[12/14] hvf: move fields from CPUState to CPUX86State

Commit Message

=?UTF-8?q?Sergio=20Andr=C3=A9s=20G=C3=B3mez=20Del=20Real?= Aug. 28, 2017, 1:56 a.m. UTC

This commit is a small refactoring of hvf's emulation code: it moves the
HVFX86EmulatorState field to CPUX86State, and in general changes, for
the emulation functions, the parameter with signature 'CPUState *' for
'CPUX86State *' so we don't have to get the 'env' (which is what we
really need) through the 'cpu' everytime.

Signed-off-by: Sergio Andres Gomez Del Real <[e-mail]>
---
 include/qom/cpu.h                  |   2 -
 target/i386/cpu.h                  |   7 +
 target/i386/hvf-all.c              | 125 +++----
 target/i386/hvf-utils/x86.c        |   4 +-
 target/i386/hvf-utils/x86.h        |  34 +-
 target/i386/hvf-utils/x86_decode.c | 357 ++++++++++----------
 target/i386/hvf-utils/x86_decode.h |  23 +-
 target/i386/hvf-utils/x86_emu.c    | 673 +++++++++++++++++++------------------
 target/i386/hvf-utils/x86_emu.h    |  29 +-
 target/i386/hvf-utils/x86_flags.c  | 194 +++++------
 target/i386/hvf-utils/x86_flags.h  | 106 +++---
 target/i386/hvf-utils/x86hvf.c     |  14 +-
 12 files changed, 794 insertions(+), 774 deletions(-)

Patch

diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index ef74c2ce3c..abe82a5b7c 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -408,9 +408,7 @@  struct CPUState {
      */
     uint16_t pending_tlb_flush;
 
-    bool hvf_vcpu_dirty;
     uint64_t hvf_fd; // fd of vcpu created by HVF
-    struct hvf_x86_state *hvf_x86;
 };
 
 QTAILQ_HEAD(CPUTailQ, CPUState);
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 7d90f08b98..1d056ee343 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -23,6 +23,9 @@ 
 #include "qemu-common.h"
 #include "cpu-qom.h"
 #include "standard-headers/asm-x86/hyperv.h"
+#if defined(CONFIG_HVF)
+#include "target/i386/hvf-utils/x86.h"
+#endif
 
 #ifdef TARGET_X86_64
 #define TARGET_LONG_BITS 64
@@ -1187,11 +1190,15 @@  typedef struct CPUX86State {
     int32_t interrupt_injected;
     uint8_t soft_interrupt;
     uint8_t has_error_code;
+    uint32_t ins_len;
     uint32_t sipi_vector;
     bool tsc_valid;
     int64_t tsc_khz;
     int64_t user_tsc_khz; /* for sanity check only */
     void *kvm_xsave_buf;
+#if defined(CONFIG_HVF)
+    HVFX86EmulatorState *hvf_emul;
+#endif
 
     uint64_t mcg_cap;
     uint64_t mcg_ctl;
diff --git a/target/i386/hvf-all.c b/target/i386/hvf-all.c
index 20c796089d..8a75723dcf 100644
--- a/target/i386/hvf-all.c
+++ b/target/i386/hvf-all.c
@@ -208,17 +208,20 @@  void update_apic_tpr(CPUState *cpu)
 /* TODO: taskswitch handling */
 static void save_state_to_tss32(CPUState *cpu, struct x86_tss_segment32 *tss)
 {
+    X86CPU *x86_cpu = X86_CPU(cpu);
+    CPUX86State *env = &x86_cpu->env;
+
     /* CR3 and ldt selector are not saved intentionally */
-    tss->eip = EIP(cpu);
-    tss->eflags = EFLAGS(cpu);
-    tss->eax = EAX(cpu);
-    tss->ecx = ECX(cpu);
-    tss->edx = EDX(cpu);
-    tss->ebx = EBX(cpu);
-    tss->esp = ESP(cpu);
-    tss->ebp = EBP(cpu);
-    tss->esi = ESI(cpu);
-    tss->edi = EDI(cpu);
+    tss->eip = EIP(env);
+    tss->eflags = EFLAGS(env);
+    tss->eax = EAX(env);
+    tss->ecx = ECX(env);
+    tss->edx = EDX(env);
+    tss->ebx = EBX(env);
+    tss->esp = ESP(env);
+    tss->ebp = EBP(env);
+    tss->esi = ESI(env);
+    tss->edi = EDI(env);
 
     tss->es = vmx_read_segment_selector(cpu, REG_SEG_ES).sel;
     tss->cs = vmx_read_segment_selector(cpu, REG_SEG_CS).sel;
@@ -230,20 +233,23 @@  static void save_state_to_tss32(CPUState *cpu, struct x86_tss_segment32 *tss)
 
 static void load_state_from_tss32(CPUState *cpu, struct x86_tss_segment32 *tss)
 {
+    X86CPU *x86_cpu = X86_CPU(cpu);
+    CPUX86State *env = &x86_cpu->env;
+
     wvmcs(cpu->hvf_fd, VMCS_GUEST_CR3, tss->cr3);
 
-    RIP(cpu) = tss->eip;
-    EFLAGS(cpu) = tss->eflags | 2;
+    RIP(env) = tss->eip;
+    EFLAGS(env) = tss->eflags | 2;
 
     /* General purpose registers */
-    RAX(cpu) = tss->eax;
-    RCX(cpu) = tss->ecx;
-    RDX(cpu) = tss->edx;
-    RBX(cpu) = tss->ebx;
-    RSP(cpu) = tss->esp;
-    RBP(cpu) = tss->ebp;
-    RSI(cpu) = tss->esi;
-    RDI(cpu) = tss->edi;
+    RAX(env) = tss->eax;
+    RCX(env) = tss->ecx;
+    RDX(env) = tss->edx;
+    RBX(env) = tss->ebx;
+    RSP(env) = tss->esp;
+    RBP(env) = tss->ebp;
+    RSI(env) = tss->esi;
+    RDI(env) = tss->edi;
 
     vmx_write_segment_selector(cpu, (x68_segment_selector){{tss->ldt}},
                                REG_SEG_LDTR);
@@ -319,6 +325,8 @@  static void vmx_handle_task_switch(CPUState *cpu, x68_segment_selector tss_sel,
     uint32_t desc_limit;
     struct x86_call_gate task_gate_desc;
     struct vmx_segment vmx_seg;
+    X86CPU *x86_cpu = X86_CPU(cpu);
+    CPUX86State *env = &x86_cpu->env;
 
     x86_read_segment_descriptor(cpu, &next_tss_desc, tss_sel);
     x86_read_segment_descriptor(cpu, &curr_tss_desc, old_tss_sel);
@@ -347,7 +355,7 @@  static void vmx_handle_task_switch(CPUState *cpu, x68_segment_selector tss_sel,
     }
 
     if (reason == TSR_IRET) {
-        EFLAGS(cpu) &= ~RFLAGS_NT;
+        EFLAGS(env) &= ~RFLAGS_NT;
     }
 
     if (reason != TSR_CALL && reason != TSR_IDT_GATE) {
@@ -404,16 +412,16 @@  void hvf_handle_io(CPUArchState *env, uint16_t port, void *buffer,
 static void do_hvf_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg)
 {
     CPUState *cpu_state = cpu;
-    if (cpu_state->hvf_vcpu_dirty == 0) {
+    if (cpu_state->vcpu_dirty == 0) {
         hvf_get_registers(cpu_state);
     }
 
-    cpu_state->hvf_vcpu_dirty = 1;
+    cpu_state->vcpu_dirty = 1;
 }
 
 void hvf_cpu_synchronize_state(CPUState *cpu_state)
 {
-    if (cpu_state->hvf_vcpu_dirty == 0) {
+    if (cpu_state->vcpu_dirty == 0) {
         run_on_cpu(cpu_state, do_hvf_cpu_synchronize_state, RUN_ON_CPU_NULL);
     }
 }
@@ -422,7 +430,7 @@  static void do_hvf_cpu_synchronize_post_reset(CPUState *cpu, run_on_cpu_data arg
 {
     CPUState *cpu_state = cpu;
     hvf_put_registers(cpu_state);
-    cpu_state->hvf_vcpu_dirty = false;
+    cpu_state->vcpu_dirty = false;
 }
 
 void hvf_cpu_synchronize_post_reset(CPUState *cpu_state)
@@ -434,7 +442,7 @@  void _hvf_cpu_synchronize_post_init(CPUState *cpu, run_on_cpu_data arg)
 {
     CPUState *cpu_state = cpu;
     hvf_put_registers(cpu_state);
-    cpu_state->hvf_vcpu_dirty = false;
+    cpu_state->vcpu_dirty = false;
 }
 
 void hvf_cpu_synchronize_post_init(CPUState *cpu_state)
@@ -647,7 +655,8 @@  static void dummy_signal(int sig)
 int hvf_init_vcpu(CPUState *cpu)
 {
 
-    X86CPU *x86cpu;
+    X86CPU *x86cpu = X86_CPU(cpu);
+    CPUX86State *env = &x86cpu->env;
 
     /* init cpu signals */
     sigset_t set;
@@ -661,15 +670,15 @@  int hvf_init_vcpu(CPUState *cpu)
     sigdelset(&set, SIG_IPI);
 
     int r;
-    init_emu(cpu);
-    init_decoder(cpu);
+    init_emu();
+    init_decoder();
     init_cpuid(cpu);
 
     hvf_state->hvf_caps = (struct hvf_vcpu_caps *)g_malloc0(sizeof(struct hvf_vcpu_caps));
-    cpu->hvf_x86 = (struct hvf_x86_state *)g_malloc0(sizeof(struct hvf_x86_state));
+    env->hvf_emul = (HVFX86EmulatorState *)g_malloc0(sizeof(HVFX86EmulatorState));
 
     r = hv_vcpu_create((hv_vcpuid_t *)&cpu->hvf_fd, HV_VCPU_DEFAULT);
-    cpu->hvf_vcpu_dirty = 1;
+    cpu->vcpu_dirty = 1;
     assert_hvf_ok(r);
 
     if (hv_vmx_read_capability(HV_VMX_CAP_PINBASED,
@@ -755,12 +764,12 @@  int hvf_vcpu_exec(CPUState *cpu)
     }
 
     do {
-        if (cpu->hvf_vcpu_dirty) {
+        if (cpu->vcpu_dirty) {
             hvf_put_registers(cpu);
-            cpu->hvf_vcpu_dirty = false;
+            cpu->vcpu_dirty = false;
         }
 
-        cpu->hvf_x86->interruptable =
+        env->hvf_emul->interruptable =
             !(rvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY) &
              (VMCS_INTERRUPTIBILITY_STI_BLOCKING |
              VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING));
@@ -785,8 +794,8 @@  int hvf_vcpu_exec(CPUState *cpu)
                                            VMCS_EXIT_INSTRUCTION_LENGTH);
         uint64_t idtvec_info = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_INFO);
         rip = rreg(cpu->hvf_fd, HV_X86_RIP);
-        RFLAGS(cpu) = rreg(cpu->hvf_fd, HV_X86_RFLAGS);
-        env->eflags = RFLAGS(cpu);
+        RFLAGS(env) = rreg(cpu->hvf_fd, HV_X86_RFLAGS);
+        env->eflags = RFLAGS(env);
 
         qemu_mutex_lock_iothread();
 
@@ -798,7 +807,7 @@  int hvf_vcpu_exec(CPUState *cpu)
         case EXIT_REASON_HLT: {
             macvm_set_rip(cpu, rip + ins_len);
             if (!((cpu->interrupt_request & CPU_INTERRUPT_HARD) &&
-                (EFLAGS(cpu) & IF_MASK))
+                (EFLAGS(env) & IF_MASK))
                 && !(cpu->interrupt_request & CPU_INTERRUPT_NMI) &&
                 !(idtvec_info & VMCS_IDT_VEC_VALID)) {
                 cpu->halted = 1;
@@ -828,10 +837,10 @@  int hvf_vcpu_exec(CPUState *cpu)
                 struct x86_decode decode;
 
                 load_regs(cpu);
-                cpu->hvf_x86->fetch_rip = rip;
+                env->hvf_emul->fetch_rip = rip;
 
-                decode_instruction(cpu, &decode);
-                exec_instruction(cpu, &decode);
+                decode_instruction(env, &decode);
+                exec_instruction(env, &decode);
                 store_regs(cpu);
                 break;
             }
@@ -851,20 +860,20 @@  int hvf_vcpu_exec(CPUState *cpu)
                 load_regs(cpu);
                 hvf_handle_io(env, port, &val, 0, size, 1);
                 if (size == 1) {
-                    AL(cpu) = val;
+                    AL(env) = val;
                 } else if (size == 2) {
-                    AX(cpu) = val;
+                    AX(env) = val;
                 } else if (size == 4) {
-                    RAX(cpu) = (uint32_t)val;
+                    RAX(env) = (uint32_t)val;
                 } else {
                     VM_PANIC("size");
                 }
-                RIP(cpu) += ins_len;
+                RIP(env) += ins_len;
                 store_regs(cpu);
                 break;
             } else if (!string && !in) {
-                RAX(cpu) = rreg(cpu->hvf_fd, HV_X86_RAX);
-                hvf_handle_io(env, port, &RAX(cpu), 1, size, 1);
+                RAX(env) = rreg(cpu->hvf_fd, HV_X86_RAX);
+                hvf_handle_io(env, port, &RAX(env), 1, size, 1);
                 macvm_set_rip(cpu, rip + ins_len);
                 break;
             }
@@ -872,11 +881,11 @@  int hvf_vcpu_exec(CPUState *cpu)
             struct x86_decode decode;
 
             load_regs(cpu);
-            cpu->hvf_x86->fetch_rip = rip;
+            env->hvf_emul->fetch_rip = rip;
 
-            decode_instruction(cpu, &decode);
+            decode_instruction(env, &decode);
             VM_PANIC_ON(ins_len != decode.len);
-            exec_instruction(cpu, &decode);
+            exec_instruction(env, &decode);
             store_regs(cpu);
 
             break;
@@ -934,7 +943,7 @@  int hvf_vcpu_exec(CPUState *cpu)
             } else {
                 simulate_wrmsr(cpu);
             }
-            RIP(cpu) += rvmcs(cpu->hvf_fd, VMCS_EXIT_INSTRUCTION_LENGTH);
+            RIP(env) += rvmcs(cpu->hvf_fd, VMCS_EXIT_INSTRUCTION_LENGTH);
             store_regs(cpu);
             break;
         }
@@ -948,19 +957,19 @@  int hvf_vcpu_exec(CPUState *cpu)
 
             switch (cr) {
             case 0x0: {
-                macvm_set_cr0(cpu->hvf_fd, RRX(cpu, reg));
+                macvm_set_cr0(cpu->hvf_fd, RRX(env, reg));
                 break;
             }
             case 4: {
-                macvm_set_cr4(cpu->hvf_fd, RRX(cpu, reg));
+                macvm_set_cr4(cpu->hvf_fd, RRX(env, reg));
                 break;
             }
             case 8: {
                 X86CPU *x86_cpu = X86_CPU(cpu);
                 if (exit_qual & 0x10) {
-                    RRX(cpu, reg) = cpu_get_apic_tpr(x86_cpu->apic_state);
+                    RRX(env, reg) = cpu_get_apic_tpr(x86_cpu->apic_state);
                 } else {
-                    int tpr = RRX(cpu, reg);
+                    int tpr = RRX(env, reg);
                     cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
                     ret = EXCP_INTERRUPT;
                 }
@@ -970,7 +979,7 @@  int hvf_vcpu_exec(CPUState *cpu)
                 fprintf(stderr, "Unrecognized CR %d\n", cr);
                 abort();
             }
-            RIP(cpu) += ins_len;
+            RIP(env) += ins_len;
             store_regs(cpu);
             break;
         }
@@ -978,10 +987,10 @@  int hvf_vcpu_exec(CPUState *cpu)
             struct x86_decode decode;
 
             load_regs(cpu);
-            cpu->hvf_x86->fetch_rip = rip;
+            env->hvf_emul->fetch_rip = rip;
 
-            decode_instruction(cpu, &decode);
-            exec_instruction(cpu, &decode);
+            decode_instruction(env, &decode);
+            exec_instruction(env, &decode);
             store_regs(cpu);
             break;
         }
diff --git a/target/i386/hvf-utils/x86.c b/target/i386/hvf-utils/x86.c
index 07eb5a8586..0df3d23ec9 100644
--- a/target/i386/hvf-utils/x86.c
+++ b/target/i386/hvf-utils/x86.c
@@ -127,7 +127,9 @@  bool x86_is_real(struct CPUState *cpu)
 
 bool x86_is_v8086(struct CPUState *cpu)
 {
-    return x86_is_protected(cpu) && (RFLAGS(cpu) & RFLAGS_VM);
+    X86CPU *x86_cpu = X86_CPU(cpu);
+    CPUX86State *env = &x86_cpu->env;
+    return x86_is_protected(cpu) && (RFLAGS(env) & RFLAGS_VM);
 }
 
 bool x86_is_long_mode(struct CPUState *cpu)
diff --git a/target/i386/hvf-utils/x86.h b/target/i386/hvf-utils/x86.h
index 435b49ae04..59a21b6e41 100644
--- a/target/i386/hvf-utils/x86.h
+++ b/target/i386/hvf-utils/x86.h
@@ -23,7 +23,7 @@ 
 #include <sys/mman.h>
 #include <stdarg.h>
 #include "qemu-common.h"
-#include "x86_flags.h"
+#include "x86_gen.h"
 
 /* exceptions */
 typedef enum x86_exception {
@@ -356,13 +356,14 @@  typedef struct x68_segment_selector {
     };
 } __attribute__ ((__packed__)) x68_segment_selector;
 
-/* Definition of hvf_x86_state is here */
-struct hvf_x86_state {
-    int hlt;
-    uint64_t init_tsc;
+typedef struct lazy_flags {
+    addr_t result;
+    addr_t auxbits;
+} lazy_flags;
 
+/* Definition of hvf_x86_state is here */
+typedef struct HVFX86EmulatorState {
     int interruptable;
-    uint64_t exp_rip;
     uint64_t fetch_rip;
     uint64_t rip;
     struct x86_register regs[16];
@@ -370,8 +371,7 @@  struct hvf_x86_state {
     struct lazy_flags   lflags;
     struct x86_efer efer;
     uint8_t mmio_buf[4096];
-    uint8_t *apic_page;
-};
+} HVFX86EmulatorState;
 
 /*
 * hvf xsave area
@@ -381,12 +381,12 @@  struct hvf_xsave_buf {
 };
 
 /* useful register access  macros */
-#define RIP(cpu)    (cpu->hvf_x86->rip)
-#define EIP(cpu)    ((uint32_t)cpu->hvf_x86->rip)
-#define RFLAGS(cpu) (cpu->hvf_x86->rflags.rflags)
-#define EFLAGS(cpu) (cpu->hvf_x86->rflags.eflags)
+#define RIP(cpu)    (cpu->hvf_emul->rip)
+#define EIP(cpu)    ((uint32_t)cpu->hvf_emul->rip)
+#define RFLAGS(cpu) (cpu->hvf_emul->rflags.rflags)
+#define EFLAGS(cpu) (cpu->hvf_emul->rflags.eflags)
 
-#define RRX(cpu, reg) (cpu->hvf_x86->regs[reg].rrx)
+#define RRX(cpu, reg) (cpu->hvf_emul->regs[reg].rrx)
 #define RAX(cpu)        RRX(cpu, REG_RAX)
 #define RCX(cpu)        RRX(cpu, REG_RCX)
 #define RDX(cpu)        RRX(cpu, REG_RDX)
@@ -404,7 +404,7 @@  struct hvf_xsave_buf {
 #define R14(cpu)        RRX(cpu, REG_R14)
 #define R15(cpu)        RRX(cpu, REG_R15)
 
-#define ERX(cpu, reg)   (cpu->hvf_x86->regs[reg].erx)
+#define ERX(cpu, reg)   (cpu->hvf_emul->regs[reg].erx)
 #define EAX(cpu)        ERX(cpu, REG_RAX)
 #define ECX(cpu)        ERX(cpu, REG_RCX)
 #define EDX(cpu)        ERX(cpu, REG_RDX)
@@ -414,7 +414,7 @@  struct hvf_xsave_buf {
 #define ESI(cpu)        ERX(cpu, REG_RSI)
 #define EDI(cpu)        ERX(cpu, REG_RDI)
 
-#define RX(cpu, reg)   (cpu->hvf_x86->regs[reg].rx)
+#define RX(cpu, reg)   (cpu->hvf_emul->regs[reg].rx)
 #define AX(cpu)        RX(cpu, REG_RAX)
 #define CX(cpu)        RX(cpu, REG_RCX)
 #define DX(cpu)        RX(cpu, REG_RDX)
@@ -424,13 +424,13 @@  struct hvf_xsave_buf {
 #define SI(cpu)        RX(cpu, REG_RSI)
 #define DI(cpu)        RX(cpu, REG_RDI)
 
-#define RL(cpu, reg)   (cpu->hvf_x86->regs[reg].lx)
+#define RL(cpu, reg)   (cpu->hvf_emul->regs[reg].lx)
 #define AL(cpu)        RL(cpu, REG_RAX)
 #define CL(cpu)        RL(cpu, REG_RCX)
 #define DL(cpu)        RL(cpu, REG_RDX)
 #define BL(cpu)        RL(cpu, REG_RBX)
 
-#define RH(cpu, reg)   (cpu->hvf_x86->regs[reg].hx)
+#define RH(cpu, reg)   (cpu->hvf_emul->regs[reg].hx)
 #define AH(cpu)        RH(cpu, REG_RAX)
 #define CH(cpu)        RH(cpu, REG_RCX)
 #define DH(cpu)        RH(cpu, REG_RDX)
diff --git a/target/i386/hvf-utils/x86_decode.c b/target/i386/hvf-utils/x86_decode.c
index 4faf82f721..e28b1ddade 100644
--- a/target/i386/hvf-utils/x86_decode.c
+++ b/target/i386/hvf-utils/x86_decode.c
@@ -27,9 +27,9 @@ 
 
 #define OPCODE_ESCAPE   0xf
 
-static void decode_invalid(CPUState *cpu, struct x86_decode *decode)
+static void decode_invalid(CPUX86State *env, struct x86_decode *decode)
 {
-    printf("%llx: failed to decode instruction ", cpu->hvf_x86->fetch_rip -
+    printf("%llx: failed to decode instruction ", env->hvf_emul->fetch_rip -
            decode->len);
     for (int i = 0; i < decode->opcode_len; i++) {
         printf("%x ", decode->opcode[i]);
@@ -60,7 +60,7 @@  uint64_t sign(uint64_t val, int size)
     return val;
 }
 
-static inline uint64_t decode_bytes(CPUState *cpu, struct x86_decode *decode,
+static inline uint64_t decode_bytes(CPUX86State *env, struct x86_decode *decode,
                                     int size)
 {
     addr_t val = 0;
@@ -75,129 +75,129 @@  static inline uint64_t decode_bytes(CPUState *cpu, struct x86_decode *decode,
         VM_PANIC_EX("%s invalid size %d\n", __func__, size);
         break;
     }
-    addr_t va  = linear_rip(cpu, RIP(cpu)) + decode->len;
-    vmx_read_mem(cpu, &val, va, size);
+    addr_t va  = linear_rip(ENV_GET_CPU(env), RIP(env)) + decode->len;
+    vmx_read_mem(ENV_GET_CPU(env), &val, va, size);
     decode->len += size;
 
     return val;
 }
 
-static inline uint8_t decode_byte(CPUState *cpu, struct x86_decode *decode)
+static inline uint8_t decode_byte(CPUX86State *env, struct x86_decode *decode)
 {
-    return (uint8_t)decode_bytes(cpu, decode, 1);
+    return (uint8_t)decode_bytes(env, decode, 1);
 }
 
-static inline uint16_t decode_word(CPUState *cpu, struct x86_decode *decode)
+static inline uint16_t decode_word(CPUX86State *env, struct x86_decode *decode)
 {
-    return (uint16_t)decode_bytes(cpu, decode, 2);
+    return (uint16_t)decode_bytes(env, decode, 2);
 }
 
-static inline uint32_t decode_dword(CPUState *cpu, struct x86_decode *decode)
+static inline uint32_t decode_dword(CPUX86State *env, struct x86_decode *decode)
 {
-    return (uint32_t)decode_bytes(cpu, decode, 4);
+    return (uint32_t)decode_bytes(env, decode, 4);
 }
 
-static inline uint64_t decode_qword(CPUState *cpu, struct x86_decode *decode)
+static inline uint64_t decode_qword(CPUX86State *env, struct x86_decode *decode)
 {
-    return decode_bytes(cpu, decode, 8);
+    return decode_bytes(env, decode, 8);
 }
 
-static void decode_modrm_rm(CPUState *cpu, struct x86_decode *decode,
+static void decode_modrm_rm(CPUX86State *env, struct x86_decode *decode,
                             struct x86_decode_op *op)
 {
     op->type = X86_VAR_RM;
 }
 
-static void decode_modrm_reg(CPUState *cpu, struct x86_decode *decode,
+static void decode_modrm_reg(CPUX86State *env, struct x86_decode *decode,
                              struct x86_decode_op *op)
 {
     op->type = X86_VAR_REG;
     op->reg = decode->modrm.reg;
-    op->ptr = get_reg_ref(cpu, op->reg, decode->rex.r, decode->operand_size);
+    op->ptr = get_reg_ref(env, op->reg, decode->rex.r, decode->operand_size);
 }
 
-static void decode_rax(CPUState *cpu, struct x86_decode *decode,
+static void decode_rax(CPUX86State *env, struct x86_decode *decode,
                        struct x86_decode_op *op)
 {
     op->type = X86_VAR_REG;
     op->reg = REG_RAX;
-    op->ptr = get_reg_ref(cpu, op->reg, 0, decode->operand_size);
+    op->ptr = get_reg_ref(env, op->reg, 0, decode->operand_size);
 }
 
-static inline void decode_immediate(CPUState *cpu, struct x86_decode *decode,
+static inline void decode_immediate(CPUX86State *env, struct x86_decode *decode,
                                     struct x86_decode_op *var, int size)
 {
     var->type = X86_VAR_IMMEDIATE;
     var->size = size;
     switch (size) {
     case 1:
-        var->val = decode_byte(cpu, decode);
+        var->val = decode_byte(env, decode);
         break;
     case 2:
-        var->val = decode_word(cpu, decode);
+        var->val = decode_word(env, decode);
         break;
     case 4:
-        var->val = decode_dword(cpu, decode);
+        var->val = decode_dword(env, decode);
         break;
     case 8:
-        var->val = decode_qword(cpu, decode);
+        var->val = decode_qword(env, decode);
         break;
     default:
         VM_PANIC_EX("bad size %d\n", size);
     }
 }
 
-static void decode_imm8(CPUState *cpu, struct x86_decode *decode,
+static void decode_imm8(CPUX86State *env, struct x86_decode *decode,
                         struct x86_decode_op *op)
 {
-    decode_immediate(cpu, decode, op, 1);
+    decode_immediate(env, decode, op, 1);
     op->type = X86_VAR_IMMEDIATE;
 }
 
-static void decode_imm8_signed(CPUState *cpu, struct x86_decode *decode,
+static void decode_imm8_signed(CPUX86State *env, struct x86_decode *decode,
                                struct x86_decode_op *op)
 {
-    decode_immediate(cpu, decode, op, 1);
+    decode_immediate(env, decode, op, 1);
     op->val = sign(op->val, 1);
     op->type = X86_VAR_IMMEDIATE;
 }
 
-static void decode_imm16(CPUState *cpu, struct x86_decode *decode,
+static void decode_imm16(CPUX86State *env, struct x86_decode *decode,
                          struct x86_decode_op *op)
 {
-    decode_immediate(cpu, decode, op, 2);
+    decode_immediate(env, decode, op, 2);
     op->type = X86_VAR_IMMEDIATE;
 }
 
 
-static void decode_imm(CPUState *cpu, struct x86_decode *decode,
+static void decode_imm(CPUX86State *env, struct x86_decode *decode,
                        struct x86_decode_op *op)
 {
     if (8 == decode->operand_size) {
-        decode_immediate(cpu, decode, op, 4);
+        decode_immediate(env, decode, op, 4);
         op->val = sign(op->val, decode->operand_size);
     } else {
-        decode_immediate(cpu, decode, op, decode->operand_size);
+        decode_immediate(env, decode, op, decode->operand_size);
     }
     op->type = X86_VAR_IMMEDIATE;
 }
 
-static void decode_imm_signed(CPUState *cpu, struct x86_decode *decode,
+static void decode_imm_signed(CPUX86State *env, struct x86_decode *decode,
                               struct x86_decode_op *op)
 {
-    decode_immediate(cpu, decode, op, decode->operand_size);
+    decode_immediate(env, decode, op, decode->operand_size);
     op->val = sign(op->val, decode->operand_size);
     op->type = X86_VAR_IMMEDIATE;
 }
 
-static void decode_imm_1(CPUState *cpu, struct x86_decode *decode,
+static void decode_imm_1(CPUX86State *env, struct x86_decode *decode,
                          struct x86_decode_op *op)
 {
     op->type = X86_VAR_IMMEDIATE;
     op->val = 1;
 }
 
-static void decode_imm_0(CPUState *cpu, struct x86_decode *decode,
+static void decode_imm_0(CPUX86State *env, struct x86_decode *decode,
                          struct x86_decode_op *op)
 {
     op->type = X86_VAR_IMMEDIATE;
@@ -205,7 +205,7 @@  static void decode_imm_0(CPUState *cpu, struct x86_decode *decode,
 }
 
 
-static void decode_pushseg(CPUState *cpu, struct x86_decode *decode)
+static void decode_pushseg(CPUX86State *env, struct x86_decode *decode)
 {
     uint8_t op = (decode->opcode_len > 1) ? decode->opcode[1] : decode->opcode[0];
 
@@ -232,7 +232,7 @@  static void decode_pushseg(CPUState *cpu, struct x86_decode *decode)
     }
 }
 
-static void decode_popseg(CPUState *cpu, struct x86_decode *decode)
+static void decode_popseg(CPUX86State *env, struct x86_decode *decode)
 {
     uint8_t op = (decode->opcode_len > 1) ? decode->opcode[1] : decode->opcode[0];
 
@@ -259,23 +259,23 @@  static void decode_popseg(CPUState *cpu, struct x86_decode *decode)
     }
 }
 
-static void decode_incgroup(CPUState *cpu, struct x86_decode *decode)
+static void decode_incgroup(CPUX86State *env, struct x86_decode *decode)
 {
     decode->op[0].type = X86_VAR_REG;
     decode->op[0].reg = decode->opcode[0] - 0x40;
-    decode->op[0].ptr = get_reg_ref(cpu, decode->op[0].reg, decode->rex.b,
+    decode->op[0].ptr = get_reg_ref(env, decode->op[0].reg, decode->rex.b,
                                     decode->operand_size);
 }
 
-static void decode_decgroup(CPUState *cpu, struct x86_decode *decode)
+static void decode_decgroup(CPUX86State *env, struct x86_decode *decode)
 {
     decode->op[0].type = X86_VAR_REG;
     decode->op[0].reg = decode->opcode[0] - 0x48;
-    decode->op[0].ptr = get_reg_ref(cpu, decode->op[0].reg, decode->rex.b,
+    decode->op[0].ptr = get_reg_ref(env, decode->op[0].reg, decode->rex.b,
                                     decode->operand_size);
 }
 
-static void decode_incgroup2(CPUState *cpu, struct x86_decode *decode)
+static void decode_incgroup2(CPUX86State *env, struct x86_decode *decode)
 {
     if (!decode->modrm.reg) {
         decode->cmd = X86_DECODE_CMD_INC;
@@ -284,36 +284,36 @@  static void decode_incgroup2(CPUState *cpu, struct x86_decode *decode)
     }
 }
 
-static void decode_pushgroup(CPUState *cpu, struct x86_decode *decode)
+static void decode_pushgroup(CPUX86State *env, struct x86_decode *decode)
 {
     decode->op[0].type = X86_VAR_REG;
     decode->op[0].reg = decode->opcode[0] - 0x50;
-    decode->op[0].ptr = get_reg_ref(cpu, decode->op[0].reg, decode->rex.b,
+    decode->op[0].ptr = get_reg_ref(env, decode->op[0].reg, decode->rex.b,
                                     decode->operand_size);
 }
 
-static void decode_popgroup(CPUState *cpu, struct x86_decode *decode)
+static void decode_popgroup(CPUX86State *env, struct x86_decode *decode)
 {
     decode->op[0].type = X86_VAR_REG;
     decode->op[0].reg = decode->opcode[0] - 0x58;
-    decode->op[0].ptr = get_reg_ref(cpu, decode->op[0].reg, decode->rex.b,
+    decode->op[0].ptr = get_reg_ref(env, decode->op[0].reg, decode->rex.b,
                                     decode->operand_size);
 }
 
-static void decode_jxx(CPUState *cpu, struct x86_decode *decode)
+static void decode_jxx(CPUX86State *env, struct x86_decode *decode)
 {
-    decode->displacement = decode_bytes(cpu, decode, decode->operand_size);
+    decode->displacement = decode_bytes(env, decode, decode->operand_size);
     decode->displacement_size = decode->operand_size;
 }
 
-static void decode_farjmp(CPUState *cpu, struct x86_decode *decode)
+static void decode_farjmp(CPUX86State *env, struct x86_decode *decode)
 {
     decode->op[0].type = X86_VAR_IMMEDIATE;
-    decode->op[0].val = decode_bytes(cpu, decode, decode->operand_size);
-    decode->displacement = decode_word(cpu, decode);
+    decode->op[0].val = decode_bytes(env, decode, decode->operand_size);
+    decode->displacement = decode_word(env, decode);
 }
 
-static void decode_addgroup(CPUState *cpu, struct x86_decode *decode)
+static void decode_addgroup(CPUX86State *env, struct x86_decode *decode)
 {
     enum x86_decode_cmd group[] = {
         X86_DECODE_CMD_ADD,
@@ -328,7 +328,7 @@  static void decode_addgroup(CPUState *cpu, struct x86_decode *decode)
     decode->cmd = group[decode->modrm.reg];
 }
 
-static void decode_rotgroup(CPUState *cpu, struct x86_decode *decode)
+static void decode_rotgroup(CPUX86State *env, struct x86_decode *decode)
 {
     enum x86_decode_cmd group[] = {
         X86_DECODE_CMD_ROL,
@@ -343,7 +343,7 @@  static void decode_rotgroup(CPUState *cpu, struct x86_decode *decode)
     decode->cmd = group[decode->modrm.reg];
 }
 
-static void decode_f7group(CPUState *cpu, struct x86_decode *decode)
+static void decode_f7group(CPUX86State *env, struct x86_decode *decode)
 {
     enum x86_decode_cmd group[] = {
         X86_DECODE_CMD_TST,
@@ -356,12 +356,12 @@  static void decode_f7group(CPUState *cpu, struct x86_decode *decode)
         X86_DECODE_CMD_IDIV
     };
     decode->cmd = group[decode->modrm.reg];
-    decode_modrm_rm(cpu, decode, &decode->op[0]);
+    decode_modrm_rm(env, decode, &decode->op[0]);
 
     switch (decode->modrm.reg) {
     case 0:
     case 1:
-        decode_imm(cpu, decode, &decode->op[1]);
+        decode_imm(env, decode, &decode->op[1]);
         break;
     case 2:
         break;
@@ -374,45 +374,45 @@  static void decode_f7group(CPUState *cpu, struct x86_decode *decode)
     }
 }
 
-static void decode_xchgroup(CPUState *cpu, struct x86_decode *decode)
+static void decode_xchgroup(CPUX86State *env, struct x86_decode *decode)
 {
     decode->op[0].type = X86_VAR_REG;
     decode->op[0].reg = decode->opcode[0] - 0x90;
-    decode->op[0].ptr = get_reg_ref(cpu, decode->op[0].reg, decode->rex.b,
+    decode->op[0].ptr = get_reg_ref(env, decode->op[0].reg, decode->rex.b,
                                     decode->operand_size);
 }
 
-static void decode_movgroup(CPUState *cpu, struct x86_decode *decode)
+static void decode_movgroup(CPUX86State *env, struct x86_decode *decode)
 {
     decode->op[0].type = X86_VAR_REG;
     decode->op[0].reg = decode->opcode[0] - 0xb8;
-    decode->op[0].ptr = get_reg_ref(cpu, decode->op[0].reg, decode->rex.b,
+    decode->op[0].ptr = get_reg_ref(env, decode->op[0].reg, decode->rex.b,
                                     decode->operand_size);
-    decode_immediate(cpu, decode, &decode->op[1], decode->operand_size);
+    decode_immediate(env, decode, &decode->op[1], decode->operand_size);
 }
 
-static void fetch_moffs(CPUState *cpu, struct x86_decode *decode,
+static void fetch_moffs(CPUX86State *env, struct x86_decode *decode,
                         struct x86_decode_op *op)
 {
     op->type = X86_VAR_OFFSET;
-    op->ptr = decode_bytes(cpu, decode, decode->addressing_size);
+    op->ptr = decode_bytes(env, decode, decode->addressing_size);
 }
 
-static void decode_movgroup8(CPUState *cpu, struct x86_decode *decode)
+static void decode_movgroup8(CPUX86State *env, struct x86_decode *decode)
 {
     decode->op[0].type = X86_VAR_REG;
     decode->op[0].reg = decode->opcode[0] - 0xb0;
-    decode->op[0].ptr = get_reg_ref(cpu, decode->op[0].reg, decode->rex.b,
+    decode->op[0].ptr = get_reg_ref(env, decode->op[0].reg, decode->rex.b,
                                     decode->operand_size);
-    decode_immediate(cpu, decode, &decode->op[1], decode->operand_size);
+    decode_immediate(env, decode, &decode->op[1], decode->operand_size);
 }
 
-static void decode_rcx(CPUState *cpu, struct x86_decode *decode,
+static void decode_rcx(CPUX86State *env, struct x86_decode *decode,
                        struct x86_decode_op *op)
 {
     op->type = X86_VAR_REG;
     op->reg = REG_RCX;
-    op->ptr = get_reg_ref(cpu, op->reg, decode->rex.b, decode->operand_size);
+    op->ptr = get_reg_ref(env, op->reg, decode->rex.b, decode->operand_size);
 }
 
 struct decode_tbl {
@@ -420,15 +420,15 @@  struct decode_tbl {
     enum x86_decode_cmd cmd;
     uint8_t operand_size;
     bool is_modrm;
-    void (*decode_op1)(CPUState *cpu, struct x86_decode *decode,
+    void (*decode_op1)(CPUX86State *env, struct x86_decode *decode,
                        struct x86_decode_op *op1);
-    void (*decode_op2)(CPUState *cpu, struct x86_decode *decode,
+    void (*decode_op2)(CPUX86State *env, struct x86_decode *decode,
                        struct x86_decode_op *op2);
-    void (*decode_op3)(CPUState *cpu, struct x86_decode *decode,
+    void (*decode_op3)(CPUX86State *env, struct x86_decode *decode,
                        struct x86_decode_op *op3);
-    void (*decode_op4)(CPUState *cpu, struct x86_decode *decode,
+    void (*decode_op4)(CPUX86State *env, struct x86_decode *decode,
                        struct x86_decode_op *op4);
-    void (*decode_postfix)(CPUState *cpu, struct x86_decode *decode);
+    void (*decode_postfix)(CPUX86State *env, struct x86_decode *decode);
     addr_t flags_mask;
 };
 
@@ -440,11 +440,11 @@  struct decode_x87_tbl {
     uint8_t operand_size;
     bool rev;
     bool pop;
-    void (*decode_op1)(CPUState *cpu, struct x86_decode *decode,
+    void (*decode_op1)(CPUX86State *env, struct x86_decode *decode,
                        struct x86_decode_op *op1);
-    void (*decode_op2)(CPUState *cpu, struct x86_decode *decode,
+    void (*decode_op2)(CPUX86State *env, struct x86_decode *decode,
                        struct x86_decode_op *op2);
-    void (*decode_postfix)(CPUState *cpu, struct x86_decode *decode);
+    void (*decode_postfix)(CPUX86State *env, struct x86_decode *decode);
     addr_t flags_mask;
 };
 
@@ -455,7 +455,7 @@  struct decode_tbl _decode_tbl1[255];
 struct decode_tbl _decode_tbl2[255];
 struct decode_x87_tbl _decode_tbl3[255];
 
-static void decode_x87_ins(CPUState *cpu, struct x86_decode *decode)
+static void decode_x87_ins(CPUX86State *env, struct x86_decode *decode)
 {
     struct decode_x87_tbl *decoder;
 
@@ -475,13 +475,13 @@  static void decode_x87_ins(CPUState *cpu, struct x86_decode *decode)
     decode->frev = decoder->rev;
 
     if (decoder->decode_op1) {
-        decoder->decode_op1(cpu, decode, &decode->op[0]);
+        decoder->decode_op1(env, decode, &decode->op[0]);
     }
     if (decoder->decode_op2) {
-        decoder->decode_op2(cpu, decode, &decode->op[1]);
+        decoder->decode_op2(env, decode, &decode->op[1]);
     }
     if (decoder->decode_postfix) {
-        decoder->decode_postfix(cpu, decode);
+        decoder->decode_postfix(env, decode);
     }
 
     VM_PANIC_ON_EX(!decode->cmd, "x87 opcode %x %x (%x %x) not decoded\n",
@@ -489,7 +489,7 @@  static void decode_x87_ins(CPUState *cpu, struct x86_decode *decode)
                    decoder->modrm_mod);
 }
 
-static void decode_ffgroup(CPUState *cpu, struct x86_decode *decode)
+static void decode_ffgroup(CPUX86State *env, struct x86_decode *decode)
 {
     enum x86_decode_cmd group[] = {
         X86_DECODE_CMD_INC,
@@ -508,8 +508,9 @@  static void decode_ffgroup(CPUState *cpu, struct x86_decode *decode)
     }
 }
 
-static void decode_sldtgroup(CPUState *cpu, struct x86_decode *decode)
+static void decode_sldtgroup(CPUX86State *env, struct x86_decode *decode)
 {
+
     enum x86_decode_cmd group[] = {
         X86_DECODE_CMD_SLDT,
         X86_DECODE_CMD_STR,
@@ -521,11 +522,11 @@  static void decode_sldtgroup(CPUState *cpu, struct x86_decode *decode)
         X86_DECODE_CMD_INVL
     };
     decode->cmd = group[decode->modrm.reg];
-    printf("%llx: decode_sldtgroup: %d\n", cpu->hvf_x86->fetch_rip,
+    printf("%llx: decode_sldtgroup: %d\n", env->hvf_emul->fetch_rip,
             decode->modrm.reg);
 }
 
-static void decode_lidtgroup(CPUState *cpu, struct x86_decode *decode)
+static void decode_lidtgroup(CPUX86State *env, struct x86_decode *decode)
 {
     enum x86_decode_cmd group[] = {
         X86_DECODE_CMD_SGDT,
@@ -544,7 +545,7 @@  static void decode_lidtgroup(CPUState *cpu, struct x86_decode *decode)
     }
 }
 
-static void decode_btgroup(CPUState *cpu, struct x86_decode *decode)
+static void decode_btgroup(CPUX86State *env, struct x86_decode *decode)
 {
     enum x86_decode_cmd group[] = {
         X86_DECODE_CMD_INVL,
@@ -559,37 +560,37 @@  static void decode_btgroup(CPUState *cpu, struct x86_decode *decode)
     decode->cmd = group[decode->modrm.reg];
 }
 
-static void decode_x87_general(CPUState *cpu, struct x86_decode *decode)
+static void decode_x87_general(CPUX86State *env, struct x86_decode *decode)
 {
     decode->is_fpu = true;
 }
 
-static void decode_x87_modrm_floatp(CPUState *cpu, struct x86_decode *decode,
+static void decode_x87_modrm_floatp(CPUX86State *env, struct x86_decode *decode,
                                     struct x86_decode_op *op)
 {
     op->type = X87_VAR_FLOATP;
 }
 
-static void decode_x87_modrm_intp(CPUState *cpu, struct x86_decode *decode,
+static void decode_x87_modrm_intp(CPUX86State *env, struct x86_decode *decode,
                                   struct x86_decode_op *op)
 {
     op->type = X87_VAR_INTP;
 }
 
-static void decode_x87_modrm_bytep(CPUState *cpu, struct x86_decode *decode,
+static void decode_x87_modrm_bytep(CPUX86State *env, struct x86_decode *decode,
                                    struct x86_decode_op *op)
 {
     op->type = X87_VAR_BYTEP;
 }
 
-static void decode_x87_modrm_st0(CPUState *cpu, struct x86_decode *decode,
+static void decode_x87_modrm_st0(CPUX86State *env, struct x86_decode *decode,
                                  struct x86_decode_op *op)
 {
     op->type = X87_VAR_REG;
     op->reg = 0;
 }
 
-static void decode_decode_x87_modrm_st0(CPUState *cpu,
+static void decode_decode_x87_modrm_st0(CPUX86State *env,
                                         struct x86_decode *decode,
                                         struct x86_decode_op *op)
 {
@@ -598,16 +599,16 @@  static void decode_decode_x87_modrm_st0(CPUState *cpu,
 }
 
 
-static void decode_aegroup(CPUState *cpu, struct x86_decode *decode)
+static void decode_aegroup(CPUX86State *env, struct x86_decode *decode)
 {
     decode->is_fpu = true;
     switch (decode->modrm.reg) {
     case 0:
         decode->cmd = X86_DECODE_CMD_FXSAVE;
-        decode_x87_modrm_bytep(cpu, decode, &decode->op[0]);
+        decode_x87_modrm_bytep(env, decode, &decode->op[0]);
         break;
     case 1:
-        decode_x87_modrm_bytep(cpu, decode, &decode->op[0]);
+        decode_x87_modrm_bytep(env, decode, &decode->op[0]);
         decode->cmd = X86_DECODE_CMD_FXRSTOR;
         break;
     case 5:
@@ -634,15 +635,15 @@  static void decode_aegroup(CPUState *cpu, struct x86_decode *decode)
     }
 }
 
-static void decode_bswap(CPUState *cpu, struct x86_decode *decode)
+static void decode_bswap(CPUX86State *env, struct x86_decode *decode)
 {
     decode->op[0].type = X86_VAR_REG;
     decode->op[0].reg = decode->opcode[1] - 0xc8;
-    decode->op[0].ptr = get_reg_ref(cpu, decode->op[0].reg, decode->rex.b,
+    decode->op[0].ptr = get_reg_ref(env, decode->op[0].reg, decode->rex.b,
                                     decode->operand_size);
 }
 
-static void decode_d9_4(CPUState *cpu, struct x86_decode *decode)
+static void decode_d9_4(CPUX86State *env, struct x86_decode *decode)
 {
     switch (decode->modrm.modrm) {
     case 0xe0:
@@ -665,7 +666,7 @@  static void decode_d9_4(CPUState *cpu, struct x86_decode *decode)
     }
 }
 
-static void decode_db_4(CPUState *cpu, struct x86_decode *decode)
+static void decode_db_4(CPUX86State *env, struct x86_decode *decode)
 {
     switch (decode->modrm.modrm) {
     case 0xe0:
@@ -1633,7 +1634,7 @@  struct decode_x87_tbl _x87_inst[] = {
      decode_x87_modrm_intp, NULL, NULL, RFLAGS_MASK_NONE},
 };
 
-void calc_modrm_operand16(CPUState *cpu, struct x86_decode *decode,
+void calc_modrm_operand16(CPUX86State *env, struct x86_decode *decode,
                           struct x86_decode_op *op)
 {
     addr_t ptr = 0;
@@ -1650,42 +1651,42 @@  void calc_modrm_operand16(CPUState *cpu, struct x86_decode *decode,
 
     switch (decode->modrm.rm) {
     case 0:
-        ptr += BX(cpu) + SI(cpu);
+        ptr += BX(env) + SI(env);
         break;
     case 1:
-        ptr += BX(cpu) + DI(cpu);
+        ptr += BX(env) + DI(env);
         break;
     case 2:
-        ptr += BP(cpu) + SI(cpu);
+        ptr += BP(env) + SI(env);
         seg = REG_SEG_SS;
         break;
     case 3:
-        ptr += BP(cpu) + DI(cpu);
+        ptr += BP(env) + DI(env);
         seg = REG_SEG_SS;
         break;
     case 4:
-        ptr += SI(cpu);
+        ptr += SI(env);
         break;
     case 5:
-        ptr += DI(cpu);
+        ptr += DI(env);
         break;
     case 6:
-        ptr += BP(cpu);
+        ptr += BP(env);
         seg = REG_SEG_SS;
         break;
     case 7:
-        ptr += BX(cpu);
+        ptr += BX(env);
         break;
     }
 calc_addr:
     if (X86_DECODE_CMD_LEA == decode->cmd) {
         op->ptr = (uint16_t)ptr;
     } else {
-        op->ptr = decode_linear_addr(cpu, decode, (uint16_t)ptr, seg);
+        op->ptr = decode_linear_addr(env, decode, (uint16_t)ptr, seg);
     }
 }
 
-addr_t get_reg_ref(CPUState *cpu, int reg, int is_extended, int size)
+addr_t get_reg_ref(CPUX86State *env, int reg, int is_extended, int size)
 {
     addr_t ptr = 0;
     int which = 0;
@@ -1699,28 +1700,28 @@  addr_t get_reg_ref(CPUState *cpu, int reg, int is_extended, int size)
     case 1:
         if (is_extended || reg < 4) {
             which = 1;
-            ptr = (addr_t)&RL(cpu, reg);
+            ptr = (addr_t)&RL(env, reg);
         } else {
             which = 2;
-            ptr = (addr_t)&RH(cpu, reg - 4);
+            ptr = (addr_t)&RH(env, reg - 4);
         }
         break;
     default:
         which = 3;
-        ptr = (addr_t)&RRX(cpu, reg);
+        ptr = (addr_t)&RRX(env, reg);
         break;
     }
     return ptr;
 }
 
-addr_t get_reg_val(CPUState *cpu, int reg, int is_extended, int size)
+addr_t get_reg_val(CPUX86State *env, int reg, int is_extended, int size)
 {
     addr_t val = 0;
-    memcpy(&val, (void *)get_reg_ref(cpu, reg, is_extended, size), size);
+    memcpy(&val, (void *)get_reg_ref(env, reg, is_extended, size), size);
     return val;
 }
 
-static addr_t get_sib_val(CPUState *cpu, struct x86_decode *decode,
+static addr_t get_sib_val(CPUX86State *env, struct x86_decode *decode,
                           x86_reg_segment *sel)
 {
     addr_t base = 0;
@@ -1738,7 +1739,7 @@  static addr_t get_sib_val(CPUState *cpu, struct x86_decode *decode,
         if (REG_RSP == base_reg || REG_RBP == base_reg) {
             *sel = REG_SEG_SS;
         }
-        base = get_reg_val(cpu, decode->sib.base, decode->rex.b, addr_size);
+        base = get_reg_val(env, decode->sib.base, decode->rex.b, addr_size);
     }
 
     if (decode->rex.x) {
@@ -1746,13 +1747,13 @@  static addr_t get_sib_val(CPUState *cpu, struct x86_decode *decode,
     }
 
     if (index_reg != REG_RSP) {
-        scaled_index = get_reg_val(cpu, index_reg, decode->rex.x, addr_size) <<
+        scaled_index = get_reg_val(env, index_reg, decode->rex.x, addr_size) <<
                                    decode->sib.scale;
     }
     return base + scaled_index;
 }
 
-void calc_modrm_operand32(CPUState *cpu, struct x86_decode *decode,
+void calc_modrm_operand32(CPUX86State *env, struct x86_decode *decode,
                           struct x86_decode_op *op)
 {
     x86_reg_segment seg = REG_SEG_DS;
@@ -1764,10 +1765,10 @@  void calc_modrm_operand32(CPUState *cpu, struct x86_decode *decode,
     }
 
     if (4 == decode->modrm.rm) {
-        ptr += get_sib_val(cpu, decode, &seg);
+        ptr += get_sib_val(env, decode, &seg);
     } else if (!decode->modrm.mod && 5 == decode->modrm.rm) {
-        if (x86_is_long_mode(cpu)) {
-            ptr += RIP(cpu) + decode->len;
+        if (x86_is_long_mode(ENV_GET_CPU(env))) {
+            ptr += RIP(env) + decode->len;
         } else {
             ptr = decode->displacement;
         }
@@ -1775,17 +1776,17 @@  void calc_modrm_operand32(CPUState *cpu, struct x86_decode *decode,
         if (REG_RBP == decode->modrm.rm || REG_RSP == decode->modrm.rm) {
             seg = REG_SEG_SS;
         }
-        ptr += get_reg_val(cpu, decode->modrm.rm, decode->rex.b, addr_size);
+        ptr += get_reg_val(env, decode->modrm.rm, decode->rex.b, addr_size);
     }
 
     if (X86_DECODE_CMD_LEA == decode->cmd) {
         op->ptr = (uint32_t)ptr;
     } else {
-        op->ptr = decode_linear_addr(cpu, decode, (uint32_t)ptr, seg);
+        op->ptr = decode_linear_addr(env, decode, (uint32_t)ptr, seg);
     }
 }
 
-void calc_modrm_operand64(CPUState *cpu, struct x86_decode *decode,
+void calc_modrm_operand64(CPUX86State *env, struct x86_decode *decode,
                           struct x86_decode_op *op)
 {
     x86_reg_segment seg = REG_SEG_DS;
@@ -1800,41 +1801,41 @@  void calc_modrm_operand64(CPUState *cpu, struct x86_decode *decode,
     }
 
     if (4 == rm) {
-        ptr = get_sib_val(cpu, decode, &seg) + offset;
+        ptr = get_sib_val(env, decode, &seg) + offset;
     } else if (0 == mod && 5 == rm) {
-        ptr = RIP(cpu) + decode->len + (int32_t) offset;
+        ptr = RIP(env) + decode->len + (int32_t) offset;
     } else {
-        ptr = get_reg_val(cpu, src, decode->rex.b, 8) + (int64_t) offset;
+        ptr = get_reg_val(env, src, decode->rex.b, 8) + (int64_t) offset;
     }
 
     if (X86_DECODE_CMD_LEA == decode->cmd) {
         op->ptr = ptr;
     } else {
-        op->ptr = decode_linear_addr(cpu, decode, ptr, seg);
+        op->ptr = decode_linear_addr(env, decode, ptr, seg);
     }
 }
 
 
-void calc_modrm_operand(CPUState *cpu, struct x86_decode *decode,
+void calc_modrm_operand(CPUX86State *env, struct x86_decode *decode,
                         struct x86_decode_op *op)
 {
     if (3 == decode->modrm.mod) {
         op->reg = decode->modrm.reg;
         op->type = X86_VAR_REG;
-        op->ptr = get_reg_ref(cpu, decode->modrm.rm, decode->rex.b,
+        op->ptr = get_reg_ref(env, decode->modrm.rm, decode->rex.b,
                               decode->operand_size);
         return;
     }
 
     switch (decode->addressing_size) {
     case 2:
-        calc_modrm_operand16(cpu, decode, op);
+        calc_modrm_operand16(env, decode, op);
         break;
     case 4:
-        calc_modrm_operand32(cpu, decode, op);
+        calc_modrm_operand32(env, decode, op);
         break;
     case 8:
-        calc_modrm_operand64(cpu, decode, op);
+        calc_modrm_operand64(env, decode, op);
         break;
     default:
         VM_PANIC_EX("unsupported address size %d\n", decode->addressing_size);
@@ -1842,10 +1843,10 @@  void calc_modrm_operand(CPUState *cpu, struct x86_decode *decode,
     }
 }
 
-static void decode_prefix(CPUState *cpu, struct x86_decode *decode)
+static void decode_prefix(CPUX86State *env, struct x86_decode *decode)
 {
     while (1) {
-        uint8_t byte = decode_byte(cpu, decode);
+        uint8_t byte = decode_byte(env, decode);
         switch (byte) {
         case PREFIX_LOCK:
             decode->lock = byte;
@@ -1869,7 +1870,7 @@  static void decode_prefix(CPUState *cpu, struct x86_decode *decode)
             decode->addr_size_override = byte;
             break;
         case PREFIX_REX ... (PREFIX_REX + 0xf):
-            if (x86_is_long_mode(cpu)) {
+            if (x86_is_long_mode(ENV_GET_CPU(env))) {
                 decode->rex.rex = byte;
                 break;
             }
@@ -1881,19 +1882,19 @@  static void decode_prefix(CPUState *cpu, struct x86_decode *decode)
     }
 }
 
-void set_addressing_size(CPUState *cpu, struct x86_decode *decode)
+void set_addressing_size(CPUX86State *env, struct x86_decode *decode)
 {
     decode->addressing_size = -1;
-    if (x86_is_real(cpu) || x86_is_v8086(cpu)) {
+    if (x86_is_real(ENV_GET_CPU(env)) || x86_is_v8086(ENV_GET_CPU(env))) {
         if (decode->addr_size_override) {
             decode->addressing_size = 4;
         } else {
             decode->addressing_size = 2;
         }
-    } else if (!x86_is_long_mode(cpu)) {
+    } else if (!x86_is_long_mode(ENV_GET_CPU(env))) {
         /* protected */
         struct vmx_segment cs;
-        vmx_read_segment_descriptor(cpu, &cs, REG_SEG_CS);
+        vmx_read_segment_descriptor(ENV_GET_CPU(env), &cs, REG_SEG_CS);
         /* check db */
         if ((cs.ar >> 14) & 1) {
             if (decode->addr_size_override) {
@@ -1918,19 +1919,19 @@  void set_addressing_size(CPUState *cpu, struct x86_decode *decode)
     }
 }
 
-void set_operand_size(CPUState *cpu, struct x86_decode *decode)
+void set_operand_size(CPUX86State *env, struct x86_decode *decode)
 {
     decode->operand_size = -1;
-    if (x86_is_real(cpu) || x86_is_v8086(cpu)) {
+    if (x86_is_real(ENV_GET_CPU(env)) || x86_is_v8086(ENV_GET_CPU(env))) {
         if (decode->op_size_override) {
             decode->operand_size = 4;
         } else {
             decode->operand_size = 2;
         }
-    } else if (!x86_is_long_mode(cpu)) {
+    } else if (!x86_is_long_mode(ENV_GET_CPU(env))) {
         /* protected */
         struct vmx_segment cs;
-        vmx_read_segment_descriptor(cpu, &cs, REG_SEG_CS);
+        vmx_read_segment_descriptor(ENV_GET_CPU(env), &cs, REG_SEG_CS);
         /* check db */
         if ((cs.ar >> 14) & 1) {
             if (decode->op_size_override) {
@@ -1959,11 +1960,11 @@  void set_operand_size(CPUState *cpu, struct x86_decode *decode)
     }
 }
 
-static void decode_sib(CPUState *cpu, struct x86_decode *decode)
+static void decode_sib(CPUX86State *env, struct x86_decode *decode)
 {
     if ((decode->modrm.mod != 3) && (4 == decode->modrm.rm) &&
         (decode->addressing_size != 2)) {
-        decode->sib.sib = decode_byte(cpu, decode);
+        decode->sib.sib = decode_byte(env, decode);
         decode->sib_present = true;
     }
 }
@@ -1984,7 +1985,7 @@  int disp32_tbl[4][8] = {
     {0, 0, 0, 0, 0, 0, 0, 0}
 };
 
-static inline void decode_displacement(CPUState *cpu, struct x86_decode *decode)
+static inline void decode_displacement(CPUX86State *env, struct x86_decode *decode)
 {
     int addressing_size = decode->addressing_size;
     int mod = decode->modrm.mod;
@@ -1995,7 +1996,7 @@  static inline void decode_displacement(CPUState *cpu, struct x86_decode *decode)
     case 2:
         decode->displacement_size = disp16_tbl[mod][rm];
         if (decode->displacement_size) {
-            decode->displacement = (uint16_t)decode_bytes(cpu, decode,
+            decode->displacement = (uint16_t)decode_bytes(env, decode,
                                     decode->displacement_size);
         }
         break;
@@ -2010,23 +2011,23 @@  static inline void decode_displacement(CPUState *cpu, struct x86_decode *decode)
         }
 
         if (decode->displacement_size) {
-            decode->displacement = (uint32_t)decode_bytes(cpu, decode,
+            decode->displacement = (uint32_t)decode_bytes(env, decode,
                                                 decode->displacement_size);
         }
         break;
     }
 }
 
-static inline void decode_modrm(CPUState *cpu, struct x86_decode *decode)
+static inline void decode_modrm(CPUX86State *env, struct x86_decode *decode)
 {
-    decode->modrm.modrm = decode_byte(cpu, decode);
+    decode->modrm.modrm = decode_byte(env, decode);
     decode->is_modrm = true;
 
-    decode_sib(cpu, decode);
-    decode_displacement(cpu, decode);
+    decode_sib(env, decode);
+    decode_displacement(env, decode);
 }
 
-static inline void decode_opcode_general(CPUState *cpu,
+static inline void decode_opcode_general(CPUX86State *env,
                                          struct x86_decode *decode,
                                          uint8_t opcode,
                                          struct decode_tbl *inst_decoder)
@@ -2038,69 +2039,69 @@  static inline void decode_opcode_general(CPUState *cpu,
     decode->flags_mask = inst_decoder->flags_mask;
 
     if (inst_decoder->is_modrm) {
-        decode_modrm(cpu, decode);
+        decode_modrm(env, decode);
     }
     if (inst_decoder->decode_op1) {
-        inst_decoder->decode_op1(cpu, decode, &decode->op[0]);
+        inst_decoder->decode_op1(env, decode, &decode->op[0]);
     }
     if (inst_decoder->decode_op2) {
-        inst_decoder->decode_op2(cpu, decode, &decode->op[1]);
+        inst_decoder->decode_op2(env, decode, &decode->op[1]);
     }
     if (inst_decoder->decode_op3) {
-        inst_decoder->decode_op3(cpu, decode, &decode->op[2]);
+        inst_decoder->decode_op3(env, decode, &decode->op[2]);
     }
     if (inst_decoder->decode_op4) {
-        inst_decoder->decode_op4(cpu, decode, &decode->op[3]);
+        inst_decoder->decode_op4(env, decode, &decode->op[3]);
     }
     if (inst_decoder->decode_postfix) {
-        inst_decoder->decode_postfix(cpu, decode);
+        inst_decoder->decode_postfix(env, decode);
     }
 }
 
-static inline void decode_opcode_1(CPUState *cpu, struct x86_decode *decode,
+static inline void decode_opcode_1(CPUX86State *env, struct x86_decode *decode,
                                    uint8_t opcode)
 {
     struct decode_tbl *inst_decoder = &_decode_tbl1[opcode];
-    decode_opcode_general(cpu, decode, opcode, inst_decoder);
+    decode_opcode_general(env, decode, opcode, inst_decoder);
 }
 
 
-static inline void decode_opcode_2(CPUState *cpu, struct x86_decode *decode,
+static inline void decode_opcode_2(CPUX86State *env, struct x86_decode *decode,
                                    uint8_t opcode)
 {
     struct decode_tbl *inst_decoder = &_decode_tbl2[opcode];
-    decode_opcode_general(cpu, decode, opcode, inst_decoder);
+    decode_opcode_general(env, decode, opcode, inst_decoder);
 }
 
-static void decode_opcodes(CPUState *cpu, struct x86_decode *decode)
+static void decode_opcodes(CPUX86State *env, struct x86_decode *decode)
 {
     uint8_t opcode;
 
-    opcode = decode_byte(cpu, decode);
+    opcode = decode_byte(env, decode);
     decode->opcode[decode->opcode_len++] = opcode;
     if (opcode != OPCODE_ESCAPE) {
-        decode_opcode_1(cpu, decode, opcode);
+        decode_opcode_1(env, decode, opcode);
     } else {
-        opcode = decode_byte(cpu, decode);
+        opcode = decode_byte(env, decode);
         decode->opcode[decode->opcode_len++] = opcode;
-        decode_opcode_2(cpu, decode, opcode);
+        decode_opcode_2(env, decode, opcode);
     }
 }
 
-uint32_t decode_instruction(CPUState *cpu, struct x86_decode *decode)
+uint32_t decode_instruction(CPUX86State *env, struct x86_decode *decode)
 {
     ZERO_INIT(*decode);
 
-    decode_prefix(cpu, decode);
-    set_addressing_size(cpu, decode);
-    set_operand_size(cpu, decode);
+    decode_prefix(env, decode);
+    set_addressing_size(env, decode);
+    set_operand_size(env, decode);
 
-    decode_opcodes(cpu, decode);
+    decode_opcodes(env, decode);
 
     return decode->len;
 }
 
-void init_decoder(CPUState *cpu)
+void init_decoder()
 {
     int i;
 
@@ -2156,7 +2157,7 @@  const char *decode_cmd_to_string(enum x86_decode_cmd cmd)
     return cmds[cmd];
 }
 
-addr_t decode_linear_addr(struct CPUState *cpu, struct x86_decode *decode,
+addr_t decode_linear_addr(CPUX86State *env, struct x86_decode *decode,
                           addr_t addr, x86_reg_segment seg)
 {
     switch (decode->segment_override) {
@@ -2181,5 +2182,5 @@  addr_t decode_linear_addr(struct CPUState *cpu, struct x86_decode *decode,
     default:
         break;
     }
-    return linear_addr_size(cpu, addr, decode->addressing_size, seg);
+    return linear_addr_size(ENV_GET_CPU(env), addr, decode->addressing_size, seg);
 }
diff --git a/target/i386/hvf-utils/x86_decode.h b/target/i386/hvf-utils/x86_decode.h
index b6763e1ba1..1c41cc9456 100644
--- a/target/i386/hvf-utils/x86_decode.h
+++ b/target/i386/hvf-utils/x86_decode.h
@@ -23,6 +23,7 @@ 
 #include <stdarg.h>
 #include "qemu-common.h"
 #include "x86.h"
+#include "cpu.h"
 
 typedef enum x86_prefix {
     /* group 1 */
@@ -304,21 +305,21 @@  typedef struct x86_decode {
 
 uint64_t sign(uint64_t val, int size);
 
-uint32_t decode_instruction(CPUState *cpu, struct x86_decode *decode);
+uint32_t decode_instruction(CPUX86State *env, struct x86_decode *decode);
 
-addr_t get_reg_ref(CPUState *cpu, int reg, int is_extended, int size);
-addr_t get_reg_val(CPUState *cpu, int reg, int is_extended, int size);
-void calc_modrm_operand(CPUState *cpu, struct x86_decode *decode,
+addr_t get_reg_ref(CPUX86State *env, int reg, int is_extended, int size);
+addr_t get_reg_val(CPUX86State *env, int reg, int is_extended, int size);
+void calc_modrm_operand(CPUX86State *env, struct x86_decode *decode,
                         struct x86_decode_op *op);
-addr_t decode_linear_addr(struct CPUState *cpu, struct x86_decode *decode,
+addr_t decode_linear_addr(CPUX86State *env, struct x86_decode *decode,
                           addr_t addr, x86_reg_segment seg);
 
-void init_decoder(CPUState *cpu);
-void calc_modrm_operand16(CPUState *cpu, struct x86_decode *decode,
+void init_decoder(void);
+void calc_modrm_operand16(CPUX86State *env, struct x86_decode *decode,
                           struct x86_decode_op *op);
-void calc_modrm_operand32(CPUState *cpu, struct x86_decode *decode,
+void calc_modrm_operand32(CPUX86State *env, struct x86_decode *decode,
                           struct x86_decode_op *op);
-void calc_modrm_operand64(CPUState *cpu, struct x86_decode *decode,
+void calc_modrm_operand64(CPUX86State *env, struct x86_decode *decode,
                           struct x86_decode_op *op);
-void set_addressing_size(CPUState *cpu, struct x86_decode *decode);
-void set_operand_size(CPUState *cpu, struct x86_decode *decode);
+void set_addressing_size(CPUX86State *env, struct x86_decode *decode);
+void set_operand_size(CPUX86State *env, struct x86_decode *decode);
diff --git a/target/i386/hvf-utils/x86_emu.c b/target/i386/hvf-utils/x86_emu.c
index dc33cd2576..10eed3b606 100644
--- a/target/i386/hvf-utils/x86_emu.c
+++ b/target/i386/hvf-utils/x86_emu.c
@@ -42,15 +42,16 @@ 
 #include "x86.h"
 #include "x86_emu.h"
 #include "x86_mmu.h"
+#include "x86_flags.h"
 #include "vmcs.h"
 #include "vmx.h"
 
 void hvf_handle_io(struct CPUState *cpu, uint16_t port, void *data,
                    int direction, int size, uint32_t count);
 
-#define EXEC_2OP_LOGIC_CMD(cpu, decode, cmd, FLAGS_FUNC, save_res) \
+#define EXEC_2OP_LOGIC_CMD(env, decode, cmd, FLAGS_FUNC, save_res) \
 {                                                       \
-    fetch_operands(cpu, decode, 2, true, true, false);  \
+    fetch_operands(env, decode, 2, true, true, false);  \
     switch (decode->operand_size) {                     \
     case 1:                                         \
     {                                               \
@@ -58,7 +59,7 @@  void hvf_handle_io(struct CPUState *cpu, uint16_t port, void *data,
         uint8_t v2 = (uint8_t)decode->op[1].val;    \
         uint8_t diff = v1 cmd v2;                   \
         if (save_res) {                              \
-            write_val_ext(cpu, decode->op[0].ptr, diff, 1);  \
+            write_val_ext(env, decode->op[0].ptr, diff, 1);  \
         } \
         FLAGS_FUNC##_8(diff);                       \
         break;                                      \
@@ -69,7 +70,7 @@  void hvf_handle_io(struct CPUState *cpu, uint16_t port, void *data,
         uint16_t v2 = (uint16_t)decode->op[1].val;  \
         uint16_t diff = v1 cmd v2;                  \
         if (save_res) {                              \
-            write_val_ext(cpu, decode->op[0].ptr, diff, 2); \
+            write_val_ext(env, decode->op[0].ptr, diff, 2); \
         } \
         FLAGS_FUNC##_16(diff);                      \
         break;                                      \
@@ -80,7 +81,7 @@  void hvf_handle_io(struct CPUState *cpu, uint16_t port, void *data,
         uint32_t v2 = (uint32_t)decode->op[1].val;  \
         uint32_t diff = v1 cmd v2;                  \
         if (save_res) {                              \
-            write_val_ext(cpu, decode->op[0].ptr, diff, 4); \
+            write_val_ext(env, decode->op[0].ptr, diff, 4); \
         } \
         FLAGS_FUNC##_32(diff);                      \
         break;                                      \
@@ -91,9 +92,9 @@  void hvf_handle_io(struct CPUState *cpu, uint16_t port, void *data,
 }                                                       \
 
 
-#define EXEC_2OP_ARITH_CMD(cpu, decode, cmd, FLAGS_FUNC, save_res) \
+#define EXEC_2OP_ARITH_CMD(env, decode, cmd, FLAGS_FUNC, save_res) \
 {                                                       \
-    fetch_operands(cpu, decode, 2, true, true, false);  \
+    fetch_operands(env, decode, 2, true, true, false);  \
     switch (decode->operand_size) {                     \
     case 1:                                         \
     {                                               \
@@ -101,7 +102,7 @@  void hvf_handle_io(struct CPUState *cpu, uint16_t port, void *data,
         uint8_t v2 = (uint8_t)decode->op[1].val;    \
         uint8_t diff = v1 cmd v2;                   \
         if (save_res) {                              \
-            write_val_ext(cpu, decode->op[0].ptr, diff, 1);  \
+            write_val_ext(env, decode->op[0].ptr, diff, 1);  \
         } \
         FLAGS_FUNC##_8(v1, v2, diff);               \
         break;                                      \
@@ -112,7 +113,7 @@  void hvf_handle_io(struct CPUState *cpu, uint16_t port, void *data,
         uint16_t v2 = (uint16_t)decode->op[1].val;  \
         uint16_t diff = v1 cmd v2;                  \
         if (save_res) {                              \
-            write_val_ext(cpu, decode->op[0].ptr, diff, 2); \
+            write_val_ext(env, decode->op[0].ptr, diff, 2); \
         } \
         FLAGS_FUNC##_16(v1, v2, diff);              \
         break;                                      \
@@ -123,7 +124,7 @@  void hvf_handle_io(struct CPUState *cpu, uint16_t port, void *data,
         uint32_t v2 = (uint32_t)decode->op[1].val;  \
         uint32_t diff = v1 cmd v2;                  \
         if (save_res) {                              \
-            write_val_ext(cpu, decode->op[0].ptr, diff, 4); \
+            write_val_ext(env, decode->op[0].ptr, diff, 4); \
         } \
         FLAGS_FUNC##_32(v1, v2, diff);              \
         break;                                      \
@@ -133,37 +134,37 @@  void hvf_handle_io(struct CPUState *cpu, uint16_t port, void *data,
     }                                                   \
 }
 
-addr_t read_reg(struct CPUState *cpu, int reg, int size)
+addr_t read_reg(CPUX86State *env, int reg, int size)
 {
     switch (size) {
     case 1:
-        return cpu->hvf_x86->regs[reg].lx;
+        return env->hvf_emul->regs[reg].lx;
     case 2:
-        return cpu->hvf_x86->regs[reg].rx;
+        return env->hvf_emul->regs[reg].rx;
     case 4:
-        return cpu->hvf_x86->regs[reg].erx;
+        return env->hvf_emul->regs[reg].erx;
     case 8:
-        return cpu->hvf_x86->regs[reg].rrx;
+        return env->hvf_emul->regs[reg].rrx;
     default:
         VM_PANIC_ON("read_reg size");
     }
     return 0;
 }
 
-void write_reg(struct CPUState *cpu, int reg, addr_t val, int size)
+void write_reg(CPUX86State *env, int reg, addr_t val, int size)
 {
     switch (size) {
     case 1:
-        cpu->hvf_x86->regs[reg].lx = val;
+        env->hvf_emul->regs[reg].lx = val;
         break;
     case 2:
-        cpu->hvf_x86->regs[reg].rx = val;
+        env->hvf_emul->regs[reg].rx = val;
         break;
     case 4:
-        cpu->hvf_x86->regs[reg].rrx = (uint32_t)val;
+        env->hvf_emul->regs[reg].rrx = (uint32_t)val;
         break;
     case 8:
-        cpu->hvf_x86->regs[reg].rrx = val;
+        env->hvf_emul->regs[reg].rrx = val;
         break;
     default:
         VM_PANIC_ON("write_reg size");
@@ -215,38 +216,36 @@  void write_val_to_reg(addr_t reg_ptr, addr_t val, int size)
     }
 }
 
-static bool is_host_reg(struct CPUState *cpu, addr_t ptr)
+static bool is_host_reg(struct CPUX86State *env, addr_t ptr)
 {
-    return (ptr > (addr_t)cpu && ptr < (addr_t)cpu + sizeof(struct CPUState)) ||
-           (ptr > (addr_t)cpu->hvf_x86 && ptr <
-            (addr_t)(cpu->hvf_x86 + sizeof(struct hvf_x86_state)));
+    return (ptr - (addr_t)&env->hvf_emul->regs[0]) < sizeof(env->hvf_emul->regs);
 }
 
-void write_val_ext(struct CPUState *cpu, addr_t ptr, addr_t val, int size)
+void write_val_ext(struct CPUX86State *env, addr_t ptr, addr_t val, int size)
 {
-    if (is_host_reg(cpu, ptr)) {
+    if (is_host_reg(env, ptr)) {
         write_val_to_reg(ptr, val, size);
         return;
     }
-    vmx_write_mem(cpu, ptr, &val, size);
+    vmx_write_mem(ENV_GET_CPU(env), ptr, &val, size);
 }
 
-uint8_t *read_mmio(struct CPUState *cpu, addr_t ptr, int bytes)
+uint8_t *read_mmio(struct CPUX86State *env, addr_t ptr, int bytes)
 {
-    vmx_read_mem(cpu, cpu->hvf_x86->mmio_buf, ptr, bytes);
-    return cpu->hvf_x86->mmio_buf;
+    vmx_read_mem(ENV_GET_CPU(env), env->hvf_emul->mmio_buf, ptr, bytes);
+    return env->hvf_emul->mmio_buf;
 }
 
-addr_t read_val_ext(struct CPUState *cpu, addr_t ptr, int size)
+addr_t read_val_ext(struct CPUX86State *env, addr_t ptr, int size)
 {
     addr_t val;
     uint8_t *mmio_ptr;
 
-    if (is_host_reg(cpu, ptr)) {
+    if (is_host_reg(env, ptr)) {
         return read_val_from_reg(ptr, size);
     }
 
-    mmio_ptr = read_mmio(cpu, ptr, size);
+    mmio_ptr = read_mmio(env, ptr, size);
     switch (size) {
     case 1:
         val = *(uint8_t *)mmio_ptr;
@@ -267,7 +266,7 @@  addr_t read_val_ext(struct CPUState *cpu, addr_t ptr, int size)
     return val;
 }
 
-static void fetch_operands(struct CPUState *cpu, struct x86_decode *decode,
+static void fetch_operands(struct CPUX86State *env, struct x86_decode *decode,
                            int n, bool val_op0, bool val_op1, bool val_op2)
 {
     int i;
@@ -285,18 +284,18 @@  static void fetch_operands(struct CPUState *cpu, struct x86_decode *decode,
             }
             break;
         case X86_VAR_RM:
-            calc_modrm_operand(cpu, decode, &decode->op[i]);
+            calc_modrm_operand(env, decode, &decode->op[i]);
             if (calc_val[i]) {
-                decode->op[i].val = read_val_ext(cpu, decode->op[i].ptr,
+                decode->op[i].val = read_val_ext(env, decode->op[i].ptr,
                                                  decode->operand_size);
             }
             break;
         case X86_VAR_OFFSET:
-            decode->op[i].ptr = decode_linear_addr(cpu, decode,
+            decode->op[i].ptr = decode_linear_addr(env, decode,
                                                    decode->op[i].ptr,
                                                    REG_SEG_DS);
             if (calc_val[i]) {
-                decode->op[i].val = read_val_ext(cpu, decode->op[i].ptr,
+                decode->op[i].val = read_val_ext(env, decode->op[i].ptr,
                                                  decode->operand_size);
             }
             break;
@@ -306,65 +305,65 @@  static void fetch_operands(struct CPUState *cpu, struct x86_decode *decode,
     }
 }
 
-static void exec_mov(struct CPUState *cpu, struct x86_decode *decode)
+static void exec_mov(struct CPUX86State *env, struct x86_decode *decode)
 {
-    fetch_operands(cpu, decode, 2, false, true, false);
-    write_val_ext(cpu, decode->op[0].ptr, decode->op[1].val,
+    fetch_operands(env, decode, 2, false, true, false);
+    write_val_ext(env, decode->op[0].ptr, decode->op[1].val,
                   decode->operand_size);
 
-    RIP(cpu) += decode->len;
+    RIP(env) += decode->len;
 }
 
-static void exec_add(struct CPUState *cpu, struct x86_decode *decode)
+static void exec_add(struct CPUX86State *env, struct x86_decode *decode)
 {
-    EXEC_2OP_ARITH_CMD(cpu, decode, +, SET_FLAGS_OSZAPC_ADD, true);
-    RIP(cpu) += decode->len;
+    EXEC_2OP_ARITH_CMD(env, decode, +, SET_FLAGS_OSZAPC_ADD, true);
+    RIP(env) += decode->len;
 }
 
-static void exec_or(struct CPUState *cpu, struct x86_decode *decode)
+static void exec_or(struct CPUX86State *env, struct x86_decode *decode)
 {
-    EXEC_2OP_LOGIC_CMD(cpu, decode, |, SET_FLAGS_OSZAPC_LOGIC, true);
-    RIP(cpu) += decode->len;
+    EXEC_2OP_LOGIC_CMD(env, decode, |, SET_FLAGS_OSZAPC_LOGIC, true);
+    RIP(env) += decode->len;
 }
 
-static void exec_adc(struct CPUState *cpu, struct x86_decode *decode)
+static void exec_adc(struct CPUX86State *env, struct x86_decode *decode)
 {
-    EXEC_2OP_ARITH_CMD(cpu, decode, +get_CF(cpu)+, SET_FLAGS_OSZAPC_ADD, true);
-    RIP(cpu) += decode->len;
+    EXEC_2OP_ARITH_CMD(env, decode, +get_CF(env)+, SET_FLAGS_OSZAPC_ADD, true);
+    RIP(env) += decode->len;
 }
 
-static void exec_sbb(struct CPUState *cpu, struct x86_decode *decode)
+static void exec_sbb(struct CPUX86State *env, struct x86_decode *decode)
 {
-    EXEC_2OP_ARITH_CMD(cpu, decode, -get_CF(cpu)-, SET_FLAGS_OSZAPC_SUB, true);
-    RIP(cpu) += decode->len;
+    EXEC_2OP_ARITH_CMD(env, decode, -get_CF(env)-, SET_FLAGS_OSZAPC_SUB, true);
+    RIP(env) += decode->len;
 }
 
-static void exec_and(struct CPUState *cpu, struct x86_decode *decode)
+static void exec_and(struct CPUX86State *env, struct x86_decode *decode)
 {
-    EXEC_2OP_LOGIC_CMD(cpu, decode, &, SET_FLAGS_OSZAPC_LOGIC, true);
-    RIP(cpu) += decode->len;
+    EXEC_2OP_LOGIC_CMD(env, decode, &, SET_FLAGS_OSZAPC_LOGIC, true);
+    RIP(env) += decode->len;
 }
 
-static void exec_sub(struct CPUState *cpu, struct x86_decode *decode)
+static void exec_sub(struct CPUX86State *env, struct x86_decode *decode)
 {
-    EXEC_2OP_ARITH_CMD(cpu, decode, -, SET_FLAGS_OSZAPC_SUB, true);
-    RIP(cpu) += decode->len;
+    EXEC_2OP_ARITH_CMD(env, decode, -, SET_FLAGS_OSZAPC_SUB, true);
+    RIP(env) += decode->len;
 }
 
-static void exec_xor(struct CPUState *cpu, struct x86_decode *decode)
+static void exec_xor(struct CPUX86State *env, struct x86_decode *decode)
 {
-    EXEC_2OP_LOGIC_CMD(cpu, decode, ^, SET_FLAGS_OSZAPC_LOGIC, true);
-    RIP(cpu) += decode->len;
+    EXEC_2OP_LOGIC_CMD(env, decode, ^, SET_FLAGS_OSZAPC_LOGIC, true);
+    RIP(env) += decode->len;
 }
 
-static void exec_neg(struct CPUState *cpu, struct x86_decode *decode)
+static void exec_neg(struct CPUX86State *env, struct x86_decode *decode)
 {
-    /*EXEC_2OP_ARITH_CMD(cpu, decode, -, SET_FLAGS_OSZAPC_SUB, false);*/
+    /*EXEC_2OP_ARITH_CMD(env, decode, -, SET_FLAGS_OSZAPC_SUB, false);*/
     int32_t val;
-    fetch_operands(cpu, decode, 2, true, true, false);
+    fetch_operands(env, decode, 2, true, true, false);
 
     val = 0 - sign(decode->op[1].val, decode->operand_size);
-    write_val_ext(cpu, decode->op[1].ptr, val, decode->operand_size);
+    write_val_ext(env, decode->op[1].ptr, val, decode->operand_size);
 
     if (4 == decode->operand_size) {
         SET_FLAGS_OSZAPC_SUB_32(0, 0 - val, val);
@@ -376,56 +375,56 @@  static void exec_neg(struct CPUState *cpu, struct x86_decode *decode)
         VM_PANIC("bad op size\n");
     }
 
-    /*lflags_to_rflags(cpu);*/
-    RIP(cpu) += decode->len;
+    /*lflags_to_rflags(env);*/
+    RIP(env) += decode->len;
 }
 
-static void exec_cmp(struct CPUState *cpu, struct x86_decode *decode)
+static void exec_cmp(struct CPUX86State *env, struct x86_decode *decode)
 {
-    EXEC_2OP_ARITH_CMD(cpu, decode, -, SET_FLAGS_OSZAPC_SUB, false);
-    RIP(cpu) += decode->len;
+    EXEC_2OP_ARITH_CMD(env, decode, -, SET_FLAGS_OSZAPC_SUB, false);
+    RIP(env) += decode->len;
 }
 
-static void exec_inc(struct CPUState *cpu, struct x86_decode *decode)
+static void exec_inc(struct CPUX86State *env, struct x86_decode *decode)
 {
     decode->op[1].type = X86_VAR_IMMEDIATE;
     decode->op[1].val = 0;
 
-    EXEC_2OP_ARITH_CMD(cpu, decode, +1+, SET_FLAGS_OSZAP_ADD, true);
+    EXEC_2OP_ARITH_CMD(env, decode, +1+, SET_FLAGS_OSZAP_ADD, true);
 
-    RIP(cpu) += decode->len;
+    RIP(env) += decode->len;
 }
 
-static void exec_dec(struct CPUState *cpu, struct x86_decode *decode)
+static void exec_dec(struct CPUX86State *env, struct x86_decode *decode)
 {
     decode->op[1].type = X86_VAR_IMMEDIATE;
     decode->op[1].val = 0;
 
-    EXEC_2OP_ARITH_CMD(cpu, decode, -1-, SET_FLAGS_OSZAP_SUB, true);
-    RIP(cpu) += decode->len;
+    EXEC_2OP_ARITH_CMD(env, decode, -1-, SET_FLAGS_OSZAP_SUB, true);
+    RIP(env) += decode->len;
 }
 
-static void exec_tst(struct CPUState *cpu, struct x86_decode *decode)
+static void exec_tst(struct CPUX86State *env, struct x86_decode *decode)
 {
-    EXEC_2OP_LOGIC_CMD(cpu, decode, &, SET_FLAGS_OSZAPC_LOGIC, false);
-    RIP(cpu) += decode->len;
+    EXEC_2OP_LOGIC_CMD(env, decode, &, SET_FLAGS_OSZAPC_LOGIC, false);
+    RIP(env) += decode->len;
 }
 
-static void exec_not(struct CPUState *cpu, struct x86_decode *decode)
+static void exec_not(struct CPUX86State *env, struct x86_decode *decode)
 {
-    fetch_operands(cpu, decode, 1, true, false, false);
+    fetch_operands(env, decode, 1, true, false, false);
 
-    write_val_ext(cpu, decode->op[0].ptr, ~decode->op[0].val,
+    write_val_ext(env, decode->op[0].ptr, ~decode->op[0].val,
                   decode->operand_size);
-    RIP(cpu) += decode->len;
+    RIP(env) += decode->len;
 }
 
-void exec_movzx(struct CPUState *cpu, struct x86_decode *decode)
+void exec_movzx(struct CPUX86State *env, struct x86_decode *decode)
 {
     int src_op_size;
     int op_size = decode->operand_size;
 
-    fetch_operands(cpu, decode, 1, false, false, false);
+    fetch_operands(env, decode, 1, false, false, false);
 
     if (0xb6 == decode->opcode[1]) {
         src_op_size = 1;
@@ -433,60 +432,60 @@  void exec_movzx(struct CPUState *cpu, struct x86_decode *decode)
         src_op_size = 2;
     }
     decode->operand_size = src_op_size;
-    calc_modrm_operand(cpu, decode, &decode->op[1]);
-    decode->op[1].val = read_val_ext(cpu, decode->op[1].ptr, src_op_size);
-    write_val_ext(cpu, decode->op[0].ptr, decode->op[1].val, op_size);
+    calc_modrm_operand(env, decode, &decode->op[1]);
+    decode->op[1].val = read_val_ext(env, decode->op[1].ptr, src_op_size);
+    write_val_ext(env, decode->op[0].ptr, decode->op[1].val, op_size);
 
-    RIP(cpu) += decode->len;
+    RIP(env) += decode->len;
 }
 
-static void exec_out(struct CPUState *cpu, struct x86_decode *decode)
+static void exec_out(struct CPUX86State *env, struct x86_decode *decode)
 {
     switch (decode->opcode[0]) {
     case 0xe6:
-        hvf_handle_io(cpu, decode->op[0].val, &AL(cpu), 1, 1, 1);
+        hvf_handle_io(ENV_GET_CPU(env), decode->op[0].val, &AL(env), 1, 1, 1);
         break;
     case 0xe7:
-        hvf_handle_io(cpu, decode->op[0].val, &RAX(cpu), 1,
+        hvf_handle_io(ENV_GET_CPU(env), decode->op[0].val, &RAX(env), 1,
                       decode->operand_size, 1);
         break;
     case 0xee:
-        hvf_handle_io(cpu, DX(cpu), &AL(cpu), 1, 1, 1);
+        hvf_handle_io(ENV_GET_CPU(env), DX(env), &AL(env), 1, 1, 1);
         break;
     case 0xef:
-        hvf_handle_io(cpu, DX(cpu), &RAX(cpu), 1, decode->operand_size, 1);
+        hvf_handle_io(ENV_GET_CPU(env), DX(env), &RAX(env), 1, decode->operand_size, 1);
         break;
     default:
         VM_PANIC("Bad out opcode\n");
         break;
     }
-    RIP(cpu) += decode->len;
+    RIP(env) += decode->len;
 }
 
-static void exec_in(struct CPUState *cpu, struct x86_decode *decode)
+static void exec_in(struct CPUX86State *env, struct x86_decode *decode)
 {
     addr_t val = 0;
     switch (decode->opcode[0]) {
     case 0xe4:
-        hvf_handle_io(cpu, decode->op[0].val, &AL(cpu), 0, 1, 1);
+        hvf_handle_io(ENV_GET_CPU(env), decode->op[0].val, &AL(env), 0, 1, 1);
         break;
     case 0xe5:
-        hvf_handle_io(cpu, decode->op[0].val, &val, 0, decode->operand_size, 1);
+        hvf_handle_io(ENV_GET_CPU(env), decode->op[0].val, &val, 0, decode->operand_size, 1);
         if (decode->operand_size == 2) {
-            AX(cpu) = val;
+            AX(env) = val;
         } else {
-            RAX(cpu) = (uint32_t)val;
+            RAX(env) = (uint32_t)val;
         }
         break;
     case 0xec:
-        hvf_handle_io(cpu, DX(cpu), &AL(cpu), 0, 1, 1);
+        hvf_handle_io(ENV_GET_CPU(env), DX(env), &AL(env), 0, 1, 1);
         break;
     case 0xed:
-        hvf_handle_io(cpu, DX(cpu), &val, 0, decode->operand_size, 1);
+        hvf_handle_io(ENV_GET_CPU(env), DX(env), &val, 0, decode->operand_size, 1);
         if (decode->operand_size == 2) {
-            AX(cpu) = val;
+            AX(env) = val;
         } else {
-            RAX(cpu) = (uint32_t)val;
+            RAX(env) = (uint32_t)val;
         }
 
         break;
@@ -495,212 +494,212 @@  static void exec_in(struct CPUState *cpu, struct x86_decode *decode)
         break;
     }
 
-    RIP(cpu) += decode->len;
+    RIP(env) += decode->len;
 }
 
-static inline void string_increment_reg(struct CPUState *cpu, int reg,
+static inline void string_increment_reg(struct CPUX86State *env, int reg,
                                         struct x86_decode *decode)
 {
-    addr_t val = read_reg(cpu, reg, decode->addressing_size);
-    if (cpu->hvf_x86->rflags.df) {
+    addr_t val = read_reg(env, reg, decode->addressing_size);
+    if (env->hvf_emul->rflags.df) {
         val -= decode->operand_size;
     } else {
         val += decode->operand_size;
     }
-    write_reg(cpu, reg, val, decode->addressing_size);
+    write_reg(env, reg, val, decode->addressing_size);
 }
 
-static inline void string_rep(struct CPUState *cpu, struct x86_decode *decode,
-                              void (*func)(struct CPUState *cpu,
+static inline void string_rep(struct CPUX86State *env, struct x86_decode *decode,
+                              void (*func)(struct CPUX86State *env,
                                            struct x86_decode *ins), int rep)
 {
-    addr_t rcx = read_reg(cpu, REG_RCX, decode->addressing_size);
+    addr_t rcx = read_reg(env, REG_RCX, decode->addressing_size);
     while (rcx--) {
-        func(cpu, decode);
-        write_reg(cpu, REG_RCX, rcx, decode->addressing_size);
-        if ((PREFIX_REP == rep) && !get_ZF(cpu)) {
+        func(env, decode);
+        write_reg(env, REG_RCX, rcx, decode->addressing_size);
+        if ((PREFIX_REP == rep) && !get_ZF(env)) {
             break;
         }
-        if ((PREFIX_REPN == rep) && get_ZF(cpu)) {
+        if ((PREFIX_REPN == rep) && get_ZF(env)) {
             break;
         }
     }
 }
 
-static void exec_ins_single(struct CPUState *cpu, struct x86_decode *decode)
+static void exec_ins_single(struct CPUX86State *env, struct x86_decode *decode)
 {
-    addr_t addr = linear_addr_size(cpu, RDI(cpu), decode->addressing_size,
+    addr_t addr = linear_addr_size(ENV_GET_CPU(env), RDI(env), decode->addressing_size,
                                    REG_SEG_ES);
 
-    hvf_handle_io(cpu, DX(cpu), cpu->hvf_x86->mmio_buf, 0,
+    hvf_handle_io(ENV_GET_CPU(env), DX(env), env->hvf_emul->mmio_buf, 0,
                   decode->operand_size, 1);
-    vmx_write_mem(cpu, addr, cpu->hvf_x86->mmio_buf, decode->operand_size);
+    vmx_write_mem(ENV_GET_CPU(env), addr, env->hvf_emul->mmio_buf, decode->operand_size);
 
-    string_increment_reg(cpu, REG_RDI, decode);
+    string_increment_reg(env, REG_RDI, decode);
 }
 
-static void exec_ins(struct CPUState *cpu, struct x86_decode *decode)
+static void exec_ins(struct CPUX86State *env, struct x86_decode *decode)
 {
     if (decode->rep) {
-        string_rep(cpu, decode, exec_ins_single, 0);
+        string_rep(env, decode, exec_ins_single, 0);
     } else {
-        exec_ins_single(cpu, decode);
+        exec_ins_single(env, decode);
     }
 
-    RIP(cpu) += decode->len;
+    RIP(env) += decode->len;
 }
 
-static void exec_outs_single(struct CPUState *cpu, struct x86_decode *decode)
+static void exec_outs_single(struct CPUX86State *env, struct x86_decode *decode)
 {
-    addr_t addr = decode_linear_addr(cpu, decode, RSI(cpu), REG_SEG_DS);
+    addr_t addr = decode_linear_addr(env, decode, RSI(env), REG_SEG_DS);
 
-    vmx_read_mem(cpu, cpu->hvf_x86->mmio_buf, addr, decode->operand_size);
-    hvf_handle_io(cpu, DX(cpu), cpu->hvf_x86->mmio_buf, 1,
+    vmx_read_mem(ENV_GET_CPU(env), env->hvf_emul->mmio_buf, addr, decode->operand_size);
+    hvf_handle_io(ENV_GET_CPU(env), DX(env), env->hvf_emul->mmio_buf, 1,
                   decode->operand_size, 1);
 
-    string_increment_reg(cpu, REG_RSI, decode);
+    string_increment_reg(env, REG_RSI, decode);
 }
 
-static void exec_outs(struct CPUState *cpu, struct x86_decode *decode)
+static void exec_outs(struct CPUX86State *env, struct x86_decode *decode)
 {
     if (decode->rep) {
-        string_rep(cpu, decode, exec_outs_single, 0);
+        string_rep(env, decode, exec_outs_single, 0);
     } else {
-        exec_outs_single(cpu, decode);
+        exec_outs_single(env, decode);
     }
 
-    RIP(cpu) += decode->len;
+    RIP(env) += decode->len;
 }
 
-static void exec_movs_single(struct CPUState *cpu, struct x86_decode *decode)
+static void exec_movs_single(struct CPUX86State *env, struct x86_decode *decode)
 {
     addr_t src_addr;
     addr_t dst_addr;
     addr_t val;
 
-    src_addr = decode_linear_addr(cpu, decode, RSI(cpu), REG_SEG_DS);
-    dst_addr = linear_addr_size(cpu, RDI(cpu), decode->addressing_size,
+    src_addr = decode_linear_addr(env, decode, RSI(env), REG_SEG_DS);
+    dst_addr = linear_addr_size(ENV_GET_CPU(env), RDI(env), decode->addressing_size,
                                 REG_SEG_ES);
 
-    val = read_val_ext(cpu, src_addr, decode->operand_size);
-    write_val_ext(cpu, dst_addr, val, decode->operand_size);
+    val = read_val_ext(env, src_addr, decode->operand_size);
+    write_val_ext(env, dst_addr, val, decode->operand_size);
 
-    string_increment_reg(cpu, REG_RSI, decode);
-    string_increment_reg(cpu, REG_RDI, decode);
+    string_increment_reg(env, REG_RSI, decode);
+    string_increment_reg(env, REG_RDI, decode);
 }
 
-static void exec_movs(struct CPUState *cpu, struct x86_decode *decode)
+static void exec_movs(struct CPUX86State *env, struct x86_decode *decode)
 {
     if (decode->rep) {
-        string_rep(cpu, decode, exec_movs_single, 0);
+        string_rep(env, decode, exec_movs_single, 0);
     } else {
-        exec_movs_single(cpu, decode);
+        exec_movs_single(env, decode);
     }
 
-    RIP(cpu) += decode->len;
+    RIP(env) += decode->len;
 }
 
-static void exec_cmps_single(struct CPUState *cpu, struct x86_decode *decode)
+static void exec_cmps_single(struct CPUX86State *env, struct x86_decode *decode)
 {
     addr_t src_addr;
     addr_t dst_addr;
 
-    src_addr = decode_linear_addr(cpu, decode, RSI(cpu), REG_SEG_DS);
-    dst_addr = linear_addr_size(cpu, RDI(cpu), decode->addressing_size,
+    src_addr = decode_linear_addr(env, decode, RSI(env), REG_SEG_DS);
+    dst_addr = linear_addr_size(ENV_GET_CPU(env), RDI(env), decode->addressing_size,
                                 REG_SEG_ES);
 
     decode->op[0].type = X86_VAR_IMMEDIATE;
-    decode->op[0].val = read_val_ext(cpu, src_addr, decode->operand_size);
+    decode->op[0].val = read_val_ext(env, src_addr, decode->operand_size);
     decode->op[1].type = X86_VAR_IMMEDIATE;
-    decode->op[1].val = read_val_ext(cpu, dst_addr, decode->operand_size);
+    decode->op[1].val = read_val_ext(env, dst_addr, decode->operand_size);
 
-    EXEC_2OP_ARITH_CMD(cpu, decode, -, SET_FLAGS_OSZAPC_SUB, false);
+    EXEC_2OP_ARITH_CMD(env, decode, -, SET_FLAGS_OSZAPC_SUB, false);
 
-    string_increment_reg(cpu, REG_RSI, decode);
-    string_increment_reg(cpu, REG_RDI, decode);
+    string_increment_reg(env, REG_RSI, decode);
+    string_increment_reg(env, REG_RDI, decode);
 }
 
-static void exec_cmps(struct CPUState *cpu, struct x86_decode *decode)
+static void exec_cmps(struct CPUX86State *env, struct x86_decode *decode)
 {
     if (decode->rep) {
-        string_rep(cpu, decode, exec_cmps_single, decode->rep);
+        string_rep(env, decode, exec_cmps_single, decode->rep);
     } else {
-        exec_cmps_single(cpu, decode);
+        exec_cmps_single(env, decode);
     }
-    RIP(cpu) += decode->len;
+    RIP(env) += decode->len;
 }
 
 
-static void exec_stos_single(struct CPUState *cpu, struct x86_decode *decode)
+static void exec_stos_single(struct CPUX86State *env, struct x86_decode *decode)
 {
     addr_t addr;
     addr_t val;
 
-    addr = linear_addr_size(cpu, RDI(cpu), decode->addressing_size, REG_SEG_ES);
-    val = read_reg(cpu, REG_RAX, decode->operand_size);
-    vmx_write_mem(cpu, addr, &val, decode->operand_size);
+    addr = linear_addr_size(ENV_GET_CPU(env), RDI(env), decode->addressing_size, REG_SEG_ES);
+    val = read_reg(env, REG_RAX, decode->operand_size);
+    vmx_write_mem(ENV_GET_CPU(env), addr, &val, decode->operand_size);
 
-    string_increment_reg(cpu, REG_RDI, decode);
+    string_increment_reg(env, REG_RDI, decode);
 }
 
 
-static void exec_stos(struct CPUState *cpu, struct x86_decode *decode)
+static void exec_stos(struct CPUX86State *env, struct x86_decode *decode)
 {
     if (decode->rep) {
-        string_rep(cpu, decode, exec_stos_single, 0);
+        string_rep(env, decode, exec_stos_single, 0);
     } else {
-        exec_stos_single(cpu, decode);
+        exec_stos_single(env, decode);
     }
 
-    RIP(cpu) += decode->len;
+    RIP(env) += decode->len;
 }
 
-static void exec_scas_single(struct CPUState *cpu, struct x86_decode *decode)
+static void exec_scas_single(struct CPUX86State *env, struct x86_decode *decode)
 {
     addr_t addr;
 
-    addr = linear_addr_size(cpu, RDI(cpu), decode->addressing_size, REG_SEG_ES);
+    addr = linear_addr_size(ENV_GET_CPU(env), RDI(env), decode->addressing_size, REG_SEG_ES);
     decode->op[1].type = X86_VAR_IMMEDIATE;
-    vmx_read_mem(cpu, &decode->op[1].val, addr, decode->operand_size);
+    vmx_read_mem(ENV_GET_CPU(env), &decode->op[1].val, addr, decode->operand_size);
 
-    EXEC_2OP_ARITH_CMD(cpu, decode, -, SET_FLAGS_OSZAPC_SUB, false);
-    string_increment_reg(cpu, REG_RDI, decode);
+    EXEC_2OP_ARITH_CMD(env, decode, -, SET_FLAGS_OSZAPC_SUB, false);
+    string_increment_reg(env, REG_RDI, decode);
 }
 
-static void exec_scas(struct CPUState *cpu, struct x86_decode *decode)
+static void exec_scas(struct CPUX86State *env, struct x86_decode *decode)
 {
     decode->op[0].type = X86_VAR_REG;
     decode->op[0].reg = REG_RAX;
     if (decode->rep) {
-        string_rep(cpu, decode, exec_scas_single, decode->rep);
+        string_rep(env, decode, exec_scas_single, decode->rep);
     } else {
-        exec_scas_single(cpu, decode);
+        exec_scas_single(env, decode);
     }
 
-    RIP(cpu) += decode->len;
+    RIP(env) += decode->len;
 }
 
-static void exec_lods_single(struct CPUState *cpu, struct x86_decode *decode)
+static void exec_lods_single(struct CPUX86State *env, struct x86_decode *decode)
 {
     addr_t addr;
     addr_t val = 0;
 
-    addr = decode_linear_addr(cpu, decode, RSI(cpu), REG_SEG_DS);
-    vmx_read_mem(cpu, &val, addr,  decode->operand_size);
-    write_reg(cpu, REG_RAX, val, decode->operand_size);
+    addr = decode_linear_addr(env, decode, RSI(env), REG_SEG_DS);
+    vmx_read_mem(ENV_GET_CPU(env), &val, addr,  decode->operand_size);
+    write_reg(env, REG_RAX, val, decode->operand_size);
 
-    string_increment_reg(cpu, REG_RSI, decode);
+    string_increment_reg(env, REG_RSI, decode);
 }
 
-static void exec_lods(struct CPUState *cpu, struct x86_decode *decode)
+static void exec_lods(struct CPUX86State *env, struct x86_decode *decode)
 {
     if (decode->rep) {
-        string_rep(cpu, decode, exec_lods_single, 0);
+        string_rep(env, decode, exec_lods_single, 0);
     } else {
-        exec_lods_single(cpu, decode);
+        exec_lods_single(env, decode);
     }
 
-    RIP(cpu) += decode->len;
+    RIP(env) += decode->len;
 }
 
 #define MSR_IA32_UCODE_REV 0x00000017
@@ -709,7 +708,7 @@  void simulate_rdmsr(struct CPUState *cpu)
 {
     X86CPU *x86_cpu = X86_CPU(cpu);
     CPUX86State *env = &x86_cpu->env;
-    uint32_t msr = ECX(cpu);
+    uint32_t msr = ECX(env);
     uint64_t val = 0;
 
     switch (msr) {
@@ -754,7 +753,7 @@  void simulate_rdmsr(struct CPUState *cpu)
     case MSR_MTRRphysBase(5):
     case MSR_MTRRphysBase(6):
     case MSR_MTRRphysBase(7):
-        val = env->mtrr_var[(ECX(cpu) - MSR_MTRRphysBase(0)) / 2].base;
+        val = env->mtrr_var[(ECX(env) - MSR_MTRRphysBase(0)) / 2].base;
         break;
     case MSR_MTRRphysMask(0):
     case MSR_MTRRphysMask(1):
@@ -764,14 +763,14 @@  void simulate_rdmsr(struct CPUState *cpu)
     case MSR_MTRRphysMask(5):
     case MSR_MTRRphysMask(6):
     case MSR_MTRRphysMask(7):
-        val = env->mtrr_var[(ECX(cpu) - MSR_MTRRphysMask(0)) / 2].mask;
+        val = env->mtrr_var[(ECX(env) - MSR_MTRRphysMask(0)) / 2].mask;
         break;
     case MSR_MTRRfix64K_00000:
         val = env->mtrr_fixed[0];
         break;
     case MSR_MTRRfix16K_80000:
     case MSR_MTRRfix16K_A0000:
-        val = env->mtrr_fixed[ECX(cpu) - MSR_MTRRfix16K_80000 + 1];
+        val = env->mtrr_fixed[ECX(env) - MSR_MTRRfix16K_80000 + 1];
         break;
     case MSR_MTRRfix4K_C0000:
     case MSR_MTRRfix4K_C8000:
@@ -781,7 +780,7 @@  void simulate_rdmsr(struct CPUState *cpu)
     case MSR_MTRRfix4K_E8000:
     case MSR_MTRRfix4K_F0000:
     case MSR_MTRRfix4K_F8000:
-        val = env->mtrr_fixed[ECX(cpu) - MSR_MTRRfix4K_C0000 + 3];
+        val = env->mtrr_fixed[ECX(env) - MSR_MTRRfix4K_C0000 + 3];
         break;
     case MSR_MTRRdefType:
         val = env->mtrr_deftype;
@@ -792,22 +791,22 @@  void simulate_rdmsr(struct CPUState *cpu)
         break;
     }
 
-    RAX(cpu) = (uint32_t)val;
-    RDX(cpu) = (uint32_t)(val >> 32);
+    RAX(env) = (uint32_t)val;
+    RDX(env) = (uint32_t)(val >> 32);
 }
 
-static void exec_rdmsr(struct CPUState *cpu, struct x86_decode *decode)
+static void exec_rdmsr(struct CPUX86State *env, struct x86_decode *decode)
 {
-    simulate_rdmsr(cpu);
-    RIP(cpu) += decode->len;
+    simulate_rdmsr(ENV_GET_CPU(env));
+    RIP(env) += decode->len;
 }
 
 void simulate_wrmsr(struct CPUState *cpu)
 {
     X86CPU *x86_cpu = X86_CPU(cpu);
     CPUX86State *env = &x86_cpu->env;
-    uint32_t msr = ECX(cpu);
-    uint64_t data = ((uint64_t)EDX(cpu) << 32) | EAX(cpu);
+    uint32_t msr = ECX(env);
+    uint64_t data = ((uint64_t)EDX(env) << 32) | EAX(env);
 
     switch (msr) {
     case MSR_IA32_TSC:
@@ -837,7 +836,7 @@  void simulate_wrmsr(struct CPUState *cpu)
         abort();
         break;
     case MSR_EFER:
-        cpu->hvf_x86->efer.efer = data;
+        env->hvf_emul->efer.efer = data;
         /*printf("new efer %llx\n", EFER(cpu));*/
         wvmcs(cpu->hvf_fd, VMCS_GUEST_IA32_EFER, data);
         if (data & EFER_NXE) {
@@ -852,7 +851,7 @@  void simulate_wrmsr(struct CPUState *cpu)
     case MSR_MTRRphysBase(5):
     case MSR_MTRRphysBase(6):
     case MSR_MTRRphysBase(7):
-        env->mtrr_var[(ECX(cpu) - MSR_MTRRphysBase(0)) / 2].base = data;
+        env->mtrr_var[(ECX(env) - MSR_MTRRphysBase(0)) / 2].base = data;
         break;
     case MSR_MTRRphysMask(0):
     case MSR_MTRRphysMask(1):
@@ -862,14 +861,14 @@  void simulate_wrmsr(struct CPUState *cpu)
     case MSR_MTRRphysMask(5):
     case MSR_MTRRphysMask(6):
     case MSR_MTRRphysMask(7):
-        env->mtrr_var[(ECX(cpu) - MSR_MTRRphysMask(0)) / 2].mask = data;
+        env->mtrr_var[(ECX(env) - MSR_MTRRphysMask(0)) / 2].mask = data;
         break;
     case MSR_MTRRfix64K_00000:
-        env->mtrr_fixed[ECX(cpu) - MSR_MTRRfix64K_00000] = data;
+        env->mtrr_fixed[ECX(env) - MSR_MTRRfix64K_00000] = data;
         break;
     case MSR_MTRRfix16K_80000:
     case MSR_MTRRfix16K_A0000:
-        env->mtrr_fixed[ECX(cpu) - MSR_MTRRfix16K_80000 + 1] = data;
+        env->mtrr_fixed[ECX(env) - MSR_MTRRfix16K_80000 + 1] = data;
         break;
     case MSR_MTRRfix4K_C0000:
     case MSR_MTRRfix4K_C8000:
@@ -879,7 +878,7 @@  void simulate_wrmsr(struct CPUState *cpu)
     case MSR_MTRRfix4K_E8000:
     case MSR_MTRRfix4K_F0000:
     case MSR_MTRRfix4K_F8000:
-        env->mtrr_fixed[ECX(cpu) - MSR_MTRRfix4K_C0000 + 3] = data;
+        env->mtrr_fixed[ECX(env) - MSR_MTRRfix4K_C0000 + 3] = data;
         break;
     case MSR_MTRRdefType:
         env->mtrr_deftype = data;
@@ -895,17 +894,17 @@  void simulate_wrmsr(struct CPUState *cpu)
     printf("write msr %llx\n", RCX(cpu));*/
 }
 
-static void exec_wrmsr(struct CPUState *cpu, struct x86_decode *decode)
+static void exec_wrmsr(struct CPUX86State *env, struct x86_decode *decode)
 {
-    simulate_wrmsr(cpu);
-    RIP(cpu) += decode->len;
+    simulate_wrmsr(ENV_GET_CPU(env));
+    RIP(env) += decode->len;
 }
 
 /*
  * flag:
  * 0 - bt, 1 - btc, 2 - bts, 3 - btr
  */
-static void do_bt(struct CPUState *cpu, struct x86_decode *decode, int flag)
+static void do_bt(struct CPUX86State *env, struct x86_decode *decode, int flag)
 {
     int32_t displacement;
     uint8_t index;
@@ -914,7 +913,7 @@  static void do_bt(struct CPUState *cpu, struct x86_decode *decode, int flag)
 
     VM_PANIC_ON(decode->rex.rex);
 
-    fetch_operands(cpu, decode, 2, false, true, false);
+    fetch_operands(env, decode, 2, false, true, false);
     index = decode->op[1].val & mask;
 
     if (decode->op[0].type != X86_VAR_REG) {
@@ -928,13 +927,13 @@  static void do_bt(struct CPUState *cpu, struct x86_decode *decode, int flag)
             VM_PANIC("bt 64bit\n");
         }
     }
-    decode->op[0].val = read_val_ext(cpu, decode->op[0].ptr,
+    decode->op[0].val = read_val_ext(env, decode->op[0].ptr,
                                      decode->operand_size);
     cf = (decode->op[0].val >> index) & 0x01;
 
     switch (flag) {
     case 0:
-        set_CF(cpu, cf);
+        set_CF(env, cf);
         return;
     case 1:
         decode->op[0].val ^= (1u << index);
@@ -946,41 +945,41 @@  static void do_bt(struct CPUState *cpu, struct x86_decode *decode, int flag)
         decode->op[0].val &= ~(1u << index);
         break;
     }
-    write_val_ext(cpu, decode->op[0].ptr, decode->op[0].val,
+    write_val_ext(env, decode->op[0].ptr, decode->op[0].val,
                   decode->operand_size);
-    set_CF(cpu, cf);
+    set_CF(env, cf);
 }
 
-static void exec_bt(struct CPUState *cpu, struct x86_decode *decode)
+static void exec_bt(struct CPUX86State *env, struct x86_decode *decode)
 {
-    do_bt(cpu, decode, 0);
-    RIP(cpu) += decode->len;
+    do_bt(env, decode, 0);
+    RIP(env) += decode->len;
 }
 
-static void exec_btc(struct CPUState *cpu, struct x86_decode *decode)
+static void exec_btc(struct CPUX86State *env, struct x86_decode *decode)
 {
-    do_bt(cpu, decode, 1);
-    RIP(cpu) += decode->len;
+    do_bt(env, decode, 1);
+    RIP(env) += decode->len;
 }
 
-static void exec_btr(struct CPUState *cpu, struct x86_decode *decode)
+static void exec_btr(struct CPUX86State *env, struct x86_decode *decode)
 {
-    do_bt(cpu, decode, 3);
-    RIP(cpu) += decode->len;
+    do_bt(env, decode, 3);
+    RIP(env) += decode->len;
 }
 
-static void exec_bts(struct CPUState *cpu, struct x86_decode *decode)
+static void exec_bts(struct CPUX86State *env, struct x86_decode *decode)
 {
-    do_bt(cpu, decode, 2);
-    RIP(cpu) += decode->len;
+    do_bt(env, decode, 2);
+    RIP(env) += decode->len;
 }
 
-void exec_shl(struct CPUState *cpu, struct x86_decode *decode)
+void exec_shl(struct CPUX86State *env, struct x86_decode *decode)
 {
     uint8_t count;
     int of = 0, cf = 0;
 
-    fetch_operands(cpu, decode, 2, true, true, false);
+    fetch_operands(env, decode, 2, true, true, false);
 
     count = decode->op[1].val;
     count &= 0x1f;      /* count is masked to 5 bits*/
@@ -998,9 +997,9 @@  void exec_shl(struct CPUState *cpu, struct x86_decode *decode)
             of = cf ^ (res >> 7);
         }
 
-        write_val_ext(cpu, decode->op[0].ptr, res, 1);
+        write_val_ext(env, decode->op[0].ptr, res, 1);
         SET_FLAGS_OSZAPC_LOGIC_8(res);
-        SET_FLAGS_OxxxxC(cpu, of, cf);
+        SET_FLAGS_OxxxxC(env, of, cf);
         break;
     }
     case 2:
@@ -1014,20 +1013,20 @@  void exec_shl(struct CPUState *cpu, struct x86_decode *decode)
             of = cf ^ (res >> 15); /* of = cf ^ result15 */
         }
 
-        write_val_ext(cpu, decode->op[0].ptr, res, 2);
+        write_val_ext(env, decode->op[0].ptr, res, 2);
         SET_FLAGS_OSZAPC_LOGIC_16(res);
-        SET_FLAGS_OxxxxC(cpu, of, cf);
+        SET_FLAGS_OxxxxC(env, of, cf);
         break;
     }
     case 4:
     {
         uint32_t res = decode->op[0].val << count;
 
-        write_val_ext(cpu, decode->op[0].ptr, res, 4);
+        write_val_ext(env, decode->op[0].ptr, res, 4);
         SET_FLAGS_OSZAPC_LOGIC_32(res);
         cf = (decode->op[0].val >> (32 - count)) & 0x1;
         of = cf ^ (res >> 31); /* of = cf ^ result31 */
-        SET_FLAGS_OxxxxC(cpu, of, cf);
+        SET_FLAGS_OxxxxC(env, of, cf);
         break;
     }
     default:
@@ -1035,16 +1034,16 @@  void exec_shl(struct CPUState *cpu, struct x86_decode *decode)
     }
 
 exit:
-    /* lflags_to_rflags(cpu); */
-    RIP(cpu) += decode->len;
+    /* lflags_to_rflags(env); */
+    RIP(env) += decode->len;
 }
 
-void exec_movsx(struct CPUState *cpu, struct x86_decode *decode)
+void exec_movsx(CPUX86State *env, struct x86_decode *decode)
 {
     int src_op_size;
     int op_size = decode->operand_size;
 
-    fetch_operands(cpu, decode, 2, false, false, false);
+    fetch_operands(env, decode, 2, false, false, false);
 
     if (0xbe == decode->opcode[1]) {
         src_op_size = 1;
@@ -1053,20 +1052,20 @@  void exec_movsx(struct CPUState *cpu, struct x86_decode *decode)
     }
 
     decode->operand_size = src_op_size;
-    calc_modrm_operand(cpu, decode, &decode->op[1]);
-    decode->op[1].val = sign(read_val_ext(cpu, decode->op[1].ptr, src_op_size),
+    calc_modrm_operand(env, decode, &decode->op[1]);
+    decode->op[1].val = sign(read_val_ext(env, decode->op[1].ptr, src_op_size),
                              src_op_size);
 
-    write_val_ext(cpu, decode->op[0].ptr, decode->op[1].val, op_size);
+    write_val_ext(env, decode->op[0].ptr, decode->op[1].val, op_size);
 
-    RIP(cpu) += decode->len;
+    RIP(env) += decode->len;
 }
 
-void exec_ror(struct CPUState *cpu, struct x86_decode *decode)
+void exec_ror(struct CPUX86State *env, struct x86_decode *decode)
 {
     uint8_t count;
 
-    fetch_operands(cpu, decode, 2, true, true, false);
+    fetch_operands(env, decode, 2, true, true, false);
     count = decode->op[1].val;
 
     switch (decode->operand_size) {
@@ -1079,17 +1078,17 @@  void exec_ror(struct CPUState *cpu, struct x86_decode *decode)
             if (count & 0x18) {
                 bit6 = ((uint8_t)decode->op[0].val >> 6) & 1;
                 bit7 = ((uint8_t)decode->op[0].val >> 7) & 1;
-                SET_FLAGS_OxxxxC(cpu, bit6 ^ bit7, bit7);
+                SET_FLAGS_OxxxxC(env, bit6 ^ bit7, bit7);
              }
         } else {
             count &= 0x7; /* use only bottom 3 bits */
             res = ((uint8_t)decode->op[0].val >> count) |
                    ((uint8_t)decode->op[0].val << (8 - count));
-            write_val_ext(cpu, decode->op[0].ptr, res, 1);
+            write_val_ext(env, decode->op[0].ptr, res, 1);
             bit6 = (res >> 6) & 1;
             bit7 = (res >> 7) & 1;
             /* set eflags: ROR count affects the following flags: C, O */
-            SET_FLAGS_OxxxxC(cpu, bit6 ^ bit7, bit7);
+            SET_FLAGS_OxxxxC(env, bit6 ^ bit7, bit7);
         }
         break;
     }
@@ -1103,18 +1102,18 @@  void exec_ror(struct CPUState *cpu, struct x86_decode *decode)
                 bit14 = ((uint16_t)decode->op[0].val >> 14) & 1;
                 bit15 = ((uint16_t)decode->op[0].val >> 15) & 1;
                 /* of = result14 ^ result15 */
-                SET_FLAGS_OxxxxC(cpu, bit14 ^ bit15, bit15);
+                SET_FLAGS_OxxxxC(env, bit14 ^ bit15, bit15);
             }
         } else {
             count &= 0x0f;  /* use only 4 LSB's */
             res = ((uint16_t)decode->op[0].val >> count) |
                    ((uint16_t)decode->op[0].val << (16 - count));
-            write_val_ext(cpu, decode->op[0].ptr, res, 2);
+            write_val_ext(env, decode->op[0].ptr, res, 2);
 
             bit14 = (res >> 14) & 1;
             bit15 = (res >> 15) & 1;
             /* of = result14 ^ result15 */
-            SET_FLAGS_OxxxxC(cpu, bit14 ^ bit15, bit15);
+            SET_FLAGS_OxxxxC(env, bit14 ^ bit15, bit15);
         }
         break;
     }
@@ -1127,24 +1126,24 @@  void exec_ror(struct CPUState *cpu, struct x86_decode *decode)
         if (count) {
             res = ((uint32_t)decode->op[0].val >> count) |
                    ((uint32_t)decode->op[0].val << (32 - count));
-            write_val_ext(cpu, decode->op[0].ptr, res, 4);
+            write_val_ext(env, decode->op[0].ptr, res, 4);
 
             bit31 = (res >> 31) & 1;
             bit30 = (res >> 30) & 1;
             /* of = result30 ^ result31 */
-            SET_FLAGS_OxxxxC(cpu, bit30 ^ bit31, bit31);
+            SET_FLAGS_OxxxxC(env, bit30 ^ bit31, bit31);
         }
         break;
         }
     }
-    RIP(cpu) += decode->len;
+    RIP(env) += decode->len;
 }
 
-void exec_rol(struct CPUState *cpu, struct x86_decode *decode)
+void exec_rol(struct CPUX86State *env, struct x86_decode *decode)
 {
     uint8_t count;
 
-    fetch_operands(cpu, decode, 2, true, true, false);
+    fetch_operands(env, decode, 2, true, true, false);
     count = decode->op[1].val;
 
     switch (decode->operand_size) {
@@ -1157,20 +1156,20 @@  void exec_rol(struct CPUState *cpu, struct x86_decode *decode)
             if (count & 0x18) {
                 bit0 = ((uint8_t)decode->op[0].val & 1);
                 bit7 = ((uint8_t)decode->op[0].val >> 7);
-                SET_FLAGS_OxxxxC(cpu, bit0 ^ bit7, bit0);
+                SET_FLAGS_OxxxxC(env, bit0 ^ bit7, bit0);
             }
         }  else {
             count &= 0x7; /* use only lowest 3 bits */
             res = ((uint8_t)decode->op[0].val << count) |
                    ((uint8_t)decode->op[0].val >> (8 - count));
 
-            write_val_ext(cpu, decode->op[0].ptr, res, 1);
+            write_val_ext(env, decode->op[0].ptr, res, 1);
             /* set eflags:
              * ROL count affects the following flags: C, O
              */
             bit0 = (res &  1);
             bit7 = (res >> 7);
-            SET_FLAGS_OxxxxC(cpu, bit0 ^ bit7, bit0);
+            SET_FLAGS_OxxxxC(env, bit0 ^ bit7, bit0);
         }
         break;
     }
@@ -1184,18 +1183,18 @@  void exec_rol(struct CPUState *cpu, struct x86_decode *decode)
                 bit0  = ((uint16_t)decode->op[0].val & 0x1);
                 bit15 = ((uint16_t)decode->op[0].val >> 15);
                 /* of = cf ^ result15 */
-                SET_FLAGS_OxxxxC(cpu, bit0 ^ bit15, bit0);
+                SET_FLAGS_OxxxxC(env, bit0 ^ bit15, bit0);
             }
         } else {
             count &= 0x0f; /* only use bottom 4 bits */
             res = ((uint16_t)decode->op[0].val << count) |
                    ((uint16_t)decode->op[0].val >> (16 - count));
 
-            write_val_ext(cpu, decode->op[0].ptr, res, 2);
+            write_val_ext(env, decode->op[0].ptr, res, 2);
             bit0  = (res & 0x1);
             bit15 = (res >> 15);
             /* of = cf ^ result15 */
-            SET_FLAGS_OxxxxC(cpu, bit0 ^ bit15, bit0);
+            SET_FLAGS_OxxxxC(env, bit0 ^ bit15, bit0);
         }
         break;
     }
@@ -1209,25 +1208,25 @@  void exec_rol(struct CPUState *cpu, struct x86_decode *decode)
             res = ((uint32_t)decode->op[0].val << count) |
                    ((uint32_t)decode->op[0].val >> (32 - count));
 
-            write_val_ext(cpu, decode->op[0].ptr, res, 4);
+            write_val_ext(env, decode->op[0].ptr, res, 4);
             bit0  = (res & 0x1);
             bit31 = (res >> 31);
             /* of = cf ^ result31 */
-            SET_FLAGS_OxxxxC(cpu, bit0 ^ bit31, bit0);
+            SET_FLAGS_OxxxxC(env, bit0 ^ bit31, bit0);
         }
         break;
         }
     }
-    RIP(cpu) += decode->len;
+    RIP(env) += decode->len;
 }
 
 
-void exec_rcl(struct CPUState *cpu, struct x86_decode *decode)
+void exec_rcl(struct CPUX86State *env, struct x86_decode *decode)
 {
     uint8_t count;
     int of = 0, cf = 0;
 
-    fetch_operands(cpu, decode, 2, true, true, false);
+    fetch_operands(env, decode, 2, true, true, false);
     count = decode->op[1].val & 0x1f;
 
     switch (decode->operand_size) {
@@ -1241,17 +1240,17 @@  void exec_rcl(struct CPUState *cpu, struct x86_decode *decode)
         }
 
         if (1 == count) {
-            res = (op1_8 << 1) | get_CF(cpu);
+            res = (op1_8 << 1) | get_CF(env);
         } else {
-            res = (op1_8 << count) | (get_CF(cpu) << (count - 1)) |
+            res = (op1_8 << count) | (get_CF(env) << (count - 1)) |
                    (op1_8 >> (9 - count));
         }
 
-        write_val_ext(cpu, decode->op[0].ptr, res, 1);
+        write_val_ext(env, decode->op[0].ptr, res, 1);
 
         cf = (op1_8 >> (8 - count)) & 0x01;
         of = cf ^ (res >> 7); /* of = cf ^ result7 */
-        SET_FLAGS_OxxxxC(cpu, of, cf);
+        SET_FLAGS_OxxxxC(env, of, cf);
         break;
     }
     case 2:
@@ -1265,19 +1264,19 @@  void exec_rcl(struct CPUState *cpu, struct x86_decode *decode)
         }
 
         if (1 == count) {
-            res = (op1_16 << 1) | get_CF(cpu);
+            res = (op1_16 << 1) | get_CF(env);
         } else if (count == 16) {
-            res = (get_CF(cpu) << 15) | (op1_16 >> 1);
+            res = (get_CF(env) << 15) | (op1_16 >> 1);
         } else { /* 2..15 */
-            res = (op1_16 << count) | (get_CF(cpu) << (count - 1)) |
+            res = (op1_16 << count) | (get_CF(env) << (count - 1)) |
                    (op1_16 >> (17 - count));
         }
 
-        write_val_ext(cpu, decode->op[0].ptr, res, 2);
+        write_val_ext(env, decode->op[0].ptr, res, 2);
 
         cf = (op1_16 >> (16 - count)) & 0x1;
         of = cf ^ (res >> 15); /* of = cf ^ result15 */
-        SET_FLAGS_OxxxxC(cpu, of, cf);
+        SET_FLAGS_OxxxxC(env, of, cf);
         break;
     }
     case 4:
@@ -1290,29 +1289,29 @@  void exec_rcl(struct CPUState *cpu, struct x86_decode *decode)
         }
 
         if (1 == count) {
-            res = (op1_32 << 1) | get_CF(cpu);
+            res = (op1_32 << 1) | get_CF(env);
         } else {
-            res = (op1_32 << count) | (get_CF(cpu) << (count - 1)) |
+            res = (op1_32 << count) | (get_CF(env) << (count - 1)) |
                    (op1_32 >> (33 - count));
         }
 
-        write_val_ext(cpu, decode->op[0].ptr, res, 4);
+        write_val_ext(env, decode->op[0].ptr, res, 4);
 
         cf = (op1_32 >> (32 - count)) & 0x1;
         of = cf ^ (res >> 31); /* of = cf ^ result31 */
-        SET_FLAGS_OxxxxC(cpu, of, cf);
+        SET_FLAGS_OxxxxC(env, of, cf);
         break;
         }
     }
-    RIP(cpu) += decode->len;
+    RIP(env) += decode->len;
 }
 
-void exec_rcr(struct CPUState *cpu, struct x86_decode *decode)
+void exec_rcr(struct CPUX86State *env, struct x86_decode *decode)
 {
     uint8_t count;
     int of = 0, cf = 0;
 
-    fetch_operands(cpu, decode, 2, true, true, false);
+    fetch_operands(env, decode, 2, true, true, false);
     count = decode->op[1].val & 0x1f;
 
     switch (decode->operand_size) {
@@ -1325,14 +1324,14 @@  void exec_rcr(struct CPUState *cpu, struct x86_decode *decode)
         if (!count) {
             break;
         }
-        res = (op1_8 >> count) | (get_CF(cpu) << (8 - count)) |
+        res = (op1_8 >> count) | (get_CF(env) << (8 - count)) |
                (op1_8 << (9 - count));
 
-        write_val_ext(cpu, decode->op[0].ptr, res, 1);
+        write_val_ext(env, decode->op[0].ptr, res, 1);
 
         cf = (op1_8 >> (count - 1)) & 0x1;
         of = (((res << 1) ^ res) >> 7) & 0x1; /* of = result6 ^ result7 */
-        SET_FLAGS_OxxxxC(cpu, of, cf);
+        SET_FLAGS_OxxxxC(env, of, cf);
         break;
     }
     case 2:
@@ -1344,15 +1343,15 @@  void exec_rcr(struct CPUState *cpu, struct x86_decode *decode)
         if (!count) {
             break;
         }
-        res = (op1_16 >> count) | (get_CF(cpu) << (16 - count)) |
+        res = (op1_16 >> count) | (get_CF(env) << (16 - count)) |
                (op1_16 << (17 - count));
 
-        write_val_ext(cpu, decode->op[0].ptr, res, 2);
+        write_val_ext(env, decode->op[0].ptr, res, 2);
 
         cf = (op1_16 >> (count - 1)) & 0x1;
         of = ((uint16_t)((res << 1) ^ res) >> 15) & 0x1; /* of = result15 ^
                                                             result14 */
-        SET_FLAGS_OxxxxC(cpu, of, cf);
+        SET_FLAGS_OxxxxC(env, of, cf);
         break;
     }
     case 4:
@@ -1365,47 +1364,47 @@  void exec_rcr(struct CPUState *cpu, struct x86_decode *decode)
         }
 
         if (1 == count) {
-            res = (op1_32 >> 1) | (get_CF(cpu) << 31);
+            res = (op1_32 >> 1) | (get_CF(env) << 31);
         } else {
-            res = (op1_32 >> count) | (get_CF(cpu) << (32 - count)) |
+            res = (op1_32 >> count) | (get_CF(env) << (32 - count)) |
                    (op1_32 << (33 - count));
         }
 
-        write_val_ext(cpu, decode->op[0].ptr, res, 4);
+        write_val_ext(env, decode->op[0].ptr, res, 4);
 
         cf = (op1_32 >> (count - 1)) & 0x1;
         of = ((res << 1) ^ res) >> 31; /* of = result30 ^ result31 */
-        SET_FLAGS_OxxxxC(cpu, of, cf);
+        SET_FLAGS_OxxxxC(env, of, cf);
         break;
         }
     }
-    RIP(cpu) += decode->len;
+    RIP(env) += decode->len;
 }
 
-static void exec_xchg(struct CPUState *cpu, struct x86_decode *decode)
+static void exec_xchg(struct CPUX86State *env, struct x86_decode *decode)
 {
-    fetch_operands(cpu, decode, 2, true, true, false);
+    fetch_operands(env, decode, 2, true, true, false);
 
-    write_val_ext(cpu, decode->op[0].ptr, decode->op[1].val,
+    write_val_ext(env, decode->op[0].ptr, decode->op[1].val,
                   decode->operand_size);
-    write_val_ext(cpu, decode->op[1].ptr, decode->op[0].val,
+    write_val_ext(env, decode->op[1].ptr, decode->op[0].val,
                   decode->operand_size);
 
-    RIP(cpu) += decode->len;
+    RIP(env) += decode->len;
 }
 
-static void exec_xadd(struct CPUState *cpu, struct x86_decode *decode)
+static void exec_xadd(struct CPUX86State *env, struct x86_decode *decode)
 {
-    EXEC_2OP_ARITH_CMD(cpu, decode, +, SET_FLAGS_OSZAPC_ADD, true);
-    write_val_ext(cpu, decode->op[1].ptr, decode->op[0].val,
+    EXEC_2OP_ARITH_CMD(env, decode, +, SET_FLAGS_OSZAPC_ADD, true);
+    write_val_ext(env, decode->op[1].ptr, decode->op[0].val,
                   decode->operand_size);
 
-    RIP(cpu) += decode->len;
+    RIP(env) += decode->len;
 }
 
 static struct cmd_handler {
     enum x86_decode_cmd cmd;
-    void (*handler)(struct CPUState *cpu, struct x86_decode *ins);
+    void (*handler)(struct CPUX86State *env, struct x86_decode *ins);
 } handlers[] = {
     {X86_DECODE_CMD_INVL, NULL,},
     {X86_DECODE_CMD_MOV, exec_mov},
@@ -1451,7 +1450,7 @@  static struct cmd_handler {
 
 static struct cmd_handler _cmd_handler[X86_DECODE_CMD_LAST];
 
-static void init_cmd_handler(CPUState *cpu)
+static void init_cmd_handler()
 {
     int i;
     for (i = 0; i < ARRAY_SIZE(handlers); i++) {
@@ -1461,45 +1460,51 @@  static void init_cmd_handler(CPUState *cpu)
 
 void load_regs(struct CPUState *cpu)
 {
+    X86CPU *x86_cpu = X86_CPU(cpu);
+    CPUX86State *env = &x86_cpu->env;
+
     int i = 0;
-    RRX(cpu, REG_RAX) = rreg(cpu->hvf_fd, HV_X86_RAX);
-    RRX(cpu, REG_RBX) = rreg(cpu->hvf_fd, HV_X86_RBX);
-    RRX(cpu, REG_RCX) = rreg(cpu->hvf_fd, HV_X86_RCX);
-    RRX(cpu, REG_RDX) = rreg(cpu->hvf_fd, HV_X86_RDX);
-    RRX(cpu, REG_RSI) = rreg(cpu->hvf_fd, HV_X86_RSI);
-    RRX(cpu, REG_RDI) = rreg(cpu->hvf_fd, HV_X86_RDI);
-    RRX(cpu, REG_RSP) = rreg(cpu->hvf_fd, HV_X86_RSP);
-    RRX(cpu, REG_RBP) = rreg(cpu->hvf_fd, HV_X86_RBP);
+    RRX(env, REG_RAX) = rreg(cpu->hvf_fd, HV_X86_RAX);
+    RRX(env, REG_RBX) = rreg(cpu->hvf_fd, HV_X86_RBX);
+    RRX(env, REG_RCX) = rreg(cpu->hvf_fd, HV_X86_RCX);
+    RRX(env, REG_RDX) = rreg(cpu->hvf_fd, HV_X86_RDX);
+    RRX(env, REG_RSI) = rreg(cpu->hvf_fd, HV_X86_RSI);
+    RRX(env, REG_RDI) = rreg(cpu->hvf_fd, HV_X86_RDI);
+    RRX(env, REG_RSP) = rreg(cpu->hvf_fd, HV_X86_RSP);
+    RRX(env, REG_RBP) = rreg(cpu->hvf_fd, HV_X86_RBP);
     for (i = 8; i < 16; i++) {
-        RRX(cpu, i) = rreg(cpu->hvf_fd, HV_X86_RAX + i);
+        RRX(env, i) = rreg(cpu->hvf_fd, HV_X86_RAX + i);
     }
 
-    RFLAGS(cpu) = rreg(cpu->hvf_fd, HV_X86_RFLAGS);
-    rflags_to_lflags(cpu);
-    RIP(cpu) = rreg(cpu->hvf_fd, HV_X86_RIP);
+    RFLAGS(env) = rreg(cpu->hvf_fd, HV_X86_RFLAGS);
+    rflags_to_lflags(env);
+    RIP(env) = rreg(cpu->hvf_fd, HV_X86_RIP);
 }
 
 void store_regs(struct CPUState *cpu)
 {
+    X86CPU *x86_cpu = X86_CPU(cpu);
+    CPUX86State *env = &x86_cpu->env;
+
     int i = 0;
-    wreg(cpu->hvf_fd, HV_X86_RAX, RAX(cpu));
-    wreg(cpu->hvf_fd, HV_X86_RBX, RBX(cpu));
-    wreg(cpu->hvf_fd, HV_X86_RCX, RCX(cpu));
-    wreg(cpu->hvf_fd, HV_X86_RDX, RDX(cpu));
-    wreg(cpu->hvf_fd, HV_X86_RSI, RSI(cpu));
-    wreg(cpu->hvf_fd, HV_X86_RDI, RDI(cpu));
-    wreg(cpu->hvf_fd, HV_X86_RBP, RBP(cpu));
-    wreg(cpu->hvf_fd, HV_X86_RSP, RSP(cpu));
+    wreg(cpu->hvf_fd, HV_X86_RAX, RAX(env));
+    wreg(cpu->hvf_fd, HV_X86_RBX, RBX(env));
+    wreg(cpu->hvf_fd, HV_X86_RCX, RCX(env));
+    wreg(cpu->hvf_fd, HV_X86_RDX, RDX(env));
+    wreg(cpu->hvf_fd, HV_X86_RSI, RSI(env));
+    wreg(cpu->hvf_fd, HV_X86_RDI, RDI(env));
+    wreg(cpu->hvf_fd, HV_X86_RBP, RBP(env));
+    wreg(cpu->hvf_fd, HV_X86_RSP, RSP(env));
     for (i = 8; i < 16; i++) {
-        wreg(cpu->hvf_fd, HV_X86_RAX + i, RRX(cpu, i));
+        wreg(cpu->hvf_fd, HV_X86_RAX + i, RRX(env, i));
     }
 
-    lflags_to_rflags(cpu);
-    wreg(cpu->hvf_fd, HV_X86_RFLAGS, RFLAGS(cpu));
-    macvm_set_rip(cpu, RIP(cpu));
+    lflags_to_rflags(env);
+    wreg(cpu->hvf_fd, HV_X86_RFLAGS, RFLAGS(env));
+    macvm_set_rip(cpu, RIP(env));
 }
 
-bool exec_instruction(struct CPUState *cpu, struct x86_decode *ins)
+bool exec_instruction(struct CPUX86State *env, struct x86_decode *ins)
 {
     /*if (hvf_vcpu_id(cpu))
     printf("%d, %llx: exec_instruction %s\n", hvf_vcpu_id(cpu),  RIP(cpu),
@@ -1509,23 +1514,23 @@  bool exec_instruction(struct CPUState *cpu, struct x86_decode *ins)
         VM_PANIC("emulate fpu\n");
     } else {
         if (!_cmd_handler[ins->cmd].handler) {
-            printf("Unimplemented handler (%llx) for %d (%x %x) \n", RIP(cpu),
+            printf("Unimplemented handler (%llx) for %d (%x %x) \n", RIP(env),
                     ins->cmd, ins->opcode[0],
                     ins->opcode_len > 1 ? ins->opcode[1] : 0);
-            RIP(cpu) += ins->len;
+            RIP(env) += ins->len;
             return true;
         }
 
         VM_PANIC_ON_EX(!_cmd_handler[ins->cmd].handler,
-                "Unimplemented handler (%llx) for %d (%x %x) \n", RIP(cpu),
+                "Unimplemented handler (%llx) for %d (%x %x) \n", RIP(env),
                  ins->cmd, ins->opcode[0],
                  ins->opcode_len > 1 ? ins->opcode[1] : 0);
-        _cmd_handler[ins->cmd].handler(cpu, ins);
+        _cmd_handler[ins->cmd].handler(env, ins);
     }
     return true;
 }
 
-void init_emu(struct CPUState *cpu)
+void init_emu()
 {
-    init_cmd_handler(cpu);
+    init_cmd_handler();
 }
diff --git a/target/i386/hvf-utils/x86_emu.h b/target/i386/hvf-utils/x86_emu.h
index f7a739bb0a..27d1f5b4d4 100644
--- a/target/i386/hvf-utils/x86_emu.h
+++ b/target/i386/hvf-utils/x86_emu.h
@@ -3,9 +3,10 @@ 
 
 #include "x86.h"
 #include "x86_decode.h"
+#include "cpu.h"
 
-void init_emu(struct CPUState *cpu);
-bool exec_instruction(struct CPUState *cpu, struct x86_decode *ins);
+void init_emu(void);
+bool exec_instruction(struct CPUX86State *env, struct x86_decode *ins);
 
 void load_regs(struct CPUState *cpu);
 void store_regs(struct CPUState *cpu);
@@ -13,19 +14,19 @@  void store_regs(struct CPUState *cpu);
 void simulate_rdmsr(struct CPUState *cpu);
 void simulate_wrmsr(struct CPUState *cpu);
 
-addr_t read_reg(struct CPUState *cpu, int reg, int size);
-void write_reg(struct CPUState *cpu, int reg, addr_t val, int size);
+addr_t read_reg(CPUX86State *env, int reg, int size);
+void write_reg(CPUX86State *env, int reg, addr_t val, int size);
 addr_t read_val_from_reg(addr_t reg_ptr, int size);
 void write_val_to_reg(addr_t reg_ptr, addr_t val, int size);
-void write_val_ext(struct CPUState *cpu, addr_t ptr, addr_t val, int size);
-uint8_t *read_mmio(struct CPUState *cpu, addr_t ptr, int bytes);
-addr_t read_val_ext(struct CPUState *cpu, addr_t ptr, int size);
+void write_val_ext(struct CPUX86State *env, addr_t ptr, addr_t val, int size);
+uint8_t *read_mmio(struct CPUX86State *env, addr_t ptr, int bytes);
+addr_t read_val_ext(struct CPUX86State *env, addr_t ptr, int size);
 
-void exec_movzx(struct CPUState *cpu, struct x86_decode *decode);
-void exec_shl(struct CPUState *cpu, struct x86_decode *decode);
-void exec_movsx(struct CPUState *cpu, struct x86_decode *decode);
-void exec_ror(struct CPUState *cpu, struct x86_decode *decode);
-void exec_rol(struct CPUState *cpu, struct x86_decode *decode);
-void exec_rcl(struct CPUState *cpu, struct x86_decode *decode);
-void exec_rcr(struct CPUState *cpu, struct x86_decode *decode);
+void exec_movzx(struct CPUX86State *env, struct x86_decode *decode);
+void exec_shl(struct CPUX86State *env, struct x86_decode *decode);
+void exec_movsx(struct CPUX86State *env, struct x86_decode *decode);
+void exec_ror(struct CPUX86State *env, struct x86_decode *decode);
+void exec_rol(struct CPUX86State *env, struct x86_decode *decode);
+void exec_rcl(struct CPUX86State *env, struct x86_decode *decode);
+void exec_rcr(struct CPUX86State *env, struct x86_decode *decode);
 #endif
diff --git a/target/i386/hvf-utils/x86_flags.c b/target/i386/hvf-utils/x86_flags.c
index 187ab9b56b..c833774485 100644
--- a/target/i386/hvf-utils/x86_flags.c
+++ b/target/i386/hvf-utils/x86_flags.c
@@ -28,155 +28,155 @@ 
 #include "x86_flags.h"
 #include "x86.h"
 
-void SET_FLAGS_OxxxxC(struct CPUState *cpu, uint32_t new_of, uint32_t new_cf)
+void SET_FLAGS_OxxxxC(CPUX86State *env, uint32_t new_of, uint32_t new_cf)
 {
     uint32_t temp_po = new_of ^ new_cf;
-    cpu->hvf_x86->lflags.auxbits &= ~(LF_MASK_PO | LF_MASK_CF);
-    cpu->hvf_x86->lflags.auxbits |= (temp_po << LF_BIT_PO) |
+    env->hvf_emul->lflags.auxbits &= ~(LF_MASK_PO | LF_MASK_CF);
+    env->hvf_emul->lflags.auxbits |= (temp_po << LF_BIT_PO) |
                                      (new_cf << LF_BIT_CF);
 }
 
-void SET_FLAGS_OSZAPC_SUB32(struct CPUState *cpu, uint32_t v1, uint32_t v2,
+void SET_FLAGS_OSZAPC_SUB32(CPUX86State *env, uint32_t v1, uint32_t v2,
                             uint32_t diff)
 {
     SET_FLAGS_OSZAPC_SUB_32(v1, v2, diff);
 }
 
-void SET_FLAGS_OSZAPC_SUB16(struct CPUState *cpu, uint16_t v1, uint16_t v2,
+void SET_FLAGS_OSZAPC_SUB16(CPUX86State *env, uint16_t v1, uint16_t v2,
                             uint16_t diff)
 {
     SET_FLAGS_OSZAPC_SUB_16(v1, v2, diff);
 }
 
-void SET_FLAGS_OSZAPC_SUB8(struct CPUState *cpu, uint8_t v1, uint8_t v2,
+void SET_FLAGS_OSZAPC_SUB8(CPUX86State *env, uint8_t v1, uint8_t v2,
                             uint8_t diff)
 {
     SET_FLAGS_OSZAPC_SUB_8(v1, v2, diff);
 }
 
-void SET_FLAGS_OSZAPC_ADD32(struct CPUState *cpu, uint32_t v1, uint32_t v2,
+void SET_FLAGS_OSZAPC_ADD32(CPUX86State *env, uint32_t v1, uint32_t v2,
                             uint32_t diff)
 {
     SET_FLAGS_OSZAPC_ADD_32(v1, v2, diff);
 }
 
-void SET_FLAGS_OSZAPC_ADD16(struct CPUState *cpu, uint16_t v1, uint16_t v2,
+void SET_FLAGS_OSZAPC_ADD16(CPUX86State *env, uint16_t v1, uint16_t v2,
                             uint16_t diff)
 {
     SET_FLAGS_OSZAPC_ADD_16(v1, v2, diff);
 }
 
-void SET_FLAGS_OSZAPC_ADD8(struct CPUState *cpu, uint8_t v1, uint8_t v2,
+void SET_FLAGS_OSZAPC_ADD8(CPUX86State *env, uint8_t v1, uint8_t v2,
                             uint8_t diff)
 {
     SET_FLAGS_OSZAPC_ADD_8(v1, v2, diff);
 }
 
-void SET_FLAGS_OSZAP_SUB32(struct CPUState *cpu, uint32_t v1, uint32_t v2,
+void SET_FLAGS_OSZAP_SUB32(CPUX86State *env, uint32_t v1, uint32_t v2,
                             uint32_t diff)
 {
     SET_FLAGS_OSZAP_SUB_32(v1, v2, diff);
 }
 
-void SET_FLAGS_OSZAP_SUB16(struct CPUState *cpu, uint16_t v1, uint16_t v2,
+void SET_FLAGS_OSZAP_SUB16(CPUX86State *env, uint16_t v1, uint16_t v2,
                             uint16_t diff)
 {
     SET_FLAGS_OSZAP_SUB_16(v1, v2, diff);
 }
 
-void SET_FLAGS_OSZAP_SUB8(struct CPUState *cpu, uint8_t v1, uint8_t v2,
+void SET_FLAGS_OSZAP_SUB8(CPUX86State *env, uint8_t v1, uint8_t v2,
                             uint8_t diff)
 {
     SET_FLAGS_OSZAP_SUB_8(v1, v2, diff);
 }
 
-void SET_FLAGS_OSZAP_ADD32(struct CPUState *cpu, uint32_t v1, uint32_t v2,
+void SET_FLAGS_OSZAP_ADD32(CPUX86State *env, uint32_t v1, uint32_t v2,
                             uint32_t diff)
 {
     SET_FLAGS_OSZAP_ADD_32(v1, v2, diff);
 }
 
-void SET_FLAGS_OSZAP_ADD16(struct CPUState *cpu, uint16_t v1, uint16_t v2,
+void SET_FLAGS_OSZAP_ADD16(CPUX86State *env, uint16_t v1, uint16_t v2,
                             uint16_t diff)
 {
     SET_FLAGS_OSZAP_ADD_16(v1, v2, diff);
 }
 
-void SET_FLAGS_OSZAP_ADD8(struct CPUState *cpu, uint8_t v1, uint8_t v2,
+void SET_FLAGS_OSZAP_ADD8(CPUX86State *env, uint8_t v1, uint8_t v2,
                             uint8_t diff)
 {
     SET_FLAGS_OSZAP_ADD_8(v1, v2, diff);
 }
 
 
-void SET_FLAGS_OSZAPC_LOGIC32(struct CPUState *cpu, uint32_t diff)
+void SET_FLAGS_OSZAPC_LOGIC32(CPUX86State *env, uint32_t diff)
 {
     SET_FLAGS_OSZAPC_LOGIC_32(diff);
 }
 
-void SET_FLAGS_OSZAPC_LOGIC16(struct CPUState *cpu, uint16_t diff)
+void SET_FLAGS_OSZAPC_LOGIC16(CPUX86State *env, uint16_t diff)
 {
     SET_FLAGS_OSZAPC_LOGIC_16(diff);
 }
 
-void SET_FLAGS_OSZAPC_LOGIC8(struct CPUState *cpu, uint8_t diff)
+void SET_FLAGS_OSZAPC_LOGIC8(CPUX86State *env, uint8_t diff)
 {
     SET_FLAGS_OSZAPC_LOGIC_8(diff);
 }
 
-void SET_FLAGS_SHR32(struct CPUState *cpu, uint32_t v, int count, uint32_t res)
+void SET_FLAGS_SHR32(CPUX86State *env, uint32_t v, int count, uint32_t res)
 {
     int cf = (v >> (count - 1)) & 0x1;
     int of = (((res << 1) ^ res) >> 31);
 
     SET_FLAGS_OSZAPC_LOGIC_32(res);
-    SET_FLAGS_OxxxxC(cpu, of, cf);
+    SET_FLAGS_OxxxxC(env, of, cf);
 }
 
-void SET_FLAGS_SHR16(struct CPUState *cpu, uint16_t v, int count, uint16_t res)
+void SET_FLAGS_SHR16(CPUX86State *env, uint16_t v, int count, uint16_t res)
 {
     int cf = (v >> (count - 1)) & 0x1;
     int of = (((res << 1) ^ res) >> 15);
 
     SET_FLAGS_OSZAPC_LOGIC_16(res);
-    SET_FLAGS_OxxxxC(cpu, of, cf);
+    SET_FLAGS_OxxxxC(env, of, cf);
 }
 
-void SET_FLAGS_SHR8(struct CPUState *cpu, uint8_t v, int count, uint8_t res)
+void SET_FLAGS_SHR8(CPUX86State *env, uint8_t v, int count, uint8_t res)
 {
     int cf = (v >> (count - 1)) & 0x1;
     int of = (((res << 1) ^ res) >> 7);
 
     SET_FLAGS_OSZAPC_LOGIC_8(res);
-    SET_FLAGS_OxxxxC(cpu, of, cf);
+    SET_FLAGS_OxxxxC(env, of, cf);
 }
 
-void SET_FLAGS_SAR32(struct CPUState *cpu, int32_t v, int count, uint32_t res)
+void SET_FLAGS_SAR32(CPUX86State *env, int32_t v, int count, uint32_t res)
 {
     int cf = (v >> (count - 1)) & 0x1;
 
     SET_FLAGS_OSZAPC_LOGIC_32(res);
-    SET_FLAGS_OxxxxC(cpu, 0, cf);
+    SET_FLAGS_OxxxxC(env, 0, cf);
 }
 
-void SET_FLAGS_SAR16(struct CPUState *cpu, int16_t v, int count, uint16_t res)
+void SET_FLAGS_SAR16(CPUX86State *env, int16_t v, int count, uint16_t res)
 {
     int cf = (v >> (count - 1)) & 0x1;
 
     SET_FLAGS_OSZAPC_LOGIC_16(res);
-    SET_FLAGS_OxxxxC(cpu, 0, cf);
+    SET_FLAGS_OxxxxC(env, 0, cf);
 }
 
-void SET_FLAGS_SAR8(struct CPUState *cpu, int8_t v, int count, uint8_t res)
+void SET_FLAGS_SAR8(CPUX86State *env, int8_t v, int count, uint8_t res)
 {
     int cf = (v >> (count - 1)) & 0x1;
 
     SET_FLAGS_OSZAPC_LOGIC_8(res);
-    SET_FLAGS_OxxxxC(cpu, 0, cf);
+    SET_FLAGS_OxxxxC(env, 0, cf);
 }
 
 
-void SET_FLAGS_SHL32(struct CPUState *cpu, uint32_t v, int count, uint32_t res)
+void SET_FLAGS_SHL32(CPUX86State *env, uint32_t v, int count, uint32_t res)
 {
     int of, cf;
 
@@ -184,10 +184,10 @@  void SET_FLAGS_SHL32(struct CPUState *cpu, uint32_t v, int count, uint32_t res)
     of = cf ^ (res >> 31);
 
     SET_FLAGS_OSZAPC_LOGIC_32(res);
-    SET_FLAGS_OxxxxC(cpu, of, cf);
+    SET_FLAGS_OxxxxC(env, of, cf);
 }
 
-void SET_FLAGS_SHL16(struct CPUState *cpu, uint16_t v, int count, uint16_t res)
+void SET_FLAGS_SHL16(CPUX86State *env, uint16_t v, int count, uint16_t res)
 {
     int of = 0, cf = 0;
 
@@ -197,10 +197,10 @@  void SET_FLAGS_SHL16(struct CPUState *cpu, uint16_t v, int count, uint16_t res)
     }
 
     SET_FLAGS_OSZAPC_LOGIC_16(res);
-    SET_FLAGS_OxxxxC(cpu, of, cf);
+    SET_FLAGS_OxxxxC(env, of, cf);
 }
 
-void SET_FLAGS_SHL8(struct CPUState *cpu, uint8_t v, int count, uint8_t res)
+void SET_FLAGS_SHL8(CPUX86State *env, uint8_t v, int count, uint8_t res)
 {
     int of = 0, cf = 0;
 
@@ -210,124 +210,124 @@  void SET_FLAGS_SHL8(struct CPUState *cpu, uint8_t v, int count, uint8_t res)
     }
 
     SET_FLAGS_OSZAPC_LOGIC_8(res);
-    SET_FLAGS_OxxxxC(cpu, of, cf);
+    SET_FLAGS_OxxxxC(env, of, cf);
 }
 
-bool get_PF(struct CPUState *cpu)
+bool get_PF(CPUX86State *env)
 {
-    uint32_t temp = (255 & cpu->hvf_x86->lflags.result);
-    temp = temp ^ (255 & (cpu->hvf_x86->lflags.auxbits >> LF_BIT_PDB));
+    uint32_t temp = (255 & env->hvf_emul->lflags.result);
+    temp = temp ^ (255 & (env->hvf_emul->lflags.auxbits >> LF_BIT_PDB));
     temp = (temp ^ (temp >> 4)) & 0x0F;
     return (0x9669U >> temp) & 1;
 }
 
-void set_PF(struct CPUState *cpu, bool val)
+void set_PF(CPUX86State *env, bool val)
 {
-    uint32_t temp = (255 & cpu->hvf_x86->lflags.result) ^ (!val);
-    cpu->hvf_x86->lflags.auxbits &= ~(LF_MASK_PDB);
-    cpu->hvf_x86->lflags.auxbits |= (temp << LF_BIT_PDB);
+    uint32_t temp = (255 & env->hvf_emul->lflags.result) ^ (!val);
+    env->hvf_emul->lflags.auxbits &= ~(LF_MASK_PDB);
+    env->hvf_emul->lflags.auxbits |= (temp << LF_BIT_PDB);
 }
 
-bool _get_OF(struct CPUState *cpu)
+bool _get_OF(CPUX86State *env)
 {
-    return ((cpu->hvf_x86->lflags.auxbits + (1U << LF_BIT_PO)) >> LF_BIT_CF) & 1;
+    return ((env->hvf_emul->lflags.auxbits + (1U << LF_BIT_PO)) >> LF_BIT_CF) & 1;
 }
 
-bool get_OF(struct CPUState *cpu)
+bool get_OF(CPUX86State *env)
 {
-    return _get_OF(cpu);
+    return _get_OF(env);
 }
 
-bool _get_CF(struct CPUState *cpu)
+bool _get_CF(CPUX86State *env)
 {
-    return (cpu->hvf_x86->lflags.auxbits >> LF_BIT_CF) & 1;
+    return (env->hvf_emul->lflags.auxbits >> LF_BIT_CF) & 1;
 }
 
-bool get_CF(struct CPUState *cpu)
+bool get_CF(CPUX86State *env)
 {
-    return _get_CF(cpu);
+    return _get_CF(env);
 }
 
-void set_OF(struct CPUState *cpu, bool val)
+void set_OF(CPUX86State *env, bool val)
 {
-    SET_FLAGS_OxxxxC(cpu, val, _get_CF(cpu));
+    SET_FLAGS_OxxxxC(env, val, _get_CF(env));
 }
 
-void set_CF(struct CPUState *cpu, bool val)
+void set_CF(CPUX86State *env, bool val)
 {
-    SET_FLAGS_OxxxxC(cpu, _get_OF(cpu), (val));
+    SET_FLAGS_OxxxxC(env, _get_OF(env), (val));
 }
 
-bool get_AF(struct CPUState *cpu)
+bool get_AF(CPUX86State *env)
 {
-    return (cpu->hvf_x86->lflags.auxbits >> LF_BIT_AF) & 1;
+    return (env->hvf_emul->lflags.auxbits >> LF_BIT_AF) & 1;
 }
 
-void set_AF(struct CPUState *cpu, bool val)
+void set_AF(CPUX86State *env, bool val)
 {
-    cpu->hvf_x86->lflags.auxbits &= ~(LF_MASK_AF);
-    cpu->hvf_x86->lflags.auxbits |= (val) << LF_BIT_AF;
+    env->hvf_emul->lflags.auxbits &= ~(LF_MASK_AF);
+    env->hvf_emul->lflags.auxbits |= (val) << LF_BIT_AF;
 }
 
-bool get_ZF(struct CPUState *cpu)
+bool get_ZF(CPUX86State *env)
 {
-    return !cpu->hvf_x86->lflags.result;
+    return !env->hvf_emul->lflags.result;
 }
 
-void set_ZF(struct CPUState *cpu, bool val)
+void set_ZF(CPUX86State *env, bool val)
 {
     if (val) {
-        cpu->hvf_x86->lflags.auxbits ^=
-         (((cpu->hvf_x86->lflags.result >> LF_SIGN_BIT) & 1) << LF_BIT_SD);
+        env->hvf_emul->lflags.auxbits ^=
+         (((env->hvf_emul->lflags.result >> LF_SIGN_BIT) & 1) << LF_BIT_SD);
         /* merge the parity bits into the Parity Delta Byte */
-        uint32_t temp_pdb = (255 & cpu->hvf_x86->lflags.result);
-        cpu->hvf_x86->lflags.auxbits ^= (temp_pdb << LF_BIT_PDB);
+        uint32_t temp_pdb = (255 & env->hvf_emul->lflags.result);
+        env->hvf_emul->lflags.auxbits ^= (temp_pdb << LF_BIT_PDB);
         /* now zero the .result value */
-        cpu->hvf_x86->lflags.result = 0;
+        env->hvf_emul->lflags.result = 0;
     } else {
-        cpu->hvf_x86->lflags.result |= (1 << 8);
+        env->hvf_emul->lflags.result |= (1 << 8);
     }
 }
 
-bool get_SF(struct CPUState *cpu)
+bool get_SF(CPUX86State *env)
 {
-    return ((cpu->hvf_x86->lflags.result >> LF_SIGN_BIT) ^
-            (cpu->hvf_x86->lflags.auxbits >> LF_BIT_SD)) & 1;
+    return ((env->hvf_emul->lflags.result >> LF_SIGN_BIT) ^
+            (env->hvf_emul->lflags.auxbits >> LF_BIT_SD)) & 1;
 }
 
-void set_SF(struct CPUState *cpu, bool val)
+void set_SF(CPUX86State *env, bool val)
 {
-    bool temp_sf = get_SF(cpu);
-    cpu->hvf_x86->lflags.auxbits ^= (temp_sf ^ val) << LF_BIT_SD;
+    bool temp_sf = get_SF(env);
+    env->hvf_emul->lflags.auxbits ^= (temp_sf ^ val) << LF_BIT_SD;
 }
 
-void set_OSZAPC(struct CPUState *cpu, uint32_t flags32)
+void set_OSZAPC(CPUX86State *env, uint32_t flags32)
 {
-    set_OF(cpu, cpu->hvf_x86->rflags.of);
-    set_SF(cpu, cpu->hvf_x86->rflags.sf);
-    set_ZF(cpu, cpu->hvf_x86->rflags.zf);
-    set_AF(cpu, cpu->hvf_x86->rflags.af);
-    set_PF(cpu, cpu->hvf_x86->rflags.pf);
-    set_CF(cpu, cpu->hvf_x86->rflags.cf);
+    set_OF(env, env->hvf_emul->rflags.of);
+    set_SF(env, env->hvf_emul->rflags.sf);
+    set_ZF(env, env->hvf_emul->rflags.zf);
+    set_AF(env, env->hvf_emul->rflags.af);
+    set_PF(env, env->hvf_emul->rflags.pf);
+    set_CF(env, env->hvf_emul->rflags.cf);
 }
 
-void lflags_to_rflags(struct CPUState *cpu)
+void lflags_to_rflags(CPUX86State *env)
 {
-    cpu->hvf_x86->rflags.cf = get_CF(cpu);
-    cpu->hvf_x86->rflags.pf = get_PF(cpu);
-    cpu->hvf_x86->rflags.af = get_AF(cpu);
-    cpu->hvf_x86->rflags.zf = get_ZF(cpu);
-    cpu->hvf_x86->rflags.sf = get_SF(cpu);
-    cpu->hvf_x86->rflags.of = get_OF(cpu);
+    env->hvf_emul->rflags.cf = get_CF(env);
+    env->hvf_emul->rflags.pf = get_PF(env);
+    env->hvf_emul->rflags.af = get_AF(env);
+    env->hvf_emul->rflags.zf = get_ZF(env);
+    env->hvf_emul->rflags.sf = get_SF(env);
+    env->hvf_emul->rflags.of = get_OF(env);
 }
 
-void rflags_to_lflags(struct CPUState *cpu)
+void rflags_to_lflags(CPUX86State *env)
 {
-    cpu->hvf_x86->lflags.auxbits = cpu->hvf_x86->lflags.result = 0;
-    set_OF(cpu, cpu->hvf_x86->rflags.of);
-    set_SF(cpu, cpu->hvf_x86->rflags.sf);
-    set_ZF(cpu, cpu->hvf_x86->rflags.zf);
-    set_AF(cpu, cpu->hvf_x86->rflags.af);
-    set_PF(cpu, cpu->hvf_x86->rflags.pf);
-    set_CF(cpu, cpu->hvf_x86->rflags.cf);
+    env->hvf_emul->lflags.auxbits = env->hvf_emul->lflags.result = 0;
+    set_OF(env, env->hvf_emul->rflags.of);
+    set_SF(env, env->hvf_emul->rflags.sf);
+    set_ZF(env, env->hvf_emul->rflags.zf);
+    set_AF(env, env->hvf_emul->rflags.af);
+    set_PF(env, env->hvf_emul->rflags.pf);
+    set_CF(env, env->hvf_emul->rflags.cf);
 }
diff --git a/target/i386/hvf-utils/x86_flags.h b/target/i386/hvf-utils/x86_flags.h
index 68a0c10b90..57a524240c 100644
--- a/target/i386/hvf-utils/x86_flags.h
+++ b/target/i386/hvf-utils/x86_flags.h
@@ -24,14 +24,10 @@ 
 #define __X86_FLAGS_H__
 
 #include "x86_gen.h"
+#include "cpu.h"
 
 /* this is basically bocsh code */
 
-typedef struct lazy_flags {
-    addr_t result;
-    addr_t auxbits;
-} lazy_flags;
-
 #define LF_SIGN_BIT     31
 
 #define LF_BIT_SD      (0)          /* lazy Sign Flag Delta            */
@@ -63,7 +59,7 @@  typedef struct lazy_flags {
 #define SET_FLAGS_OSZAPC_SIZE(size, lf_carries, lf_result) { \
     addr_t temp = ((lf_carries) & (LF_MASK_AF)) | \
     (((lf_carries) >> (size - 2)) << LF_BIT_PO); \
-    cpu->hvf_x86->lflags.result = (addr_t)(int##size##_t)(lf_result); \
+    env->hvf_emul->lflags.result = (addr_t)(int##size##_t)(lf_result); \
     if ((size) == 32) { \
         temp = ((lf_carries) & ~(LF_MASK_PDB | LF_MASK_SD)); \
     } else if ((size) == 16) { \
@@ -73,7 +69,7 @@  typedef struct lazy_flags {
     } else { \
         VM_PANIC("unimplemented");  \
     } \
-    cpu->hvf_x86->lflags.auxbits = (addr_t)(uint32_t)temp; \
+    env->hvf_emul->lflags.auxbits = (addr_t)(uint32_t)temp; \
 }
 
 /* carries, result */
@@ -135,10 +131,10 @@  typedef struct lazy_flags {
     } else { \
         VM_PANIC("unimplemented");      \
     } \
-    cpu->hvf_x86->lflags.result = (addr_t)(int##size##_t)(lf_result); \
-    addr_t delta_c = (cpu->hvf_x86->lflags.auxbits ^ temp) & LF_MASK_CF; \
+    env->hvf_emul->lflags.result = (addr_t)(int##size##_t)(lf_result); \
+    addr_t delta_c = (env->hvf_emul->lflags.auxbits ^ temp) & LF_MASK_CF; \
     delta_c ^= (delta_c >> 1); \
-    cpu->hvf_x86->lflags.auxbits = (addr_t)(uint32_t)(temp ^ delta_c); \
+    env->hvf_emul->lflags.auxbits = (addr_t)(uint32_t)(temp ^ delta_c); \
 }
 
 /* carries, result */
@@ -179,69 +175,69 @@  typedef struct lazy_flags {
 #define SET_FLAGS_OSZAxC_LOGIC_32(result_32) \
     SET_FLAGS_OSZAxC_LOGIC_SIZE(32, (result_32))
 
-void lflags_to_rflags(struct CPUState *cpu);
-void rflags_to_lflags(struct CPUState *cpu);
-
-bool get_PF(struct CPUState *cpu);
-void set_PF(struct CPUState *cpu, bool val);
-bool get_CF(struct CPUState *cpu);
-void set_CF(struct CPUState *cpu, bool val);
-bool get_AF(struct CPUState *cpu);
-void set_AF(struct CPUState *cpu, bool val);
-bool get_ZF(struct CPUState *cpu);
-void set_ZF(struct CPUState *cpu, bool val);
-bool get_SF(struct CPUState *cpu);
-void set_SF(struct CPUState *cpu, bool val);
-bool get_OF(struct CPUState *cpu);
-void set_OF(struct CPUState *cpu, bool val);
-void set_OSZAPC(struct CPUState *cpu, uint32_t flags32);
-
-void SET_FLAGS_OxxxxC(struct CPUState *cpu, uint32_t new_of, uint32_t new_cf);
-
-void SET_FLAGS_OSZAPC_SUB32(struct CPUState *cpu, uint32_t v1, uint32_t v2,
+void lflags_to_rflags(CPUX86State *env);
+void rflags_to_lflags(CPUX86State *env);
+
+bool get_PF(CPUX86State *env);
+void set_PF(CPUX86State *env, bool val);
+bool get_CF(CPUX86State *env);
+void set_CF(CPUX86State *env, bool val);
+bool get_AF(CPUX86State *env);
+void set_AF(CPUX86State *env, bool val);
+bool get_ZF(CPUX86State *env);
+void set_ZF(CPUX86State *env, bool val);
+bool get_SF(CPUX86State *env);
+void set_SF(CPUX86State *env, bool val);
+bool get_OF(CPUX86State *env);
+void set_OF(CPUX86State *env, bool val);
+void set_OSZAPC(CPUX86State *env, uint32_t flags32);
+
+void SET_FLAGS_OxxxxC(CPUX86State *env, uint32_t new_of, uint32_t new_cf);
+
+void SET_FLAGS_OSZAPC_SUB32(CPUX86State *env, uint32_t v1, uint32_t v2,
                             uint32_t diff);
-void SET_FLAGS_OSZAPC_SUB16(struct CPUState *cpu, uint16_t v1, uint16_t v2,
+void SET_FLAGS_OSZAPC_SUB16(CPUX86State *env, uint16_t v1, uint16_t v2,
                             uint16_t diff);
-void SET_FLAGS_OSZAPC_SUB8(struct CPUState *cpu, uint8_t v1, uint8_t v2,
+void SET_FLAGS_OSZAPC_SUB8(CPUX86State *env, uint8_t v1, uint8_t v2,
                            uint8_t diff);
 
-void SET_FLAGS_OSZAPC_ADD32(struct CPUState *cpu, uint32_t v1, uint32_t v2,
+void SET_FLAGS_OSZAPC_ADD32(CPUX86State *env, uint32_t v1, uint32_t v2,
                             uint32_t diff);
-void SET_FLAGS_OSZAPC_ADD16(struct CPUState *cpu, uint16_t v1, uint16_t v2,
+void SET_FLAGS_OSZAPC_ADD16(CPUX86State *env, uint16_t v1, uint16_t v2,
                             uint16_t diff);
-void SET_FLAGS_OSZAPC_ADD8(struct CPUState *cpu, uint8_t v1, uint8_t v2,
+void SET_FLAGS_OSZAPC_ADD8(CPUX86State *env, uint8_t v1, uint8_t v2,
                            uint8_t diff);
 
-void SET_FLAGS_OSZAP_SUB32(struct CPUState *cpu, uint32_t v1, uint32_t v2,
+void SET_FLAGS_OSZAP_SUB32(CPUX86State *env, uint32_t v1, uint32_t v2,
                            uint32_t diff);
-void SET_FLAGS_OSZAP_SUB16(struct CPUState *cpu, uint16_t v1, uint16_t v2,
+void SET_FLAGS_OSZAP_SUB16(CPUX86State *env, uint16_t v1, uint16_t v2,
                            uint16_t diff);
-void SET_FLAGS_OSZAP_SUB8(struct CPUState *cpu, uint8_t v1, uint8_t v2,
+void SET_FLAGS_OSZAP_SUB8(CPUX86State *env, uint8_t v1, uint8_t v2,
                           uint8_t diff);
 
-void SET_FLAGS_OSZAP_ADD32(struct CPUState *cpu, uint32_t v1, uint32_t v2,
+void SET_FLAGS_OSZAP_ADD32(CPUX86State *env, uint32_t v1, uint32_t v2,
                            uint32_t diff);
-void SET_FLAGS_OSZAP_ADD16(struct CPUState *cpu, uint16_t v1, uint16_t v2,
+void SET_FLAGS_OSZAP_ADD16(CPUX86State *env, uint16_t v1, uint16_t v2,
                            uint16_t diff);
-void SET_FLAGS_OSZAP_ADD8(struct CPUState *cpu, uint8_t v1, uint8_t v2,
+void SET_FLAGS_OSZAP_ADD8(CPUX86State *env, uint8_t v1, uint8_t v2,
                           uint8_t diff);
 
-void SET_FLAGS_OSZAPC_LOGIC32(struct CPUState *cpu, uint32_t diff);
-void SET_FLAGS_OSZAPC_LOGIC16(struct CPUState *cpu, uint16_t diff);
-void SET_FLAGS_OSZAPC_LOGIC8(struct CPUState *cpu, uint8_t diff);
+void SET_FLAGS_OSZAPC_LOGIC32(CPUX86State *env, uint32_t diff);
+void SET_FLAGS_OSZAPC_LOGIC16(CPUX86State *env, uint16_t diff);
+void SET_FLAGS_OSZAPC_LOGIC8(CPUX86State *env, uint8_t diff);
 
-void SET_FLAGS_SHR32(struct CPUState *cpu, uint32_t v, int count, uint32_t res);
-void SET_FLAGS_SHR16(struct CPUState *cpu, uint16_t v, int count, uint16_t res);
-void SET_FLAGS_SHR8(struct CPUState *cpu, uint8_t v, int count, uint8_t res);
+void SET_FLAGS_SHR32(CPUX86State *env, uint32_t v, int count, uint32_t res);
+void SET_FLAGS_SHR16(CPUX86State *env, uint16_t v, int count, uint16_t res);
+void SET_FLAGS_SHR8(CPUX86State *env, uint8_t v, int count, uint8_t res);
 
-void SET_FLAGS_SAR32(struct CPUState *cpu, int32_t v, int count, uint32_t res);
-void SET_FLAGS_SAR16(struct CPUState *cpu, int16_t v, int count, uint16_t res);
-void SET_FLAGS_SAR8(struct CPUState *cpu, int8_t v, int count, uint8_t res);
+void SET_FLAGS_SAR32(CPUX86State *env, int32_t v, int count, uint32_t res);
+void SET_FLAGS_SAR16(CPUX86State *env, int16_t v, int count, uint16_t res);
+void SET_FLAGS_SAR8(CPUX86State *env, int8_t v, int count, uint8_t res);
 
-void SET_FLAGS_SHL32(struct CPUState *cpu, uint32_t v, int count, uint32_t res);
-void SET_FLAGS_SHL16(struct CPUState *cpu, uint16_t v, int count, uint16_t res);
-void SET_FLAGS_SHL8(struct CPUState *cpu, uint8_t v, int count, uint8_t res);
+void SET_FLAGS_SHL32(CPUX86State *env, uint32_t v, int count, uint32_t res);
+void SET_FLAGS_SHL16(CPUX86State *env, uint16_t v, int count, uint16_t res);
+void SET_FLAGS_SHL8(CPUX86State *env, uint8_t v, int count, uint8_t res);
 
-bool _get_OF(struct CPUState *cpu);
-bool _get_CF(struct CPUState *cpu);
+bool _get_OF(CPUX86State *env);
+bool _get_CF(CPUX86State *env);
 #endif /* __X86_FLAGS_H__ */
diff --git a/target/i386/hvf-utils/x86hvf.c b/target/i386/hvf-utils/x86hvf.c
index 819d760624..8986b4e5e5 100644
--- a/target/i386/hvf-utils/x86hvf.c
+++ b/target/i386/hvf-utils/x86hvf.c
@@ -356,9 +356,10 @@  void vmx_clear_int_window_exiting(CPUState *cpu)
 
 void hvf_inject_interrupts(CPUState *cpu_state)
 {
-    X86CPU *x86cpu = X86_CPU(cpu_state);
     int allow_nmi = !(rvmcs(cpu_state->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY) &
-            VMCS_INTERRUPTIBILITY_NMI_BLOCKING);
+                VMCS_INTERRUPTIBILITY_NMI_BLOCKING);
+    X86CPU *x86cpu = X86_CPU(cpu_state);
+    CPUX86State *env = &x86cpu->env;
 
     uint64_t idt_info = rvmcs(cpu_state->hvf_fd, VMCS_IDT_VECTORING_INFO);
     uint64_t info = 0;
@@ -415,9 +416,9 @@  void hvf_inject_interrupts(CPUState *cpu_state)
         }
     }
 
-    if (cpu_state->hvf_x86->interruptable &&
+    if (env->hvf_emul->interruptable &&
         (cpu_state->interrupt_request & CPU_INTERRUPT_HARD) &&
-        (EFLAGS(cpu_state) & IF_MASK) && !(info & VMCS_INTR_VALID)) {
+        (EFLAGS(env) & IF_MASK) && !(info & VMCS_INTR_VALID)) {
         int line = cpu_get_pic_interrupt(&x86cpu->env);
         cpu_state->interrupt_request &= ~CPU_INTERRUPT_HARD;
         if (line >= 0) {
@@ -435,7 +436,7 @@  int hvf_process_events(CPUState *cpu_state)
     X86CPU *cpu = X86_CPU(cpu_state);
     CPUX86State *env = &cpu->env;
 
-    EFLAGS(cpu_state) = rreg(cpu_state->hvf_fd, HV_X86_RFLAGS);
+    EFLAGS(env) = rreg(cpu_state->hvf_fd, HV_X86_RFLAGS);
 
     if (cpu_state->interrupt_request & CPU_INTERRUPT_INIT) {
         hvf_cpu_synchronize_state(cpu_state);
@@ -447,7 +448,7 @@  int hvf_process_events(CPUState *cpu_state)
         apic_poll_irq(cpu->apic_state);
     }
     if (((cpu_state->interrupt_request & CPU_INTERRUPT_HARD) &&
-        (EFLAGS(cpu_state) & IF_MASK)) ||
+        (EFLAGS(env) & IF_MASK)) ||
         (cpu_state->interrupt_request & CPU_INTERRUPT_NMI)) {
         cpu_state->halted = 0;
     }
@@ -463,4 +464,3 @@  int hvf_process_events(CPUState *cpu_state)
     }
     return cpu_state->halted;
 }
-