mmu.c 126.0 KB
Newer Older
A
Avi Kivity 已提交
1 2 3 4 5 6 7 8 9
/*
 * Kernel-based Virtual Machine driver for Linux
 *
 * This module enables machines with Intel VT-x extensions to run virtual
 * machines without emulation or binary translation.
 *
 * MMU support
 *
 * Copyright (C) 2006 Qumranet, Inc.
N
Nicolas Kaiser 已提交
10
 * Copyright 2010 Red Hat, Inc. and/or its affiliates.
A
Avi Kivity 已提交
11 12 13 14 15 16 17 18 19
 *
 * Authors:
 *   Yaniv Kamay  <yaniv@qumranet.com>
 *   Avi Kivity   <avi@qumranet.com>
 *
 * This work is licensed under the terms of the GNU GPL, version 2.  See
 * the COPYING file in the top-level directory.
 *
 */
A
Avi Kivity 已提交
20

21
#include "irq.h"
22
#include "mmu.h"
23
#include "x86.h"
A
Avi Kivity 已提交
24
#include "kvm_cache_regs.h"
25
#include "cpuid.h"
A
Avi Kivity 已提交
26

27
#include <linux/kvm_host.h>
A
Avi Kivity 已提交
28 29 30 31 32
#include <linux/types.h>
#include <linux/string.h>
#include <linux/mm.h>
#include <linux/highmem.h>
#include <linux/module.h>
33
#include <linux/swap.h>
M
Marcelo Tosatti 已提交
34
#include <linux/hugetlb.h>
35
#include <linux/compiler.h>
36
#include <linux/srcu.h>
37
#include <linux/slab.h>
38
#include <linux/uaccess.h>
A
Avi Kivity 已提交
39

A
Avi Kivity 已提交
40 41
#include <asm/page.h>
#include <asm/cmpxchg.h>
42
#include <asm/io.h>
43
#include <asm/vmx.h>
44
#include <asm/kvm_page_track.h>
A
Avi Kivity 已提交
45

46 47 48 49 50 51 52
/*
 * When setting this variable to true it enables Two-Dimensional-Paging
 * where the hardware walks 2 page tables:
 * 1. the guest-virtual to guest-physical
 * 2. while doing 1. it walks guest-physical to host-physical
 * If the hardware supports that we don't need to do shadow paging.
 */
53
bool tdp_enabled = false;
54

55 56 57 58
enum {
	AUDIT_PRE_PAGE_FAULT,
	AUDIT_POST_PAGE_FAULT,
	AUDIT_PRE_PTE_WRITE,
59 60 61
	AUDIT_POST_PTE_WRITE,
	AUDIT_PRE_SYNC,
	AUDIT_POST_SYNC
62
};
63

64
#undef MMU_DEBUG
65 66

#ifdef MMU_DEBUG
67 68
static bool dbg = 0;
module_param(dbg, bool, 0644);
69 70 71

#define pgprintk(x...) do { if (dbg) printk(x); } while (0)
#define rmap_printk(x...) do { if (dbg) printk(x); } while (0)
72
#define MMU_WARN_ON(x) WARN_ON(x)
73 74 75
#else
#define pgprintk(x...) do { } while (0)
#define rmap_printk(x...) do { } while (0)
76
#define MMU_WARN_ON(x) do { } while (0)
77
#endif
A
Avi Kivity 已提交
78

79 80
#define PTE_PREFETCH_NUM		8

81
#define PT_FIRST_AVAIL_BITS_SHIFT 10
A
Avi Kivity 已提交
82 83 84 85 86
#define PT64_SECOND_AVAIL_BITS_SHIFT 52

#define PT64_LEVEL_BITS 9

#define PT64_LEVEL_SHIFT(level) \
M
Mike Day 已提交
87
		(PAGE_SHIFT + (level - 1) * PT64_LEVEL_BITS)
A
Avi Kivity 已提交
88 89 90 91 92 93 94 95

#define PT64_INDEX(address, level)\
	(((address) >> PT64_LEVEL_SHIFT(level)) & ((1 << PT64_LEVEL_BITS) - 1))


#define PT32_LEVEL_BITS 10

#define PT32_LEVEL_SHIFT(level) \
M
Mike Day 已提交
96
		(PAGE_SHIFT + (level - 1) * PT32_LEVEL_BITS)
A
Avi Kivity 已提交
97

98 99 100
#define PT32_LVL_OFFSET_MASK(level) \
	(PT32_BASE_ADDR_MASK & ((1ULL << (PAGE_SHIFT + (((level) - 1) \
						* PT32_LEVEL_BITS))) - 1))
A
Avi Kivity 已提交
101 102 103 104 105

#define PT32_INDEX(address, level)\
	(((address) >> PT32_LEVEL_SHIFT(level)) & ((1 << PT32_LEVEL_BITS) - 1))


106
#define PT64_BASE_ADDR_MASK (((1ULL << 52) - 1) & ~(u64)(PAGE_SIZE-1))
A
Avi Kivity 已提交
107 108
#define PT64_DIR_BASE_ADDR_MASK \
	(PT64_BASE_ADDR_MASK & ~((1ULL << (PAGE_SHIFT + PT64_LEVEL_BITS)) - 1))
109 110 111 112 113 114
#define PT64_LVL_ADDR_MASK(level) \
	(PT64_BASE_ADDR_MASK & ~((1ULL << (PAGE_SHIFT + (((level) - 1) \
						* PT64_LEVEL_BITS))) - 1))
#define PT64_LVL_OFFSET_MASK(level) \
	(PT64_BASE_ADDR_MASK & ((1ULL << (PAGE_SHIFT + (((level) - 1) \
						* PT64_LEVEL_BITS))) - 1))
A
Avi Kivity 已提交
115 116 117 118

#define PT32_BASE_ADDR_MASK PAGE_MASK
#define PT32_DIR_BASE_ADDR_MASK \
	(PAGE_MASK & ~((1ULL << (PAGE_SHIFT + PT32_LEVEL_BITS)) - 1))
119 120 121
#define PT32_LVL_ADDR_MASK(level) \
	(PAGE_MASK & ~((1ULL << (PAGE_SHIFT + (((level) - 1) \
					    * PT32_LEVEL_BITS))) - 1))
A
Avi Kivity 已提交
122

123 124
#define PT64_PERM_MASK (PT_PRESENT_MASK | PT_WRITABLE_MASK | shadow_user_mask \
			| shadow_x_mask | shadow_nx_mask)
A
Avi Kivity 已提交
125

126 127 128 129 130
#define ACC_EXEC_MASK    1
#define ACC_WRITE_MASK   PT_WRITABLE_MASK
#define ACC_USER_MASK    PT_USER_MASK
#define ACC_ALL          (ACC_EXEC_MASK | ACC_WRITE_MASK | ACC_USER_MASK)

131 132
#include <trace/events/kvm.h>

133 134 135
#define CREATE_TRACE_POINTS
#include "mmutrace.h"

136 137
#define SPTE_HOST_WRITEABLE	(1ULL << PT_FIRST_AVAIL_BITS_SHIFT)
#define SPTE_MMU_WRITEABLE	(1ULL << (PT_FIRST_AVAIL_BITS_SHIFT + 1))
138

139 140
#define SHADOW_PT_INDEX(addr, level) PT64_INDEX(addr, level)

141 142 143
/* make pte_list_desc fit well in cache line */
#define PTE_LIST_EXT 3

144 145 146
struct pte_list_desc {
	u64 *sptes[PTE_LIST_EXT];
	struct pte_list_desc *more;
147 148
};

149 150 151 152
struct kvm_shadow_walk_iterator {
	u64 addr;
	hpa_t shadow_addr;
	u64 *sptep;
153
	int level;
154 155 156 157 158 159 160 161
	unsigned index;
};

#define for_each_shadow_entry(_vcpu, _addr, _walker)    \
	for (shadow_walk_init(&(_walker), _vcpu, _addr);	\
	     shadow_walk_okay(&(_walker));			\
	     shadow_walk_next(&(_walker)))

162 163 164 165 166 167
#define for_each_shadow_entry_lockless(_vcpu, _addr, _walker, spte)	\
	for (shadow_walk_init(&(_walker), _vcpu, _addr);		\
	     shadow_walk_okay(&(_walker)) &&				\
		({ spte = mmu_spte_get_lockless(_walker.sptep); 1; });	\
	     __shadow_walk_next(&(_walker), spte))

168
static struct kmem_cache *pte_list_desc_cache;
169
static struct kmem_cache *mmu_page_header_cache;
170
static struct percpu_counter kvm_total_used_mmu_pages;
171

S
Sheng Yang 已提交
172 173 174 175 176
static u64 __read_mostly shadow_nx_mask;
static u64 __read_mostly shadow_x_mask;	/* mutual exclusive with nx_mask */
static u64 __read_mostly shadow_user_mask;
static u64 __read_mostly shadow_accessed_mask;
static u64 __read_mostly shadow_dirty_mask;
177 178 179
static u64 __read_mostly shadow_mmio_mask;

static void mmu_spte_set(u64 *sptep, u64 spte);
180
static void mmu_free_roots(struct kvm_vcpu *vcpu);
181 182 183 184 185 186 187

void kvm_mmu_set_mmio_spte_mask(u64 mmio_mask)
{
	shadow_mmio_mask = mmio_mask;
}
EXPORT_SYMBOL_GPL(kvm_mmu_set_mmio_spte_mask);

188
/*
189 190 191 192 193 194 195
 * the low bit of the generation number is always presumed to be zero.
 * This disables mmio caching during memslot updates.  The concept is
 * similar to a seqcount but instead of retrying the access we just punt
 * and ignore the cache.
 *
 * spte bits 3-11 are used as bits 1-9 of the generation number,
 * the bits 52-61 are used as bits 10-19 of the generation number.
196
 */
197
#define MMIO_SPTE_GEN_LOW_SHIFT		2
198 199
#define MMIO_SPTE_GEN_HIGH_SHIFT	52

200 201 202
#define MMIO_GEN_SHIFT			20
#define MMIO_GEN_LOW_SHIFT		10
#define MMIO_GEN_LOW_MASK		((1 << MMIO_GEN_LOW_SHIFT) - 2)
203
#define MMIO_GEN_MASK			((1 << MMIO_GEN_SHIFT) - 1)
204 205 206 207 208

static u64 generation_mmio_spte_mask(unsigned int gen)
{
	u64 mask;

T
Tiejun Chen 已提交
209
	WARN_ON(gen & ~MMIO_GEN_MASK);
210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226

	mask = (gen & MMIO_GEN_LOW_MASK) << MMIO_SPTE_GEN_LOW_SHIFT;
	mask |= ((u64)gen >> MMIO_GEN_LOW_SHIFT) << MMIO_SPTE_GEN_HIGH_SHIFT;
	return mask;
}

static unsigned int get_mmio_spte_generation(u64 spte)
{
	unsigned int gen;

	spte &= ~shadow_mmio_mask;

	gen = (spte >> MMIO_SPTE_GEN_LOW_SHIFT) & MMIO_GEN_LOW_MASK;
	gen |= (spte >> MMIO_SPTE_GEN_HIGH_SHIFT) << MMIO_GEN_LOW_SHIFT;
	return gen;
}

227
static unsigned int kvm_current_mmio_generation(struct kvm_vcpu *vcpu)
228
{
229
	return kvm_vcpu_memslots(vcpu)->generation & MMIO_GEN_MASK;
230 231
}

232
static void mark_mmio_spte(struct kvm_vcpu *vcpu, u64 *sptep, u64 gfn,
233
			   unsigned access)
234
{
235
	unsigned int gen = kvm_current_mmio_generation(vcpu);
236
	u64 mask = generation_mmio_spte_mask(gen);
237

238
	access &= ACC_WRITE_MASK | ACC_USER_MASK;
239 240
	mask |= shadow_mmio_mask | access | gfn << PAGE_SHIFT;

241
	trace_mark_mmio_spte(sptep, gfn, access, gen);
242
	mmu_spte_set(sptep, mask);
243 244 245 246 247 248 249 250 251
}

static bool is_mmio_spte(u64 spte)
{
	return (spte & shadow_mmio_mask) == shadow_mmio_mask;
}

static gfn_t get_mmio_spte_gfn(u64 spte)
{
T
Tiejun Chen 已提交
252
	u64 mask = generation_mmio_spte_mask(MMIO_GEN_MASK) | shadow_mmio_mask;
253
	return (spte & ~mask) >> PAGE_SHIFT;
254 255 256 257
}

static unsigned get_mmio_spte_access(u64 spte)
{
T
Tiejun Chen 已提交
258
	u64 mask = generation_mmio_spte_mask(MMIO_GEN_MASK) | shadow_mmio_mask;
259
	return (spte & ~mask) & ~PAGE_MASK;
260 261
}

262
static bool set_mmio_spte(struct kvm_vcpu *vcpu, u64 *sptep, gfn_t gfn,
D
Dan Williams 已提交
263
			  kvm_pfn_t pfn, unsigned access)
264 265
{
	if (unlikely(is_noslot_pfn(pfn))) {
266
		mark_mmio_spte(vcpu, sptep, gfn, access);
267 268 269 270 271
		return true;
	}

	return false;
}
272

273
static bool check_mmio_spte(struct kvm_vcpu *vcpu, u64 spte)
274
{
275 276
	unsigned int kvm_gen, spte_gen;

277
	kvm_gen = kvm_current_mmio_generation(vcpu);
278 279 280 281
	spte_gen = get_mmio_spte_generation(spte);

	trace_check_mmio_spte(spte, kvm_gen, spte_gen);
	return likely(kvm_gen == spte_gen);
282 283
}

S
Sheng Yang 已提交
284
void kvm_mmu_set_mask_ptes(u64 user_mask, u64 accessed_mask,
285
		u64 dirty_mask, u64 nx_mask, u64 x_mask)
S
Sheng Yang 已提交
286 287 288 289 290 291 292 293 294
{
	shadow_user_mask = user_mask;
	shadow_accessed_mask = accessed_mask;
	shadow_dirty_mask = dirty_mask;
	shadow_nx_mask = nx_mask;
	shadow_x_mask = x_mask;
}
EXPORT_SYMBOL_GPL(kvm_mmu_set_mask_ptes);

A
Avi Kivity 已提交
295 296 297 298 299
static int is_cpuid_PSE36(void)
{
	return 1;
}

300 301
static int is_nx(struct kvm_vcpu *vcpu)
{
302
	return vcpu->arch.efer & EFER_NX;
303 304
}

305 306
static int is_shadow_present_pte(u64 pte)
{
307
	return pte & PT_PRESENT_MASK && !is_mmio_spte(pte);
308 309
}

M
Marcelo Tosatti 已提交
310 311 312 313 314
static int is_large_pte(u64 pte)
{
	return pte & PT_PAGE_SIZE_MASK;
}

315 316 317 318
static int is_last_spte(u64 pte, int level)
{
	if (level == PT_PAGE_TABLE_LEVEL)
		return 1;
319
	if (is_large_pte(pte))
320 321 322 323
		return 1;
	return 0;
}

D
Dan Williams 已提交
324
static kvm_pfn_t spte_to_pfn(u64 pte)
325
{
326
	return (pte & PT64_BASE_ADDR_MASK) >> PAGE_SHIFT;
327 328
}

329 330 331 332 333 334 335
static gfn_t pse36_gfn_delta(u32 gpte)
{
	int shift = 32 - PT32_DIR_PSE36_SHIFT - PAGE_SHIFT;

	return (gpte & PT32_DIR_PSE36_MASK) << shift;
}

336
#ifdef CONFIG_X86_64
A
Avi Kivity 已提交
337
static void __set_spte(u64 *sptep, u64 spte)
338
{
339
	*sptep = spte;
340 341
}

342
static void __update_clear_spte_fast(u64 *sptep, u64 spte)
343
{
344 345 346 347 348 349 350
	*sptep = spte;
}

static u64 __update_clear_spte_slow(u64 *sptep, u64 spte)
{
	return xchg(sptep, spte);
}
351 352 353 354 355

static u64 __get_spte_lockless(u64 *sptep)
{
	return ACCESS_ONCE(*sptep);
}
356
#else
357 358 359 360 361 362 363
union split_spte {
	struct {
		u32 spte_low;
		u32 spte_high;
	};
	u64 spte;
};
364

365 366 367 368 369 370 371 372 373 374 375 376
static void count_spte_clear(u64 *sptep, u64 spte)
{
	struct kvm_mmu_page *sp =  page_header(__pa(sptep));

	if (is_shadow_present_pte(spte))
		return;

	/* Ensure the spte is completely set before we increase the count */
	smp_wmb();
	sp->clear_spte_count++;
}

377 378 379
static void __set_spte(u64 *sptep, u64 spte)
{
	union split_spte *ssptep, sspte;
380

381 382 383 384 385 386 387 388 389 390 391 392 393
	ssptep = (union split_spte *)sptep;
	sspte = (union split_spte)spte;

	ssptep->spte_high = sspte.spte_high;

	/*
	 * If we map the spte from nonpresent to present, We should store
	 * the high bits firstly, then set present bit, so cpu can not
	 * fetch this spte while we are setting the spte.
	 */
	smp_wmb();

	ssptep->spte_low = sspte.spte_low;
394 395
}

396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411
static void __update_clear_spte_fast(u64 *sptep, u64 spte)
{
	union split_spte *ssptep, sspte;

	ssptep = (union split_spte *)sptep;
	sspte = (union split_spte)spte;

	ssptep->spte_low = sspte.spte_low;

	/*
	 * If we map the spte from present to nonpresent, we should clear
	 * present bit firstly to avoid vcpu fetch the old high bits.
	 */
	smp_wmb();

	ssptep->spte_high = sspte.spte_high;
412
	count_spte_clear(sptep, spte);
413 414 415 416 417 418 419 420 421 422 423
}

static u64 __update_clear_spte_slow(u64 *sptep, u64 spte)
{
	union split_spte *ssptep, sspte, orig;

	ssptep = (union split_spte *)sptep;
	sspte = (union split_spte)spte;

	/* xchg acts as a barrier before the setting of the high bits */
	orig.spte_low = xchg(&ssptep->spte_low, sspte.spte_low);
424 425
	orig.spte_high = ssptep->spte_high;
	ssptep->spte_high = sspte.spte_high;
426
	count_spte_clear(sptep, spte);
427 428 429

	return orig.spte;
}
430 431 432 433

/*
 * The idea using the light way get the spte on x86_32 guest is from
 * gup_get_pte(arch/x86/mm/gup.c).
434 435 436 437 438 439 440 441 442 443 444 445 446 447
 *
 * An spte tlb flush may be pending, because kvm_set_pte_rmapp
 * coalesces them and we are running out of the MMU lock.  Therefore
 * we need to protect against in-progress updates of the spte.
 *
 * Reading the spte while an update is in progress may get the old value
 * for the high part of the spte.  The race is fine for a present->non-present
 * change (because the high part of the spte is ignored for non-present spte),
 * but for a present->present change we must reread the spte.
 *
 * All such changes are done in two steps (present->non-present and
 * non-present->present), hence it is enough to count the number of
 * present->non-present updates: if it changed while reading the spte,
 * we might have hit the race.  This is done using clear_spte_count.
448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470
 */
static u64 __get_spte_lockless(u64 *sptep)
{
	struct kvm_mmu_page *sp =  page_header(__pa(sptep));
	union split_spte spte, *orig = (union split_spte *)sptep;
	int count;

retry:
	count = sp->clear_spte_count;
	smp_rmb();

	spte.spte_low = orig->spte_low;
	smp_rmb();

	spte.spte_high = orig->spte_high;
	smp_rmb();

	if (unlikely(spte.spte_low != orig->spte_low ||
	      count != sp->clear_spte_count))
		goto retry;

	return spte.spte;
}
471 472
#endif

473 474
static bool spte_is_locklessly_modifiable(u64 spte)
{
475 476
	return (spte & (SPTE_HOST_WRITEABLE | SPTE_MMU_WRITEABLE)) ==
		(SPTE_HOST_WRITEABLE | SPTE_MMU_WRITEABLE);
477 478
}

479 480
static bool spte_has_volatile_bits(u64 spte)
{
481 482 483 484 485 486 487 488 489
	/*
	 * Always atomicly update spte if it can be updated
	 * out of mmu-lock, it can ensure dirty bit is not lost,
	 * also, it can help us to get a stable is_writable_pte()
	 * to ensure tlb flush is not missed.
	 */
	if (spte_is_locklessly_modifiable(spte))
		return true;

490 491 492 493 494 495
	if (!shadow_accessed_mask)
		return false;

	if (!is_shadow_present_pte(spte))
		return false;

496 497
	if ((spte & shadow_accessed_mask) &&
	      (!is_writable_pte(spte) || (spte & shadow_dirty_mask)))
498 499 500 501 502
		return false;

	return true;
}

503 504 505 506 507
static bool spte_is_bit_cleared(u64 old_spte, u64 new_spte, u64 bit_mask)
{
	return (old_spte & bit_mask) && !(new_spte & bit_mask);
}

508 509 510 511 512
static bool spte_is_bit_changed(u64 old_spte, u64 new_spte, u64 bit_mask)
{
	return (old_spte & bit_mask) != (new_spte & bit_mask);
}

513 514 515 516 517 518 519 520 521 522 523 524 525 526
/* Rules for using mmu_spte_set:
 * Set the sptep from nonpresent to present.
 * Note: the sptep being assigned *must* be either not present
 * or in a state where the hardware will not attempt to update
 * the spte.
 */
static void mmu_spte_set(u64 *sptep, u64 new_spte)
{
	WARN_ON(is_shadow_present_pte(*sptep));
	__set_spte(sptep, new_spte);
}

/* Rules for using mmu_spte_update:
 * Update the state bits, it means the mapped pfn is not changged.
527 528 529 530 531 532
 *
 * Whenever we overwrite a writable spte with a read-only one we
 * should flush remote TLBs. Otherwise rmap_write_protect
 * will find a read-only spte, even though the writable spte
 * might be cached on a CPU's TLB, the return value indicates this
 * case.
533
 */
534
static bool mmu_spte_update(u64 *sptep, u64 new_spte)
535
{
536
	u64 old_spte = *sptep;
537
	bool ret = false;
538

539
	WARN_ON(!is_shadow_present_pte(new_spte));
540

541 542 543 544
	if (!is_shadow_present_pte(old_spte)) {
		mmu_spte_set(sptep, new_spte);
		return ret;
	}
545

546
	if (!spte_has_volatile_bits(old_spte))
547
		__update_clear_spte_fast(sptep, new_spte);
548
	else
549
		old_spte = __update_clear_spte_slow(sptep, new_spte);
550

551 552 553 554 555
	/*
	 * For the spte updated out of mmu-lock is safe, since
	 * we always atomicly update it, see the comments in
	 * spte_has_volatile_bits().
	 */
556 557
	if (spte_is_locklessly_modifiable(old_spte) &&
	      !is_writable_pte(new_spte))
558 559
		ret = true;

560
	if (!shadow_accessed_mask)
561
		return ret;
562

563 564 565 566 567 568 569 570
	/*
	 * Flush TLB when accessed/dirty bits are changed in the page tables,
	 * to guarantee consistency between TLB and page tables.
	 */
	if (spte_is_bit_changed(old_spte, new_spte,
                                shadow_accessed_mask | shadow_dirty_mask))
		ret = true;

571 572 573 574
	if (spte_is_bit_cleared(old_spte, new_spte, shadow_accessed_mask))
		kvm_set_pfn_accessed(spte_to_pfn(old_spte));
	if (spte_is_bit_cleared(old_spte, new_spte, shadow_dirty_mask))
		kvm_set_pfn_dirty(spte_to_pfn(old_spte));
575 576

	return ret;
577 578
}

579 580 581 582 583 584 585
/*
 * Rules for using mmu_spte_clear_track_bits:
 * It sets the sptep from present to nonpresent, and track the
 * state bits, it is used to clear the last level sptep.
 */
static int mmu_spte_clear_track_bits(u64 *sptep)
{
D
Dan Williams 已提交
586
	kvm_pfn_t pfn;
587 588 589
	u64 old_spte = *sptep;

	if (!spte_has_volatile_bits(old_spte))
590
		__update_clear_spte_fast(sptep, 0ull);
591
	else
592
		old_spte = __update_clear_spte_slow(sptep, 0ull);
593

594
	if (!is_shadow_present_pte(old_spte))
595 596 597
		return 0;

	pfn = spte_to_pfn(old_spte);
598 599 600 601 602 603

	/*
	 * KVM does not hold the refcount of the page used by
	 * kvm mmu, before reclaiming the page, we should
	 * unmap it from mmu first.
	 */
604
	WARN_ON(!kvm_is_reserved_pfn(pfn) && !page_count(pfn_to_page(pfn)));
605

606 607 608 609 610 611 612 613 614 615 616 617 618 619
	if (!shadow_accessed_mask || old_spte & shadow_accessed_mask)
		kvm_set_pfn_accessed(pfn);
	if (!shadow_dirty_mask || (old_spte & shadow_dirty_mask))
		kvm_set_pfn_dirty(pfn);
	return 1;
}

/*
 * Rules for using mmu_spte_clear_no_track:
 * Directly clear spte without caring the state bits of sptep,
 * it is used to set the upper level spte.
 */
static void mmu_spte_clear_no_track(u64 *sptep)
{
620
	__update_clear_spte_fast(sptep, 0ull);
621 622
}

623 624 625 626 627 628 629
static u64 mmu_spte_get_lockless(u64 *sptep)
{
	return __get_spte_lockless(sptep);
}

static void walk_shadow_page_lockless_begin(struct kvm_vcpu *vcpu)
{
630 631 632 633 634 635 636 637 638 639 640
	/*
	 * Prevent page table teardown by making any free-er wait during
	 * kvm_flush_remote_tlbs() IPI to all active vcpus.
	 */
	local_irq_disable();
	vcpu->mode = READING_SHADOW_PAGE_TABLES;
	/*
	 * Make sure a following spte read is not reordered ahead of the write
	 * to vcpu->mode.
	 */
	smp_mb();
641 642 643 644
}

static void walk_shadow_page_lockless_end(struct kvm_vcpu *vcpu)
{
645 646 647 648 649 650 651 652
	/*
	 * Make sure the write to vcpu->mode is not reordered in front of
	 * reads to sptes.  If it does, kvm_commit_zap_page() can see us
	 * OUTSIDE_GUEST_MODE and proceed to free the shadow page table.
	 */
	smp_mb();
	vcpu->mode = OUTSIDE_GUEST_MODE;
	local_irq_enable();
653 654
}

655
static int mmu_topup_memory_cache(struct kvm_mmu_memory_cache *cache,
656
				  struct kmem_cache *base_cache, int min)
657 658 659 660
{
	void *obj;

	if (cache->nobjs >= min)
661
		return 0;
662
	while (cache->nobjs < ARRAY_SIZE(cache->objects)) {
663
		obj = kmem_cache_zalloc(base_cache, GFP_KERNEL);
664
		if (!obj)
665
			return -ENOMEM;
666 667
		cache->objects[cache->nobjs++] = obj;
	}
668
	return 0;
669 670
}

671 672 673 674 675
static int mmu_memory_cache_free_objects(struct kvm_mmu_memory_cache *cache)
{
	return cache->nobjs;
}

676 677
static void mmu_free_memory_cache(struct kvm_mmu_memory_cache *mc,
				  struct kmem_cache *cache)
678 679
{
	while (mc->nobjs)
680
		kmem_cache_free(cache, mc->objects[--mc->nobjs]);
681 682
}

A
Avi Kivity 已提交
683
static int mmu_topup_memory_cache_page(struct kvm_mmu_memory_cache *cache,
684
				       int min)
A
Avi Kivity 已提交
685
{
686
	void *page;
A
Avi Kivity 已提交
687 688 689 690

	if (cache->nobjs >= min)
		return 0;
	while (cache->nobjs < ARRAY_SIZE(cache->objects)) {
691
		page = (void *)__get_free_page(GFP_KERNEL);
A
Avi Kivity 已提交
692 693
		if (!page)
			return -ENOMEM;
694
		cache->objects[cache->nobjs++] = page;
A
Avi Kivity 已提交
695 696 697 698 699 700 701
	}
	return 0;
}

static void mmu_free_memory_cache_page(struct kvm_mmu_memory_cache *mc)
{
	while (mc->nobjs)
702
		free_page((unsigned long)mc->objects[--mc->nobjs]);
A
Avi Kivity 已提交
703 704
}

705
static int mmu_topup_memory_caches(struct kvm_vcpu *vcpu)
706
{
707 708
	int r;

709
	r = mmu_topup_memory_cache(&vcpu->arch.mmu_pte_list_desc_cache,
710
				   pte_list_desc_cache, 8 + PTE_PREFETCH_NUM);
711 712
	if (r)
		goto out;
713
	r = mmu_topup_memory_cache_page(&vcpu->arch.mmu_page_cache, 8);
714 715
	if (r)
		goto out;
716
	r = mmu_topup_memory_cache(&vcpu->arch.mmu_page_header_cache,
717
				   mmu_page_header_cache, 4);
718 719
out:
	return r;
720 721 722 723
}

static void mmu_free_memory_caches(struct kvm_vcpu *vcpu)
{
724 725
	mmu_free_memory_cache(&vcpu->arch.mmu_pte_list_desc_cache,
				pte_list_desc_cache);
726
	mmu_free_memory_cache_page(&vcpu->arch.mmu_page_cache);
727 728
	mmu_free_memory_cache(&vcpu->arch.mmu_page_header_cache,
				mmu_page_header_cache);
729 730
}

731
static void *mmu_memory_cache_alloc(struct kvm_mmu_memory_cache *mc)
732 733 734 735 736 737 738 739
{
	void *p;

	BUG_ON(!mc->nobjs);
	p = mc->objects[--mc->nobjs];
	return p;
}

740
static struct pte_list_desc *mmu_alloc_pte_list_desc(struct kvm_vcpu *vcpu)
741
{
742
	return mmu_memory_cache_alloc(&vcpu->arch.mmu_pte_list_desc_cache);
743 744
}

745
static void mmu_free_pte_list_desc(struct pte_list_desc *pte_list_desc)
746
{
747
	kmem_cache_free(pte_list_desc_cache, pte_list_desc);
748 749
}

750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765
static gfn_t kvm_mmu_page_get_gfn(struct kvm_mmu_page *sp, int index)
{
	if (!sp->role.direct)
		return sp->gfns[index];

	return sp->gfn + (index << ((sp->role.level - 1) * PT64_LEVEL_BITS));
}

static void kvm_mmu_page_set_gfn(struct kvm_mmu_page *sp, int index, gfn_t gfn)
{
	if (sp->role.direct)
		BUG_ON(gfn != kvm_mmu_page_get_gfn(sp, index));
	else
		sp->gfns[index] = gfn;
}

M
Marcelo Tosatti 已提交
766
/*
767 768
 * Return the pointer to the large page information for a given gfn,
 * handling slots that are not large page aligned.
M
Marcelo Tosatti 已提交
769
 */
770 771 772
static struct kvm_lpage_info *lpage_info_slot(gfn_t gfn,
					      struct kvm_memory_slot *slot,
					      int level)
M
Marcelo Tosatti 已提交
773 774 775
{
	unsigned long idx;

776
	idx = gfn_to_index(gfn, slot->base_gfn, level);
777
	return &slot->arch.lpage_info[level - 2][idx];
M
Marcelo Tosatti 已提交
778 779
}

780 781 782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797 798 799 800 801 802
static void update_gfn_disallow_lpage_count(struct kvm_memory_slot *slot,
					    gfn_t gfn, int count)
{
	struct kvm_lpage_info *linfo;
	int i;

	for (i = PT_DIRECTORY_LEVEL; i <= PT_MAX_HUGEPAGE_LEVEL; ++i) {
		linfo = lpage_info_slot(gfn, slot, i);
		linfo->disallow_lpage += count;
		WARN_ON(linfo->disallow_lpage < 0);
	}
}

void kvm_mmu_gfn_disallow_lpage(struct kvm_memory_slot *slot, gfn_t gfn)
{
	update_gfn_disallow_lpage_count(slot, gfn, 1);
}

void kvm_mmu_gfn_allow_lpage(struct kvm_memory_slot *slot, gfn_t gfn)
{
	update_gfn_disallow_lpage_count(slot, gfn, -1);
}

803
static void account_shadowed(struct kvm *kvm, struct kvm_mmu_page *sp)
M
Marcelo Tosatti 已提交
804
{
805
	struct kvm_memslots *slots;
806
	struct kvm_memory_slot *slot;
807
	gfn_t gfn;
M
Marcelo Tosatti 已提交
808

809
	kvm->arch.indirect_shadow_pages++;
810
	gfn = sp->gfn;
811 812
	slots = kvm_memslots_for_spte_role(kvm, sp->role);
	slot = __gfn_to_memslot(slots, gfn);
813 814 815 816 817 818

	/* the non-leaf shadow pages are keeping readonly. */
	if (sp->role.level > PT_PAGE_TABLE_LEVEL)
		return kvm_slot_page_track_add_page(kvm, slot, gfn,
						    KVM_PAGE_TRACK_WRITE);

819
	kvm_mmu_gfn_disallow_lpage(slot, gfn);
M
Marcelo Tosatti 已提交
820 821
}

822
static void unaccount_shadowed(struct kvm *kvm, struct kvm_mmu_page *sp)
M
Marcelo Tosatti 已提交
823
{
824
	struct kvm_memslots *slots;
825
	struct kvm_memory_slot *slot;
826
	gfn_t gfn;
M
Marcelo Tosatti 已提交
827

828
	kvm->arch.indirect_shadow_pages--;
829
	gfn = sp->gfn;
830 831
	slots = kvm_memslots_for_spte_role(kvm, sp->role);
	slot = __gfn_to_memslot(slots, gfn);
832 833 834 835
	if (sp->role.level > PT_PAGE_TABLE_LEVEL)
		return kvm_slot_page_track_remove_page(kvm, slot, gfn,
						       KVM_PAGE_TRACK_WRITE);

836
	kvm_mmu_gfn_allow_lpage(slot, gfn);
M
Marcelo Tosatti 已提交
837 838
}

839 840
static bool __mmu_gfn_lpage_is_disallowed(gfn_t gfn, int level,
					  struct kvm_memory_slot *slot)
M
Marcelo Tosatti 已提交
841
{
842
	struct kvm_lpage_info *linfo;
M
Marcelo Tosatti 已提交
843 844

	if (slot) {
845
		linfo = lpage_info_slot(gfn, slot, level);
846
		return !!linfo->disallow_lpage;
M
Marcelo Tosatti 已提交
847 848
	}

849
	return true;
M
Marcelo Tosatti 已提交
850 851
}

852 853
static bool mmu_gfn_lpage_is_disallowed(struct kvm_vcpu *vcpu, gfn_t gfn,
					int level)
854 855 856 857
{
	struct kvm_memory_slot *slot;

	slot = kvm_vcpu_gfn_to_memslot(vcpu, gfn);
858
	return __mmu_gfn_lpage_is_disallowed(gfn, level, slot);
859 860
}

861
static int host_mapping_level(struct kvm *kvm, gfn_t gfn)
M
Marcelo Tosatti 已提交
862
{
J
Joerg Roedel 已提交
863
	unsigned long page_size;
864
	int i, ret = 0;
M
Marcelo Tosatti 已提交
865

J
Joerg Roedel 已提交
866
	page_size = kvm_host_page_size(kvm, gfn);
M
Marcelo Tosatti 已提交
867

868
	for (i = PT_PAGE_TABLE_LEVEL; i <= PT_MAX_HUGEPAGE_LEVEL; ++i) {
869 870 871 872 873 874
		if (page_size >= KVM_HPAGE_SIZE(i))
			ret = i;
		else
			break;
	}

875
	return ret;
M
Marcelo Tosatti 已提交
876 877
}

878 879 880 881 882 883 884 885 886 887 888
static inline bool memslot_valid_for_gpte(struct kvm_memory_slot *slot,
					  bool no_dirty_log)
{
	if (!slot || slot->flags & KVM_MEMSLOT_INVALID)
		return false;
	if (no_dirty_log && slot->dirty_bitmap)
		return false;

	return true;
}

889 890 891
static struct kvm_memory_slot *
gfn_to_memslot_dirty_bitmap(struct kvm_vcpu *vcpu, gfn_t gfn,
			    bool no_dirty_log)
M
Marcelo Tosatti 已提交
892 893
{
	struct kvm_memory_slot *slot;
894

895
	slot = kvm_vcpu_gfn_to_memslot(vcpu, gfn);
896
	if (!memslot_valid_for_gpte(slot, no_dirty_log))
897 898 899 900 901
		slot = NULL;

	return slot;
}

902 903
static int mapping_level(struct kvm_vcpu *vcpu, gfn_t large_gfn,
			 bool *force_pt_level)
904 905
{
	int host_level, level, max_level;
906 907
	struct kvm_memory_slot *slot;

908 909
	if (unlikely(*force_pt_level))
		return PT_PAGE_TABLE_LEVEL;
M
Marcelo Tosatti 已提交
910

911 912
	slot = kvm_vcpu_gfn_to_memslot(vcpu, large_gfn);
	*force_pt_level = !memslot_valid_for_gpte(slot, true);
913 914 915
	if (unlikely(*force_pt_level))
		return PT_PAGE_TABLE_LEVEL;

916 917 918 919 920
	host_level = host_mapping_level(vcpu->kvm, large_gfn);

	if (host_level == PT_PAGE_TABLE_LEVEL)
		return host_level;

X
Xiao Guangrong 已提交
921
	max_level = min(kvm_x86_ops->get_lpage_level(), host_level);
922 923

	for (level = PT_DIRECTORY_LEVEL; level <= max_level; ++level)
924
		if (__mmu_gfn_lpage_is_disallowed(large_gfn, level, slot))
925 926 927
			break;

	return level - 1;
M
Marcelo Tosatti 已提交
928 929
}

930
/*
931
 * About rmap_head encoding:
932
 *
933 934
 * If the bit zero of rmap_head->val is clear, then it points to the only spte
 * in this rmap chain. Otherwise, (rmap_head->val & ~1) points to a struct
935
 * pte_list_desc containing more mappings.
936 937 938 939
 */

/*
 * Returns the number of pointers in the rmap chain, not counting the new one.
940
 */
941
static int pte_list_add(struct kvm_vcpu *vcpu, u64 *spte,
942
			struct kvm_rmap_head *rmap_head)
943
{
944
	struct pte_list_desc *desc;
945
	int i, count = 0;
946

947
	if (!rmap_head->val) {
948
		rmap_printk("pte_list_add: %p %llx 0->1\n", spte, *spte);
949 950
		rmap_head->val = (unsigned long)spte;
	} else if (!(rmap_head->val & 1)) {
951 952
		rmap_printk("pte_list_add: %p %llx 1->many\n", spte, *spte);
		desc = mmu_alloc_pte_list_desc(vcpu);
953
		desc->sptes[0] = (u64 *)rmap_head->val;
A
Avi Kivity 已提交
954
		desc->sptes[1] = spte;
955
		rmap_head->val = (unsigned long)desc | 1;
956
		++count;
957
	} else {
958
		rmap_printk("pte_list_add: %p %llx many->many\n", spte, *spte);
959
		desc = (struct pte_list_desc *)(rmap_head->val & ~1ul);
960
		while (desc->sptes[PTE_LIST_EXT-1] && desc->more) {
961
			desc = desc->more;
962
			count += PTE_LIST_EXT;
963
		}
964 965
		if (desc->sptes[PTE_LIST_EXT-1]) {
			desc->more = mmu_alloc_pte_list_desc(vcpu);
966 967
			desc = desc->more;
		}
A
Avi Kivity 已提交
968
		for (i = 0; desc->sptes[i]; ++i)
969
			++count;
A
Avi Kivity 已提交
970
		desc->sptes[i] = spte;
971
	}
972
	return count;
973 974
}

975
static void
976 977 978
pte_list_desc_remove_entry(struct kvm_rmap_head *rmap_head,
			   struct pte_list_desc *desc, int i,
			   struct pte_list_desc *prev_desc)
979 980 981
{
	int j;

982
	for (j = PTE_LIST_EXT - 1; !desc->sptes[j] && j > i; --j)
983
		;
A
Avi Kivity 已提交
984 985
	desc->sptes[i] = desc->sptes[j];
	desc->sptes[j] = NULL;
986 987 988
	if (j != 0)
		return;
	if (!prev_desc && !desc->more)
989
		rmap_head->val = (unsigned long)desc->sptes[0];
990 991 992 993
	else
		if (prev_desc)
			prev_desc->more = desc->more;
		else
994
			rmap_head->val = (unsigned long)desc->more | 1;
995
	mmu_free_pte_list_desc(desc);
996 997
}

998
static void pte_list_remove(u64 *spte, struct kvm_rmap_head *rmap_head)
999
{
1000 1001
	struct pte_list_desc *desc;
	struct pte_list_desc *prev_desc;
1002 1003
	int i;

1004
	if (!rmap_head->val) {
1005
		printk(KERN_ERR "pte_list_remove: %p 0->BUG\n", spte);
1006
		BUG();
1007
	} else if (!(rmap_head->val & 1)) {
1008
		rmap_printk("pte_list_remove:  %p 1->0\n", spte);
1009
		if ((u64 *)rmap_head->val != spte) {
1010
			printk(KERN_ERR "pte_list_remove:  %p 1->BUG\n", spte);
1011 1012
			BUG();
		}
1013
		rmap_head->val = 0;
1014
	} else {
1015
		rmap_printk("pte_list_remove:  %p many->many\n", spte);
1016
		desc = (struct pte_list_desc *)(rmap_head->val & ~1ul);
1017 1018
		prev_desc = NULL;
		while (desc) {
1019
			for (i = 0; i < PTE_LIST_EXT && desc->sptes[i]; ++i) {
A
Avi Kivity 已提交
1020
				if (desc->sptes[i] == spte) {
1021 1022
					pte_list_desc_remove_entry(rmap_head,
							desc, i, prev_desc);
1023 1024
					return;
				}
1025
			}
1026 1027 1028
			prev_desc = desc;
			desc = desc->more;
		}
1029
		pr_err("pte_list_remove: %p many->many\n", spte);
1030 1031 1032 1033
		BUG();
	}
}

1034 1035
static struct kvm_rmap_head *__gfn_to_rmap(gfn_t gfn, int level,
					   struct kvm_memory_slot *slot)
1036
{
1037
	unsigned long idx;
1038

1039
	idx = gfn_to_index(gfn, slot->base_gfn, level);
1040
	return &slot->arch.rmap[level - PT_PAGE_TABLE_LEVEL][idx];
1041 1042
}

1043 1044
static struct kvm_rmap_head *gfn_to_rmap(struct kvm *kvm, gfn_t gfn,
					 struct kvm_mmu_page *sp)
1045
{
1046
	struct kvm_memslots *slots;
1047 1048
	struct kvm_memory_slot *slot;

1049 1050
	slots = kvm_memslots_for_spte_role(kvm, sp->role);
	slot = __gfn_to_memslot(slots, gfn);
1051
	return __gfn_to_rmap(gfn, sp->role.level, slot);
1052 1053
}

1054 1055 1056 1057 1058 1059 1060 1061
static bool rmap_can_add(struct kvm_vcpu *vcpu)
{
	struct kvm_mmu_memory_cache *cache;

	cache = &vcpu->arch.mmu_pte_list_desc_cache;
	return mmu_memory_cache_free_objects(cache);
}

1062 1063 1064
static int rmap_add(struct kvm_vcpu *vcpu, u64 *spte, gfn_t gfn)
{
	struct kvm_mmu_page *sp;
1065
	struct kvm_rmap_head *rmap_head;
1066 1067 1068

	sp = page_header(__pa(spte));
	kvm_mmu_page_set_gfn(sp, spte - sp->spt, gfn);
1069 1070
	rmap_head = gfn_to_rmap(vcpu->kvm, gfn, sp);
	return pte_list_add(vcpu, spte, rmap_head);
1071 1072 1073 1074 1075 1076
}

static void rmap_remove(struct kvm *kvm, u64 *spte)
{
	struct kvm_mmu_page *sp;
	gfn_t gfn;
1077
	struct kvm_rmap_head *rmap_head;
1078 1079 1080

	sp = page_header(__pa(spte));
	gfn = kvm_mmu_page_get_gfn(sp, spte - sp->spt);
1081 1082
	rmap_head = gfn_to_rmap(kvm, gfn, sp);
	pte_list_remove(spte, rmap_head);
1083 1084
}

1085 1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101
/*
 * Used by the following functions to iterate through the sptes linked by a
 * rmap.  All fields are private and not assumed to be used outside.
 */
struct rmap_iterator {
	/* private fields */
	struct pte_list_desc *desc;	/* holds the sptep if not NULL */
	int pos;			/* index of the sptep */
};

/*
 * Iteration must be started by this function.  This should also be used after
 * removing/dropping sptes from the rmap link because in such cases the
 * information in the itererator may not be valid.
 *
 * Returns sptep if found, NULL otherwise.
 */
1102 1103
static u64 *rmap_get_first(struct kvm_rmap_head *rmap_head,
			   struct rmap_iterator *iter)
1104
{
1105 1106
	u64 *sptep;

1107
	if (!rmap_head->val)
1108 1109
		return NULL;

1110
	if (!(rmap_head->val & 1)) {
1111
		iter->desc = NULL;
1112 1113
		sptep = (u64 *)rmap_head->val;
		goto out;
1114 1115
	}

1116
	iter->desc = (struct pte_list_desc *)(rmap_head->val & ~1ul);
1117
	iter->pos = 0;
1118 1119 1120 1121
	sptep = iter->desc->sptes[iter->pos];
out:
	BUG_ON(!is_shadow_present_pte(*sptep));
	return sptep;
1122 1123 1124 1125 1126 1127 1128 1129 1130
}

/*
 * Must be used with a valid iterator: e.g. after rmap_get_first().
 *
 * Returns sptep if found, NULL otherwise.
 */
static u64 *rmap_get_next(struct rmap_iterator *iter)
{
1131 1132
	u64 *sptep;

1133 1134 1135 1136 1137
	if (iter->desc) {
		if (iter->pos < PTE_LIST_EXT - 1) {
			++iter->pos;
			sptep = iter->desc->sptes[iter->pos];
			if (sptep)
1138
				goto out;
1139 1140 1141 1142 1143 1144 1145
		}

		iter->desc = iter->desc->more;

		if (iter->desc) {
			iter->pos = 0;
			/* desc->sptes[0] cannot be NULL */
1146 1147
			sptep = iter->desc->sptes[iter->pos];
			goto out;
1148 1149 1150 1151
		}
	}

	return NULL;
1152 1153 1154
out:
	BUG_ON(!is_shadow_present_pte(*sptep));
	return sptep;
1155 1156
}

1157 1158
#define for_each_rmap_spte(_rmap_head_, _iter_, _spte_)			\
	for (_spte_ = rmap_get_first(_rmap_head_, _iter_);		\
1159
	     _spte_; _spte_ = rmap_get_next(_iter_))
1160

1161
static void drop_spte(struct kvm *kvm, u64 *sptep)
1162
{
1163
	if (mmu_spte_clear_track_bits(sptep))
1164
		rmap_remove(kvm, sptep);
A
Avi Kivity 已提交
1165 1166
}

1167 1168 1169 1170 1171 1172 1173 1174 1175 1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186 1187

static bool __drop_large_spte(struct kvm *kvm, u64 *sptep)
{
	if (is_large_pte(*sptep)) {
		WARN_ON(page_header(__pa(sptep))->role.level ==
			PT_PAGE_TABLE_LEVEL);
		drop_spte(kvm, sptep);
		--kvm->stat.lpages;
		return true;
	}

	return false;
}

static void drop_large_spte(struct kvm_vcpu *vcpu, u64 *sptep)
{
	if (__drop_large_spte(vcpu->kvm, sptep))
		kvm_flush_remote_tlbs(vcpu->kvm);
}

/*
1188
 * Write-protect on the specified @sptep, @pt_protect indicates whether
1189
 * spte write-protection is caused by protecting shadow page table.
1190
 *
T
Tiejun Chen 已提交
1191
 * Note: write protection is difference between dirty logging and spte
1192 1193 1194 1195 1196
 * protection:
 * - for dirty logging, the spte can be set to writable at anytime if
 *   its dirty bitmap is properly set.
 * - for spte protection, the spte can be writable only after unsync-ing
 *   shadow page.
1197
 *
1198
 * Return true if tlb need be flushed.
1199
 */
1200
static bool spte_write_protect(struct kvm *kvm, u64 *sptep, bool pt_protect)
1201 1202 1203
{
	u64 spte = *sptep;

1204 1205
	if (!is_writable_pte(spte) &&
	      !(pt_protect && spte_is_locklessly_modifiable(spte)))
1206 1207 1208 1209
		return false;

	rmap_printk("rmap_write_protect: spte %p %llx\n", sptep, *sptep);

1210 1211
	if (pt_protect)
		spte &= ~SPTE_MMU_WRITEABLE;
1212
	spte = spte & ~PT_WRITABLE_MASK;
1213

1214
	return mmu_spte_update(sptep, spte);
1215 1216
}

1217 1218
static bool __rmap_write_protect(struct kvm *kvm,
				 struct kvm_rmap_head *rmap_head,
1219
				 bool pt_protect)
1220
{
1221 1222
	u64 *sptep;
	struct rmap_iterator iter;
1223
	bool flush = false;
1224

1225
	for_each_rmap_spte(rmap_head, &iter, sptep)
1226
		flush |= spte_write_protect(kvm, sptep, pt_protect);
1227

1228
	return flush;
1229 1230
}

1231 1232 1233 1234 1235 1236 1237 1238 1239 1240 1241
static bool spte_clear_dirty(struct kvm *kvm, u64 *sptep)
{
	u64 spte = *sptep;

	rmap_printk("rmap_clear_dirty: spte %p %llx\n", sptep, *sptep);

	spte &= ~shadow_dirty_mask;

	return mmu_spte_update(sptep, spte);
}

1242
static bool __rmap_clear_dirty(struct kvm *kvm, struct kvm_rmap_head *rmap_head)
1243 1244 1245 1246 1247
{
	u64 *sptep;
	struct rmap_iterator iter;
	bool flush = false;

1248
	for_each_rmap_spte(rmap_head, &iter, sptep)
1249 1250 1251 1252 1253 1254 1255 1256 1257 1258 1259 1260 1261 1262 1263 1264
		flush |= spte_clear_dirty(kvm, sptep);

	return flush;
}

static bool spte_set_dirty(struct kvm *kvm, u64 *sptep)
{
	u64 spte = *sptep;

	rmap_printk("rmap_set_dirty: spte %p %llx\n", sptep, *sptep);

	spte |= shadow_dirty_mask;

	return mmu_spte_update(sptep, spte);
}

1265
static bool __rmap_set_dirty(struct kvm *kvm, struct kvm_rmap_head *rmap_head)
1266 1267 1268 1269 1270
{
	u64 *sptep;
	struct rmap_iterator iter;
	bool flush = false;

1271
	for_each_rmap_spte(rmap_head, &iter, sptep)
1272 1273 1274 1275 1276
		flush |= spte_set_dirty(kvm, sptep);

	return flush;
}

1277
/**
1278
 * kvm_mmu_write_protect_pt_masked - write protect selected PT level pages
1279 1280 1281 1282 1283 1284 1285 1286
 * @kvm: kvm instance
 * @slot: slot to protect
 * @gfn_offset: start of the BITS_PER_LONG pages we care about
 * @mask: indicates which pages we should protect
 *
 * Used when we do not need to care about huge page mappings: e.g. during dirty
 * logging we do not have any such mappings.
 */
1287
static void kvm_mmu_write_protect_pt_masked(struct kvm *kvm,
1288 1289
				     struct kvm_memory_slot *slot,
				     gfn_t gfn_offset, unsigned long mask)
1290
{
1291
	struct kvm_rmap_head *rmap_head;
1292

1293
	while (mask) {
1294 1295 1296
		rmap_head = __gfn_to_rmap(slot->base_gfn + gfn_offset + __ffs(mask),
					  PT_PAGE_TABLE_LEVEL, slot);
		__rmap_write_protect(kvm, rmap_head, false);
M
Marcelo Tosatti 已提交
1297

1298 1299 1300
		/* clear the first set bit */
		mask &= mask - 1;
	}
1301 1302
}

1303 1304 1305 1306 1307 1308 1309 1310 1311 1312 1313 1314 1315
/**
 * kvm_mmu_clear_dirty_pt_masked - clear MMU D-bit for PT level pages
 * @kvm: kvm instance
 * @slot: slot to clear D-bit
 * @gfn_offset: start of the BITS_PER_LONG pages we care about
 * @mask: indicates which pages we should clear D-bit
 *
 * Used for PML to re-log the dirty GPAs after userspace querying dirty_bitmap.
 */
void kvm_mmu_clear_dirty_pt_masked(struct kvm *kvm,
				     struct kvm_memory_slot *slot,
				     gfn_t gfn_offset, unsigned long mask)
{
1316
	struct kvm_rmap_head *rmap_head;
1317 1318

	while (mask) {
1319 1320 1321
		rmap_head = __gfn_to_rmap(slot->base_gfn + gfn_offset + __ffs(mask),
					  PT_PAGE_TABLE_LEVEL, slot);
		__rmap_clear_dirty(kvm, rmap_head);
1322 1323 1324 1325 1326 1327 1328

		/* clear the first set bit */
		mask &= mask - 1;
	}
}
EXPORT_SYMBOL_GPL(kvm_mmu_clear_dirty_pt_masked);

1329 1330 1331 1332 1333 1334 1335 1336 1337 1338 1339 1340 1341 1342
/**
 * kvm_arch_mmu_enable_log_dirty_pt_masked - enable dirty logging for selected
 * PT level pages.
 *
 * It calls kvm_mmu_write_protect_pt_masked to write protect selected pages to
 * enable dirty logging for them.
 *
 * Used when we do not need to care about huge page mappings: e.g. during dirty
 * logging we do not have any such mappings.
 */
void kvm_arch_mmu_enable_log_dirty_pt_masked(struct kvm *kvm,
				struct kvm_memory_slot *slot,
				gfn_t gfn_offset, unsigned long mask)
{
1343 1344 1345 1346 1347
	if (kvm_x86_ops->enable_log_dirty_pt_masked)
		kvm_x86_ops->enable_log_dirty_pt_masked(kvm, slot, gfn_offset,
				mask);
	else
		kvm_mmu_write_protect_pt_masked(kvm, slot, gfn_offset, mask);
1348 1349
}

1350 1351
bool kvm_mmu_slot_gfn_write_protect(struct kvm *kvm,
				    struct kvm_memory_slot *slot, u64 gfn)
1352
{
1353
	struct kvm_rmap_head *rmap_head;
1354
	int i;
1355
	bool write_protected = false;
1356

1357
	for (i = PT_PAGE_TABLE_LEVEL; i <= PT_MAX_HUGEPAGE_LEVEL; ++i) {
1358
		rmap_head = __gfn_to_rmap(gfn, i, slot);
1359
		write_protected |= __rmap_write_protect(kvm, rmap_head, true);
1360 1361 1362
	}

	return write_protected;
1363 1364
}

1365 1366 1367 1368 1369 1370 1371 1372
static bool rmap_write_protect(struct kvm_vcpu *vcpu, u64 gfn)
{
	struct kvm_memory_slot *slot;

	slot = kvm_vcpu_gfn_to_memslot(vcpu, gfn);
	return kvm_mmu_slot_gfn_write_protect(vcpu->kvm, slot, gfn);
}

1373
static bool kvm_zap_rmapp(struct kvm *kvm, struct kvm_rmap_head *rmap_head)
1374
{
1375 1376
	u64 *sptep;
	struct rmap_iterator iter;
1377
	bool flush = false;
1378

1379
	while ((sptep = rmap_get_first(rmap_head, &iter))) {
1380
		rmap_printk("%s: spte %p %llx.\n", __func__, sptep, *sptep);
1381 1382

		drop_spte(kvm, sptep);
1383
		flush = true;
1384
	}
1385

1386 1387 1388
	return flush;
}

1389
static int kvm_unmap_rmapp(struct kvm *kvm, struct kvm_rmap_head *rmap_head,
1390 1391 1392
			   struct kvm_memory_slot *slot, gfn_t gfn, int level,
			   unsigned long data)
{
1393
	return kvm_zap_rmapp(kvm, rmap_head);
1394 1395
}

1396
static int kvm_set_pte_rmapp(struct kvm *kvm, struct kvm_rmap_head *rmap_head,
1397 1398
			     struct kvm_memory_slot *slot, gfn_t gfn, int level,
			     unsigned long data)
1399
{
1400 1401
	u64 *sptep;
	struct rmap_iterator iter;
1402
	int need_flush = 0;
1403
	u64 new_spte;
1404
	pte_t *ptep = (pte_t *)data;
D
Dan Williams 已提交
1405
	kvm_pfn_t new_pfn;
1406 1407 1408

	WARN_ON(pte_huge(*ptep));
	new_pfn = pte_pfn(*ptep);
1409

1410
restart:
1411
	for_each_rmap_spte(rmap_head, &iter, sptep) {
1412 1413
		rmap_printk("kvm_set_pte_rmapp: spte %p %llx gfn %llx (%d)\n",
			     sptep, *sptep, gfn, level);
1414

1415
		need_flush = 1;
1416

1417
		if (pte_write(*ptep)) {
1418
			drop_spte(kvm, sptep);
1419
			goto restart;
1420
		} else {
1421
			new_spte = *sptep & ~PT64_BASE_ADDR_MASK;
1422 1423 1424 1425
			new_spte |= (u64)new_pfn << PAGE_SHIFT;

			new_spte &= ~PT_WRITABLE_MASK;
			new_spte &= ~SPTE_HOST_WRITEABLE;
1426
			new_spte &= ~shadow_accessed_mask;
1427 1428 1429

			mmu_spte_clear_track_bits(sptep);
			mmu_spte_set(sptep, new_spte);
1430 1431
		}
	}
1432

1433 1434 1435 1436 1437 1438
	if (need_flush)
		kvm_flush_remote_tlbs(kvm);

	return 0;
}

1439 1440 1441 1442 1443 1444 1445 1446 1447 1448
struct slot_rmap_walk_iterator {
	/* input fields. */
	struct kvm_memory_slot *slot;
	gfn_t start_gfn;
	gfn_t end_gfn;
	int start_level;
	int end_level;

	/* output fields. */
	gfn_t gfn;
1449
	struct kvm_rmap_head *rmap;
1450 1451 1452
	int level;

	/* private field. */
1453
	struct kvm_rmap_head *end_rmap;
1454 1455 1456 1457 1458 1459 1460 1461 1462 1463 1464 1465 1466 1467 1468 1469 1470 1471 1472 1473 1474 1475 1476 1477 1478 1479 1480 1481 1482 1483 1484 1485 1486 1487 1488 1489 1490 1491 1492 1493 1494 1495 1496 1497 1498 1499 1500 1501 1502 1503 1504 1505 1506
};

static void
rmap_walk_init_level(struct slot_rmap_walk_iterator *iterator, int level)
{
	iterator->level = level;
	iterator->gfn = iterator->start_gfn;
	iterator->rmap = __gfn_to_rmap(iterator->gfn, level, iterator->slot);
	iterator->end_rmap = __gfn_to_rmap(iterator->end_gfn, level,
					   iterator->slot);
}

static void
slot_rmap_walk_init(struct slot_rmap_walk_iterator *iterator,
		    struct kvm_memory_slot *slot, int start_level,
		    int end_level, gfn_t start_gfn, gfn_t end_gfn)
{
	iterator->slot = slot;
	iterator->start_level = start_level;
	iterator->end_level = end_level;
	iterator->start_gfn = start_gfn;
	iterator->end_gfn = end_gfn;

	rmap_walk_init_level(iterator, iterator->start_level);
}

static bool slot_rmap_walk_okay(struct slot_rmap_walk_iterator *iterator)
{
	return !!iterator->rmap;
}

static void slot_rmap_walk_next(struct slot_rmap_walk_iterator *iterator)
{
	if (++iterator->rmap <= iterator->end_rmap) {
		iterator->gfn += (1UL << KVM_HPAGE_GFN_SHIFT(iterator->level));
		return;
	}

	if (++iterator->level > iterator->end_level) {
		iterator->rmap = NULL;
		return;
	}

	rmap_walk_init_level(iterator, iterator->level);
}

#define for_each_slot_rmap_range(_slot_, _start_level_, _end_level_,	\
	   _start_gfn, _end_gfn, _iter_)				\
	for (slot_rmap_walk_init(_iter_, _slot_, _start_level_,		\
				 _end_level_, _start_gfn, _end_gfn);	\
	     slot_rmap_walk_okay(_iter_);				\
	     slot_rmap_walk_next(_iter_))

1507 1508 1509 1510 1511
static int kvm_handle_hva_range(struct kvm *kvm,
				unsigned long start,
				unsigned long end,
				unsigned long data,
				int (*handler)(struct kvm *kvm,
1512
					       struct kvm_rmap_head *rmap_head,
1513
					       struct kvm_memory_slot *slot,
1514 1515
					       gfn_t gfn,
					       int level,
1516
					       unsigned long data))
1517
{
1518
	struct kvm_memslots *slots;
1519
	struct kvm_memory_slot *memslot;
1520 1521
	struct slot_rmap_walk_iterator iterator;
	int ret = 0;
1522
	int i;
1523

1524 1525 1526 1527 1528
	for (i = 0; i < KVM_ADDRESS_SPACE_NUM; i++) {
		slots = __kvm_memslots(kvm, i);
		kvm_for_each_memslot(memslot, slots) {
			unsigned long hva_start, hva_end;
			gfn_t gfn_start, gfn_end;
1529

1530 1531 1532 1533 1534 1535 1536 1537 1538 1539 1540 1541 1542 1543 1544 1545 1546 1547 1548
			hva_start = max(start, memslot->userspace_addr);
			hva_end = min(end, memslot->userspace_addr +
				      (memslot->npages << PAGE_SHIFT));
			if (hva_start >= hva_end)
				continue;
			/*
			 * {gfn(page) | page intersects with [hva_start, hva_end)} =
			 * {gfn_start, gfn_start+1, ..., gfn_end-1}.
			 */
			gfn_start = hva_to_gfn_memslot(hva_start, memslot);
			gfn_end = hva_to_gfn_memslot(hva_end + PAGE_SIZE - 1, memslot);

			for_each_slot_rmap_range(memslot, PT_PAGE_TABLE_LEVEL,
						 PT_MAX_HUGEPAGE_LEVEL,
						 gfn_start, gfn_end - 1,
						 &iterator)
				ret |= handler(kvm, iterator.rmap, memslot,
					       iterator.gfn, iterator.level, data);
		}
1549 1550
	}

1551
	return ret;
1552 1553
}

1554 1555
static int kvm_handle_hva(struct kvm *kvm, unsigned long hva,
			  unsigned long data,
1556 1557
			  int (*handler)(struct kvm *kvm,
					 struct kvm_rmap_head *rmap_head,
1558
					 struct kvm_memory_slot *slot,
1559
					 gfn_t gfn, int level,
1560 1561 1562
					 unsigned long data))
{
	return kvm_handle_hva_range(kvm, hva, hva + 1, data, handler);
1563 1564 1565 1566
}

int kvm_unmap_hva(struct kvm *kvm, unsigned long hva)
{
1567 1568 1569
	return kvm_handle_hva(kvm, hva, 0, kvm_unmap_rmapp);
}

1570 1571 1572 1573 1574
int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end)
{
	return kvm_handle_hva_range(kvm, start, end, 0, kvm_unmap_rmapp);
}

1575 1576
void kvm_set_spte_hva(struct kvm *kvm, unsigned long hva, pte_t pte)
{
F
Frederik Deweerdt 已提交
1577
	kvm_handle_hva(kvm, hva, (unsigned long)&pte, kvm_set_pte_rmapp);
1578 1579
}

1580
static int kvm_age_rmapp(struct kvm *kvm, struct kvm_rmap_head *rmap_head,
1581 1582
			 struct kvm_memory_slot *slot, gfn_t gfn, int level,
			 unsigned long data)
1583
{
1584
	u64 *sptep;
1585
	struct rmap_iterator uninitialized_var(iter);
1586 1587
	int young = 0;

A
Andres Lagar-Cavilla 已提交
1588
	BUG_ON(!shadow_accessed_mask);
1589

1590
	for_each_rmap_spte(rmap_head, &iter, sptep) {
1591
		if (*sptep & shadow_accessed_mask) {
1592
			young = 1;
1593 1594
			clear_bit((ffs(shadow_accessed_mask) - 1),
				 (unsigned long *)sptep);
1595
		}
1596
	}
1597

1598
	trace_kvm_age_page(gfn, level, slot, young);
1599 1600 1601
	return young;
}

1602
static int kvm_test_age_rmapp(struct kvm *kvm, struct kvm_rmap_head *rmap_head,
1603 1604
			      struct kvm_memory_slot *slot, gfn_t gfn,
			      int level, unsigned long data)
A
Andrea Arcangeli 已提交
1605
{
1606 1607
	u64 *sptep;
	struct rmap_iterator iter;
A
Andrea Arcangeli 已提交
1608 1609 1610 1611 1612 1613 1614 1615 1616 1617
	int young = 0;

	/*
	 * If there's no access bit in the secondary pte set by the
	 * hardware it's up to gup-fast/gup to set the access bit in
	 * the primary pte or in the page structure.
	 */
	if (!shadow_accessed_mask)
		goto out;

1618
	for_each_rmap_spte(rmap_head, &iter, sptep) {
1619
		if (*sptep & shadow_accessed_mask) {
A
Andrea Arcangeli 已提交
1620 1621 1622
			young = 1;
			break;
		}
1623
	}
A
Andrea Arcangeli 已提交
1624 1625 1626 1627
out:
	return young;
}

1628 1629
#define RMAP_RECYCLE_THRESHOLD 1000

1630
static void rmap_recycle(struct kvm_vcpu *vcpu, u64 *spte, gfn_t gfn)
1631
{
1632
	struct kvm_rmap_head *rmap_head;
1633 1634 1635
	struct kvm_mmu_page *sp;

	sp = page_header(__pa(spte));
1636

1637
	rmap_head = gfn_to_rmap(vcpu->kvm, gfn, sp);
1638

1639
	kvm_unmap_rmapp(vcpu->kvm, rmap_head, NULL, gfn, sp->role.level, 0);
1640 1641 1642
	kvm_flush_remote_tlbs(vcpu->kvm);
}

A
Andres Lagar-Cavilla 已提交
1643
int kvm_age_hva(struct kvm *kvm, unsigned long start, unsigned long end)
1644
{
A
Andres Lagar-Cavilla 已提交
1645 1646 1647 1648 1649 1650 1651 1652 1653 1654 1655 1656 1657 1658 1659 1660 1661 1662 1663 1664 1665
	/*
	 * In case of absence of EPT Access and Dirty Bits supports,
	 * emulate the accessed bit for EPT, by checking if this page has
	 * an EPT mapping, and clearing it if it does. On the next access,
	 * a new EPT mapping will be established.
	 * This has some overhead, but not as much as the cost of swapping
	 * out actively used pages or breaking up actively used hugepages.
	 */
	if (!shadow_accessed_mask) {
		/*
		 * We are holding the kvm->mmu_lock, and we are blowing up
		 * shadow PTEs. MMU notifier consumers need to be kept at bay.
		 * This is correct as long as we don't decouple the mmu_lock
		 * protected regions (like invalidate_range_start|end does).
		 */
		kvm->mmu_notifier_seq++;
		return kvm_handle_hva_range(kvm, start, end, 0,
					    kvm_unmap_rmapp);
	}

	return kvm_handle_hva_range(kvm, start, end, 0, kvm_age_rmapp);
1666 1667
}

A
Andrea Arcangeli 已提交
1668 1669 1670 1671 1672
int kvm_test_age_hva(struct kvm *kvm, unsigned long hva)
{
	return kvm_handle_hva(kvm, hva, 0, kvm_test_age_rmapp);
}

1673
#ifdef MMU_DEBUG
1674
static int is_empty_shadow_page(u64 *spt)
A
Avi Kivity 已提交
1675
{
1676 1677 1678
	u64 *pos;
	u64 *end;

1679
	for (pos = spt, end = pos + PAGE_SIZE / sizeof(u64); pos != end; pos++)
1680
		if (is_shadow_present_pte(*pos)) {
1681
			printk(KERN_ERR "%s: %p %llx\n", __func__,
1682
			       pos, *pos);
A
Avi Kivity 已提交
1683
			return 0;
1684
		}
A
Avi Kivity 已提交
1685 1686
	return 1;
}
1687
#endif
A
Avi Kivity 已提交
1688

1689 1690 1691 1692 1693 1694 1695 1696 1697 1698 1699 1700
/*
 * This value is the sum of all of the kvm instances's
 * kvm->arch.n_used_mmu_pages values.  We need a global,
 * aggregate version in order to make the slab shrinker
 * faster
 */
static inline void kvm_mod_used_mmu_pages(struct kvm *kvm, int nr)
{
	kvm->arch.n_used_mmu_pages += nr;
	percpu_counter_add(&kvm_total_used_mmu_pages, nr);
}

1701
static void kvm_mmu_free_page(struct kvm_mmu_page *sp)
1702
{
1703
	MMU_WARN_ON(!is_empty_shadow_page(sp->spt));
1704
	hlist_del(&sp->hash_link);
1705 1706
	list_del(&sp->link);
	free_page((unsigned long)sp->spt);
1707 1708
	if (!sp->role.direct)
		free_page((unsigned long)sp->gfns);
1709
	kmem_cache_free(mmu_page_header_cache, sp);
1710 1711
}

1712 1713
static unsigned kvm_page_table_hashfn(gfn_t gfn)
{
1714
	return gfn & ((1 << KVM_MMU_HASH_SHIFT) - 1);
1715 1716
}

1717
static void mmu_page_add_parent_pte(struct kvm_vcpu *vcpu,
1718
				    struct kvm_mmu_page *sp, u64 *parent_pte)
1719 1720 1721 1722
{
	if (!parent_pte)
		return;

1723
	pte_list_add(vcpu, parent_pte, &sp->parent_ptes);
1724 1725
}

1726
static void mmu_page_remove_parent_pte(struct kvm_mmu_page *sp,
1727 1728
				       u64 *parent_pte)
{
1729
	pte_list_remove(parent_pte, &sp->parent_ptes);
1730 1731
}

1732 1733 1734 1735
static void drop_parent_pte(struct kvm_mmu_page *sp,
			    u64 *parent_pte)
{
	mmu_page_remove_parent_pte(sp, parent_pte);
1736
	mmu_spte_clear_no_track(parent_pte);
1737 1738
}

1739
static struct kvm_mmu_page *kvm_mmu_alloc_page(struct kvm_vcpu *vcpu, int direct)
M
Marcelo Tosatti 已提交
1740
{
1741
	struct kvm_mmu_page *sp;
1742

1743 1744
	sp = mmu_memory_cache_alloc(&vcpu->arch.mmu_page_header_cache);
	sp->spt = mmu_memory_cache_alloc(&vcpu->arch.mmu_page_cache);
1745
	if (!direct)
1746
		sp->gfns = mmu_memory_cache_alloc(&vcpu->arch.mmu_page_cache);
1747
	set_page_private(virt_to_page(sp->spt), (unsigned long)sp);
1748 1749 1750 1751 1752 1753

	/*
	 * The active_mmu_pages list is the FIFO list, do not move the
	 * page until it is zapped. kvm_zap_obsolete_pages depends on
	 * this feature. See the comments in kvm_zap_obsolete_pages().
	 */
1754 1755 1756
	list_add(&sp->link, &vcpu->kvm->arch.active_mmu_pages);
	kvm_mod_used_mmu_pages(vcpu->kvm, +1);
	return sp;
M
Marcelo Tosatti 已提交
1757 1758
}

1759
static void mark_unsync(u64 *spte);
1760
static void kvm_mmu_mark_parents_unsync(struct kvm_mmu_page *sp)
1761
{
1762 1763 1764 1765 1766 1767
	u64 *sptep;
	struct rmap_iterator iter;

	for_each_rmap_spte(&sp->parent_ptes, &iter, sptep) {
		mark_unsync(sptep);
	}
1768 1769
}

1770
static void mark_unsync(u64 *spte)
1771
{
1772
	struct kvm_mmu_page *sp;
1773
	unsigned int index;
1774

1775
	sp = page_header(__pa(spte));
1776 1777
	index = spte - sp->spt;
	if (__test_and_set_bit(index, sp->unsync_child_bitmap))
1778
		return;
1779
	if (sp->unsync_children++)
1780
		return;
1781
	kvm_mmu_mark_parents_unsync(sp);
1782 1783
}

1784
static int nonpaging_sync_page(struct kvm_vcpu *vcpu,
1785
			       struct kvm_mmu_page *sp)
1786
{
1787
	return 0;
1788 1789
}

M
Marcelo Tosatti 已提交
1790 1791 1792 1793
static void nonpaging_invlpg(struct kvm_vcpu *vcpu, gva_t gva)
{
}

1794 1795
static void nonpaging_update_pte(struct kvm_vcpu *vcpu,
				 struct kvm_mmu_page *sp, u64 *spte,
1796
				 const void *pte)
1797 1798 1799 1800
{
	WARN_ON(1);
}

1801 1802 1803 1804 1805 1806 1807 1808 1809 1810
#define KVM_PAGE_ARRAY_NR 16

struct kvm_mmu_pages {
	struct mmu_page_and_offset {
		struct kvm_mmu_page *sp;
		unsigned int idx;
	} page[KVM_PAGE_ARRAY_NR];
	unsigned int nr;
};

1811 1812
static int mmu_pages_add(struct kvm_mmu_pages *pvec, struct kvm_mmu_page *sp,
			 int idx)
1813
{
1814
	int i;
1815

1816 1817 1818 1819 1820 1821 1822 1823 1824 1825 1826
	if (sp->unsync)
		for (i=0; i < pvec->nr; i++)
			if (pvec->page[i].sp == sp)
				return 0;

	pvec->page[pvec->nr].sp = sp;
	pvec->page[pvec->nr].idx = idx;
	pvec->nr++;
	return (pvec->nr == KVM_PAGE_ARRAY_NR);
}

1827 1828 1829 1830 1831 1832 1833
static inline void clear_unsync_child_bit(struct kvm_mmu_page *sp, int idx)
{
	--sp->unsync_children;
	WARN_ON((int)sp->unsync_children < 0);
	__clear_bit(idx, sp->unsync_child_bitmap);
}

1834 1835 1836 1837
static int __mmu_unsync_walk(struct kvm_mmu_page *sp,
			   struct kvm_mmu_pages *pvec)
{
	int i, ret, nr_unsync_leaf = 0;
1838

1839
	for_each_set_bit(i, sp->unsync_child_bitmap, 512) {
1840
		struct kvm_mmu_page *child;
1841 1842
		u64 ent = sp->spt[i];

1843 1844 1845 1846
		if (!is_shadow_present_pte(ent) || is_large_pte(ent)) {
			clear_unsync_child_bit(sp, i);
			continue;
		}
1847 1848 1849 1850 1851 1852 1853 1854

		child = page_header(ent & PT64_BASE_ADDR_MASK);

		if (child->unsync_children) {
			if (mmu_pages_add(pvec, child, i))
				return -ENOSPC;

			ret = __mmu_unsync_walk(child, pvec);
1855 1856 1857 1858
			if (!ret) {
				clear_unsync_child_bit(sp, i);
				continue;
			} else if (ret > 0) {
1859
				nr_unsync_leaf += ret;
1860
			} else
1861 1862 1863 1864 1865 1866
				return ret;
		} else if (child->unsync) {
			nr_unsync_leaf++;
			if (mmu_pages_add(pvec, child, i))
				return -ENOSPC;
		} else
1867
			clear_unsync_child_bit(sp, i);
1868 1869
	}

1870 1871 1872
	return nr_unsync_leaf;
}

1873 1874
#define INVALID_INDEX (-1)

1875 1876 1877
static int mmu_unsync_walk(struct kvm_mmu_page *sp,
			   struct kvm_mmu_pages *pvec)
{
P
Paolo Bonzini 已提交
1878
	pvec->nr = 0;
1879 1880 1881
	if (!sp->unsync_children)
		return 0;

1882
	mmu_pages_add(pvec, sp, INVALID_INDEX);
1883
	return __mmu_unsync_walk(sp, pvec);
1884 1885 1886 1887 1888
}

static void kvm_unlink_unsync_page(struct kvm *kvm, struct kvm_mmu_page *sp)
{
	WARN_ON(!sp->unsync);
1889
	trace_kvm_mmu_sync_page(sp);
1890 1891 1892 1893
	sp->unsync = 0;
	--kvm->stat.mmu_unsync;
}

1894 1895 1896 1897
static int kvm_mmu_prepare_zap_page(struct kvm *kvm, struct kvm_mmu_page *sp,
				    struct list_head *invalid_list);
static void kvm_mmu_commit_zap_page(struct kvm *kvm,
				    struct list_head *invalid_list);
1898

1899 1900 1901 1902 1903 1904 1905 1906 1907 1908
/*
 * NOTE: we should pay more attention on the zapped-obsolete page
 * (is_obsolete_sp(sp) && sp->role.invalid) when you do hash list walk
 * since it has been deleted from active_mmu_pages but still can be found
 * at hast list.
 *
 * for_each_gfn_indirect_valid_sp has skipped that kind of page and
 * kvm_mmu_get_page(), the only user of for_each_gfn_sp(), has skipped
 * all the obsolete pages.
 */
1909 1910 1911 1912 1913 1914 1915 1916
#define for_each_gfn_sp(_kvm, _sp, _gfn)				\
	hlist_for_each_entry(_sp,					\
	  &(_kvm)->arch.mmu_page_hash[kvm_page_table_hashfn(_gfn)], hash_link) \
		if ((_sp)->gfn != (_gfn)) {} else

#define for_each_gfn_indirect_valid_sp(_kvm, _sp, _gfn)			\
	for_each_gfn_sp(_kvm, _sp, _gfn)				\
		if ((_sp)->role.direct || (_sp)->role.invalid) {} else
1917

1918
/* @sp->gfn should be write-protected at the call site */
1919 1920
static bool __kvm_sync_page(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp,
			    struct list_head *invalid_list)
1921
{
1922
	if (sp->role.cr4_pae != !!is_pae(vcpu)) {
1923
		kvm_mmu_prepare_zap_page(vcpu->kvm, sp, invalid_list);
1924
		return false;
1925 1926
	}

1927
	if (vcpu->arch.mmu.sync_page(vcpu, sp) == 0) {
1928
		kvm_mmu_prepare_zap_page(vcpu->kvm, sp, invalid_list);
1929
		return false;
1930 1931
	}

1932
	return true;
1933 1934
}

1935 1936 1937
static void kvm_mmu_flush_or_zap(struct kvm_vcpu *vcpu,
				 struct list_head *invalid_list,
				 bool remote_flush, bool local_flush)
1938
{
1939 1940 1941 1942
	if (!list_empty(invalid_list)) {
		kvm_mmu_commit_zap_page(vcpu->kvm, invalid_list);
		return;
	}
1943

1944 1945 1946 1947
	if (remote_flush)
		kvm_flush_remote_tlbs(vcpu->kvm);
	else if (local_flush)
		kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu);
1948 1949
}

1950 1951 1952 1953 1954 1955 1956
#ifdef CONFIG_KVM_MMU_AUDIT
#include "mmu_audit.c"
#else
static void kvm_mmu_audit(struct kvm_vcpu *vcpu, int point) { }
static void mmu_audit_disable(void) { }
#endif

1957
static bool kvm_sync_page(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp,
1958
			 struct list_head *invalid_list)
1959
{
1960 1961
	kvm_unlink_unsync_page(vcpu->kvm, sp);
	return __kvm_sync_page(vcpu, sp, invalid_list);
1962 1963
}

1964
/* @gfn should be write-protected at the call site */
1965 1966
static bool kvm_sync_pages(struct kvm_vcpu *vcpu, gfn_t gfn,
			   struct list_head *invalid_list)
1967 1968
{
	struct kvm_mmu_page *s;
1969
	bool ret = false;
1970

1971
	for_each_gfn_indirect_valid_sp(vcpu->kvm, s, gfn) {
1972
		if (!s->unsync)
1973 1974 1975
			continue;

		WARN_ON(s->role.level != PT_PAGE_TABLE_LEVEL);
1976
		ret |= kvm_sync_page(vcpu, s, invalid_list);
1977 1978
	}

1979
	return ret;
1980 1981
}

1982
struct mmu_page_path {
P
Paolo Bonzini 已提交
1983 1984
	struct kvm_mmu_page *parent[PT64_ROOT_LEVEL];
	unsigned int idx[PT64_ROOT_LEVEL];
1985 1986
};

1987
#define for_each_sp(pvec, sp, parents, i)			\
P
Paolo Bonzini 已提交
1988
		for (i = mmu_pages_first(&pvec, &parents);	\
1989 1990 1991
			i < pvec.nr && ({ sp = pvec.page[i].sp; 1;});	\
			i = mmu_pages_next(&pvec, &parents, i))

1992 1993 1994
static int mmu_pages_next(struct kvm_mmu_pages *pvec,
			  struct mmu_page_path *parents,
			  int i)
1995 1996 1997 1998 1999
{
	int n;

	for (n = i+1; n < pvec->nr; n++) {
		struct kvm_mmu_page *sp = pvec->page[n].sp;
P
Paolo Bonzini 已提交
2000 2001
		unsigned idx = pvec->page[n].idx;
		int level = sp->role.level;
2002

P
Paolo Bonzini 已提交
2003 2004 2005
		parents->idx[level-1] = idx;
		if (level == PT_PAGE_TABLE_LEVEL)
			break;
2006

P
Paolo Bonzini 已提交
2007
		parents->parent[level-2] = sp;
2008 2009 2010 2011 2012
	}

	return n;
}

P
Paolo Bonzini 已提交
2013 2014 2015 2016 2017 2018 2019 2020 2021
static int mmu_pages_first(struct kvm_mmu_pages *pvec,
			   struct mmu_page_path *parents)
{
	struct kvm_mmu_page *sp;
	int level;

	if (pvec->nr == 0)
		return 0;

2022 2023
	WARN_ON(pvec->page[0].idx != INVALID_INDEX);

P
Paolo Bonzini 已提交
2024 2025 2026 2027 2028 2029 2030 2031 2032 2033 2034 2035 2036
	sp = pvec->page[0].sp;
	level = sp->role.level;
	WARN_ON(level == PT_PAGE_TABLE_LEVEL);

	parents->parent[level-2] = sp;

	/* Also set up a sentinel.  Further entries in pvec are all
	 * children of sp, so this element is never overwritten.
	 */
	parents->parent[level-1] = NULL;
	return mmu_pages_next(pvec, parents, 0);
}

2037
static void mmu_pages_clear_parents(struct mmu_page_path *parents)
2038
{
2039 2040 2041 2042 2043 2044 2045 2046 2047
	struct kvm_mmu_page *sp;
	unsigned int level = 0;

	do {
		unsigned int idx = parents->idx[level];
		sp = parents->parent[level];
		if (!sp)
			return;

2048
		WARN_ON(idx == INVALID_INDEX);
2049
		clear_unsync_child_bit(sp, idx);
2050
		level++;
P
Paolo Bonzini 已提交
2051
	} while (!sp->unsync_children);
2052
}
2053

2054 2055 2056 2057 2058 2059 2060
static void mmu_sync_children(struct kvm_vcpu *vcpu,
			      struct kvm_mmu_page *parent)
{
	int i;
	struct kvm_mmu_page *sp;
	struct mmu_page_path parents;
	struct kvm_mmu_pages pages;
2061
	LIST_HEAD(invalid_list);
2062
	bool flush = false;
2063 2064

	while (mmu_unsync_walk(parent, &pages)) {
2065
		bool protected = false;
2066 2067

		for_each_sp(pages, sp, parents, i)
2068
			protected |= rmap_write_protect(vcpu, sp->gfn);
2069

2070
		if (protected) {
2071
			kvm_flush_remote_tlbs(vcpu->kvm);
2072 2073
			flush = false;
		}
2074

2075
		for_each_sp(pages, sp, parents, i) {
2076
			flush |= kvm_sync_page(vcpu, sp, &invalid_list);
2077 2078
			mmu_pages_clear_parents(&parents);
		}
2079 2080 2081 2082 2083
		if (need_resched() || spin_needbreak(&vcpu->kvm->mmu_lock)) {
			kvm_mmu_flush_or_zap(vcpu, &invalid_list, false, flush);
			cond_resched_lock(&vcpu->kvm->mmu_lock);
			flush = false;
		}
2084
	}
2085 2086

	kvm_mmu_flush_or_zap(vcpu, &invalid_list, false, flush);
2087 2088
}

2089 2090
static void __clear_sp_write_flooding_count(struct kvm_mmu_page *sp)
{
2091
	atomic_set(&sp->write_flooding_count,  0);
2092 2093 2094 2095 2096 2097 2098 2099 2100
}

static void clear_sp_write_flooding_count(u64 *spte)
{
	struct kvm_mmu_page *sp =  page_header(__pa(spte));

	__clear_sp_write_flooding_count(sp);
}

2101 2102 2103 2104 2105
static bool is_obsolete_sp(struct kvm *kvm, struct kvm_mmu_page *sp)
{
	return unlikely(sp->mmu_valid_gen != kvm->arch.mmu_valid_gen);
}

2106 2107 2108 2109
static struct kvm_mmu_page *kvm_mmu_get_page(struct kvm_vcpu *vcpu,
					     gfn_t gfn,
					     gva_t gaddr,
					     unsigned level,
2110
					     int direct,
2111
					     unsigned access)
2112 2113 2114
{
	union kvm_mmu_page_role role;
	unsigned quadrant;
2115 2116
	struct kvm_mmu_page *sp;
	bool need_sync = false;
2117 2118
	bool flush = false;
	LIST_HEAD(invalid_list);
2119

2120
	role = vcpu->arch.mmu.base_role;
2121
	role.level = level;
2122
	role.direct = direct;
2123
	if (role.direct)
2124
		role.cr4_pae = 0;
2125
	role.access = access;
2126 2127
	if (!vcpu->arch.mmu.direct_map
	    && vcpu->arch.mmu.root_level <= PT32_ROOT_LEVEL) {
2128 2129 2130 2131
		quadrant = gaddr >> (PAGE_SHIFT + (PT64_PT_BITS * level));
		quadrant &= (1 << ((PT32_PT_BITS - PT64_PT_BITS) * level)) - 1;
		role.quadrant = quadrant;
	}
2132
	for_each_gfn_sp(vcpu->kvm, sp, gfn) {
2133 2134 2135
		if (is_obsolete_sp(vcpu->kvm, sp))
			continue;

2136 2137
		if (!need_sync && sp->unsync)
			need_sync = true;
2138

2139 2140
		if (sp->role.word != role.word)
			continue;
2141

2142 2143 2144 2145 2146 2147 2148 2149 2150 2151
		if (sp->unsync) {
			/* The page is good, but __kvm_sync_page might still end
			 * up zapping it.  If so, break in order to rebuild it.
			 */
			if (!__kvm_sync_page(vcpu, sp, &invalid_list))
				break;

			WARN_ON(!list_empty(&invalid_list));
			kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu);
		}
2152

2153
		if (sp->unsync_children)
2154
			kvm_make_request(KVM_REQ_MMU_SYNC, vcpu);
2155

2156
		__clear_sp_write_flooding_count(sp);
2157 2158 2159
		trace_kvm_mmu_get_page(sp, false);
		return sp;
	}
2160

A
Avi Kivity 已提交
2161
	++vcpu->kvm->stat.mmu_cache_miss;
2162 2163 2164

	sp = kvm_mmu_alloc_page(vcpu, direct);

2165 2166
	sp->gfn = gfn;
	sp->role = role;
2167 2168
	hlist_add_head(&sp->hash_link,
		&vcpu->kvm->arch.mmu_page_hash[kvm_page_table_hashfn(gfn)]);
2169
	if (!direct) {
2170 2171 2172 2173 2174 2175 2176 2177
		/*
		 * we should do write protection before syncing pages
		 * otherwise the content of the synced shadow page may
		 * be inconsistent with guest page table.
		 */
		account_shadowed(vcpu->kvm, sp);
		if (level == PT_PAGE_TABLE_LEVEL &&
		      rmap_write_protect(vcpu, gfn))
2178
			kvm_flush_remote_tlbs(vcpu->kvm);
2179 2180

		if (level > PT_PAGE_TABLE_LEVEL && need_sync)
2181
			flush |= kvm_sync_pages(vcpu, gfn, &invalid_list);
2182
	}
2183
	sp->mmu_valid_gen = vcpu->kvm->arch.mmu_valid_gen;
2184
	clear_page(sp->spt);
A
Avi Kivity 已提交
2185
	trace_kvm_mmu_get_page(sp, true);
2186 2187

	kvm_mmu_flush_or_zap(vcpu, &invalid_list, false, flush);
2188
	return sp;
2189 2190
}

2191 2192 2193 2194 2195 2196
static void shadow_walk_init(struct kvm_shadow_walk_iterator *iterator,
			     struct kvm_vcpu *vcpu, u64 addr)
{
	iterator->addr = addr;
	iterator->shadow_addr = vcpu->arch.mmu.root_hpa;
	iterator->level = vcpu->arch.mmu.shadow_root_level;
2197 2198 2199 2200 2201 2202

	if (iterator->level == PT64_ROOT_LEVEL &&
	    vcpu->arch.mmu.root_level < PT64_ROOT_LEVEL &&
	    !vcpu->arch.mmu.direct_map)
		--iterator->level;

2203 2204 2205 2206 2207 2208 2209 2210 2211 2212 2213 2214 2215 2216
	if (iterator->level == PT32E_ROOT_LEVEL) {
		iterator->shadow_addr
			= vcpu->arch.mmu.pae_root[(addr >> 30) & 3];
		iterator->shadow_addr &= PT64_BASE_ADDR_MASK;
		--iterator->level;
		if (!iterator->shadow_addr)
			iterator->level = 0;
	}
}

static bool shadow_walk_okay(struct kvm_shadow_walk_iterator *iterator)
{
	if (iterator->level < PT_PAGE_TABLE_LEVEL)
		return false;
2217

2218 2219 2220 2221 2222
	iterator->index = SHADOW_PT_INDEX(iterator->addr, iterator->level);
	iterator->sptep	= ((u64 *)__va(iterator->shadow_addr)) + iterator->index;
	return true;
}

2223 2224
static void __shadow_walk_next(struct kvm_shadow_walk_iterator *iterator,
			       u64 spte)
2225
{
2226
	if (is_last_spte(spte, iterator->level)) {
2227 2228 2229 2230
		iterator->level = 0;
		return;
	}

2231
	iterator->shadow_addr = spte & PT64_BASE_ADDR_MASK;
2232 2233 2234
	--iterator->level;
}

2235 2236 2237 2238 2239
static void shadow_walk_next(struct kvm_shadow_walk_iterator *iterator)
{
	return __shadow_walk_next(iterator, *iterator->sptep);
}

2240 2241
static void link_shadow_page(struct kvm_vcpu *vcpu, u64 *sptep,
			     struct kvm_mmu_page *sp)
2242 2243 2244
{
	u64 spte;

2245 2246 2247
	BUILD_BUG_ON(VMX_EPT_READABLE_MASK != PT_PRESENT_MASK ||
			VMX_EPT_WRITABLE_MASK != PT_WRITABLE_MASK);

X
Xiao Guangrong 已提交
2248
	spte = __pa(sp->spt) | PT_PRESENT_MASK | PT_WRITABLE_MASK |
2249
	       shadow_user_mask | shadow_x_mask | shadow_accessed_mask;
X
Xiao Guangrong 已提交
2250

2251
	mmu_spte_set(sptep, spte);
2252 2253 2254 2255 2256

	mmu_page_add_parent_pte(vcpu, sp, sptep);

	if (sp->unsync_children || sp->unsync)
		mark_unsync(sptep);
2257 2258
}

2259 2260 2261 2262 2263 2264 2265 2266 2267 2268 2269 2270 2271 2272 2273 2274 2275
static void validate_direct_spte(struct kvm_vcpu *vcpu, u64 *sptep,
				   unsigned direct_access)
{
	if (is_shadow_present_pte(*sptep) && !is_large_pte(*sptep)) {
		struct kvm_mmu_page *child;

		/*
		 * For the direct sp, if the guest pte's dirty bit
		 * changed form clean to dirty, it will corrupt the
		 * sp's access: allow writable in the read-only sp,
		 * so we should update the spte at this point to get
		 * a new sp with the correct access.
		 */
		child = page_header(*sptep & PT64_BASE_ADDR_MASK);
		if (child->role.access == direct_access)
			return;

2276
		drop_parent_pte(child, sptep);
2277 2278 2279 2280
		kvm_flush_remote_tlbs(vcpu->kvm);
	}
}

X
Xiao Guangrong 已提交
2281
static bool mmu_page_zap_pte(struct kvm *kvm, struct kvm_mmu_page *sp,
2282 2283 2284 2285 2286 2287 2288
			     u64 *spte)
{
	u64 pte;
	struct kvm_mmu_page *child;

	pte = *spte;
	if (is_shadow_present_pte(pte)) {
X
Xiao Guangrong 已提交
2289
		if (is_last_spte(pte, sp->role.level)) {
2290
			drop_spte(kvm, spte);
X
Xiao Guangrong 已提交
2291 2292 2293
			if (is_large_pte(pte))
				--kvm->stat.lpages;
		} else {
2294
			child = page_header(pte & PT64_BASE_ADDR_MASK);
2295
			drop_parent_pte(child, spte);
2296
		}
X
Xiao Guangrong 已提交
2297 2298 2299 2300
		return true;
	}

	if (is_mmio_spte(pte))
2301
		mmu_spte_clear_no_track(spte);
2302

X
Xiao Guangrong 已提交
2303
	return false;
2304 2305
}

2306
static void kvm_mmu_page_unlink_children(struct kvm *kvm,
2307
					 struct kvm_mmu_page *sp)
2308
{
2309 2310
	unsigned i;

2311 2312
	for (i = 0; i < PT64_ENT_PER_PAGE; ++i)
		mmu_page_zap_pte(kvm, sp, sp->spt + i);
2313 2314
}

2315
static void kvm_mmu_unlink_parents(struct kvm *kvm, struct kvm_mmu_page *sp)
2316
{
2317 2318
	u64 *sptep;
	struct rmap_iterator iter;
2319

2320
	while ((sptep = rmap_get_first(&sp->parent_ptes, &iter)))
2321
		drop_parent_pte(sp, sptep);
2322 2323
}

2324
static int mmu_zap_unsync_children(struct kvm *kvm,
2325 2326
				   struct kvm_mmu_page *parent,
				   struct list_head *invalid_list)
2327
{
2328 2329 2330
	int i, zapped = 0;
	struct mmu_page_path parents;
	struct kvm_mmu_pages pages;
2331

2332
	if (parent->role.level == PT_PAGE_TABLE_LEVEL)
2333
		return 0;
2334 2335 2336 2337 2338

	while (mmu_unsync_walk(parent, &pages)) {
		struct kvm_mmu_page *sp;

		for_each_sp(pages, sp, parents, i) {
2339
			kvm_mmu_prepare_zap_page(kvm, sp, invalid_list);
2340
			mmu_pages_clear_parents(&parents);
2341
			zapped++;
2342 2343 2344 2345
		}
	}

	return zapped;
2346 2347
}

2348 2349
static int kvm_mmu_prepare_zap_page(struct kvm *kvm, struct kvm_mmu_page *sp,
				    struct list_head *invalid_list)
2350
{
2351
	int ret;
A
Avi Kivity 已提交
2352

2353
	trace_kvm_mmu_prepare_zap_page(sp);
2354
	++kvm->stat.mmu_shadow_zapped;
2355
	ret = mmu_zap_unsync_children(kvm, sp, invalid_list);
2356
	kvm_mmu_page_unlink_children(kvm, sp);
2357
	kvm_mmu_unlink_parents(kvm, sp);
2358

2359
	if (!sp->role.invalid && !sp->role.direct)
2360
		unaccount_shadowed(kvm, sp);
2361

2362 2363
	if (sp->unsync)
		kvm_unlink_unsync_page(kvm, sp);
2364
	if (!sp->root_count) {
2365 2366
		/* Count self */
		ret++;
2367
		list_move(&sp->link, invalid_list);
2368
		kvm_mod_used_mmu_pages(kvm, -1);
2369
	} else {
A
Avi Kivity 已提交
2370
		list_move(&sp->link, &kvm->arch.active_mmu_pages);
2371 2372 2373 2374 2375 2376 2377

		/*
		 * The obsolete pages can not be used on any vcpus.
		 * See the comments in kvm_mmu_invalidate_zap_all_pages().
		 */
		if (!sp->role.invalid && !is_obsolete_sp(kvm, sp))
			kvm_reload_remote_mmus(kvm);
2378
	}
2379 2380

	sp->role.invalid = 1;
2381
	return ret;
2382 2383
}

2384 2385 2386
static void kvm_mmu_commit_zap_page(struct kvm *kvm,
				    struct list_head *invalid_list)
{
2387
	struct kvm_mmu_page *sp, *nsp;
2388 2389 2390 2391

	if (list_empty(invalid_list))
		return;

2392 2393 2394 2395 2396
	/*
	 * wmb: make sure everyone sees our modifications to the page tables
	 * rmb: make sure we see changes to vcpu->mode
	 */
	smp_mb();
X
Xiao Guangrong 已提交
2397

2398 2399 2400 2401 2402
	/*
	 * Wait for all vcpus to exit guest mode and/or lockless shadow
	 * page table walks.
	 */
	kvm_flush_remote_tlbs(kvm);
2403

2404
	list_for_each_entry_safe(sp, nsp, invalid_list, link) {
2405
		WARN_ON(!sp->role.invalid || sp->root_count);
2406
		kvm_mmu_free_page(sp);
2407
	}
2408 2409
}

2410 2411 2412 2413 2414 2415 2416 2417
static bool prepare_zap_oldest_mmu_page(struct kvm *kvm,
					struct list_head *invalid_list)
{
	struct kvm_mmu_page *sp;

	if (list_empty(&kvm->arch.active_mmu_pages))
		return false;

G
Geliang Tang 已提交
2418 2419
	sp = list_last_entry(&kvm->arch.active_mmu_pages,
			     struct kvm_mmu_page, link);
2420 2421 2422 2423 2424
	kvm_mmu_prepare_zap_page(kvm, sp, invalid_list);

	return true;
}

2425 2426
/*
 * Changing the number of mmu pages allocated to the vm
2427
 * Note: if goal_nr_mmu_pages is too small, you will get dead lock
2428
 */
2429
void kvm_mmu_change_mmu_pages(struct kvm *kvm, unsigned int goal_nr_mmu_pages)
2430
{
2431
	LIST_HEAD(invalid_list);
2432

2433 2434
	spin_lock(&kvm->mmu_lock);

2435
	if (kvm->arch.n_used_mmu_pages > goal_nr_mmu_pages) {
2436 2437 2438 2439
		/* Need to free some mmu pages to achieve the goal. */
		while (kvm->arch.n_used_mmu_pages > goal_nr_mmu_pages)
			if (!prepare_zap_oldest_mmu_page(kvm, &invalid_list))
				break;
2440

2441
		kvm_mmu_commit_zap_page(kvm, &invalid_list);
2442
		goal_nr_mmu_pages = kvm->arch.n_used_mmu_pages;
2443 2444
	}

2445
	kvm->arch.n_max_mmu_pages = goal_nr_mmu_pages;
2446 2447

	spin_unlock(&kvm->mmu_lock);
2448 2449
}

2450
int kvm_mmu_unprotect_page(struct kvm *kvm, gfn_t gfn)
2451
{
2452
	struct kvm_mmu_page *sp;
2453
	LIST_HEAD(invalid_list);
2454 2455
	int r;

2456
	pgprintk("%s: looking for gfn %llx\n", __func__, gfn);
2457
	r = 0;
2458
	spin_lock(&kvm->mmu_lock);
2459
	for_each_gfn_indirect_valid_sp(kvm, sp, gfn) {
2460
		pgprintk("%s: gfn %llx role %x\n", __func__, gfn,
2461 2462
			 sp->role.word);
		r = 1;
2463
		kvm_mmu_prepare_zap_page(kvm, sp, &invalid_list);
2464
	}
2465
	kvm_mmu_commit_zap_page(kvm, &invalid_list);
2466 2467
	spin_unlock(&kvm->mmu_lock);

2468
	return r;
2469
}
2470
EXPORT_SYMBOL_GPL(kvm_mmu_unprotect_page);
2471

2472
static void kvm_unsync_page(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp)
2473 2474 2475 2476 2477 2478 2479 2480
{
	trace_kvm_mmu_unsync_page(sp);
	++vcpu->kvm->stat.mmu_unsync;
	sp->unsync = 1;

	kvm_mmu_mark_parents_unsync(sp);
}

2481 2482
static bool mmu_need_write_protect(struct kvm_vcpu *vcpu, gfn_t gfn,
				   bool can_unsync)
2483
{
2484
	struct kvm_mmu_page *sp;
2485

2486 2487
	if (kvm_page_track_is_active(vcpu, gfn, KVM_PAGE_TRACK_WRITE))
		return true;
2488

2489
	for_each_gfn_indirect_valid_sp(vcpu->kvm, sp, gfn) {
2490
		if (!can_unsync)
2491
			return true;
2492

2493 2494
		if (sp->unsync)
			continue;
2495

2496 2497
		WARN_ON(sp->role.level != PT_PAGE_TABLE_LEVEL);
		kvm_unsync_page(vcpu, sp);
2498
	}
2499 2500

	return false;
2501 2502
}

D
Dan Williams 已提交
2503
static bool kvm_is_mmio_pfn(kvm_pfn_t pfn)
2504 2505 2506 2507 2508 2509 2510
{
	if (pfn_valid(pfn))
		return !is_zero_pfn(pfn) && PageReserved(pfn_to_page(pfn));

	return true;
}

A
Avi Kivity 已提交
2511
static int set_spte(struct kvm_vcpu *vcpu, u64 *sptep,
2512
		    unsigned pte_access, int level,
D
Dan Williams 已提交
2513
		    gfn_t gfn, kvm_pfn_t pfn, bool speculative,
2514
		    bool can_unsync, bool host_writable)
2515
{
2516
	u64 spte;
M
Marcelo Tosatti 已提交
2517
	int ret = 0;
S
Sheng Yang 已提交
2518

2519
	if (set_mmio_spte(vcpu, sptep, gfn, pfn, pte_access))
2520 2521
		return 0;

2522
	spte = PT_PRESENT_MASK;
2523
	if (!speculative)
2524
		spte |= shadow_accessed_mask;
2525

S
Sheng Yang 已提交
2526 2527 2528 2529
	if (pte_access & ACC_EXEC_MASK)
		spte |= shadow_x_mask;
	else
		spte |= shadow_nx_mask;
2530

2531
	if (pte_access & ACC_USER_MASK)
S
Sheng Yang 已提交
2532
		spte |= shadow_user_mask;
2533

2534
	if (level > PT_PAGE_TABLE_LEVEL)
M
Marcelo Tosatti 已提交
2535
		spte |= PT_PAGE_SIZE_MASK;
2536
	if (tdp_enabled)
2537
		spte |= kvm_x86_ops->get_mt_mask(vcpu, gfn,
2538
			kvm_is_mmio_pfn(pfn));
2539

2540
	if (host_writable)
2541
		spte |= SPTE_HOST_WRITEABLE;
2542 2543
	else
		pte_access &= ~ACC_WRITE_MASK;
2544

2545
	spte |= (u64)pfn << PAGE_SHIFT;
2546

2547
	if (pte_access & ACC_WRITE_MASK) {
2548

X
Xiao Guangrong 已提交
2549
		/*
2550 2551 2552 2553
		 * Other vcpu creates new sp in the window between
		 * mapping_level() and acquiring mmu-lock. We can
		 * allow guest to retry the access, the mapping can
		 * be fixed if guest refault.
X
Xiao Guangrong 已提交
2554
		 */
2555
		if (level > PT_PAGE_TABLE_LEVEL &&
2556
		    mmu_gfn_lpage_is_disallowed(vcpu, gfn, level))
A
Avi Kivity 已提交
2557
			goto done;
2558

2559
		spte |= PT_WRITABLE_MASK | SPTE_MMU_WRITEABLE;
2560

2561 2562 2563 2564 2565 2566
		/*
		 * Optimization: for pte sync, if spte was writable the hash
		 * lookup is unnecessary (and expensive). Write protection
		 * is responsibility of mmu_get_page / kvm_sync_page.
		 * Same reasoning can be applied to dirty page accounting.
		 */
2567
		if (!can_unsync && is_writable_pte(*sptep))
2568 2569
			goto set_pte;

2570
		if (mmu_need_write_protect(vcpu, gfn, can_unsync)) {
2571
			pgprintk("%s: found shadow page for %llx, marking ro\n",
2572
				 __func__, gfn);
M
Marcelo Tosatti 已提交
2573
			ret = 1;
2574
			pte_access &= ~ACC_WRITE_MASK;
2575
			spte &= ~(PT_WRITABLE_MASK | SPTE_MMU_WRITEABLE);
2576 2577 2578
		}
	}

2579
	if (pte_access & ACC_WRITE_MASK) {
2580
		kvm_vcpu_mark_page_dirty(vcpu, gfn);
2581 2582
		spte |= shadow_dirty_mask;
	}
2583

2584
set_pte:
2585
	if (mmu_spte_update(sptep, spte))
2586
		kvm_flush_remote_tlbs(vcpu->kvm);
A
Avi Kivity 已提交
2587
done:
M
Marcelo Tosatti 已提交
2588 2589 2590
	return ret;
}

2591
static bool mmu_set_spte(struct kvm_vcpu *vcpu, u64 *sptep, unsigned pte_access,
D
Dan Williams 已提交
2592
			 int write_fault, int level, gfn_t gfn, kvm_pfn_t pfn,
2593
			 bool speculative, bool host_writable)
M
Marcelo Tosatti 已提交
2594 2595
{
	int was_rmapped = 0;
2596
	int rmap_count;
2597
	bool emulate = false;
M
Marcelo Tosatti 已提交
2598

2599 2600
	pgprintk("%s: spte %llx write_fault %d gfn %llx\n", __func__,
		 *sptep, write_fault, gfn);
M
Marcelo Tosatti 已提交
2601

2602
	if (is_shadow_present_pte(*sptep)) {
M
Marcelo Tosatti 已提交
2603 2604 2605 2606
		/*
		 * If we overwrite a PTE page pointer with a 2MB PMD, unlink
		 * the parent of the now unreachable PTE.
		 */
2607 2608
		if (level > PT_PAGE_TABLE_LEVEL &&
		    !is_large_pte(*sptep)) {
M
Marcelo Tosatti 已提交
2609
			struct kvm_mmu_page *child;
A
Avi Kivity 已提交
2610
			u64 pte = *sptep;
M
Marcelo Tosatti 已提交
2611 2612

			child = page_header(pte & PT64_BASE_ADDR_MASK);
2613
			drop_parent_pte(child, sptep);
2614
			kvm_flush_remote_tlbs(vcpu->kvm);
A
Avi Kivity 已提交
2615
		} else if (pfn != spte_to_pfn(*sptep)) {
2616
			pgprintk("hfn old %llx new %llx\n",
A
Avi Kivity 已提交
2617
				 spte_to_pfn(*sptep), pfn);
2618
			drop_spte(vcpu->kvm, sptep);
2619
			kvm_flush_remote_tlbs(vcpu->kvm);
2620 2621
		} else
			was_rmapped = 1;
M
Marcelo Tosatti 已提交
2622
	}
2623

2624 2625
	if (set_spte(vcpu, sptep, pte_access, level, gfn, pfn, speculative,
	      true, host_writable)) {
M
Marcelo Tosatti 已提交
2626
		if (write_fault)
2627
			emulate = true;
2628
		kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu);
2629
	}
M
Marcelo Tosatti 已提交
2630

2631 2632
	if (unlikely(is_mmio_spte(*sptep)))
		emulate = true;
2633

A
Avi Kivity 已提交
2634
	pgprintk("%s: setting spte %llx\n", __func__, *sptep);
2635
	pgprintk("instantiating %s PTE (%s) at %llx (%llx) addr %p\n",
A
Avi Kivity 已提交
2636
		 is_large_pte(*sptep)? "2MB" : "4kB",
2637 2638
		 *sptep & PT_PRESENT_MASK ?"RW":"R", gfn,
		 *sptep, sptep);
A
Avi Kivity 已提交
2639
	if (!was_rmapped && is_large_pte(*sptep))
M
Marcelo Tosatti 已提交
2640 2641
		++vcpu->kvm->stat.lpages;

2642 2643 2644 2645 2646 2647
	if (is_shadow_present_pte(*sptep)) {
		if (!was_rmapped) {
			rmap_count = rmap_add(vcpu, sptep, gfn);
			if (rmap_count > RMAP_RECYCLE_THRESHOLD)
				rmap_recycle(vcpu, sptep, gfn);
		}
2648
	}
2649

X
Xiao Guangrong 已提交
2650
	kvm_release_pfn_clean(pfn);
2651 2652

	return emulate;
2653 2654
}

D
Dan Williams 已提交
2655
static kvm_pfn_t pte_prefetch_gfn_to_pfn(struct kvm_vcpu *vcpu, gfn_t gfn,
2656 2657 2658 2659
				     bool no_dirty_log)
{
	struct kvm_memory_slot *slot;

2660
	slot = gfn_to_memslot_dirty_bitmap(vcpu, gfn, no_dirty_log);
2661
	if (!slot)
2662
		return KVM_PFN_ERR_FAULT;
2663

2664
	return gfn_to_pfn_memslot_atomic(slot, gfn);
2665 2666 2667 2668 2669 2670 2671
}

static int direct_pte_prefetch_many(struct kvm_vcpu *vcpu,
				    struct kvm_mmu_page *sp,
				    u64 *start, u64 *end)
{
	struct page *pages[PTE_PREFETCH_NUM];
2672
	struct kvm_memory_slot *slot;
2673 2674 2675 2676 2677
	unsigned access = sp->role.access;
	int i, ret;
	gfn_t gfn;

	gfn = kvm_mmu_page_get_gfn(sp, start - sp->spt);
2678 2679
	slot = gfn_to_memslot_dirty_bitmap(vcpu, gfn, access & ACC_WRITE_MASK);
	if (!slot)
2680 2681
		return -1;

2682
	ret = gfn_to_page_many_atomic(slot, gfn, pages, end - start);
2683 2684 2685 2686
	if (ret <= 0)
		return -1;

	for (i = 0; i < ret; i++, gfn++, start++)
2687 2688
		mmu_set_spte(vcpu, start, access, 0, sp->role.level, gfn,
			     page_to_pfn(pages[i]), true, true);
2689 2690 2691 2692 2693 2694 2695 2696 2697 2698 2699 2700 2701 2702 2703 2704

	return 0;
}

static void __direct_pte_prefetch(struct kvm_vcpu *vcpu,
				  struct kvm_mmu_page *sp, u64 *sptep)
{
	u64 *spte, *start = NULL;
	int i;

	WARN_ON(!sp->role.direct);

	i = (sptep - sp->spt) & ~(PTE_PREFETCH_NUM - 1);
	spte = sp->spt + i;

	for (i = 0; i < PTE_PREFETCH_NUM; i++, spte++) {
2705
		if (is_shadow_present_pte(*spte) || spte == sptep) {
2706 2707 2708 2709 2710 2711 2712 2713 2714 2715 2716 2717 2718 2719 2720 2721 2722 2723 2724 2725 2726 2727 2728 2729 2730 2731 2732 2733 2734 2735
			if (!start)
				continue;
			if (direct_pte_prefetch_many(vcpu, sp, start, spte) < 0)
				break;
			start = NULL;
		} else if (!start)
			start = spte;
	}
}

static void direct_pte_prefetch(struct kvm_vcpu *vcpu, u64 *sptep)
{
	struct kvm_mmu_page *sp;

	/*
	 * Since it's no accessed bit on EPT, it's no way to
	 * distinguish between actually accessed translations
	 * and prefetched, so disable pte prefetch if EPT is
	 * enabled.
	 */
	if (!shadow_accessed_mask)
		return;

	sp = page_header(__pa(sptep));
	if (sp->role.level > PT_PAGE_TABLE_LEVEL)
		return;

	__direct_pte_prefetch(vcpu, sp, sptep);
}

2736
static int __direct_map(struct kvm_vcpu *vcpu, int write, int map_writable,
D
Dan Williams 已提交
2737
			int level, gfn_t gfn, kvm_pfn_t pfn, bool prefault)
2738
{
2739
	struct kvm_shadow_walk_iterator iterator;
2740
	struct kvm_mmu_page *sp;
2741
	int emulate = 0;
2742
	gfn_t pseudo_gfn;
A
Avi Kivity 已提交
2743

2744 2745 2746
	if (!VALID_PAGE(vcpu->arch.mmu.root_hpa))
		return 0;

2747
	for_each_shadow_entry(vcpu, (u64)gfn << PAGE_SHIFT, iterator) {
2748
		if (iterator.level == level) {
2749 2750 2751
			emulate = mmu_set_spte(vcpu, iterator.sptep, ACC_ALL,
					       write, level, gfn, pfn, prefault,
					       map_writable);
2752
			direct_pte_prefetch(vcpu, iterator.sptep);
2753 2754
			++vcpu->stat.pf_fixed;
			break;
A
Avi Kivity 已提交
2755 2756
		}

2757
		drop_large_spte(vcpu, iterator.sptep);
2758
		if (!is_shadow_present_pte(*iterator.sptep)) {
2759 2760 2761 2762
			u64 base_addr = iterator.addr;

			base_addr &= PT64_LVL_ADDR_MASK(iterator.level);
			pseudo_gfn = base_addr >> PAGE_SHIFT;
2763
			sp = kvm_mmu_get_page(vcpu, pseudo_gfn, iterator.addr,
2764
					      iterator.level - 1, 1, ACC_ALL);
2765

2766
			link_shadow_page(vcpu, iterator.sptep, sp);
2767 2768
		}
	}
2769
	return emulate;
A
Avi Kivity 已提交
2770 2771
}

H
Huang Ying 已提交
2772
static void kvm_send_hwpoison_signal(unsigned long address, struct task_struct *tsk)
2773
{
H
Huang Ying 已提交
2774 2775 2776 2777 2778 2779 2780
	siginfo_t info;

	info.si_signo	= SIGBUS;
	info.si_errno	= 0;
	info.si_code	= BUS_MCEERR_AR;
	info.si_addr	= (void __user *)address;
	info.si_addr_lsb = PAGE_SHIFT;
2781

H
Huang Ying 已提交
2782
	send_sig_info(SIGBUS, &info, tsk);
2783 2784
}

D
Dan Williams 已提交
2785
static int kvm_handle_bad_page(struct kvm_vcpu *vcpu, gfn_t gfn, kvm_pfn_t pfn)
2786
{
X
Xiao Guangrong 已提交
2787 2788 2789 2790 2791 2792 2793 2794 2795
	/*
	 * Do not cache the mmio info caused by writing the readonly gfn
	 * into the spte otherwise read access on readonly gfn also can
	 * caused mmio page fault and treat it as mmio access.
	 * Return 1 to tell kvm to emulate it.
	 */
	if (pfn == KVM_PFN_ERR_RO_FAULT)
		return 1;

2796
	if (pfn == KVM_PFN_ERR_HWPOISON) {
2797
		kvm_send_hwpoison_signal(kvm_vcpu_gfn_to_hva(vcpu, gfn), current);
2798
		return 0;
2799
	}
2800

2801
	return -EFAULT;
2802 2803
}

2804
static void transparent_hugepage_adjust(struct kvm_vcpu *vcpu,
D
Dan Williams 已提交
2805 2806
					gfn_t *gfnp, kvm_pfn_t *pfnp,
					int *levelp)
2807
{
D
Dan Williams 已提交
2808
	kvm_pfn_t pfn = *pfnp;
2809 2810 2811 2812 2813 2814 2815 2816 2817
	gfn_t gfn = *gfnp;
	int level = *levelp;

	/*
	 * Check if it's a transparent hugepage. If this would be an
	 * hugetlbfs page, level wouldn't be set to
	 * PT_PAGE_TABLE_LEVEL and there would be no adjustment done
	 * here.
	 */
2818
	if (!is_error_noslot_pfn(pfn) && !kvm_is_reserved_pfn(pfn) &&
2819 2820
	    level == PT_PAGE_TABLE_LEVEL &&
	    PageTransCompound(pfn_to_page(pfn)) &&
2821
	    !mmu_gfn_lpage_is_disallowed(vcpu, gfn, PT_DIRECTORY_LEVEL)) {
2822 2823 2824 2825 2826 2827 2828 2829 2830 2831 2832 2833 2834 2835 2836 2837 2838 2839
		unsigned long mask;
		/*
		 * mmu_notifier_retry was successful and we hold the
		 * mmu_lock here, so the pmd can't become splitting
		 * from under us, and in turn
		 * __split_huge_page_refcount() can't run from under
		 * us and we can safely transfer the refcount from
		 * PG_tail to PG_head as we switch the pfn to tail to
		 * head.
		 */
		*levelp = level = PT_DIRECTORY_LEVEL;
		mask = KVM_PAGES_PER_HPAGE(level) - 1;
		VM_BUG_ON((gfn & mask) != (pfn & mask));
		if (pfn & mask) {
			gfn &= ~mask;
			*gfnp = gfn;
			kvm_release_pfn_clean(pfn);
			pfn &= ~mask;
2840
			kvm_get_pfn(pfn);
2841 2842 2843 2844 2845
			*pfnp = pfn;
		}
	}
}

2846
static bool handle_abnormal_pfn(struct kvm_vcpu *vcpu, gva_t gva, gfn_t gfn,
D
Dan Williams 已提交
2847
				kvm_pfn_t pfn, unsigned access, int *ret_val)
2848 2849
{
	/* The pfn is invalid, report the error! */
2850
	if (unlikely(is_error_pfn(pfn))) {
2851
		*ret_val = kvm_handle_bad_page(vcpu, gfn, pfn);
2852
		return true;
2853 2854
	}

2855
	if (unlikely(is_noslot_pfn(pfn)))
2856 2857
		vcpu_cache_mmio_info(vcpu, gva, gfn, access);

2858
	return false;
2859 2860
}

2861
static bool page_fault_can_be_fast(u32 error_code)
2862
{
2863 2864 2865 2866 2867 2868 2869
	/*
	 * Do not fix the mmio spte with invalid generation number which
	 * need to be updated by slow page fault path.
	 */
	if (unlikely(error_code & PFERR_RSVD_MASK))
		return false;

2870 2871 2872 2873 2874 2875 2876 2877 2878 2879 2880 2881 2882
	/*
	 * #PF can be fast only if the shadow page table is present and it
	 * is caused by write-protect, that means we just need change the
	 * W bit of the spte which can be done out of mmu-lock.
	 */
	if (!(error_code & PFERR_PRESENT_MASK) ||
	      !(error_code & PFERR_WRITE_MASK))
		return false;

	return true;
}

static bool
2883 2884
fast_pf_fix_direct_spte(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp,
			u64 *sptep, u64 spte)
2885 2886 2887 2888 2889 2890 2891 2892 2893 2894 2895
{
	gfn_t gfn;

	WARN_ON(!sp->role.direct);

	/*
	 * The gfn of direct spte is stable since it is calculated
	 * by sp->gfn.
	 */
	gfn = kvm_mmu_page_get_gfn(sp, sptep - sp->spt);

2896 2897 2898 2899 2900 2901 2902 2903 2904 2905 2906 2907
	/*
	 * Theoretically we could also set dirty bit (and flush TLB) here in
	 * order to eliminate unnecessary PML logging. See comments in
	 * set_spte. But fast_page_fault is very unlikely to happen with PML
	 * enabled, so we do not do this. This might result in the same GPA
	 * to be logged in PML buffer again when the write really happens, and
	 * eventually to be called by mark_page_dirty twice. But it's also no
	 * harm. This also avoids the TLB flush needed after setting dirty bit
	 * so non-PML cases won't be impacted.
	 *
	 * Compare with set_spte where instead shadow_dirty_mask is set.
	 */
2908
	if (cmpxchg64(sptep, spte, spte | PT_WRITABLE_MASK) == spte)
2909
		kvm_vcpu_mark_page_dirty(vcpu, gfn);
2910 2911 2912 2913 2914 2915 2916 2917 2918 2919 2920 2921 2922

	return true;
}

/*
 * Return value:
 * - true: let the vcpu to access on the same address again.
 * - false: let the real page fault path to fix it.
 */
static bool fast_page_fault(struct kvm_vcpu *vcpu, gva_t gva, int level,
			    u32 error_code)
{
	struct kvm_shadow_walk_iterator iterator;
2923
	struct kvm_mmu_page *sp;
2924 2925 2926
	bool ret = false;
	u64 spte = 0ull;

2927 2928 2929
	if (!VALID_PAGE(vcpu->arch.mmu.root_hpa))
		return false;

2930
	if (!page_fault_can_be_fast(error_code))
2931 2932 2933 2934 2935 2936 2937 2938 2939 2940 2941
		return false;

	walk_shadow_page_lockless_begin(vcpu);
	for_each_shadow_entry_lockless(vcpu, gva, iterator, spte)
		if (!is_shadow_present_pte(spte) || iterator.level < level)
			break;

	/*
	 * If the mapping has been changed, let the vcpu fault on the
	 * same address again.
	 */
2942
	if (!is_shadow_present_pte(spte)) {
2943 2944 2945 2946
		ret = true;
		goto exit;
	}

2947 2948
	sp = page_header(__pa(iterator.sptep));
	if (!is_last_spte(spte, sp->role.level))
2949 2950 2951 2952 2953 2954 2955 2956 2957 2958 2959 2960 2961 2962 2963 2964 2965 2966 2967 2968
		goto exit;

	/*
	 * Check if it is a spurious fault caused by TLB lazily flushed.
	 *
	 * Need not check the access of upper level table entries since
	 * they are always ACC_ALL.
	 */
	 if (is_writable_pte(spte)) {
		ret = true;
		goto exit;
	}

	/*
	 * Currently, to simplify the code, only the spte write-protected
	 * by dirty-log can be fast fixed.
	 */
	if (!spte_is_locklessly_modifiable(spte))
		goto exit;

2969 2970 2971 2972 2973 2974 2975 2976 2977 2978 2979 2980 2981
	/*
	 * Do not fix write-permission on the large spte since we only dirty
	 * the first page into the dirty-bitmap in fast_pf_fix_direct_spte()
	 * that means other pages are missed if its slot is dirty-logged.
	 *
	 * Instead, we let the slow page fault path create a normal spte to
	 * fix the access.
	 *
	 * See the comments in kvm_arch_commit_memory_region().
	 */
	if (sp->role.level > PT_PAGE_TABLE_LEVEL)
		goto exit;

2982 2983 2984 2985 2986
	/*
	 * Currently, fast page fault only works for direct mapping since
	 * the gfn is not stable for indirect shadow page.
	 * See Documentation/virtual/kvm/locking.txt to get more detail.
	 */
2987
	ret = fast_pf_fix_direct_spte(vcpu, sp, iterator.sptep, spte);
2988
exit:
X
Xiao Guangrong 已提交
2989 2990
	trace_fast_page_fault(vcpu, gva, error_code, iterator.sptep,
			      spte, ret);
2991 2992 2993 2994 2995
	walk_shadow_page_lockless_end(vcpu);

	return ret;
}

2996
static bool try_async_pf(struct kvm_vcpu *vcpu, bool prefault, gfn_t gfn,
D
Dan Williams 已提交
2997
			 gva_t gva, kvm_pfn_t *pfn, bool write, bool *writable);
2998
static void make_mmu_pages_available(struct kvm_vcpu *vcpu);
2999

3000 3001
static int nonpaging_map(struct kvm_vcpu *vcpu, gva_t v, u32 error_code,
			 gfn_t gfn, bool prefault)
3002 3003
{
	int r;
3004
	int level;
3005
	bool force_pt_level = false;
D
Dan Williams 已提交
3006
	kvm_pfn_t pfn;
3007
	unsigned long mmu_seq;
3008
	bool map_writable, write = error_code & PFERR_WRITE_MASK;
3009

3010
	level = mapping_level(vcpu, gfn, &force_pt_level);
3011 3012 3013 3014 3015 3016 3017 3018
	if (likely(!force_pt_level)) {
		/*
		 * This path builds a PAE pagetable - so we can map
		 * 2mb pages at maximum. Therefore check if the level
		 * is larger than that.
		 */
		if (level > PT_DIRECTORY_LEVEL)
			level = PT_DIRECTORY_LEVEL;
3019

3020
		gfn &= ~(KVM_PAGES_PER_HPAGE(level) - 1);
3021
	}
M
Marcelo Tosatti 已提交
3022

3023 3024 3025
	if (fast_page_fault(vcpu, v, level, error_code))
		return 0;

3026
	mmu_seq = vcpu->kvm->mmu_notifier_seq;
3027
	smp_rmb();
3028

3029
	if (try_async_pf(vcpu, prefault, gfn, v, &pfn, write, &map_writable))
3030
		return 0;
3031

3032 3033
	if (handle_abnormal_pfn(vcpu, v, gfn, pfn, ACC_ALL, &r))
		return r;
3034

3035
	spin_lock(&vcpu->kvm->mmu_lock);
3036
	if (mmu_notifier_retry(vcpu->kvm, mmu_seq))
3037
		goto out_unlock;
3038
	make_mmu_pages_available(vcpu);
3039 3040
	if (likely(!force_pt_level))
		transparent_hugepage_adjust(vcpu, &gfn, &pfn, &level);
3041
	r = __direct_map(vcpu, write, map_writable, level, gfn, pfn, prefault);
3042 3043
	spin_unlock(&vcpu->kvm->mmu_lock);

3044
	return r;
3045 3046 3047 3048 3049

out_unlock:
	spin_unlock(&vcpu->kvm->mmu_lock);
	kvm_release_pfn_clean(pfn);
	return 0;
3050 3051 3052
}


3053 3054 3055
static void mmu_free_roots(struct kvm_vcpu *vcpu)
{
	int i;
3056
	struct kvm_mmu_page *sp;
3057
	LIST_HEAD(invalid_list);
3058

3059
	if (!VALID_PAGE(vcpu->arch.mmu.root_hpa))
A
Avi Kivity 已提交
3060
		return;
3061

3062 3063 3064
	if (vcpu->arch.mmu.shadow_root_level == PT64_ROOT_LEVEL &&
	    (vcpu->arch.mmu.root_level == PT64_ROOT_LEVEL ||
	     vcpu->arch.mmu.direct_map)) {
3065
		hpa_t root = vcpu->arch.mmu.root_hpa;
3066

3067
		spin_lock(&vcpu->kvm->mmu_lock);
3068 3069
		sp = page_header(root);
		--sp->root_count;
3070 3071 3072 3073
		if (!sp->root_count && sp->role.invalid) {
			kvm_mmu_prepare_zap_page(vcpu->kvm, sp, &invalid_list);
			kvm_mmu_commit_zap_page(vcpu->kvm, &invalid_list);
		}
3074
		spin_unlock(&vcpu->kvm->mmu_lock);
3075
		vcpu->arch.mmu.root_hpa = INVALID_PAGE;
3076 3077
		return;
	}
3078 3079

	spin_lock(&vcpu->kvm->mmu_lock);
3080
	for (i = 0; i < 4; ++i) {
3081
		hpa_t root = vcpu->arch.mmu.pae_root[i];
3082

A
Avi Kivity 已提交
3083 3084
		if (root) {
			root &= PT64_BASE_ADDR_MASK;
3085 3086
			sp = page_header(root);
			--sp->root_count;
3087
			if (!sp->root_count && sp->role.invalid)
3088 3089
				kvm_mmu_prepare_zap_page(vcpu->kvm, sp,
							 &invalid_list);
A
Avi Kivity 已提交
3090
		}
3091
		vcpu->arch.mmu.pae_root[i] = INVALID_PAGE;
3092
	}
3093
	kvm_mmu_commit_zap_page(vcpu->kvm, &invalid_list);
3094
	spin_unlock(&vcpu->kvm->mmu_lock);
3095
	vcpu->arch.mmu.root_hpa = INVALID_PAGE;
3096 3097
}

3098 3099 3100 3101 3102
static int mmu_check_root(struct kvm_vcpu *vcpu, gfn_t root_gfn)
{
	int ret = 0;

	if (!kvm_is_visible_gfn(vcpu->kvm, root_gfn)) {
3103
		kvm_make_request(KVM_REQ_TRIPLE_FAULT, vcpu);
3104 3105 3106 3107 3108 3109
		ret = 1;
	}

	return ret;
}

3110 3111 3112
static int mmu_alloc_direct_roots(struct kvm_vcpu *vcpu)
{
	struct kvm_mmu_page *sp;
3113
	unsigned i;
3114 3115 3116

	if (vcpu->arch.mmu.shadow_root_level == PT64_ROOT_LEVEL) {
		spin_lock(&vcpu->kvm->mmu_lock);
3117
		make_mmu_pages_available(vcpu);
3118
		sp = kvm_mmu_get_page(vcpu, 0, 0, PT64_ROOT_LEVEL, 1, ACC_ALL);
3119 3120 3121 3122 3123 3124 3125
		++sp->root_count;
		spin_unlock(&vcpu->kvm->mmu_lock);
		vcpu->arch.mmu.root_hpa = __pa(sp->spt);
	} else if (vcpu->arch.mmu.shadow_root_level == PT32E_ROOT_LEVEL) {
		for (i = 0; i < 4; ++i) {
			hpa_t root = vcpu->arch.mmu.pae_root[i];

3126
			MMU_WARN_ON(VALID_PAGE(root));
3127
			spin_lock(&vcpu->kvm->mmu_lock);
3128
			make_mmu_pages_available(vcpu);
3129
			sp = kvm_mmu_get_page(vcpu, i << (30 - PAGE_SHIFT),
3130
					i << 30, PT32_ROOT_LEVEL, 1, ACC_ALL);
3131 3132 3133 3134 3135
			root = __pa(sp->spt);
			++sp->root_count;
			spin_unlock(&vcpu->kvm->mmu_lock);
			vcpu->arch.mmu.pae_root[i] = root | PT_PRESENT_MASK;
		}
3136
		vcpu->arch.mmu.root_hpa = __pa(vcpu->arch.mmu.pae_root);
3137 3138 3139 3140 3141 3142 3143
	} else
		BUG();

	return 0;
}

static int mmu_alloc_shadow_roots(struct kvm_vcpu *vcpu)
3144
{
3145
	struct kvm_mmu_page *sp;
3146 3147 3148
	u64 pdptr, pm_mask;
	gfn_t root_gfn;
	int i;
3149

3150
	root_gfn = vcpu->arch.mmu.get_cr3(vcpu) >> PAGE_SHIFT;
3151

3152 3153 3154 3155 3156 3157 3158 3159
	if (mmu_check_root(vcpu, root_gfn))
		return 1;

	/*
	 * Do we shadow a long mode page table? If so we need to
	 * write-protect the guests page table root.
	 */
	if (vcpu->arch.mmu.root_level == PT64_ROOT_LEVEL) {
3160
		hpa_t root = vcpu->arch.mmu.root_hpa;
3161

3162
		MMU_WARN_ON(VALID_PAGE(root));
3163

3164
		spin_lock(&vcpu->kvm->mmu_lock);
3165
		make_mmu_pages_available(vcpu);
3166
		sp = kvm_mmu_get_page(vcpu, root_gfn, 0, PT64_ROOT_LEVEL,
3167
				      0, ACC_ALL);
3168 3169
		root = __pa(sp->spt);
		++sp->root_count;
3170
		spin_unlock(&vcpu->kvm->mmu_lock);
3171
		vcpu->arch.mmu.root_hpa = root;
3172
		return 0;
3173
	}
3174

3175 3176
	/*
	 * We shadow a 32 bit page table. This may be a legacy 2-level
3177 3178
	 * or a PAE 3-level page table. In either case we need to be aware that
	 * the shadow page table may be a PAE or a long mode page table.
3179
	 */
3180 3181 3182 3183
	pm_mask = PT_PRESENT_MASK;
	if (vcpu->arch.mmu.shadow_root_level == PT64_ROOT_LEVEL)
		pm_mask |= PT_ACCESSED_MASK | PT_WRITABLE_MASK | PT_USER_MASK;

3184
	for (i = 0; i < 4; ++i) {
3185
		hpa_t root = vcpu->arch.mmu.pae_root[i];
3186

3187
		MMU_WARN_ON(VALID_PAGE(root));
3188
		if (vcpu->arch.mmu.root_level == PT32E_ROOT_LEVEL) {
3189
			pdptr = vcpu->arch.mmu.get_pdptr(vcpu, i);
3190
			if (!is_present_gpte(pdptr)) {
3191
				vcpu->arch.mmu.pae_root[i] = 0;
A
Avi Kivity 已提交
3192 3193
				continue;
			}
A
Avi Kivity 已提交
3194
			root_gfn = pdptr >> PAGE_SHIFT;
3195 3196
			if (mmu_check_root(vcpu, root_gfn))
				return 1;
3197
		}
3198
		spin_lock(&vcpu->kvm->mmu_lock);
3199
		make_mmu_pages_available(vcpu);
3200 3201
		sp = kvm_mmu_get_page(vcpu, root_gfn, i << 30, PT32_ROOT_LEVEL,
				      0, ACC_ALL);
3202 3203
		root = __pa(sp->spt);
		++sp->root_count;
3204 3205
		spin_unlock(&vcpu->kvm->mmu_lock);

3206
		vcpu->arch.mmu.pae_root[i] = root | pm_mask;
3207
	}
3208
	vcpu->arch.mmu.root_hpa = __pa(vcpu->arch.mmu.pae_root);
3209 3210 3211 3212 3213 3214 3215 3216 3217 3218 3219 3220 3221 3222 3223 3224 3225 3226 3227 3228 3229 3230 3231 3232 3233 3234

	/*
	 * If we shadow a 32 bit page table with a long mode page
	 * table we enter this path.
	 */
	if (vcpu->arch.mmu.shadow_root_level == PT64_ROOT_LEVEL) {
		if (vcpu->arch.mmu.lm_root == NULL) {
			/*
			 * The additional page necessary for this is only
			 * allocated on demand.
			 */

			u64 *lm_root;

			lm_root = (void*)get_zeroed_page(GFP_KERNEL);
			if (lm_root == NULL)
				return 1;

			lm_root[0] = __pa(vcpu->arch.mmu.pae_root) | pm_mask;

			vcpu->arch.mmu.lm_root = lm_root;
		}

		vcpu->arch.mmu.root_hpa = __pa(vcpu->arch.mmu.lm_root);
	}

3235
	return 0;
3236 3237
}

3238 3239 3240 3241 3242 3243 3244 3245
static int mmu_alloc_roots(struct kvm_vcpu *vcpu)
{
	if (vcpu->arch.mmu.direct_map)
		return mmu_alloc_direct_roots(vcpu);
	else
		return mmu_alloc_shadow_roots(vcpu);
}

3246 3247 3248 3249 3250
static void mmu_sync_roots(struct kvm_vcpu *vcpu)
{
	int i;
	struct kvm_mmu_page *sp;

3251 3252 3253
	if (vcpu->arch.mmu.direct_map)
		return;

3254 3255
	if (!VALID_PAGE(vcpu->arch.mmu.root_hpa))
		return;
3256

3257
	vcpu_clear_mmio_info(vcpu, MMIO_GVA_ANY);
3258
	kvm_mmu_audit(vcpu, AUDIT_PRE_SYNC);
3259
	if (vcpu->arch.mmu.root_level == PT64_ROOT_LEVEL) {
3260 3261 3262
		hpa_t root = vcpu->arch.mmu.root_hpa;
		sp = page_header(root);
		mmu_sync_children(vcpu, sp);
3263
		kvm_mmu_audit(vcpu, AUDIT_POST_SYNC);
3264 3265 3266 3267 3268
		return;
	}
	for (i = 0; i < 4; ++i) {
		hpa_t root = vcpu->arch.mmu.pae_root[i];

3269
		if (root && VALID_PAGE(root)) {
3270 3271 3272 3273 3274
			root &= PT64_BASE_ADDR_MASK;
			sp = page_header(root);
			mmu_sync_children(vcpu, sp);
		}
	}
3275
	kvm_mmu_audit(vcpu, AUDIT_POST_SYNC);
3276 3277 3278 3279 3280 3281
}

void kvm_mmu_sync_roots(struct kvm_vcpu *vcpu)
{
	spin_lock(&vcpu->kvm->mmu_lock);
	mmu_sync_roots(vcpu);
3282
	spin_unlock(&vcpu->kvm->mmu_lock);
3283
}
N
Nadav Har'El 已提交
3284
EXPORT_SYMBOL_GPL(kvm_mmu_sync_roots);
3285

3286
static gpa_t nonpaging_gva_to_gpa(struct kvm_vcpu *vcpu, gva_t vaddr,
3287
				  u32 access, struct x86_exception *exception)
A
Avi Kivity 已提交
3288
{
3289 3290
	if (exception)
		exception->error_code = 0;
A
Avi Kivity 已提交
3291 3292 3293
	return vaddr;
}

3294
static gpa_t nonpaging_gva_to_gpa_nested(struct kvm_vcpu *vcpu, gva_t vaddr,
3295 3296
					 u32 access,
					 struct x86_exception *exception)
3297
{
3298 3299
	if (exception)
		exception->error_code = 0;
3300
	return vcpu->arch.nested_mmu.translate_gpa(vcpu, vaddr, access, exception);
3301 3302
}

3303 3304 3305 3306 3307 3308 3309 3310 3311 3312 3313 3314 3315 3316 3317 3318 3319 3320 3321
static bool
__is_rsvd_bits_set(struct rsvd_bits_validate *rsvd_check, u64 pte, int level)
{
	int bit7 = (pte >> 7) & 1, low6 = pte & 0x3f;

	return (pte & rsvd_check->rsvd_bits_mask[bit7][level-1]) |
		((rsvd_check->bad_mt_xwr & (1ull << low6)) != 0);
}

static bool is_rsvd_bits_set(struct kvm_mmu *mmu, u64 gpte, int level)
{
	return __is_rsvd_bits_set(&mmu->guest_rsvd_check, gpte, level);
}

static bool is_shadow_zero_bits_set(struct kvm_mmu *mmu, u64 spte, int level)
{
	return __is_rsvd_bits_set(&mmu->shadow_zero_check, spte, level);
}

3322
static bool mmio_info_in_cache(struct kvm_vcpu *vcpu, u64 addr, bool direct)
3323 3324 3325 3326 3327 3328 3329
{
	if (direct)
		return vcpu_match_mmio_gpa(vcpu, addr);

	return vcpu_match_mmio_gva(vcpu, addr);
}

3330 3331 3332
/* return true if reserved bit is detected on spte. */
static bool
walk_shadow_page_get_mmio_spte(struct kvm_vcpu *vcpu, u64 addr, u64 *sptep)
3333 3334
{
	struct kvm_shadow_walk_iterator iterator;
3335 3336 3337
	u64 sptes[PT64_ROOT_LEVEL], spte = 0ull;
	int root, leaf;
	bool reserved = false;
3338

3339
	if (!VALID_PAGE(vcpu->arch.mmu.root_hpa))
3340
		goto exit;
3341

3342
	walk_shadow_page_lockless_begin(vcpu);
3343

3344 3345
	for (shadow_walk_init(&iterator, vcpu, addr),
		 leaf = root = iterator.level;
3346 3347 3348 3349 3350
	     shadow_walk_okay(&iterator);
	     __shadow_walk_next(&iterator, spte)) {
		spte = mmu_spte_get_lockless(iterator.sptep);

		sptes[leaf - 1] = spte;
3351
		leaf--;
3352

3353 3354
		if (!is_shadow_present_pte(spte))
			break;
3355 3356

		reserved |= is_shadow_zero_bits_set(&vcpu->arch.mmu, spte,
3357
						    iterator.level);
3358 3359
	}

3360 3361
	walk_shadow_page_lockless_end(vcpu);

3362 3363 3364
	if (reserved) {
		pr_err("%s: detect reserved bits on spte, addr 0x%llx, dump hierarchy:\n",
		       __func__, addr);
3365
		while (root > leaf) {
3366 3367 3368 3369 3370 3371 3372 3373
			pr_err("------ spte 0x%llx level %d.\n",
			       sptes[root - 1], root);
			root--;
		}
	}
exit:
	*sptep = spte;
	return reserved;
3374 3375
}

3376
int handle_mmio_page_fault(struct kvm_vcpu *vcpu, u64 addr, bool direct)
3377 3378
{
	u64 spte;
3379
	bool reserved;
3380

3381
	if (mmio_info_in_cache(vcpu, addr, direct))
3382
		return RET_MMIO_PF_EMULATE;
3383

3384
	reserved = walk_shadow_page_get_mmio_spte(vcpu, addr, &spte);
3385
	if (WARN_ON(reserved))
3386
		return RET_MMIO_PF_BUG;
3387 3388 3389 3390 3391

	if (is_mmio_spte(spte)) {
		gfn_t gfn = get_mmio_spte_gfn(spte);
		unsigned access = get_mmio_spte_access(spte);

3392
		if (!check_mmio_spte(vcpu, spte))
3393 3394
			return RET_MMIO_PF_INVALID;

3395 3396
		if (direct)
			addr = 0;
X
Xiao Guangrong 已提交
3397 3398

		trace_handle_mmio_page_fault(addr, gfn, access);
3399
		vcpu_cache_mmio_info(vcpu, addr, gfn, access);
3400
		return RET_MMIO_PF_EMULATE;
3401 3402 3403 3404 3405 3406
	}

	/*
	 * If the page table is zapped by other cpus, let CPU fault again on
	 * the address.
	 */
3407
	return RET_MMIO_PF_RETRY;
3408
}
3409
EXPORT_SYMBOL_GPL(handle_mmio_page_fault);
3410

3411 3412 3413 3414 3415 3416 3417 3418 3419 3420 3421 3422 3423 3424 3425 3426 3427 3428 3429 3430
static bool page_fault_handle_page_track(struct kvm_vcpu *vcpu,
					 u32 error_code, gfn_t gfn)
{
	if (unlikely(error_code & PFERR_RSVD_MASK))
		return false;

	if (!(error_code & PFERR_PRESENT_MASK) ||
	      !(error_code & PFERR_WRITE_MASK))
		return false;

	/*
	 * guest is writing the page which is write tracked which can
	 * not be fixed by page fault handler.
	 */
	if (kvm_page_track_is_active(vcpu, gfn, KVM_PAGE_TRACK_WRITE))
		return true;

	return false;
}

3431 3432 3433 3434 3435 3436 3437 3438 3439 3440 3441 3442 3443 3444 3445 3446 3447
static void shadow_page_table_clear_flood(struct kvm_vcpu *vcpu, gva_t addr)
{
	struct kvm_shadow_walk_iterator iterator;
	u64 spte;

	if (!VALID_PAGE(vcpu->arch.mmu.root_hpa))
		return;

	walk_shadow_page_lockless_begin(vcpu);
	for_each_shadow_entry_lockless(vcpu, addr, iterator, spte) {
		clear_sp_write_flooding_count(iterator.sptep);
		if (!is_shadow_present_pte(spte))
			break;
	}
	walk_shadow_page_lockless_end(vcpu);
}

A
Avi Kivity 已提交
3448
static int nonpaging_page_fault(struct kvm_vcpu *vcpu, gva_t gva,
3449
				u32 error_code, bool prefault)
A
Avi Kivity 已提交
3450
{
3451
	gfn_t gfn = gva >> PAGE_SHIFT;
3452
	int r;
A
Avi Kivity 已提交
3453

3454
	pgprintk("%s: gva %lx error %x\n", __func__, gva, error_code);
3455

3456 3457
	if (page_fault_handle_page_track(vcpu, error_code, gfn))
		return 1;
3458

3459 3460 3461
	r = mmu_topup_memory_caches(vcpu);
	if (r)
		return r;
3462

3463
	MMU_WARN_ON(!VALID_PAGE(vcpu->arch.mmu.root_hpa));
A
Avi Kivity 已提交
3464 3465


3466
	return nonpaging_map(vcpu, gva & PAGE_MASK,
3467
			     error_code, gfn, prefault);
A
Avi Kivity 已提交
3468 3469
}

3470
static int kvm_arch_setup_async_pf(struct kvm_vcpu *vcpu, gva_t gva, gfn_t gfn)
3471 3472
{
	struct kvm_arch_async_pf arch;
X
Xiao Guangrong 已提交
3473

3474
	arch.token = (vcpu->arch.apf.id++ << 12) | vcpu->vcpu_id;
3475
	arch.gfn = gfn;
3476
	arch.direct_map = vcpu->arch.mmu.direct_map;
X
Xiao Guangrong 已提交
3477
	arch.cr3 = vcpu->arch.mmu.get_cr3(vcpu);
3478

3479
	return kvm_setup_async_pf(vcpu, gva, kvm_vcpu_gfn_to_hva(vcpu, gfn), &arch);
3480 3481 3482 3483
}

static bool can_do_async_pf(struct kvm_vcpu *vcpu)
{
3484
	if (unlikely(!lapic_in_kernel(vcpu) ||
3485 3486 3487 3488 3489 3490
		     kvm_event_needs_reinjection(vcpu)))
		return false;

	return kvm_x86_ops->interrupt_allowed(vcpu);
}

3491
static bool try_async_pf(struct kvm_vcpu *vcpu, bool prefault, gfn_t gfn,
D
Dan Williams 已提交
3492
			 gva_t gva, kvm_pfn_t *pfn, bool write, bool *writable)
3493
{
3494
	struct kvm_memory_slot *slot;
3495 3496
	bool async;

3497
	slot = kvm_vcpu_gfn_to_memslot(vcpu, gfn);
3498 3499
	async = false;
	*pfn = __gfn_to_pfn_memslot(slot, gfn, false, &async, write, writable);
3500 3501 3502
	if (!async)
		return false; /* *pfn has correct page already */

3503
	if (!prefault && can_do_async_pf(vcpu)) {
3504
		trace_kvm_try_async_get_page(gva, gfn);
3505 3506 3507 3508 3509 3510 3511 3512
		if (kvm_find_async_pf_gfn(vcpu, gfn)) {
			trace_kvm_async_pf_doublefault(gva, gfn);
			kvm_make_request(KVM_REQ_APF_HALT, vcpu);
			return true;
		} else if (kvm_arch_setup_async_pf(vcpu, gva, gfn))
			return true;
	}

3513
	*pfn = __gfn_to_pfn_memslot(slot, gfn, false, NULL, write, writable);
3514 3515 3516
	return false;
}

3517 3518 3519 3520 3521 3522 3523 3524 3525 3526
static bool
check_hugepage_cache_consistency(struct kvm_vcpu *vcpu, gfn_t gfn, int level)
{
	int page_num = KVM_PAGES_PER_HPAGE(level);

	gfn &= ~(page_num - 1);

	return kvm_mtrr_check_gfn_range_consistency(vcpu, gfn, page_num);
}

G
Gleb Natapov 已提交
3527
static int tdp_page_fault(struct kvm_vcpu *vcpu, gva_t gpa, u32 error_code,
3528
			  bool prefault)
3529
{
D
Dan Williams 已提交
3530
	kvm_pfn_t pfn;
3531
	int r;
3532
	int level;
3533
	bool force_pt_level;
M
Marcelo Tosatti 已提交
3534
	gfn_t gfn = gpa >> PAGE_SHIFT;
3535
	unsigned long mmu_seq;
3536 3537
	int write = error_code & PFERR_WRITE_MASK;
	bool map_writable;
3538

3539
	MMU_WARN_ON(!VALID_PAGE(vcpu->arch.mmu.root_hpa));
3540

3541 3542
	if (page_fault_handle_page_track(vcpu, error_code, gfn))
		return 1;
3543

3544 3545 3546 3547
	r = mmu_topup_memory_caches(vcpu);
	if (r)
		return r;

3548 3549 3550
	force_pt_level = !check_hugepage_cache_consistency(vcpu, gfn,
							   PT_DIRECTORY_LEVEL);
	level = mapping_level(vcpu, gfn, &force_pt_level);
3551
	if (likely(!force_pt_level)) {
3552 3553 3554
		if (level > PT_DIRECTORY_LEVEL &&
		    !check_hugepage_cache_consistency(vcpu, gfn, level))
			level = PT_DIRECTORY_LEVEL;
3555
		gfn &= ~(KVM_PAGES_PER_HPAGE(level) - 1);
3556
	}
3557

3558 3559 3560
	if (fast_page_fault(vcpu, gpa, level, error_code))
		return 0;

3561
	mmu_seq = vcpu->kvm->mmu_notifier_seq;
3562
	smp_rmb();
3563

3564
	if (try_async_pf(vcpu, prefault, gfn, gpa, &pfn, write, &map_writable))
3565 3566
		return 0;

3567 3568 3569
	if (handle_abnormal_pfn(vcpu, 0, gfn, pfn, ACC_ALL, &r))
		return r;

3570
	spin_lock(&vcpu->kvm->mmu_lock);
3571
	if (mmu_notifier_retry(vcpu->kvm, mmu_seq))
3572
		goto out_unlock;
3573
	make_mmu_pages_available(vcpu);
3574 3575
	if (likely(!force_pt_level))
		transparent_hugepage_adjust(vcpu, &gfn, &pfn, &level);
3576
	r = __direct_map(vcpu, write, map_writable, level, gfn, pfn, prefault);
3577 3578 3579
	spin_unlock(&vcpu->kvm->mmu_lock);

	return r;
3580 3581 3582 3583 3584

out_unlock:
	spin_unlock(&vcpu->kvm->mmu_lock);
	kvm_release_pfn_clean(pfn);
	return 0;
3585 3586
}

3587 3588
static void nonpaging_init_context(struct kvm_vcpu *vcpu,
				   struct kvm_mmu *context)
A
Avi Kivity 已提交
3589 3590 3591
{
	context->page_fault = nonpaging_page_fault;
	context->gva_to_gpa = nonpaging_gva_to_gpa;
3592
	context->sync_page = nonpaging_sync_page;
M
Marcelo Tosatti 已提交
3593
	context->invlpg = nonpaging_invlpg;
3594
	context->update_pte = nonpaging_update_pte;
3595
	context->root_level = 0;
A
Avi Kivity 已提交
3596
	context->shadow_root_level = PT32E_ROOT_LEVEL;
A
Avi Kivity 已提交
3597
	context->root_hpa = INVALID_PAGE;
3598
	context->direct_map = true;
3599
	context->nx = false;
A
Avi Kivity 已提交
3600 3601
}

3602
void kvm_mmu_new_cr3(struct kvm_vcpu *vcpu)
A
Avi Kivity 已提交
3603
{
3604
	mmu_free_roots(vcpu);
A
Avi Kivity 已提交
3605 3606
}

3607 3608
static unsigned long get_cr3(struct kvm_vcpu *vcpu)
{
3609
	return kvm_read_cr3(vcpu);
3610 3611
}

3612 3613
static void inject_page_fault(struct kvm_vcpu *vcpu,
			      struct x86_exception *fault)
A
Avi Kivity 已提交
3614
{
3615
	vcpu->arch.mmu.inject_page_fault(vcpu, fault);
A
Avi Kivity 已提交
3616 3617
}

3618
static bool sync_mmio_spte(struct kvm_vcpu *vcpu, u64 *sptep, gfn_t gfn,
3619
			   unsigned access, int *nr_present)
3620 3621 3622 3623 3624 3625 3626 3627
{
	if (unlikely(is_mmio_spte(*sptep))) {
		if (gfn != get_mmio_spte_gfn(*sptep)) {
			mmu_spte_clear_no_track(sptep);
			return true;
		}

		(*nr_present)++;
3628
		mark_mmio_spte(vcpu, sptep, gfn, access);
3629 3630 3631 3632 3633 3634
		return true;
	}

	return false;
}

3635 3636
static inline bool is_last_gpte(struct kvm_mmu *mmu,
				unsigned level, unsigned gpte)
A
Avi Kivity 已提交
3637
{
3638 3639 3640 3641 3642 3643
	/*
	 * PT_PAGE_TABLE_LEVEL always terminates.  The RHS has bit 7 set
	 * iff level <= PT_PAGE_TABLE_LEVEL, which for our purpose means
	 * level == PT_PAGE_TABLE_LEVEL; set PT_PAGE_SIZE_MASK in gpte then.
	 */
	gpte |= level - PT_PAGE_TABLE_LEVEL - 1;
A
Avi Kivity 已提交
3644

3645 3646 3647 3648 3649 3650 3651 3652
	/*
	 * The RHS has bit 7 set iff level < mmu->last_nonleaf_level.
	 * If it is clear, there are no large pages at this level, so clear
	 * PT_PAGE_SIZE_MASK in gpte if that is the case.
	 */
	gpte &= level - mmu->last_nonleaf_level;

	return gpte & PT_PAGE_SIZE_MASK;
A
Avi Kivity 已提交
3653 3654
}

3655 3656 3657 3658 3659
#define PTTYPE_EPT 18 /* arbitrary */
#define PTTYPE PTTYPE_EPT
#include "paging_tmpl.h"
#undef PTTYPE

A
Avi Kivity 已提交
3660 3661 3662 3663 3664 3665 3666 3667
#define PTTYPE 64
#include "paging_tmpl.h"
#undef PTTYPE

#define PTTYPE 32
#include "paging_tmpl.h"
#undef PTTYPE

3668 3669 3670 3671
static void
__reset_rsvds_bits_mask(struct kvm_vcpu *vcpu,
			struct rsvd_bits_validate *rsvd_check,
			int maxphyaddr, int level, bool nx, bool gbpages,
3672
			bool pse, bool amd)
3673 3674
{
	u64 exb_bit_rsvd = 0;
3675
	u64 gbpages_bit_rsvd = 0;
3676
	u64 nonleaf_bit8_rsvd = 0;
3677

3678
	rsvd_check->bad_mt_xwr = 0;
3679

3680
	if (!nx)
3681
		exb_bit_rsvd = rsvd_bits(63, 63);
3682
	if (!gbpages)
3683
		gbpages_bit_rsvd = rsvd_bits(7, 7);
3684 3685 3686 3687 3688

	/*
	 * Non-leaf PML4Es and PDPEs reserve bit 8 (which would be the G bit for
	 * leaf entries) on AMD CPUs only.
	 */
3689
	if (amd)
3690 3691
		nonleaf_bit8_rsvd = rsvd_bits(8, 8);

3692
	switch (level) {
3693 3694
	case PT32_ROOT_LEVEL:
		/* no rsvd bits for 2 level 4K page table entries */
3695 3696 3697 3698
		rsvd_check->rsvd_bits_mask[0][1] = 0;
		rsvd_check->rsvd_bits_mask[0][0] = 0;
		rsvd_check->rsvd_bits_mask[1][0] =
			rsvd_check->rsvd_bits_mask[0][0];
3699

3700
		if (!pse) {
3701
			rsvd_check->rsvd_bits_mask[1][1] = 0;
3702 3703 3704
			break;
		}

3705 3706
		if (is_cpuid_PSE36())
			/* 36bits PSE 4MB page */
3707
			rsvd_check->rsvd_bits_mask[1][1] = rsvd_bits(17, 21);
3708 3709
		else
			/* 32 bits PSE 4MB page */
3710
			rsvd_check->rsvd_bits_mask[1][1] = rsvd_bits(13, 21);
3711 3712
		break;
	case PT32E_ROOT_LEVEL:
3713
		rsvd_check->rsvd_bits_mask[0][2] =
3714
			rsvd_bits(maxphyaddr, 63) |
3715
			rsvd_bits(5, 8) | rsvd_bits(1, 2);	/* PDPTE */
3716
		rsvd_check->rsvd_bits_mask[0][1] = exb_bit_rsvd |
3717
			rsvd_bits(maxphyaddr, 62);	/* PDE */
3718
		rsvd_check->rsvd_bits_mask[0][0] = exb_bit_rsvd |
3719
			rsvd_bits(maxphyaddr, 62); 	/* PTE */
3720
		rsvd_check->rsvd_bits_mask[1][1] = exb_bit_rsvd |
3721 3722
			rsvd_bits(maxphyaddr, 62) |
			rsvd_bits(13, 20);		/* large page */
3723 3724
		rsvd_check->rsvd_bits_mask[1][0] =
			rsvd_check->rsvd_bits_mask[0][0];
3725 3726
		break;
	case PT64_ROOT_LEVEL:
3727 3728
		rsvd_check->rsvd_bits_mask[0][3] = exb_bit_rsvd |
			nonleaf_bit8_rsvd | rsvd_bits(7, 7) |
3729
			rsvd_bits(maxphyaddr, 51);
3730 3731
		rsvd_check->rsvd_bits_mask[0][2] = exb_bit_rsvd |
			nonleaf_bit8_rsvd | gbpages_bit_rsvd |
3732
			rsvd_bits(maxphyaddr, 51);
3733 3734 3735 3736 3737 3738 3739
		rsvd_check->rsvd_bits_mask[0][1] = exb_bit_rsvd |
			rsvd_bits(maxphyaddr, 51);
		rsvd_check->rsvd_bits_mask[0][0] = exb_bit_rsvd |
			rsvd_bits(maxphyaddr, 51);
		rsvd_check->rsvd_bits_mask[1][3] =
			rsvd_check->rsvd_bits_mask[0][3];
		rsvd_check->rsvd_bits_mask[1][2] = exb_bit_rsvd |
3740
			gbpages_bit_rsvd | rsvd_bits(maxphyaddr, 51) |
3741
			rsvd_bits(13, 29);
3742
		rsvd_check->rsvd_bits_mask[1][1] = exb_bit_rsvd |
3743 3744
			rsvd_bits(maxphyaddr, 51) |
			rsvd_bits(13, 20);		/* large page */
3745 3746
		rsvd_check->rsvd_bits_mask[1][0] =
			rsvd_check->rsvd_bits_mask[0][0];
3747 3748 3749 3750
		break;
	}
}

3751 3752 3753 3754 3755 3756
static void reset_rsvds_bits_mask(struct kvm_vcpu *vcpu,
				  struct kvm_mmu *context)
{
	__reset_rsvds_bits_mask(vcpu, &context->guest_rsvd_check,
				cpuid_maxphyaddr(vcpu), context->root_level,
				context->nx, guest_cpuid_has_gbpages(vcpu),
3757
				is_pse(vcpu), guest_cpuid_is_amd(vcpu));
3758 3759
}

3760 3761 3762
static void
__reset_rsvds_bits_mask_ept(struct rsvd_bits_validate *rsvd_check,
			    int maxphyaddr, bool execonly)
3763
{
3764
	u64 bad_mt_xwr;
3765

3766
	rsvd_check->rsvd_bits_mask[0][3] =
3767
		rsvd_bits(maxphyaddr, 51) | rsvd_bits(3, 7);
3768
	rsvd_check->rsvd_bits_mask[0][2] =
3769
		rsvd_bits(maxphyaddr, 51) | rsvd_bits(3, 6);
3770
	rsvd_check->rsvd_bits_mask[0][1] =
3771
		rsvd_bits(maxphyaddr, 51) | rsvd_bits(3, 6);
3772
	rsvd_check->rsvd_bits_mask[0][0] = rsvd_bits(maxphyaddr, 51);
3773 3774

	/* large page */
3775 3776
	rsvd_check->rsvd_bits_mask[1][3] = rsvd_check->rsvd_bits_mask[0][3];
	rsvd_check->rsvd_bits_mask[1][2] =
3777
		rsvd_bits(maxphyaddr, 51) | rsvd_bits(12, 29);
3778
	rsvd_check->rsvd_bits_mask[1][1] =
3779
		rsvd_bits(maxphyaddr, 51) | rsvd_bits(12, 20);
3780
	rsvd_check->rsvd_bits_mask[1][0] = rsvd_check->rsvd_bits_mask[0][0];
3781

3782 3783 3784 3785 3786 3787 3788 3789
	bad_mt_xwr = 0xFFull << (2 * 8);	/* bits 3..5 must not be 2 */
	bad_mt_xwr |= 0xFFull << (3 * 8);	/* bits 3..5 must not be 3 */
	bad_mt_xwr |= 0xFFull << (7 * 8);	/* bits 3..5 must not be 7 */
	bad_mt_xwr |= REPEAT_BYTE(1ull << 2);	/* bits 0..2 must not be 010 */
	bad_mt_xwr |= REPEAT_BYTE(1ull << 6);	/* bits 0..2 must not be 110 */
	if (!execonly) {
		/* bits 0..2 must not be 100 unless VMX capabilities allow it */
		bad_mt_xwr |= REPEAT_BYTE(1ull << 4);
3790
	}
3791
	rsvd_check->bad_mt_xwr = bad_mt_xwr;
3792 3793
}

3794 3795 3796 3797 3798 3799 3800
static void reset_rsvds_bits_mask_ept(struct kvm_vcpu *vcpu,
		struct kvm_mmu *context, bool execonly)
{
	__reset_rsvds_bits_mask_ept(&context->guest_rsvd_check,
				    cpuid_maxphyaddr(vcpu), execonly);
}

3801 3802 3803 3804 3805 3806 3807 3808
/*
 * the page table on host is the shadow page table for the page
 * table in guest or amd nested guest, its mmu features completely
 * follow the features in guest.
 */
void
reset_shadow_zero_bits_mask(struct kvm_vcpu *vcpu, struct kvm_mmu *context)
{
3809 3810
	bool uses_nx = context->nx || context->base_role.smep_andnot_wp;

3811 3812 3813 3814
	/*
	 * Passing "true" to the last argument is okay; it adds a check
	 * on bit 8 of the SPTEs which KVM doesn't use anyway.
	 */
3815 3816
	__reset_rsvds_bits_mask(vcpu, &context->shadow_zero_check,
				boot_cpu_data.x86_phys_bits,
3817
				context->shadow_root_level, uses_nx,
3818 3819
				guest_cpuid_has_gbpages(vcpu), is_pse(vcpu),
				true);
3820 3821 3822
}
EXPORT_SYMBOL_GPL(reset_shadow_zero_bits_mask);

3823 3824 3825 3826 3827 3828
static inline bool boot_cpu_is_amd(void)
{
	WARN_ON_ONCE(!tdp_enabled);
	return shadow_x_mask == 0;
}

3829 3830 3831 3832 3833 3834 3835 3836
/*
 * the direct page table on host, use as much mmu features as
 * possible, however, kvm currently does not do execution-protection.
 */
static void
reset_tdp_shadow_zero_bits_mask(struct kvm_vcpu *vcpu,
				struct kvm_mmu *context)
{
3837
	if (boot_cpu_is_amd())
3838 3839 3840
		__reset_rsvds_bits_mask(vcpu, &context->shadow_zero_check,
					boot_cpu_data.x86_phys_bits,
					context->shadow_root_level, false,
3841
					cpu_has_gbpages, true, true);
3842 3843 3844 3845 3846 3847 3848 3849 3850 3851 3852 3853 3854 3855 3856 3857 3858 3859 3860
	else
		__reset_rsvds_bits_mask_ept(&context->shadow_zero_check,
					    boot_cpu_data.x86_phys_bits,
					    false);

}

/*
 * as the comments in reset_shadow_zero_bits_mask() except it
 * is the shadow page table for intel nested guest.
 */
static void
reset_ept_shadow_zero_bits_mask(struct kvm_vcpu *vcpu,
				struct kvm_mmu *context, bool execonly)
{
	__reset_rsvds_bits_mask_ept(&context->shadow_zero_check,
				    boot_cpu_data.x86_phys_bits, execonly);
}

3861 3862
static void update_permission_bitmask(struct kvm_vcpu *vcpu,
				      struct kvm_mmu *mmu, bool ept)
3863 3864 3865
{
	unsigned bit, byte, pfec;
	u8 map;
F
Feng Wu 已提交
3866
	bool fault, x, w, u, wf, uf, ff, smapf, cr4_smap, cr4_smep, smap = 0;
3867

F
Feng Wu 已提交
3868
	cr4_smep = kvm_read_cr4_bits(vcpu, X86_CR4_SMEP);
F
Feng Wu 已提交
3869
	cr4_smap = kvm_read_cr4_bits(vcpu, X86_CR4_SMAP);
3870 3871 3872 3873 3874 3875
	for (byte = 0; byte < ARRAY_SIZE(mmu->permissions); ++byte) {
		pfec = byte << 1;
		map = 0;
		wf = pfec & PFERR_WRITE_MASK;
		uf = pfec & PFERR_USER_MASK;
		ff = pfec & PFERR_FETCH_MASK;
F
Feng Wu 已提交
3876 3877 3878 3879 3880 3881
		/*
		 * PFERR_RSVD_MASK bit is set in PFEC if the access is not
		 * subject to SMAP restrictions, and cleared otherwise. The
		 * bit is only meaningful if the SMAP bit is set in CR4.
		 */
		smapf = !(pfec & PFERR_RSVD_MASK);
3882 3883 3884 3885 3886
		for (bit = 0; bit < 8; ++bit) {
			x = bit & ACC_EXEC_MASK;
			w = bit & ACC_WRITE_MASK;
			u = bit & ACC_USER_MASK;

3887 3888 3889 3890 3891 3892
			if (!ept) {
				/* Not really needed: !nx will cause pte.nx to fault */
				x |= !mmu->nx;
				/* Allow supervisor writes if !cr0.wp */
				w |= !is_write_protection(vcpu) && !uf;
				/* Disallow supervisor fetches of user code if cr4.smep */
F
Feng Wu 已提交
3893
				x &= !(cr4_smep && u && !uf);
F
Feng Wu 已提交
3894 3895 3896 3897 3898 3899 3900 3901 3902 3903 3904 3905 3906 3907 3908 3909 3910 3911 3912 3913

				/*
				 * SMAP:kernel-mode data accesses from user-mode
				 * mappings should fault. A fault is considered
				 * as a SMAP violation if all of the following
				 * conditions are ture:
				 *   - X86_CR4_SMAP is set in CR4
				 *   - An user page is accessed
				 *   - Page fault in kernel mode
				 *   - if CPL = 3 or X86_EFLAGS_AC is clear
				 *
				 *   Here, we cover the first three conditions.
				 *   The fourth is computed dynamically in
				 *   permission_fault() and is in smapf.
				 *
				 *   Also, SMAP does not affect instruction
				 *   fetches, add the !ff check here to make it
				 *   clearer.
				 */
				smap = cr4_smap && u && !uf && !ff;
3914 3915 3916
			} else
				/* Not really needed: no U/S accesses on ept  */
				u = 1;
3917

F
Feng Wu 已提交
3918 3919
			fault = (ff && !x) || (uf && !u) || (wf && !w) ||
				(smapf && smap);
3920 3921 3922 3923 3924 3925
			map |= fault << bit;
		}
		mmu->permissions[byte] = map;
	}
}

3926
static void update_last_nonleaf_level(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu)
A
Avi Kivity 已提交
3927
{
3928 3929 3930 3931 3932
	unsigned root_level = mmu->root_level;

	mmu->last_nonleaf_level = root_level;
	if (root_level == PT32_ROOT_LEVEL && is_pse(vcpu))
		mmu->last_nonleaf_level++;
A
Avi Kivity 已提交
3933 3934
}

3935 3936 3937
static void paging64_init_context_common(struct kvm_vcpu *vcpu,
					 struct kvm_mmu *context,
					 int level)
A
Avi Kivity 已提交
3938
{
3939
	context->nx = is_nx(vcpu);
3940
	context->root_level = level;
3941

3942
	reset_rsvds_bits_mask(vcpu, context);
3943
	update_permission_bitmask(vcpu, context, false);
3944
	update_last_nonleaf_level(vcpu, context);
A
Avi Kivity 已提交
3945

3946
	MMU_WARN_ON(!is_pae(vcpu));
A
Avi Kivity 已提交
3947 3948
	context->page_fault = paging64_page_fault;
	context->gva_to_gpa = paging64_gva_to_gpa;
3949
	context->sync_page = paging64_sync_page;
M
Marcelo Tosatti 已提交
3950
	context->invlpg = paging64_invlpg;
3951
	context->update_pte = paging64_update_pte;
3952
	context->shadow_root_level = level;
A
Avi Kivity 已提交
3953
	context->root_hpa = INVALID_PAGE;
3954
	context->direct_map = false;
A
Avi Kivity 已提交
3955 3956
}

3957 3958
static void paging64_init_context(struct kvm_vcpu *vcpu,
				  struct kvm_mmu *context)
3959
{
3960
	paging64_init_context_common(vcpu, context, PT64_ROOT_LEVEL);
3961 3962
}

3963 3964
static void paging32_init_context(struct kvm_vcpu *vcpu,
				  struct kvm_mmu *context)
A
Avi Kivity 已提交
3965
{
3966
	context->nx = false;
3967
	context->root_level = PT32_ROOT_LEVEL;
3968

3969
	reset_rsvds_bits_mask(vcpu, context);
3970
	update_permission_bitmask(vcpu, context, false);
3971
	update_last_nonleaf_level(vcpu, context);
A
Avi Kivity 已提交
3972 3973 3974

	context->page_fault = paging32_page_fault;
	context->gva_to_gpa = paging32_gva_to_gpa;
3975
	context->sync_page = paging32_sync_page;
M
Marcelo Tosatti 已提交
3976
	context->invlpg = paging32_invlpg;
3977
	context->update_pte = paging32_update_pte;
A
Avi Kivity 已提交
3978
	context->shadow_root_level = PT32E_ROOT_LEVEL;
A
Avi Kivity 已提交
3979
	context->root_hpa = INVALID_PAGE;
3980
	context->direct_map = false;
A
Avi Kivity 已提交
3981 3982
}

3983 3984
static void paging32E_init_context(struct kvm_vcpu *vcpu,
				   struct kvm_mmu *context)
A
Avi Kivity 已提交
3985
{
3986
	paging64_init_context_common(vcpu, context, PT32E_ROOT_LEVEL);
A
Avi Kivity 已提交
3987 3988
}

3989
static void init_kvm_tdp_mmu(struct kvm_vcpu *vcpu)
3990
{
3991
	struct kvm_mmu *context = &vcpu->arch.mmu;
3992

3993
	context->base_role.word = 0;
3994
	context->base_role.smm = is_smm(vcpu);
3995
	context->page_fault = tdp_page_fault;
3996
	context->sync_page = nonpaging_sync_page;
M
Marcelo Tosatti 已提交
3997
	context->invlpg = nonpaging_invlpg;
3998
	context->update_pte = nonpaging_update_pte;
3999
	context->shadow_root_level = kvm_x86_ops->get_tdp_level();
4000
	context->root_hpa = INVALID_PAGE;
4001
	context->direct_map = true;
4002
	context->set_cr3 = kvm_x86_ops->set_tdp_cr3;
4003
	context->get_cr3 = get_cr3;
4004
	context->get_pdptr = kvm_pdptr_read;
4005
	context->inject_page_fault = kvm_inject_page_fault;
4006 4007

	if (!is_paging(vcpu)) {
4008
		context->nx = false;
4009 4010 4011
		context->gva_to_gpa = nonpaging_gva_to_gpa;
		context->root_level = 0;
	} else if (is_long_mode(vcpu)) {
4012
		context->nx = is_nx(vcpu);
4013
		context->root_level = PT64_ROOT_LEVEL;
4014 4015
		reset_rsvds_bits_mask(vcpu, context);
		context->gva_to_gpa = paging64_gva_to_gpa;
4016
	} else if (is_pae(vcpu)) {
4017
		context->nx = is_nx(vcpu);
4018
		context->root_level = PT32E_ROOT_LEVEL;
4019 4020
		reset_rsvds_bits_mask(vcpu, context);
		context->gva_to_gpa = paging64_gva_to_gpa;
4021
	} else {
4022
		context->nx = false;
4023
		context->root_level = PT32_ROOT_LEVEL;
4024 4025
		reset_rsvds_bits_mask(vcpu, context);
		context->gva_to_gpa = paging32_gva_to_gpa;
4026 4027
	}

4028
	update_permission_bitmask(vcpu, context, false);
4029
	update_last_nonleaf_level(vcpu, context);
4030
	reset_tdp_shadow_zero_bits_mask(vcpu, context);
4031 4032
}

4033
void kvm_init_shadow_mmu(struct kvm_vcpu *vcpu)
A
Avi Kivity 已提交
4034
{
4035
	bool smep = kvm_read_cr4_bits(vcpu, X86_CR4_SMEP);
4036
	bool smap = kvm_read_cr4_bits(vcpu, X86_CR4_SMAP);
4037 4038
	struct kvm_mmu *context = &vcpu->arch.mmu;

4039
	MMU_WARN_ON(VALID_PAGE(context->root_hpa));
A
Avi Kivity 已提交
4040 4041

	if (!is_paging(vcpu))
4042
		nonpaging_init_context(vcpu, context);
A
Avi Kivity 已提交
4043
	else if (is_long_mode(vcpu))
4044
		paging64_init_context(vcpu, context);
A
Avi Kivity 已提交
4045
	else if (is_pae(vcpu))
4046
		paging32E_init_context(vcpu, context);
A
Avi Kivity 已提交
4047
	else
4048
		paging32_init_context(vcpu, context);
4049

4050 4051 4052 4053
	context->base_role.nxe = is_nx(vcpu);
	context->base_role.cr4_pae = !!is_pae(vcpu);
	context->base_role.cr0_wp  = is_write_protection(vcpu);
	context->base_role.smep_andnot_wp
4054
		= smep && !is_write_protection(vcpu);
4055 4056
	context->base_role.smap_andnot_wp
		= smap && !is_write_protection(vcpu);
4057
	context->base_role.smm = is_smm(vcpu);
4058
	reset_shadow_zero_bits_mask(vcpu, context);
4059 4060 4061
}
EXPORT_SYMBOL_GPL(kvm_init_shadow_mmu);

4062
void kvm_init_shadow_ept_mmu(struct kvm_vcpu *vcpu, bool execonly)
N
Nadav Har'El 已提交
4063
{
4064 4065
	struct kvm_mmu *context = &vcpu->arch.mmu;

4066
	MMU_WARN_ON(VALID_PAGE(context->root_hpa));
N
Nadav Har'El 已提交
4067 4068 4069 4070 4071 4072 4073 4074 4075 4076 4077 4078 4079 4080 4081

	context->shadow_root_level = kvm_x86_ops->get_tdp_level();

	context->nx = true;
	context->page_fault = ept_page_fault;
	context->gva_to_gpa = ept_gva_to_gpa;
	context->sync_page = ept_sync_page;
	context->invlpg = ept_invlpg;
	context->update_pte = ept_update_pte;
	context->root_level = context->shadow_root_level;
	context->root_hpa = INVALID_PAGE;
	context->direct_map = false;

	update_permission_bitmask(vcpu, context, true);
	reset_rsvds_bits_mask_ept(vcpu, context, execonly);
4082
	reset_ept_shadow_zero_bits_mask(vcpu, context, execonly);
N
Nadav Har'El 已提交
4083 4084 4085
}
EXPORT_SYMBOL_GPL(kvm_init_shadow_ept_mmu);

4086
static void init_kvm_softmmu(struct kvm_vcpu *vcpu)
4087
{
4088 4089 4090 4091 4092 4093 4094
	struct kvm_mmu *context = &vcpu->arch.mmu;

	kvm_init_shadow_mmu(vcpu);
	context->set_cr3           = kvm_x86_ops->set_cr3;
	context->get_cr3           = get_cr3;
	context->get_pdptr         = kvm_pdptr_read;
	context->inject_page_fault = kvm_inject_page_fault;
A
Avi Kivity 已提交
4095 4096
}

4097
static void init_kvm_nested_mmu(struct kvm_vcpu *vcpu)
4098 4099 4100 4101
{
	struct kvm_mmu *g_context = &vcpu->arch.nested_mmu;

	g_context->get_cr3           = get_cr3;
4102
	g_context->get_pdptr         = kvm_pdptr_read;
4103 4104 4105
	g_context->inject_page_fault = kvm_inject_page_fault;

	/*
4106 4107 4108 4109 4110 4111
	 * Note that arch.mmu.gva_to_gpa translates l2_gpa to l1_gpa using
	 * L1's nested page tables (e.g. EPT12). The nested translation
	 * of l2_gva to l1_gpa is done by arch.nested_mmu.gva_to_gpa using
	 * L2's page tables as the first level of translation and L1's
	 * nested page tables as the second level of translation. Basically
	 * the gva_to_gpa functions between mmu and nested_mmu are swapped.
4112 4113
	 */
	if (!is_paging(vcpu)) {
4114
		g_context->nx = false;
4115 4116 4117
		g_context->root_level = 0;
		g_context->gva_to_gpa = nonpaging_gva_to_gpa_nested;
	} else if (is_long_mode(vcpu)) {
4118
		g_context->nx = is_nx(vcpu);
4119
		g_context->root_level = PT64_ROOT_LEVEL;
4120
		reset_rsvds_bits_mask(vcpu, g_context);
4121 4122
		g_context->gva_to_gpa = paging64_gva_to_gpa_nested;
	} else if (is_pae(vcpu)) {
4123
		g_context->nx = is_nx(vcpu);
4124
		g_context->root_level = PT32E_ROOT_LEVEL;
4125
		reset_rsvds_bits_mask(vcpu, g_context);
4126 4127
		g_context->gva_to_gpa = paging64_gva_to_gpa_nested;
	} else {
4128
		g_context->nx = false;
4129
		g_context->root_level = PT32_ROOT_LEVEL;
4130
		reset_rsvds_bits_mask(vcpu, g_context);
4131 4132 4133
		g_context->gva_to_gpa = paging32_gva_to_gpa_nested;
	}

4134
	update_permission_bitmask(vcpu, g_context, false);
4135
	update_last_nonleaf_level(vcpu, g_context);
4136 4137
}

4138
static void init_kvm_mmu(struct kvm_vcpu *vcpu)
4139
{
4140
	if (mmu_is_nested(vcpu))
4141
		init_kvm_nested_mmu(vcpu);
4142
	else if (tdp_enabled)
4143
		init_kvm_tdp_mmu(vcpu);
4144
	else
4145
		init_kvm_softmmu(vcpu);
4146 4147
}

4148
void kvm_mmu_reset_context(struct kvm_vcpu *vcpu)
A
Avi Kivity 已提交
4149
{
4150
	kvm_mmu_unload(vcpu);
4151
	init_kvm_mmu(vcpu);
A
Avi Kivity 已提交
4152
}
4153
EXPORT_SYMBOL_GPL(kvm_mmu_reset_context);
A
Avi Kivity 已提交
4154 4155

int kvm_mmu_load(struct kvm_vcpu *vcpu)
A
Avi Kivity 已提交
4156
{
4157 4158
	int r;

4159
	r = mmu_topup_memory_caches(vcpu);
A
Avi Kivity 已提交
4160 4161
	if (r)
		goto out;
4162
	r = mmu_alloc_roots(vcpu);
4163
	kvm_mmu_sync_roots(vcpu);
4164 4165
	if (r)
		goto out;
4166
	/* set_cr3() should ensure TLB has been flushed */
4167
	vcpu->arch.mmu.set_cr3(vcpu, vcpu->arch.mmu.root_hpa);
4168 4169
out:
	return r;
A
Avi Kivity 已提交
4170
}
A
Avi Kivity 已提交
4171 4172 4173 4174 4175
EXPORT_SYMBOL_GPL(kvm_mmu_load);

void kvm_mmu_unload(struct kvm_vcpu *vcpu)
{
	mmu_free_roots(vcpu);
4176
	WARN_ON(VALID_PAGE(vcpu->arch.mmu.root_hpa));
A
Avi Kivity 已提交
4177
}
4178
EXPORT_SYMBOL_GPL(kvm_mmu_unload);
A
Avi Kivity 已提交
4179

4180
static void mmu_pte_write_new_pte(struct kvm_vcpu *vcpu,
4181 4182
				  struct kvm_mmu_page *sp, u64 *spte,
				  const void *new)
4183
{
4184
	if (sp->role.level != PT_PAGE_TABLE_LEVEL) {
4185 4186
		++vcpu->kvm->stat.mmu_pde_zapped;
		return;
4187
        }
4188

A
Avi Kivity 已提交
4189
	++vcpu->kvm->stat.mmu_pte_updated;
4190
	vcpu->arch.mmu.update_pte(vcpu, sp, spte, new);
4191 4192
}

4193 4194 4195 4196 4197 4198 4199 4200
static bool need_remote_flush(u64 old, u64 new)
{
	if (!is_shadow_present_pte(old))
		return false;
	if (!is_shadow_present_pte(new))
		return true;
	if ((old ^ new) & PT64_BASE_ADDR_MASK)
		return true;
4201 4202
	old ^= shadow_nx_mask;
	new ^= shadow_nx_mask;
4203 4204 4205
	return (old & ~new & PT64_PERM_MASK) != 0;
}

4206 4207
static u64 mmu_pte_write_fetch_gpte(struct kvm_vcpu *vcpu, gpa_t *gpa,
				    const u8 *new, int *bytes)
4208
{
4209 4210
	u64 gentry;
	int r;
4211 4212 4213

	/*
	 * Assume that the pte write on a page table of the same type
4214 4215
	 * as the current vcpu paging mode since we update the sptes only
	 * when they have the same mode.
4216
	 */
4217
	if (is_pae(vcpu) && *bytes == 4) {
4218
		/* Handle a 32-bit guest writing two halves of a 64-bit gpte */
4219 4220
		*gpa &= ~(gpa_t)7;
		*bytes = 8;
4221
		r = kvm_vcpu_read_guest(vcpu, *gpa, &gentry, 8);
4222 4223
		if (r)
			gentry = 0;
4224 4225 4226
		new = (const u8 *)&gentry;
	}

4227
	switch (*bytes) {
4228 4229 4230 4231 4232 4233 4234 4235 4236
	case 4:
		gentry = *(const u32 *)new;
		break;
	case 8:
		gentry = *(const u64 *)new;
		break;
	default:
		gentry = 0;
		break;
4237 4238
	}

4239 4240 4241 4242 4243 4244 4245
	return gentry;
}

/*
 * If we're seeing too many writes to a page, it may no longer be a page table,
 * or we may be forking, in which case it is better to unmap the page.
 */
4246
static bool detect_write_flooding(struct kvm_mmu_page *sp)
4247
{
4248 4249 4250 4251
	/*
	 * Skip write-flooding detected for the sp whose level is 1, because
	 * it can become unsync, then the guest page is not write-protected.
	 */
4252
	if (sp->role.level == PT_PAGE_TABLE_LEVEL)
4253
		return false;
4254

4255 4256
	atomic_inc(&sp->write_flooding_count);
	return atomic_read(&sp->write_flooding_count) >= 3;
4257 4258 4259 4260 4261 4262 4263 4264 4265 4266 4267 4268 4269 4270 4271 4272
}

/*
 * Misaligned accesses are too much trouble to fix up; also, they usually
 * indicate a page is not used as a page table.
 */
static bool detect_write_misaligned(struct kvm_mmu_page *sp, gpa_t gpa,
				    int bytes)
{
	unsigned offset, pte_size, misaligned;

	pgprintk("misaligned: gpa %llx bytes %d role %x\n",
		 gpa, bytes, sp->role.word);

	offset = offset_in_page(gpa);
	pte_size = sp->role.cr4_pae ? 8 : 4;
4273 4274 4275 4276 4277 4278 4279 4280

	/*
	 * Sometimes, the OS only writes the last one bytes to update status
	 * bits, for example, in linux, andb instruction is used in clear_bit().
	 */
	if (!(offset & (pte_size - 1)) && bytes == 1)
		return false;

4281 4282 4283 4284 4285 4286 4287 4288 4289 4290 4291 4292 4293 4294 4295 4296 4297 4298 4299 4300 4301 4302 4303 4304 4305 4306 4307 4308 4309 4310 4311 4312 4313 4314 4315 4316 4317
	misaligned = (offset ^ (offset + bytes - 1)) & ~(pte_size - 1);
	misaligned |= bytes < 4;

	return misaligned;
}

static u64 *get_written_sptes(struct kvm_mmu_page *sp, gpa_t gpa, int *nspte)
{
	unsigned page_offset, quadrant;
	u64 *spte;
	int level;

	page_offset = offset_in_page(gpa);
	level = sp->role.level;
	*nspte = 1;
	if (!sp->role.cr4_pae) {
		page_offset <<= 1;	/* 32->64 */
		/*
		 * A 32-bit pde maps 4MB while the shadow pdes map
		 * only 2MB.  So we need to double the offset again
		 * and zap two pdes instead of one.
		 */
		if (level == PT32_ROOT_LEVEL) {
			page_offset &= ~7; /* kill rounding error */
			page_offset <<= 1;
			*nspte = 2;
		}
		quadrant = page_offset >> PAGE_SHIFT;
		page_offset &= ~PAGE_MASK;
		if (quadrant != sp->role.quadrant)
			return NULL;
	}

	spte = &sp->spt[page_offset / sizeof(*spte)];
	return spte;
}

4318 4319
static void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
			      const u8 *new, int bytes)
4320 4321 4322 4323 4324 4325
{
	gfn_t gfn = gpa >> PAGE_SHIFT;
	struct kvm_mmu_page *sp;
	LIST_HEAD(invalid_list);
	u64 entry, gentry, *spte;
	int npte;
4326
	bool remote_flush, local_flush;
4327 4328 4329 4330 4331 4332 4333
	union kvm_mmu_page_role mask = { };

	mask.cr0_wp = 1;
	mask.cr4_pae = 1;
	mask.nxe = 1;
	mask.smep_andnot_wp = 1;
	mask.smap_andnot_wp = 1;
4334
	mask.smm = 1;
4335 4336 4337 4338 4339 4340 4341 4342

	/*
	 * If we don't have indirect shadow pages, it means no page is
	 * write-protected, so we can exit simply.
	 */
	if (!ACCESS_ONCE(vcpu->kvm->arch.indirect_shadow_pages))
		return;

4343
	remote_flush = local_flush = false;
4344 4345 4346 4347 4348 4349 4350 4351 4352 4353 4354 4355 4356 4357

	pgprintk("%s: gpa %llx bytes %d\n", __func__, gpa, bytes);

	gentry = mmu_pte_write_fetch_gpte(vcpu, &gpa, new, &bytes);

	/*
	 * No need to care whether allocation memory is successful
	 * or not since pte prefetch is skiped if it does not have
	 * enough objects in the cache.
	 */
	mmu_topup_memory_caches(vcpu);

	spin_lock(&vcpu->kvm->mmu_lock);
	++vcpu->kvm->stat.mmu_pte_write;
4358
	kvm_mmu_audit(vcpu, AUDIT_PRE_PTE_WRITE);
4359

4360
	for_each_gfn_indirect_valid_sp(vcpu->kvm, sp, gfn) {
4361
		if (detect_write_misaligned(sp, gpa, bytes) ||
4362
		      detect_write_flooding(sp)) {
4363
			kvm_mmu_prepare_zap_page(vcpu->kvm, sp, &invalid_list);
A
Avi Kivity 已提交
4364
			++vcpu->kvm->stat.mmu_flooded;
4365 4366
			continue;
		}
4367 4368 4369 4370 4371

		spte = get_written_sptes(sp, gpa, &npte);
		if (!spte)
			continue;

4372
		local_flush = true;
4373
		while (npte--) {
4374
			entry = *spte;
4375
			mmu_page_zap_pte(vcpu->kvm, sp, spte);
4376 4377
			if (gentry &&
			      !((sp->role.word ^ vcpu->arch.mmu.base_role.word)
4378
			      & mask.word) && rmap_can_add(vcpu))
4379
				mmu_pte_write_new_pte(vcpu, sp, spte, &gentry);
G
Gleb Natapov 已提交
4380
			if (need_remote_flush(entry, *spte))
4381
				remote_flush = true;
4382
			++spte;
4383 4384
		}
	}
4385
	kvm_mmu_flush_or_zap(vcpu, &invalid_list, remote_flush, local_flush);
4386
	kvm_mmu_audit(vcpu, AUDIT_POST_PTE_WRITE);
4387
	spin_unlock(&vcpu->kvm->mmu_lock);
4388 4389
}

4390 4391
int kvm_mmu_unprotect_page_virt(struct kvm_vcpu *vcpu, gva_t gva)
{
4392 4393
	gpa_t gpa;
	int r;
4394

4395
	if (vcpu->arch.mmu.direct_map)
4396 4397
		return 0;

4398
	gpa = kvm_mmu_gva_to_gpa_read(vcpu, gva, NULL);
4399 4400

	r = kvm_mmu_unprotect_page(vcpu->kvm, gpa >> PAGE_SHIFT);
4401

4402
	return r;
4403
}
4404
EXPORT_SYMBOL_GPL(kvm_mmu_unprotect_page_virt);
4405

4406
static void make_mmu_pages_available(struct kvm_vcpu *vcpu)
A
Avi Kivity 已提交
4407
{
4408
	LIST_HEAD(invalid_list);
4409

4410 4411 4412
	if (likely(kvm_mmu_available_pages(vcpu->kvm) >= KVM_MIN_FREE_MMU_PAGES))
		return;

4413 4414 4415
	while (kvm_mmu_available_pages(vcpu->kvm) < KVM_REFILL_PAGES) {
		if (!prepare_zap_oldest_mmu_page(vcpu->kvm, &invalid_list))
			break;
A
Avi Kivity 已提交
4416

A
Avi Kivity 已提交
4417
		++vcpu->kvm->stat.mmu_recycled;
A
Avi Kivity 已提交
4418
	}
4419
	kvm_mmu_commit_zap_page(vcpu->kvm, &invalid_list);
A
Avi Kivity 已提交
4420 4421
}

4422 4423
int kvm_mmu_page_fault(struct kvm_vcpu *vcpu, gva_t cr2, u32 error_code,
		       void *insn, int insn_len)
4424
{
4425
	int r, emulation_type = EMULTYPE_RETRY;
4426
	enum emulation_result er;
4427
	bool direct = vcpu->arch.mmu.direct_map || mmu_is_nested(vcpu);
4428

4429 4430 4431 4432 4433 4434 4435 4436 4437 4438 4439
	if (unlikely(error_code & PFERR_RSVD_MASK)) {
		r = handle_mmio_page_fault(vcpu, cr2, direct);
		if (r == RET_MMIO_PF_EMULATE) {
			emulation_type = 0;
			goto emulate;
		}
		if (r == RET_MMIO_PF_RETRY)
			return 1;
		if (r < 0)
			return r;
	}
4440

G
Gleb Natapov 已提交
4441
	r = vcpu->arch.mmu.page_fault(vcpu, cr2, error_code, false);
4442
	if (r < 0)
4443 4444 4445
		return r;
	if (!r)
		return 1;
4446

4447
	if (mmio_info_in_cache(vcpu, cr2, direct))
4448
		emulation_type = 0;
4449
emulate:
4450
	er = x86_emulate_instruction(vcpu, cr2, emulation_type, insn, insn_len);
4451 4452 4453 4454

	switch (er) {
	case EMULATE_DONE:
		return 1;
P
Paolo Bonzini 已提交
4455
	case EMULATE_USER_EXIT:
4456
		++vcpu->stat.mmio_exits;
4457
		/* fall through */
4458
	case EMULATE_FAIL:
4459
		return 0;
4460 4461 4462 4463 4464 4465
	default:
		BUG();
	}
}
EXPORT_SYMBOL_GPL(kvm_mmu_page_fault);

M
Marcelo Tosatti 已提交
4466 4467 4468
void kvm_mmu_invlpg(struct kvm_vcpu *vcpu, gva_t gva)
{
	vcpu->arch.mmu.invlpg(vcpu, gva);
4469
	kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu);
M
Marcelo Tosatti 已提交
4470 4471 4472 4473
	++vcpu->stat.invlpg;
}
EXPORT_SYMBOL_GPL(kvm_mmu_invlpg);

4474 4475 4476 4477 4478 4479
void kvm_enable_tdp(void)
{
	tdp_enabled = true;
}
EXPORT_SYMBOL_GPL(kvm_enable_tdp);

4480 4481 4482 4483 4484 4485
void kvm_disable_tdp(void)
{
	tdp_enabled = false;
}
EXPORT_SYMBOL_GPL(kvm_disable_tdp);

A
Avi Kivity 已提交
4486 4487
static void free_mmu_pages(struct kvm_vcpu *vcpu)
{
4488
	free_page((unsigned long)vcpu->arch.mmu.pae_root);
4489 4490
	if (vcpu->arch.mmu.lm_root != NULL)
		free_page((unsigned long)vcpu->arch.mmu.lm_root);
A
Avi Kivity 已提交
4491 4492 4493 4494
}

static int alloc_mmu_pages(struct kvm_vcpu *vcpu)
{
4495
	struct page *page;
A
Avi Kivity 已提交
4496 4497
	int i;

4498 4499 4500 4501 4502 4503 4504
	/*
	 * When emulating 32-bit mode, cr3 is only 32 bits even on x86_64.
	 * Therefore we need to allocate shadow page tables in the first
	 * 4GB of memory, which happens to fit the DMA32 zone.
	 */
	page = alloc_page(GFP_KERNEL | __GFP_DMA32);
	if (!page)
4505 4506
		return -ENOMEM;

4507
	vcpu->arch.mmu.pae_root = page_address(page);
4508
	for (i = 0; i < 4; ++i)
4509
		vcpu->arch.mmu.pae_root[i] = INVALID_PAGE;
4510

A
Avi Kivity 已提交
4511 4512 4513
	return 0;
}

4514
int kvm_mmu_create(struct kvm_vcpu *vcpu)
A
Avi Kivity 已提交
4515
{
4516 4517 4518 4519
	vcpu->arch.walk_mmu = &vcpu->arch.mmu;
	vcpu->arch.mmu.root_hpa = INVALID_PAGE;
	vcpu->arch.mmu.translate_gpa = translate_gpa;
	vcpu->arch.nested_mmu.translate_gpa = translate_nested_gpa;
A
Avi Kivity 已提交
4520

4521 4522
	return alloc_mmu_pages(vcpu);
}
A
Avi Kivity 已提交
4523

4524
void kvm_mmu_setup(struct kvm_vcpu *vcpu)
4525
{
4526
	MMU_WARN_ON(VALID_PAGE(vcpu->arch.mmu.root_hpa));
4527

4528
	init_kvm_mmu(vcpu);
A
Avi Kivity 已提交
4529 4530
}

4531 4532 4533 4534 4535 4536 4537 4538 4539 4540 4541 4542 4543 4544 4545
void kvm_mmu_init_vm(struct kvm *kvm)
{
	struct kvm_page_track_notifier_node *node = &kvm->arch.mmu_sp_tracker;

	node->track_write = kvm_mmu_pte_write;
	kvm_page_track_register_notifier(kvm, node);
}

void kvm_mmu_uninit_vm(struct kvm *kvm)
{
	struct kvm_page_track_notifier_node *node = &kvm->arch.mmu_sp_tracker;

	kvm_page_track_unregister_notifier(kvm, node);
}

4546
/* The return value indicates if tlb flush on all vcpus is needed. */
4547
typedef bool (*slot_level_handler) (struct kvm *kvm, struct kvm_rmap_head *rmap_head);
4548 4549 4550 4551 4552 4553 4554 4555 4556 4557 4558 4559 4560 4561 4562 4563 4564 4565 4566 4567 4568 4569 4570 4571 4572 4573 4574 4575 4576 4577 4578 4579 4580 4581 4582 4583 4584 4585 4586 4587 4588 4589 4590 4591 4592 4593 4594 4595 4596 4597 4598 4599 4600 4601 4602 4603 4604 4605 4606 4607 4608 4609 4610 4611 4612 4613 4614

/* The caller should hold mmu-lock before calling this function. */
static bool
slot_handle_level_range(struct kvm *kvm, struct kvm_memory_slot *memslot,
			slot_level_handler fn, int start_level, int end_level,
			gfn_t start_gfn, gfn_t end_gfn, bool lock_flush_tlb)
{
	struct slot_rmap_walk_iterator iterator;
	bool flush = false;

	for_each_slot_rmap_range(memslot, start_level, end_level, start_gfn,
			end_gfn, &iterator) {
		if (iterator.rmap)
			flush |= fn(kvm, iterator.rmap);

		if (need_resched() || spin_needbreak(&kvm->mmu_lock)) {
			if (flush && lock_flush_tlb) {
				kvm_flush_remote_tlbs(kvm);
				flush = false;
			}
			cond_resched_lock(&kvm->mmu_lock);
		}
	}

	if (flush && lock_flush_tlb) {
		kvm_flush_remote_tlbs(kvm);
		flush = false;
	}

	return flush;
}

static bool
slot_handle_level(struct kvm *kvm, struct kvm_memory_slot *memslot,
		  slot_level_handler fn, int start_level, int end_level,
		  bool lock_flush_tlb)
{
	return slot_handle_level_range(kvm, memslot, fn, start_level,
			end_level, memslot->base_gfn,
			memslot->base_gfn + memslot->npages - 1,
			lock_flush_tlb);
}

static bool
slot_handle_all_level(struct kvm *kvm, struct kvm_memory_slot *memslot,
		      slot_level_handler fn, bool lock_flush_tlb)
{
	return slot_handle_level(kvm, memslot, fn, PT_PAGE_TABLE_LEVEL,
				 PT_MAX_HUGEPAGE_LEVEL, lock_flush_tlb);
}

static bool
slot_handle_large_level(struct kvm *kvm, struct kvm_memory_slot *memslot,
			slot_level_handler fn, bool lock_flush_tlb)
{
	return slot_handle_level(kvm, memslot, fn, PT_PAGE_TABLE_LEVEL + 1,
				 PT_MAX_HUGEPAGE_LEVEL, lock_flush_tlb);
}

static bool
slot_handle_leaf(struct kvm *kvm, struct kvm_memory_slot *memslot,
		 slot_level_handler fn, bool lock_flush_tlb)
{
	return slot_handle_level(kvm, memslot, fn, PT_PAGE_TABLE_LEVEL,
				 PT_PAGE_TABLE_LEVEL, lock_flush_tlb);
}

X
Xiao Guangrong 已提交
4615 4616 4617 4618
void kvm_zap_gfn_range(struct kvm *kvm, gfn_t gfn_start, gfn_t gfn_end)
{
	struct kvm_memslots *slots;
	struct kvm_memory_slot *memslot;
4619
	int i;
X
Xiao Guangrong 已提交
4620 4621

	spin_lock(&kvm->mmu_lock);
4622 4623 4624 4625 4626 4627 4628 4629 4630
	for (i = 0; i < KVM_ADDRESS_SPACE_NUM; i++) {
		slots = __kvm_memslots(kvm, i);
		kvm_for_each_memslot(memslot, slots) {
			gfn_t start, end;

			start = max(gfn_start, memslot->base_gfn);
			end = min(gfn_end, memslot->base_gfn + memslot->npages);
			if (start >= end)
				continue;
X
Xiao Guangrong 已提交
4631

4632 4633 4634 4635
			slot_handle_level_range(kvm, memslot, kvm_zap_rmapp,
						PT_PAGE_TABLE_LEVEL, PT_MAX_HUGEPAGE_LEVEL,
						start, end - 1, true);
		}
X
Xiao Guangrong 已提交
4636 4637 4638 4639 4640
	}

	spin_unlock(&kvm->mmu_lock);
}

4641 4642
static bool slot_rmap_write_protect(struct kvm *kvm,
				    struct kvm_rmap_head *rmap_head)
4643
{
4644
	return __rmap_write_protect(kvm, rmap_head, false);
4645 4646
}

4647 4648
void kvm_mmu_slot_remove_write_access(struct kvm *kvm,
				      struct kvm_memory_slot *memslot)
A
Avi Kivity 已提交
4649
{
4650
	bool flush;
A
Avi Kivity 已提交
4651

4652
	spin_lock(&kvm->mmu_lock);
4653 4654
	flush = slot_handle_all_level(kvm, memslot, slot_rmap_write_protect,
				      false);
4655
	spin_unlock(&kvm->mmu_lock);
4656 4657 4658 4659 4660 4661 4662 4663 4664 4665 4666 4667 4668 4669 4670 4671 4672 4673 4674

	/*
	 * kvm_mmu_slot_remove_write_access() and kvm_vm_ioctl_get_dirty_log()
	 * which do tlb flush out of mmu-lock should be serialized by
	 * kvm->slots_lock otherwise tlb flush would be missed.
	 */
	lockdep_assert_held(&kvm->slots_lock);

	/*
	 * We can flush all the TLBs out of the mmu lock without TLB
	 * corruption since we just change the spte from writable to
	 * readonly so that we only need to care the case of changing
	 * spte from present to present (changing the spte from present
	 * to nonpresent will flush all the TLBs immediately), in other
	 * words, the only case we care is mmu_spte_update() where we
	 * haved checked SPTE_HOST_WRITEABLE | SPTE_MMU_WRITEABLE
	 * instead of PT_WRITABLE_MASK, that means it does not depend
	 * on PT_WRITABLE_MASK anymore.
	 */
4675 4676
	if (flush)
		kvm_flush_remote_tlbs(kvm);
A
Avi Kivity 已提交
4677
}
4678

4679
static bool kvm_mmu_zap_collapsible_spte(struct kvm *kvm,
4680
					 struct kvm_rmap_head *rmap_head)
4681 4682 4683 4684
{
	u64 *sptep;
	struct rmap_iterator iter;
	int need_tlb_flush = 0;
D
Dan Williams 已提交
4685
	kvm_pfn_t pfn;
4686 4687
	struct kvm_mmu_page *sp;

4688
restart:
4689
	for_each_rmap_spte(rmap_head, &iter, sptep) {
4690 4691 4692 4693
		sp = page_header(__pa(sptep));
		pfn = spte_to_pfn(*sptep);

		/*
4694 4695 4696 4697 4698
		 * We cannot do huge page mapping for indirect shadow pages,
		 * which are found on the last rmap (level = 1) when not using
		 * tdp; such shadow pages are synced with the page table in
		 * the guest, and the guest page table is using 4K page size
		 * mapping if the indirect sp has level = 1.
4699 4700 4701 4702 4703 4704
		 */
		if (sp->role.direct &&
			!kvm_is_reserved_pfn(pfn) &&
			PageTransCompound(pfn_to_page(pfn))) {
			drop_spte(kvm, sptep);
			need_tlb_flush = 1;
4705 4706
			goto restart;
		}
4707 4708 4709 4710 4711 4712
	}

	return need_tlb_flush;
}

void kvm_mmu_zap_collapsible_sptes(struct kvm *kvm,
4713
				   const struct kvm_memory_slot *memslot)
4714
{
4715
	/* FIXME: const-ify all uses of struct kvm_memory_slot.  */
4716
	spin_lock(&kvm->mmu_lock);
4717 4718
	slot_handle_leaf(kvm, (struct kvm_memory_slot *)memslot,
			 kvm_mmu_zap_collapsible_spte, true);
4719 4720 4721
	spin_unlock(&kvm->mmu_lock);
}

4722 4723 4724
void kvm_mmu_slot_leaf_clear_dirty(struct kvm *kvm,
				   struct kvm_memory_slot *memslot)
{
4725
	bool flush;
4726 4727

	spin_lock(&kvm->mmu_lock);
4728
	flush = slot_handle_leaf(kvm, memslot, __rmap_clear_dirty, false);
4729 4730 4731 4732 4733 4734 4735 4736 4737 4738 4739 4740 4741 4742 4743 4744 4745 4746
	spin_unlock(&kvm->mmu_lock);

	lockdep_assert_held(&kvm->slots_lock);

	/*
	 * It's also safe to flush TLBs out of mmu lock here as currently this
	 * function is only used for dirty logging, in which case flushing TLB
	 * out of mmu lock also guarantees no dirty pages will be lost in
	 * dirty_bitmap.
	 */
	if (flush)
		kvm_flush_remote_tlbs(kvm);
}
EXPORT_SYMBOL_GPL(kvm_mmu_slot_leaf_clear_dirty);

void kvm_mmu_slot_largepage_remove_write_access(struct kvm *kvm,
					struct kvm_memory_slot *memslot)
{
4747
	bool flush;
4748 4749

	spin_lock(&kvm->mmu_lock);
4750 4751
	flush = slot_handle_large_level(kvm, memslot, slot_rmap_write_protect,
					false);
4752 4753 4754 4755 4756 4757 4758 4759 4760 4761 4762 4763 4764
	spin_unlock(&kvm->mmu_lock);

	/* see kvm_mmu_slot_remove_write_access */
	lockdep_assert_held(&kvm->slots_lock);

	if (flush)
		kvm_flush_remote_tlbs(kvm);
}
EXPORT_SYMBOL_GPL(kvm_mmu_slot_largepage_remove_write_access);

void kvm_mmu_slot_set_dirty(struct kvm *kvm,
			    struct kvm_memory_slot *memslot)
{
4765
	bool flush;
4766 4767

	spin_lock(&kvm->mmu_lock);
4768
	flush = slot_handle_all_level(kvm, memslot, __rmap_set_dirty, false);
4769 4770 4771 4772 4773 4774 4775 4776 4777 4778
	spin_unlock(&kvm->mmu_lock);

	lockdep_assert_held(&kvm->slots_lock);

	/* see kvm_mmu_slot_leaf_clear_dirty */
	if (flush)
		kvm_flush_remote_tlbs(kvm);
}
EXPORT_SYMBOL_GPL(kvm_mmu_slot_set_dirty);

X
Xiao Guangrong 已提交
4779
#define BATCH_ZAP_PAGES	10
4780 4781 4782
static void kvm_zap_obsolete_pages(struct kvm *kvm)
{
	struct kvm_mmu_page *sp, *node;
X
Xiao Guangrong 已提交
4783
	int batch = 0;
4784 4785 4786 4787

restart:
	list_for_each_entry_safe_reverse(sp, node,
	      &kvm->arch.active_mmu_pages, link) {
X
Xiao Guangrong 已提交
4788 4789
		int ret;

4790 4791 4792 4793 4794 4795 4796 4797 4798 4799 4800 4801 4802 4803 4804
		/*
		 * No obsolete page exists before new created page since
		 * active_mmu_pages is the FIFO list.
		 */
		if (!is_obsolete_sp(kvm, sp))
			break;

		/*
		 * Since we are reversely walking the list and the invalid
		 * list will be moved to the head, skip the invalid page
		 * can help us to avoid the infinity list walking.
		 */
		if (sp->role.invalid)
			continue;

4805 4806 4807 4808
		/*
		 * Need not flush tlb since we only zap the sp with invalid
		 * generation number.
		 */
X
Xiao Guangrong 已提交
4809
		if (batch >= BATCH_ZAP_PAGES &&
4810
		      cond_resched_lock(&kvm->mmu_lock)) {
X
Xiao Guangrong 已提交
4811
			batch = 0;
4812 4813 4814
			goto restart;
		}

4815 4816
		ret = kvm_mmu_prepare_zap_page(kvm, sp,
				&kvm->arch.zapped_obsolete_pages);
X
Xiao Guangrong 已提交
4817 4818 4819
		batch += ret;

		if (ret)
4820 4821 4822
			goto restart;
	}

4823 4824 4825 4826
	/*
	 * Should flush tlb before free page tables since lockless-walking
	 * may use the pages.
	 */
4827
	kvm_mmu_commit_zap_page(kvm, &kvm->arch.zapped_obsolete_pages);
4828 4829 4830 4831 4832 4833 4834 4835 4836 4837 4838 4839 4840 4841
}

/*
 * Fast invalidate all shadow pages and use lock-break technique
 * to zap obsolete pages.
 *
 * It's required when memslot is being deleted or VM is being
 * destroyed, in these cases, we should ensure that KVM MMU does
 * not use any resource of the being-deleted slot or all slots
 * after calling the function.
 */
void kvm_mmu_invalidate_zap_all_pages(struct kvm *kvm)
{
	spin_lock(&kvm->mmu_lock);
4842
	trace_kvm_mmu_invalidate_zap_all_pages(kvm);
4843 4844
	kvm->arch.mmu_valid_gen++;

4845 4846 4847 4848 4849 4850 4851 4852 4853 4854 4855
	/*
	 * Notify all vcpus to reload its shadow page table
	 * and flush TLB. Then all vcpus will switch to new
	 * shadow page table with the new mmu_valid_gen.
	 *
	 * Note: we should do this under the protection of
	 * mmu-lock, otherwise, vcpu would purge shadow page
	 * but miss tlb flush.
	 */
	kvm_reload_remote_mmus(kvm);

4856 4857 4858 4859
	kvm_zap_obsolete_pages(kvm);
	spin_unlock(&kvm->mmu_lock);
}

4860 4861 4862 4863 4864
static bool kvm_has_zapped_obsolete_pages(struct kvm *kvm)
{
	return unlikely(!list_empty_careful(&kvm->arch.zapped_obsolete_pages));
}

4865
void kvm_mmu_invalidate_mmio_sptes(struct kvm *kvm, struct kvm_memslots *slots)
4866 4867 4868 4869 4870
{
	/*
	 * The very rare case: if the generation-number is round,
	 * zap all shadow pages.
	 */
4871
	if (unlikely((slots->generation & MMIO_GEN_MASK) == 0)) {
4872
		printk_ratelimited(KERN_DEBUG "kvm: zapping shadow pages for mmio generation wraparound\n");
4873
		kvm_mmu_invalidate_zap_all_pages(kvm);
4874
	}
4875 4876
}

4877 4878
static unsigned long
mmu_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
4879 4880
{
	struct kvm *kvm;
4881
	int nr_to_scan = sc->nr_to_scan;
4882
	unsigned long freed = 0;
4883

4884
	spin_lock(&kvm_lock);
4885 4886

	list_for_each_entry(kvm, &vm_list, vm_list) {
4887
		int idx;
4888
		LIST_HEAD(invalid_list);
4889

4890 4891 4892 4893 4894 4895 4896 4897
		/*
		 * Never scan more than sc->nr_to_scan VM instances.
		 * Will not hit this condition practically since we do not try
		 * to shrink more than one VM and it is very unlikely to see
		 * !n_used_mmu_pages so many times.
		 */
		if (!nr_to_scan--)
			break;
4898 4899 4900 4901 4902 4903
		/*
		 * n_used_mmu_pages is accessed without holding kvm->mmu_lock
		 * here. We may skip a VM instance errorneosly, but we do not
		 * want to shrink a VM that only started to populate its MMU
		 * anyway.
		 */
4904 4905
		if (!kvm->arch.n_used_mmu_pages &&
		      !kvm_has_zapped_obsolete_pages(kvm))
4906 4907
			continue;

4908
		idx = srcu_read_lock(&kvm->srcu);
4909 4910
		spin_lock(&kvm->mmu_lock);

4911 4912 4913 4914 4915 4916
		if (kvm_has_zapped_obsolete_pages(kvm)) {
			kvm_mmu_commit_zap_page(kvm,
			      &kvm->arch.zapped_obsolete_pages);
			goto unlock;
		}

4917 4918
		if (prepare_zap_oldest_mmu_page(kvm, &invalid_list))
			freed++;
4919
		kvm_mmu_commit_zap_page(kvm, &invalid_list);
4920

4921
unlock:
4922
		spin_unlock(&kvm->mmu_lock);
4923
		srcu_read_unlock(&kvm->srcu, idx);
4924

4925 4926 4927 4928 4929
		/*
		 * unfair on small ones
		 * per-vm shrinkers cry out
		 * sadness comes quickly
		 */
4930 4931
		list_move_tail(&kvm->vm_list, &vm_list);
		break;
4932 4933
	}

4934
	spin_unlock(&kvm_lock);
4935 4936 4937 4938 4939 4940
	return freed;
}

static unsigned long
mmu_shrink_count(struct shrinker *shrink, struct shrink_control *sc)
{
4941
	return percpu_counter_read_positive(&kvm_total_used_mmu_pages);
4942 4943 4944
}

static struct shrinker mmu_shrinker = {
4945 4946
	.count_objects = mmu_shrink_count,
	.scan_objects = mmu_shrink_scan,
4947 4948 4949
	.seeks = DEFAULT_SEEKS * 10,
};

I
Ingo Molnar 已提交
4950
static void mmu_destroy_caches(void)
4951
{
4952 4953
	if (pte_list_desc_cache)
		kmem_cache_destroy(pte_list_desc_cache);
4954 4955
	if (mmu_page_header_cache)
		kmem_cache_destroy(mmu_page_header_cache);
4956 4957 4958 4959
}

int kvm_mmu_module_init(void)
{
4960 4961
	pte_list_desc_cache = kmem_cache_create("pte_list_desc",
					    sizeof(struct pte_list_desc),
4962
					    0, 0, NULL);
4963
	if (!pte_list_desc_cache)
4964 4965
		goto nomem;

4966 4967
	mmu_page_header_cache = kmem_cache_create("kvm_mmu_page_header",
						  sizeof(struct kvm_mmu_page),
4968
						  0, 0, NULL);
4969 4970 4971
	if (!mmu_page_header_cache)
		goto nomem;

4972
	if (percpu_counter_init(&kvm_total_used_mmu_pages, 0, GFP_KERNEL))
4973 4974
		goto nomem;

4975 4976
	register_shrinker(&mmu_shrinker);

4977 4978 4979
	return 0;

nomem:
4980
	mmu_destroy_caches();
4981 4982 4983
	return -ENOMEM;
}

4984 4985 4986 4987 4988 4989 4990
/*
 * Caculate mmu pages needed for kvm.
 */
unsigned int kvm_mmu_calculate_mmu_pages(struct kvm *kvm)
{
	unsigned int nr_mmu_pages;
	unsigned int  nr_pages = 0;
4991
	struct kvm_memslots *slots;
4992
	struct kvm_memory_slot *memslot;
4993
	int i;
4994

4995 4996
	for (i = 0; i < KVM_ADDRESS_SPACE_NUM; i++) {
		slots = __kvm_memslots(kvm, i);
4997

4998 4999 5000
		kvm_for_each_memslot(memslot, slots)
			nr_pages += memslot->npages;
	}
5001 5002 5003

	nr_mmu_pages = nr_pages * KVM_PERMILLE_MMU_PAGES / 1000;
	nr_mmu_pages = max(nr_mmu_pages,
5004
			   (unsigned int) KVM_MIN_ALLOC_MMU_PAGES);
5005 5006 5007 5008

	return nr_mmu_pages;
}

5009 5010
void kvm_mmu_destroy(struct kvm_vcpu *vcpu)
{
5011
	kvm_mmu_unload(vcpu);
5012 5013
	free_mmu_pages(vcpu);
	mmu_free_memory_caches(vcpu);
5014 5015 5016 5017 5018 5019 5020
}

void kvm_mmu_module_exit(void)
{
	mmu_destroy_caches();
	percpu_counter_destroy(&kvm_total_used_mmu_pages);
	unregister_shrinker(&mmu_shrinker);
5021 5022
	mmu_audit_disable();
}