On 25/07/2017 13:36, Wanpeng Li wrote: >> - during VMRESUME emulation, prepare_vmcs02 sets bit 3 in the >> interruptibility-state field of vmcs02, but nmi_known_unmasked is >> still true. >> - on the next L2 exit to L0, nmi_known_unmasked is true so >> vmx_recover_nmi_blocking does not do anything. >> >> Can you explain instead what happens if your v1 patch is applied (on top of mine), >> and why it fixes the bug. > > We will set the expected guest interruptibility-state field before the > final step: L0 fixes the shadow page table (NGVA -> HPA), then L0 > resumes the guest w/ the expected guest interruptibility-state. Aha, that makes sense indeed! I was confused between the first page fault (that is reflected to L1) and the second (that is fixed by L0). Thanks! Paolo