Intel 64 and IA-32 Architectures Software Developers Manual Volume 3B, System Programming Guide Part 2

Vol. 3 21-19
VMX NON-ROOT OPERATION
— If the “enable RDTSCP” VM-execution control is 0, RDTSCP causes an invalid-
opcode exception (#UD).
— If the “enable RDTSCP” VM-execution control is 1, treatment is based on the
settings the “RDTSC exiting” and “use TSC offsetting” VM-execution controls
as well as the TSC offset:
• If both controls are 0, RDTSCP operates normally.
• If the “RDTSC exiting” VM-execution control is 0 and the “use TSC
offsetting” VM-execution control is 1, RDTSCP loads EAX:EDX with the
sum (using signed addition) of the value of the
IA32_TIME_STAMP_COUNTER MSR and the value of the TSC offset (inter-
preted as a signed value); it also loads ECX with the value of bits 31:0 of
the IA32_TSC_AUX MSR.
• If the “RDTSC exiting” VM-execution control is 1, RDTSCP causes a
VM exit (see Section 21.1.3).
• SMSW. The behavior of SMSW is determined by the CR0 guest/host mask and
the CR0 read shadow. For each position corresponding to a bit clear in the CR0
guest/host mask, the destination operand is loaded with the value of the corre-
sponding bit in CR0. For each position corresponding to a bit set in the CR0
guest/host mask, the destination operand is loaded with the value of the corre-
sponding bit in the CR0 read shadow. Thus, if every bit is cleared in the CR0
guest/host mask, MOV from CR0 reads normally from CR0; if every bit is set in
the CR0 guest/host mask, MOV from CR0 returns the value of the CR0 read
shadow.
Note the following: (1) for any memory destination or for a 16-bit register desti-
nation, only the low 16 bits of the CR0 guest/host mask and the CR0 read shadow
are used (bits 63:16 of a register destination are left unchanged); (2) for a 32-bit
register destination, only the low 32 bits of the CR0 guest/host mask and the CR0
read shadow are used (bits 63:32 of the destination are cleared); and
(3) depending on the contents of the CR0 guest/host mask and the CR0 read
shadow, bits may be set in the destination that would never be set when reading
directly from CR0.
• WRMSR. Section 21.1.3 identifies when executions of the WRMSR instruction
cause VM exits. If such an execution neither a fault due to CPL > 0 nor a VM exit,
the instruction’s behavior may be modified for certain values of ECX:
— If ECX contains 79H (indicating IA32_BIOS_UPDT_TRIG MSR), no microcode
update is loaded, and control passes to the next instruction. This implies that
microcode updates cannot be loaded in VMX non-root operation.
— If ECX contains 808H (indicating the TPR MSR) and either EDX or EAX[31:8]
is non-zero, a general-protection fault occurs (this is true even if the logical
2. Note that “enable RDTSCP” is a secondary processor-based VM-execution control. If bit 31 of the
primary processor-based VM-execution controls is 0, VMX non-root operation functions as if the
“enable RDTSCP” VM-execution control were 0. See Section 20.6.2.