Content      ..     114      115      116      117     ..

Intel 64 and IA-32 Architectures. Software Developer’s Manual (Collection, 2023) - page 116

VMX SUPPORT FOR ADDRESS TRANSLATION

required entries in the TLBs and paging-structure caches (see Section 29.4.3.1); execution of the INVVPID instruc-

tion is not required.

If EPT is in use, the logical processor associates all mappings it creates with the value of bits 51:12 of current EPTP.

If a VMM uses different EPTP values for different guests, it may use the same VPID for those guests. Doing so

cannot result in one guest using translations that pertain to the other.

The following guidelines apply more generally and are appropriate even if EPT is in use:

• As detailed in Section 30.4.5, an access to the APIC-access page might not cause an APIC-access VM exit if

software does not properly invalidate information that may be cached from the paging structures. If, at one

time, the current VPID on a logical processor was a non-zero value X, it is recommended that software use the

INVVPID instruction with the “single-context” INVVPID type and with VPID X in the INVVPID descriptor before

a VM entry on the same logical processor that establishes VPID X and either (a) the “virtualize APIC accesses”

VM-execution control was changed from 0 to 1; or (b) the value of the APIC-access address was changed.

• Software can use the INVVPID instruction with the “all-context” INVVPID type immediately after execution of

the VMXON instruction or immediately prior to execution of the VMXOFF instruction. Either prevents potentially

undesired retention of information cached from paging structures between separate uses of VMX operation.

29.4.3.4 Guidelines for Use of the INVEPT Instruction

The following items provide guidelines for use of the INVEPT instruction to invalidate information cached from the

EPT paging structures.

•

Software should use the INVEPT instruction with the “single-context” INVEPT type after making any of the

following changes to an EPT paging-structure entry (the INVEPT descriptor should contain an EPTP value that

references — directly or indirectly — the modified EPT paging structure):

— Changing any of the privilege bits 2:0 from 1 to 0.¹

— Changing the physical address in bits 51:12.

— Clearing bit 8 (the accessed flag) if accessed and dirty flags for EPT will be enabled.

— For an EPT PDPTE or an EPT PDE, changing bit 7 (which determines whether the entry maps a page).

— For the last EPT paging-structure entry used to translate a guest-physical address (an EPT PDPTE with bit 7

set to 1, an EPT PDE with bit 7 set to 1, or an EPT PTE), changing either bits 5:3 or bit 6. (These bits

determine the effective memory type of accesses using that EPT paging-structure entry; see Section

29.3.7.)

— For the last EPT paging-structure entry used to translate a guest-physical address (an EPT PDPTE with bit 7

set to 1, an EPT PDE with bit 7 set to 1, or an EPT PTE), clearing bit 9 (the dirty flag) if accessed and dirty

flags for EPT will be enabled.

•

Software should use the INVEPT instruction with the “single-context” INVEPT type before a VM entry with an

EPTP value X such that X[6] = 1 (accessed and dirty flags for EPT are enabled) if the logical processor had

earlier been in VMX non-root operation with an EPTP value Y such that Y[6] = 0 (accessed and dirty flags for

EPT are not enabled) and Y[51:12] = X[51:12].

•

Software should use the INVEPT instruction with the “single-context” INVEPT type before a VM entry with an

EPTP value X if the logical processor had earlier been in VMX non-root operation with an EPTP value Y such that

Y[5:3] ≠ X[5:3] (different EPT page-walk length) and Y[51:12] = X[51:12].

•

Software may use the INVEPT instruction after modifying a present EPT paging-structure entry (see Section

29.3.2) to change any of the privilege bits 2:0 from 0 to 1.² Failure to do so may cause an EPT violation that

would not otherwise occur. Because an EPT violation invalidates any mappings that would be used by the

access that caused the EPT violation (see Section 29.4.3.1), an EPT violation will not recur if the original access

is performed again, even if the INVEPT instruction is not executed.

1. If the “mode-based execute control for EPT” VM-execution control is 1, software should use the INVEPT instruction after changing

privilege bit 10 from 1 to 0.

2. If the “mode-based execute control for EPT” VM-execution control is 1, software may use the INVEPT instruction after modifying a

present EPT paging-structure entry to change privilege bit 10 from 0 to 1.

Vol. 3C

29-25

CHAPTER 30

APIC VIRTUALIZATION AND VIRTUAL INTERRUPTS

The VMCS includes controls that enable the virtualization of interrupts and the Advanced Programmable Interrupt

Controller (APIC).

When these controls are used, the processor will emulate many accesses to the APIC, track the state of the virtual

APIC, and deliver virtual interrupts — all in VMX non-root operation with out a VM exit.¹

The processor tracks the state of the virtual APIC using a virtual-APIC page identified by the virtual-machine

monitor (VMM). Section 30.1 discusses the virtual-APIC page and how the processor uses it to track the state of the

virtual APIC.

The following are the VM-execution controls relevant to APIC virtualization and virtual interrupts (see Section 25.6

for information about the locations of these controls):

• Virtual-interrupt delivery. This control enables the evaluation and delivery of pending virtual interrupts

(Section 30.2). It also enables the emulation of writes (memory-mapped or MSR-based, as enabled) to the

APIC registers that control interrupt prioritization.

• Use TPR shadow. This control enables emulation of accesses to the APIC’s task-priority register (TPR) via CR8

(Section 30.3) and, if enabled, via the memory-mapped or MSR-based interfaces.

• Virtualize APIC accesses. This control enables virtualization of memory-mapped accesses to the APIC

(Section 30.4) by causing VM exits on accesses to a VMM-specified APIC-access page. Some of the other

controls, if set, may cause some of these accesses to be emulated rather than causing VM exits.

• Virtualize x2APIC mode. This control enables virtualization of MSR-based accesses to the APIC (Section

30.5).

• APIC-register virtualization. This control allows memory-mapped and MSR-based reads of most APIC

registers (as enabled) by satisfying them from the virtual-APIC page. It directs memory-mapped writes to the

APIC-access page to the virtual-APIC page, following them by VM exits for VMM emulation.

• Process posted interrupts. This control allows software to post virtual interrupts in a data structure and send

a notification to another logical processor; upon receipt of the notification, the target processor will process the

posted interrupts by copying them into the virtual-APIC page (Section 30.6).

• IPI virtualization. This control enables the virtualization of interprocessor interrupts (Section 30.1.6).

“Virtualize APIC accesses”, “virtualize x2APIC mode”, “virtual-interrupt delivery”, and “APIC-register virtualization”

are all secondary processor-based VM-execution controls; if bit 31 of the primary processor-based VM-execution

controls is 0, the processor operates as if these controls were all 0. “IPI virtualization” is a tertiary processor-based

VM-execution control; if bit 17 of the primary processor-based VM-execution controls is 0, the processor operates

as if “IPI virtualization” were 0. See Section 25.6.2.

30.1

VIRTUAL APIC STATE

The virtual-APIC page is a 4-KByte region of memory that the processor uses to virtualize certain accesses to

APIC registers and to manage virtual interrupts. The physical address of the virtual-APIC page is the virtual-APIC

address, a 64-bit VM-execution control field in the VMCS (see Section 25.6.8).

Depending on the settings of certain VM-execution controls, the processor may virtualize certain fields on the

virtual-APIC page with functionality analogous to that performed by the local APIC. Section 30.1.1 identifies and

defines these fields. Section 30.1.2, Section 30.1.3, Section 30.1.4, and Section 30.1.5 detail the actions taken to

virtualize updates to some of these fields.

With the exception of fields corresponding to virtualized APIC registers (defined in Section 30.1.1), software may

modify the virtual-APIC page referenced by the current VMCS of a logical processor in VMX non-root operation.

(This is an exception to the general requirement given in Section 25.11.4.)

1. In most cases, it is not necessary for a virtual-machine monitor (VMM) to inject virtual interrupts as part of VM entry.

Vol. 3C

30-1

APIC VIRTUALIZATION AND VIRTUAL INTERRUPTS

30.1.4, Section 30.1.5, and Section 30.6 for details of when evaluation of pending virtual interrupts is performed.

No other operations cause the evaluation of pending virtual interrupts, even if they modify RVI or VPPR.

Evaluation of pending virtual interrupts uses the guest interrupt status (specifically, RVI; see Section 25.4.2). The

following pseudocode details the evaluation of pending virtual interrupts:

IF “interrupt-window exiting” is 0 AND

RVI[7:4] > VPPR[7:4] (see Section 30.1.1 for definition of VPPR)

THEN recognize a pending virtual interrupt;

ELSE

do not recognize a pending virtual interrupt;

FI;

Once recognized, a virtual interrupt may be delivered in VMX non-root operation; see Section 30.2.2.

Evaluation of pending virtual interrupts is caused only by VM entry, TPR virtualization, EOI virtualization, self-IPI

virtualization, and posted-interrupt processing. No other operations do so, even if they modify RVI or VPPR. The

logical processor ceases recognition of a pending virtual interrupt following the delivery of a virtual interrupt.

30.2.2 Virtual-Interrupt Delivery

If a virtual interrupt has been recognized (see Section 30.2.1), it is delivered at an instruction boundary when the

following conditions all hold: (1) RFLAGS.IF = 1; (2) there is no blocking by STI; (3) there is no blocking by MOV

SS or by POP SS; and (4) the “interrupt-window exiting” VM-execution control is 0.

Virtual-interrupt delivery has the same priority as that of VM exits due to the 1-setting of the “interrupt-window

exiting” VM-execution control.¹ Thus, non-maskable interrupts (NMIs) and higher priority events take priority over

delivery of a virtual interrupt; delivery of a virtual interrupt takes priority over external interrupts and lower priority

events.

Virtual-interrupt delivery wakes a logical processor from the same inactive activity states as would an external

interrupt. Specifically, it wakes a logical processor from the states entered using the HLT and MWAIT instructions.

It does not wake a logical processor in the shutdown state or in the wait-for-SIPI state.

Virtual-interrupt delivery updates the guest interrupt status (both RVI and SVI; see Section 25.4.2) and delivers

an event within VMX non-root operation without a VM exit. The following pseudocode details the behavior of

virtual-interrupt delivery (see Section 30.1.1 for definition of VISR, VIRR, and VPPR):

Vector := RVI;

VISR[Vector] := 1;

SVI := Vector;

VPPR := Vector & F0H;

VIRR[Vector] := 0;

IF any bits set in VIRR

THEN RVI := highest index of bit set in VIRR

ELSE RVI := 0;

FI;

cease recognition of any pending virtual interrupt;

IF transactional execution is in effect

THEN abort transactional execution and transition to a non-transactional execution;

FI;

IF logical processor is in enclave mode

THEN cause an Asynchronous Enclave Exit (AEX) (see Chapter 37, “Enclave Exiting Events”)

FI;

IF CR4.UINTR = 1 AND IA32_EFER.LMA = 1 AND Vector = UINV

THEN virtualize user-interrupt notification identification and processing (see Section 30.2.3)

ELSE deliver interrupt with Vector through IDT;

1. A logical processor never recognizes or delivers a virtual interrupt if the “interrupt-window exiting” VM-execution control is 1.

Because of this, the relative priority of virtual-interrupt delivery and VM exits due to the 1-setting of that control is not defined.

Vol. 3C

30-5

APIC VIRTUALIZATION AND VIRTUAL INTERRUPTS

A virtual-machine monitor (VMM) can virtualize these memory-mapped APIC accesses by ensuring that any access

to a linear address that would access the local APIC instead causes a VM exit. This could be done using paging or

the extended page-table mechanism (EPT). Another way is by using the 1-setting of the “virtualize APIC accesses”

VM-execution control.

If the “virtualize APIC accesses” VM-execution control is 1, the logical processor treats specially memory accesses

using linear addresses that translate to physical addresses in the 4-KByte APIC-access page.^1,2 (The APIC-

access page is identified by the APIC-access address, a field in the VMCS; see Section 25.6.8.)

In general, an access to the APIC-access page causes an APIC-access VM exit. APIC-access VM exits provide a

VMM with information about the access causing the VM exit. Section 30.4.1 discusses the priority of APIC-access

VM exits.

Certain VM-execution controls enable the processor to virtualize certain accesses to the APIC-access page without

a VM exit. In general, this virtualization causes these accesses to be made to the virtual-APIC page instead of the

APIC-access page.

NOTES

Unless stated otherwise, this section characterizes only linear accesses to the APIC-access page;

an access to the APIC-access page is a linear access if (1) it results from a memory access using a

linear address; and (2) the access’s physical address is the translation of that linear address.

Section 30.4.6 discusses accesses to the APIC-access page that are not linear accesses.

The distinction between the APIC-access page and the virtual-APIC page allows a VMM to share

paging structures or EPT paging structures among the virtual processors of a virtual machine (the

shared paging structures referencing the same APIC-access address, which appears in the VMCS of

all the virtual processors) while giving each virtual processor its own virtual APIC (the VMCS of each

virtual processor will have a unique virtual-APIC address).

Section 30.4.2 discusses when and how the processor may virtualize read accesses from the APIC-access page.

Section 30.4.3 does the same for write accesses. When virtualizing a write to the APIC-access page, the processor

typically takes actions in addition to passing the write through to the virtual-APIC page.

The discussion in those sections uses the concept of an operation within which these memory accesses may occur.

For those discussions, an “operation” can be an iteration of a REP-prefixed string instruction, an execution of any

other instruction, or delivery of an event through the IDT.

The 1-setting of the “virtualize APIC accesses” VM-execution control may also affect accesses to the APIC-access

page that do not result directly from linear addresses. This is discussed in Section 30.4.6.

Special treatment may apply to Intel SGX instructions or if the logical processor is in enclave mode. See Section

39.5.3 for details.

30.4.1 Priority of APIC-Access VM Exits

The following items specify the priority of APIC-access VM exits relative to other events.

• The priority of an APIC-access VM exit due to a memory access is below that of any page fault or EPT violation

that that access may incur. That is, an access does not cause an APIC-access VM exit if it would cause a page

fault or an EPT violation.

1. Even when addresses are translated using EPT (see Section 29.3), the determination of whether an APIC-access VM exit occurs

depends on an access’s physical address, not its guest-physical address. Even when CR0.PG = 0, ordinary memory accesses by soft-

ware use linear addresses; the fact that CR0.PG = 0 means only that the identity translation is used to convert linear addresses to

physical (or guest-physical) addresses.

2. If EPT is enabled and there is write to a guest-physical address that translates to an address on the APIC-access page that is eligible

for sub-page write permissions (see Section 29.3.4.1), the processor may treat the write as if the “virtualize APIC accesses” VM-exe-

cution control were 0 (and not apply the treatment specified in this section). For that reason, it is recommended that software not

configure any guest-physical address that translates to an address on the APIC-access page to be eligible for sub-page write permis-

sions.

Vol. 3C

30-7

APIC VIRTUALIZATION AND VIRTUAL INTERRUPTS

— 320H-323H, 330H-333H, 340H-343H, 350H-353H, 360H-363H, or 370H-373H (LVT entries);

— 380H-383H (initial count); or

— 3E0H-3E3H (divide configuration).

In all other cases, the access causes an APIC-access VM exit.

A read access from the APIC-access page that is virtualized returns data from the corresponding page offset on the

virtual-APIC page.¹

30.4.3 Virtualizing Writes to the APIC-Access Page

Whether a write access to the APIC-access page is virtualized depends on the settings of the VM-execution controls

and the page offset of the access. Section 30.4.3.1 details when APIC-write virtualization occurs.

Unlike reads, writes to the local APIC have side effects; because of this, virtualization of writes to the APIC-access

page may require emulation specific to the access’s page offset (which identifies the APIC register being accessed).

Section 30.4.3.2 describes this APIC-write emulation.

For some page offsets, it is necessary for software to complete the virtualization after a write completes. In these

cases, the processor causes an APIC-write VM exit to invoke VMM software. Section 30.4.3.3 discusses APIC-

write VM exits.

30.4.3.1 Determining Whether a Write Access is Virtualized

A write access to the APIC-access page causes an APIC-access VM exit if any of the following are true:

• The “use TPR shadow” VM-execution control is 0.

• The access is more than 32 bits in size.

• The access is part of an operation for which the processor has already virtualized a write (with a different page

offset or a different size) to the APIC-access page.

• The access is not entirely contained within the low 4 bytes of a naturally aligned 16-byte region. That is, bits

3:2 of the access’s address are 0, and the same is true of the address of the highest byte accessed.

If none of the above are true, whether a write access is virtualized depends on the settings of the “APIC-register

virtualization”, “virtual-interrupt delivery”, and “IPI virtualization” VM-execution controls:

• A write access is virtualized if its page offset is 080H (task priority) regardless of the settings of the “APIC-

register virtualization” and “virtual-interrupt delivery” VM-execution controls.

• If the “virtual-interrupt delivery” VM-execution control is 1, a write access is virtualized if its page offset is

0B0H (end of interrupt) or 300H (interrupt command — low).

• If the “IPI virtualization” VM-execution control is 1, a write access is virtualized if its page offset is 300H.

• If the “APIC-register virtualization” VM-execution control is 1, a write access is virtualized if it is entirely within

one the following ranges of offsets:

— 020H-023H (local APIC ID);

— 080H-083H (task priority);

— 0B0H-0B3H (end of interrupt);

— 0D0H-0D3H (logical destination);

— 0E0H-0E3H (destination format);

— 0F0H-0F3H (spurious-interrupt vector);

— 280H-283H (error status);

— 300H-303H or 310H-313H (interrupt command);

1. The memory type used for accesses that read from the virtual-APIC page is reported in bits 53:50 of the IA32_VMX_BASIC MSR

(see Appendix A.1).

Vol. 3C

30-9

APIC VIRTUALIZATION AND VIRTUAL INTERRUPTS

— 320H-323H, 330H-333H, 340H-343H, 350H-353H, 360H-363H, or 370H-373H (LVT entries);

— 380H-383H (initial count); or

— 3E0H-3E3H (divide configuration).

In all other cases, the access causes an APIC-access VM exit.

The processor virtualizes a write access to the APIC-access page by writing data to the corresponding page offset

on the virtual-APIC page.¹ Following this, the processor performs certain actions after completion of the operation

of which the access was a part.² APIC-write emulation is described in Section 30.4.3.2.

30.4.3.2 APIC-Write Emulation

If the processor virtualizes a write access to the APIC-access page, it performs additional actions after completion

of an operation of which the access was a part. These actions are called APIC-write emulation.

The details of APIC-write emulation depend upon the page offset of the virtualized write access:³

•

080H (task priority). The processor clears bytes 3:1 of VTPR and then causes TPR virtualization (Section

30.1.2).

•

0B0H (end of interrupt). If the “virtual-interrupt delivery” VM-execution control is 1, the processor clears VEOI

and then causes EOI virtualization (Section 30.1.4); otherwise, the processor causes an APIC-write VM exit

(Section 30.4.3.3).

•

300H (interrupt command — low). If the “virtual-interrupt delivery” VM-execution control is 1, the processor

checks the value of VICR_LO to determine whether the following are all true:

— Reserved bits (31:20, 17:16, 13) and bit 12 (delivery status) are all 0.

— Bits 19:18 (destination shorthand) are 01B (self).

— Bit 15 (trigger mode) is 0 (edge).

— Bits 10:8 (delivery mode) are 000B (fixed).

— Bits 7:4 (the upper half of the vector) are not 0000B.

If all of the items above are true, the processor performs self-IPI virtualization using the 8-bit vector in byte 0

of VICR_LO (Section 30.1.5).

If the “virtual-interrupt delivery” VM-execution control is 0, or if any of the items above are false, behavior

depends on the setting of the “IPI virtualization” VM-execution control:

— If the “IPI virtualization” VM-execution control is 1, the processor checks the value of VICR_LO to determine

whether the following are all true:

• Reserved bits (31:20, 17:16, 13) and bit 12 (delivery status) are all 0.

• Bits 19:18 (destination shorthand) are 00B (no shorthand).

• Bit 15 (trigger mode) is 0 (edge).

• Bit 11 (destination mode) is 0 (physical).

• Bits 10:8 (delivery mode) are 000B (fixed).

If all of the items above are true, the processor performs IPI virtualization using the 8-bit vector in byte 0

of VICR_LO and the 8-bit APIC ID in VICR_HI[31:24] (Section 30.1.6); otherwise, the processor causes an

APIC-write VM exit.

— If the “IPI virtualization” VM-execution control is 0, the processor causes an APIC-write VM exit.

1.

The memory type used for accesses that write to the virtual-APIC page is reported in bits 53:50 of the IA32_VMX_BASIC MSR (see

Appendix A.1).

2.

Recall that, for the purposes of this discussion, an operation is an iteration of a REP-prefixed string instruction, an execution of any

other instruction, or delivery of an event through the IDT.

3.

For any operation, there can be only one page offset for which a write access was virtualized. This is because a write access is not

virtualized if the processor has already virtualized a write access for the same operation with a different page offset.

30-10

Vol. 3C

APIC VIRTUALIZATION AND VIRTUAL INTERRUPTS

•

310H-313H (interrupt command — high). The processor clears bytes 2:0 of VICR_HI. No other virtualization or

VM exit occurs.

• Any other page offset. The processor causes an APIC-write VM exit.

APIC-write emulation takes priority over system-management interrupts (SMIs), INIT signals, and lower priority

events. APIC-write emulation is not blocked if RFLAGS.IF = 0 or by the MOV SS, POP SS, or STI instructions.

If an operation causes a fault after a write access to the APIC-access page and before APIC-write emulation, and

that fault is delivered without a VM exit, APIC-write emulation occurs after the fault is delivered and before the fault

handler can execute. If an operation causes a VM exit (perhaps due to a fault) after a write access to the APIC-

access page and before APIC-write emulation, the APIC-write emulation does not occur.

30.4.3.3 APIC-Write VM Exits

In certain cases, VMM software must be invoked to complete the virtualization of a write access to the APIC-access

page. In this case, APIC-write emulation causes an APIC-write VM exit. (Section 30.4.3.2 details the cases that

causes APIC-write VM exits.)

APIC-write VM exits are invoked by APIC-write emulation, and APIC-write emulation occurs after an operation that

performs a write access to the APIC-access page. Because of this, every APIC-write VM exit is trap-like: it occurs

after completion of the operation containing the write access that caused the VM exit (for example, the value of

CS:RIP saved in the guest-state area of the VMCS references the next instruction).

The basic exit reason for an APIC-write VM exit is “APIC write.” The exit qualification is the page offset of the write

access that led to the VM exit.

As noted in Section 30.5, execution of WRMSR with ECX = 83FH (self-IPI MSR) can lead to an APIC-write VM exit if

the “virtual-interrupt delivery” VM-execution control is 1; the exit qualification for the APIC-write VM exit is 3F0H.

As noted in Section 30.1.6 and in Section 30.7, IPI virtualization and execution of SENDUIPI may lead to APIC-

write VM exits; these VM exits produce an exit qualification of 300H.

30.4.4 Instruction-Specific Considerations

Certain instructions that use linear address may cause page faults even though they do not use those addresses to

access memory. The APIC-virtualization features may affect these instructions as well:

• CLFLUSH, CLFLUSHOPT. With regard to faulting, the processor operates as if each of these instructions reads

from the linear address in its source operand. If that address translates to one on the APIC-access page, the

instruction may cause an APIC-access VM exit. If it does not, it will flush the corresponding cache line on the

virtual-APIC page instead of the APIC-access page.

• ENTER. With regard to faulting, the processor operates if ENTER writes to the byte referenced by the final

value of the stack pointer (even though it does not if its size operand is non-zero). If that value translates to an

address on the APIC-access page, the instruction may cause an APIC-access VM exit. If it does not, it will cause

the APIC-write emulation appropriate to the address’s page offset.

• MASKMOVQ and MASKMOVDQU. Even if the instruction’s mask is zero, the processor may operate with

regard to faulting as if MASKMOVQ or MASKMOVDQU writes to memory (the behavior is implementation-

specific). In such a situation, an APIC-access VM exit may occur.

• MONITOR. With regard to faulting, the processor operates as if MONITOR reads from the effective address in

RAX. If the resulting linear address translates to one on the APIC-access page, the instruction may cause an

APIC-access VM exit.¹ If it does not, it will monitor the corresponding address on the virtual-APIC page instead

of the APIC-access page.

• PREFETCH. An execution of the PREFETCH instruction that would result in an access to the APIC-access page

does not cause an APIC-access VM exit. Such an access may prefetch data; if so, it is from the corresponding

address on the virtual-APIC page.

1. This chapter uses the notation RAX, RIP, RSP, RFLAGS, etc. for processor registers because most processors that support VMX oper-

ation also support Intel 64 architecture. For IA-32 processors, this notation refers to the 32-bit forms of those registers (EAX, EIP,

ESP, EFLAGS, etc.). In a few places, notation such as EAX is used to refer specifically to lower 32 bits of the indicated register.

Vol. 3C

30-11

APIC VIRTUALIZATION AND VIRTUAL INTERRUPTS

Virtualization of accesses to the APIC-access page is principally intended for basic instructions such as AND, MOV,

OR, TEST, XCHG, and XOR. Use of an instruction that normally operates on floating-point, SSE, AVX, or AVX-512

registers may cause an APIC-access VM exit unconditionally regardless of the page offset it accesses on the APIC-

access page.

30.4.5 Issues Pertaining to Page Size and TLB Management

The 1-setting of the “virtualize APIC accesses” VM-execution is guaranteed to apply only if translations to the APIC-

access address use a 4-KByte page. The following items provide details:

• If EPT is not in use, any linear address that translates to an address on the APIC-access page should use a 4-

KByte page. Any access to a linear address that translates to the APIC-access page using a larger page may

operate as if the “virtualize APIC accesses” VM-execution control were 0.

• If EPT is in use, any guest-physical address that translates to an address on the APIC-access page should use a

4-KByte page. Any access to a linear address that translates to a guest-physical address that in turn translates

to the APIC-access page using a larger page may operate as if the “virtualize APIC accesses” VM-execution

control were 0. (This is true also for guest-physical accesses to the APIC-access page; see Section 30.4.6.1.)

In addition, software should perform appropriate TLB invalidation when making changes that may affect APIC-

virtualization. The specifics depend on whether VPIDs or EPT is being used:

• VPIDs being used but EPT not being used. Suppose that there is a VPID that has been used before and that

software has since made either of the following changes: (1) set the “virtualize APIC accesses” VM-execution

control when it had previously been 0; or (2) changed the paging structures so that some linear address

translates to the APIC-access address when it previously did not. In that case, software should execute

INVVPID (see “INVVPID— Invalidate Translations Based on VPID” in Section 31.3) before performing on the

same logical processor and with the same VPID.¹

• EPT being used. Suppose that there is an EPTP value that has been used before and that software has since

made either of the following changes: (1) set the “virtualize APIC accesses” VM-execution control when it had

previously been 0; or (2) changed the EPT paging structures so that some guest-physical address translates to

the APIC-access address when it previously did not. In that case, software should execute INVEPT (see

“INVEPT— Invalidate Translations Derived from EPT” in Section 31.3) before performing on the same logical

processor and with the same EPTP value.²

• Neither VPIDs nor EPT being used. No invalidation is required.

Failure to perform the appropriate TLB invalidation may result in the logical processor operating as if the “virtualize

APIC accesses” VM-execution control were 0 in responses to accesses to the affected address. (No invalidation is

necessary if neither VPIDs nor EPT is being used.)

30.4.6 APIC Accesses Not Directly Resulting From Linear Addresses

Section 30.4 has described the treatment of accesses that use linear addresses that translate to addresses on the

APIC-access page. This section considers memory accesses that do not result directly from linear addresses.

• An access is called a guest-physical access if (1) CR0.PG = 1;³ (2) the “enable EPT” VM-execution control is

1;⁴ (3) the access’s physical address is the result of an EPT translation; and (4) either (a) the access was not

generated by a linear address; or (b) the access’s guest-physical address is not the translation of the access’s

linear address. Section 30.4.6.1 discusses the treatment of guest-physical accesses to the APIC-access page.

1. INVVPID should use either (1) the all-contexts INVVPID type; (2) the single-context INVVPID type with the VPID in the INVVPID

descriptor; or (3) the individual-address INVVPID type with the linear address and the VPID in the INVVPID descriptor.

2. INVEPT should use either (1) the global INVEPT type; or (2) the single-context INVEPT type with the EPTP value in the INVEPT

descriptor.

3. If the capability MSR IA32_VMX_CR0_FIXED0 reports that CR0.PG must be 1 in VMX operation, CR0.PG must be 1 unless the “unre-

stricted guest” VM-execution control and bit 31 of the primary processor-based VM-execution controls are both 1.

4.

“Enable EPT” is a secondary processor-based VM-execution control. If bit 31 of the primary processor-based VM-execution controls

is 0, VMX non-root operation functions as if the “enable EPT” VM-execution control were 0. See Section 25.6.2.

30-12

Vol. 3C

APIC VIRTUALIZATION AND VIRTUAL INTERRUPTS

• An access is called a physical access if (1) either (a) the “enable EPT” VM-execution control is 0; or (b) the

access’s physical address is not the result of a translation through the EPT paging structures; and (2) either

(a) the access is not generated by a linear address; or (b) the access’s physical address is not the translation

of its linear address. Section 30.4.6.2 discusses the treatment of physical accesses to the APIC-access page.

30.4.6.1 Guest-Physical Accesses to the APIC-Access Page

Guest-physical accesses include the following when guest-physical addresses are being translated using EPT:

• Reads from the guest paging structures when translating a linear address (such an access uses a guest-

physical address that is not the translation of that linear address).

• Loads of the page-directory-pointer-table entries by MOV to CR when the logical processor is using (or that

causes the logical processor to use) PAE paging (see Section 4.4).

• Updates to the accessed and dirty flags in the guest paging structures when using a linear address (such an

access uses a guest-physical address that is not the translation of that linear address).

• Memory accesses by Intel Processor Trace when the “Intel PT uses guest physical addresses” VM-execution

control is 1 (see Section 26.5.4).

Every guest-physical access using a guest-physical address that translates to an address on the APIC-access page

causes an APIC-access VM exit. Such accesses are never virtualized regardless of the page offset.

The following items specify the priority relative to other events of APIC-access VM exits caused by guest-physical

accesses to the APIC-access page.

• The priority of an APIC-access VM exit caused by a guest-physical access to memory is below that of any EPT

violation that that access may incur. That is, a guest-physical access does not cause an APIC-access VM exit if

it would cause an EPT violation.

• With respect to all other events, any APIC-access VM exit caused by a guest-physical access has the same

priority as any EPT violation that the guest-physical access could cause.

30.4.6.2 Physical Accesses to the APIC-Access Page

Physical accesses include the following:

• If the “enable EPT” VM-execution control is 0:

— Reads from the paging structures when translating a linear address.

— Loads of the page-directory-pointer-table entries by MOV to CR when the logical processor is using (or that

causes the logical processor to use) PAE paging (see Section 4.4).

— Updates to the accessed and dirty flags in the paging structures.

• If the “enable EPT” VM-execution control is 1, accesses to the EPT paging structures (including updates to the

accessed and dirty flags for EPT).

• Any of the following accesses made by the processor to support VMX non-root operation:

— Accesses to the VMCS region.

— Accesses to data structures referenced (directly or indirectly) by physical addresses in VM-execution

control fields in the VMCS. These include the I/O bitmaps, the MSR bitmaps, and the virtual-APIC page.

• Accesses that effect transitions into and out of SMM.¹ These include the following:

— Accesses to SMRAM during SMI delivery and during execution of RSM.

— Accesses during SMM VM exits (including accesses to MSEG) and during VM entries that return from SMM.

A physical access to the APIC-access page may or may not cause an APIC-access VM exit. If it does not cause an

APIC-access VM exit, it may access the APIC-access page or the virtual-APIC page. Physical write accesses to the

APIC-access page may or may not cause APIC-write emulation or APIC-write VM exits.

1. Technically, these accesses do not occur in VMX non-root operation. They are included here for clarity.

Vol. 3C

30-13

APIC VIRTUALIZATION AND VIRTUAL INTERRUPTS

• If the value is non-zero, the logical processor performs self-IPI virtualization with the 8-bit vector in

EAX[7:0] (see Section 30.1.5).

• If the value is zero, the logical processor causes an APIC-write VM exit as if there had been a write

access to page offset 3F0H on the APIC-access page (see Section 30.4.3.3).

— If ECX contains 830H, the processor then checks the value of VICR to determine whether the following are

all true:

• Bits 19:18 (destination shorthand) are 00B (no shorthand).

• Bit 15 (trigger mode) is 0 (edge).

• Bit 12 (unused) is 0.

• Bit 11 (destination mode) is 0 (physical).

• Bits 10:8 (delivery mode) are 000B (fixed).

If all of the items above are true, the processor performs IPI virtualization using the 8-bit vector in byte 0

of VICR and the 32-bit APIC ID in VICR[63:32] (see Section 30.1.6). Otherwise, the logical processor

causes an APIC-write VM exit (see Section 30.4.3.3).

If special processing does not apply, the instruction operates normally. If the local APIC is in x2APIC mode

and ECX indicates a writable APIC register, the value in EDX:EAX is written to that register. If the local APIC is

not in x2APIC mode or ECX does not indicate a writable APIC register, a general-protection fault occurs.

30.6

POSTED-INTERRUPT PROCESSING

Posted-interrupt processing is a feature by which a processor processes the virtual interrupts by recording them as

pending on the virtual-APIC page.

Posted-interrupt processing is enabled by setting the “process posted interrupts” VM-execution control. The

processing is performed in response to the arrival of an interrupt with the posted-interrupt notification vector.

In response to such an interrupt, the processor processes virtual interrupts recorded in a data structure called a

posted-interrupt descriptor. The posted-interrupt notification vector and the address of the posted-interrupt

descriptor are fields in the VMCS; see Section 25.6.8.

If the “process posted interrupts” VM-execution control is 1, a logical processor uses a 64-byte posted-interrupt

descriptor located at the posted-interrupt descriptor address. The posted-interrupt descriptor has the following

format:

Table 30-1. Format of Posted-Interrupt Descriptor

Bit

Name

Description

Position(s)

255:0

Posted-interrupt requests

One bit for each interrupt vector. There is a posted-interrupt request for a vector if

the corresponding bit is 1.

256

Outstanding notification

If this bit is set, there is a notification outstanding for one or more posted interrupts

in bits 255:0.

511:257

Reserved for software and

These bits may be used by software and by other agents in the system (e.g.,

other agents

chipset). The processor does not modify these bits.

The notation PIR (posted-interrupt requests) refers to the 256 posted-interrupt bits in the posted-interrupt

descriptor.

Use of the posted-interrupt descriptor differs from that of other data structures that are referenced by pointers in

a VMCS. There is a general requirement that software ensure that each such data structure is modified only when

no logical processor with a current VMCS that references it is in VMX non-root operation. That requirement does

not apply to the posted-interrupt descriptor. There is a requirement, however, that such modifications be done

using locked read-modify-write instructions.

Vol. 3C

30-15

APIC VIRTUALIZATION AND VIRTUAL INTERRUPTS

If the “external-interrupt exiting” VM-execution control is 1, any unmasked external interrupt causes a VM exit (see

Section 26.2). If the “process posted interrupts” VM-execution control is also 1, this behavior is changed and the

processor handles an external interrupt as follows:¹

1. The local APIC is acknowledged; this provides the processor core with an interrupt vector, called here the

physical vector.

2. If the physical vector equals the posted-interrupt notification vector, the logical processor continues to the next

step. Otherwise, a VM exit occurs as it would normally due to an external interrupt; the vector is saved in the

VM-exit interruption-information field.

3. The processor clears the outstanding-notification bit in the posted-interrupt descriptor. This is done atomically

so as to leave the remainder of the descriptor unmodified (e.g., with a locked AND operation).

4. The processor writes zero to the EOI register in the local APIC; this dismisses the interrupt with the posted-

interrupt notification vector from the local APIC.

5. The logical processor performs a logical-OR of PIR into VIRR and clears PIR. No other agent can read or write a

PIR bit (or group of bits) between the time it is read (to determine what to OR into VIRR) and when it is cleared.

6. The logical processor sets RVI to be the maximum of the old value of RVI and the highest index of all bits that

were set in PIR; if no bit was set in PIR, RVI is left unmodified.

7. The logical processor evaluates pending virtual interrupts as described in Section 30.2.1.

The logical processor performs the steps above in an uninterruptible manner. If step #7 leads to recognition of a

virtual interrupt, the processor may deliver that interrupt immediately.

Steps #1 to #7 above occur when the interrupt controller delivers an unmasked external interrupt to the CPU core.

The following items consider certain cases of interrupt delivery:

• Interrupt delivery can occur between iterations of a REP-prefixed instruction (after at least one iteration has

completed but before all iterations have completed). If this occurs, the following items characterize processor

state after posted-interrupt processing completes and before guest execution resumes:

— RIP references the REP-prefixed instruction;

— RCX, RSI, and RDI are updated to reflect the iterations completed; and

— RFLAGS.RF = 1.

• Interrupt delivery can occur when the logical processor is in the active, HLT, or MWAIT states. If the logical

processor had been in the active or MWAIT state before the arrival of the interrupt, it is in the active state

following completion of step #7; if it had been in the HLT state, it returns to the HLT state after step #7 (if a

pending virtual interrupt was recognized, the logical processor may immediately wake from the HLT state).

• Interrupt delivery can occur while the logical processor is in enclave mode. If the logical processor had been in

enclave mode before the arrival of the interrupt, an Asynchronous Enclave Exit (AEX) may occur before the

steps #1 to #7 (see Chapter 37, “Enclave Exiting Events”). If no AEX occurs before step #1 and a VM exit

occurs at step #2, an AEX occurs before the VM exit is delivered.

30.7

VIRTUALIZING SENDUIPI

The user-interrupt feature includes the SENDUIPI instruction that software operating with CPL = 3 can use to send

user interrupts to another software thread (“user IPIs”). The SENDUIPI instruction has the following high-level

operation:

read selected entry from user-interrupt target table;

use address in entry to read the referenced user posted-interrupt descriptor (UPID);

update certain fields in UPID;

if necessary, send ordinary IPI indicated in UPID’s notification information;

1. VM entry ensures that the “process posted interrupts” VM-execution control is 1 only if the “external-interrupt exiting” VM-execu-

tion control is also 1. SeeSection 27.2.1.1.

30-16

Vol. 3C

APIC VIRTUALIZATION AND VIRTUAL INTERRUPTS

The last step uses two fields in the UPID: an 8-bit notification vector (UPID.NV) and a 32-bit notification destination

(an APIC ID, UPID.NDST). Outside of VMX non-root operation, the processor implements the last step as follows:

• If the local APIC is in xAPIC mode, it writes UPID.NDST[15:8] to ICR_HI[31:24] (offset 310H from

IA32_APIC_BASE) and then writes UPID.NV to ICR_LO (offset 300H).

• If the local APIC is in x2APIC mode, it performs the control-register write that would be done by an execution

of WRMSR with ECX = 310H (ICR), EAX = UPID.NV, and EDX = UPID.NDST.

In VMX non-root operation, implementation of the step depends on the settings of the “use TPR shadow,” “virtu-

alize APIC accesses,” and “IPI virtualization” VM-execution controls:¹

1. If the “use TPR shadow” VM-execution control is 0, the behavior is not modified: the logical processor sends the

specified IPI by writing to the local APIC’s ICR as specified above (based on the current mode of the local APIC).

2. If the “use TPR shadow” VM-execution control is 1 and the “virtualize APIC accesses” VM-execution control is 0,

the logical processor virtualizes the sending of an x2APIC-mode IPI with the following steps:

a. The 64-bit value Z is written to offset 300H on the virtual-APIC page (VICR), where Z[7:0] = UPID.NV (the

8-bit virtual vector), Z[63:32] = UPID.NDST (the 32-bit virtual APIC ID) and Z[31:8] = 000000H

(indicating a physically addressed fixed-mode IPI).

b. If the “IPI virtualization” VM-execution control is 1, IPI virtualization (Section 30.1.6) is performed using

the vector UPID.NV and the 32-bit virtual APIC ID UPID.NDST.

3. If the “use TPR shadow” and “virtualize APIC accesses” VM-execution controls are both 1, the logical processor

virtualizes the sending of an xAPIC-mode IPI by performing the following steps:

a. The 32-bit value X is written to offset 310H on the virtual-APIC page (VICR_HI), where X[31:24] =

UPID.NDST[15:8] (the 8-bit virtual APIC ID) and X[23:0] = 000000H.²

b. The 32-bit value Y is written to offset 300H on the virtual-APIC page (VICR_LO), where Y[7:0] = UPID.NV

(the 8-bit virtual vector) and Y[31:8] = 000000H (indicating a physically addressed fixed-mode IPI).

c. If the “IPI virtualization” VM-execution control is 1, IPI virtualization is performed using the vector UPID.NV

and the APIC ID UPID.NDST[15:8]. IPI virtualization will use only the 8-bit APIC ID from bits 15:8 of the

UPID’s destination field (the 8-bit value written earlier to bits 31:24 of VICR_HI).

4. If the “use TPR shadow” VM-execution control is 1 and the “IPI virtualization” VM-execution control is 0, an

APIC-write VM exit occurs as if there had been a write access to page offset 300H on the APIC-access page (see

Section 30.4.3.3).

1. The setting of the “virtualize x2APIC mode” VM-execution control does not affect this operation.

2. For xAPIC mode (which is virtualized if the “virtualize APIC accesses” VM-execution control is 1), the destination APIC ID is in byte 1

(not byte 0) of the UPID’s 4-byte NDST field.

Vol. 3C

30-17

CHAPTER 31

VMX INSTRUCTION REFERENCE

31.1

OVERVIEW

This chapter describes the virtual-machine extensions (VMX) for the Intel 64 and IA-32 architectures. VMX is

intended to support virtualization of processor hardware and a system software layer acting as a host to multiple

guest software environments. The virtual-machine extensions (VMX) includes five instructions that manage the

virtual-machine control structure (VMCS), four instructions that manage VMX operation, two TLB-management

instructions, and two instructions for use by guest software. Additional details of VMX are described in Chapter 24

through Chapter 30.

The behavior of the VMCS-maintenance instructions is summarized below:

• VMPTRLD — This instruction takes a single 64-bit source operand that is in memory. It makes the referenced

VMCS active and current, loading the current-VMCS pointer with this operand and establishes the current VMCS

based on the contents of VMCS-data area in the referenced VMCS region. Because this makes the referenced

VMCS active, a logical processor may start maintaining on the processor some of the VMCS data for the VMCS.

• VMPTRST — This instruction takes a single 64-bit destination operand that is in memory. The current-VMCS

pointer is stored into the destination operand.

• VMCLEAR — This instruction takes a single 64-bit operand that is in memory. The instruction sets the launch

state of the VMCS referenced by the operand to “clear”, renders that VMCS inactive, and ensures that data for

the VMCS have been written to the VMCS-data area in the referenced VMCS region. If the operand is the same

as the current-VMCS pointer, that pointer is made invalid.

• VMREAD — This instruction reads a component from a VMCS (the encoding of that field is given in a register

operand) and stores it into a destination operand that may be a register or in memory.

• VMWRITE — This instruction writes a component to a VMCS (the encoding of that field is given in a register

operand) from a source operand that may be a register or in memory.

The behavior of the VMX management instructions is summarized below:

• VMLAUNCH — This instruction launches a virtual machine managed by the VMCS. A VM entry occurs, trans-

ferring control to the VM.

• VMRESUME — This instruction resumes a virtual machine managed by the VMCS. A VM entry occurs, trans-

ferring control to the VM.

• VMXOFF — This instruction causes the processor to leave VMX operation.

• VMXON — This instruction takes a single 64-bit source operand that is in memory. It causes a logical processor

to enter VMX root operation and to use the memory referenced by the operand to support VMX operation.

The behavior of the VMX-specific TLB-management instructions is summarized below:

• INVEPT — This instruction invalidates entries in the TLBs and paging-structure caches that were derived from

extended page tables (EPT).

• INVVPID — This instruction invalidates entries in the TLBs and paging-structure caches based on a Virtual-

Processor Identifier (VPID).

None of the instructions above can be executed in compatibility mode; they generate invalid-opcode exceptions if

executed in compatibility mode.

The behavior of the guest-available instructions is summarized below:

• VMCALL — This instruction allows software in VMX non-root operation to call the VMM for service. A VM exit

occurs, transferring control to the VMM.

• VMFUNC — This instruction allows software in VMX non-root operation to invoke a VM function (processor

functionality enabled and configured by software in VMX root operation) without a VM exit.

Vol. 3C

31-1

VMX INSTRUCTION REFERENCE

INVEPT— Invalidate Translations Derived from EPT

Opcode/

Op/En

Description

Instruction

66 0F 38 80

RM

Invalidates EPT-derived entries in the TLBs and paging-structure caches (in 64-bit mode).

INVEPT r64, m128

66 0F 38 80

RM

Invalidates EPT-derived entries in the TLBs and paging-structure caches (outside 64-bit

mode).

INVEPT r32, m128

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

RM

ModRM:reg (r)

ModRM:r/m (r)

NA

NA

Description

Invalidates mappings in the translation lookaside buffers (TLBs) and paging-structure caches that were derived

from extended page tables (EPT). (See Chapter 29, “VMX Support for Address Translation.”) Invalidation is based

on the INVEPT type specified in the register operand and the INVEPT descriptor specified in the memory

operand.

Outside IA-32e mode, the register operand is always 32 bits, regardless of the value of CS.D; in 64-bit mode, the

register operand has 64 bits (the instruction cannot be executed in compatibility mode).

The INVEPT types supported by a logical processors are reported in the IA32_VMX_EPT_VPID_CAP MSR (see

Appendix A, “VMX Capability Reporting Facility”). There are two INVEPT types currently defined:

• Single-context invalidation. If the INVEPT type is 1, the logical processor invalidates all mappings associated

with bits 51:12 of the EPT pointer (EPTP) specified in the INVEPT descriptor. It may invalidate other mappings

as well.

• Global invalidation: If the INVEPT type is 2, the logical processor invalidates mappings associated with all

EPTPs.

If an unsupported INVEPT type is specified, the instruction fails.

INVEPT invalidates all the specified mappings for the indicated EPTP(s) regardless of the VPID and PCID values with

which those mappings may be associated.

The INVEPT descriptor comprises 128 bits and contains a 64-bit EPTP value in bits 63:0 (see Figure 31-1).

127

6463

0

Reserved (must be zero)

EPT pointer (EPTP)

Figure 31-1. INVEPT Descriptor

Operation

IF (not in VMX operation) or (CR0.PE = 0) or (RFLAGS.VM = 1) or (IA32_EFER.LMA = 1 and CS.L = 0)

THEN #UD;

ELSIF in VMX non-root operation

THEN VM exit;

ELSIF CPL > 0

THEN #GP(0);

ELSE

Vol. 3C

31-3

VMX INSTRUCTION REFERENCE

INVVPID— Invalidate Translations Based on VPID

Opcode/

Op/En

Description

Instruction

66 0F 38 81

RM

Invalidates entries in the TLBs and paging-structure caches based on VPID (in 64-bit

mode).

INVVPID r64, m128

66 0F 38 81

RM

Invalidates entries in the TLBs and paging-structure caches based on VPID (outside 64-bit

mode).

INVVPID r32, m128

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

RM

ModRM:reg (r)

ModRM:r/m (r)

NA

NA

Description

Invalidates mappings in the translation lookaside buffers (TLBs) and paging-structure caches based on virtual-

processor identifier (VPID). (See Chapter 29, “VMX Support for Address Translation.”) Invalidation is based on

the INVVPID type specified in the register operand and the INVVPID descriptor specified in the memory

operand.

Outside IA-32e mode, the register operand is always 32 bits, regardless of the value of CS.D; in 64-bit mode, the

register operand has 64 bits (the instruction cannot be executed in compatibility mode).

The INVVPID types supported by a logical processors are reported in the IA32_VMX_EPT_VPID_CAP MSR (see

Appendix A, “VMX Capability Reporting Facility”). There are four INVVPID types currently defined:

• Individual-address invalidation: If the INVVPID type is 0, the logical processor invalidates mappings for the

linear address and VPID specified in the INVVPID descriptor. In some cases, it may invalidate mappings for

other linear addresses (or other VPIDs) as well.

• Single-context invalidation: If the INVVPID type is 1, the logical processor invalidates all mappings tagged with

the VPID specified in the INVVPID descriptor. In some cases, it may invalidate mappings for other VPIDs as

well.

• All-contexts invalidation: If the INVVPID type is 2, the logical processor invalidates all mappings tagged with all

VPIDs except VPID 0000H. In some cases, it may invalidate translations with VPID 0000H as well.

• Single-context invalidation, retaining global translations: If the INVVPID type is 3, the logical processor

invalidates all mappings tagged with the VPID specified in the INVVPID descriptor except global translations. In

some cases, it may invalidate global translations (and mappings with other VPIDs) as well. See the “Caching

Translation Information” section in Chapter 4 of the Intel^® 64 and IA-32 Architectures Software Developer’s

Manual, Volume 3A, for information about global translations.

If an unsupported INVVPID type is specified, the instruction fails.

INVVPID invalidates all the specified mappings for the indicated VPID(s) regardless of the EPTP and PCID values

with which those mappings may be associated.

The INVVPID descriptor comprises 128 bits and consists of a VPID and a linear address as shown in Figure 31-2.

127

6463

1615

0

Linear

Address

Reserved (must be zero)

VPID

Figure 31-2. INVVPID Descriptor

31-6

Vol. 3C

VMX INSTRUCTION REFERENCE

VMCALL—Call to VM Monitor

Opcode/

Op/En

Description

Instruction

0F 01 C1

ZO

Call to VM monitor by causing VM exit.

VMCALL

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

ZO

NA

NA

NA

NA

Description

This instruction allows guest software can make a call for service into an underlying VM monitor. The details of the

programming interface for such calls are VMM-specific; this instruction does nothing more than cause a VM exit,

registering the appropriate exit reason.

Use of this instruction in VMX root operation invokes an SMM monitor (see Section 32.15.2). This invocation will acti-

vate the dual-monitor treatment of system-management interrupts (SMIs) and system-management mode (SMM)

if it is not already active (see Section 32.15.6).

Operation

IF not in VMX operation

THEN #UD;

ELSIF in VMX non-root operation

THEN VM exit;

ELSIF (RFLAGS.VM = 1) or (IA32_EFER.LMA = 1 and CS.L = 0)

THEN #UD;

ELSIF CPL > 0

THEN #GP(0);

ELSIF in SMM or the logical processor does not support the dual-monitor treatment of SMIs and SMM or the valid bit in the

IA32_SMM_MONITOR_CTL MSR is clear

THEN VMfail (VMCALL executed in VMX root operation);

ELSIF dual-monitor treatment of SMIs and SMM is active

THEN perform an SMM VM exit (see Section 32.15.2);

ELSIF current-VMCS pointer is not valid

THEN VMfailInvalid;

ELSIF launch state of current VMCS is not clear

THEN VMfailValid(VMCALL with non-clear VMCS);

ELSIF VM-exit control fields are not valid (see Section 32.15.6.1)

THEN VMfailValid (VMCALL with invalid VM-exit control fields);

ELSE

enter SMM;

read revision identifier in MSEG;

IF revision identifier does not match that supported by processor

THEN

leave SMM;

VMfailValid(VMCALL with incorrect MSEG revision identifier);

ELSE

read SMM-monitor features field in MSEG (see Section 32.15.6.1);

IF features field is invalid

THEN

leave SMM;

Vol. 3C

31-9

VMX INSTRUCTION REFERENCE

VMCLEAR—Clear Virtual-Machine Control Structure

Opcode/

Op/En

Description

Instruction

66 0F C7 /6

M

Copy VMCS data to VMCS region in memory.

VMCLEAR m64

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

M

ModRM:r/m (r)

NA

NA

NA

Description

This instruction applies to the VMCS whose VMCS region resides at the physical address contained in the instruction

operand. The instruction ensures that VMCS data for that VMCS (some of these data may be currently maintained

on the processor) are copied to the VMCS region in memory. It also initializes parts of the VMCS region (for

example, it sets the launch state of that VMCS to clear). See Chapter 25, “Virtual Machine Control Structures.”

The operand of this instruction is always 64 bits and is always in memory. If the operand is the current-VMCS

pointer, then that pointer is made invalid (set to FFFFFFFF_FFFFFFFFH).

Note that the VMCLEAR instruction might not explicitly write any VMCS data to memory; the data may be already

resident in memory before the VMCLEAR is executed.

Operation

IF (register operand) or (not in VMX operation) or (CR0.PE = 0) or (RFLAGS.VM = 1) or (IA32_EFER.LMA = 1 and CS.L = 0)

THEN #UD;

ELSIF in VMX non-root operation

THEN VM exit;

ELSIF CPL > 0

THEN #GP(0);

ELSE

addr := contents of 64-bit in-memory operand;

IF addr is not 4KB-aligned OR

addr sets any bits beyond the physical-address width¹

THEN VMfail(VMCLEAR with invalid physical address);

ELSIF addr = VMXON pointer

THEN VMfail(VMCLEAR with VMXON pointer);

ELSE

ensure that data for VMCS referenced by the operand is in memory;

initialize implementation-specific data in VMCS region;

launch state of VMCS referenced by the operand := “clear”

IF operand addr = current-VMCS pointer

THEN current-VMCS pointer := FFFFFFFF_FFFFFFFFH;

FI;

VMsucceed;

FI;

FI;

Flags Affected

See the operation section and Section 31.2.

1. If IA32_VMX_BASIC[48] is read as 1, VMfail occurs if addr sets any bits in the range 63:32; see Appendix A.1.

Vol. 3C

31-11

VMX INSTRUCTION REFERENCE

VMFUNC—Invoke VM function

Opcode/

Op/En

Description

Instruction

NP 0F 01 D4

ZO

Invoke VM function specified in EAX.

VMFUNC

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

ZO

NA

NA

NA

NA

Description

This instruction allows software in VMX non-root operation to invoke a VM function, which is processor functionality

enabled and configured by software in VMX root operation. The value of EAX selects the specific VM function being

invoked.

The behavior of each VM function (including any additional fault checking) is specified in Section 26.5.6,

“VM Functions.”

Operation

Perform functionality of the VM function specified in EAX;

Flags Affected

Depends on the VM function specified in EAX. See Section 26.5.6, “VM Functions.”

Protected Mode Exceptions (not including those defined by specific VM functions)

#UD

If executed outside VMX non-root operation.

If “enable VM functions” VM-execution control is 0.

If EAX ≥ 64.

Real-Address Mode Exceptions

Same exceptions as in protected mode.

Virtual-8086 Exceptions

Same exceptions as in protected mode.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

Same exceptions as in protected mode.

Vol. 3C

31-13

VMX INSTRUCTION REFERENCE

VMLAUNCH/VMRESUME—Launch/Resume Virtual Machine

Opcode/

Op/En

Description

Instruction

0F 01 C2

ZO

Launch virtual machine managed by current VMCS.

VMLAUNCH

0F 01 C3

ZO

Resume virtual machine managed by current VMCS.

VMRESUME

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

ZO

NA

NA

NA

NA

Description

Effects a VM entry managed by the current VMCS.

• VMLAUNCH fails if the launch state of current VMCS is not “clear”. If the instruction is successful, it sets the

launch state to “launched.”

• VMRESUME fails if the launch state of the current VMCS is not “launched.”

If VM entry is attempted, the logical processor performs a series of consistency checks as detailed in Chapter 27,

“VM Entries.” Failure to pass checks on the VMX controls or on the host-state area passes control to the instruction

following the VMLAUNCH or VMRESUME instruction. If these pass but checks on the guest-state area fail, the logical

processor loads state from the host-state area of the VMCS, passing control to the instruction referenced by the RIP

field in the host-state area.

VM entry is not allowed when events are blocked by MOV SS or POP SS. Neither VMLAUNCH nor VMRESUME should

be used immediately after either MOV to SS or POP to SS.

Operation

IF (not in VMX operation) or (CR0.PE = 0) or (RFLAGS.VM = 1) or (IA32_EFER.LMA = 1 and CS.L = 0)

THEN #UD;

ELSIF in VMX non-root operation

THEN VMexit;

ELSIF CPL > 0

THEN #GP(0);

ELSIF current-VMCS pointer is not valid

THEN VMfailInvalid;

ELSIF events are being blocked by MOV SS

THEN VMfailValid(VM entry with events blocked by MOV SS);

ELSIF (VMLAUNCH and launch state of current VMCS is not “clear”)

THEN VMfailValid(VMLAUNCH with non-clear VMCS);

ELSIF (VMRESUME and launch state of current VMCS is not “launched”)

THEN VMfailValid(VMRESUME with non-launched VMCS);

ELSE

Check settings of VMX controls and host-state area;

IF invalid settings

THEN VMfailValid(VM entry with invalid VMX-control field(s)) or

VMfailValid(VM entry with invalid host-state field(s)) or

VMfailValid(VM entry with invalid executive-VMCS pointer)) or

VMfailValid(VM entry with non-launched executive VMCS) or

VMfailValid(VM entry with executive-VMCS pointer not VMXON pointer) or

31-14

Vol. 3C

VMX INSTRUCTION REFERENCE

VMPTRLD—Load Pointer to Virtual-Machine Control Structure

Opcode/

Op/En

Description

Instruction

NP 0F C7 /6

M

Loads the current VMCS pointer from memory.

VMPTRLD m64

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

M

ModRM:r/m (r)

NA

NA

NA

Description

Marks the current-VMCS pointer valid and loads it with the physical address in the instruction operand. The instruc-

tion fails if its operand is not properly aligned, sets unsupported physical-address bits, or is equal to the VMXON

pointer. In addition, the instruction fails if the 32 bits in memory referenced by the operand do not match the VMCS

revision identifier supported by this processor.¹

The operand of this instruction is always 64 bits and is always in memory.

Operation

IF (register operand) or (not in VMX operation) or (CR0.PE = 0) or (RFLAGS.VM = 1) or (IA32_EFER.LMA = 1 and CS.L = 0)

THEN #UD;

ELSIF in VMX non-root operation

THEN VMexit;

ELSIF CPL > 0

THEN #GP(0);

ELSE

addr := contents of 64-bit in-memory source operand;

IF addr is not 4KB-aligned OR

addr sets any bits beyond the physical-address width²

THEN VMfail(VMPTRLD with invalid physical address);

ELSIF addr = VMXON pointer

THEN VMfail(VMPTRLD with VMXON pointer);

ELSE

rev := 32 bits located at physical address addr;

IF rev[30:0] ≠ VMCS revision identifier supported by processor OR

rev[31] = 1 AND processor does not support 1-setting of “VMCS shadowing”

THEN VMfail(VMPTRLD with incorrect VMCS revision identifier);

ELSE

current-VMCS pointer := addr;

VMsucceed;

FI;

FI;

FI;

Flags Affected

See the operation section and Section 31.2.

1. Software should consult the VMX capability MSR VMX_BASIC to discover the VMCS revision identifier supported by this processor

(see Appendix A, “VMX Capability Reporting Facility”).

2. If IA32_VMX_BASIC[48] is read as 1, VMfail occurs if addr sets any bits in the range 63:32; see Appendix A.1.

Vol. 3C

31-17

VMX INSTRUCTION REFERENCE

VMPTRST—Store Pointer to Virtual-Machine Control Structure

Opcode/

Op/En

Description

Instruction

NP 0F C7 /7

M

Stores the current VMCS pointer into memory.

VMPTRST m64

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

M

ModRM:r/m (w)

NA

NA

NA

Description

Stores the current-VMCS pointer into a specified memory address. The operand of this instruction is always 64 bits

and is always in memory.

Operation

IF (register operand) or (not in VMX operation) or (CR0.PE = 0) or (RFLAGS.VM = 1) or (IA32_EFER.LMA = 1 and CS.L = 0)

THEN #UD;

ELSIF in VMX non-root operation

THEN VMexit;

ELSIF CPL > 0

THEN #GP(0);

ELSE

64-bit in-memory destination operand := current-VMCS pointer;

VMsucceed;

FI;

Flags Affected

See the operation section and Section 31.2.

Protected Mode Exceptions

#GP(0)

If the current privilege level is not 0.

If the memory destination operand effective address is outside the CS, DS, ES, FS, or GS

segment limit.

If the DS, ES, FS, or GS register contains an unusable segment.

If the destination operand is located in a read-only data segment or any code segment.

#PF(fault-code)

If a page fault occurs in accessing the memory destination operand.

#SS(0)

If the memory destination operand effective address is outside the SS segment limit.

If the SS register contains an unusable segment.

#UD

If operand is a register.

If not in VMX operation.

Real-Address Mode Exceptions

#UD

The VMPTRST instruction is not recognized in real-address mode.

Virtual-8086 Mode Exceptions

#UD

The VMPTRST instruction is not recognized in virtual-8086 mode.

Vol. 3C

31-19

VMX INSTRUCTION REFERENCE

VMREAD—Read Field from Virtual-Machine Control Structure

Opcode/

Op/En

Description

Instruction

NP 0F 78

MR

Reads a specified VMCS field (in 64-bit mode).

VMREAD r/m64, r64

NP 0F 78

MR

Reads a specified VMCS field (outside 64-bit mode).

VMREAD r/m32, r32

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

MR

ModRM:r/m (w)

ModRM:reg (r)

NA

NA

Description

Reads a specified field from a VMCS and stores it into a specified destination operand (register or memory). In VMX

root operation, the instruction reads from the current VMCS. If executed in VMX non-root operation, the instruction

reads from the VMCS referenced by the VMCS link pointer field in the current VMCS.

The VMCS field is specified by the VMCS-field encoding contained in the register source operand. Outside IA-32e

mode, the source operand has 32 bits, regardless of the value of CS.D. In 64-bit mode, the source operand has 64

bits.

The effective size of the destination operand, which may be a register or in memory, is always 32 bits outside IA-

32e mode (the setting of CS.D is ignored with respect to operand size) and 64 bits in 64-bit mode. If the VMCS field

specified by the source operand is shorter than this effective operand size, the high bits of the destination operand

are cleared to 0. If the VMCS field is longer, then the high bits of the field are not read.

Note that any faults resulting from accessing a memory destination operand can occur only after determining, in

the operation section below, that the relevant VMCS pointer is valid and that the specified VMCS field is supported.

Operation

IF (not in VMX operation) or (CR0.PE = 0) or (RFLAGS.VM = 1) or (IA32_EFER.LMA = 1 and CS.L = 0)

THEN #UD;

ELSIF in VMX non-root operation AND (“VMCS shadowing” is 0 OR source operand sets bits in range 63:15 OR

VMREAD bit corresponding to bits 14:0 of source operand is 1)¹

THEN VMexit;

ELSIF CPL > 0

THEN #GP(0);

ELSIF (in VMX root operation AND current-VMCS pointer is not valid) OR

(in VMX non-root operation AND VMCS link pointer is not valid)

THEN VMfailInvalid;

ELSIF source operand does not correspond to any VMCS field

THEN VMfailValid(VMREAD/VMWRITE from/to unsupported VMCS component);

ELSE

IF in VMX root operation

THEN destination operand := contents of field indexed by source operand in current VMCS;

ELSE destination operand := contents of field indexed by source operand in VMCS referenced by VMCS link pointer;

FI;

VMsucceed;

FI;

1. The VMREAD bit for a source operand is defined as follows. Let x be the value of bits 14:0 of the source operand and let addr be the

VMREAD-bitmap address. The corresponding VMREAD bit is in bit position x & 7 of the byte at physical address addr | (x » 3).

Vol. 3C

31-21

VMX INSTRUCTION REFERENCE

VMWRITE—Write Field to Virtual-Machine Control Structure

Opcode/

Op/En

Description

Instruction

NP 0F 79

RM

Writes a specified VMCS field (in 64-bit mode).

VMWRITE r64, r/m64

NP 0F 79

RM

Writes a specified VMCS field (outside 64-bit mode).

VMWRITE r32, r/m32

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

RM

ModRM:reg (r)

ModRM:r/m (r)

NA

NA

Description

Writes the contents of a primary source operand (register or memory) to a specified field in a VMCS. In VMX root

operation, the instruction writes to the current VMCS. If executed in VMX non-root operation, the instruction writes

to the VMCS referenced by the VMCS link pointer field in the current VMCS.

The VMCS field is specified by the VMCS-field encoding contained in the register secondary source operand.

Outside IA-32e mode, the secondary source operand is always 32 bits, regardless of the value of CS.D. In 64-bit

mode, the secondary source operand has 64 bits.

The effective size of the primary source operand, which may be a register or in memory, is always 32 bits outside

IA-32e mode (the setting of CS.D is ignored with respect to operand size) and 64 bits in 64-bit mode. If the VMCS

field specified by the secondary source operand is shorter than this effective operand size, the high bits of the

primary source operand are ignored. If the VMCS field is longer, then the high bits of the field are cleared to 0.

Note that any faults resulting from accessing a memory source operand occur after determining, in the operation

section below, that the relevant VMCS pointer is valid but before determining if the destination VMCS field is

supported.

Operation

IF (not in VMX operation) or (CR0.PE = 0) or (RFLAGS.VM = 1) or (IA32_EFER.LMA = 1 and CS.L = 0)

THEN #UD;

ELSIF in VMX non-root operation AND (“VMCS shadowing” is 0 OR secondary source operand sets bits in range 63:15 OR

VMWRITE bit corresponding to bits 14:0 of secondary source operand is 1)¹

THEN VMexit;

ELSIF CPL > 0

THEN #GP(0);

ELSIF (in VMX root operation AND current-VMCS pointer is not valid) OR

(in VMX non-root operation AND VMCS-link pointer is not valid)

THEN VMfailInvalid;

ELSIF secondary source operand does not correspond to any VMCS field

THEN VMfailValid(VMREAD/VMWRITE from/to unsupported VMCS component);

ELSIF VMCS field indexed by secondary source operand is a VM-exit information field AND

processor does not support writing to such fields²

THEN VMfailValid(VMWRITE to read-only VMCS component);

ELSE

1. The VMWRITE bit for a secondary source operand is defined as follows. Let x be the value of bits 14:0 of the secondary source oper-

and and let addr be the VMWRITE-bitmap address. The corresponding VMWRITE bit is in bit position x & 7 of the byte at physical

address addr | (x » 3).

2. Software can discover whether these fields can be written by reading the VMX capability MSR IA32_VMX_MISC (see Appendix A.6).

31-24

Vol. 3C

VMX INSTRUCTION REFERENCE

VMXOFF—Leave VMX Operation

Opcode/

Op/En

Description

Instruction

0F 01 C4

ZO

Leaves VMX operation.

VMXOFF

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

ZO

NA

NA

NA

NA

Description

Takes the logical processor out of VMX operation, unblocks INIT signals, conditionally re-enables A20M, and clears

any address-range monitoring.¹

Operation

IF (not in VMX operation) or (CR0.PE = 0) or (RFLAGS.VM = 1) or (IA32_EFER.LMA = 1 and CS.L = 0)

THEN #UD;

ELSIF in VMX non-root operation

THEN VMexit;

ELSIF CPL > 0

THEN #GP(0);

ELSIF dual-monitor treatment of SMIs and SMM is active

THEN VMfail(VMXOFF under dual-monitor treatment of SMIs and SMM);

ELSE

leave VMX operation;

unblock INIT;

IF IA32_SMM_MONITOR_CTL[2] = 0²

THEN unblock SMIs;

IF outside SMX operation³

THEN unblock and enable A20M;

FI;

clear address-range monitoring;

VMsucceed;

FI;

Flags Affected

See the operation section and Section 31.2.

Protected Mode Exceptions

#GP(0)

If executed in VMX root operation with CPL > 0.

1. See the information on MONITOR/MWAIT in Chapter 9, “Multiple-Processor Management,” of the Intel® 64 and IA-32 Architectures

Software Developer’s Manual, Volume 3A.

2. Setting IA32_SMM_MONITOR_CTL[bit 2] to 1 prevents VMXOFF from unblocking SMIs regardless of the value of the register’s value

bit (bit 0). Not all processors allow this bit to be set to 1. Software should consult the VMX capability MSR IA32_VMX_MISC (see

Appendix A.6) to determine whether this is allowed.

3. A logical processor is outside SMX operation if GETSEC[SENTER] has not been executed or if GETSEC[SEXIT] was executed after the

last execution of GETSEC[SENTER]. See Chapter 6, “Safer Mode Extensions Reference.”

31-26

Vol. 3C

VMX INSTRUCTION REFERENCE

VMXON—Enter VMX Operation

Opcode/

Op/En

Description

Instruction

F3 0F C7 /6

M

Enter VMX root operation.

VMXON m64

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

M

ModRM:r/m (r)

NA

NA

NA

Description

Puts the logical processor in VMX operation with no current VMCS, blocks INIT signals, disables A20M, and clears

any address-range monitoring established by the MONITOR instruction.¹

The operand of this instruction is a 4KB-aligned physical address (the VMXON pointer) that references the VMXON

region, which the logical processor may use to support VMX operation. This operand is always 64 bits and is always

in memory.

Operation

IF (register operand) or (CR0.PE = 0) or (CR4.VMXE = 0) or (RFLAGS.VM = 1) or (IA32_EFER.LMA = 1 and CS.L = 0)

THEN #UD;

ELSIF not in VMX operation

THEN

IF (CPL > 0) or (in A20M mode) or

(the values of CR0 and CR4 are not supported in VMX operation; see Section 24.8) or

(bit 0 (lock bit) of IA32_FEATURE_CONTROL MSR is clear) or

(in SMX operation² and bit 1 of IA32_FEATURE_CONTROL MSR is clear) or

(outside SMX operation and bit 2 of IA32_FEATURE_CONTROL MSR is clear)

THEN #GP(0);

ELSE

addr := contents of 64-bit in-memory source operand;

IF addr is not 4KB-aligned or

addr sets any bits beyond the physical-address width³

THEN VMfailInvalid;

ELSE

rev := 32 bits located at physical address addr;

IF rev[30:0] ≠ VMCS revision identifier supported by processor OR rev[31] = 1

THEN VMfailInvalid;

ELSE

current-VMCS pointer := FFFFFFFF_FFFFFFFFH;

enter VMX operation;

block INIT signals;

block and disable A20M;

1.

See the information on MONITOR/MWAIT in Chapter 9, “Multiple-Processor Management,” of the Intel^® 64 and IA-32 Architectures

Software Developer’s Manual, Volume 3A.

2.

A logical processor is in SMX operation if GETSEC[SEXIT] has not been executed since the last execution of GETSEC[SENTER]. A logi-

cal processor is outside SMX operation if GETSEC[SENTER] has not been executed or if GETSEC[SEXIT] was executed after the last

execution of GETSEC[SENTER]. See Chapter 6, “Safer Mode Extensions Reference.”

3.

If IA32_VMX_BASIC[48] is read as 1, VMfailInvalid occurs if addr sets any bits in the range 63:32; see Appendix A.1.

31-28

Vol. 3C

VMX INSTRUCTION REFERENCE

clear address-range monitoring;

IF the processor supports Intel PT but does not allow it to be used in VMX operation¹

THEN IA32_RTIT_CTL.TraceEn := 0;

FI;

VMsucceed;

FI;

FI;

FI;

ELSIF in VMX non-root operation

THEN VMexit;

ELSIF CPL > 0

THEN #GP(0);

ELSE VMfail(“VMXON executed in VMX root operation”);

FI;

Flags Affected

See the operation section and Section 31.2.

Protected Mode Exceptions

#GP(0)

If executed outside VMX operation with CPL>0 or with invalid CR0 or CR4 fixed bits.

If executed in A20M mode.

If the memory source operand effective address is outside the CS, DS, ES, FS, or GS segment

limit.

If the DS, ES, FS, or GS register contains an unusable segment.

If the source operand is located in an execute-only code segment.

If the value of the IA32_FEATURE_CONTROL MSR does not support entry to VMX operation in

the current processor mode.

#PF(fault-code)

If a page fault occurs in accessing the memory source operand.

#SS(0)

If the memory source operand effective address is outside the SS segment limit.

If the SS register contains an unusable segment.

#UD

If operand is a register.

If executed with CR4.VMXE = 0.

Real-Address Mode Exceptions

#UD

The VMXON instruction is not recognized in real-address mode.

Virtual-8086 Mode Exceptions

#UD

The VMXON instruction is not recognized in virtual-8086 mode.

Compatibility Mode Exceptions

#UD

The VMXON instruction is not recognized in compatibility mode.

64-Bit Mode Exceptions

#GP(0)

If executed outside VMX operation with CPL > 0 or with invalid CR0 or CR4 fixed bits.

If executed in A20M mode.

If the source operand is in the CS, DS, ES, FS, or GS segments and the memory address is in

a non-canonical form.

1. Software should read the VMX capability MSR IA32_VMX_MISC to determine whether the processor allows Intel PT to be used in

VMX operation (see Appendix A.6).

Vol. 3C

31-29

Content      ..     114      115      116      117     ..