lguest_user.c revision 74dbf719ed3c49687dab507967ebab9189e91ab0
1/*P:200 This contains all the /dev/lguest code, whereby the userspace launcher 2 * controls and communicates with the Guest. For example, the first write will 3 * tell us the Guest's memory layout, pagetable, entry point and kernel address 4 * offset. A read will run the Guest until something happens, such as a signal 5 * or the Guest doing a NOTIFY out to the Launcher. :*/ 6#include <linux/uaccess.h> 7#include <linux/miscdevice.h> 8#include <linux/fs.h> 9#include <linux/sched.h> 10#include "lg.h" 11 12/*L:055 When something happens, the Waker process needs a way to stop the 13 * kernel running the Guest and return to the Launcher. So the Waker writes 14 * LHREQ_BREAK and the value "1" to /dev/lguest to do this. Once the Launcher 15 * has done whatever needs attention, it writes LHREQ_BREAK and "0" to release 16 * the Waker. */ 17static int break_guest_out(struct lg_cpu *cpu, const unsigned long __user*input) 18{ 19 unsigned long on; 20 21 /* Fetch whether they're turning break on or off. */ 22 if (get_user(on, input) != 0) 23 return -EFAULT; 24 25 if (on) { 26 cpu->break_out = 1; 27 /* Pop it out of the Guest (may be running on different CPU) */ 28 wake_up_process(cpu->tsk); 29 /* Wait for them to reset it */ 30 return wait_event_interruptible(cpu->break_wq, !cpu->break_out); 31 } else { 32 cpu->break_out = 0; 33 wake_up(&cpu->break_wq); 34 return 0; 35 } 36} 37 38/*L:050 Sending an interrupt is done by writing LHREQ_IRQ and an interrupt 39 * number to /dev/lguest. */ 40static int user_send_irq(struct lg_cpu *cpu, const unsigned long __user *input) 41{ 42 unsigned long irq; 43 44 if (get_user(irq, input) != 0) 45 return -EFAULT; 46 if (irq >= LGUEST_IRQS) 47 return -EINVAL; 48 /* Next time the Guest runs, the core code will see if it can deliver 49 * this interrupt. */ 50 set_bit(irq, cpu->irqs_pending); 51 return 0; 52} 53 54/*L:040 Once our Guest is initialized, the Launcher makes it run by reading 55 * from /dev/lguest. */ 56static ssize_t read(struct file *file, char __user *user, size_t size,loff_t*o) 57{ 58 struct lguest *lg = file->private_data; 59 struct lg_cpu *cpu; 60 unsigned int cpu_id = *o; 61 62 /* You must write LHREQ_INITIALIZE first! */ 63 if (!lg) 64 return -EINVAL; 65 66 /* Watch out for arbitrary vcpu indexes! */ 67 if (cpu_id >= lg->nr_cpus) 68 return -EINVAL; 69 70 cpu = &lg->cpus[cpu_id]; 71 72 /* If you're not the task which owns the Guest, go away. */ 73 if (current != cpu->tsk) 74 return -EPERM; 75 76 /* If the Guest is already dead, we indicate why */ 77 if (lg->dead) { 78 size_t len; 79 80 /* lg->dead either contains an error code, or a string. */ 81 if (IS_ERR(lg->dead)) 82 return PTR_ERR(lg->dead); 83 84 /* We can only return as much as the buffer they read with. */ 85 len = min(size, strlen(lg->dead)+1); 86 if (copy_to_user(user, lg->dead, len) != 0) 87 return -EFAULT; 88 return len; 89 } 90 91 /* If we returned from read() last time because the Guest sent I/O, 92 * clear the flag. */ 93 if (cpu->pending_notify) 94 cpu->pending_notify = 0; 95 96 /* Run the Guest until something interesting happens. */ 97 return run_guest(cpu, (unsigned long __user *)user); 98} 99 100/*L:025 This actually initializes a CPU. For the moment, a Guest is only 101 * uniprocessor, so "id" is always 0. */ 102static int lg_cpu_start(struct lg_cpu *cpu, unsigned id, unsigned long start_ip) 103{ 104 /* We have a limited number the number of CPUs in the lguest struct. */ 105 if (id >= NR_CPUS) 106 return -EINVAL; 107 108 /* Set up this CPU's id, and pointer back to the lguest struct. */ 109 cpu->id = id; 110 cpu->lg = container_of((cpu - id), struct lguest, cpus[0]); 111 cpu->lg->nr_cpus++; 112 113 /* Each CPU has a timer it can set. */ 114 init_clockdev(cpu); 115 116 /* We need a complete page for the Guest registers: they are accessible 117 * to the Guest and we can only grant it access to whole pages. */ 118 cpu->regs_page = get_zeroed_page(GFP_KERNEL); 119 if (!cpu->regs_page) 120 return -ENOMEM; 121 122 /* We actually put the registers at the bottom of the page. */ 123 cpu->regs = (void *)cpu->regs_page + PAGE_SIZE - sizeof(*cpu->regs); 124 125 /* Now we initialize the Guest's registers, handing it the start 126 * address. */ 127 lguest_arch_setup_regs(cpu, start_ip); 128 129 /* Initialize the queue for the Waker to wait on */ 130 init_waitqueue_head(&cpu->break_wq); 131 132 /* We keep a pointer to the Launcher task (ie. current task) for when 133 * other Guests want to wake this one (eg. console input). */ 134 cpu->tsk = current; 135 136 /* We need to keep a pointer to the Launcher's memory map, because if 137 * the Launcher dies we need to clean it up. If we don't keep a 138 * reference, it is destroyed before close() is called. */ 139 cpu->mm = get_task_mm(cpu->tsk); 140 141 /* We remember which CPU's pages this Guest used last, for optimization 142 * when the same Guest runs on the same CPU twice. */ 143 cpu->last_pages = NULL; 144 145 /* No error == success. */ 146 return 0; 147} 148 149/*L:020 The initialization write supplies 4 pointer sized (32 or 64 bit) 150 * values (in addition to the LHREQ_INITIALIZE value). These are: 151 * 152 * base: The start of the Guest-physical memory inside the Launcher memory. 153 * 154 * pfnlimit: The highest (Guest-physical) page number the Guest should be 155 * allowed to access. The Guest memory lives inside the Launcher, so it sets 156 * this to ensure the Guest can only reach its own memory. 157 * 158 * pgdir: The (Guest-physical) address of the top of the initial Guest 159 * pagetables (which are set up by the Launcher). 160 * 161 * start: The first instruction to execute ("eip" in x86-speak). 162 */ 163static int initialize(struct file *file, const unsigned long __user *input) 164{ 165 /* "struct lguest" contains everything we (the Host) know about a 166 * Guest. */ 167 struct lguest *lg; 168 int err; 169 unsigned long args[4]; 170 171 /* We grab the Big Lguest lock, which protects against multiple 172 * simultaneous initializations. */ 173 mutex_lock(&lguest_lock); 174 /* You can't initialize twice! Close the device and start again... */ 175 if (file->private_data) { 176 err = -EBUSY; 177 goto unlock; 178 } 179 180 if (copy_from_user(args, input, sizeof(args)) != 0) { 181 err = -EFAULT; 182 goto unlock; 183 } 184 185 lg = kzalloc(sizeof(*lg), GFP_KERNEL); 186 if (!lg) { 187 err = -ENOMEM; 188 goto unlock; 189 } 190 191 /* Populate the easy fields of our "struct lguest" */ 192 lg->mem_base = (void __user *)args[0]; 193 lg->pfn_limit = args[1]; 194 195 /* This is the first cpu (cpu 0) and it will start booting at args[3] */ 196 err = lg_cpu_start(&lg->cpus[0], 0, args[3]); 197 if (err) 198 goto release_guest; 199 200 /* Initialize the Guest's shadow page tables, using the toplevel 201 * address the Launcher gave us. This allocates memory, so can fail. */ 202 err = init_guest_pagetable(lg, args[2]); 203 if (err) 204 goto free_regs; 205 206 /* We keep our "struct lguest" in the file's private_data. */ 207 file->private_data = lg; 208 209 mutex_unlock(&lguest_lock); 210 211 /* And because this is a write() call, we return the length used. */ 212 return sizeof(args); 213 214free_regs: 215 /* FIXME: This should be in free_vcpu */ 216 free_page(lg->cpus[0].regs_page); 217release_guest: 218 kfree(lg); 219unlock: 220 mutex_unlock(&lguest_lock); 221 return err; 222} 223 224/*L:010 The first operation the Launcher does must be a write. All writes 225 * start with an unsigned long number: for the first write this must be 226 * LHREQ_INITIALIZE to set up the Guest. After that the Launcher can use 227 * writes of other values to send interrupts. 228 * 229 * Note that we overload the "offset" in the /dev/lguest file to indicate what 230 * CPU number we're dealing with. Currently this is always 0, since we only 231 * support uniprocessor Guests, but you can see the beginnings of SMP support 232 * here. */ 233static ssize_t write(struct file *file, const char __user *in, 234 size_t size, loff_t *off) 235{ 236 /* Once the Guest is initialized, we hold the "struct lguest" in the 237 * file private data. */ 238 struct lguest *lg = file->private_data; 239 const unsigned long __user *input = (const unsigned long __user *)in; 240 unsigned long req; 241 struct lg_cpu *uninitialized_var(cpu); 242 unsigned int cpu_id = *off; 243 244 /* The first value tells us what this request is. */ 245 if (get_user(req, input) != 0) 246 return -EFAULT; 247 input++; 248 249 /* If you haven't initialized, you must do that first. */ 250 if (req != LHREQ_INITIALIZE) { 251 if (!lg || (cpu_id >= lg->nr_cpus)) 252 return -EINVAL; 253 cpu = &lg->cpus[cpu_id]; 254 if (!cpu) 255 return -EINVAL; 256 257 /* Once the Guest is dead, you can only read() why it died. */ 258 if (lg->dead) 259 return -ENOENT; 260 261 /* If you're not the task which owns the Guest, all you can do 262 * is break the Launcher out of running the Guest. */ 263 if (current != cpu->tsk && req != LHREQ_BREAK) 264 return -EPERM; 265 } 266 267 switch (req) { 268 case LHREQ_INITIALIZE: 269 return initialize(file, input); 270 case LHREQ_IRQ: 271 return user_send_irq(cpu, input); 272 case LHREQ_BREAK: 273 return break_guest_out(cpu, input); 274 default: 275 return -EINVAL; 276 } 277} 278 279/*L:060 The final piece of interface code is the close() routine. It reverses 280 * everything done in initialize(). This is usually called because the 281 * Launcher exited. 282 * 283 * Note that the close routine returns 0 or a negative error number: it can't 284 * really fail, but it can whine. I blame Sun for this wart, and K&R C for 285 * letting them do it. :*/ 286static int close(struct inode *inode, struct file *file) 287{ 288 struct lguest *lg = file->private_data; 289 unsigned int i; 290 291 /* If we never successfully initialized, there's nothing to clean up */ 292 if (!lg) 293 return 0; 294 295 /* We need the big lock, to protect from inter-guest I/O and other 296 * Launchers initializing guests. */ 297 mutex_lock(&lguest_lock); 298 299 /* Free up the shadow page tables for the Guest. */ 300 free_guest_pagetable(lg); 301 302 for (i = 0; i < lg->nr_cpus; i++) { 303 /* Cancels the hrtimer set via LHCALL_SET_CLOCKEVENT. */ 304 hrtimer_cancel(&lg->cpus[i].hrt); 305 /* We can free up the register page we allocated. */ 306 free_page(lg->cpus[i].regs_page); 307 /* Now all the memory cleanups are done, it's safe to release 308 * the Launcher's memory management structure. */ 309 mmput(lg->cpus[i].mm); 310 } 311 /* If lg->dead doesn't contain an error code it will be NULL or a 312 * kmalloc()ed string, either of which is ok to hand to kfree(). */ 313 if (!IS_ERR(lg->dead)) 314 kfree(lg->dead); 315 /* We clear the entire structure, which also marks it as free for the 316 * next user. */ 317 memset(lg, 0, sizeof(*lg)); 318 /* Release lock and exit. */ 319 mutex_unlock(&lguest_lock); 320 321 return 0; 322} 323 324/*L:000 325 * Welcome to our journey through the Launcher! 326 * 327 * The Launcher is the Host userspace program which sets up, runs and services 328 * the Guest. In fact, many comments in the Drivers which refer to "the Host" 329 * doing things are inaccurate: the Launcher does all the device handling for 330 * the Guest, but the Guest can't know that. 331 * 332 * Just to confuse you: to the Host kernel, the Launcher *is* the Guest and we 333 * shall see more of that later. 334 * 335 * We begin our understanding with the Host kernel interface which the Launcher 336 * uses: reading and writing a character device called /dev/lguest. All the 337 * work happens in the read(), write() and close() routines: */ 338static struct file_operations lguest_fops = { 339 .owner = THIS_MODULE, 340 .release = close, 341 .write = write, 342 .read = read, 343}; 344 345/* This is a textbook example of a "misc" character device. Populate a "struct 346 * miscdevice" and register it with misc_register(). */ 347static struct miscdevice lguest_dev = { 348 .minor = MISC_DYNAMIC_MINOR, 349 .name = "lguest", 350 .fops = &lguest_fops, 351}; 352 353int __init lguest_device_init(void) 354{ 355 return misc_register(&lguest_dev); 356} 357 358void __exit lguest_device_remove(void) 359{ 360 misc_deregister(&lguest_dev); 361} 362