743844-015.pdf - 第35页

— This avoids flushes on VM tr ansitions to give a lower-cost VM tr ansition time and an over all reduction in virtualization overhead. • Guest Preemption Timer — The mechanism for a VMM to preempt the execution of a gue…

2. If the translation of the linear address specifies supervisor mode (the

U/ S bit was clear in at least one of the paging-structure entries used

to translate the linear address), the resulting guest-physical address is

executable under EPT only if the XS bit is set in every EPT paging-

structure entry used to translate the guest-physical address.

• The XU and XS bits are used only when translating linear addresses for

guest code fetches. They do not apply to guest page walks, data accesses,

or A/D-bit updates.

• VMEntry - If the "activate secondary controls" and "Mode-based execute control

for EPT" VM-execution controls are both 1, VM entries ensure that the "enable

EPT" VM-execution control is 1. VM entry fails if this check fails. When such a

failure occurs, control is passed to the next instruction.

• VMExit - The exit qualification due to EPT violation reports clearly whether the

violation was due to User mode access or supervisor mode access.

— Capability Querying: IA32_VMX_PROCBASED_CTLS2 has bit to indicate the

capability, RDMSR can be used to read and query whether the processor

supports the capability or not.

• Extended Page Table (EPT) Accessed and Dirty Bits

— EPT A/D bits enabled VMMs to efficiently implement memory management and

page classification algorithms to optimize VM memory operations, such as de-

fragmentation, paging, live migration, and check-pointing. Without hardware

support for EPT A/D bits, VMMs may need to emulate A/D bits by marking EPT

paging-structures as not-present or read-only, and incur the overhead of EPT

page-fault VM exits and associated software processing.

• EPTP (EPT pointer) switching

— EPTP switching is a specific VM function. EPTP switching allows guest software

(in VMX non-root operation, supported by EPT) to request a different EPT

paging-structure hierarchy. This is a feature by which software in VMX non-

root operation can request a change of EPTP without a VM exit. The software

will be able to choose among a set of potential EPTP values determined in

advance by software in VMX root operation.

• Pause loop exiting

— Support VMM schedulers seeking to determine when a virtual processor of a

multiprocessor virtual machine is not performing useful work. This situation

may occur when not all virtual processors of the virtual machine are currently

scheduled and when the virtual processor in question is in a loop involving the

PAUSE instruction. The new feature allows detection of such loops and is thus

called PAUSE-loop exiting.

The processor IA core supports the following Intel

VT-x features:

• Extended Page Tables (EPT)

— EPT is hardware assisted page table virtualization

— It eliminates VM exits from guest OS to the VMM for shadow page-table

maintenance

• Virtual Processor IDs (VPID)

— Ability to assign a VM ID to tag processor IA core hardware structures (such

as TLBs)

Intel

Core

™

, Xeon

™

6300 And Xeon

™

E 2400 Processors—Technologies

Generation Intel

Core

™

, Intel

Core

™

Generation, Intel

Core

™

Processor (Series 1) and (Series 2), Intel

Xeon

™

2400 Processor and Intel

Xeon

™

6300 Processor

Datasheet, Volume 1 of 2 May 2025

34 Doc. No.: 743844, Rev.: 015

— This avoids flushes on VM transitions to give a lower-cost VM transition time

and an overall reduction in virtualization overhead.

• Guest Preemption Timer

— The mechanism for a VMM to preempt the execution of a guest OS after an

amount of time specified by the VMM. The VMM sets a timer value before

entering a guest

— The feature aids VMM developers in flexibility and Quality of Service (QoS)

guarantees

• Descriptor-Table Exiting

— Descriptor-table exiting allows a VMM to protect a guest OS from internal

(malicious software based) attack by preventing the relocation of key system

data structures like IDT (interrupt descriptor table), GDT (global descriptor

table), LDT (local descriptor table), and TSS (task segment selector).

— A VMM using this feature can intercept (by a VM exit) attempts to relocate

these data structures and prevent them from being tampered by malicious

software.

Intel

Virtualization Technology for Directed I/O

Intel

VT-d Objectives

The key Intel

Virtualization Technology (Intel

VT) for Directed I/O (Intel

VT-d)

objectives are domain-based isolation and hardware-based virtualization. A domain

can be abstractly defined as an isolated environment in a platform to which a subset

of host physical memory is allocated. Intel

VT-d provides accelerated I/O

performance for a Virtualization platform and provides software with the following

capabilities:

• I/O Device Assignment and Security: for flexibly assigning I/O devices to VMs

and extending the protection and isolation properties of VMs for I/O operations.

• DMA Remapping: for supporting independent address translations for Direct

Memory Accesses (DMA) from devices.

• Interrupt Remapping: for supporting isolation and routing of interrupts from

devices and external interrupt controllers to appropriate VMs.

• Reliability: for recording and reporting to system software DMA and interrupt

errors that may otherwise corrupt memory or impact VM isolation.

Intel

VT-d accomplishes address translation by associating transaction from a given

I/O device to a translation table associated with the Guest to which the device is

assigned. It does this by means of the data structure in the following illustration. This

table creates an association between the device's PCI Express* Bus/Device/Function

(B/D/F) number and the base address of a translation table. This data structure is

populated by a VMM to map devices to translation tables in accordance with the device

assignment restrictions above and to include a multi-level translation table (VT-d

Table) that contains Guest specific address translations.

2.2.2

Technologies—Intel

Core

™

, Xeon

™

6300 And Xeon

™

E 2400 Processors

Generation Intel

Core

™

, Intel

Core

™

Generation, Intel

Core

™

Processor (Series 1) and (Series 2), Intel

Xeon

™

2400 Processor and Intel

Xeon

™

6300 Processor

May 2025 Datasheet, Volume 1 of 2

Doc. No.: 743844, Rev.: 015 35

Figure 10. Device to Domain Mapping Structures

Root entry 0

Root entry N

Root entry 255

Context entry 0

Context entry 255

Context entry 0

Context entry 255

(Bus 255)

(Bus N)

(Bus 0)

Root entry table

(Dev 31, Func 7)

(Dev 0, Func 1)

(Dev 0, Func 0)

Context entry Table

For bus N

Context entry Table

For bus 0

Address Translation

Structures for Domain A

Address Translation

Structures for Domain B

Intel

VT-d functionality often referred to as an Intel

VT-d Engine, has typically been

implemented at or near a PCI Express* host bridge component of a computer system.

This might be in a chipset component or in the PCI Express functionality of a processor

with integrated I/O. When one such VT-d engine receives a PCI Express transaction

from a PCI Express bus, it uses the B/D/F number associated with the transaction to

search for an Intel

VT-d translation table. In doing so, it uses the B/D/F number to

traverse the data structure shown in the above figure. If it finds a valid Intel

VT-d

table in this data structure, it uses that table to translate the address provided on the

PCI Express bus. If it does not find a valid translation table for a given translation, this

results in an Intel

VT-d fault. If Intel

VT-d translation is required, the Intel

VT-d

engine performs an N-level table walk.

Intel

Core

™

, Xeon

™

6300 And Xeon

™

E 2400 Processors—Technologies

Generation Intel

Core

™

, Intel

Core

™

Generation, Intel

Core

™

Processor (Series 1) and (Series 2), Intel

Xeon

™

2400 Processor and Intel

Xeon

™

6300 Processor

Datasheet, Volume 1 of 2 May 2025

36 Doc. No.: 743844, Rev.: 015