Intel 64 and IA-32 Architectures Software Developers Manual Volume 3B, System Programming Guide Part 2

Vol. 3 24-21
SUPPORT FOR ADDRESS TRANSLATION
24.3.3.4 Guidelines for Use of the INVEPT Instruction
The following items provide guidelines for use of the INVEPT instruction to invalidate
information cached from the EPT paging structures.
• Software should use the INVEPT instruction with the “single-context” INVEPT
type after making any of the following changes to an EPT paging-structure entry
(the INVEPT descriptor should be set to the EPTP value that references the
modified EPT paging structure):
— Changing any of the privilege bits 2:0 from 1 to 0.
— Changing the physical address in bits 51:12.
— For an EPT PDE, changing bit 7 (which determines whether the EPT PDE maps
a 2-MByte page).
—For the last EPT paging-structure entry used to translate a guest-physical
address (either an EPT PDE with bit 7 set to 1 or an EPT PTE), changing either
bits 5:3 or bit 6. (These bits determine the effective memory type of
accesses using that EPT paging-structure entry; see Section 24.2.5.)
• Software may use the INVEPT instruction after modifying a present EPT paging-
structure entry to change any of the privilege bits 2:0 from 0 to 1. Failure to do
so may cause an EPT violation that would not otherwise occur. Because an EPT
violation invalidates any mappings that would be used by the access that caused
the EPT violation (see Section 24.3.3.1), an EPT violation will not recur if the
original access is performed again, even if the INVEPT instruction is not executed.
• Because a logical processor does not cache any information derived from EPT
paging-structure entries that are not present or misconfigured (see Section
24.2.4.1), it is not necessary to execute INVEPT following modification of an EPT
paging-structure entry that had been not present or misconfigured.
• As detailed in Section 21.2.1.1 and Section 21.2.2.1, an access to the APIC-
access page might not cause an APIC-access VM exit if software does not
properly invalidate information that may be cached from the EPT paging
structures. If EPT was in use on a logical processor at one time with EPTP X, it is
recommended that software use the INVEPT instruction with the “single-context”
INVEPT type and with EPTP X in the INVEPT descriptor before a VM entry on the
same logical processor that enables EPT with EPTP X and either (a) the “virtualize
APIC accesses” VM-execution control was changed from 0 to 1; or (b) the value
of the APIC-access address was changed.
• Software can use the INVEPT instruction with the “all-context” INVEPT type
immediately after execution of the VMXON instruction or immediately prior to
execution of the VMXOFF instruction. Either prevents potentially undesired
retention of information cached from EPT paging structures between separate
uses of VMX operation.
In a system containing more than one logical processor, software must account for
the fact that information from an EPT paging-structure entry may be cached on
logical processors other than the one that modifies that entry. The process of propa-
gating the changes to a paging-structure entry is commonly referred to as “TLB