Hi all: I'am investigating the vmx code and encounter some questions. It's very nice of you if you can help me fix these. About wbinvd. 1. Which way (ctxt->ops->wbinvd)(ctxt) is called? If cpu_has_vmx_wbinvd_exit(), wbinvd instruction would be handled by handle_wbinvd and instruction emulate is skipped... 2. What is the purpose of set local cpu into wbinvd_dirty_mask in kvm_emulate_wbinvd_noskip()? It seems local cpu is ignored in smp_call_function_many(). And so local cpu wbinvd is missed ? 3. Commit (2eec73437487: KVM: x86: Avoid issuing wbinvd twice) said we may call wbinvd twice. Could you please explain how it could execute it twice in detail ? About nWMX. When nested_vmx_handle_enlightened_vmptrld() return 0, it do not inject any exception or set rflags to Indicate VMLAUNCH instruction failed and skip this instruction. This would cause nested_vmx_run() return 1 and resume guest and retry this instruction. When the error causing nested_vmx_handle_enlightened_vmptrld() failed can't be handled, would deadloop ouucr ? About defer setting of CR2 (see commit (da998b46d244: kvm: x86: Defer setting of CR2 until #PF delivery)) How defer setting of CR2 until #PF delivery works? In inject_pending_event(), the payload of exception is loaded into vmcs12' exit_qualification without setting CR2 via nested_vmx_check_exception() in kvm_x86_ops-> check_nested_events(); But CR2 is unconditionally set to exception.payload via vmx_queue_exception() before we enter L1. So CR2 is modified before L1 hypervisor could intercept the fault. Where's the wrong in my understand? Please help me figure it out. Any answer would be very appreciated. Thanks in advance! ^_^ Best wishes!