drivers/lguest/lguest_user.c

   1 /*P:200
   2  * This contains all the /dev/lguest code, whereby the userspace launcher
   3  * controls and communicates with the Guest.  For example, the first write will
   4  * tell us the Guest's memory layout, pagetable, entry point and kernel address
   5  * offset.  A read will run the Guest until something happens, such as a signal
   6  * or the Guest doing a NOTIFY out to the Launcher.
   7 :*/
   8 #include <linux/uaccess.h>
   9 #include <linux/miscdevice.h>
  10 #include <linux/fs.h>
  11 #include <linux/sched.h>
  12 #include <linux/eventfd.h>
  13 #include <linux/file.h>
  14 #include "lg.h"
  15
  16 bool send_notify_to_eventfd(struct lg_cpu *cpu)
  17 {
  18         unsigned int i;
  19         struct lg_eventfd_map *map;
  20
  21         /* lg->eventfds is RCU-protected */
  22         rcu_read_lock();
  23         map = rcu_dereference(cpu->lg->eventfds);
  24         for (i = 0; i < map->num; i++) {
  25                 if (map->map[i].addr == cpu->pending_notify) {
  26                         eventfd_signal(map->map[i].event, 1);
  27                         cpu->pending_notify = 0;
  28                         break;
  29                 }
  30         }
  31         rcu_read_unlock();
  32         return cpu->pending_notify == 0;
  33 }
  34
  35 static int add_eventfd(struct lguest *lg, unsigned long addr, int fd)
  36 {
  37         struct lg_eventfd_map *new, *old = lg->eventfds;
  38
  39         if (!addr)
  40                 return -EINVAL;
  41
  42         /*
  43          * Replace the old array with the new one, carefully: others can
  44          * be accessing it at the same time.
  45          */
  46         new = kmalloc(sizeof(*new) + sizeof(new->map[0]) * (old->num + 1),
  47                       GFP_KERNEL);
  48         if (!new)
  49                 return -ENOMEM;
  50
  51         /* First make identical copy. */
  52         memcpy(new->map, old->map, sizeof(old->map[0]) * old->num);
  53         new->num = old->num;
  54
  55         /* Now append new entry. */
  56         new->map[new->num].addr = addr;
  57         new->map[new->num].event = eventfd_ctx_fdget(fd);
  58         if (IS_ERR(new->map[new->num].event)) {
  59                 int err =  PTR_ERR(new->map[new->num].event);
  60                 kfree(new);
  61                 return err;
  62         }
  63         new->num++;
  64
  65         /* Now put new one in place. */
  66         rcu_assign_pointer(lg->eventfds, new);
  67
  68         /*
  69          * We're not in a big hurry.  Wait until noone's looking at old
  70          * version, then delete it.
  71          */
  72         synchronize_rcu();
  73         kfree(old);
  74
  75         return 0;
  76 }
  77
  78 static int attach_eventfd(struct lguest *lg, const unsigned long __user *input)
  79 {
  80         unsigned long addr, fd;
  81         int err;
  82
  83         if (get_user(addr, input) != 0)
  84                 return -EFAULT;
  85         input++;
  86         if (get_user(fd, input) != 0)
  87                 return -EFAULT;
  88
  89         mutex_lock(&lguest_lock);
  90         err = add_eventfd(lg, addr, fd);
  91         mutex_unlock(&lguest_lock);
  92
  93         return err;
  94 }
  95
  96 /*L:050
  97  * Sending an interrupt is done by writing LHREQ_IRQ and an interrupt
  98  * number to /dev/lguest.
  99  */
 100 static int user_send_irq(struct lg_cpu *cpu, const unsigned long __user *input)
 101 {
 102         unsigned long irq;
 103
 104         if (get_user(irq, input) != 0)
 105                 return -EFAULT;
 106         if (irq >= LGUEST_IRQS)
 107                 return -EINVAL;
 108
 109         set_interrupt(cpu, irq);
 110         return 0;
 111 }
 112
 113 /*L:040
 114  * Once our Guest is initialized, the Launcher makes it run by reading
 115  * from /dev/lguest.
 116  */
 117 static ssize_t read(struct file *file, char __user *user, size_t size,loff_t*o)
 118 {
 119         struct lguest *lg = file->private_data;
 120         struct lg_cpu *cpu;
 121         unsigned int cpu_id = *o;
 122
 123         /* You must write LHREQ_INITIALIZE first! */
 124         if (!lg)
 125                 return -EINVAL;
 126
 127         /* Watch out for arbitrary vcpu indexes! */
 128         if (cpu_id >= lg->nr_cpus)
 129                 return -EINVAL;
 130
 131         cpu = &lg->cpus[cpu_id];
 132
 133         /* If you're not the task which owns the Guest, go away. */
 134         if (current != cpu->tsk)
 135                 return -EPERM;
 136
 137         /* If the Guest is already dead, we indicate why */
 138         if (lg->dead) {
 139                 size_t len;
 140
 141                 /* lg->dead either contains an error code, or a string. */
 142                 if (IS_ERR(lg->dead))
 143                         return PTR_ERR(lg->dead);
 144
 145                 /* We can only return as much as the buffer they read with. */
 146                 len = min(size, strlen(lg->dead)+1);
 147                 if (copy_to_user(user, lg->dead, len) != 0)
 148                         return -EFAULT;
 149                 return len;
 150         }
 151
 152         /*
 153          * If we returned from read() last time because the Guest sent I/O,
 154          * clear the flag.
 155          */
 156         if (cpu->pending_notify)
 157                 cpu->pending_notify = 0;
 158
 159         /* Run the Guest until something interesting happens. */
 160         return run_guest(cpu, (unsigned long __user *)user);
 161 }
 162
 163 /*L:025
 164  * This actually initializes a CPU.  For the moment, a Guest is only
 165  * uniprocessor, so "id" is always 0.
 166  */
 167 static int lg_cpu_start(struct lg_cpu *cpu, unsigned id, unsigned long start_ip)
 168 {
 169         /* We have a limited number the number of CPUs in the lguest struct. */
 170         if (id >= ARRAY_SIZE(cpu->lg->cpus))
 171                 return -EINVAL;
 172
 173         /* Set up this CPU's id, and pointer back to the lguest struct. */
 174         cpu->id = id;
 175         cpu->lg = container_of((cpu - id), struct lguest, cpus[0]);
 176         cpu->lg->nr_cpus++;
 177
 178         /* Each CPU has a timer it can set. */
 179         init_clockdev(cpu);
 180
 181         /*
 182          * We need a complete page for the Guest registers: they are accessible
 183          * to the Guest and we can only grant it access to whole pages.
 184          */
 185         cpu->regs_page = get_zeroed_page(GFP_KERNEL);
 186         if (!cpu->regs_page)
 187                 return -ENOMEM;
 188
 189         /* We actually put the registers at the bottom of the page. */
 190         cpu->regs = (void *)cpu->regs_page + PAGE_SIZE - sizeof(*cpu->regs);
 191
 192         /*
 193          * Now we initialize the Guest's registers, handing it the start
 194          * address.
 195          */
 196         lguest_arch_setup_regs(cpu, start_ip);
 197
 198         /*
 199          * We keep a pointer to the Launcher task (ie. current task) for when
 200          * other Guests want to wake this one (eg. console input).
 201          */
 202         cpu->tsk = current;
 203
 204         /*
 205          * We need to keep a pointer to the Launcher's memory map, because if
 206          * the Launcher dies we need to clean it up.  If we don't keep a
 207          * reference, it is destroyed before close() is called.
 208          */
 209         cpu->mm = get_task_mm(cpu->tsk);
 210
 211         /*
 212          * We remember which CPU's pages this Guest used last, for optimization
 213          * when the same Guest runs on the same CPU twice.
 214          */
 215         cpu->last_pages = NULL;
 216
 217         /* No error == success. */
 218         return 0;
 219 }
 220
 221 /*L:020
 222  * The initialization write supplies 3 pointer sized (32 or 64 bit) values (in
 223  * addition to the LHREQ_INITIALIZE value).  These are:
 224  *
 225  * base: The start of the Guest-physical memory inside the Launcher memory.
 226  *
 227  * pfnlimit: The highest (Guest-physical) page number the Guest should be
 228  * allowed to access.  The Guest memory lives inside the Launcher, so it sets
 229  * this to ensure the Guest can only reach its own memory.
 230  *
 231  * start: The first instruction to execute ("eip" in x86-speak).
 232  */
 233 static int initialize(struct file *file, const unsigned long __user *input)
 234 {
 235         /* "struct lguest" contains all we (the Host) know about a Guest. */
 236         struct lguest *lg;
 237         int err;
 238         unsigned long args[3];
 239
 240         /*
 241          * We grab the Big Lguest lock, which protects against multiple
 242          * simultaneous initializations.
 243          */
 244         mutex_lock(&lguest_lock);
 245         /* You can't initialize twice!  Close the device and start again... */
 246         if (file->private_data) {
 247                 err = -EBUSY;
 248                 goto unlock;
 249         }
 250
 251         if (copy_from_user(args, input, sizeof(args)) != 0) {
 252                 err = -EFAULT;
 253                 goto unlock;
 254         }
 255
 256         lg = kzalloc(sizeof(*lg), GFP_KERNEL);
 257         if (!lg) {
 258                 err = -ENOMEM;
 259                 goto unlock;
 260         }
 261
 262         lg->eventfds = kmalloc(sizeof(*lg->eventfds), GFP_KERNEL);
 263         if (!lg->eventfds) {
 264                 err = -ENOMEM;
 265                 goto free_lg;
 266         }
 267         lg->eventfds->num = 0;
 268
 269         /* Populate the easy fields of our "struct lguest" */
 270         lg->mem_base = (void __user *)args[0];
 271         lg->pfn_limit = args[1];
 272
 273         /* This is the first cpu (cpu 0) and it will start booting at args[2] */
 274         err = lg_cpu_start(&lg->cpus[0], 0, args[2]);
 275         if (err)
 276                 goto free_eventfds;
 277
 278         /*
 279          * Initialize the Guest's shadow page tables, using the toplevel
 280          * address the Launcher gave us.  This allocates memory, so can fail.
 281          */
 282         err = init_guest_pagetable(lg);
 283         if (err)
 284                 goto free_regs;
 285
 286         /* We keep our "struct lguest" in the file's private_data. */
 287         file->private_data = lg;
 288
 289         mutex_unlock(&lguest_lock);
 290
 291         /* And because this is a write() call, we return the length used. */
 292         return sizeof(args);
 293
 294 free_regs:
 295         /* FIXME: This should be in free_vcpu */
 296         free_page(lg->cpus[0].regs_page);
 297 free_eventfds:
 298         kfree(lg->eventfds);
 299 free_lg:
 300         kfree(lg);
 301 unlock:
 302         mutex_unlock(&lguest_lock);
 303         return err;
 304 }
 305
 306 /*L:010
 307  * The first operation the Launcher does must be a write.  All writes
 308  * start with an unsigned long number: for the first write this must be
 309  * LHREQ_INITIALIZE to set up the Guest.  After that the Launcher can use
 310  * writes of other values to send interrupts.
 311  *
 312  * Note that we overload the "offset" in the /dev/lguest file to indicate what
 313  * CPU number we're dealing with.  Currently this is always 0, since we only
 314  * support uniprocessor Guests, but you can see the beginnings of SMP support
 315  * here.
 316  */
 317 static ssize_t write(struct file *file, const char __user *in,
 318                      size_t size, loff_t *off)
 319 {
 320         /*
 321          * Once the Guest is initialized, we hold the "struct lguest" in the
 322          * file private data.
 323          */
 324         struct lguest *lg = file->private_data;
 325         const unsigned long __user *input = (const unsigned long __user *)in;
 326         unsigned long req;
 327         struct lg_cpu *uninitialized_var(cpu);
 328         unsigned int cpu_id = *off;
 329
 330         /* The first value tells us what this request is. */
 331         if (get_user(req, input) != 0)
 332                 return -EFAULT;
 333         input++;
 334
 335         /* If you haven't initialized, you must do that first. */
 336         if (req != LHREQ_INITIALIZE) {
 337                 if (!lg || (cpu_id >= lg->nr_cpus))
 338                         return -EINVAL;
 339                 cpu = &lg->cpus[cpu_id];
 340
 341                 /* Once the Guest is dead, you can only read() why it died. */
 342                 if (lg->dead)
 343                         return -ENOENT;
 344         }
 345
 346         switch (req) {
 347         case LHREQ_INITIALIZE:
 348                 return initialize(file, input);
 349         case LHREQ_IRQ:
 350                 return user_send_irq(cpu, input);
 351         case LHREQ_EVENTFD:
 352                 return attach_eventfd(lg, input);
 353         default:
 354                 return -EINVAL;
 355         }
 356 }
 357
 358 /*L:060
 359  * The final piece of interface code is the close() routine.  It reverses
 360  * everything done in initialize().  This is usually called because the
 361  * Launcher exited.
 362  *
 363  * Note that the close routine returns 0 or a negative error number: it can't
 364  * really fail, but it can whine.  I blame Sun for this wart, and K&R C for
 365  * letting them do it.
 366 :*/
 367 static int close(struct inode *inode, struct file *file)
 368 {
 369         struct lguest *lg = file->private_data;
 370         unsigned int i;
 371
 372         /* If we never successfully initialized, there's nothing to clean up */
 373         if (!lg)
 374                 return 0;
 375
 376         /*
 377          * We need the big lock, to protect from inter-guest I/O and other
 378          * Launchers initializing guests.
 379          */
 380         mutex_lock(&lguest_lock);
 381
 382         /* Free up the shadow page tables for the Guest. */
 383         free_guest_pagetable(lg);
 384
 385         for (i = 0; i < lg->nr_cpus; i++) {
 386                 /* Cancels the hrtimer set via LHCALL_SET_CLOCKEVENT. */
 387                 hrtimer_cancel(&lg->cpus[i].hrt);
 388                 /* We can free up the register page we allocated. */
 389                 free_page(lg->cpus[i].regs_page);
 390                 /*
 391                  * Now all the memory cleanups are done, it's safe to release
 392                  * the Launcher's memory management structure.
 393                  */
 394                 mmput(lg->cpus[i].mm);
 395         }
 396
 397         /* Release any eventfds they registered. */
 398         for (i = 0; i < lg->eventfds->num; i++)
 399                 eventfd_ctx_put(lg->eventfds->map[i].event);
 400         kfree(lg->eventfds);
 401
 402         /*
 403          * If lg->dead doesn't contain an error code it will be NULL or a
 404          * kmalloc()ed string, either of which is ok to hand to kfree().
 405          */
 406         if (!IS_ERR(lg->dead))
 407                 kfree(lg->dead);
 408         /* Free the memory allocated to the lguest_struct */
 409         kfree(lg);
 410         /* Release lock and exit. */
 411         mutex_unlock(&lguest_lock);
 412
 413         return 0;
 414 }
 415
 416 /*L:000
 417  * Welcome to our journey through the Launcher!
 418  *
 419  * The Launcher is the Host userspace program which sets up, runs and services
 420  * the Guest.  In fact, many comments in the Drivers which refer to "the Host"
 421  * doing things are inaccurate: the Launcher does all the device handling for
 422  * the Guest, but the Guest can't know that.
 423  *
 424  * Just to confuse you: to the Host kernel, the Launcher *is* the Guest and we
 425  * shall see more of that later.
 426  *
 427  * We begin our understanding with the Host kernel interface which the Launcher
 428  * uses: reading and writing a character device called /dev/lguest.  All the
 429  * work happens in the read(), write() and close() routines:
 430  */
 431 static struct file_operations lguest_fops = {
 432         .owner   = THIS_MODULE,
 433         .release = close,
 434         .write   = write,
 435         .read    = read,
 436 };
 437
 438 /*
 439  * This is a textbook example of a "misc" character device.  Populate a "struct
 440  * miscdevice" and register it with misc_register().
 441  */
 442 static struct miscdevice lguest_dev = {
 443         .minor  = MISC_DYNAMIC_MINOR,
 444         .name   = "lguest",
 445         .fops   = &lguest_fops,
 446 };
 447
 448 int __init lguest_device_init(void)
 449 {
 450         return misc_register(&lguest_dev);
 451 }
 452
 453 void __exit lguest_device_remove(void)
 454 {
 455         misc_deregister(&lguest_dev);
 456 }