虚拟化：Intel VMCS揭秘

Intel的VMX定义了一套支持硬件辅助虚拟化的机制，包括一个硬件的数据结构VMCS（VM control data structure）以及一系列新的VMX的指令，其中包括了操作VMCS的若干指令，例如vmread，用于读取VMCS的字段；vmwrite用于写入VMCS的字段。

VMCS是物理内存的一个4KB页面（4KB对齐），包含了6个区域，guest/host状态，VM运行控制，VM entry控制，VM exit控制以及VM exit的信息。

按理说可以直接通过内存的操作来操作VMCS的相应区域，但是Intel明确要求需要用vmread/vmwrite来读写相应区域和字段，因为VMCS的layout是随着CPU架构而进行改变的，不同的CPU可能使用不同的VMCS layout，所以直接访问某个内存偏移是不具有准确性和兼容性的。

而且，按照Intel一贯的风格，VMCS的layout是没有公布出来的，this seems a secret。

但是，好奇心作祟！这个VMCS layout到底是什么样的呢，例如guest的状态到底存在VMCS这个4KB内存的什么位置呢？

我做了一个kernel module，来找出VMCS的layout。下面显示的是Intel Sandybridge的VMCS layout的一部分，仅供参考。

in sandybridge physical host, it shows.

[ 4840.029135] [i] vmx supported cpu.

[ 4841.029145] [i] msr 0x3a: lock bit is on. vmxon bit is on. ok

[ 4840.029147] [i] revision id: 0x00000010

[ 4840.029163] # vpid = 0x2f0

[ 4840.029167] # pi_notification_vector = 0x44

[ 4840.029171] # eptp_index na

[ 4840.029172] # g_es_select = 0x200

[ 4840.029173] # g_cs_select = 0x218

[ 4840.029175] # g_ss_select = 0x230

[ 4840.029176] # g_ds_select = 0x248

[ 4840.029177] # g_fs_select = 0x260

[ 4840.029178] # g_gs_select = 0x278

[ 4840.029179] # g_ldtr_select = 0x290

[ 4840.029180] # g_tr_select = 0x2a8

[ 4840.029181] # g_interrupt_status = 0x2a8

[ 4840.029183] # h_es_select = 0x300

[ 4840.029184] # h_cs_select = 0x304

[ 4840.029185] # h_ss_select = 0x308

[ 4840.029186] # h_ds_select = 0x30c

[ 4840.029187] # h_fs_select = 0x310

[ 4840.029188] # h_gs_select = 0x314

[ 4840.029189] # h_tr_select = 0x318

[ 4840.029190] # io_bmap_a = 0xa0

[ 4840.029192] # io_bmap_a_hi = 0xa4

[ 4840.029193] # io_bmap_b = 0xa8

[ 4840.029194] # io_bmap_b_hi = 0xac

[ 4840.029195] # msr_bmap = 0xb0

[ 4840.029196] # msr_bmap_hi = 0xb4

[ 4840.029198] # exit_msr_store_addr = 0xb8

[ 4840.029199] # exit_msr_store_addr_hi = 0xbc

[ 4840.029200] # exit_msr_load_addr = 0xc0

[ 4840.029201] # exit_msr_load_addr_hi = 0xc4

[ 4840.029203] # entry_msr_load_addr = 0xc8

[ 4840.029204] # entry_msr_load_addr_hi = 0xcc

[ 4840.029205] # exec_vmcs_ptr = 0xd0

[ 4840.029206] # exec_vmcs_ptr_hi = 0xd4

[ 4840.029208] # tsc_offset = 0xd8

[ 4840.029209] # tsc_offset_hi = 0xdc

[ 4840.029210] # virt_apic_page_addr = 0xe0

[ 4840.029211] # virt_apic_page_addr_hi = 0xe4

[ 4840.029213] # apic_access_addr = 0x78

[ 4840.029214] # apic_access_addr_hi = 0x7c

[ 4840.029215] # pi_desc_addr = 0x50

[ 4840.029217] # pi_desc_addr_hi = 0x54

就是说在Intel Sandybridge里面MSR_bitmap是位于VMCS的偏移量0xb0处，IO_BITMAP位于0xa0，和0xa8的位置。

而在最近的Skylake上IO_BITMAP分别位于0x2c8和0x2d0的位置。

可见不同的CPU，VMCS的layout的确不同，不能直接通过某个固定偏移访问VMCS来获取相应的字段。