hypervisor-internals

Hypervisor Internals

Purpose

Explain hardware virtualization internals for agents: Intel VT-x (VMXON, VMCS, VMLAUNCH/VMRESUME, VMEXIT reasons), AMD SVM (VMCB, #VMEXIT), Extended/Nested Page Tables (EPT/NPT), APIC virtualization, MSR bitmaps, virtual interrupt injection, and references for building minimal type-1 hypervisors.

When to Use

• Understanding how KVM, Hyper-V, or VMware map to hardware features
• Debugging VMEXIT storms or EPT violations
• Studying hypervisor security research (CVE triage)
• Building educational hypervisors (SimpleVisor, hvpp)
• Tuning nested virtualization performance
• Analyzing VM escape or side-channel mitigations

Workflow

1. Virtualization types

Type 1 (bare metal)     Type 2 (hosted)
├── Hyper-V             ├── KVM + QEMU
├── Xen                 ├── VirtualBox
├── VMware ESXi         └── Parallels
└── Runs directly on HW     Runs on host OS

2. Intel VT-x overview

VMX operation
├── VMXON — enter VMX root mode
├── VMCS setup — guest/host state fields
├── VMLAUNCH / VMRESUME — enter guest
├── Guest runs until VMEXIT
└── VMXOFF — exit VMX operation

Key structures:

• VMCS (Virtual Machine Control Structure) — guest/host state, control fields
• VMEXIT — forced exit to hypervisor (I/O, MSR, EPT fault, interrupt)

// Simplified VMX enable check (kernel/driver context)
#include <linux/cpufeature.h>
if (boot_cpu_has(X86_FEATURE_VMX))
    // VT-x supported

3. VMCS fields (conceptual)

Category	Examples
Guest state	GPRs, CR0/3/4, segment selectors, RIP, RSP
Host state	Host RIP (VMEXIT handler), host CR3
Control	Pin-based, proc-based, VMEXIT/entry controls
Exit info	Exit reason, qualification, guest-linear-address

VMEXIT reasons (common):

Exit reason codes (Intel)
├── 10 — CPUID
├── 28 — CR access
├── 30 — I/O instruction
├── 48 — EPT violation
├── 0  — External interrupt
└── 1  — Triple fault

4. AMD SVM (AMD-V)