Intel 64 and IA-32 Architectures Software Developers Manual Volume 3B, System Programming Guide Part 2

Vol. 3 28-7
HANDLING BOUNDARY CONDITIONS IN A VIRTUAL MACHINE MONITOR
page-table virtualization) to trap guest accesses to the page frame hosting the
virtual local APIC registers.
Local APIC virtualization in the VMM needs to emulate the various local APIC opera-
tions and registers, such as: APIC identification/format registers, the local vector
table (LVT), the interrupt command register (ICR), interrupt capture registers (TMR,
IRR and ISR), task and processor priority registers (TPR, PPR), the EOI register and
the APIC-timer register. Since local APICs are designed to operate with non-specific
EOI, local APIC emulation also needs to emulate broadcast of EOI to the guest’s
virtual I/O APICs for level triggered virtual interrupts.
A local APIC allows interrupt masking at two levels: (1) mask bit in the local vector
table entry for local interrupts and (2) raising processor priority through the TPR
registers for masking lower priority external interrupts. The VMM needs to compre-
hend these virtual local APIC mask settings as programmed by the guest in addition
to the guest virtual processor interruptibility state (when injecting APIC routed
external virtual interrupts to a guest VM).
VMX provides several features which help the VMM to virtualize the local APIC. These
features allow many of guest TPR accesses (using CR8 only) to occur without VM
exits to the VMM:
• The VMCS contains a 'Virtual-APIC page address' field. This 64-bit field is the
physical address of the 4-KByte virtual APIC page (4-KByte aligned). The virtual-
APIC page contains a TPR shadow, which is accessed by the MOV CR8 instruction.
The TPR shadow comprises bits 7:4 in byte 80H of the virtual-APIC page.
• The TPR threshold: bits 3:0 of this 32-bit field determine the threshold below
which the TPR shadow cannot fall. A VM exit will occur after an execution of MOV
CR8 that reduces the TPR shadow below this value.
• The processor-based VM-execution controls field contains a 'Use TPR shadow' bit
and a 'CR8-store exiting' bit. If 'Use TPR shadow' is set and 'CR8-store exiting' is
cleared, then a MOV from CR8 reads from the TPR shadow. If the 'CR8-store
exiting' VM-execution control is set, then MOV from CR8 causes a VM exit. 'Use
TPR shadow' is ignored in this case.
• The processor-based VM-execution controls field contains a 'CR8-load exiting'
bit. If 'Use TPR shadow' is set and 'CR8-load exiting' is clear, then MOV to CR8
writes to the 'TPR shadow'. A VM exit will occur after this write if the value written
is below the TPR threshold. If 'CR8-load exiting' is set, then MOV to CR8 causes a
VM exit. 'Use TPR shadow' is ignored in this case.
28.3.2.4 I/O APIC Virtualization
The I/O APIC registers are typically mapped to a 1 MByte region where each I/O APIC
is allocated a 4K address window within this range. The VMM may utilize physical
memory virtualization to trap guest accesses to the virtual I/O APIC memory-
mapped registers. The I/O APIC virtualization needs to emulate the various I/O APIC
operations and registers such as identification/version registers, indirect-I/O-access
registers, EOI register, and the I/O redirection table. I/O APIC virtualization also