Instruction
VMWRITE
Writes a register or memory operand to the field of the current VMCS whose encoding another register gives.
- Extensions
- Forms
- 4 (4 Legacy)
- Data
- Intel XED v2026.08.23
Forms
Operation
What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.
if not in_vmx:
fault(UD)
f = field.read() # the field's encoding
if vmx_nonroot:
p = current_vmcs
pri = vmcs_read(p, 0x4002) # processor-based controls; bit
sec = 0 # 31 activates the secondary ones
if pri >> 31:
sec = vmcs_read(p, 0x401E)
out = 1
if sec >> 14 & 1 and not f >> 15:
bm = vmcs_read(p, 0x2028) # VMCS shadowing: the VMWRITE
b = phys_read(bm | f >> 3, 8) # bitmap, a bit a field
out = b >> (f & 7) & 1
if out:
vm_exit(25) # the hypervisor emulates it
if CPL > 0:
fault(GP, 0)
p = current_vmcs
if vmx_nonroot:
p = vmcs_read(current_vmcs, 0x2800)
if p == NO_VMCS:
vm_fail_invalid()
else:
v = src.read() # a read of memory may fault here,
# before the field is checked
ro = not msr[IA32_VMX_MISC] >> 29 & 1
if not vmcs_has(f):
vm_fail(12) # in a guest, the SDM does not say
# which VMCS takes the number
elif f >> 10 & 3 == 1 and ro:
vm_fail(13) # a VM-exit information field,
# which only some processors let
# software write
else:
vmcs_write(p, f, v) # the field's bits: a shorter one
# drops the rest of v
vm_succeed()Run on AMD Zen 5 (EPYC 9645): 4 cases. Its cases ran where CPUID reported no VMX, and every one raised an exception. The forms that 64-bit mode lacks were not run: the probe runs in 64-bit mode.
Operands
| Operand | Kind | Action |
|---|---|---|
VMWRITE r32, r/m32 not in 64-bit mode VMWRITE r64, r/m64 64-bit mode only | ||
r32/64 | explicit | read |
r/m32/64 | explicit | read |
RFLAGS | implicit | write |
Flags
| OF | SF | ZF | AF | PF | CF |
|---|---|---|---|---|---|
| All forms | |||||
| 0 | 0 | M | 0 | 0 | M |
Attributes
What else XED records about the forms. How to read.
- All forms
- privileged: CPL 0 only
CPUID and processors
Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.
| ISA set | CPUID | Processors |
|---|---|---|
VTX | VMX | Core (Merom, Conroe), Penryn, Nehalem, Westmere, Sandy Bridge, Ivy Bridge, Haswell, Broadwell, Skylake, Comet Lake, Cannon Lake, Ice Lake (client), Tiger Lake, Alder Lake, Arrow Lake, Panther Lake, Nova Lake, Skylake-SP, Cascade Lake, Cooper Lake, Ice Lake (server), Sapphire Rapids, Emerald Rapids, Granite Rapids, Diamond Rapids, Bonnell, Saltwell, Silvermont, Goldmont, Goldmont Plus, Tremont, Snow Ridge, Lakefield, Sierra Forest, Clearwater Forest, Knights Landing, Knights Mill Note: XED's AMD chips, which it derives from its Intel chips, have VMX too; AMD processors implement AMD-V (SVM) instead, so this list leaves them out. |
More VMX instructions
Sources
- Intel XED v2026.08.23 (commit
0bcb6237345c): forms, encodings, operands, flags, exception classes, attributes, ISA sets, CPUID bits and chip model. - Intel 64 and IA-32 Architectures Software Developer's Manual, Volume 3 (325384-093, September 2026): Volume 3C, page 33-24 (VMWRITE)
The tables are derived from Intel XED, Copyright Intel Corporation, licensed under the Apache License 2.0; x86-64.net converted and reformatted them. The text is our own.