29-12 Vol. 3C

APIC VIRTUALIZATION AND VIRTUAL INTERRUPTS

A physical access to the APIC-access page may or may not cause an APIC-access VM exit. If it does not cause an 
APIC-access VM exit, it may access the APIC-access page or the virtual-APIC page. Physical write accesses to the 
APIC-access page may or may not cause APIC-write emulation or APIC-write VM exits.
The priority of an APIC-access VM exit caused by physical access is not defined relative to other events that the 
access may cause.
It is recommended that software not set the APIC-access address to any of the addresses used by physical memory 
accesses (identified above). For example, it should not set the APIC-access address to the physical address of any 
of the active paging structures if the “enable EPT” VM-execution control is 0.

29.5 

VIRTUALIZING MSR-BASED APIC ACCESSES

When the local APIC is in x2APIC mode, software accesses the local APIC’s control registers using the MSR inter-
face. Specifically, software uses the RDMSR and WRMSR instructions, setting ECX (identifying the MSR being 
accessed) to values in the range 800H–8FFH (see Section 10.12, “Extended XAPIC (x2APIC)”). This section 
describes how these accesses can be virtualized.
A virtual-machine monitor can virtualize these MSR-based APIC accesses by configuring the MSR bitmaps (see 
Section 24.6.9) to ensure that the accesses cause VM exits (see Section 25.1.3). Alternatively, there are methods 
for virtualizing some MSR-based APIC accesses without VM exits.
Normally, an execution of RDMSR or WRMSR that does not fault or cause a VM exit accesses the MSR indicated in 
ECX. However, such an execution treats some values of ECX in the range 800H–8FFH specially if the “virtualize 
x2APIC mode” VM-execution control is 1. The following items provide details:

•

RDMSR. The instruction’s behavior depends on the setting of the “APIC-register virtualization” VM-execution 
control.
— If the “APIC-register virtualization” VM-execution control is 0, behavior depends upon the value of ECX.

•

If ECX contains 808H (indicating the TPR MSR), the instruction reads the 8 bytes from offset 080H on 

the virtual-APIC page (VTPR and the 4 bytes above it) into EDX:EAX. This occurs even if the local APIC 
is not in x2APIC mode (no general-protection fault occurs because the local APIC is not x2APIC mode).

•

If ECX contains any other value in the range 800H–8FFH, the instruction operates normally. If the local 

APIC is in x2APIC mode and ECX indicates a readable APIC register, EDX and EAX are loaded with the 
value of that register. If the local APIC is not in x2APIC mode or ECX does not indicate a readable APIC 
register, a general-protection fault occurs.

— If “APIC-register virtualization” is 1 and ECX contains a value in the range 800H–8FFH, the instruction reads 

the 8 bytes from offset X on the virtual-APIC page into EDX:EAX, where X = (ECX & FFH) « 4. This occurs 
even if the local APIC is not in x2APIC mode (no general-protection fault occurs because the local APIC is 
not in x2APIC mode).

•

WRMSR. The instruction’s behavior depends on the value of ECX and the setting of the “virtual-interrupt 
delivery” VM-execution control.
Special processing applies in the following cases: (1) ECX contains 808H (indicating the TPR MSR); (2) ECX
contains 80BH (indicating the EOI MSR) and the “virtual-interrupt delivery” VM-execution control is 1; and
(3) ECX contains 83FH (indicating the self-IPI MSR) and the “virtual-interrupt delivery” VM-execution control
is 1.
If special processing applies, no general-protection exception is produced due to the fact that the local APIC is
in xAPIC mode. However, WRMSR does perform the normal reserved-bit checking:
— If ECX contains 808H or 83FH, a general-protection fault occurs if either EDX or EAX[31:8] is non-zero.
— If ECX contains 80BH, a general-protection fault occurs if either EDX or EAX is non-zero.
If there is no fault, WRMSR stores EDX:EAX at offset X on the virtual-APIC page, where X = (ECX & FFH) « 4.
Following this, the processor performs an operation depending on the value of ECX:
— If ECX contains 808H, the processor performs TPR virtualization (see Section 29.1.2).
— If ECX contains 80BH, the processor performs EOI virtualization (see Section 29.1.4).
— If ECX contains 83FH, the processor then checks the value of EAX[7:4] and proceeds as follows: