lguest_user.c revision 58a24566449892dda409b9ad92c2e56c76c5670c
1/*P:200 This contains all the /dev/lguest code, whereby the userspace launcher 2 * controls and communicates with the Guest. For example, the first write will 3 * tell us the Guest's memory layout, pagetable, entry point and kernel address 4 * offset. A read will run the Guest until something happens, such as a signal 5 * or the Guest doing a NOTIFY out to the Launcher. :*/ 6#include <linux/uaccess.h> 7#include <linux/miscdevice.h> 8#include <linux/fs.h> 9#include <linux/sched.h> 10#include "lg.h" 11 12/*L:055 When something happens, the Waker process needs a way to stop the 13 * kernel running the Guest and return to the Launcher. So the Waker writes 14 * LHREQ_BREAK and the value "1" to /dev/lguest to do this. Once the Launcher 15 * has done whatever needs attention, it writes LHREQ_BREAK and "0" to release 16 * the Waker. */ 17static int break_guest_out(struct lg_cpu *cpu, const unsigned long __user*input) 18{ 19 unsigned long on; 20 21 /* Fetch whether they're turning break on or off. */ 22 if (get_user(on, input) != 0) 23 return -EFAULT; 24 25 if (on) { 26 cpu->break_out = 1; 27 /* Pop it out of the Guest (may be running on different CPU) */ 28 wake_up_process(cpu->tsk); 29 /* Wait for them to reset it */ 30 return wait_event_interruptible(cpu->break_wq, !cpu->break_out); 31 } else { 32 cpu->break_out = 0; 33 wake_up(&cpu->break_wq); 34 return 0; 35 } 36} 37 38/*L:050 Sending an interrupt is done by writing LHREQ_IRQ and an interrupt 39 * number to /dev/lguest. */ 40static int user_send_irq(struct lg_cpu *cpu, const unsigned long __user *input) 41{ 42 unsigned long irq; 43 44 if (get_user(irq, input) != 0) 45 return -EFAULT; 46 if (irq >= LGUEST_IRQS) 47 return -EINVAL; 48 /* Next time the Guest runs, the core code will see if it can deliver 49 * this interrupt. */ 50 set_bit(irq, cpu->irqs_pending); 51 return 0; 52} 53 54/*L:040 Once our Guest is initialized, the Launcher makes it run by reading 55 * from /dev/lguest. */ 56static ssize_t read(struct file *file, char __user *user, size_t size,loff_t*o) 57{ 58 struct lguest *lg = file->private_data; 59 struct lg_cpu *cpu; 60 unsigned int cpu_id = *o; 61 62 /* You must write LHREQ_INITIALIZE first! */ 63 if (!lg) 64 return -EINVAL; 65 66 /* Watch out for arbitrary vcpu indexes! */ 67 if (cpu_id >= lg->nr_cpus) 68 return -EINVAL; 69 70 cpu = &lg->cpus[cpu_id]; 71 72 /* If you're not the task which owns the Guest, go away. */ 73 if (current != cpu->tsk) 74 return -EPERM; 75 76 /* If the Guest is already dead, we indicate why */ 77 if (lg->dead) { 78 size_t len; 79 80 /* lg->dead either contains an error code, or a string. */ 81 if (IS_ERR(lg->dead)) 82 return PTR_ERR(lg->dead); 83 84 /* We can only return as much as the buffer they read with. */ 85 len = min(size, strlen(lg->dead)+1); 86 if (copy_to_user(user, lg->dead, len) != 0) 87 return -EFAULT; 88 return len; 89 } 90 91 /* If we returned from read() last time because the Guest sent I/O, 92 * clear the flag. */ 93 if (cpu->pending_notify) 94 cpu->pending_notify = 0; 95 96 /* Run the Guest until something interesting happens. */ 97 return run_guest(cpu, (unsigned long __user *)user); 98} 99 100/*L:025 This actually initializes a CPU. For the moment, a Guest is only 101 * uniprocessor, so "id" is always 0. */ 102static int lg_cpu_start(struct lg_cpu *cpu, unsigned id, unsigned long start_ip) 103{ 104 /* We have a limited number the number of CPUs in the lguest struct. */ 105 if (id >= ARRAY_SIZE(cpu->lg->cpus)) 106 return -EINVAL; 107 108 /* Set up this CPU's id, and pointer back to the lguest struct. */ 109 cpu->id = id; 110 cpu->lg = container_of((cpu - id), struct lguest, cpus[0]); 111 cpu->lg->nr_cpus++; 112 113 /* Each CPU has a timer it can set. */ 114 init_clockdev(cpu); 115 116 /* We need a complete page for the Guest registers: they are accessible 117 * to the Guest and we can only grant it access to whole pages. */ 118 cpu->regs_page = get_zeroed_page(GFP_KERNEL); 119 if (!cpu->regs_page) 120 return -ENOMEM; 121 122 /* We actually put the registers at the bottom of the page. */ 123 cpu->regs = (void *)cpu->regs_page + PAGE_SIZE - sizeof(*cpu->regs); 124 125 /* Now we initialize the Guest's registers, handing it the start 126 * address. */ 127 lguest_arch_setup_regs(cpu, start_ip); 128 129 /* Initialize the queue for the Waker to wait on */ 130 init_waitqueue_head(&cpu->break_wq); 131 132 /* We keep a pointer to the Launcher task (ie. current task) for when 133 * other Guests want to wake this one (eg. console input). */ 134 cpu->tsk = current; 135 136 /* We need to keep a pointer to the Launcher's memory map, because if 137 * the Launcher dies we need to clean it up. If we don't keep a 138 * reference, it is destroyed before close() is called. */ 139 cpu->mm = get_task_mm(cpu->tsk); 140 141 /* We remember which CPU's pages this Guest used last, for optimization 142 * when the same Guest runs on the same CPU twice. */ 143 cpu->last_pages = NULL; 144 145 /* No error == success. */ 146 return 0; 147} 148 149/*L:020 The initialization write supplies 3 pointer sized (32 or 64 bit) 150 * values (in addition to the LHREQ_INITIALIZE value). These are: 151 * 152 * base: The start of the Guest-physical memory inside the Launcher memory. 153 * 154 * pfnlimit: The highest (Guest-physical) page number the Guest should be 155 * allowed to access. The Guest memory lives inside the Launcher, so it sets 156 * this to ensure the Guest can only reach its own memory. 157 * 158 * start: The first instruction to execute ("eip" in x86-speak). 159 */ 160static int initialize(struct file *file, const unsigned long __user *input) 161{ 162 /* "struct lguest" contains everything we (the Host) know about a 163 * Guest. */ 164 struct lguest *lg; 165 int err; 166 unsigned long args[3]; 167 168 /* We grab the Big Lguest lock, which protects against multiple 169 * simultaneous initializations. */ 170 mutex_lock(&lguest_lock); 171 /* You can't initialize twice! Close the device and start again... */ 172 if (file->private_data) { 173 err = -EBUSY; 174 goto unlock; 175 } 176 177 if (copy_from_user(args, input, sizeof(args)) != 0) { 178 err = -EFAULT; 179 goto unlock; 180 } 181 182 lg = kzalloc(sizeof(*lg), GFP_KERNEL); 183 if (!lg) { 184 err = -ENOMEM; 185 goto unlock; 186 } 187 188 /* Populate the easy fields of our "struct lguest" */ 189 lg->mem_base = (void __user *)args[0]; 190 lg->pfn_limit = args[1]; 191 192 /* This is the first cpu (cpu 0) and it will start booting at args[2] */ 193 err = lg_cpu_start(&lg->cpus[0], 0, args[2]); 194 if (err) 195 goto release_guest; 196 197 /* Initialize the Guest's shadow page tables, using the toplevel 198 * address the Launcher gave us. This allocates memory, so can fail. */ 199 err = init_guest_pagetable(lg); 200 if (err) 201 goto free_regs; 202 203 /* We keep our "struct lguest" in the file's private_data. */ 204 file->private_data = lg; 205 206 mutex_unlock(&lguest_lock); 207 208 /* And because this is a write() call, we return the length used. */ 209 return sizeof(args); 210 211free_regs: 212 /* FIXME: This should be in free_vcpu */ 213 free_page(lg->cpus[0].regs_page); 214release_guest: 215 kfree(lg); 216unlock: 217 mutex_unlock(&lguest_lock); 218 return err; 219} 220 221/*L:010 The first operation the Launcher does must be a write. All writes 222 * start with an unsigned long number: for the first write this must be 223 * LHREQ_INITIALIZE to set up the Guest. After that the Launcher can use 224 * writes of other values to send interrupts. 225 * 226 * Note that we overload the "offset" in the /dev/lguest file to indicate what 227 * CPU number we're dealing with. Currently this is always 0, since we only 228 * support uniprocessor Guests, but you can see the beginnings of SMP support 229 * here. */ 230static ssize_t write(struct file *file, const char __user *in, 231 size_t size, loff_t *off) 232{ 233 /* Once the Guest is initialized, we hold the "struct lguest" in the 234 * file private data. */ 235 struct lguest *lg = file->private_data; 236 const unsigned long __user *input = (const unsigned long __user *)in; 237 unsigned long req; 238 struct lg_cpu *uninitialized_var(cpu); 239 unsigned int cpu_id = *off; 240 241 /* The first value tells us what this request is. */ 242 if (get_user(req, input) != 0) 243 return -EFAULT; 244 input++; 245 246 /* If you haven't initialized, you must do that first. */ 247 if (req != LHREQ_INITIALIZE) { 248 if (!lg || (cpu_id >= lg->nr_cpus)) 249 return -EINVAL; 250 cpu = &lg->cpus[cpu_id]; 251 252 /* Once the Guest is dead, you can only read() why it died. */ 253 if (lg->dead) 254 return -ENOENT; 255 256 /* If you're not the task which owns the Guest, all you can do 257 * is break the Launcher out of running the Guest. */ 258 if (current != cpu->tsk && req != LHREQ_BREAK) 259 return -EPERM; 260 } 261 262 switch (req) { 263 case LHREQ_INITIALIZE: 264 return initialize(file, input); 265 case LHREQ_IRQ: 266 return user_send_irq(cpu, input); 267 case LHREQ_BREAK: 268 return break_guest_out(cpu, input); 269 default: 270 return -EINVAL; 271 } 272} 273 274/*L:060 The final piece of interface code is the close() routine. It reverses 275 * everything done in initialize(). This is usually called because the 276 * Launcher exited. 277 * 278 * Note that the close routine returns 0 or a negative error number: it can't 279 * really fail, but it can whine. I blame Sun for this wart, and K&R C for 280 * letting them do it. :*/ 281static int close(struct inode *inode, struct file *file) 282{ 283 struct lguest *lg = file->private_data; 284 unsigned int i; 285 286 /* If we never successfully initialized, there's nothing to clean up */ 287 if (!lg) 288 return 0; 289 290 /* We need the big lock, to protect from inter-guest I/O and other 291 * Launchers initializing guests. */ 292 mutex_lock(&lguest_lock); 293 294 /* Free up the shadow page tables for the Guest. */ 295 free_guest_pagetable(lg); 296 297 for (i = 0; i < lg->nr_cpus; i++) { 298 /* Cancels the hrtimer set via LHCALL_SET_CLOCKEVENT. */ 299 hrtimer_cancel(&lg->cpus[i].hrt); 300 /* We can free up the register page we allocated. */ 301 free_page(lg->cpus[i].regs_page); 302 /* Now all the memory cleanups are done, it's safe to release 303 * the Launcher's memory management structure. */ 304 mmput(lg->cpus[i].mm); 305 } 306 /* If lg->dead doesn't contain an error code it will be NULL or a 307 * kmalloc()ed string, either of which is ok to hand to kfree(). */ 308 if (!IS_ERR(lg->dead)) 309 kfree(lg->dead); 310 /* We clear the entire structure, which also marks it as free for the 311 * next user. */ 312 memset(lg, 0, sizeof(*lg)); 313 /* Release lock and exit. */ 314 mutex_unlock(&lguest_lock); 315 316 return 0; 317} 318 319/*L:000 320 * Welcome to our journey through the Launcher! 321 * 322 * The Launcher is the Host userspace program which sets up, runs and services 323 * the Guest. In fact, many comments in the Drivers which refer to "the Host" 324 * doing things are inaccurate: the Launcher does all the device handling for 325 * the Guest, but the Guest can't know that. 326 * 327 * Just to confuse you: to the Host kernel, the Launcher *is* the Guest and we 328 * shall see more of that later. 329 * 330 * We begin our understanding with the Host kernel interface which the Launcher 331 * uses: reading and writing a character device called /dev/lguest. All the 332 * work happens in the read(), write() and close() routines: */ 333static struct file_operations lguest_fops = { 334 .owner = THIS_MODULE, 335 .release = close, 336 .write = write, 337 .read = read, 338}; 339 340/* This is a textbook example of a "misc" character device. Populate a "struct 341 * miscdevice" and register it with misc_register(). */ 342static struct miscdevice lguest_dev = { 343 .minor = MISC_DYNAMIC_MINOR, 344 .name = "lguest", 345 .fops = &lguest_fops, 346}; 347 348int __init lguest_device_init(void) 349{ 350 return misc_register(&lguest_dev); 351} 352 353void __exit lguest_device_remove(void) 354{ 355 misc_deregister(&lguest_dev); 356} 357