Intel 64 and IA-32 Architectures Software Developers Manual Volume 3B, System Programming Guide Part 2

27-2 Vol. 3
VIRTUALIZATION OF SYSTEM RESOURCES
• Debug registers such as DR7 and the IA32_DEBUGCTL MSR may be explicitly
modified by the guest (through MOV-DR or WRMSR instructions) or modified
implicitly by the processor as part of generating debug exceptions. The current
values of DR7 and the IA32_DEBUGCTL MSR are saved to guest-state area of
VMCS on every VM exit. Pending debug exceptions are debug exceptions that are
recognized by the processor but not yet delivered. See Section 22.6.3 for details
on pending debug exceptions.
• DR7 and the IA32-DEBUGCTL MSR are loaded from values in the guest-state area
of the VMCS on every VM entry. This allows the VMM to properly virtualize debug
registers when injecting debug exceptions to guest. Similarly, the RFLAGS
1
register is loaded on every VM entry (or pushed to stack if injecting a virtual
event) from guest-state area of the VMCS. Pending debug exceptions are also
loaded from guest-state area of VMCS so that they may be delivered after VM
entry is completed.
27.2.1 Debug Exceptions
If a VMM emulates a guest instruction that would encounter a debug trap (single step
or data or I/O breakpoint), it should cause that trap to be delivered. The VMM should
not inject the debug exception using VM-entry event injection, but should set the
appropriate bits in the pending debug exceptions field. This method will give the trap
the right priority with respect to other events. (If the exception bitmap was
programmed to cause VM exits on debug exceptions, the debug trap will cause a VM
exit. At this point, the trap can be injected during VM entry with the proper priority.)
There is a valid pending debug exception if the BS bit (see Table 20-4) is set, regard-
less of the values of RFLAGS.TF or IA32_DEBUGCTL.BTF. The values of these bits do
not impact the delivery of pending debug exceptions.
VMMs should exercise care when emulating a guest write (attempted using WRMSR)
to IA32_DEBUGCTL to modify BTF if this is occurring with RFLAGS.TF = 1 and after a
MOV SS or POP SS instruction (for example: while debug exceptions are blocked).
Note the following:
• Normally, if WRMSR clears BTF while RFLAGS.TF = 1 and with debug exceptions
blocked, a single-step trap will occur after WRMSR. A VMM emulating such an
instruction should set the BS bit (see Table 20-4) in the pending debug
exceptions field before VM entry.
• Normally, if WRMSR sets BTF while RFLAGS.TF = 1 and with debug exceptions
blocked, neither a single-step trap nor a taken-branch trap can occur after
WRMSR. A VMM emulating such an instruction should clear the BS bit (see Table
20-4) in the pending debug exceptions field before VM entry.
1. This chapter uses the notation RAX, RIP, RSP, RFLAGS, etc. for processor registers because most
processors that support VMX operation also support Intel 64 architecture. For processors that do
not support Intel 64 architecture, this notation refers to the 32-bit forms of those registers
(EAX, EIP, ESP, EFLAGS, etc.).