At 12:58 +0100 on 22 May (1306069124), henanwxr wrote:
> 1???Before do vmlaunch at the first time, CR0 in guest-state area is to paging
> protect mode, and this is actual state of guest os, as follow:
> which with vaule CR0.PE=1,CR0.PG=1
> but in the view of guest its CR0 is set to non paging protect mode, as
> v->arch.hvm_vcpu.guest_cr which with vaule CR0.PE=1,CR0.PG=0
> my question is:
> Initially, when executing the codes of guest os(such as hvmloader), address
> translate in which mode in hell? Is it in actual state of paging protect
> mode? Or in view of guest os that non paging protect mode ? And why?
There are two CR0s: the one the guest sees and the one the hardware
uses. In Xen, they're called guest_cr and hw_cr respectively.
So in this case, since hw_cr has PG and PE set, the CPU is using
You should probably read the Intel and AMD manuals about how VT-x/SVM
works in general if you're finding this confusing.
> ??? (1)If it is in actual state of paging protect mode, then the address
> translation must walk through the page table, but we don not construct a
> page table in advance?
The pagetables used are the shadow pagetables, which are constructed on
> ??? (2)If it is in view of guest os that non paging protect mode, then it
> not a page table, I find the address translation is emulated within VMM,
> liner address=physical address, as follow:
> static int hvmemul_linear_to_phys(???..
> /* With no paging it's easy: linear == physical. */
> if ( !(curr->arch.hvm_vcpu.guest_cr & X86_CR0_PG) )
> *paddr = addr;
> return X86EMUL_OKAY;
Remember, this code is _emulating_ the virtual machine. When the guest
thinks paging is disabled, then its linear addresses are the same as its
physical addresses. There is another step of translation from
guest-specific physical addresses to machine addressess to find the
> But every time when guest os access memory and fetch the instruction, does
> the address translation should through the emulation of VMM? And should
> generate VM exit? Which I am sure is that when VMM process I/O request of
> guest os it should generate VM exit and call this function.
> 2??? How does EPT(Extended-Page-Table) work in question 1 above ?
With EPT, hw_cr has PG clear and the p2m is supplied to the CPU so it
can do both translations at once.
> 3???When execute hvmloader, it will switch the processor to V86 mode, how
> implement address translation since then?
>From linear to physical to machine is exactly the same as protected
mode; it's only the segmentation step that's different.
> 4??? when virtual Bios load the guest os kernel, guest os will switch the
> processor mode to non paging protect mode again, does the process of address
> translation same as question 1?
> 5??? When guest os running normally, it is in paging protect mod, the process
> of address translation is:
> guest os liner address --> guest os physical address ( translate by guest
> page table)
> guest os physical address --> machine address (translate by EPT)
> right ?
Yes, if you're using EPT. If not, both steps are done by the shadow PT.
And in either case, when Xen is emulating an instruction, it does both
steps separately in software.
Tim Deegan <Tim.Deegan@xxxxxxxxxx>
Principal Software Engineer, Xen Platform Team
Citrix Systems UK Ltd. (Company #02937203, SL9 0BG)
Xen-devel mailing list