| 1 | /*P:400 |
| 2 | * This contains run_guest() which actually calls into the Host<->Guest |
| 3 | * Switcher and analyzes the return, such as determining if the Guest wants the |
| 4 | * Host to do something. This file also contains useful helper routines. |
| 5 | :*/ |
| 6 | #include <linux/module.h> |
| 7 | #include <linux/stringify.h> |
| 8 | #include <linux/stddef.h> |
| 9 | #include <linux/io.h> |
| 10 | #include <linux/mm.h> |
| 11 | #include <linux/vmalloc.h> |
| 12 | #include <linux/cpu.h> |
| 13 | #include <linux/freezer.h> |
| 14 | #include <linux/highmem.h> |
| 15 | #include <linux/slab.h> |
| 16 | #include <asm/paravirt.h> |
| 17 | #include <asm/pgtable.h> |
| 18 | #include <asm/uaccess.h> |
| 19 | #include <asm/poll.h> |
| 20 | #include <asm/asm-offsets.h> |
| 21 | #include "lg.h" |
| 22 | |
| 23 | unsigned long switcher_addr; |
| 24 | struct page **lg_switcher_pages; |
| 25 | static struct vm_struct *switcher_vma; |
| 26 | |
| 27 | /* This One Big lock protects all inter-guest data structures. */ |
| 28 | DEFINE_MUTEX(lguest_lock); |
| 29 | |
| 30 | /*H:010 |
| 31 | * We need to set up the Switcher at a high virtual address. Remember the |
| 32 | * Switcher is a few hundred bytes of assembler code which actually changes the |
| 33 | * CPU to run the Guest, and then changes back to the Host when a trap or |
| 34 | * interrupt happens. |
| 35 | * |
| 36 | * The Switcher code must be at the same virtual address in the Guest as the |
| 37 | * Host since it will be running as the switchover occurs. |
| 38 | * |
| 39 | * Trying to map memory at a particular address is an unusual thing to do, so |
| 40 | * it's not a simple one-liner. |
| 41 | */ |
| 42 | static __init int map_switcher(void) |
| 43 | { |
| 44 | int i, err; |
| 45 | |
| 46 | /* |
| 47 | * Map the Switcher in to high memory. |
| 48 | * |
| 49 | * It turns out that if we choose the address 0xFFC00000 (4MB under the |
| 50 | * top virtual address), it makes setting up the page tables really |
| 51 | * easy. |
| 52 | */ |
| 53 | |
| 54 | /* We assume Switcher text fits into a single page. */ |
| 55 | if (end_switcher_text - start_switcher_text > PAGE_SIZE) { |
| 56 | printk(KERN_ERR "lguest: switcher text too large (%zu)\n", |
| 57 | end_switcher_text - start_switcher_text); |
| 58 | return -EINVAL; |
| 59 | } |
| 60 | |
| 61 | /* |
| 62 | * We allocate an array of struct page pointers. map_vm_area() wants |
| 63 | * this, rather than just an array of pages. |
| 64 | */ |
| 65 | lg_switcher_pages = kmalloc(sizeof(lg_switcher_pages[0]) |
| 66 | * TOTAL_SWITCHER_PAGES, |
| 67 | GFP_KERNEL); |
| 68 | if (!lg_switcher_pages) { |
| 69 | err = -ENOMEM; |
| 70 | goto out; |
| 71 | } |
| 72 | |
| 73 | /* |
| 74 | * Now we actually allocate the pages. The Guest will see these pages, |
| 75 | * so we make sure they're zeroed. |
| 76 | */ |
| 77 | for (i = 0; i < TOTAL_SWITCHER_PAGES; i++) { |
| 78 | lg_switcher_pages[i] = alloc_page(GFP_KERNEL|__GFP_ZERO); |
| 79 | if (!lg_switcher_pages[i]) { |
| 80 | err = -ENOMEM; |
| 81 | goto free_some_pages; |
| 82 | } |
| 83 | } |
| 84 | |
| 85 | /* |
| 86 | * We place the Switcher underneath the fixmap area, which is the |
| 87 | * highest virtual address we can get. This is important, since we |
| 88 | * tell the Guest it can't access this memory, so we want its ceiling |
| 89 | * as high as possible. |
| 90 | */ |
| 91 | switcher_addr = FIXADDR_START - (TOTAL_SWITCHER_PAGES+1)*PAGE_SIZE; |
| 92 | |
| 93 | /* |
| 94 | * Now we reserve the "virtual memory area" we want. We might |
| 95 | * not get it in theory, but in practice it's worked so far. |
| 96 | * The end address needs +1 because __get_vm_area allocates an |
| 97 | * extra guard page, so we need space for that. |
| 98 | */ |
| 99 | switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE, |
| 100 | VM_ALLOC, switcher_addr, switcher_addr |
| 101 | + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE); |
| 102 | if (!switcher_vma) { |
| 103 | err = -ENOMEM; |
| 104 | printk("lguest: could not map switcher pages high\n"); |
| 105 | goto free_pages; |
| 106 | } |
| 107 | |
| 108 | /* |
| 109 | * This code actually sets up the pages we've allocated to appear at |
| 110 | * switcher_addr. map_vm_area() takes the vma we allocated above, the |
| 111 | * kind of pages we're mapping (kernel pages), and a pointer to our |
| 112 | * array of struct pages. |
| 113 | */ |
| 114 | err = map_vm_area(switcher_vma, PAGE_KERNEL_EXEC, lg_switcher_pages); |
| 115 | if (err) { |
| 116 | printk("lguest: map_vm_area failed: %i\n", err); |
| 117 | goto free_vma; |
| 118 | } |
| 119 | |
| 120 | /* |
| 121 | * Now the Switcher is mapped at the right address, we can't fail! |
| 122 | * Copy in the compiled-in Switcher code (from x86/switcher_32.S). |
| 123 | */ |
| 124 | memcpy(switcher_vma->addr, start_switcher_text, |
| 125 | end_switcher_text - start_switcher_text); |
| 126 | |
| 127 | printk(KERN_INFO "lguest: mapped switcher at %p\n", |
| 128 | switcher_vma->addr); |
| 129 | /* And we succeeded... */ |
| 130 | return 0; |
| 131 | |
| 132 | free_vma: |
| 133 | vunmap(switcher_vma->addr); |
| 134 | free_pages: |
| 135 | i = TOTAL_SWITCHER_PAGES; |
| 136 | free_some_pages: |
| 137 | for (--i; i >= 0; i--) |
| 138 | __free_pages(lg_switcher_pages[i], 0); |
| 139 | kfree(lg_switcher_pages); |
| 140 | out: |
| 141 | return err; |
| 142 | } |
| 143 | /*:*/ |
| 144 | |
| 145 | /* Cleaning up the mapping when the module is unloaded is almost... too easy. */ |
| 146 | static void unmap_switcher(void) |
| 147 | { |
| 148 | unsigned int i; |
| 149 | |
| 150 | /* vunmap() undoes *both* map_vm_area() and __get_vm_area(). */ |
| 151 | vunmap(switcher_vma->addr); |
| 152 | /* Now we just need to free the pages we copied the switcher into */ |
| 153 | for (i = 0; i < TOTAL_SWITCHER_PAGES; i++) |
| 154 | __free_pages(lg_switcher_pages[i], 0); |
| 155 | kfree(lg_switcher_pages); |
| 156 | } |
| 157 | |
| 158 | /*H:032 |
| 159 | * Dealing With Guest Memory. |
| 160 | * |
| 161 | * Before we go too much further into the Host, we need to grok the routines |
| 162 | * we use to deal with Guest memory. |
| 163 | * |
| 164 | * When the Guest gives us (what it thinks is) a physical address, we can use |
| 165 | * the normal copy_from_user() & copy_to_user() on the corresponding place in |
| 166 | * the memory region allocated by the Launcher. |
| 167 | * |
| 168 | * But we can't trust the Guest: it might be trying to access the Launcher |
| 169 | * code. We have to check that the range is below the pfn_limit the Launcher |
| 170 | * gave us. We have to make sure that addr + len doesn't give us a false |
| 171 | * positive by overflowing, too. |
| 172 | */ |
| 173 | bool lguest_address_ok(const struct lguest *lg, |
| 174 | unsigned long addr, unsigned long len) |
| 175 | { |
| 176 | return (addr+len) / PAGE_SIZE < lg->pfn_limit && (addr+len >= addr); |
| 177 | } |
| 178 | |
| 179 | /* |
| 180 | * This routine copies memory from the Guest. Here we can see how useful the |
| 181 | * kill_lguest() routine we met in the Launcher can be: we return a random |
| 182 | * value (all zeroes) instead of needing to return an error. |
| 183 | */ |
| 184 | void __lgread(struct lg_cpu *cpu, void *b, unsigned long addr, unsigned bytes) |
| 185 | { |
| 186 | if (!lguest_address_ok(cpu->lg, addr, bytes) |
| 187 | || copy_from_user(b, cpu->lg->mem_base + addr, bytes) != 0) { |
| 188 | /* copy_from_user should do this, but as we rely on it... */ |
| 189 | memset(b, 0, bytes); |
| 190 | kill_guest(cpu, "bad read address %#lx len %u", addr, bytes); |
| 191 | } |
| 192 | } |
| 193 | |
| 194 | /* This is the write (copy into Guest) version. */ |
| 195 | void __lgwrite(struct lg_cpu *cpu, unsigned long addr, const void *b, |
| 196 | unsigned bytes) |
| 197 | { |
| 198 | if (!lguest_address_ok(cpu->lg, addr, bytes) |
| 199 | || copy_to_user(cpu->lg->mem_base + addr, b, bytes) != 0) |
| 200 | kill_guest(cpu, "bad write address %#lx len %u", addr, bytes); |
| 201 | } |
| 202 | /*:*/ |
| 203 | |
| 204 | /*H:030 |
| 205 | * Let's jump straight to the the main loop which runs the Guest. |
| 206 | * Remember, this is called by the Launcher reading /dev/lguest, and we keep |
| 207 | * going around and around until something interesting happens. |
| 208 | */ |
| 209 | int run_guest(struct lg_cpu *cpu, unsigned long __user *user) |
| 210 | { |
| 211 | /* We stop running once the Guest is dead. */ |
| 212 | while (!cpu->lg->dead) { |
| 213 | unsigned int irq; |
| 214 | bool more; |
| 215 | |
| 216 | /* First we run any hypercalls the Guest wants done. */ |
| 217 | if (cpu->hcall) |
| 218 | do_hypercalls(cpu); |
| 219 | |
| 220 | /* |
| 221 | * It's possible the Guest did a NOTIFY hypercall to the |
| 222 | * Launcher. |
| 223 | */ |
| 224 | if (cpu->pending_notify) { |
| 225 | /* |
| 226 | * Does it just needs to write to a registered |
| 227 | * eventfd (ie. the appropriate virtqueue thread)? |
| 228 | */ |
| 229 | if (!send_notify_to_eventfd(cpu)) { |
| 230 | /* OK, we tell the main Launcher. */ |
| 231 | if (put_user(cpu->pending_notify, user)) |
| 232 | return -EFAULT; |
| 233 | return sizeof(cpu->pending_notify); |
| 234 | } |
| 235 | } |
| 236 | |
| 237 | /* |
| 238 | * All long-lived kernel loops need to check with this horrible |
| 239 | * thing called the freezer. If the Host is trying to suspend, |
| 240 | * it stops us. |
| 241 | */ |
| 242 | try_to_freeze(); |
| 243 | |
| 244 | /* Check for signals */ |
| 245 | if (signal_pending(current)) |
| 246 | return -ERESTARTSYS; |
| 247 | |
| 248 | /* |
| 249 | * Check if there are any interrupts which can be delivered now: |
| 250 | * if so, this sets up the hander to be executed when we next |
| 251 | * run the Guest. |
| 252 | */ |
| 253 | irq = interrupt_pending(cpu, &more); |
| 254 | if (irq < LGUEST_IRQS) |
| 255 | try_deliver_interrupt(cpu, irq, more); |
| 256 | |
| 257 | /* |
| 258 | * Just make absolutely sure the Guest is still alive. One of |
| 259 | * those hypercalls could have been fatal, for example. |
| 260 | */ |
| 261 | if (cpu->lg->dead) |
| 262 | break; |
| 263 | |
| 264 | /* |
| 265 | * If the Guest asked to be stopped, we sleep. The Guest's |
| 266 | * clock timer will wake us. |
| 267 | */ |
| 268 | if (cpu->halted) { |
| 269 | set_current_state(TASK_INTERRUPTIBLE); |
| 270 | /* |
| 271 | * Just before we sleep, make sure no interrupt snuck in |
| 272 | * which we should be doing. |
| 273 | */ |
| 274 | if (interrupt_pending(cpu, &more) < LGUEST_IRQS) |
| 275 | set_current_state(TASK_RUNNING); |
| 276 | else |
| 277 | schedule(); |
| 278 | continue; |
| 279 | } |
| 280 | |
| 281 | /* |
| 282 | * OK, now we're ready to jump into the Guest. First we put up |
| 283 | * the "Do Not Disturb" sign: |
| 284 | */ |
| 285 | local_irq_disable(); |
| 286 | |
| 287 | /* Actually run the Guest until something happens. */ |
| 288 | lguest_arch_run_guest(cpu); |
| 289 | |
| 290 | /* Now we're ready to be interrupted or moved to other CPUs */ |
| 291 | local_irq_enable(); |
| 292 | |
| 293 | /* Now we deal with whatever happened to the Guest. */ |
| 294 | lguest_arch_handle_trap(cpu); |
| 295 | } |
| 296 | |
| 297 | /* Special case: Guest is 'dead' but wants a reboot. */ |
| 298 | if (cpu->lg->dead == ERR_PTR(-ERESTART)) |
| 299 | return -ERESTART; |
| 300 | |
| 301 | /* The Guest is dead => "No such file or directory" */ |
| 302 | return -ENOENT; |
| 303 | } |
| 304 | |
| 305 | /*H:000 |
| 306 | * Welcome to the Host! |
| 307 | * |
| 308 | * By this point your brain has been tickled by the Guest code and numbed by |
| 309 | * the Launcher code; prepare for it to be stretched by the Host code. This is |
| 310 | * the heart. Let's begin at the initialization routine for the Host's lg |
| 311 | * module. |
| 312 | */ |
| 313 | static int __init init(void) |
| 314 | { |
| 315 | int err; |
| 316 | |
| 317 | /* Lguest can't run under Xen, VMI or itself. It does Tricky Stuff. */ |
| 318 | if (get_kernel_rpl() != 0) { |
| 319 | printk("lguest is afraid of being a guest\n"); |
| 320 | return -EPERM; |
| 321 | } |
| 322 | |
| 323 | /* First we put the Switcher up in very high virtual memory. */ |
| 324 | err = map_switcher(); |
| 325 | if (err) |
| 326 | goto out; |
| 327 | |
| 328 | /* We might need to reserve an interrupt vector. */ |
| 329 | err = init_interrupts(); |
| 330 | if (err) |
| 331 | goto unmap; |
| 332 | |
| 333 | /* /dev/lguest needs to be registered. */ |
| 334 | err = lguest_device_init(); |
| 335 | if (err) |
| 336 | goto free_interrupts; |
| 337 | |
| 338 | /* Finally we do some architecture-specific setup. */ |
| 339 | lguest_arch_host_init(); |
| 340 | |
| 341 | /* All good! */ |
| 342 | return 0; |
| 343 | |
| 344 | free_interrupts: |
| 345 | free_interrupts(); |
| 346 | unmap: |
| 347 | unmap_switcher(); |
| 348 | out: |
| 349 | return err; |
| 350 | } |
| 351 | |
| 352 | /* Cleaning up is just the same code, backwards. With a little French. */ |
| 353 | static void __exit fini(void) |
| 354 | { |
| 355 | lguest_device_remove(); |
| 356 | free_interrupts(); |
| 357 | unmap_switcher(); |
| 358 | |
| 359 | lguest_arch_host_fini(); |
| 360 | } |
| 361 | /*:*/ |
| 362 | |
| 363 | /* |
| 364 | * The Host side of lguest can be a module. This is a nice way for people to |
| 365 | * play with it. |
| 366 | */ |
| 367 | module_init(init); |
| 368 | module_exit(fini); |
| 369 | MODULE_LICENSE("GPL"); |
| 370 | MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>"); |