VMCB和VMCS比较
来自Intel和amd手册
VMCB 介绍
• VMRUN takes, as a single argument, the
physical address of a 4KB-aligned page, the
virtual machine control block (VMCB), which
describes a virtual machine (guest) to be
executed.
VMCB contains
• a list of instructions or events in the guest
(e.g., write to CR3) to intercept,
• various control bits that specify the execution
environment of the guest or that indicate
special actions to be taken before running
guest code
• guest processor state (such as control registers,
etc.).
Layout of VMCB
• The VMCB is divided into two areas—the first
one contains various control bits including the
intercept vector ,and the second one contains
saved guest state.
control area
• The control area is padded to a size of 1024
bytes. All unused bytes must be zero, as they
are reserved for future expansion. It is
recommended that software “bzero” any
newly allocated VMCB.
• 见手册A2中的 table b-1
state-save area
• The state-save area within the VMCB starts at
offset 400h into the VMCB page
• 见A2中的table b-2
SVM Intercept Exit Codes
• When the VMRUN instruction exits (back to
the host), an exit/reason code is stored in the
EXITCODE field in the VMCB. Intercept exit
codes 0h–89h equal the bit position of the
corresponding flag in the VMCB’s intercept
vector.
• 见A2中的table c-1
VMCS overview
• Each logical processor associates a region in
memory with each VMCS. This region is called
the VMCS region . Software references a
specific VMCS by using the 64-bit physical
address of the region; such an address is
called a VMCS pointer.
VMCS介绍
• VT-x为每个VM设计了一个控制结构VMCS来
保存VM和VMM的信息。
• 执行VM entry指令时将VMM的状态保存到
VMCS的host area，并加载相应VM的VMCS
guest area 到CPU 中。(由硬件实现 ，具体代
码分析见vmcs.h)
• 同理，执行VM exit时则将当前VM状态保存
到VMCS guest area中，并加载VMCS到CPU
中。
整个VM entry和VM exit的过程
• VMCS根据物理地址寻址，VT-x定义了一系
列新的指令集，可以直接访问VMCS
• VMM可以对不同的VMCS分别设置不同的虚
拟机退出条件，从而实现对不同VM的不同
虚拟化策略。
FORMAT OF THE VMCS REGION
ORGANIZATION OF VMCS DATA
•
•
•
•
•
•
Guest-state area.
Host-state area.
VM-execution control fields.
VM-exit control fields.
VM-entry control fields.
VM-exit information fields.
Guest-state area
• Processor state is saved into the guest-state
area on VM exits and loaded from there on
VM entries.
• 包括 Guest Register State和Guest NonRegister State
Guest Register State
The following fields in the guest-state area
correspond to processor registers:
• Control registers（ CR0, CR3, and CR4）
• Debug register DR7
• RSP, RIP, and RFLAGS
• The following fields for each of the registers
CS, SS, DS, ES, FS, GS, LDTR（ Selector (16 bits)，
Base address，Segment limit (32 bits)，
Access rights (32 bits).）
Guest Non-Register State
• the guest-state area includes the following
fields that characterize guest state but which
do not correspond to processor registers:
• Activity state (32 bits).
• Interruptibility state (32 bits).
• Pending debug exceptions
• VMCS link pointer
（具体format见vol.3 20-7）
Activity state (32 bits)
— 0: Active. The logical processor is executing
instructions normally.
— 1: HLT. The logical processor is inactive because it
executed the HLT instruction.
— 2: Shutdown. The logical processor is inactive
because it incurred a triple fault2 or some other
serious error.
— 3: Wait-for-SIPI. The logical processor is inactive
because it is waiting for a startup-IPI (SIPI).
HOST-STATE AREA
• All fields in the host-state area correspond to
processor registers:
• CR0, CR3, and CR4
• RSP and RIP
• Selector fields (16 bits each) for the segment
registers CS, SS, DS, ES, FS, GS, and TR.
• Base-address fields for FS, GS, TR, GDTR, and IDTR
• The following MSRs:（IA32_SYSENTER_CS (32
bits）；IA32_PERF_GLOBAL_CTRL）
VM-execution control fields
• These fields control processor behavior in
VMX non-root operation. They determine in
part the causes of VM exits.
a)
Pin-Based VM-Execution Controls
b)
Processor-Based VM-Execution Controls
(具体见 vol.3 20-10)
VM-exit control fields
• These fields control VM exits
a) VM-Exit Controls
b) VM-Exit Controls for MSRs
VM-Exit Controls for MSRs
• The following VM-exit control fields determine
how MSRs are stored on VM exits:(VM-exit
MSR-store count (32 bits); VM-exit MSR-store
address; VM-exit MSR-load count (32 bits);
VM-exit MSR-load address)
VM-ENTRY CONTROL FIELDS
• The VM-entry control fields govern the
behavior of VM entries
a) VM-Entry Controls
b) VM-Entry Controls for MSRs
c) VM-Entry Controls for Event Injection
VM-Entry Controls for MSRs
• A VMM may specify a list of MSRs to be
loaded on VM entries. The following VM-entry
control fields manage this functionality:(VMentry MSR-load count (32 bits); VM-entry
MSR-load address)
VM-Entry Controls for Event Injection
• VM entry can be configured to conclude by
delivering an event through the guest IDT
(after all guest state and MSRs have been
loaded).(VM-entry interruption-information
field (32 bits); VM-entry exception error code
(32 bits); VM-entry instruction length (32
bits))
VM-EXIT INFORMATION FIELDS
• The VMCS contains a section of read-only
fields that contain information about the most
recent VM exit.
• Exit reason (32 bits). This field encodes the
reason for the VM exit