INVLPG

INVLPG tells this logical processor to forget the translation of one page. The TLB keeps translations from linear to physical addresses, and the processor does not watch the page tables for changes: after the kernel unmaps a page or makes it read-only, the old translation may stay in use until it is invalidated. INVLPG takes any address in the page; the operand is a memory reference only to give that address, and the byte there is not read, so it raises no #PF. A register operand raises #UD.

What goes#

• The entries for that page with the current PCID (0 while CR4.PCIDE is clear), and global entries for it under any PCID: INVLPG is how a single global page is dropped, as a CR3 load keeps global entries.
• Every entry for the page, whatever its size: a 2-MiB or 1-GiB page that the TLB holds as several smaller entries loses all of them.
• Intel’s manual adds that it empties the paging-structure caches of the current PCID entirely, whatever addresses they cover.
• It may drop more, up to the whole TLB; both manuals allow it.

AMD’s Zen 5 guide describes one such case: Zen 5 can hold a guest’s large page as smaller entries when the host maps it with smaller pages, and INVLPG then flushes all such entries of the same 1-GiB guest page in the L1 TLBs, and all of them in the same context in the L2 TLBs.

Only this processor#

INVLPG acts on the logical processor that runs it. Other processors that may cache the translation must drop it too; Intel’s manual calls that propagation a TLB shootdown, done with interprocessor interrupts or semaphores in memory. AMD’s INVLPGB with TLBSYNC broadcasts the invalidation instead. INVPCID reaches other PCIDs, and INVLPGA a guest’s address space under SVM.

Edges#

Intel’s manual makes INVLPG on a non-canonical address a NOP rather than a fault; AMD’s does not say. Both list it among the serializing instructions, and AMD’s Zen 5 guide lists it as microcoded.

INVLPG runs only at CPL 0. The probe runs at CPL 3, and Zen 5 raised #GP in both recorded cases, one of them for address 8, near the bottom of the address space: the privilege check came first.

Forms

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

if CPL > 0:
    fault(GP, 0)
a = mem.address                  # the byte at a is not read
# drops the TLB entries of the page that holds a, of the current
# PCID, and global ones of any PCID, whatever the page's size; it
# may drop more, up to the whole TLB. Intel's manual: a
# non-canonical a drops nothing and does not fault

Operands

Flags

None: XED records no flag that the forms test or change.

Attributes

What else XED records about the forms. How to read.

All forms

privileged: CPL 0 only; may abort a TSX transaction

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More System instructions

• ARPL
• CLTS
• HLT
• INVD
• LAR
• LGDT
• LIDT
• LLDT
• LMSW
• LSL
• LTR
• RDMSR
• RDPMC
• RDTSC
• RSM
• SGDT
• SIDT
• SLDT
• SMSW
• STR
• SWAPGS
• VERR
• VERW
• WBINVD
• WRMSR