invept

Invalidate Translations Derived from EPT

INVEPT r64, m128

Invalidates Extended Page Table entries.

Details

Invalidates Extended Page Table (EPT) translation cache entries based on the invalidation type and operand descriptor. The destination register specifies the invalidation type (1=single context, 2=all contexts), and the source memory operand contains EPTP and VPID information. CF/ZF flags indicate success or error; this instruction may serialize execution.

Pseudocode Operation

if (EPT_enabled && VMX_mode_active) {
  invalidation_type ← dest;
  descriptor ← [src];
  if (invalidation_type == 1) {
    invalidate_EPT_context(descriptor);
  } else if (invalidation_type == 2) {
    invalidate_all_EPT();
  }
  CF ← 0;
  ZF ← 0;
} else {
  CF ← 1;
  ZF ← 1;
}

Example

INVEPT rax, [rbp-16]

Encoding

Binary Layout
66
+0
0F
+1
38
+2
80
+3
 
Format VMX
Opcode 66 0F 38 80
Extension VMX (EPT)

Operands

  • dest
    64-bit general-purpose register (e.g. RAX)
  • src
    128-bit memory operand

Reference (Intel® SDM)

Instruction Forms

Opcode Instruction Op/En 64/32-bit Mode CPUID Description
66 0F 38 80 INVEPT r64, m128 RM Invalidates EPT-derived entries in the TLBs and paging-structure caches (in 64-bit mode).
66 0F 38 80 INVEPT r32, m128 RM Invalidates EPT-derived entries in the TLBs and paging-structure caches (outside 64-bit mode).

Description

Invalidates mappings in the translation lookaside buffers (TLBs) and paging-structure caches that were derived from extended page tables (EPT). (See Chapter 31, “VMX Support for Address Translation.”) Invalidation is based on the INVEPT type specified in the register operand and the INVEPT descriptor specified in the memory operand. Outside IA-32e mode, the register operand is always 32 bits, regardless of the value of CS.D; in 64-bit mode, the register operand has 64 bits (the instruction cannot be executed in compatibility mode). The INVEPT types supported by a logical processors are reported in the IA32_VMX_EPT_VPID_CAP MSR (see Appendix A, “VMX Capability Reporting Facility”). There are two INVEPT types currently defined: • Single-context invalidation. If the INVEPT type is 1, the logical processor invalidates all mappings associated with bits 51:12 of the EPT pointer (EPTP) specified in the INVEPT descriptor. It may invalidate other mappings as well. • Global invalidation: If the INVEPT type is 2, the logical processor invalidates mappings associated with all EPTPs. If an unsupported INVEPT type is specified, the instruction fails. INVEPT invalidates all the specified mappings for the indicated EPTP(s) regardless of the VPID and PCID values with which those mappings may be associated. The INVEPT descriptor comprises 128 bits and contains a 64-bit EPTP value in bits 63:0 (see Figure 33-1). 127 64 63 0 Reserved (must be zero) EPT pointer (EPTP) Figure 33-1. INVEPT Descriptor

Operation

IF (not in VMX operation) or (CR0.PE = 0) or (RFLAGS.VM = 1) or (IA32_EFER.LMA = 1 and CS.L = 0)
THEN #UD;
ELSIF in VMX non-root operation
THEN VM exit;
ELSIF CPL > 0
THEN #GP(0);
ELSE


INVEPT— Invalidate Translations Derived from EPT                                                                        33-3  Vol. 3C


INVEPT_TYPE := value of register operand;
IF IA32_VMX_EPT_VPID_CAP MSR indicates that processor does not support INVEPT_TYPE
THEN VMfail(Invalid operand to INVEPT/INVVPID);
ELSE      // INVEPT_TYPE must be 1 or 2
INVEPT_DESC := value of memory operand;
EPTP := INVEPT_DESC[63:0];
CASE INVEPT_TYPE OF
1:                     // single-context invalidation
IF VM entry with the “enable EPT“ VM execution control set to 1 (see Section 29.2.1.1)
would fail due to the EPTP value
THEN VMfail(Invalid operand to INVEPT/INVVPID);
ELSE
Invalidate mappings associated with EPTP[51:12];
VMsucceed;
FI;
BREAK;
2:                     // global invalidation
Invalidate mappings associated with all EPTPs;
VMsucceed;
BREAK;
ESAC;
FI;
FI;

Flags Affected

See the operation section and Section 33.2.

Exceptions

Protected Mode Exceptions

#GP(0) If the current privilege level is not 0. If the memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. If the DS, ES, FS, or GS register contains an unusable segment. If the source operand is located in an execute-only code segment. #PF(fault-code) If a page fault occurs in accessing the memory operand. #SS(0) If the memory operand effective address is outside the SS segment limit. If the SS register contains an unusable segment. #UD If not in VMX operation. If the logical processor does not support EPT (IA32_VMX_PROCBASED_CTLS2[33]=0). If the logical processor supports EPT (IA32_VMX_PROCBASED_CTLS2[33]=1) but does not support the INVEPT instruction (IA32_VMX_EPT_VPID_CAP[20]=0).

Real-Address Mode Exceptions

#UD The INVEPT instruction is not recognized in real-address mode.

Virtual-8086 Mode Exceptions

#UD The INVEPT instruction is not recognized in virtual-8086 mode.

Compatibility Mode Exceptions

#UD The INVEPT instruction is not recognized in compatibility mode.

64-Bit Mode Exceptions

#GP(0) If the current privilege level is not 0. If the memory operand is in the CS, DS, ES, FS, or GS segments and the memory address is in a non-canonical form. #PF(fault-code) If a page fault occurs in accessing the memory operand. #SS(0) If the memory operand is in the SS segment and the memory address is in a non-canonical form. #UD If not in VMX operation. If the logical processor does not support EPT (IA32_VMX_PROCBASED_CTLS2[33]=0). If the logical processor supports EPT (IA32_VMX_PROCBASED_CTLS2[33]=1) but does not support the INVEPT instruction (IA32_VMX_EPT_VPID_CAP[20]=0). INVEPT— Invalidate Translations Derived from EPT 33-5 Vol. 3C