See also: x86 virtualization.
Instruction set extensions that have been added to the x86 instruction set in order to support hardware virtualization. These extensions provide instructions for entering and leaving a virtualized execution context and for loading virtual-machine control structures (VMCSs), which hold the state of the guest and host, along with fields which control processor behavior within the virtual machine.
| Instruction | Opcode | Instruction Description | Used by | Added in | |
|---|---|---|---|---|---|
| Basic SVM (Secure Virtual Machine) instructions[1] | |||||
0F 01 DF | Invalidate TLB mappings for the virtual page specified in rAX and the ASID (Address Space IDentifier) specified in ECX. | K8 | |||
VMRUN rAX | 0F 01 D8 | Run virtual machine managed by the VMCB (Virtual Machine Control Block) specified by physical address in rAX. | |||
VMLOAD rAX | 0F 01 DA | Load a specific subset of processor state from the VMCB specified by the physical address in the rAX register. | rowspan="2" | ||
VMSAVE rAX | 0F 01 DB | Save a specific subset of processor state to the VMCB specified by the physical address in the rAX register. | |||
STGI | 0F 01 DC | Set GIF (Global Interrupt Flag). | rowspan="2" | ||
CLGI | 0F 01 DD | Clear GIF. | |||
VMMCALL | NFx 0F 01 D9 | Call to VM monitor from guest by causing a VMEXIT. | |||
SKINIT EAX | 0F 01 DE | Secure Init and Jump with Attestation. Initializes CPU to known state, designates a 64 Kbyte memory area specified by EAX as an SLB ("Secure Loader Block"), submits a copy of the memory area to the system TPM for validation using a digital signature, then jumps into the SLB. | Turion "Lion",[2] , | ||
| Secure Encrypted Virtualization (SEV): Encrypted State (SEV-ES) instructions | |||||
VMGEXIT | SEV-ES Exit to VMM. Explicit communication with the VMM for SEV-ES VMs. | Zen 1 | |||
| Secure Nested Paging (SEV-SNP): Reverse-Map Table (RMP) instructions | |||||
PSMASH | F3 0F 01 FF | Page Smash: expands a 2MB-page RMP entry into a corresponding set of contiguous 4KB-page RMP entries. The 2 MB page's system physical address is specified in the RAX register. | Zen 3 | ||
RMPUPDATE | F2 0F 01 FE | Write a new RMP entry. The system physical address of a page whose RMP entry is modified is specified in the RAX register. The RCX register provides the effective address of a 16-byte data structure which contains the new RMP state. | |||
PVALIDATE | F2 0F 01 FF | Validate or rescind validation of a guest page's RMP entry. The guest virtual address is specified in the register operand rAX. | rowspan="2" | ||
RMPADJUST | F3 0F 01 FE | Adjust RMP permissions for a guest page. The guest virtual address is specified in the RAX register. The page size is specified in RCX[0]. The target VMPL (Virtual Machine Privilege Level) and its permissions are specified in the RDX register. | |||
RMPQUERY | F3 0F 01 FD | Reads an RMP permission mask for a guest page. The guest virtual address is specified in the RAX register. The target VMPL is specified in RDX[7:0]. RMP permissions for the specified VMPL are returned in RDX[63:8] and the RCX register. | Zen 4 | ||
RMPREAD | F2 0F 01 FD | Read an RMP entry. The system physical address of the page whose RMP entry is to be read is specified in the RAX register. The RCX register provides the effective address of a 16-byte data structure that the RMP entry will be written to. | (Zen 5) | ||
Intel virtualization instructions. VT-x is also supported on some processors from VIA and Zhaoxin.
| Instruction | Opcode | Instruction Description | Used by | Added in |
|---|---|---|---|---|
| Basic VMX (Virtual Machine Extensions) instructions | ||||
VMXON m64 | F3 0F C7 /6 | Enter VMX Operation – enters hardware supported virtualisation environment. | , Yonah, Centerton, Nano 3000 | |
VMXOFF | NP 0F 01 C4 | Leave VMX Operation – stops hardware supported virtualisation environment. | ||
VMPTRLD m64 | NP 0F C7 /6 | Load pointer to Virtual-Machine Control Structure (VMCS) from memory and mark it valid. | ||
VMPTRST m64 | NP 0F C7 /7 | Store pointer to current VMCS to memory. | ||
VMCLEAR m64 | 66 0F C7 /6 | Flush VMCS data from CPU to VMCS region in memory. If the specified VMCS is the current VMCS, then the current-VMCS is marked as invalid. | ||
VMLAUNCH | NP 0F 01 C2 | Launch virtual machine managed by current VMCS. | ||
VMRESUME | NP 0F 01 C3 | Resume virtual machine managed by current VMCS. | ||
VMREAD r/m,reg | NP 0F 78 /r | Read a specified field from the current-VMCS. The reg argument specifies which field to read – the result is stored to r/m. | rowspan="2" | |
NP 0F 79 /r | Write to specified field of current-VMCS. The reg argument specifies which field to write, and the r/m argument provides the data item to write to the field. | |||
VMCALL | NP 0F 01 C1 | Call to VM monitor from guest by causing a VMEXIT. | ||
| Extended Page Tables (EPT) instructions | ||||
INVEPT reg,m128 | Invalidates EPT-derived entries in the TLBs and paging-structure caches. The reg argument specifies an invalidation type, the memory argument specifies a 128-bit descriptor. | Nehalem, Centerton,[3] ZhangJiang | ||
Invalidates entries in the TLBs and paging-structure caches based on VPID (Virtual Processor ID). The reg argument specifies an invalidation type, the memory argument specifies a 128-bit descriptor. | ||||
VMFUNC | NP 0F 01 D4 | Invoke VM function specified in EAX. | Haswell, Silvermont, LuJiaZui | |
| Trust Domain Extensions (TDX): Secure Arbitration Mode (SEAM) instructions[4] | ||||
SEAMOPS | 66 0F 01 CE | Invoke SEAM specific operations. Operation to perform is specified in RAX. | ||
SEAMRET | 66 0F 01 CD | Return to legacy VMX root operation from SEAM VMX root operation. | ||
SEAMCALL | 66 0F 01 CF | Call to SEAM VMX root operation from legacy VMX root operation. | ||
TDCALL | 66 0F 01 CC | Call to VM monitor from TD guest by causing a VMEXIT. | ||