Model-Specific RegistersTest RegistersThen three moreThe ‘Model-Specific’ conceptQuite a few MSRs now!The Time-Stamp CounterUsing the TSCThe TSC as an MSRIA32_APIC_BASERelocating the APIC registersExtended Feature Enable RegisterDemo: ‘try64bit.s’New 4-Level page-tables needed4-Levels of mappingPage-Table entry formatSegment descriptorsA few GDT descriptors…You must update ‘binutils’Model-Specific RegistersA look at Intel’s scheme for introducing new CPU featuresTest Registers•The 80386 implemented two registers for testing its Translation Look-aside Buffer (i.e., the special cache used for speeding up virtual-to-physical address-conversions•The registers were named TR6 and TR7•Intel warned that these system registers were unique to the 80386 CPU’s design and might not be present in future chipsThen three more•The TR6 and TR7 registers were kept in the 80486 design -- along with three extra Test Registers (TR3, TR4, TR5) that allowed testing of the processor’s caches for code and data•Again Intel warned that these registers were unique to the 80486 CPU’s design and that they might not be implemented in subsequent chips•Sure enough, in the 80586 (‘Pentium’) they were gone – so software written to use them would no longer execute on the newer Pentium CPUsThe ‘Model-Specific’ concept•Beginning with the Pentium processor, Intel has been including ‘experimental’ features in its processors, warning that they may disappear from future designs, but providing a standard and permanent way for all such features to be accessed•This access is via a pair of ‘privileged’ instructions (rdmsr and wrmsr) that can only be executed by ‘ring0’ codeQuite a few MSRs now!•At first there were only about a dozen of these MSRs (Model-Specific Registers), but lately their number is well over 200•Some MSRs have evidently proven to be sufficiently satisfactory and worth having that they are now deemed as permanent fixtures of the defined i386 architectureThe Time-Stamp Counter•This 64-bit Model-Specific Register was introduced in the Pentium processor and has been present in each CPU thereafter•It increments once every CPU clock-cycle, starting from 0 when power is turned on•It won’t overflow for at least ten years •Unprivileged programs (ring3) normally can access, it via the rdtsc instructionUsing the TSC EDX EAX 63 32 31 064-bitstime0: .quad 0 # saves starting value from the TSC time1: .quad 0 # saves concluding value from TSC# how you can measure CPU clock-cycles in a code-fragment rdtsc # read the Time-Stamp Countermovl %eax, time0+0 # save least-significant longwordmovl %edx, time0+4 # save most-significant longword# <Your code-fragment to be measured goes here>rdtsc # read the Time-Stamp Countermovl %eax, time1+0 # save least-significant longwordmovl %edx, time1+4 # save most-significant longword# now subtract starting-value ‘time0’ from ending value ‘time1’The TSC as an MSR•Each Model-Specific Register has its own identifying register-number, and can be accessed (from ring0) using the special pair of instructions: rdmsr and wrmsr •The Time-Stamp Counter is MSR number 0x10•To write a new 64-bit value into the TSC, you load the desired 64-bit value into the EDX:EAX register-pair, you put the MSR ID-number 0x10 into register ECX, then you execute wrmsrIA32_APIC_BASE•This register has MSR number 0x1B and it’s private to each CPU in an SMP system •It establishes the base-address for the Local-APIC’s memory-mapped registers (the default base-address is 0xFEE00000, but that can be changed using this MSR)•The CPU’s Local-APIC functions can be either enabled or disabled (via bit #11)•The BSP can be recognized (via bit #8)Relocating the APIC registersreserved 63 32 31 12 11 8 0IA32_APIC_BASE (64-bits)APIC base-address(4K page-number)ENBSPDefault-value for APIC base-address page = 0xFEE00Local-APIC Enable bit (1=enabled, 0=disabled)Boot-Strap Processor (read-only): 1=yes, 0=no# make the processor’s Local-APIC registers accessible in real-modemov $0x000D8000, %eax # least-significant 32-bitsmov $0x00000000, %edx # most-significant 32-bitsmov $0x1B, %ecx # MSR register-numberwrmsr # write to specified MSRExtended Feature Enable Register•The EFER was introduced in conformity with Advanced Microprocessor Designs way of implementing 64-bit architecture•Its MSR register-number is 0xC0000080 reserved 63 32 31 12 11 10 9 8 0IA32_EFER (64-bits)reservedXD32eESYSCALL32eAeXecute-Disable bit in paging structures (1=enabled, 0=disabled)IA32e-mode is active (1=yes, 0=no)Enable IA32e-mode (1=yes, 0=no)Enable SYSCALL/SYSRET instructions in 64-bit mode (1=yes, 0=no)Demo: ‘try64bit.s’•We created a demo-program that shows what steps are needed to enable the new 64-bit capabilities of recent Pentium-D or Core 2 Duo processors (using EFER)•This demo cannot be executed on our current CS Lab/Classroom workstations, but it CAN execute on a remote-access department server named ‘anchor00’New 4-Level page-tables needed•For executing in 64-bit mode, the PAE-bit (Page-Addressing Extensions) must be enabled (bit #6 in Control Register CR4) and 4-levels of page-table structures must be prepared which implement an “identity mapping” for the transition-code itself•Then 64-bit mode is entered by turning on the PG-bit in Control Register 0 (assuming bit #8 in the EFER register was set to 1)4-Levels of mappingPageMapLevel-4TableCR3PageDirectoryPointerTablePageDirectoryPageTablePageFrame(4KB)offset64-bit ‘canonical’ virtual addresssign-extensionPML4 PDPT PDIR PTBL 63 48 47 39 38 30 29 21 20 12 11 0Each mapping-table contains up to 512 quadword-size entriesPage-Table entry format Base Address [39..32]EXB63 62 52 51 40 39 32availablereserved(must be 0) 31 12 11 9 8 0PR/WS/UPWTPCDADPATGBase Address [31..12] availLegend: P = present (0=no, 1=yes) PWT = Page Write-Through (0=no, 1=yes) R/W (0=read-only, 1=writable) PCD = Page Caching Disable (0=no, 1=yes) S/U (0=supervisor-only, 1=user) PAT = Page-Attribute Table-Index A = accessed (0=no, 1=yes) G = Global page (1=yes, 0=no) D = dirty (0=no, 1=yes)Segment