-
Notifications
You must be signed in to change notification settings - Fork 99
VMXON
VMX INSTRUCTION REFERENCE VMXON — Enter VMX Operation
| Opcode/ Instruction | Op/En | Description |
| F3 0F C7 /6 VMXON m64 | M | Enter VMX root operation. |
| Op/En | Operand 1 | Operand 2 | Operand 3 | Operand 4 |
| M | ModRM:r/m (r) | NA | NA | NA |
Puts the logical processor in VMX operation with no current VMCS, blocks INIT signals, disables A20M, and clears 1 any address-range monitoring established by the MONITOR instruction.
The operand of this instruction is a 4KB-aligned physical address (the VMXON pointer) that references the VMXON region, which the logical processor may use to support VMX operation. This operand is always 64 bits and is always in memory.
IF (register operand) or (CR0.PE = 0) or (CR4.VMXE = 0) or (RFLAGS.VM = 1) or (IA32_EFER.LMA = 1 and CS.L = 0)
THEN #UD;
ELSIF not in VMX operation
THEN
IF (CPL > 0) or (in A20M mode) or
(the values of CR0 and CR4 are not supported in VMX operation; see Section 26.8) or
(bit 0 (lock bit) of IA32_FEATURE_CONTROL MSR is clear) or
2
(in SMX operation and bit 1 of IA32_FEATURE_CONTROL MSR is clear) or
(outside SMX operation and bit 2 of IA32_FEATURE_CONTROL MSR is clear)
THEN #GP(0);
ELSE
addr ← contents of 64-bit in-memory source operand;
IF addr is not 4KB-aligned or
3,4
addr sets any bits beyond the physical-address width
THEN VMfailInvalid;
ELSE
rev ← 32 bits located at physical address addr;
IF rev[30:0] ≠ VMCS revision identifier supported by processor OR rev[31] = 1
THEN VMfailInvalid;
ELSE
®
1. See the information on MONITOR/MWAIT in Chapter 11, “Multiple-Processor Management,” of the Intel 64 and IA-32 Architectures
Software Developer’s Manual, Volume 3A.
2. A logical processor is in SMX operation if GETSEC[SEXIT] has not been executed since the last execution of GETSEC[SENTER]. A logi-
cal processor is outside SMX operation if GETSEC[SENTER] has not been executed or if GETSEC[SEXIT] was executed after the last
execution of GETSEC[SENTER]. See Chapter 7, “Safer Mode Extensions Reference.”
3. If IA32_VMX_BASIC[48] is read as 1, VMfailInvalid occurs if addr sets any bits in the range 63:32; see Appendix A.1.
4. Usually, the processor’s physical-address width is the value enumerated in CPUID.80000008H:EAX[7:0] (at most 52). If IA32_T-
ME_ACTIVATE[0] = 1 (indicating that TME has been configured), the width is reduced by the value of IA32_TME_ACTIVATE[39:36].
IA32_TME_ACTIVATE[39:36] is the number of physical-address bits reserved to encode TDX-private key identifiers. This number is
never greater than IA32_TME_ACTIVATE[35:32], which is the number physical-address bits used for key identifiers generally.
33-28 Vol. 3C VMX INSTRUCTION REFERENCE
current-VMCS pointer ← FFFFFFFF_FFFFFFFFH;
enter VMX operation;
block INIT signals;
block and disable A20M;
clear address-range monitoring;
1
IF the processor supports Intel PT but does not allow it to be used in VMX operation
THEN IA32_RTIT_CTL.TraceEn ← 0;
FI;
VMsucceed;
FI;
FI;
FI;
ELSIF in VMX non-root operation
THEN VMexit;
ELSIF CPL > 0
THEN #GP(0);
ELSE VMfail(“VMXON executed in VMX root operation”);
FI;See the operation section and Section 33.2.
#GP(0) If executed outside VMX operation with CPL>0 or with invalid CR0 or CR4 fixed bits. If executed in A20M mode. If the memory source operand effective address is outside the CS, DS, ES, FS, or GS segment limit. If the DS, ES, FS, or GS register contains an unusable segment. If the source operand is located in an execute-only code segment. If the value of the IA32_FEATURE_CONTROL MSR does not support entry to VMX operation in the current processor mode.
#PF(fault-code) If a page fault occurs in accessing the memory source operand.
#SS(0) If the memory source operand effective address is outside the SS segment limit. If the SS register contains an unusable segment.
#UD If operand is a register. If executed with CR4.VMXE = 0.
#UD The VMXON instruction is not recognized in real-address mode.
#UD The VMXON instruction is not recognized in virtual-8086 mode.
#UD The VMXON instruction is not recognized in compatibility mode.
- Software should read the VMX capability MSR IA32_VMX_MISC to determine whether the processor allows Intel PT to be used in VMX operation (see Appendix A.6).
33-29 Vol. 3C VMX INSTRUCTION REFERENCE
#GP(0) If executed outside VMX operation with CPL > 0 or with invalid CR0 or CR4 fixed bits. If executed in A20M mode. If the source operand is in the CS, DS, ES, FS, or GS segments and the memory address is in a non-canonical form. If the value of the IA32_FEATURE_CONTROL MSR does not support entry to VMX operation in the current processor mode.
#PF(fault-code) If a page fault occurs in accessing the memory source operand.
#SS(0) If the source operand is in the SS segment and the memory address is in a non-canonical form.
#UD If operand is a register. If executed with CR4.VMXE = 0.
33.4 VM INSTRUCTION ERROR NUMBERS
For certain error conditions, the VM-instruction error field is loaded with an error number to indicate the source of the error. Table 33-1 lists VM-instruction error numbers.
Table 33-1. VM-Instruction Error Numbers
| Error Number | Description |
| 1 | VMCALL executed in VMX root operation |
| 2 | VMCLEAR with invalid physical address |
| 3 | VMCLEAR with VMXON pointer |
| 4 | VMLAUNCH with non-clear VMCS |
| 5 | VMRESUME with non-launched VMCS a |
| 6 | a VMRESUME after VMXOFF (VMXOFF and VMXON between VMLAUNCH and VMRESUME) b,c |
| 7 | b,c VM entry with invalid control field(s) b |
| 8 | b VM entry with invalid host-state field(s) |
| 9 | VMPTRLD with invalid physical address |
| 10 | VMPTRLD with VMXON pointer |
| 11 | VMPTRLD with incorrect VMCS revision identifier |
| 12 | VMREAD/VMWRITE from/to unsupported VMCS component |
| 13 | VMWRITE to read-only VMCS component |
| 15 | VMXON executed in VMX root operation b |
| 16 | b VM entry with invalid executive-VMCS pointer b |
| 17 | b VM entry with non-launched executive VMCS |
| 18 | VM entry with executive-VMCS pointer not VMXON pointer (when attempting to deactivate the dual-monitor treatment of b SMIs and SMM) |
| 19 | VMCALL with non-clear VMCS (when attempting to activate the dual-monitor treatment of SMIs and SMM) |
| 20 | VMCALL with invalid VM-exit control fields |
| 22 | VMCALL with incorrect MSEG revision identifier (when attempting to activate the dual-monitor treatment of SMIs and SMM) |
| 23 | VMXOFF under dual-monitor treatment of SMIs and SMM |
| 24 | VMCALL with invalid SMM-monitor features (when attempting to activate the dual-monitor treatment of SMIs and SMM) |
33-30 Vol. 3C VMX INSTRUCTION REFERENCE
Table 33-1. VM-Instruction Error Numbers (Contd.)
| Error Number | Description b,c |
| 25 | b,c VM entry with invalid VM-execution control fields in executive VMCS (when attempting to return from SMM) |
| 26 | VM entry with events blocked by MOV SS. |
| 28 | Invalid operand to INVEPT/INVVPID. |
NOTES: a. Earlier versions of this manual described this error as “VMRESUME with a corrupted VMCS”. b. VM-entry checks on control fields and host-state fields may be performed in any order. Thus, an indication by error number of one cause does not imply that there are not also other errors. Different processors may give different error numbers for the same VMCS. c. Error number 7 is not used for VM entries that return from SMM that fail due to invalid VM-execution control fields in the executive VMCS. Error number 25 is used for these cases.
33-31 Vol. 3C VMX INSTRUCTION REFERENCE
33-32 Vol. 3C
Source: Intel® 64 and IA-32 Architectures Software Developer's Manual, Combined Volumes (Order Number 325462-091US, March 2026)
Generated: 7-6-2026