mmu.c 128.9 KB
Newer Older
A
Avi Kivity 已提交
1 2 3 4 5 6 7 8 9
/*
 * Kernel-based Virtual Machine driver for Linux
 *
 * This module enables machines with Intel VT-x extensions to run virtual
 * machines without emulation or binary translation.
 *
 * MMU support
 *
 * Copyright (C) 2006 Qumranet, Inc.
N
Nicolas Kaiser 已提交
10
 * Copyright 2010 Red Hat, Inc. and/or its affiliates.
A
Avi Kivity 已提交
11 12 13 14 15 16 17 18 19
 *
 * Authors:
 *   Yaniv Kamay  <yaniv@qumranet.com>
 *   Avi Kivity   <avi@qumranet.com>
 *
 * This work is licensed under the terms of the GNU GPL, version 2.  See
 * the COPYING file in the top-level directory.
 *
 */
A
Avi Kivity 已提交
20

21
#include "irq.h"
22
#include "mmu.h"
23
#include "x86.h"
A
Avi Kivity 已提交
24
#include "kvm_cache_regs.h"
25
#include "cpuid.h"
A
Avi Kivity 已提交
26

27
#include <linux/kvm_host.h>
A
Avi Kivity 已提交
28 29 30 31 32
#include <linux/types.h>
#include <linux/string.h>
#include <linux/mm.h>
#include <linux/highmem.h>
#include <linux/module.h>
33
#include <linux/swap.h>
M
Marcelo Tosatti 已提交
34
#include <linux/hugetlb.h>
35
#include <linux/compiler.h>
36
#include <linux/srcu.h>
37
#include <linux/slab.h>
38
#include <linux/uaccess.h>
A
Avi Kivity 已提交
39

A
Avi Kivity 已提交
40 41
#include <asm/page.h>
#include <asm/cmpxchg.h>
42
#include <asm/io.h>
43
#include <asm/vmx.h>
44
#include <asm/kvm_page_track.h>
A
Avi Kivity 已提交
45

46 47 48 49 50 51 52
/*
 * When setting this variable to true it enables Two-Dimensional-Paging
 * where the hardware walks 2 page tables:
 * 1. the guest-virtual to guest-physical
 * 2. while doing 1. it walks guest-physical to host-physical
 * If the hardware supports that we don't need to do shadow paging.
 */
53
bool tdp_enabled = false;
54

55 56 57 58
enum {
	AUDIT_PRE_PAGE_FAULT,
	AUDIT_POST_PAGE_FAULT,
	AUDIT_PRE_PTE_WRITE,
59 60 61
	AUDIT_POST_PTE_WRITE,
	AUDIT_PRE_SYNC,
	AUDIT_POST_SYNC
62
};
63

64
#undef MMU_DEBUG
65 66

#ifdef MMU_DEBUG
67 68
static bool dbg = 0;
module_param(dbg, bool, 0644);
69 70 71

#define pgprintk(x...) do { if (dbg) printk(x); } while (0)
#define rmap_printk(x...) do { if (dbg) printk(x); } while (0)
72
#define MMU_WARN_ON(x) WARN_ON(x)
73 74 75
#else
#define pgprintk(x...) do { } while (0)
#define rmap_printk(x...) do { } while (0)
76
#define MMU_WARN_ON(x) do { } while (0)
77
#endif
A
Avi Kivity 已提交
78

79 80
#define PTE_PREFETCH_NUM		8

81
#define PT_FIRST_AVAIL_BITS_SHIFT 10
A
Avi Kivity 已提交
82 83 84 85 86
#define PT64_SECOND_AVAIL_BITS_SHIFT 52

#define PT64_LEVEL_BITS 9

#define PT64_LEVEL_SHIFT(level) \
M
Mike Day 已提交
87
		(PAGE_SHIFT + (level - 1) * PT64_LEVEL_BITS)
A
Avi Kivity 已提交
88 89 90 91 92 93 94 95

#define PT64_INDEX(address, level)\
	(((address) >> PT64_LEVEL_SHIFT(level)) & ((1 << PT64_LEVEL_BITS) - 1))


#define PT32_LEVEL_BITS 10

#define PT32_LEVEL_SHIFT(level) \
M
Mike Day 已提交
96
		(PAGE_SHIFT + (level - 1) * PT32_LEVEL_BITS)
A
Avi Kivity 已提交
97

98 99 100
#define PT32_LVL_OFFSET_MASK(level) \
	(PT32_BASE_ADDR_MASK & ((1ULL << (PAGE_SHIFT + (((level) - 1) \
						* PT32_LEVEL_BITS))) - 1))
A
Avi Kivity 已提交
101 102 103 104 105

#define PT32_INDEX(address, level)\
	(((address) >> PT32_LEVEL_SHIFT(level)) & ((1 << PT32_LEVEL_BITS) - 1))


106
#define PT64_BASE_ADDR_MASK (((1ULL << 52) - 1) & ~(u64)(PAGE_SIZE-1))
A
Avi Kivity 已提交
107 108
#define PT64_DIR_BASE_ADDR_MASK \
	(PT64_BASE_ADDR_MASK & ~((1ULL << (PAGE_SHIFT + PT64_LEVEL_BITS)) - 1))
109 110 111 112 113 114
#define PT64_LVL_ADDR_MASK(level) \
	(PT64_BASE_ADDR_MASK & ~((1ULL << (PAGE_SHIFT + (((level) - 1) \
						* PT64_LEVEL_BITS))) - 1))
#define PT64_LVL_OFFSET_MASK(level) \
	(PT64_BASE_ADDR_MASK & ((1ULL << (PAGE_SHIFT + (((level) - 1) \
						* PT64_LEVEL_BITS))) - 1))
A
Avi Kivity 已提交
115 116 117 118

#define PT32_BASE_ADDR_MASK PAGE_MASK
#define PT32_DIR_BASE_ADDR_MASK \
	(PAGE_MASK & ~((1ULL << (PAGE_SHIFT + PT32_LEVEL_BITS)) - 1))
119 120 121
#define PT32_LVL_ADDR_MASK(level) \
	(PAGE_MASK & ~((1ULL << (PAGE_SHIFT + (((level) - 1) \
					    * PT32_LEVEL_BITS))) - 1))
A
Avi Kivity 已提交
122

123 124
#define PT64_PERM_MASK (PT_PRESENT_MASK | PT_WRITABLE_MASK | shadow_user_mask \
			| shadow_x_mask | shadow_nx_mask)
A
Avi Kivity 已提交
125

126 127 128 129 130
#define ACC_EXEC_MASK    1
#define ACC_WRITE_MASK   PT_WRITABLE_MASK
#define ACC_USER_MASK    PT_USER_MASK
#define ACC_ALL          (ACC_EXEC_MASK | ACC_WRITE_MASK | ACC_USER_MASK)

131 132
#include <trace/events/kvm.h>

133 134 135
#define CREATE_TRACE_POINTS
#include "mmutrace.h"

136 137
#define SPTE_HOST_WRITEABLE	(1ULL << PT_FIRST_AVAIL_BITS_SHIFT)
#define SPTE_MMU_WRITEABLE	(1ULL << (PT_FIRST_AVAIL_BITS_SHIFT + 1))
138

139 140
#define SHADOW_PT_INDEX(addr, level) PT64_INDEX(addr, level)

141 142 143
/* make pte_list_desc fit well in cache line */
#define PTE_LIST_EXT 3

144 145 146
struct pte_list_desc {
	u64 *sptes[PTE_LIST_EXT];
	struct pte_list_desc *more;
147 148
};

149 150 151 152
struct kvm_shadow_walk_iterator {
	u64 addr;
	hpa_t shadow_addr;
	u64 *sptep;
153
	int level;
154 155 156 157 158 159 160 161
	unsigned index;
};

#define for_each_shadow_entry(_vcpu, _addr, _walker)    \
	for (shadow_walk_init(&(_walker), _vcpu, _addr);	\
	     shadow_walk_okay(&(_walker));			\
	     shadow_walk_next(&(_walker)))

162 163 164 165 166 167
#define for_each_shadow_entry_lockless(_vcpu, _addr, _walker, spte)	\
	for (shadow_walk_init(&(_walker), _vcpu, _addr);		\
	     shadow_walk_okay(&(_walker)) &&				\
		({ spte = mmu_spte_get_lockless(_walker.sptep); 1; });	\
	     __shadow_walk_next(&(_walker), spte))

168
static struct kmem_cache *pte_list_desc_cache;
169
static struct kmem_cache *mmu_page_header_cache;
170
static struct percpu_counter kvm_total_used_mmu_pages;
171

S
Sheng Yang 已提交
172 173 174 175 176
static u64 __read_mostly shadow_nx_mask;
static u64 __read_mostly shadow_x_mask;	/* mutual exclusive with nx_mask */
static u64 __read_mostly shadow_user_mask;
static u64 __read_mostly shadow_accessed_mask;
static u64 __read_mostly shadow_dirty_mask;
177 178 179
static u64 __read_mostly shadow_mmio_mask;

static void mmu_spte_set(u64 *sptep, u64 spte);
180
static void mmu_free_roots(struct kvm_vcpu *vcpu);
181 182 183 184 185 186 187

void kvm_mmu_set_mmio_spte_mask(u64 mmio_mask)
{
	shadow_mmio_mask = mmio_mask;
}
EXPORT_SYMBOL_GPL(kvm_mmu_set_mmio_spte_mask);

188
/*
189 190 191 192 193 194 195
 * the low bit of the generation number is always presumed to be zero.
 * This disables mmio caching during memslot updates.  The concept is
 * similar to a seqcount but instead of retrying the access we just punt
 * and ignore the cache.
 *
 * spte bits 3-11 are used as bits 1-9 of the generation number,
 * the bits 52-61 are used as bits 10-19 of the generation number.
196
 */
197
#define MMIO_SPTE_GEN_LOW_SHIFT		2
198 199
#define MMIO_SPTE_GEN_HIGH_SHIFT	52

200 201 202
#define MMIO_GEN_SHIFT			20
#define MMIO_GEN_LOW_SHIFT		10
#define MMIO_GEN_LOW_MASK		((1 << MMIO_GEN_LOW_SHIFT) - 2)
203
#define MMIO_GEN_MASK			((1 << MMIO_GEN_SHIFT) - 1)
204 205 206 207 208

static u64 generation_mmio_spte_mask(unsigned int gen)
{
	u64 mask;

T
Tiejun Chen 已提交
209
	WARN_ON(gen & ~MMIO_GEN_MASK);
210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226

	mask = (gen & MMIO_GEN_LOW_MASK) << MMIO_SPTE_GEN_LOW_SHIFT;
	mask |= ((u64)gen >> MMIO_GEN_LOW_SHIFT) << MMIO_SPTE_GEN_HIGH_SHIFT;
	return mask;
}

static unsigned int get_mmio_spte_generation(u64 spte)
{
	unsigned int gen;

	spte &= ~shadow_mmio_mask;

	gen = (spte >> MMIO_SPTE_GEN_LOW_SHIFT) & MMIO_GEN_LOW_MASK;
	gen |= (spte >> MMIO_SPTE_GEN_HIGH_SHIFT) << MMIO_GEN_LOW_SHIFT;
	return gen;
}

227
static unsigned int kvm_current_mmio_generation(struct kvm_vcpu *vcpu)
228
{
229
	return kvm_vcpu_memslots(vcpu)->generation & MMIO_GEN_MASK;
230 231
}

232
static void mark_mmio_spte(struct kvm_vcpu *vcpu, u64 *sptep, u64 gfn,
233
			   unsigned access)
234
{
235
	unsigned int gen = kvm_current_mmio_generation(vcpu);
236
	u64 mask = generation_mmio_spte_mask(gen);
237

238
	access &= ACC_WRITE_MASK | ACC_USER_MASK;
239 240
	mask |= shadow_mmio_mask | access | gfn << PAGE_SHIFT;

241
	trace_mark_mmio_spte(sptep, gfn, access, gen);
242
	mmu_spte_set(sptep, mask);
243 244 245 246 247 248 249 250 251
}

static bool is_mmio_spte(u64 spte)
{
	return (spte & shadow_mmio_mask) == shadow_mmio_mask;
}

static gfn_t get_mmio_spte_gfn(u64 spte)
{
T
Tiejun Chen 已提交
252
	u64 mask = generation_mmio_spte_mask(MMIO_GEN_MASK) | shadow_mmio_mask;
253
	return (spte & ~mask) >> PAGE_SHIFT;
254 255 256 257
}

static unsigned get_mmio_spte_access(u64 spte)
{
T
Tiejun Chen 已提交
258
	u64 mask = generation_mmio_spte_mask(MMIO_GEN_MASK) | shadow_mmio_mask;
259
	return (spte & ~mask) & ~PAGE_MASK;
260 261
}

262
static bool set_mmio_spte(struct kvm_vcpu *vcpu, u64 *sptep, gfn_t gfn,
D
Dan Williams 已提交
263
			  kvm_pfn_t pfn, unsigned access)
264 265
{
	if (unlikely(is_noslot_pfn(pfn))) {
266
		mark_mmio_spte(vcpu, sptep, gfn, access);
267 268 269 270 271
		return true;
	}

	return false;
}
272

273
static bool check_mmio_spte(struct kvm_vcpu *vcpu, u64 spte)
274
{
275 276
	unsigned int kvm_gen, spte_gen;

277
	kvm_gen = kvm_current_mmio_generation(vcpu);
278 279 280 281
	spte_gen = get_mmio_spte_generation(spte);

	trace_check_mmio_spte(spte, kvm_gen, spte_gen);
	return likely(kvm_gen == spte_gen);
282 283
}

S
Sheng Yang 已提交
284
void kvm_mmu_set_mask_ptes(u64 user_mask, u64 accessed_mask,
285
		u64 dirty_mask, u64 nx_mask, u64 x_mask)
S
Sheng Yang 已提交
286 287 288 289 290 291 292 293 294
{
	shadow_user_mask = user_mask;
	shadow_accessed_mask = accessed_mask;
	shadow_dirty_mask = dirty_mask;
	shadow_nx_mask = nx_mask;
	shadow_x_mask = x_mask;
}
EXPORT_SYMBOL_GPL(kvm_mmu_set_mask_ptes);

A
Avi Kivity 已提交
295 296 297 298 299
static int is_cpuid_PSE36(void)
{
	return 1;
}

300 301
static int is_nx(struct kvm_vcpu *vcpu)
{
302
	return vcpu->arch.efer & EFER_NX;
303 304
}

305 306
static int is_shadow_present_pte(u64 pte)
{
307
	return pte & PT_PRESENT_MASK && !is_mmio_spte(pte);
308 309
}

M
Marcelo Tosatti 已提交
310 311 312 313 314
static int is_large_pte(u64 pte)
{
	return pte & PT_PAGE_SIZE_MASK;
}

315 316 317 318
static int is_last_spte(u64 pte, int level)
{
	if (level == PT_PAGE_TABLE_LEVEL)
		return 1;
319
	if (is_large_pte(pte))
320 321 322 323
		return 1;
	return 0;
}

D
Dan Williams 已提交
324
static kvm_pfn_t spte_to_pfn(u64 pte)
325
{
326
	return (pte & PT64_BASE_ADDR_MASK) >> PAGE_SHIFT;
327 328
}

329 330 331 332 333 334 335
static gfn_t pse36_gfn_delta(u32 gpte)
{
	int shift = 32 - PT32_DIR_PSE36_SHIFT - PAGE_SHIFT;

	return (gpte & PT32_DIR_PSE36_MASK) << shift;
}

336
#ifdef CONFIG_X86_64
A
Avi Kivity 已提交
337
static void __set_spte(u64 *sptep, u64 spte)
338
{
339
	*sptep = spte;
340 341
}

342
static void __update_clear_spte_fast(u64 *sptep, u64 spte)
343
{
344 345 346 347 348 349 350
	*sptep = spte;
}

static u64 __update_clear_spte_slow(u64 *sptep, u64 spte)
{
	return xchg(sptep, spte);
}
351 352 353 354 355

static u64 __get_spte_lockless(u64 *sptep)
{
	return ACCESS_ONCE(*sptep);
}
356
#else
357 358 359 360 361 362 363
union split_spte {
	struct {
		u32 spte_low;
		u32 spte_high;
	};
	u64 spte;
};
364

365 366 367 368 369 370 371 372 373 374 375 376
static void count_spte_clear(u64 *sptep, u64 spte)
{
	struct kvm_mmu_page *sp =  page_header(__pa(sptep));

	if (is_shadow_present_pte(spte))
		return;

	/* Ensure the spte is completely set before we increase the count */
	smp_wmb();
	sp->clear_spte_count++;
}

377 378 379
static void __set_spte(u64 *sptep, u64 spte)
{
	union split_spte *ssptep, sspte;
380

381 382 383 384 385 386 387 388 389 390 391 392 393
	ssptep = (union split_spte *)sptep;
	sspte = (union split_spte)spte;

	ssptep->spte_high = sspte.spte_high;

	/*
	 * If we map the spte from nonpresent to present, We should store
	 * the high bits firstly, then set present bit, so cpu can not
	 * fetch this spte while we are setting the spte.
	 */
	smp_wmb();

	ssptep->spte_low = sspte.spte_low;
394 395
}

396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411
static void __update_clear_spte_fast(u64 *sptep, u64 spte)
{
	union split_spte *ssptep, sspte;

	ssptep = (union split_spte *)sptep;
	sspte = (union split_spte)spte;

	ssptep->spte_low = sspte.spte_low;

	/*
	 * If we map the spte from present to nonpresent, we should clear
	 * present bit firstly to avoid vcpu fetch the old high bits.
	 */
	smp_wmb();

	ssptep->spte_high = sspte.spte_high;
412
	count_spte_clear(sptep, spte);
413 414 415 416 417 418 419 420 421 422 423
}

static u64 __update_clear_spte_slow(u64 *sptep, u64 spte)
{
	union split_spte *ssptep, sspte, orig;

	ssptep = (union split_spte *)sptep;
	sspte = (union split_spte)spte;

	/* xchg acts as a barrier before the setting of the high bits */
	orig.spte_low = xchg(&ssptep->spte_low, sspte.spte_low);
424 425
	orig.spte_high = ssptep->spte_high;
	ssptep->spte_high = sspte.spte_high;
426
	count_spte_clear(sptep, spte);
427 428 429

	return orig.spte;
}
430 431 432 433

/*
 * The idea using the light way get the spte on x86_32 guest is from
 * gup_get_pte(arch/x86/mm/gup.c).
434 435 436 437 438 439 440 441 442 443 444 445 446 447
 *
 * An spte tlb flush may be pending, because kvm_set_pte_rmapp
 * coalesces them and we are running out of the MMU lock.  Therefore
 * we need to protect against in-progress updates of the spte.
 *
 * Reading the spte while an update is in progress may get the old value
 * for the high part of the spte.  The race is fine for a present->non-present
 * change (because the high part of the spte is ignored for non-present spte),
 * but for a present->present change we must reread the spte.
 *
 * All such changes are done in two steps (present->non-present and
 * non-present->present), hence it is enough to count the number of
 * present->non-present updates: if it changed while reading the spte,
 * we might have hit the race.  This is done using clear_spte_count.
448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470
 */
static u64 __get_spte_lockless(u64 *sptep)
{
	struct kvm_mmu_page *sp =  page_header(__pa(sptep));
	union split_spte spte, *orig = (union split_spte *)sptep;
	int count;

retry:
	count = sp->clear_spte_count;
	smp_rmb();

	spte.spte_low = orig->spte_low;
	smp_rmb();

	spte.spte_high = orig->spte_high;
	smp_rmb();

	if (unlikely(spte.spte_low != orig->spte_low ||
	      count != sp->clear_spte_count))
		goto retry;

	return spte.spte;
}
471 472
#endif

473 474
static bool spte_is_locklessly_modifiable(u64 spte)
{
475 476
	return (spte & (SPTE_HOST_WRITEABLE | SPTE_MMU_WRITEABLE)) ==
		(SPTE_HOST_WRITEABLE | SPTE_MMU_WRITEABLE);
477 478
}

479 480
static bool spte_has_volatile_bits(u64 spte)
{
481
	/*
482
	 * Always atomically update spte if it can be updated
483 484 485 486 487 488 489
	 * out of mmu-lock, it can ensure dirty bit is not lost,
	 * also, it can help us to get a stable is_writable_pte()
	 * to ensure tlb flush is not missed.
	 */
	if (spte_is_locklessly_modifiable(spte))
		return true;

490 491 492 493 494 495
	if (!shadow_accessed_mask)
		return false;

	if (!is_shadow_present_pte(spte))
		return false;

496 497
	if ((spte & shadow_accessed_mask) &&
	      (!is_writable_pte(spte) || (spte & shadow_dirty_mask)))
498 499 500 501 502
		return false;

	return true;
}

503 504 505 506 507
static bool spte_is_bit_cleared(u64 old_spte, u64 new_spte, u64 bit_mask)
{
	return (old_spte & bit_mask) && !(new_spte & bit_mask);
}

508 509 510 511 512
static bool spte_is_bit_changed(u64 old_spte, u64 new_spte, u64 bit_mask)
{
	return (old_spte & bit_mask) != (new_spte & bit_mask);
}

513 514 515 516 517 518 519 520 521 522 523 524 525 526
/* Rules for using mmu_spte_set:
 * Set the sptep from nonpresent to present.
 * Note: the sptep being assigned *must* be either not present
 * or in a state where the hardware will not attempt to update
 * the spte.
 */
static void mmu_spte_set(u64 *sptep, u64 new_spte)
{
	WARN_ON(is_shadow_present_pte(*sptep));
	__set_spte(sptep, new_spte);
}

/* Rules for using mmu_spte_update:
 * Update the state bits, it means the mapped pfn is not changged.
527 528 529 530 531 532
 *
 * Whenever we overwrite a writable spte with a read-only one we
 * should flush remote TLBs. Otherwise rmap_write_protect
 * will find a read-only spte, even though the writable spte
 * might be cached on a CPU's TLB, the return value indicates this
 * case.
533
 */
534
static bool mmu_spte_update(u64 *sptep, u64 new_spte)
535
{
536
	u64 old_spte = *sptep;
537
	bool ret = false;
538

539
	WARN_ON(!is_shadow_present_pte(new_spte));
540

541 542 543 544
	if (!is_shadow_present_pte(old_spte)) {
		mmu_spte_set(sptep, new_spte);
		return ret;
	}
545

546
	if (!spte_has_volatile_bits(old_spte))
547
		__update_clear_spte_fast(sptep, new_spte);
548
	else
549
		old_spte = __update_clear_spte_slow(sptep, new_spte);
550

551 552
	/*
	 * For the spte updated out of mmu-lock is safe, since
553
	 * we always atomically update it, see the comments in
554 555
	 * spte_has_volatile_bits().
	 */
556 557
	if (spte_is_locklessly_modifiable(old_spte) &&
	      !is_writable_pte(new_spte))
558 559
		ret = true;

560
	if (!shadow_accessed_mask)
561
		return ret;
562

563 564 565 566 567 568 569 570
	/*
	 * Flush TLB when accessed/dirty bits are changed in the page tables,
	 * to guarantee consistency between TLB and page tables.
	 */
	if (spte_is_bit_changed(old_spte, new_spte,
                                shadow_accessed_mask | shadow_dirty_mask))
		ret = true;

571 572 573 574
	if (spte_is_bit_cleared(old_spte, new_spte, shadow_accessed_mask))
		kvm_set_pfn_accessed(spte_to_pfn(old_spte));
	if (spte_is_bit_cleared(old_spte, new_spte, shadow_dirty_mask))
		kvm_set_pfn_dirty(spte_to_pfn(old_spte));
575 576

	return ret;
577 578
}

579 580 581 582 583 584 585
/*
 * Rules for using mmu_spte_clear_track_bits:
 * It sets the sptep from present to nonpresent, and track the
 * state bits, it is used to clear the last level sptep.
 */
static int mmu_spte_clear_track_bits(u64 *sptep)
{
D
Dan Williams 已提交
586
	kvm_pfn_t pfn;
587 588 589
	u64 old_spte = *sptep;

	if (!spte_has_volatile_bits(old_spte))
590
		__update_clear_spte_fast(sptep, 0ull);
591
	else
592
		old_spte = __update_clear_spte_slow(sptep, 0ull);
593

594
	if (!is_shadow_present_pte(old_spte))
595 596 597
		return 0;

	pfn = spte_to_pfn(old_spte);
598 599 600 601 602 603

	/*
	 * KVM does not hold the refcount of the page used by
	 * kvm mmu, before reclaiming the page, we should
	 * unmap it from mmu first.
	 */
604
	WARN_ON(!kvm_is_reserved_pfn(pfn) && !page_count(pfn_to_page(pfn)));
605

606 607 608 609 610 611 612 613 614 615 616 617 618 619
	if (!shadow_accessed_mask || old_spte & shadow_accessed_mask)
		kvm_set_pfn_accessed(pfn);
	if (!shadow_dirty_mask || (old_spte & shadow_dirty_mask))
		kvm_set_pfn_dirty(pfn);
	return 1;
}

/*
 * Rules for using mmu_spte_clear_no_track:
 * Directly clear spte without caring the state bits of sptep,
 * it is used to set the upper level spte.
 */
static void mmu_spte_clear_no_track(u64 *sptep)
{
620
	__update_clear_spte_fast(sptep, 0ull);
621 622
}

623 624 625 626 627 628 629
static u64 mmu_spte_get_lockless(u64 *sptep)
{
	return __get_spte_lockless(sptep);
}

static void walk_shadow_page_lockless_begin(struct kvm_vcpu *vcpu)
{
630 631 632 633 634
	/*
	 * Prevent page table teardown by making any free-er wait during
	 * kvm_flush_remote_tlbs() IPI to all active vcpus.
	 */
	local_irq_disable();
635

636 637 638 639
	/*
	 * Make sure a following spte read is not reordered ahead of the write
	 * to vcpu->mode.
	 */
640
	smp_store_mb(vcpu->mode, READING_SHADOW_PAGE_TABLES);
641 642 643 644
}

static void walk_shadow_page_lockless_end(struct kvm_vcpu *vcpu)
{
645 646 647 648 649
	/*
	 * Make sure the write to vcpu->mode is not reordered in front of
	 * reads to sptes.  If it does, kvm_commit_zap_page() can see us
	 * OUTSIDE_GUEST_MODE and proceed to free the shadow page table.
	 */
650
	smp_store_release(&vcpu->mode, OUTSIDE_GUEST_MODE);
651
	local_irq_enable();
652 653
}

654
static int mmu_topup_memory_cache(struct kvm_mmu_memory_cache *cache,
655
				  struct kmem_cache *base_cache, int min)
656 657 658 659
{
	void *obj;

	if (cache->nobjs >= min)
660
		return 0;
661
	while (cache->nobjs < ARRAY_SIZE(cache->objects)) {
662
		obj = kmem_cache_zalloc(base_cache, GFP_KERNEL);
663
		if (!obj)
664
			return -ENOMEM;
665 666
		cache->objects[cache->nobjs++] = obj;
	}
667
	return 0;
668 669
}

670 671 672 673 674
static int mmu_memory_cache_free_objects(struct kvm_mmu_memory_cache *cache)
{
	return cache->nobjs;
}

675 676
static void mmu_free_memory_cache(struct kvm_mmu_memory_cache *mc,
				  struct kmem_cache *cache)
677 678
{
	while (mc->nobjs)
679
		kmem_cache_free(cache, mc->objects[--mc->nobjs]);
680 681
}

A
Avi Kivity 已提交
682
static int mmu_topup_memory_cache_page(struct kvm_mmu_memory_cache *cache,
683
				       int min)
A
Avi Kivity 已提交
684
{
685
	void *page;
A
Avi Kivity 已提交
686 687 688 689

	if (cache->nobjs >= min)
		return 0;
	while (cache->nobjs < ARRAY_SIZE(cache->objects)) {
690
		page = (void *)__get_free_page(GFP_KERNEL);
A
Avi Kivity 已提交
691 692
		if (!page)
			return -ENOMEM;
693
		cache->objects[cache->nobjs++] = page;
A
Avi Kivity 已提交
694 695 696 697 698 699 700
	}
	return 0;
}

static void mmu_free_memory_cache_page(struct kvm_mmu_memory_cache *mc)
{
	while (mc->nobjs)
701
		free_page((unsigned long)mc->objects[--mc->nobjs]);
A
Avi Kivity 已提交
702 703
}

704
static int mmu_topup_memory_caches(struct kvm_vcpu *vcpu)
705
{
706 707
	int r;

708
	r = mmu_topup_memory_cache(&vcpu->arch.mmu_pte_list_desc_cache,
709
				   pte_list_desc_cache, 8 + PTE_PREFETCH_NUM);
710 711
	if (r)
		goto out;
712
	r = mmu_topup_memory_cache_page(&vcpu->arch.mmu_page_cache, 8);
713 714
	if (r)
		goto out;
715
	r = mmu_topup_memory_cache(&vcpu->arch.mmu_page_header_cache,
716
				   mmu_page_header_cache, 4);
717 718
out:
	return r;
719 720 721 722
}

static void mmu_free_memory_caches(struct kvm_vcpu *vcpu)
{
723 724
	mmu_free_memory_cache(&vcpu->arch.mmu_pte_list_desc_cache,
				pte_list_desc_cache);
725
	mmu_free_memory_cache_page(&vcpu->arch.mmu_page_cache);
726 727
	mmu_free_memory_cache(&vcpu->arch.mmu_page_header_cache,
				mmu_page_header_cache);
728 729
}

730
static void *mmu_memory_cache_alloc(struct kvm_mmu_memory_cache *mc)
731 732 733 734 735 736 737 738
{
	void *p;

	BUG_ON(!mc->nobjs);
	p = mc->objects[--mc->nobjs];
	return p;
}

739
static struct pte_list_desc *mmu_alloc_pte_list_desc(struct kvm_vcpu *vcpu)
740
{
741
	return mmu_memory_cache_alloc(&vcpu->arch.mmu_pte_list_desc_cache);
742 743
}

744
static void mmu_free_pte_list_desc(struct pte_list_desc *pte_list_desc)
745
{
746
	kmem_cache_free(pte_list_desc_cache, pte_list_desc);
747 748
}

749 750 751 752 753 754 755 756 757 758 759 760 761 762 763 764
static gfn_t kvm_mmu_page_get_gfn(struct kvm_mmu_page *sp, int index)
{
	if (!sp->role.direct)
		return sp->gfns[index];

	return sp->gfn + (index << ((sp->role.level - 1) * PT64_LEVEL_BITS));
}

static void kvm_mmu_page_set_gfn(struct kvm_mmu_page *sp, int index, gfn_t gfn)
{
	if (sp->role.direct)
		BUG_ON(gfn != kvm_mmu_page_get_gfn(sp, index));
	else
		sp->gfns[index] = gfn;
}

M
Marcelo Tosatti 已提交
765
/*
766 767
 * Return the pointer to the large page information for a given gfn,
 * handling slots that are not large page aligned.
M
Marcelo Tosatti 已提交
768
 */
769 770 771
static struct kvm_lpage_info *lpage_info_slot(gfn_t gfn,
					      struct kvm_memory_slot *slot,
					      int level)
M
Marcelo Tosatti 已提交
772 773 774
{
	unsigned long idx;

775
	idx = gfn_to_index(gfn, slot->base_gfn, level);
776
	return &slot->arch.lpage_info[level - 2][idx];
M
Marcelo Tosatti 已提交
777 778
}

779 780 781 782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797 798 799 800 801
static void update_gfn_disallow_lpage_count(struct kvm_memory_slot *slot,
					    gfn_t gfn, int count)
{
	struct kvm_lpage_info *linfo;
	int i;

	for (i = PT_DIRECTORY_LEVEL; i <= PT_MAX_HUGEPAGE_LEVEL; ++i) {
		linfo = lpage_info_slot(gfn, slot, i);
		linfo->disallow_lpage += count;
		WARN_ON(linfo->disallow_lpage < 0);
	}
}

void kvm_mmu_gfn_disallow_lpage(struct kvm_memory_slot *slot, gfn_t gfn)
{
	update_gfn_disallow_lpage_count(slot, gfn, 1);
}

void kvm_mmu_gfn_allow_lpage(struct kvm_memory_slot *slot, gfn_t gfn)
{
	update_gfn_disallow_lpage_count(slot, gfn, -1);
}

802
static void account_shadowed(struct kvm *kvm, struct kvm_mmu_page *sp)
M
Marcelo Tosatti 已提交
803
{
804
	struct kvm_memslots *slots;
805
	struct kvm_memory_slot *slot;
806
	gfn_t gfn;
M
Marcelo Tosatti 已提交
807

808
	kvm->arch.indirect_shadow_pages++;
809
	gfn = sp->gfn;
810 811
	slots = kvm_memslots_for_spte_role(kvm, sp->role);
	slot = __gfn_to_memslot(slots, gfn);
812 813 814 815 816 817

	/* the non-leaf shadow pages are keeping readonly. */
	if (sp->role.level > PT_PAGE_TABLE_LEVEL)
		return kvm_slot_page_track_add_page(kvm, slot, gfn,
						    KVM_PAGE_TRACK_WRITE);

818
	kvm_mmu_gfn_disallow_lpage(slot, gfn);
M
Marcelo Tosatti 已提交
819 820
}

821
static void unaccount_shadowed(struct kvm *kvm, struct kvm_mmu_page *sp)
M
Marcelo Tosatti 已提交
822
{
823
	struct kvm_memslots *slots;
824
	struct kvm_memory_slot *slot;
825
	gfn_t gfn;
M
Marcelo Tosatti 已提交
826

827
	kvm->arch.indirect_shadow_pages--;
828
	gfn = sp->gfn;
829 830
	slots = kvm_memslots_for_spte_role(kvm, sp->role);
	slot = __gfn_to_memslot(slots, gfn);
831 832 833 834
	if (sp->role.level > PT_PAGE_TABLE_LEVEL)
		return kvm_slot_page_track_remove_page(kvm, slot, gfn,
						       KVM_PAGE_TRACK_WRITE);

835
	kvm_mmu_gfn_allow_lpage(slot, gfn);
M
Marcelo Tosatti 已提交
836 837
}

838 839
static bool __mmu_gfn_lpage_is_disallowed(gfn_t gfn, int level,
					  struct kvm_memory_slot *slot)
M
Marcelo Tosatti 已提交
840
{
841
	struct kvm_lpage_info *linfo;
M
Marcelo Tosatti 已提交
842 843

	if (slot) {
844
		linfo = lpage_info_slot(gfn, slot, level);
845
		return !!linfo->disallow_lpage;
M
Marcelo Tosatti 已提交
846 847
	}

848
	return true;
M
Marcelo Tosatti 已提交
849 850
}

851 852
static bool mmu_gfn_lpage_is_disallowed(struct kvm_vcpu *vcpu, gfn_t gfn,
					int level)
853 854 855 856
{
	struct kvm_memory_slot *slot;

	slot = kvm_vcpu_gfn_to_memslot(vcpu, gfn);
857
	return __mmu_gfn_lpage_is_disallowed(gfn, level, slot);
858 859
}

860
static int host_mapping_level(struct kvm *kvm, gfn_t gfn)
M
Marcelo Tosatti 已提交
861
{
J
Joerg Roedel 已提交
862
	unsigned long page_size;
863
	int i, ret = 0;
M
Marcelo Tosatti 已提交
864

J
Joerg Roedel 已提交
865
	page_size = kvm_host_page_size(kvm, gfn);
M
Marcelo Tosatti 已提交
866

867
	for (i = PT_PAGE_TABLE_LEVEL; i <= PT_MAX_HUGEPAGE_LEVEL; ++i) {
868 869 870 871 872 873
		if (page_size >= KVM_HPAGE_SIZE(i))
			ret = i;
		else
			break;
	}

874
	return ret;
M
Marcelo Tosatti 已提交
875 876
}

877 878 879 880 881 882 883 884 885 886 887
static inline bool memslot_valid_for_gpte(struct kvm_memory_slot *slot,
					  bool no_dirty_log)
{
	if (!slot || slot->flags & KVM_MEMSLOT_INVALID)
		return false;
	if (no_dirty_log && slot->dirty_bitmap)
		return false;

	return true;
}

888 889 890
static struct kvm_memory_slot *
gfn_to_memslot_dirty_bitmap(struct kvm_vcpu *vcpu, gfn_t gfn,
			    bool no_dirty_log)
M
Marcelo Tosatti 已提交
891 892
{
	struct kvm_memory_slot *slot;
893

894
	slot = kvm_vcpu_gfn_to_memslot(vcpu, gfn);
895
	if (!memslot_valid_for_gpte(slot, no_dirty_log))
896 897 898 899 900
		slot = NULL;

	return slot;
}

901 902
static int mapping_level(struct kvm_vcpu *vcpu, gfn_t large_gfn,
			 bool *force_pt_level)
903 904
{
	int host_level, level, max_level;
905 906
	struct kvm_memory_slot *slot;

907 908
	if (unlikely(*force_pt_level))
		return PT_PAGE_TABLE_LEVEL;
M
Marcelo Tosatti 已提交
909

910 911
	slot = kvm_vcpu_gfn_to_memslot(vcpu, large_gfn);
	*force_pt_level = !memslot_valid_for_gpte(slot, true);
912 913 914
	if (unlikely(*force_pt_level))
		return PT_PAGE_TABLE_LEVEL;

915 916 917 918 919
	host_level = host_mapping_level(vcpu->kvm, large_gfn);

	if (host_level == PT_PAGE_TABLE_LEVEL)
		return host_level;

X
Xiao Guangrong 已提交
920
	max_level = min(kvm_x86_ops->get_lpage_level(), host_level);
921 922

	for (level = PT_DIRECTORY_LEVEL; level <= max_level; ++level)
923
		if (__mmu_gfn_lpage_is_disallowed(large_gfn, level, slot))
924 925 926
			break;

	return level - 1;
M
Marcelo Tosatti 已提交
927 928
}

929
/*
930
 * About rmap_head encoding:
931
 *
932 933
 * If the bit zero of rmap_head->val is clear, then it points to the only spte
 * in this rmap chain. Otherwise, (rmap_head->val & ~1) points to a struct
934
 * pte_list_desc containing more mappings.
935 936 937 938
 */

/*
 * Returns the number of pointers in the rmap chain, not counting the new one.
939
 */
940
static int pte_list_add(struct kvm_vcpu *vcpu, u64 *spte,
941
			struct kvm_rmap_head *rmap_head)
942
{
943
	struct pte_list_desc *desc;
944
	int i, count = 0;
945

946
	if (!rmap_head->val) {
947
		rmap_printk("pte_list_add: %p %llx 0->1\n", spte, *spte);
948 949
		rmap_head->val = (unsigned long)spte;
	} else if (!(rmap_head->val & 1)) {
950 951
		rmap_printk("pte_list_add: %p %llx 1->many\n", spte, *spte);
		desc = mmu_alloc_pte_list_desc(vcpu);
952
		desc->sptes[0] = (u64 *)rmap_head->val;
A
Avi Kivity 已提交
953
		desc->sptes[1] = spte;
954
		rmap_head->val = (unsigned long)desc | 1;
955
		++count;
956
	} else {
957
		rmap_printk("pte_list_add: %p %llx many->many\n", spte, *spte);
958
		desc = (struct pte_list_desc *)(rmap_head->val & ~1ul);
959
		while (desc->sptes[PTE_LIST_EXT-1] && desc->more) {
960
			desc = desc->more;
961
			count += PTE_LIST_EXT;
962
		}
963 964
		if (desc->sptes[PTE_LIST_EXT-1]) {
			desc->more = mmu_alloc_pte_list_desc(vcpu);
965 966
			desc = desc->more;
		}
A
Avi Kivity 已提交
967
		for (i = 0; desc->sptes[i]; ++i)
968
			++count;
A
Avi Kivity 已提交
969
		desc->sptes[i] = spte;
970
	}
971
	return count;
972 973
}

974
static void
975 976 977
pte_list_desc_remove_entry(struct kvm_rmap_head *rmap_head,
			   struct pte_list_desc *desc, int i,
			   struct pte_list_desc *prev_desc)
978 979 980
{
	int j;

981
	for (j = PTE_LIST_EXT - 1; !desc->sptes[j] && j > i; --j)
982
		;
A
Avi Kivity 已提交
983 984
	desc->sptes[i] = desc->sptes[j];
	desc->sptes[j] = NULL;
985 986 987
	if (j != 0)
		return;
	if (!prev_desc && !desc->more)
988
		rmap_head->val = (unsigned long)desc->sptes[0];
989 990 991 992
	else
		if (prev_desc)
			prev_desc->more = desc->more;
		else
993
			rmap_head->val = (unsigned long)desc->more | 1;
994
	mmu_free_pte_list_desc(desc);
995 996
}

997
static void pte_list_remove(u64 *spte, struct kvm_rmap_head *rmap_head)
998
{
999 1000
	struct pte_list_desc *desc;
	struct pte_list_desc *prev_desc;
1001 1002
	int i;

1003
	if (!rmap_head->val) {
1004
		printk(KERN_ERR "pte_list_remove: %p 0->BUG\n", spte);
1005
		BUG();
1006
	} else if (!(rmap_head->val & 1)) {
1007
		rmap_printk("pte_list_remove:  %p 1->0\n", spte);
1008
		if ((u64 *)rmap_head->val != spte) {
1009
			printk(KERN_ERR "pte_list_remove:  %p 1->BUG\n", spte);
1010 1011
			BUG();
		}
1012
		rmap_head->val = 0;
1013
	} else {
1014
		rmap_printk("pte_list_remove:  %p many->many\n", spte);
1015
		desc = (struct pte_list_desc *)(rmap_head->val & ~1ul);
1016 1017
		prev_desc = NULL;
		while (desc) {
1018
			for (i = 0; i < PTE_LIST_EXT && desc->sptes[i]; ++i) {
A
Avi Kivity 已提交
1019
				if (desc->sptes[i] == spte) {
1020 1021
					pte_list_desc_remove_entry(rmap_head,
							desc, i, prev_desc);
1022 1023
					return;
				}
1024
			}
1025 1026 1027
			prev_desc = desc;
			desc = desc->more;
		}
1028
		pr_err("pte_list_remove: %p many->many\n", spte);
1029 1030 1031 1032
		BUG();
	}
}

1033 1034
static struct kvm_rmap_head *__gfn_to_rmap(gfn_t gfn, int level,
					   struct kvm_memory_slot *slot)
1035
{
1036
	unsigned long idx;
1037

1038
	idx = gfn_to_index(gfn, slot->base_gfn, level);
1039
	return &slot->arch.rmap[level - PT_PAGE_TABLE_LEVEL][idx];
1040 1041
}

1042 1043
static struct kvm_rmap_head *gfn_to_rmap(struct kvm *kvm, gfn_t gfn,
					 struct kvm_mmu_page *sp)
1044
{
1045
	struct kvm_memslots *slots;
1046 1047
	struct kvm_memory_slot *slot;

1048 1049
	slots = kvm_memslots_for_spte_role(kvm, sp->role);
	slot = __gfn_to_memslot(slots, gfn);
1050
	return __gfn_to_rmap(gfn, sp->role.level, slot);
1051 1052
}

1053 1054 1055 1056 1057 1058 1059 1060
static bool rmap_can_add(struct kvm_vcpu *vcpu)
{
	struct kvm_mmu_memory_cache *cache;

	cache = &vcpu->arch.mmu_pte_list_desc_cache;
	return mmu_memory_cache_free_objects(cache);
}

1061 1062 1063
static int rmap_add(struct kvm_vcpu *vcpu, u64 *spte, gfn_t gfn)
{
	struct kvm_mmu_page *sp;
1064
	struct kvm_rmap_head *rmap_head;
1065 1066 1067

	sp = page_header(__pa(spte));
	kvm_mmu_page_set_gfn(sp, spte - sp->spt, gfn);
1068 1069
	rmap_head = gfn_to_rmap(vcpu->kvm, gfn, sp);
	return pte_list_add(vcpu, spte, rmap_head);
1070 1071 1072 1073 1074 1075
}

static void rmap_remove(struct kvm *kvm, u64 *spte)
{
	struct kvm_mmu_page *sp;
	gfn_t gfn;
1076
	struct kvm_rmap_head *rmap_head;
1077 1078 1079

	sp = page_header(__pa(spte));
	gfn = kvm_mmu_page_get_gfn(sp, spte - sp->spt);
1080 1081
	rmap_head = gfn_to_rmap(kvm, gfn, sp);
	pte_list_remove(spte, rmap_head);
1082 1083
}

1084 1085 1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100
/*
 * Used by the following functions to iterate through the sptes linked by a
 * rmap.  All fields are private and not assumed to be used outside.
 */
struct rmap_iterator {
	/* private fields */
	struct pte_list_desc *desc;	/* holds the sptep if not NULL */
	int pos;			/* index of the sptep */
};

/*
 * Iteration must be started by this function.  This should also be used after
 * removing/dropping sptes from the rmap link because in such cases the
 * information in the itererator may not be valid.
 *
 * Returns sptep if found, NULL otherwise.
 */
1101 1102
static u64 *rmap_get_first(struct kvm_rmap_head *rmap_head,
			   struct rmap_iterator *iter)
1103
{
1104 1105
	u64 *sptep;

1106
	if (!rmap_head->val)
1107 1108
		return NULL;

1109
	if (!(rmap_head->val & 1)) {
1110
		iter->desc = NULL;
1111 1112
		sptep = (u64 *)rmap_head->val;
		goto out;
1113 1114
	}

1115
	iter->desc = (struct pte_list_desc *)(rmap_head->val & ~1ul);
1116
	iter->pos = 0;
1117 1118 1119 1120
	sptep = iter->desc->sptes[iter->pos];
out:
	BUG_ON(!is_shadow_present_pte(*sptep));
	return sptep;
1121 1122 1123 1124 1125 1126 1127 1128 1129
}

/*
 * Must be used with a valid iterator: e.g. after rmap_get_first().
 *
 * Returns sptep if found, NULL otherwise.
 */
static u64 *rmap_get_next(struct rmap_iterator *iter)
{
1130 1131
	u64 *sptep;

1132 1133 1134 1135 1136
	if (iter->desc) {
		if (iter->pos < PTE_LIST_EXT - 1) {
			++iter->pos;
			sptep = iter->desc->sptes[iter->pos];
			if (sptep)
1137
				goto out;
1138 1139 1140 1141 1142 1143 1144
		}

		iter->desc = iter->desc->more;

		if (iter->desc) {
			iter->pos = 0;
			/* desc->sptes[0] cannot be NULL */
1145 1146
			sptep = iter->desc->sptes[iter->pos];
			goto out;
1147 1148 1149 1150
		}
	}

	return NULL;
1151 1152 1153
out:
	BUG_ON(!is_shadow_present_pte(*sptep));
	return sptep;
1154 1155
}

1156 1157
#define for_each_rmap_spte(_rmap_head_, _iter_, _spte_)			\
	for (_spte_ = rmap_get_first(_rmap_head_, _iter_);		\
1158
	     _spte_; _spte_ = rmap_get_next(_iter_))
1159

1160
static void drop_spte(struct kvm *kvm, u64 *sptep)
1161
{
1162
	if (mmu_spte_clear_track_bits(sptep))
1163
		rmap_remove(kvm, sptep);
A
Avi Kivity 已提交
1164 1165
}

1166 1167 1168 1169 1170 1171 1172 1173 1174 1175 1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186

static bool __drop_large_spte(struct kvm *kvm, u64 *sptep)
{
	if (is_large_pte(*sptep)) {
		WARN_ON(page_header(__pa(sptep))->role.level ==
			PT_PAGE_TABLE_LEVEL);
		drop_spte(kvm, sptep);
		--kvm->stat.lpages;
		return true;
	}

	return false;
}

static void drop_large_spte(struct kvm_vcpu *vcpu, u64 *sptep)
{
	if (__drop_large_spte(vcpu->kvm, sptep))
		kvm_flush_remote_tlbs(vcpu->kvm);
}

/*
1187
 * Write-protect on the specified @sptep, @pt_protect indicates whether
1188
 * spte write-protection is caused by protecting shadow page table.
1189
 *
T
Tiejun Chen 已提交
1190
 * Note: write protection is difference between dirty logging and spte
1191 1192 1193 1194 1195
 * protection:
 * - for dirty logging, the spte can be set to writable at anytime if
 *   its dirty bitmap is properly set.
 * - for spte protection, the spte can be writable only after unsync-ing
 *   shadow page.
1196
 *
1197
 * Return true if tlb need be flushed.
1198
 */
1199
static bool spte_write_protect(struct kvm *kvm, u64 *sptep, bool pt_protect)
1200 1201 1202
{
	u64 spte = *sptep;

1203 1204
	if (!is_writable_pte(spte) &&
	      !(pt_protect && spte_is_locklessly_modifiable(spte)))
1205 1206 1207 1208
		return false;

	rmap_printk("rmap_write_protect: spte %p %llx\n", sptep, *sptep);

1209 1210
	if (pt_protect)
		spte &= ~SPTE_MMU_WRITEABLE;
1211
	spte = spte & ~PT_WRITABLE_MASK;
1212

1213
	return mmu_spte_update(sptep, spte);
1214 1215
}

1216 1217
static bool __rmap_write_protect(struct kvm *kvm,
				 struct kvm_rmap_head *rmap_head,
1218
				 bool pt_protect)
1219
{
1220 1221
	u64 *sptep;
	struct rmap_iterator iter;
1222
	bool flush = false;
1223

1224
	for_each_rmap_spte(rmap_head, &iter, sptep)
1225
		flush |= spte_write_protect(kvm, sptep, pt_protect);
1226

1227
	return flush;
1228 1229
}

1230 1231 1232 1233 1234 1235 1236 1237 1238 1239 1240
static bool spte_clear_dirty(struct kvm *kvm, u64 *sptep)
{
	u64 spte = *sptep;

	rmap_printk("rmap_clear_dirty: spte %p %llx\n", sptep, *sptep);

	spte &= ~shadow_dirty_mask;

	return mmu_spte_update(sptep, spte);
}

1241
static bool __rmap_clear_dirty(struct kvm *kvm, struct kvm_rmap_head *rmap_head)
1242 1243 1244 1245 1246
{
	u64 *sptep;
	struct rmap_iterator iter;
	bool flush = false;

1247
	for_each_rmap_spte(rmap_head, &iter, sptep)
1248 1249 1250 1251 1252 1253 1254 1255 1256 1257 1258 1259 1260 1261 1262 1263
		flush |= spte_clear_dirty(kvm, sptep);

	return flush;
}

static bool spte_set_dirty(struct kvm *kvm, u64 *sptep)
{
	u64 spte = *sptep;

	rmap_printk("rmap_set_dirty: spte %p %llx\n", sptep, *sptep);

	spte |= shadow_dirty_mask;

	return mmu_spte_update(sptep, spte);
}

1264
static bool __rmap_set_dirty(struct kvm *kvm, struct kvm_rmap_head *rmap_head)
1265 1266 1267 1268 1269
{
	u64 *sptep;
	struct rmap_iterator iter;
	bool flush = false;

1270
	for_each_rmap_spte(rmap_head, &iter, sptep)
1271 1272 1273 1274 1275
		flush |= spte_set_dirty(kvm, sptep);

	return flush;
}

1276
/**
1277
 * kvm_mmu_write_protect_pt_masked - write protect selected PT level pages
1278 1279 1280 1281 1282 1283 1284 1285
 * @kvm: kvm instance
 * @slot: slot to protect
 * @gfn_offset: start of the BITS_PER_LONG pages we care about
 * @mask: indicates which pages we should protect
 *
 * Used when we do not need to care about huge page mappings: e.g. during dirty
 * logging we do not have any such mappings.
 */
1286
static void kvm_mmu_write_protect_pt_masked(struct kvm *kvm,
1287 1288
				     struct kvm_memory_slot *slot,
				     gfn_t gfn_offset, unsigned long mask)
1289
{
1290
	struct kvm_rmap_head *rmap_head;
1291

1292
	while (mask) {
1293 1294 1295
		rmap_head = __gfn_to_rmap(slot->base_gfn + gfn_offset + __ffs(mask),
					  PT_PAGE_TABLE_LEVEL, slot);
		__rmap_write_protect(kvm, rmap_head, false);
M
Marcelo Tosatti 已提交
1296

1297 1298 1299
		/* clear the first set bit */
		mask &= mask - 1;
	}
1300 1301
}

1302 1303 1304 1305 1306 1307 1308 1309 1310 1311 1312 1313 1314
/**
 * kvm_mmu_clear_dirty_pt_masked - clear MMU D-bit for PT level pages
 * @kvm: kvm instance
 * @slot: slot to clear D-bit
 * @gfn_offset: start of the BITS_PER_LONG pages we care about
 * @mask: indicates which pages we should clear D-bit
 *
 * Used for PML to re-log the dirty GPAs after userspace querying dirty_bitmap.
 */
void kvm_mmu_clear_dirty_pt_masked(struct kvm *kvm,
				     struct kvm_memory_slot *slot,
				     gfn_t gfn_offset, unsigned long mask)
{
1315
	struct kvm_rmap_head *rmap_head;
1316 1317

	while (mask) {
1318 1319 1320
		rmap_head = __gfn_to_rmap(slot->base_gfn + gfn_offset + __ffs(mask),
					  PT_PAGE_TABLE_LEVEL, slot);
		__rmap_clear_dirty(kvm, rmap_head);
1321 1322 1323 1324 1325 1326 1327

		/* clear the first set bit */
		mask &= mask - 1;
	}
}
EXPORT_SYMBOL_GPL(kvm_mmu_clear_dirty_pt_masked);

1328 1329 1330 1331 1332 1333 1334 1335 1336 1337 1338 1339 1340 1341
/**
 * kvm_arch_mmu_enable_log_dirty_pt_masked - enable dirty logging for selected
 * PT level pages.
 *
 * It calls kvm_mmu_write_protect_pt_masked to write protect selected pages to
 * enable dirty logging for them.
 *
 * Used when we do not need to care about huge page mappings: e.g. during dirty
 * logging we do not have any such mappings.
 */
void kvm_arch_mmu_enable_log_dirty_pt_masked(struct kvm *kvm,
				struct kvm_memory_slot *slot,
				gfn_t gfn_offset, unsigned long mask)
{
1342 1343 1344 1345 1346
	if (kvm_x86_ops->enable_log_dirty_pt_masked)
		kvm_x86_ops->enable_log_dirty_pt_masked(kvm, slot, gfn_offset,
				mask);
	else
		kvm_mmu_write_protect_pt_masked(kvm, slot, gfn_offset, mask);
1347 1348
}

1349 1350
bool kvm_mmu_slot_gfn_write_protect(struct kvm *kvm,
				    struct kvm_memory_slot *slot, u64 gfn)
1351
{
1352
	struct kvm_rmap_head *rmap_head;
1353
	int i;
1354
	bool write_protected = false;
1355

1356
	for (i = PT_PAGE_TABLE_LEVEL; i <= PT_MAX_HUGEPAGE_LEVEL; ++i) {
1357
		rmap_head = __gfn_to_rmap(gfn, i, slot);
1358
		write_protected |= __rmap_write_protect(kvm, rmap_head, true);
1359 1360 1361
	}

	return write_protected;
1362 1363
}

1364 1365 1366 1367 1368 1369 1370 1371
static bool rmap_write_protect(struct kvm_vcpu *vcpu, u64 gfn)
{
	struct kvm_memory_slot *slot;

	slot = kvm_vcpu_gfn_to_memslot(vcpu, gfn);
	return kvm_mmu_slot_gfn_write_protect(vcpu->kvm, slot, gfn);
}

1372
static bool kvm_zap_rmapp(struct kvm *kvm, struct kvm_rmap_head *rmap_head)
1373
{
1374 1375
	u64 *sptep;
	struct rmap_iterator iter;
1376
	bool flush = false;
1377

1378
	while ((sptep = rmap_get_first(rmap_head, &iter))) {
1379
		rmap_printk("%s: spte %p %llx.\n", __func__, sptep, *sptep);
1380 1381

		drop_spte(kvm, sptep);
1382
		flush = true;
1383
	}
1384

1385 1386 1387
	return flush;
}

1388
static int kvm_unmap_rmapp(struct kvm *kvm, struct kvm_rmap_head *rmap_head,
1389 1390 1391
			   struct kvm_memory_slot *slot, gfn_t gfn, int level,
			   unsigned long data)
{
1392
	return kvm_zap_rmapp(kvm, rmap_head);
1393 1394
}

1395
static int kvm_set_pte_rmapp(struct kvm *kvm, struct kvm_rmap_head *rmap_head,
1396 1397
			     struct kvm_memory_slot *slot, gfn_t gfn, int level,
			     unsigned long data)
1398
{
1399 1400
	u64 *sptep;
	struct rmap_iterator iter;
1401
	int need_flush = 0;
1402
	u64 new_spte;
1403
	pte_t *ptep = (pte_t *)data;
D
Dan Williams 已提交
1404
	kvm_pfn_t new_pfn;
1405 1406 1407

	WARN_ON(pte_huge(*ptep));
	new_pfn = pte_pfn(*ptep);
1408

1409
restart:
1410
	for_each_rmap_spte(rmap_head, &iter, sptep) {
1411 1412
		rmap_printk("kvm_set_pte_rmapp: spte %p %llx gfn %llx (%d)\n",
			     sptep, *sptep, gfn, level);
1413

1414
		need_flush = 1;
1415

1416
		if (pte_write(*ptep)) {
1417
			drop_spte(kvm, sptep);
1418
			goto restart;
1419
		} else {
1420
			new_spte = *sptep & ~PT64_BASE_ADDR_MASK;
1421 1422 1423 1424
			new_spte |= (u64)new_pfn << PAGE_SHIFT;

			new_spte &= ~PT_WRITABLE_MASK;
			new_spte &= ~SPTE_HOST_WRITEABLE;
1425
			new_spte &= ~shadow_accessed_mask;
1426 1427 1428

			mmu_spte_clear_track_bits(sptep);
			mmu_spte_set(sptep, new_spte);
1429 1430
		}
	}
1431

1432 1433 1434 1435 1436 1437
	if (need_flush)
		kvm_flush_remote_tlbs(kvm);

	return 0;
}

1438 1439 1440 1441 1442 1443 1444 1445 1446 1447
struct slot_rmap_walk_iterator {
	/* input fields. */
	struct kvm_memory_slot *slot;
	gfn_t start_gfn;
	gfn_t end_gfn;
	int start_level;
	int end_level;

	/* output fields. */
	gfn_t gfn;
1448
	struct kvm_rmap_head *rmap;
1449 1450 1451
	int level;

	/* private field. */
1452
	struct kvm_rmap_head *end_rmap;
1453 1454 1455 1456 1457 1458 1459 1460 1461 1462 1463 1464 1465 1466 1467 1468 1469 1470 1471 1472 1473 1474 1475 1476 1477 1478 1479 1480 1481 1482 1483 1484 1485 1486 1487 1488 1489 1490 1491 1492 1493 1494 1495 1496 1497 1498 1499 1500 1501 1502 1503 1504 1505
};

static void
rmap_walk_init_level(struct slot_rmap_walk_iterator *iterator, int level)
{
	iterator->level = level;
	iterator->gfn = iterator->start_gfn;
	iterator->rmap = __gfn_to_rmap(iterator->gfn, level, iterator->slot);
	iterator->end_rmap = __gfn_to_rmap(iterator->end_gfn, level,
					   iterator->slot);
}

static void
slot_rmap_walk_init(struct slot_rmap_walk_iterator *iterator,
		    struct kvm_memory_slot *slot, int start_level,
		    int end_level, gfn_t start_gfn, gfn_t end_gfn)
{
	iterator->slot = slot;
	iterator->start_level = start_level;
	iterator->end_level = end_level;
	iterator->start_gfn = start_gfn;
	iterator->end_gfn = end_gfn;

	rmap_walk_init_level(iterator, iterator->start_level);
}

static bool slot_rmap_walk_okay(struct slot_rmap_walk_iterator *iterator)
{
	return !!iterator->rmap;
}

static void slot_rmap_walk_next(struct slot_rmap_walk_iterator *iterator)
{
	if (++iterator->rmap <= iterator->end_rmap) {
		iterator->gfn += (1UL << KVM_HPAGE_GFN_SHIFT(iterator->level));
		return;
	}

	if (++iterator->level > iterator->end_level) {
		iterator->rmap = NULL;
		return;
	}

	rmap_walk_init_level(iterator, iterator->level);
}

#define for_each_slot_rmap_range(_slot_, _start_level_, _end_level_,	\
	   _start_gfn, _end_gfn, _iter_)				\
	for (slot_rmap_walk_init(_iter_, _slot_, _start_level_,		\
				 _end_level_, _start_gfn, _end_gfn);	\
	     slot_rmap_walk_okay(_iter_);				\
	     slot_rmap_walk_next(_iter_))

1506 1507 1508 1509 1510
static int kvm_handle_hva_range(struct kvm *kvm,
				unsigned long start,
				unsigned long end,
				unsigned long data,
				int (*handler)(struct kvm *kvm,
1511
					       struct kvm_rmap_head *rmap_head,
1512
					       struct kvm_memory_slot *slot,
1513 1514
					       gfn_t gfn,
					       int level,
1515
					       unsigned long data))
1516
{
1517
	struct kvm_memslots *slots;
1518
	struct kvm_memory_slot *memslot;
1519 1520
	struct slot_rmap_walk_iterator iterator;
	int ret = 0;
1521
	int i;
1522

1523 1524 1525 1526 1527
	for (i = 0; i < KVM_ADDRESS_SPACE_NUM; i++) {
		slots = __kvm_memslots(kvm, i);
		kvm_for_each_memslot(memslot, slots) {
			unsigned long hva_start, hva_end;
			gfn_t gfn_start, gfn_end;
1528

1529 1530 1531 1532 1533 1534 1535 1536 1537 1538 1539 1540 1541 1542 1543 1544 1545 1546 1547
			hva_start = max(start, memslot->userspace_addr);
			hva_end = min(end, memslot->userspace_addr +
				      (memslot->npages << PAGE_SHIFT));
			if (hva_start >= hva_end)
				continue;
			/*
			 * {gfn(page) | page intersects with [hva_start, hva_end)} =
			 * {gfn_start, gfn_start+1, ..., gfn_end-1}.
			 */
			gfn_start = hva_to_gfn_memslot(hva_start, memslot);
			gfn_end = hva_to_gfn_memslot(hva_end + PAGE_SIZE - 1, memslot);

			for_each_slot_rmap_range(memslot, PT_PAGE_TABLE_LEVEL,
						 PT_MAX_HUGEPAGE_LEVEL,
						 gfn_start, gfn_end - 1,
						 &iterator)
				ret |= handler(kvm, iterator.rmap, memslot,
					       iterator.gfn, iterator.level, data);
		}
1548 1549
	}

1550
	return ret;
1551 1552
}

1553 1554
static int kvm_handle_hva(struct kvm *kvm, unsigned long hva,
			  unsigned long data,
1555 1556
			  int (*handler)(struct kvm *kvm,
					 struct kvm_rmap_head *rmap_head,
1557
					 struct kvm_memory_slot *slot,
1558
					 gfn_t gfn, int level,
1559 1560 1561
					 unsigned long data))
{
	return kvm_handle_hva_range(kvm, hva, hva + 1, data, handler);
1562 1563 1564 1565
}

int kvm_unmap_hva(struct kvm *kvm, unsigned long hva)
{
1566 1567 1568
	return kvm_handle_hva(kvm, hva, 0, kvm_unmap_rmapp);
}

1569 1570 1571 1572 1573
int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end)
{
	return kvm_handle_hva_range(kvm, start, end, 0, kvm_unmap_rmapp);
}

1574 1575
void kvm_set_spte_hva(struct kvm *kvm, unsigned long hva, pte_t pte)
{
F
Frederik Deweerdt 已提交
1576
	kvm_handle_hva(kvm, hva, (unsigned long)&pte, kvm_set_pte_rmapp);
1577 1578
}

1579
static int kvm_age_rmapp(struct kvm *kvm, struct kvm_rmap_head *rmap_head,
1580 1581
			 struct kvm_memory_slot *slot, gfn_t gfn, int level,
			 unsigned long data)
1582
{
1583
	u64 *sptep;
1584
	struct rmap_iterator uninitialized_var(iter);
1585 1586
	int young = 0;

A
Andres Lagar-Cavilla 已提交
1587
	BUG_ON(!shadow_accessed_mask);
1588

1589
	for_each_rmap_spte(rmap_head, &iter, sptep) {
1590
		if (*sptep & shadow_accessed_mask) {
1591
			young = 1;
1592 1593
			clear_bit((ffs(shadow_accessed_mask) - 1),
				 (unsigned long *)sptep);
1594
		}
1595
	}
1596

1597
	trace_kvm_age_page(gfn, level, slot, young);
1598 1599 1600
	return young;
}

1601
static int kvm_test_age_rmapp(struct kvm *kvm, struct kvm_rmap_head *rmap_head,
1602 1603
			      struct kvm_memory_slot *slot, gfn_t gfn,
			      int level, unsigned long data)
A
Andrea Arcangeli 已提交
1604
{
1605 1606
	u64 *sptep;
	struct rmap_iterator iter;
A
Andrea Arcangeli 已提交
1607 1608 1609 1610 1611 1612 1613 1614 1615 1616
	int young = 0;

	/*
	 * If there's no access bit in the secondary pte set by the
	 * hardware it's up to gup-fast/gup to set the access bit in
	 * the primary pte or in the page structure.
	 */
	if (!shadow_accessed_mask)
		goto out;

1617
	for_each_rmap_spte(rmap_head, &iter, sptep) {
1618
		if (*sptep & shadow_accessed_mask) {
A
Andrea Arcangeli 已提交
1619 1620 1621
			young = 1;
			break;
		}
1622
	}
A
Andrea Arcangeli 已提交
1623 1624 1625 1626
out:
	return young;
}

1627 1628
#define RMAP_RECYCLE_THRESHOLD 1000

1629
static void rmap_recycle(struct kvm_vcpu *vcpu, u64 *spte, gfn_t gfn)
1630
{
1631
	struct kvm_rmap_head *rmap_head;
1632 1633 1634
	struct kvm_mmu_page *sp;

	sp = page_header(__pa(spte));
1635

1636
	rmap_head = gfn_to_rmap(vcpu->kvm, gfn, sp);
1637

1638
	kvm_unmap_rmapp(vcpu->kvm, rmap_head, NULL, gfn, sp->role.level, 0);
1639 1640 1641
	kvm_flush_remote_tlbs(vcpu->kvm);
}

A
Andres Lagar-Cavilla 已提交
1642
int kvm_age_hva(struct kvm *kvm, unsigned long start, unsigned long end)
1643
{
A
Andres Lagar-Cavilla 已提交
1644 1645 1646 1647 1648 1649 1650 1651 1652 1653 1654 1655 1656 1657 1658 1659 1660 1661 1662 1663 1664
	/*
	 * In case of absence of EPT Access and Dirty Bits supports,
	 * emulate the accessed bit for EPT, by checking if this page has
	 * an EPT mapping, and clearing it if it does. On the next access,
	 * a new EPT mapping will be established.
	 * This has some overhead, but not as much as the cost of swapping
	 * out actively used pages or breaking up actively used hugepages.
	 */
	if (!shadow_accessed_mask) {
		/*
		 * We are holding the kvm->mmu_lock, and we are blowing up
		 * shadow PTEs. MMU notifier consumers need to be kept at bay.
		 * This is correct as long as we don't decouple the mmu_lock
		 * protected regions (like invalidate_range_start|end does).
		 */
		kvm->mmu_notifier_seq++;
		return kvm_handle_hva_range(kvm, start, end, 0,
					    kvm_unmap_rmapp);
	}

	return kvm_handle_hva_range(kvm, start, end, 0, kvm_age_rmapp);
1665 1666
}

A
Andrea Arcangeli 已提交
1667 1668 1669 1670 1671
int kvm_test_age_hva(struct kvm *kvm, unsigned long hva)
{
	return kvm_handle_hva(kvm, hva, 0, kvm_test_age_rmapp);
}

1672
#ifdef MMU_DEBUG
1673
static int is_empty_shadow_page(u64 *spt)
A
Avi Kivity 已提交
1674
{
1675 1676 1677
	u64 *pos;
	u64 *end;

1678
	for (pos = spt, end = pos + PAGE_SIZE / sizeof(u64); pos != end; pos++)
1679
		if (is_shadow_present_pte(*pos)) {
1680
			printk(KERN_ERR "%s: %p %llx\n", __func__,
1681
			       pos, *pos);
A
Avi Kivity 已提交
1682
			return 0;
1683
		}
A
Avi Kivity 已提交
1684 1685
	return 1;
}
1686
#endif
A
Avi Kivity 已提交
1687

1688 1689 1690 1691 1692 1693 1694 1695 1696 1697 1698 1699
/*
 * This value is the sum of all of the kvm instances's
 * kvm->arch.n_used_mmu_pages values.  We need a global,
 * aggregate version in order to make the slab shrinker
 * faster
 */
static inline void kvm_mod_used_mmu_pages(struct kvm *kvm, int nr)
{
	kvm->arch.n_used_mmu_pages += nr;
	percpu_counter_add(&kvm_total_used_mmu_pages, nr);
}

1700
static void kvm_mmu_free_page(struct kvm_mmu_page *sp)
1701
{
1702
	MMU_WARN_ON(!is_empty_shadow_page(sp->spt));
1703
	hlist_del(&sp->hash_link);
1704 1705
	list_del(&sp->link);
	free_page((unsigned long)sp->spt);
1706 1707
	if (!sp->role.direct)
		free_page((unsigned long)sp->gfns);
1708
	kmem_cache_free(mmu_page_header_cache, sp);
1709 1710
}

1711 1712
static unsigned kvm_page_table_hashfn(gfn_t gfn)
{
1713
	return gfn & ((1 << KVM_MMU_HASH_SHIFT) - 1);
1714 1715
}

1716
static void mmu_page_add_parent_pte(struct kvm_vcpu *vcpu,
1717
				    struct kvm_mmu_page *sp, u64 *parent_pte)
1718 1719 1720 1721
{
	if (!parent_pte)
		return;

1722
	pte_list_add(vcpu, parent_pte, &sp->parent_ptes);
1723 1724
}

1725
static void mmu_page_remove_parent_pte(struct kvm_mmu_page *sp,
1726 1727
				       u64 *parent_pte)
{
1728
	pte_list_remove(parent_pte, &sp->parent_ptes);
1729 1730
}

1731 1732 1733 1734
static void drop_parent_pte(struct kvm_mmu_page *sp,
			    u64 *parent_pte)
{
	mmu_page_remove_parent_pte(sp, parent_pte);
1735
	mmu_spte_clear_no_track(parent_pte);
1736 1737
}

1738
static struct kvm_mmu_page *kvm_mmu_alloc_page(struct kvm_vcpu *vcpu, int direct)
M
Marcelo Tosatti 已提交
1739
{
1740
	struct kvm_mmu_page *sp;
1741

1742 1743
	sp = mmu_memory_cache_alloc(&vcpu->arch.mmu_page_header_cache);
	sp->spt = mmu_memory_cache_alloc(&vcpu->arch.mmu_page_cache);
1744
	if (!direct)
1745
		sp->gfns = mmu_memory_cache_alloc(&vcpu->arch.mmu_page_cache);
1746
	set_page_private(virt_to_page(sp->spt), (unsigned long)sp);
1747 1748 1749 1750 1751 1752

	/*
	 * The active_mmu_pages list is the FIFO list, do not move the
	 * page until it is zapped. kvm_zap_obsolete_pages depends on
	 * this feature. See the comments in kvm_zap_obsolete_pages().
	 */
1753 1754 1755
	list_add(&sp->link, &vcpu->kvm->arch.active_mmu_pages);
	kvm_mod_used_mmu_pages(vcpu->kvm, +1);
	return sp;
M
Marcelo Tosatti 已提交
1756 1757
}

1758
static void mark_unsync(u64 *spte);
1759
static void kvm_mmu_mark_parents_unsync(struct kvm_mmu_page *sp)
1760
{
1761 1762 1763 1764 1765 1766
	u64 *sptep;
	struct rmap_iterator iter;

	for_each_rmap_spte(&sp->parent_ptes, &iter, sptep) {
		mark_unsync(sptep);
	}
1767 1768
}

1769
static void mark_unsync(u64 *spte)
1770
{
1771
	struct kvm_mmu_page *sp;
1772
	unsigned int index;
1773

1774
	sp = page_header(__pa(spte));
1775 1776
	index = spte - sp->spt;
	if (__test_and_set_bit(index, sp->unsync_child_bitmap))
1777
		return;
1778
	if (sp->unsync_children++)
1779
		return;
1780
	kvm_mmu_mark_parents_unsync(sp);
1781 1782
}

1783
static int nonpaging_sync_page(struct kvm_vcpu *vcpu,
1784
			       struct kvm_mmu_page *sp)
1785
{
1786
	return 0;
1787 1788
}

M
Marcelo Tosatti 已提交
1789 1790 1791 1792
static void nonpaging_invlpg(struct kvm_vcpu *vcpu, gva_t gva)
{
}

1793 1794
static void nonpaging_update_pte(struct kvm_vcpu *vcpu,
				 struct kvm_mmu_page *sp, u64 *spte,
1795
				 const void *pte)
1796 1797 1798 1799
{
	WARN_ON(1);
}

1800 1801 1802 1803 1804 1805 1806 1807 1808 1809
#define KVM_PAGE_ARRAY_NR 16

struct kvm_mmu_pages {
	struct mmu_page_and_offset {
		struct kvm_mmu_page *sp;
		unsigned int idx;
	} page[KVM_PAGE_ARRAY_NR];
	unsigned int nr;
};

1810 1811
static int mmu_pages_add(struct kvm_mmu_pages *pvec, struct kvm_mmu_page *sp,
			 int idx)
1812
{
1813
	int i;
1814

1815 1816 1817 1818 1819 1820 1821 1822 1823 1824 1825
	if (sp->unsync)
		for (i=0; i < pvec->nr; i++)
			if (pvec->page[i].sp == sp)
				return 0;

	pvec->page[pvec->nr].sp = sp;
	pvec->page[pvec->nr].idx = idx;
	pvec->nr++;
	return (pvec->nr == KVM_PAGE_ARRAY_NR);
}

1826 1827 1828 1829 1830 1831 1832
static inline void clear_unsync_child_bit(struct kvm_mmu_page *sp, int idx)
{
	--sp->unsync_children;
	WARN_ON((int)sp->unsync_children < 0);
	__clear_bit(idx, sp->unsync_child_bitmap);
}

1833 1834 1835 1836
static int __mmu_unsync_walk(struct kvm_mmu_page *sp,
			   struct kvm_mmu_pages *pvec)
{
	int i, ret, nr_unsync_leaf = 0;
1837

1838
	for_each_set_bit(i, sp->unsync_child_bitmap, 512) {
1839
		struct kvm_mmu_page *child;
1840 1841
		u64 ent = sp->spt[i];

1842 1843 1844 1845
		if (!is_shadow_present_pte(ent) || is_large_pte(ent)) {
			clear_unsync_child_bit(sp, i);
			continue;
		}
1846 1847 1848 1849 1850 1851 1852 1853

		child = page_header(ent & PT64_BASE_ADDR_MASK);

		if (child->unsync_children) {
			if (mmu_pages_add(pvec, child, i))
				return -ENOSPC;

			ret = __mmu_unsync_walk(child, pvec);
1854 1855 1856 1857
			if (!ret) {
				clear_unsync_child_bit(sp, i);
				continue;
			} else if (ret > 0) {
1858
				nr_unsync_leaf += ret;
1859
			} else
1860 1861 1862 1863 1864 1865
				return ret;
		} else if (child->unsync) {
			nr_unsync_leaf++;
			if (mmu_pages_add(pvec, child, i))
				return -ENOSPC;
		} else
1866
			clear_unsync_child_bit(sp, i);
1867 1868
	}

1869 1870 1871
	return nr_unsync_leaf;
}

1872 1873
#define INVALID_INDEX (-1)

1874 1875 1876
static int mmu_unsync_walk(struct kvm_mmu_page *sp,
			   struct kvm_mmu_pages *pvec)
{
P
Paolo Bonzini 已提交
1877
	pvec->nr = 0;
1878 1879 1880
	if (!sp->unsync_children)
		return 0;

1881
	mmu_pages_add(pvec, sp, INVALID_INDEX);
1882
	return __mmu_unsync_walk(sp, pvec);
1883 1884 1885 1886 1887
}

static void kvm_unlink_unsync_page(struct kvm *kvm, struct kvm_mmu_page *sp)
{
	WARN_ON(!sp->unsync);
1888
	trace_kvm_mmu_sync_page(sp);
1889 1890 1891 1892
	sp->unsync = 0;
	--kvm->stat.mmu_unsync;
}

1893 1894 1895 1896
static int kvm_mmu_prepare_zap_page(struct kvm *kvm, struct kvm_mmu_page *sp,
				    struct list_head *invalid_list);
static void kvm_mmu_commit_zap_page(struct kvm *kvm,
				    struct list_head *invalid_list);
1897

1898 1899 1900 1901 1902 1903 1904 1905 1906 1907
/*
 * NOTE: we should pay more attention on the zapped-obsolete page
 * (is_obsolete_sp(sp) && sp->role.invalid) when you do hash list walk
 * since it has been deleted from active_mmu_pages but still can be found
 * at hast list.
 *
 * for_each_gfn_indirect_valid_sp has skipped that kind of page and
 * kvm_mmu_get_page(), the only user of for_each_gfn_sp(), has skipped
 * all the obsolete pages.
 */
1908 1909 1910 1911 1912 1913 1914 1915
#define for_each_gfn_sp(_kvm, _sp, _gfn)				\
	hlist_for_each_entry(_sp,					\
	  &(_kvm)->arch.mmu_page_hash[kvm_page_table_hashfn(_gfn)], hash_link) \
		if ((_sp)->gfn != (_gfn)) {} else

#define for_each_gfn_indirect_valid_sp(_kvm, _sp, _gfn)			\
	for_each_gfn_sp(_kvm, _sp, _gfn)				\
		if ((_sp)->role.direct || (_sp)->role.invalid) {} else
1916

1917
/* @sp->gfn should be write-protected at the call site */
1918 1919
static bool __kvm_sync_page(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp,
			    struct list_head *invalid_list)
1920
{
1921
	if (sp->role.cr4_pae != !!is_pae(vcpu)) {
1922
		kvm_mmu_prepare_zap_page(vcpu->kvm, sp, invalid_list);
1923
		return false;
1924 1925
	}

1926
	if (vcpu->arch.mmu.sync_page(vcpu, sp) == 0) {
1927
		kvm_mmu_prepare_zap_page(vcpu->kvm, sp, invalid_list);
1928
		return false;
1929 1930
	}

1931
	return true;
1932 1933
}

1934 1935 1936
static void kvm_mmu_flush_or_zap(struct kvm_vcpu *vcpu,
				 struct list_head *invalid_list,
				 bool remote_flush, bool local_flush)
1937
{
1938 1939 1940 1941
	if (!list_empty(invalid_list)) {
		kvm_mmu_commit_zap_page(vcpu->kvm, invalid_list);
		return;
	}
1942

1943 1944 1945 1946
	if (remote_flush)
		kvm_flush_remote_tlbs(vcpu->kvm);
	else if (local_flush)
		kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu);
1947 1948
}

1949 1950 1951 1952 1953 1954 1955
#ifdef CONFIG_KVM_MMU_AUDIT
#include "mmu_audit.c"
#else
static void kvm_mmu_audit(struct kvm_vcpu *vcpu, int point) { }
static void mmu_audit_disable(void) { }
#endif

1956
static bool kvm_sync_page(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp,
1957
			 struct list_head *invalid_list)
1958
{
1959 1960
	kvm_unlink_unsync_page(vcpu->kvm, sp);
	return __kvm_sync_page(vcpu, sp, invalid_list);
1961 1962
}

1963
/* @gfn should be write-protected at the call site */
1964 1965
static bool kvm_sync_pages(struct kvm_vcpu *vcpu, gfn_t gfn,
			   struct list_head *invalid_list)
1966 1967
{
	struct kvm_mmu_page *s;
1968
	bool ret = false;
1969

1970
	for_each_gfn_indirect_valid_sp(vcpu->kvm, s, gfn) {
1971
		if (!s->unsync)
1972 1973 1974
			continue;

		WARN_ON(s->role.level != PT_PAGE_TABLE_LEVEL);
1975
		ret |= kvm_sync_page(vcpu, s, invalid_list);
1976 1977
	}

1978
	return ret;
1979 1980
}

1981
struct mmu_page_path {
P
Paolo Bonzini 已提交
1982 1983
	struct kvm_mmu_page *parent[PT64_ROOT_LEVEL];
	unsigned int idx[PT64_ROOT_LEVEL];
1984 1985
};

1986
#define for_each_sp(pvec, sp, parents, i)			\
P
Paolo Bonzini 已提交
1987
		for (i = mmu_pages_first(&pvec, &parents);	\
1988 1989 1990
			i < pvec.nr && ({ sp = pvec.page[i].sp; 1;});	\
			i = mmu_pages_next(&pvec, &parents, i))

1991 1992 1993
static int mmu_pages_next(struct kvm_mmu_pages *pvec,
			  struct mmu_page_path *parents,
			  int i)
1994 1995 1996 1997 1998
{
	int n;

	for (n = i+1; n < pvec->nr; n++) {
		struct kvm_mmu_page *sp = pvec->page[n].sp;
P
Paolo Bonzini 已提交
1999 2000
		unsigned idx = pvec->page[n].idx;
		int level = sp->role.level;
2001

P
Paolo Bonzini 已提交
2002 2003 2004
		parents->idx[level-1] = idx;
		if (level == PT_PAGE_TABLE_LEVEL)
			break;
2005

P
Paolo Bonzini 已提交
2006
		parents->parent[level-2] = sp;
2007 2008 2009 2010 2011
	}

	return n;
}

P
Paolo Bonzini 已提交
2012 2013 2014 2015 2016 2017 2018 2019 2020
static int mmu_pages_first(struct kvm_mmu_pages *pvec,
			   struct mmu_page_path *parents)
{
	struct kvm_mmu_page *sp;
	int level;

	if (pvec->nr == 0)
		return 0;

2021 2022
	WARN_ON(pvec->page[0].idx != INVALID_INDEX);

P
Paolo Bonzini 已提交
2023 2024 2025 2026 2027 2028 2029 2030 2031 2032 2033 2034 2035
	sp = pvec->page[0].sp;
	level = sp->role.level;
	WARN_ON(level == PT_PAGE_TABLE_LEVEL);

	parents->parent[level-2] = sp;

	/* Also set up a sentinel.  Further entries in pvec are all
	 * children of sp, so this element is never overwritten.
	 */
	parents->parent[level-1] = NULL;
	return mmu_pages_next(pvec, parents, 0);
}

2036
static void mmu_pages_clear_parents(struct mmu_page_path *parents)
2037
{
2038 2039 2040 2041 2042 2043 2044 2045 2046
	struct kvm_mmu_page *sp;
	unsigned int level = 0;

	do {
		unsigned int idx = parents->idx[level];
		sp = parents->parent[level];
		if (!sp)
			return;

2047
		WARN_ON(idx == INVALID_INDEX);
2048
		clear_unsync_child_bit(sp, idx);
2049
		level++;
P
Paolo Bonzini 已提交
2050
	} while (!sp->unsync_children);
2051
}
2052

2053 2054 2055 2056 2057 2058 2059
static void mmu_sync_children(struct kvm_vcpu *vcpu,
			      struct kvm_mmu_page *parent)
{
	int i;
	struct kvm_mmu_page *sp;
	struct mmu_page_path parents;
	struct kvm_mmu_pages pages;
2060
	LIST_HEAD(invalid_list);
2061
	bool flush = false;
2062 2063

	while (mmu_unsync_walk(parent, &pages)) {
2064
		bool protected = false;
2065 2066

		for_each_sp(pages, sp, parents, i)
2067
			protected |= rmap_write_protect(vcpu, sp->gfn);
2068

2069
		if (protected) {
2070
			kvm_flush_remote_tlbs(vcpu->kvm);
2071 2072
			flush = false;
		}
2073

2074
		for_each_sp(pages, sp, parents, i) {
2075
			flush |= kvm_sync_page(vcpu, sp, &invalid_list);
2076 2077
			mmu_pages_clear_parents(&parents);
		}
2078 2079 2080 2081 2082
		if (need_resched() || spin_needbreak(&vcpu->kvm->mmu_lock)) {
			kvm_mmu_flush_or_zap(vcpu, &invalid_list, false, flush);
			cond_resched_lock(&vcpu->kvm->mmu_lock);
			flush = false;
		}
2083
	}
2084 2085

	kvm_mmu_flush_or_zap(vcpu, &invalid_list, false, flush);
2086 2087
}

2088 2089
static void __clear_sp_write_flooding_count(struct kvm_mmu_page *sp)
{
2090
	atomic_set(&sp->write_flooding_count,  0);
2091 2092 2093 2094 2095 2096 2097 2098 2099
}

static void clear_sp_write_flooding_count(u64 *spte)
{
	struct kvm_mmu_page *sp =  page_header(__pa(spte));

	__clear_sp_write_flooding_count(sp);
}

2100 2101 2102 2103 2104
static bool is_obsolete_sp(struct kvm *kvm, struct kvm_mmu_page *sp)
{
	return unlikely(sp->mmu_valid_gen != kvm->arch.mmu_valid_gen);
}

2105 2106 2107 2108
static struct kvm_mmu_page *kvm_mmu_get_page(struct kvm_vcpu *vcpu,
					     gfn_t gfn,
					     gva_t gaddr,
					     unsigned level,
2109
					     int direct,
2110
					     unsigned access)
2111 2112 2113
{
	union kvm_mmu_page_role role;
	unsigned quadrant;
2114 2115
	struct kvm_mmu_page *sp;
	bool need_sync = false;
2116 2117
	bool flush = false;
	LIST_HEAD(invalid_list);
2118

2119
	role = vcpu->arch.mmu.base_role;
2120
	role.level = level;
2121
	role.direct = direct;
2122
	if (role.direct)
2123
		role.cr4_pae = 0;
2124
	role.access = access;
2125 2126
	if (!vcpu->arch.mmu.direct_map
	    && vcpu->arch.mmu.root_level <= PT32_ROOT_LEVEL) {
2127 2128 2129 2130
		quadrant = gaddr >> (PAGE_SHIFT + (PT64_PT_BITS * level));
		quadrant &= (1 << ((PT32_PT_BITS - PT64_PT_BITS) * level)) - 1;
		role.quadrant = quadrant;
	}
2131
	for_each_gfn_sp(vcpu->kvm, sp, gfn) {
2132 2133 2134
		if (is_obsolete_sp(vcpu->kvm, sp))
			continue;

2135 2136
		if (!need_sync && sp->unsync)
			need_sync = true;
2137

2138 2139
		if (sp->role.word != role.word)
			continue;
2140

2141 2142 2143 2144 2145 2146 2147 2148 2149 2150
		if (sp->unsync) {
			/* The page is good, but __kvm_sync_page might still end
			 * up zapping it.  If so, break in order to rebuild it.
			 */
			if (!__kvm_sync_page(vcpu, sp, &invalid_list))
				break;

			WARN_ON(!list_empty(&invalid_list));
			kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu);
		}
2151

2152
		if (sp->unsync_children)
2153
			kvm_make_request(KVM_REQ_MMU_SYNC, vcpu);
2154

2155
		__clear_sp_write_flooding_count(sp);
2156 2157 2158
		trace_kvm_mmu_get_page(sp, false);
		return sp;
	}
2159

A
Avi Kivity 已提交
2160
	++vcpu->kvm->stat.mmu_cache_miss;
2161 2162 2163

	sp = kvm_mmu_alloc_page(vcpu, direct);

2164 2165
	sp->gfn = gfn;
	sp->role = role;
2166 2167
	hlist_add_head(&sp->hash_link,
		&vcpu->kvm->arch.mmu_page_hash[kvm_page_table_hashfn(gfn)]);
2168
	if (!direct) {
2169 2170 2171 2172 2173 2174 2175 2176
		/*
		 * we should do write protection before syncing pages
		 * otherwise the content of the synced shadow page may
		 * be inconsistent with guest page table.
		 */
		account_shadowed(vcpu->kvm, sp);
		if (level == PT_PAGE_TABLE_LEVEL &&
		      rmap_write_protect(vcpu, gfn))
2177
			kvm_flush_remote_tlbs(vcpu->kvm);
2178 2179

		if (level > PT_PAGE_TABLE_LEVEL && need_sync)
2180
			flush |= kvm_sync_pages(vcpu, gfn, &invalid_list);
2181
	}
2182
	sp->mmu_valid_gen = vcpu->kvm->arch.mmu_valid_gen;
2183
	clear_page(sp->spt);
A
Avi Kivity 已提交
2184
	trace_kvm_mmu_get_page(sp, true);
2185 2186

	kvm_mmu_flush_or_zap(vcpu, &invalid_list, false, flush);
2187
	return sp;
2188 2189
}

2190 2191 2192 2193 2194 2195
static void shadow_walk_init(struct kvm_shadow_walk_iterator *iterator,
			     struct kvm_vcpu *vcpu, u64 addr)
{
	iterator->addr = addr;
	iterator->shadow_addr = vcpu->arch.mmu.root_hpa;
	iterator->level = vcpu->arch.mmu.shadow_root_level;
2196 2197 2198 2199 2200 2201

	if (iterator->level == PT64_ROOT_LEVEL &&
	    vcpu->arch.mmu.root_level < PT64_ROOT_LEVEL &&
	    !vcpu->arch.mmu.direct_map)
		--iterator->level;

2202 2203 2204 2205 2206 2207 2208 2209 2210 2211 2212 2213 2214 2215
	if (iterator->level == PT32E_ROOT_LEVEL) {
		iterator->shadow_addr
			= vcpu->arch.mmu.pae_root[(addr >> 30) & 3];
		iterator->shadow_addr &= PT64_BASE_ADDR_MASK;
		--iterator->level;
		if (!iterator->shadow_addr)
			iterator->level = 0;
	}
}

static bool shadow_walk_okay(struct kvm_shadow_walk_iterator *iterator)
{
	if (iterator->level < PT_PAGE_TABLE_LEVEL)
		return false;
2216

2217 2218 2219 2220 2221
	iterator->index = SHADOW_PT_INDEX(iterator->addr, iterator->level);
	iterator->sptep	= ((u64 *)__va(iterator->shadow_addr)) + iterator->index;
	return true;
}

2222 2223
static void __shadow_walk_next(struct kvm_shadow_walk_iterator *iterator,
			       u64 spte)
2224
{
2225
	if (is_last_spte(spte, iterator->level)) {
2226 2227 2228 2229
		iterator->level = 0;
		return;
	}

2230
	iterator->shadow_addr = spte & PT64_BASE_ADDR_MASK;
2231 2232 2233
	--iterator->level;
}

2234 2235 2236 2237 2238
static void shadow_walk_next(struct kvm_shadow_walk_iterator *iterator)
{
	return __shadow_walk_next(iterator, *iterator->sptep);
}

2239 2240
static void link_shadow_page(struct kvm_vcpu *vcpu, u64 *sptep,
			     struct kvm_mmu_page *sp)
2241 2242 2243
{
	u64 spte;

2244 2245 2246
	BUILD_BUG_ON(VMX_EPT_READABLE_MASK != PT_PRESENT_MASK ||
			VMX_EPT_WRITABLE_MASK != PT_WRITABLE_MASK);

X
Xiao Guangrong 已提交
2247
	spte = __pa(sp->spt) | PT_PRESENT_MASK | PT_WRITABLE_MASK |
2248
	       shadow_user_mask | shadow_x_mask | shadow_accessed_mask;
X
Xiao Guangrong 已提交
2249

2250
	mmu_spte_set(sptep, spte);
2251 2252 2253 2254 2255

	mmu_page_add_parent_pte(vcpu, sp, sptep);

	if (sp->unsync_children || sp->unsync)
		mark_unsync(sptep);
2256 2257
}

2258 2259 2260 2261 2262 2263 2264 2265 2266 2267 2268 2269 2270 2271 2272 2273 2274
static void validate_direct_spte(struct kvm_vcpu *vcpu, u64 *sptep,
				   unsigned direct_access)
{
	if (is_shadow_present_pte(*sptep) && !is_large_pte(*sptep)) {
		struct kvm_mmu_page *child;

		/*
		 * For the direct sp, if the guest pte's dirty bit
		 * changed form clean to dirty, it will corrupt the
		 * sp's access: allow writable in the read-only sp,
		 * so we should update the spte at this point to get
		 * a new sp with the correct access.
		 */
		child = page_header(*sptep & PT64_BASE_ADDR_MASK);
		if (child->role.access == direct_access)
			return;

2275
		drop_parent_pte(child, sptep);
2276 2277 2278 2279
		kvm_flush_remote_tlbs(vcpu->kvm);
	}
}

X
Xiao Guangrong 已提交
2280
static bool mmu_page_zap_pte(struct kvm *kvm, struct kvm_mmu_page *sp,
2281 2282 2283 2284 2285 2286 2287
			     u64 *spte)
{
	u64 pte;
	struct kvm_mmu_page *child;

	pte = *spte;
	if (is_shadow_present_pte(pte)) {
X
Xiao Guangrong 已提交
2288
		if (is_last_spte(pte, sp->role.level)) {
2289
			drop_spte(kvm, spte);
X
Xiao Guangrong 已提交
2290 2291 2292
			if (is_large_pte(pte))
				--kvm->stat.lpages;
		} else {
2293
			child = page_header(pte & PT64_BASE_ADDR_MASK);
2294
			drop_parent_pte(child, spte);
2295
		}
X
Xiao Guangrong 已提交
2296 2297 2298 2299
		return true;
	}

	if (is_mmio_spte(pte))
2300
		mmu_spte_clear_no_track(spte);
2301

X
Xiao Guangrong 已提交
2302
	return false;
2303 2304
}

2305
static void kvm_mmu_page_unlink_children(struct kvm *kvm,
2306
					 struct kvm_mmu_page *sp)
2307
{
2308 2309
	unsigned i;

2310 2311
	for (i = 0; i < PT64_ENT_PER_PAGE; ++i)
		mmu_page_zap_pte(kvm, sp, sp->spt + i);
2312 2313
}

2314
static void kvm_mmu_unlink_parents(struct kvm *kvm, struct kvm_mmu_page *sp)
2315
{
2316 2317
	u64 *sptep;
	struct rmap_iterator iter;
2318

2319
	while ((sptep = rmap_get_first(&sp->parent_ptes, &iter)))
2320
		drop_parent_pte(sp, sptep);
2321 2322
}

2323
static int mmu_zap_unsync_children(struct kvm *kvm,
2324 2325
				   struct kvm_mmu_page *parent,
				   struct list_head *invalid_list)
2326
{
2327 2328 2329
	int i, zapped = 0;
	struct mmu_page_path parents;
	struct kvm_mmu_pages pages;
2330

2331
	if (parent->role.level == PT_PAGE_TABLE_LEVEL)
2332
		return 0;
2333 2334 2335 2336 2337

	while (mmu_unsync_walk(parent, &pages)) {
		struct kvm_mmu_page *sp;

		for_each_sp(pages, sp, parents, i) {
2338
			kvm_mmu_prepare_zap_page(kvm, sp, invalid_list);
2339
			mmu_pages_clear_parents(&parents);
2340
			zapped++;
2341 2342 2343 2344
		}
	}

	return zapped;
2345 2346
}

2347 2348
static int kvm_mmu_prepare_zap_page(struct kvm *kvm, struct kvm_mmu_page *sp,
				    struct list_head *invalid_list)
2349
{
2350
	int ret;
A
Avi Kivity 已提交
2351

2352
	trace_kvm_mmu_prepare_zap_page(sp);
2353
	++kvm->stat.mmu_shadow_zapped;
2354
	ret = mmu_zap_unsync_children(kvm, sp, invalid_list);
2355
	kvm_mmu_page_unlink_children(kvm, sp);
2356
	kvm_mmu_unlink_parents(kvm, sp);
2357

2358
	if (!sp->role.invalid && !sp->role.direct)
2359
		unaccount_shadowed(kvm, sp);
2360

2361 2362
	if (sp->unsync)
		kvm_unlink_unsync_page(kvm, sp);
2363
	if (!sp->root_count) {
2364 2365
		/* Count self */
		ret++;
2366
		list_move(&sp->link, invalid_list);
2367
		kvm_mod_used_mmu_pages(kvm, -1);
2368
	} else {
A
Avi Kivity 已提交
2369
		list_move(&sp->link, &kvm->arch.active_mmu_pages);
2370 2371 2372 2373 2374 2375 2376

		/*
		 * The obsolete pages can not be used on any vcpus.
		 * See the comments in kvm_mmu_invalidate_zap_all_pages().
		 */
		if (!sp->role.invalid && !is_obsolete_sp(kvm, sp))
			kvm_reload_remote_mmus(kvm);
2377
	}
2378 2379

	sp->role.invalid = 1;
2380
	return ret;
2381 2382
}

2383 2384 2385
static void kvm_mmu_commit_zap_page(struct kvm *kvm,
				    struct list_head *invalid_list)
{
2386
	struct kvm_mmu_page *sp, *nsp;
2387 2388 2389 2390

	if (list_empty(invalid_list))
		return;

2391
	/*
2392 2393 2394 2395 2396 2397 2398
	 * We need to make sure everyone sees our modifications to
	 * the page tables and see changes to vcpu->mode here. The barrier
	 * in the kvm_flush_remote_tlbs() achieves this. This pairs
	 * with vcpu_enter_guest and walk_shadow_page_lockless_begin/end.
	 *
	 * In addition, kvm_flush_remote_tlbs waits for all vcpus to exit
	 * guest mode and/or lockless shadow page table walks.
2399 2400
	 */
	kvm_flush_remote_tlbs(kvm);
2401

2402
	list_for_each_entry_safe(sp, nsp, invalid_list, link) {
2403
		WARN_ON(!sp->role.invalid || sp->root_count);
2404
		kvm_mmu_free_page(sp);
2405
	}
2406 2407
}

2408 2409 2410 2411 2412 2413 2414 2415
static bool prepare_zap_oldest_mmu_page(struct kvm *kvm,
					struct list_head *invalid_list)
{
	struct kvm_mmu_page *sp;

	if (list_empty(&kvm->arch.active_mmu_pages))
		return false;

G
Geliang Tang 已提交
2416 2417
	sp = list_last_entry(&kvm->arch.active_mmu_pages,
			     struct kvm_mmu_page, link);
2418 2419 2420 2421 2422
	kvm_mmu_prepare_zap_page(kvm, sp, invalid_list);

	return true;
}

2423 2424
/*
 * Changing the number of mmu pages allocated to the vm
2425
 * Note: if goal_nr_mmu_pages is too small, you will get dead lock
2426
 */
2427
void kvm_mmu_change_mmu_pages(struct kvm *kvm, unsigned int goal_nr_mmu_pages)
2428
{
2429
	LIST_HEAD(invalid_list);
2430

2431 2432
	spin_lock(&kvm->mmu_lock);

2433
	if (kvm->arch.n_used_mmu_pages > goal_nr_mmu_pages) {
2434 2435 2436 2437
		/* Need to free some mmu pages to achieve the goal. */
		while (kvm->arch.n_used_mmu_pages > goal_nr_mmu_pages)
			if (!prepare_zap_oldest_mmu_page(kvm, &invalid_list))
				break;
2438

2439
		kvm_mmu_commit_zap_page(kvm, &invalid_list);
2440
		goal_nr_mmu_pages = kvm->arch.n_used_mmu_pages;
2441 2442
	}

2443
	kvm->arch.n_max_mmu_pages = goal_nr_mmu_pages;
2444 2445

	spin_unlock(&kvm->mmu_lock);
2446 2447
}

2448
int kvm_mmu_unprotect_page(struct kvm *kvm, gfn_t gfn)
2449
{
2450
	struct kvm_mmu_page *sp;
2451
	LIST_HEAD(invalid_list);
2452 2453
	int r;

2454
	pgprintk("%s: looking for gfn %llx\n", __func__, gfn);
2455
	r = 0;
2456
	spin_lock(&kvm->mmu_lock);
2457
	for_each_gfn_indirect_valid_sp(kvm, sp, gfn) {
2458
		pgprintk("%s: gfn %llx role %x\n", __func__, gfn,
2459 2460
			 sp->role.word);
		r = 1;
2461
		kvm_mmu_prepare_zap_page(kvm, sp, &invalid_list);
2462
	}
2463
	kvm_mmu_commit_zap_page(kvm, &invalid_list);
2464 2465
	spin_unlock(&kvm->mmu_lock);

2466
	return r;
2467
}
2468
EXPORT_SYMBOL_GPL(kvm_mmu_unprotect_page);
2469

2470
static void kvm_unsync_page(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp)
2471 2472 2473 2474 2475 2476 2477 2478
{
	trace_kvm_mmu_unsync_page(sp);
	++vcpu->kvm->stat.mmu_unsync;
	sp->unsync = 1;

	kvm_mmu_mark_parents_unsync(sp);
}

2479 2480
static bool mmu_need_write_protect(struct kvm_vcpu *vcpu, gfn_t gfn,
				   bool can_unsync)
2481
{
2482
	struct kvm_mmu_page *sp;
2483

2484 2485
	if (kvm_page_track_is_active(vcpu, gfn, KVM_PAGE_TRACK_WRITE))
		return true;
2486

2487
	for_each_gfn_indirect_valid_sp(vcpu->kvm, sp, gfn) {
2488
		if (!can_unsync)
2489
			return true;
2490

2491 2492
		if (sp->unsync)
			continue;
2493

2494 2495
		WARN_ON(sp->role.level != PT_PAGE_TABLE_LEVEL);
		kvm_unsync_page(vcpu, sp);
2496
	}
2497 2498

	return false;
2499 2500
}

D
Dan Williams 已提交
2501
static bool kvm_is_mmio_pfn(kvm_pfn_t pfn)
2502 2503 2504 2505 2506 2507 2508
{
	if (pfn_valid(pfn))
		return !is_zero_pfn(pfn) && PageReserved(pfn_to_page(pfn));

	return true;
}

A
Avi Kivity 已提交
2509
static int set_spte(struct kvm_vcpu *vcpu, u64 *sptep,
2510
		    unsigned pte_access, int level,
D
Dan Williams 已提交
2511
		    gfn_t gfn, kvm_pfn_t pfn, bool speculative,
2512
		    bool can_unsync, bool host_writable)
2513
{
2514
	u64 spte;
M
Marcelo Tosatti 已提交
2515
	int ret = 0;
S
Sheng Yang 已提交
2516

2517
	if (set_mmio_spte(vcpu, sptep, gfn, pfn, pte_access))
2518 2519
		return 0;

2520
	spte = PT_PRESENT_MASK;
2521
	if (!speculative)
2522
		spte |= shadow_accessed_mask;
2523

S
Sheng Yang 已提交
2524 2525 2526 2527
	if (pte_access & ACC_EXEC_MASK)
		spte |= shadow_x_mask;
	else
		spte |= shadow_nx_mask;
2528

2529
	if (pte_access & ACC_USER_MASK)
S
Sheng Yang 已提交
2530
		spte |= shadow_user_mask;
2531

2532
	if (level > PT_PAGE_TABLE_LEVEL)
M
Marcelo Tosatti 已提交
2533
		spte |= PT_PAGE_SIZE_MASK;
2534
	if (tdp_enabled)
2535
		spte |= kvm_x86_ops->get_mt_mask(vcpu, gfn,
2536
			kvm_is_mmio_pfn(pfn));
2537

2538
	if (host_writable)
2539
		spte |= SPTE_HOST_WRITEABLE;
2540 2541
	else
		pte_access &= ~ACC_WRITE_MASK;
2542

2543
	spte |= (u64)pfn << PAGE_SHIFT;
2544

2545
	if (pte_access & ACC_WRITE_MASK) {
2546

X
Xiao Guangrong 已提交
2547
		/*
2548 2549 2550 2551
		 * Other vcpu creates new sp in the window between
		 * mapping_level() and acquiring mmu-lock. We can
		 * allow guest to retry the access, the mapping can
		 * be fixed if guest refault.
X
Xiao Guangrong 已提交
2552
		 */
2553
		if (level > PT_PAGE_TABLE_LEVEL &&
2554
		    mmu_gfn_lpage_is_disallowed(vcpu, gfn, level))
A
Avi Kivity 已提交
2555
			goto done;
2556

2557
		spte |= PT_WRITABLE_MASK | SPTE_MMU_WRITEABLE;
2558

2559 2560 2561 2562 2563 2564
		/*
		 * Optimization: for pte sync, if spte was writable the hash
		 * lookup is unnecessary (and expensive). Write protection
		 * is responsibility of mmu_get_page / kvm_sync_page.
		 * Same reasoning can be applied to dirty page accounting.
		 */
2565
		if (!can_unsync && is_writable_pte(*sptep))
2566 2567
			goto set_pte;

2568
		if (mmu_need_write_protect(vcpu, gfn, can_unsync)) {
2569
			pgprintk("%s: found shadow page for %llx, marking ro\n",
2570
				 __func__, gfn);
M
Marcelo Tosatti 已提交
2571
			ret = 1;
2572
			pte_access &= ~ACC_WRITE_MASK;
2573
			spte &= ~(PT_WRITABLE_MASK | SPTE_MMU_WRITEABLE);
2574 2575 2576
		}
	}

2577
	if (pte_access & ACC_WRITE_MASK) {
2578
		kvm_vcpu_mark_page_dirty(vcpu, gfn);
2579 2580
		spte |= shadow_dirty_mask;
	}
2581

2582
set_pte:
2583
	if (mmu_spte_update(sptep, spte))
2584
		kvm_flush_remote_tlbs(vcpu->kvm);
A
Avi Kivity 已提交
2585
done:
M
Marcelo Tosatti 已提交
2586 2587 2588
	return ret;
}

2589
static bool mmu_set_spte(struct kvm_vcpu *vcpu, u64 *sptep, unsigned pte_access,
D
Dan Williams 已提交
2590
			 int write_fault, int level, gfn_t gfn, kvm_pfn_t pfn,
2591
			 bool speculative, bool host_writable)
M
Marcelo Tosatti 已提交
2592 2593
{
	int was_rmapped = 0;
2594
	int rmap_count;
2595
	bool emulate = false;
M
Marcelo Tosatti 已提交
2596

2597 2598
	pgprintk("%s: spte %llx write_fault %d gfn %llx\n", __func__,
		 *sptep, write_fault, gfn);
M
Marcelo Tosatti 已提交
2599

2600
	if (is_shadow_present_pte(*sptep)) {
M
Marcelo Tosatti 已提交
2601 2602 2603 2604
		/*
		 * If we overwrite a PTE page pointer with a 2MB PMD, unlink
		 * the parent of the now unreachable PTE.
		 */
2605 2606
		if (level > PT_PAGE_TABLE_LEVEL &&
		    !is_large_pte(*sptep)) {
M
Marcelo Tosatti 已提交
2607
			struct kvm_mmu_page *child;
A
Avi Kivity 已提交
2608
			u64 pte = *sptep;
M
Marcelo Tosatti 已提交
2609 2610

			child = page_header(pte & PT64_BASE_ADDR_MASK);
2611
			drop_parent_pte(child, sptep);
2612
			kvm_flush_remote_tlbs(vcpu->kvm);
A
Avi Kivity 已提交
2613
		} else if (pfn != spte_to_pfn(*sptep)) {
2614
			pgprintk("hfn old %llx new %llx\n",
A
Avi Kivity 已提交
2615
				 spte_to_pfn(*sptep), pfn);
2616
			drop_spte(vcpu->kvm, sptep);
2617
			kvm_flush_remote_tlbs(vcpu->kvm);
2618 2619
		} else
			was_rmapped = 1;
M
Marcelo Tosatti 已提交
2620
	}
2621

2622 2623
	if (set_spte(vcpu, sptep, pte_access, level, gfn, pfn, speculative,
	      true, host_writable)) {
M
Marcelo Tosatti 已提交
2624
		if (write_fault)
2625
			emulate = true;
2626
		kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu);
2627
	}
M
Marcelo Tosatti 已提交
2628

2629 2630
	if (unlikely(is_mmio_spte(*sptep)))
		emulate = true;
2631

A
Avi Kivity 已提交
2632
	pgprintk("%s: setting spte %llx\n", __func__, *sptep);
2633
	pgprintk("instantiating %s PTE (%s) at %llx (%llx) addr %p\n",
A
Avi Kivity 已提交
2634
		 is_large_pte(*sptep)? "2MB" : "4kB",
2635 2636
		 *sptep & PT_PRESENT_MASK ?"RW":"R", gfn,
		 *sptep, sptep);
A
Avi Kivity 已提交
2637
	if (!was_rmapped && is_large_pte(*sptep))
M
Marcelo Tosatti 已提交
2638 2639
		++vcpu->kvm->stat.lpages;

2640 2641 2642 2643 2644 2645
	if (is_shadow_present_pte(*sptep)) {
		if (!was_rmapped) {
			rmap_count = rmap_add(vcpu, sptep, gfn);
			if (rmap_count > RMAP_RECYCLE_THRESHOLD)
				rmap_recycle(vcpu, sptep, gfn);
		}
2646
	}
2647

X
Xiao Guangrong 已提交
2648
	kvm_release_pfn_clean(pfn);
2649 2650

	return emulate;
2651 2652
}

D
Dan Williams 已提交
2653
static kvm_pfn_t pte_prefetch_gfn_to_pfn(struct kvm_vcpu *vcpu, gfn_t gfn,
2654 2655 2656 2657
				     bool no_dirty_log)
{
	struct kvm_memory_slot *slot;

2658
	slot = gfn_to_memslot_dirty_bitmap(vcpu, gfn, no_dirty_log);
2659
	if (!slot)
2660
		return KVM_PFN_ERR_FAULT;
2661

2662
	return gfn_to_pfn_memslot_atomic(slot, gfn);
2663 2664 2665 2666 2667 2668 2669
}

static int direct_pte_prefetch_many(struct kvm_vcpu *vcpu,
				    struct kvm_mmu_page *sp,
				    u64 *start, u64 *end)
{
	struct page *pages[PTE_PREFETCH_NUM];
2670
	struct kvm_memory_slot *slot;
2671 2672 2673 2674 2675
	unsigned access = sp->role.access;
	int i, ret;
	gfn_t gfn;

	gfn = kvm_mmu_page_get_gfn(sp, start - sp->spt);
2676 2677
	slot = gfn_to_memslot_dirty_bitmap(vcpu, gfn, access & ACC_WRITE_MASK);
	if (!slot)
2678 2679
		return -1;

2680
	ret = gfn_to_page_many_atomic(slot, gfn, pages, end - start);
2681 2682 2683 2684
	if (ret <= 0)
		return -1;

	for (i = 0; i < ret; i++, gfn++, start++)
2685 2686
		mmu_set_spte(vcpu, start, access, 0, sp->role.level, gfn,
			     page_to_pfn(pages[i]), true, true);
2687 2688 2689 2690 2691 2692 2693 2694 2695 2696 2697 2698 2699 2700 2701 2702

	return 0;
}

static void __direct_pte_prefetch(struct kvm_vcpu *vcpu,
				  struct kvm_mmu_page *sp, u64 *sptep)
{
	u64 *spte, *start = NULL;
	int i;

	WARN_ON(!sp->role.direct);

	i = (sptep - sp->spt) & ~(PTE_PREFETCH_NUM - 1);
	spte = sp->spt + i;

	for (i = 0; i < PTE_PREFETCH_NUM; i++, spte++) {
2703
		if (is_shadow_present_pte(*spte) || spte == sptep) {
2704 2705 2706 2707 2708 2709 2710 2711 2712 2713 2714 2715 2716 2717 2718 2719 2720 2721 2722 2723 2724 2725 2726 2727 2728 2729 2730 2731 2732 2733
			if (!start)
				continue;
			if (direct_pte_prefetch_many(vcpu, sp, start, spte) < 0)
				break;
			start = NULL;
		} else if (!start)
			start = spte;
	}
}

static void direct_pte_prefetch(struct kvm_vcpu *vcpu, u64 *sptep)
{
	struct kvm_mmu_page *sp;

	/*
	 * Since it's no accessed bit on EPT, it's no way to
	 * distinguish between actually accessed translations
	 * and prefetched, so disable pte prefetch if EPT is
	 * enabled.
	 */
	if (!shadow_accessed_mask)
		return;

	sp = page_header(__pa(sptep));
	if (sp->role.level > PT_PAGE_TABLE_LEVEL)
		return;

	__direct_pte_prefetch(vcpu, sp, sptep);
}

2734
static int __direct_map(struct kvm_vcpu *vcpu, int write, int map_writable,
D
Dan Williams 已提交
2735
			int level, gfn_t gfn, kvm_pfn_t pfn, bool prefault)
2736
{
2737
	struct kvm_shadow_walk_iterator iterator;
2738
	struct kvm_mmu_page *sp;
2739
	int emulate = 0;
2740
	gfn_t pseudo_gfn;
A
Avi Kivity 已提交
2741

2742 2743 2744
	if (!VALID_PAGE(vcpu->arch.mmu.root_hpa))
		return 0;

2745
	for_each_shadow_entry(vcpu, (u64)gfn << PAGE_SHIFT, iterator) {
2746
		if (iterator.level == level) {
2747 2748 2749
			emulate = mmu_set_spte(vcpu, iterator.sptep, ACC_ALL,
					       write, level, gfn, pfn, prefault,
					       map_writable);
2750
			direct_pte_prefetch(vcpu, iterator.sptep);
2751 2752
			++vcpu->stat.pf_fixed;
			break;
A
Avi Kivity 已提交
2753 2754
		}

2755
		drop_large_spte(vcpu, iterator.sptep);
2756
		if (!is_shadow_present_pte(*iterator.sptep)) {
2757 2758 2759 2760
			u64 base_addr = iterator.addr;

			base_addr &= PT64_LVL_ADDR_MASK(iterator.level);
			pseudo_gfn = base_addr >> PAGE_SHIFT;
2761
			sp = kvm_mmu_get_page(vcpu, pseudo_gfn, iterator.addr,
2762
					      iterator.level - 1, 1, ACC_ALL);
2763

2764
			link_shadow_page(vcpu, iterator.sptep, sp);
2765 2766
		}
	}
2767
	return emulate;
A
Avi Kivity 已提交
2768 2769
}

H
Huang Ying 已提交
2770
static void kvm_send_hwpoison_signal(unsigned long address, struct task_struct *tsk)
2771
{
H
Huang Ying 已提交
2772 2773 2774 2775 2776 2777 2778
	siginfo_t info;

	info.si_signo	= SIGBUS;
	info.si_errno	= 0;
	info.si_code	= BUS_MCEERR_AR;
	info.si_addr	= (void __user *)address;
	info.si_addr_lsb = PAGE_SHIFT;
2779

H
Huang Ying 已提交
2780
	send_sig_info(SIGBUS, &info, tsk);
2781 2782
}

D
Dan Williams 已提交
2783
static int kvm_handle_bad_page(struct kvm_vcpu *vcpu, gfn_t gfn, kvm_pfn_t pfn)
2784
{
X
Xiao Guangrong 已提交
2785 2786 2787 2788 2789 2790 2791 2792 2793
	/*
	 * Do not cache the mmio info caused by writing the readonly gfn
	 * into the spte otherwise read access on readonly gfn also can
	 * caused mmio page fault and treat it as mmio access.
	 * Return 1 to tell kvm to emulate it.
	 */
	if (pfn == KVM_PFN_ERR_RO_FAULT)
		return 1;

2794
	if (pfn == KVM_PFN_ERR_HWPOISON) {
2795
		kvm_send_hwpoison_signal(kvm_vcpu_gfn_to_hva(vcpu, gfn), current);
2796
		return 0;
2797
	}
2798

2799
	return -EFAULT;
2800 2801
}

2802
static void transparent_hugepage_adjust(struct kvm_vcpu *vcpu,
D
Dan Williams 已提交
2803 2804
					gfn_t *gfnp, kvm_pfn_t *pfnp,
					int *levelp)
2805
{
D
Dan Williams 已提交
2806
	kvm_pfn_t pfn = *pfnp;
2807 2808 2809 2810 2811 2812 2813 2814 2815
	gfn_t gfn = *gfnp;
	int level = *levelp;

	/*
	 * Check if it's a transparent hugepage. If this would be an
	 * hugetlbfs page, level wouldn't be set to
	 * PT_PAGE_TABLE_LEVEL and there would be no adjustment done
	 * here.
	 */
2816
	if (!is_error_noslot_pfn(pfn) && !kvm_is_reserved_pfn(pfn) &&
2817 2818
	    level == PT_PAGE_TABLE_LEVEL &&
	    PageTransCompound(pfn_to_page(pfn)) &&
2819
	    !mmu_gfn_lpage_is_disallowed(vcpu, gfn, PT_DIRECTORY_LEVEL)) {
2820 2821 2822 2823 2824 2825 2826 2827 2828 2829 2830 2831 2832 2833 2834 2835 2836 2837
		unsigned long mask;
		/*
		 * mmu_notifier_retry was successful and we hold the
		 * mmu_lock here, so the pmd can't become splitting
		 * from under us, and in turn
		 * __split_huge_page_refcount() can't run from under
		 * us and we can safely transfer the refcount from
		 * PG_tail to PG_head as we switch the pfn to tail to
		 * head.
		 */
		*levelp = level = PT_DIRECTORY_LEVEL;
		mask = KVM_PAGES_PER_HPAGE(level) - 1;
		VM_BUG_ON((gfn & mask) != (pfn & mask));
		if (pfn & mask) {
			gfn &= ~mask;
			*gfnp = gfn;
			kvm_release_pfn_clean(pfn);
			pfn &= ~mask;
2838
			kvm_get_pfn(pfn);
2839 2840 2841 2842 2843
			*pfnp = pfn;
		}
	}
}

2844
static bool handle_abnormal_pfn(struct kvm_vcpu *vcpu, gva_t gva, gfn_t gfn,
D
Dan Williams 已提交
2845
				kvm_pfn_t pfn, unsigned access, int *ret_val)
2846 2847
{
	/* The pfn is invalid, report the error! */
2848
	if (unlikely(is_error_pfn(pfn))) {
2849
		*ret_val = kvm_handle_bad_page(vcpu, gfn, pfn);
2850
		return true;
2851 2852
	}

2853
	if (unlikely(is_noslot_pfn(pfn)))
2854 2855
		vcpu_cache_mmio_info(vcpu, gva, gfn, access);

2856
	return false;
2857 2858
}

2859
static bool page_fault_can_be_fast(u32 error_code)
2860
{
2861 2862 2863 2864 2865 2866 2867
	/*
	 * Do not fix the mmio spte with invalid generation number which
	 * need to be updated by slow page fault path.
	 */
	if (unlikely(error_code & PFERR_RSVD_MASK))
		return false;

2868 2869 2870 2871 2872 2873 2874 2875 2876 2877 2878 2879 2880
	/*
	 * #PF can be fast only if the shadow page table is present and it
	 * is caused by write-protect, that means we just need change the
	 * W bit of the spte which can be done out of mmu-lock.
	 */
	if (!(error_code & PFERR_PRESENT_MASK) ||
	      !(error_code & PFERR_WRITE_MASK))
		return false;

	return true;
}

static bool
2881 2882
fast_pf_fix_direct_spte(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp,
			u64 *sptep, u64 spte)
2883 2884 2885 2886 2887 2888 2889 2890 2891 2892 2893
{
	gfn_t gfn;

	WARN_ON(!sp->role.direct);

	/*
	 * The gfn of direct spte is stable since it is calculated
	 * by sp->gfn.
	 */
	gfn = kvm_mmu_page_get_gfn(sp, sptep - sp->spt);

2894 2895 2896 2897 2898 2899 2900 2901 2902 2903 2904 2905
	/*
	 * Theoretically we could also set dirty bit (and flush TLB) here in
	 * order to eliminate unnecessary PML logging. See comments in
	 * set_spte. But fast_page_fault is very unlikely to happen with PML
	 * enabled, so we do not do this. This might result in the same GPA
	 * to be logged in PML buffer again when the write really happens, and
	 * eventually to be called by mark_page_dirty twice. But it's also no
	 * harm. This also avoids the TLB flush needed after setting dirty bit
	 * so non-PML cases won't be impacted.
	 *
	 * Compare with set_spte where instead shadow_dirty_mask is set.
	 */
2906
	if (cmpxchg64(sptep, spte, spte | PT_WRITABLE_MASK) == spte)
2907
		kvm_vcpu_mark_page_dirty(vcpu, gfn);
2908 2909 2910 2911 2912 2913 2914 2915 2916 2917 2918 2919 2920

	return true;
}

/*
 * Return value:
 * - true: let the vcpu to access on the same address again.
 * - false: let the real page fault path to fix it.
 */
static bool fast_page_fault(struct kvm_vcpu *vcpu, gva_t gva, int level,
			    u32 error_code)
{
	struct kvm_shadow_walk_iterator iterator;
2921
	struct kvm_mmu_page *sp;
2922 2923 2924
	bool ret = false;
	u64 spte = 0ull;

2925 2926 2927
	if (!VALID_PAGE(vcpu->arch.mmu.root_hpa))
		return false;

2928
	if (!page_fault_can_be_fast(error_code))
2929 2930 2931 2932 2933 2934 2935 2936 2937 2938 2939
		return false;

	walk_shadow_page_lockless_begin(vcpu);
	for_each_shadow_entry_lockless(vcpu, gva, iterator, spte)
		if (!is_shadow_present_pte(spte) || iterator.level < level)
			break;

	/*
	 * If the mapping has been changed, let the vcpu fault on the
	 * same address again.
	 */
2940
	if (!is_shadow_present_pte(spte)) {
2941 2942 2943 2944
		ret = true;
		goto exit;
	}

2945 2946
	sp = page_header(__pa(iterator.sptep));
	if (!is_last_spte(spte, sp->role.level))
2947 2948 2949 2950 2951 2952 2953 2954 2955 2956 2957 2958 2959 2960 2961 2962 2963 2964 2965 2966
		goto exit;

	/*
	 * Check if it is a spurious fault caused by TLB lazily flushed.
	 *
	 * Need not check the access of upper level table entries since
	 * they are always ACC_ALL.
	 */
	 if (is_writable_pte(spte)) {
		ret = true;
		goto exit;
	}

	/*
	 * Currently, to simplify the code, only the spte write-protected
	 * by dirty-log can be fast fixed.
	 */
	if (!spte_is_locklessly_modifiable(spte))
		goto exit;

2967 2968 2969 2970 2971 2972 2973 2974 2975 2976 2977 2978 2979
	/*
	 * Do not fix write-permission on the large spte since we only dirty
	 * the first page into the dirty-bitmap in fast_pf_fix_direct_spte()
	 * that means other pages are missed if its slot is dirty-logged.
	 *
	 * Instead, we let the slow page fault path create a normal spte to
	 * fix the access.
	 *
	 * See the comments in kvm_arch_commit_memory_region().
	 */
	if (sp->role.level > PT_PAGE_TABLE_LEVEL)
		goto exit;

2980 2981 2982 2983 2984
	/*
	 * Currently, fast page fault only works for direct mapping since
	 * the gfn is not stable for indirect shadow page.
	 * See Documentation/virtual/kvm/locking.txt to get more detail.
	 */
2985
	ret = fast_pf_fix_direct_spte(vcpu, sp, iterator.sptep, spte);
2986
exit:
X
Xiao Guangrong 已提交
2987 2988
	trace_fast_page_fault(vcpu, gva, error_code, iterator.sptep,
			      spte, ret);
2989 2990 2991 2992 2993
	walk_shadow_page_lockless_end(vcpu);

	return ret;
}

2994
static bool try_async_pf(struct kvm_vcpu *vcpu, bool prefault, gfn_t gfn,
D
Dan Williams 已提交
2995
			 gva_t gva, kvm_pfn_t *pfn, bool write, bool *writable);
2996
static void make_mmu_pages_available(struct kvm_vcpu *vcpu);
2997

2998 2999
static int nonpaging_map(struct kvm_vcpu *vcpu, gva_t v, u32 error_code,
			 gfn_t gfn, bool prefault)
3000 3001
{
	int r;
3002
	int level;
3003
	bool force_pt_level = false;
D
Dan Williams 已提交
3004
	kvm_pfn_t pfn;
3005
	unsigned long mmu_seq;
3006
	bool map_writable, write = error_code & PFERR_WRITE_MASK;
3007

3008
	level = mapping_level(vcpu, gfn, &force_pt_level);
3009 3010 3011 3012 3013 3014 3015 3016
	if (likely(!force_pt_level)) {
		/*
		 * This path builds a PAE pagetable - so we can map
		 * 2mb pages at maximum. Therefore check if the level
		 * is larger than that.
		 */
		if (level > PT_DIRECTORY_LEVEL)
			level = PT_DIRECTORY_LEVEL;
3017

3018
		gfn &= ~(KVM_PAGES_PER_HPAGE(level) - 1);
3019
	}
M
Marcelo Tosatti 已提交
3020

3021 3022 3023
	if (fast_page_fault(vcpu, v, level, error_code))
		return 0;

3024
	mmu_seq = vcpu->kvm->mmu_notifier_seq;
3025
	smp_rmb();
3026

3027
	if (try_async_pf(vcpu, prefault, gfn, v, &pfn, write, &map_writable))
3028
		return 0;
3029

3030 3031
	if (handle_abnormal_pfn(vcpu, v, gfn, pfn, ACC_ALL, &r))
		return r;
3032

3033
	spin_lock(&vcpu->kvm->mmu_lock);
3034
	if (mmu_notifier_retry(vcpu->kvm, mmu_seq))
3035
		goto out_unlock;
3036
	make_mmu_pages_available(vcpu);
3037 3038
	if (likely(!force_pt_level))
		transparent_hugepage_adjust(vcpu, &gfn, &pfn, &level);
3039
	r = __direct_map(vcpu, write, map_writable, level, gfn, pfn, prefault);
3040 3041
	spin_unlock(&vcpu->kvm->mmu_lock);

3042
	return r;
3043 3044 3045 3046 3047

out_unlock:
	spin_unlock(&vcpu->kvm->mmu_lock);
	kvm_release_pfn_clean(pfn);
	return 0;
3048 3049 3050
}


3051 3052 3053
static void mmu_free_roots(struct kvm_vcpu *vcpu)
{
	int i;
3054
	struct kvm_mmu_page *sp;
3055
	LIST_HEAD(invalid_list);
3056

3057
	if (!VALID_PAGE(vcpu->arch.mmu.root_hpa))
A
Avi Kivity 已提交
3058
		return;
3059

3060 3061 3062
	if (vcpu->arch.mmu.shadow_root_level == PT64_ROOT_LEVEL &&
	    (vcpu->arch.mmu.root_level == PT64_ROOT_LEVEL ||
	     vcpu->arch.mmu.direct_map)) {
3063
		hpa_t root = vcpu->arch.mmu.root_hpa;
3064

3065
		spin_lock(&vcpu->kvm->mmu_lock);
3066 3067
		sp = page_header(root);
		--sp->root_count;
3068 3069 3070 3071
		if (!sp->root_count && sp->role.invalid) {
			kvm_mmu_prepare_zap_page(vcpu->kvm, sp, &invalid_list);
			kvm_mmu_commit_zap_page(vcpu->kvm, &invalid_list);
		}
3072
		spin_unlock(&vcpu->kvm->mmu_lock);
3073
		vcpu->arch.mmu.root_hpa = INVALID_PAGE;
3074 3075
		return;
	}
3076 3077

	spin_lock(&vcpu->kvm->mmu_lock);
3078
	for (i = 0; i < 4; ++i) {
3079
		hpa_t root = vcpu->arch.mmu.pae_root[i];
3080

A
Avi Kivity 已提交
3081 3082
		if (root) {
			root &= PT64_BASE_ADDR_MASK;
3083 3084
			sp = page_header(root);
			--sp->root_count;
3085
			if (!sp->root_count && sp->role.invalid)
3086 3087
				kvm_mmu_prepare_zap_page(vcpu->kvm, sp,
							 &invalid_list);
A
Avi Kivity 已提交
3088
		}
3089
		vcpu->arch.mmu.pae_root[i] = INVALID_PAGE;
3090
	}
3091
	kvm_mmu_commit_zap_page(vcpu->kvm, &invalid_list);
3092
	spin_unlock(&vcpu->kvm->mmu_lock);
3093
	vcpu->arch.mmu.root_hpa = INVALID_PAGE;
3094 3095
}

3096 3097 3098 3099 3100
static int mmu_check_root(struct kvm_vcpu *vcpu, gfn_t root_gfn)
{
	int ret = 0;

	if (!kvm_is_visible_gfn(vcpu->kvm, root_gfn)) {
3101
		kvm_make_request(KVM_REQ_TRIPLE_FAULT, vcpu);
3102 3103 3104 3105 3106 3107
		ret = 1;
	}

	return ret;
}

3108 3109 3110
static int mmu_alloc_direct_roots(struct kvm_vcpu *vcpu)
{
	struct kvm_mmu_page *sp;
3111
	unsigned i;
3112 3113 3114

	if (vcpu->arch.mmu.shadow_root_level == PT64_ROOT_LEVEL) {
		spin_lock(&vcpu->kvm->mmu_lock);
3115
		make_mmu_pages_available(vcpu);
3116
		sp = kvm_mmu_get_page(vcpu, 0, 0, PT64_ROOT_LEVEL, 1, ACC_ALL);
3117 3118 3119 3120 3121 3122 3123
		++sp->root_count;
		spin_unlock(&vcpu->kvm->mmu_lock);
		vcpu->arch.mmu.root_hpa = __pa(sp->spt);
	} else if (vcpu->arch.mmu.shadow_root_level == PT32E_ROOT_LEVEL) {
		for (i = 0; i < 4; ++i) {
			hpa_t root = vcpu->arch.mmu.pae_root[i];

3124
			MMU_WARN_ON(VALID_PAGE(root));
3125
			spin_lock(&vcpu->kvm->mmu_lock);
3126
			make_mmu_pages_available(vcpu);
3127
			sp = kvm_mmu_get_page(vcpu, i << (30 - PAGE_SHIFT),
3128
					i << 30, PT32_ROOT_LEVEL, 1, ACC_ALL);
3129 3130 3131 3132 3133
			root = __pa(sp->spt);
			++sp->root_count;
			spin_unlock(&vcpu->kvm->mmu_lock);
			vcpu->arch.mmu.pae_root[i] = root | PT_PRESENT_MASK;
		}
3134
		vcpu->arch.mmu.root_hpa = __pa(vcpu->arch.mmu.pae_root);
3135 3136 3137 3138 3139 3140 3141
	} else
		BUG();

	return 0;
}

static int mmu_alloc_shadow_roots(struct kvm_vcpu *vcpu)
3142
{
3143
	struct kvm_mmu_page *sp;
3144 3145 3146
	u64 pdptr, pm_mask;
	gfn_t root_gfn;
	int i;
3147

3148
	root_gfn = vcpu->arch.mmu.get_cr3(vcpu) >> PAGE_SHIFT;
3149

3150 3151 3152 3153 3154 3155 3156 3157
	if (mmu_check_root(vcpu, root_gfn))
		return 1;

	/*
	 * Do we shadow a long mode page table? If so we need to
	 * write-protect the guests page table root.
	 */
	if (vcpu->arch.mmu.root_level == PT64_ROOT_LEVEL) {
3158
		hpa_t root = vcpu->arch.mmu.root_hpa;
3159

3160
		MMU_WARN_ON(VALID_PAGE(root));
3161

3162
		spin_lock(&vcpu->kvm->mmu_lock);
3163
		make_mmu_pages_available(vcpu);
3164
		sp = kvm_mmu_get_page(vcpu, root_gfn, 0, PT64_ROOT_LEVEL,
3165
				      0, ACC_ALL);
3166 3167
		root = __pa(sp->spt);
		++sp->root_count;
3168
		spin_unlock(&vcpu->kvm->mmu_lock);
3169
		vcpu->arch.mmu.root_hpa = root;
3170
		return 0;
3171
	}
3172

3173 3174
	/*
	 * We shadow a 32 bit page table. This may be a legacy 2-level
3175 3176
	 * or a PAE 3-level page table. In either case we need to be aware that
	 * the shadow page table may be a PAE or a long mode page table.
3177
	 */
3178 3179 3180 3181
	pm_mask = PT_PRESENT_MASK;
	if (vcpu->arch.mmu.shadow_root_level == PT64_ROOT_LEVEL)
		pm_mask |= PT_ACCESSED_MASK | PT_WRITABLE_MASK | PT_USER_MASK;

3182
	for (i = 0; i < 4; ++i) {
3183
		hpa_t root = vcpu->arch.mmu.pae_root[i];
3184

3185
		MMU_WARN_ON(VALID_PAGE(root));
3186
		if (vcpu->arch.mmu.root_level == PT32E_ROOT_LEVEL) {
3187
			pdptr = vcpu->arch.mmu.get_pdptr(vcpu, i);
3188
			if (!is_present_gpte(pdptr)) {
3189
				vcpu->arch.mmu.pae_root[i] = 0;
A
Avi Kivity 已提交
3190 3191
				continue;
			}
A
Avi Kivity 已提交
3192
			root_gfn = pdptr >> PAGE_SHIFT;
3193 3194
			if (mmu_check_root(vcpu, root_gfn))
				return 1;
3195
		}
3196
		spin_lock(&vcpu->kvm->mmu_lock);
3197
		make_mmu_pages_available(vcpu);
3198 3199
		sp = kvm_mmu_get_page(vcpu, root_gfn, i << 30, PT32_ROOT_LEVEL,
				      0, ACC_ALL);
3200 3201
		root = __pa(sp->spt);
		++sp->root_count;
3202 3203
		spin_unlock(&vcpu->kvm->mmu_lock);

3204
		vcpu->arch.mmu.pae_root[i] = root | pm_mask;
3205
	}
3206
	vcpu->arch.mmu.root_hpa = __pa(vcpu->arch.mmu.pae_root);
3207 3208 3209 3210 3211 3212 3213 3214 3215 3216 3217 3218 3219 3220 3221 3222 3223 3224 3225 3226 3227 3228 3229 3230 3231 3232

	/*
	 * If we shadow a 32 bit page table with a long mode page
	 * table we enter this path.
	 */
	if (vcpu->arch.mmu.shadow_root_level == PT64_ROOT_LEVEL) {
		if (vcpu->arch.mmu.lm_root == NULL) {
			/*
			 * The additional page necessary for this is only
			 * allocated on demand.
			 */

			u64 *lm_root;

			lm_root = (void*)get_zeroed_page(GFP_KERNEL);
			if (lm_root == NULL)
				return 1;

			lm_root[0] = __pa(vcpu->arch.mmu.pae_root) | pm_mask;

			vcpu->arch.mmu.lm_root = lm_root;
		}

		vcpu->arch.mmu.root_hpa = __pa(vcpu->arch.mmu.lm_root);
	}

3233
	return 0;
3234 3235
}

3236 3237 3238 3239 3240 3241 3242 3243
static int mmu_alloc_roots(struct kvm_vcpu *vcpu)
{
	if (vcpu->arch.mmu.direct_map)
		return mmu_alloc_direct_roots(vcpu);
	else
		return mmu_alloc_shadow_roots(vcpu);
}

3244 3245 3246 3247 3248
static void mmu_sync_roots(struct kvm_vcpu *vcpu)
{
	int i;
	struct kvm_mmu_page *sp;

3249 3250 3251
	if (vcpu->arch.mmu.direct_map)
		return;

3252 3253
	if (!VALID_PAGE(vcpu->arch.mmu.root_hpa))
		return;
3254

3255
	vcpu_clear_mmio_info(vcpu, MMIO_GVA_ANY);
3256
	kvm_mmu_audit(vcpu, AUDIT_PRE_SYNC);
3257
	if (vcpu->arch.mmu.root_level == PT64_ROOT_LEVEL) {
3258 3259 3260
		hpa_t root = vcpu->arch.mmu.root_hpa;
		sp = page_header(root);
		mmu_sync_children(vcpu, sp);
3261
		kvm_mmu_audit(vcpu, AUDIT_POST_SYNC);
3262 3263 3264 3265 3266
		return;
	}
	for (i = 0; i < 4; ++i) {
		hpa_t root = vcpu->arch.mmu.pae_root[i];

3267
		if (root && VALID_PAGE(root)) {
3268 3269 3270 3271 3272
			root &= PT64_BASE_ADDR_MASK;
			sp = page_header(root);
			mmu_sync_children(vcpu, sp);
		}
	}
3273
	kvm_mmu_audit(vcpu, AUDIT_POST_SYNC);
3274 3275 3276 3277 3278 3279
}

void kvm_mmu_sync_roots(struct kvm_vcpu *vcpu)
{
	spin_lock(&vcpu->kvm->mmu_lock);
	mmu_sync_roots(vcpu);
3280
	spin_unlock(&vcpu->kvm->mmu_lock);
3281
}
N
Nadav Har'El 已提交
3282
EXPORT_SYMBOL_GPL(kvm_mmu_sync_roots);
3283

3284
static gpa_t nonpaging_gva_to_gpa(struct kvm_vcpu *vcpu, gva_t vaddr,
3285
				  u32 access, struct x86_exception *exception)
A
Avi Kivity 已提交
3286
{
3287 3288
	if (exception)
		exception->error_code = 0;
A
Avi Kivity 已提交
3289 3290 3291
	return vaddr;
}

3292
static gpa_t nonpaging_gva_to_gpa_nested(struct kvm_vcpu *vcpu, gva_t vaddr,
3293 3294
					 u32 access,
					 struct x86_exception *exception)
3295
{
3296 3297
	if (exception)
		exception->error_code = 0;
3298
	return vcpu->arch.nested_mmu.translate_gpa(vcpu, vaddr, access, exception);
3299 3300
}

3301 3302 3303 3304 3305 3306 3307 3308 3309 3310 3311 3312 3313 3314 3315 3316 3317 3318 3319
static bool
__is_rsvd_bits_set(struct rsvd_bits_validate *rsvd_check, u64 pte, int level)
{
	int bit7 = (pte >> 7) & 1, low6 = pte & 0x3f;

	return (pte & rsvd_check->rsvd_bits_mask[bit7][level-1]) |
		((rsvd_check->bad_mt_xwr & (1ull << low6)) != 0);
}

static bool is_rsvd_bits_set(struct kvm_mmu *mmu, u64 gpte, int level)
{
	return __is_rsvd_bits_set(&mmu->guest_rsvd_check, gpte, level);
}

static bool is_shadow_zero_bits_set(struct kvm_mmu *mmu, u64 spte, int level)
{
	return __is_rsvd_bits_set(&mmu->shadow_zero_check, spte, level);
}

3320
static bool mmio_info_in_cache(struct kvm_vcpu *vcpu, u64 addr, bool direct)
3321 3322 3323 3324 3325 3326 3327
{
	if (direct)
		return vcpu_match_mmio_gpa(vcpu, addr);

	return vcpu_match_mmio_gva(vcpu, addr);
}

3328 3329 3330
/* return true if reserved bit is detected on spte. */
static bool
walk_shadow_page_get_mmio_spte(struct kvm_vcpu *vcpu, u64 addr, u64 *sptep)
3331 3332
{
	struct kvm_shadow_walk_iterator iterator;
3333 3334 3335
	u64 sptes[PT64_ROOT_LEVEL], spte = 0ull;
	int root, leaf;
	bool reserved = false;
3336

3337
	if (!VALID_PAGE(vcpu->arch.mmu.root_hpa))
3338
		goto exit;
3339

3340
	walk_shadow_page_lockless_begin(vcpu);
3341

3342 3343
	for (shadow_walk_init(&iterator, vcpu, addr),
		 leaf = root = iterator.level;
3344 3345 3346 3347 3348
	     shadow_walk_okay(&iterator);
	     __shadow_walk_next(&iterator, spte)) {
		spte = mmu_spte_get_lockless(iterator.sptep);

		sptes[leaf - 1] = spte;
3349
		leaf--;
3350

3351 3352
		if (!is_shadow_present_pte(spte))
			break;
3353 3354

		reserved |= is_shadow_zero_bits_set(&vcpu->arch.mmu, spte,
3355
						    iterator.level);
3356 3357
	}

3358 3359
	walk_shadow_page_lockless_end(vcpu);

3360 3361 3362
	if (reserved) {
		pr_err("%s: detect reserved bits on spte, addr 0x%llx, dump hierarchy:\n",
		       __func__, addr);
3363
		while (root > leaf) {
3364 3365 3366 3367 3368 3369 3370 3371
			pr_err("------ spte 0x%llx level %d.\n",
			       sptes[root - 1], root);
			root--;
		}
	}
exit:
	*sptep = spte;
	return reserved;
3372 3373
}

3374
int handle_mmio_page_fault(struct kvm_vcpu *vcpu, u64 addr, bool direct)
3375 3376
{
	u64 spte;
3377
	bool reserved;
3378

3379
	if (mmio_info_in_cache(vcpu, addr, direct))
3380
		return RET_MMIO_PF_EMULATE;
3381

3382
	reserved = walk_shadow_page_get_mmio_spte(vcpu, addr, &spte);
3383
	if (WARN_ON(reserved))
3384
		return RET_MMIO_PF_BUG;
3385 3386 3387 3388 3389

	if (is_mmio_spte(spte)) {
		gfn_t gfn = get_mmio_spte_gfn(spte);
		unsigned access = get_mmio_spte_access(spte);

3390
		if (!check_mmio_spte(vcpu, spte))
3391 3392
			return RET_MMIO_PF_INVALID;

3393 3394
		if (direct)
			addr = 0;
X
Xiao Guangrong 已提交
3395 3396

		trace_handle_mmio_page_fault(addr, gfn, access);
3397
		vcpu_cache_mmio_info(vcpu, addr, gfn, access);
3398
		return RET_MMIO_PF_EMULATE;
3399 3400 3401 3402 3403 3404
	}

	/*
	 * If the page table is zapped by other cpus, let CPU fault again on
	 * the address.
	 */
3405
	return RET_MMIO_PF_RETRY;
3406
}
3407
EXPORT_SYMBOL_GPL(handle_mmio_page_fault);
3408

3409 3410 3411 3412 3413 3414 3415 3416 3417 3418 3419 3420 3421 3422 3423 3424 3425 3426 3427 3428
static bool page_fault_handle_page_track(struct kvm_vcpu *vcpu,
					 u32 error_code, gfn_t gfn)
{
	if (unlikely(error_code & PFERR_RSVD_MASK))
		return false;

	if (!(error_code & PFERR_PRESENT_MASK) ||
	      !(error_code & PFERR_WRITE_MASK))
		return false;

	/*
	 * guest is writing the page which is write tracked which can
	 * not be fixed by page fault handler.
	 */
	if (kvm_page_track_is_active(vcpu, gfn, KVM_PAGE_TRACK_WRITE))
		return true;

	return false;
}

3429 3430 3431 3432 3433 3434 3435 3436 3437 3438 3439 3440 3441 3442 3443 3444 3445
static void shadow_page_table_clear_flood(struct kvm_vcpu *vcpu, gva_t addr)
{
	struct kvm_shadow_walk_iterator iterator;
	u64 spte;

	if (!VALID_PAGE(vcpu->arch.mmu.root_hpa))
		return;

	walk_shadow_page_lockless_begin(vcpu);
	for_each_shadow_entry_lockless(vcpu, addr, iterator, spte) {
		clear_sp_write_flooding_count(iterator.sptep);
		if (!is_shadow_present_pte(spte))
			break;
	}
	walk_shadow_page_lockless_end(vcpu);
}

A
Avi Kivity 已提交
3446
static int nonpaging_page_fault(struct kvm_vcpu *vcpu, gva_t gva,
3447
				u32 error_code, bool prefault)
A
Avi Kivity 已提交
3448
{
3449
	gfn_t gfn = gva >> PAGE_SHIFT;
3450
	int r;
A
Avi Kivity 已提交
3451

3452
	pgprintk("%s: gva %lx error %x\n", __func__, gva, error_code);
3453

3454 3455
	if (page_fault_handle_page_track(vcpu, error_code, gfn))
		return 1;
3456

3457 3458 3459
	r = mmu_topup_memory_caches(vcpu);
	if (r)
		return r;
3460

3461
	MMU_WARN_ON(!VALID_PAGE(vcpu->arch.mmu.root_hpa));
A
Avi Kivity 已提交
3462 3463


3464
	return nonpaging_map(vcpu, gva & PAGE_MASK,
3465
			     error_code, gfn, prefault);
A
Avi Kivity 已提交
3466 3467
}

3468
static int kvm_arch_setup_async_pf(struct kvm_vcpu *vcpu, gva_t gva, gfn_t gfn)
3469 3470
{
	struct kvm_arch_async_pf arch;
X
Xiao Guangrong 已提交
3471

3472
	arch.token = (vcpu->arch.apf.id++ << 12) | vcpu->vcpu_id;
3473
	arch.gfn = gfn;
3474
	arch.direct_map = vcpu->arch.mmu.direct_map;
X
Xiao Guangrong 已提交
3475
	arch.cr3 = vcpu->arch.mmu.get_cr3(vcpu);
3476

3477
	return kvm_setup_async_pf(vcpu, gva, kvm_vcpu_gfn_to_hva(vcpu, gfn), &arch);
3478 3479 3480 3481
}

static bool can_do_async_pf(struct kvm_vcpu *vcpu)
{
3482
	if (unlikely(!lapic_in_kernel(vcpu) ||
3483 3484 3485 3486 3487 3488
		     kvm_event_needs_reinjection(vcpu)))
		return false;

	return kvm_x86_ops->interrupt_allowed(vcpu);
}

3489
static bool try_async_pf(struct kvm_vcpu *vcpu, bool prefault, gfn_t gfn,
D
Dan Williams 已提交
3490
			 gva_t gva, kvm_pfn_t *pfn, bool write, bool *writable)
3491
{
3492
	struct kvm_memory_slot *slot;
3493 3494
	bool async;

3495
	slot = kvm_vcpu_gfn_to_memslot(vcpu, gfn);
3496 3497
	async = false;
	*pfn = __gfn_to_pfn_memslot(slot, gfn, false, &async, write, writable);
3498 3499 3500
	if (!async)
		return false; /* *pfn has correct page already */

3501
	if (!prefault && can_do_async_pf(vcpu)) {
3502
		trace_kvm_try_async_get_page(gva, gfn);
3503 3504 3505 3506 3507 3508 3509 3510
		if (kvm_find_async_pf_gfn(vcpu, gfn)) {
			trace_kvm_async_pf_doublefault(gva, gfn);
			kvm_make_request(KVM_REQ_APF_HALT, vcpu);
			return true;
		} else if (kvm_arch_setup_async_pf(vcpu, gva, gfn))
			return true;
	}

3511
	*pfn = __gfn_to_pfn_memslot(slot, gfn, false, NULL, write, writable);
3512 3513 3514
	return false;
}

3515 3516 3517 3518 3519 3520 3521 3522 3523 3524
static bool
check_hugepage_cache_consistency(struct kvm_vcpu *vcpu, gfn_t gfn, int level)
{
	int page_num = KVM_PAGES_PER_HPAGE(level);

	gfn &= ~(page_num - 1);

	return kvm_mtrr_check_gfn_range_consistency(vcpu, gfn, page_num);
}

G
Gleb Natapov 已提交
3525
static int tdp_page_fault(struct kvm_vcpu *vcpu, gva_t gpa, u32 error_code,
3526
			  bool prefault)
3527
{
D
Dan Williams 已提交
3528
	kvm_pfn_t pfn;
3529
	int r;
3530
	int level;
3531
	bool force_pt_level;
M
Marcelo Tosatti 已提交
3532
	gfn_t gfn = gpa >> PAGE_SHIFT;
3533
	unsigned long mmu_seq;
3534 3535
	int write = error_code & PFERR_WRITE_MASK;
	bool map_writable;
3536

3537
	MMU_WARN_ON(!VALID_PAGE(vcpu->arch.mmu.root_hpa));
3538

3539 3540
	if (page_fault_handle_page_track(vcpu, error_code, gfn))
		return 1;
3541

3542 3543 3544 3545
	r = mmu_topup_memory_caches(vcpu);
	if (r)
		return r;

3546 3547 3548
	force_pt_level = !check_hugepage_cache_consistency(vcpu, gfn,
							   PT_DIRECTORY_LEVEL);
	level = mapping_level(vcpu, gfn, &force_pt_level);
3549
	if (likely(!force_pt_level)) {
3550 3551 3552
		if (level > PT_DIRECTORY_LEVEL &&
		    !check_hugepage_cache_consistency(vcpu, gfn, level))
			level = PT_DIRECTORY_LEVEL;
3553
		gfn &= ~(KVM_PAGES_PER_HPAGE(level) - 1);
3554
	}
3555

3556 3557 3558
	if (fast_page_fault(vcpu, gpa, level, error_code))
		return 0;

3559
	mmu_seq = vcpu->kvm->mmu_notifier_seq;
3560
	smp_rmb();
3561

3562
	if (try_async_pf(vcpu, prefault, gfn, gpa, &pfn, write, &map_writable))
3563 3564
		return 0;

3565 3566 3567
	if (handle_abnormal_pfn(vcpu, 0, gfn, pfn, ACC_ALL, &r))
		return r;

3568
	spin_lock(&vcpu->kvm->mmu_lock);
3569
	if (mmu_notifier_retry(vcpu->kvm, mmu_seq))
3570
		goto out_unlock;
3571
	make_mmu_pages_available(vcpu);
3572 3573
	if (likely(!force_pt_level))
		transparent_hugepage_adjust(vcpu, &gfn, &pfn, &level);
3574
	r = __direct_map(vcpu, write, map_writable, level, gfn, pfn, prefault);
3575 3576 3577
	spin_unlock(&vcpu->kvm->mmu_lock);

	return r;
3578 3579 3580 3581 3582

out_unlock:
	spin_unlock(&vcpu->kvm->mmu_lock);
	kvm_release_pfn_clean(pfn);
	return 0;
3583 3584
}

3585 3586
static void nonpaging_init_context(struct kvm_vcpu *vcpu,
				   struct kvm_mmu *context)
A
Avi Kivity 已提交
3587 3588 3589
{
	context->page_fault = nonpaging_page_fault;
	context->gva_to_gpa = nonpaging_gva_to_gpa;
3590
	context->sync_page = nonpaging_sync_page;
M
Marcelo Tosatti 已提交
3591
	context->invlpg = nonpaging_invlpg;
3592
	context->update_pte = nonpaging_update_pte;
3593
	context->root_level = 0;
A
Avi Kivity 已提交
3594
	context->shadow_root_level = PT32E_ROOT_LEVEL;
A
Avi Kivity 已提交
3595
	context->root_hpa = INVALID_PAGE;
3596
	context->direct_map = true;
3597
	context->nx = false;
A
Avi Kivity 已提交
3598 3599
}

3600
void kvm_mmu_new_cr3(struct kvm_vcpu *vcpu)
A
Avi Kivity 已提交
3601
{
3602
	mmu_free_roots(vcpu);
A
Avi Kivity 已提交
3603 3604
}

3605 3606
static unsigned long get_cr3(struct kvm_vcpu *vcpu)
{
3607
	return kvm_read_cr3(vcpu);
3608 3609
}

3610 3611
static void inject_page_fault(struct kvm_vcpu *vcpu,
			      struct x86_exception *fault)
A
Avi Kivity 已提交
3612
{
3613
	vcpu->arch.mmu.inject_page_fault(vcpu, fault);
A
Avi Kivity 已提交
3614 3615
}

3616
static bool sync_mmio_spte(struct kvm_vcpu *vcpu, u64 *sptep, gfn_t gfn,
3617
			   unsigned access, int *nr_present)
3618 3619 3620 3621 3622 3623 3624 3625
{
	if (unlikely(is_mmio_spte(*sptep))) {
		if (gfn != get_mmio_spte_gfn(*sptep)) {
			mmu_spte_clear_no_track(sptep);
			return true;
		}

		(*nr_present)++;
3626
		mark_mmio_spte(vcpu, sptep, gfn, access);
3627 3628 3629 3630 3631 3632
		return true;
	}

	return false;
}

3633 3634
static inline bool is_last_gpte(struct kvm_mmu *mmu,
				unsigned level, unsigned gpte)
A
Avi Kivity 已提交
3635
{
3636 3637 3638 3639 3640 3641
	/*
	 * PT_PAGE_TABLE_LEVEL always terminates.  The RHS has bit 7 set
	 * iff level <= PT_PAGE_TABLE_LEVEL, which for our purpose means
	 * level == PT_PAGE_TABLE_LEVEL; set PT_PAGE_SIZE_MASK in gpte then.
	 */
	gpte |= level - PT_PAGE_TABLE_LEVEL - 1;
A
Avi Kivity 已提交
3642

3643 3644 3645 3646 3647 3648 3649 3650
	/*
	 * The RHS has bit 7 set iff level < mmu->last_nonleaf_level.
	 * If it is clear, there are no large pages at this level, so clear
	 * PT_PAGE_SIZE_MASK in gpte if that is the case.
	 */
	gpte &= level - mmu->last_nonleaf_level;

	return gpte & PT_PAGE_SIZE_MASK;
A
Avi Kivity 已提交
3651 3652
}

3653 3654 3655 3656 3657
#define PTTYPE_EPT 18 /* arbitrary */
#define PTTYPE PTTYPE_EPT
#include "paging_tmpl.h"
#undef PTTYPE

A
Avi Kivity 已提交
3658 3659 3660 3661 3662 3663 3664 3665
#define PTTYPE 64
#include "paging_tmpl.h"
#undef PTTYPE

#define PTTYPE 32
#include "paging_tmpl.h"
#undef PTTYPE

3666 3667 3668 3669
static void
__reset_rsvds_bits_mask(struct kvm_vcpu *vcpu,
			struct rsvd_bits_validate *rsvd_check,
			int maxphyaddr, int level, bool nx, bool gbpages,
3670
			bool pse, bool amd)
3671 3672
{
	u64 exb_bit_rsvd = 0;
3673
	u64 gbpages_bit_rsvd = 0;
3674
	u64 nonleaf_bit8_rsvd = 0;
3675

3676
	rsvd_check->bad_mt_xwr = 0;
3677

3678
	if (!nx)
3679
		exb_bit_rsvd = rsvd_bits(63, 63);
3680
	if (!gbpages)
3681
		gbpages_bit_rsvd = rsvd_bits(7, 7);
3682 3683 3684 3685 3686

	/*
	 * Non-leaf PML4Es and PDPEs reserve bit 8 (which would be the G bit for
	 * leaf entries) on AMD CPUs only.
	 */
3687
	if (amd)
3688 3689
		nonleaf_bit8_rsvd = rsvd_bits(8, 8);

3690
	switch (level) {
3691 3692
	case PT32_ROOT_LEVEL:
		/* no rsvd bits for 2 level 4K page table entries */
3693 3694 3695 3696
		rsvd_check->rsvd_bits_mask[0][1] = 0;
		rsvd_check->rsvd_bits_mask[0][0] = 0;
		rsvd_check->rsvd_bits_mask[1][0] =
			rsvd_check->rsvd_bits_mask[0][0];
3697

3698
		if (!pse) {
3699
			rsvd_check->rsvd_bits_mask[1][1] = 0;
3700 3701 3702
			break;
		}

3703 3704
		if (is_cpuid_PSE36())
			/* 36bits PSE 4MB page */
3705
			rsvd_check->rsvd_bits_mask[1][1] = rsvd_bits(17, 21);
3706 3707
		else
			/* 32 bits PSE 4MB page */
3708
			rsvd_check->rsvd_bits_mask[1][1] = rsvd_bits(13, 21);
3709 3710
		break;
	case PT32E_ROOT_LEVEL:
3711
		rsvd_check->rsvd_bits_mask[0][2] =
3712
			rsvd_bits(maxphyaddr, 63) |
3713
			rsvd_bits(5, 8) | rsvd_bits(1, 2);	/* PDPTE */
3714
		rsvd_check->rsvd_bits_mask[0][1] = exb_bit_rsvd |
3715
			rsvd_bits(maxphyaddr, 62);	/* PDE */
3716
		rsvd_check->rsvd_bits_mask[0][0] = exb_bit_rsvd |
3717
			rsvd_bits(maxphyaddr, 62); 	/* PTE */
3718
		rsvd_check->rsvd_bits_mask[1][1] = exb_bit_rsvd |
3719 3720
			rsvd_bits(maxphyaddr, 62) |
			rsvd_bits(13, 20);		/* large page */
3721 3722
		rsvd_check->rsvd_bits_mask[1][0] =
			rsvd_check->rsvd_bits_mask[0][0];
3723 3724
		break;
	case PT64_ROOT_LEVEL:
3725 3726
		rsvd_check->rsvd_bits_mask[0][3] = exb_bit_rsvd |
			nonleaf_bit8_rsvd | rsvd_bits(7, 7) |
3727
			rsvd_bits(maxphyaddr, 51);
3728 3729
		rsvd_check->rsvd_bits_mask[0][2] = exb_bit_rsvd |
			nonleaf_bit8_rsvd | gbpages_bit_rsvd |
3730
			rsvd_bits(maxphyaddr, 51);
3731 3732 3733 3734 3735 3736 3737
		rsvd_check->rsvd_bits_mask[0][1] = exb_bit_rsvd |
			rsvd_bits(maxphyaddr, 51);
		rsvd_check->rsvd_bits_mask[0][0] = exb_bit_rsvd |
			rsvd_bits(maxphyaddr, 51);
		rsvd_check->rsvd_bits_mask[1][3] =
			rsvd_check->rsvd_bits_mask[0][3];
		rsvd_check->rsvd_bits_mask[1][2] = exb_bit_rsvd |
3738
			gbpages_bit_rsvd | rsvd_bits(maxphyaddr, 51) |
3739
			rsvd_bits(13, 29);
3740
		rsvd_check->rsvd_bits_mask[1][1] = exb_bit_rsvd |
3741 3742
			rsvd_bits(maxphyaddr, 51) |
			rsvd_bits(13, 20);		/* large page */
3743 3744
		rsvd_check->rsvd_bits_mask[1][0] =
			rsvd_check->rsvd_bits_mask[0][0];
3745 3746 3747 3748
		break;
	}
}

3749 3750 3751 3752 3753 3754
static void reset_rsvds_bits_mask(struct kvm_vcpu *vcpu,
				  struct kvm_mmu *context)
{
	__reset_rsvds_bits_mask(vcpu, &context->guest_rsvd_check,
				cpuid_maxphyaddr(vcpu), context->root_level,
				context->nx, guest_cpuid_has_gbpages(vcpu),
3755
				is_pse(vcpu), guest_cpuid_is_amd(vcpu));
3756 3757
}

3758 3759 3760
static void
__reset_rsvds_bits_mask_ept(struct rsvd_bits_validate *rsvd_check,
			    int maxphyaddr, bool execonly)
3761
{
3762
	u64 bad_mt_xwr;
3763

3764
	rsvd_check->rsvd_bits_mask[0][3] =
3765
		rsvd_bits(maxphyaddr, 51) | rsvd_bits(3, 7);
3766
	rsvd_check->rsvd_bits_mask[0][2] =
3767
		rsvd_bits(maxphyaddr, 51) | rsvd_bits(3, 6);
3768
	rsvd_check->rsvd_bits_mask[0][1] =
3769
		rsvd_bits(maxphyaddr, 51) | rsvd_bits(3, 6);
3770
	rsvd_check->rsvd_bits_mask[0][0] = rsvd_bits(maxphyaddr, 51);
3771 3772

	/* large page */
3773 3774
	rsvd_check->rsvd_bits_mask[1][3] = rsvd_check->rsvd_bits_mask[0][3];
	rsvd_check->rsvd_bits_mask[1][2] =
3775
		rsvd_bits(maxphyaddr, 51) | rsvd_bits(12, 29);
3776
	rsvd_check->rsvd_bits_mask[1][1] =
3777
		rsvd_bits(maxphyaddr, 51) | rsvd_bits(12, 20);
3778
	rsvd_check->rsvd_bits_mask[1][0] = rsvd_check->rsvd_bits_mask[0][0];
3779

3780 3781 3782 3783 3784 3785 3786 3787
	bad_mt_xwr = 0xFFull << (2 * 8);	/* bits 3..5 must not be 2 */
	bad_mt_xwr |= 0xFFull << (3 * 8);	/* bits 3..5 must not be 3 */
	bad_mt_xwr |= 0xFFull << (7 * 8);	/* bits 3..5 must not be 7 */
	bad_mt_xwr |= REPEAT_BYTE(1ull << 2);	/* bits 0..2 must not be 010 */
	bad_mt_xwr |= REPEAT_BYTE(1ull << 6);	/* bits 0..2 must not be 110 */
	if (!execonly) {
		/* bits 0..2 must not be 100 unless VMX capabilities allow it */
		bad_mt_xwr |= REPEAT_BYTE(1ull << 4);
3788
	}
3789
	rsvd_check->bad_mt_xwr = bad_mt_xwr;
3790 3791
}

3792 3793 3794 3795 3796 3797 3798
static void reset_rsvds_bits_mask_ept(struct kvm_vcpu *vcpu,
		struct kvm_mmu *context, bool execonly)
{
	__reset_rsvds_bits_mask_ept(&context->guest_rsvd_check,
				    cpuid_maxphyaddr(vcpu), execonly);
}

3799 3800 3801 3802 3803 3804 3805 3806
/*
 * the page table on host is the shadow page table for the page
 * table in guest or amd nested guest, its mmu features completely
 * follow the features in guest.
 */
void
reset_shadow_zero_bits_mask(struct kvm_vcpu *vcpu, struct kvm_mmu *context)
{
3807 3808
	bool uses_nx = context->nx || context->base_role.smep_andnot_wp;

3809 3810 3811 3812
	/*
	 * Passing "true" to the last argument is okay; it adds a check
	 * on bit 8 of the SPTEs which KVM doesn't use anyway.
	 */
3813 3814
	__reset_rsvds_bits_mask(vcpu, &context->shadow_zero_check,
				boot_cpu_data.x86_phys_bits,
3815
				context->shadow_root_level, uses_nx,
3816 3817
				guest_cpuid_has_gbpages(vcpu), is_pse(vcpu),
				true);
3818 3819 3820
}
EXPORT_SYMBOL_GPL(reset_shadow_zero_bits_mask);

3821 3822 3823 3824 3825 3826
static inline bool boot_cpu_is_amd(void)
{
	WARN_ON_ONCE(!tdp_enabled);
	return shadow_x_mask == 0;
}

3827 3828 3829 3830 3831 3832 3833 3834
/*
 * the direct page table on host, use as much mmu features as
 * possible, however, kvm currently does not do execution-protection.
 */
static void
reset_tdp_shadow_zero_bits_mask(struct kvm_vcpu *vcpu,
				struct kvm_mmu *context)
{
3835
	if (boot_cpu_is_amd())
3836 3837 3838
		__reset_rsvds_bits_mask(vcpu, &context->shadow_zero_check,
					boot_cpu_data.x86_phys_bits,
					context->shadow_root_level, false,
3839
					cpu_has_gbpages, true, true);
3840 3841 3842 3843 3844 3845 3846 3847 3848 3849 3850 3851 3852 3853 3854 3855 3856 3857 3858
	else
		__reset_rsvds_bits_mask_ept(&context->shadow_zero_check,
					    boot_cpu_data.x86_phys_bits,
					    false);

}

/*
 * as the comments in reset_shadow_zero_bits_mask() except it
 * is the shadow page table for intel nested guest.
 */
static void
reset_ept_shadow_zero_bits_mask(struct kvm_vcpu *vcpu,
				struct kvm_mmu *context, bool execonly)
{
	__reset_rsvds_bits_mask_ept(&context->shadow_zero_check,
				    boot_cpu_data.x86_phys_bits, execonly);
}

3859 3860
static void update_permission_bitmask(struct kvm_vcpu *vcpu,
				      struct kvm_mmu *mmu, bool ept)
3861 3862 3863
{
	unsigned bit, byte, pfec;
	u8 map;
F
Feng Wu 已提交
3864
	bool fault, x, w, u, wf, uf, ff, smapf, cr4_smap, cr4_smep, smap = 0;
3865

F
Feng Wu 已提交
3866
	cr4_smep = kvm_read_cr4_bits(vcpu, X86_CR4_SMEP);
F
Feng Wu 已提交
3867
	cr4_smap = kvm_read_cr4_bits(vcpu, X86_CR4_SMAP);
3868 3869 3870 3871 3872 3873
	for (byte = 0; byte < ARRAY_SIZE(mmu->permissions); ++byte) {
		pfec = byte << 1;
		map = 0;
		wf = pfec & PFERR_WRITE_MASK;
		uf = pfec & PFERR_USER_MASK;
		ff = pfec & PFERR_FETCH_MASK;
F
Feng Wu 已提交
3874 3875 3876 3877 3878 3879
		/*
		 * PFERR_RSVD_MASK bit is set in PFEC if the access is not
		 * subject to SMAP restrictions, and cleared otherwise. The
		 * bit is only meaningful if the SMAP bit is set in CR4.
		 */
		smapf = !(pfec & PFERR_RSVD_MASK);
3880 3881 3882 3883 3884
		for (bit = 0; bit < 8; ++bit) {
			x = bit & ACC_EXEC_MASK;
			w = bit & ACC_WRITE_MASK;
			u = bit & ACC_USER_MASK;

3885 3886 3887 3888 3889 3890
			if (!ept) {
				/* Not really needed: !nx will cause pte.nx to fault */
				x |= !mmu->nx;
				/* Allow supervisor writes if !cr0.wp */
				w |= !is_write_protection(vcpu) && !uf;
				/* Disallow supervisor fetches of user code if cr4.smep */
F
Feng Wu 已提交
3891
				x &= !(cr4_smep && u && !uf);
F
Feng Wu 已提交
3892 3893 3894 3895 3896 3897 3898 3899 3900 3901 3902 3903 3904 3905 3906 3907 3908 3909 3910 3911

				/*
				 * SMAP:kernel-mode data accesses from user-mode
				 * mappings should fault. A fault is considered
				 * as a SMAP violation if all of the following
				 * conditions are ture:
				 *   - X86_CR4_SMAP is set in CR4
				 *   - An user page is accessed
				 *   - Page fault in kernel mode
				 *   - if CPL = 3 or X86_EFLAGS_AC is clear
				 *
				 *   Here, we cover the first three conditions.
				 *   The fourth is computed dynamically in
				 *   permission_fault() and is in smapf.
				 *
				 *   Also, SMAP does not affect instruction
				 *   fetches, add the !ff check here to make it
				 *   clearer.
				 */
				smap = cr4_smap && u && !uf && !ff;
3912 3913 3914
			} else
				/* Not really needed: no U/S accesses on ept  */
				u = 1;
3915

F
Feng Wu 已提交
3916 3917
			fault = (ff && !x) || (uf && !u) || (wf && !w) ||
				(smapf && smap);
3918 3919 3920 3921 3922 3923
			map |= fault << bit;
		}
		mmu->permissions[byte] = map;
	}
}

3924 3925 3926 3927 3928 3929 3930 3931 3932 3933 3934 3935 3936 3937 3938 3939 3940 3941 3942 3943 3944 3945 3946 3947 3948 3949 3950 3951 3952 3953 3954 3955 3956 3957 3958 3959 3960 3961 3962 3963 3964 3965 3966 3967 3968 3969 3970 3971 3972 3973 3974 3975 3976 3977 3978 3979 3980 3981 3982 3983 3984 3985 3986 3987 3988 3989 3990 3991 3992 3993 3994 3995 3996 3997 3998
/*
* PKU is an additional mechanism by which the paging controls access to
* user-mode addresses based on the value in the PKRU register.  Protection
* key violations are reported through a bit in the page fault error code.
* Unlike other bits of the error code, the PK bit is not known at the
* call site of e.g. gva_to_gpa; it must be computed directly in
* permission_fault based on two bits of PKRU, on some machine state (CR4,
* CR0, EFER, CPL), and on other bits of the error code and the page tables.
*
* In particular the following conditions come from the error code, the
* page tables and the machine state:
* - PK is always zero unless CR4.PKE=1 and EFER.LMA=1
* - PK is always zero if RSVD=1 (reserved bit set) or F=1 (instruction fetch)
* - PK is always zero if U=0 in the page tables
* - PKRU.WD is ignored if CR0.WP=0 and the access is a supervisor access.
*
* The PKRU bitmask caches the result of these four conditions.  The error
* code (minus the P bit) and the page table's U bit form an index into the
* PKRU bitmask.  Two bits of the PKRU bitmask are then extracted and ANDed
* with the two bits of the PKRU register corresponding to the protection key.
* For the first three conditions above the bits will be 00, thus masking
* away both AD and WD.  For all reads or if the last condition holds, WD
* only will be masked away.
*/
static void update_pkru_bitmask(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu,
				bool ept)
{
	unsigned bit;
	bool wp;

	if (ept) {
		mmu->pkru_mask = 0;
		return;
	}

	/* PKEY is enabled only if CR4.PKE and EFER.LMA are both set. */
	if (!kvm_read_cr4_bits(vcpu, X86_CR4_PKE) || !is_long_mode(vcpu)) {
		mmu->pkru_mask = 0;
		return;
	}

	wp = is_write_protection(vcpu);

	for (bit = 0; bit < ARRAY_SIZE(mmu->permissions); ++bit) {
		unsigned pfec, pkey_bits;
		bool check_pkey, check_write, ff, uf, wf, pte_user;

		pfec = bit << 1;
		ff = pfec & PFERR_FETCH_MASK;
		uf = pfec & PFERR_USER_MASK;
		wf = pfec & PFERR_WRITE_MASK;

		/* PFEC.RSVD is replaced by ACC_USER_MASK. */
		pte_user = pfec & PFERR_RSVD_MASK;

		/*
		 * Only need to check the access which is not an
		 * instruction fetch and is to a user page.
		 */
		check_pkey = (!ff && pte_user);
		/*
		 * write access is controlled by PKRU if it is a
		 * user access or CR0.WP = 1.
		 */
		check_write = check_pkey && wf && (uf || wp);

		/* PKRU.AD stops both read and write access. */
		pkey_bits = !!check_pkey;
		/* PKRU.WD stops write access. */
		pkey_bits |= (!!check_write) << 1;

		mmu->pkru_mask |= (pkey_bits & 3) << pfec;
	}
}

3999
static void update_last_nonleaf_level(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu)
A
Avi Kivity 已提交
4000
{
4001 4002 4003 4004 4005
	unsigned root_level = mmu->root_level;

	mmu->last_nonleaf_level = root_level;
	if (root_level == PT32_ROOT_LEVEL && is_pse(vcpu))
		mmu->last_nonleaf_level++;
A
Avi Kivity 已提交
4006 4007
}

4008 4009 4010
static void paging64_init_context_common(struct kvm_vcpu *vcpu,
					 struct kvm_mmu *context,
					 int level)
A
Avi Kivity 已提交
4011
{
4012
	context->nx = is_nx(vcpu);
4013
	context->root_level = level;
4014

4015
	reset_rsvds_bits_mask(vcpu, context);
4016
	update_permission_bitmask(vcpu, context, false);
4017
	update_pkru_bitmask(vcpu, context, false);
4018
	update_last_nonleaf_level(vcpu, context);
A
Avi Kivity 已提交
4019

4020
	MMU_WARN_ON(!is_pae(vcpu));
A
Avi Kivity 已提交
4021 4022
	context->page_fault = paging64_page_fault;
	context->gva_to_gpa = paging64_gva_to_gpa;
4023
	context->sync_page = paging64_sync_page;
M
Marcelo Tosatti 已提交
4024
	context->invlpg = paging64_invlpg;
4025
	context->update_pte = paging64_update_pte;
4026
	context->shadow_root_level = level;
A
Avi Kivity 已提交
4027
	context->root_hpa = INVALID_PAGE;
4028
	context->direct_map = false;
A
Avi Kivity 已提交
4029 4030
}

4031 4032
static void paging64_init_context(struct kvm_vcpu *vcpu,
				  struct kvm_mmu *context)
4033
{
4034
	paging64_init_context_common(vcpu, context, PT64_ROOT_LEVEL);
4035 4036
}

4037 4038
static void paging32_init_context(struct kvm_vcpu *vcpu,
				  struct kvm_mmu *context)
A
Avi Kivity 已提交
4039
{
4040
	context->nx = false;
4041
	context->root_level = PT32_ROOT_LEVEL;
4042

4043
	reset_rsvds_bits_mask(vcpu, context);
4044
	update_permission_bitmask(vcpu, context, false);
4045
	update_pkru_bitmask(vcpu, context, false);
4046
	update_last_nonleaf_level(vcpu, context);
A
Avi Kivity 已提交
4047 4048 4049

	context->page_fault = paging32_page_fault;
	context->gva_to_gpa = paging32_gva_to_gpa;
4050
	context->sync_page = paging32_sync_page;
M
Marcelo Tosatti 已提交
4051
	context->invlpg = paging32_invlpg;
4052
	context->update_pte = paging32_update_pte;
A
Avi Kivity 已提交
4053
	context->shadow_root_level = PT32E_ROOT_LEVEL;
A
Avi Kivity 已提交
4054
	context->root_hpa = INVALID_PAGE;
4055
	context->direct_map = false;
A
Avi Kivity 已提交
4056 4057
}

4058 4059
static void paging32E_init_context(struct kvm_vcpu *vcpu,
				   struct kvm_mmu *context)
A
Avi Kivity 已提交
4060
{
4061
	paging64_init_context_common(vcpu, context, PT32E_ROOT_LEVEL);
A
Avi Kivity 已提交
4062 4063
}

4064
static void init_kvm_tdp_mmu(struct kvm_vcpu *vcpu)
4065
{
4066
	struct kvm_mmu *context = &vcpu->arch.mmu;
4067

4068
	context->base_role.word = 0;
4069
	context->base_role.smm = is_smm(vcpu);
4070
	context->page_fault = tdp_page_fault;
4071
	context->sync_page = nonpaging_sync_page;
M
Marcelo Tosatti 已提交
4072
	context->invlpg = nonpaging_invlpg;
4073
	context->update_pte = nonpaging_update_pte;
4074
	context->shadow_root_level = kvm_x86_ops->get_tdp_level();
4075
	context->root_hpa = INVALID_PAGE;
4076
	context->direct_map = true;
4077
	context->set_cr3 = kvm_x86_ops->set_tdp_cr3;
4078
	context->get_cr3 = get_cr3;
4079
	context->get_pdptr = kvm_pdptr_read;
4080
	context->inject_page_fault = kvm_inject_page_fault;
4081 4082

	if (!is_paging(vcpu)) {
4083
		context->nx = false;
4084 4085 4086
		context->gva_to_gpa = nonpaging_gva_to_gpa;
		context->root_level = 0;
	} else if (is_long_mode(vcpu)) {
4087
		context->nx = is_nx(vcpu);
4088
		context->root_level = PT64_ROOT_LEVEL;
4089 4090
		reset_rsvds_bits_mask(vcpu, context);
		context->gva_to_gpa = paging64_gva_to_gpa;
4091
	} else if (is_pae(vcpu)) {
4092
		context->nx = is_nx(vcpu);
4093
		context->root_level = PT32E_ROOT_LEVEL;
4094 4095
		reset_rsvds_bits_mask(vcpu, context);
		context->gva_to_gpa = paging64_gva_to_gpa;
4096
	} else {
4097
		context->nx = false;
4098
		context->root_level = PT32_ROOT_LEVEL;
4099 4100
		reset_rsvds_bits_mask(vcpu, context);
		context->gva_to_gpa = paging32_gva_to_gpa;
4101 4102
	}

4103
	update_permission_bitmask(vcpu, context, false);
4104
	update_pkru_bitmask(vcpu, context, false);
4105
	update_last_nonleaf_level(vcpu, context);
4106
	reset_tdp_shadow_zero_bits_mask(vcpu, context);
4107 4108
}

4109
void kvm_init_shadow_mmu(struct kvm_vcpu *vcpu)
A
Avi Kivity 已提交
4110
{
4111
	bool smep = kvm_read_cr4_bits(vcpu, X86_CR4_SMEP);
4112
	bool smap = kvm_read_cr4_bits(vcpu, X86_CR4_SMAP);
4113 4114
	struct kvm_mmu *context = &vcpu->arch.mmu;

4115
	MMU_WARN_ON(VALID_PAGE(context->root_hpa));
A
Avi Kivity 已提交
4116 4117

	if (!is_paging(vcpu))
4118
		nonpaging_init_context(vcpu, context);
A
Avi Kivity 已提交
4119
	else if (is_long_mode(vcpu))
4120
		paging64_init_context(vcpu, context);
A
Avi Kivity 已提交
4121
	else if (is_pae(vcpu))
4122
		paging32E_init_context(vcpu, context);
A
Avi Kivity 已提交
4123
	else
4124
		paging32_init_context(vcpu, context);
4125

4126 4127 4128 4129
	context->base_role.nxe = is_nx(vcpu);
	context->base_role.cr4_pae = !!is_pae(vcpu);
	context->base_role.cr0_wp  = is_write_protection(vcpu);
	context->base_role.smep_andnot_wp
4130
		= smep && !is_write_protection(vcpu);
4131 4132
	context->base_role.smap_andnot_wp
		= smap && !is_write_protection(vcpu);
4133
	context->base_role.smm = is_smm(vcpu);
4134
	reset_shadow_zero_bits_mask(vcpu, context);
4135 4136 4137
}
EXPORT_SYMBOL_GPL(kvm_init_shadow_mmu);

4138
void kvm_init_shadow_ept_mmu(struct kvm_vcpu *vcpu, bool execonly)
N
Nadav Har'El 已提交
4139
{
4140 4141
	struct kvm_mmu *context = &vcpu->arch.mmu;

4142
	MMU_WARN_ON(VALID_PAGE(context->root_hpa));
N
Nadav Har'El 已提交
4143 4144 4145 4146 4147 4148 4149 4150 4151 4152 4153 4154 4155 4156

	context->shadow_root_level = kvm_x86_ops->get_tdp_level();

	context->nx = true;
	context->page_fault = ept_page_fault;
	context->gva_to_gpa = ept_gva_to_gpa;
	context->sync_page = ept_sync_page;
	context->invlpg = ept_invlpg;
	context->update_pte = ept_update_pte;
	context->root_level = context->shadow_root_level;
	context->root_hpa = INVALID_PAGE;
	context->direct_map = false;

	update_permission_bitmask(vcpu, context, true);
4157
	update_pkru_bitmask(vcpu, context, true);
N
Nadav Har'El 已提交
4158
	reset_rsvds_bits_mask_ept(vcpu, context, execonly);
4159
	reset_ept_shadow_zero_bits_mask(vcpu, context, execonly);
N
Nadav Har'El 已提交
4160 4161 4162
}
EXPORT_SYMBOL_GPL(kvm_init_shadow_ept_mmu);

4163
static void init_kvm_softmmu(struct kvm_vcpu *vcpu)
4164
{
4165 4166 4167 4168 4169 4170 4171
	struct kvm_mmu *context = &vcpu->arch.mmu;

	kvm_init_shadow_mmu(vcpu);
	context->set_cr3           = kvm_x86_ops->set_cr3;
	context->get_cr3           = get_cr3;
	context->get_pdptr         = kvm_pdptr_read;
	context->inject_page_fault = kvm_inject_page_fault;
A
Avi Kivity 已提交
4172 4173
}

4174
static void init_kvm_nested_mmu(struct kvm_vcpu *vcpu)
4175 4176 4177 4178
{
	struct kvm_mmu *g_context = &vcpu->arch.nested_mmu;

	g_context->get_cr3           = get_cr3;
4179
	g_context->get_pdptr         = kvm_pdptr_read;
4180 4181 4182
	g_context->inject_page_fault = kvm_inject_page_fault;

	/*
4183 4184 4185 4186 4187 4188
	 * Note that arch.mmu.gva_to_gpa translates l2_gpa to l1_gpa using
	 * L1's nested page tables (e.g. EPT12). The nested translation
	 * of l2_gva to l1_gpa is done by arch.nested_mmu.gva_to_gpa using
	 * L2's page tables as the first level of translation and L1's
	 * nested page tables as the second level of translation. Basically
	 * the gva_to_gpa functions between mmu and nested_mmu are swapped.
4189 4190
	 */
	if (!is_paging(vcpu)) {
4191
		g_context->nx = false;
4192 4193 4194
		g_context->root_level = 0;
		g_context->gva_to_gpa = nonpaging_gva_to_gpa_nested;
	} else if (is_long_mode(vcpu)) {
4195
		g_context->nx = is_nx(vcpu);
4196
		g_context->root_level = PT64_ROOT_LEVEL;
4197
		reset_rsvds_bits_mask(vcpu, g_context);
4198 4199
		g_context->gva_to_gpa = paging64_gva_to_gpa_nested;
	} else if (is_pae(vcpu)) {
4200
		g_context->nx = is_nx(vcpu);
4201
		g_context->root_level = PT32E_ROOT_LEVEL;
4202
		reset_rsvds_bits_mask(vcpu, g_context);
4203 4204
		g_context->gva_to_gpa = paging64_gva_to_gpa_nested;
	} else {
4205
		g_context->nx = false;
4206
		g_context->root_level = PT32_ROOT_LEVEL;
4207
		reset_rsvds_bits_mask(vcpu, g_context);
4208 4209 4210
		g_context->gva_to_gpa = paging32_gva_to_gpa_nested;
	}

4211
	update_permission_bitmask(vcpu, g_context, false);
4212
	update_pkru_bitmask(vcpu, g_context, false);
4213
	update_last_nonleaf_level(vcpu, g_context);
4214 4215
}

4216
static void init_kvm_mmu(struct kvm_vcpu *vcpu)
4217
{
4218
	if (mmu_is_nested(vcpu))
4219
		init_kvm_nested_mmu(vcpu);
4220
	else if (tdp_enabled)
4221
		init_kvm_tdp_mmu(vcpu);
4222
	else
4223
		init_kvm_softmmu(vcpu);
4224 4225
}

4226
void kvm_mmu_reset_context(struct kvm_vcpu *vcpu)
A
Avi Kivity 已提交
4227
{
4228
	kvm_mmu_unload(vcpu);
4229
	init_kvm_mmu(vcpu);
A
Avi Kivity 已提交
4230
}
4231
EXPORT_SYMBOL_GPL(kvm_mmu_reset_context);
A
Avi Kivity 已提交
4232 4233

int kvm_mmu_load(struct kvm_vcpu *vcpu)
A
Avi Kivity 已提交
4234
{
4235 4236
	int r;

4237
	r = mmu_topup_memory_caches(vcpu);
A
Avi Kivity 已提交
4238 4239
	if (r)
		goto out;
4240
	r = mmu_alloc_roots(vcpu);
4241
	kvm_mmu_sync_roots(vcpu);
4242 4243
	if (r)
		goto out;
4244
	/* set_cr3() should ensure TLB has been flushed */
4245
	vcpu->arch.mmu.set_cr3(vcpu, vcpu->arch.mmu.root_hpa);
4246 4247
out:
	return r;
A
Avi Kivity 已提交
4248
}
A
Avi Kivity 已提交
4249 4250 4251 4252 4253
EXPORT_SYMBOL_GPL(kvm_mmu_load);

void kvm_mmu_unload(struct kvm_vcpu *vcpu)
{
	mmu_free_roots(vcpu);
4254
	WARN_ON(VALID_PAGE(vcpu->arch.mmu.root_hpa));
A
Avi Kivity 已提交
4255
}
4256
EXPORT_SYMBOL_GPL(kvm_mmu_unload);
A
Avi Kivity 已提交
4257

4258
static void mmu_pte_write_new_pte(struct kvm_vcpu *vcpu,
4259 4260
				  struct kvm_mmu_page *sp, u64 *spte,
				  const void *new)
4261
{
4262
	if (sp->role.level != PT_PAGE_TABLE_LEVEL) {
4263 4264
		++vcpu->kvm->stat.mmu_pde_zapped;
		return;
4265
        }
4266

A
Avi Kivity 已提交
4267
	++vcpu->kvm->stat.mmu_pte_updated;
4268
	vcpu->arch.mmu.update_pte(vcpu, sp, spte, new);
4269 4270
}

4271 4272 4273 4274 4275 4276 4277 4278
static bool need_remote_flush(u64 old, u64 new)
{
	if (!is_shadow_present_pte(old))
		return false;
	if (!is_shadow_present_pte(new))
		return true;
	if ((old ^ new) & PT64_BASE_ADDR_MASK)
		return true;
4279 4280
	old ^= shadow_nx_mask;
	new ^= shadow_nx_mask;
4281 4282 4283
	return (old & ~new & PT64_PERM_MASK) != 0;
}

4284 4285
static u64 mmu_pte_write_fetch_gpte(struct kvm_vcpu *vcpu, gpa_t *gpa,
				    const u8 *new, int *bytes)
4286
{
4287 4288
	u64 gentry;
	int r;
4289 4290 4291

	/*
	 * Assume that the pte write on a page table of the same type
4292 4293
	 * as the current vcpu paging mode since we update the sptes only
	 * when they have the same mode.
4294
	 */
4295
	if (is_pae(vcpu) && *bytes == 4) {
4296
		/* Handle a 32-bit guest writing two halves of a 64-bit gpte */
4297 4298
		*gpa &= ~(gpa_t)7;
		*bytes = 8;
4299
		r = kvm_vcpu_read_guest(vcpu, *gpa, &gentry, 8);
4300 4301
		if (r)
			gentry = 0;
4302 4303 4304
		new = (const u8 *)&gentry;
	}

4305
	switch (*bytes) {
4306 4307 4308 4309 4310 4311 4312 4313 4314
	case 4:
		gentry = *(const u32 *)new;
		break;
	case 8:
		gentry = *(const u64 *)new;
		break;
	default:
		gentry = 0;
		break;
4315 4316
	}

4317 4318 4319 4320 4321 4322 4323
	return gentry;
}

/*
 * If we're seeing too many writes to a page, it may no longer be a page table,
 * or we may be forking, in which case it is better to unmap the page.
 */
4324
static bool detect_write_flooding(struct kvm_mmu_page *sp)
4325
{
4326 4327 4328 4329
	/*
	 * Skip write-flooding detected for the sp whose level is 1, because
	 * it can become unsync, then the guest page is not write-protected.
	 */
4330
	if (sp->role.level == PT_PAGE_TABLE_LEVEL)
4331
		return false;
4332

4333 4334
	atomic_inc(&sp->write_flooding_count);
	return atomic_read(&sp->write_flooding_count) >= 3;
4335 4336 4337 4338 4339 4340 4341 4342 4343 4344 4345 4346 4347 4348 4349 4350
}

/*
 * Misaligned accesses are too much trouble to fix up; also, they usually
 * indicate a page is not used as a page table.
 */
static bool detect_write_misaligned(struct kvm_mmu_page *sp, gpa_t gpa,
				    int bytes)
{
	unsigned offset, pte_size, misaligned;

	pgprintk("misaligned: gpa %llx bytes %d role %x\n",
		 gpa, bytes, sp->role.word);

	offset = offset_in_page(gpa);
	pte_size = sp->role.cr4_pae ? 8 : 4;
4351 4352 4353 4354 4355 4356 4357 4358

	/*
	 * Sometimes, the OS only writes the last one bytes to update status
	 * bits, for example, in linux, andb instruction is used in clear_bit().
	 */
	if (!(offset & (pte_size - 1)) && bytes == 1)
		return false;

4359 4360 4361 4362 4363 4364 4365 4366 4367 4368 4369 4370 4371 4372 4373 4374 4375 4376 4377 4378 4379 4380 4381 4382 4383 4384 4385 4386 4387 4388 4389 4390 4391 4392 4393 4394 4395
	misaligned = (offset ^ (offset + bytes - 1)) & ~(pte_size - 1);
	misaligned |= bytes < 4;

	return misaligned;
}

static u64 *get_written_sptes(struct kvm_mmu_page *sp, gpa_t gpa, int *nspte)
{
	unsigned page_offset, quadrant;
	u64 *spte;
	int level;

	page_offset = offset_in_page(gpa);
	level = sp->role.level;
	*nspte = 1;
	if (!sp->role.cr4_pae) {
		page_offset <<= 1;	/* 32->64 */
		/*
		 * A 32-bit pde maps 4MB while the shadow pdes map
		 * only 2MB.  So we need to double the offset again
		 * and zap two pdes instead of one.
		 */
		if (level == PT32_ROOT_LEVEL) {
			page_offset &= ~7; /* kill rounding error */
			page_offset <<= 1;
			*nspte = 2;
		}
		quadrant = page_offset >> PAGE_SHIFT;
		page_offset &= ~PAGE_MASK;
		if (quadrant != sp->role.quadrant)
			return NULL;
	}

	spte = &sp->spt[page_offset / sizeof(*spte)];
	return spte;
}

4396 4397
static void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
			      const u8 *new, int bytes)
4398 4399 4400 4401 4402 4403
{
	gfn_t gfn = gpa >> PAGE_SHIFT;
	struct kvm_mmu_page *sp;
	LIST_HEAD(invalid_list);
	u64 entry, gentry, *spte;
	int npte;
4404
	bool remote_flush, local_flush;
4405 4406 4407 4408 4409 4410 4411
	union kvm_mmu_page_role mask = { };

	mask.cr0_wp = 1;
	mask.cr4_pae = 1;
	mask.nxe = 1;
	mask.smep_andnot_wp = 1;
	mask.smap_andnot_wp = 1;
4412
	mask.smm = 1;
4413 4414 4415 4416 4417 4418 4419 4420

	/*
	 * If we don't have indirect shadow pages, it means no page is
	 * write-protected, so we can exit simply.
	 */
	if (!ACCESS_ONCE(vcpu->kvm->arch.indirect_shadow_pages))
		return;

4421
	remote_flush = local_flush = false;
4422 4423 4424 4425 4426 4427 4428 4429 4430 4431 4432 4433 4434 4435

	pgprintk("%s: gpa %llx bytes %d\n", __func__, gpa, bytes);

	gentry = mmu_pte_write_fetch_gpte(vcpu, &gpa, new, &bytes);

	/*
	 * No need to care whether allocation memory is successful
	 * or not since pte prefetch is skiped if it does not have
	 * enough objects in the cache.
	 */
	mmu_topup_memory_caches(vcpu);

	spin_lock(&vcpu->kvm->mmu_lock);
	++vcpu->kvm->stat.mmu_pte_write;
4436
	kvm_mmu_audit(vcpu, AUDIT_PRE_PTE_WRITE);
4437

4438
	for_each_gfn_indirect_valid_sp(vcpu->kvm, sp, gfn) {
4439
		if (detect_write_misaligned(sp, gpa, bytes) ||
4440
		      detect_write_flooding(sp)) {
4441
			kvm_mmu_prepare_zap_page(vcpu->kvm, sp, &invalid_list);
A
Avi Kivity 已提交
4442
			++vcpu->kvm->stat.mmu_flooded;
4443 4444
			continue;
		}
4445 4446 4447 4448 4449

		spte = get_written_sptes(sp, gpa, &npte);
		if (!spte)
			continue;

4450
		local_flush = true;
4451
		while (npte--) {
4452
			entry = *spte;
4453
			mmu_page_zap_pte(vcpu->kvm, sp, spte);
4454 4455
			if (gentry &&
			      !((sp->role.word ^ vcpu->arch.mmu.base_role.word)
4456
			      & mask.word) && rmap_can_add(vcpu))
4457
				mmu_pte_write_new_pte(vcpu, sp, spte, &gentry);
G
Gleb Natapov 已提交
4458
			if (need_remote_flush(entry, *spte))
4459
				remote_flush = true;
4460
			++spte;
4461 4462
		}
	}
4463
	kvm_mmu_flush_or_zap(vcpu, &invalid_list, remote_flush, local_flush);
4464
	kvm_mmu_audit(vcpu, AUDIT_POST_PTE_WRITE);
4465
	spin_unlock(&vcpu->kvm->mmu_lock);
4466 4467
}

4468 4469
int kvm_mmu_unprotect_page_virt(struct kvm_vcpu *vcpu, gva_t gva)
{
4470 4471
	gpa_t gpa;
	int r;
4472

4473
	if (vcpu->arch.mmu.direct_map)
4474 4475
		return 0;

4476
	gpa = kvm_mmu_gva_to_gpa_read(vcpu, gva, NULL);
4477 4478

	r = kvm_mmu_unprotect_page(vcpu->kvm, gpa >> PAGE_SHIFT);
4479

4480
	return r;
4481
}
4482
EXPORT_SYMBOL_GPL(kvm_mmu_unprotect_page_virt);
4483

4484
static void make_mmu_pages_available(struct kvm_vcpu *vcpu)
A
Avi Kivity 已提交
4485
{
4486
	LIST_HEAD(invalid_list);
4487

4488 4489 4490
	if (likely(kvm_mmu_available_pages(vcpu->kvm) >= KVM_MIN_FREE_MMU_PAGES))
		return;

4491 4492 4493
	while (kvm_mmu_available_pages(vcpu->kvm) < KVM_REFILL_PAGES) {
		if (!prepare_zap_oldest_mmu_page(vcpu->kvm, &invalid_list))
			break;
A
Avi Kivity 已提交
4494

A
Avi Kivity 已提交
4495
		++vcpu->kvm->stat.mmu_recycled;
A
Avi Kivity 已提交
4496
	}
4497
	kvm_mmu_commit_zap_page(vcpu->kvm, &invalid_list);
A
Avi Kivity 已提交
4498 4499
}

4500 4501
int kvm_mmu_page_fault(struct kvm_vcpu *vcpu, gva_t cr2, u32 error_code,
		       void *insn, int insn_len)
4502
{
4503
	int r, emulation_type = EMULTYPE_RETRY;
4504
	enum emulation_result er;
4505
	bool direct = vcpu->arch.mmu.direct_map || mmu_is_nested(vcpu);
4506

4507 4508 4509 4510 4511 4512 4513 4514 4515 4516 4517
	if (unlikely(error_code & PFERR_RSVD_MASK)) {
		r = handle_mmio_page_fault(vcpu, cr2, direct);
		if (r == RET_MMIO_PF_EMULATE) {
			emulation_type = 0;
			goto emulate;
		}
		if (r == RET_MMIO_PF_RETRY)
			return 1;
		if (r < 0)
			return r;
	}
4518

G
Gleb Natapov 已提交
4519
	r = vcpu->arch.mmu.page_fault(vcpu, cr2, error_code, false);
4520
	if (r < 0)
4521 4522 4523
		return r;
	if (!r)
		return 1;
4524

4525
	if (mmio_info_in_cache(vcpu, cr2, direct))
4526
		emulation_type = 0;
4527
emulate:
4528
	er = x86_emulate_instruction(vcpu, cr2, emulation_type, insn, insn_len);
4529 4530 4531 4532

	switch (er) {
	case EMULATE_DONE:
		return 1;
P
Paolo Bonzini 已提交
4533
	case EMULATE_USER_EXIT:
4534
		++vcpu->stat.mmio_exits;
4535
		/* fall through */
4536
	case EMULATE_FAIL:
4537
		return 0;
4538 4539 4540 4541 4542 4543
	default:
		BUG();
	}
}
EXPORT_SYMBOL_GPL(kvm_mmu_page_fault);

M
Marcelo Tosatti 已提交
4544 4545 4546
void kvm_mmu_invlpg(struct kvm_vcpu *vcpu, gva_t gva)
{
	vcpu->arch.mmu.invlpg(vcpu, gva);
4547
	kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu);
M
Marcelo Tosatti 已提交
4548 4549 4550 4551
	++vcpu->stat.invlpg;
}
EXPORT_SYMBOL_GPL(kvm_mmu_invlpg);

4552 4553 4554 4555 4556 4557
void kvm_enable_tdp(void)
{
	tdp_enabled = true;
}
EXPORT_SYMBOL_GPL(kvm_enable_tdp);

4558 4559 4560 4561 4562 4563
void kvm_disable_tdp(void)
{
	tdp_enabled = false;
}
EXPORT_SYMBOL_GPL(kvm_disable_tdp);

A
Avi Kivity 已提交
4564 4565
static void free_mmu_pages(struct kvm_vcpu *vcpu)
{
4566
	free_page((unsigned long)vcpu->arch.mmu.pae_root);
4567 4568
	if (vcpu->arch.mmu.lm_root != NULL)
		free_page((unsigned long)vcpu->arch.mmu.lm_root);
A
Avi Kivity 已提交
4569 4570 4571 4572
}

static int alloc_mmu_pages(struct kvm_vcpu *vcpu)
{
4573
	struct page *page;
A
Avi Kivity 已提交
4574 4575
	int i;

4576 4577 4578 4579 4580 4581 4582
	/*
	 * When emulating 32-bit mode, cr3 is only 32 bits even on x86_64.
	 * Therefore we need to allocate shadow page tables in the first
	 * 4GB of memory, which happens to fit the DMA32 zone.
	 */
	page = alloc_page(GFP_KERNEL | __GFP_DMA32);
	if (!page)
4583 4584
		return -ENOMEM;

4585
	vcpu->arch.mmu.pae_root = page_address(page);
4586
	for (i = 0; i < 4; ++i)
4587
		vcpu->arch.mmu.pae_root[i] = INVALID_PAGE;
4588

A
Avi Kivity 已提交
4589 4590 4591
	return 0;
}

4592
int kvm_mmu_create(struct kvm_vcpu *vcpu)
A
Avi Kivity 已提交
4593
{
4594 4595 4596 4597
	vcpu->arch.walk_mmu = &vcpu->arch.mmu;
	vcpu->arch.mmu.root_hpa = INVALID_PAGE;
	vcpu->arch.mmu.translate_gpa = translate_gpa;
	vcpu->arch.nested_mmu.translate_gpa = translate_nested_gpa;
A
Avi Kivity 已提交
4598

4599 4600
	return alloc_mmu_pages(vcpu);
}
A
Avi Kivity 已提交
4601

4602
void kvm_mmu_setup(struct kvm_vcpu *vcpu)
4603
{
4604
	MMU_WARN_ON(VALID_PAGE(vcpu->arch.mmu.root_hpa));
4605

4606
	init_kvm_mmu(vcpu);
A
Avi Kivity 已提交
4607 4608
}

4609 4610 4611 4612 4613 4614 4615 4616 4617 4618 4619 4620 4621 4622 4623
void kvm_mmu_init_vm(struct kvm *kvm)
{
	struct kvm_page_track_notifier_node *node = &kvm->arch.mmu_sp_tracker;

	node->track_write = kvm_mmu_pte_write;
	kvm_page_track_register_notifier(kvm, node);
}

void kvm_mmu_uninit_vm(struct kvm *kvm)
{
	struct kvm_page_track_notifier_node *node = &kvm->arch.mmu_sp_tracker;

	kvm_page_track_unregister_notifier(kvm, node);
}

4624
/* The return value indicates if tlb flush on all vcpus is needed. */
4625
typedef bool (*slot_level_handler) (struct kvm *kvm, struct kvm_rmap_head *rmap_head);
4626 4627 4628 4629 4630 4631 4632 4633 4634 4635 4636 4637 4638 4639 4640 4641 4642 4643 4644 4645 4646 4647 4648 4649 4650 4651 4652 4653 4654 4655 4656 4657 4658 4659 4660 4661 4662 4663 4664 4665 4666 4667 4668 4669 4670 4671 4672 4673 4674 4675 4676 4677 4678 4679 4680 4681 4682 4683 4684 4685 4686 4687 4688 4689 4690 4691 4692

/* The caller should hold mmu-lock before calling this function. */
static bool
slot_handle_level_range(struct kvm *kvm, struct kvm_memory_slot *memslot,
			slot_level_handler fn, int start_level, int end_level,
			gfn_t start_gfn, gfn_t end_gfn, bool lock_flush_tlb)
{
	struct slot_rmap_walk_iterator iterator;
	bool flush = false;

	for_each_slot_rmap_range(memslot, start_level, end_level, start_gfn,
			end_gfn, &iterator) {
		if (iterator.rmap)
			flush |= fn(kvm, iterator.rmap);

		if (need_resched() || spin_needbreak(&kvm->mmu_lock)) {
			if (flush && lock_flush_tlb) {
				kvm_flush_remote_tlbs(kvm);
				flush = false;
			}
			cond_resched_lock(&kvm->mmu_lock);
		}
	}

	if (flush && lock_flush_tlb) {
		kvm_flush_remote_tlbs(kvm);
		flush = false;
	}

	return flush;
}

static bool
slot_handle_level(struct kvm *kvm, struct kvm_memory_slot *memslot,
		  slot_level_handler fn, int start_level, int end_level,
		  bool lock_flush_tlb)
{
	return slot_handle_level_range(kvm, memslot, fn, start_level,
			end_level, memslot->base_gfn,
			memslot->base_gfn + memslot->npages - 1,
			lock_flush_tlb);
}

static bool
slot_handle_all_level(struct kvm *kvm, struct kvm_memory_slot *memslot,
		      slot_level_handler fn, bool lock_flush_tlb)
{
	return slot_handle_level(kvm, memslot, fn, PT_PAGE_TABLE_LEVEL,
				 PT_MAX_HUGEPAGE_LEVEL, lock_flush_tlb);
}

static bool
slot_handle_large_level(struct kvm *kvm, struct kvm_memory_slot *memslot,
			slot_level_handler fn, bool lock_flush_tlb)
{
	return slot_handle_level(kvm, memslot, fn, PT_PAGE_TABLE_LEVEL + 1,
				 PT_MAX_HUGEPAGE_LEVEL, lock_flush_tlb);
}

static bool
slot_handle_leaf(struct kvm *kvm, struct kvm_memory_slot *memslot,
		 slot_level_handler fn, bool lock_flush_tlb)
{
	return slot_handle_level(kvm, memslot, fn, PT_PAGE_TABLE_LEVEL,
				 PT_PAGE_TABLE_LEVEL, lock_flush_tlb);
}

X
Xiao Guangrong 已提交
4693 4694 4695 4696
void kvm_zap_gfn_range(struct kvm *kvm, gfn_t gfn_start, gfn_t gfn_end)
{
	struct kvm_memslots *slots;
	struct kvm_memory_slot *memslot;
4697
	int i;
X
Xiao Guangrong 已提交
4698 4699

	spin_lock(&kvm->mmu_lock);
4700 4701 4702 4703 4704 4705 4706 4707 4708
	for (i = 0; i < KVM_ADDRESS_SPACE_NUM; i++) {
		slots = __kvm_memslots(kvm, i);
		kvm_for_each_memslot(memslot, slots) {
			gfn_t start, end;

			start = max(gfn_start, memslot->base_gfn);
			end = min(gfn_end, memslot->base_gfn + memslot->npages);
			if (start >= end)
				continue;
X
Xiao Guangrong 已提交
4709

4710 4711 4712 4713
			slot_handle_level_range(kvm, memslot, kvm_zap_rmapp,
						PT_PAGE_TABLE_LEVEL, PT_MAX_HUGEPAGE_LEVEL,
						start, end - 1, true);
		}
X
Xiao Guangrong 已提交
4714 4715 4716 4717 4718
	}

	spin_unlock(&kvm->mmu_lock);
}

4719 4720
static bool slot_rmap_write_protect(struct kvm *kvm,
				    struct kvm_rmap_head *rmap_head)
4721
{
4722
	return __rmap_write_protect(kvm, rmap_head, false);
4723 4724
}

4725 4726
void kvm_mmu_slot_remove_write_access(struct kvm *kvm,
				      struct kvm_memory_slot *memslot)
A
Avi Kivity 已提交
4727
{
4728
	bool flush;
A
Avi Kivity 已提交
4729

4730
	spin_lock(&kvm->mmu_lock);
4731 4732
	flush = slot_handle_all_level(kvm, memslot, slot_rmap_write_protect,
				      false);
4733
	spin_unlock(&kvm->mmu_lock);
4734 4735 4736 4737 4738 4739 4740 4741 4742 4743 4744 4745 4746 4747 4748 4749 4750 4751 4752

	/*
	 * kvm_mmu_slot_remove_write_access() and kvm_vm_ioctl_get_dirty_log()
	 * which do tlb flush out of mmu-lock should be serialized by
	 * kvm->slots_lock otherwise tlb flush would be missed.
	 */
	lockdep_assert_held(&kvm->slots_lock);

	/*
	 * We can flush all the TLBs out of the mmu lock without TLB
	 * corruption since we just change the spte from writable to
	 * readonly so that we only need to care the case of changing
	 * spte from present to present (changing the spte from present
	 * to nonpresent will flush all the TLBs immediately), in other
	 * words, the only case we care is mmu_spte_update() where we
	 * haved checked SPTE_HOST_WRITEABLE | SPTE_MMU_WRITEABLE
	 * instead of PT_WRITABLE_MASK, that means it does not depend
	 * on PT_WRITABLE_MASK anymore.
	 */
4753 4754
	if (flush)
		kvm_flush_remote_tlbs(kvm);
A
Avi Kivity 已提交
4755
}
4756

4757
static bool kvm_mmu_zap_collapsible_spte(struct kvm *kvm,
4758
					 struct kvm_rmap_head *rmap_head)
4759 4760 4761 4762
{
	u64 *sptep;
	struct rmap_iterator iter;
	int need_tlb_flush = 0;
D
Dan Williams 已提交
4763
	kvm_pfn_t pfn;
4764 4765
	struct kvm_mmu_page *sp;

4766
restart:
4767
	for_each_rmap_spte(rmap_head, &iter, sptep) {
4768 4769 4770 4771
		sp = page_header(__pa(sptep));
		pfn = spte_to_pfn(*sptep);

		/*
4772 4773 4774 4775 4776
		 * We cannot do huge page mapping for indirect shadow pages,
		 * which are found on the last rmap (level = 1) when not using
		 * tdp; such shadow pages are synced with the page table in
		 * the guest, and the guest page table is using 4K page size
		 * mapping if the indirect sp has level = 1.
4777 4778 4779 4780 4781 4782
		 */
		if (sp->role.direct &&
			!kvm_is_reserved_pfn(pfn) &&
			PageTransCompound(pfn_to_page(pfn))) {
			drop_spte(kvm, sptep);
			need_tlb_flush = 1;
4783 4784
			goto restart;
		}
4785 4786 4787 4788 4789 4790
	}

	return need_tlb_flush;
}

void kvm_mmu_zap_collapsible_sptes(struct kvm *kvm,
4791
				   const struct kvm_memory_slot *memslot)
4792
{
4793
	/* FIXME: const-ify all uses of struct kvm_memory_slot.  */
4794
	spin_lock(&kvm->mmu_lock);
4795 4796
	slot_handle_leaf(kvm, (struct kvm_memory_slot *)memslot,
			 kvm_mmu_zap_collapsible_spte, true);
4797 4798 4799
	spin_unlock(&kvm->mmu_lock);
}

4800 4801 4802
void kvm_mmu_slot_leaf_clear_dirty(struct kvm *kvm,
				   struct kvm_memory_slot *memslot)
{
4803
	bool flush;
4804 4805

	spin_lock(&kvm->mmu_lock);
4806
	flush = slot_handle_leaf(kvm, memslot, __rmap_clear_dirty, false);
4807 4808 4809 4810 4811 4812 4813 4814 4815 4816 4817 4818 4819 4820 4821 4822 4823 4824
	spin_unlock(&kvm->mmu_lock);

	lockdep_assert_held(&kvm->slots_lock);

	/*
	 * It's also safe to flush TLBs out of mmu lock here as currently this
	 * function is only used for dirty logging, in which case flushing TLB
	 * out of mmu lock also guarantees no dirty pages will be lost in
	 * dirty_bitmap.
	 */
	if (flush)
		kvm_flush_remote_tlbs(kvm);
}
EXPORT_SYMBOL_GPL(kvm_mmu_slot_leaf_clear_dirty);

void kvm_mmu_slot_largepage_remove_write_access(struct kvm *kvm,
					struct kvm_memory_slot *memslot)
{
4825
	bool flush;
4826 4827

	spin_lock(&kvm->mmu_lock);
4828 4829
	flush = slot_handle_large_level(kvm, memslot, slot_rmap_write_protect,
					false);
4830 4831 4832 4833 4834 4835 4836 4837 4838 4839 4840 4841 4842
	spin_unlock(&kvm->mmu_lock);

	/* see kvm_mmu_slot_remove_write_access */
	lockdep_assert_held(&kvm->slots_lock);

	if (flush)
		kvm_flush_remote_tlbs(kvm);
}
EXPORT_SYMBOL_GPL(kvm_mmu_slot_largepage_remove_write_access);

void kvm_mmu_slot_set_dirty(struct kvm *kvm,
			    struct kvm_memory_slot *memslot)
{
4843
	bool flush;
4844 4845

	spin_lock(&kvm->mmu_lock);
4846
	flush = slot_handle_all_level(kvm, memslot, __rmap_set_dirty, false);
4847 4848 4849 4850 4851 4852 4853 4854 4855 4856
	spin_unlock(&kvm->mmu_lock);

	lockdep_assert_held(&kvm->slots_lock);

	/* see kvm_mmu_slot_leaf_clear_dirty */
	if (flush)
		kvm_flush_remote_tlbs(kvm);
}
EXPORT_SYMBOL_GPL(kvm_mmu_slot_set_dirty);

X
Xiao Guangrong 已提交
4857
#define BATCH_ZAP_PAGES	10
4858 4859 4860
static void kvm_zap_obsolete_pages(struct kvm *kvm)
{
	struct kvm_mmu_page *sp, *node;
X
Xiao Guangrong 已提交
4861
	int batch = 0;
4862 4863 4864 4865

restart:
	list_for_each_entry_safe_reverse(sp, node,
	      &kvm->arch.active_mmu_pages, link) {
X
Xiao Guangrong 已提交
4866 4867
		int ret;

4868 4869 4870 4871 4872 4873 4874 4875 4876 4877 4878 4879 4880 4881 4882
		/*
		 * No obsolete page exists before new created page since
		 * active_mmu_pages is the FIFO list.
		 */
		if (!is_obsolete_sp(kvm, sp))
			break;

		/*
		 * Since we are reversely walking the list and the invalid
		 * list will be moved to the head, skip the invalid page
		 * can help us to avoid the infinity list walking.
		 */
		if (sp->role.invalid)
			continue;

4883 4884 4885 4886
		/*
		 * Need not flush tlb since we only zap the sp with invalid
		 * generation number.
		 */
X
Xiao Guangrong 已提交
4887
		if (batch >= BATCH_ZAP_PAGES &&
4888
		      cond_resched_lock(&kvm->mmu_lock)) {
X
Xiao Guangrong 已提交
4889
			batch = 0;
4890 4891 4892
			goto restart;
		}

4893 4894
		ret = kvm_mmu_prepare_zap_page(kvm, sp,
				&kvm->arch.zapped_obsolete_pages);
X
Xiao Guangrong 已提交
4895 4896 4897
		batch += ret;

		if (ret)
4898 4899 4900
			goto restart;
	}

4901 4902 4903 4904
	/*
	 * Should flush tlb before free page tables since lockless-walking
	 * may use the pages.
	 */
4905
	kvm_mmu_commit_zap_page(kvm, &kvm->arch.zapped_obsolete_pages);
4906 4907 4908 4909 4910 4911 4912 4913 4914 4915 4916 4917 4918 4919
}

/*
 * Fast invalidate all shadow pages and use lock-break technique
 * to zap obsolete pages.
 *
 * It's required when memslot is being deleted or VM is being
 * destroyed, in these cases, we should ensure that KVM MMU does
 * not use any resource of the being-deleted slot or all slots
 * after calling the function.
 */
void kvm_mmu_invalidate_zap_all_pages(struct kvm *kvm)
{
	spin_lock(&kvm->mmu_lock);
4920
	trace_kvm_mmu_invalidate_zap_all_pages(kvm);
4921 4922
	kvm->arch.mmu_valid_gen++;

4923 4924 4925 4926 4927 4928 4929 4930 4931 4932 4933
	/*
	 * Notify all vcpus to reload its shadow page table
	 * and flush TLB. Then all vcpus will switch to new
	 * shadow page table with the new mmu_valid_gen.
	 *
	 * Note: we should do this under the protection of
	 * mmu-lock, otherwise, vcpu would purge shadow page
	 * but miss tlb flush.
	 */
	kvm_reload_remote_mmus(kvm);

4934 4935 4936 4937
	kvm_zap_obsolete_pages(kvm);
	spin_unlock(&kvm->mmu_lock);
}

4938 4939 4940 4941 4942
static bool kvm_has_zapped_obsolete_pages(struct kvm *kvm)
{
	return unlikely(!list_empty_careful(&kvm->arch.zapped_obsolete_pages));
}

4943
void kvm_mmu_invalidate_mmio_sptes(struct kvm *kvm, struct kvm_memslots *slots)
4944 4945 4946 4947 4948
{
	/*
	 * The very rare case: if the generation-number is round,
	 * zap all shadow pages.
	 */
4949
	if (unlikely((slots->generation & MMIO_GEN_MASK) == 0)) {
4950
		printk_ratelimited(KERN_DEBUG "kvm: zapping shadow pages for mmio generation wraparound\n");
4951
		kvm_mmu_invalidate_zap_all_pages(kvm);
4952
	}
4953 4954
}

4955 4956
static unsigned long
mmu_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
4957 4958
{
	struct kvm *kvm;
4959
	int nr_to_scan = sc->nr_to_scan;
4960
	unsigned long freed = 0;
4961

4962
	spin_lock(&kvm_lock);
4963 4964

	list_for_each_entry(kvm, &vm_list, vm_list) {
4965
		int idx;
4966
		LIST_HEAD(invalid_list);
4967

4968 4969 4970 4971 4972 4973 4974 4975
		/*
		 * Never scan more than sc->nr_to_scan VM instances.
		 * Will not hit this condition practically since we do not try
		 * to shrink more than one VM and it is very unlikely to see
		 * !n_used_mmu_pages so many times.
		 */
		if (!nr_to_scan--)
			break;
4976 4977 4978 4979 4980 4981
		/*
		 * n_used_mmu_pages is accessed without holding kvm->mmu_lock
		 * here. We may skip a VM instance errorneosly, but we do not
		 * want to shrink a VM that only started to populate its MMU
		 * anyway.
		 */
4982 4983
		if (!kvm->arch.n_used_mmu_pages &&
		      !kvm_has_zapped_obsolete_pages(kvm))
4984 4985
			continue;

4986
		idx = srcu_read_lock(&kvm->srcu);
4987 4988
		spin_lock(&kvm->mmu_lock);

4989 4990 4991 4992 4993 4994
		if (kvm_has_zapped_obsolete_pages(kvm)) {
			kvm_mmu_commit_zap_page(kvm,
			      &kvm->arch.zapped_obsolete_pages);
			goto unlock;
		}

4995 4996
		if (prepare_zap_oldest_mmu_page(kvm, &invalid_list))
			freed++;
4997
		kvm_mmu_commit_zap_page(kvm, &invalid_list);
4998

4999
unlock:
5000
		spin_unlock(&kvm->mmu_lock);
5001
		srcu_read_unlock(&kvm->srcu, idx);
5002

5003 5004 5005 5006 5007
		/*
		 * unfair on small ones
		 * per-vm shrinkers cry out
		 * sadness comes quickly
		 */
5008 5009
		list_move_tail(&kvm->vm_list, &vm_list);
		break;
5010 5011
	}

5012
	spin_unlock(&kvm_lock);
5013 5014 5015 5016 5017 5018
	return freed;
}

static unsigned long
mmu_shrink_count(struct shrinker *shrink, struct shrink_control *sc)
{
5019
	return percpu_counter_read_positive(&kvm_total_used_mmu_pages);
5020 5021 5022
}

static struct shrinker mmu_shrinker = {
5023 5024
	.count_objects = mmu_shrink_count,
	.scan_objects = mmu_shrink_scan,
5025 5026 5027
	.seeks = DEFAULT_SEEKS * 10,
};

I
Ingo Molnar 已提交
5028
static void mmu_destroy_caches(void)
5029
{
5030 5031
	if (pte_list_desc_cache)
		kmem_cache_destroy(pte_list_desc_cache);
5032 5033
	if (mmu_page_header_cache)
		kmem_cache_destroy(mmu_page_header_cache);
5034 5035 5036 5037
}

int kvm_mmu_module_init(void)
{
5038 5039
	pte_list_desc_cache = kmem_cache_create("pte_list_desc",
					    sizeof(struct pte_list_desc),
5040
					    0, 0, NULL);
5041
	if (!pte_list_desc_cache)
5042 5043
		goto nomem;

5044 5045
	mmu_page_header_cache = kmem_cache_create("kvm_mmu_page_header",
						  sizeof(struct kvm_mmu_page),
5046
						  0, 0, NULL);
5047 5048 5049
	if (!mmu_page_header_cache)
		goto nomem;

5050
	if (percpu_counter_init(&kvm_total_used_mmu_pages, 0, GFP_KERNEL))
5051 5052
		goto nomem;

5053 5054
	register_shrinker(&mmu_shrinker);

5055 5056 5057
	return 0;

nomem:
5058
	mmu_destroy_caches();
5059 5060 5061
	return -ENOMEM;
}

5062 5063 5064 5065 5066 5067 5068
/*
 * Caculate mmu pages needed for kvm.
 */
unsigned int kvm_mmu_calculate_mmu_pages(struct kvm *kvm)
{
	unsigned int nr_mmu_pages;
	unsigned int  nr_pages = 0;
5069
	struct kvm_memslots *slots;
5070
	struct kvm_memory_slot *memslot;
5071
	int i;
5072

5073 5074
	for (i = 0; i < KVM_ADDRESS_SPACE_NUM; i++) {
		slots = __kvm_memslots(kvm, i);
5075

5076 5077 5078
		kvm_for_each_memslot(memslot, slots)
			nr_pages += memslot->npages;
	}
5079 5080 5081

	nr_mmu_pages = nr_pages * KVM_PERMILLE_MMU_PAGES / 1000;
	nr_mmu_pages = max(nr_mmu_pages,
5082
			   (unsigned int) KVM_MIN_ALLOC_MMU_PAGES);
5083 5084 5085 5086

	return nr_mmu_pages;
}

5087 5088
void kvm_mmu_destroy(struct kvm_vcpu *vcpu)
{
5089
	kvm_mmu_unload(vcpu);
5090 5091
	free_mmu_pages(vcpu);
	mmu_free_memory_caches(vcpu);
5092 5093 5094 5095 5096 5097 5098
}

void kvm_mmu_module_exit(void)
{
	mmu_destroy_caches();
	percpu_counter_destroy(&kvm_total_used_mmu_pages);
	unregister_shrinker(&mmu_shrinker);
5099 5100
	mmu_audit_disable();
}