Intel E3-1280 v3 BX80646E31280V3 User Manual

•

Descriptor-Table Exiting
— Descriptor-table exiting allows a VMM to protect a guest OS from internal

(malicious software based) attack by preventing relocation of key system data

structures like IDT (interrupt descriptor table), GDT (global descriptor table),

LDT (local descriptor table), and TSS (task segment selector).

— A VMM using this feature can intercept (by a VM exit) attempts to relocate

these data structures and prevent them from being tampered by malicious

software.

The key Intel VT-d objectives are domain-based isolation and hardware-based

virtualization. A domain can be abstractly defined as an isolated environment in a

platform to which a subset of host physical memory is allocated. Intel VT-d provides

accelerated I/O performance for virtualized platform and provides software with the

following capabilities:
•

I/O device assignment and security: for flexibly assigning I/O devices to VMs and

extending the protection and isolation properties of VMs for I/O operations.

•

DMA remapping: for supporting independent address translations for Direct

Memory Accesses (DMA) from devices.

•

Interrupt remapping: for supporting isolation and routing of interrupts from

devices and external interrupt controllers to appropriate VMs.

•

Reliability: for recording and reporting to system software DMA and interrupt

errors that may otherwise corrupt memory or impact VM isolation.

Intel VT-d accomplishes address translation by associating transaction from a given

I/O device to a translation table associated with the Guest to which the device is

assigned. It does this by means of the data structure in the following illustration. This

table creates an association between device's PCI Express* ―Bus/Device/Function‖

(B/D/F) number and the base address of a translation table. This data structure is

populated by a VMM to map devices to translation tables in accordance with the device

assignment restrictions above, and to include a multi-level translation table (VT-d

Table) that contains Guest specific address translations.

Intel

®

 Xeon

®

 Processor E3-1200 v3 Product Family

Datasheet – Volume 1 of 2

June 2013

40

Order No.: 328907-001