mmu_internal.h

  1/* SPDX-License-Identifier: GPL-2.0 */
  2#ifndef __KVM_X86_MMU_INTERNAL_H
  3#define __KVM_X86_MMU_INTERNAL_H
  4
  5#include <linux/types.h>
  6#include <linux/kvm_host.h>
  7#include <asm/kvm_host.h>
  8
  9#include "mmu.h"
 10
 11#ifdef CONFIG_KVM_PROVE_MMU
 12#define KVM_MMU_WARN_ON(x) WARN_ON_ONCE(x)
 13#else
 14#define KVM_MMU_WARN_ON(x) BUILD_BUG_ON_INVALID(x)
 15#endif
 16
 17/* Page table builder macros common to shadow (host) PTEs and guest PTEs. */
 18#define __PT_BASE_ADDR_MASK GENMASK_ULL(51, 12)
 19#define __PT_LEVEL_SHIFT(level, bits_per_level)	\
 20	(PAGE_SHIFT + ((level) - 1) * (bits_per_level))
 21#define __PT_INDEX(address, level, bits_per_level) \
 22	(((address) >> __PT_LEVEL_SHIFT(level, bits_per_level)) & ((1 << (bits_per_level)) - 1))
 23
 24#define __PT_LVL_ADDR_MASK(base_addr_mask, level, bits_per_level) \
 25	((base_addr_mask) & ~((1ULL << (PAGE_SHIFT + (((level) - 1) * (bits_per_level)))) - 1))
 26
 27#define __PT_LVL_OFFSET_MASK(base_addr_mask, level, bits_per_level) \
 28	((base_addr_mask) & ((1ULL << (PAGE_SHIFT + (((level) - 1) * (bits_per_level)))) - 1))
 29
 30#define __PT_ENT_PER_PAGE(bits_per_level)  (1 << (bits_per_level))
 31
 32/*
 33 * Unlike regular MMU roots, PAE "roots", a.k.a. PDPTEs/PDPTRs, have a PRESENT
 34 * bit, and thus are guaranteed to be non-zero when valid.  And, when a guest
 35 * PDPTR is !PRESENT, its corresponding PAE root cannot be set to INVALID_PAGE,
 36 * as the CPU would treat that as PRESENT PDPTR with reserved bits set.  Use
 37 * '0' instead of INVALID_PAGE to indicate an invalid PAE root.
 38 */
 39#define INVALID_PAE_ROOT	0
 40#define IS_VALID_PAE_ROOT(x)	(!!(x))
 41
 42typedef u64 __rcu *tdp_ptep_t;
 43
 44struct kvm_mmu_page {
 45	/*
 46	 * Note, "link" through "spt" fit in a single 64 byte cache line on
 47	 * 64-bit kernels, keep it that way unless there's a reason not to.
 48	 */
 49	struct list_head link;
 50	struct hlist_node hash_link;
 51
 52	bool tdp_mmu_page;
 53	bool unsync;
 54	union {
 55		u8 mmu_valid_gen;
 56
 57		/* Only accessed under slots_lock.  */
 58		bool tdp_mmu_scheduled_root_to_zap;
 59	};
 60
 61	 /*
 62	  * The shadow page can't be replaced by an equivalent huge page
 63	  * because it is being used to map an executable page in the guest
 64	  * and the NX huge page mitigation is enabled.
 65	  */
 66	bool nx_huge_page_disallowed;
 67
 68	/*
 69	 * The following two entries are used to key the shadow page in the
 70	 * hash table.
 71	 */
 72	union kvm_mmu_page_role role;
 73	gfn_t gfn;
 74
 75	u64 *spt;
 76
 77	/*
 78	 * Stores the result of the guest translation being shadowed by each
 79	 * SPTE.  KVM shadows two types of guest translations: nGPA -> GPA
 80	 * (shadow EPT/NPT) and GVA -> GPA (traditional shadow paging). In both
 81	 * cases the result of the translation is a GPA and a set of access
 82	 * constraints.
 83	 *
 84	 * The GFN is stored in the upper bits (PAGE_SHIFT) and the shadowed
 85	 * access permissions are stored in the lower bits. Note, for
 86	 * convenience and uniformity across guests, the access permissions are
 87	 * stored in KVM format (e.g.  ACC_EXEC_MASK) not the raw guest format.
 88	 */
 89	u64 *shadowed_translation;
 90
 91	/* Currently serving as active root */
 92	union {
 93		int root_count;
 94		refcount_t tdp_mmu_root_count;
 95	};
 96
 97	bool has_mapped_host_mmio;
 98
 99	union {
100		/* These two members aren't used for TDP MMU */
101		struct {
102			unsigned int unsync_children;
103			/*
104			 * Number of writes since the last time traversal
105			 * visited this page.
106			 */
107			atomic_t write_flooding_count;
108		};
109		/*
110		 * Page table page of external PT.
111		 * Passed to TDX module, not accessed by KVM.
112		 */
113		void *external_spt;
114	};
115	union {
116		struct kvm_rmap_head parent_ptes; /* rmap pointers to parent sptes */
117		tdp_ptep_t ptep;
118	};
119	DECLARE_BITMAP(unsync_child_bitmap, 512);
120
121	/*
122	 * Tracks shadow pages that, if zapped, would allow KVM to create an NX
123	 * huge page.  A shadow page will have nx_huge_page_disallowed set but
124	 * not be on the list if a huge page is disallowed for other reasons,
125	 * e.g. because KVM is shadowing a PTE at the same gfn, the memslot
126	 * isn't properly aligned, etc...
127	 */
128	struct list_head possible_nx_huge_page_link;
129#ifdef CONFIG_X86_32
130	/*
131	 * Used out of the mmu-lock to avoid reading spte values while an
132	 * update is in progress; see the comments in __get_spte_lockless().
133	 */
134	int clear_spte_count;
135#endif
136
137#ifdef CONFIG_X86_64
138	/* Used for freeing the page asynchronously if it is a TDP MMU page. */
139	struct rcu_head rcu_head;
140#endif
141};
142
143extern struct kmem_cache *mmu_page_header_cache;
144
145static inline int kvm_mmu_role_as_id(union kvm_mmu_page_role role)
146{
147	return role.smm ? 1 : 0;
148}
149
150static inline int kvm_mmu_page_as_id(struct kvm_mmu_page *sp)
151{
152	return kvm_mmu_role_as_id(sp->role);
153}
154
155static inline bool is_mirror_sp(const struct kvm_mmu_page *sp)
156{
157	return sp->role.is_mirror;
158}
159
160static inline void kvm_mmu_alloc_external_spt(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp)
161{
162	/*
163	 * external_spt is allocated for TDX module to hold private EPT mappings,
164	 * TDX module will initialize the page by itself.
165	 * Therefore, KVM does not need to initialize or access external_spt.
166	 * KVM only interacts with sp->spt for private EPT operations.
167	 */
168	sp->external_spt = kvm_mmu_memory_cache_alloc(&vcpu->arch.mmu_external_spt_cache);
169}
170
171static inline gfn_t kvm_gfn_root_bits(const struct kvm *kvm, const struct kvm_mmu_page *root)
172{
173	/*
174	 * Since mirror SPs are used only for TDX, which maps private memory
175	 * at its "natural" GFN, no mask needs to be applied to them - and, dually,
176	 * we expect that the bits is only used for the shared PT.
177	 */
178	if (is_mirror_sp(root))
179		return 0;
180	return kvm_gfn_direct_bits(kvm);
181}
182
183static inline bool kvm_mmu_page_ad_need_write_protect(struct kvm *kvm,
184						      struct kvm_mmu_page *sp)
185{
186	/*
187	 * When using the EPT page-modification log, the GPAs in the CPU dirty
188	 * log would come from L2 rather than L1.  Therefore, we need to rely
189	 * on write protection to record dirty pages, which bypasses PML, since
190	 * writes now result in a vmexit.  Note, the check on CPU dirty logging
191	 * being enabled is mandatory as the bits used to denote WP-only SPTEs
192	 * are reserved for PAE paging (32-bit KVM).
193	 */
194	return kvm->arch.cpu_dirty_log_size && sp->role.guest_mode;
195}
196
197static inline gfn_t gfn_round_for_level(gfn_t gfn, int level)
198{
199	return gfn & -KVM_PAGES_PER_HPAGE(level);
200}
201
202int mmu_try_to_unsync_pages(struct kvm *kvm, const struct kvm_memory_slot *slot,
203			    gfn_t gfn, bool synchronizing, bool prefetch);
204
205void kvm_mmu_gfn_disallow_lpage(const struct kvm_memory_slot *slot, gfn_t gfn);
206void kvm_mmu_gfn_allow_lpage(const struct kvm_memory_slot *slot, gfn_t gfn);
207bool kvm_mmu_slot_gfn_write_protect(struct kvm *kvm,
208				    struct kvm_memory_slot *slot, u64 gfn,
209				    int min_level);
210
211/* Flush the given page (huge or not) of guest memory. */
212static inline void kvm_flush_remote_tlbs_gfn(struct kvm *kvm, gfn_t gfn, int level)
213{
214	kvm_flush_remote_tlbs_range(kvm, gfn_round_for_level(gfn, level),
215				    KVM_PAGES_PER_HPAGE(level));
216}
217
218unsigned int pte_list_count(struct kvm_rmap_head *rmap_head);
219
220extern int nx_huge_pages;
221static inline bool is_nx_huge_page_enabled(struct kvm *kvm)
222{
223	return READ_ONCE(nx_huge_pages) && !kvm->arch.disable_nx_huge_pages;
224}
225
226struct kvm_page_fault {
227	/* arguments to kvm_mmu_do_page_fault.  */
228	const gpa_t addr;
229	const u64 error_code;
230	const bool prefetch;
231
232	/* Derived from error_code.  */
233	const bool exec;
234	const bool write;
235	const bool present;
236	const bool rsvd;
237	const bool user;
238
239	/* Derived from mmu and global state.  */
240	const bool is_tdp;
241	const bool is_private;
242	const bool nx_huge_page_workaround_enabled;
243
244	/*
245	 * Whether a >4KB mapping can be created or is forbidden due to NX
246	 * hugepages.
247	 */
248	bool huge_page_disallowed;
249
250	/*
251	 * Maximum page size that can be created for this fault; input to
252	 * FNAME(fetch), direct_map() and kvm_tdp_mmu_map().
253	 */
254	u8 max_level;
255
256	/*
257	 * Page size that can be created based on the max_level and the
258	 * page size used by the host mapping.
259	 */
260	u8 req_level;
261
262	/*
263	 * Page size that will be created based on the req_level and
264	 * huge_page_disallowed.
265	 */
266	u8 goal_level;
267
268	/*
269	 * Shifted addr, or result of guest page table walk if addr is a gva. In
270	 * the case of VM where memslot's can be mapped at multiple GPA aliases
271	 * (i.e. TDX), the gfn field does not contain the bit that selects between
272	 * the aliases (i.e. the shared bit for TDX).
273	 */
274	gfn_t gfn;
275
276	/* The memslot containing gfn. May be NULL. */
277	struct kvm_memory_slot *slot;
278
279	/* Outputs of kvm_mmu_faultin_pfn().  */
280	unsigned long mmu_seq;
281	kvm_pfn_t pfn;
282	struct page *refcounted_page;
283	bool map_writable;
284
285	/*
286	 * Indicates the guest is trying to write a gfn that contains one or
287	 * more of the PTEs used to translate the write itself, i.e. the access
288	 * is changing its own translation in the guest page tables.
289	 */
290	bool write_fault_to_shadow_pgtable;
291};
292
293int kvm_tdp_page_fault(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault);
294
295/*
296 * Return values of handle_mmio_page_fault(), mmu.page_fault(), fast_page_fault(),
297 * and of course kvm_mmu_do_page_fault().
298 *
299 * RET_PF_CONTINUE: So far, so good, keep handling the page fault.
300 * RET_PF_RETRY: let CPU fault again on the address.
301 * RET_PF_EMULATE: mmio page fault, emulate the instruction directly.
302 * RET_PF_WRITE_PROTECTED: the gfn is write-protected, either unprotected the
303 *                         gfn and retry, or emulate the instruction directly.
304 * RET_PF_INVALID: the spte is invalid, let the real page fault path update it.
305 * RET_PF_FIXED: The faulting entry has been fixed.
306 * RET_PF_SPURIOUS: The faulting entry was already fixed, e.g. by another vCPU.
307 *
308 * Any names added to this enum should be exported to userspace for use in
309 * tracepoints via TRACE_DEFINE_ENUM() in mmutrace.h
310 *
311 * Note, all values must be greater than or equal to zero so as not to encroach
312 * on -errno return values.
313 */
314enum {
315	RET_PF_CONTINUE = 0,
316	RET_PF_RETRY,
317	RET_PF_EMULATE,
318	RET_PF_WRITE_PROTECTED,
319	RET_PF_INVALID,
320	RET_PF_FIXED,
321	RET_PF_SPURIOUS,
322};
323
324/*
325 * Define RET_PF_CONTINUE as 0 to allow for
326 * - efficient machine code when checking for CONTINUE, e.g.
327 *   "TEST %rax, %rax, JNZ", as all "stop!" values are non-zero,
328 * - kvm_mmu_do_page_fault() to return other RET_PF_* as a positive value.
329 */
330static_assert(RET_PF_CONTINUE == 0);
331
332static inline void kvm_mmu_prepare_memory_fault_exit(struct kvm_vcpu *vcpu,
333						     struct kvm_page_fault *fault)
334{
335	kvm_prepare_memory_fault_exit(vcpu, fault->gfn << PAGE_SHIFT,
336				      PAGE_SIZE, fault->write, fault->exec,
337				      fault->is_private);
338}
339
340static inline int kvm_mmu_do_page_fault(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa,
341					u64 err, bool prefetch,
342					int *emulation_type, u8 *level)
343{
344	struct kvm_page_fault fault = {
345		.addr = cr2_or_gpa,
346		.error_code = err,
347		.exec = err & PFERR_FETCH_MASK,
348		.write = err & PFERR_WRITE_MASK,
349		.present = err & PFERR_PRESENT_MASK,
350		.rsvd = err & PFERR_RSVD_MASK,
351		.user = err & PFERR_USER_MASK,
352		.prefetch = prefetch,
353		.is_tdp = likely(vcpu->arch.mmu->page_fault == kvm_tdp_page_fault),
354		.nx_huge_page_workaround_enabled =
355			is_nx_huge_page_enabled(vcpu->kvm),
356
357		.max_level = KVM_MAX_HUGEPAGE_LEVEL,
358		.req_level = PG_LEVEL_4K,
359		.goal_level = PG_LEVEL_4K,
360		.is_private = err & PFERR_PRIVATE_ACCESS,
361
362		.pfn = KVM_PFN_ERR_FAULT,
363	};
364	int r;
365
366	if (vcpu->arch.mmu->root_role.direct) {
367		/*
368		 * Things like memslots don't understand the concept of a shared
369		 * bit. Strip it so that the GFN can be used like normal, and the
370		 * fault.addr can be used when the shared bit is needed.
371		 */
372		fault.gfn = gpa_to_gfn(fault.addr) & ~kvm_gfn_direct_bits(vcpu->kvm);
373		fault.slot = kvm_vcpu_gfn_to_memslot(vcpu, fault.gfn);
374	}
375
376	/*
377	 * With retpoline being active an indirect call is rather expensive,
378	 * so do a direct call in the most common case.
379	 */
380	if (IS_ENABLED(CONFIG_MITIGATION_RETPOLINE) && fault.is_tdp)
381		r = kvm_tdp_page_fault(vcpu, &fault);
382	else
383		r = vcpu->arch.mmu->page_fault(vcpu, &fault);
384
385	/*
386	 * Not sure what's happening, but punt to userspace and hope that
387	 * they can fix it by changing memory to shared, or they can
388	 * provide a better error.
389	 */
390	if (r == RET_PF_EMULATE && fault.is_private) {
391		pr_warn_ratelimited("kvm: unexpected emulation request on private memory\n");
392		kvm_mmu_prepare_memory_fault_exit(vcpu, &fault);
393		return -EFAULT;
394	}
395
396	if (fault.write_fault_to_shadow_pgtable && emulation_type)
397		*emulation_type |= EMULTYPE_WRITE_PF_TO_SP;
398	if (level)
399		*level = fault.goal_level;
400
401	return r;
402}
403
404int kvm_mmu_max_mapping_level(struct kvm *kvm, struct kvm_page_fault *fault,
405			      const struct kvm_memory_slot *slot, gfn_t gfn);
406void kvm_mmu_hugepage_adjust(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault);
407void disallowed_hugepage_adjust(struct kvm_page_fault *fault, u64 spte, int cur_level);
408
409void track_possible_nx_huge_page(struct kvm *kvm, struct kvm_mmu_page *sp,
410				 enum kvm_mmu_type mmu_type);
411void untrack_possible_nx_huge_page(struct kvm *kvm, struct kvm_mmu_page *sp,
412				   enum kvm_mmu_type mmu_type);
413
414#endif /* __KVM_X86_MMU_INTERNAL_H */