]>
Commit | Line | Data |
---|---|---|
f938d2c8 RR |
1 | /*P:400 This contains run_guest() which actually calls into the Host<->Guest |
2 | * Switcher and analyzes the return, such as determining if the Guest wants the | |
3 | * Host to do something. This file also contains useful helper routines, and a | |
4 | * couple of non-obvious setup and teardown pieces which were implemented after | |
5 | * days of debugging pain. :*/ | |
d7e28ffe RR |
6 | #include <linux/module.h> |
7 | #include <linux/stringify.h> | |
8 | #include <linux/stddef.h> | |
9 | #include <linux/io.h> | |
10 | #include <linux/mm.h> | |
11 | #include <linux/vmalloc.h> | |
12 | #include <linux/cpu.h> | |
13 | #include <linux/freezer.h> | |
625efab1 | 14 | #include <linux/highmem.h> |
d7e28ffe | 15 | #include <asm/paravirt.h> |
d7e28ffe RR |
16 | #include <asm/pgtable.h> |
17 | #include <asm/uaccess.h> | |
18 | #include <asm/poll.h> | |
d7e28ffe | 19 | #include <asm/asm-offsets.h> |
d7e28ffe RR |
20 | #include "lg.h" |
21 | ||
d7e28ffe RR |
22 | |
23 | static struct vm_struct *switcher_vma; | |
24 | static struct page **switcher_page; | |
25 | ||
d7e28ffe RR |
26 | /* This One Big lock protects all inter-guest data structures. */ |
27 | DEFINE_MUTEX(lguest_lock); | |
d7e28ffe | 28 | |
bff672e6 RR |
29 | /*H:010 We need to set up the Switcher at a high virtual address. Remember the |
30 | * Switcher is a few hundred bytes of assembler code which actually changes the | |
31 | * CPU to run the Guest, and then changes back to the Host when a trap or | |
32 | * interrupt happens. | |
33 | * | |
34 | * The Switcher code must be at the same virtual address in the Guest as the | |
35 | * Host since it will be running as the switchover occurs. | |
36 | * | |
37 | * Trying to map memory at a particular address is an unusual thing to do, so | |
625efab1 | 38 | * it's not a simple one-liner. */ |
d7e28ffe RR |
39 | static __init int map_switcher(void) |
40 | { | |
41 | int i, err; | |
42 | struct page **pagep; | |
43 | ||
bff672e6 RR |
44 | /* |
45 | * Map the Switcher in to high memory. | |
46 | * | |
47 | * It turns out that if we choose the address 0xFFC00000 (4MB under the | |
48 | * top virtual address), it makes setting up the page tables really | |
49 | * easy. | |
50 | */ | |
51 | ||
52 | /* We allocate an array of "struct page"s. map_vm_area() wants the | |
53 | * pages in this form, rather than just an array of pointers. */ | |
d7e28ffe RR |
54 | switcher_page = kmalloc(sizeof(switcher_page[0])*TOTAL_SWITCHER_PAGES, |
55 | GFP_KERNEL); | |
56 | if (!switcher_page) { | |
57 | err = -ENOMEM; | |
58 | goto out; | |
59 | } | |
60 | ||
bff672e6 RR |
61 | /* Now we actually allocate the pages. The Guest will see these pages, |
62 | * so we make sure they're zeroed. */ | |
d7e28ffe RR |
63 | for (i = 0; i < TOTAL_SWITCHER_PAGES; i++) { |
64 | unsigned long addr = get_zeroed_page(GFP_KERNEL); | |
65 | if (!addr) { | |
66 | err = -ENOMEM; | |
67 | goto free_some_pages; | |
68 | } | |
69 | switcher_page[i] = virt_to_page(addr); | |
70 | } | |
71 | ||
bff672e6 RR |
72 | /* Now we reserve the "virtual memory area" we want: 0xFFC00000 |
73 | * (SWITCHER_ADDR). We might not get it in theory, but in practice | |
74 | * it's worked so far. */ | |
d7e28ffe RR |
75 | switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE, |
76 | VM_ALLOC, SWITCHER_ADDR, VMALLOC_END); | |
77 | if (!switcher_vma) { | |
78 | err = -ENOMEM; | |
79 | printk("lguest: could not map switcher pages high\n"); | |
80 | goto free_pages; | |
81 | } | |
82 | ||
bff672e6 RR |
83 | /* This code actually sets up the pages we've allocated to appear at |
84 | * SWITCHER_ADDR. map_vm_area() takes the vma we allocated above, the | |
85 | * kind of pages we're mapping (kernel pages), and a pointer to our | |
86 | * array of struct pages. It increments that pointer, but we don't | |
87 | * care. */ | |
d7e28ffe RR |
88 | pagep = switcher_page; |
89 | err = map_vm_area(switcher_vma, PAGE_KERNEL, &pagep); | |
90 | if (err) { | |
91 | printk("lguest: map_vm_area failed: %i\n", err); | |
92 | goto free_vma; | |
93 | } | |
bff672e6 | 94 | |
625efab1 JS |
95 | /* Now the Switcher is mapped at the right address, we can't fail! |
96 | * Copy in the compiled-in Switcher code (from <arch>_switcher.S). */ | |
d7e28ffe RR |
97 | memcpy(switcher_vma->addr, start_switcher_text, |
98 | end_switcher_text - start_switcher_text); | |
99 | ||
d7e28ffe RR |
100 | printk(KERN_INFO "lguest: mapped switcher at %p\n", |
101 | switcher_vma->addr); | |
bff672e6 | 102 | /* And we succeeded... */ |
d7e28ffe RR |
103 | return 0; |
104 | ||
105 | free_vma: | |
106 | vunmap(switcher_vma->addr); | |
107 | free_pages: | |
108 | i = TOTAL_SWITCHER_PAGES; | |
109 | free_some_pages: | |
110 | for (--i; i >= 0; i--) | |
111 | __free_pages(switcher_page[i], 0); | |
112 | kfree(switcher_page); | |
113 | out: | |
114 | return err; | |
115 | } | |
bff672e6 | 116 | /*:*/ |
d7e28ffe | 117 | |
bff672e6 RR |
118 | /* Cleaning up the mapping when the module is unloaded is almost... |
119 | * too easy. */ | |
d7e28ffe RR |
120 | static void unmap_switcher(void) |
121 | { | |
122 | unsigned int i; | |
123 | ||
bff672e6 | 124 | /* vunmap() undoes *both* map_vm_area() and __get_vm_area(). */ |
d7e28ffe | 125 | vunmap(switcher_vma->addr); |
bff672e6 | 126 | /* Now we just need to free the pages we copied the switcher into */ |
d7e28ffe RR |
127 | for (i = 0; i < TOTAL_SWITCHER_PAGES; i++) |
128 | __free_pages(switcher_page[i], 0); | |
129 | } | |
130 | ||
dde79789 RR |
131 | /*L:305 |
132 | * Dealing With Guest Memory. | |
133 | * | |
134 | * When the Guest gives us (what it thinks is) a physical address, we can use | |
3c6b5bfa RR |
135 | * the normal copy_from_user() & copy_to_user() on the corresponding place in |
136 | * the memory region allocated by the Launcher. | |
dde79789 RR |
137 | * |
138 | * But we can't trust the Guest: it might be trying to access the Launcher | |
139 | * code. We have to check that the range is below the pfn_limit the Launcher | |
140 | * gave us. We have to make sure that addr + len doesn't give us a false | |
141 | * positive by overflowing, too. */ | |
d7e28ffe RR |
142 | int lguest_address_ok(const struct lguest *lg, |
143 | unsigned long addr, unsigned long len) | |
144 | { | |
145 | return (addr+len) / PAGE_SIZE < lg->pfn_limit && (addr+len >= addr); | |
146 | } | |
147 | ||
dde79789 RR |
148 | /* This is a convenient routine to get a 32-bit value from the Guest (a very |
149 | * common operation). Here we can see how useful the kill_lguest() routine we | |
150 | * met in the Launcher can be: we return a random value (0) instead of needing | |
151 | * to return an error. */ | |
d7e28ffe RR |
152 | u32 lgread_u32(struct lguest *lg, unsigned long addr) |
153 | { | |
154 | u32 val = 0; | |
155 | ||
dde79789 | 156 | /* Don't let them access lguest binary. */ |
d7e28ffe | 157 | if (!lguest_address_ok(lg, addr, sizeof(val)) |
3c6b5bfa RR |
158 | || get_user(val, (u32 *)(lg->mem_base + addr)) != 0) |
159 | kill_guest(lg, "bad read address %#lx: pfn_limit=%u membase=%p", addr, lg->pfn_limit, lg->mem_base); | |
d7e28ffe RR |
160 | return val; |
161 | } | |
162 | ||
dde79789 | 163 | /* Same thing for writing a value. */ |
d7e28ffe RR |
164 | void lgwrite_u32(struct lguest *lg, unsigned long addr, u32 val) |
165 | { | |
166 | if (!lguest_address_ok(lg, addr, sizeof(val)) | |
3c6b5bfa | 167 | || put_user(val, (u32 *)(lg->mem_base + addr)) != 0) |
d7e28ffe RR |
168 | kill_guest(lg, "bad write address %#lx", addr); |
169 | } | |
170 | ||
dde79789 RR |
171 | /* This routine is more generic, and copies a range of Guest bytes into a |
172 | * buffer. If the copy_from_user() fails, we fill the buffer with zeroes, so | |
173 | * the caller doesn't end up using uninitialized kernel memory. */ | |
d7e28ffe RR |
174 | void lgread(struct lguest *lg, void *b, unsigned long addr, unsigned bytes) |
175 | { | |
176 | if (!lguest_address_ok(lg, addr, bytes) | |
3c6b5bfa | 177 | || copy_from_user(b, lg->mem_base + addr, bytes) != 0) { |
d7e28ffe RR |
178 | /* copy_from_user should do this, but as we rely on it... */ |
179 | memset(b, 0, bytes); | |
180 | kill_guest(lg, "bad read address %#lx len %u", addr, bytes); | |
181 | } | |
182 | } | |
183 | ||
dde79789 | 184 | /* Similarly, our generic routine to copy into a range of Guest bytes. */ |
d7e28ffe RR |
185 | void lgwrite(struct lguest *lg, unsigned long addr, const void *b, |
186 | unsigned bytes) | |
187 | { | |
188 | if (!lguest_address_ok(lg, addr, bytes) | |
3c6b5bfa | 189 | || copy_to_user(lg->mem_base + addr, b, bytes) != 0) |
d7e28ffe RR |
190 | kill_guest(lg, "bad write address %#lx len %u", addr, bytes); |
191 | } | |
dde79789 | 192 | /* (end of memory access helper routines) :*/ |
d7e28ffe | 193 | |
bff672e6 RR |
194 | /*H:030 Let's jump straight to the the main loop which runs the Guest. |
195 | * Remember, this is called by the Launcher reading /dev/lguest, and we keep | |
196 | * going around and around until something interesting happens. */ | |
d7e28ffe RR |
197 | int run_guest(struct lguest *lg, unsigned long __user *user) |
198 | { | |
bff672e6 | 199 | /* We stop running once the Guest is dead. */ |
d7e28ffe | 200 | while (!lg->dead) { |
cc6d4fbc RR |
201 | /* First we run any hypercalls the Guest wants done. */ |
202 | if (lg->hcall) | |
203 | do_hypercalls(lg); | |
204 | ||
bff672e6 RR |
205 | /* It's possible the Guest did a SEND_DMA hypercall to the |
206 | * Launcher, in which case we return from the read() now. */ | |
d7e28ffe RR |
207 | if (lg->dma_is_pending) { |
208 | if (put_user(lg->pending_dma, user) || | |
209 | put_user(lg->pending_key, user+1)) | |
210 | return -EFAULT; | |
211 | return sizeof(unsigned long)*2; | |
212 | } | |
213 | ||
bff672e6 | 214 | /* Check for signals */ |
d7e28ffe RR |
215 | if (signal_pending(current)) |
216 | return -ERESTARTSYS; | |
217 | ||
218 | /* If Waker set break_out, return to Launcher. */ | |
219 | if (lg->break_out) | |
220 | return -EAGAIN; | |
221 | ||
bff672e6 RR |
222 | /* Check if there are any interrupts which can be delivered |
223 | * now: if so, this sets up the hander to be executed when we | |
224 | * next run the Guest. */ | |
d7e28ffe RR |
225 | maybe_do_interrupt(lg); |
226 | ||
bff672e6 RR |
227 | /* All long-lived kernel loops need to check with this horrible |
228 | * thing called the freezer. If the Host is trying to suspend, | |
229 | * it stops us. */ | |
d7e28ffe RR |
230 | try_to_freeze(); |
231 | ||
bff672e6 RR |
232 | /* Just make absolutely sure the Guest is still alive. One of |
233 | * those hypercalls could have been fatal, for example. */ | |
d7e28ffe RR |
234 | if (lg->dead) |
235 | break; | |
236 | ||
bff672e6 RR |
237 | /* If the Guest asked to be stopped, we sleep. The Guest's |
238 | * clock timer or LHCALL_BREAK from the Waker will wake us. */ | |
d7e28ffe RR |
239 | if (lg->halted) { |
240 | set_current_state(TASK_INTERRUPTIBLE); | |
241 | schedule(); | |
242 | continue; | |
243 | } | |
244 | ||
bff672e6 RR |
245 | /* OK, now we're ready to jump into the Guest. First we put up |
246 | * the "Do Not Disturb" sign: */ | |
d7e28ffe RR |
247 | local_irq_disable(); |
248 | ||
625efab1 JS |
249 | /* Actually run the Guest until something happens. */ |
250 | lguest_arch_run_guest(lg); | |
bff672e6 RR |
251 | |
252 | /* Now we're ready to be interrupted or moved to other CPUs */ | |
d7e28ffe RR |
253 | local_irq_enable(); |
254 | ||
625efab1 JS |
255 | /* Now we deal with whatever happened to the Guest. */ |
256 | lguest_arch_handle_trap(lg); | |
d7e28ffe | 257 | } |
625efab1 | 258 | |
bff672e6 | 259 | /* The Guest is dead => "No such file or directory" */ |
d7e28ffe RR |
260 | return -ENOENT; |
261 | } | |
262 | ||
bff672e6 RR |
263 | /*H:000 |
264 | * Welcome to the Host! | |
265 | * | |
266 | * By this point your brain has been tickled by the Guest code and numbed by | |
267 | * the Launcher code; prepare for it to be stretched by the Host code. This is | |
268 | * the heart. Let's begin at the initialization routine for the Host's lg | |
269 | * module. | |
270 | */ | |
d7e28ffe RR |
271 | static int __init init(void) |
272 | { | |
273 | int err; | |
274 | ||
bff672e6 | 275 | /* Lguest can't run under Xen, VMI or itself. It does Tricky Stuff. */ |
d7e28ffe | 276 | if (paravirt_enabled()) { |
93b1eab3 | 277 | printk("lguest is afraid of %s\n", pv_info.name); |
d7e28ffe RR |
278 | return -EPERM; |
279 | } | |
280 | ||
bff672e6 | 281 | /* First we put the Switcher up in very high virtual memory. */ |
d7e28ffe RR |
282 | err = map_switcher(); |
283 | if (err) | |
284 | return err; | |
285 | ||
bff672e6 | 286 | /* Now we set up the pagetable implementation for the Guests. */ |
d7e28ffe RR |
287 | err = init_pagetables(switcher_page, SHARED_SWITCHER_PAGES); |
288 | if (err) { | |
289 | unmap_switcher(); | |
290 | return err; | |
291 | } | |
bff672e6 RR |
292 | |
293 | /* The I/O subsystem needs some things initialized. */ | |
d7e28ffe RR |
294 | lguest_io_init(); |
295 | ||
bff672e6 | 296 | /* /dev/lguest needs to be registered. */ |
d7e28ffe RR |
297 | err = lguest_device_init(); |
298 | if (err) { | |
299 | free_pagetables(); | |
300 | unmap_switcher(); | |
301 | return err; | |
302 | } | |
bff672e6 | 303 | |
625efab1 JS |
304 | /* Finally we do some architecture-specific setup. */ |
305 | lguest_arch_host_init(); | |
bff672e6 RR |
306 | |
307 | /* All good! */ | |
d7e28ffe RR |
308 | return 0; |
309 | } | |
310 | ||
bff672e6 | 311 | /* Cleaning up is just the same code, backwards. With a little French. */ |
d7e28ffe RR |
312 | static void __exit fini(void) |
313 | { | |
314 | lguest_device_remove(); | |
315 | free_pagetables(); | |
316 | unmap_switcher(); | |
bff672e6 | 317 | |
625efab1 | 318 | lguest_arch_host_fini(); |
d7e28ffe | 319 | } |
625efab1 | 320 | /*:*/ |
d7e28ffe | 321 | |
bff672e6 RR |
322 | /* The Host side of lguest can be a module. This is a nice way for people to |
323 | * play with it. */ | |
d7e28ffe RR |
324 | module_init(init); |
325 | module_exit(fini); | |
326 | MODULE_LICENSE("GPL"); | |
327 | MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>"); |