VMX: Difference between revisions

=== Basic environment ===

Software should enable bit 13 of CR4 (CR4.VMXE) first. Here are a few definitions of some used MSR's that we'll be dealing with:

#define IA32_VMX_BASIC 0x480

#define IA32_VMX_CR0_FIXED0 0x486

#define IA32_VMX_CR4_FIXED0 0x488

#define IA32_VMX_CR4_FIXED1 0x489

 

In order to see what your OS needs to support, you need to read the lower 32-bits of IA32_VMX_CR0_FIXED0 and IA32_VMX_CR4_FIXED0. The bits in those MSR's are what need to be set (and supported) in their corresponding control registers (CR0/CR4). If any of those bits are not enabled, a GPF will occur. Also, to see what extra bits can be set, check the IA32_VMX_CR0_FIXED1 and IA32_VMX_CR4_FIXED1. It's basically a mask of bits, if a bit is set to 1, then it "can" be enabled, but if it's a 0, you may generate an exception if you enable the corresponding bit in the control registers.

=== Executing VMXON ===

The main entry point for using VMX is through the VMXON instruction. The instruction requires a single operand of a m64 region called the VMXON region. The memory region needs to be 4096-byte aligned (bits 0-11 must be 0) and the only VMCS field that should be modified is the VMCS revision identification field. This ID field should contain the value in bits 0-31 of MSR IA32_VMX_BASIC. In order to prepare a memory address in 32-bit PMode for use as an m64, some modifications need to be made. The upper 32-bits of the m64 on non long mode capable processors have to be 0 or an "invalid memory address" error will occur and a VMEXIT will be called.

uint32_t * region = (uint32_t *)allocate_4k_aligned(4096);

uint64_t region64 = (uint64_t)((size_t)(region) & 0xFFFFFFFF);

asm volatile(" vmxon %0; "::"m" (region64));

 

This general process of taking a 32-bit memory address and turning it into a psuedo-64bit int (unsigned long long) will be used for all m64 operands later. VMCLEAR is another example instruction that requires the upper 32-bits of a memory address to be 0.

A VMCS is loaded with the VMPTRLD instruction, which loads and activates a VMCS, and requires a 64-bit memory address as it's operand in the same format as VMXON/VMCLEAR.

 

asm volatile ("vmptrld %0; ":: "m" (vmcsRegion64));

 

The structure of the VMCS is covered in detail in Chapter 20 of the Intel SDM volume 3B (see link below). Field encodings for VMWRITE and VMREAD are covered in Appendix H of the same manual.

VMX provides two kinds of EPT involved vm exits: EPT violation and EPT misconfiguration. In general, when guest is accessing memory which is not backed correctly(e.g. the memory is '''writable''' but '''not readable'''!), VMX results in vm exits with EPT misconfiguration.

the hypervisor must do the following steps to do MMIO operation:

1). decode the memory move instruction to determine the memory involved instruction length, access size, direction, operations, registers index/immediates and memory address,

2). search the MMIO devices regions to see whether the address is backed with a DEVICE.

3). store the result in destination register if necessary.

4). advance to next instruction by adding guest RIP with instruction length resolved in step 1.

 

=== Devices emulation examples===

 

[[Category:X86]]