~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/tools/lguest/lguest.c

Version: ~ [ linux-5.3-rc4 ] ~ [ linux-5.2.8 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.66 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.138 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.189 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.189 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.71 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.102 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*P:100
  2  * This is the Launcher code, a simple program which lays out the "physical"
  3  * memory for the new Guest by mapping the kernel image and the virtual
  4  * devices, then opens /dev/lguest to tell the kernel about the Guest and
  5  * control it.
  6 :*/
  7 #define _LARGEFILE64_SOURCE
  8 #define _GNU_SOURCE
  9 #include <stdio.h>
 10 #include <string.h>
 11 #include <unistd.h>
 12 #include <err.h>
 13 #include <stdint.h>
 14 #include <stdlib.h>
 15 #include <elf.h>
 16 #include <sys/mman.h>
 17 #include <sys/param.h>
 18 #include <sys/types.h>
 19 #include <sys/stat.h>
 20 #include <sys/wait.h>
 21 #include <sys/eventfd.h>
 22 #include <fcntl.h>
 23 #include <stdbool.h>
 24 #include <errno.h>
 25 #include <ctype.h>
 26 #include <sys/socket.h>
 27 #include <sys/ioctl.h>
 28 #include <sys/time.h>
 29 #include <time.h>
 30 #include <netinet/in.h>
 31 #include <net/if.h>
 32 #include <linux/sockios.h>
 33 #include <linux/if_tun.h>
 34 #include <sys/uio.h>
 35 #include <termios.h>
 36 #include <getopt.h>
 37 #include <assert.h>
 38 #include <sched.h>
 39 #include <limits.h>
 40 #include <stddef.h>
 41 #include <signal.h>
 42 #include <pwd.h>
 43 #include <grp.h>
 44 
 45 /*L:110
 46  * We can ignore the 43 include files we need for this program, but I do want
 47  * to draw attention to the use of kernel-style types.
 48  *
 49  * As Linus said, "C is a Spartan language, and so should your naming be."  I
 50  * like these abbreviations, so we define them here.  Note that u64 is always
 51  * unsigned long long, which works on all Linux systems: this means that we can
 52  * use %llu in printf for any u64.
 53  */
 54 typedef unsigned long long u64;
 55 typedef uint32_t u32;
 56 typedef uint16_t u16;
 57 typedef uint8_t u8;
 58 /*:*/
 59 
 60 #include <linux/virtio_config.h>
 61 #include <linux/virtio_net.h>
 62 #include <linux/virtio_blk.h>
 63 #include <linux/virtio_console.h>
 64 #include <linux/virtio_rng.h>
 65 #include <linux/virtio_ring.h>
 66 #include <asm/bootparam.h>
 67 #include "../../include/linux/lguest_launcher.h"
 68 
 69 #define BRIDGE_PFX "bridge:"
 70 #ifndef SIOCBRADDIF
 71 #define SIOCBRADDIF     0x89a2          /* add interface to bridge      */
 72 #endif
 73 /* We can have up to 256 pages for devices. */
 74 #define DEVICE_PAGES 256
 75 /* This will occupy 3 pages: it must be a power of 2. */
 76 #define VIRTQUEUE_NUM 256
 77 
 78 /*L:120
 79  * verbose is both a global flag and a macro.  The C preprocessor allows
 80  * this, and although I wouldn't recommend it, it works quite nicely here.
 81  */
 82 static bool verbose;
 83 #define verbose(args...) \
 84         do { if (verbose) printf(args); } while(0)
 85 /*:*/
 86 
 87 /* The pointer to the start of guest memory. */
 88 static void *guest_base;
 89 /* The maximum guest physical address allowed, and maximum possible. */
 90 static unsigned long guest_limit, guest_max;
 91 /* The /dev/lguest file descriptor. */
 92 static int lguest_fd;
 93 
 94 /* a per-cpu variable indicating whose vcpu is currently running */
 95 static unsigned int __thread cpu_id;
 96 
 97 /* This is our list of devices. */
 98 struct device_list {
 99         /* Counter to assign interrupt numbers. */
100         unsigned int next_irq;
101 
102         /* Counter to print out convenient device numbers. */
103         unsigned int device_num;
104 
105         /* The descriptor page for the devices. */
106         u8 *descpage;
107 
108         /* A single linked list of devices. */
109         struct device *dev;
110         /* And a pointer to the last device for easy append. */
111         struct device *lastdev;
112 };
113 
114 /* The list of Guest devices, based on command line arguments. */
115 static struct device_list devices;
116 
117 /* The device structure describes a single device. */
118 struct device {
119         /* The linked-list pointer. */
120         struct device *next;
121 
122         /* The device's descriptor, as mapped into the Guest. */
123         struct lguest_device_desc *desc;
124 
125         /* We can't trust desc values once Guest has booted: we use these. */
126         unsigned int feature_len;
127         unsigned int num_vq;
128 
129         /* The name of this device, for --verbose. */
130         const char *name;
131 
132         /* Any queues attached to this device */
133         struct virtqueue *vq;
134 
135         /* Is it operational */
136         bool running;
137 
138         /* Device-specific data. */
139         void *priv;
140 };
141 
142 /* The virtqueue structure describes a queue attached to a device. */
143 struct virtqueue {
144         struct virtqueue *next;
145 
146         /* Which device owns me. */
147         struct device *dev;
148 
149         /* The configuration for this queue. */
150         struct lguest_vqconfig config;
151 
152         /* The actual ring of buffers. */
153         struct vring vring;
154 
155         /* Last available index we saw. */
156         u16 last_avail_idx;
157 
158         /* How many are used since we sent last irq? */
159         unsigned int pending_used;
160 
161         /* Eventfd where Guest notifications arrive. */
162         int eventfd;
163 
164         /* Function for the thread which is servicing this virtqueue. */
165         void (*service)(struct virtqueue *vq);
166         pid_t thread;
167 };
168 
169 /* Remember the arguments to the program so we can "reboot" */
170 static char **main_args;
171 
172 /* The original tty settings to restore on exit. */
173 static struct termios orig_term;
174 
175 /*
176  * We have to be careful with barriers: our devices are all run in separate
177  * threads and so we need to make sure that changes visible to the Guest happen
178  * in precise order.
179  */
180 #define wmb() __asm__ __volatile__("" : : : "memory")
181 #define rmb() __asm__ __volatile__("lock; addl $0,0(%%esp)" : : : "memory")
182 #define mb() __asm__ __volatile__("lock; addl $0,0(%%esp)" : : : "memory")
183 
184 /* Wrapper for the last available index.  Makes it easier to change. */
185 #define lg_last_avail(vq)       ((vq)->last_avail_idx)
186 
187 /*
188  * The virtio configuration space is defined to be little-endian.  x86 is
189  * little-endian too, but it's nice to be explicit so we have these helpers.
190  */
191 #define cpu_to_le16(v16) (v16)
192 #define cpu_to_le32(v32) (v32)
193 #define cpu_to_le64(v64) (v64)
194 #define le16_to_cpu(v16) (v16)
195 #define le32_to_cpu(v32) (v32)
196 #define le64_to_cpu(v64) (v64)
197 
198 /* Is this iovec empty? */
199 static bool iov_empty(const struct iovec iov[], unsigned int num_iov)
200 {
201         unsigned int i;
202 
203         for (i = 0; i < num_iov; i++)
204                 if (iov[i].iov_len)
205                         return false;
206         return true;
207 }
208 
209 /* Take len bytes from the front of this iovec. */
210 static void iov_consume(struct iovec iov[], unsigned num_iov,
211                         void *dest, unsigned len)
212 {
213         unsigned int i;
214 
215         for (i = 0; i < num_iov; i++) {
216                 unsigned int used;
217 
218                 used = iov[i].iov_len < len ? iov[i].iov_len : len;
219                 if (dest) {
220                         memcpy(dest, iov[i].iov_base, used);
221                         dest += used;
222                 }
223                 iov[i].iov_base += used;
224                 iov[i].iov_len -= used;
225                 len -= used;
226         }
227         if (len != 0)
228                 errx(1, "iovec too short!");
229 }
230 
231 /* The device virtqueue descriptors are followed by feature bitmasks. */
232 static u8 *get_feature_bits(struct device *dev)
233 {
234         return (u8 *)(dev->desc + 1)
235                 + dev->num_vq * sizeof(struct lguest_vqconfig);
236 }
237 
238 /*L:100
239  * The Launcher code itself takes us out into userspace, that scary place where
240  * pointers run wild and free!  Unfortunately, like most userspace programs,
241  * it's quite boring (which is why everyone likes to hack on the kernel!).
242  * Perhaps if you make up an Lguest Drinking Game at this point, it will get
243  * you through this section.  Or, maybe not.
244  *
245  * The Launcher sets up a big chunk of memory to be the Guest's "physical"
246  * memory and stores it in "guest_base".  In other words, Guest physical ==
247  * Launcher virtual with an offset.
248  *
249  * This can be tough to get your head around, but usually it just means that we
250  * use these trivial conversion functions when the Guest gives us its
251  * "physical" addresses:
252  */
253 static void *from_guest_phys(unsigned long addr)
254 {
255         return guest_base + addr;
256 }
257 
258 static unsigned long to_guest_phys(const void *addr)
259 {
260         return (addr - guest_base);
261 }
262 
263 /*L:130
264  * Loading the Kernel.
265  *
266  * We start with couple of simple helper routines.  open_or_die() avoids
267  * error-checking code cluttering the callers:
268  */
269 static int open_or_die(const char *name, int flags)
270 {
271         int fd = open(name, flags);
272         if (fd < 0)
273                 err(1, "Failed to open %s", name);
274         return fd;
275 }
276 
277 /* map_zeroed_pages() takes a number of pages. */
278 static void *map_zeroed_pages(unsigned int num)
279 {
280         int fd = open_or_die("/dev/zero", O_RDONLY);
281         void *addr;
282 
283         /*
284          * We use a private mapping (ie. if we write to the page, it will be
285          * copied). We allocate an extra two pages PROT_NONE to act as guard
286          * pages against read/write attempts that exceed allocated space.
287          */
288         addr = mmap(NULL, getpagesize() * (num+2),
289                     PROT_NONE, MAP_PRIVATE, fd, 0);
290 
291         if (addr == MAP_FAILED)
292                 err(1, "Mmapping %u pages of /dev/zero", num);
293 
294         if (mprotect(addr + getpagesize(), getpagesize() * num,
295                      PROT_READ|PROT_WRITE) == -1)
296                 err(1, "mprotect rw %u pages failed", num);
297 
298         /*
299          * One neat mmap feature is that you can close the fd, and it
300          * stays mapped.
301          */
302         close(fd);
303 
304         /* Return address after PROT_NONE page */
305         return addr + getpagesize();
306 }
307 
308 /* Get some more pages for a device. */
309 static void *get_pages(unsigned int num)
310 {
311         void *addr = from_guest_phys(guest_limit);
312 
313         guest_limit += num * getpagesize();
314         if (guest_limit > guest_max)
315                 errx(1, "Not enough memory for devices");
316         return addr;
317 }
318 
319 /*
320  * This routine is used to load the kernel or initrd.  It tries mmap, but if
321  * that fails (Plan 9's kernel file isn't nicely aligned on page boundaries),
322  * it falls back to reading the memory in.
323  */
324 static void map_at(int fd, void *addr, unsigned long offset, unsigned long len)
325 {
326         ssize_t r;
327 
328         /*
329          * We map writable even though for some segments are marked read-only.
330          * The kernel really wants to be writable: it patches its own
331          * instructions.
332          *
333          * MAP_PRIVATE means that the page won't be copied until a write is
334          * done to it.  This allows us to share untouched memory between
335          * Guests.
336          */
337         if (mmap(addr, len, PROT_READ|PROT_WRITE,
338                  MAP_FIXED|MAP_PRIVATE, fd, offset) != MAP_FAILED)
339                 return;
340 
341         /* pread does a seek and a read in one shot: saves a few lines. */
342         r = pread(fd, addr, len, offset);
343         if (r != len)
344                 err(1, "Reading offset %lu len %lu gave %zi", offset, len, r);
345 }
346 
347 /*
348  * This routine takes an open vmlinux image, which is in ELF, and maps it into
349  * the Guest memory.  ELF = Embedded Linking Format, which is the format used
350  * by all modern binaries on Linux including the kernel.
351  *
352  * The ELF headers give *two* addresses: a physical address, and a virtual
353  * address.  We use the physical address; the Guest will map itself to the
354  * virtual address.
355  *
356  * We return the starting address.
357  */
358 static unsigned long map_elf(int elf_fd, const Elf32_Ehdr *ehdr)
359 {
360         Elf32_Phdr phdr[ehdr->e_phnum];
361         unsigned int i;
362 
363         /*
364          * Sanity checks on the main ELF header: an x86 executable with a
365          * reasonable number of correctly-sized program headers.
366          */
367         if (ehdr->e_type != ET_EXEC
368             || ehdr->e_machine != EM_386
369             || ehdr->e_phentsize != sizeof(Elf32_Phdr)
370             || ehdr->e_phnum < 1 || ehdr->e_phnum > 65536U/sizeof(Elf32_Phdr))
371                 errx(1, "Malformed elf header");
372 
373         /*
374          * An ELF executable contains an ELF header and a number of "program"
375          * headers which indicate which parts ("segments") of the program to
376          * load where.
377          */
378 
379         /* We read in all the program headers at once: */
380         if (lseek(elf_fd, ehdr->e_phoff, SEEK_SET) < 0)
381                 err(1, "Seeking to program headers");
382         if (read(elf_fd, phdr, sizeof(phdr)) != sizeof(phdr))
383                 err(1, "Reading program headers");
384 
385         /*
386          * Try all the headers: there are usually only three.  A read-only one,
387          * a read-write one, and a "note" section which we don't load.
388          */
389         for (i = 0; i < ehdr->e_phnum; i++) {
390                 /* If this isn't a loadable segment, we ignore it */
391                 if (phdr[i].p_type != PT_LOAD)
392                         continue;
393 
394                 verbose("Section %i: size %i addr %p\n",
395                         i, phdr[i].p_memsz, (void *)phdr[i].p_paddr);
396 
397                 /* We map this section of the file at its physical address. */
398                 map_at(elf_fd, from_guest_phys(phdr[i].p_paddr),
399                        phdr[i].p_offset, phdr[i].p_filesz);
400         }
401 
402         /* The entry point is given in the ELF header. */
403         return ehdr->e_entry;
404 }
405 
406 /*L:150
407  * A bzImage, unlike an ELF file, is not meant to be loaded.  You're supposed
408  * to jump into it and it will unpack itself.  We used to have to perform some
409  * hairy magic because the unpacking code scared me.
410  *
411  * Fortunately, Jeremy Fitzhardinge convinced me it wasn't that hard and wrote
412  * a small patch to jump over the tricky bits in the Guest, so now we just read
413  * the funky header so we know where in the file to load, and away we go!
414  */
415 static unsigned long load_bzimage(int fd)
416 {
417         struct boot_params boot;
418         int r;
419         /* Modern bzImages get loaded at 1M. */
420         void *p = from_guest_phys(0x100000);
421 
422         /*
423          * Go back to the start of the file and read the header.  It should be
424          * a Linux boot header (see Documentation/x86/boot.txt)
425          */
426         lseek(fd, 0, SEEK_SET);
427         read(fd, &boot, sizeof(boot));
428 
429         /* Inside the setup_hdr, we expect the magic "HdrS" */
430         if (memcmp(&boot.hdr.header, "HdrS", 4) != 0)
431                 errx(1, "This doesn't look like a bzImage to me");
432 
433         /* Skip over the extra sectors of the header. */
434         lseek(fd, (boot.hdr.setup_sects+1) * 512, SEEK_SET);
435 
436         /* Now read everything into memory. in nice big chunks. */
437         while ((r = read(fd, p, 65536)) > 0)
438                 p += r;
439 
440         /* Finally, code32_start tells us where to enter the kernel. */
441         return boot.hdr.code32_start;
442 }
443 
444 /*L:140
445  * Loading the kernel is easy when it's a "vmlinux", but most kernels
446  * come wrapped up in the self-decompressing "bzImage" format.  With a little
447  * work, we can load those, too.
448  */
449 static unsigned long load_kernel(int fd)
450 {
451         Elf32_Ehdr hdr;
452 
453         /* Read in the first few bytes. */
454         if (read(fd, &hdr, sizeof(hdr)) != sizeof(hdr))
455                 err(1, "Reading kernel");
456 
457         /* If it's an ELF file, it starts with "\177ELF" */
458         if (memcmp(hdr.e_ident, ELFMAG, SELFMAG) == 0)
459                 return map_elf(fd, &hdr);
460 
461         /* Otherwise we assume it's a bzImage, and try to load it. */
462         return load_bzimage(fd);
463 }
464 
465 /*
466  * This is a trivial little helper to align pages.  Andi Kleen hated it because
467  * it calls getpagesize() twice: "it's dumb code."
468  *
469  * Kernel guys get really het up about optimization, even when it's not
470  * necessary.  I leave this code as a reaction against that.
471  */
472 static inline unsigned long page_align(unsigned long addr)
473 {
474         /* Add upwards and truncate downwards. */
475         return ((addr + getpagesize()-1) & ~(getpagesize()-1));
476 }
477 
478 /*L:180
479  * An "initial ram disk" is a disk image loaded into memory along with the
480  * kernel which the kernel can use to boot from without needing any drivers.
481  * Most distributions now use this as standard: the initrd contains the code to
482  * load the appropriate driver modules for the current machine.
483  *
484  * Importantly, James Morris works for RedHat, and Fedora uses initrds for its
485  * kernels.  He sent me this (and tells me when I break it).
486  */
487 static unsigned long load_initrd(const char *name, unsigned long mem)
488 {
489         int ifd;
490         struct stat st;
491         unsigned long len;
492 
493         ifd = open_or_die(name, O_RDONLY);
494         /* fstat() is needed to get the file size. */
495         if (fstat(ifd, &st) < 0)
496                 err(1, "fstat() on initrd '%s'", name);
497 
498         /*
499          * We map the initrd at the top of memory, but mmap wants it to be
500          * page-aligned, so we round the size up for that.
501          */
502         len = page_align(st.st_size);
503         map_at(ifd, from_guest_phys(mem - len), 0, st.st_size);
504         /*
505          * Once a file is mapped, you can close the file descriptor.  It's a
506          * little odd, but quite useful.
507          */
508         close(ifd);
509         verbose("mapped initrd %s size=%lu @ %p\n", name, len, (void*)mem-len);
510 
511         /* We return the initrd size. */
512         return len;
513 }
514 /*:*/
515 
516 /*
517  * Simple routine to roll all the commandline arguments together with spaces
518  * between them.
519  */
520 static void concat(char *dst, char *args[])
521 {
522         unsigned int i, len = 0;
523 
524         for (i = 0; args[i]; i++) {
525                 if (i) {
526                         strcat(dst+len, " ");
527                         len++;
528                 }
529                 strcpy(dst+len, args[i]);
530                 len += strlen(args[i]);
531         }
532         /* In case it's empty. */
533         dst[len] = '\0';
534 }
535 
536 /*L:185
537  * This is where we actually tell the kernel to initialize the Guest.  We
538  * saw the arguments it expects when we looked at initialize() in lguest_user.c:
539  * the base of Guest "physical" memory, the top physical page to allow and the
540  * entry point for the Guest.
541  */
542 static void tell_kernel(unsigned long start)
543 {
544         unsigned long args[] = { LHREQ_INITIALIZE,
545                                  (unsigned long)guest_base,
546                                  guest_limit / getpagesize(), start };
547         verbose("Guest: %p - %p (%#lx)\n",
548                 guest_base, guest_base + guest_limit, guest_limit);
549         lguest_fd = open_or_die("/dev/lguest", O_RDWR);
550         if (write(lguest_fd, args, sizeof(args)) < 0)
551                 err(1, "Writing to /dev/lguest");
552 }
553 /*:*/
554 
555 /*L:200
556  * Device Handling.
557  *
558  * When the Guest gives us a buffer, it sends an array of addresses and sizes.
559  * We need to make sure it's not trying to reach into the Launcher itself, so
560  * we have a convenient routine which checks it and exits with an error message
561  * if something funny is going on:
562  */
563 static void *_check_pointer(unsigned long addr, unsigned int size,
564                             unsigned int line)
565 {
566         /*
567          * Check if the requested address and size exceeds the allocated memory,
568          * or addr + size wraps around.
569          */
570         if ((addr + size) > guest_limit || (addr + size) < addr)
571                 errx(1, "%s:%i: Invalid address %#lx", __FILE__, line, addr);
572         /*
573          * We return a pointer for the caller's convenience, now we know it's
574          * safe to use.
575          */
576         return from_guest_phys(addr);
577 }
578 /* A macro which transparently hands the line number to the real function. */
579 #define check_pointer(addr,size) _check_pointer(addr, size, __LINE__)
580 
581 /*
582  * Each buffer in the virtqueues is actually a chain of descriptors.  This
583  * function returns the next descriptor in the chain, or vq->vring.num if we're
584  * at the end.
585  */
586 static unsigned next_desc(struct vring_desc *desc,
587                           unsigned int i, unsigned int max)
588 {
589         unsigned int next;
590 
591         /* If this descriptor says it doesn't chain, we're done. */
592         if (!(desc[i].flags & VRING_DESC_F_NEXT))
593                 return max;
594 
595         /* Check they're not leading us off end of descriptors. */
596         next = desc[i].next;
597         /* Make sure compiler knows to grab that: we don't want it changing! */
598         wmb();
599 
600         if (next >= max)
601                 errx(1, "Desc next is %u", next);
602 
603         return next;
604 }
605 
606 /*
607  * This actually sends the interrupt for this virtqueue, if we've used a
608  * buffer.
609  */
610 static void trigger_irq(struct virtqueue *vq)
611 {
612         unsigned long buf[] = { LHREQ_IRQ, vq->config.irq };
613 
614         /* Don't inform them if nothing used. */
615         if (!vq->pending_used)
616                 return;
617         vq->pending_used = 0;
618 
619         /* If they don't want an interrupt, don't send one... */
620         if (vq->vring.avail->flags & VRING_AVAIL_F_NO_INTERRUPT) {
621                 return;
622         }
623 
624         /* Send the Guest an interrupt tell them we used something up. */
625         if (write(lguest_fd, buf, sizeof(buf)) != 0)
626                 err(1, "Triggering irq %i", vq->config.irq);
627 }
628 
629 /*
630  * This looks in the virtqueue for the first available buffer, and converts
631  * it to an iovec for convenient access.  Since descriptors consist of some
632  * number of output then some number of input descriptors, it's actually two
633  * iovecs, but we pack them into one and note how many of each there were.
634  *
635  * This function waits if necessary, and returns the descriptor number found.
636  */
637 static unsigned wait_for_vq_desc(struct virtqueue *vq,
638                                  struct iovec iov[],
639                                  unsigned int *out_num, unsigned int *in_num)
640 {
641         unsigned int i, head, max;
642         struct vring_desc *desc;
643         u16 last_avail = lg_last_avail(vq);
644 
645         /* There's nothing available? */
646         while (last_avail == vq->vring.avail->idx) {
647                 u64 event;
648 
649                 /*
650                  * Since we're about to sleep, now is a good time to tell the
651                  * Guest about what we've used up to now.
652                  */
653                 trigger_irq(vq);
654 
655                 /* OK, now we need to know about added descriptors. */
656                 vq->vring.used->flags &= ~VRING_USED_F_NO_NOTIFY;
657 
658                 /*
659                  * They could have slipped one in as we were doing that: make
660                  * sure it's written, then check again.
661                  */
662                 mb();
663                 if (last_avail != vq->vring.avail->idx) {
664                         vq->vring.used->flags |= VRING_USED_F_NO_NOTIFY;
665                         break;
666                 }
667 
668                 /* Nothing new?  Wait for eventfd to tell us they refilled. */
669                 if (read(vq->eventfd, &event, sizeof(event)) != sizeof(event))
670                         errx(1, "Event read failed?");
671 
672                 /* We don't need to be notified again. */
673                 vq->vring.used->flags |= VRING_USED_F_NO_NOTIFY;
674         }
675 
676         /* Check it isn't doing very strange things with descriptor numbers. */
677         if ((u16)(vq->vring.avail->idx - last_avail) > vq->vring.num)
678                 errx(1, "Guest moved used index from %u to %u",
679                      last_avail, vq->vring.avail->idx);
680 
681         /* 
682          * Make sure we read the descriptor number *after* we read the ring
683          * update; don't let the cpu or compiler change the order.
684          */
685         rmb();
686 
687         /*
688          * Grab the next descriptor number they're advertising, and increment
689          * the index we've seen.
690          */
691         head = vq->vring.avail->ring[last_avail % vq->vring.num];
692         lg_last_avail(vq)++;
693 
694         /* If their number is silly, that's a fatal mistake. */
695         if (head >= vq->vring.num)
696                 errx(1, "Guest says index %u is available", head);
697 
698         /* When we start there are none of either input nor output. */
699         *out_num = *in_num = 0;
700 
701         max = vq->vring.num;
702         desc = vq->vring.desc;
703         i = head;
704 
705         /*
706          * We have to read the descriptor after we read the descriptor number,
707          * but there's a data dependency there so the CPU shouldn't reorder
708          * that: no rmb() required.
709          */
710 
711         /*
712          * If this is an indirect entry, then this buffer contains a descriptor
713          * table which we handle as if it's any normal descriptor chain.
714          */
715         if (desc[i].flags & VRING_DESC_F_INDIRECT) {
716                 if (desc[i].len % sizeof(struct vring_desc))
717                         errx(1, "Invalid size for indirect buffer table");
718 
719                 max = desc[i].len / sizeof(struct vring_desc);
720                 desc = check_pointer(desc[i].addr, desc[i].len);
721                 i = 0;
722         }
723 
724         do {
725                 /* Grab the first descriptor, and check it's OK. */
726                 iov[*out_num + *in_num].iov_len = desc[i].len;
727                 iov[*out_num + *in_num].iov_base
728                         = check_pointer(desc[i].addr, desc[i].len);
729                 /* If this is an input descriptor, increment that count. */
730                 if (desc[i].flags & VRING_DESC_F_WRITE)
731                         (*in_num)++;
732                 else {
733                         /*
734                          * If it's an output descriptor, they're all supposed
735                          * to come before any input descriptors.
736                          */
737                         if (*in_num)
738                                 errx(1, "Descriptor has out after in");
739                         (*out_num)++;
740                 }
741 
742                 /* If we've got too many, that implies a descriptor loop. */
743                 if (*out_num + *in_num > max)
744                         errx(1, "Looped descriptor");
745         } while ((i = next_desc(desc, i, max)) != max);
746 
747         return head;
748 }
749 
750 /*
751  * After we've used one of their buffers, we tell the Guest about it.  Sometime
752  * later we'll want to send them an interrupt using trigger_irq(); note that
753  * wait_for_vq_desc() does that for us if it has to wait.
754  */
755 static void add_used(struct virtqueue *vq, unsigned int head, int len)
756 {
757         struct vring_used_elem *used;
758 
759         /*
760          * The virtqueue contains a ring of used buffers.  Get a pointer to the
761          * next entry in that used ring.
762          */
763         used = &vq->vring.used->ring[vq->vring.used->idx % vq->vring.num];
764         used->id = head;
765         used->len = len;
766         /* Make sure buffer is written before we update index. */
767         wmb();
768         vq->vring.used->idx++;
769         vq->pending_used++;
770 }
771 
772 /* And here's the combo meal deal.  Supersize me! */
773 static void add_used_and_trigger(struct virtqueue *vq, unsigned head, int len)
774 {
775         add_used(vq, head, len);
776         trigger_irq(vq);
777 }
778 
779 /*
780  * The Console
781  *
782  * We associate some data with the console for our exit hack.
783  */
784 struct console_abort {
785         /* How many times have they hit ^C? */
786         int count;
787         /* When did they start? */
788         struct timeval start;
789 };
790 
791 /* This is the routine which handles console input (ie. stdin). */
792 static void console_input(struct virtqueue *vq)
793 {
794         int len;
795         unsigned int head, in_num, out_num;
796         struct console_abort *abort = vq->dev->priv;
797         struct iovec iov[vq->vring.num];
798 
799         /* Make sure there's a descriptor available. */
800         head = wait_for_vq_desc(vq, iov, &out_num, &in_num);
801         if (out_num)
802                 errx(1, "Output buffers in console in queue?");
803 
804         /* Read into it.  This is where we usually wait. */
805         len = readv(STDIN_FILENO, iov, in_num);
806         if (len <= 0) {
807                 /* Ran out of input? */
808                 warnx("Failed to get console input, ignoring console.");
809                 /*
810                  * For simplicity, dying threads kill the whole Launcher.  So
811                  * just nap here.
812                  */
813                 for (;;)
814                         pause();
815         }
816 
817         /* Tell the Guest we used a buffer. */
818         add_used_and_trigger(vq, head, len);
819 
820         /*
821          * Three ^C within one second?  Exit.
822          *
823          * This is such a hack, but works surprisingly well.  Each ^C has to
824          * be in a buffer by itself, so they can't be too fast.  But we check
825          * that we get three within about a second, so they can't be too
826          * slow.
827          */
828         if (len != 1 || ((char *)iov[0].iov_base)[0] != 3) {
829                 abort->count = 0;
830                 return;
831         }
832 
833         abort->count++;
834         if (abort->count == 1)
835                 gettimeofday(&abort->start, NULL);
836         else if (abort->count == 3) {
837                 struct timeval now;
838                 gettimeofday(&now, NULL);
839                 /* Kill all Launcher processes with SIGINT, like normal ^C */
840                 if (now.tv_sec <= abort->start.tv_sec+1)
841                         kill(0, SIGINT);
842                 abort->count = 0;
843         }
844 }
845 
846 /* This is the routine which handles console output (ie. stdout). */
847 static void console_output(struct virtqueue *vq)
848 {
849         unsigned int head, out, in;
850         struct iovec iov[vq->vring.num];
851 
852         /* We usually wait in here, for the Guest to give us something. */
853         head = wait_for_vq_desc(vq, iov, &out, &in);
854         if (in)
855                 errx(1, "Input buffers in console output queue?");
856 
857         /* writev can return a partial write, so we loop here. */
858         while (!iov_empty(iov, out)) {
859                 int len = writev(STDOUT_FILENO, iov, out);
860                 if (len <= 0) {
861                         warn("Write to stdout gave %i (%d)", len, errno);
862                         break;
863                 }
864                 iov_consume(iov, out, NULL, len);
865         }
866 
867         /*
868          * We're finished with that buffer: if we're going to sleep,
869          * wait_for_vq_desc() will prod the Guest with an interrupt.
870          */
871         add_used(vq, head, 0);
872 }
873 
874 /*
875  * The Network
876  *
877  * Handling output for network is also simple: we get all the output buffers
878  * and write them to /dev/net/tun.
879  */
880 struct net_info {
881         int tunfd;
882 };
883 
884 static void net_output(struct virtqueue *vq)
885 {
886         struct net_info *net_info = vq->dev->priv;
887         unsigned int head, out, in;
888         struct iovec iov[vq->vring.num];
889 
890         /* We usually wait in here for the Guest to give us a packet. */
891         head = wait_for_vq_desc(vq, iov, &out, &in);
892         if (in)
893                 errx(1, "Input buffers in net output queue?");
894         /*
895          * Send the whole thing through to /dev/net/tun.  It expects the exact
896          * same format: what a coincidence!
897          */
898         if (writev(net_info->tunfd, iov, out) < 0)
899                 warnx("Write to tun failed (%d)?", errno);
900 
901         /*
902          * Done with that one; wait_for_vq_desc() will send the interrupt if
903          * all packets are processed.
904          */
905         add_used(vq, head, 0);
906 }
907 
908 /*
909  * Handling network input is a bit trickier, because I've tried to optimize it.
910  *
911  * First we have a helper routine which tells is if from this file descriptor
912  * (ie. the /dev/net/tun device) will block:
913  */
914 static bool will_block(int fd)
915 {
916         fd_set fdset;
917         struct timeval zero = { 0, 0 };
918         FD_ZERO(&fdset);
919         FD_SET(fd, &fdset);
920         return select(fd+1, &fdset, NULL, NULL, &zero) != 1;
921 }
922 
923 /*
924  * This handles packets coming in from the tun device to our Guest.  Like all
925  * service routines, it gets called again as soon as it returns, so you don't
926  * see a while(1) loop here.
927  */
928 static void net_input(struct virtqueue *vq)
929 {
930         int len;
931         unsigned int head, out, in;
932         struct iovec iov[vq->vring.num];
933         struct net_info *net_info = vq->dev->priv;
934 
935         /*
936          * Get a descriptor to write an incoming packet into.  This will also
937          * send an interrupt if they're out of descriptors.
938          */
939         head = wait_for_vq_desc(vq, iov, &out, &in);
940         if (out)
941                 errx(1, "Output buffers in net input queue?");
942 
943         /*
944          * If it looks like we'll block reading from the tun device, send them
945          * an interrupt.
946          */
947         if (vq->pending_used && will_block(net_info->tunfd))
948                 trigger_irq(vq);
949 
950         /*
951          * Read in the packet.  This is where we normally wait (when there's no
952          * incoming network traffic).
953          */
954         len = readv(net_info->tunfd, iov, in);
955         if (len <= 0)
956                 warn("Failed to read from tun (%d).", errno);
957 
958         /*
959          * Mark that packet buffer as used, but don't interrupt here.  We want
960          * to wait until we've done as much work as we can.
961          */
962         add_used(vq, head, len);
963 }
964 /*:*/
965 
966 /* This is the helper to create threads: run the service routine in a loop. */
967 static int do_thread(void *_vq)
968 {
969         struct virtqueue *vq = _vq;
970 
971         for (;;)
972                 vq->service(vq);
973         return 0;
974 }
975 
976 /*
977  * When a child dies, we kill our entire process group with SIGTERM.  This
978  * also has the side effect that the shell restores the console for us!
979  */
980 static void kill_launcher(int signal)
981 {
982         kill(0, SIGTERM);
983 }
984 
985 static void reset_device(struct device *dev)
986 {
987         struct virtqueue *vq;
988 
989         verbose("Resetting device %s\n", dev->name);
990 
991         /* Clear any features they've acked. */
992         memset(get_feature_bits(dev) + dev->feature_len, 0, dev->feature_len);
993 
994         /* We're going to be explicitly killing threads, so ignore them. */
995         signal(SIGCHLD, SIG_IGN);
996 
997         /* Zero out the virtqueues, get rid of their threads */
998         for (vq = dev->vq; vq; vq = vq->next) {
999                 if (vq->thread != (pid_t)-1) {
1000                         kill(vq->thread, SIGTERM);
1001                         waitpid(vq->thread, NULL, 0);
1002                         vq->thread = (pid_t)-1;
1003                 }
1004                 memset(vq->vring.desc, 0,
1005                        vring_size(vq->config.num, LGUEST_VRING_ALIGN));
1006                 lg_last_avail(vq) = 0;
1007         }
1008         dev->running = false;
1009 
1010         /* Now we care if threads die. */
1011         signal(SIGCHLD, (void *)kill_launcher);
1012 }
1013 
1014 /*L:216
1015  * This actually creates the thread which services the virtqueue for a device.
1016  */
1017 static void create_thread(struct virtqueue *vq)
1018 {
1019         /*
1020          * Create stack for thread.  Since the stack grows upwards, we point
1021          * the stack pointer to the end of this region.
1022          */
1023         char *stack = malloc(32768);
1024         unsigned long args[] = { LHREQ_EVENTFD,
1025                                  vq->config.pfn*getpagesize(), 0 };
1026 
1027         /* Create a zero-initialized eventfd. */
1028         vq->eventfd = eventfd(0, 0);
1029         if (vq->eventfd < 0)
1030                 err(1, "Creating eventfd");
1031         args[2] = vq->eventfd;
1032 
1033         /*
1034          * Attach an eventfd to this virtqueue: it will go off when the Guest
1035          * does an LHCALL_NOTIFY for this vq.
1036          */
1037         if (write(lguest_fd, &args, sizeof(args)) != 0)
1038                 err(1, "Attaching eventfd");
1039 
1040         /*
1041          * CLONE_VM: because it has to access the Guest memory, and SIGCHLD so
1042          * we get a signal if it dies.
1043          */
1044         vq->thread = clone(do_thread, stack + 32768, CLONE_VM | SIGCHLD, vq);
1045         if (vq->thread == (pid_t)-1)
1046                 err(1, "Creating clone");
1047 
1048         /* We close our local copy now the child has it. */
1049         close(vq->eventfd);
1050 }
1051 
1052 static void start_device(struct device *dev)
1053 {
1054         unsigned int i;
1055         struct virtqueue *vq;
1056 
1057         verbose("Device %s OK: offered", dev->name);
1058         for (i = 0; i < dev->feature_len; i++)
1059                 verbose(" %02x", get_feature_bits(dev)[i]);
1060         verbose(", accepted");
1061         for (i = 0; i < dev->feature_len; i++)
1062                 verbose(" %02x", get_feature_bits(dev)
1063                         [dev->feature_len+i]);
1064 
1065         for (vq = dev->vq; vq; vq = vq->next) {
1066                 if (vq->service)
1067                         create_thread(vq);
1068         }
1069         dev->running = true;
1070 }
1071 
1072 static void cleanup_devices(void)
1073 {
1074         struct device *dev;
1075 
1076         for (dev = devices.dev; dev; dev = dev->next)
1077                 reset_device(dev);
1078 
1079         /* If we saved off the original terminal settings, restore them now. */
1080         if (orig_term.c_lflag & (ISIG|ICANON|ECHO))
1081                 tcsetattr(STDIN_FILENO, TCSANOW, &orig_term);
1082 }
1083 
1084 /* When the Guest tells us they updated the status field, we handle it. */
1085 static void update_device_status(struct device *dev)
1086 {
1087         /* A zero status is a reset, otherwise it's a set of flags. */
1088         if (dev->desc->status == 0)
1089                 reset_device(dev);
1090         else if (dev->desc->status & VIRTIO_CONFIG_S_FAILED) {
1091                 warnx("Device %s configuration FAILED", dev->name);
1092                 if (dev->running)
1093                         reset_device(dev);
1094         } else {
1095                 if (dev->running)
1096                         err(1, "Device %s features finalized twice", dev->name);
1097                 start_device(dev);
1098         }
1099 }
1100 
1101 /*L:215
1102  * This is the generic routine we call when the Guest uses LHCALL_NOTIFY.  In
1103  * particular, it's used to notify us of device status changes during boot.
1104  */
1105 static void handle_output(unsigned long addr)
1106 {
1107         struct device *i;
1108 
1109         /* Check each device. */
1110         for (i = devices.dev; i; i = i->next) {
1111                 struct virtqueue *vq;
1112 
1113                 /*
1114                  * Notifications to device descriptors mean they updated the
1115                  * device status.
1116                  */
1117                 if (from_guest_phys(addr) == i->desc) {
1118                         update_device_status(i);
1119                         return;
1120                 }
1121 
1122                 /* Devices should not be used before features are finalized. */
1123                 for (vq = i->vq; vq; vq = vq->next) {
1124                         if (addr != vq->config.pfn*getpagesize())
1125                                 continue;
1126                         errx(1, "Notification on %s before setup!", i->name);
1127                 }
1128         }
1129 
1130         /*
1131          * Early console write is done using notify on a nul-terminated string
1132          * in Guest memory.  It's also great for hacking debugging messages
1133          * into a Guest.
1134          */
1135         if (addr >= guest_limit)
1136                 errx(1, "Bad NOTIFY %#lx", addr);
1137 
1138         write(STDOUT_FILENO, from_guest_phys(addr),
1139               strnlen(from_guest_phys(addr), guest_limit - addr));
1140 }
1141 
1142 /*L:190
1143  * Device Setup
1144  *
1145  * All devices need a descriptor so the Guest knows it exists, and a "struct
1146  * device" so the Launcher can keep track of it.  We have common helper
1147  * routines to allocate and manage them.
1148  */
1149 
1150 /*
1151  * The layout of the device page is a "struct lguest_device_desc" followed by a
1152  * number of virtqueue descriptors, then two sets of feature bits, then an
1153  * array of configuration bytes.  This routine returns the configuration
1154  * pointer.
1155  */
1156 static u8 *device_config(const struct device *dev)
1157 {
1158         return (void *)(dev->desc + 1)
1159                 + dev->num_vq * sizeof(struct lguest_vqconfig)
1160                 + dev->feature_len * 2;
1161 }
1162 
1163 /*
1164  * This routine allocates a new "struct lguest_device_desc" from descriptor
1165  * table page just above the Guest's normal memory.  It returns a pointer to
1166  * that descriptor.
1167  */
1168 static struct lguest_device_desc *new_dev_desc(u16 type)
1169 {
1170         struct lguest_device_desc d = { .type = type };
1171         void *p;
1172 
1173         /* Figure out where the next device config is, based on the last one. */
1174         if (devices.lastdev)
1175                 p = device_config(devices.lastdev)
1176                         + devices.lastdev->desc->config_len;
1177         else
1178                 p = devices.descpage;
1179 
1180         /* We only have one page for all the descriptors. */
1181         if (p + sizeof(d) > (void *)devices.descpage + getpagesize())
1182                 errx(1, "Too many devices");
1183 
1184         /* p might not be aligned, so we memcpy in. */
1185         return memcpy(p, &d, sizeof(d));
1186 }
1187 
1188 /*
1189  * Each device descriptor is followed by the description of its virtqueues.  We
1190  * specify how many descriptors the virtqueue is to have.
1191  */
1192 static void add_virtqueue(struct device *dev, unsigned int num_descs,
1193                           void (*service)(struct virtqueue *))
1194 {
1195         unsigned int pages;
1196         struct virtqueue **i, *vq = malloc(sizeof(*vq));
1197         void *p;
1198 
1199         /* First we need some memory for this virtqueue. */
1200         pages = (vring_size(num_descs, LGUEST_VRING_ALIGN) + getpagesize() - 1)
1201                 / getpagesize();
1202         p = get_pages(pages);
1203 
1204         /* Initialize the virtqueue */
1205         vq->next = NULL;
1206         vq->last_avail_idx = 0;
1207         vq->dev = dev;
1208 
1209         /*
1210          * This is the routine the service thread will run, and its Process ID
1211          * once it's running.
1212          */
1213         vq->service = service;
1214         vq->thread = (pid_t)-1;
1215 
1216         /* Initialize the configuration. */
1217         vq->config.num = num_descs;
1218         vq->config.irq = devices.next_irq++;
1219         vq->config.pfn = to_guest_phys(p) / getpagesize();
1220 
1221         /* Initialize the vring. */
1222         vring_init(&vq->vring, num_descs, p, LGUEST_VRING_ALIGN);
1223 
1224         /*
1225          * Append virtqueue to this device's descriptor.  We use
1226          * device_config() to get the end of the device's current virtqueues;
1227          * we check that we haven't added any config or feature information
1228          * yet, otherwise we'd be overwriting them.
1229          */
1230         assert(dev->desc->config_len == 0 && dev->desc->feature_len == 0);
1231         memcpy(device_config(dev), &vq->config, sizeof(vq->config));
1232         dev->num_vq++;
1233         dev->desc->num_vq++;
1234 
1235         verbose("Virtqueue page %#lx\n", to_guest_phys(p));
1236 
1237         /*
1238          * Add to tail of list, so dev->vq is first vq, dev->vq->next is
1239          * second.
1240          */
1241         for (i = &dev->vq; *i; i = &(*i)->next);
1242         *i = vq;
1243 }
1244 
1245 /*
1246  * The first half of the feature bitmask is for us to advertise features.  The
1247  * second half is for the Guest to accept features.
1248  */
1249 static void add_feature(struct device *dev, unsigned bit)
1250 {
1251         u8 *features = get_feature_bits(dev);
1252 
1253         /* We can't extend the feature bits once we've added config bytes */
1254         if (dev->desc->feature_len <= bit / CHAR_BIT) {
1255                 assert(dev->desc->config_len == 0);
1256                 dev->feature_len = dev->desc->feature_len = (bit/CHAR_BIT) + 1;
1257         }
1258 
1259         features[bit / CHAR_BIT] |= (1 << (bit % CHAR_BIT));
1260 }
1261 
1262 /*
1263  * This routine sets the configuration fields for an existing device's
1264  * descriptor.  It only works for the last device, but that's OK because that's
1265  * how we use it.
1266  */
1267 static void set_config(struct device *dev, unsigned len, const void *conf)
1268 {
1269         /* Check we haven't overflowed our single page. */
1270         if (device_config(dev) + len > devices.descpage + getpagesize())
1271                 errx(1, "Too many devices");
1272 
1273         /* Copy in the config information, and store the length. */
1274         memcpy(device_config(dev), conf, len);
1275         dev->desc->config_len = len;
1276 
1277         /* Size must fit in config_len field (8 bits)! */
1278         assert(dev->desc->config_len == len);
1279 }
1280 
1281 /*
1282  * This routine does all the creation and setup of a new device, including
1283  * calling new_dev_desc() to allocate the descriptor and device memory.  We
1284  * don't actually start the service threads until later.
1285  *
1286  * See what I mean about userspace being boring?
1287  */
1288 static struct device *new_device(const char *name, u16 type)
1289 {
1290         struct device *dev = malloc(sizeof(*dev));
1291 
1292         /* Now we populate the fields one at a time. */
1293         dev->desc = new_dev_desc(type);
1294         dev->name = name;
1295         dev->vq = NULL;
1296         dev->feature_len = 0;
1297         dev->num_vq = 0;
1298         dev->running = false;
1299         dev->next = NULL;
1300 
1301         /*
1302          * Append to device list.  Prepending to a single-linked list is
1303          * easier, but the user expects the devices to be arranged on the bus
1304          * in command-line order.  The first network device on the command line
1305          * is eth0, the first block device /dev/vda, etc.
1306          */
1307         if (devices.lastdev)
1308                 devices.lastdev->next = dev;
1309         else
1310                 devices.dev = dev;
1311         devices.lastdev = dev;
1312 
1313         return dev;
1314 }
1315 
1316 /*
1317  * Our first setup routine is the console.  It's a fairly simple device, but
1318  * UNIX tty handling makes it uglier than it could be.
1319  */
1320 static void setup_console(void)
1321 {
1322         struct device *dev;
1323 
1324         /* If we can save the initial standard input settings... */
1325         if (tcgetattr(STDIN_FILENO, &orig_term) == 0) {
1326                 struct termios term = orig_term;
1327                 /*
1328                  * Then we turn off echo, line buffering and ^C etc: We want a
1329                  * raw input stream to the Guest.
1330                  */
1331                 term.c_lflag &= ~(ISIG|ICANON|ECHO);
1332                 tcsetattr(STDIN_FILENO, TCSANOW, &term);
1333         }
1334 
1335         dev = new_device("console", VIRTIO_ID_CONSOLE);
1336 
1337         /* We store the console state in dev->priv, and initialize it. */
1338         dev->priv = malloc(sizeof(struct console_abort));
1339         ((struct console_abort *)dev->priv)->count = 0;
1340 
1341         /*
1342          * The console needs two virtqueues: the input then the output.  When
1343          * they put something the input queue, we make sure we're listening to
1344          * stdin.  When they put something in the output queue, we write it to
1345          * stdout.
1346          */
1347         add_virtqueue(dev, VIRTQUEUE_NUM, console_input);
1348         add_virtqueue(dev, VIRTQUEUE_NUM, console_output);
1349 
1350         verbose("device %u: console\n", ++devices.device_num);
1351 }
1352 /*:*/
1353 
1354 /*M:010
1355  * Inter-guest networking is an interesting area.  Simplest is to have a
1356  * --sharenet=<name> option which opens or creates a named pipe.  This can be
1357  * used to send packets to another guest in a 1:1 manner.
1358  *
1359  * More sophisticated is to use one of the tools developed for project like UML
1360  * to do networking.
1361  *
1362  * Faster is to do virtio bonding in kernel.  Doing this 1:1 would be
1363  * completely generic ("here's my vring, attach to your vring") and would work
1364  * for any traffic.  Of course, namespace and permissions issues need to be
1365  * dealt with.  A more sophisticated "multi-channel" virtio_net.c could hide
1366  * multiple inter-guest channels behind one interface, although it would
1367  * require some manner of hotplugging new virtio channels.
1368  *
1369  * Finally, we could use a virtio network switch in the kernel, ie. vhost.
1370 :*/
1371 
1372 static u32 str2ip(const char *ipaddr)
1373 {
1374         unsigned int b[4];
1375 
1376         if (sscanf(ipaddr, "%u.%u.%u.%u", &b[0], &b[1], &b[2], &b[3]) != 4)
1377                 errx(1, "Failed to parse IP address '%s'", ipaddr);
1378         return (b[0] << 24) | (b[1] << 16) | (b[2] << 8) | b[3];
1379 }
1380 
1381 static void str2mac(const char *macaddr, unsigned char mac[6])
1382 {
1383         unsigned int m[6];
1384         if (sscanf(macaddr, "%02x:%02x:%02x:%02x:%02x:%02x",
1385                    &m[0], &m[1], &m[2], &m[3], &m[4], &m[5]) != 6)
1386                 errx(1, "Failed to parse mac address '%s'", macaddr);
1387         mac[0] = m[0];
1388         mac[1] = m[1];
1389         mac[2] = m[2];
1390         mac[3] = m[3];
1391         mac[4] = m[4];
1392         mac[5] = m[5];
1393 }
1394 
1395 /*
1396  * This code is "adapted" from libbridge: it attaches the Host end of the
1397  * network device to the bridge device specified by the command line.
1398  *
1399  * This is yet another James Morris contribution (I'm an IP-level guy, so I
1400  * dislike bridging), and I just try not to break it.
1401  */
1402 static void add_to_bridge(int fd, const char *if_name, const char *br_name)
1403 {
1404         int ifidx;
1405         struct ifreq ifr;
1406 
1407         if (!*br_name)
1408                 errx(1, "must specify bridge name");
1409 
1410         ifidx = if_nametoindex(if_name);
1411         if (!ifidx)
1412                 errx(1, "interface %s does not exist!", if_name);
1413 
1414         strncpy(ifr.ifr_name, br_name, IFNAMSIZ);
1415         ifr.ifr_name[IFNAMSIZ-1] = '\0';
1416         ifr.ifr_ifindex = ifidx;
1417         if (ioctl(fd, SIOCBRADDIF, &ifr) < 0)
1418                 err(1, "can't add %s to bridge %s", if_name, br_name);
1419 }
1420 
1421 /*
1422  * This sets up the Host end of the network device with an IP address, brings
1423  * it up so packets will flow, the copies the MAC address into the hwaddr
1424  * pointer.
1425  */
1426 static void configure_device(int fd, const char *tapif, u32 ipaddr)
1427 {
1428         struct ifreq ifr;
1429         struct sockaddr_in sin;
1430 
1431         memset(&ifr, 0, sizeof(ifr));
1432         strcpy(ifr.ifr_name, tapif);
1433 
1434         /* Don't read these incantations.  Just cut & paste them like I did! */
1435         sin.sin_family = AF_INET;
1436         sin.sin_addr.s_addr = htonl(ipaddr);
1437         memcpy(&ifr.ifr_addr, &sin, sizeof(sin));
1438         if (ioctl(fd, SIOCSIFADDR, &ifr) != 0)
1439                 err(1, "Setting %s interface address", tapif);
1440         ifr.ifr_flags = IFF_UP;
1441         if (ioctl(fd, SIOCSIFFLAGS, &ifr) != 0)
1442                 err(1, "Bringing interface %s up", tapif);
1443 }
1444 
1445 static int get_tun_device(char tapif[IFNAMSIZ])
1446 {
1447         struct ifreq ifr;
1448         int netfd;
1449 
1450         /* Start with this zeroed.  Messy but sure. */
1451         memset(&ifr, 0, sizeof(ifr));
1452 
1453         /*
1454          * We open the /dev/net/tun device and tell it we want a tap device.  A
1455          * tap device is like a tun device, only somehow different.  To tell
1456          * the truth, I completely blundered my way through this code, but it
1457          * works now!
1458          */
1459         netfd = open_or_die("/dev/net/tun", O_RDWR);
1460         ifr.ifr_flags = IFF_TAP | IFF_NO_PI | IFF_VNET_HDR;
1461         strcpy(ifr.ifr_name, "tap%d");
1462         if (ioctl(netfd, TUNSETIFF, &ifr) != 0)
1463                 err(1, "configuring /dev/net/tun");
1464 
1465         if (ioctl(netfd, TUNSETOFFLOAD,
1466                   TUN_F_CSUM|TUN_F_TSO4|TUN_F_TSO6|TUN_F_TSO_ECN) != 0)
1467                 err(1, "Could not set features for tun device");
1468 
1469         /*
1470          * We don't need checksums calculated for packets coming in this
1471          * device: trust us!
1472          */
1473         ioctl(netfd, TUNSETNOCSUM, 1);
1474 
1475         memcpy(tapif, ifr.ifr_name, IFNAMSIZ);
1476         return netfd;
1477 }
1478 
1479 /*L:195
1480  * Our network is a Host<->Guest network.  This can either use bridging or
1481  * routing, but the principle is the same: it uses the "tun" device to inject
1482  * packets into the Host as if they came in from a normal network card.  We
1483  * just shunt packets between the Guest and the tun device.
1484  */
1485 static void setup_tun_net(char *arg)
1486 {
1487         struct device *dev;
1488         struct net_info *net_info = malloc(sizeof(*net_info));
1489         int ipfd;
1490         u32 ip = INADDR_ANY;
1491         bool bridging = false;
1492         char tapif[IFNAMSIZ], *p;
1493         struct virtio_net_config conf;
1494 
1495         net_info->tunfd = get_tun_device(tapif);
1496 
1497         /* First we create a new network device. */
1498         dev = new_device("net", VIRTIO_ID_NET);
1499         dev->priv = net_info;
1500 
1501         /* Network devices need a recv and a send queue, just like console. */
1502         add_virtqueue(dev, VIRTQUEUE_NUM, net_input);
1503         add_virtqueue(dev, VIRTQUEUE_NUM, net_output);
1504 
1505         /*
1506          * We need a socket to perform the magic network ioctls to bring up the
1507          * tap interface, connect to the bridge etc.  Any socket will do!
1508          */
1509         ipfd = socket(PF_INET, SOCK_DGRAM, IPPROTO_IP);
1510         if (ipfd < 0)
1511                 err(1, "opening IP socket");
1512 
1513         /* If the command line was --tunnet=bridge:<name> do bridging. */
1514         if (!strncmp(BRIDGE_PFX, arg, strlen(BRIDGE_PFX))) {
1515                 arg += strlen(BRIDGE_PFX);
1516                 bridging = true;
1517         }
1518 
1519         /* A mac address may follow the bridge name or IP address */
1520         p = strchr(arg, ':');
1521         if (p) {
1522                 str2mac(p+1, conf.mac);
1523                 add_feature(dev, VIRTIO_NET_F_MAC);
1524                 *p = '\0';
1525         }
1526 
1527         /* arg is now either an IP address or a bridge name */
1528         if (bridging)
1529                 add_to_bridge(ipfd, tapif, arg);
1530         else
1531                 ip = str2ip(arg);
1532 
1533         /* Set up the tun device. */
1534         configure_device(ipfd, tapif, ip);
1535 
1536         /* Expect Guest to handle everything except UFO */
1537         add_feature(dev, VIRTIO_NET_F_CSUM);
1538         add_feature(dev, VIRTIO_NET_F_GUEST_CSUM);
1539         add_feature(dev, VIRTIO_NET_F_GUEST_TSO4);
1540         add_feature(dev, VIRTIO_NET_F_GUEST_TSO6);
1541         add_feature(dev, VIRTIO_NET_F_GUEST_ECN);
1542         add_feature(dev, VIRTIO_NET_F_HOST_TSO4);
1543         add_feature(dev, VIRTIO_NET_F_HOST_TSO6);
1544         add_feature(dev, VIRTIO_NET_F_HOST_ECN);
1545         /* We handle indirect ring entries */
1546         add_feature(dev, VIRTIO_RING_F_INDIRECT_DESC);
1547         set_config(dev, sizeof(conf), &conf);
1548 
1549         /* We don't need the socket any more; setup is done. */
1550         close(ipfd);
1551 
1552         devices.device_num++;
1553 
1554         if (bridging)
1555                 verbose("device %u: tun %s attached to bridge: %s\n",
1556                         devices.device_num, tapif, arg);
1557         else
1558                 verbose("device %u: tun %s: %s\n",
1559                         devices.device_num, tapif, arg);
1560 }
1561 /*:*/
1562 
1563 /* This hangs off device->priv. */
1564 struct vblk_info {
1565         /* The size of the file. */
1566         off64_t len;
1567 
1568         /* The file descriptor for the file. */
1569         int fd;
1570 
1571 };
1572 
1573 /*L:210
1574  * The Disk
1575  *
1576  * The disk only has one virtqueue, so it only has one thread.  It is really
1577  * simple: the Guest asks for a block number and we read or write that position
1578  * in the file.
1579  *
1580  * Before we serviced each virtqueue in a separate thread, that was unacceptably
1581  * slow: the Guest waits until the read is finished before running anything
1582  * else, even if it could have been doing useful work.
1583  *
1584  * We could have used async I/O, except it's reputed to suck so hard that
1585  * characters actually go missing from your code when you try to use it.
1586  */
1587 static void blk_request(struct virtqueue *vq)
1588 {
1589         struct vblk_info *vblk = vq->dev->priv;
1590         unsigned int head, out_num, in_num, wlen;
1591         int ret, i;
1592         u8 *in;
1593         struct virtio_blk_outhdr out;
1594         struct iovec iov[vq->vring.num];
1595         off64_t off;
1596 
1597         /*
1598          * Get the next request, where we normally wait.  It triggers the
1599          * interrupt to acknowledge previously serviced requests (if any).
1600          */
1601         head = wait_for_vq_desc(vq, iov, &out_num, &in_num);
1602 
1603         /* Copy the output header from the front of the iov (adjusts iov) */
1604         iov_consume(iov, out_num, &out, sizeof(out));
1605 
1606         /* Find and trim end of iov input array, for our status byte. */
1607         in = NULL;
1608         for (i = out_num + in_num - 1; i >= out_num; i--) {
1609                 if (iov[i].iov_len > 0) {
1610                         in = iov[i].iov_base + iov[i].iov_len - 1;
1611                         iov[i].iov_len--;
1612                         break;
1613                 }
1614         }
1615         if (!in)
1616                 errx(1, "Bad virtblk cmd with no room for status");
1617 
1618         /*
1619          * For historical reasons, block operations are expressed in 512 byte
1620          * "sectors".
1621          */
1622         off = out.sector * 512;
1623 
1624         /*
1625          * In general the virtio block driver is allowed to try SCSI commands.
1626          * It'd be nice if we supported eject, for example, but we don't.
1627          */
1628         if (out.type & VIRTIO_BLK_T_SCSI_CMD) {
1629                 fprintf(stderr, "Scsi commands unsupported\n");
1630                 *in = VIRTIO_BLK_S_UNSUPP;
1631                 wlen = sizeof(*in);
1632         } else if (out.type & VIRTIO_BLK_T_OUT) {
1633                 /*
1634                  * Write
1635                  *
1636                  * Move to the right location in the block file.  This can fail
1637                  * if they try to write past end.
1638                  */
1639                 if (lseek64(vblk->fd, off, SEEK_SET) != off)
1640                         err(1, "Bad seek to sector %llu", out.sector);
1641 
1642                 ret = writev(vblk->fd, iov, out_num);
1643                 verbose("WRITE to sector %llu: %i\n", out.sector, ret);
1644 
1645                 /*
1646                  * Grr... Now we know how long the descriptor they sent was, we
1647                  * make sure they didn't try to write over the end of the block
1648                  * file (possibly extending it).
1649                  */
1650                 if (ret > 0 && off + ret > vblk->len) {
1651                         /* Trim it back to the correct length */
1652                         ftruncate64(vblk->fd, vblk->len);
1653                         /* Die, bad Guest, die. */
1654                         errx(1, "Write past end %llu+%u", off, ret);
1655                 }
1656 
1657                 wlen = sizeof(*in);
1658                 *in = (ret >= 0 ? VIRTIO_BLK_S_OK : VIRTIO_BLK_S_IOERR);
1659         } else if (out.type & VIRTIO_BLK_T_FLUSH) {
1660                 /* Flush */
1661                 ret = fdatasync(vblk->fd);
1662                 verbose("FLUSH fdatasync: %i\n", ret);
1663                 wlen = sizeof(*in);
1664                 *in = (ret >= 0 ? VIRTIO_BLK_S_OK : VIRTIO_BLK_S_IOERR);
1665         } else {
1666                 /*
1667                  * Read
1668                  *
1669                  * Move to the right location in the block file.  This can fail
1670                  * if they try to read past end.
1671                  */
1672                 if (lseek64(vblk->fd, off, SEEK_SET) != off)
1673                         err(1, "Bad seek to sector %llu", out.sector);
1674 
1675                 ret = readv(vblk->fd, iov + out_num, in_num);
1676                 if (ret >= 0) {
1677                         wlen = sizeof(*in) + ret;
1678                         *in = VIRTIO_BLK_S_OK;
1679                 } else {
1680                         wlen = sizeof(*in);
1681                         *in = VIRTIO_BLK_S_IOERR;
1682                 }
1683         }
1684 
1685         /* Finished that request. */
1686         add_used(vq, head, wlen);
1687 }
1688 
1689 /*L:198 This actually sets up a virtual block device. */
1690 static void setup_block_file(const char *filename)
1691 {
1692         struct device *dev;
1693         struct vblk_info *vblk;
1694         struct virtio_blk_config conf;
1695 
1696         /* Creat the device. */
1697         dev = new_device("block", VIRTIO_ID_BLOCK);
1698 
1699         /* The device has one virtqueue, where the Guest places requests. */
1700         add_virtqueue(dev, VIRTQUEUE_NUM, blk_request);
1701 
1702         /* Allocate the room for our own bookkeeping */
1703         vblk = dev->priv = malloc(sizeof(*vblk));
1704 
1705         /* First we open the file and store the length. */
1706         vblk->fd = open_or_die(filename, O_RDWR|O_LARGEFILE);
1707         vblk->len = lseek64(vblk->fd, 0, SEEK_END);
1708 
1709         /* We support FLUSH. */
1710         add_feature(dev, VIRTIO_BLK_F_FLUSH);
1711 
1712         /* Tell Guest how many sectors this device has. */
1713         conf.capacity = cpu_to_le64(vblk->len / 512);
1714 
1715         /*
1716          * Tell Guest not to put in too many descriptors at once: two are used
1717          * for the in and out elements.
1718          */
1719         add_feature(dev, VIRTIO_BLK_F_SEG_MAX);
1720         conf.seg_max = cpu_to_le32(VIRTQUEUE_NUM - 2);
1721 
1722         /* Don't try to put whole struct: we have 8 bit limit. */
1723         set_config(dev, offsetof(struct virtio_blk_config, geometry), &conf);
1724 
1725         verbose("device %u: virtblock %llu sectors\n",
1726                 ++devices.device_num, le64_to_cpu(conf.capacity));
1727 }
1728 
1729 /*L:211
1730  * Our random number generator device reads from /dev/random into the Guest's
1731  * input buffers.  The usual case is that the Guest doesn't want random numbers
1732  * and so has no buffers although /dev/random is still readable, whereas
1733  * console is the reverse.
1734  *
1735  * The same logic applies, however.
1736  */
1737 struct rng_info {
1738         int rfd;
1739 };
1740 
1741 static void rng_input(struct virtqueue *vq)
1742 {
1743         int len;
1744         unsigned int head, in_num, out_num, totlen = 0;
1745         struct rng_info *rng_info = vq->dev->priv;
1746         struct iovec iov[vq->vring.num];
1747 
1748         /* First we need a buffer from the Guests's virtqueue. */
1749         head = wait_for_vq_desc(vq, iov, &out_num, &in_num);
1750         if (out_num)
1751                 errx(1, "Output buffers in rng?");
1752 
1753         /*
1754          * Just like the console write, we loop to cover the whole iovec.
1755          * In this case, short reads actually happen quite a bit.
1756          */
1757         while (!iov_empty(iov, in_num)) {
1758                 len = readv(rng_info->rfd, iov, in_num);
1759                 if (len <= 0)
1760                         err(1, "Read from /dev/random gave %i", len);
1761                 iov_consume(iov, in_num, NULL, len);
1762                 totlen += len;
1763         }
1764 
1765         /* Tell the Guest about the new input. */
1766         add_used(vq, head, totlen);
1767 }
1768 
1769 /*L:199
1770  * This creates a "hardware" random number device for the Guest.
1771  */
1772 static void setup_rng(void)
1773 {
1774         struct device *dev;
1775         struct rng_info *rng_info = malloc(sizeof(*rng_info));
1776 
1777         /* Our device's privat info simply contains the /dev/random fd. */
1778         rng_info->rfd = open_or_die("/dev/random", O_RDONLY);
1779 
1780         /* Create the new device. */
1781         dev = new_device("rng", VIRTIO_ID_RNG);
1782         dev->priv = rng_info;
1783 
1784         /* The device has one virtqueue, where the Guest places inbufs. */
1785         add_virtqueue(dev, VIRTQUEUE_NUM, rng_input);
1786 
1787         verbose("device %u: rng\n", devices.device_num++);
1788 }
1789 /* That's the end of device setup. */
1790 
1791 /*L:230 Reboot is pretty easy: clean up and exec() the Launcher afresh. */
1792 static void __attribute__((noreturn)) restart_guest(void)
1793 {
1794         unsigned int i;
1795 
1796         /*
1797          * Since we don't track all open fds, we simply close everything beyond
1798          * stderr.
1799          */
1800         for (i = 3; i < FD_SETSIZE; i++)
1801                 close(i);
1802 
1803         /* Reset all the devices (kills all threads). */
1804         cleanup_devices();
1805 
1806         execv(main_args[0], main_args);
1807         err(1, "Could not exec %s", main_args[0]);
1808 }
1809 
1810 /*L:220
1811  * Finally we reach the core of the Launcher which runs the Guest, serves
1812  * its input and output, and finally, lays it to rest.
1813  */
1814 static void __attribute__((noreturn)) run_guest(void)
1815 {
1816         for (;;) {
1817                 unsigned long notify_addr;
1818                 int readval;
1819 
1820                 /* We read from the /dev/lguest device to run the Guest. */
1821                 readval = pread(lguest_fd, &notify_addr,
1822                                 sizeof(notify_addr), cpu_id);
1823 
1824                 /* One unsigned long means the Guest did HCALL_NOTIFY */
1825                 if (readval == sizeof(notify_addr)) {
1826                         verbose("Notify on address %#lx\n", notify_addr);
1827                         handle_output(notify_addr);
1828                 /* ENOENT means the Guest died.  Reading tells us why. */
1829                 } else if (errno == ENOENT) {
1830                         char reason[1024] = { 0 };
1831                         pread(lguest_fd, reason, sizeof(reason)-1, cpu_id);
1832                         errx(1, "%s", reason);
1833                 /* ERESTART means that we need to reboot the guest */
1834                 } else if (errno == ERESTART) {
1835                         restart_guest();
1836                 /* Anything else means a bug or incompatible change. */
1837                 } else
1838                         err(1, "Running guest failed");
1839         }
1840 }
1841 /*L:240
1842  * This is the end of the Launcher.  The good news: we are over halfway
1843  * through!  The bad news: the most fiendish part of the code still lies ahead
1844  * of us.
1845  *
1846  * Are you ready?  Take a deep breath and join me in the core of the Host, in
1847  * "make Host".
1848 :*/
1849 
1850 static struct option opts[] = {
1851         { "verbose", 0, NULL, 'v' },
1852         { "tunnet", 1, NULL, 't' },
1853         { "block", 1, NULL, 'b' },
1854         { "rng", 0, NULL, 'r' },
1855         { "initrd", 1, NULL, 'i' },
1856         { "username", 1, NULL, 'u' },
1857         { "chroot", 1, NULL, 'c' },
1858         { NULL },
1859 };
1860 static void usage(void)
1861 {
1862         errx(1, "Usage: lguest [--verbose] "
1863              "[--tunnet=(<ipaddr>:<macaddr>|bridge:<bridgename>:<macaddr>)\n"
1864              "|--block=<filename>|--initrd=<filename>]...\n"
1865              "<mem-in-mb> vmlinux [args...]");
1866 }
1867 
1868 /*L:105 The main routine is where the real work begins: */
1869 int main(int argc, char *argv[])
1870 {
1871         /* Memory, code startpoint and size of the (optional) initrd. */
1872         unsigned long mem = 0, start, initrd_size = 0;
1873         /* Two temporaries. */
1874         int i, c;
1875         /* The boot information for the Guest. */
1876         struct boot_params *boot;
1877         /* If they specify an initrd file to load. */
1878         const char *initrd_name = NULL;
1879 
1880         /* Password structure for initgroups/setres[gu]id */
1881         struct passwd *user_details = NULL;
1882 
1883         /* Directory to chroot to */
1884         char *chroot_path = NULL;
1885 
1886         /* Save the args: we "reboot" by execing ourselves again. */
1887         main_args = argv;
1888 
1889         /*
1890          * First we initialize the device list.  We keep a pointer to the last
1891          * device, and the next interrupt number to use for devices (1:
1892          * remember that 0 is used by the timer).
1893          */
1894         devices.lastdev = NULL;
1895         devices.next_irq = 1;
1896 
1897         /* We're CPU 0.  In fact, that's the only CPU possible right now. */
1898         cpu_id = 0;
1899 
1900         /*
1901          * We need to know how much memory so we can set up the device
1902          * descriptor and memory pages for the devices as we parse the command
1903          * line.  So we quickly look through the arguments to find the amount
1904          * of memory now.
1905          */
1906         for (i = 1; i < argc; i++) {
1907                 if (argv[i][0] != '-') {
1908                         mem = atoi(argv[i]) * 1024 * 1024;
1909                         /*
1910                          * We start by mapping anonymous pages over all of
1911                          * guest-physical memory range.  This fills it with 0,
1912                          * and ensures that the Guest won't be killed when it
1913                          * tries to access it.
1914                          */
1915                         guest_base = map_zeroed_pages(mem / getpagesize()
1916                                                       + DEVICE_PAGES);
1917                         guest_limit = mem;
1918                         guest_max = mem + DEVICE_PAGES*getpagesize();
1919                         devices.descpage = get_pages(1);
1920                         break;
1921                 }
1922         }
1923 
1924         /* The options are fairly straight-forward */
1925         while ((c = getopt_long(argc, argv, "v", opts, NULL)) != EOF) {
1926                 switch (c) {
1927                 case 'v':
1928                         verbose = true;
1929                         break;
1930                 case 't':
1931                         setup_tun_net(optarg);
1932                         break;
1933                 case 'b':
1934                         setup_block_file(optarg);
1935                         break;
1936                 case 'r':
1937                         setup_rng();
1938                         break;
1939                 case 'i':
1940                         initrd_name = optarg;
1941                         break;
1942                 case 'u':
1943                         user_details = getpwnam(optarg);
1944                         if (!user_details)
1945                                 err(1, "getpwnam failed, incorrect username?");
1946                         break;
1947                 case 'c':
1948                         chroot_path = optarg;
1949                         break;
1950                 default:
1951                         warnx("Unknown argument %s", argv[optind]);
1952                         usage();
1953                 }
1954         }
1955         /*
1956          * After the other arguments we expect memory and kernel image name,
1957          * followed by command line arguments for the kernel.
1958          */
1959         if (optind + 2 > argc)
1960                 usage();
1961 
1962         verbose("Guest base is at %p\n", guest_base);
1963 
1964         /* We always have a console device */
1965         setup_console();
1966 
1967         /* Now we load the kernel */
1968         start = load_kernel(open_or_die(argv[optind+1], O_RDONLY));
1969 
1970         /* Boot information is stashed at physical address 0 */
1971         boot = from_guest_phys(0);
1972 
1973         /* Map the initrd image if requested (at top of physical memory) */
1974         if (initrd_name) {
1975                 initrd_size = load_initrd(initrd_name, mem);
1976                 /*
1977                  * These are the location in the Linux boot header where the
1978                  * start and size of the initrd are expected to be found.
1979                  */
1980                 boot->hdr.ramdisk_image = mem - initrd_size;
1981                 boot->hdr.ramdisk_size = initrd_size;
1982                 /* The bootloader type 0xFF means "unknown"; that's OK. */
1983                 boot->hdr.type_of_loader = 0xFF;
1984         }
1985 
1986         /*
1987          * The Linux boot header contains an "E820" memory map: ours is a
1988          * simple, single region.
1989          */
1990         boot->e820_entries = 1;
1991         boot->e820_map[0] = ((struct e820entry) { 0, mem, E820_RAM });
1992         /*
1993          * The boot header contains a command line pointer: we put the command
1994          * line after the boot header.
1995          */
1996         boot->hdr.cmd_line_ptr = to_guest_phys(boot + 1);
1997         /* We use a simple helper to copy the arguments separated by spaces. */
1998         concat((char *)(boot + 1), argv+optind+2);
1999 
2000         /* Set kernel alignment to 16M (CONFIG_PHYSICAL_ALIGN) */
2001         boot->hdr.kernel_alignment = 0x1000000;
2002 
2003         /* Boot protocol version: 2.07 supports the fields for lguest. */
2004         boot->hdr.version = 0x207;
2005 
2006         /* The hardware_subarch value of "1" tells the Guest it's an lguest. */
2007         boot->hdr.hardware_subarch = 1;
2008 
2009         /* Tell the entry path not to try to reload segment registers. */
2010         boot->hdr.loadflags |= KEEP_SEGMENTS;
2011 
2012         /* We tell the kernel to initialize the Guest. */
2013         tell_kernel(start);
2014 
2015         /* Ensure that we terminate if a device-servicing child dies. */
2016         signal(SIGCHLD, kill_launcher);
2017 
2018         /* If we exit via err(), this kills all the threads, restores tty. */
2019         atexit(cleanup_devices);
2020 
2021         /* If requested, chroot to a directory */
2022         if (chroot_path) {
2023                 if (chroot(chroot_path) != 0)
2024                         err(1, "chroot(\"%s\") failed", chroot_path);
2025 
2026                 if (chdir("/") != 0)
2027                         err(1, "chdir(\"/\") failed");
2028 
2029                 verbose("chroot done\n");
2030         }
2031 
2032         /* If requested, drop privileges */
2033         if (user_details) {
2034                 uid_t u;
2035                 gid_t g;
2036 
2037                 u = user_details->pw_uid;
2038                 g = user_details->pw_gid;
2039 
2040                 if (initgroups(user_details->pw_name, g) != 0)
2041                         err(1, "initgroups failed");
2042 
2043                 if (setresgid(g, g, g) != 0)
2044                         err(1, "setresgid failed");
2045 
2046                 if (setresuid(u, u, u) != 0)
2047                         err(1, "setresuid failed");
2048 
2049                 verbose("Dropping privileges completed\n");
2050         }
2051 
2052         /* Finally, run the Guest.  This doesn't return. */
2053         run_guest();
2054 }
2055 /*:*/
2056 
2057 /*M:999
2058  * Mastery is done: you now know everything I do.
2059  *
2060  * But surely you have seen code, features and bugs in your wanderings which
2061  * you now yearn to attack?  That is the real game, and I look forward to you
2062  * patching and forking lguest into the Your-Name-Here-visor.
2063  *
2064  * Farewell, and good coding!
2065  * Rusty Russell.
2066  */
2067 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp