vmxon

Enter VMX Operation

VMXON m64

Enters VMX root operation (Host Mode).

Details

Enters VMX root operation (host/hypervisor mode) using a 64-bit VMXON region pointer loaded from memory. The instruction validates the VMXON region, sets the VMXON flag in CR4, and transitions the processor to VMX root mode; failure causes #UD or sets RFLAGS.CF/ZF. This is a privileged instruction (requires CPL=0) and available only on processors with VMX support.

Pseudocode Operation

if (CPL != 0 || VMX_ENABLED == 0) raise #UD
VMXON_PTR ← [m64]
if (!validate_vmxon_region(VMXON_PTR)) { RFLAGS.CF ← 1; RFLAGS.ZF ← 0; } else { VMX_ROOT ← 1; RFLAGS.CF ← 0; RFLAGS.ZF ← 0; }

Example

VMXON [rbp-8]

Encoding

Binary Layout

ModRM

Format VMX

Opcode F3 0F C7 /6

Extension VMX

Operands

dest
64-bit memory operand (quadword)

Reference (Intel® SDM)

Instruction Forms

Opcode	Instruction	Op/En	64/32-bit Mode	CPUID	Description
F3 0F C7 /6	VMXON m64	M			Enter VMX root operation.

Description

Puts the logical processor in VMX operation with no current VMCS, blocks INIT signals, disables A20M, and clears any address-range monitoring established by the MONITOR instruction.1 The operand of this instruction is a 4KB-aligned physical address (the VMXON pointer) that references the VMXON region, which the logical processor may use to support VMX operation. This operand is always 64 bits and is always in memory.

Operation

IF (register operand) or (CR0.PE = 0) or (CR4.VMXE = 0) or (RFLAGS.VM = 1) or (IA32_EFER.LMA = 1 and CS.L = 0)
THEN #UD;
ELSIF not in VMX operation
THEN
IF (CPL > 0) or (in A20M mode) or
(the values of CR0 and CR4 are not supported in VMX operation; see Section 26.8) or
(bit 0 (lock bit) of IA32_FEATURE_CONTROL MSR is clear) or
(in SMX operation2 and bit 1 of IA32_FEATURE_CONTROL MSR is clear) or
(outside SMX operation and bit 2 of IA32_FEATURE_CONTROL MSR is clear)
THEN #GP(0);
ELSE
addr := contents of 64-bit in-memory source operand;
IF addr is not 4KB-aligned or
addr sets any bits beyond the physical-address width3,4
THEN VMfailInvalid;
ELSE
rev := 32 bits located at physical address addr;
IF rev[30:0] ≠ VMCS revision identifier supported by processor OR rev[31] = 1
THEN VMfailInvalid;
ELSE

1.  See the information on MONITOR/MWAIT in Chapter 11, “Multiple-Processor Management,” of the Intel® 64 and IA-32 Architectures
Software Developer’s Manual, Volume 3A.
2. A logical processor is in SMX operation if GETSEC[SEXIT] has not been executed since the last execution of GETSEC[SENTER]. A logi-
cal processor is outside SMX operation if GETSEC[SENTER] has not been executed or if GETSEC[SEXIT] was executed after the last
execution of GETSEC[SENTER]. See Chapter 7, “Safer Mode Extensions Reference.”
3.   If IA32_VMX_BASIC[48] is read as 1, VMfailInvalid occurs if addr sets any bits in the range 63:32; see Appendix A.1.
4.  Usually, the processor’s physical-address width is the value enumerated in CPUID.80000008H:EAX[7:0] (at most 52). If IA32_T-
ME_ACTIVATE[0] = 1 (indicating that TME has been configured), the width is reduced by the value of IA32_TME_ACTIVATE[39:36].
IA32_TME_ACTIVATE[39:36] is the number of physical-address bits reserved to encode TDX-private key identifiers. This number is
never greater than IA32_TME_ACTIVATE[35:32], which is the number physical-address bits used for key identifiers generally.




current-VMCS pointer := FFFFFFFF_FFFFFFFFH;
enter VMX operation;
block INIT signals;
block and disable A20M;
clear address-range monitoring;
IF the processor supports Intel PT but does not allow it to be used in VMX operation1
THEN IA32_RTIT_CTL.TraceEn := 0;
FI;
VMsucceed;
FI;
FI;
FI;
ELSIF in VMX non-root operation
THEN VMexit;
ELSIF CPL > 0
THEN #GP(0);
ELSE VMfail(“VMXON executed in VMX root operation”);
FI;

Flags Affected

See the operation section and Section 33.2.

Exceptions

Protected Mode Exceptions

#GP(0) If executed outside VMX operation with CPL>0 or with invalid CR0 or CR4 fixed bits. If executed in A20M mode. If the memory source operand effective address is outside the CS, DS, ES, FS, or GS segment limit. If the DS, ES, FS, or GS register contains an unusable segment. If the source operand is located in an execute-only code segment. If the value of the IA32_FEATURE_CONTROL MSR does not support entry to VMX operation in the current processor mode. #PF(fault-code) If a page fault occurs in accessing the memory source operand. #SS(0) If the memory source operand effective address is outside the SS segment limit. If the SS register contains an unusable segment. #UD If operand is a register. If executed with CR4.VMXE = 0.

Real-Address Mode Exceptions

#UD The VMXON instruction is not recognized in real-address mode.

Virtual-8086 Mode Exceptions

#UD The VMXON instruction is not recognized in virtual-8086 mode.

Compatibility Mode Exceptions

#UD The VMXON instruction is not recognized in compatibility mode. 1. Software should read the VMX capability MSR IA32_VMX_MISC to determine whether the processor allows Intel PT to be used in VMX operation (see Appendix A.6). VMXON—Enter VMX Operation 33-29 Vol. 3C

64-Bit Mode Exceptions

#GP(0) If executed outside VMX operation with CPL > 0 or with invalid CR0 or CR4 fixed bits. If executed in A20M mode. If the source operand is in the CS, DS, ES, FS, or GS segments and the memory address is in a non-canonical form. If the value of the IA32_FEATURE_CONTROL MSR does not support entry to VMX operation in the current processor mode. #PF(fault-code) If a page fault occurs in accessing the memory source operand. #SS(0) If the source operand is in the SS segment and the memory address is in a non-canonical form. #UD If operand is a register. If executed with CR4.VMXE = 0. 33.4 VM INSTRUCTION ERROR NUMBERS For certain error conditions, the VM-instruction error field is loaded with an error number to indicate the source of the error. Table 33-1 lists VM-instruction error numbers. Table 33-1. VM-Instruction Error Numbers Error Description Number 1 VMCALL executed in VMX root operation 2 VMCLEAR with invalid physical address 3 VMCLEAR with VMXON pointer 4 VMLAUNCH with non-clear VMCS 5 VMRESUME with non-launched VMCS 6 VMRESUME after VMXOFF (VMXOFF and VMXON between VMLAUNCH and VMRESUME)a 7 VM entry with invalid control field(s)b,c 8 VM entry with invalid host-state field(s)b 9 VMPTRLD with invalid physical address 10 VMPTRLD with VMXON pointer 11 VMPTRLD with incorrect VMCS revision identifier 12 VMREAD/VMWRITE from/to unsupported VMCS component 13 VMWRITE to read-only VMCS component 15 VMXON executed in VMX root operation 16 VM entry with invalid executive-VMCS pointerb 17 VM entry with non-launched executive VMCSb 18 VM entry with executive-VMCS pointer not VMXON pointer (when attempting to deactivate the dual-monitor treatment of SMIs and SMM)b 19 VMCALL with non-clear VMCS (when attempting to activate the dual-monitor treatment of SMIs and SMM) 20 VMCALL with invalid VM-exit control fields 22 VMCALL with incorrect MSEG revision identifier (when attempting to activate the dual-monitor treatment of SMIs and SMM) 23 VMXOFF under dual-monitor treatment of SMIs and SMM 24 VMCALL with invalid SMM-monitor features (when attempting to activate the dual-monitor treatment of SMIs and SMM) Table 33-1. VM-Instruction Error Numbers (Contd.) Error Description Number 25 VM entry with invalid VM-execution control fields in executive VMCS (when attempting to return from SMM)b,c 26 VM entry with events blocked by MOV SS. 28 Invalid operand to INVEPT/INVVPID.