1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Copyright (C) 2020 Google LLC
4 * Author: Will Deacon <will@kernel.org>
5 */
6
7 #ifndef __ARM64_KVM_PGTABLE_H__
8 #define __ARM64_KVM_PGTABLE_H__
9
10 #include <linux/bits.h>
11 #include <linux/kvm_host.h>
12 #include <linux/types.h>
13
14 #define KVM_PGTABLE_MAX_LEVELS 4U
15
kvm_get_parange(u64 mmfr0)16 static inline u64 kvm_get_parange(u64 mmfr0)
17 {
18 u64 parange = cpuid_feature_extract_unsigned_field(mmfr0,
19 ID_AA64MMFR0_PARANGE_SHIFT);
20 if (parange > ID_AA64MMFR0_PARANGE_MAX)
21 parange = ID_AA64MMFR0_PARANGE_MAX;
22
23 return parange;
24 }
25
26 typedef u64 kvm_pte_t;
27
28 /**
29 * struct kvm_pgtable_mm_ops - Memory management callbacks.
30 * @zalloc_page: Allocate a single zeroed memory page. The @arg parameter
31 * can be used by the walker to pass a memcache. The
32 * initial refcount of the page is 1.
33 * @zalloc_pages_exact: Allocate an exact number of zeroed memory pages. The
34 * @size parameter is in bytes, and is rounded-up to the
35 * next page boundary. The resulting allocation is
36 * physically contiguous.
37 * @free_pages_exact: Free an exact number of memory pages previously
38 * allocated by zalloc_pages_exact.
39 * @get_page: Increment the refcount on a page.
40 * @put_page: Decrement the refcount on a page. When the refcount
41 * reaches 0 the page is automatically freed.
42 * @page_count: Return the refcount of a page.
43 * @phys_to_virt: Convert a physical address into a virtual address mapped
44 * in the current context.
45 * @virt_to_phys: Convert a virtual address mapped in the current context
46 * into a physical address.
47 */
48 struct kvm_pgtable_mm_ops {
49 void* (*zalloc_page)(void *arg);
50 void* (*zalloc_pages_exact)(size_t size);
51 void (*free_pages_exact)(void *addr, size_t size);
52 void (*get_page)(void *addr);
53 void (*put_page)(void *addr);
54 int (*page_count)(void *addr);
55 void* (*phys_to_virt)(phys_addr_t phys);
56 phys_addr_t (*virt_to_phys)(void *addr);
57 };
58
59 /**
60 * enum kvm_pgtable_stage2_flags - Stage-2 page-table flags.
61 * @KVM_PGTABLE_S2_NOFWB: Don't enforce Normal-WB even if the CPUs have
62 * ARM64_HAS_STAGE2_FWB.
63 * @KVM_PGTABLE_S2_IDMAP: Only use identity mappings.
64 */
65 enum kvm_pgtable_stage2_flags {
66 KVM_PGTABLE_S2_NOFWB = BIT(0),
67 KVM_PGTABLE_S2_IDMAP = BIT(1),
68 };
69
70 /**
71 * struct kvm_pgtable - KVM page-table.
72 * @ia_bits: Maximum input address size, in bits.
73 * @start_level: Level at which the page-table walk starts.
74 * @pgd: Pointer to the first top-level entry of the page-table.
75 * @mm_ops: Memory management callbacks.
76 * @mmu: Stage-2 KVM MMU struct. Unused for stage-1 page-tables.
77 */
78 struct kvm_pgtable {
79 u32 ia_bits;
80 u32 start_level;
81 kvm_pte_t *pgd;
82 struct kvm_pgtable_mm_ops *mm_ops;
83
84 /* Stage-2 only */
85 struct kvm_s2_mmu *mmu;
86 enum kvm_pgtable_stage2_flags flags;
87 };
88
89 /**
90 * enum kvm_pgtable_prot - Page-table permissions and attributes.
91 * @KVM_PGTABLE_PROT_X: Execute permission.
92 * @KVM_PGTABLE_PROT_W: Write permission.
93 * @KVM_PGTABLE_PROT_R: Read permission.
94 * @KVM_PGTABLE_PROT_DEVICE: Device attributes.
95 */
96 enum kvm_pgtable_prot {
97 KVM_PGTABLE_PROT_X = BIT(0),
98 KVM_PGTABLE_PROT_W = BIT(1),
99 KVM_PGTABLE_PROT_R = BIT(2),
100
101 KVM_PGTABLE_PROT_DEVICE = BIT(3),
102 };
103
104 #define PAGE_HYP (KVM_PGTABLE_PROT_R | KVM_PGTABLE_PROT_W)
105 #define PAGE_HYP_EXEC (KVM_PGTABLE_PROT_R | KVM_PGTABLE_PROT_X)
106 #define PAGE_HYP_RO (KVM_PGTABLE_PROT_R)
107 #define PAGE_HYP_DEVICE (PAGE_HYP | KVM_PGTABLE_PROT_DEVICE)
108
109 /**
110 * struct kvm_mem_range - Range of Intermediate Physical Addresses
111 * @start: Start of the range.
112 * @end: End of the range.
113 */
114 struct kvm_mem_range {
115 u64 start;
116 u64 end;
117 };
118
119 /**
120 * enum kvm_pgtable_walk_flags - Flags to control a depth-first page-table walk.
121 * @KVM_PGTABLE_WALK_LEAF: Visit leaf entries, including invalid
122 * entries.
123 * @KVM_PGTABLE_WALK_TABLE_PRE: Visit table entries before their
124 * children.
125 * @KVM_PGTABLE_WALK_TABLE_POST: Visit table entries after their
126 * children.
127 */
128 enum kvm_pgtable_walk_flags {
129 KVM_PGTABLE_WALK_LEAF = BIT(0),
130 KVM_PGTABLE_WALK_TABLE_PRE = BIT(1),
131 KVM_PGTABLE_WALK_TABLE_POST = BIT(2),
132 };
133
134 typedef int (*kvm_pgtable_visitor_fn_t)(u64 addr, u64 end, u32 level,
135 kvm_pte_t *ptep,
136 enum kvm_pgtable_walk_flags flag,
137 void * const arg);
138
139 /**
140 * struct kvm_pgtable_walker - Hook into a page-table walk.
141 * @cb: Callback function to invoke during the walk.
142 * @arg: Argument passed to the callback function.
143 * @flags: Bitwise-OR of flags to identify the entry types on which to
144 * invoke the callback function.
145 */
146 struct kvm_pgtable_walker {
147 const kvm_pgtable_visitor_fn_t cb;
148 void * const arg;
149 const enum kvm_pgtable_walk_flags flags;
150 };
151
152 /**
153 * kvm_pgtable_hyp_init() - Initialise a hypervisor stage-1 page-table.
154 * @pgt: Uninitialised page-table structure to initialise.
155 * @va_bits: Maximum virtual address bits.
156 * @mm_ops: Memory management callbacks.
157 *
158 * Return: 0 on success, negative error code on failure.
159 */
160 int kvm_pgtable_hyp_init(struct kvm_pgtable *pgt, u32 va_bits,
161 struct kvm_pgtable_mm_ops *mm_ops);
162
163 /**
164 * kvm_pgtable_hyp_destroy() - Destroy an unused hypervisor stage-1 page-table.
165 * @pgt: Page-table structure initialised by kvm_pgtable_hyp_init().
166 *
167 * The page-table is assumed to be unreachable by any hardware walkers prior
168 * to freeing and therefore no TLB invalidation is performed.
169 */
170 void kvm_pgtable_hyp_destroy(struct kvm_pgtable *pgt);
171
172 /**
173 * kvm_pgtable_hyp_map() - Install a mapping in a hypervisor stage-1 page-table.
174 * @pgt: Page-table structure initialised by kvm_pgtable_hyp_init().
175 * @addr: Virtual address at which to place the mapping.
176 * @size: Size of the mapping.
177 * @phys: Physical address of the memory to map.
178 * @prot: Permissions and attributes for the mapping.
179 *
180 * The offset of @addr within a page is ignored, @size is rounded-up to
181 * the next page boundary and @phys is rounded-down to the previous page
182 * boundary.
183 *
184 * If device attributes are not explicitly requested in @prot, then the
185 * mapping will be normal, cacheable. Attempts to install a new mapping
186 * for a virtual address that is already mapped will be rejected with an
187 * error and a WARN().
188 *
189 * Return: 0 on success, negative error code on failure.
190 */
191 int kvm_pgtable_hyp_map(struct kvm_pgtable *pgt, u64 addr, u64 size, u64 phys,
192 enum kvm_pgtable_prot prot);
193
194 /**
195 * kvm_get_vtcr() - Helper to construct VTCR_EL2
196 * @mmfr0: Sanitized value of SYS_ID_AA64MMFR0_EL1 register.
197 * @mmfr1: Sanitized value of SYS_ID_AA64MMFR1_EL1 register.
198 * @phys_shfit: Value to set in VTCR_EL2.T0SZ.
199 *
200 * The VTCR value is common across all the physical CPUs on the system.
201 * We use system wide sanitised values to fill in different fields,
202 * except for Hardware Management of Access Flags. HA Flag is set
203 * unconditionally on all CPUs, as it is safe to run with or without
204 * the feature and the bit is RES0 on CPUs that don't support it.
205 *
206 * Return: VTCR_EL2 value
207 */
208 u64 kvm_get_vtcr(u64 mmfr0, u64 mmfr1, u32 phys_shift);
209
210 /**
211 * kvm_pgtable_stage2_init_flags() - Initialise a guest stage-2 page-table.
212 * @pgt: Uninitialised page-table structure to initialise.
213 * @arch: Arch-specific KVM structure representing the guest virtual
214 * machine.
215 * @mm_ops: Memory management callbacks.
216 * @flags: Stage-2 configuration flags.
217 *
218 * Return: 0 on success, negative error code on failure.
219 */
220 int kvm_pgtable_stage2_init_flags(struct kvm_pgtable *pgt, struct kvm_arch *arch,
221 struct kvm_pgtable_mm_ops *mm_ops,
222 enum kvm_pgtable_stage2_flags flags);
223
224 #define kvm_pgtable_stage2_init(pgt, arch, mm_ops) \
225 kvm_pgtable_stage2_init_flags(pgt, arch, mm_ops, 0)
226
227 /**
228 * kvm_pgtable_stage2_destroy() - Destroy an unused guest stage-2 page-table.
229 * @pgt: Page-table structure initialised by kvm_pgtable_stage2_init*().
230 *
231 * The page-table is assumed to be unreachable by any hardware walkers prior
232 * to freeing and therefore no TLB invalidation is performed.
233 */
234 void kvm_pgtable_stage2_destroy(struct kvm_pgtable *pgt);
235
236 /**
237 * kvm_pgtable_stage2_map() - Install a mapping in a guest stage-2 page-table.
238 * @pgt: Page-table structure initialised by kvm_pgtable_stage2_init*().
239 * @addr: Intermediate physical address at which to place the mapping.
240 * @size: Size of the mapping.
241 * @phys: Physical address of the memory to map.
242 * @prot: Permissions and attributes for the mapping.
243 * @mc: Cache of pre-allocated and zeroed memory from which to allocate
244 * page-table pages.
245 *
246 * The offset of @addr within a page is ignored, @size is rounded-up to
247 * the next page boundary and @phys is rounded-down to the previous page
248 * boundary.
249 *
250 * If device attributes are not explicitly requested in @prot, then the
251 * mapping will be normal, cacheable.
252 *
253 * Note that the update of a valid leaf PTE in this function will be aborted,
254 * if it's trying to recreate the exact same mapping or only change the access
255 * permissions. Instead, the vCPU will exit one more time from guest if still
256 * needed and then go through the path of relaxing permissions.
257 *
258 * Note that this function will both coalesce existing table entries and split
259 * existing block mappings, relying on page-faults to fault back areas outside
260 * of the new mapping lazily.
261 *
262 * Return: 0 on success, negative error code on failure.
263 */
264 int kvm_pgtable_stage2_map(struct kvm_pgtable *pgt, u64 addr, u64 size,
265 u64 phys, enum kvm_pgtable_prot prot,
266 void *mc);
267
268 /**
269 * kvm_pgtable_stage2_set_owner() - Unmap and annotate pages in the IPA space to
270 * track ownership.
271 * @pgt: Page-table structure initialised by kvm_pgtable_stage2_init*().
272 * @addr: Base intermediate physical address to annotate.
273 * @size: Size of the annotated range.
274 * @mc: Cache of pre-allocated and zeroed memory from which to allocate
275 * page-table pages.
276 * @owner_id: Unique identifier for the owner of the page.
277 *
278 * By default, all page-tables are owned by identifier 0. This function can be
279 * used to mark portions of the IPA space as owned by other entities. When a
280 * stage 2 is used with identity-mappings, these annotations allow to use the
281 * page-table data structure as a simple rmap.
282 *
283 * Return: 0 on success, negative error code on failure.
284 */
285 int kvm_pgtable_stage2_set_owner(struct kvm_pgtable *pgt, u64 addr, u64 size,
286 void *mc, u8 owner_id);
287
288 /**
289 * kvm_pgtable_stage2_unmap() - Remove a mapping from a guest stage-2 page-table.
290 * @pgt: Page-table structure initialised by kvm_pgtable_stage2_init*().
291 * @addr: Intermediate physical address from which to remove the mapping.
292 * @size: Size of the mapping.
293 *
294 * The offset of @addr within a page is ignored and @size is rounded-up to
295 * the next page boundary.
296 *
297 * TLB invalidation is performed for each page-table entry cleared during the
298 * unmapping operation and the reference count for the page-table page
299 * containing the cleared entry is decremented, with unreferenced pages being
300 * freed. Unmapping a cacheable page will ensure that it is clean to the PoC if
301 * FWB is not supported by the CPU.
302 *
303 * Return: 0 on success, negative error code on failure.
304 */
305 int kvm_pgtable_stage2_unmap(struct kvm_pgtable *pgt, u64 addr, u64 size);
306
307 /**
308 * kvm_pgtable_stage2_wrprotect() - Write-protect guest stage-2 address range
309 * without TLB invalidation.
310 * @pgt: Page-table structure initialised by kvm_pgtable_stage2_init*().
311 * @addr: Intermediate physical address from which to write-protect,
312 * @size: Size of the range.
313 *
314 * The offset of @addr within a page is ignored and @size is rounded-up to
315 * the next page boundary.
316 *
317 * Note that it is the caller's responsibility to invalidate the TLB after
318 * calling this function to ensure that the updated permissions are visible
319 * to the CPUs.
320 *
321 * Return: 0 on success, negative error code on failure.
322 */
323 int kvm_pgtable_stage2_wrprotect(struct kvm_pgtable *pgt, u64 addr, u64 size);
324
325 /**
326 * kvm_pgtable_stage2_mkyoung() - Set the access flag in a page-table entry.
327 * @pgt: Page-table structure initialised by kvm_pgtable_stage2_init*().
328 * @addr: Intermediate physical address to identify the page-table entry.
329 *
330 * The offset of @addr within a page is ignored.
331 *
332 * If there is a valid, leaf page-table entry used to translate @addr, then
333 * set the access flag in that entry.
334 *
335 * Return: The old page-table entry prior to setting the flag, 0 on failure.
336 */
337 kvm_pte_t kvm_pgtable_stage2_mkyoung(struct kvm_pgtable *pgt, u64 addr);
338
339 /**
340 * kvm_pgtable_stage2_mkold() - Clear the access flag in a page-table entry.
341 * @pgt: Page-table structure initialised by kvm_pgtable_stage2_init*().
342 * @addr: Intermediate physical address to identify the page-table entry.
343 *
344 * The offset of @addr within a page is ignored.
345 *
346 * If there is a valid, leaf page-table entry used to translate @addr, then
347 * clear the access flag in that entry.
348 *
349 * Note that it is the caller's responsibility to invalidate the TLB after
350 * calling this function to ensure that the updated permissions are visible
351 * to the CPUs.
352 *
353 * Return: The old page-table entry prior to clearing the flag, 0 on failure.
354 */
355 kvm_pte_t kvm_pgtable_stage2_mkold(struct kvm_pgtable *pgt, u64 addr);
356
357 /**
358 * kvm_pgtable_stage2_relax_perms() - Relax the permissions enforced by a
359 * page-table entry.
360 * @pgt: Page-table structure initialised by kvm_pgtable_stage2_init*().
361 * @addr: Intermediate physical address to identify the page-table entry.
362 * @prot: Additional permissions to grant for the mapping.
363 *
364 * The offset of @addr within a page is ignored.
365 *
366 * If there is a valid, leaf page-table entry used to translate @addr, then
367 * relax the permissions in that entry according to the read, write and
368 * execute permissions specified by @prot. No permissions are removed, and
369 * TLB invalidation is performed after updating the entry.
370 *
371 * Return: 0 on success, negative error code on failure.
372 */
373 int kvm_pgtable_stage2_relax_perms(struct kvm_pgtable *pgt, u64 addr,
374 enum kvm_pgtable_prot prot);
375
376 /**
377 * kvm_pgtable_stage2_is_young() - Test whether a page-table entry has the
378 * access flag set.
379 * @pgt: Page-table structure initialised by kvm_pgtable_stage2_init*().
380 * @addr: Intermediate physical address to identify the page-table entry.
381 *
382 * The offset of @addr within a page is ignored.
383 *
384 * Return: True if the page-table entry has the access flag set, false otherwise.
385 */
386 bool kvm_pgtable_stage2_is_young(struct kvm_pgtable *pgt, u64 addr);
387
388 /**
389 * kvm_pgtable_stage2_flush_range() - Clean and invalidate data cache to Point
390 * of Coherency for guest stage-2 address
391 * range.
392 * @pgt: Page-table structure initialised by kvm_pgtable_stage2_init*().
393 * @addr: Intermediate physical address from which to flush.
394 * @size: Size of the range.
395 *
396 * The offset of @addr within a page is ignored and @size is rounded-up to
397 * the next page boundary.
398 *
399 * Return: 0 on success, negative error code on failure.
400 */
401 int kvm_pgtable_stage2_flush(struct kvm_pgtable *pgt, u64 addr, u64 size);
402
403 /**
404 * kvm_pgtable_walk() - Walk a page-table.
405 * @pgt: Page-table structure initialised by kvm_pgtable_*_init().
406 * @addr: Input address for the start of the walk.
407 * @size: Size of the range to walk.
408 * @walker: Walker callback description.
409 *
410 * The offset of @addr within a page is ignored and @size is rounded-up to
411 * the next page boundary.
412 *
413 * The walker will walk the page-table entries corresponding to the input
414 * address range specified, visiting entries according to the walker flags.
415 * Invalid entries are treated as leaf entries. Leaf entries are reloaded
416 * after invoking the walker callback, allowing the walker to descend into
417 * a newly installed table.
418 *
419 * Returning a negative error code from the walker callback function will
420 * terminate the walk immediately with the same error code.
421 *
422 * Return: 0 on success, negative error code on failure.
423 */
424 int kvm_pgtable_walk(struct kvm_pgtable *pgt, u64 addr, u64 size,
425 struct kvm_pgtable_walker *walker);
426
427 /**
428 * kvm_pgtable_stage2_find_range() - Find a range of Intermediate Physical
429 * Addresses with compatible permission
430 * attributes.
431 * @pgt: Page-table structure initialised by kvm_pgtable_stage2_init*().
432 * @addr: Address that must be covered by the range.
433 * @prot: Protection attributes that the range must be compatible with.
434 * @range: Range structure used to limit the search space at call time and
435 * that will hold the result.
436 *
437 * The offset of @addr within a page is ignored. An IPA is compatible with @prot
438 * iff its corresponding stage-2 page-table entry has default ownership and, if
439 * valid, is mapped with protection attributes identical to @prot.
440 *
441 * Return: 0 on success, negative error code on failure.
442 */
443 int kvm_pgtable_stage2_find_range(struct kvm_pgtable *pgt, u64 addr,
444 enum kvm_pgtable_prot prot,
445 struct kvm_mem_range *range);
446 #endif /* __ARM64_KVM_PGTABLE_H__ */
447