RMPADJUST

if not snp_active:
    fault(UD)                    # outside an SNP-active guest
if CPL > 0:
    fault(GP, 0)
va = addr.read() & ~0xFFF        # RAX: the page's virtual address
big = size.read() & 1            # RCX bit 0: a 2-MB page
d = target.read()                # RDX
t = d & 0xFF                     # a VMPL, and the permission mask
p = d >> 8 & 0xFF                # it is to have
if big and va >> 12 & 0x1FF:
    eax = 1                      # FAIL_INPUT: off a 2-MB boundary
elif t <= vmpl:
    eax = 2                      # FAIL_PERMISSION: a VMPL changes
                                 # only those less privileged
else:
    gpa = guest_pa(va)           # the guest's page tables, then the
    spa = system_pa(gpa)         # nested ones
    if not in_rmp(spa):
        vm_exit(0x400)           # #VMEXIT(NPF): no RMP entry
    r = rmp(spa)
    g = r >> 96 & 0xFFFFFFFF     # its ASID, and 2-MB page size
    s2m = r >> 72 & 1
    bad = r >> 80 & 1 or not r >> 64 & 1
    if low(r, 64) != gpa or g != asid:
        bad = 1                  # another guest's page, or another
                                 # address in it
    if s2m != npt_large(gpa):
        bad = 1                  # not the nested page's size
    if s2m and not big:
        bad = 1                  # 4 KB of a 2-MB page
    if bad:
        vm_exit(0x400)           # #VMEXIT(NPF)
    if not r >> 128 & 1:
        fault(VC, 0x404)         # PAGE_NOT_VALIDATED
    own = r >> 136 + 8 * vmpl & 0xFF
    if big and not s2m:
        eax = 6                  # FAIL_SIZEMISMATCH
    elif p & ~own:
        eax = 2                  # FAIL_PERMISSION: more than the
                                 # VMPL has itself
    else:
        if vmpl == 0:            # VMSA from RDX bit 16, at VMPL 0
            r = r & ~(1 << 129)
            r = r | (d >> 16 & 1) << 129
        at = 136 + 8 * t
        r = r & ~(0xFF << at)
        set_rmp(spa, r | p << at)
        eax = 0                  # SUCCESS
of = zf = af = pf = sf = UNDEFINED