1 /* SPDX-License-Identifier: GPL-2.0 */ 2 #ifndef __KVM_X86_MMU_INTERNAL_H 3 #define __KVM_X86_MMU_INTERNAL_H 4 5 #include <linux/types.h> 6 #include <linux/kvm_host.h> 7 #include <asm/kvm_host.h> 8 9 #ifdef CONFIG_KVM_PROVE_MMU 10 #define KVM_MMU_WARN_ON(x) WARN_ON_ONCE(x) 11 #else 12 #define KVM_MMU_WARN_ON(x) BUILD_BUG_ON_INVALID(x) 13 #endif 14 15 /* Page table builder macros common to shadow (host) PTEs and guest PTEs. */ 16 #define __PT_LEVEL_SHIFT(level, bits_per_level) \ 17 (PAGE_SHIFT + ((level) - 1) * (bits_per_level)) 18 #define __PT_INDEX(address, level, bits_per_level) \ 19 (((address) >> __PT_LEVEL_SHIFT(level, bits_per_level)) & ((1 << (bits_per_level)) - 1)) 20 21 #define __PT_LVL_ADDR_MASK(base_addr_mask, level, bits_per_level) \ 22 ((base_addr_mask) & ~((1ULL << (PAGE_SHIFT + (((level) - 1) * (bits_per_level)))) - 1)) 23 24 #define __PT_LVL_OFFSET_MASK(base_addr_mask, level, bits_per_level) \ 25 ((base_addr_mask) & ((1ULL << (PAGE_SHIFT + (((level) - 1) * (bits_per_level)))) - 1)) 26 27 #define __PT_ENT_PER_PAGE(bits_per_level) (1 << (bits_per_level)) 28 29 /* 30 * Unlike regular MMU roots, PAE "roots", a.k.a. PDPTEs/PDPTRs, have a PRESENT 31 * bit, and thus are guaranteed to be non-zero when valid. And, when a guest 32 * PDPTR is !PRESENT, its corresponding PAE root cannot be set to INVALID_PAGE, 33 * as the CPU would treat that as PRESENT PDPTR with reserved bits set. Use 34 * '0' instead of INVALID_PAGE to indicate an invalid PAE root. 35 */ 36 #define INVALID_PAE_ROOT 0 37 #define IS_VALID_PAE_ROOT(x) (!!(x)) 38 39 static inline hpa_t kvm_mmu_get_dummy_root(void) 40 { 41 return my_zero_pfn(0) << PAGE_SHIFT; 42 } 43 44 static inline bool kvm_mmu_is_dummy_root(hpa_t shadow_page) 45 { 46 return is_zero_pfn(shadow_page >> PAGE_SHIFT); 47 } 48 49 typedef u64 __rcu *tdp_ptep_t; 50 51 struct kvm_mmu_page { 52 /* 53 * Note, "link" through "spt" fit in a single 64 byte cache line on 54 * 64-bit kernels, keep it that way unless there's a reason not to. 55 */ 56 struct list_head link; 57 struct hlist_node hash_link; 58 59 bool tdp_mmu_page; 60 bool unsync; 61 union { 62 u8 mmu_valid_gen; 63 64 /* Only accessed under slots_lock. */ 65 bool tdp_mmu_scheduled_root_to_zap; 66 }; 67 68 /* 69 * The shadow page can't be replaced by an equivalent huge page 70 * because it is being used to map an executable page in the guest 71 * and the NX huge page mitigation is enabled. 72 */ 73 bool nx_huge_page_disallowed; 74 75 /* 76 * The following two entries are used to key the shadow page in the 77 * hash table. 78 */ 79 union kvm_mmu_page_role role; 80 gfn_t gfn; 81 82 u64 *spt; 83 84 /* 85 * Stores the result of the guest translation being shadowed by each 86 * SPTE. KVM shadows two types of guest translations: nGPA -> GPA 87 * (shadow EPT/NPT) and GVA -> GPA (traditional shadow paging). In both 88 * cases the result of the translation is a GPA and a set of access 89 * constraints. 90 * 91 * The GFN is stored in the upper bits (PAGE_SHIFT) and the shadowed 92 * access permissions are stored in the lower bits. Note, for 93 * convenience and uniformity across guests, the access permissions are 94 * stored in KVM format (e.g. ACC_EXEC_MASK) not the raw guest format. 95 */ 96 u64 *shadowed_translation; 97 98 /* Currently serving as active root */ 99 union { 100 int root_count; 101 refcount_t tdp_mmu_root_count; 102 }; 103 unsigned int unsync_children; 104 union { 105 struct kvm_rmap_head parent_ptes; /* rmap pointers to parent sptes */ 106 tdp_ptep_t ptep; 107 }; 108 DECLARE_BITMAP(unsync_child_bitmap, 512); 109 110 /* 111 * Tracks shadow pages that, if zapped, would allow KVM to create an NX 112 * huge page. A shadow page will have nx_huge_page_disallowed set but 113 * not be on the list if a huge page is disallowed for other reasons, 114 * e.g. because KVM is shadowing a PTE at the same gfn, the memslot 115 * isn't properly aligned, etc... 116 */ 117 struct list_head possible_nx_huge_page_link; 118 #ifdef CONFIG_X86_32 119 /* 120 * Used out of the mmu-lock to avoid reading spte values while an 121 * update is in progress; see the comments in __get_spte_lockless(). 122 */ 123 int clear_spte_count; 124 #endif 125 126 /* Number of writes since the last time traversal visited this page. */ 127 atomic_t write_flooding_count; 128 129 #ifdef CONFIG_X86_64 130 /* Used for freeing the page asynchronously if it is a TDP MMU page. */ 131 struct rcu_head rcu_head; 132 #endif 133 }; 134 135 extern struct kmem_cache *mmu_page_header_cache; 136 137 static inline int kvm_mmu_role_as_id(union kvm_mmu_page_role role) 138 { 139 return role.smm ? 1 : 0; 140 } 141 142 static inline int kvm_mmu_page_as_id(struct kvm_mmu_page *sp) 143 { 144 return kvm_mmu_role_as_id(sp->role); 145 } 146 147 static inline bool kvm_mmu_page_ad_need_write_protect(struct kvm_mmu_page *sp) 148 { 149 /* 150 * When using the EPT page-modification log, the GPAs in the CPU dirty 151 * log would come from L2 rather than L1. Therefore, we need to rely 152 * on write protection to record dirty pages, which bypasses PML, since 153 * writes now result in a vmexit. Note, the check on CPU dirty logging 154 * being enabled is mandatory as the bits used to denote WP-only SPTEs 155 * are reserved for PAE paging (32-bit KVM). 156 */ 157 return kvm_x86_ops.cpu_dirty_log_size && sp->role.guest_mode; 158 } 159 160 static inline gfn_t gfn_round_for_level(gfn_t gfn, int level) 161 { 162 return gfn & -KVM_PAGES_PER_HPAGE(level); 163 } 164 165 int mmu_try_to_unsync_pages(struct kvm *kvm, const struct kvm_memory_slot *slot, 166 gfn_t gfn, bool can_unsync, bool prefetch); 167 168 void kvm_mmu_gfn_disallow_lpage(const struct kvm_memory_slot *slot, gfn_t gfn); 169 void kvm_mmu_gfn_allow_lpage(const struct kvm_memory_slot *slot, gfn_t gfn); 170 bool kvm_mmu_slot_gfn_write_protect(struct kvm *kvm, 171 struct kvm_memory_slot *slot, u64 gfn, 172 int min_level); 173 174 /* Flush the given page (huge or not) of guest memory. */ 175 static inline void kvm_flush_remote_tlbs_gfn(struct kvm *kvm, gfn_t gfn, int level) 176 { 177 kvm_flush_remote_tlbs_range(kvm, gfn_round_for_level(gfn, level), 178 KVM_PAGES_PER_HPAGE(level)); 179 } 180 181 unsigned int pte_list_count(struct kvm_rmap_head *rmap_head); 182 183 extern int nx_huge_pages; 184 static inline bool is_nx_huge_page_enabled(struct kvm *kvm) 185 { 186 return READ_ONCE(nx_huge_pages) && !kvm->arch.disable_nx_huge_pages; 187 } 188 189 struct kvm_page_fault { 190 /* arguments to kvm_mmu_do_page_fault. */ 191 const gpa_t addr; 192 const u32 error_code; 193 const bool prefetch; 194 195 /* Derived from error_code. */ 196 const bool exec; 197 const bool write; 198 const bool present; 199 const bool rsvd; 200 const bool user; 201 202 /* Derived from mmu and global state. */ 203 const bool is_tdp; 204 const bool nx_huge_page_workaround_enabled; 205 206 /* 207 * Whether a >4KB mapping can be created or is forbidden due to NX 208 * hugepages. 209 */ 210 bool huge_page_disallowed; 211 212 /* 213 * Maximum page size that can be created for this fault; input to 214 * FNAME(fetch), direct_map() and kvm_tdp_mmu_map(). 215 */ 216 u8 max_level; 217 218 /* 219 * Page size that can be created based on the max_level and the 220 * page size used by the host mapping. 221 */ 222 u8 req_level; 223 224 /* 225 * Page size that will be created based on the req_level and 226 * huge_page_disallowed. 227 */ 228 u8 goal_level; 229 230 /* Shifted addr, or result of guest page table walk if addr is a gva. */ 231 gfn_t gfn; 232 233 /* The memslot containing gfn. May be NULL. */ 234 struct kvm_memory_slot *slot; 235 236 /* Outputs of kvm_faultin_pfn. */ 237 unsigned long mmu_seq; 238 kvm_pfn_t pfn; 239 hva_t hva; 240 bool map_writable; 241 242 /* 243 * Indicates the guest is trying to write a gfn that contains one or 244 * more of the PTEs used to translate the write itself, i.e. the access 245 * is changing its own translation in the guest page tables. 246 */ 247 bool write_fault_to_shadow_pgtable; 248 }; 249 250 int kvm_tdp_page_fault(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault); 251 252 /* 253 * Return values of handle_mmio_page_fault(), mmu.page_fault(), fast_page_fault(), 254 * and of course kvm_mmu_do_page_fault(). 255 * 256 * RET_PF_CONTINUE: So far, so good, keep handling the page fault. 257 * RET_PF_RETRY: let CPU fault again on the address. 258 * RET_PF_EMULATE: mmio page fault, emulate the instruction directly. 259 * RET_PF_INVALID: the spte is invalid, let the real page fault path update it. 260 * RET_PF_FIXED: The faulting entry has been fixed. 261 * RET_PF_SPURIOUS: The faulting entry was already fixed, e.g. by another vCPU. 262 * 263 * Any names added to this enum should be exported to userspace for use in 264 * tracepoints via TRACE_DEFINE_ENUM() in mmutrace.h 265 * 266 * Note, all values must be greater than or equal to zero so as not to encroach 267 * on -errno return values. Somewhat arbitrarily use '0' for CONTINUE, which 268 * will allow for efficient machine code when checking for CONTINUE, e.g. 269 * "TEST %rax, %rax, JNZ", as all "stop!" values are non-zero. 270 */ 271 enum { 272 RET_PF_CONTINUE = 0, 273 RET_PF_RETRY, 274 RET_PF_EMULATE, 275 RET_PF_INVALID, 276 RET_PF_FIXED, 277 RET_PF_SPURIOUS, 278 }; 279 280 static inline int kvm_mmu_do_page_fault(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa, 281 u32 err, bool prefetch, int *emulation_type) 282 { 283 struct kvm_page_fault fault = { 284 .addr = cr2_or_gpa, 285 .error_code = err, 286 .exec = err & PFERR_FETCH_MASK, 287 .write = err & PFERR_WRITE_MASK, 288 .present = err & PFERR_PRESENT_MASK, 289 .rsvd = err & PFERR_RSVD_MASK, 290 .user = err & PFERR_USER_MASK, 291 .prefetch = prefetch, 292 .is_tdp = likely(vcpu->arch.mmu->page_fault == kvm_tdp_page_fault), 293 .nx_huge_page_workaround_enabled = 294 is_nx_huge_page_enabled(vcpu->kvm), 295 296 .max_level = KVM_MAX_HUGEPAGE_LEVEL, 297 .req_level = PG_LEVEL_4K, 298 .goal_level = PG_LEVEL_4K, 299 }; 300 int r; 301 302 if (vcpu->arch.mmu->root_role.direct) { 303 fault.gfn = fault.addr >> PAGE_SHIFT; 304 fault.slot = kvm_vcpu_gfn_to_memslot(vcpu, fault.gfn); 305 } 306 307 /* 308 * Async #PF "faults", a.k.a. prefetch faults, are not faults from the 309 * guest perspective and have already been counted at the time of the 310 * original fault. 311 */ 312 if (!prefetch) 313 vcpu->stat.pf_taken++; 314 315 if (IS_ENABLED(CONFIG_RETPOLINE) && fault.is_tdp) 316 r = kvm_tdp_page_fault(vcpu, &fault); 317 else 318 r = vcpu->arch.mmu->page_fault(vcpu, &fault); 319 320 if (fault.write_fault_to_shadow_pgtable && emulation_type) 321 *emulation_type |= EMULTYPE_WRITE_PF_TO_SP; 322 323 /* 324 * Similar to above, prefetch faults aren't truly spurious, and the 325 * async #PF path doesn't do emulation. Do count faults that are fixed 326 * by the async #PF handler though, otherwise they'll never be counted. 327 */ 328 if (r == RET_PF_FIXED) 329 vcpu->stat.pf_fixed++; 330 else if (prefetch) 331 ; 332 else if (r == RET_PF_EMULATE) 333 vcpu->stat.pf_emulate++; 334 else if (r == RET_PF_SPURIOUS) 335 vcpu->stat.pf_spurious++; 336 return r; 337 } 338 339 int kvm_mmu_max_mapping_level(struct kvm *kvm, 340 const struct kvm_memory_slot *slot, gfn_t gfn, 341 int max_level); 342 void kvm_mmu_hugepage_adjust(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault); 343 void disallowed_hugepage_adjust(struct kvm_page_fault *fault, u64 spte, int cur_level); 344 345 void *mmu_memory_cache_alloc(struct kvm_mmu_memory_cache *mc); 346 347 void track_possible_nx_huge_page(struct kvm *kvm, struct kvm_mmu_page *sp); 348 void untrack_possible_nx_huge_page(struct kvm *kvm, struct kvm_mmu_page *sp); 349 350 #endif /* __KVM_X86_MMU_INTERNAL_H */ 351