git clone https://git.kernel.org/pub/scm/virt/kvm/kvm.git
git clone https://github.com/qemu/qemu.git

git clone https://github.com/xen-project/xen.git

void vmx_vmexit_handler(struct cpu_user_regs *regs){
    switch ( exit_reason ){
        case EXIT_REASON_EXCEPTION_NMI: {  // 退出理由是异常/NMI中断，向量号是#UD时
            switch ( vector ) {
                case TRAP_invalid_op:
                    HVMTRACE_1D(TRAP, vector);
                    vmx_vmexit_ud_intercept(regs);
                    ...
static void vmx_vmexit_ud_intercept(struct cpu_user_regs *regs){
    hvm_emulate_prepare(&ctxt, regs);  // 准备模拟环境
    rc = hvm_emulate_one(&ctxt);  // 尝试模拟执行一条指令
    ...
static int _hvm_emulate_one(struct hvm_emulate_ctxt *hvmemul_ctxt,
    const struct x86_emulate_ops *ops)
{
    hvmemul_ctxt->insn_buf_eip = regs->eip;
    if ( !vio->mmio_insn_bytes )  // 这里开始从内存中取指令信息
    {
        hvmemul_ctxt->insn_buf_bytes =
            hvm_get_insn_bytes(curr, hvmemul_ctxt->insn_buf) ?:
            (hvm_virtual_to_linear_addr(x86_seg_cs,
                                        &hvmemul_ctxt->seg_reg[x86_seg_cs],
                                        regs->eip,
                                        sizeof(hvmemul_ctxt->insn_buf),
                                        hvm_access_insn_fetch,
                                        hvmemul_ctxt->ctxt.addr_size,
                                        &addr) &&
             hvm_fetch_from_guest_virt_nofault(hvmemul_ctxt->insn_buf, addr,
                                               sizeof(hvmemul_ctxt->insn_buf),
                                               pfec) == HVMCOPY_okay) ?
            sizeof(hvmemul_ctxt->insn_buf) : 0;
    }...
    rc = x86_emulate(&hvmemul_ctxt->ctxt, ops);

// 不允许设置的标志位，可见_PAGE_PSE可设置
base_disallow_mask = ~(_PAGE_PRESENT|_PAGE_RW|_PAGE_USER|_PAGE_ACCESSED|_PAGE_DIRTY|_PAGE_AVAIL);
#define L2_DISALLOW_MASK (base_disallow_mask & ~_PAGE_PSE)

// xen-4.4.0 xen/arch/x86/mm.c
static int mod_l2_entry(l2_pgentry_t *pl2e, l2_pgentry_t nl2e, unsigned long pfn, int preserve_ad, struct vcpu *vcpu)
{
    // 检查1: 属于Guest
    if ( unlikely(!is_guest_l2_slot(d, type, pgentry_ptr_to_slot(pl2e))) )
    {
        MEM_LOG("Illegal L2 update attempt in Xen-private area %p", pl2e);
        return -EPERM;
    }
    // 检查2：PDE.P ?= 1
    if ( l2e_get_flags(nl2e) & _PAGE_PRESENT )
    {
        // 检查3：检查nl2e的标志位里保留位 ?= 0，这里可设置PSE
        if ( unlikely(l2e_get_flags(nl2e) & L2_DISALLOW_MASK) )
        {
            MEM_LOG("Bad L2 flags %x", l2e_get_flags(nl2e) & L2_DISALLOW_MASK);
            return -EINVAL;
        }

        // 检查4: ol2e.addr|.P ?= nl2e.addr|.P，需要这两项相等
        if ( !l2e_has_changed(ol2e, nl2e, _PAGE_PRESENT) )
        {
            adjust_guest_l2e(nl2e, d);
            // 更新
            if ( UPDATE_ENTRY(l2, pl2e, ol2e, nl2e, pfn, vcpu, preserve_ad) )
                return 0;
            return -EBUSY;
        }

diff --git a/hw/acpi_piix4.c b/hw/acpi_piix4.c
index 96f522233a..6c908ff00b 100644
@@ -471,11 +471,13 @@ static void pciej_write(void *opaque, uint32_t addr, uint32_t val)
     QLIST_FOREACH_SAFE(qdev, &bus->children, sibling, next) {
         dev = DO_UPCAST(PCIDevice, qdev, qdev);
-        if (PCI_SLOT(dev->devfn) == slot) {
+        info = container_of(qdev->info, PCIDeviceInfo, qdev);
+        if (PCI_SLOT(dev->devfn) == slot && !info->no_hotplug) {
             qdev_free(qdev);
         }
     }

typedef struct RTCState {
    ISADevice dev;
    ...
    QEMUTimer *periodic_timer;  // periodic timer
    int64_t next_second_time;  // second update
    QEMUTimer *second_timer;
    QEMUTimer *second_timer2;
} RTCState;

struct QEMUTimer {
    QEMUClock *clock;   // 所属时钟
    int64_t expire_time;    // 纳秒级的到期时间，时钟到达指定时间会调用该计时器的回调函数
    int scale;
    QEMUTimerCB *cb;  // 到期时调用的回调函数
    void *opaque;  // 回调函数的参数
    struct QEMUTimer *next;
};

static int rtc_initfn(ISADevice *dev)
{
    RTCState *s = DO_UPCAST(RTCState, dev, dev);
    ...
    // 创建计数器，注意这里的第三个参数，opaque指向RTCState
    s->second_timer = qemu_new_timer_ns(rtc_clock, rtc_update_second, s);  
    s->second_timer2 = qemu_new_timer_ns(rtc_clock, rtc_update_second2, s);
    s->next_second_time = qemu_get_clock_ns(rtc_clock) + (get_ticks_per_sec() * 99) / 100;
    // 将计数器插入时钟链表里
    qemu_mod_timer(s->second_timer2, s->next_second_time);
    ...
}

main()
  =>main_loop()
     =>main_loop_wait(nonblocking)
       =>qemu_run_all_timers()
         =>qemu_run_timers(host_clock) // rtc

static void qemu_run_timers(QEMUClock *clock)
{
    current_time = qemu_get_clock_ns(clock);
    ptimer_head = &active_timers[clock->type];
    for(;;) {
        ts = *ptimer_head;
        if (!qemu_timer_expired_ns(ts, current_time)) {  // 由于是按过期时间排序，未过期则退出循环
            break;
        }
        *ptimer_head = ts->next;
        ts->next = NULL;
        ts->cb(ts->opaque);  // 调用
    }
}

static void rtc_update_second2(void *opaque)
{
    RTCState *s = opaque;
        ...
    s->next_second_time += get_ticks_per_sec();
    qemu_mod_timer(s->second_timer, s->next_second_time);  // 将second_timer插入时钟的计时器链表中
}

static void fdctrl_write (void *opaque, uint32_t reg, uint32_t value)
{
    FDCtrl *fdctrl = opaque;
    reg &= 7;  // 0X3FX&7
    switch (reg) {
        case FD_REG_FIFO:  // FD_REG_FIFO = 0x05
            fdctrl_write_data(fdctrl, value);
            break;
    ...
static void fdctrl_write_data(FDCtrl *fdctrl, uint32_t value)
{
    /* 检查主状态寄存器，需要处于如下状态：
    FD_MSR_RQM: FIFO能交换数据
    FD_MSR_DIO: FIFO能读取数据
    */
    if (!(fdctrl->msr & FD_MSR_RQM) || (fdctrl->msr & FD_MSR_DIO)) {
        return;
    }
    ...
    if (fdctrl->data_pos == 0) {  // 数据位置为0时，说明开始处理新的命令，value为命令号
        pos = command_to_handler[value & 0xff];  // 获取命令handler
        fdctrl->data_len = handlers[pos].parameters + 1;  // 数据长度为参数个数加一，记下来可看到数据位0为
        fdctrl->msr |= FD_MSR_CMDBUSY;  // 设置当前主状态寄存器为CMDBUSY状态
    }

    fdctrl->fifo[fdctrl->data_pos++] = value;  // 由于第一次时value为命令号，之后才是参数，因此
    if (fdctrl->data_pos == fdctrl->data_len) {  // 参数接收完成，开始处理
        pos = command_to_handler[fdctrl->fifo[0] & 0xff];
        (*handlers[pos].handler)(fdctrl, handlers[pos].direction);
    }
}

enum{
    FD_CMD_DRIVE_SPECIFICATION_COMMAND = 0x8e
    ...
};

static const struct {
    uint8_t value;
    uint8_t mask;
    const char* name;
    int parameters;  // 参数个数
    void (*handler)(FDCtrl *fdctrl, int direction);  //处理函数
    int direction;
} handlers[] = {
    ...
    { FD_CMD_DRIVE_SPECIFICATION_COMMAND, 0xff, "DRIVE SPECIFICATION COMMAND", 5, fdctrl_handle_drive_specification_command },
    ...
};

static void fdctrl_handle_drive_specification_command(FDCtrl *fdctrl, int direction)
{
    FDrive *cur_drv = get_cur_drv(fdctrl);
    if (fdctrl->fifo[fdctrl->data_pos - 1] & 0x80) {  // 这里是最后一个参数，Guest可控因此可不满足条件
        /* Command parameters done */
        if (fdctrl->fifo[fdctrl->data_pos - 1] & 0x40) {
            fdctrl->fifo[0] = fdctrl->fifo[1];
            fdctrl->fifo[2] = 0;
            fdctrl->fifo[3] = 0;
            fdctrl_set_fifo(fdctrl, 4);  // data_pos = 0;
        } else {
            fdctrl_reset_fifo(fdctrl);  // data_pos = 0; msr &= ~(FD_MSR_CMDBUSY | FD_MSR_DIO);
        }
    } else if (fdctrl->data_len > 7) {  // 这里的判断错误，由上可知参数5个加1应该是不大于6，因此这个地方也进不去
        fdctrl_set_fifo(fdctrl, 1);
    }
    // 于是到这里，fdctrl->data_pos不会被清除，MSR的状态也不会改变
}

struct QEMUBH {
    AioContext *ctx;
    QEMUBHFunc *cb; 
    void *opaque;
    QEMUBH *next;
    bool scheduled;
    bool idle;
    bool deleted;
};

static void nvme_init_sq(NvmeSQueue *sq, NvmeCtrl *n, uint64_t dma_addr, uint16_t sqid, uint16_t cqid, uint16_t size){
    sq->io_req = g_new(NvmeRequest, sq->size);  // 此处分配了一些req，具体个数Guest可控，此处没有初始化它
    QTAILQ_INIT(&sq->req_list);
    for (i = 0; i < sq->size; i++) {
        sq->io_req[i].sq = sq;
        QTAILQ_INSERT_TAIL(&(sq->req_list), &sq->io_req[i], entry);  // 插入列表
    }
    sq->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, nvme_process_sq, sq);  // 加入定时任务，注意这里还在堆上创建了个QEMUTimer对象
    ...
}
static void nvme_process_sq(void *opaque){  // 定时处理SQ里的请求
    while (!(nvme_sq_empty(sq) || QTAILQ_EMPTY(&sq->req_list))) {
        ...
        status = sq->sqid ? nvme_io_cmd(n, &cmd, req) : nvme_admin_cmd(n, &cmd, req);  // 循环从SQ队列里获取命令，并根据类型进行处理
}}
static uint16_t nvme_io_cmd(NvmeCtrl *n, NvmeCmd *cmd, NvmeRequest *req){
    switch (cmd->opcode) {
    case NVME_CMD_WRITE:
    case NVME_CMD_READ:
        return nvme_rw(n, ns, cmd, req); // 对读写命令，跟入
}}
static uint16_t nvme_rw(NvmeCtrl *n, NvmeNamespace *ns, NvmeCmd *cmd, NvmeRequest *req){
    nvme_map_prp(&req->qsg, &req->iov, prp1, prp2, data_size, n); //继续
}
static uint16_t nvme_map_prp(QEMUSGList *qsg, QEMUIOVector *iov, uint64_t prp1, uint64_t prp2, uint32_t len, NvmeCtrl *n){
    if (unlikely(!prp1)) {...} else if (n->bar.cmbsz && prp1 >= n->ctrl_mem.addr && prp1 < n->ctrl_mem.addr + int128_get64(n->ctrl_mem.size)) {
        // 若prp1指向控制内存，则使用iov
        qsg->nsg = 0;
        qemu_iovec_init(iov, num_prps);
        qemu_iovec_add(iov, (void *)&n->cmbuf[prp1 - n->ctrl_mem.addr], trans_len);
    } else { // 否则使用sgl
        pci_dma_sglist_init(qsg, &n->parent_obj, num_prps);
        qemu_sglist_add(qsg, prp1, trans_len);
    }
    len -= trans_len;
    if (len) {
        if (unlikely(!prp2)) {  // prp2为0即可
            goto unmap;
 unmap:
    qemu_sglist_destroy(qsg);  // 这里只处理qsg，但若走前一个分支则并没有初始化qsg(至少在该函数内部未初始化)
}
void qemu_sglist_destroy(QEMUSGList *qsg)
{
    object_unref(OBJECT(qsg->dev));
    g_free(qsg->sg);  // 释放了qsg->sg的内存
    memset(qsg, 0, sizeof(*qsg));
}

static void virtio_gpu_handle_ctrl(VirtIODevice *vdev, VirtQueue *vq){
    while (cmd) {
        ...
        QTAILQ_INSERT_TAIL(&g->cmdq, cmd, next);
        cmd = virtqueue_pop(vq, sizeof(struct virtio_gpu_ctrl_command));
    }
    virtio_gpu_process_cmdq(g);
}
void virtio_gpu_process_cmdq(VirtIOGPU *g){
    while (!QTAILQ_EMPTY(&g->cmdq)) {
        cmd = QTAILQ_FIRST(&g->cmdq);
        VIRGL(g, virtio_gpu_virgl_process_cmd, virtio_gpu_simple_process_cmd,
              g, cmd);  // 展开为 virtio_gpu_simple_process_cmd(g, cmd);
        ...
    }
}
static void virtio_gpu_simple_process_cmd(VirtIOGPU *g, struct virtio_gpu_ctrl_command *cmd){
    VIRTIO_GPU_FILL_CMD(cmd->cmd_hdr);
    switch (cmd->cmd_hdr.type) {
    case VIRTIO_GPU_CMD_RESOURCE_UNREF:
        virtio_gpu_resource_unref(g, cmd);
        break;
    case VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING:  // 分配
        virtio_gpu_resource_attach_backing(g, cmd);
        break;
    case VIRTIO_GPU_CMD_RESOURCE_DETACH_BACKING:  // 释放
        virtio_gpu_resource_detach_backing(g, cmd);
        break;}
}
static void virtio_gpu_resource_attach_backing(VirtIOGPU *g, struct virtio_gpu_ctrl_command *cmd){
    VIRTIO_GPU_FILL_CMD(ab);  // 展开为iov_to_buf(cmd->elem.out_sg, cmd->elem.out_num, 0, &ab, sizeof(ab));
    res = virtio_gpu_find_resource(g, ab.resource_id);
    ret = virtio_gpu_create_mapping_iov(&ab, cmd, &res->iov);  // 映射GPA到HVA
}
int virtio_gpu_create_mapping_iov(struct virtio_gpu_resource_attach_backing *ab, struct virtio_gpu_ctrl_command *cmd, struct iovec **iov){
    struct virtio_gpu_mem_entry *ents;  // 16字节(指针8+长度4+填充4)
    esize = sizeof(*ents) * ab->nr_entries;  // nr_entries大小可控
    ents = g_malloc(esize);
    s = iov_to_buf(cmd->elem.out_sg, cmd->elem.out_num,  sizeof(*ab), ents, esize);
    *iov = g_malloc0(sizeof(struct iovec) * ab->nr_entries);  // iov16字节(指针8+大小8)
    for (i = 0; i < ab->nr_entries; i++) {
        hwaddr len = ents[i].length;
        (*iov)[i].iov_len = ents[i].length;
        (*iov)[i].iov_base = cpu_physical_memory_map(ents[i].addr, &len, 1);  // GPA->HVA
    }
    g_free(ents);  // 申请了两个释放了一个
}

uint32_t vga_mem_readb(VGACommonState *s, hwaddr addr)  // 期待读一字节
{
    int memory_map_mode, plane;
    uint32_t ret;

    memory_map_mode = (s->gr[VGA_GFX_MISC] >> 2) & 3;  /// 显存映射类型
    addr &= 0x1ffff;  // 这里限制了偏移最大为 0x1ffff，即128K
    switch(memory_map_mode) {  
      case 0:    // 为128K
          break;
      case 1:  // 为64K
          if (addr >= 0x10000)
              return 0xff;
          addr += s->bank_offset;  // 最大值为0xffffff=0xffff+0xff0000
          break;
            ...
    }
        ...
    } else {
        // 注意这里计算时，转换了指针类型，因此可访问到(0xffffff+1)*4=64M的内存，即越界48M
        s->latch = ((uint32_t *)s->vram_ptr)[addr];  

        if (!(s->gr[VGA_GFX_MODE] & 0x08)) {  // 读模式为0时，直接返回该平面
            /* read mode 0 */
            plane = s->gr[VGA_GFX_PLANE_READ]; // 获取要读的平面 0～3
            ret = GET_PLANE(s->latch, plane);  // 获取这一字节的数据
                    ...
    }
    return ret;
}

//默认的vga-pci下配置，显存为16M
DEFINE_PROP_UINT32("vgamem_mb", PCIVGAState, vga.vram_size_mb, 16),

s->vram_size_mb = uint_clamp(s->vram_size_mb, 1, 512);
s->vram_size_mb = pow2ceil(s->vram_size_mb);
s->vram_size = s->vram_size_mb << 20;

s->vbe_bank_mask = (s->vram_size >> 16) - 1;

void vbe_ioport_write_data(void *opaque, uint32_t addr, uint32_t val)
{
    VGACommonState *s = opaque;
    switch(s->vbe_index) {
      case VBE_DISPI_INDEX_BANK:  // 切换BANK映射
        if (s->vbe_regs[VBE_DISPI_INDEX_BPP] == 4) {
          val &= (s->vbe_bank_mask >> 2);
        } else {
          val &= s->vbe_bank_mask;  // 这里的掩码为0xff=((16<<20)>>16)-1
        }
        s->vbe_regs[s->vbe_index] = val;
        s->bank_offset = (val << 16);  // 最大为0xff0000=(0xff<<16)
        vga_update_memory_access(s);  // 重新映射
        break;

typedef enum
{
    VBOXVDMACMD_TYPE_UNDEFINED         = 0,
    VBOXVDMACMD_TYPE_DMA_PRESENT_BLT   = 1,  // 漏洞点1
    VBOXVDMACMD_TYPE_DMA_BPB_TRANSFER,       // 漏洞点2
    ...
} VBOXVDMACMD_TYPE;

vbvaChannelHandler(void *pvHandler, uint16_t u16ChannelInfo, void *pvBuffer, HGSMISIZE cbBuffer)
    => vboxVDMACommand(pVGAState->pVdma, pCmd, cbBuffer - VBoxSHGSMIBufferHeaderSize());
            => vboxVDMACommandProcess(pVdma, pCmd, cbCmd);
            => vboxVDMACmdExec(pVdma, pvBuf, pCmd->cbBuf);

static int vboxVDMACmdExec(PVBOXVDMAHOST pVdma, const uint8_t *pvBuffer, uint32_t cbBuffer)
{
    PVBOXVDMACMD pCmd = (PVBOXVDMACMD)pvBuffer; // 循环处理命令
    switch (pCmd->enmType)
    {
      case VBOXVDMACMD_TYPE_DMA_BPB_TRANSFER:
        {
          // 获取命令体，它由Guest指定
          const PVBOXVDMACMD_DMA_BPB_TRANSFER pTransfer = VBOXVDMACMD_BODY(pCmd, VBOXVDMACMD_DMA_BPB_TRANSFER);
          int cbTransfer = vboxVDMACmdExecBpbTransfer(pVdma, pTransfer, cbBuffer);
          ...
}

static int vboxVDMACmdExecBpbTransfer(PVBOXVDMAHOST pVdma, const PVBOXVDMACMD_DMA_BPB_TRANSFER pTransfer, uint32_t cbBuffer)
{
    PVGASTATE pVGAState = pVdma->pVGAState;
    uint8_t * pvRam = pVGAState->vram_ptrR3;
    uint32_t cbTransfer = pTransfer->cbTransferSize;  // 要传输的大小
    uint32_t cbTransfered = 0;
    do
    {
        uint32_t cbSubTransfer = cbTransfer;
        if (pTransfer->fFlags & VBOXVDMACMD_DMA_BPB_TRANSFER_F_SRC_VRAMOFFSET)
        {
            pvSrc  = pvRam + pTransfer->Src.offVramBuf + cbTransfered;  // VRAM基地址固定，偏移Guest指定，因此可指定任意地址
        }
                ...

        if (pTransfer->fFlags & VBOXVDMACMD_DMA_BPB_TRANSFER_F_DST_VRAMOFFSET)
        {
            pvDst  = pvRam + pTransfer->Dst.offVramBuf + cbTransfered;  // 同上，注意偏移为uint64类型，可溢出到低位
        }
                ...
        if (RT_SUCCESS(rc))
        {
            memcpy(pvDst, pvSrc, cbSubTransfer);  // 复制
            cbTransfer -= cbSubTransfer;
            cbTransfered += cbSubTransfer;
        }
    } while (cbTransfer);
        ...
}

if (pClient->PathDelimiter != RTPATH_DELIMITER) 
{ 
    while (*src) // 会一直遍历下去直到遇到\x00
    { 
        if (*src == pClient->PathDelimiter) 
        *src = RTPATH_DELIMITER;   // 若后面的数据和用户指定的字符一致则修改为"\"符号
        src++; 
    }

#define VMMDEV_CREDENTIALS_SZ_SIZE          128

typedef struct
{
    VMMDevRequestHeader header;
    uint32_t u32Flags; /** IN/OUT: Request flags. */
    char szUserName[VMMDEV_CREDENTIALS_SZ_SIZE];  /** OUT: User name (UTF-8). */
    char szPassword[VMMDEV_CREDENTIALS_SZ_SIZE];  /** OUT: Password (UTF-8). */
    char szDomain[VMMDEV_CREDENTIALS_SZ_SIZE];  /** OUT: Domain name (UTF-8). */
} VMMDevCredentials;

static DECLCALLBACK(int) vmmdevIPort_SetCredentials(PPDMIVMMDEVPORT pInterface, const char *pszUsername,
                                                    const char *pszPassword, const char *pszDomain, uint32_t fFlags)
{
    PVMMDEV pThis = RT_FROM_MEMBER(pInterface, VMMDEV, IPort);
    if (fFlags & VMMDEV_SETCREDENTIALS_GUESTLOGON)
    {
        strcpy(pThis->pCredentials->Logon.szUserName, pszUsername);  // 缓冲区溢出
        strcpy(pThis->pCredentials->Logon.szPassword, pszPassword);
        strcpy(pThis->pCredentials->Logon.szDomain,   pszDomain);
        pThis->pCredentials->Logon.fAllowInteractiveLogon = !(fFlags & VMMDEV_SETCREDENTIALS_NOLOCALLOGON);
    }
    ... 
}