Max counts for allocation masks or CBMs. In other words, the size of
+ * respective MSRs.
+ * L3_MASK and L3_mask are architectural limitations. THRTL_COUNT is just
+ * the space left until the next MSR.
+ * */
+#define RDT_MAX_L3_MASK_COUNT      127
+#define RDT_MAX_L2_MASK_COUNT      63
+#define RDT_MAX_MBA_THRTL_COUNT    63
+
+typedef struct RDTState RDTState;
+typedef struct RDTStatePerL3Cache RDTStatePerL3Cache;
+typedef struct RDTStatePerCore RDTStatePerCore;
+typedef struct RDTMonitor RDTMonitor;
+typedef struct RDTAllocation RDTAllocation;
+
+#endif
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index c67b42d34f..2cbcc8fe4e 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -2253,6 +2253,10 @@ struct ArchCPU {
     struct MemoryRegion *cpu_as_root, *cpu_as_mem, *smram;
     Notifier machine_done;
 
+    /* Help the RDT MSRs find the RDT device state */
+    struct RDTStatePerL3Cache *rdtStatePerL3Cache;
+    struct RDTStatePerCore *rdtPerCore;
+
     struct kvm_msrs *kvm_msr_buf;
 
     int32_t node_id; /* NUMA node this CPU belongs to */
-- 
2.48.1.711.g2feabab25a-goog

[PATCH v6 2/8] i386: Add init and realize functionality for RDT device.

[Hendrik Wuethrich]

Add code to initialize all necessary state for the RDT device.

Signed-off-by: Hendrik Wuethrich <whendrik@google.com>
---
 hw/i386/rdt.c | 80 +++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 80 insertions(+)

diff --git a/hw/i386/rdt.c b/hw/i386/rdt.c
index 76a253902b..498c7b70ad 100644
--- a/hw/i386/rdt.c
+++ b/hw/i386/rdt.c
@@ -18,7 +18,9 @@
 #include "qemu/osdep.h" /* Needs to be included before isa.h */
 #include "hw/isa/isa.h"
 #include "hw/qdev-properties.h"
+#include "include/hw/boards.h"
 #include "qom/object.h"
+#include "target/i386/cpu.h"
 
 #define TYPE_RDT "rdt"
 #define RDT_NUM_RMID_PROP "rmids"
@@ -71,6 +73,16 @@ struct RDTState {
 struct RDTStateClass {
 };
 
+static inline int16_t cache_ids_contain(uint32_t current_ids[],
+                                        uint16_t size, uint32_t id) {
+    for (int i = 0; i < size; i++) {
+        if (current_ids[i] == id) {
+            return i;
+        }
+    }
+    return -1;
+}
+
 OBJECT_DEFINE_TYPE(RDTState, rdt, RDT, ISA_DEVICE);
 
 static Property rdt_properties[] = {
@@ -81,8 +93,75 @@ static void rdt_init(Object *obj)
 {
 }
 
+static void rdt_realize(DeviceState *dev, Error **errp) {
+    RDTState *rdtDev = RDT(dev);
+    MachineState *ms = MACHINE(qdev_get_machine());
+    rdtDev->rdtInstances = NULL;
+    rdtDev->l3_caches = 0;
+    uint32_t *cache_ids_found = g_malloc(sizeof(uint32_t) * 256);
+    uint32_t cache_ids_size = 0;
+
+    /* Iterate over all CPUs and set RDT state */
+    for (int i = 0; i < ms->possible_cpus->len; i++) {
+        X86CPU *x86_cpu = X86_CPU(ms->possible_cpus->cpus[i].cpu);
+        X86CPUTopoInfo topo_info = x86_cpu->env.topo_info;
+
+        uint32_t num_threads_sharing = apicid_pkg_offset(&topo_info);
+        uint32_t index_msb = 32 - clz32(num_threads_sharing);
+        uint32_t l3_id = x86_cpu->apic_id & ~((1 << index_msb) - 1);
+
+        int16_t pos = cache_ids_contain(cache_ids_found,
+                                        cache_ids_size, l3_id);
+        /*
+         * If we find a core that shares a new L3 cache,
+         * initialize the relevant per-L3 state.
+         * */
+        if (pos == -1) {
+            cache_ids_size++;
+            pos = cache_ids_size - 1;
+            cache_ids_found[pos] = l3_id;
+
+            rdtDev->rdtInstances = g_realloc(rdtDev->rdtInstances,
+                                             sizeof(RDTStatePerL3Cache) *
+                                             cache_ids_size);
+            rdtDev->l3_caches++;
+            RDTStatePerL3Cache *rdt = &rdtDev->rdtInstances[pos];
+            rdt->rdtstate = rdtDev;
+            rdt->monitors = g_malloc(sizeof(RDTMonitor) * rdtDev->rmids);
+            rdt->rdtstate->allocations = g_malloc(sizeof(RDTAllocation) *
+                                                  rdtDev->rmids);
+            rdt->monitors->count_local = 0;
+            rdt->monitors->count_remote = 0;
+            rdt->monitors->count_l3 = 0;
+            memset(rdt->msr_L2_ia32_mask_n, 0xF,
+                   sizeof(rdt->msr_L2_ia32_mask_n));
+            memset(rdt->msr_L3_ia32_mask_n, 0xF,
+                   sizeof(rdt->msr_L3_ia32_mask_n));
+            memset(rdt->ia32_L2_qos_ext_bw_thrtl_n, 0xF,
+                   sizeof(rdt->ia32_L2_qos_ext_bw_thrtl_n));
+            qemu_mutex_init(&rdt->rdtstate->allocations->lock);
+            qemu_mutex_init(&rdt->lock);
+        }
+
+        x86_cpu->rdtStatePerL3Cache = &rdtDev->rdtInstances[pos];
+        x86_cpu->rdtPerCore = g_malloc(sizeof(RDTStatePerCore));
+
+        qemu_mutex_init(&x86_cpu->rdtPerCore->lock);
+    }
+}
+
 static void rdt_finalize(Object *obj)
 {
+    RDTState *rdt = RDT(obj);
+    MachineState *ms = MACHINE(qdev_get_machine());
+
+    for (int i = 0; i < ms->possible_cpus->len; i++) {
+        RDTStatePerL3Cache *rdtInstance = &rdt->rdtInstances[i];
+        g_free(rdtInstance->monitors);
+        g_free(rdtInstance->rdtstate->allocations);
+    }
+
+    g_free(rdt->rdtInstances);
 }
 
 static void rdt_class_init(ObjectClass *klass, void *data)
@@ -92,6 +171,7 @@ static void rdt_class_init(ObjectClass *klass, void *data)
     dc->hotpluggable = false;
     dc->desc = "RDT";
     dc->user_creatable = true;
+    dc->realize = rdt_realize;
 
     device_class_set_props(dc, rdt_properties);
 }
-- 
2.48.1.711.g2feabab25a-goog

[PATCH v6 3/8] i386: Add RDT functionality

[Hendrik Wuethrich]

Add RDT code to Associate CLOSID with RMID / set RMID for monitoring,
write COS, and read monitoring data. This patch does not add code for
the guest to interact through these things with MSRs, only the actual
ability for the RDT device to do them.

Signed-off-by: Hendrik Wuethrich <whendrik@google.com>
---
 hw/i386/rdt.c         | 145 ++++++++++++++++++++++++++++++++++++++++++
 include/hw/i386/rdt.h |  16 +++++
 2 files changed, 161 insertions(+)

diff --git a/hw/i386/rdt.c b/hw/i386/rdt.c
index 498c7b70ad..32ef1ee124 100644
--- a/hw/i386/rdt.c
+++ b/hw/i386/rdt.c
@@ -22,9 +22,17 @@
 #include "qom/object.h"
 #include "target/i386/cpu.h"
 
+/* RDT Monitoring Event Codes */
+#define RDT_EVENT_L3_OCCUPANCY 1
+#define RDT_EVENT_L3_REMOTE_BW 2
+#define RDT_EVENT_L3_LOCAL_BW 3
+
 #define TYPE_RDT "rdt"
 #define RDT_NUM_RMID_PROP "rmids"
 
+#define QM_CTR_ERROR        (1ULL << 63)
+#define QM_CTR_UNAVAILABLE  (1ULL << 62)
+
 OBJECT_DECLARE_TYPE(RDTState, RDTStateClass, RDT);
 
 struct RDTMonitor {
@@ -73,6 +81,143 @@ struct RDTState {
 struct RDTStateClass {
 };
 
+bool rdt_associate_rmid_cos(uint64_t msr_ia32_pqr_assoc)
+{
+    X86CPU *cpu = X86_CPU(current_cpu);
+    RDTStatePerL3Cache *rdtStatePerL3Cache = cpu->rdtStatePerL3Cache;
+    RDTStatePerCore *rdtPerCore = cpu->rdtPerCore;
+    RDTAllocation *alloc;
+
+    uint32_t cos_id = (msr_ia32_pqr_assoc & 0xffff0000) >> 16;
+    uint32_t rmid = msr_ia32_pqr_assoc & 0xffff;
+
+    if (cos_id > RDT_MAX_L3_MASK_COUNT || cos_id > RDT_MAX_L2_MASK_COUNT ||
+        cos_id > RDT_MAX_MBA_THRTL_COUNT || rmid > rdt_max_rmid(rdtStatePerL3Cache)) {
+        return false;
+    }
+
+    qemu_mutex_lock(&rdtPerCore->lock);
+    qemu_mutex_lock(&rdtStatePerL3Cache->lock);
+
+    rdtPerCore->active_rmid = rmid;
+
+    alloc = &rdtStatePerL3Cache->rdtstate->allocations[rmid];
+
+    alloc->active_cos = cos_id;
+
+    qemu_mutex_unlock(&rdtStatePerL3Cache->lock);
+    qemu_mutex_unlock(&rdtPerCore->lock);
+
+    return true;
+}
+
+uint32_t rdt_read_l3_mask(uint32_t pos)
+{
+    X86CPU *cpu = X86_CPU(current_cpu);
+    RDTStatePerL3Cache *rdt = cpu->rdtStatePerL3Cache;
+
+    qemu_mutex_lock(&rdt->lock);
+    return rdt->msr_L3_ia32_mask_n[pos];
+    qemu_mutex_unlock(&rdt->lock);
+}
+
+uint32_t rdt_read_l2_mask(uint32_t pos)
+{
+    X86CPU *cpu = X86_CPU(current_cpu);
+    RDTStatePerL3Cache *rdt = cpu->rdtStatePerL3Cache;
+
+    qemu_mutex_lock(&rdt->lock);
+    return rdt->msr_L2_ia32_mask_n[pos];
+    qemu_mutex_unlock(&rdt->lock);
+}
+
+uint32_t rdt_read_mba_thrtl(uint32_t pos)
+{
+    X86CPU *cpu = X86_CPU(current_cpu);
+    RDTStatePerL3Cache *rdt = cpu->rdtStatePerL3Cache;
+
+    qemu_mutex_lock(&rdt->lock);
+    return rdt->ia32_L2_qos_ext_bw_thrtl_n[pos];
+    qemu_mutex_unlock(&rdt->lock);
+}
+
+void rdt_write_msr_l3_mask(uint32_t pos, uint32_t val)
+{
+    X86CPU *cpu = X86_CPU(current_cpu);
+    RDTStatePerL3Cache *rdt = cpu->rdtStatePerL3Cache;
+
+    qemu_mutex_lock(&rdt->lock);
+    rdt->msr_L3_ia32_mask_n[pos] = val;
+    qemu_mutex_unlock(&rdt->lock);
+}
+
+void rdt_write_msr_l2_mask(uint32_t pos, uint32_t val)
+{
+    X86CPU *cpu = X86_CPU(current_cpu);
+    RDTStatePerL3Cache *rdt = cpu->rdtStatePerL3Cache;
+
+    qemu_mutex_lock(&rdt->lock);
+    rdt->msr_L2_ia32_mask_n[pos] = val;
+    qemu_mutex_unlock(&rdt->lock);
+}
+
+void rdt_write_mba_thrtl(uint32_t pos, uint32_t val)
+{
+    X86CPU *cpu = X86_CPU(current_cpu);
+    RDTStatePerL3Cache *rdt = cpu->rdtStatePerL3Cache;
+
+    qemu_mutex_lock(&rdt->lock);
+    rdt->ia32_L2_qos_ext_bw_thrtl_n[pos] = val;
+    qemu_mutex_unlock(&rdt->lock);
+}
+
+uint32_t rdt_max_rmid(RDTStatePerL3Cache *rdt)
+{
+    RDTState *rdtdev = rdt->rdtstate;
+    return rdtdev->rmids - 1;
+}
+
+uint64_t rdt_read_event_count(RDTStatePerL3Cache *rdtInstance,
+                              uint32_t rmid, uint32_t event_id)
+{
+    RDTMonitor *mon;
+    RDTState *rdt = rdtInstance->rdtstate;
+
+    uint32_t count_l3 = 0;
+    uint32_t count_local = 0;
+    uint32_t count_remote = 0;
+
+    if (!rdt) {
+        return 0;
+    }
+
+    qemu_mutex_lock(&rdtInstance->lock);
+
+    for (int i = 0; i < rdt->l3_caches; i++) {
+        rdtInstance = &rdt->rdtInstances[i];
+        if (rmid >= rdtInstance->rdtstate->rmids) {
+            return QM_CTR_ERROR;
+        }
+        mon = &rdtInstance->monitors[rmid];
+        count_l3 += mon->count_l3;
+        count_local += mon->count_local;
+        count_remote += mon->count_remote;
+    }
+
+    qemu_mutex_unlock(&rdtInstance->lock);
+
+    switch (event_id) {
+    case RDT_EVENT_L3_OCCUPANCY:
+        return count_l3 == 0 ? QM_CTR_UNAVAILABLE : count_l3;
+    case RDT_EVENT_L3_REMOTE_BW:
+        return count_remote == 0 ? QM_CTR_UNAVAILABLE : count_remote;
+    case RDT_EVENT_L3_LOCAL_BW:
+        return count_local == 0 ? QM_CTR_UNAVAILABLE : count_local;
+    default:
+        return QM_CTR_ERROR;
+    }
+}
+
 static inline int16_t cache_ids_contain(uint32_t current_ids[],
                                         uint16_t size, uint32_t id) {
     for (int i = 0; i < size; i++) {
diff --git a/include/hw/i386/rdt.h b/include/hw/i386/rdt.h
index 1f99f98f7f..d087627499 100644
--- a/include/hw/i386/rdt.h
+++ b/include/hw/i386/rdt.h
@@ -17,6 +17,9 @@
 #ifndef HW_RDT_H
 #define HW_RDT_H
 
+#include <stdbool.h>
+#include <stdint.h>
+
 /* Max counts for allocation masks or CBMs. In other words, the size of
  * respective MSRs.
  * L3_MASK and L3_mask are architectural limitations. THRTL_COUNT is just
@@ -32,4 +35,17 @@ typedef struct RDTStatePerCore RDTStatePerCore;
 typedef struct RDTMonitor RDTMonitor;
 typedef struct RDTAllocation RDTAllocation;
 
+bool rdt_associate_rmid_cos(uint64_t msr_ia32_pqr_assoc);
+
+void rdt_write_msr_l3_mask(uint32_t pos, uint32_t val);
+void rdt_write_msr_l2_mask(uint32_t pos, uint32_t val);
+void rdt_write_mba_thrtl(uint32_t pos, uint32_t val);
+
+uint32_t rdt_read_l3_mask(uint32_t pos);
+uint32_t rdt_read_l2_mask(uint32_t pos);
+uint32_t rdt_read_mba_thrtl(uint32_t pos);
+
+uint64_t rdt_read_event_count(RDTStatePerL3Cache *rdt, uint32_t rmid, uint32_t event_id);
+uint32_t rdt_max_rmid(RDTStatePerL3Cache *rdt);
+
 #endif
-- 
2.48.1.711.g2feabab25a-goog

[PATCH v6 4/8] i386: Add RDT device interface through MSRs

[Hendrik Wuethrich]

Implement rdmsr and wrmsr for the following MSRs:
* MSR_IA32_PQR_ASSOC
* MSR_IA32_QM_EVTSEL
* MSR_IA32_QM_CTR
* IA32_L3_QOS_Mask_n
* IA32_L2_QOS_Mask_n
* IA32_L2_QoS_Ext_BW_Thrtl_n

This allows for the guest to call RDT-internal functions to
associate an RMID with a CLOSID / set an active RMID for
monitoring, read monitoring data, and set classes of service.

Signed-off-by: Hendrik Wuethrich <whendrik@google.com>
---
 include/hw/i386/rdt.h                |  4 ++
 target/i386/cpu.h                    | 14 +++++
 target/i386/tcg/system/misc_helper.c | 85 ++++++++++++++++++++++++++++
 3 files changed, 103 insertions(+)

diff --git a/include/hw/i386/rdt.h b/include/hw/i386/rdt.h
index d087627499..b63b433eef 100644
--- a/include/hw/i386/rdt.h
+++ b/include/hw/i386/rdt.h
@@ -29,6 +29,10 @@
 #define RDT_MAX_L2_MASK_COUNT      63
 #define RDT_MAX_MBA_THRTL_COUNT    63
 
+#define CPUID_10_1_EDX_COS_MAX          RDT_MAX_L3_MASK_COUNT
+#define CPUID_10_2_EDX_COS_MAX          RDT_MAX_L2_MASK_COUNT
+#define CPUID_10_3_EDX_COS_MAX          RDT_MAX_MBA_THRTL_COUNT
+
 typedef struct RDTState RDTState;
 typedef struct RDTStatePerL3Cache RDTStatePerL3Cache;
 typedef struct RDTStatePerCore RDTStatePerCore;
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 2cbcc8fe4e..08089ce6c2 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -577,6 +577,17 @@ typedef enum X86Seg {
 #define MSR_IA32_VMX_TRUE_ENTRY_CTLS     0x00000490
 #define MSR_IA32_VMX_VMFUNC             0x00000491
 
+#define MSR_IA32_QM_EVTSEL                  0x0c8d
+#define MSR_IA32_QM_CTR                     0x0c8e
+#define MSR_IA32_PQR_ASSOC                  0x0c8f
+
+#define MSR_IA32_L3_CBM_BASE                0x0c90
+#define MSR_IA32_L3_MASKS_END               0x0d0f
+#define MSR_IA32_L2_CBM_BASE                0x0d10
+#define MSR_IA32_L2_CBM_END                 0x0d4f
+#define MSR_IA32_L2_QOS_Ext_BW_Thrtl_BASE   0xd50
+#define MSR_IA32_L2_QOS_Ext_BW_Thrtl_END    0xd8f
+
 #define MSR_APIC_START                  0x00000800
 #define MSR_APIC_END                    0x000008ff
 
@@ -1883,6 +1894,9 @@ typedef struct CPUArchState {
     uint64_t msr_ia32_feature_control;
     uint64_t msr_ia32_sgxlepubkeyhash[4];
 
+    uint64_t msr_ia32_qm_evtsel;
+    uint64_t msr_ia32_pqr_assoc;
+
     uint64_t msr_fixed_ctr_ctrl;
     uint64_t msr_global_ctrl;
     uint64_t msr_global_status;
diff --git a/target/i386/tcg/system/misc_helper.c b/target/i386/tcg/system/misc_helper.c
index c9c4d42f84..7027f7228c 100644
--- a/target/i386/tcg/system/misc_helper.c
+++ b/target/i386/tcg/system/misc_helper.c
@@ -25,6 +25,7 @@
 #include "exec/address-spaces.h"
 #include "exec/exec-all.h"
 #include "tcg/helper-tcg.h"
+#include "hw/i386/rdt.h"
 #include "hw/i386/apic.h"
 
 void helper_outb(CPUX86State *env, uint32_t port, uint32_t data)
@@ -293,6 +294,47 @@ void helper_wrmsr(CPUX86State *env)
         env->msr_bndcfgs = val;
         cpu_sync_bndcs_hflags(env);
         break;
+#ifdef CONFIG_RDT
+    case MSR_IA32_QM_EVTSEL:
+        env->msr_ia32_qm_evtsel = val;
+        break;
+    case MSR_IA32_PQR_ASSOC:
+        env->msr_ia32_pqr_assoc = val;
+
+        if (!rdt_associate_rmid_cos(val))
+            goto error;
+        break;
+    case MSR_IA32_L3_CBM_BASE ... MSR_IA32_L3_MASKS_END:
+    {
+        uint32_t pos = (uint32_t)env->regs[R_ECX] - MSR_IA32_L3_CBM_BASE;
+
+        if (pos > CPUID_10_1_EDX_COS_MAX) {
+            goto error;
+        }
+        rdt_write_msr_l3_mask(pos, val);
+        break;
+    }
+    case MSR_IA32_L2_CBM_BASE ... MSR_IA32_L2_CBM_END:
+    {
+        uint32_t pos = (uint32_t)env->regs[R_ECX] - MSR_IA32_L2_CBM_BASE;
+
+        if (pos > CPUID_10_2_EDX_COS_MAX) {
+            goto error;
+        }
+        rdt_write_msr_l2_mask(pos, val);
+        break;
+    }
+    case MSR_IA32_L2_QOS_Ext_BW_Thrtl_BASE ... MSR_IA32_L2_QOS_Ext_BW_Thrtl_END:
+    {
+        uint32_t pos = (uint32_t)env->regs[R_ECX] - MSR_IA32_L2_QOS_Ext_BW_Thrtl_BASE;
+
+        if (pos > CPUID_10_3_EDX_COS_MAX) {
+            goto error;
+        }
+        rdt_write_mba_thrtl(pos, val);
+        break;
+    }
+#endif
     case MSR_APIC_START ... MSR_APIC_END: {
         int ret;
         int index = (uint32_t)env->regs[R_ECX] - MSR_APIC_START;
@@ -471,6 +513,49 @@ void helper_rdmsr(CPUX86State *env)
         val = cpu_x86_get_msr_core_thread_count(x86_cpu);
         break;
     }
+#ifdef CONFIG_RDT
+    case MSR_IA32_QM_CTR:
+        val = rdt_read_event_count(x86_cpu->rdtPerNode,
+                                   (env->msr_ia32_qm_evtsel >> 32) & 0xff,
+                                   env->msr_ia32_qm_evtsel & 0xff);
+        break;
+    case MSR_IA32_QM_EVTSEL:
+        val = env->msr_ia32_qm_evtsel;
+        break;
+    case MSR_IA32_PQR_ASSOC:
+        val = env->msr_ia32_pqr_assoc;
+        break;
+    case MSR_IA32_L3_CBM_BASE ... MSR_IA32_L3_MASKS_END:
+    {
+        uint32_t pos = (uint32_t)env->regs[R_ECX] - MSR_IA32_L3_CBM_BASE;
+
+        if (pos >= CPUID_10_1_EDX_COS_MAX) {
+            raise_exception_err_ra(env, EXCP0D_GPF, 0, GETPC());
+        }
+        val = rdt_read_l3_mask(pos);
+        break;
+    }
+    case MSR_IA32_L2_CBM_BASE ... MSR_IA32_L2_CBM_END:
+    {
+        uint32_t pos = (uint32_t)env->regs[R_ECX] - MSR_IA32_L2_CBM_BASE;
+
+        if (pos >= CPUID_10_2_EDX_COS_MAX) {
+            raise_exception_err_ra(env, EXCP0D_GPF, 0, GETPC());
+        }
+        val = rdt_read_l2_mask(pos);
+        break;
+    }
+    case MSR_IA32_L2_QOS_Ext_BW_Thrtl_BASE ... MSR_IA32_L2_QOS_Ext_BW_Thrtl_END:
+    {
+        uint32_t pos = (uint32_t)env->regs[R_ECX] - MSR_IA32_L2_QOS_Ext_BW_Thrtl_BASE;
+
+        if (pos >= CPUID_10_3_EDX_COS_MAX) {
+            raise_exception_err_ra(env, EXCP0D_GPF, 0, GETPC());
+        }
+        val = rdt_read_mba_thrtl(pos);
+        break;
+    }
+#endif
     case MSR_APIC_START ... MSR_APIC_END: {
         int ret;
         int index = (uint32_t)env->regs[R_ECX] - MSR_APIC_START;
-- 
2.48.1.711.g2feabab25a-goog

[PATCH v6 5/8] i386: Add CPUID enumeration for RDT

[Hendrik Wuethrich]

Add CPUID enumeration for intel RDT monitoring and allocation, as well
as the flags used in the enumeration code.

Signed-off-by: Hendrik Wuethrich <whendrik@google.com>
---
 include/hw/i386/rdt.h | 23 +++++++++++++
 target/i386/cpu.c     | 75 +++++++++++++++++++++++++++++++++++++++++++
 target/i386/cpu.h     |  5 +++
 3 files changed, 103 insertions(+)

diff --git a/include/hw/i386/rdt.h b/include/hw/i386/rdt.h
index b63b433eef..a21bf804a6 100644
--- a/include/hw/i386/rdt.h
+++ b/include/hw/i386/rdt.h
@@ -29,8 +29,31 @@
 #define RDT_MAX_L2_MASK_COUNT      63
 #define RDT_MAX_MBA_THRTL_COUNT    63
 
+/* RDT L3 Cache Monitoring Technology */
+#define CPUID_F_0_EDX_L3               (1U << 1)
+#define CPUID_F_1_EDX_L3_OCCUPANCY     (1U << 0)
+#define CPUID_F_1_EDX_L3_TOTAL_BW      (1U << 1)
+#define CPUID_F_1_EDX_L3_LOCAL_BW      (1U << 2)
+
+/* RDT Cache Allocation Technology */
+#define CPUID_10_0_EBX_L3_CAT           (1U << 1)
+#define CPUID_10_0_EBX_L2_CAT           (1U << 2)
+#define CPUID_10_0_EBX_MBA              (1U << 3)
+
+/* RDT L3 Allocation features */
+#define CPUID_10_1_EAX_CBM_LENGTH       0xf
+#define CPUID_10_1_EBX_CBM              0x0
+#define CPUID_10_1_ECX_CDP              0x0 /* to enable, it would be (1U << 2) */
 #define CPUID_10_1_EDX_COS_MAX          RDT_MAX_L3_MASK_COUNT
+
+/* RDT L2 Allocation features*/
+#define CPUID_10_2_EAX_CBM_LENGTH       0xf
+#define CPUID_10_2_EBX_CBM              0x0
 #define CPUID_10_2_EDX_COS_MAX          RDT_MAX_L2_MASK_COUNT
+
+/* RDT MBA features */
+#define CPUID_10_3_EAX_THRTL_MAX        89
+#define CPUID_10_3_ECX_LINEAR_RESPONSE (1U << 2)
 #define CPUID_10_3_EDX_COS_MAX          RDT_MAX_MBA_THRTL_COUNT
 
 typedef struct RDTState RDTState;
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 72ab147e85..cd06744451 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -42,6 +42,7 @@
 #include "hw/boards.h"
 #include "hw/i386/sgx-epc.h"
 #endif
+#include "hw/i386/rdt.h"
 
 #include "disas/capstone.h"
 #include "cpu-internal.h"
@@ -6869,6 +6870,80 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
         assert(!(*eax & ~0x1f));
         *ebx &= 0xffff; /* The count doesn't need to be reliable. */
         break;
+#ifndef CONFIG_USER_ONLY
+    case 0xF:
+        /* Shared Resource Monitoring Enumeration Leaf */
+        *eax = 0;
+        *ebx = 0;
+        *ecx = 0;
+        *edx = 0;
+#ifdef CONFIG_RDT
+        if (!(env->features[FEAT_7_0_EBX] & CPUID_7_0_EBX_PQM))
+            break;
+        if (!(cpu->rdtStatePerL3Cache)) {
+            warn_report("Intel RDT features enabled in commandline, "
+                        "but rdt device not used");
+            break;
+        }
+        /* Non-zero count is ResId */
+        switch (count) {
+            /* Monitoring Resource Type Enumeration */
+        case 0:
+            *edx = env->features[FEAT_RDT_F_0_EDX];
+            *ebx = rdt_max_rmid(cpu->rdtStatePerL3Cache);
+            break;
+        case 1:
+            *ebx = 1;
+            *ecx = rdt_max_rmid(cpu->rdtStatePerL3Cache);
+            *edx =  CPUID_F_1_EDX_L3_OCCUPANCY  |
+                    CPUID_F_1_EDX_L3_TOTAL_BW   |
+                    CPUID_F_1_EDX_L3_LOCAL_BW;
+            break;
+        }
+#endif
+        break;
+    case 0x10:
+        /* Shared Resource Director Technology Allocation Enumeration Leaf */
+        *eax = 0;
+        *ebx = 0;
+        *ecx = 0;
+        *edx = 0;
+#ifdef CONFIG_RDT
+        if (!(env->features[FEAT_7_0_EBX] & CPUID_7_0_EBX_PQE))
+            break;
+        if (!(cpu->rdtPerCore)) {
+            warn_report("Intel RDT features enabled in commandline, "
+                        "but rdt device not used");
+            break;
+        }
+        /* Non-zero count is ResId */
+        switch (count) {
+            /* Cache Allocation Technology Available Resource Types */
+        case 0:
+            *ebx =  CPUID_10_0_EBX_L3_CAT |
+                    CPUID_10_0_EBX_L2_CAT |
+                    CPUID_10_0_EBX_MBA;
+            break;
+        case 1:
+            *eax = CPUID_10_1_EAX_CBM_LENGTH;
+            *ebx = CPUID_10_1_EBX_CBM;
+            *ecx = CPUID_10_1_ECX_CDP;
+            *edx = CPUID_10_1_EDX_COS_MAX;
+            break;
+        case 2:
+            *eax = CPUID_10_2_EAX_CBM_LENGTH;
+            *ebx = CPUID_10_2_EBX_CBM;
+            *edx = CPUID_10_2_EDX_COS_MAX;
+            break;
+        case 3:
+            *eax = CPUID_10_3_EAX_THRTL_MAX;
+            *ecx = CPUID_10_3_ECX_LINEAR_RESPONSE;
+            *edx = CPUID_10_3_EDX_COS_MAX;
+            break;
+        }
+#endif
+        break;
+#endif
     case 0x1C:
         if (cpu->enable_pmu && (env->features[FEAT_7_0_EDX] & CPUID_7_0_EDX_ARCH_LBR)) {
             x86_cpu_get_supported_cpuid(0x1C, 0, eax, ebx, ecx, edx);
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 08089ce6c2..6f5a3ecbd4 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -679,6 +679,7 @@ typedef enum FeatureWord {
     FEAT_7_1_EDX,       /* CPUID[EAX=7,ECX=1].EDX */
     FEAT_7_2_EDX,       /* CPUID[EAX=7,ECX=2].EDX */
     FEAT_24_0_EBX,      /* CPUID[EAX=0x24,ECX=0].EBX */
+    FEAT_RDT_F_0_EDX,  /* CPUID[EAX=0xf,ECX=0].EDX (RDT CMT/MBM) */
     FEATURE_WORDS,
 } FeatureWord;
 
@@ -853,8 +854,12 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w);
 #define CPUID_7_0_EBX_RTM               (1U << 11)
 /* Zero out FPU CS and FPU DS */
 #define CPUID_7_0_EBX_ZERO_FCS_FDS      (1U << 13)
+/* Resource Director Technology Monitoring */
+#define CPUID_7_0_EBX_PQM               (1U << 12)
 /* Memory Protection Extension */
 #define CPUID_7_0_EBX_MPX               (1U << 14)
+/* Resource Director Technology Allocation */
+#define CPUID_7_0_EBX_PQE               (1U << 15)
 /* AVX-512 Foundation */
 #define CPUID_7_0_EBX_AVX512F           (1U << 16)
 /* AVX-512 Doubleword & Quadword Instruction */
-- 
2.48.1.711.g2feabab25a-goog

[PATCH v6 6/8] i386: Add RDT feature flags.

[Hendrik Wuethrich]

Add RDT features to feature word / TCG.

Signed-off-by: Hendrik Wuethrich <whendrik@google.com>
---
 target/i386/cpu.c | 33 +++++++++++++++++++++++++++++++--
 target/i386/cpu.h |  2 ++
 2 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index cd06744451..6262665294 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -868,7 +868,8 @@ void x86_cpu_vendor_words2str(char *dst, uint32_t vendor1,
           CPUID_7_0_EBX_CLFLUSHOPT |            \
           CPUID_7_0_EBX_CLWB | CPUID_7_0_EBX_MPX | CPUID_7_0_EBX_FSGSBASE | \
           CPUID_7_0_EBX_ERMS | CPUID_7_0_EBX_AVX2 | CPUID_7_0_EBX_RDSEED | \
-          CPUID_7_0_EBX_SHA_NI | CPUID_7_0_EBX_KERNEL_FEATURES)
+          CPUID_7_0_EBX_SHA_NI | CPUID_7_0_EBX_KERNEL_FEATURES | \
+          CPUID_7_0_EBX_PQM | CPUID_7_0_EBX_PQE)
           /* missing:
           CPUID_7_0_EBX_HLE
           CPUID_7_0_EBX_INVPCID, CPUID_7_0_EBX_RTM */
@@ -905,6 +906,9 @@ void x86_cpu_vendor_words2str(char *dst, uint32_t vendor1,
 #define TCG_SGX_12_0_EBX_FEATURES 0
 #define TCG_SGX_12_1_EAX_FEATURES 0
 #define TCG_24_0_EBX_FEATURES 0
+#define TCG_RDT_F_0_EDX_FEATURES CPUID_F_0_EDX_L3
+#define TCG_RDT_10_0_EDX_FEATURES (CPUID_10_0_EBX_L3_CAT | \
+          CPUID_10_0_EBX_L2_CAT | CPUID_10_0_EBX_MBA)
 
 #if defined CONFIG_USER_ONLY
 #define CPUID_8000_0008_EBX_KERNEL_FEATURES (CPUID_8000_0008_EBX_IBPB | \
@@ -1062,7 +1066,7 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
             "fsgsbase", "tsc-adjust", "sgx", "bmi1",
             "hle", "avx2", "fdp-excptn-only", "smep",
             "bmi2", "erms", "invpcid", "rtm",
-            NULL, "zero-fcs-fds", "mpx", NULL,
+            "rdt-m", "zero-fcs-fds", "mpx", "rdt-a",
             "avx512f", "avx512dq", "rdseed", "adx",
             "smap", "avx512ifma", "pcommit", "clflushopt",
             "clwb", "intel-pt", "avx512pf", "avx512er",
@@ -1650,6 +1654,31 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
         },
         .tcg_features = TCG_SGX_12_1_EAX_FEATURES,
     },
+
+    [FEAT_RDT_10_0_EBX] = {
+        .type = CPUID_FEATURE_WORD,
+        .feat_names = {
+            NULL, "l3-cat", "l2-cat", "mba"
+        },
+        .cpuid = {
+            .eax = 0x10,
+            .needs_ecx = true, .ecx = 0,
+            .reg = R_EBX,
+        },
+        .tcg_features = TCG_RDT_10_0_EDX_FEATURES,
+    },
+    [FEAT_RDT_F_0_EDX] = {
+        .type = CPUID_FEATURE_WORD,
+        .feat_names = {
+            [1] = "l3-cmt"
+        },
+        .cpuid = {
+            .eax = 0xf,
+            .needs_ecx = true, .ecx = 0,
+            .reg = R_EDX,
+        },
+        .tcg_features = TCG_RDT_F_0_EDX_FEATURES,
+    },
 };
 
 typedef struct FeatureMask {
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 6f5a3ecbd4..488126378d 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -679,7 +679,9 @@ typedef enum FeatureWord {
     FEAT_7_1_EDX,       /* CPUID[EAX=7,ECX=1].EDX */
     FEAT_7_2_EDX,       /* CPUID[EAX=7,ECX=2].EDX */
     FEAT_24_0_EBX,      /* CPUID[EAX=0x24,ECX=0].EBX */
+    FEAT_RDT_F_0_EBX,  /* CPUID[EAX=0xf,ECX=0].EBX (RDT CMT/MBM) */
     FEAT_RDT_F_0_EDX,  /* CPUID[EAX=0xf,ECX=0].EDX (RDT CMT/MBM) */
+    FEAT_RDT_10_0_EBX,  /* CPUID[EAX=0x10,ECX=0].EBX (RDT CAT/MBA) */
     FEATURE_WORDS,
 } FeatureWord;
 
-- 
2.48.1.711.g2feabab25a-goog

[PATCH v6 7/8] i386/cpu: Adjust CPUID level for RDT features

[Hendrik Wuethrich]

Adjust minimum CPUID level if RDT monitoring or allocation features are
enabled to ensure that CPUID will return them.

Signed-off-by: Hendrik Wuethrich <whendrik@google.com>
---
 target/i386/cpu.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 6262665294..1ec3d88a65 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -7872,6 +7872,16 @@ void x86_cpu_expand_features(X86CPU *cpu, Error **errp)
         if (env->features[FEAT_7_0_EBX] & CPUID_7_0_EBX_SGX) {
             x86_cpu_adjust_level(cpu, &env->cpuid_min_level, 0x12);
         }
+
+        /* RDT monitoring requires CPUID[0xF] */
+        if (env->features[FEAT_7_0_EBX] & CPUID_7_0_EBX_PQM) {
+            x86_cpu_adjust_level(cpu, &env->cpuid_min_level, 0xF);
+        }
+
+        /* RDT allocation requires CPUID[0x10] */
+        if (env->features[FEAT_7_0_EBX] & CPUID_7_0_EBX_PQE) {
+            x86_cpu_adjust_level(cpu, &env->cpuid_min_level, 0x10);
+        }
     }
 
     /* Set cpuid_*level* based on cpuid_min_*level, if not explicitly set */
-- 
2.48.1.711.g2feabab25a-goog

[PATCH v6 8/8] i386/cpu: Adjust level for RDT on full_cpuid_auto_level

[Hendrik Wuethrich]

Make sure that RDT monitoring and allocation features are included in
in full_cpuid_auto_level.

Signed-off-by: Hendrik Wuethrich <whendrik@google.com>
---
 target/i386/cpu.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 1ec3d88a65..55003760a6 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -7825,6 +7825,8 @@ void x86_cpu_expand_features(X86CPU *cpu, Error **errp)
         x86_cpu_adjust_feat_level(cpu, FEAT_C000_0001_EDX);
         x86_cpu_adjust_feat_level(cpu, FEAT_SVM);
         x86_cpu_adjust_feat_level(cpu, FEAT_XSAVE);
+        x86_cpu_adjust_feat_level(cpu, FEAT_RDT_F_0_EDX);
+        x86_cpu_adjust_feat_level(cpu, FEAT_RDT_10_0_EBX);
 
         /* Intel Processor Trace requires CPUID[0x14] */
         if ((env->features[FEAT_7_0_EBX] & CPUID_7_0_EBX_INTEL_PT)) {
-- 
2.48.1.711.g2feabab25a-goog