(1) AMD SVM allows virtualization of AMD processors through virtualization of the processor state and controls. It uses a Virtual Machine Control Block (VMCB) to store and manage the guest and host state. (2) The VMCB contains a control area and save state area. The control area manages features like I/O permissions and controls VM exits. The save state area stores guest register state like RIP, RSP, and control register state. (3) Transition between host and guest mode uses the VMCB. VMLOAD loads the VMCB, VMRUN runs the guest, and VMSAVE saves state back to the VMCB on VM exits. Key state

1. AMD SVM
syuu1228 from @livedoor

2. SVM
AMD
Intel-VT
VMM
qemu
↑

3. SVM
Ring Host/Guest
Guest
DMA Host/Guest
Guest
Guest
Tagged TLB
Nested Paging

4. Host
Guest
VMM
ex:

5. Guest
VMCB VMRUN Guest
VMCB Guest
Host ex:
Host
AMD #VMEXIT
Host #VMEXIT VMRUN

6. Host Guest
Guest VMRUN
λ... #VMEXIT
Host #VMEXIT VMRUN

7. VMCB
Virtual Machine Control Block
VM VMCB
4KB aligned 4KB 1
Control area
Guest CPU Save state area

8. Control Area (1)
on/off bit
R/W
,
I/O
MSR

9. Control Area (2)
I/O Permissons Map
IO
MSR Permissons Map
MSR
Time stamp counter
RDTSC, RDTSCP

10. Control Area (3)
TLB , Guest ASID(TLB tag )
#VMEXIT
Nested Paging
Event Injection
Guest
LBR
LBR Last Branch Record)AMD64

11. Save state area
RIP,RSP,RAX
ES,CS,SS,DS,FS,GS
STAR,LSTAR,CSTAR
GDTR,LDTR,IDTR
SFMASK
TR
KernelGsBase
CPL
SYSENTER_CS,SYSENTER
CR0,CR2,CR3,CR4
_ESP,SYSENTER_EIP
DR6,DR7
PAT
RFLAGS
LBR registers
RBX

12. …
Save state area
Guest
(RBX,RCX,RDX,RSI,RDI,RBI)
Host (!!!!)

13. …
Guest
"mov %c[rbx](%[svm]), %%ebx nt" ※kvm-6
"mov %c[rcx](%[svm]), %%ecx nt"
"mov %c[rdx](%[svm]), %%edx nt"
"mov %c[rsi](%[svm]), %%esi nt"
"mov %c[rdi](%[svm]), %%edi nt"
"mov %c[rbp](%[svm]), %%ebp nt"
/* Enter guest mode */
"push %%eax nt"
"mov %c[vmcb](%[svm]), %%eax nt"
SVM_VMLOAD "nt"
SVM_VMRUN "nt"
SVM_VMSAVE "nt"
"pop %%eax nt"
/* Save guest registers, load host registers */
"mov %%ebx, %c[rbx](%[svm]) nt"
"mov %%ecx, %c[rcx](%[svm]) nt"
"mov %%edx, %c[rdx](%[svm]) nt"
"mov %%esi, %c[rsi](%[svm]) nt"
"mov %%edi, %c[rdi](%[svm]) nt"
"mov %%ebp, %c[rbp](%[svm]) nt"
mov ;)

14. Host
__asm __volatile ( ※kvm-6
"push %%ebx; push %%ecx; push %%edx;"
"push %%esi; push %%edi; push %%ebp;"
"pop %%ebp; pop %%edi; pop %%esi;"
"pop %%edx; pop %%ecx; pop %%ebx; nt"
push/pop

15. Host
MSR,FS,GS,LDT,CR2,DR0-3,DR6-7,TR

16. SVM
VM_HSAVE_PA on MSR
SVM MSR
Host
VMRUN/#VMEXIT
CS,SS,RIP,RSP,CR0,CR4,EFER,IDTR,GDTR

17. /* Enter guest mode */ ※kvm-6
"push %%eax nt"
"mov %c[vmcb](%[svm]), %%eax nt"
SVM_VMLOAD "nt"
SVM_VMRUN "nt"
SVM_VMSAVE "nt"
"pop %%eax nt"
VMRUN

18. VMLOAD/VMSAVE
VMRUN/#VMEXIT
CS,RIP,RFLAGS,RAX,SS,RSP,CR0,CR2-4,EFER,IDTR,GDTR,ES,DS,DR6-7,CPL
→VMLOAD/VMSAVE
FS,GS,TR,LDTR,KernelGsBase,STAR,LSTAR,CSTAR,SFMASK,SYSENTER_CS,SY
SENTER_ESP,SYSENTER_EIP
KVM VMLOAD→VMRUN→VMSAVE

19. Host
Host
Guest
Guest VMLOAD)
Host (VMRUN)
Guest (VMRUN)
Guest !!!
Guest (#VMEXIT)
Host (#VMEXIT)
Guest (VMSAVE)
Guest
Host
Host