1 /* 2 * vMTRR implementation 3 * 4 * Copyright (C) 2006 Qumranet, Inc. 5 * Copyright 2010 Red Hat, Inc. and/or its affiliates. 6 * Copyright(C) 2015 Intel Corporation. 7 * 8 * Authors: 9 * Yaniv Kamay <yaniv@qumranet.com> 10 * Avi Kivity <avi@qumranet.com> 11 * Marcelo Tosatti <mtosatti@redhat.com> 12 * Paolo Bonzini <pbonzini@redhat.com> 13 * Xiao Guangrong <guangrong.xiao@linux.intel.com> 14 * 15 * This work is licensed under the terms of the GNU GPL, version 2. See 16 * the COPYING file in the top-level directory. 17 */ 18 19 #include <linux/kvm_host.h> 20 #include <asm/mtrr.h> 21 22 #include "cpuid.h" 23 #include "mmu.h" 24 25 #define IA32_MTRR_DEF_TYPE_E (1ULL << 11) 26 #define IA32_MTRR_DEF_TYPE_FE (1ULL << 10) 27 #define IA32_MTRR_DEF_TYPE_TYPE_MASK (0xff) 28 29 static bool msr_mtrr_valid(unsigned msr) 30 { 31 switch (msr) { 32 case 0x200 ... 0x200 + 2 * KVM_NR_VAR_MTRR - 1: 33 case MSR_MTRRfix64K_00000: 34 case MSR_MTRRfix16K_80000: 35 case MSR_MTRRfix16K_A0000: 36 case MSR_MTRRfix4K_C0000: 37 case MSR_MTRRfix4K_C8000: 38 case MSR_MTRRfix4K_D0000: 39 case MSR_MTRRfix4K_D8000: 40 case MSR_MTRRfix4K_E0000: 41 case MSR_MTRRfix4K_E8000: 42 case MSR_MTRRfix4K_F0000: 43 case MSR_MTRRfix4K_F8000: 44 case MSR_MTRRdefType: 45 case MSR_IA32_CR_PAT: 46 return true; 47 case 0x2f8: 48 return true; 49 } 50 return false; 51 } 52 53 static bool valid_pat_type(unsigned t) 54 { 55 return t < 8 && (1 << t) & 0xf3; /* 0, 1, 4, 5, 6, 7 */ 56 } 57 58 static bool valid_mtrr_type(unsigned t) 59 { 60 return t < 8 && (1 << t) & 0x73; /* 0, 1, 4, 5, 6 */ 61 } 62 63 bool kvm_mtrr_valid(struct kvm_vcpu *vcpu, u32 msr, u64 data) 64 { 65 int i; 66 u64 mask; 67 68 if (!msr_mtrr_valid(msr)) 69 return false; 70 71 if (msr == MSR_IA32_CR_PAT) { 72 for (i = 0; i < 8; i++) 73 if (!valid_pat_type((data >> (i * 8)) & 0xff)) 74 return false; 75 return true; 76 } else if (msr == MSR_MTRRdefType) { 77 if (data & ~0xcff) 78 return false; 79 return valid_mtrr_type(data & 0xff); 80 } else if (msr >= MSR_MTRRfix64K_00000 && msr <= MSR_MTRRfix4K_F8000) { 81 for (i = 0; i < 8 ; i++) 82 if (!valid_mtrr_type((data >> (i * 8)) & 0xff)) 83 return false; 84 return true; 85 } 86 87 /* variable MTRRs */ 88 WARN_ON(!(msr >= 0x200 && msr < 0x200 + 2 * KVM_NR_VAR_MTRR)); 89 90 mask = (~0ULL) << cpuid_maxphyaddr(vcpu); 91 if ((msr & 1) == 0) { 92 /* MTRR base */ 93 if (!valid_mtrr_type(data & 0xff)) 94 return false; 95 mask |= 0xf00; 96 } else 97 /* MTRR mask */ 98 mask |= 0x7ff; 99 if (data & mask) { 100 kvm_inject_gp(vcpu, 0); 101 return false; 102 } 103 104 return true; 105 } 106 EXPORT_SYMBOL_GPL(kvm_mtrr_valid); 107 108 static bool mtrr_is_enabled(struct kvm_mtrr *mtrr_state) 109 { 110 return !!(mtrr_state->deftype & IA32_MTRR_DEF_TYPE_E); 111 } 112 113 static bool fixed_mtrr_is_enabled(struct kvm_mtrr *mtrr_state) 114 { 115 return !!(mtrr_state->deftype & IA32_MTRR_DEF_TYPE_FE); 116 } 117 118 static u8 mtrr_default_type(struct kvm_mtrr *mtrr_state) 119 { 120 return mtrr_state->deftype & IA32_MTRR_DEF_TYPE_TYPE_MASK; 121 } 122 123 static u8 mtrr_disabled_type(void) 124 { 125 /* 126 * Intel SDM 11.11.2.2: all MTRRs are disabled when 127 * IA32_MTRR_DEF_TYPE.E bit is cleared, and the UC 128 * memory type is applied to all of physical memory. 129 */ 130 return MTRR_TYPE_UNCACHABLE; 131 } 132 133 /* 134 * Three terms are used in the following code: 135 * - segment, it indicates the address segments covered by fixed MTRRs. 136 * - unit, it corresponds to the MSR entry in the segment. 137 * - range, a range is covered in one memory cache type. 138 */ 139 struct fixed_mtrr_segment { 140 u64 start; 141 u64 end; 142 143 int range_shift; 144 145 /* the start position in kvm_mtrr.fixed_ranges[]. */ 146 int range_start; 147 }; 148 149 static struct fixed_mtrr_segment fixed_seg_table[] = { 150 /* MSR_MTRRfix64K_00000, 1 unit. 64K fixed mtrr. */ 151 { 152 .start = 0x0, 153 .end = 0x80000, 154 .range_shift = 16, /* 64K */ 155 .range_start = 0, 156 }, 157 158 /* 159 * MSR_MTRRfix16K_80000 ... MSR_MTRRfix16K_A0000, 2 units, 160 * 16K fixed mtrr. 161 */ 162 { 163 .start = 0x80000, 164 .end = 0xc0000, 165 .range_shift = 14, /* 16K */ 166 .range_start = 8, 167 }, 168 169 /* 170 * MSR_MTRRfix4K_C0000 ... MSR_MTRRfix4K_F8000, 8 units, 171 * 4K fixed mtrr. 172 */ 173 { 174 .start = 0xc0000, 175 .end = 0x100000, 176 .range_shift = 12, /* 12K */ 177 .range_start = 24, 178 } 179 }; 180 181 /* 182 * The size of unit is covered in one MSR, one MSR entry contains 183 * 8 ranges so that unit size is always 8 * 2^range_shift. 184 */ 185 static u64 fixed_mtrr_seg_unit_size(int seg) 186 { 187 return 8 << fixed_seg_table[seg].range_shift; 188 } 189 190 static bool fixed_msr_to_seg_unit(u32 msr, int *seg, int *unit) 191 { 192 switch (msr) { 193 case MSR_MTRRfix64K_00000: 194 *seg = 0; 195 *unit = 0; 196 break; 197 case MSR_MTRRfix16K_80000 ... MSR_MTRRfix16K_A0000: 198 *seg = 1; 199 *unit = msr - MSR_MTRRfix16K_80000; 200 break; 201 case MSR_MTRRfix4K_C0000 ... MSR_MTRRfix4K_F8000: 202 *seg = 2; 203 *unit = msr - MSR_MTRRfix4K_C0000; 204 break; 205 default: 206 return false; 207 } 208 209 return true; 210 } 211 212 static void fixed_mtrr_seg_unit_range(int seg, int unit, u64 *start, u64 *end) 213 { 214 struct fixed_mtrr_segment *mtrr_seg = &fixed_seg_table[seg]; 215 u64 unit_size = fixed_mtrr_seg_unit_size(seg); 216 217 *start = mtrr_seg->start + unit * unit_size; 218 *end = *start + unit_size; 219 WARN_ON(*end > mtrr_seg->end); 220 } 221 222 static int fixed_mtrr_seg_unit_range_index(int seg, int unit) 223 { 224 struct fixed_mtrr_segment *mtrr_seg = &fixed_seg_table[seg]; 225 226 WARN_ON(mtrr_seg->start + unit * fixed_mtrr_seg_unit_size(seg) 227 > mtrr_seg->end); 228 229 /* each unit has 8 ranges. */ 230 return mtrr_seg->range_start + 8 * unit; 231 } 232 233 static int fixed_mtrr_seg_end_range_index(int seg) 234 { 235 struct fixed_mtrr_segment *mtrr_seg = &fixed_seg_table[seg]; 236 int n; 237 238 n = (mtrr_seg->end - mtrr_seg->start) >> mtrr_seg->range_shift; 239 return mtrr_seg->range_start + n - 1; 240 } 241 242 static bool fixed_msr_to_range(u32 msr, u64 *start, u64 *end) 243 { 244 int seg, unit; 245 246 if (!fixed_msr_to_seg_unit(msr, &seg, &unit)) 247 return false; 248 249 fixed_mtrr_seg_unit_range(seg, unit, start, end); 250 return true; 251 } 252 253 static int fixed_msr_to_range_index(u32 msr) 254 { 255 int seg, unit; 256 257 if (!fixed_msr_to_seg_unit(msr, &seg, &unit)) 258 return -1; 259 260 return fixed_mtrr_seg_unit_range_index(seg, unit); 261 } 262 263 static int fixed_mtrr_addr_to_seg(u64 addr) 264 { 265 struct fixed_mtrr_segment *mtrr_seg; 266 int seg, seg_num = ARRAY_SIZE(fixed_seg_table); 267 268 for (seg = 0; seg < seg_num; seg++) { 269 mtrr_seg = &fixed_seg_table[seg]; 270 if (mtrr_seg->start >= addr && addr < mtrr_seg->end) 271 return seg; 272 } 273 274 return -1; 275 } 276 277 static int fixed_mtrr_addr_seg_to_range_index(u64 addr, int seg) 278 { 279 struct fixed_mtrr_segment *mtrr_seg; 280 int index; 281 282 mtrr_seg = &fixed_seg_table[seg]; 283 index = mtrr_seg->range_start; 284 index += (addr - mtrr_seg->start) >> mtrr_seg->range_shift; 285 return index; 286 } 287 288 static u64 fixed_mtrr_range_end_addr(int seg, int index) 289 { 290 struct fixed_mtrr_segment *mtrr_seg = &fixed_seg_table[seg]; 291 int pos = index - mtrr_seg->range_start; 292 293 return mtrr_seg->start + ((pos + 1) << mtrr_seg->range_shift); 294 } 295 296 static void var_mtrr_range(struct kvm_mtrr_range *range, u64 *start, u64 *end) 297 { 298 u64 mask; 299 300 *start = range->base & PAGE_MASK; 301 302 mask = range->mask & PAGE_MASK; 303 mask |= ~0ULL << boot_cpu_data.x86_phys_bits; 304 305 /* This cannot overflow because writing to the reserved bits of 306 * variable MTRRs causes a #GP. 307 */ 308 *end = (*start | ~mask) + 1; 309 } 310 311 static void update_mtrr(struct kvm_vcpu *vcpu, u32 msr) 312 { 313 struct kvm_mtrr *mtrr_state = &vcpu->arch.mtrr_state; 314 gfn_t start, end; 315 int index; 316 317 if (msr == MSR_IA32_CR_PAT || !tdp_enabled || 318 !kvm_arch_has_noncoherent_dma(vcpu->kvm)) 319 return; 320 321 if (!mtrr_is_enabled(mtrr_state) && msr != MSR_MTRRdefType) 322 return; 323 324 /* fixed MTRRs. */ 325 if (fixed_msr_to_range(msr, &start, &end)) { 326 if (!fixed_mtrr_is_enabled(mtrr_state)) 327 return; 328 } else if (msr == MSR_MTRRdefType) { 329 start = 0x0; 330 end = ~0ULL; 331 } else { 332 /* variable range MTRRs. */ 333 index = (msr - 0x200) / 2; 334 var_mtrr_range(&mtrr_state->var_ranges[index], &start, &end); 335 } 336 337 kvm_zap_gfn_range(vcpu->kvm, gpa_to_gfn(start), gpa_to_gfn(end)); 338 } 339 340 static bool var_mtrr_range_is_valid(struct kvm_mtrr_range *range) 341 { 342 return (range->mask & (1 << 11)) != 0; 343 } 344 345 static void set_var_mtrr_msr(struct kvm_vcpu *vcpu, u32 msr, u64 data) 346 { 347 struct kvm_mtrr *mtrr_state = &vcpu->arch.mtrr_state; 348 struct kvm_mtrr_range *tmp, *cur; 349 int index, is_mtrr_mask; 350 351 index = (msr - 0x200) / 2; 352 is_mtrr_mask = msr - 0x200 - 2 * index; 353 cur = &mtrr_state->var_ranges[index]; 354 355 /* remove the entry if it's in the list. */ 356 if (var_mtrr_range_is_valid(cur)) 357 list_del(&mtrr_state->var_ranges[index].node); 358 359 if (!is_mtrr_mask) 360 cur->base = data; 361 else 362 cur->mask = data; 363 364 /* add it to the list if it's enabled. */ 365 if (var_mtrr_range_is_valid(cur)) { 366 list_for_each_entry(tmp, &mtrr_state->head, node) 367 if (cur->base >= tmp->base) 368 break; 369 list_add_tail(&cur->node, &tmp->node); 370 } 371 } 372 373 int kvm_mtrr_set_msr(struct kvm_vcpu *vcpu, u32 msr, u64 data) 374 { 375 int index; 376 377 if (!kvm_mtrr_valid(vcpu, msr, data)) 378 return 1; 379 380 index = fixed_msr_to_range_index(msr); 381 if (index >= 0) 382 *(u64 *)&vcpu->arch.mtrr_state.fixed_ranges[index] = data; 383 else if (msr == MSR_MTRRdefType) 384 vcpu->arch.mtrr_state.deftype = data; 385 else if (msr == MSR_IA32_CR_PAT) 386 vcpu->arch.pat = data; 387 else 388 set_var_mtrr_msr(vcpu, msr, data); 389 390 update_mtrr(vcpu, msr); 391 return 0; 392 } 393 394 int kvm_mtrr_get_msr(struct kvm_vcpu *vcpu, u32 msr, u64 *pdata) 395 { 396 int index; 397 398 /* MSR_MTRRcap is a readonly MSR. */ 399 if (msr == MSR_MTRRcap) { 400 /* 401 * SMRR = 0 402 * WC = 1 403 * FIX = 1 404 * VCNT = KVM_NR_VAR_MTRR 405 */ 406 *pdata = 0x500 | KVM_NR_VAR_MTRR; 407 return 0; 408 } 409 410 if (!msr_mtrr_valid(msr)) 411 return 1; 412 413 index = fixed_msr_to_range_index(msr); 414 if (index >= 0) 415 *pdata = *(u64 *)&vcpu->arch.mtrr_state.fixed_ranges[index]; 416 else if (msr == MSR_MTRRdefType) 417 *pdata = vcpu->arch.mtrr_state.deftype; 418 else if (msr == MSR_IA32_CR_PAT) 419 *pdata = vcpu->arch.pat; 420 else { /* Variable MTRRs */ 421 int is_mtrr_mask; 422 423 index = (msr - 0x200) / 2; 424 is_mtrr_mask = msr - 0x200 - 2 * index; 425 if (!is_mtrr_mask) 426 *pdata = vcpu->arch.mtrr_state.var_ranges[index].base; 427 else 428 *pdata = vcpu->arch.mtrr_state.var_ranges[index].mask; 429 } 430 431 return 0; 432 } 433 434 void kvm_vcpu_mtrr_init(struct kvm_vcpu *vcpu) 435 { 436 INIT_LIST_HEAD(&vcpu->arch.mtrr_state.head); 437 } 438 439 struct mtrr_iter { 440 /* input fields. */ 441 struct kvm_mtrr *mtrr_state; 442 u64 start; 443 u64 end; 444 445 /* output fields. */ 446 int mem_type; 447 /* mtrr is completely disabled? */ 448 bool mtrr_disabled; 449 /* [start, end) is not fully covered in MTRRs? */ 450 bool partial_map; 451 452 /* private fields. */ 453 union { 454 /* used for fixed MTRRs. */ 455 struct { 456 int index; 457 int seg; 458 }; 459 460 /* used for var MTRRs. */ 461 struct { 462 struct kvm_mtrr_range *range; 463 /* max address has been covered in var MTRRs. */ 464 u64 start_max; 465 }; 466 }; 467 468 bool fixed; 469 }; 470 471 static bool mtrr_lookup_fixed_start(struct mtrr_iter *iter) 472 { 473 int seg, index; 474 475 if (!fixed_mtrr_is_enabled(iter->mtrr_state)) 476 return false; 477 478 seg = fixed_mtrr_addr_to_seg(iter->start); 479 if (seg < 0) 480 return false; 481 482 iter->fixed = true; 483 index = fixed_mtrr_addr_seg_to_range_index(iter->start, seg); 484 iter->index = index; 485 iter->seg = seg; 486 return true; 487 } 488 489 static bool match_var_range(struct mtrr_iter *iter, 490 struct kvm_mtrr_range *range) 491 { 492 u64 start, end; 493 494 var_mtrr_range(range, &start, &end); 495 if (!(start >= iter->end || end <= iter->start)) { 496 iter->range = range; 497 498 /* 499 * the function is called when we do kvm_mtrr.head walking. 500 * Range has the minimum base address which interleaves 501 * [looker->start_max, looker->end). 502 */ 503 iter->partial_map |= iter->start_max < start; 504 505 /* update the max address has been covered. */ 506 iter->start_max = max(iter->start_max, end); 507 return true; 508 } 509 510 return false; 511 } 512 513 static void __mtrr_lookup_var_next(struct mtrr_iter *iter) 514 { 515 struct kvm_mtrr *mtrr_state = iter->mtrr_state; 516 517 list_for_each_entry_continue(iter->range, &mtrr_state->head, node) 518 if (match_var_range(iter, iter->range)) 519 return; 520 521 iter->range = NULL; 522 iter->partial_map |= iter->start_max < iter->end; 523 } 524 525 static void mtrr_lookup_var_start(struct mtrr_iter *iter) 526 { 527 struct kvm_mtrr *mtrr_state = iter->mtrr_state; 528 529 iter->fixed = false; 530 iter->start_max = iter->start; 531 iter->range = list_prepare_entry(iter->range, &mtrr_state->head, node); 532 533 __mtrr_lookup_var_next(iter); 534 } 535 536 static void mtrr_lookup_fixed_next(struct mtrr_iter *iter) 537 { 538 /* terminate the lookup. */ 539 if (fixed_mtrr_range_end_addr(iter->seg, iter->index) >= iter->end) { 540 iter->fixed = false; 541 iter->range = NULL; 542 return; 543 } 544 545 iter->index++; 546 547 /* have looked up for all fixed MTRRs. */ 548 if (iter->index >= ARRAY_SIZE(iter->mtrr_state->fixed_ranges)) 549 return mtrr_lookup_var_start(iter); 550 551 /* switch to next segment. */ 552 if (iter->index > fixed_mtrr_seg_end_range_index(iter->seg)) 553 iter->seg++; 554 } 555 556 static void mtrr_lookup_var_next(struct mtrr_iter *iter) 557 { 558 __mtrr_lookup_var_next(iter); 559 } 560 561 static void mtrr_lookup_start(struct mtrr_iter *iter) 562 { 563 if (!mtrr_is_enabled(iter->mtrr_state)) { 564 iter->mtrr_disabled = true; 565 return; 566 } 567 568 if (!mtrr_lookup_fixed_start(iter)) 569 mtrr_lookup_var_start(iter); 570 } 571 572 static void mtrr_lookup_init(struct mtrr_iter *iter, 573 struct kvm_mtrr *mtrr_state, u64 start, u64 end) 574 { 575 iter->mtrr_state = mtrr_state; 576 iter->start = start; 577 iter->end = end; 578 iter->mtrr_disabled = false; 579 iter->partial_map = false; 580 iter->fixed = false; 581 iter->range = NULL; 582 583 mtrr_lookup_start(iter); 584 } 585 586 static bool mtrr_lookup_okay(struct mtrr_iter *iter) 587 { 588 if (iter->fixed) { 589 iter->mem_type = iter->mtrr_state->fixed_ranges[iter->index]; 590 return true; 591 } 592 593 if (iter->range) { 594 iter->mem_type = iter->range->base & 0xff; 595 return true; 596 } 597 598 return false; 599 } 600 601 static void mtrr_lookup_next(struct mtrr_iter *iter) 602 { 603 if (iter->fixed) 604 mtrr_lookup_fixed_next(iter); 605 else 606 mtrr_lookup_var_next(iter); 607 } 608 609 #define mtrr_for_each_mem_type(_iter_, _mtrr_, _gpa_start_, _gpa_end_) \ 610 for (mtrr_lookup_init(_iter_, _mtrr_, _gpa_start_, _gpa_end_); \ 611 mtrr_lookup_okay(_iter_); mtrr_lookup_next(_iter_)) 612 613 u8 kvm_mtrr_get_guest_memory_type(struct kvm_vcpu *vcpu, gfn_t gfn) 614 { 615 struct kvm_mtrr *mtrr_state = &vcpu->arch.mtrr_state; 616 struct mtrr_iter iter; 617 u64 start, end; 618 int type = -1; 619 const int wt_wb_mask = (1 << MTRR_TYPE_WRBACK) 620 | (1 << MTRR_TYPE_WRTHROUGH); 621 622 start = gfn_to_gpa(gfn); 623 end = start + PAGE_SIZE; 624 625 mtrr_for_each_mem_type(&iter, mtrr_state, start, end) { 626 int curr_type = iter.mem_type; 627 628 /* 629 * Please refer to Intel SDM Volume 3: 11.11.4.1 MTRR 630 * Precedences. 631 */ 632 633 if (type == -1) { 634 type = curr_type; 635 continue; 636 } 637 638 /* 639 * If two or more variable memory ranges match and the 640 * memory types are identical, then that memory type is 641 * used. 642 */ 643 if (type == curr_type) 644 continue; 645 646 /* 647 * If two or more variable memory ranges match and one of 648 * the memory types is UC, the UC memory type used. 649 */ 650 if (curr_type == MTRR_TYPE_UNCACHABLE) 651 return MTRR_TYPE_UNCACHABLE; 652 653 /* 654 * If two or more variable memory ranges match and the 655 * memory types are WT and WB, the WT memory type is used. 656 */ 657 if (((1 << type) & wt_wb_mask) && 658 ((1 << curr_type) & wt_wb_mask)) { 659 type = MTRR_TYPE_WRTHROUGH; 660 continue; 661 } 662 663 /* 664 * For overlaps not defined by the above rules, processor 665 * behavior is undefined. 666 */ 667 668 /* We use WB for this undefined behavior. :( */ 669 return MTRR_TYPE_WRBACK; 670 } 671 672 if (iter.mtrr_disabled) 673 return mtrr_disabled_type(); 674 675 /* not contained in any MTRRs. */ 676 if (type == -1) 677 return mtrr_default_type(mtrr_state); 678 679 /* 680 * We just check one page, partially covered by MTRRs is 681 * impossible. 682 */ 683 WARN_ON(iter.partial_map); 684 685 return type; 686 } 687 EXPORT_SYMBOL_GPL(kvm_mtrr_get_guest_memory_type); 688 689 bool kvm_mtrr_check_gfn_range_consistency(struct kvm_vcpu *vcpu, gfn_t gfn, 690 int page_num) 691 { 692 struct kvm_mtrr *mtrr_state = &vcpu->arch.mtrr_state; 693 struct mtrr_iter iter; 694 u64 start, end; 695 int type = -1; 696 697 start = gfn_to_gpa(gfn); 698 end = gfn_to_gpa(gfn + page_num); 699 mtrr_for_each_mem_type(&iter, mtrr_state, start, end) { 700 if (type == -1) { 701 type = iter.mem_type; 702 continue; 703 } 704 705 if (type != iter.mem_type) 706 return false; 707 } 708 709 if (iter.mtrr_disabled) 710 return true; 711 712 if (!iter.partial_map) 713 return true; 714 715 if (type == -1) 716 return true; 717 718 return type == mtrr_default_type(mtrr_state); 719 } 720