Pierre-Clément Tosi | 90238c5 | 2023-04-27 17:59:10 +0000 | [diff] [blame] | 1 | // Copyright 2023, The Android Open Source Project |
| 2 | // |
| 3 | // Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | // you may not use this file except in compliance with the License. |
| 5 | // You may obtain a copy of the License at |
| 6 | // |
| 7 | // http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | // |
| 9 | // Unless required by applicable law or agreed to in writing, software |
| 10 | // distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | // See the License for the specific language governing permissions and |
| 13 | // limitations under the License. |
| 14 | |
| 15 | //! HAL for the virtio_drivers crate. |
| 16 | |
Andrew Walbran | b398fc8 | 2023-01-24 14:45:46 +0000 | [diff] [blame] | 17 | use super::pci::PCI_INFO; |
Pierre-Clément Tosi | 90238c5 | 2023-04-27 17:59:10 +0000 | [diff] [blame] | 18 | use crate::helpers::RangeExt as _; |
Andrew Walbran | 272bd7a | 2023-01-24 14:02:36 +0000 | [diff] [blame] | 19 | use crate::memory::{alloc_shared, dealloc_shared, phys_to_virt, virt_to_phys}; |
Pierre-Clément Tosi | 2d5bc58 | 2023-05-03 11:23:11 +0000 | [diff] [blame] | 20 | use core::alloc::Layout; |
| 21 | use core::mem::size_of; |
Pierre-Clément Tosi | 90238c5 | 2023-04-27 17:59:10 +0000 | [diff] [blame] | 22 | use core::ptr::{copy_nonoverlapping, NonNull}; |
| 23 | use log::trace; |
Andrew Walbran | 272bd7a | 2023-01-24 14:02:36 +0000 | [diff] [blame] | 24 | use virtio_drivers::{BufferDirection, Hal, PhysAddr, PAGE_SIZE}; |
Andrew Walbran | 848decf | 2022-12-15 14:39:38 +0000 | [diff] [blame] | 25 | |
| 26 | pub struct HalImpl; |
| 27 | |
Alice Wang | 63e0d0d | 2023-04-20 14:15:32 +0000 | [diff] [blame] | 28 | /// Implements the `Hal` trait for `HalImpl`. |
| 29 | /// |
| 30 | /// # Safety |
| 31 | /// |
Pierre-Clément Tosi | 90238c5 | 2023-04-27 17:59:10 +0000 | [diff] [blame] | 32 | /// Callers of this implementatation must follow the safety requirements documented in the `Hal` |
| 33 | /// trait for the unsafe methods. |
Alice Wang | 63e0d0d | 2023-04-20 14:15:32 +0000 | [diff] [blame] | 34 | unsafe impl Hal for HalImpl { |
| 35 | /// Allocates the given number of contiguous physical pages of DMA memory for VirtIO use. |
| 36 | /// |
| 37 | /// # Implementation Safety |
| 38 | /// |
| 39 | /// `dma_alloc` ensures the returned DMA buffer is not aliased with any other allocation or |
| 40 | /// reference in the program until it is deallocated by `dma_dealloc` by allocating a unique |
| 41 | /// block of memory using `alloc_shared` and returning a non-null pointer to it that is |
| 42 | /// aligned to `PAGE_SIZE`. |
Andrew Walbran | 272bd7a | 2023-01-24 14:02:36 +0000 | [diff] [blame] | 43 | fn dma_alloc(pages: usize, _direction: BufferDirection) -> (PhysAddr, NonNull<u8>) { |
Pierre-Clément Tosi | 2d5bc58 | 2023-05-03 11:23:11 +0000 | [diff] [blame] | 44 | let vaddr = alloc_shared(dma_layout(pages)) |
| 45 | .expect("Failed to allocate and share VirtIO DMA range with host"); |
Pierre-Clément Tosi | f19c0e6 | 2023-05-02 13:56:58 +0000 | [diff] [blame^] | 46 | // TODO(ptosi): Move this zeroing to virtio_drivers, if it silently wants a zeroed region. |
| 47 | // SAFETY - vaddr points to a region allocated for the caller so is safe to access. |
| 48 | unsafe { core::ptr::write_bytes(vaddr.as_ptr(), 0, dma_layout(pages).size()) }; |
Andrew Walbran | 272bd7a | 2023-01-24 14:02:36 +0000 | [diff] [blame] | 49 | let paddr = virt_to_phys(vaddr); |
| 50 | (paddr, vaddr) |
Andrew Walbran | 848decf | 2022-12-15 14:39:38 +0000 | [diff] [blame] | 51 | } |
| 52 | |
Pierre-Clément Tosi | 90238c5 | 2023-04-27 17:59:10 +0000 | [diff] [blame] | 53 | unsafe fn dma_dealloc(_paddr: PhysAddr, vaddr: NonNull<u8>, pages: usize) -> i32 { |
Pierre-Clément Tosi | 90238c5 | 2023-04-27 17:59:10 +0000 | [diff] [blame] | 54 | // SAFETY - Memory was allocated by `dma_alloc` using `alloc_shared` with the same size. |
Pierre-Clément Tosi | 2d5bc58 | 2023-05-03 11:23:11 +0000 | [diff] [blame] | 55 | unsafe { dealloc_shared(vaddr, dma_layout(pages)) } |
Pierre-Clément Tosi | 90238c5 | 2023-04-27 17:59:10 +0000 | [diff] [blame] | 56 | .expect("Failed to unshare VirtIO DMA range with host"); |
Andrew Walbran | 848decf | 2022-12-15 14:39:38 +0000 | [diff] [blame] | 57 | 0 |
| 58 | } |
| 59 | |
Alice Wang | 63e0d0d | 2023-04-20 14:15:32 +0000 | [diff] [blame] | 60 | /// Converts a physical address used for MMIO to a virtual address which the driver can access. |
| 61 | /// |
| 62 | /// # Implementation Safety |
| 63 | /// |
| 64 | /// `mmio_phys_to_virt` satisfies the requirement by checking that the mapped memory region |
| 65 | /// is within the PCI MMIO range. |
| 66 | unsafe fn mmio_phys_to_virt(paddr: PhysAddr, size: usize) -> NonNull<u8> { |
Andrew Walbran | b398fc8 | 2023-01-24 14:45:46 +0000 | [diff] [blame] | 67 | let pci_info = PCI_INFO.get().expect("VirtIO HAL used before PCI_INFO was initialised"); |
Pierre-Clément Tosi | 90238c5 | 2023-04-27 17:59:10 +0000 | [diff] [blame] | 68 | let bar_range = { |
| 69 | let start = pci_info.bar_range.start.try_into().unwrap(); |
| 70 | let end = pci_info.bar_range.end.try_into().unwrap(); |
| 71 | |
| 72 | start..end |
| 73 | }; |
| 74 | let mmio_range = paddr..paddr.checked_add(size).expect("PCI MMIO region end overflowed"); |
| 75 | |
Andrew Walbran | b398fc8 | 2023-01-24 14:45:46 +0000 | [diff] [blame] | 76 | // Check that the region is within the PCI MMIO range that we read from the device tree. If |
| 77 | // not, the host is probably trying to do something malicious. |
Pierre-Clément Tosi | 90238c5 | 2023-04-27 17:59:10 +0000 | [diff] [blame] | 78 | assert!( |
| 79 | mmio_range.is_within(&bar_range), |
| 80 | "PCI MMIO region was outside of expected BAR range.", |
| 81 | ); |
| 82 | |
Andrew Walbran | 272bd7a | 2023-01-24 14:02:36 +0000 | [diff] [blame] | 83 | phys_to_virt(paddr) |
Andrew Walbran | 848decf | 2022-12-15 14:39:38 +0000 | [diff] [blame] | 84 | } |
| 85 | |
Alice Wang | 63e0d0d | 2023-04-20 14:15:32 +0000 | [diff] [blame] | 86 | unsafe fn share(buffer: NonNull<[u8]>, direction: BufferDirection) -> PhysAddr { |
Andrew Walbran | 848decf | 2022-12-15 14:39:38 +0000 | [diff] [blame] | 87 | let size = buffer.len(); |
| 88 | |
Pierre-Clément Tosi | 2d5bc58 | 2023-05-03 11:23:11 +0000 | [diff] [blame] | 89 | let bounce = alloc_shared(bb_layout(size)) |
Pierre-Clément Tosi | 90238c5 | 2023-04-27 17:59:10 +0000 | [diff] [blame] | 90 | .expect("Failed to allocate and share VirtIO bounce buffer with host"); |
| 91 | let paddr = virt_to_phys(bounce); |
Andrew Walbran | 848decf | 2022-12-15 14:39:38 +0000 | [diff] [blame] | 92 | if direction == BufferDirection::DriverToDevice { |
Pierre-Clément Tosi | 90238c5 | 2023-04-27 17:59:10 +0000 | [diff] [blame] | 93 | let src = buffer.cast::<u8>().as_ptr().cast_const(); |
| 94 | trace!("VirtIO bounce buffer at {bounce:?} (PA:{paddr:#x}) initialized from {src:?}"); |
| 95 | // SAFETY - Both regions are valid, properly aligned, and don't overlap. |
| 96 | unsafe { copy_nonoverlapping(src, bounce.as_ptr(), size) }; |
Andrew Walbran | 848decf | 2022-12-15 14:39:38 +0000 | [diff] [blame] | 97 | } |
Pierre-Clément Tosi | 90238c5 | 2023-04-27 17:59:10 +0000 | [diff] [blame] | 98 | |
| 99 | paddr |
Andrew Walbran | 848decf | 2022-12-15 14:39:38 +0000 | [diff] [blame] | 100 | } |
| 101 | |
Alice Wang | 63e0d0d | 2023-04-20 14:15:32 +0000 | [diff] [blame] | 102 | unsafe fn unshare(paddr: PhysAddr, buffer: NonNull<[u8]>, direction: BufferDirection) { |
Pierre-Clément Tosi | 90238c5 | 2023-04-27 17:59:10 +0000 | [diff] [blame] | 103 | let bounce = phys_to_virt(paddr); |
Andrew Walbran | 848decf | 2022-12-15 14:39:38 +0000 | [diff] [blame] | 104 | let size = buffer.len(); |
| 105 | if direction == BufferDirection::DeviceToDriver { |
Pierre-Clément Tosi | 90238c5 | 2023-04-27 17:59:10 +0000 | [diff] [blame] | 106 | let dest = buffer.cast::<u8>().as_ptr(); |
| 107 | trace!("VirtIO bounce buffer at {bounce:?} (PA:{paddr:#x}) copied back to {dest:?}"); |
| 108 | // SAFETY - Both regions are valid, properly aligned, and don't overlap. |
| 109 | unsafe { copy_nonoverlapping(bounce.as_ptr(), dest, size) }; |
Andrew Walbran | 848decf | 2022-12-15 14:39:38 +0000 | [diff] [blame] | 110 | } |
| 111 | |
Pierre-Clément Tosi | 90238c5 | 2023-04-27 17:59:10 +0000 | [diff] [blame] | 112 | // SAFETY - Memory was allocated by `share` using `alloc_shared` with the same size. |
Pierre-Clément Tosi | 2d5bc58 | 2023-05-03 11:23:11 +0000 | [diff] [blame] | 113 | unsafe { dealloc_shared(bounce, bb_layout(size)) } |
Pierre-Clément Tosi | 90238c5 | 2023-04-27 17:59:10 +0000 | [diff] [blame] | 114 | .expect("Failed to unshare and deallocate VirtIO bounce buffer"); |
Andrew Walbran | 848decf | 2022-12-15 14:39:38 +0000 | [diff] [blame] | 115 | } |
| 116 | } |
Pierre-Clément Tosi | 2d5bc58 | 2023-05-03 11:23:11 +0000 | [diff] [blame] | 117 | |
| 118 | fn dma_layout(pages: usize) -> Layout { |
| 119 | let size = pages.checked_mul(PAGE_SIZE).unwrap(); |
| 120 | Layout::from_size_align(size, PAGE_SIZE).unwrap() |
| 121 | } |
| 122 | |
| 123 | fn bb_layout(size: usize) -> Layout { |
| 124 | // In theory, it would be legal to align to 1-byte but use a larger alignment for good measure. |
| 125 | const VIRTIO_BOUNCE_BUFFER_ALIGN: usize = size_of::<u128>(); |
| 126 | Layout::from_size_align(size, VIRTIO_BOUNCE_BUFFER_ALIGN).unwrap() |
| 127 | } |