Intel 64 and IA-32 Architectures. Software Developer’s Manual (2026) - page 47
CONTENTS
PAGE
34.15.4
VM Entries that Return from SMM
34-22
34.15.4.1
Checks on the Executive-VMCS Pointer Field
34-22
34.15.4.2
Checks on VM-Execution Control Fields
34-23
34.15.4.3
Checks on VM-Entry Control Fields
34-23
34.15.4.4
Checks on the Guest State Area
34-23
34.15.4.5
Loading Guest State
34-24
34.15.4.6
VMX-Preemption Timer
34-24
34.15.4.7
Updating the Current-VMCS and SMM-Transfer VMCS Pointers
34-24
34.15.4.8
VM Exits Induced by VM Entry
34-24
34.15.4.9
SMI Blocking
34-24
34.15.4.10
Failures of VM Entries That Return from SMM
34-25
34.15.5
Enabling the Dual-Monitor Treatment
34-25
34.15.6
Activating the Dual-Monitor Treatment
34-26
34.15.6.1
Initial Checks
34-26
34.15.6.2
Updating the Current-VMCS and Executive-VMCS Pointers
34-27
34.15.6.3
Saving Guest State
34-27
34.15.6.4
Saving MSRs
34-28
34.15.6.5
Loading Host State
34-28
34.15.6.6
Loading MSRs
34-29
34.15.7
Deactivating the Dual-Monitor Treatment
34-29
34.16
SMI AND PROCESSOR EXTENDED STATE MANAGEMENT
34-30
34.17
MODEL-SPECIFIC SYSTEM MANAGEMENT ENHANCEMENT
34-30
34.17.1
SMM Handler Code Access Control
34-30
34.17.2
SMI Delivery Delay Reporting
34-30
34.17.3
Blocked SMI Reporting
34-31
CHAPTER 35
SECURE ARBITRATION MODE (SEAM)
35.1
MODES OF OPERATION
35-1
35.1.1
SEAM Calls
35-2
35.1.2
SEAM Returns
35-2
35.1.3
SEAM Host-Guest Transitions
35-2
35.2
SEAM AND TME-MK
35-2
35.3
OPERATION IN SEAM
35-3
35.3.1
SEAM Root Operation
35-3
35.3.2
SEAM Non-Root Operation
35-3
35.4
MEMORY PROTECTION
35-5
35.4.1
SEAM Range
35-5
35.4.2
Memory Protections
35-5
35.5
SEAM INSTRUCTION REFERENCE
35-6
SEAMCALL-Enter SEAM Root Operation
35-7
TDCALL-Call SEAM Module
35-9
CHAPTER 36
INTEL® PROCESSOR TRACE
36.1
OVERVIEW
36-1
36.1.1
Features and Capabilities
36-1
36.1.1.1
Packet Summary
36-1
36.2
INTEL® PROCESSOR TRACE OPERATIONAL MODEL
36-2
36.2.1
Change of Flow Instruction (COFI) Tracing
36-2
36.2.1.1
Direct Transfer COFI
36-3
36.2.1.2
Indirect Transfer COFI
36-3
36.2.1.3
Far Transfer COFI
36-4
36.2.2
Software Trace Instrumentation with PTWRITE
36-4
36.2.3
Power Event Tracing
36-4
36.2.4
Event Tracing
36-5
36.2.5
Trace Filtering
36-5
36.2.5.1
Filtering by Current Privilege Level (CPL)
36-5
36.2.5.2
Filtering by CR3
36-5
36.2.5.3
Filtering by IP
36-6
36.2.6
Packet Generation Enable Controls
36-7
36.2.6.1
Packet Enable (PacketEn)
36-7
xxx Vol. 3A
CONTENTS
PAGE
36.2.6.2
Trigger Enable (TriggerEn)
36-7
36.2.6.3
Context Enable (ContextEn)
36-8
36.2.6.4
Branch Enable (BranchEn)
36-8
36.2.6.5
Filter Enable (FilterEn)
36-8
36.2.7
Trace Output
36-9
36.2.7.1
Single Range Output
36-9
36.2.7.2
Table of Physical Addresses (ToPA)
36-10
Single Output Region ToPA Implementation
36-12
ToPA Table Entry Format
36-12
ToPA STOP
36-13
ToPA PMI
36-13
PMI Preservation
36-14
ToPA PMI and Single Output Region ToPA Implementation
36-14
ToPA PMI and XSAVES/XRSTORS State Handling
36-15
ToPA Errors
36-15
36.2.7.3
Trace Transport Subsystem
36-16
36.2.7.4
Restricted Memory Access
36-16
Modifications to Restricted Memory Regions
36-17
36.2.8
Enabling and Configuration MSRs
36-17
36.2.8.1
General Considerations
36-17
36.2.8.2
IA32_RTIT_CTL MSR
36-17
36.2.8.3
Enabling and Disabling Packet Generation with TraceEn
36-21
Disabling Packet Generation
36-21
Other Writes to IA32_RTIT_CTL
36-21
36.2.8.4
IA32_RTIT_STATUS MSR
36-21
36.2.8.5
IA32_RTIT_ADDRn_A and IA32_RTIT_ADDRn_B MSRs
36-22
36.2.8.6
IA32_RTIT_CR3_MATCH MSR
36-23
36.2.8.7
IA32_RTIT_OUTPUT_BASE MSR
36-23
36.2.8.8
IA32_RTIT_OUTPUT_MASK_PTRS MSR
36-24
36.2.9
Interaction of Intel® Processor Trace and Other Processor Features
36-24
36.2.9.1
Intel® Transactional Synchronization Extensions (Intel® TSX)
36-24
36.2.9.2
TSX and IP Filtering
36-25
36.2.9.3
System Management Mode (SMM)
36-25
36.2.9.4
Virtual-Machine Extensions (VMX)
36-26
36.2.9.5
Intel® Software Guard Extensions (Intel® SGX)
36-26
36.2.9.6
SENTER/ENTERACCS and ACM
36-26
36.2.9.7
Intel® Memory Protection Extensions (Intel® MPX)
36-26
36.3
CONFIGURATION AND PROGRAMMING GUIDELINE
36-27
36.3.1
Detection of Intel Processor Trace and Capability Enumeration
36-27
36.3.1.1
Packet Decoding of RIP versus LIP
36-30
36.3.1.2
Model Specific Capability Restrictions
36-30
36.3.2
Enabling and Configuration of Trace Packet Generation
36-31
36.3.2.1
Enabling Packet Generation
36-31
36.3.2.2
Disabling Packet Generation
36-31
36.3.3
Flushing Trace Output
36-31
36.3.4
Warm Reset
36-31
36.3.5
Context Switch Consideration
36-32
36.3.5.1
Manual Trace Configuration Context Switch
36-32
36.3.5.2
Trace Configuration Context Switch Using XSAVES/XRSTORS
36-32
36.3.6
Cycle-Accurate Mode
36-32
36.3.6.1
Cycle Counter
36-33
36.3.6.2
Cycle Packet Semantics
36-33
36.3.6.3
Cycle Thresholds
36-34
36.3.7
Decoder Synchronization (PSB+)
36-34
36.3.8
Internal Buffer Overflow
36-35
36.3.8.1
Overflow Impact on Enables
36-35
36.3.8.2
Overflow Impact on Timing Packets
36-36
36.3.9
TNT Disable
36-36
36.3.10
Operational Errors
36-36
36.4
TRACE PACKETS AND DATA TYPES
36-36
36.4.1
Packet Relationships and Ordering
36-37
36.4.1.1
Packet Blocks
36-37
Decoder Implications
36-38
Vol. 3A xxxi
CONTENTS
PAGE
36.4.2
Packet Definitions
36-38
36.4.2.1
Taken/Not-taken (TNT) Packet
36-39
36.4.2.2
Target IP (TIP) Packet
36-40
IP Compression
36-40
Indirect Transfer Compression for Returns (RET)
36-41
36.4.2.3
Deferred TIPs
36-42
36.4.2.4
Packet Generation Enable (TIP.PGE) Packet
36-43
36.4.2.5
Packet Generation Disable (TIP.PGD) Packet
36-43
36.4.2.6
Flow Update (FUP) Packet
36-44
FUP IP Payload
36-45
36.4.2.7
Paging Information (PIP) Packet
36-46
36.4.2.8
MODE Packets
36-47
MODE.Exec Packet
36-47
MODE.TSX Packet
36-48
36.4.2.9
TraceStop Packet
36-49
36.4.2.10
Core:Bus Ratio (CBR) Packet
36-49
36.4.2.11
Timestamp Counter (TSC) Packet
36-50
36.4.2.12
Mini Time Counter (MTC) Packet
36-50
36.4.2.13
TSC/MTC Alignment (TMA) Packet
36-51
36.4.2.14
Cycle Count (CYC) Packet
36-51
36.4.2.15
VMCS Packet
36-52
36.4.2.16
Overflow (OVF) Packet
36-53
36.4.2.17
Packet Stream Boundary (PSB) Packet
36-54
36.4.2.18
PSBEND Packet
36-55
36.4.2.19
Maintenance (MNT) Packet
36-55
36.4.2.20
PAD Packet
36-56
36.4.2.21
PTWRITE (PTW) Packet
36-56
36.4.2.22
Execution Stop (EXSTOP) Packet
36-57
36.4.2.23
MWAIT Packet
36-57
36.4.2.24
Power Entry (PWRE) Packet
36-58
36.4.2.25
Power Exit (PWRX) Packet
36-59
36.4.2.26
Block Begin Packet (BBP)
36-60
36.4.2.27
Block Item Packet (BIP)
36-60
BIP State Value Encodings
36-61
36.4.2.28
Block End Packet (BEP)
36-66
36.4.2.29
Control Flow Event (CFE) Packet
36-66
CFE Packet Type and Vector Fields
36-67
36.4.2.30
Event Data (EVD) Packet
36-67
36.5
TRACING IN VMX OPERATION
36-68
36.5.1
VMX-Specific Packets and VMCS Controls
36-68
36.5.2
Managing Trace Packet Generation Across VMX Transitions
36-69
36.5.2.1
System-Wide Tracing
36-69
36.5.2.2
Guest-Only Tracing
36-70
36.5.2.3
Emulation of Intel PT Traced State
36-71
36.5.2.4
TSC Scaling
36-71
36.5.2.5
Failed VM Entry
36-71
36.5.2.6
VMX Abort
36-71
36.6
TRACING AND SMM TRANSFER MONITOR (STM)
36-72
36.7
INTEL® PT TRIGGER TRACING
36-72
36.7.1
Processor Trace Trigger Tracing Overview
36-72
36.7.1.1
Trigger Unit
36-72
36.7.1.2
Trigger Input
36-72
36.7.1.3
Trigger Actions
36-73
36.7.1.4
Programming Considerations
36-73
36.7.1.5
Trigger (TRIG) Packet
36-74
36.7.2
MSR Changes
36-75
36.7.2.1
IA32_RTIT_TRIGGERx_CFG
36-75
36.7.2.2
IA32_PERFEVTSELx MSR Changes
36-76
36.7.2.3
DR7 Changes
36-76
36.7.2.4
IA32_RTIT_STATUS Changes
36-76
36.8
PACKET GENERATION SCENARIOS
36-76
36.9
SOFTWARE CONSIDERATIONS
36-80
36.9.1
Tracing SMM Code
36-80
36.9.2
Cooperative Transition of Multiple Trace Collection Agents
36-81
xxxii Vol. 3A
CONTENTS
PAGE
36.9.3
Tracking Time
36-81
36.9.3.1
Time Domain Relationships
36-81
36.9.3.2
Estimating TSC within Intel PT
36-82
36.9.3.3
VMX TSC Manipulation
36-82
36.9.3.4
Calculating Frequency with Intel PT
36-82
CHAPTER 37
INTRODUCTION TO INTEL® SOFTWARE GUARD EXTENSIONS
37.1
OVERVIEW
37-1
37.2
ENCLAVE INTERACTION AND PROTECTION
37-1
37.3
ENCLAVE LIFE CYCLE
37-2
37.4
DATA STRUCTURES AND ENCLAVE OPERATION
37-2
37.5
ENCLAVE PAGE CACHE
37-2
37.5.1
Enclave Page Cache Map (EPCM)
37-3
37.6
ENCLAVE INSTRUCTIONS AND INTEL® SGX
37-3
37.7
DISCOVERING SUPPORT FOR INTEL® SGX AND ENABLING ENCLAVE INSTRUCTIONS
37-4
37.7.1
Intel® SGX Opt-In Configuration
37-4
37.7.2
Intel® SGX Resource Enumeration Leaves
37-5
37.8
INTEL® SGX INTERACTIONS WITH CONTROL-FLOW ENFORCEMENT TECHNOLOGY
37-5
37.8.1
CET in Enclaves Model
37-5
37.8.2
Operations Not Supported on Shadow Stack Pages
37-6
37.8.3
Indirect Branch Tracking - Legacy Compatibility Treatment
37-6
CHAPTER 38
ENCLAVE ACCESS CONTROL AND DATA STRUCTURES
38.1
OVERVIEW OF ENCLAVE EXECUTION ENVIRONMENT
38-1
38.2
TERMINOLOGY
38-1
38.3
ACCESS-CONTROL REQUIREMENTS
38-1
38.4
SEGMENT-BASED ACCESS CONTROL
38-2
38.5
PAGE-BASED ACCESS CONTROL
38-2
38.5.1
Access-control for Accesses that Originate from Non-SGX Instructions
38-2
38.5.2
Memory Accesses that Split Across ELRANGE
38-2
38.5.3
Implicit vs. Explicit Accesses
38-3
38.5.3.1
Explicit Accesses
38-3
38.5.3.2
Implicit Accesses
38-3
38.6
INTEL® SGX DATA STRUCTURES OVERVIEW
38-4
38.7
SGX ENCLAVE CONTROL STRUCTURE (SECS)
38-4
38.7.1
ATTRIBUTES
38-5
38.7.2
SECS.MISCSELECT Field
38-6
38.7.3
SECS.CET_ATTRIBUTES Field
38-6
38.8
THREAD CONTROL STRUCTURE (TCS)
38-7
38.8.1
TCS.FLAGS
38-7
38.8.2
State Save Area Offset (OSSA)
38-7
38.8.3
Current State Save Area Frame (CSSA)
38-8
38.8.4
Number of State Save Area Frames (NSSA)
38-8
38.9
STATE SAVE AREA (SSA) FRAME
38-8
38.9.1
GPRSGX Region
38-8
38.9.1.1
EXITINFO
38-9
38.9.1.2
VECTOR Field Definition
38-10
38.9.2
MISC Region
38-10
38.9.2.1
EXINFO Structure
38-11
38.9.2.2
Page Fault Error Code
38-11
38.10
CET STATE SAVE AREA FRAME
38-11
38.11
PAGE INFORMATION (PAGEINFO)
38-12
38.12
SECURITY INFORMATION (SECINFO)
38-12
38.12.1
SECINFO.FLAGS
38-12
38.12.2
PAGE_TYPE Field Definition
38-12
38.13
PAGING CRYPTO METADATA (PCMD)
38-13
38.14
ENCLAVE SIGNATURE STRUCTURE (SIGSTRUCT)
38-13
38.15
EINIT TOKEN STRUCTURE (EINITTOKEN)
38-15
38.16
REPORT (REPORT)
38-15
38.16.1
REPORTDATA
38-16
Vol. 3A xxxiii
CONTENTS
PAGE
38.17
REPORT TARGET INFO (TARGETINFO)
38-16
38.18
KEY REQUEST (KEYREQUEST)
38-17
38.18.1
KEY REQUEST KeyNames
38-17
38.18.2
Key Request Policy Structure
38-17
38.19
VERSION ARRAY (VA)
38-18
38.20
ENCLAVE PAGE CACHE MAP (EPCM)
38-18
CHAPTER 39
ENCLAVE OPERATION
39.1
CONSTRUCTING AN ENCLAVE
39-1
39.1.1
ECREATE
39-2
39.1.2
EADD and EEXTEND Interaction
39-2
39.1.3
EINIT Interaction
39-2
39.1.4
Intel® SGX Launch Control Configuration
39-3
39.2
ENCLAVE ENTRY AND EXITING
39-3
39.2.1
Controlled Entry and Exit
39-3
39.2.2
Asynchronous Enclave Exit (AEX)
39-4
39.2.3
Resuming Execution After AEX
39-4
39.2.3.1
ERESUME Interaction
39-5
39.2.3.2
Asynchronous Enclave Exit Notify and EDECCSSA
39-5
39.3
CALLING ENCLAVE PROCEDURES
39-6
39.3.1
Calling Convention
39-6
39.3.2
Register Preservation
39-6
39.3.3
Returning to Caller
39-6
39.4
INTEL® SGX KEY AND ATTESTATION
39-6
39.4.1
Enclave Measurement and Identification
39-6
39.4.1.1
MRENCLAVE
39-6
39.4.1.2
MRSIGNER
39-7
39.4.1.3
CONFIGID
39-7
39.4.2
Security Version Numbers (SVN)
39-7
39.4.2.1
Enclave Security Version
39-8
39.4.2.2
Hardware Security Version
39-8
39.4.2.3
CONFIGID Security Version
39-8
39.4.3
Keys
39-8
39.4.3.1
Sealing Enclave Data
39-9
39.4.3.2
Using REPORTs for Local Attestation
39-9
39.5
EPC AND MANAGEMENT OF EPC PAGES
39-10
39.5.1
EPC Implementation
39-10
39.5.2
OS Management of EPC Pages
39-10
39.5.2.1
Enhancement to Managing EPC Pages
39-10
39.5.3
Eviction of Enclave Pages
39-10
39.5.4
Loading an Enclave Page
39-11
39.5.5
Eviction of an SECS Page
39-11
39.5.6
Eviction of a Version Array Page
39-12
39.5.7
Allocating a Regular Page
39-12
39.5.8
Allocating a TCS Page
39-12
39.5.9
Trimming a Page
39-13
39.5.10
Restricting the EPCM Permissions of a Page
39-13
39.5.11
Extending the EPCM Permissions of a Page
39-14
39.6
CHANGES TO INSTRUCTION BEHAVIOR INSIDE AN ENCLAVE
39-14
39.6.1
Illegal Instructions
39-14
39.6.2
RDRAND and RDSEED Instructions
39-15
39.6.3
PAUSE Instruction
39-15
39.6.4
Executions of INT1 and INT3 Inside an Enclave
39-15
39.6.5
INVD Handling when Enclaves Are Enabled
39-15
CHAPTER 40
ENCLAVE EXITING EVENTS
40.1
COMPATIBLE SWITCH TO THE EXITING STACK OF AEX
40-1
40.2
STATE SAVING BY AEX
40-2
40.3
SYNTHETIC STATE ON ASYNCHRONOUS ENCLAVE EXIT
40-3
40.3.1
Processor Synthetic State on Asynchronous Enclave Exit
40-3
xxxiv Vol. 3A
CONTENTS
PAGE
40.3.2
Synthetic State for Extended Features
40-3
40.3.3
Synthetic State for MISC Features
40-4
40.4
AEX FLOW
40-4
40.4.1
AEX Operational Detail
40-5
CHAPTER 41
INTEL® SGX INSTRUCTION REFERENCES
41.1
INTEL® SGX INSTRUCTION SYNTAX AND OPERATION
41-1
41.1.1
ENCLS Register Usage Summary
41-1
41.1.2
ENCLU Register Usage Summary
41-1
41.1.3
Information and Error Codes
41-2
41.1.4
Internal CREGs
41-3
41.1.5
Concurrent Operation Restrictions
41-4
41.1.5.1
Concurrency Tables of Intel® SGX Instructions
41-4
41.2
INTEL® SGX INSTRUCTION REFERENCE
41-7
ENCLS-Execute an Enclave System Function of Specified Leaf Number
41-8
ENCLU-Execute an Enclave User Function of Specified Leaf Number
41-10
41.3
INTEL® SGX SYSTEM LEAF FUNCTION REFERENCE
41-12
EADD-Add a Page to an Uninitialized Enclave
41-13
EAUG-Add a Page to an Initialized Enclave
41-18
EBLOCK-Mark a page in EPC as Blocked
41-22
ECREATE-Create an SECS page in the Enclave Page Cache
41-25
EDBGRD-Read From a Debug Enclave
41-30
EDBGWR-Write to a Debug Enclave
41-34
EEXTEND-Extend Uninitialized Enclave Measurement by 256 Bytes
41-38
EINIT-Initialize an Enclave for Execution
41-41
ELDB/ELDU-Load an EPC Page and Mark its State
41-49
EMODPR-Restrict the Permissions of an EPC Page
41-54
EMODT-Change the Type of an EPC Page
41-57
EPA-Add Version Array
41-60
EREMOVE-Remove a page from the EPC
41-62
ETRACK-Activates EBLOCK Checks
41-65
EUPDATESVN-Update CR_CPUSVN
41-67
EWB-Invalidate an EPC Page and Write out to Main Memory
41-69
41.4
INTEL® SGX USER LEAF FUNCTION REFERENCE
41-73
EACCEPT-Accept Changes to an EPC Page
41-74
EACCEPTCOPY-Initialize a Pending Page
41-79
EDECCSSA-Decrements TCS.CSSA
41-83
EENTER-Enters an Enclave
41-87
EEXIT-Exits an Enclave
41-96
EGETKEY-Retrieves a Cryptographic Key
41-99
EMODPE-Extend an EPC Page Permissions
41-109
EREPORT-Create a Cryptographic Report of the Enclave
41-112
ERESUME-Re-Enters an Enclave
41-117
EVERIFYREPORT2-Verify a Cryptographic Report Created by SEAMREPORT
41-129
CHAPTER 42
INTEL® SGX INTERACTIONS WITH IA32 AND INTEL® 64 ARCHITECTURE
42.1
INTEL® SGX AVAILABILITY IN VARIOUS PROCESSOR MODES
42-1
42.2
IA32_FEATURE_CONTROL
42-1
42.2.1
Availability of Intel SGX
42-1
42.2.2
Intel SGX Launch Control Configuration
42-1
42.3
INTERACTIONS WITH SEGMENTATION
42-1
42.3.1
Scope of Interaction
42-1
42.3.2
Interactions of Intel® SGX Instructions with Segment, Operand, and Addressing Prefixes
42-2
42.3.3
Interaction of Intel® SGX Instructions with Segmentation
42-2
42.3.4
Interactions of Enclave Execution with Segmentation
42-2
42.4
INTERACTIONS WITH PAGING
42-2
42.5
INTERACTIONS WITH VMX
42-3
42.5.1
VMM Controls to Configure Guest Support of Intel® SGX
42-3
Vol. 3A xxxv
CONTENTS
PAGE
42.5.2
Interactions with the Extended Page Table Mechanism (EPT)
42-3
42.5.3
Interactions with APIC Virtualization
42-4
42.6
INTEL® SGX INTERACTIONS WITH ARCHITECTURALLY-VISIBLE EVENTS
42-4
42.7
INTERACTIONS WITH THE PROCESSOR EXTENDED STATE AND MISCELLANEOUS STATE
42-4
42.7.1
Requirements and Architecture Overview
42-4
42.7.2
Relevant Fields in Various Data Structures
42-5
42.7.2.1
SECS.ATTRIBUTES.XFRM
42-5
42.7.2.2
SECS.SSAFRAMESIZE
42-6
42.7.2.3
XSAVE Area in SSA
42-6
42.7.2.4
MISC Area in SSA
42-6
42.7.2.5
SIGSTRUCT Fields
42-6
42.7.2.6
REPORT.ATTRIBUTES.XFRM and REPORT.MISCSELECT
42-7
42.7.2.7
KEYREQUEST
42-7
42.7.3
Processor Extended States and ENCLS[ECREATE]
42-7
42.7.4
Processor Extended States and ENCLU[EENTER]
42-7
42.7.4.1
Fault Checking
42-7
42.7.4.2
State Loading
42-7
42.7.5
Processor Extended States and AEX
42-8
42.7.5.1
State Saving
42-8
42.7.5.2
State Synthesis
42-8
42.7.6
Processor Extended States and ENCLU[ERESUME]
42-8
42.7.6.1
Fault Checking
42-8
42.7.6.2
State Loading
42-8
42.7.7
Processor Extended States and ENCLU[EEXIT]
42-8
42.7.8
Processor Extended States and ENCLU[EREPORT]
42-9
42.7.9
Processor Extended States and ENCLU[EGETKEY]
42-9
42.8
INTERACTIONS WITH SMM
42-9
42.8.1
Availability of Intel® SGX instructions in SMM
42-9
42.8.2
SMI while Inside an Enclave
42-9
42.8.3
SMRAM Synthetic State of AEX Triggered by SMI
42-9
42.9
INTERACTIONS OF INIT, SIPI, AND WAIT-FOR-SIPI WITH INTEL® SGX
42-10
42.10
INTERACTIONS WITH DMA
42-10
42.11
INTERACTIONS WITH TXT
42-10
42.11.1
Enclaves Created Prior to Execution of GETSEC
42-10
42.11.2
Interaction of GETSEC with Intel® SGX
42-10
42.11.3
Interactions with Authenticated Code Modules (ACMs)
42-11
42.12
INTERACTIONS WITH CACHING OF LINEAR-ADDRESS TRANSLATIONS
42-11
42.13
INTERACTIONS WITH INTEL® TRANSACTIONAL SYNCHRONIZATION EXTENSIONS (INTEL® TSX)
42-11
42.13.1
HLE and RTM Debug
42-12
42.14
INTEL® SGX INTERACTIONS WITH S STATES
42-12
42.15
INTEL® SGX INTERACTIONS WITH MACHINE CHECK ARCHITECTURE (MCA)
42-12
42.15.1
Interactions with MCA Events
42-12
42.15.2
Machine Check Enables (IA32_MCi_CTL)
42-12
42.15.3
CR4.MCE
42-12
42.16
INTEL® SGX INTERACTIONS WITH PROTECTED MODE VIRTUAL INTERRUPTS
42-13
42.17
INTEL SGX INTERACTION WITH PROTECTION KEYS
42-13
CHAPTER 43
ENCLAVE CODE DEBUG AND PROFILING
43.1
CONFIGURATION AND CONTROLS
43-1
43.1.1
Debug Enclave vs. Production Enclave
43-1
43.1.2
Tool-Chain Opt-in
43-1
43.1.3
Debugging an Enclave That Uses Asynchronous Enclave Exit Notify
43-1
43.2
SINGLE STEP DEBUG
43-1
43.2.1
Single Stepping ENCLS Instruction Leafs
43-1
43.2.2
Single Stepping ENCLU Instruction Leafs
43-2
43.2.3
Single-Stepping Enclave Entry with Opt-out Entry
43-2
43.2.3.1
Single Stepping without AEX
43-2
43.2.3.2
Single Step Preempted by AEX Due to Non-SMI Event
43-2
43.2.4
RFLAGS.TF Treatment on AEX
43-3
43.2.5
Restriction on Setting of TF after an Opt-Out Entry
43-3
43.2.6
Trampoline Code Considerations
43-3
43.3
CODE AND DATA BREAKPOINTS
43-3
43.3.1
Breakpoint Suppression
43-3
xxxvi Vol. 3A
CONTENTS
PAGE
43.3.2
Reporting of Instruction Breakpoint on Next Instruction on a Debug Trap
43-4
43.3.3
RF Treatment on AEX
43-4
43.3.4
Breakpoint Matching in Intel® SGX Instruction Flows
43-4
43.4
CONSIDERATION OF THE INT1 AND INT3 INSTRUCTIONS
43-4
43.4.1
Behavior of INT1 and INT3 Inside an Enclave
43-4
43.4.2
Debugger Considerations
43-4
43.4.3
VMM Considerations
43-5
43.5
BRANCH TRACING
43-5
43.5.1
BTF Treatment
43-5
43.5.2
LBR Treatment
43-5
43.5.2.1
LBR Stack on Opt-in Entry
43-5
43.5.2.2
LBR Stack on Opt-out Entry
43-6
43.5.2.3
Mispredict Bit, Record Type, and Filtering
43-7
43.6
INTERACTION WITH PERFORMANCE MONITORING
43-7
43.6.1
IA32_PERF_GLOBAL_STATUS Enhancement
43-7
43.6.2
Performance Monitoring with Opt-in Entry
43-7
43.6.3
Performance Monitoring with Opt-out Entry
43-8
43.6.4
Enclave Exit and Performance Monitoring
43-8
43.6.5
PEBS Record Generation on Intel® SGX Instructions
43-8
43.6.6
Exception-Handling on PEBS/BTS Loads/Stores after AEX
43-8
43.6.6.1
Other Interactions with Performance Monitoring
43-9
APPENDIX A
VMX CAPABILITY REPORTING FACILITY
A.1
BASIC VMX INFORMATION
A-1
A.2
RESERVED CONTROLS AND DEFAULT SETTINGS
A-2
A.3
VM-EXECUTION CONTROLS
A-2
A.3.1
Pin-Based VM-Execution Controls
A-3
A.3.2
Primary Processor-Based VM-Execution Controls
A-3
A.3.3
Secondary Processor-Based VM-Execution Controls
A-4
A.3.4
Tertiary Processor-Based VM-Execution Controls
A-4
A.4
VM-EXIT CONTROLS
A-4
A.4.1
Primary VM-Exit Controls
A-5
A.4.2
Secondary VM-Exit Controls
A-5
A.5
VM-ENTRY CONTROLS
A-5
A.6
MISCELLANEOUS DATA
A-6
A.7
VMX-FIXED BITS IN CR0
A-7
A.8
VMX-FIXED BITS IN CR4
A-7
A.9
VMCS ENUMERATION
A-7
A.10
VPID AND EPT CAPABILITIES
A-8
A.11
VM FUNCTIONS
A-9
APPENDIX B
FIELD ENCODING IN VMCS
B.1
16-BIT FIELDS
B-1
B.1.1
16-Bit Control Fields
B-1
B.1.2
16-Bit Guest-State Fields
B-1
B.1.3
16-Bit Host-State Fields
B-2
B.2
64-BIT FIELDS
B-2
B.2.1
64-Bit Control Fields
B-2
B.2.2
64-Bit Read-Only Data Fields
B-5
B.2.3
64-Bit Guest-State Fields
B-6
B.2.4
64-Bit Host-State Fields
B-7
B.3
32-BIT FIELDS
B-8
B.3.1
32-Bit Control Fields
B-8
B.3.2
32-Bit Read-Only Data Fields
B-9
B.3.3
32-Bit Guest-State Fields
B-10
B.3.4
32-Bit Host-State Field
B-11
B.4
NATURAL-WIDTH FIELDS
B-11
B.4.1
Natural-Width Control Fields
B-11
B.4.2
Natural-Width Read-Only Data Fields
B-11
B.4.3
Natural-Width Guest-State Fields
B-12
Vol. 3A xxxvii
CONTENTS
PAGE
B.4.4
Natural-Width Host-State Fields
B-13
APPENDIX C
VMX BASIC EXIT REASONS
xxxviii Vol. 3A
CONTENTS
PAGE
FIGURES
Figure 2-1.
IA-32 System-Level Registers and Data Structures
2-2
Figure 2-2.
System-Level Registers and Data Structures in IA-32e Mode and 4-Level Paging
2-3
Figure 2-3.
Transitions Among the Processor’s Operating Modes
2-8
Figure 2-4.
IA32_EFER MSR Layout
2-9
Figure 2-5.
System Flags in the EFLAGS Register
2-10
Figure 2-6.
Memory Management Registers
2-12
Figure 2-7.
Control Registers
2-15
Figure 2-8.
XCR0
2-22
Figure 2-9.
Format of Protection-Key Rights Registers
2-23
Figure 2-10.
WBINVD Invalidation of Shared and Non-Shared Cache Hierarchy
2-27
Figure 3-1.
Segmentation and Paging
3-2
Figure 3-2.
Flat Model
3-3
Figure 3-3.
Protected Flat Model
3-4
Figure 3-4.
Multi-Segment Model
3-5
Figure 3-5.
Logical Address to Linear Address Translation
3-7
Figure 3-6.
Segment Selector
3-7
Figure 3-7.
Segment Registers
3-8
Figure 3-8.
Segment Descriptor
3-10
Figure 3-9.
Segment Descriptor When Segment-Present Flag Is Clear
3-11
Figure 3-10.
Global and Local Descriptor Tables
3-15
Figure 3-11.
Pseudo-Descriptor Formats
3-16
Figure 5-1.
Enabling and Changing Paging Modes
5-4
Figure 5-2.
Linear-Address Translation to a 4-KByte Page using 32-Bit Paging
5-10
Figure 5-4.
Formats of CR3 and Paging-Structure Entries with 32-Bit Paging
5-11
Figure 5-3.
Linear-Address Translation to a 4-MByte Page using 32-Bit Paging
5-11
Figure 5-5.
Linear-Address Translation to a 4-KByte Page using PAE Paging
5-16
Figure 5-6.
Linear-Address Translation to a 2-MByte Page using PAE Paging
5-17
Figure 5-7.
Formats of CR3 and Paging-Structure Entries with PAE Paging
5-19
Figure 5-8.
Linear-Address Translation to a 4-KByte Page Using 4-Level Paging
5-22
Figure 5-9.
Linear-Address Translation to a 2-MByte Page using 4-Level Paging
5-23
Figure 5-10.
Linear-Address Translation to a 1-GByte Page using 4-Level Paging
5-23
Figure 5-11.
Formats of CR3 and Paging-Structure Entries with 4-Level Paging and 5-Level Paging
5-32
Figure 5-12.
Page-Fault Error Code
5-37
Figure 5-13.
Memory Management Convention That Assigns a Page Table to Each Segment
5-55
Figure 6-1.
Descriptor Fields Used for Protection
6-3
Figure 6-2.
Descriptor Fields with Flags used in IA-32e Mode
6-4
Figure 6-3.
Protection Rings
6-7
Figure 6-4.
Privilege Check for Data Access
6-8
Figure 6-5.
Examples of Accessing Data Segments From Various Privilege Levels
6-9
Figure 6-6.
Privilege Check for Control Transfer Without Using a Gate
6-11
Figure 6-7.
Examples of Accessing Conforming and Nonconforming Code Segments From Various Privilege Levels
6-12
Figure 6-8.
Call-Gate Descriptor
6-13
Figure 6-9.
Call-Gate Descriptor in IA-32e Mode
6-14
Figure 6-10.
Call-Gate Mechanism
6-15
Figure 6-11.
Privilege Check for Control Transfer with Call Gate
6-16
Figure 6-12.
Example of Accessing Call Gates At Various Privilege Levels
6-17
Figure 6-13.
Stack Switching During an Interprivilege-Level Call
6-19
Figure 6-14.
MSRs Used by SYSCALL and SYSRET
6-23
Figure 6-15.
Use of RPL to Weaken Privilege Level of Called Procedure
6-27
Figure 7-1.
Relationship of the IDTR and IDT
7-11
Figure 7-2.
IDT Gate Descriptors
7-12
Figure 7-3.
Interrupt Procedure Call
7-13
Figure 7-4.
Stack Usage on Transfers to Interrupt and Exception-Handling Routines
7-14
Figure 7-5.
Shadow Stack Usage on Transfers to Interrupt and Exception-Handling Routines
7-16
Figure 7-6.
Interrupt Task Switch
7-19
Figure 7-7.
Error Code
7-20
Figure 7-8.
64-Bit IDT Gate Descriptors
7-21
Figure 7-9.
IA-32e Mode Stack Usage After Privilege Level Change
7-23
Figure 7-10.
Interrupt Shadow Stack Table
7-24
Figure 7-11.
Page-Fault Error Code
7-49
Figure 7-12.
Exception Error Code Information
7-59
Figure 8-1.
Flexible Return and Event Delivery Stack
8-7
Vol. 3A xxxix
CONTENTS
PAGE
Figure 10-1.
Structure of a Task
10-2
Figure 10-2.
32-Bit Task-State Segment (TSS)
10-4
Figure 10-3.
TSS Descriptor
10-6
Figure 10-4.
Format of TSS and LDT Descriptors in 64-bit Mode
10-7
Figure 10-5.
Task Register
10-8
Figure 10-6.
Task-Gate Descriptor
10-8
Figure 10-7.
Task Gates Referencing the Same Task
10-9
Figure 10-8.
Nested Tasks
10-15
Figure 10-9.
Overlapping Linear-to-Physical Mappings
10-17
Figure 10-10.
16-Bit TSS Format
10-19
Figure 10-11.
64-Bit TSS Format
10-20
Figure 11-1.
Example of Write Ordering in Multiple-Processor Systems
11-8
Figure 11-2.
Interpretation of APIC ID in Early MP Systems
11-26
Figure 11-3.
Local APICs and I/O APIC in MP System Supporting Intel HT Technology
11-28
Figure 11-4.
IA-32 Processor with Two Logical Processors Supporting Intel HT Technology
11-29
Figure 11-5.
Generalized Seven-Domain Interpretation of the APIC ID
11-36
Figure 11-6.
Conceptual Six-Domain Topology and 32-bit APIC ID Composition
11-37
Figure 11-7.
Topological Relationships Between Hierarchical IDs in a Hypothetical MP Platform
11-40
Figure 11-8.
MP System With Multiple Pentium III Processors
11-57
Figure 12-1.
Contents of CR0 Register after Reset
12-2
Figure 12-2.
Version Information in the EDX Register after Reset
12-5
Figure 12-3.
Processor State After Reset
12-15
Figure 12-4.
Constructing Temporary GDT and Switching to Protected Mode (Lines 162-172 of List File)
12-23
Figure 12-5.
Moving the GDT, IDT, and TSS from ROM to RAM (Lines 196-261 of List File)
12-24
Figure 12-6.
Task Switching (Lines 282-296 of List File)
12-25
Figure 12-7.
Applying Microcode Updates
12-28
Figure 12-8.
Microcode Update Write Operation Flow [1]
12-46
Figure 12-9.
Microcode Update Write Operation Flow [2]
12-47
Figure 13-1.
Relationship of Local APIC and I/O APIC In Single-Processor Systems
13-2
Figure 13-2.
Local APICs and I/O APIC When Intel Xeon Processors Are Used in Multiple-Processor Systems
13-3
Figure 13-3.
Local APICs and I/O APIC When P6 Family Processors Are Used in Multiple-Processor Systems
13-3
Figure 13-4.
Local APIC Structure
13-5
Figure 13-5.
IA32_APIC_BASE MSR (APIC_BASE_MSR in P6 Family)
13-9
Figure 13-6.
Local APIC ID Register
13-9
Figure 13-7.
Local APIC Version Register
13-11
Figure 13-8.
Local Vector Table (LVT)
13-13
Figure 13-9.
Error Status Register (ESR)
13-15
Figure 13-10.
Divide Configuration Register
13-17
Figure 13-11.
Initial Count and Current Count Registers
13-17
Figure 13-12.
Interrupt Command Register (ICR)
13-20
Figure 13-13.
Logical Destination Register (LDR)
13-24
Figure 13-14.
Destination Format Register (DFR)
13-25
Figure 13-15.
Arbitration Priority Register (APR)
13-26
Figure 13-16.
Interrupt Acceptance Flow Chart for the Local APIC (Pentium 4 and Intel Xeon Processors)
13-28
Figure 13-17.
Interrupt Acceptance Flow Chart for the Local APIC (P6 Family and Pentium Processors)
13-29
Figure 13-18.
Task-Priority Register (TPR)
13-30
Figure 13-19.
Processor-Priority Register (PPR)
13-30
Figure 13-20.
IRR, ISR, and TMR Registers
13-31
Figure 13-21.
EOI Register
13-32
Figure 13-22.
CR8 Register
13-33
Figure 13-23.
Spurious-Interrupt Vector Register (SVR)
13-34
Figure 13-24.
Layout of the MSI Message Address Register
13-35
Figure 13-25.
Layout of the MSI Message Data Register
13-37
Figure 13-26.
IA32_APIC_BASE MSR Supporting x2APIC
13-38
Figure 13-27.
Local x2APIC State Transitions with IA32_APIC_BASE, INIT, and Reset
13-43
Figure 13-28.
Interrupt Command Register (ICR) in x2APIC Mode
13-46
Figure 13-29.
Logical Destination Register in x2APIC Mode
13-47
Figure 13-30.
SELF IPI register
13-48
Figure 14-1.
Cache Structure of the Pentium 4 and Intel Xeon Processors
14-1
Figure 14-2.
Cache Structure of the Intel Core i7 Processors
14-2
Figure 14-3.
Cache-Control Registers and Bits Available in Intel 64 and IA-32 Processors
14-11
Figure 14-4.
Mapping Physical Memory With MTRRs
14-21
Figure 14-5.
IA32_MTRRCAP Register
14-22
Figure 14-6.
IA32_MTRR_DEF_TYPE MSR
14-23
Figure 14-7.
IA32_MTRR_PHYSBASEn and IA32_MTRR_PHYSMASKn Variable-Range Register Pair
14-25
xl Vol. 3A
CONTENTS
PAGE
Figure 14-8.
IA32_SMRR_PHYSBASE and IA32_SMRR_PHYSMASK SMRR Pair
14-26
Figure 14-9.
IA32_PAT MSR
14-34
Figure 15-1.
Mapping of MMX Registers to Floating-Point Registers
15-2
Figure 15-2.
Mapping of MMX Registers to x87 FPU Data Register Stack
15-5
Figure 17-1.
IA32_MPERF MSR and IA32_APERF MSR for P-state Coordination
17-2
Figure 17-2.
IA32_PERF_CTL Register
17-4
Figure 17-3.
IA32_ENERGY_PERF_BIAS Register
17-5
Figure 17-4.
IA32_PM_ENABLE MSR
17-7
Figure 17-5.
IA32_HWP_CAPABILITIES Register
17-8
Figure 17-6.
IA32_HWP_REQUEST Register
17-9
Figure 17-7.
IA32_HWP_REQUEST_PKG Register
17-11
Figure 17-8.
IA32_HWP_PECI_REQUEST_INFO MSR
17-11
Figure 17-9.
IA32_HWP_STATUS MSR
17-14
Figure 17-10.
IA32_THERM_STATUS Register With HWP Feedback
17-15
Figure 17-11.
MSR_PPERF MSR
17-15
Figure 17-12.
IA32_HWP_INTERRUPT MSR
17-16
Figure 17-13.
FAST_UNCORE_MSRS_CAPABILITY MSR
17-17
Figure 17-14.
FAST_UNCORE_MSRS_CTL MSR
17-18
Figure 17-15.
FAST_UNCORE_MSRS_STATUS MSR
17-18
Figure 17-16.
IA32_PKG_HDC_CTL MSR
17-21
Figure 17-17.
IA32_PM_CTL1 MSR
17-22
Figure 17-18.
IA32_THREAD_STALL MSR
17-22
Figure 17-19.
MSR_CORE_HDC_RESIDENCY MSR
17-23
Figure 17-20.
MSR_PKG_HDC_SHALLOW_RESIDENCY MSR
17-23
Figure 17-21.
MSR_PKG_HDC_DEEP_RESIDENCY MSR
17-24
Figure 17-22.
MSR_PKG_HDC_CONFIG MSR
17-24
Figure 17-23.
Example of Effective Frequency Reduction and Forced Idle Period of HDC
17-25
Figure 17-24.
Processor Modulation Through Stop-Clock Mechanism
17-36
Figure 17-25.
MSR_THERM2_CTL Register On Processors with CPUID Family/Model/Stepping Signature Encoded as 0x69n or 0x6Dn
17-38
Figure 17-26.
MSR_THERM2_CTL Register for Supporting TM2
17-38
Figure 17-27.
IA32_THERM_STATUS MSR
17-39
Figure 17-28.
IA32_THERM_INTERRUPT MSR
17-39
Figure 17-29.
IA32_CLOCK_MODULATION MSR
17-40
Figure 17-30.
IA32_CLOCK_MODULATION MSR with Clock Modulation Extension
17-41
Figure 17-31.
IA32_THERM_STATUS Register
17-42
Figure 17-32.
IA32_THERM_INTERRUPT Register
17-44
Figure 17-33.
IA32_PACKAGE_THERM_STATUS Register
17-45
Figure 17-34.
IA32_PACKAGE_THERM_INTERRUPT Register
17-47
Figure 17-35.
MSR_RAPL_POWER_UNIT Register
17-49
Figure 17-36.
MSR_PKG_POWER_LIMIT Register
17-50
Figure 17-37.
MSR_PKG_ENERGY_STATUS MSR
17-51
Figure 17-38.
MSR_PKG_POWER_INFO Register
17-51
Figure 17-39.
MSR_PKG_PERF_STATUS MSR
17-52
Figure 17-40.
MSR_PP0_POWER_LIMIT/MSR_PP1_POWER_LIMIT Register
17-52
Figure 17-41.
MSR_PP0_ENERGY_STATUS/MSR_PP1_ENERGY_STATUS MSR
17-53
Figure 17-42.
MSR_PP0_POLICY/MSR_PP1_POLICY Register
17-53
Figure 17-43.
MSR_PP0_PERF_STATUS MSR
17-54
Figure 17-44.
MSR_DRAM_POWER_LIMIT Register
17-54
Figure 17-45.
MSR_DRAM_ENERGY_STATUS MSR
17-55
Figure 17-46.
MSR_DRAM_POWER_INFO Register
17-55
Figure 17-47.
MSR_DRAM_PERF_STATUS MSR
17-55
Figure 18-1.
Machine-Check MSRs
18-2
Figure 18-2.
IA32_MCG_CAP Register
18-3
Figure 18-3.
IA32_MCG_STATUS Register
18-4
Figure 18-4.
IA32_MCG_EXT_CTL Register
18-5
Figure 18-5.
IA32_MCi_CTL Register
18-6
Figure 18-6.
IA32_MCi_STATUS Register
18-7
Figure 18-7.
IA32_MCi_ADDR MSR
18-9
Figure 18-8.
UCR Support in IA32_MCi_MISC Register
18-10
Figure 18-9.
IA32_MCi_CTL2 Register
18-11
Figure 18-10.
CMCI Behavior
18-14
Figure 20-1.
Debug Registers
20-3
Figure 20-2.
DR6/DR7 Layout on Processors Supporting Intel® 64 Architecture
20-8
Figure 20-3.
IA32_DEBUGCTL MSR for Processors Based on Intel® Core™ Microarchitecture
20-13
Vol. 3A xli
CONTENTS
PAGE
Figure 20-4.
64-bit Address Layout of LBR MSR
20-18
Figure 20-5.
DS Save Area Example
20-21
Figure 20-6.
32-bit Branch Trace Record Format
20-22
Figure 20-7.
PEBS Record Format
20-22
Figure 20-8.
IA-32e Mode DS Save Area Example
20-23
Figure 20-9.
64-bit Branch Trace Record Format
20-23
Figure 20-10.
64-bit PEBS Record Format
20-24
Figure 20-11.
IA32_DEBUGCTL MSR for Processors Based on Nehalem Microarchitecture
20-30
Figure 20-12.
MSR_DEBUGCTLA MSR for Pentium 4 and Intel Xeon Processors
20-36
Figure 20-13.
LBR MSR Branch Record Layout for the Pentium 4 and Intel® Xeon® Processor Family
20-37
Figure 20-14.
IA32_DEBUGCTL MSR for Intel® Core™ Solo and Intel® Core™ Duo Processors
20-38
Figure 20-15.
LBR Branch Record Layout for the Intel® Core™ Solo and Intel® Core™ Duo Processor
20-39
Figure 20-16.
MSR_DEBUGCTLB MSR for Pentium M Processors
20-40
Figure 20-17.
LBR Branch Record Layout for the Pentium M Processor
20-40
Figure 20-18.
DEBUGCTLMSR Register (P6 Family Processors)
20-41
Figure 20-19.
Platform Shared Resource Monitoring Usage Flow
20-46
Figure 20-20.
CPUID.0FH.00H Monitoring Resource Type Enumeration
20-47
Figure 20-21.
L3 Cache Monitoring Capability Enumeration Data (CPUID.0FH.01H)
20-47
Figure 20-22.
L3 Cache Monitoring Capability Enumeration Event Type Bit Vector (CPUID.0FH.01H )
20-48
Figure 20-23.
IA32_PQR_ASSOC MSR
20-50
Figure 20-24.
IA32_QM_EVTSEL and IA32_QM_CTR MSRs
20-51
Figure 20-25.
Software Usage of Cache Monitoring Resources
20-51
Figure 20-26.
Cache Allocation Technology Enables Allocation of More Resources to High Priority Applications
20-53
Figure 20-27.
Examples of Cache Capacity Bitmasks
20-54
Figure 20-28.
Class of Service and Cache Capacity Bitmasks
20-55
Figure 20-29.
Code and Data Capacity Bitmasks of CDP
20-57
Figure 20-30.
Cache Allocation Technology Usage Flow
20-57
Figure 20-31.
CPUID.10H.00H Available Resource Type Identification
20-58
Figure 20-32.
L3 Cache Allocation Technology and CDP Enumeration
20-59
Figure 20-33.
L2 Cache Allocation Technology
20-60
Figure 20-34.
IA32_PQR_ASSOC, IA32_L3_MASK_n MSRs
20-61
Figure 20-35.
IA32_L2_MASK_n MSRs
20-61
Figure 20-36.
Layout of IA32_L3_QOS_CFG
20-63
Figure 20-37.
Layout of IA32_L2_QOS_CFG
20-64
Figure 20-38.
CPUID.10H.03H MBA Feature Details Identification
20-67
Figure 20-39.
IA32_L2_QoS_Ext_BW_Thrtl_n MSR Definition
20-68
Figure 20-40.
CPUID.10H.05H, CBA Feature Details Identification
20-70
Figure 20-41.
IA32_QoS_Core_BW_Thrtl_n MSR Definition
20-71
Figure 20-42.
Layout of the IA32_L3_IO_RDT_CFG MSR for Enabling Non-CPU Agent Intel® RDT
20-74
Figure 20-43.
CPUID.10H.06H, RP Feature Details Identification
20-77
Figure 20-44.
IA32_RESOURCE_PRIORITY and IA32_RESOURCE_PRIORITY_PKG Layouts
20-78
Figure 22-1.
Layout of IA32_PERFEVTSELx MSRs
22-4
Figure 22-2.
Layout of IA32_FIXED_CTR_CTRL MSR
22-6
Figure 22-3.
Layout of IA32_PERF_GLOBAL_CTRL MSR
22-7
Figure 22-4.
Layout of IA32_PERF_GLOBAL_STATUS MSR
22-8
Figure 22-5.
Layout of IA32_PERF_GLOBAL_OVF_CTRL MSR
22-9
Figure 22-6.
Layout of IA32_PERFEVTSELx MSRs Supporting Architectural Performance Monitoring Version 3
22-9
Figure 22-7.
IA32_FIXED_CTR_CTRL MSR Supporting Architectural Performance Monitoring Version 3
22-10
Figure 22-8.
Layout of Global Performance Monitoring Control MSR
22-10
Figure 22-9.
Global Performance Monitoring Overflow Status and Control MSRs
22-11
Figure 22-10.
IA32_PERF_GLOBAL_STATUS MSR and Architectural PerfMon Version 4
22-13
Figure 22-11.
IA32_PERF_GLOBAL_STATUS_RESET MSR and Architectural PerfMon Version 4
22-13
Figure 22-12.
IA32_PERF_GLOBAL_STATUS_SET MSR and Architectural PerfMon Version 4
22-14
Figure 22-13.
IA32_PERF_GLOBAL_INUSE MSR and Architectural PerfMon Version 4
22-14
Figure 22-14.
IA32_PMC_GPx_CFG_A MSR (also known as IA32_PERFEVTSELx)
Supporting Architectural Performance Monitoring Version 6
22-17
Figure 22-15.
IA32_FIXED_CTR_CTRL MSR Supporting Architectural Performance Monitoring Version 6
22-17
Figure 22-16.
IA32_PERF_GLOBAL_STATUS MSR
22-23
Figure 22-17.
Layout of IA32_PEBS_ENABLE MSR
22-25
Figure 22-18.
PEBS Programming Environment
22-27
Figure 22-19.
Layout of MSR_PEBS_LD_LAT MSR
22-29
Figure 22-20.
Layout of MSR_OFFCORE_RSP_0 and MSR_OFFCORE_RSP_1 to Configure Off-core Response Events
22-30
Figure 22-21.
Layout of MSR_UNCORE_PERF_GLOBAL_CTRL MSR
22-32
Figure 22-22.
Layout of MSR_UNCORE_PERF_GLOBAL_STATUS MSR
22-33
Figure 22-23.
Layout of MSR_UNCORE_PERF_GLOBAL_OVF_CTRL MSR
22-33
xlii Vol. 3A
CONTENTS
PAGE
Figure 22-24.
Layout of MSR_UNCORE_PERFEVTSELx MSRs
22-34
Figure 22-25.
Layout of MSR_UNCORE_FIXED_CTR_CTRL MSR
22-34
Figure 22-26.
Layout of MSR_UNCORE_ADDR_OPCODE_MATCH MSR
22-35
Figure 22-27.
Distributed Units of the Uncore of Intel® Xeon® Processor 7500 Series
22-36
Figure 22-28.
IA32_PERF_GLOBAL_CTRL MSR in Sandy Bridge Microarchitecture
22-39
Figure 22-29.
IA32_PERF_GLOBAL_STATUS MSR in Sandy Bridge Microarchitecture
22-40
Figure 22-30.
IA32_PERF_GLOBAL_OVF_CTRL MSR in Sandy Bridge Microarchitecture
22-41
Figure 22-31.
Layout of IA32_PEBS_ENABLE MSR
22-43
Figure 22-32.
Request_Type Fields for MSR_OFFCORE_RSP_x
22-47
Figure 22-33.
Response_Supplier and Snoop Info Fields for MSR_OFFCORE_RSP_x
22-48
Figure 22-34.
Layout of Uncore PERFEVTSEL MSR for a C-Box Unit or the ARB Unit
22-49
Figure 22-35.
Layout of MSR_UNC_PERF_GLOBAL_CTRL MSR for Uncore
22-50
Figure 22-36.
Layout of IA32_PERFEVTSELx MSRs Supporting Intel TSX
22-59
Figure 22-37.
IA32_PERF_GLOBAL_STATUS MSR in Broadwell Microarchitecture
22-61
Figure 22-38.
IA32_PERF_GLOBAL_OVF_CTRL MSR in Broadwell microarchitecture
22-61
Figure 22-39.
MSR_PERF_METRICS Definition
22-75
Figure 22-40.
PERF_METRICS MSR Definition for 12th Generation Intel® Core™ Processor P-core
22-77
Figure 22-41.
Deducing Implied Level 2 Metrics in the Core PMU for12th Generation Intel® Core™ Processor P-core
22-77
Figure 22-42.
Request_Type Fields for MSR_OFFCORE_RSPx
22-91
Figure 22-43.
Response_Supplier and Snoop Info Fields for MSR_OFFCORE_RSPx
22-92
Figure 22-44.
IA32_PEBS_ENABLE MSR with PEBS Output to Intel® Processor Trace
22-101
Figure 22-45.
Layout of IA32_FIXED_CTR_CTRL MSR
22-107
Figure 22-46.
Layout of MSR_PERF_GLOBAL_CTRL MSR
22-108
Figure 22-47.
Layout of MSR_PERF_GLOBAL_STATUS MSR
22-108
Figure 22-48.
Layout of MSR_PERF_GLOBAL_OVF_CTRL MSR
22-109
Figure 22-49.
Event Selection Control Register (ESCR) for Pentium 4
and Intel® Xeon® Processors without Intel HT Technology Support
22-116
Figure 22-50.
Performance Counter (Pentium 4 and Intel® Xeon® Processors)
22-117
Figure 22-51.
Counter Configuration Control Register (CCCR)
22-118
Figure 22-52.
Effects of Edge Filtering
22-122
Figure 22-53.
Event Selection Control Register (ESCR) for the Pentium 4 Processor, Intel® Xeon® Processor, and Intel® Xeon® Processor
MP Supporting Hyper-Threading Technology
22-129
Figure 22-54.
Counter Configuration Control Register (CCCR)
22-130
Figure 22-55.
Block Diagram of 64-bit Intel® Xeon® Processor MP with 8-MByte L3
22-134
Figure 22-56.
MSR_IFSB_IBUSQx, Addresses: 107CCH and 107CDH
22-134
Figure 22-57.
MSR_IFSB_ISNPQx, Addresses: 107CEH and 107CFH
22-135
Figure 22-58.
MSR_EFSB_DRDYx, Addresses: 107D0H and 107D1H
22-135
Figure 22-59.
MSR_IFSB_CTL6, Address: 107D2H; MSR_IFSB_CNTR7, Address: 107D3H
22-136
Figure 22-60.
Block Diagram of the Intel® Xeon® Processor 7400 Series
22-137
Figure 22-61.
Block Diagram of the Intel® Xeon® Processor 7100 Series
22-137
Figure 22-62.
MSR_EMON_L3_CTR_CTL0/1, Addresses: 107CCH/107CDH
22-139
Figure 22-63.
MSR_EMON_L3_CTR_CTL2/3, Addresses: 107CEH/107CFH
22-141
Figure 22-64.
MSR_EMON_L3_CTR_CTL4/5/6/7, Addresses: 107D0H-107D3H
22-141
Figure 22-65.
PerfEvtSel0 and PerfEvtSel1 MSRs
22-143
Figure 22-66.
CESR MSR (Pentium Processor Only)
22-146
Figure 22-67.
Layout of IA32_PERF_CAPABILITIES MSR
22-151
Figure 22-68.
Layout of IA32_PEBS_ENABLE MSR
22-152
Figure 22-69.
PEBS Programming Environment
22-153
Figure 22-70.
Layout of IA32_PerfEvtSelX MSR Supporting Adaptive PEBS
22-154
Figure 22-71.
Layout of IA32_FIXED_CTR_CTRL MSR Supporting Adaptive PEBS
22-155
Figure 22-72.
Legacy MSR_PEBS_DATA_CFG
22-159
Figure 22-73.
MSR_PEBS_DATA_CFG in PEBS_FMT=6
22-160
Figure 22-74.
Example PEBS Record
22-172
Figure 22-75.
IA32_PEBS_BASE Register
22-172
Figure 22-76.
IA32_PEBS_INDEX Register
22-173
Figure 22-77.
PEBS Record Format
22-176
Figure 22-78.
Bit Mapping of Applicable Counters in the PEBS Record
22-178
Figure 22-79.
Example of a Fragmented Record
22-184
Figure 22-80.
EPT Page Boundary Example with Included Padding
22-184
Figure 22-81.
System-Wide PEBS: Diagram of Interactions Across Entities
22-185
Figure 22-82.
Guest-Only PEBS: Diagram of Interactions Across Entities
22-186
Figure 23-1.
Real-Address Mode Address Translation
23-3
Figure 23-2.
Interrupt Vector Table in Real-Address Mode
23-5
Figure 23-3.
Entering and Leaving Virtual-8086 Mode
23-9
Figure 23-4.
Privilege Level 0 Stack After Interrupt or Exception in Virtual-8086 Mode
23-13
Vol. 3A xliii
CONTENTS
PAGE
Figure 23-5.
Software Interrupt Redirection Bit Map in TSS
23-18
Figure 24-1.
Stack after Far 16- and 32-Bit Calls
24-5
Figure 25-1.
I/O Map Base Address Differences
25-30
Figure 26-1.
Interaction of a Virtual-Machine Monitor and Guests
26-2
Figure 27-1.
States of VMCS X
27-2
Figure 31-1.
Formats of EPTP and EPT Paging-Structure Entries
31-13
Figure 33-1.
INVEPT Descriptor
33-3
Figure 33-2.
INVVPID Descriptor
33-6
Figure 34-1.
SMRAM Usage
34-5
Figure 34-2.
SMM Revision Identifier
34-14
Figure 34-3.
Auto HALT Restart Field
34-14
Figure 34-4.
SMBASE Relocation Field
34-15
Figure 34-5.
I/O Instruction Restart Field
34-16
Figure 35-1.
SEAM Modes of Operation
35-1
Figure 36-1.
ToPA Memory Illustration
36-11
Figure 36-2.
Layout of ToPA Table Entry
36-12
Figure 36-3.
Interpreting Tabular Definition of Packet Format
36-38
Figure 36-4.
Layout of the IA32_PERFEVTSELx MSR
36-76
Figure 37-1.
An Enclave Within the Application’s Virtual Address Space
37-1
Figure 39-1.
Enclave Memory Layout
39-1
Figure 39-2.
Measurement Flow of Enclave Build Process
39-7
Figure 39-3.
SGX Local Attestation
39-9
Figure 40-1.
Exit Stack Just After Interrupt with Stack Switch
40-1
Figure 40-2.
The SSA Stack
40-2
Figure 41-1.
Relationships Between SECS, SIGSTRUCT, and EINITTOKEN
41-41
Figure 43-1.
Single Stepping with Opt-out Entry - No AEX
43-2
Figure 43-2.
Single Stepping with Opt-out Entry -AEX Due to Non-SMI Event Before Single-Step Boundary
43-3
Figure 43-3.
LBR Stack Interaction with Opt-in Entry
43-6
Figure 43-4.
LBR Stack Interaction with Opt-out Entry
43-7
xliv Vol. 3A
CONTENTS
PAGE
TABLES
Table 2-1.
IA32_EFER MSR Information
2-9
Table 2-2.
Action Taken By x87 FPU Instructions for Different Combinations of EM, MP, and TS
2-17
Table 2-3.
Summary of System Instructions
2-24
Table 3-1.
Code- and Data-Segment Types
3-12
Table 3-2.
System-Segment and Gate-Descriptor Types
3-14
Table 5-1.
Properties of Different Paging Modes
5-2
Table 5-2.
Paging Structures in the Different Paging Modes
5-8
Table 5-3.
Use of CR3 with 32-Bit Paging
5-12
Table 5-4.
Format of a 32-Bit Page-Directory Entry that Maps a 4-MByte Page
5-12
Table 5-6.
Format of a 32-Bit Page-Table Entry that Maps a 4-KByte Page
5-13
Table 5-5.
Format of a 32-Bit Page-Directory Entry that References a Page Table
5-13
Table 5-7.
Use of CR3 with PAE Paging
5-14
Table 5-8.
Format of a PAE Page-Directory-Pointer-Table Entry (PDPTE)
5-15
Table 5-9.
Format of a PAE Page-Directory Entry that Maps a 2-MByte Page
5-17
Table 5-10.
Format of a PAE Page-Directory Entry that References a Page Table
5-18
Table 5-11.
Format of a PAE Page-Table Entry that Maps a 4-KByte Page
5-18
Table 5-12.
Use of CR3 with 4-Level Paging and 5-level Paging and CR4.PCIDE = 0
5-21
Table 5-13.
Use of CR3 with 4-Level Paging and 5-Level Paging and CR4.PCIDE = 1
5-21
Table 5-14.
Format of a PML5 Entry (PML5E) that References a PML4 Table
5-26
Table 5-15.
Format of a PML4 Entry (PML4E) that References a Page-Directory-Pointer Table
5-26
Table 5-16.
Format of a Page-Directory-Pointer-Table Entry (PDPTE) that Maps a 1-GByte Page
5-27
Table 5-17.
Format of a Page-Directory-Pointer-Table Entry (PDPTE) that References a Page Directory
5-28
Table 5-18.
Format of a Page-Directory Entry that Maps a 2-MByte Page
5-29
Table 5-19.
Format of a Page-Directory Entry that References a Page Table
5-30
Table 5-20.
Format of a Page-Table Entry that Maps a 4-KByte Page
5-31
Table 6-1.
Privilege Check Rules for Call Gates
6-16
Table 6-2.
64-Bit-Mode Stack Layout After Far CALL with CPL Change
6-19
Table 6-3.
Combined Page-Directory and Page-Table Protection
6-29
Table 6-4.
Extended Feature Enable MSR (IA32_EFER)
6-31
Table 6-6.
4-KByte Page Level Protection Matrix with Execute-Disable Bit Capability with PAE Paging
6-32
Table 6-7.
2-MByte Page Level Protection with Execute-Disable Bit Capability with PAE Paging
6-32
Table 6-5.
Page Level Protection Matrix with Execute-Disable Bit Capability with 4-Level Paging
6-32
Table 6-9.
Reserved Bit Checking with Execute-Disable Bit Capability Not Enabled
6-33
Table 6-8.
Page Level Protection Matrix with Execute-Disable Bit Capability Enabled
6-33
Table 7-1.
Protected-Mode Exceptions and Interrupts
7-2
Table 7-2.
Priority Among Concurrent Events
7-9
Table 7-3.
Debug Exception Conditions and Corresponding Exception Classes
7-26
Table 7-4.
Interrupt and Exception Classes
7-36
Table 7-5.
Conditions for Generating a Double Fault
7-37
Table 7-6.
Invalid TSS Conditions
7-39
Table 7-7.
Alignment Requirements by Data Type
7-53
Table 7-8.
SIMD Floating-Point Exceptions Priority
7-57
Table 9-1.
Format of User Posted-Interrupt Descriptor - UPID
9-5
Table 10-1.
Exception Conditions Checked During a Task Switch
10-13
Table 10-2.
Effect of a Task Switch on Busy Flag, NT Flag, Previous Task Link Field, and TS Flag
10-15
Table 11-1.
Broadcast INIT-SIPI-SIPI Sequence and Choice of Timeouts
11-24
Table 11-2.
Initial APIC IDs for the Logical Processors in a System that has Four Intel Xeon MP Processors Supporting Intel Hyper-
Threading Technology111-40
Table 11-3.
Initial APIC IDs for the Logical Processors in a System that has Two Physical Processors Supporting Dual-Core and Intel
Hyper-Threading Technology11-41
Table 11-4.
Example of Possible x2APIC ID Assignment in a System that has Two Physical Processors Supporting x2APIC and Intel
Hyper-Threading Technology11-41
Table 11-5.
Boot Phase IPI Message Format
11-56
Table 12-1.
IA-32 and Intel® 64 Processor States Following Power-up, Reset, or INIT
12-2
Table 12-2.
Variance of RESET Values in Selected Intel Architecture Processors
12-4
Table 12-3.
Recommended Settings of EM and MP Flags on IA-32 Processors
12-6
Table 12-4.
Software Emulation Settings of EM, MP, and NE Flags
12-7
Table 12-5.
Main Initialization Steps in STARTUP.ASM Source Listing
12-16
Table 12-6.
Relationship Between BLD Item and ASM Source File
12-27
Table 12-7.
Microcode Update Field Definitions
12-28
Table 12-8.
Microcode Update Format
12-30
Table 12-9.
Extended Processor Signature Table Header Structure
12-31
Vol. 3A xlv
CONTENTS
PAGE
Table 12-10.
Processor Signature Structure
12-31
Table 12-11.
Processor Flags
12-33
Table 12-12.
Microcode Update Signature
12-37
Table 12-13.
Microcode Update Functions
12-42
Table 12-14.
Parameters for the Presence Test
12-42
Table 12-15.
Parameters for the Write Update Data Function
12-43
Table 12-16.
Parameters for the Control Update Sub-function
12-48
Table 12-17.
Mnemonic Values
12-48
Table 12-18.
Parameters for the Read Microcode Update Data Function
12-48
Table 12-19.
Return Code Definitions
12-50
Table 13-1.
Local APIC Register Address Map
13-6
Table 13-2.
Local APIC Timer Modes
13-18
Table 13-3.
Valid Combinations for Pentium 4 and Intel Xeon Processors Local xAPIC Interrupt Command Register
13-22
Table 13-4.
Valid Combinations for the P6 Family Processor Local APIC Interrupt Command Register
13-23
Table 13-5.
x2APIC Operating Mode Configurations
13-38
Table 13-6.
Local APIC Register Address Map Supported by x2APIC
13-39
Table 13-7.
MSR/MMIO Interface of a Local x2APIC in Different Modes of Operation
13-41
Table 13-8.
EOI Message (14 Cycles)
13-48
Table 13-9.
Short Message (21 Cycles)
13-49
Table 13-10.
Non-Focused Lowest Priority Message (34 Cycles)
13-50
Table 13-11.
APIC Bus Status Cycles Interpretation
13-52
Table 14-1.
Characteristics of the Caches, TLBs, Store Buffer, and
Write Combining Buffer in Intel 64 and IA-32 Processors14-2
Table 14-2.
Memory Types and Their Properties
14-6
Table 14-3.
Methods of Caching Available in Intel Core 2 Duo, Intel Atom, Intel Core Duo, Pentium M, Pentium 4, Intel Xeon, P6 Family,
and Pentium Processors14-7
Table 14-4.
MESI Cache Line States
14-9
Table 14-5.
Cache Operating Modes
14-12
Table 14-6.
Effective Page-Level Memory Type for Pentium Pro and Pentium II Processors
14-14
Table 14-7.
Effective Page-Level Memory Types for Pentium III and More Recent Processor Families
14-15
Table 14-8.
Memory Types That Can Be Encoded in MTRRs
14-21
Table 14-9.
Address Mapping for Fixed-Range MTRRs
14-24
Table 14-10.
Memory Types That Can Be Encoded With PAT
14-34
Table 14-11.
Selection of PAT Entries with PAT, PCD, and PWT Flags
14-35
Table 14-12.
Memory Type Setting of PAT Entries Following a Power-up or Reset
14-35
Table 15-1.
Action Taken By MMX Instructions for Different Combinations of EM, MP, and TS
15-1
Table 15-3.
Effect of the MMX, x87 FPU, and FXSAVE/FXRSTOR Instructions on the x87 FPU Tag Word
15-3
Table 15-2.
Effects of MMX Instructions on x87 FPU State
15-3
Table 16-1.
Action Taken for Combinations of OSFXSR, OSXMMEXCPT, SSE, SSE2, SSE3, EM, MP, and TS
16-3
Table 16-2.
Action Taken for Combinations of OSFXSR, SSSE3, SSE4, EM, and TS
16-4
Table 16-3.
CPUID.0DH.01H EAX Bit Assignment
16-8
Table 17-1.
Architectural and Non-Architectural MSRs Related to HWP
17-6
Table 17-2.
IA32_HWP_CTL MSR Bit 0 Behavior
17-13
Table 17-3.
Architectural and non-Architecture MSRs Related to HDC
17-21
Table 17-4.
Hardware Feedback Interface Structure
17-25
Table 17-5.
Hardware Feedback Interface Global Header Structure
17-26
Table 17-6.
Hardware Feedback Interface Logical Processor Entry Structure
17-26
Table 17-7.
Intel® Thread Director Table Structure
17-27
Table 17-8.
Intel® Thread Director Global Header Structure
17-28
Table 17-9.
Intel® Thread Director Logical Processor Entry Structure
17-29
Table 17-10.
IA32_HW_FEEDBACK_CONFIG Control Options
17-32
Table 17-11.
On-Demand Clock Modulation Duty Cycle Field Encoding
17-40
Table 17-12.
RAPL MSR Interfaces and RAPL Domains
17-50
Table 18-1.
Bits 54:53 in IA32_MCi_STATUS MSRs when IA32_MCG_CAP[11] = 1 and UC = 0
18-8
Table 18-2.
Overwrite Rules for Enabled Errors
18-8
Table 18-3.
Address Mode in IA32_MCi_MISC[8:6]
18-10
Table 18-4.
Address Mode in IA32_MCi_MISC[8:6]
18-11
Table 18-5.
Extended Machine Check State MSRs in Processors Without Support for Intel® 64 Architecture
18-12
Table 18-6.
Extended Machine Check State MSRs In Processors With Support for Intel® 64 Architecture
18-12
Table 18-7.
MC Error Classifications
18-18
Table 18-8.
Overwrite Rules for UC, CE, and UCR Errors
18-18
Table 18-9.
IA32_MCi_Status [15:0] Simple Error Code Encoding
18-21
Table 18-10.
IA32_MCi_Status [15:0] Compound Error Code Encoding
18-21
Table 18-11.
Encoding for TT (Transaction Type) Sub-Field
18-22
Table 18-12.
Level Encoding for LL (Memory Hierarchy Level) Sub-Field
18-22
xlvi Vol. 3A
CONTENTS
PAGE
Table 18-13.
Encoding of Request (RRRR) Sub-Field
18-23
Table 18-14.
Encodings of PP, T, and II Sub-Fields
18-23
Table 18-15.
Encodings of MMM and CCCC Sub-Fields
18-24
Table 18-16.
MCA Compound Error Code Encoding for SRAO Errors
18-25
Table 18-17.
IA32_MCi_STATUS Values for SRAO Errors
18-25
Table 18-18.
IA32_MCG_STATUS Flag Indication for SRAO Errors
18-25
Table 18-19.
MCA Compound Error Code Encoding for SRAR Errors
18-26
Table 18-20.
IA32_MCi_STATUS Values for All Defined SRAR Errors
18-26
Table 18-21.
IA32_MCG_STATUS Flag Indication for SRAR Errors
18-27
Table 19-1.
CPUID DisplayFamily_DisplayModel Signatures for Processor Family 06H
19-1
Table 19-2.
Incremental Decoding Information: Processor Family 06H Machine Error Codes for Machine Check
19-1
Table 19-3.
CPUID DisplayFamily_DisplayModel Signatures for Processors Based on Intel® Core™ Microarchitecture
19-3
Table 19-4.
Incremental Bus Error Codes of Machine Check for Processors
Based on Intel® Core™ Microarchitecture19-4
Table 19-5.
Incremental MCA Error Code Types for Intel® Xeon® Processor 7400
19-6
Table 19-6.
Type B: Bus and Interconnect Error Codes
19-6
Table 19-7.
Type C: Cache Bus Controller Error Codes
19-6
Table 19-8.
Intel® QPI Machine Check Error Codes for IA32_MC0_STATUS and IA32_MC1_STATUS
19-7
Table 19-9.
Intel® QPI Machine Check Error Codes for IA32_MC0_MISC and IA32_MC1_MISC
19-8
Table 19-10.
Machine Check Error Codes for IA32_MC7_STATUS
19-8
Table 19-11.
Incremental Memory Controller Error Codes of Machine Check for IA32_MC8_STATUS
19-9
Table 19-12.
Incremental Memory Controller Error Codes of Machine Check for IA32_MC8_MISC
19-9
Table 19-13.
Machine Check Error Codes for IA32_MC4_STATUS
19-10
Table 19-14.
Intel® QPI MC Error Codes for IA32_MC6_STATUS and IA32_MC7_STATUS
19-11
Table 19-15.
Intel IMC MC Error Codes for IA32_MCi_STATUS (i= 8, 11)
19-11
Table 19-16.
Intel IMC MC Error Codes for IA32_MCi_MISC (i= 8, 11)
19-11
Table 19-17.
Machine Check Error Codes for IA32_MC4_STATUS
19-12
Table 19-18.
Intel IMC MC Error Codes for IA32_MCi_STATUS (i= 9-16)
19-13
Table 19-19.
Intel IMC MC Error Codes for IA32_MCi_MISC (i= 9-16)
19-14
Table 19-20.
Machine Check Error Codes for IA32_MC4_STATUS
19-15
Table 19-21.
Intel® QPI MC Error Codes for IA32_MCi_STATUS (i = 5, 20, 21)
19-17
Table 19-22.
Intel IMC MC Error Codes for IA32_MCi_STATUS (i= 9-16)
19-17
Table 19-23.
Intel IMC MC Error Codes for IA32_MCi_MISC (i= 9-16)
19-18
Table 19-24.
Machine Check Error Codes for IA32_MC4_STATUS
19-19
Table 19-25.
Intel IMC MC Error Codes for IA32_MCi_STATUS (i= 9-10)
19-20
Table 19-26.
Intel IMC MC Error Codes for IA32_MCi_STATUS (i= 9-16)
19-21
Table 19-27.
Intel HA MC Error Codes for IA32_MCi_MISC (i= 7, 8)
19-22
Table 19-28.
Machine Check Error Codes for IA32_MC4_STATUS
19-22
Table 19-29.
Interconnect MC Error Codes for IA32_MCi_STATUS (i = 5, 12, 19)
19-24
Table 19-30.
Intel IMC MC Error Codes for IA32_MCi_STATUS (i= 13-18)
19-26
Table 19-31.
M2M MC Error Codes for IA32_MCi_STATUS (i= 7, 8)
19-27
Table 19-32.
Intel HA MC Error Codes for IA32_MCi_MISC (i= 7, 8)
19-27
Table 19-33.
Intel IMC MC Error Codes for IA32_MCi_STATUS (i= 7, 8)
19-28
Table 19-34.
Machine Check Error Codes for IA32_MC4_STATUS
19-29
Table 19-35.
Interconnect MC Error Codes for IA32_MCi_STATUS (i = 5, 7, 8)
19-31
Table 19-36.
MSRs Reporting MC Error Codes by CPUID DisplayFamily_DisplaySignature
19-32
Table 19-37.
Intel IMC MC Error Codes for IA32_MCi_STATUS (i= 13-14, 17-18, 21-22, 25-26)
19-33
Table 19-38.
Additional Information Reported in IA32_MCi_MISC (i= 13-14, 17-18, 21-22, 25-26)
19-35
Table 19-39.
M2M MC Error Codes for IA32_MCi_STATUS (i= 12, 16, 20, 24)
19-36
Table 19-40.
Machine Check Error Codes for IA32_MC4_STATUS
19-37
Table 19-41.
Interconnect MC Error Codes for IA32_MC5_STATUS
19-40
Table 19-42.
Intel IMC MC Error Codes for IA32_MCi_STATUS (i= 13-20)
19-41
Table 19-43.
Additional Information Reported in IA32_MCi_MISC (i= 13-20)
19-43
Table 19-44.
M2M MC Error Codes for IA32_MC12_STATUS
19-44
Table 19-45.
Incremental Decoding Information: Processor Family 0FH, Machine Error Codes for Machine Check
19-45
Table 19-46.
MCi_STATUS Register Bit Definition
19-46
Table 19-47.
Incremental MCA Error Code for Intel® Xeon® Processor MP 7100
19-47
Table 19-48.
Other Information Field Bit Definition
19-47
Table 19-49.
Type A: L3 Error Codes
19-48
Table 19-50.
Type B: Bus and Interconnect Error Codes
19-48
Table 19-51.
Type C: Cache Bus Controller Error Codes
19-49
Table 19-52.
Decoding Family 0FH Machine Check Codes for Cache Hierarchy Errors
19-50
Table 20-1.
Breakpoint Examples
20-6
Table 20-2.
Debug Exception Conditions
20-9
Table 20-4.
LBR Stack Size and TOS Pointer Range
20-17
Vol. 3A xlvii
CONTENTS
PAGE
Table 20-3.
Legacy and Streamlined Operation with Freeze_PerfMon_On_PMI = 1, Counter Overflowed
20-17
Table 20-5.
IA32_DEBUGCTL Flag Encodings
20-25
Table 20-6.
CPL-Qualified Branch Trace Store Encodings
20-26
Table 20-7.
MSR_LASTBRANCH_x_TO_IP for the Goldmont Microarchitecture
20-28
Table 20-8.
MSR_LASTBRANCH_x_FROM_IP
20-30
Table 20-9.
MSR_LASTBRANCH_x_TO_IP
20-31
Table 20-10.
LBR Stack Size and TOS Pointer Range
20-31
Table 20-11.
MSR_LBR_SELECT for Nehalem Microarchitecture
20-31
Table 20-12.
MSR_LBR_SELECT for Sandy Bridge Microarchitecture
20-32
Table 20-13.
MSR_LBR_SELECT for Haswell Microarchitecture
20-32
Table 20-14.
MSR_LASTBRANCH_x_FROM_IP with TSX Information
20-33
Table 20-15.
LBR Stack Size and TOS Pointer Range
20-34
Table 20-16.
MSR_LBR_INFO_x
20-34
Table 20-17.
LBR MSR Stack Size and TOS Pointer Range for the Pentium® 4 and the Intel® Xeon® Processor Family
20-37
Table 20-18.
Monitoring Supported Event IDs
20-49
Table 20-19.
Re-indexing of CLOS Numbers and Mapping to CAT/CDP Mask MSRs
20-63
Table 20-20.
MBA Delay Value MSRs
20-68
Table 20-21.
Cache Bandwidth Allocation (CBA) MSRs
20-71
Table 20-22.
Asymmetrical Enumeration
20-74
Table 20-23.
Asymmetrical CPUID Leaves
20-74
Table 21-1.
LBR IP Values for Various Operations
21-2
Table 21-2.
Branch Type Filtering Details
21-3
Table 21-3.
IA32_LBR_x_INFO and IA32_LER_INFO Branch Type Encodings
21-4
Table 21-4.
LBR VMCS Fields
21-6
Table 22-1.
Association of Fixed-Function Performance Counters with Architectural Performance Events
22-7
Table 22-2.
New Performance Monitoring MSR Naming Details
22-16
Table 22-3.
UMask and Event Select Encodings for Pre-Defined Architectural Performance Events
22-18
Table 22-4.
PEBS Record Format for Intel Core i7 Processor Family
22-25
Table 22-5.
Data Source Encoding for Load Latency Record
22-29
Table 22-6.
Off-Core Response Event Encoding
22-30
Table 22-7.
MSR_OFFCORE_RSP_0 and MSR_OFFCORE_RSP_1 Bit Field Definition
22-30
Table 22-8.
Opcode Field Encoding for MSR_UNCORE_ADDR_OPCODE_MATCH
22-35
Table 22-9.
Uncore PMU MSR Summary
22-37
Table 22-10.
Uncore PMU MSR Summary for Intel® Xeon® Processor E7 Family
22-38
Table 22-11.
Core PMU Comparison
22-39
Table 22-12.
PEBS Facility Comparison
22-42
Table 22-13.
PEBS Performance Events for Sandy Bridge Microarchitecture
22-43
Table 22-14.
Layout of Data Source Field of Load Latency Record
22-45
Table 22-16.
Off-Core Response Event Encoding
22-46
Table 22-15.
Layout of Precise Store Information In PEBS Record
22-46
Table 22-17.
MSR_OFFCORE_RSP_x Request_Type Field Definition
22-47
Table 22-18.
MSR_OFFCORE_RSP_x Response Supplier Info Field Definition
22-48
Table 22-19.
MSR_OFFCORE_RSP_x Snoop Info Field Definition
22-49
Table 22-20.
Uncore PMU MSR Summary
22-50
Table 22-21.
MSR_OFFCORE_RSP_x Supplier Info Field Definitions
22-51
Table 22-22.
Uncore PMU MSR Summary for Intel® Xeon® Processor E5 Family
22-52
Table 22-23.
Core PMU Comparison
22-53
Table 22-24.
PEBS Facility Comparison
22-53
Table 22-25.
PEBS Record Format for 4th Generation Intel Core Processor Family
22-54
Table 22-26.
Precise Events That Supports Data Linear Address Profiling
22-55
Table 22-27.
Layout of Data Linear Address Information In PEBS Record
22-56
Table 22-28.
MSR_OFFCORE_RSP_x Request_Type Definition (Haswell Microarchitecture)
22-56
Table 22-29.
MSR_OFFCORE_RSP_x Supplier Info Field Definition (CPUID Signatures: 06_3CH, 06_46H)
22-57
Table 22-30.
MSR_OFFCORE_RSP_x Supplier Info Field Definition (CPUID Signature: 06_45H)
22-57
Table 22-31.
MSR_OFFCORE_RSP_x Supplier Info Field Definition
22-58
Table 22-32.
TX Abort Information Field Definition
22-60
Table 22-33.
Uncore PMU MSR Summary
22-60
Table 22-34.
Core PMU Comparison
22-62
Table 22-35.
PEBS Facility Comparison
22-63
Table 22-36.
PEBS Record Format for the 6th Generation, 7th Generation, and 8th Generation Intel Core Processor Families 22-64
Table 22-37.
Precise Events for the Skylake, Kaby Lake, and Coffee Lake Microarchitectures
22-65
Table 22-38.
Layout of Data Linear Address Information In PEBS Record
22-66
Table 22-39.
FrontEnd_Retired Sub-Event Encodings Supported by MSR_PEBS_FRONTEND.EVTSEL
22-67
Table 22-40.
MSR_PEBS_FRONTEND Layout
22-67
Table 22-41.
MSR_OFFCORE_RSP_x Request_Type Definition
xlviii Vol. 3A
CONTENTS
PAGE
(Skylake, Kaby Lake, and Coffee Lake Microarchitectures)22-68
Table 22-42.
MSR_OFFCORE_RSP_x Supplier Info Field Definition
(CPUID Signatures: 06_4EH, 06_5EH, 06_8EH, 06_9EH)22-68
Table 22-43.
MSR_OFFCORE_RSP_x Snoop Info Field Definition
(CPUID Signatures: 06_4EH, 06_5EH, 06_8EH, 06_9E, 06_55H)22-69
Table 22-44.
MSR_OFFCORE_RSP_x Request_Type Definition (Intel® Xeon® Scalable Processor Family)
22-70
Table 22-46.
MSR_OFFCORE_RSP_x Supplier Info Field Definition
(CPUID Signature: 06_55H, Steppings 0x5H - 0xFH)22-71
Table 22-45.
MSR_OFFCORE_RSP_x Supplier Info Field Definition (CPUID Signature: 06_55H)
22-71
Table 22-47.
Core PMU Summary of the Ice Lake Microarchitecture
22-72
Table 22-48.
MSR_OFFCORE_RSP_x Request_Type Definition
(Processors Based on Ice Lake Microarchitecture)22-73
Table 22-49.
MSR_OFFCORE_RSP_x Supplier Info Field Definition
(Processors Based on Ice Lake Microarchitecture)22-73
Table 22-50.
MSR_OFFCORE_RSP_x Snoop Info Field Definition
(Processors Based on Ice Lake Microarchitecture)22-74
Table 22-51.
Core PMU Summary of the Golden Cove Microarchitecture
22-76
Table 22-52.
Special Performance Monitoring Events with Counter Restrictions
22-77
Table 22-53.
Core PMU Summary of the Gracemont Microarchitecture
22-78
Table 22-54.
E-core PEBS Memory Access Info Encoding
22-79
Table 22-55.
E-core PEBS Data Source Encodings
22-79
Table 22-56.
MSR_OFFCORE_RSPx Request Type Definition
22-80
Table 22-57.
Core PMU Summary of the Lion Cove Microarchitecture
22-81
Table 22-58.
Performance Monitoring Events with Counter Restrictions in Lion Cove PMU
22-82
Table 22-59.
Core PMU Summary of the Skymont Microarchitecture
22-83
Table 22-60.
PEBS Performance Events for Knights Landing Microarchitecture
22-84
Table 22-61.
PEBS Record Format for Knights Landing Microarchitecture
22-85
Table 22-62.
OffCore Response Event Encoding
22-85
Table 22-63.
Bit fields of the MSR_OFFCORE_RESP [0, 1] Registers
22-86
Table 22-64.
PEBS Performance Events for the Silvermont Microarchitecture
22-89
Table 22-66.
OffCore Response Event Encoding
22-90
Table 22-65.
PEBS Record Format for the Silvermont Microarchitecture
22-90
Table 22-67.
MSR_OFFCORE_RSPx Request_Type Field Definition
22-91
Table 22-68.
MSR_OFFCORE_RSP_x Response Supplier Info Field Definition
22-92
Table 22-69.
MSR_OFFCORE_RSPx Snoop Info Field Definition
22-92
Table 22-70.
Core PMU Comparison Between the Goldmont and Silvermont Microarchitectures
22-93
Table 22-71.
Precise Events Supported by the Goldmont Microarchitecture
22-95
Table 22-72.
PEBS Record Format for the Goldmont Microarchitecture
22-96
Table 22-73.
MSR_OFFCORE_RSPx Request_Type Field Definition
22-97
Table 22-74.
MSR_OFFCORE_RSPx For L2 Miss and Outstanding Requests
22-98
Table 22-75.
Core PMU Comparison Between the Goldmont Plus and Goldmont Microarchitectures
22-99
Table 22-76.
Core PMU Comparison Between the Tremont and Goldmont Plus Microarchitectures
22-100
Table 22-77.
New Fields in IA32_PEBS_ENABLE
22-101
Table 22-78.
MSR_OFFCORE_RSPx Request Type Definition
22-102
Table 22-79.
MSR_OFFCORE_RSPx Response Type Definition
22-103
Table 22-80.
MSR_OFFCORE_RSPx Snoop Info Definition
22-103
Table 22-81.
Core Specificity Encoding within a Non-Architectural Umask
22-105
Table 22-82.
Agent Specificity Encoding within a Non-Architectural Umask
22-105
Table 22-83.
HW Prefetch Qualification Encoding within a Non-Architectural Umask
22-105
Table 22-84.
MESI Qualification Definitions within a Non-Architectural Umask
22-105
Table 22-85.
Bus Snoop Qualification Definitions within a Non-Architectural Umask
22-106
Table 22-86.
Snoop Type Qualification Definitions within a Non-Architectural Umask
22-106
Table 22-87.
At-Retirement Performance Events for Intel Core Microarchitecture
22-109
Table 22-88.
PEBS Performance Events for Intel Core Microarchitecture
22-110
Table 22-89.
Requirements to Program PEBS
22-111
Table 22-90.
Performance Counter MSRs and Associated CCCR and ESCR MSRs
(Processors Based on Intel NetBurst Microarchitecture)22-113
Table 22-91.
Event Example
22-120
Table 22-92.
CCR Names and Bit Positions
22-123
Table 22-93.
Effect of Logical Processor and CPL Qualification
for Logical-Processor-Specific (TS) Events22-132
Table 22-94.
Effect of Logical Processor and CPL Qualification
for Non-logical-Processor-specific (TI) Events22-132
Table 22-95.
Nominal Core Crystal Clock Frequency
22-149
Table 22-96.
Basic Info Group
22-155
Vol. 3A xlix
CONTENTS
PAGE
Table 22-97.
Memory Access Info Group
22-156
Table 22-98.
Updated Memory Access Info Group
22-157
Table 22-99.
GPRs in Ice Lake Microarchitecture
22-158
Table 22-100.
XMMs
22-158
Table 22-101.
LBRs
22-159
Table 22-102.
MSR_PEBS_CFG Programming
22-160
Table 22-103.
Counters Group
22-161
Table 22-104.
PEBS Record Example 1
22-162
Table 22-105.
PEBS Record Example 2
22-164
Table 22-106.
Data Source Encoding for Memory Accesses (Ice Lake and Later Microarchitectures)
22-166
Table 22-107.
Data Source Encoding for Memory Accesses (Lion Cove and Next Generation Microarchitectures)
22-166
Table 22-108.
PEBS Basic Info Group
22-168
Table 22-109.
Architectural PEBS Configuration Locations
22-170
Table 22-110.
IA32_PMC_GPn_CFG_C and IA32_PMC_FXm_CFG_C MSRs
22-174
Table 22-111.
Basic Group Fields
22-177
Table 22-112.
Auxiliary Group Fields
22-179
Table 22-113.
General-Purpose Register Group Fields
22-180
Table 22-114.
XSAVE-Enabled Registers (XER) Group Fields and Sizes
22-181
Table 22-115.
Last Branch Record Group Fields
22-181
Table 22-116.
Counter Group Details
22-183
Table 23-1.
Real-Address Mode Exceptions and Interrupts
23-6
Table 23-2.
Software Interrupt Handling Methods While in Virtual-8086 Mode
23-17
Table 24-1.
Characteristics of 16-Bit and 32-Bit Program Modules
24-1
Table 25-1.
New Instruction in the Pentium Processor and Later IA-32 Processors
25-4
Table 25-3.
EM and MP Flag Interpretation
25-17
Table 25-2.
Recommended Values of the EM, MP, and NE Flags for Intel486 SX Microprocessor/Intel 487 SX Math Coprocessor
System25-17
Table 25-4.
Exception Conditions for Legacy SIMD/MMX Instructions with FP Exception and 16-Byte Alignment
25-22
Table 25-5.
Exception Conditions for Legacy SIMD/MMX Instructions with XMM and FP Exception
25-23
Table 25-6.
Exception Conditions for Legacy SIMD/MMX Instructions with XMM and without FP Exception
25-24
Table 25-7.
Exception Conditions for SIMD/MMX Instructions with Memory Reference
25-25
Table 25-8.
Exception Conditions for Legacy SIMD/MMX Instructions without FP Exception
25-26
Table 25-9.
Exception Conditions for Legacy SIMD/MMX Instructions without Memory Reference
25-27
Table 25-10.
Processor State Following Power-up/Reset/INIT for Pentium, Pentium Pro and Pentium 4 Processors
25-37
Table 27-1.
Format of the VMCS Region
27-2
Table 27-2.
Format of Access Rights
27-4
Table 27-3.
Format of Interruptibility State
27-7
Table 27-4.
Format of Pending-Debug-Exceptions
27-8
Table 27-5.
Definitions of Pin-Based VM-Execution Controls
27-10
Table 27-6.
Definitions of Primary Processor-Based VM-Execution Controls
27-11
Table 27-7.
Definitions of Secondary Processor-Based VM-Execution Controls
27-12
Table 27-8.
Definitions of Tertiary Processor-Based VM-Execution Controls
27-14
Table 27-9.
Format of Extended-Page-Table Pointer
27-17
Table 27-10.
Definitions of VM-Function Controls
27-18
Table 27-11.
Format of Sub-Page-Permission-Table Pointer
27-20
Table 27-12.
Format of Hypervisor-Managed Linear-Address Translation Pointer
27-20
Table 27-13.
Format of SEAM Shared EPT Pointer
27-21
Table 27-14.
Definitions of Primary VM-Exit Controls
27-22
Table 27-15.
Definitions of Secondary VM-Exit Controls
27-23
Table 27-16.
Format of an MSR Entry
27-24
Table 27-17.
Definitions of VM-Entry Controls
27-25
Table 27-18.
Format of the Injected-Event Identification Field
27-26
Table 27-19.
Format of Exit Reason
27-27
Table 27-20.
Format of the Exiting-Event Identification Field
27-28
Table 27-21.
Format of the Original-Event Identification Field
27-29
Table 27-22.
Structure of VMCS Component Encoding
27-32
Table 28-23.
Format of the Virtualization-Exception Information Area
28-23
Table 30-1.
Exit Qualification for Debug Exceptions
30-5
Table 30-2.
Exit Qualification for Task Switches
30-6
Table 30-3.
Exit Qualification for Control-Register Accesses
30-7
Table 30-4.
Exit Qualification for MOV DR
30-8
Table 30-5.
Exit Qualification for I/O Instructions
30-9
Table 30-6.
Exit Qualification for APIC-Access VM Exits from Linear Accesses and Guest-Physical Accesses
30-9
Table 30-7.
Exit Qualification for EPT Violations
30-11
Table 30-8.
Format of the VM-Exit Instruction-Information Field as Used for INS and OUTS
30-16
l Vol. 3A
CONTENTS
PAGE
Table 30-9.
Format of the VM-Exit Instruction-Information Field as Used for INVEPT, INVPCID, and INVVPID
30-18
Table 30-10.
Format of the VM-Exit Instruction-Information Field as Used for LIDT, LGDT, SIDT, or SGDT
30-19
Table 30-11.
Format of the VM-Exit Instruction-Information Field as Used for LLDT, LTR, SLDT, and STR
30-20
Table 30-12.
Format of the VM-Exit Instruction-Information Field as Used for RDRAND and RDSEED
30-21
Table 30-13.
Format of the VM-Exit Instruction-Information Field as Used for TPAUSE and UMWAIT
30-21
Table 30-14.
Format of the VM-Exit Instruction-Information Field as Used for VMCLEAR, VMPTRLD, VMPTRST, VMXON, XRSTORS, and
XSAVES30-22
Table 30-15.
Format of the VM-Exit Instruction-Information Field as Used for VMREAD and VMWRITE
30-23
Table 30-16.
Format of the VM-Exit Instruction-Information Field as Used for LOADIWKEY
30-24
Table 31-1.
Format of an EPT PML5 Entry (PML5E) that References an EPT PML4 Table
31-4
Table 31-2.
Format of an EPT PML4 Entry (PML4E) that References an EPT Page-Directory-Pointer Table
31-5
Table 31-3.
Format of an EPT Page-Directory-Pointer-Table Entry (PDPTE) that Maps a 1-GByte Page
31-6
Table 31-4.
Format of an EPT Page-Directory-Pointer-Table Entry (PDPTE) that References an EPT Page Directory
31-7
Table 31-5.
Format of an EPT Page-Directory Entry (PDE) that Maps a 2-MByte Page
31-8
Table 31-6.
Format of an EPT Page-Directory Entry (PDE) that References an EPT Page Table
31-9
Table 31-7.
Format of an EPT Page-Table Entry that Maps a 4-KByte Page
31-11
Table 32-1.
Format of Posted-Interrupt Descriptor (PID)
32-4
Table 32-2.
Format of Posted-Interrupt Descriptor (PID)
32-17
Table 33-1.
VM-Instruction Error Numbers
33-30
Table 34-1.
SMRAM State Save Map
34-5
Table 34-2.
Processor Signatures and 64-bit SMRAM State Save Map Format
34-7
Table 34-3.
SMRAM State Save Map for Intel 64 Architecture
34-7
Table 34-4.
Processor Register Initialization in SMM
34-10
Table 34-5.
I/O Instruction Information in the SMM State Save Map
34-12
Table 34-6.
I/O Instruction Type Encodings
34-13
Table 34-7.
Auto HALT Restart Flag Values
34-14
Table 34-8.
I/O Instruction Restart Field Values
34-16
Table 34-9.
Exit Qualification for SMIs That Arrive Immediately After the Retirement of an I/O Instruction
34-21
Table 34-10.
Format of MSEG Header
34-26
Table 36-1.
COFI Type for Branch Instructions
36-3
Table 36-2.
IP Filtering Packet Example
36-7
Table 36-3.
ToPA Table Entry Fields
36-12
Table 36-4.
Algorithm to Manage Intel PT ToPA PMI and XSAVES/XRSTORS
36-15
Table 36-5.
Behavior on Restricted Memory Access
36-16
Table 36-6.
IA32_RTIT_CTL MSR
36-17
Table 36-7.
IA32_RTIT_STATUS MSR
36-21
Table 36-8.
IA32_RTIT_OUTPUT_BASE MSR
36-23
Table 36-9.
IA32_RTIT_OUTPUT_MASK_PTRS MSR
36-24
Table 36-10.
TSX Packet Scenarios with BranchEn=1
36-25
Table 36-11.
CPUID.14H Enumeration of Intel Processor Trace Capabilities
36-27
Table 36-12.
CPUID.14H.01H Enumeration of Intel Processor Trace Capabilities
36-29
Table 36-13.
An Illustrative CYC Packet Example
36-34
Table 36-14.
Compound Packet Event Summary
36-37
Table 36-15.
Packets Forbidden Between BBP and BEP
36-37
Table 36-16.
TNT Packet Definition
36-39
Table 36-18.
FUP/TIP IP Reconstruction
36-41
Table 36-19.
TNT Examples with Deferred TIPs
36-42
Table 36-20.
TIP.PGE Packet Definition
36-43
Table 36-21.
TIP.PGD Packet Definition
36-43
Table 36-22.
FUP Packet Definition
36-44
Table 36-23.
FUP Cases and IP Payload
36-45
Table 36-24.
PIP Packet Definition
36-46
Table 36-25.
General Form of MODE Packets
36-47
Table 36-26.
MODE.Exec Packet Definition
36-47
Table 36-27.
MODE.TSX Packet Definition
36-48
Table 36-28.
TraceStop Packet Definition
36-49
Table 36-29.
CBR Packet Definition
36-49
Table 36-30.
TSC Packet Definition
36-50
Table 36-31.
MTC Packet Definition
36-50
Table 36-32.
TMA Packet Definition
36-51
Table 36-33.
Cycle Count Packet Definition
36-51
Table 36-34.
VMCS Packet Definition
36-52
Table 36-35.
OVF Packet Definition
36-53
Table 36-36.
PSB Packet Definition
36-54
Table 36-37.
PSBEND Packet Definition
36-55
Vol. 3A li
CONTENTS
PAGE
Table 36-38.
MNT Packet Definition
36-55
Table 36-39.
PAD Packet Definition
36-56
Table 36-40.
PTW Packet Definition
36-56
Table 36-41.
EXSTOP Packet Definition
36-57
Table 36-42.
MWAIT Packet Definition
36-57
Table 36-43.
PWRE Packet Definition
36-58
Table 36-44.
PWRX Packet Definition
36-59
Table 36-45.
Block Begin Packet Definition
36-60
Table 36-46.
Block Item Packet Definition
36-60
Table 36-47.
BIP Encodings
36-61
Table 36-48.
Block End Packet Definition
36-66
Table 36-49.
Control Flow Event Packet Definition
36-66
Table 36-50.
CFE Packet Type and Vector Fields Details
36-67
Table 36-51.
Event Data Packet Definition
36-67
Table 36-52.
VMX Controls For Intel Processor Trace
36-69
Table 36-53.
Packets on VMX Transitions (System-Wide Tracing)
36-70
Table 36-54.
Packets on a Failed VM Entry
36-71
Table 36-55.
Supported Trigger Inputs
36-72
Table 36-56.
Trigger Actions
36-73
Table 36-57.
ICNT on Multiple Trigger Events
36-74
Table 36-58.
TRIG Packet Definition
36-75
Table 36-59.
Packet Generation under Different Example Operations
36-77
Table 36-60.
Packet Generation with Operations That Alter the Value of PacketEn
36-78
Table 36-61.
Examples of PTWRITE when TriggerEn && PTWEn is True
36-78
Table 36-62.
Examples of Power Event Trace when TriggerEn && PwrEvtEn is True
36-79
Table 36-63.
Event Trace Examples when TriggerEn && ContextEn && EventEn is True
36-79
Table 37-1.
Supervisor and User Mode Enclave Instruction Leaf Functions in Long-Form of SGX1
37-3
Table 37-2.
Supervisor and User Mode Enclave Instruction Leaf Functions in Long-Form of SGX2
37-4
Table 37-3.
Intel® SGX Opt-in and Enabling Behavior
37-4
Table 38-1.
List of Implicit and Explicit Memory Access by Intel® SGX Enclave Instructions
38-3
Table 38-2.
Layout of SGX Enclave Control Structure (SECS)
38-5
Table 38-3.
Layout of ATTRIBUTES Structure
38-5
Table 38-4.
Bit Vector Layout of MISCSELECT Field of Extended Information
38-6
Table 38-5.
Bit Vector Layout of CET_ATTRIBUTES Field of Extended Information
38-6
Table 38-6.
Layout of Thread Control Structure (TCS)
38-7
Table 38-7.
Layout of TCS.FLAGS Field
38-7
Table 38-8.
Top-to-Bottom Layout of an SSA Frame
38-8
Table 38-9.
Layout of GPRSGX Portion of the State Save Area
38-8
Table 38-10.
Layout of EXITINFO Field
38-9
Table 38-11.
Exception Vectors
38-10
Table 38-12.
Layout of MISC region of the State Save Area
38-11
Table 38-13.
Layout of EXINFO Structure
38-11
Table 38-14.
Layout of CET State Save Area Frame
38-11
Table 38-15.
Layout of PAGEINFO Data Structure
38-12
Table 38-16.
Layout of SECINFO Data Structure
38-12
Table 38-17.
Layout of SECINFO.FLAGS Field
38-12
Table 38-18.
Supported PAGE_TYPE
38-13
Table 38-19.
Layout of PCMD Data Structure
38-13
Table 38-20.
Layout of Enclave Signature Structure (SIGSTRUCT)
38-14
Table 38-21.
Layout of EINIT Token (EINITTOKEN)
38-15
Table 38-22.
Layout of REPORT
38-15
Table 38-23.
Layout of TARGETINFO Data Structure
38-16
Table 38-24.
Layout of KEYREQUEST Data Structure
38-17
Table 38-25.
Supported KEYName Values
38-17
Table 38-26.
Layout of KEYPOLICY Field
38-17
Table 38-27.
Layout of Version Array Data Structure
38-18
Table 38-28.
Content of an Enclave Page Cache Map Entry
38-18
Table 39-1.
Illegal Instructions Inside an Enclave
39-14
Table 40-1.
GPR, x87 Synthetic States on Asynchronous Enclave Exit
40-3
Table 41-1.
Register Usage of Privileged Enclave Instruction Leaf Functions
41-1
Table 41-2.
Register Usage of Unprivileged Enclave Instruction Leaf Functions
41-2
Table 41-3.
Error or Information Codes for Intel® SGX Instructions
41-2
Table 41-4.
List of Internal CREG
41-3
Table 41-5.
Base Concurrency Restrictions
41-5
Table 41-6.
Additional Concurrency Restrictions
41-6
lii Vol. 3A
CONTENTS
PAGE
Table 41-7.
Base Concurrency Restrictions of EADD
41-13
Table 41-8.
Additional Concurrency Restrictions of EADD
41-14
Table 41-9.
Base Concurrency Restrictions of EAUG
41-18
Table 41-10.
Additional Concurrency Restrictions of EAUG
41-19
Table 41-11.
EBLOCK Return Value in RAX
41-22
Table 41-12.
Base Concurrency Restrictions of EBLOCK
41-22
Table 41-13.
Additional Concurrency Restrictions of EBLOCK
41-23
Table 41-14.
Base Concurrency Restrictions of ECREATE
41-25
Table 41-15.
Additional Concurrency Restrictions of ECREATE
41-26
Table 41-16.
EDBGRD Return Value in RAX
41-30
Table 41-17.
Base Concurrency Restrictions of EDBGRD
41-31
Table 41-18.
Additional Concurrency Restrictions of EDBGRD
41-31
Table 41-19.
EDBGWR Return Value in RAX
41-34
Table 41-20.
Base Concurrency Restrictions of EDBGWR
41-35
Table 41-21.
Additional Concurrency Restrictions of EDBGWR
41-35
Table 41-22.
Base Concurrency Restrictions of EEXTEND
41-38
Table 41-23.
Additional Concurrency Restrictions of EEXTEND
41-39
Table 41-24.
EINIT Return Value in RAX
41-42
Table 41-25.
Base Concurrency Restrictions of EINIT
41-43
Table 41-26.
Additional Concurrency Restrictions of ENIT
41-43
Table 41-27.
ELDB/ELDU Return Value in RAX
41-49
Table 41-28.
Base Concurrency Restrictions of ELDB/ELDU
41-49
Table 41-29.
Additional Concurrency Restrictions of ELDB/ELDU
41-50
Table 41-30.
EMODPR Return Value in RAX
41-54
Table 41-31.
Base Concurrency Restrictions of EMODPR
41-54
Table 41-32.
Additional Concurrency Restrictions of EMODPR
41-55
Table 41-33.
EMODT Return Value in RAX
41-57
Table 41-34.
Base Concurrency Restrictions of EMODT
41-57
Table 41-35.
Additional Concurrency Restrictions of EMODT
41-58
Table 41-36.
Base Concurrency Restrictions of EPA
41-60
Table 41-37.
Additional Concurrency Restrictions of EPA
41-60
Table 41-38.
EREMOVE Return Value in RAX
41-62
Table 41-39.
Base Concurrency Restrictions of EREMOVE
41-63
Table 41-40.
Additional Concurrency Restrictions of EREMOVE
41-63
Table 41-41.
ETRACK Return Value in RAX
41-65
Table 41-42.
Base Concurrency Restrictions of ETRACK
41-65
Table 41-43.
Additional Concurrency Restrictions of ETRACK
41-65
Table 41-44.
EUPDATESVN Return Value in RAX
41-67
Table 41-45.
Base Concurrency Restrictions of EUPDATESVN
41-67
Table 41-46.
Additional Concurrency Restrictions of EUPDATESVN
41-67
Table 41-47.
EWB Return Value in RAX
41-69
Table 41-48.
Base Concurrency Restrictions of EWB
41-69
Table 41-49.
Additional Concurrency Restrictions of EWB
41-69
Table 41-50.
EACCEPT Return Value in RAX
41-74
Table 41-51.
Base Concurrency Restrictions of EACCEPT
41-75
Table 41-52.
Additional Concurrency Restrictions of EACCEPT
41-75
Table 41-53.
EACCEPTCOPY Return Value in RAX
41-79
Table 41-54.
Base Concurrency Restrictions of EACCEPTCOPY
41-80
Table 41-55.
Additional Concurrency Restrictions of EACCEPTCOPY
41-80
Table 41-56.
Base Concurrency Restrictions of EDECCSSA
41-83
Table 41-57.
Additional Concurrency Restrictions of EDECCSSA
41-83
Table 41-58.
Base Concurrency Restrictions of EENTER
41-88
Table 41-59.
Additional Concurrency Restrictions of EENTER
41-88
Table 41-60.
Base Concurrency Restrictions of EEXIT
41-96
Table 41-61.
Additional Concurrency Restrictions of EEXIT
41-96
Table 41-62.
Key Derivation
41-100
Table 41-63.
EGETKEY Return Value in RAX
41-100
Table 41-64.
Base Concurrency Restrictions of EGETKEY
41-100
Table 41-65.
Additional Concurrency Restrictions of EGETKEY
41-101
Table 41-66.
Base Concurrency Restrictions of EMODPE
41-109
Table 41-67.
Additional Concurrency Restrictions of EMODPE
41-109
Table 41-68.
Base Concurrency Restrictions of EREPORT
41-113
Table 41-69.
Additional Concurrency Restrictions of EREPORT
41-113
Table 41-70.
Base Concurrency Restrictions of ERESUME
41-118
Table 41-71.
Additional Concurrency Restrictions of ERESUME
41-118
Vol. 3A liii
CONTENTS
PAGE
Table 42-1.
SMRAM Synthetic States on Asynchronous Enclave Exit
42-9
Table 42-2.
Layout of the IA32_SGX_SVN_STATUS MSR
42-11
Table A-1.
Memory Types Recommended for VMCS and Related Data Structures
A-1
Table B-1.
Encoding for 16-Bit Control Fields (0000_00xx_xxxx_xxx0B)
B-1
Table B-2.
Encodings for 16-Bit Guest-State Fields (0000_10xx_xxxx_xxx0B)
B-1
Table B-3.
Encodings for 16-Bit Host-State Fields (0000_11xx_xxxx_xxx0B)
B-2
Table B-4.
Encodings for 64-Bit Control Fields (0010_00xx_xxxx_xxxAb)
B-2
Table B-5.
Encodings for 64-Bit Read-Only Data Fields (0010_01xx_xxxx_xxxAb)
B-5
Table B-6.
Encodings for 64-Bit Guest-State Fields (0010_10xx_xxxx_xxxAb)
B-6
Table B-7.
Encodings for 64-Bit Host-State Fields (0010_11xx_xxxx_xxxAb)
B-7
Table B-8.
Encodings for 32-Bit Control Fields (0100_00xx_xxxx_xxx0B)
B-8
Table B-9.
Encodings for 32-Bit Read-Only Data Fields (0100_01xx_xxxx_xxx0B)
B-9
Table B-10.
Encodings for 32-Bit Guest-State Fields (0100_10xx_xxxx_xxx0B)
B-10
Table B-11.
Encoding for 32-Bit Host-State Field (0100_11xx_xxxx_xxx0B)
B-11
Table B-12.
Encodings for Natural-Width Control Fields (0110_00xx_xxxx_xxx0B)
B-11
Table B-13.
Encodings for Natural-Width Read-Only Data Fields (0110_01xx_xxxx_xxx0B)
B-11
Table B-14.
Encodings for Natural-Width Guest-State Fields (0110_10xx_xxxx_xxx0B)
B-12
Table B-15.
Encodings for Natural-Width Host-State Fields (0110_11xx_xxxx_xxx0B)
B-13
Table C-1.
Basic Exit Reasons
C-1
liv Vol. 3A
CHAPTER 1
ABOUT THIS MANUAL
The Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A: System Programming Guide, Part
1 (order number 253668), the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3B:
System Programming Guide, Part 2 (order number 253669), the Intel® 64 and IA-32 Architectures Software Devel-
oper’s Manual, Volume 3C: System Programming Guide, Part 3 (order number 326019), and the Intel® 64 and
IA-32 Architectures Software Developer’s Manual, Volume 3D:System Programming Guide, Part 4 (order number
332831) are part of a set that describes the architecture and programming environment of Intel 64 and IA-32
Architecture processors. The other volumes in this set are:
• Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1: Basic Architecture (order number
253665).
• Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volumes 2A, 2B, 2C, & 2D: Instruction Set
Reference (order numbers 253666, 253667, 326018, and 334569).
• The Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 4: Model-Specific Registers
(order number 335592).
The Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1, describes the basic architecture
and programming environment of Intel 64 and IA-32 processors. The Intel® 64 and IA-32 Architectures Software
Developer’s Manual, Volumes 2A, 2B, 2C, & 2D, describe the instruction set of the processor and the opcode struc-
ture. These volumes apply to application programmers and to programmers who write operating systems or exec-
utives. The Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volumes 3A, 3B, 3C, & 3D, describe
the operating-system support environment of Intel 64 and IA-32 processors. These volumes target operating-
system and BIOS designers. In addition, Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume
3B, and Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3C, address the programming
environment for classes of software that host operating systems. The Intel® 64 and IA-32 Architectures Software
Developer’s Manual, Volume 4, describes the model-specific registers of Intel 64 and IA-32 processors.
1.1
OVERVIEW OF THE SYSTEM PROGRAMMING GUIDE
A description of this manual’s content follows:
Chapter 1 - About This Manual. Gives an overview of all volumes of the Intel® 64 and IA-32 Architectures Soft-
ware Developer’s Manual, with chapter-specific details for the current volume.
Chapter 2 - System Architecture Overview. Describes the modes of operation used by Intel 64 and IA-32
processors and the mechanisms provided by the architectures to support operating systems and executives,
including the system-oriented registers and data structures and the system-oriented instructions. The steps neces-
sary for switching between real-address and protected modes are also identified.
Chapter 3 - Protected-Mode Memory Management. Describes the data structures, registers, and instructions
that support segmentation and paging. The chapter explains how they can be used to implement a “flat” (unseg-
mented) memory model or a segmented memory model.
Chapter 4 - Linear-Address Pre-Processing. Describes the processes to which linear addresses are subject
prior to translation changing. These include fault checking for linear-address-space separation (LASS) and canoni-
cality, as well as linear-address masking (LAM).
Chapter 5 - Paging. Describes the paging modes supported by Intel 64 and IA-32 processors.
Chapter 6 - Protection. Describes the support for page and segment protection provided in the Intel 64 and IA-
32 architectures. This chapter also explains the implementation of privilege rules, stack switching, pointer valida-
tion, user mode, and supervisor mode.
Chapter 7 - Interrupt and Exception Handling. Describes the basic interrupt mechanisms defined in the Intel
64 and IA-32 architectures, shows how interrupts and exceptions relate to protection, and describes how the archi-
tecture handles each exception type. Reference information for each exception is given in this chapter. Includes
Vol. 3A
1-1
ABOUT THIS MANUAL
programming the LINT0 and LINT1 inputs and gives an example of how to program the LINT0 and LINT1 pins for
specific interrupt vectors.
Chapter 8 - Flexible Return and Event Delivery (FRED). Describes the architecture of flexible return and
event delivery (FRED).
Chapter 9 - User Interrupts. Describes user interrupts supported by Intel 64 and IA-32 processors.
Chapter 10 - Task Management. Describes mechanisms the Intel 64 and IA-32 architectures provide to support
multitasking and inter-task protection.
Chapter 11 - Multiple-Processor Management. Describes the instructions and flags that support multiple
processors with shared memory, memory ordering, and Intel® Hyper-Threading Technology. Includes MP initializa-
tion for P6 family processors and gives an example of how to use the MP protocol to boot P6 family processors in an
MP system.
Chapter 12 - Processor Management and Initialization. Defines the state of an Intel 64 or IA-32 processor
after reset initialization. This chapter also explains how to set up an Intel 64 or IA-32 processor for real-address
mode operation and protected- mode operation, and how to switch between modes.
Chapter 13 - Advanced Programmable Interrupt Controller (APIC). Describes the programming interface
to the local APIC and gives an overview of the interface between the local APIC and the I/O APIC. Includes APIC bus
message formats and describes the message formats for messages transmitted on the APIC bus for P6 family and
Pentium processors.
Chapter 14 - Memory Cache Control. Describes the general concept of caching and the caching mechanisms
supported by the Intel 64 or IA-32 architectures. This chapter also describes the memory type range registers
(MTRRs) and how they can be used to map memory types of physical memory. Information on using the new cache
control and memory streaming instructions introduced with the Pentium III, Pentium 4, and Intel Xeon processors is
also given.
Chapter 15 - Intel® MMX™ Technology System Programming. Describes those aspects of the Intel® MMX™
technology that must be handled and considered at the system programming level, including: task switching,
exception handling, and compatibility with existing system environments.
Chapter 16 - System Programming for Instruction Set Extensions and Processor Extended States.
Describes the operating system requirements to support SSE/SSE2/SSE3/SSSE3/SSE4 extensions, including task
switching, exception handling, and compatibility with existing system environments. The latter part of this chapter
describes the extensible framework of operating system requirements to support processor extended states.
Processor extended state may be required by instruction set extensions beyond those of
SSE/SSE2/SSE3/SSSE3/SSE4 extensions.
Chapter 17 - Power and Thermal Management. Describes facilities of Intel 64 and IA-32 architecture used for
power management and thermal monitoring.
Chapter 18 - Machine-Check Architecture. Describes the machine-check architecture and machine-check
exception mechanism found in the Pentium 4, Intel Xeon, and P6 family processors. Additionally, a signaling mech-
anism for software to respond to hardware corrected machine check error is covered.
Chapter 19 - Interpreting Machine Check Error Codes. Gives an example of how to interpret the error codes
for a machine-check error that occurred on a P6 family processor.
Chapter 20 - Debug, Branch Profile, TSC, and Intel® Resource Director Technology (Intel® RDT)
Features. Describes the debugging registers and other debug mechanism provided in Intel 64 or IA-32 proces-
sors. This chapter also describes the time-stamp counter and resource director technology.
Chapter 21 - Last Branch Records. Describes the Last Branch Records (architectural feature).
Chapter 22 - Performance Monitoring. Describes the Intel 64 and IA-32 architectures’ facilities for monitoring
performance.
Chapter 23 - 8086 Emulation. Describes the real-address and virtual-8086 modes of the IA-32 architecture.
Chapter 24 - Mixing 16-Bit and 32-Bit Code. Describes how to mix 16-bit and 32-bit code modules within the
same program or task.
Chapter 25 - Architecture Compatibility. Describes architectural compatibility among IA-32 processors.
1-2
Vol. 3A
ABOUT THIS MANUAL
Chapter 26 - Introduction to Virtual Machine Extensions. Describes the basic elements of virtual machine
architecture and the virtual machine extensions for Intel 64 and IA-32 Architectures.
Chapter 27 - Virtual Machine Control Structures. Describes components that manage VMX operation. These
include the working-VMCS pointer and the controlling-VMCS pointer.
Chapter 28 - VMX Non-Root Operation. Describes the operation of a VMX non-root operation. Processor oper-
ation in VMX non-root mode can be restricted programmatically such that certain operations, events or conditions
can cause the processor to transfer control from the guest (running in VMX non-root mode) to the monitor software
(running in VMX root mode).
Chapter 29 - VM Entries. Describes VM entries. VM entry transitions the processor from the VMM running in VMX
root-mode to a VM running in VMX non-root mode. VM-Entry is performed by the execution of VMLAUNCH or
VMRESUME instructions.
Chapter 30 - VM Exits. Describes VM exits. Certain events, operations or situations while the processor is in VMX
non-root operation may cause VM-exit transitions. In addition, VM exits can also occur on failed VM entries.
Chapter 31 - VMX Support for Address Translation. Describes virtual-machine extensions that support
address translation and the virtualization of physical memory.
Chapter 32 - APIC Virtualization and Virtual Interrupts. Describes the VMCS including controls that enable
the virtualization of interrupts and the Advanced Programmable Interrupt Controller (APIC).
Chapter 33 - VMX Instruction Reference. Describes the virtual-machine extensions (VMX). VMX is intended for
a system executive to support virtualization of processor hardware and a system software layer acting as a host to
multiple guest software environments.
Chapter 34 - System Management Mode. Describes Intel 64 and IA-32 architectures’ system management
mode (SMM) facilities.
Chapter 35 - Secure Arbitration Mode (SEAM). Describes secure arbitration mode (SEAM), an extension of the
virtual machines extensions architecture (VMX) that allows running secure virtual machines.
Chapter 36 - Intel® Processor Trace. Describes details of Intel® Processor Trace.
Chapter 37 - Introduction to Intel® Software Guard Extensions. Provides an overview of the Intel® Soft-
ware Guard Extensions (Intel® SGX) set of instructions.
Chapter 38 - Enclave Access Control and Data Structures. Describes Enclave Access Control procedures and
defines various Intel SGX data structures.
Chapter 39 - Enclave Operation. Describes enclave creation and initialization, adding pages and measuring an
enclave, and enclave entry and exit.
Chapter 40 - Enclave Exiting Events. Describes enclave-exiting events (EEE) and asynchronous enclave exit
(AEX).
Chapter 41 - Intel® SGX Instruction References. Describes the supervisor and user level instructions
provided by Intel SGX.
Chapter 42 - Intel® SGX Interactions with IA32 and Intel® 64 Architecture. Describes the Intel SGX
collection of enclave instructions for creating protected execution environments on processors supporting IA32 and
Intel 64 architectures.
Chapter 43 - Enclave Code Debug and Profiling. Describes enclave code debug processes and options.
Chapter A - VMX Capability Reporting Facility. Describes the VMX capability MSRs. Support for specific VMX
features is determined by reading capability MSRs.
Chapter B - Field Encoding in VMCS. Enumerates all fields in the VMCS and their encodings. Fields are grouped
by width (16-bit, 32-bit, etc.) and type (guest-state, host-state, etc.).
Chapter C - VMX Basic Exit Reasons. Describes the 32-bit fields that encode reasons for a VM exit. Examples of
exit reasons include, but are not limited to: software interrupts, processor exceptions, software traps, NMIs,
external interrupts, and triple faults.
Vol. 3A
1-3
ABOUT THIS MANUAL
1-4
Vol. 3A
CHAPTER 2
SYSTEM ARCHITECTURE OVERVIEW
IA-32 architecture (beginning with the Intel386 processor family) provides extensive support for operating-system
and system-development software. This support offers multiple modes of operation, which include:
• Real mode, protected mode, virtual 8086 mode, and system management mode. These are sometimes
referred to as legacy modes.
Intel 64 architecture supports almost all the system programming facilities available in IA-32 architecture and
extends them to a new operating mode (IA-32e mode) that supports a 64-bit programming environment. IA-32e
mode allows software to operate in one of two sub-modes:
•
64-bit mode supports 64-bit OS and 64-bit applications
• Compatibility mode allows most legacy software to run; it co-exists with 64-bit applications under a 64-bit OS.
The IA-32 system-level architecture includes features to assist in the following operations:
• Memory management.
• Protection of software modules.
• Multitasking.
• Exception and interrupt handling.
• Multiprocessing.
• Cache management.
• Hardware resource and power management.
• Debugging and performance monitoring.
This chapter provides a description of each part of this architecture. It also describes the system registers that are
used to set up and control the processor at the system level and gives a brief overview of the processor’s system-
level (operating system) instructions.
Many features of the system-level architecture are used only by system programmers. However, application
programmers may need to read this chapter and the following chapters in order to create a reliable and secure
environment for application programs.
This overview and most subsequent chapters of this book focus on protected-mode operation of the IA-32 architec-
ture. IA-32e mode operation of the Intel 64 architecture, as it differs from protected mode operation, is also
described.
All Intel 64 and IA-32 processors enter real-address mode following a power-up or reset (see Chapter 12,
“Processor Management and Initialization”). Software then initiates the switch from real-address mode to
protected mode. If IA-32e mode operation is desired, software also initiates a switch from protected mode to IA-
32e mode.
2.1
OVERVIEW OF THE SYSTEM-LEVEL ARCHITECTURE
System-level architecture consists of a set of registers, data structures, and instructions designed to support basic
system-level operations such as memory management, interrupt and exception handling, task management, and
control of multiple processors.
Figure 2-1 provides a summary of system registers and data structures that applies to 32-bit modes. System regis-
ters and data structures that apply to IA-32e mode are shown in Figure 2-2.
Vol. 3A
2-1
SYSTEM ARCHITECTURE OVERVIEW
EFLAGS Register
Physical Address
Code, Data or
Stack Segment
Linear Address
Control Registers
Task-State
CR4
Segment Selector
Segment (TSS)
Task
CR3
Code
CR2
Register
Data
CR1
CR0
Stack
Global Descriptor
Task Register
Table (GDT)
Interrupt Handler
Segment Sel.
Seg. Desc.
Code
Current
TSS Seg. Sel.
TSS Desc.
Stack
Interrupt
TSS
Vector
Seg. Desc.
Interrupt Descriptor
Task-State
Table (IDT)
Segment (TSS)
TSS Desc.
Task
Code
Interrupt Gate
LDT Desc.
Data
Stack
Task Gate
GDTR
Trap Gate
Local Descriptor
Exception Handler
Table (LDT)
Code
Current
Stack
Call-Gate
TSS
IDTR
Seg. Desc.
Segment Selector
Call Gate
Protected Procedure
Code
XCR0
Current
LDTR
TSS
Stack
Linear Address Space
Linear Address
Dir
Table
Offset
Linear Addr.
Page Directory
Page Table
Page
Physical Addr.
Pg. Dir. Entry
Pg. Tbl. Entry
0
This page mapping example is for 4-KByte pages
CR3*
and 32-bit paging.
*Physical Address
Figure 2-1. IA-32 System-Level Registers and Data Structures
2-2
Vol. 3A
SYSTEM ARCHITECTURE OVERVIEW
RFLAGS
Physical Address
Code, Data or Stack
Control Register
Segment (Base =0)
Linear Address
CR8
Task-State
CR4
Segment Selector
Segment (TSS)
CR3
CR2
Register
CR1
CR0
Global Descriptor
Task Register
Table (GDT)
Interrupt Handler
Segment Sel.
Seg. Desc.
Code
NULL
Interrupt
TR
TSS Desc.
Stack
Vector
Seg. Desc.
Interrupt Descriptor
Table (IDT)
Interr. Handler
Seg. Desc.
Code
Interrupt Gate
LDT Desc.
Current TSS
Stack
Interrupt Gate
GDTR
IST
Trap Gate
Local Descriptor
Exception Handler
Table (LDT)
Code
NULL
Stack
IDTR
Call-Gate
Seg. Desc.
Segment Selector
Call Gate
Protected Procedure
XCR0
Code
LDTR
NULL
Stack
PKRU
Linear Address Space
Linear Address
PML4
Dir. Pointer
Directory
T
able
Offset
Linear Addr.
PML4
Pg. Dir
. Ptr.
Page Dir.
Page Table
Page
Physical
PML4.
Pg. Dir.
Page Tbl
Addr.
Entry
Entry
Entry
0
This page mapping example is for 4-KByte pages
CR3*
and 4-level paging.
*Physical Address
Figure 2-2. System-Level Registers and Data Structures in IA-32e Mode and 4-Level Paging
2.1.1
Global and Local Descriptor Tables
When operating in protected mode, all memory accesses pass through either the global descriptor table (GDT) or
an optional local descriptor table (LDT) as shown in Figure 2-1. These tables contain entries called segment
descriptors. Segment descriptors provide the base address of segments well as access rights, type, and usage
information.
Vol. 3A
2-3
SYSTEM ARCHITECTURE OVERVIEW
Each segment descriptor has an associated segment selector. A segment selector provides the software that uses
it with an index into the GDT or LDT (the offset of its associated segment descriptor), a global/local flag (deter-
mines whether the selector points to the GDT or the LDT), and access rights information.
To access a byte in a segment, a segment selector and an offset must be supplied. The segment selector provides
access to the segment descriptor for the segment (in the GDT or LDT). From the segment descriptor, the processor
obtains the base address of the segment in the linear address space. The offset then provides the location of the
byte relative to the base address. This mechanism can be used to access any valid code, data, or stack segment,
provided the segment is accessible from the current privilege level (CPL) at which the processor is operating. The
CPL is defined as the protection level of the currently executing code segment.
See Figure 2-1. The solid arrows in the figure indicate a linear address, dashed lines indicate a segment selector,
and the dotted arrows indicate a physical address. For simplicity, many of the segment selectors are shown as
direct pointers to a segment. However, the actual path from a segment selector to its associated segment is always
through a GDT or LDT.
The linear address of the base of the GDT is contained in the GDT register (GDTR); the linear address of the LDT is
contained in the LDT register (LDTR).
2.1.1.1
Global and Local Descriptor Tables in IA-32e Mode
GDTR and LDTR registers are expanded to 64-bits wide in both IA-32e sub-modes (64-bit mode and compatibility
mode). For more information: see Section 3.5.2, “Segment Descriptor Tables in IA-32e Mode.”
Global and local descriptor tables are expanded in 64-bit mode to support 64-bit base addresses, (16-byte LDT
descriptors hold a 64-bit base address and various attributes). In compatibility mode, descriptors are not
expanded.
2.1.2
System Segments, Segment Descriptors, and Gates
Besides code, data, and stack segments that make up the execution environment of a program or procedure, the
architecture defines two system segments: the task-state segment (TSS) and the LDT. The GDT is not considered
a segment because it is not accessed by means of a segment selector and segment descriptor. TSSs and LDTs have
segment descriptors defined for them.
The architecture also defines a set of special descriptors called gates (call gates, interrupt gates, trap gates, and
task gates). These provide protected gateways to system procedures and handlers that may operate at a different
privilege level than application programs and most procedures. For example, a CALL to a call gate can provide
access to a procedure in a code segment that is at the same or a numerically lower privilege level (more privileged)
than the current code segment. To access a procedure through a call gate, the calling procedure1 supplies the
selector for the call gate. The processor then performs an access rights check on the call gate, comparing the CPL
with the privilege level of the call gate and the destination code segment pointed to by the call gate.
If access to the destination code segment is allowed, the processor gets the segment selector for the destination
code segment and an offset into that code segment from the call gate. If the call requires a change in privilege
level, the processor also switches to the stack for the targeted privilege level. The segment selector for the new
stack is obtained from the TSS for the currently running task. Gates also facilitate transitions between 16-bit and
32-bit code segments, and vice versa.
2.1.2.1
Gates in IA-32e Mode
In IA-32e mode, the following descriptors are 16-byte descriptors (expanded to allow a 64-bit base): LDT descrip-
tors, 64-bit TSSs, call gates, interrupt gates, and trap gates.
Call gates facilitate transitions between 64-bit mode and compatibility mode. Task gates are not supported in IA-
32e mode. On privilege level changes, stack segment selectors are not read from the TSS. Instead, they are set to
NULL.
1. The word “procedure” is commonly used in this document as a general term for a logical unit or block of code (such as a program, pro-
cedure, function, or routine).
2-4
Vol. 3A
SYSTEM ARCHITECTURE OVERVIEW
2.1.3
Task-State Segments and Task Gates
The TSS (see Figure 2-1) defines the state of the execution environment for a task. It includes the state of general-
purpose registers, segment registers, the EFLAGS register, the EIP register, and segment selectors with stack
pointers for three stack segments (one stack for each privilege level). The TSS also includes the segment selector
for the LDT associated with the task and the base address of the paging-structure hierarchy.
All program execution in protected mode happens within the context of a task (called the current task). The
segment selector for the TSS for the current task is stored in the task register. The simplest method for switching
to a task is to make a call or jump to the new task. Here, the segment selector for the TSS of the new task is given
in the CALL or JMP instruction. In switching tasks, the processor performs the following actions:
1. Stores the state of the current task in the current TSS.
2. Loads the task register with the segment selector for the new task.
3. Accesses the new TSS through a segment descriptor in the GDT.
4. Loads the state of the new task from the new TSS into the general-purpose registers, the segment registers,
the LDTR, control register CR3 (base address of the paging-structure hierarchy), the EFLAGS register, and the
EIP register.
5. Begins execution of the new task.
A task can also be accessed through a task gate. A task gate is similar to a call gate, except that it provides access
(through a segment selector) to a TSS rather than a code segment.
2.1.3.1
Task-State Segments in IA-32e Mode
Hardware task switches are not supported in IA-32e mode. However, TSSs continue to exist. The base address of
a TSS is specified by its descriptor.
A 64-bit TSS holds the following information that is important to 64-bit operation:
• Stack pointer addresses for each privilege level.
• Pointer addresses for the interrupt stack table.
• Offset address of the IO-permission bitmap (from the TSS base).
The task register is expanded to hold 64-bit base addresses in IA-32e mode. See also: Section 10.7, “Task Manage-
ment in 64-bit Mode.”
2.1.4
Interrupt and Exception Handling
NOTE
This section focuses on event handling based on IDT event delivery and on return using the IRET
instruction. FRED transitions are alternatives to these mechanisms. In general, the material in this
section does not apply when FRED transitions are enabled. See Chapter 8, “Flexible Return and
Event Delivery (FRED),” for more information about FRED transitions.
External interrupts, software interrupts and exceptions are handled through the interrupt descriptor table (IDT).
The IDT stores a collection of gate descriptors that provide access to interrupt and exception handlers. Like the
GDT, the IDT is not a segment. The linear address for the base of the IDT is contained in the IDT register (IDTR).
Gate descriptors in the IDT can be interrupt, trap, or task gate descriptors. To access an interrupt or exception
handler, the processor first receives an interrupt vector from internal hardware, an external interrupt controller, or
from software by means of an INT n, INTO, INT3, INT1, or BOUND instruction. The interrupt vector provides an
index into the IDT. If the selected gate descriptor is an interrupt gate or a trap gate, the associated handler proce-
dure is accessed in a manner similar to calling a procedure through a call gate. If the descriptor is a task gate, the
handler is accessed through a task switch.
Vol. 3A
2-5
SYSTEM ARCHITECTURE OVERVIEW
2.1.4.1
Interrupt and Exception Handling IA-32e Mode
In IA-32e mode, interrupt gate descriptors are expanded to 16 bytes to support 64-bit base addresses. This is true
for 64-bit mode and compatibility mode.
The IDTR register is expanded to hold a 64-bit base address. Task gates are not supported.
2.1.5
Memory Management
System architecture supports either direct physical addressing of memory or virtual memory (through paging).
When physical addressing is used, a linear address is treated as a physical address. When paging is used: all code,
data, stack, and system segments (including the GDT and IDT) can be paged with only the most recently accessed
pages being held in physical memory.
The location of pages (sometimes called page frames) in physical memory is contained in the paging structures.
These structures reside in physical memory (see Figure 2-1 for the case of 32-bit paging).
The base physical address of the paging-structure hierarchy is contained in control register CR3. The entries in the
paging structures determine the physical address of the base of a page frame, access rights and memory manage-
ment information.
To use this paging mechanism, a linear address is broken into parts. The parts provide separate offsets into the
paging structures and the page frame. A system can have a single hierarchy of paging structures or several. For
example, each task can have its own hierarchy.
2.1.5.1
Memory Management in IA-32e Mode
In IA-32e mode, physical memory pages are managed by a set of system data structures. In both compatibility
mode and 64-bit mode, four or five levels of system data structures are used (see Chapter 5, “Paging”). These
include the following:
• The page map level 5 (PML5) - An entry in the PML5 table contains the physical address of the base of a
PML4 table, access rights, and memory management information. The base physical address of the PML5 table
is stored in CR3. The PML5 table is used only with 5-level paging.
• A page map level 4 (PML4) - An entry in a PML4 table contains the physical address of the base of a page
directory pointer table, access rights, and memory management information. With 4-level paging, there is only
one PML4 table and its base physical address is stored in CR3.
• A set of page directory pointer tables - An entry in a page directory pointer table contains the physical
address of the base of a page directory table, access rights, and memory management information.
• Sets of page directories - An entry in a page directory table contains the physical address of the base of a
page table, access rights, and memory management information.
• Sets of page tables - An entry in a page table contains the physical address of a page frame, access rights,
and memory management information.
2.1.6
System Registers
To assist in initializing the processor and controlling system operations, the system architecture provides system
flags in the EFLAGS register and several system registers:
• The system flags and IOPL field in the EFLAGS register control task and mode switching, interrupt handling,
instruction tracing, and access rights. See also: Section 2.3, “System Flags and Fields in the EFLAGS Register.”
• The control registers (CR0, CR2, CR3, and CR4) contain a variety of flags and data fields for controlling system-
level operations. Other flags in these registers are used to indicate support for specific processor capabilities
within the operating system or executive. See also: Chapter 2, “Control Registers,” and Section 2.6, “Extended
Control Registers (Including XCR0).”
• The debug registers (not shown in Figure 2-1) allow the setting of breakpoints for use in debugging programs
and systems software. See also: Chapter 20, “Debug, Branch Profile, TSC, and Intel® Resource Director
Technology (Intel® RDT) Features.”
2-6
Vol. 3A
SYSTEM ARCHITECTURE OVERVIEW
• The GDTR, LDTR, and IDTR registers contain the linear addresses and sizes (limits) of their respective tables.
See also: Section 2.4, “Memory-Management Registers.”
• The task register contains the linear address and size of the TSS for the current task. See also: Section 2.4,
“Memory-Management Registers.”
• Model-specific registers (not shown in Figure 2-1).
The model-specific registers (MSRs) are a group of registers available primarily to operating-system or executive
procedures (that is, code running at privilege level 0). These registers control items such as the debug extensions,
the performance-monitoring counters, the machine- check architecture, and the memory type ranges (MTRRs).
The number and function of these registers varies among different members of the Intel 64 and IA-32 processor
families. See also: Section 12.4, “Model-Specific Registers (MSRs),” and Chapter 2, “Model-Specific Registers
(MSRs),” in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 4.
Most systems restrict access to system registers (other than the EFLAGS register) by application programs.
Systems can be designed, however, where all programs and procedures run at the most privileged level (privilege
level 0). In such a case, application programs would be allowed to modify the system registers.
2.1.6.1
System Registers in IA-32e Mode
In IA-32e mode, the four system-descriptor-table registers (GDTR, IDTR, LDTR, and TR) are expanded in hardware
to hold 64-bit base addresses. EFLAGS becomes the 64-bit RFLAGS register. CR0-CR4 are expanded to 64 bits.
CR8 becomes available. CR8 provides read-write access to the task priority register (TPR) so that the operating
system can control the priority classes of external interrupts.
In 64-bit mode, debug registers DR0-DR7 are 64 bits. In compatibility mode, address-matching in DR0-DR3 is
also done at 64-bit granularity.
On systems that support IA-32e mode, the extended feature enable register (IA32_EFER) is available. This model-
specific register controls activation of IA-32e mode and other IA-32e mode operations. In addition, there are
several model-specific registers that govern IA-32e mode instructions:
• IA32_KERNEL_GS_BASE - Used by SWAPGS instruction.
• IA32_LSTAR - Used by SYSCALL instruction.
• IA32_FMASK - Used by SYSCALL instruction.
• IA32_STAR - Used by SYSCALL and SYSRET instruction.
Another set of MSRs control FRED transitions when they are enabled. These are described in Section 8.2.
2.1.7
Other System Resources
Besides the system registers and data structures described in the previous sections, system architecture provides
the following additional resources:
• Operating system instructions (see also: Section 2.8, “System Instruction Summary”).
• Performance-monitoring counters (not shown in Figure 2-1).
• Internal caches and buffers (not shown in Figure 2-1).
Performance-monitoring counters are event counters that can be programmed to count processor events such as
the number of instructions decoded, the number of interrupts received, or the number of cache loads.
The processor provides several internal caches and buffers. The caches are used to store both data and instruc-
tions. The buffers are used to store things like decoded addresses to system and application segments and write
operations waiting to be performed. See also: Chapter 14, “Memory Cache Control.”
2.2
MODES OF OPERATION
The IA-32 architecture supports three operating modes and one quasi-operating mode:
Vol. 3A
2-7
SYSTEM ARCHITECTURE OVERVIEW
• Protected mode - This is the native operating mode of the processor. It provides a rich set of architectural
features, flexibility, high performance and backward compatibility to existing software base.
• Real-address mode - This operating mode provides the programming environment of the Intel 8086
processor, with a few extensions (such as the ability to switch to protected or system management mode).
• System management mode (SMM) - SMM is a standard architectural feature in all IA-32 processors,
beginning with the Intel386 SL processor. This mode provides an operating system or executive with a
transparent mechanism for implementing power management and OEM differentiation features. SMM is
entered through activation of an external system interrupt pin (SMI#), which generates a system management
interrupt (SMI). In SMM, the processor switches to a separate address space while saving the context of the
currently running program or task. SMM-specific code may then be executed transparently. Upon returning
from SMM, the processor is placed back into its state prior to the SMI.
• Virtual-8086 mode - In protected mode, the processor supports a quasi-operating mode known as virtual-
8086 mode. This mode allows the processor execute 8086 software in a protected, multitasking environment.
Intel 64 architecture supports all operating modes of IA-32 architecture and IA-32e modes:
• IA-32e mode - In IA-32e mode, the processor supports two sub-modes: compatibility mode and 64-bit
mode. 64-bit mode provides 64-bit linear addressing and support for physical address space larger than 64
GBytes. Compatibility mode allows most legacy protected-mode applications to run unchanged.
Figure 2-3 shows how the processor moves between operating modes.
SMI#
Real-Address
Mode
Reset
or
Reset or
RSM
PE=1
PE=0
SMI#
Reset
Protected Mode
RSM
System
Management
LME=1, CR0.PG=1*
SMI#
Mode
See**
IA-32e
RSM
Mode
VM=0
VM=1
* See Section 12.8.5
SMI#
** See Section 12.8.5.4
Virtual-8086
Mode
RSM
Figure 2-3. Transitions Among the Processor’s Operating Modes
The processor is placed in real-address mode following power-up or a reset. The PE flag in control register CR0 then
controls whether the processor is operating in real-address or protected mode. See also: Section 12.9, “Mode
Switching,” and Section 5.1.2, “Paging-Mode Enabling.”
The VM flag in the EFLAGS register determines whether the processor is operating in protected mode or virtual-
8086 mode. Transitions between protected mode and virtual-8086 mode are generally carried out as part of a task
switch or a return from an interrupt or exception handler. See also: Section 23.2.5, “Entering Virtual-8086 Mode.”
The LMA bit (IA32_EFER.LMA[10]) determines whether the processor is operating in IA-32e mode. When running
in IA-32e mode, 64-bit or compatibility sub-mode operation is determined by CS.L bit of the code segment. The
processor enters into IA-32e mode from protected mode by enabling paging and setting the LME bit
(IA32_EFER.LME[8]). See also: Chapter 12, “Processor Management and Initialization.”
2-8
Vol. 3A
SYSTEM ARCHITECTURE OVERVIEW
The processor switches to SMM whenever it receives an SMI while the processor is in real-address, protected,
virtual-8086, or IA-32e modes. Upon execution of the RSM instruction, the processor always returns to the mode
it was in when the SMI occurred.
2.2.1
Extended Feature Enable Register
The IA32_EFER MSR provides several fields related to IA-32e mode enabling and operation. It also provides one
field that relates to page-access right modification (see Section 5.6, “Access Rights”). The layout of the IA32_EFER
MSR is shown in Figure 2-4.
63
12 11 10 9
8
7
1
0
IA32_EFER
Execute Disable Bit Enable
IA-32e Mode Active
IA-32e Mode Enable
SYSCALL Enable
Reserved
Figure 2-4. IA32_EFER MSR Layout
Table 2-1. IA32_EFER MSR Information
Bit
Description
0
SYSCALL Enable: IA32_EFER.SCE (R/W)
Enables SYSCALL/SYSRET instructions in 64-bit mode.
7:1
Reserved.
8
IA-32e Mode Enable: IA32_EFER.LME (R/W)
Enables IA-32e mode operation.
9
Reserved.
10
IA-32e Mode Active: IA32_EFER.LMA (R)
Indicates IA-32e mode is active when set.
11
Execute Disable Bit Enable: IA32_EFER.NXE (R/W)
Enables page access restriction by preventing instruction fetches from PAE pages with the XD bit set (See Section 5.6).
63:12
Reserved.
2.3
SYSTEM FLAGS AND FIELDS IN THE EFLAGS REGISTER
The system flags and IOPL field of the EFLAGS register control I/O, maskable hardware interrupts, debugging, task
switching, and the virtual-8086 mode (see Figure 2-5). Only privileged code (typically operating system or execu-
tive code) should be allowed to modify these bits.
Vol. 3A
2-9
SYSTEM ARCHITECTURE OVERVIEW
The system flags and IOPL are:
TF
Trap (bit 8) - Set to enable single-step mode for debugging; clear to disable single-step mode. In single-
step mode, the processor generates a debug exception after each instruction. This allows the execution
state of a program to be inspected after each instruction. If an application program sets the TF flag using a
POPF, POPFD, or IRET instruction, a debug exception is generated after the instruction that follows the
POPF, POPFD, or IRET.
31
22 21 20 19 18 17 16
15 14 13 12 11 10 9
8
7
6
5
4
3
2
1
0
I
V
V
I
A
V
R
N
O
O
D
I
T
S
Z
A
P
C
Reserved (set to 0)
I
I
0
0
0
1
D
C
M
F
T
P
F
F
F
F
F
F
F
F
F
P
F
L
ID
- Identification Flag
VIP - Virtual Interrupt Pending
VIF - Virtual Interrupt Flag
AC - Alignment Check / Access Control
VM - Virtual-8086 Mode
RF - Resume Flag
NT - Nested Task Flag
IOPL- I/O Privilege Level
IF
- Interrupt Enable Flag
TF
- Trap Flag
Reserved
Figure 2-5. System Flags in the EFLAGS Register
IF
Interrupt enable (bit 9) - Controls the response of the processor to maskable hardware interrupt
requests (see also: Section 7.3.2, “Maskable Hardware Interrupts”). The flag is set to respond to maskable
hardware interrupts; cleared to inhibit maskable hardware interrupts. The IF flag does not affect the gener-
ation of exceptions or nonmaskable interrupts (NMI interrupts). The CPL, IOPL, and the state of the VME
flag in control register CR4 determine whether the IF flag can be modified by the CLI, STI, POPF, POPFD,
and IRET.
IOPL
I/O privilege level field (bits 12 and 13) - Indicates the I/O privilege level (IOPL) of the currently
running program or task. The CPL of the currently running program or task must be less than or equal to
the IOPL to access the I/O address space. The POPF and IRET instructions can modify this field only when
operating at a CPL of 0.
The IOPL is also one of the mechanisms that controls the modification of the IF flag and the handling of
interrupts in virtual-8086 mode when virtual mode extensions are in effect (when CR4.VME = 1). See also:
Chapter 20, “Input/Output,” in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume
1.
NT
Nested task (bit 14) - Controls the chaining of interrupted and called tasks. The processor sets this flag
on calls to a task initiated with a CALL instruction, an interrupt, or an exception. It examines and modifies
this flag on returns from a task initiated with the IRET instruction. The flag can be explicitly set or cleared
with the POPF/POPFD instructions; however, changing to the state of this flag can generate unexpected
exceptions in application programs.
See also: Section 10.4, “Task Linking.”
RF
Resume (bit 16) - Controls the processor’s response to instruction-breakpoint conditions. When set, this
flag temporarily disables debug exceptions (#DB) from being generated for instruction breakpoints
(although other exception conditions can cause an exception to be generated). When clear, instruction
breakpoints will generate debug exceptions.
The primary function of the RF flag is to allow the restarting of an instruction following a debug exception
that was caused by an instruction breakpoint condition. Here, debug software must set this flag in the
EFLAGS image on the stack just prior to returning to the interrupted program with IRETD (to prevent the
instruction breakpoint from causing another debug exception). The processor then automatically clears
2-10
Vol. 3A
SYSTEM ARCHITECTURE OVERVIEW
this flag after the instruction returned to has been successfully executed, enabling instruction breakpoint
faults again.
See also: Section 20.3.1.1, “Instruction-Breakpoint Exception Condition.”
VM
Virtual-8086 mode (bit 17) - Set to enable virtual-8086 mode; clear to return to protected mode.
See also: Section 23.2.1, “Enabling Virtual-8086 Mode.”
AC
Alignment check or access control (bit 18) - If the AM bit is set in the CR0 register, alignment
checking of user-mode data accesses is enabled if and only if this flag is 1. An alignment-check exception
is generated when reference is made to an unaligned operand, such as a word at an odd byte address or a
doubleword at an address which is not an integral multiple of four. Alignment-check exceptions are gener-
ated only in user mode (privilege level 3). Memory references that default to privilege level 0, such as
segment descriptor loads, do not generate this exception even when caused by instructions executed in
user-mode.
The alignment-check exception can be used to check alignment of data. This is useful when exchanging
data with processors which require all data to be aligned. The alignment-check exception can also be used
by interpreters to flag some pointers as special by misaligning the pointer. This eliminates overhead of
checking each pointer and only handles the special pointer when used.
If the SMAP bit is set in the CR4 register, explicit supervisor-mode data accesses to user-mode pages are
allowed if and only if this bit is 1. See Section 5.6, “Access Rights.”
VIF
Virtual Interrupt (bit 19) - Contains a virtual image of the IF flag. This flag is used in conjunction with
the VIP flag. The processor only recognizes the VIF flag when either the VME flag or the PVI flag in control
register CR4 is set and the IOPL is less than 3. (The VME flag enables the virtual-8086 mode extensions;
the PVI flag enables the protected-mode virtual interrupts.)
See also: Section 23.3.3.5, “Method 6: Software Interrupt Handling,” and Section 23.4, “Protected-Mode
Virtual Interrupts.”
VIP
Virtual interrupt pending (bit 20) - Set by software to indicate that an interrupt is pending; cleared to
indicate that no interrupt is pending. This flag is used in conjunction with the VIF flag. The processor reads
this flag but never modifies it. The processor only recognizes the VIP flag when either the VME flag or the
PVI flag in control register CR4 is set and the IOPL is less than 3. The VME flag enables the virtual-8086
mode extensions; the PVI flag enables the protected-mode virtual interrupts.
See Section 23.3.3.5, “Method 6: Software Interrupt Handling,” and Section 23.4, “Protected-Mode Virtual
Interrupts.”
ID
Identification (bit 21) - The ability of a program or procedure to set or clear this flag indicates support
for the CPUID instruction.
2.3.1
System Flags and Fields in IA-32e Mode
In 64-bit mode, the RFLAGS register expands to 64 bits with the upper 32 bits reserved. System flags in RFLAGS
(64-bit mode) or EFLAGS (compatibility mode) are shown in Figure 2-5.
In IA-32e mode, the processor does not allow the VM bit to be set because virtual-8086 mode is not supported
(attempts to set the bit are ignored). Also, the processor will not set the NT bit. The processor does, however, allow
software to set the NT bit (note that an IRET causes a general protection fault in IA-32e mode if the NT bit is set).
In IA-32e mode, the SYSCALL/SYSRET instructions have a programmable method of specifying which bits are
cleared in RFLAGS/EFLAGS. These instructions save/restore EFLAGS/RFLAGS.
2.4
MEMORY-MANAGEMENT REGISTERS
The processor provides four memory-management registers (GDTR, LDTR, IDTR, and TR) that specify the locations
of the data structures which control segmented memory management (see Figure 2-6). Special instructions are
provided for loading and storing these registers.
Vol. 3A
2-11
SYSTEM ARCHITECTURE OVERVIEW
System Table Registers
47(79)
16 15
0
GDTR
32(64)-bit Linear Base Address
16-Bit Table Limit
IDTR
32(64)-bit Linear Base Address
16-Bit Table Limit
System Segment
Segment Descriptor Registers (Automatically Loaded)
Registers
15
0
Attributes
Task
Seg. Sel.
32(64)-bit Linear Base Address
Segment Limit
Register
LDTR
Seg. Sel.
32(64)-bit Linear Base Address
Segment Limit
Figure 2-6. Memory Management Registers
2.4.1
Global Descriptor Table Register (GDTR)
The GDTR register holds the base address (32 bits in protected mode; 64 bits in IA-32e mode) and the 16-bit table
limit for the GDT. The base address specifies the linear address of byte 0 of the GDT; the table limit specifies the
number of bytes in the table.
The LGDT and SGDT instructions load and store the GDTR register, respectively. On power up or reset of the
processor, the base address is set to the default value of 0 and the limit is set to 0FFFFH. A new base address must
be loaded into the GDTR as part of the processor initialization process for protected-mode operation.
See also: Section 3.5.1, “Segment Descriptor Tables.”
2.4.2
Local Descriptor Table Register (LDTR)
The LDTR register holds the 16-bit segment selector, base address (32 bits in protected mode; 64 bits in IA-32e
mode), segment limit, and descriptor attributes for the LDT. The base address specifies the linear address of byte
0 of the LDT segment; the segment limit specifies the number of bytes in the segment. See also: Section 3.5.1,
“Segment Descriptor Tables.”
The LLDT and SLDT instructions load and store the segment selector part of the LDTR register, respectively. The
segment that contains the LDT must have a segment descriptor in the GDT. When the LLDT instruction loads a
segment selector in the LDTR: the base address, limit, and descriptor attributes from the LDT descriptor are auto-
matically loaded in the LDTR.
When a task switch occurs, the LDTR is automatically loaded with the segment selector and descriptor for the LDT
for the new task. The contents of the LDTR are not automatically saved prior to writing the new LDT information
into the register.
On power up or reset of the processor, the segment selector and base address are set to the default value of 0 and
the limit is set to 0FFFFH.
2.4.3
IDTR Interrupt Descriptor Table Register
The IDTR register holds the base address (32 bits in protected mode; 64 bits in IA-32e mode) and 16-bit table limit
for the IDT. The base address specifies the linear address of byte 0 of the IDT; the table limit specifies the number
of bytes in the table. The LIDT and SIDT instructions load and store the IDTR register, respectively. On power up or
reset of the processor, the base address is set to the default value of 0 and the limit is set to 0FFFFH. The base
address and limit in the register can then be changed as part of the processor initialization process.
See also: Section 7.10, “Interrupt Descriptor Table (IDT).”
2-12
Vol. 3A
SYSTEM ARCHITECTURE OVERVIEW
2.4.4
Task Register (TR)
The task register holds the 16-bit segment selector, base address (32 bits in protected mode; 64 bits in IA-32e
mode), segment limit, and descriptor attributes for the TSS of the current task. The selector references the TSS
descriptor in the GDT. The base address specifies the linear address of byte 0 of the TSS; the segment limit speci-
fies the number of bytes in the TSS. See also: Section 10.2.4, “Task Register.”
The LTR and STR instructions load and store the segment selector part of the task register, respectively. When the
LTR instruction loads a segment selector in the task register, the base address, limit, and descriptor attributes from
the TSS descriptor are automatically loaded into the task register. On power up or reset of the processor, the base
address is set to the default value of 0 and the limit is set to 0FFFFH.
When a task switch occurs, the task register is automatically loaded with the segment selector and descriptor for
the TSS for the new task. The contents of the task register are not automatically saved prior to writing the new TSS
information into the register.
2.5
CONTROL REGISTERS
Control registers (CR0, CR1, CR2, CR3, and CR4; see Figure 2-7) determine operating mode of the processor and
the characteristics of the currently executing task. These registers are 32 bits in all 32-bit modes and compatibility
mode.
In 64-bit mode, control registers are expanded to 64 bits. The MOV CRn instructions are used to manipulate the
register bits. Operand-size prefixes for these instructions are ignored. The following is also true:
• The control registers can be read and loaded (or modified) using the move-to-or-from-control-registers forms
of the MOV instruction. In protected mode, the MOV instructions allow the control registers to be read or loaded
(at privilege level 0 only). This restriction means that application programs or operating-system procedures
(running at privilege levels 1, 2, or 3) are prevented from reading or loading the control registers.
• Some of the bits in CR0 and CR4 are reserved and must be written with zeros. Attempting to set any reserved
bits in CR0[31:0] is ignored. Attempting to set any reserved bits in CR0[63:32] results in a general-protection
exception, #GP(0). Attempting to set any reserved bits in CR4 results in a general-protection exception,
#GP(0).
• All 64 bits of CR2 are writable by software.
• Bits in CR3 in the range 63:MAXPHYADDR that are reserved (see Figure 2-7) must be zero. Attempting to set
any of them results in #GP(0).1
• The MOV CR2 instruction does not check that address written to CR2 is canonical.
• A 64-bit capable processor will retain the upper 32 bits of each control register when transitioning out of IA-32e
mode.
• On a 64-bit capable processor, an execution of MOV to CR outside of 64-bit mode zeros the upper 32 bits of the
control register.
• Register CR8 is available in 64-bit mode only.
The control registers are summarized below, and each architecturally defined control field in these control registers
is described individually. In Figure 2-7, the width of the register in 64-bit mode is indicated in parenthesis (except
for CR0).
• CR0 - Contains system control flags that control operating mode and states of the processor.
• CR1 - Reserved.
• CR2 - Contains the page-fault linear address (the linear address that caused a page fault).
• CR3 - Contains the physical address of the base of the paging-structure hierarchy and four flags (PWT, PCD,
LAM_U57, and LAM_U48). Only the most-significant bits (less the lower 12 bits) of the base address are
specified; the lower 12 bits of the address are assumed to be 0. The first paging structure must thus be aligned
1. MAXPHYADDR is derived from the value enumerated by CPUID.80000008H:EAX[7:0]. If IA32_TME_ACTIVATE[0] = 1 (indicating that
TME has been configured), MAXPHYADDR is reduced by the value of IA32_TME_ACTIVATE[39:36] when a logical processor is out-
side secure arbitration mode (SEAM; see Chapter 35); the value is not reduced in SEAM.
Vol. 3A
2-13
SYSTEM ARCHITECTURE OVERVIEW
to a page (4-KByte) boundary. The PCD and PWT flags control caching of that paging structure in the
processor’s internal data caches (they do not control TLB caching of page-directory information). The LAM_U57
and LAM_U48 flags control linear-address masking for user addresses (see Section 4.4, “Linear-Address
Masking”).
When using the physical address extension, the CR3 register contains the base address of the page-directory-
pointer table. With 4-level paging and 5-level paging, the CR3 register contains the base address of the PML4
table and PML5 table, respectively. If PCIDs are enabled, CR3 has a format different from that illustrated in
Figure 2-7. See Section 5.5, “4-Level Paging and 5-Level Paging.”
See also: Chapter 5, “Paging.”
• CR4 - Contains a group of flags that enable several architectural extensions, and indicate operating system or
executive support for specific processor capabilities. Bits CR4[63:32] can only be used for IA-32e mode only
features that are enabled after entering 64-bit mode. Bits CR4[63:32] do not have any effect outside of IA-32e
mode.
• CR8 - Provides (in CR8[3:0]) read and write access to bits 7:4 of the local APIC's Task-Priority Register (TPR).
These bits are the task-priority class; all interrupts in this and lower priority classes are blocked. A value of
15 blocks interrupts in all priority classes, while a value of 0 blocks none. CR8 can be accessed only in 64-bit
mode, but the value of the TPR blocks interrupts regardless of mode.
2-14
Vol. 3A
SYSTEM ARCHITECTURE OVERVIEW
63
4
3
0
Task-
Reserved
Priority
CR8
Class
63
33 32
F
R
Reserved
CR4
E
D
31
29
28 27 26 25 24 23 22 21 20 19
18 17 16 15 14 13 12 11 10
9
8
7
6
5
4
3
2
1
0
U
P
L
S
S
S
V
L
U
I
P
C
P
C
P
P
M
P
P
T
P
V
A
M
M
K
M
M
A
M
D
Reserved
N
K
E
K
I
C
G
C
A
S
S
V
M
CR4
S
A
E
L
X
X
5
I
E
T
S
T
E
D
E
E
E
E
E
D
I
E
S
P
P
E
E
7
P
R
E
Reserved
Reserved
OSFXSR
LAM_SUP
FSGSBASE
OSXMMEXCPT
OSXSAVE
63
62 61 60
12 11
5
4
3
2
0
P
P
Page-Directory Base
Reserved
C
W
CR3
D
D
LAM_U57
Reserved
LAM_U48
63
0
Page-Fault Linear Address
CR2
31
29
28
19
18 17 16 15
6
5
4
3
2
1
0
P
C
N
A
W
N
E
T
E
M
P
Reserved
Reserved
CR0
G
D
W
M
P
E
T
S
M
P
E
Reserved
Figure 2-7. Control Registers
Vol. 3A
2-15
SYSTEM ARCHITECTURE OVERVIEW
The flags in control registers are:
CR0.PG
Paging (bit 31 of CR0) - Enables paging when set; disables paging when clear. When paging is
disabled, all linear addresses are treated as physical addresses. The PG flag has no effect if the PE flag (bit
0 of register CR0) is not also set; setting the PG flag when the PE flag is clear causes a general-protection
exception (#GP). See also: Chapter 5, “Paging.”
On Intel 64 processors, enabling and disabling IA-32e mode operation also requires modifying CR0.PG.
CR0.CD
Cache Disable (bit 30 of CR0) - When the CD and NW flags are clear, caching of memory locations for
the whole of physical memory in the processor’s internal (and external) caches is enabled. When the CD
flag is set, caching is restricted as described in Table 14-5. To prevent the processor from accessing and
updating its caches, the CD flag must be set and the caches must be invalidated so that no cache hits can
occur.
See also: Section 14.5.3, “Preventing Caching,” and Section 14.5, “Cache Control.”
CR0.NW
Not Write-through (bit 29 of CR0) - When the NW and CD flags are clear, write-back (for Pentium 4,
Intel Xeon, P6 family, and Pentium processors) or write-through (for Intel486 processors) is enabled for
writes that hit the cache and invalidation cycles are enabled. See Table 14-5 for detailed information about
the effect of the NW flag on caching for other settings of the CD and NW flags.
CR0.AM
Alignment Mask (bit 18 of CR0) - Enables automatic alignment checking when set; disables alignment
checking when clear. Alignment checking is performed only when the AM flag is set, the AC flag in the
EFLAGS register is set, CPL is 3, and the processor is operating in either protected or virtual-8086 mode.
CR0.WP
Write Protect (bit 16 of CR0) - When set, inhibits supervisor-level procedures from writing into read-
only pages; when clear, allows supervisor-level procedures to write into read-only pages (regardless of the
U/S bit setting; see Section 5.1.3 and Section 5.6). This flag facilitates implementation of the copy-on-
write method of creating a new process (forking) used by operating systems such as UNIX. This flag must
be set before software can set CR4.CET, and it cannot be cleared as long as CR4.CET = 1 (see below).
CR0.NE
Numeric Error (bit 5 of CR0) - Enables the native (internal) mechanism for reporting x87 FPU errors
when set; enables the PC-style x87 FPU error reporting mechanism when clear. When the NE flag is clear
and the IGNNE# input is asserted, x87 FPU errors are ignored. When the NE flag is clear and the IGNNE#
input is deasserted, an unmasked x87 FPU error causes the processor to assert the FERR# pin to generate
an external interrupt and to stop instruction execution immediately before executing the next waiting
floating-point instruction or WAIT/FWAIT instruction.
The FERR# pin is intended to drive an input to an external interrupt controller (the FERR# pin emulates the
ERROR# pin of the Intel 287 and Intel 387 DX math coprocessors). The NE flag, IGNNE# pin, and FERR#
pin are used with external logic to implement PC-style error reporting. Using FERR# and IGNNE# to handle
floating-point exceptions is deprecated by modern operating systems; this non-native approach also limits
newer processors to operate with one logical processor active.
See also: Section 8.7, “Handling x87 FPU Exceptions in Software,” in Chapter 8, “Programming with the
x87 FPU,” and Appendix A, “EFLAGS Cross-Reference,” in the Intel® 64 and IA-32 Architectures Software
Developer’s Manual, Volume 1.
CR0.ET
Extension Type (bit 4 of CR0) - Reserved in the Pentium 4, Intel Xeon, P6 family, and Pentium proces-
sors. In the Pentium 4, Intel Xeon, and P6 family processors, this flag is hardcoded to 1. In the Intel386 and
Intel486 processors, this flag indicates support of Intel 387 DX math coprocessor instructions when set.
CR0.TS
Task Switched (bit 3 of CR0) - Allows the saving of the x87 FPU/MMX/SSE/SSE2/SSE3/SSSE3/SSE4
context on a task switch to be delayed until an x87 FPU/MMX/SSE/SSE2/SSE3/SSSE3/SSE4 instruction is
2-16
Vol. 3A
SYSTEM ARCHITECTURE OVERVIEW
actually executed by the new task. The processor sets this flag on every task switch and tests it when
executing x87 FPU/MMX/SSE/SSE2/SSE3/SSSE3/SSE4 instructions.
• If the TS flag is set and the EM flag (bit 2 of CR0) is clear, a device-not-available exception (#NM) is
raised prior to the execution of any x87 FPU/MMX/SSE/SSE2/SSE3/SSSE3/SSE4 instruction; with the
exception of PAUSE, PREFETCHh, SFENCE, LFENCE, MFENCE, MOVNTI, CLFLUSH, CRC32, and POPCNT.
See the paragraph below for the special case of the WAIT/FWAIT instructions.
• If the TS flag is set and the MP flag (bit 1 of CR0) and EM flag are clear, an #NM exception is not raised
prior to the execution of an x87 FPU WAIT/FWAIT instruction.
• If the EM flag is set, the setting of the TS flag has no effect on the execution of x87
FPU/MMX/SSE/SSE2/SSE3/SSSE3/SSE4 instructions.
Table 2-2 shows the actions taken when the processor encounters an x87 FPU instruction based on the
settings of the TS, EM, and MP flags. Table 15-1 and 16-1 show the actions taken when the processor
encounters an MMX/SSE/SSE2/SSE3/SSSE3/SSE4 instruction.
The processor does not automatically save the context of the x87 FPU, XMM, and MXCSR registers on a
task switch. Instead, it sets the TS flag, which causes the processor to raise an #NM exception whenever
it encounters an x87 FPU/MMX/SSE/SSE2/SSE3/SSSE3/SSE4 instruction in the instruction stream for the
new task (with the exception of the instructions listed above).
The fault handler for the #NM exception can then be used to clear the TS flag (with the CLTS instruction)
and save the context of the x87 FPU, XMM, and MXCSR registers. If the task never encounters an x87
FPU/MMX/SSE/SSE2/SSE3/SSSE3/SSE4 instruction, the x87 FPU/MMX/SSE/SSE2/SSE3/SSSE3/SSE4
context is never saved.
Table 2-2. Action Taken By x87 FPU Instructions for Different Combinations of EM, MP, and TS
CR0 Flags
x87 FPU Instruction Type
EM
MP
TS
Floating-Point
WAIT/FWAIT
0
0
0
Execute
Execute.
0
0
1
#NM Exception
Execute.
0
1
0
Execute
Execute.
0
1
1
#NM Exception
#NM exception.
1
0
0
#NM Exception
Execute.
1
0
1
#NM Exception
Execute.
1
1
0
#NM Exception
Execute.
1
1
1
#NM Exception
#NM exception.
CR0.EM
Emulation (bit 2 of CR0) - Indicates that the processor does not have an internal or external x87 FPU when set;
indicates an x87 FPU is present when clear. This flag also affects the execution of
MMX/SSE/SSE2/SSE3/SSSE3/SSE4 instructions.
When the EM flag is set, execution of an x87 FPU instruction generates a device-not-available exception
(#NM). This flag must be set when the processor does not have an internal x87 FPU or is not connected to
an external math coprocessor. Setting this flag forces all floating-point instructions to be handled by soft-
ware emulation. Table 12-3 shows the recommended setting of this flag, depending on the IA-32 processor
and x87 FPU or math coprocessor present in the system. Table 2-2 shows the interaction of the EM, MP, and
TS flags.
Also, when the EM flag is set, execution of an MMX instruction causes an invalid-opcode exception (#UD)
to be generated (see Table 15-1). Thus, if an IA-32 or Intel 64 processor incorporates MMX technology, the
EM flag must be set to 0 to enable execution of MMX instructions.
Similarly for SSE/SSE2/SSE3/SSSE3/SSE4 extensions, when the EM flag is set, execution of most
SSE/SSE2/SSE3/SSSE3/SSE4 instructions causes an invalid opcode exception (#UD) to be generated (see
Vol. 3A
2-17
SYSTEM ARCHITECTURE OVERVIEW
Table 16-1). If an IA-32 or Intel 64 processor incorporates the SSE/SSE2/SSE3/SSSE3/SSE4 extensions,
the EM flag must be set to 0 to enable execution of these extensions. SSE/SSE2/SSE3/SSSE3/SSE4
instructions not affected by the EM flag include: PAUSE, PREFETCHh, SFENCE, LFENCE, MFENCE, MOVNTI,
CLFLUSH, CRC32, and POPCNT.
CR0.MP
Monitor Coprocessor (bit 1 of CR0) - Controls the interaction of the WAIT (or FWAIT) instruction with
the TS flag (bit 3 of CR0). If the MP flag is set, a WAIT instruction generates a device-not-available exception
(#NM) if the TS flag is also set. If the MP flag is clear, the WAIT instruction ignores the setting of the TS flag.
Table 12-3 shows the recommended setting of this flag, depending on the IA-32 processor and x87 FPU or
math coprocessor present in the system. Table 2-2 shows the interaction of the MP, EM, and TS flags.
CR0.PE
Protection Enable (bit 0 of CR0) - Enables protected mode when set; enables real-address mode when
clear. This flag does not enable paging directly. It only enables segment-level protection. To enable paging,
both the PE and PG flags must be set.
See also: Section 12.9, “Mode Switching.”
CR3.LAM_U48
User LAM48 enable (bit 62 of CR3) - When set and CR3.LAM_U57 is clear, enables LAM48 (masking of
linear-address bits 62:48) for user pointers. See Section 4.4, “Linear-Address Masking.”
CR3.LAM_U57
User LAM57 enable (bit 61 of CR3) - When set, enables LAM57 (masking of linear-address bits 62:57)
for user pointers and overrides CR3.LAM_U48. See Section 4.4, “Linear-Address Masking.”
CR3.PCD
Page-level Cache Disable (bit 4 of CR3) - Controls the memory type used to access the first paging
structure of the current paging-structure hierarchy. See Section 5.9, “Paging and Memory Typing.” This bit
is not used if paging is disabled, with PAE paging, or with 4-level paging1 or 5-level paging if CR4.PCIDE=1.
CR3.PWT
Page-level Write-Through (bit 3 of CR3) - Controls the memory type used to access the first paging
structure of the current paging-structure hierarchy. See Section 5.9, “Paging and Memory Typing.” This bit
is not used if paging is disabled, with PAE paging, or with 4-level paging or 5-level paging if CR4.PCIDE=1.
CR4.VME
Virtual-8086 Mode Extensions (bit 0 of CR4) - Enables interrupt- and exception-handling extensions
in virtual-8086 mode when set; disables the extensions when clear. Use of the virtual mode extensions can
improve the performance of virtual-8086 applications by eliminating the overhead of calling the virtual-
8086 monitor to handle interrupts and exceptions that occur while executing an 8086 program and,
instead, redirecting the interrupts and exceptions back to the 8086 program’s handlers. It also provides
hardware support for a virtual interrupt flag (VIF) to improve reliability of running 8086 programs in multi-
tasking and multiple-processor environments.
See also: Section 23.3, “Interrupt and Exception Handling in Virtual-8086 Mode.”
CR4.FRED
FRED enable (bit 32 of CR4) - When set, enables FRED transitions. See Chapter 8, “Flexible Return and
Event Delivery (FRED).”
CR4.LAM_SUP
Supervisor LAM enable (bit 28 of CR4) - When set, enables LAM (linear-address masking) for super-
visor pointers. See Section 4.4, “Linear-Address Masking.”
CR4.LASS
Linear-address-space Separation (bit 27 of CR4) - When set, enables LASS (linear-address-space
separation). See Section 4.3, “Linear-Address-Space Separation (LASS).”
CR4.UINTR
User Interrupts Enable Bit (bit 25 of CR4) - Enables user interrupts when set, including user-interrupt
delivery, user-interrupt notification identification, and the user-interrupt instructions.
1. Earlier versions of this manual used the term “IA-32e paging” to identify 4-level paging.
2-18
Vol. 3A
SYSTEM ARCHITECTURE OVERVIEW
CR4.PKS
Enable protection keys for supervisor-mode pages (bit 24 of CR4) - 4-level paging and 5-level
paging associate each supervisor-mode linear address with a protection key. When set, this flag allows use
of the IA32_PKRS MSR to specify, for each protection key, whether supervisor-mode linear addresses with
that protection key can be read or written.
CR4.CET
Control-flow Enforcement Technology (bit 23 of CR4) - Enables control-flow enforcement tech-
nology when set. See Chapter 18, “Control-flow Enforcement Technology (CET)‚” of the IA-32 Intel® Archi-
tecture Software Developer’s Manual, Volume 1. This flag can be set only if CR0.WP is set, and it must be
clear before CR0.WP can be cleared (see below).
CR4.PKE
Enable protection keys for user-mode pages (bit 22 of CR4) - 4-level paging and 5-level paging
associate each user-mode linear address with a protection key. When set, this flag indicates (via
CPUID.07H.00H:ECX.OSPKE[4]) that the operating system supports use of the PKRU register to specify,
for each protection key, whether user-mode linear addresses with that protection key can be read or
written. This bit also enables access to the PKRU register using the RDPKRU and WRPKRU instructions.
CR4.SMAP
SMAP-Enable Bit (bit 21 of CR4) - Enables supervisor-mode access prevention (SMAP) when set. See
Section 5.6, “Access Rights.”
CR4.SMEP
SMEP-Enable Bit (bit 20 of CR4) - Enables supervisor-mode execution prevention (SMEP) when set.
See Section 5.6, “Access Rights.”
CR4.KL
Key-Locker-Enable Bit (bit 19 of CR4) - When set, the LOADIWKEY instruction is enabled; in addition,
if support for the AES Key Locker instructions has been activated by system firmware,
CPUID.19H:EBX.AESKLE[0] is enumerated as 1 and the AES Key Locker instructions are enabled.1 When
clear, CPUID.19H:EBX.AESKLE[0] is enumerated as 0 and execution of any Key Locker instruction causes
an invalid-opcode exception (#UD).
CR4.OSXSAVE
XSAVE and Processor Extended States-Enable Bit (bit 18 of CR4) - When set, this flag: (1) indi-
cates (via CPUID.01H:ECX.OSXSAVE[27]) that the operating system supports the use of the XGETBV,
XSAVE, and XRSTOR instructions by general software; (2) enables the XSAVE and XRSTOR instructions to
save and restore the x87 FPU state (including MMX registers), the SSE state (XMM registers and MXCSR),
along with other processor extended states enabled in XCR0; (3) enables the processor to execute XGETBV
and XSETBV instructions in order to read and write XCR0. See Section 2.6 and Chapter 16, “System
Programming for Instruction Set Extensions and Processor Extended States.”
CR4.PCIDE
PCID-Enable Bit (bit 17 of CR4) - Enables process-context identifiers (PCIDs) when set. See Section
5.10.1, “Process-Context Identifiers (PCIDs).” Applies only in IA-32e mode (if IA32_EFER.LMA = 1).
CR4.FSGSBASE
FSGSBASE-Enable Bit (bit 16 of CR4) - Enables the instructions RDFSBASE, RDGSBASE, WRFSBASE,
and WRGSBASE.
CR4.SMXE
SMX-Enable Bit (bit 14 of CR4) - Enables SMX operation when set. See Chapter 7, “Safer Mode Exten-
sions Reference,” of Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 2D.
See also: Chapter 5, “Paging.”
1. Software can check CPUID.19H:EBX.AESKLE[0] after setting CR4.KL to determine whether the AES Key Locker instructions have
been enabled. Note that some processors may allow enabling of those instructions without activation by system firmware. Some
processors may not support use of the AES Key Locker instructions in system-management mode (SMM). Those processors enumer-
ate CPUID.19H:EBX.AESKLE[0] as 0 in SMM regardless of the setting of CR4.KL.
Vol. 3A
2-19
SYSTEM ARCHITECTURE OVERVIEW
CR4.VMXE
VMX-Enable Bit (bit 13 of CR4) - Enables VMX operation when set. See Chapter 26, “Introduction to
Virtual Machine Extensions.”
CR4.LA57
57-bit linear addresses (bit 12 of CR4) - When set in IA-32e mode, the processor uses 5-level paging
to translate 57-bit linear addresses. When clear in IA-32e mode, the processor uses 4-level paging to
translate 48-bit linear addresses. This bit cannot be modified in IA-32e mode.
CR4.UMIP
User-Mode Instruction Prevention (bit 11 of CR4) - When set, the following instructions cannot be
executed if CPL > 0: SGDT, SIDT, SLDT, SMSW, and STR. An attempt at such execution causes a general-
protection exception (#GP).
CR4.OSXMMEXCPT
Operating System Support for Unmasked SIMD Floating-Point Exceptions (bit 10 of CR4) -
When set, indicates that the operating system supports the handling of unmasked SIMD floating-point
exceptions through an exception handler that is invoked when a SIMD floating-point exception (#XM) is
generated. SIMD floating-point exceptions are only generated by SSE/SSE2/SSE3/SSE4.1 SIMD floating-
point instructions.
The operating system or executive must explicitly set this flag. If this flag is not set, the processor will
generate an invalid opcode exception (#UD) whenever it detects an unmasked SIMD floating-point excep-
tion.
CR4.OSFXSR
Operating System Support for FXSAVE and FXRSTOR instructions (bit 9 of CR4) - When set, this
flag: (1) indicates to software that the operating system supports the use of the FXSAVE and FXRSTOR
instructions, (2) enables the FXSAVE and FXRSTOR instructions to save and restore the contents of the
XMM and MXCSR registers along with the contents of the x87 FPU and MMX registers, and (3) enables the
processor to execute SSE/SSE2/SSE3/SSSE3/SSE4 instructions, with the exception of the PAUSE,
PREFETCHh, SFENCE, LFENCE, MFENCE, MOVNTI, CLFLUSH, CRC32, and POPCNT.
If this flag is clear, the FXSAVE and FXRSTOR instructions will save and restore the contents of the x87 FPU
and MMX registers, but they may not save and restore the contents of the XMM and MXCSR registers. Also,
the processor will generate an invalid opcode exception (#UD) if it attempts to execute any
SSE/SSE2/SSE3 instruction, with the exception of PAUSE, PREFETCHh, SFENCE, LFENCE, MFENCE,
MOVNTI, CLFLUSH, CRC32, and POPCNT. The operating system or executive must explicitly set this flag.
NOTE
CPUID feature flag FXSR indicates availability of the FXSAVE/FXRSTOR instructions. The OSFXSR
bit provides operating system software with a means of enabling FXSAVE/FXRSTOR to save/restore
the contents of the X87 FPU, XMM, and MXCSR registers. Consequently OSFXSR bit indicates that
the operating system provides context switch support for SSE/SSE2/SSE3/SSSE3/SSE4.
CR4.PCE
Performance-Monitoring Counter Enable (bit 8 of CR4) - Enables execution of the RDPMC instruc-
tion for programs or procedures running at any protection level when set; RDPMC instruction can be
executed only at protection level 0 when clear.
CR4.PGE
Page Global Enable (bit 7 of CR4) - (Introduced in the P6 family processors.) Enables the global page
feature when set; disables the global page feature when clear. The global page feature allows frequently
used or shared pages to be marked as global to all users (done with the global flag, bit 8, in a page-direc-
tory-pointer-table entry, a page-directory entry, or a page-table entry). Global pages are not flushed from
the translation-lookaside buffer (TLB) on a task switch or a write to register CR3.
When enabling the global page feature, paging must be enabled (by setting the PG flag in control register
CR0) before the PGE flag is set. Reversing this sequence may affect program correctness, and processor
performance will be impacted.
See also: Section 5.10, “Caching Translation Information.”
2-20
Vol. 3A
SYSTEM ARCHITECTURE OVERVIEW
CR4.MCE
Machine-Check Enable (bit 6 of CR4) - Enables the machine-check exception when set; disables the
machine-check exception when clear.
See also: Chapter 18, “Machine-Check Architecture.”
CR4.PAE
Physical Address Extension (bit 5 of CR4) - When set, enables paging to produce physical addresses
with more than 32 bits. When clear, restricts physical addresses to 32 bits. PAE must be set before entering
IA-32e mode.
See also: Chapter 5, “Paging.”
CR4.PSE
Page Size Extensions (bit 4 of CR4) - Enables 4-MByte pages with 32-bit paging when set; restricts
32-bit paging to pages of 4 KBytes when clear.
See also: Section 5.3, “32-Bit Paging.”
CR4.DE
Debugging Extensions (bit 3 of CR4) - References to debug registers DR4 and DR5 cause an unde-
fined opcode (#UD) exception to be generated when set; when clear, processor aliases references to regis-
ters DR4 and DR5 for compatibility with software written to run on earlier IA-32 processors.
See also: Section 20.2.2, “Debug Registers DR4 and DR5.”
CR4.TSDTime Stamp Disable (bit 2 of CR4) - Restricts the execution of the RDTSC instruction to procedures
running at privilege level 0 when set; allows RDTSC instruction to be executed at any privilege level when
clear. This bit also applies to the RDTSCP instruction if supported (if CPUID.80000001H:EDX[27] = 1).
CR4.PVI
Protected-Mode Virtual Interrupts (bit 1 of CR4) - Enables hardware support for a virtual interrupt
flag (VIF) in protected mode when set; disables the VIF flag in protected mode when clear.
See also: Section 23.4, “Protected-Mode Virtual Interrupts.”
2.5.1
CPUID Qualification of Control Register Flags
Not all flags in control register CR4 are implemented on all processors. With the exception of the PCE flag, they can
be qualified with the CPUID instruction to determine if they are implemented on the processor before they are
used.
The CR8 register is available on processors that support Intel 64 architecture.
2.6
EXTENDED CONTROL REGISTERS (INCLUDING XCR0)
If CPUID.01H:ECX.XSAVE[26] is 1, the processor supports one or more extended control registers (XCRs).
Currently, the only such register defined is XCR0. This register specifies the set of processor state components for
which the operating system provides context management, e.g., x87 FPU state, SSE state, AVX state. The OS
programs XCR0 to reflect the features for which it provides context management.
Vol. 3A
2-21
SYSTEM ARCHITECTURE OVERVIEW
63
18
17
10
9
8
7
6
5
4
3
2
1
0
1
Reserved for XCR0 bit vector expansion
Reserved / Future processor extended states
TILEDATA state
TILECONFIG state
PKRU state
Hi16_ZMM state
ZMM_Hi256 state
Opmask state
BNDCSR state
BNDREG state
AVX state
SSE state
X87 FPU/MMX state (must be 1)
Reserved (must be 0)
Figure 2-8. XCR0
Software can access XCR0 only if CR4.OSXSAVE[bit 18] = 1. (This bit is also readable as
CPUID.01H:ECX.OSXSAVE[27].) Software can use CPUID.0DH to enumerate the bits in XCR0 that the processor
supports (see CPUID instruction in Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 2A).
Each supported state component is represented by a bit in XCR0. System software enables state components by
loading an appropriate bit mask value into XCR0 using the XSETBV instruction.
As each bit in XCR0 (except bit 63) corresponds to a processor state component, XCR0 thus provides support for
up to 63 sets of processor state components. Bit 63 of XCR0 is reserved for future expansion and will not represent
a processor state component.
Currently, XCR0 defines support for the following state components:
• XCR0.X87 (bit 0): This bit 0 must be 1. An attempt to write 0 to this bit causes a #GP exception.
• XCR0.SSE (bit 1): If 1, the XSAVE feature set can be used to manage MXCSR and the XMM registers (XMM0-
XMM15 in 64-bit mode; otherwise XMM0-XMM7).
• XCR0.AVX (bit 2): If 1, Intel AVX instructions can be executed and the XSAVE feature set can be used to
manage the upper halves of the YMM registers (YMM0-YMM15 in 64-bit mode; otherwise YMM0-YMM7).
• XCR0.BNDREG (bit 3): If 1, Intel MPX instructions can be executed and the XSAVE feature set can be used to
manage the bounds registers BND0-BND3.
• XCR0.BNDCSR (bit 4): If 1, Intel MPX instructions can be executed and the XSAVE feature set can be used to
manage the BNDCFGU and BNDSTATUS registers.
• XCR0.opmask (bit 5): If 1, Intel AVX-512 instructions can be executed and the XSAVE feature set can be used
to manage the opmask registers k0-k7.
• XCR0.ZMM_Hi256 (bit 6): If 1, Intel AVX-512 instructions can be executed and the XSAVE feature set can be
used to manage the upper halves of the lower ZMM registers (ZMM0-ZMM15 in 64-bit mode; otherwise ZMM0-
ZMM7).
• XCR0.Hi16_ZMM (bit 7): If 1, Intel AVX-512 instructions can be executed and the XSAVE feature set can be
used to manage the upper ZMM registers (ZMM16-ZMM31, only in 64-bit mode).
• XCR0.PKRU (bit 9): If 1, the XSAVE feature set can be used to manage the PKRU register (see Section 2.7).
• XCR0.TILECFG (bit 17): If 1, and if XCR0.TILEDATA is also 1, Intel AMX instructions can be executed and the
XSAVE feature set can be used to manage TILECFG.
2-22
Vol. 3A
SYSTEM ARCHITECTURE OVERVIEW
• XCR0.TILEDATA (bit 18): If 1, and if XCR0.TILECFG is also 1, Intel AMX instructions can be executed and the
XSAVE feature set can be used to manage TILEDATA.
An attempt to use XSETBV to write to XCR0 results in general-protection exceptions (#GP) if it would do any of the
following:
• Set a bit reserved in XCR0 for a given processor (as determined by the contents of EAX and EDX after executing
CPUID.0DH.00H).
• Clear XCR0.x87.
• Clear XCR0.SSE and set XCR0.AVX.
• Clear XCR0.AVX and set any of XCR0.opmask, XCR0.ZMM_Hi256, or XCR0.Hi16_ZMM.
• Set either XCR0.BNDREG or XCR0.BNDCSR while not setting the other.
• Set any of XCR0.opmask, XCR0.ZMM_Hi256, and XCR0.Hi16_ZMM while not setting all of them.
• Set either XCR0.TILECFG or XCR0.TILEDATA while not setting the other.
After reset, all bits (except bit 0) in XCR0 are cleared to zero; XCR0[0] is set to 1.
2.7
PROTECTION-KEY RIGHTS REGISTERS (PKRU AND IA32_PKRS)
Processors may support either or both of two protection-key rights registers: PKRU for user-mode pages and the
IA32_PKRS MSR (MSR index 6E1H) for supervisor-mode pages. 4-level paging and 5-level paging associate a 4-bit
protection key with each page. The protection-key rights registers determine accessibility based on a page’s
protection key.
If CPUID.07H.00H:ECX.PKU[3] = 1, the processor supports the protection-key feature for user-mode pages. When
CR4.PKE = 1, software can use the protection-key rights register for user pages (PKRU) to specify the access
rights for user-mode pages for each protection key.
If CPUID.07H.00H:ECX.PKS[31] = 1, the processor supports the protection-key feature for supervisor-mode
pages. When CR4.PKS = 1, software can use the protection-key rights register for supervisor pages (the
IA32_PKRS MSR) to specify the access rights for supervisor-mode pages for each protection key.
31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11
10 9
8
7
6
5
4
3
2
1
0
Bit Position
W
A
W
A
W
A
W
A
W
A
W
A
W
A
W
A
W
A
W
A
W
A
W
A
W
A
W
A
W
A
W
A
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
15
15
14
14
13
13
12
12
11
11
1010
9
9
8
8
7
7
6
6
5
5
4
4
3
3
2
2
1
1
0
0
Figure 2-9. Format of Protection-Key Rights Registers
The format of each protection-key rights register is given in Figure 2-9. Each contains 16 pairs of disable controls
to prevent data accesses to linear addresses (user-mode or supervisor-mode, depending on the register) based on
their protection keys. Each protection key i (0 ≤ i ≤ 15) is associated with two bits in each protection-key rights
register:
• Bit 2i, shown as “ADi” (access disable): if set, the processor prevents any data accesses to linear addresses
(user-mode or supervisor-mode, depending on the register) with protection key i.
• Bit 2i+1, shown as “WDi” (write disable): if set, the processor prevents write accesses to linear addresses
(user-mode or supervisor-mode, depending on the register) with protection key i.
(Bits 63:32 of the IA32_PKRS MSR are reserved and must be zero.)
See Section 5.6.2, “Protection Keys,” for details of how the processor uses the protection-key rights registers to
control accesses to linear addresses.
Software can read and write PKRU using the RDPKRU and WRPKRU instructions. The IA32_PKRS MSR can be read
and written with the RDMSR and WRMSR instructions. Writes to the IA32_PKRS MSR using WRMSR are not serial-
izing.
Vol. 3A
2-23
SYSTEM ARCHITECTURE OVERVIEW
2.8
SYSTEM INSTRUCTION SUMMARY
System instructions handle system-level functions such as loading system registers, managing the cache,
managing interrupts, or setting up the debug registers. Many of these instructions can be executed only by oper-
ating-system or executive procedures (that is, procedures running at privilege level 0). Others can be executed at
any privilege level and are thus available to application programs.
Table 2-3 lists the system instructions and indicates whether they are available and useful for application programs.
These instructions are described in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volumes
2A, 2B, 2C, & 2D.
Table 2-3. Summary of System Instructions
Useful to
Protected from
Instruction
Description
Application?
Application?
LLDT
Load LDT Register
No
Yes
SLDT
Store LDT Register
No
If CR4.UMIP = 1
LGDT
Load GDT Register
No
Yes
SGDT
Store GDT Register
No
If CR4.UMIP = 1
LTR
Load Task Register
No
Yes
STR
Store Task Register
No
If CR4.UMIP = 1
LIDT
Load IDT Register
No
Yes
SIDT
Store IDT Register
No
If CR4.UMIP = 1
MOV CRn
Load and store control registers
No
Yes
SMSW
Store MSW
Yes
If CR4.UMIP = 1
LMSW
Load MSW
No
Yes
CLTS
Clear TS flag in CR0
No
Yes
ARPL
Adjust RPL
Yes1, 2
No
LAR
Load Access Rights
Yes
No
LSL
Load Segment Limit
Yes
No
VERR
Verify for Reading
Yes
No
VERW
Verify for Writing
Yes
No
MOV DRn
Load and store debug registers
No
Yes
INVD
Invalidate cache, no writeback
No
Yes
WBINVD
Invalidate cache, with writeback
No
Yes
WBNOINVD
Writeback cache, without invalidation
No
Yes
INVLPG
Invalidate TLB entry
No
Yes
INVPCID
Invalidate TLB entries for PCID
No
Yes
HLT
Halt Processor
No
Yes
LOCK (Prefix)
Bus Lock
Yes
No
RSM
Return from system management mode
No
Yes
RDMSR3, RDMSRLIST
Read Model-Specific Registers
No
Yes
WRMSR3, WRMSRLIST,
Write Model-Specific Registers
No
Yes
WRMSRNS
RDPMC4
Read Performance-Monitoring Counter
Yes
Yes5
RDTSC3
Read Time-Stamp Counter
Yes
Yes5
2-24
Vol. 3A
SYSTEM ARCHITECTURE OVERVIEW
Table 2-3. Summary of System Instructions (Contd.)
Useful to
Protected from
Instruction
Description
Application?
Application?
RDTSCP6
Read Serialized Time-Stamp Counter
Yes
Yes5
RDPID
Read Processor ID
Yes
No
RDPKRU
Read Protection Key Rights for User Pages
Yes
No
WRPKRU
Write Protection Key Rights for User Pages
Yes
No
SWAPGS
Swap GS Base Register
No
Yes
XGETBV
Return the state of XCR0
Yes
No
XSETBV
Enable one or more processor extended states
No
Yes
LKGS
Load Kernel GS Base
No
Yes
INT
Call to Interrupt Procedure
Yes
No7
INT1
Generate debug trap
Yes
No
INT3
Generate breakpoint trap
Yes
No7
INTO
Generate overflow trap if overflow flag is 1
Yes
No7
IRET
Interrupt Return
Yes
No
SYSENTER, SYSCALL
Fast System Call
Yes
No
SYSEXIT, SYSRET
Return from Fast System Call
No
Yes
ERETS
Event Return to Supervisor
No
Yes
ERETU
Event Return to User
No
Yes
NOTES:
1. Useful to application programs running at a CPL of 1 or 2.
2. This instruction is not supported in 64-bit mode.
3. These instructions were introduced into the IA-32 Architecture with the Pentium processor.
4. This instruction was introduced into the IA-32 Architecture with the Pentium Pro processor and the Pentium processor with MMX technol-
ogy.
5. The TSD and PCE flags in control register CR4 control access to these instructions by application programs running at a CPL of 3.
6. RDTSCP is introduced in Intel Core i7 processor.
7. With IDT event delivery, an operating system can configure the DPL in the relevant descriptor in the IDT to prevent application access.
2.8.1
Loading and Storing System Registers
The GDTR, LDTR, IDTR, and TR registers each have a load and store instruction for loading data into and storing
data from the register:
• LGDT (Load GDTR Register) - Loads the GDT base address and limit from memory into the GDTR register.
• SGDT (Store GDTR Register) - Stores the GDT base address and limit from the GDTR register into memory.
• LIDT (Load IDTR Register) - Loads the IDT base address and limit from memory into the IDTR register.
• SIDT (Store IDTR Register) - Stores the IDT base address and limit from the IDTR register into memory.
• LLDT (Load LDTR Register) - Loads the LDT segment selector and segment descriptor from memory into
the LDTR. (The segment selector operand can also be located in a general-purpose register.)
• SLDT (Store LDTR Register) - Stores the LDT segment selector from the LDTR register into memory or a
general-purpose register.
• LTR (Load Task Register) - Loads segment selector and segment descriptor for a TSS from memory into the
task register. (The segment selector operand can also be located in a general-purpose register.)
Vol. 3A
2-25
SYSTEM ARCHITECTURE OVERVIEW
• STR (Store Task Register) - Stores the segment selector for the current task TSS from the task register into
memory or a general-purpose register.
The LMSW (load machine status word) and SMSW (store machine status word) instructions operate on bits 0
through 15 of control register CR0. These instructions are provided for compatibility with the 16-bit Intel 286
processor. Programs written to run on 32-bit IA-32 processors should not use these instructions. Instead, they
should access the control register CR0 using the MOV CR instruction.
The CLTS (clear TS flag in CR0) instruction is provided for use in handling a device-not-available exception (#NM)
that occurs when the processor attempts to execute a floating-point instruction when the TS flag is set. This
instruction allows the TS flag to be cleared after the x87 FPU context has been saved, preventing further #NM
exceptions. See Section 2.5, “Control Registers,” for more information on the TS flag.
The control registers (CR0, CR1, CR2, CR3, CR4, and CR8) are loaded using the MOV instruction. The instruction
loads a control register from a general-purpose register or stores the content of a control register in a general-
purpose register.
2.8.2
Modifying Kernel GS
The Swap GS Base Register (SWAPGS) instruction exchanges the current GS base register value with the
IA32_KERNEL_GS_BASE MSR (address C0000102H). The instruction cannot be executed when FRED transitions
are enabled. FRED transitions perform the same swap when changing the CPL.
The LKGS (Load Kernel GS Base) instruction operates in the same way as MOV to GS except that the descriptor’s
base address is loaded into the IA32_KERNEL_GS_BASE MSR instead of the GS segment’s descriptor cache. LKGS
was introduced alongside FRED to allow system software to manage the GS segment more flexibly. Support is indi-
cated by CPUID.07H.01H:EAX.LKGS[18] = 1.
2.8.3
Reading and Writing Protection Key Rights for User Pages
The Protection Key Rights User register (PKRU) can be read and written using the RDPKRU and WRPKRU instruc-
tions, respectively. Protection Keys User (PKU) feature support is indicated by CPUID.07H.00H:ECX.PKU[3] = 1.
The OS must enable the PKU feature through CR4.PKE[22] = 1. Instruction support is indicated to software by
CPUID.07H.00H:ECX.OSPKE[4] = 1. The 32-bit PKRU is read to or written from the EAX register.
See Section 2.7, “Protection-Key Rights Registers (PKRU and IA32_PKRS),” and Section 5.6.2, “Protection Keys,”
for more information on the PKRU register and Protection Keys feature.
2.8.4
Verifying of Access Privileges
The processor provides several instructions for examining segment selectors and segment descriptors to determine
if access to their associated segments is allowed. These instructions duplicate some of the automatic access rights
and type checking done by the processor, thus allowing operating-system or executive software to prevent excep-
tions from being generated.
The ARPL (adjust RPL) instruction adjusts the RPL (requestor privilege level) of a segment selector to match that of
the program or procedure that supplied the segment selector. See Section 6.10.4, “Checking Caller Access Privi-
leges (ARPL Instruction),” for a detailed explanation of the function and use of this instruction. Note that ARPL is
not supported in 64-bit mode.
The LAR (load access rights) instruction verifies the accessibility of a specified segment and loads access rights
information from the segment’s segment descriptor into a general-purpose register. Software can then examine
the access rights to determine if the segment type is compatible with its intended use. See Section 6.10.1,
“Checking Access Rights (LAR Instruction),” for a detailed explanation of the function and use of this instruction.
The LSL (load segment limit) instruction verifies the accessibility of a specified segment and loads the segment
limit from the segment’s segment descriptor into a general-purpose register. Software can then compare the
segment limit with an offset into the segment to determine whether the offset lies within the segment. See Section
6.10.3, “Checking That the Pointer Offset Is Within Limits (LSL Instruction),” for a detailed explanation of the func-
tion and use of this instruction.
2-26
Vol. 3A
SYSTEM ARCHITECTURE OVERVIEW
The VERR (verify for reading) and VERW (verify for writing) instructions verify if a selected segment is readable or
writable, respectively, at a given CPL. See Section 6.10.2, “Checking Read/Write Rights (VERR and VERW Instruc-
tions),” for a detailed explanation of the function and use of these instructions.
2.8.5
Loading and Storing Debug Registers
Internal debugging facilities in the processor are controlled by a set of 8 debug registers (DR0-DR7). The MOV
instruction allows setup data to be loaded to and stored from these registers.
On processors that support Intel 64 architecture, debug registers DR0-DR7 are 64 bits. In 32-bit modes and
compatibility mode, writes to a debug register fill the upper 32 bits with zeros. Reads return the lower 32 bits. In
64-bit mode, the upper 32 bits of DR6-DR7 are reserved and must be written with zeros. Writing one to any of the
upper 32 bits causes an exception, #GP(0).
In 64-bit mode, MOV DRn instructions read or write all 64 bits of a debug register (operand-size prefixes are
ignored). All 64 bits of DR0-DR3 are writable by software. However, MOV DRn instructions do not check that
addresses written to DR0-DR3 are in the limits of the implementation. Address matching is supported only on valid
addresses generated by the processor implementation.
2.8.6
Invalidating Caches and TLBs
The processor provides several instructions for use in explicitly invalidating its caches and TLB entries. The INVD
(invalidate cache with no writeback) instruction invalidates all data and instruction entries in the internal caches
and sends a signal to the external caches indicating that they should also be invalidated.
The WBINVD (invalidate cache with writeback) instruction performs the same function as the INVD instruction,
except that it writes back modified lines in its internal caches to memory before it invalidates the caches. After
invalidating the caches local to the executing logical processor or processor core, WBINVD signals caches higher in
the cache hierarchy (caches shared with the invalidating logical processor or core) to write back any data they have
in modified state at the time of instruction execution and to invalidate their contents.
The WBNOINVD (writeback cache without invalidation) instruction performs similarly to the WBINVD instruction
but does not invalidate (flush) the internal caches. Support is indicated by CPUID.80000008H:EBX.WBNOINVD[9]
= 1.
Note, non-shared caches may not be written back nor invalidated. In Figure 2-10 below, if code executing on either
LP0 or LP1 were to execute a WBINVD, the shared L1 and L2 for LP0/LP1 will be written back and invalidated as will
the shared L3. However, the L1 and L2 caches not shared with LP0 and LP1 will not be written back nor invalidated.
Not Written back and
not Invalidated
Logical Processors
LP0
LP1
LP2
LP3
LP4
LP5
LP6
LP7
L1 & L2 Cache
Written back
& Invalidated
Execution Engine
L3 Cache
Written back and Invalidated
Uncore
QPI
DDR3
Figure 2-10. WBINVD Invalidation of Shared and Non-Shared Cache Hierarchy
The INVLPG (invalidate TLB entry) instruction invalidates (flushes) the TLB entry for a specified page.
Vol. 3A
2-27
SYSTEM ARCHITECTURE OVERVIEW
The INVPCID (Invalidate Process-Context Identifier) instruction invalidates (flushes) the TLB entries for the speci-
fied PCID. Support is indicated by CPUID.07H.00H:EBX.INVPCID[10] = 1.
2.8.7
Controlling the Processor
The HLT (halt processor) instruction stops the processor until an enabled interrupt (such as NMI or SMI, which are
normally enabled), a debug exception, the BINIT# signal, the INIT# signal, or the RESET# signal is received. The
processor generates a special bus cycle to indicate that the halt mode has been entered.
Hardware may respond to this signal in a number of ways. An indicator light on the front panel may be turned on.
An NMI interrupt for recording diagnostic information may be generated. Reset initialization may be invoked (note
that the BINIT# pin was introduced with the Pentium Pro processor). If any non-wake events are pending during
shutdown, they will be handled after the wake event from shutdown is processed (for example, A20M# interrupts).
The LOCK prefix invokes a locked (atomic) read-modify-write operation when modifying a memory operand. This
mechanism is used to allow reliable communications between processors in multiprocessor systems, as described
below:
• In the Pentium processor and earlier IA-32 processors, the LOCK prefix causes the processor to assert the
LOCK# signal during the instruction. This always causes an explicit bus lock to occur.
• In the Pentium 4, Intel Xeon, and P6 family processors, the locking operation is handled with either a cache lock
or bus lock. If a memory access is cacheable and affects only a single cache line, a cache lock is invoked and
the system bus and the actual memory location in system memory are not locked during the operation. Here,
other Pentium 4, Intel Xeon, or P6 family processors on the bus write-back any modified data and invalidate
their caches as necessary to maintain system memory coherency. If the memory access is not cacheable
and/or it crosses a cache line boundary, the processor’s LOCK# signal is asserted and the processor does not
respond to requests for bus control during the locked operation.
The RSM (return from SMM) instruction restores the processor (from a context dump) to the state it was in prior to
a system management mode (SMM) interrupt.
2.8.8
Reading Performance-Monitoring Counters
The RDPMC (read performance-monitoring counter) instruction allows application programs to read the processor’s
performance-monitoring counters. Processors based on Intel NetBurst® microarchitecture have eighteen 40-bit
performance-monitoring counters; P6 family processors have two 40-bit counters. Intel Atom® processors and
most of the processors based on the Intel Core microarchitecture support two types of performance monitoring
counters: programmable performance counters similar to those available in the P6 family, and three fixed-function
performance monitoring counters. Details of programmable and fixed-function performance monitoring counters
for each processor generation are described in Chapter 21, “Last Branch Records.”
The programmable performance counters can support counting either the occurrence or duration of events. Events
that can be monitored on programmable counters generally are model specific (except for architectural perfor-
mance events enumerated by CPUID.0AH); they may include the number of instructions decoded, interrupts
received, or the number of cache loads. Individual counters can be set up to monitor different events. Use the
system instruction WRMSR to set up values in one of the IA32_PERFEVTSELx MSR, in one of the 45 ESCRs and one
of the 18 CCCR MSRs (for Pentium 4 and Intel Xeon processors); or in the PerfEvtSel0 or the PerfEvtSel1 MSR (for
the P6 family processors). The RDPMC instruction loads the current count from the selected counter into the
EDX:EAX registers.
Fixed-function performance counters record only specific events that are defined at: https://perfmon-
events.intel.com/, and the width/number of fixed-function counters are enumerated by CPUID.0AH.
See Section 22.1, “Performance Monitoring Overview,” for more information about the performance monitoring
counters.
The RDPMC instruction was introduced into the IA-32 architecture with the Pentium Pro processor and the Pentium
processor with MMX technology. Earlier Pentium processors have two performance-monitoring counters, but they
can be read only with the RDMSR instruction, and only at privilege level 0.
2-28
Vol. 3A
SYSTEM ARCHITECTURE OVERVIEW
RDPMC requires an index to specify the offset of the performance-monitoring counter. In 64-bit mode for Pentium
4 or Intel Xeon processor families, the index is specified in ECX[30:0]. The current count of the performance-moni-
toring counter is stored in EDX:EAX (or RDX[31:0]:RAX[31:0] with RDX[63:32]:RAX[63:32] cleared).
2.8.9
Reading Time-Stamp Counter and IA32_TSC_AUX
The RDTSC/RDTSCP (read Time-Stamp Counter, Processor ID) instructions allow application programs to read the
processor’s time-stamp counter. The RDTSC instruction was introduced into the IA-32 architecture with the
Pentium processor. Support is indicated by CPUID.01H:EDX.TSC[4] = 1. In 64-bit mode, RDTSC/RDTSCP operates
the same as in protected mode.
The RDTSCP instruction operates similarly to the RDTSC instruction, but additionally returns the IA32_TSC_AUX
MSR in ECX. RDTSCP waits until all previous instructions have executed and all previous loads are globally visible.
Support is indicated by CPUID.80000001H:EDX.RDTSCP[27] = 1.
The RDPID (Read Processor ID) instruction simply reads the IA32_TSC_AUX MSR into the specified GPR. Support
is indicated by CPUID.07H.00H:ECX.RDPID[22] = 1.
The time-stamp counter is a model-specific 64-bit counter that is reset to zero each time the processor is reset. If
not reset, the counter will increment ~9.5 x 1016 times per year when the processor is operating at a clock rate of
3 GHz. At this clock frequency, it would take over 190 years for the counter to wrap around. The RDTSC instruction
loads the current count of the time-stamp counter into the EDX:EAX registers.
See Section 20.17, “Time-Stamp Counter,” for more information about the time-stamp counter.
2.8.10 Reading and Writing Model-Specific Registers
The RDMSR (read model-specific register) and WRMSR (write model-specific register) instructions allow a
processor’s 64-bit model-specific registers (MSRs) to be read and written, respectively. RDMSR and WRMSR were
introduced into the IA-32 architecture with the Pentium processor. In 64-bit mode, the index specifying the MSR
remains 32 bits.
WRMSRNS behaves like WRMSR, except that it is not a serializing instruction by default. Support is indicated by
CPUID.07H.01H:EAX.WRMSRNS[19] = 1.
RDMSRLIST and WRMSRLIST allow up to 64 MSRs from a software-provided list to be read to or written from
memory. WRMSRLIST is not a serializing instruction by default. Support is indicated by
CPUID.07H.01H:EAX.MSRLIST[27] = 1.
The initial forms of RDMSR, WRMSR, and WRMSRNS use implicit 32-bit registers EDX:EAX for the value and ECX
for the index. Explicit register and immediate (index) forms of RDMSR and WRMSRNS were added later, support is
indicated by CPUID.07H.01H:ECX.MSR_IMM[5] = 1.
RDMSRLIST and WRMSRLIST use implicit 64-bit registers. RSI contains the linear address of the memory table of
MSR indexes, RDI contains the linear address of the memory table of MSR values. RCX is the bit mask of table
entries.
See Section 12.4, “Model-Specific Registers (MSRs),” and the Intel® 64 and IA-32 Architectures Software Devel-
oper’s Manual, Volume 2B and Volume 2D for more information.
2.8.11 Enabling Processor Extended States
The XSETBV instruction is required to enable OS support of individual processor extended states in XCR0 (see
Section 2.6).
Vol. 3A
2-29
SYSTEM ARCHITECTURE OVERVIEW
2-30
Vol. 3A
CHAPTER 3
PROTECTED-MODE MEMORY MANAGEMENT
This chapter describes the Intel 64 and IA-32 architecture’s protected-mode memory management facilities,
including the physical memory requirements, segmentation mechanism, and paging mechanism.
See also: Chapter 6, “Protection‚” (for a description of the processor’s protection mechanism) and Chapter 23,
“8086 Emulation‚” (for a description of memory addressing protection in real-address and virtual-8086 modes).
3.1
MEMORY MANAGEMENT OVERVIEW
The memory management facilities of the IA-32 architecture are divided into two parts: segmentation and paging.
Segmentation provides a mechanism of isolating individual code, data, and stack modules so that multiple
programs (or tasks) can run on the same processor without interfering with one another. Paging provides a mech-
anism for implementing a conventional demand-paged, virtual-memory system where sections of a program’s
execution environment are mapped into physical memory as needed. Paging can also be used to provide isolation
between multiple tasks. When operating in protected mode, some form of segmentation must be used. There is
no mode bit to disable segmentation. The use of paging, however, is optional.
These two mechanisms (segmentation and paging) can be configured to support simple single-program (or single-
task) systems, multitasking systems, or multiple-processor systems that used shared memory.
As shown in Figure 3-1, segmentation provides a mechanism for dividing the processor’s addressable memory
space (called the linear address space) into smaller protected address spaces called segments. Segments can
be used to hold the code, data, and stack for a program or to hold system data structures (such as a TSS or LDT).
If more than one program (or task) is running on a processor, each program can be assigned its own set of
segments. The processor then enforces the boundaries between these segments and ensures that one program
does not interfere with the execution of another program by writing into the other program’s segments. The
segmentation mechanism also allows typing of segments so that the operations that may be performed on a partic-
ular type of segment can be restricted.
All the segments in a system are contained in the processor’s linear address space. To locate a byte in a particular
segment, a logical address (also called a far pointer) must be provided. A logical address consists of a segment
selector and an offset. The segment selector is a unique identifier for a segment. Among other things it provides an
offset into a descriptor table (such as the global descriptor table, GDT) to a data structure called a segment
descriptor. Each segment has a segment descriptor, which specifies the size of the segment, the access rights and
privilege level for the segment, the segment type, and the location of the first byte of the segment in the linear
address space (called the base address of the segment). The offset part of the logical address is added to the base
address for the segment to locate a byte within the segment. The base address plus the offset thus forms a linear
address in the processor’s linear address space.
Vol. 3A
3-1
PROTECTED-MODE MEMORY MANAGEMENT
Logical Address
(or Far Pointer)
Segment
Selector
Offset
Linear Address
Space
Linear Address
Global Descriptor
Dir
Table
Offset
Physical
Table (GDT)
Address
Space
Segment
Page Table
Segment
Page
Descriptor
Page Directory
Phy. Addr.
Lin. Addr.
Entry
Entry
Segment
Base Address
Page
Segmentation
Paging
Figure 3-1. Segmentation and Paging
If paging is not used, the linear address space of the processor is mapped directly into the physical address space
of processor. The physical address space is defined as the range of addresses that the processor can generate on
its address bus.
Because multitasking computing systems commonly define a linear address space much larger than it is economi-
cally feasible to contain all at once in physical memory, some method of “virtualizing” the linear address space is
needed. This virtualization of the linear address space is handled through the processor’s paging mechanism.
Paging supports a “virtual memory” environment where a large linear address space is simulated with a small
amount of physical memory (RAM and ROM) and some disk storage. When using paging, each segment is divided
into pages (typically 4 KBytes each in size), which are stored either in physical memory or on the disk. The oper-
ating system or executive maintains a page directory and a set of page tables to keep track of the pages. When a
program (or task) attempts to access an address location in the linear address space, the processor uses the page
directory and page tables to translate the linear address into a physical address and then performs the requested
operation (read or write) on the memory location.
If the page being accessed is not currently in physical memory, the processor interrupts execution of the program
(by generating a page-fault exception). The operating system or executive then reads the page into physical
memory from the disk and continues executing the program.
When paging is implemented properly in the operating-system or executive, the swapping of pages between phys-
ical memory and the disk is transparent to the correct execution of a program. Even programs written for 16-bit IA-
32 processors can be paged (transparently) when they are run in virtual-8086 mode.
3.2
USING SEGMENTS
The segmentation mechanism supported by the IA-32 architecture can be used to implement a wide variety of
system designs. These designs range from flat models that make only minimal use of segmentation to protect
3-2
Vol. 3A
PROTECTED-MODE MEMORY MANAGEMENT
programs to multi-segmented models that employ segmentation to create a robust operating environment in
which multiple programs and tasks can be executed reliably.
The following sections give several examples of how segmentation can be employed in a system to improve
memory management performance and reliability.
3.2.1
Basic Flat Model
The simplest memory model for a system is the basic “flat model,” in which the operating system and application
programs have access to a continuous, unsegmented address space. To the greatest extent possible, this basic flat
model hides the segmentation mechanism of the architecture from both the system designer and the application
programmer.
To implement a basic flat memory model with the IA-32 architecture, at least two segment descriptors must be
created, one for referencing a code segment and one for referencing a data segment (see Figure 3-2). Both of
these segments, however, are mapped to the entire linear address space: that is, both segment descriptors have
the same base address value of 0 and the same segment limit of 4 GBytes. By setting the segment limit to 4
GBytes, the segmentation mechanism is kept from generating exceptions for out of limit memory references, even
if no physical memory resides at a particular address. ROM (EPROM) is generally located at the top of the physical
address space, because the processor begins execution at FFFF_FFF0H. RAM (DRAM) is placed at the bottom of the
address space because the initial base address for the DS data segment after reset initialization is 0.
3.2.2
Protected Flat Model
The protected flat model is similar to the basic flat model, except the segment limits are set to include only the
range of addresses for which physical memory actually exists (see Figure 3-3). A general-protection exception
(#GP) is then generated on any attempt to access nonexistent memory. This model provides a minimum level of
hardware protection against some kinds of program bugs.
Linear Address Space
(or Physical Memory)
Segment
FFFFFFFFH
Registers
Code
CS
Code- and Data-Segment
Descriptors
Not Present
SS
DS
Access
Limit
Data and
Base Address
Stack
0
ES
FS
GS
Figure 3-2. Flat Model
Vol. 3A
3-3
PROTECTED-MODE MEMORY MANAGEMENT
Segment
Linear Address Space
Descriptors
(or Physical Memory)
Segment
Access
Limit
Registers
Code
FFFFFFFFH
Base Address
CS
Not Present
ES
Memory I/O
SS
Access
Limit
DS
Base Address
Data and
FS
Stack
GS
0
Figure 3-3. Protected Flat Model
More complexity can be added to this protected flat model to provide more protection. For example, for the paging
mechanism to provide isolation between user and supervisor code and data, four segments need to be defined:
code and data segments at privilege level 3 for the user, and code and data segments at privilege level 0 for the
supervisor. Usually these segments all overlay each other and start at address 0 in the linear address space. This
flat segmentation model along with a simple paging structure can protect the operating system from applications,
and by adding a separate paging structure for each task or process, it can also protect applications from each other.
Similar designs are used by several popular multitasking operating systems.
3.2.3
Multi-Segment Model
A multi-segment model (such as the one shown in Figure 3-4) uses the full capabilities of the segmentation mech-
anism to provide hardware enforced protection of code, data structures, and programs and tasks. Here, each
program (or task) is given its own table of segment descriptors and its own segments. The segments can be
completely private to their assigned programs or shared among programs. Access to all segments and to the
execution environments of individual programs running on the system is controlled by hardware.
3-4
Vol. 3A
PROTECTED-MODE MEMORY MANAGEMENT
Segment
Segment
Linear Address Space
Registers
Descriptors
(or Physical Memory)
Access
Limit
CS
Base Address
Stack
Access
Limit
SS
Base Address
Access
Limit
DS
Base Address
Code
Access
Limit
ES
Base Address
Data
Access
Limit
FS
Base Address
Data
Access
Limit
GS
Base Address
Data
Access
Limit
Base Address
Access
Limit
Base Address
Data
Access
Limit
Base Address
Access
Limit
Base Address
Figure 3-4. Multi-Segment Model
Access checks can be used to protect not only against referencing an address outside the limit of a segment, but
also against performing disallowed operations in certain segments. For example, since code segments are desig-
nated as read-only segments, hardware can be used to prevent writes into code segments. The access rights infor-
mation created for segments can also be used to set up protection rings or levels. Protection levels can be used to
protect operating-system procedures from unauthorized access by application programs.
3.2.4
Segmentation in IA-32e Mode
In IA-32e mode of Intel 64 architecture, the effects of segmentation depend on whether the processor is running
in compatibility mode or 64-bit mode. In compatibility mode, segmentation functions just as it does using legacy
16-bit or 32-bit protected mode semantics.
In 64-bit mode, segmentation is generally (but not completely) disabled, creating a flat 64-bit linear-address
space. The processor treats the segment base of CS, DS, ES, SS as zero, creating a linear address that is equal to
the effective address. The FS and GS segments are exceptions. These segment registers (which hold the segment
base) can be used as additional base registers in linear address calculations. They facilitate addressing local data
and certain operating system data structures.
Note that the processor does not perform segment limit checks at runtime in 64-bit mode.
3.2.5
Paging and Segmentation
Paging can be used with any of the segmentation models described in Figures 3-2, 3-3, and 3-4. The processor’s
paging mechanism divides the linear address space (into which segments are mapped) into pages (as shown in
Figure 3-1). These linear-address-space pages are then mapped to pages in the physical address space. The
paging mechanism offers several page-level protection facilities that can be used with or instead of the segment-
Vol. 3A
3-5
PROTECTED-MODE MEMORY MANAGEMENT
protection facilities. For example, it lets read-write protection be enforced on a page-by-page basis. The paging
mechanism also provides two-level user-supervisor protection that can also be specified on a page-by-page basis.
3.3
PHYSICAL ADDRESS SPACE
In protected mode, the IA-32 architecture provides a normal physical address space of 4 GBytes (232 bytes). This
is the address space that the processor can address on its address bus. This address space is flat (unsegmented),
with addresses ranging continuously from 0 to FFFFFFFFH. This physical address space can be mapped to read-
write memory, read-only memory, and memory mapped I/O. The memory mapping facilities described in this
chapter can be used to divide this physical memory up into segments and/or pages.
Starting with the Pentium Pro processor, the IA-32 architecture also supports an extension of the physical address
space to 236 bytes (64 GBytes); with a maximum physical address of FFFFFFFFFH. This extension is invoked in
either of two ways:
• Using the physical address extension (PAE) flag, located in bit 5 of control register CR4.
• Using the 36-bit page size extension (PSE-36) feature (introduced in the Pentium III processors).
Physical address support has since been extended beyond 36 bits. See Chapter 5, “Paging‚” for more information
about 36-bit physical addressing.
3.3.1
Intel® 64 Processors and Physical Address Space
On processors that support Intel 64 architecture (CPUID.80000001H:EDX[29] = 1), the size of the physical
address range is implementation-specific and indicated by CPUID.80000008H:EAX[7:0].
For the format of information returned in EAX, see “CPUID-CPU Identification” in Chapter 3 of the Intel® 64 and
IA-32 Architectures Software Developer’s Manual, Volume 2A. See also: Chapter 5, “Paging.”
MAXPHYADDR is derived from the value enumerated by CPUID.80000008H:EAX[7:0]. If
IA32_TME_ACTIVATE[0] = 1 (indicating that TME has been configured), MAXPHYADDR is reduced by the value of
IA32_TME_ACTIVATE[39:36] when a logical processor is outside secure arbitration mode (SEAM; see Chapter 35);
the value is not reduced in SEAM.
3.4
LOGICAL AND LINEAR ADDRESSES
At the system-architecture level in protected mode, the processor uses two stages of address translation to arrive
at a physical address: logical-address translation and linear address space paging.
Even with the minimum use of segments, every byte in the processor’s address space is accessed with a logical
address. A logical address consists of a 16-bit segment selector and a 32-bit offset (see Figure 3-5). The segment
selector identifies the segment the byte is located in and the offset specifies the location of the byte in the segment
relative to the base address of the segment.
The processor translates every logical address into a linear address. A linear address is a 32-bit address in the
processor’s linear address space. Like the physical address space, the linear address space is a flat (unsegmented),
232-byte address space, with addresses ranging from 0 to FFFFFFFFH. The linear address space contains all the
segments and system tables defined for a system.
To translate a logical address into a linear address, the processor does the following:
1. Uses the offset in the segment selector to locate the segment descriptor for the segment in the GDT or LDT and
reads it into the processor. (This step is needed only when a new segment selector is loaded into a segment
register.)
2. Examines the segment descriptor to check the access rights and range of the segment to ensure that the
segment is accessible and that the offset is within the limits of the segment.
3. Adds the base address of the segment from the segment descriptor to the offset to form a linear address.
3-6
Vol. 3A
PROTECTED-MODE MEMORY MANAGEMENT
15
0
31(63)
0
Logical
Seg. Selector
Offset (Effective Address)
Address
Descriptor Table
Base Address
Segment
+
Descriptor
31(63)
0
Linear Address
Figure 3-5. Logical Address to Linear Address Translation
If paging is not used, the processor maps the linear address directly to a physical address (that is, the linear
address goes out on the processor’s address bus). If the linear address space is paged, a second level of address
translation is used to translate the linear address into a physical address.
See also: Chapter 5, “Paging.”
3.4.1
Logical Address Translation in IA-32e Mode
In IA-32e mode, an Intel 64 processor uses the steps described above to translate a logical address to a linear
address. In 64-bit mode, the offset and base address of the segment are 64-bits instead of 32 bits. The linear
address format is also 64 bits wide and is subject to linear-address pre-processing (see Chapter 4).
Each code segment descriptor provides an L bit. This bit allows a code segment to execute 64-bit code or legacy
32-bit code by code segment.
3.4.2
Segment Selectors
A segment selector is a 16-bit identifier for a segment (see Figure 3-6). It does not point directly to the segment,
but instead points to the segment descriptor that defines the segment. A segment selector contains the following
items:
Index
(Bits 3 through 15) - Selects one of 8192 descriptors in the GDT or LDT. The processor multiplies
the index value by 8 (the number of bytes in a segment descriptor) and adds the result to the base
address of the GDT or LDT (from the GDTR or LDTR register, respectively).
TI (table indicator) flag
(Bit 2) - Specifies the descriptor table to use: clearing this flag selects the GDT; setting this flag
selects the current LDT.
15
3
2
1
0
T
Index
RPL
I
Table Indicator
0 = GDT
1 = LDT
Requested Privilege Level (RPL)
Figure 3-6. Segment Selector
Vol. 3A
3-7
PROTECTED-MODE MEMORY MANAGEMENT
Requested Privilege Level (RPL)
(Bits 0 and 1) - Specifies the privilege level of the selector. The privilege level can range from 0 to
3, with 0 being the most privileged level. See Section 6.5, “Privilege Levels,” for a description of the
relationship of the RPL to the CPL of the executing program (or task) and the descriptor privilege
level (DPL) of the descriptor the segment selector points to.
The first entry of the GDT is not used by the processor. A segment selector that points to this entry of the GDT (that
is, a segment selector with an index of 0 and the TI flag set to 0) is used as a “null segment selector.” The processor
does not generate an exception when a segment register (other than the CS or SS registers) is loaded with a null
selector. It does, however, generate an exception when a segment register holding a null selector is used to access
memory. A null selector can be used to initialize unused segment registers. Loading the CS or SS register with a null
segment selector causes a general-protection exception (#GP) to be generated.
Segment selectors are visible to application programs as part of a pointer variable, but the values of selectors are
usually assigned or modified by link editors or linking loaders, not application programs.
3.4.3
Segment Registers
To reduce address translation time and coding complexity, the processor provides registers for holding up to 6
segment selectors (see Figure 3-7). Each of these segment registers support a specific kind of memory reference
(code, stack, or data). For virtually any kind of program execution to take place, at least the code-segment (CS),
data-segment (DS), and stack-segment (SS) registers must be loaded with valid segment selectors. The processor
also provides three additional data-segment registers (ES, FS, and GS), which can be used to make additional data
segments available to the currently executing program (or task).
For a program to access a segment, the segment selector for the segment must have been loaded in one of the
segment registers. So, although a system can define thousands of segments, only 6 can be available for immediate
use. Other segments can be made available by loading their segment selectors into these registers during program
execution.
Visible Part
Hidden Part
Segment Selector
Base Address, Limit, Access Information
CS
SS
DS
ES
FS
GS
Figure 3-7. Segment Registers
Every segment register has a “visible” part and a “hidden” part. (The hidden part is sometimes referred to as a
“descriptor cache” or a “shadow register.”) When a segment selector is loaded into the visible part of a segment
register, the processor also loads the hidden part of the segment register with the base address, segment limit, and
access control information from the segment descriptor pointed to by the segment selector. The information cached
in the segment register (visible and hidden) allows the processor to translate addresses without taking extra bus
cycles to read the base address and limit from the segment descriptor. In systems in which multiple processors
have access to the same descriptor tables, it is the responsibility of software to reload the segment registers when
the descriptor tables are modified. If this is not done, an old segment descriptor cached in a segment register might
be used after its memory-resident version has been modified.
Two kinds of load instructions are provided for loading the segment registers:
1. Direct load instructions such as the MOV, POP, LDS, LES, LSS, LGS, and LFS instructions. These instructions
explicitly reference the segment registers.
2. Implied load instructions such as the far pointer versions of the CALL, JMP, and RET instructions, the SYSENTER
and SYSEXIT instructions, and the IRET, INT n, INTO, INT3, and INT1 instructions. These instructions change
3-8
Vol. 3A
PROTECTED-MODE MEMORY MANAGEMENT
the contents of the CS register (and sometimes other segment registers) as an incidental part of their
operation.
The MOV instruction can also be used to store the visible part of a segment register in a general-purpose register.
3.4.4
Segment Loading Instructions in IA-32e Mode
Because ES, DS, and SS segment registers are not used in 64-bit mode, their fields (base, limit, and attribute) in
segment descriptor registers are ignored. Some forms of segment load instructions are also invalid (for example,
LDS, POP ES). Address calculations that reference the ES, DS, or SS segments are treated as if the segment base
is zero.
The processor performs linear-address pre-processing (Chapter 4) instead of performing limit checks. Mode
switching does not change the contents of the segment registers or the associated descriptor registers. These
registers are also not changed during 64-bit mode execution, unless explicit segment loads are performed.
In order to set up compatibility mode for an application, segment-load instructions (MOV to Sreg, POP Sreg) work
normally in 64-bit mode. An entry is read from the system descriptor table (GDT or LDT) and is loaded in the hidden
portion of the segment register. The descriptor-register base, limit, and attribute fields are all loaded. However, the
contents of the data and stack segment selector and the descriptor registers are ignored.
When FS and GS segment overrides are used in 64-bit mode, their respective base addresses are used in the linear
address calculation: (FS or GS).base + index + displacement. FS.base and GS.base are then expanded to the full
linear-address size supported by the implementation. The resulting effective address calculation can wrap across
positive and negative addresses; the resulting address is subject to linear-address pre-processing.
In 64-bit mode, memory accesses using FS-segment and GS-segment overrides are not checked for a runtime limit
nor subjected to attribute-checking. Normal segment loads (MOV to Sreg and POP Sreg) into FS and GS load a
standard 32-bit base value in the hidden portion of the segment register. The base address bits above the standard
32 bits are cleared to 0 to allow consistency for implementations that use less than 64 bits.
The hidden descriptor register fields for FS.base and GS.base are physically mapped to MSRs in order to load all
address bits supported by a 64-bit implementation. Software with CPL = 0 (privileged software) can load all
supported linear-address bits into FS.base or GS.base using WRMSR. Addresses written into the 64-bit FS.base
and GS.base registers must be in canonical form. A WRMSR instruction that attempts to write a non-canonical
address to those registers causes a #GP fault. See Section 4.5.2.
When in compatibility mode, FS and GS overrides operate as defined by 32-bit mode behavior regardless of the
value loaded into the upper 32 linear-address bits of the hidden descriptor register base field. Compatibility mode
ignores the upper 32 bits when calculating an effective address.
A new 64-bit mode instruction, SWAPGS, can be used to load GS base. SWAPGS exchanges the kernel data struc-
ture pointer from the IA32_KERNEL_GS_BASE MSR with the GS base register. The kernel can then use the GS
prefix on normal memory references to access the kernel data structures. An attempt to write a non-canonical
value (using WRMSR) to the IA32_KERNEL_GS_BASE MSR causes a #GP fault; see Section 4.5.2.
3.4.5
Segment Descriptors
A segment descriptor is a data structure in a GDT or LDT that provides the processor with the size and location of
a segment, as well as access control and status information. Segment descriptors are typically created by
compilers, linkers, loaders, or the operating system or executive, but not application programs. Figure 3-8 illus-
trates the general descriptor format for all types of segment descriptors.
Vol. 3A
3-9
PROTECTED-MODE MEMORY MANAGEMENT
31
2423 22 21 20 19
16 15 14 13 12 11
8
7
0
D
A
Seg.
D
Base 31:24
G
/
L
V
Limit
P
P
S
Type
Base 23:16
4
B
L
19:16
L
31
16 15
0
Base Address 15:00
Segment Limit 15:00
0
L
- 64-bit code segment (IA-32e mode only)
AVL
- Available for use by system software
BASE - Segment base address
D/B
- Default operation size (0 = 16-bit segment; 1 = 32-bit segment)
DPL
- Descriptor privilege level
G
- Granularity
LIMIT - Segment Limit
P
- Segment present
S
- Descriptor type (0 = system; 1 = code or data)
TYPE - Segment type
Figure 3-8. Segment Descriptor
The flags and fields in a segment descriptor are as follows:
Segment limit field
Specifies the size of the segment. The processor puts together the two segment limit fields to form
a 20-bit value. The processor interprets the segment limit in one of two ways, depending on the
setting of the G (granularity) flag:
• If the granularity flag is clear, the segment size can range from 1 byte to 1 MByte, in byte incre-
ments.
• If the granularity flag is set, the segment size can range from 4 KBytes to 4 GBytes, in 4-KByte
increments.
The processor uses the segment limit in two different ways, depending on whether the segment is
an expand-up or an expand-down segment. See Section 3.4.5.1, “Code- and Data-Segment
Descriptor Types,” for more information about segment types. For expand-up segments, the offset
in a logical address can range from 0 to the segment limit. Offsets greater than the segment limit
generate general-protection exceptions (#GP, for all segments other than SS) or stack-fault excep-
tions (#SS for the SS segment). For expand-down segments, the segment limit has the reverse
function; the offset can range from the segment limit plus 1 to FFFFFFFFH or FFFFH, depending on
the setting of the B flag. Offsets less than or equal to the segment limit generate general-protection
exceptions or stack-fault exceptions. Decreasing the value in the segment limit field for an expand-
down segment allocates new memory at the bottom of the segment's address space, rather than at
the top. IA-32 architecture stacks always grow downwards, making this mechanism convenient for
expandable stacks.
Base address fields
Defines the location of byte 0 of the segment within the 4-GByte linear address space. The
processor puts together the three base address fields to form a single 32-bit value. Segment base
addresses should be aligned to 16-byte boundaries. Although 16-byte alignment is not required,
this alignment allows programs to maximize performance by aligning code and data on 16-byte
boundaries.
Type field
Indicates the segment or gate type and specifies the kinds of access that can be made to the
segment and the direction of growth. The interpretation of this field depends on whether the
descriptor type flag specifies an application (code or data) descriptor or a system descriptor. The
encoding of the type field is different for code, data, and system descriptors (see Figure 6-1). See
Section 3.4.5.1, “Code- and Data-Segment Descriptor Types,” for a description of how this field is
used to specify code and data-segment types.
3-10
Vol. 3A
PROTECTED-MODE MEMORY MANAGEMENT
S (descriptor type) flag
Specifies whether the segment descriptor is for a system segment (S flag is clear) or a code or data
segment (S flag is set).
DPL (descriptor privilege level) field
Specifies the privilege level of the segment. The privilege level can range from 0 to 3, with 0 being
the most privileged level. The DPL is used to control access to the segment. See Section 6.5, “Priv-
ilege Levels,” for a description of the relationship of the DPL to the CPL of the executing code
segment and the RPL of a segment selector.
P (segment-present) flag
Indicates whether the segment is present in memory (set) or not present (clear). If this flag is clear,
the processor generates a segment-not-present exception (#NP) when a segment selector that
points to the segment descriptor is loaded into a segment register. Memory management software
can use this flag to control which segments are actually loaded into physical memory at a given
time. It offers a control in addition to paging for managing virtual memory.
Figure 3-9 shows the format of a segment descriptor when the segment-present flag is clear. When
this flag is clear, the operating system or executive is free to use the locations marked “Available” to
store its own data, such as information regarding the whereabouts of the missing segment.
D/B (default operation size/default stack pointer size and/or upper bound) flag
Performs different functions depending on whether the segment descriptor is an executable code
segment, an expand-down data segment, or a stack segment. (This flag should always be set to 1
for 32-bit code and data segments and to 0 for 16-bit code and data segments.)
• Executable code segment. The flag is called the D flag and it indicates the default length for
effective addresses and operands referenced by instructions in the segment. If the flag is set,
32-bit addresses and 32-bit or 8-bit operands are assumed; if it is clear, 16-bit addresses and
16-bit or 8-bit operands are assumed.
The instruction prefix 66H can be used to select an operand size other than the default, and the
prefix 67H can be used select an address size other than the default.
• Stack segment (data segment pointed to by the SS register). The flag is called the B (big)
flag and it specifies the size of the stack pointer used for implicit stack operations (such as
pushes, pops, and calls). If the flag is set, a 32-bit stack pointer is used, which is stored in the
32-bit ESP register; if the flag is clear, a 16-bit stack pointer is used, which is stored in the 16-
bit SP register. If the stack segment is set up to be an expand-down data segment (described in
the next paragraph), the B flag also specifies the upper bound of the stack segment.
• Expand-down data segment. The flag is called the B flag and it specifies the upper bound of
the segment. If the flag is set, the upper bound is FFFFFFFFH (4 GBytes); if the flag is clear, the
upper bound is FFFFH (64 KBytes).
31
16 15 14 13 12 11
8 7
0
D
Available
0
P
S
Type
Available
4
L
31
0
Available
0
Figure 3-9. Segment Descriptor When Segment-Present Flag Is Clear
G (granularity) flag
Determines the scaling of the segment limit field. When the granularity flag is clear, the segment
limit is interpreted in byte units; when flag is set, the segment limit is interpreted in 4-KByte units.
(This flag does not affect the granularity of the base address; it is always byte granular.) When the
granularity flag is set, the twelve least significant bits of an offset are not tested when checking the
Vol. 3A
3-11