drivers/lguest/lguest_user.c

   1 /*P:200 This contains all the /dev/lguest code, whereby the userspace
   2  * launcher controls and communicates with the Guest.  For example,
   3  * the first write will tell us the Guest's memory layout and entry
   4  * point.  A read will run the Guest until something happens, such as
   5  * a signal or the Guest accessing a device.
   6 :*/
   7 #include <linux/uaccess.h>
   8 #include <linux/miscdevice.h>
   9 #include <linux/fs.h>
  10 #include <linux/sched.h>
  11 #include <linux/sched/mm.h>
  12 #include <linux/file.h>
  13 #include <linux/slab.h>
  14 #include <linux/export.h>
  15 #include "lg.h"
  16
  17 /*L:052
  18   The Launcher can get the registers, and also set some of them.
  19 */
  20 static int getreg_setup(struct lg_cpu *cpu, const unsigned long __user *input)
  21 {
  22         unsigned long which;
  23
  24         /* We re-use the ptrace structure to specify which register to read. */
  25         if (get_user(which, input) != 0)
  26                 return -EFAULT;
  27
  28         /*
  29          * We set up the cpu register pointer, and their next read will
  30          * actually get the value (instead of running the guest).
  31          *
  32          * The last argument 'true' says we can access any register.
  33          */
  34         cpu->reg_read = lguest_arch_regptr(cpu, which, true);
  35         if (!cpu->reg_read)
  36                 return -ENOENT;
  37
  38         /* And because this is a write() call, we return the length used. */
  39         return sizeof(unsigned long) * 2;
  40 }
  41
  42 static int setreg(struct lg_cpu *cpu, const unsigned long __user *input)
  43 {
  44         unsigned long which, value, *reg;
  45
  46         /* We re-use the ptrace structure to specify which register to read. */
  47         if (get_user(which, input) != 0)
  48                 return -EFAULT;
  49         input++;
  50         if (get_user(value, input) != 0)
  51                 return -EFAULT;
  52
  53         /* The last argument 'false' means we can't access all registers. */
  54         reg = lguest_arch_regptr(cpu, which, false);
  55         if (!reg)
  56                 return -ENOENT;
  57
  58         *reg = value;
  59
  60         /* And because this is a write() call, we return the length used. */
  61         return sizeof(unsigned long) * 3;
  62 }
  63
  64 /*L:050
  65  * Sending an interrupt is done by writing LHREQ_IRQ and an interrupt
  66  * number to /dev/lguest.
  67  */
  68 static int user_send_irq(struct lg_cpu *cpu, const unsigned long __user *input)
  69 {
  70         unsigned long irq;
  71
  72         if (get_user(irq, input) != 0)
  73                 return -EFAULT;
  74         if (irq >= LGUEST_IRQS)
  75                 return -EINVAL;
  76
  77         /*
  78          * Next time the Guest runs, the core code will see if it can deliver
  79          * this interrupt.
  80          */
  81         set_interrupt(cpu, irq);
  82         return 0;
  83 }
  84
  85 /*L:053
  86  * Deliver a trap: this is used by the Launcher if it can't emulate
  87  * an instruction.
  88  */
  89 static int trap(struct lg_cpu *cpu, const unsigned long __user *input)
  90 {
  91         unsigned long trapnum;
  92
  93         if (get_user(trapnum, input) != 0)
  94                 return -EFAULT;
  95
  96         if (!deliver_trap(cpu, trapnum))
  97                 return -EINVAL;
  98
  99         return 0;
 100 }
 101
 102 /*L:040
 103  * Once our Guest is initialized, the Launcher makes it run by reading
 104  * from /dev/lguest.
 105  */
 106 static ssize_t read(struct file *file, char __user *user, size_t size,loff_t*o)
 107 {
 108         struct lguest *lg = file->private_data;
 109         struct lg_cpu *cpu;
 110         unsigned int cpu_id = *o;
 111
 112         /* You must write LHREQ_INITIALIZE first! */
 113         if (!lg)
 114                 return -EINVAL;
 115
 116         /* Watch out for arbitrary vcpu indexes! */
 117         if (cpu_id >= lg->nr_cpus)
 118                 return -EINVAL;
 119
 120         cpu = &lg->cpus[cpu_id];
 121
 122         /* If you're not the task which owns the Guest, go away. */
 123         if (current != cpu->tsk)
 124                 return -EPERM;
 125
 126         /* If the Guest is already dead, we indicate why */
 127         if (lg->dead) {
 128                 size_t len;
 129
 130                 /* lg->dead either contains an error code, or a string. */
 131                 if (IS_ERR(lg->dead))
 132                         return PTR_ERR(lg->dead);
 133
 134                 /* We can only return as much as the buffer they read with. */
 135                 len = min(size, strlen(lg->dead)+1);
 136                 if (copy_to_user(user, lg->dead, len) != 0)
 137                         return -EFAULT;
 138                 return len;
 139         }
 140
 141         /*
 142          * If we returned from read() last time because the Guest sent I/O,
 143          * clear the flag.
 144          */
 145         if (cpu->pending.trap)
 146                 cpu->pending.trap = 0;
 147
 148         /* Run the Guest until something interesting happens. */
 149         return run_guest(cpu, (unsigned long __user *)user);
 150 }
 151
 152 /*L:025
 153  * This actually initializes a CPU.  For the moment, a Guest is only
 154  * uniprocessor, so "id" is always 0.
 155  */
 156 static int lg_cpu_start(struct lg_cpu *cpu, unsigned id, unsigned long start_ip)
 157 {
 158         /* We have a limited number of CPUs in the lguest struct. */
 159         if (id >= ARRAY_SIZE(cpu->lg->cpus))
 160                 return -EINVAL;
 161
 162         /* Set up this CPU's id, and pointer back to the lguest struct. */
 163         cpu->id = id;
 164         cpu->lg = container_of(cpu, struct lguest, cpus[id]);
 165         cpu->lg->nr_cpus++;
 166
 167         /* Each CPU has a timer it can set. */
 168         init_clockdev(cpu);
 169
 170         /*
 171          * We need a complete page for the Guest registers: they are accessible
 172          * to the Guest and we can only grant it access to whole pages.
 173          */
 174         cpu->regs_page = get_zeroed_page(GFP_KERNEL);
 175         if (!cpu->regs_page)
 176                 return -ENOMEM;
 177
 178         /* We actually put the registers at the end of the page. */
 179         cpu->regs = (void *)cpu->regs_page + PAGE_SIZE - sizeof(*cpu->regs);
 180
 181         /*
 182          * Now we initialize the Guest's registers, handing it the start
 183          * address.
 184          */
 185         lguest_arch_setup_regs(cpu, start_ip);
 186
 187         /*
 188          * We keep a pointer to the Launcher task (ie. current task) for when
 189          * other Guests want to wake this one (eg. console input).
 190          */
 191         cpu->tsk = current;
 192
 193         /*
 194          * We need to keep a pointer to the Launcher's memory map, because if
 195          * the Launcher dies we need to clean it up.  If we don't keep a
 196          * reference, it is destroyed before close() is called.
 197          */
 198         cpu->mm = get_task_mm(cpu->tsk);
 199
 200         /*
 201          * We remember which CPU's pages this Guest used last, for optimization
 202          * when the same Guest runs on the same CPU twice.
 203          */
 204         cpu->last_pages = NULL;
 205
 206         /* No error == success. */
 207         return 0;
 208 }
 209
 210 /*L:020
 211  * The initialization write supplies 3 pointer sized (32 or 64 bit) values (in
 212  * addition to the LHREQ_INITIALIZE value).  These are:
 213  *
 214  * base: The start of the Guest-physical memory inside the Launcher memory.
 215  *
 216  * pfnlimit: The highest (Guest-physical) page number the Guest should be
 217  * allowed to access.  The Guest memory lives inside the Launcher, so it sets
 218  * this to ensure the Guest can only reach its own memory.
 219  *
 220  * start: The first instruction to execute ("eip" in x86-speak).
 221  */
 222 static int initialize(struct file *file, const unsigned long __user *input)
 223 {
 224         /* "struct lguest" contains all we (the Host) know about a Guest. */
 225         struct lguest *lg;
 226         int err;
 227         unsigned long args[4];
 228
 229         /*
 230          * We grab the Big Lguest lock, which protects against multiple
 231          * simultaneous initializations.
 232          */
 233         mutex_lock(&lguest_lock);
 234         /* You can't initialize twice!  Close the device and start again... */
 235         if (file->private_data) {
 236                 err = -EBUSY;
 237                 goto unlock;
 238         }
 239
 240         if (copy_from_user(args, input, sizeof(args)) != 0) {
 241                 err = -EFAULT;
 242                 goto unlock;
 243         }
 244
 245         lg = kzalloc(sizeof(*lg), GFP_KERNEL);
 246         if (!lg) {
 247                 err = -ENOMEM;
 248                 goto unlock;
 249         }
 250
 251         /* Populate the easy fields of our "struct lguest" */
 252         lg->mem_base = (void __user *)args[0];
 253         lg->pfn_limit = args[1];
 254         lg->device_limit = args[3];
 255
 256         /* This is the first cpu (cpu 0) and it will start booting at args[2] */
 257         err = lg_cpu_start(&lg->cpus[0], 0, args[2]);
 258         if (err)
 259                 goto free_lg;
 260
 261         /*
 262          * Initialize the Guest's shadow page tables.  This allocates
 263          * memory, so can fail.
 264          */
 265         err = init_guest_pagetable(lg);
 266         if (err)
 267                 goto free_regs;
 268
 269         /* We keep our "struct lguest" in the file's private_data. */
 270         file->private_data = lg;
 271
 272         mutex_unlock(&lguest_lock);
 273
 274         /* And because this is a write() call, we return the length used. */
 275         return sizeof(args);
 276
 277 free_regs:
 278         /* FIXME: This should be in free_vcpu */
 279         free_page(lg->cpus[0].regs_page);
 280 free_lg:
 281         kfree(lg);
 282 unlock:
 283         mutex_unlock(&lguest_lock);
 284         return err;
 285 }
 286
 287 /*L:010
 288  * The first operation the Launcher does must be a write.  All writes
 289  * start with an unsigned long number: for the first write this must be
 290  * LHREQ_INITIALIZE to set up the Guest.  After that the Launcher can use
 291  * writes of other values to send interrupts or set up receipt of notifications.
 292  *
 293  * Note that we overload the "offset" in the /dev/lguest file to indicate what
 294  * CPU number we're dealing with.  Currently this is always 0 since we only
 295  * support uniprocessor Guests, but you can see the beginnings of SMP support
 296  * here.
 297  */
 298 static ssize_t write(struct file *file, const char __user *in,
 299                      size_t size, loff_t *off)
 300 {
 301         /*
 302          * Once the Guest is initialized, we hold the "struct lguest" in the
 303          * file private data.
 304          */
 305         struct lguest *lg = file->private_data;
 306         const unsigned long __user *input = (const unsigned long __user *)in;
 307         unsigned long req;
 308         struct lg_cpu *uninitialized_var(cpu);
 309         unsigned int cpu_id = *off;
 310
 311         /* The first value tells us what this request is. */
 312         if (get_user(req, input) != 0)
 313                 return -EFAULT;
 314         input++;
 315
 316         /* If you haven't initialized, you must do that first. */
 317         if (req != LHREQ_INITIALIZE) {
 318                 if (!lg || (cpu_id >= lg->nr_cpus))
 319                         return -EINVAL;
 320                 cpu = &lg->cpus[cpu_id];
 321
 322                 /* Once the Guest is dead, you can only read() why it died. */
 323                 if (lg->dead)
 324                         return -ENOENT;
 325         }
 326
 327         switch (req) {
 328         case LHREQ_INITIALIZE:
 329                 return initialize(file, input);
 330         case LHREQ_IRQ:
 331                 return user_send_irq(cpu, input);
 332         case LHREQ_GETREG:
 333                 return getreg_setup(cpu, input);
 334         case LHREQ_SETREG:
 335                 return setreg(cpu, input);
 336         case LHREQ_TRAP:
 337                 return trap(cpu, input);
 338         default:
 339                 return -EINVAL;
 340         }
 341 }
 342
 343 static int open(struct inode *inode, struct file *file)
 344 {
 345         file->private_data = NULL;
 346
 347         return 0;
 348 }
 349
 350 /*L:060
 351  * The final piece of interface code is the close() routine.  It reverses
 352  * everything done in initialize().  This is usually called because the
 353  * Launcher exited.
 354  *
 355  * Note that the close routine returns 0 or a negative error number: it can't
 356  * really fail, but it can whine.  I blame Sun for this wart, and K&R C for
 357  * letting them do it.
 358 :*/
 359 static int close(struct inode *inode, struct file *file)
 360 {
 361         struct lguest *lg = file->private_data;
 362         unsigned int i;
 363
 364         /* If we never successfully initialized, there's nothing to clean up */
 365         if (!lg)
 366                 return 0;
 367
 368         /*
 369          * We need the big lock, to protect from inter-guest I/O and other
 370          * Launchers initializing guests.
 371          */
 372         mutex_lock(&lguest_lock);
 373
 374         /* Free up the shadow page tables for the Guest. */
 375         free_guest_pagetable(lg);
 376
 377         for (i = 0; i < lg->nr_cpus; i++) {
 378                 /* Cancels the hrtimer set via LHCALL_SET_CLOCKEVENT. */
 379                 hrtimer_cancel(&lg->cpus[i].hrt);
 380                 /* We can free up the register page we allocated. */
 381                 free_page(lg->cpus[i].regs_page);
 382                 /*
 383                  * Now all the memory cleanups are done, it's safe to release
 384                  * the Launcher's memory management structure.
 385                  */
 386                 mmput(lg->cpus[i].mm);
 387         }
 388
 389         /*
 390          * If lg->dead doesn't contain an error code it will be NULL or a
 391          * kmalloc()ed string, either of which is ok to hand to kfree().
 392          */
 393         if (!IS_ERR(lg->dead))
 394                 kfree(lg->dead);
 395         /* Free the memory allocated to the lguest_struct */
 396         kfree(lg);
 397         /* Release lock and exit. */
 398         mutex_unlock(&lguest_lock);
 399
 400         return 0;
 401 }
 402
 403 /*L:000
 404  * Welcome to our journey through the Launcher!
 405  *
 406  * The Launcher is the Host userspace program which sets up, runs and services
 407  * the Guest.  In fact, many comments in the Drivers which refer to "the Host"
 408  * doing things are inaccurate: the Launcher does all the device handling for
 409  * the Guest, but the Guest can't know that.
 410  *
 411  * Just to confuse you: to the Host kernel, the Launcher *is* the Guest and we
 412  * shall see more of that later.
 413  *
 414  * We begin our understanding with the Host kernel interface which the Launcher
 415  * uses: reading and writing a character device called /dev/lguest.  All the
 416  * work happens in the read(), write() and close() routines:
 417  */
 418 static const struct file_operations lguest_fops = {
 419         .owner   = THIS_MODULE,
 420         .open    = open,
 421         .release = close,
 422         .write   = write,
 423         .read    = read,
 424         .llseek  = default_llseek,
 425 };
 426 /*:*/
 427
 428 /*
 429  * This is a textbook example of a "misc" character device.  Populate a "struct
 430  * miscdevice" and register it with misc_register().
 431  */
 432 static struct miscdevice lguest_dev = {
 433         .minor  = MISC_DYNAMIC_MINOR,
 434         .name   = "lguest",
 435         .fops   = &lguest_fops,
 436 };
 437
 438 int __init lguest_device_init(void)
 439 {
 440         return misc_register(&lguest_dev);
 441 }
 442
 443 void __exit lguest_device_remove(void)
 444 {
 445         misc_deregister(&lguest_dev);
 446 }