Vol. 3C 28-3

VMX SUPPORT FOR ADDRESS TRANSLATION

28.2.2 

EPT Translation Mechanism

The EPT translation mechanism uses only bits 47:0 of each guest-physical address.

1

 It uses a page-walk length of 

4, meaning that at most 4 EPT paging-structure entries are accessed to translate a guest-physical address.

2

These 48 bits are partitioned by the logical processor to traverse the EPT paging structures:

•

A 4-KByte naturally aligned EPT PML4 table is located at the physical address specified in bits 51:12 of the 
extended-page-table pointer (EPTP), a VM-execution control field (see Table 24-8 in Section 24.6.11). An EPT 
PML4 table comprises 512 64-bit entries (EPT PML4Es). An EPT PML4E is selected using the physical address 
defined as follows:
— Bits 63:52 are all 0.
— Bits 51:12 are from the EPTP.
— Bits 11:3 are bits 47:39 of the guest-physical address.
— Bits 2:0 are all 0.
Because an EPT PML4E is identified using bits 47:39 of the guest-physical address, it controls access to a 512-
GByte region of the guest-physical-address space. The format of an EPT PML4E is given in Table 28-1.

•

A 4-KByte naturally aligned EPT page-directory-pointer table is located at the physical address specified in 
bits 51:12 of the EPT PML4E. An EPT page-directory-pointer table comprises 512 64-bit entries (EPT PDPTEs). 
An EPT PDPTE is selected using the physical address defined as follows:
— Bits 63:52 are all 0.
— Bits 51:12 are from the EPT PML4E.

1. No processors supporting the Intel 64 architecture support more than 48 physical-address bits. Thus, no such processor can pro-

duce a guest-physical address with more than 48 bits. An attempt to use such an address causes a page fault. An attempt to load 

CR3 with such an address causes a general-protection fault. If PAE paging is being used, an attempt to load CR3 that would load a 

PDPTE with such an address causes a general-protection fault.

2. Future processors may include support for other EPT page-walk lengths. Software should read the VMX capability MSR 

IA32_VMX_EPT_VPID_CAP (see Appendix A.10) to determine what EPT page-walk lengths are supported.

Table 28-1.  Format of an EPT PML4 Entry (PML4E) that References an EPT Page-Directory-Pointer Table

Bit 

Position(s)

Contents

0

Read access; indicates whether reads are allowed from the 512-GByte region controlled by this entry

1

Write access; indicates whether writes are allowed to the 512-GByte region controlled by this entry

2

Execute access; indicates whether instruction fetches are allowed from the 512-GByte region controlled by this 

entry

7:3

Reserved (must be 0)

8

If bit 6 of EPTP is 1, accessed flag for EPT; indicates whether software has accessed the 512-GByte region 

controlled by this entry (see Section 28.2.4). Ignored if bit 6 of EPTP is 0

11:9

Ignored

(N–1):12

Physical address of 4-KByte aligned EPT page-directory-pointer table referenced by this entry

1

NOTES:

1. N is the physical-address width supported by the processor. Software can determine a processor’s physical-address width by execut-

ing CPUID with 80000008H in EAX. The physical-address width is returned in bits 7:0 of EAX.

51:N

Reserved (must be 0)

63:52

Ignored