Rusty Russell | f938d2c | 2007-07-26 10:41:02 -0700 | [diff] [blame] | 1 | /*P:600 The x86 architecture has segments, which involve a table of descriptors |
| 2 | * which can be used to do funky things with virtual address interpretation. |
| 3 | * We originally used to use segments so the Guest couldn't alter the |
| 4 | * Guest<->Host Switcher, and then we had to trim Guest segments, and restore |
| 5 | * for userspace per-thread segments, but trim again for on userspace->kernel |
| 6 | * transitions... This nightmarish creation was contained within this file, |
| 7 | * where we knew not to tread without heavy armament and a change of underwear. |
| 8 | * |
| 9 | * In these modern times, the segment handling code consists of simple sanity |
| 10 | * checks, and the worst you'll experience reading this code is butterfly-rash |
| 11 | * from frolicking through its parklike serenity. :*/ |
Rusty Russell | d7e28ff | 2007-07-19 01:49:23 -0700 | [diff] [blame] | 12 | #include "lg.h" |
| 13 | |
Rusty Russell | bff672e | 2007-07-26 10:41:04 -0700 | [diff] [blame] | 14 | /*H:600 |
Rusty Russell | bff672e | 2007-07-26 10:41:04 -0700 | [diff] [blame] | 15 | * Segments & The Global Descriptor Table |
| 16 | * |
| 17 | * (That title sounds like a bad Nerdcore group. Not to suggest that there are |
| 18 | * any good Nerdcore groups, but in high school a friend of mine had a band |
| 19 | * called Joe Fish and the Chips, so there are definitely worse band names). |
| 20 | * |
| 21 | * To refresh: the GDT is a table of 8-byte values describing segments. Once |
| 22 | * set up, these segments can be loaded into one of the 6 "segment registers". |
| 23 | * |
| 24 | * GDT entries are passed around as "struct desc_struct"s, which like IDT |
| 25 | * entries are split into two 32-bit members, "a" and "b". One day, someone |
| 26 | * will clean that up, and be declared a Hero. (No pressure, I'm just saying). |
| 27 | * |
| 28 | * Anyway, the GDT entry contains a base (the start address of the segment), a |
| 29 | * limit (the size of the segment - 1), and some flags. Sounds simple, and it |
| 30 | * would be, except those zany Intel engineers decided that it was too boring |
| 31 | * to put the base at one end, the limit at the other, and the flags in |
| 32 | * between. They decided to shotgun the bits at random throughout the 8 bytes, |
| 33 | * like so: |
| 34 | * |
| 35 | * 0 16 40 48 52 56 63 |
| 36 | * [ limit part 1 ][ base part 1 ][ flags ][li][fl][base ] |
| 37 | * mit ags part 2 |
| 38 | * part 2 |
| 39 | * |
| 40 | * As a result, this file contains a certain amount of magic numeracy. Let's |
| 41 | * begin. |
| 42 | */ |
| 43 | |
Rusty Russell | bff672e | 2007-07-26 10:41:04 -0700 | [diff] [blame] | 44 | /* There are several entries we don't let the Guest set. The TSS entry is the |
| 45 | * "Task State Segment" which controls all kinds of delicate things. The |
| 46 | * LGUEST_CS and LGUEST_DS entries are reserved for the Switcher, and the |
| 47 | * the Guest can't be trusted to deal with double faults. */ |
Rusty Russell | d7e28ff | 2007-07-19 01:49:23 -0700 | [diff] [blame] | 48 | static int ignored_gdt(unsigned int num) |
| 49 | { |
| 50 | return (num == GDT_ENTRY_TSS |
| 51 | || num == GDT_ENTRY_LGUEST_CS |
| 52 | || num == GDT_ENTRY_LGUEST_DS |
| 53 | || num == GDT_ENTRY_DOUBLEFAULT_TSS); |
| 54 | } |
| 55 | |
Rusty Russell | e1e7296 | 2007-10-25 15:02:50 +1000 | [diff] [blame] | 56 | /*H:630 Once the Guest gave us new GDT entries, we fix them up a little. We |
Rusty Russell | 0d027c0 | 2007-08-09 20:57:13 +1000 | [diff] [blame] | 57 | * don't care if they're invalid: the worst that can happen is a General |
| 58 | * Protection Fault in the Switcher when it restores a Guest segment register |
| 59 | * which tries to use that entry. Then we kill the Guest for causing such a |
| 60 | * mess: the message will be "unhandled trap 256". */ |
Rusty Russell | d7e28ff | 2007-07-19 01:49:23 -0700 | [diff] [blame] | 61 | static void fixup_gdt_table(struct lguest *lg, unsigned start, unsigned end) |
| 62 | { |
| 63 | unsigned int i; |
| 64 | |
| 65 | for (i = start; i < end; i++) { |
Rusty Russell | bff672e | 2007-07-26 10:41:04 -0700 | [diff] [blame] | 66 | /* We never copy these ones to real GDT, so we don't care what |
| 67 | * they say */ |
Rusty Russell | d7e28ff | 2007-07-19 01:49:23 -0700 | [diff] [blame] | 68 | if (ignored_gdt(i)) |
| 69 | continue; |
| 70 | |
Rusty Russell | bff672e | 2007-07-26 10:41:04 -0700 | [diff] [blame] | 71 | /* Segment descriptors contain a privilege level: the Guest is |
| 72 | * sometimes careless and leaves this as 0, even though it's |
| 73 | * running at privilege level 1. If so, we fix it here. */ |
Jes Sorensen | 625efab | 2007-10-22 11:03:28 +1000 | [diff] [blame] | 74 | if ((lg->arch.gdt[i].b & 0x00006000) == 0) |
| 75 | lg->arch.gdt[i].b |= (GUEST_PL << 13); |
Rusty Russell | d7e28ff | 2007-07-19 01:49:23 -0700 | [diff] [blame] | 76 | |
Rusty Russell | bff672e | 2007-07-26 10:41:04 -0700 | [diff] [blame] | 77 | /* Each descriptor has an "accessed" bit. If we don't set it |
| 78 | * now, the CPU will try to set it when the Guest first loads |
| 79 | * that entry into a segment register. But the GDT isn't |
| 80 | * writable by the Guest, so bad things can happen. */ |
Jes Sorensen | 625efab | 2007-10-22 11:03:28 +1000 | [diff] [blame] | 81 | lg->arch.gdt[i].b |= 0x00000100; |
Rusty Russell | d7e28ff | 2007-07-19 01:49:23 -0700 | [diff] [blame] | 82 | } |
| 83 | } |
| 84 | |
Rusty Russell | e1e7296 | 2007-10-25 15:02:50 +1000 | [diff] [blame] | 85 | /*H:610 Like the IDT, we never simply use the GDT the Guest gives us. We keep |
| 86 | * a GDT for each CPU, and copy across the Guest's entries each time we want to |
| 87 | * run the Guest on that CPU. |
| 88 | * |
| 89 | * This routine is called at boot or modprobe time for each CPU to set up the |
| 90 | * constant GDT entries: the ones which are the same no matter what Guest we're |
| 91 | * running. */ |
Rusty Russell | d7e28ff | 2007-07-19 01:49:23 -0700 | [diff] [blame] | 92 | void setup_default_gdt_entries(struct lguest_ro_state *state) |
| 93 | { |
| 94 | struct desc_struct *gdt = state->guest_gdt; |
| 95 | unsigned long tss = (unsigned long)&state->guest_tss; |
| 96 | |
Rusty Russell | e1e7296 | 2007-10-25 15:02:50 +1000 | [diff] [blame] | 97 | /* The Switcher segments are full 0-4G segments, privilege level 0 */ |
Rusty Russell | d7e28ff | 2007-07-19 01:49:23 -0700 | [diff] [blame] | 98 | gdt[GDT_ENTRY_LGUEST_CS] = FULL_EXEC_SEGMENT; |
| 99 | gdt[GDT_ENTRY_LGUEST_DS] = FULL_SEGMENT; |
| 100 | |
Rusty Russell | e1e7296 | 2007-10-25 15:02:50 +1000 | [diff] [blame] | 101 | /* The TSS segment refers to the TSS entry for this particular CPU. |
| 102 | * Forgive the magic flags: the 0x8900 means the entry is Present, it's |
| 103 | * privilege level 0 Available 386 TSS system segment, and the 0x67 |
| 104 | * means Saturn is eclipsed by Mercury in the twelfth house. */ |
Rusty Russell | d7e28ff | 2007-07-19 01:49:23 -0700 | [diff] [blame] | 105 | gdt[GDT_ENTRY_TSS].a = 0x00000067 | (tss << 16); |
| 106 | gdt[GDT_ENTRY_TSS].b = 0x00008900 | (tss & 0xFF000000) |
| 107 | | ((tss >> 16) & 0x000000FF); |
| 108 | } |
| 109 | |
Rusty Russell | e1e7296 | 2007-10-25 15:02:50 +1000 | [diff] [blame] | 110 | /* This routine sets up the initial Guest GDT for booting. All entries start |
| 111 | * as 0 (unusable). */ |
Rusty Russell | d7e28ff | 2007-07-19 01:49:23 -0700 | [diff] [blame] | 112 | void setup_guest_gdt(struct lguest *lg) |
| 113 | { |
Rusty Russell | bff672e | 2007-07-26 10:41:04 -0700 | [diff] [blame] | 114 | /* Start with full 0-4G segments... */ |
Jes Sorensen | 625efab | 2007-10-22 11:03:28 +1000 | [diff] [blame] | 115 | lg->arch.gdt[GDT_ENTRY_KERNEL_CS] = FULL_EXEC_SEGMENT; |
| 116 | lg->arch.gdt[GDT_ENTRY_KERNEL_DS] = FULL_SEGMENT; |
Rusty Russell | bff672e | 2007-07-26 10:41:04 -0700 | [diff] [blame] | 117 | /* ...except the Guest is allowed to use them, so set the privilege |
| 118 | * level appropriately in the flags. */ |
Jes Sorensen | 625efab | 2007-10-22 11:03:28 +1000 | [diff] [blame] | 119 | lg->arch.gdt[GDT_ENTRY_KERNEL_CS].b |= (GUEST_PL << 13); |
| 120 | lg->arch.gdt[GDT_ENTRY_KERNEL_DS].b |= (GUEST_PL << 13); |
Rusty Russell | d7e28ff | 2007-07-19 01:49:23 -0700 | [diff] [blame] | 121 | } |
| 122 | |
Rusty Russell | e1e7296 | 2007-10-25 15:02:50 +1000 | [diff] [blame] | 123 | /*H:650 An optimization of copy_gdt(), for just the three "thead-local storage" |
| 124 | * entries. */ |
Rusty Russell | d7e28ff | 2007-07-19 01:49:23 -0700 | [diff] [blame] | 125 | void copy_gdt_tls(const struct lguest *lg, struct desc_struct *gdt) |
| 126 | { |
| 127 | unsigned int i; |
| 128 | |
| 129 | for (i = GDT_ENTRY_TLS_MIN; i <= GDT_ENTRY_TLS_MAX; i++) |
Jes Sorensen | 625efab | 2007-10-22 11:03:28 +1000 | [diff] [blame] | 130 | gdt[i] = lg->arch.gdt[i]; |
Rusty Russell | d7e28ff | 2007-07-19 01:49:23 -0700 | [diff] [blame] | 131 | } |
| 132 | |
Rusty Russell | e1e7296 | 2007-10-25 15:02:50 +1000 | [diff] [blame] | 133 | /*H:640 When the Guest is run on a different CPU, or the GDT entries have |
| 134 | * changed, copy_gdt() is called to copy the Guest's GDT entries across to this |
| 135 | * CPU's GDT. */ |
Rusty Russell | d7e28ff | 2007-07-19 01:49:23 -0700 | [diff] [blame] | 136 | void copy_gdt(const struct lguest *lg, struct desc_struct *gdt) |
| 137 | { |
| 138 | unsigned int i; |
| 139 | |
Rusty Russell | bff672e | 2007-07-26 10:41:04 -0700 | [diff] [blame] | 140 | /* The default entries from setup_default_gdt_entries() are not |
| 141 | * replaced. See ignored_gdt() above. */ |
Rusty Russell | d7e28ff | 2007-07-19 01:49:23 -0700 | [diff] [blame] | 142 | for (i = 0; i < GDT_ENTRIES; i++) |
| 143 | if (!ignored_gdt(i)) |
Jes Sorensen | 625efab | 2007-10-22 11:03:28 +1000 | [diff] [blame] | 144 | gdt[i] = lg->arch.gdt[i]; |
Rusty Russell | d7e28ff | 2007-07-19 01:49:23 -0700 | [diff] [blame] | 145 | } |
| 146 | |
Rusty Russell | e1e7296 | 2007-10-25 15:02:50 +1000 | [diff] [blame] | 147 | /*H:620 This is where the Guest asks us to load a new GDT (LHCALL_LOAD_GDT). |
| 148 | * We copy it from the Guest and tweak the entries. */ |
Rusty Russell | d7e28ff | 2007-07-19 01:49:23 -0700 | [diff] [blame] | 149 | void load_guest_gdt(struct lguest *lg, unsigned long table, u32 num) |
| 150 | { |
Rusty Russell | bff672e | 2007-07-26 10:41:04 -0700 | [diff] [blame] | 151 | /* We assume the Guest has the same number of GDT entries as the |
| 152 | * Host, otherwise we'd have to dynamically allocate the Guest GDT. */ |
Jes Sorensen | 625efab | 2007-10-22 11:03:28 +1000 | [diff] [blame] | 153 | if (num > ARRAY_SIZE(lg->arch.gdt)) |
Rusty Russell | d7e28ff | 2007-07-19 01:49:23 -0700 | [diff] [blame] | 154 | kill_guest(lg, "too many gdt entries %i", num); |
| 155 | |
Rusty Russell | bff672e | 2007-07-26 10:41:04 -0700 | [diff] [blame] | 156 | /* We read the whole thing in, then fix it up. */ |
Rusty Russell | 2d37f94 | 2007-10-22 11:24:24 +1000 | [diff] [blame] | 157 | __lgread(lg, lg->arch.gdt, table, num * sizeof(lg->arch.gdt[0])); |
Jes Sorensen | 625efab | 2007-10-22 11:03:28 +1000 | [diff] [blame] | 158 | fixup_gdt_table(lg, 0, ARRAY_SIZE(lg->arch.gdt)); |
Rusty Russell | bff672e | 2007-07-26 10:41:04 -0700 | [diff] [blame] | 159 | /* Mark that the GDT changed so the core knows it has to copy it again, |
| 160 | * even if the Guest is run on the same CPU. */ |
Rusty Russell | d7e28ff | 2007-07-19 01:49:23 -0700 | [diff] [blame] | 161 | lg->changed |= CHANGED_GDT; |
| 162 | } |
| 163 | |
Rusty Russell | e1e7296 | 2007-10-25 15:02:50 +1000 | [diff] [blame] | 164 | /* This is the fast-track version for just changing the three TLS entries. |
| 165 | * Remember that this happens on every context switch, so it's worth |
| 166 | * optimizing. But wouldn't it be neater to have a single hypercall to cover |
| 167 | * both cases? */ |
Rusty Russell | d7e28ff | 2007-07-19 01:49:23 -0700 | [diff] [blame] | 168 | void guest_load_tls(struct lguest *lg, unsigned long gtls) |
| 169 | { |
Jes Sorensen | 625efab | 2007-10-22 11:03:28 +1000 | [diff] [blame] | 170 | struct desc_struct *tls = &lg->arch.gdt[GDT_ENTRY_TLS_MIN]; |
Rusty Russell | d7e28ff | 2007-07-19 01:49:23 -0700 | [diff] [blame] | 171 | |
Rusty Russell | 2d37f94 | 2007-10-22 11:24:24 +1000 | [diff] [blame] | 172 | __lgread(lg, tls, gtls, sizeof(*tls)*GDT_ENTRY_TLS_ENTRIES); |
Rusty Russell | d7e28ff | 2007-07-19 01:49:23 -0700 | [diff] [blame] | 173 | fixup_gdt_table(lg, GDT_ENTRY_TLS_MIN, GDT_ENTRY_TLS_MAX+1); |
Rusty Russell | e1e7296 | 2007-10-25 15:02:50 +1000 | [diff] [blame] | 174 | /* Note that just the TLS entries have changed. */ |
Rusty Russell | d7e28ff | 2007-07-19 01:49:23 -0700 | [diff] [blame] | 175 | lg->changed |= CHANGED_GDT_TLS; |
| 176 | } |
Rusty Russell | e1e7296 | 2007-10-25 15:02:50 +1000 | [diff] [blame] | 177 | /*:*/ |
Rusty Russell | bff672e | 2007-07-26 10:41:04 -0700 | [diff] [blame] | 178 | |
Rusty Russell | e1e7296 | 2007-10-25 15:02:50 +1000 | [diff] [blame] | 179 | /*H:660 |
Rusty Russell | bff672e | 2007-07-26 10:41:04 -0700 | [diff] [blame] | 180 | * With this, we have finished the Host. |
| 181 | * |
| 182 | * Five of the seven parts of our task are complete. You have made it through |
| 183 | * the Bit of Despair (I think that's somewhere in the page table code, |
| 184 | * myself). |
| 185 | * |
| 186 | * Next, we examine "make Switcher". It's short, but intense. |
| 187 | */ |