background image

Vol. 3C 25-9


— If both controls are 0, RDTSC operates normally.
— If the “RDTSC exiting” VM-execution control is 0 and the “use TSC offsetting” VM-execution control is 1, the 

value returned is determined by the setting of the “use TSC scaling” VM-execution control:

If the control is 0, RDTSC loads EAX:EDX with the sum of the value of the IA32_TIME_STAMP_COUNTER 

MSR and the value of the TSC offset.

If the control is 1, RDTSC first computes the product of the value of the IA32_TIME_STAMP_COUNTER 

MSR and the value of the TSC multiplier. It then shifts the value of the product right 48 bits and loads 
EAX:EDX with the sum of that shifted value and the value of the TSC offset.

— If the “RDTSC exiting” VM-execution control is 1, RDTSC causes a VM exit.

RDTSCP. Behavior of the RDTSCP instruction is determined first by the setting of the “enable RDTSCP” 
VM-execution control:
— If the “enable RDTSCP” VM-execution control is 0, RDTSCP causes an invalid-opcode exception (#UD). This 

exception takes priority over any other exception the instruction may incur.

— If the “enable RDTSCP” VM-execution control is 1, treatment is based on the settings of the “RDTSC exiting” 

and “use TSC offsetting” VM-execution controls:

If both controls are 0, RDTSCP operates normally.

If the “RDTSC exiting” VM-execution control is 0 and the “use TSC offsetting” VM-execution control is 1, 

the value returned is determined by the setting of the “use TSC scaling” VM-execution control:

If the control is 0, RDTSCP loads EAX:EDX with the sum of the value of the 

IA32_TIME_STAMP_COUNTER MSR and the value of the TSC offset.

If the control is 1, RDTSCP first computes the product of the value of the 

IA32_TIME_STAMP_COUNTER MSR and the value of the TSC multiplier. It then shifts the value of 
the product right 48 bits and loads EAX:EDX with the sum of that shifted value and the value of the 
TSC offset.

In either case, RDTSCP also loads ECX with the value of bits 31:0 of the IA32_TSC_AUX MSR.

If the “RDTSC exiting” VM-execution control is 1, RDTSCP causes a VM exit.

SMSW. The behavior of SMSW is determined by the CR0 guest/host mask and the CR0 read shadow. For each 
position corresponding to a bit clear in the CR0 guest/host mask, the destination operand is loaded with the 
value of the corresponding bit in CR0. For each position corresponding to a bit set in the CR0 guest/host mask, 
the destination operand is loaded with the value of the corresponding bit in the CR0 read shadow. Thus, if every 
bit is cleared in the CR0 guest/host mask, MOV from CR0 reads normally from CR0; if every bit is set in the CR0 
guest/host mask, MOV from CR0 returns the value of the CR0 read shadow.
Note the following: (1) for any memory destination or for a 16-bit register destination, only the low 16 bits of 
the CR0 guest/host mask and the CR0 read shadow are used (bits 63:16 of a register destination are left 
unchanged); (2) for a 32-bit register destination, only the low 32 bits of the CR0 guest/host mask and the CR0 
read shadow are used (bits 63:32 of the destination are cleared); and (3) depending on the contents of the 
CR0 guest/host mask and the CR0 read shadow, bits may be set in the destination that would never be set 
when reading directly from CR0.

WRMSR. Section 25.1.3 identifies when executions of the WRMSR instruction cause VM exits. If such an 
execution neither a fault due to CPL > 0 nor a VM exit, the instruction’s behavior may be modified for certain 
values of ECX:
— If ECX contains 79H (indicating IA32_BIOS_UPDT_TRIG MSR), no microcode update is loaded, and control 

passes to the next instruction. This implies that microcode updates cannot be loaded in VMX non-root 

— On processors that support Intel PT but which do not allow it to be used in VMX operation, if ECX contains 

570H (indicating the IA32_RTIT_CTL MSR), the instruction causes a general-protection exception if it 
attempts IA32_RTIT_CTL.TraceEn.


1. Software should read the VMX capability MSR IA32_VMX_MISC to determine whether the processor allows Intel PT to be used in 

VMX operation (see Appendix A.6).