Changeset 89552 in vbox

Timestamp:

Jun 8, 2021 5:35:06 AM (3 years ago)

Author:

vboxsync

Message:

Intel IOMMU: bugref:9967 Address translation fixes.

Location:

trunk

Files:

• include/VBox/iommu-intel.h (modified) (3 diffs)
• src/VBox/Devices/Bus/DevIommuIntel.cpp (modified) (15 diffs)

trunk/include/VBox/iommu-intel.h

@@ -250 +250 @@
 /** Pointer to a const context entry. */
 typedef VTD_CONTEXT_ENTRY_T const *PCVTD_CONTEXT_ENTRY_T;
+AssertCompileSize(VTD_CONTEXT_ENTRY_T, 16);
 
 /** Context Entry: Qword 0 valid mask. */
@@ -511 +512 @@
 RT_BF_ASSERT_COMPILE_CHECKS(VTD_BF_FLP_ENTRY_, UINT64_C(0), UINT64_MAX,
                             (P, RW, US, PWT, PCD, A, IGN_6, RSVD_7, IGN_9_8, EA, IGN_11, ADDR, IGN_62_52, XD));
-
-/** First-Level Paging Entry. */
-typedef uint64_t VTD_FLP_ENTRY_T;
 /** @} */
 
@@ -894 +892 @@
                                                                  | VTD_BF_SL_PTE_IGN_10_MASK | VTD_BF_SL_PTE_ADDR_MASK \
                                                                  | VTD_BF_SL_PTE_IGN_61_52_MASK | VTD_BF_SL_PTE_IGN_63_MASK)
-/** @} */
-
-
-/** @name Second-Level Generic Paging Entry.
- * In accordance with the Intel spec.
- * @{ */
-/** Second-Level Paging Entry. */
-typedef uint64_t VTD_SLP_ENTRY_T;
-/** Pointer to a second-level paging entry. */
-typedef uint64_t *PVTD_SLP_ENTRY_T;
-/** Pointer to a const second-level paging entry. */
-typedef uint64_t const *CPVTD_SLP_ENTRY_T;
 /** @} */
 

trunk/src/VBox/Devices/Bus/DevIommuIntel.cpp

@@ -187 +187 @@
     kDmarDiag_At_Lm_RootEntry_Read_Failed,
     kDmarDiag_At_Lm_RootEntry_Rsvd,
-    kDmarDiag_At_Lm_Slpptr_Read_Failed,
     kDmarDiag_At_Lm_Tt_Invalid,
     kDmarDiag_At_Lm_Ut_At_Block,
@@ -200 +199 @@
     kDmarDiag_At_Xm_Pte_Sllps_Invalid,
     kDmarDiag_At_Xm_Read_Pte_Failed,
+    kDmarDiag_At_Xm_Slpptr_Read_Failed,
 
     /* CCMD_REG faults. */
@@ -261 +261 @@
     DMARDIAG_DESC(At_Lm_RootEntry_Read_Failed),
     DMARDIAG_DESC(At_Lm_RootEntry_Rsvd       ),
-    DMARDIAG_DESC(At_Lm_Slpptr_Read_Failed   ),
     DMARDIAG_DESC(At_Lm_Tt_Invalid           ),
     DMARDIAG_DESC(At_Lm_Ut_At_Block          ),
@@ -274 +273 @@
     DMARDIAG_DESC(At_Xm_Pte_Sllps_Invalid    ),
     DMARDIAG_DESC(At_Xm_Read_Pte_Failed      ),
+    DMARDIAG_DESC(At_Xm_Slpptr_Read_Failed   ),
 
     /* CCMD_REG faults. */
@@ -555 +555 @@
     uint8_t             cPagingLevel;
     uint8_t             afPadding[5];
-    /** The first-level page-table pointer.  */
-    uint64_t            uFlPtPtr;
-    /** The second-level page-table pointer.  */
-    uint64_t            uSlPtPtr;
+    /** The address of the first-level page-table.  */
+    uint64_t            GCPhysFlPt;
+    /** The address of second-level page-table.  */
+    uint64_t            GCPhysSlPt;
 } DMARMEMREQAUX;
 /** Pointer to a DMA memory request output. */
@@ -1617 +1617 @@
             case kDmarDiag_At_Lm_RootEntry_Read_Failed:      enmAtFault = VTDATFAULT_LRT_1;    break;
             case kDmarDiag_At_Lm_RootEntry_Rsvd:             enmAtFault = VTDATFAULT_LRT_3;    break;
-            case kDmarDiag_At_Lm_Slpptr_Read_Failed:         enmAtFault = VTDATFAULT_LCT_4_3;  break;
             case kDmarDiag_At_Lm_Tt_Invalid:                 enmAtFault = VTDATFAULT_LCT_4_2;  break;
             case kDmarDiag_At_Lm_Ut_At_Block:                enmAtFault = VTDATFAULT_LCT_5;    break;
@@ -1634 +1633 @@
             case kDmarDiag_At_Xm_Pte_Sllps_Invalid:          enmAtFault = fLm ? VTDATFAULT_LSL_2 : VTDATFAULT_SSL_3;   break;
             case kDmarDiag_At_Xm_Read_Pte_Failed:            enmAtFault = fLm ? VTDATFAULT_LSL_1 : VTDATFAULT_SSL_1;   break;
+            case kDmarDiag_At_Xm_Slpptr_Read_Failed:         enmAtFault = fLm ? VTDATFAULT_LCT_4_3 : VTDATFAULT_SSL_4; break;
 
             /* Shouldn't ever happen. */
@@ -2110 +2110 @@
 
 /**
- * Reads a second-level page-table pointer from guest memory.
- *
- * @returns VBox status code.
- * @param   pDevIns         The IOMMU device instance.
- * @param   GCPhysSlPtPtr   The physical address of the SLPTPTR.
- * @param   pSlpEntry       Where to store the read SLPTPTR.
- */
-static int dmarDrReadSecondLevelPtPtr(PPDMDEVINS pDevIns, RTGCPHYS GCPhysSlPtPtr, PVTD_SLP_ENTRY_T pSlpEntry)
-{
-    /* We don't verify bits 63:HAW of GCPhysSlPtPtr is 0 since reading from such an address should fail anyway. */
-    return PDMDevHlpPhysReadMeta(pDevIns, GCPhysSlPtPtr, pSlpEntry, sizeof(*pSlpEntry));
-}
-
-
-/**
  * Validates and updates the output I/O page of a translation.
  *
@@ -2156 +2141 @@
 
 /**
- * Performs second level translation.
- *
- * This is a DMA address lookup callback function which performs the translation
+ * Performs second level translation by walking the I/O page tables.
+ *
+ * This is a DMA address-lookup callback function which performs the translation
  * (and access control) as part of the lookup.
  *
@@ -2203 +2188 @@
      * Unlike AMD IOMMU paging, here there is no feature for "skipping" levels.
      */
-    uint64_t uPtEntity   = pMemReqAux->uSlPtPtr;
-    int8_t   iLevel      = pMemReqAux->cPagingLevel - 1;
-    uint8_t  cLevelShift = X86_PAGE_4K_SHIFT + (iLevel * 9);
-    Assert(iLevel >= 2);
-    for (;;)
-    {
+    uint64_t uPtEntity   = pMemReqAux->GCPhysSlPt;
+    for (int8_t idxLevel = pMemReqAux->cPagingLevel - 1; idxLevel >= 0; idxLevel--)
+    {
+        /*
+         * Read the paging entry for the current level.
+         */
+        uint8_t const cLevelShift = X86_PAGE_4K_SHIFT + (idxLevel * 9);
+        {
+            uint64_t const idxPte         = (uAddrIn >> cLevelShift) & UINT64_C(0x1ff);
+            uint64_t const offPte         = idxPte << 3;
+            RTGCPHYS const GCPhysPtEntity = (uPtEntity & X86_PAGE_BASE_MASK) | offPte;
+            int const rc = PDMDevHlpPhysReadMeta(pDevIns, GCPhysPtEntity, &uPtEntity, sizeof(uPtEntity));
+            if (RT_SUCCESS(rc))
+            { /* likely */ }
+            else
+            {
+                if ((GCPhysPtEntity & X86_PAGE_BASE_MASK) == pMemReqAux->GCPhysSlPt)
+                    dmarAtFaultRecord(pDevIns, kDmarDiag_At_Xm_Slpptr_Read_Failed, pMemReqIn, pMemReqAux);
+                else
+                    dmarAtFaultRecord(pDevIns, kDmarDiag_At_Xm_Read_Pte_Failed, pMemReqIn, pMemReqAux);
+                break;
+            }
+        }
+
         /*
          * Check I/O permissions.
          * This must be done prior to check reserved bits for properly reporting errors SSL.2 and SSL.3.
-         *
          * See Intel spec. 7.1.3 "Fault conditions and Remapping hardware behavior for various request".
          */
@@ -2230 +2232 @@
          * Validate reserved bits of the current paging entry.
          */
-        if (!(uPtEntity & ~s_auPtEntityRsvd[iLevel]))
+        if (!(uPtEntity & ~s_auPtEntityRsvd[idxLevel]))
         { /* likely */ }
         else
@@ -2243 +2245 @@
         AssertCompile(VTD_BF_SL_PDE_PS_MASK == VTD_BF_SL_PDPE_PS_MASK);
         uint8_t const fLargePage = RT_BF_GET(uPtEntity, VTD_BF_SL_PDE_PS);
-        if (fLargePage && iLevel > 0)
+        if (fLargePage && idxLevel > 0)
         {
-            Assert(iLevel == 1 || iLevel == 2);     /* Is guaranteed by the reserved bits check above. */
+            Assert(idxLevel == 1 || idxLevel == 2);   /* Is guaranteed by the reserved bits check above. */
             uint8_t const fSllpsMask = RT_BF_GET(pThis->fCapReg, VTD_BF_CAP_REG_SLLPS);
-            if (fSllpsMask & RT_BIT(iLevel - 1))
+            if (fSllpsMask & RT_BIT(idxLevel - 1))
             {
                 /*
@@ -2267 +2269 @@
          * If this is the final PTE, compute the translation address and we're done.
          */
-        if (iLevel == 0)
+        if (idxLevel == 0)
         {
             RTGCPHYS const GCPhysBase = uPtEntity & X86_GET_PAGE_BASE_MASK(cLevelShift);
             return dmarDrUpdateIoPageOut(pDevIns, GCPhysBase, cLevelShift, fPtPerm, pMemReqIn, pMemReqAux, pIoPageOut);
-        }
-
-        /*
-         * Move to the next level.
-         */
-        --iLevel;
-        cLevelShift = X86_PAGE_4K_SHIFT + (iLevel * 9);
-
-        /*
-         * Read the paging entry for the next level.
-         */
-        {
-            uint16_t const idxPte         = (uAddrIn >> cLevelShift) & UINT64_C(0x1ff);
-            uint64_t const offPte         = idxPte << 3;
-            RTGCPHYS const GCPhysPtEntity = uPtEntity | offPte;
-            int const rc = PDMDevHlpPhysReadMeta(pDevIns, GCPhysPtEntity, &uPtEntity, sizeof(uPtEntity));
-            if (RT_SUCCESS(rc))
-            { /* likely */ }
-            else
-            {
-                dmarAtFaultRecord(pDevIns, kDmarDiag_At_Xm_Read_Pte_Failed, pMemReqIn, pMemReqAux);
-                break;
-            }
         }
     }
@@ -2340 +2319 @@
 static int dmarDrMemRangeLookup(PPDMDEVINS pDevIns, PFNDMADDRLOOKUP pfnLookup, PDMARMEMREQREMAP pMemReqRemap)
 {
+    AssertPtr(pfnLookup);
+
     RTGCPHYS       GCPhysAddr  = NIL_RTGCPHYS;
     DMARMEMREQIN   MemReqIn    = pMemReqRemap->In;
@@ -2479 +2460 @@
                                         if (dmarDrLegacyModeIsAwValid(pThis, &CtxEntry, &cPagingLevel))
                                         {
-                                            /* Read the SLPTPTR from guest memory. */
-                                            VTD_SLP_ENTRY_T SlPtPtr;
-                                            RTGCPHYS const GCPhysSlPtPtr = uCtxEntryQword0 & VTD_BF_0_CONTEXT_ENTRY_SLPTPTR_MASK;
-                                            rc = dmarDrReadSecondLevelPtPtr(pDevIns, GCPhysSlPtPtr, &SlPtPtr);
-                                            if (RT_SUCCESS(rc))
-                                            {
-                                                /* Finally... perform second-level translation. */
-                                                pMemReqAux->uSlPtPtr     = SlPtPtr;
-                                                pMemReqAux->cPagingLevel = cPagingLevel;
-                                                return dmarDrMemRangeLookup(pDevIns, dmarDrSecondLevelTranslate, pMemReqRemap);
-                                            }
-                                            dmarAtFaultRecord(pDevIns, kDmarDiag_At_Lm_Slpptr_Read_Failed, pMemReqIn, pMemReqAux);
+                                            /*
+                                             * The second-level page table is located at the physical address specified
+                                             * in the context entry with which we can finally perform second-level translation.
+                                             */
+                                            pMemReqAux->cPagingLevel = cPagingLevel;
+                                            pMemReqAux->GCPhysSlPt   = uCtxEntryQword0 & VTD_BF_0_CONTEXT_ENTRY_SLPTPTR_MASK;
+                                            Assert(!(pMemReqAux->GCPhysSlPt & X86_PAGE_OFFSET_MASK));
+                                            return dmarDrMemRangeLookup(pDevIns, dmarDrSecondLevelTranslate, pMemReqRemap);
                                         }
                                         else