简体繁体 English

请解释虚拟化中敏感指令的问题及其解决方法

[英]Please explain the issue of sensitive instructions in Virtualization and how it is resolved

原文 2019-07-23 12:48:47 3 2 x86/ virtualization/ isa

In virtualization,is sensitive instructions an issue because it probably gets executed in non-privileged mode without getting trapped or raising an interrupt? 在虚拟化中，敏感指令是否是一个问题，因为它很可能在非特权模式下执行而不会陷入陷阱或引发中断？

In hardware-assisted virtualization, is the Intel-VT, AMD Pacifica solving the problem by actually executing the sensitive instruction or it is just creating a interrupt trap? 在硬件辅助虚拟化中，Intel-VT，AMD Pacifica是通过实际执行敏感指令来解决问题还是仅创建中断陷阱？

Is Hypervisor catching the trap from Intel-VT/AMD Pacifica and then choosing to execute the sensitive instruction or not? 系统管理程序是否正在捕获Intel-VT / AMD Pacifica的陷阱，然后选择执行敏感指令？

2 个解决方案

In virtualization,is sensitive instructions an issue because it probably gets executed in non-privileged mode without getting trapped or raising an interrupt? 在虚拟化中，敏感指令是否是一个问题，因为它很可能在非特权模式下执行而不会陷入陷阱或引发中断？

For virtualization; 用于虚拟化； sensitive instructions would be a major problem if they aren't trapped. 如果敏感指令没有被捕获，将是一个主要问题。

In hardware-assisted virtualization, is the Intel-VT, AMD Pacifica solving the problem by actually executing the sensitive instruction or it is just creating a interrupt trap? 在硬件辅助虚拟化中，Intel-VT，AMD Pacifica是通过实际执行敏感指令来解决问题还是仅创建中断陷阱？ Is Hypervisor catching the trap from Intel-VT/AMD Pacifica and then choosing to execute the sensitive instruction or not? 系统管理程序是否正在捕获Intel-VT / AMD Pacifica的陷阱，然后选择执行敏感指令？

For hardware-assisted virtualization; 用于硬件辅助的虚拟化； the CPU sees the sensitive instruction and switches to the hyper-visor (eg "VMEXIT") instead of executing the sensitive instruction; CPU看到敏感指令并切换到管理程序（例如“ VMEXIT”），而不执行敏感指令； and the hyper-visor emulates the instruction (it doesn't ignore the instruction or ask the CPU to execute the instruction). 虚拟机管理程序会仿真该指令（它不会忽略该指令或不要求CPU执行该指令）。

The emulation of an instruction may be very simple (eg clearing a bit in a variable somewhere in response to a cli instruction) and may be very complicated (eg using sockets on the host to emulate the behavior of a real NE2000 network card to emulate an out instruction in the guest). 指令的仿真可能非常简单（例如，响应cli指令清除某个位置的变量中的位），并且可能非常复杂（例如，使用主机上的套接字来仿真真实的NE2000网卡的行为来仿真指令）。客人中的out指示）。

First paragraph: Yes, sensitive instructions that do not trap are an issue for x86 virtualisation. 第一段：是的，没有陷阱的敏感指令是x86虚拟化的问题。

Extensions like SVM generally trap for all sensitive instructions AFAIK. 像SVM这样的扩展通常会捕获所有敏感指令AFAIK。 The hypervisor's handling of the instructions depends on what the instructions are. 系统管理程序对指令的处理取决于指令是什么。 It can be either ignored (skipped), handled by some sort of emulation, or directly be executed by the hypervisor. 它可以被忽略（跳过），通过某种模拟进行处理，也可以由管理程序直接执行。

However, in (non-AMD64) V86M's VME (Virtual Mode Extensions), specific software interrupts (which are generally sensitive) can be handled without trapping. 但是，在（非AMD64）V86M的VME（虚拟模式扩展）中，可以处理特定的软件中断（通常是敏感的）而不会被捕获。