1 // Copyright 2023, The Android Open Source Project
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 //! HAL for the virtio_drivers crate.
16
17 use super::pci::PCI_INFO;
18 use crate::helpers::RangeExt as _;
19 use crate::memory::{alloc_shared, dealloc_shared, phys_to_virt, virt_to_phys};
20 use core::alloc::Layout;
21 use core::mem::size_of;
22 use core::ptr::{copy_nonoverlapping, NonNull};
23 use log::trace;
24 use virtio_drivers::{BufferDirection, Hal, PhysAddr, PAGE_SIZE};
25
26 pub struct HalImpl;
27
28 /// Implements the `Hal` trait for `HalImpl`.
29 ///
30 /// # Safety
31 ///
32 /// Callers of this implementatation must follow the safety requirements documented in the `Hal`
33 /// trait for the unsafe methods.
34 unsafe impl Hal for HalImpl {
35 /// Allocates the given number of contiguous physical pages of DMA memory for VirtIO use.
36 ///
37 /// # Implementation Safety
38 ///
39 /// `dma_alloc` ensures the returned DMA buffer is not aliased with any other allocation or
40 /// reference in the program until it is deallocated by `dma_dealloc` by allocating a unique
41 /// block of memory using `alloc_shared` and returning a non-null pointer to it that is
42 /// aligned to `PAGE_SIZE`.
dma_alloc(pages: usize, _direction: BufferDirection) -> (PhysAddr, NonNull<u8>)43 fn dma_alloc(pages: usize, _direction: BufferDirection) -> (PhysAddr, NonNull<u8>) {
44 let vaddr = alloc_shared(dma_layout(pages))
45 .expect("Failed to allocate and share VirtIO DMA range with host");
46 // TODO(ptosi): Move this zeroing to virtio_drivers, if it silently wants a zeroed region.
47 // SAFETY - vaddr points to a region allocated for the caller so is safe to access.
48 unsafe { core::ptr::write_bytes(vaddr.as_ptr(), 0, dma_layout(pages).size()) };
49 let paddr = virt_to_phys(vaddr);
50 (paddr, vaddr)
51 }
52
dma_dealloc(_paddr: PhysAddr, vaddr: NonNull<u8>, pages: usize) -> i3253 unsafe fn dma_dealloc(_paddr: PhysAddr, vaddr: NonNull<u8>, pages: usize) -> i32 {
54 // SAFETY - Memory was allocated by `dma_alloc` using `alloc_shared` with the same size.
55 unsafe { dealloc_shared(vaddr, dma_layout(pages)) }
56 .expect("Failed to unshare VirtIO DMA range with host");
57 0
58 }
59
60 /// Converts a physical address used for MMIO to a virtual address which the driver can access.
61 ///
62 /// # Implementation Safety
63 ///
64 /// `mmio_phys_to_virt` satisfies the requirement by checking that the mapped memory region
65 /// is within the PCI MMIO range.
mmio_phys_to_virt(paddr: PhysAddr, size: usize) -> NonNull<u8>66 unsafe fn mmio_phys_to_virt(paddr: PhysAddr, size: usize) -> NonNull<u8> {
67 let pci_info = PCI_INFO.get().expect("VirtIO HAL used before PCI_INFO was initialised");
68 let bar_range = {
69 let start = pci_info.bar_range.start.try_into().unwrap();
70 let end = pci_info.bar_range.end.try_into().unwrap();
71
72 start..end
73 };
74 let mmio_range = paddr..paddr.checked_add(size).expect("PCI MMIO region end overflowed");
75
76 // Check that the region is within the PCI MMIO range that we read from the device tree. If
77 // not, the host is probably trying to do something malicious.
78 assert!(
79 mmio_range.is_within(&bar_range),
80 "PCI MMIO region was outside of expected BAR range.",
81 );
82
83 phys_to_virt(paddr)
84 }
85
share(buffer: NonNull<[u8]>, direction: BufferDirection) -> PhysAddr86 unsafe fn share(buffer: NonNull<[u8]>, direction: BufferDirection) -> PhysAddr {
87 let size = buffer.len();
88
89 let bounce = alloc_shared(bb_layout(size))
90 .expect("Failed to allocate and share VirtIO bounce buffer with host");
91 let paddr = virt_to_phys(bounce);
92 if direction == BufferDirection::DriverToDevice {
93 let src = buffer.cast::<u8>().as_ptr().cast_const();
94 trace!("VirtIO bounce buffer at {bounce:?} (PA:{paddr:#x}) initialized from {src:?}");
95 // SAFETY - Both regions are valid, properly aligned, and don't overlap.
96 unsafe { copy_nonoverlapping(src, bounce.as_ptr(), size) };
97 }
98
99 paddr
100 }
101
unshare(paddr: PhysAddr, buffer: NonNull<[u8]>, direction: BufferDirection)102 unsafe fn unshare(paddr: PhysAddr, buffer: NonNull<[u8]>, direction: BufferDirection) {
103 let bounce = phys_to_virt(paddr);
104 let size = buffer.len();
105 if direction == BufferDirection::DeviceToDriver {
106 let dest = buffer.cast::<u8>().as_ptr();
107 trace!("VirtIO bounce buffer at {bounce:?} (PA:{paddr:#x}) copied back to {dest:?}");
108 // SAFETY - Both regions are valid, properly aligned, and don't overlap.
109 unsafe { copy_nonoverlapping(bounce.as_ptr(), dest, size) };
110 }
111
112 // SAFETY - Memory was allocated by `share` using `alloc_shared` with the same size.
113 unsafe { dealloc_shared(bounce, bb_layout(size)) }
114 .expect("Failed to unshare and deallocate VirtIO bounce buffer");
115 }
116 }
117
dma_layout(pages: usize) -> Layout118 fn dma_layout(pages: usize) -> Layout {
119 let size = pages.checked_mul(PAGE_SIZE).unwrap();
120 Layout::from_size_align(size, PAGE_SIZE).unwrap()
121 }
122
bb_layout(size: usize) -> Layout123 fn bb_layout(size: usize) -> Layout {
124 // In theory, it would be legal to align to 1-byte but use a larger alignment for good measure.
125 const VIRTIO_BOUNCE_BUFFER_ALIGN: usize = size_of::<u128>();
126 Layout::from_size_align(size, VIRTIO_BOUNCE_BUFFER_ALIGN).unwrap()
127 }
128