[PATCH v5 4/6] x86: extend do_mmu_update() to support returning the old PTE value

[Kevin Lampis <kevin.lampis@xxxxxxxxxx>]

A new sub-op MMU_PT_UPDATE_SWAP when used will do an atomic swap to set
the new value and return the old PTE value through the req.val field.

- The old PTE value is passed back to the guest through the req.val field

If MMU_PT_UPDATE_SWAP is not set then the old behavior is preserved
  do_mmu_update -> mod_l*_entry -> UPDATE_ENTRY -> paging_write_guest_entry

The new MMU_PT_UPDATE_SWAP call chain looks like this
  do_mmu_update -> mod_l*_entry -> UPDATE_ENTRY -> paging_cmpxchg_guest_entry

New feature flag XENFEAT_mmu_pt_update_swap.

Signed-off-by: Kevin Lampis <kevin.lampis@xxxxxxxxxx>
---
Changes in v5:
- Add braces to the case statements
- Move copy_to_guest to the end so it doesn't interfere
  with things like flush_linear_pt
- Use copy_field_to_guest instead of copy_to_guest
- Use the raw form of __copy_field_to_guest because
  bounds have already been checked
- Folded x86: New feature flag XENFEAT_mmu_pt_update_swap patch
  into this one

Changes in v4:
- Refactor how mod_l*_entry() is used
  Checking `if (!rc)` multiple times in a row is inelegant but reduces
  the diff size. Let me know if that's not the right tradeoff here.

Changes in v3:
- Do swap for l2, l3, l4
- Allow all values not just 0

Changes in v2:
- Add a sub-op to mmu_update instead of new hypercall
- Rename to "swap" instead of "clear", although only `0` is accepted
- Remove spurious curly brace from `case PGT_l1_page_table:`
- Restructure `case PGT_l1_page_table:` to avoid diff churn
- Add missing `MMU_PT_UPDATE_SWAP` check for the second
  `PGT_writable_page` block
---
 xen/arch/x86/mm.c             | 75 ++++++++++++++++++++++++++++++-----
 xen/common/kernel.c           |  1 +
 xen/include/public/features.h |  3 ++
 xen/include/public/xen.h      |  1 +
 4 files changed, 71 insertions(+), 9 deletions(-)

diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
index 316a435b9b71..2458fd5e508b 100644
--- a/xen/arch/x86/mm.c
+++ b/xen/arch/x86/mm.c
@@ -4123,6 +4123,7 @@ long do_mmu_update(
         case MMU_NORMAL_PT_UPDATE:
         case MMU_PT_UPDATE_PRESERVE_AD:
         case MMU_PT_UPDATE_NO_TRANSLATE:
+        case MMU_PT_UPDATE_SWAP:
         {
             p2m_type_t p2mt;
 
@@ -4184,37 +4185,79 @@ long do_mmu_update(
                      update_flags = PTE_UPDATE_PRESERVE_AD;
                 else if ( cmd == MMU_PT_UPDATE_NO_TRANSLATE )
                      update_flags = PTE_UPDATE_NO_TRANSLATE;
+                else if ( cmd == MMU_PT_UPDATE_SWAP )
+                     update_flags = PTE_UPDATE_SWAP;
 
                 switch ( page->u.inuse.type_info & PGT_type_mask )
                 {
                 case PGT_l1_page_table:
+                {
+                    l1_pgentry_t ol1e = {};
                     rc = mod_l1_entry(va, l1e_from_intpte(req.val), mfn,
-                                      update_flags, v, pg_owner, NULL);
-                    break;
+                                      update_flags, v, pg_owner, &ol1e);
 
+                    if ( !rc && cmd == MMU_PT_UPDATE_SWAP )
+                    {
+                        req.val = ol1e.l1;
+                        if ( unlikely(copy_field_to_guest(ureqs, &req, val)) )
+                            rc = -EFAULT;
+                    }
+                    break;
+                }
                 case PGT_l2_page_table:
+                {
+                    l2_pgentry_t ol2e = {};
+
                     if ( unlikely(pg_owner != pt_owner) )
                         break;
+
                     rc = mod_l2_entry(va, l2e_from_intpte(req.val), mfn,
-                                      update_flags, v, NULL);
+                                      update_flags, v, &ol2e);
+
                     if ( !rc )
                         flush_linear_pt = true;
-                    break;
 
+                    if ( !rc && cmd == MMU_PT_UPDATE_SWAP )
+                    {
+                        req.val = ol2e.l2;
+                        if ( unlikely(copy_field_to_guest(ureqs, &req, val)) )
+                            rc = -EFAULT;
+                    }
+
+                    break;
+                }
                 case PGT_l3_page_table:
+                {
+                    l3_pgentry_t ol3e = {};
+
                     if ( unlikely(pg_owner != pt_owner) )
                         break;
+
                     rc = mod_l3_entry(va, l3e_from_intpte(req.val), mfn,
-                                      update_flags, v, NULL);
+                                      update_flags, v, &ol3e);
+
                     if ( !rc )
                         flush_linear_pt = true;
-                    break;
 
+                    if ( !rc && cmd == MMU_PT_UPDATE_SWAP )
+                    {
+                        req.val = ol3e.l3;
+                        if ( unlikely(copy_field_to_guest(ureqs, &req, val)) )
+                            rc = -EFAULT;
+                    }
+
+                    break;
+                }
                 case PGT_l4_page_table:
+                {
+                    l4_pgentry_t ol4e = {};
+
                     if ( unlikely(pg_owner != pt_owner) )
                         break;
+
                     rc = mod_l4_entry(va, l4e_from_intpte(req.val), mfn,
-                                      update_flags, v, NULL);
+                                      update_flags, v, &ol4e);
+
                     if ( !rc )
                         flush_linear_pt = true;
                     if ( !rc && pt_owner->arch.pv.xpti )
@@ -4239,9 +4282,22 @@ long do_mmu_update(
                                      mfn) + local_in_use) )
                             flush_root_pt_others = true;
                     }
-                    break;
 
+                    if ( !rc && cmd == MMU_PT_UPDATE_SWAP )
+                    {
+                        req.val = ol4e.l4;
+                        if ( unlikely(copy_field_to_guest(ureqs, &req, val)) )
+                            rc = -EFAULT;
+                    }
+
+                    break;
+                }
                 case PGT_writable_page:
+                    if ( unlikely(cmd == MMU_PT_UPDATE_SWAP) )
+                    {
+                        rc = -EINVAL;
+                        break;
+                    }
                     perfc_incr(writable_mmu_updates);
                     paging_write_guest_entry(v, va, req.val, mfn);
                     rc = 0;
@@ -4251,7 +4307,8 @@ long do_mmu_update(
                 if ( rc == -EINTR )
                     rc = -ERESTART;
             }
-            else if ( get_page_type(page, PGT_writable_page) )
+            else if ( likely(cmd != MMU_PT_UPDATE_SWAP) &&
+                      get_page_type(page, PGT_writable_page) )
             {
                 perfc_incr(writable_mmu_updates);
                 paging_write_guest_entry(v, va, req.val, mfn);
diff --git a/xen/common/kernel.c b/xen/common/kernel.c
index 499023fae6fd..dc3cd9c3321b 100644
--- a/xen/common/kernel.c
+++ b/xen/common/kernel.c
@@ -690,6 +690,7 @@ long do_xen_version(int cmd, XEN_GUEST_HANDLE_PARAM(void) 
arg)
             if ( is_pv_domain(d) )
             {
                 fi.submap |= (1U << XENFEAT_mmu_pt_update_preserve_ad) |
+                             (1U << XENFEAT_mmu_pt_update_swap) |
                              (1U << XENFEAT_highmem_assist) |
                              (1U << XENFEAT_gnttab_map_avail_bits);
                 if ( IS_ENABLED(CONFIG_PV32) && VM_ASSIST(d, pae_extended_cr3) 
)
diff --git a/xen/include/public/features.h b/xen/include/public/features.h
index 880193094713..227f1e408e41 100644
--- a/xen/include/public/features.h
+++ b/xen/include/public/features.h
@@ -128,6 +128,9 @@
  */
 #define XENFEAT_dm_msix_all_writes        20
 
+/* x86: Does this Xen host support the MMU_PT_UPDATE_SWAP hypercall? */
+#define XENFEAT_mmu_pt_update_swap        21
+
 #define XENFEAT_NR_SUBMAPS 1
 
 #endif /* __XEN_PUBLIC_FEATURES_H__ */
diff --git a/xen/include/public/xen.h b/xen/include/public/xen.h
index 2149b8dd3808..2c403ca47ed6 100644
--- a/xen/include/public/xen.h
+++ b/xen/include/public/xen.h
@@ -349,6 +349,7 @@ DEFINE_XEN_GUEST_HANDLE(xen_ulong_t);
 #define MMU_PT_UPDATE_PRESERVE_AD  2 /* atomically: *ptr = val | (*ptr&(A|D)) 
*/
 #define MMU_PT_UPDATE_NO_TRANSLATE 3 /* checked '*ptr = val'. ptr is MA.      
*/
                                      /* val never translated.                 
*/
+#define MMU_PT_UPDATE_SWAP         4 /* Update and return the old value. */
 
 /*
  * MMU EXTENDED OPERATIONS
-- 
2.52.0