]>
Commit | Line | Data |
---|---|---|
f938d2c8 RR |
1 | /*P:400 This contains run_guest() which actually calls into the Host<->Guest |
2 | * Switcher and analyzes the return, such as determining if the Guest wants the | |
a6bd8e13 | 3 | * Host to do something. This file also contains useful helper routines. :*/ |
d7e28ffe RR |
4 | #include <linux/module.h> |
5 | #include <linux/stringify.h> | |
6 | #include <linux/stddef.h> | |
7 | #include <linux/io.h> | |
8 | #include <linux/mm.h> | |
9 | #include <linux/vmalloc.h> | |
10 | #include <linux/cpu.h> | |
11 | #include <linux/freezer.h> | |
625efab1 | 12 | #include <linux/highmem.h> |
d7e28ffe | 13 | #include <asm/paravirt.h> |
d7e28ffe RR |
14 | #include <asm/pgtable.h> |
15 | #include <asm/uaccess.h> | |
16 | #include <asm/poll.h> | |
d7e28ffe | 17 | #include <asm/asm-offsets.h> |
d7e28ffe RR |
18 | #include "lg.h" |
19 | ||
d7e28ffe RR |
20 | |
21 | static struct vm_struct *switcher_vma; | |
22 | static struct page **switcher_page; | |
23 | ||
d7e28ffe RR |
24 | /* This One Big lock protects all inter-guest data structures. */ |
25 | DEFINE_MUTEX(lguest_lock); | |
d7e28ffe | 26 | |
bff672e6 RR |
27 | /*H:010 We need to set up the Switcher at a high virtual address. Remember the |
28 | * Switcher is a few hundred bytes of assembler code which actually changes the | |
29 | * CPU to run the Guest, and then changes back to the Host when a trap or | |
30 | * interrupt happens. | |
31 | * | |
32 | * The Switcher code must be at the same virtual address in the Guest as the | |
33 | * Host since it will be running as the switchover occurs. | |
34 | * | |
35 | * Trying to map memory at a particular address is an unusual thing to do, so | |
625efab1 | 36 | * it's not a simple one-liner. */ |
d7e28ffe RR |
37 | static __init int map_switcher(void) |
38 | { | |
39 | int i, err; | |
40 | struct page **pagep; | |
41 | ||
bff672e6 RR |
42 | /* |
43 | * Map the Switcher in to high memory. | |
44 | * | |
45 | * It turns out that if we choose the address 0xFFC00000 (4MB under the | |
46 | * top virtual address), it makes setting up the page tables really | |
47 | * easy. | |
48 | */ | |
49 | ||
a6bd8e13 RR |
50 | /* We allocate an array of struct page pointers. map_vm_area() wants |
51 | * this, rather than just an array of pages. */ | |
d7e28ffe RR |
52 | switcher_page = kmalloc(sizeof(switcher_page[0])*TOTAL_SWITCHER_PAGES, |
53 | GFP_KERNEL); | |
54 | if (!switcher_page) { | |
55 | err = -ENOMEM; | |
56 | goto out; | |
57 | } | |
58 | ||
bff672e6 RR |
59 | /* Now we actually allocate the pages. The Guest will see these pages, |
60 | * so we make sure they're zeroed. */ | |
d7e28ffe RR |
61 | for (i = 0; i < TOTAL_SWITCHER_PAGES; i++) { |
62 | unsigned long addr = get_zeroed_page(GFP_KERNEL); | |
63 | if (!addr) { | |
64 | err = -ENOMEM; | |
65 | goto free_some_pages; | |
66 | } | |
67 | switcher_page[i] = virt_to_page(addr); | |
68 | } | |
69 | ||
f14ae652 RR |
70 | /* First we check that the Switcher won't overlap the fixmap area at |
71 | * the top of memory. It's currently nowhere near, but it could have | |
72 | * very strange effects if it ever happened. */ | |
73 | if (SWITCHER_ADDR + (TOTAL_SWITCHER_PAGES+1)*PAGE_SIZE > FIXADDR_START){ | |
74 | err = -ENOMEM; | |
75 | printk("lguest: mapping switcher would thwack fixmap\n"); | |
76 | goto free_pages; | |
77 | } | |
78 | ||
bff672e6 RR |
79 | /* Now we reserve the "virtual memory area" we want: 0xFFC00000 |
80 | * (SWITCHER_ADDR). We might not get it in theory, but in practice | |
f14ae652 RR |
81 | * it's worked so far. The end address needs +1 because __get_vm_area |
82 | * allocates an extra guard page, so we need space for that. */ | |
d7e28ffe | 83 | switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE, |
f14ae652 RR |
84 | VM_ALLOC, SWITCHER_ADDR, SWITCHER_ADDR |
85 | + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE); | |
d7e28ffe RR |
86 | if (!switcher_vma) { |
87 | err = -ENOMEM; | |
88 | printk("lguest: could not map switcher pages high\n"); | |
89 | goto free_pages; | |
90 | } | |
91 | ||
bff672e6 RR |
92 | /* This code actually sets up the pages we've allocated to appear at |
93 | * SWITCHER_ADDR. map_vm_area() takes the vma we allocated above, the | |
94 | * kind of pages we're mapping (kernel pages), and a pointer to our | |
95 | * array of struct pages. It increments that pointer, but we don't | |
96 | * care. */ | |
d7e28ffe RR |
97 | pagep = switcher_page; |
98 | err = map_vm_area(switcher_vma, PAGE_KERNEL, &pagep); | |
99 | if (err) { | |
100 | printk("lguest: map_vm_area failed: %i\n", err); | |
101 | goto free_vma; | |
102 | } | |
bff672e6 | 103 | |
625efab1 JS |
104 | /* Now the Switcher is mapped at the right address, we can't fail! |
105 | * Copy in the compiled-in Switcher code (from <arch>_switcher.S). */ | |
d7e28ffe RR |
106 | memcpy(switcher_vma->addr, start_switcher_text, |
107 | end_switcher_text - start_switcher_text); | |
108 | ||
d7e28ffe RR |
109 | printk(KERN_INFO "lguest: mapped switcher at %p\n", |
110 | switcher_vma->addr); | |
bff672e6 | 111 | /* And we succeeded... */ |
d7e28ffe RR |
112 | return 0; |
113 | ||
114 | free_vma: | |
115 | vunmap(switcher_vma->addr); | |
116 | free_pages: | |
117 | i = TOTAL_SWITCHER_PAGES; | |
118 | free_some_pages: | |
119 | for (--i; i >= 0; i--) | |
120 | __free_pages(switcher_page[i], 0); | |
121 | kfree(switcher_page); | |
122 | out: | |
123 | return err; | |
124 | } | |
bff672e6 | 125 | /*:*/ |
d7e28ffe | 126 | |
bff672e6 RR |
127 | /* Cleaning up the mapping when the module is unloaded is almost... |
128 | * too easy. */ | |
d7e28ffe RR |
129 | static void unmap_switcher(void) |
130 | { | |
131 | unsigned int i; | |
132 | ||
bff672e6 | 133 | /* vunmap() undoes *both* map_vm_area() and __get_vm_area(). */ |
d7e28ffe | 134 | vunmap(switcher_vma->addr); |
bff672e6 | 135 | /* Now we just need to free the pages we copied the switcher into */ |
d7e28ffe RR |
136 | for (i = 0; i < TOTAL_SWITCHER_PAGES; i++) |
137 | __free_pages(switcher_page[i], 0); | |
138 | } | |
139 | ||
e1e72965 | 140 | /*H:032 |
dde79789 RR |
141 | * Dealing With Guest Memory. |
142 | * | |
e1e72965 RR |
143 | * Before we go too much further into the Host, we need to grok the routines |
144 | * we use to deal with Guest memory. | |
145 | * | |
dde79789 | 146 | * When the Guest gives us (what it thinks is) a physical address, we can use |
3c6b5bfa RR |
147 | * the normal copy_from_user() & copy_to_user() on the corresponding place in |
148 | * the memory region allocated by the Launcher. | |
dde79789 RR |
149 | * |
150 | * But we can't trust the Guest: it might be trying to access the Launcher | |
151 | * code. We have to check that the range is below the pfn_limit the Launcher | |
152 | * gave us. We have to make sure that addr + len doesn't give us a false | |
153 | * positive by overflowing, too. */ | |
d7e28ffe RR |
154 | int lguest_address_ok(const struct lguest *lg, |
155 | unsigned long addr, unsigned long len) | |
156 | { | |
157 | return (addr+len) / PAGE_SIZE < lg->pfn_limit && (addr+len >= addr); | |
158 | } | |
159 | ||
2d37f94a RR |
160 | /* This routine copies memory from the Guest. Here we can see how useful the |
161 | * kill_lguest() routine we met in the Launcher can be: we return a random | |
162 | * value (all zeroes) instead of needing to return an error. */ | |
382ac6b3 | 163 | void __lgread(struct lg_cpu *cpu, void *b, unsigned long addr, unsigned bytes) |
d7e28ffe | 164 | { |
382ac6b3 GOC |
165 | if (!lguest_address_ok(cpu->lg, addr, bytes) |
166 | || copy_from_user(b, cpu->lg->mem_base + addr, bytes) != 0) { | |
d7e28ffe RR |
167 | /* copy_from_user should do this, but as we rely on it... */ |
168 | memset(b, 0, bytes); | |
382ac6b3 | 169 | kill_guest(cpu, "bad read address %#lx len %u", addr, bytes); |
d7e28ffe RR |
170 | } |
171 | } | |
172 | ||
a6bd8e13 | 173 | /* This is the write (copy into Guest) version. */ |
382ac6b3 | 174 | void __lgwrite(struct lg_cpu *cpu, unsigned long addr, const void *b, |
2d37f94a | 175 | unsigned bytes) |
d7e28ffe | 176 | { |
382ac6b3 GOC |
177 | if (!lguest_address_ok(cpu->lg, addr, bytes) |
178 | || copy_to_user(cpu->lg->mem_base + addr, b, bytes) != 0) | |
179 | kill_guest(cpu, "bad write address %#lx len %u", addr, bytes); | |
d7e28ffe | 180 | } |
2d37f94a | 181 | /*:*/ |
d7e28ffe | 182 | |
bff672e6 RR |
183 | /*H:030 Let's jump straight to the the main loop which runs the Guest. |
184 | * Remember, this is called by the Launcher reading /dev/lguest, and we keep | |
185 | * going around and around until something interesting happens. */ | |
d0953d42 | 186 | int run_guest(struct lg_cpu *cpu, unsigned long __user *user) |
d7e28ffe | 187 | { |
bff672e6 | 188 | /* We stop running once the Guest is dead. */ |
382ac6b3 | 189 | while (!cpu->lg->dead) { |
cc6d4fbc | 190 | /* First we run any hypercalls the Guest wants done. */ |
73044f05 GOC |
191 | if (cpu->hcall) |
192 | do_hypercalls(cpu); | |
cc6d4fbc | 193 | |
15045275 | 194 | /* It's possible the Guest did a NOTIFY hypercall to the |
bff672e6 | 195 | * Launcher, in which case we return from the read() now. */ |
5e232f4f GOC |
196 | if (cpu->pending_notify) { |
197 | if (put_user(cpu->pending_notify, user)) | |
d7e28ffe | 198 | return -EFAULT; |
5e232f4f | 199 | return sizeof(cpu->pending_notify); |
d7e28ffe RR |
200 | } |
201 | ||
bff672e6 | 202 | /* Check for signals */ |
d7e28ffe RR |
203 | if (signal_pending(current)) |
204 | return -ERESTARTSYS; | |
205 | ||
206 | /* If Waker set break_out, return to Launcher. */ | |
66686c2a | 207 | if (cpu->break_out) |
d7e28ffe RR |
208 | return -EAGAIN; |
209 | ||
a6bd8e13 RR |
210 | /* Check if there are any interrupts which can be delivered now: |
211 | * if so, this sets up the hander to be executed when we next | |
212 | * run the Guest. */ | |
177e449d | 213 | maybe_do_interrupt(cpu); |
d7e28ffe | 214 | |
bff672e6 RR |
215 | /* All long-lived kernel loops need to check with this horrible |
216 | * thing called the freezer. If the Host is trying to suspend, | |
217 | * it stops us. */ | |
d7e28ffe RR |
218 | try_to_freeze(); |
219 | ||
bff672e6 RR |
220 | /* Just make absolutely sure the Guest is still alive. One of |
221 | * those hypercalls could have been fatal, for example. */ | |
382ac6b3 | 222 | if (cpu->lg->dead) |
d7e28ffe RR |
223 | break; |
224 | ||
bff672e6 RR |
225 | /* If the Guest asked to be stopped, we sleep. The Guest's |
226 | * clock timer or LHCALL_BREAK from the Waker will wake us. */ | |
66686c2a | 227 | if (cpu->halted) { |
d7e28ffe RR |
228 | set_current_state(TASK_INTERRUPTIBLE); |
229 | schedule(); | |
230 | continue; | |
231 | } | |
232 | ||
bff672e6 RR |
233 | /* OK, now we're ready to jump into the Guest. First we put up |
234 | * the "Do Not Disturb" sign: */ | |
d7e28ffe RR |
235 | local_irq_disable(); |
236 | ||
625efab1 | 237 | /* Actually run the Guest until something happens. */ |
d0953d42 | 238 | lguest_arch_run_guest(cpu); |
bff672e6 RR |
239 | |
240 | /* Now we're ready to be interrupted or moved to other CPUs */ | |
d7e28ffe RR |
241 | local_irq_enable(); |
242 | ||
625efab1 | 243 | /* Now we deal with whatever happened to the Guest. */ |
73044f05 | 244 | lguest_arch_handle_trap(cpu); |
d7e28ffe | 245 | } |
625efab1 | 246 | |
a6bd8e13 | 247 | /* Special case: Guest is 'dead' but wants a reboot. */ |
382ac6b3 | 248 | if (cpu->lg->dead == ERR_PTR(-ERESTART)) |
ec04b13f | 249 | return -ERESTART; |
a6bd8e13 | 250 | |
bff672e6 | 251 | /* The Guest is dead => "No such file or directory" */ |
d7e28ffe RR |
252 | return -ENOENT; |
253 | } | |
254 | ||
bff672e6 RR |
255 | /*H:000 |
256 | * Welcome to the Host! | |
257 | * | |
258 | * By this point your brain has been tickled by the Guest code and numbed by | |
259 | * the Launcher code; prepare for it to be stretched by the Host code. This is | |
260 | * the heart. Let's begin at the initialization routine for the Host's lg | |
261 | * module. | |
262 | */ | |
d7e28ffe RR |
263 | static int __init init(void) |
264 | { | |
265 | int err; | |
266 | ||
bff672e6 | 267 | /* Lguest can't run under Xen, VMI or itself. It does Tricky Stuff. */ |
d7e28ffe | 268 | if (paravirt_enabled()) { |
5c55841d | 269 | printk("lguest is afraid of being a guest\n"); |
d7e28ffe RR |
270 | return -EPERM; |
271 | } | |
272 | ||
bff672e6 | 273 | /* First we put the Switcher up in very high virtual memory. */ |
d7e28ffe RR |
274 | err = map_switcher(); |
275 | if (err) | |
c18acd73 | 276 | goto out; |
d7e28ffe | 277 | |
bff672e6 | 278 | /* Now we set up the pagetable implementation for the Guests. */ |
d7e28ffe | 279 | err = init_pagetables(switcher_page, SHARED_SWITCHER_PAGES); |
c18acd73 RR |
280 | if (err) |
281 | goto unmap; | |
bff672e6 | 282 | |
c18acd73 RR |
283 | /* We might need to reserve an interrupt vector. */ |
284 | err = init_interrupts(); | |
285 | if (err) | |
286 | goto free_pgtables; | |
287 | ||
bff672e6 | 288 | /* /dev/lguest needs to be registered. */ |
d7e28ffe | 289 | err = lguest_device_init(); |
c18acd73 RR |
290 | if (err) |
291 | goto free_interrupts; | |
bff672e6 | 292 | |
625efab1 JS |
293 | /* Finally we do some architecture-specific setup. */ |
294 | lguest_arch_host_init(); | |
bff672e6 RR |
295 | |
296 | /* All good! */ | |
d7e28ffe | 297 | return 0; |
c18acd73 RR |
298 | |
299 | free_interrupts: | |
300 | free_interrupts(); | |
301 | free_pgtables: | |
302 | free_pagetables(); | |
303 | unmap: | |
304 | unmap_switcher(); | |
305 | out: | |
306 | return err; | |
d7e28ffe RR |
307 | } |
308 | ||
bff672e6 | 309 | /* Cleaning up is just the same code, backwards. With a little French. */ |
d7e28ffe RR |
310 | static void __exit fini(void) |
311 | { | |
312 | lguest_device_remove(); | |
c18acd73 | 313 | free_interrupts(); |
d7e28ffe RR |
314 | free_pagetables(); |
315 | unmap_switcher(); | |
bff672e6 | 316 | |
625efab1 | 317 | lguest_arch_host_fini(); |
d7e28ffe | 318 | } |
625efab1 | 319 | /*:*/ |
d7e28ffe | 320 | |
bff672e6 RR |
321 | /* The Host side of lguest can be a module. This is a nice way for people to |
322 | * play with it. */ | |
d7e28ffe RR |
323 | module_init(init); |
324 | module_exit(fini); | |
325 | MODULE_LICENSE("GPL"); | |
326 | MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>"); |