Content      ..     58      59      60      61     ..

Intel 64 and IA-32 Architectures. Software Developer’s Manual (2026) - page 60

PERFORMANCE MONITORING

Architectural PEBS / Architectural PerfMon does not mandate a particular sequence for enabling counting. However,

our clear recommendation is to enable IA32_PERF_GLOBAL_CTRL last / disable it first as it provides atomic

starting/stopping of the counters.

To reiterate, the PEBS enable bits are distributed per counter, unlike the “global” register in model-specific PEBS.

22.10.2.2 Record Data

The CPU writes a PEBS Record for each counter that has overflowed at the instruction boundary. Each PEBS Record

contains a header followed by a collection of record groups. The header contains information about the size of the

PEBS record and a bit vector indicating the presence of selected record groups. Available record groups are the

Basic group, the Memory Auxiliary group, the General-Purpose Registers group, the XSAVE-Enabled Registers

group, the Last Branch Records group, and the Performance-Monitoring Counters group. The Basic group is present

by default in PEBS records as it includes necessary data for processing a record. These groups are listed in Table

22-109 and described in detail in Section 22.10.4

Table 22-109. Architectural PEBS Configuration Locations

Register/Format

Bit Description

31

30

29

28:24

23:17

16:10

9:8

7:3

2:0

CPUID.23H.04H:EBX

0

AUX

GPR

0

XER

0

LBR

CNTR/A

0

63

62

61

60:56

55:49

48:42

41:40

39:35

34:32

IA32_PMC_GPn_CFG_C

PEBS_EN

AUX

GPR

MBZ

XER

MBZ

LBR

CNTR/A

MBZ

IA32_PMC_FXm_CFG_C

63

62

61

60:56

55:49

48:42

41:40

39:35

PEBS Record Format

BASIC

AUX

GPR

RSVD

XER

RSVD

LBR

CNTR/

RSVD

RSVD

22.10.2.3 Programming PEBS

This section lists the programming guidelines¹ that system software should follow in the specified order. Then, it

illustrates the behavior through an example.

22.10.2.3.1 Programming Guidelines at Initialization Phase

1. Disable counting globally.

2. Setup the PEBS output buffer via the IA32_PEBS_BASE and IA32_PEBS_INDEX registers.

3. Configure counter(s).²

a. Configure a performance-monitoring event into a counter.³

1) Select a performance-monitoring event via the IA32_PMC_GPn_CFG_A MSR for general-purpose

counters. This step does not apply for fixed-function counters.

2) Set CPL filters via the IA32_PMC_GPn_CFG_A MSR for general-purpose counters or via the

IA32_FIXED_CTR_CTRL MSR for fixed-function counters.

1. The first and last steps in both lists may rely on IA32_PERF_GLOBAL_CTRL. Architectural PEBS and Architectural Performance-Mon-

itoring do not mandate a particular sequence for enabling counting. However, the recommendation is to enable IA32_PERF_-

GLOBAL_CTRL last or disable it first, as it provides atomic starting and stopping of the counters and ensures the least disruption to

profiling.

2. This step may be repeated for each counter that software wishes to generate a PEBS record, at initialization, or when another event

is configured (e.g., event-counter multiplexing usage).

3. The counter registers are accessed in the IA32_PMC_GPn_CTR MSR for general-purpose counter n, or in the IA32_PMC_FXm_CTR

MSR for fixed-function counter m.

22-170

Vol. 3B

PERFORMANCE MONITORING

a. Locally enable it by setting the CPL bits IA32_FIXED_CTR_CTRL.[USR1|OS1]. This counter counts

CPU_CLK_UNHALTED.THREAD - Unhalted Core Cycles.

b. Set the PEBS_EN[63] bit in the IA32_PMC_FX1_CFG_C MSR (address 1987H). This enables PEBS.

c. Put the 32-bit reload value into IA32_PMC_FX1_CFG_C.RELOAD_VALUE.

d. Set the AUX[62] bit and GPR[61] bit in the IA32_PMC_FX1_CFG_C MSR. This includes the AUX and GPR

groups in the record.

5. Re-enable counting globally by setting bits 1 and 33 in the IA32_PERF_GLOBAL_CTRL MSR to start counting on

both counters. See Chapter 2 in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume

4, for details of the MSR.

When the general-purpose counter and the fixed-function counter overflow, the two records are written to memory.

General Purpose Counter 1

Fixed Counter 1

Header Information

Header Information

Basic Group

Basic Group

AUX Group

GPR Group

Figure 22-74. Example PEBS Record

22.10.3 Model-Specific Registers (MSRs)

The Architectural PEBS MSRs are IA32_PEBS_BASE, IA32_PEBS_INDEX, IA32_PMC_GPn_CFG_C, and

IA32_PMC_FXm_CFG_C.

22.10.3.1 IA32_PEBS_BASE MSR

Figure 22-75 shows the layout of the IA32_PEBS_BASE MSR, the Output Buffer Base Register MSR.

63

12 11

4 3

0

Reserved

PHYS_ADDR

Reserved

SIZE

PHYS_ADDR: Base physical address.

SIZE: Output buffer size.

Reserved

Figure 22-75. IA32_PEBS_BASE Register

22-172

Vol. 3B

PERFORMANCE MONITORING

The functions of the flags and fields are:

• SIZE, bits 3:0 - Specifies the output buffer size in powers of 2, where buffer size = 4 KB * 2^SIZE, e.g., SIZE

= 7 results in a 512 KB output buffer and SIZE = 9 results in a 2 MB output buffer. The maximum SIZE value is

15, or 128 MB output buffer.

• PHYS_ADDR, bits (MAXPHYADDR - 1):12 - Specifies the value of the base physical address of a single,

contiguous physical output region.

The MSR is initialized to all zeros on reset.

22.10.3.2 IA32_PEBS_INDEX MSR

Figure 22-76 shows the layout of the IA32_PEBS_INDEX MSR, the Output Buffer Index Register MSR.

63

58

36

32 31

26

4 3

0

F

U

THRESH_OFFSET

WR_OFFSET

L

L

THRESH_OFFSET

THRESH_EN

FULL

WR_OFFSET

Reserved

Figure 22-76. IA32_PEBS_INDEX Register

The functions of the flags and fields are:

• WR_OFFSET, bits 26:4 - Specifies the value of the next-byte-to-write offset from IA32_-

PEBS_BASE.PHYS_ADDR.

• FULL, bit 31 - When set, the output buffer is full, and no further records will be generated.

• THRESH_EN, bit 32 - When set, the PMI threshold is enabled.

• THRESH_OFFSET, bits 58:36 - Specifies the value of bits [26:4] of the PMI threshold offset from the output

buffer base.

The MSR is initialized to all zeros on reset.

22.10.3.3 IA32_PMC_GPn_CFG_C and IA32_PMC_FXm_CFG_C MSRs

Table 22-110 shows the layout of the Performance Event Select Extended Register MSRs. The IA32_PMC_G-

Pn_CFG_C MSR is the Event Select Extended register for a general-purpose counter, while the IA32_PMC_FX-

m_CFG_C MSR is the Event Select Extended register for a fixed-function counter, where n and m are the counter

numbers.

Vol. 3B

22-173

PERFORMANCE MONITORING

Table 22-110. IA32_PMC_GPn_CFG_C and IA32_PMC_FXm_CFG_C MSRs

Register Address: Hex, Decimal

Register Name

Register Information / Bit Fields

Bit Description

Scope

Register Address:

IA32_PMC_GPn_CFG_C

1903H, 1907H, …, 1903H+(4*n),

6403, 6407, ..., 6403 +(4*n)

Extended Performance Event Selector for GP Counter x (R/W)

For general-purpose counters, the IA32_PMC_GPn_CFG_C MSR is available if either CPUID.23H.05H:EAX[n] or

CPUID.03H.02H:EAX[n] is set. Reserved bits must be zero.

31:0

RELOAD_VALUE (R/W)

Contains the reload value to be loaded into the associated counter by

Auto Counter Reload. It will be 1-extended to 48 bits.

34:32

Reserved.

35

ALLOW_IN_RECORD (R/W)

If 1, indicates that this counter's value will be included in the PEBS record

if the associated CNTR subgroup is enabled.

38:36

CNTR (R/W)

When any bit is set, the counter group will be included in the PEBS record.

Bit 36: If 1, the general-purpose counters subgroup will be included.

Bit 37: If 1, the fixed-function counters subgroup will be included.

Bit 38: If 1, the performance metrics subgroup will be included and will be

reset

39

Reserved.

41:40

LBR (R/W)

Identifies the number of Last Branch Records (LBRs) to record. The

encodings of this field are as follows:

•

00 - LBR group will not be recorded. The group is disabled.

•

01 - 8 LBRs will be recorded.

•

10 - 16 LBRs will be recorded.

•

11 - The number of LBRs to be recorded is IA32_LBR_DEPTH.DEPTH.

48:42

Reserved.

55:49

XER (R/W)

When set, enables particular XSAVE-Enabled Registers to be included in

the PEBS record. The encodings for the register subgroup are:

• Bit 49 - SSER: Record XMM0-XMM15.

• Bit 50 - YMMHIR: Record the upper 128 bits of YMM0-YMM15.

• Bit 51 - EGPR: Record R16-R31.

• Bit 52 - Reserved and must be zero.

• Bit 53 - OPMASKR: Record K0-K7.

• Bit 54 - ZMMHIR: Record the upper 256 bits of ZMM0-ZMM15.

• Bit 55 - Hi16ZMMR: Record ZMM16-ZMM31.

60:56

Reserved.

61

GPR (R/W)

If 1, enables the General-Purpose Registers Group to be included in the

PEBS record.

62

AUX (R/W)

If 1, enables the Auxiliary Group to be included in the PEBS record.

63

PEBS (R/W)

If 1, PEBS is enabled for this counter.

22-174

Vol. 3B

PERFORMANCE MONITORING

Table 22-110. IA32_PMC_GPn_CFG_C and IA32_PMC_FXm_CFG_C MSRs (Contd.)

Register Address: Hex, Decimal

Register Name

Register Information / Bit Fields

Bit Description

Scope

Register Address:

IA32_PMC_FXm_CFG_C

1983H, 1987H, …, 1983H+(4*m),

6531, 6535, ..., 6531 +(4*m)

Extended Performance Event Selector for Fixed-Function Counter x (R/W)

For fixed-function counters, the IA32_PMC_FXm_CFG_C MSR is available if either CPUID.23H.05H:ECX[m] or

CPUID.23H.02H:EBX[m] is set. Reserved bits must be zero.

63:0

This MSR has identical bit definitions to the IA32_PMC_GPn_CFG_C MSR.

The functions of the flags and fields are:

• RELOAD_VALUE, bits 31:0 - Selects a 32-bit value loaded into IA32_PMC_GPn_CTR when a PEBS record is

generated due to counter n. For a 48-bit counter, the value will be 1-extended into a 48-bit value.

• ALLOW_IN_RECORD, bit 35 - When set, indicates that this counter's value will be included in the PEBS

record if the associated CNTR subgroup is enabled.

• CNTR, bits 38:36 - When any bit is set, the counter group will be included in the PEBS record. If bit 36 is set,

the general-purpose counters subgroup will be included. If bit 37 is set, the fixed-function counters subgroup

will be included. If bit 38 is set, the performance metrics subgroup will be included and reset.

• LBR, bits 41:40 - Identifies the number of Last Branch Records (LBRs) to record. The encodings of this field are

as follows:

•

00 - LBR group will not be recorded. The group is disabled.

•

01 - 8 LBRs will be recorded.

•

10 - 16 LBRs will be recorded.

•

11 - The number of LBRs to be recorded is IA32_LBR_DEPTH.DEPTH.

• XER, bits 55:49 - When set, enables particular XSAVE-Enabled Registers to be included in the PEBS record.

The encodings for the register subgroup are:

• Bit 49 - SSER: Record XMM0-XMM15.

• Bit 50 - YMMHIR: Record the upper 128 bits of YMM0-YMM15.

• Bit 51 - EGPR: Record R16-R31.

• Bit 53 - OPMASKR: Record K0-K7.

• Bit 54 - ZMMHIR: Record the upper 256 bits of ZMM0-ZMM15.

• Bit 55 - Hi16ZMMR: Record ZMM16-ZMM31.

• GPR, bit 61 - When set, this field enables the General-Purpose Registers group to be included in the PEBS

record.

• AUX, bit 62 - When set, this field enables the Auxiliary group to be included in the PEBS record.

• PEBS_EN, bit 63 - When set, PEBS is enabled for this counter.

On reset, the MSR is initialized to all zeros.

22.10.3.4 Changes from Legacy PEBS

The following MSRs are removed and generate a #GP exception on any attempt to read or write them:

• IA32_PEBS_ENABLE

• MSR_PEBS_DATA_CFG

Architectural PEBS does not use the IA32_DS_AREA MSR, but it is maintained for BTS use.

Vol. 3B

22-175

PERFORMANCE MONITORING

Bits 32, 36, 40, and 44 of IA32_PMC_FXm_CFG_C.ADAPTIVE_RECORD_CTRm will report 0 on a RDMSR and will

generate a #GP exception on an attempt to set them. The same results occur with IA32_PMC_GPn_CFG.Adaptive

PEBS for all general-purpose counters. See Section 22.9.2.1 for more information.

The IA32_ PERF_GLOBAL_STATUS, IA32_ PERF_GLOBAL_STATUS _RESET, and IA32_PERF_GLOBAL_STATUS_SET

MSRs are modified by adding a bit, ARCH_PEBS[54]:

• The processor clears IA32_ PERF_GLOBAL_STATUS[54]=0 on a software write of 1 to

IA32_PERF_GLOBAL_STATUS_RESET[54].

• The processor sets IA32_ PERF_GLOBAL_STATUS[54]=1 on a software write of 1 to

IA32_PERF_GLOBAL_STATUS_SET[54].

See Section 22.2.4.2 for more information.

22.10.4 Records and Groups

All records begin with a 16-byte header, shown in Figure 22-77, which includes the 8-byte PEBS record format. The

record format contains the following:

• The bit vector indicating the groups in the record

• The record size, which may include end padding (see Section 22.10.4.7)

• Other indicator bits

The remaining 8 bytes in the header are reserved.

127

64 63

32 31 30 29

16 15

0

Reserved

Groups

Reserved

Record Size

Continued

64-bit Mode

Figure 22-77. PEBS Record Format

The record size is a 16-bit field containing the size of the generated record (the header plus the groups) in bytes,

with a maximum size of 64 kilobytes. A record always starts at a 16-byte aligned address. The size may include

padding at the end for alignment reasons. The padding bytes would be stale and not written by the processor.

The Continued bit indicates that the record has additional groups in subsequent record fragments. See Section

22.10.4.7 for an example.

A record continues in the architecturally defined group order: Basic group, Memory Auxiliary group, General-

Purpose Registers group, XSAVE-Enabled Registers group, Last Branch Records group, and finally, Performance-

Monitoring Counters group. The record is also compacted to place only those groups indicated in the bit vector

contiguously.

All groups are aligned along 16-byte boundaries and multiples of 16 bytes. Some groups have reserved fields and

subfields to preserve alignment requirements. Most groups have a predetermined size, though some are variable.

A processor may dump groups/fields in any temporal order, not necessarily per their offset.

22.10.4.1 Basic Group

22-176

Vol. 3B

PERFORMANCE MONITORING

The Basic group is present in all complete PEBS records (see Section 22.10.4.7). The group size is 48 bytes and

consists of the Instruction Pointer, Applicable Counter, Time-Stamp Counter, and Retire Latency fields. The final two

fields in the group, each consisting of 8 bytes, are reserved for future growth.

Table 22-111 lists the Basic group's fields and the offset from the start of the Basic group. Each field is 64 bits wide.

Table 22-111. Basic Group Fields

Field Name

Byte Offset

Instruction Pointer

00H

Applicable Counter

08H

Time-Stamp Counter

10H

Retire Latency

18H

Reserved

20H

Reserved

28H

22.10.4.1.1 Instruction Pointer

The Instruction Pointer field holds the RIP register value¹ of the instruction that retired immediately before emitting

the PEBS record. This field is sometimes historically referred to as “EventingIP.”

For precise events, this is the instruction that triggered PEBS record generation. For non-precise events, this is

some instruction when the counter overflows without necessarily stopping at the causing instruction.

If a record was generated immediately after execution just became “in context” for a given counter, then the

Instruction Pointer of that record is considered “out of context.” A -1 value denotes an out-of-context Instruction

Pointer. This behavior avoids leaking information across contexts.

Note that the Instruction Pointer field differs from the RIP field in the General-Purpose Registers group, which

records the instruction pointer of the next instruction to be executed after record generation. Also, when not in 64-

bit mode, the upper 32 bits will be zero.

22.10.4.1.2 Applicable Counter

This field indicates which counter(s) triggered the generation of the PEBS record.

Figure 22-78 shows the mapping of the various one-hot counter bits in the PEBS record. IA32_PMC[i-1:0] is the bit

vector of general purpose counters, where IA32_PMC0 starts at bit 0, and i is the maximum general purpose

counter ID supported. IA32_FIXED_CTR[32+j-1:32] is the bit vector of fixed counters, where IA32_FIXED_CTR0

starts at bit 32, and j is the maximum fixed counter ID supported. Bits that do not correspond to counters identified

in Section 22.2.9 are reserved.

1. RIP register without the CS register base.

Vol. 3B

22-177

PERFORMANCE MONITORING

63

32 + m-1 ... 35 34 33 32 31

n … 2

1

0

Reserved

Reserved

IA32_FIXED_CTR3

IA32_FIXED_CTR2

IA32_FIXED_CTR1

IA32_FIXED_CTR0

IA32_PMC(n-1)

IA32_PMC1

IA32_PMC0

Figure 22-78. Bit Mapping of Applicable Counters in the PEBS Record

22.10.4.1.3 Time-Stamp Counter

The time-stamp counter is a 64-bit counter set to 0 following a processor reset. After a reset, the counter incre-

ments even when the HLT instruction or the external STPCLK# pin halts the processor.

The time-stamp counter will reflect the value of the counter when the record is generated, and it will include the

offset and scale adjustments even if RDTSC Exiting is enabled (i.e., no exit taken). It is the same as Intel Processor

Trace.

For more details, see Section 20.17, “Time-Stamp Counter,” of the Intel® 64 and IA-32 Architectures Software

Developer’s Manual, Volume 3B.

22.10.4.1.4 Retire Latency

The Retire Latency field in the record will consist of:

• Retire Latency field, bits 15:0 - Indicates the elapsed cycles between the retirement of the architecturally-

visible instruction that caused PEBS and the prior instruction retirement. The measurement reflects core

unhalted cycles (at the pace of Fixed-Function Counter 1) and is reported for any PEBS, regardless of whether

precise or non-precise events are programmed. The count saturates at 216-1.

• Retire Latency Valid flag, bit 16 - A valid bit for the Retire Latency field. When set, the Retire Latency field

holds a valid value.

• Reserved field, bits 63:17 - Reserved for future use.

22.10.4.2 Auxiliary Group

The Auxiliary (AUX) group is home to custom fields, often without ties to the state of a particular processor archi-

tectural feature and without architectural registers. The AUX group size is 64 bytes, consisting of 8 fields of 8 bytes

each. The first 8-byte field is the Memory Access Address, followed by seven 8-byte reserved fields, as shown in

Table 22-112. A named reserved field may have processor-dependent implementation.

22-178

Vol. 3B

PERFORMANCE MONITORING

Table 22-116. Counter Group Details

METRICS

FIXED

GP

Bit

Reserved

ALLOW_IN_RECORD

Subgroup

Subgroup

Subgroup

CPUID.23H.04H:EBX

7

6

5

4

3

IA32_PMC_GPn_CFG_C

39

38

37

36

35

IA32_PMC_FXm_CFG_C

PEBS Record Format

39

38

37

36

35

Group Header Bits

127:96

95:94

63:32

31:0

N/A

Consider the following example using general-purpose counters, where:

• IA32_PMC_GP0_CFG_C.{ALLOW=1, GP=1}

• IA32_PMC_GP1_CFG_C.ALLOW=1

• IA32_PMC_GP2_CFG_C.ALLOW=0

If general-purpose counter 0 generates a PEBS record, it includes general-purpose counter 0 and general-purpose

counter 1 (but not general-purpose counter 2 because its ALLOW bit was clear).

If general-purpose counter 1 or general-purpose counter 2 generates a PEBS record, it does not include any

counters because all METRICS, FIXED, and GP bits were clear for general-purpose counter 1 and general-purpose

counter 2.

22.10.4.7 Fragmented Records

A PEBS record can be split into n fragments that comprise the complete record. Fragmented records can help miti-

gate the contiguous buffer when PEBS2GPA is used. See Section 22.10.5.1 for information about PEBS2GPA and

Chapter 31, “VMX Support for Address Translation” of the Intel® 64 and IA-32 Architectures Software Developer’s

Manual, Volumes 3C, for EPT details.

Each fragment of the complete record has a header and a subset of the groups. The first n-1 fragments will have

their Continued[31] bit set to 1 to indicate that the record has additional groups in subsequent record fragments.

The last fragment will have its Continued bit clear.

If there is empty space between record fragments, then either the Record Size field may indicate padding (i.e.,

having a value larger than the required size as described in Section 22.10.4) or a NULL record will be inserted. A

NULL record is an empty record where only the Record Size field is non-zero (group indicators, the Continued bit,

and other fields are clear).

For example, suppose that a complete record consists of two fragments, record 4 and record 5, which cross an EPT

page boundary as shown in Figure 22-79. In the top portion of Figure 22-79, record 4 includes some of the

requested groups and padding to abut the end of the page, and it has its Continued bit set to 1. In the lower part

of Figure 22-79, record 4 includes some of the requested groups with no padding (it has its Continued bit set to 1)

and the Null Record is at the end of the page. Record 5 contains the remaining groups in both instances, with the

Continued bit clear.

Vol. 3B

22-183

PERFORMANCE MONITORING

Complete Record

EPT Page Boundary

Base

End

Record

Record

Record

Record

Record 4

Padding

Record 5

0

1

2

3

Write Offset

Complete Record

EPT Page Boundary

Base

End

Record

Record

Record

Record

Record

Null

Record 5

0

1

2

3

4

Record

Write Offset

Figure 22-79. Example of a Fragmented Record

Guest Physical Memory

Platform Physical Memory

GPA

Contents

PPA

Contents

Output Base

0x0000

0x0000

Header FUTURE, Sz=2056B (16B)

Output Wr Offset

0x0FC0

Header BASIC CONT Sz=16+32+16 = 64B

0x0010

FUTURE Group (2040B)

0x0FD0

Basic Group (32B)

0x0808

0x0FF0

<old contents> (16B)

0x0FF8

0x1000

Header VECR, LBR CONT Sz=2936+1160 = 4096B (16B)

0x1000

0x1010

VECR (2112B)

0x1850

LBR Group (816B)

0x1B80

<old contents> (16B)

0x1B80

0x2000

Header FUTURE, Sz=2056B (16B)

0x2000

Header VECR, LBR CONT Sz=2936+1160 = 4096B (16B)

0x2010

FUTURE Group (2040B)

0x2010

VECR (2112B)

Next Wr Offset

0x2810

0x2850

LBR Group (816B)

0x2B80

<old contents> (16B)

0x2B80

0x3000

0x3000

0x3FC0

Header BASIC CONT Sz=16+32+16 = 64B

0x3FD0

Basic Group (32B)

0x3FF0

<old contents> (16B)

0x0FF8

**Note that the Group sizes may have changed and are for illustrative purposes.

Figure 22-80. EPT Page Boundary Example with Included Padding

22-184

Vol. 3B

PERFORMANCE MONITORING

22.10.5 Interactions with Other Processor Features

22.10.5.1 Virtualization

In the context of virtualization, PEBS has dedicated support for either of two usages: system-wide use and guest-

only use.

With system-wide use, PEBS operation can persist across VMX transitions. A VMM would allocate the PEBS buffer

using a physical base address, and PEBS would use the resulting addresses in both VMX root operation and VMX

non-root operation. Counters configured for PEBS would always be enabled (by suitable management of the

IA32_PERF_GLOBAL_CTRL MSR), possibly hidden from guests. As a result, the relevant counters should continue

counting across VMX transitions. This ensures that the counters and the PEBS record information are system-wide.

In this use case, the host owns counter/PEBS configuration, manages the PEBS output buffer, and assures the

counter/PEBS state persists across guests, as illustrated by Figure 22-81.

Guest 2

Guest 1

Secure Guest 3

Uses CTR

Host

System Software

Host Memory

PMU Layer

Interrupt Handler

Counter/

PEBS

PMI

PEBS Management

Records

Platform

Core with Architectural PEBS

Figure 22-81. System-Wide PEBS: Diagram of Interactions Across Entities

To support the guest-only use case, the CPU defines a VM-execution control called “PEBS uses guest physical

addresses.” When this control is set, the addresses used by PEBS in VMX non-root operation are treated as guest-

physical addresses and are translated through EPT (see Section 28.5.5, “Translation of Guest-Physical Addresses

Used by Architectural PEBS”). A VMM setting this control can allow guest software to manage the IA32_PEBS_BASE

MSR, as the MSR would be interpreted as having a guest-physical address.

To enable the guest-only PEBS use case, a VMM should set this VM-execution control and allocate the PEBS buffer

using guest-physical addresses. Additionally, counters should be enabled only in VMX non-root operation for that

guest (by suitable management of the IA32_PERF_GLOBAL_CTRL MSR). In other words, on VM exit from the

Vol. 3B

22-185

PERFORMANCE MONITORING

guest, the counters should be stopped, and on VM entry back to the guest, the counters should be resumed. This

ensures that the counters and the PEBS record information belong to that guest.

In this use case, the guest owns counter/PEBS configuration, manages the PEBS output buffer, and switches the

counter/PEBS state across applications inside that guest. The host can simply pass through the PEBS and counter

management handling to that guest as illustrated by Figure 22-82.

Guest

System Software

Guest

PMU Layer

Interrupt Handler

Memory

VMM

Counter/

PEBS

PMI

PEBS Management

Records

Platform

Core with Architectural PEBS

Figure 22-82. Guest-Only PEBS: Diagram of Interactions Across Entities

Other use cases, e.g., host-only, are possible but must be managed by the VMM.

22.10.5.2 Intel® Secure Guard Extensions (Intel® SGX)

For production (opt-out) enclaves, an enclave entry freezes counters, except fixed-function counters 1 and 2

(unhalted core cycles and unhalted reference cycles, respectively). Additionally, handling any PEBS event that may

occur during an enclave execution is deferred until after the enclave exit, i.e., the PEBS event would skid to the end

of EEXIT/AEX. Specifically, the instruction pointer field of the PEBS record would have the EENTER/ERESUME

address and the Memory Access Address (MAA) field would be zero.

For non-production (opt-in) enclaves, all counters continue to count. Any PEBS event that may occur during

enclave execution would be handled normally. Specifically, fields of the PEBS record would expose the non-produc-

tion enclave state.

Architectural PEBS will write nothing to memory in the case where the PEBS buffer is mapped to the Processor

Reserved Memory Range Register (PRMRR). Writes are directed to the abort page.

22-186

Vol. 3B

8086 EMULATION

19

4

3

0

Base

16-bit Segment Selector

0 0 0 0

+

19

16

15

0

Offset

0 0 0 0

16-bit Effective Address

=

19

0

Linear

20-bit Linear Address

Address

Figure 23-1. Real-Address Mode Address Translation

The IA-32 processors beginning with the Intel386 processor can generate 32-bit offsets using an address override

prefix; however, in real-address mode, the value of a 32-bit offset may not exceed FFFFH without causing an

exception.

For full compatibility with Intel 286 real-address mode, pseudo-protection faults (interrupt 12 or 13) occur if a 32-

bit offset is generated outside the range 0 through FFFFH.

23.1.2 Registers Supported in Real-Address Mode

The register set available in real-address mode includes all the registers defined for the 8086 processor plus the

new registers introduced in later IA-32 processors, such as the FS and GS segment registers, the debug registers,

the control registers, and the floating-point unit registers. The 32-bit operand prefix allows a real-address mode

program to use the 32-bit general-purpose registers (EAX, EBX, ECX, EDX, ESP, EBP, ESI, and EDI).

23.1.3 Instructions Supported in Real-Address Mode

The following instructions make up the core instruction set for the 8086 processor. If backwards compatibility to

the Intel 286 and Intel 8086 processors is required, only these instructions should be used in a new program

written to run in real-address mode.

• Move (MOV) instructions that move operands between general-purpose registers, segment registers, and

between memory and general-purpose registers.

• The exchange (XCHG) instruction.

• Load segment register instructions LDS and LES.

• Arithmetic instructions ADD, ADC, SUB, SBB, MUL, IMUL, DIV, IDIV, INC, DEC, CMP, and NEG.

• Logical instructions AND, OR, XOR, and NOT.

• Decimal instructions DAA, DAS, AAA, AAS, AAM, and AAD.

• Stack instructions PUSH and POP (to general-purpose registers and segment registers).

• Type conversion instructions CWD, CDQ, CBW, and CWDE.

• Shift and rotate instructions SAL, SHL, SHR, SAR, ROL, ROR, RCL, and RCR.

• TEST instruction.

• Control instructions JMP, Jcc, CALL, RET, LOOP, LOOPE, and LOOPNE.

• Interrupt instructions INT n, INTO, and IRET.

• EFLAGS control instructions STC, CLC, CMC, CLD, STD, LAHF, SAHF, PUSHF, and POPF.

• I/O instructions IN, INS, OUT, and OUTS.

• Load effective address (LEA) instruction, and translate (XLATB) instruction.

Vol. 3B

23-3

8086 EMULATION

5. Transfers program control to the location specified in the interrupt vector table.

An IRET instruction at the end of the handler procedure reverses these steps to return program control to the inter-

rupted program. Exceptions do not return error codes in real-address mode.

The interrupt vector table is an array of 4-byte entries (see Figure 23-2). Each entry consists of a far pointer to a

handler procedure, made up of a segment selector and an offset. The processor scales the interrupt or exception

vector by 4 to obtain an offset into the interrupt table. Following reset, the base of the interrupt vector table is

located at physical address 0 and its limit is set to 3FFH. In the Intel 8086 processor, the base address and limit of

the interrupt vector table cannot be changed. In the later IA-32 processors, the base address and limit of the inter-

rupt vector table are contained in the IDTR register and can be changed using the LIDT instruction.

(For backward compatibility to Intel 8086 processors, the default base address and limit of the interrupt vector

table should not be changed.)

Up to Entry 255

Entry 3

12

Entry 2

8

Entry 1

4

2

Segment Selector

Interrupt Vector 0*

Offset

0

15

0

* Interrupt vector number 0 selects entry 0

IDTR

(called “interrupt vector 0”) in the interrupt

vector table. Interrupt vector 0 in turn

points to the start of the interrupt handler

for interrupt 0.

Figure 23-2. Interrupt Vector Table in Real-Address Mode

Table 23-1 shows the interrupt and exception vectors that can be generated in real-address mode and virtual-8086

mode, and in the Intel 8086 processor. See Chapter 7, “Interrupt and Exception Handling‚” for a description of the

exception conditions.

23.2

VIRTUAL-8086 MODE

Virtual-8086 mode is actually a special type of a task that runs in protected mode. When the operating-system or

executive switches to a virtual-8086-mode task, the processor emulates an Intel 8086 processor. The execution

environment of the processor while in the 8086-emulation state is the same as is described in Section 23.1, “Real-

Address Mode,” for real-address mode, including the extensions. The major difference between the two modes is

that in virtual-8086 mode the 8086 emulator uses some protected-mode services (such as the protected-mode

interrupt and exception-handling and paging facilities).

Vol. 3B

23-5

8086 EMULATION

Real Mode

Code

Real-Address

Mode

PE=0 or

PE=1

RESET

Task Switch

Protected-

CALL

Protected

Protected-

VM=0

Mode Interrupt

Virtual-8086

Mode

Mode Tasks

and Exception

Monitor

Handlers

RET

Task Switch¹

VM = 0

VM = 1

Interrupt or

Exception²

Virtual-8086

Mode

Virtual-8086

#GP Exception³

RESET

Mode Tasks

(8086

IRET⁴

Programs)

IRET⁵

Redirect Interrupt to 8086 Program

Interrupt or Exception Handler⁶

NOTES:

1. Task switch carried out in either of two ways:

- CALL or JMP where the VM flag in the EFLAGS image is 1.

- IRET where VM is 1 and NT is 1.

2. Hardware interrupt or exception; software interrupt (INT n) when IOPL is 3.

3. General-protection exception caused by software interrupt (INT n), IRET,

POPF, PUSHF, IN, or OUT when IOPL is less than 3.

4. Normal return from protected-mode interrupt or exception handler.

5. A return from the 8086 monitor to redirect an interrupt or exception back

to an interrupt or exception handler in the 8086 program running in virtual-

8086 mode.

6. Internal redirection of a software interrupt (INT n) when VME is 1,

IOPL is <3, and the redirection bit is 1.

Figure 23-3. Entering and Leaving Virtual-8086 Mode

23.2.6 Leaving Virtual-8086 Mode

The processor can leave the virtual-8086 mode only through an interrupt or exception. The following are situations

where an interrupt or exception will lead to the processor leaving virtual-8086 mode (see Figure 23-3):

• The processor services a hardware interrupt generated to signal the suspension of execution of the virtual-

8086 application. This hardware interrupt may be generated by a timer or other external mechanism. Upon

receiving the hardware interrupt, the processor enters protected mode and switches to a protected-mode (or

another virtual-8086 mode) task either through a task gate in the protected-mode IDT or through a trap or

interrupt gate that points to a handler that initiates a task switch. A task switch from a virtual-8086 task to

another task loads the EFLAGS register from the TSS of the new task. The value of the VM flag in the new

EFLAGS determines if the new task executes in virtual-8086 mode or not.

• The processor services an exception caused by code executing the virtual-8086 task or services a hardware

interrupt that “belongs to” the virtual-8086 task. Here, the processor enters protected mode and services the

Vol. 3B

23-9

8086 EMULATION

3. Clears the segment registers. Saving the DS, ES, FS, and GS registers on the stack and then clearing the

registers lets the interrupt or exception handler safely save and restore these registers regardless of the type

segment selectors they contain (protected-mode or 8086-style). The interrupt and exception handlers, which

may be called in the context of either a protected-mode task or a virtual-8086-mode task, can use the same

code sequences for saving and restoring the registers for any task. Clearing these registers before execution of

the IRET instruction does not cause a trap in the interrupt handler. Interrupt procedures that expect values in

the segment registers or that return values in the segment registers must use the register images saved on the

stack for privilege level 0.

4. Clears VM, NT, RF, and TF flags (in the EFLAGS register). If the gate is an interrupt gate, clears the IF flag.

5. Begins executing the selected interrupt or exception handler.

If the trap or interrupt gate references a procedure in a conforming segment or in a segment at a privilege level

other than 0, the processor generates a general-protection exception (#GP). Here, the error code is the segment

selector of the code segment to which a call was attempted.

Without Error Code

With Error Code

ESP from

ESP from

Unused

Unused

TSS

TSS

Old GS

Old GS

Old FS

Old FS

Old DS

Old DS

Old ES

Old ES

Old SS

Old SS

Old ESP

Old ESP

Old EFLAGS

Old EFLAGS

Old CS

Old CS

Old EIP

New ESP

Old EIP

Error Code

New ESP

Figure 23-4. Privilege Level 0 Stack After Interrupt or Exception in Virtual-8086 Mode

Interrupt and exception handlers can examine the VM flag on the stack to determine if the interrupted procedure

was running in virtual-8086 mode. If so, the interrupt or exception can be handled in one of three ways:

• The protected-mode interrupt or exception handler that was called can handle the interrupt or exception.

• The protected-mode interrupt or exception handler can call the virtual-8086 monitor to handle the interrupt or

exception.

• The virtual-8086 monitor (if called) can in turn pass control back to the 8086 program’s interrupt and exception

handler.

If the interrupt or exception is handled with a protected-mode handler, the handler can return to the interrupted

program in virtual-8086 mode by executing an IRET instruction. This instruction loads the EFLAGS and segment

registers from the images saved in the privilege level 0 stack (see Figure 23-4). A set VM flag in the EFLAGS image

causes the processor to switch back to virtual-8086 mode. The CPL at the time the IRET instruction is executed

must be 0, otherwise the processor does not change the state of the VM flag.

The virtual-8086 monitor runs at privilege level 0, like the protected-mode interrupt and exception handlers. It is

commonly closely tied to the protected-mode general-protection exception (#GP, vector 13) handler. If the

Vol. 3B

23-13

8086 EMULATION

The IOPL value interacts with the VME flag and the bits in the interrupt redirection bit map to determine how

specific software interrupts should be handled.

The software interrupt redirection bit map (see Figure 23-5) is a 32-byte field in the TSS. This map is located

directly below the I/O permission bit map in the TSS. Each bit in the interrupt redirection bit map is mapped to an

interrupt vector. Bit 0 in the interrupt redirection bit map (which maps to vector zero in the interrupt table) is

located at the I/O base map address in the TSS minus 32 bytes. When a bit in this bit map is set, it indicates that

the associated software interrupt (interrupt generated with an INT n instruction) should be handled through the

protected-mode IDT and interrupt and exception handlers. When a bit in this bit map is clear, the processor redi-

rects the associated software interrupt back to the interrupt table in the 8086 program (located at linear address 0

in the program’s address space).

NOTE

The software interrupt redirection bit map does not affect hardware generated interrupts and

exceptions. Hardware generated interrupts and exceptions are always handled by the protected-

mode interrupt and exception handlers.

Table 23-2. Software Interrupt Handling Methods While in Virtual-8086 Mode

Bit in

Redir.

Method

VME

IOPL

Bitmap*

Processor Action

1

0

3

X

Interrupt directed to a protected-mode interrupt handler:

• Switches to privilege-level 0 stack.

• Pushes GS, FS, DS, and ES onto privilege-level 0 stack.

• Pushes SS, ESP, EFLAGS, CS, and EIP of interrupted task onto privilege-level 0 stack.

• Clears VM, RF, NT, and TF flags.

• If serviced through interrupt gate, clears IF flag.

• Clears GS, FS, DS, and ES to 0.

• Sets CS and EIP from interrupt gate.

2

0

< 3

X

Interrupt directed to protected-mode general-protection exception (#GP) handler.

3

1

< 3

1

Interrupt directed to a protected-mode general-protection exception (#GP) handler; VIF and VIP

flag support for handling class 2 maskable hardware interrupts.

4

1

3

1

Interrupt directed to protected-mode interrupt handler: (see method 1 processor action).

5

1

3

0

Interrupt redirected to 8086 program interrupt handler:

• Pushes EFLAGS.

• Pushes CS and EIP (lower 16 bits only).

• Clears IF flag.

• Clears TF flag.

• Loads CS and EIP (lower 16 bits only) from selected entry in the interrupt vector table of the

current virtual-8086 task.

6

1

< 3

0

Interrupt redirected to 8086 program interrupt handler; VIF and VIP flag support for handling class

2 maskable hardware interrupts:

• Pushes EFLAGS with IOPL set to 3 and VIF copied to IF.

• Pushes CS and EIP (lower 16 bits only).

• Clears the VIF flag.

• Clears TF flag.

• Loads CS and EIP (lower 16 bits only) from selected entry in the interrupt vector table of the

current virtual-8086 task.

NOTE:

* When set to 0, software interrupt is redirected back to the 8086 program interrupt handler; when set to 1, interrupt is directed to

protected-mode handler.

Vol. 3B

23-17

8086 EMULATION

31

24 23

Task-State Segment (TSS)

0

Last byte of

1

1

1

1

1

1

1

1

bit

map must be

I/O Permission Bit Map

Software Interrupt Redirection Bit Map (32 Bytes)

I/O Map Base

64H

I/O map

base must

not exceed

DFFFH.

0

Figure 23-5. Software Interrupt Redirection Bit Map in TSS

Redirecting software interrupts back to the 8086 program potentially speeds up interrupt handling because a

switch back and forth between virtual-8086 mode and protected mode is not required. This latter interrupt-

handling technique is particularly useful for 8086 operating systems (such as MS-DOS) that use the INT n instruc-

tion to call operating system procedures.

The CPUID instruction can be used to verify that the virtual mode extension is implemented on the processor. Bit 1

of the feature flags register (EDX) indicates the availability of the virtual mode extension (see “CPUID-CPU Iden-

tification” in Chapter 3, “Instruction Set Reference, A-L,” of the Intel^® 64 and IA-32 Architectures Software Devel-

oper’s Manual, Volume 2A).

The following sections describe the six methods (or mechanisms) for handling software interrupts in virtual-8086

mode. See Section 23.3.2, “Class 2-Maskable Hardware Interrupt Handling in Virtual-8086 Mode Using the Virtual

Interrupt Mechanism,” for a description of the use of the VIF and VIP flags in the EFLAGS register for handling

maskable hardware interrupts.

23.3.3.1 Method 1: Software Interrupt Handling

When the VME flag in control register CR4 is clear and the IOPL field is 3, a Pentium or later IA-32 processor

handles software interrupts in the same manner as they are handled by an Intel386 or Intel486 processor. It

executes an implicit call to the interrupt handler in the protected-mode IDT pointed to by the interrupt vector. See

Section 23.3.1, “Class 1-Hardware Interrupt and Exception Handling in Virtual-8086 Mode,” for a complete

description of this mechanism and its possible uses.

23.3.3.2 Methods 2 and 3: Software Interrupt Handling

When a software interrupt occurs in virtual-8086 mode and the method 2 or 3 conditions are present, the processor

generates a general-protection exception (#GP). Method 2 is enabled when the VME flag is set to 0 and the IOPL

value is less than 3. Here the IOPL value is used to bypass the protected-mode interrupt handlers and cause any

software interrupt that occurs in virtual-8086 mode to be treated as a protected-mode general-protection excep-

tion (#GP). The general-protection exception handler calls the virtual-8086 monitor, which can then emulate an

8086-program interrupt handler or pass control back to the 8086 program’s handler, as described in Section

23.3.1.2, “Handling an Interrupt or Exception With an 8086 Program Interrupt or Exception Handler.”

Method 3 is enabled when the VME flag is set to 1, the IOPL value is less than 3, and the corresponding bit for the

software interrupt in the software interrupt redirection bit map is set to 1. Here, the processor performs the same

23-18

Vol. 3B

CHAPTER 24

MIXING 16-BIT AND 32-BIT CODE

Program modules written to run on IA-32 processors can be either 16-bit modules or 32-bit modules. Table 24-1

shows the characteristic of 16-bit and 32-bit modules.

Table 24-1. Characteristics of 16-Bit and 32-Bit Program Modules

Characteristic

16-Bit Program Modules

32-Bit Program Modules

Segment Size

0 to 64 KBytes

0 to 4 GBytes

Operand Sizes

8 bits and 16 bits

8 bits and 32 bits

Pointer Offset Size (Address Size)

16 bits

32 bits

Stack Pointer Size

16 Bits

32 Bits

Control Transfers Allowed to Code Segments

16 Bits

32 Bits

of This Size

The IA-32 processors function most efficiently when executing 32-bit program modules. They can, however, also

execute 16-bit program modules, in any of the following ways:

• In real-address mode.

• In virtual-8086 mode.

• System management mode (SMM).

• As a protected-mode task, when the code, data, and stack segments for the task are all configured as a 16-bit

segments.

• By integrating 16-bit and 32-bit segments into a single protected-mode task.

• By integrating 16-bit operations into 32-bit code segments.

Real-address mode, virtual-8086 mode, and SMM are native 16-bit modes. A legacy program assembled and/or

compiled to run on an Intel 8086 or Intel 286 processor should run in real-address mode or virtual-8086 mode

without modification. Sixteen-bit program modules can also be written to run in real-address mode for handling

system initialization or to run in SMM for handling system management functions. See Chapter 23, “8086 Emula-

tion,” for detailed information on real-address mode and virtual-8086 mode; see Chapter 34, “System Manage-

ment Mode,” for information on SMM.

This chapter describes how to integrate 16-bit program modules with 32-bit program modules when operating in

protected mode and how to mix 16-bit and 32-bit code within 32-bit code segments.

24.1

DEFINING 16-BIT AND 32-BIT PROGRAM MODULES

The following IA-32 architecture mechanisms are used to distinguish between and support 16-bit and 32-bit

segments and operations:

• The D (default operand and address size) flag in code-segment descriptors.

• The B (default stack size) flag in stack-segment descriptors.

•

16-bit and 32-bit call gates, interrupt gates, and trap gates.

• Operand-size and address-size instruction prefixes.

•

16-bit and 32-bit general-purpose registers.

The D flag in a code-segment descriptor determines the default operand-size and address-size for the instructions

of a code segment. (In real-address mode and virtual-8086 mode, which do not use segment descriptors, the

default is 16 bits.) A code segment with its D flag set is a 32-bit segment; a code segment with its D flag clear is a

16-bit segment.

Vol. 3B

24-1

MIXING 16-BIT AND 32-BIT CODE

Without Privilege Transition

After 16-bit Call

After 32-bit Call

31

0

31

0

PARM 2

PARM 1

PARM 2

Stack

Growth

CS

IP

SP

PARM 1

CS

EIP

ESP

With Privilege Transition

After 16-bit Call

After 32-bit Call

31

0

31

0

SS

SP

SS

PARM 2

PARM 1

ESP

Stack

Growth

CS

IP

SP

PARM 2

PARM 1

CS

EIP

ESP

Undefined

Figure 24-1. Stack after Far 16- and 32-Bit Calls

While executing 32-bit code, if a call is made to a 16-bit code segment which is at the same or a more privileged

level (that is, the DPL of the called code segment is less than or equal to the CPL of the calling code segment)

through a 16-bit call gate, then the upper 16-bits of the ESP register may be unreliable upon returning to the 32-

bit code segment (that is, after executing a RET in the 16-bit code segment).

When the CALL instruction and its matching RET instruction are in code segments that have D flags with the same

values (that is, both are 32-bit code segments or both are 16-bit code segments), the default settings may be

used. When the CALL instruction and its matching RET instruction are in segments which have different D-flag

settings, an operand-size prefix must be used.

24.4.2.1 Controlling the Operand-Size Attribute For a Call

Three things can determine the operand-size of a call:

• The D flag in the segment descriptor for the calling code segment.

• An operand-size instruction prefix.

• The type of call gate (16-bit or 32-bit), if a call is made through a call gate.

When a call is made with a pointer (rather than a call gate), the D flag for the calling code segment determines the

operand-size for the CALL instruction. This operand-size attribute can be overridden by prepending an operand-

size prefix to the CALL instruction. So, for example, if the D flag for a code segment is set for 16 bits and the

operand-size prefix is used with a CALL instruction, the processor will cause the information stored on the stack to

Vol. 3B

24-5

ARCHITECTURE COMPATIBILITY

25.11 MULTI-CORE TECHNOLOGY

The Pentium D processor and Pentium processor Extreme Edition provide two processor cores in each physical

processor package. See also: Section 11.5, “Intel® Hyper-Threading Technology and Intel® Multi-Core Tech-

nology,” and Section 11.8, “Multi-Core Architecture.” Intel Core 2 Duo, Intel Pentium Dual-Core processors, Intel

Xeon processors 3000, 3100, 5100, 5200 series provide two processor cores in each physical processor package.

Intel Core 2 Extreme, Intel Core 2 Quad processors, Intel Xeon processors 3200, 3300, 5300, 5400, 7300 series

provide two processor cores in each physical processor package.

25.12 SPECIFIC FEATURES OF DUAL-CORE PROCESSOR

Dual-core processors may have some processor-specific features. Use CPUID feature flags to detect the availability

features. Note the following:

• CPUID Brand String - On Pentium processor Extreme Edition, the process will report the correct brand string

only after the correct microcode updates are loaded.

• Enhanced Intel SpeedStep Technology - This feature is supported in Pentium D processor but not in

Pentium processor Extreme Edition.

25.13 NEW INSTRUCTIONS IN THE PENTIUM AND LATER IA-32 PROCESSORS

Table 25-1 identifies the instructions introduced into the IA-32 in the Pentium processor and later IA-32 processors.

25.13.1 Instructions Added Prior to the Pentium Processor

The following instructions were added in the Intel486 processor:

• BSWAP (byte swap) instruction.

• XADD (exchange and add) instruction.

• CMPXCHG (compare and exchange) instruction.

• ΙNVD (invalidate cache) instruction.

• WBINVD (write-back and invalidate cache) instruction.

• INVLPG (invalidate TLB entry) instruction.

Table 25-1. New Instruction in the Pentium Processor and Later IA-32 Processors

Instruction

CPUID Identification Bits

Introduced In

CMOVcc (conditional move)

EDX, Bit 15

Pentium Pro processor

FCMOVcc (floating-point conditional move)

EDX, Bits 0 and 15

FCOMI (floating-point compare and set EFLAGS)

EDX, Bits 0 and 15

RDPMC (read performance monitoring counters)

EAX, Bits 8-11, set to 6H;

see Note 1

UD2 (undefined)

EAX, Bits 8-11, set to 6H

25-4

Vol. 3B

ARCHITECTURE COMPATIBILITY

Table 25-1. New Instruction in the Pentium Processor and Later IA-32 Processors (Contd.)

Instruction

CPUID Identification Bits

Introduced In

CMPXCHG8B (compare and exchange 8 bytes)

EDX, Bit 8

Pentium processor

CPUID (CPU identification)

None; see Note 2

RDTSC (read time-stamp counter)

EDX, Bit 4

RDMSR (read model-specific register)

EDX, Bit 5

WRMSR (write model-specific register)

EDX, Bit 5

MMX Instructions

EDX, Bit 23

NOTES:

1. The RDPMC instruction was introduced in the P6 family of processors and added to later model Pentium processors. This instruc-

tion is model specific in nature and not architectural.

2. The CPUID instruction is available in all Pentium and P6 family processors and in later models of the Intel486 processors. The ability

to set and clear the ID flag (bit 21) in the EFLAGS register indicates the availability of the CPUID instruction.

The following instructions were added in the Intel386 processor:

• LSS, LFS, and LGS (load SS, FS, and GS registers).

• Long-displacement conditional jumps.

• Single-bit instructions.

• Bit scan instructions.

• Double-shift instructions.

• Byte set on condition instruction.

• Move with sign/zero extension.

• Generalized multiply instruction.

• MOV to and from control registers.

• MOV to and from test registers (now obsolete).

• MOV to and from debug registers.

• RSM (resume from SMM). This instruction was introduced in the Intel386 SL and Intel486 SL processors.

The following instructions were added in the Intel 387 math coprocessor:

• FPREM1.

• FUCOM, FUCOMP, and FUCOMPP.

25.14 OBSOLETE INSTRUCTIONS

The MOV to and from test registers instructions were removed from the Pentium processor and future IA-32

processors. Execution of these instructions generates an invalid-opcode exception (#UD).

25.15 UNDEFINED OPCODES

All new instructions defined for Intel 64 and IA-32 processors use binary encodings that were reserved on earlier-

generation processors. Generally, attempting to execute a reserved opcode results in an invalid-opcode (#UD)

exception being generated. Consequently, programs that execute correctly on earlier-generation processors

cannot erroneously execute these instructions and thereby produce unexpected results when executed on later

Intel 64 processors.

For compatibility with prior generations, there are a few reserved opcodes which do not result in a #UD but rather

result in the same behavior as certain defined instructions. In the interest of standardization, it is recommended

Vol. 3B

25-5

ARCHITECTURE COMPATIBILITY

Table 25-2. Recommended Values of the EM, MP, and NE Flags for Intel486 SX Microprocessor/Intel 487 SX Math

Coprocessor System

CR0 Flags

Intel486 SX Processor Only

Intel 487 SX Math Coprocessor Present

EM

1

0

MP

0

1

NE

1

0, for MS-DOS* systems

1, for user-defined exception handler

The EM and MP flags in register CR0 are interpreted as shown in Table 25-3.

Table 25-3. EM and MP Flag Interpretation

EM

MP

Interpretation

0

0

Floating-point instructions are passed to FPU; WAIT/FWAIT and other waiting-type instructions

ignore TS.

0

1

Floating-point instructions are passed to FPU; WAIT/FWAIT and other waiting-type instructions

test TS.

1

0

Floating-point instructions trap to emulator; WAIT/FWAIT and other waiting-type instructions

ignore TS.

1

1

Floating-point instructions trap to emulator; WAIT/FWAIT and other waiting-type instructions

test TS.

Following is an example code sequence to initialize the system and check for the presence of Intel486 SX

processor/Intel 487 SX math coprocessor.

fninit

fstcw mem_loc

mov ax, mem_loc

cmp ax, 037fh

jz Intel487_SX_Math_CoProcessor_present

;ax=037fh

jmp Intel486_SX_microprocessor_present

;ax=ffffh

If the Intel 487 SX math coprocessor is not present, the following code can be run to set the CR0 register for the

Intel486 SX processor.

mov eax, cr0

and eax, fffffffdh ;make MP=0

or eax, 0024h

;make EM=1, NE=1

mov cr0, eax

This initialization will cause any floating-point instruction to generate a device not available exception (#NM), inter-

rupt 7. The software emulation will then take control to execute these instructions. This code is not required if an

Intel 487 SX math coprocessor is present in the system. In that case, the typical initialization routine for the

Intel486 SX microprocessor will be adequate.

Also, when designing an Intel486 SX processor based system with an Intel 487 SX math coprocessor, timing loops

should be independent of frequency and clocks per instruction. One way to attain this is to implement these loops

in hardware and not in software (for example, BIOS).

25.21 CONTROL REGISTERS

The following sections identify the new control registers and control register flags and fields that were introduced

to the 32-bit IA-32 in various processor families. See Figure 2-7 for the location of these flags and fields in the

control registers.

Vol. 3B

25-17

Content      ..     58      59      60      61     ..