Loading...
1/* SPDX-License-Identifier: GPL-2.0 */
2#ifndef __KVM_X86_MMU_INTERNAL_H
3#define __KVM_X86_MMU_INTERNAL_H
4
5#include <linux/types.h>
6#include <linux/kvm_host.h>
7#include <asm/kvm_host.h>
8
9#undef MMU_DEBUG
10
11#ifdef MMU_DEBUG
12extern bool dbg;
13
14#define pgprintk(x...) do { if (dbg) printk(x); } while (0)
15#define rmap_printk(fmt, args...) do { if (dbg) printk("%s: " fmt, __func__, ## args); } while (0)
16#define MMU_WARN_ON(x) WARN_ON(x)
17#else
18#define pgprintk(x...) do { } while (0)
19#define rmap_printk(x...) do { } while (0)
20#define MMU_WARN_ON(x) do { } while (0)
21#endif
22
23/* Page table builder macros common to shadow (host) PTEs and guest PTEs. */
24#define __PT_LEVEL_SHIFT(level, bits_per_level) \
25 (PAGE_SHIFT + ((level) - 1) * (bits_per_level))
26#define __PT_INDEX(address, level, bits_per_level) \
27 (((address) >> __PT_LEVEL_SHIFT(level, bits_per_level)) & ((1 << (bits_per_level)) - 1))
28
29#define __PT_LVL_ADDR_MASK(base_addr_mask, level, bits_per_level) \
30 ((base_addr_mask) & ~((1ULL << (PAGE_SHIFT + (((level) - 1) * (bits_per_level)))) - 1))
31
32#define __PT_LVL_OFFSET_MASK(base_addr_mask, level, bits_per_level) \
33 ((base_addr_mask) & ((1ULL << (PAGE_SHIFT + (((level) - 1) * (bits_per_level)))) - 1))
34
35#define __PT_ENT_PER_PAGE(bits_per_level) (1 << (bits_per_level))
36
37/*
38 * Unlike regular MMU roots, PAE "roots", a.k.a. PDPTEs/PDPTRs, have a PRESENT
39 * bit, and thus are guaranteed to be non-zero when valid. And, when a guest
40 * PDPTR is !PRESENT, its corresponding PAE root cannot be set to INVALID_PAGE,
41 * as the CPU would treat that as PRESENT PDPTR with reserved bits set. Use
42 * '0' instead of INVALID_PAGE to indicate an invalid PAE root.
43 */
44#define INVALID_PAE_ROOT 0
45#define IS_VALID_PAE_ROOT(x) (!!(x))
46
47typedef u64 __rcu *tdp_ptep_t;
48
49struct kvm_mmu_page {
50 /*
51 * Note, "link" through "spt" fit in a single 64 byte cache line on
52 * 64-bit kernels, keep it that way unless there's a reason not to.
53 */
54 struct list_head link;
55 struct hlist_node hash_link;
56
57 bool tdp_mmu_page;
58 bool unsync;
59 u8 mmu_valid_gen;
60
61 /*
62 * The shadow page can't be replaced by an equivalent huge page
63 * because it is being used to map an executable page in the guest
64 * and the NX huge page mitigation is enabled.
65 */
66 bool nx_huge_page_disallowed;
67
68 /*
69 * The following two entries are used to key the shadow page in the
70 * hash table.
71 */
72 union kvm_mmu_page_role role;
73 gfn_t gfn;
74
75 u64 *spt;
76
77 /*
78 * Stores the result of the guest translation being shadowed by each
79 * SPTE. KVM shadows two types of guest translations: nGPA -> GPA
80 * (shadow EPT/NPT) and GVA -> GPA (traditional shadow paging). In both
81 * cases the result of the translation is a GPA and a set of access
82 * constraints.
83 *
84 * The GFN is stored in the upper bits (PAGE_SHIFT) and the shadowed
85 * access permissions are stored in the lower bits. Note, for
86 * convenience and uniformity across guests, the access permissions are
87 * stored in KVM format (e.g. ACC_EXEC_MASK) not the raw guest format.
88 */
89 u64 *shadowed_translation;
90
91 /* Currently serving as active root */
92 union {
93 int root_count;
94 refcount_t tdp_mmu_root_count;
95 };
96 unsigned int unsync_children;
97 union {
98 struct kvm_rmap_head parent_ptes; /* rmap pointers to parent sptes */
99 tdp_ptep_t ptep;
100 };
101 union {
102 DECLARE_BITMAP(unsync_child_bitmap, 512);
103 struct {
104 struct work_struct tdp_mmu_async_work;
105 void *tdp_mmu_async_data;
106 };
107 };
108
109 /*
110 * Tracks shadow pages that, if zapped, would allow KVM to create an NX
111 * huge page. A shadow page will have nx_huge_page_disallowed set but
112 * not be on the list if a huge page is disallowed for other reasons,
113 * e.g. because KVM is shadowing a PTE at the same gfn, the memslot
114 * isn't properly aligned, etc...
115 */
116 struct list_head possible_nx_huge_page_link;
117#ifdef CONFIG_X86_32
118 /*
119 * Used out of the mmu-lock to avoid reading spte values while an
120 * update is in progress; see the comments in __get_spte_lockless().
121 */
122 int clear_spte_count;
123#endif
124
125 /* Number of writes since the last time traversal visited this page. */
126 atomic_t write_flooding_count;
127
128#ifdef CONFIG_X86_64
129 /* Used for freeing the page asynchronously if it is a TDP MMU page. */
130 struct rcu_head rcu_head;
131#endif
132};
133
134extern struct kmem_cache *mmu_page_header_cache;
135
136static inline int kvm_mmu_role_as_id(union kvm_mmu_page_role role)
137{
138 return role.smm ? 1 : 0;
139}
140
141static inline int kvm_mmu_page_as_id(struct kvm_mmu_page *sp)
142{
143 return kvm_mmu_role_as_id(sp->role);
144}
145
146static inline bool kvm_mmu_page_ad_need_write_protect(struct kvm_mmu_page *sp)
147{
148 /*
149 * When using the EPT page-modification log, the GPAs in the CPU dirty
150 * log would come from L2 rather than L1. Therefore, we need to rely
151 * on write protection to record dirty pages, which bypasses PML, since
152 * writes now result in a vmexit. Note, the check on CPU dirty logging
153 * being enabled is mandatory as the bits used to denote WP-only SPTEs
154 * are reserved for PAE paging (32-bit KVM).
155 */
156 return kvm_x86_ops.cpu_dirty_log_size && sp->role.guest_mode;
157}
158
159int mmu_try_to_unsync_pages(struct kvm *kvm, const struct kvm_memory_slot *slot,
160 gfn_t gfn, bool can_unsync, bool prefetch);
161
162void kvm_mmu_gfn_disallow_lpage(const struct kvm_memory_slot *slot, gfn_t gfn);
163void kvm_mmu_gfn_allow_lpage(const struct kvm_memory_slot *slot, gfn_t gfn);
164bool kvm_mmu_slot_gfn_write_protect(struct kvm *kvm,
165 struct kvm_memory_slot *slot, u64 gfn,
166 int min_level);
167void kvm_flush_remote_tlbs_with_address(struct kvm *kvm,
168 u64 start_gfn, u64 pages);
169unsigned int pte_list_count(struct kvm_rmap_head *rmap_head);
170
171extern int nx_huge_pages;
172static inline bool is_nx_huge_page_enabled(struct kvm *kvm)
173{
174 return READ_ONCE(nx_huge_pages) && !kvm->arch.disable_nx_huge_pages;
175}
176
177struct kvm_page_fault {
178 /* arguments to kvm_mmu_do_page_fault. */
179 const gpa_t addr;
180 const u32 error_code;
181 const bool prefetch;
182
183 /* Derived from error_code. */
184 const bool exec;
185 const bool write;
186 const bool present;
187 const bool rsvd;
188 const bool user;
189
190 /* Derived from mmu and global state. */
191 const bool is_tdp;
192 const bool nx_huge_page_workaround_enabled;
193
194 /*
195 * Whether a >4KB mapping can be created or is forbidden due to NX
196 * hugepages.
197 */
198 bool huge_page_disallowed;
199
200 /*
201 * Maximum page size that can be created for this fault; input to
202 * FNAME(fetch), __direct_map and kvm_tdp_mmu_map.
203 */
204 u8 max_level;
205
206 /*
207 * Page size that can be created based on the max_level and the
208 * page size used by the host mapping.
209 */
210 u8 req_level;
211
212 /*
213 * Page size that will be created based on the req_level and
214 * huge_page_disallowed.
215 */
216 u8 goal_level;
217
218 /* Shifted addr, or result of guest page table walk if addr is a gva. */
219 gfn_t gfn;
220
221 /* The memslot containing gfn. May be NULL. */
222 struct kvm_memory_slot *slot;
223
224 /* Outputs of kvm_faultin_pfn. */
225 kvm_pfn_t pfn;
226 hva_t hva;
227 bool map_writable;
228};
229
230int kvm_tdp_page_fault(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault);
231
232/*
233 * Return values of handle_mmio_page_fault(), mmu.page_fault(), fast_page_fault(),
234 * and of course kvm_mmu_do_page_fault().
235 *
236 * RET_PF_CONTINUE: So far, so good, keep handling the page fault.
237 * RET_PF_RETRY: let CPU fault again on the address.
238 * RET_PF_EMULATE: mmio page fault, emulate the instruction directly.
239 * RET_PF_INVALID: the spte is invalid, let the real page fault path update it.
240 * RET_PF_FIXED: The faulting entry has been fixed.
241 * RET_PF_SPURIOUS: The faulting entry was already fixed, e.g. by another vCPU.
242 *
243 * Any names added to this enum should be exported to userspace for use in
244 * tracepoints via TRACE_DEFINE_ENUM() in mmutrace.h
245 *
246 * Note, all values must be greater than or equal to zero so as not to encroach
247 * on -errno return values. Somewhat arbitrarily use '0' for CONTINUE, which
248 * will allow for efficient machine code when checking for CONTINUE, e.g.
249 * "TEST %rax, %rax, JNZ", as all "stop!" values are non-zero.
250 */
251enum {
252 RET_PF_CONTINUE = 0,
253 RET_PF_RETRY,
254 RET_PF_EMULATE,
255 RET_PF_INVALID,
256 RET_PF_FIXED,
257 RET_PF_SPURIOUS,
258};
259
260static inline int kvm_mmu_do_page_fault(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa,
261 u32 err, bool prefetch)
262{
263 struct kvm_page_fault fault = {
264 .addr = cr2_or_gpa,
265 .error_code = err,
266 .exec = err & PFERR_FETCH_MASK,
267 .write = err & PFERR_WRITE_MASK,
268 .present = err & PFERR_PRESENT_MASK,
269 .rsvd = err & PFERR_RSVD_MASK,
270 .user = err & PFERR_USER_MASK,
271 .prefetch = prefetch,
272 .is_tdp = likely(vcpu->arch.mmu->page_fault == kvm_tdp_page_fault),
273 .nx_huge_page_workaround_enabled =
274 is_nx_huge_page_enabled(vcpu->kvm),
275
276 .max_level = KVM_MAX_HUGEPAGE_LEVEL,
277 .req_level = PG_LEVEL_4K,
278 .goal_level = PG_LEVEL_4K,
279 };
280 int r;
281
282 /*
283 * Async #PF "faults", a.k.a. prefetch faults, are not faults from the
284 * guest perspective and have already been counted at the time of the
285 * original fault.
286 */
287 if (!prefetch)
288 vcpu->stat.pf_taken++;
289
290 if (IS_ENABLED(CONFIG_RETPOLINE) && fault.is_tdp)
291 r = kvm_tdp_page_fault(vcpu, &fault);
292 else
293 r = vcpu->arch.mmu->page_fault(vcpu, &fault);
294
295 /*
296 * Similar to above, prefetch faults aren't truly spurious, and the
297 * async #PF path doesn't do emulation. Do count faults that are fixed
298 * by the async #PF handler though, otherwise they'll never be counted.
299 */
300 if (r == RET_PF_FIXED)
301 vcpu->stat.pf_fixed++;
302 else if (prefetch)
303 ;
304 else if (r == RET_PF_EMULATE)
305 vcpu->stat.pf_emulate++;
306 else if (r == RET_PF_SPURIOUS)
307 vcpu->stat.pf_spurious++;
308 return r;
309}
310
311int kvm_mmu_max_mapping_level(struct kvm *kvm,
312 const struct kvm_memory_slot *slot, gfn_t gfn,
313 int max_level);
314void kvm_mmu_hugepage_adjust(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault);
315void disallowed_hugepage_adjust(struct kvm_page_fault *fault, u64 spte, int cur_level);
316
317void *mmu_memory_cache_alloc(struct kvm_mmu_memory_cache *mc);
318
319void track_possible_nx_huge_page(struct kvm *kvm, struct kvm_mmu_page *sp);
320void untrack_possible_nx_huge_page(struct kvm *kvm, struct kvm_mmu_page *sp);
321
322#endif /* __KVM_X86_MMU_INTERNAL_H */
1/* SPDX-License-Identifier: GPL-2.0 */
2#ifndef __KVM_X86_MMU_INTERNAL_H
3#define __KVM_X86_MMU_INTERNAL_H
4
5#include <linux/types.h>
6#include <linux/kvm_host.h>
7#include <asm/kvm_host.h>
8
9#ifdef CONFIG_KVM_PROVE_MMU
10#define KVM_MMU_WARN_ON(x) WARN_ON_ONCE(x)
11#else
12#define KVM_MMU_WARN_ON(x) BUILD_BUG_ON_INVALID(x)
13#endif
14
15/* Page table builder macros common to shadow (host) PTEs and guest PTEs. */
16#define __PT_BASE_ADDR_MASK GENMASK_ULL(51, 12)
17#define __PT_LEVEL_SHIFT(level, bits_per_level) \
18 (PAGE_SHIFT + ((level) - 1) * (bits_per_level))
19#define __PT_INDEX(address, level, bits_per_level) \
20 (((address) >> __PT_LEVEL_SHIFT(level, bits_per_level)) & ((1 << (bits_per_level)) - 1))
21
22#define __PT_LVL_ADDR_MASK(base_addr_mask, level, bits_per_level) \
23 ((base_addr_mask) & ~((1ULL << (PAGE_SHIFT + (((level) - 1) * (bits_per_level)))) - 1))
24
25#define __PT_LVL_OFFSET_MASK(base_addr_mask, level, bits_per_level) \
26 ((base_addr_mask) & ((1ULL << (PAGE_SHIFT + (((level) - 1) * (bits_per_level)))) - 1))
27
28#define __PT_ENT_PER_PAGE(bits_per_level) (1 << (bits_per_level))
29
30/*
31 * Unlike regular MMU roots, PAE "roots", a.k.a. PDPTEs/PDPTRs, have a PRESENT
32 * bit, and thus are guaranteed to be non-zero when valid. And, when a guest
33 * PDPTR is !PRESENT, its corresponding PAE root cannot be set to INVALID_PAGE,
34 * as the CPU would treat that as PRESENT PDPTR with reserved bits set. Use
35 * '0' instead of INVALID_PAGE to indicate an invalid PAE root.
36 */
37#define INVALID_PAE_ROOT 0
38#define IS_VALID_PAE_ROOT(x) (!!(x))
39
40static inline hpa_t kvm_mmu_get_dummy_root(void)
41{
42 return my_zero_pfn(0) << PAGE_SHIFT;
43}
44
45static inline bool kvm_mmu_is_dummy_root(hpa_t shadow_page)
46{
47 return is_zero_pfn(shadow_page >> PAGE_SHIFT);
48}
49
50typedef u64 __rcu *tdp_ptep_t;
51
52struct kvm_mmu_page {
53 /*
54 * Note, "link" through "spt" fit in a single 64 byte cache line on
55 * 64-bit kernels, keep it that way unless there's a reason not to.
56 */
57 struct list_head link;
58 struct hlist_node hash_link;
59
60 bool tdp_mmu_page;
61 bool unsync;
62 union {
63 u8 mmu_valid_gen;
64
65 /* Only accessed under slots_lock. */
66 bool tdp_mmu_scheduled_root_to_zap;
67 };
68
69 /*
70 * The shadow page can't be replaced by an equivalent huge page
71 * because it is being used to map an executable page in the guest
72 * and the NX huge page mitigation is enabled.
73 */
74 bool nx_huge_page_disallowed;
75
76 /*
77 * The following two entries are used to key the shadow page in the
78 * hash table.
79 */
80 union kvm_mmu_page_role role;
81 gfn_t gfn;
82
83 u64 *spt;
84
85 /*
86 * Stores the result of the guest translation being shadowed by each
87 * SPTE. KVM shadows two types of guest translations: nGPA -> GPA
88 * (shadow EPT/NPT) and GVA -> GPA (traditional shadow paging). In both
89 * cases the result of the translation is a GPA and a set of access
90 * constraints.
91 *
92 * The GFN is stored in the upper bits (PAGE_SHIFT) and the shadowed
93 * access permissions are stored in the lower bits. Note, for
94 * convenience and uniformity across guests, the access permissions are
95 * stored in KVM format (e.g. ACC_EXEC_MASK) not the raw guest format.
96 */
97 u64 *shadowed_translation;
98
99 /* Currently serving as active root */
100 union {
101 int root_count;
102 refcount_t tdp_mmu_root_count;
103 };
104 unsigned int unsync_children;
105 union {
106 struct kvm_rmap_head parent_ptes; /* rmap pointers to parent sptes */
107 tdp_ptep_t ptep;
108 };
109 DECLARE_BITMAP(unsync_child_bitmap, 512);
110
111 /*
112 * Tracks shadow pages that, if zapped, would allow KVM to create an NX
113 * huge page. A shadow page will have nx_huge_page_disallowed set but
114 * not be on the list if a huge page is disallowed for other reasons,
115 * e.g. because KVM is shadowing a PTE at the same gfn, the memslot
116 * isn't properly aligned, etc...
117 */
118 struct list_head possible_nx_huge_page_link;
119#ifdef CONFIG_X86_32
120 /*
121 * Used out of the mmu-lock to avoid reading spte values while an
122 * update is in progress; see the comments in __get_spte_lockless().
123 */
124 int clear_spte_count;
125#endif
126
127 /* Number of writes since the last time traversal visited this page. */
128 atomic_t write_flooding_count;
129
130#ifdef CONFIG_X86_64
131 /* Used for freeing the page asynchronously if it is a TDP MMU page. */
132 struct rcu_head rcu_head;
133#endif
134};
135
136extern struct kmem_cache *mmu_page_header_cache;
137
138static inline int kvm_mmu_role_as_id(union kvm_mmu_page_role role)
139{
140 return role.smm ? 1 : 0;
141}
142
143static inline int kvm_mmu_page_as_id(struct kvm_mmu_page *sp)
144{
145 return kvm_mmu_role_as_id(sp->role);
146}
147
148static inline bool kvm_mmu_page_ad_need_write_protect(struct kvm_mmu_page *sp)
149{
150 /*
151 * When using the EPT page-modification log, the GPAs in the CPU dirty
152 * log would come from L2 rather than L1. Therefore, we need to rely
153 * on write protection to record dirty pages, which bypasses PML, since
154 * writes now result in a vmexit. Note, the check on CPU dirty logging
155 * being enabled is mandatory as the bits used to denote WP-only SPTEs
156 * are reserved for PAE paging (32-bit KVM).
157 */
158 return kvm_x86_ops.cpu_dirty_log_size && sp->role.guest_mode;
159}
160
161static inline gfn_t gfn_round_for_level(gfn_t gfn, int level)
162{
163 return gfn & -KVM_PAGES_PER_HPAGE(level);
164}
165
166int mmu_try_to_unsync_pages(struct kvm *kvm, const struct kvm_memory_slot *slot,
167 gfn_t gfn, bool can_unsync, bool prefetch);
168
169void kvm_mmu_gfn_disallow_lpage(const struct kvm_memory_slot *slot, gfn_t gfn);
170void kvm_mmu_gfn_allow_lpage(const struct kvm_memory_slot *slot, gfn_t gfn);
171bool kvm_mmu_slot_gfn_write_protect(struct kvm *kvm,
172 struct kvm_memory_slot *slot, u64 gfn,
173 int min_level);
174
175/* Flush the given page (huge or not) of guest memory. */
176static inline void kvm_flush_remote_tlbs_gfn(struct kvm *kvm, gfn_t gfn, int level)
177{
178 kvm_flush_remote_tlbs_range(kvm, gfn_round_for_level(gfn, level),
179 KVM_PAGES_PER_HPAGE(level));
180}
181
182unsigned int pte_list_count(struct kvm_rmap_head *rmap_head);
183
184extern int nx_huge_pages;
185static inline bool is_nx_huge_page_enabled(struct kvm *kvm)
186{
187 return READ_ONCE(nx_huge_pages) && !kvm->arch.disable_nx_huge_pages;
188}
189
190struct kvm_page_fault {
191 /* arguments to kvm_mmu_do_page_fault. */
192 const gpa_t addr;
193 const u32 error_code;
194 const bool prefetch;
195
196 /* Derived from error_code. */
197 const bool exec;
198 const bool write;
199 const bool present;
200 const bool rsvd;
201 const bool user;
202
203 /* Derived from mmu and global state. */
204 const bool is_tdp;
205 const bool is_private;
206 const bool nx_huge_page_workaround_enabled;
207
208 /*
209 * Whether a >4KB mapping can be created or is forbidden due to NX
210 * hugepages.
211 */
212 bool huge_page_disallowed;
213
214 /*
215 * Maximum page size that can be created for this fault; input to
216 * FNAME(fetch), direct_map() and kvm_tdp_mmu_map().
217 */
218 u8 max_level;
219
220 /*
221 * Page size that can be created based on the max_level and the
222 * page size used by the host mapping.
223 */
224 u8 req_level;
225
226 /*
227 * Page size that will be created based on the req_level and
228 * huge_page_disallowed.
229 */
230 u8 goal_level;
231
232 /* Shifted addr, or result of guest page table walk if addr is a gva. */
233 gfn_t gfn;
234
235 /* The memslot containing gfn. May be NULL. */
236 struct kvm_memory_slot *slot;
237
238 /* Outputs of kvm_faultin_pfn. */
239 unsigned long mmu_seq;
240 kvm_pfn_t pfn;
241 hva_t hva;
242 bool map_writable;
243
244 /*
245 * Indicates the guest is trying to write a gfn that contains one or
246 * more of the PTEs used to translate the write itself, i.e. the access
247 * is changing its own translation in the guest page tables.
248 */
249 bool write_fault_to_shadow_pgtable;
250};
251
252int kvm_tdp_page_fault(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault);
253
254/*
255 * Return values of handle_mmio_page_fault(), mmu.page_fault(), fast_page_fault(),
256 * and of course kvm_mmu_do_page_fault().
257 *
258 * RET_PF_CONTINUE: So far, so good, keep handling the page fault.
259 * RET_PF_RETRY: let CPU fault again on the address.
260 * RET_PF_EMULATE: mmio page fault, emulate the instruction directly.
261 * RET_PF_INVALID: the spte is invalid, let the real page fault path update it.
262 * RET_PF_FIXED: The faulting entry has been fixed.
263 * RET_PF_SPURIOUS: The faulting entry was already fixed, e.g. by another vCPU.
264 *
265 * Any names added to this enum should be exported to userspace for use in
266 * tracepoints via TRACE_DEFINE_ENUM() in mmutrace.h
267 *
268 * Note, all values must be greater than or equal to zero so as not to encroach
269 * on -errno return values. Somewhat arbitrarily use '0' for CONTINUE, which
270 * will allow for efficient machine code when checking for CONTINUE, e.g.
271 * "TEST %rax, %rax, JNZ", as all "stop!" values are non-zero.
272 */
273enum {
274 RET_PF_CONTINUE = 0,
275 RET_PF_RETRY,
276 RET_PF_EMULATE,
277 RET_PF_INVALID,
278 RET_PF_FIXED,
279 RET_PF_SPURIOUS,
280};
281
282static inline int kvm_mmu_do_page_fault(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa,
283 u32 err, bool prefetch, int *emulation_type)
284{
285 struct kvm_page_fault fault = {
286 .addr = cr2_or_gpa,
287 .error_code = err,
288 .exec = err & PFERR_FETCH_MASK,
289 .write = err & PFERR_WRITE_MASK,
290 .present = err & PFERR_PRESENT_MASK,
291 .rsvd = err & PFERR_RSVD_MASK,
292 .user = err & PFERR_USER_MASK,
293 .prefetch = prefetch,
294 .is_tdp = likely(vcpu->arch.mmu->page_fault == kvm_tdp_page_fault),
295 .nx_huge_page_workaround_enabled =
296 is_nx_huge_page_enabled(vcpu->kvm),
297
298 .max_level = KVM_MAX_HUGEPAGE_LEVEL,
299 .req_level = PG_LEVEL_4K,
300 .goal_level = PG_LEVEL_4K,
301 .is_private = kvm_mem_is_private(vcpu->kvm, cr2_or_gpa >> PAGE_SHIFT),
302 };
303 int r;
304
305 if (vcpu->arch.mmu->root_role.direct) {
306 fault.gfn = fault.addr >> PAGE_SHIFT;
307 fault.slot = kvm_vcpu_gfn_to_memslot(vcpu, fault.gfn);
308 }
309
310 /*
311 * Async #PF "faults", a.k.a. prefetch faults, are not faults from the
312 * guest perspective and have already been counted at the time of the
313 * original fault.
314 */
315 if (!prefetch)
316 vcpu->stat.pf_taken++;
317
318 if (IS_ENABLED(CONFIG_MITIGATION_RETPOLINE) && fault.is_tdp)
319 r = kvm_tdp_page_fault(vcpu, &fault);
320 else
321 r = vcpu->arch.mmu->page_fault(vcpu, &fault);
322
323 if (fault.write_fault_to_shadow_pgtable && emulation_type)
324 *emulation_type |= EMULTYPE_WRITE_PF_TO_SP;
325
326 /*
327 * Similar to above, prefetch faults aren't truly spurious, and the
328 * async #PF path doesn't do emulation. Do count faults that are fixed
329 * by the async #PF handler though, otherwise they'll never be counted.
330 */
331 if (r == RET_PF_FIXED)
332 vcpu->stat.pf_fixed++;
333 else if (prefetch)
334 ;
335 else if (r == RET_PF_EMULATE)
336 vcpu->stat.pf_emulate++;
337 else if (r == RET_PF_SPURIOUS)
338 vcpu->stat.pf_spurious++;
339 return r;
340}
341
342int kvm_mmu_max_mapping_level(struct kvm *kvm,
343 const struct kvm_memory_slot *slot, gfn_t gfn,
344 int max_level);
345void kvm_mmu_hugepage_adjust(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault);
346void disallowed_hugepage_adjust(struct kvm_page_fault *fault, u64 spte, int cur_level);
347
348void *mmu_memory_cache_alloc(struct kvm_mmu_memory_cache *mc);
349
350void track_possible_nx_huge_page(struct kvm *kvm, struct kvm_mmu_page *sp);
351void untrack_possible_nx_huge_page(struct kvm *kvm, struct kvm_mmu_page *sp);
352
353#endif /* __KVM_X86_MMU_INTERNAL_H */