Index: trunk/src/VBox/VMM/VMMAll/IEMAll.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/IEMAll.cpp	(revision 77093)
+++ trunk/src/VBox/VMM/VMMAll/IEMAll.cpp	(revision 77094)
@@ -1133,5 +1133,5 @@
 }
 
-#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
+#if defined(VBOX_WITH_NESTED_HWVIRT_SVM) || defined(VBOX_WITH_NESTED_HWVIRT_VMX)
 /**
  * Performs a minimal reinitialization of the execution state.
@@ -5567,5 +5567,5 @@
         }
     }
-#endif /* VBOX_WITH_NESTED_HWVIRT_SVM */
+#endif
 
     /*
@@ -14336,12 +14336,17 @@
      */
     /** @todo Can we centralize this under CPUMCanInjectInterrupt()? */
-#if defined(VBOX_WITH_NESTED_HWVIRT_SVM)
+#if defined(VBOX_WITH_NESTED_HWVIRT_SVM) || defined(VBOX_WITH_NESTED_HWVIRT_VMX)
     bool fIntrEnabled = CPUMGetGuestGif(&pVCpu->cpum.GstCtx);
     if (fIntrEnabled)
     {
-        if (CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
+        if (!CPUMIsGuestInNestedHwvirtMode(IEM_GET_CTX(pVCpu)))
+            fIntrEnabled = pVCpu->cpum.GstCtx.eflags.Bits.u1IF;
+        else if (CPUMIsGuestInVmxNonRootMode(IEM_GET_CTX(pVCpu)))
+            fIntrEnabled = CPUMIsGuestVmxPhysIntrEnabled(pVCpu, IEM_GET_CTX(pVCpu));
+        else
+        {
+            Assert(CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
             fIntrEnabled = CPUMIsGuestSvmPhysIntrEnabled(pVCpu, IEM_GET_CTX(pVCpu));
-        else
-            fIntrEnabled = pVCpu->cpum.GstCtx.eflags.Bits.u1IF;
+        }
     }
 #else
@@ -14357,6 +14362,14 @@
         RTGCPTR     uCr2;
         int rc2 = TRPMQueryTrapAll(pVCpu, &u8TrapNo, &enmType, &uErrCode, &uCr2, NULL /* pu8InstLen */); AssertRC(rc2);
-        IEMInjectTrap(pVCpu, u8TrapNo, enmType, (uint16_t)uErrCode, uCr2, 0 /* cbInstr */);
+        VBOXSTRICTRC rcStrict = IEMInjectTrap(pVCpu, u8TrapNo, enmType, (uint16_t)uErrCode, uCr2, 0 /* cbInstr */);
         TRPMResetTrap(pVCpu);
+#if defined(VBOX_WITH_NESTED_HWVIRT_SVM) || defined(VBOX_WITH_NESTED_HWVIRT_VMX)
+        /* Injecting an event may cause a VM-exit. */
+        if (   rcStrict != VINF_SUCCESS
+            && rcStrict != VINF_IEM_RAISED_XCPT)
+            return iemExecStatusCodeFiddling(pVCpu, rcStrict);
+#else
+        NOREF(rcStrict);
+#endif
     }
 
@@ -14456,5 +14469,5 @@
             iemMemRollback(pVCpu);
 
-#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
+#if defined(VBOX_WITH_NESTED_HWVIRT_SVM) || defined(VBOX_WITH_NESTED_HWVIRT_VMX)
         /*
          * When a nested-guest causes an exception intercept (e.g. #PF) when fetching
@@ -14633,5 +14646,5 @@
             iemMemRollback(pVCpu);
 
-#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
+#if defined(VBOX_WITH_NESTED_HWVIRT_SVM) || defined(VBOX_WITH_NESTED_HWVIRT_VMX)
         /*
          * When a nested-guest causes an exception intercept (e.g. #PF) when fetching
@@ -14750,9 +14763,12 @@
 
     VBOXSTRICTRC rcStrict = IEMInjectTrap(pVCpu, u8TrapNo, enmType, uErrCode, uCr2, cbInstr);
-# ifdef VBOX_WITH_NESTED_HWVIRT_SVM
+#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
     if (rcStrict == VINF_SVM_VMEXIT)
         rcStrict = VINF_SUCCESS;
-# endif
-
+#endif
+#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
+    if (rcStrict == VINF_VMX_VMEXIT)
+        rcStrict = VINF_SUCCESS;
+#endif
     /** @todo Are there any other codes that imply the event was successfully
      *        delivered to the guest? See @bugref{6607}.  */
Index: trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp.h
===================================================================
--- trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp.h	(revision 77093)
+++ trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp.h	(revision 77094)
@@ -6569,5 +6569,5 @@
      */
     uint64_t uTicks = TMCpuTickGet(pVCpu);
-#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
+#if defined(VBOX_WITH_NESTED_HWVIRT_SVM) || defined(VBOX_WITH_NESTED_HWVIRT_VMX)
     uTicks = CPUMApplyNestedGuestTscOffset(pVCpu, uTicks);
 #endif
@@ -6626,5 +6626,5 @@
 
         uint64_t uTicks = TMCpuTickGet(pVCpu);
-#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
+#if defined(VBOX_WITH_NESTED_HWVIRT_SVM) || defined(VBOX_WITH_NESTED_HWVIRT_VMX)
         uTicks = CPUMApplyNestedGuestTscOffset(pVCpu, uTicks);
 #endif
Index: trunk/src/VBox/VMM/VMMAll/IEMAllCImplVmxInstr.cpp.h
===================================================================
--- trunk/src/VBox/VMM/VMMAll/IEMAllCImplVmxInstr.cpp.h	(revision 77093)
+++ trunk/src/VBox/VMM/VMMAll/IEMAllCImplVmxInstr.cpp.h	(revision 77094)
@@ -1765,5 +1765,5 @@
     }
 
-    /* Segment attribute bits 31:7 and 11:8 MBZ. */
+    /* Segment attribute bits 31:17 and 11:8 MBZ. */
     uint32_t const fValidAttrMask = X86DESCATTR_TYPE | X86DESCATTR_DT  | X86DESCATTR_DPL | X86DESCATTR_P
                                   | X86DESCATTR_AVL  | X86DESCATTR_L   | X86DESCATTR_D   | X86DESCATTR_G | X86DESCATTR_UNUSABLE;
@@ -3317,4 +3317,5 @@
     if ((fReadShadow & fGstHostMask) != (*puNewCrX & fGstHostMask))
     {
+        Assert(fGstHostMask != 0);
         Log2(("mov_Cr_Rd: (CR%u) Guest intercept -> VM-exit\n", iCrReg));
 
@@ -3967,5 +3968,6 @@
      * We are injecting an external interrupt, check if we need to cause a VM-exit now.
      * If not, the caller will continue delivery of the external interrupt as it would
-     * normally.
+     * normally. The interrupt is no longer pending in the interrupt controller at this
+     * point.
      */
     if (fFlags & IEM_XCPT_FLAGS_T_EXT_INT)
