1 /*P:900 This is the Switcher: code which sits at 0xFFC00000 to do the low-level
2 * Guest<->Host switch. It is as simple as it can be made, but it's naturally
3 * very specific to x86.
5 * You have now completed Preparation. If this has whet your appetite; if you
6 * are feeling invigorated and refreshed then the next, more challenging stage
7 * can be found in "make Guest". :*/
10 * Welcome to the Switcher itself!
12 * This file contains the low-level code which changes the CPU to run the Guest
13 * code, and returns to the Host when something happens. Understand this, and
14 * you understand the heart of our journey.
16 * Because this is in assembler rather than C, our tale switches from prose to
17 * verse. First I tried limericks:
19 * There once was an eax reg,
20 * To which our pointer was fed,
22 * Which asm-offsets.h had
23 * But this limerick is hurting my head.
25 * Next I tried haikus, but fitting the required reference to the seasons in
26 * every stanza was quickly becoming tiresome:
29 * Holds "struct lguest_pages" now:
30 * Cherry blossoms fall.
32 * Then I started with Heroic Verse, but the rhyming requirement leeched away
33 * the content density and led to some uniquely awful oblique rhymes:
35 * These constants are coming from struct offsets
36 * For use within the asm switcher text.
38 * Finally, I settled for something between heroic hexameter, and normal prose
39 * with inappropriate linebreaks. Anyway, it aint no Shakespeare.
42 // Not all kernel headers work from assembler
43 // But these ones are needed: the ENTRY() define
44 // And constants extracted from struct offsets
45 // To avoid magic numbers and breakage:
46 // Should they change the compiler can't save us
47 // Down here in the depths of assembler code.
48 #include <linux/linkage.h>
49 #include <asm/asm-offsets.h>
52 // We mark the start of the code to copy
53 // It's placed in .text tho it's never run here
54 // You'll see the trick macro at the end
55 // Which interleaves data and text to effect.
57 ENTRY(start_switcher_text)
59 // When we reach switch_to_guest we have just left
60 // The safe and comforting shores of C code
61 // %eax has the "struct lguest_pages" to use
62 // Where we save state and still see it from the Guest
63 // And %ebx holds the Guest shadow pagetable:
64 // Once set we have truly left Host behind.
65 ENTRY(switch_to_guest)
66 // We told gcc all its regs could fade,
67 // Clobbered by our journey into the Guest
68 // We could have saved them, if we tried
69 // But time is our master and cycles count.
71 // Segment registers must be saved for the Host
72 // We push them on the Host stack for later
77 // But the compiler is fickle, and heeds
78 // No warning of %ebp clobbers
79 // When frame pointers are used. That register
80 // Must be saved and restored or chaos strikes.
82 // The Host's stack is done, now save it away
83 // In our "struct lguest_pages" at offset
84 // Distilled into asm-offsets.h
85 movl %esp, LGUEST_PAGES_host_sp(%eax)
87 // All saved and there's now five steps before us:
88 // Stack, GDT, IDT, TSS
89 // And last of all the page tables are flipped.
91 // Yet beware that our stack pointer must be
92 // Always valid lest an NMI hits
93 // %edx does the duty here as we juggle
94 // %eax is lguest_pages: our stack lies within.
96 addl $LGUEST_PAGES_regs, %edx
99 // The Guest's GDT we so carefully
100 // Placed in the "struct lguest_pages" before
101 lgdt LGUEST_PAGES_guest_gdt_desc(%eax)
103 // The Guest's IDT we did partially
104 // Move to the "struct lguest_pages" as well.
105 lidt LGUEST_PAGES_guest_idt_desc(%eax)
107 // The TSS entry which controls traps
108 // Must be loaded up with "ltr" now:
109 // For after we switch over our page tables
110 // It (as the rest) will be writable no more.
111 // (The GDT entry TSS needs
112 // Changes type when we load it: damn Intel!)
113 movl $(GDT_ENTRY_TSS*8), %edx
116 // Look back now, before we take this last step!
117 // The Host's TSS entry was also marked used;
118 // Let's clear it again, ere we return.
119 // The GDT descriptor of the Host
120 // Points to the table after two "size" bytes
121 movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %edx
122 // Clear the type field of "used" (byte 5, bit 2)
123 andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%edx)
125 // Once our page table's switched, the Guest is live!
126 // The Host fades as we run this final step.
127 // Our "struct lguest_pages" is now read-only.
130 // The page table change did one tricky thing:
131 // The Guest's register page has been mapped
132 // Writable onto our %esp (stack) --
133 // We can simply pop off all Guest regs.
146 // Near the base of the stack lurk two strange fields
147 // Which we fill as we exit the Guest
148 // These are the trap number and its error
149 // We can simply step past them on our way.
152 // The last five stack slots hold return address
153 // And everything needed to change privilege
154 // Into the Guest privilege level of 1,
155 // And the stack where the Guest had last left it.
156 // Interrupts are turned back on: we are Guest.
159 // There are two paths where we switch to the Host
160 // So we put the routine in a macro.
161 // We are on our way home, back to the Host
162 // Interrupted out of the Guest, we come here.
163 #define SWITCH_TO_HOST \
164 /* We save the Guest state: all registers first \
165 * Laid out just as "struct lguest_regs" defines */ \
177 /* Our stack and our code are using segments \
178 * Set in the TSS and IDT \
179 * Yet if we were to touch data we'd use \
180 * Whatever data segment the Guest had. \
181 * Load the lguest ds segment for now. */ \
182 movl $(LGUEST_DS), %eax; \
184 /* So where are we? Which CPU, which struct? \
185 * The stack is our clue: our TSS sets \
186 * It at the end of "struct lguest_pages" \
187 * And we then pushed and pushed and pushed Guest regs: \
188 * Now stack points atop the "struct lguest_regs". \
189 * Subtract that offset, and we find our struct. */ \
191 subl $LGUEST_PAGES_regs, %eax; \
192 /* Save our trap number: the switch will obscure it \
193 * (The Guest regs are not mapped here in the Host) \
194 * %ebx holds it safe for deliver_to_host */ \
195 movl LGUEST_PAGES_regs_trapnum(%eax), %ebx; \
196 /* The Host GDT, IDT and stack! \
197 * All these lie safely hidden from the Guest: \
198 * We must return to the Host page tables \
199 * (Hence that was saved in struct lguest_pages) */ \
200 movl LGUEST_PAGES_host_cr3(%eax), %edx; \
202 /* As before, when we looked back at the Host \
203 * As we left and marked TSS unused \
204 * So must we now for the Guest left behind. */ \
205 andb $0xFD, (LGUEST_PAGES_guest_gdt+GDT_ENTRY_TSS*8+5)(%eax); \
206 /* Switch to Host's GDT, IDT. */ \
207 lgdt LGUEST_PAGES_host_gdt_desc(%eax); \
208 lidt LGUEST_PAGES_host_idt_desc(%eax); \
209 /* Restore the Host's stack where it's saved regs lie */ \
210 movl LGUEST_PAGES_host_sp(%eax), %esp; \
211 /* Last the TSS: our Host is complete */ \
212 movl $(GDT_ENTRY_TSS*8), %edx; \
214 /* Restore now the regs saved right at the first. */ \
221 // Here's where we come when the Guest has just trapped:
222 // (Which trap we'll see has been pushed on the stack).
223 // We need only switch back, and the Host will decode
224 // Why we came home, and what needs to be done.
229 // An interrupt, with some cause external
230 // Has ajerked us rudely from the Guest's code
231 // Again we must return home to the Host
234 // But now we must go home via that place
235 // Where that interrupt was supposed to go
236 // Had we not been ensconced, running the Guest.
237 // Here we see the cleverness of our stack:
238 // The Host stack is formed like an interrupt
239 // With EIP, CS and EFLAGS layered.
240 // Interrupt handlers end with "iret"
241 // And that will take us home at long long last.
243 // But first we must find the handler to call!
244 // The IDT descriptor for the Host
245 // Has two bytes for size, and four for address:
246 // %edx will hold it for us for now.
247 movl (LGUEST_PAGES_host_idt_desc+2)(%eax), %edx
248 // We now know the table address we need,
249 // And saved the trap's number inside %ebx.
250 // Yet the pointer to the handler is smeared
251 // Across the bits of the table entry.
252 // What oracle can tell us how to extract
253 // From such a convoluted encoding?
254 // I consulted gcc, and it gave
255 // These instructions, which I gladly credit:
256 leal (%edx,%ebx,8), %eax
261 // Now the address of the handler's in %edx
262 // We call it now: its "iret" takes us home.
265 // Every interrupt can come to us here
266 // But we must truly tell each apart.
267 // They number two hundred and fifty six
268 // And each must land in a different spot,
269 // Push its number on stack, and join the stream.
271 // And worse, a mere six of the traps stand apart
272 // And push on their stack an addition:
273 // An error number, thirty two bits long
274 // So we punish the other two fifty
275 // And make them push a zero so they match.
277 // Yet two fifty six entries is long
278 // And all will look most the same as the last
279 // So we create a macro which can make
280 // As many entries as we need to fill.
282 // Note the change to .data then .text:
283 // We plant the address of each entry
284 // Into a (data) table for the Host
285 // To know where each Guest interrupt should go.
286 .macro IRQ_STUB N TARGET
287 .data; .long 1f; .text; 1:
288 // Trap eight, ten through fourteen and seventeen
289 // Supply an error number. Else zero.
290 .if (\N <> 8) && (\N < 10 || \N > 14) && (\N <> 17)
298 // This macro creates numerous entries
299 // Using GAS macros which out-power C's.
300 .macro IRQ_STUBS FIRST LAST TARGET
308 // Here's the marker for our pointer table
309 // Laid in the data section just before
310 // Each macro places the address of code
311 // Forming an array: each one points to text
312 // Which handles interrupt in its turn.
314 .global default_idt_entries
317 // The first two traps go straight back to the Host
318 IRQ_STUBS 0 1 return_to_host
319 // We'll say nothing, yet, about NMI
320 IRQ_STUB 2 handle_nmi
321 // Other traps also return to the Host
322 IRQ_STUBS 3 31 return_to_host
323 // All interrupts go via their handlers
324 IRQ_STUBS 32 127 deliver_to_host
325 // 'Cept system calls coming from userspace
326 // Are to go to the Guest, never the Host.
327 IRQ_STUB 128 return_to_host
328 IRQ_STUBS 129 255 deliver_to_host
330 // The NMI, what a fabulous beast
331 // Which swoops in and stops us no matter that
332 // We're suspended between heaven and hell,
333 // (Or more likely between the Host and Guest)
334 // When in it comes! We are dazed and confused
335 // So we do the simplest thing which one can.
336 // Though we've pushed the trap number and zero
337 // We discard them, return, and hope we live.
342 // We are done; all that's left is Mastery
343 // And "make Mastery" is a journey long
344 // Designed to make your fingers itch to code.
346 // Here ends the text, the file and poem.
347 ENTRY(end_switcher_text)