System
VMX virtualization instructions
VMX, Intel's virtualization extension (VT-x), lets a hypervisor run guests directly on the processor, each virtual processor described by a control structure (VMCS) in memory.
- CPUID
- See the ISA sets below.
- Instructions
- 13 mnemonics
- Processors
- Core (Merom, Conroe), Penryn, Nehalem, Westmere, Sandy Bridge, Ivy Bridge, Haswell, Broadwell, Skylake, Comet Lake, Cannon Lake, Ice Lake (client), Tiger Lake, Alder Lake, Arrow Lake, Panther Lake, Nova Lake, Skylake-SP, Cascade Lake, Cooper Lake, Ice Lake (server), Sapphire Rapids, Emerald Rapids, Granite Rapids, Diamond Rapids, Bonnell, Saltwell, Silvermont, Goldmont, Goldmont Plus, Tremont, Snow Ridge, Lakefield, Sierra Forest, Clearwater Forest, Knights Landing, Knights Mill
VMX, the Virtual Machine Extensions that Intel sells as VT-x, lets a hypervisor run guest code directly on the processor. VMXON puts a logical processor in VMX operation, and each virtual processor gets a virtual-machine control structure (VMCS) in memory: VMPTRLD makes one current, VMREAD and VMWRITE access its fields, and VMLAUNCH or VMRESUME enter the guest. The guest runs in VMX non-root operation until one of the events that the VMCS lists, or VMCALL, causes a VM exit back to the hypervisor.
INVEPT and INVVPID drop cached translations of the extended page tables and of a virtual processor; their pages also list the APX forms, which can use the new registers. VMFUNC lets a guest invoke functions that the hypervisor has enabled, such as switching to another set of extended page tables, without a VM exit; VMX reports it in a capability MSR rather than in CPUID. AMD processors implement their own virtualization extension, AMD-V (SVM), instead. How hypervisors present the processor to their guests is the subject of x86-64 levels in virtual machines.
Instructions
| Mnemonic | Summary | Forms |
|---|---|---|
| INVEPT | Invalidates cached translations derived from a VMX guest's extended page tables, for one EPT context or all of them. | 2 |
| INVVPID | Invalidates cached translations tagged with a VMX virtual-processor identifier (VPID), for one address, one VPID or all of them. | 2 |
| VMCALL | Causes a VM exit from a guest to its hypervisor, which defines what the call means. | 1 |
| VMCLEAR | Writes the data of the VMCS at a physical address back to its memory region and sets its launch state to clear. | 1 |
| VMFUNC | Invokes the VM function that EAX selects, such as EPTP switching (0), from a guest without a VM exit. | 1 |
| VMLAUNCH | Enters the guest that the current VMCS describes, for a VMCS whose launch state is clear, and marks the VMCS launched. | 1 |
| VMPTRLD | Makes the VMCS at the physical address in a 64-bit memory operand the current VMCS. | 1 |
| VMPTRST | Stores the physical address of the current VMCS to a 64-bit memory operand. | 1 |
| VMREAD | Reads the field of the current VMCS whose encoding a register gives into a register or memory. | 4 |
| VMRESUME | Enters the guest that the current VMCS describes again, for a VMCS that VMLAUNCH has launched. | 1 |
| VMWRITE | Writes a register or memory operand to the field of the current VMCS whose encoding another register gives. | 4 |
| VMXOFF | Takes the processor out of VMX operation and unblocks INIT signals again. | 1 |
| VMXON | Puts the processor in VMX operation, taking the physical address of a 4-KByte VMXON region from a 64-bit memory operand. | 1 |
CPUID and processors
XED splits VMX into 2 ISA sets. Software can use a form when the processor reports every CPUID bit of one alternative of the form's ISA set.
Sources
- Intel XED v2026.08.23 (commit
0bcb6237345c): forms, encodings, ISA sets, CPUID bits and chip model. - Intel 64 and IA-32 Architectures Software Developer's Manual, Volume 3 (325384-093, September 2026)
The tables are derived from Intel XED, Copyright Intel Corporation, licensed under the Apache License 2.0; x86-64.net converted and reformatted them. The text is our own.