Intel® 64 and IA-32 Architectures：系统编程指南

需积分: 10 8 浏览量更新于2024-07-22 收藏 2.53MB PDF 举报

"Intel SDM3是Intel CPU体系结构和软件编程接口的一部分，主要涉及系统编程指南的第三部分，用于指导操作系统和设备驱动程序的开发。它由七卷组成，包括基本架构、指令集参考以及系统编程指南等。文档提供与Intel产品相关的信息，但不授予任何知识产权许可，并且Intel对产品的销售和使用不承担任何明示或暗示的保修责任。" Intel SDM3，全称为Intel®64 and IA-32 Architectures Software Developer’s Manual Volume 3C，是Intel为开发者提供的一个重要参考资料，专注于系统编程方面的指南。这个手册分为多个部分，覆盖了从底层硬件架构到高级软件接口的广泛内容，帮助开发者理解和利用Intel处理器的特性来优化软件性能。 1. **基本架构**（Volume 1）：这部分详细介绍了Intel 64（也称为x86-64）和IA-32架构的基本原理，包括处理器结构、内存模型、总线接口、指令执行流程等。对于开发操作系统内核和低级系统软件的人员来说，这是不可或缺的基础知识。 2. **指令集参考**（Volumes 2A-2Z）：分为两个部分，A-L和M-Z，包含了Intel处理器支持的所有指令的详细描述，包括操作码、操作数、执行时间和影响的寄存器等，是编写汇编语言程序或理解编译器生成代码的关键。 3. **系统编程指南**（Volumes 3A-3C）：这部分深入探讨了操作系统如何与硬件交互，涵盖了中断处理、异常处理、系统调用、多处理器同步、内存管理、I/O系统、电源管理和虚拟化技术等内容。Volume 3C特别关注系统编程的特定方面，如系统服务、硬件事件和性能计数器的使用。 4. **开发者须知**：文档中的信息仅供参考，不包含任何知识产权的许可。Intel产品仅按照其销售条款和条件提供，并且明确声明不提供任何明示或暗示的保修，包括但不限于针对特定用途的适用性。了解和掌握Intel SDM3的内容，对于操作系统开发者、设备驱动程序员以及性能优化专家来说至关重要。通过这些手册，开发者可以有效地利用Intel处理器的高级特性，提高软件的效率和兼容性，同时避免潜在的问题和陷阱。无论是实现高效的内存管理策略，还是设计高性能的设备驱动，Intel SDM3都提供了详尽的指导和参考。

24-10 Vol. 3C

VIRTUAL-MACHINE CONTROL STRUCTURES

IA32_VMX_TRUE_PROCBASED_CTLS MSR, and software should consult this MSR to discover support for the 0-

settings of these bits. Software that is not aware of the functionality of any one of these bits should set that bit to 1.

Bit 31 of the primary processor-based VM-execution controls determines whether the secondary processor-based

VM-execution controls are used. If that bit is 0, VM entry and VMX non-root operation function as if all the

secondary processor-based VM-execution controls were 0. Processors that support only the 0-setting of bit 31 of

the primary processor-based VM-execution controls do not support the secondary processor-based VM-execution

controls.

Table 24-7 lists the secondary processor-based VM-execution controls. See Chapter 25 for more details of how

these controls affect processor behavior in VMX non-root operation.

All other bits in this field are reserved to 0. Software should consult the VMX capability MSR

IA32_VMX_PROCBASED_CTLS2 (see Appendix A.3.3) to determine which bits may be set to 1. Failure to clear

reserved bits causes subsequent VM entries to fail (see Section 26.2.1.1).

24.6.3 Exception Bitmap

The exception bitmap is a 32-bit field that contains one bit for each exception. When an exception occurs, its

vector is used to select a bit in this field. If the bit is 1, the exception causes a VM exit. If the bit is 0, the exception

is delivered normally through the IDT, using the descriptor corresponding to the exception’s vector.

Whether a page fault (exception with vector 14) causes a VM exit is determined by bit 14 in the exception bitmap

as well as the error code produced by the page fault and two 32-bit fields in the VMCS (the page-fault error-code

mask and page-fault error-code match). See Section 25.2 for details.

Table 24-7. Definitions of Secondary Processor-Based VM-Execution Controls

Bit Position(s) Name Description

0 Virtualize APIC

accesses

If this control is 1, the logical processor treats specially accesses to the page with the APIC-

access address. See Section 29.4.

1 Enable EPT If this control is 1, extended page tables (EPT) are enabled. See Section 28.2.

2 Descriptor-table

exiting

This control determines whether executions of LGDT, LIDT, LLDT, LTR, SGDT, SIDT, SLDT, and

STR cause VM exits.

3 Enable RDTSCP If this control is 0, any execution of RDTSCP causes an invalid-opcode exception (#UD).

4 Virtualize x2APIC

mode

If this control is 1, the logical processor treats specially RDMSR and WRMSR to APIC MSRs (in

the range 800H–8FFH). See Section 29.5.

5 Enable VPID If this control is 1, cached translations of linear addresses are associated with a virtual-

processor identifier (VPID). See Section 28.1.

6 WBINVD exiting This control determines whether executions of WBINVD cause VM exits.

7 Unrestricted guest This control determines whether guest software may run in unpaged protected mode or in real-

address mode.

8APIC-register

virtualization

If this control is 1, the logical processor virtualizes certain APIC accesses. See Section 29.4 and

Section 29.5.

9 Virtual-interrupt

delivery

This controls enables the evaluation and delivery of pending virtual interrupts as well as the

emulation of writes to the APIC registers that control interrupt prioritization.

10 PAUSE-loop exiting This control determines whether a series of executions of PAUSE can cause a VM exit (see

Section 24.6.13 and Section 25.1.3).

11 RDRAND exiting This control determines whether executions of RDRAND cause VM exits.

12 Enable INVPCID If this control is 0, any execution of INVPCID causes an invalid-opcode exception (#UD).

13 Enable

VM functions

Setting this control to 1 enables use of the VMFUNC instruction in VMX non-root operation. See

Section 25.5.5.

Vol. 3C 24-11

VIRTUAL-MACHINE CONTROL STRUCTURES

24.6.4 I/O-Bitmap Addresses

The VM-execution control fields include the 64-bit physical addresses of I/O bitmaps A and B (each of which are

4 KBytes in size). I/O bitmap A contains one bit for each I/O port in the range 0000H through 7FFFH; I/O bitmap B

contains bits for ports in the range 8000H through FFFFH.

A logical processor uses these bitmaps if and only if the “use I/O bitmaps” control is 1. If the bitmaps are used,

execution of an I/O instruction causes a VM exit if any bit in the I/O bitmaps corresponding to a port it accesses is

1. See Section 25.1.3 for details. If the bitmaps are used, their addresses must be 4-KByte aligned.

24.6.5 Time-Stamp Counter Offset

VM-execution control fields include a 64-bit TSC-offset field. If the “RDTSC exiting” control is 0 and the “use TSC

offsetting” control is 1, this field controls executions of the RDTSC and RDTSCP instructions. It also controls execu-

tions of the RDMSR instruction that read from the IA32_TIME_STAMP_COUNTER MSR. For all of these, the signed

value of the TSC offset is combined with the contents of the time-stamp counter (using signed addition) and the

sum is reported to guest software in EDX:EAX. See Chapter 25 for a detailed treatment of the behavior of RDTSC,

RDTSCP, and RDMSR in VMX non-root operation.

24.6.6 Guest/Host Masks and Read Shadows for CR0 and CR4

VM-execution control fields include guest/host masks and read shadows for the CR0 and CR4 registers. These

fields control executions of instructions that access those registers (including CLTS, LMSW, MOV CR, and SMSW).

They are 64 bits on processors that support Intel 64 architecture and 32 bits on processors that do not.

In general, bits set to 1 in a guest/host mask correspond to bits “owned” by the host:

• Guest attempts to set them (using CLTS, LMSW, or MOV to CR) to values differing from the corresponding bits

in the corresponding read shadow cause VM exits.

• Guest reads (using MOV from CR or SMSW) return values for these bits from the corresponding read shadow.

Bits cleared to 0 correspond to bits “owned” by the guest; guest attempts to modify them succeed and guest reads

return values for these bits from the control register itself.

See Chapter 25 for details regarding how these fields affect VMX non-root operation.

24.6.7 CR3-Target Controls

The VM-execution control fields include a set of 4 CR3-target values and a CR3-target count. The CR3-target

values each have 64 bits on processors that support Intel 64 architecture and 32 bits on processors that do not.

The CR3-target count has 32 bits on all processors.

An execution of MOV to CR3 in VMX non-root operation does not cause a VM exit if its source operand matches one

of these values. If the CR3-target count is n, only the first n CR3-target values are considered; if the CR3-target

count is 0, MOV to CR3 always causes a VM exit

There are no limitations on the values that can be written for the CR3-target values. VM entry fails (see Section

26.2) if the CR3-target count is greater than 4.

Future processors may support a different number of CR3-target values. Software should read the VMX capability

MSR IA32_VMX_MISC (see Appendix A.6) to determine the number of values supported.

24.6.8 Controls for APIC Virtualization

There are three mechanisms by which software accesses registers of the logical processor’s local APIC:

• If the local APIC is in xAPIC mode, it can perform memory-mapped accesses to addresses in the 4-KByte page

referenced by the physical address in the IA32_APIC_BASE MSR (see Section 10.4.4, “Local APIC Status and

Location” in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A and Intel® 64

Architecture Processor Topology Enumeration).

24-12 Vol. 3C

VIRTUAL-MACHINE CONTROL STRUCTURES

• If the local APIC is in x2APIC mode, it can accesses the local APIC’s registers using the RDMSR and WRMSR

instructions (see Intel® 64 Architecture Processor Topology Enumeration).

• In 64-bit mode, it can access the local APIC’s task-priority register (TPR) using the MOV CR8 instruction.

There are five processor-based VM-execution controls (see Section 24.6.2) that control such accesses. There are

“use TPR shadow”, “virtualize APIC accesses”, “virtualize x2APIC mode”, “virtual-interrupt delivery”, and “APIC-

• APIC-access address (64 bits). This field contains the physical address of the 4-KByte APIC-access page.

If the “virtualize APIC accesses” VM-execution control is 1, access to this page may cause VM exits or be

virtualized by the processor. See Section 29.4.

The APIC-access address exists only on processors that support the 1-setting of the “virtualize APIC accesses”

VM-execution control.

• Virtual-APIC address (64 bits). This field contains the physical address of the 4-KByte virtual-APIC page.

The processor uses the virtual-APIC page to virtualize certain accesses to APIC registers and to manage virtual

interrupts; see Chapter 29.

Depending on the setting of the controls indicated earlier, the virtual-APIC page may be accessed by the

following operations:

— The MOV CR8 instructions (see Section 29.3).

— Accesses to the APIC-access page if, in addition, the “virtualize APIC accesses” VM-execution control is 1

(see Section 29.4).

— The RDMSR and WRMSR instructions if, in addition, the value of ECX is in the range 800H–8FFH (indicating

an APIC MSR) and the “virtualize x2APIC mode” VM-execution control is 1 (see Section 29.5).

If the “use TPR shadow” VM-execution control is 1, VM entry ensures that the virtual-APIC address is 4-KByte

aligned. The virtual-APIC address exists only on processors that support the 1-setting of the “use TPR shadow”

VM-execution control.

• TPR threshold (32 bits). Bits 3:0 of this field determine the threshold below which bits 7:4 of VTPR (see

Section 29.1.1) cannot fall. If the “virtual-interrupt delivery” VM-execution control is 0, a VM exit occurs after

an operation (e.g., an execution of MOV to CR8) that reduces the value of those bits below the TPR threshold.

See Section 29.1.2.

The TPR threshold exists only on processors that support the 1-setting of the “use TPR shadow” VM-execution

control.

• EOI-exit bitmap (4 fields; 64 bits each). These fields are supported only on processors that support the 1-

setting of the “virtual-interrupt delivery” VM-execution control. They are used to determine which virtualized

writes to the APIC’s EOI register cause VM exits:

— EOI_EXIT0 contains bits for vectors from 0 (bit 0) to 63 (bit 63).

— EOI_EXIT1 contains bits for vectors from 64 (bit 0) to 127 (bit 63).

— EOI_EXIT2 contains bits for vectors from 128 (bit 0) to 191 (bit 63).

— EOI_EXIT3 contains bits for vectors from 192 (bit 0) to 255 (bit 63).

See Section 29.1.4 for more information on the use of this field.

• Posted-interrupt notification vector (16 bits). This field is supported only on processors that support the 1-

setting of the “process posted interrupts” VM-execution control. Its low 8 bits contain the interrupt vector that

is used to notify a logical processor that virtual interrupts have been posted. See Section 29.6 for more

information on the use of this field.

• Posted-interrupt descriptor address (64 bits). This field is supported only on processors that support the

1-setting of the “process posted interrupts” VM-execution control. It is the physical address of a 64-byte

aligned posted interrupt descriptor. See Section 29.6 for more information on the use of this field.

1. If the local APIC does not support x2APIC mode, it is always in xAPIC mode.

Vol. 3C 24-13

VIRTUAL-MACHINE CONTROL STRUCTURES

24.6.9 MSR-Bitmap Address

On processors that support the 1-setting of the “use MSR bitmaps” VM-execution control, the VM-execution control

fields include the 64-bit physical address of four contiguous MSR bitmaps, which are each 1-KByte in size. This

field does not exist on processors that do not support the 1-setting of that control. The four bitmaps are:

• Read bitmap for low MSRs (located at the MSR-bitmap address). This contains one bit for each MSR address

in the range 00000000H to 00001FFFH. The bit determines whether an execution of RDMSR applied to that

MSR causes a VM exit.

• Read bitmap for high MSRs (located at the MSR-bitmap address plus 1024). This contains one bit for each

MSR address in the range C0000000H toC0001FFFH. The bit determines whether an execution of RDMSR

applied to that MSR causes a VM exit.

• Write bitmap for low MSRs (located at the MSR-bitmap address plus 2048). This contains one bit for each

MSR address in the range 00000000H to 00001FFFH. The bit determines whether an execution of WRMSR

applied to that MSR causes a VM exit.

• Write bitmap for high MSRs (located at the MSR-bitmap address plus 3072). This contains one bit for each

MSR address in the range C0000000H toC0001FFFH. The bit determines whether an execution of WRMSR

applied to that MSR causes a VM exit.

A logical processor uses these bitmaps if and only if the “use MSR bitmaps” control is 1. If the bitmaps are used, an

execution of RDMSR or WRMSR causes a VM exit if the value of RCX is in neither of the ranges covered by the

bitmaps or if the appropriate bit in the MSR bitmaps (corresponding to the instruction and the RCX value) is 1. See

Section 25.1.3 for details. If the bitmaps are used, their address must be 4-KByte aligned.

24.6.10 Executive-VMCS Pointer

The executive-VMCS pointer is a 64-bit field used in the dual-monitor treatment of system-management interrupts

(SMIs) and system-management mode (SMM). SMM VM exits save this field as described in Section 34.15.2.

VM entries that return from SMM use this field as described in Section 34.15.4.

24.6.11 Extended-Page-Table Pointer (EPTP)

The extended-page-table pointer (EPTP) contains the address of the base of EPT PML4 table (see Section

28.2.2), as well as other EPT configuration information. The format of this field is shown in Table 24-8.

Table 24-8. Format of Extended-Page-Table Pointer

Bit

Position(s)

Field

2:0 EPT paging-structure memory type (see Section 28.2.5):

0 = Uncacheable (UC)

6= Write-back (WB)

Other values are reserved.

NOTES:

1. Software should read the VMX capability MSR IA32_VMX_EPT_VPID_CAP (see Appendix A.10) to determine what EPT paging-struc-

ture memory types are supported.

5:3 This value is 1 less than the EPT page-walk length (see Section 28.2.2)

6 Setting this control to 1 enables accessed and dirty flags for EPT (see Section 28.2.4)

11:7 Reserved

N–1:12 Bits N–1:12 of the physical address of the 4-KByte aligned EPT PML4 table

63:N Reserved

24-14 Vol. 3C

VIRTUAL-MACHINE CONTROL STRUCTURES

The EPTP exists only on processors that support the 1-setting of the “enable EPT” VM-execution control.

24.6.12 Virtual-Processor Identifier (VPID)

The virtual-processor identifier (VPID) is a 16-bit field. It exists only on processors that support the 1-setting of

the “enable VPID” VM-execution control. See Section 28.1 for details regarding the use of this field.

24.6.13 Controls for PAUSE-Loop Exiting

On processors that support the 1-setting of the “PAUSE-loop exiting” VM-execution control, the VM-execution

control fields include the following 32-bit fields:

• PLE_Gap. Software can configure this field as an upper bound on the amount of time between two successive

executions of PAUSE in a loop.

• PLE_Window. Software can configure this field as an upper bound on the amount of time a guest is allowed to

execute in a PAUSE loop.

These fields measure time based on a counter that runs at the same rate as the timestamp counter (TSC). See

Section 25.1.3 for more details regarding PAUSE-loop exiting.

24.6.14 VM-Function Controls

The VM-function controls constitute a 64-bit vector that governs use of the VMFUNC instruction in VMX non-root

operation. This field is supported only on processors that support the 1-settings of both the “activate secondary

controls” primary processor-based VM-execution control and the “enable VM functions” secondary processor-

based VM-execution control.

Table 24-9 lists the VM-function controls. See Section 25.5.5 for more details of how these controls affect processor

behavior in VMX non-root operation.

All other bits in this field are reserved to 0. Software should consult the VMX capability MSR IA32_VMX_VMFUNC

(see Appendix A.11) to determine which bits are reserved. Failure to clear reserved bits causes subsequent

VM entries to fail (see Section 26.2.1.1).

Processors that support the 1-setting of the “EPTP switching” VM-function control also support a 64-bit field called

the EPTP-list address. This field contains the physical address of the 4-KByte EPTP list. The EPTP list comprises

512 8-Byte entries (each an EPTP value) and is used by the EPTP-switching VM function (see Section 25.5.5.3).

24.7 VM-EXIT CONTROL FIELDS

The VM-exit control fields govern the behavior of VM exits. They are discussed in Section 24.7.1 and Section

24.7.2.

2. Not all processors support accessed and dirty flags for EPT. Software should read the VMX capability MSR

IA32_VMX_EPT_VPID_CAP (see Appendix A.10) to determine whether the processor supports this feature.

3. N is the physical-address width supported by the logical processor. Software can determine a processor’s physical-address width by

executing CPUID with 80000008H in EAX. The physical-address width is returned in bits 7:0 of EAX.

Table 24-9. Definitions of VM-Function Controls

Bit Position(s) Name Description

0 EPTP switching The EPTP-switching VM function changes the EPT pointer to a value chosen from the EPTP list.

See Section 25.5.5.3.

剩余439页未读，继续阅读

qhjin2000

粉丝: 1
资源: 11

Intel® 64 and IA-32 Architectures：系统编程指南

intel cpu sdm2

intel sdm 最新 2017

intel cpu sdm

intel-sdm-vol-1

sdm参考书籍

325462-sdm-vol-1-2abcd-3abcd_intel处理器开发手册_44200_volume_

325462-sdm-vol-1-2abcd-3abcd.zip

IA32 EDS 三卷 (SDM).7z

inter指令集手册325383-sdm-vol-2abcd.pdf

Volume 3 (3A, 3B, 3C & 3D) Intel® 64 and IA-32 Architectures Software Developer

最新资源