// SPDX-License-Identifier: GPL-2.0
/*
 * This code is used on x86_64 to create page table identity mappings on
 * demand by building up a new set of page tables (or appending to the
 * existing ones), and then switching over to them when ready.
 *
 * Copyright (C) 2015-2016  Yinghai Lu
 * Copyright (C)      2016  Kees Cook
 */

/* No MITIGATION_PAGE_TABLE_ISOLATION support needed either: */
#undef CONFIG_MITIGATION_PAGE_TABLE_ISOLATION

#include "error.h"
#include "misc.h"

/* These actually do the work of building the kernel identity maps. */
#include <linux/pgtable.h>
#include <asm/cmpxchg.h>
#include <asm/trap_pf.h>
#include <asm/trapnr.h>
#include <asm/init.h>
/* Use the static base for this part of the boot process */
#undef __PAGE_OFFSET
#define __PAGE_OFFSET __PAGE_OFFSET_BASE
#include "../../mm/ident_map.c"

#define _SETUP
#include <asm/setup.h>  /* For COMMAND_LINE_SIZE */
#undef _SETUP

extern unsigned long get_cmd_line_ptr(void);

/* Used by PAGE_KERN* macros: */
pteval_t __default_kernel_pte_mask __read_mostly = ~0;

/* Used to track our page table allocation area. */
struct alloc_pgt_data {
        unsigned char *pgt_buf;
        unsigned long pgt_buf_size;
        unsigned long pgt_buf_offset;
};

/*
 * Allocates space for a page table entry, using struct alloc_pgt_data
 * above. Besides the local callers, this is used as the allocation
 * callback in mapping_info below.
 */
static void *alloc_pgt_page(void *context)
{
        struct alloc_pgt_data *pages = (struct alloc_pgt_data *)context;
        unsigned char *entry;

        /* Validate there is space available for a new page. */
        if (pages->pgt_buf_offset >= pages->pgt_buf_size) {
                debug_putstr("out of pgt_buf in " __FILE__ "!?\n");
                debug_putaddr(pages->pgt_buf_offset);
                debug_putaddr(pages->pgt_buf_size);
                return NULL;
        }

        /* Consumed more tables than expected? */
        if (pages->pgt_buf_offset == BOOT_PGT_SIZE_WARN) {
                debug_putstr("pgt_buf running low in " __FILE__ "\n");
                debug_putstr("Need to raise BOOT_PGT_SIZE?\n");
                debug_putaddr(pages->pgt_buf_offset);
                debug_putaddr(pages->pgt_buf_size);
        }

        entry = pages->pgt_buf + pages->pgt_buf_offset;
        pages->pgt_buf_offset += PAGE_SIZE;

        return entry;
}

/* Used to track our allocated page tables. */
static struct alloc_pgt_data pgt_data;

/* The top level page table entry pointer. */
static unsigned long top_level_pgt;

phys_addr_t physical_mask = (1ULL << __PHYSICAL_MASK_SHIFT) - 1;

/*
 * Mapping information structure passed to kernel_ident_mapping_init().
 * Due to relocation, pointers must be assigned at run time not build time.
 */
static struct x86_mapping_info mapping_info;

/*
 * Adds the specified range to the identity mappings.
 */
void kernel_add_identity_map(unsigned long start, unsigned long end)
{
        int ret;

        /* Align boundary to 2M. */
        start = round_down(start, PMD_SIZE);
        end = round_up(end, PMD_SIZE);
        if (start >= end)
                return;

        /* Build the mapping. */
        ret = kernel_ident_mapping_init(&mapping_info, (pgd_t *)top_level_pgt, start, end);
        if (ret)
                error("Error: kernel_ident_mapping_init() failed\n");
}

/* Locates and clears a region for a new top level page table. */
void initialize_identity_maps(void *rmode)
{
        unsigned long cmdline;
        struct setup_data *sd;

        /* Exclude the encryption mask from __PHYSICAL_MASK */
        physical_mask &= ~sme_me_mask;

        /* Init mapping_info with run-time function/buffer pointers. */
        mapping_info.alloc_pgt_page = alloc_pgt_page;
        mapping_info.context = &pgt_data;
        mapping_info.page_flag = __PAGE_KERNEL_LARGE_EXEC | sme_me_mask;
        mapping_info.kernpg_flag = _KERNPG_TABLE;

        /*
         * It should be impossible for this not to already be true,
         * but since calling this a second time would rewind the other
         * counters, let's just make sure this is reset too.
         */
        pgt_data.pgt_buf_offset = 0;

        /*
         * If we came here via startup_32(), cr3 will be _pgtable already
         * and we must append to the existing area instead of entirely
         * overwriting it.
         *
         * With 5-level paging, we use '_pgtable' to allocate the p4d page table,
         * the top-level page table is allocated separately.
         *
         * p4d_offset(top_level_pgt, 0) would cover both the 4- and 5-level
         * cases. On 4-level paging it's equal to 'top_level_pgt'.
         */
        top_level_pgt = read_cr3_pa();
        if (p4d_offset((pgd_t *)top_level_pgt, 0) == (p4d_t *)_pgtable) {
                pgt_data.pgt_buf = _pgtable + BOOT_INIT_PGT_SIZE;
                pgt_data.pgt_buf_size = BOOT_PGT_SIZE - BOOT_INIT_PGT_SIZE;
                memset(pgt_data.pgt_buf, 0, pgt_data.pgt_buf_size);
        } else {
                pgt_data.pgt_buf = _pgtable;
                pgt_data.pgt_buf_size = BOOT_PGT_SIZE;
                memset(pgt_data.pgt_buf, 0, pgt_data.pgt_buf_size);
                top_level_pgt = (unsigned long)alloc_pgt_page(&pgt_data);
        }

        /*
         * New page-table is set up - map the kernel image, boot_params and the
         * command line. The uncompressed kernel requires boot_params and the
         * command line to be mapped in the identity mapping. Map them
         * explicitly here in case the compressed kernel does not touch them,
         * or does not touch all the pages covering them.
         */
        kernel_add_identity_map((unsigned long)_head, (unsigned long)_end);
        boot_params_ptr = rmode;
        kernel_add_identity_map((unsigned long)boot_params_ptr,
                                (unsigned long)(boot_params_ptr + 1));
        cmdline = get_cmd_line_ptr();
        kernel_add_identity_map(cmdline, cmdline + COMMAND_LINE_SIZE);

        /*
         * Also map the setup_data entries passed via boot_params in case they
         * need to be accessed by uncompressed kernel via the identity mapping.
         */
        sd = (struct setup_data *)boot_params_ptr->hdr.setup_data;
        while (sd) {
                unsigned long sd_addr = (unsigned long)sd;

                kernel_add_identity_map(sd_addr, sd_addr + sizeof(*sd) + sd->len);
                sd = (struct setup_data *)sd->next;
        }

        sev_prep_identity_maps(top_level_pgt);

        /* Load the new page-table. */
        write_cr3(top_level_pgt);

        /*
         * Now that the required page table mappings are established and a
         * GHCB can be used, check for SNP guest/HV feature compatibility.
         */
        snp_check_features();
}

static pte_t *split_large_pmd(struct x86_mapping_info *info,
                              pmd_t *pmdp, unsigned long __address)
{
        unsigned long page_flags;
        unsigned long address;
        pte_t *pte;
        pmd_t pmd;
        int i;

        pte = (pte_t *)info->alloc_pgt_page(info->context);
        if (!pte)
                return NULL;

        address     = __address & PMD_MASK;
        /* No large page - clear PSE flag */
        page_flags  = info->page_flag & ~_PAGE_PSE;

        /* Populate the PTEs */
        for (i = 0; i < PTRS_PER_PMD; i++) {
                set_pte(&pte[i], __pte(address | page_flags));
                address += PAGE_SIZE;
        }

        /*
         * Ideally we need to clear the large PMD first and do a TLB
         * flush before we write the new PMD. But the 2M range of the
         * PMD might contain the code we execute and/or the stack
         * we are on, so we can't do that. But that should be safe here
         * because we are going from large to small mappings and we are
         * also the only user of the page-table, so there is no chance
         * of a TLB multihit.
         */
        pmd = __pmd((unsigned long)pte | info->kernpg_flag);
        set_pmd(pmdp, pmd);
        /* Flush TLB to establish the new PMD */
        write_cr3(top_level_pgt);

        return pte + pte_index(__address);
}

static void clflush_page(unsigned long address)
{
        unsigned int flush_size;
        char *cl, *start, *end;

        /*
         * Hardcode cl-size to 64 - CPUID can't be used here because that might
         * cause another #VC exception and the GHCB is not ready to use yet.
         */
        flush_size = 64;
        start      = (char *)(address & PAGE_MASK);
        end        = start + PAGE_SIZE;

        /*
         * First make sure there are no pending writes on the cache-lines to
         * flush.
         */
        asm volatile("mfence" : : : "memory");

        for (cl = start; cl != end; cl += flush_size)
                clflush(cl);
}

static int set_clr_page_flags(struct x86_mapping_info *info,
                              unsigned long address,
                              pteval_t set, pteval_t clr)
{
        pgd_t *pgdp = (pgd_t *)top_level_pgt;
        p4d_t *p4dp;
        pud_t *pudp;
        pmd_t *pmdp;
        pte_t *ptep, pte;

        /*
         * First make sure there is a PMD mapping for 'address'.
         * It should already exist, but keep things generic.
         *
         * To map the page just read from it and fault it in if there is no
         * mapping yet. kernel_add_identity_map() can't be called here because
         * that would unconditionally map the address on PMD level, destroying
         * any PTE-level mappings that might already exist. Use assembly here
         * so the access won't be optimized away.
         */
        asm volatile("mov %[address], %%r9"
                     :: [address] "g" (*(unsigned long *)address)
                     : "r9", "memory");

        /*
         * The page is mapped at least with PMD size - so skip checks and walk
         * directly to the PMD.
         */
        p4dp = p4d_offset(pgdp, address);
        pudp = pud_offset(p4dp, address);
        pmdp = pmd_offset(pudp, address);

        if (pmd_leaf(*pmdp))
                ptep = split_large_pmd(info, pmdp, address);
        else
                ptep = pte_offset_kernel(pmdp, address);

        if (!ptep)
                return -ENOMEM;

        /*
         * Changing encryption attributes of a page requires to flush it from
         * the caches.
         */
        if ((set | clr) & _PAGE_ENC) {
                clflush_page(address);

                /*
                 * If the encryption attribute is being cleared, change the page state
                 * to shared in the RMP table.
                 */
                if (clr)
                        snp_set_page_shared(__pa(address & PAGE_MASK));
        }

        /* Update PTE */
        pte = *ptep;
        pte = pte_set_flags(pte, set);
        pte = pte_clear_flags(pte, clr);
        set_pte(ptep, pte);

        /*
         * If the encryption attribute is being set, then change the page state to
         * private in the RMP entry. The page state change must be done after the PTE
         * is updated.
         */
        if (set & _PAGE_ENC)
                snp_set_page_private(__pa(address & PAGE_MASK));

        /* Flush TLB after changing encryption attribute */
        write_cr3(top_level_pgt);

        return 0;
}

int set_page_decrypted(unsigned long address)
{
        return set_clr_page_flags(&mapping_info, address, 0, _PAGE_ENC);
}

int set_page_encrypted(unsigned long address)
{
        return set_clr_page_flags(&mapping_info, address, _PAGE_ENC, 0);
}

int set_page_non_present(unsigned long address)
{
        return set_clr_page_flags(&mapping_info, address, 0, _PAGE_PRESENT);
}

static void do_pf_error(const char *msg, unsigned long error_code,
                        unsigned long address, unsigned long ip)
{
        error_putstr(msg);

        error_putstr("\nError Code: ");
        error_puthex(error_code);
        error_putstr("\nCR2: 0x");
        error_puthex(address);
        error_putstr("\nRIP relative to _head: 0x");
        error_puthex(ip - (unsigned long)_head);
        error_putstr("\n");

        error("Stopping.\n");
}

void do_boot_page_fault(struct pt_regs *regs, unsigned long error_code)
{
        unsigned long address = native_read_cr2();
        unsigned long end;
        bool ghcb_fault;

        ghcb_fault = sev_es_check_ghcb_fault(address);

        address   &= PMD_MASK;
        end        = address + PMD_SIZE;

        /*
         * Check for unexpected error codes. Unexpected are:
         *      - Faults on present pages
         *      - User faults
         *      - Reserved bits set
         */
        if (error_code & (X86_PF_PROT | X86_PF_USER | X86_PF_RSVD))
                do_pf_error("Unexpected page-fault:", error_code, address, regs->ip);
        else if (ghcb_fault)
                do_pf_error("Page-fault on GHCB page:", error_code, address, regs->ip);

        /*
         * Error code is sane - now identity map the 2M region around
         * the faulting address.
         */
        kernel_add_identity_map(address, end);
}

void do_boot_nmi_trap(struct pt_regs *regs, unsigned long error_code)
{
        spurious_nmi_count++;
}