Intel 64 and IA-32 Architectures Software Developers Manual Volume 3B, System Programming Guide Part 2

23-28 Vol. 3
VM EXITS
— If the VM exit occurs due to the 1-setting of either the “interrupt-window
exiting” VM-execution control or the “NMI-window exiting” VM-execution
control, the value saved is that which would be in the register had the VM exit
not occurred.
— If the VM exit is due to an external interrupt, non-maskable interrupt (NMI),
or hardware exception (as defined in Section 23.2.2), the value saved is the
return pointer that would have been saved (either on the stack had the event
been delivered through a trap or interrupt gate,
1
or into the old task-state
segment had the event been delivered through a task gate).
— If the VM exit is due to a triple fault, the value saved is the return pointer that
would have been saved (either on the stack had the event been delivered
through a trap or interrupt gate, or into the old task-state segment had the
event been delivered through a task gate) had delivery of the double fault not
encountered the nested exception that caused the triple fault.
— If the VM exit is due to a software exception (due to an execution of INT3 or
INTO), the value saved references the INT3 or INTO instruction that caused
that exception.
— Suppose that the VM exit is due to a task switch that was caused by execution
of CALL, IRET, or JMP or by execution of a software interrupt (INT n) or
software exception (due to execution of INT3 or INTO) that encountered a
task gate in the IDT. The value saved references the instruction that caused
the task switch (CALL, IRET, JMP, INT n, INT3, or INTO).
— Suppose that the VM exit is due to a task switch that was caused by a task
gate in the IDT that was encountered for any reason except the direct access
by a software interrupt or software exception. The value saved is that which
would have been saved in the old task-state segment had the task switch
completed normally.
— If the VM exit is due to an execution of MOV to CR8 or WRMSR that reduced
the value of the TPR shadow
2
below that of TPR threshold VM-execution
control field, the value saved references the instruction following the MOV to
CR8 or WRMSR.
— If the VM exit was caused by a TPR-shadow update (see Section 21.5.3.3)
that results from an APIC access as part of instruction execution, the value
saved references the instruction following the one whose execution caused
the VTPR access.
• The contents of the RSP register are saved into the RSP field.
• With the exception of the resume flag (RF; bit 16), the contents of the RFLAGS
register is saved into the RFLAGS field. RFLAGS.RF is saved as follows:
1. The reference here is to the full value of RIP before any truncation that would occur had the
stack width been only 32 bits or 16 bits.
2. The TPR shadow is bits 7:4 of the byte at offset 80H of the virtual-APIC page (see Section
20.6.8).