Exception Intercept Message

An exception intercept message is delivered by the hypervisor when a virtual processor generates an exception.

The format of exception intercept messages is shown in the following table. An HV_X64_EXCEPTION_INTERCEPT_MESSAGE structure is used to encode an exception intercept message.

Message Header
0	MessageType (4 bytes)				Rsvd (3 bytes)			PayloadSize (1 byte)
8	SourcePartition (8 bytes)
Exception Intercept Payload
16	VpIndex (4 bytes)				InstLen = 0 (1 byte)	AccessType (1 byte)	ExecutionState (2 bytes)
24	CsSegment[0] (8 bytes)
32	CsSegment[1] (8 bytes)
40	Rip (8 bytes)
48	Rflags (8 bytes)
56	Exception Vector (2 bytes)	Exception Flags (1 byte)	InstrByte Count (1 byte)	ErrorCode (4 bytes)
64	ExceptionParameter (8 bytes)
72	Rsvd (8 bytes)
80	InstructionBytes[0] (8 bytes)
88	InstructionBytes[1] (8 bytes)
96	DsSegment[0] (8 bytes)
104	DsSegment[1] (8 bytes)
112	SsSegment[0] (8 bytes)
120	SsSegment[1] (8 bytes)
128	Rax (8 bytes)
...	...
248	R15 (8 bytes)

The following list describes the fields of exception intercept messages:

ExceptionVector: The vector number of the exception that was generated.
ExceptionFlags: A HV_X64_EXCEPTION_INFO union that provides information about the exception.
InstByteCount: The number of instruction bytes that have been provided in the InstructionBytes fields. Valid values are in the range 0 through 16.
ErrorCode: The error code that would have been pushed as part of the exception frame. This field is valid only if the ExceptionFlags field indicates that an error code is present.
ExceptionParameter: Additional information whose meaning is specific to the exception type. This information is only defined for page faults (vector 0x0E) and breakpoint exceptions (vector 0x01). In the case of page faults, the virtual address that caused the fault is provided (that is, the value that would typically be placed in CR2 by the processor). In the case of breakpoint exceptions, the value that would have been placed in DR6 is provided. This field is reserved for all other exception types.
InstructionBytes: Includes up to 16 bytes from the instruction stream that starts at the current CS:RIP. The number of valid bytes is specified by InstByteCount. If the access was due to the delivery of an interruption (as indicated by the InterruptionPending bit in the ExecutionState member of the HV_X64_VP_EXECUTION_STATE union), the message will not include any instruction bytes. In other cases, the hypervisor might only fetch up to the next page boundary or up to the end of the code segment, which results in an instruction byte count that is less than 16.
DsSegment: The selector, base, limit, and flags for the current data segment (DS).
SsSegment: The selector, base, limit, and flags for the current stack segment (SS).
Rax...R15: The current values of the virtual processor's sixteen 64-bit general purpose registers.

Send comments about this topic to Microsoft

Build date: 11/16/2013