25-2 Vol. 3C

VMX NON-ROOT OPERATION

— A general-protection fault due to the relevant segment (ES for INS; DS for OUTS unless overridden by an 

instruction prefix) being unusable

— A general-protection fault due to an offset beyond the limit of the relevant segment
— An alignment-check exception

•

Fault-like VM exits have priority over exceptions other than those mentioned above. For example, RDMSR of a 
non-existent MSR with CPL = 0 generates a VM exit and not a general-protection exception.

When Section 25.1.2 or Section 25.1.3 (below) identify an instruction execution that may lead to a VM exit, it is 
assumed that the instruction does not incur a fault that takes priority over a VM exit.

25.1.2 

Instructions That Cause VM Exits Unconditionally

The following instructions cause VM exits when they are executed in VMX non-root operation: CPUID, GETSEC,

1

 

INVD, and XSETBV. This is also true of instructions introduced with VMX, which include: INVEPT, INVVPID, 
VMCALL,

2

 VMCLEAR, VMLAUNCH, VMPTRLD, VMPTRST, VMRESUME, VMXOFF, and VMXON.

25.1.3 

Instructions That Cause VM Exits Conditionally

Certain instructions cause VM exits in VMX non-root operation depending on the setting of the VM-execution 
controls. The following instructions can cause “fault-like” VM exits based on the conditions described:

3

•

CLTS. The CLTS instruction causes a VM exit if the bits in position 3 (corresponding to CR0.TS) are set in both 
the CR0 guest/host mask and the CR0 read shadow.

•

ENCLS. The ENCLS instruction causes a VM exit if the “enable ENCLS exiting” VM-execution control is 1 and 
one of the following is true:
— The value of EAX is less than 63 and the corresponding bit in the ENCLS-exiting bitmap is 1 (see Section 

24.6.16).

— The value of EAX is greater than or equal to 63 and bit 63 in the ENCLS-exiting bitmap is 1.

•

HLT. The HLT instruction causes a VM exit if the “HLT exiting” VM-execution control is 1.

•

IN, INS/INSB/INSW/INSD, OUT, OUTS/OUTSB/OUTSW/OUTSD. The behavior of each of these instruc-
tions is determined by the settings of the “unconditional I/O exiting” and “use I/O bitmaps” VM-execution 
controls:
— If both controls are 0, the instruction executes normally.
— If the “unconditional I/O exiting” VM-execution control is 1 and the “use I/O bitmaps” VM-execution control 

is 0, the instruction causes a VM exit.

— If the “use I/O bitmaps” VM-execution control is 1, the instruction causes a VM exit if it attempts to access 

an I/O port corresponding to a bit set to 1 in the appropriate I/O bitmap (see Section 24.6.4). If an I/O 
operation “wraps around” the 16-bit I/O-port space (accesses ports FFFFH and 0000H), the I/O instruction 
causes a VM exit (the “unconditional I/O exiting” VM-execution control is ignored if the “use I/O bitmaps” 
VM-execution control is 1).

See Section 25.1.1 for information regarding the priority of VM exits relative to faults that may be caused by 
the INS and OUTS instructions.

•

INVLPG. The INVLPG instruction causes a VM exit if the “INVLPG exiting” VM-execution control is 1.

•

INVPCID. The INVPCID instruction causes a VM exit if the “INVLPG exiting” and “enable INVPCID” 
VM-execution controls are both 1.

1. An execution of GETSEC in VMX non-root operation causes a VM exit if CR4.SMXE[Bit 14] = 1 regardless of the value of CPL or RAX. 

An execution of GETSEC causes an invalid-opcode exception (#UD) if CR4.SMXE[Bit 14] = 0.

2. Under the dual-monitor treatment of SMIs and SMM, executions of VMCALL cause SMM VM exits in VMX root operation outside SMM. 

See Section 34.15.2.

3. Many of the items in this section refer to secondary processor-based VM-execution controls. If bit 31 of the primary processor-

based VM-execution controls is 0, VMX non-root operation functions as if these controls were all 0. See Section 24.6.2.