1 /* SPDX-License-Identifier: GPL-2.0 */ 2 #ifndef __KVM_X86_MMU_INTERNAL_H 3 #define __KVM_X86_MMU_INTERNAL_H 4 5 #include <linux/types.h> 6 #include <linux/kvm_host.h> 7 #include <asm/kvm_host.h> 8 9 #ifdef CONFIG_KVM_PROVE_MMU 10 #define KVM_MMU_WARN_ON(x) WARN_ON_ONCE(x) 11 #else 12 #define KVM_MMU_WARN_ON(x) BUILD_BUG_ON_INVALID(x) 13 #endif 14 15 /* Page table builder macros common to shadow (host) PTEs and guest PTEs. */ 16 #define __PT_BASE_ADDR_MASK GENMASK_ULL(51, 12) 17 #define __PT_LEVEL_SHIFT(level, bits_per_level) \ 18 (PAGE_SHIFT + ((level) - 1) * (bits_per_level)) 19 #define __PT_INDEX(address, level, bits_per_level) \ 20 (((address) >> __PT_LEVEL_SHIFT(level, bits_per_level)) & ((1 << (bits_per_level)) - 1)) 21 22 #define __PT_LVL_ADDR_MASK(base_addr_mask, level, bits_per_level) \ 23 ((base_addr_mask) & ~((1ULL << (PAGE_SHIFT + (((level) - 1) * (bits_per_level)))) - 1)) 24 25 #define __PT_LVL_OFFSET_MASK(base_addr_mask, level, bits_per_level) \ 26 ((base_addr_mask) & ((1ULL << (PAGE_SHIFT + (((level) - 1) * (bits_per_level)))) - 1)) 27 28 #define __PT_ENT_PER_PAGE(bits_per_level) (1 << (bits_per_level)) 29 30 /* 31 * Unlike regular MMU roots, PAE "roots", a.k.a. PDPTEs/PDPTRs, have a PRESENT 32 * bit, and thus are guaranteed to be non-zero when valid. And, when a guest 33 * PDPTR is !PRESENT, its corresponding PAE root cannot be set to INVALID_PAGE, 34 * as the CPU would treat that as PRESENT PDPTR with reserved bits set. Use 35 * '0' instead of INVALID_PAGE to indicate an invalid PAE root. 36 */ 37 #define INVALID_PAE_ROOT 0 38 #define IS_VALID_PAE_ROOT(x) (!!(x)) 39 40 static inline hpa_t kvm_mmu_get_dummy_root(void) 41 { 42 return my_zero_pfn(0) << PAGE_SHIFT; 43 } 44 45 static inline bool kvm_mmu_is_dummy_root(hpa_t shadow_page) 46 { 47 return is_zero_pfn(shadow_page >> PAGE_SHIFT); 48 } 49 50 typedef u64 __rcu *tdp_ptep_t; 51 52 struct kvm_mmu_page { 53 /* 54 * Note, "link" through "spt" fit in a single 64 byte cache line on 55 * 64-bit kernels, keep it that way unless there's a reason not to. 56 */ 57 struct list_head link; 58 struct hlist_node hash_link; 59 60 bool tdp_mmu_page; 61 bool unsync; 62 union { 63 u8 mmu_valid_gen; 64 65 /* Only accessed under slots_lock. */ 66 bool tdp_mmu_scheduled_root_to_zap; 67 }; 68 69 /* 70 * The shadow page can't be replaced by an equivalent huge page 71 * because it is being used to map an executable page in the guest 72 * and the NX huge page mitigation is enabled. 73 */ 74 bool nx_huge_page_disallowed; 75 76 /* 77 * The following two entries are used to key the shadow page in the 78 * hash table. 79 */ 80 union kvm_mmu_page_role role; 81 gfn_t gfn; 82 83 u64 *spt; 84 85 /* 86 * Stores the result of the guest translation being shadowed by each 87 * SPTE. KVM shadows two types of guest translations: nGPA -> GPA 88 * (shadow EPT/NPT) and GVA -> GPA (traditional shadow paging). In both 89 * cases the result of the translation is a GPA and a set of access 90 * constraints. 91 * 92 * The GFN is stored in the upper bits (PAGE_SHIFT) and the shadowed 93 * access permissions are stored in the lower bits. Note, for 94 * convenience and uniformity across guests, the access permissions are 95 * stored in KVM format (e.g. ACC_EXEC_MASK) not the raw guest format. 96 */ 97 u64 *shadowed_translation; 98 99 /* Currently serving as active root */ 100 union { 101 int root_count; 102 refcount_t tdp_mmu_root_count; 103 }; 104 unsigned int unsync_children; 105 union { 106 struct kvm_rmap_head parent_ptes; /* rmap pointers to parent sptes */ 107 tdp_ptep_t ptep; 108 }; 109 DECLARE_BITMAP(unsync_child_bitmap, 512); 110 111 /* 112 * Tracks shadow pages that, if zapped, would allow KVM to create an NX 113 * huge page. A shadow page will have nx_huge_page_disallowed set but 114 * not be on the list if a huge page is disallowed for other reasons, 115 * e.g. because KVM is shadowing a PTE at the same gfn, the memslot 116 * isn't properly aligned, etc... 117 */ 118 struct list_head possible_nx_huge_page_link; 119 #ifdef CONFIG_X86_32 120 /* 121 * Used out of the mmu-lock to avoid reading spte values while an 122 * update is in progress; see the comments in __get_spte_lockless(). 123 */ 124 int clear_spte_count; 125 #endif 126 127 /* Number of writes since the last time traversal visited this page. */ 128 atomic_t write_flooding_count; 129 130 #ifdef CONFIG_X86_64 131 /* Used for freeing the page asynchronously if it is a TDP MMU page. */ 132 struct rcu_head rcu_head; 133 #endif 134 }; 135 136 extern struct kmem_cache *mmu_page_header_cache; 137 138 static inline int kvm_mmu_role_as_id(union kvm_mmu_page_role role) 139 { 140 return role.smm ? 1 : 0; 141 } 142 143 static inline int kvm_mmu_page_as_id(struct kvm_mmu_page *sp) 144 { 145 return kvm_mmu_role_as_id(sp->role); 146 } 147 148 static inline bool kvm_mmu_page_ad_need_write_protect(struct kvm_mmu_page *sp) 149 { 150 /* 151 * When using the EPT page-modification log, the GPAs in the CPU dirty 152 * log would come from L2 rather than L1. Therefore, we need to rely 153 * on write protection to record dirty pages, which bypasses PML, since 154 * writes now result in a vmexit. Note, the check on CPU dirty logging 155 * being enabled is mandatory as the bits used to denote WP-only SPTEs 156 * are reserved for PAE paging (32-bit KVM). 157 */ 158 return kvm_x86_ops.cpu_dirty_log_size && sp->role.guest_mode; 159 } 160 161 static inline gfn_t gfn_round_for_level(gfn_t gfn, int level) 162 { 163 return gfn & -KVM_PAGES_PER_HPAGE(level); 164 } 165 166 int mmu_try_to_unsync_pages(struct kvm *kvm, const struct kvm_memory_slot *slot, 167 gfn_t gfn, bool can_unsync, bool prefetch); 168 169 void kvm_mmu_gfn_disallow_lpage(const struct kvm_memory_slot *slot, gfn_t gfn); 170 void kvm_mmu_gfn_allow_lpage(const struct kvm_memory_slot *slot, gfn_t gfn); 171 bool kvm_mmu_slot_gfn_write_protect(struct kvm *kvm, 172 struct kvm_memory_slot *slot, u64 gfn, 173 int min_level); 174 175 /* Flush the given page (huge or not) of guest memory. */ 176 static inline void kvm_flush_remote_tlbs_gfn(struct kvm *kvm, gfn_t gfn, int level) 177 { 178 kvm_flush_remote_tlbs_range(kvm, gfn_round_for_level(gfn, level), 179 KVM_PAGES_PER_HPAGE(level)); 180 } 181 182 unsigned int pte_list_count(struct kvm_rmap_head *rmap_head); 183 184 extern int nx_huge_pages; 185 static inline bool is_nx_huge_page_enabled(struct kvm *kvm) 186 { 187 return READ_ONCE(nx_huge_pages) && !kvm->arch.disable_nx_huge_pages; 188 } 189 190 struct kvm_page_fault { 191 /* arguments to kvm_mmu_do_page_fault. */ 192 const gpa_t addr; 193 const u64 error_code; 194 const bool prefetch; 195 196 /* Derived from error_code. */ 197 const bool exec; 198 const bool write; 199 const bool present; 200 const bool rsvd; 201 const bool user; 202 203 /* Derived from mmu and global state. */ 204 const bool is_tdp; 205 const bool is_private; 206 const bool nx_huge_page_workaround_enabled; 207 208 /* 209 * Whether a >4KB mapping can be created or is forbidden due to NX 210 * hugepages. 211 */ 212 bool huge_page_disallowed; 213 214 /* 215 * Maximum page size that can be created for this fault; input to 216 * FNAME(fetch), direct_map() and kvm_tdp_mmu_map(). 217 */ 218 u8 max_level; 219 220 /* 221 * Page size that can be created based on the max_level and the 222 * page size used by the host mapping. 223 */ 224 u8 req_level; 225 226 /* 227 * Page size that will be created based on the req_level and 228 * huge_page_disallowed. 229 */ 230 u8 goal_level; 231 232 /* Shifted addr, or result of guest page table walk if addr is a gva. */ 233 gfn_t gfn; 234 235 /* The memslot containing gfn. May be NULL. */ 236 struct kvm_memory_slot *slot; 237 238 /* Outputs of kvm_faultin_pfn. */ 239 unsigned long mmu_seq; 240 kvm_pfn_t pfn; 241 hva_t hva; 242 bool map_writable; 243 244 /* 245 * Indicates the guest is trying to write a gfn that contains one or 246 * more of the PTEs used to translate the write itself, i.e. the access 247 * is changing its own translation in the guest page tables. 248 */ 249 bool write_fault_to_shadow_pgtable; 250 }; 251 252 int kvm_tdp_page_fault(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault); 253 254 /* 255 * Return values of handle_mmio_page_fault(), mmu.page_fault(), fast_page_fault(), 256 * and of course kvm_mmu_do_page_fault(). 257 * 258 * RET_PF_CONTINUE: So far, so good, keep handling the page fault. 259 * RET_PF_RETRY: let CPU fault again on the address. 260 * RET_PF_EMULATE: mmio page fault, emulate the instruction directly. 261 * RET_PF_WRITE_PROTECTED: the gfn is write-protected, either unprotected the 262 * gfn and retry, or emulate the instruction directly. 263 * RET_PF_INVALID: the spte is invalid, let the real page fault path update it. 264 * RET_PF_FIXED: The faulting entry has been fixed. 265 * RET_PF_SPURIOUS: The faulting entry was already fixed, e.g. by another vCPU. 266 * 267 * Any names added to this enum should be exported to userspace for use in 268 * tracepoints via TRACE_DEFINE_ENUM() in mmutrace.h 269 * 270 * Note, all values must be greater than or equal to zero so as not to encroach 271 * on -errno return values. Somewhat arbitrarily use '0' for CONTINUE, which 272 * will allow for efficient machine code when checking for CONTINUE, e.g. 273 * "TEST %rax, %rax, JNZ", as all "stop!" values are non-zero. 274 */ 275 enum { 276 RET_PF_CONTINUE = 0, 277 RET_PF_RETRY, 278 RET_PF_EMULATE, 279 RET_PF_WRITE_PROTECTED, 280 RET_PF_INVALID, 281 RET_PF_FIXED, 282 RET_PF_SPURIOUS, 283 }; 284 285 static inline void kvm_mmu_prepare_memory_fault_exit(struct kvm_vcpu *vcpu, 286 struct kvm_page_fault *fault) 287 { 288 kvm_prepare_memory_fault_exit(vcpu, fault->gfn << PAGE_SHIFT, 289 PAGE_SIZE, fault->write, fault->exec, 290 fault->is_private); 291 } 292 293 static inline int kvm_mmu_do_page_fault(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa, 294 u64 err, bool prefetch, 295 int *emulation_type, u8 *level) 296 { 297 struct kvm_page_fault fault = { 298 .addr = cr2_or_gpa, 299 .error_code = err, 300 .exec = err & PFERR_FETCH_MASK, 301 .write = err & PFERR_WRITE_MASK, 302 .present = err & PFERR_PRESENT_MASK, 303 .rsvd = err & PFERR_RSVD_MASK, 304 .user = err & PFERR_USER_MASK, 305 .prefetch = prefetch, 306 .is_tdp = likely(vcpu->arch.mmu->page_fault == kvm_tdp_page_fault), 307 .nx_huge_page_workaround_enabled = 308 is_nx_huge_page_enabled(vcpu->kvm), 309 310 .max_level = KVM_MAX_HUGEPAGE_LEVEL, 311 .req_level = PG_LEVEL_4K, 312 .goal_level = PG_LEVEL_4K, 313 .is_private = err & PFERR_PRIVATE_ACCESS, 314 315 .pfn = KVM_PFN_ERR_FAULT, 316 .hva = KVM_HVA_ERR_BAD, 317 }; 318 int r; 319 320 if (vcpu->arch.mmu->root_role.direct) { 321 fault.gfn = fault.addr >> PAGE_SHIFT; 322 fault.slot = kvm_vcpu_gfn_to_memslot(vcpu, fault.gfn); 323 } 324 325 if (IS_ENABLED(CONFIG_MITIGATION_RETPOLINE) && fault.is_tdp) 326 r = kvm_tdp_page_fault(vcpu, &fault); 327 else 328 r = vcpu->arch.mmu->page_fault(vcpu, &fault); 329 330 /* 331 * Not sure what's happening, but punt to userspace and hope that 332 * they can fix it by changing memory to shared, or they can 333 * provide a better error. 334 */ 335 if (r == RET_PF_EMULATE && fault.is_private) { 336 pr_warn_ratelimited("kvm: unexpected emulation request on private memory\n"); 337 kvm_mmu_prepare_memory_fault_exit(vcpu, &fault); 338 return -EFAULT; 339 } 340 341 if (fault.write_fault_to_shadow_pgtable && emulation_type) 342 *emulation_type |= EMULTYPE_WRITE_PF_TO_SP; 343 if (level) 344 *level = fault.goal_level; 345 346 return r; 347 } 348 349 int kvm_mmu_max_mapping_level(struct kvm *kvm, 350 const struct kvm_memory_slot *slot, gfn_t gfn, 351 int max_level); 352 void kvm_mmu_hugepage_adjust(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault); 353 void disallowed_hugepage_adjust(struct kvm_page_fault *fault, u64 spte, int cur_level); 354 355 void track_possible_nx_huge_page(struct kvm *kvm, struct kvm_mmu_page *sp); 356 void untrack_possible_nx_huge_page(struct kvm *kvm, struct kvm_mmu_page *sp); 357 358 #endif /* __KVM_X86_MMU_INTERNAL_H */ 359