1 files changed, 198 insertions, 150 deletions

diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 4cb164268846..be3cea4407ff 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -135,8 +135,6 @@ module_param(dbg, bool, 0644);
 #define PT64_PERM_MASK (PT_PRESENT_MASK | PT_WRITABLE_MASK | PT_USER_MASK \
                         | PT64_NX_MASK)
 
-#define PTE_LIST_EXT 4
-
 #define ACC_EXEC_MASK    1
 #define ACC_WRITE_MASK   PT_WRITABLE_MASK
 #define ACC_USER_MASK    PT_USER_MASK
@@ -151,6 +149,9 @@ module_param(dbg, bool, 0644);
 
 #define SHADOW_PT_INDEX(addr, level) PT64_INDEX(addr, level)
 
+/* make pte_list_desc fit well in cache line */
+#define PTE_LIST_EXT 3
+
 struct pte_list_desc {
         u64 *sptes[PTE_LIST_EXT];
         struct pte_list_desc *more;
@@ -550,19 +551,29 @@ static u64 mmu_spte_get_lockless(u64 *sptep)
 
 static void walk_shadow_page_lockless_begin(struct kvm_vcpu *vcpu)
 {
-        rcu_read_lock();
-        atomic_inc(&vcpu->kvm->arch.reader_counter);
-
-        /* Increase the counter before walking shadow page table */
-        smp_mb__after_atomic_inc();
+        /*
+         * Prevent page table teardown by making any free-er wait during
+         * kvm_flush_remote_tlbs() IPI to all active vcpus.
+         */
+        local_irq_disable();
+        vcpu->mode = READING_SHADOW_PAGE_TABLES;
+        /*
+         * Make sure a following spte read is not reordered ahead of the write
+         * to vcpu->mode.
+         */
+        smp_mb();
 }
 
 static void walk_shadow_page_lockless_end(struct kvm_vcpu *vcpu)
 {
-        /* Decrease the counter after walking shadow page table finished */
-        smp_mb__before_atomic_dec();
-        atomic_dec(&vcpu->kvm->arch.reader_counter);
-        rcu_read_unlock();
+        /*
+         * Make sure the write to vcpu->mode is not reordered in front of
+         * reads to sptes.  If it does, kvm_commit_zap_page() can see us
+         * OUTSIDE_GUEST_MODE and proceed to free the shadow page table.
+         */
+        smp_mb();
+        vcpu->mode = OUTSIDE_GUEST_MODE;
+        local_irq_enable();
 }
 
 static int mmu_topup_memory_cache(struct kvm_mmu_memory_cache *cache,
@@ -841,32 +852,6 @@ static int pte_list_add(struct kvm_vcpu *vcpu, u64 *spte,
         return count;
 }
 
-static u64 *pte_list_next(unsigned long *pte_list, u64 *spte)
-{
-        struct pte_list_desc *desc;
-        u64 *prev_spte;
-        int i;
-
-        if (!*pte_list)
-                return NULL;
-        else if (!(*pte_list & 1)) {
-                if (!spte)
-                        return (u64 *)*pte_list;
-                return NULL;
-        }
-        desc = (struct pte_list_desc *)(*pte_list & ~1ul);
-        prev_spte = NULL;
-        while (desc) {
-                for (i = 0; i < PTE_LIST_EXT && desc->sptes[i]; ++i) {
-                        if (prev_spte == spte)
-                                return desc->sptes[i];
-                        prev_spte = desc->sptes[i];
-                }
-                desc = desc->more;
-        }
-        return NULL;
-}
-
 static void
 pte_list_desc_remove_entry(unsigned long *pte_list, struct pte_list_desc *desc,
                            int i, struct pte_list_desc *prev_desc)
@@ -987,11 +972,6 @@ static int rmap_add(struct kvm_vcpu *vcpu, u64 *spte, gfn_t gfn)
         return pte_list_add(vcpu, spte, rmapp);
 }
 
-static u64 *rmap_next(unsigned long *rmapp, u64 *spte)
-{
-        return pte_list_next(rmapp, spte);
-}
-
 static void rmap_remove(struct kvm *kvm, u64 *spte)
 {
         struct kvm_mmu_page *sp;
@@ -1004,106 +984,201 @@ static void rmap_remove(struct kvm *kvm, u64 *spte)
         pte_list_remove(spte, rmapp);
 }
 
+/*
+ * Used by the following functions to iterate through the sptes linked by a
+ * rmap.  All fields are private and not assumed to be used outside.
+ */
+struct rmap_iterator {
+        /* private fields */
+        struct pte_list_desc *desc;     /* holds the sptep if not NULL */
+        int pos;                        /* index of the sptep */
+};
+
+/*
+ * Iteration must be started by this function.  This should also be used after
+ * removing/dropping sptes from the rmap link because in such cases the
+ * information in the itererator may not be valid.
+ *
+ * Returns sptep if found, NULL otherwise.
+ */
+static u64 *rmap_get_first(unsigned long rmap, struct rmap_iterator *iter)
+{
+        if (!rmap)
+                return NULL;
+
+        if (!(rmap & 1)) {
+                iter->desc = NULL;
+                return (u64 *)rmap;
+        }
+
+        iter->desc = (struct pte_list_desc *)(rmap & ~1ul);
+        iter->pos = 0;
+        return iter->desc->sptes[iter->pos];
+}
+
+/*
+ * Must be used with a valid iterator: e.g. after rmap_get_first().
+ *
+ * Returns sptep if found, NULL otherwise.
+ */
+static u64 *rmap_get_next(struct rmap_iterator *iter)
+{
+        if (iter->desc) {
+                if (iter->pos < PTE_LIST_EXT - 1) {
+                        u64 *sptep;
+
+                        ++iter->pos;
+                        sptep = iter->desc->sptes[iter->pos];
+                        if (sptep)
+                                return sptep;
+                }
+
+                iter->desc = iter->desc->more;
+
+                if (iter->desc) {
+                        iter->pos = 0;
+                        /* desc->sptes[0] cannot be NULL */
+                        return iter->desc->sptes[iter->pos];
+                }
+        }
+
+        return NULL;
+}
+
 static void drop_spte(struct kvm *kvm, u64 *sptep)
 {
         if (mmu_spte_clear_track_bits(sptep))
                 rmap_remove(kvm, sptep);
 }
 
-int kvm_mmu_rmap_write_protect(struct kvm *kvm, u64 gfn,
-                               struct kvm_memory_slot *slot)
+static int __rmap_write_protect(struct kvm *kvm, unsigned long *rmapp, int level)
 {
-        unsigned long *rmapp;
-        u64 *spte;
-        int i, write_protected = 0;
-
-        rmapp = __gfn_to_rmap(gfn, PT_PAGE_TABLE_LEVEL, slot);
-        spte = rmap_next(rmapp, NULL);
-        while (spte) {
-                BUG_ON(!(*spte & PT_PRESENT_MASK));
-                rmap_printk("rmap_write_protect: spte %p %llx\n", spte, *spte);
-                if (is_writable_pte(*spte)) {
-                        mmu_spte_update(spte, *spte & ~PT_WRITABLE_MASK);
-                        write_protected = 1;
+        u64 *sptep;
+        struct rmap_iterator iter;
+        int write_protected = 0;
+
+        for (sptep = rmap_get_first(*rmapp, &iter); sptep;) {
+                BUG_ON(!(*sptep & PT_PRESENT_MASK));
+                rmap_printk("rmap_write_protect: spte %p %llx\n", sptep, *sptep);
+
+                if (!is_writable_pte(*sptep)) {
+                        sptep = rmap_get_next(&iter);
+                        continue;
                 }
-                spte = rmap_next(rmapp, spte);
-        }
 
-        /* check for huge page mappings */
-        for (i = PT_DIRECTORY_LEVEL;
-             i < PT_PAGE_TABLE_LEVEL + KVM_NR_PAGE_SIZES; ++i) {
-                rmapp = __gfn_to_rmap(gfn, i, slot);
-                spte = rmap_next(rmapp, NULL);
-                while (spte) {
-                        BUG_ON(!(*spte & PT_PRESENT_MASK));
-                        BUG_ON(!is_large_pte(*spte));
-                        pgprintk("rmap_write_protect(large): spte %p %llx %lld\n", spte, *spte, gfn);
-                        if (is_writable_pte(*spte)) {
-                                drop_spte(kvm, spte);
-                                --kvm->stat.lpages;
-                                spte = NULL;
-                                write_protected = 1;
-                        }
-                        spte = rmap_next(rmapp, spte);
+                if (level == PT_PAGE_TABLE_LEVEL) {
+                        mmu_spte_update(sptep, *sptep & ~PT_WRITABLE_MASK);
+                        sptep = rmap_get_next(&iter);
+                } else {
+                        BUG_ON(!is_large_pte(*sptep));
+                        drop_spte(kvm, sptep);
+                        --kvm->stat.lpages;
+                        sptep = rmap_get_first(*rmapp, &iter);
                 }
+
+                write_protected = 1;
         }
 
         return write_protected;
 }
 
+/**
+ * kvm_mmu_write_protect_pt_masked - write protect selected PT level pages
+ * @kvm: kvm instance
+ * @slot: slot to protect
+ * @gfn_offset: start of the BITS_PER_LONG pages we care about
+ * @mask: indicates which pages we should protect
+ *
+ * Used when we do not need to care about huge page mappings: e.g. during dirty
+ * logging we do not have any such mappings.
+ */
+void kvm_mmu_write_protect_pt_masked(struct kvm *kvm,
+                                     struct kvm_memory_slot *slot,
+                                     gfn_t gfn_offset, unsigned long mask)
+{
+        unsigned long *rmapp;
+
+        while (mask) {
+                rmapp = &slot->rmap[gfn_offset + __ffs(mask)];
+                __rmap_write_protect(kvm, rmapp, PT_PAGE_TABLE_LEVEL);
+
+                /* clear the first set bit */
+                mask &= mask - 1;
+        }
+}
+
 static int rmap_write_protect(struct kvm *kvm, u64 gfn)
 {
         struct kvm_memory_slot *slot;
+        unsigned long *rmapp;
+        int i;
+        int write_protected = 0;
 
         slot = gfn_to_memslot(kvm, gfn);
-        return kvm_mmu_rmap_write_protect(kvm, gfn, slot);
+
+        for (i = PT_PAGE_TABLE_LEVEL;
+             i < PT_PAGE_TABLE_LEVEL + KVM_NR_PAGE_SIZES; ++i) {
+                rmapp = __gfn_to_rmap(gfn, i, slot);
+                write_protected |= __rmap_write_protect(kvm, rmapp, i);
+        }
+
+        return write_protected;
 }
 
 static int kvm_unmap_rmapp(struct kvm *kvm, unsigned long *rmapp,
                            unsigned long data)
 {
-        u64 *spte;
+        u64 *sptep;
+        struct rmap_iterator iter;
         int need_tlb_flush = 0;
 
-        while ((spte = rmap_next(rmapp, NULL))) {
-                BUG_ON(!(*spte & PT_PRESENT_MASK));
-                rmap_printk("kvm_rmap_unmap_hva: spte %p %llx\n", spte, *spte);
-                drop_spte(kvm, spte);
+        while ((sptep = rmap_get_first(*rmapp, &iter))) {
+                BUG_ON(!(*sptep & PT_PRESENT_MASK));
+                rmap_printk("kvm_rmap_unmap_hva: spte %p %llx\n", sptep, *sptep);
+
+                drop_spte(kvm, sptep);
                 need_tlb_flush = 1;
         }
+
         return need_tlb_flush;
 }
 
 static int kvm_set_pte_rmapp(struct kvm *kvm, unsigned long *rmapp,
                              unsigned long data)
 {
+        u64 *sptep;
+        struct rmap_iterator iter;
         int need_flush = 0;
-        u64 *spte, new_spte;
+        u64 new_spte;
         pte_t *ptep = (pte_t *)data;
         pfn_t new_pfn;
 
         WARN_ON(pte_huge(*ptep));
         new_pfn = pte_pfn(*ptep);
-        spte = rmap_next(rmapp, NULL);
-        while (spte) {
-                BUG_ON(!is_shadow_present_pte(*spte));
-                rmap_printk("kvm_set_pte_rmapp: spte %p %llx\n", spte, *spte);
+
+        for (sptep = rmap_get_first(*rmapp, &iter); sptep;) {
+                BUG_ON(!is_shadow_present_pte(*sptep));
+                rmap_printk("kvm_set_pte_rmapp: spte %p %llx\n", sptep, *sptep);
+
                 need_flush = 1;
+
                 if (pte_write(*ptep)) {
-                        drop_spte(kvm, spte);
-                        spte = rmap_next(rmapp, NULL);
+                        drop_spte(kvm, sptep);
+                        sptep = rmap_get_first(*rmapp, &iter);
                 } else {
-                        new_spte = *spte &~ (PT64_BASE_ADDR_MASK);
+                        new_spte = *sptep & ~PT64_BASE_ADDR_MASK;
                         new_spte |= (u64)new_pfn << PAGE_SHIFT;
 
                         new_spte &= ~PT_WRITABLE_MASK;
                         new_spte &= ~SPTE_HOST_WRITEABLE;
                         new_spte &= ~shadow_accessed_mask;
-                        mmu_spte_clear_track_bits(spte);
-                        mmu_spte_set(spte, new_spte);
-                        spte = rmap_next(rmapp, spte);
+
+                        mmu_spte_clear_track_bits(sptep);
+                        mmu_spte_set(sptep, new_spte);
+                        sptep = rmap_get_next(&iter);
                 }
         }
+
         if (need_flush)
                 kvm_flush_remote_tlbs(kvm);
 
@@ -1162,7 +1237,8 @@ void kvm_set_spte_hva(struct kvm *kvm, unsigned long hva, pte_t pte)
 static int kvm_age_rmapp(struct kvm *kvm, unsigned long *rmapp,
                          unsigned long data)
 {
-        u64 *spte;
+        u64 *sptep;
+        struct rmap_iterator iter;
         int young = 0;
 
         /*
@@ -1175,25 +1251,24 @@ static int kvm_age_rmapp(struct kvm *kvm, unsigned long *rmapp,
         if (!shadow_accessed_mask)
                 return kvm_unmap_rmapp(kvm, rmapp, data);
 
-        spte = rmap_next(rmapp, NULL);
-        while (spte) {
-                int _young;
-                u64 _spte = *spte;
-                BUG_ON(!(_spte & PT_PRESENT_MASK));
-                _young = _spte & PT_ACCESSED_MASK;
-                if (_young) {
+        for (sptep = rmap_get_first(*rmapp, &iter); sptep;
+             sptep = rmap_get_next(&iter)) {
+                BUG_ON(!(*sptep & PT_PRESENT_MASK));
+
+                if (*sptep & PT_ACCESSED_MASK) {
                         young = 1;
-                        clear_bit(PT_ACCESSED_SHIFT, (unsigned long *)spte);
+                        clear_bit(PT_ACCESSED_SHIFT, (unsigned long *)sptep);
                 }
-                spte = rmap_next(rmapp, spte);
         }
+
         return young;
 }
 
 static int kvm_test_age_rmapp(struct kvm *kvm, unsigned long *rmapp,
                               unsigned long data)
 {
-        u64 *spte;
+        u64 *sptep;
+        struct rmap_iterator iter;
         int young = 0;
 
         /*
@@ -1204,16 +1279,14 @@ static int kvm_test_age_rmapp(struct kvm *kvm, unsigned long *rmapp,
         if (!shadow_accessed_mask)
                 goto out;
 
-        spte = rmap_next(rmapp, NULL);
-        while (spte) {
-                u64 _spte = *spte;
-                BUG_ON(!(_spte & PT_PRESENT_MASK));
-                young = _spte & PT_ACCESSED_MASK;
-                if (young) {
+        for (sptep = rmap_get_first(*rmapp, &iter); sptep;
+             sptep = rmap_get_next(&iter)) {
+                BUG_ON(!(*sptep & PT_PRESENT_MASK));
+
+                if (*sptep & PT_ACCESSED_MASK) {
                         young = 1;
                         break;
                 }
-                spte = rmap_next(rmapp, spte);
         }
 out:
         return young;
@@ -1865,10 +1938,11 @@ static void kvm_mmu_put_page(struct kvm_mmu_page *sp, u64 *parent_pte)
 
 static void kvm_mmu_unlink_parents(struct kvm *kvm, struct kvm_mmu_page *sp)
 {
-        u64 *parent_pte;
+        u64 *sptep;
+        struct rmap_iterator iter;
 
-        while ((parent_pte = pte_list_next(&sp->parent_ptes, NULL)))
-                drop_parent_pte(sp, parent_pte);
+        while ((sptep = rmap_get_first(sp->parent_ptes, &iter)))
+                drop_parent_pte(sp, sptep);
 }
 
 static int mmu_zap_unsync_children(struct kvm *kvm,
@@ -1925,30 +1999,6 @@ static int kvm_mmu_prepare_zap_page(struct kvm *kvm, struct kvm_mmu_page *sp,
         return ret;
 }
 
-static void kvm_mmu_isolate_pages(struct list_head *invalid_list)
-{
-        struct kvm_mmu_page *sp;
-
-        list_for_each_entry(sp, invalid_list, link)
-                kvm_mmu_isolate_page(sp);
-}
-
-static void free_pages_rcu(struct rcu_head *head)
-{
-        struct kvm_mmu_page *next, *sp;
-
-        sp = container_of(head, struct kvm_mmu_page, rcu);
-        while (sp) {
-                if (!list_empty(&sp->link))
-                        next = list_first_entry(&sp->link,
-                                      struct kvm_mmu_page, link);
-                else
-                        next = NULL;
-                kvm_mmu_free_page(sp);
-                sp = next;
-        }
-}
-
 static void kvm_mmu_commit_zap_page(struct kvm *kvm,
                                     struct list_head *invalid_list)
 {
@@ -1957,17 +2007,17 @@ static void kvm_mmu_commit_zap_page(struct kvm *kvm,
         if (list_empty(invalid_list))
                 return;
 
-        kvm_flush_remote_tlbs(kvm);
-
-        if (atomic_read(&kvm->arch.reader_counter)) {
-                kvm_mmu_isolate_pages(invalid_list);
-                sp = list_first_entry(invalid_list, struct kvm_mmu_page, link);
-                list_del_init(invalid_list);
+        /*
+         * wmb: make sure everyone sees our modifications to the page tables
+         * rmb: make sure we see changes to vcpu->mode
+         */
+        smp_mb();
 
-                trace_kvm_mmu_delay_free_pages(sp);
-                call_rcu(&sp->rcu, free_pages_rcu);
-                return;
-        }
+        /*
+         * Wait for all vcpus to exit guest mode and/or lockless shadow
+         * page table walks.
+         */
+        kvm_flush_remote_tlbs(kvm);
 
         do {
                 sp = list_first_entry(invalid_list, struct kvm_mmu_page, link);
@@ -1975,7 +2025,6 @@ static void kvm_mmu_commit_zap_page(struct kvm *kvm,
                 kvm_mmu_isolate_page(sp);
                 kvm_mmu_free_page(sp);
         } while (!list_empty(invalid_list));
-
 }
 
 /*
@@ -2546,8 +2595,7 @@ static void transparent_hugepage_adjust(struct kvm_vcpu *vcpu,
                         *gfnp = gfn;
                         kvm_release_pfn_clean(pfn);
                         pfn &= ~mask;
-                        if (!get_page_unless_zero(pfn_to_page(pfn)))
-                                BUG();
+                        kvm_get_pfn(pfn);
                         *pfnp = pfn;
                 }
         }
@@ -3554,7 +3602,7 @@ static bool detect_write_flooding(struct kvm_mmu_page *sp)
          * Skip write-flooding detected for the sp whose level is 1, because
          * it can become unsync, then the guest page is not write-protected.
          */
-        if (sp->role.level == 1)
+        if (sp->role.level == PT_PAGE_TABLE_LEVEL)
                 return false;
 
         return ++sp->write_flooding_count >= 3;