// SPDX-License-Identifier: GPL-2.0-only /* * Kernel - based Virtual Machine driver for Linux * * This module enables machines with Intel VT - x extensions to run virtual * machines without emulation or binary translation . * * MMU support * * Copyright ( C ) 2006 Qumranet , Inc . * Copyright 2010 Red Hat , Inc . and / or its affiliates . * * Authors : * Yaniv Kamay < yaniv @ qumranet . com > * Avi Kivity < avi @ qumranet . com > #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt#include "irq.h" #include "ioapic.h" #include "mmu.h" #include "mmu_internal.h" #include "tdp_mmu.h" #include "x86.h" #include "kvm_cache_regs.h" #include "smm.h" #include "kvm_emulate.h" #include "page_track.h" #include "cpuid.h" #include "spte.h" #include <linux/kvm_host.h>#include <linux/types.h>#include <linux/string.h>#include <linux/mm.h>#include <linux/highmem.h>#include <linux/moduleparam.h>#include <linux/export.h>#include <linux/swap.h>#include <linux/hugetlb.h>#include <linux/compiler.h>#include <linux/srcu.h>#include <linux/slab.h>#include <linux/sched/signal.h>#include <linux/uaccess.h>#include <linux/hash.h>#include <linux/kern_levels.h>#include <linux/kstrtox.h>#include <linux/kthread.h>#include <linux/wordpart.h>#include <asm /page.h>#include <asm /memtype.h>#include <asm /cmpxchg.h>#include <asm /io.h>#include <asm /set_memory.h>#include <asm /spec-ctrl.h>#include <asm /vmx.h>#include "trace.h" static bool nx_hugepage_mitigation_hard_disabled;int __read_mostly nx_huge_pages = -1 ;static uint __read_mostly nx_huge_pages_recovery_period_ms;#ifdef CONFIG_PREEMPT_RT/* Recovery can cause latency spikes, disable it for PREEMPT_RT. */ static uint __read_mostly nx_huge_pages_recovery_ratio = 0 ;#else static uint __read_mostly nx_huge_pages_recovery_ratio = 60 ;#endif static int get_nx_huge_pages(char *buffer, const struct kernel_param *kp);static int set_nx_huge_pages(const char *val, const struct kernel_param *kp);static int set_nx_huge_pages_recovery_param(const char *val, const struct kernel_param *kp);static const struct kernel_param_ops nx_huge_pages_ops = {static const struct kernel_param_ops nx_huge_pages_recovery_param_ops = {0644 );"bool" );0644 );"uint" );0644 );"uint" );static bool __read_mostly force_flush_and_sync_on_reuse;bool , 0644 );/* * When setting this variable to true it enables Two - Dimensional - Paging * where the hardware walks 2 page tables : * 1 . the guest - virtual to guest - physical * 2 . while doing 1 . it walks guest - physical to host - physical * If the hardware supports that we don ' t need to do shadow paging . bool tdp_enabled = false ;static bool __ro_after_init tdp_mmu_allowed;#ifdef CONFIG_X86_64bool __read_mostly tdp_mmu_enabled = true ;bool , 0444 );#endif static int max_huge_page_level __read_mostly;static int tdp_root_level __read_mostly;static int max_tdp_level __read_mostly;#define PTE_PREFETCH_NUM 8 #include <trace/events/kvm.h>/* make pte_list_desc fit well in cache lines */ #define PTE_LIST_EXT 14 /* * struct pte_list_desc is the core data structure used to implement a custom * list for tracking a set of related SPTEs , e . g . all the SPTEs that map a * given GFN when used in the context of rmaps . Using a custom list allows KVM * to optimize for the common case where many GFNs will have at most a handful * of SPTEs pointing at them , i . e . allows packing multiple SPTEs into a small * memory footprint , which in turn improves runtime performance by exploiting * cache locality . * * A list is comprised of one or more pte_list_desc objects ( descriptors ) . * Each individual descriptor stores up to PTE_LIST_EXT SPTEs . If a descriptor * is full and a new SPTEs needs to be added , a new descriptor is allocated and * becomes the head of the list . This means that by definitions , all tail * descriptors are full . * * Note , the meta data fields are deliberately placed at the start of the * structure to optimize the cacheline layout ; accessing the descriptor will * touch only a single cacheline so long as @ spte_count < = 6 ( or if only the * descriptors metadata is accessed ) . struct pte_list_desc {struct pte_list_desc *more;/* The number of PTEs stored in _this_ descriptor. */ /* The number of PTEs stored in all tails of this descriptor. */ struct kvm_shadow_walk_iterator {int level;unsigned index;#define for_each_shadow_entry_using_root(_vcpu, _root, _addr, _walker) \for (shadow_walk_init_using_root(&(_walker), (_vcpu), \#define for_each_shadow_entry(_vcpu, _addr, _walker) \for (shadow_walk_init(&(_walker), _vcpu, _addr); \#define for_each_shadow_entry_lockless(_vcpu, _addr, _walker, spte) \for (shadow_walk_init(&(_walker), _vcpu, _addr); \1 ; }); \static struct kmem_cache *pte_list_desc_cache;struct kmem_cache *mmu_page_header_cache;static void mmu_spte_set(u64 *sptep, u64 spte);struct kvm_mmu_role_regs {const unsigned long cr0;const unsigned long cr4;const u64 efer;#define CREATE_TRACE_POINTS#include "mmutrace.h" /* * Yes , lot ' s of underscores . They ' re a hint that you probably shouldn ' t be * reading from the role_regs . Once the root_role is constructed , it becomes * the single source of truth for the MMU ' s state . #define BUILD_MMU_ROLE_REGS_ACCESSOR(reg, name, flag) \static inline bool __maybe_unused \## reg## _## name(const struct kvm_mmu_role_regs *regs) \return !!(regs->reg & flag); \/* * The MMU itself ( with a valid role ) is the single source of truth for the * MMU . Do not use the regs used to build the MMU / role , nor the vCPU . The * regs don ' t account for dependencies , e . g . clearing CR4 bits if CR0 . PG = 1 , * and the vCPU may be incorrect / irrelevant . #define BUILD_MMU_ROLE_ACCESSOR(base_or_ext, reg, name) \static inline bool __maybe_unused is_## reg## _## name(struct kvm_mmu *mmu) \return !!(mmu->cpu_role. base_or_ext . reg## _## name); \static inline bool is_cr0_pg(struct kvm_mmu *mmu)return mmu->cpu_role.base.level > 0 ;static inline bool is_cr4_pae(struct kvm_mmu *mmu)return !mmu->cpu_role.base.has_4_byte_gpte;static struct kvm_mmu_role_regs vcpu_to_role_regs(struct kvm_vcpu *vcpu)struct kvm_mmu_role_regs regs = {return regs;static unsigned long get_guest_cr3(struct kvm_vcpu *vcpu)return kvm_read_cr3(vcpu);static inline unsigned long kvm_mmu_get_guest_pgd(struct kvm_vcpu *vcpu,struct kvm_mmu *mmu)if (IS_ENABLED(CONFIG_MITIGATION_RETPOLINE) && mmu->get_guest_pgd == get_guest_cr3)return kvm_read_cr3(vcpu);return mmu->get_guest_pgd(vcpu);static inline bool kvm_available_flush_remote_tlbs_range(void )#if IS_ENABLED(CONFIG_HYPERV)return kvm_x86_ops.flush_remote_tlbs_range;#else return false ;#endif static gfn_t kvm_mmu_page_get_gfn(struct kvm_mmu_page *sp, int index);/* Flush the range of guest memory mapped by the given SPTE. */ static void kvm_flush_remote_tlbs_sptep(struct kvm *kvm, u64 *sptep)struct kvm_mmu_page *sp = sptep_to_sp(sptep);static void mark_mmio_spte(struct kvm_vcpu *vcpu, u64 *sptep, u64 gfn,unsigned int access)static gfn_t get_mmio_spte_gfn(u64 spte)return gpa >> PAGE_SHIFT;static unsigned get_mmio_spte_access(u64 spte)return spte & shadow_mmio_access_mask;static bool check_mmio_spte(struct kvm_vcpu *vcpu, u64 spte)if (unlikely(gen & KVM_MEMSLOT_GEN_UPDATE_IN_PROGRESS))return false ;return likely(kvm_gen == spte_gen);static int is_cpuid_PSE36(void )return 1 ;#ifdef CONFIG_X86_64static void __set_spte(u64 *sptep, u64 spte)static void __update_clear_spte_fast(u64 *sptep, u64 spte)static u64 __update_clear_spte_slow(u64 *sptep, u64 spte)return xchg(sptep, spte);static u64 __get_spte_lockless(u64 *sptep)return READ_ONCE(*sptep);#else union split_spte {struct {static void count_spte_clear(u64 *sptep, u64 spte)struct kvm_mmu_page *sp = sptep_to_sp(sptep);if (is_shadow_present_pte(spte))return ;/* Ensure the spte is completely set before we increase the count */ static void __set_spte(u64 *sptep, u64 spte)union split_spte *ssptep, sspte;union split_spte *)sptep;union split_spte)spte;/* * If we map the spte from nonpresent to present , We should store * the high bits firstly , then set present bit , so cpu can not * fetch this spte while we are setting the spte . static void __update_clear_spte_fast(u64 *sptep, u64 spte)union split_spte *ssptep, sspte;union split_spte *)sptep;union split_spte)spte;/* * If we map the spte from present to nonpresent , we should clear * present bit firstly to avoid vcpu fetch the old high bits . static u64 __update_clear_spte_slow(u64 *sptep, u64 spte)union split_spte *ssptep, sspte, orig;union split_spte *)sptep;union split_spte)spte;/* xchg acts as a barrier before the setting of the high bits */ return orig.spte;/* * The idea using the light way get the spte on x86_32 guest is from * gup_get_pte ( mm / gup . c ) . * * An spte tlb flush may be pending , because they are coalesced and * we are running out of the MMU lock . Therefore * we need to protect against in - progress updates of the spte . * * Reading the spte while an update is in progress may get the old value * for the high part of the spte . The race is fine for a present - > non - present * change ( because the high part of the spte is ignored for non - present spte ) , * but for a present - > present change we must reread the spte . * * All such changes are done in two steps ( present - > non - present and * non - present - > present ) , hence it is enough to count the number of * present - > non - present updates : if it changed while reading the spte , * we might have hit the race . This is done using clear_spte_count . static u64 __get_spte_lockless(u64 *sptep)struct kvm_mmu_page *sp = sptep_to_sp(sptep);union split_spte spte, *orig = (union split_spte *)sptep;int count;if (unlikely(spte.spte_low != orig->spte_low ||goto retry;return spte.spte;#endif /* Rules for using mmu_spte_set: * Set the sptep from nonpresent to present . * Note : the sptep being assigned * must * be either not present * or in a state where the hardware will not attempt to update * the spte . static void mmu_spte_set(u64 *sptep, u64 new_spte)/* Rules for using mmu_spte_update: * Update the state bits , it means the mapped pfn is not changed . * * Returns true if the TLB needs to be flushed static bool mmu_spte_update(u64 *sptep, u64 new_spte)if (!is_shadow_present_pte(old_spte)) {return false ;if (!spte_needs_atomic_update(old_spte))else return leaf_spte_change_needs_tlb_flush(old_spte, new_spte);/* * Rules for using mmu_spte_clear_track_bits : * It sets the sptep from present to nonpresent , and track the * state bits , it is used to clear the last level sptep . * Returns the old PTE . static u64 mmu_spte_clear_track_bits(struct kvm *kvm, u64 *sptep)int level = sptep_to_sp(sptep)->role.level;if (!is_shadow_present_pte(old_spte) ||else if (!is_shadow_present_pte(old_spte))return old_spte;1 );return old_spte;/* * Rules for using mmu_spte_clear_no_track : * Directly clear spte without caring the state bits of sptep , * it is used to set the upper level spte . static void mmu_spte_clear_no_track(u64 *sptep)static u64 mmu_spte_get_lockless(u64 *sptep)return __get_spte_lockless(sptep);static inline bool is_tdp_mmu_active(struct kvm_vcpu *vcpu)return tdp_mmu_enabled && vcpu->arch.mmu->root_role.direct;static void walk_shadow_page_lockless_begin(struct kvm_vcpu *vcpu)if (is_tdp_mmu_active(vcpu)) {else {/* * Prevent page table teardown by making any free - er wait during * kvm_flush_remote_tlbs ( ) IPI to all active vcpus . /* * Make sure a following spte read is not reordered ahead of the write * to vcpu - > mode . static void walk_shadow_page_lockless_end(struct kvm_vcpu *vcpu)if (is_tdp_mmu_active(vcpu)) {else {/* * Make sure the write to vcpu - > mode is not reordered in front of * reads to sptes . If it does , kvm_mmu_commit_zap_page ( ) can see us * OUTSIDE_GUEST_MODE and proceed to free the shadow page table . static int mmu_topup_memory_caches(struct kvm_vcpu *vcpu, bool maybe_indirect)int r;/* 1 rmap, 1 parent PTE per level, and the prefetched rmaps. */ 1 + PT64_ROOT_MAX_LEVEL + PTE_PREFETCH_NUM);if (r)return r;if (kvm_has_mirrored_tdp(vcpu->kvm)) {if (r)return r;if (r)return r;if (maybe_indirect) {if (r)return r;return kvm_mmu_topup_memory_cache(&vcpu->arch.mmu_page_header_cache,static void mmu_free_memory_caches(struct kvm_vcpu *vcpu)static void mmu_free_pte_list_desc(struct pte_list_desc *pte_list_desc)static bool sp_has_gptes(struct kvm_mmu_page *sp);static gfn_t kvm_mmu_page_get_gfn(struct kvm_mmu_page *sp, int index)if (sp->role.passthrough)return sp->gfn;if (sp->shadowed_translation)return sp->shadowed_translation[index] >> PAGE_SHIFT;return sp->gfn + (index << ((sp->role.level - 1 ) * SPTE_LEVEL_BITS));/* * For leaf SPTEs , fetch the * guest * access permissions being shadowed . Note * that the SPTE itself may have a more constrained access permissions that * what the guest enforces . For example , a guest may create an executable * huge PTE but KVM may disallow execution to mitigate iTLB multihit . static u32 kvm_mmu_page_get_access(struct kvm_mmu_page *sp, int index)if (sp->shadowed_translation)return sp->shadowed_translation[index] & ACC_ALL;/* * For direct MMUs ( e . g . TDP or non - paging guests ) or passthrough SPs , * KVM is not shadowing any guest page tables , so the " guest access * permissions " are just ACC_ALL . * * For direct SPs in indirect MMUs ( shadow paging ) , i . e . when KVM * is shadowing a guest huge page with small pages , the guest access * permissions being shadowed are the access permissions of the huge * page . * * In both cases , sp - > role . access contains the correct access bits . return sp->role.access;static void kvm_mmu_page_set_translation(struct kvm_mmu_page *sp, int index,unsigned int access)if (sp->shadowed_translation) {return ;"access mismatch under %s page %llx (expected %u, got %u)\n" ,"passthrough" : "direct" ,"gfn mismatch under %s page %llx (expected %llx, got %llx)\n" ,"passthrough" : "direct" ,static void kvm_mmu_page_set_access(struct kvm_mmu_page *sp, int index,unsigned int access)/* * Return the pointer to the large page information for a given gfn , * handling slots that are not large page aligned . static struct kvm_lpage_info *lpage_info_slot(gfn_t gfn,const struct kvm_memory_slot *slot, int level)unsigned long idx;return &slot->arch.lpage_info[level - 2 ][idx];/* * The most significant bit in disallow_lpage tracks whether or not memory * attributes are mixed , i . e . not identical for all gfns at the current level . * The lower order bits are used to refcount other cases where a hugepage is * disallowed , e . g . if KVM has shadow a page table at the gfn . #define KVM_LPAGE_MIXED_FLAG BIT(31 )static void update_gfn_disallow_lpage_count(const struct kvm_memory_slot *slot,int count)struct kvm_lpage_info *linfo;int old, i;for (i = PG_LEVEL_2M; i <= KVM_MAX_HUGEPAGE_LEVEL; ++i) {void kvm_mmu_gfn_disallow_lpage(const struct kvm_memory_slot *slot, gfn_t gfn)1 );void kvm_mmu_gfn_allow_lpage(const struct kvm_memory_slot *slot, gfn_t gfn)1 );static void account_shadowed(struct kvm *kvm, struct kvm_mmu_page *sp)struct kvm_memslots *slots;struct kvm_memory_slot *slot;/* * Ensure indirect_shadow_pages is elevated prior to re - reading guest * child PTEs in FNAME ( gpte_changed ) , i . e . guarantee either in - flight * emulated writes are visible before re - reading guest PTEs , or that * an emulated write will see the elevated count and acquire mmu_lock * to update SPTEs . Pairs with the smp_mb ( ) in kvm_mmu_track_write ( ) . /* the non-leaf shadow pages are keeping readonly. */ if (sp->role.level > PG_LEVEL_4K)return __kvm_write_track_add_gfn(kvm, slot, gfn);if (kvm_mmu_slot_gfn_write_protect(kvm, slot, gfn, PG_LEVEL_4K))void track_possible_nx_huge_page(struct kvm *kvm, struct kvm_mmu_page *sp)/* * If it ' s possible to replace the shadow page with an NX huge page , * i . e . if the shadow page is the only thing currently preventing KVM * from using a huge page , add the shadow page to the list of " to be * zapped for NX recovery " pages . Note , the shadow page can already be * on the list if KVM is reusing an existing shadow page , i . e . if KVM * links a shadow page at multiple points . if (!list_empty(&sp->possible_nx_huge_page_link))return ;static void account_nx_huge_page(struct kvm *kvm, struct kvm_mmu_page *sp,bool nx_huge_page_possible)true ;if (nx_huge_page_possible)static void unaccount_shadowed(struct kvm *kvm, struct kvm_mmu_page *sp)struct kvm_memslots *slots;struct kvm_memory_slot *slot;if (sp->role.level > PG_LEVEL_4K)return __kvm_write_track_remove_gfn(kvm, slot, gfn);void untrack_possible_nx_huge_page(struct kvm *kvm, struct kvm_mmu_page *sp)if (list_empty(&sp->possible_nx_huge_page_link))return ;static void unaccount_nx_huge_page(struct kvm *kvm, struct kvm_mmu_page *sp)false ;static struct kvm_memory_slot *gfn_to_memslot_dirty_bitmap(struct kvm_vcpu *vcpu,bool no_dirty_log)struct kvm_memory_slot *slot;if (!slot || slot->flags & KVM_MEMSLOT_INVALID)return NULL;if (no_dirty_log && kvm_slot_dirty_track_enabled(slot))return NULL;return slot;/* * About rmap_head encoding : * * If the bit zero of rmap_head - > val is clear , then it points to the only spte * in this rmap chain . Otherwise , ( rmap_head - > val & ~ 3 ) points to a struct * pte_list_desc containing more mappings . #define KVM_RMAP_MANY BIT(0 )/* * rmaps and PTE lists are mostly protected by mmu_lock ( the shadow MMU always * operates with mmu_lock held for write ) , but rmaps can be walked without * holding mmu_lock so long as the caller can tolerate SPTEs in the rmap chain * being zapped / dropped _ while the rmap is locked_ . * * Other than the KVM_RMAP_LOCKED flag , modifications to rmap entries must be * done while holding mmu_lock for write . This allows a task walking rmaps * without holding mmu_lock to concurrently walk the same entries as a task * that is holding mmu_lock but _ not_ the rmap lock . Neither task will modify * the rmaps , thus the walks are stable . * * As alluded to above , SPTEs in rmaps are _ not_ protected by KVM_RMAP_LOCKED , * only the rmap chains themselves are protected . E . g . holding an rmap ' s lock * ensures all " struct pte_list_desc " fields are stable . #define KVM_RMAP_LOCKED BIT(1 )static unsigned long __kvm_rmap_lock(struct kvm_rmap_head *rmap_head)unsigned long old_val, new_val;/* * Elide the lock if the rmap is empty , as lockless walkers ( read - only * mode ) don ' t need to ( and can ' t ) walk an empty rmap , nor can they add * entries to the rmap . I . e . the only paths that process empty rmaps * do so while holding mmu_lock for write , and are mutually exclusive . if (!old_val)return 0 ;do {/* * If the rmap is locked , wait for it to be unlocked before * trying acquire the lock , e . g . to avoid bouncing the cache * line . while (old_val & KVM_RMAP_LOCKED) {/* * Recheck for an empty rmap , it may have been purged by the * task that held the lock . if (!old_val)return 0 ;/* * Use try_cmpxchg_acquire ( ) to prevent reads and writes to the rmap * from being reordered outside of the critical section created by * _ _ kvm_rmap_lock ( ) . * * Pairs with the atomic_long_set_release ( ) in kvm_rmap_unlock ( ) . * * For the ! old_val case , no ordering is needed , as there is no rmap * to walk . while (!atomic_long_try_cmpxchg_acquire(&rmap_head->val, &old_val, new_val));/* * Return the old value , i . e . _ without_ the LOCKED bit set . It ' s * impossible for the return value to be 0 ( see above ) , i . e . the read - * only unlock flow can ' t get a false positive and fail to unlock . return old_val;static unsigned long kvm_rmap_lock(struct kvm *kvm,struct kvm_rmap_head *rmap_head)return __kvm_rmap_lock(rmap_head);static void __kvm_rmap_unlock(struct kvm_rmap_head *rmap_head,unsigned long val)/* * Ensure that all accesses to the rmap have completed before unlocking * the rmap . * * Pairs with the atomic_long_try_cmpxchg_acquire ( ) in _ _ kvm_rmap_lock ( ) . static void kvm_rmap_unlock(struct kvm *kvm,struct kvm_rmap_head *rmap_head,unsigned long new_val)static unsigned long kvm_rmap_get(struct kvm_rmap_head *rmap_head)return atomic_long_read(&rmap_head->val) & ~KVM_RMAP_LOCKED;/* * If mmu_lock isn ' t held , rmaps can only be locked in read - only mode . The * actual locking is the same , but the caller is disallowed from modifying the * rmap , and so the unlock flow is a nop if the rmap is / was empty . static unsigned long kvm_rmap_lock_readonly(struct kvm_rmap_head *rmap_head)unsigned long rmap_val;if (!rmap_val)return rmap_val;static void kvm_rmap_unlock_readonly(struct kvm_rmap_head *rmap_head,unsigned long old_val)if (!old_val)return ;/* * Returns the number of pointers in the rmap chain , not counting the new one . static int pte_list_add(struct kvm *kvm, struct kvm_mmu_memory_cache *cache,struct kvm_rmap_head *rmap_head)unsigned long old_val, new_val;struct pte_list_desc *desc;int count = 0 ;if (!old_val) {unsigned long )spte;else if (!(old_val & KVM_RMAP_MANY)) {0 ] = (u64 *)old_val;1 ] = spte;2 ;0 ;unsigned long )desc | KVM_RMAP_MANY;else {struct pte_list_desc *)(old_val & ~KVM_RMAP_MANY);/* * If the previous head is full , allocate a new head descriptor * as tail descriptors are always kept full . if (desc->spte_count == PTE_LIST_EXT) {struct pte_list_desc *)(old_val & ~KVM_RMAP_MANY);0 ;unsigned long )desc | KVM_RMAP_MANY;else {return count;static void pte_list_desc_remove_entry(struct kvm *kvm, unsigned long *rmap_val,struct pte_list_desc *desc, int i)struct pte_list_desc *head_desc = (struct pte_list_desc *)(*rmap_val & ~KVM_RMAP_MANY);int j = head_desc->spte_count - 1 ;/* * The head descriptor should never be empty . A new head is added only * when adding an entry and the previous head is full , and heads are * removed ( this flow ) when they become empty . 0 , kvm);/* * Replace the to - be - freed SPTE with the last valid entry from the head * descriptor to ensure that tail descriptors are full at all times . * Note , this also means that tail_count is stable for each descriptor . if (head_desc->spte_count)return ;/* * The head descriptor is empty . If there are no tail descriptors , * nullify the rmap head to mark the list as empty , else point the rmap * head at the next descriptor , i . e . the new head . if (!head_desc->more)0 ;else unsigned long )head_desc->more | KVM_RMAP_MANY;static void pte_list_remove(struct kvm *kvm, u64 *spte,struct kvm_rmap_head *rmap_head)struct pte_list_desc *desc;unsigned long rmap_val;int i;if (KVM_BUG_ON_DATA_CORRUPTION(!rmap_val, kvm))goto out;if (!(rmap_val & KVM_RMAP_MANY)) {if (KVM_BUG_ON_DATA_CORRUPTION((u64 *)rmap_val != spte, kvm))goto out;0 ;else {struct pte_list_desc *)(rmap_val & ~KVM_RMAP_MANY);while (desc) {for (i = 0 ; i < desc->spte_count; ++i) {if (desc->sptes[i] == spte) {goto out;true , kvm);static void kvm_zap_one_rmap_spte(struct kvm *kvm,struct kvm_rmap_head *rmap_head, u64 *sptep)/* Return true if at least one SPTE was zapped, false otherwise */ static bool kvm_zap_all_rmap_sptes(struct kvm *kvm,struct kvm_rmap_head *rmap_head)struct pte_list_desc *desc, *next;unsigned long rmap_val;int i;if (!rmap_val)return false ;if (!(rmap_val & KVM_RMAP_MANY)) {goto out;struct pte_list_desc *)(rmap_val & ~KVM_RMAP_MANY);for (; desc; desc = next) {for (i = 0 ; i < desc->spte_count; i++)/* rmap_head is meaningless now, remember to reset it */ 0 );return true ;unsigned int pte_list_count(struct kvm_rmap_head *rmap_head)unsigned long rmap_val = kvm_rmap_get(rmap_head);struct pte_list_desc *desc;if (!rmap_val)return 0 ;else if (!(rmap_val & KVM_RMAP_MANY))return 1 ;struct pte_list_desc *)(rmap_val & ~KVM_RMAP_MANY);return desc->tail_count + desc->spte_count;static struct kvm_rmap_head *gfn_to_rmap(gfn_t gfn, int level,const struct kvm_memory_slot *slot)unsigned long idx;return &slot->arch.rmap[level - PG_LEVEL_4K][idx];static void rmap_remove(struct kvm *kvm, u64 *spte)struct kvm_memslots *slots;struct kvm_memory_slot *slot;struct kvm_mmu_page *sp;struct kvm_rmap_head *rmap_head;/* * Unlike rmap_add , rmap_remove does not run in the context of a vCPU * so we have to determine which memslots to use based on context * information in sp - > role . /* * Used by the following functions to iterate through the sptes linked by a * rmap . All fields are private and not assumed to be used outside . struct rmap_iterator {/* private fields */ struct rmap_head *head;struct pte_list_desc *desc; /* holds the sptep if not NULL */ int pos; /* index of the sptep */ /* * Iteration must be started by this function . This should also be used after * removing / dropping sptes from the rmap link because in such cases the * information in the iterator may not be valid . * * Returns sptep if found , NULL otherwise . static u64 *rmap_get_first(struct kvm_rmap_head *rmap_head,struct rmap_iterator *iter)unsigned long rmap_val = kvm_rmap_get(rmap_head);if (!rmap_val)return NULL;if (!(rmap_val & KVM_RMAP_MANY)) {return (u64 *)rmap_val;struct pte_list_desc *)(rmap_val & ~KVM_RMAP_MANY);0 ;return iter->desc->sptes[iter->pos];/* * Must be used with a valid iterator : e . g . after rmap_get_first ( ) . * * Returns sptep if found , NULL otherwise . static u64 *rmap_get_next(struct rmap_iterator *iter)if (iter->desc) {if (iter->pos < PTE_LIST_EXT - 1 ) {if (iter->desc->sptes[iter->pos])return iter->desc->sptes[iter->pos];if (iter->desc) {0 ;/* desc->sptes[0] cannot be NULL */ return iter->desc->sptes[iter->pos];return NULL;#define __for_each_rmap_spte(_rmap_head_, _iter_, _sptep_) \for (_sptep_ = rmap_get_first(_rmap_head_, _iter_); \#define for_each_rmap_spte(_rmap_head_, _iter_, _sptep_) \if (!WARN_ON_ONCE(!is_shadow_present_pte(*(_sptep_)))) \#define for_each_rmap_spte_lockless(_rmap_head_, _iter_, _sptep_, _spte_) \if (is_shadow_present_pte(_spte_ = mmu_spte_get_lockless(sptep)))static void drop_spte(struct kvm *kvm, u64 *sptep)if (is_shadow_present_pte(old_spte))static void drop_large_spte(struct kvm *kvm, u64 *sptep, bool flush)struct kvm_mmu_page *sp;if (flush)/* * Write - protect on the specified @ sptep , @ pt_protect indicates whether * spte write - protection is caused by protecting shadow page table . * * Note : write protection is difference between dirty logging and spte * protection : * - for dirty logging , the spte can be set to writable at anytime if * its dirty bitmap is properly set . * - for spte protection , the spte can be writable only after unsync - ing * shadow page . * * Return true if tlb need be flushed . static bool spte_write_protect(u64 *sptep, bool pt_protect)if (!is_writable_pte(spte) &&return false ;if (pt_protect)return mmu_spte_update(sptep, spte);static bool rmap_write_protect(struct kvm_rmap_head *rmap_head,bool pt_protect)struct rmap_iterator iter;bool flush = false ;return flush;static bool spte_clear_dirty(u64 *sptep)return mmu_spte_update(sptep, spte);/* * Gets the GFN ready for another round of dirty logging by clearing the * - D bit on ad - enabled SPTEs , and * - W bit on ad - disabled SPTEs . * Returns true iff any D or W bits were cleared . static bool __rmap_clear_dirty(struct kvm *kvm, struct kvm_rmap_head *rmap_head,const struct kvm_memory_slot *slot)struct rmap_iterator iter;bool flush = false ;if (spte_ad_need_write_protect(*sptep))unsigned long *)sptep);else return flush;static void kvm_mmu_write_protect_pt_masked(struct kvm *kvm,struct kvm_memory_slot *slot,unsigned long mask)struct kvm_rmap_head *rmap_head;if (tdp_mmu_enabled)true );if (!kvm_memslots_have_rmaps(kvm))return ;while (mask) {false );/* clear the first set bit */ 1 ;static void kvm_mmu_clear_dirty_pt_masked(struct kvm *kvm,struct kvm_memory_slot *slot,unsigned long mask)struct kvm_rmap_head *rmap_head;if (tdp_mmu_enabled)false );if (!kvm_memslots_have_rmaps(kvm))return ;while (mask) {/* clear the first set bit */ 1 ;void kvm_arch_mmu_enable_log_dirty_pt_masked(struct kvm *kvm,struct kvm_memory_slot *slot,unsigned long mask)/* * If the slot was assumed to be " initially all dirty " , write - protect * huge pages to ensure they are split to 4 KiB on the first write ( KVM * dirty logs at 4 KiB granularity ) . If eager page splitting is enabled , * immediately try to split huge pages , e . g . so that vCPUs don ' t get * saddled with the cost of splitting . * * The gfn_offset is guaranteed to be aligned to 64 , but the base_gfn * of memslot has no such restriction , so the range can cross two large * pages . if (kvm_dirty_log_manual_protect_and_init_set(kvm)) {if (READ_ONCE(eager_page_split))1 , PG_LEVEL_4K);/* Cross two large pages? */ if (ALIGN(start << PAGE_SHIFT, PMD_SIZE) !=/* * ( Re ) Enable dirty logging for all 4 KiB SPTEs that map the GFNs in * mask . If PML is enabled and the GFN doesn ' t need to be write - * protected for other reasons , e . g . shadow paging , clear the Dirty bit . * Otherwise clear the Writable bit . * * Note that kvm_mmu_clear_dirty_pt_masked ( ) is called whenever PML is * enabled but it chooses between clearing the Dirty bit and Writeable * bit based on the context . if (kvm->arch.cpu_dirty_log_size)else int kvm_cpu_dirty_log_size(struct kvm *kvm)return kvm->arch.cpu_dirty_log_size;bool kvm_mmu_slot_gfn_write_protect(struct kvm *kvm,struct kvm_memory_slot *slot, u64 gfn,int min_level)struct kvm_rmap_head *rmap_head;int i;bool write_protected = false ;if (kvm_memslots_have_rmaps(kvm)) {for (i = min_level; i <= KVM_MAX_HUGEPAGE_LEVEL; ++i) {true );if (tdp_mmu_enabled)return write_protected;static bool kvm_vcpu_write_protect_gfn(struct kvm_vcpu *vcpu, u64 gfn)struct kvm_memory_slot *slot;return kvm_mmu_slot_gfn_write_protect(vcpu->kvm, slot, gfn, PG_LEVEL_4K);static bool kvm_zap_rmap(struct kvm *kvm, struct kvm_rmap_head *rmap_head,const struct kvm_memory_slot *slot)return kvm_zap_all_rmap_sptes(kvm, rmap_head);struct slot_rmap_walk_iterator {/* input fields. */ const struct kvm_memory_slot *slot;int start_level;int end_level;/* output fields. */ struct kvm_rmap_head *rmap;int level;/* private field. */ struct kvm_rmap_head *end_rmap;static void rmap_walk_init_level(struct slot_rmap_walk_iterator *iterator,int level)static void slot_rmap_walk_init(struct slot_rmap_walk_iterator *iterator,const struct kvm_memory_slot *slot,int start_level, int end_level,static bool slot_rmap_walk_okay(struct slot_rmap_walk_iterator *iterator)return !!iterator->rmap;static void slot_rmap_walk_next(struct slot_rmap_walk_iterator *iterator)while (++iterator->rmap <= iterator->end_rmap) {if (atomic_long_read(&iterator->rmap->val))return ;if (++iterator->level > iterator->end_level) {return ;#define for_each_slot_rmap_range(_slot_, _start_level_, _end_level_, \for (slot_rmap_walk_init(_iter_, _slot_, _start_level_, \/* The return value indicates if tlb flush on all vcpus is needed. */ typedef bool (*slot_rmaps_handler) (struct kvm *kvm,struct kvm_rmap_head *rmap_head,const struct kvm_memory_slot *slot);static __always_inline bool __walk_slot_rmaps(struct kvm *kvm,const struct kvm_memory_slot *slot,int start_level, int end_level,bool can_yield, bool flush_on_yield,bool flush)struct slot_rmap_walk_iterator iterator;if (iterator.rmap)if (!can_yield)continue ;if (need_resched() || rwlock_needbreak(&kvm->mmu_lock)) {if (flush && flush_on_yield) {1 );false ;return flush;static __always_inline bool walk_slot_rmaps(struct kvm *kvm,const struct kvm_memory_slot *slot,int start_level, int end_level,bool flush_on_yield)return __walk_slot_rmaps(kvm, slot, fn, start_level, end_level,1 ,true , flush_on_yield, false );static __always_inline bool walk_slot_rmaps_4k(struct kvm *kvm,const struct kvm_memory_slot *slot,bool flush_on_yield)return walk_slot_rmaps(kvm, slot, fn, PG_LEVEL_4K, PG_LEVEL_4K, flush_on_yield);static bool __kvm_rmap_zap_gfn_range(struct kvm *kvm,const struct kvm_memory_slot *slot,bool can_yield,bool flush)return __walk_slot_rmaps(kvm, slot, kvm_zap_rmap,1 , can_yield, true , flush);bool kvm_unmap_gfn_range(struct kvm *kvm, struct kvm_gfn_range *range)bool flush = false ;/* * To prevent races with vCPUs faulting in a gfn using stale data , * zapping a gfn range must be protected by mmu_invalidate_in_progress * ( and mmu_invalidate_seq ) . The only exception is memslot deletion ; * in that case , SRCU synchronization ensures that SPTEs are zapped * after all vCPUs have unlocked SRCU , guaranteeing that vCPUs see the * invalid slot . if (kvm_memslots_have_rmaps(kvm))if (tdp_mmu_enabled)if (kvm_x86_ops.set_apic_access_page_addr &&return flush;#define RMAP_RECYCLE_THRESHOLD 1000 static void __rmap_add(struct kvm *kvm,struct kvm_mmu_memory_cache *cache,const struct kvm_memory_slot *slot,unsigned int access)struct kvm_mmu_page *sp;struct kvm_rmap_head *rmap_head;int rmap_count;1 );if (rmap_count > kvm->stat.max_mmu_rmap_size)if (rmap_count > RMAP_RECYCLE_THRESHOLD) {static void rmap_add(struct kvm_vcpu *vcpu, const struct kvm_memory_slot *slot,unsigned int access)struct kvm_mmu_memory_cache *cache = &vcpu->arch.mmu_pte_list_desc_cache;static bool kvm_rmap_age_gfn_range(struct kvm *kvm,struct kvm_gfn_range *range,bool test_only)struct kvm_rmap_head *rmap_head;struct rmap_iterator iter;unsigned long rmap_val;bool young = false ;int level;for (level = PG_LEVEL_4K; level <= KVM_MAX_HUGEPAGE_LEVEL; level++) {for (gfn = range->start; gfn < range->end;if (!is_accessed_spte(spte))continue ;if (test_only) {return true ;if (spte_ad_enabled(spte))1 ),unsigned long *)sptep);else /* * If the following cmpxchg fails , the * spte is being concurrently modified * and should most likely stay young . true ;return young;static bool kvm_may_have_shadow_mmu_sptes(struct kvm *kvm)return !tdp_mmu_enabled || READ_ONCE(kvm->arch.indirect_shadow_pages);bool kvm_age_gfn(struct kvm *kvm, struct kvm_gfn_range *range)bool young = false ;if (tdp_mmu_enabled)if (kvm_may_have_shadow_mmu_sptes(kvm))false );return young;bool kvm_test_age_gfn(struct kvm *kvm, struct kvm_gfn_range *range)bool young = false ;if (tdp_mmu_enabled)if (young)return young;if (kvm_may_have_shadow_mmu_sptes(kvm))true );return young;static void kvm_mmu_check_sptes_at_free(struct kvm_mmu_page *sp)#ifdef CONFIG_KVM_PROVE_MMUint i;for (i = 0 ; i < SPTE_ENT_PER_PAGE; i++) {if (KVM_MMU_WARN_ON(is_shadow_present_pte(sp->spt[i])))"SPTE %llx (@ %p) for gfn %llx shadow-present at free" ,#endif static void kvm_account_mmu_page(struct kvm *kvm, struct kvm_mmu_page *sp)void *)sp->spt, +1 );static void kvm_unaccount_mmu_page(struct kvm *kvm, struct kvm_mmu_page *sp)void *)sp->spt, -1 );static void kvm_mmu_free_shadow_page(struct kvm_mmu_page *sp)unsigned long )sp->spt);unsigned long )sp->shadowed_translation);static unsigned kvm_page_table_hashfn(gfn_t gfn)return hash_64(gfn, KVM_MMU_HASH_SHIFT);static void mmu_page_add_parent_pte(struct kvm *kvm,struct kvm_mmu_memory_cache *cache,struct kvm_mmu_page *sp, u64 *parent_pte)if (!parent_pte)return ;static void mmu_page_remove_parent_pte(struct kvm *kvm, struct kvm_mmu_page *sp,static void drop_parent_pte(struct kvm *kvm, struct kvm_mmu_page *sp,static void mark_unsync(u64 *spte);static void kvm_mmu_mark_parents_unsync(struct kvm_mmu_page *sp)struct rmap_iterator iter;static void mark_unsync(u64 *spte)struct kvm_mmu_page *sp;if (__test_and_set_bit(spte_index(spte), sp->unsync_child_bitmap))return ;if (sp->unsync_children++)return ;#define KVM_PAGE_ARRAY_NR 16 struct kvm_mmu_pages {struct mmu_page_and_offset {struct kvm_mmu_page *sp;unsigned int idx;unsigned int nr;static int mmu_pages_add(struct kvm_mmu_pages *pvec, struct kvm_mmu_page *sp,int idx)int i;if (sp->unsync)for (i=0 ; i < pvec->nr; i++)if (pvec->page[i].sp == sp)return 0 ;return (pvec->nr == KVM_PAGE_ARRAY_NR);static inline void clear_unsync_child_bit(struct kvm_mmu_page *sp, int idx)int )sp->unsync_children < 0 );static int __mmu_unsync_walk(struct kvm_mmu_page *sp,struct kvm_mmu_pages *pvec)int i, ret, nr_unsync_leaf = 0 ;512 ) {struct kvm_mmu_page *child;if (!is_shadow_present_pte(ent) || is_large_pte(ent)) {continue ;if (child->unsync_children) {if (mmu_pages_add(pvec, child, i))return -ENOSPC;if (!ret) {continue ;else if (ret > 0 ) {else return ret;else if (child->unsync) {if (mmu_pages_add(pvec, child, i))return -ENOSPC;else return nr_unsync_leaf;#define INVALID_INDEX (-1 )static int mmu_unsync_walk(struct kvm_mmu_page *sp,struct kvm_mmu_pages *pvec)0 ;if (!sp->unsync_children)return 0 ;return __mmu_unsync_walk(sp, pvec);static void kvm_unlink_unsync_page(struct kvm *kvm, struct kvm_mmu_page *sp)0 ;static bool kvm_mmu_prepare_zap_page(struct kvm *kvm, struct kvm_mmu_page *sp,struct list_head *invalid_list);static void kvm_mmu_commit_zap_page(struct kvm *kvm,struct list_head *invalid_list);static bool sp_has_gptes(struct kvm_mmu_page *sp)if (sp->role.direct)return false ;if (sp->role.passthrough)return false ;return true ;static __ro_after_init HLIST_HEAD(empty_page_hash);static struct hlist_head *kvm_get_mmu_page_hash(struct kvm *kvm, gfn_t gfn)/* * Ensure the load of the hash table pointer itself is ordered before * loads to walk the table . The pointer is set at runtime outside of * mmu_lock when the TDP MMU is enabled , i . e . when the hash table of * shadow pages becomes necessary only when KVM needs to shadow L1 ' s * TDP for an L2 guest . Pairs with the smp_store_release ( ) in * kvm_mmu_alloc_page_hash ( ) . struct hlist_head *page_hash = smp_load_acquire(&kvm->arch.mmu_page_hash);if (!page_hash)return &empty_page_hash;return &page_hash[kvm_page_table_hashfn(gfn)];#define for_each_valid_sp(_kvm, _sp, _list) \if (is_obsolete_sp((_kvm), (_sp))) { \else #define for_each_gfn_valid_sp_with_gptes(_kvm, _sp, _gfn) \if ((_sp)->gfn != (_gfn) || !sp_has_gptes(_sp)) {} else static bool kvm_sync_page_check(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp)union kvm_mmu_page_role root_role = vcpu->arch.mmu->root_role;/* * Ignore various flags when verifying that it ' s safe to sync a shadow * page using the current MMU context . * * - level : not part of the overall MMU role and will never match as the MMU ' s * level tracks the root level * - access : updated based on the new guest PTE * - quadrant : not part of the overall MMU role ( similar to level ) const union kvm_mmu_page_role sync_role_ign = {0 xf,0 x7,0 x3,0 x1,/* * Direct pages can never be unsync , and KVM should never attempt to * sync a shadow page for a different MMU context , e . g . if the role * differs then the memslot lookup ( SMM vs . non - SMM ) will be bogus , the * reserved bits checks will be wrong , etc . . . if (WARN_ON_ONCE(sp->role.direct || !vcpu->arch.mmu->sync_spte ||return false ;return true ;static int kvm_sync_spte(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp, int i)/* sp->spt[i] has initial value of shadow page table allocation */ if (sp->spt[i] == SHADOW_NONPRESENT_VALUE)return 0 ;return vcpu->arch.mmu->sync_spte(vcpu, sp, i);static int __kvm_sync_page(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp)int flush = 0 ;int i;if (!kvm_sync_page_check(vcpu, sp))return -1 ;for (i = 0 ; i < SPTE_ENT_PER_PAGE; i++) {int ret = kvm_sync_spte(vcpu, sp, i);if (ret < -1 )return -1 ;/* * Note , any flush is purely for KVM ' s correctness , e . g . when dropping * an existing SPTE or clearing W / A / D bits to ensure an mmu_notifier * unmap or dirty logging event doesn ' t fail to flush . The guest is * responsible for flushing the TLB to ensure any changes in protection * bits are recognized , i . e . until the guest flushes or page faults on * a relevant address , KVM is architecturally allowed to let vCPUs use * cached translations with the old protection bits . return flush;static int kvm_sync_page(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp,struct list_head *invalid_list)int ret = __kvm_sync_page(vcpu, sp);if (ret < 0 )return ret;static bool kvm_mmu_remote_flush_or_zap(struct kvm *kvm,struct list_head *invalid_list,bool remote_flush)if (!remote_flush && list_empty(invalid_list))return false ;if (!list_empty(invalid_list))else return true ;static bool is_obsolete_sp(struct kvm *kvm, struct kvm_mmu_page *sp)if (sp->role.invalid)return true ;/* TDP MMU pages do not use the MMU generation. */ return !is_tdp_mmu_page(sp) &&struct mmu_page_path {struct kvm_mmu_page *parent[PT64_ROOT_MAX_LEVEL];unsigned int idx[PT64_ROOT_MAX_LEVEL];#define for_each_sp(pvec, sp, parents, i) \for (i = mmu_pages_first(&pvec, &parents); \1 ;}); \static int mmu_pages_next(struct kvm_mmu_pages *pvec,struct mmu_page_path *parents,int i)int n;for (n = i+1 ; n < pvec->nr; n++) {struct kvm_mmu_page *sp = pvec->page[n].sp;unsigned idx = pvec->page[n].idx;int level = sp->role.level;1 ] = idx;if (level == PG_LEVEL_4K)break ;2 ] = sp;return n;static int mmu_pages_first(struct kvm_mmu_pages *pvec,struct mmu_page_path *parents)struct kvm_mmu_page *sp;int level;if (pvec->nr == 0 )return 0 ;0 ].idx != INVALID_INDEX);0 ].sp;2 ] = sp;/* Also set up a sentinel. Further entries in pvec are all * children of sp , so this element is never overwritten . 1 ] = NULL;return mmu_pages_next(pvec, parents, 0 );static void mmu_pages_clear_parents(struct mmu_page_path *parents)struct kvm_mmu_page *sp;unsigned int level = 0 ;do {unsigned int idx = parents->idx[level];if (!sp)return ;while (!sp->unsync_children);static int mmu_sync_children(struct kvm_vcpu *vcpu,struct kvm_mmu_page *parent, bool can_yield)int i;struct kvm_mmu_page *sp;struct mmu_page_path parents;struct kvm_mmu_pages pages;bool flush = false ;while (mmu_unsync_walk(parent, &pages)) {bool protected = false ;protected |= kvm_vcpu_write_protect_gfn(vcpu, sp->gfn);if (protected ) {true );false ;0 ;if (need_resched() || rwlock_needbreak(&vcpu->kvm->mmu_lock)) {if (!can_yield) {return -EINTR;false ;return 0 ;static void __clear_sp_write_flooding_count(struct kvm_mmu_page *sp)0 );static void clear_sp_write_flooding_count(u64 *spte)/* * The vCPU is required when finding indirect shadow pages ; the shadow * page may already exist and syncing it needs the vCPU pointer in * order to read guest page tables . Direct shadow pages are never * unsync , thus @ vcpu can be NULL if @ role . direct is true . static struct kvm_mmu_page *kvm_mmu_find_shadow_page(struct kvm *kvm,struct kvm_vcpu *vcpu,struct hlist_head *sp_list,union kvm_mmu_page_role role)struct kvm_mmu_page *sp;int ret;int collisions = 0 ;if (sp->gfn != gfn) {continue ;if (sp->role.word != role.word) {/* * If the guest is creating an upper - level page , zap * unsync pages for the same gfn . While it ' s possible * the guest is using recursive page tables , in all * likelihood the guest has stopped using the unsync * page and is installing a completely unrelated page . * Unsync pages must not be left as is , because the new * upper - level page will be write - protected . if (role.level > PG_LEVEL_4K && sp->unsync)continue ;/* unsync and write-flooding only apply to indirect SPs. */ if (sp->role.direct)goto out;if (sp->unsync) {if (KVM_BUG_ON(!vcpu, kvm))break ;/* * The page is good , but is stale . kvm_sync_page does * get the latest guest state , but ( unlike mmu_unsync_children ) * it doesn ' t write - protect the page or mark it synchronized ! * This way the validity of the mapping is ensured , but the * overhead of write protection is not incurred until the * guest invalidates the TLB mapping . This allows multiple * SPs for a single gfn to be unsync . * * If the sync fails , the page is zapped . If so , break * in order to rebuild it . if (ret < 0 )break ;if (ret > 0 )goto out;if (collisions > kvm->stat.max_mmu_page_hash_collisions)return sp;/* Caches used when allocating a new shadow page. */ struct shadow_page_caches {struct kvm_mmu_memory_cache *page_header_cache;struct kvm_mmu_memory_cache *shadow_page_cache;struct kvm_mmu_memory_cache *shadowed_info_cache;static struct kvm_mmu_page *kvm_mmu_alloc_shadow_page(struct kvm *kvm,struct shadow_page_caches *caches,struct hlist_head *sp_list,union kvm_mmu_page_role role)struct kvm_mmu_page *sp;if (!role.direct && role.level <= KVM_MAX_HUGEPAGE_LEVEL)unsigned long )sp);/* * active_mmu_pages must be a FIFO list , as kvm_zap_obsolete_pages ( ) * depends on valid pages being added to the head of the list . See * comments in kvm_zap_obsolete_pages ( ) . if (sp_has_gptes(sp))return sp;/* Note, @vcpu may be NULL if @role.direct is true; see kvm_mmu_find_shadow_page. */ static struct kvm_mmu_page *__kvm_mmu_get_shadow_page(struct kvm *kvm,struct kvm_vcpu *vcpu,struct shadow_page_caches *caches,union kvm_mmu_page_role role)struct hlist_head *sp_list;struct kvm_mmu_page *sp;bool created = false ;/* * No need for memory barriers , unlike in kvm_get_mmu_page_hash ( ) , as * mmu_page_hash must be set prior to creating the first shadow root , * i . e . reaching this point is fully serialized by slots_arch_lock . if (!sp) {true ;return sp;static struct kvm_mmu_page *kvm_mmu_get_shadow_page(struct kvm_vcpu *vcpu,union kvm_mmu_page_role role)struct shadow_page_caches caches = {return __kvm_mmu_get_shadow_page(vcpu->kvm, vcpu, &caches, gfn, role);static union kvm_mmu_page_role kvm_mmu_child_role(u64 *sptep, bool direct,unsigned int access)struct kvm_mmu_page *parent_sp = sptep_to_sp(sptep);union kvm_mmu_page_role role;0 ;/* * If the guest has 4 - byte PTEs then that means it ' s using 32 - bit , * 2 - level , non - PAE paging . KVM shadows such guests with PAE paging * ( i . e . 8 - byte PTEs ) . The difference in PTE size means that KVM must * shadow each guest page table with multiple shadow page tables , which * requires extra bookkeeping in the role . * * Specifically , to shadow the guest ' s page directory ( which covers a * 4 GiB address space ) , KVM uses 4 PAE page directories , each mapping * 1 GiB of the address space . @ role . quadrant encodes which quarter of * the address space each maps . * * To shadow the guest ' s page tables ( which each map a 4 MiB region ) , KVM * uses 2 PAE page tables , each mapping a 2 MiB region . For these , * @ role . quadrant encodes which half of the region they map . * * Concretely , a 4 - byte PDE consumes bits 31 : 22 , while an 8 - byte PDE * consumes bits 29 : 21 . To consume bits 31 : 30 , KVM ' s uses 4 shadow * PDPTEs ; those 4 PAE page directories are pre - allocated and their * quadrant is assigned in mmu_alloc_root ( ) . A 4 - byte PTE consumes * bits 21 : 12 , while an 8 - byte PTE consumes bits 20 : 12 . To consume * bit 21 in the PTE ( the child here ) , KVM propagates that bit to the * quadrant , i . e . sets quadrant to ' 0 ' or ' 1 ' . The parent 8 - byte PDE * covers bit 21 ( see above ) , thus the quadrant is calculated from the * _ least_ significant bit of the PDE index . if (role.has_4_byte_gpte) {1 ;return role;static struct kvm_mmu_page *kvm_mmu_get_child_sp(struct kvm_vcpu *vcpu,bool direct, unsigned int access)union kvm_mmu_page_role role;if (is_shadow_present_pte(*sptep) && !is_large_pte(*sptep))return ERR_PTR(-EEXIST);return kvm_mmu_get_shadow_page(vcpu, gfn, role);static void shadow_walk_init_using_root(struct kvm_shadow_walk_iterator *iterator,struct kvm_vcpu *vcpu, hpa_t root,if (iterator->level >= PT64_ROOT_4LEVEL &&if (iterator->level == PT32E_ROOT_LEVEL) {/* * prev_root is currently only used for 64 - bit hosts . So only * the active root_hpa is valid here . 30 ) & 3 ];if (!iterator->shadow_addr)0 ;static void shadow_walk_init(struct kvm_shadow_walk_iterator *iterator,struct kvm_vcpu *vcpu, u64 addr)static bool shadow_walk_okay(struct kvm_shadow_walk_iterator *iterator)if (iterator->level < PG_LEVEL_4K)return false ;return true ;static void __shadow_walk_next(struct kvm_shadow_walk_iterator *iterator,if (!is_shadow_present_pte(spte) || is_last_spte(spte, iterator->level)) {0 ;return ;static void shadow_walk_next(struct kvm_shadow_walk_iterator *iterator)static void __link_shadow_page(struct kvm *kvm,struct kvm_mmu_memory_cache *cache, u64 *sptep,struct kvm_mmu_page *sp, bool flush)/* * If an SPTE is present already , it must be a leaf and therefore * a large one . Drop it , and flush the TLB if needed , before * installing sp . if (is_shadow_present_pte(*sptep))/* * The non - direct sub - pagetable must be updated before linking . For * L1 sp , the pagetable is updated via kvm_sync_page ( ) in * kvm_mmu_find_shadow_page ( ) without write - protecting the gfn , * so sp - > unsync can be true or false . For higher level non - direct * sp , the pagetable is updated / synced via mmu_sync_children ( ) in * FNAME ( fetch ) ( ) , so sp - > unsync_children can only be false . * WARN_ON_ONCE ( ) if anything happens unexpectedly . if (WARN_ON_ONCE(sp->unsync_children) || sp->unsync)static void link_shadow_page(struct kvm_vcpu *vcpu, u64 *sptep,struct kvm_mmu_page *sp)true );static void validate_direct_spte(struct kvm_vcpu *vcpu, u64 *sptep,unsigned direct_access)if (is_shadow_present_pte(*sptep) && !is_large_pte(*sptep)) {struct kvm_mmu_page *child;/* * For the direct sp , if the guest pte ' s dirty bit * changed form clean to dirty , it will corrupt the * sp ' s access : allow writable in the read - only sp , * so we should update the spte at this point to get * a new sp with the correct access . if (child->role.access == direct_access)return ;/* Returns the number of zapped non-leaf child shadow pages. */ static int mmu_page_zap_pte(struct kvm *kvm, struct kvm_mmu_page *sp,struct list_head *invalid_list)struct kvm_mmu_page *child;if (is_shadow_present_pte(pte)) {if (is_last_spte(pte, sp->role.level)) {else {/* * Recursively zap nested TDP SPs , parentless SPs are * unlikely to be used again in the near future . This * avoids retaining a large number of stale nested SPs . if (tdp_enabled && invalid_list &&return kvm_mmu_prepare_zap_page(kvm, child,else if (is_mmio_spte(kvm, pte)) {return 0 ;static int kvm_mmu_page_unlink_children(struct kvm *kvm,struct kvm_mmu_page *sp,struct list_head *invalid_list)int zapped = 0 ;unsigned i;for (i = 0 ; i < SPTE_ENT_PER_PAGE; ++i)return zapped;static void kvm_mmu_unlink_parents(struct kvm *kvm, struct kvm_mmu_page *sp)struct rmap_iterator iter;while ((sptep = rmap_get_first(&sp->parent_ptes, &iter)))static int mmu_zap_unsync_children(struct kvm *kvm,struct kvm_mmu_page *parent,struct list_head *invalid_list)int i, zapped = 0 ;struct mmu_page_path parents;struct kvm_mmu_pages pages;if (parent->role.level == PG_LEVEL_4K)return 0 ;while (mmu_unsync_walk(parent, &pages)) {struct kvm_mmu_page *sp;return zapped;static bool __kvm_mmu_prepare_zap_page(struct kvm *kvm,struct kvm_mmu_page *sp,struct list_head *invalid_list,int *nr_zapped)bool list_unstable, zapped_root = false ;/* Zapping children means active_mmu_pages has become unstable. */ if (!sp->role.invalid && sp_has_gptes(sp))if (sp->unsync)if (!sp->root_count) {/* Count self */ /* * Already invalid pages ( previously active roots ) are not on * the active page list . See list_del ( ) in the " else " case of * ! sp - > root_count . if (sp->role.invalid)else else {/* * Remove the active root from the active page list , the root * will be explicitly freed when the root_count hits zero . /* * Obsolete pages cannot be used on any vCPUs , see the comment * in kvm_mmu_zap_all_fast ( ) . Note , is_obsolete_sp ( ) also * treats invalid shadow pages as being obsolete . if (sp->nx_huge_page_disallowed)1 ;/* * Make the request to free obsolete roots after marking the root * invalid , otherwise other vCPUs may not see it as invalid . if (zapped_root)return list_unstable;static bool kvm_mmu_prepare_zap_page(struct kvm *kvm, struct kvm_mmu_page *sp,struct list_head *invalid_list)int nr_zapped;return nr_zapped;static void kvm_mmu_commit_zap_page(struct kvm *kvm,struct list_head *invalid_list)struct kvm_mmu_page *sp, *nsp;if (list_empty(invalid_list))return ;/* * We need to make sure everyone sees our modifications to * the page tables and see changes to vcpu - > mode here . The barrier * in the kvm_flush_remote_tlbs ( ) achieves this . This pairs * with vcpu_enter_guest and walk_shadow_page_lockless_begin / end . * * In addition , kvm_flush_remote_tlbs waits for all vcpus to exit * guest mode and / or lockless shadow page table walks . static unsigned long kvm_mmu_zap_oldest_mmu_pages(struct kvm *kvm,unsigned long nr_to_zap)unsigned long total_zapped = 0 ;struct kvm_mmu_page *sp, *tmp;bool unstable;int nr_zapped;if (list_empty(&kvm->arch.active_mmu_pages))return 0 ;/* * Don ' t zap active root pages , the page itself can ' t be freed * and zapping it will just force vCPUs to realloc and reload . if (sp->root_count)continue ;if (total_zapped >= nr_to_zap)break ;if (unstable)goto restart;return total_zapped;static inline unsigned long kvm_mmu_available_pages(struct kvm *kvm)if (kvm->arch.n_max_mmu_pages > kvm->arch.n_used_mmu_pages)return kvm->arch.n_max_mmu_pages -return 0 ;static int make_mmu_pages_available(struct kvm_vcpu *vcpu)unsigned long avail = kvm_mmu_available_pages(vcpu->kvm);if (likely(avail >= KVM_MIN_FREE_MMU_PAGES))return 0 ;/* * Note , this check is intentionally soft , it only guarantees that one * page is available , while the caller may end up allocating as many as * four pages , e . g . for PAE roots or for 5 - level paging . Temporarily * exceeding the ( arbitrary by default ) limit will not harm the host , * being too aggressive may unnecessarily kill the guest , and getting an * exact count is far more trouble than it ' s worth , especially in the * page fault paths . if (!kvm_mmu_available_pages(vcpu->kvm))return -ENOSPC;return 0 ;/* * Changing the number of mmu pages allocated to the vm * Note : if goal_nr_mmu_pages is too small , you will get dead lock void kvm_mmu_change_mmu_pages(struct kvm *kvm, unsigned long goal_nr_mmu_pages)if (kvm->arch.n_used_mmu_pages > goal_nr_mmu_pages) {bool __kvm_mmu_unprotect_gfn_and_retry(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa,bool always_retry)struct kvm *kvm = vcpu->kvm;struct kvm_mmu_page *sp;bool r = false ;/* * Bail early if there aren ' t any write - protected shadow pages to avoid * unnecessarily taking mmu_lock lock , e . g . if the gfn is write - tracked * by a third party . Reading indirect_shadow_pages without holding * mmu_lock is safe , as this is purely an optimization , i . e . a false * positive is benign , and a false negative will simply result in KVM * skipping the unprotect + retry path , which is also an optimization . if (!READ_ONCE(kvm->arch.indirect_shadow_pages))goto out;if (!vcpu->arch.mmu->root_role.direct) {if (gpa == INVALID_GPA)goto out;/* * Snapshot the result before zapping , as zapping will remove all list * entries , i . e . checking the list later would yield a false negative . if (r || always_retry) {return r;static void kvm_unsync_page(struct kvm *kvm, struct kvm_mmu_page *sp)1 ;/* * Attempt to unsync any shadow pages that can be reached by the specified gfn , * KVM is creating a writable mapping for said gfn . Returns 0 if all pages * were marked unsync ( or if there is no shadow page ) , - EPERM if the SPTE must * be write - protected . int mmu_try_to_unsync_pages(struct kvm *kvm, const struct kvm_memory_slot *slot,bool synchronizing, bool prefetch)struct kvm_mmu_page *sp;bool locked = false ;/* * Force write - protection if the page is being tracked . Note , the page * track machinery is used to write - protect upper - level shadow pages , * i . e . this guards the role . level = = 4 K assertion below ! if (kvm_gfn_is_write_tracked(kvm, slot, gfn))return -EPERM;/* * The page is not write - tracked , mark existing shadow pages unsync * unless KVM is synchronizing an unsync SP . In that case , KVM must * complete emulation of the guest TLB flush before allowing shadow * pages to become unsync ( writable by the guest ) . if (synchronizing)return -EPERM;if (sp->unsync)continue ;if (prefetch)return -EEXIST;/* * TDP MMU page faults require an additional spinlock as they * run with mmu_lock held for read , not write , and the unsync * logic is not thread safe . Take the spinklock regardless of * the MMU type to avoid extra conditionals / parameters , there ' s * no meaningful penalty if mmu_lock is held for write . if (!locked) {true ;/* * Recheck after taking the spinlock , a different vCPU * may have since marked the page unsync . A false * negative on the unprotected check above is not * possible as clearing sp - > unsync _ must_ hold mmu_lock * for write , i . e . unsync cannot transition from 1 - > 0 * while this CPU holds mmu_lock for read ( or write ) . if (READ_ONCE(sp->unsync))continue ;if (locked)/* * We need to ensure that the marking of unsync pages is visible * before the SPTE is updated to allow writes because * kvm_mmu_sync_roots ( ) checks the unsync flags without holding * the MMU lock and so can race with this . If the SPTE was updated * before the page had been marked as unsync - ed , something like the * following could happen : * * CPU 1 CPU 2 * - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - * 1 . 2 Host updates SPTE * to be writable * 2 . 1 Guest writes a GPTE for GVA X . * ( GPTE being in the guest page table shadowed * by the SP from CPU 1 . ) * This reads SPTE during the page table walk . * Since SPTE . W is read as 1 , there is no * fault . * * 2 . 2 Guest issues TLB flush . * That causes a VM Exit . * * 2 . 3 Walking of unsync pages sees sp - > unsync is * false and skips the page . * * 2 . 4 Guest accesses GVA X . * Since the mapping in the SP was not updated , * so the old mapping for GVA X incorrectly * gets used . * 1 . 1 Host marks SP * as unsync * ( sp - > unsync = true ) * * The write barrier below ensures that 1 . 1 happens before 1 . 2 and thus * the situation in 2 . 4 does not arise . It pairs with the read barrier * in is_unsync_root ( ) , placed between 2 . 1 ' s load of SPTE . W and 2 . 3 . return 0 ;static int mmu_set_spte(struct kvm_vcpu *vcpu, struct kvm_memory_slot *slot,unsigned int pte_access, gfn_t gfn,struct kvm_page_fault *fault)struct kvm_mmu_page *sp = sptep_to_sp(sptep);int level = sp->role.level;int was_rmapped = 0 ;int ret = RET_PF_FIXED;bool flush = false ;bool wrprot;/* Prefetching always gets a writable pfn. */ bool host_writable = !fault || fault->map_writable;bool prefetch = !fault || fault->prefetch;bool write_fault = fault && fault->write;if (unlikely(is_noslot_pfn(pfn))) {return RET_PF_EMULATE;if (is_shadow_present_pte(*sptep)) {if (prefetch && is_last_spte(*sptep, level) &&return RET_PF_SPURIOUS;/* * If we overwrite a PTE page pointer with a 2 MB PMD , unlink * the parent of the now unreachable PTE . if (level > PG_LEVEL_4K && !is_large_pte(*sptep)) {struct kvm_mmu_page *child;true ;else if (WARN_ON_ONCE(pfn != spte_to_pfn(*sptep))) {true ;else 1 ;false , host_writable, &spte);if (*sptep == spte) {else {if (wrprot && write_fault)if (flush)if (!was_rmapped) {else {/* Already rmapped but the pte_access bits may have changed. */ return ret;static bool kvm_mmu_prefetch_sptes(struct kvm_vcpu *vcpu, gfn_t gfn, u64 *sptep,int nr_pages, unsigned int access)struct page *pages[PTE_PREFETCH_NUM];struct kvm_memory_slot *slot;int i;if (WARN_ON_ONCE(nr_pages > PTE_PREFETCH_NUM))return false ;if (!slot)return false ;if (nr_pages <= 0 )return false ;for (i = 0 ; i < nr_pages; i++, gfn++, sptep++) {/* * KVM always prefetches writable pages from the primary MMU , * and KVM can make its SPTE writable in the fast page handler , * without notifying the primary MMU . Mark pages / folios dirty * now to ensure file data is written back if it ends up being * written by the guest . Because KVM ' s prefetching GUPs * writable PTEs , the probability of unnecessary writeback is * extremely low . return true ;static bool direct_pte_prefetch_many(struct kvm_vcpu *vcpu,struct kvm_mmu_page *sp,unsigned int access = sp->role.access;return kvm_mmu_prefetch_sptes(vcpu, gfn, start, end - start, access);static void __direct_pte_prefetch(struct kvm_vcpu *vcpu,struct kvm_mmu_page *sp, u64 *sptep)int i;1 );for (i = 0 ; i < PTE_PREFETCH_NUM; i++, spte++) {if (is_shadow_present_pte(*spte) || spte == sptep) {if (!start)continue ;if (!direct_pte_prefetch_many(vcpu, sp, start, spte))return ;else if (!start)if (start)static void direct_pte_prefetch(struct kvm_vcpu *vcpu, u64 *sptep)struct kvm_mmu_page *sp;/* * Without accessed bits , there ' s no way to distinguish between * actually accessed translations and prefetched , so disable pte * prefetch if accessed bits aren ' t available . if (sp_ad_disabled(sp))return ;if (sp->role.level > PG_LEVEL_4K)return ;/* * If addresses are being invalidated , skip prefetching to avoid * accidentally prefetching those addresses . if (unlikely(vcpu->kvm->mmu_invalidate_in_progress))return ;/* * Lookup the mapping level for @ gfn in the current mm . * * WARNING ! Use of host_pfn_mapping_level ( ) requires the caller and the end * consumer to be tied into KVM ' s handlers for MMU notifier events ! * * There are several ways to safely use this helper : * * - Check mmu_invalidate_retry_gfn ( ) after grabbing the mapping level , before * consuming it . In this case , mmu_lock doesn ' t need to be held during the * lookup , but it does need to be held while checking the MMU notifier . * * - Hold mmu_lock AND ensure there is no in - progress MMU notifier invalidation * event for the hva . This can be done by explicit checking the MMU notifier * or by ensuring that KVM already has a valid mapping that covers the hva . * * - Do not use the result to install new mappings , e . g . use the host mapping * level only to decide whether or not to zap an entry . In this case , it ' s * not required to hold mmu_lock ( though it ' s highly likely the caller will * want to hold mmu_lock anyways , e . g . to modify SPTEs ) . * * Note ! The lookup can still race with modifications to host page tables , but * the above " rules " ensure KVM will not _ consume_ the result of the walk if a * race with the primary MMU occurs . static int host_pfn_mapping_level(struct kvm *kvm, gfn_t gfn,const struct kvm_memory_slot *slot)int level = PG_LEVEL_4K;unsigned long hva;unsigned long flags;/* * Note , using the already - retrieved memslot and _ _ gfn_to_hva_memslot ( ) * is not solely for performance , it ' s also necessary to avoid the * " writable " check in _ _ gfn_to_hva_many ( ) , which will always fail on * read - only memslots due to gfn_to_hva ( ) assuming writes . Earlier * page fault steps have already verified the guest isn ' t writing a * read - only memslot . /* * Disable IRQs to prevent concurrent tear down of host page tables , * e . g . if the primary MMU promotes a P * D to a huge page and then frees * the original page table . /* * Read each entry once . As above , a non - leaf entry can be promoted to * a huge page _ during_ this walk . Re - reading the entry could send the * walk into the weeks , e . g . p * d_leaf ( ) returns false ( sees the old * value ) and then p * d_offset ( ) walks into the target huge page instead * of the old page table ( sees the new value ) . if (pgd_none(pgd))goto out;if (p4d_none(p4d) || !p4d_present(p4d))goto out;if (pud_none(pud) || !pud_present(pud))goto out;if (pud_leaf(pud)) {goto out;if (pmd_none(pmd) || !pmd_present(pmd))goto out;if (pmd_leaf(pmd))return level;static int __kvm_mmu_max_mapping_level(struct kvm *kvm,const struct kvm_memory_slot *slot,int max_level, bool is_private)struct kvm_lpage_info *linfo;int host_level;for ( ; max_level > PG_LEVEL_4K; max_level--) {if (!linfo->disallow_lpage)break ;if (is_private)return max_level;if (max_level == PG_LEVEL_4K)return PG_LEVEL_4K;return min(host_level, max_level);int kvm_mmu_max_mapping_level(struct kvm *kvm,const struct kvm_memory_slot *slot, gfn_t gfn)bool is_private = kvm_slot_can_be_private(slot) &&return __kvm_mmu_max_mapping_level(kvm, slot, gfn, PG_LEVEL_NUM, is_private);void kvm_mmu_hugepage_adjust(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault)struct kvm_memory_slot *slot = fault->slot;if (unlikely(fault->max_level == PG_LEVEL_4K))return ;if (is_error_noslot_pfn(fault->pfn))return ;if (kvm_slot_dirty_track_enabled(slot))return ;/* * Enforce the iTLB multihit workaround after capturing the requested * level , which will be used to do precise , accurate accounting . if (fault->req_level == PG_LEVEL_4K || fault->huge_page_disallowed)return ;/* * mmu_invalidate_retry ( ) was successful and mmu_lock is held , so * the pmd can ' t be split from under us . 1 ;void disallowed_hugepage_adjust(struct kvm_page_fault *fault, u64 spte, int cur_level)if (cur_level > PG_LEVEL_4K &&/* * A small SPTE exists for this pfn , but FNAME ( fetch ) , * direct_map ( ) , or kvm_tdp_mmu_map ( ) would like to create a * large PTE instead : just force them to go down another level , * patching back for them into pfn the next 9 bits of the * address . 1 );static int direct_map(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault)struct kvm_shadow_walk_iterator it;struct kvm_mmu_page *sp;int ret;/* * We cannot overwrite existing page tables with an NX * large page , as the leaf could be executable . if (fault->nx_huge_page_workaround_enabled)if (it.level == fault->goal_level)break ;true , ACC_ALL);if (sp == ERR_PTR(-EEXIST))continue ;if (fault->huge_page_disallowed)if (WARN_ON_ONCE(it.level != fault->goal_level))return -EFAULT;if (ret == RET_PF_SPURIOUS)return ret;return ret;static void kvm_send_hwpoison_signal(struct kvm_memory_slot *slot, gfn_t gfn)unsigned long hva = gfn_to_hva_memslot(slot, gfn);void __user *)hva, PAGE_SHIFT, current);static int kvm_handle_error_pfn(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault)if (is_sigpending_pfn(fault->pfn)) {return -EINTR;/* * Do not cache the mmio info caused by writing the readonly gfn * into the spte otherwise read access on readonly gfn also can * caused mmio page fault and treat it as mmio access . if (fault->pfn == KVM_PFN_ERR_RO_FAULT)return RET_PF_EMULATE;if (fault->pfn == KVM_PFN_ERR_HWPOISON) {return RET_PF_RETRY;return -EFAULT;static int kvm_handle_noslot_fault(struct kvm_vcpu *vcpu,struct kvm_page_fault *fault,unsigned int access)0 : fault->addr;if (fault->is_private) {return -EFAULT;false ;/* * If MMIO caching is disabled , emulate immediately without * touching the shadow page tables as attempting to install an * MMIO SPTE will just be an expensive nop . if (unlikely(!enable_mmio_caching))return RET_PF_EMULATE;/* * Do not create an MMIO SPTE for a gfn greater than host . MAXPHYADDR , * any guest that generates such gfns is running nested and is being * tricked by L0 userspace ( you can observe gfn > L1 . MAXPHYADDR if and * only if L1 ' s MAXPHYADDR is inaccurate with respect to the * hardware ' s ) . if (unlikely(fault->gfn > kvm_mmu_max_gfn()))return RET_PF_EMULATE;return RET_PF_CONTINUE;static bool page_fault_can_be_fast(struct kvm *kvm, struct kvm_page_fault *fault)/* * Page faults with reserved bits set , i . e . faults on MMIO SPTEs , only * reach the common page fault handler if the SPTE has an invalid MMIO * generation number . Refreshing the MMIO generation needs to go down * the slow path . Note , EPT Misconfigs do NOT set the PRESENT flag ! if (fault->rsvd)return false ;/* * For hardware - protected VMs , certain conditions like attempting to * perform a write to a page which is not in the state that the guest * expects it to be in can result in a nested / extended # PF . In this * case , the below code might misconstrue this situation as being the * result of a write - protected access , and treat it as a spurious case * rather than taking any action to satisfy the real source of the # PF * such as generating a KVM_EXIT_MEMORY_FAULT . This can lead to the * guest spinning on a # PF indefinitely , so don ' t attempt the fast path * in this case . * * Note that the kvm_mem_is_private ( ) check might race with an * attribute update , but this will either result in the guest spinning * on RET_PF_SPURIOUS until the update completes , or an actual spurious * case might go down the slow path . Either case will resolve itself . if (kvm->arch.has_private_mem &&return false ;/* * # PF can be fast if : * * 1 . The shadow page table entry is not present and A / D bits are * disabled _ by KVM_ , which could mean that the fault is potentially * caused by access tracking ( if enabled ) . If A / D bits are enabled * by KVM , but disabled by L1 for L2 , KVM is forced to disable A / D * bits for L2 and employ access tracking , but the fast page fault * mechanism only supports direct MMUs . * 2 . The shadow page table entry is present , the access is a write , * and no reserved bits are set ( MMIO SPTEs cannot be " fixed " ) , i . e . * the fault was caused by a write - protection violation . If the * SPTE is MMU - writable ( determined later ) , the fault can be fixed * by setting the Writable bit , which can be done out of mmu_lock . if (!fault->present)return !kvm_ad_enabled;/* * Note , instruction fetches and writes are mutually exclusive , ignore * the " exec " flag . return fault->write;/* * Returns true if the SPTE was fixed successfully . Otherwise , * someone else modified the SPTE from its original value . static bool fast_pf_fix_direct_spte(struct kvm_vcpu *vcpu,struct kvm_page_fault *fault,/* * Theoretically we could also set dirty bit ( and flush TLB ) here in * order to eliminate unnecessary PML logging . See comments in * set_spte . But fast_page_fault is very unlikely to happen with PML * enabled , so we do not do this . This might result in the same GPA * to be logged in PML buffer again when the write really happens , and * eventually to be called by mark_page_dirty twice . But it ' s also no * harm . This also avoids the TLB flush needed after setting dirty bit * so non - PML cases won ' t be impacted . * * Compare with make_spte ( ) where instead shadow_dirty_mask is set . if (!try_cmpxchg64(sptep, &old_spte, new_spte))return false ;if (is_writable_pte(new_spte) && !is_writable_pte(old_spte))return true ;/* * Returns the last level spte pointer of the shadow page walk for the given * gpa , and sets * spte to the spte value . This spte may be non - preset . If no * walk could be performed , returns NULL and * spte does not contain valid data . * * Contract : * - Must be called between walk_shadow_page_lockless_ { begin , end } . * - The returned sptep must not be used after walk_shadow_page_lockless_end . static u64 *fast_pf_get_last_sptep(struct kvm_vcpu *vcpu, gpa_t gpa, u64 *spte)struct kvm_shadow_walk_iterator iterator;return sptep;/* * Returns one of RET_PF_INVALID , RET_PF_FIXED or RET_PF_SPURIOUS . static int fast_page_fault(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault)struct kvm_mmu_page *sp;int ret = RET_PF_INVALID;0 ;if (!page_fault_can_be_fast(vcpu->kvm, fault))return ret;do {if (tdp_mmu_enabled)else /* * It ' s entirely possible for the mapping to have been zapped * by a different task , but the root page should always be * available as the vCPU holds a reference to its root ( s ) . if (WARN_ON_ONCE(!sptep))if (!is_shadow_present_pte(spte))break ;if (!is_last_spte(spte, sp->role.level))break ;/* * Check whether the memory access that caused the fault would * still cause it if it were to be performed right now . If not , * then this is a spurious fault caused by TLB lazily flushed , * or some other CPU has already fixed the PTE after the * current CPU took the fault . * * Need not check the access of upper level table entries since * they are always ACC_ALL . if (is_access_allowed(fault, spte)) {break ;/* * KVM only supports fixing page faults outside of MMU lock for * direct MMUs , nested MMUs are always indirect , and KVM always * uses A / D bits for non - nested MMUs . Thus , if A / D bits are * enabled , the SPTE can ' t be an access - tracked SPTE . if (unlikely(!kvm_ad_enabled) && is_access_track_spte(spte))/* * To keep things simple , only SPTEs that are MMU - writable can * be made fully writable outside of mmu_lock , e . g . only SPTEs * that were write - protected for dirty - logging or access * tracking are handled here . Don ' t bother checking if the * SPTE is writable to prioritize running with A / D bits enabled . * The is_access_allowed ( ) check above handles the common case * of the fault being spurious , and the SPTE is known to be * shadow - present , i . e . except for access tracking restoration * making the new SPTE writable , the check is wasteful . if (fault->write && is_mmu_writable_spte(spte)) {/* * Do not fix write - permission on the large spte when * dirty logging is enabled . Since we only dirty the * first page into the dirty - bitmap in * fast_pf_fix_direct_spte ( ) , other pages are missed * if its slot has dirty logging enabled . * * Instead , we let the slow page fault path create a * normal spte to fix the access . if (sp->role.level > PG_LEVEL_4K &&break ;/* Verify that the fault can be handled in the fast path */ if (new_spte == spte ||break ;/* * Currently , fast page fault only works for direct mapping * since the gfn is not stable for indirect shadow page . See * Documentation / virt / kvm / locking . rst to get more detail . if (fast_pf_fix_direct_spte(vcpu, fault, sptep, spte, new_spte)) {break ;if (++retry_count > 4 ) {"Fast #PF retrying more than 4 times.\n" );break ;while (true );if (ret != RET_PF_INVALID)return ret;static void mmu_free_root_page(struct kvm *kvm, hpa_t *root_hpa,struct list_head *invalid_list)struct kvm_mmu_page *sp;if (!VALID_PAGE(*root_hpa))return ;if (WARN_ON_ONCE(!sp))return ;if (is_tdp_mmu_page(sp)) {else {if (!--sp->root_count && sp->role.invalid)/* roots_to_free must be some combination of the KVM_MMU_ROOT_* flags */ void kvm_mmu_free_roots(struct kvm *kvm, struct kvm_mmu *mmu,bool is_tdp_mmu = tdp_mmu_enabled && mmu->root_role.direct;int i;bool free_active_root;/* Before acquiring the MMU lock, see if we need to do any real work. */ if (!free_active_root) {for (i = 0 ; i < KVM_MMU_NUM_PREV_ROOTS; i++)if ((roots_to_free & KVM_MMU_ROOT_PREVIOUS(i)) &&break ;if (i == KVM_MMU_NUM_PREV_ROOTS)return ;if (is_tdp_mmu)else for (i = 0 ; i < KVM_MMU_NUM_PREV_ROOTS; i++)if (roots_to_free & KVM_MMU_ROOT_PREVIOUS(i))if (free_active_root) {if (kvm_mmu_is_dummy_root(mmu->root.hpa)) {/* Nothing to cleanup for dummy roots. */ else if (root_to_sp(mmu->root.hpa)) {else if (mmu->pae_root) {for (i = 0 ; i < 4 ; ++i) {if (!IS_VALID_PAE_ROOT(mmu->pae_root[i]))continue ;0 ;if (is_tdp_mmu) {else {void kvm_mmu_free_guest_mode_roots(struct kvm *kvm, struct kvm_mmu *mmu)unsigned long roots_to_free = 0 ;struct kvm_mmu_page *sp;int i;/* * This should not be called while L2 is active , L2 can ' t invalidate * _ only_ its own roots , e . g . INVVPID unconditionally exits . for (i = 0 ; i < KVM_MMU_NUM_PREV_ROOTS; i++) {if (!VALID_PAGE(root_hpa))continue ;if (!sp || sp->role.guest_mode)static hpa_t mmu_alloc_root(struct kvm_vcpu *vcpu, gfn_t gfn, int quadrant,union kvm_mmu_page_role role = vcpu->arch.mmu->root_role;struct kvm_mmu_page *sp;return __pa(sp->spt);static int mmu_alloc_direct_roots(struct kvm_vcpu *vcpu)struct kvm_mmu *mmu = vcpu->arch.mmu;unsigned i;int r;if (tdp_mmu_enabled) {if (kvm_has_mirrored_tdp(vcpu->kvm) &&true );false );return 0 ;if (r < 0 )goto out_unlock;if (shadow_root_level >= PT64_ROOT_4LEVEL) {0 , 0 , shadow_root_level);else if (shadow_root_level == PT32E_ROOT_LEVEL) {if (WARN_ON_ONCE(!mmu->pae_root)) {goto out_unlock;for (i = 0 ; i < 4 ; ++i) {30 - PAGE_SHIFT), 0 ,else {1 , "Bad TDP root level = %d\n" , shadow_root_level);goto out_unlock;/* root.pgd is ignored for direct MMUs. */ 0 ;return r;static int kvm_mmu_alloc_page_hash(struct kvm *kvm)struct hlist_head *h;if (kvm->arch.mmu_page_hash)return 0 ;sizeof (*h), GFP_KERNEL_ACCOUNT);if (!h)return -ENOMEM;/* * Ensure the hash table pointer is set only after all stores to zero * the memory are retired . Pairs with the smp_load_acquire ( ) in * kvm_get_mmu_page_hash ( ) . Note , mmu_lock must be held for write to * add ( or remove ) shadow pages , and so readers are guaranteed to see * an empty list for their current mmu_lock critical section . return 0 ;static int mmu_first_shadow_root_alloc(struct kvm *kvm)struct kvm_memslots *slots;struct kvm_memory_slot *slot;int r = 0 , i, bkt;/* * Check if this is the first shadow root being allocated before * taking the lock . if (kvm_shadow_root_allocated(kvm))return 0 ;/* Recheck, under the lock, whether this is the first shadow root. */ if (kvm_shadow_root_allocated(kvm))goto out_unlock;if (r)goto out_unlock;/* * Check if memslot metadata actually needs to be allocated , e . g . all * metadata will be allocated upfront if TDP is disabled . if (kvm_memslots_have_rmaps(kvm) &&goto out_success;for (i = 0 ; i < kvm_arch_nr_memslot_as_ids(kvm); i++) {/* * Both of these functions are no - ops if the target is * already allocated , so unconditionally calling both * is safe . Intentionally do NOT free allocations on * failure to avoid having to track which allocations * were made now versus when the memslot was created . * The metadata is guaranteed to be freed when the slot * is freed , and will be kept / used if userspace retries * KVM_RUN instead of killing the VM . if (r)goto out_unlock;if (r)goto out_unlock;/* * Ensure that shadow_root_allocated becomes true strictly after * all the related pointers are set . true );return r;static int mmu_alloc_shadow_roots(struct kvm_vcpu *vcpu)struct kvm_mmu *mmu = vcpu->arch.mmu;4 ], pm_mask;int quadrant, i, r;if (!kvm_vcpu_is_visible_gfn(vcpu, root_gfn)) {return 0 ;/* * On SVM , reading PDPTRs might access guest memory , which might fault * and thus might sleep . Grab the PDPTRs before acquiring mmu_lock . if (mmu->cpu_role.base.level == PT32E_ROOT_LEVEL) {for (i = 0 ; i < 4 ; ++i) {if (!(pdptrs[i] & PT_PRESENT_MASK))continue ;if (!kvm_vcpu_is_visible_gfn(vcpu, pdptrs[i] >> PAGE_SHIFT))0 ;if (r)return r;if (r < 0 )goto out_unlock;/* * Do we shadow a long mode page table ? If so we need to * write - protect the guests page table root . if (mmu->cpu_role.base.level >= PT64_ROOT_4LEVEL) {0 ,goto set_root_pgd;if (WARN_ON_ONCE(!mmu->pae_root)) {goto out_unlock;/* * We shadow a 32 bit page table . This may be a legacy 2 - level * or a PAE 3 - level page table . In either case we need to be aware that * the shadow page table may be a PAE or a long mode page table . if (mmu->root_role.level >= PT64_ROOT_4LEVEL) {if (WARN_ON_ONCE(!mmu->pml4_root)) {goto out_unlock;0 ] = __pa(mmu->pae_root) | pm_mask;if (mmu->root_role.level == PT64_ROOT_5LEVEL) {if (WARN_ON_ONCE(!mmu->pml5_root)) {goto out_unlock;0 ] = __pa(mmu->pml4_root) | pm_mask;for (i = 0 ; i < 4 ; ++i) {if (mmu->cpu_role.base.level == PT32E_ROOT_LEVEL) {if (!(pdptrs[i] & PT_PRESENT_MASK)) {continue ;/* * If shadowing 32 - bit non - PAE page tables , each PAE page * directory maps one quarter of the guest ' s non - PAE page * directory . Othwerise each PAE page direct shadows one guest * PAE page directory so that quadrant should be 0 . 0 ;if (mmu->root_role.level == PT64_ROOT_5LEVEL)else if (mmu->root_role.level == PT64_ROOT_4LEVEL)else return r;static int mmu_alloc_special_roots(struct kvm_vcpu *vcpu)struct kvm_mmu *mmu = vcpu->arch.mmu;bool need_pml5 = mmu->root_role.level > PT64_ROOT_4LEVEL;/* * When shadowing 32 - bit or PAE NPT with 64 - bit NPT , the PML4 and PDP * tables are allocated and initialized at root creation as there is no * equivalent level in the guest ' s NPT to shadow . Allocate the tables * on demand , as running a 32 - bit L1 VMM on 64 - bit KVM is very rare . if (mmu->root_role.direct ||return 0 ;/* * NPT , the only paging mode that uses this horror , uses a fixed number * of levels for the shadow page tables , e . g . all MMUs are 4 - level or * all MMus are 5 - level . Thus , this can safely require that pml5_root * is allocated if the other roots are valid and pml5 is needed , as any * prior MMU would also have required pml5 . if (mmu->pae_root && mmu->pml4_root && (!need_pml5 || mmu->pml5_root))return 0 ;/* * The special roots should always be allocated in concert . Yell and * bail if KVM ends up in a state where only one of the roots is valid . if (WARN_ON_ONCE(!tdp_enabled || mmu->pae_root || mmu->pml4_root ||return -EIO;/* * Unlike 32 - bit NPT , the PDP table doesn ' t need to be in low mem , and * doesn ' t need to be decrypted . void *)get_zeroed_page(GFP_KERNEL_ACCOUNT);if (!pae_root)return -ENOMEM;#ifdef CONFIG_X86_64void *)get_zeroed_page(GFP_KERNEL_ACCOUNT);if (!pml4_root)goto err_pml4;if (need_pml5) {void *)get_zeroed_page(GFP_KERNEL_ACCOUNT);if (!pml5_root)goto err_pml5;#endif return 0 ;#ifdef CONFIG_X86_64unsigned long )pml4_root);unsigned long )pae_root);return -ENOMEM;#endif static bool is_unsync_root(hpa_t root)struct kvm_mmu_page *sp;if (!VALID_PAGE(root) || kvm_mmu_is_dummy_root(root))return false ;/* * The read barrier orders the CPU ' s read of SPTE . W during the page table * walk before the reads of sp - > unsync / sp - > unsync_children here . * * Even if another CPU was marking the SP as unsync - ed simultaneously , * any guest page table changes are not guaranteed to be visible anyway * until this VCPU issues a TLB flush strictly after those changes are * made . We only need to ensure that the other CPU sets these flags * before any actual changes to the page tables are made . The comments * in mmu_try_to_unsync_pages ( ) describe what could go wrong if this * requirement isn ' t satisfied . /* * PAE roots ( somewhat arbitrarily ) aren ' t backed by shadow pages , the * PDPTEs for a given PAE root need to be synchronized individually . if (WARN_ON_ONCE(!sp))return false ;if (sp->unsync || sp->unsync_children)return true ;return false ;void kvm_mmu_sync_roots(struct kvm_vcpu *vcpu)int i;struct kvm_mmu_page *sp;if (vcpu->arch.mmu->root_role.direct)return ;if (!VALID_PAGE(vcpu->arch.mmu->root.hpa))return ;if (vcpu->arch.mmu->cpu_role.base.level >= PT64_ROOT_4LEVEL) {if (!is_unsync_root(root))return ;true );return ;for (i = 0 ; i < 4 ; ++i) {if (IS_VALID_PAE_ROOT(root)) {true );void kvm_mmu_sync_prev_roots(struct kvm_vcpu *vcpu)unsigned long roots_to_free = 0 ;int i;for (i = 0 ; i < KVM_MMU_NUM_PREV_ROOTS; i++)if (is_unsync_root(vcpu->arch.mmu->prev_roots[i].hpa))/* sync prev_roots by simply freeing them */ static gpa_t nonpaging_gva_to_gpa(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu,struct x86_exception *exception)if (exception)0 ;return kvm_translate_gpa(vcpu, mmu, vaddr, access, exception);static bool mmio_info_in_cache(struct kvm_vcpu *vcpu, u64 addr, bool direct)/* * A nested guest cannot use the MMIO cache if it is using nested * page tables , because cr2 is a nGPA while the cache stores GPAs . if (mmu_is_nested(vcpu))return false ;if (direct)return vcpu_match_mmio_gpa(vcpu, addr);return vcpu_match_mmio_gva(vcpu, addr);/* * Return the level of the lowest level SPTE added to sptes . * That SPTE may be non - present . * * Must be called between walk_shadow_page_lockless_ { begin , end } . static int get_walk(struct kvm_vcpu *vcpu, u64 addr, u64 *sptes, int *root_level)struct kvm_shadow_walk_iterator iterator;int leaf = -1 ;for (shadow_walk_init(&iterator, vcpu, addr),return leaf;static int get_sptes_lockless(struct kvm_vcpu *vcpu, u64 addr, u64 *sptes,int *root_level)int leaf;if (is_tdp_mmu_active(vcpu))else return leaf;/* return true if reserved bit(s) are detected on a valid, non-MMIO SPTE. */ static bool get_mmio_spte(struct kvm_vcpu *vcpu, u64 addr, u64 *sptep)1 ];struct rsvd_bits_validate *rsvd_check;int root, leaf, level;bool reserved = false ;if (unlikely(leaf < 0 )) {0 ull;return reserved;/* * Skip reserved bits checks on the terminal leaf if it ' s not a valid * SPTE . Note , this also ( intentionally ) skips MMIO SPTEs , which , by * design , always have reserved bits set . The purpose of the checks is * to detect reserved bits on non - MMIO SPTEs . i . e . buggy SPTEs . if (!is_shadow_present_pte(sptes[leaf]))for (level = root; level >= leaf; level--)if (reserved) {"%s: reserved bits set on MMU-present spte, addr 0x%llx, hierarchy:\n" ,for (level = root; level >= leaf; level--)"------ spte = 0x%llx level = %d, rsvd bits = 0x%llx" ,return reserved;static int handle_mmio_page_fault(struct kvm_vcpu *vcpu, u64 addr, bool direct)bool reserved;if (mmio_info_in_cache(vcpu, addr, direct))return RET_PF_EMULATE;if (WARN_ON_ONCE(reserved))return -EINVAL;if (is_mmio_spte(vcpu->kvm, spte)) {unsigned int access = get_mmio_spte_access(spte);if (!check_mmio_spte(vcpu, spte))return RET_PF_INVALID;if (direct)0 ;return RET_PF_EMULATE;/* * If the page table is zapped by other cpus , let CPU fault again on * the address . return RET_PF_RETRY;static bool page_fault_handle_page_track(struct kvm_vcpu *vcpu,struct kvm_page_fault *fault)if (unlikely(fault->rsvd))return false ;if (!fault->present || !fault->write)return false ;/* * guest is writing the page which is write tracked which can * not be fixed by page fault handler . if (kvm_gfn_is_write_tracked(vcpu->kvm, fault->slot, fault->gfn))return true ;return false ;static void shadow_page_table_clear_flood(struct kvm_vcpu *vcpu, gva_t addr)struct kvm_shadow_walk_iterator iterator;static u32 alloc_apf_token(struct kvm_vcpu *vcpu)/* make sure the token value is not 0 */ if (id << 12 == 0 )1 ;return (vcpu->arch.apf.id++ << 12 ) | vcpu->vcpu_id;static bool kvm_arch_setup_async_pf(struct kvm_vcpu *vcpu,struct kvm_page_fault *fault)struct kvm_arch_async_pf arch;return kvm_setup_async_pf(vcpu, fault->addr,void kvm_arch_async_page_ready(struct kvm_vcpu *vcpu, struct kvm_async_pf *work)int r;if (WARN_ON_ONCE(work->arch.error_code & PFERR_PRIVATE_ACCESS))return ;if ((vcpu->arch.mmu->root_role.direct != work->arch.direct_map) ||return ;if (unlikely(r))return ;if (!vcpu->arch.mmu->root_role.direct &&return ;true , NULL, NULL);/* * Account fixed page faults , otherwise they ' ll never be counted , but * ignore stats for all other return times . Page - ready " faults " aren ' t * truly spurious and never trigger emulation if (r == RET_PF_FIXED)static inline u8 kvm_max_level_for_order(int order)if (order >= KVM_HPAGE_GFN_SHIFT(PG_LEVEL_1G))return PG_LEVEL_1G;if (order >= KVM_HPAGE_GFN_SHIFT(PG_LEVEL_2M))return PG_LEVEL_2M;return PG_LEVEL_4K;static u8 kvm_max_private_mapping_level(struct kvm *kvm, kvm_pfn_t pfn,int gmem_order)if (max_level == PG_LEVEL_4K)return PG_LEVEL_4K;if (max_level == PG_LEVEL_4K)return PG_LEVEL_4K;if (req_max_level)return max_level;static void kvm_mmu_finish_page_fault(struct kvm_vcpu *vcpu,struct kvm_page_fault *fault, int r)static int kvm_mmu_faultin_pfn_private(struct kvm_vcpu *vcpu,struct kvm_page_fault *fault)int max_order, r;if (!kvm_slot_can_be_private(fault->slot)) {return -EFAULT;if (r) {return r;return RET_PF_CONTINUE;static int __kvm_mmu_faultin_pfn(struct kvm_vcpu *vcpu,struct kvm_page_fault *fault)unsigned int foll = fault->write ? FOLL_WRITE : 0 ;if (fault->is_private)return kvm_mmu_faultin_pfn_private(vcpu, fault);/* * If resolving the page failed because I / O is needed to fault - in the * page , then either set up an asynchronous # PF to do the I / O , or if * doing an async # PF isn ' t possible , retry with I / O allowed . All * other failures are terminal , i . e . retrying won ' t help . if (fault->pfn != KVM_PFN_ERR_NEEDS_IO)return RET_PF_CONTINUE;if (!fault->prefetch && kvm_can_do_async_pf(vcpu)) {if (kvm_find_async_pf_gfn(vcpu, fault->gfn)) {return RET_PF_RETRY;else if (kvm_arch_setup_async_pf(vcpu, fault)) {return RET_PF_RETRY;/* * Allow gup to bail on pending non - fatal signals when it ' s also allowed * to wait for IO . Note , gup always bails if it is unable to quickly * get a page and a fatal signal , i . e . SIGKILL , is pending . return RET_PF_CONTINUE;static int kvm_mmu_faultin_pfn(struct kvm_vcpu *vcpu,struct kvm_page_fault *fault, unsigned int access)struct kvm_memory_slot *slot = fault->slot;struct kvm *kvm = vcpu->kvm;int ret;if (KVM_BUG_ON(kvm_is_gfn_alias(kvm, fault->gfn), kvm))return -EFAULT;/* * Note that the mmu_invalidate_seq also serves to detect a concurrent * change in attributes . is_page_fault_stale ( ) will detect an * invalidation relate to fault - > fn and resume the guest without * installing a mapping in the page tables . /* * Now that we have a snapshot of mmu_invalidate_seq we can check for a * private vs . shared mismatch . if (fault->is_private != kvm_mem_is_private(kvm, fault->gfn)) {return -EFAULT;if (unlikely(!slot))return kvm_handle_noslot_fault(vcpu, fault, access);/* * Retry the page fault if the gfn hit a memslot that is being deleted * or moved . This ensures any existing SPTEs for the old memslot will * be zapped before KVM inserts a new MMIO SPTE for the gfn . if (slot->flags & KVM_MEMSLOT_INVALID)return RET_PF_RETRY;if (slot->id == APIC_ACCESS_PAGE_PRIVATE_MEMSLOT) {/* * Don ' t map L1 ' s APIC access page into L2 , KVM doesn ' t support * using APICv / AVIC to accelerate L2 accesses to L1 ' s APIC , * i . e . the access needs to be emulated . Emulating access to * L1 ' s APIC is also correct if L1 is accelerating L2 ' s own * virtual APIC , but for some reason L1 also maps _ L1 ' s_ APIC * into L2 . Note , vcpu_is_mmio_gpa ( ) always treats access to * the APIC as MMIO . Allow an MMIO SPTE to be created , as KVM * uses different roots for L1 vs . L2 , i . e . there is no danger * of breaking APICv / AVIC for L1 . if (is_guest_mode(vcpu))return kvm_handle_noslot_fault(vcpu, fault, access);/* * If the APIC access page exists but is disabled , go directly * to emulation without caching the MMIO access or creating a * MMIO SPTE . That way the cache doesn ' t need to be purged * when the AVIC is re - enabled . if (!kvm_apicv_activated(vcpu->kvm))return RET_PF_EMULATE;/* * Check for a relevant mmu_notifier invalidation event before getting * the pfn from the primary MMU , and before acquiring mmu_lock . * * For mmu_lock , if there is an in - progress invalidation and the kernel * allows preemption , the invalidation task may drop mmu_lock and yield * in response to mmu_lock being contended , which is * very * counter - * productive as this vCPU can ' t actually make forward progress until * the invalidation completes . * * Retrying now can also avoid unnessary lock contention in the primary * MMU , as the primary MMU doesn ' t necessarily hold a single lock for * the duration of the invalidation , i . e . faulting in a conflicting pfn * can cause the invalidation to take longer by holding locks that are * needed to complete the invalidation . * * Do the pre - check even for non - preemtible kernels , i . e . even if KVM * will never yield mmu_lock in response to contention , as this vCPU is * * guaranteed * to need to retry , i . e . waiting until mmu_lock is held * to detect retry guarantees the worst case latency for the vCPU . if (mmu_invalidate_retry_gfn_unsafe(kvm, fault->mmu_seq, fault->gfn))return RET_PF_RETRY;if (ret != RET_PF_CONTINUE)return ret;if (unlikely(is_error_pfn(fault->pfn)))return kvm_handle_error_pfn(vcpu, fault);if (WARN_ON_ONCE(!fault->slot || is_noslot_pfn(fault->pfn)))return kvm_handle_noslot_fault(vcpu, fault, access);/* * Check again for a relevant mmu_notifier invalidation event purely to * avoid contending mmu_lock . Most invalidations will be detected by * the previous check , but checking is extremely cheap relative to the * overall cost of failing to detect the invalidation until after * mmu_lock is acquired . if (mmu_invalidate_retry_gfn_unsafe(kvm, fault->mmu_seq, fault->gfn)) {return RET_PF_RETRY;return RET_PF_CONTINUE;/* * Returns true if the page fault is stale and needs to be retried , i . e . if the * root was invalidated by a memslot update or a relevant mmu_notifier fired . static bool is_page_fault_stale(struct kvm_vcpu *vcpu,struct kvm_page_fault *fault)struct kvm_mmu_page *sp = root_to_sp(vcpu->arch.mmu->root.hpa);/* Special roots, e.g. pae_root, are not backed by shadow pages. */ if (sp && is_obsolete_sp(vcpu->kvm, sp))return true ;/* * Roots without an associated shadow page are considered invalid if * there is a pending request to free obsolete roots . The request is * only a hint that the current root _ may_ be obsolete and needs to be * reloaded , e . g . if the guest frees a PGD that KVM is tracking as a * previous root , then _ _ kvm_mmu_prepare_zap_page ( ) signals all vCPUs * to reload even if no vCPU is actively using the root . if (!sp && kvm_test_request(KVM_REQ_MMU_FREE_OBSOLETE_ROOTS, vcpu))return true ;/* * Check for a relevant mmu_notifier invalidation event one last time * now that mmu_lock is held , as the " unsafe " checks performed without * holding mmu_lock can get false negatives . return fault->slot &&static int direct_page_fault(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault)int r;/* Dummy roots are used only for shadowing bad guest roots. */ if (WARN_ON_ONCE(kvm_mmu_is_dummy_root(vcpu->arch.mmu->root.hpa)))return RET_PF_RETRY;if (page_fault_handle_page_track(vcpu, fault))return RET_PF_WRITE_PROTECTED;if (r != RET_PF_INVALID)return r;false );if (r)return r;if (r != RET_PF_CONTINUE)return r;if (is_page_fault_stale(vcpu, fault))goto out_unlock;if (r)goto out_unlock;return r;static int nonpaging_page_fault(struct kvm_vcpu *vcpu,struct kvm_page_fault *fault)/* This path builds a PAE pagetable, we can map 2mb pages at maximum. */ return direct_page_fault(vcpu, fault);int kvm_handle_page_fault(struct kvm_vcpu *vcpu, u64 error_code,char *insn, int insn_len)int r = 1 ;#ifndef CONFIG_X86_64/* A 64-bit CR2 should be impossible on 32-bit KVM. */ if (WARN_ON_ONCE(fault_address >> 32 ))return -EFAULT;#endif /* * Legacy # PF exception only have a 32 - bit error code . Simply drop the * upper bits as KVM doesn ' t use them for # PF ( because they are never * set ) , and to ensure there are no collisions with KVM - defined bits . if (WARN_ON_ONCE(error_code >> 32 ))/* * Restrict KVM - defined flags to bits 63 : 32 so that it ' s impossible for * them to conflict with # PF error codes , which are limited to 32 bits . true ;if (!flags) {else if (flags & KVM_PV_REASON_PAGE_NOT_PRESENT) {0 ;else {1 , "Unexpected host async PF flags: %x\n" , flags);return r;#ifdef CONFIG_X86_64static int kvm_tdp_mmu_page_fault(struct kvm_vcpu *vcpu,struct kvm_page_fault *fault)int r;if (page_fault_handle_page_track(vcpu, fault))return RET_PF_WRITE_PROTECTED;if (r != RET_PF_INVALID)return r;false );if (r)return r;if (r != RET_PF_CONTINUE)return r;if (is_page_fault_stale(vcpu, fault))goto out_unlock;return r;#endif int kvm_tdp_page_fault(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault)#ifdef CONFIG_X86_64if (tdp_mmu_enabled)return kvm_tdp_mmu_page_fault(vcpu, fault);#endif return direct_page_fault(vcpu, fault);int kvm_tdp_map_page(struct kvm_vcpu *vcpu, gpa_t gpa, u64 error_code, u8 *level)int r;/* * Restrict to TDP page fault , since that ' s the only case where the MMU * is indexed by GPA . if (vcpu->arch.mmu->page_fault != kvm_tdp_page_fault)return -EOPNOTSUPP;do {if (signal_pending(current))return -EINTR;if (kvm_check_request(KVM_REQ_VM_DEAD, vcpu))return -EIO;true , NULL, level);while (r == RET_PF_RETRY);if (r < 0 )return r;switch (r) {case RET_PF_FIXED:case RET_PF_SPURIOUS:case RET_PF_WRITE_PROTECTED:return 0 ;case RET_PF_EMULATE:return -ENOENT;case RET_PF_RETRY:case RET_PF_CONTINUE:case RET_PF_INVALID:default :1 , "could not fix page fault during prefault" );return -EIO;long kvm_arch_vcpu_pre_fault_memory(struct kvm_vcpu *vcpu,struct kvm_pre_fault_memory *range)int r;if (!vcpu->kvm->arch.pre_fault_allowed)return -EOPNOTSUPP;if (kvm_is_gfn_alias(vcpu->kvm, gpa_to_gfn(range->gpa)))return -EINVAL;/* * reload is efficient when called repeatedly , so we can do it on * every iteration . if (r)return r;0 ;if (kvm_arch_has_private_mem(vcpu->kvm) &&else /* * Shadow paging uses GVA for kvm page fault , so restrict to * two - dimensional paging . if (r < 0 )return r;/* * If the mapping that covers range - > gpa can use a huge page , it * may start below it or end after range - > gpa + range - > size . return min(range->size, end - range->gpa);static void nonpaging_init_context(struct kvm_mmu *context)static inline bool is_root_usable(struct kvm_mmu_root_info *root, gpa_t pgd,union kvm_mmu_page_role role)struct kvm_mmu_page *sp;if (!VALID_PAGE(root->hpa))return false ;if (!role.direct && pgd != root->pgd)return false ;if (WARN_ON_ONCE(!sp))return false ;return role.word == sp->role.word;/* * Find out if a previously cached root matching the new pgd / role is available , * and insert the current root as the MRU in the cache . * If a matching root is found , it is assigned to kvm_mmu - > root and * true is returned . * If no match is found , kvm_mmu - > root is left invalid , the LRU root is * evicted to make room for the current root , and false is returned . static bool cached_root_find_and_keep_current(struct kvm *kvm, struct kvm_mmu *mmu,union kvm_mmu_page_role new_role)if (is_root_usable(&mmu->root, new_pgd, new_role))return true ;for (i = 0 ; i < KVM_MMU_NUM_PREV_ROOTS; i++) {/* * The swaps end up rotating the cache like this : * C 0 1 2 3 ( on entry to the function ) * 0 C 1 2 3 * 1 C 0 2 3 * 2 C 0 1 3 * 3 C 0 1 2 ( on exit from the loop ) if (is_root_usable(&mmu->root, new_pgd, new_role))return true ;return false ;/* * Find out if a previously cached root matching the new pgd / role is available . * On entry , mmu - > root is invalid . * If a matching root is found , it is assigned to kvm_mmu - > root , the LRU entry * of the cache becomes invalid , and true is returned . * If no match is found , kvm_mmu - > root is left invalid and false is returned . static bool cached_root_find_without_current(struct kvm *kvm, struct kvm_mmu *mmu,union kvm_mmu_page_role new_role)for (i = 0 ; i < KVM_MMU_NUM_PREV_ROOTS; i++)if (is_root_usable(&mmu->prev_roots[i], new_pgd, new_role))goto hit;return false ;/* Bubble up the remaining roots. */ for (; i < KVM_MMU_NUM_PREV_ROOTS - 1 ; i++)1 ];return true ;static bool fast_pgd_switch(struct kvm *kvm, struct kvm_mmu *mmu,union kvm_mmu_page_role new_role)/* * Limit reuse to 64 - bit hosts + VMs without " special " roots in order to * avoid having to deal with PDPTEs and other complexities . if (VALID_PAGE(mmu->root.hpa) && !root_to_sp(mmu->root.hpa))if (VALID_PAGE(mmu->root.hpa))return cached_root_find_and_keep_current(kvm, mmu, new_pgd, new_role);else return cached_root_find_without_current(kvm, mmu, new_pgd, new_role);void kvm_mmu_new_pgd(struct kvm_vcpu *vcpu, gpa_t new_pgd)struct kvm_mmu *mmu = vcpu->arch.mmu;union kvm_mmu_page_role new_role = mmu->root_role;/* * Return immediately if no usable root was found , kvm_mmu_reload ( ) * will establish a valid root prior to the next VM - Enter . if (!fast_pgd_switch(vcpu->kvm, mmu, new_pgd, new_role))return ;/* * It ' s possible that the cached previous root page is obsolete because * of a change in the MMU generation number . However , changing the * generation number is accompanied by KVM_REQ_MMU_FREE_OBSOLETE_ROOTS , * which will free the root set here and allocate a new one . if (force_flush_and_sync_on_reuse) {/* * The last MMIO access ' s GVA and GPA are cached in the VCPU . When * switching to a new CR3 , that GVA - > GPA mapping may no longer be * valid . So clear any cached MMIO info even when we don ' t need to sync * the shadow page tables . /* * If this is a direct root page , it doesn ' t have a write flooding * count . Otherwise , clear the write flooding count . if (!new_role.direct) {struct kvm_mmu_page *sp = root_to_sp(vcpu->arch.mmu->root.hpa);if (!WARN_ON_ONCE(!sp))static bool sync_mmio_spte(struct kvm_vcpu *vcpu, u64 *sptep, gfn_t gfn,unsigned int access)if (unlikely(is_mmio_spte(vcpu->kvm, *sptep))) {if (gfn != get_mmio_spte_gfn(*sptep)) {return true ;return true ;return false ;#define PTTYPE_EPT 18 /* arbitrary */ #define PTTYPE PTTYPE_EPT#include "paging_tmpl.h" #undef PTTYPE#define PTTYPE 64 #include "paging_tmpl.h" #undef PTTYPE#define PTTYPE 32 #include "paging_tmpl.h" #undef PTTYPEstatic void __reset_rsvds_bits_mask(struct rsvd_bits_validate *rsvd_check,int level, bool nx,bool gbpages, bool pse, bool amd)0 ;0 ;0 ;if (!gbpages)7 , 7 );if (level == PT32E_ROOT_LEVEL)0 , 62 );else 0 , 51 );/* Note, NX doesn't exist in PDPTEs, this is handled below. */ if (!nx)63 , 63 );/* * Non - leaf PML4Es and PDPEs reserve bit 8 ( which would be the G bit for * leaf entries ) on AMD CPUs only . if (amd)8 , 8 );switch (level) {case PT32_ROOT_LEVEL:/* no rsvd bits for 2 level 4K page table entries */ 0 ][1 ] = 0 ;0 ][0 ] = 0 ;1 ][0 ] =0 ][0 ];if (!pse) {1 ][1 ] = 0 ;break ;if (is_cpuid_PSE36())/* 36bits PSE 4MB page */ 1 ][1 ] = rsvd_bits(17 , 21 );else /* 32 bits PSE 4MB page */ 1 ][1 ] = rsvd_bits(13 , 21 );break ;case PT32E_ROOT_LEVEL:0 ][2 ] = rsvd_bits(63 , 63 ) |5 , 8 ) |1 , 2 ); /* PDPTE */ 0 ][1 ] = high_bits_rsvd; /* PDE */ 0 ][0 ] = high_bits_rsvd; /* PTE */ 1 ][1 ] = high_bits_rsvd |13 , 20 ); /* large page */ 1 ][0 ] =0 ][0 ];break ;case PT64_ROOT_5LEVEL:0 ][4 ] = high_bits_rsvd |7 , 7 );1 ][4 ] =0 ][4 ];case PT64_ROOT_4LEVEL:0 ][3 ] = high_bits_rsvd |7 , 7 );0 ][2 ] = high_bits_rsvd |0 ][1 ] = high_bits_rsvd;0 ][0 ] = high_bits_rsvd;1 ][3 ] =0 ][3 ];1 ][2 ] = high_bits_rsvd |13 , 29 );1 ][1 ] = high_bits_rsvd |13 , 20 ); /* large page */ 1 ][0 ] =0 ][0 ];break ;static void reset_guest_rsvds_bits_mask(struct kvm_vcpu *vcpu,struct kvm_mmu *context)static void __reset_rsvds_bits_mask_ept(struct rsvd_bits_validate *rsvd_check,bool execonly,int huge_page_level)0 , 51 );0 , large_2m_rsvd = 0 ;if (huge_page_level < PG_LEVEL_1G)7 , 7 );if (huge_page_level < PG_LEVEL_2M)7 , 7 );0 ][4 ] = high_bits_rsvd | rsvd_bits(3 , 7 );0 ][3 ] = high_bits_rsvd | rsvd_bits(3 , 7 );0 ][2 ] = high_bits_rsvd | rsvd_bits(3 , 6 ) | large_1g_rsvd;0 ][1 ] = high_bits_rsvd | rsvd_bits(3 , 6 ) | large_2m_rsvd;0 ][0 ] = high_bits_rsvd;/* large page */ 1 ][4 ] = rsvd_check->rsvd_bits_mask[0 ][4 ];1 ][3 ] = rsvd_check->rsvd_bits_mask[0 ][3 ];1 ][2 ] = high_bits_rsvd | rsvd_bits(12 , 29 ) | large_1g_rsvd;1 ][1 ] = high_bits_rsvd | rsvd_bits(12 , 20 ) | large_2m_rsvd;1 ][0 ] = rsvd_check->rsvd_bits_mask[0 ][0 ];0 xFFull << (2 * 8 ); /* bits 3..5 must not be 2 */ 0 xFFull << (3 * 8 ); /* bits 3..5 must not be 3 */ 0 xFFull << (7 * 8 ); /* bits 3..5 must not be 7 */ 1 ull << 2 ); /* bits 0..2 must not be 010 */ 1 ull << 6 ); /* bits 0..2 must not be 110 */ if (!execonly) {/* bits 0..2 must not be 100 unless VMX capabilities allow it */ 1 ull << 4 );static void reset_rsvds_bits_mask_ept(struct kvm_vcpu *vcpu,struct kvm_mmu *context, bool execonly, int huge_page_level)static inline u64 reserved_hpa_bits(void )return rsvd_bits(kvm_host.maxphyaddr, 63 );/* * the page table on host is the shadow page table for the page * table in guest or amd nested guest , its mmu features completely * follow the features in guest . static void reset_shadow_zero_bits_mask(struct kvm_vcpu *vcpu,struct kvm_mmu *context)/* @amd adds a check on bit of SPTEs, which KVM shouldn't use anyways. */ bool is_amd = true ;/* KVM doesn't use 2-level page tables for the shadow MMU. */ bool is_pse = false ;struct rsvd_bits_validate *shadow_zero_check;int i;if (!shadow_me_mask)return ;for (i = context->root_role.level; --i >= 0 ;) {/* * So far shadow_me_value is a constant during KVM ' s life * time . Bits in shadow_me_value are allowed to be set . * Bits in shadow_me_mask but not in shadow_me_value are * not allowed to be set . 0 ][i] |= shadow_me_mask;1 ][i] |= shadow_me_mask;0 ][i] &= ~shadow_me_value;1 ][i] &= ~shadow_me_value;static inline bool boot_cpu_is_amd(void )return shadow_x_mask == 0 ;/* * the direct page table on host , use as much mmu features as * possible , however , kvm currently does not do execution - protection . static void reset_tdp_shadow_zero_bits_mask(struct kvm_mmu *context)struct rsvd_bits_validate *shadow_zero_check;int i;if (boot_cpu_is_amd())true ,false , true );else false ,if (!shadow_me_mask)return ;for (i = context->root_role.level; --i >= 0 ;) {0 ][i] &= ~shadow_me_mask;1 ][i] &= ~shadow_me_mask;/* * as the comments in reset_shadow_zero_bits_mask ( ) except it * is the shadow page table for intel nested guest . static void struct kvm_mmu *context, bool execonly)#define BYTE_MASK(access) \1 & (access) ? 2 : 0 ) | \2 & (access) ? 4 : 0 ) | \3 & (access) ? 8 : 0 ) | \4 & (access) ? 16 : 0 ) | \5 & (access) ? 32 : 0 ) | \6 & (access) ? 64 : 0 ) | \7 & (access) ? 128 : 0 ))static void update_permission_bitmask(struct kvm_mmu *mmu, bool ept)unsigned byte;const u8 x = BYTE_MASK(ACC_EXEC_MASK);const u8 w = BYTE_MASK(ACC_WRITE_MASK);const u8 u = BYTE_MASK(ACC_USER_MASK);bool cr4_smep = is_cr4_smep(mmu);bool cr4_smap = is_cr4_smap(mmu);bool cr0_wp = is_cr0_wp(mmu);bool efer_nx = is_efer_nx(mmu);for (byte = 0 ; byte < ARRAY_SIZE(mmu->permissions); ++byte) {unsigned pfec = byte << 1 ;/* * Each " * f " variable has a 1 bit for each UWX value * that causes a fault with the given PFEC . /* Faults from writes to non-writable pages */ 0 ;/* Faults from user mode accesses to supervisor pages */ 0 ;/* Faults from fetches of non-executable pages*/ 0 ;/* Faults from kernel mode fetches of user pages */ 0 ;/* Faults from kernel mode accesses of user pages */ 0 ;if (!ept) {/* Faults from kernel mode accesses to user pages */ 0 : u;/* Not really needed: !nx will cause pte.nx to fault */ if (!efer_nx)0 ;/* Allow supervisor writes if !cr0.wp */ if (!cr0_wp)0 ;/* Disallow supervisor fetches of user code if cr4.smep */ if (cr4_smep)0 ;/* * SMAP : kernel - mode data accesses from user - mode * mappings should fault . A fault is considered * as a SMAP violation if all of the following * conditions are true : * - X86_CR4_SMAP is set in CR4 * - A user page is accessed * - The access is not a fetch * - The access is supervisor mode * - If implicit supervisor access or X86_EFLAGS_AC is clear * * Here , we cover the first four conditions . * The fifth is computed dynamically in permission_fault ( ) ; * PFERR_RSVD_MASK bit will be set in PFEC if the access is * * not * subject to SMAP restrictions . if (cr4_smap)0 : kf;/** PKU is an additional mechanism by which the paging controls access to * user - mode addresses based on the value in the PKRU register . Protection * key violations are reported through a bit in the page fault error code . * Unlike other bits of the error code , the PK bit is not known at the * call site of e . g . gva_to_gpa ; it must be computed directly in * permission_fault based on two bits of PKRU , on some machine state ( CR4 , * CR0 , EFER , CPL ) , and on other bits of the error code and the page tables . * * In particular the following conditions come from the error code , the * page tables and the machine state : * - PK is always zero unless CR4 . PKE = 1 and EFER . LMA = 1 * - PK is always zero if RSVD = 1 ( reserved bit set ) or F = 1 ( instruction fetch ) * - PK is always zero if U = 0 in the page tables * - PKRU . WD is ignored if CR0 . WP = 0 and the access is a supervisor access . * * The PKRU bitmask caches the result of these four conditions . The error * code ( minus the P bit ) and the page table ' s U bit form an index into the * PKRU bitmask . Two bits of the PKRU bitmask are then extracted and ANDed * with the two bits of the PKRU register corresponding to the protection key . * For the first three conditions above the bits will be 00 , thus masking * away both AD and WD . For all reads or if the last condition holds , WD * only will be masked away . static void update_pkru_bitmask(struct kvm_mmu *mmu)unsigned bit;bool wp;0 ;if (!is_cr4_pke(mmu))return ;for (bit = 0 ; bit < ARRAY_SIZE(mmu->permissions); ++bit) {unsigned pfec, pkey_bits;bool check_pkey, check_write, ff, uf, wf, pte_user;1 ;/* PFEC.RSVD is replaced by ACC_USER_MASK. */ /* * Only need to check the access which is not an * instruction fetch and is to a user page . /* * write access is controlled by PKRU if it is a * user access or CR0 . WP = 1 . /* PKRU.AD stops both read and write access. */ /* PKRU.WD stops write access. */ 1 ;3 ) << pfec;static void reset_guest_paging_metadata(struct kvm_vcpu *vcpu,struct kvm_mmu *mmu)if (!is_cr0_pg(mmu))return ;false );static void paging64_init_context(struct kvm_mmu *context)static void paging32_init_context(struct kvm_mmu *context)static union kvm_cpu_role kvm_calc_cpu_role(struct kvm_vcpu *vcpu,const struct kvm_mmu_role_regs *regs)union kvm_cpu_role role = {0 };1 ;if (!____is_cr0_pg(regs)) {1 ;return role;if (____is_efer_lma(regs))else if (____is_cr4_pae(regs))else /* PKEY and LA57 are active iff long mode is active. */ return role;void __kvm_mmu_refresh_passthrough_bits(struct kvm_vcpu *vcpu,struct kvm_mmu *mmu)const bool cr0_wp = kvm_is_cr0_bit_set(vcpu, X86_CR0_WP););if (is_cr0_wp(mmu) == cr0_wp)return ;static inline int kvm_mmu_get_tdp_level(struct kvm_vcpu *vcpu)int maxpa;if (vcpu->kvm->arch.vm_type == KVM_X86_TDX_VM)else /* tdp_root_level is architecture forced level, use it if nonzero */ if (tdp_root_level)return tdp_root_level;/* Use 5-level TDP if and only if it's useful/necessary. */ if (max_tdp_level == 5 && maxpa <= 48 )return 4 ;return max_tdp_level;void )return tdp_root_level ? tdp_root_level : max_tdp_level;static union kvm_mmu_page_rolestruct kvm_vcpu *vcpu,union kvm_cpu_role cpu_role)union kvm_mmu_page_role role = {0 };true ;true ;true ;false ;return role;static void init_kvm_tdp_mmu(struct kvm_vcpu *vcpu,union kvm_cpu_role cpu_role)struct kvm_mmu *context = &vcpu->arch.root_mmu;union kvm_mmu_page_role root_role = kvm_calc_tdp_mmu_root_page_role(vcpu, cpu_role);if (cpu_role.as_u64 == context->cpu_role.as_u64 &&return ;if (!is_cr0_pg(context))else if (is_cr4_pae(context))else static void shadow_mmu_init_context(struct kvm_vcpu *vcpu, struct kvm_mmu *context,union kvm_cpu_role cpu_role,union kvm_mmu_page_role root_role)if (cpu_role.as_u64 == context->cpu_role.as_u64 &&return ;if (!is_cr0_pg(context))else if (is_cr4_pae(context))else static void kvm_init_shadow_mmu(struct kvm_vcpu *vcpu,union kvm_cpu_role cpu_role)struct kvm_mmu *context = &vcpu->arch.root_mmu;union kvm_mmu_page_role root_role;/* KVM uses PAE paging whenever the guest isn't using 64-bit paging. */ /* * KVM forces EFER . NX = 1 when TDP is disabled , reflect it in the MMU role . * KVM uses NX when TDP is disabled to handle a variety of scenarios , * notably for huge SPTEs if iTLB multi - hit mitigation is enabled and * to generate correct permissions for CR0 . WP = 0 / CR4 . SMEP = 1 / EFER . NX = 0 . * The iTLB multi - hit workaround can be toggled at any time , so assume * NX can be used by any non - nested shadow MMU to avoid having to reset * MMU contexts . true ;void kvm_init_shadow_npt_mmu(struct kvm_vcpu *vcpu, unsigned long cr0,unsigned long cr4, u64 efer, gpa_t nested_cr3)struct kvm_mmu *context = &vcpu->arch.guest_mmu;struct kvm_mmu_role_regs regs = {union kvm_cpu_role cpu_role = kvm_calc_cpu_role(vcpu, ®s);union kvm_mmu_page_role root_role;/* NPT requires CR0.PG=1. */ if (root_role.level == PT64_ROOT_5LEVEL &&1 ;static union kvm_cpu_rolestruct kvm_vcpu *vcpu, bool accessed_dirty,bool execonly, u8 level)union kvm_cpu_role role = {0 };/* * KVM does not support SMM transfer monitors , and consequently does not * support the " entry to SMM " control either . role . base . smm is always 0 . false ;false ;true ;0 ;1 ;return role;void kvm_init_shadow_ept_mmu(struct kvm_vcpu *vcpu, bool execonly,int huge_page_level, bool accessed_dirty,struct kvm_mmu *context = &vcpu->arch.guest_mmu;union kvm_cpu_role new_mode =if (new_mode.as_u64 != context->cpu_role.as_u64) {/* EPT, and thus nested EPT, does not consume CR0, CR4, nor EFER. */ true );0 ;static void init_kvm_softmmu(struct kvm_vcpu *vcpu,union kvm_cpu_role cpu_role)struct kvm_mmu *context = &vcpu->arch.root_mmu;static void init_kvm_nested_mmu(struct kvm_vcpu *vcpu,union kvm_cpu_role new_mode)struct kvm_mmu *g_context = &vcpu->arch.nested_mmu;if (new_mode.as_u64 == g_context->cpu_role.as_u64)return ;/* * L2 page tables are never shadowed , so there is no need to sync * SPTEs . /* * Note that arch . mmu - > gva_to_gpa translates l2_gpa to l1_gpa using * L1 ' s nested page tables ( e . g . EPT12 ) . The nested translation * of l2_gva to l1_gpa is done by arch . nested_mmu . gva_to_gpa using * L2 ' s page tables as the first level of translation and L1 ' s * nested page tables as the second level of translation . Basically * the gva_to_gpa functions between mmu and nested_mmu are swapped . if (!is_paging(vcpu))else if (is_long_mode(vcpu))else if (is_pae(vcpu))else void kvm_init_mmu(struct kvm_vcpu *vcpu)struct kvm_mmu_role_regs regs = vcpu_to_role_regs(vcpu);union kvm_cpu_role cpu_role = kvm_calc_cpu_role(vcpu, ®s);if (mmu_is_nested(vcpu))else if (tdp_enabled)else void kvm_mmu_after_set_cpuid(struct kvm_vcpu *vcpu)/* * Invalidate all MMU roles to force them to reinitialize as CPUID * information is factored into reserved bit calculations . * * Correctly handling multiple vCPU models with respect to paging and * physical address properties ) in a single VM would require tracking * all relevant CPUID information in kvm_mmu_page_role . That is very * undesirable as it would increase the memory requirements for * gfn_write_track ( see struct kvm_mmu_page_role comments ) . For now * that problem is swept under the rug ; KVM ' s CPUID API is horrific and * it ' s all but impossible to solve it without introducing a new API . 1 ;1 ;1 ;0 ;0 ;0 ;/* * Changing guest CPUID after KVM_RUN is forbidden , see the comment in * kvm_arch_vcpu_ioctl ( ) . void kvm_mmu_reset_context(struct kvm_vcpu *vcpu)int kvm_mmu_load(struct kvm_vcpu *vcpu)int r;if (r)goto out;if (r)goto out;if (vcpu->arch.mmu->root_role.direct)else if (r)goto out;/* * Flush any TLB entries for the new root , the provenance of the root * is unknown . Even if KVM ensures there are no stale TLB entries * for a freed root , in theory another hypervisor could have left * stale entries . Flushing on alloc also allows KVM to skip the TLB * flush when freeing a root ( see kvm_tdp_mmu_put_root ( ) ) . return r;void kvm_mmu_unload(struct kvm_vcpu *vcpu)struct kvm *kvm = vcpu->kvm;static bool is_obsolete_root(struct kvm *kvm, hpa_t root_hpa)struct kvm_mmu_page *sp;if (!VALID_PAGE(root_hpa))return false ;/* * When freeing obsolete roots , treat roots as obsolete if they don ' t * have an associated shadow page , as it ' s impossible to determine if * such roots are fresh or stale . This does mean KVM will get false * positives and free roots that don ' t strictly need to be freed , but * such false positives are relatively rare : * * ( a ) only PAE paging and nested NPT have roots without shadow pages * ( or any shadow paging flavor with a dummy root , see note below ) * ( b ) remote reloads due to a memslot update obsoletes _ all_ roots * ( c ) KVM doesn ' t track previous roots for PAE paging , and the guest * is unlikely to zap an in - use PGD . * * Note ! Dummy roots are unique in that they are obsoleted by memslot * _ creation_ ! See also FNAME ( fetch ) . return !sp || is_obsolete_sp(kvm, sp);static void __kvm_mmu_free_obsolete_roots(struct kvm *kvm, struct kvm_mmu *mmu)unsigned long roots_to_free = 0 ;int i;if (is_obsolete_root(kvm, mmu->root.hpa))for (i = 0 ; i < KVM_MMU_NUM_PREV_ROOTS; i++) {if (is_obsolete_root(kvm, mmu->prev_roots[i].hpa))if (roots_to_free)void kvm_mmu_free_obsolete_roots(struct kvm_vcpu *vcpu)static u64 mmu_pte_write_fetch_gpte(struct kvm_vcpu *vcpu, gpa_t *gpa,int *bytes)0 ;int r;/* * Assume that the pte write on a page table of the same type * as the current vcpu paging mode since we update the sptes only * when they have the same mode . if (is_pae(vcpu) && *bytes == 4 ) {/* Handle a 32-bit guest writing two halves of a 64-bit gpte */ 7 ;8 ;if (*bytes == 4 || *bytes == 8 ) {if (r)0 ;return gentry;/* * If we ' re seeing too many writes to a page , it may no longer be a page table , * or we may be forking , in which case it is better to unmap the page . static bool detect_write_flooding(struct kvm_mmu_page *sp)/* * Skip write - flooding detected for the sp whose level is 1 , because * it can become unsync , then the guest page is not write - protected . if (sp->role.level == PG_LEVEL_4K)return false ;return atomic_read(&sp->write_flooding_count) >= 3 ;/* * Misaligned accesses are too much trouble to fix up ; also , they usually * indicate a page is not used as a page table . static bool detect_write_misaligned(struct kvm_mmu_page *sp, gpa_t gpa,int bytes)unsigned offset, pte_size, misaligned;4 : 8 ;/* * Sometimes , the OS only writes the last one bytes to update status * bits , for example , in linux , andb instruction is used in clear_bit ( ) . if (!(offset & (pte_size - 1 )) && bytes == 1 )return false ;1 )) & ~(pte_size - 1 );4 ;return misaligned;static u64 *get_written_sptes(struct kvm_mmu_page *sp, gpa_t gpa, int *nspte)unsigned page_offset, quadrant;int level;1 ;if (sp->role.has_4_byte_gpte) {1 ; /* 32->64 */ /* * A 32 - bit pde maps 4 MB while the shadow pdes map * only 2 MB . So we need to double the offset again * and zap two pdes instead of one . if (level == PT32_ROOT_LEVEL) {7 ; /* kill rounding error */ 1 ;2 ;if (quadrant != sp->role.quadrant)return NULL;sizeof (*spte)];return spte;void kvm_mmu_track_write(struct kvm_vcpu *vcpu, gpa_t gpa, const u8 *new ,int bytes)struct kvm_mmu_page *sp;int npte;bool flush = false ;/* * When emulating guest writes , ensure the written value is visible to * any task that is handling page faults before checking whether or not * KVM is shadowing a guest PTE . This ensures either KVM will create * the correct SPTE in the page fault handler , or this task will see * a non - zero indirect_shadow_pages . Pairs with the smp_mb ( ) in * account_shadowed ( ) . if (!vcpu->kvm->arch.indirect_shadow_pages)return ;if (detect_write_misaligned(sp, gpa, bytes) ||continue ;if (!spte)continue ;while (npte--) {if (gentry && sp->role.level != PG_LEVEL_4K)if (is_shadow_present_pte(entry))true ;static bool is_write_to_guest_page_table(u64 error_code)const u64 mask = PFERR_GUEST_PAGE_MASK | PFERR_WRITE_MASK | PFERR_PRESENT_MASK;return (error_code & mask) == mask;static int kvm_mmu_write_protect_fault(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa,int *emulation_type)bool direct = vcpu->arch.mmu->root_role.direct;/* * Do not try to unprotect and retry if the vCPU re - faulted on the same * RIP with the same address that was previously unprotected , as doing * so will likely put the vCPU into an infinite . E . g . if the vCPU uses * a non - page - table modifying instruction on the PDE that points to the * instruction , then unprotecting the gfn will unmap the instruction ' s * code , i . e . make it impossible for the instruction to ever complete . if (vcpu->arch.last_retry_eip == kvm_rip_read(vcpu) &&return RET_PF_EMULATE;/* * Reset the unprotect + retry values that guard against infinite loops . * The values will be refreshed if KVM explicitly unprotects a gfn and * retries , in all other cases it ' s safe to retry in the future even if * the next page fault happens on the same RIP + address . 0 ;0 ;/* * It should be impossible to reach this point with an MMIO cache hit , * as RET_PF_WRITE_PROTECTED is returned if and only if there ' s a valid , * writable memslot , and creating a memslot should invalidate the MMIO * cache by way of changing the memslot generation . WARN and disallow * retry if MMIO is detected , as retrying MMIO emulation is pointless * and could put the vCPU into an infinite loop because the processor * will keep faulting on the non - existent MMIO address . if (WARN_ON_ONCE(mmio_info_in_cache(vcpu, cr2_or_gpa, direct)))return RET_PF_EMULATE;/* * Before emulating the instruction , check to see if the access was due * to a read - only violation while the CPU was walking non - nested NPT * page tables , i . e . for a direct MMU , for _ guest_ page tables in L1 . * If L1 is sharing ( a subset of ) its page tables with L2 , e . g . by * having nCR3 share lower level page tables with hCR3 , then when KVM * ( L0 ) write - protects the nested NPTs , i . e . npt12 entries , KVM is also * unknowingly write - protecting L1 ' s guest page tables , which KVM isn ' t * shadowing . * * Because the CPU ( by default ) walks NPT page tables using a write * access ( to ensure the CPU can do A / D updates ) , page walks in L1 can * trigger write faults for the above case even when L1 isn ' t modifying * PTEs . As a result , KVM will unnecessarily emulate ( or at least , try * to emulate ) an excessive number of L1 instructions ; because L1 ' s MMU * isn ' t shadowed by KVM , there is no need to write - protect L1 ' s gPTEs * and thus no need to emulate in order to guarantee forward progress . * * Try to unprotect the gfn , i . e . zap any shadow pages , so that L1 can * proceed without triggering emulation . If one or more shadow pages * was zapped , skip emulation and resume L1 to let it natively execute * the instruction . If no shadow pages were zapped , then the write - * fault is due to something else entirely , i . e . KVM needs to emulate , * as resuming the guest will put it into an infinite loop . * * Note , this code also applies to Intel CPUs , even though it is * very * * unlikely that an L1 will share its page tables ( IA32 / PAE / paging64 * format ) with L2 ' s page tables ( EPT format ) . * * For indirect MMUs , i . e . if KVM is shadowing the current MMU , try to * unprotect the gfn and retry if an event is awaiting reinjection . If * KVM emulates multiple instructions before completing event injection , * the event could be delayed beyond what is architecturally allowed , * e . g . KVM could inject an IRQ after the TPR has been raised . if (((direct && is_write_to_guest_page_table(error_code)) ||return RET_PF_RETRY;/* * The gfn is write - protected , but if KVM detects its emulating an * instruction that is unlikely to be used to modify page tables , or if * emulation fails , KVM can try to unprotect the gfn and let the CPU * re - execute the instruction that caused the page fault . Do not allow * retrying an instruction from a nested guest as KVM is only explicitly * shadowing L1 ' s page tables , i . e . unprotecting something for L1 isn ' t * going to magically fix whatever issue caused L2 to fail . if (!is_guest_mode(vcpu))return RET_PF_EMULATE;int noinline kvm_mmu_page_fault(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa, u64 error_code,void *insn, int insn_len)int r, emulation_type = EMULTYPE_PF;bool direct = vcpu->arch.mmu->root_role.direct;if (WARN_ON_ONCE(!VALID_PAGE(vcpu->arch.mmu->root.hpa)))return RET_PF_RETRY;/* * Except for reserved faults ( emulated MMIO is shared - only ) , set the * PFERR_PRIVATE_ACCESS flag for software - protected VMs based on the gfn ' s * current attributes , which are the source of truth for such VMs . Note , * this wrong for nested MMUs as the GPA is an L2 GPA , but KVM doesn ' t * currently supported nested virtualization ( among many other things ) * for software - protected VMs . if (IS_ENABLED(CONFIG_KVM_SW_PROTECTED_VM) &&if (unlikely(error_code & PFERR_RSVD_MASK)) {if (WARN_ON_ONCE(error_code & PFERR_PRIVATE_ACCESS))return -EFAULT;if (r == RET_PF_EMULATE)goto emulate;if (r == RET_PF_INVALID) {false ,if (KVM_BUG_ON(r == RET_PF_INVALID, vcpu->kvm))return -EIO;if (r < 0 )return r;if (r == RET_PF_WRITE_PROTECTED)if (r == RET_PF_FIXED)else if (r == RET_PF_EMULATE)else if (r == RET_PF_SPURIOUS)/* * None of handle_mmio_page_fault ( ) , kvm_mmu_do_page_fault ( ) , or * kvm_mmu_write_protect_fault ( ) return RET_PF_CONTINUE . * kvm_mmu_do_page_fault ( ) only uses RET_PF_CONTINUE internally to * indicate continuing the page fault handling until to the final * page table mapping phase . if (r != RET_PF_EMULATE)return r;return x86_emulate_instruction(vcpu, cr2_or_gpa, emulation_type, insn,void kvm_mmu_print_sptes(struct kvm_vcpu *vcpu, gpa_t gpa, const char *msg)1 ];int root_level, leaf, level;if (unlikely(leaf < 0 ))return ;"%s %llx" , msg, gpa);for (level = root_level; level >= leaf; level--)", spte[%d] = 0x%llx" , level, sptes[level]);"\n" );static void __kvm_mmu_invalidate_addr(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu,struct kvm_shadow_walk_iterator iterator;/* * Walking and synchronizing SPTEs both assume they are operating in * the context of the current MMU , and would need to be reworked if * this is ever used to sync the guest_mmu , e . g . to emulate INVEPT . if (WARN_ON_ONCE(mmu != vcpu->arch.mmu))return ;if (!VALID_PAGE(root_hpa))return ;struct kvm_mmu_page *sp = sptep_to_sp(iterator.sptep);if (sp->unsync) {int ret = kvm_sync_spte(vcpu, sp, iterator.index);if (ret < 0 )if (ret)if (!sp->unsync_children)break ;void kvm_mmu_invalidate_addr(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu,unsigned long roots)int i;/* It's actually a GPA for vcpu->arch.guest_mmu. */ if (mmu != &vcpu->arch.guest_mmu) {/* INVLPG on a non-canonical address is a NOP according to the SDM. */ if (is_noncanonical_invlpg_address(addr, vcpu))return ;if (!mmu->sync_spte)return ;if (roots & KVM_MMU_ROOT_CURRENT)for (i = 0 ; i < KVM_MMU_NUM_PREV_ROOTS; i++) {if (roots & KVM_MMU_ROOT_PREVIOUS(i))void kvm_mmu_invlpg(struct kvm_vcpu *vcpu, gva_t gva)/* * INVLPG is required to invalidate any global mappings for the VA , * irrespective of PCID . Blindly sync all roots as it would take * roughly the same amount of work / time to determine whether any of the * previous roots have a global mapping . * * Mappings not reachable via the current or previous cached roots will * be synced when switching to that new cr3 , so nothing needs to be * done here for them . void kvm_mmu_invpcid_gva(struct kvm_vcpu *vcpu, gva_t gva, unsigned long pcid)struct kvm_mmu *mmu = vcpu->arch.mmu;unsigned long roots = 0 ;if (pcid == kvm_get_active_pcid(vcpu))for (i = 0 ; i < KVM_MMU_NUM_PREV_ROOTS; i++) {if (VALID_PAGE(mmu->prev_roots[i].hpa) &&if (roots)/* * Mappings not reachable via the current cr3 or the prev_roots will be * synced when switching to that cr3 , so nothing needs to be done here * for them . void kvm_configure_mmu(bool enable_tdp, int tdp_forced_root_level,int tdp_max_root_level, int tdp_huge_page_level)#ifdef CONFIG_X86_64#endif /* * max_huge_page_level reflects KVM ' s MMU capabilities irrespective * of kernel support , e . g . KVM may be capable of using 1 GB pages when * the kernel is not . But , KVM never creates a page size greater than * what is used by the kernel for any given HVA , i . e . the kernel ' s * capabilities are ultimately consulted by kvm_mmu_hugepage_adjust ( ) . if (tdp_enabled)else if (boot_cpu_has(X86_FEATURE_GBPAGES))else static void free_mmu_pages(struct kvm_mmu *mmu)if (!tdp_enabled && mmu->pae_root)unsigned long )mmu->pae_root, 1 );unsigned long )mmu->pae_root);unsigned long )mmu->pml4_root);unsigned long )mmu->pml5_root);static int __kvm_mmu_create(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu)struct page *page;int i;0 ;for (i = 0 ; i < KVM_MMU_NUM_PREV_ROOTS; i++)/* vcpu->arch.guest_mmu isn't used when !tdp_enabled. */ if (!tdp_enabled && mmu == &vcpu->arch.guest_mmu)return 0 ;/* * When using PAE paging , the four PDPTEs are treated as ' root ' pages , * while the PDP table is a per - vCPU construct that ' s allocated at MMU * creation . When emulating 32 - bit mode , cr3 is only 32 bits even on * x86_64 . Therefore we need to allocate the PDP table in the first * 4 GB of memory , which happens to fit the DMA32 zone . TDP paging * generally doesn ' t use PAE paging and can skip allocating the PDP * table . The main exception , handled here , is SVM ' s 32 - bit NPT . The * other exception is for shadowing L1 ' s 32 - bit or PAE NPT on 64 - bit * KVM ; that horror is handled on - demand by mmu_alloc_special_roots ( ) . if (tdp_enabled && kvm_mmu_get_tdp_level(vcpu) > PT32E_ROOT_LEVEL)return 0 ;if (!page)return -ENOMEM;/* * CR3 is only 32 bits when PAE paging is used , thus it ' s impossible to * get the CPU to treat the PDPTEs as encrypted . Decrypt the page so * that KVM ' s writes and the CPU ' s reads get along . Note , this is * only necessary when using shadow paging , as 64 - bit NPT can get at * the C - bit even when shadowing 32 - bit NPT , and SME isn ' t supported * by 32 - bit kernels ( when KVM itself uses 32 - bit NPT ) . if (!tdp_enabled)unsigned long )mmu->pae_root, 1 );else for (i = 0 ; i < 4 ; ++i)return 0 ;int kvm_mmu_create(struct kvm_vcpu *vcpu)int ret;if (!vcpu->arch.mmu_shadow_page_cache.init_value)if (ret)return ret;if (ret)goto fail_allocate_root;return ret;return ret;#define BATCH_ZAP_PAGES 10 static void kvm_zap_obsolete_pages(struct kvm *kvm)struct kvm_mmu_page *sp, *node;int nr_zapped, batch = 0 ;bool unstable;/* * No obsolete valid page exists before a newly created page * since active_mmu_pages is a FIFO list . if (!is_obsolete_sp(kvm, sp))break ;/* * Invalid pages should never land back on the list of active * pages . Skip the bogus page , otherwise we ' ll get stuck in an * infinite loop if the page gets put back on the list ( again ) . if (WARN_ON_ONCE(sp->role.invalid))continue ;/* * No need to flush the TLB since we ' re only zapping shadow * pages with an obsolete generation number and all vCPUS have * loaded a new root , i . e . the shadow pages being zapped cannot * be in active use by the guest . if (batch >= BATCH_ZAP_PAGES &&0 ;goto restart;if (unstable)goto restart;/* * Kick all vCPUs ( via remote TLB flush ) before freeing the page tables * to ensure KVM is not in the middle of a lockless shadow page table * walk , which may reference the pages . The remote TLB flush itself is * not required and is simply a convenient way to kick vCPUs as needed . * KVM performs a local TLB flush when allocating a new root ( see * kvm_mmu_load ( ) ) , and the reload in the caller ensure no vCPUs are * running with an obsolete MMU . /* * Fast invalidate all shadow pages and use lock - break technique * to zap obsolete pages . * * It ' s required when memslot is being deleted or VM is being * destroyed , in these cases , we should ensure that KVM MMU does * not use any resource of the being - deleted slot or all slots * after calling the function . static void kvm_mmu_zap_all_fast(struct kvm *kvm)/* * Toggle mmu_valid_gen between ' 0 ' and ' 1 ' . Because slots_lock is * held for the entire duration of zapping obsolete pages , it ' s * impossible for there to be multiple invalid generations associated * with * valid * shadow pages at any given time , i . e . there is exactly * one valid generation and ( at most ) one invalid generation . 0 : 1 ;/* * In order to ensure all vCPUs drop their soon - to - be invalid roots , * invalidating TDP MMU roots must be done while holding mmu_lock for * write and in the same critical section as making the reload request , * e . g . before kvm_zap_obsolete_pages ( ) could drop mmu_lock and yield . if (tdp_mmu_enabled) {/* * External page tables don ' t support fast zapping , therefore * their mirrors must be invalidated separately by the caller . /* * Notify all vcpus to reload its shadow page table and flush TLB . * Then all vcpus will switch to new shadow page table with the new * mmu_valid_gen . * * Note : we need to do this under the protection of mmu_lock , * otherwise , vcpu would purge shadow page but miss tlb flush . /* * Zap the invalidated TDP MMU roots , all SPTEs must be dropped before * returning to the caller , e . g . if the zap is in response to a memslot * deletion , mmu_notifier callbacks will be unable to reach the SPTEs * associated with the deleted memslot once the update completes , and * Deferring the zap until the final reference to the root is put would * lead to use - after - free . if (tdp_mmu_enabled)true );int kvm_mmu_init_vm(struct kvm *kvm)int r;if (tdp_mmu_enabled) {else {if (r)return r;return 0 ;static void mmu_free_vm_memory_caches(struct kvm *kvm)void kvm_mmu_uninit_vm(struct kvm *kvm)if (tdp_mmu_enabled)static bool kvm_rmap_zap_gfn_range(struct kvm *kvm, gfn_t gfn_start, gfn_t gfn_end)const struct kvm_memory_slot *memslot;struct kvm_memslots *slots;struct kvm_memslot_iter iter;bool flush = false ;int i;if (!kvm_memslots_have_rmaps(kvm))return flush;for (i = 0 ; i < kvm_arch_nr_memslot_as_ids(kvm); i++) {if (WARN_ON_ONCE(start >= end))continue ;true , flush);return flush;/* * Invalidate ( zap ) SPTEs that cover GFNs from gfn_start and up to gfn_end * ( not including it ) void kvm_zap_gfn_range(struct kvm *kvm, gfn_t gfn_start, gfn_t gfn_end)bool flush;if (WARN_ON_ONCE(gfn_end <= gfn_start))return ;if (tdp_mmu_enabled)if (flush)static bool slot_rmap_write_protect(struct kvm *kvm,struct kvm_rmap_head *rmap_head,const struct kvm_memory_slot *slot)return rmap_write_protect(rmap_head, false );void kvm_mmu_slot_remove_write_access(struct kvm *kvm,const struct kvm_memory_slot *memslot,int start_level)if (kvm_memslots_have_rmaps(kvm)) {false );if (tdp_mmu_enabled) {static inline bool need_topup(struct kvm_mmu_memory_cache *cache, int min)return kvm_mmu_memory_cache_nr_free_objects(cache) < min;static bool need_topup_split_caches_or_resched(struct kvm *kvm)if (need_resched() || rwlock_needbreak(&kvm->mmu_lock))return true ;/* * In the worst case , SPLIT_DESC_CACHE_MIN_NR_OBJECTS descriptors are needed * to split a single huge page . Calculating how many are actually needed * is possible but not worth the complexity . return need_topup(&kvm->arch.split_desc_cache, SPLIT_DESC_CACHE_MIN_NR_OBJECTS) ||1 ) ||1 );static int topup_split_caches(struct kvm *kvm)/* * Allocating rmap list entries when splitting huge pages for nested * MMUs is uncommon as KVM needs to use a list if and only if there is * more than one rmap entry for a gfn , i . e . requires an L1 gfn to be * aliased by multiple L2 gfns and / or from multiple nested roots with * different roles . Aliasing gfns when using TDP is atypical for VMMs ; * a few gfns are often aliased during boot , e . g . when remapping BIOS , * but aliasing rarely occurs post - boot or for many gfns . If there is * only one rmap entry , rmap - > val points directly at that one entry and * doesn ' t need to allocate a list . Buffer the cache by the default * capacity so that KVM doesn ' t have to drop mmu_lock to topup if KVM * encounters an aliased gfn or two . const int capacity = SPLIT_DESC_CACHE_MIN_NR_OBJECTS +int r;if (r)return r;1 );if (r)return r;return kvm_mmu_topup_memory_cache(&kvm->arch.split_shadow_page_cache, 1 );static struct kvm_mmu_page *shadow_mmu_get_sp_for_split(struct kvm *kvm, u64 *huge_sptep)struct kvm_mmu_page *huge_sp = sptep_to_sp(huge_sptep);struct shadow_page_caches caches = {};union kvm_mmu_page_role role;unsigned int access;/* * Note , huge page splitting always uses direct shadow pages , regardless * of whether the huge page itself is mapped by a direct or indirect * shadow page , since the huge page region itself is being directly * mapped with smaller pages . /*direct=*/true, access); /* Direct SPs do not require a shadowed_info_cache. */ /* Safe to pass NULL for vCPU since requesting a direct SP. */ return __kvm_mmu_get_shadow_page(kvm, NULL, &caches, gfn, role);static void shadow_mmu_split_huge_page(struct kvm *kvm,const struct kvm_memory_slot *slot,struct kvm_mmu_memory_cache *cache = &kvm->arch.split_desc_cache;struct kvm_mmu_page *sp;bool flush = false ;int index;for (index = 0 ; index < SPTE_ENT_PER_PAGE; index++) {/* * The SP may already have populated SPTEs , e . g . if this huge * page is aliased by multiple sptes with the same access * permissions . These entries are guaranteed to map the same * gfn - to - pfn translation since the SP is direct , so no need to * modify them . * * However , if a given SPTE points to a lower level page table , * that lower level page table may only be partially populated . * Installing such SPTEs would effectively unmap a potion of the * huge page . Unmapping guest memory always requires a TLB flush * since a subsequent operation on the unmapped regions would * fail to detect the need to flush . if (is_shadow_present_pte(*sptep)) {continue ;static int shadow_mmu_try_split_huge_page(struct kvm *kvm,const struct kvm_memory_slot *slot,struct kvm_mmu_page *huge_sp = sptep_to_sp(huge_sptep);int level, r = 0 ;/* Grab information for the tracepoint before dropping the MMU lock. */ if (kvm_mmu_available_pages(kvm) <= KVM_MIN_FREE_MMU_PAGES) {goto out;if (need_topup_split_caches_or_resched(kvm)) {/* * If the topup succeeds , return - EAGAIN to indicate that the * rmap iterator should be restarted because the MMU lock was * dropped . goto out;return r;static bool shadow_mmu_try_split_huge_pages(struct kvm *kvm,struct kvm_rmap_head *rmap_head,const struct kvm_memory_slot *slot)struct rmap_iterator iter;struct kvm_mmu_page *sp;int r;/* TDP MMU is enabled, so rmap only contains nested MMU SPs. */ if (WARN_ON_ONCE(!sp->role.guest_mode))continue ;/* The rmaps should never contain non-leaf SPTEs. */ if (WARN_ON_ONCE(!is_large_pte(*huge_sptep)))continue ;/* SPs with level >PG_LEVEL_4K should never by unsync. */ if (WARN_ON_ONCE(sp->unsync))continue ;/* Don't bother splitting huge pages on invalid SPs. */ if (sp->role.invalid)continue ;/* * The split succeeded or needs to be retried because the MMU * lock was dropped . Either way , restart the iterator to get it * back into a consistent state . if (!r || r == -EAGAIN)goto restart;/* The split failed and shouldn't be retried (e.g. -ENOMEM). */ break ;return false ;static void kvm_shadow_mmu_try_split_huge_pages(struct kvm *kvm,const struct kvm_memory_slot *slot,int target_level)int level;/* * Split huge pages starting with KVM_MAX_HUGEPAGE_LEVEL and working * down to the target level . This ensures pages are recursively split * all the way to the target level . There ' s no need to split pages * already at the target level . for (level = KVM_MAX_HUGEPAGE_LEVEL; level > target_level; level--)1 , true , true , false );/* Must be called with the mmu_lock held in write-mode. */ void kvm_mmu_try_split_huge_pages(struct kvm *kvm,const struct kvm_memory_slot *memslot,int target_level)if (!tdp_mmu_enabled)return ;if (kvm_memslots_have_rmaps(kvm))false );/* * A TLB flush is unnecessary at this point for the same reasons as in * kvm_mmu_slot_try_split_huge_pages ( ) . void kvm_mmu_slot_try_split_huge_pages(struct kvm *kvm,const struct kvm_memory_slot *memslot,int target_level)if (!tdp_mmu_enabled)return ;if (kvm_memslots_have_rmaps(kvm)) {true );/* * No TLB flush is necessary here . KVM will flush TLBs after * write - protecting and / or clearing dirty on the newly split SPTEs to * ensure that guest writes are reflected in the dirty log before the * ioctl to enable dirty logging on this memslot completes . Since the * split SPTEs retain the write and dirty bits of the huge SPTE , it is * safe for KVM to decide if a TLB flush is necessary based on the split * SPTEs . static bool kvm_mmu_zap_collapsible_spte(struct kvm *kvm,struct kvm_rmap_head *rmap_head,const struct kvm_memory_slot *slot)struct rmap_iterator iter;int need_tlb_flush = 0 ;struct kvm_mmu_page *sp;/* * We cannot do huge page mapping for indirect shadow pages , * which are found on the last rmap ( level = 1 ) when not using * tdp ; such shadow pages are synced with the page table in * the guest , and the guest page table is using 4 K page size * mapping if the indirect sp has level = 1 . if (sp->role.direct &&if (kvm_available_flush_remote_tlbs_range())else 1 ;goto restart;return need_tlb_flush;static void kvm_rmap_zap_collapsible_sptes(struct kvm *kvm,const struct kvm_memory_slot *slot)/* * Note , use KVM_MAX_HUGEPAGE_LEVEL - 1 since there ' s no need to zap * pages that are already mapped at the maximum hugepage level . if (walk_slot_rmaps(kvm, slot, kvm_mmu_zap_collapsible_spte,1 , true ))void kvm_mmu_recover_huge_pages(struct kvm *kvm,const struct kvm_memory_slot *slot)if (kvm_memslots_have_rmaps(kvm)) {if (tdp_mmu_enabled) {void kvm_mmu_slot_leaf_clear_dirty(struct kvm *kvm,const struct kvm_memory_slot *memslot)if (kvm_memslots_have_rmaps(kvm)) {/* * Clear dirty bits only on 4 k SPTEs since the legacy MMU only * support dirty logging at a 4 k granularity . false );if (tdp_mmu_enabled) {/* * The caller will flush the TLBs after this function returns . * * It ' s also safe to flush TLBs out of mmu lock here as currently this * function is only used for dirty logging , in which case flushing TLB * out of mmu lock also guarantees no dirty pages will be lost in * dirty_bitmap . static void kvm_mmu_zap_all(struct kvm *kvm)struct kvm_mmu_page *sp, *node;int ign;if (WARN_ON_ONCE(sp->role.invalid))continue ;if (__kvm_mmu_prepare_zap_page(kvm, sp, &invalid_list, &ign))goto restart;if (cond_resched_rwlock_write(&kvm->mmu_lock))goto restart;if (tdp_mmu_enabled)void kvm_arch_flush_shadow_all(struct kvm *kvm)static void kvm_mmu_zap_memslot_pages_and_flush(struct kvm *kvm,struct kvm_memory_slot *slot,bool flush)unsigned long i;if (list_empty(&kvm->arch.active_mmu_pages))goto out_flush;/* * Since accounting information is stored in struct kvm_arch_memory_slot , * all MMU pages that are shadowing guest PTEs must be zapped before the * memslot is deleted , as freeing such pages after the memslot is freed * will result in use - after - free , e . g . in unaccount_shadowed ( ) . for (i = 0 ; i < slot->npages; i++) {struct kvm_mmu_page *sp;if (need_resched() || rwlock_needbreak(&kvm->mmu_lock)) {false ;static void kvm_mmu_zap_memslot(struct kvm *kvm,struct kvm_memory_slot *slot)struct kvm_gfn_range range = {true ,bool flush;static inline bool kvm_memslot_flush_zap_all(struct kvm *kvm)return kvm->arch.vm_type == KVM_X86_DEFAULT_VM &&void kvm_arch_flush_shadow_memslot(struct kvm *kvm,struct kvm_memory_slot *slot)if (kvm_memslot_flush_zap_all(kvm))else void kvm_mmu_invalidate_mmio_sptes(struct kvm *kvm, u64 gen)/* * Generation numbers are incremented in multiples of the number of * address spaces in order to provide unique generations across all * address spaces . Strip what is effectively the address space * modifier prior to checking for a wrap of the MMIO generation so * that a wrap in any address space is detected . 1 );/* * The very rare case : if the MMIO generation number has wrapped , * zap all shadow pages . if (unlikely(gen == 0 )) {"zapping shadow pages for mmio generation wraparound\n" );static void mmu_destroy_caches(void )static void kvm_wake_nx_recovery_thread(struct kvm *kvm)/* * The NX recovery thread is spawned on - demand at the first KVM_RUN and * may not be valid even though the VM is globally visible . Do nothing , * as such a VM can ' t have any possible NX huge pages . struct vhost_task *nx_thread = READ_ONCE(kvm->arch.nx_huge_page_recovery_thread);if (nx_thread)static int get_nx_huge_pages(char *buffer, const struct kernel_param *kp)if (nx_hugepage_mitigation_hard_disabled)return sysfs_emit(buffer, "never\n" );return param_get_bool(buffer, kp);static bool get_nx_auto_mode(void )/* Return true when CPU has the bug, and mitigations are ON */ return boot_cpu_has_bug(X86_BUG_ITLB_MULTIHIT) && !cpu_mitigations_off();static void __set_nx_huge_pages(bool val)static int set_nx_huge_pages(const char *val, const struct kernel_param *kp)bool old_val = nx_huge_pages;bool new_val;if (nx_hugepage_mitigation_hard_disabled)return -EPERM;/* In "auto" mode deploy workaround only if CPU has the bug. */ if (sysfs_streq(val, "off" )) {0 ;else if (sysfs_streq(val, "force" )) {1 ;else if (sysfs_streq(val, "auto" )) {else if (sysfs_streq(val, "never" )) {0 ;if (!list_empty(&vm_list)) {return -EBUSY;true ;else if (kstrtobool(val, &new_val) < 0 ) {return -EINVAL;if (new_val != old_val) {struct kvm *kvm;return 0 ;/* * nx_huge_pages needs to be resolved to true / false when kvm . ko is loaded , as * its default value of - 1 is technically undefined behavior for a boolean . * Forward the module init call to SPTE code so that it too can handle module * params that need to be resolved / snapshot . void __init kvm_mmu_x86_module_init(void )if (nx_huge_pages == -1 )/* * Snapshot userspace ' s desire to enable the TDP MMU . Whether or not the * TDP MMU is actually enabled is determined in kvm_configure_mmu ( ) * when the vendor module is loaded . /* * The bulk of the MMU initialization is deferred until the vendor module is * loaded as many of the masks / values may be modified by VMX or SVM , i . e . need * to be reset when a potentially different vendor module is loaded . int kvm_mmu_vendor_module_init(void )int ret = -ENOMEM;/* * MMU roles use union aliasing which is , generally speaking , an * undefined behavior . However , we supposedly know how compilers behave * and the current status quo is unlikely to change . Guardians below are * supposed to let us know if the assumption becomes false . sizeof (union kvm_mmu_page_role) != sizeof (u32));sizeof (union kvm_mmu_extended_role) != sizeof (u32));sizeof (union kvm_cpu_role) != sizeof (u64));if (!pte_list_desc_cache)goto out;"kvm_mmu_page_header" ,sizeof (struct kvm_mmu_page),0 , SLAB_ACCOUNT, NULL);if (!mmu_page_header_cache)goto out;return 0 ;return ret;void kvm_mmu_destroy(struct kvm_vcpu *vcpu)if (tdp_mmu_enabled) {void kvm_mmu_vendor_module_exit(void )/* * Calculate the effective recovery period , accounting for ' 0 ' meaning " let KVM * select a halving time of 1 hour " . Returns true if recovery is enabled . static bool calc_nx_huge_pages_recovery_period(uint *period)/* * Use READ_ONCE to get the params , this may be called outside of the * param setters , e . g . by the kthread to compute its next timeout . bool enabled = READ_ONCE(nx_huge_pages);if (!enabled || !ratio)return false ;if (!*period) {/* Make sure the period is not less than one second. */ 3600 u);60 * 60 * 1000 / ratio;return true ;static int set_nx_huge_pages_recovery_param(const char *val, const struct kernel_param *kp)bool was_recovery_enabled, is_recovery_enabled;int err;if (nx_hugepage_mitigation_hard_disabled)return -EPERM;if (err)return err;if (is_recovery_enabled &&struct kvm *kvm;return err;static void kvm_recover_nx_huge_pages(struct kvm *kvm)unsigned long nx_lpage_splits = kvm->stat.nx_lpage_splits;struct kvm_memory_slot *slot;int rcu_idx;struct kvm_mmu_page *sp;unsigned int ratio;bool flush = false ;/* * Zapping TDP MMU shadow pages , including the remote TLB flush , must * be done under RCU protection , because the pages are freed via RCU * callback . 0 ;for ( ; to_zap; --to_zap) {if (list_empty(&kvm->arch.possible_nx_huge_pages))break ;/* * We use a separate list instead of just using active_mmu_pages * because the number of shadow pages that be replaced with an * NX huge page is expected to be relatively small compared to * the total number of shadow pages . And because the TDP MMU * doesn ' t use active_mmu_pages . struct kvm_mmu_page,/* * Unaccount and do not attempt to recover any NX Huge Pages * that are being dirty tracked , as they would just be faulted * back in as 4 KiB pages . The NX Huge Pages in this slot will be * recovered , along with all the other huge pages in the slot , * when dirty logging is disabled . * * Since gfn_to_memslot ( ) is relatively expensive , it helps to * skip it if it the test cannot possibly return true . On the * other hand , if any memslot has logging enabled , chances are * good that all of them do , in which case unaccount_nx_huge_page ( ) * is much cheaper than zapping the page . * * If a memslot update is in progress , reading an incorrect value * of kvm - > nr_memslots_dirty_logging is not a problem : if it is * becoming zero , gfn_to_memslot ( ) will be done unnecessarily ; if * it is becoming nonzero , the page will be zapped unnecessarily . * Either way , this only affects efficiency in racy situations , * and not correctness . if (atomic_read(&kvm->nr_memslots_dirty_logging)) {struct kvm_memslots *slots;if (slot && kvm_slot_dirty_track_enabled(slot))else if (is_tdp_mmu_page(sp))else if (need_resched() || rwlock_needbreak(&kvm->mmu_lock)) {false ;static void kvm_nx_huge_page_recovery_worker_kill(void *data)static bool kvm_nx_huge_page_recovery_worker(void *data)struct kvm *kvm = data;bool enabled;long remaining_time;if (!enabled)return false ;if (remaining_time > 0 ) {/* check for signals and come back */ return true ;return true ;static int kvm_mmu_start_lpage_recovery(struct once *once)struct kvm_arch *ka = container_of(once, struct kvm_arch, nx_once);struct kvm *kvm = container_of(ka, struct kvm, arch);struct vhost_task *nx_thread;"kvm-nx-lpage-recovery" );if (IS_ERR(nx_thread))return PTR_ERR(nx_thread);/* Make the task visible only once it is fully started. */ return 0 ;int kvm_mmu_post_init_vm(struct kvm *kvm)if (nx_hugepage_mitigation_hard_disabled)return 0 ;return call_once(&kvm->arch.nx_once, kvm_mmu_start_lpage_recovery);void kvm_mmu_pre_destroy_vm(struct kvm *kvm)if (kvm->arch.nx_huge_page_recovery_thread)#ifdef CONFIG_KVM_GENERIC_MEMORY_ATTRIBUTESstatic bool hugepage_test_mixed(struct kvm_memory_slot *slot, gfn_t gfn,int level)return lpage_info_slot(gfn, slot, level)->disallow_lpage & KVM_LPAGE_MIXED_FLAG;static void hugepage_clear_mixed(struct kvm_memory_slot *slot, gfn_t gfn,int level)static void hugepage_set_mixed(struct kvm_memory_slot *slot, gfn_t gfn,int level)bool kvm_arch_pre_set_memory_attributes(struct kvm *kvm,struct kvm_gfn_range *range)struct kvm_memory_slot *slot = range->slot;int level;/* * Zap SPTEs even if the slot can ' t be mapped PRIVATE . KVM x86 only * supports KVM_MEMORY_ATTRIBUTE_PRIVATE , and so it * seems * like KVM * can simply ignore such slots . But if userspace is making memory * PRIVATE , then KVM must prevent the guest from accessing the memory * as shared . And if userspace is making memory SHARED and this point * is reached , then at least one page within the range was previously * PRIVATE , i . e . the slot ' s possible hugepage ranges are changing . * Zapping SPTEs in this case ensures KVM will reassess whether or not * a hugepage can be used for affected ranges . if (WARN_ON_ONCE(!kvm_arch_has_private_mem(kvm)))return false ;if (WARN_ON_ONCE(range->end <= range->start))return false ;/* * If the head and tail pages of the range currently allow a hugepage , * i . e . reside fully in the slot and don ' t have mixed attributes , then * add each corresponding hugepage range to the ongoing invalidation , * e . g . to prevent KVM from creating a hugepage in response to a fault * for a gfn whose attributes aren ' t changing . Note , only the range * of gfns whose attributes are being modified needs to be explicitly * unmapped , as that will unmap any existing hugepages . for (level = PG_LEVEL_2M; level <= KVM_MAX_HUGEPAGE_LEVEL; level++) {1 , level);if ((start != range->start || start + nr_pages > range->end) &&if (end == start)continue ;if ((end + nr_pages) > range->end &&/* Unmap the old attribute page. */ if (range->arg.attributes & KVM_MEMORY_ATTRIBUTE_PRIVATE)else return kvm_unmap_gfn_range(kvm, range);static bool hugepage_has_attrs(struct kvm *kvm, struct kvm_memory_slot *slot,int level, unsigned long attrs)const unsigned long start = gfn;const unsigned long end = start + KVM_PAGES_PER_HPAGE(level);if (level == PG_LEVEL_2M)return kvm_range_has_memory_attributes(kvm, start, end, ~0 , attrs);for (gfn = start; gfn < end; gfn += KVM_PAGES_PER_HPAGE(level - 1 )) {if (hugepage_test_mixed(slot, gfn, level - 1 ) ||return false ;return true ;bool kvm_arch_post_set_memory_attributes(struct kvm *kvm,struct kvm_gfn_range *range)unsigned long attrs = range->arg.attributes;struct kvm_memory_slot *slot = range->slot;int level;/* * Calculate which ranges can be mapped with hugepages even if the slot * can ' t map memory PRIVATE . KVM mustn ' t create a SHARED hugepage over * a range that has PRIVATE GFNs , and conversely converting a range to * SHARED may now allow hugepages . if (WARN_ON_ONCE(!kvm_arch_has_private_mem(kvm)))return false ;/* * The sequence matters here : upper levels consume the result of lower * level ' s scanning . for (level = PG_LEVEL_2M; level <= KVM_MAX_HUGEPAGE_LEVEL; level++) {/* Process the head page if it straddles the range. */ if (gfn != range->start || gfn + nr_pages > range->end) {/* * Skip mixed tracking if the aligned gfn isn ' t covered * by the memslot , KVM can ' t use a hugepage due to the * misaligned address regardless of memory attributes . if (gfn >= slot->base_gfn &&if (hugepage_has_attrs(kvm, slot, gfn, level, attrs))else /* * Pages entirely covered by the range are guaranteed to have * only the attributes which were just set . for ( ; gfn + nr_pages <= range->end; gfn += nr_pages)/* * Process the last tail page if it straddles the range and is * contained by the memslot . Like the head page , KVM can ' t * create a hugepage if the slot size is misaligned . if (gfn < range->end &&if (hugepage_has_attrs(kvm, slot, gfn, level, attrs))else return false ;void kvm_mmu_init_memslot_memory_attributes(struct kvm *kvm,struct kvm_memory_slot *slot)int level;if (!kvm_arch_has_private_mem(kvm))return ;for (level = PG_LEVEL_2M; level <= KVM_MAX_HUGEPAGE_LEVEL; level++) {/* * Don ' t bother tracking mixed attributes for pages that can ' t * be huge due to alignment , i . e . process only pages that are * entirely contained by the memslot . if (start < slot->base_gfn)/* * Unlike setting attributes , every potential hugepage needs to * be manually checked as the attributes may already be mixed . for (gfn = start; gfn < end; gfn += nr_pages) {unsigned long attrs = kvm_get_memory_attributes(kvm, gfn);if (hugepage_has_attrs(kvm, slot, gfn, level, attrs))else #endif
Messung V0.5 in Prozent C=96 H=93 G=94
¤ Dauer der Verarbeitung: 0.639 Sekunden
(vorverarbeitet am 2026-09-28)
¤ *© Formatika GbR, Deutschland
