1 /*
2  * Handle caching attributes in page tables (PAT)
3  *
4  * Authors: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
5  *          Suresh B Siddha <suresh.b.siddha@intel.com>
6  *
7  * Loosely based on earlier PAT patchset from Eric Biederman and Andi Kleen.
8  */
9 
10 #include <linux/seq_file.h>
11 #include <linux/bootmem.h>
12 #include <linux/debugfs.h>
13 #include <linux/ioport.h>
14 #include <linux/kernel.h>
15 #include <linux/pfn_t.h>
16 #include <linux/slab.h>
17 #include <linux/mm.h>
18 #include <linux/fs.h>
19 #include <linux/rbtree.h>
20 
21 #include <asm/cacheflush.h>
22 #include <asm/processor.h>
23 #include <asm/tlbflush.h>
24 #include <asm/x86_init.h>
25 #include <asm/pgtable.h>
26 #include <asm/fcntl.h>
27 #include <asm/e820/api.h>
28 #include <asm/mtrr.h>
29 #include <asm/page.h>
30 #include <asm/msr.h>
31 #include <asm/pat.h>
32 #include <asm/io.h>
33 
34 #include "pat_internal.h"
35 #include "mm_internal.h"
36 
37 #undef pr_fmt
38 #define pr_fmt(fmt) "" fmt
39 
40 static bool __read_mostly boot_cpu_done;
41 static bool __read_mostly pat_disabled = !IS_ENABLED(CONFIG_X86_PAT);
42 static bool __read_mostly pat_initialized;
43 static bool __read_mostly init_cm_done;
44 
pat_disable(const char * reason)45 void pat_disable(const char *reason)
46 {
47 	if (pat_disabled)
48 		return;
49 
50 	if (boot_cpu_done) {
51 		WARN_ONCE(1, "x86/PAT: PAT cannot be disabled after initialization\n");
52 		return;
53 	}
54 
55 	pat_disabled = true;
56 	pr_info("x86/PAT: %s\n", reason);
57 }
58 
nopat(char * str)59 static int __init nopat(char *str)
60 {
61 	pat_disable("PAT support disabled.");
62 	return 0;
63 }
64 early_param("nopat", nopat);
65 
pat_enabled(void)66 bool pat_enabled(void)
67 {
68 	return pat_initialized;
69 }
70 EXPORT_SYMBOL_GPL(pat_enabled);
71 
72 int pat_debug_enable;
73 
pat_debug_setup(char * str)74 static int __init pat_debug_setup(char *str)
75 {
76 	pat_debug_enable = 1;
77 	return 0;
78 }
79 __setup("debugpat", pat_debug_setup);
80 
81 #ifdef CONFIG_X86_PAT
82 /*
83  * X86 PAT uses page flags arch_1 and uncached together to keep track of
84  * memory type of pages that have backing page struct.
85  *
86  * X86 PAT supports 4 different memory types:
87  *  - _PAGE_CACHE_MODE_WB
88  *  - _PAGE_CACHE_MODE_WC
89  *  - _PAGE_CACHE_MODE_UC_MINUS
90  *  - _PAGE_CACHE_MODE_WT
91  *
92  * _PAGE_CACHE_MODE_WB is the default type.
93  */
94 
95 #define _PGMT_WB		0
96 #define _PGMT_WC		(1UL << PG_arch_1)
97 #define _PGMT_UC_MINUS		(1UL << PG_uncached)
98 #define _PGMT_WT		(1UL << PG_uncached | 1UL << PG_arch_1)
99 #define _PGMT_MASK		(1UL << PG_uncached | 1UL << PG_arch_1)
100 #define _PGMT_CLEAR_MASK	(~_PGMT_MASK)
101 
get_page_memtype(struct page * pg)102 static inline enum page_cache_mode get_page_memtype(struct page *pg)
103 {
104 	unsigned long pg_flags = pg->flags & _PGMT_MASK;
105 
106 	if (pg_flags == _PGMT_WB)
107 		return _PAGE_CACHE_MODE_WB;
108 	else if (pg_flags == _PGMT_WC)
109 		return _PAGE_CACHE_MODE_WC;
110 	else if (pg_flags == _PGMT_UC_MINUS)
111 		return _PAGE_CACHE_MODE_UC_MINUS;
112 	else
113 		return _PAGE_CACHE_MODE_WT;
114 }
115 
set_page_memtype(struct page * pg,enum page_cache_mode memtype)116 static inline void set_page_memtype(struct page *pg,
117 				    enum page_cache_mode memtype)
118 {
119 	unsigned long memtype_flags;
120 	unsigned long old_flags;
121 	unsigned long new_flags;
122 
123 	switch (memtype) {
124 	case _PAGE_CACHE_MODE_WC:
125 		memtype_flags = _PGMT_WC;
126 		break;
127 	case _PAGE_CACHE_MODE_UC_MINUS:
128 		memtype_flags = _PGMT_UC_MINUS;
129 		break;
130 	case _PAGE_CACHE_MODE_WT:
131 		memtype_flags = _PGMT_WT;
132 		break;
133 	case _PAGE_CACHE_MODE_WB:
134 	default:
135 		memtype_flags = _PGMT_WB;
136 		break;
137 	}
138 
139 	do {
140 		old_flags = pg->flags;
141 		new_flags = (old_flags & _PGMT_CLEAR_MASK) | memtype_flags;
142 	} while (cmpxchg(&pg->flags, old_flags, new_flags) != old_flags);
143 }
144 #else
get_page_memtype(struct page * pg)145 static inline enum page_cache_mode get_page_memtype(struct page *pg)
146 {
147 	return -1;
148 }
set_page_memtype(struct page * pg,enum page_cache_mode memtype)149 static inline void set_page_memtype(struct page *pg,
150 				    enum page_cache_mode memtype)
151 {
152 }
153 #endif
154 
155 enum {
156 	PAT_UC = 0,		/* uncached */
157 	PAT_WC = 1,		/* Write combining */
158 	PAT_WT = 4,		/* Write Through */
159 	PAT_WP = 5,		/* Write Protected */
160 	PAT_WB = 6,		/* Write Back (default) */
161 	PAT_UC_MINUS = 7,	/* UC, but can be overridden by MTRR */
162 };
163 
164 #define CM(c) (_PAGE_CACHE_MODE_ ## c)
165 
pat_get_cache_mode(unsigned pat_val,char * msg)166 static enum page_cache_mode pat_get_cache_mode(unsigned pat_val, char *msg)
167 {
168 	enum page_cache_mode cache;
169 	char *cache_mode;
170 
171 	switch (pat_val) {
172 	case PAT_UC:       cache = CM(UC);       cache_mode = "UC  "; break;
173 	case PAT_WC:       cache = CM(WC);       cache_mode = "WC  "; break;
174 	case PAT_WT:       cache = CM(WT);       cache_mode = "WT  "; break;
175 	case PAT_WP:       cache = CM(WP);       cache_mode = "WP  "; break;
176 	case PAT_WB:       cache = CM(WB);       cache_mode = "WB  "; break;
177 	case PAT_UC_MINUS: cache = CM(UC_MINUS); cache_mode = "UC- "; break;
178 	default:           cache = CM(WB);       cache_mode = "WB  "; break;
179 	}
180 
181 	memcpy(msg, cache_mode, 4);
182 
183 	return cache;
184 }
185 
186 #undef CM
187 
188 /*
189  * Update the cache mode to pgprot translation tables according to PAT
190  * configuration.
191  * Using lower indices is preferred, so we start with highest index.
192  */
__init_cache_modes(u64 pat)193 static void __init_cache_modes(u64 pat)
194 {
195 	enum page_cache_mode cache;
196 	char pat_msg[33];
197 	int i;
198 
199 	pat_msg[32] = 0;
200 	for (i = 7; i >= 0; i--) {
201 		cache = pat_get_cache_mode((pat >> (i * 8)) & 7,
202 					   pat_msg + 4 * i);
203 		update_cache_mode_entry(i, cache);
204 	}
205 	pr_info("x86/PAT: Configuration [0-7]: %s\n", pat_msg);
206 
207 	init_cm_done = true;
208 }
209 
210 #define PAT(x, y)	((u64)PAT_ ## y << ((x)*8))
211 
pat_bsp_init(u64 pat)212 static void pat_bsp_init(u64 pat)
213 {
214 	u64 tmp_pat;
215 
216 	if (!boot_cpu_has(X86_FEATURE_PAT)) {
217 		pat_disable("PAT not supported by CPU.");
218 		return;
219 	}
220 
221 	rdmsrl(MSR_IA32_CR_PAT, tmp_pat);
222 	if (!tmp_pat) {
223 		pat_disable("PAT MSR is 0, disabled.");
224 		return;
225 	}
226 
227 	wrmsrl(MSR_IA32_CR_PAT, pat);
228 	pat_initialized = true;
229 
230 	__init_cache_modes(pat);
231 }
232 
pat_ap_init(u64 pat)233 static void pat_ap_init(u64 pat)
234 {
235 	if (!boot_cpu_has(X86_FEATURE_PAT)) {
236 		/*
237 		 * If this happens we are on a secondary CPU, but switched to
238 		 * PAT on the boot CPU. We have no way to undo PAT.
239 		 */
240 		panic("x86/PAT: PAT enabled, but not supported by secondary CPU\n");
241 	}
242 
243 	wrmsrl(MSR_IA32_CR_PAT, pat);
244 }
245 
init_cache_modes(void)246 void init_cache_modes(void)
247 {
248 	u64 pat = 0;
249 
250 	if (init_cm_done)
251 		return;
252 
253 	if (boot_cpu_has(X86_FEATURE_PAT)) {
254 		/*
255 		 * CPU supports PAT. Set PAT table to be consistent with
256 		 * PAT MSR. This case supports "nopat" boot option, and
257 		 * virtual machine environments which support PAT without
258 		 * MTRRs. In specific, Xen has unique setup to PAT MSR.
259 		 *
260 		 * If PAT MSR returns 0, it is considered invalid and emulates
261 		 * as No PAT.
262 		 */
263 		rdmsrl(MSR_IA32_CR_PAT, pat);
264 	}
265 
266 	if (!pat) {
267 		/*
268 		 * No PAT. Emulate the PAT table that corresponds to the two
269 		 * cache bits, PWT (Write Through) and PCD (Cache Disable).
270 		 * This setup is also the same as the BIOS default setup.
271 		 *
272 		 * PTE encoding:
273 		 *
274 		 *       PCD
275 		 *       |PWT  PAT
276 		 *       ||    slot
277 		 *       00    0    WB : _PAGE_CACHE_MODE_WB
278 		 *       01    1    WT : _PAGE_CACHE_MODE_WT
279 		 *       10    2    UC-: _PAGE_CACHE_MODE_UC_MINUS
280 		 *       11    3    UC : _PAGE_CACHE_MODE_UC
281 		 *
282 		 * NOTE: When WC or WP is used, it is redirected to UC- per
283 		 * the default setup in __cachemode2pte_tbl[].
284 		 */
285 		pat = PAT(0, WB) | PAT(1, WT) | PAT(2, UC_MINUS) | PAT(3, UC) |
286 		      PAT(4, WB) | PAT(5, WT) | PAT(6, UC_MINUS) | PAT(7, UC);
287 	}
288 
289 	__init_cache_modes(pat);
290 }
291 
292 /**
293  * pat_init - Initialize PAT MSR and PAT table
294  *
295  * This function initializes PAT MSR and PAT table with an OS-defined value
296  * to enable additional cache attributes, WC, WT and WP.
297  *
298  * This function must be called on all CPUs using the specific sequence of
299  * operations defined in Intel SDM. mtrr_rendezvous_handler() provides this
300  * procedure for PAT.
301  */
pat_init(void)302 void pat_init(void)
303 {
304 	u64 pat;
305 	struct cpuinfo_x86 *c = &boot_cpu_data;
306 
307 	if (pat_disabled)
308 		return;
309 
310 	if ((c->x86_vendor == X86_VENDOR_INTEL) &&
311 	    (((c->x86 == 0x6) && (c->x86_model <= 0xd)) ||
312 	     ((c->x86 == 0xf) && (c->x86_model <= 0x6)))) {
313 		/*
314 		 * PAT support with the lower four entries. Intel Pentium 2,
315 		 * 3, M, and 4 are affected by PAT errata, which makes the
316 		 * upper four entries unusable. To be on the safe side, we don't
317 		 * use those.
318 		 *
319 		 *  PTE encoding:
320 		 *      PAT
321 		 *      |PCD
322 		 *      ||PWT  PAT
323 		 *      |||    slot
324 		 *      000    0    WB : _PAGE_CACHE_MODE_WB
325 		 *      001    1    WC : _PAGE_CACHE_MODE_WC
326 		 *      010    2    UC-: _PAGE_CACHE_MODE_UC_MINUS
327 		 *      011    3    UC : _PAGE_CACHE_MODE_UC
328 		 * PAT bit unused
329 		 *
330 		 * NOTE: When WT or WP is used, it is redirected to UC- per
331 		 * the default setup in __cachemode2pte_tbl[].
332 		 */
333 		pat = PAT(0, WB) | PAT(1, WC) | PAT(2, UC_MINUS) | PAT(3, UC) |
334 		      PAT(4, WB) | PAT(5, WC) | PAT(6, UC_MINUS) | PAT(7, UC);
335 	} else {
336 		/*
337 		 * Full PAT support.  We put WT in slot 7 to improve
338 		 * robustness in the presence of errata that might cause
339 		 * the high PAT bit to be ignored.  This way, a buggy slot 7
340 		 * access will hit slot 3, and slot 3 is UC, so at worst
341 		 * we lose performance without causing a correctness issue.
342 		 * Pentium 4 erratum N46 is an example for such an erratum,
343 		 * although we try not to use PAT at all on affected CPUs.
344 		 *
345 		 *  PTE encoding:
346 		 *      PAT
347 		 *      |PCD
348 		 *      ||PWT  PAT
349 		 *      |||    slot
350 		 *      000    0    WB : _PAGE_CACHE_MODE_WB
351 		 *      001    1    WC : _PAGE_CACHE_MODE_WC
352 		 *      010    2    UC-: _PAGE_CACHE_MODE_UC_MINUS
353 		 *      011    3    UC : _PAGE_CACHE_MODE_UC
354 		 *      100    4    WB : Reserved
355 		 *      101    5    WP : _PAGE_CACHE_MODE_WP
356 		 *      110    6    UC-: Reserved
357 		 *      111    7    WT : _PAGE_CACHE_MODE_WT
358 		 *
359 		 * The reserved slots are unused, but mapped to their
360 		 * corresponding types in the presence of PAT errata.
361 		 */
362 		pat = PAT(0, WB) | PAT(1, WC) | PAT(2, UC_MINUS) | PAT(3, UC) |
363 		      PAT(4, WB) | PAT(5, WP) | PAT(6, UC_MINUS) | PAT(7, WT);
364 	}
365 
366 	if (!boot_cpu_done) {
367 		pat_bsp_init(pat);
368 		boot_cpu_done = true;
369 	} else {
370 		pat_ap_init(pat);
371 	}
372 }
373 
374 #undef PAT
375 
376 static DEFINE_SPINLOCK(memtype_lock);	/* protects memtype accesses */
377 
378 /*
379  * Does intersection of PAT memory type and MTRR memory type and returns
380  * the resulting memory type as PAT understands it.
381  * (Type in pat and mtrr will not have same value)
382  * The intersection is based on "Effective Memory Type" tables in IA-32
383  * SDM vol 3a
384  */
pat_x_mtrr_type(u64 start,u64 end,enum page_cache_mode req_type)385 static unsigned long pat_x_mtrr_type(u64 start, u64 end,
386 				     enum page_cache_mode req_type)
387 {
388 	/*
389 	 * Look for MTRR hint to get the effective type in case where PAT
390 	 * request is for WB.
391 	 */
392 	if (req_type == _PAGE_CACHE_MODE_WB) {
393 		u8 mtrr_type, uniform;
394 
395 		mtrr_type = mtrr_type_lookup(start, end, &uniform);
396 		if (mtrr_type != MTRR_TYPE_WRBACK)
397 			return _PAGE_CACHE_MODE_UC_MINUS;
398 
399 		return _PAGE_CACHE_MODE_WB;
400 	}
401 
402 	return req_type;
403 }
404 
405 struct pagerange_state {
406 	unsigned long		cur_pfn;
407 	int			ram;
408 	int			not_ram;
409 };
410 
411 static int
pagerange_is_ram_callback(unsigned long initial_pfn,unsigned long total_nr_pages,void * arg)412 pagerange_is_ram_callback(unsigned long initial_pfn, unsigned long total_nr_pages, void *arg)
413 {
414 	struct pagerange_state *state = arg;
415 
416 	state->not_ram	|= initial_pfn > state->cur_pfn;
417 	state->ram	|= total_nr_pages > 0;
418 	state->cur_pfn	 = initial_pfn + total_nr_pages;
419 
420 	return state->ram && state->not_ram;
421 }
422 
pat_pagerange_is_ram(resource_size_t start,resource_size_t end)423 static int pat_pagerange_is_ram(resource_size_t start, resource_size_t end)
424 {
425 	int ret = 0;
426 	unsigned long start_pfn = start >> PAGE_SHIFT;
427 	unsigned long end_pfn = (end + PAGE_SIZE - 1) >> PAGE_SHIFT;
428 	struct pagerange_state state = {start_pfn, 0, 0};
429 
430 	/*
431 	 * For legacy reasons, physical address range in the legacy ISA
432 	 * region is tracked as non-RAM. This will allow users of
433 	 * /dev/mem to map portions of legacy ISA region, even when
434 	 * some of those portions are listed(or not even listed) with
435 	 * different e820 types(RAM/reserved/..)
436 	 */
437 	if (start_pfn < ISA_END_ADDRESS >> PAGE_SHIFT)
438 		start_pfn = ISA_END_ADDRESS >> PAGE_SHIFT;
439 
440 	if (start_pfn < end_pfn) {
441 		ret = walk_system_ram_range(start_pfn, end_pfn - start_pfn,
442 				&state, pagerange_is_ram_callback);
443 	}
444 
445 	return (ret > 0) ? -1 : (state.ram ? 1 : 0);
446 }
447 
448 /*
449  * For RAM pages, we use page flags to mark the pages with appropriate type.
450  * The page flags are limited to four types, WB (default), WC, WT and UC-.
451  * WP request fails with -EINVAL, and UC gets redirected to UC-.  Setting
452  * a new memory type is only allowed for a page mapped with the default WB
453  * type.
454  *
455  * Here we do two passes:
456  * - Find the memtype of all the pages in the range, look for any conflicts.
457  * - In case of no conflicts, set the new memtype for pages in the range.
458  */
reserve_ram_pages_type(u64 start,u64 end,enum page_cache_mode req_type,enum page_cache_mode * new_type)459 static int reserve_ram_pages_type(u64 start, u64 end,
460 				  enum page_cache_mode req_type,
461 				  enum page_cache_mode *new_type)
462 {
463 	struct page *page;
464 	u64 pfn;
465 
466 	if (req_type == _PAGE_CACHE_MODE_WP) {
467 		if (new_type)
468 			*new_type = _PAGE_CACHE_MODE_UC_MINUS;
469 		return -EINVAL;
470 	}
471 
472 	if (req_type == _PAGE_CACHE_MODE_UC) {
473 		/* We do not support strong UC */
474 		WARN_ON_ONCE(1);
475 		req_type = _PAGE_CACHE_MODE_UC_MINUS;
476 	}
477 
478 	for (pfn = (start >> PAGE_SHIFT); pfn < (end >> PAGE_SHIFT); ++pfn) {
479 		enum page_cache_mode type;
480 
481 		page = pfn_to_page(pfn);
482 		type = get_page_memtype(page);
483 		if (type != _PAGE_CACHE_MODE_WB) {
484 			pr_info("x86/PAT: reserve_ram_pages_type failed [mem %#010Lx-%#010Lx], track 0x%x, req 0x%x\n",
485 				start, end - 1, type, req_type);
486 			if (new_type)
487 				*new_type = type;
488 
489 			return -EBUSY;
490 		}
491 	}
492 
493 	if (new_type)
494 		*new_type = req_type;
495 
496 	for (pfn = (start >> PAGE_SHIFT); pfn < (end >> PAGE_SHIFT); ++pfn) {
497 		page = pfn_to_page(pfn);
498 		set_page_memtype(page, req_type);
499 	}
500 	return 0;
501 }
502 
free_ram_pages_type(u64 start,u64 end)503 static int free_ram_pages_type(u64 start, u64 end)
504 {
505 	struct page *page;
506 	u64 pfn;
507 
508 	for (pfn = (start >> PAGE_SHIFT); pfn < (end >> PAGE_SHIFT); ++pfn) {
509 		page = pfn_to_page(pfn);
510 		set_page_memtype(page, _PAGE_CACHE_MODE_WB);
511 	}
512 	return 0;
513 }
514 
sanitize_phys(u64 address)515 static u64 sanitize_phys(u64 address)
516 {
517 	/*
518 	 * When changing the memtype for pages containing poison allow
519 	 * for a "decoy" virtual address (bit 63 clear) passed to
520 	 * set_memory_X(). __pa() on a "decoy" address results in a
521 	 * physical address with bit 63 set.
522 	 */
523 	return address & __PHYSICAL_MASK;
524 }
525 
526 /*
527  * req_type typically has one of the:
528  * - _PAGE_CACHE_MODE_WB
529  * - _PAGE_CACHE_MODE_WC
530  * - _PAGE_CACHE_MODE_UC_MINUS
531  * - _PAGE_CACHE_MODE_UC
532  * - _PAGE_CACHE_MODE_WT
533  *
534  * If new_type is NULL, function will return an error if it cannot reserve the
535  * region with req_type. If new_type is non-NULL, function will return
536  * available type in new_type in case of no error. In case of any error
537  * it will return a negative return value.
538  */
reserve_memtype(u64 start,u64 end,enum page_cache_mode req_type,enum page_cache_mode * new_type)539 int reserve_memtype(u64 start, u64 end, enum page_cache_mode req_type,
540 		    enum page_cache_mode *new_type)
541 {
542 	struct memtype *new;
543 	enum page_cache_mode actual_type;
544 	int is_range_ram;
545 	int err = 0;
546 
547 	start = sanitize_phys(start);
548 	end = sanitize_phys(end);
549 	BUG_ON(start >= end); /* end is exclusive */
550 
551 	if (!pat_enabled()) {
552 		/* This is identical to page table setting without PAT */
553 		if (new_type)
554 			*new_type = req_type;
555 		return 0;
556 	}
557 
558 	/* Low ISA region is always mapped WB in page table. No need to track */
559 	if (x86_platform.is_untracked_pat_range(start, end)) {
560 		if (new_type)
561 			*new_type = _PAGE_CACHE_MODE_WB;
562 		return 0;
563 	}
564 
565 	/*
566 	 * Call mtrr_lookup to get the type hint. This is an
567 	 * optimization for /dev/mem mmap'ers into WB memory (BIOS
568 	 * tools and ACPI tools). Use WB request for WB memory and use
569 	 * UC_MINUS otherwise.
570 	 */
571 	actual_type = pat_x_mtrr_type(start, end, req_type);
572 
573 	if (new_type)
574 		*new_type = actual_type;
575 
576 	is_range_ram = pat_pagerange_is_ram(start, end);
577 	if (is_range_ram == 1) {
578 
579 		err = reserve_ram_pages_type(start, end, req_type, new_type);
580 
581 		return err;
582 	} else if (is_range_ram < 0) {
583 		return -EINVAL;
584 	}
585 
586 	new  = kzalloc(sizeof(struct memtype), GFP_KERNEL);
587 	if (!new)
588 		return -ENOMEM;
589 
590 	new->start	= start;
591 	new->end	= end;
592 	new->type	= actual_type;
593 
594 	spin_lock(&memtype_lock);
595 
596 	err = rbt_memtype_check_insert(new, new_type);
597 	if (err) {
598 		pr_info("x86/PAT: reserve_memtype failed [mem %#010Lx-%#010Lx], track %s, req %s\n",
599 			start, end - 1,
600 			cattr_name(new->type), cattr_name(req_type));
601 		kfree(new);
602 		spin_unlock(&memtype_lock);
603 
604 		return err;
605 	}
606 
607 	spin_unlock(&memtype_lock);
608 
609 	dprintk("reserve_memtype added [mem %#010Lx-%#010Lx], track %s, req %s, ret %s\n",
610 		start, end - 1, cattr_name(new->type), cattr_name(req_type),
611 		new_type ? cattr_name(*new_type) : "-");
612 
613 	return err;
614 }
615 
free_memtype(u64 start,u64 end)616 int free_memtype(u64 start, u64 end)
617 {
618 	int err = -EINVAL;
619 	int is_range_ram;
620 	struct memtype *entry;
621 
622 	if (!pat_enabled())
623 		return 0;
624 
625 	start = sanitize_phys(start);
626 	end = sanitize_phys(end);
627 
628 	/* Low ISA region is always mapped WB. No need to track */
629 	if (x86_platform.is_untracked_pat_range(start, end))
630 		return 0;
631 
632 	is_range_ram = pat_pagerange_is_ram(start, end);
633 	if (is_range_ram == 1) {
634 
635 		err = free_ram_pages_type(start, end);
636 
637 		return err;
638 	} else if (is_range_ram < 0) {
639 		return -EINVAL;
640 	}
641 
642 	spin_lock(&memtype_lock);
643 	entry = rbt_memtype_erase(start, end);
644 	spin_unlock(&memtype_lock);
645 
646 	if (IS_ERR(entry)) {
647 		pr_info("x86/PAT: %s:%d freeing invalid memtype [mem %#010Lx-%#010Lx]\n",
648 			current->comm, current->pid, start, end - 1);
649 		return -EINVAL;
650 	}
651 
652 	kfree(entry);
653 
654 	dprintk("free_memtype request [mem %#010Lx-%#010Lx]\n", start, end - 1);
655 
656 	return 0;
657 }
658 
659 
660 /**
661  * lookup_memtype - Looksup the memory type for a physical address
662  * @paddr: physical address of which memory type needs to be looked up
663  *
664  * Only to be called when PAT is enabled
665  *
666  * Returns _PAGE_CACHE_MODE_WB, _PAGE_CACHE_MODE_WC, _PAGE_CACHE_MODE_UC_MINUS
667  * or _PAGE_CACHE_MODE_WT.
668  */
lookup_memtype(u64 paddr)669 static enum page_cache_mode lookup_memtype(u64 paddr)
670 {
671 	enum page_cache_mode rettype = _PAGE_CACHE_MODE_WB;
672 	struct memtype *entry;
673 
674 	if (x86_platform.is_untracked_pat_range(paddr, paddr + PAGE_SIZE))
675 		return rettype;
676 
677 	if (pat_pagerange_is_ram(paddr, paddr + PAGE_SIZE)) {
678 		struct page *page;
679 
680 		page = pfn_to_page(paddr >> PAGE_SHIFT);
681 		return get_page_memtype(page);
682 	}
683 
684 	spin_lock(&memtype_lock);
685 
686 	entry = rbt_memtype_lookup(paddr);
687 	if (entry != NULL)
688 		rettype = entry->type;
689 	else
690 		rettype = _PAGE_CACHE_MODE_UC_MINUS;
691 
692 	spin_unlock(&memtype_lock);
693 	return rettype;
694 }
695 
696 /**
697  * pat_pfn_immune_to_uc_mtrr - Check whether the PAT memory type
698  * of @pfn cannot be overridden by UC MTRR memory type.
699  *
700  * Only to be called when PAT is enabled.
701  *
702  * Returns true, if the PAT memory type of @pfn is UC, UC-, or WC.
703  * Returns false in other cases.
704  */
pat_pfn_immune_to_uc_mtrr(unsigned long pfn)705 bool pat_pfn_immune_to_uc_mtrr(unsigned long pfn)
706 {
707 	enum page_cache_mode cm = lookup_memtype(PFN_PHYS(pfn));
708 
709 	return cm == _PAGE_CACHE_MODE_UC ||
710 	       cm == _PAGE_CACHE_MODE_UC_MINUS ||
711 	       cm == _PAGE_CACHE_MODE_WC;
712 }
713 EXPORT_SYMBOL_GPL(pat_pfn_immune_to_uc_mtrr);
714 
715 /**
716  * io_reserve_memtype - Request a memory type mapping for a region of memory
717  * @start: start (physical address) of the region
718  * @end: end (physical address) of the region
719  * @type: A pointer to memtype, with requested type. On success, requested
720  * or any other compatible type that was available for the region is returned
721  *
722  * On success, returns 0
723  * On failure, returns non-zero
724  */
io_reserve_memtype(resource_size_t start,resource_size_t end,enum page_cache_mode * type)725 int io_reserve_memtype(resource_size_t start, resource_size_t end,
726 			enum page_cache_mode *type)
727 {
728 	resource_size_t size = end - start;
729 	enum page_cache_mode req_type = *type;
730 	enum page_cache_mode new_type;
731 	int ret;
732 
733 	WARN_ON_ONCE(iomem_map_sanity_check(start, size));
734 
735 	ret = reserve_memtype(start, end, req_type, &new_type);
736 	if (ret)
737 		goto out_err;
738 
739 	if (!is_new_memtype_allowed(start, size, req_type, new_type))
740 		goto out_free;
741 
742 	if (kernel_map_sync_memtype(start, size, new_type) < 0)
743 		goto out_free;
744 
745 	*type = new_type;
746 	return 0;
747 
748 out_free:
749 	free_memtype(start, end);
750 	ret = -EBUSY;
751 out_err:
752 	return ret;
753 }
754 
755 /**
756  * io_free_memtype - Release a memory type mapping for a region of memory
757  * @start: start (physical address) of the region
758  * @end: end (physical address) of the region
759  */
io_free_memtype(resource_size_t start,resource_size_t end)760 void io_free_memtype(resource_size_t start, resource_size_t end)
761 {
762 	free_memtype(start, end);
763 }
764 
arch_io_reserve_memtype_wc(resource_size_t start,resource_size_t size)765 int arch_io_reserve_memtype_wc(resource_size_t start, resource_size_t size)
766 {
767 	enum page_cache_mode type = _PAGE_CACHE_MODE_WC;
768 
769 	return io_reserve_memtype(start, start + size, &type);
770 }
771 EXPORT_SYMBOL(arch_io_reserve_memtype_wc);
772 
arch_io_free_memtype_wc(resource_size_t start,resource_size_t size)773 void arch_io_free_memtype_wc(resource_size_t start, resource_size_t size)
774 {
775 	io_free_memtype(start, start + size);
776 }
777 EXPORT_SYMBOL(arch_io_free_memtype_wc);
778 
phys_mem_access_prot(struct file * file,unsigned long pfn,unsigned long size,pgprot_t vma_prot)779 pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn,
780 				unsigned long size, pgprot_t vma_prot)
781 {
782 	if (!phys_mem_access_encrypted(pfn << PAGE_SHIFT, size))
783 		vma_prot = pgprot_decrypted(vma_prot);
784 
785 	return vma_prot;
786 }
787 
788 #ifdef CONFIG_STRICT_DEVMEM
789 /* This check is done in drivers/char/mem.c in case of STRICT_DEVMEM */
range_is_allowed(unsigned long pfn,unsigned long size)790 static inline int range_is_allowed(unsigned long pfn, unsigned long size)
791 {
792 	return 1;
793 }
794 #else
795 /* This check is needed to avoid cache aliasing when PAT is enabled */
range_is_allowed(unsigned long pfn,unsigned long size)796 static inline int range_is_allowed(unsigned long pfn, unsigned long size)
797 {
798 	u64 from = ((u64)pfn) << PAGE_SHIFT;
799 	u64 to = from + size;
800 	u64 cursor = from;
801 
802 	if (!pat_enabled())
803 		return 1;
804 
805 	while (cursor < to) {
806 		if (!devmem_is_allowed(pfn))
807 			return 0;
808 		cursor += PAGE_SIZE;
809 		pfn++;
810 	}
811 	return 1;
812 }
813 #endif /* CONFIG_STRICT_DEVMEM */
814 
phys_mem_access_prot_allowed(struct file * file,unsigned long pfn,unsigned long size,pgprot_t * vma_prot)815 int phys_mem_access_prot_allowed(struct file *file, unsigned long pfn,
816 				unsigned long size, pgprot_t *vma_prot)
817 {
818 	enum page_cache_mode pcm = _PAGE_CACHE_MODE_WB;
819 
820 	if (!range_is_allowed(pfn, size))
821 		return 0;
822 
823 	if (file->f_flags & O_DSYNC)
824 		pcm = _PAGE_CACHE_MODE_UC_MINUS;
825 
826 	*vma_prot = __pgprot((pgprot_val(*vma_prot) & ~_PAGE_CACHE_MASK) |
827 			     cachemode2protval(pcm));
828 	return 1;
829 }
830 
831 /*
832  * Change the memory type for the physial address range in kernel identity
833  * mapping space if that range is a part of identity map.
834  */
kernel_map_sync_memtype(u64 base,unsigned long size,enum page_cache_mode pcm)835 int kernel_map_sync_memtype(u64 base, unsigned long size,
836 			    enum page_cache_mode pcm)
837 {
838 	unsigned long id_sz;
839 
840 	if (base > __pa(high_memory-1))
841 		return 0;
842 
843 	/*
844 	 * some areas in the middle of the kernel identity range
845 	 * are not mapped, like the PCI space.
846 	 */
847 	if (!page_is_ram(base >> PAGE_SHIFT))
848 		return 0;
849 
850 	id_sz = (__pa(high_memory-1) <= base + size) ?
851 				__pa(high_memory) - base :
852 				size;
853 
854 	if (ioremap_change_attr((unsigned long)__va(base), id_sz, pcm) < 0) {
855 		pr_info("x86/PAT: %s:%d ioremap_change_attr failed %s for [mem %#010Lx-%#010Lx]\n",
856 			current->comm, current->pid,
857 			cattr_name(pcm),
858 			base, (unsigned long long)(base + size-1));
859 		return -EINVAL;
860 	}
861 	return 0;
862 }
863 
864 /*
865  * Internal interface to reserve a range of physical memory with prot.
866  * Reserved non RAM regions only and after successful reserve_memtype,
867  * this func also keeps identity mapping (if any) in sync with this new prot.
868  */
reserve_pfn_range(u64 paddr,unsigned long size,pgprot_t * vma_prot,int strict_prot)869 static int reserve_pfn_range(u64 paddr, unsigned long size, pgprot_t *vma_prot,
870 				int strict_prot)
871 {
872 	int is_ram = 0;
873 	int ret;
874 	enum page_cache_mode want_pcm = pgprot2cachemode(*vma_prot);
875 	enum page_cache_mode pcm = want_pcm;
876 
877 	is_ram = pat_pagerange_is_ram(paddr, paddr + size);
878 
879 	/*
880 	 * reserve_pfn_range() for RAM pages. We do not refcount to keep
881 	 * track of number of mappings of RAM pages. We can assert that
882 	 * the type requested matches the type of first page in the range.
883 	 */
884 	if (is_ram) {
885 		if (!pat_enabled())
886 			return 0;
887 
888 		pcm = lookup_memtype(paddr);
889 		if (want_pcm != pcm) {
890 			pr_warn("x86/PAT: %s:%d map pfn RAM range req %s for [mem %#010Lx-%#010Lx], got %s\n",
891 				current->comm, current->pid,
892 				cattr_name(want_pcm),
893 				(unsigned long long)paddr,
894 				(unsigned long long)(paddr + size - 1),
895 				cattr_name(pcm));
896 			*vma_prot = __pgprot((pgprot_val(*vma_prot) &
897 					     (~_PAGE_CACHE_MASK)) |
898 					     cachemode2protval(pcm));
899 		}
900 		return 0;
901 	}
902 
903 	ret = reserve_memtype(paddr, paddr + size, want_pcm, &pcm);
904 	if (ret)
905 		return ret;
906 
907 	if (pcm != want_pcm) {
908 		if (strict_prot ||
909 		    !is_new_memtype_allowed(paddr, size, want_pcm, pcm)) {
910 			free_memtype(paddr, paddr + size);
911 			pr_err("x86/PAT: %s:%d map pfn expected mapping type %s for [mem %#010Lx-%#010Lx], got %s\n",
912 			       current->comm, current->pid,
913 			       cattr_name(want_pcm),
914 			       (unsigned long long)paddr,
915 			       (unsigned long long)(paddr + size - 1),
916 			       cattr_name(pcm));
917 			return -EINVAL;
918 		}
919 		/*
920 		 * We allow returning different type than the one requested in
921 		 * non strict case.
922 		 */
923 		*vma_prot = __pgprot((pgprot_val(*vma_prot) &
924 				      (~_PAGE_CACHE_MASK)) |
925 				     cachemode2protval(pcm));
926 	}
927 
928 	if (kernel_map_sync_memtype(paddr, size, pcm) < 0) {
929 		free_memtype(paddr, paddr + size);
930 		return -EINVAL;
931 	}
932 	return 0;
933 }
934 
935 /*
936  * Internal interface to free a range of physical memory.
937  * Frees non RAM regions only.
938  */
free_pfn_range(u64 paddr,unsigned long size)939 static void free_pfn_range(u64 paddr, unsigned long size)
940 {
941 	int is_ram;
942 
943 	is_ram = pat_pagerange_is_ram(paddr, paddr + size);
944 	if (is_ram == 0)
945 		free_memtype(paddr, paddr + size);
946 }
947 
948 /*
949  * track_pfn_copy is called when vma that is covering the pfnmap gets
950  * copied through copy_page_range().
951  *
952  * If the vma has a linear pfn mapping for the entire range, we get the prot
953  * from pte and reserve the entire vma range with single reserve_pfn_range call.
954  */
track_pfn_copy(struct vm_area_struct * vma)955 int track_pfn_copy(struct vm_area_struct *vma)
956 {
957 	resource_size_t paddr;
958 	unsigned long prot;
959 	unsigned long vma_size = vma->vm_end - vma->vm_start;
960 	pgprot_t pgprot;
961 
962 	if (vma->vm_flags & VM_PAT) {
963 		/*
964 		 * reserve the whole chunk covered by vma. We need the
965 		 * starting address and protection from pte.
966 		 */
967 		if (follow_phys(vma, vma->vm_start, 0, &prot, &paddr)) {
968 			WARN_ON_ONCE(1);
969 			return -EINVAL;
970 		}
971 		pgprot = __pgprot(prot);
972 		return reserve_pfn_range(paddr, vma_size, &pgprot, 1);
973 	}
974 
975 	return 0;
976 }
977 
978 /*
979  * prot is passed in as a parameter for the new mapping. If the vma has
980  * a linear pfn mapping for the entire range, or no vma is provided,
981  * reserve the entire pfn + size range with single reserve_pfn_range
982  * call.
983  */
track_pfn_remap(struct vm_area_struct * vma,pgprot_t * prot,unsigned long pfn,unsigned long addr,unsigned long size)984 int track_pfn_remap(struct vm_area_struct *vma, pgprot_t *prot,
985 		    unsigned long pfn, unsigned long addr, unsigned long size)
986 {
987 	resource_size_t paddr = (resource_size_t)pfn << PAGE_SHIFT;
988 	enum page_cache_mode pcm;
989 
990 	/* reserve the whole chunk starting from paddr */
991 	if (!vma || (addr == vma->vm_start
992 				&& size == (vma->vm_end - vma->vm_start))) {
993 		int ret;
994 
995 		ret = reserve_pfn_range(paddr, size, prot, 0);
996 		if (ret == 0 && vma)
997 			vma->vm_flags |= VM_PAT;
998 		return ret;
999 	}
1000 
1001 	if (!pat_enabled())
1002 		return 0;
1003 
1004 	/*
1005 	 * For anything smaller than the vma size we set prot based on the
1006 	 * lookup.
1007 	 */
1008 	pcm = lookup_memtype(paddr);
1009 
1010 	/* Check memtype for the remaining pages */
1011 	while (size > PAGE_SIZE) {
1012 		size -= PAGE_SIZE;
1013 		paddr += PAGE_SIZE;
1014 		if (pcm != lookup_memtype(paddr))
1015 			return -EINVAL;
1016 	}
1017 
1018 	*prot = __pgprot((pgprot_val(*prot) & (~_PAGE_CACHE_MASK)) |
1019 			 cachemode2protval(pcm));
1020 
1021 	return 0;
1022 }
1023 
track_pfn_insert(struct vm_area_struct * vma,pgprot_t * prot,pfn_t pfn)1024 void track_pfn_insert(struct vm_area_struct *vma, pgprot_t *prot, pfn_t pfn)
1025 {
1026 	enum page_cache_mode pcm;
1027 
1028 	if (!pat_enabled())
1029 		return;
1030 
1031 	/* Set prot based on lookup */
1032 	pcm = lookup_memtype(pfn_t_to_phys(pfn));
1033 	*prot = __pgprot((pgprot_val(*prot) & (~_PAGE_CACHE_MASK)) |
1034 			 cachemode2protval(pcm));
1035 }
1036 
1037 /*
1038  * untrack_pfn is called while unmapping a pfnmap for a region.
1039  * untrack can be called for a specific region indicated by pfn and size or
1040  * can be for the entire vma (in which case pfn, size are zero).
1041  */
untrack_pfn(struct vm_area_struct * vma,unsigned long pfn,unsigned long size)1042 void untrack_pfn(struct vm_area_struct *vma, unsigned long pfn,
1043 		 unsigned long size)
1044 {
1045 	resource_size_t paddr;
1046 	unsigned long prot;
1047 
1048 	if (vma && !(vma->vm_flags & VM_PAT))
1049 		return;
1050 
1051 	/* free the chunk starting from pfn or the whole chunk */
1052 	paddr = (resource_size_t)pfn << PAGE_SHIFT;
1053 	if (!paddr && !size) {
1054 		if (follow_phys(vma, vma->vm_start, 0, &prot, &paddr)) {
1055 			WARN_ON_ONCE(1);
1056 			return;
1057 		}
1058 
1059 		size = vma->vm_end - vma->vm_start;
1060 	}
1061 	free_pfn_range(paddr, size);
1062 	if (vma)
1063 		vma->vm_flags &= ~VM_PAT;
1064 }
1065 
1066 /*
1067  * untrack_pfn_moved is called, while mremapping a pfnmap for a new region,
1068  * with the old vma after its pfnmap page table has been removed.  The new
1069  * vma has a new pfnmap to the same pfn & cache type with VM_PAT set.
1070  */
untrack_pfn_moved(struct vm_area_struct * vma)1071 void untrack_pfn_moved(struct vm_area_struct *vma)
1072 {
1073 	vma->vm_flags &= ~VM_PAT;
1074 }
1075 
pgprot_writecombine(pgprot_t prot)1076 pgprot_t pgprot_writecombine(pgprot_t prot)
1077 {
1078 	return __pgprot(pgprot_val(prot) |
1079 				cachemode2protval(_PAGE_CACHE_MODE_WC));
1080 }
1081 EXPORT_SYMBOL_GPL(pgprot_writecombine);
1082 
pgprot_writethrough(pgprot_t prot)1083 pgprot_t pgprot_writethrough(pgprot_t prot)
1084 {
1085 	return __pgprot(pgprot_val(prot) |
1086 				cachemode2protval(_PAGE_CACHE_MODE_WT));
1087 }
1088 EXPORT_SYMBOL_GPL(pgprot_writethrough);
1089 
1090 #if defined(CONFIG_DEBUG_FS) && defined(CONFIG_X86_PAT)
1091 
memtype_get_idx(loff_t pos)1092 static struct memtype *memtype_get_idx(loff_t pos)
1093 {
1094 	struct memtype *print_entry;
1095 	int ret;
1096 
1097 	print_entry  = kzalloc(sizeof(struct memtype), GFP_KERNEL);
1098 	if (!print_entry)
1099 		return NULL;
1100 
1101 	spin_lock(&memtype_lock);
1102 	ret = rbt_memtype_copy_nth_element(print_entry, pos);
1103 	spin_unlock(&memtype_lock);
1104 
1105 	if (!ret) {
1106 		return print_entry;
1107 	} else {
1108 		kfree(print_entry);
1109 		return NULL;
1110 	}
1111 }
1112 
memtype_seq_start(struct seq_file * seq,loff_t * pos)1113 static void *memtype_seq_start(struct seq_file *seq, loff_t *pos)
1114 {
1115 	if (*pos == 0) {
1116 		++*pos;
1117 		seq_puts(seq, "PAT memtype list:\n");
1118 	}
1119 
1120 	return memtype_get_idx(*pos);
1121 }
1122 
memtype_seq_next(struct seq_file * seq,void * v,loff_t * pos)1123 static void *memtype_seq_next(struct seq_file *seq, void *v, loff_t *pos)
1124 {
1125 	++*pos;
1126 	return memtype_get_idx(*pos);
1127 }
1128 
memtype_seq_stop(struct seq_file * seq,void * v)1129 static void memtype_seq_stop(struct seq_file *seq, void *v)
1130 {
1131 }
1132 
memtype_seq_show(struct seq_file * seq,void * v)1133 static int memtype_seq_show(struct seq_file *seq, void *v)
1134 {
1135 	struct memtype *print_entry = (struct memtype *)v;
1136 
1137 	seq_printf(seq, "%s @ 0x%Lx-0x%Lx\n", cattr_name(print_entry->type),
1138 			print_entry->start, print_entry->end);
1139 	kfree(print_entry);
1140 
1141 	return 0;
1142 }
1143 
1144 static const struct seq_operations memtype_seq_ops = {
1145 	.start = memtype_seq_start,
1146 	.next  = memtype_seq_next,
1147 	.stop  = memtype_seq_stop,
1148 	.show  = memtype_seq_show,
1149 };
1150 
memtype_seq_open(struct inode * inode,struct file * file)1151 static int memtype_seq_open(struct inode *inode, struct file *file)
1152 {
1153 	return seq_open(file, &memtype_seq_ops);
1154 }
1155 
1156 static const struct file_operations memtype_fops = {
1157 	.open    = memtype_seq_open,
1158 	.read    = seq_read,
1159 	.llseek  = seq_lseek,
1160 	.release = seq_release,
1161 };
1162 
pat_memtype_list_init(void)1163 static int __init pat_memtype_list_init(void)
1164 {
1165 	if (pat_enabled()) {
1166 		debugfs_create_file("pat_memtype_list", S_IRUSR,
1167 				    arch_debugfs_dir, NULL, &memtype_fops);
1168 	}
1169 	return 0;
1170 }
1171 
1172 late_initcall(pat_memtype_list_init);
1173 
1174 #endif /* CONFIG_DEBUG_FS && CONFIG_X86_PAT */
1175