Intel® 64 and IA-32 Architectures System Programming Guide

需积分: 9 67 浏览量更新于2024-07-26 收藏 2.54MB PDF 举报

"Intel®64 and IA-32 Architectures Software Developer’s Manual Volume 3C: System Programming Guide, Part 3" 这篇文档是Intel提供的针对Intel®64和IA-32架构的软件开发人员指南，它包含了系统编程的详细信息。这个手册由七卷组成，每一卷都有特定的关注点，旨在帮助开发者理解和优化在这些架构上的软件性能。 1. **基本架构** (Volume 1: Basic Architecture, Order Number 253665)：这部分详细介绍了处理器的硬件结构，包括处理器核心、内存层次结构、输入/输出系统以及与之相关的硬件特性。 2. **指令集参考A-L** (Volume 2A: Instruction Set Reference, A-L, Order Number 253666)：这一卷涵盖了从A到L的指令集，包括每个指令的功能、操作码、操作数和可能的执行时序。 3. **指令集参考M-Z** (Volume 2B: Instruction Set Reference, M-Z, Order Number 253667)：同上，但涵盖的是M到Z的指令集。 4. **综合指令集参考** (Volume 2: Instruction Set Reference, Order Number 326018)：这是A-L和M-Z的合集，提供了完整的指令集参考。 5. **系统编程指南第一部分** (Volume 3A: System Programming Guide, Part 1, Order Number 253668)：这部分主要讲解了系统级的编程概念，如虚拟内存管理、中断和异常处理，以及处理器状态的切换。 6. **系统编程指南第二部分** (Volume 3B: System Programming Guide, Part 2, Order Number 253669)：涵盖了多处理器系统编程、系统初始化、电源管理和性能监控等方面。 7. **系统编程指南第三部分** (Volume 3C: System Programming Guide, Part 3, Order Number 326019)：这部分是本文档的主题，详细讨论了诸如系统管理模式(SMM)、硬件性能计数器、调试技术、内存保护扩展(PAE)、I/O虚拟化以及与系统软件交互的其他高级主题。这个文档系列是为那些需要深入理解Intel处理器内部工作原理和系统级编程技巧的开发者设计的。通过阅读这些手册，开发者可以更好地优化代码，解决兼容性问题，并充分利用处理器提供的各种功能。文档中提到，信息的提供与Intel产品相关，但不授予任何知识产权许可。除非在Intel的产品销售条款和条件中有明确规定，否则Intel不对产品销售或使用承担任何明示或暗示的保证责任，包括但不限于适合特定目的的保证。这强调了文档使用者需要自行承担风险，并遵循Intel提供的产品使用指导。

24-10 Vol. 3C

VIRTUAL-MACHINE CONTROL STRUCTURES

All other bits in this field are reserved, some to 0 and some to 1. Software should consult the VMX capability MSRs

IA32_VMX_PROCBASED_CTLS and IA32_VMX_TRUE_PROCBASED_CTLS (see Appendix A.3.2) to determine how

to set reserved bits. Failure to set reserved bits properly causes subsequent VM entries to fail (see Section

26.2.1.1).

The first processors to support the virtual-machine extensions supported only the 1-settings of bits 1, 4–6, 8, 13–

16, and 26. The VMX capability MSR IA32_VMX_PROCBASED_CTLS will always report that these bits must be 1.

Logical processors that support the 0-settings of any of these bits will support the VMX capability MSR

IA32_VMX_TRUE_PROCBASED_CTLS MSR, and software should consult this MSR to discover support for the 0-

settings of these bits. Software that is not aware of the functionality of any one of these bits should set that bit to 1.

Bit 31 of the primary processor-based VM-execution controls determines whether the secondary processor-based

VM-execution controls are used. If that bit is 0, VM entry and VMX non-root operation function as if all the

secondary processor-based VM-execution controls were 0. Processors that support only the 0-setting of bit 31 of

the primary processor-based VM-execution controls do not support the secondary processor-based VM-execution

controls.

Table 24-7 lists the secondary processor-based VM-execution controls. See Chapter 25 for more details of how

these controls affect processor behavior in VMX non-root operation.

28 Use MSR bitmaps This control determines whether MSR bitmaps are used to control execution of the RDMSR

and WRMSR instructions (see Section 24.6.9 and Section 25.1.3).

For this control, “0” means “do not use MSR bitmaps” and “1” means “use MSR bitmaps.” If the

MSR bitmaps are not used, all executions of the RDMSR and WRMSR instructions cause

VM exits.

29 MONITOR exiting This control determines whether executions of MONITOR cause VM exits.

30 PAUSE exiting This control determines whether executions of PAUSE cause VM exits.

31 Activate secondary

controls

This control determines whether the secondary processor-based VM-execution controls are

used. If this control is 0, the logical processor operates as if all the secondary processor-based

VM-execution controls were also 0.

Table 24-7. Definitions of Secondary Processor-Based VM-Execution Controls

Bit Position(s) Name Description

0 Virtualize APIC

accesses

If this control is 1, the logical processor treats specially accesses to the page with the APIC-

access address. See Section 29.4.

1 Enable EPT If this control is 1, extended page tables (EPT) are enabled. See Section 28.2.

2 Descriptor-table

exiting

This control determines whether executions of LGDT, LIDT, LLDT, LTR, SGDT, SIDT, SLDT, and

STR cause VM exits.

3 Enable RDTSCP If this control is 0, any execution of RDTSCP causes an invalid-opcode exception (#UD).

4 Virtualize x2APIC

mode

If this control is 1, the logical processor treats specially RDMSR and WRMSR to APIC MSRs (in

the range 800H–8FFH). See Section 29.5.

5 Enable VPID If this control is 1, cached translations of linear addresses are associated with a virtual-

processor identifier (VPID). See Section 28.1.

6 WBINVD exiting This control determines whether executions of WBINVD cause VM exits.

7 Unrestricted guest This control determines whether guest software may run in unpaged protected mode or in real-

address mode.

8APIC-register

virtualization

If this control is 1, the logical processor virtualizes certain APIC accesses. See Section 29.4 and

Section 29.5.

9 Virtual-interrupt

delivery

This controls enables the evaluation and delivery of pending virtual interrupts as well as the

emulation of writes to the APIC registers that control interrupt prioritization.

10 PAUSE-loop exiting This control determines whether a series of executions of PAUSE can cause a VM exit (see

Section 24.6.13 and Section 25.1.3).

Table 24-6. Definitions of Primary Processor-Based VM-Execution Controls (Contd.)

Bit Position(s) Name Description

Vol. 3C 24-11

VIRTUAL-MACHINE CONTROL STRUCTURES

All other bits in this field are reserved to 0. Software should consult the VMX capability MSR

IA32_VMX_PROCBASED_CTLS2 (see Appendix A.3.3) to determine which bits may be set to 1. Failure to clear

reserved bits causes subsequent VM entries to fail (see Section 26.2.1.1).

24.6.3 Exception Bitmap

The exception bitmap is a 32-bit field that contains one bit for each exception. When an exception occurs, its

vector is used to select a bit in this field. If the bit is 1, the exception causes a VM exit. If the bit is 0, the exception

is delivered normally through the IDT, using the descriptor corresponding to the exception’s vector.

Whether a page fault (exception with vector 14) causes a VM exit is determined by bit 14 in the exception bitmap

as well as the error code produced by the page fault and two 32-bit fields in the VMCS (the page-fault error-code

mask and page-fault error-code match). See Section 25.2 for details.

24.6.4 I/O-Bitmap Addresses

The VM-execution control fields include the 64-bit physical addresses of I/O bitmaps A and B (each of which are

4 KBytes in size). I/O bitmap A contains one bit for each I/O port in the range 0000H through 7FFFH; I/O bitmap B

contains bits for ports in the range 8000H through FFFFH.

A logical processor uses these bitmaps if and only if the “use I/O bitmaps” control is 1. If the bitmaps are used,

execution of an I/O instruction causes a VM exit if any bit in the I/O bitmaps corresponding to a port it accesses is

1. See Section 25.1.3 for details. If the bitmaps are used, their addresses must be 4-KByte aligned.

24.6.5 Time-Stamp Counter Offset

VM-execution control fields include a 64-bit TSC-offset field. If the “RDTSC exiting” control is 0 and the “use TSC

offsetting” control is 1, this field controls executions of the RDTSC and RDTSCP instructions. It also controls execu-

tions of the RDMSR instruction that read from the IA32_TIME_STAMP_COUNTER MSR. For all of these, the signed

value of the TSC offset is combined with the contents of the time-stamp counter (using signed addition) and the

sum is reported to guest software in EDX:EAX. See Chapter 25 for a detailed treatment of the behavior of RDTSC,

RDTSCP, and RDMSR in VMX non-root operation.

24.6.6 Guest/Host Masks and Read Shadows for CR0 and CR4

VM-execution control fields include guest/host masks and read shadows for the CR0 and CR4 registers. These

fields control executions of instructions that access those registers (including CLTS, LMSW, MOV CR, and SMSW).

They are 64 bits on processors that support Intel 64 architecture and 32 bits on processors that do not.

In general, bits set to 1 in a guest/host mask correspond to bits “owned” by the host:

• Guest attempts to set them (using CLTS, LMSW, or MOV to CR) to values differing from the corresponding bits

in the corresponding read shadow cause VM exits.

• Guest reads (using MOV from CR or SMSW) return values for these bits from the corresponding read shadow.

11 RDRAND exiting This control determines whether executions of RDRAND cause VM exits.

12 Enable INVPCID If this control is 0, any execution of INVPCID causes an invalid-opcode exception (#UD).

13 Enable

VM functions

Setting this control to 1 enables use of the VMFUNC instruction in VMX non-root operation. See

Section 25.5.5.

14 VMCS shadowing If this control is 1, executions of VMREAD and VMWRITE in VMX non-root operation may access

a shadow VMCS (instead of causing VM exits). See Section 24.10 and Section 30.3.

18 EPT-violation #VE If this control is 1, EPT violations may cause virtualization exceptions (#VE) instead of VM exits.

See Section 25.5.6.

Table 24-7. Definitions of Secondary Processor-Based VM-Execution Controls (Contd.)

Bit Position(s) Name Description

24-12 Vol. 3C

VIRTUAL-MACHINE CONTROL STRUCTURES

Bits cleared to 0 correspond to bits “owned” by the guest; guest attempts to modify them succeed and guest reads

return values for these bits from the control register itself.

See Chapter 25 for details regarding how these fields affect VMX non-root operation.

24.6.7 CR3-Target Controls

The VM-execution control fields include a set of 4 CR3-target values and a CR3-target count. The CR3-target

values each have 64 bits on processors that support Intel 64 architecture and 32 bits on processors that do not. The

CR3-target count has 32 bits on all processors.

An execution of MOV to CR3 in VMX non-root operation does not cause a VM exit if its source operand matches one

of these values. If the CR3-target count is n, only the first n CR3-target values are considered; if the CR3-target

count is 0, MOV to CR3 always causes a VM exit

There are no limitations on the values that can be written for the CR3-target values. VM entry fails (see Section

26.2) if the CR3-target count is greater than 4.

Future processors may support a different number of CR3-target values. Software should read the VMX capability

MSR IA32_VMX_MISC (see Appendix A.6) to determine the number of values supported.

24.6.8 Controls for APIC Virtualization

There are three mechanisms by which software accesses registers of the logical processor’s local APIC:

• If the local APIC is in xAPIC mode, it can perform memory-mapped accesses to addresses in the 4-KByte page

referenced by the physical address in the IA32_APIC_BASE MSR (see Section 10.4.4, “Local APIC Status and

Location” in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A and Intel® 64

Architecture Processor Topology Enumeration).

• If the local APIC is in x2APIC mode, it can accesses the local APIC’s registers using the RDMSR and WRMSR

instructions (see Intel® 64 Architecture Processor Topology Enumeration).

• In 64-bit mode, it can access the local APIC’s task-priority register (TPR) using the MOV CR8 instruction.

There are five processor-based VM-execution controls (see Section 24.6.2) that control such accesses. There are

“use TPR shadow”, “virtualize APIC accesses”, “virtualize x2APIC mode”, “virtual-interrupt delivery”, and “APIC-

• APIC-access address (64 bits). This field contains the physical address of the 4-KByte APIC-access page.

If the “virtualize APIC accesses” VM-execution control is 1, access to this page may cause VM exits or be

virtualized by the processor. See Section 29.4.

The APIC-access address exists only on processors that support the 1-setting of the “virtualize APIC accesses”

VM-execution control.

• Virtual-APIC address (64 bits). This field contains the physical address of the 4-KByte virtual-APIC page.

The processor uses the virtual-APIC page to virtualize certain accesses to APIC registers and to manage virtual

interrupts; see Chapter 29.

Depending on the setting of the controls indicated earlier, the virtual-APIC page may be accessed by the

following operations:

— The MOV CR8 instructions (see Section 29.3).

— Accesses to the APIC-access page if, in addition, the “virtualize APIC accesses” VM-execution control is 1

(see Section 29.4).

— The RDMSR and WRMSR instructions if, in addition, the value of ECX is in the range 800H–8FFH (indicating

an APIC MSR) and the “virtualize x2APIC mode” VM-execution control is 1 (see Section 29.5).

If the “use TPR shadow” VM-execution control is 1, VM entry ensures that the virtual-APIC address is 4-KByte

aligned. The virtual-APIC address exists only on processors that support the 1-setting of the “use TPR shadow”

VM-execution control.

1. If the local APIC does not support x2APIC mode, it is always in xAPIC mode.

Vol. 3C 24-13

VIRTUAL-MACHINE CONTROL STRUCTURES

• TPR threshold (32 bits). Bits 3:0 of this field determine the threshold below which bits 7:4 of VTPR (see

Section 29.1.1) cannot fall. If the “virtual-interrupt delivery” VM-execution control is 0, a VM exit occurs after

an operation (e.g., an execution of MOV to CR8) that reduces the value of those bits below the TPR threshold.

See Section 29.1.2.

The TPR threshold exists only on processors that support the 1-setting of the “use TPR shadow” VM-execution

control.

• EOI-exit bitmap (4 fields; 64 bits each). These fields are supported only on processors that support the 1-

setting of the “virtual-interrupt delivery” VM-execution control. They are used to determine which virtualized

writes to the APIC’s EOI register cause VM exits:

— EOI_EXIT0 contains bits for vectors from 0 (bit 0) to 63 (bit 63).

— EOI_EXIT1 contains bits for vectors from 64 (bit 0) to 127 (bit 63).

— EOI_EXIT2 contains bits for vectors from 128 (bit 0) to 191 (bit 63).

— EOI_EXIT3 contains bits for vectors from 192 (bit 0) to 255 (bit 63).

See Section 29.1.4 for more information on the use of this field.

• Posted-interrupt notification vector (16 bits). This field is supported only on processors that support the 1-

setting of the “process posted interrupts” VM-execution control. Its low 8 bits contain the interrupt vector that

is used to notify a logical processor that virtual interrupts have been posted. See Section 29.6 for more

information on the use of this field.

• Posted-interrupt descriptor address (64 bits). This field is supported only on processors that support the

1-setting of the “process posted interrupts” VM-execution control. It is the physical address of a 64-byte

aligned posted interrupt descriptor. See Section 29.6 for more information on the use of this field.

24.6.9 MSR-Bitmap Address

On processors that support the 1-setting of the “use MSR bitmaps” VM-execution control, the VM-execution control

fields include the 64-bit physical address of four contiguous MSR bitmaps, which are each 1-KByte in size. This

field does not exist on processors that do not support the 1-setting of that control. The four bitmaps are:

• Read bitmap for low MSRs (located at the MSR-bitmap address). This contains one bit for each MSR address

in the range 00000000H to 00001FFFH. The bit determines whether an execution of RDMSR applied to that

MSR causes a VM exit.

• Read bitmap for high MSRs (located at the MSR-bitmap address plus 1024). This contains one bit for each

MSR address in the range C0000000H toC0001FFFH. The bit determines whether an execution of RDMSR

applied to that MSR causes a VM exit.

• Write bitmap for low MSRs (located at the MSR-bitmap address plus 2048). This contains one bit for each

MSR address in the range 00000000H to 00001FFFH. The bit determines whether an execution of WRMSR

applied to that MSR causes a VM exit.

• Write bitmap for high MSRs (located at the MSR-bitmap address plus 3072). This contains one bit for each

MSR address in the range C0000000H toC0001FFFH. The bit determines whether an execution of WRMSR

applied to that MSR causes a VM exit.

A logical processor uses these bitmaps if and only if the “use MSR bitmaps” control is 1. If the bitmaps are used, an

execution of RDMSR or WRMSR causes a VM exit if the value of RCX is in neither of the ranges covered by the

bitmaps or if the appropriate bit in the MSR bitmaps (corresponding to the instruction and the RCX value) is 1. See

Section 25.1.3 for details. If the bitmaps are used, their address must be 4-KByte aligned.

24.6.10 Executive-VMCS Pointer

The executive-VMCS pointer is a 64-bit field used in the dual-monitor treatment of system-management interrupts

(SMIs) and system-management mode (SMM). SMM VM exits save this field as described in Section 34.15.2.

VM entries that return from SMM use this field as described in Section 34.15.4.

24-14 Vol. 3C

VIRTUAL-MACHINE CONTROL STRUCTURES

24.6.11 Extended-Page-Table Pointer (EPTP)

The extended-page-table pointer (EPTP) contains the address of the base of EPT PML4 table (see Section

28.2.2), as well as other EPT configuration information. The format of this field is shown in Table 24-8.

The EPTP exists only on processors that support the 1-setting of the “enable EPT” VM-execution control.

24.6.12 Virtual-Processor Identifier (VPID)

The virtual-processor identifier (VPID) is a 16-bit field. It exists only on processors that support the 1-setting of

the “enable VPID” VM-execution control. See Section 28.1 for details regarding the use of this field.

24.6.13 Controls for PAUSE-Loop Exiting

On processors that support the 1-setting of the “PAUSE-loop exiting” VM-execution control, the VM-execution

control fields include the following 32-bit fields:

• PLE_Gap. Software can configure this field as an upper bound on the amount of time between two successive

executions of PAUSE in a loop.

• PLE_Window. Software can configure this field as an upper bound on the amount of time a guest is allowed to

execute in a PAUSE loop.

These fields measure time based on a counter that runs at the same rate as the timestamp counter (TSC). See

Section 25.1.3 for more details regarding PAUSE-loop exiting.

24.6.14 VM-Function Controls

The VM-function controls constitute a 64-bit vector that governs use of the VMFUNC instruction in VMX non-root

operation. This field is supported only on processors that support the 1-settings of both the “activate secondary

Table 24-8. Format of Extended-Page-Table Pointer

Bit

Position(s)

Field

2:0 EPT paging-structure memory type (see Section 28.2.5):

0 = Uncacheable (UC)

6= Write-back (WB)

Other values are reserved.

NOTES:

1. Software should read the VMX capability MSR IA32_VMX_EPT_VPID_CAP (see Appendix A.10) to determine what EPT paging-struc-

ture memory types are supported.

5:3 This value is 1 less than the EPT page-walk length (see Section 28.2.2)

6 Setting this control to 1 enables accessed and dirty flags for EPT (see Section 28.2.4)

2. Not all processors support accessed and dirty flags for EPT. Software should read the VMX capability MSR

IA32_VMX_EPT_VPID_CAP (see Appendix A.10) to determine whether the processor supports this feature.

11:7 Reserved

N–1:12 Bits N–1:12 of the physical address of the 4-KByte aligned EPT PML4 table

3. N is the physical-address width supported by the logical processor. Software can determine a processor’s physical-address width by

executing CPUID with 80000008H in EAX. The physical-address width is returned in bits 7:0 of EAX.

63:N Reserved

剩余451页未读，继续阅读

thill

粉丝: 3
资源: 59

Intel® 64 and IA-32 Architectures System Programming Guide

FreeBSD内核调试指南：Intel文档详解

Intel多线程应用程序开发指南

英特尔GP规范：TEE系统架构文档解析

intel文档 卷3

Intel文档(英文).rar

x86-sat:使用Z3的x86指令的基本SAT模型，可从英特尔文档自动生成

Intel英特尔Hex格式官方文档

Intel Galileo官方文档

Intel体系结构文档

intel CPU 开发文档

最新资源

intel文档卷3