virtualbox-原理构架分析

1,PATM.cpp

PATM.h

2, PATMa.asm

3,em.cpp

4,em.h

5,vm.cpp

6,vm.h

7.vm

虚机创建:

VMMR3DECL(int) VMR3Create(uint32_t cCpus, PCVMM2USERMETHODS pVmm2UserMethods,

PFNVMATERROR pfnVMAtError, void *pvUserVM,

PFNCFGMCONSTRUCTOR pfnCFGMConstructor, void *pvUserCFGM,

PVM *ppVM)

{

……

static int vmR3CreateUVM(uint32_t cCpus, PCVMM2USERMETHODS pVmm2UserMethods, PUVM *ppUVM)

{

uint32_t i;

}

…….

DECLCALLBACK(int) vmR3EmulationThread(RTTHREAD ThreadSelf, void *pvArgs)

{

PUVMCPU pUVCpu = (PUVMCPU)pvArgs;

return vmR3EmulationThreadWithId(ThreadSelf, pUVCpu, pUVCpu->idCpu);

}

……

VMMR3DECL(int) EMR3ExecuteVM(PVM pVM, PVMCPU pVCpu)

{

…………….

rc2 = PATMAreInterruptsEnabled(pVM) ? VINF_EM_RESCHEDULE_RAW : VINF_EM_RESCHEDULE_REM;

……………………

VMMR3DECL(int) PATMR3InstallPatch(PVM pVM, RTRCPTR pInstrGC, uint64_t flags)

{

Jump back to guest if IF=1, else fault

;

BEGINPROC PATMJumpToGuest_IF1

PATMJumpToGuest_IF1_Start:

mov dword [ss:PATM_INTERRUPTFLAG], 0

pushf

test dword [ss:PATM_VMFLAGS], X86_EFL_IF

jnz PATMJumpToGuest_IF1_Safe

nop

; IF=0 -> unsafe, so fault

popf

mov dword [ss:PATM_INTERRUPTFLAG], 1

PATM_INT3

PATMJumpToGuest_IF1_Safe:

; IF=1 -> we can safely jump back to the original instruction

popf

mov dword [ss:PATM_INTERRUPTFLAG], 1

DB 0xE9

PATMJumpToGuest_IF1_Jump:

DD PATM_JUMPDELTA

PATMJumpToGuest_IF1_End:

ENDPROC PATMJumpToGuest_IF1

; Patch record for call instructions

PATM_JUMPDELTA在补丁代码生成时会被提换为虚拟机中被打补丁的下一条指令以PATM开头的标签都会在补丁代码生成时被替换成相应的地址或变量的值

全局定义类:

VBoxGlobal.h

1,虚拟化分类:

一,基于软件虚拟化:

1,解释执行;2,扫描与修补技术3,BT技术qemu,vmware

二,硬件辅助虚拟化,

三,类/泛/半虚拟化(xen)

Ring0—ring3技术;

Vm.cpp

Gmm-- Global Memory Manager, ring-3 request wrappers.

Em.cpp :EM - Execution Monitor / Manager.

static int emR3RemExecute(PVM pVM, PVMCPU pVCpu, bool *pfFFDone)

{

Executes recompiled code.

This function contains the recompiler version of the inner

* execution loop (the outer loop being in EMR3ExecuteVM()).

* Execute VM.

* This function is the main loop of the VM. The emulation thread

* calls this function when the VM has been successfully constructed

* and we're ready for executing the VM.

*

* Returning from this function means that the VM is turned off or

* suspended (state already saved) and deconstruction in next in line.

VMMR3DECL(int) EMR3ExecuteVM(PVM pVM, PVMCPU pVCpu)

{

…………………………

VMEmt.cpp: Virtual Machine, The Emulation Thread.

The emulation thread main function, with Virtual CPU ID for debugging.

int vmR3EmulationThreadWithId(RTTHREAD ThreadSelf, PUVMCPU pUVCpu, VMCPUID idCpu) {

PUVM pUVM = pUVCpu->pUVM;

Startvm___>

int main (int argc, char **argv, char **envp)

{ for (int i = 1; i < argc; i++)

{

/* NOTE: the check here must match the corresponding check for the

* options to start a VM in hardenedmain.cpp and VBoxGlobal.cpp exactly,

* otherwise there will be weird error messages. */

if ( !::strcmp(argv[i], "--startvm")

|| !::strcmp(argv[i], "-startvm"))

return TrustedMain (argc, argv, envp);

}---------------→

extern "C" DECLEXPORT(int) TrustedMain (int argc, char **argv, char ** /*envp*/)

{

LogFlowFuncEnter();

rc = RTThreadCreate(&thread, VMPowerUpThread, 0, 0, RTTHREADTYPE_MAIN_WORKER, 0, "PowerUp");

…rc = VMR3Create(1, NULL, setVMErrorCallback, NULL, vboxbfeConfigConstructor, NULL, &gpVM);

if (RT_FAILURE(rc))

}------→

static int vmR3CreateUVM(uint32_t cCpus, PCVMM2USERMETHODS pVmm2UserMethods, PUVM *ppUVM)

{

………………………..

DECLCALLBACK(int) vmR3EmulationThread(RTTHREAD ThreadSelf, void *pvArgs)

{

PUVMCPU pUVCpu = (PUVMCPU)pvArgs;

return vmR3EmulationThreadWithId(ThreadSelf, pUVCpu, pUVCpu->idCpu);

}

-----------------→

/**

* The emulation thread main function, with Virtual CPU ID for debugging.

*/

int vmR3EmulationThreadWithId(RTTHREAD ThreadSelf, PUVMCPU pUVCpu, VMCPUID idCpu)

{

* The request loop.

*/

rc = VINF_SUCCESS;

for (;;)

{

/*

rc = EMR3ExecuteVM(pVM, pVCpu);

Log(("vmR3EmulationThread: EMR3ExecuteVM() -> rc=%Rrc,

}

}

} /* forever */

}

-------------------→

static int emR3RemExecute(PVM pVM, PVMCPU pVCpu, bool *pfFFDone)

{

Vmmr0.cpp --→gvmmr0.cpp--→SUPDrv.c----vbox-Pci.c---底层驱动文件(RTSemFastMutexCreate)

VMMRC.cpp * VMM - Raw-mode Context.

* CSAM - Guest OS Code Scanning and Analysis Manager

扫描主函数:

* Execute VM.

*

* This function is the main loop of the VM. The emulation thread

* calls this function when the VM has been successfully constructed

* and we're ready for executing the VM.

VMMR3DECL(int) EMR3ExecuteVM(PVM pVM, PVMCPU pVCpu)

{….}

执行扫描主函数:

int vmR3EmulationThreadWithId(RTTHREAD ThreadSelf, PUVMCPU pUVCpu, VMCPUID idCpu)

{

PUVM pUVM = pUVCpu->pUVM;

for (;;)

{ rc = EMR3ExecuteVM(pVM, pVCpu);

Log(("vmR3EmulationThread: EMR3ExecuteVM() -> rc=%Rrc, enmVMState=%d\n", rc, pVM->enmVMState));

if (EMGetState(pVCpu) == EMSTATE_GURU_MEDITATION)

vmR3SetGuruMeditation(pVM);

}

}

} /* forever */

}

---EMR3ExecuteVM-----→vmR3EmulationThreadWithId

-----------------→vmR3EmulationThread-------------------→RTThreadCreateF------------→--vmR3CreateUVM-----→ VMR3Create-----→VMPowerUpThread------→RTThreadCreate---→

TrustedMain--- main() (main.cpp * VBox frontends: Qt GUI ("VirtualBox"): * The main() function )

另外还有: int main(int argc, char **argv) (VboxSDL.cpp)

{

return TrustedMain(argc, argv, NULL);

}

int main(int argc, char **argv, char **envp) (vboxnetnat.cpp)

{

return TrustedMain(argc, argv, envp);

}

Main entry point.

*/

int main(int argc, char **argv) (vboxbfe.cpp)

{

return TrustedMain(argc, argv, NULL);

}

int main(int argc, char **argv, char **envp) (vboxheadless.cpp)

{

// initialize VBox Runtime

int rc = RTR3InitAndSUPLib();

return TrustedMain(argc, argv, envp);

}

int main(int argc, char **argv, char **envp) (vboxnetdhcp.cpp)

{

int rc = RTR3InitAndSUPLib();

return TrustedMain(argc, argv, envp);

}

* Start the emulation threads for all VMCPUs.

*/

for (i = 0; i < cCpus; i++)

{

rc = RTThreadCreateF(&pUVM->aCpus[i].vm.s.ThreadEMT, vmR3EmulationThread, &pUVM->aCpus[i], _1M,

RTTHREADTYPE_EMULATION, RTTHREADFLAGS_WAITABLE,

cCpus > 1 ? "EMT-%u" : "EMT", i);

if (RT_FAILURE(rc))

break;

/**

* Executes one (or perhaps a few more) instruction(s).

*

* @returns VBox status code suitable for EM.*/

static int emR3ExecuteInstructionWorker(PVM pVM, PVMCPU pVCpu, int rcGC, const char *pszPrefix)

patch过程:

CPUMR3RawEnter(pVCpu, NULL);----→PATMRawEnter(pVM, pCtxCore);---→VMMR3DECL(int) PATMR3InstallPatch(PVM pVM, RTRCPTR pInstrGC, uint64_t flags)--→ static int patmDuplicateFunction(PVM pVM, RTRCPTR pInstrGC, PPATMPATCHREC pPatchRec, PPATMP2GLOOKUPREC pCacheRec)--→int patmPatchGenSetPIF(PVM pVM, PPATCHINFO pPatch, RTRCPTR pInstrGC)------→size = patmPatchGenCode(pVM, pPatch, pPB, &PATMSetPIFRecord, 0, false); ----→ PATMSetPIFRecord --→ GLOBALNAME PATMSetPIFRecord

RTCCPTR_DEF PATMSetPIF_Start

DD 0

DD 0

DD 0

DD PATMSetPIF_End - PATMSetPIF_Start

DD 1

DD PATM_INTERRUPTFLAG

DD 0

DD 0ffffffffh

int main(int argc, char **argv)

{

return TrustedMain(argc, argv, NULL);

} ----→extern "C" DECLEXPORT(int) TrustedMain (int argc, char **argv, char **envp)

{ ---→DECLCALLBACK(int) VMPowerUpThread(RTTHREAD Thread, void *pvUser)

{ --→- VMMR3DECL(int) VMR3Create(uint32_t cCpus, PCVMM2USERMETHODS ..)< Creates a virtual machine by calling the supplied configuration constructor.

*

* On successful returned the VM is powered, i.e. VMR3PowerOn() should be

* called to start the execution.>

---→static int vmR3CreateUVM(uint32_t cCpus, PCVMM2USERMETHODS pVmm2UserMethods, PUVM *ppUVM)

{ -----→DECLCALLBACK(int) vmR3EmulationThread(RTTHREAD ThreadSelf, void *pvArgs)

{ ---→int vmR3EmulationThreadWithId(RTTHREAD ThreadSelf, PUVMCPU pUVCpu, VMCPUID idCpu)

{ -------→VMMR3DECL(int) EMR3ExecuteVM(PVM pVM, PVMCPU pVCpu)< Execute VM>

{ -----→static int emR3RemExecute(PVM pVM, PVMCPU pVCpu, bool *pfFFDone)< Executes recompiled code. This function contains the recompiler version of the inner

* execution loop (the outer loop being in EMR3ExecuteVM()).>

{ ---→int emR3ForcedActions(PVM pVM, PVMCPU pVCpu, int rc)

{ ----→VMMR3DECL(int) TRPMR3InjectEvent(PVM pVM, PVMCPU pVCpu, TRPMEVENT enmEvent)

{ ------→VMMR3DECL(int) CSAMR3CheckGates(PVM pVM, uint32_t iGate, uint32_t cGates) { -----→static int CSAMR3AnalyseCallback(PVM pVM, DISCPUSTATE *pCpu, RCPTRTYPE(uint8_t *) pInstrGC, RCPTRTYPE(uint8_t *) pCurInstrGC,

PCSAMP2GLOOKUPREC pCacheRec, void *pUserData)

{ ----→VMMR3DECL(int) PATMR3InstallPatch(PVM pVM, RTRCPTR pInstrGC, uint64_t flags) { ---→VMMR3DECL(int) PATMR3PatchBlock(PVM pVM, RTRCPTR pInstrGC, R3PTRTYPE(uint8_t *) pInstrHC,

uint32_t uOpcode, uint32_t uOpSize, PPATMPATCHREC pPatchRec)

{ --→ static int patmRecompileCallback(PVM pVM, DISCPUSTATE *pCpu, RCPTRTYPE(uint8_t *) pInstrGC, RCPTRTYPE(uint8_t *) pCurInstrGC, PPATMP2GLOOKUPREC pCacheRec) ----→patmPatchGenClearInhibitIRQ(PVM pVM, PPATCHINFO pPatch, RTRCPTR pNextInstrGC) { ---→ size = patmPatchGenCode(pVM, pPatch, pPB, &PATMClearInhibitIRQContIF0Record, 0, false, &callInfo); --→GLOBALNAME PATMClearInhibitIRQContIF0Record

RTCCPTR_DEF PATMClearInhibitIRQContIF0_Start

DD 0

DD 0

DD 0

DD PATMClearInhibitIRQContIF0_End - PATMClearInhibitIRQContIF0_Start

DD 11

DD PATM_INTERRUPTFLAG

DD 0

DD PATM_INHIBITIRQADDR

DD 0

DD PATM_VMFLAGS

DD 0

DD PATM_VM_FORCEDACTIONS DD 0

DD PATM_TEMP_EAX

DD 0

DD PATM_TEMP_ECX

DD 0

DD PATM_TEMP_EDI

DD 0

DD PATM_TEMP_RESTORE_FLAGS DD 0

DD PATM_PENDINGACTION

DD 0

DD PATM_NEXTINSTRADDR

DD 0

DD PATM_INTERRUPTFLAG

DD 0

DD 0ffffffffh

Os-image

VMM KERNEL