VMCB 和 VMCS 比较

1. VMCB和VMCS比较 来自Intel和amd手册

2. VMCB 介绍 • VMRUN takes, as a single argument, the physicaladdress of a 4KB-aligned page, the virtual machine control block (VMCB), which describes a virtualmachine (guest) to be executed.

3. VMCBcontains • a list of instructions or events in the guest (e.g., write to CR3) to intercept, • various control bits that specify the execution environment of the guest or that indicate specialactions to be taken before running guest code • guest processor state (such as control registers, etc.).

4. Layout of VMCB • The VMCB is divided into two areas—the first one contains various control bits including the intercept vector ,and the second one contains saved guest state.

5. control area • The control area is padded to a size of 1024 bytes. All unused bytes must be zero, as they are reserved for future expansion. It is recommended that software “bzero” any newly allocated VMCB. • 见手册A2中的 tableb-1

6. state-save area • The state-save area within the VMCB starts at offset 400h into the VMCB page • 见A2中的tableb-2

7. SVM Intercept Exit Codes • When the VMRUN instruction exits (back to the host), an exit/reason code is stored in the EXITCODE field in the VMCB. Intercept exit codes 0h–89h equal the bitposition of the corresponding flag in the VMCB’s intercept vector. • 见A2中的tablec-1

8. VMCSoverview • Each logical processor associates a region in memory with each VMCS. This region iscalled the VMCS region.Software references a specific VMCS by using the 64-bitphysical address of the region; such an address is called a VMCS pointer.

9. VMCS介绍 • VT-x为每个VM设计了一个控制结构VMCS来保存VM和VMM的信息。 • 执行VMentry指令时将VMM的状态保存到VMCS的hostarea，并加载相应VM的VMCSguestarea 到CPU 中。(由硬件实现 ，具体代码分析见vmcs.h)

10. 同理，执行VMexit时则将当前VM状态保存到VMCSguestarea中，并加载VMCS到CPU中。同理，执行VMexit时则将当前VM状态保存到VMCSguestarea中，并加载VMCS到CPU中。

11. 整个VMentry和VMexit的过程

12. VMCS根据物理地址寻址，VT-x定义了一系列新的指令集，可以直接访问VMCSVMCS根据物理地址寻址，VT-x定义了一系列新的指令集，可以直接访问VMCS

13. VMM可以对不同的VMCS分别设置不同的虚拟机退出条件，从而实现对不同VM的不同虚拟化策略。VMM可以对不同的VMCS分别设置不同的虚拟机退出条件，从而实现对不同VM的不同虚拟化策略。

14. FORMAT OF THE VMCS REGION

15. ORGANIZATION OF VMCS DATA • Guest-state area. • Host-state area. • VM-execution control fields. • VM-exit control fields. • VM-entry control fields. • VM-exit information fields.

16. Guest-state area • Processor state is saved into the guest-state area onVM exits and loaded from there on VM entries. • 包括 Guest Register State和Guest Non-Register State

17. Guest Register State The following fields in the guest-state area correspond to processor registers: • Control registers（ CR0, CR3, and CR4） • Debug register DR7 • RSP, RIP, and RFLAGS • The following fields for each of the registers CS, SS, DS, ES, FS, GS, LDTR（ Selector (16 bits)， Base address，Segment limit (32 bits)， Access rights (32 bits).）

18. Guest Non-Register State • the guest-state areaincludes the following fields that characterize guest state but which do not correspondto processor registers: • Activity state (32 bits). • Interruptibility state (32 bits). • Pending debug exceptions • VMCS link pointer （具体format见vol.320-7）

19. Activity state (32 bits) — 0: Active. The logical processor is executing instructions normally. — 1: HLT. The logical processor is inactive because it executed the HLTinstruction. — 2: Shutdown. The logical processor is inactive because it incurred a triplefault2 or some other serious error. — 3: Wait-for-SIPI. The logical processor is inactive because it is waiting for astartup-IPI (SIPI).

20. HOST-STATE AREA • All fields in the host-state area correspond to processor registers: • CR0, CR3, and CR4 • RSP and RIP • Selector fields (16 bits each) for the segment registers CS, SS, DS, ES, FS, GS,and TR. • Base-address fields for FS, GS, TR, GDTR, and IDTR • The following MSRs:（IA32_SYSENTER_CS (32 bits）；IA32_PERF_GLOBAL_CTRL）

21. VM-execution control fields • These fields control processor behavior in VMX non-root operation. They determine in part the causes of VM exits. • Pin-Based VM-Execution Controls • Processor-Based VM-Execution Controls (具体见 vol.3 20-10)

22. VM-exit control fields • These fields control VM exits • VM-Exit Controls • VM-Exit Controls for MSRs

23. VM-Exit Controls for MSRs • The following VM-exit control fields determine how MSRs are stored on VM exits:(VM-exit MSR-store count (32 bits); VM-exit MSR-store address; VM-exit MSR-load count (32 bits); VM-exit MSR-load address)

24. VM-ENTRY CONTROL FIELDS • The VM-entry control fields govern the behavior of VM entries • VM-Entry Controls • VM-Entry Controls for MSRs • VM-Entry Controls for Event Injection

25. VM-Entry Controls for MSRs • A VMM may specify a list of MSRs to be loaded on VM entries. The following VM-entry control fields manage this functionality:(VM-entry MSR-load count (32 bits); VM-entry MSR-load address)

26. VM-Entry Controls for Event Injection • VM entry can be configured to conclude by delivering an event through the guest IDT (after all guest state and MSRs have been loaded).(VM-entry interruption-information field (32 bits); VM-entry exception error code (32 bits); VM-entry instruction length (32 bits))

27. VM-EXIT INFORMATION FIELDS • The VMCS contains a section of read-only fields that contain information about the most recent VM exit. • Exit reason (32 bits). This field encodes the reason for the VM exit