PVALIDATE

if CPL > 0:                      # (#UD first on a processor without
    fault(GP, 0)                 # SEV-SNP; Zen 5 has it, though its
                                 # KVM guests' CPUID says not)
va = addr.read() & ~0xFFF        # RAX: the page's virtual address
big = size.read() & 1            # ECX bit 0: a 2-MB page
v = valid.read() & 1             # EDX bit 0: the new Validated
if not snp_active:
    eax = 0                      # SUCCESS outside an SNP-active
    cf = 1                       # guest, which changes nothing
elif vmpl > 0:
    fault(GP, 0)                 # VMPL 0 alone validates pages
elif big and va >> 12 & 0x1FF:
    eax = 1                      # FAIL_INPUT: off a 2-MB boundary
    cf = UNDEFINED
else:
    gpa = guest_pa(va)           # the guest's page tables, then the
    spa = system_pa(gpa)         # nested ones
    if not in_rmp(spa):
        vm_exit(0x400)           # #VMEXIT(NPF): no RMP entry
    r = rmp(spa)
    g = r >> 96 & 0xFFFFFFFF     # its ASID, and 2-MB page size
    s2m = r >> 72 & 1
    bad = r >> 80 & 1 or not r >> 64 & 1
    if low(r, 64) != gpa or g != asid:
        bad = 1                  # another guest's page, or another
                                 # address in it
    if s2m != npt_large(gpa):
        bad = 1                  # not the nested page's size
    if s2m and not big:
        bad = 1                  # 4 KB of a 2-MB page
    if bad:
        vm_exit(0x400)           # #VMEXIT(NPF)
    if big and not s2m:
        eax = 6                  # FAIL_SIZEMISMATCH: a 2-MB page
        cf = UNDEFINED           # that the RMP has in 4-KB pages
    else:
        cf = r >> 128 & 1 == v   # 1: Validated was so already
        r = r & ~(1 << 128)
        set_rmp(spa, r | v << 128)
        eax = 0                  # SUCCESS
of = zf = af = pf = sf = UNDEFINED