]>
Commit | Line | Data |
---|---|---|
1 | /*P:400 | |
2 | * This contains run_guest() which actually calls into the Host<->Guest | |
3 | * Switcher and analyzes the return, such as determining if the Guest wants the | |
4 | * Host to do something. This file also contains useful helper routines. | |
5 | :*/ | |
6 | #include <linux/module.h> | |
7 | #include <linux/stringify.h> | |
8 | #include <linux/stddef.h> | |
9 | #include <linux/io.h> | |
10 | #include <linux/mm.h> | |
11 | #include <linux/sched/signal.h> | |
12 | #include <linux/vmalloc.h> | |
13 | #include <linux/cpu.h> | |
14 | #include <linux/freezer.h> | |
15 | #include <linux/highmem.h> | |
16 | #include <linux/slab.h> | |
17 | #include <asm/paravirt.h> | |
18 | #include <asm/pgtable.h> | |
19 | #include <linux/uaccess.h> | |
20 | #include <asm/poll.h> | |
21 | #include <asm/asm-offsets.h> | |
22 | #include "lg.h" | |
23 | ||
24 | unsigned long switcher_addr; | |
25 | struct page **lg_switcher_pages; | |
26 | static struct vm_struct *switcher_text_vma; | |
27 | static struct vm_struct *switcher_stacks_vma; | |
28 | ||
29 | /* This One Big lock protects all inter-guest data structures. */ | |
30 | DEFINE_MUTEX(lguest_lock); | |
31 | ||
32 | /*H:010 | |
33 | * We need to set up the Switcher at a high virtual address. Remember the | |
34 | * Switcher is a few hundred bytes of assembler code which actually changes the | |
35 | * CPU to run the Guest, and then changes back to the Host when a trap or | |
36 | * interrupt happens. | |
37 | * | |
38 | * The Switcher code must be at the same virtual address in the Guest as the | |
39 | * Host since it will be running as the switchover occurs. | |
40 | * | |
41 | * Trying to map memory at a particular address is an unusual thing to do, so | |
42 | * it's not a simple one-liner. | |
43 | */ | |
44 | static __init int map_switcher(void) | |
45 | { | |
46 | int i, err; | |
47 | ||
48 | /* | |
49 | * Map the Switcher in to high memory. | |
50 | * | |
51 | * It turns out that if we choose the address 0xFFC00000 (4MB under the | |
52 | * top virtual address), it makes setting up the page tables really | |
53 | * easy. | |
54 | */ | |
55 | ||
56 | /* We assume Switcher text fits into a single page. */ | |
57 | if (end_switcher_text - start_switcher_text > PAGE_SIZE) { | |
58 | printk(KERN_ERR "lguest: switcher text too large (%zu)\n", | |
59 | end_switcher_text - start_switcher_text); | |
60 | return -EINVAL; | |
61 | } | |
62 | ||
63 | /* | |
64 | * We allocate an array of struct page pointers. map_vm_area() wants | |
65 | * this, rather than just an array of pages. | |
66 | */ | |
67 | lg_switcher_pages = kmalloc(sizeof(lg_switcher_pages[0]) | |
68 | * TOTAL_SWITCHER_PAGES, | |
69 | GFP_KERNEL); | |
70 | if (!lg_switcher_pages) { | |
71 | err = -ENOMEM; | |
72 | goto out; | |
73 | } | |
74 | ||
75 | /* | |
76 | * Now we actually allocate the pages. The Guest will see these pages, | |
77 | * so we make sure they're zeroed. | |
78 | */ | |
79 | for (i = 0; i < TOTAL_SWITCHER_PAGES; i++) { | |
80 | lg_switcher_pages[i] = alloc_page(GFP_KERNEL|__GFP_ZERO); | |
81 | if (!lg_switcher_pages[i]) { | |
82 | err = -ENOMEM; | |
83 | goto free_some_pages; | |
84 | } | |
85 | } | |
86 | ||
87 | /* | |
88 | * Copy in the compiled-in Switcher code (from x86/switcher_32.S). | |
89 | * It goes in the first page, which we map in momentarily. | |
90 | */ | |
91 | memcpy(kmap(lg_switcher_pages[0]), start_switcher_text, | |
92 | end_switcher_text - start_switcher_text); | |
93 | kunmap(lg_switcher_pages[0]); | |
94 | ||
95 | /* | |
96 | * We place the Switcher underneath the fixmap area, which is the | |
97 | * highest virtual address we can get. This is important, since we | |
98 | * tell the Guest it can't access this memory, so we want its ceiling | |
99 | * as high as possible. | |
100 | */ | |
101 | switcher_addr = FIXADDR_START - TOTAL_SWITCHER_PAGES*PAGE_SIZE; | |
102 | ||
103 | /* | |
104 | * Now we reserve the "virtual memory area"s we want. We might | |
105 | * not get them in theory, but in practice it's worked so far. | |
106 | * | |
107 | * We want the switcher text to be read-only and executable, and | |
108 | * the stacks to be read-write and non-executable. | |
109 | */ | |
110 | switcher_text_vma = __get_vm_area(PAGE_SIZE, VM_ALLOC|VM_NO_GUARD, | |
111 | switcher_addr, | |
112 | switcher_addr + PAGE_SIZE); | |
113 | ||
114 | if (!switcher_text_vma) { | |
115 | err = -ENOMEM; | |
116 | printk("lguest: could not map switcher pages high\n"); | |
117 | goto free_pages; | |
118 | } | |
119 | ||
120 | switcher_stacks_vma = __get_vm_area(SWITCHER_STACK_PAGES * PAGE_SIZE, | |
121 | VM_ALLOC|VM_NO_GUARD, | |
122 | switcher_addr + PAGE_SIZE, | |
123 | switcher_addr + TOTAL_SWITCHER_PAGES * PAGE_SIZE); | |
124 | if (!switcher_stacks_vma) { | |
125 | err = -ENOMEM; | |
126 | printk("lguest: could not map switcher pages high\n"); | |
127 | goto free_text_vma; | |
128 | } | |
129 | ||
130 | /* | |
131 | * This code actually sets up the pages we've allocated to appear at | |
132 | * switcher_addr. map_vm_area() takes the vma we allocated above, the | |
133 | * kind of pages we're mapping (kernel text pages and kernel writable | |
134 | * pages respectively), and a pointer to our array of struct pages. | |
135 | */ | |
136 | err = map_vm_area(switcher_text_vma, PAGE_KERNEL_RX, lg_switcher_pages); | |
137 | if (err) { | |
138 | printk("lguest: text map_vm_area failed: %i\n", err); | |
139 | goto free_vmas; | |
140 | } | |
141 | ||
142 | err = map_vm_area(switcher_stacks_vma, PAGE_KERNEL, | |
143 | lg_switcher_pages + SWITCHER_TEXT_PAGES); | |
144 | if (err) { | |
145 | printk("lguest: stacks map_vm_area failed: %i\n", err); | |
146 | goto free_vmas; | |
147 | } | |
148 | ||
149 | /* | |
150 | * Now the Switcher is mapped at the right address, we can't fail! | |
151 | */ | |
152 | printk(KERN_INFO "lguest: mapped switcher at %p\n", | |
153 | switcher_text_vma->addr); | |
154 | /* And we succeeded... */ | |
155 | return 0; | |
156 | ||
157 | free_vmas: | |
158 | /* Undoes map_vm_area and __get_vm_area */ | |
159 | vunmap(switcher_stacks_vma->addr); | |
160 | free_text_vma: | |
161 | vunmap(switcher_text_vma->addr); | |
162 | free_pages: | |
163 | i = TOTAL_SWITCHER_PAGES; | |
164 | free_some_pages: | |
165 | for (--i; i >= 0; i--) | |
166 | __free_pages(lg_switcher_pages[i], 0); | |
167 | kfree(lg_switcher_pages); | |
168 | out: | |
169 | return err; | |
170 | } | |
171 | /*:*/ | |
172 | ||
173 | /* Cleaning up the mapping when the module is unloaded is almost... too easy. */ | |
174 | static void unmap_switcher(void) | |
175 | { | |
176 | unsigned int i; | |
177 | ||
178 | /* vunmap() undoes *both* map_vm_area() and __get_vm_area(). */ | |
179 | vunmap(switcher_text_vma->addr); | |
180 | vunmap(switcher_stacks_vma->addr); | |
181 | /* Now we just need to free the pages we copied the switcher into */ | |
182 | for (i = 0; i < TOTAL_SWITCHER_PAGES; i++) | |
183 | __free_pages(lg_switcher_pages[i], 0); | |
184 | kfree(lg_switcher_pages); | |
185 | } | |
186 | ||
187 | /*H:032 | |
188 | * Dealing With Guest Memory. | |
189 | * | |
190 | * Before we go too much further into the Host, we need to grok the routines | |
191 | * we use to deal with Guest memory. | |
192 | * | |
193 | * When the Guest gives us (what it thinks is) a physical address, we can use | |
194 | * the normal copy_from_user() & copy_to_user() on the corresponding place in | |
195 | * the memory region allocated by the Launcher. | |
196 | * | |
197 | * But we can't trust the Guest: it might be trying to access the Launcher | |
198 | * code. We have to check that the range is below the pfn_limit the Launcher | |
199 | * gave us. We have to make sure that addr + len doesn't give us a false | |
200 | * positive by overflowing, too. | |
201 | */ | |
202 | bool lguest_address_ok(const struct lguest *lg, | |
203 | unsigned long addr, unsigned long len) | |
204 | { | |
205 | return addr+len <= lg->pfn_limit * PAGE_SIZE && (addr+len >= addr); | |
206 | } | |
207 | ||
208 | /* | |
209 | * This routine copies memory from the Guest. Here we can see how useful the | |
210 | * kill_lguest() routine we met in the Launcher can be: we return a random | |
211 | * value (all zeroes) instead of needing to return an error. | |
212 | */ | |
213 | void __lgread(struct lg_cpu *cpu, void *b, unsigned long addr, unsigned bytes) | |
214 | { | |
215 | if (!lguest_address_ok(cpu->lg, addr, bytes) | |
216 | || copy_from_user(b, cpu->lg->mem_base + addr, bytes) != 0) { | |
217 | /* copy_from_user should do this, but as we rely on it... */ | |
218 | memset(b, 0, bytes); | |
219 | kill_guest(cpu, "bad read address %#lx len %u", addr, bytes); | |
220 | } | |
221 | } | |
222 | ||
223 | /* This is the write (copy into Guest) version. */ | |
224 | void __lgwrite(struct lg_cpu *cpu, unsigned long addr, const void *b, | |
225 | unsigned bytes) | |
226 | { | |
227 | if (!lguest_address_ok(cpu->lg, addr, bytes) | |
228 | || copy_to_user(cpu->lg->mem_base + addr, b, bytes) != 0) | |
229 | kill_guest(cpu, "bad write address %#lx len %u", addr, bytes); | |
230 | } | |
231 | /*:*/ | |
232 | ||
233 | /*H:030 | |
234 | * Let's jump straight to the the main loop which runs the Guest. | |
235 | * Remember, this is called by the Launcher reading /dev/lguest, and we keep | |
236 | * going around and around until something interesting happens. | |
237 | */ | |
238 | int run_guest(struct lg_cpu *cpu, unsigned long __user *user) | |
239 | { | |
240 | /* If the launcher asked for a register with LHREQ_GETREG */ | |
241 | if (cpu->reg_read) { | |
242 | if (put_user(*cpu->reg_read, user)) | |
243 | return -EFAULT; | |
244 | cpu->reg_read = NULL; | |
245 | return sizeof(*cpu->reg_read); | |
246 | } | |
247 | ||
248 | /* We stop running once the Guest is dead. */ | |
249 | while (!cpu->lg->dead) { | |
250 | unsigned int irq; | |
251 | bool more; | |
252 | ||
253 | /* First we run any hypercalls the Guest wants done. */ | |
254 | if (cpu->hcall) | |
255 | do_hypercalls(cpu); | |
256 | ||
257 | /* Do we have to tell the Launcher about a trap? */ | |
258 | if (cpu->pending.trap) { | |
259 | if (copy_to_user(user, &cpu->pending, | |
260 | sizeof(cpu->pending))) | |
261 | return -EFAULT; | |
262 | return sizeof(cpu->pending); | |
263 | } | |
264 | ||
265 | /* | |
266 | * All long-lived kernel loops need to check with this horrible | |
267 | * thing called the freezer. If the Host is trying to suspend, | |
268 | * it stops us. | |
269 | */ | |
270 | try_to_freeze(); | |
271 | ||
272 | /* Check for signals */ | |
273 | if (signal_pending(current)) | |
274 | return -ERESTARTSYS; | |
275 | ||
276 | /* | |
277 | * Check if there are any interrupts which can be delivered now: | |
278 | * if so, this sets up the hander to be executed when we next | |
279 | * run the Guest. | |
280 | */ | |
281 | irq = interrupt_pending(cpu, &more); | |
282 | if (irq < LGUEST_IRQS) | |
283 | try_deliver_interrupt(cpu, irq, more); | |
284 | ||
285 | /* | |
286 | * Just make absolutely sure the Guest is still alive. One of | |
287 | * those hypercalls could have been fatal, for example. | |
288 | */ | |
289 | if (cpu->lg->dead) | |
290 | break; | |
291 | ||
292 | /* | |
293 | * If the Guest asked to be stopped, we sleep. The Guest's | |
294 | * clock timer will wake us. | |
295 | */ | |
296 | if (cpu->halted) { | |
297 | set_current_state(TASK_INTERRUPTIBLE); | |
298 | /* | |
299 | * Just before we sleep, make sure no interrupt snuck in | |
300 | * which we should be doing. | |
301 | */ | |
302 | if (interrupt_pending(cpu, &more) < LGUEST_IRQS) | |
303 | set_current_state(TASK_RUNNING); | |
304 | else | |
305 | schedule(); | |
306 | continue; | |
307 | } | |
308 | ||
309 | /* | |
310 | * OK, now we're ready to jump into the Guest. First we put up | |
311 | * the "Do Not Disturb" sign: | |
312 | */ | |
313 | local_irq_disable(); | |
314 | ||
315 | /* Actually run the Guest until something happens. */ | |
316 | lguest_arch_run_guest(cpu); | |
317 | ||
318 | /* Now we're ready to be interrupted or moved to other CPUs */ | |
319 | local_irq_enable(); | |
320 | ||
321 | /* Now we deal with whatever happened to the Guest. */ | |
322 | lguest_arch_handle_trap(cpu); | |
323 | } | |
324 | ||
325 | /* Special case: Guest is 'dead' but wants a reboot. */ | |
326 | if (cpu->lg->dead == ERR_PTR(-ERESTART)) | |
327 | return -ERESTART; | |
328 | ||
329 | /* The Guest is dead => "No such file or directory" */ | |
330 | return -ENOENT; | |
331 | } | |
332 | ||
333 | /*H:000 | |
334 | * Welcome to the Host! | |
335 | * | |
336 | * By this point your brain has been tickled by the Guest code and numbed by | |
337 | * the Launcher code; prepare for it to be stretched by the Host code. This is | |
338 | * the heart. Let's begin at the initialization routine for the Host's lg | |
339 | * module. | |
340 | */ | |
341 | static int __init init(void) | |
342 | { | |
343 | int err; | |
344 | ||
345 | /* Lguest can't run under Xen, VMI or itself. It does Tricky Stuff. */ | |
346 | if (get_kernel_rpl() != 0) { | |
347 | printk("lguest is afraid of being a guest\n"); | |
348 | return -EPERM; | |
349 | } | |
350 | ||
351 | /* First we put the Switcher up in very high virtual memory. */ | |
352 | err = map_switcher(); | |
353 | if (err) | |
354 | goto out; | |
355 | ||
356 | /* We might need to reserve an interrupt vector. */ | |
357 | err = init_interrupts(); | |
358 | if (err) | |
359 | goto unmap; | |
360 | ||
361 | /* /dev/lguest needs to be registered. */ | |
362 | err = lguest_device_init(); | |
363 | if (err) | |
364 | goto free_interrupts; | |
365 | ||
366 | /* Finally we do some architecture-specific setup. */ | |
367 | lguest_arch_host_init(); | |
368 | ||
369 | /* All good! */ | |
370 | return 0; | |
371 | ||
372 | free_interrupts: | |
373 | free_interrupts(); | |
374 | unmap: | |
375 | unmap_switcher(); | |
376 | out: | |
377 | return err; | |
378 | } | |
379 | ||
380 | /* Cleaning up is just the same code, backwards. With a little French. */ | |
381 | static void __exit fini(void) | |
382 | { | |
383 | lguest_device_remove(); | |
384 | free_interrupts(); | |
385 | unmap_switcher(); | |
386 | ||
387 | lguest_arch_host_fini(); | |
388 | } | |
389 | /*:*/ | |
390 | ||
391 | /* | |
392 | * The Host side of lguest can be a module. This is a nice way for people to | |
393 | * play with it. | |
394 | */ | |
395 | module_init(init); | |
396 | module_exit(fini); | |
397 | MODULE_LICENSE("GPL"); | |
398 | MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>"); |