vmrun

Run Virtual Machine

VMRUN

Switch to guest VM (AMD SVM).

Details

Switches execution from host to guest virtual machine context by loading guest state from the VMCB (Virtual Machine Control Block) addressed by RAX; serializes the processor and triggers a full context switch including segment registers, control registers, and TLB state. Available only in 64-bit mode with AMD SVM (Secure Virtual Machine) enabled and appropriate privilege level; no flags are affected from the host perspective as execution transfers to guest.

Pseudocode Operation

VMCB_addr ← RAX;
load_guest_state(VMCB_addr);
execute_guest();

Example

VMRUN

Encoding

Binary Layout

Format SVM

Opcode 0F 01 D8

Extension SVM

Operands

Reference (AMD APM)

Instruction Forms

Opcode	Instruction	Op/En	64/32-bit Mode	CPUID	Description
0F 01 D8	VMRUN rAX				Performs a world-switch to guest.

Description

Starts execution of a guest instruction stream. The physical address of the virtual machine control block (VMCB) describing the guest is taken from the rAX register (the portion of RAX used to form the address is determined by the effective address size). The physical address of the VMCB must be aligned on a 4KB boundary. VMRUN saves a subset of host processor state to the host state-save area specified by the physical address in the VM_HSAVE_PA MSR. VMRUN then loads guest processor state (and control information) from the VMCB at the physical address specified in rAX. The processor then executes guest instructions until one of several intercept events (specified in the VMCB) is triggered. When an intercept event occurs, the processor stores a snapshot of the guest state back into the VMCB, reloads the host state, and continues execution of host code at the instruction following the VMRUN instruction. This is a Secure Virtual Machine (SVM) instruction. Support for the SVM architecture and the SVM instructions is indicated by CPUID Fn8000_0001_ECX[SVM] = 1. For more information on using the CPUID instruction, see the reference page for the CPUID instruction on page 165. This instruction generates a #UD exception if SVM is not enabled. See “Enabling SVM” in APM Volume 2. The VMRUN instruction is not supported in System Management Mode. Processor behavior resulting from an attempt to execute this instruction from within the SMM handler is undefined. Instruction Encoding

Operation

IF ((MSR_EFER.SVME == 0) || (!PROTECTED_MODE))
EXCEPTION [#UD]      //  This instruction can only be executed in protected
//  mode with SVM enabled
IF (CPL != 0)              //  This instruction is only allowed at CPL 0
EXCEPTION [#GP]
IF (rAX contains an unsupported physical address)
EXCEPTION [#GP]
IF (intercepted(VMRUN))
#VMEXIT (VMRUN)
remember VMCB address (delivered in rAX) for next #VMEXIT
save host state to physical memory indicated in the VM_HSAVE_PA MSR:
ES.sel
CS.sel
SS.sel
492                                                System Instruction Reference
DS.sel
GDTR.{base,limit}
IDTR.{base,limit}
EFER
CR0
CR4
CR3
// host CR2 is not saved
RFLAGS
RIP
RSP
RAX
from the VMCB at physical address rAX, load control information:
intercept vector
TSC_OFFSET
interrupt control (v_irq, v_intr_*, v_tpr)
EVENTINJ field
ASID
IF(nested paging supported)
NP_ENABLE
IF (NP_ENABLE == 1)
nCR3
from the VMCB at physical address rAX, load guest state:
ES.{base,limit,attr,sel}
CS.{base,limit,attr,sel}
SS.{base,limit,attr,sel}
DS.{base,limit,attr,sel}
GDTR.{base,limit}
IDTR.{base,limit}
EFER
CR0
CR4
CR3
CR2
IF (NP_ENABLE == 1)
gPAT            //  Leaves host hPAT register unchanged.
RFLAGS
RIP
RSP
RAX
DR7
DR6
CPL            //  0 for real mode, 3 for v86 mode, else as loaded.
INTERRUPT_SHADOW
IF (LBR virtualization supported)
LBR_VIRTUALIZATION_ENABLE
IF (LBR_VIRTUALIZATION_ENABLE == 1)
System Instruction Reference                                                   493
save LBR state to the host save area
DBGCTL
BR_FROM
BR_TO
LASTEXCP_FROM
LASTEXCP_TO
load LBR state from the VMCB
DBGCTL
BR_FROM
BR_TO
LASTEXCP_FROM
LASTEXCP_TO
IF (guest state consistency checks fail)
#VMEXIT(INVALID)
Execute command stored in TLB_CONTROL.
GIF = 1           // allow interrupts in the guest
IF (EVENTINJ.V)
cause exception/interrupt in guest
else
jump to first guest instruction
Upon #VMEXIT, the processor performs the following actions in order to return to the host execution
context:
GIF = 0
save guest state to VMCB:
ES.{base,limit,attr,sel}
CS.{base,limit,attr,sel}
SS.{base,limit,attr,sel}
DS.{base,limit,attr,sel}
GDTR.{base,limit}
IDTR.{base,limit}
EFER
CR4
CR3
CR2
CR0
if (nested paging enabled)
gPAT
RFLAGS
RIP
RSP
RAX
DR7
DR6
CPL
INTERRUPT_SHADOW
save additional state and intercept information:
V_IRQ, V_TPR
494                                                System Instruction Reference
EXITCODE
EXITINFO1
EXITINFO2
EXITINTINFO
clear EVENTINJ field in VMCB
prepare for host mode by clearing internal processor state bits:
clear intercepts
clear v_irq
clear v_intr_masking
clear tsc_offset
disable nested paging
clear ASID to zero
reload host state
GDTR.{base,limit}
IDTR.{base,limit}
EFER
CR0
CR0.PE = 1  // saved copy of CR0.PE is ignored
CR4
CR3
if (host is in PAE paging mode)
reloaded host PDPEs
// Do not reload host CR2 or PAT
RFLAGS
RIP
RSP
RAX
DR7 = “all disabled”
CPL = 0
ES.sel; reload segment descriptor from GDT
CS.sel; reload segment descriptor from GDT
SS.sel; reload segment descriptor from GDT
DS.sel; reload segment descriptor from GDT
if (LBR virtualization supported)
LBR_VIRTUALIZATION_ENABLE
if (LBR_VIRTUALIZATION_ENABLE == 1)
save LBR state to the VMCB:
DBGCTL
BR_FROM
BR_TO
LASTEXCP_FROM
LASTEXCP_TO
load LBR state from the host save area:
DBGCTL
BR_FROM
BR_TO
LASTEXCP_FROM
LASTEXCP_TO
System Instruction Reference                                                   495
if (illegal host state loaded, or exception while loading host state)
shutdown
else
execute first host instruction following the VMRUN

Flags Affected

None.

Exceptions

Virtual Exception Real 8086 Protected Cause of Exception The SVM instructions are not supported as indicated by X X X CPUID Fn8000_0001_ECX[SVM] = 0. Invalid opcode, #UD X Secure Virtual Machine was not enabled (EFER.SVME=0). X X The instruction is only recognized in protected mode. X CPL was not 0. General protection, rAX referenced a physical address above the maximum X #GP supported physical address. X The address in rAX was not aligned on a 4Kbyte boundary. 496 System Instruction Reference