[mirror_ubuntu-bionic-kernel.git] / arch / x86 / kvm / mtrr.c

/*
 * vMTRR implementation
 *
 * Copyright (C) 2006 Qumranet, Inc.
 * Copyright 2010 Red Hat, Inc. and/or its affiliates.
 * Copyright(C) 2015 Intel Corporation.
 *
 * Authors:
 *   Yaniv Kamay  <yaniv@qumranet.com>
 *   Avi Kivity   <avi@qumranet.com>
 *   Marcelo Tosatti <mtosatti@redhat.com>
 *   Paolo Bonzini <pbonzini@redhat.com>
 *   Xiao Guangrong <guangrong.xiao@linux.intel.com>
 *
 * This work is licensed under the terms of the GNU GPL, version 2.  See
 * the COPYING file in the top-level directory.
 */

#include <linux/kvm_host.h>
#include <asm/mtrr.h>

#include "cpuid.h"
#include "mmu.h"

#define IA32_MTRR_DEF_TYPE_E		(1ULL << 11)
#define IA32_MTRR_DEF_TYPE_FE		(1ULL << 10)
#define IA32_MTRR_DEF_TYPE_TYPE_MASK	(0xff)

static bool msr_mtrr_valid(unsigned msr)
{
	switch (msr) {
	case 0x200 ... 0x200 + 2 * KVM_NR_VAR_MTRR - 1:
	case MSR_MTRRfix64K_00000:
	case MSR_MTRRfix16K_80000:
	case MSR_MTRRfix16K_A0000:
	case MSR_MTRRfix4K_C0000:
	case MSR_MTRRfix4K_C8000:
	case MSR_MTRRfix4K_D0000:
	case MSR_MTRRfix4K_D8000:
	case MSR_MTRRfix4K_E0000:
	case MSR_MTRRfix4K_E8000:
	case MSR_MTRRfix4K_F0000:
	case MSR_MTRRfix4K_F8000:
	case MSR_MTRRdefType:
	case MSR_IA32_CR_PAT:
		return true;
	case 0x2f8:
		return true;
	}
	return false;
}

static bool valid_pat_type(unsigned t)
{
	return t < 8 && (1 << t) & 0xf3; /* 0, 1, 4, 5, 6, 7 */
}

static bool valid_mtrr_type(unsigned t)
{
	return t < 8 && (1 << t) & 0x73; /* 0, 1, 4, 5, 6 */
}

bool kvm_mtrr_valid(struct kvm_vcpu *vcpu, u32 msr, u64 data)
{
	int i;
	u64 mask;

	if (!msr_mtrr_valid(msr))
		return false;

	if (msr == MSR_IA32_CR_PAT) {
		for (i = 0; i < 8; i++)
			if (!valid_pat_type((data >> (i * 8)) & 0xff))
				return false;
		return true;
	} else if (msr == MSR_MTRRdefType) {
		if (data & ~0xcff)
			return false;
		return valid_mtrr_type(data & 0xff);
	} else if (msr >= MSR_MTRRfix64K_00000 && msr <= MSR_MTRRfix4K_F8000) {
		for (i = 0; i < 8 ; i++)
			if (!valid_mtrr_type((data >> (i * 8)) & 0xff))
				return false;
		return true;
	}

	/* variable MTRRs */
	WARN_ON(!(msr >= 0x200 && msr < 0x200 + 2 * KVM_NR_VAR_MTRR));

	mask = (~0ULL) << cpuid_maxphyaddr(vcpu);
	if ((msr & 1) == 0) {
		/* MTRR base */
		if (!valid_mtrr_type(data & 0xff))
			return false;
		mask |= 0xf00;
	} else
		/* MTRR mask */
		mask |= 0x7ff;
	if (data & mask) {
		kvm_inject_gp(vcpu, 0);
		return false;
	}

	return true;
}
EXPORT_SYMBOL_GPL(kvm_mtrr_valid);

static bool mtrr_is_enabled(struct kvm_mtrr *mtrr_state)
{
	return !!(mtrr_state->deftype & IA32_MTRR_DEF_TYPE_E);
}

static bool fixed_mtrr_is_enabled(struct kvm_mtrr *mtrr_state)
{
	return !!(mtrr_state->deftype & IA32_MTRR_DEF_TYPE_FE);
}

static u8 mtrr_default_type(struct kvm_mtrr *mtrr_state)
{
	return mtrr_state->deftype & IA32_MTRR_DEF_TYPE_TYPE_MASK;
}

static u8 mtrr_disabled_type(void)
{
	/*
	 * Intel SDM 11.11.2.2: all MTRRs are disabled when
	 * IA32_MTRR_DEF_TYPE.E bit is cleared, and the UC
	 * memory type is applied to all of physical memory.
	 */
	return MTRR_TYPE_UNCACHABLE;
}

/*
* Three terms are used in the following code:
* - segment, it indicates the address segments covered by fixed MTRRs.
* - unit, it corresponds to the MSR entry in the segment.
* - range, a range is covered in one memory cache type.
*/
struct fixed_mtrr_segment {
	u64 start;
	u64 end;

	int range_shift;

	/* the start position in kvm_mtrr.fixed_ranges[]. */
	int range_start;
};

static struct fixed_mtrr_segment fixed_seg_table[] = {
	/* MSR_MTRRfix64K_00000, 1 unit. 64K fixed mtrr. */
	{
		.start = 0x0,
		.end = 0x80000,
		.range_shift = 16, /* 64K */
		.range_start = 0,
	},

	/*
	 * MSR_MTRRfix16K_80000 ... MSR_MTRRfix16K_A0000, 2 units,
	 * 16K fixed mtrr.
	 */
	{
		.start = 0x80000,
		.end = 0xc0000,
		.range_shift = 14, /* 16K */
		.range_start = 8,
	},

	/*
	 * MSR_MTRRfix4K_C0000 ... MSR_MTRRfix4K_F8000, 8 units,
	 * 4K fixed mtrr.
	 */
	{
		.start = 0xc0000,
		.end = 0x100000,
		.range_shift = 12, /* 12K */
		.range_start = 24,
	}
};

/*
 * The size of unit is covered in one MSR, one MSR entry contains
 * 8 ranges so that unit size is always 8 * 2^range_shift.
 */
static u64 fixed_mtrr_seg_unit_size(int seg)
{
	return 8 << fixed_seg_table[seg].range_shift;
}

static bool fixed_msr_to_seg_unit(u32 msr, int *seg, int *unit)
{
	switch (msr) {
	case MSR_MTRRfix64K_00000:
		*seg = 0;
		*unit = 0;
		break;
	case MSR_MTRRfix16K_80000 ... MSR_MTRRfix16K_A0000:
		*seg = 1;
		*unit = msr - MSR_MTRRfix16K_80000;
		break;
	case MSR_MTRRfix4K_C0000 ... MSR_MTRRfix4K_F8000:
		*seg = 2;
		*unit = msr - MSR_MTRRfix4K_C0000;
		break;
	default:
		return false;
	}

	return true;
}

static void fixed_mtrr_seg_unit_range(int seg, int unit, u64 *start, u64 *end)
{
	struct fixed_mtrr_segment *mtrr_seg = &fixed_seg_table[seg];
	u64 unit_size = fixed_mtrr_seg_unit_size(seg);

	*start = mtrr_seg->start + unit * unit_size;
	*end = *start + unit_size;
	WARN_ON(*end > mtrr_seg->end);
}

static int fixed_mtrr_seg_unit_range_index(int seg, int unit)
{
	struct fixed_mtrr_segment *mtrr_seg = &fixed_seg_table[seg];

	WARN_ON(mtrr_seg->start + unit * fixed_mtrr_seg_unit_size(seg)
		> mtrr_seg->end);

	/* each unit has 8 ranges. */
	return mtrr_seg->range_start + 8 * unit;
}

static int fixed_mtrr_seg_end_range_index(int seg)
{
	struct fixed_mtrr_segment *mtrr_seg = &fixed_seg_table[seg];
	int n;

	n = (mtrr_seg->end - mtrr_seg->start) >> mtrr_seg->range_shift;
	return mtrr_seg->range_start + n - 1;
}

static bool fixed_msr_to_range(u32 msr, u64 *start, u64 *end)
{
	int seg, unit;

	if (!fixed_msr_to_seg_unit(msr, &seg, &unit))
		return false;

	fixed_mtrr_seg_unit_range(seg, unit, start, end);
	return true;
}

static int fixed_msr_to_range_index(u32 msr)
{
	int seg, unit;

	if (!fixed_msr_to_seg_unit(msr, &seg, &unit))
		return -1;

	return fixed_mtrr_seg_unit_range_index(seg, unit);
}

static int fixed_mtrr_addr_to_seg(u64 addr)
{
	struct fixed_mtrr_segment *mtrr_seg;
	int seg, seg_num = ARRAY_SIZE(fixed_seg_table);

	for (seg = 0; seg < seg_num; seg++) {
		mtrr_seg = &fixed_seg_table[seg];
		if (mtrr_seg->start >= addr && addr < mtrr_seg->end)
			return seg;
	}

	return -1;
}

static int fixed_mtrr_addr_seg_to_range_index(u64 addr, int seg)
{
	struct fixed_mtrr_segment *mtrr_seg;
	int index;

	mtrr_seg = &fixed_seg_table[seg];
	index = mtrr_seg->range_start;
	index += (addr - mtrr_seg->start) >> mtrr_seg->range_shift;
	return index;
}

static u64 fixed_mtrr_range_end_addr(int seg, int index)
{
	struct fixed_mtrr_segment *mtrr_seg = &fixed_seg_table[seg];
	int pos = index - mtrr_seg->range_start;

	return mtrr_seg->start + ((pos + 1) << mtrr_seg->range_shift);
}

static void var_mtrr_range(struct kvm_mtrr_range *range, u64 *start, u64 *end)
{
	u64 mask;

	*start = range->base & PAGE_MASK;

	mask = range->mask & PAGE_MASK;
	mask |= ~0ULL << boot_cpu_data.x86_phys_bits;

	/* This cannot overflow because writing to the reserved bits of
	 * variable MTRRs causes a #GP.
	 */
	*end = (*start | ~mask) + 1;
}

static void update_mtrr(struct kvm_vcpu *vcpu, u32 msr)
{
	struct kvm_mtrr *mtrr_state = &vcpu->arch.mtrr_state;
	gfn_t start, end;
	int index;

	if (msr == MSR_IA32_CR_PAT || !tdp_enabled ||
	      !kvm_arch_has_noncoherent_dma(vcpu->kvm))
		return;

	if (!mtrr_is_enabled(mtrr_state) && msr != MSR_MTRRdefType)
		return;

	/* fixed MTRRs. */
	if (fixed_msr_to_range(msr, &start, &end)) {
		if (!fixed_mtrr_is_enabled(mtrr_state))
			return;
	} else if (msr == MSR_MTRRdefType) {
		start = 0x0;
		end = ~0ULL;
	} else {
		/* variable range MTRRs. */
		index = (msr - 0x200) / 2;
		var_mtrr_range(&mtrr_state->var_ranges[index], &start, &end);
	}

	kvm_zap_gfn_range(vcpu->kvm, gpa_to_gfn(start), gpa_to_gfn(end));
}

static bool var_mtrr_range_is_valid(struct kvm_mtrr_range *range)
{
	return (range->mask & (1 << 11)) != 0;
}

static void set_var_mtrr_msr(struct kvm_vcpu *vcpu, u32 msr, u64 data)
{
	struct kvm_mtrr *mtrr_state = &vcpu->arch.mtrr_state;
	struct kvm_mtrr_range *tmp, *cur;
	int index, is_mtrr_mask;

	index = (msr - 0x200) / 2;
	is_mtrr_mask = msr - 0x200 - 2 * index;
	cur = &mtrr_state->var_ranges[index];

	/* remove the entry if it's in the list. */
	if (var_mtrr_range_is_valid(cur))
		list_del(&mtrr_state->var_ranges[index].node);

	if (!is_mtrr_mask)
		cur->base = data;
	else
		cur->mask = data;

	/* add it to the list if it's enabled. */
	if (var_mtrr_range_is_valid(cur)) {
		list_for_each_entry(tmp, &mtrr_state->head, node)
			if (cur->base >= tmp->base)
				break;
		list_add_tail(&cur->node, &tmp->node);
	}
}

int kvm_mtrr_set_msr(struct kvm_vcpu *vcpu, u32 msr, u64 data)
{
	int index;

	if (!kvm_mtrr_valid(vcpu, msr, data))
		return 1;

	index = fixed_msr_to_range_index(msr);
	if (index >= 0)
		*(u64 *)&vcpu->arch.mtrr_state.fixed_ranges[index] = data;
	else if (msr == MSR_MTRRdefType)
		vcpu->arch.mtrr_state.deftype = data;
	else if (msr == MSR_IA32_CR_PAT)
		vcpu->arch.pat = data;
	else
		set_var_mtrr_msr(vcpu, msr, data);

	update_mtrr(vcpu, msr);
	return 0;
}

int kvm_mtrr_get_msr(struct kvm_vcpu *vcpu, u32 msr, u64 *pdata)
{
	int index;

	/* MSR_MTRRcap is a readonly MSR. */
	if (msr == MSR_MTRRcap) {
		/*
		 * SMRR = 0
		 * WC = 1
		 * FIX = 1
		 * VCNT = KVM_NR_VAR_MTRR
		 */
		*pdata = 0x500 | KVM_NR_VAR_MTRR;
		return 0;
	}

	if (!msr_mtrr_valid(msr))
		return 1;

	index = fixed_msr_to_range_index(msr);
	if (index >= 0)
		*pdata = *(u64 *)&vcpu->arch.mtrr_state.fixed_ranges[index];
	else if (msr == MSR_MTRRdefType)
		*pdata = vcpu->arch.mtrr_state.deftype;
	else if (msr == MSR_IA32_CR_PAT)
		*pdata = vcpu->arch.pat;
	else {	/* Variable MTRRs */
		int is_mtrr_mask;

		index = (msr - 0x200) / 2;
		is_mtrr_mask = msr - 0x200 - 2 * index;
		if (!is_mtrr_mask)
			*pdata = vcpu->arch.mtrr_state.var_ranges[index].base;
		else
			*pdata = vcpu->arch.mtrr_state.var_ranges[index].mask;
	}

	return 0;
}

void kvm_vcpu_mtrr_init(struct kvm_vcpu *vcpu)
{
	INIT_LIST_HEAD(&vcpu->arch.mtrr_state.head);
}

struct mtrr_iter {
	/* input fields. */
	struct kvm_mtrr *mtrr_state;
	u64 start;
	u64 end;

	/* output fields. */
	int mem_type;
	/* mtrr is completely disabled? */
	bool mtrr_disabled;
	/* [start, end) is not fully covered in MTRRs? */
	bool partial_map;

	/* private fields. */
	union {
		/* used for fixed MTRRs. */
		struct {
			int index;
			int seg;
		};

		/* used for var MTRRs. */
		struct {
			struct kvm_mtrr_range *range;
			/* max address has been covered in var MTRRs. */
			u64 start_max;
		};
	};

	bool fixed;
};

static bool mtrr_lookup_fixed_start(struct mtrr_iter *iter)
{
	int seg, index;

	if (!fixed_mtrr_is_enabled(iter->mtrr_state))
		return false;

	seg = fixed_mtrr_addr_to_seg(iter->start);
	if (seg < 0)
		return false;

	iter->fixed = true;
	index = fixed_mtrr_addr_seg_to_range_index(iter->start, seg);
	iter->index = index;
	iter->seg = seg;
	return true;
}

static bool match_var_range(struct mtrr_iter *iter,
			    struct kvm_mtrr_range *range)
{
	u64 start, end;

	var_mtrr_range(range, &start, &end);
	if (!(start >= iter->end || end <= iter->start)) {
		iter->range = range;

		/*
		 * the function is called when we do kvm_mtrr.head walking.
		 * Range has the minimum base address which interleaves
		 * [looker->start_max, looker->end).
		 */
		iter->partial_map |= iter->start_max < start;

		/* update the max address has been covered. */
		iter->start_max = max(iter->start_max, end);
		return true;
	}

	return false;
}

static void __mtrr_lookup_var_next(struct mtrr_iter *iter)
{
	struct kvm_mtrr *mtrr_state = iter->mtrr_state;

	list_for_each_entry_continue(iter->range, &mtrr_state->head, node)
		if (match_var_range(iter, iter->range))
			return;

	iter->range = NULL;
	iter->partial_map |= iter->start_max < iter->end;
}

static void mtrr_lookup_var_start(struct mtrr_iter *iter)
{
	struct kvm_mtrr *mtrr_state = iter->mtrr_state;

	iter->fixed = false;
	iter->start_max = iter->start;
	iter->range = list_prepare_entry(iter->range, &mtrr_state->head, node);

	__mtrr_lookup_var_next(iter);
}

static void mtrr_lookup_fixed_next(struct mtrr_iter *iter)
{
	/* terminate the lookup. */
	if (fixed_mtrr_range_end_addr(iter->seg, iter->index) >= iter->end) {
		iter->fixed = false;
		iter->range = NULL;
		return;
	}

	iter->index++;

	/* have looked up for all fixed MTRRs. */
	if (iter->index >= ARRAY_SIZE(iter->mtrr_state->fixed_ranges))
		return mtrr_lookup_var_start(iter);

	/* switch to next segment. */
	if (iter->index > fixed_mtrr_seg_end_range_index(iter->seg))
		iter->seg++;
}

static void mtrr_lookup_var_next(struct mtrr_iter *iter)
{
	__mtrr_lookup_var_next(iter);
}

static void mtrr_lookup_start(struct mtrr_iter *iter)
{
	if (!mtrr_is_enabled(iter->mtrr_state)) {
		iter->mtrr_disabled = true;
		return;
	}

	if (!mtrr_lookup_fixed_start(iter))
		mtrr_lookup_var_start(iter);
}

static void mtrr_lookup_init(struct mtrr_iter *iter,
			     struct kvm_mtrr *mtrr_state, u64 start, u64 end)
{
	iter->mtrr_state = mtrr_state;
	iter->start = start;
	iter->end = end;
	iter->mtrr_disabled = false;
	iter->partial_map = false;
	iter->fixed = false;
	iter->range = NULL;

	mtrr_lookup_start(iter);
}

static bool mtrr_lookup_okay(struct mtrr_iter *iter)
{
	if (iter->fixed) {
		iter->mem_type = iter->mtrr_state->fixed_ranges[iter->index];
		return true;
	}

	if (iter->range) {
		iter->mem_type = iter->range->base & 0xff;
		return true;
	}

	return false;
}

static void mtrr_lookup_next(struct mtrr_iter *iter)
{
	if (iter->fixed)
		mtrr_lookup_fixed_next(iter);
	else
		mtrr_lookup_var_next(iter);
}

#define mtrr_for_each_mem_type(_iter_, _mtrr_, _gpa_start_, _gpa_end_) \
	for (mtrr_lookup_init(_iter_, _mtrr_, _gpa_start_, _gpa_end_); \
	     mtrr_lookup_okay(_iter_); mtrr_lookup_next(_iter_))

u8 kvm_mtrr_get_guest_memory_type(struct kvm_vcpu *vcpu, gfn_t gfn)
{
	struct kvm_mtrr *mtrr_state = &vcpu->arch.mtrr_state;
	struct mtrr_iter iter;
	u64 start, end;
	int type = -1;
	const int wt_wb_mask = (1 << MTRR_TYPE_WRBACK)
			       | (1 << MTRR_TYPE_WRTHROUGH);

	start = gfn_to_gpa(gfn);
	end = start + PAGE_SIZE;

	mtrr_for_each_mem_type(&iter, mtrr_state, start, end) {
		int curr_type = iter.mem_type;

		/*
		 * Please refer to Intel SDM Volume 3: 11.11.4.1 MTRR
		 * Precedences.
		 */

		if (type == -1) {
			type = curr_type;
			continue;
		}

		/*
		 * If two or more variable memory ranges match and the
		 * memory types are identical, then that memory type is
		 * used.
		 */
		if (type == curr_type)
			continue;

		/*
		 * If two or more variable memory ranges match and one of
		 * the memory types is UC, the UC memory type used.
		 */
		if (curr_type == MTRR_TYPE_UNCACHABLE)
			return MTRR_TYPE_UNCACHABLE;

		/*
		 * If two or more variable memory ranges match and the
		 * memory types are WT and WB, the WT memory type is used.
		 */
		if (((1 << type) & wt_wb_mask) &&
		      ((1 << curr_type) & wt_wb_mask)) {
			type = MTRR_TYPE_WRTHROUGH;
			continue;
		}

		/*
		 * For overlaps not defined by the above rules, processor
		 * behavior is undefined.
		 */

		/* We use WB for this undefined behavior. :( */
		return MTRR_TYPE_WRBACK;
	}

	if (iter.mtrr_disabled)
		return mtrr_disabled_type();

	/* It is not covered by MTRRs. */
	if (iter.partial_map) {
		/*
		 * We just check one page, partially covered by MTRRs is
		 * impossible.
		 */
		WARN_ON(type != -1);
		type = mtrr_default_type(mtrr_state);
	}
	return type;
}
EXPORT_SYMBOL_GPL(kvm_mtrr_get_guest_memory_type);

bool kvm_mtrr_check_gfn_range_consistency(struct kvm_vcpu *vcpu, gfn_t gfn,
					  int page_num)
{
	struct kvm_mtrr *mtrr_state = &vcpu->arch.mtrr_state;
	struct mtrr_iter iter;
	u64 start, end;
	int type = -1;

	start = gfn_to_gpa(gfn);
	end = gfn_to_gpa(gfn + page_num);
	mtrr_for_each_mem_type(&iter, mtrr_state, start, end) {
		if (type == -1) {
			type = iter.mem_type;
			continue;
		}

		if (type != iter.mem_type)
			return false;
	}

	if (iter.mtrr_disabled)
		return true;

	if (!iter.partial_map)
		return true;

	if (type == -1)
		return true;

	return type == mtrr_default_type(mtrr_state);
}
Commit	Line	Data
ff53604b XG	1	/*
	2	* vMTRR implementation
	3	*
	4	* Copyright (C) 2006 Qumranet, Inc.
	5	* Copyright 2010 Red Hat, Inc. and/or its affiliates.
	6	* Copyright(C) 2015 Intel Corporation.
	7	*
	8	* Authors:
	9	* Yaniv Kamay <yaniv@qumranet.com>
	10	* Avi Kivity <avi@qumranet.com>
	11	* Marcelo Tosatti <mtosatti@redhat.com>
	12	* Paolo Bonzini <pbonzini@redhat.com>
	13	* Xiao Guangrong <guangrong.xiao@linux.intel.com>
	14	*
	15	* This work is licensed under the terms of the GNU GPL, version 2. See
	16	* the COPYING file in the top-level directory.
	17	*/
	18
	19	#include <linux/kvm_host.h>
	20	#include <asm/mtrr.h>
	21
	22	#include "cpuid.h"
	23	#include "mmu.h"
	24
10fac2dc XG	25	#define IA32_MTRR_DEF_TYPE_E (1ULL << 11)
	26	#define IA32_MTRR_DEF_TYPE_FE (1ULL << 10)
	27	#define IA32_MTRR_DEF_TYPE_TYPE_MASK (0xff)
	28
ff53604b XG	29	static bool msr_mtrr_valid(unsigned msr)
	30	{
	31	switch (msr) {
	32	case 0x200 ... 0x200 + 2 * KVM_NR_VAR_MTRR - 1:
	33	case MSR_MTRRfix64K_00000:
	34	case MSR_MTRRfix16K_80000:
	35	case MSR_MTRRfix16K_A0000:
	36	case MSR_MTRRfix4K_C0000:
	37	case MSR_MTRRfix4K_C8000:
	38	case MSR_MTRRfix4K_D0000:
	39	case MSR_MTRRfix4K_D8000:
	40	case MSR_MTRRfix4K_E0000:
	41	case MSR_MTRRfix4K_E8000:
	42	case MSR_MTRRfix4K_F0000:
	43	case MSR_MTRRfix4K_F8000:
	44	case MSR_MTRRdefType:
	45	case MSR_IA32_CR_PAT:
	46	return true;
	47	case 0x2f8:
	48	return true;
	49	}
	50	return false;
	51	}
	52
	53	static bool valid_pat_type(unsigned t)
	54	{
	55	return t < 8 && (1 << t) & 0xf3; /* 0, 1, 4, 5, 6, 7 */
	56	}
	57
	58	static bool valid_mtrr_type(unsigned t)
	59	{
	60	return t < 8 && (1 << t) & 0x73; /* 0, 1, 4, 5, 6 */
	61	}
	62
	63	bool kvm_mtrr_valid(struct kvm_vcpu *vcpu, u32 msr, u64 data)
	64	{
	65	int i;
	66	u64 mask;
	67
	68	if (!msr_mtrr_valid(msr))
	69	return false;
	70
	71	if (msr == MSR_IA32_CR_PAT) {
	72	for (i = 0; i < 8; i++)
	73	if (!valid_pat_type((data >> (i * 8)) & 0xff))
	74	return false;
	75	return true;
	76	} else if (msr == MSR_MTRRdefType) {
	77	if (data & ~0xcff)
	78	return false;
	79	return valid_mtrr_type(data & 0xff);
	80	} else if (msr >= MSR_MTRRfix64K_00000 && msr <= MSR_MTRRfix4K_F8000) {
	81	for (i = 0; i < 8 ; i++)
	82	if (!valid_mtrr_type((data >> (i * 8)) & 0xff))
	83	return false;
	84	return true;
	85	}
	86
	87	/* variable MTRRs */
	88	WARN_ON(!(msr >= 0x200 && msr < 0x200 + 2 * KVM_NR_VAR_MTRR));
	89
	90	mask = (~0ULL) << cpuid_maxphyaddr(vcpu);
	91	if ((msr & 1) == 0) {
	92	/* MTRR base */
93	if (!valid_mtrr_type(data & 0xff))
94	return false;
95	mask \|= 0xf00;
96	} else
97	/* MTRR mask */
98	mask \|= 0x7ff;
99	if (data & mask) {
100	kvm_inject_gp(vcpu, 0);
101	return false;
102	}
103
104	return true;
105	}
106	EXPORT_SYMBOL_GPL(kvm_mtrr_valid);
107
10fac2dc XG	108	static bool mtrr_is_enabled(struct kvm_mtrr *mtrr_state)
	109	{
	110	return !!(mtrr_state->deftype & IA32_MTRR_DEF_TYPE_E);
	111	}
	112
	113	static bool fixed_mtrr_is_enabled(struct kvm_mtrr *mtrr_state)
	114	{
	115	return !!(mtrr_state->deftype & IA32_MTRR_DEF_TYPE_FE);
	116	}
	117
	118	static u8 mtrr_default_type(struct kvm_mtrr *mtrr_state)
	119	{
	120	return mtrr_state->deftype & IA32_MTRR_DEF_TYPE_TYPE_MASK;
	121	}
	122
10dc331f XG	123	static u8 mtrr_disabled_type(void)
	124	{
	125	/*
	126	* Intel SDM 11.11.2.2: all MTRRs are disabled when
	127	* IA32_MTRR_DEF_TYPE.E bit is cleared, and the UC
	128	* memory type is applied to all of physical memory.
	129	*/
	130	return MTRR_TYPE_UNCACHABLE;
	131	}
	132
de9aef5e XG	133	/*
	134	* Three terms are used in the following code:
	135	* - segment, it indicates the address segments covered by fixed MTRRs.
	136	* - unit, it corresponds to the MSR entry in the segment.
	137	* - range, a range is covered in one memory cache type.
	138	*/
	139	struct fixed_mtrr_segment {
	140	u64 start;
	141	u64 end;
	142
	143	int range_shift;
	144
	145	/* the start position in kvm_mtrr.fixed_ranges[]. */
	146	int range_start;
	147	};
	148
	149	static struct fixed_mtrr_segment fixed_seg_table[] = {
	150	/* MSR_MTRRfix64K_00000, 1 unit. 64K fixed mtrr. */
	151	{
	152	.start = 0x0,
	153	.end = 0x80000,
	154	.range_shift = 16, /* 64K */
	155	.range_start = 0,
	156	},
	157
	158	/*
	159	* MSR_MTRRfix16K_80000 ... MSR_MTRRfix16K_A0000, 2 units,
	160	* 16K fixed mtrr.
	161	*/
	162	{
	163	.start = 0x80000,
	164	.end = 0xc0000,
	165	.range_shift = 14, /* 16K */
	166	.range_start = 8,
	167	},
	168
	169	/*
	170	* MSR_MTRRfix4K_C0000 ... MSR_MTRRfix4K_F8000, 8 units,
	171	* 4K fixed mtrr.
	172	*/
	173	{
	174	.start = 0xc0000,
	175	.end = 0x100000,
	176	.range_shift = 12, /* 12K */
	177	.range_start = 24,
	178	}
	179	};
	180
	181	/*
	182	* The size of unit is covered in one MSR, one MSR entry contains
	183	* 8 ranges so that unit size is always 8 * 2^range_shift.
	184	*/
	185	static u64 fixed_mtrr_seg_unit_size(int seg)
	186	{
	187	return 8 << fixed_seg_table[seg].range_shift;
	188	}
	189
	190	static bool fixed_msr_to_seg_unit(u32 msr, int seg, int unit)
	191	{
	192	switch (msr) {
	193	case MSR_MTRRfix64K_00000:
	194	*seg = 0;
	195	*unit = 0;
	196	break;
197	case MSR_MTRRfix16K_80000 ... MSR_MTRRfix16K_A0000:
198	*seg = 1;
199	*unit = msr - MSR_MTRRfix16K_80000;
200	break;
201	case MSR_MTRRfix4K_C0000 ... MSR_MTRRfix4K_F8000:
202	*seg = 2;
203	*unit = msr - MSR_MTRRfix4K_C0000;
204	break;
205	default:
206	return false;
207	}
208
209	return true;
210	}
211
212	static void fixed_mtrr_seg_unit_range(int seg, int unit, u64 start, u64 end)
213	{
214	struct fixed_mtrr_segment *mtrr_seg = &fixed_seg_table[seg];
215	u64 unit_size = fixed_mtrr_seg_unit_size(seg);
216
217	start = mtrr_seg->start + unit unit_size;
218	end = start + unit_size;
219	WARN_ON(*end > mtrr_seg->end);
220	}
221
222	static int fixed_mtrr_seg_unit_range_index(int seg, int unit)
223	{
224	struct fixed_mtrr_segment *mtrr_seg = &fixed_seg_table[seg];
225
226	WARN_ON(mtrr_seg->start + unit * fixed_mtrr_seg_unit_size(seg)
227	> mtrr_seg->end);
228
229	/* each unit has 8 ranges. */
230	return mtrr_seg->range_start + 8 * unit;
231	}
232
f571c097 XG	233	static int fixed_mtrr_seg_end_range_index(int seg)
	234	{
	235	struct fixed_mtrr_segment *mtrr_seg = &fixed_seg_table[seg];
	236	int n;
	237
	238	n = (mtrr_seg->end - mtrr_seg->start) >> mtrr_seg->range_shift;
	239	return mtrr_seg->range_start + n - 1;
	240	}
	241
de9aef5e XG	242	static bool fixed_msr_to_range(u32 msr, u64 start, u64 end)
	243	{
	244	int seg, unit;
	245
	246	if (!fixed_msr_to_seg_unit(msr, &seg, &unit))
	247	return false;
	248
	249	fixed_mtrr_seg_unit_range(seg, unit, start, end);
	250	return true;
	251	}
	252
	253	static int fixed_msr_to_range_index(u32 msr)
	254	{
	255	int seg, unit;
	256
	257	if (!fixed_msr_to_seg_unit(msr, &seg, &unit))
	258	return -1;
	259
	260	return fixed_mtrr_seg_unit_range_index(seg, unit);
	261	}
	262
f7bfb57b XG	263	static int fixed_mtrr_addr_to_seg(u64 addr)
	264	{
	265	struct fixed_mtrr_segment *mtrr_seg;
	266	int seg, seg_num = ARRAY_SIZE(fixed_seg_table);
	267
	268	for (seg = 0; seg < seg_num; seg++) {
	269	mtrr_seg = &fixed_seg_table[seg];
	270	if (mtrr_seg->start >= addr && addr < mtrr_seg->end)
	271	return seg;
	272	}
	273
	274	return -1;
	275	}
	276
	277	static int fixed_mtrr_addr_seg_to_range_index(u64 addr, int seg)
	278	{
	279	struct fixed_mtrr_segment *mtrr_seg;
	280	int index;
	281
	282	mtrr_seg = &fixed_seg_table[seg];
	283	index = mtrr_seg->range_start;
	284	index += (addr - mtrr_seg->start) >> mtrr_seg->range_shift;
	285	return index;
	286	}
	287
f571c097 XG	288	static u64 fixed_mtrr_range_end_addr(int seg, int index)
	289	{
	290	struct fixed_mtrr_segment *mtrr_seg = &fixed_seg_table[seg];
	291	int pos = index - mtrr_seg->range_start;
	292
	293	return mtrr_seg->start + ((pos + 1) << mtrr_seg->range_shift);
	294	}
	295
a13842dc XG	296	static void var_mtrr_range(struct kvm_mtrr_range range, u64 start, u64 *end)
	297	{
	298	u64 mask;
	299
	300	*start = range->base & PAGE_MASK;
	301
	302	mask = range->mask & PAGE_MASK;
	303	mask \|= ~0ULL << boot_cpu_data.x86_phys_bits;
	304
	305	/* This cannot overflow because writing to the reserved bits of
	306	* variable MTRRs causes a #GP.
	307	*/
	308	end = (start \| ~mask) + 1;
	309	}
	310
ff53604b XG	311	static void update_mtrr(struct kvm_vcpu *vcpu, u32 msr)
ff53604b XG	312	{
70109e7d	313	struct kvm_mtrr *mtrr_state = &vcpu->arch.mtrr_state;
a13842dc	314	gfn_t start, end;
ff53604b	315	int index;
ff53604b XG	316
	317	if (msr == MSR_IA32_CR_PAT \|\| !tdp_enabled \|\|
	318	!kvm_arch_has_noncoherent_dma(vcpu->kvm))
	319	return;
	320
10fac2dc	321	if (!mtrr_is_enabled(mtrr_state) && msr != MSR_MTRRdefType)
ff53604b XG	322	return;
ff53604b XG	323
de9aef5e XG	324	/* fixed MTRRs. */
	325	if (fixed_msr_to_range(msr, &start, &end)) {
	326	if (!fixed_mtrr_is_enabled(mtrr_state))
	327	return;
	328	} else if (msr == MSR_MTRRdefType) {
ff53604b XG	329	start = 0x0;
ff53604b XG	330	end = ~0ULL;
de9aef5e	331	} else {
ff53604b	332	/* variable range MTRRs. */
ff53604b	333	index = (msr - 0x200) / 2;
a13842dc	334	var_mtrr_range(&mtrr_state->var_ranges[index], &start, &end);
ff53604b XG	335	}
ff53604b XG	336
ff53604b XG	337	kvm_zap_gfn_range(vcpu->kvm, gpa_to_gfn(start), gpa_to_gfn(end));
	338	}
	339
19efffa2 XG	340	static bool var_mtrr_range_is_valid(struct kvm_mtrr_range *range)
	341	{
	342	return (range->mask & (1 << 11)) != 0;
	343	}
	344
	345	static void set_var_mtrr_msr(struct kvm_vcpu *vcpu, u32 msr, u64 data)
	346	{
	347	struct kvm_mtrr *mtrr_state = &vcpu->arch.mtrr_state;
	348	struct kvm_mtrr_range tmp, cur;
	349	int index, is_mtrr_mask;
	350
	351	index = (msr - 0x200) / 2;
	352	is_mtrr_mask = msr - 0x200 - 2 * index;
	353	cur = &mtrr_state->var_ranges[index];
	354
	355	/* remove the entry if it's in the list. */
	356	if (var_mtrr_range_is_valid(cur))
	357	list_del(&mtrr_state->var_ranges[index].node);
	358
	359	if (!is_mtrr_mask)
	360	cur->base = data;
	361	else
	362	cur->mask = data;
	363
	364	/* add it to the list if it's enabled. */
	365	if (var_mtrr_range_is_valid(cur)) {
	366	list_for_each_entry(tmp, &mtrr_state->head, node)
	367	if (cur->base >= tmp->base)
	368	break;
	369	list_add_tail(&cur->node, &tmp->node);
	370	}
	371	}
	372
ff53604b XG	373	int kvm_mtrr_set_msr(struct kvm_vcpu *vcpu, u32 msr, u64 data)
ff53604b XG	374	{
de9aef5e	375	int index;
ff53604b XG	376
	377	if (!kvm_mtrr_valid(vcpu, msr, data))
	378	return 1;
	379
de9aef5e XG	380	index = fixed_msr_to_range_index(msr);
	381	if (index >= 0)
	382	(u64 )&vcpu->arch.mtrr_state.fixed_ranges[index] = data;
	383	else if (msr == MSR_MTRRdefType)
10fac2dc	384	vcpu->arch.mtrr_state.deftype = data;
ff53604b XG	385	else if (msr == MSR_IA32_CR_PAT)
ff53604b XG	386	vcpu->arch.pat = data;
19efffa2 XG	387	else
19efffa2 XG	388	set_var_mtrr_msr(vcpu, msr, data);
ff53604b XG	389
	390	update_mtrr(vcpu, msr);
	391	return 0;
	392	}
	393
	394	int kvm_mtrr_get_msr(struct kvm_vcpu vcpu, u32 msr, u64 pdata)
	395	{
de9aef5e	396	int index;
ff53604b	397
eb839917 XG	398	/* MSR_MTRRcap is a readonly MSR. */
	399	if (msr == MSR_MTRRcap) {
	400	/*
	401	* SMRR = 0
	402	* WC = 1
	403	* FIX = 1
	404	* VCNT = KVM_NR_VAR_MTRR
	405	*/
	406	*pdata = 0x500 \| KVM_NR_VAR_MTRR;
	407	return 0;
	408	}
	409
ff53604b XG	410	if (!msr_mtrr_valid(msr))
	411	return 1;
	412
de9aef5e XG	413	index = fixed_msr_to_range_index(msr);
	414	if (index >= 0)
	415	pdata = (u64 *)&vcpu->arch.mtrr_state.fixed_ranges[index];
	416	else if (msr == MSR_MTRRdefType)
10fac2dc	417	*pdata = vcpu->arch.mtrr_state.deftype;
ff53604b XG	418	else if (msr == MSR_IA32_CR_PAT)
	419	*pdata = vcpu->arch.pat;
	420	else { /* Variable MTRRs */
de9aef5e	421	int is_mtrr_mask;
ff53604b	422
de9aef5e XG	423	index = (msr - 0x200) / 2;
de9aef5e XG	424	is_mtrr_mask = msr - 0x200 - 2 * index;
ff53604b	425	if (!is_mtrr_mask)
de9aef5e	426	*pdata = vcpu->arch.mtrr_state.var_ranges[index].base;
ff53604b	427	else
de9aef5e	428	*pdata = vcpu->arch.mtrr_state.var_ranges[index].mask;
ff53604b XG	429	}
	430
	431	return 0;
	432	}
	433
19efffa2 XG	434	void kvm_vcpu_mtrr_init(struct kvm_vcpu *vcpu)
	435	{
	436	INIT_LIST_HEAD(&vcpu->arch.mtrr_state.head);
	437	}
	438
f571c097 XG	439	struct mtrr_iter {
	440	/* input fields. */
	441	struct kvm_mtrr *mtrr_state;
	442	u64 start;
	443	u64 end;
	444
	445	/* output fields. */
	446	int mem_type;
10dc331f XG	447	/* mtrr is completely disabled? */
10dc331f XG	448	bool mtrr_disabled;
f571c097 XG	449	/* [start, end) is not fully covered in MTRRs? */
	450	bool partial_map;
	451
	452	/* private fields. */
	453	union {
	454	/* used for fixed MTRRs. */
	455	struct {
	456	int index;
	457	int seg;
	458	};
	459
	460	/* used for var MTRRs. */
	461	struct {
	462	struct kvm_mtrr_range *range;
	463	/* max address has been covered in var MTRRs. */
	464	u64 start_max;
	465	};
	466	};
	467
	468	bool fixed;
	469	};
	470
	471	static bool mtrr_lookup_fixed_start(struct mtrr_iter *iter)
	472	{
	473	int seg, index;
	474
	475	if (!fixed_mtrr_is_enabled(iter->mtrr_state))
	476	return false;
	477
	478	seg = fixed_mtrr_addr_to_seg(iter->start);
	479	if (seg < 0)
	480	return false;
	481
	482	iter->fixed = true;
	483	index = fixed_mtrr_addr_seg_to_range_index(iter->start, seg);
	484	iter->index = index;
	485	iter->seg = seg;
	486	return true;
	487	}
	488
	489	static bool match_var_range(struct mtrr_iter *iter,
	490	struct kvm_mtrr_range *range)
	491	{
	492	u64 start, end;
	493
	494	var_mtrr_range(range, &start, &end);
	495	if (!(start >= iter->end \|\| end <= iter->start)) {
	496	iter->range = range;
	497
	498	/*
	499	* the function is called when we do kvm_mtrr.head walking.
	500	* Range has the minimum base address which interleaves
	501	* [looker->start_max, looker->end).
	502	*/
	503	iter->partial_map \|= iter->start_max < start;
	504
	505	/* update the max address has been covered. */
	506	iter->start_max = max(iter->start_max, end);
	507	return true;
	508	}
	509
	510	return false;
	511	}
	512
513	static void __mtrr_lookup_var_next(struct mtrr_iter *iter)
514	{
515	struct kvm_mtrr *mtrr_state = iter->mtrr_state;
516
517	list_for_each_entry_continue(iter->range, &mtrr_state->head, node)
518	if (match_var_range(iter, iter->range))
519	return;
520
521	iter->range = NULL;
522	iter->partial_map \|= iter->start_max < iter->end;
523	}
524
525	static void mtrr_lookup_var_start(struct mtrr_iter *iter)
526	{
527	struct kvm_mtrr *mtrr_state = iter->mtrr_state;
528
529	iter->fixed = false;
530	iter->start_max = iter->start;
531	iter->range = list_prepare_entry(iter->range, &mtrr_state->head, node);
532
533	__mtrr_lookup_var_next(iter);
534	}
535
536	static void mtrr_lookup_fixed_next(struct mtrr_iter *iter)
537	{
538	/* terminate the lookup. */
539	if (fixed_mtrr_range_end_addr(iter->seg, iter->index) >= iter->end) {
540	iter->fixed = false;
541	iter->range = NULL;
542	return;
543	}
544
545	iter->index++;
546
547	/* have looked up for all fixed MTRRs. */
548	if (iter->index >= ARRAY_SIZE(iter->mtrr_state->fixed_ranges))
549	return mtrr_lookup_var_start(iter);
550
551	/* switch to next segment. */
552	if (iter->index > fixed_mtrr_seg_end_range_index(iter->seg))
553	iter->seg++;
554	}
555
556	static void mtrr_lookup_var_next(struct mtrr_iter *iter)
557	{
558	__mtrr_lookup_var_next(iter);
559	}
560
561	static void mtrr_lookup_start(struct mtrr_iter *iter)
562	{
563	if (!mtrr_is_enabled(iter->mtrr_state)) {
10dc331f	564	iter->mtrr_disabled = true;
f571c097 XG	565	return;
	566	}
	567
	568	if (!mtrr_lookup_fixed_start(iter))
	569	mtrr_lookup_var_start(iter);
	570	}
	571
	572	static void mtrr_lookup_init(struct mtrr_iter *iter,
	573	struct kvm_mtrr *mtrr_state, u64 start, u64 end)
	574	{
	575	iter->mtrr_state = mtrr_state;
	576	iter->start = start;
	577	iter->end = end;
10dc331f	578	iter->mtrr_disabled = false;
f571c097 XG	579	iter->partial_map = false;
	580	iter->fixed = false;
	581	iter->range = NULL;
	582
	583	mtrr_lookup_start(iter);
	584	}
	585
	586	static bool mtrr_lookup_okay(struct mtrr_iter *iter)
	587	{
	588	if (iter->fixed) {
	589	iter->mem_type = iter->mtrr_state->fixed_ranges[iter->index];
	590	return true;
	591	}
	592
	593	if (iter->range) {
	594	iter->mem_type = iter->range->base & 0xff;
	595	return true;
	596	}
	597
	598	return false;
	599	}
	600
	601	static void mtrr_lookup_next(struct mtrr_iter *iter)
	602	{
	603	if (iter->fixed)
	604	mtrr_lookup_fixed_next(iter);
	605	else
	606	mtrr_lookup_var_next(iter);
	607	}
	608
	609	#define mtrr_for_each_mem_type(_iter_, _mtrr_, _gpa_start_, _gpa_end_) \
	610	for (mtrr_lookup_init(_iter_, _mtrr_, _gpa_start_, _gpa_end_); \
	611	mtrr_lookup_okay(_iter_); mtrr_lookup_next(_iter_))
	612
3f3f78b6	613	u8 kvm_mtrr_get_guest_memory_type(struct kvm_vcpu *vcpu, gfn_t gfn)
ff53604b	614	{
3f3f78b6	615	struct kvm_mtrr *mtrr_state = &vcpu->arch.mtrr_state;
fa612137 XG	616	struct mtrr_iter iter;
	617	u64 start, end;
	618	int type = -1;
3f3f78b6 XG	619	const int wt_wb_mask = (1 << MTRR_TYPE_WRBACK)
	620	\| (1 << MTRR_TYPE_WRTHROUGH);
	621
	622	start = gfn_to_gpa(gfn);
fa612137	623	end = start + PAGE_SIZE;
ff53604b	624
fa612137 XG	625	mtrr_for_each_mem_type(&iter, mtrr_state, start, end) {
fa612137 XG	626	int curr_type = iter.mem_type;
ff53604b	627
3f3f78b6 XG	628	/*
	629	* Please refer to Intel SDM Volume 3: 11.11.4.1 MTRR
	630	* Precedences.
	631	*/
	632
3f3f78b6 XG	633	if (type == -1) {
3f3f78b6 XG	634	type = curr_type;
ff53604b XG	635	continue;
	636	}
	637
3f3f78b6 XG	638	/*
	639	* If two or more variable memory ranges match and the
	640	* memory types are identical, then that memory type is
	641	* used.
	642	*/
	643	if (type == curr_type)
	644	continue;
	645
	646	/*
	647	* If two or more variable memory ranges match and one of
	648	* the memory types is UC, the UC memory type used.
	649	*/
	650	if (curr_type == MTRR_TYPE_UNCACHABLE)
ff53604b XG	651	return MTRR_TYPE_UNCACHABLE;
ff53604b XG	652
3f3f78b6 XG	653	/*
	654	* If two or more variable memory ranges match and the
	655	* memory types are WT and WB, the WT memory type is used.
	656	*/
	657	if (((1 << type) & wt_wb_mask) &&
	658	((1 << curr_type) & wt_wb_mask)) {
	659	type = MTRR_TYPE_WRTHROUGH;
	660	continue;
ff53604b XG	661	}
ff53604b XG	662
3f3f78b6 XG	663	/*
	664	* For overlaps not defined by the above rules, processor
	665	* behavior is undefined.
	666	*/
	667
	668	/* We use WB for this undefined behavior. :( */
	669	return MTRR_TYPE_WRBACK;
ff53604b XG	670	}
ff53604b XG	671
10dc331f XG	672	if (iter.mtrr_disabled)
	673	return mtrr_disabled_type();
	674
fa612137 XG	675	/* It is not covered by MTRRs. */
	676	if (iter.partial_map) {
	677	/*
	678	* We just check one page, partially covered by MTRRs is
	679	* impossible.
	680	*/
	681	WARN_ON(type != -1);
	682	type = mtrr_default_type(mtrr_state);
	683	}
	684	return type;
ff53604b	685	}
ff53604b	686	EXPORT_SYMBOL_GPL(kvm_mtrr_get_guest_memory_type);
6a39bbc5 XG	687
	688	bool kvm_mtrr_check_gfn_range_consistency(struct kvm_vcpu *vcpu, gfn_t gfn,
	689	int page_num)
	690	{
	691	struct kvm_mtrr *mtrr_state = &vcpu->arch.mtrr_state;
	692	struct mtrr_iter iter;
	693	u64 start, end;
	694	int type = -1;
	695
	696	start = gfn_to_gpa(gfn);
	697	end = gfn_to_gpa(gfn + page_num);
	698	mtrr_for_each_mem_type(&iter, mtrr_state, start, end) {
	699	if (type == -1) {
	700	type = iter.mem_type;
	701	continue;
	702	}
	703
	704	if (type != iter.mem_type)
	705	return false;
	706	}
	707
10dc331f XG	708	if (iter.mtrr_disabled)
	709	return true;
	710
6a39bbc5 XG	711	if (!iter.partial_map)
	712	return true;
	713
	714	if (type == -1)
	715	return true;
	716
	717	return type == mtrr_default_type(mtrr_state);
	718	}