Intel Virtualization Technology Xen Architecture Lv Zheng Objectives

Intel® Virtualization Technology Xen Architecture Lv Zheng

Objectives l Coverage u u l Limitations u l Xen’s paravirtualization architecture Xen’s hardware virtual machine framework Intel® virtualization technology for IA-32 (VT-x) Intel® virtualization technology for Direct IO (VT-d) Do not cover PAE & EM 64 T Requirements u IA-32 basic architecture l l u Memory management Interrupts & exceptions Task management Input & output Quick calculation of 2^N 2

Agenda l Xen’s Architecture u u u Terminology & Concepts Bootstrap Process Physical Memory Management Virtual Memory Management Domains Virtualization 3

Address Terminology l l l l vaddr, virt (virtual address): Translated virtual addresses in Xen heap. Addressing that Xen uses. maddr, phys (machine address): Real host machine address, the addresses the processor understands. paddr (physical address): A catch-all for any kind of physical address. "Physical" here can mean guest-physical, machine-physical or guest-machine-physical. See definitions below. mfn (machine frame number): Corresponding to maddr. gpfn (guest pseudo frame number): Guests run in an illusory contiguous physical address space, which is probably not contiguous in the machine address space. gmfn (guest machine frame number): Equivalent to GPFN for an auto-translated guest, and equivalent to MFN for normal paravirtualised guests. It represents what the guest thinks are MFNs. pfn (physical frame number): Corresponding to paddr. virt_to_mfn __pa / virt_to_maddr virt paddr_to_pfn maddr mfn __va / maddr_to_virt pfn_to_paddr mfn_to_virt map_domain_page 4

Agenda l Xen’s Architecture u u u Terminology & Concepts Bootstrap Process Physical Memory Management Virtual Memory Management Domains Virtualization 5

Segmentation l gdt_descr / nopaging_gdt_descr u u l FIRST_RESERVED_GDT_BYTE = FIRST_RESERVED_GDT_PAGE(14) * PAGE_SIZE(4096) gdt_table Segment descriptors u u u l gdt_descr. base Base: gdt_table – FIRST_RESERVED_GDT_BYTE Limit: 15*4096 -1 = 0 x. EFFF DPL 0: hypervisor space DPL 1: kernel space DPL 3: user space Type. A: code segment Type 2: data segment Base: 0 x 0000 / Limit: 0 x. FFFFFF: 4 GB flat segmentation 0 x 00000000 (unused) Base Limit P DPL S 0 Type A Limit DPL P S 0 Type 2 Limit DPL P S 1 Type A Limit DPL P S 1 Type 2 Limit DPL P S 3 Type A Limit DPL P S 3 Type 2 Base Segment selectors u u GD G B Limit Base RPL: equal to DPL Index: offset from gdt_descr. base Base GD Base Address High Base Address Low G B Base GDTR GD RPL 0 __HYPERVISOR_CS 0 xe 008 __HYPERVISOR_DS 0 xe 010 Index 14*(4096/8)+2 RPL 0 FLAT_KERNEL_CS 0 xe 019 Index 14*(4096/8)+3 RPL 1 FLAT_KERNEL_DS FLAT_KERNEL_SS 0 xe 021 Index 14*(4096/8)+3 RPL 1 FLAT_USER_CS 0 xe 02 b Index 14*(4096/8)+4 RPL 3 FLAT_USER_DS FLAT_USER_SS 0 xe 033 Index 14*(4096/8)+5 RPL 3 Base G B Base Limit Base Index 14*(4096/8)+1 Base Limit (15*4096 -1) Base Limit Base NR_RESERVED_GDT_PAGES(1) Base Limit 0 x 00000000 (unused) 4*NR_CPUS * 8 (space for TSS and LDT per CPU) 6

Early Paging Directory Offset Start Physical Address (0 x 0000) P D A S 0 x 000=0 x 000 R P W Direct Mapping [Xen code/data/heap] (12 MB) Physical Address low mapping (4 GB-64 MB) Page Directory Entry Base Address 0 x 3 F 0 unmapped area (48 MB) P D A S 0 x 3 FC=0 x 000 R P W End Physical Address (HYPERVISOR_VIRT_START, 0 x. FC 000000) Physical Memory high mapping (12 MB) 0 x 3 FF unmapped are (4 MB) P G idle_pg_table A M W P N E E T MP P E CR 0 P S idle_pg_table CR 3 l l l CR 4 PS: Page Size extension (also known as PSE), if set, page size will be 4 MBytes 0 x 3 FC = PAGE_OFFSET >> 22, 0 x 3 F 0 = HYPERVISOR_VIRT_START >> 22, xen is linked at 0 x. FF 000000 + 0 x 100000 (xen. lds. S) Pink: mapped are. Yellow: unmapped area Low mapping: lower virtual address = lower physical address, map up to HYPERVISOR_VIRT_START as maximum physical address is unknown High mapping: Xen codes’ address = lower physical address (DIRECTMAP with Xen code/data/heap ) 7

Agenda l Xen’s Architecture u u u Terminology & Concepts Bootstrap Process Physical Memory Management Virtual Memory Management Domains Virtualization 8

Xen Memory Layout l Overview u l 0 x. FFC 00000 IO Remapping (4 MB) Xen’s address space u u Entry: 0 x. FF 000000 + 0 x 100000 PAGE_OFFSET: 0 x. FF 000000 l l l End Virtual Address (0 x. FFFF) Every OS’s address space at the top 64 MB of memory, to save a TLB flush. Direct Mapping [Xen code/data/heap] (12 MB) virt_to_maddr / __pa maddr_to_virt / __va 0 x. FF 000000 Memory Regions u u u Per-domain mapping (8 MB) 0 x. FE 800000 Direct Mapping: during early startup phase, Xen initialized this area for its own code/data addressing. Frame-info table: holding the frame tables for tracking machine pages. Shadow & Guest linear page table: for guest’s linear address space virtualization. Available in guests. Machine to physical mapping: holding the MFN -> GPFN translation. IO Remapping: reserved area for ioremap Per-domain mapping: reserved area for per-domain mapping l l 0 x. FE 400000 Shadow linear page tables (4 MB) 0 x. FE 000000 Guest linear page tables (4 MB) 0 x. FDC 00000 Machine-to-physical translation table [writable] (4 MB) Frame-info table (24 MB) 0 x. FC 400000 0 x. FC 000000 GDT/LDT tables: if guest want segmentation, it can register its own GDT/LDT tables here mapping cache: map a page to Xen directly addressable area Machine-to-physical translation table [read-only] (4 MB) Start Virtual Address (0 x. FC 000000) 9

Allocation Overview l l l l l Xen heap is up to physical address “xenheap_phys_end” (configurable, default is 0 x 00 C 00000=12 MB) RAM extent is determined by e 820 map table. xenheap_phys_start then is determined. Xen executable images extend xenheap_phys_start to “_end” Modules (xen 0 kernel & initial images) in multiboot table will be copied to the start position of xen heap. init_boot_allocator: initialize area for early stage allocation with bitmap indicating allocation states. init_boot_pages: allocation area allocable. memguard_init: map xen heap pages at 4 k. B granularity, and protect xen heap with overflow detection. init_frametable: initialize frame tables indicating page level allocation states end_boot_allocator: MEMZONE_DMADOM & MEMZONE_DOM turned to be allocable. init_xenheap_pages: MEMZONE_XEN turned to be allocable. Start Physical Address (0 x 0000) xen_image (_start ~ _end) xenheap_phys_start alloc_bitmap xenheap_phys_start pl 1 e[xen_heap] xenheap_phys_start pl 1 e[frame_table] xenheap_phys_start Xen heap Heap (12 MB) (Final) Xen xenheap_phys_end initial_images Domain Heap Frame-info Table Start Virtual Address (FRAMETABLE_VIRT_START) frame_table Frame table (24 MB) End Virtual Address (FRAMETABLE_VIRT_END) 10

Boot Allocation l Descriptions: u u l l l u Located in Xen heap area 0[white] means free 1[red] means allocated) alloc_bitmap xenheap_phys_end l u Initial Images initial_images_end Free Page (4 KB) From: initial_images_end (physical address > xenheap_phys_end) To: maximum of accessible physical memory Allocable Intefaces: u Xen Heap Boot allocation's allocable area: l l Start Physical Address (0 x 0000) Early boot stage allocation Allocation bitmap (alloc_bitmap): Allocated Page (4 KB) Allocable area: alloc_boot_pages Xenheap area: xenheap_phys_start + allocated i. e. alloc_xen_pagetable Allocable Physical Memory …… …… … Maximum Physical Address 11

Frame Table l l l Start Physical Address (0 x 0000) Address: FRAMETABLE_VIRT_START Size: max_page * sizeof (page_info) Align: PAGE_SIZE State: Red = allocated / White = free Interfaces u u 4 KB Xen Heap … frame_table 4 KB Allocable Domain Physical Heap Memory alloc_heap_pages free_heap_pages [virt(xenheap) | maddr | mfn]_to_page_to_[virt(xenheap) | maddr | mfn] tlbflush_timestamp type_info … Used Area max_pages Maximum Physical Address Start Virtual Address (FRAMETABLE_VIRT_START) _domain count_info list order count_info list … tlbflush_timestamp cpumask End Virtual Address (FRAMETABLE_VIRT_END) … max_pages 0 x 3 F 1 … tlbflush_timestamp type_info cpumask _domain order count_info D A list idle_pg_table_l 2 … frame_table 12 R P W

Page Info Fields l count_info u u l A(allocated): Cleared when the owning guest 'frees' this page. OS(out-of-sync): Set when fullshadow mode marks a page out-of-sync. PT(page-table): Set when fullshadow mode is using a page as a page table. COUNT: 29 -bit count of references to this frame. u u u l COUNT count_info VA TYPE: mutually exclusive types l l l u O P S T TYPE V P type_info: u A COUNT type_info PGT_l 1_page_table PGT_l 2_page_table PGT_gdt_page PGT_ldt_page PGT_writable_page V(validated): Has this page been validated for use as its current type? P(pinned): Owning guest has pinned this page to its current type? VA: The 11 most significant bits of virt address if this is a page table. COUNT: 16 -bit count of uses of this frame as its current type. <page_info> _domain list <domain> page_list u u u Each frame can be threaded onto a doubly-linked list. Link to xenpage_list of <struct domain>: xen pages shared with this domain. share_xen_page_with_guest Link to page_list of <struct domain>: pages belonging to this domain. alloc_domain_pages l _domain l order u u owner of this page order-size of the free chunk this page is the head of 13 <page_info> _domain list <domain> xenpage_list

Memory Zone l Attached into a global list for allocation u l Xen Heap (xenheap_phys_end) MEMZONE_XEN: u u always be freed by free_xenheap_pages or xfree explicitly alloc_xenheap_pages l l u u DMA Addressable Domain Area DMA_BITS = 31 (0 x 80000000) Safe in IRQ context l Domain Area allocate pages in Xen heap Need not map to idle_pg_table_l 2 Whole Physical Memory free_xenheap_pages xmalloc / xfree l l Start Physical Address (0 x 0000) static struct list_head heap[NR_ZONES][MAX_ORDER+1]; Maximum Physical Address O(n) power of 2 free list allocator for arbitrary chunks allocation MEMZONE_DMADOM & MEMZONE_DOM: u l u u l 0 MAX_ORDER distinguish between these 2 zones try to allocate pages in MEMZONE_DOM try MEMZONE_DMADOM if MEMZONE_DOM failed must remap to idle_pg_table_l 2 free_domheap_pages l u 1 alloc_domheap_pages l l u _DOMF_dying: it cares about the secrecy of pages’ contents Will be scrubbed in softirq context pfn_dom_zone_type l Will check whether _DOMF_dying is set, if so, page will be added to page_scrub_list, which will be freed in later softirq context avail_domheap_pages l MAX_ORDER … Not safe in IRQ context l heap … 1 0 MAX_ORDER … 1 get available page number for allocation 0 14

Memory Guard l Descriptions u u l Memory guard is used for xen heap memory (Xen’s source codes will use this region) overflow detection If a range is guarded, memory overflow will lead to a page fault exception (#PF) memguard_unguard_range memguard_guard_range memguard_range Operations u u u l Start Physical Address (xenheap_phys_start) Init: Splitter 4 MB mapped Xen heap pages into 4 KB mapping Guard: set pages to be present, page is not in use Unguard: set pages to be not present, page is in use memguard_range Xen Heap #PF memguard_unguard_range memguard_guard_range Interfaces u memguard_range, used in such functions: l l u init_xenheap_pages free_xenheap_pages memguard_range memguard_unguard_range, used in such functions: l …… alloc_xenheap_pages 15 End Physical Address (xenheap_phys_end)

Agenda l Xen’s Architecture u u u Terminology & Concepts Bootstrap Process Physical Memory Management Virtual Memory Management Domains Virtualization 16

Paging Overview 0 x 000=0 x 000 Start Physical Address (xenheap_phys_end) P D A S R P W P D A S P D A R P W P D A S R P W Low Domain Mapping Entries (4 GB-64 MB) (0 x 3 F 0) 0 x 3 F 0 Xen Heap G 0 x 3 F 1 Frame info table (<=24 MB) Frame-info table (24 MB) 0 x 3 F 7 G MPT mapping (4 MB) l 0 x 3 FA D A R P W Maximum Physical Address 0 x 3 FB D A R P W P D A S R P W D A R P W Entries u u u l Domain Heap 0 x 3 FC=0 x 000 L 2_PAGETABLE_ENTRIES: 0 x 400 DOMAIN_ENTRIES_PER_L 2_PAGETABLE: 0 x 3 f 0 HYPERVISOR_ENTRIES_PER_L 2_PAGETABLE: 0 x 010 0 x 3 FF start_paging u u memguard_init_frametable domain_create (idle domain) l paging_init u u Xen heap L 1 table (12 KB) arch_domain_create Frame info L 1 table (4 KB * needed) Machine to physical mapping IO remapping Per-domain page table IO remap L 1 table (4 KB) Per-domain GDT / LDT L 1 table (4 KB) construct_dom 0 u Hypervisor Entries (0 x 010) idle_pg_table_l 2 Xen heap mapping Low mapping l l Direct mapping (12 MB) Per-domain mapping cache L 1 table (4 KB) Zap_low_mapping (idle_pg_table_l 2) Xen Heap 17

Per-domain Page Table l L 1_ENTRIES: arch_domain_create u u u l Per-domain GDT/LDTs (0 x 000 ~ 0 x 3 FF) L 2_ENTRIES: construct_dom 0 u u u l Size: 0 x 0800, 2 pages Location: Xen heap Contents: entries pointing to pages Per-domain L 1 Page Table Size: 0 x 0002 Location: idle_pg_table_l 2 Contents: entries pointing to mm_perdomain_pt mapcache. l 1 tab (0 x 400 ~ 7 FF) Per Domain u u u mm_perdomain_pt in <struct domain> 4 KB L 1 table for per-VCPU GDT/LDTs (4 MB) 4 KB L 1 table for mapping cache (4 MB) 0 x 3 FA D A R P W 0 x 3 FB D A R P W Start Physical Address (0 x 0000) idle_pg_table_l 2 Direct Mapping [Xen heap] (12 MB) Start Virtual Address (PERDOMAIN_VIRT_START) Per-domain mapping (8 MB) End Physical Address (xenheap_phys_end) End Virtual Address (PERDOMAIN_VIRT_END) 18

GDT/LDT Tables l Location (per virtual CPU) u l perdomain_ptes in <struct vcpu> Entries u 1<<GDT_LDT_VCPU_SHIFT PDPT_L 2_ENTRIES: construct_dom 0 l l l u gdt_table (0 x 00 E) Size: 0 x 0002 Location: idle_pg_table_l 2 Contents: entries pointing to mm_perdomain_pt PDPT_L 1_ENTRIES: arch_domain_create l l Per-domain GDT/LDTS (FIRST_RESERVED_GDT_PAGE = 14 pages) Per-domain reservation VCPU[0] per-domain page tables PDPT_L 1_ENTRIES Size: 0 x 0800, 2 pages Location: Xen heap Contents: entries pointing to pages Per-domain GDT/LDTs (FIRST_RESERVED_GDT_PAGE = 14 pages) Interfaces u GDT map / unmap l l u Per-domain … L 1 Page Table set_gdt destroy_gdt gdt_table (0 x 3 EE) LDT map / unmap l l Per-domain reservation VCPU[MAX_VIRT_CPUS] per-domain page tables map_ldt_shadow_page invalidate_shadow_ldt mm_perdomain_pt (0 x 000 ~ 0 x 3 FF) Start Physical Address (0 x 0000) Start Virtual Address (PERDOMAIN_VIRT_START) Direct Mapping [Xen heap] (12 MB) Per-domain mapping (8 MB) End Virtual Address (PERDOMAIN_VIRT_END) End Physical Address (xenheap_phys_end) 19

Mapping Cache l Why? u u l u u u DOM Heap Pages Map domain pages to the mapping cache area which is addressable in idle_pg_table address space Hash bitmap is used for acceleration 4 MB can cache 1 K pages mapping Install mapping into mapcache. l 1 tab (mm_perdomain_pt + 0 x 400) Hash u u l MFN=0 x. C 03 How? u l maddr_to_virt can only work for xenheap region in idle_pg_table address space, so if we had a mfn or maddr to access, we could hardly translate it to a virtual address. CONFIG_DOMAIN_PAGE indicates whether current arch is OK for using map_domain_page interfaces … u MAX_VIRT_CPU Per-VCPU mappings l l map_domain_page unmap_domain_page Start Virtual Address (MAPCACHE_VIRT_START) … Accessible in all address spaces, can also be unmapped from any context. l l mapcache. vcpu_maphash 0 Not in-use: MAPHASHENT_NOTINUSE = (u 16)~0 U In-use: idx from MAPCACHE_VIRT_START Interfaces u MFN=0 x 100 E Per-domain mapping (8 MB) map_domain_page_global unmap_domain_page_global End Virtual Address (PERDOMAIN_VIRT_END) … mapcache. l 1 tab (0 x 0400 ~ 0 x 7 FF) pfn idx refcount mm_perdomain_pt 20

Machine to Physical Mapping l Description u l Records the mapping from machine page frames to pseudophysical ones. MEMZONE_DMADOM 0 x 5555 u u Size: max_page * BYTES_PER_LONG (max=4 MB) Align: 1<<L 2_PAGETABLE_SHIFT (4 MB) Location: anonymous domain (domain == NULL) heap pages l u l l u RDWR_MPT_VIRT_START RO_MPT_VIRT _START l Start Virtual Address (RDWR_MPT_VIRT_START) Machine-to-physical translation table [writable] (4 MB) End Virtual Address (RDWR_MPT_VIRT_END) End Virtual Address (RO_MPT_VIRT_END) GPFN: guest pseudo-physical frame number INVALID_M 2 P_ENTRY: ~0 UL 0 x 5555 on initialization … 0 x 3 F 0 P S D A E P P S D A E R P W … Interfaces l Maximum Physical Address Machine-to-physical translation table [read-only] (4 MB) Stores l …… Start Virtual Address (RO_MPT_VIRT_START) Address l …… … machine_to_phys_mapping u 0 x 5555 MEMZONE_DOM mpt_size u l Start Physical Address (xenheap_phys_end) 0 x 3 F 7 set_gpfn_from_mfn get_gpfn_from_mfn … idle_pg_table 21

Paging Directory pl 1 e base address Table D A R P W Offset Page Directory Entry (pl 2 e) Page Directory (4 KB) pl 1 e base address L 2 Page Table (idle_pg_table) pl 2 e page frame no 0 x 3 FF Physical Address D A R P W Page Table Entry (pl 1 e) Base Address Page Table (4 KB) pl 2 e page frame no 0 x 000 D A R P W L 1 Page Table Physical Memory P S idle_pg_table CR 3 l l l CR 4 L 2 entry: idle_pg_table_l 2[l 2_linear_offset(virt)], virt_to_xen_l 2 e(virt) L 1 entry: l 2 e_to_l 1 e(l 2 e) + l 1_table_offset(virt) map_pages_to_xen: map a physical page to idle_pg_table, specify MAP_SMALL_PAGES for 4 KB mappings 22

Agenda l Xen’s Architecture u u u Terminology & Concepts Bootstrap Process Physical Memory Management Virtual Memory Management Guest Memory Management Interrupt/Exception Handling 23

Reserved Domains l DOMID_IO: This domain owns I/O pages that are within the range of the page_info array. u u l u reserved usable M 2 P table is mappable read-only by privileged domains. Xen trace buffer is shared for xentrace. M 2 P Table IDLE_DOMAIN_ID: The idle domain will perform as an idle task after initialization is done. u usable Historical 1 MB IO Trace Buffer DOMID_XEN: Any Xen-heap pages that we will allow to be mapped will have their domain field set to this domain. u l First 1 MB of RAM is historically marked as I/O. Any areas not specified as RAM by the e 820 map are considered I/O. Start Physical Address (0 x 0000) ACPI NVS Reserved Area IO ACPI data reserved No pages belonging to this domain. Maximum Physical Address 24

Dom 0 Memory Layout l nr_pages u u u l 1/16 th of available memory for things like DMA buffers. Maximum of 128 MB. Specifiable. Kernel Image Init. ramdisk Physical to Machine Mapping Align u u l Start Virtual Address (domain_setup_info. v_start) Start Info (1 page) v_end: 4 MB alignment Other: 4 KB alignment Page Tables (nr_pt_pages) Boot Stack Regions u u u u Loaded kernel: parse elf image load it to the correct start address (for linux 0 x. C 0000000). Initial images: copy initial images after kernel. Physical to machine mapping: alloc required pages for P 2 M mapping for pseudo physical address virtualization. Start info: stores start information for domain in this page. Page tables: L 2 (1 page) & L 1 page tables for this mapping. nr_pages(vpt) > l 1 & l 2 page tables * PAGE_SIZE Boot stack: reserved for bootup stack v_end: reserved at least 512 KB. … nr_pages 25 Domain 0 Memory End Virtual Address (v_end) To Be Allocated Pages

Linear Page Table l Steps u Allocate required page table pages l l l u u l Copy idle_pg_table_l 2 Set LINEAR_PT_VIRT_START entry pointing to page table itself Overwrite PERDOMAIN_VIRT_START entries Set v_start ~ v_end page tables Fields u l L 2: 1 page, set as PGT_l 2_page_table L 1: no, of pages containing entries can cover (v_end - v_start), set as PGT_l 1_page_table type_info of page frame is set to be PGT_writable_page 0 x 2 fc D A P 0 x 2 fd D A P P D A S P D A R P W P D A S R P W 0 x 3 F 8 D A R P W 0 x 3 FA D A R P W 0 x 3 FB D A R P W 0 x 3 FC=0 x 000 D A R P W 0 x 3 F 0 G 0 x 3 F 1 Frame-info table (24 MB) 0 x 3 F 7 All page table pages marked as read only to ensure not to be modified by guest OS G Page Tables u guest_table, pfn of l 2 entry offset 0 x 3 f 8 Start Virtual Address (linux entry point 0 x. C 0000000) Direct mapping (12 MB) 0 x 3 FF l 1 start (4 KB) Page Tables vpt_start ~ vpt_end (nr_pt_pages) l 1 start+1 (4 KB) guest_table idle_pg_table_l 2 26

Physical to Machine Mapping l Description u l l Records the mapping from pseudo-physical frames to machine page ones. Address: vpt_start ~ vpt_end construct_dom 0 u u Start Virtual Address (domain_setup_info. v_start) Physical to Machine Mapping Startup Area End Virtual Address (v_end) nr_pages Allocate all domain 0 reservation Fill P 2 M & M 2 P mappings l l Reserved Area Start Virtual Address (RDWR_MPT_VIRT_START) Machine-to-physical translation table [writable] (4 MB) End Virtual Address (RDWR_MPT_VIRT_END) vphysmap_start[pfn] = mfn; set_gpfn_from_mfn(mf n, pfn); … Start Virtual Address (RO_MPT_VIRT_START) Machine-to-physical translation table [read-only] (4 MB) End Virtual Address (RO_MPT_VIRT_END) 27

Start Info 28

Dom. U Builder l l Similar to dom 0 builder. Can be called from domain 0 (control domain) in libxc: xc_linux_build. 29

Writable Pages 30

Shadow Page Table 31

Grant Table 32

Agenda l Xen’s Architecture u u u Terminology & Concepts Bootstrap Process Physical Memory Management Virtual Memory Management Guest Memory Management Interrupt/Exception Handling 33

Interrupt Table l Stores u u l Fields u u l DPL: privilege level Offset: trap function address Segment Selector: use hypervisor code segment (D = 1) means size of (gate = 32) Entries u u u l Address: idt_table Size: IDT_ENTRIES (256) Gray: DPL=0 (hypervisor traps) Blue: DPL=3 (system wide gate) Green: DPL=1 (allow kernel trap in hypervisor) Yellow: DPL=0 type=task gate Pink: per-CPU interrupt gate Interfaces: u u Gray: set_intr_gate Blue: set_system_gate Yellow: set_task_gate Others: _set_gate IDT_ENTRIES (256) Base Address High Base Address Low Limit (256*8 -1) IDTR Offset High P DPL Segment Selector (__HYPERVISOR_CS << 16) D Offset Low Fields <- idt_table 34 0 TRAP_divide_error 1 TRAP_debug 2 TRAP_nmi 3 TRAP_int 3 4 TRAP_overflow 5 TRAP_bounds 6 TRAP_invalid_op 7 TRAP_no_device_not_available 8 TRAP_double_fault __DOUBLEFAULT_TSS_ENTRY 9 TRAP_copro_seg coprocessor_segment_overrun 10 TRAP_invalid_tss invalid_TSS 11 TRAP_no_segment_not_present 12 TRAP_stack_error stack_segment 13 TRAP_gp_fault general_protection 14 TRAP_page_fault 15 TRAP_spurious_interrupt_bug 16 TRAP_copro_error coprocessor_error 17 TRAP_alignment_check 18 TRAP_machine_check 19 TRAP_simd_error simd_coprocessor_error 31 TRAP_deferred_nmi 0 x 82 HYPERCALL_VECTOR hypercall

Exception Handler l l l Allocate structure on stack Processor saves specific registers Error code u l l l cpu_user_regs ebx ecx May be stored by processor on specific exception edx esi Entry vector store by exception handler Store other registers by ‘error_code’ codes If CS==3, exception handler saves selectors Stack top (functions’ parameter) points cpu_user_regs EBX points to current vcpu edi ebp eax error_code entry_vector eip cs upcall_mask eflags esp Start Virtual Address (vcpu[n] stack) cpu_user_regs STACK ss _pad 1 es _pad 2 ds _pad 3 fs _pad 4 gs _pad 5 Stack Top struct vcpu ebx 35 _pad 0

Hyper Call 36

Event Channel 37

Virtual IDT l Description u l cs address Sequences Initialize CS field for guest as FLAT_KERNEL_CS u Set init vcpu’s virtual IDT handlers l l u construct_dom 0 (linux)trap_init (linux)HYPERVISOR_set_trap_table do_set_trap_table (NULL: clear entire virtual IDT / Not NULL: set virtual IDT) Initialize trap_ctxt for every virtual CPU l l l (linux)smp_trap_init (linux)HYPERVISOR_vcpu_op(VCPUOP_initia lise) do_vcpu_op(VCPUOP_initialise): copy virtual IDT u Restrict code selector for guest virtual IDT u Propagate exceptions l l l vector flags vector … 256 Maximum to 256 entries u flags address Stored in the vcpu’s guest context field Init values are in global trap_table Stored in the vcpu’s guest context through hypercall Size u l cs Location u u u l trap_table Virtual IDT propagates exceptions to the guest OS. fixup_guest_code_selector do_xxx (trap handlers): turn safe exception tor trap_bounce create_bounce_frame: create a basic exception frame on guest OS (RING-1) stack 38

Dynamic IRQ 39

Current Task 40

Range Set l Used for following system resources’ management u u u Interrupts IO Ports IO Memory 41