Vol. 3C 26-3

VM ENTRIES

•

Reserved bits in the primary processor-based VM-execution controls must be set properly. Software may 
consult the VMX capability MSRs to determine the proper settings (see Appendix A.3.2).

•

If the “activate secondary controls” primary processor-based VM-execution control is 1, reserved bits in the 
secondary processor-based VM-execution controls must be cleared. Software may consult the VMX capability 
MSRs to determine which bits are reserved (see Appendix A.3.3).
If the “activate secondary controls” primary processor-based VM-execution control is 0 (or if the processor
does not support the 1-setting of that control), no checks are performed on the secondary processor-based
VM-execution controls. The logical processor operates as if all the secondary processor-based VM-execution
controls were 0.

•

The CR3-target count must not be greater than 4. Future processors may support a different number of CR3-
target values. Software should read the VMX capability MSR IA32_VMX_MISC to determine the number of 
values supported (see Appendix A.6).

•

If the “use I/O bitmaps” VM-execution control is 1, bits 11:0 of each I/O-bitmap address must be 0. Neither 
address should set any bits beyond the processor’s physical-address width.

1,2

•

If the “use MSR bitmaps” VM-execution control is 1, bits 11:0 of the MSR-bitmap address must be 0. The 
address should not set any bits beyond the processor’s physical-address width.

3

•

If the “use TPR shadow” VM-execution control is 1, the virtual-APIC address must satisfy the following checks:
— Bits 11:0 of the address must be 0.
— The address should not set any bits beyond the processor’s physical-address width.

4

If all of the above checks are satisfied and the “use TPR shadow” VM-execution control is 1, bytes 3:1 of VTPR
(see Section 29.1.1) may be cleared (behavior may be implementation-specific).
The clearing of these bytes may occur even if the VM entry fails. This is true either if the failure causes control
to pass to the instruction following the VM-entry instruction or if it causes processor state to be loaded from
the host-state area of the VMCS.

•

If the “use TPR shadow” VM-execution control is 1 and the “virtual-interrupt delivery” VM-execution control is 
0, bits 31:4 of the TPR threshold VM-execution control field must be 0.

5

•

The following check is performed if the “use TPR shadow” VM-execution control is 1 and the “virtualize APIC 
accesses” and “virtual-interrupt delivery” VM-execution controls are both 0: the value of bits 3:0 of the TPR 
threshold VM-execution control field should not be greater than the value of bits 7:4 of VTPR (see Section 
29.1.1).

•

If the “NMI exiting” VM-execution control is 0, the “virtual NMIs” VM-execution control must be 0.

•

If the “virtual NMIs” VM-execution control is 0, the “NMI-window exiting” VM-execution control must be 0.

•

If the “virtualize APIC-accesses” VM-execution control is 1, the APIC-access address must satisfy the following 
checks:
— Bits 11:0 of the address must be 0.
— The address should not set any bits beyond the processor’s physical-address width.

6

•

If the “use TPR shadow” VM-execution control is 0, the following VM-execution controls must also be 0: 
“virtualize x2APIC mode”, “APIC-register virtualization”, and “virtual-interrupt delivery”.

7

1. Software can determine a processor’s physical-address width by executing CPUID with 80000008H in EAX. The physical-address 

width is returned in bits 7:0 of EAX.

2. If IA32_VMX_BASIC[48] is read as 1, these addresses must not set any bits in the range 63:32; see Appendix A.1.
3. If IA32_VMX_BASIC[48] is read as 1, this address must not set any bits in the range 63:32; see Appendix A.1.
4. If IA32_VMX_BASIC[48] is read as 1, this address must not set any bits in the range 63:32; see Appendix A.1.
5. “Virtual-interrupt delivery” is a secondary processor-based VM-execution control. If bit 31 of the primary processor-based VM-exe-

cution controls is 0, VM entry functions as if the “virtual-interrupt delivery” VM-execution control were 0. See Section 24.6.2.

6. If IA32_VMX_BASIC[48] is read as 1, this address must not set any bits in the range 63:32; see Appendix A.1.
7. “Virtualize x2APIC mode” and “APIC-register virtualization” are secondary processor-based VM-execution controls. If bit 31 of the 

primary processor-based VM-execution controls is 0, VM entry functions as if these controls were 0. See Section 24.6.2.