1 /* SPDX-License-Identifier: GPL-2.0 */
2 #ifndef __KVM_X86_MMU_INTERNAL_H
3 #define __KVM_X86_MMU_INTERNAL_H
4 
5 #include <linux/types.h>
6 #include <linux/kvm_host.h>
7 #include <asm/kvm_host.h>
8 
9 #undef MMU_DEBUG
10 
11 #ifdef MMU_DEBUG
12 extern bool dbg;
13 
14 #define pgprintk(x...) do { if (dbg) printk(x); } while (0)
15 #define rmap_printk(fmt, args...) do { if (dbg) printk("%s: " fmt, __func__, ## args); } while (0)
16 #define MMU_WARN_ON(x) WARN_ON(x)
17 #else
18 #define pgprintk(x...) do { } while (0)
19 #define rmap_printk(x...) do { } while (0)
20 #define MMU_WARN_ON(x) do { } while (0)
21 #endif
22 
23 /* Page table builder macros common to shadow (host) PTEs and guest PTEs. */
24 #define __PT_LEVEL_SHIFT(level, bits_per_level)	\
25 	(PAGE_SHIFT + ((level) - 1) * (bits_per_level))
26 #define __PT_INDEX(address, level, bits_per_level) \
27 	(((address) >> __PT_LEVEL_SHIFT(level, bits_per_level)) & ((1 << (bits_per_level)) - 1))
28 
29 #define __PT_LVL_ADDR_MASK(base_addr_mask, level, bits_per_level) \
30 	((base_addr_mask) & ~((1ULL << (PAGE_SHIFT + (((level) - 1) * (bits_per_level)))) - 1))
31 
32 #define __PT_LVL_OFFSET_MASK(base_addr_mask, level, bits_per_level) \
33 	((base_addr_mask) & ((1ULL << (PAGE_SHIFT + (((level) - 1) * (bits_per_level)))) - 1))
34 
35 #define __PT_ENT_PER_PAGE(bits_per_level)  (1 << (bits_per_level))
36 
37 /*
38  * Unlike regular MMU roots, PAE "roots", a.k.a. PDPTEs/PDPTRs, have a PRESENT
39  * bit, and thus are guaranteed to be non-zero when valid.  And, when a guest
40  * PDPTR is !PRESENT, its corresponding PAE root cannot be set to INVALID_PAGE,
41  * as the CPU would treat that as PRESENT PDPTR with reserved bits set.  Use
42  * '0' instead of INVALID_PAGE to indicate an invalid PAE root.
43  */
44 #define INVALID_PAE_ROOT	0
45 #define IS_VALID_PAE_ROOT(x)	(!!(x))
46 
47 typedef u64 __rcu *tdp_ptep_t;
48 
49 struct kvm_mmu_page {
50 	/*
51 	 * Note, "link" through "spt" fit in a single 64 byte cache line on
52 	 * 64-bit kernels, keep it that way unless there's a reason not to.
53 	 */
54 	struct list_head link;
55 	struct hlist_node hash_link;
56 
57 	bool tdp_mmu_page;
58 	bool unsync;
59 	u8 mmu_valid_gen;
60 	bool lpage_disallowed; /* Can't be replaced by an equiv large page */
61 
62 	/*
63 	 * The following two entries are used to key the shadow page in the
64 	 * hash table.
65 	 */
66 	union kvm_mmu_page_role role;
67 	gfn_t gfn;
68 
69 	u64 *spt;
70 
71 	/*
72 	 * Stores the result of the guest translation being shadowed by each
73 	 * SPTE.  KVM shadows two types of guest translations: nGPA -> GPA
74 	 * (shadow EPT/NPT) and GVA -> GPA (traditional shadow paging). In both
75 	 * cases the result of the translation is a GPA and a set of access
76 	 * constraints.
77 	 *
78 	 * The GFN is stored in the upper bits (PAGE_SHIFT) and the shadowed
79 	 * access permissions are stored in the lower bits. Note, for
80 	 * convenience and uniformity across guests, the access permissions are
81 	 * stored in KVM format (e.g.  ACC_EXEC_MASK) not the raw guest format.
82 	 */
83 	u64 *shadowed_translation;
84 
85 	/* Currently serving as active root */
86 	union {
87 		int root_count;
88 		refcount_t tdp_mmu_root_count;
89 	};
90 	unsigned int unsync_children;
91 	union {
92 		struct kvm_rmap_head parent_ptes; /* rmap pointers to parent sptes */
93 		tdp_ptep_t ptep;
94 	};
95 	union {
96 		DECLARE_BITMAP(unsync_child_bitmap, 512);
97 		struct {
98 			struct work_struct tdp_mmu_async_work;
99 			void *tdp_mmu_async_data;
100 		};
101 	};
102 
103 	struct list_head lpage_disallowed_link;
104 #ifdef CONFIG_X86_32
105 	/*
106 	 * Used out of the mmu-lock to avoid reading spte values while an
107 	 * update is in progress; see the comments in __get_spte_lockless().
108 	 */
109 	int clear_spte_count;
110 #endif
111 
112 	/* Number of writes since the last time traversal visited this page.  */
113 	atomic_t write_flooding_count;
114 
115 #ifdef CONFIG_X86_64
116 	/* Used for freeing the page asynchronously if it is a TDP MMU page. */
117 	struct rcu_head rcu_head;
118 #endif
119 };
120 
121 extern struct kmem_cache *mmu_page_header_cache;
122 
to_shadow_page(hpa_t shadow_page)123 static inline struct kvm_mmu_page *to_shadow_page(hpa_t shadow_page)
124 {
125 	struct page *page = pfn_to_page(shadow_page >> PAGE_SHIFT);
126 
127 	return (struct kvm_mmu_page *)page_private(page);
128 }
129 
sptep_to_sp(u64 * sptep)130 static inline struct kvm_mmu_page *sptep_to_sp(u64 *sptep)
131 {
132 	return to_shadow_page(__pa(sptep));
133 }
134 
kvm_mmu_role_as_id(union kvm_mmu_page_role role)135 static inline int kvm_mmu_role_as_id(union kvm_mmu_page_role role)
136 {
137 	return role.smm ? 1 : 0;
138 }
139 
kvm_mmu_page_as_id(struct kvm_mmu_page * sp)140 static inline int kvm_mmu_page_as_id(struct kvm_mmu_page *sp)
141 {
142 	return kvm_mmu_role_as_id(sp->role);
143 }
144 
kvm_mmu_page_ad_need_write_protect(struct kvm_mmu_page * sp)145 static inline bool kvm_mmu_page_ad_need_write_protect(struct kvm_mmu_page *sp)
146 {
147 	/*
148 	 * When using the EPT page-modification log, the GPAs in the CPU dirty
149 	 * log would come from L2 rather than L1.  Therefore, we need to rely
150 	 * on write protection to record dirty pages, which bypasses PML, since
151 	 * writes now result in a vmexit.  Note, the check on CPU dirty logging
152 	 * being enabled is mandatory as the bits used to denote WP-only SPTEs
153 	 * are reserved for PAE paging (32-bit KVM).
154 	 */
155 	return kvm_x86_ops.cpu_dirty_log_size && sp->role.guest_mode;
156 }
157 
158 int mmu_try_to_unsync_pages(struct kvm *kvm, const struct kvm_memory_slot *slot,
159 			    gfn_t gfn, bool can_unsync, bool prefetch);
160 
161 void kvm_mmu_gfn_disallow_lpage(const struct kvm_memory_slot *slot, gfn_t gfn);
162 void kvm_mmu_gfn_allow_lpage(const struct kvm_memory_slot *slot, gfn_t gfn);
163 bool kvm_mmu_slot_gfn_write_protect(struct kvm *kvm,
164 				    struct kvm_memory_slot *slot, u64 gfn,
165 				    int min_level);
166 void kvm_flush_remote_tlbs_with_address(struct kvm *kvm,
167 					u64 start_gfn, u64 pages);
168 unsigned int pte_list_count(struct kvm_rmap_head *rmap_head);
169 
170 extern int nx_huge_pages;
is_nx_huge_page_enabled(struct kvm * kvm)171 static inline bool is_nx_huge_page_enabled(struct kvm *kvm)
172 {
173 	return READ_ONCE(nx_huge_pages) && !kvm->arch.disable_nx_huge_pages;
174 }
175 
176 struct kvm_page_fault {
177 	/* arguments to kvm_mmu_do_page_fault.  */
178 	const gpa_t addr;
179 	const u32 error_code;
180 	const bool prefetch;
181 
182 	/* Derived from error_code.  */
183 	const bool exec;
184 	const bool write;
185 	const bool present;
186 	const bool rsvd;
187 	const bool user;
188 
189 	/* Derived from mmu and global state.  */
190 	const bool is_tdp;
191 	const bool nx_huge_page_workaround_enabled;
192 
193 	/*
194 	 * Whether a >4KB mapping can be created or is forbidden due to NX
195 	 * hugepages.
196 	 */
197 	bool huge_page_disallowed;
198 
199 	/*
200 	 * Maximum page size that can be created for this fault; input to
201 	 * FNAME(fetch), __direct_map and kvm_tdp_mmu_map.
202 	 */
203 	u8 max_level;
204 
205 	/*
206 	 * Page size that can be created based on the max_level and the
207 	 * page size used by the host mapping.
208 	 */
209 	u8 req_level;
210 
211 	/*
212 	 * Page size that will be created based on the req_level and
213 	 * huge_page_disallowed.
214 	 */
215 	u8 goal_level;
216 
217 	/* Shifted addr, or result of guest page table walk if addr is a gva.  */
218 	gfn_t gfn;
219 
220 	/* The memslot containing gfn. May be NULL. */
221 	struct kvm_memory_slot *slot;
222 
223 	/* Outputs of kvm_faultin_pfn.  */
224 	kvm_pfn_t pfn;
225 	hva_t hva;
226 	bool map_writable;
227 };
228 
229 int kvm_tdp_page_fault(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault);
230 
231 /*
232  * Return values of handle_mmio_page_fault(), mmu.page_fault(), fast_page_fault(),
233  * and of course kvm_mmu_do_page_fault().
234  *
235  * RET_PF_CONTINUE: So far, so good, keep handling the page fault.
236  * RET_PF_RETRY: let CPU fault again on the address.
237  * RET_PF_EMULATE: mmio page fault, emulate the instruction directly.
238  * RET_PF_INVALID: the spte is invalid, let the real page fault path update it.
239  * RET_PF_FIXED: The faulting entry has been fixed.
240  * RET_PF_SPURIOUS: The faulting entry was already fixed, e.g. by another vCPU.
241  *
242  * Any names added to this enum should be exported to userspace for use in
243  * tracepoints via TRACE_DEFINE_ENUM() in mmutrace.h
244  *
245  * Note, all values must be greater than or equal to zero so as not to encroach
246  * on -errno return values.  Somewhat arbitrarily use '0' for CONTINUE, which
247  * will allow for efficient machine code when checking for CONTINUE, e.g.
248  * "TEST %rax, %rax, JNZ", as all "stop!" values are non-zero.
249  */
250 enum {
251 	RET_PF_CONTINUE = 0,
252 	RET_PF_RETRY,
253 	RET_PF_EMULATE,
254 	RET_PF_INVALID,
255 	RET_PF_FIXED,
256 	RET_PF_SPURIOUS,
257 };
258 
kvm_mmu_do_page_fault(struct kvm_vcpu * vcpu,gpa_t cr2_or_gpa,u32 err,bool prefetch)259 static inline int kvm_mmu_do_page_fault(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa,
260 					u32 err, bool prefetch)
261 {
262 	struct kvm_page_fault fault = {
263 		.addr = cr2_or_gpa,
264 		.error_code = err,
265 		.exec = err & PFERR_FETCH_MASK,
266 		.write = err & PFERR_WRITE_MASK,
267 		.present = err & PFERR_PRESENT_MASK,
268 		.rsvd = err & PFERR_RSVD_MASK,
269 		.user = err & PFERR_USER_MASK,
270 		.prefetch = prefetch,
271 		.is_tdp = likely(vcpu->arch.mmu->page_fault == kvm_tdp_page_fault),
272 		.nx_huge_page_workaround_enabled =
273 			is_nx_huge_page_enabled(vcpu->kvm),
274 
275 		.max_level = KVM_MAX_HUGEPAGE_LEVEL,
276 		.req_level = PG_LEVEL_4K,
277 		.goal_level = PG_LEVEL_4K,
278 	};
279 	int r;
280 
281 	/*
282 	 * Async #PF "faults", a.k.a. prefetch faults, are not faults from the
283 	 * guest perspective and have already been counted at the time of the
284 	 * original fault.
285 	 */
286 	if (!prefetch)
287 		vcpu->stat.pf_taken++;
288 
289 	if (IS_ENABLED(CONFIG_RETPOLINE) && fault.is_tdp)
290 		r = kvm_tdp_page_fault(vcpu, &fault);
291 	else
292 		r = vcpu->arch.mmu->page_fault(vcpu, &fault);
293 
294 	/*
295 	 * Similar to above, prefetch faults aren't truly spurious, and the
296 	 * async #PF path doesn't do emulation.  Do count faults that are fixed
297 	 * by the async #PF handler though, otherwise they'll never be counted.
298 	 */
299 	if (r == RET_PF_FIXED)
300 		vcpu->stat.pf_fixed++;
301 	else if (prefetch)
302 		;
303 	else if (r == RET_PF_EMULATE)
304 		vcpu->stat.pf_emulate++;
305 	else if (r == RET_PF_SPURIOUS)
306 		vcpu->stat.pf_spurious++;
307 	return r;
308 }
309 
310 int kvm_mmu_max_mapping_level(struct kvm *kvm,
311 			      const struct kvm_memory_slot *slot, gfn_t gfn,
312 			      int max_level);
313 void kvm_mmu_hugepage_adjust(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault);
314 void disallowed_hugepage_adjust(struct kvm_page_fault *fault, u64 spte, int cur_level);
315 
316 void *mmu_memory_cache_alloc(struct kvm_mmu_memory_cache *mc);
317 
318 void account_huge_nx_page(struct kvm *kvm, struct kvm_mmu_page *sp);
319 void unaccount_huge_nx_page(struct kvm *kvm, struct kvm_mmu_page *sp);
320 
321 #endif /* __KVM_X86_MMU_INTERNAL_H */
322