1 /* SPDX-License-Identifier: GPL-2.0 */ 2 #ifndef __KVM_X86_MMU_INTERNAL_H 3 #define __KVM_X86_MMU_INTERNAL_H 4 5 #include <linux/types.h> 6 #include <linux/kvm_host.h> 7 #include <asm/kvm_host.h> 8 9 #undef MMU_DEBUG 10 11 #ifdef MMU_DEBUG 12 extern bool dbg; 13 14 #define pgprintk(x...) do { if (dbg) printk(x); } while (0) 15 #define rmap_printk(fmt, args...) do { if (dbg) printk("%s: " fmt, __func__, ## args); } while (0) 16 #define MMU_WARN_ON(x) WARN_ON(x) 17 #else 18 #define pgprintk(x...) do { } while (0) 19 #define rmap_printk(x...) do { } while (0) 20 #define MMU_WARN_ON(x) do { } while (0) 21 #endif 22 23 /* 24 * Unlike regular MMU roots, PAE "roots", a.k.a. PDPTEs/PDPTRs, have a PRESENT 25 * bit, and thus are guaranteed to be non-zero when valid. And, when a guest 26 * PDPTR is !PRESENT, its corresponding PAE root cannot be set to INVALID_PAGE, 27 * as the CPU would treat that as PRESENT PDPTR with reserved bits set. Use 28 * '0' instead of INVALID_PAGE to indicate an invalid PAE root. 29 */ 30 #define INVALID_PAE_ROOT 0 31 #define IS_VALID_PAE_ROOT(x) (!!(x)) 32 33 typedef u64 __rcu *tdp_ptep_t; 34 35 struct kvm_mmu_page { 36 /* 37 * Note, "link" through "spt" fit in a single 64 byte cache line on 38 * 64-bit kernels, keep it that way unless there's a reason not to. 39 */ 40 struct list_head link; 41 struct hlist_node hash_link; 42 43 bool tdp_mmu_page; 44 bool unsync; 45 u8 mmu_valid_gen; 46 bool lpage_disallowed; /* Can't be replaced by an equiv large page */ 47 48 /* 49 * The following two entries are used to key the shadow page in the 50 * hash table. 51 */ 52 union kvm_mmu_page_role role; 53 gfn_t gfn; 54 55 u64 *spt; 56 /* hold the gfn of each spte inside spt */ 57 gfn_t *gfns; 58 /* Currently serving as active root */ 59 union { 60 int root_count; 61 refcount_t tdp_mmu_root_count; 62 }; 63 unsigned int unsync_children; 64 union { 65 struct kvm_rmap_head parent_ptes; /* rmap pointers to parent sptes */ 66 tdp_ptep_t ptep; 67 }; 68 union { 69 DECLARE_BITMAP(unsync_child_bitmap, 512); 70 struct { 71 struct work_struct tdp_mmu_async_work; 72 void *tdp_mmu_async_data; 73 }; 74 }; 75 76 struct list_head lpage_disallowed_link; 77 #ifdef CONFIG_X86_32 78 /* 79 * Used out of the mmu-lock to avoid reading spte values while an 80 * update is in progress; see the comments in __get_spte_lockless(). 81 */ 82 int clear_spte_count; 83 #endif 84 85 /* Number of writes since the last time traversal visited this page. */ 86 atomic_t write_flooding_count; 87 88 #ifdef CONFIG_X86_64 89 /* Used for freeing the page asynchronously if it is a TDP MMU page. */ 90 struct rcu_head rcu_head; 91 #endif 92 }; 93 94 extern struct kmem_cache *mmu_page_header_cache; 95 96 static inline struct kvm_mmu_page *to_shadow_page(hpa_t shadow_page) 97 { 98 struct page *page = pfn_to_page(shadow_page >> PAGE_SHIFT); 99 100 return (struct kvm_mmu_page *)page_private(page); 101 } 102 103 static inline struct kvm_mmu_page *sptep_to_sp(u64 *sptep) 104 { 105 return to_shadow_page(__pa(sptep)); 106 } 107 108 static inline int kvm_mmu_role_as_id(union kvm_mmu_page_role role) 109 { 110 return role.smm ? 1 : 0; 111 } 112 113 static inline int kvm_mmu_page_as_id(struct kvm_mmu_page *sp) 114 { 115 return kvm_mmu_role_as_id(sp->role); 116 } 117 118 static inline bool kvm_mmu_page_ad_need_write_protect(struct kvm_mmu_page *sp) 119 { 120 /* 121 * When using the EPT page-modification log, the GPAs in the CPU dirty 122 * log would come from L2 rather than L1. Therefore, we need to rely 123 * on write protection to record dirty pages, which bypasses PML, since 124 * writes now result in a vmexit. Note, the check on CPU dirty logging 125 * being enabled is mandatory as the bits used to denote WP-only SPTEs 126 * are reserved for PAE paging (32-bit KVM). 127 */ 128 return kvm_x86_ops.cpu_dirty_log_size && sp->role.guest_mode; 129 } 130 131 int mmu_try_to_unsync_pages(struct kvm *kvm, const struct kvm_memory_slot *slot, 132 gfn_t gfn, bool can_unsync, bool prefetch); 133 134 void kvm_mmu_gfn_disallow_lpage(const struct kvm_memory_slot *slot, gfn_t gfn); 135 void kvm_mmu_gfn_allow_lpage(const struct kvm_memory_slot *slot, gfn_t gfn); 136 bool kvm_mmu_slot_gfn_write_protect(struct kvm *kvm, 137 struct kvm_memory_slot *slot, u64 gfn, 138 int min_level); 139 void kvm_flush_remote_tlbs_with_address(struct kvm *kvm, 140 u64 start_gfn, u64 pages); 141 unsigned int pte_list_count(struct kvm_rmap_head *rmap_head); 142 143 extern int nx_huge_pages; 144 static inline bool is_nx_huge_page_enabled(void) 145 { 146 return READ_ONCE(nx_huge_pages); 147 } 148 149 struct kvm_page_fault { 150 /* arguments to kvm_mmu_do_page_fault. */ 151 const gpa_t addr; 152 const u32 error_code; 153 const bool prefetch; 154 155 /* Derived from error_code. */ 156 const bool exec; 157 const bool write; 158 const bool present; 159 const bool rsvd; 160 const bool user; 161 162 /* Derived from mmu and global state. */ 163 const bool is_tdp; 164 const bool nx_huge_page_workaround_enabled; 165 166 /* 167 * Whether a >4KB mapping can be created or is forbidden due to NX 168 * hugepages. 169 */ 170 bool huge_page_disallowed; 171 172 /* 173 * Maximum page size that can be created for this fault; input to 174 * FNAME(fetch), __direct_map and kvm_tdp_mmu_map. 175 */ 176 u8 max_level; 177 178 /* 179 * Page size that can be created based on the max_level and the 180 * page size used by the host mapping. 181 */ 182 u8 req_level; 183 184 /* 185 * Page size that will be created based on the req_level and 186 * huge_page_disallowed. 187 */ 188 u8 goal_level; 189 190 /* Shifted addr, or result of guest page table walk if addr is a gva. */ 191 gfn_t gfn; 192 193 /* The memslot containing gfn. May be NULL. */ 194 struct kvm_memory_slot *slot; 195 196 /* Outputs of kvm_faultin_pfn. */ 197 kvm_pfn_t pfn; 198 hva_t hva; 199 bool map_writable; 200 }; 201 202 int kvm_tdp_page_fault(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault); 203 204 /* 205 * Return values of handle_mmio_page_fault(), mmu.page_fault(), fast_page_fault(), 206 * and of course kvm_mmu_do_page_fault(). 207 * 208 * RET_PF_CONTINUE: So far, so good, keep handling the page fault. 209 * RET_PF_RETRY: let CPU fault again on the address. 210 * RET_PF_EMULATE: mmio page fault, emulate the instruction directly. 211 * RET_PF_INVALID: the spte is invalid, let the real page fault path update it. 212 * RET_PF_FIXED: The faulting entry has been fixed. 213 * RET_PF_SPURIOUS: The faulting entry was already fixed, e.g. by another vCPU. 214 * 215 * Any names added to this enum should be exported to userspace for use in 216 * tracepoints via TRACE_DEFINE_ENUM() in mmutrace.h 217 * 218 * Note, all values must be greater than or equal to zero so as not to encroach 219 * on -errno return values. Somewhat arbitrarily use '0' for CONTINUE, which 220 * will allow for efficient machine code when checking for CONTINUE, e.g. 221 * "TEST %rax, %rax, JNZ", as all "stop!" values are non-zero. 222 */ 223 enum { 224 RET_PF_CONTINUE = 0, 225 RET_PF_RETRY, 226 RET_PF_EMULATE, 227 RET_PF_INVALID, 228 RET_PF_FIXED, 229 RET_PF_SPURIOUS, 230 }; 231 232 static inline int kvm_mmu_do_page_fault(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa, 233 u32 err, bool prefetch) 234 { 235 struct kvm_page_fault fault = { 236 .addr = cr2_or_gpa, 237 .error_code = err, 238 .exec = err & PFERR_FETCH_MASK, 239 .write = err & PFERR_WRITE_MASK, 240 .present = err & PFERR_PRESENT_MASK, 241 .rsvd = err & PFERR_RSVD_MASK, 242 .user = err & PFERR_USER_MASK, 243 .prefetch = prefetch, 244 .is_tdp = likely(vcpu->arch.mmu->page_fault == kvm_tdp_page_fault), 245 .nx_huge_page_workaround_enabled = is_nx_huge_page_enabled(), 246 247 .max_level = KVM_MAX_HUGEPAGE_LEVEL, 248 .req_level = PG_LEVEL_4K, 249 .goal_level = PG_LEVEL_4K, 250 }; 251 int r; 252 253 /* 254 * Async #PF "faults", a.k.a. prefetch faults, are not faults from the 255 * guest perspective and have already been counted at the time of the 256 * original fault. 257 */ 258 if (!prefetch) 259 vcpu->stat.pf_taken++; 260 261 if (IS_ENABLED(CONFIG_RETPOLINE) && fault.is_tdp) 262 r = kvm_tdp_page_fault(vcpu, &fault); 263 else 264 r = vcpu->arch.mmu->page_fault(vcpu, &fault); 265 266 /* 267 * Similar to above, prefetch faults aren't truly spurious, and the 268 * async #PF path doesn't do emulation. Do count faults that are fixed 269 * by the async #PF handler though, otherwise they'll never be counted. 270 */ 271 if (r == RET_PF_FIXED) 272 vcpu->stat.pf_fixed++; 273 else if (prefetch) 274 ; 275 else if (r == RET_PF_EMULATE) 276 vcpu->stat.pf_emulate++; 277 else if (r == RET_PF_SPURIOUS) 278 vcpu->stat.pf_spurious++; 279 return r; 280 } 281 282 int kvm_mmu_max_mapping_level(struct kvm *kvm, 283 const struct kvm_memory_slot *slot, gfn_t gfn, 284 kvm_pfn_t pfn, int max_level); 285 void kvm_mmu_hugepage_adjust(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault); 286 void disallowed_hugepage_adjust(struct kvm_page_fault *fault, u64 spte, int cur_level); 287 288 void *mmu_memory_cache_alloc(struct kvm_mmu_memory_cache *mc); 289 290 void account_huge_nx_page(struct kvm *kvm, struct kvm_mmu_page *sp); 291 void unaccount_huge_nx_page(struct kvm *kvm, struct kvm_mmu_page *sp); 292 293 #endif /* __KVM_X86_MMU_INTERNAL_H */ 294