]>
Commit | Line | Data |
---|---|---|
2e04ef76 RR |
1 | /*P:400 |
2 | * This contains run_guest() which actually calls into the Host<->Guest | |
f938d2c8 | 3 | * Switcher and analyzes the return, such as determining if the Guest wants the |
2e04ef76 RR |
4 | * Host to do something. This file also contains useful helper routines. |
5 | :*/ | |
d7e28ffe RR |
6 | #include <linux/module.h> |
7 | #include <linux/stringify.h> | |
8 | #include <linux/stddef.h> | |
9 | #include <linux/io.h> | |
10 | #include <linux/mm.h> | |
11 | #include <linux/vmalloc.h> | |
12 | #include <linux/cpu.h> | |
13 | #include <linux/freezer.h> | |
625efab1 | 14 | #include <linux/highmem.h> |
5a0e3ad6 | 15 | #include <linux/slab.h> |
d7e28ffe | 16 | #include <asm/paravirt.h> |
d7e28ffe RR |
17 | #include <asm/pgtable.h> |
18 | #include <asm/uaccess.h> | |
19 | #include <asm/poll.h> | |
d7e28ffe | 20 | #include <asm/asm-offsets.h> |
d7e28ffe RR |
21 | #include "lg.h" |
22 | ||
406a590b | 23 | unsigned long switcher_addr; |
d7e28ffe | 24 | static struct vm_struct *switcher_vma; |
856c6088 | 25 | static struct page **switcher_pages; |
d7e28ffe | 26 | |
d7e28ffe RR |
27 | /* This One Big lock protects all inter-guest data structures. */ |
28 | DEFINE_MUTEX(lguest_lock); | |
d7e28ffe | 29 | |
2e04ef76 RR |
30 | /*H:010 |
31 | * We need to set up the Switcher at a high virtual address. Remember the | |
bff672e6 RR |
32 | * Switcher is a few hundred bytes of assembler code which actually changes the |
33 | * CPU to run the Guest, and then changes back to the Host when a trap or | |
34 | * interrupt happens. | |
35 | * | |
36 | * The Switcher code must be at the same virtual address in the Guest as the | |
37 | * Host since it will be running as the switchover occurs. | |
38 | * | |
39 | * Trying to map memory at a particular address is an unusual thing to do, so | |
2e04ef76 RR |
40 | * it's not a simple one-liner. |
41 | */ | |
d7e28ffe RR |
42 | static __init int map_switcher(void) |
43 | { | |
44 | int i, err; | |
45 | struct page **pagep; | |
46 | ||
bff672e6 RR |
47 | /* |
48 | * Map the Switcher in to high memory. | |
49 | * | |
50 | * It turns out that if we choose the address 0xFFC00000 (4MB under the | |
51 | * top virtual address), it makes setting up the page tables really | |
52 | * easy. | |
53 | */ | |
54 | ||
93a2cdff RR |
55 | /* We assume Switcher text fits into a single page. */ |
56 | if (end_switcher_text - start_switcher_text > PAGE_SIZE) { | |
57 | printk(KERN_ERR "lguest: switcher text too large (%zu)\n", | |
58 | end_switcher_text - start_switcher_text); | |
59 | return -EINVAL; | |
60 | } | |
61 | ||
2e04ef76 RR |
62 | /* |
63 | * We allocate an array of struct page pointers. map_vm_area() wants | |
64 | * this, rather than just an array of pages. | |
65 | */ | |
856c6088 RR |
66 | switcher_pages = kmalloc(sizeof(switcher_pages[0])*TOTAL_SWITCHER_PAGES, |
67 | GFP_KERNEL); | |
68 | if (!switcher_pages) { | |
d7e28ffe RR |
69 | err = -ENOMEM; |
70 | goto out; | |
71 | } | |
72 | ||
2e04ef76 RR |
73 | /* |
74 | * Now we actually allocate the pages. The Guest will see these pages, | |
75 | * so we make sure they're zeroed. | |
76 | */ | |
d7e28ffe | 77 | for (i = 0; i < TOTAL_SWITCHER_PAGES; i++) { |
856c6088 RR |
78 | switcher_pages[i] = alloc_page(GFP_KERNEL|__GFP_ZERO); |
79 | if (!switcher_pages[i]) { | |
d7e28ffe RR |
80 | err = -ENOMEM; |
81 | goto free_some_pages; | |
82 | } | |
d7e28ffe RR |
83 | } |
84 | ||
406a590b RR |
85 | switcher_addr = SWITCHER_ADDR; |
86 | ||
2e04ef76 RR |
87 | /* |
88 | * First we check that the Switcher won't overlap the fixmap area at | |
f14ae652 | 89 | * the top of memory. It's currently nowhere near, but it could have |
2e04ef76 RR |
90 | * very strange effects if it ever happened. |
91 | */ | |
406a590b | 92 | if (switcher_addr + (TOTAL_SWITCHER_PAGES+1)*PAGE_SIZE > FIXADDR_START){ |
f14ae652 RR |
93 | err = -ENOMEM; |
94 | printk("lguest: mapping switcher would thwack fixmap\n"); | |
95 | goto free_pages; | |
96 | } | |
97 | ||
2e04ef76 | 98 | /* |
406a590b RR |
99 | * Now we reserve the "virtual memory area" we want. We might |
100 | * not get it in theory, but in practice it's worked so far. | |
101 | * The end address needs +1 because __get_vm_area allocates an | |
102 | * extra guard page, so we need space for that. | |
2e04ef76 | 103 | */ |
d7e28ffe | 104 | switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE, |
406a590b | 105 | VM_ALLOC, switcher_addr, switcher_addr |
f14ae652 | 106 | + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE); |
d7e28ffe RR |
107 | if (!switcher_vma) { |
108 | err = -ENOMEM; | |
109 | printk("lguest: could not map switcher pages high\n"); | |
110 | goto free_pages; | |
111 | } | |
112 | ||
2e04ef76 RR |
113 | /* |
114 | * This code actually sets up the pages we've allocated to appear at | |
406a590b | 115 | * switcher_addr. map_vm_area() takes the vma we allocated above, the |
bff672e6 RR |
116 | * kind of pages we're mapping (kernel pages), and a pointer to our |
117 | * array of struct pages. It increments that pointer, but we don't | |
2e04ef76 RR |
118 | * care. |
119 | */ | |
856c6088 | 120 | pagep = switcher_pages; |
ed1dc778 | 121 | err = map_vm_area(switcher_vma, PAGE_KERNEL_EXEC, &pagep); |
d7e28ffe RR |
122 | if (err) { |
123 | printk("lguest: map_vm_area failed: %i\n", err); | |
124 | goto free_vma; | |
125 | } | |
bff672e6 | 126 | |
2e04ef76 RR |
127 | /* |
128 | * Now the Switcher is mapped at the right address, we can't fail! | |
9f54288d | 129 | * Copy in the compiled-in Switcher code (from x86/switcher_32.S). |
2e04ef76 | 130 | */ |
d7e28ffe RR |
131 | memcpy(switcher_vma->addr, start_switcher_text, |
132 | end_switcher_text - start_switcher_text); | |
133 | ||
d7e28ffe RR |
134 | printk(KERN_INFO "lguest: mapped switcher at %p\n", |
135 | switcher_vma->addr); | |
bff672e6 | 136 | /* And we succeeded... */ |
d7e28ffe RR |
137 | return 0; |
138 | ||
139 | free_vma: | |
140 | vunmap(switcher_vma->addr); | |
141 | free_pages: | |
142 | i = TOTAL_SWITCHER_PAGES; | |
143 | free_some_pages: | |
144 | for (--i; i >= 0; i--) | |
856c6088 RR |
145 | __free_pages(switcher_pages[i], 0); |
146 | kfree(switcher_pages); | |
d7e28ffe RR |
147 | out: |
148 | return err; | |
149 | } | |
bff672e6 | 150 | /*:*/ |
d7e28ffe | 151 | |
2e04ef76 | 152 | /* Cleaning up the mapping when the module is unloaded is almost... too easy. */ |
d7e28ffe RR |
153 | static void unmap_switcher(void) |
154 | { | |
155 | unsigned int i; | |
156 | ||
bff672e6 | 157 | /* vunmap() undoes *both* map_vm_area() and __get_vm_area(). */ |
d7e28ffe | 158 | vunmap(switcher_vma->addr); |
bff672e6 | 159 | /* Now we just need to free the pages we copied the switcher into */ |
d7e28ffe | 160 | for (i = 0; i < TOTAL_SWITCHER_PAGES; i++) |
856c6088 RR |
161 | __free_pages(switcher_pages[i], 0); |
162 | kfree(switcher_pages); | |
d7e28ffe RR |
163 | } |
164 | ||
e1e72965 | 165 | /*H:032 |
dde79789 RR |
166 | * Dealing With Guest Memory. |
167 | * | |
e1e72965 RR |
168 | * Before we go too much further into the Host, we need to grok the routines |
169 | * we use to deal with Guest memory. | |
170 | * | |
dde79789 | 171 | * When the Guest gives us (what it thinks is) a physical address, we can use |
3c6b5bfa RR |
172 | * the normal copy_from_user() & copy_to_user() on the corresponding place in |
173 | * the memory region allocated by the Launcher. | |
dde79789 RR |
174 | * |
175 | * But we can't trust the Guest: it might be trying to access the Launcher | |
176 | * code. We have to check that the range is below the pfn_limit the Launcher | |
177 | * gave us. We have to make sure that addr + len doesn't give us a false | |
2e04ef76 RR |
178 | * positive by overflowing, too. |
179 | */ | |
df1693ab MZ |
180 | bool lguest_address_ok(const struct lguest *lg, |
181 | unsigned long addr, unsigned long len) | |
d7e28ffe RR |
182 | { |
183 | return (addr+len) / PAGE_SIZE < lg->pfn_limit && (addr+len >= addr); | |
184 | } | |
185 | ||
2e04ef76 RR |
186 | /* |
187 | * This routine copies memory from the Guest. Here we can see how useful the | |
2d37f94a | 188 | * kill_lguest() routine we met in the Launcher can be: we return a random |
2e04ef76 RR |
189 | * value (all zeroes) instead of needing to return an error. |
190 | */ | |
382ac6b3 | 191 | void __lgread(struct lg_cpu *cpu, void *b, unsigned long addr, unsigned bytes) |
d7e28ffe | 192 | { |
382ac6b3 GOC |
193 | if (!lguest_address_ok(cpu->lg, addr, bytes) |
194 | || copy_from_user(b, cpu->lg->mem_base + addr, bytes) != 0) { | |
d7e28ffe RR |
195 | /* copy_from_user should do this, but as we rely on it... */ |
196 | memset(b, 0, bytes); | |
382ac6b3 | 197 | kill_guest(cpu, "bad read address %#lx len %u", addr, bytes); |
d7e28ffe RR |
198 | } |
199 | } | |
200 | ||
a6bd8e13 | 201 | /* This is the write (copy into Guest) version. */ |
382ac6b3 | 202 | void __lgwrite(struct lg_cpu *cpu, unsigned long addr, const void *b, |
2d37f94a | 203 | unsigned bytes) |
d7e28ffe | 204 | { |
382ac6b3 GOC |
205 | if (!lguest_address_ok(cpu->lg, addr, bytes) |
206 | || copy_to_user(cpu->lg->mem_base + addr, b, bytes) != 0) | |
207 | kill_guest(cpu, "bad write address %#lx len %u", addr, bytes); | |
d7e28ffe | 208 | } |
2d37f94a | 209 | /*:*/ |
d7e28ffe | 210 | |
2e04ef76 RR |
211 | /*H:030 |
212 | * Let's jump straight to the the main loop which runs the Guest. | |
bff672e6 | 213 | * Remember, this is called by the Launcher reading /dev/lguest, and we keep |
2e04ef76 RR |
214 | * going around and around until something interesting happens. |
215 | */ | |
d0953d42 | 216 | int run_guest(struct lg_cpu *cpu, unsigned long __user *user) |
d7e28ffe | 217 | { |
bff672e6 | 218 | /* We stop running once the Guest is dead. */ |
382ac6b3 | 219 | while (!cpu->lg->dead) { |
abd41f03 | 220 | unsigned int irq; |
a32a8813 | 221 | bool more; |
abd41f03 | 222 | |
cc6d4fbc | 223 | /* First we run any hypercalls the Guest wants done. */ |
73044f05 GOC |
224 | if (cpu->hcall) |
225 | do_hypercalls(cpu); | |
cc6d4fbc | 226 | |
2e04ef76 RR |
227 | /* |
228 | * It's possible the Guest did a NOTIFY hypercall to the | |
a91d74a3 | 229 | * Launcher. |
2e04ef76 | 230 | */ |
5e232f4f | 231 | if (cpu->pending_notify) { |
a91d74a3 RR |
232 | /* |
233 | * Does it just needs to write to a registered | |
234 | * eventfd (ie. the appropriate virtqueue thread)? | |
235 | */ | |
df60aeef | 236 | if (!send_notify_to_eventfd(cpu)) { |
681f2066 | 237 | /* OK, we tell the main Launcher. */ |
df60aeef RR |
238 | if (put_user(cpu->pending_notify, user)) |
239 | return -EFAULT; | |
240 | return sizeof(cpu->pending_notify); | |
241 | } | |
d7e28ffe RR |
242 | } |
243 | ||
0acf0001 MH |
244 | /* |
245 | * All long-lived kernel loops need to check with this horrible | |
246 | * thing called the freezer. If the Host is trying to suspend, | |
247 | * it stops us. | |
248 | */ | |
249 | try_to_freeze(); | |
250 | ||
bff672e6 | 251 | /* Check for signals */ |
d7e28ffe RR |
252 | if (signal_pending(current)) |
253 | return -ERESTARTSYS; | |
254 | ||
2e04ef76 RR |
255 | /* |
256 | * Check if there are any interrupts which can be delivered now: | |
a6bd8e13 | 257 | * if so, this sets up the hander to be executed when we next |
2e04ef76 RR |
258 | * run the Guest. |
259 | */ | |
a32a8813 | 260 | irq = interrupt_pending(cpu, &more); |
abd41f03 | 261 | if (irq < LGUEST_IRQS) |
a32a8813 | 262 | try_deliver_interrupt(cpu, irq, more); |
d7e28ffe | 263 | |
2e04ef76 RR |
264 | /* |
265 | * Just make absolutely sure the Guest is still alive. One of | |
266 | * those hypercalls could have been fatal, for example. | |
267 | */ | |
382ac6b3 | 268 | if (cpu->lg->dead) |
d7e28ffe RR |
269 | break; |
270 | ||
2e04ef76 RR |
271 | /* |
272 | * If the Guest asked to be stopped, we sleep. The Guest's | |
273 | * clock timer will wake us. | |
274 | */ | |
66686c2a | 275 | if (cpu->halted) { |
d7e28ffe | 276 | set_current_state(TASK_INTERRUPTIBLE); |
2e04ef76 RR |
277 | /* |
278 | * Just before we sleep, make sure no interrupt snuck in | |
279 | * which we should be doing. | |
280 | */ | |
5dac051b | 281 | if (interrupt_pending(cpu, &more) < LGUEST_IRQS) |
abd41f03 RR |
282 | set_current_state(TASK_RUNNING); |
283 | else | |
284 | schedule(); | |
d7e28ffe RR |
285 | continue; |
286 | } | |
287 | ||
2e04ef76 RR |
288 | /* |
289 | * OK, now we're ready to jump into the Guest. First we put up | |
290 | * the "Do Not Disturb" sign: | |
291 | */ | |
d7e28ffe RR |
292 | local_irq_disable(); |
293 | ||
625efab1 | 294 | /* Actually run the Guest until something happens. */ |
d0953d42 | 295 | lguest_arch_run_guest(cpu); |
bff672e6 RR |
296 | |
297 | /* Now we're ready to be interrupted or moved to other CPUs */ | |
d7e28ffe RR |
298 | local_irq_enable(); |
299 | ||
625efab1 | 300 | /* Now we deal with whatever happened to the Guest. */ |
73044f05 | 301 | lguest_arch_handle_trap(cpu); |
d7e28ffe | 302 | } |
625efab1 | 303 | |
a6bd8e13 | 304 | /* Special case: Guest is 'dead' but wants a reboot. */ |
382ac6b3 | 305 | if (cpu->lg->dead == ERR_PTR(-ERESTART)) |
ec04b13f | 306 | return -ERESTART; |
a6bd8e13 | 307 | |
bff672e6 | 308 | /* The Guest is dead => "No such file or directory" */ |
d7e28ffe RR |
309 | return -ENOENT; |
310 | } | |
311 | ||
bff672e6 RR |
312 | /*H:000 |
313 | * Welcome to the Host! | |
314 | * | |
315 | * By this point your brain has been tickled by the Guest code and numbed by | |
316 | * the Launcher code; prepare for it to be stretched by the Host code. This is | |
317 | * the heart. Let's begin at the initialization routine for the Host's lg | |
318 | * module. | |
319 | */ | |
d7e28ffe RR |
320 | static int __init init(void) |
321 | { | |
322 | int err; | |
323 | ||
bff672e6 | 324 | /* Lguest can't run under Xen, VMI or itself. It does Tricky Stuff. */ |
b56e3215 | 325 | if (get_kernel_rpl() != 0) { |
5c55841d | 326 | printk("lguest is afraid of being a guest\n"); |
d7e28ffe RR |
327 | return -EPERM; |
328 | } | |
329 | ||
bff672e6 | 330 | /* First we put the Switcher up in very high virtual memory. */ |
d7e28ffe RR |
331 | err = map_switcher(); |
332 | if (err) | |
c18acd73 | 333 | goto out; |
d7e28ffe | 334 | |
bff672e6 | 335 | /* Now we set up the pagetable implementation for the Guests. */ |
93a2cdff | 336 | err = init_pagetables(switcher_pages); |
c18acd73 RR |
337 | if (err) |
338 | goto unmap; | |
bff672e6 | 339 | |
c18acd73 RR |
340 | /* We might need to reserve an interrupt vector. */ |
341 | err = init_interrupts(); | |
342 | if (err) | |
343 | goto free_pgtables; | |
344 | ||
bff672e6 | 345 | /* /dev/lguest needs to be registered. */ |
d7e28ffe | 346 | err = lguest_device_init(); |
c18acd73 RR |
347 | if (err) |
348 | goto free_interrupts; | |
bff672e6 | 349 | |
625efab1 JS |
350 | /* Finally we do some architecture-specific setup. */ |
351 | lguest_arch_host_init(); | |
bff672e6 RR |
352 | |
353 | /* All good! */ | |
d7e28ffe | 354 | return 0; |
c18acd73 RR |
355 | |
356 | free_interrupts: | |
357 | free_interrupts(); | |
358 | free_pgtables: | |
359 | free_pagetables(); | |
360 | unmap: | |
361 | unmap_switcher(); | |
362 | out: | |
363 | return err; | |
d7e28ffe RR |
364 | } |
365 | ||
bff672e6 | 366 | /* Cleaning up is just the same code, backwards. With a little French. */ |
d7e28ffe RR |
367 | static void __exit fini(void) |
368 | { | |
369 | lguest_device_remove(); | |
c18acd73 | 370 | free_interrupts(); |
d7e28ffe RR |
371 | free_pagetables(); |
372 | unmap_switcher(); | |
bff672e6 | 373 | |
625efab1 | 374 | lguest_arch_host_fini(); |
d7e28ffe | 375 | } |
625efab1 | 376 | /*:*/ |
d7e28ffe | 377 | |
2e04ef76 RR |
378 | /* |
379 | * The Host side of lguest can be a module. This is a nice way for people to | |
380 | * play with it. | |
381 | */ | |
d7e28ffe RR |
382 | module_init(init); |
383 | module_exit(fini); | |
384 | MODULE_LICENSE("GPL"); | |
385 | MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>"); |