INVVPID instruction (VMX, APX)

INVVPID drops cached translations that belong to a virtual processor under Intel’s VMX. With the “enable VPID” control set, the processor tags the linear-address translations it caches with a 16-bit virtual-processor identifier (VPID) from the VMCS, so that a guest’s entries survive VM entries and exits instead of being flushed at each, and VPID 0 is the hypervisor’s own. INVVPID is how the hypervisor removes entries of one tag when the guest’s view of memory changes. The register operand gives the type, 64 bits in 64-bit mode and 32 elsewhere; the 16-byte memory operand holds the VPID in bits 15:0, zeros in bits 63:16 and a linear address in bits 127:64.

Four types

0, individual address: the mappings of that linear address for that VPID, the hypervisor’s way to emulate a guest’s INVLPG.
1, single context: everything tagged with that VPID.
2, all contexts: everything tagged with any VPID but 0.
3, single context retaining globals: as type 1, but global translations stay, as emulating a guest’s MOV to CR3 needs.

Any type may drop more than it is asked to. Bit 32 of IA32_VMX_EPT_VPID_CAP says whether INVVPID exists and bits 40 to 43 which types; a missing type, nonzero reserved bits, VPID 0 for types other than 2, or a non-canonical address for type 0 fail with ZF set and VM-instruction error 28. INVVPID drops linear and combined mappings whatever the EPTP and PCID, but need not drop guest-physical ones, which are INVEPT’s. Intel’s manual suggests an all-contexts INVVPID right after VMXON or before VMXOFF, so that nothing cached in one use of VMX survives into the next.

Running it

INVVPID raises #UD outside VMX operation, without VPID support, and in real, virtual-8086 and compatibility mode; in a guest it always causes a VM exit, reason 53; in the hypervisor it needs CPL 0. KVM’s helpers in vmx_ops.h skip VPID 0, use the individual-address type where the processor has it, and fall back to single context, then to all contexts; KVM leaves VPIDs off on a processor with neither of the last two. On Zen 5, which has no VMX, both recorded cases raised #UD. GCC 14 and Clang 23 assemble the mnemonic as 66 0F 38 81.

Forms

Every encoding of INVVPID that Intel XED knows, one row per XED instruction form (iform). How to read the notation.

Instruction	Encoding	Requires
`INVVPID r64, m128` 64-bit mode only INVVPID_GPR64_MEMdq	`66 0F 38 81 /r`	VMX
`INVVPID r32, m128` not in 64-bit mode INVVPID_GPR32_MEMdq	`66 0F 38 81 /r`	VMX
`INVVPID r64, m128` INVVPID_GPR64i64_MEMi128_APX	`EVEX.LLZ.F3.MAP4.WIG F1 /r`	APX_F + VMX

Latency and throughput

What the scheduling models of LLVM 23.1.2 give for each form, not measurements: latency / reciprocal throughput in cycles, the ports under them. A row is a model, or models that agree; a dash, a form that its processors lack. Memory forms: latency from the address, ports without the load and store units. Which processors each model covers.

Model	`r64, m128`
Sandy Bridge	100 / 0.33p015
Haswell, Broadwell, Skylake, Skylake-SP, Ice Lake, Alder Lake, Sapphire Rapids	100 / 0.25p0156
Bonnell	100 / 0.5p1
Silvermont	100 / 1FPC0

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

if not in_vmx:
    fault(UD)
ctls = msr[IA32_VMX_PROCBASED_CTLS2]
caps = msr[IA32_VMX_EPT_VPID_CAP]
if not ctls >> 37 & 1:
    fault(UD)                    # no VPIDs
if not caps >> 32 & 1:
    fault(UD)                    # no INVVPID
if vmx_nonroot:
    vm_exit(53)                  # the hypervisor emulates it
if CPL > 0:
    fault(GP, 0)
t = kind.read()                  # 0: one address of a VPID; 1: a
                                 # VPID; 2: every VPID but 0; 3: a
                                 # VPID but its global translations
if t > 3 or not caps >> (40 + t) & 1:
    vm_fail(28)                  # a type the processor lacks
else:
    d = desc.read()
    vpid = d & 0xFFFF
    a = d >> 64                  # the linear address of type 0
    if low(d, 64) >> 16:
        vm_fail(28)              # bits 63:16 reserved
    elif t != 2 and vpid == 0:
        vm_fail(28)              # VPID 0 is the hypervisor's own
    elif t == 0 and not canonical(a):
        vm_fail(28)
    else:
        vm_succeed()             # those translations dropped

Run on AMD Zen 5 (EPYC 9645): 2 cases. Its cases ran where CPUID reported no VMX, and every one raised an exception. The APX forms were not run: none of these processors has APX. The forms that 64-bit mode lacks were not run: the probe runs in 64-bit mode.

Operands

What each form reads and writes, as Intel XED records it: the operands of its syntax, in order, and the implicit ones that the syntax does not name. How to read.

Operand	Kind	Action
`INVVPID r32, m128` not in 64-bit mode `INVVPID r64, m128` 64-bit mode only
`r32/64`	explicit	read
`m128`	explicit	read
`RFLAGS`	implicit	write

Flags

M modified, 0 cleared; blank: not affected. How to read.

OF	SF	ZF	AF	PF	CF
All forms
0	0	M	0	0	M

Exceptions

The exception class is XED's name for the set of exception conditions that a form follows. How to read.

Legacy forms: none in XED
EVEX forms: APX-EVEX-INVVPID

Attributes

What else XED records about the forms. How to read.

All forms: privileged: CPL 0 only; may abort a TSX transaction

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

CPUID requirements and processors of the XED ISA sets above. Alternatives are separated by “or”; processors follow XED’s chip model, whose AMD processors end with Zen 2, and the CPU data of this site for Zen 3 to Zen 6.

ISA set	CPUID	Processors
`VTX` VMX	VMX `CPUID.01H:ECX[5]` VMX	Core (Merom, Conroe), Penryn, Nehalem, Westmere, Sandy Bridge, Ivy Bridge, Haswell, Broadwell, Skylake, Comet Lake, Cannon Lake, Ice Lake (client), Tiger Lake, Alder Lake, Arrow Lake, Panther Lake, Nova Lake, Skylake-SP, Cascade Lake, Cooper Lake, Ice Lake (server), Sapphire Rapids, Emerald Rapids, Granite Rapids, Diamond Rapids, Bonnell, Saltwell, Silvermont, Goldmont, Goldmont Plus, Tremont, Snow Ridge, Lakefield, Sierra Forest, Clearwater Forest, Knights Landing, Knights Mill Note: XED's AMD chips, which it derives from its Intel chips, have VMX too; AMD processors implement AMD-V (SVM) instead, so this list leaves them out.
`APX_F_VMX` APX	APX_F + VMX `CPUID.(EAX=07H,ECX=1):EDX[21]` APX_F `CPUID.01H:ECX[5]` VMX	Nova Lake, Diamond Rapids

More VMX instructions

More APX instructions

All 88 APX instructions

Four types#

Running it#