4 * Copyright (C) 2006 Qumranet, Inc.
5 * Copyright 2010 Red Hat, Inc. and/or its affiliates.
6 * Copyright(C) 2015 Intel Corporation.
9 * Yaniv Kamay <yaniv@qumranet.com>
10 * Avi Kivity <avi@qumranet.com>
11 * Marcelo Tosatti <mtosatti@redhat.com>
12 * Paolo Bonzini <pbonzini@redhat.com>
13 * Xiao Guangrong <guangrong.xiao@linux.intel.com>
15 * This work is licensed under the terms of the GNU GPL, version 2. See
16 * the COPYING file in the top-level directory.
19 #include <linux/kvm_host.h>
25 #define IA32_MTRR_DEF_TYPE_E (1ULL << 11)
26 #define IA32_MTRR_DEF_TYPE_FE (1ULL << 10)
27 #define IA32_MTRR_DEF_TYPE_TYPE_MASK (0xff)
29 static bool msr_mtrr_valid(unsigned msr
)
32 case 0x200 ... 0x200 + 2 * KVM_NR_VAR_MTRR
- 1:
33 case MSR_MTRRfix64K_00000
:
34 case MSR_MTRRfix16K_80000
:
35 case MSR_MTRRfix16K_A0000
:
36 case MSR_MTRRfix4K_C0000
:
37 case MSR_MTRRfix4K_C8000
:
38 case MSR_MTRRfix4K_D0000
:
39 case MSR_MTRRfix4K_D8000
:
40 case MSR_MTRRfix4K_E0000
:
41 case MSR_MTRRfix4K_E8000
:
42 case MSR_MTRRfix4K_F0000
:
43 case MSR_MTRRfix4K_F8000
:
53 static bool valid_pat_type(unsigned t
)
55 return t
< 8 && (1 << t
) & 0xf3; /* 0, 1, 4, 5, 6, 7 */
58 static bool valid_mtrr_type(unsigned t
)
60 return t
< 8 && (1 << t
) & 0x73; /* 0, 1, 4, 5, 6 */
63 bool kvm_mtrr_valid(struct kvm_vcpu
*vcpu
, u32 msr
, u64 data
)
68 if (!msr_mtrr_valid(msr
))
71 if (msr
== MSR_IA32_CR_PAT
) {
72 for (i
= 0; i
< 8; i
++)
73 if (!valid_pat_type((data
>> (i
* 8)) & 0xff))
76 } else if (msr
== MSR_MTRRdefType
) {
79 return valid_mtrr_type(data
& 0xff);
80 } else if (msr
>= MSR_MTRRfix64K_00000
&& msr
<= MSR_MTRRfix4K_F8000
) {
81 for (i
= 0; i
< 8 ; i
++)
82 if (!valid_mtrr_type((data
>> (i
* 8)) & 0xff))
88 WARN_ON(!(msr
>= 0x200 && msr
< 0x200 + 2 * KVM_NR_VAR_MTRR
));
90 mask
= (~0ULL) << cpuid_maxphyaddr(vcpu
);
93 if (!valid_mtrr_type(data
& 0xff))
100 kvm_inject_gp(vcpu
, 0);
106 EXPORT_SYMBOL_GPL(kvm_mtrr_valid
);
108 static bool mtrr_is_enabled(struct kvm_mtrr
*mtrr_state
)
110 return !!(mtrr_state
->deftype
& IA32_MTRR_DEF_TYPE_E
);
113 static bool fixed_mtrr_is_enabled(struct kvm_mtrr
*mtrr_state
)
115 return !!(mtrr_state
->deftype
& IA32_MTRR_DEF_TYPE_FE
);
118 static u8
mtrr_default_type(struct kvm_mtrr
*mtrr_state
)
120 return mtrr_state
->deftype
& IA32_MTRR_DEF_TYPE_TYPE_MASK
;
123 static u8
mtrr_disabled_type(struct kvm_vcpu
*vcpu
)
126 * Intel SDM 11.11.2.2: all MTRRs are disabled when
127 * IA32_MTRR_DEF_TYPE.E bit is cleared, and the UC
128 * memory type is applied to all of physical memory.
130 * However, virtual machines can be run with CPUID such that
131 * there are no MTRRs. In that case, the firmware will never
132 * enable MTRRs and it is obviously undesirable to run the
133 * guest entirely with UC memory and we use WB.
135 if (guest_cpuid_has_mtrr(vcpu
))
136 return MTRR_TYPE_UNCACHABLE
;
138 return MTRR_TYPE_WRBACK
;
142 * Three terms are used in the following code:
143 * - segment, it indicates the address segments covered by fixed MTRRs.
144 * - unit, it corresponds to the MSR entry in the segment.
145 * - range, a range is covered in one memory cache type.
147 struct fixed_mtrr_segment
{
153 /* the start position in kvm_mtrr.fixed_ranges[]. */
157 static struct fixed_mtrr_segment fixed_seg_table
[] = {
158 /* MSR_MTRRfix64K_00000, 1 unit. 64K fixed mtrr. */
162 .range_shift
= 16, /* 64K */
167 * MSR_MTRRfix16K_80000 ... MSR_MTRRfix16K_A0000, 2 units,
173 .range_shift
= 14, /* 16K */
178 * MSR_MTRRfix4K_C0000 ... MSR_MTRRfix4K_F8000, 8 units,
184 .range_shift
= 12, /* 12K */
190 * The size of unit is covered in one MSR, one MSR entry contains
191 * 8 ranges so that unit size is always 8 * 2^range_shift.
193 static u64
fixed_mtrr_seg_unit_size(int seg
)
195 return 8 << fixed_seg_table
[seg
].range_shift
;
198 static bool fixed_msr_to_seg_unit(u32 msr
, int *seg
, int *unit
)
201 case MSR_MTRRfix64K_00000
:
205 case MSR_MTRRfix16K_80000
... MSR_MTRRfix16K_A0000
:
207 *unit
= msr
- MSR_MTRRfix16K_80000
;
209 case MSR_MTRRfix4K_C0000
... MSR_MTRRfix4K_F8000
:
211 *unit
= msr
- MSR_MTRRfix4K_C0000
;
220 static void fixed_mtrr_seg_unit_range(int seg
, int unit
, u64
*start
, u64
*end
)
222 struct fixed_mtrr_segment
*mtrr_seg
= &fixed_seg_table
[seg
];
223 u64 unit_size
= fixed_mtrr_seg_unit_size(seg
);
225 *start
= mtrr_seg
->start
+ unit
* unit_size
;
226 *end
= *start
+ unit_size
;
227 WARN_ON(*end
> mtrr_seg
->end
);
230 static int fixed_mtrr_seg_unit_range_index(int seg
, int unit
)
232 struct fixed_mtrr_segment
*mtrr_seg
= &fixed_seg_table
[seg
];
234 WARN_ON(mtrr_seg
->start
+ unit
* fixed_mtrr_seg_unit_size(seg
)
237 /* each unit has 8 ranges. */
238 return mtrr_seg
->range_start
+ 8 * unit
;
241 static int fixed_mtrr_seg_end_range_index(int seg
)
243 struct fixed_mtrr_segment
*mtrr_seg
= &fixed_seg_table
[seg
];
246 n
= (mtrr_seg
->end
- mtrr_seg
->start
) >> mtrr_seg
->range_shift
;
247 return mtrr_seg
->range_start
+ n
- 1;
250 static bool fixed_msr_to_range(u32 msr
, u64
*start
, u64
*end
)
254 if (!fixed_msr_to_seg_unit(msr
, &seg
, &unit
))
257 fixed_mtrr_seg_unit_range(seg
, unit
, start
, end
);
261 static int fixed_msr_to_range_index(u32 msr
)
265 if (!fixed_msr_to_seg_unit(msr
, &seg
, &unit
))
268 return fixed_mtrr_seg_unit_range_index(seg
, unit
);
271 static int fixed_mtrr_addr_to_seg(u64 addr
)
273 struct fixed_mtrr_segment
*mtrr_seg
;
274 int seg
, seg_num
= ARRAY_SIZE(fixed_seg_table
);
276 for (seg
= 0; seg
< seg_num
; seg
++) {
277 mtrr_seg
= &fixed_seg_table
[seg
];
278 if (mtrr_seg
->start
<= addr
&& addr
< mtrr_seg
->end
)
285 static int fixed_mtrr_addr_seg_to_range_index(u64 addr
, int seg
)
287 struct fixed_mtrr_segment
*mtrr_seg
;
290 mtrr_seg
= &fixed_seg_table
[seg
];
291 index
= mtrr_seg
->range_start
;
292 index
+= (addr
- mtrr_seg
->start
) >> mtrr_seg
->range_shift
;
296 static u64
fixed_mtrr_range_end_addr(int seg
, int index
)
298 struct fixed_mtrr_segment
*mtrr_seg
= &fixed_seg_table
[seg
];
299 int pos
= index
- mtrr_seg
->range_start
;
301 return mtrr_seg
->start
+ ((pos
+ 1) << mtrr_seg
->range_shift
);
304 static void var_mtrr_range(struct kvm_mtrr_range
*range
, u64
*start
, u64
*end
)
308 *start
= range
->base
& PAGE_MASK
;
310 mask
= range
->mask
& PAGE_MASK
;
312 /* This cannot overflow because writing to the reserved bits of
313 * variable MTRRs causes a #GP.
315 *end
= (*start
| ~mask
) + 1;
318 static void update_mtrr(struct kvm_vcpu
*vcpu
, u32 msr
)
320 struct kvm_mtrr
*mtrr_state
= &vcpu
->arch
.mtrr_state
;
324 if (msr
== MSR_IA32_CR_PAT
|| !tdp_enabled
||
325 !kvm_arch_has_noncoherent_dma(vcpu
->kvm
))
328 if (!mtrr_is_enabled(mtrr_state
) && msr
!= MSR_MTRRdefType
)
332 if (fixed_msr_to_range(msr
, &start
, &end
)) {
333 if (!fixed_mtrr_is_enabled(mtrr_state
))
335 } else if (msr
== MSR_MTRRdefType
) {
339 /* variable range MTRRs. */
340 index
= (msr
- 0x200) / 2;
341 var_mtrr_range(&mtrr_state
->var_ranges
[index
], &start
, &end
);
344 kvm_zap_gfn_range(vcpu
->kvm
, gpa_to_gfn(start
), gpa_to_gfn(end
));
347 static bool var_mtrr_range_is_valid(struct kvm_mtrr_range
*range
)
349 return (range
->mask
& (1 << 11)) != 0;
352 static void set_var_mtrr_msr(struct kvm_vcpu
*vcpu
, u32 msr
, u64 data
)
354 struct kvm_mtrr
*mtrr_state
= &vcpu
->arch
.mtrr_state
;
355 struct kvm_mtrr_range
*tmp
, *cur
;
356 int index
, is_mtrr_mask
;
358 index
= (msr
- 0x200) / 2;
359 is_mtrr_mask
= msr
- 0x200 - 2 * index
;
360 cur
= &mtrr_state
->var_ranges
[index
];
362 /* remove the entry if it's in the list. */
363 if (var_mtrr_range_is_valid(cur
))
364 list_del(&mtrr_state
->var_ranges
[index
].node
);
366 /* Extend the mask with all 1 bits to the left, since those
367 * bits must implicitly be 0. The bits are then cleared
373 cur
->mask
= data
| (-1LL << cpuid_maxphyaddr(vcpu
));
375 /* add it to the list if it's enabled. */
376 if (var_mtrr_range_is_valid(cur
)) {
377 list_for_each_entry(tmp
, &mtrr_state
->head
, node
)
378 if (cur
->base
>= tmp
->base
)
380 list_add_tail(&cur
->node
, &tmp
->node
);
384 int kvm_mtrr_set_msr(struct kvm_vcpu
*vcpu
, u32 msr
, u64 data
)
388 if (!kvm_mtrr_valid(vcpu
, msr
, data
))
391 index
= fixed_msr_to_range_index(msr
);
393 *(u64
*)&vcpu
->arch
.mtrr_state
.fixed_ranges
[index
] = data
;
394 else if (msr
== MSR_MTRRdefType
)
395 vcpu
->arch
.mtrr_state
.deftype
= data
;
396 else if (msr
== MSR_IA32_CR_PAT
)
397 vcpu
->arch
.pat
= data
;
399 set_var_mtrr_msr(vcpu
, msr
, data
);
401 update_mtrr(vcpu
, msr
);
405 int kvm_mtrr_get_msr(struct kvm_vcpu
*vcpu
, u32 msr
, u64
*pdata
)
409 /* MSR_MTRRcap is a readonly MSR. */
410 if (msr
== MSR_MTRRcap
) {
415 * VCNT = KVM_NR_VAR_MTRR
417 *pdata
= 0x500 | KVM_NR_VAR_MTRR
;
421 if (!msr_mtrr_valid(msr
))
424 index
= fixed_msr_to_range_index(msr
);
426 *pdata
= *(u64
*)&vcpu
->arch
.mtrr_state
.fixed_ranges
[index
];
427 else if (msr
== MSR_MTRRdefType
)
428 *pdata
= vcpu
->arch
.mtrr_state
.deftype
;
429 else if (msr
== MSR_IA32_CR_PAT
)
430 *pdata
= vcpu
->arch
.pat
;
431 else { /* Variable MTRRs */
434 index
= (msr
- 0x200) / 2;
435 is_mtrr_mask
= msr
- 0x200 - 2 * index
;
437 *pdata
= vcpu
->arch
.mtrr_state
.var_ranges
[index
].base
;
439 *pdata
= vcpu
->arch
.mtrr_state
.var_ranges
[index
].mask
;
441 *pdata
&= (1ULL << cpuid_maxphyaddr(vcpu
)) - 1;
447 void kvm_vcpu_mtrr_init(struct kvm_vcpu
*vcpu
)
449 INIT_LIST_HEAD(&vcpu
->arch
.mtrr_state
.head
);
454 struct kvm_mtrr
*mtrr_state
;
460 /* mtrr is completely disabled? */
462 /* [start, end) is not fully covered in MTRRs? */
465 /* private fields. */
467 /* used for fixed MTRRs. */
473 /* used for var MTRRs. */
475 struct kvm_mtrr_range
*range
;
476 /* max address has been covered in var MTRRs. */
484 static bool mtrr_lookup_fixed_start(struct mtrr_iter
*iter
)
488 if (!fixed_mtrr_is_enabled(iter
->mtrr_state
))
491 seg
= fixed_mtrr_addr_to_seg(iter
->start
);
496 index
= fixed_mtrr_addr_seg_to_range_index(iter
->start
, seg
);
502 static bool match_var_range(struct mtrr_iter
*iter
,
503 struct kvm_mtrr_range
*range
)
507 var_mtrr_range(range
, &start
, &end
);
508 if (!(start
>= iter
->end
|| end
<= iter
->start
)) {
512 * the function is called when we do kvm_mtrr.head walking.
513 * Range has the minimum base address which interleaves
514 * [looker->start_max, looker->end).
516 iter
->partial_map
|= iter
->start_max
< start
;
518 /* update the max address has been covered. */
519 iter
->start_max
= max(iter
->start_max
, end
);
526 static void __mtrr_lookup_var_next(struct mtrr_iter
*iter
)
528 struct kvm_mtrr
*mtrr_state
= iter
->mtrr_state
;
530 list_for_each_entry_continue(iter
->range
, &mtrr_state
->head
, node
)
531 if (match_var_range(iter
, iter
->range
))
535 iter
->partial_map
|= iter
->start_max
< iter
->end
;
538 static void mtrr_lookup_var_start(struct mtrr_iter
*iter
)
540 struct kvm_mtrr
*mtrr_state
= iter
->mtrr_state
;
543 iter
->start_max
= iter
->start
;
544 iter
->range
= list_prepare_entry(iter
->range
, &mtrr_state
->head
, node
);
546 __mtrr_lookup_var_next(iter
);
549 static void mtrr_lookup_fixed_next(struct mtrr_iter
*iter
)
551 /* terminate the lookup. */
552 if (fixed_mtrr_range_end_addr(iter
->seg
, iter
->index
) >= iter
->end
) {
560 /* have looked up for all fixed MTRRs. */
561 if (iter
->index
>= ARRAY_SIZE(iter
->mtrr_state
->fixed_ranges
))
562 return mtrr_lookup_var_start(iter
);
564 /* switch to next segment. */
565 if (iter
->index
> fixed_mtrr_seg_end_range_index(iter
->seg
))
569 static void mtrr_lookup_var_next(struct mtrr_iter
*iter
)
571 __mtrr_lookup_var_next(iter
);
574 static void mtrr_lookup_start(struct mtrr_iter
*iter
)
576 if (!mtrr_is_enabled(iter
->mtrr_state
)) {
577 iter
->mtrr_disabled
= true;
581 if (!mtrr_lookup_fixed_start(iter
))
582 mtrr_lookup_var_start(iter
);
585 static void mtrr_lookup_init(struct mtrr_iter
*iter
,
586 struct kvm_mtrr
*mtrr_state
, u64 start
, u64 end
)
588 iter
->mtrr_state
= mtrr_state
;
591 iter
->mtrr_disabled
= false;
592 iter
->partial_map
= false;
596 mtrr_lookup_start(iter
);
599 static bool mtrr_lookup_okay(struct mtrr_iter
*iter
)
602 iter
->mem_type
= iter
->mtrr_state
->fixed_ranges
[iter
->index
];
607 iter
->mem_type
= iter
->range
->base
& 0xff;
614 static void mtrr_lookup_next(struct mtrr_iter
*iter
)
617 mtrr_lookup_fixed_next(iter
);
619 mtrr_lookup_var_next(iter
);
622 #define mtrr_for_each_mem_type(_iter_, _mtrr_, _gpa_start_, _gpa_end_) \
623 for (mtrr_lookup_init(_iter_, _mtrr_, _gpa_start_, _gpa_end_); \
624 mtrr_lookup_okay(_iter_); mtrr_lookup_next(_iter_))
626 u8
kvm_mtrr_get_guest_memory_type(struct kvm_vcpu
*vcpu
, gfn_t gfn
)
628 struct kvm_mtrr
*mtrr_state
= &vcpu
->arch
.mtrr_state
;
629 struct mtrr_iter iter
;
632 const int wt_wb_mask
= (1 << MTRR_TYPE_WRBACK
)
633 | (1 << MTRR_TYPE_WRTHROUGH
);
635 start
= gfn_to_gpa(gfn
);
636 end
= start
+ PAGE_SIZE
;
638 mtrr_for_each_mem_type(&iter
, mtrr_state
, start
, end
) {
639 int curr_type
= iter
.mem_type
;
642 * Please refer to Intel SDM Volume 3: 11.11.4.1 MTRR
652 * If two or more variable memory ranges match and the
653 * memory types are identical, then that memory type is
656 if (type
== curr_type
)
660 * If two or more variable memory ranges match and one of
661 * the memory types is UC, the UC memory type used.
663 if (curr_type
== MTRR_TYPE_UNCACHABLE
)
664 return MTRR_TYPE_UNCACHABLE
;
667 * If two or more variable memory ranges match and the
668 * memory types are WT and WB, the WT memory type is used.
670 if (((1 << type
) & wt_wb_mask
) &&
671 ((1 << curr_type
) & wt_wb_mask
)) {
672 type
= MTRR_TYPE_WRTHROUGH
;
677 * For overlaps not defined by the above rules, processor
678 * behavior is undefined.
681 /* We use WB for this undefined behavior. :( */
682 return MTRR_TYPE_WRBACK
;
685 if (iter
.mtrr_disabled
)
686 return mtrr_disabled_type(vcpu
);
688 /* not contained in any MTRRs. */
690 return mtrr_default_type(mtrr_state
);
693 * We just check one page, partially covered by MTRRs is
696 WARN_ON(iter
.partial_map
);
700 EXPORT_SYMBOL_GPL(kvm_mtrr_get_guest_memory_type
);
702 bool kvm_mtrr_check_gfn_range_consistency(struct kvm_vcpu
*vcpu
, gfn_t gfn
,
705 struct kvm_mtrr
*mtrr_state
= &vcpu
->arch
.mtrr_state
;
706 struct mtrr_iter iter
;
710 start
= gfn_to_gpa(gfn
);
711 end
= gfn_to_gpa(gfn
+ page_num
);
712 mtrr_for_each_mem_type(&iter
, mtrr_state
, start
, end
) {
714 type
= iter
.mem_type
;
718 if (type
!= iter
.mem_type
)
722 if (iter
.mtrr_disabled
)
725 if (!iter
.partial_map
)
731 return type
== mtrr_default_type(mtrr_state
);