diff --git a/cpus.c b/cpus.c
index 9bed61eefc..a2cd9dfa5d 100644
--- a/cpus.c
+++ b/cpus.c
@@ -1434,6 +1434,48 @@ static void *qemu_hax_cpu_thread_fn(void *arg)
     return NULL;
 }
 
+/* The HVF-specific vCPU thread function. This one should only run when the host
+ * CPU supports the VMX "unrestricted guest" feature. */
+static void *qemu_hvf_cpu_thread_fn(void *arg)
+{
+    CPUState *cpu = arg;
+
+    int r;
+
+    assert(hvf_enabled());
+
+    rcu_register_thread();
+
+    qemu_mutex_lock_iothread();
+    qemu_thread_get_self(cpu->thread);
+
+    cpu->thread_id = qemu_get_thread_id();
+    cpu->can_do_io = 1;
+    current_cpu = cpu;
+
+    hvf_init_vcpu(cpu);
+
+    /* signal CPU creation */
+    cpu->created = true;
+    qemu_cond_signal(&qemu_cpu_cond);
+
+    do {
+        if (cpu_can_run(cpu)) {
+            r = hvf_vcpu_exec(cpu);
+            if (r == EXCP_DEBUG) {
+                cpu_handle_guest_debug(cpu);
+            }
+        }
+        qemu_hvf_wait_io_event(cpu);
+    } while (!cpu->unplug || cpu_can_run(cpu));
+
+    hvf_vcpu_destroy(cpu);
+    cpu->created = false;
+    qemu_cond_signal(&qemu_cpu_cond);
+    qemu_mutex_unlock_iothread();
+    return NULL;
+}
+
 #ifdef _WIN32
 static void CALLBACK dummy_apc_func(ULONG_PTR unused)
 {
diff --git a/include/sysemu/hvf.h b/include/sysemu/hvf.h
new file mode 100644
index 0000000000..752a78eaa4
--- /dev/null
+++ b/include/sysemu/hvf.h
@@ -0,0 +1,99 @@
+/*
+ * QEMU Hypervisor.framework (HVF) support
+ *
+ * Copyright Google Inc., 2017
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ */
+
+/* header to be included in non-HVF-specific code */
+#ifndef _HVF_H
+#define _HVF_H
+
+#include "config-host.h"
+#include "qemu/osdep.h"
+#include "qemu-common.h"
+#include "hw/hw.h"
+#include "target/i386/cpu.h"
+#include "qemu/bitops.h"
+#include "exec/memory.h"
+#include "sysemu/accel.h"
+#include <Hypervisor/hv.h>
+#include <Hypervisor/hv_vmx.h>
+#include <Hypervisor/hv_error.h>
+
+
+typedef struct hvf_slot {
+    uint64_t start;
+    uint64_t size;
+    uint8_t *mem;
+    int slot_id;
+} hvf_slot;
+
+struct hvf_vcpu_caps {
+    uint64_t vmx_cap_pinbased;
+    uint64_t vmx_cap_procbased;
+    uint64_t vmx_cap_procbased2;
+    uint64_t vmx_cap_entry;
+    uint64_t vmx_cap_exit;
+    uint64_t vmx_cap_preemption_timer;
+};
+
+int __hvf_set_memory(hvf_slot *);
+typedef struct HVFState {
+    AccelState parent;
+    hvf_slot slots[32];
+    int num_slots;
+
+    struct hvf_vcpu_caps *hvf_caps;
+} HVFState;
+extern HVFState *hvf_state;
+
+void hvf_set_phys_mem(MemoryRegionSection *, bool);
+void hvf_handle_io(CPUArchState *, uint16_t, void *,
+                  int, int, int);
+hvf_slot *hvf_find_overlap_slot(uint64_t, uint64_t);
+
+/* Returns 1 if HVF is available and enabled, 0 otherwise. */
+int hvf_enabled(void);
+
+/* Disable HVF if |disable| is 1, otherwise, enable it iff it is supported by the host CPU.
+ * Use hvf_enabled() after this to get the result. */
+void hvf_disable(int disable);
+
+/* Returns non-0 if the host CPU supports the VMX "unrestricted guest" feature which
+ * allows the virtual CPU to directly run in "real mode". If true, this allows QEMU to run
+ * several vCPU threads in parallel (see cpus.c). Otherwise, only a a single TCG thread
+ * can run, and it will call HVF to run the current instructions, except in case of
+ * "real mode" (paging disabled, typically at boot time), or MMIO operations. */
+// int hvf_ug_platform(void); does not apply to HVF; assume we must be in UG mode
+
+int hvf_sync_vcpus(void);
+
+int hvf_init_vcpu(CPUState *);
+int hvf_vcpu_exec(CPUState *);
+int hvf_smp_cpu_exec(CPUState *);
+void hvf_cpu_synchronize_state(CPUState *);
+void hvf_cpu_synchronize_post_reset(CPUState *);
+void hvf_cpu_synchronize_post_init(CPUState *);
+void _hvf_cpu_synchronize_post_init(CPUState *, run_on_cpu_data);
+
+void hvf_vcpu_destroy(CPUState *);
+void hvf_raise_event(CPUState *);
+// void hvf_reset_vcpu_state(void *opaque);
+void vmx_reset_vcpu(CPUState *);
+void __hvf_cpu_synchronize_state(CPUState *, run_on_cpu_data);
+void __hvf_cpu_synchronize_post_reset(CPUState *, run_on_cpu_data);
+void vmx_update_tpr(CPUState *);
+void update_apic_tpr(CPUState *);
+int apic_get_highest_priority_irr(DeviceState *);
+int hvf_put_registers(CPUState *);
+
+#define TYPE_HVF_ACCEL ACCEL_CLASS_NAME("hvf")
+
+#define HVF_STATE(obj) \
+    OBJECT_CHECK(HVFState, (obj), TYPE_HVF_ACCEL)
+
+#endif
diff --git a/target/i386/hvf-all.c b/target/i386/hvf-all.c
new file mode 100644
index 0000000000..0a1a5134f8
--- /dev/null
+++ b/target/i386/hvf-all.c
@@ -0,0 +1,999 @@
+// Copyright 2008 IBM Corporation
+//           2008 Red Hat, Inc.
+// Copyright 2011 Intel Corporation
+// Copyright 2016 Veertu, Inc.
+// Copyright 2017 The Android Open Source Project
+// 
+// QEMU Hypervisor.framework support
+// 
+// This software is licensed under the terms of the GNU General Public
+// License version 2, as published by the Free Software Foundation, and
+// may be copied, distributed, and modified under those terms.
+// 
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+#include "qemu/osdep.h"
+#include "qemu-common.h"
+
+#include "sysemu/hvf.h"
+#include "hvf-i386.h"
+#include "hvf-utils/vmcs.h"
+#include "hvf-utils/vmx.h"
+#include "hvf-utils/x86.h"
+#include "hvf-utils/x86_descr.h"
+#include "hvf-utils/x86_mmu.h"
+#include "hvf-utils/x86_decode.h"
+#include "hvf-utils/x86_emu.h"
+#include "hvf-utils/x86_cpuid.h"
+#include "hvf-utils/x86hvf.h"
+
+#include <Hypervisor/hv.h>
+#include <Hypervisor/hv_vmx.h>
+
+#include "exec/address-spaces.h"
+#include "exec/exec-all.h"
+#include "exec/ioport.h"
+#include "hw/i386/apic_internal.h"
+#include "hw/boards.h"
+#include "qemu/main-loop.h"
+#include "strings.h"
+#include "trace.h"
+#include "sysemu/accel.h"
+#include "sysemu/sysemu.h"
+#include "target/i386/cpu.h"
+
+pthread_rwlock_t mem_lock = PTHREAD_RWLOCK_INITIALIZER;
+HVFState *hvf_state;
+static int hvf_disabled = 1;
+
+static void assert_hvf_ok(hv_return_t ret)
+{
+    if (ret == HV_SUCCESS)
+        return;
+
+    switch (ret) {
+        case HV_ERROR:
+            fprintf(stderr, "Error: HV_ERROR\n");
+            break;
+        case HV_BUSY:
+            fprintf(stderr, "Error: HV_BUSY\n");
+            break;
+        case HV_BAD_ARGUMENT:
+            fprintf(stderr, "Error: HV_BAD_ARGUMENT\n");
+            break;
+        case HV_NO_RESOURCES:
+            fprintf(stderr, "Error: HV_NO_RESOURCES\n");
+            break;
+        case HV_NO_DEVICE:
+            fprintf(stderr, "Error: HV_NO_DEVICE\n");
+            break;
+        case HV_UNSUPPORTED:
+            fprintf(stderr, "Error: HV_UNSUPPORTED\n");
+            break;
+        default:
+            fprintf(stderr, "Unknown Error\n");
+    }
+
+    abort();
+}
+
+// Memory slots/////////////////////////////////////////////////////////////////
+
+hvf_slot *hvf_find_overlap_slot(uint64_t start, uint64_t end) {
+    hvf_slot *slot;
+    int x;
+    for (x = 0; x < hvf_state->num_slots; ++x) {
+        slot = &hvf_state->slots[x];
+        if (slot->size && start < (slot->start + slot->size) && end > slot->start)
+            return slot;
+    }
+    return NULL;
+}
+
+struct mac_slot {
+    int present;
+    uint64_t size;
+    uint64_t gpa_start;
+    uint64_t gva;
+};
+
+struct mac_slot mac_slots[32];
+#define ALIGN(x, y)  (((x)+(y)-1) & ~((y)-1))
+
+int __hvf_set_memory(hvf_slot *slot)
+{
+    struct mac_slot *macslot;
+    hv_memory_flags_t flags;
+    pthread_rwlock_wrlock(&mem_lock);
+    hv_return_t ret;
+
+    macslot = &mac_slots[slot->slot_id];
+
+    if (macslot->present) {
+        if (macslot->size != slot->size) {
+            macslot->present = 0;
+            ret = hv_vm_unmap(macslot->gpa_start, macslot->size);
+            assert_hvf_ok(ret);
+        }
+    }
+
+    if (!slot->size) {
+        pthread_rwlock_unlock(&mem_lock);
+        return 0;
+    }
+
+    flags = HV_MEMORY_READ | HV_MEMORY_WRITE | HV_MEMORY_EXEC;
+
+    macslot->present = 1;
+    macslot->gpa_start = slot->start;
+    macslot->size = slot->size;
+    ret = hv_vm_map((hv_uvaddr_t)slot->mem, slot->start, slot->size, flags);
+    assert_hvf_ok(ret);
+    pthread_rwlock_unlock(&mem_lock);
+    return 0;
+}
+
+void hvf_set_phys_mem(MemoryRegionSection* section, bool add)
+{
+    hvf_slot *mem;
+    MemoryRegion *area = section->mr;
+
+    if (!memory_region_is_ram(area)) return;
+
+    mem = hvf_find_overlap_slot(
+            section->offset_within_address_space,
+            section->offset_within_address_space + int128_get64(section->size));
+
+    if (mem && add) {
+        if (mem->size == int128_get64(section->size) &&
+                mem->start == section->offset_within_address_space &&
+                mem->mem == (memory_region_get_ram_ptr(area) + section->offset_within_region))
+            return; // Same region was attempted to register, go away.
+    }
+
+    // Region needs to be reset. set the size to 0 and remap it.
+    if (mem) {
+        mem->size = 0;
+        if (__hvf_set_memory(mem)) {
+            fprintf(stderr, "Failed to reset overlapping slot\n");
+            abort();
+        }
+    }
+
+    if (!add) return;
+
+    // Now make a new slot.
+    int x;
+
+    for (x = 0; x < hvf_state->num_slots; ++x) {
+        mem = &hvf_state->slots[x];
+        if (!mem->size)
+            break;
+    }
+
+    if (x == hvf_state->num_slots) {
+        fprintf(stderr, "No free slots\n");
+        abort();
+    }
+
+    mem->size = int128_get64(section->size);
+    mem->mem = memory_region_get_ram_ptr(area) + section->offset_within_region;
+    mem->start = section->offset_within_address_space;
+
+    if (__hvf_set_memory(mem)) {
+        fprintf(stderr, "Error registering new memory slot\n");
+        abort();
+    }
+}
+
+/* return -1 if no bit is set */
+static int get_highest_priority_int(uint32_t *tab)
+{
+    int i;
+    for (i = 7; i >= 0; i--) {
+        if (tab[i] != 0) {
+            return i * 32 + apic_fls_bit(tab[i]);
+        }
+    }
+    return -1;
+}
+
+void vmx_update_tpr(CPUState *cpu)
+{
+    // TODO: need integrate APIC handling
+    X86CPU *x86_cpu = X86_CPU(cpu);
+    int tpr = cpu_get_apic_tpr(x86_cpu->apic_state) << 4;
+    int irr = apic_get_highest_priority_irr(x86_cpu->apic_state);
+
+    wreg(cpu->hvf_fd, HV_X86_TPR, tpr);
+    if (irr == -1)
+        wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, 0);
+    else
+        wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, (irr > tpr) ? tpr >> 4 : irr >> 4);
+}
+
+void update_apic_tpr(CPUState *cpu)
+{
+    X86CPU *x86_cpu = X86_CPU(cpu);
+    int tpr = rreg(cpu->hvf_fd, HV_X86_TPR) >> 4;
+    cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
+}
+
+#define VECTORING_INFO_VECTOR_MASK     0xff
+
+// TODO: taskswitch handling
+static void save_state_to_tss32(CPUState *cpu, struct x86_tss_segment32 *tss)
+{
+    /* CR3 and ldt selector are not saved intentionally */
+    tss->eip = EIP(cpu);
+    tss->eflags = EFLAGS(cpu);
+    tss->eax = EAX(cpu);
+    tss->ecx = ECX(cpu);
+    tss->edx = EDX(cpu);
+    tss->ebx = EBX(cpu);
+    tss->esp = ESP(cpu);
+    tss->ebp = EBP(cpu);
+    tss->esi = ESI(cpu);
+    tss->edi = EDI(cpu);
+
+    tss->es = vmx_read_segment_selector(cpu, REG_SEG_ES).sel;
+    tss->cs = vmx_read_segment_selector(cpu, REG_SEG_CS).sel;
+    tss->ss = vmx_read_segment_selector(cpu, REG_SEG_SS).sel;
+    tss->ds = vmx_read_segment_selector(cpu, REG_SEG_DS).sel;
+    tss->fs = vmx_read_segment_selector(cpu, REG_SEG_FS).sel;
+    tss->gs = vmx_read_segment_selector(cpu, REG_SEG_GS).sel;
+}
+
+static void load_state_from_tss32(CPUState *cpu, struct x86_tss_segment32 *tss)
+{
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_CR3, tss->cr3);
+
+    RIP(cpu) = tss->eip;
+    EFLAGS(cpu) = tss->eflags | 2;
+
+    /* General purpose registers */
+    RAX(cpu) = tss->eax;
+    RCX(cpu) = tss->ecx;
+    RDX(cpu) = tss->edx;
+    RBX(cpu) = tss->ebx;
+    RSP(cpu) = tss->esp;
+    RBP(cpu) = tss->ebp;
+    RSI(cpu) = tss->esi;
+    RDI(cpu) = tss->edi;
+
+    vmx_write_segment_selector(cpu, (x68_segment_selector){{tss->ldt}}, REG_SEG_LDTR);
+    vmx_write_segment_selector(cpu, (x68_segment_selector){{tss->es}}, REG_SEG_ES);
+    vmx_write_segment_selector(cpu, (x68_segment_selector){{tss->cs}}, REG_SEG_CS);
+    vmx_write_segment_selector(cpu, (x68_segment_selector){{tss->ss}}, REG_SEG_SS);
+    vmx_write_segment_selector(cpu, (x68_segment_selector){{tss->ds}}, REG_SEG_DS);
+    vmx_write_segment_selector(cpu, (x68_segment_selector){{tss->fs}}, REG_SEG_FS);
+    vmx_write_segment_selector(cpu, (x68_segment_selector){{tss->gs}}, REG_SEG_GS);
+
+#if 0
+    load_segment(cpu, REG_SEG_LDTR, tss->ldt);
+    load_segment(cpu, REG_SEG_ES, tss->es);
+    load_segment(cpu, REG_SEG_CS, tss->cs);
+    load_segment(cpu, REG_SEG_SS, tss->ss);
+    load_segment(cpu, REG_SEG_DS, tss->ds);
+    load_segment(cpu, REG_SEG_FS, tss->fs);
+    load_segment(cpu, REG_SEG_GS, tss->gs);
+#endif
+}
+
+static int task_switch_32(CPUState *cpu, x68_segment_selector tss_sel, x68_segment_selector old_tss_sel,
+                          uint64_t old_tss_base, struct x86_segment_descriptor *new_desc)
+{
+    struct x86_tss_segment32 tss_seg;
+    uint32_t new_tss_base = x86_segment_base(new_desc);
+    uint32_t eip_offset = offsetof(struct x86_tss_segment32, eip);
+    uint32_t ldt_sel_offset = offsetof(struct x86_tss_segment32, ldt);
+
+    vmx_read_mem(cpu, &tss_seg, old_tss_base, sizeof(tss_seg));
+    save_state_to_tss32(cpu, &tss_seg);
+
+    vmx_write_mem(cpu, old_tss_base + eip_offset, &tss_seg.eip, ldt_sel_offset - eip_offset);
+    vmx_read_mem(cpu, &tss_seg, new_tss_base, sizeof(tss_seg));
+
+    if (old_tss_sel.sel != 0xffff) {
+        tss_seg.prev_tss = old_tss_sel.sel;
+
+        vmx_write_mem(cpu, new_tss_base, &tss_seg.prev_tss, sizeof(tss_seg.prev_tss));
+    }
+    load_state_from_tss32(cpu, &tss_seg);
+    return 0;
+}
+
+static void vmx_handle_task_switch(CPUState *cpu, x68_segment_selector tss_sel, int reason, bool gate_valid, uint8_t gate, uint64_t gate_type)
+{
+    uint64_t rip = rreg(cpu->hvf_fd, HV_X86_RIP);
+    if (!gate_valid || (gate_type != VMCS_INTR_T_HWEXCEPTION &&
+                        gate_type != VMCS_INTR_T_HWINTR &&
+                        gate_type != VMCS_INTR_T_NMI)) {
+        int ins_len = rvmcs(cpu->hvf_fd, VMCS_EXIT_INSTRUCTION_LENGTH);
+        macvm_set_rip(cpu, rip + ins_len);
+        return;
+    }
+
+    load_regs(cpu);
+
+    struct x86_segment_descriptor curr_tss_desc, next_tss_desc;
+    int ret;
+    x68_segment_selector old_tss_sel = vmx_read_segment_selector(cpu, REG_SEG_TR);
+    uint64_t old_tss_base = vmx_read_segment_base(cpu, REG_SEG_TR);
+    uint32_t desc_limit;
+    struct x86_call_gate task_gate_desc;
+    struct vmx_segment vmx_seg;
+
+    x86_read_segment_descriptor(cpu, &next_tss_desc, tss_sel);
+    x86_read_segment_descriptor(cpu, &curr_tss_desc, old_tss_sel);
+
+    if (reason == TSR_IDT_GATE && gate_valid) {
+        int dpl;
+
+        ret = x86_read_call_gate(cpu, &task_gate_desc, gate);
+
+        dpl = task_gate_desc.dpl;
+        x68_segment_selector cs = vmx_read_segment_selector(cpu, REG_SEG_CS);
+        if (tss_sel.rpl > dpl || cs.rpl > dpl)
+            ;//DPRINTF("emulate_gp");
+    }
+
+    desc_limit = x86_segment_limit(&next_tss_desc);
+    if (!next_tss_desc.p || ((desc_limit < 0x67 && (next_tss_desc.type & 8)) || desc_limit < 0x2b)) {
+        VM_PANIC("emulate_ts");
+    }
+
+    if (reason == TSR_IRET || reason == TSR_JMP) {
+        curr_tss_desc.type &= ~(1 << 1); /* clear busy flag */
+        x86_write_segment_descriptor(cpu, &curr_tss_desc, old_tss_sel);
+    }
+
+    if (reason == TSR_IRET)
+        EFLAGS(cpu) &= ~RFLAGS_NT;
+
+    if (reason != TSR_CALL && reason != TSR_IDT_GATE)
+        old_tss_sel.sel = 0xffff;
+
+    if (reason != TSR_IRET) {
+        next_tss_desc.type |= (1 << 1); /* set busy flag */
+        x86_write_segment_descriptor(cpu, &next_tss_desc, tss_sel);
+    }
+
+    if (next_tss_desc.type & 8)
+        ret = task_switch_32(cpu, tss_sel, old_tss_sel, old_tss_base, &next_tss_desc);
+    else
+        //ret = task_switch_16(cpu, tss_sel, old_tss_sel, old_tss_base, &next_tss_desc);
+        VM_PANIC("task_switch_16");
+
+    macvm_set_cr0(cpu->hvf_fd, rvmcs(cpu->hvf_fd, VMCS_GUEST_CR0) | CR0_TS);
+    x86_segment_descriptor_to_vmx(cpu, tss_sel, &next_tss_desc, &vmx_seg);
+    vmx_write_segment_descriptor(cpu, &vmx_seg, REG_SEG_TR);
+
+    store_regs(cpu);
+
+    hv_vcpu_invalidate_tlb(cpu->hvf_fd);
+    hv_vcpu_flush(cpu->hvf_fd);
+}
+
+static void hvf_handle_interrupt(CPUState * cpu, int mask)
+{
+    cpu->interrupt_request |= mask;
+    if (!qemu_cpu_is_self(cpu)) {
+        qemu_cpu_kick(cpu);
+    }
+}
+
+void hvf_handle_io(CPUArchState * env, uint16_t port, void* buffer,
+                  int direction, int size, int count)
+{
+    int i;
+    uint8_t *ptr = buffer;
+
+    for (i = 0; i < count; i++) {
+        address_space_rw(&address_space_io, port, MEMTXATTRS_UNSPECIFIED,
+                         ptr, size,
+                         direction);
+        ptr += size;
+    }
+}
+//
+// TODO: synchronize vcpu state
+void __hvf_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg)
+{
+    CPUState *cpu_state = cpu;//(CPUState *)data;
+    if (cpu_state->hvf_vcpu_dirty == 0)
+        hvf_get_registers(cpu_state);
+
+    cpu_state->hvf_vcpu_dirty = 1;
+}
+
+void hvf_cpu_synchronize_state(CPUState *cpu_state)
+{
+    if (cpu_state->hvf_vcpu_dirty == 0)
+        run_on_cpu(cpu_state, __hvf_cpu_synchronize_state, RUN_ON_CPU_NULL);
+}
+
+void __hvf_cpu_synchronize_post_reset(CPUState *cpu, run_on_cpu_data arg)
+{
+    CPUState *cpu_state = cpu;
+    hvf_put_registers(cpu_state);
+    cpu_state->hvf_vcpu_dirty = false;
+}
+
+void hvf_cpu_synchronize_post_reset(CPUState *cpu_state)
+{
+    run_on_cpu(cpu_state, __hvf_cpu_synchronize_post_reset, RUN_ON_CPU_NULL);
+}
+
+void _hvf_cpu_synchronize_post_init(CPUState *cpu, run_on_cpu_data arg)
+{
+    CPUState *cpu_state = cpu;
+    hvf_put_registers(cpu_state);
+    cpu_state->hvf_vcpu_dirty = false;
+}
+
+void hvf_cpu_synchronize_post_init(CPUState *cpu_state)
+{
+    run_on_cpu(cpu_state, _hvf_cpu_synchronize_post_init, RUN_ON_CPU_NULL);
+}
+ 
+// TODO: ept fault handlig
+void vmx_clear_int_window_exiting(CPUState *cpu);
+static bool ept_emulation_fault(uint64_t ept_qual)
+{
+	int read, write;
+
+	/* EPT fault on an instruction fetch doesn't make sense here */
+	if (ept_qual & EPT_VIOLATION_INST_FETCH)
+		return false;
+
+	/* EPT fault must be a read fault or a write fault */
+	read = ept_qual & EPT_VIOLATION_DATA_READ ? 1 : 0;
+	write = ept_qual & EPT_VIOLATION_DATA_WRITE ? 1 : 0;
+	if ((read | write) == 0)
+		return false;
+
+	/*
+	 * The EPT violation must have been caused by accessing a
+	 * guest-physical address that is a translation of a guest-linear
+	 * address.
+	 */
+	if ((ept_qual & EPT_VIOLATION_GLA_VALID) == 0 ||
+	    (ept_qual & EPT_VIOLATION_XLAT_VALID) == 0) {
+		return false;
+	}
+
+	return true;
+}
+
+static void hvf_region_add(MemoryListener * listener,
+                           MemoryRegionSection * section)
+{
+    hvf_set_phys_mem(section, true);
+}
+
+static void hvf_region_del(MemoryListener * listener,
+                           MemoryRegionSection * section)
+{
+    hvf_set_phys_mem(section, false);
+}
+
+static MemoryListener hvf_memory_listener = {
+    .priority = 10,
+    .region_add = hvf_region_add,
+    .region_del = hvf_region_del,
+};
+
+static MemoryListener hvf_io_listener = {
+    .priority = 10,
+};
+
+void vmx_reset_vcpu(CPUState *cpu) {
+
+    wvmcs(cpu->hvf_fd, VMCS_ENTRY_CTLS, 0);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_IA32_EFER, 0);
+    macvm_set_cr0(cpu->hvf_fd, 0x60000010);
+
+    wvmcs(cpu->hvf_fd, VMCS_CR4_MASK, CR4_VMXE_MASK);
+    wvmcs(cpu->hvf_fd, VMCS_CR4_SHADOW, 0x0);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_CR4, CR4_VMXE_MASK);
+
+    // set VMCS guest state fields
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_SELECTOR, 0xf000);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_LIMIT, 0xffff);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_ACCESS_RIGHTS, 0x9b);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_BASE, 0xffff0000);
+
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_SELECTOR, 0);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_LIMIT, 0xffff);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_ACCESS_RIGHTS, 0x93);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_BASE, 0);
+
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_SELECTOR, 0);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_LIMIT, 0xffff);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_ACCESS_RIGHTS, 0x93);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_BASE, 0);
+
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_SELECTOR, 0);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_LIMIT, 0xffff);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_ACCESS_RIGHTS, 0x93);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_BASE, 0);
+
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_SELECTOR, 0);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_LIMIT, 0xffff);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_ACCESS_RIGHTS, 0x93);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_BASE, 0);
+
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_SELECTOR, 0);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_LIMIT, 0xffff);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_ACCESS_RIGHTS, 0x93);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_BASE, 0);
+
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_SELECTOR, 0);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_LIMIT, 0);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_ACCESS_RIGHTS, 0x10000);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_BASE, 0);
+
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_SELECTOR, 0);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_LIMIT, 0);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_ACCESS_RIGHTS, 0x83);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_BASE, 0);
+
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_GDTR_LIMIT, 0);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_GDTR_BASE, 0);
+
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_IDTR_LIMIT, 0);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_IDTR_BASE, 0);
+
+    //wvmcs(cpu->hvf_fd, VMCS_GUEST_CR2, 0x0);
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_CR3, 0x0);
+
+    wreg(cpu->hvf_fd, HV_X86_RIP, 0xfff0);
+    wreg(cpu->hvf_fd, HV_X86_RDX, 0x623);
+    wreg(cpu->hvf_fd, HV_X86_RFLAGS, 0x2);
+    wreg(cpu->hvf_fd, HV_X86_RSP, 0x0);
+    wreg(cpu->hvf_fd, HV_X86_RAX, 0x0);
+    wreg(cpu->hvf_fd, HV_X86_RBX, 0x0);
+    wreg(cpu->hvf_fd, HV_X86_RCX, 0x0);
+    wreg(cpu->hvf_fd, HV_X86_RSI, 0x0);
+    wreg(cpu->hvf_fd, HV_X86_RDI, 0x0);
+    wreg(cpu->hvf_fd, HV_X86_RBP, 0x0);
+
+    for (int i = 0; i < 8; i++)
+         wreg(cpu->hvf_fd, HV_X86_R8+i, 0x0);
+
+    hv_vm_sync_tsc(0);
+    cpu->halted = 0;
+    hv_vcpu_invalidate_tlb(cpu->hvf_fd);
+    hv_vcpu_flush(cpu->hvf_fd);
+}
+
+void hvf_vcpu_destroy(CPUState* cpu) 
+{
+    hv_return_t ret = hv_vcpu_destroy((hv_vcpuid_t)cpu->hvf_fd);
+    assert_hvf_ok(ret);
+}
+
+static void dummy_signal(int sig)
+{
+}
+
+int hvf_init_vcpu(CPUState * cpu) {
+
+    X86CPU *x86cpu;
+    
+    // init cpu signals
+    sigset_t set;
+    struct sigaction sigact;
+
+    memset(&sigact, 0, sizeof(sigact));
+    sigact.sa_handler = dummy_signal;
+    sigaction(SIG_IPI, &sigact, NULL);
+
+    pthread_sigmask(SIG_BLOCK, NULL, &set);
+    sigdelset(&set, SIG_IPI);
+
+    int r;
+    init_emu(cpu);
+    init_decoder(cpu);
+    init_cpuid(cpu);
+
+    cpu->hvf_caps = (struct hvf_vcpu_caps*)g_malloc0(sizeof(struct hvf_vcpu_caps));
+    cpu->hvf_x86 = (struct hvf_x86_state*)g_malloc0(sizeof(struct hvf_x86_state));
+
+    r = hv_vcpu_create((hv_vcpuid_t *)&cpu->hvf_fd, HV_VCPU_DEFAULT);
+    cpu->hvf_vcpu_dirty = 1;
+    assert_hvf_ok(r);
+
+	if (hv_vmx_read_capability(HV_VMX_CAP_PINBASED, &cpu->hvf_caps->vmx_cap_pinbased))
+		abort();
+	if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED, &cpu->hvf_caps->vmx_cap_procbased))
+		abort();
+	if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED2, &cpu->hvf_caps->vmx_cap_procbased2))
+		abort();
+	if (hv_vmx_read_capability(HV_VMX_CAP_ENTRY, &cpu->hvf_caps->vmx_cap_entry))
+		abort();
+
+	/* set VMCS control fields */
+    wvmcs(cpu->hvf_fd, VMCS_PIN_BASED_CTLS, cap2ctrl(cpu->hvf_caps->vmx_cap_pinbased, 0));
+    wvmcs(cpu->hvf_fd, VMCS_PRI_PROC_BASED_CTLS, cap2ctrl(cpu->hvf_caps->vmx_cap_procbased,
+                                                   VMCS_PRI_PROC_BASED_CTLS_HLT |
+                                                   VMCS_PRI_PROC_BASED_CTLS_MWAIT |
+                                                   VMCS_PRI_PROC_BASED_CTLS_TSC_OFFSET |
+                                                   VMCS_PRI_PROC_BASED_CTLS_TPR_SHADOW) |
+                                                   VMCS_PRI_PROC_BASED_CTLS_SEC_CONTROL);
+	wvmcs(cpu->hvf_fd, VMCS_SEC_PROC_BASED_CTLS,
+          cap2ctrl(cpu->hvf_caps->vmx_cap_procbased2,VMCS_PRI_PROC_BASED2_CTLS_APIC_ACCESSES));
+
+	wvmcs(cpu->hvf_fd, VMCS_ENTRY_CTLS, cap2ctrl(cpu->hvf_caps->vmx_cap_entry, 0));
+	wvmcs(cpu->hvf_fd, VMCS_EXCEPTION_BITMAP, 0); /* Double fault */
+
+    wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, 0);
+
+    vmx_reset_vcpu(cpu);
+
+    x86cpu = X86_CPU(cpu);
+    x86cpu->env.kvm_xsave_buf = qemu_memalign(4096, sizeof(struct hvf_xsave_buf));
+
+    hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_STAR, 1);
+    hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_LSTAR, 1);
+    hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_CSTAR, 1);
+    hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_FMASK, 1);
+    hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_FSBASE, 1);
+    hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_GSBASE, 1);
+    hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_KERNELGSBASE, 1);
+    hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_TSC_AUX, 1);
+    //hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_TSC, 1);
+    hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_CS, 1);
+    hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_EIP, 1);
+    hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_ESP, 1);
+
+    return 0;
+}
+
+int hvf_enabled() { return !hvf_disabled; }
+void hvf_disable(int shouldDisable) {
+    hvf_disabled = shouldDisable;
+}
+
+int hvf_vcpu_exec(CPUState* cpu) {
+    X86CPU *x86_cpu = X86_CPU(cpu);
+    CPUX86State *env = &x86_cpu->env;
+    int ret = 0;
+    uint64_t rip = 0;
+
+    cpu->halted = 0;
+
+    if (hvf_process_events(cpu)) {
+        return EXCP_HLT;
+    }
+
+    do {
+        if (cpu->hvf_vcpu_dirty) {
+            hvf_put_registers(cpu);
+            cpu->hvf_vcpu_dirty = false;
+        }
+
+        cpu->hvf_x86->interruptable =
+            !(rvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY) &
+            (VMCS_INTERRUPTIBILITY_STI_BLOCKING | VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING));
+
+        hvf_inject_interrupts(cpu);
+        vmx_update_tpr(cpu);
+
+
+        qemu_mutex_unlock_iothread();
+        if (!cpu_is_bsp(X86_CPU(cpu)) && cpu->halted) {
+            qemu_mutex_lock_iothread();
+            return EXCP_HLT;
+        }
+
+        hv_return_t r  = hv_vcpu_run(cpu->hvf_fd);
+        assert_hvf_ok(r);
+
+        /* handle VMEXIT */
+        uint64_t exit_reason = rvmcs(cpu->hvf_fd, VMCS_EXIT_REASON);
+        uint64_t exit_qual = rvmcs(cpu->hvf_fd, VMCS_EXIT_QUALIFICATION);
+        uint32_t ins_len = (uint32_t)rvmcs(cpu->hvf_fd, VMCS_EXIT_INSTRUCTION_LENGTH);
+        uint64_t idtvec_info = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_INFO);
+        rip = rreg(cpu->hvf_fd, HV_X86_RIP);
+        RFLAGS(cpu) = rreg(cpu->hvf_fd, HV_X86_RFLAGS);
+        env->eflags = RFLAGS(cpu);
+
+        trace_hvf_vm_exit(exit_reason, exit_qual);
+
+        qemu_mutex_lock_iothread();
+
+        update_apic_tpr(cpu);
+        current_cpu = cpu;
+
+        ret = 0;
+        switch (exit_reason) {
+            case EXIT_REASON_HLT: {
+                macvm_set_rip(cpu, rip + ins_len);
+                if (!((cpu->interrupt_request & CPU_INTERRUPT_HARD) && (EFLAGS(cpu) & IF_MASK))
+                    && !(cpu->interrupt_request & CPU_INTERRUPT_NMI) &&
+                    !(idtvec_info & VMCS_IDT_VEC_VALID)) {
+                    cpu->halted = 1;
+                    ret = EXCP_HLT;
+                }
+                ret = EXCP_INTERRUPT;
+                break;
+            }
+            case EXIT_REASON_MWAIT: {
+                ret = EXCP_INTERRUPT;
+                break;
+            }
+                /* Need to check if MMIO or unmmaped fault */
+            case EXIT_REASON_EPT_FAULT:
+            {
+                hvf_slot *slot;
+                addr_t gpa = rvmcs(cpu->hvf_fd, VMCS_GUEST_PHYSICAL_ADDRESS);
+                trace_hvf_vm_exit_gpa(gpa);
+
+                if ((idtvec_info & VMCS_IDT_VEC_VALID) == 0 && (exit_qual & EXIT_QUAL_NMIUDTI) != 0)
+                    vmx_set_nmi_blocking(cpu);
+
+                slot = hvf_find_overlap_slot(gpa, gpa);
+                // mmio
+                if (ept_emulation_fault(exit_qual) && !slot) {
+                    struct x86_decode decode;
+
+                    load_regs(cpu);
+                    cpu->hvf_x86->fetch_rip = rip;
+
+                    decode_instruction(cpu, &decode);
+                    exec_instruction(cpu, &decode);
+                    store_regs(cpu);
+                    break;
+                }
+#ifdef DIRTY_VGA_TRACKING
+                if (slot) {
+                    bool read = exit_qual & EPT_VIOLATION_DATA_READ ? 1 : 0;
+                    bool write = exit_qual & EPT_VIOLATION_DATA_WRITE ? 1 : 0;
+                    if (!read && !write)
+                        break;
+                    int flags = HV_MEMORY_READ | HV_MEMORY_EXEC;
+                    if (write) flags |= HV_MEMORY_WRITE;
+
+                    pthread_rwlock_wrlock(&mem_lock);
+                    if (write)
+                        mark_slot_page_dirty(slot, gpa);
+                    hv_vm_protect(gpa & ~0xfff, 4096, flags);
+                    pthread_rwlock_unlock(&mem_lock);
+                }
+#endif
+                break;
+            }
+            case EXIT_REASON_INOUT:
+            {
+                uint32_t in = (exit_qual & 8) != 0;
+                uint32_t size =  (exit_qual & 7) + 1;
+                uint32_t string =  (exit_qual & 16) != 0;
+                uint32_t port =  exit_qual >> 16;
+                //uint32_t rep = (exit_qual & 0x20) != 0;
+
+#if 1
+                if (!string && in) {
+                    uint64_t val = 0;
+                    load_regs(cpu);
+                    hvf_handle_io(env, port, &val, 0, size, 1);
+                    if (size == 1) AL(cpu) = val;
+                    else if (size == 2) AX(cpu) = val;
+                    else if (size == 4) RAX(cpu) = (uint32_t)val;
+                    else VM_PANIC("size");
+                    RIP(cpu) += ins_len;
+                    store_regs(cpu);
+                    break;
+                } else if (!string && !in) {
+                    RAX(cpu) = rreg(cpu->hvf_fd, HV_X86_RAX);
+                    hvf_handle_io(env, port, &RAX(cpu), 1, size, 1);
+                    macvm_set_rip(cpu, rip + ins_len);
+                    break;
+                }
+#endif
+                struct x86_decode decode;
+
+                load_regs(cpu);
+                cpu->hvf_x86->fetch_rip = rip;
+
+                decode_instruction(cpu, &decode);
+                VM_PANIC_ON(ins_len != decode.len);
+                exec_instruction(cpu, &decode);
+                store_regs(cpu);
+
+                break;
+            }
+            case EXIT_REASON_CPUID: {
+                uint32_t rax = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RAX);
+                uint32_t rbx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RBX);
+                uint32_t rcx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RCX);
+                uint32_t rdx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RDX);
+
+                get_cpuid_func(cpu, rax, rcx, &rax, &rbx, &rcx, &rdx);
+
+                wreg(cpu->hvf_fd, HV_X86_RAX, rax);
+                wreg(cpu->hvf_fd, HV_X86_RBX, rbx);
+                wreg(cpu->hvf_fd, HV_X86_RCX, rcx);
+                wreg(cpu->hvf_fd, HV_X86_RDX, rdx);
+
+                macvm_set_rip(cpu, rip + ins_len);
+                break;
+            }
+            case EXIT_REASON_XSETBV: {
+                X86CPU *x86_cpu = X86_CPU(cpu);
+                CPUX86State *env = &x86_cpu->env;
+                uint32_t eax = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RAX);
+                uint32_t ecx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RCX);
+                uint32_t edx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RDX);
+
+                if (ecx) {
+                    macvm_set_rip(cpu, rip + ins_len);
+                    break;
+                }
+                env->xcr0 = ((uint64_t)edx << 32) | eax;
+                wreg(cpu->hvf_fd, HV_X86_XCR0, env->xcr0 | 1);
+                macvm_set_rip(cpu, rip + ins_len);
+                break;
+            }
+            case EXIT_REASON_INTR_WINDOW:
+                vmx_clear_int_window_exiting(cpu);
+                ret = EXCP_INTERRUPT;
+                break;
+            case EXIT_REASON_NMI_WINDOW:
+                vmx_clear_nmi_window_exiting(cpu);
+                ret = EXCP_INTERRUPT;
+                break;
+            case EXIT_REASON_EXT_INTR:
+                /* force exit and allow io handling */
+                ret = EXCP_INTERRUPT;
+                break;
+            case EXIT_REASON_RDMSR:
+            case EXIT_REASON_WRMSR:
+            {
+                load_regs(cpu);
+                if (exit_reason == EXIT_REASON_RDMSR)
+                    simulate_rdmsr(cpu);
+                else
+                    simulate_wrmsr(cpu);
+                RIP(cpu) += rvmcs(cpu->hvf_fd, VMCS_EXIT_INSTRUCTION_LENGTH);
+                store_regs(cpu);
+                break;
+            }
+            case EXIT_REASON_CR_ACCESS: {
+                int cr;
+                int reg;
+
+                load_regs(cpu);
+                cr = exit_qual & 15;
+                reg = (exit_qual >> 8) & 15;
+
+                switch (cr) {
+                    case 0x0: {
+                        macvm_set_cr0(cpu->hvf_fd, RRX(cpu, reg));
+                        break;
+                    }
+                    case 4: {
+                        macvm_set_cr4(cpu->hvf_fd, RRX(cpu, reg));
+                        break;
+                    }
+                    case 8: {
+                        X86CPU *x86_cpu = X86_CPU(cpu);
+                        if (exit_qual & 0x10) {
+                            RRX(cpu, reg) = cpu_get_apic_tpr(x86_cpu->apic_state);
+                        }
+                        else {
+                            int tpr = RRX(cpu, reg);
+                            cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
+                            ret = EXCP_INTERRUPT;
+                        }
+                        break;
+                    }
+                    default:
+                        fprintf(stderr, "Unrecognized CR %d\n", cr);
+                        abort();
+                }
+                RIP(cpu) += ins_len;
+                store_regs(cpu);
+                break;
+            }
+            case EXIT_REASON_APIC_ACCESS: { // TODO
+                struct x86_decode decode;
+
+                load_regs(cpu);
+                cpu->hvf_x86->fetch_rip = rip;
+
+                decode_instruction(cpu, &decode);
+                exec_instruction(cpu, &decode);
+                store_regs(cpu);
+                break;
+            }
+            case EXIT_REASON_TPR: {
+                ret = 1;
+                break;
+            }
+            case EXIT_REASON_TASK_SWITCH: {
+                uint64_t vinfo = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_INFO);
+                x68_segment_selector sel = {.sel = exit_qual & 0xffff};
+                vmx_handle_task_switch(cpu, sel, (exit_qual >> 30) & 0x3,
+                 vinfo & VMCS_INTR_VALID, vinfo & VECTORING_INFO_VECTOR_MASK, vinfo & VMCS_INTR_T_MASK);
+                break;
+            }
+            case EXIT_REASON_TRIPLE_FAULT: {
+                //addr_t gpa = rvmcs(cpu->hvf_fd, VMCS_GUEST_PHYSICAL_ADDRESS);
+                qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
+                usleep(1000 * 100);
+                ret = EXCP_INTERRUPT;
+                break;
+            }
+            case EXIT_REASON_RDPMC:
+                wreg(cpu->hvf_fd, HV_X86_RAX, 0);
+                wreg(cpu->hvf_fd, HV_X86_RDX, 0);
+                macvm_set_rip(cpu, rip + ins_len);
+                break;
+            case VMX_REASON_VMCALL:
+                // TODO: maybe just take this out?
+                // if (g_hypervisor_iface) {
+                //     load_regs(cpu);
+                //     g_hypervisor_iface->hypercall_handler(cpu);
+                //     RIP(cpu) += rvmcs(cpu->hvf_fd, VMCS_EXIT_INSTRUCTION_LENGTH);
+                //     store_regs(cpu);
+                // }
+                break;
+            default:
+                fprintf(stderr, "%llx: unhandled exit %llx\n", rip, exit_reason);
+        }
+    } while (ret == 0);
+
+    return ret;
+}
+
+static bool hvf_allowed;
+
+static int hvf_accel_init(MachineState *ms)
+{
+    int x;
+    hv_return_t ret;
+    HVFState *s;
+
+    hvf_disable(0);
+    ret = hv_vm_create(HV_VM_DEFAULT);
+    assert_hvf_ok(ret);
+
+    s = (HVFState *)g_malloc0(sizeof(HVFState));
+ 
+    s->num_slots = 32;
+    for (x = 0; x < s->num_slots; ++x) {
+        s->slots[x].size = 0;
+        s->slots[x].slot_id = x;
+    }
+  
+    hvf_state = s;
+    cpu_interrupt_handler = hvf_handle_interrupt;
+    memory_listener_register(&hvf_memory_listener, &address_space_memory);
+    memory_listener_register(&hvf_io_listener, &address_space_io);
+    return 0;
+}
+
+static void hvf_accel_class_init(ObjectClass *oc, void *data)
+{
+    AccelClass *ac = ACCEL_CLASS(oc);
+    ac->name = "HVF";
+    ac->init_machine = hvf_accel_init;
+    ac->allowed = &hvf_allowed;
+}
+
+static const TypeInfo hvf_accel_type = {
+    .name = TYPE_HVF_ACCEL,
+    .parent = TYPE_ACCEL,
+    .class_init = hvf_accel_class_init,
+};
+
+static void hvf_type_init(void)
+{
+    type_register_static(&hvf_accel_type);
+}
+
+type_init(hvf_type_init);
diff --git a/target/i386/hvf-i386.h b/target/i386/hvf-i386.h
new file mode 100644
index 0000000000..f3f958058a
--- /dev/null
+++ b/target/i386/hvf-i386.h
@@ -0,0 +1,48 @@
+/*
+ * QEMU Hypervisor.framework (HVF) support
+ *
+ * Copyright 2017 Google Inc
+ *
+ * Adapted from target-i386/hax-i386.h:
+ * Copyright (c) 2011 Intel Corporation
+ *  Written by:
+ *  Jiang Yunhong<yunhong.jiang@intel.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ */
+
+#ifndef _HVF_I386_H
+#define _HVF_I386_H
+
+#include "sysemu/hvf.h"
+#include "cpu.h"
+#include "hvf-utils/x86.h"
+
+#define HVF_MAX_VCPU 0x10
+#define MAX_VM_ID 0x40
+#define MAX_VCPU_ID 0x40
+
+extern struct hvf_state hvf_global;
+
+struct hvf_vm {
+    int id;
+    struct hvf_vcpu_state *vcpus[HVF_MAX_VCPU];
+};
+
+struct hvf_state {
+    uint32_t version;
+    struct hvf_vm *vm;
+    uint64_t mem_quota;
+};
+
+#ifdef NEED_CPU_H
+/* Functions exported to host specific mode */
+
+/* Host specific functions */
+int hvf_inject_interrupt(CPUArchState * env, int vector);
+int hvf_vcpu_run(struct hvf_vcpu_state *vcpu);
+#endif
+
+#endif
diff --git a/target/i386/hvf-utils/Makefile.objs b/target/i386/hvf-utils/Makefile.objs
new file mode 100644
index 0000000000..7df219ad9c
--- /dev/null
+++ b/target/i386/hvf-utils/Makefile.objs
@@ -0,0 +1 @@
+obj-y += x86.o x86_cpuid.o x86_decode.o x86_descr.o x86_emu.o x86_flags.o x86_mmu.o x86hvf.o
diff --git a/target/i386/hvf-utils/README.md b/target/i386/hvf-utils/README.md
new file mode 100644
index 0000000000..0d27a0d52b
--- /dev/null
+++ b/target/i386/hvf-utils/README.md
@@ -0,0 +1,7 @@
+# OS X Hypervisor.framework support in QEMU
+
+These sources (and ../hvf-all.c) are adapted from Veertu Inc's vdhh (Veertu Desktop Hosted Hypervisor) (last known location: https://github.com/veertuinc/vdhh) with some minor changes, the most significant of which were:
+
+1. Adapt to our current QEMU's `CPUState` structure and `address_space_rw` API; many struct members have been moved around (emulated x86 state, kvm_xsave_buf) due to historical differences + QEMU needing to handle more emulation targets.
+2. Removal of `apic_page` and hyperv-related functionality.
+3. More relaxed use of `qemu_mutex_lock_iothread`.
diff --git a/target/i386/hvf-utils/vmcs.h b/target/i386/hvf-utils/vmcs.h
new file mode 100644
index 0000000000..6f7ccb361a
--- /dev/null
+++ b/target/i386/hvf-utils/vmcs.h
@@ -0,0 +1,368 @@
+/*-
+ * Copyright (c) 2011 NetApp, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _VMCS_H_
+#define	_VMCS_H_
+
+#include <Hypervisor/hv.h>
+#include <Hypervisor/hv_vmx.h>
+
+#define	VMCS_INITIAL			0xffffffffffffffff
+
+#define	VMCS_IDENT(encoding)		((encoding) | 0x80000000)
+/*
+ * VMCS field encodings from Appendix H, Intel Architecture Manual Vol3B.
+ */
+#define	VMCS_INVALID_ENCODING		0xffffffff
+
+/* 16-bit control fields */
+#define	VMCS_VPID			0x00000000
+#define	VMCS_PIR_VECTOR			0x00000002
+
+/* 16-bit guest-state fields */
+#define	VMCS_GUEST_ES_SELECTOR		0x00000800
+#define	VMCS_GUEST_CS_SELECTOR		0x00000802
+#define	VMCS_GUEST_SS_SELECTOR		0x00000804
+#define	VMCS_GUEST_DS_SELECTOR		0x00000806
+#define	VMCS_GUEST_FS_SELECTOR		0x00000808
+#define	VMCS_GUEST_GS_SELECTOR		0x0000080A
+#define	VMCS_GUEST_LDTR_SELECTOR	0x0000080C
+#define	VMCS_GUEST_TR_SELECTOR		0x0000080E
+#define	VMCS_GUEST_INTR_STATUS		0x00000810
+
+/* 16-bit host-state fields */
+#define	VMCS_HOST_ES_SELECTOR		0x00000C00
+#define	VMCS_HOST_CS_SELECTOR		0x00000C02
+#define	VMCS_HOST_SS_SELECTOR		0x00000C04
+#define	VMCS_HOST_DS_SELECTOR		0x00000C06
+#define	VMCS_HOST_FS_SELECTOR		0x00000C08
+#define	VMCS_HOST_GS_SELECTOR		0x00000C0A
+#define	VMCS_HOST_TR_SELECTOR		0x00000C0C
+
+/* 64-bit control fields */
+#define	VMCS_IO_BITMAP_A		0x00002000
+#define	VMCS_IO_BITMAP_B		0x00002002
+#define	VMCS_MSR_BITMAP			0x00002004
+#define	VMCS_EXIT_MSR_STORE		0x00002006
+#define	VMCS_EXIT_MSR_LOAD		0x00002008
+#define	VMCS_ENTRY_MSR_LOAD		0x0000200A
+#define	VMCS_EXECUTIVE_VMCS		0x0000200C
+#define	VMCS_TSC_OFFSET			0x00002010
+#define	VMCS_VIRTUAL_APIC		0x00002012
+#define	VMCS_APIC_ACCESS		0x00002014
+#define	VMCS_PIR_DESC			0x00002016
+#define	VMCS_EPTP			0x0000201A
+#define	VMCS_EOI_EXIT0			0x0000201C
+#define	VMCS_EOI_EXIT1			0x0000201E
+#define	VMCS_EOI_EXIT2			0x00002020
+#define	VMCS_EOI_EXIT3			0x00002022
+#define	VMCS_EOI_EXIT(vector)		(VMCS_EOI_EXIT0 + ((vector) / 64) * 2)
+
+/* 64-bit read-only fields */
+#define	VMCS_GUEST_PHYSICAL_ADDRESS	0x00002400
+
+/* 64-bit guest-state fields */
+#define	VMCS_LINK_POINTER		0x00002800
+#define	VMCS_GUEST_IA32_DEBUGCTL	0x00002802
+#define	VMCS_GUEST_IA32_PAT		0x00002804
+#define	VMCS_GUEST_IA32_EFER		0x00002806
+#define	VMCS_GUEST_IA32_PERF_GLOBAL_CTRL 0x00002808
+#define	VMCS_GUEST_PDPTE0		0x0000280A
+#define	VMCS_GUEST_PDPTE1		0x0000280C
+#define	VMCS_GUEST_PDPTE2		0x0000280E
+#define	VMCS_GUEST_PDPTE3		0x00002810
+
+/* 64-bit host-state fields */
+#define	VMCS_HOST_IA32_PAT		0x00002C00
+#define	VMCS_HOST_IA32_EFER		0x00002C02
+#define	VMCS_HOST_IA32_PERF_GLOBAL_CTRL	0x00002C04
+
+/* 32-bit control fields */
+#define	VMCS_PIN_BASED_CTLS		0x00004000
+#define	VMCS_PRI_PROC_BASED_CTLS	0x00004002
+#define	VMCS_EXCEPTION_BITMAP		0x00004004
+#define	VMCS_PF_ERROR_MASK		0x00004006
+#define	VMCS_PF_ERROR_MATCH		0x00004008
+#define	VMCS_CR3_TARGET_COUNT		0x0000400A
+#define	VMCS_EXIT_CTLS			0x0000400C
+#define	VMCS_EXIT_MSR_STORE_COUNT	0x0000400E
+#define	VMCS_EXIT_MSR_LOAD_COUNT	0x00004010
+#define	VMCS_ENTRY_CTLS			0x00004012
+#define	VMCS_ENTRY_MSR_LOAD_COUNT	0x00004014
+#define	VMCS_ENTRY_INTR_INFO		0x00004016
+#define	VMCS_ENTRY_EXCEPTION_ERROR	0x00004018
+#define	VMCS_ENTRY_INST_LENGTH		0x0000401A
+#define	VMCS_TPR_THRESHOLD		0x0000401C
+#define	VMCS_SEC_PROC_BASED_CTLS	0x0000401E
+#define	VMCS_PLE_GAP			0x00004020
+#define	VMCS_PLE_WINDOW			0x00004022
+
+/* 32-bit read-only data fields */
+#define	VMCS_INSTRUCTION_ERROR		0x00004400
+#define	VMCS_EXIT_REASON		0x00004402
+#define	VMCS_EXIT_INTR_INFO		0x00004404
+#define	VMCS_EXIT_INTR_ERRCODE		0x00004406
+#define	VMCS_IDT_VECTORING_INFO		0x00004408
+#define	VMCS_IDT_VECTORING_ERROR	0x0000440A
+#define	VMCS_EXIT_INSTRUCTION_LENGTH	0x0000440C
+#define	VMCS_EXIT_INSTRUCTION_INFO	0x0000440E
+
+/* 32-bit guest-state fields */
+#define	VMCS_GUEST_ES_LIMIT		0x00004800
+#define	VMCS_GUEST_CS_LIMIT		0x00004802
+#define	VMCS_GUEST_SS_LIMIT		0x00004804
+#define	VMCS_GUEST_DS_LIMIT		0x00004806
+#define	VMCS_GUEST_FS_LIMIT		0x00004808
+#define	VMCS_GUEST_GS_LIMIT		0x0000480A
+#define	VMCS_GUEST_LDTR_LIMIT		0x0000480C
+#define	VMCS_GUEST_TR_LIMIT		0x0000480E
+#define	VMCS_GUEST_GDTR_LIMIT		0x00004810
+#define	VMCS_GUEST_IDTR_LIMIT		0x00004812
+#define	VMCS_GUEST_ES_ACCESS_RIGHTS	0x00004814
+#define	VMCS_GUEST_CS_ACCESS_RIGHTS	0x00004816
+#define	VMCS_GUEST_SS_ACCESS_RIGHTS	0x00004818
+#define	VMCS_GUEST_DS_ACCESS_RIGHTS	0x0000481A
+#define	VMCS_GUEST_FS_ACCESS_RIGHTS	0x0000481C
+#define	VMCS_GUEST_GS_ACCESS_RIGHTS	0x0000481E
+#define	VMCS_GUEST_LDTR_ACCESS_RIGHTS	0x00004820
+#define	VMCS_GUEST_TR_ACCESS_RIGHTS	0x00004822
+#define	VMCS_GUEST_INTERRUPTIBILITY	0x00004824
+#define	VMCS_GUEST_ACTIVITY		0x00004826
+#define VMCS_GUEST_SMBASE		0x00004828
+#define	VMCS_GUEST_IA32_SYSENTER_CS	0x0000482A
+#define	VMCS_PREEMPTION_TIMER_VALUE	0x0000482E
+
+/* 32-bit host state fields */
+#define	VMCS_HOST_IA32_SYSENTER_CS	0x00004C00
+
+/* Natural Width control fields */
+#define	VMCS_CR0_MASK			0x00006000
+#define	VMCS_CR4_MASK			0x00006002
+#define	VMCS_CR0_SHADOW			0x00006004
+#define	VMCS_CR4_SHADOW			0x00006006
+#define	VMCS_CR3_TARGET0		0x00006008
+#define	VMCS_CR3_TARGET1		0x0000600A
+#define	VMCS_CR3_TARGET2		0x0000600C
+#define	VMCS_CR3_TARGET3		0x0000600E
+
+/* Natural Width read-only fields */
+#define	VMCS_EXIT_QUALIFICATION		0x00006400
+#define	VMCS_IO_RCX			0x00006402
+#define	VMCS_IO_RSI			0x00006404
+#define	VMCS_IO_RDI			0x00006406
+#define	VMCS_IO_RIP			0x00006408
+#define	VMCS_GUEST_LINEAR_ADDRESS	0x0000640A
+
+/* Natural Width guest-state fields */
+#define	VMCS_GUEST_CR0			0x00006800
+#define	VMCS_GUEST_CR3			0x00006802
+#define	VMCS_GUEST_CR4			0x00006804
+#define	VMCS_GUEST_ES_BASE		0x00006806
+#define	VMCS_GUEST_CS_BASE		0x00006808
+#define	VMCS_GUEST_SS_BASE		0x0000680A
+#define	VMCS_GUEST_DS_BASE		0x0000680C
+#define	VMCS_GUEST_FS_BASE		0x0000680E
+#define	VMCS_GUEST_GS_BASE		0x00006810
+#define	VMCS_GUEST_LDTR_BASE		0x00006812
+#define	VMCS_GUEST_TR_BASE		0x00006814
+#define	VMCS_GUEST_GDTR_BASE		0x00006816
+#define	VMCS_GUEST_IDTR_BASE		0x00006818
+#define	VMCS_GUEST_DR7			0x0000681A
+#define	VMCS_GUEST_RSP			0x0000681C
+#define	VMCS_GUEST_RIP			0x0000681E
+#define	VMCS_GUEST_RFLAGS		0x00006820
+#define	VMCS_GUEST_PENDING_DBG_EXCEPTIONS 0x00006822
+#define	VMCS_GUEST_IA32_SYSENTER_ESP	0x00006824
+#define	VMCS_GUEST_IA32_SYSENTER_EIP	0x00006826
+
+/* Natural Width host-state fields */
+#define	VMCS_HOST_CR0			0x00006C00
+#define	VMCS_HOST_CR3			0x00006C02
+#define	VMCS_HOST_CR4			0x00006C04
+#define	VMCS_HOST_FS_BASE		0x00006C06
+#define	VMCS_HOST_GS_BASE		0x00006C08
+#define	VMCS_HOST_TR_BASE		0x00006C0A
+#define	VMCS_HOST_GDTR_BASE		0x00006C0C
+#define	VMCS_HOST_IDTR_BASE		0x00006C0E
+#define	VMCS_HOST_IA32_SYSENTER_ESP	0x00006C10
+#define	VMCS_HOST_IA32_SYSENTER_EIP	0x00006C12
+#define	VMCS_HOST_RSP			0x00006C14
+#define	VMCS_HOST_RIP			0x00006c16
+
+/*
+ * VM instruction error numbers
+ */
+#define	VMRESUME_WITH_NON_LAUNCHED_VMCS	5
+
+/*
+ * VMCS exit reasons
+ */
+#define EXIT_REASON_EXCEPTION		0
+#define EXIT_REASON_EXT_INTR		1
+#define EXIT_REASON_TRIPLE_FAULT	2
+#define EXIT_REASON_INIT		3
+#define EXIT_REASON_SIPI		4
+#define EXIT_REASON_IO_SMI		5
+#define EXIT_REASON_SMI			6
+#define EXIT_REASON_INTR_WINDOW		7
+#define EXIT_REASON_NMI_WINDOW		8
+#define EXIT_REASON_TASK_SWITCH		9
+#define EXIT_REASON_CPUID		10
+#define EXIT_REASON_GETSEC		11
+#define EXIT_REASON_HLT			12
+#define EXIT_REASON_INVD		13
+#define EXIT_REASON_INVLPG		14
+#define EXIT_REASON_RDPMC		15
+#define EXIT_REASON_RDTSC		16
+#define EXIT_REASON_RSM			17
+#define EXIT_REASON_VMCALL		18
+#define EXIT_REASON_VMCLEAR		19
+#define EXIT_REASON_VMLAUNCH		20
+#define EXIT_REASON_VMPTRLD		21
+#define EXIT_REASON_VMPTRST		22
+#define EXIT_REASON_VMREAD		23
+#define EXIT_REASON_VMRESUME		24
+#define EXIT_REASON_VMWRITE		25
+#define EXIT_REASON_VMXOFF		26
+#define EXIT_REASON_VMXON		27
+#define EXIT_REASON_CR_ACCESS		28
+#define EXIT_REASON_DR_ACCESS		29
+#define EXIT_REASON_INOUT		30
+#define EXIT_REASON_RDMSR		31
+#define EXIT_REASON_WRMSR		32
+#define EXIT_REASON_INVAL_VMCS		33
+#define EXIT_REASON_INVAL_MSR		34
+#define EXIT_REASON_MWAIT		36
+#define EXIT_REASON_MTF			37
+#define EXIT_REASON_MONITOR		39
+#define EXIT_REASON_PAUSE		40
+#define EXIT_REASON_MCE_DURING_ENTRY	41
+#define EXIT_REASON_TPR			43
+#define EXIT_REASON_APIC_ACCESS		44
+#define	EXIT_REASON_VIRTUALIZED_EOI	45
+#define EXIT_REASON_GDTR_IDTR		46
+#define EXIT_REASON_LDTR_TR		47
+#define EXIT_REASON_EPT_FAULT		48
+#define EXIT_REASON_EPT_MISCONFIG	49
+#define EXIT_REASON_INVEPT		50
+#define EXIT_REASON_RDTSCP		51
+#define EXIT_REASON_VMX_PREEMPT		52
+#define EXIT_REASON_INVVPID		53
+#define EXIT_REASON_WBINVD		54
+#define EXIT_REASON_XSETBV		55
+#define	EXIT_REASON_APIC_WRITE		56
+
+/*
+ * NMI unblocking due to IRET.
+ *
+ * Applies to VM-exits due to hardware exception or EPT fault.
+ */
+#define	EXIT_QUAL_NMIUDTI	(1 << 12)
+/*
+ * VMCS interrupt information fields
+ */
+#define	VMCS_INTR_VALID		(1U << 31)
+#define	VMCS_INTR_T_MASK	0x700		/* Interruption-info type */
+#define	VMCS_INTR_T_HWINTR	(0 << 8)
+#define	VMCS_INTR_T_NMI		(2 << 8)
+#define	VMCS_INTR_T_HWEXCEPTION	(3 << 8)
+#define	VMCS_INTR_T_SWINTR	(4 << 8)
+#define	VMCS_INTR_T_PRIV_SWEXCEPTION (5 << 8)
+#define	VMCS_INTR_T_SWEXCEPTION	(6 << 8)
+#define	VMCS_INTR_DEL_ERRCODE	(1 << 11)
+
+/*
+ * VMCS IDT-Vectoring information fields
+ */
+#define	VMCS_IDT_VEC_VALID          (1U << 31)
+#define	VMCS_IDT_VEC_TYPE           0x700
+#define	VMCS_IDT_VEC_ERRCODE_VALID	(1U << 11)
+#define	VMCS_IDT_VEC_HWINTR         (0 << 8)
+#define	VMCS_IDT_VEC_NMI            (2 << 8)
+#define	VMCS_IDT_VEC_HWEXCEPTION	(3 << 8)
+#define	VMCS_IDT_VEC_SWINTR         (4 << 8)
+
+/*
+ * VMCS Guest interruptibility field
+ */
+#define	VMCS_INTERRUPTIBILITY_STI_BLOCKING	(1 << 0)
+#define	VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING	(1 << 1)
+#define	VMCS_INTERRUPTIBILITY_SMI_BLOCKING	(1 << 2)
+#define	VMCS_INTERRUPTIBILITY_NMI_BLOCKING	(1 << 3)
+
+/*
+ * Exit qualification for EXIT_REASON_INVAL_VMCS
+ */
+#define	EXIT_QUAL_NMI_WHILE_STI_BLOCKING	3
+
+/*
+ * Exit qualification for EPT violation
+ */
+#define	EPT_VIOLATION_DATA_READ		(1UL << 0)
+#define	EPT_VIOLATION_DATA_WRITE	(1UL << 1)
+#define	EPT_VIOLATION_INST_FETCH	(1UL << 2)
+#define	EPT_VIOLATION_GPA_READABLE	(1UL << 3)
+#define	EPT_VIOLATION_GPA_WRITEABLE	(1UL << 4)
+#define	EPT_VIOLATION_GPA_EXECUTABLE	(1UL << 5)
+#define	EPT_VIOLATION_GLA_VALID		(1UL << 7)
+#define	EPT_VIOLATION_XLAT_VALID	(1UL << 8)
+
+/*
+ * Exit qualification for APIC-access VM exit
+ */
+#define	APIC_ACCESS_OFFSET(qual)	((qual) & 0xFFF)
+#define	APIC_ACCESS_TYPE(qual)		(((qual) >> 12) & 0xF)
+
+/*
+ * Exit qualification for APIC-write VM exit
+ */
+#define	APIC_WRITE_OFFSET(qual)		((qual) & 0xFFF)
+
+
+#define VMCS_PRI_PROC_BASED_CTLS_INT_WINDOW_EXITING    (1 << 2)
+#define VMCS_PRI_PROC_BASED_CTLS_TSC_OFFSET    (1 << 3)
+#define VMCS_PRI_PROC_BASED_CTLS_HLT           (1 << 7)
+#define VMCS_PRI_PROC_BASED_CTLS_MWAIT         (1 << 10)
+#define VMCS_PRI_PROC_BASED_CTLS_TSC           (1 << 12)
+#define VMCS_PRI_PROC_BASED_CTLS_CR8_LOAD      (1 << 19)
+#define VMCS_PRI_PROC_BASED_CTLS_CR8_STORE     (1 << 20)
+#define VMCS_PRI_PROC_BASED_CTLS_TPR_SHADOW    (1 << 21)
+#define VMCS_PRI_PROC_BASED_CTLS_NMI_WINDOW_EXITING    (1 << 22)
+#define VMCS_PRI_PROC_BASED_CTLS_SEC_CONTROL   (1 << 31)
+
+#define VMCS_PRI_PROC_BASED2_CTLS_APIC_ACCESSES (1 << 0)
+#define VMCS_PRI_PROC_BASED2_CTLS_X2APIC        (1 << 4)
+
+enum task_switch_reason {
+	TSR_CALL,
+	TSR_IRET,
+    TSR_JMP,
+	TSR_IDT_GATE,	/* task gate in IDT */
+};
+
+#endif
diff --git a/target/i386/hvf-utils/vmx.h b/target/i386/hvf-utils/vmx.h
new file mode 100644
index 0000000000..8a080e6777
--- /dev/null
+++ b/target/i386/hvf-utils/vmx.h
@@ -0,0 +1,200 @@
+/*
+ * Copyright (C) 2016 Veertu Inc,
+ * Copyright (C) 2017 Google Inc,
+ * Based on Veertu vddh/vmm/vmx.h
+ *
+ * Interfaces to Hypervisor.framework to read/write X86 registers and VMCS.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 or
+ * (at your option) version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef VMX_H
+#define VMX_H
+
+#include <stdint.h>
+#include <Hypervisor/hv.h>
+#include <Hypervisor/hv_vmx.h>
+#include "vmcs.h"
+#include "cpu.h"
+#include "x86.h"
+
+#include "exec/address-spaces.h"
+
+static uint64_t inline rreg(hv_vcpuid_t vcpu, hv_x86_reg_t reg)
+{
+	uint64_t v;
+
+	if (hv_vcpu_read_register(vcpu, reg, &v)) {
+		abort();
+	}
+
+	return v;
+}
+
+/* write GPR */
+static void inline wreg(hv_vcpuid_t vcpu, hv_x86_reg_t reg, uint64_t v)
+{
+	if (hv_vcpu_write_register(vcpu, reg, v)) {
+		abort();
+	}
+}
+
+/* read VMCS field */
+static uint64_t inline rvmcs(hv_vcpuid_t vcpu, uint32_t field)
+{
+	uint64_t v;
+
+	hv_vmx_vcpu_read_vmcs(vcpu, field, &v);
+
+	return v;
+}
+
+/* write VMCS field */
+static void inline wvmcs(hv_vcpuid_t vcpu, uint32_t field, uint64_t v)
+{
+	hv_vmx_vcpu_write_vmcs(vcpu, field, v);
+}
+
+/* desired control word constrained by hardware/hypervisor capabilities */
+static uint64_t inline cap2ctrl(uint64_t cap, uint64_t ctrl)
+{
+	return (ctrl | (cap & 0xffffffff)) & (cap >> 32);
+}
+
+#define VM_ENTRY_GUEST_LMA (1LL << 9)
+
+#define AR_TYPE_ACCESSES_MASK 1
+#define AR_TYPE_READABLE_MASK (1 << 1)
+#define AR_TYPE_WRITEABLE_MASK (1 << 2)
+#define AR_TYPE_CODE_MASK (1 << 3)
+#define AR_TYPE_MASK 0x0f
+#define AR_TYPE_BUSY_64_TSS 11
+#define AR_TYPE_BUSY_32_TSS 11
+#define AR_TYPE_BUSY_16_TSS 3
+#define AR_TYPE_LDT 2
+
+static void enter_long_mode(hv_vcpuid_t vcpu, uint64_t cr0, uint64_t efer)
+{
+    uint64_t entry_ctls;
+
+    efer |= EFER_LMA;
+    wvmcs(vcpu, VMCS_GUEST_IA32_EFER, efer);
+    entry_ctls = rvmcs(vcpu, VMCS_ENTRY_CTLS);
+    wvmcs(vcpu, VMCS_ENTRY_CTLS, rvmcs(vcpu, VMCS_ENTRY_CTLS) | VM_ENTRY_GUEST_LMA);
+
+    uint64_t guest_tr_ar = rvmcs(vcpu, VMCS_GUEST_TR_ACCESS_RIGHTS);
+    if ((efer & EFER_LME) && (guest_tr_ar & AR_TYPE_MASK) != AR_TYPE_BUSY_64_TSS) {
+        wvmcs(vcpu, VMCS_GUEST_TR_ACCESS_RIGHTS, (guest_tr_ar & ~AR_TYPE_MASK) | AR_TYPE_BUSY_64_TSS);
+    }
+}
+
+static void exit_long_mode(hv_vcpuid_t vcpu, uint64_t cr0, uint64_t efer)
+{
+    uint64_t entry_ctls;
+
+    entry_ctls = rvmcs(vcpu, VMCS_ENTRY_CTLS);
+    wvmcs(vcpu, VMCS_ENTRY_CTLS, entry_ctls & ~VM_ENTRY_GUEST_LMA);
+
+    efer &= ~EFER_LMA;
+    wvmcs(vcpu, VMCS_GUEST_IA32_EFER, efer);
+}
+
+static void inline macvm_set_cr0(hv_vcpuid_t vcpu, uint64_t cr0)
+{
+    int i;
+    uint64_t pdpte[4] = {0, 0, 0, 0};
+    uint64_t efer = rvmcs(vcpu, VMCS_GUEST_IA32_EFER);
+    uint64_t old_cr0 = rvmcs(vcpu, VMCS_GUEST_CR0);
+
+    if ((cr0 & CR0_PG) && (rvmcs(vcpu, VMCS_GUEST_CR4) & CR4_PAE) && !(efer & EFER_LME))
+        address_space_rw(&address_space_memory, rvmcs(vcpu, VMCS_GUEST_CR3) & ~0x1f,
+                         MEMTXATTRS_UNSPECIFIED,
+                         (uint8_t *)pdpte, 32, 0);
+
+    for (i = 0; i < 4; i++)
+        wvmcs(vcpu, VMCS_GUEST_PDPTE0 + i * 2, pdpte[i]);
+
+    wvmcs(vcpu, VMCS_CR0_MASK, CR0_CD | CR0_NE | CR0_PG);
+    wvmcs(vcpu, VMCS_CR0_SHADOW, cr0);
+
+    cr0 &= ~CR0_CD;
+    wvmcs(vcpu, VMCS_GUEST_CR0, cr0 | CR0_NE| CR0_ET);
+
+    if (efer & EFER_LME) {
+        if (!(old_cr0 & CR0_PG) && (cr0 & CR0_PG))
+             enter_long_mode(vcpu, cr0, efer);
+        if (/*(old_cr0 & CR0_PG) &&*/ !(cr0 & CR0_PG))
+            exit_long_mode(vcpu, cr0, efer);
+    }
+
+    hv_vcpu_invalidate_tlb(vcpu);
+    hv_vcpu_flush(vcpu);
+}
+
+static void inline macvm_set_cr4(hv_vcpuid_t vcpu, uint64_t cr4)
+{
+    uint64_t guest_cr4 = cr4 | CR4_VMXE;
+
+    wvmcs(vcpu, VMCS_GUEST_CR4, guest_cr4);
+    wvmcs(vcpu, VMCS_CR4_SHADOW, cr4);
+
+    hv_vcpu_invalidate_tlb(vcpu);
+    hv_vcpu_flush(vcpu);
+}
+
+static void inline macvm_set_rip(CPUState *cpu, uint64_t rip)
+{
+    uint64_t val;
+
+    /* BUG, should take considering overlap.. */
+    wreg(cpu->hvf_fd, HV_X86_RIP, rip);
+
+    /* after moving forward in rip, we need to clean INTERRUPTABILITY */
+   val = rvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY);
+   if (val & (VMCS_INTERRUPTIBILITY_STI_BLOCKING | VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING))
+        wvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY,
+              val & ~(VMCS_INTERRUPTIBILITY_STI_BLOCKING | VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING));
+}
+
+static void inline vmx_clear_nmi_blocking(CPUState *cpu)
+{
+    uint32_t gi = (uint32_t) rvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY);
+    gi &= ~VMCS_INTERRUPTIBILITY_NMI_BLOCKING;
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY, gi);
+}
+
+static void inline vmx_set_nmi_blocking(CPUState *cpu)
+{
+    uint32_t gi = (uint32_t)rvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY);
+    gi |= VMCS_INTERRUPTIBILITY_NMI_BLOCKING;
+    wvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY, gi);
+}
+
+static void inline vmx_set_nmi_window_exiting(CPUState *cpu)
+{
+    uint64_t val;
+    val = rvmcs(cpu->hvf_fd, VMCS_PRI_PROC_BASED_CTLS);
+    wvmcs(cpu->hvf_fd, VMCS_PRI_PROC_BASED_CTLS, val | VMCS_PRI_PROC_BASED_CTLS_NMI_WINDOW_EXITING);
+
+}
+
+static void inline vmx_clear_nmi_window_exiting(CPUState *cpu)
+{
+
+    uint64_t val;
+    val = rvmcs(cpu->hvf_fd, VMCS_PRI_PROC_BASED_CTLS);
+    wvmcs(cpu->hvf_fd, VMCS_PRI_PROC_BASED_CTLS, val & ~VMCS_PRI_PROC_BASED_CTLS_NMI_WINDOW_EXITING);
+}
+
+#endif
diff --git a/target/i386/hvf-utils/x86.c b/target/i386/hvf-utils/x86.c
new file mode 100644
index 0000000000..e3db2c9c8b
--- /dev/null
+++ b/target/i386/hvf-utils/x86.c
@@ -0,0 +1,174 @@
+/*
+ * Copyright (C) 2016 Veertu Inc,
+ * Copyright (C) 2017 Google Inc,
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 or
+ * (at your option) version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+
+#include "qemu-common.h"
+#include "x86_decode.h"
+#include "x86_emu.h"
+#include "vmcs.h"
+#include "vmx.h"
+#include "x86_mmu.h"
+#include "x86_descr.h"
+
+static uint32_t x86_segment_access_rights(struct x86_segment_descriptor *var)
+{
+    uint32_t ar;
+
+    if (!var->p) {
+        ar = 1 << 16;
+        return ar;
+    }
+
+    ar = var->type & 15;
+    ar |= (var->s & 1) << 4;
+    ar |= (var->dpl & 3) << 5;
+    ar |= (var->p & 1) << 7;
+    ar |= (var->avl & 1) << 12;
+    ar |= (var->l & 1) << 13;
+    ar |= (var->db & 1) << 14;
+    ar |= (var->g & 1) << 15;
+    return ar;
+}
+
+bool x86_read_segment_descriptor(struct CPUState *cpu, struct x86_segment_descriptor *desc, x68_segment_selector sel)
+{
+    addr_t base;
+    uint32_t limit;
+
+    ZERO_INIT(*desc);
+    // valid gdt descriptors start from index 1
+    if (!sel.index && GDT_SEL == sel.ti)
+        return false;
+
+    if (GDT_SEL == sel.ti) {
+        base  = rvmcs(cpu->hvf_fd, VMCS_GUEST_GDTR_BASE);
+        limit = rvmcs(cpu->hvf_fd, VMCS_GUEST_GDTR_LIMIT);
+    } else {
+        base  = rvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_BASE);
+        limit = rvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_LIMIT);
+    }
+
+    if (sel.index * 8 >= limit)
+        return false;
+
+    vmx_read_mem(cpu, desc, base + sel.index * 8, sizeof(*desc));
+    return true;
+}
+
+bool x86_write_segment_descriptor(struct CPUState *cpu, struct x86_segment_descriptor *desc, x68_segment_selector sel)
+{
+    addr_t base;
+    uint32_t limit;
+    
+    if (GDT_SEL == sel.ti) {
+        base  = rvmcs(cpu->hvf_fd, VMCS_GUEST_GDTR_BASE);
+        limit = rvmcs(cpu->hvf_fd, VMCS_GUEST_GDTR_LIMIT);
+    } else {
+        base  = rvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_BASE);
+        limit = rvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_LIMIT);
+    }
+    
+    if (sel.index * 8 >= limit) {
+        printf("%s: gdt limit\n", __FUNCTION__);
+        return false;
+    }
+    vmx_write_mem(cpu, base + sel.index * 8, desc, sizeof(*desc));
+    return true;
+}
+
+bool x86_read_call_gate(struct CPUState *cpu, struct x86_call_gate *idt_desc, int gate)
+{
+    addr_t base  = rvmcs(cpu->hvf_fd, VMCS_GUEST_IDTR_BASE);
+    uint32_t limit = rvmcs(cpu->hvf_fd, VMCS_GUEST_IDTR_LIMIT);
+
+    ZERO_INIT(*idt_desc);
+    if (gate * 8 >= limit) {
+        printf("%s: idt limit\n", __FUNCTION__);
+        return false;
+    }
+
+    vmx_read_mem(cpu, idt_desc, base + gate * 8, sizeof(*idt_desc));
+    return true;
+}
+
+bool x86_is_protected(struct CPUState *cpu)
+{
+    uint64_t cr0 = rvmcs(cpu->hvf_fd, VMCS_GUEST_CR0);
+    return cr0 & CR0_PE;
+}
+
+bool x86_is_real(struct CPUState *cpu)
+{
+    return !x86_is_protected(cpu);
+}
+
+bool x86_is_v8086(struct CPUState *cpu)
+{
+    return (x86_is_protected(cpu) && (RFLAGS(cpu) & RFLAGS_VM));
+}
+
+bool x86_is_long_mode(struct CPUState *cpu)
+{
+    return rvmcs(cpu->hvf_fd, VMCS_GUEST_IA32_EFER) & EFER_LMA;
+}
+
+bool x86_is_long64_mode(struct CPUState *cpu)
+{
+    struct vmx_segment desc;
+    vmx_read_segment_descriptor(cpu, &desc, REG_SEG_CS);
+
+    return x86_is_long_mode(cpu) && ((desc.ar >> 13) & 1);
+}
+
+bool x86_is_paging_mode(struct CPUState *cpu)
+{
+    uint64_t cr0 = rvmcs(cpu->hvf_fd, VMCS_GUEST_CR0);
+    return cr0 & CR0_PG;
+}
+
+bool x86_is_pae_enabled(struct CPUState *cpu)
+{
+    uint64_t cr4 = rvmcs(cpu->hvf_fd, VMCS_GUEST_CR4);
+    return cr4 & CR4_PAE;
+}
+
+addr_t linear_addr(struct CPUState *cpu, addr_t addr, x86_reg_segment seg)
+{
+    return vmx_read_segment_base(cpu, seg) + addr;
+}
+
+addr_t linear_addr_size(struct CPUState *cpu, addr_t addr, int size, x86_reg_segment seg)
+{
+    switch (size) {
+        case 2:
+            addr = (uint16_t)addr;
+            break;
+        case 4:
+            addr = (uint32_t)addr;
+            break;
+        default:
+            break;
+    }
+    return linear_addr(cpu, addr, seg);
+}
+
+addr_t linear_rip(struct CPUState *cpu, addr_t rip)
+{
+    return linear_addr(cpu, rip, REG_SEG_CS);
+}
diff --git a/target/i386/hvf-utils/x86.h b/target/i386/hvf-utils/x86.h
new file mode 100644
index 0000000000..5dffdd6568
--- /dev/null
+++ b/target/i386/hvf-utils/x86.h
@@ -0,0 +1,470 @@
+/*
+ * Copyright (C) 2016 Veertu Inc,
+ * Copyright (C) 2017 Veertu Inc,
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 or
+ * (at your option) version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#pragma once
+
+#include <sys/types.h>
+#include <sys/ioctl.h>
+#include <sys/mman.h>
+#include <stdarg.h>
+#include "qemu-common.h"
+#include "x86_flags.h"
+
+// exceptions
+typedef enum x86_exception {
+    EXCEPTION_DE,           // divide error
+    EXCEPTION_DB,           // debug fault
+    EXCEPTION_NMI,          // non-maskable interrupt
+    EXCEPTION_BP,           // breakpoint	trap
+    EXCEPTION_OF,           // overflow	trap
+    EXCEPTION_BR,           // boundary range exceeded	fault
+    EXCEPTION_UD,           // undefined opcode
+    EXCEPTION_NM,           // device not available
+    EXCEPTION_DF,           // double fault
+    EXCEPTION_RSVD,         // not defined
+    EXCEPTION_TS,           // invalid TSS	fault
+    EXCEPTION_NP,           // not present	fault
+    EXCEPTION_GP,           // general protection	fault
+    EXCEPTION_PF,           // page fault
+    EXCEPTION_RSVD2,        // not defined
+} x86_exception;
+
+// general purpose regs
+typedef enum x86_reg_name {
+    REG_RAX = 0,
+    REG_RCX = 1,
+    REG_RDX = 2,
+    REG_RBX = 3,
+    REG_RSP = 4,
+    REG_RBP = 5,
+    REG_RSI = 6,
+    REG_RDI = 7,
+    REG_R8 = 8,
+    REG_R9 = 9,
+    REG_R10 = 10,
+    REG_R11 = 11,
+    REG_R12 = 12,
+    REG_R13 = 13,
+    REG_R14 = 14,
+    REG_R15 = 15,
+} x86_reg_name;
+
+// segment regs
+typedef enum x86_reg_segment {
+    REG_SEG_ES = 0,
+    REG_SEG_CS = 1,
+    REG_SEG_SS = 2,
+    REG_SEG_DS = 3,
+    REG_SEG_FS = 4,
+    REG_SEG_GS = 5,
+    REG_SEG_LDTR = 6,
+    REG_SEG_TR = 7,
+} x86_reg_segment;
+
+typedef struct x86_register
+{
+    union {
+        struct {
+            uint64_t rrx;               // full 64 bit
+        };
+        struct {
+            uint32_t erx;               // low 32 bit part
+            uint32_t hi32_unused1;
+        };
+        struct {
+            uint16_t rx;                // low 16 bit part
+            uint16_t hi16_unused1;
+            uint32_t hi32_unused2;
+        };
+        struct {
+            uint8_t lx;                 // low 8 bit part
+            uint8_t hx;                 // high 8 bit
+            uint16_t hi16_unused2;
+            uint32_t hi32_unused3;
+        };
+    };
+} __attribute__ ((__packed__)) x86_register;
+
+typedef enum x86_rflags {
+    RFLAGS_CF       = (1L << 0),
+    RFLAGS_PF       = (1L << 2),
+    RFLAGS_AF       = (1L << 4),
+    RFLAGS_ZF       = (1L << 6),
+    RFLAGS_SF       = (1L << 7),
+    RFLAGS_TF       = (1L << 8),
+    RFLAGS_IF       = (1L << 9),
+    RFLAGS_DF       = (1L << 10),
+    RFLAGS_OF       = (1L << 11),
+    RFLAGS_IOPL     = (3L << 12),
+    RFLAGS_NT       = (1L << 14),
+    RFLAGS_RF       = (1L << 16),
+    RFLAGS_VM       = (1L << 17),
+    RFLAGS_AC       = (1L << 18),
+    RFLAGS_VIF      = (1L << 19),
+    RFLAGS_VIP      = (1L << 20),
+    RFLAGS_ID       = (1L << 21),
+} x86_rflags;
+
+// rflags register
+typedef struct x86_reg_flags {
+    union {
+        struct {
+            uint64_t rflags;
+        };
+        struct {
+            uint32_t eflags;
+            uint32_t hi32_unused1;
+        };
+        struct {
+            uint32_t cf:1;
+            uint32_t unused1:1;
+            uint32_t pf:1;
+            uint32_t unused2:1;
+            uint32_t af:1;
+            uint32_t unused3:1;
+            uint32_t zf:1;
+            uint32_t sf:1;
+            uint32_t tf:1;
+            uint32_t ief:1;
+            uint32_t df:1;
+            uint32_t of:1;
+            uint32_t iopl:2;
+            uint32_t nt:1;
+            uint32_t unused4:1;
+            uint32_t rf:1;
+            uint32_t vm:1;
+            uint32_t ac:1;
+            uint32_t vif:1;
+            uint32_t vip:1;
+            uint32_t id:1;
+            uint32_t unused5:10;
+            uint32_t hi32_unused2;
+        };
+    };
+} __attribute__ ((__packed__)) x86_reg_flags;
+
+typedef enum x86_reg_efer {
+    EFER_SCE =          (1L << 0),
+    EFER_LME =          (1L << 8),
+    EFER_LMA =          (1L << 10),
+    EFER_NXE =          (1L << 11),
+    EFER_SVME =         (1L << 12),
+    EFER_FXSR =         (1L << 14),
+} x86_reg_efer;
+
+typedef struct x86_efer {
+    uint64_t efer;
+} __attribute__ ((__packed__)) x86_efer;
+
+typedef enum x86_reg_cr0 {
+    CR0_PE =            (1L << 0),
+    CR0_MP =            (1L << 1),
+    CR0_EM =            (1L << 2),
+    CR0_TS =            (1L << 3),
+    CR0_ET =            (1L << 4),
+    CR0_NE =            (1L << 5),
+    CR0_WP =            (1L << 16),
+    CR0_AM =            (1L << 18),
+    CR0_NW =            (1L << 29),
+    CR0_CD =            (1L << 30),
+    CR0_PG =            (1L << 31),
+} x86_reg_cr0;
+
+typedef enum x86_reg_cr4 {
+    CR4_VME =            (1L << 0),
+    CR4_PVI =            (1L << 1),
+    CR4_TSD =            (1L << 2),
+    CR4_DE  =            (1L << 3),
+    CR4_PSE =            (1L << 4),
+    CR4_PAE =            (1L << 5),
+    CR4_MSE =            (1L << 6),
+    CR4_PGE =            (1L << 7),
+    CR4_PCE =            (1L << 8),
+    CR4_OSFXSR =         (1L << 9),
+    CR4_OSXMMEXCPT =     (1L << 10),
+    CR4_VMXE =           (1L << 13),
+    CR4_SMXE =           (1L << 14),
+    CR4_FSGSBASE =       (1L << 16),
+    CR4_PCIDE =          (1L << 17),
+    CR4_OSXSAVE =        (1L << 18),
+    CR4_SMEP =           (1L << 20),
+} x86_reg_cr4;
+
+// 16 bit Task State Segment
+typedef struct x86_tss_segment16 {
+    uint16_t link;
+    uint16_t sp0;
+    uint16_t ss0;
+    uint32_t sp1;
+    uint16_t ss1;
+    uint32_t sp2;
+    uint16_t ss2;
+    uint16_t ip;
+    uint16_t flags;
+    uint16_t ax;
+    uint16_t cx;
+    uint16_t dx;
+    uint16_t bx;
+    uint16_t sp;
+    uint16_t bp;
+    uint16_t si;
+    uint16_t di;
+    uint16_t es;
+    uint16_t cs;
+    uint16_t ss;
+    uint16_t ds;
+    uint16_t ldtr;
+} __attribute__((packed)) x86_tss_segment16;
+
+// 32 bit Task State Segment
+typedef struct x86_tss_segment32
+{
+    uint32_t prev_tss;
+    uint32_t esp0;
+    uint32_t ss0;
+    uint32_t esp1;
+    uint32_t ss1;
+    uint32_t esp2;
+    uint32_t ss2;
+    uint32_t cr3;
+    uint32_t eip;
+    uint32_t eflags;
+    uint32_t eax;
+    uint32_t ecx;
+    uint32_t edx;
+    uint32_t ebx;
+    uint32_t esp;
+    uint32_t ebp;
+    uint32_t esi;
+    uint32_t edi;
+    uint32_t es;
+    uint32_t cs;
+    uint32_t ss;
+    uint32_t ds;
+    uint32_t fs;
+    uint32_t gs;
+    uint32_t ldt;
+    uint16_t trap;
+    uint16_t iomap_base;
+} __attribute__ ((__packed__)) x86_tss_segment32;
+
+// 64 bit Task State Segment
+typedef struct x86_tss_segment64
+{
+    uint32_t unused;
+    uint64_t rsp0;
+    uint64_t rsp1;
+    uint64_t rsp2;
+    uint64_t unused1;
+    uint64_t ist1;
+    uint64_t ist2;
+    uint64_t ist3;
+    uint64_t ist4;
+    uint64_t ist5;
+    uint64_t ist6;
+    uint64_t ist7;
+    uint64_t unused2;
+    uint16_t unused3;
+    uint16_t iomap_base;
+} __attribute__ ((__packed__)) x86_tss_segment64;
+
+// segment descriptors
+typedef struct x86_segment_descriptor {
+    uint64_t    limit0:16;
+    uint64_t    base0:16;
+    uint64_t    base1:8;
+    uint64_t    type:4;
+    uint64_t    s:1;
+    uint64_t    dpl:2;
+    uint64_t    p:1;
+    uint64_t    limit1:4;
+    uint64_t    avl:1;
+    uint64_t    l:1;
+    uint64_t    db:1;
+    uint64_t    g:1;
+    uint64_t    base2:8;
+} __attribute__ ((__packed__)) x86_segment_descriptor;
+
+static inline uint32_t x86_segment_base(x86_segment_descriptor *desc)
+{
+    return (uint32_t)((desc->base2 << 24) | (desc->base1 << 16) | desc->base0);
+}
+
+static inline void x86_set_segment_base(x86_segment_descriptor *desc, uint32_t base)
+{
+    desc->base2 = base >> 24;
+    desc->base1 = (base >> 16) & 0xff;
+    desc->base0 = base & 0xffff;
+}
+
+static inline uint32_t x86_segment_limit(x86_segment_descriptor *desc)
+{
+    uint32_t limit = (uint32_t)((desc->limit1 << 16) | desc->limit0);
+    if (desc->g)
+        return (limit << 12) | 0xfff;
+    return limit;
+}
+
+static inline void x86_set_segment_limit(x86_segment_descriptor *desc, uint32_t limit)
+{
+    desc->limit0 = limit & 0xffff;
+    desc->limit1 = limit >> 16;
+}
+
+typedef struct x86_call_gate {
+    uint64_t offset0:16;
+    uint64_t selector:16;
+    uint64_t param_count:4;
+    uint64_t reserved:3;
+    uint64_t type:4;
+    uint64_t dpl:1;
+    uint64_t p:1;
+    uint64_t offset1:16;
+} __attribute__ ((__packed__)) x86_call_gate;
+
+static inline uint32_t x86_call_gate_offset(x86_call_gate *gate)
+{
+    return (uint32_t)((gate->offset1 << 16) | gate->offset0);
+}
+
+#define LDT_SEL     0
+#define GDT_SEL     1
+
+typedef struct x68_segment_selector {
+    union {
+        uint16_t sel;
+        struct {
+            uint16_t rpl:3;
+            uint16_t ti:1;
+            uint16_t index:12;
+        };
+    };
+} __attribute__ ((__packed__)) x68_segment_selector;
+
+// Definition of hvf_x86_state is here
+struct hvf_x86_state {
+    int hlt;
+    uint64_t init_tsc;
+    
+    int interruptable;
+    uint64_t exp_rip;
+    uint64_t fetch_rip;
+    uint64_t rip;
+    struct x86_register regs[16];
+    struct x86_reg_flags   rflags;
+    struct lazy_flags   lflags;
+    struct x86_efer efer;
+    uint8_t mmio_buf[4096];
+    uint8_t* apic_page;
+};
+
+/*
+* hvf xsave area
+*/
+struct hvf_xsave_buf {
+    uint32_t data[1024];
+};
+
+// useful register access  macros
+#define RIP(cpu)    (cpu->hvf_x86->rip)
+#define EIP(cpu)    ((uint32_t)cpu->hvf_x86->rip)
+#define RFLAGS(cpu) (cpu->hvf_x86->rflags.rflags)
+#define EFLAGS(cpu) (cpu->hvf_x86->rflags.eflags)
+
+#define RRX(cpu, reg) (cpu->hvf_x86->regs[reg].rrx)
+#define RAX(cpu)        RRX(cpu, REG_RAX)
+#define RCX(cpu)        RRX(cpu, REG_RCX)
+#define RDX(cpu)        RRX(cpu, REG_RDX)
+#define RBX(cpu)        RRX(cpu, REG_RBX)
+#define RSP(cpu)        RRX(cpu, REG_RSP)
+#define RBP(cpu)        RRX(cpu, REG_RBP)
+#define RSI(cpu)        RRX(cpu, REG_RSI)
+#define RDI(cpu)        RRX(cpu, REG_RDI)
+#define R8(cpu)         RRX(cpu, REG_R8)
+#define R9(cpu)         RRX(cpu, REG_R9)
+#define R10(cpu)        RRX(cpu, REG_R10)
+#define R11(cpu)        RRX(cpu, REG_R11)
+#define R12(cpu)        RRX(cpu, REG_R12)
+#define R13(cpu)        RRX(cpu, REG_R13)
+#define R14(cpu)        RRX(cpu, REG_R14)
+#define R15(cpu)        RRX(cpu, REG_R15)
+
+#define ERX(cpu, reg)   (cpu->hvf_x86->regs[reg].erx)
+#define EAX(cpu)        ERX(cpu, REG_RAX)
+#define ECX(cpu)        ERX(cpu, REG_RCX)
+#define EDX(cpu)        ERX(cpu, REG_RDX)
+#define EBX(cpu)        ERX(cpu, REG_RBX)
+#define ESP(cpu)        ERX(cpu, REG_RSP)
+#define EBP(cpu)        ERX(cpu, REG_RBP)
+#define ESI(cpu)        ERX(cpu, REG_RSI)
+#define EDI(cpu)        ERX(cpu, REG_RDI)
+
+#define RX(cpu, reg)   (cpu->hvf_x86->regs[reg].rx)
+#define AX(cpu)        RX(cpu, REG_RAX)
+#define CX(cpu)        RX(cpu, REG_RCX)
+#define DX(cpu)        RX(cpu, REG_RDX)
+#define BP(cpu)        RX(cpu, REG_RBP)
+#define SP(cpu)        RX(cpu, REG_RSP)
+#define BX(cpu)        RX(cpu, REG_RBX)
+#define SI(cpu)        RX(cpu, REG_RSI)
+#define DI(cpu)        RX(cpu, REG_RDI)
+
+#define RL(cpu, reg)   (cpu->hvf_x86->regs[reg].lx)
+#define AL(cpu)        RL(cpu, REG_RAX)
+#define CL(cpu)        RL(cpu, REG_RCX)
+#define DL(cpu)        RL(cpu, REG_RDX)
+#define BL(cpu)        RL(cpu, REG_RBX)
+
+#define RH(cpu, reg)   (cpu->hvf_x86->regs[reg].hx)
+#define AH(cpu)        RH(cpu, REG_RAX)
+#define CH(cpu)        RH(cpu, REG_RCX)
+#define DH(cpu)        RH(cpu, REG_RDX)
+#define BH(cpu)        RH(cpu, REG_RBX)
+
+// deal with GDT/LDT descriptors in memory
+bool x86_read_segment_descriptor(struct CPUState *cpu, struct x86_segment_descriptor *desc, x68_segment_selector sel);
+bool x86_write_segment_descriptor(struct CPUState *cpu, struct x86_segment_descriptor *desc, x68_segment_selector sel);
+
+bool x86_read_call_gate(struct CPUState *cpu, struct x86_call_gate *idt_desc, int gate);
+
+// helpers
+bool x86_is_protected(struct CPUState *cpu);
+bool x86_is_real(struct CPUState *cpu);
+bool x86_is_v8086(struct CPUState *cpu);
+bool x86_is_long_mode(struct CPUState *cpu);
+bool x86_is_long64_mode(struct CPUState *cpu);
+bool x86_is_paging_mode(struct CPUState *cpu);
+bool x86_is_pae_enabled(struct CPUState *cpu);
+
+addr_t linear_addr(struct CPUState *cpu, addr_t addr, x86_reg_segment seg);
+addr_t linear_addr_size(struct CPUState *cpu, addr_t addr, int size, x86_reg_segment seg);
+addr_t linear_rip(struct CPUState *cpu, addr_t rip);
+
+static inline uint64_t rdtscp(void)
+{
+    uint64_t tsc;
+    __asm__ __volatile__("rdtscp; "         // serializing read of tsc
+                         "shl $32,%%rdx; "  // shift higher 32 bits stored in rdx up
+                         "or %%rdx,%%rax"   // and or onto rax
+                         : "=a"(tsc)        // output to tsc variable
+                         :
+                         : "%rcx", "%rdx"); // rcx and rdx are clobbered
+    
+    return tsc;
+}
+
diff --git a/target/i386/hvf-utils/x86_cpuid.c b/target/i386/hvf-utils/x86_cpuid.c
new file mode 100644
index 0000000000..e496cf001c
--- /dev/null
+++ b/target/i386/hvf-utils/x86_cpuid.c
@@ -0,0 +1,270 @@
+/*
+ *  i386 CPUID helper functions
+ *
+ *  Copyright (c) 2003 Fabrice Bellard
+ *  Copyright (c) 2017 Google Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ *
+ * cpuid
+ */
+
+#include "qemu/osdep.h"
+#include "x86_cpuid.h"
+#include "x86.h"
+#include "vmx.h"
+
+#define PPRO_FEATURES (CPUID_FP87 | CPUID_DE | CPUID_PSE | CPUID_TSC | \
+    CPUID_MSR | CPUID_MCE | CPUID_CX8 | CPUID_PGE | CPUID_CMOV | \
+    CPUID_PAT | CPUID_FXSR | CPUID_MMX | CPUID_SSE | CPUID_SSE2 | \
+    CPUID_PAE | CPUID_SEP | CPUID_APIC)
+
+struct x86_cpuid builtin_cpus[] = {
+    {
+        .name = "vmx32",
+        .vendor1  = CPUID_VENDOR_INTEL_1,
+        .vendor2  = CPUID_VENDOR_INTEL_2,
+        .vendor3  = CPUID_VENDOR_INTEL_3,
+        .level = 4,
+        .family = 6,
+        .model = 3,
+        .stepping = 3,
+        .features = PPRO_FEATURES,
+        .ext_features = /*CPUID_EXT_SSE3 |*/ CPUID_EXT_POPCNT, CPUID_MTRR | CPUID_CLFLUSH,
+                    CPUID_PSE36,
+        .ext2_features = CPUID_EXT2_LM | CPUID_EXT2_SYSCALL | CPUID_EXT2_NX,
+        .ext3_features = 0,//CPUID_EXT3_LAHF_LM,
+        .xlevel = 0x80000004,
+        .model_id = "vmx32",
+    },
+    {
+        .name = "core2duo",
+        .vendor1  = CPUID_VENDOR_INTEL_1,
+        .vendor2  = CPUID_VENDOR_INTEL_2,
+        .vendor3  = CPUID_VENDOR_INTEL_3,
+        .level = 10,
+        .family = 6,
+        .model = 15,
+        .stepping = 11,
+        .features = PPRO_FEATURES |
+        CPUID_MTRR | CPUID_CLFLUSH | CPUID_MCA |
+        CPUID_PSE36 | CPUID_VME | CPUID_DTS | CPUID_ACPI | CPUID_SS |
+        CPUID_HT | CPUID_TM | CPUID_PBE,
+        .ext_features = CPUID_EXT_SSE3 | CPUID_EXT_SSSE3 | 
+        CPUID_EXT_DTES64 | CPUID_EXT_DSCPL |
+        CPUID_EXT_CX16 | CPUID_EXT_XTPR | CPUID_EXT_PDCM | CPUID_EXT_HYPERVISOR,
+        .ext2_features = CPUID_EXT2_LM | CPUID_EXT2_SYSCALL | CPUID_EXT2_NX,
+        .ext3_features = CPUID_EXT3_LAHF_LM,
+        .xlevel = 0x80000008,
+        .model_id = "Intel(R) Core(TM)2 Duo GETCPU     T7700  @ 2.40GHz",
+    },
+    {
+        .name = "vmX",
+        .vendor1  = CPUID_VENDOR_INTEL_1,
+        .vendor2  = CPUID_VENDOR_INTEL_2,
+        .vendor3  = CPUID_VENDOR_INTEL_3,
+        .level = 0xd,
+        .family = 6,
+        .model = 15,
+        .stepping = 11,
+        .features = PPRO_FEATURES |
+        CPUID_MTRR | CPUID_CLFLUSH | CPUID_MCA |
+        CPUID_PSE36 | CPUID_VME | CPUID_DTS | CPUID_ACPI | CPUID_SS |
+        CPUID_HT | CPUID_TM | CPUID_PBE,
+        .ext_features = CPUID_EXT_SSE3 | CPUID_EXT_SSSE3 |
+        CPUID_EXT_DTES64 | CPUID_EXT_DSCPL |
+        CPUID_EXT_CX16 | CPUID_EXT_XTPR | CPUID_EXT_PDCM | CPUID_EXT_HYPERVISOR,
+        .ext2_features = CPUID_EXT2_LM | CPUID_EXT2_SYSCALL | CPUID_EXT2_NX,
+        .ext3_features = CPUID_EXT3_LAHF_LM,
+        .xlevel = 0x80000008,
+        .model_id = "Common vmX processor",
+    },
+};
+
+static struct x86_cpuid *_cpuid = NULL;
+
+void init_cpuid(struct CPUState* cpu)
+{
+    _cpuid = &builtin_cpus[2]; // core2duo
+}
+
+void get_cpuid_func(struct CPUState* cpu, int func, int cnt, uint32_t *eax, uint32_t *ebx, uint32_t *ecx, uint32_t *edx)
+{
+   uint32_t h_rax, h_rbx, h_rcx, h_rdx;
+   host_cpuid(func, cnt, &h_rax, &h_rbx, &h_rcx, &h_rdx);
+   uint32_t apic_id = X86_CPU(cpu)->apic_id;
+
+
+    *eax = *ebx = *ecx = *edx = 0;
+    switch(func) {
+        case 0:
+            *eax = _cpuid->level;
+            *ebx = _cpuid->vendor1;
+            *edx = _cpuid->vendor2;
+            *ecx = _cpuid->vendor3;
+            break;
+        case 1:
+            *eax = h_rax;//_cpuid->stepping | (_cpuid->model << 3) | (_cpuid->family << 6);
+            *ebx = (apic_id << 24) | (h_rbx & 0x00ffffff);
+            *ecx = h_rcx;
+            *edx = h_rdx;
+
+            if (cpu->nr_cores * cpu->nr_threads > 1) {
+                *ebx |= (cpu->nr_cores * cpu->nr_threads) << 16;
+                *edx |= 1 << 28;    /* Enable Hyper-Threading */
+            }
+
+            *ecx = *ecx & ~(CPUID_EXT_OSXSAVE | CPUID_EXT_MONITOR | CPUID_EXT_X2APIC |
+                        CPUID_EXT_VMX | CPUID_EXT_TSC_DEADLINE_TIMER | CPUID_EXT_TM2 | CPUID_EXT_PCID |
+                        CPUID_EXT_EST | CPUID_EXT_SSE42 | CPUID_EXT_SSE41);
+            *ecx |= CPUID_EXT_HYPERVISOR;
+            break;
+        case 2:
+            /* cache info: needed for Pentium Pro compatibility */
+            *eax = h_rax;
+            *ebx = h_rbx;
+            *ecx = h_rcx;
+            *edx = h_rdx;
+            break;
+        case 4:
+            /* cache info: needed for Core compatibility */
+            *eax = h_rax;
+            *ebx = h_rbx;
+            *ecx = h_rcx;
+            *edx = h_rdx;
+            break;
+        case 5:
+            /* mwait info: needed for Core compatibility */
+            *eax = h_rax;
+            *ebx = h_rbx;
+            *ecx = h_rcx;
+            *edx = h_rdx;
+            break;
+        case 6:
+            /* Thermal and Power Leaf */
+            *eax = 0;
+            *ebx = 0;
+            *ecx = 0;
+            *edx = 0;
+            break;
+        case 7:
+            *eax = h_rax;
+            *ebx = h_rbx & ~(CPUID_7_0_EBX_AVX512F | CPUID_7_0_EBX_AVX512PF | CPUID_7_0_EBX_AVX512ER | CPUID_7_0_EBX_AVX512CD |
+                             CPUID_7_0_EBX_AVX512BW | CPUID_7_0_EBX_AVX512VL | CPUID_7_0_EBX_MPX | CPUID_7_0_EBX_INVPCID);
+            *ecx = h_rcx & ~(CPUID_7_0_ECX_AVX512BMI);
+            *edx = h_rdx;
+            break;
+        case 9:
+            /* Direct Cache Access Information Leaf */
+            *eax = h_rax;
+            *ebx = h_rbx;
+            *ecx = h_rcx;
+            *edx = h_rdx;
+            break;
+        case 0xA:
+            /* Architectural Performance Monitoring Leaf */
+            *eax = 0;
+            *ebx = 0;
+            *ecx = 0;
+            *edx = 0;
+            break;
+        case 0xB:
+            /* CPU Topology Leaf */
+            *eax = 0;
+            *ebx = 0;   /* Means that we don't support this leaf */
+            *ecx = 0;
+            *edx = 0;
+            break;
+        case 0xD:
+            *eax = h_rax;
+            if (!cnt)
+                *eax &= (XSTATE_FP_MASK | XSTATE_SSE_MASK | XSTATE_YMM_MASK);
+            if (1 == cnt)
+                *eax &= (CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC);
+            *ebx = h_rbx;
+            *ecx = h_rcx;
+            *edx = h_rdx;
+            break;
+        case 0x80000000:
+            *eax = _cpuid->xlevel;
+            *ebx = _cpuid->vendor1;
+            *edx = _cpuid->vendor2;
+            *ecx = _cpuid->vendor3;
+            break;
+        case 0x80000001:
+            *eax = h_rax;//_cpuid->stepping | (_cpuid->model << 3) | (_cpuid->family << 6);
+            *ebx = 0;
+            *ecx = _cpuid->ext3_features & h_rcx;
+            *edx = _cpuid->ext2_features & h_rdx;
+            break;
+        case 0x80000002:
+        case 0x80000003:
+        case 0x80000004:
+            *eax = h_rax;
+            *ebx = h_rbx;
+            *ecx = h_rcx;
+            *edx = h_rdx;
+            break;
+        case 0x80000005:
+            /* cache info (L1 cache) */
+            *eax = h_rax;
+            *ebx = h_rbx;
+            *ecx = h_rcx;
+            *edx = h_rdx;
+            break;
+        case 0x80000006:
+            /* cache info (L2 cache) */
+            *eax = h_rax;
+            *ebx = h_rbx;
+            *ecx = h_rcx;
+            *edx = h_rdx;
+            break;
+        case 0x80000007:
+            *eax = 0;
+            *ebx = 0;
+            *ecx = 0;
+            *edx = 0;   /* Note - We disable invariant TSC (bit 8) in purpose */
+            break;
+        case 0x80000008:
+            /* virtual & phys address size in low 2 bytes. */
+            *eax = h_rax;
+            *ebx = 0;
+            *ecx = 0;
+            *edx = 0;
+            break;
+        case 0x8000000A:
+            *eax = 0;
+            *ebx = 0;
+            *ecx = 0;
+            *edx = 0;
+            break;
+        case 0x80000019:
+            *eax = h_rax;
+            *ebx = h_rbx;
+            *ecx = 0;
+            *edx = 0;
+        case 0xC0000000:
+            *eax = _cpuid->xlevel2;
+            *ebx = 0;
+            *ecx = 0;
+            *edx = 0;
+            break;
+        default:
+            *eax = 0;
+            *ebx = 0;
+            *ecx = 0;
+            *edx = 0;
+            break;
+    }
+}
diff --git a/target/i386/hvf-utils/x86_cpuid.h b/target/i386/hvf-utils/x86_cpuid.h
new file mode 100644
index 0000000000..02f2f115b0
--- /dev/null
+++ b/target/i386/hvf-utils/x86_cpuid.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2016 Veertu Inc,
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 or
+ * (at your option) version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef __CPUID_H__
+#define __CPUID_H__
+
+#include <sys/types.h>
+#include <sys/ioctl.h>
+#include <sys/mman.h>
+#include <stdarg.h>
+#include "qemu-common.h"
+#include "x86_flags.h"
+
+struct x86_cpuid {
+    const char *name;
+    uint32_t level;
+    uint32_t vendor1, vendor2, vendor3;
+    int family;
+    int model;
+    int stepping;
+    int tsc_khz;
+    uint32_t features, ext_features, ext2_features, ext3_features;
+    uint32_t kvm_features, svm_features;
+    uint32_t xlevel;
+    char model_id[48];
+    int vendor_override;
+    uint32_t flags;
+    uint32_t xlevel2;
+    uint32_t cpuid_7_0_ebx_features;
+};
+
+struct CPUState;
+
+void init_cpuid(struct CPUState* cpu);
+void get_cpuid_func(struct CPUState *cpu, int func, int cnt, uint32_t *eax, uint32_t *ebx, uint32_t *ecx, uint32_t *edx);
+
+#endif /* __CPUID_H__ */
+
diff --git a/target/i386/hvf-utils/x86_decode.c b/target/i386/hvf-utils/x86_decode.c
new file mode 100644
index 0000000000..b4d8e22449
--- /dev/null
+++ b/target/i386/hvf-utils/x86_decode.c
@@ -0,0 +1,1659 @@
+/*
+ * Copyright (C) 2016 Veertu Inc,
+ * Copyright (C) 2017 Google Inc,
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 or
+ * (at your option) version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+
+#include "x86_decode.h"
+#include "string.h"
+#include "vmx.h"
+#include "x86_gen.h"
+#include "x86_mmu.h"
+#include "x86_descr.h"
+
+#define OPCODE_ESCAPE   0xf
+
+static void decode_invalid(CPUState *cpu, struct x86_decode *decode)
+{
+    printf("%llx: failed to decode instruction ", cpu->hvf_x86->fetch_rip - decode->len);
+    for (int i = 0; i < decode->opcode_len; i++)
+        printf("%x ", decode->opcode[i]);
+    printf("\n");
+    VM_PANIC("decoder failed\n");
+}
+
+uint64_t sign(uint64_t val, int size)
+{
+    switch (size) {
+        case 1:
+            val = (int8_t)val;
+            break;
+        case 2:
+            val = (int16_t)val;
+            break;
+        case 4:
+            val = (int32_t)val;
+            break;
+        case 8:
+            val = (int64_t)val;
+            break;
+        default:
+            VM_PANIC_EX("%s invalid size %d\n", __FUNCTION__, size);
+            break;
+    }
+    return val;
+}
+
+static inline uint64_t decode_bytes(CPUState *cpu, struct x86_decode *decode, int size)
+{
+    addr_t val = 0;
+    
+    switch (size) {
+        case 1:
+        case 2:
+        case 4:
+        case 8:
+            break;
+        default:
+            VM_PANIC_EX("%s invalid size %d\n", __FUNCTION__, size);
+            break;
+    }
+    addr_t va  = linear_rip(cpu, RIP(cpu)) + decode->len;
+    vmx_read_mem(cpu, &val, va, size);
+    decode->len += size;
+    
+    return val;
+}
+
+static inline uint8_t decode_byte(CPUState *cpu, struct x86_decode *decode)
+{
+    return (uint8_t)decode_bytes(cpu, decode, 1);
+}
+
+static inline uint16_t decode_word(CPUState *cpu, struct x86_decode *decode)
+{
+    return (uint16_t)decode_bytes(cpu, decode, 2);
+}
+
+static inline uint32_t decode_dword(CPUState *cpu, struct x86_decode *decode)
+{
+    return (uint32_t)decode_bytes(cpu, decode, 4);
+}
+
+static inline uint64_t decode_qword(CPUState *cpu, struct x86_decode *decode)
+{
+    return decode_bytes(cpu, decode, 8);
+}
+
+static void decode_modrm_rm(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *op)
+{
+    op->type = X86_VAR_RM;
+}
+
+static void decode_modrm_reg(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *op)
+{
+    op->type = X86_VAR_REG;
+    op->reg = decode->modrm.reg;
+    op->ptr = get_reg_ref(cpu, op->reg, decode->rex.r, decode->operand_size);
+}
+
+static void decode_rax(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *op)
+{
+    op->type = X86_VAR_REG;
+    op->reg = REG_RAX;
+    op->ptr = get_reg_ref(cpu, op->reg, 0, decode->operand_size);
+}
+
+static inline void decode_immediate(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *var, int size)
+{
+    var->type = X86_VAR_IMMEDIATE;
+    var->size = size;
+    switch (size) {
+        case 1:
+            var->val = decode_byte(cpu, decode);
+            break;
+        case 2:
+            var->val = decode_word(cpu, decode);
+            break;
+        case 4:
+            var->val = decode_dword(cpu, decode);
+            break;
+        case 8:
+            var->val = decode_qword(cpu, decode);
+            break;
+        default:
+            VM_PANIC_EX("bad size %d\n", size);
+    }
+}
+
+static void decode_imm8(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *op)
+{
+    decode_immediate(cpu, decode, op, 1);
+    op->type = X86_VAR_IMMEDIATE;
+}
+
+static void decode_imm8_signed(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *op)
+{
+    decode_immediate(cpu, decode, op, 1);
+    op->val = sign(op->val, 1);
+    op->type = X86_VAR_IMMEDIATE;
+}
+
+static void decode_imm16(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *op)
+{
+    decode_immediate(cpu, decode, op, 2);
+    op->type = X86_VAR_IMMEDIATE;
+}
+
+
+static void decode_imm(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *op)
+{
+    if (8 == decode->operand_size) {
+        decode_immediate(cpu, decode, op, 4);
+        op->val = sign(op->val, decode->operand_size);
+    } else {
+        decode_immediate(cpu, decode, op, decode->operand_size);
+    }
+    op->type = X86_VAR_IMMEDIATE;
+}
+
+static void decode_imm_signed(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *op)
+{
+    decode_immediate(cpu, decode, op, decode->operand_size);
+    op->val = sign(op->val, decode->operand_size);
+    op->type = X86_VAR_IMMEDIATE;
+}
+
+static void decode_imm_1(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *op)
+{
+    op->type = X86_VAR_IMMEDIATE;
+    op->val = 1;
+}
+
+static void decode_imm_0(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *op)
+{
+    op->type = X86_VAR_IMMEDIATE;
+    op->val = 0;
+}
+
+
+static void decode_pushseg(CPUState *cpu, struct x86_decode *decode)
+{
+    uint8_t op = (decode->opcode_len > 1) ? decode->opcode[1] : decode->opcode[0];
+    
+    decode->op[0].type = X86_VAR_REG;
+    switch (op) {
+        case 0xe:
+            decode->op[0].reg = REG_SEG_CS;
+            break;
+        case 0x16:
+            decode->op[0].reg = REG_SEG_SS;
+            break;
+        case 0x1e:
+            decode->op[0].reg = REG_SEG_DS;
+            break;
+        case 0x06:
+            decode->op[0].reg = REG_SEG_ES;
+            break;
+        case 0xa0:
+            decode->op[0].reg = REG_SEG_FS;
+            break;
+        case 0xa8:
+            decode->op[0].reg = REG_SEG_GS;
+            break;
+    }
+}
+
+static void decode_popseg(CPUState *cpu, struct x86_decode *decode)
+{
+    uint8_t op = (decode->opcode_len > 1) ? decode->opcode[1] : decode->opcode[0];
+    
+    decode->op[0].type = X86_VAR_REG;
+    switch (op) {
+        case 0xf:
+            decode->op[0].reg = REG_SEG_CS;
+            break;
+        case 0x17:
+            decode->op[0].reg = REG_SEG_SS;
+            break;
+        case 0x1f:
+            decode->op[0].reg = REG_SEG_DS;
+            break;
+        case 0x07:
+            decode->op[0].reg = REG_SEG_ES;
+            break;
+        case 0xa1:
+            decode->op[0].reg = REG_SEG_FS;
+            break;
+        case 0xa9:
+            decode->op[0].reg = REG_SEG_GS;
+            break;
+    }
+}
+
+static void decode_incgroup(CPUState *cpu, struct x86_decode *decode)
+{
+    decode->op[0].type = X86_VAR_REG;
+    decode->op[0].reg = decode->opcode[0] - 0x40;
+    decode->op[0].ptr = get_reg_ref(cpu, decode->op[0].reg, decode->rex.b, decode->operand_size);
+}
+
+static void decode_decgroup(CPUState *cpu, struct x86_decode *decode)
+{
+    decode->op[0].type = X86_VAR_REG;
+    decode->op[0].reg = decode->opcode[0] - 0x48;
+    decode->op[0].ptr = get_reg_ref(cpu, decode->op[0].reg, decode->rex.b, decode->operand_size);
+}
+
+static void decode_incgroup2(CPUState *cpu, struct x86_decode *decode)
+{
+    if (!decode->modrm.reg)
+        decode->cmd = X86_DECODE_CMD_INC;
+    else if (1 == decode->modrm.reg)
+        decode->cmd = X86_DECODE_CMD_DEC;
+}
+
+static void decode_pushgroup(CPUState *cpu, struct x86_decode *decode)
+{
+    decode->op[0].type = X86_VAR_REG;
+    decode->op[0].reg = decode->opcode[0] - 0x50;
+    decode->op[0].ptr = get_reg_ref(cpu, decode->op[0].reg, decode->rex.b, decode->operand_size);
+}
+
+static void decode_popgroup(CPUState *cpu, struct x86_decode *decode)
+{
+    decode->op[0].type = X86_VAR_REG;
+    decode->op[0].reg = decode->opcode[0] - 0x58;
+    decode->op[0].ptr = get_reg_ref(cpu, decode->op[0].reg, decode->rex.b, decode->operand_size);
+}
+
+static void decode_jxx(CPUState *cpu, struct x86_decode *decode)
+{
+    decode->displacement = decode_bytes(cpu, decode, decode->operand_size);
+    decode->displacement_size = decode->operand_size;
+}
+
+static void decode_farjmp(CPUState *cpu, struct x86_decode *decode)
+{
+    decode->op[0].type = X86_VAR_IMMEDIATE;
+    decode->op[0].val = decode_bytes(cpu, decode, decode->operand_size);
+    decode->displacement = decode_word(cpu, decode);
+}
+
+static void decode_addgroup(CPUState *cpu, struct x86_decode *decode)
+{
+    enum x86_decode_cmd group[] = {
+        X86_DECODE_CMD_ADD,
+        X86_DECODE_CMD_OR,
+        X86_DECODE_CMD_ADC,
+        X86_DECODE_CMD_SBB,
+        X86_DECODE_CMD_AND,
+        X86_DECODE_CMD_SUB,
+        X86_DECODE_CMD_XOR,
+        X86_DECODE_CMD_CMP
+    };
+    decode->cmd = group[decode->modrm.reg];
+}
+
+static void decode_rotgroup(CPUState *cpu, struct x86_decode *decode)
+{
+    enum x86_decode_cmd group[] = {
+        X86_DECODE_CMD_ROL,
+        X86_DECODE_CMD_ROR,
+        X86_DECODE_CMD_RCL,
+        X86_DECODE_CMD_RCR,
+        X86_DECODE_CMD_SHL,
+        X86_DECODE_CMD_SHR,
+        X86_DECODE_CMD_SHL,
+        X86_DECODE_CMD_SAR
+    };
+    decode->cmd = group[decode->modrm.reg];
+}
+
+static void decode_f7group(CPUState *cpu, struct x86_decode *decode)
+{
+    enum x86_decode_cmd group[] = {
+        X86_DECODE_CMD_TST,
+        X86_DECODE_CMD_TST,
+        X86_DECODE_CMD_NOT,
+        X86_DECODE_CMD_NEG,
+        X86_DECODE_CMD_MUL,
+        X86_DECODE_CMD_IMUL_1,
+        X86_DECODE_CMD_DIV,
+        X86_DECODE_CMD_IDIV
+    };
+    decode->cmd = group[decode->modrm.reg];
+    decode_modrm_rm(cpu, decode, &decode->op[0]);
+
+    switch (decode->modrm.reg) {
+        case 0:
+        case 1:
+            decode_imm(cpu, decode, &decode->op[1]);
+            break;
+        case 2:
+            break;
+        case 3:
+            decode->op[1].type = X86_VAR_IMMEDIATE;
+            decode->op[1].val = 0;
+            break;
+        default:
+            break;
+    }
+}
+
+static void decode_xchgroup(CPUState *cpu, struct x86_decode *decode)
+{
+    decode->op[0].type = X86_VAR_REG;
+    decode->op[0].reg = decode->opcode[0] - 0x90;
+    decode->op[0].ptr = get_reg_ref(cpu, decode->op[0].reg, decode->rex.b, decode->operand_size);
+}
+
+static void decode_movgroup(CPUState *cpu, struct x86_decode *decode)
+{
+    decode->op[0].type = X86_VAR_REG;
+    decode->op[0].reg = decode->opcode[0] - 0xb8;
+    decode->op[0].ptr = get_reg_ref(cpu, decode->op[0].reg, decode->rex.b, decode->operand_size);
+    decode_immediate(cpu, decode, &decode->op[1], decode->operand_size);
+}
+
+static void fetch_moffs(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *op)
+{
+    op->type = X86_VAR_OFFSET;
+    op->ptr = decode_bytes(cpu, decode, decode->addressing_size);
+}
+
+static void decode_movgroup8(CPUState *cpu, struct x86_decode *decode)
+{
+    decode->op[0].type = X86_VAR_REG;
+    decode->op[0].reg = decode->opcode[0] - 0xb0;
+    decode->op[0].ptr = get_reg_ref(cpu, decode->op[0].reg, decode->rex.b, decode->operand_size);
+    decode_immediate(cpu, decode, &decode->op[1], decode->operand_size);
+}
+
+static void decode_rcx(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *op)
+{
+    op->type = X86_VAR_REG;
+    op->reg = REG_RCX;
+    op->ptr = get_reg_ref(cpu, op->reg, decode->rex.b, decode->operand_size);
+}
+
+struct decode_tbl {
+    uint8_t opcode;
+    enum x86_decode_cmd cmd;
+    uint8_t operand_size;
+    bool is_modrm;
+    void (*decode_op1)(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *op1);
+    void (*decode_op2)(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *op2);
+    void (*decode_op3)(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *op3);
+    void (*decode_op4)(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *op4);
+    void (*decode_postfix)(CPUState *cpu, struct x86_decode *decode);
+    addr_t flags_mask;
+};
+
+struct decode_x87_tbl {
+    uint8_t opcode;
+    uint8_t modrm_reg;
+    uint8_t modrm_mod;
+    enum x86_decode_cmd cmd;
+    uint8_t operand_size;
+    bool rev;
+    bool pop;
+    void (*decode_op1)(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *op1);
+    void (*decode_op2)(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *op2);
+    void (*decode_postfix)(CPUState *cpu, struct x86_decode *decode);
+    addr_t flags_mask;
+};
+
+struct decode_tbl invl_inst = {0x0, 0, 0, false, NULL, NULL, NULL, NULL, decode_invalid};
+
+struct decode_tbl _decode_tbl1[255];
+struct decode_tbl _decode_tbl2[255];
+struct decode_x87_tbl _decode_tbl3[255];
+
+static void decode_x87_ins(CPUState *cpu, struct x86_decode *decode)
+{
+    struct decode_x87_tbl *decoder;
+    
+    decode->is_fpu = true;
+    int mode = decode->modrm.mod == 3 ? 1 : 0;
+    int index = ((decode->opcode[0] & 0xf) << 4) | (mode << 3) | decode->modrm.reg;
+    
+    decoder = &_decode_tbl3[index];
+    
+    decode->cmd = decoder->cmd;
+    if (decoder->operand_size)
+        decode->operand_size = decoder->operand_size;
+    decode->flags_mask = decoder->flags_mask;
+    decode->fpop_stack = decoder->pop;
+    decode->frev = decoder->rev;
+    
+    if (decoder->decode_op1)
+        decoder->decode_op1(cpu, decode, &decode->op[0]);
+    if (decoder->decode_op2)
+        decoder->decode_op2(cpu, decode, &decode->op[1]);
+    if (decoder->decode_postfix)
+        decoder->decode_postfix(cpu, decode);
+    
+    VM_PANIC_ON_EX(!decode->cmd, "x87 opcode %x %x (%x %x) not decoded\n", decode->opcode[0], decode->modrm.modrm, decoder->modrm_reg, decoder->modrm_mod);
+}
+
+static void decode_ffgroup(CPUState *cpu, struct x86_decode *decode)
+{
+    enum x86_decode_cmd group[] = {
+        X86_DECODE_CMD_INC,
+        X86_DECODE_CMD_DEC,
+        X86_DECODE_CMD_CALL_NEAR_ABS_INDIRECT,
+        X86_DECODE_CMD_CALL_FAR_ABS_INDIRECT,
+        X86_DECODE_CMD_JMP_NEAR_ABS_INDIRECT,
+        X86_DECODE_CMD_JMP_FAR_ABS_INDIRECT,
+        X86_DECODE_CMD_PUSH,
+        X86_DECODE_CMD_INVL,
+        X86_DECODE_CMD_INVL
+    };
+    decode->cmd = group[decode->modrm.reg];
+    if (decode->modrm.reg > 2)
+        decode->flags_mask = 0;
+}
+
+static void decode_sldtgroup(CPUState *cpu, struct x86_decode *decode)
+{
+    enum x86_decode_cmd group[] = {
+        X86_DECODE_CMD_SLDT,
+        X86_DECODE_CMD_STR,
+        X86_DECODE_CMD_LLDT,
+        X86_DECODE_CMD_LTR,
+        X86_DECODE_CMD_VERR,
+        X86_DECODE_CMD_VERW,
+        X86_DECODE_CMD_INVL,
+        X86_DECODE_CMD_INVL
+    };
+    decode->cmd = group[decode->modrm.reg];
+    printf("%llx: decode_sldtgroup: %d\n", cpu->hvf_x86->fetch_rip, decode->modrm.reg);
+}
+
+static void decode_lidtgroup(CPUState *cpu, struct x86_decode *decode)
+{
+    enum x86_decode_cmd group[] = {
+        X86_DECODE_CMD_SGDT,
+        X86_DECODE_CMD_SIDT,
+        X86_DECODE_CMD_LGDT,
+        X86_DECODE_CMD_LIDT,
+        X86_DECODE_CMD_SMSW,
+        X86_DECODE_CMD_LMSW,
+        X86_DECODE_CMD_LMSW,
+        X86_DECODE_CMD_INVLPG
+    };
+    decode->cmd = group[decode->modrm.reg];
+    if (0xf9 == decode->modrm.modrm) {
+        decode->opcode[decode->len++] = decode->modrm.modrm;
+        decode->cmd = X86_DECODE_CMD_RDTSCP;
+    }
+}
+
+static void decode_btgroup(CPUState *cpu, struct x86_decode *decode)
+{
+    enum x86_decode_cmd group[] = {
+        X86_DECODE_CMD_INVL,
+        X86_DECODE_CMD_INVL,
+        X86_DECODE_CMD_INVL,
+        X86_DECODE_CMD_INVL,
+        X86_DECODE_CMD_BT,
+        X86_DECODE_CMD_BTS,
+        X86_DECODE_CMD_BTR,
+        X86_DECODE_CMD_BTC
+    };
+    decode->cmd = group[decode->modrm.reg];
+}
+
+static void decode_x87_general(CPUState *cpu, struct x86_decode *decode)
+{
+    decode->is_fpu = true;
+}
+
+static void decode_x87_modrm_floatp(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *op)
+{
+    op->type = X87_VAR_FLOATP;
+}
+
+static void decode_x87_modrm_intp(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *op)
+{
+    op->type = X87_VAR_INTP;
+}
+
+static void decode_x87_modrm_bytep(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *op)
+{
+    op->type = X87_VAR_BYTEP;
+}
+
+static void decode_x87_modrm_st0(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *op)
+{
+    op->type = X87_VAR_REG;
+    op->reg = 0;
+}
+
+static void decode_decode_x87_modrm_st0(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *op)
+{
+    op->type = X87_VAR_REG;
+    op->reg = decode->modrm.modrm & 7;
+}
+
+
+static void decode_aegroup(CPUState *cpu, struct x86_decode *decode)
+{
+    decode->is_fpu = true;
+    switch (decode->modrm.reg) {
+        case 0:
+            decode->cmd = X86_DECODE_CMD_FXSAVE;
+            decode_x87_modrm_bytep(cpu, decode, &decode->op[0]);
+            break;
+        case 1:
+            decode_x87_modrm_bytep(cpu, decode, &decode->op[0]);
+            decode->cmd = X86_DECODE_CMD_FXRSTOR;
+            break;
+        case 5:
+            if (decode->modrm.modrm == 0xe8) {
+                decode->cmd = X86_DECODE_CMD_LFENCE;
+            } else {
+                VM_PANIC("xrstor");
+            }
+            break;
+        case 6:
+            VM_PANIC_ON(decode->modrm.modrm != 0xf0);
+            decode->cmd = X86_DECODE_CMD_MFENCE;
+            break;
+        case 7:
+            if (decode->modrm.modrm == 0xf8) {
+                decode->cmd = X86_DECODE_CMD_SFENCE;
+            } else {
+                decode->cmd = X86_DECODE_CMD_CLFLUSH;
+            }
+            break;
+        default:
+            VM_PANIC_ON_EX(1, "0xae: reg %d\n", decode->modrm.reg);
+            break;
+    }
+}
+
+static void decode_bswap(CPUState *cpu, struct x86_decode *decode)
+{
+    decode->op[0].type = X86_VAR_REG;
+    decode->op[0].reg = decode->opcode[1] - 0xc8;
+    decode->op[0].ptr = get_reg_ref(cpu, decode->op[0].reg, decode->rex.b, decode->operand_size);
+}
+
+static void decode_d9_4(CPUState *cpu, struct x86_decode *decode)
+{
+    switch(decode->modrm.modrm) {
+        case 0xe0:
+            // FCHS
+            decode->cmd = X86_DECODE_CMD_FCHS;
+            break;
+        case 0xe1:
+            decode->cmd = X86_DECODE_CMD_FABS;
+            break;
+        case 0xe4:
+            VM_PANIC_ON_EX(1, "FTST");
+            break;
+        case 0xe5:
+            // FXAM
+            decode->cmd = X86_DECODE_CMD_FXAM;
+            break;
+        default:
+            VM_PANIC_ON_EX(1, "FLDENV");
+            break;
+    }
+}
+
+static void decode_db_4(CPUState *cpu, struct x86_decode *decode)
+{
+    switch (decode->modrm.modrm) {
+        case 0xe0:
+            VM_PANIC_ON_EX(1, "unhandled FNENI: %x %x\n", decode->opcode[0], decode->modrm.modrm);
+            break;
+        case 0xe1:
+            VM_PANIC_ON_EX(1, "unhandled FNDISI: %x %x\n", decode->opcode[0], decode->modrm.modrm);
+            break;
+        case 0xe2:
+            VM_PANIC_ON_EX(1, "unhandled FCLEX: %x %x\n", decode->opcode[0], decode->modrm.modrm);
+            break;
+        case 0xe3:
+            decode->cmd = X86_DECODE_CMD_FNINIT;
+            break;
+        case 0xe4:
+            decode->cmd = X86_DECODE_CMD_FNSETPM;
+            break;
+        default:
+            VM_PANIC_ON_EX(1, "unhandled fpu opcode: %x %x\n", decode->opcode[0], decode->modrm.modrm);
+            break;
+    }
+}
+
+
+#define RFLAGS_MASK_NONE    0
+#define RFLAGS_MASK_OSZAPC  (RFLAGS_OF | RFLAGS_SF | RFLAGS_ZF | RFLAGS_AF | RFLAGS_PF | RFLAGS_CF)
+#define RFLAGS_MASK_LAHF    (RFLAGS_SF | RFLAGS_ZF | RFLAGS_AF | RFLAGS_PF | RFLAGS_CF)
+#define RFLAGS_MASK_CF      (RFLAGS_CF)
+#define RFLAGS_MASK_IF      (RFLAGS_IF)
+#define RFLAGS_MASK_TF      (RFLAGS_TF)
+#define RFLAGS_MASK_DF      (RFLAGS_DF)
+#define RFLAGS_MASK_ZF      (RFLAGS_ZF)
+
+struct decode_tbl _1op_inst[] =
+{
+    {0x0, X86_DECODE_CMD_ADD, 1, true, decode_modrm_rm, decode_modrm_reg, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x1, X86_DECODE_CMD_ADD, 0, true, decode_modrm_rm, decode_modrm_reg, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x2, X86_DECODE_CMD_ADD, 1, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x3, X86_DECODE_CMD_ADD, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x4, X86_DECODE_CMD_ADD, 1, false, decode_rax, decode_imm8, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x5, X86_DECODE_CMD_ADD, 0, false, decode_rax, decode_imm, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x6, X86_DECODE_CMD_PUSH_SEG, 0, false, false, NULL, NULL, NULL, decode_pushseg, RFLAGS_MASK_NONE},
+    {0x7, X86_DECODE_CMD_POP_SEG, 0, false, false, NULL, NULL, NULL, decode_popseg, RFLAGS_MASK_NONE},
+    {0x8, X86_DECODE_CMD_OR, 1, true, decode_modrm_rm, decode_modrm_reg, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x9, X86_DECODE_CMD_OR, 0, true, decode_modrm_rm, decode_modrm_reg, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0xa, X86_DECODE_CMD_OR, 1, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0xb, X86_DECODE_CMD_OR, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0xc, X86_DECODE_CMD_OR, 1, false, decode_rax, decode_imm8, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0xd, X86_DECODE_CMD_OR, 0, false, decode_rax, decode_imm, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    
+    {0xe, X86_DECODE_CMD_PUSH_SEG, 0, false, false, NULL, NULL, NULL, decode_pushseg, RFLAGS_MASK_NONE},
+    {0xf, X86_DECODE_CMD_POP_SEG, 0, false, false, NULL, NULL, NULL, decode_popseg, RFLAGS_MASK_NONE},
+    
+    {0x10, X86_DECODE_CMD_ADC, 1, true, decode_modrm_rm, decode_modrm_reg, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x11, X86_DECODE_CMD_ADC, 0, true, decode_modrm_rm, decode_modrm_reg, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x12, X86_DECODE_CMD_ADC, 1, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x13, X86_DECODE_CMD_ADC, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x14, X86_DECODE_CMD_ADC, 1, false, decode_rax, decode_imm, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x15, X86_DECODE_CMD_ADC, 0, false, decode_rax, decode_imm, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    
+    {0x16, X86_DECODE_CMD_PUSH_SEG, 0, false, false, NULL, NULL, NULL, decode_pushseg, RFLAGS_MASK_NONE},
+    {0x17, X86_DECODE_CMD_POP_SEG, 0, false, false, NULL, NULL, NULL, decode_popseg, RFLAGS_MASK_NONE},
+    
+    {0x18, X86_DECODE_CMD_SBB, 1, true, decode_modrm_rm, decode_modrm_reg, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x19, X86_DECODE_CMD_SBB, 0, true, decode_modrm_rm, decode_modrm_reg, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x1a, X86_DECODE_CMD_SBB, 1, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x1b, X86_DECODE_CMD_SBB, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x1c, X86_DECODE_CMD_SBB, 1, false, decode_rax, decode_imm8, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x1d, X86_DECODE_CMD_SBB, 0, false, decode_rax, decode_imm, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    
+    {0x1e, X86_DECODE_CMD_PUSH_SEG, 0, false, false, NULL, NULL, NULL, decode_pushseg, RFLAGS_MASK_NONE},
+    {0x1f, X86_DECODE_CMD_POP_SEG, 0, false, false, NULL, NULL, NULL, decode_popseg, RFLAGS_MASK_NONE},
+    
+    {0x20, X86_DECODE_CMD_AND, 1, true, decode_modrm_rm, decode_modrm_reg, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x21, X86_DECODE_CMD_AND, 0, true, decode_modrm_rm, decode_modrm_reg, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x22, X86_DECODE_CMD_AND, 1, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x23, X86_DECODE_CMD_AND, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x24, X86_DECODE_CMD_AND, 1, false, decode_rax, decode_imm, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x25, X86_DECODE_CMD_AND, 0, false, decode_rax, decode_imm, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x28, X86_DECODE_CMD_SUB, 1, true, decode_modrm_rm, decode_modrm_reg, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x29, X86_DECODE_CMD_SUB, 0, true, decode_modrm_rm, decode_modrm_reg, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x2a, X86_DECODE_CMD_SUB, 1, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x2b, X86_DECODE_CMD_SUB, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x2c, X86_DECODE_CMD_SUB, 1, false, decode_rax, decode_imm, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x2d, X86_DECODE_CMD_SUB, 0, false, decode_rax, decode_imm, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x2f, X86_DECODE_CMD_DAS, 0, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x30, X86_DECODE_CMD_XOR, 1, true, decode_modrm_rm, decode_modrm_reg, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x31, X86_DECODE_CMD_XOR, 0, true, decode_modrm_rm, decode_modrm_reg, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x32, X86_DECODE_CMD_XOR, 1, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x33, X86_DECODE_CMD_XOR, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x34, X86_DECODE_CMD_XOR, 1, false, decode_rax, decode_imm, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x35, X86_DECODE_CMD_XOR, 0, false, decode_rax, decode_imm, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    
+    {0x38, X86_DECODE_CMD_CMP, 1, true, decode_modrm_rm, decode_modrm_reg, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x39, X86_DECODE_CMD_CMP, 0, true, decode_modrm_rm, decode_modrm_reg, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x3a, X86_DECODE_CMD_CMP, 1, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x3b, X86_DECODE_CMD_CMP, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x3c, X86_DECODE_CMD_CMP, 1, false, decode_rax, decode_imm8, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x3d, X86_DECODE_CMD_CMP, 0, false, decode_rax, decode_imm, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    
+    {0x3f, X86_DECODE_CMD_AAS, 0, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    
+    {0x40, X86_DECODE_CMD_INC, 0, false, NULL, NULL, NULL, NULL, decode_incgroup, RFLAGS_MASK_OSZAPC},
+    {0x41, X86_DECODE_CMD_INC, 0, false, NULL, NULL, NULL, NULL, decode_incgroup, RFLAGS_MASK_OSZAPC},
+    {0x42, X86_DECODE_CMD_INC, 0, false, NULL, NULL, NULL, NULL, decode_incgroup, RFLAGS_MASK_OSZAPC},
+    {0x43, X86_DECODE_CMD_INC, 0, false, NULL, NULL, NULL, NULL, decode_incgroup, RFLAGS_MASK_OSZAPC},
+    {0x44, X86_DECODE_CMD_INC, 0, false, NULL, NULL, NULL, NULL, decode_incgroup, RFLAGS_MASK_OSZAPC},
+    {0x45, X86_DECODE_CMD_INC, 0, false, NULL, NULL, NULL, NULL, decode_incgroup, RFLAGS_MASK_OSZAPC},
+    {0x46, X86_DECODE_CMD_INC, 0, false, NULL, NULL, NULL, NULL, decode_incgroup, RFLAGS_MASK_OSZAPC},
+    {0x47, X86_DECODE_CMD_INC, 0, false, NULL, NULL, NULL, NULL, decode_incgroup, RFLAGS_MASK_OSZAPC},
+    
+    {0x48, X86_DECODE_CMD_DEC, 0, false, NULL, NULL, NULL, NULL, decode_decgroup, RFLAGS_MASK_OSZAPC},
+    {0x49, X86_DECODE_CMD_DEC, 0, false, NULL, NULL, NULL, NULL, decode_decgroup, RFLAGS_MASK_OSZAPC},
+    {0x4a, X86_DECODE_CMD_DEC, 0, false, NULL, NULL, NULL, NULL, decode_decgroup, RFLAGS_MASK_OSZAPC},
+    {0x4b, X86_DECODE_CMD_DEC, 0, false, NULL, NULL, NULL, NULL, decode_decgroup, RFLAGS_MASK_OSZAPC},
+    {0x4c, X86_DECODE_CMD_DEC, 0, false, NULL, NULL, NULL, NULL, decode_decgroup, RFLAGS_MASK_OSZAPC},
+    {0x4d, X86_DECODE_CMD_DEC, 0, false, NULL, NULL, NULL, NULL, decode_decgroup, RFLAGS_MASK_OSZAPC},
+    {0x4e, X86_DECODE_CMD_DEC, 0, false, NULL, NULL, NULL, NULL, decode_decgroup, RFLAGS_MASK_OSZAPC},
+    {0x4f, X86_DECODE_CMD_DEC, 0, false, NULL, NULL, NULL, NULL, decode_decgroup, RFLAGS_MASK_OSZAPC},
+    
+    {0x50, X86_DECODE_CMD_PUSH, 0, false, NULL, NULL, NULL, NULL, decode_pushgroup, RFLAGS_MASK_NONE},
+    {0x51, X86_DECODE_CMD_PUSH, 0, false, NULL, NULL, NULL, NULL, decode_pushgroup, RFLAGS_MASK_NONE},
+    {0x52, X86_DECODE_CMD_PUSH, 0, false, NULL, NULL, NULL, NULL, decode_pushgroup, RFLAGS_MASK_NONE},
+    {0x53, X86_DECODE_CMD_PUSH, 0, false, NULL, NULL, NULL, NULL, decode_pushgroup, RFLAGS_MASK_NONE},
+    {0x54, X86_DECODE_CMD_PUSH, 0, false, NULL, NULL, NULL, NULL, decode_pushgroup, RFLAGS_MASK_NONE},
+    {0x55, X86_DECODE_CMD_PUSH, 0, false, NULL, NULL, NULL, NULL, decode_pushgroup, RFLAGS_MASK_NONE},
+    {0x56, X86_DECODE_CMD_PUSH, 0, false, NULL, NULL, NULL, NULL, decode_pushgroup, RFLAGS_MASK_NONE},
+    {0x57, X86_DECODE_CMD_PUSH, 0, false, NULL, NULL, NULL, NULL, decode_pushgroup, RFLAGS_MASK_NONE},
+    
+    {0x58, X86_DECODE_CMD_POP, 0, false, NULL, NULL, NULL, NULL, decode_popgroup, RFLAGS_MASK_NONE},
+    {0x59, X86_DECODE_CMD_POP, 0, false, NULL, NULL, NULL, NULL, decode_popgroup, RFLAGS_MASK_NONE},
+    {0x5a, X86_DECODE_CMD_POP, 0, false, NULL, NULL, NULL, NULL, decode_popgroup, RFLAGS_MASK_NONE},
+    {0x5b, X86_DECODE_CMD_POP, 0, false, NULL, NULL, NULL, NULL, decode_popgroup, RFLAGS_MASK_NONE},
+    {0x5c, X86_DECODE_CMD_POP, 0, false, NULL, NULL, NULL, NULL, decode_popgroup, RFLAGS_MASK_NONE},
+    {0x5d, X86_DECODE_CMD_POP, 0, false, NULL, NULL, NULL, NULL, decode_popgroup, RFLAGS_MASK_NONE},
+    {0x5e, X86_DECODE_CMD_POP, 0, false, NULL, NULL, NULL, NULL, decode_popgroup, RFLAGS_MASK_NONE},
+    {0x5f, X86_DECODE_CMD_POP, 0, false, NULL, NULL, NULL, NULL, decode_popgroup, RFLAGS_MASK_NONE},
+    
+    {0x60, X86_DECODE_CMD_PUSHA, 0, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x61, X86_DECODE_CMD_POPA, 0, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    
+    {0x68, X86_DECODE_CMD_PUSH, 0, false, decode_imm, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x6a, X86_DECODE_CMD_PUSH, 0, false, decode_imm8_signed, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x69, X86_DECODE_CMD_IMUL_3, 0, true, decode_modrm_reg, decode_modrm_rm, decode_imm, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x6b, X86_DECODE_CMD_IMUL_3, 0, true, decode_modrm_reg, decode_modrm_rm, decode_imm8_signed, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    
+    {0x6c, X86_DECODE_CMD_INS, 1, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x6d, X86_DECODE_CMD_INS, 0, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x6e, X86_DECODE_CMD_OUTS, 1, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x6f, X86_DECODE_CMD_OUTS, 0, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    
+    {0x70, X86_DECODE_CMD_JXX, 1, false, NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+    {0x71, X86_DECODE_CMD_JXX, 1, false, NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+    {0x72, X86_DECODE_CMD_JXX, 1, false, NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+    {0x73, X86_DECODE_CMD_JXX, 1, false, NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+    {0x74, X86_DECODE_CMD_JXX, 1, false, NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+    {0x75, X86_DECODE_CMD_JXX, 1, false, NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+    {0x76, X86_DECODE_CMD_JXX, 1, false, NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+    {0x77, X86_DECODE_CMD_JXX, 1, false, NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+    {0x78, X86_DECODE_CMD_JXX, 1, false, NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+    {0x79, X86_DECODE_CMD_JXX, 1, false, NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+    {0x7a, X86_DECODE_CMD_JXX, 1, false, NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+    {0x7b, X86_DECODE_CMD_JXX, 1, false, NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+    {0x7c, X86_DECODE_CMD_JXX, 1, false, NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+    {0x7d, X86_DECODE_CMD_JXX, 1, false, NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+    {0x7e, X86_DECODE_CMD_JXX, 1, false, NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+    {0x7f, X86_DECODE_CMD_JXX, 1, false, NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+    
+    {0x80, X86_DECODE_CMD_INVL, 1, true, decode_modrm_rm, decode_imm8, NULL, NULL, decode_addgroup, RFLAGS_MASK_OSZAPC},
+    {0x81, X86_DECODE_CMD_INVL, 0, true, decode_modrm_rm, decode_imm, NULL, NULL, decode_addgroup, RFLAGS_MASK_OSZAPC},
+    {0x82, X86_DECODE_CMD_INVL, 1, true, decode_modrm_rm, decode_imm8, NULL, NULL, decode_addgroup, RFLAGS_MASK_OSZAPC},
+    {0x83, X86_DECODE_CMD_INVL, 0, true, decode_modrm_rm, decode_imm8_signed, NULL, NULL, decode_addgroup, RFLAGS_MASK_OSZAPC},
+    {0x84, X86_DECODE_CMD_TST, 1, true, decode_modrm_rm, decode_modrm_reg, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x85, X86_DECODE_CMD_TST, 0, true, decode_modrm_rm, decode_modrm_reg, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0x86, X86_DECODE_CMD_XCHG, 1, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x87, X86_DECODE_CMD_XCHG, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x88, X86_DECODE_CMD_MOV, 1, true, decode_modrm_rm, decode_modrm_reg, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x89, X86_DECODE_CMD_MOV, 0, true, decode_modrm_rm, decode_modrm_reg, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x8a, X86_DECODE_CMD_MOV, 1, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x8b, X86_DECODE_CMD_MOV, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x8c, X86_DECODE_CMD_MOV_FROM_SEG, 0, true, decode_modrm_rm, decode_modrm_reg, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x8d, X86_DECODE_CMD_LEA, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x8e, X86_DECODE_CMD_MOV_TO_SEG, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x8f, X86_DECODE_CMD_POP, 0, true, decode_modrm_rm, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    
+    {0x90, X86_DECODE_CMD_NOP, 0, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x91, X86_DECODE_CMD_XCHG, 0, false, NULL, decode_rax, NULL, NULL, decode_xchgroup, RFLAGS_MASK_NONE},
+    {0x92, X86_DECODE_CMD_XCHG, 0, false, NULL, decode_rax, NULL, NULL, decode_xchgroup, RFLAGS_MASK_NONE},
+    {0x93, X86_DECODE_CMD_XCHG, 0, false, NULL, decode_rax, NULL, NULL, decode_xchgroup, RFLAGS_MASK_NONE},
+    {0x94, X86_DECODE_CMD_XCHG, 0, false, NULL, decode_rax, NULL, NULL, decode_xchgroup, RFLAGS_MASK_NONE},
+    {0x95, X86_DECODE_CMD_XCHG, 0, false, NULL, decode_rax, NULL, NULL, decode_xchgroup, RFLAGS_MASK_NONE},
+    {0x96, X86_DECODE_CMD_XCHG, 0, false, NULL, decode_rax, NULL, NULL, decode_xchgroup, RFLAGS_MASK_NONE},
+    {0x97, X86_DECODE_CMD_XCHG, 0, false, NULL, decode_rax, NULL, NULL, decode_xchgroup, RFLAGS_MASK_NONE},
+    
+    {0x98, X86_DECODE_CMD_CBW, 0, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x99, X86_DECODE_CMD_CWD, 0, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    
+    {0x9a, X86_DECODE_CMD_CALL_FAR, 0, false, NULL, NULL, NULL, NULL, decode_farjmp, RFLAGS_MASK_NONE},
+    
+    {0x9c, X86_DECODE_CMD_PUSHF, 0, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    //{0x9d, X86_DECODE_CMD_POPF, 0, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_POPF},
+    {0x9e, X86_DECODE_CMD_SAHF, 0, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x9f, X86_DECODE_CMD_LAHF, 0, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_LAHF},
+    
+    {0xa0, X86_DECODE_CMD_MOV, 1, false, decode_rax, fetch_moffs, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xa1, X86_DECODE_CMD_MOV, 0, false, decode_rax, fetch_moffs, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xa2, X86_DECODE_CMD_MOV, 1, false, fetch_moffs, decode_rax, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xa3, X86_DECODE_CMD_MOV, 0, false, fetch_moffs, decode_rax, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    
+    {0xa4, X86_DECODE_CMD_MOVS, 1, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xa5, X86_DECODE_CMD_MOVS, 0, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xa6, X86_DECODE_CMD_CMPS, 1, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0xa7, X86_DECODE_CMD_CMPS, 0, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0xaa, X86_DECODE_CMD_STOS, 1, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xab, X86_DECODE_CMD_STOS, 0, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xac, X86_DECODE_CMD_LODS, 1, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xad, X86_DECODE_CMD_LODS, 0, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xae, X86_DECODE_CMD_SCAS, 1, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0xaf, X86_DECODE_CMD_SCAS, 0, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    
+    {0xa8, X86_DECODE_CMD_TST, 1, false, decode_rax, decode_imm, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0xa9, X86_DECODE_CMD_TST, 0, false, decode_rax, decode_imm, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    
+    {0xb0, X86_DECODE_CMD_MOV, 1, false, NULL, NULL, NULL, NULL, decode_movgroup8, RFLAGS_MASK_NONE},
+    {0xb1, X86_DECODE_CMD_MOV, 1, false, NULL, NULL, NULL, NULL, decode_movgroup8, RFLAGS_MASK_NONE},
+    {0xb2, X86_DECODE_CMD_MOV, 1, false, NULL, NULL, NULL, NULL, decode_movgroup8, RFLAGS_MASK_NONE},
+    {0xb3, X86_DECODE_CMD_MOV, 1, false, NULL, NULL, NULL, NULL, decode_movgroup8, RFLAGS_MASK_NONE},
+    {0xb4, X86_DECODE_CMD_MOV, 1, false, NULL, NULL, NULL, NULL, decode_movgroup8, RFLAGS_MASK_NONE},
+    {0xb5, X86_DECODE_CMD_MOV, 1, false, NULL, NULL, NULL, NULL, decode_movgroup8, RFLAGS_MASK_NONE},
+    {0xb6, X86_DECODE_CMD_MOV, 1, false, NULL, NULL, NULL, NULL, decode_movgroup8, RFLAGS_MASK_NONE},
+    {0xb7, X86_DECODE_CMD_MOV, 1, false, NULL, NULL, NULL, NULL, decode_movgroup8, RFLAGS_MASK_NONE},
+    
+    {0xb8, X86_DECODE_CMD_MOV, 0, false, NULL, NULL, NULL, NULL, decode_movgroup, RFLAGS_MASK_NONE},
+    {0xb9, X86_DECODE_CMD_MOV, 0, false, NULL, NULL, NULL, NULL, decode_movgroup, RFLAGS_MASK_NONE},
+    {0xba, X86_DECODE_CMD_MOV, 0, false, NULL, NULL, NULL, NULL, decode_movgroup, RFLAGS_MASK_NONE},
+    {0xbb, X86_DECODE_CMD_MOV, 0, false, NULL, NULL, NULL, NULL, decode_movgroup, RFLAGS_MASK_NONE},
+    {0xbc, X86_DECODE_CMD_MOV, 0, false, NULL, NULL, NULL, NULL, decode_movgroup, RFLAGS_MASK_NONE},
+    {0xbd, X86_DECODE_CMD_MOV, 0, false, NULL, NULL, NULL, NULL, decode_movgroup, RFLAGS_MASK_NONE},
+    {0xbe, X86_DECODE_CMD_MOV, 0, false, NULL, NULL, NULL, NULL, decode_movgroup, RFLAGS_MASK_NONE},
+    {0xbf, X86_DECODE_CMD_MOV, 0, false, NULL, NULL, NULL, NULL, decode_movgroup, RFLAGS_MASK_NONE},
+    
+    {0xc0, X86_DECODE_CMD_INVL, 1, true, decode_modrm_rm, decode_imm8, NULL, NULL, decode_rotgroup, RFLAGS_MASK_OSZAPC},
+    {0xc1, X86_DECODE_CMD_INVL, 0, true, decode_modrm_rm, decode_imm8, NULL, NULL, decode_rotgroup, RFLAGS_MASK_OSZAPC},
+    
+    {0xc2, X86_DECODE_RET_NEAR, 0, false, decode_imm16, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xc3, X86_DECODE_RET_NEAR, 0, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    
+    {0xc4, X86_DECODE_CMD_LES, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xc5, X86_DECODE_CMD_LDS, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    
+    {0xc6, X86_DECODE_CMD_MOV, 1, true, decode_modrm_rm, decode_imm8, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xc7, X86_DECODE_CMD_MOV, 0, true, decode_modrm_rm, decode_imm, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    
+    {0xc8, X86_DECODE_CMD_ENTER, 0, false, decode_imm16, decode_imm8, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xc9, X86_DECODE_CMD_LEAVE, 0, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xca, X86_DECODE_RET_FAR, 0, false, decode_imm16, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xcb, X86_DECODE_RET_FAR, 0, false, decode_imm_0, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xcd, X86_DECODE_CMD_INT, 0, false, decode_imm8, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    //{0xcf, X86_DECODE_CMD_IRET, 0, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_IRET},
+    
+    {0xd0, X86_DECODE_CMD_INVL, 1, true, decode_modrm_rm, decode_imm_1, NULL, NULL, decode_rotgroup, RFLAGS_MASK_OSZAPC},
+    {0xd1, X86_DECODE_CMD_INVL, 0, true, decode_modrm_rm, decode_imm_1, NULL, NULL, decode_rotgroup, RFLAGS_MASK_OSZAPC},
+    {0xd2, X86_DECODE_CMD_INVL, 1, true, decode_modrm_rm, decode_rcx, NULL, NULL, decode_rotgroup, RFLAGS_MASK_OSZAPC},
+    {0xd3, X86_DECODE_CMD_INVL, 0, true, decode_modrm_rm, decode_rcx, NULL, NULL, decode_rotgroup, RFLAGS_MASK_OSZAPC},
+    
+    {0xd4, X86_DECODE_CMD_AAM, 0, false, decode_imm8, NULL, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0xd5, X86_DECODE_CMD_AAD, 0, false, decode_imm8, NULL, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    
+    {0xd7, X86_DECODE_CMD_XLAT, 0, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    
+    {0xd8, X86_DECODE_CMD_INVL, 0, true, NULL, NULL, NULL, NULL, decode_x87_ins, RFLAGS_MASK_NONE},
+    {0xd9, X86_DECODE_CMD_INVL, 0, true, NULL, NULL, NULL, NULL, decode_x87_ins, RFLAGS_MASK_NONE},
+    {0xda, X86_DECODE_CMD_INVL, 0, true, NULL, NULL, NULL, NULL, decode_x87_ins, RFLAGS_MASK_NONE},
+    {0xdb, X86_DECODE_CMD_INVL, 0, true, NULL, NULL, NULL, NULL, decode_x87_ins, RFLAGS_MASK_NONE},
+    {0xdc, X86_DECODE_CMD_INVL, 0, true, NULL, NULL, NULL, NULL, decode_x87_ins, RFLAGS_MASK_NONE},
+    {0xdd, X86_DECODE_CMD_INVL, 0, true, NULL, NULL, NULL, NULL, decode_x87_ins, RFLAGS_MASK_NONE},
+    {0xde, X86_DECODE_CMD_INVL, 0, true, NULL, NULL, NULL, NULL, decode_x87_ins, RFLAGS_MASK_NONE},
+    {0xdf, X86_DECODE_CMD_INVL, 0, true, NULL, NULL, NULL, NULL, decode_x87_ins, RFLAGS_MASK_NONE},
+    
+    {0xe0, X86_DECODE_CMD_LOOP, 0, false, decode_imm8_signed, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xe1, X86_DECODE_CMD_LOOP, 0, false, decode_imm8_signed, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xe2, X86_DECODE_CMD_LOOP, 0, false, decode_imm8_signed, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    
+    {0xe3, X86_DECODE_CMD_JCXZ, 1, false, NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+    
+    {0xe4, X86_DECODE_CMD_IN, 1, false, decode_imm8, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xe5, X86_DECODE_CMD_IN, 0, false, decode_imm8, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xe6, X86_DECODE_CMD_OUT, 1, false, decode_imm8, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xe7, X86_DECODE_CMD_OUT, 0, false, decode_imm8, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xe8, X86_DECODE_CMD_CALL_NEAR, 0, false, decode_imm_signed, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xe9, X86_DECODE_CMD_JMP_NEAR, 0, false, decode_imm_signed, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xea, X86_DECODE_CMD_JMP_FAR, 0, false, NULL, NULL, NULL, NULL, decode_farjmp, RFLAGS_MASK_NONE},
+    {0xeb, X86_DECODE_CMD_JMP_NEAR, 1, false, decode_imm8_signed, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xec, X86_DECODE_CMD_IN, 1, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xed, X86_DECODE_CMD_IN, 0, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xee, X86_DECODE_CMD_OUT, 1, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xef, X86_DECODE_CMD_OUT, 0, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    
+    {0xf4, X86_DECODE_CMD_HLT, 0, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    
+    {0xf5, X86_DECODE_CMD_CMC, 0, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_CF},
+    
+    {0xf6, X86_DECODE_CMD_INVL, 1, true, NULL, NULL, NULL, NULL, decode_f7group, RFLAGS_MASK_OSZAPC},
+    {0xf7, X86_DECODE_CMD_INVL, 0, true, NULL, NULL, NULL, NULL, decode_f7group, RFLAGS_MASK_OSZAPC},
+    
+    {0xf8, X86_DECODE_CMD_CLC, 0, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_CF},
+    {0xf9, X86_DECODE_CMD_STC, 0, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_CF},
+    
+    {0xfa, X86_DECODE_CMD_CLI, 0, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_IF},
+    {0xfb, X86_DECODE_CMD_STI, 0, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_IF},
+    {0xfc, X86_DECODE_CMD_CLD, 0, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_DF},
+    {0xfd, X86_DECODE_CMD_STD, 0, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_DF},
+    {0xfe, X86_DECODE_CMD_INVL, 1, true, decode_modrm_rm, NULL, NULL, NULL, decode_incgroup2, RFLAGS_MASK_OSZAPC},
+    {0xff, X86_DECODE_CMD_INVL, 0, true, decode_modrm_rm, NULL, NULL, NULL, decode_ffgroup, RFLAGS_MASK_OSZAPC},
+};
+
+struct decode_tbl _2op_inst[] =
+{
+    {0x0, X86_DECODE_CMD_INVL, 0, true, decode_modrm_rm, NULL, NULL, NULL, decode_sldtgroup, RFLAGS_MASK_NONE},
+    {0x1, X86_DECODE_CMD_INVL, 0, true, decode_modrm_rm, NULL, NULL, NULL, decode_lidtgroup, RFLAGS_MASK_NONE},
+    {0x6, X86_DECODE_CMD_CLTS, 0, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_TF},
+    {0x9, X86_DECODE_CMD_WBINVD, 0, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x18, X86_DECODE_CMD_PREFETCH, 0, true, NULL, NULL, NULL, NULL, decode_x87_general, RFLAGS_MASK_NONE},
+    {0x1f, X86_DECODE_CMD_NOP, 0, true, decode_modrm_rm, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x20, X86_DECODE_CMD_MOV_FROM_CR, 0, true, decode_modrm_rm, decode_modrm_reg, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x21, X86_DECODE_CMD_MOV_FROM_DR, 0, true, decode_modrm_rm, decode_modrm_reg, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x22, X86_DECODE_CMD_MOV_TO_CR, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x23, X86_DECODE_CMD_MOV_TO_DR, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x30, X86_DECODE_CMD_WRMSR, 0, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x31, X86_DECODE_CMD_RDTSC, 0, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x32, X86_DECODE_CMD_RDMSR, 0, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x40, X86_DECODE_CMD_CMOV, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x41, X86_DECODE_CMD_CMOV, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x42, X86_DECODE_CMD_CMOV, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x43, X86_DECODE_CMD_CMOV, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x44, X86_DECODE_CMD_CMOV, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x45, X86_DECODE_CMD_CMOV, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x46, X86_DECODE_CMD_CMOV, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x47, X86_DECODE_CMD_CMOV, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x48, X86_DECODE_CMD_CMOV, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x49, X86_DECODE_CMD_CMOV, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x4a, X86_DECODE_CMD_CMOV, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x4b, X86_DECODE_CMD_CMOV, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x4c, X86_DECODE_CMD_CMOV, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x4d, X86_DECODE_CMD_CMOV, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x4e, X86_DECODE_CMD_CMOV, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x4f, X86_DECODE_CMD_CMOV, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x77, X86_DECODE_CMD_EMMS, 0, false, NULL, NULL, NULL, NULL, decode_x87_general, RFLAGS_MASK_NONE},
+    {0x82, X86_DECODE_CMD_JXX, 0, false, NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+    {0x83, X86_DECODE_CMD_JXX, 0, false, NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+    {0x84, X86_DECODE_CMD_JXX, 0, false, NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+    {0x85, X86_DECODE_CMD_JXX, 0, false, NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+    {0x86, X86_DECODE_CMD_JXX, 0, false, NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+    {0x87, X86_DECODE_CMD_JXX, 0, false, NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+    {0x88, X86_DECODE_CMD_JXX, 0, false, NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+    {0x89, X86_DECODE_CMD_JXX, 0, false, NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+    {0x8a, X86_DECODE_CMD_JXX, 0, false, NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+    {0x8b, X86_DECODE_CMD_JXX, 0, false, NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+    {0x8c, X86_DECODE_CMD_JXX, 0, false, NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+    {0x8d, X86_DECODE_CMD_JXX, 0, false, NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+    {0x8e, X86_DECODE_CMD_JXX, 0, false, NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+    {0x8f, X86_DECODE_CMD_JXX, 0, false, NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+    {0x90, X86_DECODE_CMD_SETXX, 1, true, decode_modrm_rm, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x91, X86_DECODE_CMD_SETXX, 1, true, decode_modrm_rm, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x92, X86_DECODE_CMD_SETXX, 1, true, decode_modrm_rm, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x93, X86_DECODE_CMD_SETXX, 1, true, decode_modrm_rm, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x94, X86_DECODE_CMD_SETXX, 1, true, decode_modrm_rm, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x95, X86_DECODE_CMD_SETXX, 1, true, decode_modrm_rm, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x96, X86_DECODE_CMD_SETXX, 1, true, decode_modrm_rm, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x97, X86_DECODE_CMD_SETXX, 1, true, decode_modrm_rm, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x98, X86_DECODE_CMD_SETXX, 1, true, decode_modrm_rm, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x99, X86_DECODE_CMD_SETXX, 1, true, decode_modrm_rm, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x9a, X86_DECODE_CMD_SETXX, 1, true, decode_modrm_rm, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x9b, X86_DECODE_CMD_SETXX, 1, true, decode_modrm_rm, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x9c, X86_DECODE_CMD_SETXX, 1, true, decode_modrm_rm, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x9d, X86_DECODE_CMD_SETXX, 1, true, decode_modrm_rm, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x9e, X86_DECODE_CMD_SETXX, 1, true, decode_modrm_rm, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0x9f, X86_DECODE_CMD_SETXX, 1, true, decode_modrm_rm, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    
+    {0xb0, X86_DECODE_CMD_CMPXCHG, 1, true, decode_modrm_rm, decode_modrm_reg, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xb1, X86_DECODE_CMD_CMPXCHG, 0, true, decode_modrm_rm, decode_modrm_reg, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    
+    {0xb6, X86_DECODE_CMD_MOVZX, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xb7, X86_DECODE_CMD_MOVZX, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xb8, X86_DECODE_CMD_POPCNT, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0xbe, X86_DECODE_CMD_MOVSX, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xbf, X86_DECODE_CMD_MOVSX, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xa0, X86_DECODE_CMD_PUSH_SEG, 0, false, false, NULL, NULL, NULL, decode_pushseg, RFLAGS_MASK_NONE},
+    {0xa1, X86_DECODE_CMD_POP_SEG, 0, false, false, NULL, NULL, NULL, decode_popseg, RFLAGS_MASK_NONE},
+    {0xa2, X86_DECODE_CMD_CPUID, 0, false, NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xa3, X86_DECODE_CMD_BT, 0, true, decode_modrm_rm, decode_modrm_reg, NULL, NULL, NULL, RFLAGS_MASK_CF},
+    {0xa4, X86_DECODE_CMD_SHLD, 0, true, decode_modrm_rm, decode_modrm_reg, decode_imm8, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0xa5, X86_DECODE_CMD_SHLD, 0, true, decode_modrm_rm, decode_modrm_reg, decode_rcx, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0xa8, X86_DECODE_CMD_PUSH_SEG, 0, false, false, NULL, NULL, NULL, decode_pushseg, RFLAGS_MASK_NONE},
+    {0xa9, X86_DECODE_CMD_POP_SEG, 0, false, false, NULL, NULL, NULL, decode_popseg, RFLAGS_MASK_NONE},
+    {0xab, X86_DECODE_CMD_BTS, 0, true, decode_modrm_rm, decode_modrm_reg, NULL, NULL, NULL, RFLAGS_MASK_CF},
+    {0xac, X86_DECODE_CMD_SHRD, 0, true, decode_modrm_rm, decode_modrm_reg, decode_imm8, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0xad, X86_DECODE_CMD_SHRD, 0, true, decode_modrm_rm, decode_modrm_reg, decode_rcx, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    
+    {0xae, X86_DECODE_CMD_INVL, 0, true, decode_modrm_rm, NULL, NULL, NULL, decode_aegroup, RFLAGS_MASK_NONE},
+    
+    {0xaf, X86_DECODE_CMD_IMUL_2, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0xb2, X86_DECODE_CMD_LSS, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xb3, X86_DECODE_CMD_BTR, 0, true, decode_modrm_rm, decode_modrm_reg, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0xba, X86_DECODE_CMD_INVL, 0, true, decode_modrm_rm, decode_imm8, NULL, NULL, decode_btgroup, RFLAGS_MASK_OSZAPC},
+    {0xbb, X86_DECODE_CMD_BTC, 0, true, decode_modrm_rm, decode_modrm_reg, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0xbc, X86_DECODE_CMD_BSF, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    {0xbd, X86_DECODE_CMD_BSR, 0, true, decode_modrm_reg, decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    
+    {0xc1, X86_DECODE_CMD_XADD, 0, true, decode_modrm_rm, decode_modrm_reg, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+    
+    {0xc7, X86_DECODE_CMD_CMPXCHG8B, 0, true, decode_modrm_rm, NULL, NULL, NULL, NULL, RFLAGS_MASK_ZF},
+    
+    {0xc8, X86_DECODE_CMD_BSWAP, 0, false, NULL, NULL, NULL, NULL, decode_bswap, RFLAGS_MASK_NONE},
+    {0xc9, X86_DECODE_CMD_BSWAP, 0, false, NULL, NULL, NULL, NULL, decode_bswap, RFLAGS_MASK_NONE},
+    {0xca, X86_DECODE_CMD_BSWAP, 0, false, NULL, NULL, NULL, NULL, decode_bswap, RFLAGS_MASK_NONE},
+    {0xcb, X86_DECODE_CMD_BSWAP, 0, false, NULL, NULL, NULL, NULL, decode_bswap, RFLAGS_MASK_NONE},
+    {0xcc, X86_DECODE_CMD_BSWAP, 0, false, NULL, NULL, NULL, NULL, decode_bswap, RFLAGS_MASK_NONE},
+    {0xcd, X86_DECODE_CMD_BSWAP, 0, false, NULL, NULL, NULL, NULL, decode_bswap, RFLAGS_MASK_NONE},
+    {0xce, X86_DECODE_CMD_BSWAP, 0, false, NULL, NULL, NULL, NULL, decode_bswap, RFLAGS_MASK_NONE},
+    {0xcf, X86_DECODE_CMD_BSWAP, 0, false, NULL, NULL, NULL, NULL, decode_bswap, RFLAGS_MASK_NONE},
+};
+
+struct decode_x87_tbl invl_inst_x87 = {0x0, 0, 0, 0, 0, false, false, NULL, NULL, decode_invalid, 0};
+
+struct decode_x87_tbl _x87_inst[] =
+{
+    {0xd8, 0, 3, X86_DECODE_CMD_FADD, 10, false, false, decode_x87_modrm_st0, decode_decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+    {0xd8, 0, 0, X86_DECODE_CMD_FADD, 4, false, false, decode_x87_modrm_st0, decode_x87_modrm_floatp, NULL, RFLAGS_MASK_NONE},
+    {0xd8, 1, 3, X86_DECODE_CMD_FMUL, 10, false, false, decode_x87_modrm_st0, decode_decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+    {0xd8, 1, 0, X86_DECODE_CMD_FMUL, 4, false, false, decode_x87_modrm_st0, decode_x87_modrm_floatp, NULL, RFLAGS_MASK_NONE},
+    {0xd8, 4, 3, X86_DECODE_CMD_FSUB, 10, false, false, decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+    {0xd8, 4, 0, X86_DECODE_CMD_FSUB, 4, false, false, decode_x87_modrm_st0, decode_x87_modrm_floatp, NULL, RFLAGS_MASK_NONE},
+    {0xd8, 5, 3, X86_DECODE_CMD_FSUB, 10, true, false, decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+    {0xd8, 5, 0, X86_DECODE_CMD_FSUB, 4, true, false, decode_x87_modrm_st0, decode_x87_modrm_floatp, NULL, RFLAGS_MASK_NONE},
+    {0xd8, 6, 3, X86_DECODE_CMD_FDIV, 10, false, false, decode_x87_modrm_st0,decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+    {0xd8, 6, 0, X86_DECODE_CMD_FDIV, 4, false, false, decode_x87_modrm_st0, decode_x87_modrm_floatp, NULL, RFLAGS_MASK_NONE},
+    {0xd8, 7, 3, X86_DECODE_CMD_FDIV, 10, true, false, decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+    {0xd8, 7, 0, X86_DECODE_CMD_FDIV, 4, true, false, decode_x87_modrm_st0, decode_x87_modrm_floatp, NULL, RFLAGS_MASK_NONE},
+    
+    {0xd9, 0, 3, X86_DECODE_CMD_FLD, 10, false, false, decode_x87_modrm_st0, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xd9, 0, 0, X86_DECODE_CMD_FLD, 4, false, false, decode_x87_modrm_floatp, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xd9, 1, 3, X86_DECODE_CMD_FXCH, 10, false, false, decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+    {0xd9, 1, 0, X86_DECODE_CMD_INVL, 10, false, false, decode_x87_modrm_st0, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xd9, 2, 3, X86_DECODE_CMD_INVL, 10, false, false, decode_x87_modrm_st0, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xd9, 2, 0, X86_DECODE_CMD_FST, 4, false, false, decode_x87_modrm_floatp, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xd9, 3, 3, X86_DECODE_CMD_INVL, 10, false, false, decode_x87_modrm_st0, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xd9, 3, 0, X86_DECODE_CMD_FST, 4, false, true, decode_x87_modrm_floatp, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xd9, 4, 3, X86_DECODE_CMD_INVL, 10, false, false, decode_x87_modrm_st0, NULL, decode_d9_4, RFLAGS_MASK_NONE},
+    {0xd9, 4, 0, X86_DECODE_CMD_INVL, 4, false, false, decode_x87_modrm_bytep, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xd9, 5, 3, X86_DECODE_CMD_FLDxx, 10, false, false, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xd9, 5, 0, X86_DECODE_CMD_FLDCW, 2, false, false, decode_x87_modrm_bytep, NULL, NULL, RFLAGS_MASK_NONE},
+    //
+    {0xd9, 7, 3, X86_DECODE_CMD_FNSTCW, 2, false, false, decode_x87_modrm_bytep, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xd9, 7, 0, X86_DECODE_CMD_FNSTCW, 2, false, false, decode_x87_modrm_bytep, NULL, NULL, RFLAGS_MASK_NONE},
+    
+    {0xda, 0, 3, X86_DECODE_CMD_FCMOV, 10, false, false, decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+    {0xda, 0, 0, X86_DECODE_CMD_FADD, 4, false, false, decode_x87_modrm_st0, decode_x87_modrm_intp, NULL, RFLAGS_MASK_NONE},
+    {0xda, 1, 3, X86_DECODE_CMD_FCMOV, 10, false, false, decode_x87_modrm_st0, decode_decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+    {0xda, 1, 0, X86_DECODE_CMD_FMUL, 4, false, false, decode_x87_modrm_st0, decode_x87_modrm_intp, NULL, RFLAGS_MASK_NONE},
+    {0xda, 2, 3, X86_DECODE_CMD_FCMOV, 10, false, false, decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+    {0xda, 3, 3, X86_DECODE_CMD_FCMOV, 10, false, false, decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+    {0xda, 4, 3, X86_DECODE_CMD_INVL, 10, false, false, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xda, 4, 0, X86_DECODE_CMD_FSUB, 4, false, false, decode_x87_modrm_st0, decode_x87_modrm_intp, NULL, RFLAGS_MASK_NONE},
+    {0xda, 5, 3, X86_DECODE_CMD_FUCOM, 10, false, true, decode_x87_modrm_st0, decode_decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+    {0xda, 5, 0, X86_DECODE_CMD_FSUB, 4, true, false, decode_x87_modrm_st0, decode_x87_modrm_intp, NULL, RFLAGS_MASK_NONE},
+    {0xda, 6, 3, X86_DECODE_CMD_INVL, 10, false, false, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xda, 6, 0, X86_DECODE_CMD_FDIV, 4, false, false, decode_x87_modrm_st0, decode_x87_modrm_intp, NULL, RFLAGS_MASK_NONE},
+    {0xda, 7, 3, X86_DECODE_CMD_INVL, 10, false, false, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xda, 7, 0, X86_DECODE_CMD_FDIV, 4, true, false, decode_x87_modrm_st0, decode_x87_modrm_intp, NULL, RFLAGS_MASK_NONE},
+    
+    {0xdb, 0, 3, X86_DECODE_CMD_FCMOV, 10, false, false, decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+    {0xdb, 0, 0, X86_DECODE_CMD_FLD, 4, false, false, decode_x87_modrm_intp, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xdb, 1, 3, X86_DECODE_CMD_FCMOV, 10, false, false, decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+    {0xdb, 2, 3, X86_DECODE_CMD_FCMOV, 10, false, false, decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+    {0xdb, 2, 0, X86_DECODE_CMD_FST, 4, false, false, decode_x87_modrm_intp, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xdb, 3, 3, X86_DECODE_CMD_FCMOV, 10, false, false, decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+    {0xdb, 3, 0, X86_DECODE_CMD_FST, 4, false, true, decode_x87_modrm_intp, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xdb, 4, 3, X86_DECODE_CMD_INVL, 10, false, false, NULL, NULL, decode_db_4, RFLAGS_MASK_NONE},
+    {0xdb, 4, 0, X86_DECODE_CMD_INVL, 10, false, false, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xdb, 5, 3, X86_DECODE_CMD_FUCOMI, 10, false, false, decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+    {0xdb, 5, 0, X86_DECODE_CMD_FLD, 10, false, false, decode_x87_modrm_floatp, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xdb, 7, 0, X86_DECODE_CMD_FST, 10, false, true, decode_x87_modrm_floatp, NULL, NULL, RFLAGS_MASK_NONE},
+    
+    {0xdc, 0, 3, X86_DECODE_CMD_FADD, 10, false, false, decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+    {0xdc, 0, 0, X86_DECODE_CMD_FADD, 8, false, false, decode_x87_modrm_st0, decode_x87_modrm_floatp, NULL, RFLAGS_MASK_NONE},
+    {0xdc, 1, 3, X86_DECODE_CMD_FMUL, 10, false, false, decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+    {0xdc, 1, 0, X86_DECODE_CMD_FMUL, 8, false, false, decode_x87_modrm_st0, decode_x87_modrm_floatp, NULL, RFLAGS_MASK_NONE},
+    {0xdc, 4, 3, X86_DECODE_CMD_FSUB, 10, true, false, decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+    {0xdc, 4, 0, X86_DECODE_CMD_FSUB, 8, false, false, decode_x87_modrm_st0, decode_x87_modrm_floatp, NULL, RFLAGS_MASK_NONE},
+    {0xdc, 5, 3, X86_DECODE_CMD_FSUB, 10, false, false, decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+    {0xdc, 5, 0, X86_DECODE_CMD_FSUB, 8, true, false, decode_x87_modrm_st0, decode_x87_modrm_floatp, NULL, RFLAGS_MASK_NONE},
+    {0xdc, 6, 3, X86_DECODE_CMD_FDIV, 10, true, false, decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+    {0xdc, 6, 0, X86_DECODE_CMD_FDIV, 8, false, false, decode_x87_modrm_st0, decode_x87_modrm_floatp, NULL, RFLAGS_MASK_NONE},
+    {0xdc, 7, 3, X86_DECODE_CMD_FDIV, 10, false, false, decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+    {0xdc, 7, 0, X86_DECODE_CMD_FDIV, 8, true, false, decode_x87_modrm_st0, decode_x87_modrm_floatp, NULL, RFLAGS_MASK_NONE},
+    
+    {0xdd, 0, 0, X86_DECODE_CMD_FLD, 8, false, false, decode_x87_modrm_floatp, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xdd, 1, 3, X86_DECODE_CMD_FXCH, 10, false, false, decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+    {0xdd, 2, 3, X86_DECODE_CMD_FST, 10, false, false, decode_x87_modrm_st0, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xdd, 2, 0, X86_DECODE_CMD_FST, 8, false, false, decode_x87_modrm_floatp, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xdd, 3, 3, X86_DECODE_CMD_FST, 10, false, true, decode_x87_modrm_st0, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xdd, 3, 0, X86_DECODE_CMD_FST, 8, false, true, decode_x87_modrm_floatp, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xdd, 4, 3, X86_DECODE_CMD_FUCOM, 10, false, false, decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+    {0xdd, 4, 0, X86_DECODE_CMD_FRSTOR, 8, false, false, decode_x87_modrm_bytep, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xdd, 5, 3, X86_DECODE_CMD_FUCOM, 10, false, true, decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+    {0xdd, 7, 0, X86_DECODE_CMD_FNSTSW, 0, false, false, decode_x87_modrm_bytep, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xdd, 7, 3, X86_DECODE_CMD_FNSTSW, 0, false, false, decode_x87_modrm_bytep, NULL, NULL, RFLAGS_MASK_NONE},
+    
+    {0xde, 0, 3, X86_DECODE_CMD_FADD, 10, false, true, decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+    {0xde, 0, 0, X86_DECODE_CMD_FADD, 2, false, false, decode_x87_modrm_st0, decode_x87_modrm_intp, NULL, RFLAGS_MASK_NONE},
+    {0xde, 1, 3, X86_DECODE_CMD_FMUL, 10, false, true, decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+    {0xde, 1, 0, X86_DECODE_CMD_FMUL, 2, false, false, decode_x87_modrm_st0, decode_x87_modrm_intp, NULL, RFLAGS_MASK_NONE},
+    {0xde, 4, 3, X86_DECODE_CMD_FSUB, 10, true, true, decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+    {0xde, 4, 0, X86_DECODE_CMD_FSUB, 2, false, false, decode_x87_modrm_st0, decode_x87_modrm_intp, NULL, RFLAGS_MASK_NONE},
+    {0xde, 5, 3, X86_DECODE_CMD_FSUB, 10, false, true, decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+    {0xde, 5, 0, X86_DECODE_CMD_FSUB, 2, true, false, decode_x87_modrm_st0, decode_x87_modrm_intp, NULL, RFLAGS_MASK_NONE},
+    {0xde, 6, 3, X86_DECODE_CMD_FDIV, 10, true, true, decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+    {0xde, 6, 0, X86_DECODE_CMD_FDIV, 2, false, false, decode_x87_modrm_st0, decode_x87_modrm_intp, NULL, RFLAGS_MASK_NONE},
+    {0xde, 7, 3, X86_DECODE_CMD_FDIV, 10, false, true, decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+    {0xde, 7, 0, X86_DECODE_CMD_FDIV, 2, true, false, decode_x87_modrm_st0, decode_x87_modrm_intp, NULL, RFLAGS_MASK_NONE},
+    
+    {0xdf, 0, 0, X86_DECODE_CMD_FLD, 2, false, false, decode_x87_modrm_intp, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xdf, 1, 3, X86_DECODE_CMD_FXCH, 10, false, false, decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+    {0xdf, 2, 3, X86_DECODE_CMD_FST, 10, false, true, decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+    {0xdf, 2, 0, X86_DECODE_CMD_FST, 2, false, false, decode_x87_modrm_intp, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xdf, 3, 3, X86_DECODE_CMD_FST, 10, false, true, decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+    {0xdf, 3, 0, X86_DECODE_CMD_FST, 2, false, true, decode_x87_modrm_intp, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xdf, 4, 3, X86_DECODE_CMD_FNSTSW, 2, false, true, decode_x87_modrm_bytep, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xdf, 5, 3, X86_DECODE_CMD_FUCOMI, 10, false, true, decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+    {0xdf, 5, 0, X86_DECODE_CMD_FLD, 8, false, false, decode_x87_modrm_intp, NULL, NULL, RFLAGS_MASK_NONE},
+    {0xdf, 7, 0, X86_DECODE_CMD_FST, 8, false, true, decode_x87_modrm_intp, NULL, NULL, RFLAGS_MASK_NONE},
+};
+
+void calc_modrm_operand16(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *op)
+{
+    addr_t ptr = 0;
+    x86_reg_segment seg = REG_SEG_DS;
+
+    if (!decode->modrm.mod && 6 == decode->modrm.rm) {
+        op->ptr = (uint16_t)decode->displacement;
+        goto calc_addr;
+    }
+
+    if (decode->displacement_size)
+        ptr = sign(decode->displacement, decode->displacement_size);
+
+    switch (decode->modrm.rm) {
+        case 0:
+            ptr += BX(cpu) + SI(cpu);
+            break;
+        case 1:
+            ptr += BX(cpu) + DI(cpu);
+            break;
+        case 2:
+            ptr += BP(cpu) + SI(cpu);
+            seg = REG_SEG_SS;
+            break;
+        case 3:
+            ptr += BP(cpu) + DI(cpu);
+            seg = REG_SEG_SS;
+            break;
+        case 4:
+            ptr += SI(cpu);
+            break;
+        case 5:
+            ptr += DI(cpu);
+            break;
+        case 6:
+            ptr += BP(cpu);
+            seg = REG_SEG_SS;
+            break;
+        case 7:
+            ptr += BX(cpu);
+            break;
+    }
+calc_addr:
+    if (X86_DECODE_CMD_LEA == decode->cmd)
+        op->ptr = (uint16_t)ptr;
+    else
+        op->ptr = decode_linear_addr(cpu, decode, (uint16_t)ptr, seg);
+}
+
+addr_t get_reg_ref(CPUState *cpu, int reg, int is_extended, int size)
+{
+    addr_t ptr = 0;
+    int which = 0;
+
+    if (is_extended)
+        reg |= REG_R8;
+
+
+    switch (size) {
+        case 1:
+            if (is_extended || reg < 4) {
+                which = 1;
+                ptr = (addr_t)&RL(cpu, reg);
+            } else {
+                which = 2;
+                ptr = (addr_t)&RH(cpu, reg - 4);
+            }
+            break;
+        default:
+            which = 3;
+            ptr = (addr_t)&RRX(cpu, reg);
+            break;
+    }
+    return ptr;
+}
+
+addr_t get_reg_val(CPUState *cpu, int reg, int is_extended, int size)
+{
+    addr_t val = 0;
+    memcpy(&val, (void*)get_reg_ref(cpu, reg, is_extended, size), size);
+    return val;
+}
+
+static addr_t get_sib_val(CPUState *cpu, struct x86_decode *decode, x86_reg_segment *sel)
+{
+    addr_t base = 0;
+    addr_t scaled_index = 0;
+    int addr_size = decode->addressing_size;
+    int base_reg = decode->sib.base;
+    int index_reg = decode->sib.index;
+
+    *sel = REG_SEG_DS;
+
+    if (decode->modrm.mod || base_reg != REG_RBP) {
+        if (decode->rex.b)
+            base_reg |= REG_R8;
+        if (REG_RSP == base_reg || REG_RBP == base_reg)
+            *sel = REG_SEG_SS;
+        base = get_reg_val(cpu, decode->sib.base, decode->rex.b, addr_size);
+    }
+
+    if (decode->rex.x)
+        index_reg |= REG_R8;
+
+    if (index_reg != REG_RSP)
+        scaled_index = get_reg_val(cpu, index_reg, decode->rex.x, addr_size) << decode->sib.scale;
+    return base + scaled_index;
+}
+
+void calc_modrm_operand32(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *op)
+{
+    x86_reg_segment seg = REG_SEG_DS;
+    addr_t ptr = 0;
+    int addr_size = decode->addressing_size;
+
+    if (decode->displacement_size)
+        ptr = sign(decode->displacement, decode->displacement_size);
+
+    if (4 == decode->modrm.rm) {
+        ptr += get_sib_val(cpu, decode, &seg);
+    }
+    else if (!decode->modrm.mod && 5 == decode->modrm.rm) {
+        if (x86_is_long_mode(cpu))
+            ptr += RIP(cpu) + decode->len;
+        else
+            ptr = decode->displacement;
+    }
+    else {
+        if (REG_RBP == decode->modrm.rm || REG_RSP == decode->modrm.rm)
+            seg = REG_SEG_SS;
+        ptr += get_reg_val(cpu, decode->modrm.rm, decode->rex.b, addr_size);
+    }
+
+    if (X86_DECODE_CMD_LEA == decode->cmd)
+        op->ptr = (uint32_t)ptr;
+    else
+        op->ptr = decode_linear_addr(cpu, decode, (uint32_t)ptr, seg);
+}
+
+void calc_modrm_operand64(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *op)
+{
+    x86_reg_segment seg = REG_SEG_DS;
+    int32_t offset = 0;
+    int mod = decode->modrm.mod;
+    int rm = decode->modrm.rm;
+    addr_t ptr;
+    int src = decode->modrm.rm;
+    
+    if (decode->displacement_size)
+        offset = sign(decode->displacement, decode->displacement_size);
+
+    if (4 == rm)
+        ptr = get_sib_val(cpu, decode, &seg) + offset;
+    else if (0 == mod && 5 == rm)
+        ptr = RIP(cpu) + decode->len + (int32_t) offset;
+    else
+        ptr = get_reg_val(cpu, src, decode->rex.b, 8) + (int64_t) offset;
+    
+    if (X86_DECODE_CMD_LEA == decode->cmd)
+        op->ptr = ptr;
+    else
+        op->ptr = decode_linear_addr(cpu, decode, ptr, seg);
+}
+
+
+void calc_modrm_operand(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *op)
+{
+    if (3 == decode->modrm.mod) {
+        op->reg = decode->modrm.reg;
+        op->type = X86_VAR_REG;
+        op->ptr = get_reg_ref(cpu, decode->modrm.rm, decode->rex.b, decode->operand_size);
+        return;
+    }
+
+    switch (decode->addressing_size) {
+        case 2:
+            calc_modrm_operand16(cpu, decode, op);
+            break;
+        case 4:
+            calc_modrm_operand32(cpu, decode, op);
+            break;
+        case 8:
+            calc_modrm_operand64(cpu, decode, op);
+            break;
+        default:
+            VM_PANIC_EX("unsupported address size %d\n", decode->addressing_size);
+            break;
+    }
+}
+
+static void decode_prefix(CPUState *cpu, struct x86_decode *decode)
+{
+    while (1) {
+        uint8_t byte = decode_byte(cpu, decode);
+        switch (byte) {
+            case PREFIX_LOCK:
+                decode->lock = byte;
+                break;
+            case PREFIX_REPN:
+            case PREFIX_REP:
+                decode->rep = byte;
+                break;
+            case PREFIX_CS_SEG_OVEERIDE:
+            case PREFIX_SS_SEG_OVEERIDE:
+            case PREFIX_DS_SEG_OVEERIDE:
+            case PREFIX_ES_SEG_OVEERIDE:
+            case PREFIX_FS_SEG_OVEERIDE:
+            case PREFIX_GS_SEG_OVEERIDE:
+                decode->segment_override = byte;
+                break;
+            case PREFIX_OP_SIZE_OVERRIDE:
+                decode->op_size_override = byte;
+                break;
+            case PREFIX_ADDR_SIZE_OVERRIDE:
+                decode->addr_size_override = byte;
+                break;
+            case PREFIX_REX ... (PREFIX_REX + 0xf):
+                if (x86_is_long_mode(cpu)) {
+                    decode->rex.rex = byte;
+                    break;
+                }
+                // fall through when not in long mode
+            default:
+                decode->len--;
+                return;
+        }
+    }
+}
+
+void set_addressing_size(CPUState *cpu, struct x86_decode *decode)
+{
+    decode->addressing_size = -1;
+    if (x86_is_real(cpu) || x86_is_v8086(cpu)) {
+        if (decode->addr_size_override)
+            decode->addressing_size = 4;
+        else
+            decode->addressing_size = 2;
+    }
+    else if (!x86_is_long_mode(cpu)) {
+        // protected
+        struct vmx_segment cs;
+        vmx_read_segment_descriptor(cpu, &cs, REG_SEG_CS);
+        // check db
+        if ((cs.ar >> 14) & 1) {
+            if (decode->addr_size_override)
+                decode->addressing_size = 2;
+            else
+                decode->addressing_size = 4;
+        } else {
+            if (decode->addr_size_override)
+                decode->addressing_size = 4;
+            else
+                decode->addressing_size = 2;
+        }
+    } else {
+        // long
+        if (decode->addr_size_override)
+            decode->addressing_size = 4;
+        else
+            decode->addressing_size = 8;
+    }
+}
+
+void set_operand_size(CPUState *cpu, struct x86_decode *decode)
+{
+    decode->operand_size = -1;
+    if (x86_is_real(cpu) || x86_is_v8086(cpu)) {
+        if (decode->op_size_override)
+            decode->operand_size = 4;
+        else
+            decode->operand_size = 2;
+    }
+    else if (!x86_is_long_mode(cpu)) {
+        // protected
+        struct vmx_segment cs;
+        vmx_read_segment_descriptor(cpu, &cs, REG_SEG_CS);
+        // check db
+        if ((cs.ar >> 14) & 1) {
+            if (decode->op_size_override)
+                decode->operand_size = 2;
+            else
+                decode->operand_size = 4;
+        } else {
+            if (decode->op_size_override)
+                decode->operand_size = 4;
+            else
+                decode->operand_size = 2;
+        }
+    } else {
+        // long
+        if (decode->op_size_override)
+            decode->operand_size = 2;
+        else
+            decode->operand_size = 4;
+
+        if (decode->rex.w)
+            decode->operand_size = 8;
+    }
+}
+
+static void decode_sib(CPUState *cpu, struct x86_decode *decode)
+{
+    if ((decode->modrm.mod != 3) && (4 == decode->modrm.rm) && (decode->addressing_size != 2)) {
+        decode->sib.sib = decode_byte(cpu, decode);
+        decode->sib_present = true;
+    }
+}
+
+/* 16 bit modrm
+ * mod                               R/M
+ * 00	[BX+SI]         [BX+DI]         [BP+SI]         [BP+DI]         [SI]        [DI]        [disp16]	[BX]
+ * 01	[BX+SI+disp8]	[BX+DI+disp8]	[BP+SI+disp8]	[BP+DI+disp8]	[SI+disp8]	[DI+disp8]	[BP+disp8]	[BX+disp8]
+ * 10	[BX+SI+disp16]	[BX+DI+disp16]	[BP+SI+disp16]	[BP+DI+disp16]	[SI+disp16]	[DI+disp16]	[BP+disp16]	[BX+disp16]
+ * 11     -               -              -                -               -          -            -          -
+ */
+int disp16_tbl[4][8] =
+    {{0, 0, 0, 0, 0, 0, 2, 0},
+    {1, 1, 1, 1, 1, 1, 1, 1},
+    {2, 2, 2, 2, 2, 2, 2, 2},
+    {0, 0, 0, 0, 0, 0, 0, 0}};
+
+/*
+ 32/64-bit	 modrm
+ Mod
+ 00     [r/m]        [r/m]        [r/m]        [r/m]        [SIB]        [RIP/EIP1,2+disp32]   [r/m]         [r/m]
+ 01     [r/m+disp8]  [r/m+disp8]  [r/m+disp8]  [r/m+disp8]  [SIB+disp8]  [r/m+disp8]           [SIB+disp8]   [r/m+disp8]
+ 10     [r/m+disp32] [r/m+disp32] [r/m+disp32] [r/m+disp32] [SIB+disp32] [r/m+disp32]          [SIB+disp32]	 [r/m+disp32]
+ 11     -            -             -           -            -            -                      -             -
+ */
+int disp32_tbl[4][8] =
+    {{0, 0, 0, 0, -1, 4, 0, 0},
+    {1, 1, 1, 1, 1, 1, 1, 1},
+    {4, 4, 4, 4, 4, 4, 4, 4},
+    {0, 0, 0, 0, 0, 0, 0, 0}};
+
+static inline void decode_displacement(CPUState *cpu, struct x86_decode *decode)
+{
+    int addressing_size = decode->addressing_size;
+    int mod = decode->modrm.mod;
+    int rm = decode->modrm.rm;
+    
+    decode->displacement_size = 0;
+    switch (addressing_size) {
+        case 2:
+            decode->displacement_size = disp16_tbl[mod][rm];
+            if (decode->displacement_size)
+                decode->displacement = (uint16_t)decode_bytes(cpu, decode, decode->displacement_size);
+            break;
+        case 4:
+        case 8:
+            if (-1 == disp32_tbl[mod][rm]) {
+                if (5 == decode->sib.base)
+                    decode->displacement_size = 4;
+            }
+            else
+                decode->displacement_size = disp32_tbl[mod][rm];
+            
+            if (decode->displacement_size)
+                decode->displacement = (uint32_t)decode_bytes(cpu, decode, decode->displacement_size);
+            break;
+    }
+}
+
+static inline void decode_modrm(CPUState *cpu, struct x86_decode *decode)
+{
+    decode->modrm.modrm = decode_byte(cpu, decode);
+    decode->is_modrm = true;
+    
+    decode_sib(cpu, decode);
+    decode_displacement(cpu, decode);
+}
+
+static inline void decode_opcode_general(CPUState *cpu, struct x86_decode *decode, uint8_t opcode, struct decode_tbl *inst_decoder)
+{
+    decode->cmd = inst_decoder->cmd;
+    if (inst_decoder->operand_size)
+        decode->operand_size = inst_decoder->operand_size;
+    decode->flags_mask = inst_decoder->flags_mask;
+    
+    if (inst_decoder->is_modrm)
+        decode_modrm(cpu, decode);
+    if (inst_decoder->decode_op1)
+        inst_decoder->decode_op1(cpu, decode, &decode->op[0]);
+    if (inst_decoder->decode_op2)
+        inst_decoder->decode_op2(cpu, decode, &decode->op[1]);
+    if (inst_decoder->decode_op3)
+        inst_decoder->decode_op3(cpu, decode, &decode->op[2]);
+    if (inst_decoder->decode_op4)
+        inst_decoder->decode_op4(cpu, decode, &decode->op[3]);
+    if (inst_decoder->decode_postfix)
+        inst_decoder->decode_postfix(cpu, decode);
+}
+
+static inline void decode_opcode_1(CPUState *cpu, struct x86_decode *decode, uint8_t opcode)
+{
+    struct decode_tbl *inst_decoder = &_decode_tbl1[opcode];
+    decode_opcode_general(cpu, decode, opcode, inst_decoder);
+}
+
+
+static inline void decode_opcode_2(CPUState *cpu, struct x86_decode *decode, uint8_t opcode)
+{
+    struct decode_tbl *inst_decoder = &_decode_tbl2[opcode];
+    decode_opcode_general(cpu, decode, opcode, inst_decoder);
+}
+
+static void decode_opcodes(CPUState *cpu, struct x86_decode *decode)
+{
+    uint8_t opcode;
+    
+    opcode = decode_byte(cpu, decode);
+    decode->opcode[decode->opcode_len++] = opcode;
+    if (opcode != OPCODE_ESCAPE) {
+        decode_opcode_1(cpu, decode, opcode);
+    } else {
+        opcode = decode_byte(cpu, decode);
+        decode->opcode[decode->opcode_len++] = opcode;
+        decode_opcode_2(cpu, decode, opcode);
+    }
+}
+
+uint32_t decode_instruction(CPUState *cpu, struct x86_decode *decode)
+{
+    ZERO_INIT(*decode);
+
+    decode_prefix(cpu, decode);
+    set_addressing_size(cpu, decode);
+    set_operand_size(cpu, decode);
+
+    decode_opcodes(cpu, decode);
+    
+    return decode->len;
+}
+
+void init_decoder(CPUState *cpu)
+{
+    int i;
+    
+    for (i = 0; i < ARRAY_SIZE(_decode_tbl2); i++)
+        memcpy(_decode_tbl1, &invl_inst, sizeof(invl_inst));
+    for (i = 0; i < ARRAY_SIZE(_decode_tbl2); i++)
+        memcpy(_decode_tbl2, &invl_inst, sizeof(invl_inst));
+    for (i = 0; i < ARRAY_SIZE(_decode_tbl3); i++)
+        memcpy(_decode_tbl3, &invl_inst, sizeof(invl_inst_x87));
+    
+    for (i = 0; i < ARRAY_SIZE(_1op_inst); i++) {
+        _decode_tbl1[_1op_inst[i].opcode] = _1op_inst[i];
+    }
+    for (i = 0; i < ARRAY_SIZE(_2op_inst); i++) {
+        _decode_tbl2[_2op_inst[i].opcode] = _2op_inst[i];
+    }
+    for (i = 0; i < ARRAY_SIZE(_x87_inst); i++) {
+        int index = ((_x87_inst[i].opcode & 0xf) << 4) | ((_x87_inst[i].modrm_mod & 1) << 3) | _x87_inst[i].modrm_reg;
+        _decode_tbl3[index] = _x87_inst[i];
+    }
+}
+
+
+const char *decode_cmd_to_string(enum x86_decode_cmd cmd)
+{
+    static const char *cmds[] = {"INVL", "PUSH", "PUSH_SEG", "POP", "POP_SEG", "MOV", "MOVSX", "MOVZX", "CALL_NEAR",
+        "CALL_NEAR_ABS_INDIRECT", "CALL_FAR_ABS_INDIRECT", "CMD_CALL_FAR", "RET_NEAR", "RET_FAR", "ADD", "OR",
+        "ADC", "SBB", "AND", "SUB", "XOR", "CMP", "INC", "DEC", "TST", "NOT", "NEG", "JMP_NEAR", "JMP_NEAR_ABS_INDIRECT",
+        "JMP_FAR", "JMP_FAR_ABS_INDIRECT", "LEA", "JXX",
+        "JCXZ", "SETXX", "MOV_TO_SEG", "MOV_FROM_SEG", "CLI", "STI", "CLD", "STD", "STC",
+        "CLC", "OUT", "IN", "INS", "OUTS", "LIDT", "SIDT", "LGDT", "SGDT", "SMSW", "LMSW", "RDTSCP", "INVLPG", "MOV_TO_CR",
+        "MOV_FROM_CR", "MOV_TO_DR", "MOV_FROM_DR", "PUSHF", "POPF", "CPUID", "ROL", "ROR", "RCL", "RCR", "SHL", "SAL",
+        "SHR","SHRD", "SHLD", "SAR", "DIV", "IDIV", "MUL", "IMUL_3", "IMUL_2", "IMUL_1", "MOVS", "CMPS", "SCAS",
+        "LODS", "STOS", "BSWAP", "XCHG", "RDTSC", "RDMSR", "WRMSR", "ENTER", "LEAVE", "BT", "BTS", "BTC", "BTR", "BSF",
+        "BSR", "IRET", "INT", "POPA", "PUSHA", "CWD", "CBW", "DAS", "AAD", "AAM", "AAS", "LOOP", "SLDT", "STR", "LLDT",
+        "LTR", "VERR", "VERW", "SAHF", "LAHF", "WBINVD", "LDS", "LSS", "LES", "LGS", "LFS", "CMC", "XLAT", "NOP", "CMOV",
+        "CLTS", "XADD", "HLT", "CMPXCHG8B", "CMPXCHG", "POPCNT",
+        "FNINIT", "FLD", "FLDxx", "FNSTCW", "FNSTSW", "FNSETPM", "FSAVE", "FRSTOR", "FXSAVE", "FXRSTOR", "FDIV", "FMUL",
+        "FSUB", "FADD", "EMMS", "MFENCE", "SFENCE", "LFENCE", "PREFETCH", "FST", "FABS", "FUCOM", "FUCOMI", "FLDCW",
+        "FXCH", "FCHS", "FCMOV", "FRNDINT", "FXAM", "LAST"};
+    return cmds[cmd];
+}
+
+addr_t decode_linear_addr(struct CPUState *cpu, struct x86_decode *decode, addr_t addr, x86_reg_segment seg)
+{
+    switch (decode->segment_override) {
+        case PREFIX_CS_SEG_OVEERIDE:
+            seg = REG_SEG_CS;
+            break;
+        case PREFIX_SS_SEG_OVEERIDE:
+            seg = REG_SEG_SS;
+            break;
+        case PREFIX_DS_SEG_OVEERIDE:
+            seg = REG_SEG_DS;
+            break;
+        case PREFIX_ES_SEG_OVEERIDE:
+            seg = REG_SEG_ES;
+            break;
+        case PREFIX_FS_SEG_OVEERIDE:
+            seg = REG_SEG_FS;
+            break;
+        case PREFIX_GS_SEG_OVEERIDE:
+            seg = REG_SEG_GS;
+            break;
+        default:
+            break;
+    }
+    return linear_addr_size(cpu, addr, decode->addressing_size, seg);
+}
diff --git a/target/i386/hvf-utils/x86_decode.h b/target/i386/hvf-utils/x86_decode.h
new file mode 100644
index 0000000000..3a22d7d1a5
--- /dev/null
+++ b/target/i386/hvf-utils/x86_decode.h
@@ -0,0 +1,314 @@
+/*
+ * Copyright (C) 2016 Veertu Inc,
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 or
+ * (at your option) version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#pragma once
+
+#include <sys/types.h>
+#include <sys/ioctl.h>
+#include <sys/mman.h>
+#include <stdarg.h>
+#include "qemu-common.h"
+#include "x86.h"
+
+typedef enum x86_prefix {
+    // group 1
+    PREFIX_LOCK =                  0xf0,
+    PREFIX_REPN =                  0xf2,
+    PREFIX_REP =                   0xf3,
+    // group 2
+    PREFIX_CS_SEG_OVEERIDE =       0x2e,
+    PREFIX_SS_SEG_OVEERIDE =       0x36,
+    PREFIX_DS_SEG_OVEERIDE =       0x3e,
+    PREFIX_ES_SEG_OVEERIDE =       0x26,
+    PREFIX_FS_SEG_OVEERIDE =       0x64,
+    PREFIX_GS_SEG_OVEERIDE =       0x65,
+    // group 3
+    PREFIX_OP_SIZE_OVERRIDE =      0x66,
+    // group 4
+    PREFIX_ADDR_SIZE_OVERRIDE =    0x67,
+
+    PREFIX_REX                   = 0x40,
+} x86_prefix;
+
+enum x86_decode_cmd {
+    X86_DECODE_CMD_INVL = 0,
+    
+    X86_DECODE_CMD_PUSH,
+    X86_DECODE_CMD_PUSH_SEG,
+    X86_DECODE_CMD_POP,
+    X86_DECODE_CMD_POP_SEG,
+    X86_DECODE_CMD_MOV,
+    X86_DECODE_CMD_MOVSX,
+    X86_DECODE_CMD_MOVZX,
+    X86_DECODE_CMD_CALL_NEAR,
+    X86_DECODE_CMD_CALL_NEAR_ABS_INDIRECT,
+    X86_DECODE_CMD_CALL_FAR_ABS_INDIRECT,
+    X86_DECODE_CMD_CALL_FAR,
+    X86_DECODE_RET_NEAR,
+    X86_DECODE_RET_FAR,
+    X86_DECODE_CMD_ADD,
+    X86_DECODE_CMD_OR,
+    X86_DECODE_CMD_ADC,
+    X86_DECODE_CMD_SBB,
+    X86_DECODE_CMD_AND,
+    X86_DECODE_CMD_SUB,
+    X86_DECODE_CMD_XOR,
+    X86_DECODE_CMD_CMP,
+    X86_DECODE_CMD_INC,
+    X86_DECODE_CMD_DEC,
+    X86_DECODE_CMD_TST,
+    X86_DECODE_CMD_NOT,
+    X86_DECODE_CMD_NEG,
+    X86_DECODE_CMD_JMP_NEAR,
+    X86_DECODE_CMD_JMP_NEAR_ABS_INDIRECT,
+    X86_DECODE_CMD_JMP_FAR,
+    X86_DECODE_CMD_JMP_FAR_ABS_INDIRECT,
+    X86_DECODE_CMD_LEA,
+    X86_DECODE_CMD_JXX,
+    X86_DECODE_CMD_JCXZ,
+    X86_DECODE_CMD_SETXX,
+    X86_DECODE_CMD_MOV_TO_SEG,
+    X86_DECODE_CMD_MOV_FROM_SEG,
+    X86_DECODE_CMD_CLI,
+    X86_DECODE_CMD_STI,
+    X86_DECODE_CMD_CLD,
+    X86_DECODE_CMD_STD,
+    X86_DECODE_CMD_STC,
+    X86_DECODE_CMD_CLC,
+    X86_DECODE_CMD_OUT,
+    X86_DECODE_CMD_IN,
+    X86_DECODE_CMD_INS,
+    X86_DECODE_CMD_OUTS,
+    X86_DECODE_CMD_LIDT,
+    X86_DECODE_CMD_SIDT,
+    X86_DECODE_CMD_LGDT,
+    X86_DECODE_CMD_SGDT,
+    X86_DECODE_CMD_SMSW,
+    X86_DECODE_CMD_LMSW,
+    X86_DECODE_CMD_RDTSCP,
+    X86_DECODE_CMD_INVLPG,
+    X86_DECODE_CMD_MOV_TO_CR,
+    X86_DECODE_CMD_MOV_FROM_CR,
+    X86_DECODE_CMD_MOV_TO_DR,
+    X86_DECODE_CMD_MOV_FROM_DR,
+    X86_DECODE_CMD_PUSHF,
+    X86_DECODE_CMD_POPF,
+    X86_DECODE_CMD_CPUID,
+    X86_DECODE_CMD_ROL,
+    X86_DECODE_CMD_ROR,
+    X86_DECODE_CMD_RCL,
+    X86_DECODE_CMD_RCR,
+    X86_DECODE_CMD_SHL,
+    X86_DECODE_CMD_SAL,
+    X86_DECODE_CMD_SHR,
+    X86_DECODE_CMD_SHRD,
+    X86_DECODE_CMD_SHLD,
+    X86_DECODE_CMD_SAR,
+    X86_DECODE_CMD_DIV,
+    X86_DECODE_CMD_IDIV,
+    X86_DECODE_CMD_MUL,
+    X86_DECODE_CMD_IMUL_3,
+    X86_DECODE_CMD_IMUL_2,
+    X86_DECODE_CMD_IMUL_1,
+    X86_DECODE_CMD_MOVS,
+    X86_DECODE_CMD_CMPS,
+    X86_DECODE_CMD_SCAS,
+    X86_DECODE_CMD_LODS,
+    X86_DECODE_CMD_STOS,
+    X86_DECODE_CMD_BSWAP,
+    X86_DECODE_CMD_XCHG,
+    X86_DECODE_CMD_RDTSC,
+    X86_DECODE_CMD_RDMSR,
+    X86_DECODE_CMD_WRMSR,
+    X86_DECODE_CMD_ENTER,
+    X86_DECODE_CMD_LEAVE,
+    X86_DECODE_CMD_BT,
+    X86_DECODE_CMD_BTS,
+    X86_DECODE_CMD_BTC,
+    X86_DECODE_CMD_BTR,
+    X86_DECODE_CMD_BSF,
+    X86_DECODE_CMD_BSR,
+    X86_DECODE_CMD_IRET,
+    X86_DECODE_CMD_INT,
+    X86_DECODE_CMD_POPA,
+    X86_DECODE_CMD_PUSHA,
+    X86_DECODE_CMD_CWD,
+    X86_DECODE_CMD_CBW,
+    X86_DECODE_CMD_DAS,
+    X86_DECODE_CMD_AAD,
+    X86_DECODE_CMD_AAM,
+    X86_DECODE_CMD_AAS,
+    X86_DECODE_CMD_LOOP,
+    X86_DECODE_CMD_SLDT,
+    X86_DECODE_CMD_STR,
+    X86_DECODE_CMD_LLDT,
+    X86_DECODE_CMD_LTR,
+    X86_DECODE_CMD_VERR,
+    X86_DECODE_CMD_VERW,
+    X86_DECODE_CMD_SAHF,
+    X86_DECODE_CMD_LAHF,
+    X86_DECODE_CMD_WBINVD,
+    X86_DECODE_CMD_LDS,
+    X86_DECODE_CMD_LSS,
+    X86_DECODE_CMD_LES,
+    X86_DECODE_XMD_LGS,
+    X86_DECODE_CMD_LFS,
+    X86_DECODE_CMD_CMC,
+    X86_DECODE_CMD_XLAT,
+    X86_DECODE_CMD_NOP,
+    X86_DECODE_CMD_CMOV,
+    X86_DECODE_CMD_CLTS,
+    X86_DECODE_CMD_XADD,
+    X86_DECODE_CMD_HLT,
+    X86_DECODE_CMD_CMPXCHG8B,
+    X86_DECODE_CMD_CMPXCHG,
+    X86_DECODE_CMD_POPCNT,
+    
+    X86_DECODE_CMD_FNINIT,
+    X86_DECODE_CMD_FLD,
+    X86_DECODE_CMD_FLDxx,
+    X86_DECODE_CMD_FNSTCW,
+    X86_DECODE_CMD_FNSTSW,
+    X86_DECODE_CMD_FNSETPM,
+    X86_DECODE_CMD_FSAVE,
+    X86_DECODE_CMD_FRSTOR,
+    X86_DECODE_CMD_FXSAVE,
+    X86_DECODE_CMD_FXRSTOR,
+    X86_DECODE_CMD_FDIV,
+    X86_DECODE_CMD_FMUL,
+    X86_DECODE_CMD_FSUB,
+    X86_DECODE_CMD_FADD,
+    X86_DECODE_CMD_EMMS,
+    X86_DECODE_CMD_MFENCE,
+    X86_DECODE_CMD_SFENCE,
+    X86_DECODE_CMD_LFENCE,
+    X86_DECODE_CMD_PREFETCH,
+    X86_DECODE_CMD_CLFLUSH,
+    X86_DECODE_CMD_FST,
+    X86_DECODE_CMD_FABS,
+    X86_DECODE_CMD_FUCOM,
+    X86_DECODE_CMD_FUCOMI,
+    X86_DECODE_CMD_FLDCW,
+    X86_DECODE_CMD_FXCH,
+    X86_DECODE_CMD_FCHS,
+    X86_DECODE_CMD_FCMOV,
+    X86_DECODE_CMD_FRNDINT,
+    X86_DECODE_CMD_FXAM,
+
+    X86_DECODE_CMD_LAST,
+};
+
+const char *decode_cmd_to_string(enum x86_decode_cmd cmd);
+
+typedef struct x86_modrm {
+    union {
+        uint8_t modrm;
+        struct {
+            uint8_t rm:3;
+            uint8_t reg:3;
+            uint8_t mod:2;
+        };
+    };
+} __attribute__ ((__packed__)) x86_modrm;
+
+typedef struct x86_sib {
+    union {
+        uint8_t sib;
+        struct {
+            uint8_t base:3;
+            uint8_t index:3;
+            uint8_t scale:2;
+        };
+    };
+} __attribute__ ((__packed__)) x86_sib;
+
+typedef struct x86_rex {
+    union {
+        uint8_t rex;
+        struct {
+            uint8_t b:1;
+            uint8_t x:1;
+            uint8_t r:1;
+            uint8_t w:1;
+            uint8_t unused:4;
+        };
+    };
+} __attribute__ ((__packed__)) x86_rex;
+
+typedef enum x86_var_type {
+    X86_VAR_IMMEDIATE,
+    X86_VAR_OFFSET,
+    X86_VAR_REG,
+    X86_VAR_RM,
+
+    // for floating point computations
+    X87_VAR_REG,
+    X87_VAR_FLOATP,
+    X87_VAR_INTP,
+    X87_VAR_BYTEP,
+} x86_var_type;
+
+typedef struct x86_decode_op {
+    enum x86_var_type type;
+    int size;
+
+    int reg;
+    addr_t val;
+
+    addr_t ptr;
+} x86_decode_op;
+
+typedef struct x86_decode {
+    int len;
+    uint8_t opcode[4];
+    uint8_t opcode_len;
+    enum x86_decode_cmd cmd;
+    int addressing_size;
+    int operand_size;
+    int lock;
+    int rep;
+    int op_size_override;
+    int addr_size_override;
+    int segment_override;
+    int control_change_inst;
+    bool fwait;
+    bool fpop_stack;
+    bool frev;
+
+    uint32_t displacement;
+    uint8_t displacement_size;
+    struct x86_rex rex;
+    bool is_modrm;
+    bool sib_present;
+    struct x86_sib sib;
+    struct x86_modrm modrm;
+    struct x86_decode_op op[4];
+    bool is_fpu;
+    addr_t flags_mask;
+
+} x86_decode;
+
+uint64_t sign(uint64_t val, int size);
+
+uint32_t decode_instruction(CPUState *cpu, struct x86_decode *decode);
+
+addr_t get_reg_ref(CPUState *cpu, int reg, int is_extended, int size);
+addr_t get_reg_val(CPUState *cpu, int reg, int is_extended, int size);
+void calc_modrm_operand(CPUState *cpu, struct x86_decode *decode, struct x86_decode_op *op);
+addr_t decode_linear_addr(struct CPUState *cpu, struct x86_decode *decode, addr_t addr, x86_reg_segment seg);
+
+void init_decoder(CPUState* cpu);
diff --git a/target/i386/hvf-utils/x86_descr.c b/target/i386/hvf-utils/x86_descr.c
new file mode 100644
index 0000000000..c3b089aaa8
--- /dev/null
+++ b/target/i386/hvf-utils/x86_descr.c
@@ -0,0 +1,124 @@
+/*
+ * Copyright (C) 2016 Veertu Inc,
+ * Copyright (C) 2017 Google Inc,
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 or
+ * (at your option) version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+
+#include "vmx.h"
+#include "x86_descr.h"
+
+#define VMX_SEGMENT_FIELD(seg)                      \
+    [REG_SEG_##seg] = {                           \
+        .selector = VMCS_GUEST_##seg##_SELECTOR,             \
+        .base = VMCS_GUEST_##seg##_BASE,                     \
+        .limit = VMCS_GUEST_##seg##_LIMIT,                   \
+        .ar_bytes = VMCS_GUEST_##seg##_ACCESS_RIGHTS,             \
+}
+
+static const struct vmx_segment_field {
+    int selector;
+    int base;
+    int limit;
+    int ar_bytes;
+} vmx_segment_fields[] = {
+    VMX_SEGMENT_FIELD(ES),
+    VMX_SEGMENT_FIELD(CS),
+    VMX_SEGMENT_FIELD(SS),
+    VMX_SEGMENT_FIELD(DS),
+    VMX_SEGMENT_FIELD(FS),
+    VMX_SEGMENT_FIELD(GS),
+    VMX_SEGMENT_FIELD(LDTR),
+    VMX_SEGMENT_FIELD(TR),
+};
+
+uint32_t vmx_read_segment_limit(CPUState *cpu, x86_reg_segment seg)
+{
+    return (uint32_t)rvmcs(cpu->hvf_fd, vmx_segment_fields[seg].limit);
+}
+
+uint32_t vmx_read_segment_ar(CPUState *cpu, x86_reg_segment seg)
+{
+    return (uint32_t)rvmcs(cpu->hvf_fd, vmx_segment_fields[seg].ar_bytes);
+}
+
+uint64_t vmx_read_segment_base(CPUState *cpu, x86_reg_segment seg)
+{
+    return rvmcs(cpu->hvf_fd, vmx_segment_fields[seg].base);
+}
+
+x68_segment_selector vmx_read_segment_selector(CPUState *cpu, x86_reg_segment seg)
+{
+    x68_segment_selector sel;
+    sel.sel = rvmcs(cpu->hvf_fd, vmx_segment_fields[seg].selector);
+    return sel;
+}
+
+void vmx_write_segment_selector(struct CPUState *cpu, x68_segment_selector selector, x86_reg_segment seg)
+{
+    wvmcs(cpu->hvf_fd, vmx_segment_fields[seg].selector, selector.sel);
+}
+
+void vmx_read_segment_descriptor(struct CPUState *cpu, struct vmx_segment *desc, x86_reg_segment seg)
+{
+    desc->sel = rvmcs(cpu->hvf_fd, vmx_segment_fields[seg].selector);
+    desc->base = rvmcs(cpu->hvf_fd, vmx_segment_fields[seg].base);
+    desc->limit = rvmcs(cpu->hvf_fd, vmx_segment_fields[seg].limit);
+    desc->ar = rvmcs(cpu->hvf_fd, vmx_segment_fields[seg].ar_bytes);
+}
+
+void vmx_write_segment_descriptor(CPUState *cpu, struct vmx_segment *desc, x86_reg_segment seg)
+{
+    const struct vmx_segment_field *sf = &vmx_segment_fields[seg];
+
+    wvmcs(cpu->hvf_fd, sf->base, desc->base);
+    wvmcs(cpu->hvf_fd, sf->limit, desc->limit);
+    wvmcs(cpu->hvf_fd, sf->selector, desc->sel);
+    wvmcs(cpu->hvf_fd, sf->ar_bytes, desc->ar);
+}
+
+void x86_segment_descriptor_to_vmx(struct CPUState *cpu, x68_segment_selector selector, struct x86_segment_descriptor *desc, struct vmx_segment *vmx_desc)
+{
+    vmx_desc->sel = selector.sel;
+    vmx_desc->base = x86_segment_base(desc);
+    vmx_desc->limit = x86_segment_limit(desc);
+
+    vmx_desc->ar = (selector.sel ? 0 : 1) << 16 |
+                    desc->g << 15 |
+                    desc->db << 14 |
+                    desc->l << 13 |
+                    desc->avl << 12 |
+                    desc->p << 7 |
+                    desc->dpl << 5 |
+                    desc->s << 4 |
+                    desc->type;
+}
+
+void vmx_segment_to_x86_descriptor(struct CPUState *cpu, struct vmx_segment *vmx_desc, struct x86_segment_descriptor *desc)
+{
+    x86_set_segment_limit(desc, vmx_desc->limit);
+    x86_set_segment_base(desc, vmx_desc->base);
+    
+    desc->type = vmx_desc->ar & 15;
+    desc->s = (vmx_desc->ar >> 4) & 1;
+    desc->dpl = (vmx_desc->ar >> 5) & 3;
+    desc->p = (vmx_desc->ar >> 7) & 1;
+    desc->avl = (vmx_desc->ar >> 12) & 1;
+    desc->l = (vmx_desc->ar >> 13) & 1;
+    desc->db = (vmx_desc->ar >> 14) & 1;
+    desc->g = (vmx_desc->ar >> 15) & 1;
+}
+
diff --git a/target/i386/hvf-utils/x86_descr.h b/target/i386/hvf-utils/x86_descr.h
new file mode 100644
index 0000000000..78fb1bc420
--- /dev/null
+++ b/target/i386/hvf-utils/x86_descr.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2016 Veertu Inc,
+ * Copyright (C) 2017 Google Inc,
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 or
+ * (at your option) version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#pragma once
+
+#include "x86.h"
+
+typedef struct vmx_segment {
+    uint16_t sel;
+    uint64_t base;
+    uint64_t limit;
+    uint64_t ar;
+} vmx_segment;
+
+// deal with vmstate descriptors
+void vmx_read_segment_descriptor(struct CPUState *cpu, struct vmx_segment *desc, x86_reg_segment seg);
+void vmx_write_segment_descriptor(CPUState *cpu, struct vmx_segment *desc, x86_reg_segment seg);
+
+x68_segment_selector vmx_read_segment_selector(struct CPUState *cpu, x86_reg_segment seg);
+void vmx_write_segment_selector(struct CPUState *cpu, x68_segment_selector selector, x86_reg_segment seg);
+
+uint64_t vmx_read_segment_base(struct CPUState *cpu, x86_reg_segment seg);
+void vmx_write_segment_base(struct CPUState *cpu, x86_reg_segment seg, uint64_t base);
+
+void x86_segment_descriptor_to_vmx(struct CPUState *cpu, x68_segment_selector selector, struct x86_segment_descriptor *desc, struct vmx_segment *vmx_desc);
diff --git a/target/i386/hvf-utils/x86_emu.c b/target/i386/hvf-utils/x86_emu.c
new file mode 100644
index 0000000000..8b5efc76f0
--- /dev/null
+++ b/target/i386/hvf-utils/x86_emu.c
@@ -0,0 +1,1466 @@
+/*
+ * Copyright (C) 2016 Veertu Inc,
+ * Copyright (C) 2017 Google Inc,
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 or
+ * (at your option) version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+/////////////////////////////////////////////////////////////////////////
+//
+//  Copyright (C) 2001-2012  The Bochs Project
+//
+//  This library is free software; you can redistribute it and/or
+//  modify it under the terms of the GNU Lesser General Public
+//  License as published by the Free Software Foundation; either
+//  version 2 of the License, or (at your option) any later version.
+//
+//  This library is distributed in the hope that it will be useful,
+//  but WITHOUT ANY WARRANTY; without even the implied warranty of
+//  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+//  Lesser General Public License for more details.
+//
+//  You should have received a copy of the GNU Lesser General Public
+//  License along with this library; if not, write to the Free Software
+//  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA B 02110-1301 USA
+/////////////////////////////////////////////////////////////////////////
+
+#include "qemu/osdep.h"
+
+#include "qemu-common.h"
+#include "x86_decode.h"
+#include "x86.h"
+#include "x86_emu.h"
+#include "x86_mmu.h"
+#include "vmcs.h"
+#include "vmx.h"
+
+static void print_debug(struct CPUState *cpu);
+void hvf_handle_io(struct CPUState *cpu, uint16_t port, void *data, int direction, int size, uint32_t count);
+
+#define EXEC_2OP_LOGIC_CMD(cpu, decode, cmd, FLAGS_FUNC, save_res) \
+{                                                       \
+    fetch_operands(cpu, decode, 2, true, true, false);  \
+    switch (decode->operand_size) {                     \
+    case 1:                                         \
+    {                                               \
+        uint8_t v1 = (uint8_t)decode->op[0].val;    \
+        uint8_t v2 = (uint8_t)decode->op[1].val;    \
+        uint8_t diff = v1 cmd v2;                   \
+        if (save_res)                               \
+            write_val_ext(cpu, decode->op[0].ptr, diff, 1);  \
+        FLAGS_FUNC##_8(diff);                       \
+        break;                                      \
+    }                                               \
+    case 2:                                        \
+    {                                               \
+        uint16_t v1 = (uint16_t)decode->op[0].val;  \
+        uint16_t v2 = (uint16_t)decode->op[1].val;  \
+        uint16_t diff = v1 cmd v2;                  \
+        if (save_res)                               \
+            write_val_ext(cpu, decode->op[0].ptr, diff, 2); \
+        FLAGS_FUNC##_16(diff);                      \
+        break;                                      \
+    }                                               \
+    case 4:                                        \
+    {                                               \
+        uint32_t v1 = (uint32_t)decode->op[0].val;  \
+        uint32_t v2 = (uint32_t)decode->op[1].val;  \
+        uint32_t diff = v1 cmd v2;                  \
+        if (save_res)                               \
+            write_val_ext(cpu, decode->op[0].ptr, diff, 4); \
+        FLAGS_FUNC##_32(diff);                      \
+        break;                                      \
+    }                                               \
+    default:                                        \
+        VM_PANIC("bad size\n");                    \
+    }                                                   \
+}                                                       \
+
+
+#define EXEC_2OP_ARITH_CMD(cpu, decode, cmd, FLAGS_FUNC, save_res) \
+{                                                       \
+    fetch_operands(cpu, decode, 2, true, true, false);  \
+    switch (decode->operand_size) {                     \
+    case 1:                                         \
+    {                                               \
+        uint8_t v1 = (uint8_t)decode->op[0].val;    \
+        uint8_t v2 = (uint8_t)decode->op[1].val;    \
+        uint8_t diff = v1 cmd v2;                   \
+        if (save_res)                               \
+            write_val_ext(cpu, decode->op[0].ptr, diff, 1);  \
+        FLAGS_FUNC##_8(v1, v2, diff);               \
+        break;                                      \
+    }                                               \
+    case 2:                                        \
+    {                                               \
+        uint16_t v1 = (uint16_t)decode->op[0].val;  \
+        uint16_t v2 = (uint16_t)decode->op[1].val;  \
+        uint16_t diff = v1 cmd v2;                  \
+        if (save_res)                               \
+            write_val_ext(cpu, decode->op[0].ptr, diff, 2); \
+        FLAGS_FUNC##_16(v1, v2, diff);              \
+        break;                                      \
+    }                                               \
+    case 4:                                        \
+    {                                               \
+        uint32_t v1 = (uint32_t)decode->op[0].val;  \
+        uint32_t v2 = (uint32_t)decode->op[1].val;  \
+        uint32_t diff = v1 cmd v2;                  \
+        if (save_res)                               \
+            write_val_ext(cpu, decode->op[0].ptr, diff, 4); \
+        FLAGS_FUNC##_32(v1, v2, diff);              \
+        break;                                      \
+    }                                               \
+    default:                                        \
+        VM_PANIC("bad size\n");                    \
+    }                                                   \
+}
+
+addr_t read_reg(struct CPUState* cpu, int reg, int size)
+{
+    switch (size) {
+        case 1:
+            return cpu->hvf_x86->regs[reg].lx;
+        case 2:
+            return cpu->hvf_x86->regs[reg].rx;
+        case 4:
+            return cpu->hvf_x86->regs[reg].erx;
+        case 8:
+            return cpu->hvf_x86->regs[reg].rrx;
+        default:
+            VM_PANIC_ON("read_reg size");
+    }
+    return 0;
+}
+
+void write_reg(struct CPUState* cpu, int reg, addr_t val, int size)
+{
+    switch (size) {
+        case 1:
+            cpu->hvf_x86->regs[reg].lx = val;
+            break;
+        case 2:
+            cpu->hvf_x86->regs[reg].rx = val;
+            break;
+        case 4:
+            cpu->hvf_x86->regs[reg].rrx = (uint32_t)val;
+            break;
+        case 8:
+            cpu->hvf_x86->regs[reg].rrx = val;
+            break;
+        default:
+            VM_PANIC_ON("write_reg size");
+    }
+}
+
+addr_t read_val_from_reg(addr_t reg_ptr, int size)
+{
+    addr_t val;
+    
+    switch (size) {
+        case 1:
+            val = *(uint8_t*)reg_ptr;
+            break;
+        case 2:
+            val = *(uint16_t*)reg_ptr;
+            break;
+        case 4:
+            val = *(uint32_t*)reg_ptr;
+            break;
+        case 8:
+            val = *(uint64_t*)reg_ptr;
+            break;
+        default:
+            VM_PANIC_ON_EX(1, "read_val: Unknown size %d\n", size);
+            break;
+    }
+    return val;
+}
+
+void write_val_to_reg(addr_t reg_ptr, addr_t val, int size)
+{
+    switch (size) {
+        case 1:
+            *(uint8_t*)reg_ptr = val;
+            break;
+        case 2:
+            *(uint16_t*)reg_ptr = val;
+            break;
+        case 4:
+            *(uint64_t*)reg_ptr = (uint32_t)val;
+            break;
+        case 8:
+            *(uint64_t*)reg_ptr = val;
+            break;
+        default:
+            VM_PANIC("write_val: Unknown size\n");
+            break;
+    }
+}
+
+static bool is_host_reg(struct CPUState* cpu, addr_t ptr) {
+    return (ptr > (addr_t)cpu && ptr < (addr_t)cpu + sizeof(struct CPUState)) ||
+           (ptr > (addr_t)cpu->hvf_x86 && ptr < (addr_t)(cpu->hvf_x86 + sizeof(struct hvf_x86_state)));
+}
+
+void write_val_ext(struct CPUState* cpu, addr_t ptr, addr_t val, int size)
+{
+    if (is_host_reg(cpu, ptr)) {
+        write_val_to_reg(ptr, val, size);
+        return;
+    }
+    vmx_write_mem(cpu, ptr, &val, size);
+}
+
+uint8_t *read_mmio(struct CPUState* cpu, addr_t ptr, int bytes)
+{
+    vmx_read_mem(cpu, cpu->hvf_x86->mmio_buf, ptr, bytes);
+    return cpu->hvf_x86->mmio_buf;
+}
+
+addr_t read_val_ext(struct CPUState* cpu, addr_t ptr, int size)
+{
+    addr_t val;
+    uint8_t *mmio_ptr;
+    
+    if (is_host_reg(cpu, ptr)) {
+        return read_val_from_reg(ptr, size);
+    }
+    
+    mmio_ptr = read_mmio(cpu, ptr, size);
+    switch (size) {
+        case 1:
+            val = *(uint8_t*)mmio_ptr;
+            break;
+        case 2:
+            val = *(uint16_t*)mmio_ptr;
+            break;
+        case 4:
+            val = *(uint32_t*)mmio_ptr;
+            break;
+        case 8:
+            val = *(uint64_t*)mmio_ptr;
+            break;
+        default:
+            VM_PANIC("bad size\n");
+            break;
+    }
+    return val;
+}
+
+static void fetch_operands(struct CPUState *cpu, struct x86_decode *decode, int n, bool val_op0, bool val_op1, bool val_op2)
+{
+    int i;
+    bool calc_val[3] = {val_op0, val_op1, val_op2};
+
+    for (i = 0; i < n; i++) {
+        switch (decode->op[i].type) {
+            case X86_VAR_IMMEDIATE:
+                break;
+            case X86_VAR_REG:
+                VM_PANIC_ON(!decode->op[i].ptr);
+                if (calc_val[i])
+                    decode->op[i].val = read_val_from_reg(decode->op[i].ptr, decode->operand_size);
+                break;
+            case X86_VAR_RM:
+                calc_modrm_operand(cpu, decode, &decode->op[i]);
+                if (calc_val[i])
+                    decode->op[i].val = read_val_ext(cpu, decode->op[i].ptr, decode->operand_size);
+                break;
+            case X86_VAR_OFFSET:
+                decode->op[i].ptr = decode_linear_addr(cpu, decode, decode->op[i].ptr, REG_SEG_DS);
+                if (calc_val[i])
+                    decode->op[i].val = read_val_ext(cpu, decode->op[i].ptr, decode->operand_size);
+                break;
+            default:
+                break;
+        }
+    }
+}
+
+static void exec_mov(struct CPUState *cpu, struct x86_decode *decode)
+{
+    fetch_operands(cpu, decode, 2, false, true, false);
+    write_val_ext(cpu, decode->op[0].ptr, decode->op[1].val, decode->operand_size);
+
+    RIP(cpu) += decode->len;
+}
+
+static void exec_add(struct CPUState *cpu, struct x86_decode *decode)
+{
+    EXEC_2OP_ARITH_CMD(cpu, decode, +, SET_FLAGS_OSZAPC_ADD, true);
+    RIP(cpu) += decode->len;
+}
+
+static void exec_or(struct CPUState *cpu, struct x86_decode *decode)
+{
+    EXEC_2OP_LOGIC_CMD(cpu, decode, |, SET_FLAGS_OSZAPC_LOGIC, true);
+    RIP(cpu) += decode->len;
+}
+
+static void exec_adc(struct CPUState *cpu, struct x86_decode *decode)
+{
+    EXEC_2OP_ARITH_CMD(cpu, decode, +get_CF(cpu)+, SET_FLAGS_OSZAPC_ADD, true);
+    RIP(cpu) += decode->len;
+}
+
+static void exec_sbb(struct CPUState *cpu, struct x86_decode *decode)
+{
+    EXEC_2OP_ARITH_CMD(cpu, decode, -get_CF(cpu)-, SET_FLAGS_OSZAPC_SUB, true);
+    RIP(cpu) += decode->len;
+}
+
+static void exec_and(struct CPUState *cpu, struct x86_decode *decode)
+{
+    EXEC_2OP_LOGIC_CMD(cpu, decode, &, SET_FLAGS_OSZAPC_LOGIC, true);
+    RIP(cpu) += decode->len;
+}
+
+static void exec_sub(struct CPUState *cpu, struct x86_decode *decode)
+{
+    EXEC_2OP_ARITH_CMD(cpu, decode, -, SET_FLAGS_OSZAPC_SUB, true);
+    RIP(cpu) += decode->len;
+}
+
+static void exec_xor(struct CPUState *cpu, struct x86_decode *decode)
+{
+    EXEC_2OP_LOGIC_CMD(cpu, decode, ^, SET_FLAGS_OSZAPC_LOGIC, true);
+    RIP(cpu) += decode->len;
+}
+
+static void exec_neg(struct CPUState *cpu, struct x86_decode *decode)
+{
+    //EXEC_2OP_ARITH_CMD(cpu, decode, -, SET_FLAGS_OSZAPC_SUB, false);
+    int32_t val;
+    fetch_operands(cpu, decode, 2, true, true, false);
+
+    val = 0 - sign(decode->op[1].val, decode->operand_size);
+    write_val_ext(cpu, decode->op[1].ptr, val, decode->operand_size);
+
+    if (4 == decode->operand_size) {
+        SET_FLAGS_OSZAPC_SUB_32(0, 0 - val, val);
+    }
+    else if (2 == decode->operand_size) {
+        SET_FLAGS_OSZAPC_SUB_16(0, 0 - val, val);
+    }
+    else if (1 == decode->operand_size) {
+        SET_FLAGS_OSZAPC_SUB_8(0, 0 - val, val);
+    } else {
+        VM_PANIC("bad op size\n");
+    }
+
+    //lflags_to_rflags(cpu);
+    RIP(cpu) += decode->len;
+}
+
+static void exec_cmp(struct CPUState *cpu, struct x86_decode *decode)
+{
+    EXEC_2OP_ARITH_CMD(cpu, decode, -, SET_FLAGS_OSZAPC_SUB, false);
+    RIP(cpu) += decode->len;
+}
+
+static void exec_inc(struct CPUState *cpu, struct x86_decode *decode)
+{
+    decode->op[1].type = X86_VAR_IMMEDIATE;
+    decode->op[1].val = 0;
+
+    EXEC_2OP_ARITH_CMD(cpu, decode, +1+, SET_FLAGS_OSZAP_ADD, true);
+
+    RIP(cpu) += decode->len;
+}
+
+static void exec_dec(struct CPUState *cpu, struct x86_decode *decode)
+{
+    decode->op[1].type = X86_VAR_IMMEDIATE;
+    decode->op[1].val = 0;
+
+    EXEC_2OP_ARITH_CMD(cpu, decode, -1-, SET_FLAGS_OSZAP_SUB, true);
+    RIP(cpu) += decode->len;
+}
+
+static void exec_tst(struct CPUState *cpu, struct x86_decode *decode)
+{
+    EXEC_2OP_LOGIC_CMD(cpu, decode, &, SET_FLAGS_OSZAPC_LOGIC, false);
+    RIP(cpu) += decode->len;
+}
+
+static void exec_not(struct CPUState *cpu, struct x86_decode *decode)
+{
+    fetch_operands(cpu, decode, 1, true, false, false);
+
+    write_val_ext(cpu, decode->op[0].ptr, ~decode->op[0].val, decode->operand_size);
+    RIP(cpu) += decode->len;
+}
+
+void exec_movzx(struct CPUState *cpu, struct x86_decode *decode)
+{
+    int src_op_size;
+    int op_size = decode->operand_size;
+
+    fetch_operands(cpu, decode, 1, false, false, false);
+
+    if (0xb6 == decode->opcode[1])
+        src_op_size = 1;
+    else
+        src_op_size = 2;
+    decode->operand_size = src_op_size;
+    calc_modrm_operand(cpu, decode, &decode->op[1]);
+    decode->op[1].val = read_val_ext(cpu, decode->op[1].ptr, src_op_size);
+    write_val_ext(cpu, decode->op[0].ptr, decode->op[1].val, op_size);
+
+    RIP(cpu) += decode->len;
+}
+
+static void exec_out(struct CPUState *cpu, struct x86_decode *decode)
+{
+    switch (decode->opcode[0]) {
+        case 0xe6:
+            hvf_handle_io(cpu, decode->op[0].val, &AL(cpu), 1, 1, 1);
+            break;
+        case 0xe7:
+            hvf_handle_io(cpu, decode->op[0].val, &RAX(cpu), 1, decode->operand_size, 1);
+            break;
+        case 0xee:
+            hvf_handle_io(cpu, DX(cpu), &AL(cpu), 1, 1, 1);
+            break;
+        case 0xef:
+            hvf_handle_io(cpu, DX(cpu), &RAX(cpu), 1, decode->operand_size, 1);
+            break;
+        default:
+            VM_PANIC("Bad out opcode\n");
+            break;
+    }
+    RIP(cpu) += decode->len;
+}
+
+static void exec_in(struct CPUState *cpu, struct x86_decode *decode)
+{
+    addr_t val = 0;
+    switch (decode->opcode[0]) {
+        case 0xe4:
+            hvf_handle_io(cpu, decode->op[0].val, &AL(cpu), 0, 1, 1);
+            break;
+        case 0xe5:
+            hvf_handle_io(cpu, decode->op[0].val, &val, 0, decode->operand_size, 1);
+            if (decode->operand_size == 2)
+                AX(cpu) = val;
+            else
+                RAX(cpu) = (uint32_t)val;
+            break;
+        case 0xec:
+            hvf_handle_io(cpu, DX(cpu), &AL(cpu), 0, 1, 1);
+            break;
+        case 0xed:
+            hvf_handle_io(cpu, DX(cpu), &val, 0, decode->operand_size, 1);
+            if (decode->operand_size == 2)
+                AX(cpu) = val;
+            else
+                RAX(cpu) = (uint32_t)val;
+
+            break;
+        default:
+            VM_PANIC("Bad in opcode\n");
+            break;
+    }
+
+    RIP(cpu) += decode->len;
+}
+
+static inline void string_increment_reg(struct CPUState * cpu, int reg, struct x86_decode *decode)
+{
+    addr_t val = read_reg(cpu, reg, decode->addressing_size);
+    if (cpu->hvf_x86->rflags.df)
+        val -= decode->operand_size;
+    else
+        val += decode->operand_size;
+    write_reg(cpu, reg, val, decode->addressing_size);
+}
+
+static inline void string_rep(struct CPUState * cpu, struct x86_decode *decode, void (*func)(struct CPUState *cpu, struct x86_decode *ins), int rep)
+{
+    addr_t rcx = read_reg(cpu, REG_RCX, decode->addressing_size);
+    while (rcx--) {
+        func(cpu, decode);
+        write_reg(cpu, REG_RCX, rcx, decode->addressing_size);
+        if ((PREFIX_REP == rep) && !get_ZF(cpu))
+            break;
+        if ((PREFIX_REPN == rep) && get_ZF(cpu))
+            break;
+    }
+}
+
+static void exec_ins_single(struct CPUState *cpu, struct x86_decode *decode)
+{
+    addr_t addr = linear_addr_size(cpu, RDI(cpu), decode->addressing_size, REG_SEG_ES);
+
+    hvf_handle_io(cpu, DX(cpu), cpu->hvf_x86->mmio_buf, 0, decode->operand_size, 1);
+    vmx_write_mem(cpu, addr, cpu->hvf_x86->mmio_buf, decode->operand_size);
+
+    string_increment_reg(cpu, REG_RDI, decode);
+}
+
+static void exec_ins(struct CPUState *cpu, struct x86_decode *decode)
+{
+    if (decode->rep)
+        string_rep(cpu, decode, exec_ins_single, 0);
+    else
+        exec_ins_single(cpu, decode);
+
+    RIP(cpu) += decode->len;
+}
+
+static void exec_outs_single(struct CPUState *cpu, struct x86_decode *decode)
+{
+    addr_t addr = decode_linear_addr(cpu, decode, RSI(cpu), REG_SEG_DS);
+
+    vmx_read_mem(cpu, cpu->hvf_x86->mmio_buf, addr, decode->operand_size);
+    hvf_handle_io(cpu, DX(cpu), cpu->hvf_x86->mmio_buf, 1, decode->operand_size, 1);
+
+    string_increment_reg(cpu, REG_RSI, decode);
+}
+
+static void exec_outs(struct CPUState *cpu, struct x86_decode *decode)
+{
+    if (decode->rep)
+        string_rep(cpu, decode, exec_outs_single, 0);
+    else
+        exec_outs_single(cpu, decode);
+    
+    RIP(cpu) += decode->len;
+}
+
+static void exec_movs_single(struct CPUState *cpu, struct x86_decode *decode)
+{
+    addr_t src_addr;
+    addr_t dst_addr;
+    addr_t val;
+    
+    src_addr = decode_linear_addr(cpu, decode, RSI(cpu), REG_SEG_DS);
+    dst_addr = linear_addr_size(cpu, RDI(cpu), decode->addressing_size, REG_SEG_ES);
+    
+    val = read_val_ext(cpu, src_addr, decode->operand_size);
+    write_val_ext(cpu, dst_addr, val, decode->operand_size);
+
+    string_increment_reg(cpu, REG_RSI, decode);
+    string_increment_reg(cpu, REG_RDI, decode);
+}
+
+static void exec_movs(struct CPUState *cpu, struct x86_decode *decode)
+{
+    if (decode->rep) {
+        string_rep(cpu, decode, exec_movs_single, 0);
+    }
+    else
+        exec_movs_single(cpu, decode);
+
+    RIP(cpu) += decode->len;
+}
+
+static void exec_cmps_single(struct CPUState *cpu, struct x86_decode *decode)
+{
+    addr_t src_addr;
+    addr_t dst_addr;
+
+    src_addr = decode_linear_addr(cpu, decode, RSI(cpu), REG_SEG_DS);
+    dst_addr = linear_addr_size(cpu, RDI(cpu), decode->addressing_size, REG_SEG_ES);
+
+    decode->op[0].type = X86_VAR_IMMEDIATE;
+    decode->op[0].val = read_val_ext(cpu, src_addr, decode->operand_size);
+    decode->op[1].type = X86_VAR_IMMEDIATE;
+    decode->op[1].val = read_val_ext(cpu, dst_addr, decode->operand_size);
+
+    EXEC_2OP_ARITH_CMD(cpu, decode, -, SET_FLAGS_OSZAPC_SUB, false);
+
+    string_increment_reg(cpu, REG_RSI, decode);
+    string_increment_reg(cpu, REG_RDI, decode);
+}
+
+static void exec_cmps(struct CPUState *cpu, struct x86_decode *decode)
+{
+    if (decode->rep) {
+        string_rep(cpu, decode, exec_cmps_single, decode->rep);
+    }
+    else
+        exec_cmps_single(cpu, decode);
+    RIP(cpu) += decode->len;
+}
+
+
+static void exec_stos_single(struct CPUState *cpu, struct x86_decode *decode)
+{
+    addr_t addr;
+    addr_t val;
+
+    addr = linear_addr_size(cpu, RDI(cpu), decode->addressing_size, REG_SEG_ES);
+    val = read_reg(cpu, REG_RAX, decode->operand_size);
+    vmx_write_mem(cpu, addr, &val, decode->operand_size);
+
+    string_increment_reg(cpu, REG_RDI, decode);
+}
+
+
+static void exec_stos(struct CPUState *cpu, struct x86_decode *decode)
+{
+    if (decode->rep) {
+        string_rep(cpu, decode, exec_stos_single, 0);
+    }
+    else
+        exec_stos_single(cpu, decode);
+
+    RIP(cpu) += decode->len;
+}
+
+static void exec_scas_single(struct CPUState *cpu, struct x86_decode *decode)
+{
+    addr_t addr;
+    
+    addr = linear_addr_size(cpu, RDI(cpu), decode->addressing_size, REG_SEG_ES);
+    decode->op[1].type = X86_VAR_IMMEDIATE;
+    vmx_read_mem(cpu, &decode->op[1].val, addr, decode->operand_size);
+
+    EXEC_2OP_ARITH_CMD(cpu, decode, -, SET_FLAGS_OSZAPC_SUB, false);
+    string_increment_reg(cpu, REG_RDI, decode);
+}
+
+static void exec_scas(struct CPUState *cpu, struct x86_decode *decode)
+{
+    decode->op[0].type = X86_VAR_REG;
+    decode->op[0].reg = REG_RAX;
+    if (decode->rep) {
+        string_rep(cpu, decode, exec_scas_single, decode->rep);
+    }
+    else
+        exec_scas_single(cpu, decode);
+
+    RIP(cpu) += decode->len;
+}
+
+static void exec_lods_single(struct CPUState *cpu, struct x86_decode *decode)
+{
+    addr_t addr;
+    addr_t val = 0;
+    
+    addr = decode_linear_addr(cpu, decode, RSI(cpu), REG_SEG_DS);
+    vmx_read_mem(cpu, &val, addr,  decode->operand_size);
+    write_reg(cpu, REG_RAX, val, decode->operand_size);
+
+    string_increment_reg(cpu, REG_RSI, decode);
+}
+
+static void exec_lods(struct CPUState *cpu, struct x86_decode *decode)
+{
+    if (decode->rep) {
+        string_rep(cpu, decode, exec_lods_single, 0);
+    }
+    else
+        exec_lods_single(cpu, decode);
+
+    RIP(cpu) += decode->len;
+}
+
+#define MSR_IA32_UCODE_REV 		0x00000017
+
+void simulate_rdmsr(struct CPUState *cpu)
+{
+    X86CPU *x86_cpu = X86_CPU(cpu);
+    CPUX86State *env = &x86_cpu->env;
+    uint32_t msr = ECX(cpu);
+    uint64_t val = 0;
+
+    switch (msr) {
+        case MSR_IA32_TSC:
+            val = rdtscp() + rvmcs(cpu->hvf_fd, VMCS_TSC_OFFSET);
+            break;
+        case MSR_IA32_APICBASE:
+            val = cpu_get_apic_base(X86_CPU(cpu)->apic_state);
+            break;
+        case MSR_IA32_UCODE_REV:
+            val = (0x100000000ULL << 32) | 0x100000000ULL;
+            break;
+        case MSR_EFER:
+            val = rvmcs(cpu->hvf_fd, VMCS_GUEST_IA32_EFER);
+            break;
+        case MSR_FSBASE:
+            val = rvmcs(cpu->hvf_fd, VMCS_GUEST_FS_BASE);
+            break;
+        case MSR_GSBASE:
+            val = rvmcs(cpu->hvf_fd, VMCS_GUEST_GS_BASE);
+            break;
+        case MSR_KERNELGSBASE:
+            val = rvmcs(cpu->hvf_fd, VMCS_HOST_FS_BASE);
+            break;
+        case MSR_STAR:
+            abort();
+            break;
+        case MSR_LSTAR:
+            abort();
+            break;
+        case MSR_CSTAR:
+            abort();
+            break;
+        case MSR_IA32_MISC_ENABLE:
+            val = env->msr_ia32_misc_enable;
+            break;
+        case MSR_MTRRphysBase(0):
+        case MSR_MTRRphysBase(1):
+        case MSR_MTRRphysBase(2):
+        case MSR_MTRRphysBase(3):
+        case MSR_MTRRphysBase(4):
+        case MSR_MTRRphysBase(5):
+        case MSR_MTRRphysBase(6):
+        case MSR_MTRRphysBase(7):
+            val = env->mtrr_var[(ECX(cpu) - MSR_MTRRphysBase(0)) / 2].base;
+            break;
+        case MSR_MTRRphysMask(0):
+        case MSR_MTRRphysMask(1):
+        case MSR_MTRRphysMask(2):
+        case MSR_MTRRphysMask(3):
+        case MSR_MTRRphysMask(4):
+        case MSR_MTRRphysMask(5):
+        case MSR_MTRRphysMask(6):
+        case MSR_MTRRphysMask(7):
+            val = env->mtrr_var[(ECX(cpu) - MSR_MTRRphysMask(0)) / 2].mask;
+            break;
+        case MSR_MTRRfix64K_00000:
+            val = env->mtrr_fixed[0];
+            break;
+        case MSR_MTRRfix16K_80000:
+        case MSR_MTRRfix16K_A0000:
+            val = env->mtrr_fixed[ECX(cpu) - MSR_MTRRfix16K_80000 + 1];
+            break;
+        case MSR_MTRRfix4K_C0000:
+        case MSR_MTRRfix4K_C8000:
+        case MSR_MTRRfix4K_D0000:
+        case MSR_MTRRfix4K_D8000:
+        case MSR_MTRRfix4K_E0000:
+        case MSR_MTRRfix4K_E8000:
+        case MSR_MTRRfix4K_F0000:
+        case MSR_MTRRfix4K_F8000:
+            val = env->mtrr_fixed[ECX(cpu) - MSR_MTRRfix4K_C0000 + 3];
+            break;
+        case MSR_MTRRdefType:
+            val = env->mtrr_deftype;
+            break;
+        default:
+            // fprintf(stderr, "%s: unknown msr 0x%x\n", __func__, msr);
+            val = 0;
+            break;
+    }
+
+    RAX(cpu) = (uint32_t)val;
+    RDX(cpu) = (uint32_t)(val >> 32);
+}
+
+static void exec_rdmsr(struct CPUState *cpu, struct x86_decode *decode)
+{
+    simulate_rdmsr(cpu);
+    RIP(cpu) += decode->len;
+}
+
+void simulate_wrmsr(struct CPUState *cpu)
+{
+    X86CPU *x86_cpu = X86_CPU(cpu);
+    CPUX86State *env = &x86_cpu->env;
+    uint32_t msr = ECX(cpu);
+    uint64_t data = ((uint64_t)EDX(cpu) << 32) | EAX(cpu);
+
+    switch (msr) {
+        case MSR_IA32_TSC:
+            // if (!osx_is_sierra())
+            //     wvmcs(cpu->hvf_fd, VMCS_TSC_OFFSET, data - rdtscp());
+            //hv_vm_sync_tsc(data);
+            break;
+        case MSR_IA32_APICBASE:
+            cpu_set_apic_base(X86_CPU(cpu)->apic_state, data);
+            break;
+        case MSR_FSBASE:
+            wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_BASE, data);
+            break;
+        case MSR_GSBASE:
+            wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_BASE, data);
+            break;
+        case MSR_KERNELGSBASE:
+            wvmcs(cpu->hvf_fd, VMCS_HOST_FS_BASE, data);
+            break;
+        case MSR_STAR:
+            abort();
+            break;
+        case MSR_LSTAR:
+            abort();
+            break;
+        case MSR_CSTAR:
+            abort();
+            break;
+        case MSR_EFER:
+            cpu->hvf_x86->efer.efer = data;
+            //printf("new efer %llx\n", EFER(cpu));
+            wvmcs(cpu->hvf_fd, VMCS_GUEST_IA32_EFER, data);
+            if (data & EFER_NXE)
+                hv_vcpu_invalidate_tlb(cpu->hvf_fd);
+            break;
+        case MSR_MTRRphysBase(0):
+        case MSR_MTRRphysBase(1):
+        case MSR_MTRRphysBase(2):
+        case MSR_MTRRphysBase(3):
+        case MSR_MTRRphysBase(4):
+        case MSR_MTRRphysBase(5):
+        case MSR_MTRRphysBase(6):
+        case MSR_MTRRphysBase(7):
+            env->mtrr_var[(ECX(cpu) - MSR_MTRRphysBase(0)) / 2].base = data;
+            break;
+        case MSR_MTRRphysMask(0):
+        case MSR_MTRRphysMask(1):
+        case MSR_MTRRphysMask(2):
+        case MSR_MTRRphysMask(3):
+        case MSR_MTRRphysMask(4):
+        case MSR_MTRRphysMask(5):
+        case MSR_MTRRphysMask(6):
+        case MSR_MTRRphysMask(7):
+            env->mtrr_var[(ECX(cpu) - MSR_MTRRphysMask(0)) / 2].mask = data;
+            break;
+        case MSR_MTRRfix64K_00000:
+            env->mtrr_fixed[ECX(cpu) - MSR_MTRRfix64K_00000] = data;
+            break;
+        case MSR_MTRRfix16K_80000:
+        case MSR_MTRRfix16K_A0000:
+            env->mtrr_fixed[ECX(cpu) - MSR_MTRRfix16K_80000 + 1] = data;
+            break;
+        case MSR_MTRRfix4K_C0000:
+        case MSR_MTRRfix4K_C8000:
+        case MSR_MTRRfix4K_D0000:
+        case MSR_MTRRfix4K_D8000:
+        case MSR_MTRRfix4K_E0000:
+        case MSR_MTRRfix4K_E8000:
+        case MSR_MTRRfix4K_F0000:
+        case MSR_MTRRfix4K_F8000:
+            env->mtrr_fixed[ECX(cpu) - MSR_MTRRfix4K_C0000 + 3] = data;
+            break;
+        case MSR_MTRRdefType:
+            env->mtrr_deftype = data;
+            break;
+        default:
+            break;
+    }
+
+    /* Related to support known hypervisor interface */
+    // if (g_hypervisor_iface)
+    //     g_hypervisor_iface->wrmsr_handler(cpu, msr, data);
+
+    //printf("write msr %llx\n", RCX(cpu));
+}
+
+static void exec_wrmsr(struct CPUState *cpu, struct x86_decode *decode)
+{
+    simulate_wrmsr(cpu);
+    RIP(cpu) += decode->len;
+}
+
+/*
+ * flag:
+ * 0 - bt, 1 - btc, 2 - bts, 3 - btr
+ */
+static void do_bt(struct CPUState *cpu, struct x86_decode *decode, int flag)
+{
+    int32_t displacement;
+    uint8_t index;
+    bool cf;
+    int mask = (4 == decode->operand_size) ? 0x1f : 0xf;
+
+    VM_PANIC_ON(decode->rex.rex);
+
+    fetch_operands(cpu, decode, 2, false, true, false);
+    index = decode->op[1].val & mask;
+
+    if (decode->op[0].type != X86_VAR_REG) {
+        if (4 == decode->operand_size) {
+            displacement = ((int32_t) (decode->op[1].val & 0xffffffe0)) / 32;
+            decode->op[0].ptr += 4 * displacement;
+        } else if (2 == decode->operand_size) {
+            displacement = ((int16_t) (decode->op[1].val & 0xfff0)) / 16;
+            decode->op[0].ptr += 2 * displacement;
+        } else {
+            VM_PANIC("bt 64bit\n");
+        }
+    }
+    decode->op[0].val = read_val_ext(cpu, decode->op[0].ptr, decode->operand_size);
+    cf = (decode->op[0].val >> index) & 0x01;
+
+    switch (flag) {
+        case 0:
+            set_CF(cpu, cf);
+            return;
+        case 1:
+            decode->op[0].val ^= (1u << index);
+            break;
+        case 2:
+            decode->op[0].val |= (1u << index);
+            break;
+        case 3:
+            decode->op[0].val &= ~(1u << index);
+            break;
+    }
+    write_val_ext(cpu, decode->op[0].ptr, decode->op[0].val, decode->operand_size);
+    set_CF(cpu, cf);
+}
+
+static void exec_bt(struct CPUState *cpu, struct x86_decode *decode)
+{
+    do_bt(cpu, decode, 0);
+    RIP(cpu) += decode->len;
+}
+
+static void exec_btc(struct CPUState *cpu, struct x86_decode *decode)
+{
+    do_bt(cpu, decode, 1);
+    RIP(cpu) += decode->len;
+}
+
+static void exec_btr(struct CPUState *cpu, struct x86_decode *decode)
+{
+    do_bt(cpu, decode, 3);
+    RIP(cpu) += decode->len;
+}
+
+static void exec_bts(struct CPUState *cpu, struct x86_decode *decode)
+{
+    do_bt(cpu, decode, 2);
+    RIP(cpu) += decode->len;
+}
+
+void exec_shl(struct CPUState *cpu, struct x86_decode *decode)
+{
+    uint8_t count;
+    int of = 0, cf = 0;
+
+    fetch_operands(cpu, decode, 2, true, true, false);
+
+    count = decode->op[1].val;
+    count &= 0x1f;      // count is masked to 5 bits
+    if (!count)
+        goto exit;
+
+    switch (decode->operand_size) {
+        case 1:
+        {
+            uint8_t res = 0;
+            if (count <= 8) {
+                res = (decode->op[0].val << count);
+                cf = (decode->op[0].val >> (8 - count)) & 0x1;
+                of = cf ^ (res >> 7);
+            }
+
+            write_val_ext(cpu, decode->op[0].ptr, res, 1);
+            SET_FLAGS_OSZAPC_LOGIC_8(res);
+            SET_FLAGS_OxxxxC(cpu, of, cf);
+            break;
+        }
+        case 2:
+        {
+            uint16_t res = 0;
+
+            /* from bochs */
+            if (count <= 16) {
+                res = (decode->op[0].val << count);
+                cf = (decode->op[0].val >> (16 - count)) & 0x1;
+                of = cf ^ (res >> 15); // of = cf ^ result15
+            }
+
+            write_val_ext(cpu, decode->op[0].ptr, res, 2);
+            SET_FLAGS_OSZAPC_LOGIC_16(res);
+            SET_FLAGS_OxxxxC(cpu, of, cf);
+            break;
+        }
+        case 4:
+        {
+            uint32_t res = decode->op[0].val << count;
+            
+            write_val_ext(cpu, decode->op[0].ptr, res, 4);
+            SET_FLAGS_OSZAPC_LOGIC_32(res);
+            cf = (decode->op[0].val >> (32 - count)) & 0x1;
+            of = cf ^ (res >> 31); // of = cf ^ result31
+            SET_FLAGS_OxxxxC(cpu, of, cf);
+            break;
+        }
+        default:
+            abort();
+    }
+
+exit:
+    //lflags_to_rflags(cpu);
+    RIP(cpu) += decode->len;
+}
+
+void exec_movsx(struct CPUState *cpu, struct x86_decode *decode)
+{
+    int src_op_size;
+    int op_size = decode->operand_size;
+
+    fetch_operands(cpu, decode, 2, false, false, false);
+
+    if (0xbe == decode->opcode[1])
+        src_op_size = 1;
+    else
+        src_op_size = 2;
+
+    decode->operand_size = src_op_size;
+    calc_modrm_operand(cpu, decode, &decode->op[1]);
+    decode->op[1].val = sign(read_val_ext(cpu, decode->op[1].ptr, src_op_size), src_op_size);
+
+    write_val_ext(cpu, decode->op[0].ptr, decode->op[1].val, op_size);
+
+    RIP(cpu) += decode->len;
+}
+
+void exec_ror(struct CPUState *cpu, struct x86_decode *decode)
+{
+    uint8_t count;
+
+    fetch_operands(cpu, decode, 2, true, true, false);
+    count = decode->op[1].val;
+
+    switch (decode->operand_size) {
+        case 1:
+        {
+            uint32_t bit6, bit7;
+            uint8_t res;
+
+            if ((count & 0x07) == 0) {
+                if (count & 0x18) {
+                    bit6 = ((uint8_t)decode->op[0].val >> 6) & 1;
+                    bit7 = ((uint8_t)decode->op[0].val >> 7) & 1;
+                    SET_FLAGS_OxxxxC(cpu, bit6 ^ bit7, bit7);
+                 }
+            } else {
+                count &= 0x7; /* use only bottom 3 bits */
+                res = ((uint8_t)decode->op[0].val >> count) | ((uint8_t)decode->op[0].val << (8 - count));
+                write_val_ext(cpu, decode->op[0].ptr, res, 1);
+                bit6 = (res >> 6) & 1;
+                bit7 = (res >> 7) & 1;
+                /* set eflags: ROR count affects the following flags: C, O */
+                SET_FLAGS_OxxxxC(cpu, bit6 ^ bit7, bit7);
+            }
+            break;
+        }
+        case 2:
+        {
+            uint32_t bit14, bit15;
+            uint16_t res;
+
+            if ((count & 0x0f) == 0) {
+                if (count & 0x10) {
+                    bit14 = ((uint16_t)decode->op[0].val >> 14) & 1;
+                    bit15 = ((uint16_t)decode->op[0].val >> 15) & 1;
+                    // of = result14 ^ result15
+                    SET_FLAGS_OxxxxC(cpu, bit14 ^ bit15, bit15);
+                }
+            } else {
+                count &= 0x0f;  // use only 4 LSB's
+                res = ((uint16_t)decode->op[0].val >> count) | ((uint16_t)decode->op[0].val << (16 - count));
+                write_val_ext(cpu, decode->op[0].ptr, res, 2);
+
+                bit14 = (res >> 14) & 1;
+                bit15 = (res >> 15) & 1;
+                // of = result14 ^ result15
+                SET_FLAGS_OxxxxC(cpu, bit14 ^ bit15, bit15);
+            }
+            break;
+        }
+        case 4:
+        {
+            uint32_t bit31, bit30;
+            uint32_t res;
+
+            count &= 0x1f;
+            if (count) {
+                res = ((uint32_t)decode->op[0].val >> count) | ((uint32_t)decode->op[0].val << (32 - count));
+                write_val_ext(cpu, decode->op[0].ptr, res, 4);
+
+                bit31 = (res >> 31) & 1;
+                bit30 = (res >> 30) & 1;
+                // of = result30 ^ result31
+                SET_FLAGS_OxxxxC(cpu, bit30 ^ bit31, bit31);
+            }
+            break;
+        }
+    }
+    RIP(cpu) += decode->len;
+}
+
+void exec_rol(struct CPUState *cpu, struct x86_decode *decode)
+{
+    uint8_t count;
+
+    fetch_operands(cpu, decode, 2, true, true, false);
+    count = decode->op[1].val;
+
+    switch (decode->operand_size) {
+        case 1:
+        {
+            uint32_t bit0, bit7;
+            uint8_t res;
+
+            if ((count & 0x07) == 0) {
+                if (count & 0x18) {
+                    bit0 = ((uint8_t)decode->op[0].val & 1);
+                    bit7 = ((uint8_t)decode->op[0].val >> 7);
+                    SET_FLAGS_OxxxxC(cpu, bit0 ^ bit7, bit0);
+                }
+            }  else {
+                count &= 0x7; // use only lowest 3 bits
+                res = ((uint8_t)decode->op[0].val << count) | ((uint8_t)decode->op[0].val >> (8 - count));
+
+                write_val_ext(cpu, decode->op[0].ptr, res, 1);
+                /* set eflags:
+                 * ROL count affects the following flags: C, O
+                 */
+                bit0 = (res &  1);
+                bit7 = (res >> 7);
+                SET_FLAGS_OxxxxC(cpu, bit0 ^ bit7, bit0);
+            }
+            break;
+        }
+        case 2:
+        {
+            uint32_t bit0, bit15;
+            uint16_t res;
+
+            if ((count & 0x0f) == 0) {
+                if (count & 0x10) {
+                    bit0  = ((uint16_t)decode->op[0].val & 0x1);
+                    bit15 = ((uint16_t)decode->op[0].val >> 15);
+                    // of = cf ^ result15
+                    SET_FLAGS_OxxxxC(cpu, bit0 ^ bit15, bit0);
+                }
+            } else {
+                count &= 0x0f; // only use bottom 4 bits
+                res = ((uint16_t)decode->op[0].val << count) | ((uint16_t)decode->op[0].val >> (16 - count));
+
+                write_val_ext(cpu, decode->op[0].ptr, res, 2);
+                bit0  = (res & 0x1);
+                bit15 = (res >> 15);
+                // of = cf ^ result15
+                SET_FLAGS_OxxxxC(cpu, bit0 ^ bit15, bit0);
+            }
+            break;
+        }
+        case 4:
+        {
+            uint32_t bit0, bit31;
+            uint32_t res;
+
+            count &= 0x1f;
+            if (count) {
+                res = ((uint32_t)decode->op[0].val << count) | ((uint32_t)decode->op[0].val >> (32 - count));
+
+                write_val_ext(cpu, decode->op[0].ptr, res, 4);
+                bit0  = (res & 0x1);
+                bit31 = (res >> 31);
+                // of = cf ^ result31
+                SET_FLAGS_OxxxxC(cpu, bit0 ^ bit31, bit0);
+            }
+            break;
+        }
+    }
+    RIP(cpu) += decode->len;
+}
+
+
+void exec_rcl(struct CPUState *cpu, struct x86_decode *decode)
+{
+    uint8_t count;
+    int of = 0, cf = 0;
+
+    fetch_operands(cpu, decode, 2, true, true, false);
+    count = decode->op[1].val & 0x1f;
+
+    switch(decode->operand_size) {
+        case 1:
+        {
+            uint8_t op1_8 = decode->op[0].val;
+            uint8_t res;
+            count %= 9;
+            if (!count)
+                break;
+
+            if (1 == count)
+                res = (op1_8 << 1) | get_CF(cpu);
+            else
+                res = (op1_8 << count) | (get_CF(cpu) << (count - 1)) | (op1_8 >> (9 - count));
+
+            write_val_ext(cpu, decode->op[0].ptr, res, 1);
+
+            cf = (op1_8 >> (8 - count)) & 0x01;
+            of = cf ^ (res >> 7); // of = cf ^ result7
+            SET_FLAGS_OxxxxC(cpu, of, cf);
+            break;
+        }
+        case 2:
+        {
+            uint16_t res;
+            uint16_t op1_16 = decode->op[0].val;
+
+            count %= 17;
+            if (!count)
+                break;
+
+            if (1 == count)
+                res = (op1_16 << 1) | get_CF(cpu);
+            else if (count == 16)
+                res = (get_CF(cpu) << 15) | (op1_16 >> 1);
+            else  // 2..15
+                res = (op1_16 << count) | (get_CF(cpu) << (count - 1)) | (op1_16 >> (17 - count));
+            
+            write_val_ext(cpu, decode->op[0].ptr, res, 2);
+            
+            cf = (op1_16 >> (16 - count)) & 0x1;
+            of = cf ^ (res >> 15); // of = cf ^ result15
+            SET_FLAGS_OxxxxC(cpu, of, cf);
+            break;
+        }
+        case 4:
+        {
+            uint32_t res;
+            uint32_t op1_32 = decode->op[0].val;
+
+            if (!count)
+                break;
+
+            if (1 == count)
+                res = (op1_32 << 1) | get_CF(cpu);
+            else
+                res = (op1_32 << count) | (get_CF(cpu) << (count - 1)) | (op1_32 >> (33 - count));
+
+            write_val_ext(cpu, decode->op[0].ptr, res, 4);
+
+            cf = (op1_32 >> (32 - count)) & 0x1;
+            of = cf ^ (res >> 31); // of = cf ^ result31
+            SET_FLAGS_OxxxxC(cpu, of, cf);
+            break;
+        }
+    }
+    RIP(cpu) += decode->len;
+}
+
+void exec_rcr(struct CPUState *cpu, struct x86_decode *decode)
+{
+    uint8_t count;
+    int of = 0, cf = 0;
+
+    fetch_operands(cpu, decode, 2, true, true, false);
+    count = decode->op[1].val & 0x1f;
+
+    switch(decode->operand_size) {
+        case 1:
+        {
+            uint8_t op1_8 = decode->op[0].val;
+            uint8_t res;
+
+            count %= 9;
+            if (!count)
+                break;
+            res = (op1_8 >> count) | (get_CF(cpu) << (8 - count)) | (op1_8 << (9 - count));
+
+            write_val_ext(cpu, decode->op[0].ptr, res, 1);
+
+            cf = (op1_8 >> (count - 1)) & 0x1;
+            of = (((res << 1) ^ res) >> 7) & 0x1; // of = result6 ^ result7
+            SET_FLAGS_OxxxxC(cpu, of, cf);
+            break;
+        }
+        case 2:
+        {
+            uint16_t op1_16 = decode->op[0].val;
+            uint16_t res;
+
+            count %= 17;
+            if (!count)
+                break;
+            res = (op1_16 >> count) | (get_CF(cpu) << (16 - count)) | (op1_16 << (17 - count));
+
+            write_val_ext(cpu, decode->op[0].ptr, res, 2);
+
+            cf = (op1_16 >> (count - 1)) & 0x1;
+            of = ((uint16_t)((res << 1) ^ res) >> 15) & 0x1; // of = result15 ^ result14
+            SET_FLAGS_OxxxxC(cpu, of, cf);
+            break;
+        }
+        case 4:
+        {
+            uint32_t res;
+            uint32_t op1_32 = decode->op[0].val;
+
+            if (!count)
+                break;
+ 
+            if (1 == count)
+                res = (op1_32 >> 1) | (get_CF(cpu) << 31);
+            else
+                res = (op1_32 >> count) | (get_CF(cpu) << (32 - count)) | (op1_32 << (33 - count));
+
+            write_val_ext(cpu, decode->op[0].ptr, res, 4);
+
+            cf = (op1_32 >> (count - 1)) & 0x1;
+            of = ((res << 1) ^ res) >> 31; // of = result30 ^ result31
+            SET_FLAGS_OxxxxC(cpu, of, cf);
+            break;
+        }
+    }
+    RIP(cpu) += decode->len;
+}
+
+static void exec_xchg(struct CPUState *cpu, struct x86_decode *decode)
+{
+    fetch_operands(cpu, decode, 2, true, true, false);
+
+    write_val_ext(cpu, decode->op[0].ptr, decode->op[1].val, decode->operand_size);
+    write_val_ext(cpu, decode->op[1].ptr, decode->op[0].val, decode->operand_size);
+
+    RIP(cpu) += decode->len;
+}
+
+static void exec_xadd(struct CPUState *cpu, struct x86_decode *decode)
+{
+    EXEC_2OP_ARITH_CMD(cpu, decode, +, SET_FLAGS_OSZAPC_ADD, true);
+    write_val_ext(cpu, decode->op[1].ptr, decode->op[0].val, decode->operand_size);
+
+    RIP(cpu) += decode->len;
+}
+
+static struct cmd_handler {
+    enum x86_decode_cmd cmd;
+    void (*handler)(struct CPUState *cpu, struct x86_decode *ins);
+} handlers[] = {
+    {X86_DECODE_CMD_INVL, NULL,},
+    {X86_DECODE_CMD_MOV, exec_mov},
+    {X86_DECODE_CMD_ADD, exec_add},
+    {X86_DECODE_CMD_OR, exec_or},
+    {X86_DECODE_CMD_ADC, exec_adc},
+    {X86_DECODE_CMD_SBB, exec_sbb},
+    {X86_DECODE_CMD_AND, exec_and},
+    {X86_DECODE_CMD_SUB, exec_sub},
+    {X86_DECODE_CMD_NEG, exec_neg},
+    {X86_DECODE_CMD_XOR, exec_xor},
+    {X86_DECODE_CMD_CMP, exec_cmp},
+    {X86_DECODE_CMD_INC, exec_inc},
+    {X86_DECODE_CMD_DEC, exec_dec},
+    {X86_DECODE_CMD_TST, exec_tst},
+    {X86_DECODE_CMD_NOT, exec_not},
+    {X86_DECODE_CMD_MOVZX, exec_movzx},
+    {X86_DECODE_CMD_OUT, exec_out},
+    {X86_DECODE_CMD_IN, exec_in},
+    {X86_DECODE_CMD_INS, exec_ins},
+    {X86_DECODE_CMD_OUTS, exec_outs},
+    {X86_DECODE_CMD_RDMSR, exec_rdmsr},
+    {X86_DECODE_CMD_WRMSR, exec_wrmsr},
+    {X86_DECODE_CMD_BT, exec_bt},
+    {X86_DECODE_CMD_BTR, exec_btr},
+    {X86_DECODE_CMD_BTC, exec_btc},
+    {X86_DECODE_CMD_BTS, exec_bts},
+    {X86_DECODE_CMD_SHL, exec_shl},
+    {X86_DECODE_CMD_ROL, exec_rol},
+    {X86_DECODE_CMD_ROR, exec_ror},
+    {X86_DECODE_CMD_RCR, exec_rcr},
+    {X86_DECODE_CMD_RCL, exec_rcl},
+    /*{X86_DECODE_CMD_CPUID, exec_cpuid},*/
+    {X86_DECODE_CMD_MOVS, exec_movs},
+    {X86_DECODE_CMD_CMPS, exec_cmps},
+    {X86_DECODE_CMD_STOS, exec_stos},
+    {X86_DECODE_CMD_SCAS, exec_scas},
+    {X86_DECODE_CMD_LODS, exec_lods},
+    {X86_DECODE_CMD_MOVSX, exec_movsx},
+    {X86_DECODE_CMD_XCHG, exec_xchg},
+    {X86_DECODE_CMD_XADD, exec_xadd},
+};
+
+static struct cmd_handler _cmd_handler[X86_DECODE_CMD_LAST];
+
+static void init_cmd_handler(CPUState *cpu)
+{
+    int i;
+    for (i = 0; i < ARRAY_SIZE(handlers); i++)
+        _cmd_handler[handlers[i].cmd] = handlers[i];
+}
+
+static void print_debug(struct CPUState *cpu)
+{
+    printf("%llx: eax %llx ebx %llx ecx %llx edx %llx esi %llx edi %llx ebp %llx esp %llx flags %llx\n", RIP(cpu), RAX(cpu), RBX(cpu), RCX(cpu), RDX(cpu), RSI(cpu), RDI(cpu), RBP(cpu), RSP(cpu), EFLAGS(cpu));
+}
+
+void load_regs(struct CPUState *cpu)
+{
+    int i = 0;
+    RRX(cpu, REG_RAX) = rreg(cpu->hvf_fd, HV_X86_RAX);
+    RRX(cpu, REG_RBX) = rreg(cpu->hvf_fd, HV_X86_RBX);
+    RRX(cpu, REG_RCX) = rreg(cpu->hvf_fd, HV_X86_RCX);
+    RRX(cpu, REG_RDX) = rreg(cpu->hvf_fd, HV_X86_RDX);
+    RRX(cpu, REG_RSI) = rreg(cpu->hvf_fd, HV_X86_RSI);
+    RRX(cpu, REG_RDI) = rreg(cpu->hvf_fd, HV_X86_RDI);
+    RRX(cpu, REG_RSP) = rreg(cpu->hvf_fd, HV_X86_RSP);
+    RRX(cpu, REG_RBP) = rreg(cpu->hvf_fd, HV_X86_RBP);
+    for (i = 8; i < 16; i++)
+        RRX(cpu, i) = rreg(cpu->hvf_fd, HV_X86_RAX + i);
+    
+    RFLAGS(cpu) = rreg(cpu->hvf_fd, HV_X86_RFLAGS);
+    rflags_to_lflags(cpu);
+    RIP(cpu) = rreg(cpu->hvf_fd, HV_X86_RIP);
+
+    //print_debug(cpu);
+}
+
+void store_regs(struct CPUState *cpu)
+{
+    int i = 0;
+    wreg(cpu->hvf_fd, HV_X86_RAX, RAX(cpu));
+    wreg(cpu->hvf_fd, HV_X86_RBX, RBX(cpu));
+    wreg(cpu->hvf_fd, HV_X86_RCX, RCX(cpu));
+    wreg(cpu->hvf_fd, HV_X86_RDX, RDX(cpu));
+    wreg(cpu->hvf_fd, HV_X86_RSI, RSI(cpu));
+    wreg(cpu->hvf_fd, HV_X86_RDI, RDI(cpu));
+    wreg(cpu->hvf_fd, HV_X86_RBP, RBP(cpu));
+    wreg(cpu->hvf_fd, HV_X86_RSP, RSP(cpu));
+    for (i = 8; i < 16; i++)
+        wreg(cpu->hvf_fd, HV_X86_RAX + i, RRX(cpu, i));
+    
+    lflags_to_rflags(cpu);
+    wreg(cpu->hvf_fd, HV_X86_RFLAGS, RFLAGS(cpu));
+    macvm_set_rip(cpu, RIP(cpu));
+
+    //print_debug(cpu);
+}
+
+bool exec_instruction(struct CPUState *cpu, struct x86_decode *ins)
+{
+    //if (hvf_vcpu_id(cpu))
+    //printf("%d, %llx: exec_instruction %s\n", hvf_vcpu_id(cpu),  RIP(cpu), decode_cmd_to_string(ins->cmd));
+    
+    if (0 && ins->is_fpu) {
+        VM_PANIC("emulate fpu\n");
+    } else {
+        if (!_cmd_handler[ins->cmd].handler) {
+            printf("Unimplemented handler (%llx) for %d (%x %x) \n", RIP(cpu), ins->cmd, ins->opcode[0],
+                   ins->opcode_len > 1 ? ins->opcode[1] : 0);
+            RIP(cpu) += ins->len;
+            return true;
+        }
+        
+        VM_PANIC_ON_EX(!_cmd_handler[ins->cmd].handler, "Unimplemented handler (%llx) for %d (%x %x) \n", RIP(cpu), ins->cmd, ins->opcode[0], ins->opcode_len > 1 ? ins->opcode[1] : 0);
+        _cmd_handler[ins->cmd].handler(cpu, ins);
+    }
+    return true;
+}
+
+void init_emu(struct CPUState *cpu)
+{
+    init_cmd_handler(cpu);
+}
diff --git a/target/i386/hvf-utils/x86_emu.h b/target/i386/hvf-utils/x86_emu.h
new file mode 100644
index 0000000000..42cc5e4296
--- /dev/null
+++ b/target/i386/hvf-utils/x86_emu.h
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2016 Veertu Inc,
+ * Copyright (C) 2017 Google Inc,
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 or
+ * (at your option) version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef __X86_EMU_H__
+#define __X86_EMU_H__
+
+#include "x86.h"
+#include "x86_decode.h"
+
+void init_emu(struct CPUState *cpu);
+bool exec_instruction(struct CPUState *cpu, struct x86_decode *ins);
+
+void load_regs(struct CPUState *cpu);
+void store_regs(struct CPUState *cpu);
+
+void simulate_rdmsr(struct CPUState *cpu);
+void simulate_wrmsr(struct CPUState *cpu);
+
+#endif
diff --git a/target/i386/hvf-utils/x86_flags.c b/target/i386/hvf-utils/x86_flags.c
new file mode 100644
index 0000000000..ca876d03dd
--- /dev/null
+++ b/target/i386/hvf-utils/x86_flags.c
@@ -0,0 +1,317 @@
+/////////////////////////////////////////////////////////////////////////
+//
+//  Copyright (C) 2001-2012  The Bochs Project
+//  Copyright (C) 2017 Google Inc.
+//
+//  This library is free software; you can redistribute it and/or
+//  modify it under the terms of the GNU Lesser General Public
+//  License as published by the Free Software Foundation; either
+//  version 2 of the License, or (at your option) any later version.
+//
+//  This library is distributed in the hope that it will be useful,
+//  but WITHOUT ANY WARRANTY; without even the implied warranty of
+//  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+//  Lesser General Public License for more details.
+//
+//  You should have received a copy of the GNU Lesser General Public
+//  License along with this library; if not, write to the Free Software
+//  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA B 02110-1301 USA
+/////////////////////////////////////////////////////////////////////////
+/*
+ * flags functions
+ */
+
+#include "qemu/osdep.h"
+#include "qemu-common.h"
+
+#include "cpu.h"
+#include "x86_flags.h"
+#include "x86.h"
+
+void SET_FLAGS_OxxxxC(struct CPUState *cpu, uint32_t new_of, uint32_t new_cf)
+{
+    uint32_t temp_po = new_of ^ new_cf;
+    cpu->hvf_x86->lflags.auxbits &= ~(LF_MASK_PO | LF_MASK_CF);
+    cpu->hvf_x86->lflags.auxbits |= (temp_po << LF_BIT_PO) | (new_cf << LF_BIT_CF);
+}
+
+void SET_FLAGS_OSZAPC_SUB32(struct CPUState *cpu, uint32_t v1, uint32_t v2, uint32_t diff)
+{
+    SET_FLAGS_OSZAPC_SUB_32(v1, v2, diff);
+}
+
+void SET_FLAGS_OSZAPC_SUB16(struct CPUState *cpu, uint16_t v1, uint16_t v2, uint16_t diff)
+{
+    SET_FLAGS_OSZAPC_SUB_16(v1, v2, diff);
+}
+
+void SET_FLAGS_OSZAPC_SUB8(struct CPUState *cpu, uint8_t v1, uint8_t v2, uint8_t diff)
+{
+    SET_FLAGS_OSZAPC_SUB_8(v1, v2, diff);
+}
+
+void SET_FLAGS_OSZAPC_ADD32(struct CPUState *cpu, uint32_t v1, uint32_t v2, uint32_t diff)
+{
+    SET_FLAGS_OSZAPC_ADD_32(v1, v2, diff);
+}
+
+void SET_FLAGS_OSZAPC_ADD16(struct CPUState *cpu, uint16_t v1, uint16_t v2, uint16_t diff)
+{
+    SET_FLAGS_OSZAPC_ADD_16(v1, v2, diff);
+}
+
+void SET_FLAGS_OSZAPC_ADD8(struct CPUState *cpu, uint8_t v1, uint8_t v2, uint8_t diff)
+{
+    SET_FLAGS_OSZAPC_ADD_8(v1, v2, diff);
+}
+
+void SET_FLAGS_OSZAP_SUB32(struct CPUState *cpu, uint32_t v1, uint32_t v2, uint32_t diff)
+{
+    SET_FLAGS_OSZAP_SUB_32(v1, v2, diff);
+}
+
+void SET_FLAGS_OSZAP_SUB16(struct CPUState *cpu, uint16_t v1, uint16_t v2, uint16_t diff)
+{
+    SET_FLAGS_OSZAP_SUB_16(v1, v2, diff);
+}
+
+void SET_FLAGS_OSZAP_SUB8(struct CPUState *cpu, uint8_t v1, uint8_t v2, uint8_t diff)
+{
+    SET_FLAGS_OSZAP_SUB_8(v1, v2, diff);
+}
+
+void SET_FLAGS_OSZAP_ADD32(struct CPUState *cpu, uint32_t v1, uint32_t v2, uint32_t diff)
+{
+    SET_FLAGS_OSZAP_ADD_32(v1, v2, diff);
+}
+
+void SET_FLAGS_OSZAP_ADD16(struct CPUState *cpu, uint16_t v1, uint16_t v2, uint16_t diff)
+{
+    SET_FLAGS_OSZAP_ADD_16(v1, v2, diff);
+}
+
+void SET_FLAGS_OSZAP_ADD8(struct CPUState *cpu, uint8_t v1, uint8_t v2, uint8_t diff)
+{
+    SET_FLAGS_OSZAP_ADD_8(v1, v2, diff);
+}
+
+
+void SET_FLAGS_OSZAPC_LOGIC32(struct CPUState *cpu, uint32_t diff)
+{
+    SET_FLAGS_OSZAPC_LOGIC_32(diff);
+}
+
+void SET_FLAGS_OSZAPC_LOGIC16(struct CPUState *cpu, uint16_t diff)
+{
+    SET_FLAGS_OSZAPC_LOGIC_16(diff);
+}
+
+void SET_FLAGS_OSZAPC_LOGIC8(struct CPUState *cpu, uint8_t diff)
+{
+    SET_FLAGS_OSZAPC_LOGIC_8(diff);
+}
+
+void SET_FLAGS_SHR32(struct CPUState *cpu, uint32_t v, int count, uint32_t res)
+{
+    int cf = (v >> (count - 1)) & 0x1;
+    int of = (((res << 1) ^ res) >> 31);
+
+    SET_FLAGS_OSZAPC_LOGIC_32(res);
+    SET_FLAGS_OxxxxC(cpu, of, cf);
+}
+
+void SET_FLAGS_SHR16(struct CPUState *cpu, uint16_t v, int count, uint16_t res)
+{
+    int cf = (v >> (count - 1)) & 0x1;
+    int of = (((res << 1) ^ res) >> 15);
+
+    SET_FLAGS_OSZAPC_LOGIC_16(res);
+    SET_FLAGS_OxxxxC(cpu, of, cf);
+}
+
+void SET_FLAGS_SHR8(struct CPUState *cpu, uint8_t v, int count, uint8_t res)
+{
+    int cf = (v >> (count - 1)) & 0x1;
+    int of = (((res << 1) ^ res) >> 7);
+
+    SET_FLAGS_OSZAPC_LOGIC_8(res);
+    SET_FLAGS_OxxxxC(cpu, of, cf);
+}
+
+void SET_FLAGS_SAR32(struct CPUState *cpu, int32_t v, int count, uint32_t res)
+{
+    int cf = (v >> (count - 1)) & 0x1;
+
+    SET_FLAGS_OSZAPC_LOGIC_32(res);
+    SET_FLAGS_OxxxxC(cpu, 0, cf);
+}
+
+void SET_FLAGS_SAR16(struct CPUState *cpu, int16_t v, int count, uint16_t res)
+{
+    int cf = (v >> (count - 1)) & 0x1;
+
+    SET_FLAGS_OSZAPC_LOGIC_16(res);
+    SET_FLAGS_OxxxxC(cpu, 0, cf);
+}
+
+void SET_FLAGS_SAR8(struct CPUState *cpu, int8_t v, int count, uint8_t res)
+{
+    int cf = (v >> (count - 1)) & 0x1;
+
+    SET_FLAGS_OSZAPC_LOGIC_8(res);
+    SET_FLAGS_OxxxxC(cpu, 0, cf);
+}
+
+
+void SET_FLAGS_SHL32(struct CPUState *cpu, uint32_t v, int count, uint32_t res)
+{
+    int of, cf;
+
+    cf = (v >> (32 - count)) & 0x1;
+    of = cf ^ (res >> 31);
+
+    SET_FLAGS_OSZAPC_LOGIC_32(res);
+    SET_FLAGS_OxxxxC(cpu, of, cf);
+}
+
+void SET_FLAGS_SHL16(struct CPUState *cpu, uint16_t v, int count, uint16_t res)
+{
+    int of = 0, cf = 0;
+
+    if (count <= 16) {
+        cf = (v >> (16 - count)) & 0x1;
+        of = cf ^ (res >> 15);
+    }
+
+    SET_FLAGS_OSZAPC_LOGIC_16(res);
+    SET_FLAGS_OxxxxC(cpu, of, cf);
+}
+
+void SET_FLAGS_SHL8(struct CPUState *cpu, uint8_t v, int count, uint8_t res)
+{
+    int of = 0, cf = 0;
+
+    if (count <= 8) {
+        cf = (v >> (8 - count)) & 0x1;
+        of = cf ^ (res >> 7);
+    }
+
+    SET_FLAGS_OSZAPC_LOGIC_8(res);
+    SET_FLAGS_OxxxxC(cpu, of, cf);
+}
+
+bool get_PF(struct CPUState *cpu)
+{
+    uint32_t temp = (255 & cpu->hvf_x86->lflags.result);
+    temp = temp ^ (255 & (cpu->hvf_x86->lflags.auxbits >> LF_BIT_PDB));
+    temp = (temp ^ (temp >> 4)) & 0x0F;
+    return (0x9669U >> temp) & 1;
+}
+
+void set_PF(struct CPUState *cpu, bool val)
+{
+    uint32_t temp = (255 & cpu->hvf_x86->lflags.result) ^ (!val);
+    cpu->hvf_x86->lflags.auxbits &= ~(LF_MASK_PDB);
+    cpu->hvf_x86->lflags.auxbits |= (temp << LF_BIT_PDB);
+}
+
+bool _get_OF(struct CPUState *cpu)
+{
+    return ((cpu->hvf_x86->lflags.auxbits + (1U << LF_BIT_PO)) >> LF_BIT_CF) & 1;
+}
+
+bool get_OF(struct CPUState *cpu)
+{
+    return _get_OF(cpu);
+}
+
+bool _get_CF(struct CPUState *cpu)
+{
+    return (cpu->hvf_x86->lflags.auxbits >> LF_BIT_CF) & 1;
+}
+
+bool get_CF(struct CPUState *cpu)
+{
+    return _get_CF(cpu);
+}
+
+void set_OF(struct CPUState *cpu, bool val)
+{
+    SET_FLAGS_OxxxxC(cpu, val, _get_CF(cpu));
+}
+
+void set_CF(struct CPUState *cpu, bool val)
+{
+    SET_FLAGS_OxxxxC(cpu, _get_OF(cpu), (val));
+}
+
+bool get_AF(struct CPUState *cpu)
+{
+    return (cpu->hvf_x86->lflags.auxbits >> LF_BIT_AF) & 1;
+}
+
+void set_AF(struct CPUState *cpu, bool val)
+{
+    cpu->hvf_x86->lflags.auxbits &= ~(LF_MASK_AF);
+    cpu->hvf_x86->lflags.auxbits |= (val) << LF_BIT_AF;
+}
+
+bool get_ZF(struct CPUState *cpu)
+{
+    return !cpu->hvf_x86->lflags.result;
+}
+
+void set_ZF(struct CPUState *cpu, bool val)
+{
+    if (val) {
+        cpu->hvf_x86->lflags.auxbits ^= (((cpu->hvf_x86->lflags.result >> LF_SIGN_BIT) & 1) << LF_BIT_SD);
+        // merge the parity bits into the Parity Delta Byte
+        uint32_t temp_pdb = (255 & cpu->hvf_x86->lflags.result);
+        cpu->hvf_x86->lflags.auxbits ^= (temp_pdb << LF_BIT_PDB);
+        // now zero the .result value
+        cpu->hvf_x86->lflags.result = 0;
+    } else
+        cpu->hvf_x86->lflags.result |= (1 << 8);
+}
+
+bool get_SF(struct CPUState *cpu)
+{
+    return ((cpu->hvf_x86->lflags.result >> LF_SIGN_BIT) ^ (cpu->hvf_x86->lflags.auxbits >> LF_BIT_SD)) & 1;
+}
+
+void set_SF(struct CPUState *cpu, bool val)
+{
+    bool temp_sf = get_SF(cpu);
+    cpu->hvf_x86->lflags.auxbits ^= (temp_sf ^ val) << LF_BIT_SD;
+}
+
+void set_OSZAPC(struct CPUState *cpu, uint32_t flags32)
+{
+    set_OF(cpu, cpu->hvf_x86->rflags.of);
+    set_SF(cpu, cpu->hvf_x86->rflags.sf);
+    set_ZF(cpu, cpu->hvf_x86->rflags.zf);
+    set_AF(cpu, cpu->hvf_x86->rflags.af);
+    set_PF(cpu, cpu->hvf_x86->rflags.pf);
+    set_CF(cpu, cpu->hvf_x86->rflags.cf);
+}
+
+void lflags_to_rflags(struct CPUState *cpu)
+{
+    cpu->hvf_x86->rflags.cf = get_CF(cpu);
+    cpu->hvf_x86->rflags.pf = get_PF(cpu);
+    cpu->hvf_x86->rflags.af = get_AF(cpu);
+    cpu->hvf_x86->rflags.zf = get_ZF(cpu);
+    cpu->hvf_x86->rflags.sf = get_SF(cpu);
+    cpu->hvf_x86->rflags.of = get_OF(cpu);
+}
+
+void rflags_to_lflags(struct CPUState *cpu)
+{
+    cpu->hvf_x86->lflags.auxbits = cpu->hvf_x86->lflags.result = 0;
+    set_OF(cpu, cpu->hvf_x86->rflags.of);
+    set_SF(cpu, cpu->hvf_x86->rflags.sf);
+    set_ZF(cpu, cpu->hvf_x86->rflags.zf);
+    set_AF(cpu, cpu->hvf_x86->rflags.af);
+    set_PF(cpu, cpu->hvf_x86->rflags.pf);
+    set_CF(cpu, cpu->hvf_x86->rflags.cf);
+}
diff --git a/target/i386/hvf-utils/x86_flags.h b/target/i386/hvf-utils/x86_flags.h
new file mode 100644
index 0000000000..f963f8ad1b
--- /dev/null
+++ b/target/i386/hvf-utils/x86_flags.h
@@ -0,0 +1,218 @@
+/////////////////////////////////////////////////////////////////////////
+//
+//  Copyright (C) 2001-2012  The Bochs Project
+//  Copyright (C) 2017 Google Inc.
+//
+//  This library is free software; you can redistribute it and/or
+//  modify it under the terms of the GNU Lesser General Public
+//  License as published by the Free Software Foundation; either
+//  version 2 of the License, or (at your option) any later version.
+//
+//  This library is distributed in the hope that it will be useful,
+//  but WITHOUT ANY WARRANTY; without even the implied warranty of
+//  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+//  Lesser General Public License for more details.
+//
+//  You should have received a copy of the GNU Lesser General Public
+//  License along with this library; if not, write to the Free Software
+//  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA B 02110-1301 USA
+/////////////////////////////////////////////////////////////////////////
+/*
+ * x86 eflags functions
+ */
+#ifndef __X86_FLAGS_H__
+#define __X86_FLAGS_H__
+
+#include "x86_gen.h"
+
+/* this is basically bocsh code */
+
+typedef struct lazy_flags {
+    addr_t result;
+    addr_t auxbits;
+} lazy_flags;
+
+#define LF_SIGN_BIT     31
+
+#define LF_BIT_SD      (0)          /* lazy Sign Flag Delta            */
+#define LF_BIT_AF      (3)          /* lazy Adjust flag                */
+#define LF_BIT_PDB     (8)          /* lazy Parity Delta Byte (8 bits) */
+#define LF_BIT_CF      (31)         /* lazy Carry Flag                 */
+#define LF_BIT_PO      (30)         /* lazy Partial Overflow = CF ^ OF */
+
+#define LF_MASK_SD     (0x01 << LF_BIT_SD)
+#define LF_MASK_AF     (0x01 << LF_BIT_AF)
+#define LF_MASK_PDB    (0xFF << LF_BIT_PDB)
+#define LF_MASK_CF     (0x01 << LF_BIT_CF)
+#define LF_MASK_PO     (0x01 << LF_BIT_PO)
+
+#define ADD_COUT_VEC(op1, op2, result) \
+   (((op1) & (op2)) | (((op1) | (op2)) & (~(result))))
+
+#define SUB_COUT_VEC(op1, op2, result) \
+   (((~(op1)) & (op2)) | (((~(op1)) ^ (op2)) & (result)))
+
+#define GET_ADD_OVERFLOW(op1, op2, result, mask) \
+   ((((op1) ^ (result)) & ((op2) ^ (result))) & (mask))
+
+// *******************
+// OSZAPC
+// *******************
+
+/* size, carries, result */
+#define SET_FLAGS_OSZAPC_SIZE(size, lf_carries, lf_result) { \
+    addr_t temp = ((lf_carries) & (LF_MASK_AF)) | \
+    (((lf_carries) >> (size - 2)) << LF_BIT_PO); \
+    cpu->hvf_x86->lflags.result = (addr_t)(int##size##_t)(lf_result); \
+    if ((size) == 32) temp = ((lf_carries) & ~(LF_MASK_PDB | LF_MASK_SD)); \
+    else if ((size) == 16) temp = ((lf_carries) & (LF_MASK_AF)) | ((lf_carries) << 16); \
+    else if ((size) == 8)  temp = ((lf_carries) & (LF_MASK_AF)) | ((lf_carries) << 24); \
+    else VM_PANIC("unimplemented");                                                    \
+    cpu->hvf_x86->lflags.auxbits = (addr_t)(uint32_t)temp; \
+}
+
+/* carries, result */
+#define SET_FLAGS_OSZAPC_8(carries, result) \
+    SET_FLAGS_OSZAPC_SIZE(8, carries, result)
+#define SET_FLAGS_OSZAPC_16(carries, result) \
+    SET_FLAGS_OSZAPC_SIZE(16, carries, result)
+#define SET_FLAGS_OSZAPC_32(carries, result) \
+    SET_FLAGS_OSZAPC_SIZE(32, carries, result)
+
+/* result */
+#define SET_FLAGS_OSZAPC_LOGIC_8(result_8) \
+    SET_FLAGS_OSZAPC_8(0, (result_8))
+#define SET_FLAGS_OSZAPC_LOGIC_16(result_16) \
+    SET_FLAGS_OSZAPC_16(0, (result_16))
+#define SET_FLAGS_OSZAPC_LOGIC_32(result_32) \
+    SET_FLAGS_OSZAPC_32(0, (result_32))
+#define SET_FLAGS_OSZAPC_LOGIC_SIZE(size, result) {             \
+    if (32 == size) {SET_FLAGS_OSZAPC_LOGIC_32(result);}        \
+    else if (16 == size) {SET_FLAGS_OSZAPC_LOGIC_16(result);}   \
+    else if (8 == size) {SET_FLAGS_OSZAPC_LOGIC_8(result);}     \
+    else VM_PANIC("unimplemented");                            \
+}
+
+/* op1, op2, result */
+#define SET_FLAGS_OSZAPC_ADD_8(op1_8, op2_8, sum_8) \
+    SET_FLAGS_OSZAPC_8(ADD_COUT_VEC((op1_8), (op2_8), (sum_8)), (sum_8))
+#define SET_FLAGS_OSZAPC_ADD_16(op1_16, op2_16, sum_16) \
+    SET_FLAGS_OSZAPC_16(ADD_COUT_VEC((op1_16), (op2_16), (sum_16)), (sum_16))
+#define SET_FLAGS_OSZAPC_ADD_32(op1_32, op2_32, sum_32) \
+    SET_FLAGS_OSZAPC_32(ADD_COUT_VEC((op1_32), (op2_32), (sum_32)), (sum_32))
+
+/* op1, op2, result */
+#define SET_FLAGS_OSZAPC_SUB_8(op1_8, op2_8, diff_8) \
+    SET_FLAGS_OSZAPC_8(SUB_COUT_VEC((op1_8), (op2_8), (diff_8)), (diff_8))
+#define SET_FLAGS_OSZAPC_SUB_16(op1_16, op2_16, diff_16) \
+    SET_FLAGS_OSZAPC_16(SUB_COUT_VEC((op1_16), (op2_16), (diff_16)), (diff_16))
+#define SET_FLAGS_OSZAPC_SUB_32(op1_32, op2_32, diff_32) \
+    SET_FLAGS_OSZAPC_32(SUB_COUT_VEC((op1_32), (op2_32), (diff_32)), (diff_32))
+
+// *******************
+// OSZAP
+// *******************
+/* size, carries, result */
+#define SET_FLAGS_OSZAP_SIZE(size, lf_carries, lf_result) { \
+    addr_t temp = ((lf_carries) & (LF_MASK_AF)) | \
+    (((lf_carries) >> (size - 2)) << LF_BIT_PO); \
+    if ((size) == 32) temp = ((lf_carries) & ~(LF_MASK_PDB | LF_MASK_SD)); \
+    else if ((size) == 16) temp = ((lf_carries) & (LF_MASK_AF)) | ((lf_carries) << 16); \
+    else if ((size) == 8)  temp = ((lf_carries) & (LF_MASK_AF)) | ((lf_carries) << 24); \
+    else VM_PANIC("unimplemented");                                                    \
+    cpu->hvf_x86->lflags.result = (addr_t)(int##size##_t)(lf_result); \
+    addr_t delta_c = (cpu->hvf_x86->lflags.auxbits ^ temp) & LF_MASK_CF; \
+    delta_c ^= (delta_c >> 1); \
+    cpu->hvf_x86->lflags.auxbits = (addr_t)(uint32_t)(temp ^ delta_c); \
+}
+
+/* carries, result */
+#define SET_FLAGS_OSZAP_8(carries, result) \
+    SET_FLAGS_OSZAP_SIZE(8, carries, result)
+#define SET_FLAGS_OSZAP_16(carries, result) \
+    SET_FLAGS_OSZAP_SIZE(16, carries, result)
+#define SET_FLAGS_OSZAP_32(carries, result) \
+    SET_FLAGS_OSZAP_SIZE(32, carries, result)
+
+/* op1, op2, result */
+#define SET_FLAGS_OSZAP_ADD_8(op1_8, op2_8, sum_8) \
+    SET_FLAGS_OSZAP_8(ADD_COUT_VEC((op1_8), (op2_8), (sum_8)), (sum_8))
+#define SET_FLAGS_OSZAP_ADD_16(op1_16, op2_16, sum_16) \
+    SET_FLAGS_OSZAP_16(ADD_COUT_VEC((op1_16), (op2_16), (sum_16)), (sum_16))
+#define SET_FLAGS_OSZAP_ADD_32(op1_32, op2_32, sum_32) \
+    SET_FLAGS_OSZAP_32(ADD_COUT_VEC((op1_32), (op2_32), (sum_32)), (sum_32))
+
+/* op1, op2, result */
+#define SET_FLAGS_OSZAP_SUB_8(op1_8, op2_8, diff_8) \
+    SET_FLAGS_OSZAP_8(SUB_COUT_VEC((op1_8), (op2_8), (diff_8)), (diff_8))
+#define SET_FLAGS_OSZAP_SUB_16(op1_16, op2_16, diff_16) \
+    SET_FLAGS_OSZAP_16(SUB_COUT_VEC((op1_16), (op2_16), (diff_16)), (diff_16))
+#define SET_FLAGS_OSZAP_SUB_32(op1_32, op2_32, diff_32) \
+    SET_FLAGS_OSZAP_32(SUB_COUT_VEC((op1_32), (op2_32), (diff_32)), (diff_32))
+
+// *******************
+// OSZAxC
+// *******************
+/* size, carries, result */
+#define SET_FLAGS_OSZAxC_LOGIC_SIZE(size, lf_result) { \
+    bool saved_PF = getB_PF(); \
+    SET_FLAGS_OSZAPC_SIZE(size, (int##size##_t)(0), lf_result); \
+    set_PF(saved_PF); \
+}
+
+/* result */
+#define SET_FLAGS_OSZAxC_LOGIC_32(result_32) \
+    SET_FLAGS_OSZAxC_LOGIC_SIZE(32, (result_32))
+
+void lflags_to_rflags(struct CPUState *cpu);
+void rflags_to_lflags(struct CPUState *cpu);
+
+bool get_PF(struct CPUState *cpu);
+void set_PF(struct CPUState *cpu, bool val);
+bool get_CF(struct CPUState *cpu);
+void set_CF(struct CPUState *cpu, bool val);
+bool get_AF(struct CPUState *cpu);
+void set_AF(struct CPUState *cpu, bool val);
+bool get_ZF(struct CPUState *cpu);
+void set_ZF(struct CPUState *cpu, bool val);
+bool get_SF(struct CPUState *cpu);
+void set_SF(struct CPUState *cpu, bool val);
+bool get_OF(struct CPUState *cpu);
+void set_OF(struct CPUState *cpu, bool val);
+void set_OSZAPC(struct CPUState *cpu, uint32_t flags32);
+
+void SET_FLAGS_OxxxxC(struct CPUState *cpu, uint32_t new_of, uint32_t new_cf);
+
+void SET_FLAGS_OSZAPC_SUB32(struct CPUState *cpu, uint32_t v1, uint32_t v2, uint32_t diff);
+void SET_FLAGS_OSZAPC_SUB16(struct CPUState *cpu, uint16_t v1, uint16_t v2, uint16_t diff);
+void SET_FLAGS_OSZAPC_SUB8(struct CPUState *cpu, uint8_t v1, uint8_t v2, uint8_t diff);
+
+void SET_FLAGS_OSZAPC_ADD32(struct CPUState *cpu, uint32_t v1, uint32_t v2, uint32_t diff);
+void SET_FLAGS_OSZAPC_ADD16(struct CPUState *cpu, uint16_t v1, uint16_t v2, uint16_t diff);
+void SET_FLAGS_OSZAPC_ADD8(struct CPUState *cpu, uint8_t v1, uint8_t v2, uint8_t diff);
+
+void SET_FLAGS_OSZAP_SUB32(struct CPUState *cpu, uint32_t v1, uint32_t v2, uint32_t diff);
+void SET_FLAGS_OSZAP_SUB16(struct CPUState *cpu, uint16_t v1, uint16_t v2, uint16_t diff);
+void SET_FLAGS_OSZAP_SUB8(struct CPUState *cpu, uint8_t v1, uint8_t v2, uint8_t diff);
+
+void SET_FLAGS_OSZAP_ADD32(struct CPUState *cpu, uint32_t v1, uint32_t v2, uint32_t diff);
+void SET_FLAGS_OSZAP_ADD16(struct CPUState *cpu, uint16_t v1, uint16_t v2, uint16_t diff);
+void SET_FLAGS_OSZAP_ADD8(struct CPUState *cpu, uint8_t v1, uint8_t v2, uint8_t diff);
+
+void SET_FLAGS_OSZAPC_LOGIC32(struct CPUState *cpu, uint32_t diff);
+void SET_FLAGS_OSZAPC_LOGIC16(struct CPUState *cpu, uint16_t diff);
+void SET_FLAGS_OSZAPC_LOGIC8(struct CPUState *cpu, uint8_t diff);
+
+void SET_FLAGS_SHR32(struct CPUState *cpu, uint32_t v, int count, uint32_t res);
+void SET_FLAGS_SHR16(struct CPUState *cpu, uint16_t v, int count, uint16_t res);
+void SET_FLAGS_SHR8(struct CPUState *cpu, uint8_t v, int count, uint8_t res);
+
+void SET_FLAGS_SAR32(struct CPUState *cpu, int32_t v, int count, uint32_t res);
+void SET_FLAGS_SAR16(struct CPUState *cpu, int16_t v, int count, uint16_t res);
+void SET_FLAGS_SAR8(struct CPUState *cpu, int8_t v, int count, uint8_t res);
+
+void SET_FLAGS_SHL32(struct CPUState *cpu, uint32_t v, int count, uint32_t res);
+void SET_FLAGS_SHL16(struct CPUState *cpu, uint16_t v, int count, uint16_t res);
+void SET_FLAGS_SHL8(struct CPUState *cpu, uint8_t v, int count, uint8_t res);
+
+#endif /* __X86_FLAGS_H__ */
diff --git a/target/i386/hvf-utils/x86_gen.h b/target/i386/hvf-utils/x86_gen.h
new file mode 100644
index 0000000000..e4340fa244
--- /dev/null
+++ b/target/i386/hvf-utils/x86_gen.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2016 Veertu Inc,
+ * Copyright (C) 2017 Google Inc,
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 or
+ * (at your option) version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef __X86_GEN_H__
+#define __X86_GEN_H__
+
+#include <stdlib.h>
+#include <stdio.h>
+#include "qemu-common.h"
+
+typedef uint64_t addr_t;
+
+#define VM_PANIC(x) {\
+    printf("%s\n", x); \
+    abort(); \
+}
+
+#define VM_PANIC_ON(x) {\
+    if (x) { \
+        printf("%s\n", #x); \
+        abort(); \
+    } \
+}
+
+#define VM_PANIC_EX(...) {\
+    printf(__VA_ARGS__); \
+    abort(); \
+}
+
+#define VM_PANIC_ON_EX(x, ...) {\
+    if (x) { \
+        printf(__VA_ARGS__); \
+        abort(); \
+    } \
+}
+
+#define ZERO_INIT(obj) memset((void *) &obj, 0, sizeof(obj))
+
+#endif
diff --git a/target/i386/hvf-utils/x86_mmu.c b/target/i386/hvf-utils/x86_mmu.c
new file mode 100644
index 0000000000..00fae735be
--- /dev/null
+++ b/target/i386/hvf-utils/x86_mmu.c
@@ -0,0 +1,254 @@
+/*
+ * Copyright (C) 2016 Veertu Inc,
+ * Copyright (C) 2017 Google Inc,
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 or
+ * (at your option) version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+#include "qemu/osdep.h"
+
+#include "qemu-common.h"
+#include "x86.h"
+#include "x86_mmu.h"
+#include "string.h"
+#include "vmcs.h"
+#include "vmx.h"
+
+#include "memory.h"
+#include "exec/address-spaces.h"
+
+#define pte_present(pte) (pte & PT_PRESENT)
+#define pte_write_access(pte) (pte & PT_WRITE)
+#define pte_user_access(pte) (pte & PT_USER)
+#define pte_exec_access(pte) (!(pte & PT_NX))
+
+#define pte_large_page(pte) (pte & PT_PS)
+#define pte_global_access(pte) (pte & PT_GLOBAL)
+
+#define PAE_CR3_MASK                (~0x1fllu)
+#define LEGACY_CR3_MASK             (0xffffffff)
+
+#define LEGACY_PTE_PAGE_MASK        (0xffffffffllu << 12)
+#define PAE_PTE_PAGE_MASK           ((-1llu << 12) & ((1llu << 52) - 1))
+#define PAE_PTE_LARGE_PAGE_MASK     ((-1llu << (21)) & ((1llu << 52) - 1))
+
+struct gpt_translation {
+    addr_t  gva;
+    addr_t gpa;
+    int    err_code;
+    uint64_t pte[5];
+    bool write_access;
+    bool user_access;
+    bool exec_access;
+};
+
+static int gpt_top_level(struct CPUState *cpu, bool pae)
+{
+    if (!pae)
+        return 2;
+    if (x86_is_long_mode(cpu))
+        return 4;
+
+    return 3;
+}
+
+static inline int gpt_entry(addr_t addr, int level, bool pae)
+{
+    int level_shift = pae ? 9 : 10;
+    return (addr >> (level_shift * (level - 1) + 12)) & ((1 << level_shift) - 1);
+}
+
+static inline int pte_size(bool pae)
+{
+    return pae ? 8 : 4;
+}
+
+
+static bool get_pt_entry(struct CPUState *cpu, struct gpt_translation *pt, int level, bool pae)
+{
+    int index;
+    uint64_t pte = 0;
+    addr_t page_mask = pae ? PAE_PTE_PAGE_MASK : LEGACY_PTE_PAGE_MASK;
+    addr_t gpa = pt->pte[level] & page_mask;
+
+    if (level == 3 && !x86_is_long_mode(cpu))
+        gpa = pt->pte[level];
+
+    index = gpt_entry(pt->gva, level, pae);
+    address_space_rw(&address_space_memory, gpa + index * pte_size(pae), MEMTXATTRS_UNSPECIFIED, (uint8_t *)&pte, pte_size(pae), 0);
+
+    pt->pte[level - 1] = pte;
+
+    return true;
+}
+
+/* test page table entry */
+static bool test_pt_entry(struct CPUState *cpu, struct gpt_translation *pt, int level, bool *is_large, bool pae)
+{
+    uint64_t pte = pt->pte[level];
+    
+    if (pt->write_access)
+        pt->err_code |= MMU_PAGE_WT;
+    if (pt->user_access)
+        pt->err_code |= MMU_PAGE_US;
+    if (pt->exec_access)
+        pt->err_code |= MMU_PAGE_NX;
+
+    if (!pte_present(pte)) {
+        addr_t page_mask = pae ? PAE_PTE_PAGE_MASK : LEGACY_PTE_PAGE_MASK;
+        return false;
+    }
+    
+    if (pae && !x86_is_long_mode(cpu) && 2 == level)
+        goto exit;
+    
+    if (1 == level && pte_large_page(pte)) {
+        pt->err_code |= MMU_PAGE_PT;
+        *is_large = true;
+    }
+    if (!level)
+        pt->err_code |= MMU_PAGE_PT;
+        
+    addr_t cr0 = rvmcs(cpu->hvf_fd, VMCS_GUEST_CR0);
+    /* check protection */
+    if (cr0 & CR0_WP) {
+        if (pt->write_access && !pte_write_access(pte)) {
+            return false;
+        }
+    }
+
+    if (pt->user_access && !pte_user_access(pte)) {
+        return false;
+    }
+
+    if (pae && pt->exec_access && !pte_exec_access(pte)) {
+        return false;
+    }
+    
+exit:
+    /* TODO: check reserved bits */
+    return true;
+}
+
+static inline uint64_t pse_pte_to_page(uint64_t pte)
+{
+    return ((pte & 0x1fe000) << 19) | (pte & 0xffc00000);
+}
+
+static inline uint64_t large_page_gpa(struct gpt_translation *pt, bool pae)
+{
+    VM_PANIC_ON(!pte_large_page(pt->pte[1]))
+    /* 2Mb large page  */
+    if (pae)
+        return (pt->pte[1] & PAE_PTE_LARGE_PAGE_MASK) | (pt->gva & 0x1fffff);
+    
+    /* 4Mb large page */
+    return pse_pte_to_page(pt->pte[1]) | (pt->gva & 0x3fffff);
+}
+
+
+
+static bool walk_gpt(struct CPUState *cpu, addr_t addr, int err_code, struct gpt_translation* pt, bool pae)
+{
+    int top_level, level;
+    bool is_large = false;
+    addr_t cr3 = rvmcs(cpu->hvf_fd, VMCS_GUEST_CR3);
+    addr_t page_mask = pae ? PAE_PTE_PAGE_MASK : LEGACY_PTE_PAGE_MASK;
+    
+    memset(pt, 0, sizeof(*pt));
+    top_level = gpt_top_level(cpu, pae);
+
+    pt->pte[top_level] = pae ? (cr3 & PAE_CR3_MASK) : (cr3 & LEGACY_CR3_MASK);
+    pt->gva = addr;
+    pt->user_access = (err_code & MMU_PAGE_US);
+    pt->write_access = (err_code & MMU_PAGE_WT);
+    pt->exec_access = (err_code & MMU_PAGE_NX);
+    
+    for (level = top_level; level > 0; level--) {
+        get_pt_entry(cpu, pt, level, pae);
+
+        if (!test_pt_entry(cpu, pt, level - 1, &is_large, pae)) {
+            return false;
+        }
+
+        if (is_large)
+            break;
+    }
+
+    if (!is_large)
+        pt->gpa = (pt->pte[0] & page_mask) | (pt->gva & 0xfff);
+    else
+        pt->gpa = large_page_gpa(pt, pae);
+
+    return true;
+}
+
+
+bool mmu_gva_to_gpa(struct CPUState *cpu, addr_t gva, addr_t *gpa)
+{
+    bool res;
+    struct gpt_translation pt;
+    int err_code = 0;
+
+    if (!x86_is_paging_mode(cpu)) {
+        *gpa = gva;
+        return true;
+    }
+
+    res = walk_gpt(cpu, gva, err_code, &pt, x86_is_pae_enabled(cpu));
+    if (res) {
+        *gpa = pt.gpa;
+        return true;
+    }
+
+    return false;
+}
+
+void vmx_write_mem(struct CPUState* cpu, addr_t gva, void *data, int bytes)
+{
+    addr_t gpa;
+
+    while (bytes > 0) {
+        // copy page
+        int copy = MIN(bytes, 0x1000 - (gva & 0xfff));
+
+        if (!mmu_gva_to_gpa(cpu, gva, &gpa)) {
+            VM_PANIC_ON_EX(1, "%s: mmu_gva_to_gpa %llx failed\n", __FUNCTION__, gva);
+        } else {
+            address_space_rw(&address_space_memory, gpa, MEMTXATTRS_UNSPECIFIED, data, copy, 1);
+        }
+
+        bytes -= copy;
+        gva += copy;
+        data += copy;
+    }
+}
+
+void vmx_read_mem(struct CPUState* cpu, void *data, addr_t gva, int bytes)
+{
+    addr_t gpa;
+
+    while (bytes > 0) {
+        // copy page
+        int copy = MIN(bytes, 0x1000 - (gva & 0xfff));
+
+        if (!mmu_gva_to_gpa(cpu, gva, &gpa)) {
+            VM_PANIC_ON_EX(1, "%s: mmu_gva_to_gpa %llx failed\n", __FUNCTION__, gva);
+        }
+        address_space_rw(&address_space_memory, gpa, MEMTXATTRS_UNSPECIFIED, data, copy, 0);
+
+        bytes -= copy;
+        gva += copy;
+        data += copy;
+    }
+}
diff --git a/target/i386/hvf-utils/x86_mmu.h b/target/i386/hvf-utils/x86_mmu.h
new file mode 100644
index 0000000000..f794d04b3d
--- /dev/null
+++ b/target/i386/hvf-utils/x86_mmu.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2016 Veertu Inc,
+ * Copyright (C) 2017 Google Inc,
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 or
+ * (at your option) version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef __X86_MMU_H__
+#define __X86_MMU_H__
+
+#include "x86_gen.h"
+
+#define PT_PRESENT      (1 << 0)
+#define PT_WRITE        (1 << 1)
+#define PT_USER         (1 << 2)
+#define PT_WT           (1 << 3)
+#define PT_CD           (1 << 4)
+#define PT_ACCESSED     (1 << 5)
+#define PT_DIRTY        (1 << 6)
+#define PT_PS           (1 << 7)
+#define PT_GLOBAL       (1 << 8)
+#define PT_NX           (1llu << 63)
+
+// error codes
+#define MMU_PAGE_PT             (1 << 0)
+#define MMU_PAGE_WT             (1 << 1)
+#define MMU_PAGE_US             (1 << 2)
+#define MMU_PAGE_NX             (1 << 3)
+
+bool mmu_gva_to_gpa(struct CPUState *cpu, addr_t gva, addr_t *gpa);
+
+void vmx_write_mem(struct CPUState* cpu, addr_t gva, void *data, int bytes);
+void vmx_read_mem(struct CPUState* cpu, void *data, addr_t gva, int bytes);
+
+#endif /* __X86_MMU_H__ */
diff --git a/target/i386/hvf-utils/x86hvf.c b/target/i386/hvf-utils/x86hvf.c
new file mode 100644
index 0000000000..d5668df37f
--- /dev/null
+++ b/target/i386/hvf-utils/x86hvf.c
@@ -0,0 +1,501 @@
+/*
+ * Copyright (c) 2003-2008 Fabrice Bellard
+ * Copyright (C) 2016 Veertu Inc,
+ * Copyright (C) 2017 Google Inc,
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 or
+ * (at your option) version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu-common.h"
+
+#include "x86hvf.h"
+#include "vmx.h"
+#include "vmcs.h"
+#include "cpu.h"
+#include "x86_descr.h"
+#include "x86_decode.h"
+
+#include "hw/i386/apic_internal.h"
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <Hypervisor/hv.h>
+#include <Hypervisor/hv_vmx.h>
+#include <stdint.h>
+
+void hvf_cpu_synchronize_state(struct CPUState* cpu_state);
+
+void hvf_set_segment(struct CPUState *cpu, struct vmx_segment *vmx_seg, SegmentCache *qseg, bool is_tr)
+{
+    vmx_seg->sel = qseg->selector;
+    vmx_seg->base = qseg->base;
+    vmx_seg->limit = qseg->limit;
+
+    if (!qseg->selector && !x86_is_real(cpu) && !is_tr) {
+        // the TR register is usable after processor reset despite having a null selector
+        vmx_seg->ar = 1 << 16;
+        return;
+    }
+    vmx_seg->ar = (qseg->flags >> DESC_TYPE_SHIFT) & 0xf;
+    vmx_seg->ar |= ((qseg->flags >> DESC_G_SHIFT) & 1) << 15;
+    vmx_seg->ar |= ((qseg->flags >> DESC_B_SHIFT) & 1) << 14;
+    vmx_seg->ar |= ((qseg->flags >> DESC_L_SHIFT) & 1) << 13;
+    vmx_seg->ar |= ((qseg->flags >> DESC_AVL_SHIFT) & 1) << 12;
+    vmx_seg->ar |= ((qseg->flags >> DESC_P_SHIFT) & 1) << 7;
+    vmx_seg->ar |= ((qseg->flags >> DESC_DPL_SHIFT) & 3) << 5;
+    vmx_seg->ar |= ((qseg->flags >> DESC_S_SHIFT) & 1) << 4;
+}
+
+void hvf_get_segment(SegmentCache *qseg, struct vmx_segment *vmx_seg)
+{
+    qseg->limit = vmx_seg->limit;
+    qseg->base = vmx_seg->base;
+    qseg->selector = vmx_seg->sel;
+    qseg->flags = ((vmx_seg->ar & 0xf) << DESC_TYPE_SHIFT) |
+                  (((vmx_seg->ar >> 4) & 1) << DESC_S_SHIFT) |
+                  (((vmx_seg->ar >> 5) & 3) << DESC_DPL_SHIFT) |
+                  (((vmx_seg->ar >> 7) & 1) << DESC_P_SHIFT) |
+                  (((vmx_seg->ar >> 12) & 1) << DESC_AVL_SHIFT) |
+                  (((vmx_seg->ar >> 13) & 1) << DESC_L_SHIFT) |
+                  (((vmx_seg->ar >> 14) & 1) << DESC_B_SHIFT) |
+                  (((vmx_seg->ar >> 15) & 1) << DESC_G_SHIFT);
+}
+
+void hvf_put_xsave(CPUState *cpu_state)
+{
+
+    int x;
+    struct hvf_xsave_buf *xsave;
+    
+    xsave = X86_CPU(cpu_state)->env.kvm_xsave_buf;
+    memset(xsave, 0, sizeof(*xsave)); 
+    
+    memcpy(&xsave->data[4], &X86_CPU(cpu_state)->env.fpdp, sizeof(X86_CPU(cpu_state)->env.fpdp));
+    memcpy(&xsave->data[2], &X86_CPU(cpu_state)->env.fpip, sizeof(X86_CPU(cpu_state)->env.fpip));
+    memcpy(&xsave->data[8], &X86_CPU(cpu_state)->env.fpregs, sizeof(X86_CPU(cpu_state)->env.fpregs));
+    memcpy(&xsave->data[144], &X86_CPU(cpu_state)->env.ymmh_regs, sizeof(X86_CPU(cpu_state)->env.ymmh_regs));
+    memcpy(&xsave->data[288], &X86_CPU(cpu_state)->env.zmmh_regs, sizeof(X86_CPU(cpu_state)->env.zmmh_regs));
+    memcpy(&xsave->data[272], &X86_CPU(cpu_state)->env.opmask_regs, sizeof(X86_CPU(cpu_state)->env.opmask_regs));
+    memcpy(&xsave->data[240], &X86_CPU(cpu_state)->env.bnd_regs, sizeof(X86_CPU(cpu_state)->env.bnd_regs));
+    memcpy(&xsave->data[256], &X86_CPU(cpu_state)->env.bndcs_regs, sizeof(X86_CPU(cpu_state)->env.bndcs_regs));
+    memcpy(&xsave->data[416], &X86_CPU(cpu_state)->env.hi16_zmm_regs, sizeof(X86_CPU(cpu_state)->env.hi16_zmm_regs));
+    
+    xsave->data[0] = (uint16_t)X86_CPU(cpu_state)->env.fpuc;
+    xsave->data[0] |= (X86_CPU(cpu_state)->env.fpus << 16);
+    xsave->data[0] |= (X86_CPU(cpu_state)->env.fpstt & 7) << 11;
+    
+    for (x = 0; x < 8; ++x)
+        xsave->data[1] |= ((!X86_CPU(cpu_state)->env.fptags[x]) << x);
+    xsave->data[1] |= (uint32_t)(X86_CPU(cpu_state)->env.fpop << 16);
+    
+    memcpy(&xsave->data[40], &X86_CPU(cpu_state)->env.xmm_regs, sizeof(X86_CPU(cpu_state)->env.xmm_regs));
+    
+    xsave->data[6] = X86_CPU(cpu_state)->env.mxcsr;
+    *(uint64_t *)&xsave->data[128] = X86_CPU(cpu_state)->env.xstate_bv;
+    
+    if (hv_vcpu_write_fpstate(cpu_state->hvf_fd, xsave->data, 4096)){
+        abort();
+    }
+}
+
+void vmx_update_tpr(CPUState *cpu);
+void hvf_put_segments(CPUState *cpu_state)
+{
+    CPUX86State *env = &X86_CPU(cpu_state)->env;
+    struct vmx_segment seg;
+    
+    wvmcs(cpu_state->hvf_fd, VMCS_GUEST_IDTR_LIMIT, env->idt.limit);
+    wvmcs(cpu_state->hvf_fd, VMCS_GUEST_IDTR_BASE, env->idt.base);
+
+    wvmcs(cpu_state->hvf_fd, VMCS_GUEST_GDTR_LIMIT, env->gdt.limit);
+    wvmcs(cpu_state->hvf_fd, VMCS_GUEST_GDTR_BASE, env->gdt.base);
+
+    //wvmcs(cpu_state->hvf_fd, VMCS_GUEST_CR2, env->cr[2]);
+    wvmcs(cpu_state->hvf_fd, VMCS_GUEST_CR3, env->cr[3]);
+    vmx_update_tpr(cpu_state);
+    wvmcs(cpu_state->hvf_fd, VMCS_GUEST_IA32_EFER, env->efer);
+
+    macvm_set_cr4(cpu_state->hvf_fd, env->cr[4]);
+    macvm_set_cr0(cpu_state->hvf_fd, env->cr[0]);
+
+    hvf_set_segment(cpu_state, &seg, &env->segs[R_CS], false);
+    vmx_write_segment_descriptor(cpu_state, &seg, REG_SEG_CS);
+    
+    hvf_set_segment(cpu_state, &seg, &env->segs[R_DS], false);
+    vmx_write_segment_descriptor(cpu_state, &seg, REG_SEG_DS);
+
+    hvf_set_segment(cpu_state, &seg, &env->segs[R_ES], false);
+    vmx_write_segment_descriptor(cpu_state, &seg, REG_SEG_ES);
+
+    hvf_set_segment(cpu_state, &seg, &env->segs[R_SS], false);
+    vmx_write_segment_descriptor(cpu_state, &seg, REG_SEG_SS);
+
+    hvf_set_segment(cpu_state, &seg, &env->segs[R_FS], false);
+    vmx_write_segment_descriptor(cpu_state, &seg, REG_SEG_FS);
+
+    hvf_set_segment(cpu_state, &seg, &env->segs[R_GS], false);
+    vmx_write_segment_descriptor(cpu_state, &seg, REG_SEG_GS);
+
+    hvf_set_segment(cpu_state, &seg, &env->tr, true);
+    vmx_write_segment_descriptor(cpu_state, &seg, REG_SEG_TR);
+
+    hvf_set_segment(cpu_state, &seg, &env->ldt, false);
+    vmx_write_segment_descriptor(cpu_state, &seg, REG_SEG_LDTR);
+    
+    hv_vcpu_flush(cpu_state->hvf_fd);
+}
+    
+void hvf_put_msrs(CPUState *cpu_state)
+{
+    CPUX86State *env = &X86_CPU(cpu_state)->env;
+
+    hv_vcpu_write_msr(cpu_state->hvf_fd, MSR_IA32_SYSENTER_CS, env->sysenter_cs);
+    hv_vcpu_write_msr(cpu_state->hvf_fd, MSR_IA32_SYSENTER_ESP, env->sysenter_esp);
+    hv_vcpu_write_msr(cpu_state->hvf_fd, MSR_IA32_SYSENTER_EIP, env->sysenter_eip);
+
+    hv_vcpu_write_msr(cpu_state->hvf_fd, MSR_STAR, env->star);
+
+#ifdef TARGET_X86_64
+    hv_vcpu_write_msr(cpu_state->hvf_fd, MSR_CSTAR, env->cstar);
+    hv_vcpu_write_msr(cpu_state->hvf_fd, MSR_KERNELGSBASE, env->kernelgsbase);
+    hv_vcpu_write_msr(cpu_state->hvf_fd, MSR_FMASK, env->fmask);
+    hv_vcpu_write_msr(cpu_state->hvf_fd, MSR_LSTAR, env->lstar);
+#endif
+
+    hv_vcpu_write_msr(cpu_state->hvf_fd, MSR_GSBASE, env->segs[R_GS].base);
+    hv_vcpu_write_msr(cpu_state->hvf_fd, MSR_FSBASE, env->segs[R_FS].base);
+
+    // if (!osx_is_sierra())
+    //     wvmcs(cpu_state->hvf_fd, VMCS_TSC_OFFSET, env->tsc - rdtscp());
+    hv_vm_sync_tsc(env->tsc);
+}
+
+
+void hvf_get_xsave(CPUState *cpu_state)
+{
+    int x;
+    struct hvf_xsave_buf *xsave;
+    
+    xsave = X86_CPU(cpu_state)->env.kvm_xsave_buf;
+    
+    if (hv_vcpu_read_fpstate(cpu_state->hvf_fd, xsave->data, 4096)) {
+        abort();
+    }
+
+    memcpy(&X86_CPU(cpu_state)->env.fpdp, &xsave->data[4], sizeof(X86_CPU(cpu_state)->env.fpdp));
+    memcpy(&X86_CPU(cpu_state)->env.fpip, &xsave->data[2], sizeof(X86_CPU(cpu_state)->env.fpip));
+    memcpy(&X86_CPU(cpu_state)->env.fpregs, &xsave->data[8], sizeof(X86_CPU(cpu_state)->env.fpregs));
+    memcpy(&X86_CPU(cpu_state)->env.ymmh_regs, &xsave->data[144], sizeof(X86_CPU(cpu_state)->env.ymmh_regs));
+    memcpy(&X86_CPU(cpu_state)->env.zmmh_regs, &xsave->data[288], sizeof(X86_CPU(cpu_state)->env.zmmh_regs));
+    memcpy(&X86_CPU(cpu_state)->env.opmask_regs, &xsave->data[272], sizeof(X86_CPU(cpu_state)->env.opmask_regs));
+    memcpy(&X86_CPU(cpu_state)->env.bnd_regs, &xsave->data[240], sizeof(X86_CPU(cpu_state)->env.bnd_regs));
+    memcpy(&X86_CPU(cpu_state)->env.bndcs_regs, &xsave->data[256], sizeof(X86_CPU(cpu_state)->env.bndcs_regs));
+    memcpy(&X86_CPU(cpu_state)->env.hi16_zmm_regs, &xsave->data[416], sizeof(X86_CPU(cpu_state)->env.hi16_zmm_regs));
+    
+    
+    X86_CPU(cpu_state)->env.fpuc = (uint16_t)xsave->data[0];
+    X86_CPU(cpu_state)->env.fpus = (uint16_t)(xsave->data[0] >> 16);
+    X86_CPU(cpu_state)->env.fpstt = (X86_CPU(cpu_state)->env.fpus >> 11) & 7;
+    X86_CPU(cpu_state)->env.fpop = (uint16_t)(xsave->data[1] >> 16);
+    
+    for (x = 0; x < 8; ++x)
+       X86_CPU(cpu_state)->env.fptags[x] =
+        ((((uint16_t)xsave->data[1] >> x) & 1) == 0);
+    
+    memcpy(&X86_CPU(cpu_state)->env.xmm_regs, &xsave->data[40], sizeof(X86_CPU(cpu_state)->env.xmm_regs));
+
+    X86_CPU(cpu_state)->env.mxcsr = xsave->data[6];
+    X86_CPU(cpu_state)->env.xstate_bv = *(uint64_t *)&xsave->data[128];
+}
+
+void hvf_get_segments(CPUState *cpu_state)
+{
+    CPUX86State *env = &X86_CPU(cpu_state)->env;
+
+    struct vmx_segment seg;
+
+    env->interrupt_injected = -1;
+
+    vmx_read_segment_descriptor(cpu_state, &seg, REG_SEG_CS);
+    hvf_get_segment(&env->segs[R_CS], &seg);
+    
+    vmx_read_segment_descriptor(cpu_state, &seg, REG_SEG_DS);
+    hvf_get_segment(&env->segs[R_DS], &seg);
+
+    vmx_read_segment_descriptor(cpu_state, &seg, REG_SEG_ES);
+    hvf_get_segment(&env->segs[R_ES], &seg);
+
+    vmx_read_segment_descriptor(cpu_state, &seg, REG_SEG_FS);
+    hvf_get_segment(&env->segs[R_FS], &seg);
+
+    vmx_read_segment_descriptor(cpu_state, &seg, REG_SEG_GS);
+    hvf_get_segment(&env->segs[R_GS], &seg);
+
+    vmx_read_segment_descriptor(cpu_state, &seg, REG_SEG_SS);
+    hvf_get_segment(&env->segs[R_SS], &seg);
+
+    vmx_read_segment_descriptor(cpu_state, &seg, REG_SEG_TR);
+    hvf_get_segment(&env->tr, &seg);
+
+    vmx_read_segment_descriptor(cpu_state, &seg, REG_SEG_LDTR);
+    hvf_get_segment(&env->ldt, &seg);
+
+    env->idt.limit = rvmcs(cpu_state->hvf_fd, VMCS_GUEST_IDTR_LIMIT);
+    env->idt.base = rvmcs(cpu_state->hvf_fd, VMCS_GUEST_IDTR_BASE);
+    env->gdt.limit = rvmcs(cpu_state->hvf_fd, VMCS_GUEST_GDTR_LIMIT);
+    env->gdt.base = rvmcs(cpu_state->hvf_fd, VMCS_GUEST_GDTR_BASE);
+
+    env->cr[0] = rvmcs(cpu_state->hvf_fd, VMCS_GUEST_CR0);
+    env->cr[2] = 0;
+    env->cr[3] = rvmcs(cpu_state->hvf_fd, VMCS_GUEST_CR3);
+    env->cr[4] = rvmcs(cpu_state->hvf_fd, VMCS_GUEST_CR4);
+    
+    env->efer = rvmcs(cpu_state->hvf_fd, VMCS_GUEST_IA32_EFER);
+}
+
+void hvf_get_msrs(CPUState *cpu_state)
+{
+    CPUX86State *env = &X86_CPU(cpu_state)->env;
+    uint64_t tmp;
+    
+    hv_vcpu_read_msr(cpu_state->hvf_fd, MSR_IA32_SYSENTER_CS, &tmp);
+    env->sysenter_cs = tmp;
+    
+    hv_vcpu_read_msr(cpu_state->hvf_fd, MSR_IA32_SYSENTER_ESP, &tmp);
+    env->sysenter_esp = tmp;
+
+    hv_vcpu_read_msr(cpu_state->hvf_fd, MSR_IA32_SYSENTER_EIP, &tmp);
+    env->sysenter_eip = tmp;
+
+    hv_vcpu_read_msr(cpu_state->hvf_fd, MSR_STAR, &env->star);
+
+#ifdef TARGET_X86_64
+    hv_vcpu_read_msr(cpu_state->hvf_fd, MSR_CSTAR, &env->cstar);
+    hv_vcpu_read_msr(cpu_state->hvf_fd, MSR_KERNELGSBASE, &env->kernelgsbase);
+    hv_vcpu_read_msr(cpu_state->hvf_fd, MSR_FMASK, &env->fmask);
+    hv_vcpu_read_msr(cpu_state->hvf_fd, MSR_LSTAR, &env->lstar);
+#endif
+
+    hv_vcpu_read_msr(cpu_state->hvf_fd, MSR_IA32_APICBASE, &tmp);
+    
+    env->tsc = rdtscp() + rvmcs(cpu_state->hvf_fd, VMCS_TSC_OFFSET);
+}
+
+int hvf_put_registers(CPUState *cpu_state)
+{
+    X86CPU *x86cpu = X86_CPU(cpu_state);
+    CPUX86State *env = &x86cpu->env;
+
+    wreg(cpu_state->hvf_fd, HV_X86_RAX, env->regs[R_EAX]);
+    wreg(cpu_state->hvf_fd, HV_X86_RBX, env->regs[R_EBX]);
+    wreg(cpu_state->hvf_fd, HV_X86_RCX, env->regs[R_ECX]);
+    wreg(cpu_state->hvf_fd, HV_X86_RDX, env->regs[R_EDX]);
+    wreg(cpu_state->hvf_fd, HV_X86_RBP, env->regs[R_EBP]);
+    wreg(cpu_state->hvf_fd, HV_X86_RSP, env->regs[R_ESP]);
+    wreg(cpu_state->hvf_fd, HV_X86_RSI, env->regs[R_ESI]);
+    wreg(cpu_state->hvf_fd, HV_X86_RDI, env->regs[R_EDI]);
+    wreg(cpu_state->hvf_fd, HV_X86_R8, env->regs[8]);
+    wreg(cpu_state->hvf_fd, HV_X86_R9, env->regs[9]);
+    wreg(cpu_state->hvf_fd, HV_X86_R10, env->regs[10]);
+    wreg(cpu_state->hvf_fd, HV_X86_R11, env->regs[11]);
+    wreg(cpu_state->hvf_fd, HV_X86_R12, env->regs[12]);
+    wreg(cpu_state->hvf_fd, HV_X86_R13, env->regs[13]);
+    wreg(cpu_state->hvf_fd, HV_X86_R14, env->regs[14]);
+    wreg(cpu_state->hvf_fd, HV_X86_R15, env->regs[15]);
+    wreg(cpu_state->hvf_fd, HV_X86_RFLAGS, env->eflags);
+    wreg(cpu_state->hvf_fd, HV_X86_RIP, env->eip);
+   
+    wreg(cpu_state->hvf_fd, HV_X86_XCR0, env->xcr0);
+    
+    hvf_put_xsave(cpu_state);
+    
+    hvf_put_segments(cpu_state);
+    
+    hvf_put_msrs(cpu_state);
+    
+    wreg(cpu_state->hvf_fd, HV_X86_DR0, env->dr[0]);
+    wreg(cpu_state->hvf_fd, HV_X86_DR1, env->dr[1]);
+    wreg(cpu_state->hvf_fd, HV_X86_DR2, env->dr[2]);
+    wreg(cpu_state->hvf_fd, HV_X86_DR3, env->dr[3]);
+    wreg(cpu_state->hvf_fd, HV_X86_DR4, env->dr[4]);
+    wreg(cpu_state->hvf_fd, HV_X86_DR5, env->dr[5]);
+    wreg(cpu_state->hvf_fd, HV_X86_DR6, env->dr[6]);
+    wreg(cpu_state->hvf_fd, HV_X86_DR7, env->dr[7]);
+    
+    return 0;
+}
+
+int hvf_get_registers(CPUState *cpu_state)
+{
+    X86CPU *x86cpu = X86_CPU(cpu_state);
+    CPUX86State *env = &x86cpu->env;
+
+
+    env->regs[R_EAX] = rreg(cpu_state->hvf_fd, HV_X86_RAX);
+    env->regs[R_EBX] = rreg(cpu_state->hvf_fd, HV_X86_RBX);
+    env->regs[R_ECX] = rreg(cpu_state->hvf_fd, HV_X86_RCX);
+    env->regs[R_EDX] = rreg(cpu_state->hvf_fd, HV_X86_RDX);
+    env->regs[R_EBP] = rreg(cpu_state->hvf_fd, HV_X86_RBP);
+    env->regs[R_ESP] = rreg(cpu_state->hvf_fd, HV_X86_RSP);
+    env->regs[R_ESI] = rreg(cpu_state->hvf_fd, HV_X86_RSI);
+    env->regs[R_EDI] = rreg(cpu_state->hvf_fd, HV_X86_RDI);
+    env->regs[8] = rreg(cpu_state->hvf_fd, HV_X86_R8);
+    env->regs[9] = rreg(cpu_state->hvf_fd, HV_X86_R9);
+    env->regs[10] = rreg(cpu_state->hvf_fd, HV_X86_R10);
+    env->regs[11] = rreg(cpu_state->hvf_fd, HV_X86_R11);
+    env->regs[12] = rreg(cpu_state->hvf_fd, HV_X86_R12);
+    env->regs[13] = rreg(cpu_state->hvf_fd, HV_X86_R13);
+    env->regs[14] = rreg(cpu_state->hvf_fd, HV_X86_R14);
+    env->regs[15] = rreg(cpu_state->hvf_fd, HV_X86_R15);
+    
+    env->eflags = rreg(cpu_state->hvf_fd, HV_X86_RFLAGS);
+    env->eip = rreg(cpu_state->hvf_fd, HV_X86_RIP);
+   
+    hvf_get_xsave(cpu_state);
+    env->xcr0 = rreg(cpu_state->hvf_fd, HV_X86_XCR0);
+    
+    hvf_get_segments(cpu_state);
+    hvf_get_msrs(cpu_state);
+    
+    env->dr[0] = rreg(cpu_state->hvf_fd, HV_X86_DR0);
+    env->dr[1] = rreg(cpu_state->hvf_fd, HV_X86_DR1);
+    env->dr[2] = rreg(cpu_state->hvf_fd, HV_X86_DR2);
+    env->dr[3] = rreg(cpu_state->hvf_fd, HV_X86_DR3);
+    env->dr[4] = rreg(cpu_state->hvf_fd, HV_X86_DR4);
+    env->dr[5] = rreg(cpu_state->hvf_fd, HV_X86_DR5);
+    env->dr[6] = rreg(cpu_state->hvf_fd, HV_X86_DR6);
+    env->dr[7] = rreg(cpu_state->hvf_fd, HV_X86_DR7);
+    
+    return 0;
+}
+
+static void vmx_set_int_window_exiting(CPUState *cpu)
+{
+     uint64_t val;
+     val = rvmcs(cpu->hvf_fd, VMCS_PRI_PROC_BASED_CTLS);
+     wvmcs(cpu->hvf_fd, VMCS_PRI_PROC_BASED_CTLS, val | VMCS_PRI_PROC_BASED_CTLS_INT_WINDOW_EXITING);
+}
+
+void vmx_clear_int_window_exiting(CPUState *cpu)
+{
+     uint64_t val;
+     val = rvmcs(cpu->hvf_fd, VMCS_PRI_PROC_BASED_CTLS);
+     wvmcs(cpu->hvf_fd, VMCS_PRI_PROC_BASED_CTLS, val & ~VMCS_PRI_PROC_BASED_CTLS_INT_WINDOW_EXITING);
+}
+
+#define NMI_VEC 2
+
+void hvf_inject_interrupts(CPUState *cpu_state)
+{
+    X86CPU *x86cpu = X86_CPU(cpu_state);
+    int allow_nmi = !(rvmcs(cpu_state->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY) & VMCS_INTERRUPTIBILITY_NMI_BLOCKING);
+
+    uint64_t idt_info = rvmcs(cpu_state->hvf_fd, VMCS_IDT_VECTORING_INFO);
+    uint64_t info = 0;
+    
+    if (idt_info & VMCS_IDT_VEC_VALID) {
+        uint8_t vector = idt_info & 0xff;
+        uint64_t intr_type = idt_info & VMCS_INTR_T_MASK;
+        info = idt_info;
+        
+        uint64_t reason = rvmcs(cpu_state->hvf_fd, VMCS_EXIT_REASON);
+        if (intr_type == VMCS_INTR_T_NMI && reason != EXIT_REASON_TASK_SWITCH) {
+            allow_nmi = 1;
+            vmx_clear_nmi_blocking(cpu_state);
+        }
+        
+        if ((allow_nmi || intr_type != VMCS_INTR_T_NMI)) {
+            info &= ~(1 << 12); /* clear undefined bit */
+            if (intr_type == VMCS_INTR_T_SWINTR ||
+                intr_type == VMCS_INTR_T_PRIV_SWEXCEPTION ||
+                intr_type == VMCS_INTR_T_SWEXCEPTION) {
+                uint64_t ins_len = rvmcs(cpu_state->hvf_fd, VMCS_EXIT_INSTRUCTION_LENGTH);
+                wvmcs(cpu_state->hvf_fd, VMCS_ENTRY_INST_LENGTH, ins_len);
+            }
+            if (vector == EXCEPTION_BP || vector == EXCEPTION_OF) {
+                /*
+                 * VT-x requires #BP and #OF to be injected as software
+                 * exceptions.
+                 */
+                info &= ~VMCS_INTR_T_MASK;
+                info |= VMCS_INTR_T_SWEXCEPTION;
+                uint64_t ins_len = rvmcs(cpu_state->hvf_fd, VMCS_EXIT_INSTRUCTION_LENGTH);
+                wvmcs(cpu_state->hvf_fd, VMCS_ENTRY_INST_LENGTH, ins_len);
+            }
+            
+            uint64_t err = 0;
+            if (idt_info & VMCS_INTR_DEL_ERRCODE) {
+                err = rvmcs(cpu_state->hvf_fd, VMCS_IDT_VECTORING_ERROR);
+                wvmcs(cpu_state->hvf_fd, VMCS_ENTRY_EXCEPTION_ERROR, err);
+            }
+            //printf("reinject  %lx err %d\n", info, err);
+            wvmcs(cpu_state->hvf_fd, VMCS_ENTRY_INTR_INFO, info);
+        };
+    }
+
+    if (cpu_state->interrupt_request & CPU_INTERRUPT_NMI) {
+        if (allow_nmi && !(info & VMCS_INTR_VALID)) {
+            cpu_state->interrupt_request &= ~CPU_INTERRUPT_NMI;
+            info = VMCS_INTR_VALID | VMCS_INTR_T_NMI | NMI_VEC;
+            wvmcs(cpu_state->hvf_fd, VMCS_ENTRY_INTR_INFO, info);
+        } else {
+            vmx_set_nmi_window_exiting(cpu_state);
+        }
+    }
+
+    if (cpu_state->hvf_x86->interruptable && (cpu_state->interrupt_request & CPU_INTERRUPT_HARD) &&
+        (EFLAGS(cpu_state) & IF_MASK) && !(info & VMCS_INTR_VALID)) {
+        int line = cpu_get_pic_interrupt(&x86cpu->env);
+        cpu_state->interrupt_request &= ~CPU_INTERRUPT_HARD;
+        if (line >= 0)
+            wvmcs(cpu_state->hvf_fd, VMCS_ENTRY_INTR_INFO, line | VMCS_INTR_VALID | VMCS_INTR_T_HWINTR);
+    }
+    if (cpu_state->interrupt_request & CPU_INTERRUPT_HARD)
+        vmx_set_int_window_exiting(cpu_state);
+}
+
+int hvf_process_events(CPUState *cpu_state)
+{
+    X86CPU *cpu = X86_CPU(cpu_state);
+    CPUX86State *env = &cpu->env;
+    
+    EFLAGS(cpu_state) = rreg(cpu_state->hvf_fd, HV_X86_RFLAGS);
+
+    if (cpu_state->interrupt_request & CPU_INTERRUPT_INIT) {
+        hvf_cpu_synchronize_state(cpu_state);
+        do_cpu_init(cpu);
+    }
+
+    if (cpu_state->interrupt_request & CPU_INTERRUPT_POLL) {
+        cpu_state->interrupt_request &= ~CPU_INTERRUPT_POLL;
+        apic_poll_irq(cpu->apic_state);
+    }
+    if (((cpu_state->interrupt_request & CPU_INTERRUPT_HARD) && (EFLAGS(cpu_state) & IF_MASK)) ||
+        (cpu_state->interrupt_request & CPU_INTERRUPT_NMI)) {
+        cpu_state->halted = 0;
+    }
+    if (cpu_state->interrupt_request & CPU_INTERRUPT_SIPI) {
+        hvf_cpu_synchronize_state(cpu_state);
+        do_cpu_sipi(cpu);
+    }
+    if (cpu_state->interrupt_request & CPU_INTERRUPT_TPR) {
+        cpu_state->interrupt_request &= ~CPU_INTERRUPT_TPR;
+        hvf_cpu_synchronize_state(cpu_state);
+        apic_handle_tpr_access_report(cpu->apic_state, env->eip,
+                                      env->tpr_access_type);
+    }
+    return cpu_state->halted;
+}
+
diff --git a/target/i386/hvf-utils/x86hvf.h b/target/i386/hvf-utils/x86hvf.h
new file mode 100644
index 0000000000..fbc2158a2b
--- /dev/null
+++ b/target/i386/hvf-utils/x86hvf.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2016 Veertu Inc,
+ * Copyright (C) 2017 Google Inc,
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 or
+ * (at your option) version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef X86HVF_H
+#define X86HVF_H
+#include "cpu.h"
+#include "x86_descr.h"
+
+int hvf_process_events(CPUState *);
+int hvf_put_registers(CPUState *);
+int hvf_get_registers(CPUState *);
+void hvf_inject_interrupts(CPUState *);
+void hvf_set_segment(struct CPUState *cpu, struct vmx_segment *vmx_seg, SegmentCache *qseg, bool is_tr);
+void hvf_get_segment(SegmentCache *qseg, struct vmx_segment *vmx_seg);
+void hvf_put_xsave(CPUState *cpu_state);
+void hvf_put_segments(CPUState *cpu_state);
+void hvf_put_msrs(CPUState *cpu_state);
+void hvf_get_xsave(CPUState *cpu_state);
+void hvf_get_msrs(CPUState *cpu_state);
+void vmx_clear_int_window_exiting(CPUState *cpu);
+void hvf_get_segments(CPUState *cpu_state);
+#endif
