virt/kvm/mmu.rst

1 .. SPDX-License-Identifier: GPL-2.0
13 - correctness:
18 - security:
21 - performance:
23 - scaling:
25 - hardware:
27 - integration:
31 - dirty tracking:
33                and framebuffer-based displays
34 - footprint:
37 - reliability:
62 The mmu supports first-generation mmu hardware, which allows an atomic switch
63 of the current paging mode and cr3 during guest entry, as well as
64 two-dimensional paging (AMD's NPT and Intel's EPT).  The emulated hardware
76 - when guest paging is disabled, we translate guest physical addresses to
77   host physical addresses (gpa->hpa)
78 - when guest paging is enabled, we translate guest virtual addresses, to
79   guest physical addresses, to host physical addresses (gva->gpa->hpa)
80 - when the guest launches a guest of its own, we translate nested guest
82   addresses, to host physical addresses (ngva->ngpa->gpa->hpa)
87 direct mode; otherwise it operates in shadow mode (see below).
94 addresses (gpa->hva); note that two gpas may alias to the same hva, but not
108 - writes to control registers (especially cr3)
109 - invlpg/invlpga instruction execution
110 - access to missing or protected translations
114 - changes in the gpa->hpa translation (either through gpa->hva changes or
115   through hva->hpa changes)
116 - memory pressure (the shrinker)
133 The following table shows translations encoded by leaf ptes, with higher-level
136  Non-nested guests::
138   nonpaging:     gpa->hpa
139   paging:        gva->gpa->hpa
140   paging, tdp:   (gva->)gpa->hpa
144   non-tdp:       ngva->gpa->hpa  (*)
145   tdp:           (ngva->)ngpa->gpa->hpa
147   (*) the guest hypervisor will encode the ngva->gpa translation into its page
155     If set, leaf sptes reachable from this page are for a linear range.
156     Examples include real mode translation, large guest pages backed by small
157     host pages, and gpa->hpa translations when NPT or EPT is active.
158     The linear range starts at (gfn << PAGE_SHIFT) and its size is determined
164     When role.gpte_is_8_bytes=0, the guest uses 32-bit gptes while the host uses 64-bit
167     For first-level shadow pages, role.quadrant can be 0 or 1 and denotes the
168     first or second 512-gpte block in the guest page table.  For second-level
169     page tables, each 32-bit gpte is converted to two 64-bit sptes
170     (since each first-level guest page is shadowed by two first-level
182     if 64-bit gptes are in use, '0' if 32-bit gptes are in use.
199     Is 1 if the page is valid in system management mode.  This field
210     page, or the base page frame for linear translations.  See role.direct.
212     A pageful of 64-bit sptes containing the translations for this page.
214     The page pointed to by spt will have its page->private pointing back
216     sptes in spt point either at guest pages, or at lower-level shadow pages.
217     Specifically, if sp1 and sp2 are shadow pages, then sp1->spt[n] may point
218     at __pa(sp2->spt).  sp2 will point back at sp1 through parent_pte.
231     The reverse mapping for the pte/ptes pointing at this page's spt. If
250     Only present on 32-bit hosts, where a 64-bit spte cannot be written
252     to detect in-progress updates and retry them until the writer has
256     emulations if the page needs to be write-protected (see "Synchronized
259     possible for non-leafs.  This field counts the number of emulations
267 The mmu maintains a reverse mapping whereby all ptes mapping a page can be
296 - guest page fault (or npt page fault, or ept violation)
300   - a true guest fault (the guest translation won't allow the access) (*)
301   - access to a missing translation
302   - access to a protected translation
303     - when logging dirty pages, memory is write protected
304     - synchronized shadow pages are write protected (*)
305   - access to untranslatable memory (mmio)
307   (*) not applicable in direct mode
311  - if the RSV bit of the error code is set, the page fault is caused by guest
314    - walk shadow page table
315    - check for valid generation number in the spte (see "Fast invalidation of
317    - cache the information to vcpu->arch.mmio_gva, vcpu->arch.mmio_access and
318      vcpu->arch.mmio_gfn, and call the emulator
320  - If both P bit and R/W bit of error code are set, this could possibly
324  - if needed, walk the guest page tables to determine the guest translation
325    (gva->gpa or ngpa->gpa)
327    - if permissions are insufficient, reflect the fault back to the guest
329  - determine the host page
331    - if this is an mmio request, there is no host page; cache the info to
332      vcpu->arch.mmio_gva, vcpu->arch.mmio_access and vcpu->arch.mmio_gfn
334  - walk the shadow page table to find the spte for the translation,
337    - If this is an mmio request, cache the mmio info to the spte and set some
340  - try to unsynchronize the page
342    - if successful, we can let the guest continue and modify the gpte
344  - emulate the instruction
346    - if failed, unshadow the page and let the guest continue
348  - update any translations that were modified by the instruction
352   - walk the shadow page hierarchy and drop affected translations
353   - try to reinstantiate the indicated translation in the hope that the
358 - mov to cr3
360   - look up new shadow roots
361   - synchronize newly reachable shadow pages
363 - mov to cr0/cr4/efer
365   - set up mmu context for new paging mode
366   - look up new shadow roots
367   - synchronize newly reachable shadow pages
371   - mmu notifier called with updated hva
372   - look up affected sptes through reverse map
373   - drop (or update) translations
384 We handle this by mapping the permissions to two possible sptes, depending
387 - kernel write fault: spte.u=0, spte.w=1 (allows full kernel access,
389 - read fault: spte.u=1, spte.w=0 (allows full read access, disallows kernel
396 - if CR4.SMEP is enabled: since we've turned the page into a kernel page,
401 - if CR4.SMAP is disabled: since the page has been changed to a kernel
410 with one value of cr0.wp cannot be used when cr0.wp has a different value -
426 - the spte must point to a large host page
427 - the guest pte must be a large pte of at least equivalent size (if tdp is
429 - if the spte will be writeable, the large page frame may not overlap any
430   write-protected pages
431 - the guest page must be wholly contained by a single memory slot
433 To check the last two conditions, the mmu maintains a ->disallow_lpage set of
437 artificially inflated ->disallow_lpages so they can never be instantiated.
450 kvm_memslots(kvm)->generation, and increased whenever guest memory info
458 Since only 18 bits are used to store generation-number on mmio spte, all
464 out-of-date information, but with an up-to-date generation number.
467 returns; thus, bit 63 of kvm_memslots(kvm)->generation set to 1 only during a
470 this without losing a bit in the MMIO spte.  The "update in-progress" bit of the
473 spte while an update is in-progress, the next access to the spte will always be
475 miss due to the in-progress flag diverging, while an access after the update
482 - NPT presentation from KVM Forum 2008
483   https://www.linux-kvm.org/images/c/c8/KvmForum2008%24kdf2008_21.pdf