VMXON

if not cr4 >> 13 & 1:
    fault(UD)                    # CR4.VMXE clear: VMX off (and on
                                 # AMD's processors, which have no
                                 # VMX)
if not in_vmx:
    fc = msr[IA32_FEATURE_CONTROL]
    on = fc >> (1 if in_smx else 2) & 1
    a0 = msr[IA32_VMX_CR0_FIXED0]  # bits that must be 1
    a1 = msr[IA32_VMX_CR0_FIXED1]  # bits that may be 1
    b0 = msr[IA32_VMX_CR4_FIXED0]
    b1 = msr[IA32_VMX_CR4_FIXED1]
    bad = cr0 & a0 != a0 or cr0 & ~a1
    if cr4 & b0 != b0 or cr4 & ~b1:
        bad = 1
    if CPL > 0 or bad:
        fault(GP, 0)
    if not fc & 1 or not on:
        fault(GP, 0)             # the firmware left the MSR open
                                 # (bit 0, lock) or VMX off: bit 1 in
                                 # SMX operation, bit 2 outside
    p = src.read()               # a physical address
    basic = msr[IA32_VMX_BASIC]
    rev = basic & 0x7FFFFFFF     # the VMCS revision identifier
    w = maxphyaddr               # the physical-address width, or 32
    if basic >> 48 & 1:          # bits where IA32_VMX_BASIC[48]
        w = 32                   # says so
    if p & 0xFFF or p >> w:
        vm_fail_invalid()
    elif phys_read(p, 32) != rev:
        vm_fail_invalid()        # another revision identifier, or
                                 # bit 31 set
    else:
        in_vmx = 1               # INIT blocked, A20M off, address
        vmxon_ptr = p            # monitoring cleared
        current_vmcs = NO_VMCS
        vm_succeed()
elif vmx_nonroot:
    vm_exit(27)                  # the hypervisor emulates it
elif CPL > 0:
    fault(GP, 0)
else:
    vm_fail(15)                  # in VMX root operation already