Index: /trunk/include/VBox/vmm/hm_vmx.h
===================================================================
--- /trunk/include/VBox/vmm/hm_vmx.h	(revision 73627)
+++ /trunk/include/VBox/vmm/hm_vmx.h	(revision 73628)
@@ -1237,6 +1237,8 @@
  *  instructions. */
 #define VMX_MISC_ENTRY_INJECT_SOFT_INT                          RT_BIT(30)
-/** Maximum number of MSRs in the VMCS, (n+1)*512. */
+/** Maximum number of MSRs in the auto-load/store MSR areas, (n+1) * 512. */
 #define VMX_MISC_MAX_MSRS(a_MiscMsr)                            (512 * (RT_BF_GET((a_MiscMsr), VMX_BF_MISC_MAX_MSRS) + 1))
+/** Maximum CR3-target count supported by the CPU. */
+#define VMX_MISC_CR3_TARGET_COUNT(a_MiscMsr)                    (((a) >> 16) & 0xff)
 /** Relationship between the preemption timer and tsc. */
 #define VMX_BF_MISC_PREEMPT_TIMER_TSC_SHIFT                     0
@@ -1286,4 +1288,6 @@
 /** @} */
 
+/** Maximum number of CR3 target supported by VT-x */
+#define VMX_VMCS_CTRL_CR3_TARGET_COUNT_MAX                      4
 
 /** @name VMX MSR - VMCS enumeration.
@@ -1574,5 +1578,5 @@
 #define VMX_VMCS_CTRL_CR3_TARGET_VAL1                           0x600a
 #define VMX_VMCS_CTRL_CR3_TARGET_VAL2                           0x600c
-#define VMX_VMCS_CTRL_CR3_TARGET_VAL31                          0x600e
+#define VMX_VMCS_CTRL_CR3_TARGET_VAL3                           0x600e
 /** @} */
 
@@ -2523,4 +2527,18 @@
 #define VMX_V_VMCS_PHYSADDR_4G_LIMIT                            0
 
+/** @name Virtual VMX MSR - Miscellaneous data.
+ * @{ */
+/** Number of CR3-target values supported. */
+#define VMX_V_CR3_TARGET_COUNT                                  4
+/** Activity states supported. */
+#define VMX_V_GUEST_ACTIVITY_STATE_MASK                         (VMX_VMCS_GUEST_ACTIVITY_HLT)
+/** VMX preemption-timer shift (Core i7-2600 taken as reference). */
+#define VMX_V_PREEMPT_TIMER_SHIFT                               5
+/** Maximum number of MSRs in the auto-load/store MSR areas, (n+1) * 512. */
+#define VMX_V_MAX_MSRS                                          0
+/** SMM MSEG revision ID. */
+#define VMX_V_MSEG_REV_ID                                       0
+/** @} */
+
 /**
  * Virtual VMX-instruction diagnostics.
Index: /trunk/src/VBox/VMM/VMMAll/CPUMAllMsrs.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/CPUMAllMsrs.cpp	(revision 73627)
+++ /trunk/src/VBox/VMM/VMMAll/CPUMAllMsrs.cpp	(revision 73628)
@@ -1455,6 +1455,19 @@
     if (pGuestFeatures->fVmx)
     {
-        /** @todo Think about this especially preemption timer TSC shifts.  */
-        *puValue = 0;
+        uint64_t uHostMsr;
+        int rc = HMVmxGetHostMsr(pVCpu->CTX_SUFF(pVM), idMsr, &uHostMsr);
+        AssertRCReturn(rc, rc);
+        uint8_t const cMaxMsrs = RT_MIN(RT_BF_GET(uHostMsr, VMX_BF_MISC_MAX_MSRS), VMX_V_MAX_MSRS);
+        *puValue = RT_BF_MAKE(VMX_BF_MISC_PREEMPT_TIMER_TSC,      VMX_V_PREEMPT_TIMER_SHIFT             )
+                 | RT_BF_MAKE(VMX_BF_MISC_EXIT_STORE_EFER_LMA,    pGuestFeatures->fVmxExitStoreEferLma  )
+                 | RT_BF_MAKE(VMX_BF_MISC_ACTIVITY_STATES,        VMX_V_GUEST_ACTIVITY_STATE_MASK       )
+                 | RT_BF_MAKE(VMX_BF_MISC_PT,                     0                                     )
+                 | RT_BF_MAKE(VMX_BF_MISC_SMM_READ_SMBASE_MSR,    0                                     )
+                 | RT_BF_MAKE(VMX_BF_MISC_CR3_TARGET,             VMX_V_CR3_TARGET_COUNT                )
+                 | RT_BF_MAKE(VMX_BF_MISC_MAX_MSRS,               cMaxMsrs                              )
+                 | RT_BF_MAKE(VMX_BF_MISC_VMXOFF_BLOCK_SMI,       0                                     )
+                 | RT_BF_MAKE(VMX_BF_MISC_VMWRITE_ALL,            pGuestFeatures->fVmxVmwriteAll        )
+                 | RT_BF_MAKE(VMX_BF_MISC_ENTRY_INJECT_SOFT_INT,  pGuestFeatures->fVmxEntryInjectSoftInt)
+                 | RT_BF_MAKE(VMX_BF_MISC_MSEG_ID,                VMX_V_MSEG_REV_ID                     );
     }
     else
Index: /trunk/src/VBox/VMM/VMMAll/IEMAllCImplVmxInstr.cpp.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/IEMAllCImplVmxInstr.cpp.h	(revision 73627)
+++ /trunk/src/VBox/VMM/VMMAll/IEMAllCImplVmxInstr.cpp.h	(revision 73628)
@@ -337,5 +337,4 @@
     Assert(!pVCpu->cpum.GstCtx.hwvirt.vmx.fInVmxNonRootMode);
 
-    /** @todo NSTVMX: Unblock INIT. */
     if (fSmmMonitorCtl & MSR_IA32_SMM_MONITOR_VMXOFF_UNBLOCK_SMI)
     { /** @todo NSTVMX: Unblock SMI. */ }