29-10 Vol. 3C

APIC VIRTUALIZATION AND VIRTUAL INTERRUPTS

•

PREFETCH. An execution of the PREFETCH instruction that would result in an access to the APIC-access page 
does not cause an APIC-access VM exit. Such an access may prefetch data; if so, it is from the corresponding 
address on the virtual-APIC page.

Virtualization of accesses to the APIC-access page is principally intended for basic instructions such as AND, MOV, 
OR, TEST, XCHG, and XOR. Use of an instruction that normally operates on floating-point, SSE, AVX, or AVX-512 
registers may cause an APIC-access VM exit unconditionally regardless of the page offset it accesses on the APIC-
access page.

29.4.5 

Issues Pertaining to Page Size and TLB Management

The 1-setting of the “virtualize APIC accesses” VM-execution is guaranteed to apply only if translations to the APIC-
access address use a 4-KByte page. The following items provide details:

•

If EPT is not in use, any linear address that translates to an address on the APIC-access page should use a 4-
KByte page. Any access to a linear address that translates to the APIC-access page using a larger page may 
operate as if the “virtualize APIC accesses” VM-execution control were 0.

•

If EPT is in use, any guest-physical address that translates to an address on the APIC-access page should use a 
4-KByte page. Any access to a linear address that translates to a guest-physical address that in turn translates 
to the APIC-access page using a larger page may operate as if the “virtualize APIC accesses” VM-execution 
control were 0. (This is true also for guest-physical accesses to the APIC-access page; see Section 29.4.6.1.)

In addition, software should perform appropriate TLB invalidation when making changes that may affect APIC-
virtualization. The specifics depend on whether VPIDs or EPT is being used:

•

VPIDs being used but EPT not being used. Suppose that there is a VPID that has been used before and that 
software has since made either of the following changes: (1) set the “virtualize APIC accesses” VM-execution 
control when it had previously been 0; or (2) changed the paging structures so that some linear address 
translates to the APIC-access address when it previously did not. In that case, software should execute 
INVVPID (see “INVVPID— Invalidate Translations Based on VPID” in Section 30.3) before performing on the 
same logical processor and with the same VPID.

9

•

EPT being used. Suppose that there is an EPTP value that has been used before and that software has since 
made either of the following changes: (1) set the “virtualize APIC accesses” VM-execution control when it had 
previously been 0; or (2) changed the EPT paging structures so that some guest-physical address translates to 
the APIC-access address when it previously did not. In that case, software should execute INVEPT (see 
“INVEPT— Invalidate Translations Derived from EPT” in Section 30.3) before performing on the same logical 
processor and with the same EPTP value.

10

•

Neither VPIDs nor EPT being used. No invalidation is required.

Failure to perform the appropriate TLB invalidation may result in the logical processor operating as if the “virtualize 
APIC accesses” VM-execution control were 0 in responses to accesses to the affected address. (No invalidation is 
necessary if neither VPIDs nor EPT is being used.)

29.4.6 

APIC Accesses Not Directly Resulting From Linear Addresses

Section 29.4 has described the treatment of accesses that use linear addresses that translate to addresses on the 
APIC-access page. This section considers memory accesses that do not result directly from linear addresses.

•

An access is called a guest-physical access if (1) CR0.PG = 1;

11

 (2) the “enable EPT” VM-execution control 

is 1;

12

 (3) the access’s physical address is the result of an EPT translation; and (4) either (a) the access was 

not generated by a linear address; or (b) the access’s guest-physical address is not the translation of the 

9. INVVPID should use either (1) the all-contexts INVVPID type; (2) the single-context INVVPID type with the VPID in the INVVPID 

descriptor; or (3)  the individual-address INVVPID type with the linear address and the VPID in the INVVPID descriptor.

10. INVEPT should use either (1) the global INVEPT type; or (2) the single-context INVEPT type with the EPTP value in the INVEPT 

descriptor.

11. If the capability MSR IA32_VMX_CR0_FIXED0 reports that CR0.PG must be 1 in VMX operation, CR0.PG must be 1 unless the “unre-

stricted guest” VM-execution control and bit 31 of the primary processor-based VM-execution controls are both 1.