Intel ARCHITECTURE IA-32 User Manual

IA-32 Intel® ArchitectureSoftware Developer’s ManualVolume 3A:System Programming Guide, Part 1NOTE: The IA-32 Intel Architecture Software Developer&ap

CONTENTSxVol. 3APAGE8.10 APIC BUS MESSAGE PASSING MECHANISM ANDPROTOCOL (P6 FAMILY, PENTIUM PROCESSORS). . . . . . . . . . . . . . . . . . . . . 8-42

3-20 Vol. 3APROTECTED-MODE MEMORY MANAGEMENT3.5.2 Segment Descriptor Tables in IA-32e ModeIn IA-32e mode, a segment descriptor table can contain up to

Vol. 3A 3-21PROTECTED-MODE MEMORY MANAGEMENTaccessed for a long time. See Section 3.12, “Translation Lookaside Buffers (TLBs)”, for moreinformation on

3-22 Vol. 3APROTECTED-MODE MEMORY MANAGEMENT3.6.2 Page Tables and Directories in the Absence of Intel EM64TThe information that the processor uses to

Vol. 3A 3-23PROTECTED-MODE MEMORY MANAGEMENT3.7.1 Linear Address Translation (4-KByte Pages)Figure 3-12 shows the page directory and page-table hierar

3-24 Vol. 3APROTECTED-MODE MEMORY MANAGEMENTTo select the various table entries, the linear address is divided into three sections: • Page-directory e

Vol. 3A 3-25PROTECTED-MODE MEMORY MANAGEMENTNOTE(For the Pentium processor only.) When enabling or disabling large pagesizes, the TLBs must be invalid

3-26 Vol. 3APROTECTED-MODE MEMORY MANAGEMENT3.7.6 Page-Directory and Page-Table EntriesFigure 3-14 shows the format for the page-directory and page-ta

Vol. 3A 3-27PROTECTED-MODE MEMORY MANAGEMENT(Page-directory entries for 4-KByte page tables) — Specifies the physicaladdress of the first byte of a pa

3-28 Vol. 3APROTECTED-MODE MEMORY MANAGEMENT3. Invalidate the current page-table entry in the TLB (see Section 3.12,“Translation Lookaside Buffers (TL

Vol. 3A 3-29PROTECTED-MODE MEMORY MANAGEMENTThis flag is a “sticky” flag, meaning that once set, the processor does notimplicitly clear it. Only softw

Vol. 3A xiCONTENTSPAGE9.11.6.4 Update in a System Supporting Dual-Core Technology . . . . . . . . . . . . . . . . 9-469.11.6.5 Update Loader Enhancem

3-30 Vol. 3APROTECTED-MODE MEMORY MANAGEMENTin the TLB when register CR3 is loaded or a task switch occurs. This flag isprovided to prevent frequently

Vol. 3A 3-31PROTECTED-MODE MEMORY MANAGEMENTWhen the PAE paging mechanism is enabled, the processor supports two sizes of pages:4-KByte and 2-MByte. A

3-32 Vol. 3APROTECTED-MODE MEMORY MANAGEMENTTo select the various table entries, the linear address is divided into three sections: • Page-directory-p

Vol. 3A 3-33PROTECTED-MODE MEMORY MANAGEMENTCR4 has no affect on the page size when PAE is enabled.) With the PS flag set, the linear addressis divide

3-34 Vol. 3APROTECTED-MODE MEMORY MANAGEMENT3.8.5 Page-Directory and Page-Table Entries With Extended Addressing EnabledFigure 3-20 shows the format f

Vol. 3A 3-35PROTECTED-MODE MEMORY MANAGEMENTFigure 3-20. Format of Page-Directory-Pointer-Table, Page-Directory, and Page-Table Entries for 4-KByte P

3-36 Vol. 3APROTECTED-MODE MEMORY MANAGEMENTThe base physical address in an entry specifies the following, depending on the type of entry:• Page-direc

Vol. 3A 3-37PROTECTED-MODE MEMORY MANAGEMENTAccess (A) and dirty (D) flags (bits 5 and 6) are provided for table entries that point to pages.Bits 9, 1

3-38 Vol. 3APROTECTED-MODE MEMORY MANAGEMENTFigure 3-23 shows the format for the page-directory entries when 4-MByte pages and 36-bitphysical addresse

Vol. 3A 3-39PROTECTED-MODE MEMORY MANAGEMENT3.10 PAE-ENABLED PAGING IN IA-32E MODEIntel EM64T 64-bit extensions expand physical address extension (PAE

CONTENTSxiiVol. 3APAGE10.11.3.1 Base and Mask Calculations with Intel EM64T. . . . . . . . . . . . . . . . . . . . . . .10-3310.11.4 Range Size and Al

3-40 Vol. 3APROTECTED-MODE MEMORY MANAGEMENT3.10.2 IA-32e Mode Linear Address Translation (2-MByte Pages)Figure 3-25 shows the PML4 table, page-direct

Vol. 3A 3-41PROTECTED-MODE MEMORY MANAGEMENT• Page-directory entry — Bits 29:21 provide an offset to an entry in the page directory. Theselected entry

3-42 Vol. 3APROTECTED-MODE MEMORY MANAGEMENTExcept for bit 63, functions of the flags in these entries are as described in Section 3.7.6, “Page-Direct

Vol. 3A 3-43PROTECTED-MODE MEMORY MANAGEMENT• The base physical address field in each entry is extended to 28 bits if the processor’simplementation su

3-44 Vol. 3APROTECTED-MODE MEMORY MANAGEMENTIf the execute disable bit is enabled in an IA-32 processor, the reserved bits in paging data struc-tures

Vol. 3A 3-45PROTECTED-MODE MEMORY MANAGEMENT3.11 MAPPING SEGMENTS TO PAGESThe segmentation and paging mechanisms provide in the IA-32 architecture sup

3-46 Vol. 3APROTECTED-MODE MEMORY MANAGEMENT3.12 TRANSLATION LOOKASIDE BUFFERS (TLBS)The processor stores the most recently used page-directory and pa

Vol. 3A 3-47PROTECTED-MODE MEMORY MANAGEMENT• Implicitly by executing a task switch, which automatically changes the contents of the CR3register.The I

3-48 Vol. 3APROTECTED-MODE MEMORY MANAGEMENT

4Protection

Vol. 3A xiiiCONTENTSPAGECHAPTER 13POWER AND THERMAL MANAGEMENT13.1 ENHANCED INTEL SPEEDSTEP® TECHNOLOGY . . . . . . . . . . . . . . . . . . . . . . .

Vol. 3A 4-1CHAPTER 4PROTECTIONIn protected mode, the IA-32 architecture provides a protection mechanism that operates at boththe segment level and the

4-2 Vol. 3APROTECTIONthat is based on privilege levels can essentially be disabled while still in protected mode byassigning a privilege level of 0 (m

Vol. 3A 4-3PROTECTION• Read/write (R/W) flag — (Bit 1 of a page-directory or page-table entry.) Determines thetype of access allowed to a page: read o

4-4 Vol. 3APROTECTIONMany different styles of protection schemes can be implemented with these fields and flags.When the operating system creates a de

Vol. 3A 4-5PROTECTION4.3 LIMIT CHECKINGThe limit field of a segment descriptor prevents programs or procedures from addressingmemory locations outside

4-6 Vol. 3APROTECTIONFor expand-down data segments, the segment limit has the same function but is interpreteddifferently. Here, the effective limit s

Vol. 3A 4-7PROTECTION• When a segment selector is loaded into a segment register — Certain segment registerscan contain only certain descriptor types,

4-8 Vol. 3APROTECTION— On a call or jump through a call gate (or on an interrupt- or exception-handler callthrough a trap or interrupt gate), the proc

Vol. 3A 4-9PROTECTIONThe processor uses privilege levels to prevent a program or task operating at a lesser privilegelevel from accessing a segment wi

CONTENTSxivVol. 3APAGE15.2 VIRTUAL-8086 MODE. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15-715.2.1 En

4-10 Vol. 3APROTECTION— Nonconforming code segment (without using a call gate) — The DPL indicates theprivilege level that a program or task must be a

Vol. 3A 4-11PROTECTION4.6 PRIVILEGE LEVEL CHECKING WHEN ACCESSING DATA SEGMENTSTo access operands in a data segment, the segment selector for the data

4-12 Vol. 3APROTECTION4. The procedure in code segment D should be able to access data segment E because codesegment D’s CPL is numerically less than

Vol. 3A 4-13PROTECTION4.6.1 Accessing Data in Code SegmentsIn some instances it may be desirable to access data structures that are contained in a cod

4-14 Vol. 3APROTECTIONA JMP or CALL instruction can reference another code segment in any of four ways:• The target operand contains the segment selec

Vol. 3A 4-15PROTECTION• The DPL of the segment descriptor for the destination code segment that contains thecalled procedure. • The RPL of the segment

4-16 Vol. 3APROTECTIONThe RPL of the segment selector that points to a nonconforming code segment has a limitedeffect on the privilege check. The RPL

Vol. 3A 4-17PROTECTIONIn the example in Figure 4-7, code segment D is a conforming code segment. Therefore, callingprocedures in both code segment A a

4-18 Vol. 3APROTECTION4.8.3 Call GatesCall gates facilitate controlled transfers of program control between different privilege levels.They are typica

Vol. 3A 4-19PROTECTIONNote that the P flag in a gate descriptor is normally always set to 1. If it is set to 0, a not present(#NP) exception is genera

Vol. 3A xvCONTENTSPAGE17.6. STREAMING SIMD EXTENSIONS (SSE) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17-317.7. STREAMING SIMD EX

4-20 Vol. 3APROTECTION• Target code segments referenced by a 64-bit call gate must be 64-bit code segments(CS.L = 1, CS.D = 0). If not, the reference

Vol. 3A 4-21PROTECTIONFigure 4-10. Call-Gate MechanismFigure 4-11. Privilege Check for Control Transfer with Call GateOffsetSegment SelectorFar Poin

4-22 Vol. 3APROTECTIONThe privilege checking rules are different depending on whether the control transfer was initi-ated with a CALL or a JMP instruc

Vol. 3A 4-23PROTECTIONCall gates allow a single code segment to have procedures that can be accessed at different priv-ilege levels. For example, an o

4-24 Vol. 3APROTECTIONEach task must define up to 4 stacks: one for applications code (running at privilege level 3) andone for each of the privilege

Vol. 3A 4-25PROTECTION4. Temporarily saves the current values of the SS and ESP registers.5. Loads the segment selector and stack pointer for the new

4-26 Vol. 3APROTECTION4.8.5.1 Stack Switching in 64-bit ModeAlthough protection-check rules for call gates are unchanged from 32-bit mode, stack-switc

Vol. 3A 4-27PROTECTIONfrom the stack into the EIP register, it checks that the pointer does not exceed the limit of thecurrent code segment.On a far r

4-28 Vol. 3APROTECTIONnew CPL (excluding conforming code segments), the segment register is loaded with a nullsegment selector.See the description of

Vol. 3A 4-29PROTECTIONMSRs and general-purpose registers eliminates all memory accesses except when fetching thetarget code.Any additional state that

CONTENTSxviVol. 3APAGE17.17.7.12. FXTRACT Instruction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .17-1717.17.7.

4-30 Vol. 3APROTECTIONWhen SYSEXIT transfers control to compatibility mode user code when the operand sizeattribute is 32 bits, the following fields a

Vol. 3A 4-31PROTECTIONWhen SYSRET transfers control to 64-bit mode user code using REX.W, the processor gets theprivilege level 3 target instruction a

4-32 Vol. 3APROTECTION4.9 PRIVILEGED INSTRUCTIONSSome of the system instructions (called “privileged instructions”) are protected from use byapplicati

Vol. 3A 4-33PROTECTION3. Checking if the pointer offset exceeds the segment limit.4. Checking if the supplier of the pointer is allowed to access the

4-34 Vol. 3APROTECTION4.10.2 Checking Read/Write Rights (VERR and VERW Instructions)When the processor accesses any code or data segment it checks the

Vol. 3A 4-35PROTECTION5. If the privilege level and type checks pass, loads the unscrambled limit (the limit scaledaccording to the setting of the G f

4-36 Vol. 3APROTECTIONNow assume that instead of setting the RPL of the segment selector to 3, the application programsets the RPL to 0 (segment selec

Vol. 3A 4-37PROTECTIONapplication program (represented by the code-segment selector pushed onto the stack). If theRPL is less than application program

4-38 Vol. 3APROTECTION4.11.1 Page-Protection FlagsProtection information for pages is contained in two flags in a page-directory or page-table entry(s

Vol. 3A 4-39PROTECTIONread/write accessible. User-mode pages which are read/write or read-only are readable; super-visor-mode pages are neither readab

Vol. 3A xviiCONTENTSPAGE17.29.1. Large Pages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17-

4-40 Vol. 3APROTECTIONPage-level protection can be used to enhance segment-level protection. For example, if a largeread-write data segment is paged,

Vol. 3A 4-41PROTECTIONWhile the execute disable bit capability does not introduce new instructions, it does requireoperating systems to use a PAE-enab

4-42 Vol. 3APROTECTIONtures. Execute-disable bit protection can be activated using the execute-disable bit at any levelof the paging structure, irresp

Vol. 3A 4-43PROTECTION4.13.3 Reserved Bit CheckingThe processor enforces reserved bit checking in paging data structure entries. The bits beingchecked

4-44 Vol. 3APROTECTIONTable 4-10. Reserved Bit Checking WIth Execute-Disable Bit Capability Not Enabled 4.13.4 Exception HandlingWhen execute disable

5Interrupt and Exception Handling

Vol. 3A 5-1CHAPTER 5INTERRUPT AND EXCEPTION HANDLINGThis chapter describes the processor’s interrupt and exception-handling mechanism when oper-ating

5-2 Vol. 3AINTERRUPT AND EXCEPTION HANDLING5.2 EXCEPTION AND INTERRUPT VECTORSTo aid in handling exceptions and interrupts, each IA-32 architecture-de

Vol. 3A 5-3INTERRUPT AND EXCEPTION HANDLINGTable 5-1. Protected-Mode Exceptions and Interrupts Vector No.Mne-monicDescription Type Error CodeSource 0

CONTENTSxviiiVol. 3APAGE18.5.7.1 Last Exception Records and Intel EM64T . . . . . . . . . . . . . . . . . . . . . . . . . .18-1918.5.8 Branch Trace S

5-4 Vol. 3AINTERRUPT AND EXCEPTION HANDLINGThe processor’s local APIC is normally connected to a system-based I/O APIC. Here, externalinterrupts recei

Vol. 3A 5-5INTERRUPT AND EXCEPTION HANDLING5.4 SOURCES OF EXCEPTIONSThe processor receives exceptions from three sources:• Processor-detected program-

5-6 Vol. 3AINTERRUPT AND EXCEPTION HANDLING• Faults — A fault is an exception that can generally be corrected and that, once corrected,allows the prog

Vol. 3A 5-7INTERRUPT AND EXCEPTION HANDLINGFor trap-class exceptions, the return instruction pointer points to the instruction following thetrapping i

5-8 Vol. 3AINTERRUPT AND EXCEPTION HANDLING5.7 NONMASKABLE INTERRUPT (NMI)The nonmaskable interrupt (NMI) can be generated in either of two ways:• Ext

Vol. 3A 5-9INTERRUPT AND EXCEPTION HANDLING5.8.1 Masking Maskable Hardware InterruptsThe IF flag can disable the servicing of maskable hardware interr

5-10 Vol. 3AINTERRUPT AND EXCEPTION HANDLINGManual, Volume 2A, for a detailed description of the operations these instructions are allowedto perform o

Vol. 3A 5-11INTERRUPT AND EXCEPTION HANDLINGWhile priority among these classes listed in Table 5-2 is consistent throughout the architecture,exception

5-12 Vol. 3AINTERRUPT AND EXCEPTION HANDLINGre-generated when the interrupt handler returns execution to the point in the program or taskwhere the exc

Vol. 3A 5-13INTERRUPT AND EXCEPTION HANDLING5.11 IDT DESCRIPTORSThe IDT may contain any of three kinds of gate descriptors:• Task-gate descriptor• Int

Vol. 3A xixCONTENTSPAGE18.11 PERFORMANCE MONITORING AND HYPER-THREADING TECHNOLOGY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

5-14 Vol. 3AINTERRUPT AND EXCEPTION HANDLING5.12 EXCEPTION AND INTERRUPT HANDLINGThe processor handles calls to exception- and interrupt-handlers simi

Vol. 3A 5-15INTERRUPT AND EXCEPTION HANDLINGthrough Section 4.8.6, “Returning from a Called Procedure”). If index points to a task gate, theprocessor

5-16 Vol. 3AINTERRUPT AND EXCEPTION HANDLINGWhen the processor performs a call to the exception- or interrupt-handler procedure:• If the handler proce

Vol. 3A 5-17INTERRUPT AND EXCEPTION HANDLINGTo return from an exception- or interrupt-handler procedure, the handler must use the IRET (orIRETD) instr

5-18 Vol. 3AINTERRUPT AND EXCEPTION HANDLINGAn attempt to violate this rule results in a general-protection exception (#GP). The protectionmechanism f

Vol. 3A 5-19INTERRUPT AND EXCEPTION HANDLING5.12.2 Interrupt TasksWhen an exception or interrupt handler is accessed through a task gate in the IDT, a

5-20 Vol. 3AINTERRUPT AND EXCEPTION HANDLINGFigure 5-5. Interrupt Task SwitchIDTTask GateTSS for Interrupt-TSS SelectorGDTTSS DescriptorInterruptVect

Vol. 3A 5-21INTERRUPT AND EXCEPTION HANDLING5.13 ERROR CODEWhen an exception condition is related to a specific segment, the processor pushes an error

5-22 Vol. 3AINTERRUPT AND EXCEPTION HANDLING5.14 EXCEPTION AND INTERRUPT HANDLING IN 64-BIT MODEIn 64-bit mode, interrupt and exception handling is si

Vol. 3A 5-23INTERRUPT AND EXCEPTION HANDLINGIn 64-bit mode, the IDT index is formed by scaling the interrupt vector by 16. The first eightbytes (bytes

INFORMATION IN THIS DOCUMENT IS PROVIDED IN CONNECTION WITH INTEL PRODUCTS. NO LICENSE, EX-PRESS OR IMPLIED, BY ESTOPPEL OR OTHERWISE, TO ANY INTELLEC

CONTENTSxxVol. 3APAGE20.7 VM-EXIT CONTROL FIELDS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20-1420.7.1 VM-Exit C

5-24 Vol. 3AINTERRUPT AND EXCEPTION HANDLING5.14.3 IRET in IA-32e Mode In IA-32e mode, IRET executes with an 8-byte operand size. There is nothing tha

Vol. 3A 5-25INTERRUPT AND EXCEPTION HANDLINGIn summary, a stack switch in IA-32e mode works like the legacy stack switch, except that a newSS selector

5-26 Vol. 3AINTERRUPT AND EXCEPTION HANDLINGThe IST mechanism provides up to seven IST pointers in the TSS. The pointers are referencedby an interrupt

Vol. 3A 5-27INTERRUPT AND EXCEPTION HANDLINGInterrupt 0—Divide Error Exception (#DE)Exception Class Fault.DescriptionIndicates the divisor operand for

5-28 Vol. 3AINTERRUPT AND EXCEPTION HANDLINGInterrupt 1—Debug Exception (#DB)Exception Class Trap or Fault. The exception handler can distinguish betw

Vol. 3A 5-29INTERRUPT AND EXCEPTION HANDLINGInterrupt 2—NMI InterruptException Class Not applicable.DescriptionThe nonmaskable interrupt (NMI) is gene

5-30 Vol. 3AINTERRUPT AND EXCEPTION HANDLINGInterrupt 3—Breakpoint Exception (#BP)Exception Class Trap.DescriptionIndicates that a breakpoint instruct

Vol. 3A 5-31INTERRUPT AND EXCEPTION HANDLINGInterrupt 4—Overflow Exception (#OF)Exception Class Trap.DescriptionIndicates that an overflow trap occurr

5-32 Vol. 3AINTERRUPT AND EXCEPTION HANDLINGInterrupt 5—BOUND Range Exceeded Exception (#BR)Exception Class Fault.DescriptionIndicates that a BOUND-ra

Vol. 3A 5-33INTERRUPT AND EXCEPTION HANDLINGInterrupt 6—Invalid Opcode Exception (#UD)Exception Class Fault.DescriptionIndicates that the processor di

Vol. 3A xxiCONTENTSPAGE22.3.2.1 Loading Guest Control Registers, Debug Registers, and MSRs . . . . . . . . 21-1422.3.2.2 Loading Guest Segment Regis

5-34 Vol. 3AINTERRUPT AND EXCEPTION HANDLINGThe opcodes D6 and F1 are undefined opcodes that are reserved by the IA-32 architecture.These opcodes, eve

Vol. 3A 5-35INTERRUPT AND EXCEPTION HANDLINGInterrupt 7—Device Not Available Exception (#NM)Exception Class Fault.DescriptionIndicates one of the foll

5-36 Vol. 3AINTERRUPT AND EXCEPTION HANDLINGSaved Instruction PointerThe saved contents of CS and EIP registers point to the floating-point instructio

Vol. 3A 5-37INTERRUPT AND EXCEPTION HANDLINGInterrupt 8—Double Fault Exception (#DF)Exception Class Abort.DescriptionIndicates that the processor dete

5-38 Vol. 3AINTERRUPT AND EXCEPTION HANDLINGIf another exception occurs while attempting to call the double-fault handler, the processorenters shutdow

Vol. 3A 5-39INTERRUPT AND EXCEPTION HANDLINGInterrupt 9—Coprocessor Segment OverrunException Class Abort. (Intel reserved; do not use. Recent IA-32 pr

5-40 Vol. 3AINTERRUPT AND EXCEPTION HANDLINGInterrupt 10—Invalid TSS Exception (#TS)Exception Class Fault.DescriptionIndicates that there was an error

Vol. 3A 5-41INTERRUPT AND EXCEPTION HANDLINGThis exception can generated either in the context of the original task or in the context of thenew task (

5-42 Vol. 3AINTERRUPT AND EXCEPTION HANDLINGException Error CodeAn error code containing the segment selector index for the segment descriptor that ca

Vol. 3A 5-43INTERRUPT AND EXCEPTION HANDLINGInterrupt 11—Segment Not Present (#NP)Exception Class Fault.DescriptionIndicates that the present flag of

CONTENTSxxiiVol. 3APAGE24.3.2 Exiting From SMM. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .26-424.4

5-44 Vol. 3AINTERRUPT AND EXCEPTION HANDLINGSaved Instruction PointerThe saved contents of CS and EIP registers normally point to the instruction that

Vol. 3A 5-45INTERRUPT AND EXCEPTION HANDLINGInterrupt 12—Stack Fault Exception (#SS)Exception Class Fault.DescriptionIndicates that one of the followi

5-46 Vol. 3AINTERRUPT AND EXCEPTION HANDLINGexception. The stack fault handler should thus not rely on being able to use the segment selectorsfound in

Vol. 3A 5-47INTERRUPT AND EXCEPTION HANDLINGInterrupt 13—General Protection Exception (#GP)Exception Class Fault.DescriptionIndicates that the process

5-48 Vol. 3AINTERRUPT AND EXCEPTION HANDLING• Loading the CR0 register with a set NW flag and a clear CD flag.• Referencing an entry in the IDT (follo

Vol. 3A 5-49INTERRUPT AND EXCEPTION HANDLING• A selector from a TSS involved in a task switch.• IDT vector number.Saved Instruction PointerThe saved c

5-50 Vol. 3AINTERRUPT AND EXCEPTION HANDLING• If the segment descriptor from a 64-bit call gate is in non-canonical space.• If the DPL from a 64-bit c

Vol. 3A 5-51INTERRUPT AND EXCEPTION HANDLINGInterrupt 14—Page-Fault Exception (#PF)Exception Class Fault.DescriptionIndicates that, with paging enable

5-52 Vol. 3AINTERRUPT AND EXCEPTION HANDLING— The RSVD flag indicates that the processor detected 1s in reserved bits of the pagedirectory, when the P

Vol. 3A 5-53INTERRUPT AND EXCEPTION HANDLINGSaved Instruction PointerThe saved contents of CS and EIP registers generally point to the instruction tha

Vol. 3A xxiiiCONTENTSPAGECHAPTER 25VIRTUAL-MACHINE MONITOR PROGRAMMING CONSIDERATIONS25.1 VMX SYSTEM PROGRAMMING OVERVIEW. . . . . . . . . . . . . . .

5-54 Vol. 3AINTERRUPT AND EXCEPTION HANDLINGWhen executing this code on one of the 32-bit IA-32 processors, it is possible to get a page fault,general

Vol. 3A 5-55INTERRUPT AND EXCEPTION HANDLINGInterrupt 16—x87 FPU Floating-Point Error (#MF)Exception Class Fault.DescriptionIndicates that the x87 FPU

5-56 Vol. 3AINTERRUPT AND EXCEPTION HANDLINGPrior to executing a waiting x87 FPU instruction or the WAIT/FWAIT instruction, the x87 FPUchecks for pend

Vol. 3A 5-57INTERRUPT AND EXCEPTION HANDLINGInterrupt 17—Alignment Check Exception (#AC)Exception Class Fault.DescriptionIndicates that the processor

5-58 Vol. 3AINTERRUPT AND EXCEPTION HANDLINGAlignment-check exceptions (#AC) are generated only when operating at privilege level 3 (usermode). Memory

Vol. 3A 5-59INTERRUPT AND EXCEPTION HANDLINGInterrupt 18—Machine-Check Exception (#MC)Exception Class Abort.DescriptionIndicates that the processor de

5-60 Vol. 3AINTERRUPT AND EXCEPTION HANDLINGProgram State ChangeThe machine-check mechanism is enabled by setting the MCE flag in control register CR4

Vol. 3A 5-61INTERRUPT AND EXCEPTION HANDLINGInterrupt 19—SIMD Floating-Point Exception (#XF)Exception Class Fault.DescriptionIndicates the processor h

5-62 Vol. 3AINTERRUPT AND EXCEPTION HANDLINGNote that because SIMD floating-point exceptions are precise and occur immediately, the situ-ation does no

Vol. 3A 5-63INTERRUPT AND EXCEPTION HANDLINGSaved Instruction PointerThe saved contents of CS and EIP registers point to the SSE/SSE2/SSE3 instruction

CONTENTSxxivVol. 3APAGE26.3.5.1 Initialization of Virtual TLB . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24-626.3.5.

5-64 Vol. 3AINTERRUPT AND EXCEPTION HANDLINGInterrupts 32 to 255—User Defined InterruptsException Class Not applicable.DescriptionIndicates that the p

6Task Management

Vol. 3A 6-1CHAPTER 6TASK MANAGEMENTThis chapter describes the IA-32 architecture’s task management facilities. These facilities areonly available when

6-2 Vol. 3ATASK MANAGEMENT6.1.2 Task StateThe following items define the state of the currently executing task:• The task’s current execution space, d

Vol. 3A 6-3TASK MANAGEMENT6.1.3 Executing a TaskSoftware or the processor can dispatch a task for execution in one of the following ways:• A explicit

6-4 Vol. 3ATASK MANAGEMENTUse of task management facilities for handling multitasking applications is optional. Multi-tasking can be handled in softwa

Vol. 3A 6-5TASK MANAGEMENTThe processor updates dynamic fields when a task is suspended during a task switch. Thefollowing are dynamic fields:• Genera

6-6 Vol. 3ATASK MANAGEMENT• EFLAGS register field — State of the EFAGS register prior to the task switch.• EIP (instruction pointer) field — State of

Vol. 3A 6-7TASK MANAGEMENT6.2.2 TSS DescriptorThe TSS, like all other segments, is defined by a segment descriptor. Figure 6-3 shows theformat of a TS

Vol. 3A xxvCONTENTSPAGEAPPENDIX CMP INITIALIZATION FOR P6 FAMILY PROCESSORSC.1 OVERVIEW OF THE MP INITIALIZATION PROCESS FOR P6 FAMILY PROCESSORS . .

6-8 Vol. 3ATASK MANAGEMENTThe base, limit, and DPL fields and the granularity and present flags have functions similar totheir use in data-segment des

Vol. 3A 6-9TASK MANAGEMENT6.2.4 Task RegisterThe task register holds the 16-bit segment selector and the entire segment descriptor (32-bit baseaddress

6-10 Vol. 3ATASK MANAGEMENTThe LTR instruction loads a segment selector (source operand) into the task register that pointsto a TSS descriptor in the

Vol. 3A 6-11TASK MANAGEMENT6.2.5 Task-Gate DescriptorA task-gate descriptor provides an indirect, protected reference to a task (see Figure 6-6). It c

6-12 Vol. 3ATASK MANAGEMENTFigure 6-7 illustrates how a task gate in an LDT, a task gate in the GDT, and a task gate in theIDT can all point to the sa

Vol. 3A 6-13TASK MANAGEMENTJMP, CALL, and IRET instructions, as well as interrupts and exceptions, are all mechanisms forredirecting a program. The re

6-14 Vol. 3ATASK MANAGEMENT10. If the task switch was initiated with a CALL instruction, JMP instruction, an exception, oran interrupt, the processor

Vol. 3A 6-15TASK MANAGEMENTWhen switching tasks, the privilege level of the new task does not inherit its privilege level fromthe suspended task. The

6-16 Vol. 3ATASK MANAGEMENTThe TS (task switched) flag in the control register CR0 is set every time a task switch occurs.System software uses the TS

Vol. 3A 6-17TASK MANAGEMENTTable 6-2 shows the busy flag (in the TSS segment descriptor), the NT flag, the previous tasklink field, and TS flag (in co

CONTENTSxxviVol. 3APAGEH.3.4 32-Bit Host-State Field . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . H-6H.4 NA

6-18 Vol. 3ATASK MANAGEMENT6.4.1 Use of Busy Flag To Prevent Recursive Task SwitchingA TSS allows only one context to be saved for a task; therefore,

Vol. 3A 6-19TASK MANAGEMENTIn a multiprocessing system, additional synchronization and serialization operations must beadded to this procedure to insu

6-20 Vol. 3ATASK MANAGEMENTthat the mapping of TSS addresses does not change while the processor is reading and updatingthe TSSs during a task switch.

Vol. 3A 6-21TASK MANAGEMENT• Through segment descriptors in distinct LDTs that are mapped to common addressesin linear address space — If this common

6-22 Vol. 3ATASK MANAGEMENTFigure 6-10. 16-Bit TSS FormatTask LDT SelectorDS SelectorSS SelectorCS SelectorES SelectorDISIBPSPBXDXCXAXFLAG WordIP (En

Vol. 3A 6-23TASK MANAGEMENT6.7 TASK MANAGEMENT IN 64-BIT MODEIn 64-bit mode, task structure and task state are similar to those in protected mode. How

6-24 Vol. 3ATASK MANAGEMENTFigure 6-11. 64-Bit TSS Format031100969288848076I/O Map Base Address1572686460565248444036322824201612840RSP0 (lower 32 bi

7Multiple-Processor Management

Vol. 3A 7-1CHAPTER 7MULTIPLE-PROCESSOR MANAGEMENTThe IA-32 architecture provides several mechanisms for managing and improving the perfor-mance of mul

Vol. 3A xxviiCONTENTSPAGEFigure 3-23. Format of Page-Directory Entries for 4-MByte Pages and36-Bit Physical Addresses . . . . . . . . . . . . . . . .

7-2 Vol. 3AMULTIPLE-PROCESSOR MANAGEMENT• To distribute interrupt handling among a group of processors — When several processorsare operating in a sys

Vol. 3A 7-3MULTIPLE-PROCESSOR MANAGEMENTThe mechanisms for handling locked atomic operations have evolved as the complexity of IA-32processors has evo

7-4 Vol. 3AMULTIPLE-PROCESSOR MANAGEMENTFor the Pentium 4, Intel Xeon, and P6 family processors, if the memory area being accessed iscached internally

Vol. 3A 7-5MULTIPLE-PROCESSOR MANAGEMENT7.1.2.2 Software Controlled Bus LockingTo explicitly force the LOCK semantics, software can use the LOCK prefi

7-6 Vol. 3AMULTIPLE-PROCESSOR MANAGEMENTLocked instructions should not be used to insure that data written can be fetched as instructions. NOTEThe loc

Vol. 3A 7-7MULTIPLE-PROCESSOR MANAGEMENTTo write cross-modifying code and insure that it is compliant with current and future versionsof the IA-32 arc

7-8 Vol. 3AMULTIPLE-PROCESSOR MANAGEMENTTo allow optimizing of instruction execution, the IA-32 architecture allows departures fromstrong-ordering mod

Vol. 3A 7-9MULTIPLE-PROCESSOR MANAGEMENT4. Writes can be buffered.5. Writes are not performed speculatively; they are only performed for instructions

7-10 Vol. 3AMULTIPLE-PROCESSOR MANAGEMENT7.2.3 Out-of-Order Stores For String Operations in Pentium 4, Intel Xeon, and P6 Family ProcessorsThe Pentium

Vol. 3A 7-11MULTIPLE-PROCESSOR MANAGEMENT• The initial operation counter (ECX) must be equal to or greater than 64.• Source and destination must not o

CONTENTSxxviiiVol. 3APAGEFigure 7-6. Topological Relationships between Hierarchical IDs in a Hypothetical MP Platform. . . . . . . . . . . . . . . . .

7-12 Vol. 3AMULTIPLE-PROCESSOR MANAGEMENTProgram synchronization can also be carried out with serializing instructions (see Section 7.4).These instruc

Vol. 3A 7-13MULTIPLE-PROCESSOR MANAGEMENTIt is recommended that software written to run on Pentium 4, Intel Xeon, and P6 family proces-sors assume the

7-14 Vol. 3AMULTIPLE-PROCESSOR MANAGEMENT7.4 SERIALIZING INSTRUCTIONSThe IA-32 architecture defines several serializing instructions. These instructio

Vol. 3A 7-15MULTIPLE-PROCESSOR MANAGEMENT• When an instruction is executed that enables or disables paging (that is, changes the PGflag in control reg

7-16 Vol. 3AMULTIPLE-PROCESSOR MANAGEMENT• Intel Xeon processors with family, model, and stepping IDs up to F09H — Theselection of the BSP and APs (se

Vol. 3A 7-17MULTIPLE-PROCESSOR MANAGEMENT• All devices in the system that are capable of delivering interrupts to the processors must beinhibited from

7-18 Vol. 3AMULTIPLE-PROCESSOR MANAGEMENT• The remainder of the processors (which were not selected as the BSP) aredesignated as APs. They leave their

Vol. 3A 7-19MULTIPLE-PROCESSOR MANAGEMENTThe following constants and data definitions are used in the accompanying code examples. Theyare based on the

7-20 Vol. 3AMULTIPLE-PROCESSOR MANAGEMENTspace (1-MByte space). For example, a vector of 0BDH specifies a start-up memoryaddress of 000BD000H. 11. Ena

Vol. 3A 7-21MULTIPLE-PROCESSOR MANAGEMENT16. Waits for the timer interrupt.17. Reads and evaluates the COUNT variable and establishes a processor coun

Vol. 3A xxixCONTENTSPAGEFigure 11-2. Mapping of MMX Registers to x87 FPU Data Register Stack. . . . . . . . . . . . 11-7Figure 12-1. Example of Savin

7-22 Vol. 3AMULTIPLE-PROCESSOR MANAGEMENT7.5.5 Identifying Logical Processors in an MP SystemAfter the BIOS has completed the MP initialization protoc

Vol. 3A 7-23MULTIPLE-PROCESSOR MANAGEMENTFor P6 family processors, the APIC ID that is assigned to a processor during power-up andinitialization is 4

7-24 Vol. 3AMULTIPLE-PROCESSOR MANAGEMENT7.7 DETECTING HARDWARE MULTI-THREADING SUPPORT AND TOPOLOGYUse the CPUID instruction to detect the presence o

Vol. 3A 7-25MULTIPLE-PROCESSOR MANAGEMENT7.7.2 Initializing Dual-Core IA-32 ProcessorsThe initialization process for an MP system that contains dual-c

7-26 Vol. 3AMULTIPLE-PROCESSOR MANAGEMENT7.8 INTEL® HYPER-THREADING TECHNOLOGY ARCHITECTUREFigure 7-4 shows a generalized view of an IA-32 processor s

Vol. 3A 7-27MULTIPLE-PROCESSOR MANAGEMENT7.8.1 State of the Logical ProcessorsThe following features are part of the architectural state of logical pr

7-28 Vol. 3AMULTIPLE-PROCESSOR MANAGEMENT• Debug registers (DR0, DR1, DR2, DR3, DR6, DR7) and the debug control MSRs• Machine check global status (IA3

Vol. 3A 7-29MULTIPLE-PROCESSOR MANAGEMENTof memory, independent of the processor on which it is running. See Section 10.11, “MemoryType Range Register

7-30 Vol. 3AMULTIPLE-PROCESSOR MANAGEMENTThe performance counter interrupts, events, and precise event monitoring support can be set upand allocated o

Vol. 3A 7-31MULTIPLE-PROCESSOR MANAGEMENT7.8.12 Self Modifying CodeIA-32 processors supporting Hyper-Threading Technology support self-modifying code,

Vol. 3A iiiCONTENTS FOR VOLUME 3A AND 3BCHAPTER 1ABOUT THIS MANUAL1.1 IA-32 PROCESSORS COVERED IN THIS MANUAL . . . . . . . . . . . . . . . . . . . .

CONTENTSxxxVol. 3APAGEFigure 18-23. MSR_IFSB_CTL6, Address: 107D2H; MSR_IFSB_CNTR7, Address: 107D3H . . . . . . . . . . . . . . . . . . . . . . . . .

7-32 Vol. 3AMULTIPLE-PROCESSOR MANAGEMENTEntries in the TLBs are tagged with an ID that indicates the logical processor that initiated thetranslation.

Vol. 3A 7-33MULTIPLE-PROCESSOR MANAGEMENTvector tables for one or both of the logical processors.Typically in MP systems, the LINT0 and LINT1 pins are

7-34 Vol. 3AMULTIPLE-PROCESSOR MANAGEMENT7.9.2 Memory Type Range Registers (MTRR)MTRR is shared between two logical processors sharing a processor cor

Vol. 3A 7-35MULTIPLE-PROCESSOR MANAGEMENT7.10 PROGRAMMING CONSIDERATIONS FOR HARDWARE MULTI-THREADING CAPABLE PROCESSORSIn a multi-threading environme

7-36 Vol. 3AMULTIPLE-PROCESSOR MANAGEMENTThe value of valid APIC_IDs need not be contiguous across package boundary or core bound-aries.7.10.2 Identif

Vol. 3A 7-37MULTIPLE-PROCESSOR MANAGEMENTTable 7-2 shows the initial APIC IDs for a hypothetical situation with a dual processor system.Each physical

7-38 Vol. 3AMULTIPLE-PROCESSOR MANAGEMENT7.10.3 Algorithm for Three-Level Mappings of APIC_IDSoftware can gather the initial APIC_IDs for each logical

Vol. 3A 7-39MULTIPLE-PROCESSOR MANAGEMENTunsigned int HWMTSupported(void){try { // verify cpuid instruction is supportedexecute cpuid with eax = 0 to

7-40 Vol. 3AMULTIPLE-PROCESSOR MANAGEMENTstore returned value of eaxreturn (unsigned ) ((reg_eax >> 26) +1);}else // must be a single-core proce

Vol. 3A 7-41MULTIPLE-PROCESSOR MANAGEMENT6. Extract a sub ID given a full ID, maximum sub ID value and shift count.// Returns the value of the sub ID,

Vol. 3A xxxiCONTENTSPAGETable 6-1. Exception Conditions Checked During a Task Switch . . . . . . . . . . . . . . . . . 6-15Table 6-2. Effect of a Tas

7-42 Vol. 3AMULTIPLE-PROCESSOR MANAGEMENTCORE_ID, assuming the number of physical packages in each node of a clusteredsystem is symmetric.• Assemble t

Vol. 3A 7-43MULTIPLE-PROCESSOR MANAGEMENTExample 7-3 Compute the Number of Packages, Cores, and Processor Relationships in a MP Systema) Assemble list

7-44 Vol. 3AMULTIPLE-PROCESSOR MANAGEMENTThe algorithm below assumes there is symmetry across package boundary if more than one socket is populated in

Vol. 3A 7-45MULTIPLE-PROCESSOR MANAGEMENTIf ((PackageID[ProcessorNum] | CoreID[ProcessorNum]) == CoreIDBucket[i]) {CoreProcessorMask[i] |= ProcessorMa

7-46 Vol. 3AMULTIPLE-PROCESSOR MANAGEMENT7.11.2 PAUSE InstructionThe PAUSE instruction improves the performance of IA-32 processors supporting Hyper-T

Vol. 3A 7-47MULTIPLE-PROCESSOR MANAGEMENT7.11.4 MONITOR/MWAIT InstructionOperating systems usually implement idle loops to handle thread synchronizati

7-48 Vol. 3AMULTIPLE-PROCESSOR MANAGEMENTPower management related events (such as Thermal Monitor 2 or chipset driven STPCLK#assertion) will not cause

Vol. 3A 7-49MULTIPLE-PROCESSOR MANAGEMENTThese above two values bear no relationship to cache line size in the system and software shouldnot make any

7-50 Vol. 3AMULTIPLE-PROCESSOR MANAGEMENTPAUSE ; Short delayJMP Spin_LockGet_Lock:MOV EAX, 1XCHG EAX, lockvar ; Try to get lockCMP EAX, 0 ; Test if su

Vol. 3A 7-51MULTIPLE-PROCESSOR MANAGEMENTThe MONITOR and MWAIT instructions may be considered for use in the C0 idle state loops, if MONITOR and MWAIT

CONTENTSxxxiiVol. 3APAGETable 11-3. Effect of the MMX, x87 FPU, and FXSAVE/FXRSTOR Instructionson the x87 FPU Tag Word . . . . . . . . . . . . . . . .

7-52 Vol. 3AMULTIPLE-PROCESSOR MANAGEMENTother logical processors in the physical package. For this reason, halting idle logical processorsoptimizes t

Vol. 3A 7-53MULTIPLE-PROCESSOR MANAGEMENT7.11.6.5 Guidelines for Scheduling Threads on Logical Processors Sharing Execution ResourcesBecause the logic

7-54 Vol. 3AMULTIPLE-PROCESSOR MANAGEMENT

8Advanced Programmable Interrupt Controller (APIC)

Vol. 3A 8-1CHAPTER 8ADVANCED PROGRAMMABLEINTERRUPT CONTROLLER (APIC)The Advanced Programmable Interrupt Controller (APIC), referred to in the followin

8-2 Vol. 3AADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)Local APICs can receive interrupts from the following sources:• Locally connected I/O devi

Vol. 3A 8-3ADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)Xeon processors) or on the APIC bus (for Pentium and P6 family processors). See Section 8.

8-4 Vol. 3AADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)processors through the local interrupt pins; however, this mechanism is commonly not used

Vol. 3A 8-5ADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)The IPI mechanism is typically used in MP systems to send fixed interrupts (interrupts for

Vol. 3A xxxiiiCONTENTSPAGETable 23-1. Exit Qualification for Debug Exceptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22-5Table 23-2.

8-6 Vol. 3AADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)8.4.1 The Local APIC Block DiagramFigure 8-4 gives a functional block diagram for the loca

Vol. 3A 8-7ADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)Figure 8-4. Local APIC StructureCurrent CountRegisterInitial CountRegisterDivide Configur

8-8 Vol. 3AADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)Table 8-1 shows how the APIC registers are mapped into the 4-KByte APIC register space.Reg

Vol. 3A 8-9ADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)8.4.2 Presence of the Local APICBeginning with the P6 family processors, the presence or a

8-10 Vol. 3AADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)8.4.3 Enabling or Disabling the Local APICThe local APIC can be enabled or disabled in ei

Vol. 3A 8-11ADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)8.4.4 Local APIC Status and LocationThe status and location of the local APIC are contain

8-12 Vol. 3AADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)8.4.6 Local APIC IDAt power up, system hardware assigns a unique APIC ID to each local AP

Vol. 3A 8-13ADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)8.4.7.1 Local APIC State After Power-Up or ResetFollowing a power-up or RESET of the proc

8-14 Vol. 3AADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)8.4.7.3 Local APIC State After an INIT Reset (“Wait-for-SIPI” State)An INIT reset of the

Vol. 3A 8-15ADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)8.5 HANDLING LOCAL INTERRUPTSThe following sections describe facilities that are provided

CONTENTSxxxivVol. 3APAGETable F-3. Non-Focused Lowest Priority Message (34 Cycles). . . . . . . . . . . . . . . . . . . . .F-3Table F-4. APIC Bus Stat

8-16 Vol. 3AADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)monitor register and its associated interrupt were introduced in the Pentium 4 and Intel

Vol. 3A 8-17ADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)The setup information that can be specified in the registers of the LVT table is as follo

8-18 Vol. 3AADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)Remote IRR Flag (Read Only)For fixed mode, level-triggered interrupts; this flag is set w

Vol. 3A 8-19ADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)8.5.3 Error HandlingThe local APIC provides an error status register (ESR) that it uses t

8-20 Vol. 3AADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)The ESR is a write/read register. A write (of any value) to the ESR must be done just pri

Vol. 3A 8-21ADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)The time base for the timer is derived from the processor’s bus clock, divided by the val

8-22 Vol. 3AADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)8.5.5 Local Interrupt AcceptanceWhen a local interrupt is sent to the processor core, it

Vol. 3A 8-23ADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)The ICR consists of the following fields. Vector The vector number of the interrupt being

8-24 Vol. 3AADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)send a lowest priority IPI is model specific andshould be avoided by BIOS and operating s

Vol. 3A 8-25ADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)Destination Mode Selects either physical (0) or logical (1) destination mode (seeSection

1About This Manual

8-26 Vol. 3AADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)sors and to FFH for Pentium 4 and Intel Xeon pro-cessors.11: (All Excluding Self)The IPI

Vol. 3A 8-27ADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)All Excluding Self Valid Edge Fixed, Lowest Priority1,4, NMI, INIT, SMI, Start-UpXAll Exc

8-28 Vol. 3AADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)8.6.2 Determining IPI DestinationThe destination of an IPI can be one, all, or a subset (

Vol. 3A 8-29ADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)NOTEThe number of local APICs that can be addressed on the system bus may berestricted by

8-30 Vol. 3AADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)The interpretation of MDA for the two models is described in the following paragraphs.1.

Vol. 3A 8-31ADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)8.6.2.3 Broadcast/Self Delivery ModeThe destination shorthand field of the ICR allows the

8-32 Vol. 3AADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)Here, the TPR value is the task priority value in the TPR (see Figure 8-18), the IRRV val

Vol. 3A 8-33ADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)Section 8.10, “APIC Bus Message Passing Mechanism and Protocol (P6 Family, PentiumProcess

8-34 Vol. 3AADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)4. When interrupts are pending in the IRR and ISR register, the local APIC dispatches the

Vol. 3A 8-35ADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)1. (IPIs only) It examines the IPI message to determines if it is the specified destinati

8-36 Vol. 3AADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)3. If the local APIC determines that it is the designated destination for the interrupt b

Vol. 3A 8-37ADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)8.8.3.1 Task and Processor PrioritiesThe local APIC also defines a task priority and a pr

8-38 Vol. 3AADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)Its value in the PPR is computed as follows: IF TPR[7:4] ≥ ISRV[7:4]THEN PPR[7:0] ← TPR[7

Vol. 3A 8-39ADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)The IRR contains the active interrupt requests that have been accepted, but not yet dispa

8-40 Vol. 3AADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)8.8.5 Signaling Interrupt Servicing CompletionFor all interrupts except those delivered w

Vol. 3A 8-41ADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)the TPR. The IC, however, is considered implementation-dependent with the under-lyingprio

8-42 Vol. 3AADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)The vector number for the spurious-interrupt vector is specified in the spurious-interrup

Vol. 3A 8-43ADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)8.10 APIC BUS MESSAGE PASSING MECHANISM ANDPROTOCOL (P6 FAMILY, PENTIUM PROCESSORS)The Pe

8-44 Vol. 3AADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)destination and message during device configuration, allocating one or morenon-shared mes

Vol. 3A 8-45ADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)• When RH is 1 and the logical destination mode is active in a system using a flataddress

Vol. 3A 1-1CHAPTER 1ABOUT THIS MANUALThe IA-32 Intel® Architecture Software Developer’s Manual, Volume 3A: System ProgrammingGuide, Part 1 (order numb

8-46 Vol. 3AADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)Reserved fields are not assumed to be any value. Software must preserve their contents on

Vol. 3A 8-47ADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)d. 100B (NMI) — Deliver the signal to all the agents listed in the destination field. The

8-48 Vol. 3AADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC)

9Processor Management and Initialization

Vol. 3A 9-1CHAPTER 9PROCESSOR MANAGEMENT ANDINITIALIZATIONThis chapter describes the facilities provided for managing processor wide functions and for

9-2 Vol. 3APROCESSOR MANAGEMENT AND INITIALIZATIONThe software-initialization code performs all system-specific initialization of the BSP orprimary pr

Vol. 3A 9-3PROCESSOR MANAGEMENT AND INITIALIZATIONTable 9-1. IA-32 Processor States Following Power-up, Reset, or INIT RegisterPentium 4 and Intel Xe

9-4 Vol. 3APROCESSOR MANAGEMENT AND INITIALIZATIONMXCSR Pwr up or Reset: 1F80HINIT: UnchangedPentium III processor only-Pwr up or Reset: 1F80HINIT: Un

Vol. 3A 9-5PROCESSOR MANAGEMENT AND INITIALIZATION9.1.3 Model and Stepping InformationFollowing a hardware reset, the EDX register contains component

1-2 Vol. 3AABOUT THIS MANUAL1.2 OVERVIEW OF THE SYSTEM PROGRAMMING GUIDEA description of this manual’s content follows:Chapter 1 — About This Manual.

9-6 Vol. 3APROCESSOR MANAGEMENT AND INITIALIZATION9.1.4 First Instruction ExecutedThe first instruction that is fetched and executed following a hardw

Vol. 3A 9-7PROCESSOR MANAGEMENT AND INITIALIZATIONThe EM flag determines whether floating-point instructions are executed by the x87 FPU (EMis cleared

9-8 Vol. 3APROCESSOR MANAGEMENT AND INITIALIZATIONTo emulate floating-point instructions, the EM, MP, and NE flag in control register CR0 shouldbe set

Vol. 3A 9-9PROCESSOR MANAGEMENT AND INITIALIZATION9.4 MODEL-SPECIFIC REGISTERS (MSRS)The Pentium 4, Intel Xeon, P6 family, and Pentium processors cont

9-10 Vol. 3APROCESSOR MANAGEMENT AND INITIALIZATION9.6 INITIALIZING SSE/SSE2/SSE3 EXTENSIONSFor processors that contain SSE/SSE2/SSE3 extensions, step

Vol. 3A 9-11PROCESSOR MANAGEMENT AND INITIALIZATION9.7.1 Real-Address Mode IDTIn real-address mode, the only system data structure that must be loaded

9-12 Vol. 3APROCESSOR MANAGEMENT AND INITIALIZATION• If paging is to be used, at least one page directory and one page table.• A code segment that con

Vol. 3A 9-13PROCESSOR MANAGEMENT AND INITIALIZATION9.8.2 Initializing Protected-Mode Exceptions and InterruptsSoftware initialization code must at a m

9-14 Vol. 3APROCESSOR MANAGEMENT AND INITIALIZATIONAfter the processor has switched to protected mode, the LTR instruction can be used to load asegmen

Vol. 3A 9-15PROCESSOR MANAGEMENT AND INITIALIZATION64-bit mode consistency checks fail in the following circumstances:• An attempt is made to enable o

Vol. 3A 1-3ABOUT THIS MANUALlevel, including: task switching, exception handling, and compatibility with existing systemenvironments.Chapter 12 — SSE,

9-16 Vol. 3APROCESSOR MANAGEMENT AND INITIALIZATIONCompatibility mode execution is selected on a code-segment basis. This mode allows legacyapplicatio

Vol. 3A 9-17PROCESSOR MANAGEMENT AND INITIALIZATION9.9 MODE SWITCHINGTo use the processor in protected mode after hardware or software reset, a mode s

9-18 Vol. 3APROCESSOR MANAGEMENT AND INITIALIZATION6. Execute the LTR instruction to load the task register with a segment selector to the initialprot

Vol. 3A 9-19PROCESSOR MANAGEMENT AND INITIALIZATION4. Load segment registers SS, DS, ES, FS, and GS with a selector for a descriptor containingthe fol

9-20 Vol. 3APROCESSOR MANAGEMENT AND INITIALIZATION9.10 INITIALIZATION AND MODE SWITCHING EXAMPLEThis section provides an initialization and mode swit

Vol. 3A 9-21PROCESSOR MANAGEMENT AND INITIALIZATIONFigure 9-3. Processor State After ResetTable 9-4. Main Initialization Steps in STARTUP.ASM Source

9-22 Vol. 3APROCESSOR MANAGEMENT AND INITIALIZATION9.10.1 Assembler UsageIn this example, the Intel assembler ASM386 and build tools BLD386 are used t

Vol. 3A 9-23PROCESSOR MANAGEMENT AND INITIALIZATION9.10.2 STARTUP.ASM ListingExample 9-1 provides high-level sample code designed to move the processo

9-24 Vol. 3APROCESSOR MANAGEMENT AND INITIALIZATION 32 TSS_INDEX EQU 10 33 34 ; TSS_INDEX is the index of the TSS of the first task t

Vol. 3A 9-25PROCESSOR MANAGEMENT AND INITIALIZATION 79 LDT_reg DW ? 80 LDT_h DW ? 81 TRAP_reg DW ? 82 IO_map_base DW ? 83 TA

CONTENTSivVol. 3APAGE2.6.7 Reading and Writing Model-Specific Registers. . . . . . . . . . . . . . . . . . . . . . . . . .2-292.6.7.1 Reading and Writ

1-4 Vol. 3AABOUT THIS MANUALChapter 25 — Virtual-Machine Monitoring Programming Considerations. Describesprogramming considerations for VMMs. VMMs man

9-26 Vol. 3APROCESSOR MANAGEMENT AND INITIALIZATION 126 127 ; scratch areas for LGDT and LIDT instructions 128 TEMP_GDT_SCRATCH TABLE_REG <&g

Vol. 3A 9-27PROCESSOR MANAGEMENT AND INITIALIZATION 175 MOV EBX,CR0 176 OR EBX,PE_BIT 177 MOV CR0,EBX 178 17

9-28 Vol. 3APROCESSOR MANAGEMENT AND INITIALIZATION 222 MOV ECX, CS_BASE 223 ADD ECX, OFFSET (IDT_EPROM) 224 M

Vol. 3A 9-29PROCESSOR MANAGEMENT AND INITIALIZATION 271 272 ;assume no LDT used in the initial task - if necessary, 273 ;code to move th

9-30 Vol. 3APROCESSOR MANAGEMENT AND INITIALIZATIONFigure 9-4. Constructing Temporary GDT and Switching to Protected Mode (Lines 162-172 of List File

Vol. 3A 9-31PROCESSOR MANAGEMENT AND INITIALIZATIONFigure 9-5. Moving the GDT, IDT, and TSS from ROM to RAM (Lines 196-261 of List File)FFFF FFFFHGDT

9-32 Vol. 3APROCESSOR MANAGEMENT AND INITIALIZATIONFigure 9-6. Task Switching (Lines 282-296 of List File)GDT RAMRAM_STARTTSS RAMIDT RAMGDT AliasIDT

Vol. 3A 9-33PROCESSOR MANAGEMENT AND INITIALIZATION9.10.3 MAIN.ASM Source CodeThe file MAIN.ASM shown in Example 9-2 defines the data and stack segmen

9-34 Vol. 3APROCESSOR MANAGEMENT AND INITIALIZATIONExample 9-4. Build FileINIT_BLD_EXAMPLE;SEGMENT *SEGMENTS(DPL = 0) , startup.startup_c

Vol. 3A 9-35PROCESSOR MANAGEMENT AND INITIALIZATION9.11 MICROCODE UPDATE FACILITIESThe Pentium 4, Intel Xeon, and P6 family processors have the capabi

Vol. 3A 1-5ABOUT THIS MANUAL1.3.1 Bit and Byte OrderIn illustrations of data structures in memory, smaller addresses appear toward the bottom of thefi

9-36 Vol. 3APROCESSOR MANAGEMENT AND INITIALIZATION9.11.1 Microcode UpdateA microcode update consists of an Intel-supplied binary that contains a desc

Vol. 3A 9-37PROCESSOR MANAGEMENT AND INITIALIZATION. Table 9-6. Microcode Update Field DefinitionsField Name Offset (bytes)Length (bytes)DescriptionH

9-38 Vol. 3APROCESSOR MANAGEMENT AND INITIALIZATIONTotal Size 32 4 Specifies the total size of the microcode update in bytes. It is the summation of

Vol. 3A 9-39PROCESSOR MANAGEMENT AND INITIALIZATIONChecksum[n] Data Size + 76 + (n * 12)4 Used by utility software to decompose a microcode update int

9-40 Vol. 3APROCESSOR MANAGEMENT AND INITIALIZATION9.11.2 Optional Extended Signature TableThe extended signature table is a structure that may be app

Vol. 3A 9-41PROCESSOR MANAGEMENT AND INITIALIZATION9.11.3 Processor IdentificationEach microcode update is designed to for a specific processor or set

9-42 Vol. 3APROCESSOR MANAGEMENT AND INITIALIZATION9.11.4 Platform IdentificationIn addition to verifying the processor signature, the intended proces

Vol. 3A 9-43PROCESSOR MANAGEMENT AND INITIALIZATIONExample 9-6. Pseudo Code Example of Processor Flags TestFlag ← 1 << IA32_PLATFORM_ID[52:50]I

9-44 Vol. 3APROCESSOR MANAGEMENT AND INITIALIZATIONExample 9-7. Pseudo Code Example of Checksum TestN ← 512If (Update.DataSize != 00000000H)N ← Updat

Vol. 3A 9-45PROCESSOR MANAGEMENT AND INITIALIZATIONThe loader shown in Example 9-8 assumes that update is the address of a microcode update(header and

1-6 Vol. 3AABOUT THIS MANUAL1.3.3 Instruction OperandsWhen instructions are represented symbolically, a subset of the IA-32 assembly language isused.

9-46 Vol. 3APROCESSOR MANAGEMENT AND INITIALIZATION9.11.6.3 Update in a System Supporting Intel Hyper-Threading Technology Intel Hyper-Threading Techn

Vol. 3A 9-47PROCESSOR MANAGEMENT AND INITIALIZATIONCPUID returns a value in a model specific register in addition to its usual register return values.

9-48 Vol. 3APROCESSOR MANAGEMENT AND INITIALIZATIONThe IA32_BIOS_SIGN_ID register is used to report the microcode update signature whenCPUID executes.

Vol. 3A 9-49PROCESSOR MANAGEMENT AND INITIALIZATION9.11.8 Pentium 4, Intel Xeon, and P6 Family ProcessorMicrocode Update SpecificationsThis section de

9-50 Vol. 3APROCESSOR MANAGEMENT AND INITIALIZATIONupdate blocks for each microcode update. In a MP system, a commonmicrocode update may be sufficient

Vol. 3A 9-51PROCESSOR MANAGEMENT AND INITIALIZATION{If ((Update.ProcessorSignature[N] == Processor Signature) && (Update.ProcessorFlags[N] &a

9-52 Vol. 3APROCESSOR MANAGEMENT AND INITIALIZATION• The calling program should read any update data that already exists in the BIOS in order tomake d

Vol. 3A 9-53PROCESSOR MANAGEMENT AND INITIALIZATIONFor each processor{If ((this is a unique processor stepping) AND(we have a unique update in the dat

9-54 Vol. 3APROCESSOR MANAGEMENT AND INITIALIZATION}//// Verify the update was loaded correctly//Issue the ReadUpdate functionIf an error occurred{Dis

Vol. 3A 9-55PROCESSOR MANAGEMENT AND INITIALIZATION9.11.8.4 INT 15H-based InterfaceIntel recommends that a BIOS interface be provided that allows addi

Vol. 3A 1-7ABOUT THIS MANUAL1.3.4 Hexadecimal and Binary NumbersBase 16 (hexadecimal) numbers are represented by a string of hexadecimal digits follow

9-56 Vol. 3APROCESSOR MANAGEMENT AND INITIALIZATIONDescriptionIn order to assure that the BIOS function is present, the caller must verify the carry f

Vol. 3A 9-57PROCESSOR MANAGEMENT AND INITIALIZATIONDescriptionThe BIOS is responsible for selecting an appropriate update block in the non-volatile st

9-58 Vol. 3APROCESSOR MANAGEMENT AND INITIALIZATIONIf no unused update blocks are available and the above criteria are not met, the BIOS can over-writ

Vol. 3A 9-59PROCESSOR MANAGEMENT AND INITIALIZATIONFigure 9-8. Microcode Update Write Operation Flow [1] 1 Valid UpdateHeader Version? Loader Revisio

9-60 Vol. 3APROCESSOR MANAGEMENT AND INITIALIZATIONFigure 9-9. Microcode Update Write Operation Flow [2] ReturnINVALID_REVISIONYes 1Update Revision N

Vol. 3A 9-61PROCESSOR MANAGEMENT AND INITIALIZATION9.11.8.7 Function 02H—Microcode Update ControlThis function enables loading of binary updates into

9-62 Vol. 3APROCESSOR MANAGEMENT AND INITIALIZATIONThe READ_FAILURE error code returned by this function has meaning only if the control func-tion is

Vol. 3A 9-63PROCESSOR MANAGEMENT AND INITIALIZATIONDescriptionThe read function enables the caller to read any microcode update data that already exis

9-64 Vol. 3APROCESSOR MANAGEMENT AND INITIALIZATIONUPDATE_NUM_INVALID 99H The update number exceeds the maximum number of update blocks implemented by

10Memory Cache Control

1-8 Vol. 3AABOUT THIS MANUAL1.3.7 ExceptionsAn exception is an event that typically occurs when an instruction causes an error. For example,an attempt

Vol. 3A 10-1CHAPTER 10MEMORY CACHE CONTROLThis chapter describes the IA-32 architecture’s memory cache and cache control mechanisms, theTLBs, and the

10-2 Vol. 3AMEMORY CACHE CONTROLTable 10-1. Characteristics of the Caches, TLBs, Store Buffer, and Write Combining Buffer in IA-32 ProcessorsCache or

Vol. 3A 10-3MEMORY CACHE CONTROLThe IA-32 processors implement four types of caches: the trace cache, the level 1 (L1) cache,the level 2 (L2) cache, a

10-4 Vol. 3AMEMORY CACHE CONTROLThe trace cache in the Pentium 4 and Intel Xeon processors is an integral part of the IntelNetBurst microarchitecture

Vol. 3A 10-5MEMORY CACHE CONTROLWhen the processor attempts to write an operand to a cacheable area of memory, it first checksif a cache line for that

10-6 Vol. 3AMEMORY CACHE CONTROLNOTEThe behavior of FP and SSE/SSE2 operations on operands in UC memory isimplementation dependent. In some implementa

Vol. 3A 10-7MEMORY CACHE CONTROLmemory. When writing through to memory, invalid cache lines are never filled, and validcache lines are either filled o

10-8 Vol. 3AMEMORY CACHE CONTROL10.3.1 Buffering of Write Combining Memory LocationsWrites to the WC memory type are not cached in the typical sense o

Vol. 3A 10-9MEMORY CACHE CONTROLThe only elements of WC propagation to the system bus that are guaranteed are those providedby transaction atomicity.

Vol. 3A 1-9ABOUT THIS MANUALbe able to report an accurate code. In this case, the error code is zero, as shown below for ageneral-protection exception

10-10 Vol. 3AMEMORY CACHE CONTROLFor a description of these instructions and there intended use, see Section 10.5.5, “CacheManagement Instructions.”10

Vol. 3A 10-11MEMORY CACHE CONTROL• Cache control and memory ordering instructions — The IA-32 architecture providesseveral instructions that control t

10-12 Vol. 3AMEMORY CACHE CONTROLFigure 10-2. Cache-Control Registers and Bits Available in IA-32 ProcessorsPage-Directory orPage-Table EntryTLBsMTRR

Vol. 3A 10-13MEMORY CACHE CONTROLTable 10-5. Cache Operating Modes CD NW Caching and Read/Write Policy L1 L2/L310 0 Normal Cache Mode. Highest perfor

10-14 Vol. 3AMEMORY CACHE CONTROL• NW flag, bit 29 of control register CR0 — Controls the write policy for system memorylocations (see Section 2.5, “C

Vol. 3A 10-15MEMORY CACHE CONTROL• Memory type range registers (MTRRs) (introduced in P6 family processors) —Control the type of caching used in speci

10-16 Vol. 3AMEMORY CACHE CONTROL10.5.2.1 Selecting Memory Types for Pentium Pro and Pentium II ProcessorsThe Pentium Pro and Pentium II processors do

Vol. 3A 10-17MEMORY CACHE CONTROL4. Setting the PCD and PWT flags to opposite values is considered model-specific for the WPand WC memory types and ar

10-18 Vol. 3AMEMORY CACHE CONTROL10.5.2.3 Writing Values Across Pages with Different Memory TypesIf two adjoining pages in memory have different memor

Vol. 3A 10-19MEMORY CACHE CONTROL3. Disable the MTRRs and set the default memory type to uncached or set all MTRRs for theuncached memory type (see th

1-10 Vol. 3AABOUT THIS MANUAL

10-20 Vol. 3AMEMORY CACHE CONTROLmodified lines (such as, during testing or fault recovery where cache coherency with mainmemory is not a concern), so

Vol. 3A 10-21MEMORY CACHE CONTROL10.5.6.1 Adaptive ModeAdaptive mode facilitates L1 data cache sharing between logical processors. When running inadap

10-22 Vol. 3AMEMORY CACHE CONTROLFor Intel486 processors, a write to an instruction in the cache will modify it in both the cacheand memory, but if th

Vol. 3A 10-23MEMORY CACHE CONTROLcache hierarchy now or as soon as possible, in anticipation of its use. The instructions providedifferent variations

10-24 Vol. 3AMEMORY CACHE CONTROL10.10 STORE BUFFERIA-32 processors temporarily store each write (store) to memory in a store buffer. The storebuffer

Vol. 3A 10-25MEMORY CACHE CONTROLization software should then set the MTRRs to a specific, system-defined memory map. Typi-cally, the BIOS (basic inpu

10-26 Vol. 3AMEMORY CACHE CONTROL10.11.1 MTRR Feature IdentificationThe availability of the MTRR feature is model-specific. Software can determine if

Vol. 3A 10-27MEMORY CACHE CONTROL• WC (write combining) flag, bit 10 — The write-combining (WC) memory type issupported when set; the WC type is not s

10-28 Vol. 3AMEMORY CACHE CONTROL• FE (fixed MTRRs enabled) flag, bit 10 — Fixed-range MTRRs are enabled when set;fixed-range MTRRs are disabled when

Vol. 3A 10-29MEMORY CACHE CONTROLFor the P6 family processors, the prefix for the fixed range MTRRs is MTRRfix.10.11.2.3 Variable Range MTRRsThe Penti

2System Architecture Overview

10-30 Vol. 3AMEMORY CACHE CONTROL• PhysBase field, bits 12 through (MAXPHYADDR-1) — Specifies the base address ofthe address range. This 24-bit value,

Vol. 3A 10-31MEMORY CACHE CONTROLAll other bits in the IA32_MTRR_PHYSBASEn and IA32_MTRR_PHYSMASKn registers arereserved; the processor generates a ge

10-32 Vol. 3AMEMORY CACHE CONTROL10.11.3 Example Base and Mask CalculationsThe examples in this section apply to processors that support a maximum phy

Vol. 3A 10-33MEMORY CACHE CONTROLThe following settings for the MTRRs will yield the proper mapping of the physical addressspace for this system confi

10-34 Vol. 3AMEMORY CACHE CONTROLCaches 96-100 MByte as WB cache type.IA32_MTRR_PHYSBASE3 = 0000 0000 0400 0000HIA32_MTRR_PHYSMASK3 = 0000 00FF FFC0

Vol. 3A 10-35MEMORY CACHE CONTROLd. If two or more variable memory ranges match and the memory types are WT and WB,the WT memory type is used.e. For o

10-36 Vol. 3AMEMORY CACHE CONTROL10.11.7 MTRR Maintenance Programming InterfaceThe operating system maintains the MTRRs after booting and sets up or c

Vol. 3A 10-37MEMORY CACHE CONTROLThe pseudocode for the Get4KMemType() function in Example 10-17 obtains the memory typefor a single 4-KByte range at

10-38 Vol. 3AMEMORY CACHE CONTROLFI;IF IA32_MTRRCAP.FIX is set AND range can be mapped using a fixed-range MTRRTHENpre_mtrr_change();update affected M

Vol. 3A 10-39MEMORY CACHE CONTROLThe physical address to variable range mapping algorithm in the MemTypeSet function detectsconflicts with current var

10-40 Vol. 3AMEMORY CACHE CONTROL6. If the PGE flag is set in control register CR4, flush all TLBs by clearing that flag.7. If the PGE flag is clear i

Vol. 3A 10-41MEMORY CACHE CONTROLThe Pentium 4, Intel Xeon, and P6 family processors provide special support for the physicalmemory range from 0 to 4

10-42 Vol. 3AMEMORY CACHE CONTROL10.12.2 IA32_CR_PAT MSRThe IA32_CR_PAT MSR is located at MSR address 277H (see to Appendix B, “Model-SpecificRegister

Vol. 3A 10-43MEMORY CACHE CONTROL10.12.3 Selecting a Memory Type from the PATTo select a memory type for a page from the PAT, a 3-bit index made up of

10-44 Vol. 3AMEMORY CACHE CONTROLThe values in all the entries of the PAT can be changed by writing to the IA32_CR_PAT MSRusing the WRMSR instruction.

Vol. 3A 10-45MEMORY CACHE CONTROL10.12.5 PAT Compatibility with Earlier IA-32 ProcessorsFor IA-32 processors that support the PAT, the IA32_CR_PAT MSR

10-46 Vol. 3AMEMORY CACHE CONTROL

11Intel® MMX™ Technology System Programming

Vol. 3A 11-1CHAPTER 11INTEL® MMX™ TECHNOLOGY SYSTEMPROGRAMMINGThis chapter describes those features of the Intel® MMX™ technology that must be conside

Vol. 3A 2-1CHAPTER 2SYSTEM ARCHITECTURE OVERVIEWIA-32 architecture (beginning with the Intel386 processor family) provides extensive supportfor operat

11-2 Vol. 3AINTEL® MMX™ TECHNOLOGY SYSTEM PROGRAMMINGWhen a value is written into an MMX register using an MMX instruction, the value also appearsin t

Vol. 3A 11-3INTEL® MMX™ TECHNOLOGY SYSTEM PROGRAMMINGExecution of MMX instructions does not affect the other bits in the x87 FPU status word (bits0 th

11-4 Vol. 3AINTEL® MMX™ TECHNOLOGY SYSTEM PROGRAMMING11.3 SAVING AND RESTORING THE MMX STATE AND REGISTERSBecause the MMX registers are aliased to the

Vol. 3A 11-5INTEL® MMX™ TECHNOLOGY SYSTEM PROGRAMMINGNOTEThe IA-32 architecture does not support scanning the x87 FPU tag word andthen only saving val

11-6 Vol. 3AINTEL® MMX™ TECHNOLOGY SYSTEM PROGRAMMING• Other exceptions can occur indirectly due to the faulty execution of the exception handlersfor

Vol. 3A 11-7INTEL® MMX™ TECHNOLOGY SYSTEM PROGRAMMINGFigure 11-2. Mapping of MMX Registers to x87 FPU Data Register StackMM0MM1MM2MM3MM4MM5MM6MM7ST1S

11-8 Vol. 3AINTEL® MMX™ TECHNOLOGY SYSTEM PROGRAMMING

12SSE, SSE2 and SSE3 System Programming

Vol. 3A 12-1CHAPTER 12SSE, SSE2 AND SSE3 SYSTEM PROGRAMMINGThis chapter describes features of the streaming SIMD extensions (SSE), streaming SIMDexten

Vol. 3A vCONTENTSPAGECHAPTER 4PROTECTION4.1 ENABLING AND DISABLING SEGMENT AND PAGE PROTECTION . . . . . . . . . . 4-14.2 FIELDS AND FLAGS USED FOR S

2-2 Vol. 3ASYSTEM ARCHITECTURE OVERVIEW2.1 OVERVIEW OF THE SYSTEM-LEVEL ARCHITECTUREIA-32 system-level architecture consists of a set of registers, da

12-2 Vol. 3ASSE, SSE2 AND SSE3 SYSTEM PROGRAMMING12.1.2 Checking for SSE/SSE2/SSE3 Extension SupportIf the processor attempts to execute an unsupporte

Vol. 3A 12-3SSE, SSE2 AND SSE3 SYSTEM PROGRAMMINGNOTEThe OSFXSR and OSXMMEXCPT bits in control register CR4 must be setby the operating system. The pr

12-4 Vol. 3ASSE, SSE2 AND SSE3 SYSTEM PROGRAMMINGThe SIMD floating-point exception mask bits (bits 7 through 12), the flush-to-zero flag (bit 15),the

Vol. 3A 12-5SSE, SSE2 AND SSE3 SYSTEM PROGRAMMING• System Exceptions:— Invalid-opcode exception (#UD). This exception is generated when executingSSE/S

12-6 Vol. 3ASSE, SSE2 AND SSE3 SYSTEM PROGRAMMINGsame conditions that cause x87 FPU floating-point error exceptions (#MF) to be generated forx87 FPU i

Vol. 3A 12-7SSE, SSE2 AND SSE3 SYSTEM PROGRAMMINGIn some cases, applications can only save the XMM and MXCSR registers in the following way:• Execute

12-8 Vol. 3ASSE, SSE2 AND SSE3 SYSTEM PROGRAMMING• The operating system can take the responsibility for automatically saving the x87 FPU,MMX, XXM, and

Vol. 3A 12-9SSE, SSE2 AND SSE3 SYSTEM PROGRAMMINGOn a task switch, the operating system task switching code must execute the following pseudo-code to

12-10 Vol. 3ASSE, SSE2 AND SSE3 SYSTEM PROGRAMMING• Restores the x87 FPU, MMX, XMM, or MXCSR registers from the new task’s save areafor the x87 FPU/MM

13Power and Thermal Management

Vol. 3A 2-3SYSTEM ARCHITECTURE OVERVIEWFigure 2-1. IA-32 System-Level Registers and Data StructuresLocal DescriptorTable (LDT)EFLAGS RegisterControl

Vol. 3A 13-1CHAPTER 13POWER AND THERMAL MANAGEMENTThis chapter describes facilities of IA-32 architecture used for power management and thermalmonitor

13-2 Vol. 3APOWER AND THERMAL MANAGEMENT13.2 P-STATE HARDWARE COORDINATIONThe Advanced Configuration and Power Interface (ACPI) defines performance st

Vol. 3A 13-3POWER AND THERMAL MANAGEMENTIf P-states are exposed by the BIOS as hardware coordinated, software is expected to confirmprocessor support

13-4 Vol. 3APOWER AND THERMAL MANAGEMENT13.3 MWAIT EXTENSIONS FOR ADVANCED POWER MANAGEMENTIA-32 processors may support a number of C-state1 that redu

Vol. 3A 13-5POWER AND THERMAL MANAGEMENT13.4 THERMAL MONITORING AND PROTECTIONThe IA-32 architecture provides the following mechanisms for monitoring

13-6 Vol. 3APOWER AND THERMAL MANAGEMENT13.4.1 Catastrophic Shutdown DetectorP6 family processors introduced a thermal sensor that acts as a catastrop

Vol. 3A 13-7POWER AND THERMAL MANAGEMENTMSR_THERM2_CTL register is set to 1 (Figure 13-3) and bit 3 of the IA32_MISC_ENABLE register is set to 1. Foll

13-8 Vol. 3APOWER AND THERMAL MANAGEMENT• If TM1 is enabled and the TCC is engaged, the performance state transition can commencebefore the TCC is dis

Vol. 3A 13-9POWER AND THERMAL MANAGEMENT• High-Temperature Interrupt Enable flag, bit 0 — Enables an interrupt to be generatedon the transition from a

2-4 Vol. 3ASYSTEM ARCHITECTURE OVERVIEWFigure 2-2. System-Level Registers and Data Structures in IA-32e ModeLocal DescriptorTable (LDT)CR1CR2CR3CR4CR

13-10 Vol. 3APOWER AND THERMAL MANAGEMENTThe IA32_CLOCK_MODULATION MSR contains the following flag and field used to enablesoftware-controlled clock m

Vol. 3A 13-11POWER AND THERMAL MANAGEMENT13.4.4 Detection of Thermal Monitor and Software ControlledClock Modulation FacilitiesThe ACPI flag (bit 22)

13-12 Vol. 3APOWER AND THERMAL MANAGEMENTbeen asserted since a previous RESET or the last time software cleared the bit. Softwaremay clear this bit by

Vol. 3A 13-13POWER AND THERMAL MANAGEMENT• Thermal Threshold #2 Log (bit 9, R/WC0) — Sticky bit that indicates whether theThermal Threshold #2 has bee

13-14 Vol. 3APOWER AND THERMAL MANAGEMENT• THERMTRIP# Interrupt Enable (bit 2, R/W) — When a catastrophic cooling failureoccurs, the processor will au

14Machine Check Architecture

Vol. 3A 14-1CHAPTER 14MACHINE-CHECK ARCHITECTUREThis chapter describes the machine-check architecture and machine-check exception mecha-nism found in

14-2 Vol. 3AMACHINE-CHECK ARCHITECTURE14.3 MACHINE-CHECK MSRSMachine check MSRs in the Pentium 4, Intel Xeon, and P6 family processors consist of a se

Vol. 3A 14-3MACHINE-CHECK ARCHITECTUREWhere:• Count field, bits 0 through 7 — Indicates the number of hardware unit error-reportingbanks available in

Vol. 3A 2-5SYSTEM ARCHITECTURE OVERVIEW2.1.1 Global and Local Descriptor TablesWhen operating in protected mode, all memory accesses pass through eith

14-4 Vol. 3AMACHINE-CHECK ARCHITECTUREWhere:• Count field, bits 0 through 7 — Indicates the number of hardware unit error-reportingbanks available in

Vol. 3A 14-5MACHINE-CHECK ARCHITECTURE14.3.1.4 IA32_MCG_CTL MSRThe IA32_MCG_CTL MSR (called the MCG_CTL MSR in P6 family processors) is present ifthe

14-6 Vol. 3AMACHINE-CHECK ARCHITECTURE14.3.2.2 IA32_MCi_STATUS MSRsEach IA32_MCi_STATUS MSR (called MCi_STATUS in P6 family processors) contains infor

Vol. 3A 14-7MACHINE-CHECK ARCHITECTUREwhere the error occurred. Do not read these registers if they are not implemented in theprocessor.• MISCV (IA32_

14-8 Vol. 3AMACHINE-CHECK ARCHITECTURE14.3.2.4 IA32_MCi_MISC MSRsThe IA32_MCi_MISC MSR (called the MCi_MISC MSR in the P6 family processors) containsa

Vol. 3A 14-9MACHINE-CHECK ARCHITECTUREIn processors with support for Intel EM64T, 64-bit machine check state MSRs are aliased to thelegacy MSRs. In ad

14-10 Vol. 3AMACHINE-CHECK ARCHITECTUREWhen a machine-check error is detected on a Pentium 4 or Intel Xeon processor, the processorsaves the state of

Vol. 3A 14-11MACHINE-CHECK ARCHITECTURE14.3.3 Mapping of the Pentium Processor Machine-Check Errorsto the Machine-Check ArchitectureThe Pentium proces

14-12 Vol. 3AMACHINE-CHECK ARCHITECTUREExample 14-19. Machine-Check Initialization PseudocodeCheck CPUID Feature Flags for MCE and MCA supportIF CPU

Vol. 3A 14-13MACHINE-CHECK ARCHITECTUREFOR error-reporting banks (0 through MAX_BANK_NUMBER)DO(Optional for BIOS and OS) Log valid errors(OS only) IA3

2-6 Vol. 3ASYSTEM ARCHITECTURE OVERVIEWFor example, a CALL to a call gate can provide access to a procedure in a code segment that isat the same or a

14-14 Vol. 3AMACHINE-CHECK ARCHITECTURE14.6.2 Compound Error CodesCompound error codes describe errors related to the TLBs, memory, caches, bus and in

Vol. 3A 14-15MACHINE-CHECK ARCHITECTUREFor example, the error code ICACHEL1_RD_ERR is constructed from the form: {TT}CACHE{LL}_{RRRR}_ERR,where {TT} i

14-16 Vol. 3AMACHINE-CHECK ARCHITECTUREThe 4-bit RRRR sub-field (see Table 14-7) indicates the type of action associated with the error.Actions includ

Vol. 3A 14-17MACHINE-CHECK ARCHITECTURE14.6.3 Machine-Check Error Codes InterpretationAppendix E, “Interpreting Machine-Check Error Codes,” provides i

14-18 Vol. 3AMACHINE-CHECK ARCHITECTURE14.7.1 Machine-Check Exception HandlerThe machine-check exception (#MC) corresponds to vector 18. To service ma

Vol. 3A 14-19MACHINE-CHECK ARCHITECTURE• The MCIP flag in the IA32_MCG_STATUS register indicates whether a machine-checkexception was generated. Befor

14-20 Vol. 3AMACHINE-CHECK ARCHITECTURE14.7.3 Pentium Processor Machine-Check Exception HandlingTo make the machine-check exception handler portable t

Vol. 3A 14-21MACHINE-CHECK ARCHITECTUREAND RIPV flag in IA32_MCG_STATUS = 0(* execution is not restartable *)THEN RESTARTABILITY = FALSE;return RESTAR

14-22 Vol. 3AMACHINE-CHECK ARCHITECTUREThe basic algorithm given in Example 14-21 can be modified to provide more robust recoverytechniques. For examp

158086 Emulation

Vol. 3A 2-7SYSTEM ARCHITECTURE OVERVIEWA task can also be accessed through a task gate. A task gate is similar to a call gate, except thatit provides

Vol. 3A 15-1CHAPTER 158086 EMULATIONIA-32 processors (beginning with the Intel386 processor) provide two ways to execute new orlegacy programs that ar

15-2 Vol. 3A8086 EMULATIONThe following is a summary of the core features of the real-address mode execution environmentas would be seen by a program

Vol. 3A 15-38086 EMULATION8-byte entries) used when handling protected-mode interrupts and exceptions. Interruptand exception vector numbers provide a

15-4 Vol. 3A8086 EMULATIONbehavior of the 8086 processor.) Care should be take to ensure that A20M# based address wrap-ping is handled correctly in mu

Vol. 3A 15-58086 EMULATION• Logical instructions AND, OR, XOR, and NOT.• Decimal instructions DAA, DAS, AAA, AAS, AAM, and AAD.• Stack instructions PU

15-6 Vol. 3A8086 EMULATION• ENTER and LEAVE control instructions.• BOUND instruction.• CPU identification (CPUID) instruction.• System instructions CL

Vol. 3A 15-78086 EMULATION(For backward compatibility to Intel 8086 processors, the default base address and limit of theinterrupt vector table should

15-8 Vol. 3A8086 EMULATIONTable 15-1. Real-Address Mode Exceptions and Interrupts Vector No. DescriptionReal-Address ModeVirtual-8086 ModeIntel 8086

Vol. 3A 15-98086 EMULATION15.2.1 Enabling Virtual-8086 ModeThe processor runs in virtual-8086 mode when the VM (virtual machine) flag in the EFLAGSreg

2-8 Vol. 3ASYSTEM ARCHITECTURE OVERVIEWThe location of pages (sometimes called page frames) in physical memory is contained in twotypes of system data

15-10 Vol. 3A8086 EMULATIONThe 8086 operating-system services consists of a kernel and/or operating-system proceduresthat the 8086 program makes calls

Vol. 3A 15-118086 EMULATION• When sharing the 8086 operating-system services or ROM code that is common to several8086 programs running as different 8

15-12 Vol. 3A8086 EMULATIONFigure 15-3. Entering and Leaving Virtual-8086 ModeMonitorVirtual-8086Real ModeCodeProtected-Mode TasksVirtual-8086Mode Ta

Vol. 3A 15-138086 EMULATION15.2.6 Leaving Virtual-8086 ModeThe processor can leave the virtual-8086 mode only through an interrupt or exception. Thefo

15-14 Vol. 3A8086 EMULATION15.2.7 Sensitive InstructionsWhen an IA-32 processor is running in virtual-8086 mode, the CLI, STI, PUSHF, POPF, INT n,and

Vol. 3A 15-158086 EMULATION15.2.8.2 Memory-Mapped I/OIn systems which use memory-mapped I/O, the paging facilities of the processor can be used togene

15-16 Vol. 3A8086 EMULATIONThe method the processor uses to handle class 2 and 3 interrupts depends on the setting of thefollowing flags and fields:•

Vol. 3A 15-178086 EMULATION15.3.1 Class 1—Hardware Interrupt and Exception Handling in Virtual-8086 ModeIn virtual-8086 mode, the Pentium, P6 family,

15-18 Vol. 3A8086 EMULATIONInterrupt and exception handlers can examine the VM flag on the stack to determine if the inter-rupted procedure was runnin

Vol. 3A 15-198086 EMULATIONThe virtual-8086 monitor runs at privilege level 0, like the protected-mode interrupt and excep-tion handlers. It is common

Vol. 3A 2-9SYSTEM ARCHITECTURE OVERVIEW• The GDTR, LDTR, and IDTR registers contain the linear addresses and sizes (limits) oftheir respective tables.

15-20 Vol. 3A8086 EMULATION15.3.1.3 Handling an Interrupt or Exception Through a Task GateWhen an interrupt or exception vector points to a task gate

Vol. 3A 15-218086 EMULATIONavailable or not enabled, maskable hardware interrupts are handled as class 1interrupts. Here, if VIF and VIP flags are nee

15-22 Vol. 3A8086 EMULATION3. The virtual-8086 monitor should read the VIF flag in the EFLAGS register. — If the VIF flag is clear, the virtual-8086 m

Vol. 3A 15-238086 EMULATION15.3.3 Class 3—Software Interrupt Handling in Virtual-8086 ModeWhen the processor receives a software interrupt (an interru

15-24 Vol. 3A8086 EMULATIONTable 15-2. Software Interrupt Handling Methods While in Virtual-8086 ModeMethod VME IOPLBit in Redir. Bitmap* Processor A

Vol. 3A 15-258086 EMULATIONRedirecting software interrupts back to the 8086 program potentially speeds up interrupthandling because a switch back and

15-26 Vol. 3A8086 EMULATION15.3.3.2 Methods 2 and 3: Software Interrupt HandlingWhen a software interrupt occurs in virtual-8086 mode and the method 2

Vol. 3A 15-278086 EMULATION6. Loads the CS and EIP registers with values from the interrupt vector table entry pointed toby the interrupt vector numbe

15-28 Vol. 3A8086 EMULATION15.4 PROTECTED-MODE VIRTUAL INTERRUPTSThe IA-32 processors (beginning with the Pentium processor) also support the VIF and

16Mixing 16-Bit and 32-Bit Code

2-10 Vol. 3ASYSTEM ARCHITECTURE OVERVIEW2.1.7 Other System ResourcesBesides the system registers and data structures described in the previous section

Vol. 3A 16-1CHAPTER 16MIXING 16-BIT AND 32-BIT CODEProgram modules written to run on IA-32 processors can be either 16-bit modules or 32-bitmodules. T

16-2 Vol. 3AMIXING 16-BIT AND 32-BIT CODE16.1 DEFINING 16-BIT AND 32-BIT PROGRAM MODULESThe following IA-32 architecture mechanisms are used to distin

Vol. 3A 16-3MIXING 16-BIT AND 32-BIT CODEThese prefixes reverse the default size selected by the D flag in the code-segment descriptor. Forexample, th

16-4 Vol. 3AMIXING 16-BIT AND 32-BIT CODEA stack that spans less than 64 KBytes can be shared by both 16- and 32-bit code segments. Thisclass of stack

Vol. 3A 16-5MIXING 16-BIT AND 32-BIT CODEThese methods of transferring program control overcome the following architectural limitationsimposed on call

16-6 Vol. 3AMIXING 16-BIT AND 32-BIT CODEWhile executing 32-bit code, if a call is made to a 16-bit code segment which is at the same ora more privile

Vol. 3A 16-7MIXING 16-BIT AND 32-BIT CODE16.4.2.1 Controlling the Operand-Size Attribute For a CallThree things can determine the operand-size of a ca

16-8 Vol. 3AMIXING 16-BIT AND 32-BIT CODE16.4.3 Interrupt Control TransfersA program-control transfer caused by an exception or interrupt is always ca

Vol. 3A 16-9MIXING 16-BIT AND 32-BIT CODEThe interface procedure becomes more complex if any of these rules are violated. For example,if a 16-bit proc

Vol. 3A 2-11SYSTEM ARCHITECTURE OVERVIEWThe processor is placed in real-address mode following power-up or a reset. The PE flag incontrol register CR0

16-10 Vol. 3AMIXING 16-BIT AND 32-BIT CODE

17IA-32 Architecture Compatibility

Vol. 3A 17-1CHAPTER 17IA-32 ARCHITECTURE COMPATIBILITYAll IA-32 processors are binary compatible. Compatibility means that, within certain limitedcons

17-2 Vol. 3AIA-32 ARCHITECTURE COMPATIBILITY17.2. RESERVED BITSThroughout this manual, certain bits are marked as reserved in many register and memory

Vol. 3A 17-3IA-32 ARCHITECTURE COMPATIBILITY2. Execute the CPUID instruction. The CPUID instruction (added to the IA-32 in the Pentiumprocessor) indic

17-4 Vol. 3AIA-32 ARCHITECTURE COMPATIBILITYming for conversion to integer. The remaining two instructions (MONITOR and MWAIT)accelerate synchronizati

Vol. 3A 17-5IA-32 ARCHITECTURE COMPATIBILITY17.12.1 Instructions Added Prior to the Pentium ProcessorThe following instructions were added in the Inte

17-6 Vol. 3AIA-32 ARCHITECTURE COMPATIBILITY• Bit scan instructions.• Double-shift instructions.• Byte set on condition instruction.• Move with sign/z

Vol. 3A 17-7IA-32 ARCHITECTURE COMPATIBILITY• VIP (virtual interrupt pending), bit 20. • ID (identification flag), bit 21. The AC flag (bit 18) was ad

CONTENTSviVol. 3APAGECHAPTER 5INTERRUPT AND EXCEPTION HANDLING5.1 INTERRUPT AND EXCEPTION OVERVIEW . . . . . . . . . . . . . . . . . . . . . . . . . .

2-12 Vol. 3ASYSTEM ARCHITECTURE OVERVIEW2.3 SYSTEM FLAGS AND FIELDS IN THE EFLAGS REGISTERThe system flags and IOPL field of the EFLAGS register contr

17-8 Vol. 3AIA-32 ARCHITECTURE COMPATIBILITY17.16.2 EFLAGS Pushed on the StackThe setting of the stored values of bits 12 through 15 (which includes t

Vol. 3A 17-9IA-32 ARCHITECTURE COMPATIBILITYAs on the Intel 286 and Intel386 processors, the MP (monitor coprocessor) flag (bit 1 of registerCR0) dete

17-10 Vol. 3AIA-32 ARCHITECTURE COMPATIBILITYis reserved on these processors. The addition of the SF flag on a 32-bit x87 FPU has no impacton software

Vol. 3A 17-11IA-32 ARCHITECTURE COMPATIBILITY17.17.5.1 NANSThe 32-bit x87 FPUs distinguish between signaling NaNs (SNaNs) and quiet NaNs (QNaNs).These

17-12 Vol. 3AIA-32 ARCHITECTURE COMPATIBILITY17.17.6.2 NUMERIC OVERFLOW EXCEPTION (#O)On the 32-bit x87 FPUs, when the numeric overflow exception is m

Vol. 3A 17-13IA-32 ARCHITECTURE COMPATIBILITY16-bit IA-32 math coprocessors, it takes precedence over all other exceptions. This differencecauses no i

17-14 Vol. 3AIA-32 ARCHITECTURE COMPATIBILITY17.17.6.8 INVALID OPERATION EXCEPTION ON DENORMALS An invalid-operation exception is not generated on the

Vol. 3A 17-15IA-32 ARCHITECTURE COMPATIBILITY17.17.6.14 FLOATING-POINT ERROR EXCEPTION (#MF)In real mode and protected mode (not including virtual-808

17-16 Vol. 3AIA-32 ARCHITECTURE COMPATIBILITY17.17.7.5 FUCOM, FUCOMP, AND FUCOMPP INSTRUCTIONSWhen executing the FUCOM, FUCOMP, and FUCOMPP instructio

Vol. 3A 17-17IA-32 ARCHITECTURE COMPATIBILITY16-bit IA-32 math coprocessors do report a denormal-operand exception in this situation. Thisdifference d

Vol. 3A 2-13SYSTEM ARCHITECTURE OVERVIEWThe IOPL is also one of the mechanisms that controls the modification of the IF flagand the handling of interr

17-18 Vol. 3AIA-32 ARCHITECTURE COMPATIBILITY17.17.7.15 FXAM INSTRUCTIONWith the 32-bit x87 FPUs, if the FPU encounters an empty register when executi

Vol. 3A 17-19IA-32 ARCHITECTURE COMPATIBILITY17.17.11Operands Split Across Segments and/or PagesOn the P6 family, Pentium, and Intel486 processor FPUs

17-20 Vol. 3AIA-32 ARCHITECTURE COMPATIBILITYcoprocessor keeps its ERROR# output in inactive state after hardware reset; the Intel 387 copro-cessor ke

Vol. 3A 17-21IA-32 ARCHITECTURE COMPATIBILITYcmp ax, 037fhjz Intel487_SX_Math_CoProcessor_present;ax=037fhjmp Intel486_SX_microprocessor_present;ax=ff

17-22 Vol. 3AIA-32 ARCHITECTURE COMPATIBILITYThe content of CR4 is 0H following a hardware reset.Control register CR4 was introduced in the Pentium pr

Vol. 3A 17-23IA-32 ARCHITECTURE COMPATIBILITY17.21. MEMORY MANAGEMENT FACILITIESThe following sections describe the new memory management facilities a

17-24 Vol. 3AIA-32 ARCHITECTURE COMPATIBILITYthe data cache; in the Intel486 processor, they implement a write-through strategy. See Table10-5 for a c

Vol. 3A 17-25IA-32 ARCHITECTURE COMPATIBILITYOn the P6 family and Pentium processors, reserved bits 11, 12, 14 and 15 are hard-wired to 0.On the Intel

17-26 Vol. 3AIA-32 ARCHITECTURE COMPATIBILITYtecture has been added for handling and reporting on hardware errors. See Chapter 14,“Machine-Check Archi

Vol. 3A 17-27IA-32 ARCHITECTURE COMPATIBILITY17.24.1 Machine-Check ArchitectureThe Pentium Pro processor introduced a new architecture to the IA-32 fo

2-14 Vol. 3ASYSTEM ARCHITECTURE OVERVIEWVIF Virtual Interrupt (bit 19) — Contains a virtual image of the IF flag. This flag is usedin conjunction with

17-28 Vol. 3AIA-32 ARCHITECTURE COMPATIBILITY17.25.3 IDT LimitThe LIDT instruction can be used to set a limit on the size of the IDT. A double-fault e

Vol. 3A 17-29IA-32 ARCHITECTURE COMPATIBILITY• For the 82489DX, in the lowest priority delivery mode, all the target local APICs specifiedby the desti

17-30 Vol. 3AIA-32 ARCHITECTURE COMPATIBILITY17.27.1 P6 Family and Pentium Processor TSSWhen the virtual mode extensions are enabled (by setting the V

Vol. 3A 17-31IA-32 ARCHITECTURE COMPATIBILITYgeneral-protection exceptions (#GP). Figure 17-1 demonstrates the different areas accessed bythe Intel486

17-32 Vol. 3AIA-32 ARCHITECTURE COMPATIBILITYExternal system hardware can force the Pentium processor to disable caching or to use the write-through c

Vol. 3A 17-33IA-32 ARCHITECTURE COMPATIBILITYcache to be disabled and enabled, independently of the L1 and L2 caches (see Section 10.5.4,“Disabling an

17-34 Vol. 3AIA-32 ARCHITECTURE COMPATIBILITYThe sequence bounded by the MOV and JMP instructions should be identity mapped (that is,the instructions

Vol. 3A 17-35IA-32 ARCHITECTURE COMPATIBILITY17.30.2 Error Code PushesThe Intel486 processor implements the error code pushed on the stack as a 16-bit

17-36 Vol. 3AIA-32 ARCHITECTURE COMPATIBILITYThe 32-bit processors also have descriptors for TSS segments, call gates, interrupt gates, andtrap gates

Vol. 3A 17-37IA-32 ARCHITECTURE COMPATIBILITYAn exception to this behavior occurs when a stack access is data aligned, and the stack pointeris pointin

Vol. 3A 2-15SYSTEM ARCHITECTURE OVERVIEW2.4.1 Global Descriptor Table Register (GDTR)The GDTR register holds the base address (32 bits in protected mo

17-38 Vol. 3AIA-32 ARCHITECTURE COMPATIBILITYway of ensuring ordering between routines that produce weakly-ordered results and routines thatconsume th

Vol. 3A 17-39IA-32 ARCHITECTURE COMPATIBILITYbus to send the interrupt vector to the processor. After receiving the interrupt request signal, theproce

17-40 Vol. 3AIA-32 ARCHITECTURE COMPATIBILITY17.36.3 Memory Type Range RegistersMemory type range registers (MTRRs) are a new feature introduced into

Vol. 3A 17-41IA-32 ARCHITECTURE COMPATIBILITY17.36.5 Performance-Monitoring CountersThe P6 family and Pentium processors provide two performance-monit

17-42 Vol. 3AIA-32 ARCHITECTURE COMPATIBILITY

INTEL SALES OFFICESASIA PACIFICAustraliaIntel Corp.Level 2448 St Kilda Road Melbourne VIC3004AustraliaFax:613-9862 5599ChinaIntel Corp.Rm 709, Shaanxi

Intel Corp.999 CANADA PLACE, Suite 404,#11Vancouver BCV6C 3E2CanadaFax:604-844-2813Intel Corp.2650 Queensview Drive, Suite 250Ottawa ONK2B 8H6CanadaFa

2-16 Vol. 3ASYSTEM ARCHITECTURE OVERVIEW2.4.3 IDTR Interrupt Descriptor Table RegisterThe IDTR register holds the base address (32 bits in protected m

Vol. 3A 2-17SYSTEM ARCHITECTURE OVERVIEWThe control registers are summarized below, and each architecturally defined control field inthese control reg

2-18 Vol. 3ASYSTEM ARCHITECTURE OVERVIEWWhen loading a control register, reserved bits should always be set to the values previously read.The flags in

Vol. 3A 2-19SYSTEM ARCHITECTURE OVERVIEWNW Not Write-through (bit 29 of CR0) — When the NW and CD flags are clear, write-back (for Pentium 4, Intel Xe

2-20 Vol. 3ASYSTEM ARCHITECTURE OVERVIEW• If the TS flag is set and the MP flag (bit 1 of CR0) and EM flag are clear, an #NMexception is not raised pr

Vol. 3A 2-21SYSTEM ARCHITECTURE OVERVIEWFPU or math coprocessor present in the system. Table 2-1 shows the interaction of theEM, MP, and TS flags.Also

Vol. 3A viiCONTENTSPAGEInterrupt 16—x87 FPU Floating-Point Error (#MF) . . . . . . . . . . . . . . . . . . . . . . 5-55Interrupt 17—Alignment Check E

2-22 Vol. 3ASYSTEM ARCHITECTURE OVERVIEWVME Virtual-8086 Mode Extensions (bit 0 of CR4) — Enables interrupt- and exception-handling extensions in virt

Vol. 3A 2-23SYSTEM ARCHITECTURE OVERVIEWWhen enabling the global page feature, paging must be enabled (by setting the PG flagin control register CR0)

2-24 Vol. 3ASYSTEM ARCHITECTURE OVERVIEW2.5.1 CPUID Qualification of Control Register FlagsThe VME, PVI, TSD, DE, PSE, PAE, MCE, PGE, PCE, OSFXSR, and

Vol. 3A 2-25SYSTEM ARCHITECTURE OVERVIEW2.6.1 Loading and Storing System RegistersThe GDTR, LDTR, IDTR, and TR registers each have a load and store in

2-26 Vol. 3ASYSTEM ARCHITECTURE OVERVIEW• SLDT (Store LDT Register) — Stores the LDT segment selector from the LDTR registerinto memory or a general-p

Vol. 3A 2-27SYSTEM ARCHITECTURE OVERVIEWOffset Is Within Limits (LSL Instruction),” for a detailed explanation of the function and use ofthis instruct

2-28 Vol. 3ASYSTEM ARCHITECTURE OVERVIEWHardware may respond to this signal in a number of ways. An indicator light on the front panelmay be turned on

Vol. 3A 2-29SYSTEM ARCHITECTURE OVERVIEWSee Section 18.10, “Performance Monitoring Overview,” and Section 18.9, “Time-StampCounter,” for more informat

2-30 Vol. 3ASYSTEM ARCHITECTURE OVERVIEW

3Protected-Mode Memory Management

CONTENTSviiiVol. 3APAGE7.5.4 MP Initialization Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-187.5.4.1

Vol. 3A 3-1CHAPTER 3PROTECTED-MODE MEMORY MANAGEMENTThis chapter describes the IA-32 architecture’s protected-mode memory management facilities,includ

3-2 Vol. 3APROTECTED-MODE MEMORY MANAGEMENTIf paging is not used, the linear address space of the processor is mapped directly into the phys-ical addr

Vol. 3A 3-3PROTECTED-MODE MEMORY MANAGEMENTIf the page being accessed is not currently in physical memory, the processor interrupts execu-tion of the

3-4 Vol. 3APROTECTED-MODE MEMORY MANAGEMENTMore complexity can be added to this protected flat model to provide more protection. Forexample, for the p

Vol. 3A 3-5PROTECTED-MODE MEMORY MANAGEMENT3.2.3 Multi-Segment ModelA multi-segment model (such as the one shown in Figure 3-4) uses the full capabili

3-6 Vol. 3APROTECTED-MODE MEMORY MANAGEMENT3.2.4 Segmentation in IA-32e ModeIn IA-32e mode, the effects of segmentation depend on whether the processo

Vol. 3A 3-7PROTECTED-MODE MEMORY MANAGEMENT3.3.1 Physical Address Space for Processors with Intel® EM64TOn processors that support Intel EM64T (CPUID.

3-8 Vol. 3APROTECTED-MODE MEMORY MANAGEMENTIf paging is not used, the processor maps the linear address directly to a physical address (thatis, the li

Vol. 3A 3-9PROTECTED-MODE MEMORY MANAGEMENTTI (table indicator) flag(Bit 2) — Specifies the descriptor table to use: clearing this flag selects theGDT

Vol. 3A ixCONTENTSPAGE7.11.6.3 Halt Idle Logical Processors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-527.11.6.4 Po

3-10 Vol. 3APROTECTED-MODE MEMORY MANAGEMENTcan be available for immediate use. Other segments can be made available by loading theirsegment selectors

Vol. 3A 3-11PROTECTED-MODE MEMORY MANAGEMENT3.4.4 Segment Loading Instructions in IA-32e ModeBecause ES, DS, and SS segment registers are not used in

3-12 Vol. 3APROTECTED-MODE MEMORY MANAGEMENT3.4.5 Segment DescriptorsA segment descriptor is a data structure in a GDT or LDT that provides the proces

Vol. 3A 3-13PROTECTED-MODE MEMORY MANAGEMENTsegment limit has the reverse function; the offset can range from the segmentlimit to FFFFFFFFH or FFFFH,

3-14 Vol. 3APROTECTED-MODE MEMORY MANAGEMENTsegment. (This flag should always be set to 1 for 32-bit code and data segmentsand to 0 for 16-bit code an

Vol. 3A 3-15PROTECTED-MODE MEMORY MANAGEMENTL (64-bit code segment) flagIn IA-32e mode, bit 21 of the second doubleword of the segment descriptorindic

3-16 Vol. 3APROTECTED-MODE MEMORY MANAGEMENTStack segments are data segments which must be read/write segments. Loading the SS registerwith a segment

Vol. 3A 3-17PROTECTED-MODE MEMORY MANAGEMENT3.5 SYSTEM DESCRIPTOR TYPESWhen the S (descriptor type) flag in a segment descriptor is clear, the descrip

3-18 Vol. 3APROTECTED-MODE MEMORY MANAGEMENTSee also: Section 3.5.1, “Segment Descriptor Tables”, and Section 6.2.2, “TSS Descriptor”(for more informa

Vol. 3A 3-19PROTECTED-MODE MEMORY MANAGEMENTEach system must have one GDT defined, which may be used for all programs and tasks in thesystem. Optional