From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43)
	id 1IQlOu-0004WK-2m
	for qemu-devel@nongnu.org; Thu, 30 Aug 2007 10:53:40 -0400
Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43)
	id 1IQlOq-0004VJ-La
	for qemu-devel@nongnu.org; Thu, 30 Aug 2007 10:53:39 -0400
Received: from [199.232.76.173] (helo=monty-python.gnu.org)
	by lists.gnu.org with esmtp (Exim 4.43) id 1IQlOq-0004VB-E4
	for qemu-devel@nongnu.org; Thu, 30 Aug 2007 10:53:36 -0400
Received: from mx2.suse.de ([195.135.220.15])
	by monty-python.gnu.org with esmtps
	(TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.60)
	(envelope-from <agraf@suse.de>) id 1IQlOo-00016C-Ow
	for qemu-devel@nongnu.org; Thu, 30 Aug 2007 10:53:36 -0400
Received: from Relay2.suse.de (mail2.suse.de [195.135.221.8])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by mx2.suse.de (Postfix) with ESMTP id 6253321761
	for <qemu-devel@nongnu.org>; Thu, 30 Aug 2007 16:53:32 +0200 (CEST)
Message-ID: <46D6DA17.7050304@suse.de>
Date: Thu, 30 Aug 2007 16:54:15 +0200
From: Alexander Graf <agraf@suse.de>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="------------000400080308000307030106"
Subject: [Qemu-devel] [PATCH] SVM support
Reply-To: qemu-devel@nongnu.org
List-Id: qemu-devel.nongnu.org
List-Unsubscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.gnu.org/pipermail/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: qemu-devel@nongnu.org

This is a multi-part message in MIME format.
--------------000400080308000307030106
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

Hi,

after a lot of struggling I finally got everything working smoothly
(special thanks to Fabrice and Avi), so I believe this patch is ready to
be taken upstream.
CC_DST was never a problem, as everything I did in the eflags area
already worked. I managed to clobber the segment attributes though, so
that was the real problem here.
Nevertheless there is still a lot of functionality missing, whereas none
of that is used in kvm by now, so that works already.

So there are still missing parts that I will list here:

- NPT support
- Everything related to device virtualisation
- The "Secure" part of the extension (would need TPM emulation for that)
- Debugging support (maybe it does work, I actually have never tried to
debug a kvm virtualised machine)
- TSC_OFFSET
- ASID support
- Sanity checks
- Task switch and Ferr_Freeze Intercepts
- VMMCALL
- SMM support
- SVM-Lock


Most of these features are optional or not used by any software I know
of today, so it does not hurt (yet).

I'm really sorry that this patch is so big. I already tried to make it
as small as I could, but this feature is heavy.
In case it is too big, I can try to split it up into several patches.

Thanks a lot,

Alexander Graf

--------------000400080308000307030106
Content-Type: text/x-patch;
 name="svm.patch"
Content-Disposition: inline;
 filename="svm.patch"
Content-Transfer-Encoding: quoted-printable

Index: qemu/target-i386/helper2.c
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
--- qemu.orig/target-i386/helper2.c
+++ qemu/target-i386/helper2.c
@@ -27,6 +27,7 @@
=20
 #include "cpu.h"
 #include "exec-all.h"
+#include "svm.h"
=20
 //#define DEBUG_MMU
=20
@@ -111,6 +112,7 @@ CPUX86State *cpu_x86_init(void)
                                CPUID_CX8 | CPUID_PGE | CPUID_CMOV |
                                CPUID_PAT);
         env->pat =3D 0x0007040600070406ULL;
+        env->cpuid_ext3_features =3D CPUID_EXT3_SVM;
         env->cpuid_ext_features =3D CPUID_EXT_SSE3;
         env->cpuid_features |=3D CPUID_FXSR | CPUID_MMX | CPUID_SSE | CP=
UID_SSE2 | CPUID_PAE | CPUID_SEP;
         env->cpuid_features |=3D CPUID_APIC;
@@ -131,7 +133,7 @@ CPUX86State *cpu_x86_init(void)
         /* currently not enabled for std i386 because not fully tested *=
/
         env->cpuid_ext2_features =3D (env->cpuid_features & 0x0183F3FF);
         env->cpuid_ext2_features |=3D CPUID_EXT2_LM | CPUID_EXT2_SYSCALL=
 | CPUID_EXT2_NX;
-        env->cpuid_xlevel =3D 0x80000008;
+        env->cpuid_xlevel =3D 0x8000000a;
=20
         /* these features are needed for Win64 and aren't fully implemen=
ted */
         env->cpuid_features |=3D CPUID_MTRR | CPUID_CLFLUSH | CPUID_MCA;
@@ -160,6 +162,7 @@ void cpu_reset(CPUX86State *env)
 #ifdef CONFIG_SOFTMMU
     env->hflags |=3D HF_SOFTMMU_MASK;
 #endif
+    env->hflags |=3D HF_GIF_MASK;
=20
     cpu_x86_update_cr0(env, 0x60000010);
     env->a20_mask =3D 0xffffffff;
@@ -863,7 +866,6 @@ int cpu_x86_handle_mmu_fault(CPUX86State
  do_fault_protect:
     error_code =3D PG_ERROR_P_MASK;
  do_fault:
-    env->cr[2] =3D addr;
     error_code |=3D (is_write << PG_ERROR_W_BIT);
     if (is_user)
         error_code |=3D PG_ERROR_U_MASK;
@@ -871,8 +873,15 @@ int cpu_x86_handle_mmu_fault(CPUX86State
         (env->efer & MSR_EFER_NXE) &&=20
         (env->cr[4] & CR4_PAE_MASK))
         error_code |=3D PG_ERROR_I_D_MASK;
+    if (INTERCEPTEDl(_exceptions, 1 << EXCP0E_PAGE)) {
+        stq_phys(env->vm_vmcb + offsetof(struct vmcb, control.exit_info_=
2), addr);
+    } else {
+        env->cr[2] =3D addr;
+    }
     env->error_code =3D error_code;
     env->exception_index =3D EXCP0E_PAGE;
+    if (INTERCEPTEDl(_exceptions, 1 << EXCP0E_PAGE)) // the VMM will han=
dle this
+        return 2;
     return 1;
 }
=20
Index: qemu/target-i386/translate.c
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
--- qemu.orig/target-i386/translate.c
+++ qemu/target-i386/translate.c
@@ -77,6 +77,7 @@ typedef struct DisasContext {
                    static state change (stop translation) */
     /* current block context */
     target_ulong cs_base; /* base of CS segment */
+    uint64_t intercept; /* SVM intercept vector */
     int pe;     /* protected mode */
     int code32; /* 32 bit code segment */
 #ifdef TARGET_X86_64
@@ -1995,6 +1996,84 @@ static void gen_movl_seg_T0(DisasContext
     }
 }
=20
+#ifdef TARGET_X86_64
+#define SVM_movq_T1_im(x) gen_op_movq_T1_im64((x) >> 32, x)
+#else
+#define SVM_movq_T1_im(x) gen_op_movq_T1_im(x)
+#endif
+
+static inline int gen_svm_check_io(DisasContext *s, target_ulong pc_star=
t, uint64_t type) {
+    if(s->intercept & (1ULL << INTERCEPT_IOIO_PROT)) {
+        if (s->cc_op !=3D CC_OP_DYNAMIC)
+            gen_op_set_cc_op(s->cc_op);
+        SVM_movq_T1_im(s->pc - s->cs_base);
+        gen_jmp_im(pc_start - s->cs_base);
+        gen_op_geneflags();
+        gen_op_svm_check_intercept_io((uint32_t)(type >> 32), (uint32_t)=
type);
+        s->cc_op =3D CC_OP_DYNAMIC;
+        // FIXME: maybe we could move the io intercept vector to env as =
well
+	//        so we know if this is an EOB or not ... let's assume it's not
+	//        for now
+    }
+    return 0;
+}
+
+static inline int svm_is_rep(int prefixes) {
+    return ((prefixes & (PREFIX_REPZ | PREFIX_REPNZ)) ? 8 : 0);
+}
+
+static inline int gen_svm_check_intercept_param(DisasContext *s, target_=
ulong pc_start, uint64_t type, uint64_t param) {
+    if(!(s->intercept & (INTERCEPT_SVM_MASK))) return 0; // no SVM activ=
ated
+    switch(type) {
+        case SVM_EXIT_READ_CR0 ... SVM_EXIT_EXCP_BASE - 1: // CRx and DR=
x reads/writes
+            if (s->cc_op !=3D CC_OP_DYNAMIC) {
+                gen_op_set_cc_op(s->cc_op);
+                s->cc_op =3D CC_OP_DYNAMIC;
+            }
+            gen_jmp_im(pc_start - s->cs_base);
+            SVM_movq_T1_im(param);
+            gen_op_geneflags();
+            gen_op_svm_check_intercept_param((uint32_t)(type >> 32), (ui=
nt32_t)type);
+            // this is a special case as we do not know if the intercept=
ion occurs
+            // so we assume there was none
+            return 0;
+        case SVM_EXIT_MSR:
+            if(s->intercept & (1ULL << INTERCEPT_MSR_PROT)) {
+                if (s->cc_op !=3D CC_OP_DYNAMIC) {
+                    gen_op_set_cc_op(s->cc_op);
+                    s->cc_op =3D CC_OP_DYNAMIC;
+                }
+                gen_jmp_im(pc_start - s->cs_base);
+                SVM_movq_T1_im(param);
+                gen_op_geneflags();
+                gen_op_svm_check_intercept_param((uint32_t)(type >> 32),=
 (uint32_t)type);
+                // this is a special case as we do not know if the inter=
ception occurs
+                // so we assume there was none
+                return 0;
+            }
+            break;
+        default:
+            if(s->intercept & (1ULL << (type - SVM_EXIT_INTR))) {
+                if (s->cc_op !=3D CC_OP_DYNAMIC) {
+                    gen_op_set_cc_op(s->cc_op);
+		    s->cc_op =3D CC_OP_EFLAGS;
+                }
+                gen_jmp_im(pc_start - s->cs_base);
+                SVM_movq_T1_im(param);
+                gen_op_geneflags();
+                gen_op_svm_vmexit(type >> 32, type);
+                // we can optimize this one so TBs don't get longer than=
 up to vmexit
+                gen_eob(s);
+                return 1;
+            }
+    }
+    return 0;
+}
+
+static inline int gen_svm_check_intercept(DisasContext *s, target_ulong =
pc_start, uint64_t type) {
+    return gen_svm_check_intercept_param(s, pc_start, type, 0);
+}
+
 static inline void gen_stack_update(DisasContext *s, int addend)
 {
 #ifdef TARGET_X86_64
@@ -4880,6 +4959,9 @@ static target_ulong disas_insn(DisasCont
         else
             ot =3D dflag ? OT_LONG : OT_WORD;
         gen_check_io(s, ot, 1, pc_start - s->cs_base);
+        gen_op_mov_TN_reg[OT_WORD][0][R_EDX]();
+        gen_op_andl_T0_ffff();
+        if(gen_svm_check_io(s, pc_start, SVM_IOIO_TYPE_MASK | (1 << (4+o=
t)) | svm_is_rep(prefixes )| 4 | (1 << (7+s->aflag)))) break;
         if (prefixes & (PREFIX_REPZ | PREFIX_REPNZ)) {
             gen_repz_ins(s, ot, pc_start - s->cs_base, s->pc - s->cs_bas=
e);
         } else {
@@ -4893,6 +4975,9 @@ static target_ulong disas_insn(DisasCont
         else
             ot =3D dflag ? OT_LONG : OT_WORD;
         gen_check_io(s, ot, 1, pc_start - s->cs_base);
+        gen_op_mov_TN_reg[OT_WORD][0][R_EDX]();
+        gen_op_andl_T0_ffff();
+        if(gen_svm_check_io(s, pc_start, (1 << (4+ot)) | svm_is_rep(pref=
ixes) | 4 | (1 << (7+s->aflag)))) break;
         if (prefixes & (PREFIX_REPZ | PREFIX_REPNZ)) {
             gen_repz_outs(s, ot, pc_start - s->cs_base, s->pc - s->cs_ba=
se);
         } else {
@@ -4902,6 +4987,7 @@ static target_ulong disas_insn(DisasCont
=20
         /************************/
         /* port I/O */
+
     case 0xe4:
     case 0xe5:
         if ((b & 1) =3D=3D 0)
@@ -4911,6 +4997,7 @@ static target_ulong disas_insn(DisasCont
         val =3D ldub_code(s->pc++);
         gen_op_movl_T0_im(val);
         gen_check_io(s, ot, 0, pc_start - s->cs_base);
+        if(gen_svm_check_io(s, pc_start, SVM_IOIO_TYPE_MASK | svm_is_rep=
(prefixes) | (1 << (4+ot)))) break;
         gen_op_in[ot]();
         gen_op_mov_reg_T1[ot][R_EAX]();
         break;
@@ -4923,6 +5010,7 @@ static target_ulong disas_insn(DisasCont
         val =3D ldub_code(s->pc++);
         gen_op_movl_T0_im(val);
         gen_check_io(s, ot, 0, pc_start - s->cs_base);
+        if(gen_svm_check_io(s, pc_start, svm_is_rep(prefixes) | (1 << (4=
+ot)))) break;
         gen_op_mov_TN_reg[ot][1][R_EAX]();
         gen_op_out[ot]();
         break;
@@ -4935,6 +5023,7 @@ static target_ulong disas_insn(DisasCont
         gen_op_mov_TN_reg[OT_WORD][0][R_EDX]();
         gen_op_andl_T0_ffff();
         gen_check_io(s, ot, 0, pc_start - s->cs_base);
+        if(gen_svm_check_io(s, pc_start, SVM_IOIO_TYPE_MASK | svm_is_rep=
(prefixes) | (1 << (4+ot)))) break;
         gen_op_in[ot]();
         gen_op_mov_reg_T1[ot][R_EAX]();
         break;
@@ -4947,6 +5036,7 @@ static target_ulong disas_insn(DisasCont
         gen_op_mov_TN_reg[OT_WORD][0][R_EDX]();
         gen_op_andl_T0_ffff();
         gen_check_io(s, ot, 0, pc_start - s->cs_base);
+        if(gen_svm_check_io(s, pc_start, svm_is_rep(prefixes) | (1 << (4=
+ot)))) break;
         gen_op_mov_TN_reg[ot][1][R_EAX]();
         gen_op_out[ot]();
         break;
@@ -5004,6 +5094,7 @@ static target_ulong disas_insn(DisasCont
         val =3D 0;
         goto do_lret;
     case 0xcf: /* iret */
+        if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_IRET)) break;
         if (!s->pe) {
             /* real mode */
             gen_op_iret_real(s->dflag);
@@ -5125,6 +5216,7 @@ static target_ulong disas_insn(DisasCont
         /************************/
         /* flags */
     case 0x9c: /* pushf */
+        if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_PUSHF)) break;
         if (s->vm86 && s->iopl !=3D 3) {
             gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
         } else {
@@ -5135,6 +5227,7 @@ static target_ulong disas_insn(DisasCont
         }
         break;
     case 0x9d: /* popf */
+        if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_POPF)) break;
         if (s->vm86 && s->iopl !=3D 3) {
             gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
         } else {
@@ -5344,6 +5437,9 @@ static target_ulong disas_insn(DisasCont
         /* XXX: correct lock test for all insn */
         if (prefixes & PREFIX_LOCK)
             goto illegal_op;
+        if (prefixes & PREFIX_REPZ) {
+            gen_svm_check_intercept(s, pc_start, SVM_EXIT_PAUSE);
+        }
         break;
     case 0x9b: /* fwait */
         if ((s->flags & (HF_MP_MASK | HF_TS_MASK)) =3D=3D=20
@@ -5357,11 +5453,13 @@ static target_ulong disas_insn(DisasCont
         }
         break;
     case 0xcc: /* int3 */
+        if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_SWINT)) break;
         gen_interrupt(s, EXCP03_INT3, pc_start - s->cs_base, s->pc - s->=
cs_base);
         break;
     case 0xcd: /* int N */
         val =3D ldub_code(s->pc++);
-        if (s->vm86 && s->iopl !=3D 3) {
+        if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_SWINT)) break;
+	if (s->vm86 && s->iopl !=3D 3) {
             gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);=20
         } else {
             gen_interrupt(s, val, pc_start - s->cs_base, s->pc - s->cs_b=
ase);
@@ -5370,12 +5468,14 @@ static target_ulong disas_insn(DisasCont
     case 0xce: /* into */
         if (CODE64(s))
             goto illegal_op;
+        if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_SWINT)) break;
         if (s->cc_op !=3D CC_OP_DYNAMIC)
             gen_op_set_cc_op(s->cc_op);
         gen_jmp_im(pc_start - s->cs_base);
         gen_op_into(s->pc - pc_start);
         break;
     case 0xf1: /* icebp (undocumented, exits to external debugger) */
+        if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_ICEBP)) break;
 #if 1
         gen_debug(s, pc_start - s->cs_base);
 #else
@@ -5503,13 +5603,20 @@ static target_ulong disas_insn(DisasCont
         if (s->cpl !=3D 0) {
             gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
         } else {
-            if (b & 2)
+            int retval =3D 0;
+            if (b & 2) {
+                retval =3D gen_svm_check_intercept_param(s, pc_start, SV=
M_EXIT_MSR, 0);
                 gen_op_rdmsr();
-            else
+            } else {
+                retval =3D gen_svm_check_intercept_param(s, pc_start, SV=
M_EXIT_MSR, 1);
                 gen_op_wrmsr();
+            }
+            if(retval)
+                gen_eob(s);
         }
         break;
     case 0x131: /* rdtsc */
+        if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_RDTSC)) break;
         gen_jmp_im(pc_start - s->cs_base);
         gen_op_rdtsc();
         break;
@@ -5572,12 +5679,14 @@ static target_ulong disas_insn(DisasCont
         break;
 #endif
     case 0x1a2: /* cpuid */
+        if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_CPUID)) break;
         gen_op_cpuid();
         break;
     case 0xf4: /* hlt */
         if (s->cpl !=3D 0) {
             gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
         } else {
+            if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_HLT)) break=
;
             if (s->cc_op !=3D CC_OP_DYNAMIC)
                 gen_op_set_cc_op(s->cc_op);
             gen_jmp_im(s->pc - s->cs_base);
@@ -5593,6 +5702,7 @@ static target_ulong disas_insn(DisasCont
         case 0: /* sldt */
             if (!s->pe || s->vm86)
                 goto illegal_op;
+            if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_LDTR_READ))=
 break;
             gen_op_movl_T0_env(offsetof(CPUX86State,ldt.selector));
             ot =3D OT_WORD;
             if (mod =3D=3D 3)
@@ -5605,6 +5715,7 @@ static target_ulong disas_insn(DisasCont
             if (s->cpl !=3D 0) {
                 gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
             } else {
+                if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_LDTR_WR=
ITE)) break;
                 gen_ldst_modrm(s, modrm, OT_WORD, OR_TMP0, 0);
                 gen_jmp_im(pc_start - s->cs_base);
                 gen_op_lldt_T0();
@@ -5613,6 +5724,7 @@ static target_ulong disas_insn(DisasCont
         case 1: /* str */
             if (!s->pe || s->vm86)
                 goto illegal_op;
+            if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_TR_READ)) b=
reak;
             gen_op_movl_T0_env(offsetof(CPUX86State,tr.selector));
             ot =3D OT_WORD;
             if (mod =3D=3D 3)
@@ -5625,6 +5737,7 @@ static target_ulong disas_insn(DisasCont
             if (s->cpl !=3D 0) {
                 gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
             } else {
+                if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_TR_WRIT=
E)) break;
                 gen_ldst_modrm(s, modrm, OT_WORD, OR_TMP0, 0);
                 gen_jmp_im(pc_start - s->cs_base);
                 gen_op_ltr_T0();
@@ -5656,6 +5769,7 @@ static target_ulong disas_insn(DisasCont
         case 0: /* sgdt */
             if (mod =3D=3D 3)
                 goto illegal_op;
+            if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_GDTR_READ))=
 break;
             gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
             gen_op_movl_T0_env(offsetof(CPUX86State, gdt.limit));
             gen_op_st_T0_A0[OT_WORD + s->mem_index]();
@@ -5672,6 +5786,7 @@ static target_ulong disas_insn(DisasCont
                     if (!(s->cpuid_ext_features & CPUID_EXT_MONITOR) ||
                         s->cpl !=3D 0)
                         goto illegal_op;
+                    if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_MON=
ITOR)) break;
                     gen_jmp_im(pc_start - s->cs_base);
 #ifdef TARGET_X86_64
                     if (s->aflag =3D=3D 2) {
@@ -5696,6 +5811,7 @@ static target_ulong disas_insn(DisasCont
                         gen_op_set_cc_op(s->cc_op);
                         s->cc_op =3D CC_OP_DYNAMIC;
                     }
+                    if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_MWA=
IT)) break;
                     gen_jmp_im(s->pc - s->cs_base);
                     gen_op_mwait();
                     gen_eob(s);
@@ -5704,6 +5820,7 @@ static target_ulong disas_insn(DisasCont
                     goto illegal_op;
                 }
             } else { /* sidt */
+                if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_IDTR_RE=
AD)) break;
                 gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
                 gen_op_movl_T0_env(offsetof(CPUX86State, idt.limit));
                 gen_op_st_T0_A0[OT_WORD + s->mem_index]();
@@ -5716,11 +5833,53 @@ static target_ulong disas_insn(DisasCont
             break;
         case 2: /* lgdt */
         case 3: /* lidt */
-            if (mod =3D=3D 3)
-                goto illegal_op;
-            if (s->cpl !=3D 0) {
+            if (mod =3D=3D 3) {
+                switch(rm) {
+                case 0: /* VMRUN */
+                    if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_VMR=
UN)) break;
+                    if (s->cc_op !=3D CC_OP_DYNAMIC)
+                        gen_op_set_cc_op(s->cc_op);
+                    gen_jmp_im(s->pc - s->cs_base);
+                    gen_op_vmrun();
+                    s->cc_op =3D CC_OP_EFLAGS;
+                    gen_eob(s);
+                    break;
+                case 1: /* VMMCALL */
+                    if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_VMM=
CALL)) break;
+                    // FIXME: cause #UD if hflags & SVM
+                    gen_op_vmmcall();
+                    break;
+                case 2: /* VMLOAD */
+                    if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_VML=
OAD)) break;
+                    gen_op_vmload();
+                    break;
+                case 3: /* VMSAVE */
+                    if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_VMS=
AVE)) break;
+                    gen_op_vmsave();
+                    break;
+                case 4: /* STGI */
+                    if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_STG=
I)) break;
+                    gen_op_stgi();
+                    break;
+                case 5: /* CLGI */
+                    if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_CLG=
I)) break;
+                    gen_op_clgi();
+                    break;
+                case 6: /* SKINIT */
+                    if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_SKI=
NIT)) break;
+                    gen_op_skinit();
+                    break;
+                case 7: /* INVLPGA */
+                    if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_INV=
LPGA)) break;
+                    gen_op_invlpga();
+                    break;
+                default:
+                    goto illegal_op;
+                }
+            } else if (s->cpl !=3D 0) {
                 gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
             } else {
+                if(gen_svm_check_intercept(s, pc_start, op=3D=3D2 ? SVM_=
EXIT_GDTR_WRITE : SVM_EXIT_IDTR_WRITE)) break;
                 gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
                 gen_op_ld_T1_A0[OT_WORD + s->mem_index]();
                 gen_add_A0_im(s, 2);
@@ -5737,6 +5896,7 @@ static target_ulong disas_insn(DisasCont
             }
             break;
         case 4: /* smsw */
+            if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_READ_CR0)) =
break;
             gen_op_movl_T0_env(offsetof(CPUX86State,cr[0]));
             gen_ldst_modrm(s, modrm, OT_WORD, OR_TMP0, 1);
             break;
@@ -5744,6 +5904,7 @@ static target_ulong disas_insn(DisasCont
             if (s->cpl !=3D 0) {
                 gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
             } else {
+                if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_WRITE_C=
R0)) break;
                 gen_ldst_modrm(s, modrm, OT_WORD, OR_TMP0, 0);
                 gen_op_lmsw_T0();
                 gen_jmp_im(s->pc - s->cs_base);
@@ -5768,6 +5929,7 @@ static target_ulong disas_insn(DisasCont
                         goto illegal_op;
                     }
                 } else {
+                    if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_INV=
LPG)) break;
                     gen_lea_modrm(s, modrm, &reg_addr, &offset_addr);
                     gen_op_invlpg_A0();
                     gen_jmp_im(s->pc - s->cs_base);
@@ -5784,6 +5946,7 @@ static target_ulong disas_insn(DisasCont
         if (s->cpl !=3D 0) {
             gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
         } else {
+            if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_INVD)) brea=
k;
             /* nothing to do */
         }
         break;
@@ -5904,17 +6067,20 @@ static target_ulong disas_insn(DisasCont
             case 4:
             case 8:
                 if (b & 2) {
+                    gen_svm_check_intercept(s, pc_start, SVM_EXIT_WRITE_=
CR0 + reg);
                     gen_op_mov_TN_reg[ot][0][rm]();
                     gen_op_movl_crN_T0(reg);
                     gen_jmp_im(s->pc - s->cs_base);
                     gen_eob(s);
                 } else {
+                    gen_svm_check_intercept(s, pc_start, SVM_EXIT_READ_C=
R0 + reg);
 #if !defined(CONFIG_USER_ONLY)=20
                     if (reg =3D=3D 8)
                         gen_op_movtl_T0_cr8();
-                    else
+                    else {
 #endif
                         gen_op_movtl_T0_env(offsetof(CPUX86State,cr[reg]=
));
+                    }
                     gen_op_mov_reg_T0[ot][rm]();
                 }
                 break;
@@ -5941,11 +6107,13 @@ static target_ulong disas_insn(DisasCont
             if (reg =3D=3D 4 || reg =3D=3D 5 || reg >=3D 8)
                 goto illegal_op;
             if (b & 2) {
+                gen_svm_check_intercept(s, pc_start, SVM_EXIT_WRITE_DR0 =
+ reg);
                 gen_op_mov_TN_reg[ot][0][rm]();
                 gen_op_movl_drN_T0(reg);
                 gen_jmp_im(s->pc - s->cs_base);
                 gen_eob(s);
             } else {
+                gen_svm_check_intercept(s, pc_start, SVM_EXIT_READ_DR0 +=
 reg);
                 gen_op_movtl_T0_env(offsetof(CPUX86State,dr[reg]));
                 gen_op_mov_reg_T0[ot][rm]();
             }
@@ -5955,6 +6123,7 @@ static target_ulong disas_insn(DisasCont
         if (s->cpl !=3D 0) {
             gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
         } else {
+            gen_svm_check_intercept(s, pc_start, SVM_EXIT_WRITE_CR0);
             gen_op_clts();
             /* abort block because static cpu state changed */
             gen_jmp_im(s->pc - s->cs_base);
@@ -6046,6 +6215,7 @@ static target_ulong disas_insn(DisasCont
         /* ignore for now */
         break;
     case 0x1aa: /* rsm */
+        if(gen_svm_check_intercept(s, pc_start, SVM_EXIT_RSM)) break;
         if (!(s->flags & HF_SMM_MASK))
             goto illegal_op;
         if (s->cc_op !=3D CC_OP_DYNAMIC) {
@@ -6480,6 +6650,7 @@ static inline int gen_intermediate_code_
     dc->singlestep_enabled =3D env->singlestep_enabled;
     dc->cc_op =3D CC_OP_DYNAMIC;
     dc->cs_base =3D cs_base;
+    dc->intercept =3D tb->intercept;
     dc->tb =3D tb;
     dc->popl_esp_hack =3D 0;
     /* select memory access functions */
Index: qemu/target-i386/cpu.h
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
--- qemu.orig/target-i386/cpu.h
+++ qemu/target-i386/cpu.h
@@ -46,6 +46,8 @@
=20
 #include "softfloat.h"
=20
+#include "svm.h"
+
 #if defined(__i386__) && !defined(CONFIG_SOFTMMU) && !defined(__APPLE__)
 #define USE_CODE_COPY
 #endif
@@ -84,6 +86,7 @@
 #define DESC_AVL_MASK   (1 << 20)
 #define DESC_P_MASK     (1 << 15)
 #define DESC_DPL_SHIFT  13
+#define DESC_DPL_MASK   (1 << DESC_DPL_SHIFT)
 #define DESC_S_MASK     (1 << 12)
 #define DESC_TYPE_SHIFT 8
 #define DESC_A_MASK     (1 << 8)
@@ -149,6 +152,8 @@
 #define HF_VM_SHIFT         17 /* must be same as eflags */
 #define HF_HALTED_SHIFT     18 /* CPU halted */
 #define HF_SMM_SHIFT        19 /* CPU in SMM mode */
+#define HF_GIF_SHIFT        20 /* if set CPU takes interrupts */
+#define HF_HIF_SHIFT        21 /* shadow copy of IF_MASK when in SVM */
=20
 #define HF_CPL_MASK          (3 << HF_CPL_SHIFT)
 #define HF_SOFTMMU_MASK      (1 << HF_SOFTMMU_SHIFT)
@@ -166,6 +171,8 @@
 #define HF_OSFXSR_MASK       (1 << HF_OSFXSR_SHIFT)
 #define HF_HALTED_MASK       (1 << HF_HALTED_SHIFT)
 #define HF_SMM_MASK          (1 << HF_SMM_SHIFT)
+#define HF_GIF_MASK          (1 << HF_GIF_SHIFT)
+#define HF_HIF_MASK          (1 << HF_HIF_SHIFT)
=20
 #define CR0_PE_MASK  (1 << 0)
 #define CR0_MP_MASK  (1 << 1)
@@ -249,6 +256,8 @@
 #define MSR_GSBASE                      0xc0000101
 #define MSR_KERNELGSBASE                0xc0000102
=20
+#define MSR_VM_HSAVE_PA                 0xc0010117
+
 /* cpuid_features bits */
 #define CPUID_FP87 (1 << 0)
 #define CPUID_VME  (1 << 1)
@@ -283,6 +292,8 @@
 #define CPUID_EXT2_FFXSR   (1 << 25)
 #define CPUID_EXT2_LM      (1 << 29)
=20
+#define CPUID_EXT3_SVM     (1 << 2)
+
 #define EXCP00_DIVZ	0
 #define EXCP01_SSTP	1
 #define EXCP02_NMI	2
@@ -489,6 +500,16 @@ typedef struct CPUX86State {
     uint32_t sysenter_eip;
     uint64_t efer;
     uint64_t star;
+
+    target_phys_addr_t vm_hsave;
+    target_phys_addr_t vm_vmcb;
+    uint64_t intercept;
+    uint16_t intercept_cr_read;
+    uint16_t intercept_cr_write;
+    uint16_t intercept_dr_read;
+    uint16_t intercept_dr_write;
+    uint32_t intercept_exceptions;
+
 #ifdef TARGET_X86_64
     target_ulong lstar;
     target_ulong cstar;
Index: qemu/target-i386/op.c
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
--- qemu.orig/target-i386/op.c
+++ qemu/target-i386/op.c
@@ -1243,6 +1243,38 @@ void OPPROTO op_movl_crN_T0(void)
     helper_movl_crN_T0(PARAM1);
 }
=20
+// these pseudo-opcodes check for SVM intercepts
+void OPPROTO op_svm_check_intercept(void)
+{
+    svm_check_intercept(PARAMQ1);
+}
+
+void OPPROTO op_svm_check_intercept_param(void)
+{
+    svm_check_intercept_param(PARAMQ1, T1);
+}
+
+void OPPROTO op_svm_vmexit(void)
+{
+    vmexit(PARAMQ1, T1);
+}
+
+void OPPROTO op_geneflags(void)
+{
+    CC_SRC =3D cc_table[CC_OP].compute_all();
+}
+
+// this pseudo-opcode checks for IO intercepts
+void OPPROTO op_svm_check_intercept_io(void)
+{
+    // PARAM1 =3D TYPE (0 =3D OUT, 1 =3D IN; 4 =3D STRING; 8 =3D REP)
+    // T0     =3D PORT
+    // T1     =3D next eip
+    stq_phys(env->vm_vmcb + offsetof(struct vmcb, control.exit_info_2), =
T1);
+    // ASIZE does not appear on real hw
+    svm_check_intercept_param(SVM_EXIT_IOIO, (PARAMQ1 & ~SVM_IOIO_ASIZE_=
MASK) | ((T0 & 0xffff) << 16));
+}
+
 #if !defined(CONFIG_USER_ONLY)=20
 void OPPROTO op_movtl_T0_cr8(void)
 {
@@ -2447,3 +2479,45 @@ void OPPROTO op_emms(void)
=20
 #define SHIFT 1
 #include "ops_sse.h"
+
+/* Secure Virtual Machine ops */
+
+void OPPROTO op_vmrun(void)
+{
+    helper_vmrun(EAX);
+}
+
+void OPPROTO op_vmmcall(void)
+{
+    helper_vmmcall();
+}
+
+void OPPROTO op_vmload(void)
+{
+    helper_vmload(EAX);
+}
+
+void OPPROTO op_vmsave(void)
+{
+    helper_vmsave(EAX);
+}
+
+void OPPROTO op_stgi(void)
+{
+    helper_stgi();
+}
+
+void OPPROTO op_clgi(void)
+{
+    helper_clgi();
+}
+
+void OPPROTO op_skinit(void)
+{
+    helper_skinit();
+}
+
+void OPPROTO op_invlpga(void)
+{
+    helper_invlpga();
+}
Index: qemu/target-i386/helper.c
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
--- qemu.orig/target-i386/helper.c
+++ qemu/target-i386/helper.c
@@ -594,7 +594,18 @@ static void do_interrupt_protected(int i
     int has_error_code, new_stack, shift;
     uint32_t e1, e2, offset, ss, esp, ss_e1, ss_e2;
     uint32_t old_eip, sp_mask;
+    int svm_should_check =3D 1;
=20
+    if((env->intercept & INTERCEPT_SVM_MASK) && !is_int && next_eip=3D=3D=
-1) {
+        next_eip =3D EIP;
+        svm_should_check =3D 0;
+    }
+   =20
+    if(svm_should_check
+        && (INTERCEPTEDl(_exceptions, 1 << intno)
+        && !is_int)) {
+        raise_interrupt(intno, is_int, error_code, 0);
+    }=20
     has_error_code =3D 0;
     if (!is_int && !is_hw) {
         switch(intno) {
@@ -830,7 +841,17 @@ static void do_interrupt64(int intno, in
     int has_error_code, new_stack;
     uint32_t e1, e2, e3, ss;
     target_ulong old_eip, esp, offset;
+    int svm_should_check =3D 1;
=20
+    if((env->intercept & INTERCEPT_SVM_MASK) && !is_int && next_eip=3D=3D=
-1) {
+        next_eip =3D EIP;
+        svm_should_check =3D 0;
+    }
+    if(svm_should_check
+        && INTERCEPTEDl(_exceptions, 1 << intno)
+        && !is_int) {
+        raise_interrupt(intno, is_int, error_code, 0);
+    }
     has_error_code =3D 0;
     if (!is_int && !is_hw) {
         switch(intno) {
@@ -1077,7 +1098,17 @@ static void do_interrupt_real(int intno,
     int selector;
     uint32_t offset, esp;
     uint32_t old_cs, old_eip;
+    int svm_should_check =3D 1;
=20
+    if((env->intercept & INTERCEPT_SVM_MASK) && !is_int && next_eip=3D=3D=
-1) {
+        next_eip =3D EIP;
+        svm_should_check =3D 0;
+    }
+    if(svm_should_check
+        && INTERCEPTEDl(_exceptions, 1 << intno)
+        && !is_int) {
+        raise_interrupt(intno, is_int, error_code, 0);
+    }
     /* real mode (simpler !) */
     dt =3D &env->idt;
     if (intno * 4 + 3 > dt->limit)
@@ -1227,13 +1258,16 @@ int check_exception(int intno, int *erro
 void raise_interrupt(int intno, int is_int, int error_code,=20
                      int next_eip_addend)
 {
-    if (!is_int)
+    if (!is_int) {
+        svm_check_intercept_param(SVM_EXIT_EXCP_BASE + intno, error_code=
);
         intno =3D check_exception(intno, &error_code);
+    }
=20
     env->exception_index =3D intno;
     env->error_code =3D error_code;
     env->exception_is_int =3D is_int;
     env->exception_next_eip =3D env->eip + next_eip_addend;
+   =20
     cpu_loop_exit();
 }
=20
@@ -1665,7 +1699,7 @@ void helper_cpuid(void)
     case 0x80000001:
         EAX =3D env->cpuid_features;
         EBX =3D 0;
-        ECX =3D 0;
+        ECX =3D env->cpuid_ext3_features;
         EDX =3D env->cpuid_ext2_features;
         break;
     case 0x80000002:
@@ -2739,6 +2773,9 @@ void helper_wrmsr(void)
     case MSR_PAT:
         env->pat =3D val;
         break;
+    case MSR_VM_HSAVE_PA:
+        env->vm_hsave =3D val;
+        break;
 #ifdef TARGET_X86_64
     case MSR_LSTAR:
         env->lstar =3D val;
@@ -2790,6 +2827,9 @@ void helper_rdmsr(void)
     case MSR_PAT:
         val =3D env->pat;
         break;
+    case MSR_VM_HSAVE_PA:
+        val =3D env->vm_hsave;
+        break;
 #ifdef TARGET_X86_64
     case MSR_LSTAR:
         val =3D env->lstar;
@@ -3871,3 +3911,433 @@ void tlb_fill(target_ulong addr, int is_
     }
     env =3D saved_env;
 }
+
+
+/* Secure Virtual Machine helpers */
+
+static inline uint32_t vmcb2cpu_attrib(uint16_t vmcb_attrib, uint32_t vm=
cb_base, uint32_t vmcb_limit) {
+    return    ((vmcb_attrib & 0x00ff) << 8)          // Type, S, DPL, P
+	    | ((vmcb_attrib & 0x0f00) << 12)         // AVL, L, DB, G
+	    | ((vmcb_base >> 16) & 0xff)             // Base 23-16
+	    | (vmcb_base & 0xff000000)               // Base 31-24
+	    | (vmcb_limit & 0xf0000);                // Limit 19-16
+}
+
+static inline uint16_t cpu2vmcb_attrib(uint32_t cpu_attrib) {
+    return    ((cpu_attrib >> 8) & 0xff)             // Type, S, DPL, P
+	    | ((cpu_attrib & 0xf00000) >> 12);       // AVL, L, DB, G
+}
+
+extern uint8_t *phys_ram_base;
+void helper_vmrun(target_ulong addr)
+{
+    uint32_t event_inj;
+    uint32_t int_ctl;
+
+    if (loglevel & CPU_LOG_TB_IN_ASM) fprintf(logfile,"vmrun! %#lx\n", a=
ddr);=20
+
+    env->vm_vmcb =3D addr;
+    regs_to_env();
+
+    // save the current CPU state in the hsave page
+    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.gdtr.base), env-=
>gdt.base);
+    stl_phys(env->vm_hsave + offsetof(struct vmcb, save.gdtr.limit), env=
->gdt.limit);
+
+    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.idtr.base), env-=
>idt.base);
+    stl_phys(env->vm_hsave + offsetof(struct vmcb, save.idtr.limit), env=
->idt.limit);
+
+    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.cr0), env->cr[0]=
);
+    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.cr2), env->cr[2]=
);
+    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.cr3), env->cr[3]=
);
+    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.cr4), env->cr[4]=
);
+    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.cr8), env->cr[8]=
);
+    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.dr6), env->dr[6]=
);
+    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.dr7), env->dr[7]=
);
+
+    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.efer), env->efer=
);
+    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.rflags), compute=
_eflags());
+
+    SVM_SAVE_SEG(env->vm_hsave, segs[R_ES], es);
+    SVM_SAVE_SEG(env->vm_hsave, segs[R_CS], cs);
+    SVM_SAVE_SEG(env->vm_hsave, segs[R_SS], ss);
+    SVM_SAVE_SEG(env->vm_hsave, segs[R_DS], ds);
+
+    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.rip), EIP);
+    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.rsp), ESP);
+    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.rax), EAX);
+
+    // load the interception bitmaps so we do not need to access the vmc=
b in svm mode
+    env->intercept            =3D ldq_phys(env->vm_vmcb + offsetof(struc=
t vmcb, control.intercept)) | INTERCEPT_SVM_MASK;
+    env->intercept_cr_read    =3D lduw_phys(env->vm_vmcb + offsetof(stru=
ct vmcb, control.intercept_cr_read));
+    env->intercept_cr_write   =3D lduw_phys(env->vm_vmcb + offsetof(stru=
ct vmcb, control.intercept_cr_write));
+    env->intercept_dr_read    =3D lduw_phys(env->vm_vmcb + offsetof(stru=
ct vmcb, control.intercept_dr_read));
+    env->intercept_dr_write   =3D lduw_phys(env->vm_vmcb + offsetof(stru=
ct vmcb, control.intercept_dr_write));
+    env->intercept_exceptions =3D ldl_phys(env->vm_vmcb + offsetof(struc=
t vmcb, control.intercept_exceptions));
+
+    env->gdt.base  =3D ldq_phys(env->vm_vmcb + offsetof(struct vmcb, sav=
e.gdtr.base));
+    env->gdt.limit =3D ldl_phys(env->vm_vmcb + offsetof(struct vmcb, sav=
e.gdtr.limit));
+
+    env->idt.base  =3D ldq_phys(env->vm_vmcb + offsetof(struct vmcb, sav=
e.idtr.base));
+    env->idt.limit =3D ldl_phys(env->vm_vmcb + offsetof(struct vmcb, sav=
e.idtr.limit));
+
+    // clear exit_info_2 so we behave like the real hardware
+    stq_phys(env->vm_vmcb + offsetof(struct vmcb, control.exit_info_2), =
0);
+
+    cpu_x86_update_cr0(env, ldq_phys(env->vm_vmcb + offsetof(struct vmcb=
, save.cr0)));
+    cpu_x86_update_cr4(env, ldq_phys(env->vm_vmcb + offsetof(struct vmcb=
, save.cr4)));
+    cpu_x86_update_cr3(env, ldq_phys(env->vm_vmcb + offsetof(struct vmcb=
, save.cr3)));
+    env->cr[2] =3D ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.cr=
2));
+    int_ctl =3D ldl_phys(env->vm_vmcb + offsetof(struct vmcb, control.in=
t_ctl));
+    if(int_ctl & V_INTR_MASKING_MASK) {
+        env->cr[8] =3D int_ctl & V_TPR_MASK;
+        if(env->eflags & IF_MASK) env->hflags |=3D HF_HIF_MASK;
+    }
+
+#ifdef TARGET_X86_64
+    env->efer =3D ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.efe=
r));
+    env->hflags &=3D ~HF_LMA_MASK;
+    if (env->efer & MSR_EFER_LMA)
+       env->hflags |=3D HF_LMA_MASK;
+#endif
+    env->eflags =3D 0;
+    load_eflags(ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rflag=
s)), ~(CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C | DF_MASK));
+    CC_OP =3D CC_OP_EFLAGS;
+    CC_DST =3D 0xffffffff;
+
+    SVM_LOAD_SEG(env->vm_vmcb, ES, es);
+    SVM_LOAD_SEG(env->vm_vmcb, CS, cs);
+    SVM_LOAD_SEG(env->vm_vmcb, SS, ss);
+    SVM_LOAD_SEG(env->vm_vmcb, DS, ds);
+
+    EIP =3D ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rip));
+    env->eip =3D EIP;
+    ESP =3D ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rsp));
+    EAX =3D ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rax));
+    env->dr[7] =3D ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.dr=
7));
+    env->dr[6] =3D ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.dr=
6));
+    cpu_x86_set_cpl(env, ldub_phys(env->vm_vmcb + offsetof(struct vmcb, =
save.cpl)));
+
+    // FIXME: guest state consistency checks
+
+    switch(ldub_phys(env->vm_vmcb + offsetof(struct vmcb, control.tlb_ct=
l))) {
+        case TLB_CONTROL_DO_NOTHING:
+            break;
+        case TLB_CONTROL_FLUSH_ALL_ASID:
+            // FIXME: this is not 100% correct but should work for now
+            tlb_flush(env, 1);
+        break;
+    }
+
+    helper_stgi();
+
+    regs_to_env();
+
+    // maybe we need to inject an event
+    event_inj =3D ldl_phys(env->vm_vmcb + offsetof(struct vmcb, control.=
event_inj));
+    if(event_inj & SVM_EVTINJ_VALID) {
+        uint8_t vector =3D event_inj & SVM_EVTINJ_VEC_MASK;
+        uint16_t valid_err =3D event_inj & SVM_EVTINJ_VALID_ERR;
+        uint32_t event_inj_err =3D ldl_phys(env->vm_vmcb + offsetof(stru=
ct vmcb, control.event_inj_err));
+        stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.event_inj)=
, event_inj & ~SVM_EVTINJ_VALID);
+       =20
+        if (loglevel & CPU_LOG_TB_IN_ASM) fprintf(logfile, "Injecting(%#=
hx): ", valid_err);
+        // FIXME: need to implement valid_err
+        switch(event_inj & SVM_EVTINJ_TYPE_MASK) {
+                case SVM_EVTINJ_TYPE_INTR:
+                        env->exception_index =3D vector;
+                        env->error_code =3D event_inj_err;
+                        env->exception_is_int =3D 1;
+                        env->exception_next_eip =3D -1;
+                        if (loglevel & CPU_LOG_TB_IN_ASM) fprintf(logfil=
e, "INTR");
+                        break;
+                case SVM_EVTINJ_TYPE_NMI:
+                        env->exception_index =3D vector;
+                        env->error_code =3D event_inj_err;
+                        env->exception_is_int =3D 1;
+                        env->exception_next_eip =3D EIP;
+                        if (loglevel & CPU_LOG_TB_IN_ASM) fprintf(logfil=
e, "NMI");
+                        break;
+                case SVM_EVTINJ_TYPE_EXEPT:
+                        env->exception_index =3D vector;
+                        env->error_code =3D event_inj_err;
+                        env->exception_is_int =3D 0;
+                        env->exception_next_eip =3D -1;
+                        if (loglevel & CPU_LOG_TB_IN_ASM) fprintf(logfil=
e, "EXEPT");
+                        break;
+                case SVM_EVTINJ_TYPE_SOFT:
+                        env->exception_index =3D vector;
+                        env->error_code =3D event_inj_err;
+                        env->exception_is_int =3D 1;
+                        env->exception_next_eip =3D EIP;
+                        if (loglevel & CPU_LOG_TB_IN_ASM) fprintf(logfil=
e, "SOFT");
+                        break;
+        }
+        if (loglevel & CPU_LOG_TB_IN_ASM) fprintf(logfile, " %#x %#x\n",=
 env->exception_index, env->error_code);
+    }
+    if (int_ctl & V_IRQ_MASK)
+        env->interrupt_request |=3D CPU_INTERRUPT_VIRQ;
+
+    cpu_loop_exit();
+}
+
+void helper_vmmcall()
+{
+    if (loglevel & CPU_LOG_TB_IN_ASM) fprintf(logfile,"vmmcall!\n");
+}
+
+void helper_vmload(target_ulong addr)
+{
+    if (loglevel & CPU_LOG_TB_IN_ASM) fprintf(logfile,"vmload! %#lx\nFS:=
 %#lx | %#lx\n", addr, ldq_phys(addr + offsetof(struct vmcb, save.fs.base=
)), env->segs[R_FS].base);=20
+
+    SVM_LOAD_SEG2(addr, segs[R_FS], fs);
+    SVM_LOAD_SEG2(addr, segs[R_GS], gs);
+    SVM_LOAD_SEG2(addr, tr, tr);
+    SVM_LOAD_SEG2(addr, ldt, ldtr);
+
+#ifdef TARGET_X86_64
+    env->kernelgsbase =3D ldq_phys(addr + offsetof(struct vmcb, save.ker=
nel_gs_base));
+    env->lstar =3D ldq_phys(addr + offsetof(struct vmcb, save.lstar));
+    env->cstar =3D ldq_phys(addr + offsetof(struct vmcb, save.cstar));
+    env->fmask =3D ldq_phys(addr + offsetof(struct vmcb, save.sfmask));
+#endif
+    env->star =3D ldq_phys(addr + offsetof(struct vmcb, save.star));
+    env->sysenter_cs =3D ldq_phys(addr + offsetof(struct vmcb, save.syse=
nter_cs));
+    env->sysenter_esp =3D ldq_phys(addr + offsetof(struct vmcb, save.sys=
enter_esp));
+    env->sysenter_eip =3D ldq_phys(addr + offsetof(struct vmcb, save.sys=
enter_eip));
+}
+
+void helper_vmsave(target_ulong addr)
+{
+    if (loglevel & CPU_LOG_TB_IN_ASM) fprintf(logfile,"vmsave! %#lx\nFS:=
 %#lx | %#lx\n", addr, ldq_phys(addr + offsetof(struct vmcb, save.fs.base=
)), env->segs[R_FS].base);=20
+
+    SVM_SAVE_SEG(addr, segs[R_FS], fs);
+    SVM_SAVE_SEG(addr, segs[R_GS], gs);
+    SVM_SAVE_SEG(addr, tr, tr);
+    SVM_SAVE_SEG(addr, ldt, ldtr);
+
+#ifdef TARGET_X86_64
+    stq_phys(addr + offsetof(struct vmcb, save.kernel_gs_base), env->ker=
nelgsbase);
+    stq_phys(addr + offsetof(struct vmcb, save.lstar), env->lstar);
+    stq_phys(addr + offsetof(struct vmcb, save.cstar), env->cstar);
+    stq_phys(addr + offsetof(struct vmcb, save.sfmask), env->fmask);
+#endif
+    stq_phys(addr + offsetof(struct vmcb, save.star), env->star);
+    stq_phys(addr + offsetof(struct vmcb, save.sysenter_cs), env->sysent=
er_cs);
+    stq_phys(addr + offsetof(struct vmcb, save.sysenter_esp), env->sysen=
ter_esp);
+    stq_phys(addr + offsetof(struct vmcb, save.sysenter_eip), env->sysen=
ter_eip);
+}
+
+void helper_stgi()
+{
+    env->hflags |=3D HF_GIF_MASK;
+}
+
+void helper_clgi()
+{
+    env->hflags &=3D ~HF_GIF_MASK;
+}
+
+void helper_skinit()
+{
+    if (loglevel & CPU_LOG_TB_IN_ASM) fprintf(logfile,"skinit!\n");
+}
+
+void helper_invlpga()
+{
+    tlb_flush(env, 0);
+}
+
+int svm_check_intercept_param(uint32_t type, uint64_t param) {
+    switch(type) {
+        case SVM_EXIT_READ_CR0 ... SVM_EXIT_READ_CR0 + 8:
+            if (INTERCEPTEDw(_cr_read, (1 << (type - SVM_EXIT_READ_CR0))=
)) {
+                vmexit(type, param);
+                return 1;
+            }
+            break;
+        case SVM_EXIT_READ_DR0 ... SVM_EXIT_READ_DR0 + 8:
+            if (INTERCEPTEDw(_dr_read, (1 << (type - SVM_EXIT_READ_DR0))=
)) {
+                vmexit(type, param);
+                return 1;
+            }
+            break;
+        case SVM_EXIT_WRITE_CR0 ... SVM_EXIT_WRITE_CR0 + 8:
+            if (INTERCEPTEDw(_cr_write, (1 << (type - SVM_EXIT_WRITE_CR0=
)))) {
+                vmexit(type, param);
+                return 1;
+            }
+            break;
+        case SVM_EXIT_WRITE_DR0 ... SVM_EXIT_WRITE_DR0 + 8:
+            if (INTERCEPTEDw(_dr_write, (1 << (type - SVM_EXIT_WRITE_DR0=
)))) {
+                vmexit(type, param);
+                return 1;
+            }
+            break;
+        case SVM_EXIT_EXCP_BASE ... SVM_EXIT_EXCP_BASE + 16:
+            if (INTERCEPTEDl(_exceptions, (1 << (type - SVM_EXIT_EXCP_BA=
SE)))) {
+                vmexit(type, param);
+                return 1;
+            }
+            break;
+        case SVM_EXIT_IOIO:
+            if (INTERCEPTED(INTERCEPT_IOIO_PROT)) {
+                // FIXME: this should be read in at vmrun (faster this w=
ay?)
+                uint64_t addr =3D ldq_phys(env->vm_vmcb + offsetof(struc=
t vmcb, control.iopm_base_pa));
+                uint16_t port =3D (uint16_t) (param >> 16);
+               =20
+                if(ldub_phys(addr + port / 8) & (1 << (port % 8)))
+                    vmexit(type, param);
+            }
+            break;
+
+        case SVM_EXIT_MSR:
+            if (INTERCEPTED(1L << INTERCEPT_MSR_PROT)) {
+                // FIXME: this should be read in at vmrun (faster this w=
ay?)
+                uint64_t addr =3D ldq_phys(env->vm_vmcb + offsetof(struc=
t vmcb, control.msrpm_base_pa));
+                switch((uint32_t)ECX) {
+                    case 0 ... 0x1fff:
+                        T0 =3D (ECX * 2) % 8;
+                        T1 =3D ECX / 8;
+                        break;
+                    case 0xc0000000 ... 0xc0001fff:
+                        T0 =3D (8192 + ECX - 0xc0000000) * 2;
+                        T1 =3D (T0 / 8);
+                        T0 %=3D 8;
+                        break;
+                    case 0xc0010000 ... 0xc0011fff:
+                        T0 =3D (16384 + ECX - 0xc0010000) * 2;
+                        T1 =3D (T0 / 8);
+                        T0 %=3D 8;
+                        break;
+                    default:
+                        vmexit(type, param);
+                        return 1;
+                }
+                if (ldub_phys(addr + T1) & ((1 << param) << T0))
+                    vmexit(type, param);
+                return 1;
+            }
+            break;
+        default:
+            if (INTERCEPTED((1 << (type - SVM_EXIT_INTR)))) {
+                vmexit(type, param);
+                return 1;
+            }
+            break;
+    }
+    return 0;
+}
+
+void vmexit(uint64_t exit_code, uint64_t exit_info_1)
+{
+    uint32_t int_ctl;
+
+    if (loglevel & CPU_LOG_TB_IN_ASM) fprintf(logfile,"vmexit(%#lx, %#lx=
, %#lx, %#lx)!\n", exit_code, exit_info_1, ldq_phys(env->vm_vmcb + offset=
of(struct vmcb, control.exit_info_2)), EIP);
+
+// Save the VM state in the vmcb
+    SVM_SAVE_SEG(env->vm_vmcb, segs[R_ES], es);
+    SVM_SAVE_SEG(env->vm_vmcb, segs[R_CS], cs);
+    SVM_SAVE_SEG(env->vm_vmcb, segs[R_SS], ss);
+    SVM_SAVE_SEG(env->vm_vmcb, segs[R_DS], ds);
+
+    stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.gdtr.base), env->=
gdt.base);
+    stl_phys(env->vm_vmcb + offsetof(struct vmcb, save.gdtr.limit), env-=
>gdt.limit);
+
+    stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.idtr.base), env->=
idt.base);
+    stl_phys(env->vm_vmcb + offsetof(struct vmcb, save.idtr.limit), env-=
>idt.limit);
+
+    stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.efer), env->efer)=
;
+    stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.cr0), env->cr[0])=
;
+    stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.cr2), env->cr[2])=
;
+    stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.cr3), env->cr[3])=
;
+    stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.cr4), env->cr[4])=
;
+
+    if((int_ctl =3D ldl_phys(env->vm_vmcb + offsetof(struct vmcb, contro=
l.int_ctl))) & V_INTR_MASKING_MASK) {
+        int_ctl &=3D ~V_TPR_MASK;
+        int_ctl |=3D env->cr[8] & V_TPR_MASK;
+        stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.int_ctl), =
int_ctl);
+    }
+
+    stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rflags), compute_=
eflags());
+    stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rip), env->eip);
+    stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rsp), ESP);
+    stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rax), EAX);
+    stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.dr7), env->dr[7])=
;
+    stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.dr6), env->dr[6])=
;
+    stb_phys(env->vm_vmcb + offsetof(struct vmcb, save.cpl), env->hflags=
 & HF_CPL_MASK);
+
+// Reload the host state from vm_hsave
+    env->hflags &=3D ~HF_HIF_MASK;
+    env->intercept =3D 0;
+    env->intercept_exceptions =3D 0;
+    env->interrupt_request &=3D ~CPU_INTERRUPT_VIRQ;
+
+    env->gdt.base  =3D ldq_phys(env->vm_hsave + offsetof(struct vmcb, sa=
ve.gdtr.base));
+    env->gdt.limit =3D ldl_phys(env->vm_hsave + offsetof(struct vmcb, sa=
ve.gdtr.limit));
+
+    env->idt.base  =3D ldq_phys(env->vm_hsave + offsetof(struct vmcb, sa=
ve.idtr.base));
+    env->idt.limit =3D ldl_phys(env->vm_hsave + offsetof(struct vmcb, sa=
ve.idtr.limit));
+
+    cpu_x86_update_cr0(env, ldq_phys(env->vm_hsave + offsetof(struct vmc=
b, save.cr0)) | CR0_PE_MASK);
+    cpu_x86_update_cr4(env, ldq_phys(env->vm_hsave + offsetof(struct vmc=
b, save.cr4)));
+    cpu_x86_update_cr3(env, ldq_phys(env->vm_hsave + offsetof(struct vmc=
b, save.cr3)));
+    if(int_ctl & V_INTR_MASKING_MASK)
+        env->cr[8] =3D ldq_phys(env->vm_hsave + offsetof(struct vmcb, sa=
ve.cr8));
+    // we need to set the efer after the crs so the hidden flags get set=
 properly
+#ifdef TARGET_X86_64
+    env->efer  =3D ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.e=
fer));
+    env->hflags &=3D ~HF_LMA_MASK;
+    if (env->efer & MSR_EFER_LMA)
+       env->hflags |=3D HF_LMA_MASK;
+#endif
+
+    env->eflags =3D 0;
+    load_eflags(ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.rfla=
gs)), ~(CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C | DF_MASK));
+    CC_OP =3D CC_OP_EFLAGS;
+
+    SVM_LOAD_SEG(env->vm_hsave, ES, es);
+    SVM_LOAD_SEG(env->vm_hsave, CS, cs);
+    SVM_LOAD_SEG(env->vm_hsave, SS, ss);
+    SVM_LOAD_SEG(env->vm_hsave, DS, ds);
+
+    EIP =3D ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.rip));
+    ESP =3D ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.rsp));
+    EAX =3D ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.rax));
+
+    env->dr[6] =3D ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.d=
r6));
+    env->dr[7] =3D ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.d=
r7));
+
+// other setups
+    cpu_x86_set_cpl(env, 0);
+    stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.exit_code_hi),=
 (uint32_t)(exit_code >> 32));
+    stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.exit_code), ex=
it_code);
+    stq_phys(env->vm_vmcb + offsetof(struct vmcb, control.exit_info_1), =
exit_info_1);
+
+    helper_clgi();
+    // FIXME: Resets the current ASID register to zero (host ASID).
+
+    // Clears the V_IRQ and V_INTR_MASKING bits inside the processor.
+   =20
+    // Clears the TSC_OFFSET inside the processor.
+   =20
+    // If the host is in PAE mode, the processor reloads the host's PDPE=
s from the page table indicated the host's CR3. If the PDPEs contain ille=
gal state, the processor causes a shutdown.
+
+    // Forces CR0.PE =3D 1, RFLAGS.VM =3D 0.
+    env->cr[0] |=3D CR0_PE_MASK;
+    env->eflags &=3D ~VM_MASK;
+   =20
+    // Disables all breakpoints in the host DR7 register.
+
+    // Checks the reloaded host state for consistency;
+
+    // If the host=E2=80=99s rIP reloaded by #VMEXIT is outside the limi=
t of the host=E2=80=99s code segment or non-canonical (in the case of lon=
g mode), a #GP fault is delivered inside the host.)
+
+    // remove any pending exception
+    env->exception_index =3D -1;
+    env->error_code =3D 0;
+    env->old_exception =3D -1;
+
+    regs_to_env();
+    cpu_loop_exit();
+}
+
Index: qemu/target-i386/svm.h
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
--- /dev/null
+++ qemu/target-i386/svm.h
@@ -0,0 +1,373 @@
+#ifndef __SVM_H
+#define __SVM_H
+
+enum {
+	INTERCEPT_INTR,
+	INTERCEPT_NMI,
+	INTERCEPT_SMI,
+	INTERCEPT_INIT,
+	INTERCEPT_VINTR,
+	INTERCEPT_SELECTIVE_CR0,
+	INTERCEPT_STORE_IDTR,
+	INTERCEPT_STORE_GDTR,
+	INTERCEPT_STORE_LDTR,
+	INTERCEPT_STORE_TR,
+	INTERCEPT_LOAD_IDTR,
+	INTERCEPT_LOAD_GDTR,
+	INTERCEPT_LOAD_LDTR,
+	INTERCEPT_LOAD_TR,
+	INTERCEPT_RDTSC,
+	INTERCEPT_RDPMC,
+	INTERCEPT_PUSHF,
+	INTERCEPT_POPF,
+	INTERCEPT_CPUID,
+	INTERCEPT_RSM,
+	INTERCEPT_IRET,
+	INTERCEPT_INTn,
+	INTERCEPT_INVD,
+	INTERCEPT_PAUSE,
+	INTERCEPT_HLT,
+	INTERCEPT_INVLPG,
+	INTERCEPT_INVLPGA,
+	INTERCEPT_IOIO_PROT,
+	INTERCEPT_MSR_PROT,
+	INTERCEPT_TASK_SWITCH,
+	INTERCEPT_FERR_FREEZE,
+	INTERCEPT_SHUTDOWN,
+	INTERCEPT_VMRUN,
+	INTERCEPT_VMMCALL,
+	INTERCEPT_VMLOAD,
+	INTERCEPT_VMSAVE,
+	INTERCEPT_STGI,
+	INTERCEPT_CLGI,
+	INTERCEPT_SKINIT,
+	INTERCEPT_RDTSCP,
+	INTERCEPT_ICEBP,
+	INTERCEPT_WBINVD,
+};
+// This is not really an intercept but rather a placeholder to
+// show that we are in an SVM (just like a hidden flag, but keeps the
+// TBs clean)
+#define INTERCEPT_SVM 63
+#define INTERCEPT_SVM_MASK (1L << INTERCEPT_SVM)
+
+struct __attribute__ ((__packed__)) vmcb_control_area {
+	uint16_t intercept_cr_read;
+	uint16_t intercept_cr_write;
+	uint16_t intercept_dr_read;
+	uint16_t intercept_dr_write;
+	uint32_t intercept_exceptions;
+	uint64_t intercept;
+	uint8_t reserved_1[44];
+	uint64_t iopm_base_pa;
+	uint64_t msrpm_base_pa;
+	uint64_t tsc_offset;
+	uint32_t asid;
+	uint8_t tlb_ctl;
+	uint8_t reserved_2[3];
+	uint32_t int_ctl;
+	uint32_t int_vector;
+	uint32_t int_state;
+	uint8_t reserved_3[4];
+	uint32_t exit_code;
+	uint32_t exit_code_hi;
+	uint64_t exit_info_1;
+	uint64_t exit_info_2;
+	uint32_t exit_int_info;
+	uint32_t exit_int_info_err;
+	uint64_t nested_ctl;
+	uint8_t reserved_4[16];
+	uint32_t event_inj;
+	uint32_t event_inj_err;
+	uint64_t nested_cr3;
+	uint64_t lbr_ctl;
+	uint8_t reserved_5[832];
+};
+
+
+#define TLB_CONTROL_DO_NOTHING 0
+#define TLB_CONTROL_FLUSH_ALL_ASID 1
+
+#define V_TPR_MASK 0x0f
+
+#define V_IRQ_SHIFT 8
+#define V_IRQ_MASK (1 << V_IRQ_SHIFT)
+
+#define V_INTR_PRIO_SHIFT 16
+#define V_INTR_PRIO_MASK (0x0f << V_INTR_PRIO_SHIFT)
+
+#define V_IGN_TPR_SHIFT 20
+#define V_IGN_TPR_MASK (1 << V_IGN_TPR_SHIFT)
+
+#define V_INTR_MASKING_SHIFT 24
+#define V_INTR_MASKING_MASK (1 << V_INTR_MASKING_SHIFT)
+
+#define SVM_INTERRUPT_SHADOW_MASK 1
+
+#define SVM_IOIO_STR_SHIFT 2
+#define SVM_IOIO_REP_SHIFT 3
+#define SVM_IOIO_SIZE_SHIFT 4
+#define SVM_IOIO_ASIZE_SHIFT 7
+
+#define SVM_IOIO_TYPE_MASK 1
+#define SVM_IOIO_STR_MASK (1 << SVM_IOIO_STR_SHIFT)
+#define SVM_IOIO_REP_MASK (1 << SVM_IOIO_REP_SHIFT)
+#define SVM_IOIO_SIZE_MASK (7 << SVM_IOIO_SIZE_SHIFT)
+#define SVM_IOIO_ASIZE_MASK (7 << SVM_IOIO_ASIZE_SHIFT)
+
+struct __attribute__ ((__packed__)) vmcb_seg {
+	uint16_t selector;
+	uint16_t attrib;
+	uint32_t limit;
+	uint64_t base;
+};
+
+struct __attribute__ ((__packed__)) vmcb_save_area {
+	struct vmcb_seg es;
+	struct vmcb_seg cs;
+	struct vmcb_seg ss;
+	struct vmcb_seg ds;
+	struct vmcb_seg fs;
+	struct vmcb_seg gs;
+	struct vmcb_seg gdtr;
+	struct vmcb_seg ldtr;
+	struct vmcb_seg idtr;
+	struct vmcb_seg tr;
+	uint8_t reserved_1[43];
+	uint8_t cpl;
+	uint8_t reserved_2[4];
+	uint64_t efer;
+	uint8_t reserved_3[112];
+	uint64_t cr4;
+	uint64_t cr3;
+	uint64_t cr0;
+	uint64_t dr7;
+	uint64_t dr6;
+	uint64_t rflags;
+	uint64_t rip;
+	uint8_t reserved_4[88];
+	uint64_t rsp;
+	uint8_t reserved_5[24];
+	uint64_t rax;
+	uint64_t star;
+	uint64_t lstar;
+	uint64_t cstar;
+	uint64_t sfmask;
+	uint64_t kernel_gs_base;
+	uint64_t sysenter_cs;
+	uint64_t sysenter_esp;
+	uint64_t sysenter_eip;
+	uint64_t cr2;
+	// qemu: added to reuse this as hsave
+	uint64_t cr8;
+	// end of add
+	uint8_t reserved_6[32 - 8]; // originally 32
+	uint64_t g_pat;
+	uint64_t dbgctl;
+	uint64_t br_from;
+	uint64_t br_to;
+	uint64_t last_excp_from;
+	uint64_t last_excp_to;
+};
+
+struct __attribute__ ((__packed__)) vmcb {
+	struct vmcb_control_area control;
+	struct vmcb_save_area save;
+};
+
+#define SVM_CPUID_FEATURE_SHIFT 2
+#define SVM_CPUID_FUNC 0x8000000a
+
+#define MSR_EFER_SVME_MASK (1ULL << 12)
+
+#define SVM_SELECTOR_S_SHIFT 4
+#define SVM_SELECTOR_DPL_SHIFT 5
+#define SVM_SELECTOR_P_SHIFT 7
+#define SVM_SELECTOR_AVL_SHIFT 8
+#define SVM_SELECTOR_L_SHIFT 9
+#define SVM_SELECTOR_DB_SHIFT 10
+#define SVM_SELECTOR_G_SHIFT 11
+
+#define SVM_SELECTOR_TYPE_MASK (0xf)
+#define SVM_SELECTOR_S_MASK (1 << SVM_SELECTOR_S_SHIFT)
+#define SVM_SELECTOR_DPL_MASK (3 << SVM_SELECTOR_DPL_SHIFT)
+#define SVM_SELECTOR_P_MASK (1 << SVM_SELECTOR_P_SHIFT)
+#define SVM_SELECTOR_AVL_MASK (1 << SVM_SELECTOR_AVL_SHIFT)
+#define SVM_SELECTOR_L_MASK (1 << SVM_SELECTOR_L_SHIFT)
+#define SVM_SELECTOR_DB_MASK (1 << SVM_SELECTOR_DB_SHIFT)
+#define SVM_SELECTOR_G_MASK (1 << SVM_SELECTOR_G_SHIFT)
+
+#define SVM_SELECTOR_WRITE_MASK (1 << 1)
+#define SVM_SELECTOR_READ_MASK SVM_SELECTOR_WRITE_MASK
+#define SVM_SELECTOR_CODE_MASK (1 << 3)
+
+#define INTERCEPT_CR0_MASK 1
+#define INTERCEPT_CR3_MASK (1 << 3)
+#define INTERCEPT_CR4_MASK (1 << 4)
+
+#define INTERCEPT_DR0_MASK 1
+#define INTERCEPT_DR1_MASK (1 << 1)
+#define INTERCEPT_DR2_MASK (1 << 2)
+#define INTERCEPT_DR3_MASK (1 << 3)
+#define INTERCEPT_DR4_MASK (1 << 4)
+#define INTERCEPT_DR5_MASK (1 << 5)
+#define INTERCEPT_DR6_MASK (1 << 6)
+#define INTERCEPT_DR7_MASK (1 << 7)
+
+#define SVM_EVTINJ_VEC_MASK 0xff
+
+#define SVM_EVTINJ_TYPE_SHIFT 8
+#define SVM_EVTINJ_TYPE_MASK (7 << SVM_EVTINJ_TYPE_SHIFT)
+
+#define SVM_EVTINJ_TYPE_INTR (0 << SVM_EVTINJ_TYPE_SHIFT)
+#define SVM_EVTINJ_TYPE_NMI (2 << SVM_EVTINJ_TYPE_SHIFT)
+#define SVM_EVTINJ_TYPE_EXEPT (3 << SVM_EVTINJ_TYPE_SHIFT)
+#define SVM_EVTINJ_TYPE_SOFT (4 << SVM_EVTINJ_TYPE_SHIFT)
+
+#define SVM_EVTINJ_VALID (1 << 31)
+#define SVM_EVTINJ_VALID_ERR (1 << 11)
+
+#define SVM_EXITINTINFO_VEC_MASK SVM_EVTINJ_VEC_MASK
+
+#define	SVM_EXITINTINFO_TYPE_INTR SVM_EVTINJ_TYPE_INTR
+#define	SVM_EXITINTINFO_TYPE_NMI SVM_EVTINJ_TYPE_NMI
+#define	SVM_EXITINTINFO_TYPE_EXEPT SVM_EVTINJ_TYPE_EXEPT
+#define	SVM_EXITINTINFO_TYPE_SOFT SVM_EVTINJ_TYPE_SOFT
+
+#define SVM_EXITINTINFO_VALID SVM_EVTINJ_VALID
+#define SVM_EXITINTINFO_VALID_ERR SVM_EVTINJ_VALID_ERR
+
+#define	SVM_EXIT_READ_CR0 	0x000
+#define	SVM_EXIT_READ_CR3 	0x003
+#define	SVM_EXIT_READ_CR4 	0x004
+#define	SVM_EXIT_READ_CR8 	0x008
+#define	SVM_EXIT_WRITE_CR0 	0x010
+#define	SVM_EXIT_WRITE_CR3 	0x013
+#define	SVM_EXIT_WRITE_CR4 	0x014
+#define	SVM_EXIT_WRITE_CR8 	0x018
+#define	SVM_EXIT_READ_DR0 	0x020
+#define	SVM_EXIT_READ_DR1 	0x021
+#define	SVM_EXIT_READ_DR2 	0x022
+#define	SVM_EXIT_READ_DR3 	0x023
+#define	SVM_EXIT_READ_DR4 	0x024
+#define	SVM_EXIT_READ_DR5 	0x025
+#define	SVM_EXIT_READ_DR6 	0x026
+#define	SVM_EXIT_READ_DR7 	0x027
+#define	SVM_EXIT_WRITE_DR0 	0x030
+#define	SVM_EXIT_WRITE_DR1 	0x031
+#define	SVM_EXIT_WRITE_DR2 	0x032
+#define	SVM_EXIT_WRITE_DR3 	0x033
+#define	SVM_EXIT_WRITE_DR4 	0x034
+#define	SVM_EXIT_WRITE_DR5 	0x035
+#define	SVM_EXIT_WRITE_DR6 	0x036
+#define	SVM_EXIT_WRITE_DR7 	0x037
+#define SVM_EXIT_EXCP_BASE      0x040
+#define SVM_EXIT_INTR		0x060
+#define SVM_EXIT_NMI		0x061
+#define SVM_EXIT_SMI		0x062
+#define SVM_EXIT_INIT		0x063
+#define SVM_EXIT_VINTR		0x064
+#define SVM_EXIT_CR0_SEL_WRITE	0x065
+#define SVM_EXIT_IDTR_READ	0x066
+#define SVM_EXIT_GDTR_READ	0x067
+#define SVM_EXIT_LDTR_READ	0x068
+#define SVM_EXIT_TR_READ	0x069
+#define SVM_EXIT_IDTR_WRITE	0x06a
+#define SVM_EXIT_GDTR_WRITE	0x06b
+#define SVM_EXIT_LDTR_WRITE	0x06c
+#define SVM_EXIT_TR_WRITE	0x06d
+#define SVM_EXIT_RDTSC		0x06e
+#define SVM_EXIT_RDPMC		0x06f
+#define SVM_EXIT_PUSHF		0x070
+#define SVM_EXIT_POPF		0x071
+#define SVM_EXIT_CPUID		0x072
+#define SVM_EXIT_RSM		0x073
+#define SVM_EXIT_IRET		0x074
+#define SVM_EXIT_SWINT		0x075
+#define SVM_EXIT_INVD		0x076
+#define SVM_EXIT_PAUSE		0x077
+#define SVM_EXIT_HLT		0x078
+#define SVM_EXIT_INVLPG		0x079
+#define SVM_EXIT_INVLPGA	0x07a
+#define SVM_EXIT_IOIO		0x07b
+#define SVM_EXIT_MSR		0x07c
+#define SVM_EXIT_TASK_SWITCH	0x07d
+#define SVM_EXIT_FERR_FREEZE	0x07e
+#define SVM_EXIT_SHUTDOWN	0x07f
+#define SVM_EXIT_VMRUN		0x080
+#define SVM_EXIT_VMMCALL	0x081
+#define SVM_EXIT_VMLOAD		0x082
+#define SVM_EXIT_VMSAVE		0x083
+#define SVM_EXIT_STGI		0x084
+#define SVM_EXIT_CLGI		0x085
+#define SVM_EXIT_SKINIT		0x086
+#define SVM_EXIT_RDTSCP		0x087
+#define SVM_EXIT_ICEBP		0x088
+#define SVM_EXIT_WBINVD		0x089
+// only included in documentation, maybe wrong
+#define SVM_EXIT_MONITOR	0x08a
+#define SVM_EXIT_MWAIT		0x08b
+#define SVM_EXIT_NPF  		0x400
+
+#define SVM_EXIT_ERR		-1
+
+#define SVM_CR0_SELECTIVE_MASK (1 << 3 | 1) // TS and MP
+
+#define SVM_VMLOAD ".byte 0x0f, 0x01, 0xda"
+#define SVM_VMRUN  ".byte 0x0f, 0x01, 0xd8"
+#define SVM_VMSAVE ".byte 0x0f, 0x01, 0xdb"
+#define SVM_CLGI   ".byte 0x0f, 0x01, 0xdd"
+#define SVM_STGI   ".byte 0x0f, 0x01, 0xdc"
+#define SVM_INVLPGA ".byte 0x0f, 0x01, 0xdf"
+
+/////// function references
+
+void helper_stgi();
+void vmexit(uint64_t exit_code, uint64_t exit_info_1);
+int svm_check_intercept_param(uint32_t type, uint64_t param);
+static inline int svm_check_intercept(unsigned int type) {
+    return svm_check_intercept_param(type, 0);
+}
+
+
+#define INTERCEPTED(mask) (env->intercept & mask)=20
+#define INTERCEPTEDw(var, mask) (env->intercept ## var & mask)=20
+#define INTERCEPTEDl(var, mask) (env->intercept ## var & mask)=20
+
+#define SVM_LOAD_SEG(addr, seg_index, seg) \
+    cpu_x86_load_seg_cache(env, \
+                    R_##seg_index, \
+                    lduw_phys(addr + offsetof(struct vmcb, save.seg.sele=
ctor)),\
+                    ldq_phys(addr + offsetof(struct vmcb, save.seg.base)=
),\
+                    ldl_phys(addr + offsetof(struct vmcb, save.seg.limit=
)),\
+                    vmcb2cpu_attrib(lduw_phys(addr + offsetof(struct vmc=
b, save.seg.attrib)), ldq_phys(addr + offsetof(struct vmcb, save.seg.base=
)), ldl_phys(addr + offsetof(struct vmcb, save.seg.limit))))
+
+#define SVM_LOAD_SEG2(addr, seg_qemu, seg_vmcb) \
+    env->seg_qemu.selector  =3D lduw_phys(addr + offsetof(struct vmcb, s=
ave.seg_vmcb.selector)); \
+    env->seg_qemu.base      =3D ldq_phys(addr + offsetof(struct vmcb, sa=
ve.seg_vmcb.base)); \
+    env->seg_qemu.limit     =3D ldl_phys(addr + offsetof(struct vmcb, sa=
ve.seg_vmcb.limit)); \
+    env->seg_qemu.flags     =3D vmcb2cpu_attrib(lduw_phys(addr + offseto=
f(struct vmcb, save.seg_vmcb.attrib)), env->seg_qemu.base, env->seg_qemu.=
limit)
+
+#define SVM_SAVE_SEG(addr, seg_qemu, seg_vmcb) \
+    stw_phys(addr + offsetof(struct vmcb, save.seg_vmcb.selector), env->=
seg_qemu.selector); \
+    stq_phys(addr + offsetof(struct vmcb, save.seg_vmcb.base), env->seg_=
qemu.base); \
+    stl_phys(addr + offsetof(struct vmcb, save.seg_vmcb.limit), env->seg=
_qemu.limit); \
+    stw_phys(addr + offsetof(struct vmcb, save.seg_vmcb.attrib), cpu2vmc=
b_attrib(env->seg_qemu.flags))
+
+
+////// debugging only
+
+#define SVM_LOAD_SEG2_noconv(addr, seg_qemu, seg_vmcb) \
+    env->seg_qemu.selector  =3D lduw_phys(addr + offsetof(struct vmcb, s=
ave.seg_vmcb.selector)); \
+    env->seg_qemu.base      =3D ldq_phys(addr + offsetof(struct vmcb, sa=
ve.seg_vmcb.base)); \
+    env->seg_qemu.limit     =3D ldl_phys(addr + offsetof(struct vmcb, sa=
ve.seg_vmcb.limit)); \
+    env->seg_qemu.flags     =3D lduw_phys(addr + offsetof(struct vmcb, s=
ave.seg_vmcb.attrib))
+
+#define SVM_SAVE_SEG_noconv(addr, seg_qemu, seg_vmcb) \
+    stw_phys(addr + offsetof(struct vmcb, save.seg_vmcb.selector), env->=
seg_qemu.selector); \
+    stq_phys(addr + offsetof(struct vmcb, save.seg_vmcb.base), env->seg_=
qemu.base); \
+    stl_phys(addr + offsetof(struct vmcb, save.seg_vmcb.limit), env->seg=
_qemu.limit); \
+    stw_phys(addr + offsetof(struct vmcb, save.seg_vmcb.attrib), env->se=
g_qemu.flags)
+
+#endif
+
Index: qemu/cpu-exec.c
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
--- qemu.orig/cpu-exec.c
+++ qemu/cpu-exec.c
@@ -104,6 +104,9 @@ static TranslationBlock *tb_find_slow(ta
         if (tb->pc =3D=3D pc &&=20
             tb->page_addr[0] =3D=3D phys_page1 &&
             tb->cs_base =3D=3D cs_base &&=20
+#if defined(TARGET_I386)
+	    tb->intercept =3D=3D env->intercept &&
+#endif
             tb->flags =3D=3D flags) {
             /* check next page if needed */
             if (tb->page_addr[1] !=3D -1) {
@@ -132,6 +135,9 @@ static TranslationBlock *tb_find_slow(ta
     tc_ptr =3D code_gen_ptr;
     tb->tc_ptr =3D tc_ptr;
     tb->cs_base =3D cs_base;
+#if defined(TARGET_I386)
+    tb->intercept =3D env->intercept;
+#endif
     tb->flags =3D flags;
     cpu_gen_code(env, tb, CODE_GEN_MAX_SIZE, &code_gen_size);
     code_gen_ptr =3D (void *)(((unsigned long)code_gen_ptr + code_gen_si=
ze + CODE_GEN_ALIGN - 1) & ~(CODE_GEN_ALIGN - 1));
@@ -214,7 +220,11 @@ static inline TranslationBlock *tb_find_
 #endif
     tb =3D env->tb_jmp_cache[tb_jmp_cache_hash_func(pc)];
     if (__builtin_expect(!tb || tb->pc !=3D pc || tb->cs_base !=3D cs_ba=
se ||
-                         tb->flags !=3D flags, 0)) {
+                         tb->flags !=3D flags
+#if defined(TARGET_I386)
+			 || tb->intercept !=3D env->intercept
+#endif
+			 , 0)) {
         tb =3D tb_find_slow(pc, cs_base, flags);
         /* Note: we do it here to avoid a gcc bug on Mac OS X when
            doing it in tb_find_slow */
@@ -373,7 +383,11 @@ int cpu_exec(CPUState *env1)
                 tmp_T0 =3D T0;
 #endif	   =20
                 interrupt_request =3D env->interrupt_request;
-                if (__builtin_expect(interrupt_request, 0)) {
+                if (__builtin_expect(interrupt_request, 0)
+#if defined(TARGET_I386)
+			&& env->hflags & HF_GIF_MASK
+#endif
+				) {
                     if (interrupt_request & CPU_INTERRUPT_DEBUG) {
                         env->interrupt_request &=3D ~CPU_INTERRUPT_DEBUG=
;
                         env->exception_index =3D EXCP_DEBUG;
@@ -391,6 +405,7 @@ int cpu_exec(CPUState *env1)
 #if defined(TARGET_I386)
                     if ((interrupt_request & CPU_INTERRUPT_SMI) &&
                         !(env->hflags & HF_SMM_MASK)) {
+                        svm_check_intercept(SVM_EXIT_SMI);
                         env->interrupt_request &=3D ~CPU_INTERRUPT_SMI;
                         do_smm_enter();
 #if defined(__sparc__) && !defined(HOST_SOLARIS)
@@ -399,9 +414,10 @@ int cpu_exec(CPUState *env1)
                         T0 =3D 0;
 #endif
                     } else if ((interrupt_request & CPU_INTERRUPT_HARD) =
&&
-                        (env->eflags & IF_MASK) &&=20
+                        (env->eflags & IF_MASK || env->hflags & HF_HIF_M=
ASK) &&=20
                         !(env->hflags & HF_INHIBIT_IRQ_MASK)) {
                         int intno;
+			svm_check_intercept(SVM_EXIT_INTR);
                         env->interrupt_request &=3D ~CPU_INTERRUPT_HARD;
                         intno =3D cpu_get_pic_interrupt(env);
                         if (loglevel & CPU_LOG_TB_IN_ASM) {
@@ -415,6 +431,22 @@ int cpu_exec(CPUState *env1)
 #else
                         T0 =3D 0;
 #endif
+                    } else if((interrupt_request & CPU_INTERRUPT_VIRQ) &=
&
+                        (env->eflags & IF_MASK) && !(env->hflags & HF_IN=
HIBIT_IRQ_MASK)) {
+                         int intno;
+                         // FIXME: this should respect TPR
+                         svm_check_intercept(SVM_EXIT_VINTR);
+                         env->interrupt_request &=3D ~CPU_INTERRUPT_VIRQ=
;
+                         stl_phys(env->vm_vmcb + offsetof(struct vmcb, c=
ontrol.int_ctl), ldl_phys(env->vm_vmcb + offsetof(struct vmcb, control.in=
t_ctl)) & ~V_IRQ_MASK);
+                         intno =3D ldl_phys(env->vm_vmcb + offsetof(stru=
ct vmcb, control.int_vector));
+                         if (loglevel & CPU_LOG_TB_IN_ASM)
+                             fprintf(logfile, "Servicing virtual hardwar=
e INT=3D0x%02x\n", intno);
+	                 do_interrupt(intno, 0, 0, -1, 1);
+#if defined(__sparc__) && !defined(HOST_SOLARIS)
+                         tmp_T0 =3D 0;
+#else
+                         T0 =3D 0;
+#endif
                     }
 #elif defined(TARGET_PPC)
 #if 0
Index: qemu/target-i386/exec.h
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
--- qemu.orig/target-i386/exec.h
+++ qemu/target-i386/exec.h
@@ -501,6 +501,15 @@ void update_fp_status(void);
 void helper_hlt(void);
 void helper_monitor(void);
 void helper_mwait(void);
+void helper_vmrun(target_ulong addr);
+void helper_vmmcall(void);
+void helper_vmload(target_ulong addr);
+void helper_vmsave(target_ulong addr);
+void helper_stgi(void);
+void helper_clgi(void);
+void helper_skinit(void);
+void helper_invlpga(void);
+void vmexit(uint64_t exit_code, uint64_t exit_info_1);
=20
 extern const uint8_t parity_table[256];
 extern const uint8_t rclw_table[32];
@@ -588,3 +597,4 @@ static inline int cpu_halted(CPUState *e
     }
     return EXCP_HALTED;
 }
+
Index: qemu/exec.c
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
--- qemu.orig/exec.c
+++ qemu/exec.c
@@ -1281,6 +1281,11 @@ void cpu_abort(CPUState *env, const char
     vfprintf(stderr, fmt, ap);
     fprintf(stderr, "\n");
 #ifdef TARGET_I386
+    if(env->intercept & INTERCEPT_SVM_MASK) {
+	// most probably the virtual machine should not
+	// be shut down but rather caught by the VMM
+        vmexit(SVM_EXIT_SHUTDOWN, 0);
+    }
     cpu_dump_state(env, stderr, fprintf, X86_DUMP_FPU | X86_DUMP_CCOP);
 #else
     cpu_dump_state(env, stderr, fprintf, 0);
Index: qemu/exec-all.h
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
--- qemu.orig/exec-all.h
+++ qemu/exec-all.h
@@ -166,6 +166,7 @@ static inline int tlb_set_page(CPUState=20
 typedef struct TranslationBlock {
     target_ulong pc;   /* simulated PC corresponding to this block (EIP =
+ CS base) */
     target_ulong cs_base; /* CS base for this block */
+    uint64_t intercept; /* SVM intercept vector */
     unsigned int flags; /* flags defining in which context the code was =
generated */
     uint16_t size;      /* size of target code for this block (1 <=3D
                            size <=3D TARGET_PAGE_SIZE) */
Index: qemu/cpu-all.h
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
--- qemu.orig/cpu-all.h
+++ qemu/cpu-all.h
@@ -715,6 +715,7 @@ extern int code_copy_enabled;
 #define CPU_INTERRUPT_HALT   0x20 /* CPU halt wanted */
 #define CPU_INTERRUPT_SMI    0x40 /* (x86 only) SMI interrupt pending */
 #define CPU_INTERRUPT_DEBUG  0x80 /* Debug event occured.  */
+#define CPU_INTERRUPT_VIRQ   0x100 /* virtual interrupt pending.  */
=20
 void cpu_interrupt(CPUState *s, int mask);
 void cpu_reset_interrupt(CPUState *env, int mask);

--------------000400080308000307030106--