36-62 Vol. 3C

INTEL® PROCESSOR TRACE

36.5.1 

VMX-Specific Packets and VMCS Controls

In all of the usages of VMX and Intel PT, the decoder in the host or VMM context can identify the occurrences of VMX 
transitions with the aid of VMX-specific packets. Packets relevant to VMX fall into the follow two kinds:

•

VMCS Packet: The VMX transitions of individual VM can be distinguished by a decoder using the base address 
field in a VMCS packet. The base address field stores the VMCS pointer address of a successful VMPTRLD. A 
VMCS packet is sent on a successful execution of VMPTRLD. See Section 36.4.2.15 for details.

•

NonRoot (NR) bit field in PIP packet: PIP packets are generated with each VM entry/exit. The NR bit in a PIP 
packet is set when in VMX non-Root operation. Thus a transition of the NR bit from 0 to 1 indicates the 
occurrence of a VM entry, and a transition of 1 to 0 indicates the occurrence of a VM exit.

Processors with IA32_VMX_MISC[bit 14]= 1 also provides VMCS controls that a VMM can configure to prevent 
VMX-specific information from leaking across virtualization boundaries.

The default setting for the VMCS controls that interacts with Intel PT is to enable all VMX-specific packet informa-
tion. The scenarios that would use the default setting also do not require the VMM to use MSR load list to manage 
the configuration of turning-on/off of trace packet generation across VM exits.
If IA32_VMX_MISC[bit 14] reports 0, any attempt to set the VMCS control bits in Table 36-46 will result in a failure 
on guest entry.

Table 36-45. Common Usages of Intel PT and VMX

Target Domain

Output 

Consumer

Virtualize 

Output

Configure VMCS 

Controls

TraceEN Configuration

Save/Restore MSR states 

of Trace Configuration

System-Wide 

(VMM + VMs)

Host

NA

Default Setting 

(no suppression)

WRMSR or XRSTORS by Host 

NA

VMM Only

Intel PT Aware 

VMM

NA

Enable 

suppression

MSR load list to disable tracing in 

VM, enable tracing on VM exits

NA

VM Only

Intel PT Aware 

VMM

NA

Enable 

suppression

MSR load list to enable tracing in 

VM, disable tracing on VM exits

NA

Intel PT Aware 

Guest(s)

Per Guest

VMM adds 

trace output 

virtualization

Enable 

suppression

MSR load list to enable tracing in 

VM, disable tracing on VM exits

VMM Update guest state 

on XRSTORS-exiting VM 

exits

Table 36-46. VMCS Controls For Intel Processor Trace

Name

Type Bit 

Position

Value

Behavior

Conceal VMX 

non-root 

operation from 

Intel PT

VM-execution 

control

19

0

PIPs generated in VM non-root operation will set the PIP.NR bit.
PSB+ in VMX non-root operation will include the VMCS packet, to ensure 

that the decoder knows which guest is currently in use.

1

PIPs generated in VMX non-root operation will not set the PIP.NR bit.
PSB+ in VMX non-root operation will not include the VMCS packet.

Conceal VM 

exits from Intel 

PT

VM-exit control

24

0

PIPs are generated on VM exit, with NonRoot=0.
On VM exit to SMM, VMCS packets are additionally generated.

1

No PIP is generated on VM exit, and no VMCS packet is generated on 

VM exit to SMM.

Conceal VM 

entries from 

Intel PT

VM-entry control

17

0

PIPs are generated on VM entry, with NonRoot=1 if the destination of 

the VM entry is VMX non-root operation.
On VM entry to SMM, VMCS packets are additionally generated.

1

No PIP is generated on VM entry, and no VMCS packet is generated on 

VM entry to SMM.