1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2012 NetApp, Inc. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND 17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 * ARE DISCLAIMED. IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE 20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 /* 29 * This file and its contents are supplied under the terms of the 30 * Common Development and Distribution License ("CDDL"), version 1.0. 31 * You may only use this file in accordance with the terms of version 32 * 1.0 of the CDDL. 33 * 34 * A full copy of the text of the CDDL should have accompanied this 35 * source. A copy of the CDDL is also available via the Internet at 36 * http://www.illumos.org/license/CDDL. 37 * 38 * Copyright 2020 Oxide Computer Company 39 * Copyright 2026 OmniOS Community Edition (OmniOSce) Association. 40 */ 41 42 /* 43 * Memory ranges are represented with an RB tree. On insertion, the range 44 * is checked for overlaps. On lookup, the key has the same base and limit 45 * so it can be searched within the range. 46 */ 47 48 49 #include <sys/types.h> 50 #include <sys/errno.h> 51 #include <sys/tree.h> 52 #include <machine/vmm.h> 53 54 #include <assert.h> 55 #include <err.h> 56 #include <pthread.h> 57 #include <stdio.h> 58 #include <stdlib.h> 59 #include <vmmapi.h> 60 61 #include "mem.h" 62 #include "debug.h" 63 64 struct mmio_rb_range { 65 RB_ENTRY(mmio_rb_range) mr_link; /* RB tree links */ 66 struct mem_range mr_param; 67 uint64_t mr_base; 68 uint64_t mr_end; 69 }; 70 71 struct mmio_rb_tree; 72 RB_PROTOTYPE(mmio_rb_tree, mmio_rb_range, mr_link, mmio_rb_range_compare); 73 74 static RB_HEAD(mmio_rb_tree, mmio_rb_range) mmio_rb_root, mmio_rb_fallback; 75 76 /* 77 * Per-vCPU cache. Since most accesses from a vCPU will be to 78 * consecutive addresses in a range, it makes sense to cache the 79 * result of a lookup. 80 */ 81 static struct mmio_rb_range **mmio_hint; 82 static int mmio_ncpu; 83 84 static pthread_rwlock_t mmio_rwlock; 85 86 static int 87 mmio_rb_range_compare(struct mmio_rb_range *a, struct mmio_rb_range *b) 88 { 89 if (a->mr_end < b->mr_base) 90 return (-1); 91 else if (a->mr_base > b->mr_end) 92 return (1); 93 return (0); 94 } 95 96 static int 97 mmio_rb_lookup(struct mmio_rb_tree *rbt, uint64_t addr, 98 struct mmio_rb_range **entry) 99 { 100 struct mmio_rb_range find, *res; 101 102 find.mr_base = find.mr_end = addr; 103 104 res = RB_FIND(mmio_rb_tree, rbt, &find); 105 106 if (res != NULL) { 107 *entry = res; 108 return (0); 109 } 110 111 return (ENOENT); 112 } 113 114 static void 115 mmio_rb_dump(struct mmio_rb_tree *rbt) 116 { 117 int perror; 118 struct mmio_rb_range *np; 119 120 pthread_rwlock_rdlock(&mmio_rwlock); 121 RB_FOREACH(np, mmio_rb_tree, rbt) { 122 PRINTLN(" %lx:%lx, %s", np->mr_base, np->mr_end, 123 np->mr_param.name); 124 } 125 perror = pthread_rwlock_unlock(&mmio_rwlock); 126 assert(perror == 0); 127 } 128 129 static int 130 mmio_rb_add(struct mmio_rb_tree *rbt, struct mmio_rb_range *new) 131 { 132 struct mmio_rb_range *overlap; 133 134 overlap = RB_INSERT(mmio_rb_tree, rbt, new); 135 136 if (overlap != NULL) { 137 EPRINTLN("overlap detected: new %lx:%lx, tree %lx:%lx, '%s' " 138 "claims region already claimed for '%s'", 139 new->mr_base, new->mr_end, 140 overlap->mr_base, overlap->mr_end, 141 new->mr_param.name, overlap->mr_param.name); 142 143 return (EEXIST); 144 } 145 146 return (0); 147 } 148 149 RB_GENERATE(mmio_rb_tree, mmio_rb_range, mr_link, mmio_rb_range_compare); 150 151 typedef int (mem_cb_t)(struct vcpu *vcpu, uint64_t gpa, struct mem_range *mr, 152 void *arg); 153 154 static int 155 mem_read(struct vcpu *vcpu, uint64_t gpa, uint64_t *rval, int size, void *arg) 156 { 157 int error; 158 struct mem_range *mr = arg; 159 160 error = (*mr->handler)(vcpu, MEM_F_READ, gpa, size, rval, mr->arg1, 161 mr->arg2); 162 return (error); 163 } 164 165 static int 166 mem_write(struct vcpu *vcpu, uint64_t gpa, uint64_t wval, int size, void *arg) 167 { 168 int error; 169 struct mem_range *mr = arg; 170 171 error = (*mr->handler)(vcpu, MEM_F_WRITE, gpa, size, &wval, mr->arg1, 172 mr->arg2); 173 return (error); 174 } 175 176 static int 177 access_memory(struct vcpu *vcpu, uint64_t paddr, mem_cb_t *cb, void *arg) 178 { 179 struct mmio_rb_range *entry; 180 int err, perror, immutable, vcpuid; 181 182 vcpuid = vcpu_id(vcpu); 183 pthread_rwlock_rdlock(&mmio_rwlock); 184 /* 185 * First check the per-vCPU cache 186 */ 187 if (mmio_hint[vcpuid] && 188 paddr >= mmio_hint[vcpuid]->mr_base && 189 paddr <= mmio_hint[vcpuid]->mr_end) { 190 entry = mmio_hint[vcpuid]; 191 } else 192 entry = NULL; 193 194 if (entry == NULL) { 195 if (mmio_rb_lookup(&mmio_rb_root, paddr, &entry) == 0) { 196 /* Update the per-vCPU cache */ 197 mmio_hint[vcpuid] = entry; 198 } else if (mmio_rb_lookup(&mmio_rb_fallback, paddr, &entry)) { 199 perror = pthread_rwlock_unlock(&mmio_rwlock); 200 assert(perror == 0); 201 return (ESRCH); 202 } 203 } 204 205 assert(entry != NULL); 206 207 /* 208 * An 'immutable' memory range is guaranteed to be never removed 209 * so there is no need to hold 'mmio_rwlock' while calling the 210 * handler. 211 * 212 * XXX writes to the PCIR_COMMAND register can cause register_mem() 213 * to be called. If the guest is using PCI extended config space 214 * to modify the PCIR_COMMAND register then register_mem() can 215 * deadlock on 'mmio_rwlock'. However by registering the extended 216 * config space window as 'immutable' the deadlock can be avoided. 217 */ 218 immutable = (entry->mr_param.flags & MEM_F_IMMUTABLE); 219 if (immutable) { 220 perror = pthread_rwlock_unlock(&mmio_rwlock); 221 assert(perror == 0); 222 } 223 224 err = cb(vcpu, paddr, &entry->mr_param, arg); 225 226 if (!immutable) { 227 perror = pthread_rwlock_unlock(&mmio_rwlock); 228 assert(perror == 0); 229 } 230 231 return (err); 232 } 233 234 static int 235 emulate_mem_cb(struct vcpu *vcpu, uint64_t paddr, struct mem_range *mr, 236 void *arg) 237 { 238 struct vm_mmio *mmio; 239 int err = 0; 240 241 mmio = arg; 242 243 if (mmio->read != 0) { 244 err = mem_read(vcpu, paddr, &mmio->data, mmio->bytes, mr); 245 } else { 246 err = mem_write(vcpu, paddr, mmio->data, mmio->bytes, mr); 247 } 248 249 return (err); 250 } 251 252 int 253 emulate_mem(struct vcpu *vcpu, struct vm_mmio *mmio) 254 { 255 return (access_memory(vcpu, mmio->gpa, emulate_mem_cb, mmio)); 256 } 257 258 struct rw_mem_args { 259 uint64_t *val; 260 int size; 261 int operation; 262 }; 263 264 static int 265 rw_mem_cb(struct vcpu *vcpu, uint64_t paddr, struct mem_range *mr, 266 void *arg) 267 { 268 struct rw_mem_args *rma; 269 270 rma = arg; 271 return (mr->handler(vcpu, rma->operation, paddr, rma->size, 272 rma->val, mr->arg1, mr->arg2)); 273 } 274 275 int 276 read_mem(struct vcpu *vcpu, uint64_t gpa, uint64_t *rval, int size) 277 { 278 struct rw_mem_args rma; 279 280 rma.val = rval; 281 rma.size = size; 282 rma.operation = MEM_F_READ; 283 return (access_memory(vcpu, gpa, rw_mem_cb, &rma)); 284 } 285 286 int 287 write_mem(struct vcpu *vcpu, uint64_t gpa, uint64_t wval, int size) 288 { 289 struct rw_mem_args rma; 290 291 rma.val = &wval; 292 rma.size = size; 293 rma.operation = MEM_F_WRITE; 294 return (access_memory(vcpu, gpa, rw_mem_cb, &rma)); 295 } 296 297 static int 298 register_mem_int(struct mmio_rb_tree *rbt, struct mem_range *memp) 299 { 300 struct mmio_rb_range *entry, *mrp; 301 int err, perror; 302 303 err = 0; 304 305 mrp = malloc(sizeof(struct mmio_rb_range)); 306 if (mrp == NULL) { 307 warn("%s: couldn't allocate memory for mrp\n", 308 __func__); 309 err = ENOMEM; 310 } else { 311 mrp->mr_param = *memp; 312 mrp->mr_base = memp->base; 313 mrp->mr_end = memp->base + memp->size - 1; 314 pthread_rwlock_wrlock(&mmio_rwlock); 315 if (mmio_rb_lookup(rbt, memp->base, &entry) != 0) 316 err = mmio_rb_add(rbt, mrp); 317 #ifndef __FreeBSD__ 318 else /* smatch warn: possible memory leak of 'mrp' */ 319 free(mrp); 320 #endif 321 perror = pthread_rwlock_unlock(&mmio_rwlock); 322 #ifdef __FreeBSD__ 323 assert(perror == 0); 324 #else 325 if (perror != 0) { 326 mmio_rb_dump(rbt); 327 exit(4); 328 } 329 #endif 330 if (err) 331 free(mrp); 332 } 333 334 return (err); 335 } 336 337 int 338 register_mem(struct mem_range *memp) 339 { 340 341 return (register_mem_int(&mmio_rb_root, memp)); 342 } 343 344 int 345 register_mem_fallback(struct mem_range *memp) 346 { 347 348 return (register_mem_int(&mmio_rb_fallback, memp)); 349 } 350 351 int 352 unregister_mem(struct mem_range *memp) 353 { 354 struct mem_range *mr; 355 struct mmio_rb_range *entry = NULL; 356 int err, perror, i; 357 358 pthread_rwlock_wrlock(&mmio_rwlock); 359 err = mmio_rb_lookup(&mmio_rb_root, memp->base, &entry); 360 if (err == 0) { 361 mr = &entry->mr_param; 362 assert(mr->name == memp->name); 363 assert(mr->base == memp->base && mr->size == memp->size); 364 assert((mr->flags & MEM_F_IMMUTABLE) == 0); 365 RB_REMOVE(mmio_rb_tree, &mmio_rb_root, entry); 366 367 /* flush Per-vCPU cache */ 368 for (i = 0; i < mmio_ncpu; i++) { 369 if (mmio_hint[i] == entry) 370 mmio_hint[i] = NULL; 371 } 372 } 373 perror = pthread_rwlock_unlock(&mmio_rwlock); 374 assert(perror == 0); 375 376 if (entry) 377 free(entry); 378 379 return (err); 380 } 381 382 void 383 init_mem(int ncpu) 384 { 385 386 mmio_ncpu = ncpu; 387 mmio_hint = calloc(ncpu, sizeof(*mmio_hint)); 388 RB_INIT(&mmio_rb_root); 389 RB_INIT(&mmio_rb_fallback); 390 pthread_rwlock_init(&mmio_rwlock, NULL); 391 } 392