• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * Kernel-based Virtual Machine driver for Linux
3  *
4  * This module enables machines with Intel VT-x extensions to run virtual
5  * machines without emulation or binary translation.
6  *
7  * MMU support
8  *
9  * Copyright (C) 2006 Qumranet, Inc.
10  *
11  * Authors:
12  *   Yaniv Kamay  <yaniv@qumranet.com>
13  *   Avi Kivity   <avi@qumranet.com>
14  *
15  * This work is licensed under the terms of the GNU GPL, version 2.  See
16  * the COPYING file in the top-level directory.
17  *
18  */
19 
20 /*
21  * We need the mmu code to access both 32-bit and 64-bit guest ptes,
22  * so the code in this file is compiled twice, once per pte size.
23  */
24 
25 #if PTTYPE == 64
26 	#define pt_element_t u64
27 	#define guest_walker guest_walker64
28 	#define shadow_walker shadow_walker64
29 	#define FNAME(name) paging##64_##name
30 	#define PT_BASE_ADDR_MASK PT64_BASE_ADDR_MASK
31 	#define PT_DIR_BASE_ADDR_MASK PT64_DIR_BASE_ADDR_MASK
32 	#define PT_INDEX(addr, level) PT64_INDEX(addr, level)
33 	#define PT_LEVEL_MASK(level) PT64_LEVEL_MASK(level)
34 	#define PT_LEVEL_BITS PT64_LEVEL_BITS
35 	#ifdef CONFIG_X86_64
36 	#define PT_MAX_FULL_LEVELS 4
37 	#define CMPXCHG cmpxchg
38 	#else
39 	#define CMPXCHG cmpxchg64
40 	#define PT_MAX_FULL_LEVELS 2
41 	#endif
42 #elif PTTYPE == 32
43 	#define pt_element_t u32
44 	#define guest_walker guest_walker32
45 	#define shadow_walker shadow_walker32
46 	#define FNAME(name) paging##32_##name
47 	#define PT_BASE_ADDR_MASK PT32_BASE_ADDR_MASK
48 	#define PT_DIR_BASE_ADDR_MASK PT32_DIR_BASE_ADDR_MASK
49 	#define PT_INDEX(addr, level) PT32_INDEX(addr, level)
50 	#define PT_LEVEL_MASK(level) PT32_LEVEL_MASK(level)
51 	#define PT_LEVEL_BITS PT32_LEVEL_BITS
52 	#define PT_MAX_FULL_LEVELS 2
53 	#define CMPXCHG cmpxchg
54 #else
55 	#error Invalid PTTYPE value
56 #endif
57 
58 #define gpte_to_gfn FNAME(gpte_to_gfn)
59 #define gpte_to_gfn_pde FNAME(gpte_to_gfn_pde)
60 
61 /*
62  * The guest_walker structure emulates the behavior of the hardware page
63  * table walker.
64  */
65 struct guest_walker {
66 	int level;
67 	gfn_t table_gfn[PT_MAX_FULL_LEVELS];
68 	pt_element_t ptes[PT_MAX_FULL_LEVELS];
69 	gpa_t pte_gpa[PT_MAX_FULL_LEVELS];
70 	unsigned pt_access;
71 	unsigned pte_access;
72 	gfn_t gfn;
73 	u32 error_code;
74 };
75 
76 struct shadow_walker {
77 	struct kvm_shadow_walk walker;
78 	struct guest_walker *guest_walker;
79 	int user_fault;
80 	int write_fault;
81 	int largepage;
82 	int *ptwrite;
83 	pfn_t pfn;
84 	u64 *sptep;
85 	gpa_t pte_gpa;
86 };
87 
gpte_to_gfn(pt_element_t gpte)88 static gfn_t gpte_to_gfn(pt_element_t gpte)
89 {
90 	return (gpte & PT_BASE_ADDR_MASK) >> PAGE_SHIFT;
91 }
92 
gpte_to_gfn_pde(pt_element_t gpte)93 static gfn_t gpte_to_gfn_pde(pt_element_t gpte)
94 {
95 	return (gpte & PT_DIR_BASE_ADDR_MASK) >> PAGE_SHIFT;
96 }
97 
FNAME(cmpxchg_gpte)98 static bool FNAME(cmpxchg_gpte)(struct kvm *kvm,
99 			 gfn_t table_gfn, unsigned index,
100 			 pt_element_t orig_pte, pt_element_t new_pte)
101 {
102 	pt_element_t ret;
103 	pt_element_t *table;
104 	struct page *page;
105 
106 	page = gfn_to_page(kvm, table_gfn);
107 
108 	table = kmap_atomic(page, KM_USER0);
109 	ret = CMPXCHG(&table[index], orig_pte, new_pte);
110 	kunmap_atomic(table, KM_USER0);
111 
112 	kvm_release_page_dirty(page);
113 
114 	return (ret != orig_pte);
115 }
116 
FNAME(gpte_access)117 static unsigned FNAME(gpte_access)(struct kvm_vcpu *vcpu, pt_element_t gpte)
118 {
119 	unsigned access;
120 
121 	access = (gpte & (PT_WRITABLE_MASK | PT_USER_MASK)) | ACC_EXEC_MASK;
122 #if PTTYPE == 64
123 	if (is_nx(vcpu))
124 		access &= ~(gpte >> PT64_NX_SHIFT);
125 #endif
126 	return access;
127 }
128 
129 /*
130  * Fetch a guest pte for a guest virtual address
131  */
FNAME(walk_addr)132 static int FNAME(walk_addr)(struct guest_walker *walker,
133 			    struct kvm_vcpu *vcpu, gva_t addr,
134 			    int write_fault, int user_fault, int fetch_fault)
135 {
136 	pt_element_t pte;
137 	gfn_t table_gfn;
138 	unsigned index, pt_access, pte_access;
139 	gpa_t pte_gpa;
140 
141 	pgprintk("%s: addr %lx\n", __func__, addr);
142 walk:
143 	walker->level = vcpu->arch.mmu.root_level;
144 	pte = vcpu->arch.cr3;
145 #if PTTYPE == 64
146 	if (!is_long_mode(vcpu)) {
147 		pte = vcpu->arch.pdptrs[(addr >> 30) & 3];
148 		if (!is_present_pte(pte))
149 			goto not_present;
150 		--walker->level;
151 	}
152 #endif
153 	ASSERT((!is_long_mode(vcpu) && is_pae(vcpu)) ||
154 	       (vcpu->arch.cr3 & CR3_NONPAE_RESERVED_BITS) == 0);
155 
156 	pt_access = ACC_ALL;
157 
158 	for (;;) {
159 		index = PT_INDEX(addr, walker->level);
160 
161 		table_gfn = gpte_to_gfn(pte);
162 		pte_gpa = gfn_to_gpa(table_gfn);
163 		pte_gpa += index * sizeof(pt_element_t);
164 		walker->table_gfn[walker->level - 1] = table_gfn;
165 		walker->pte_gpa[walker->level - 1] = pte_gpa;
166 		pgprintk("%s: table_gfn[%d] %lx\n", __func__,
167 			 walker->level - 1, table_gfn);
168 
169 		kvm_read_guest(vcpu->kvm, pte_gpa, &pte, sizeof(pte));
170 
171 		if (!is_present_pte(pte))
172 			goto not_present;
173 
174 		if (write_fault && !is_writeble_pte(pte))
175 			if (user_fault || is_write_protection(vcpu))
176 				goto access_error;
177 
178 		if (user_fault && !(pte & PT_USER_MASK))
179 			goto access_error;
180 
181 #if PTTYPE == 64
182 		if (fetch_fault && is_nx(vcpu) && (pte & PT64_NX_MASK))
183 			goto access_error;
184 #endif
185 
186 		if (!(pte & PT_ACCESSED_MASK)) {
187 			mark_page_dirty(vcpu->kvm, table_gfn);
188 			if (FNAME(cmpxchg_gpte)(vcpu->kvm, table_gfn,
189 			    index, pte, pte|PT_ACCESSED_MASK))
190 				goto walk;
191 			pte |= PT_ACCESSED_MASK;
192 		}
193 
194 		pte_access = pt_access & FNAME(gpte_access)(vcpu, pte);
195 
196 		walker->ptes[walker->level - 1] = pte;
197 
198 		if (walker->level == PT_PAGE_TABLE_LEVEL) {
199 			walker->gfn = gpte_to_gfn(pte);
200 			break;
201 		}
202 
203 		if (walker->level == PT_DIRECTORY_LEVEL
204 		    && (pte & PT_PAGE_SIZE_MASK)
205 		    && (PTTYPE == 64 || is_pse(vcpu))) {
206 			walker->gfn = gpte_to_gfn_pde(pte);
207 			walker->gfn += PT_INDEX(addr, PT_PAGE_TABLE_LEVEL);
208 			if (PTTYPE == 32 && is_cpuid_PSE36())
209 				walker->gfn += pse36_gfn_delta(pte);
210 			break;
211 		}
212 
213 		pt_access = pte_access;
214 		--walker->level;
215 	}
216 
217 	if (write_fault && !is_dirty_pte(pte)) {
218 		bool ret;
219 
220 		mark_page_dirty(vcpu->kvm, table_gfn);
221 		ret = FNAME(cmpxchg_gpte)(vcpu->kvm, table_gfn, index, pte,
222 			    pte|PT_DIRTY_MASK);
223 		if (ret)
224 			goto walk;
225 		pte |= PT_DIRTY_MASK;
226 		kvm_mmu_pte_write(vcpu, pte_gpa, (u8 *)&pte, sizeof(pte), 0);
227 		walker->ptes[walker->level - 1] = pte;
228 	}
229 
230 	walker->pt_access = pt_access;
231 	walker->pte_access = pte_access;
232 	pgprintk("%s: pte %llx pte_access %x pt_access %x\n",
233 		 __func__, (u64)pte, pt_access, pte_access);
234 	return 1;
235 
236 not_present:
237 	walker->error_code = 0;
238 	goto err;
239 
240 access_error:
241 	walker->error_code = PFERR_PRESENT_MASK;
242 
243 err:
244 	if (write_fault)
245 		walker->error_code |= PFERR_WRITE_MASK;
246 	if (user_fault)
247 		walker->error_code |= PFERR_USER_MASK;
248 	if (fetch_fault)
249 		walker->error_code |= PFERR_FETCH_MASK;
250 	return 0;
251 }
252 
FNAME(update_pte)253 static void FNAME(update_pte)(struct kvm_vcpu *vcpu, struct kvm_mmu_page *page,
254 			      u64 *spte, const void *pte)
255 {
256 	pt_element_t gpte;
257 	unsigned pte_access;
258 	pfn_t pfn;
259 	int largepage = vcpu->arch.update_pte.largepage;
260 
261 	gpte = *(const pt_element_t *)pte;
262 	if (~gpte & (PT_PRESENT_MASK | PT_ACCESSED_MASK)) {
263 		if (!is_present_pte(gpte))
264 			set_shadow_pte(spte, shadow_notrap_nonpresent_pte);
265 		return;
266 	}
267 	pgprintk("%s: gpte %llx spte %p\n", __func__, (u64)gpte, spte);
268 	pte_access = page->role.access & FNAME(gpte_access)(vcpu, gpte);
269 	if (gpte_to_gfn(gpte) != vcpu->arch.update_pte.gfn)
270 		return;
271 	pfn = vcpu->arch.update_pte.pfn;
272 	if (is_error_pfn(pfn))
273 		return;
274 	if (mmu_notifier_retry(vcpu, vcpu->arch.update_pte.mmu_seq))
275 		return;
276 	kvm_get_pfn(pfn);
277 	mmu_set_spte(vcpu, spte, page->role.access, pte_access, 0, 0,
278 		     gpte & PT_DIRTY_MASK, NULL, largepage,
279 		     gpte & PT_GLOBAL_MASK, gpte_to_gfn(gpte),
280 		     pfn, true);
281 }
282 
283 /*
284  * Fetch a shadow pte for a specific level in the paging hierarchy.
285  */
FNAME(shadow_walk_entry)286 static int FNAME(shadow_walk_entry)(struct kvm_shadow_walk *_sw,
287 				    struct kvm_vcpu *vcpu, u64 addr,
288 				    u64 *sptep, int level)
289 {
290 	struct shadow_walker *sw =
291 		container_of(_sw, struct shadow_walker, walker);
292 	struct guest_walker *gw = sw->guest_walker;
293 	unsigned access = gw->pt_access;
294 	struct kvm_mmu_page *shadow_page;
295 	u64 spte;
296 	int metaphysical;
297 	gfn_t table_gfn;
298 	int r;
299 	pt_element_t curr_pte;
300 
301 	if (level == PT_PAGE_TABLE_LEVEL
302 	    || (sw->largepage && level == PT_DIRECTORY_LEVEL)) {
303 		mmu_set_spte(vcpu, sptep, access, gw->pte_access & access,
304 			     sw->user_fault, sw->write_fault,
305 			     gw->ptes[gw->level-1] & PT_DIRTY_MASK,
306 			     sw->ptwrite, sw->largepage,
307 			     gw->ptes[gw->level-1] & PT_GLOBAL_MASK,
308 			     gw->gfn, sw->pfn, false);
309 		sw->sptep = sptep;
310 		return 1;
311 	}
312 
313 	if (is_shadow_present_pte(*sptep) && !is_large_pte(*sptep))
314 		return 0;
315 
316 	if (is_large_pte(*sptep)) {
317 		set_shadow_pte(sptep, shadow_trap_nonpresent_pte);
318 		kvm_flush_remote_tlbs(vcpu->kvm);
319 		rmap_remove(vcpu->kvm, sptep);
320 	}
321 
322 	if (level == PT_DIRECTORY_LEVEL && gw->level == PT_DIRECTORY_LEVEL) {
323 		metaphysical = 1;
324 		if (!is_dirty_pte(gw->ptes[level - 1]))
325 			access &= ~ACC_WRITE_MASK;
326 		table_gfn = gpte_to_gfn(gw->ptes[level - 1]);
327 	} else {
328 		metaphysical = 0;
329 		table_gfn = gw->table_gfn[level - 2];
330 	}
331 	shadow_page = kvm_mmu_get_page(vcpu, table_gfn, (gva_t)addr, level-1,
332 				       metaphysical, access, sptep);
333 	if (!metaphysical) {
334 		r = kvm_read_guest_atomic(vcpu->kvm, gw->pte_gpa[level - 2],
335 					  &curr_pte, sizeof(curr_pte));
336 		if (r || curr_pte != gw->ptes[level - 2]) {
337 			kvm_mmu_put_page(shadow_page, sptep);
338 			kvm_release_pfn_clean(sw->pfn);
339 			sw->sptep = NULL;
340 			return 1;
341 		}
342 	}
343 
344 	spte = __pa(shadow_page->spt) | PT_PRESENT_MASK | PT_ACCESSED_MASK
345 		| PT_WRITABLE_MASK | PT_USER_MASK;
346 	*sptep = spte;
347 	return 0;
348 }
349 
FNAME(fetch)350 static u64 *FNAME(fetch)(struct kvm_vcpu *vcpu, gva_t addr,
351 			 struct guest_walker *guest_walker,
352 			 int user_fault, int write_fault, int largepage,
353 			 int *ptwrite, pfn_t pfn)
354 {
355 	struct shadow_walker walker = {
356 		.walker = { .entry = FNAME(shadow_walk_entry), },
357 		.guest_walker = guest_walker,
358 		.user_fault = user_fault,
359 		.write_fault = write_fault,
360 		.largepage = largepage,
361 		.ptwrite = ptwrite,
362 		.pfn = pfn,
363 	};
364 
365 	if (!is_present_pte(guest_walker->ptes[guest_walker->level - 1]))
366 		return NULL;
367 
368 	walk_shadow(&walker.walker, vcpu, addr);
369 
370 	return walker.sptep;
371 }
372 
373 /*
374  * Page fault handler.  There are several causes for a page fault:
375  *   - there is no shadow pte for the guest pte
376  *   - write access through a shadow pte marked read only so that we can set
377  *     the dirty bit
378  *   - write access to a shadow pte marked read only so we can update the page
379  *     dirty bitmap, when userspace requests it
380  *   - mmio access; in this case we will never install a present shadow pte
381  *   - normal guest page fault due to the guest pte marked not present, not
382  *     writable, or not executable
383  *
384  *  Returns: 1 if we need to emulate the instruction, 0 otherwise, or
385  *           a negative value on error.
386  */
FNAME(page_fault)387 static int FNAME(page_fault)(struct kvm_vcpu *vcpu, gva_t addr,
388 			       u32 error_code)
389 {
390 	int write_fault = error_code & PFERR_WRITE_MASK;
391 	int user_fault = error_code & PFERR_USER_MASK;
392 	int fetch_fault = error_code & PFERR_FETCH_MASK;
393 	struct guest_walker walker;
394 	u64 *shadow_pte;
395 	int write_pt = 0;
396 	int r;
397 	pfn_t pfn;
398 	int largepage = 0;
399 	unsigned long mmu_seq;
400 
401 	pgprintk("%s: addr %lx err %x\n", __func__, addr, error_code);
402 	kvm_mmu_audit(vcpu, "pre page fault");
403 
404 	r = mmu_topup_memory_caches(vcpu);
405 	if (r)
406 		return r;
407 
408 	/*
409 	 * Look up the shadow pte for the faulting address.
410 	 */
411 	r = FNAME(walk_addr)(&walker, vcpu, addr, write_fault, user_fault,
412 			     fetch_fault);
413 
414 	/*
415 	 * The page is not mapped by the guest.  Let the guest handle it.
416 	 */
417 	if (!r) {
418 		pgprintk("%s: guest page fault\n", __func__);
419 		inject_page_fault(vcpu, addr, walker.error_code);
420 		vcpu->arch.last_pt_write_count = 0; /* reset fork detector */
421 		return 0;
422 	}
423 
424 	if (walker.level == PT_DIRECTORY_LEVEL) {
425 		gfn_t large_gfn;
426 		large_gfn = walker.gfn & ~(KVM_PAGES_PER_HPAGE-1);
427 		if (is_largepage_backed(vcpu, large_gfn)) {
428 			walker.gfn = large_gfn;
429 			largepage = 1;
430 		}
431 	}
432 	mmu_seq = vcpu->kvm->mmu_notifier_seq;
433 	smp_rmb();
434 	pfn = gfn_to_pfn(vcpu->kvm, walker.gfn);
435 
436 	/* mmio */
437 	if (is_error_pfn(pfn)) {
438 		pgprintk("gfn %lx is mmio\n", walker.gfn);
439 		kvm_release_pfn_clean(pfn);
440 		return 1;
441 	}
442 
443 	spin_lock(&vcpu->kvm->mmu_lock);
444 	if (mmu_notifier_retry(vcpu, mmu_seq))
445 		goto out_unlock;
446 	kvm_mmu_free_some_pages(vcpu);
447 	shadow_pte = FNAME(fetch)(vcpu, addr, &walker, user_fault, write_fault,
448 				  largepage, &write_pt, pfn);
449 
450 	pgprintk("%s: shadow pte %p %llx ptwrite %d\n", __func__,
451 		 shadow_pte, *shadow_pte, write_pt);
452 
453 	if (!write_pt)
454 		vcpu->arch.last_pt_write_count = 0; /* reset fork detector */
455 
456 	++vcpu->stat.pf_fixed;
457 	kvm_mmu_audit(vcpu, "post page fault (fixed)");
458 	spin_unlock(&vcpu->kvm->mmu_lock);
459 
460 	return write_pt;
461 
462 out_unlock:
463 	spin_unlock(&vcpu->kvm->mmu_lock);
464 	kvm_release_pfn_clean(pfn);
465 	return 0;
466 }
467 
FNAME(shadow_invlpg_entry)468 static int FNAME(shadow_invlpg_entry)(struct kvm_shadow_walk *_sw,
469 				      struct kvm_vcpu *vcpu, u64 addr,
470 				      u64 *sptep, int level)
471 {
472 	struct shadow_walker *sw =
473 		container_of(_sw, struct shadow_walker, walker);
474 
475 	/* FIXME: properly handle invlpg on large guest pages */
476 	if (level == PT_PAGE_TABLE_LEVEL ||
477 	    ((level == PT_DIRECTORY_LEVEL) && is_large_pte(*sptep))) {
478 		struct kvm_mmu_page *sp = page_header(__pa(sptep));
479 
480 		sw->pte_gpa = (sp->gfn << PAGE_SHIFT);
481 		sw->pte_gpa += (sptep - sp->spt) * sizeof(pt_element_t);
482 
483 		if (is_shadow_present_pte(*sptep)) {
484 			rmap_remove(vcpu->kvm, sptep);
485 			if (is_large_pte(*sptep))
486 				--vcpu->kvm->stat.lpages;
487 		}
488 		set_shadow_pte(sptep, shadow_trap_nonpresent_pte);
489 		return 1;
490 	}
491 	if (!is_shadow_present_pte(*sptep))
492 		return 1;
493 	return 0;
494 }
495 
FNAME(invlpg)496 static void FNAME(invlpg)(struct kvm_vcpu *vcpu, gva_t gva)
497 {
498 	pt_element_t gpte;
499 	struct shadow_walker walker = {
500 		.walker = { .entry = FNAME(shadow_invlpg_entry), },
501 		.pte_gpa = -1,
502 	};
503 
504 	spin_lock(&vcpu->kvm->mmu_lock);
505 	walk_shadow(&walker.walker, vcpu, gva);
506 	spin_unlock(&vcpu->kvm->mmu_lock);
507 	if (walker.pte_gpa == -1)
508 		return;
509 	if (kvm_read_guest_atomic(vcpu->kvm, walker.pte_gpa, &gpte,
510 				  sizeof(pt_element_t)))
511 		return;
512 	if (is_present_pte(gpte) && (gpte & PT_ACCESSED_MASK)) {
513 		if (mmu_topup_memory_caches(vcpu))
514 			return;
515 		kvm_mmu_pte_write(vcpu, walker.pte_gpa, (const u8 *)&gpte,
516 				  sizeof(pt_element_t), 0);
517 	}
518 }
519 
FNAME(gva_to_gpa)520 static gpa_t FNAME(gva_to_gpa)(struct kvm_vcpu *vcpu, gva_t vaddr)
521 {
522 	struct guest_walker walker;
523 	gpa_t gpa = UNMAPPED_GVA;
524 	int r;
525 
526 	r = FNAME(walk_addr)(&walker, vcpu, vaddr, 0, 0, 0);
527 
528 	if (r) {
529 		gpa = gfn_to_gpa(walker.gfn);
530 		gpa |= vaddr & ~PAGE_MASK;
531 	}
532 
533 	return gpa;
534 }
535 
FNAME(prefetch_page)536 static void FNAME(prefetch_page)(struct kvm_vcpu *vcpu,
537 				 struct kvm_mmu_page *sp)
538 {
539 	int i, j, offset, r;
540 	pt_element_t pt[256 / sizeof(pt_element_t)];
541 	gpa_t pte_gpa;
542 
543 	if (sp->role.metaphysical
544 	    || (PTTYPE == 32 && sp->role.level > PT_PAGE_TABLE_LEVEL)) {
545 		nonpaging_prefetch_page(vcpu, sp);
546 		return;
547 	}
548 
549 	pte_gpa = gfn_to_gpa(sp->gfn);
550 	if (PTTYPE == 32) {
551 		offset = sp->role.quadrant << PT64_LEVEL_BITS;
552 		pte_gpa += offset * sizeof(pt_element_t);
553 	}
554 
555 	for (i = 0; i < PT64_ENT_PER_PAGE; i += ARRAY_SIZE(pt)) {
556 		r = kvm_read_guest_atomic(vcpu->kvm, pte_gpa, pt, sizeof pt);
557 		pte_gpa += ARRAY_SIZE(pt) * sizeof(pt_element_t);
558 		for (j = 0; j < ARRAY_SIZE(pt); ++j)
559 			if (r || is_present_pte(pt[j]))
560 				sp->spt[i+j] = shadow_trap_nonpresent_pte;
561 			else
562 				sp->spt[i+j] = shadow_notrap_nonpresent_pte;
563 	}
564 }
565 
566 /*
567  * Using the cached information from sp->gfns is safe because:
568  * - The spte has a reference to the struct page, so the pfn for a given gfn
569  *   can't change unless all sptes pointing to it are nuked first.
570  * - Alias changes zap the entire shadow cache.
571  */
FNAME(sync_page)572 static int FNAME(sync_page)(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp)
573 {
574 	int i, offset, nr_present;
575 
576 	offset = nr_present = 0;
577 
578 	if (PTTYPE == 32)
579 		offset = sp->role.quadrant << PT64_LEVEL_BITS;
580 
581 	for (i = 0; i < PT64_ENT_PER_PAGE; i++) {
582 		unsigned pte_access;
583 		pt_element_t gpte;
584 		gpa_t pte_gpa;
585 		gfn_t gfn = sp->gfns[i];
586 
587 		if (!is_shadow_present_pte(sp->spt[i]))
588 			continue;
589 
590 		pte_gpa = gfn_to_gpa(sp->gfn);
591 		pte_gpa += (i+offset) * sizeof(pt_element_t);
592 
593 		if (kvm_read_guest_atomic(vcpu->kvm, pte_gpa, &gpte,
594 					  sizeof(pt_element_t)))
595 			return -EINVAL;
596 
597 		if (gpte_to_gfn(gpte) != gfn || !is_present_pte(gpte) ||
598 		    !(gpte & PT_ACCESSED_MASK)) {
599 			u64 nonpresent;
600 
601 			rmap_remove(vcpu->kvm, &sp->spt[i]);
602 			if (is_present_pte(gpte))
603 				nonpresent = shadow_trap_nonpresent_pte;
604 			else
605 				nonpresent = shadow_notrap_nonpresent_pte;
606 			set_shadow_pte(&sp->spt[i], nonpresent);
607 			continue;
608 		}
609 
610 		nr_present++;
611 		pte_access = sp->role.access & FNAME(gpte_access)(vcpu, gpte);
612 		set_spte(vcpu, &sp->spt[i], pte_access, 0, 0,
613 			 is_dirty_pte(gpte), 0, gpte & PT_GLOBAL_MASK, gfn,
614 			 spte_to_pfn(sp->spt[i]), true, false);
615 	}
616 
617 	return !nr_present;
618 }
619 
620 #undef pt_element_t
621 #undef guest_walker
622 #undef shadow_walker
623 #undef FNAME
624 #undef PT_BASE_ADDR_MASK
625 #undef PT_INDEX
626 #undef PT_LEVEL_MASK
627 #undef PT_DIR_BASE_ADDR_MASK
628 #undef PT_LEVEL_BITS
629 #undef PT_MAX_FULL_LEVELS
630 #undef gpte_to_gfn
631 #undef gpte_to_gfn_pde
632 #undef CMPXCHG
633