Instruction
VMCALL
Causes a VM exit from a guest to its hypervisor, which defines what the call means.
- Extensions
- Forms
- 1 (1 Legacy)
- Data
- Intel XED v2026.08.23
Forms
| Instruction | Encoding | Requires |
|---|---|---|
VMCALL
VMCALL | NP 0F 01 C1 | VMX |
Operation
What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.
if not in_vmx:
fault(UD)
if vmx_nonroot:
vm_exit(18, 0) # the hypercall: what the call means
# is the hypervisor's to define
if CPL > 0 or seam:
fault(GP, 0)
ctl = msr[IA32_SMM_MONITOR_CTL] # MSEG's base in bits 31:12
dual = msr[IA32_VMX_BASIC] >> 49 & 1
p = current_vmcs
if in_smm or not dual or not ctl & 1:
vm_fail(1) # in the hypervisor, VMCALL calls
# the SMM-transfer monitor alone
elif dual_monitor:
vm_exit(18, 0) # an SMM VM exit, to the monitor
# (34.15.2)
elif p == NO_VMCS:
vm_fail_invalid()
elif launched(p):
vm_fail(19)
elif not exit_controls_ok():
vm_fail(20) # 34.15.6.1
else:
mseg = ctl & 0xFFFFF000
rev = msr[IA32_VMX_MISC] >> 32
if phys_read(mseg, 32) != rev:
vm_fail(22) # MSEG's revision identifier
elif phys_read(mseg + 4, 32) != 1:
vm_fail(24) # the monitor's features: 64-bit
# mode needs bit 0, the rest 0
else:
vm_exit(18, 0) # an SMM VM exit that activates
# the dual-monitor treatment
# (34.15.6)
Not run on a processor: the probe never runs VMCALL: in a KVM guest it is a hypercall, which on an AMD processor KVM emulates after the #UD it raises, answering at CPL 3 with an error in RAX rather than a fault.
Operands
| Operand | Kind | Action |
|---|---|---|
VMCALL | ||
RFLAGS | implicit | read, conditional write |
Flags
| When | OF | SF | ZF | AF | PF | CF | DF | IF | TF | AC | IOPL | NT | RF | VM | VIF | VIP | ID |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| All forms | |||||||||||||||||
| in some cases | M | M | M | M | M | M | M | M | M | M | TM | M | M | T | M | M | M |
Attributes
What else XED records about the forms. How to read.
- All forms
- privileged: CPL 0 only; may abort a TSX transaction
CPUID and processors
Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.
| ISA set | CPUID | Processors |
|---|---|---|
VTX | VMX | Core (Merom, Conroe), Penryn, Nehalem, Westmere, Sandy Bridge, Ivy Bridge, Haswell, Broadwell, Skylake, Comet Lake, Cannon Lake, Ice Lake (client), Tiger Lake, Alder Lake, Arrow Lake, Panther Lake, Nova Lake, Skylake-SP, Cascade Lake, Cooper Lake, Ice Lake (server), Sapphire Rapids, Emerald Rapids, Granite Rapids, Diamond Rapids, Bonnell, Saltwell, Silvermont, Goldmont, Goldmont Plus, Tremont, Snow Ridge, Lakefield, Sierra Forest, Clearwater Forest, Knights Landing, Knights Mill Note: XED's AMD chips, which it derives from its Intel chips, have VMX too; AMD processors implement AMD-V (SVM) instead, so this list leaves them out. |
More VMX instructions
Sources
- Intel XED v2026.08.23 (commit
0bcb6237345c): forms, encodings, operands, flags, exception classes, attributes, ISA sets, CPUID bits and chip model. - Intel 64 and IA-32 Architectures Software Developer's Manual, Volume 3 (325384-093, September 2026): Volume 3C, page 33-9 (VMCALL)
The tables are derived from Intel XED, Copyright Intel Corporation, licensed under the Apache License 2.0; x86-64.net converted and reformatted them. The text is our own.