Volume 3B System Programming Guide_ Part 2 (794104), страница 29
Текст из файла (страница 29)
3VIRTUAL-MACHINE CONTROL STRUCTURES20.6.3Exception BitmapThe exception bitmap is a 32-bit field that contains one bit for each exception.When an exception occurs, its vector is used to select a bit in this field. If the bit is 1,the exception causes a VM exit. If the bit is 0, the exception is delivered normallythrough the IDT, using the descriptor corresponding to the exception’s vector.Whether a page fault (exception with vector 14) causes a VM exit is determined bybit 14 in the exception bitmap as well as the error code produced by the page faultand two 32-bit fields in the VMCS (the page-fault error-code mask and pagefault error-code match).
See Section 21.3 for details.20.6.4I/O-Bitmap AddressesThe VM-execution control fields include the 64-bit physical addresses of I/Obitmaps A and B (each of which are 4 KBytes in size). I/O bitmap A contains one bitfor each I/O port in the range 0000H through 7FFFH; I/O bitmap B contains bits forports in the range 8000H through FFFFH.A logical processor uses these bitmaps if and only if the “use I/O bitmaps” control is1. If the bitmaps are used, execution of an I/O instruction causes a VM exit if any bitin the I/O bitmaps corresponding to a port it accesses is 1.
See Section 21.1.3 fordetails. If the bitmaps are used, their addresses must be 4-KByte aligned.20.6.5Time-Stamp Counter OffsetVM-execution control fields include a 64-bit TSC-offset field. If the “RDTSC exiting”control is 0 and the “use TSC offsetting” control is 1, this field controls executions ofthe RDTSC instruction and executions of the RDMSR instruction that read from theIA32_TIME_STAMP_COUNTER MSR. The signed value of the TSC offset is combinedwith the contents of the time-stamp counter (using signed addition) and the sum isreported to guest software in EDX:EAX.
See Chapter 21 for a detailed treatment ofthe behavior of RDTSC and RDMSR in VMX non-root operation.20.6.6Guest/Host Masks and Read Shadows for CR0 and CR4VM-execution control fields include guest/host masks and read shadows for theCR0 and CR4 registers. These fields control executions of instructions that accessthose registers (including CLTS, LMSW, MOV CR, and SMSW). They are 64 bits onprocessors that support Intel 64 architecture and 32 bits on processors that do not.In general, bits set to 1 in a guest/host mask correspond to bits “owned” by the host:•Guest attempts to set them (using CLTS, LMSW, or MOV to CR) to values differingfrom the corresponding bits in the corresponding read shadow cause VM exits.•Guest reads (using MOV from CR or SMSW) return values for these bits from thecorresponding read shadow.Vol.
3 20-13VIRTUAL-MACHINE CONTROL STRUCTURESBits cleared to 0 correspond to bits “owned” by the guest; guest attempts to modifythem succeed and guest reads return values for these bits from the control registeritself.See Chapter 21 for details regarding how these fields affect VMX non-root operation.20.6.7CR3-Target ControlsThe VM-execution control fields include a set of 4 CR3-target values and a CR3target count. The CR3-target values each have 64 bits on processors that supportIntel 64 architecture and 32 bits on processors that do not.
The CR3-target count has32 bits on all processors.An execution of MOV to CR3 in VMX non-root operation does not cause a VM exit if itssource operand matches one of these values. If the CR3-target count is n, only thefirst n CR3-target values are considered; if the CR3-target count is 0, MOV to CR3always causes a VM exitThere are no limitations on the values that can be written for the CR3-target values.VM entry fails (see Section 22.2) if the CR3-target count is greater than 4.Future processors may support a different number of CR3-target values. Softwareshould read the VMX capability MSR IA32_VMX_MISC (see Appendix G.5) to determine the number of values supported.20.6.8Controls for APIC AccessesThere are two mechanisms by which software accesses registers of the logicalprocessor’s local APIC:•It can perform memory-mapped accesses to addresses in the 4-KByte pagereferenced by the physical address in the IA32_APIC_BASE MSR (see Section8.4.4, “Local APIC Status and Location” in the Intel® 64 and IA-32 ArchitecturesSoftware Developer’s Manual, Volume 3A).•In 64-bit mode, it can access the local APIC’s task-priority register (TPR) usingthe MOV CR8 instruction.There are two processor-based VM-execution controls (see Section 20.6.2) thatcontrol such accesses.
There are “use TPR shadow” and “virtualize APIC accesses”.These controls interact with the following fields:•APIC-access address (64 bits). This field is the physical address of the 4-KByteAPIC-access page. If the “virtualize APIC accesses” VM-execution control is 1,operations that access this page may cause VM exits. See Section 21.2 andSection 21.5.The APIC-access address exists only on processors that support the 1-setting ofthe “virtualize APIC accesses” VM-execution control.20-14 Vol. 3VIRTUAL-MACHINE CONTROL STRUCTURES•Virtual-APIC address (64 bits).
This field is the physical address of the 4-KBytevirtual-APIC page. The virtual-APIC page contains the TPR shadow, whichcomprises bits 7:4 in byte 80H of that page. The TPR shadow is accessed by thefollowing operations if the “use TPR shadow” VM-execution control is 1:— The MOV CR8 instructions (see Section 21.1.3 and Section 21.4).— Accesses to byte 80H on the APIC-access page if, in addition, the “virtualizeAPIC accesses” VM-execution control is 1 (see Section 21.5.3).If the “use TPR shadow” VM-execution control is 1, the virtual-APIC address mustbe 4-KByte aligned.The virtual-APIC address exists only on processors that support the 1-setting ofthe “use TPR shadow” VM-execution control.•TPR threshold (32 bits).
Bits 3:0 of this field determine the threshold belowwhich the TPR shadow (see previous item) cannot fall. A VM exit occurs after anan operation (e.g., an execution of MOV to CR8) that reduces the TPR shadowbelow this value. See Section 21.4 and Section 21.5.3.The TPR threshold exists only on processors that support the 1-setting of the“use TPR shadow” VM-execution control.20.6.9MSR-Bitmap AddressOn processors that support the 1-setting of the “use MSR bitmaps” VM-executioncontrol, the VM-execution control fields include the 64-bit physical address of fourcontiguous MSR bitmaps, which are each 1-KByte in size. This field does not existon processors that do not support the 1-setting of that control. The four bitmaps are:•Read bitmap for low MSRs (located at the MSR-bitmap address).
This containsone bit for each MSR address in the range 00000000H – 00001FFFH. The bitdetermines whether an execution of RDMSR applied to that MSR causes aVM exit.•Read bitmap for high MSRs (located at the MSR-bitmap address plus 1024).This contains one bit for each MSR address in the range C0000000H –C0001FFFH. The bit determines whether an execution of RDMSR applied to thatMSR causes a VM exit.•Write bitmap for low MSRs (located at the MSR-bitmap address plus 2048).This contains one bit for each MSR address in the range 00000000H –00001FFFH. The bit determines whether an execution of WRMSR applied to thatMSR causes a VM exit.•Write bitmap for high MSRs (located at the MSR-bitmap address plus 3072).This contains one bit for each MSR address in the range C0000000H –C0001FFFH.
The bit determines whether an execution of WRMSR applied to thatMSR causes a VM exit.A logical processor uses these bitmaps if and only if the “use MSR bitmaps” controlis 1. If the bitmaps are used, an execution of RDMSR or WRMSR causes a VM exit ifVol. 3 20-15VIRTUAL-MACHINE CONTROL STRUCTURESthe value of RCX is in neither of the ranges covered by the bitmaps or if the appropriate bit in the MSR bitmaps (corresponding to the instruction and the RCX value) is1.
See Section 21.1.3 for details. If the bitmaps are used, their address must be 4KByte aligned.20.6.10 Executive-VMCS PointerThe executive-VMCS pointer is a 64-bit field used in the dual-monitor treatment ofsystem-management interrupts (SMIs) and system-management mode (SMM).
SMMVM exits save this field as described in Section 24.16.2. VM entries that return fromSMM use this field as described in Section 24.16.4.20.7VM-EXIT CONTROL FIELDSThe VM-exit control fields govern the behavior of VM exits. They are discussed inSection 20.7.1 and Section 20.7.2.20.7.1VM-Exit ControlsThe VM-exit controls constitute a 32-bit vector that governs the basic operation ofVM exits.
Table 20-8 lists the controls supported. See Chapter 23 for complete detailsof how these controls affect VM exits.Table 20-8. Definitions of VM-Exit ControlsBit Position(s) NameDescription9On processors that support Intel 64 architecture, this controldetermines whether a logical processor is in 64-bit modeafter the next VM exit. Its value is loaded into CS.L,IA32_EFER.LME, and IA32_EFER.LMA on every VM exit.1Host addressspace sizeThis control must be 0 on processors that do not supportIntel 64 architecture.15Acknowledgeinterrupt on exitThis control affects VM exits due to external interrupts:• If such a VM exit occurs and this control is 1, the logicalprocessor acknowledges the interrupt controller, acquiringthe interrupt’s vector.
![](https://s.studizba.com/z.php?f=/templates/si/i/noavatar.png&w=100&h=100&t=1"){kind=avatar}
