Intel 64 and IA-32 Architectures Software Developers Manual Volume 3B, System Programming Guide Part 2

Vol. 3 23-29
VM EXITS
— If the VM exit is caused directly by an event that would normally be delivered
through the IDT, the value saved is that which would appear in the saved
RFLAGS image (either that which would be saved on the stack had the event
been delivered through a trap or interrupt gate
1
or into the old task-state
segment had the event been delivered through a task gate) had the event
been delivered through the IDT. See below for VM exits due to task switches
caused by task gates in the IDT.
— If the VM exit is caused by a triple fault, the value saved is that which the
logical processor would have in RF in the RFLAGS register had the triple fault
taken the logical processor to the shutdown state.
— If the VM exit is caused by a task switch (including one caused by a task gate
in the IDT), the value saved is that which would have been saved in the
RFLAGS image in the old task-state segment (TSS) had the task switch
completed normally without exception.
— If the VM exit is caused by an attempt to execute an instruction that uncondi-
tionally causes VM exits or one that was configured to do with a VM-execution
control, the value saved is 0.
2
— For APIC-access VM exits and for VM exits caused by EPT violations and EPT
misconfigurations, the value saved depends on whether the VM exit occurred
during delivery of an event through the IDT:
• If the VM exit stored 0 for bit 31 for IDT-vectoring information field
(because the VM exit did not occur during delivery of an event through
the IDT; see Section 23.2.3), the value saved is 1.
• If the VM exit stored 1 for bit 31 for IDT-vectoring information field
(because the VM exit did occur during delivery of an event through the
IDT), the value saved is the value that would have appeared in the saved
RFLAGS image had the event been delivered through the IDT (see
above).
— For all other VM exits, the value saved is the value RFLAGS.RF had before the
VM exit occurred.
23.3.4 Saving Non-Register State
Information corresponding to guest non-register state is saved as follows:
1. The reference here is to the full value of RFLAGS before any truncation that would occur had the
stack width been only 32 bits or 16 bits.
2. This is true even if RFLAGS.RF was 1 before the instruction was executed. If, in response to such
a VM exit, a VM monitor re-enters the guest to re-execute the instruction that caused the
VM exit (for example, after clearing the VM-execution control that caused the VM exit), the
instruction may encounter a code breakpoint that has already been processed. A VM monitor can
avoid this by setting the guest value of RFLAGS.RF to 1 before resuming guest software.