cs6465 Advanced OS - Lecture 03 - Intel VMX (part 2)
Watch on YouTube →
Overview
Anton Burtsev explains how Intel VMX gives a hypervisor fine-grained control over guest execution, including exception, I/O-port, and MSR exits, and how nested page tables reduce the need to intercept guest page faults. He distinguishes fault-like exits, where an instruction has not executed, from trap-like exits, where it has, then details interrupt-window handling, interrupt injection through VMCS fields, and the different host-delivery paths for maskable and non-maskable interrupts.
Key takeaways
- EPT separates guest virtual-to-physical translation from guest-physical-to-host translation, allowing guest page faults to remain inside the guest when the hypervisor does not need to intercept them.
- VMX fault-like exits occur before the triggering instruction executes, while trap-like exits report after execution; that distinction determines whether the hypervisor must emulate an instruction or respond to its completed effects.
- Interrupt-window exiting avoids expensive guest single-stepping: the hypervisor resumes a guest with interrupts disabled and regains control when the guest becomes interruptible.
- Guest interrupt injection is configured through VM-entry interruption information, but the hypervisor must check guest readiness or VM entry can fail.
- Acknowledging a maskable interrupt on VM exit transfers dispatch responsibility to host code, while leaving it unacknowledged lets the host APIC deliver it through the host IDT.
- I/O-port bitmaps can restrict legacy device access, but modern PCI devices more often use MMIO and may support isolated passthrough interfaces.
Chapters
- Intel VMX controls whether external interrupts, non-maskable interrupts, and selected guest instructions cause exits from VMX non-root mode.
- The exception bitmap selects individual synchronous exceptions, while external interrupts use a separate, less granular exit control.
- VMCS controls can also intercept specific I/O-port accesses and MSR reads or writes.
- Without Extended Page Tables (EPT), early VMX hypervisors had to monitor guest page tables and intercept page faults to maintain correct memory mappings.
- With EPT enabled, guest page tables translate guest virtual addresses to guest physical addresses, and EPT translates guest physical addresses to host machine addresses.
- The guest can handle its own page faults without a VM exit when the hypervisor does not need to track guest page-table changes.
- VMX uses two 4 KB I/O bitmap pages to control access to the 65,536 x86 I/O ports, with separate permissions for input and output operations.
- Unrestricted guest access to legacy ports could let a guest interfere with host devices, such as an IDE disk or keyboard.
- Modern devices commonly use memory-mapped I/O (MMIO) instead of the older IN and OUT port interface; PCI devices can sometimes expose isolated virtual functions for passthrough.
- A bitmap for the full 32-bit MSR address space would require about 512 MB, so Intel provides bitmap coverage for two commonly used MSR regions.
- The bitmap controls read and write permissions separately; MSRs outside the covered regions cause exits.
- Hypervisors must restrict MSRs that could undermine isolation, including registers that affect critical processor state.
- VMX can scale and offset the guest time-stamp counter, allowing guest time to progress at a rate different from host physical time.
- A hypervisor can instead intercept RDTSC, but doing so may cause an exit on every guest timestamp read.
- CR3 target values let selected guest page-table-root loads avoid exits, while unlisted values can trigger them.
- A hypervisor can allow interrupts to reach the guest directly and use the VMX preemption timer to regain control later.
- Alternatively, it can intercept interrupts, handle host-owned events, and queue guest-owned interrupts for later injection.
- If guest RFLAGS.IF is clear, interrupt-window exiting resumes the guest and exits again when the guest becomes ready to accept a maskable interrupt.
- VMX operates per logical processor, with VMCS guest-state fields defining guest execution and host-state fields defining where execution resumes after an exit.
- A VMCS pointer must be loaded before use; the first entry uses VMLAUNCH, while subsequent entries use VMRESUME.
- Switching to another VMCS requires clearing the current VMCS and loading the new pointer; VMREAD and VMWRITE access indexed fields.
- For a fault-like VM exit, the guest instruction that triggered the exit has not executed, and the saved guest instruction pointer still identifies it.
- A hypervisor can emulate an intercepted instruction, update guest state such as a register, advance the instruction pointer, and resume the guest.
- RDTSC is an example of an instruction a hypervisor could intercept and emulate with a chosen timestamp value.
- A trap-like exit occurs after the triggering operation has executed, so the hypervisor observes its result rather than emulating the operation beforehand.
- Intel can report certain expensive or problematic events, such as a bus-lock condition, after the guest instruction completes.
- The hypervisor can respond to a bus-lock exit by adjusting scheduling or reducing the offending VM's CPU time.
- A LOCK-prefixed increment is usually made atomic through cache-coherence ownership, but an operation spanning cache lines may require a costly bus lock.
- VMX can report bus-lock events so a hypervisor can mitigate their system-wide performance impact.
- CR8 represents interrupt priority; a trap-like exit on a guest CR8 write can notify the hypervisor that queued interrupts may now be deliverable.
- If a user-mode guest executes RDMSR at CPL 3, the resulting general-protection fault belongs to the guest and takes precedence over an MSR-interception exit.
- At guest CPL 0, the same RDMSR can cause a VM exit when the VMCS MSR controls request interception.
- Some operations, including CPUID and VMX instructions, exit unconditionally; others, such as HLT, RDTSC, and selected I/O or MSR accesses, are conditionally controlled.
- TSC scaling changes the value returned to the guest without requiring the hypervisor to intercept every RDTSC.
- VMX can virtualize timer behavior, including TSC-deadline operation, through hardware support rather than repeated software emulation.
- VMFUNC can switch EPT views, changing a VM's effective memory mapping without following an ordinary exit-and-emulate path.
- Interrupt-window exiting lets the guest run until it can accept a pending maskable interrupt, rather than single-stepping it while interrupts are disabled.
- The processor delays interrupt delivery after STI until the following instruction, and also defers delivery briefly during certain stack-segment and stack-pointer updates.
- A guest that permanently leaves interrupts disabled will not receive queued guest interrupts, although the hypervisor can still regain control and schedule other VMs.
- After VMRESUME exits to the host, host execution begins at the VMCS host RIP, with interrupts initially disabled.
- Without the acknowledge-interrupt-on-exit control, the interrupt remains pending in the local APIC and can be delivered through the host IDT when the host enables interrupts.
- With acknowledgment enabled, the vector is recorded in VMCS exit information, and host code must dispatch the handler and acknowledge the interrupt itself.
- Non-maskable interrupts do not follow the same acknowledged-interrupt path; the host must dispatch an NMI handler after an NMI-caused exit.
- A hypervisor injects a guest event by setting the VM-entry interruption-information field before VMLAUNCH or VMRESUME, allowing hardware to perform the guest IDT transition.
- Blindly injecting an interrupt when the guest is not ready can cause VM-entry failure, so the hypervisor must track guest interruptibility and use the appropriate interrupt or NMI window controls.
- The lecture closes by preparing to apply VMX knowledge to an x86 hypervisor, including interrupt delivery and device handling.
Transcript excerpt
0:50 Okay, so let's get back to this uh just quick reminder where we are. We are looking at Intel VMX. So essentially more specifically we talked through like the details of what is there this MCS and uh trying to understand how to like at the level of like very fine grain level of details trying to understand uh how it works so we can like essentially like move on and start building the hypervisor and I kind of believe that hopefully we're going to finish this today and uh we can discuss the whole work and when I can over the weekend, let's say. But remember, we we talked about like BMCS guest area, BMCS host area. Uh I
1:41 stumbled at the very at the very end. I stumbled and I said, okay, I don't remember how interrupts are injected and uh we'll come back to it today because there are actually like multiple ways to inject them and that's why maybe I didn't remember. Uh but sure, let's quickly finish. like briefly finish the this section of like of this slide deck and hopefully talk at the next three chapters and uh I mean as I said we're we're kind of close right so like just bear with me for a sec so uh so what we need to understand is essentially right so how how we can control like the policy and essentially say what can be
2:28 executed inside the hypervisor inside the uh inside the virtual machine inside the V vtx nroot nonroot environment and what uh requires an exit and we talked about it when uh I gave this first overview lecture but uh essentially uh the the IntelBMX uh interface allows you to control whether external interrupts cause an exist whether non-maskable interrupt interrupts cause
This is the start of the transcript. Save this video free for the whole transcript, searchable and time-coded.
In this course
Related notes
Summary, takeaways, and chapters were generated by AI from the video's transcript and may contain errors. The video belongs to its creator, Anton Burtsev.