Chinaunix首页 | 论坛 | 博客
  • 博客访问: 7116226
  • 博文数量: 3857
  • 博客积分: 6409
  • 博客等级: 准将
  • 技术积分: 15948
  • 用 户 组: 普通用户
  • 注册时间: 2008-09-02 16:48
个人简介

迷彩 潜伏 隐蔽 伪装

文章分类

全部博文(3857)

文章存档

2017年(5)

2016年(63)

2015年(927)

2014年(677)

2013年(807)

2012年(1241)

2011年(67)

2010年(7)

2009年(36)

2008年(28)

分类: LINUX

2014-08-15 08:02:31

1、基本原理
如之前分析,kvm虚拟机实际运行于qemu-kvm的进程上下文中,因此,需要建立虚拟机的物理内存空间(GPA)与qemu-kvm进程的虚拟地址空间(HVA)的映射关系。
虚拟机的物理地址空间实际也是不连续的,分成不同的内存区域(slot),因为物理地址空间中通常还包括BIOS、MMIO、显存、ISA保留等部分。

qemu-kvm通过ioctl vm指令KVM_SET_USER_MEMORY_REGION来为虚拟机设置内存。主要建立guest物理地址空间中的内存区域与qemu-kvm虚拟地址空间中的内存区域的映射,从而建立其从GVA到HVA的对应关系,该对应关系主要通过kvm_mem_slot结构体保存,所以实质为设置kvm_mem_slot结构体
本文简介ioctl vm指令KVM_SET_USER_MEMORY_REGION在内核中的执行流程,qemu-kvm用户态部分暂不包括。

2、基本流程
ioctl vm指令KVM_SET_USER_MEMORY_REGION在内核主要执行流程如下:
kvm_vm_ioctl()
    kvm_vm_ioctl_set_memory_region()
        kvm_set_memory_region()
            __kvm_set_memory_region()
                kvm_iommu_unmap_pages() // 原来的slot需要删除,所以需要unmap掉相应的内存区域
                install_new_memslots() //将new分配的memslot写入kvm->memslots[]数组中
                kvm_free_physmem_slot() // 释放旧内存区域相应的物理内存(HPA)

3、代码分析
kvm_mem_slot结构

点击(此处)折叠或打开

  1. /*
  2.   * 由于GPA不能直接用于物理 MMU 进行寻址,所以需要将GPA转换为HVA,
  3.   * kvm中利用 kvm_memory_slot 数据结构来记录每一个地址区间(Guest中的物理
  4.   * 地址区间)中GPA与HVA的映射关系
  5.   */
  6. struct kvm_memory_slot {
  7.     // 虚拟机物理地址(即GPA)对应的页框号
  8.     gfn_t base_gfn;
  9.     // 当前slot中包含的page数
  10.     unsigned long npages;
  11.     // 脏页位图
  12.     unsigned long *dirty_bitmap;
  13.     // 架构相关的部分
  14.     struct kvm_arch_memory_slot arch;
  15.     /*
  16.      * GPA对应的Host虚拟地址(HVA),由于虚拟机都运行在qemu的地址空间中
  17.      * 而qemu是用户态程序,所以通常使用根模式下用户地址空间。
  18.      */
  19.     unsigned long userspace_addr;
  20.     u32 flags;
  21.     short id;
  22. };

kvm_vm_ioctl()
:

点击(此处)折叠或打开

  1. /*
  2.   * kvm ioctl vm指令的入口,传入的fd为KVM_CREATE_VM中返回的fd。
  3.   * 主要用于针对VM虚拟机进行控制,如:内存设置、创建VCPU等。
  4.   */
  5. static long kvm_vm_ioctl(struct file *filp,
  6.              unsigned int ioctl, unsigned long arg)
  7. {
  8.     struct kvm *kvm = filp->private_data;
  9.     void __user *argp = (void __user *)arg;
  10.     int r;

  11.     if (kvm->mm != current->mm)
  12.         return -EIO;
  13.     switch (ioctl) {
  14.     // 创建VCPU
  15.     case KVM_CREATE_VCPU:
  16.         r = kvm_vm_ioctl_create_vcpu(kvm, arg);
  17.         break;
  18.     // 建立guest物理地址空间中的内存区域与qemu-kvm虚拟地址空间中的内存区域的映射
  19.     case KVM_SET_USER_MEMORY_REGION: {
  20.         // 存放内存区域信息的结构体,该内存区域从qemu-kvm进程的用户地址空间中分配
  21.         struct kvm_userspace_memory_region kvm_userspace_mem;

  22.         r = -EFAULT;
  23.         // 从用户态拷贝相应数据到内核态,入参argp指向用户态地址
  24.         if (copy_from_user(&kvm_userspace_mem, argp,
  25.                         sizeof kvm_userspace_mem))
  26.             goto out;
  27.         // 进入实际处理流程
  28.         r = kvm_vm_ioctl_set_memory_region(kvm, &kvm_userspace_mem);
  29.         break;
  30.     }
  31. ...

kvm_vm_ioctl()-->kvm_vm_ioctl_set_memory_region()-->kvm_set_memory_region()-->__kvm_set_memory_region()

点击(此处)折叠或打开

  1. /*
  2.   * 建立guest物理地址空间中的内存区域与qemu-kvm虚拟地址空间中的内存区域的映射
  3.   * 相应信息由uerspace_memory_region参数传入,而其源头来自于用户态qemu-kvm。每次
  4.   * 调用设置一个内存区间。内存区域可以不连续(实际的物理内存区域也经常不连
  5.   * 续,因为有可能有保留内存)
  6.   */
  7. int __kvm_set_memory_region(struct kvm *kvm,
  8.              struct kvm_userspace_memory_region *mem)
  9. {
  10.     int r;
  11.     gfn_t base_gfn;
  12.     unsigned long npages;
  13.     struct kvm_memory_slot *slot;
  14.     struct kvm_memory_slot old, new;
  15.     struct kvm_memslots *slots = NULL, *old_memslots;
  16.     enum kvm_mr_change change;

  17.     // 标记检查
  18.     r = check_memory_region_flags(mem);
  19.     if (r)
  20.         goto out;

  21.     r = -EINVAL;
  22.     /* General sanity checks */
  23.     // 合规检查,防止用户态恶意传参,导致安全漏洞
  24.     if (mem->memory_size & (PAGE_SIZE - 1))
  25.         goto out;
  26.     if (mem->guest_phys_addr & (PAGE_SIZE - 1))
  27.         goto out;
  28.     /* We can read the guest memory with __xxx_user() later on. */
  29.     if ((mem->slot < KVM_USER_MEM_SLOTS) &&
  30.      ((mem->userspace_addr & (PAGE_SIZE - 1)) ||
  31.      !access_ok(VERIFY_WRITE,
  32.             (void __user *)(unsigned long)mem->userspace_addr,
  33.             mem->memory_size)))
  34.         goto out;
  35.     if (mem->slot >= KVM_MEM_SLOTS_NUM)
  36.         goto out;
  37.     if (mem->guest_phys_addr + mem->memory_size < mem->guest_phys_addr)
  38.         goto out;
  39.     // 将kvm_userspace_memory_region->slot转换为kvm_mem_slot结构,该结构从kvm->memslots获取
  40.     slot = id_to_memslot(kvm->memslots, mem->slot);
  41.     // 内存区域起始位置在Guest物理地址空间中的页框号
  42.     base_gfn = mem->guest_phys_addr >> PAGE_SHIFT;
  43.     // 内存区域大小转换为page单位
  44.     npages = mem->memory_size >> PAGE_SHIFT;

  45.     r = -EINVAL;
  46.     if (npages > KVM_MEM_MAX_NR_PAGES)
  47.         goto out;

  48.     if (!npages)
  49.         mem->flags &= ~KVM_MEM_LOG_DIRTY_PAGES;

  50.     new = old = *slot;

  51.     new.id = mem->slot;
  52.     new.base_gfn = base_gfn;
  53.     new.npages = npages;
  54.     new.flags = mem->flags;

  55.     r = -EINVAL;
  56.     if (npages) {
  57.         // 判断是否需新创建内存区域
  58.         if (!old.npages)
  59.             change = KVM_MR_CREATE;
  60.         // 判断是否修改现有的内存区域
  61.         else { /* Modify an existing slot. */
  62.             // 修改的区域的HVA不同或者大小不同或者flag中的
  63.             // KVM_MEM_READONLY标记不同,直接退出。
  64.             if ((mem->userspace_addr != old.userspace_addr) ||
  65.              (npages != old.npages) ||
  66.              ((new.flags ^ old.flags) & KVM_MEM_READONLY))
  67.                 goto out;
  68.             /*
  69.              * 走到这,说明被修改的区域HVA和大小都是相同的
  70.              * 判断区域起始的GFN是否相同,如果是,则说明需
  71.              * 要在Guest物理地址空间中move这段区域,设置KVM_MR_MOVE标记
  72.              */
  73.             if (base_gfn != old.base_gfn)
  74.                 change = KVM_MR_MOVE;
  75.             // 如果仅仅是flag不同,则仅修改标记,设置KVM_MR_FLAGS_ONLY标记
  76.             else if (new.flags != old.flags)
  77.                 change = KVM_MR_FLAGS_ONLY;
  78.             // 否则,啥也不干
  79.             else { /* Nothing to change. */
  80.                 r = 0;
  81.                 goto out;
  82.             }
  83.         }
  84.     } else if (old.npages) {/*如果新设置的区域大小为0,而老的区域大小不为0,则表示需要删除原有区域。*/
  85.         change = KVM_MR_DELETE;
  86.     } else /* Modify a non-existent slot: disallowed. */
  87.         goto out;

  88.     if ((change == KVM_MR_CREATE) || (change == KVM_MR_MOVE)) {
  89.         /* Check for overlaps */
  90.         r = -EEXIST;
  91.         // 检查现有区域中是否重叠的
  92.         kvm_for_each_memslot(slot, kvm->memslots) {
  93.             if ((slot->id >= KVM_USER_MEM_SLOTS) ||
  94.              (slot->id == mem->slot))
  95.                 continue;
  96.             if (!((base_gfn + npages <= slot->base_gfn) ||
  97.              (base_gfn >= slot->base_gfn + slot->npages)))
  98.                 goto out;
  99.         }
  100.     }

  101.     /* Free page dirty bitmap if unneeded */
  102.     if (!(new.flags & KVM_MEM_LOG_DIRTY_PAGES))
  103.         new.dirty_bitmap = NULL;

  104.     r = -ENOMEM;
  105.     // 如果需要创建新区域
  106.     if (change == KVM_MR_CREATE) {
  107.         new.userspace_addr = mem->userspace_addr;
  108.         // 设置新的内存区域架构相关部分
  109.         if (kvm_arch_create_memslot(&new, npages))
  110.             goto out_free;
  111.     }

  112.     /* Allocate page dirty bitmap if needed */
  113.     if ((new.flags & KVM_MEM_LOG_DIRTY_PAGES) && !new.dirty_bitmap) {
  114.         if (kvm_create_dirty_bitmap(&new) < 0)
  115.             goto out_free;
  116.     }
  117.     // 如果删除或move内存区域
  118.     if ((change == KVM_MR_DELETE) || (change == KVM_MR_MOVE)) {
  119.         r = -ENOMEM;
  120.         // 复制kvm->memslots的副本
  121.         slots = kmemdup(kvm->memslots, sizeof(struct kvm_memslots),
  122.                 GFP_KERNEL);
  123.         if (!slots)
  124.             goto out_free;
  125.         slot = id_to_memslot(slots, mem->slot);
  126.         slot->flags |= KVM_MEMSLOT_INVALID;
  127.         // 安装新memslots,返回旧的memslots
  128.         old_memslots = install_new_memslots(kvm, slots, NULL);

  129.         /* slot was deleted or moved, clear iommu mapping */
  130.         // 原来的slot需要删除,所以需要unmap掉相应的内存区域
  131.         kvm_iommu_unmap_pages(kvm, &old);
  132.         /* From this point no new shadow pages pointing to a deleted,
  133.          * or moved, memslot will be created.
  134.          *
  135.          * validation of sp->gfn happens in:
  136.          *     - gfn_to_hva (kvm_read_guest, gfn_to_pfn)
  137.          *     - kvm_is_visible_gfn (mmu_check_roots)
  138.          */
  139.         // flush影子页表中的条目
  140.         kvm_arch_flush_shadow_memslot(kvm, slot);
  141.         slots = old_memslots;
  142.     }
  143.     // 处理private memory slots,对其分配用户态地址,即HVA
  144.     r = kvm_arch_prepare_memory_region(kvm, &new, mem, change);
  145.     if (r)
  146.         goto out_slots;

  147.     r = -ENOMEM;
  148.     /*
  149.      * We can re-use the old_memslots from above, the only difference
  150.      * from the currently installed memslots is the invalid flag. This
  151.      * will get overwritten by update_memslots anyway.
  152.      */
  153.     if (!slots) {
  154.         slots = kmemdup(kvm->memslots, sizeof(struct kvm_memslots),
  155.                 GFP_KERNEL);
  156.         if (!slots)
  157.             goto out_free;
  158.     }

  159.     /*
  160.      * IOMMU mapping: New slots need to be mapped. Old slots need to be
  161.      * un-mapped and re-mapped if their base changes. Since base change
  162.      * unmapping is handled above with slot deletion, mapping alone is
  163.      * needed here. Anything else the iommu might care about for existing
  164.      * slots (size changes, userspace addr changes and read-only flag
  165.      * changes) is disallowed above, so any other attribute changes getting
  166.      * here can be skipped.
  167.      */
  168.     if ((change == KVM_MR_CREATE) || (change == KVM_MR_MOVE)) {
  169.         r = kvm_iommu_map_pages(kvm, &new);
  170.         if (r)
  171.             goto out_slots;
  172.     }

  173.     /* actual memory is freed via old in kvm_free_physmem_slot below */
  174.     if (change == KVM_MR_DELETE) {
  175.         new.dirty_bitmap = NULL;
  176.         memset(&new.arch, 0, sizeof(new.arch));
  177.     }
  178.     //将new分配的memslot写入kvm->memslots[]数组中
  179.     old_memslots = install_new_memslots(kvm, slots, &new);

  180.     kvm_arch_commit_memory_region(kvm, mem, &old, change);
  181.     // 释放旧内存区域相应的物理内存(HPA)
  182.     kvm_free_physmem_slot(&old, &new);
  183.     kfree(old_memslots);

  184.     return 0;

  185. out_slots:
  186.     kfree(slots);
  187. out_free:
  188.     kvm_free_physmem_slot(&new, &old);
  189. out:
  190.     return r;
  191. }

阅读(666) | 评论(0) | 转发(0) |
给主人留下些什么吧!~~