vmxon

Enter VMX Operation

VMXON m64

Enters VMX root operation (Host Mode).

Pseudocode Operation

if (CPL != 0 || VMX_ENABLED == 0) raise #UD
VMXON_PTR ← [m64]
if (!validate_vmxon_region(VMXON_PTR)) { RFLAGS.CF ← 1; RFLAGS.ZF ← 0; } else { VMX_ROOT ← 1; RFLAGS.CF ← 0; RFLAGS.ZF ← 0; }

Example

VMXON [rbp-8]

Encoding

Binary Layout

ModRM

Format VMX

Opcode F3 0F C7 !(11):110:bbb

Extension VMX

Operands

dest
64-bit memory operand (quadword)

Reference

View in Intel® 64 and IA-32 Architectures SDM ↗ Intel® SDM

Instruction Forms

Opcode	Instruction	Op/En	64/32-bit Mode	CPUID	Description
F3 0F C7 /6	VMXON m64	M			Enter VMX root operation.

Description

Puts the logical processor in VMX operation with no current VMCS, blocks INIT signals, disables A20M, and clears any address-range monitoring established by the MONITOR instruction.1 The operand of this instruction is a 4KB-aligned physical address (the VMXON pointer) that references the VMXON region, which the logical processor may use to support VMX operation. This operand is always 64 bits and is always in memory.

Operation

IF (register operand) or (CR0.PE = 0) or (CR4.VMXE = 0) or (RFLAGS.VM = 1) or (IA32_EFER.LMA = 1 and CS.L = 0)
THEN #UD;
ELSIF not in VMX operation
THEN
IF (CPL > 0) or (in A20M mode) or
(the values of CR0 and CR4 are not supported in VMX operation; see Section 26.8) or
(bit 0 (lock bit) of IA32_FEATURE_CONTROL MSR is clear) or
(in SMX operation2 and bit 1 of IA32_FEATURE_CONTROL MSR is clear) or
(outside SMX operation and bit 2 of IA32_FEATURE_CONTROL MSR is clear)
THEN #GP(0);
ELSE
addr := contents of 64-bit in-memory source operand;
IF addr is not 4KB-aligned or
addr sets any bits beyond the physical-address width3,4
THEN VMfailInvalid;
ELSE
rev := 32 bits located at physical address addr;
IF rev[30:0] ≠ VMCS revision identifier supported by processor OR rev[31] = 1
THEN VMfailInvalid;
ELSE

1.  See the information on MONITOR/MWAIT in Chapter 11, “Multiple-Processor Management,” of the Intel® 64 and IA-32 Architectures
Software Developer’s Manual, Volume 3A.
2. A logical processor is in SMX operation if GETSEC[SEXIT] has not been executed since the last execution of GETSEC[SENTER]. A logi-
cal processor is outside SMX operation if GETSEC[SENTER] has not been executed or if GETSEC[SEXIT] was executed after the last
execution of GETSEC[SENTER]. See Chapter 7, “Safer Mode Extensions Reference.”
3.   If IA32_VMX_BASIC[48] is read as 1, VMfailInvalid occurs if addr sets any bits in the range 63:32; see Appendix A.1.
4.  Usually, the processor’s physical-address width is the value enumerated in CPUID.80000008H:EAX[7:0] (at most 52). If IA32_T-
ME_ACTIVATE[0] = 1 (indicating that TME has been configured), the width is reduced by the value of IA32_TME_ACTIVATE[39:36].
IA32_TME_ACTIVATE[39:36] is the number of physical-address bits reserved to encode TDX-private key identifiers. This number is
never greater than IA32_TME_ACTIVATE[35:32], which is the number physical-address bits used for key identifiers generally.

current-VMCS pointer := FFFFFFFF_FFFFFFFFH;
enter VMX operation;
block INIT signals;
block and disable A20M;
clear address-range monitoring;
IF the processor supports Intel PT but does not allow it to be used in VMX operation1
THEN IA32_RTIT_CTL.TraceEn := 0;
FI;
VMsucceed;
FI;
FI;
FI;
ELSIF in VMX non-root operation
THEN VMexit;
ELSIF CPL > 0
THEN #GP(0);
ELSE VMfail(“VMXON executed in VMX root operation”);
FI;

Flags Affected

See the operation section and Section 33.2.

Exceptions

Protected Mode Exceptions

#GP(0) If executed outside VMX operation with CPL>0 or with invalid CR0 or CR4 fixed bits. If executed in A20M mode. If the memory source operand effective address is outside the CS, DS, ES, FS, or GS segment limit. If the DS, ES, FS, or GS register contains an unusable segment. If the source operand is located in an execute-only code segment. If the value of the IA32_FEATURE_CONTROL MSR does not support entry to VMX operation in the current processor mode. #PF(fault-code) If a page fault occurs in accessing the memory source operand. #SS(0) If the memory source operand effective address is outside the SS segment limit. If the SS register contains an unusable segment. #UD If operand is a register. If executed with CR4.VMXE = 0.

Real-Address Mode Exceptions

#UD The VMXON instruction is not recognized in real-address mode.

Virtual-8086 Mode Exceptions

#UD The VMXON instruction is not recognized in virtual-8086 mode.

Compatibility Mode Exceptions

#UD The VMXON instruction is not recognized in compatibility mode. 1. Software should read the VMX capability MSR IA32_VMX_MISC to determine whether the processor allows Intel PT to be used in VMX operation (see Appendix A.6). VMXON-Enter VMX Operation 33-29 Vol. 3C

64-Bit Mode Exceptions

#GP(0) If executed outside VMX operation with CPL > 0 or with invalid CR0 or CR4 fixed bits. If executed in A20M mode. If the source operand is in the CS, DS, ES, FS, or GS segments and the memory address is in a non-canonical form. If the value of the IA32_FEATURE_CONTROL MSR does not support entry to VMX operation in the current processor mode. #PF(fault-code) If a page fault occurs in accessing the memory source operand. #SS(0) If the source operand is in the SS segment and the memory address is in a non-canonical form. #UD If operand is a register. If executed with CR4.VMXE = 0.