The check for virtual NMI and blocking by NMI is missing during injection.

[SHU1107]

Is the check for VIRTUAL_NMI and blocking_by_NMI missing here?

if (event_type == BX_NMI) {
      if ((guest.interruptibility_state & 0x3) != 0) {
        BX_ERROR(("VMENTER FAIL: VMCS guest interrupts blocked when injecting NMI"));
        return VMX_VMEXIT_VMENTRY_FAILURE_GUEST_STATE;
      }

intel SDM:
28.3.1.5 Checks on Guest Non-Register State
Interruptibility state:
Bit 3 (blocking by NMI) must be 0 if the “virtual NMIs” VM-execution control is 1, the valid bit (bit 31) in the
VM-entry interruption-information field is 1, and the interruption type (bits 10:8) in that field has value 2
(indicating NMI).

[stlintel]

There is existing check but it is commented out:

  if (VMENTRY_INJECTING_EVENT(vm->vmentry_interr_info)) {

     /* the VMENTRY injecting event to the guest */
     unsigned vector = vm->vmentry_interr_info & 0xff;
     unsigned event_type = (vm->vmentry_interr_info >>  8) & 7;
     unsigned push_error = (vm->vmentry_interr_info >> 11) & 1;
     unsigned error_code = push_error ? vm->vmentry_excep_err_code : 0;

     unsigned push_error_reference = false;
     if (event_type == BX_HARDWARE_EXCEPTION && vector < BX_CPU_HANDLED_EXCEPTIONS)
        push_error_reference = exception_push_error(vector);

     if (vm->vmentry_interr_info & 0x7ffff000) {
        BX_ERROR(("VMFAIL: VMENTRY broken interruption info field"));
        return VMXERR_VMENTRY_INVALID_VM_CONTROL_FIELD;
     }

     switch (event_type) {
       case BX_EXTERNAL_INTERRUPT:
         break;

       case BX_NMI:
         if (vector != 2) {
           BX_ERROR(("VMFAIL: VMENTRY bad injected event vector %d", vector));
           return VMXERR_VMENTRY_INVALID_VM_CONTROL_FIELD;
         }
/*
         // injecting NMI
         if (vm->pin_vmexec_ctrls.VIRTUAL_NMI()) {
           if (guest.interruptibility_state & BX_VMX_INTERRUPTS_BLOCKED_NMI_BLOCKED) {
             BX_ERROR(("VMFAIL: VMENTRY injected NMI vector when blocked by NMI in interruptibility state", vector));
             return VMXERR_VMENTRY_INVALID_VM_CONTROL_FIELD;
           }
         }
*/
         break;

I don't recall why it is commented out ... might be I was not able to find a test case, might be it created problems in other place.
Do you have a test case ?
If you do -> try to uncommented and play with it

[SHU1107]

It will report an error after opening.

../../Bochs/bochs/cpu/vmx.cc: In member function ‘VMX_error_code BX_CPU_C::VMenterLoadCheckVmControls()’:
../../Bochs/bochs/cpu/vmx.cc:1035:16: error: ‘guest’ was not declared in this scope
1035 | if (guest.interruptibility_state & BX_VMX_INTERRUPTS_BLOCKED_NMI_BLOCKED) {
| ^~~~~

[stlintel]

Try this way:

         // injecting NMI
         if (vm->pin_vmexec_ctrls.VIRTUAL_NMI()) {
           Bit32u guest_interruptibility_state = VMread32(VMCS_32BIT_GUEST_INTERRUPTIBILITY_STATE);
           if (guest_interruptibility_state & BX_VMX_INTERRUPTS_BLOCKED_NMI_BLOCKED) {
             BX_ERROR(("VMFAIL: VMENTRY injected NMI vector when blocked by NMI in interruptibility state", vector));
             return VMXERR_VMENTRY_INVALID_VM_CONTROL_FIELD;
           }
         }

[stlintel]

Patch:

diff --git a/bochs/cpu/vmx.cc b/bochs/cpu/vmx.cc
index 2b2c22119..4df912b2a 100644
--- a/bochs/cpu/vmx.cc
+++ b/bochs/cpu/vmx.cc
@@ -1033,15 +1033,14 @@ VMX_error_code BX_CPU_C::VMenterLoadCheckVmControls(void)
            BX_ERROR(("VMFAIL: VMENTRY bad injected event vector %d", vector));
            return VMXERR_VMENTRY_INVALID_VM_CONTROL_FIELD;
          }
-/*
          // injecting NMI
          if (vm->pin_vmexec_ctrls.VIRTUAL_NMI()) {
-           if (guest.interruptibility_state & BX_VMX_INTERRUPTS_BLOCKED_NMI_BLOCKED) {
+           Bit32u guest_interruptibility_state = VMread32(VMCS_32BIT_GUEST_INTERRUPTIBILITY_STATE);
+           if (guest_interruptibility_state & BX_VMX_INTERRUPTS_BLOCKED_NMI_BLOCKED) {
              BX_ERROR(("VMFAIL: VMENTRY injected NMI vector when blocked by NMI in interruptibility state", vector));
              return VMXERR_VMENTRY_INVALID_VM_CONTROL_FIELD;
            }
          }
-*/
          break;
 
        case BX_HARDWARE_EXCEPTION:

[SHU1107]

../../Bochs/bochs/cpu/vmx.cc: In member function ‘VMX_error_code BX_CPU_C::VMenterLoadCheckVmControls()’:
../../Bochs/bochs/cpu/vmx.cc:1040:19: error: expected initializer before ‘guest_interruptibility_state’
1040 | Bit32u guest_interruptibility_state = VMread32(VMCS_32BIT_GUEST_INTERRUPIBILITY_STATE);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
../../Bochs/bochs/cpu/vmx.cc:1041:16: error: ‘guest_interruptibility_state’ was not declared in this scope
1041 | if (guest_interruptibility_state & BX_VMX_INTERRUPTS_BLOCKED_NMI_BLOCKED) {
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~

[stlintel]

I don't understand what do you mean. Did you apply the patch above ?

Bit32u guest_interruptibility_state = VMread32(VMCS_32BIT_GUEST_INTERRUPTIBILITY_STATE);

this line of code is the initializer

just copy paste this code if you have trouble with applying patches:

         // injecting NMI
         if (vm->pin_vmexec_ctrls.VIRTUAL_NMI()) {
           Bit32u guest_interruptibility_state = VMread32(VMCS_32BIT_GUEST_INTERRUPTIBILITY_STATE);
           if (guest_interruptibility_state & BX_VMX_INTERRUPTS_BLOCKED_NMI_BLOCKED) {
             BX_ERROR(("VMFAIL: VMENTRY injected NMI vector when blocked by NMI in interruptibility state", vector));
             return VMXERR_VMENTRY_INVALID_VM_CONTROL_FIELD;
           }
         }
         break;

it compiles perfectly for me, I just need proof that it fixes the issue

[SHU1107]

if (vector == BX_BP_EXCEPTION || vector == BX_OF_EXCEPTION) {
type = BX_SOFTWARE_EXCEPTION;
}
BX_CPU_THIS_PTR EXT = 1;
break;

  Additionally, the SVM implementation is still incomplete in the following aspects:

INT3, INTO, and INT n do not update the instruction pointer (IP).
INTO does not check whether the guest is in 64-bit mode.

[stlintel]

Can you open separate issue for that ?

[SHU1107]

OK, it's fixed now—the previous update caused some confusion.
This shouldn't be a vmfail; it should be a VM-entry failure.

t image:
t12.zip

KVM's behavior matches real hardware exactly.

[SHU1107]

I'll work on the SVM part later—probably need a test IMG for that.

[stlintel]

Fixed now thanks to the test case provided !