xref: /openbmc/linux/arch/x86/kvm/mmu/mmu_internal.h (revision 83146efc)
1 /* SPDX-License-Identifier: GPL-2.0 */
2 #ifndef __KVM_X86_MMU_INTERNAL_H
3 #define __KVM_X86_MMU_INTERNAL_H
4 
5 #include <linux/types.h>
6 #include <linux/kvm_host.h>
7 #include <asm/kvm_host.h>
8 
9 #ifdef CONFIG_KVM_PROVE_MMU
10 #define KVM_MMU_WARN_ON(x) WARN_ON_ONCE(x)
11 #else
12 #define KVM_MMU_WARN_ON(x) BUILD_BUG_ON_INVALID(x)
13 #endif
14 
15 /* Page table builder macros common to shadow (host) PTEs and guest PTEs. */
16 #define __PT_LEVEL_SHIFT(level, bits_per_level)	\
17 	(PAGE_SHIFT + ((level) - 1) * (bits_per_level))
18 #define __PT_INDEX(address, level, bits_per_level) \
19 	(((address) >> __PT_LEVEL_SHIFT(level, bits_per_level)) & ((1 << (bits_per_level)) - 1))
20 
21 #define __PT_LVL_ADDR_MASK(base_addr_mask, level, bits_per_level) \
22 	((base_addr_mask) & ~((1ULL << (PAGE_SHIFT + (((level) - 1) * (bits_per_level)))) - 1))
23 
24 #define __PT_LVL_OFFSET_MASK(base_addr_mask, level, bits_per_level) \
25 	((base_addr_mask) & ((1ULL << (PAGE_SHIFT + (((level) - 1) * (bits_per_level)))) - 1))
26 
27 #define __PT_ENT_PER_PAGE(bits_per_level)  (1 << (bits_per_level))
28 
29 /*
30  * Unlike regular MMU roots, PAE "roots", a.k.a. PDPTEs/PDPTRs, have a PRESENT
31  * bit, and thus are guaranteed to be non-zero when valid.  And, when a guest
32  * PDPTR is !PRESENT, its corresponding PAE root cannot be set to INVALID_PAGE,
33  * as the CPU would treat that as PRESENT PDPTR with reserved bits set.  Use
34  * '0' instead of INVALID_PAGE to indicate an invalid PAE root.
35  */
36 #define INVALID_PAE_ROOT	0
37 #define IS_VALID_PAE_ROOT(x)	(!!(x))
38 
39 static inline hpa_t kvm_mmu_get_dummy_root(void)
40 {
41 	return my_zero_pfn(0) << PAGE_SHIFT;
42 }
43 
44 static inline bool kvm_mmu_is_dummy_root(hpa_t shadow_page)
45 {
46 	return is_zero_pfn(shadow_page >> PAGE_SHIFT);
47 }
48 
49 typedef u64 __rcu *tdp_ptep_t;
50 
51 struct kvm_mmu_page {
52 	/*
53 	 * Note, "link" through "spt" fit in a single 64 byte cache line on
54 	 * 64-bit kernels, keep it that way unless there's a reason not to.
55 	 */
56 	struct list_head link;
57 	struct hlist_node hash_link;
58 
59 	bool tdp_mmu_page;
60 	bool unsync;
61 	union {
62 		u8 mmu_valid_gen;
63 
64 		/* Only accessed under slots_lock.  */
65 		bool tdp_mmu_scheduled_root_to_zap;
66 	};
67 
68 	 /*
69 	  * The shadow page can't be replaced by an equivalent huge page
70 	  * because it is being used to map an executable page in the guest
71 	  * and the NX huge page mitigation is enabled.
72 	  */
73 	bool nx_huge_page_disallowed;
74 
75 	/*
76 	 * The following two entries are used to key the shadow page in the
77 	 * hash table.
78 	 */
79 	union kvm_mmu_page_role role;
80 	gfn_t gfn;
81 
82 	u64 *spt;
83 
84 	/*
85 	 * Stores the result of the guest translation being shadowed by each
86 	 * SPTE.  KVM shadows two types of guest translations: nGPA -> GPA
87 	 * (shadow EPT/NPT) and GVA -> GPA (traditional shadow paging). In both
88 	 * cases the result of the translation is a GPA and a set of access
89 	 * constraints.
90 	 *
91 	 * The GFN is stored in the upper bits (PAGE_SHIFT) and the shadowed
92 	 * access permissions are stored in the lower bits. Note, for
93 	 * convenience and uniformity across guests, the access permissions are
94 	 * stored in KVM format (e.g.  ACC_EXEC_MASK) not the raw guest format.
95 	 */
96 	u64 *shadowed_translation;
97 
98 	/* Currently serving as active root */
99 	union {
100 		int root_count;
101 		refcount_t tdp_mmu_root_count;
102 	};
103 	unsigned int unsync_children;
104 	union {
105 		struct kvm_rmap_head parent_ptes; /* rmap pointers to parent sptes */
106 		tdp_ptep_t ptep;
107 	};
108 	DECLARE_BITMAP(unsync_child_bitmap, 512);
109 
110 	/*
111 	 * Tracks shadow pages that, if zapped, would allow KVM to create an NX
112 	 * huge page.  A shadow page will have nx_huge_page_disallowed set but
113 	 * not be on the list if a huge page is disallowed for other reasons,
114 	 * e.g. because KVM is shadowing a PTE at the same gfn, the memslot
115 	 * isn't properly aligned, etc...
116 	 */
117 	struct list_head possible_nx_huge_page_link;
118 #ifdef CONFIG_X86_32
119 	/*
120 	 * Used out of the mmu-lock to avoid reading spte values while an
121 	 * update is in progress; see the comments in __get_spte_lockless().
122 	 */
123 	int clear_spte_count;
124 #endif
125 
126 	/* Number of writes since the last time traversal visited this page.  */
127 	atomic_t write_flooding_count;
128 
129 #ifdef CONFIG_X86_64
130 	/* Used for freeing the page asynchronously if it is a TDP MMU page. */
131 	struct rcu_head rcu_head;
132 #endif
133 };
134 
135 extern struct kmem_cache *mmu_page_header_cache;
136 
137 static inline int kvm_mmu_role_as_id(union kvm_mmu_page_role role)
138 {
139 	return role.smm ? 1 : 0;
140 }
141 
142 static inline int kvm_mmu_page_as_id(struct kvm_mmu_page *sp)
143 {
144 	return kvm_mmu_role_as_id(sp->role);
145 }
146 
147 static inline bool kvm_mmu_page_ad_need_write_protect(struct kvm_mmu_page *sp)
148 {
149 	/*
150 	 * When using the EPT page-modification log, the GPAs in the CPU dirty
151 	 * log would come from L2 rather than L1.  Therefore, we need to rely
152 	 * on write protection to record dirty pages, which bypasses PML, since
153 	 * writes now result in a vmexit.  Note, the check on CPU dirty logging
154 	 * being enabled is mandatory as the bits used to denote WP-only SPTEs
155 	 * are reserved for PAE paging (32-bit KVM).
156 	 */
157 	return kvm_x86_ops.cpu_dirty_log_size && sp->role.guest_mode;
158 }
159 
160 static inline gfn_t gfn_round_for_level(gfn_t gfn, int level)
161 {
162 	return gfn & -KVM_PAGES_PER_HPAGE(level);
163 }
164 
165 int mmu_try_to_unsync_pages(struct kvm *kvm, const struct kvm_memory_slot *slot,
166 			    gfn_t gfn, bool can_unsync, bool prefetch);
167 
168 void kvm_mmu_gfn_disallow_lpage(const struct kvm_memory_slot *slot, gfn_t gfn);
169 void kvm_mmu_gfn_allow_lpage(const struct kvm_memory_slot *slot, gfn_t gfn);
170 bool kvm_mmu_slot_gfn_write_protect(struct kvm *kvm,
171 				    struct kvm_memory_slot *slot, u64 gfn,
172 				    int min_level);
173 
174 /* Flush the given page (huge or not) of guest memory. */
175 static inline void kvm_flush_remote_tlbs_gfn(struct kvm *kvm, gfn_t gfn, int level)
176 {
177 	kvm_flush_remote_tlbs_range(kvm, gfn_round_for_level(gfn, level),
178 				    KVM_PAGES_PER_HPAGE(level));
179 }
180 
181 unsigned int pte_list_count(struct kvm_rmap_head *rmap_head);
182 
183 extern int nx_huge_pages;
184 static inline bool is_nx_huge_page_enabled(struct kvm *kvm)
185 {
186 	return READ_ONCE(nx_huge_pages) && !kvm->arch.disable_nx_huge_pages;
187 }
188 
189 struct kvm_page_fault {
190 	/* arguments to kvm_mmu_do_page_fault.  */
191 	const gpa_t addr;
192 	const u32 error_code;
193 	const bool prefetch;
194 
195 	/* Derived from error_code.  */
196 	const bool exec;
197 	const bool write;
198 	const bool present;
199 	const bool rsvd;
200 	const bool user;
201 
202 	/* Derived from mmu and global state.  */
203 	const bool is_tdp;
204 	const bool nx_huge_page_workaround_enabled;
205 
206 	/*
207 	 * Whether a >4KB mapping can be created or is forbidden due to NX
208 	 * hugepages.
209 	 */
210 	bool huge_page_disallowed;
211 
212 	/*
213 	 * Maximum page size that can be created for this fault; input to
214 	 * FNAME(fetch), direct_map() and kvm_tdp_mmu_map().
215 	 */
216 	u8 max_level;
217 
218 	/*
219 	 * Page size that can be created based on the max_level and the
220 	 * page size used by the host mapping.
221 	 */
222 	u8 req_level;
223 
224 	/*
225 	 * Page size that will be created based on the req_level and
226 	 * huge_page_disallowed.
227 	 */
228 	u8 goal_level;
229 
230 	/* Shifted addr, or result of guest page table walk if addr is a gva.  */
231 	gfn_t gfn;
232 
233 	/* The memslot containing gfn. May be NULL. */
234 	struct kvm_memory_slot *slot;
235 
236 	/* Outputs of kvm_faultin_pfn.  */
237 	unsigned long mmu_seq;
238 	kvm_pfn_t pfn;
239 	hva_t hva;
240 	bool map_writable;
241 
242 	/*
243 	 * Indicates the guest is trying to write a gfn that contains one or
244 	 * more of the PTEs used to translate the write itself, i.e. the access
245 	 * is changing its own translation in the guest page tables.
246 	 */
247 	bool write_fault_to_shadow_pgtable;
248 };
249 
250 int kvm_tdp_page_fault(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault);
251 
252 /*
253  * Return values of handle_mmio_page_fault(), mmu.page_fault(), fast_page_fault(),
254  * and of course kvm_mmu_do_page_fault().
255  *
256  * RET_PF_CONTINUE: So far, so good, keep handling the page fault.
257  * RET_PF_RETRY: let CPU fault again on the address.
258  * RET_PF_EMULATE: mmio page fault, emulate the instruction directly.
259  * RET_PF_INVALID: the spte is invalid, let the real page fault path update it.
260  * RET_PF_FIXED: The faulting entry has been fixed.
261  * RET_PF_SPURIOUS: The faulting entry was already fixed, e.g. by another vCPU.
262  *
263  * Any names added to this enum should be exported to userspace for use in
264  * tracepoints via TRACE_DEFINE_ENUM() in mmutrace.h
265  *
266  * Note, all values must be greater than or equal to zero so as not to encroach
267  * on -errno return values.  Somewhat arbitrarily use '0' for CONTINUE, which
268  * will allow for efficient machine code when checking for CONTINUE, e.g.
269  * "TEST %rax, %rax, JNZ", as all "stop!" values are non-zero.
270  */
271 enum {
272 	RET_PF_CONTINUE = 0,
273 	RET_PF_RETRY,
274 	RET_PF_EMULATE,
275 	RET_PF_INVALID,
276 	RET_PF_FIXED,
277 	RET_PF_SPURIOUS,
278 };
279 
280 static inline int kvm_mmu_do_page_fault(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa,
281 					u32 err, bool prefetch, int *emulation_type)
282 {
283 	struct kvm_page_fault fault = {
284 		.addr = cr2_or_gpa,
285 		.error_code = err,
286 		.exec = err & PFERR_FETCH_MASK,
287 		.write = err & PFERR_WRITE_MASK,
288 		.present = err & PFERR_PRESENT_MASK,
289 		.rsvd = err & PFERR_RSVD_MASK,
290 		.user = err & PFERR_USER_MASK,
291 		.prefetch = prefetch,
292 		.is_tdp = likely(vcpu->arch.mmu->page_fault == kvm_tdp_page_fault),
293 		.nx_huge_page_workaround_enabled =
294 			is_nx_huge_page_enabled(vcpu->kvm),
295 
296 		.max_level = KVM_MAX_HUGEPAGE_LEVEL,
297 		.req_level = PG_LEVEL_4K,
298 		.goal_level = PG_LEVEL_4K,
299 	};
300 	int r;
301 
302 	if (vcpu->arch.mmu->root_role.direct) {
303 		fault.gfn = fault.addr >> PAGE_SHIFT;
304 		fault.slot = kvm_vcpu_gfn_to_memslot(vcpu, fault.gfn);
305 	}
306 
307 	/*
308 	 * Async #PF "faults", a.k.a. prefetch faults, are not faults from the
309 	 * guest perspective and have already been counted at the time of the
310 	 * original fault.
311 	 */
312 	if (!prefetch)
313 		vcpu->stat.pf_taken++;
314 
315 	if (IS_ENABLED(CONFIG_RETPOLINE) && fault.is_tdp)
316 		r = kvm_tdp_page_fault(vcpu, &fault);
317 	else
318 		r = vcpu->arch.mmu->page_fault(vcpu, &fault);
319 
320 	if (fault.write_fault_to_shadow_pgtable && emulation_type)
321 		*emulation_type |= EMULTYPE_WRITE_PF_TO_SP;
322 
323 	/*
324 	 * Similar to above, prefetch faults aren't truly spurious, and the
325 	 * async #PF path doesn't do emulation.  Do count faults that are fixed
326 	 * by the async #PF handler though, otherwise they'll never be counted.
327 	 */
328 	if (r == RET_PF_FIXED)
329 		vcpu->stat.pf_fixed++;
330 	else if (prefetch)
331 		;
332 	else if (r == RET_PF_EMULATE)
333 		vcpu->stat.pf_emulate++;
334 	else if (r == RET_PF_SPURIOUS)
335 		vcpu->stat.pf_spurious++;
336 	return r;
337 }
338 
339 int kvm_mmu_max_mapping_level(struct kvm *kvm,
340 			      const struct kvm_memory_slot *slot, gfn_t gfn,
341 			      int max_level);
342 void kvm_mmu_hugepage_adjust(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault);
343 void disallowed_hugepage_adjust(struct kvm_page_fault *fault, u64 spte, int cur_level);
344 
345 void *mmu_memory_cache_alloc(struct kvm_mmu_memory_cache *mc);
346 
347 void track_possible_nx_huge_page(struct kvm *kvm, struct kvm_mmu_page *sp);
348 void untrack_possible_nx_huge_page(struct kvm *kvm, struct kvm_mmu_page *sp);
349 
350 #endif /* __KVM_X86_MMU_INTERNAL_H */
351