INVEPT instruction (VMX, APX)

INVEPT drops translations that the processor cached from the extended page tables (EPT), the second level of paging through which a guest’s physical addresses become real ones under Intel’s VMX. It is the hypervisor’s counterpart of INVLPG: the processor may keep EPT entries in its TLBs and paging-structure caches, and after changing an EPT entry the hypervisor must tell it. The register operand gives the type, 64 bits in 64-bit mode and 32 elsewhere; the 16-byte memory operand holds an EPT pointer (EPTP) in its low 8 bytes and zeros above.

Two types

Type 1, single context, drops what was cached for the EPT paging structures that bits 51:12 of the EPTP point at, and possibly more.
Type 2, global, drops what was cached for every EPTP.

Both drop the guest-physical mappings and the combined ones, from guest linear addresses through the guest’s and the EPT paging structures, whatever their VPID or PCID; they need not drop the linear mappings, which are INVVPID’s. IA32_VMX_EPT_VPID_CAP says whether INVEPT exists (bit 20) and which types it takes (bits 25 and 26); a type it lacks, or an EPTP that a VM entry would refuse, fails with ZF set and VM-instruction error 28. Intel’s manual asks for a single-context INVEPT after an EPT entry loses a permission, gets a new address, loses its accessed or dirty flag, changes page size or memory type, and before entering with the same tables under a different walk length or with accessed and dirty flags newly on. A permission that is only added needs none: the EPT violation it might cause drops the stale entry itself.

Running it

INVEPT raises #UD outside VMX operation, without EPT, in real, virtual-8086 and compatibility mode; in a guest it always causes a VM exit, reason 50; in the hypervisor it needs CPL 0. KVM’s helpers in vmx_ops.h use the single-context type where the processor has it and fall back to the global one, and KVM turns EPT off on a processor without global INVEPT. On Zen 5, which has no VMX, both recorded cases raised #UD. GCC 14 and Clang 23 assemble the mnemonic, with the type register first in Intel syntax, as 66 0F 38 80.

Forms

Every encoding of INVEPT that Intel XED knows, one row per XED instruction form (iform). How to read the notation.

Instruction	Encoding	Requires
`INVEPT r64, m128` 64-bit mode only INVEPT_GPR64_MEMdq	`66 0F 38 80 /r`	VMX
`INVEPT r32, m128` not in 64-bit mode INVEPT_GPR32_MEMdq	`66 0F 38 80 /r`	VMX
`INVEPT r64, m128` INVEPT_GPR64i64_MEMi128_APX	`EVEX.LLZ.F3.MAP4.WIG F0 /r`	APX_F + VMX

Latency and throughput

What the scheduling models of LLVM 23.1.2 give for each form, not measurements: latency / reciprocal throughput in cycles, the ports under them. A row is a model, or models that agree; a dash, a form that its processors lack. Memory forms: latency from the address, ports without the load and store units. Which processors each model covers.

Model	`r64, m128`
Sandy Bridge	100 / 0.33p015
Haswell, Broadwell, Skylake, Skylake-SP, Ice Lake, Alder Lake, Sapphire Rapids	100 / 0.25p0156
Bonnell	100 / 0.5p1
Silvermont	100 / 1FPC0

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

if not in_vmx:
    fault(UD)
ctls = msr[IA32_VMX_PROCBASED_CTLS2]
caps = msr[IA32_VMX_EPT_VPID_CAP]
if not ctls >> 33 & 1:
    fault(UD)                    # no EPT
if not caps >> 20 & 1:
    fault(UD)                    # no INVEPT
if vmx_nonroot:
    vm_exit(50)                  # the hypervisor emulates it
if CPL > 0:
    fault(GP, 0)
t = kind.read()                  # 1: one EPTP; 2: every EPTP
if t not in (1, 2):
    vm_fail(28)
elif not caps >> (24 + t) & 1:
    vm_fail(28)                  # a type the processor lacks
else:
    eptp = low(desc.read(), 64)  # bits 127:64 reserved
    if t == 1 and not eptp_ok(eptp):
        vm_fail(28)              # an EPTP that a VM entry would
                                 # refuse
    else:
        vm_succeed()             # the translations of EPTP[51:12]
                                 # dropped, or of every EPTP

Run on AMD Zen 5 (EPYC 9645): 2 cases. Its cases ran where CPUID reported no VMX, and every one raised an exception. The APX forms were not run: none of these processors has APX. The forms that 64-bit mode lacks were not run: the probe runs in 64-bit mode.

Operands

What each form reads and writes, as Intel XED records it: the operands of its syntax, in order, and the implicit ones that the syntax does not name. How to read.

Operand	Kind	Action
`INVEPT r32, m128` not in 64-bit mode `INVEPT r64, m128` 64-bit mode only
`r32/64`	explicit	read
`m128`	explicit	read
`RFLAGS`	implicit	write

Flags

M modified, 0 cleared; blank: not affected. How to read.

OF	SF	ZF	AF	PF	CF
All forms
0	0	M	0	0	M

Exceptions

The exception class is XED's name for the set of exception conditions that a form follows. How to read.

Legacy forms: none in XED
EVEX forms: APX-EVEX-INVEPT

Attributes

What else XED records about the forms. How to read.

All forms: privileged: CPL 0 only; may abort a TSX transaction

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

CPUID requirements and processors of the XED ISA sets above. Alternatives are separated by “or”; processors follow XED’s chip model, whose AMD processors end with Zen 2, and the CPU data of this site for Zen 3 to Zen 6.

ISA set	CPUID	Processors
`VTX` VMX	VMX `CPUID.01H:ECX[5]` VMX	Core (Merom, Conroe), Penryn, Nehalem, Westmere, Sandy Bridge, Ivy Bridge, Haswell, Broadwell, Skylake, Comet Lake, Cannon Lake, Ice Lake (client), Tiger Lake, Alder Lake, Arrow Lake, Panther Lake, Nova Lake, Skylake-SP, Cascade Lake, Cooper Lake, Ice Lake (server), Sapphire Rapids, Emerald Rapids, Granite Rapids, Diamond Rapids, Bonnell, Saltwell, Silvermont, Goldmont, Goldmont Plus, Tremont, Snow Ridge, Lakefield, Sierra Forest, Clearwater Forest, Knights Landing, Knights Mill Note: XED's AMD chips, which it derives from its Intel chips, have VMX too; AMD processors implement AMD-V (SVM) instead, so this list leaves them out.
`APX_F_VMX` APX	APX_F + VMX `CPUID.(EAX=07H,ECX=1):EDX[21]` APX_F `CPUID.01H:ECX[5]` VMX	Nova Lake, Diamond Rapids

More VMX instructions

More APX instructions

All 88 APX instructions

Two types#

Running it#