mmu.c 59.3 KB
Newer Older
A
Avi Kivity 已提交
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
/*
 * Kernel-based Virtual Machine driver for Linux
 *
 * This module enables machines with Intel VT-x extensions to run virtual
 * machines without emulation or binary translation.
 *
 * MMU support
 *
 * Copyright (C) 2006 Qumranet, Inc.
 *
 * Authors:
 *   Yaniv Kamay  <yaniv@qumranet.com>
 *   Avi Kivity   <avi@qumranet.com>
 *
 * This work is licensed under the terms of the GNU GPL, version 2.  See
 * the COPYING file in the top-level directory.
 *
 */
A
Avi Kivity 已提交
19 20

#include "vmx.h"
21
#include "mmu.h"
A
Avi Kivity 已提交
22

23
#include <linux/kvm_host.h>
A
Avi Kivity 已提交
24 25 26 27 28
#include <linux/types.h>
#include <linux/string.h>
#include <linux/mm.h>
#include <linux/highmem.h>
#include <linux/module.h>
29
#include <linux/swap.h>
M
Marcelo Tosatti 已提交
30
#include <linux/hugetlb.h>
31
#include <linux/compiler.h>
A
Avi Kivity 已提交
32

A
Avi Kivity 已提交
33 34
#include <asm/page.h>
#include <asm/cmpxchg.h>
35
#include <asm/io.h>
A
Avi Kivity 已提交
36

37 38 39 40 41 42 43
/*
 * When setting this variable to true it enables Two-Dimensional-Paging
 * where the hardware walks 2 page tables:
 * 1. the guest-virtual to guest-physical
 * 2. while doing 1. it walks guest-physical to host-physical
 * If the hardware supports that we don't need to do shadow paging.
 */
44
bool tdp_enabled = false;
45

46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68
#undef MMU_DEBUG

#undef AUDIT

#ifdef AUDIT
static void kvm_mmu_audit(struct kvm_vcpu *vcpu, const char *msg);
#else
static void kvm_mmu_audit(struct kvm_vcpu *vcpu, const char *msg) {}
#endif

#ifdef MMU_DEBUG

#define pgprintk(x...) do { if (dbg) printk(x); } while (0)
#define rmap_printk(x...) do { if (dbg) printk(x); } while (0)

#else

#define pgprintk(x...) do { } while (0)
#define rmap_printk(x...) do { } while (0)

#endif

#if defined(MMU_DEBUG) || defined(AUDIT)
69 70
static int dbg = 0;
module_param(dbg, bool, 0644);
71
#endif
A
Avi Kivity 已提交
72

73 74 75
#ifndef MMU_DEBUG
#define ASSERT(x) do { } while (0)
#else
A
Avi Kivity 已提交
76 77 78 79 80
#define ASSERT(x)							\
	if (!(x)) {							\
		printk(KERN_WARNING "assertion failed %s:%d: %s\n",	\
		       __FILE__, __LINE__, #x);				\
	}
81
#endif
A
Avi Kivity 已提交
82 83 84 85 86 87 88 89 90

#define PT_FIRST_AVAIL_BITS_SHIFT 9
#define PT64_SECOND_AVAIL_BITS_SHIFT 52

#define VALID_PAGE(x) ((x) != INVALID_PAGE)

#define PT64_LEVEL_BITS 9

#define PT64_LEVEL_SHIFT(level) \
M
Mike Day 已提交
91
		(PAGE_SHIFT + (level - 1) * PT64_LEVEL_BITS)
A
Avi Kivity 已提交
92 93 94 95 96 97 98 99 100 101 102

#define PT64_LEVEL_MASK(level) \
		(((1ULL << PT64_LEVEL_BITS) - 1) << PT64_LEVEL_SHIFT(level))

#define PT64_INDEX(address, level)\
	(((address) >> PT64_LEVEL_SHIFT(level)) & ((1 << PT64_LEVEL_BITS) - 1))


#define PT32_LEVEL_BITS 10

#define PT32_LEVEL_SHIFT(level) \
M
Mike Day 已提交
103
		(PAGE_SHIFT + (level - 1) * PT32_LEVEL_BITS)
A
Avi Kivity 已提交
104 105 106 107 108 109 110 111

#define PT32_LEVEL_MASK(level) \
		(((1ULL << PT32_LEVEL_BITS) - 1) << PT32_LEVEL_SHIFT(level))

#define PT32_INDEX(address, level)\
	(((address) >> PT32_LEVEL_SHIFT(level)) & ((1 << PT32_LEVEL_BITS) - 1))


112
#define PT64_BASE_ADDR_MASK (((1ULL << 52) - 1) & ~(u64)(PAGE_SIZE-1))
A
Avi Kivity 已提交
113 114 115 116 117 118 119
#define PT64_DIR_BASE_ADDR_MASK \
	(PT64_BASE_ADDR_MASK & ~((1ULL << (PAGE_SHIFT + PT64_LEVEL_BITS)) - 1))

#define PT32_BASE_ADDR_MASK PAGE_MASK
#define PT32_DIR_BASE_ADDR_MASK \
	(PAGE_MASK & ~((1ULL << (PAGE_SHIFT + PT32_LEVEL_BITS)) - 1))

120 121
#define PT64_PERM_MASK (PT_PRESENT_MASK | PT_WRITABLE_MASK | PT_USER_MASK \
			| PT64_NX_MASK)
A
Avi Kivity 已提交
122 123 124 125

#define PFERR_PRESENT_MASK (1U << 0)
#define PFERR_WRITE_MASK (1U << 1)
#define PFERR_USER_MASK (1U << 2)
126
#define PFERR_FETCH_MASK (1U << 4)
A
Avi Kivity 已提交
127 128 129 130

#define PT_DIRECTORY_LEVEL 2
#define PT_PAGE_TABLE_LEVEL 1

131 132
#define RMAP_EXT 4

133 134 135 136 137
#define ACC_EXEC_MASK    1
#define ACC_WRITE_MASK   PT_WRITABLE_MASK
#define ACC_USER_MASK    PT_USER_MASK
#define ACC_ALL          (ACC_EXEC_MASK | ACC_WRITE_MASK | ACC_USER_MASK)

138 139
#define SHADOW_PT_INDEX(addr, level) PT64_INDEX(addr, level)

140 141 142 143 144
struct kvm_rmap_desc {
	u64 *shadow_ptes[RMAP_EXT];
	struct kvm_rmap_desc *more;
};

A
Avi Kivity 已提交
145 146 147 148 149
struct kvm_shadow_walk {
	int (*entry)(struct kvm_shadow_walk *walk, struct kvm_vcpu *vcpu,
		     gva_t addr, u64 *spte, int level);
};

150 151
static struct kmem_cache *pte_chain_cache;
static struct kmem_cache *rmap_desc_cache;
152
static struct kmem_cache *mmu_page_header_cache;
153

154 155
static u64 __read_mostly shadow_trap_nonpresent_pte;
static u64 __read_mostly shadow_notrap_nonpresent_pte;
S
Sheng Yang 已提交
156 157 158 159 160 161
static u64 __read_mostly shadow_base_present_pte;
static u64 __read_mostly shadow_nx_mask;
static u64 __read_mostly shadow_x_mask;	/* mutual exclusive with nx_mask */
static u64 __read_mostly shadow_user_mask;
static u64 __read_mostly shadow_accessed_mask;
static u64 __read_mostly shadow_dirty_mask;
162 163 164 165 166 167 168 169

void kvm_mmu_set_nonpresent_ptes(u64 trap_pte, u64 notrap_pte)
{
	shadow_trap_nonpresent_pte = trap_pte;
	shadow_notrap_nonpresent_pte = notrap_pte;
}
EXPORT_SYMBOL_GPL(kvm_mmu_set_nonpresent_ptes);

S
Sheng Yang 已提交
170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186
void kvm_mmu_set_base_ptes(u64 base_pte)
{
	shadow_base_present_pte = base_pte;
}
EXPORT_SYMBOL_GPL(kvm_mmu_set_base_ptes);

void kvm_mmu_set_mask_ptes(u64 user_mask, u64 accessed_mask,
		u64 dirty_mask, u64 nx_mask, u64 x_mask)
{
	shadow_user_mask = user_mask;
	shadow_accessed_mask = accessed_mask;
	shadow_dirty_mask = dirty_mask;
	shadow_nx_mask = nx_mask;
	shadow_x_mask = x_mask;
}
EXPORT_SYMBOL_GPL(kvm_mmu_set_mask_ptes);

A
Avi Kivity 已提交
187 188
static int is_write_protection(struct kvm_vcpu *vcpu)
{
189
	return vcpu->arch.cr0 & X86_CR0_WP;
A
Avi Kivity 已提交
190 191 192 193 194 195 196
}

static int is_cpuid_PSE36(void)
{
	return 1;
}

197 198
static int is_nx(struct kvm_vcpu *vcpu)
{
199
	return vcpu->arch.shadow_efer & EFER_NX;
200 201
}

A
Avi Kivity 已提交
202 203 204 205 206
static int is_present_pte(unsigned long pte)
{
	return pte & PT_PRESENT_MASK;
}

207 208 209 210 211 212
static int is_shadow_present_pte(u64 pte)
{
	return pte != shadow_trap_nonpresent_pte
		&& pte != shadow_notrap_nonpresent_pte;
}

M
Marcelo Tosatti 已提交
213 214 215 216 217
static int is_large_pte(u64 pte)
{
	return pte & PT_PAGE_SIZE_MASK;
}

A
Avi Kivity 已提交
218 219 220 221 222
static int is_writeble_pte(unsigned long pte)
{
	return pte & PT_WRITABLE_MASK;
}

223 224
static int is_dirty_pte(unsigned long pte)
{
S
Sheng Yang 已提交
225
	return pte & shadow_dirty_mask;
226 227
}

228 229
static int is_rmap_pte(u64 pte)
{
230
	return is_shadow_present_pte(pte);
231 232
}

233
static pfn_t spte_to_pfn(u64 pte)
234
{
235
	return (pte & PT64_BASE_ADDR_MASK) >> PAGE_SHIFT;
236 237
}

238 239 240 241 242 243 244
static gfn_t pse36_gfn_delta(u32 gpte)
{
	int shift = 32 - PT32_DIR_PSE36_SHIFT - PAGE_SHIFT;

	return (gpte & PT32_DIR_PSE36_MASK) << shift;
}

245 246 247 248 249 250 251 252 253
static void set_shadow_pte(u64 *sptep, u64 spte)
{
#ifdef CONFIG_X86_64
	set_64bit((unsigned long *)sptep, spte);
#else
	set_64bit((unsigned long long *)sptep, spte);
#endif
}

254
static int mmu_topup_memory_cache(struct kvm_mmu_memory_cache *cache,
255
				  struct kmem_cache *base_cache, int min)
256 257 258 259
{
	void *obj;

	if (cache->nobjs >= min)
260
		return 0;
261
	while (cache->nobjs < ARRAY_SIZE(cache->objects)) {
262
		obj = kmem_cache_zalloc(base_cache, GFP_KERNEL);
263
		if (!obj)
264
			return -ENOMEM;
265 266
		cache->objects[cache->nobjs++] = obj;
	}
267
	return 0;
268 269 270 271 272 273 274 275
}

static void mmu_free_memory_cache(struct kvm_mmu_memory_cache *mc)
{
	while (mc->nobjs)
		kfree(mc->objects[--mc->nobjs]);
}

A
Avi Kivity 已提交
276
static int mmu_topup_memory_cache_page(struct kvm_mmu_memory_cache *cache,
277
				       int min)
A
Avi Kivity 已提交
278 279 280 281 282 283
{
	struct page *page;

	if (cache->nobjs >= min)
		return 0;
	while (cache->nobjs < ARRAY_SIZE(cache->objects)) {
284
		page = alloc_page(GFP_KERNEL);
A
Avi Kivity 已提交
285 286 287 288 289 290 291 292 293 294 295
		if (!page)
			return -ENOMEM;
		set_page_private(page, 0);
		cache->objects[cache->nobjs++] = page_address(page);
	}
	return 0;
}

static void mmu_free_memory_cache_page(struct kvm_mmu_memory_cache *mc)
{
	while (mc->nobjs)
296
		free_page((unsigned long)mc->objects[--mc->nobjs]);
A
Avi Kivity 已提交
297 298
}

299
static int mmu_topup_memory_caches(struct kvm_vcpu *vcpu)
300
{
301 302
	int r;

303
	r = mmu_topup_memory_cache(&vcpu->arch.mmu_pte_chain_cache,
304
				   pte_chain_cache, 4);
305 306
	if (r)
		goto out;
307
	r = mmu_topup_memory_cache(&vcpu->arch.mmu_rmap_desc_cache,
308
				   rmap_desc_cache, 1);
309 310
	if (r)
		goto out;
311
	r = mmu_topup_memory_cache_page(&vcpu->arch.mmu_page_cache, 8);
312 313
	if (r)
		goto out;
314
	r = mmu_topup_memory_cache(&vcpu->arch.mmu_page_header_cache,
315
				   mmu_page_header_cache, 4);
316 317
out:
	return r;
318 319 320 321
}

static void mmu_free_memory_caches(struct kvm_vcpu *vcpu)
{
322 323 324 325
	mmu_free_memory_cache(&vcpu->arch.mmu_pte_chain_cache);
	mmu_free_memory_cache(&vcpu->arch.mmu_rmap_desc_cache);
	mmu_free_memory_cache_page(&vcpu->arch.mmu_page_cache);
	mmu_free_memory_cache(&vcpu->arch.mmu_page_header_cache);
326 327 328 329 330 331 332 333 334 335 336 337 338 339 340
}

static void *mmu_memory_cache_alloc(struct kvm_mmu_memory_cache *mc,
				    size_t size)
{
	void *p;

	BUG_ON(!mc->nobjs);
	p = mc->objects[--mc->nobjs];
	memset(p, 0, size);
	return p;
}

static struct kvm_pte_chain *mmu_alloc_pte_chain(struct kvm_vcpu *vcpu)
{
341
	return mmu_memory_cache_alloc(&vcpu->arch.mmu_pte_chain_cache,
342 343 344
				      sizeof(struct kvm_pte_chain));
}

345
static void mmu_free_pte_chain(struct kvm_pte_chain *pc)
346
{
347
	kfree(pc);
348 349 350 351
}

static struct kvm_rmap_desc *mmu_alloc_rmap_desc(struct kvm_vcpu *vcpu)
{
352
	return mmu_memory_cache_alloc(&vcpu->arch.mmu_rmap_desc_cache,
353 354 355
				      sizeof(struct kvm_rmap_desc));
}

356
static void mmu_free_rmap_desc(struct kvm_rmap_desc *rd)
357
{
358
	kfree(rd);
359 360
}

M
Marcelo Tosatti 已提交
361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436
/*
 * Return the pointer to the largepage write count for a given
 * gfn, handling slots that are not large page aligned.
 */
static int *slot_largepage_idx(gfn_t gfn, struct kvm_memory_slot *slot)
{
	unsigned long idx;

	idx = (gfn / KVM_PAGES_PER_HPAGE) -
	      (slot->base_gfn / KVM_PAGES_PER_HPAGE);
	return &slot->lpage_info[idx].write_count;
}

static void account_shadowed(struct kvm *kvm, gfn_t gfn)
{
	int *write_count;

	write_count = slot_largepage_idx(gfn, gfn_to_memslot(kvm, gfn));
	*write_count += 1;
}

static void unaccount_shadowed(struct kvm *kvm, gfn_t gfn)
{
	int *write_count;

	write_count = slot_largepage_idx(gfn, gfn_to_memslot(kvm, gfn));
	*write_count -= 1;
	WARN_ON(*write_count < 0);
}

static int has_wrprotected_page(struct kvm *kvm, gfn_t gfn)
{
	struct kvm_memory_slot *slot = gfn_to_memslot(kvm, gfn);
	int *largepage_idx;

	if (slot) {
		largepage_idx = slot_largepage_idx(gfn, slot);
		return *largepage_idx;
	}

	return 1;
}

static int host_largepage_backed(struct kvm *kvm, gfn_t gfn)
{
	struct vm_area_struct *vma;
	unsigned long addr;

	addr = gfn_to_hva(kvm, gfn);
	if (kvm_is_error_hva(addr))
		return 0;

	vma = find_vma(current->mm, addr);
	if (vma && is_vm_hugetlb_page(vma))
		return 1;

	return 0;
}

static int is_largepage_backed(struct kvm_vcpu *vcpu, gfn_t large_gfn)
{
	struct kvm_memory_slot *slot;

	if (has_wrprotected_page(vcpu->kvm, large_gfn))
		return 0;

	if (!host_largepage_backed(vcpu->kvm, large_gfn))
		return 0;

	slot = gfn_to_memslot(vcpu->kvm, large_gfn);
	if (slot && slot->dirty_bitmap)
		return 0;

	return 1;
}

437 438 439 440 441
/*
 * Take gfn and return the reverse mapping to it.
 * Note: gfn must be unaliased before this function get called
 */

M
Marcelo Tosatti 已提交
442
static unsigned long *gfn_to_rmap(struct kvm *kvm, gfn_t gfn, int lpage)
443 444
{
	struct kvm_memory_slot *slot;
M
Marcelo Tosatti 已提交
445
	unsigned long idx;
446 447

	slot = gfn_to_memslot(kvm, gfn);
M
Marcelo Tosatti 已提交
448 449 450 451 452 453 454
	if (!lpage)
		return &slot->rmap[gfn - slot->base_gfn];

	idx = (gfn / KVM_PAGES_PER_HPAGE) -
	      (slot->base_gfn / KVM_PAGES_PER_HPAGE);

	return &slot->lpage_info[idx].rmap_pde;
455 456
}

457 458 459
/*
 * Reverse mapping data structures:
 *
460 461
 * If rmapp bit zero is zero, then rmapp point to the shadw page table entry
 * that points to page_address(page).
462
 *
463 464
 * If rmapp bit zero is one, (then rmap & ~1) points to a struct kvm_rmap_desc
 * containing more mappings.
465
 */
M
Marcelo Tosatti 已提交
466
static void rmap_add(struct kvm_vcpu *vcpu, u64 *spte, gfn_t gfn, int lpage)
467
{
468
	struct kvm_mmu_page *sp;
469
	struct kvm_rmap_desc *desc;
470
	unsigned long *rmapp;
471 472 473 474
	int i;

	if (!is_rmap_pte(*spte))
		return;
475
	gfn = unalias_gfn(vcpu->kvm, gfn);
476 477
	sp = page_header(__pa(spte));
	sp->gfns[spte - sp->spt] = gfn;
M
Marcelo Tosatti 已提交
478
	rmapp = gfn_to_rmap(vcpu->kvm, gfn, lpage);
479
	if (!*rmapp) {
480
		rmap_printk("rmap_add: %p %llx 0->1\n", spte, *spte);
481 482
		*rmapp = (unsigned long)spte;
	} else if (!(*rmapp & 1)) {
483
		rmap_printk("rmap_add: %p %llx 1->many\n", spte, *spte);
484
		desc = mmu_alloc_rmap_desc(vcpu);
485
		desc->shadow_ptes[0] = (u64 *)*rmapp;
486
		desc->shadow_ptes[1] = spte;
487
		*rmapp = (unsigned long)desc | 1;
488 489
	} else {
		rmap_printk("rmap_add: %p %llx many->many\n", spte, *spte);
490
		desc = (struct kvm_rmap_desc *)(*rmapp & ~1ul);
491 492 493
		while (desc->shadow_ptes[RMAP_EXT-1] && desc->more)
			desc = desc->more;
		if (desc->shadow_ptes[RMAP_EXT-1]) {
494
			desc->more = mmu_alloc_rmap_desc(vcpu);
495 496 497 498 499 500 501 502
			desc = desc->more;
		}
		for (i = 0; desc->shadow_ptes[i]; ++i)
			;
		desc->shadow_ptes[i] = spte;
	}
}

503
static void rmap_desc_remove_entry(unsigned long *rmapp,
504 505 506 507 508 509 510 511 512
				   struct kvm_rmap_desc *desc,
				   int i,
				   struct kvm_rmap_desc *prev_desc)
{
	int j;

	for (j = RMAP_EXT - 1; !desc->shadow_ptes[j] && j > i; --j)
		;
	desc->shadow_ptes[i] = desc->shadow_ptes[j];
A
Al Viro 已提交
513
	desc->shadow_ptes[j] = NULL;
514 515 516
	if (j != 0)
		return;
	if (!prev_desc && !desc->more)
517
		*rmapp = (unsigned long)desc->shadow_ptes[0];
518 519 520 521
	else
		if (prev_desc)
			prev_desc->more = desc->more;
		else
522
			*rmapp = (unsigned long)desc->more | 1;
523
	mmu_free_rmap_desc(desc);
524 525
}

526
static void rmap_remove(struct kvm *kvm, u64 *spte)
527 528 529
{
	struct kvm_rmap_desc *desc;
	struct kvm_rmap_desc *prev_desc;
530
	struct kvm_mmu_page *sp;
531
	pfn_t pfn;
532
	unsigned long *rmapp;
533 534 535 536
	int i;

	if (!is_rmap_pte(*spte))
		return;
537
	sp = page_header(__pa(spte));
538
	pfn = spte_to_pfn(*spte);
S
Sheng Yang 已提交
539
	if (*spte & shadow_accessed_mask)
540
		kvm_set_pfn_accessed(pfn);
541
	if (is_writeble_pte(*spte))
542
		kvm_release_pfn_dirty(pfn);
543
	else
544
		kvm_release_pfn_clean(pfn);
M
Marcelo Tosatti 已提交
545
	rmapp = gfn_to_rmap(kvm, sp->gfns[spte - sp->spt], is_large_pte(*spte));
546
	if (!*rmapp) {
547 548
		printk(KERN_ERR "rmap_remove: %p %llx 0->BUG\n", spte, *spte);
		BUG();
549
	} else if (!(*rmapp & 1)) {
550
		rmap_printk("rmap_remove:  %p %llx 1->0\n", spte, *spte);
551
		if ((u64 *)*rmapp != spte) {
552 553 554 555
			printk(KERN_ERR "rmap_remove:  %p %llx 1->BUG\n",
			       spte, *spte);
			BUG();
		}
556
		*rmapp = 0;
557 558
	} else {
		rmap_printk("rmap_remove:  %p %llx many->many\n", spte, *spte);
559
		desc = (struct kvm_rmap_desc *)(*rmapp & ~1ul);
560 561 562 563
		prev_desc = NULL;
		while (desc) {
			for (i = 0; i < RMAP_EXT && desc->shadow_ptes[i]; ++i)
				if (desc->shadow_ptes[i] == spte) {
564
					rmap_desc_remove_entry(rmapp,
565
							       desc, i,
566 567 568 569 570 571 572 573 574 575
							       prev_desc);
					return;
				}
			prev_desc = desc;
			desc = desc->more;
		}
		BUG();
	}
}

576
static u64 *rmap_next(struct kvm *kvm, unsigned long *rmapp, u64 *spte)
577 578
{
	struct kvm_rmap_desc *desc;
579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605
	struct kvm_rmap_desc *prev_desc;
	u64 *prev_spte;
	int i;

	if (!*rmapp)
		return NULL;
	else if (!(*rmapp & 1)) {
		if (!spte)
			return (u64 *)*rmapp;
		return NULL;
	}
	desc = (struct kvm_rmap_desc *)(*rmapp & ~1ul);
	prev_desc = NULL;
	prev_spte = NULL;
	while (desc) {
		for (i = 0; i < RMAP_EXT && desc->shadow_ptes[i]; ++i) {
			if (prev_spte == spte)
				return desc->shadow_ptes[i];
			prev_spte = desc->shadow_ptes[i];
		}
		desc = desc->more;
	}
	return NULL;
}

static void rmap_write_protect(struct kvm *kvm, u64 gfn)
{
606
	unsigned long *rmapp;
607
	u64 *spte;
608
	int write_protected = 0;
609

610
	gfn = unalias_gfn(kvm, gfn);
M
Marcelo Tosatti 已提交
611
	rmapp = gfn_to_rmap(kvm, gfn, 0);
612

613 614
	spte = rmap_next(kvm, rmapp, NULL);
	while (spte) {
615 616 617
		BUG_ON(!spte);
		BUG_ON(!(*spte & PT_PRESENT_MASK));
		rmap_printk("rmap_write_protect: spte %p %llx\n", spte, *spte);
618
		if (is_writeble_pte(*spte)) {
619
			set_shadow_pte(spte, *spte & ~PT_WRITABLE_MASK);
620 621
			write_protected = 1;
		}
622
		spte = rmap_next(kvm, rmapp, spte);
623
	}
624
	if (write_protected) {
625
		pfn_t pfn;
626 627

		spte = rmap_next(kvm, rmapp, NULL);
628 629
		pfn = spte_to_pfn(*spte);
		kvm_set_pfn_dirty(pfn);
630 631
	}

M
Marcelo Tosatti 已提交
632 633 634 635 636 637 638 639 640 641 642 643
	/* check for huge page mappings */
	rmapp = gfn_to_rmap(kvm, gfn, 1);
	spte = rmap_next(kvm, rmapp, NULL);
	while (spte) {
		BUG_ON(!spte);
		BUG_ON(!(*spte & PT_PRESENT_MASK));
		BUG_ON((*spte & (PT_PAGE_SIZE_MASK|PT_PRESENT_MASK)) != (PT_PAGE_SIZE_MASK|PT_PRESENT_MASK));
		pgprintk("rmap_write_protect(large): spte %p %llx %lld\n", spte, *spte, gfn);
		if (is_writeble_pte(*spte)) {
			rmap_remove(kvm, spte);
			--kvm->stat.lpages;
			set_shadow_pte(spte, shadow_trap_nonpresent_pte);
644
			spte = NULL;
M
Marcelo Tosatti 已提交
645 646 647 648 649
			write_protected = 1;
		}
		spte = rmap_next(kvm, rmapp, spte);
	}

650 651
	if (write_protected)
		kvm_flush_remote_tlbs(kvm);
M
Marcelo Tosatti 已提交
652 653

	account_shadowed(kvm, gfn);
654 655
}

656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713
static int kvm_unmap_rmapp(struct kvm *kvm, unsigned long *rmapp)
{
	u64 *spte;
	int need_tlb_flush = 0;

	while ((spte = rmap_next(kvm, rmapp, NULL))) {
		BUG_ON(!(*spte & PT_PRESENT_MASK));
		rmap_printk("kvm_rmap_unmap_hva: spte %p %llx\n", spte, *spte);
		rmap_remove(kvm, spte);
		set_shadow_pte(spte, shadow_trap_nonpresent_pte);
		need_tlb_flush = 1;
	}
	return need_tlb_flush;
}

static int kvm_handle_hva(struct kvm *kvm, unsigned long hva,
			  int (*handler)(struct kvm *kvm, unsigned long *rmapp))
{
	int i;
	int retval = 0;

	/*
	 * If mmap_sem isn't taken, we can look the memslots with only
	 * the mmu_lock by skipping over the slots with userspace_addr == 0.
	 */
	for (i = 0; i < kvm->nmemslots; i++) {
		struct kvm_memory_slot *memslot = &kvm->memslots[i];
		unsigned long start = memslot->userspace_addr;
		unsigned long end;

		/* mmu_lock protects userspace_addr */
		if (!start)
			continue;

		end = start + (memslot->npages << PAGE_SHIFT);
		if (hva >= start && hva < end) {
			gfn_t gfn_offset = (hva - start) >> PAGE_SHIFT;
			retval |= handler(kvm, &memslot->rmap[gfn_offset]);
			retval |= handler(kvm,
					  &memslot->lpage_info[
						  gfn_offset /
						  KVM_PAGES_PER_HPAGE].rmap_pde);
		}
	}

	return retval;
}

int kvm_unmap_hva(struct kvm *kvm, unsigned long hva)
{
	return kvm_handle_hva(kvm, hva, kvm_unmap_rmapp);
}

static int kvm_age_rmapp(struct kvm *kvm, unsigned long *rmapp)
{
	u64 *spte;
	int young = 0;

714 715 716 717
	/* always return old for EPT */
	if (!shadow_accessed_mask)
		return 0;

718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737
	spte = rmap_next(kvm, rmapp, NULL);
	while (spte) {
		int _young;
		u64 _spte = *spte;
		BUG_ON(!(_spte & PT_PRESENT_MASK));
		_young = _spte & PT_ACCESSED_MASK;
		if (_young) {
			young = 1;
			clear_bit(PT_ACCESSED_SHIFT, (unsigned long *)spte);
		}
		spte = rmap_next(kvm, rmapp, spte);
	}
	return young;
}

int kvm_age_hva(struct kvm *kvm, unsigned long hva)
{
	return kvm_handle_hva(kvm, hva, kvm_age_rmapp);
}

738
#ifdef MMU_DEBUG
739
static int is_empty_shadow_page(u64 *spt)
A
Avi Kivity 已提交
740
{
741 742 743
	u64 *pos;
	u64 *end;

744
	for (pos = spt, end = pos + PAGE_SIZE / sizeof(u64); pos != end; pos++)
745
		if (is_shadow_present_pte(*pos)) {
746
			printk(KERN_ERR "%s: %p %llx\n", __func__,
747
			       pos, *pos);
A
Avi Kivity 已提交
748
			return 0;
749
		}
A
Avi Kivity 已提交
750 751
	return 1;
}
752
#endif
A
Avi Kivity 已提交
753

754
static void kvm_mmu_free_page(struct kvm *kvm, struct kvm_mmu_page *sp)
755
{
756 757 758 759 760
	ASSERT(is_empty_shadow_page(sp->spt));
	list_del(&sp->link);
	__free_page(virt_to_page(sp->spt));
	__free_page(virt_to_page(sp->gfns));
	kfree(sp);
761
	++kvm->arch.n_free_mmu_pages;
762 763
}

764 765
static unsigned kvm_page_table_hashfn(gfn_t gfn)
{
766
	return gfn & ((1 << KVM_MMU_HASH_SHIFT) - 1);
767 768
}

769 770
static struct kvm_mmu_page *kvm_mmu_alloc_page(struct kvm_vcpu *vcpu,
					       u64 *parent_pte)
A
Avi Kivity 已提交
771
{
772
	struct kvm_mmu_page *sp;
A
Avi Kivity 已提交
773

774 775 776
	sp = mmu_memory_cache_alloc(&vcpu->arch.mmu_page_header_cache, sizeof *sp);
	sp->spt = mmu_memory_cache_alloc(&vcpu->arch.mmu_page_cache, PAGE_SIZE);
	sp->gfns = mmu_memory_cache_alloc(&vcpu->arch.mmu_page_cache, PAGE_SIZE);
777
	set_page_private(virt_to_page(sp->spt), (unsigned long)sp);
778
	list_add(&sp->link, &vcpu->kvm->arch.active_mmu_pages);
779 780 781 782
	ASSERT(is_empty_shadow_page(sp->spt));
	sp->slot_bitmap = 0;
	sp->multimapped = 0;
	sp->parent_pte = parent_pte;
783
	--vcpu->kvm->arch.n_free_mmu_pages;
784
	return sp;
A
Avi Kivity 已提交
785 786
}

787
static void mmu_page_add_parent_pte(struct kvm_vcpu *vcpu,
788
				    struct kvm_mmu_page *sp, u64 *parent_pte)
789 790 791 792 793 794 795
{
	struct kvm_pte_chain *pte_chain;
	struct hlist_node *node;
	int i;

	if (!parent_pte)
		return;
796 797
	if (!sp->multimapped) {
		u64 *old = sp->parent_pte;
798 799

		if (!old) {
800
			sp->parent_pte = parent_pte;
801 802
			return;
		}
803
		sp->multimapped = 1;
804
		pte_chain = mmu_alloc_pte_chain(vcpu);
805 806
		INIT_HLIST_HEAD(&sp->parent_ptes);
		hlist_add_head(&pte_chain->link, &sp->parent_ptes);
807 808
		pte_chain->parent_ptes[0] = old;
	}
809
	hlist_for_each_entry(pte_chain, node, &sp->parent_ptes, link) {
810 811 812 813 814 815 816 817
		if (pte_chain->parent_ptes[NR_PTE_CHAIN_ENTRIES-1])
			continue;
		for (i = 0; i < NR_PTE_CHAIN_ENTRIES; ++i)
			if (!pte_chain->parent_ptes[i]) {
				pte_chain->parent_ptes[i] = parent_pte;
				return;
			}
	}
818
	pte_chain = mmu_alloc_pte_chain(vcpu);
819
	BUG_ON(!pte_chain);
820
	hlist_add_head(&pte_chain->link, &sp->parent_ptes);
821 822 823
	pte_chain->parent_ptes[0] = parent_pte;
}

824
static void mmu_page_remove_parent_pte(struct kvm_mmu_page *sp,
825 826 827 828 829 830
				       u64 *parent_pte)
{
	struct kvm_pte_chain *pte_chain;
	struct hlist_node *node;
	int i;

831 832 833
	if (!sp->multimapped) {
		BUG_ON(sp->parent_pte != parent_pte);
		sp->parent_pte = NULL;
834 835
		return;
	}
836
	hlist_for_each_entry(pte_chain, node, &sp->parent_ptes, link)
837 838 839 840 841
		for (i = 0; i < NR_PTE_CHAIN_ENTRIES; ++i) {
			if (!pte_chain->parent_ptes[i])
				break;
			if (pte_chain->parent_ptes[i] != parent_pte)
				continue;
842 843
			while (i + 1 < NR_PTE_CHAIN_ENTRIES
				&& pte_chain->parent_ptes[i + 1]) {
844 845 846 847 848
				pte_chain->parent_ptes[i]
					= pte_chain->parent_ptes[i + 1];
				++i;
			}
			pte_chain->parent_ptes[i] = NULL;
849 850
			if (i == 0) {
				hlist_del(&pte_chain->link);
851
				mmu_free_pte_chain(pte_chain);
852 853 854
				if (hlist_empty(&sp->parent_ptes)) {
					sp->multimapped = 0;
					sp->parent_pte = NULL;
855 856
				}
			}
857 858 859 860 861
			return;
		}
	BUG();
}

862 863 864 865 866 867 868 869 870
static void nonpaging_prefetch_page(struct kvm_vcpu *vcpu,
				    struct kvm_mmu_page *sp)
{
	int i;

	for (i = 0; i < PT64_ENT_PER_PAGE; ++i)
		sp->spt[i] = shadow_trap_nonpresent_pte;
}

871
static struct kvm_mmu_page *kvm_mmu_lookup_page(struct kvm *kvm, gfn_t gfn)
872 873 874
{
	unsigned index;
	struct hlist_head *bucket;
875
	struct kvm_mmu_page *sp;
876 877
	struct hlist_node *node;

878
	pgprintk("%s: looking for gfn %lx\n", __func__, gfn);
879
	index = kvm_page_table_hashfn(gfn);
880
	bucket = &kvm->arch.mmu_page_hash[index];
881
	hlist_for_each_entry(sp, node, bucket, hash_link)
882 883
		if (sp->gfn == gfn && !sp->role.metaphysical
		    && !sp->role.invalid) {
884
			pgprintk("%s: found role %x\n",
885
				 __func__, sp->role.word);
886
			return sp;
887 888 889 890 891 892 893 894 895
		}
	return NULL;
}

static struct kvm_mmu_page *kvm_mmu_get_page(struct kvm_vcpu *vcpu,
					     gfn_t gfn,
					     gva_t gaddr,
					     unsigned level,
					     int metaphysical,
896
					     unsigned access,
897
					     u64 *parent_pte)
898 899 900 901 902
{
	union kvm_mmu_page_role role;
	unsigned index;
	unsigned quadrant;
	struct hlist_head *bucket;
903
	struct kvm_mmu_page *sp;
904 905 906
	struct hlist_node *node;

	role.word = 0;
907
	role.glevels = vcpu->arch.mmu.root_level;
908 909
	role.level = level;
	role.metaphysical = metaphysical;
910
	role.access = access;
911
	if (vcpu->arch.mmu.root_level <= PT32_ROOT_LEVEL) {
912 913 914 915
		quadrant = gaddr >> (PAGE_SHIFT + (PT64_PT_BITS * level));
		quadrant &= (1 << ((PT32_PT_BITS - PT64_PT_BITS) * level)) - 1;
		role.quadrant = quadrant;
	}
916
	pgprintk("%s: looking gfn %lx role %x\n", __func__,
917
		 gfn, role.word);
918
	index = kvm_page_table_hashfn(gfn);
919
	bucket = &vcpu->kvm->arch.mmu_page_hash[index];
920 921 922
	hlist_for_each_entry(sp, node, bucket, hash_link)
		if (sp->gfn == gfn && sp->role.word == role.word) {
			mmu_page_add_parent_pte(vcpu, sp, parent_pte);
923
			pgprintk("%s: found\n", __func__);
924
			return sp;
925
		}
A
Avi Kivity 已提交
926
	++vcpu->kvm->stat.mmu_cache_miss;
927 928 929
	sp = kvm_mmu_alloc_page(vcpu, parent_pte);
	if (!sp)
		return sp;
930
	pgprintk("%s: adding gfn %lx role %x\n", __func__, gfn, role.word);
931 932 933
	sp->gfn = gfn;
	sp->role = role;
	hlist_add_head(&sp->hash_link, bucket);
934
	if (!metaphysical)
935
		rmap_write_protect(vcpu->kvm, gfn);
936 937 938 939
	if (shadow_trap_nonpresent_pte != shadow_notrap_nonpresent_pte)
		vcpu->arch.mmu.prefetch_page(vcpu, sp);
	else
		nonpaging_prefetch_page(vcpu, sp);
940
	return sp;
941 942
}

A
Avi Kivity 已提交
943 944 945 946 947 948 949 950 951 952 953 954 955 956 957 958 959 960 961 962 963 964 965 966 967 968 969 970 971
static int walk_shadow(struct kvm_shadow_walk *walker,
		       struct kvm_vcpu *vcpu, gva_t addr)
{
	hpa_t shadow_addr;
	int level;
	int r;
	u64 *sptep;
	unsigned index;

	shadow_addr = vcpu->arch.mmu.root_hpa;
	level = vcpu->arch.mmu.shadow_root_level;
	if (level == PT32E_ROOT_LEVEL) {
		shadow_addr = vcpu->arch.mmu.pae_root[(addr >> 30) & 3];
		shadow_addr &= PT64_BASE_ADDR_MASK;
		--level;
	}

	while (level >= PT_PAGE_TABLE_LEVEL) {
		index = SHADOW_PT_INDEX(addr, level);
		sptep = ((u64 *)__va(shadow_addr)) + index;
		r = walker->entry(walker, vcpu, addr, sptep, level);
		if (r)
			return r;
		shadow_addr = *sptep & PT64_BASE_ADDR_MASK;
		--level;
	}
	return 0;
}

972
static void kvm_mmu_page_unlink_children(struct kvm *kvm,
973
					 struct kvm_mmu_page *sp)
974
{
975 976 977 978
	unsigned i;
	u64 *pt;
	u64 ent;

979
	pt = sp->spt;
980

981
	if (sp->role.level == PT_PAGE_TABLE_LEVEL) {
982
		for (i = 0; i < PT64_ENT_PER_PAGE; ++i) {
983
			if (is_shadow_present_pte(pt[i]))
984
				rmap_remove(kvm, &pt[i]);
985
			pt[i] = shadow_trap_nonpresent_pte;
986 987 988 989 990 991 992
		}
		return;
	}

	for (i = 0; i < PT64_ENT_PER_PAGE; ++i) {
		ent = pt[i];

M
Marcelo Tosatti 已提交
993 994 995 996 997 998 999 1000 1001 1002
		if (is_shadow_present_pte(ent)) {
			if (!is_large_pte(ent)) {
				ent &= PT64_BASE_ADDR_MASK;
				mmu_page_remove_parent_pte(page_header(ent),
							   &pt[i]);
			} else {
				--kvm->stat.lpages;
				rmap_remove(kvm, &pt[i]);
			}
		}
1003
		pt[i] = shadow_trap_nonpresent_pte;
1004
	}
1005 1006
}

1007
static void kvm_mmu_put_page(struct kvm_mmu_page *sp, u64 *parent_pte)
1008
{
1009
	mmu_page_remove_parent_pte(sp, parent_pte);
1010 1011
}

1012 1013 1014 1015 1016 1017
static void kvm_mmu_reset_last_pte_updated(struct kvm *kvm)
{
	int i;

	for (i = 0; i < KVM_MAX_VCPUS; ++i)
		if (kvm->vcpus[i])
1018
			kvm->vcpus[i]->arch.last_pte_updated = NULL;
1019 1020
}

1021
static void kvm_mmu_unlink_parents(struct kvm *kvm, struct kvm_mmu_page *sp)
1022 1023 1024
{
	u64 *parent_pte;

1025 1026 1027
	while (sp->multimapped || sp->parent_pte) {
		if (!sp->multimapped)
			parent_pte = sp->parent_pte;
1028 1029 1030
		else {
			struct kvm_pte_chain *chain;

1031
			chain = container_of(sp->parent_ptes.first,
1032 1033 1034
					     struct kvm_pte_chain, link);
			parent_pte = chain->parent_ptes[0];
		}
1035
		BUG_ON(!parent_pte);
1036
		kvm_mmu_put_page(sp, parent_pte);
1037
		set_shadow_pte(parent_pte, shadow_trap_nonpresent_pte);
1038
	}
1039 1040 1041 1042 1043
}

static void kvm_mmu_zap_page(struct kvm *kvm, struct kvm_mmu_page *sp)
{
	++kvm->stat.mmu_shadow_zapped;
1044
	kvm_mmu_page_unlink_children(kvm, sp);
1045
	kvm_mmu_unlink_parents(kvm, sp);
A
Avi Kivity 已提交
1046 1047 1048
	kvm_flush_remote_tlbs(kvm);
	if (!sp->role.invalid && !sp->role.metaphysical)
		unaccount_shadowed(kvm, sp->gfn);
1049 1050 1051
	if (!sp->root_count) {
		hlist_del(&sp->hash_link);
		kvm_mmu_free_page(kvm, sp);
1052 1053
	} else {
		sp->role.invalid = 1;
A
Avi Kivity 已提交
1054
		list_move(&sp->link, &kvm->arch.active_mmu_pages);
1055 1056
		kvm_reload_remote_mmus(kvm);
	}
1057
	kvm_mmu_reset_last_pte_updated(kvm);
1058 1059
}

1060 1061 1062 1063 1064 1065 1066 1067 1068 1069 1070 1071
/*
 * Changing the number of mmu pages allocated to the vm
 * Note: if kvm_nr_mmu_pages is too small, you will get dead lock
 */
void kvm_mmu_change_mmu_pages(struct kvm *kvm, unsigned int kvm_nr_mmu_pages)
{
	/*
	 * If we set the number of mmu pages to be smaller be than the
	 * number of actived pages , we must to free some mmu pages before we
	 * change the value
	 */

1072
	if ((kvm->arch.n_alloc_mmu_pages - kvm->arch.n_free_mmu_pages) >
1073
	    kvm_nr_mmu_pages) {
1074 1075
		int n_used_mmu_pages = kvm->arch.n_alloc_mmu_pages
				       - kvm->arch.n_free_mmu_pages;
1076 1077 1078 1079

		while (n_used_mmu_pages > kvm_nr_mmu_pages) {
			struct kvm_mmu_page *page;

1080
			page = container_of(kvm->arch.active_mmu_pages.prev,
1081 1082 1083 1084
					    struct kvm_mmu_page, link);
			kvm_mmu_zap_page(kvm, page);
			n_used_mmu_pages--;
		}
1085
		kvm->arch.n_free_mmu_pages = 0;
1086 1087
	}
	else
1088 1089
		kvm->arch.n_free_mmu_pages += kvm_nr_mmu_pages
					 - kvm->arch.n_alloc_mmu_pages;
1090

1091
	kvm->arch.n_alloc_mmu_pages = kvm_nr_mmu_pages;
1092 1093
}

1094
static int kvm_mmu_unprotect_page(struct kvm *kvm, gfn_t gfn)
1095 1096 1097
{
	unsigned index;
	struct hlist_head *bucket;
1098
	struct kvm_mmu_page *sp;
1099 1100 1101
	struct hlist_node *node, *n;
	int r;

1102
	pgprintk("%s: looking for gfn %lx\n", __func__, gfn);
1103
	r = 0;
1104
	index = kvm_page_table_hashfn(gfn);
1105
	bucket = &kvm->arch.mmu_page_hash[index];
1106 1107
	hlist_for_each_entry_safe(sp, node, n, bucket, hash_link)
		if (sp->gfn == gfn && !sp->role.metaphysical) {
1108
			pgprintk("%s: gfn %lx role %x\n", __func__, gfn,
1109 1110
				 sp->role.word);
			kvm_mmu_zap_page(kvm, sp);
1111 1112 1113
			r = 1;
		}
	return r;
1114 1115
}

1116
static void mmu_unshadow(struct kvm *kvm, gfn_t gfn)
1117
{
1118
	struct kvm_mmu_page *sp;
1119

1120
	while ((sp = kvm_mmu_lookup_page(kvm, gfn)) != NULL) {
1121
		pgprintk("%s: zap %lx %x\n", __func__, gfn, sp->role.word);
1122
		kvm_mmu_zap_page(kvm, sp);
1123 1124 1125
	}
}

1126
static void page_header_update_slot(struct kvm *kvm, void *pte, gfn_t gfn)
A
Avi Kivity 已提交
1127
{
1128
	int slot = memslot_id(kvm, gfn_to_memslot(kvm, gfn));
1129
	struct kvm_mmu_page *sp = page_header(__pa(pte));
A
Avi Kivity 已提交
1130

1131
	__set_bit(slot, &sp->slot_bitmap);
A
Avi Kivity 已提交
1132 1133
}

1134 1135
struct page *gva_to_page(struct kvm_vcpu *vcpu, gva_t gva)
{
1136 1137
	struct page *page;

1138
	gpa_t gpa = vcpu->arch.mmu.gva_to_gpa(vcpu, gva);
1139 1140 1141

	if (gpa == UNMAPPED_GVA)
		return NULL;
1142 1143 1144 1145 1146 1147

	down_read(&current->mm->mmap_sem);
	page = gfn_to_page(vcpu->kvm, gpa >> PAGE_SHIFT);
	up_read(&current->mm->mmap_sem);

	return page;
1148 1149
}

1150 1151 1152
static void mmu_set_spte(struct kvm_vcpu *vcpu, u64 *shadow_pte,
			 unsigned pt_access, unsigned pte_access,
			 int user_fault, int write_fault, int dirty,
M
Marcelo Tosatti 已提交
1153
			 int *ptwrite, int largepage, gfn_t gfn,
1154
			 pfn_t pfn, bool speculative)
1155 1156
{
	u64 spte;
1157
	int was_rmapped = 0;
1158
	int was_writeble = is_writeble_pte(*shadow_pte);
1159

1160
	pgprintk("%s: spte %llx access %x write_fault %d"
1161
		 " user_fault %d gfn %lx\n",
1162
		 __func__, *shadow_pte, pt_access,
1163 1164
		 write_fault, user_fault, gfn);

1165
	if (is_rmap_pte(*shadow_pte)) {
M
Marcelo Tosatti 已提交
1166 1167 1168 1169 1170 1171 1172 1173 1174 1175
		/*
		 * If we overwrite a PTE page pointer with a 2MB PMD, unlink
		 * the parent of the now unreachable PTE.
		 */
		if (largepage && !is_large_pte(*shadow_pte)) {
			struct kvm_mmu_page *child;
			u64 pte = *shadow_pte;

			child = page_header(pte & PT64_BASE_ADDR_MASK);
			mmu_page_remove_parent_pte(child, shadow_pte);
1176
		} else if (pfn != spte_to_pfn(*shadow_pte)) {
1177
			pgprintk("hfn old %lx new %lx\n",
1178
				 spte_to_pfn(*shadow_pte), pfn);
1179
			rmap_remove(vcpu->kvm, shadow_pte);
M
Marcelo Tosatti 已提交
1180 1181 1182 1183 1184
		} else {
			if (largepage)
				was_rmapped = is_large_pte(*shadow_pte);
			else
				was_rmapped = 1;
1185 1186 1187
		}
	}

1188 1189 1190 1191 1192
	/*
	 * We don't set the accessed bit, since we sometimes want to see
	 * whether the guest actually used the pte (in order to detect
	 * demand paging).
	 */
S
Sheng Yang 已提交
1193
	spte = shadow_base_present_pte | shadow_dirty_mask;
1194
	if (!speculative)
1195
		spte |= shadow_accessed_mask;
1196 1197
	if (!dirty)
		pte_access &= ~ACC_WRITE_MASK;
S
Sheng Yang 已提交
1198 1199 1200 1201
	if (pte_access & ACC_EXEC_MASK)
		spte |= shadow_x_mask;
	else
		spte |= shadow_nx_mask;
1202
	if (pte_access & ACC_USER_MASK)
S
Sheng Yang 已提交
1203
		spte |= shadow_user_mask;
M
Marcelo Tosatti 已提交
1204 1205
	if (largepage)
		spte |= PT_PAGE_SIZE_MASK;
1206

1207
	spte |= (u64)pfn << PAGE_SHIFT;
1208 1209 1210 1211 1212 1213 1214 1215

	if ((pte_access & ACC_WRITE_MASK)
	    || (write_fault && !is_write_protection(vcpu) && !user_fault)) {
		struct kvm_mmu_page *shadow;

		spte |= PT_WRITABLE_MASK;

		shadow = kvm_mmu_lookup_page(vcpu->kvm, gfn);
M
Marcelo Tosatti 已提交
1216 1217
		if (shadow ||
		   (largepage && has_wrprotected_page(vcpu->kvm, gfn))) {
1218
			pgprintk("%s: found shadow page for %lx, marking ro\n",
1219
				 __func__, gfn);
1220 1221 1222 1223 1224 1225 1226 1227 1228 1229 1230 1231 1232
			pte_access &= ~ACC_WRITE_MASK;
			if (is_writeble_pte(spte)) {
				spte &= ~PT_WRITABLE_MASK;
				kvm_x86_ops->tlb_flush(vcpu);
			}
			if (write_fault)
				*ptwrite = 1;
		}
	}

	if (pte_access & ACC_WRITE_MASK)
		mark_page_dirty(vcpu->kvm, gfn);

1233
	pgprintk("%s: setting spte %llx\n", __func__, spte);
A
Avi Kivity 已提交
1234
	pgprintk("instantiating %s PTE (%s) at %ld (%llx) addr %p\n",
M
Marcelo Tosatti 已提交
1235 1236
		 (spte&PT_PAGE_SIZE_MASK)? "2MB" : "4kB",
		 (spte&PT_WRITABLE_MASK)?"RW":"R", gfn, spte, shadow_pte);
1237
	set_shadow_pte(shadow_pte, spte);
M
Marcelo Tosatti 已提交
1238 1239 1240 1241
	if (!was_rmapped && (spte & PT_PAGE_SIZE_MASK)
	    && (spte & PT_PRESENT_MASK))
		++vcpu->kvm->stat.lpages;

1242 1243
	page_header_update_slot(vcpu->kvm, shadow_pte, gfn);
	if (!was_rmapped) {
M
Marcelo Tosatti 已提交
1244
		rmap_add(vcpu, shadow_pte, gfn, largepage);
1245
		if (!is_rmap_pte(*shadow_pte))
1246
			kvm_release_pfn_clean(pfn);
1247 1248
	} else {
		if (was_writeble)
1249
			kvm_release_pfn_dirty(pfn);
1250
		else
1251
			kvm_release_pfn_clean(pfn);
1252
	}
1253
	if (speculative) {
1254
		vcpu->arch.last_pte_updated = shadow_pte;
1255 1256
		vcpu->arch.last_pte_gfn = gfn;
	}
1257 1258
}

A
Avi Kivity 已提交
1259 1260 1261 1262
static void nonpaging_new_cr3(struct kvm_vcpu *vcpu)
{
}

1263 1264 1265 1266 1267 1268 1269
struct direct_shadow_walk {
	struct kvm_shadow_walk walker;
	pfn_t pfn;
	int write;
	int largepage;
	int pt_write;
};
A
Avi Kivity 已提交
1270

1271 1272 1273 1274 1275 1276 1277 1278 1279 1280 1281 1282 1283 1284 1285
static int direct_map_entry(struct kvm_shadow_walk *_walk,
			    struct kvm_vcpu *vcpu,
			    gva_t addr, u64 *sptep, int level)
{
	struct direct_shadow_walk *walk =
		container_of(_walk, struct direct_shadow_walk, walker);
	struct kvm_mmu_page *sp;
	gfn_t pseudo_gfn;
	gfn_t gfn = addr >> PAGE_SHIFT;

	if (level == PT_PAGE_TABLE_LEVEL
	    || (walk->largepage && level == PT_DIRECTORY_LEVEL)) {
		mmu_set_spte(vcpu, sptep, ACC_ALL, ACC_ALL,
			     0, walk->write, 1, &walk->pt_write,
			     walk->largepage, gfn, walk->pfn, false);
1286
		++vcpu->stat.pf_fixed;
1287 1288
		return 1;
	}
A
Avi Kivity 已提交
1289

1290 1291 1292 1293 1294 1295 1296 1297
	if (*sptep == shadow_trap_nonpresent_pte) {
		pseudo_gfn = (addr & PT64_DIR_BASE_ADDR_MASK) >> PAGE_SHIFT;
		sp = kvm_mmu_get_page(vcpu, pseudo_gfn, addr, level - 1,
				      1, ACC_ALL, sptep);
		if (!sp) {
			pgprintk("nonpaging_map: ENOMEM\n");
			kvm_release_pfn_clean(walk->pfn);
			return -ENOMEM;
A
Avi Kivity 已提交
1298 1299
		}

1300 1301 1302 1303
		set_shadow_pte(sptep,
			       __pa(sp->spt)
			       | PT_PRESENT_MASK | PT_WRITABLE_MASK
			       | shadow_user_mask | shadow_x_mask);
A
Avi Kivity 已提交
1304
	}
1305 1306 1307 1308 1309 1310 1311 1312 1313 1314 1315 1316 1317 1318 1319 1320 1321 1322 1323
	return 0;
}

static int __direct_map(struct kvm_vcpu *vcpu, gpa_t v, int write,
			int largepage, gfn_t gfn, pfn_t pfn)
{
	int r;
	struct direct_shadow_walk walker = {
		.walker = { .entry = direct_map_entry, },
		.pfn = pfn,
		.largepage = largepage,
		.write = write,
		.pt_write = 0,
	};

	r = walk_shadow(&walker.walker, vcpu, (gva_t)gfn << PAGE_SHIFT);
	if (r < 0)
		return r;
	return walker.pt_write;
A
Avi Kivity 已提交
1324 1325
}

1326 1327 1328
static int nonpaging_map(struct kvm_vcpu *vcpu, gva_t v, int write, gfn_t gfn)
{
	int r;
M
Marcelo Tosatti 已提交
1329
	int largepage = 0;
1330
	pfn_t pfn;
1331
	unsigned long mmu_seq;
1332 1333

	down_read(&current->mm->mmap_sem);
M
Marcelo Tosatti 已提交
1334 1335 1336 1337 1338
	if (is_largepage_backed(vcpu, gfn & ~(KVM_PAGES_PER_HPAGE-1))) {
		gfn &= ~(KVM_PAGES_PER_HPAGE-1);
		largepage = 1;
	}

1339 1340
	mmu_seq = vcpu->kvm->mmu_notifier_seq;
	/* implicit mb(), we'll read before PT lock is unlocked */
1341
	pfn = gfn_to_pfn(vcpu->kvm, gfn);
1342
	up_read(&current->mm->mmap_sem);
1343

1344
	/* mmio */
1345 1346
	if (is_error_pfn(pfn)) {
		kvm_release_pfn_clean(pfn);
1347 1348 1349
		return 1;
	}

1350
	spin_lock(&vcpu->kvm->mmu_lock);
1351 1352
	if (mmu_notifier_retry(vcpu, mmu_seq))
		goto out_unlock;
1353
	kvm_mmu_free_some_pages(vcpu);
1354
	r = __direct_map(vcpu, v, write, largepage, gfn, pfn);
1355 1356 1357
	spin_unlock(&vcpu->kvm->mmu_lock);


1358
	return r;
1359 1360 1361 1362 1363

out_unlock:
	spin_unlock(&vcpu->kvm->mmu_lock);
	kvm_release_pfn_clean(pfn);
	return 0;
1364 1365 1366
}


1367 1368 1369
static void mmu_free_roots(struct kvm_vcpu *vcpu)
{
	int i;
1370
	struct kvm_mmu_page *sp;
1371

1372
	if (!VALID_PAGE(vcpu->arch.mmu.root_hpa))
A
Avi Kivity 已提交
1373
		return;
1374
	spin_lock(&vcpu->kvm->mmu_lock);
1375 1376
	if (vcpu->arch.mmu.shadow_root_level == PT64_ROOT_LEVEL) {
		hpa_t root = vcpu->arch.mmu.root_hpa;
1377

1378 1379
		sp = page_header(root);
		--sp->root_count;
1380 1381
		if (!sp->root_count && sp->role.invalid)
			kvm_mmu_zap_page(vcpu->kvm, sp);
1382
		vcpu->arch.mmu.root_hpa = INVALID_PAGE;
1383
		spin_unlock(&vcpu->kvm->mmu_lock);
1384 1385 1386
		return;
	}
	for (i = 0; i < 4; ++i) {
1387
		hpa_t root = vcpu->arch.mmu.pae_root[i];
1388

A
Avi Kivity 已提交
1389 1390
		if (root) {
			root &= PT64_BASE_ADDR_MASK;
1391 1392
			sp = page_header(root);
			--sp->root_count;
1393 1394
			if (!sp->root_count && sp->role.invalid)
				kvm_mmu_zap_page(vcpu->kvm, sp);
A
Avi Kivity 已提交
1395
		}
1396
		vcpu->arch.mmu.pae_root[i] = INVALID_PAGE;
1397
	}
1398
	spin_unlock(&vcpu->kvm->mmu_lock);
1399
	vcpu->arch.mmu.root_hpa = INVALID_PAGE;
1400 1401 1402 1403 1404
}

static void mmu_alloc_roots(struct kvm_vcpu *vcpu)
{
	int i;
1405
	gfn_t root_gfn;
1406
	struct kvm_mmu_page *sp;
1407
	int metaphysical = 0;
1408

1409
	root_gfn = vcpu->arch.cr3 >> PAGE_SHIFT;
1410

1411 1412
	if (vcpu->arch.mmu.shadow_root_level == PT64_ROOT_LEVEL) {
		hpa_t root = vcpu->arch.mmu.root_hpa;
1413 1414

		ASSERT(!VALID_PAGE(root));
1415 1416
		if (tdp_enabled)
			metaphysical = 1;
1417
		sp = kvm_mmu_get_page(vcpu, root_gfn, 0,
1418 1419
				      PT64_ROOT_LEVEL, metaphysical,
				      ACC_ALL, NULL);
1420 1421
		root = __pa(sp->spt);
		++sp->root_count;
1422
		vcpu->arch.mmu.root_hpa = root;
1423 1424
		return;
	}
1425 1426 1427
	metaphysical = !is_paging(vcpu);
	if (tdp_enabled)
		metaphysical = 1;
1428
	for (i = 0; i < 4; ++i) {
1429
		hpa_t root = vcpu->arch.mmu.pae_root[i];
1430 1431

		ASSERT(!VALID_PAGE(root));
1432 1433 1434
		if (vcpu->arch.mmu.root_level == PT32E_ROOT_LEVEL) {
			if (!is_present_pte(vcpu->arch.pdptrs[i])) {
				vcpu->arch.mmu.pae_root[i] = 0;
A
Avi Kivity 已提交
1435 1436
				continue;
			}
1437 1438
			root_gfn = vcpu->arch.pdptrs[i] >> PAGE_SHIFT;
		} else if (vcpu->arch.mmu.root_level == 0)
1439
			root_gfn = 0;
1440
		sp = kvm_mmu_get_page(vcpu, root_gfn, i << 30,
1441
				      PT32_ROOT_LEVEL, metaphysical,
1442
				      ACC_ALL, NULL);
1443 1444
		root = __pa(sp->spt);
		++sp->root_count;
1445
		vcpu->arch.mmu.pae_root[i] = root | PT_PRESENT_MASK;
1446
	}
1447
	vcpu->arch.mmu.root_hpa = __pa(vcpu->arch.mmu.pae_root);
1448 1449
}

A
Avi Kivity 已提交
1450 1451 1452 1453 1454 1455
static gpa_t nonpaging_gva_to_gpa(struct kvm_vcpu *vcpu, gva_t vaddr)
{
	return vaddr;
}

static int nonpaging_page_fault(struct kvm_vcpu *vcpu, gva_t gva,
A
Avi Kivity 已提交
1456
				u32 error_code)
A
Avi Kivity 已提交
1457
{
1458
	gfn_t gfn;
1459
	int r;
A
Avi Kivity 已提交
1460

1461
	pgprintk("%s: gva %lx error %x\n", __func__, gva, error_code);
1462 1463 1464
	r = mmu_topup_memory_caches(vcpu);
	if (r)
		return r;
1465

A
Avi Kivity 已提交
1466
	ASSERT(vcpu);
1467
	ASSERT(VALID_PAGE(vcpu->arch.mmu.root_hpa));
A
Avi Kivity 已提交
1468

1469
	gfn = gva >> PAGE_SHIFT;
A
Avi Kivity 已提交
1470

1471 1472
	return nonpaging_map(vcpu, gva & PAGE_MASK,
			     error_code & PFERR_WRITE_MASK, gfn);
A
Avi Kivity 已提交
1473 1474
}

1475 1476 1477
static int tdp_page_fault(struct kvm_vcpu *vcpu, gva_t gpa,
				u32 error_code)
{
1478
	pfn_t pfn;
1479
	int r;
M
Marcelo Tosatti 已提交
1480 1481
	int largepage = 0;
	gfn_t gfn = gpa >> PAGE_SHIFT;
1482
	unsigned long mmu_seq;
1483 1484 1485 1486 1487 1488 1489 1490 1491

	ASSERT(vcpu);
	ASSERT(VALID_PAGE(vcpu->arch.mmu.root_hpa));

	r = mmu_topup_memory_caches(vcpu);
	if (r)
		return r;

	down_read(&current->mm->mmap_sem);
M
Marcelo Tosatti 已提交
1492 1493 1494 1495
	if (is_largepage_backed(vcpu, gfn & ~(KVM_PAGES_PER_HPAGE-1))) {
		gfn &= ~(KVM_PAGES_PER_HPAGE-1);
		largepage = 1;
	}
1496 1497
	mmu_seq = vcpu->kvm->mmu_notifier_seq;
	/* implicit mb(), we'll read before PT lock is unlocked */
1498
	pfn = gfn_to_pfn(vcpu->kvm, gfn);
1499
	up_read(&current->mm->mmap_sem);
1500 1501
	if (is_error_pfn(pfn)) {
		kvm_release_pfn_clean(pfn);
1502 1503 1504
		return 1;
	}
	spin_lock(&vcpu->kvm->mmu_lock);
1505 1506
	if (mmu_notifier_retry(vcpu, mmu_seq))
		goto out_unlock;
1507 1508
	kvm_mmu_free_some_pages(vcpu);
	r = __direct_map(vcpu, gpa, error_code & PFERR_WRITE_MASK,
1509
			 largepage, gfn, pfn);
1510 1511 1512
	spin_unlock(&vcpu->kvm->mmu_lock);

	return r;
1513 1514 1515 1516 1517

out_unlock:
	spin_unlock(&vcpu->kvm->mmu_lock);
	kvm_release_pfn_clean(pfn);
	return 0;
1518 1519
}

A
Avi Kivity 已提交
1520 1521
static void nonpaging_free(struct kvm_vcpu *vcpu)
{
1522
	mmu_free_roots(vcpu);
A
Avi Kivity 已提交
1523 1524 1525 1526
}

static int nonpaging_init_context(struct kvm_vcpu *vcpu)
{
1527
	struct kvm_mmu *context = &vcpu->arch.mmu;
A
Avi Kivity 已提交
1528 1529 1530 1531 1532

	context->new_cr3 = nonpaging_new_cr3;
	context->page_fault = nonpaging_page_fault;
	context->gva_to_gpa = nonpaging_gva_to_gpa;
	context->free = nonpaging_free;
1533
	context->prefetch_page = nonpaging_prefetch_page;
1534
	context->root_level = 0;
A
Avi Kivity 已提交
1535
	context->shadow_root_level = PT32E_ROOT_LEVEL;
A
Avi Kivity 已提交
1536
	context->root_hpa = INVALID_PAGE;
A
Avi Kivity 已提交
1537 1538 1539
	return 0;
}

1540
void kvm_mmu_flush_tlb(struct kvm_vcpu *vcpu)
A
Avi Kivity 已提交
1541
{
A
Avi Kivity 已提交
1542
	++vcpu->stat.tlb_flush;
1543
	kvm_x86_ops->tlb_flush(vcpu);
A
Avi Kivity 已提交
1544 1545 1546 1547
}

static void paging_new_cr3(struct kvm_vcpu *vcpu)
{
1548
	pgprintk("%s: cr3 %lx\n", __func__, vcpu->arch.cr3);
1549
	mmu_free_roots(vcpu);
A
Avi Kivity 已提交
1550 1551 1552 1553 1554 1555
}

static void inject_page_fault(struct kvm_vcpu *vcpu,
			      u64 addr,
			      u32 err_code)
{
1556
	kvm_inject_page_fault(vcpu, addr, err_code);
A
Avi Kivity 已提交
1557 1558 1559 1560 1561 1562 1563 1564 1565 1566 1567 1568 1569 1570 1571
}

static void paging_free(struct kvm_vcpu *vcpu)
{
	nonpaging_free(vcpu);
}

#define PTTYPE 64
#include "paging_tmpl.h"
#undef PTTYPE

#define PTTYPE 32
#include "paging_tmpl.h"
#undef PTTYPE

1572
static int paging64_init_context_common(struct kvm_vcpu *vcpu, int level)
A
Avi Kivity 已提交
1573
{
1574
	struct kvm_mmu *context = &vcpu->arch.mmu;
A
Avi Kivity 已提交
1575 1576 1577 1578 1579

	ASSERT(is_pae(vcpu));
	context->new_cr3 = paging_new_cr3;
	context->page_fault = paging64_page_fault;
	context->gva_to_gpa = paging64_gva_to_gpa;
1580
	context->prefetch_page = paging64_prefetch_page;
A
Avi Kivity 已提交
1581
	context->free = paging_free;
1582 1583
	context->root_level = level;
	context->shadow_root_level = level;
A
Avi Kivity 已提交
1584
	context->root_hpa = INVALID_PAGE;
A
Avi Kivity 已提交
1585 1586 1587
	return 0;
}

1588 1589 1590 1591 1592
static int paging64_init_context(struct kvm_vcpu *vcpu)
{
	return paging64_init_context_common(vcpu, PT64_ROOT_LEVEL);
}

A
Avi Kivity 已提交
1593 1594
static int paging32_init_context(struct kvm_vcpu *vcpu)
{
1595
	struct kvm_mmu *context = &vcpu->arch.mmu;
A
Avi Kivity 已提交
1596 1597 1598 1599 1600

	context->new_cr3 = paging_new_cr3;
	context->page_fault = paging32_page_fault;
	context->gva_to_gpa = paging32_gva_to_gpa;
	context->free = paging_free;
1601
	context->prefetch_page = paging32_prefetch_page;
A
Avi Kivity 已提交
1602 1603
	context->root_level = PT32_ROOT_LEVEL;
	context->shadow_root_level = PT32E_ROOT_LEVEL;
A
Avi Kivity 已提交
1604
	context->root_hpa = INVALID_PAGE;
A
Avi Kivity 已提交
1605 1606 1607 1608 1609
	return 0;
}

static int paging32E_init_context(struct kvm_vcpu *vcpu)
{
1610
	return paging64_init_context_common(vcpu, PT32E_ROOT_LEVEL);
A
Avi Kivity 已提交
1611 1612
}

1613 1614 1615 1616 1617 1618 1619 1620
static int init_kvm_tdp_mmu(struct kvm_vcpu *vcpu)
{
	struct kvm_mmu *context = &vcpu->arch.mmu;

	context->new_cr3 = nonpaging_new_cr3;
	context->page_fault = tdp_page_fault;
	context->free = nonpaging_free;
	context->prefetch_page = nonpaging_prefetch_page;
1621
	context->shadow_root_level = kvm_x86_ops->get_tdp_level();
1622 1623 1624 1625 1626 1627 1628 1629 1630 1631 1632 1633 1634 1635 1636 1637 1638 1639 1640 1641
	context->root_hpa = INVALID_PAGE;

	if (!is_paging(vcpu)) {
		context->gva_to_gpa = nonpaging_gva_to_gpa;
		context->root_level = 0;
	} else if (is_long_mode(vcpu)) {
		context->gva_to_gpa = paging64_gva_to_gpa;
		context->root_level = PT64_ROOT_LEVEL;
	} else if (is_pae(vcpu)) {
		context->gva_to_gpa = paging64_gva_to_gpa;
		context->root_level = PT32E_ROOT_LEVEL;
	} else {
		context->gva_to_gpa = paging32_gva_to_gpa;
		context->root_level = PT32_ROOT_LEVEL;
	}

	return 0;
}

static int init_kvm_softmmu(struct kvm_vcpu *vcpu)
A
Avi Kivity 已提交
1642 1643
{
	ASSERT(vcpu);
1644
	ASSERT(!VALID_PAGE(vcpu->arch.mmu.root_hpa));
A
Avi Kivity 已提交
1645 1646 1647

	if (!is_paging(vcpu))
		return nonpaging_init_context(vcpu);
A
Avi Kivity 已提交
1648
	else if (is_long_mode(vcpu))
A
Avi Kivity 已提交
1649 1650 1651 1652 1653 1654 1655
		return paging64_init_context(vcpu);
	else if (is_pae(vcpu))
		return paging32E_init_context(vcpu);
	else
		return paging32_init_context(vcpu);
}

1656 1657
static int init_kvm_mmu(struct kvm_vcpu *vcpu)
{
1658 1659
	vcpu->arch.update_pte.pfn = bad_pfn;

1660 1661 1662 1663 1664 1665
	if (tdp_enabled)
		return init_kvm_tdp_mmu(vcpu);
	else
		return init_kvm_softmmu(vcpu);
}

A
Avi Kivity 已提交
1666 1667 1668
static void destroy_kvm_mmu(struct kvm_vcpu *vcpu)
{
	ASSERT(vcpu);
1669 1670 1671
	if (VALID_PAGE(vcpu->arch.mmu.root_hpa)) {
		vcpu->arch.mmu.free(vcpu);
		vcpu->arch.mmu.root_hpa = INVALID_PAGE;
A
Avi Kivity 已提交
1672 1673 1674 1675
	}
}

int kvm_mmu_reset_context(struct kvm_vcpu *vcpu)
A
Avi Kivity 已提交
1676 1677 1678 1679
{
	destroy_kvm_mmu(vcpu);
	return init_kvm_mmu(vcpu);
}
1680
EXPORT_SYMBOL_GPL(kvm_mmu_reset_context);
A
Avi Kivity 已提交
1681 1682

int kvm_mmu_load(struct kvm_vcpu *vcpu)
A
Avi Kivity 已提交
1683
{
1684 1685
	int r;

1686
	r = mmu_topup_memory_caches(vcpu);
A
Avi Kivity 已提交
1687 1688
	if (r)
		goto out;
1689
	spin_lock(&vcpu->kvm->mmu_lock);
1690
	kvm_mmu_free_some_pages(vcpu);
A
Avi Kivity 已提交
1691
	mmu_alloc_roots(vcpu);
1692
	spin_unlock(&vcpu->kvm->mmu_lock);
1693
	kvm_x86_ops->set_cr3(vcpu, vcpu->arch.mmu.root_hpa);
A
Avi Kivity 已提交
1694
	kvm_mmu_flush_tlb(vcpu);
1695 1696
out:
	return r;
A
Avi Kivity 已提交
1697
}
A
Avi Kivity 已提交
1698 1699 1700 1701 1702 1703
EXPORT_SYMBOL_GPL(kvm_mmu_load);

void kvm_mmu_unload(struct kvm_vcpu *vcpu)
{
	mmu_free_roots(vcpu);
}
A
Avi Kivity 已提交
1704

1705
static void mmu_pte_write_zap_pte(struct kvm_vcpu *vcpu,
1706
				  struct kvm_mmu_page *sp,
1707 1708 1709 1710 1711 1712
				  u64 *spte)
{
	u64 pte;
	struct kvm_mmu_page *child;

	pte = *spte;
1713
	if (is_shadow_present_pte(pte)) {
M
Marcelo Tosatti 已提交
1714 1715
		if (sp->role.level == PT_PAGE_TABLE_LEVEL ||
		    is_large_pte(pte))
1716
			rmap_remove(vcpu->kvm, spte);
1717 1718
		else {
			child = page_header(pte & PT64_BASE_ADDR_MASK);
1719
			mmu_page_remove_parent_pte(child, spte);
1720 1721
		}
	}
1722
	set_shadow_pte(spte, shadow_trap_nonpresent_pte);
M
Marcelo Tosatti 已提交
1723 1724
	if (is_large_pte(pte))
		--vcpu->kvm->stat.lpages;
1725 1726
}

1727
static void mmu_pte_write_new_pte(struct kvm_vcpu *vcpu,
1728
				  struct kvm_mmu_page *sp,
1729
				  u64 *spte,
1730
				  const void *new)
1731
{
1732 1733 1734 1735 1736 1737 1738
	if (sp->role.level != PT_PAGE_TABLE_LEVEL) {
		if (!vcpu->arch.update_pte.largepage ||
		    sp->role.glevels == PT32_ROOT_LEVEL) {
			++vcpu->kvm->stat.mmu_pde_zapped;
			return;
		}
        }
1739

A
Avi Kivity 已提交
1740
	++vcpu->kvm->stat.mmu_pte_updated;
1741
	if (sp->role.glevels == PT32_ROOT_LEVEL)
1742
		paging32_update_pte(vcpu, sp, spte, new);
1743
	else
1744
		paging64_update_pte(vcpu, sp, spte, new);
1745 1746
}

1747 1748 1749 1750 1751 1752 1753 1754 1755 1756 1757 1758 1759 1760 1761 1762 1763 1764 1765 1766 1767
static bool need_remote_flush(u64 old, u64 new)
{
	if (!is_shadow_present_pte(old))
		return false;
	if (!is_shadow_present_pte(new))
		return true;
	if ((old ^ new) & PT64_BASE_ADDR_MASK)
		return true;
	old ^= PT64_NX_MASK;
	new ^= PT64_NX_MASK;
	return (old & ~new & PT64_PERM_MASK) != 0;
}

static void mmu_pte_write_flush_tlb(struct kvm_vcpu *vcpu, u64 old, u64 new)
{
	if (need_remote_flush(old, new))
		kvm_flush_remote_tlbs(vcpu->kvm);
	else
		kvm_mmu_flush_tlb(vcpu);
}

1768 1769
static bool last_updated_pte_accessed(struct kvm_vcpu *vcpu)
{
1770
	u64 *spte = vcpu->arch.last_pte_updated;
1771

S
Sheng Yang 已提交
1772
	return !!(spte && (*spte & shadow_accessed_mask));
1773 1774
}

1775 1776 1777 1778 1779 1780
static void mmu_guess_page_from_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
					  const u8 *new, int bytes)
{
	gfn_t gfn;
	int r;
	u64 gpte = 0;
1781
	pfn_t pfn;
1782

M
Marcelo Tosatti 已提交
1783 1784
	vcpu->arch.update_pte.largepage = 0;

1785 1786 1787 1788 1789 1790 1791 1792 1793 1794 1795 1796 1797 1798 1799 1800 1801 1802 1803 1804 1805 1806 1807 1808 1809 1810
	if (bytes != 4 && bytes != 8)
		return;

	/*
	 * Assume that the pte write on a page table of the same type
	 * as the current vcpu paging mode.  This is nearly always true
	 * (might be false while changing modes).  Note it is verified later
	 * by update_pte().
	 */
	if (is_pae(vcpu)) {
		/* Handle a 32-bit guest writing two halves of a 64-bit gpte */
		if ((bytes == 4) && (gpa % 4 == 0)) {
			r = kvm_read_guest(vcpu->kvm, gpa & ~(u64)7, &gpte, 8);
			if (r)
				return;
			memcpy((void *)&gpte + (gpa % 8), new, 4);
		} else if ((bytes == 8) && (gpa % 8 == 0)) {
			memcpy((void *)&gpte, new, 8);
		}
	} else {
		if ((bytes == 4) && (gpa % 4 == 0))
			memcpy((void *)&gpte, new, 4);
	}
	if (!is_present_pte(gpte))
		return;
	gfn = (gpte & PT64_BASE_ADDR_MASK) >> PAGE_SHIFT;
1811

M
Marcelo Tosatti 已提交
1812 1813 1814 1815 1816
	down_read(&current->mm->mmap_sem);
	if (is_large_pte(gpte) && is_largepage_backed(vcpu, gfn)) {
		gfn &= ~(KVM_PAGES_PER_HPAGE-1);
		vcpu->arch.update_pte.largepage = 1;
	}
1817 1818
	vcpu->arch.update_pte.mmu_seq = vcpu->kvm->mmu_notifier_seq;
	/* implicit mb(), we'll read before PT lock is unlocked */
1819
	pfn = gfn_to_pfn(vcpu->kvm, gfn);
M
Marcelo Tosatti 已提交
1820
	up_read(&current->mm->mmap_sem);
1821

1822 1823
	if (is_error_pfn(pfn)) {
		kvm_release_pfn_clean(pfn);
1824 1825
		return;
	}
1826
	vcpu->arch.update_pte.gfn = gfn;
1827
	vcpu->arch.update_pte.pfn = pfn;
1828 1829
}

1830 1831 1832 1833 1834 1835 1836 1837 1838 1839 1840 1841
static void kvm_mmu_access_page(struct kvm_vcpu *vcpu, gfn_t gfn)
{
	u64 *spte = vcpu->arch.last_pte_updated;

	if (spte
	    && vcpu->arch.last_pte_gfn == gfn
	    && shadow_accessed_mask
	    && !(*spte & shadow_accessed_mask)
	    && is_shadow_present_pte(*spte))
		set_bit(PT_ACCESSED_SHIFT, (unsigned long *)spte);
}

1842
void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
1843
		       const u8 *new, int bytes)
1844
{
1845
	gfn_t gfn = gpa >> PAGE_SHIFT;
1846
	struct kvm_mmu_page *sp;
1847
	struct hlist_node *node, *n;
1848 1849
	struct hlist_head *bucket;
	unsigned index;
1850
	u64 entry, gentry;
1851 1852
	u64 *spte;
	unsigned offset = offset_in_page(gpa);
1853
	unsigned pte_size;
1854
	unsigned page_offset;
1855
	unsigned misaligned;
1856
	unsigned quadrant;
1857
	int level;
1858
	int flooded = 0;
1859
	int npte;
1860
	int r;
1861

1862
	pgprintk("%s: gpa %llx bytes %d\n", __func__, gpa, bytes);
1863
	mmu_guess_page_from_pte_write(vcpu, gpa, new, bytes);
1864
	spin_lock(&vcpu->kvm->mmu_lock);
1865
	kvm_mmu_access_page(vcpu, gfn);
1866
	kvm_mmu_free_some_pages(vcpu);
A
Avi Kivity 已提交
1867
	++vcpu->kvm->stat.mmu_pte_write;
1868
	kvm_mmu_audit(vcpu, "pre pte write");
1869
	if (gfn == vcpu->arch.last_pt_write_gfn
1870
	    && !last_updated_pte_accessed(vcpu)) {
1871 1872
		++vcpu->arch.last_pt_write_count;
		if (vcpu->arch.last_pt_write_count >= 3)
1873 1874
			flooded = 1;
	} else {
1875 1876 1877
		vcpu->arch.last_pt_write_gfn = gfn;
		vcpu->arch.last_pt_write_count = 1;
		vcpu->arch.last_pte_updated = NULL;
1878
	}
1879
	index = kvm_page_table_hashfn(gfn);
1880
	bucket = &vcpu->kvm->arch.mmu_page_hash[index];
1881
	hlist_for_each_entry_safe(sp, node, n, bucket, hash_link) {
A
Avi Kivity 已提交
1882
		if (sp->gfn != gfn || sp->role.metaphysical || sp->role.invalid)
1883
			continue;
1884
		pte_size = sp->role.glevels == PT32_ROOT_LEVEL ? 4 : 8;
1885
		misaligned = (offset ^ (offset + bytes - 1)) & ~(pte_size - 1);
1886
		misaligned |= bytes < 4;
1887
		if (misaligned || flooded) {
1888 1889 1890 1891
			/*
			 * Misaligned accesses are too much trouble to fix
			 * up; also, they usually indicate a page is not used
			 * as a page table.
1892 1893 1894 1895 1896
			 *
			 * If we're seeing too many writes to a page,
			 * it may no longer be a page table, or we may be
			 * forking, in which case it is better to unmap the
			 * page.
1897 1898
			 */
			pgprintk("misaligned: gpa %llx bytes %d role %x\n",
1899 1900
				 gpa, bytes, sp->role.word);
			kvm_mmu_zap_page(vcpu->kvm, sp);
A
Avi Kivity 已提交
1901
			++vcpu->kvm->stat.mmu_flooded;
1902 1903
			continue;
		}
1904
		page_offset = offset;
1905
		level = sp->role.level;
1906
		npte = 1;
1907
		if (sp->role.glevels == PT32_ROOT_LEVEL) {
1908 1909 1910 1911 1912 1913 1914
			page_offset <<= 1;	/* 32->64 */
			/*
			 * A 32-bit pde maps 4MB while the shadow pdes map
			 * only 2MB.  So we need to double the offset again
			 * and zap two pdes instead of one.
			 */
			if (level == PT32_ROOT_LEVEL) {
1915
				page_offset &= ~7; /* kill rounding error */
1916 1917 1918
				page_offset <<= 1;
				npte = 2;
			}
1919
			quadrant = page_offset >> PAGE_SHIFT;
1920
			page_offset &= ~PAGE_MASK;
1921
			if (quadrant != sp->role.quadrant)
1922
				continue;
1923
		}
1924
		spte = &sp->spt[page_offset / sizeof(*spte)];
1925 1926 1927 1928 1929 1930 1931 1932 1933
		if ((gpa & (pte_size - 1)) || (bytes < pte_size)) {
			gentry = 0;
			r = kvm_read_guest_atomic(vcpu->kvm,
						  gpa & ~(u64)(pte_size - 1),
						  &gentry, pte_size);
			new = (const void *)&gentry;
			if (r < 0)
				new = NULL;
		}
1934
		while (npte--) {
1935
			entry = *spte;
1936
			mmu_pte_write_zap_pte(vcpu, sp, spte);
1937 1938
			if (new)
				mmu_pte_write_new_pte(vcpu, sp, spte, new);
1939
			mmu_pte_write_flush_tlb(vcpu, entry, *spte);
1940
			++spte;
1941 1942
		}
	}
1943
	kvm_mmu_audit(vcpu, "post pte write");
1944
	spin_unlock(&vcpu->kvm->mmu_lock);
1945 1946 1947
	if (!is_error_pfn(vcpu->arch.update_pte.pfn)) {
		kvm_release_pfn_clean(vcpu->arch.update_pte.pfn);
		vcpu->arch.update_pte.pfn = bad_pfn;
1948
	}
1949 1950
}

1951 1952
int kvm_mmu_unprotect_page_virt(struct kvm_vcpu *vcpu, gva_t gva)
{
1953 1954
	gpa_t gpa;
	int r;
1955

1956 1957
	gpa = vcpu->arch.mmu.gva_to_gpa(vcpu, gva);

1958
	spin_lock(&vcpu->kvm->mmu_lock);
1959
	r = kvm_mmu_unprotect_page(vcpu->kvm, gpa >> PAGE_SHIFT);
1960
	spin_unlock(&vcpu->kvm->mmu_lock);
1961
	return r;
1962
}
1963
EXPORT_SYMBOL_GPL(kvm_mmu_unprotect_page_virt);
1964

1965
void __kvm_mmu_free_some_pages(struct kvm_vcpu *vcpu)
A
Avi Kivity 已提交
1966
{
1967
	while (vcpu->kvm->arch.n_free_mmu_pages < KVM_REFILL_PAGES) {
1968
		struct kvm_mmu_page *sp;
A
Avi Kivity 已提交
1969

1970
		sp = container_of(vcpu->kvm->arch.active_mmu_pages.prev,
1971 1972
				  struct kvm_mmu_page, link);
		kvm_mmu_zap_page(vcpu->kvm, sp);
A
Avi Kivity 已提交
1973
		++vcpu->kvm->stat.mmu_recycled;
A
Avi Kivity 已提交
1974 1975 1976
	}
}

1977 1978 1979 1980 1981
int kvm_mmu_page_fault(struct kvm_vcpu *vcpu, gva_t cr2, u32 error_code)
{
	int r;
	enum emulation_result er;

1982
	r = vcpu->arch.mmu.page_fault(vcpu, cr2, error_code);
1983 1984 1985 1986 1987 1988 1989 1990
	if (r < 0)
		goto out;

	if (!r) {
		r = 1;
		goto out;
	}

1991 1992 1993 1994
	r = mmu_topup_memory_caches(vcpu);
	if (r)
		goto out;

1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013
	er = emulate_instruction(vcpu, vcpu->run, cr2, error_code, 0);

	switch (er) {
	case EMULATE_DONE:
		return 1;
	case EMULATE_DO_MMIO:
		++vcpu->stat.mmio_exits;
		return 0;
	case EMULATE_FAIL:
		kvm_report_emulation_failure(vcpu, "pagetable");
		return 1;
	default:
		BUG();
	}
out:
	return r;
}
EXPORT_SYMBOL_GPL(kvm_mmu_page_fault);

2014 2015 2016 2017 2018 2019
void kvm_enable_tdp(void)
{
	tdp_enabled = true;
}
EXPORT_SYMBOL_GPL(kvm_enable_tdp);

2020 2021 2022 2023 2024 2025
void kvm_disable_tdp(void)
{
	tdp_enabled = false;
}
EXPORT_SYMBOL_GPL(kvm_disable_tdp);

A
Avi Kivity 已提交
2026 2027
static void free_mmu_pages(struct kvm_vcpu *vcpu)
{
2028
	struct kvm_mmu_page *sp;
A
Avi Kivity 已提交
2029

2030 2031
	while (!list_empty(&vcpu->kvm->arch.active_mmu_pages)) {
		sp = container_of(vcpu->kvm->arch.active_mmu_pages.next,
2032 2033
				  struct kvm_mmu_page, link);
		kvm_mmu_zap_page(vcpu->kvm, sp);
2034
		cond_resched();
2035
	}
2036
	free_page((unsigned long)vcpu->arch.mmu.pae_root);
A
Avi Kivity 已提交
2037 2038 2039 2040
}

static int alloc_mmu_pages(struct kvm_vcpu *vcpu)
{
2041
	struct page *page;
A
Avi Kivity 已提交
2042 2043 2044 2045
	int i;

	ASSERT(vcpu);

2046 2047 2048
	if (vcpu->kvm->arch.n_requested_mmu_pages)
		vcpu->kvm->arch.n_free_mmu_pages =
					vcpu->kvm->arch.n_requested_mmu_pages;
2049
	else
2050 2051
		vcpu->kvm->arch.n_free_mmu_pages =
					vcpu->kvm->arch.n_alloc_mmu_pages;
2052 2053 2054 2055 2056 2057 2058 2059
	/*
	 * When emulating 32-bit mode, cr3 is only 32 bits even on x86_64.
	 * Therefore we need to allocate shadow page tables in the first
	 * 4GB of memory, which happens to fit the DMA32 zone.
	 */
	page = alloc_page(GFP_KERNEL | __GFP_DMA32);
	if (!page)
		goto error_1;
2060
	vcpu->arch.mmu.pae_root = page_address(page);
2061
	for (i = 0; i < 4; ++i)
2062
		vcpu->arch.mmu.pae_root[i] = INVALID_PAGE;
2063

A
Avi Kivity 已提交
2064 2065 2066 2067 2068 2069 2070
	return 0;

error_1:
	free_mmu_pages(vcpu);
	return -ENOMEM;
}

2071
int kvm_mmu_create(struct kvm_vcpu *vcpu)
A
Avi Kivity 已提交
2072 2073
{
	ASSERT(vcpu);
2074
	ASSERT(!VALID_PAGE(vcpu->arch.mmu.root_hpa));
A
Avi Kivity 已提交
2075

2076 2077
	return alloc_mmu_pages(vcpu);
}
A
Avi Kivity 已提交
2078

2079 2080 2081
int kvm_mmu_setup(struct kvm_vcpu *vcpu)
{
	ASSERT(vcpu);
2082
	ASSERT(!VALID_PAGE(vcpu->arch.mmu.root_hpa));
2083

2084
	return init_kvm_mmu(vcpu);
A
Avi Kivity 已提交
2085 2086 2087 2088 2089 2090 2091 2092
}

void kvm_mmu_destroy(struct kvm_vcpu *vcpu)
{
	ASSERT(vcpu);

	destroy_kvm_mmu(vcpu);
	free_mmu_pages(vcpu);
2093
	mmu_free_memory_caches(vcpu);
A
Avi Kivity 已提交
2094 2095
}

2096
void kvm_mmu_slot_remove_write_access(struct kvm *kvm, int slot)
A
Avi Kivity 已提交
2097
{
2098
	struct kvm_mmu_page *sp;
A
Avi Kivity 已提交
2099

2100
	spin_lock(&kvm->mmu_lock);
2101
	list_for_each_entry(sp, &kvm->arch.active_mmu_pages, link) {
A
Avi Kivity 已提交
2102 2103 2104
		int i;
		u64 *pt;

2105
		if (!test_bit(slot, &sp->slot_bitmap))
A
Avi Kivity 已提交
2106 2107
			continue;

2108
		pt = sp->spt;
A
Avi Kivity 已提交
2109 2110
		for (i = 0; i < PT64_ENT_PER_PAGE; ++i)
			/* avoid RMW */
2111
			if (pt[i] & PT_WRITABLE_MASK)
A
Avi Kivity 已提交
2112 2113
				pt[i] &= ~PT_WRITABLE_MASK;
	}
2114
	kvm_flush_remote_tlbs(kvm);
2115
	spin_unlock(&kvm->mmu_lock);
A
Avi Kivity 已提交
2116
}
2117

2118
void kvm_mmu_zap_all(struct kvm *kvm)
D
Dor Laor 已提交
2119
{
2120
	struct kvm_mmu_page *sp, *node;
D
Dor Laor 已提交
2121

2122
	spin_lock(&kvm->mmu_lock);
2123
	list_for_each_entry_safe(sp, node, &kvm->arch.active_mmu_pages, link)
2124
		kvm_mmu_zap_page(kvm, sp);
2125
	spin_unlock(&kvm->mmu_lock);
D
Dor Laor 已提交
2126

2127
	kvm_flush_remote_tlbs(kvm);
D
Dor Laor 已提交
2128 2129
}

2130
static void kvm_mmu_remove_one_alloc_mmu_page(struct kvm *kvm)
2131 2132 2133 2134 2135 2136 2137 2138 2139 2140 2141 2142 2143 2144 2145 2146 2147 2148 2149
{
	struct kvm_mmu_page *page;

	page = container_of(kvm->arch.active_mmu_pages.prev,
			    struct kvm_mmu_page, link);
	kvm_mmu_zap_page(kvm, page);
}

static int mmu_shrink(int nr_to_scan, gfp_t gfp_mask)
{
	struct kvm *kvm;
	struct kvm *kvm_freed = NULL;
	int cache_count = 0;

	spin_lock(&kvm_lock);

	list_for_each_entry(kvm, &vm_list, vm_list) {
		int npages;

2150 2151
		if (!down_read_trylock(&kvm->slots_lock))
			continue;
2152 2153 2154 2155 2156 2157 2158 2159 2160 2161 2162 2163
		spin_lock(&kvm->mmu_lock);
		npages = kvm->arch.n_alloc_mmu_pages -
			 kvm->arch.n_free_mmu_pages;
		cache_count += npages;
		if (!kvm_freed && nr_to_scan > 0 && npages > 0) {
			kvm_mmu_remove_one_alloc_mmu_page(kvm);
			cache_count--;
			kvm_freed = kvm;
		}
		nr_to_scan--;

		spin_unlock(&kvm->mmu_lock);
2164
		up_read(&kvm->slots_lock);
2165 2166 2167 2168 2169 2170 2171 2172 2173 2174 2175 2176 2177 2178
	}
	if (kvm_freed)
		list_move_tail(&kvm_freed->vm_list, &vm_list);

	spin_unlock(&kvm_lock);

	return cache_count;
}

static struct shrinker mmu_shrinker = {
	.shrink = mmu_shrink,
	.seeks = DEFAULT_SEEKS * 10,
};

I
Ingo Molnar 已提交
2179
static void mmu_destroy_caches(void)
2180 2181 2182 2183 2184
{
	if (pte_chain_cache)
		kmem_cache_destroy(pte_chain_cache);
	if (rmap_desc_cache)
		kmem_cache_destroy(rmap_desc_cache);
2185 2186
	if (mmu_page_header_cache)
		kmem_cache_destroy(mmu_page_header_cache);
2187 2188
}

2189 2190 2191 2192 2193 2194
void kvm_mmu_module_exit(void)
{
	mmu_destroy_caches();
	unregister_shrinker(&mmu_shrinker);
}

2195 2196 2197 2198
int kvm_mmu_module_init(void)
{
	pte_chain_cache = kmem_cache_create("kvm_pte_chain",
					    sizeof(struct kvm_pte_chain),
2199
					    0, 0, NULL);
2200 2201 2202 2203
	if (!pte_chain_cache)
		goto nomem;
	rmap_desc_cache = kmem_cache_create("kvm_rmap_desc",
					    sizeof(struct kvm_rmap_desc),
2204
					    0, 0, NULL);
2205 2206 2207
	if (!rmap_desc_cache)
		goto nomem;

2208 2209
	mmu_page_header_cache = kmem_cache_create("kvm_mmu_page_header",
						  sizeof(struct kvm_mmu_page),
2210
						  0, 0, NULL);
2211 2212 2213
	if (!mmu_page_header_cache)
		goto nomem;

2214 2215
	register_shrinker(&mmu_shrinker);

2216 2217 2218
	return 0;

nomem:
2219
	mmu_destroy_caches();
2220 2221 2222
	return -ENOMEM;
}

2223 2224 2225 2226 2227 2228 2229 2230 2231 2232 2233 2234 2235 2236 2237 2238 2239 2240 2241
/*
 * Caculate mmu pages needed for kvm.
 */
unsigned int kvm_mmu_calculate_mmu_pages(struct kvm *kvm)
{
	int i;
	unsigned int nr_mmu_pages;
	unsigned int  nr_pages = 0;

	for (i = 0; i < kvm->nmemslots; i++)
		nr_pages += kvm->memslots[i].npages;

	nr_mmu_pages = nr_pages * KVM_PERMILLE_MMU_PAGES / 1000;
	nr_mmu_pages = max(nr_mmu_pages,
			(unsigned int) KVM_MIN_ALLOC_MMU_PAGES);

	return nr_mmu_pages;
}

2242 2243 2244 2245 2246 2247 2248 2249 2250 2251 2252 2253 2254 2255 2256 2257 2258 2259 2260 2261 2262 2263 2264 2265 2266 2267 2268 2269 2270 2271 2272 2273 2274 2275 2276
static void *pv_mmu_peek_buffer(struct kvm_pv_mmu_op_buffer *buffer,
				unsigned len)
{
	if (len > buffer->len)
		return NULL;
	return buffer->ptr;
}

static void *pv_mmu_read_buffer(struct kvm_pv_mmu_op_buffer *buffer,
				unsigned len)
{
	void *ret;

	ret = pv_mmu_peek_buffer(buffer, len);
	if (!ret)
		return ret;
	buffer->ptr += len;
	buffer->len -= len;
	buffer->processed += len;
	return ret;
}

static int kvm_pv_mmu_write(struct kvm_vcpu *vcpu,
			     gpa_t addr, gpa_t value)
{
	int bytes = 8;
	int r;

	if (!is_long_mode(vcpu) && !is_pae(vcpu))
		bytes = 4;

	r = mmu_topup_memory_caches(vcpu);
	if (r)
		return r;

2277
	if (!emulator_write_phys(vcpu, addr, &value, bytes))
2278 2279 2280 2281 2282 2283 2284 2285 2286 2287 2288 2289 2290 2291 2292 2293 2294 2295 2296 2297 2298 2299 2300 2301 2302 2303 2304 2305 2306 2307 2308 2309 2310 2311 2312 2313 2314 2315 2316 2317 2318 2319 2320 2321 2322 2323 2324 2325 2326 2327 2328 2329 2330 2331 2332 2333 2334 2335 2336 2337 2338
		return -EFAULT;

	return 1;
}

static int kvm_pv_mmu_flush_tlb(struct kvm_vcpu *vcpu)
{
	kvm_x86_ops->tlb_flush(vcpu);
	return 1;
}

static int kvm_pv_mmu_release_pt(struct kvm_vcpu *vcpu, gpa_t addr)
{
	spin_lock(&vcpu->kvm->mmu_lock);
	mmu_unshadow(vcpu->kvm, addr >> PAGE_SHIFT);
	spin_unlock(&vcpu->kvm->mmu_lock);
	return 1;
}

static int kvm_pv_mmu_op_one(struct kvm_vcpu *vcpu,
			     struct kvm_pv_mmu_op_buffer *buffer)
{
	struct kvm_mmu_op_header *header;

	header = pv_mmu_peek_buffer(buffer, sizeof *header);
	if (!header)
		return 0;
	switch (header->op) {
	case KVM_MMU_OP_WRITE_PTE: {
		struct kvm_mmu_op_write_pte *wpte;

		wpte = pv_mmu_read_buffer(buffer, sizeof *wpte);
		if (!wpte)
			return 0;
		return kvm_pv_mmu_write(vcpu, wpte->pte_phys,
					wpte->pte_val);
	}
	case KVM_MMU_OP_FLUSH_TLB: {
		struct kvm_mmu_op_flush_tlb *ftlb;

		ftlb = pv_mmu_read_buffer(buffer, sizeof *ftlb);
		if (!ftlb)
			return 0;
		return kvm_pv_mmu_flush_tlb(vcpu);
	}
	case KVM_MMU_OP_RELEASE_PT: {
		struct kvm_mmu_op_release_pt *rpt;

		rpt = pv_mmu_read_buffer(buffer, sizeof *rpt);
		if (!rpt)
			return 0;
		return kvm_pv_mmu_release_pt(vcpu, rpt->pt_phys);
	}
	default: return 0;
	}
}

int kvm_pv_mmu_op(struct kvm_vcpu *vcpu, unsigned long bytes,
		  gpa_t addr, unsigned long *ret)
{
	int r;
2339
	struct kvm_pv_mmu_op_buffer *buffer = &vcpu->arch.mmu_op_buffer;
2340

2341 2342 2343
	buffer->ptr = buffer->buf;
	buffer->len = min_t(unsigned long, bytes, sizeof buffer->buf);
	buffer->processed = 0;
2344

2345
	r = kvm_read_guest(vcpu->kvm, addr, buffer->buf, buffer->len);
2346 2347 2348
	if (r)
		goto out;

2349 2350
	while (buffer->len) {
		r = kvm_pv_mmu_op_one(vcpu, buffer);
2351 2352 2353 2354 2355 2356 2357 2358
		if (r < 0)
			goto out;
		if (r == 0)
			break;
	}

	r = 1;
out:
2359
	*ret = buffer->processed;
2360 2361 2362
	return r;
}

2363 2364 2365 2366 2367 2368 2369 2370 2371 2372 2373 2374 2375 2376 2377 2378 2379 2380 2381 2382 2383 2384
#ifdef AUDIT

static const char *audit_msg;

static gva_t canonicalize(gva_t gva)
{
#ifdef CONFIG_X86_64
	gva = (long long)(gva << 16) >> 16;
#endif
	return gva;
}

static void audit_mappings_page(struct kvm_vcpu *vcpu, u64 page_pte,
				gva_t va, int level)
{
	u64 *pt = __va(page_pte & PT64_BASE_ADDR_MASK);
	int i;
	gva_t va_delta = 1ul << (PAGE_SHIFT + 9 * (level - 1));

	for (i = 0; i < PT64_ENT_PER_PAGE; ++i, va += va_delta) {
		u64 ent = pt[i];

2385
		if (ent == shadow_trap_nonpresent_pte)
2386 2387 2388
			continue;

		va = canonicalize(va);
2389 2390 2391 2392 2393
		if (level > 1) {
			if (ent == shadow_notrap_nonpresent_pte)
				printk(KERN_ERR "audit: (%s) nontrapping pte"
				       " in nonleaf level: levels %d gva %lx"
				       " level %d pte %llx\n", audit_msg,
2394
				       vcpu->arch.mmu.root_level, va, level, ent);
2395

2396
			audit_mappings_page(vcpu, ent, va, level - 1);
2397
		} else {
2398
			gpa_t gpa = vcpu->arch.mmu.gva_to_gpa(vcpu, va);
2399
			hpa_t hpa = (hpa_t)gpa_to_pfn(vcpu, gpa) << PAGE_SHIFT;
2400

2401
			if (is_shadow_present_pte(ent)
2402
			    && (ent & PT64_BASE_ADDR_MASK) != hpa)
2403 2404
				printk(KERN_ERR "xx audit error: (%s) levels %d"
				       " gva %lx gpa %llx hpa %llx ent %llx %d\n",
2405
				       audit_msg, vcpu->arch.mmu.root_level,
M
Mike Day 已提交
2406 2407
				       va, gpa, hpa, ent,
				       is_shadow_present_pte(ent));
2408 2409 2410 2411
			else if (ent == shadow_notrap_nonpresent_pte
				 && !is_error_hpa(hpa))
				printk(KERN_ERR "audit: (%s) notrap shadow,"
				       " valid guest gva %lx\n", audit_msg, va);
2412
			kvm_release_pfn_clean(pfn);
2413

2414 2415 2416 2417 2418 2419
		}
	}
}

static void audit_mappings(struct kvm_vcpu *vcpu)
{
2420
	unsigned i;
2421

2422 2423
	if (vcpu->arch.mmu.root_level == 4)
		audit_mappings_page(vcpu, vcpu->arch.mmu.root_hpa, 0, 4);
2424 2425
	else
		for (i = 0; i < 4; ++i)
2426
			if (vcpu->arch.mmu.pae_root[i] & PT_PRESENT_MASK)
2427
				audit_mappings_page(vcpu,
2428
						    vcpu->arch.mmu.pae_root[i],
2429 2430 2431 2432 2433 2434 2435 2436 2437 2438 2439 2440 2441 2442
						    i << 30,
						    2);
}

static int count_rmaps(struct kvm_vcpu *vcpu)
{
	int nmaps = 0;
	int i, j, k;

	for (i = 0; i < KVM_MEMORY_SLOTS; ++i) {
		struct kvm_memory_slot *m = &vcpu->kvm->memslots[i];
		struct kvm_rmap_desc *d;

		for (j = 0; j < m->npages; ++j) {
2443
			unsigned long *rmapp = &m->rmap[j];
2444

2445
			if (!*rmapp)
2446
				continue;
2447
			if (!(*rmapp & 1)) {
2448 2449 2450
				++nmaps;
				continue;
			}
2451
			d = (struct kvm_rmap_desc *)(*rmapp & ~1ul);
2452 2453 2454 2455 2456 2457 2458 2459 2460 2461 2462 2463 2464 2465 2466 2467
			while (d) {
				for (k = 0; k < RMAP_EXT; ++k)
					if (d->shadow_ptes[k])
						++nmaps;
					else
						break;
				d = d->more;
			}
		}
	}
	return nmaps;
}

static int count_writable_mappings(struct kvm_vcpu *vcpu)
{
	int nmaps = 0;
2468
	struct kvm_mmu_page *sp;
2469 2470
	int i;

2471
	list_for_each_entry(sp, &vcpu->kvm->arch.active_mmu_pages, link) {
2472
		u64 *pt = sp->spt;
2473

2474
		if (sp->role.level != PT_PAGE_TABLE_LEVEL)
2475 2476 2477 2478 2479 2480 2481 2482 2483 2484 2485 2486 2487 2488 2489 2490 2491 2492 2493 2494 2495 2496
			continue;

		for (i = 0; i < PT64_ENT_PER_PAGE; ++i) {
			u64 ent = pt[i];

			if (!(ent & PT_PRESENT_MASK))
				continue;
			if (!(ent & PT_WRITABLE_MASK))
				continue;
			++nmaps;
		}
	}
	return nmaps;
}

static void audit_rmap(struct kvm_vcpu *vcpu)
{
	int n_rmap = count_rmaps(vcpu);
	int n_actual = count_writable_mappings(vcpu);

	if (n_rmap != n_actual)
		printk(KERN_ERR "%s: (%s) rmap %d actual %d\n",
2497
		       __func__, audit_msg, n_rmap, n_actual);
2498 2499 2500 2501
}

static void audit_write_protection(struct kvm_vcpu *vcpu)
{
2502
	struct kvm_mmu_page *sp;
2503 2504 2505
	struct kvm_memory_slot *slot;
	unsigned long *rmapp;
	gfn_t gfn;
2506

2507
	list_for_each_entry(sp, &vcpu->kvm->arch.active_mmu_pages, link) {
2508
		if (sp->role.metaphysical)
2509 2510
			continue;

2511 2512
		slot = gfn_to_memslot(vcpu->kvm, sp->gfn);
		gfn = unalias_gfn(vcpu->kvm, sp->gfn);
2513 2514
		rmapp = &slot->rmap[gfn - slot->base_gfn];
		if (*rmapp)
2515 2516
			printk(KERN_ERR "%s: (%s) shadow page has writable"
			       " mappings: gfn %lx role %x\n",
2517
			       __func__, audit_msg, sp->gfn,
2518
			       sp->role.word);
2519 2520 2521 2522 2523 2524 2525 2526 2527 2528 2529 2530 2531 2532 2533 2534
	}
}

static void kvm_mmu_audit(struct kvm_vcpu *vcpu, const char *msg)
{
	int olddbg = dbg;

	dbg = 0;
	audit_msg = msg;
	audit_rmap(vcpu);
	audit_write_protection(vcpu);
	audit_mappings(vcpu);
	dbg = olddbg;
}

#endif