MTRR

MTRR, or Memory-Type Range Registers are a group of x86 Model Specific Registers providing a way to control access and cacheability of physical memory regions. These were introduced in the Intel Pentium Pro (P6) processor, intended to extend and enhance the memory type information provided by page tables (i.e. the write-through and cache disable bits).

The set of registers is provided in two groups: 11 registers for 88 fixed ranges and a number of base-mask pairs for custom range configuration. The exact number of the latter can be known by reading the capabilities register.

While this method is available in most new Intel and AMD processors, preference should be given to Page Attribute Tables instead, as many of the systems usually configure these during early boot from UEFI/BIOS and changing MTRRs which were set up by the firmware may lead to unexpected problems.

Memory types

There are 5 memory types defined for use in MTRRs:

Number	Name	Description
0	UC — Uncacheable	All accesses are uncacheable. Write combining is not allowed. Speculative accesses are not allowed.
1	WC — Write-Combining	All accesses are uncacheable. Write combining is allowed. Speculative reads are allowed.
4	WT — Writethrough	Reads allocate cache lines on a cache miss. Cache lines are not allocated on a write miss. Write hits update the cache and main memory.
5	WP — Write-Protect	Reads allocate cache lines on a cache miss. All writes update main memory. Cache lines are not allocated on a write miss. Write hits invalidate the cache line and update main memory.
6	WB — Writeback	Reads allocate cache lines on a cache miss, and can allocate to either the shared, exclusive, or modified state. Writes allocate to the modified state on a cache miss.

Accessing MTRRs

Before attempting reads/writes to MTRRs, the operating system should first check the availability of this feature by checking if CPUID.01h:EDX[bit 12] is set.

Once the feature is known to be available, the following MSRs can be used for configuration:

IA32_MTRRCAP (MSR 0xFE)

This register describes memory range types and count supported by the implementation. The register is read-only.

Bit(s)	Label	Description
63..11	-	Reserved
10	WC	Write-combining type is available
9	-	Reserved
8	FIX	All fixed-size MTRRs are available
7..0	VCNT	Count of variable-size MTRRs supported

IA32_MTRRdefType (MSR 0x2FF)

Describes the default type used for physical addresses which are outside of any configured memory ranges, as well as whether MTRRs and fixed ranges are enabled.

Bit(s)	Label	Description
63..12	-	Reserved
11	E	MTRR enable
10	FE	Fixed range enable
9..8	-	Reserved
7..0	Type	Default memory type

IA32_MTRRphysBasen and IA32_MTRRphysMaskn registers

These allow defining custom memory ranges using base-mask pairs and have the following addresses:

• IA32_MTRRphysBasen = 0x200 + (n * 2)
• IA32_MTRRphysMaskn = 0x201 + (n * 2)

Where n parameter ranges from 0 to IA32_MTRRdefType[VCNT].

Base register has the following bits:

Bit(s)	Label	Description
63..52	-	Reserved
51..12	PhysBase	Range base address
11..8	-	Reserved
7..0	Type	Range memory type

"Mask" registers use bits 51:12 to specify the region mask and bit 11 ("Valid" bit) tells if the region is enabled. If your CPU supports address widths of less than 52 bits, the remaining bits are reserved. Writing to these reserved bits will trigger a General Protection Fault.

The processor uses the following algorithm to check if an address is covered by an MTRR:

 MaskBase = PhysMask AND PhysBase
 MaskTarget = PhysMask AND Target_Address[51:12]
 IF MaskBase == MaskTarget
   target address is in range
 ELSE
   target address is not in range

The mask is calculated like this: ~(size - 1) & ((1 << ADDRESS_WIDTH) - 1) where ADDRESS WIDTH is the maximum supported address width of your CPU. Both the mask and base must be aligned to at least 4K boundary (thus must be shifted to the right by 12 to fit into the 51:12 range) and the size must be equal to the boundary, on which the range is aligned. So, in order to have, for example, a 6M-long range, one would need to set up two MTRRs, one 4M and the other 2M.

IA32_MTRRfixsize_base

If supported by implementation, the specification defines a set of 11 registers allowing the configuration of addresses in lowest 1M block.

Each fixed-size range register contains 8 eight-bit type fields and the address block is split in different sizes:

63-56	55-48	47-40	39-32	31-24	23-16	15-8	7-0	Register
Address range
70000-7FFFF	60000-6FFFF	50000-5FFFF	40000-4FFFF	30000-3FFFF	20000-2FFFF	10000-1FFFF	00000-0FFFF	MTRRfix64K_00000
9C000-9FFFF	98000-9BFFF	94000-97FFF	90000-93FFF	8C000-8FFFF	88000-8BFFF	84000-87FFF	80000-83FFF	MTRRfix16K_80000
BC000-BFFFF	B8000-BBFFF	B4000-B7FFF	B0000-B3FFF	AC000-AFFFF	A8000-ABFFF	A4000-A7FFF	A0000-A3FFF	MTRRfix16K_A0000
C7000-C7FFF	C6000-C6FFF	C5000-C5FFF	C4000-C4FFF	C3000-C3FFF	C2000-C2FFF	C1000-C1FFF	C0000-C0FFF	MTRRfix4K_C0000
CF000-CFFFF	CE000-CEFFF	CD000-CDFFF	CC000-CCFFF	CB000-CBFFF	CA000-CAFFF	C9000-C9FFF	C8000-C8FFF	MTRRfix4K_C8000
D7000-D7FFF	D6000-D6FFF	D5000-D5FFF	D4000-D4FFF	D3000-D3FFF	D2000-D2FFF	D1000-D1FFF	D0000-D0FFF	MTRRfix4K_D0000
DF000-DFFFF	DE000-DEFFF	DD000-DDFFF	DC000-DCFFF	DB000-DBFFF	DA000-DAFFF	D9000-D9FFF	D8000-D8FFF	MTRRfix4K_D8000
E7000-E7FFF	E6000-E6FFF	E5000-E5FFF	E4000-E4FFF	E3000-E3FFF	E2000-E2FFF	E1000-E1FFF	E0000-E0FFF	MTRRfix4K_E0000
EF000-EFFFF	EE000-EEFFF	ED000-EDFFF	EC000-ECFFF	EB000-EBFFF	EA000-EAFFF	E9000-E9FFF	E8000-E8FFF	MTRRfix4K_E8000
F7000-F7FFF	F6000-F6FFF	F5000-F5FFF	F4000-F4FFF	F3000-F3FFF	F2000-F2FFF	F1000-F1FFF	F0000-F0FFF	MTRRfix4K_F0000
FF000-FFFFF	FE000-FEFFF	FD000-FDFFF	FC000-FCFFF	FB000-FBFFF	FA000-FAFFF	F9000-F9FFF	F8000-F8FFF	MTRRfix4K_F8000

Fixed-size range registers have are:

• MTRRfix64K_00000 — MSR 0x250
• MTRRfix16K_80000 — MSR 0x258
• MTRRfix16K_A0000 — MSR 0x259
• MTRRfix4K_C0000 — MSR 0x268
• MTRRfix4K_C8000 — MSR 0x269
• MTRRfix4K_D0000 — MSR 0x26A
• MTRRfix4K_D8000 — MSR 0x26B
• MTRRfix4K_E0000 — MSR 0x26C
• MTRRfix4K_E8000 — MSR 0x26D
• MTRRfix4K_F0000 — MSR 0x26E
• MTRRfix4K_F8000 — MSR 0x26F

Combining with page-level control

Both MTRR and Page Tables allow setting cache-disable and writethrough attributes for memory regions — there may be cases when such ranges overlap. How MTRR and page entry bits work in combination (if the PAT register wasn't modified):

Without PAT

MTRR type	Page CD bit	Page WT bit	Resulting type
UC	—	—	UC
WC	0	—	WC
	1	0	WC (impl. dependent)
	1	1	UC
WP	0	—	WP
	1	—	UC
WT	0	—	WT
	1	—	UC
WB	0	0	WB
	0	1	WT
	1	—	UC

With PAT

MTRR type	PAT Entry Value	Resulting type
UC	UC	UC
	UC-	UC
	WC	WC
	WT	UC
	WB	UC
	WP	UC
WC	UC	UC
	UC-	WC
	WC	WC
	WT	UC
	WB	WC
	WP	UC
WT	UC	UC
	UC-	UC
	WC	WC
	WT	WT
	WB	WT
	WP	WP
WB	UC	UC
	UC-	UC
	WC	WC
	WT	WT
	WB	WB
	WP	WP
WP	UC	UC
	UC-	WC
	WC	WC
	WT	WT
	WB	WP
	WP	WP