特权指令，陷阱和系统调用之间的关系 [英] The relation between privileged instructions, traps and system calls

问题描述

我试图了解虚拟机监视器(VMM)如何虚拟化CPU.

I am trying to understand how a virtual machine monitor (VMM) virtualizes the CPU.

我现在的理解是，当在CPU处于用户模式时，将要执行特权指令时，CPU会发出保护故障中断.在高级语言(如C)中，特权指令包装在系统调用中.例如，当应用程序需要当前日期和时间(与I/O设备交互的指令具有特权)时，它将调用某个库函数.该库函数的汇编版本包含一条称为"int"的指令，该指令在CPU中引起陷阱. CPU从用户模式切换到特权模式，并跳转到操作系统提供的陷阱处理程序.每个系统调用都有其自己的陷阱处理程序.在此示例中，陷阱处理程序从硬件时钟读取日期和时间并返回，然后CPU将其自身从特权模式切换到用户模式. (来源: http://elvis.rowan.edu/~hartley/Courses/OperatingSystems/Handouts /030Syscalls.html )

My understanding right now is that the CPU issues a protection fault interrupt when a privileged instruction is about to be executed while the CPU is in user mode. In high level languages like C, privileged instructions are wrapped inside system calls. For example, when an application needs the current date and time (instructions that interact with I/O devices are privileged), it calls a certain library function. The assembled version of this library function contains an instruction called 'int' that causes a trap in the CPU. The CPU switches from user mode to privileged mode and jumps to the trap handler the OS has provided. Each system call has its own trap handler. In this example, the trap handler reads the date and time from the hardware clock and returns, then the CPU switches itself from privileged to user mode. (source: http://elvis.rowan.edu/~hartley/Courses/OperatingSystems/Handouts/030Syscalls.html)

但是，我不太确定这种理解是正确的.本文提到以下概念:(特权)x86 popf指令不会导致陷阱，从而使VMM的事情复杂化:

However, I am not quite sure this understanding is correct. This article mentions the notion that the (privileged) x86 popf instruction does not cause a trap, and thus complicates things for the VMM: http://www.csd.uwo.ca/courses/CS843a/papers/intro-vm.pdf. In my understanding the popf instruction should not cause a trap but a protection fault interrupt, when explicitly called by a user program and not through a system call.

所以我的两个具体问题是:

So my two concrete questions are:

• 当CPU处于用户模式时，如果用户程序执行特权指令，会发生什么情况?
• 当用户程序执行系统调用时会发生什么?

推荐答案

无特殊顺序:

您的困惑主要是由于操作系统社区没有标准化的词汇这一事实造成的.这里有些术语有时含义相同，有时却不相同: exception ， fault ， interrupt ，系统调用和 trap .任何单个作者通常都会一致地使用这些术语，但是不同的作者对它们的定义是不同的.

Your confusion is mainly caused by the fact that the operating systems community does not have standardized vocabulary. Here are some terms that get slung around that sometimes mean the same thing, sometimes not: exception, fault, interrupt, system call, and trap. Any individual author will generally use the terms consistently, but different authors define them differently.

有3种不同的事件会导致进入特权模式.

There are 3 different kinds of events that cause entry into privileged mode.

1. 异步中断(例如，由需要服务的I/O设备引起的).
2. 系统调用指令(x86上的int). (在x86手册中通常将其称为 traps ，并包括其他一些说明(主要用于调试器).)
3. 执行特殊操作的指令(非法指令，保护错误，0分频，页面错误等). (不同的作者称这些为 exceptions ， faults 或 traps .x86手册称这些为 faults .)

1. An asynchronous interrupt (caused, for example, by an i/o device needing service.)
2. A system call instruction (int on the x86). (More generally in the x86 manuals these are called traps and include a couple of other instructions (for debuggers mostly.))
3. An instruction that does something exceptional (illegal instruction, protection fault, divide-by-0, page fault, ...). (Different authors calls these exceptions, faults or traps. x86 manuals call these faults.)

每个中断，陷阱或故障都有不同的编号.

Each interrupt, trap or fault has a different number associated with it.

在所有情况下:

1. 处理器进入特权模式.
2. 用户模式寄存器保存在某个地方.
3. 处理器找到中断向量表的基地址，并使用中断/陷阱/故障号作为该表的偏移量.这为该中断/陷阱/故障提供了服务例程的指针.
4. 处理器跳转到服务例程.现在我们处于保护模式，所有用户级别的状态都保存在可以访问的位置，并且我们在操作系统内的正确代码中.
5. 服务例程完成后，它会调用中断返回指令(x86上的iret.)(这是x86上的故障和陷阱之间的细微区别:故障返回到导致故障的指令，即traps返回陷阱后的指令.)

1. The processor enters privileged mode.
2. The user-mode registers are saved somewhere.
3. The processor finds the base address of the interrupt vector table, and uses the interrupt/trap/fault number as an offset into the table. This gives a pointer to the service routine for that interrupt/trap/fault.
4. The processor jumps to the service routine. Now we are in protected mode, the user level state is all saved somewhere we can get at it, and we're in the correct code inside the operating system.
5. When the service routine is finished it calls an interrupt-return instruction (iret on x86.) (This is the subtle distinction between a fault and a trap on x86: faults return to the instruction that caused the fault, traps return to the instruction after the trap.)

请注意混淆的名称中断向量表".即使它被称为 interrupt 表，它也用于故障和陷阱. (这导致一些作者将一切称为中断.)

Note the confusing name "interrupt vector table." Even though it is called an interrupt table, it is used for faults and traps as well. (Which leads some authors to call everything an interrupt.)

popf问题相当微妙.这本质上是x86体系结构中的错误.当popf从用户模式执行时，它不会不会引起陷阱或错误(或异常或中断或任何您想调用的错误.)它只是充当noop.

The popf issue is rather subtle. This is essentially a bug in the x86 architecture. When popf executes from user mode it does not cause a trap or fault (or exception or interrupt or whatever you want to call it.) It simply acts as a noop.

这有关系吗?好吧，对于普通的操作系统而言，这并不重要.另一方面，如果您要实现虚拟机监视器(如VMWare或Xen或Hyper-V)，则VMM在保护模式下运行，并且您希望在用户模式下运行来宾操作系统 并有效地模拟任何保护模式代码.当来宾操作系统使用popf指令时，您想要会生成一般保护错误，但不会. (cli和sti指令如果从用户模式调用，确实会产生一般的保护错误，这就是您想要的.)

Does this matter? Well, for a normal OS it doesn't really matter. If, on the other hand, you are implementing a virtual machine monitor (like VMWare or Xen or Hyper-V), the VMM is running in protected mode, and you'd like to run the guest operating systems in user mode and efficiently emulate any protected mode code. When the guest operating system uses a popf instruction you want it to generate a general protection fault, but it doesn't. (The cli and sti instructions do generate a general protection fault if called from user mode, which is what you want.)

这篇关于特权指令，陷阱和系统调用之间的关系的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！