1 /******************************************************************************
4 * Device for accessing (in user-space) pages that have been granted by other
7 * Copyright (c) 2006-2007, D G Murray.
8 * (c) 2009 Gerd Hoffmann <kraxel@redhat.com>
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
15 * You should have received a copy of the GNU General Public License
16 * along with this program; if not, write to the Free Software
17 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
22 #include <linux/module.h>
23 #include <linux/kernel.h>
24 #include <linux/init.h>
25 #include <linux/miscdevice.h>
28 #include <linux/mman.h>
29 #include <linux/mmu_notifier.h>
30 #include <linux/types.h>
31 #include <linux/uaccess.h>
32 #include <linux/sched.h>
33 #include <linux/spinlock.h>
34 #include <linux/slab.h>
35 #include <linux/highmem.h>
38 #include <xen/grant_table.h>
39 #include <xen/balloon.h>
40 #include <xen/gntdev.h>
41 #include <xen/events.h>
42 #include <asm/xen/hypervisor.h>
43 #include <asm/xen/hypercall.h>
44 #include <asm/xen/page.h>
46 MODULE_LICENSE("GPL");
47 MODULE_AUTHOR("Derek G. Murray <Derek.Murray@cl.cam.ac.uk>, "
48 "Gerd Hoffmann <kraxel@redhat.com>");
49 MODULE_DESCRIPTION("User-space granted page access driver");
51 static int limit
= 1024*1024;
52 module_param(limit
, int, 0644);
53 MODULE_PARM_DESC(limit
, "Maximum number of grants that may be mapped by "
56 static atomic_t pages_mapped
= ATOMIC_INIT(0);
58 static int use_ptemod
;
61 struct list_head maps
;
62 /* lock protects maps from concurrent changes */
65 struct mmu_notifier mn
;
70 /* Address relative to the start of the grant_map */
76 struct list_head next
;
77 struct vm_area_struct
*vma
;
82 struct unmap_notify notify
;
83 struct ioctl_gntdev_grant_ref
*grants
;
84 struct gnttab_map_grant_ref
*map_ops
;
85 struct gnttab_unmap_grant_ref
*unmap_ops
;
86 struct gnttab_map_grant_ref
*kmap_ops
;
90 static int unmap_grant_pages(struct grant_map
*map
, int offset
, int pages
);
92 /* ------------------------------------------------------------------ */
94 static void gntdev_print_maps(struct gntdev_priv
*priv
,
95 char *text
, int text_index
)
98 struct grant_map
*map
;
100 pr_debug("%s: maps list (priv %p)\n", __func__
, priv
);
101 list_for_each_entry(map
, &priv
->maps
, next
)
102 pr_debug(" index %2d, count %2d %s\n",
103 map
->index
, map
->count
,
104 map
->index
== text_index
&& text
? text
: "");
108 static struct grant_map
*gntdev_alloc_map(struct gntdev_priv
*priv
, int count
)
110 struct grant_map
*add
;
113 add
= kzalloc(sizeof(struct grant_map
), GFP_KERNEL
);
117 add
->grants
= kzalloc(sizeof(add
->grants
[0]) * count
, GFP_KERNEL
);
118 add
->map_ops
= kzalloc(sizeof(add
->map_ops
[0]) * count
, GFP_KERNEL
);
119 add
->unmap_ops
= kzalloc(sizeof(add
->unmap_ops
[0]) * count
, GFP_KERNEL
);
120 add
->kmap_ops
= kzalloc(sizeof(add
->kmap_ops
[0]) * count
, GFP_KERNEL
);
121 add
->pages
= kzalloc(sizeof(add
->pages
[0]) * count
, GFP_KERNEL
);
122 if (NULL
== add
->grants
||
123 NULL
== add
->map_ops
||
124 NULL
== add
->unmap_ops
||
125 NULL
== add
->kmap_ops
||
129 if (alloc_xenballooned_pages(count
, add
->pages
, false /* lowmem */))
132 for (i
= 0; i
< count
; i
++) {
133 add
->map_ops
[i
].handle
= -1;
134 add
->unmap_ops
[i
].handle
= -1;
135 add
->kmap_ops
[i
].handle
= -1;
140 atomic_set(&add
->users
, 1);
148 kfree(add
->unmap_ops
);
149 kfree(add
->kmap_ops
);
154 static void gntdev_add_map(struct gntdev_priv
*priv
, struct grant_map
*add
)
156 struct grant_map
*map
;
158 list_for_each_entry(map
, &priv
->maps
, next
) {
159 if (add
->index
+ add
->count
< map
->index
) {
160 list_add_tail(&add
->next
, &map
->next
);
163 add
->index
= map
->index
+ map
->count
;
165 list_add_tail(&add
->next
, &priv
->maps
);
168 gntdev_print_maps(priv
, "[new]", add
->index
);
171 static struct grant_map
*gntdev_find_map_index(struct gntdev_priv
*priv
,
172 int index
, int count
)
174 struct grant_map
*map
;
176 list_for_each_entry(map
, &priv
->maps
, next
) {
177 if (map
->index
!= index
)
179 if (count
&& map
->count
!= count
)
186 static void gntdev_put_map(struct grant_map
*map
)
191 if (!atomic_dec_and_test(&map
->users
))
194 atomic_sub(map
->count
, &pages_mapped
);
196 if (map
->notify
.flags
& UNMAP_NOTIFY_SEND_EVENT
) {
197 notify_remote_via_evtchn(map
->notify
.event
);
202 unmap_grant_pages(map
, 0, map
->count
);
204 free_xenballooned_pages(map
->count
, map
->pages
);
209 kfree(map
->unmap_ops
);
213 /* ------------------------------------------------------------------ */
215 static int find_grant_ptes(pte_t
*pte
, pgtable_t token
,
216 unsigned long addr
, void *data
)
218 struct grant_map
*map
= data
;
219 unsigned int pgnr
= (addr
- map
->vma
->vm_start
) >> PAGE_SHIFT
;
220 int flags
= map
->flags
| GNTMAP_application_map
| GNTMAP_contains_pte
;
223 BUG_ON(pgnr
>= map
->count
);
224 pte_maddr
= arbitrary_virt_to_machine(pte
).maddr
;
226 gnttab_set_map_op(&map
->map_ops
[pgnr
], pte_maddr
, flags
,
227 map
->grants
[pgnr
].ref
,
228 map
->grants
[pgnr
].domid
);
229 gnttab_set_unmap_op(&map
->unmap_ops
[pgnr
], pte_maddr
, flags
,
234 static int map_grant_pages(struct grant_map
*map
)
239 /* Note: it could already be mapped */
240 if (map
->map_ops
[0].handle
!= -1)
242 for (i
= 0; i
< map
->count
; i
++) {
243 unsigned long addr
= (unsigned long)
244 pfn_to_kaddr(page_to_pfn(map
->pages
[i
]));
245 gnttab_set_map_op(&map
->map_ops
[i
], addr
, map
->flags
,
247 map
->grants
[i
].domid
);
248 gnttab_set_unmap_op(&map
->unmap_ops
[i
], addr
,
249 map
->flags
, -1 /* handle */);
253 * Setup the map_ops corresponding to the pte entries pointing
254 * to the kernel linear addresses of the struct pages.
255 * These ptes are completely different from the user ptes dealt
256 * with find_grant_ptes.
258 for (i
= 0; i
< map
->count
; i
++) {
260 unsigned long address
= (unsigned long)
261 pfn_to_kaddr(page_to_pfn(map
->pages
[i
]));
264 BUG_ON(PageHighMem(map
->pages
[i
]));
266 ptep
= lookup_address(address
, &level
);
267 pte_maddr
= arbitrary_virt_to_machine(ptep
).maddr
;
268 gnttab_set_map_op(&map
->kmap_ops
[i
], pte_maddr
,
273 map
->grants
[i
].domid
);
277 pr_debug("map %d+%d\n", map
->index
, map
->count
);
278 err
= gnttab_map_refs(map
->map_ops
, use_ptemod
? map
->kmap_ops
: NULL
,
279 map
->pages
, map
->count
);
283 for (i
= 0; i
< map
->count
; i
++) {
284 if (map
->map_ops
[i
].status
)
287 BUG_ON(map
->map_ops
[i
].handle
== -1);
288 map
->unmap_ops
[i
].handle
= map
->map_ops
[i
].handle
;
289 pr_debug("map handle=%d\n", map
->map_ops
[i
].handle
);
295 static int __unmap_grant_pages(struct grant_map
*map
, int offset
, int pages
)
299 if (map
->notify
.flags
& UNMAP_NOTIFY_CLEAR_BYTE
) {
300 int pgno
= (map
->notify
.addr
>> PAGE_SHIFT
);
301 if (pgno
>= offset
&& pgno
< offset
+ pages
&& use_ptemod
) {
302 void __user
*tmp
= (void __user
*)
303 map
->vma
->vm_start
+ map
->notify
.addr
;
304 err
= copy_to_user(tmp
, &err
, 1);
307 map
->notify
.flags
&= ~UNMAP_NOTIFY_CLEAR_BYTE
;
308 } else if (pgno
>= offset
&& pgno
< offset
+ pages
) {
309 uint8_t *tmp
= kmap(map
->pages
[pgno
]);
310 tmp
[map
->notify
.addr
& (PAGE_SIZE
-1)] = 0;
311 kunmap(map
->pages
[pgno
]);
312 map
->notify
.flags
&= ~UNMAP_NOTIFY_CLEAR_BYTE
;
316 err
= gnttab_unmap_refs(map
->unmap_ops
+ offset
, map
->pages
+ offset
, pages
);
320 for (i
= 0; i
< pages
; i
++) {
321 if (map
->unmap_ops
[offset
+i
].status
)
323 pr_debug("unmap handle=%d st=%d\n",
324 map
->unmap_ops
[offset
+i
].handle
,
325 map
->unmap_ops
[offset
+i
].status
);
326 map
->unmap_ops
[offset
+i
].handle
= -1;
331 static int unmap_grant_pages(struct grant_map
*map
, int offset
, int pages
)
335 pr_debug("unmap %d+%d [%d+%d]\n", map
->index
, map
->count
, offset
, pages
);
337 /* It is possible the requested range will have a "hole" where we
338 * already unmapped some of the grants. Only unmap valid ranges.
340 while (pages
&& !err
) {
341 while (pages
&& map
->unmap_ops
[offset
].handle
== -1) {
346 while (range
< pages
) {
347 if (map
->unmap_ops
[offset
+range
].handle
== -1) {
353 err
= __unmap_grant_pages(map
, offset
, range
);
361 /* ------------------------------------------------------------------ */
363 static void gntdev_vma_open(struct vm_area_struct
*vma
)
365 struct grant_map
*map
= vma
->vm_private_data
;
367 pr_debug("gntdev_vma_open %p\n", vma
);
368 atomic_inc(&map
->users
);
371 static void gntdev_vma_close(struct vm_area_struct
*vma
)
373 struct grant_map
*map
= vma
->vm_private_data
;
375 pr_debug("gntdev_vma_close %p\n", vma
);
377 vma
->vm_private_data
= NULL
;
381 static struct vm_operations_struct gntdev_vmops
= {
382 .open
= gntdev_vma_open
,
383 .close
= gntdev_vma_close
,
386 /* ------------------------------------------------------------------ */
388 static void mn_invl_range_start(struct mmu_notifier
*mn
,
389 struct mm_struct
*mm
,
390 unsigned long start
, unsigned long end
)
392 struct gntdev_priv
*priv
= container_of(mn
, struct gntdev_priv
, mn
);
393 struct grant_map
*map
;
394 unsigned long mstart
, mend
;
397 spin_lock(&priv
->lock
);
398 list_for_each_entry(map
, &priv
->maps
, next
) {
401 if (map
->vma
->vm_start
>= end
)
403 if (map
->vma
->vm_end
<= start
)
405 mstart
= max(start
, map
->vma
->vm_start
);
406 mend
= min(end
, map
->vma
->vm_end
);
407 pr_debug("map %d+%d (%lx %lx), range %lx %lx, mrange %lx %lx\n",
408 map
->index
, map
->count
,
409 map
->vma
->vm_start
, map
->vma
->vm_end
,
410 start
, end
, mstart
, mend
);
411 err
= unmap_grant_pages(map
,
412 (mstart
- map
->vma
->vm_start
) >> PAGE_SHIFT
,
413 (mend
- mstart
) >> PAGE_SHIFT
);
416 spin_unlock(&priv
->lock
);
419 static void mn_invl_page(struct mmu_notifier
*mn
,
420 struct mm_struct
*mm
,
421 unsigned long address
)
423 mn_invl_range_start(mn
, mm
, address
, address
+ PAGE_SIZE
);
426 static void mn_release(struct mmu_notifier
*mn
,
427 struct mm_struct
*mm
)
429 struct gntdev_priv
*priv
= container_of(mn
, struct gntdev_priv
, mn
);
430 struct grant_map
*map
;
433 spin_lock(&priv
->lock
);
434 list_for_each_entry(map
, &priv
->maps
, next
) {
437 pr_debug("map %d+%d (%lx %lx)\n",
438 map
->index
, map
->count
,
439 map
->vma
->vm_start
, map
->vma
->vm_end
);
440 err
= unmap_grant_pages(map
, /* offset */ 0, map
->count
);
443 spin_unlock(&priv
->lock
);
446 struct mmu_notifier_ops gntdev_mmu_ops
= {
447 .release
= mn_release
,
448 .invalidate_page
= mn_invl_page
,
449 .invalidate_range_start
= mn_invl_range_start
,
452 /* ------------------------------------------------------------------ */
454 static int gntdev_open(struct inode
*inode
, struct file
*flip
)
456 struct gntdev_priv
*priv
;
459 priv
= kzalloc(sizeof(*priv
), GFP_KERNEL
);
463 INIT_LIST_HEAD(&priv
->maps
);
464 spin_lock_init(&priv
->lock
);
467 priv
->mm
= get_task_mm(current
);
472 priv
->mn
.ops
= &gntdev_mmu_ops
;
473 ret
= mmu_notifier_register(&priv
->mn
, priv
->mm
);
482 flip
->private_data
= priv
;
483 pr_debug("priv %p\n", priv
);
488 static int gntdev_release(struct inode
*inode
, struct file
*flip
)
490 struct gntdev_priv
*priv
= flip
->private_data
;
491 struct grant_map
*map
;
493 pr_debug("priv %p\n", priv
);
495 while (!list_empty(&priv
->maps
)) {
496 map
= list_entry(priv
->maps
.next
, struct grant_map
, next
);
497 list_del(&map
->next
);
502 mmu_notifier_unregister(&priv
->mn
, priv
->mm
);
507 static long gntdev_ioctl_map_grant_ref(struct gntdev_priv
*priv
,
508 struct ioctl_gntdev_map_grant_ref __user
*u
)
510 struct ioctl_gntdev_map_grant_ref op
;
511 struct grant_map
*map
;
514 if (copy_from_user(&op
, u
, sizeof(op
)) != 0)
516 pr_debug("priv %p, add %d\n", priv
, op
.count
);
517 if (unlikely(op
.count
<= 0))
521 map
= gntdev_alloc_map(priv
, op
.count
);
525 if (unlikely(atomic_add_return(op
.count
, &pages_mapped
) > limit
)) {
526 pr_debug("can't map: over limit\n");
531 if (copy_from_user(map
->grants
, &u
->refs
,
532 sizeof(map
->grants
[0]) * op
.count
) != 0) {
537 spin_lock(&priv
->lock
);
538 gntdev_add_map(priv
, map
);
539 op
.index
= map
->index
<< PAGE_SHIFT
;
540 spin_unlock(&priv
->lock
);
542 if (copy_to_user(u
, &op
, sizeof(op
)) != 0)
548 static long gntdev_ioctl_unmap_grant_ref(struct gntdev_priv
*priv
,
549 struct ioctl_gntdev_unmap_grant_ref __user
*u
)
551 struct ioctl_gntdev_unmap_grant_ref op
;
552 struct grant_map
*map
;
555 if (copy_from_user(&op
, u
, sizeof(op
)) != 0)
557 pr_debug("priv %p, del %d+%d\n", priv
, (int)op
.index
, (int)op
.count
);
559 spin_lock(&priv
->lock
);
560 map
= gntdev_find_map_index(priv
, op
.index
>> PAGE_SHIFT
, op
.count
);
562 list_del(&map
->next
);
565 spin_unlock(&priv
->lock
);
571 static long gntdev_ioctl_get_offset_for_vaddr(struct gntdev_priv
*priv
,
572 struct ioctl_gntdev_get_offset_for_vaddr __user
*u
)
574 struct ioctl_gntdev_get_offset_for_vaddr op
;
575 struct vm_area_struct
*vma
;
576 struct grant_map
*map
;
578 if (copy_from_user(&op
, u
, sizeof(op
)) != 0)
580 pr_debug("priv %p, offset for vaddr %lx\n", priv
, (unsigned long)op
.vaddr
);
582 vma
= find_vma(current
->mm
, op
.vaddr
);
583 if (!vma
|| vma
->vm_ops
!= &gntdev_vmops
)
586 map
= vma
->vm_private_data
;
590 op
.offset
= map
->index
<< PAGE_SHIFT
;
591 op
.count
= map
->count
;
593 if (copy_to_user(u
, &op
, sizeof(op
)) != 0)
598 static long gntdev_ioctl_notify(struct gntdev_priv
*priv
, void __user
*u
)
600 struct ioctl_gntdev_unmap_notify op
;
601 struct grant_map
*map
;
604 if (copy_from_user(&op
, u
, sizeof(op
)))
607 if (op
.action
& ~(UNMAP_NOTIFY_CLEAR_BYTE
|UNMAP_NOTIFY_SEND_EVENT
))
610 spin_lock(&priv
->lock
);
612 list_for_each_entry(map
, &priv
->maps
, next
) {
613 uint64_t begin
= map
->index
<< PAGE_SHIFT
;
614 uint64_t end
= (map
->index
+ map
->count
) << PAGE_SHIFT
;
615 if (op
.index
>= begin
&& op
.index
< end
)
622 if ((op
.action
& UNMAP_NOTIFY_CLEAR_BYTE
) &&
623 (map
->flags
& GNTMAP_readonly
)) {
628 map
->notify
.flags
= op
.action
;
629 map
->notify
.addr
= op
.index
- (map
->index
<< PAGE_SHIFT
);
630 map
->notify
.event
= op
.event_channel_port
;
633 spin_unlock(&priv
->lock
);
637 static long gntdev_ioctl(struct file
*flip
,
638 unsigned int cmd
, unsigned long arg
)
640 struct gntdev_priv
*priv
= flip
->private_data
;
641 void __user
*ptr
= (void __user
*)arg
;
644 case IOCTL_GNTDEV_MAP_GRANT_REF
:
645 return gntdev_ioctl_map_grant_ref(priv
, ptr
);
647 case IOCTL_GNTDEV_UNMAP_GRANT_REF
:
648 return gntdev_ioctl_unmap_grant_ref(priv
, ptr
);
650 case IOCTL_GNTDEV_GET_OFFSET_FOR_VADDR
:
651 return gntdev_ioctl_get_offset_for_vaddr(priv
, ptr
);
653 case IOCTL_GNTDEV_SET_UNMAP_NOTIFY
:
654 return gntdev_ioctl_notify(priv
, ptr
);
657 pr_debug("priv %p, unknown cmd %x\n", priv
, cmd
);
664 static int gntdev_mmap(struct file
*flip
, struct vm_area_struct
*vma
)
666 struct gntdev_priv
*priv
= flip
->private_data
;
667 int index
= vma
->vm_pgoff
;
668 int count
= (vma
->vm_end
- vma
->vm_start
) >> PAGE_SHIFT
;
669 struct grant_map
*map
;
670 int i
, err
= -EINVAL
;
672 if ((vma
->vm_flags
& VM_WRITE
) && !(vma
->vm_flags
& VM_SHARED
))
675 pr_debug("map %d+%d at %lx (pgoff %lx)\n",
676 index
, count
, vma
->vm_start
, vma
->vm_pgoff
);
678 spin_lock(&priv
->lock
);
679 map
= gntdev_find_map_index(priv
, index
, count
);
682 if (use_ptemod
&& map
->vma
)
684 if (use_ptemod
&& priv
->mm
!= vma
->vm_mm
) {
685 printk(KERN_WARNING
"Huh? Other mm?\n");
689 atomic_inc(&map
->users
);
691 vma
->vm_ops
= &gntdev_vmops
;
693 vma
->vm_flags
|= VM_RESERVED
|VM_DONTEXPAND
;
696 vma
->vm_flags
|= VM_DONTCOPY
|VM_PFNMAP
;
698 vma
->vm_private_data
= map
;
704 if ((vma
->vm_flags
& VM_WRITE
) &&
705 (map
->flags
& GNTMAP_readonly
))
708 map
->flags
= GNTMAP_host_map
;
709 if (!(vma
->vm_flags
& VM_WRITE
))
710 map
->flags
|= GNTMAP_readonly
;
713 spin_unlock(&priv
->lock
);
716 err
= apply_to_page_range(vma
->vm_mm
, vma
->vm_start
,
717 vma
->vm_end
- vma
->vm_start
,
718 find_grant_ptes
, map
);
720 printk(KERN_WARNING
"find_grant_ptes() failure.\n");
725 err
= map_grant_pages(map
);
730 for (i
= 0; i
< count
; i
++) {
731 err
= vm_insert_page(vma
, vma
->vm_start
+ i
*PAGE_SIZE
,
741 spin_unlock(&priv
->lock
);
745 spin_unlock(&priv
->lock
);
753 static const struct file_operations gntdev_fops
= {
754 .owner
= THIS_MODULE
,
756 .release
= gntdev_release
,
758 .unlocked_ioctl
= gntdev_ioctl
761 static struct miscdevice gntdev_miscdev
= {
762 .minor
= MISC_DYNAMIC_MINOR
,
763 .name
= "xen/gntdev",
764 .fops
= &gntdev_fops
,
767 /* ------------------------------------------------------------------ */
769 static int __init
gntdev_init(void)
776 use_ptemod
= xen_pv_domain();
778 err
= misc_register(&gntdev_miscdev
);
780 printk(KERN_ERR
"Could not register gntdev device\n");
786 static void __exit
gntdev_exit(void)
788 misc_deregister(&gntdev_miscdev
);
791 module_init(gntdev_init
);
792 module_exit(gntdev_exit
);
794 /* ------------------------------------------------------------------ */