1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Copyright (C) 2020 Google LLC
4  * Author: Will Deacon <will@kernel.org>
5  */
6 
7 #ifndef __ARM64_KVM_PGTABLE_H__
8 #define __ARM64_KVM_PGTABLE_H__
9 
10 #include <linux/bits.h>
11 #include <linux/kvm_host.h>
12 #include <linux/types.h>
13 
14 #define KVM_PGTABLE_MAX_LEVELS		4U
15 
16 static inline u64 kvm_get_parange(u64 mmfr0)
17 {
18 	u64 parange = cpuid_feature_extract_unsigned_field(mmfr0,
19 				ID_AA64MMFR0_PARANGE_SHIFT);
20 	if (parange > ID_AA64MMFR0_PARANGE_MAX)
21 		parange = ID_AA64MMFR0_PARANGE_MAX;
22 
23 	return parange;
24 }
25 
26 typedef u64 kvm_pte_t;
27 
28 /**
29  * struct kvm_pgtable_mm_ops - Memory management callbacks.
30  * @zalloc_page:	Allocate a single zeroed memory page. The @arg parameter
31  *			can be used by the walker to pass a memcache. The
32  *			initial refcount of the page is 1.
33  * @zalloc_pages_exact:	Allocate an exact number of zeroed memory pages. The
34  *			@size parameter is in bytes, and is rounded-up to the
35  *			next page boundary. The resulting allocation is
36  *			physically contiguous.
37  * @free_pages_exact:	Free an exact number of memory pages previously
38  *			allocated by zalloc_pages_exact.
39  * @get_page:		Increment the refcount on a page.
40  * @put_page:		Decrement the refcount on a page. When the refcount
41  *			reaches 0 the page is automatically freed.
42  * @page_count:		Return the refcount of a page.
43  * @phys_to_virt:	Convert a physical address into a virtual address mapped
44  *			in the current context.
45  * @virt_to_phys:	Convert a virtual address mapped in the current context
46  *			into a physical address.
47  */
48 struct kvm_pgtable_mm_ops {
49 	void*		(*zalloc_page)(void *arg);
50 	void*		(*zalloc_pages_exact)(size_t size);
51 	void		(*free_pages_exact)(void *addr, size_t size);
52 	void		(*get_page)(void *addr);
53 	void		(*put_page)(void *addr);
54 	int		(*page_count)(void *addr);
55 	void*		(*phys_to_virt)(phys_addr_t phys);
56 	phys_addr_t	(*virt_to_phys)(void *addr);
57 };
58 
59 /**
60  * enum kvm_pgtable_stage2_flags - Stage-2 page-table flags.
61  * @KVM_PGTABLE_S2_NOFWB:	Don't enforce Normal-WB even if the CPUs have
62  *				ARM64_HAS_STAGE2_FWB.
63  * @KVM_PGTABLE_S2_IDMAP:	Only use identity mappings.
64  */
65 enum kvm_pgtable_stage2_flags {
66 	KVM_PGTABLE_S2_NOFWB			= BIT(0),
67 	KVM_PGTABLE_S2_IDMAP			= BIT(1),
68 };
69 
70 /**
71  * struct kvm_pgtable - KVM page-table.
72  * @ia_bits:		Maximum input address size, in bits.
73  * @start_level:	Level at which the page-table walk starts.
74  * @pgd:		Pointer to the first top-level entry of the page-table.
75  * @mm_ops:		Memory management callbacks.
76  * @mmu:		Stage-2 KVM MMU struct. Unused for stage-1 page-tables.
77  */
78 struct kvm_pgtable {
79 	u32					ia_bits;
80 	u32					start_level;
81 	kvm_pte_t				*pgd;
82 	struct kvm_pgtable_mm_ops		*mm_ops;
83 
84 	/* Stage-2 only */
85 	struct kvm_s2_mmu			*mmu;
86 	enum kvm_pgtable_stage2_flags		flags;
87 };
88 
89 /**
90  * enum kvm_pgtable_prot - Page-table permissions and attributes.
91  * @KVM_PGTABLE_PROT_X:		Execute permission.
92  * @KVM_PGTABLE_PROT_W:		Write permission.
93  * @KVM_PGTABLE_PROT_R:		Read permission.
94  * @KVM_PGTABLE_PROT_DEVICE:	Device attributes.
95  */
96 enum kvm_pgtable_prot {
97 	KVM_PGTABLE_PROT_X			= BIT(0),
98 	KVM_PGTABLE_PROT_W			= BIT(1),
99 	KVM_PGTABLE_PROT_R			= BIT(2),
100 
101 	KVM_PGTABLE_PROT_DEVICE			= BIT(3),
102 };
103 
104 #define PAGE_HYP		(KVM_PGTABLE_PROT_R | KVM_PGTABLE_PROT_W)
105 #define PAGE_HYP_EXEC		(KVM_PGTABLE_PROT_R | KVM_PGTABLE_PROT_X)
106 #define PAGE_HYP_RO		(KVM_PGTABLE_PROT_R)
107 #define PAGE_HYP_DEVICE		(PAGE_HYP | KVM_PGTABLE_PROT_DEVICE)
108 
109 /**
110  * struct kvm_mem_range - Range of Intermediate Physical Addresses
111  * @start:	Start of the range.
112  * @end:	End of the range.
113  */
114 struct kvm_mem_range {
115 	u64 start;
116 	u64 end;
117 };
118 
119 /**
120  * enum kvm_pgtable_walk_flags - Flags to control a depth-first page-table walk.
121  * @KVM_PGTABLE_WALK_LEAF:		Visit leaf entries, including invalid
122  *					entries.
123  * @KVM_PGTABLE_WALK_TABLE_PRE:		Visit table entries before their
124  *					children.
125  * @KVM_PGTABLE_WALK_TABLE_POST:	Visit table entries after their
126  *					children.
127  */
128 enum kvm_pgtable_walk_flags {
129 	KVM_PGTABLE_WALK_LEAF			= BIT(0),
130 	KVM_PGTABLE_WALK_TABLE_PRE		= BIT(1),
131 	KVM_PGTABLE_WALK_TABLE_POST		= BIT(2),
132 };
133 
134 typedef int (*kvm_pgtable_visitor_fn_t)(u64 addr, u64 end, u32 level,
135 					kvm_pte_t *ptep,
136 					enum kvm_pgtable_walk_flags flag,
137 					void * const arg);
138 
139 /**
140  * struct kvm_pgtable_walker - Hook into a page-table walk.
141  * @cb:		Callback function to invoke during the walk.
142  * @arg:	Argument passed to the callback function.
143  * @flags:	Bitwise-OR of flags to identify the entry types on which to
144  *		invoke the callback function.
145  */
146 struct kvm_pgtable_walker {
147 	const kvm_pgtable_visitor_fn_t		cb;
148 	void * const				arg;
149 	const enum kvm_pgtable_walk_flags	flags;
150 };
151 
152 /**
153  * kvm_pgtable_hyp_init() - Initialise a hypervisor stage-1 page-table.
154  * @pgt:	Uninitialised page-table structure to initialise.
155  * @va_bits:	Maximum virtual address bits.
156  * @mm_ops:	Memory management callbacks.
157  *
158  * Return: 0 on success, negative error code on failure.
159  */
160 int kvm_pgtable_hyp_init(struct kvm_pgtable *pgt, u32 va_bits,
161 			 struct kvm_pgtable_mm_ops *mm_ops);
162 
163 /**
164  * kvm_pgtable_hyp_destroy() - Destroy an unused hypervisor stage-1 page-table.
165  * @pgt:	Page-table structure initialised by kvm_pgtable_hyp_init().
166  *
167  * The page-table is assumed to be unreachable by any hardware walkers prior
168  * to freeing and therefore no TLB invalidation is performed.
169  */
170 void kvm_pgtable_hyp_destroy(struct kvm_pgtable *pgt);
171 
172 /**
173  * kvm_pgtable_hyp_map() - Install a mapping in a hypervisor stage-1 page-table.
174  * @pgt:	Page-table structure initialised by kvm_pgtable_hyp_init().
175  * @addr:	Virtual address at which to place the mapping.
176  * @size:	Size of the mapping.
177  * @phys:	Physical address of the memory to map.
178  * @prot:	Permissions and attributes for the mapping.
179  *
180  * The offset of @addr within a page is ignored, @size is rounded-up to
181  * the next page boundary and @phys is rounded-down to the previous page
182  * boundary.
183  *
184  * If device attributes are not explicitly requested in @prot, then the
185  * mapping will be normal, cacheable. Attempts to install a new mapping
186  * for a virtual address that is already mapped will be rejected with an
187  * error and a WARN().
188  *
189  * Return: 0 on success, negative error code on failure.
190  */
191 int kvm_pgtable_hyp_map(struct kvm_pgtable *pgt, u64 addr, u64 size, u64 phys,
192 			enum kvm_pgtable_prot prot);
193 
194 /**
195  * kvm_get_vtcr() - Helper to construct VTCR_EL2
196  * @mmfr0:	Sanitized value of SYS_ID_AA64MMFR0_EL1 register.
197  * @mmfr1:	Sanitized value of SYS_ID_AA64MMFR1_EL1 register.
198  * @phys_shfit:	Value to set in VTCR_EL2.T0SZ.
199  *
200  * The VTCR value is common across all the physical CPUs on the system.
201  * We use system wide sanitised values to fill in different fields,
202  * except for Hardware Management of Access Flags. HA Flag is set
203  * unconditionally on all CPUs, as it is safe to run with or without
204  * the feature and the bit is RES0 on CPUs that don't support it.
205  *
206  * Return: VTCR_EL2 value
207  */
208 u64 kvm_get_vtcr(u64 mmfr0, u64 mmfr1, u32 phys_shift);
209 
210 /**
211  * kvm_pgtable_stage2_init_flags() - Initialise a guest stage-2 page-table.
212  * @pgt:	Uninitialised page-table structure to initialise.
213  * @arch:	Arch-specific KVM structure representing the guest virtual
214  *		machine.
215  * @mm_ops:	Memory management callbacks.
216  * @flags:	Stage-2 configuration flags.
217  *
218  * Return: 0 on success, negative error code on failure.
219  */
220 int kvm_pgtable_stage2_init_flags(struct kvm_pgtable *pgt, struct kvm_arch *arch,
221 				  struct kvm_pgtable_mm_ops *mm_ops,
222 				  enum kvm_pgtable_stage2_flags flags);
223 
224 #define kvm_pgtable_stage2_init(pgt, arch, mm_ops) \
225 	kvm_pgtable_stage2_init_flags(pgt, arch, mm_ops, 0)
226 
227 /**
228  * kvm_pgtable_stage2_destroy() - Destroy an unused guest stage-2 page-table.
229  * @pgt:	Page-table structure initialised by kvm_pgtable_stage2_init*().
230  *
231  * The page-table is assumed to be unreachable by any hardware walkers prior
232  * to freeing and therefore no TLB invalidation is performed.
233  */
234 void kvm_pgtable_stage2_destroy(struct kvm_pgtable *pgt);
235 
236 /**
237  * kvm_pgtable_stage2_map() - Install a mapping in a guest stage-2 page-table.
238  * @pgt:	Page-table structure initialised by kvm_pgtable_stage2_init*().
239  * @addr:	Intermediate physical address at which to place the mapping.
240  * @size:	Size of the mapping.
241  * @phys:	Physical address of the memory to map.
242  * @prot:	Permissions and attributes for the mapping.
243  * @mc:		Cache of pre-allocated and zeroed memory from which to allocate
244  *		page-table pages.
245  *
246  * The offset of @addr within a page is ignored, @size is rounded-up to
247  * the next page boundary and @phys is rounded-down to the previous page
248  * boundary.
249  *
250  * If device attributes are not explicitly requested in @prot, then the
251  * mapping will be normal, cacheable.
252  *
253  * Note that the update of a valid leaf PTE in this function will be aborted,
254  * if it's trying to recreate the exact same mapping or only change the access
255  * permissions. Instead, the vCPU will exit one more time from guest if still
256  * needed and then go through the path of relaxing permissions.
257  *
258  * Note that this function will both coalesce existing table entries and split
259  * existing block mappings, relying on page-faults to fault back areas outside
260  * of the new mapping lazily.
261  *
262  * Return: 0 on success, negative error code on failure.
263  */
264 int kvm_pgtable_stage2_map(struct kvm_pgtable *pgt, u64 addr, u64 size,
265 			   u64 phys, enum kvm_pgtable_prot prot,
266 			   void *mc);
267 
268 /**
269  * kvm_pgtable_stage2_set_owner() - Unmap and annotate pages in the IPA space to
270  *				    track ownership.
271  * @pgt:	Page-table structure initialised by kvm_pgtable_stage2_init*().
272  * @addr:	Base intermediate physical address to annotate.
273  * @size:	Size of the annotated range.
274  * @mc:		Cache of pre-allocated and zeroed memory from which to allocate
275  *		page-table pages.
276  * @owner_id:	Unique identifier for the owner of the page.
277  *
278  * By default, all page-tables are owned by identifier 0. This function can be
279  * used to mark portions of the IPA space as owned by other entities. When a
280  * stage 2 is used with identity-mappings, these annotations allow to use the
281  * page-table data structure as a simple rmap.
282  *
283  * Return: 0 on success, negative error code on failure.
284  */
285 int kvm_pgtable_stage2_set_owner(struct kvm_pgtable *pgt, u64 addr, u64 size,
286 				 void *mc, u8 owner_id);
287 
288 /**
289  * kvm_pgtable_stage2_unmap() - Remove a mapping from a guest stage-2 page-table.
290  * @pgt:	Page-table structure initialised by kvm_pgtable_stage2_init*().
291  * @addr:	Intermediate physical address from which to remove the mapping.
292  * @size:	Size of the mapping.
293  *
294  * The offset of @addr within a page is ignored and @size is rounded-up to
295  * the next page boundary.
296  *
297  * TLB invalidation is performed for each page-table entry cleared during the
298  * unmapping operation and the reference count for the page-table page
299  * containing the cleared entry is decremented, with unreferenced pages being
300  * freed. Unmapping a cacheable page will ensure that it is clean to the PoC if
301  * FWB is not supported by the CPU.
302  *
303  * Return: 0 on success, negative error code on failure.
304  */
305 int kvm_pgtable_stage2_unmap(struct kvm_pgtable *pgt, u64 addr, u64 size);
306 
307 /**
308  * kvm_pgtable_stage2_wrprotect() - Write-protect guest stage-2 address range
309  *                                  without TLB invalidation.
310  * @pgt:	Page-table structure initialised by kvm_pgtable_stage2_init*().
311  * @addr:	Intermediate physical address from which to write-protect,
312  * @size:	Size of the range.
313  *
314  * The offset of @addr within a page is ignored and @size is rounded-up to
315  * the next page boundary.
316  *
317  * Note that it is the caller's responsibility to invalidate the TLB after
318  * calling this function to ensure that the updated permissions are visible
319  * to the CPUs.
320  *
321  * Return: 0 on success, negative error code on failure.
322  */
323 int kvm_pgtable_stage2_wrprotect(struct kvm_pgtable *pgt, u64 addr, u64 size);
324 
325 /**
326  * kvm_pgtable_stage2_mkyoung() - Set the access flag in a page-table entry.
327  * @pgt:	Page-table structure initialised by kvm_pgtable_stage2_init*().
328  * @addr:	Intermediate physical address to identify the page-table entry.
329  *
330  * The offset of @addr within a page is ignored.
331  *
332  * If there is a valid, leaf page-table entry used to translate @addr, then
333  * set the access flag in that entry.
334  *
335  * Return: The old page-table entry prior to setting the flag, 0 on failure.
336  */
337 kvm_pte_t kvm_pgtable_stage2_mkyoung(struct kvm_pgtable *pgt, u64 addr);
338 
339 /**
340  * kvm_pgtable_stage2_mkold() - Clear the access flag in a page-table entry.
341  * @pgt:	Page-table structure initialised by kvm_pgtable_stage2_init*().
342  * @addr:	Intermediate physical address to identify the page-table entry.
343  *
344  * The offset of @addr within a page is ignored.
345  *
346  * If there is a valid, leaf page-table entry used to translate @addr, then
347  * clear the access flag in that entry.
348  *
349  * Note that it is the caller's responsibility to invalidate the TLB after
350  * calling this function to ensure that the updated permissions are visible
351  * to the CPUs.
352  *
353  * Return: The old page-table entry prior to clearing the flag, 0 on failure.
354  */
355 kvm_pte_t kvm_pgtable_stage2_mkold(struct kvm_pgtable *pgt, u64 addr);
356 
357 /**
358  * kvm_pgtable_stage2_relax_perms() - Relax the permissions enforced by a
359  *				      page-table entry.
360  * @pgt:	Page-table structure initialised by kvm_pgtable_stage2_init*().
361  * @addr:	Intermediate physical address to identify the page-table entry.
362  * @prot:	Additional permissions to grant for the mapping.
363  *
364  * The offset of @addr within a page is ignored.
365  *
366  * If there is a valid, leaf page-table entry used to translate @addr, then
367  * relax the permissions in that entry according to the read, write and
368  * execute permissions specified by @prot. No permissions are removed, and
369  * TLB invalidation is performed after updating the entry.
370  *
371  * Return: 0 on success, negative error code on failure.
372  */
373 int kvm_pgtable_stage2_relax_perms(struct kvm_pgtable *pgt, u64 addr,
374 				   enum kvm_pgtable_prot prot);
375 
376 /**
377  * kvm_pgtable_stage2_is_young() - Test whether a page-table entry has the
378  *				   access flag set.
379  * @pgt:	Page-table structure initialised by kvm_pgtable_stage2_init*().
380  * @addr:	Intermediate physical address to identify the page-table entry.
381  *
382  * The offset of @addr within a page is ignored.
383  *
384  * Return: True if the page-table entry has the access flag set, false otherwise.
385  */
386 bool kvm_pgtable_stage2_is_young(struct kvm_pgtable *pgt, u64 addr);
387 
388 /**
389  * kvm_pgtable_stage2_flush_range() - Clean and invalidate data cache to Point
390  * 				      of Coherency for guest stage-2 address
391  *				      range.
392  * @pgt:	Page-table structure initialised by kvm_pgtable_stage2_init*().
393  * @addr:	Intermediate physical address from which to flush.
394  * @size:	Size of the range.
395  *
396  * The offset of @addr within a page is ignored and @size is rounded-up to
397  * the next page boundary.
398  *
399  * Return: 0 on success, negative error code on failure.
400  */
401 int kvm_pgtable_stage2_flush(struct kvm_pgtable *pgt, u64 addr, u64 size);
402 
403 /**
404  * kvm_pgtable_walk() - Walk a page-table.
405  * @pgt:	Page-table structure initialised by kvm_pgtable_*_init().
406  * @addr:	Input address for the start of the walk.
407  * @size:	Size of the range to walk.
408  * @walker:	Walker callback description.
409  *
410  * The offset of @addr within a page is ignored and @size is rounded-up to
411  * the next page boundary.
412  *
413  * The walker will walk the page-table entries corresponding to the input
414  * address range specified, visiting entries according to the walker flags.
415  * Invalid entries are treated as leaf entries. Leaf entries are reloaded
416  * after invoking the walker callback, allowing the walker to descend into
417  * a newly installed table.
418  *
419  * Returning a negative error code from the walker callback function will
420  * terminate the walk immediately with the same error code.
421  *
422  * Return: 0 on success, negative error code on failure.
423  */
424 int kvm_pgtable_walk(struct kvm_pgtable *pgt, u64 addr, u64 size,
425 		     struct kvm_pgtable_walker *walker);
426 
427 /**
428  * kvm_pgtable_stage2_find_range() - Find a range of Intermediate Physical
429  *				     Addresses with compatible permission
430  *				     attributes.
431  * @pgt:	Page-table structure initialised by kvm_pgtable_stage2_init*().
432  * @addr:	Address that must be covered by the range.
433  * @prot:	Protection attributes that the range must be compatible with.
434  * @range:	Range structure used to limit the search space at call time and
435  *		that will hold the result.
436  *
437  * The offset of @addr within a page is ignored. An IPA is compatible with @prot
438  * iff its corresponding stage-2 page-table entry has default ownership and, if
439  * valid, is mapped with protection attributes identical to @prot.
440  *
441  * Return: 0 on success, negative error code on failure.
442  */
443 int kvm_pgtable_stage2_find_range(struct kvm_pgtable *pgt, u64 addr,
444 				  enum kvm_pgtable_prot prot,
445 				  struct kvm_mem_range *range);
446 #endif	/* __ARM64_KVM_PGTABLE_H__ */
447