Merge pull request #47 from sysprog21/arm-virtio-net

End-to-end network for Arm/virtio

Author: jserv

README.md

@@ -10,6 +10,13 @@ capable of running Linux kernel partially.
 
 ## Build and Run
 
+A working C toolchain plus the kernel build prerequisites (`flex`, `bison`, and
+the `libelf` development headers) are required. On Debian/Ubuntu:
+```shell
+$ sudo apt install -y flex bison libelf-dev
+```
+Other distributions provide equivalent packages.
+
 Fetch required submodules (only necessary for ARM build):
 ```shell
 git submodule update --init --recursive
@@ -33,17 +40,75 @@ make check
 
 ## Usage
 
+### Start Emulator
+
 ```
-build/kvm-host -k bzImage [-i initrd] [-d disk-image]
+$ build/kvm-host -k bzImage [-i initrd] [-d disk-image]
 ```
 
 `bzImage` is the path to linux kernel bzImage. The bzImage file is in a specific format,
 containing concatenated `bootsect.o + setup.o + misc.o + piggy.o`. `initrd` is the path to
 initial RAM disk image, which is an optional argument.
 `disk-image` is the path to disk image which can be mounted as a block device via virtio. For the reference Linux guest, ext4 filesystem is used for disk image.
 
+### Exit Emulator
+
 To exit kvm-host, press "Ctrl-A", release both keys, and then press "x".
 
+### Test the Guest virtio-net Interface
+
+The guest is reachable from the host through a dedicated bridge
+(`kvmbr0` by default) that owns the TAP interface kvm-host creates at
+startup. The bridge is a host-guest link only — no internet egress —
+so the helpers never modify the host's default route.
+
+1. Start `kvm-host` and locate the TAP it created. `kvm-host` requests
+   `tap%d` from `TUNSETIFF`, so the kernel assigns the first free
+   `tapN`; it is usually but not always `tap0`. The interface comes up
+   `DOWN` because nothing has claimed it yet:
+
+   ```shell
+   $ ip a
+   ...
+   11: tap0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
+       link/ether 5a:1d:bd:2d:7c:1f brd ff:ff:ff:ff:ff:ff
+   ```
+
+2. From the host, run `scripts/set-host-bridge.sh [TAP] [BRIDGE]`. It
+   creates `kvmbr0`, assigns `10.0.0.1/24`, and enslaves the TAP. If
+   the bridge already exists the script reuses it; if a non-bridge
+   interface owns the name it refuses to proceed. Override `TAP` if
+   the kernel handed kvm-host a different name in step 1:
+
+   ```shell
+   $ ./scripts/set-host-bridge.sh           # uses tap0 + kvmbr0
+   $ ./scripts/set-host-bridge.sh tap1      # if kvm-host got tap1
+   $ ip a
+   ...
+   11: tap0:   <BROADCAST,MULTICAST,UP,LOWER_UP> ...
+   12: kvmbr0: <BROADCAST,MULTICAST,UP,LOWER_UP> ...
+       inet 10.0.0.1/24 scope global kvmbr0
+   ```
+
+3. Inside the guest, paste the contents of `scripts/set-guest-route.sh`
+   to assign `10.0.0.2/24`:
+
+   ```shell
+   $ ip a
+   ...
+   2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> ...
+       inet 10.0.0.2/24 scope global eth0
+   ```
+
+4. Verify connectivity from the guest:
+
+   ```shell
+   $ ping 10.0.0.1
+   ```
+
+   For traffic beyond `10.0.0.0/24`, configure NAT and IPv4 forwarding
+   on the host first; the helpers stop at the host-guest link.
+
 ## License
 
 `kvm-host` is released under the BSD 2 clause license. Use of this source code is governed by
@@ -52,7 +117,7 @@ a BSD-style license that can be found in the LICENSE file.
 ## References
 * [kvmtool](https://github.com/kvmtool/kvmtool)
 * [KVM (Kernel-based Virtual Machine) API](https://www.kernel.org/doc/Documentation/virtual/kvm/api.txt)
-* [The Linux/x86 Boot Protocol](https://www.kernel.org/doc/html/latest/x86/boot.html)
+* [The Linux/x86 Boot Protocol](https://www.kernel.org/doc/html/latest/arch/x86/boot.html)
 * [Using the KVM API](https://lwn.net/Articles/658511/)
 * [gokvm](https://github.com/bobuhiro11/gokvm)
 * [KVM Host in a few lines of code](https://zserge.com/posts/kvm/)

configs/linux-arm64.config

@@ -12,7 +12,7 @@ CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 # CONFIG_MULTIUSER is not set
 # CONFIG_SYSFS_SYSCALL is not set
 # CONFIG_FHANDLE is not set
-# CONFIG_POSIX_TIMERS is not set
+CONFIG_POSIX_TIMERS=y
 # CONFIG_BUG is not set
 CONFIG_BASE_SMALL=y
 # CONFIG_FUTEX is not set
@@ -65,3 +65,11 @@ CONFIG_EXT4_FS=y
 # CONFIG_DEBUG_MISC is not set
 # CONFIG_FTRACE is not set
 # CONFIG_STRICT_DEVMEM is not set
+CONFIG_NET=y
+CONFIG_INET=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_NETDEVICES=y
+CONFIG_VIRTIO=y
+CONFIG_VIRTIO_NET=y

scripts/set-guest-route.sh

@@ -0,0 +1,15 @@
+#!/bin/sh
+# Configure the guest's virtio-net interface so it can reach the host
+# bridge created by set-host-bridge.sh. Paste these commands at the
+# guest shell; the BusyBox initramfs does not ship the script itself.
+#
+# No default route is installed: the host bridge is a dedicated
+# host-guest link, not an internet gateway, and pointing default
+# traffic at it would silently black-hole everything outside
+# 10.0.0.0/24. Add NAT/forwarding on the host first if you want the
+# guest reaching beyond the bridge.
+
+set -eu
+
+ip addr replace 10.0.0.2/24 dev eth0
+ip link set eth0 up

scripts/set-host-bridge.sh

@@ -0,0 +1,48 @@
+#!/bin/sh
+# Bring up a host-side bridge and enslave the kvm-host TAP interface
+# to it so the guest can ping the host. Run after kvm-host has created
+# its TAP. The bridge is dedicated to this 10.0.0.0/24 link; the
+# script never touches the host's default route.
+#
+# Usage: set-host-bridge.sh [TAP] [BRIDGE]
+#   TAP     defaults to "tap0". kvm-host opens the first free
+#           tap%d via TUNSETIFF, so this may be tap1, tap2, ...
+#           if the host already has a tap0. Check `ip a` after
+#           starting kvm-host and pass the actual name if it
+#           differs.
+#   BRIDGE  defaults to "kvmbr0". The script refuses to touch a
+#           bridge it did not create, so picking a dedicated name
+#           protects pre-existing br0/virbr0/etc.
+
+set -eu
+
+TAP=${1:-tap0}
+BRIDGE=${2:-kvmbr0}
+ADDR=10.0.0.1/24
+
+if ip link show "$BRIDGE" >/dev/null 2>&1; then
+    # `ip link show NAME type bridge` does not filter by type when a name
+    # is given, so probe the kernel's bridge sysfs directory instead.
+    if [ ! -d "/sys/class/net/$BRIDGE/bridge" ]; then
+        echo "set-host-bridge: '$BRIDGE' exists and is not a bridge; refusing to touch it" >&2
+        exit 1
+    fi
+    # The bridge already exists. Reuse it instead of deleting so we
+    # don't disturb other slaves (libvirt, containers, ...) that may
+    # share the name.
+    echo "set-host-bridge: reusing existing bridge '$BRIDGE'" >&2
+else
+    sudo ip link add name "$BRIDGE" type bridge
+fi
+
+if ! ip -o addr show dev "$BRIDGE" | grep -q " ${ADDR%/*}/"; then
+    sudo ip addr add "$ADDR" dev "$BRIDGE"
+fi
+sudo ip link set "$BRIDGE" up
+
+if ! ip link show "$TAP" >/dev/null 2>&1; then
+    echo "set-host-bridge: TAP '$TAP' does not exist; start kvm-host first" >&2
+    exit 1
+fi
+sudo ip link set "$TAP" master "$BRIDGE"
+sudo ip link set "$TAP" up

src/arch/arm64/vm.c

@@ -142,6 +142,13 @@ int vm_arch_init_platform_device(vm_t *v)
     if (serial_init(&v->serial, &v->io_bus))
         return throw_err("Failed to init UART device");
 
+    /* Zero virtio_blk_dev so pci_dev_is_registered() observes a clean
+     * state when the user boots without -d. virtio_net_init memsets
+     * inside vm_enable_net, so virtio_net_dev is covered by that path.
+     * x86 already does the same call in its vm_arch_init_platform_device.
+     */
+    virtio_blk_init(&v->virtio_blk_dev);
+
     if (finalize_irqchip(v) < 0)
         return -1;
 
@@ -218,6 +225,11 @@ static int get_mpidr(vm_t *v, uint64_t *mpidr)
     return 0;
 }
 
+static bool pci_dev_is_registered(struct pci_dev *dev)
+{
+    return dev->config_dev.len == PCI_CFG_SPACE_SIZE;
+}
+
 /* The phandle of interrupt controller */
 #define FDT_PHANDLE_GIC 1
 
@@ -376,12 +388,14 @@ static int generate_fdt(vm_t *v)
          cpu_to_fdt64(ARM_PCI_MMIO_BASE), cpu_to_fdt64(ARM_PCI_MMIO_SIZE)},
     };
     __FDT(property, "ranges", &pci_ranges, sizeof(pci_ranges));
-    /* interrupt-map contains the interrupt mapping between the PCI device and
-     * the IRQ number of interrupt controller.
-     * virtio-blk is the only PCI device.
+    /* interrupt-map routes each PCI device's INTA# to a GIC SPI so the
+     * guest can wire up MSI-less virtio devices. One entry per emulated
+     * PCI function.
      */
     struct virtio_blk_dev *virtio_blk = &v->virtio_blk_dev;
     struct pci_dev *virtio_blk_pci = (struct pci_dev *) virtio_blk;
+    struct virtio_net_dev *virtio_net = &v->virtio_net_dev;
+    struct pci_dev *virtio_net_pci = (struct pci_dev *) virtio_net;
     struct {
         uint32_t pci_hi;
         uint64_t pci_addr;
@@ -390,16 +404,35 @@ static int generate_fdt(vm_t *v)
         uint32_t gic_type;
         uint32_t gic_irqn;
         uint32_t gic_irq_type;
-    } __attribute__((packed)) pci_irq_map[] = {{
-        cpu_to_fdt32(virtio_blk_pci->config_dev.base & ~(1UL << 31)),
-        0,
-        cpu_to_fdt32(1),
-        cpu_to_fdt32(FDT_PHANDLE_GIC),
-        cpu_to_fdt32(ARM_FDT_IRQ_TYPE_SPI),
-        cpu_to_fdt32(VIRTIO_BLK_IRQ),
-        cpu_to_fdt32(ARM_FDT_IRQ_EDGE_TRIGGER),
-    }};
-    __FDT(property, "interrupt-map", &pci_irq_map, sizeof(pci_irq_map));
+    } __attribute__((packed)) pci_irq_map[2];
+    size_t pci_irq_map_len = 0;
+
+    if (pci_dev_is_registered(virtio_blk_pci)) {
+        pci_irq_map[pci_irq_map_len++] = (__typeof__(pci_irq_map[0])) {
+            cpu_to_fdt32(virtio_blk_pci->config_dev.base & ~(1UL << 31)),
+            0,
+            cpu_to_fdt32(1),
+            cpu_to_fdt32(FDT_PHANDLE_GIC),
+            cpu_to_fdt32(ARM_FDT_IRQ_TYPE_SPI),
+            cpu_to_fdt32(VIRTIO_BLK_IRQ),
+            cpu_to_fdt32(ARM_FDT_IRQ_EDGE_TRIGGER),
+        };
+    }
+    if (pci_dev_is_registered(virtio_net_pci)) {
+        pci_irq_map[pci_irq_map_len++] = (__typeof__(pci_irq_map[0])) {
+            cpu_to_fdt32(virtio_net_pci->config_dev.base & ~(1UL << 31)),
+            0,
+            cpu_to_fdt32(1),
+            cpu_to_fdt32(FDT_PHANDLE_GIC),
+            cpu_to_fdt32(ARM_FDT_IRQ_TYPE_SPI),
+            cpu_to_fdt32(VIRTIO_NET_IRQ),
+            cpu_to_fdt32(ARM_FDT_IRQ_EDGE_TRIGGER),
+        };
+    }
+    if (pci_irq_map_len > 0) {
+        __FDT(property, "interrupt-map", &pci_irq_map,
+              pci_irq_map_len * sizeof(pci_irq_map[0]));
+    }
     __FDT(end_node); /* End of /pci node */
 
     /* Finalize the device tree */