Vol. 3C 34-17

SYSTEM MANAGEMENT MODE

FI;
IF the logical processor supports SMX operation

THEN

save internal to the logical processor an indication of whether the Intel® TXT private space is locked;
IF the TXT private space is unlocked

THEN lock the TXT private space;

FI;

FI;
CR4.VMXE ← 0;

perform ordinary SMI delivery:

save processor state in SMRAM;
set processor state to standard SMM values;

1

invalidate linear mappings and combined mappings associated with VPID 0000H (for all PCIDs); combined mappings for VPID 0000H 

are invalidated for all EP4TA values (EP4TA is the value of bits 51:12 of EPTP; see Section 28.3);
The pseudocode above makes reference to the saving of VMX-critical state. This state consists of the following: 
(1) SS.DPL (the current privilege level); (2) RFLAGS.VM

2

; (3) the state of blocking by STI and by MOV SS (see 

Table 24-3 in Section 24.4.2); (4) the state of virtual-NMI blocking (only if the processor is in VMX non-root oper-
ation and the “virtual NMIs” VM-execution control is 1); and (5) an indication of whether an MTF VM exit is pending 
(see Section 25.5.2). These data may be saved internal to the processor or in the VMCS region of the current 
VMCS. Processors that do not support SMI recognition while there is blocking by STI or by MOV SS need not save 
the state of such blocking.
If the logical processor supports the 1-setting of the “enable EPT” VM-execution control and the logical processor 
was in VMX non-root operation at the time of an SMI, it saves the value of that control into bit 0 of the 32-bit field 
at offset SMBASE + 8000H + 7EE0H (SMBASE + FEE0H; see Table 34-3).

3

 If the logical processor was not in VMX 

non-root operation at the time of the SMI, it saves 0 into that bit. If the logical processor saves 1 into that bit (it 
was in VMX non-root operation and the “enable EPT” VM-execution control was 1), it saves the value of the EPT 
pointer (EPTP) into the 64-bit field at offset SMBASE + 8000H + 7ED8H (SMBASE + FED8H).
Because SMI delivery causes a logical processor to leave VMX operation, all the controls associated with VMX non-
root operation are disabled in SMM and thus cannot cause VM exits while the logical processor in SMM.

34.14.2  Default Treatment of RSM

Ordinary execution of RSM restores processor state from SMRAM. Under the default treatment, processors that 
support VMX operation perform RSM as follows:

IF VMXE = 1 in CR4 image in SMRAM

THEN fail and enter shutdown state;
ELSE

restore state normally from SMRAM;
invalidate linear mappings and combined mappings associated with all VPIDs and all PCIDs; combined mappings are invalidated 

for all EP4TA values (EP4TA is the value of bits 51:12 of EPTP; see Section 28.3);

IF the logical processor supports SMX operation andthe Intel® TXT private space was unlocked at the time of the last SMI (as 

saved)

THEN unlock the TXT private space;

FI;
CR4.VMXE ← value stored internally;

1. This causes the logical processor to block INIT signals, NMIs, and SMIs.
2. Section 34.14 and Section 34.15 use the notation RAX, RIP, RSP, RFLAGS, etc. for processor registers because most processors that 

support VMX operation also support Intel 64 architecture. For processors that do not support Intel 64 architecture, this notation 

refers to the 32-bit forms of these registers (EAX, EIP, ESP, EFLAGS, etc.). In a few places, notation such as EAX is used to refer spe-

cifically to the lower 32 bits of the register.

3. “Enable EPT” is a secondary processor-based VM-execution control. If bit 31 of the primary processor-based VM-execution controls 

is 0, SMI functions as the “enable EPT” VM-execution control were 0. See Section 24.6.2.