27-6 Vol. 3C

VM EXITS

— For MWAIT, the exit qualification contains a value that indicates whether address-range monitoring 

hardware was armed. The exit qualification is set either to 0 (if address-range monitoring hardware is not 
armed) or to 1 (if address-range monitoring hardware is armed).

— For an APIC-access VM exit resulting from a linear access or a guest-physical access to the APIC-access 

page (see Section 29.4), the exit qualification contains information about the access and has the format 
given in Table 27-6.

1

If the access to the APIC-access page occurred during execution of an instruction in enclave mode (and not 
during delivery of an event incident to enclave mode), bits 11:0 of the exit qualification are cleared.
Such a VM exit that set bits 15:12 of the exit qualification to 0000b (data read during instruction execution) 
or 0001b (data write during instruction execution) set bit 12—which distinguishes data read from data 
write—to that which would have been stored in bit 1—W/R—of the page-fault error code had the access 
caused a page fault instead of an APIC-access VM exit. This implies the following:

•

For an APIC-access VM exit caused by the CLFLUSH and CLFLUSHOPT instructions, the access type is 
“data read during instruction execution.”

•

For an APIC-access VM exit caused by the ENTER instruction, the access type is “data write during 
instruction execution.”

1. The exit qualification is undefined if the access was part of the logging of a branch record or a precise-event-based-sampling (PEBS) 

record to the DS save area. It is recommended that software configure the paging structures so that no address in the DS save area 

translates to an address on the APIC-access page.

Table 27-3.  Exit Qualification for Control-Register Accesses 

Bit Positions

Contents

3:0

Number of control register (0 for CLTS and LMSW). Bit 3 is always 0 on processors that do not support Intel 64 

architecture as they do not support CR8.

5:4

Access type:

0 =  MOV  to  CR

1 = MOV from CR

2 =  CLTS

3 =  LMSW

6

LMSW operand type:

0 =  register

1 =  memory

For CLTS and MOV CR, cleared to 0

7

Reserved (cleared to 0)

11:8

For MOV CR, the general-purpose register:

0 =  RAX

1 =  RCX

2 =  RDX

3 =  RBX

4 =  RSP

5 =  RBP

6 =  RSI

7 =  RDI

8–15 represent R8–R15, respectively (used only on processors that support Intel 64 architecture)

For CLTS and LMSW, cleared to 0

15:12

Reserved (cleared to 0)