summary refs log tree commit diff stats
path: root/target-i386
diff options
context:
space:
mode:
Diffstat (limited to 'target-i386')
-rw-r--r--target-i386/arch_memory_mapping.c46
-rw-r--r--target-i386/cpu-qom.h1
-rw-r--r--target-i386/cpu.c148
-rw-r--r--target-i386/cpu.h4
-rw-r--r--target-i386/helper.c48
-rw-r--r--target-i386/kvm.c109
-rw-r--r--target-i386/machine.c67
-rw-r--r--target-i386/seg_helper.c14
-rw-r--r--target-i386/smm_helper.c300
-rw-r--r--target-i386/svm_helper.c299
10 files changed, 589 insertions, 447 deletions
diff --git a/target-i386/arch_memory_mapping.c b/target-i386/arch_memory_mapping.c
index 462f984a26..2d35f63e1e 100644
--- a/target-i386/arch_memory_mapping.c
+++ b/target-i386/arch_memory_mapping.c
@@ -16,7 +16,8 @@
 #include "sysemu/memory_mapping.h"
 
 /* PAE Paging or IA-32e Paging */
-static void walk_pte(MemoryMappingList *list, hwaddr pte_start_addr,
+static void walk_pte(MemoryMappingList *list, AddressSpace *as,
+                     hwaddr pte_start_addr,
                      int32_t a20_mask, target_ulong start_line_addr)
 {
     hwaddr pte_addr, start_paddr;
@@ -26,7 +27,7 @@ static void walk_pte(MemoryMappingList *list, hwaddr pte_start_addr,
 
     for (i = 0; i < 512; i++) {
         pte_addr = (pte_start_addr + i * 8) & a20_mask;
-        pte = ldq_phys(pte_addr);
+        pte = ldq_phys(as, pte_addr);
         if (!(pte & PG_PRESENT_MASK)) {
             /* not present */
             continue;
@@ -45,7 +46,7 @@ static void walk_pte(MemoryMappingList *list, hwaddr pte_start_addr,
 }
 
 /* 32-bit Paging */
-static void walk_pte2(MemoryMappingList *list,
+static void walk_pte2(MemoryMappingList *list, AddressSpace *as,
                       hwaddr pte_start_addr, int32_t a20_mask,
                       target_ulong start_line_addr)
 {
@@ -56,7 +57,7 @@ static void walk_pte2(MemoryMappingList *list,
 
     for (i = 0; i < 1024; i++) {
         pte_addr = (pte_start_addr + i * 4) & a20_mask;
-        pte = ldl_phys(pte_addr);
+        pte = ldl_phys(as, pte_addr);
         if (!(pte & PG_PRESENT_MASK)) {
             /* not present */
             continue;
@@ -77,7 +78,8 @@ static void walk_pte2(MemoryMappingList *list,
 /* PAE Paging or IA-32e Paging */
 #define PLM4_ADDR_MASK 0xffffffffff000ULL /* selects bits 51:12 */
 
-static void walk_pde(MemoryMappingList *list, hwaddr pde_start_addr,
+static void walk_pde(MemoryMappingList *list, AddressSpace *as,
+                     hwaddr pde_start_addr,
                      int32_t a20_mask, target_ulong start_line_addr)
 {
     hwaddr pde_addr, pte_start_addr, start_paddr;
@@ -87,7 +89,7 @@ static void walk_pde(MemoryMappingList *list, hwaddr pde_start_addr,
 
     for (i = 0; i < 512; i++) {
         pde_addr = (pde_start_addr + i * 8) & a20_mask;
-        pde = ldq_phys(pde_addr);
+        pde = ldq_phys(as, pde_addr);
         if (!(pde & PG_PRESENT_MASK)) {
             /* not present */
             continue;
@@ -108,12 +110,12 @@ static void walk_pde(MemoryMappingList *list, hwaddr pde_start_addr,
         }
 
         pte_start_addr = (pde & PLM4_ADDR_MASK) & a20_mask;
-        walk_pte(list, pte_start_addr, a20_mask, line_addr);
+        walk_pte(list, as, pte_start_addr, a20_mask, line_addr);
     }
 }
 
 /* 32-bit Paging */
-static void walk_pde2(MemoryMappingList *list,
+static void walk_pde2(MemoryMappingList *list, AddressSpace *as,
                       hwaddr pde_start_addr, int32_t a20_mask,
                       bool pse)
 {
@@ -124,7 +126,7 @@ static void walk_pde2(MemoryMappingList *list,
 
     for (i = 0; i < 1024; i++) {
         pde_addr = (pde_start_addr + i * 4) & a20_mask;
-        pde = ldl_phys(pde_addr);
+        pde = ldl_phys(as, pde_addr);
         if (!(pde & PG_PRESENT_MASK)) {
             /* not present */
             continue;
@@ -150,12 +152,12 @@ static void walk_pde2(MemoryMappingList *list,
         }
 
         pte_start_addr = (pde & ~0xfff) & a20_mask;
-        walk_pte2(list, pte_start_addr, a20_mask, line_addr);
+        walk_pte2(list, as, pte_start_addr, a20_mask, line_addr);
     }
 }
 
 /* PAE Paging */
-static void walk_pdpe2(MemoryMappingList *list,
+static void walk_pdpe2(MemoryMappingList *list, AddressSpace *as,
                        hwaddr pdpe_start_addr, int32_t a20_mask)
 {
     hwaddr pdpe_addr, pde_start_addr;
@@ -165,7 +167,7 @@ static void walk_pdpe2(MemoryMappingList *list,
 
     for (i = 0; i < 4; i++) {
         pdpe_addr = (pdpe_start_addr + i * 8) & a20_mask;
-        pdpe = ldq_phys(pdpe_addr);
+        pdpe = ldq_phys(as, pdpe_addr);
         if (!(pdpe & PG_PRESENT_MASK)) {
             /* not present */
             continue;
@@ -173,13 +175,13 @@ static void walk_pdpe2(MemoryMappingList *list,
 
         line_addr = (((unsigned int)i & 0x3) << 30);
         pde_start_addr = (pdpe & ~0xfff) & a20_mask;
-        walk_pde(list, pde_start_addr, a20_mask, line_addr);
+        walk_pde(list, as, pde_start_addr, a20_mask, line_addr);
     }
 }
 
 #ifdef TARGET_X86_64
 /* IA-32e Paging */
-static void walk_pdpe(MemoryMappingList *list,
+static void walk_pdpe(MemoryMappingList *list, AddressSpace *as,
                       hwaddr pdpe_start_addr, int32_t a20_mask,
                       target_ulong start_line_addr)
 {
@@ -190,7 +192,7 @@ static void walk_pdpe(MemoryMappingList *list,
 
     for (i = 0; i < 512; i++) {
         pdpe_addr = (pdpe_start_addr + i * 8) & a20_mask;
-        pdpe = ldq_phys(pdpe_addr);
+        pdpe = ldq_phys(as, pdpe_addr);
         if (!(pdpe & PG_PRESENT_MASK)) {
             /* not present */
             continue;
@@ -211,12 +213,12 @@ static void walk_pdpe(MemoryMappingList *list,
         }
 
         pde_start_addr = (pdpe & PLM4_ADDR_MASK) & a20_mask;
-        walk_pde(list, pde_start_addr, a20_mask, line_addr);
+        walk_pde(list, as, pde_start_addr, a20_mask, line_addr);
     }
 }
 
 /* IA-32e Paging */
-static void walk_pml4e(MemoryMappingList *list,
+static void walk_pml4e(MemoryMappingList *list, AddressSpace *as,
                        hwaddr pml4e_start_addr, int32_t a20_mask)
 {
     hwaddr pml4e_addr, pdpe_start_addr;
@@ -226,7 +228,7 @@ static void walk_pml4e(MemoryMappingList *list,
 
     for (i = 0; i < 512; i++) {
         pml4e_addr = (pml4e_start_addr + i * 8) & a20_mask;
-        pml4e = ldq_phys(pml4e_addr);
+        pml4e = ldq_phys(as, pml4e_addr);
         if (!(pml4e & PG_PRESENT_MASK)) {
             /* not present */
             continue;
@@ -234,7 +236,7 @@ static void walk_pml4e(MemoryMappingList *list,
 
         line_addr = ((i & 0x1ffULL) << 39) | (0xffffULL << 48);
         pdpe_start_addr = (pml4e & PLM4_ADDR_MASK) & a20_mask;
-        walk_pdpe(list, pdpe_start_addr, a20_mask, line_addr);
+        walk_pdpe(list, as, pdpe_start_addr, a20_mask, line_addr);
     }
 }
 #endif
@@ -256,14 +258,14 @@ void x86_cpu_get_memory_mapping(CPUState *cs, MemoryMappingList *list,
             hwaddr pml4e_addr;
 
             pml4e_addr = (env->cr[3] & PLM4_ADDR_MASK) & env->a20_mask;
-            walk_pml4e(list, pml4e_addr, env->a20_mask);
+            walk_pml4e(list, cs->as, pml4e_addr, env->a20_mask);
         } else
 #endif
         {
             hwaddr pdpe_addr;
 
             pdpe_addr = (env->cr[3] & ~0x1f) & env->a20_mask;
-            walk_pdpe2(list, pdpe_addr, env->a20_mask);
+            walk_pdpe2(list, cs->as, pdpe_addr, env->a20_mask);
         }
     } else {
         hwaddr pde_addr;
@@ -271,7 +273,7 @@ void x86_cpu_get_memory_mapping(CPUState *cs, MemoryMappingList *list,
 
         pde_addr = (env->cr[3] & ~0xfff) & env->a20_mask;
         pse = !!(env->cr[4] & CR4_PSE_MASK);
-        walk_pde2(list, pde_addr, env->a20_mask, pse);
+        walk_pde2(list, cs->as, pde_addr, env->a20_mask, pse);
     }
 }
 
diff --git a/target-i386/cpu-qom.h b/target-i386/cpu-qom.h
index d1751a40c6..722f11a04f 100644
--- a/target-i386/cpu-qom.h
+++ b/target-i386/cpu-qom.h
@@ -69,6 +69,7 @@ typedef struct X86CPU {
     bool hyperv_vapic;
     bool hyperv_relaxed_timing;
     int hyperv_spinlock_attempts;
+    bool hyperv_time;
     bool check_cpuid;
     bool enforce_cpuid;
 
diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index e6f7eaf5cd..0e8812a11d 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -374,7 +374,6 @@ void disable_kvm_pv_eoi(void)
 void host_cpuid(uint32_t function, uint32_t count,
                 uint32_t *eax, uint32_t *ebx, uint32_t *ecx, uint32_t *edx)
 {
-#if defined(CONFIG_KVM)
     uint32_t vec[4];
 
 #ifdef __x86_64__
@@ -382,7 +381,7 @@ void host_cpuid(uint32_t function, uint32_t count,
                  : "=a"(vec[0]), "=b"(vec[1]),
                    "=c"(vec[2]), "=d"(vec[3])
                  : "0"(function), "c"(count) : "cc");
-#else
+#elif defined(__i386__)
     asm volatile("pusha \n\t"
                  "cpuid \n\t"
                  "mov %%eax, 0(%2) \n\t"
@@ -392,6 +391,8 @@ void host_cpuid(uint32_t function, uint32_t count,
                  "popa"
                  : : "a"(function), "c"(count), "S"(vec)
                  : "memory", "cc");
+#else
+    abort();
 #endif
 
     if (eax)
@@ -402,7 +403,6 @@ void host_cpuid(uint32_t function, uint32_t count,
         *ecx = vec[2];
     if (edx)
         *edx = vec[3];
-#endif
 }
 
 #define iswhite(c) ((c) && ((c) <= ' ' || '~' < (c)))
@@ -1119,7 +1119,6 @@ void x86_cpu_compat_set_features(const char *cpu_model, FeatureWord w,
     }
 }
 
-#ifdef CONFIG_KVM
 static int cpu_x86_fill_model_id(char *str)
 {
     uint32_t eax = 0, ebx = 0, ecx = 0, edx = 0;
@@ -1134,7 +1133,6 @@ static int cpu_x86_fill_model_id(char *str)
     }
     return 0;
 }
-#endif
 
 /* Fill a x86_def_t struct with information about the host CPU, and
  * the CPU features supported by the host hardware + host kernel
@@ -1143,7 +1141,6 @@ static int cpu_x86_fill_model_id(char *str)
  */
 static void kvm_cpu_fill_host(x86_def_t *x86_cpu_def)
 {
-#ifdef CONFIG_KVM
     KVMState *s = kvm_state;
     uint32_t eax = 0, ebx = 0, ecx = 0, edx = 0;
 
@@ -1160,46 +1157,19 @@ static void kvm_cpu_fill_host(x86_def_t *x86_cpu_def)
     x86_cpu_def->stepping = eax & 0x0F;
 
     x86_cpu_def->level = kvm_arch_get_supported_cpuid(s, 0x0, 0, R_EAX);
-    x86_cpu_def->features[FEAT_1_EDX] =
-        kvm_arch_get_supported_cpuid(s, 0x1, 0, R_EDX);
-    x86_cpu_def->features[FEAT_1_ECX] =
-        kvm_arch_get_supported_cpuid(s, 0x1, 0, R_ECX);
-
-    if (x86_cpu_def->level >= 7) {
-        x86_cpu_def->features[FEAT_7_0_EBX] =
-                    kvm_arch_get_supported_cpuid(s, 0x7, 0, R_EBX);
-    } else {
-        x86_cpu_def->features[FEAT_7_0_EBX] = 0;
-    }
-
     x86_cpu_def->xlevel = kvm_arch_get_supported_cpuid(s, 0x80000000, 0, R_EAX);
-    x86_cpu_def->features[FEAT_8000_0001_EDX] =
-                kvm_arch_get_supported_cpuid(s, 0x80000001, 0, R_EDX);
-    x86_cpu_def->features[FEAT_8000_0001_ECX] =
-                kvm_arch_get_supported_cpuid(s, 0x80000001, 0, R_ECX);
+    x86_cpu_def->xlevel2 =
+        kvm_arch_get_supported_cpuid(s, 0xC0000000, 0, R_EAX);
 
     cpu_x86_fill_model_id(x86_cpu_def->model_id);
 
-    /* Call Centaur's CPUID instruction. */
-    if (!strcmp(x86_cpu_def->vendor, CPUID_VENDOR_VIA)) {
-        host_cpuid(0xC0000000, 0, &eax, &ebx, &ecx, &edx);
-        eax = kvm_arch_get_supported_cpuid(s, 0xC0000000, 0, R_EAX);
-        if (eax >= 0xC0000001) {
-            /* Support VIA max extended level */
-            x86_cpu_def->xlevel2 = eax;
-            host_cpuid(0xC0000001, 0, &eax, &ebx, &ecx, &edx);
-            x86_cpu_def->features[FEAT_C000_0001_EDX] =
-                    kvm_arch_get_supported_cpuid(s, 0xC0000001, 0, R_EDX);
-        }
+    FeatureWord w;
+    for (w = 0; w < FEATURE_WORDS; w++) {
+        FeatureWordInfo *wi = &feature_word_info[w];
+        x86_cpu_def->features[w] =
+            kvm_arch_get_supported_cpuid(s, wi->cpuid_eax, wi->cpuid_ecx,
+                                         wi->cpuid_reg);
     }
-
-    /* Other KVM-specific feature fields: */
-    x86_cpu_def->features[FEAT_SVM] =
-        kvm_arch_get_supported_cpuid(s, 0x8000000A, 0, R_EDX);
-    x86_cpu_def->features[FEAT_KVM] =
-        kvm_arch_get_supported_cpuid(s, KVM_CPUID_FEATURES, 0, R_EAX);
-
-#endif /* CONFIG_KVM */
 }
 
 static int unavailable_host_feature(FeatureWordInfo *f, uint32_t mask)
@@ -1226,48 +1196,23 @@ static int unavailable_host_feature(FeatureWordInfo *f, uint32_t mask)
  *
  * This function may be called only if KVM is enabled.
  */
-static int kvm_check_features_against_host(X86CPU *cpu)
+static int kvm_check_features_against_host(KVMState *s, X86CPU *cpu)
 {
     CPUX86State *env = &cpu->env;
-    x86_def_t host_def;
-    uint32_t mask;
-    int rv, i;
-    struct model_features_t ft[] = {
-        {&env->features[FEAT_1_EDX],
-            &host_def.features[FEAT_1_EDX],
-            FEAT_1_EDX },
-        {&env->features[FEAT_1_ECX],
-            &host_def.features[FEAT_1_ECX],
-            FEAT_1_ECX },
-        {&env->features[FEAT_8000_0001_EDX],
-            &host_def.features[FEAT_8000_0001_EDX],
-            FEAT_8000_0001_EDX },
-        {&env->features[FEAT_8000_0001_ECX],
-            &host_def.features[FEAT_8000_0001_ECX],
-            FEAT_8000_0001_ECX },
-        {&env->features[FEAT_C000_0001_EDX],
-            &host_def.features[FEAT_C000_0001_EDX],
-            FEAT_C000_0001_EDX },
-        {&env->features[FEAT_7_0_EBX],
-            &host_def.features[FEAT_7_0_EBX],
-            FEAT_7_0_EBX },
-        {&env->features[FEAT_SVM],
-            &host_def.features[FEAT_SVM],
-            FEAT_SVM },
-        {&env->features[FEAT_KVM],
-            &host_def.features[FEAT_KVM],
-            FEAT_KVM },
-    };
+    int rv = 0;
+    FeatureWord w;
 
     assert(kvm_enabled());
 
-    kvm_cpu_fill_host(&host_def);
-    for (rv = 0, i = 0; i < ARRAY_SIZE(ft); ++i) {
-        FeatureWord w = ft[i].feat_word;
+    for (w = 0; w < FEATURE_WORDS; w++) {
         FeatureWordInfo *wi = &feature_word_info[w];
+        uint32_t guest_feat = env->features[w];
+        uint32_t host_feat = kvm_arch_get_supported_cpuid(s, wi->cpuid_eax,
+                                                             wi->cpuid_ecx,
+                                                             wi->cpuid_reg);
+        uint32_t mask;
         for (mask = 1; mask; mask <<= 1) {
-            if (*ft[i].guest_feat & mask &&
-                !(*ft[i].host_feat & mask)) {
+            if (guest_feat & mask && !(host_feat & mask)) {
                 unavailable_host_feature(wi, mask);
                 rv = 1;
             }
@@ -1656,18 +1601,6 @@ static int cpu_x86_find_by_name(X86CPU *cpu, x86_def_t *x86_cpu_def,
         def = &builtin_x86_defs[i];
         if (strcmp(name, def->name) == 0) {
             memcpy(x86_cpu_def, def, sizeof(*def));
-            /* sysenter isn't supported in compatibility mode on AMD,
-             * syscall isn't supported in compatibility mode on Intel.
-             * Normally we advertise the actual CPU vendor, but you can
-             * override this using the 'vendor' property if you want to use
-             * KVM's sysenter/syscall emulation in compatibility mode and
-             * when doing cross vendor migration
-             */
-            if (kvm_enabled()) {
-                uint32_t  ebx = 0, ecx = 0, edx = 0;
-                host_cpuid(0, 0, NULL, &ebx, &ecx, &edx);
-                x86_cpu_vendor_words2str(x86_cpu_def->vendor, ebx, edx, ecx);
-            }
             return 0;
         }
     }
@@ -1867,7 +1800,6 @@ CpuDefinitionInfoList *arch_query_cpu_definitions(Error **errp)
     return cpu_list;
 }
 
-#ifdef CONFIG_KVM
 static void filter_features_for_kvm(X86CPU *cpu)
 {
     CPUX86State *env = &cpu->env;
@@ -1884,7 +1816,6 @@ static void filter_features_for_kvm(X86CPU *cpu)
         cpu->filtered_features[w] = requested_features & ~env->features[w];
     }
 }
-#endif
 
 static void cpu_x86_register(X86CPU *cpu, const char *name, Error **errp)
 {
@@ -1898,12 +1829,6 @@ static void cpu_x86_register(X86CPU *cpu, const char *name, Error **errp)
         return;
     }
 
-    if (kvm_enabled()) {
-        def->features[FEAT_KVM] |= kvm_default_features;
-    }
-    def->features[FEAT_1_ECX] |= CPUID_EXT_HYPERVISOR;
-
-    object_property_set_str(OBJECT(cpu), def->vendor, "vendor", errp);
     object_property_set_int(OBJECT(cpu), def->level, "level", errp);
     object_property_set_int(OBJECT(cpu), def->family, "family", errp);
     object_property_set_int(OBJECT(cpu), def->model, "model", errp);
@@ -1921,6 +1846,31 @@ static void cpu_x86_register(X86CPU *cpu, const char *name, Error **errp)
     cpu->cache_info_passthrough = def->cache_info_passthrough;
 
     object_property_set_str(OBJECT(cpu), def->model_id, "model-id", errp);
+
+    /* Special cases not set in the x86_def_t structs: */
+    if (kvm_enabled()) {
+        env->features[FEAT_KVM] |= kvm_default_features;
+    }
+    env->features[FEAT_1_ECX] |= CPUID_EXT_HYPERVISOR;
+
+    /* sysenter isn't supported in compatibility mode on AMD,
+     * syscall isn't supported in compatibility mode on Intel.
+     * Normally we advertise the actual CPU vendor, but you can
+     * override this using the 'vendor' property if you want to use
+     * KVM's sysenter/syscall emulation in compatibility mode and
+     * when doing cross vendor migration
+     */
+    const char *vendor = def->vendor;
+    char host_vendor[CPUID_VENDOR_SZ + 1];
+    if (kvm_enabled()) {
+        uint32_t  ebx = 0, ecx = 0, edx = 0;
+        host_cpuid(0, 0, NULL, &ebx, &ecx, &edx);
+        x86_cpu_vendor_words2str(host_vendor, ebx, edx, ecx);
+        vendor = host_vendor;
+    }
+
+    object_property_set_str(OBJECT(cpu), vendor, "vendor", errp);
+
 }
 
 X86CPU *cpu_x86_create(const char *cpu_model, DeviceState *icc_bridge,
@@ -2588,15 +2538,14 @@ static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
         env->features[FEAT_8000_0001_ECX] &= TCG_EXT3_FEATURES;
         env->features[FEAT_SVM] &= TCG_SVM_FEATURES;
     } else {
+        KVMState *s = kvm_state;
         if ((cpu->check_cpuid || cpu->enforce_cpuid)
-            && kvm_check_features_against_host(cpu) && cpu->enforce_cpuid) {
+            && kvm_check_features_against_host(s, cpu) && cpu->enforce_cpuid) {
             error_setg(&local_err,
                        "Host's CPU doesn't support requested features");
             goto out;
         }
-#ifdef CONFIG_KVM
         filter_features_for_kvm(cpu);
-#endif
     }
 
 #ifndef CONFIG_USER_ONLY
@@ -2751,6 +2700,7 @@ static Property x86_cpu_properties[] = {
     { .name  = "hv-spinlocks", .info  = &qdev_prop_spinlocks },
     DEFINE_PROP_BOOL("hv-relaxed", X86CPU, hyperv_relaxed_timing, false),
     DEFINE_PROP_BOOL("hv-vapic", X86CPU, hyperv_vapic, false),
+    DEFINE_PROP_BOOL("hv-time", X86CPU, hyperv_time, false),
     DEFINE_PROP_BOOL("check", X86CPU, check_cpuid, false),
     DEFINE_PROP_BOOL("enforce", X86CPU, enforce_cpuid, false),
     DEFINE_PROP_END_OF_LIST()
diff --git a/target-i386/cpu.h b/target-i386/cpu.h
index 1fcbc82698..1b94f0ffb7 100644
--- a/target-i386/cpu.h
+++ b/target-i386/cpu.h
@@ -862,6 +862,10 @@ typedef struct CPUX86State {
     uint64_t msr_fixed_counters[MAX_FIXED_COUNTERS];
     uint64_t msr_gp_counters[MAX_GP_COUNTERS];
     uint64_t msr_gp_evtsel[MAX_GP_COUNTERS];
+    uint64_t msr_hv_hypercall;
+    uint64_t msr_hv_guest_os_id;
+    uint64_t msr_hv_vapic;
+    uint64_t msr_hv_tsc;
 
     /* exception/interrupt handling */
     int error_code;
diff --git a/target-i386/helper.c b/target-i386/helper.c
index fe613b26e1..55c04577dc 100644
--- a/target-i386/helper.c
+++ b/target-i386/helper.c
@@ -515,6 +515,7 @@ int cpu_x86_handle_mmu_fault(CPUX86State *env, target_ulong addr,
 int cpu_x86_handle_mmu_fault(CPUX86State *env, target_ulong addr,
                              int is_write1, int mmu_idx)
 {
+    CPUState *cs = ENV_GET_CPU(env);
     uint64_t ptep, pte;
     target_ulong pde_addr, pte_addr;
     int error_code, is_dirty, prot, page_size, is_write, is_user;
@@ -562,7 +563,7 @@ int cpu_x86_handle_mmu_fault(CPUX86State *env, target_ulong addr,
 
             pml4e_addr = ((env->cr[3] & ~0xfff) + (((addr >> 39) & 0x1ff) << 3)) &
                 env->a20_mask;
-            pml4e = ldq_phys(pml4e_addr);
+            pml4e = ldq_phys(cs->as, pml4e_addr);
             if (!(pml4e & PG_PRESENT_MASK)) {
                 error_code = 0;
                 goto do_fault;
@@ -573,12 +574,12 @@ int cpu_x86_handle_mmu_fault(CPUX86State *env, target_ulong addr,
             }
             if (!(pml4e & PG_ACCESSED_MASK)) {
                 pml4e |= PG_ACCESSED_MASK;
-                stl_phys_notdirty(pml4e_addr, pml4e);
+                stl_phys_notdirty(cs->as, pml4e_addr, pml4e);
             }
             ptep = pml4e ^ PG_NX_MASK;
             pdpe_addr = ((pml4e & PHYS_ADDR_MASK) + (((addr >> 30) & 0x1ff) << 3)) &
                 env->a20_mask;
-            pdpe = ldq_phys(pdpe_addr);
+            pdpe = ldq_phys(cs->as, pdpe_addr);
             if (!(pdpe & PG_PRESENT_MASK)) {
                 error_code = 0;
                 goto do_fault;
@@ -590,7 +591,7 @@ int cpu_x86_handle_mmu_fault(CPUX86State *env, target_ulong addr,
             ptep &= pdpe ^ PG_NX_MASK;
             if (!(pdpe & PG_ACCESSED_MASK)) {
                 pdpe |= PG_ACCESSED_MASK;
-                stl_phys_notdirty(pdpe_addr, pdpe);
+                stl_phys_notdirty(cs->as, pdpe_addr, pdpe);
             }
         } else
 #endif
@@ -598,7 +599,7 @@ int cpu_x86_handle_mmu_fault(CPUX86State *env, target_ulong addr,
             /* XXX: load them when cr3 is loaded ? */
             pdpe_addr = ((env->cr[3] & ~0x1f) + ((addr >> 27) & 0x18)) &
                 env->a20_mask;
-            pdpe = ldq_phys(pdpe_addr);
+            pdpe = ldq_phys(cs->as, pdpe_addr);
             if (!(pdpe & PG_PRESENT_MASK)) {
                 error_code = 0;
                 goto do_fault;
@@ -608,7 +609,7 @@ int cpu_x86_handle_mmu_fault(CPUX86State *env, target_ulong addr,
 
         pde_addr = ((pdpe & PHYS_ADDR_MASK) + (((addr >> 21) & 0x1ff) << 3)) &
             env->a20_mask;
-        pde = ldq_phys(pde_addr);
+        pde = ldq_phys(cs->as, pde_addr);
         if (!(pde & PG_PRESENT_MASK)) {
             error_code = 0;
             goto do_fault;
@@ -660,7 +661,7 @@ int cpu_x86_handle_mmu_fault(CPUX86State *env, target_ulong addr,
                 pde |= PG_ACCESSED_MASK;
                 if (is_dirty)
                     pde |= PG_DIRTY_MASK;
-                stl_phys_notdirty(pde_addr, pde);
+                stl_phys_notdirty(cs->as, pde_addr, pde);
             }
             /* align to page_size */
             pte = pde & ((PHYS_ADDR_MASK & ~(page_size - 1)) | 0xfff);
@@ -669,11 +670,11 @@ int cpu_x86_handle_mmu_fault(CPUX86State *env, target_ulong addr,
             /* 4 KB page */
             if (!(pde & PG_ACCESSED_MASK)) {
                 pde |= PG_ACCESSED_MASK;
-                stl_phys_notdirty(pde_addr, pde);
+                stl_phys_notdirty(cs->as, pde_addr, pde);
             }
             pte_addr = ((pde & PHYS_ADDR_MASK) + (((addr >> 12) & 0x1ff) << 3)) &
                 env->a20_mask;
-            pte = ldq_phys(pte_addr);
+            pte = ldq_phys(cs->as, pte_addr);
             if (!(pte & PG_PRESENT_MASK)) {
                 error_code = 0;
                 goto do_fault;
@@ -722,7 +723,7 @@ int cpu_x86_handle_mmu_fault(CPUX86State *env, target_ulong addr,
                 pte |= PG_ACCESSED_MASK;
                 if (is_dirty)
                     pte |= PG_DIRTY_MASK;
-                stl_phys_notdirty(pte_addr, pte);
+                stl_phys_notdirty(cs->as, pte_addr, pte);
             }
             page_size = 4096;
             virt_addr = addr & ~0xfff;
@@ -734,7 +735,7 @@ int cpu_x86_handle_mmu_fault(CPUX86State *env, target_ulong addr,
         /* page directory entry */
         pde_addr = ((env->cr[3] & ~0xfff) + ((addr >> 20) & 0xffc)) &
             env->a20_mask;
-        pde = ldl_phys(pde_addr);
+        pde = ldl_phys(cs->as, pde_addr);
         if (!(pde & PG_PRESENT_MASK)) {
             error_code = 0;
             goto do_fault;
@@ -777,7 +778,7 @@ int cpu_x86_handle_mmu_fault(CPUX86State *env, target_ulong addr,
                 pde |= PG_ACCESSED_MASK;
                 if (is_dirty)
                     pde |= PG_DIRTY_MASK;
-                stl_phys_notdirty(pde_addr, pde);
+                stl_phys_notdirty(cs->as, pde_addr, pde);
             }
 
             pte = pde & ~( (page_size - 1) & ~0xfff); /* align to page_size */
@@ -786,13 +787,13 @@ int cpu_x86_handle_mmu_fault(CPUX86State *env, target_ulong addr,
         } else {
             if (!(pde & PG_ACCESSED_MASK)) {
                 pde |= PG_ACCESSED_MASK;
-                stl_phys_notdirty(pde_addr, pde);
+                stl_phys_notdirty(cs->as, pde_addr, pde);
             }
 
             /* page directory entry */
             pte_addr = ((pde & ~0xfff) + ((addr >> 10) & 0xffc)) &
                 env->a20_mask;
-            pte = ldl_phys(pte_addr);
+            pte = ldl_phys(cs->as, pte_addr);
             if (!(pte & PG_PRESENT_MASK)) {
                 error_code = 0;
                 goto do_fault;
@@ -834,7 +835,7 @@ int cpu_x86_handle_mmu_fault(CPUX86State *env, target_ulong addr,
                 pte |= PG_ACCESSED_MASK;
                 if (is_dirty)
                     pte |= PG_DIRTY_MASK;
-                stl_phys_notdirty(pte_addr, pte);
+                stl_phys_notdirty(cs->as, pte_addr, pte);
             }
             page_size = 4096;
             virt_addr = addr & ~0xfff;
@@ -880,7 +881,8 @@ int cpu_x86_handle_mmu_fault(CPUX86State *env, target_ulong addr,
         error_code |= PG_ERROR_I_D_MASK;
     if (env->intercept_exceptions & (1 << EXCP0E_PAGE)) {
         /* cr2 is not modified in case of exceptions */
-        stq_phys(env->vm_vmcb + offsetof(struct vmcb, control.exit_info_2), 
+        stq_phys(cs->as,
+                 env->vm_vmcb + offsetof(struct vmcb, control.exit_info_2),
                  addr);
     } else {
         env->cr[2] = addr;
@@ -919,13 +921,13 @@ hwaddr x86_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
 
             pml4e_addr = ((env->cr[3] & ~0xfff) + (((addr >> 39) & 0x1ff) << 3)) &
                 env->a20_mask;
-            pml4e = ldq_phys(pml4e_addr);
+            pml4e = ldq_phys(cs->as, pml4e_addr);
             if (!(pml4e & PG_PRESENT_MASK))
                 return -1;
 
             pdpe_addr = ((pml4e & ~0xfff & ~(PG_NX_MASK | PG_HI_USER_MASK)) +
                          (((addr >> 30) & 0x1ff) << 3)) & env->a20_mask;
-            pdpe = ldq_phys(pdpe_addr);
+            pdpe = ldq_phys(cs->as, pdpe_addr);
             if (!(pdpe & PG_PRESENT_MASK))
                 return -1;
         } else
@@ -933,14 +935,14 @@ hwaddr x86_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
         {
             pdpe_addr = ((env->cr[3] & ~0x1f) + ((addr >> 27) & 0x18)) &
                 env->a20_mask;
-            pdpe = ldq_phys(pdpe_addr);
+            pdpe = ldq_phys(cs->as, pdpe_addr);
             if (!(pdpe & PG_PRESENT_MASK))
                 return -1;
         }
 
         pde_addr = ((pdpe & ~0xfff & ~(PG_NX_MASK | PG_HI_USER_MASK)) +
                     (((addr >> 21) & 0x1ff) << 3)) & env->a20_mask;
-        pde = ldq_phys(pde_addr);
+        pde = ldq_phys(cs->as, pde_addr);
         if (!(pde & PG_PRESENT_MASK)) {
             return -1;
         }
@@ -953,7 +955,7 @@ hwaddr x86_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
             pte_addr = ((pde & ~0xfff & ~(PG_NX_MASK | PG_HI_USER_MASK)) +
                         (((addr >> 12) & 0x1ff) << 3)) & env->a20_mask;
             page_size = 4096;
-            pte = ldq_phys(pte_addr);
+            pte = ldq_phys(cs->as, pte_addr);
         }
         pte &= ~(PG_NX_MASK | PG_HI_USER_MASK);
         if (!(pte & PG_PRESENT_MASK))
@@ -963,7 +965,7 @@ hwaddr x86_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
 
         /* page directory entry */
         pde_addr = ((env->cr[3] & ~0xfff) + ((addr >> 20) & 0xffc)) & env->a20_mask;
-        pde = ldl_phys(pde_addr);
+        pde = ldl_phys(cs->as, pde_addr);
         if (!(pde & PG_PRESENT_MASK))
             return -1;
         if ((pde & PG_PSE_MASK) && (env->cr[4] & CR4_PSE_MASK)) {
@@ -972,7 +974,7 @@ hwaddr x86_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
         } else {
             /* page directory entry */
             pte_addr = ((pde & ~0xfff) + ((addr >> 10) & 0xffc)) & env->a20_mask;
-            pte = ldl_phys(pte_addr);
+            pte = ldl_phys(cs->as, pte_addr);
             if (!(pte & PG_PRESENT_MASK))
                 return -1;
             page_size = 4096;
diff --git a/target-i386/kvm.c b/target-i386/kvm.c
index 0a21c3085d..e555040a97 100644
--- a/target-i386/kvm.c
+++ b/target-i386/kvm.c
@@ -72,6 +72,9 @@ static bool has_msr_misc_enable;
 static bool has_msr_bndcfgs;
 static bool has_msr_kvm_steal_time;
 static int lm_capable_kernel;
+static bool has_msr_hv_hypercall;
+static bool has_msr_hv_vapic;
+static bool has_msr_hv_tsc;
 
 static bool has_msr_architectural_pmu;
 static uint32_t num_architectural_pmu_counters;
@@ -437,8 +440,11 @@ static bool hyperv_hypercall_available(X86CPU *cpu)
 
 static bool hyperv_enabled(X86CPU *cpu)
 {
-    return hyperv_hypercall_available(cpu) ||
-           cpu->hyperv_relaxed_timing;
+    CPUState *cs = CPU(cpu);
+    return kvm_check_extension(cs->kvm_state, KVM_CAP_HYPERV) > 0 &&
+           (hyperv_hypercall_available(cpu) ||
+            cpu->hyperv_time  ||
+            cpu->hyperv_relaxed_timing);
 }
 
 #define KVM_MAX_CPUID_ENTRIES  100
@@ -455,6 +461,7 @@ int kvm_arch_init_vcpu(CPUState *cs)
     uint32_t unused;
     struct kvm_cpuid_entry2 *c;
     uint32_t signature[3];
+    int kvm_base = KVM_CPUID_SIGNATURE;
     int r;
 
     memset(&cpuid_data, 0, sizeof(cpuid_data));
@@ -462,26 +469,22 @@ int kvm_arch_init_vcpu(CPUState *cs)
     cpuid_i = 0;
 
     /* Paravirtualization CPUIDs */
-    c = &cpuid_data.entries[cpuid_i++];
-    c->function = KVM_CPUID_SIGNATURE;
-    if (!hyperv_enabled(cpu)) {
-        memcpy(signature, "KVMKVMKVM\0\0\0", 12);
-        c->eax = 0;
-    } else {
+    if (hyperv_enabled(cpu)) {
+        c = &cpuid_data.entries[cpuid_i++];
+        c->function = HYPERV_CPUID_VENDOR_AND_MAX_FUNCTIONS;
         memcpy(signature, "Microsoft Hv", 12);
         c->eax = HYPERV_CPUID_MIN;
-    }
-    c->ebx = signature[0];
-    c->ecx = signature[1];
-    c->edx = signature[2];
-
-    c = &cpuid_data.entries[cpuid_i++];
-    c->function = KVM_CPUID_FEATURES;
-    c->eax = env->features[FEAT_KVM];
+        c->ebx = signature[0];
+        c->ecx = signature[1];
+        c->edx = signature[2];
 
-    if (hyperv_enabled(cpu)) {
+        c = &cpuid_data.entries[cpuid_i++];
+        c->function = HYPERV_CPUID_INTERFACE;
         memcpy(signature, "Hv#1\0\0\0\0\0\0\0\0", 12);
         c->eax = signature[0];
+        c->ebx = 0;
+        c->ecx = 0;
+        c->edx = 0;
 
         c = &cpuid_data.entries[cpuid_i++];
         c->function = HYPERV_CPUID_VERSION;
@@ -496,14 +499,21 @@ int kvm_arch_init_vcpu(CPUState *cs)
         if (cpu->hyperv_vapic) {
             c->eax |= HV_X64_MSR_HYPERCALL_AVAILABLE;
             c->eax |= HV_X64_MSR_APIC_ACCESS_AVAILABLE;
+            has_msr_hv_vapic = true;
+        }
+        if (cpu->hyperv_time &&
+            kvm_check_extension(cs->kvm_state, KVM_CAP_HYPERV_TIME) > 0) {
+            c->eax |= HV_X64_MSR_HYPERCALL_AVAILABLE;
+            c->eax |= HV_X64_MSR_TIME_REF_COUNT_AVAILABLE;
+            c->eax |= 0x200;
+            has_msr_hv_tsc = true;
         }
-
         c = &cpuid_data.entries[cpuid_i++];
         c->function = HYPERV_CPUID_ENLIGHTMENT_INFO;
         if (cpu->hyperv_relaxed_timing) {
             c->eax |= HV_X64_RELAXED_TIMING_RECOMMENDED;
         }
-        if (cpu->hyperv_vapic) {
+        if (has_msr_hv_vapic) {
             c->eax |= HV_X64_APIC_ACCESS_RECOMMENDED;
         }
         c->ebx = cpu->hyperv_spinlock_attempts;
@@ -513,15 +523,22 @@ int kvm_arch_init_vcpu(CPUState *cs)
         c->eax = 0x40;
         c->ebx = 0x40;
 
-        c = &cpuid_data.entries[cpuid_i++];
-        c->function = KVM_CPUID_SIGNATURE_NEXT;
-        memcpy(signature, "KVMKVMKVM\0\0\0", 12);
-        c->eax = 0;
-        c->ebx = signature[0];
-        c->ecx = signature[1];
-        c->edx = signature[2];
+        kvm_base = KVM_CPUID_SIGNATURE_NEXT;
+        has_msr_hv_hypercall = true;
     }
 
+    memcpy(signature, "KVMKVMKVM\0\0\0", 12);
+    c = &cpuid_data.entries[cpuid_i++];
+    c->function = KVM_CPUID_SIGNATURE | kvm_base;
+    c->eax = 0;
+    c->ebx = signature[0];
+    c->ecx = signature[1];
+    c->edx = signature[2];
+
+    c = &cpuid_data.entries[cpuid_i++];
+    c->function = KVM_CPUID_FEATURES | kvm_base;
+    c->eax = env->features[FEAT_KVM];
+
     has_msr_async_pf_en = c->eax & (1 << KVM_FEATURE_ASYNC_PF);
 
     has_msr_pv_eoi_en = c->eax & (1 << KVM_FEATURE_PV_EOI);
@@ -1220,12 +1237,19 @@ static int kvm_put_msrs(X86CPU *cpu, int level)
             kvm_msr_entry_set(&msrs[n++], MSR_CORE_PERF_GLOBAL_CTRL,
                               env->msr_global_ctrl);
         }
-        if (hyperv_hypercall_available(cpu)) {
-            kvm_msr_entry_set(&msrs[n++], HV_X64_MSR_GUEST_OS_ID, 0);
-            kvm_msr_entry_set(&msrs[n++], HV_X64_MSR_HYPERCALL, 0);
+        if (has_msr_hv_hypercall) {
+            kvm_msr_entry_set(&msrs[n++], HV_X64_MSR_GUEST_OS_ID,
+                              env->msr_hv_guest_os_id);
+            kvm_msr_entry_set(&msrs[n++], HV_X64_MSR_HYPERCALL,
+                              env->msr_hv_hypercall);
         }
-        if (cpu->hyperv_vapic) {
-            kvm_msr_entry_set(&msrs[n++], HV_X64_MSR_APIC_ASSIST_PAGE, 0);
+        if (has_msr_hv_vapic) {
+            kvm_msr_entry_set(&msrs[n++], HV_X64_MSR_APIC_ASSIST_PAGE,
+                              env->msr_hv_vapic);
+        }
+        if (has_msr_hv_tsc) {
+            kvm_msr_entry_set(&msrs[n++], HV_X64_MSR_REFERENCE_TSC,
+                              env->msr_hv_tsc);
         }
 
         /* Note: MSR_IA32_FEATURE_CONTROL is written separately, see
@@ -1511,6 +1535,17 @@ static int kvm_get_msrs(X86CPU *cpu)
         }
     }
 
+    if (has_msr_hv_hypercall) {
+        msrs[n++].index = HV_X64_MSR_HYPERCALL;
+        msrs[n++].index = HV_X64_MSR_GUEST_OS_ID;
+    }
+    if (has_msr_hv_vapic) {
+        msrs[n++].index = HV_X64_MSR_APIC_ASSIST_PAGE;
+    }
+    if (has_msr_hv_tsc) {
+        msrs[n++].index = HV_X64_MSR_REFERENCE_TSC;
+    }
+
     msr_data.info.nmsrs = n;
     ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_MSRS, &msr_data);
     if (ret < 0) {
@@ -1618,6 +1653,18 @@ static int kvm_get_msrs(X86CPU *cpu)
         case MSR_P6_EVNTSEL0 ... MSR_P6_EVNTSEL0 + MAX_GP_COUNTERS - 1:
             env->msr_gp_evtsel[index - MSR_P6_EVNTSEL0] = msrs[i].data;
             break;
+        case HV_X64_MSR_HYPERCALL:
+            env->msr_hv_hypercall = msrs[i].data;
+            break;
+        case HV_X64_MSR_GUEST_OS_ID:
+            env->msr_hv_guest_os_id = msrs[i].data;
+            break;
+        case HV_X64_MSR_APIC_ASSIST_PAGE:
+            env->msr_hv_vapic = msrs[i].data;
+            break;
+        case HV_X64_MSR_REFERENCE_TSC:
+            env->msr_hv_tsc = msrs[i].data;
+            break;
         }
     }
 
diff --git a/target-i386/machine.c b/target-i386/machine.c
index 2de196428d..d548c055a9 100644
--- a/target-i386/machine.c
+++ b/target-i386/machine.c
@@ -554,6 +554,64 @@ static const VMStateDescription vmstate_mpx = {
     }
 };
 
+static bool hyperv_hypercall_enable_needed(void *opaque)
+{
+    X86CPU *cpu = opaque;
+    CPUX86State *env = &cpu->env;
+
+    return env->msr_hv_hypercall != 0 || env->msr_hv_guest_os_id != 0;
+}
+
+static const VMStateDescription vmstate_msr_hypercall_hypercall = {
+    .name = "cpu/msr_hyperv_hypercall",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINT64(env.msr_hv_hypercall, X86CPU),
+        VMSTATE_UINT64(env.msr_hv_guest_os_id, X86CPU),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static bool hyperv_vapic_enable_needed(void *opaque)
+{
+    X86CPU *cpu = opaque;
+    CPUX86State *env = &cpu->env;
+
+    return env->msr_hv_vapic != 0;
+}
+
+static const VMStateDescription vmstate_msr_hyperv_vapic = {
+    .name = "cpu/msr_hyperv_vapic",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINT64(env.msr_hv_vapic, X86CPU),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static bool hyperv_time_enable_needed(void *opaque)
+{
+    X86CPU *cpu = opaque;
+    CPUX86State *env = &cpu->env;
+
+    return env->msr_hv_tsc != 0;
+}
+
+static const VMStateDescription vmstate_msr_hyperv_time = {
+    .name = "cpu/msr_hyperv_time",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINT64(env.msr_hv_tsc, X86CPU),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 const VMStateDescription vmstate_x86_cpu = {
     .name = "cpu",
     .version_id = 12,
@@ -688,6 +746,15 @@ const VMStateDescription vmstate_x86_cpu = {
         } , {
             .vmsd = &vmstate_mpx,
             .needed = mpx_needed,
+        }, {
+            .vmsd = &vmstate_msr_hypercall_hypercall,
+            .needed = hyperv_hypercall_enable_needed,
+        }, {
+            .vmsd = &vmstate_msr_hyperv_vapic,
+            .needed = hyperv_vapic_enable_needed,
+        }, {
+            .vmsd = &vmstate_msr_hyperv_time,
+            .needed = hyperv_time_enable_needed,
         } , {
             /* empty */
         }
diff --git a/target-i386/seg_helper.c b/target-i386/seg_helper.c
index e78910200a..959212bfe3 100644
--- a/target-i386/seg_helper.c
+++ b/target-i386/seg_helper.c
@@ -1131,7 +1131,8 @@ static void do_interrupt_user(CPUX86State *env, int intno, int is_int,
 static void handle_even_inj(CPUX86State *env, int intno, int is_int,
                             int error_code, int is_hw, int rm)
 {
-    uint32_t event_inj = ldl_phys(env->vm_vmcb + offsetof(struct vmcb,
+    CPUState *cs = ENV_GET_CPU(env);
+    uint32_t event_inj = ldl_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb,
                                                           control.event_inj));
 
     if (!(event_inj & SVM_EVTINJ_VALID)) {
@@ -1145,11 +1146,12 @@ static void handle_even_inj(CPUX86State *env, int intno, int is_int,
         event_inj = intno | type | SVM_EVTINJ_VALID;
         if (!rm && exception_has_error_code(intno)) {
             event_inj |= SVM_EVTINJ_VALID_ERR;
-            stl_phys(env->vm_vmcb + offsetof(struct vmcb,
+            stl_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb,
                                              control.event_inj_err),
                      error_code);
         }
-        stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.event_inj),
+        stl_phys(cs->as,
+                 env->vm_vmcb + offsetof(struct vmcb, control.event_inj),
                  event_inj);
     }
 }
@@ -1225,11 +1227,13 @@ static void do_interrupt_all(X86CPU *cpu, int intno, int is_int,
 
 #if !defined(CONFIG_USER_ONLY)
     if (env->hflags & HF_SVMI_MASK) {
-        uint32_t event_inj = ldl_phys(env->vm_vmcb +
+        CPUState *cs = CPU(cpu);
+        uint32_t event_inj = ldl_phys(cs->as, env->vm_vmcb +
                                       offsetof(struct vmcb,
                                                control.event_inj));
 
-        stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.event_inj),
+        stl_phys(cs->as,
+                 env->vm_vmcb + offsetof(struct vmcb, control.event_inj),
                  event_inj & ~SVM_EVTINJ_VALID);
     }
 #endif
diff --git a/target-i386/smm_helper.c b/target-i386/smm_helper.c
index 6cb45511b8..71c64b2479 100644
--- a/target-i386/smm_helper.c
+++ b/target-i386/smm_helper.c
@@ -43,6 +43,7 @@ void helper_rsm(CPUX86State *env)
 void do_smm_enter(X86CPU *cpu)
 {
     CPUX86State *env = &cpu->env;
+    CPUState *cs = CPU(cpu);
     target_ulong sm_state;
     SegmentCache *dt;
     int i, offset;
@@ -59,83 +60,83 @@ void do_smm_enter(X86CPU *cpu)
     for (i = 0; i < 6; i++) {
         dt = &env->segs[i];
         offset = 0x7e00 + i * 16;
-        stw_phys(sm_state + offset, dt->selector);
-        stw_phys(sm_state + offset + 2, (dt->flags >> 8) & 0xf0ff);
-        stl_phys(sm_state + offset + 4, dt->limit);
-        stq_phys(sm_state + offset + 8, dt->base);
+        stw_phys(cs->as, sm_state + offset, dt->selector);
+        stw_phys(cs->as, sm_state + offset + 2, (dt->flags >> 8) & 0xf0ff);
+        stl_phys(cs->as, sm_state + offset + 4, dt->limit);
+        stq_phys(cs->as, sm_state + offset + 8, dt->base);
     }
 
-    stq_phys(sm_state + 0x7e68, env->gdt.base);
-    stl_phys(sm_state + 0x7e64, env->gdt.limit);
+    stq_phys(cs->as, sm_state + 0x7e68, env->gdt.base);
+    stl_phys(cs->as, sm_state + 0x7e64, env->gdt.limit);
 
-    stw_phys(sm_state + 0x7e70, env->ldt.selector);
-    stq_phys(sm_state + 0x7e78, env->ldt.base);
-    stl_phys(sm_state + 0x7e74, env->ldt.limit);
-    stw_phys(sm_state + 0x7e72, (env->ldt.flags >> 8) & 0xf0ff);
+    stw_phys(cs->as, sm_state + 0x7e70, env->ldt.selector);
+    stq_phys(cs->as, sm_state + 0x7e78, env->ldt.base);
+    stl_phys(cs->as, sm_state + 0x7e74, env->ldt.limit);
+    stw_phys(cs->as, sm_state + 0x7e72, (env->ldt.flags >> 8) & 0xf0ff);
 
-    stq_phys(sm_state + 0x7e88, env->idt.base);
-    stl_phys(sm_state + 0x7e84, env->idt.limit);
+    stq_phys(cs->as, sm_state + 0x7e88, env->idt.base);
+    stl_phys(cs->as, sm_state + 0x7e84, env->idt.limit);
 
-    stw_phys(sm_state + 0x7e90, env->tr.selector);
-    stq_phys(sm_state + 0x7e98, env->tr.base);
-    stl_phys(sm_state + 0x7e94, env->tr.limit);
-    stw_phys(sm_state + 0x7e92, (env->tr.flags >> 8) & 0xf0ff);
+    stw_phys(cs->as, sm_state + 0x7e90, env->tr.selector);
+    stq_phys(cs->as, sm_state + 0x7e98, env->tr.base);
+    stl_phys(cs->as, sm_state + 0x7e94, env->tr.limit);
+    stw_phys(cs->as, sm_state + 0x7e92, (env->tr.flags >> 8) & 0xf0ff);
 
-    stq_phys(sm_state + 0x7ed0, env->efer);
+    stq_phys(cs->as, sm_state + 0x7ed0, env->efer);
 
-    stq_phys(sm_state + 0x7ff8, env->regs[R_EAX]);
-    stq_phys(sm_state + 0x7ff0, env->regs[R_ECX]);
-    stq_phys(sm_state + 0x7fe8, env->regs[R_EDX]);
-    stq_phys(sm_state + 0x7fe0, env->regs[R_EBX]);
-    stq_phys(sm_state + 0x7fd8, env->regs[R_ESP]);
-    stq_phys(sm_state + 0x7fd0, env->regs[R_EBP]);
-    stq_phys(sm_state + 0x7fc8, env->regs[R_ESI]);
-    stq_phys(sm_state + 0x7fc0, env->regs[R_EDI]);
+    stq_phys(cs->as, sm_state + 0x7ff8, env->regs[R_EAX]);
+    stq_phys(cs->as, sm_state + 0x7ff0, env->regs[R_ECX]);
+    stq_phys(cs->as, sm_state + 0x7fe8, env->regs[R_EDX]);
+    stq_phys(cs->as, sm_state + 0x7fe0, env->regs[R_EBX]);
+    stq_phys(cs->as, sm_state + 0x7fd8, env->regs[R_ESP]);
+    stq_phys(cs->as, sm_state + 0x7fd0, env->regs[R_EBP]);
+    stq_phys(cs->as, sm_state + 0x7fc8, env->regs[R_ESI]);
+    stq_phys(cs->as, sm_state + 0x7fc0, env->regs[R_EDI]);
     for (i = 8; i < 16; i++) {
-        stq_phys(sm_state + 0x7ff8 - i * 8, env->regs[i]);
+        stq_phys(cs->as, sm_state + 0x7ff8 - i * 8, env->regs[i]);
     }
-    stq_phys(sm_state + 0x7f78, env->eip);
-    stl_phys(sm_state + 0x7f70, cpu_compute_eflags(env));
-    stl_phys(sm_state + 0x7f68, env->dr[6]);
-    stl_phys(sm_state + 0x7f60, env->dr[7]);
+    stq_phys(cs->as, sm_state + 0x7f78, env->eip);
+    stl_phys(cs->as, sm_state + 0x7f70, cpu_compute_eflags(env));
+    stl_phys(cs->as, sm_state + 0x7f68, env->dr[6]);
+    stl_phys(cs->as, sm_state + 0x7f60, env->dr[7]);
 
-    stl_phys(sm_state + 0x7f48, env->cr[4]);
-    stl_phys(sm_state + 0x7f50, env->cr[3]);
-    stl_phys(sm_state + 0x7f58, env->cr[0]);
+    stl_phys(cs->as, sm_state + 0x7f48, env->cr[4]);
+    stl_phys(cs->as, sm_state + 0x7f50, env->cr[3]);
+    stl_phys(cs->as, sm_state + 0x7f58, env->cr[0]);
 
-    stl_phys(sm_state + 0x7efc, SMM_REVISION_ID);
-    stl_phys(sm_state + 0x7f00, env->smbase);
+    stl_phys(cs->as, sm_state + 0x7efc, SMM_REVISION_ID);
+    stl_phys(cs->as, sm_state + 0x7f00, env->smbase);
 #else
-    stl_phys(sm_state + 0x7ffc, env->cr[0]);
-    stl_phys(sm_state + 0x7ff8, env->cr[3]);
-    stl_phys(sm_state + 0x7ff4, cpu_compute_eflags(env));
-    stl_phys(sm_state + 0x7ff0, env->eip);
-    stl_phys(sm_state + 0x7fec, env->regs[R_EDI]);
-    stl_phys(sm_state + 0x7fe8, env->regs[R_ESI]);
-    stl_phys(sm_state + 0x7fe4, env->regs[R_EBP]);
-    stl_phys(sm_state + 0x7fe0, env->regs[R_ESP]);
-    stl_phys(sm_state + 0x7fdc, env->regs[R_EBX]);
-    stl_phys(sm_state + 0x7fd8, env->regs[R_EDX]);
-    stl_phys(sm_state + 0x7fd4, env->regs[R_ECX]);
-    stl_phys(sm_state + 0x7fd0, env->regs[R_EAX]);
-    stl_phys(sm_state + 0x7fcc, env->dr[6]);
-    stl_phys(sm_state + 0x7fc8, env->dr[7]);
-
-    stl_phys(sm_state + 0x7fc4, env->tr.selector);
-    stl_phys(sm_state + 0x7f64, env->tr.base);
-    stl_phys(sm_state + 0x7f60, env->tr.limit);
-    stl_phys(sm_state + 0x7f5c, (env->tr.flags >> 8) & 0xf0ff);
-
-    stl_phys(sm_state + 0x7fc0, env->ldt.selector);
-    stl_phys(sm_state + 0x7f80, env->ldt.base);
-    stl_phys(sm_state + 0x7f7c, env->ldt.limit);
-    stl_phys(sm_state + 0x7f78, (env->ldt.flags >> 8) & 0xf0ff);
-
-    stl_phys(sm_state + 0x7f74, env->gdt.base);
-    stl_phys(sm_state + 0x7f70, env->gdt.limit);
-
-    stl_phys(sm_state + 0x7f58, env->idt.base);
-    stl_phys(sm_state + 0x7f54, env->idt.limit);
+    stl_phys(cs->as, sm_state + 0x7ffc, env->cr[0]);
+    stl_phys(cs->as, sm_state + 0x7ff8, env->cr[3]);
+    stl_phys(cs->as, sm_state + 0x7ff4, cpu_compute_eflags(env));
+    stl_phys(cs->as, sm_state + 0x7ff0, env->eip);
+    stl_phys(cs->as, sm_state + 0x7fec, env->regs[R_EDI]);
+    stl_phys(cs->as, sm_state + 0x7fe8, env->regs[R_ESI]);
+    stl_phys(cs->as, sm_state + 0x7fe4, env->regs[R_EBP]);
+    stl_phys(cs->as, sm_state + 0x7fe0, env->regs[R_ESP]);
+    stl_phys(cs->as, sm_state + 0x7fdc, env->regs[R_EBX]);
+    stl_phys(cs->as, sm_state + 0x7fd8, env->regs[R_EDX]);
+    stl_phys(cs->as, sm_state + 0x7fd4, env->regs[R_ECX]);
+    stl_phys(cs->as, sm_state + 0x7fd0, env->regs[R_EAX]);
+    stl_phys(cs->as, sm_state + 0x7fcc, env->dr[6]);
+    stl_phys(cs->as, sm_state + 0x7fc8, env->dr[7]);
+
+    stl_phys(cs->as, sm_state + 0x7fc4, env->tr.selector);
+    stl_phys(cs->as, sm_state + 0x7f64, env->tr.base);
+    stl_phys(cs->as, sm_state + 0x7f60, env->tr.limit);
+    stl_phys(cs->as, sm_state + 0x7f5c, (env->tr.flags >> 8) & 0xf0ff);
+
+    stl_phys(cs->as, sm_state + 0x7fc0, env->ldt.selector);
+    stl_phys(cs->as, sm_state + 0x7f80, env->ldt.base);
+    stl_phys(cs->as, sm_state + 0x7f7c, env->ldt.limit);
+    stl_phys(cs->as, sm_state + 0x7f78, (env->ldt.flags >> 8) & 0xf0ff);
+
+    stl_phys(cs->as, sm_state + 0x7f74, env->gdt.base);
+    stl_phys(cs->as, sm_state + 0x7f70, env->gdt.limit);
+
+    stl_phys(cs->as, sm_state + 0x7f58, env->idt.base);
+    stl_phys(cs->as, sm_state + 0x7f54, env->idt.limit);
 
     for (i = 0; i < 6; i++) {
         dt = &env->segs[i];
@@ -144,15 +145,15 @@ void do_smm_enter(X86CPU *cpu)
         } else {
             offset = 0x7f2c + (i - 3) * 12;
         }
-        stl_phys(sm_state + 0x7fa8 + i * 4, dt->selector);
-        stl_phys(sm_state + offset + 8, dt->base);
-        stl_phys(sm_state + offset + 4, dt->limit);
-        stl_phys(sm_state + offset, (dt->flags >> 8) & 0xf0ff);
+        stl_phys(cs->as, sm_state + 0x7fa8 + i * 4, dt->selector);
+        stl_phys(cs->as, sm_state + offset + 8, dt->base);
+        stl_phys(cs->as, sm_state + offset + 4, dt->limit);
+        stl_phys(cs->as, sm_state + offset, (dt->flags >> 8) & 0xf0ff);
     }
-    stl_phys(sm_state + 0x7f14, env->cr[4]);
+    stl_phys(cs->as, sm_state + 0x7f14, env->cr[4]);
 
-    stl_phys(sm_state + 0x7efc, SMM_REVISION_ID);
-    stl_phys(sm_state + 0x7ef8, env->smbase);
+    stl_phys(cs->as, sm_state + 0x7efc, SMM_REVISION_ID);
+    stl_phys(cs->as, sm_state + 0x7ef8, env->smbase);
 #endif
     /* init SMM cpu state */
 
@@ -180,6 +181,7 @@ void do_smm_enter(X86CPU *cpu)
 
 void helper_rsm(CPUX86State *env)
 {
+    CPUState *cs = ENV_GET_CPU(env);
     X86CPU *cpu = x86_env_get_cpu(env);
     target_ulong sm_state;
     int i, offset;
@@ -187,91 +189,91 @@ void helper_rsm(CPUX86State *env)
 
     sm_state = env->smbase + 0x8000;
 #ifdef TARGET_X86_64
-    cpu_load_efer(env, ldq_phys(sm_state + 0x7ed0));
+    cpu_load_efer(env, ldq_phys(cs->as, sm_state + 0x7ed0));
 
     for (i = 0; i < 6; i++) {
         offset = 0x7e00 + i * 16;
         cpu_x86_load_seg_cache(env, i,
-                               lduw_phys(sm_state + offset),
-                               ldq_phys(sm_state + offset + 8),
-                               ldl_phys(sm_state + offset + 4),
-                               (lduw_phys(sm_state + offset + 2) &
+                               lduw_phys(cs->as, sm_state + offset),
+                               ldq_phys(cs->as, sm_state + offset + 8),
+                               ldl_phys(cs->as, sm_state + offset + 4),
+                               (lduw_phys(cs->as, sm_state + offset + 2) &
                                 0xf0ff) << 8);
     }
 
-    env->gdt.base = ldq_phys(sm_state + 0x7e68);
-    env->gdt.limit = ldl_phys(sm_state + 0x7e64);
-
-    env->ldt.selector = lduw_phys(sm_state + 0x7e70);
-    env->ldt.base = ldq_phys(sm_state + 0x7e78);
-    env->ldt.limit = ldl_phys(sm_state + 0x7e74);
-    env->ldt.flags = (lduw_phys(sm_state + 0x7e72) & 0xf0ff) << 8;
-
-    env->idt.base = ldq_phys(sm_state + 0x7e88);
-    env->idt.limit = ldl_phys(sm_state + 0x7e84);
-
-    env->tr.selector = lduw_phys(sm_state + 0x7e90);
-    env->tr.base = ldq_phys(sm_state + 0x7e98);
-    env->tr.limit = ldl_phys(sm_state + 0x7e94);
-    env->tr.flags = (lduw_phys(sm_state + 0x7e92) & 0xf0ff) << 8;
-
-    env->regs[R_EAX] = ldq_phys(sm_state + 0x7ff8);
-    env->regs[R_ECX] = ldq_phys(sm_state + 0x7ff0);
-    env->regs[R_EDX] = ldq_phys(sm_state + 0x7fe8);
-    env->regs[R_EBX] = ldq_phys(sm_state + 0x7fe0);
-    env->regs[R_ESP] = ldq_phys(sm_state + 0x7fd8);
-    env->regs[R_EBP] = ldq_phys(sm_state + 0x7fd0);
-    env->regs[R_ESI] = ldq_phys(sm_state + 0x7fc8);
-    env->regs[R_EDI] = ldq_phys(sm_state + 0x7fc0);
+    env->gdt.base = ldq_phys(cs->as, sm_state + 0x7e68);
+    env->gdt.limit = ldl_phys(cs->as, sm_state + 0x7e64);
+
+    env->ldt.selector = lduw_phys(cs->as, sm_state + 0x7e70);
+    env->ldt.base = ldq_phys(cs->as, sm_state + 0x7e78);
+    env->ldt.limit = ldl_phys(cs->as, sm_state + 0x7e74);
+    env->ldt.flags = (lduw_phys(cs->as, sm_state + 0x7e72) & 0xf0ff) << 8;
+
+    env->idt.base = ldq_phys(cs->as, sm_state + 0x7e88);
+    env->idt.limit = ldl_phys(cs->as, sm_state + 0x7e84);
+
+    env->tr.selector = lduw_phys(cs->as, sm_state + 0x7e90);
+    env->tr.base = ldq_phys(cs->as, sm_state + 0x7e98);
+    env->tr.limit = ldl_phys(cs->as, sm_state + 0x7e94);
+    env->tr.flags = (lduw_phys(cs->as, sm_state + 0x7e92) & 0xf0ff) << 8;
+
+    env->regs[R_EAX] = ldq_phys(cs->as, sm_state + 0x7ff8);
+    env->regs[R_ECX] = ldq_phys(cs->as, sm_state + 0x7ff0);
+    env->regs[R_EDX] = ldq_phys(cs->as, sm_state + 0x7fe8);
+    env->regs[R_EBX] = ldq_phys(cs->as, sm_state + 0x7fe0);
+    env->regs[R_ESP] = ldq_phys(cs->as, sm_state + 0x7fd8);
+    env->regs[R_EBP] = ldq_phys(cs->as, sm_state + 0x7fd0);
+    env->regs[R_ESI] = ldq_phys(cs->as, sm_state + 0x7fc8);
+    env->regs[R_EDI] = ldq_phys(cs->as, sm_state + 0x7fc0);
     for (i = 8; i < 16; i++) {
-        env->regs[i] = ldq_phys(sm_state + 0x7ff8 - i * 8);
+        env->regs[i] = ldq_phys(cs->as, sm_state + 0x7ff8 - i * 8);
     }
-    env->eip = ldq_phys(sm_state + 0x7f78);
-    cpu_load_eflags(env, ldl_phys(sm_state + 0x7f70),
+    env->eip = ldq_phys(cs->as, sm_state + 0x7f78);
+    cpu_load_eflags(env, ldl_phys(cs->as, sm_state + 0x7f70),
                     ~(CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C | DF_MASK));
-    env->dr[6] = ldl_phys(sm_state + 0x7f68);
-    env->dr[7] = ldl_phys(sm_state + 0x7f60);
+    env->dr[6] = ldl_phys(cs->as, sm_state + 0x7f68);
+    env->dr[7] = ldl_phys(cs->as, sm_state + 0x7f60);
 
-    cpu_x86_update_cr4(env, ldl_phys(sm_state + 0x7f48));
-    cpu_x86_update_cr3(env, ldl_phys(sm_state + 0x7f50));
-    cpu_x86_update_cr0(env, ldl_phys(sm_state + 0x7f58));
+    cpu_x86_update_cr4(env, ldl_phys(cs->as, sm_state + 0x7f48));
+    cpu_x86_update_cr3(env, ldl_phys(cs->as, sm_state + 0x7f50));
+    cpu_x86_update_cr0(env, ldl_phys(cs->as, sm_state + 0x7f58));
 
-    val = ldl_phys(sm_state + 0x7efc); /* revision ID */
+    val = ldl_phys(cs->as, sm_state + 0x7efc); /* revision ID */
     if (val & 0x20000) {
-        env->smbase = ldl_phys(sm_state + 0x7f00) & ~0x7fff;
+        env->smbase = ldl_phys(cs->as, sm_state + 0x7f00) & ~0x7fff;
     }
 #else
-    cpu_x86_update_cr0(env, ldl_phys(sm_state + 0x7ffc));
-    cpu_x86_update_cr3(env, ldl_phys(sm_state + 0x7ff8));
-    cpu_load_eflags(env, ldl_phys(sm_state + 0x7ff4),
+    cpu_x86_update_cr0(env, ldl_phys(cs->as, sm_state + 0x7ffc));
+    cpu_x86_update_cr3(env, ldl_phys(cs->as, sm_state + 0x7ff8));
+    cpu_load_eflags(env, ldl_phys(cs->as, sm_state + 0x7ff4),
                     ~(CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C | DF_MASK));
-    env->eip = ldl_phys(sm_state + 0x7ff0);
-    env->regs[R_EDI] = ldl_phys(sm_state + 0x7fec);
-    env->regs[R_ESI] = ldl_phys(sm_state + 0x7fe8);
-    env->regs[R_EBP] = ldl_phys(sm_state + 0x7fe4);
-    env->regs[R_ESP] = ldl_phys(sm_state + 0x7fe0);
-    env->regs[R_EBX] = ldl_phys(sm_state + 0x7fdc);
-    env->regs[R_EDX] = ldl_phys(sm_state + 0x7fd8);
-    env->regs[R_ECX] = ldl_phys(sm_state + 0x7fd4);
-    env->regs[R_EAX] = ldl_phys(sm_state + 0x7fd0);
-    env->dr[6] = ldl_phys(sm_state + 0x7fcc);
-    env->dr[7] = ldl_phys(sm_state + 0x7fc8);
-
-    env->tr.selector = ldl_phys(sm_state + 0x7fc4) & 0xffff;
-    env->tr.base = ldl_phys(sm_state + 0x7f64);
-    env->tr.limit = ldl_phys(sm_state + 0x7f60);
-    env->tr.flags = (ldl_phys(sm_state + 0x7f5c) & 0xf0ff) << 8;
-
-    env->ldt.selector = ldl_phys(sm_state + 0x7fc0) & 0xffff;
-    env->ldt.base = ldl_phys(sm_state + 0x7f80);
-    env->ldt.limit = ldl_phys(sm_state + 0x7f7c);
-    env->ldt.flags = (ldl_phys(sm_state + 0x7f78) & 0xf0ff) << 8;
-
-    env->gdt.base = ldl_phys(sm_state + 0x7f74);
-    env->gdt.limit = ldl_phys(sm_state + 0x7f70);
-
-    env->idt.base = ldl_phys(sm_state + 0x7f58);
-    env->idt.limit = ldl_phys(sm_state + 0x7f54);
+    env->eip = ldl_phys(cs->as, sm_state + 0x7ff0);
+    env->regs[R_EDI] = ldl_phys(cs->as, sm_state + 0x7fec);
+    env->regs[R_ESI] = ldl_phys(cs->as, sm_state + 0x7fe8);
+    env->regs[R_EBP] = ldl_phys(cs->as, sm_state + 0x7fe4);
+    env->regs[R_ESP] = ldl_phys(cs->as, sm_state + 0x7fe0);
+    env->regs[R_EBX] = ldl_phys(cs->as, sm_state + 0x7fdc);
+    env->regs[R_EDX] = ldl_phys(cs->as, sm_state + 0x7fd8);
+    env->regs[R_ECX] = ldl_phys(cs->as, sm_state + 0x7fd4);
+    env->regs[R_EAX] = ldl_phys(cs->as, sm_state + 0x7fd0);
+    env->dr[6] = ldl_phys(cs->as, sm_state + 0x7fcc);
+    env->dr[7] = ldl_phys(cs->as, sm_state + 0x7fc8);
+
+    env->tr.selector = ldl_phys(cs->as, sm_state + 0x7fc4) & 0xffff;
+    env->tr.base = ldl_phys(cs->as, sm_state + 0x7f64);
+    env->tr.limit = ldl_phys(cs->as, sm_state + 0x7f60);
+    env->tr.flags = (ldl_phys(cs->as, sm_state + 0x7f5c) & 0xf0ff) << 8;
+
+    env->ldt.selector = ldl_phys(cs->as, sm_state + 0x7fc0) & 0xffff;
+    env->ldt.base = ldl_phys(cs->as, sm_state + 0x7f80);
+    env->ldt.limit = ldl_phys(cs->as, sm_state + 0x7f7c);
+    env->ldt.flags = (ldl_phys(cs->as, sm_state + 0x7f78) & 0xf0ff) << 8;
+
+    env->gdt.base = ldl_phys(cs->as, sm_state + 0x7f74);
+    env->gdt.limit = ldl_phys(cs->as, sm_state + 0x7f70);
+
+    env->idt.base = ldl_phys(cs->as, sm_state + 0x7f58);
+    env->idt.limit = ldl_phys(cs->as, sm_state + 0x7f54);
 
     for (i = 0; i < 6; i++) {
         if (i < 3) {
@@ -280,16 +282,18 @@ void helper_rsm(CPUX86State *env)
             offset = 0x7f2c + (i - 3) * 12;
         }
         cpu_x86_load_seg_cache(env, i,
-                               ldl_phys(sm_state + 0x7fa8 + i * 4) & 0xffff,
-                               ldl_phys(sm_state + offset + 8),
-                               ldl_phys(sm_state + offset + 4),
-                               (ldl_phys(sm_state + offset) & 0xf0ff) << 8);
+                               ldl_phys(cs->as,
+                                        sm_state + 0x7fa8 + i * 4) & 0xffff,
+                               ldl_phys(cs->as, sm_state + offset + 8),
+                               ldl_phys(cs->as, sm_state + offset + 4),
+                               (ldl_phys(cs->as,
+                                         sm_state + offset) & 0xf0ff) << 8);
     }
-    cpu_x86_update_cr4(env, ldl_phys(sm_state + 0x7f14));
+    cpu_x86_update_cr4(env, ldl_phys(cs->as, sm_state + 0x7f14));
 
-    val = ldl_phys(sm_state + 0x7efc); /* revision ID */
+    val = ldl_phys(cs->as, sm_state + 0x7efc); /* revision ID */
     if (val & 0x20000) {
-        env->smbase = ldl_phys(sm_state + 0x7ef8) & ~0x7fff;
+        env->smbase = ldl_phys(cs->as, sm_state + 0x7ef8) & ~0x7fff;
     }
 #endif
     CC_OP = CC_OP_EFLAGS;
diff --git a/target-i386/svm_helper.c b/target-i386/svm_helper.c
index 4a7de42b35..b38d45002f 100644
--- a/target-i386/svm_helper.c
+++ b/target-i386/svm_helper.c
@@ -88,25 +88,28 @@ void helper_svm_check_io(CPUX86State *env, uint32_t port, uint32_t param,
 static inline void svm_save_seg(CPUX86State *env, hwaddr addr,
                                 const SegmentCache *sc)
 {
-    stw_phys(addr + offsetof(struct vmcb_seg, selector),
+    CPUState *cs = ENV_GET_CPU(env);
+    stw_phys(cs->as, addr + offsetof(struct vmcb_seg, selector),
              sc->selector);
-    stq_phys(addr + offsetof(struct vmcb_seg, base),
+    stq_phys(cs->as, addr + offsetof(struct vmcb_seg, base),
              sc->base);
-    stl_phys(addr + offsetof(struct vmcb_seg, limit),
+    stl_phys(cs->as, addr + offsetof(struct vmcb_seg, limit),
              sc->limit);
-    stw_phys(addr + offsetof(struct vmcb_seg, attrib),
+    stw_phys(cs->as, addr + offsetof(struct vmcb_seg, attrib),
              ((sc->flags >> 8) & 0xff) | ((sc->flags >> 12) & 0x0f00));
 }
 
 static inline void svm_load_seg(CPUX86State *env, hwaddr addr,
                                 SegmentCache *sc)
 {
+    CPUState *cs = ENV_GET_CPU(env);
     unsigned int flags;
 
-    sc->selector = lduw_phys(addr + offsetof(struct vmcb_seg, selector));
-    sc->base = ldq_phys(addr + offsetof(struct vmcb_seg, base));
-    sc->limit = ldl_phys(addr + offsetof(struct vmcb_seg, limit));
-    flags = lduw_phys(addr + offsetof(struct vmcb_seg, attrib));
+    sc->selector = lduw_phys(cs->as,
+                             addr + offsetof(struct vmcb_seg, selector));
+    sc->base = ldq_phys(cs->as, addr + offsetof(struct vmcb_seg, base));
+    sc->limit = ldl_phys(cs->as, addr + offsetof(struct vmcb_seg, limit));
+    flags = lduw_phys(cs->as, addr + offsetof(struct vmcb_seg, attrib));
     sc->flags = ((flags & 0xff) << 8) | ((flags & 0x0f00) << 12);
 }
 
@@ -122,6 +125,7 @@ static inline void svm_load_seg_cache(CPUX86State *env, hwaddr addr,
 
 void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
 {
+    CPUState *cs = ENV_GET_CPU(env);
     target_ulong addr;
     uint32_t event_inj;
     uint32_t int_ctl;
@@ -139,25 +143,33 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
     env->vm_vmcb = addr;
 
     /* save the current CPU state in the hsave page */
-    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.gdtr.base),
+    stq_phys(cs->as, env->vm_hsave + offsetof(struct vmcb, save.gdtr.base),
              env->gdt.base);
-    stl_phys(env->vm_hsave + offsetof(struct vmcb, save.gdtr.limit),
+    stl_phys(cs->as, env->vm_hsave + offsetof(struct vmcb, save.gdtr.limit),
              env->gdt.limit);
 
-    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.idtr.base),
+    stq_phys(cs->as, env->vm_hsave + offsetof(struct vmcb, save.idtr.base),
              env->idt.base);
-    stl_phys(env->vm_hsave + offsetof(struct vmcb, save.idtr.limit),
+    stl_phys(cs->as, env->vm_hsave + offsetof(struct vmcb, save.idtr.limit),
              env->idt.limit);
 
-    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.cr0), env->cr[0]);
-    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.cr2), env->cr[2]);
-    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.cr3), env->cr[3]);
-    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.cr4), env->cr[4]);
-    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.dr6), env->dr[6]);
-    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.dr7), env->dr[7]);
-
-    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.efer), env->efer);
-    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.rflags),
+    stq_phys(cs->as,
+             env->vm_hsave + offsetof(struct vmcb, save.cr0), env->cr[0]);
+    stq_phys(cs->as,
+             env->vm_hsave + offsetof(struct vmcb, save.cr2), env->cr[2]);
+    stq_phys(cs->as,
+             env->vm_hsave + offsetof(struct vmcb, save.cr3), env->cr[3]);
+    stq_phys(cs->as,
+             env->vm_hsave + offsetof(struct vmcb, save.cr4), env->cr[4]);
+    stq_phys(cs->as,
+             env->vm_hsave + offsetof(struct vmcb, save.dr6), env->dr[6]);
+    stq_phys(cs->as,
+             env->vm_hsave + offsetof(struct vmcb, save.dr7), env->dr[7]);
+
+    stq_phys(cs->as,
+             env->vm_hsave + offsetof(struct vmcb, save.efer), env->efer);
+    stq_phys(cs->as,
+             env->vm_hsave + offsetof(struct vmcb, save.rflags),
              cpu_compute_eflags(env));
 
     svm_save_seg(env, env->vm_hsave + offsetof(struct vmcb, save.es),
@@ -169,28 +181,30 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
     svm_save_seg(env, env->vm_hsave + offsetof(struct vmcb, save.ds),
                  &env->segs[R_DS]);
 
-    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.rip),
+    stq_phys(cs->as, env->vm_hsave + offsetof(struct vmcb, save.rip),
              env->eip + next_eip_addend);
-    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.rsp), env->regs[R_ESP]);
-    stq_phys(env->vm_hsave + offsetof(struct vmcb, save.rax), env->regs[R_EAX]);
+    stq_phys(cs->as,
+             env->vm_hsave + offsetof(struct vmcb, save.rsp), env->regs[R_ESP]);
+    stq_phys(cs->as,
+             env->vm_hsave + offsetof(struct vmcb, save.rax), env->regs[R_EAX]);
 
     /* load the interception bitmaps so we do not need to access the
        vmcb in svm mode */
-    env->intercept = ldq_phys(env->vm_vmcb + offsetof(struct vmcb,
+    env->intercept = ldq_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb,
                                                       control.intercept));
-    env->intercept_cr_read = lduw_phys(env->vm_vmcb +
+    env->intercept_cr_read = lduw_phys(cs->as, env->vm_vmcb +
                                        offsetof(struct vmcb,
                                                 control.intercept_cr_read));
-    env->intercept_cr_write = lduw_phys(env->vm_vmcb +
+    env->intercept_cr_write = lduw_phys(cs->as, env->vm_vmcb +
                                         offsetof(struct vmcb,
                                                  control.intercept_cr_write));
-    env->intercept_dr_read = lduw_phys(env->vm_vmcb +
+    env->intercept_dr_read = lduw_phys(cs->as, env->vm_vmcb +
                                        offsetof(struct vmcb,
                                                 control.intercept_dr_read));
-    env->intercept_dr_write = lduw_phys(env->vm_vmcb +
+    env->intercept_dr_write = lduw_phys(cs->as, env->vm_vmcb +
                                         offsetof(struct vmcb,
                                                  control.intercept_dr_write));
-    env->intercept_exceptions = ldl_phys(env->vm_vmcb +
+    env->intercept_exceptions = ldl_phys(cs->as, env->vm_vmcb +
                                          offsetof(struct vmcb,
                                                   control.intercept_exceptions
                                                   ));
@@ -198,30 +212,36 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
     /* enable intercepts */
     env->hflags |= HF_SVMI_MASK;
 
-    env->tsc_offset = ldq_phys(env->vm_vmcb +
+    env->tsc_offset = ldq_phys(cs->as, env->vm_vmcb +
                                offsetof(struct vmcb, control.tsc_offset));
 
-    env->gdt.base  = ldq_phys(env->vm_vmcb + offsetof(struct vmcb,
+    env->gdt.base  = ldq_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb,
                                                       save.gdtr.base));
-    env->gdt.limit = ldl_phys(env->vm_vmcb + offsetof(struct vmcb,
+    env->gdt.limit = ldl_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb,
                                                       save.gdtr.limit));
 
-    env->idt.base  = ldq_phys(env->vm_vmcb + offsetof(struct vmcb,
+    env->idt.base  = ldq_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb,
                                                       save.idtr.base));
-    env->idt.limit = ldl_phys(env->vm_vmcb + offsetof(struct vmcb,
+    env->idt.limit = ldl_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb,
                                                       save.idtr.limit));
 
     /* clear exit_info_2 so we behave like the real hardware */
-    stq_phys(env->vm_vmcb + offsetof(struct vmcb, control.exit_info_2), 0);
+    stq_phys(cs->as,
+             env->vm_vmcb + offsetof(struct vmcb, control.exit_info_2), 0);
 
-    cpu_x86_update_cr0(env, ldq_phys(env->vm_vmcb + offsetof(struct vmcb,
+    cpu_x86_update_cr0(env, ldq_phys(cs->as,
+                                     env->vm_vmcb + offsetof(struct vmcb,
                                                              save.cr0)));
-    cpu_x86_update_cr4(env, ldq_phys(env->vm_vmcb + offsetof(struct vmcb,
+    cpu_x86_update_cr4(env, ldq_phys(cs->as,
+                                     env->vm_vmcb + offsetof(struct vmcb,
                                                              save.cr4)));
-    cpu_x86_update_cr3(env, ldq_phys(env->vm_vmcb + offsetof(struct vmcb,
+    cpu_x86_update_cr3(env, ldq_phys(cs->as,
+                                     env->vm_vmcb + offsetof(struct vmcb,
                                                              save.cr3)));
-    env->cr[2] = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.cr2));
-    int_ctl = ldl_phys(env->vm_vmcb + offsetof(struct vmcb, control.int_ctl));
+    env->cr[2] = ldq_phys(cs->as,
+                          env->vm_vmcb + offsetof(struct vmcb, save.cr2));
+    int_ctl = ldl_phys(cs->as,
+                       env->vm_vmcb + offsetof(struct vmcb, control.int_ctl));
     env->hflags2 &= ~(HF2_HIF_MASK | HF2_VINTR_MASK);
     if (int_ctl & V_INTR_MASKING_MASK) {
         env->v_tpr = int_ctl & V_TPR_MASK;
@@ -232,9 +252,11 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
     }
 
     cpu_load_efer(env,
-                  ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.efer)));
+                  ldq_phys(cs->as,
+                           env->vm_vmcb + offsetof(struct vmcb, save.efer)));
     env->eflags = 0;
-    cpu_load_eflags(env, ldq_phys(env->vm_vmcb + offsetof(struct vmcb,
+    cpu_load_eflags(env, ldq_phys(cs->as,
+                                  env->vm_vmcb + offsetof(struct vmcb,
                                                           save.rflags)),
                     ~(CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C | DF_MASK));
     CC_OP = CC_OP_EFLAGS;
@@ -248,18 +270,25 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
     svm_load_seg_cache(env, env->vm_vmcb + offsetof(struct vmcb, save.ds),
                        R_DS);
 
-    env->eip = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rip));
-
-    env->regs[R_ESP] = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rsp));
-    env->regs[R_EAX] = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rax));
-    env->dr[7] = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.dr7));
-    env->dr[6] = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, save.dr6));
-    cpu_x86_set_cpl(env, ldub_phys(env->vm_vmcb + offsetof(struct vmcb,
+    env->eip = ldq_phys(cs->as,
+                        env->vm_vmcb + offsetof(struct vmcb, save.rip));
+
+    env->regs[R_ESP] = ldq_phys(cs->as,
+                                env->vm_vmcb + offsetof(struct vmcb, save.rsp));
+    env->regs[R_EAX] = ldq_phys(cs->as,
+                                env->vm_vmcb + offsetof(struct vmcb, save.rax));
+    env->dr[7] = ldq_phys(cs->as,
+                          env->vm_vmcb + offsetof(struct vmcb, save.dr7));
+    env->dr[6] = ldq_phys(cs->as,
+                          env->vm_vmcb + offsetof(struct vmcb, save.dr6));
+    cpu_x86_set_cpl(env, ldub_phys(cs->as,
+                                   env->vm_vmcb + offsetof(struct vmcb,
                                                            save.cpl)));
 
     /* FIXME: guest state consistency checks */
 
-    switch (ldub_phys(env->vm_vmcb + offsetof(struct vmcb, control.tlb_ctl))) {
+    switch (ldub_phys(cs->as,
+                      env->vm_vmcb + offsetof(struct vmcb, control.tlb_ctl))) {
     case TLB_CONTROL_DO_NOTHING:
         break;
     case TLB_CONTROL_FLUSH_ALL_ASID:
@@ -277,12 +306,12 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
     }
 
     /* maybe we need to inject an event */
-    event_inj = ldl_phys(env->vm_vmcb + offsetof(struct vmcb,
+    event_inj = ldl_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb,
                                                  control.event_inj));
     if (event_inj & SVM_EVTINJ_VALID) {
         uint8_t vector = event_inj & SVM_EVTINJ_VEC_MASK;
         uint16_t valid_err = event_inj & SVM_EVTINJ_VALID_ERR;
-        uint32_t event_inj_err = ldl_phys(env->vm_vmcb +
+        uint32_t event_inj_err = ldl_phys(cs->as, env->vm_vmcb +
                                           offsetof(struct vmcb,
                                                    control.event_inj_err));
 
@@ -336,6 +365,7 @@ void helper_vmmcall(CPUX86State *env)
 
 void helper_vmload(CPUX86State *env, int aflag)
 {
+    CPUState *cs = ENV_GET_CPU(env);
     target_ulong addr;
 
     cpu_svm_check_intercept_param(env, SVM_EXIT_VMLOAD, 0);
@@ -348,7 +378,7 @@ void helper_vmload(CPUX86State *env, int aflag)
 
     qemu_log_mask(CPU_LOG_TB_IN_ASM, "vmload! " TARGET_FMT_lx
                   "\nFS: %016" PRIx64 " | " TARGET_FMT_lx "\n",
-                  addr, ldq_phys(addr + offsetof(struct vmcb,
+                  addr, ldq_phys(cs->as, addr + offsetof(struct vmcb,
                                                           save.fs.base)),
                   env->segs[R_FS].base);
 
@@ -358,22 +388,24 @@ void helper_vmload(CPUX86State *env, int aflag)
     svm_load_seg(env, addr + offsetof(struct vmcb, save.ldtr), &env->ldt);
 
 #ifdef TARGET_X86_64
-    env->kernelgsbase = ldq_phys(addr + offsetof(struct vmcb,
+    env->kernelgsbase = ldq_phys(cs->as, addr + offsetof(struct vmcb,
                                                  save.kernel_gs_base));
-    env->lstar = ldq_phys(addr + offsetof(struct vmcb, save.lstar));
-    env->cstar = ldq_phys(addr + offsetof(struct vmcb, save.cstar));
-    env->fmask = ldq_phys(addr + offsetof(struct vmcb, save.sfmask));
+    env->lstar = ldq_phys(cs->as, addr + offsetof(struct vmcb, save.lstar));
+    env->cstar = ldq_phys(cs->as, addr + offsetof(struct vmcb, save.cstar));
+    env->fmask = ldq_phys(cs->as, addr + offsetof(struct vmcb, save.sfmask));
 #endif
-    env->star = ldq_phys(addr + offsetof(struct vmcb, save.star));
-    env->sysenter_cs = ldq_phys(addr + offsetof(struct vmcb, save.sysenter_cs));
-    env->sysenter_esp = ldq_phys(addr + offsetof(struct vmcb,
+    env->star = ldq_phys(cs->as, addr + offsetof(struct vmcb, save.star));
+    env->sysenter_cs = ldq_phys(cs->as,
+                                addr + offsetof(struct vmcb, save.sysenter_cs));
+    env->sysenter_esp = ldq_phys(cs->as, addr + offsetof(struct vmcb,
                                                  save.sysenter_esp));
-    env->sysenter_eip = ldq_phys(addr + offsetof(struct vmcb,
+    env->sysenter_eip = ldq_phys(cs->as, addr + offsetof(struct vmcb,
                                                  save.sysenter_eip));
 }
 
 void helper_vmsave(CPUX86State *env, int aflag)
 {
+    CPUState *cs = ENV_GET_CPU(env);
     target_ulong addr;
 
     cpu_svm_check_intercept_param(env, SVM_EXIT_VMSAVE, 0);
@@ -386,7 +418,8 @@ void helper_vmsave(CPUX86State *env, int aflag)
 
     qemu_log_mask(CPU_LOG_TB_IN_ASM, "vmsave! " TARGET_FMT_lx
                   "\nFS: %016" PRIx64 " | " TARGET_FMT_lx "\n",
-                  addr, ldq_phys(addr + offsetof(struct vmcb, save.fs.base)),
+                  addr, ldq_phys(cs->as,
+                                 addr + offsetof(struct vmcb, save.fs.base)),
                   env->segs[R_FS].base);
 
     svm_save_seg(env, addr + offsetof(struct vmcb, save.fs),
@@ -399,17 +432,18 @@ void helper_vmsave(CPUX86State *env, int aflag)
                  &env->ldt);
 
 #ifdef TARGET_X86_64
-    stq_phys(addr + offsetof(struct vmcb, save.kernel_gs_base),
+    stq_phys(cs->as, addr + offsetof(struct vmcb, save.kernel_gs_base),
              env->kernelgsbase);
-    stq_phys(addr + offsetof(struct vmcb, save.lstar), env->lstar);
-    stq_phys(addr + offsetof(struct vmcb, save.cstar), env->cstar);
-    stq_phys(addr + offsetof(struct vmcb, save.sfmask), env->fmask);
+    stq_phys(cs->as, addr + offsetof(struct vmcb, save.lstar), env->lstar);
+    stq_phys(cs->as, addr + offsetof(struct vmcb, save.cstar), env->cstar);
+    stq_phys(cs->as, addr + offsetof(struct vmcb, save.sfmask), env->fmask);
 #endif
-    stq_phys(addr + offsetof(struct vmcb, save.star), env->star);
-    stq_phys(addr + offsetof(struct vmcb, save.sysenter_cs), env->sysenter_cs);
-    stq_phys(addr + offsetof(struct vmcb, save.sysenter_esp),
+    stq_phys(cs->as, addr + offsetof(struct vmcb, save.star), env->star);
+    stq_phys(cs->as,
+             addr + offsetof(struct vmcb, save.sysenter_cs), env->sysenter_cs);
+    stq_phys(cs->as, addr + offsetof(struct vmcb, save.sysenter_esp),
              env->sysenter_esp);
-    stq_phys(addr + offsetof(struct vmcb, save.sysenter_eip),
+    stq_phys(cs->as, addr + offsetof(struct vmcb, save.sysenter_eip),
              env->sysenter_eip);
 }
 
@@ -452,6 +486,8 @@ void helper_invlpga(CPUX86State *env, int aflag)
 void helper_svm_check_intercept_param(CPUX86State *env, uint32_t type,
                                       uint64_t param)
 {
+    CPUState *cs = ENV_GET_CPU(env);
+
     if (likely(!(env->hflags & HF_SVMI_MASK))) {
         return;
     }
@@ -484,7 +520,7 @@ void helper_svm_check_intercept_param(CPUX86State *env, uint32_t type,
     case SVM_EXIT_MSR:
         if (env->intercept & (1ULL << (SVM_EXIT_MSR - SVM_EXIT_INTR))) {
             /* FIXME: this should be read in at vmrun (faster this way?) */
-            uint64_t addr = ldq_phys(env->vm_vmcb +
+            uint64_t addr = ldq_phys(cs->as, env->vm_vmcb +
                                      offsetof(struct vmcb,
                                               control.msrpm_base_pa));
             uint32_t t0, t1;
@@ -510,7 +546,7 @@ void helper_svm_check_intercept_param(CPUX86State *env, uint32_t type,
                 t1 = 0;
                 break;
             }
-            if (ldub_phys(addr + t1) & ((1 << param) << t0)) {
+            if (ldub_phys(cs->as, addr + t1) & ((1 << param) << t0)) {
                 helper_vmexit(env, type, param);
             }
         }
@@ -532,15 +568,17 @@ void cpu_svm_check_intercept_param(CPUX86State *env, uint32_t type,
 void helper_svm_check_io(CPUX86State *env, uint32_t port, uint32_t param,
                          uint32_t next_eip_addend)
 {
+    CPUState *cs = ENV_GET_CPU(env);
     if (env->intercept & (1ULL << (SVM_EXIT_IOIO - SVM_EXIT_INTR))) {
         /* FIXME: this should be read in at vmrun (faster this way?) */
-        uint64_t addr = ldq_phys(env->vm_vmcb +
+        uint64_t addr = ldq_phys(cs->as, env->vm_vmcb +
                                  offsetof(struct vmcb, control.iopm_base_pa));
         uint16_t mask = (1 << ((param >> 4) & 7)) - 1;
 
-        if (lduw_phys(addr + port / 8) & (mask << (port & 7))) {
+        if (lduw_phys(cs->as, addr + port / 8) & (mask << (port & 7))) {
             /* next env->eip */
-            stq_phys(env->vm_vmcb + offsetof(struct vmcb, control.exit_info_2),
+            stq_phys(cs->as,
+                     env->vm_vmcb + offsetof(struct vmcb, control.exit_info_2),
                      env->eip + next_eip_addend);
             helper_vmexit(env, SVM_EXIT_IOIO, param | (port << 16));
         }
@@ -556,16 +594,18 @@ void helper_vmexit(CPUX86State *env, uint32_t exit_code, uint64_t exit_info_1)
     qemu_log_mask(CPU_LOG_TB_IN_ASM, "vmexit(%08x, %016" PRIx64 ", %016"
                   PRIx64 ", " TARGET_FMT_lx ")!\n",
                   exit_code, exit_info_1,
-                  ldq_phys(env->vm_vmcb + offsetof(struct vmcb,
+                  ldq_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb,
                                                    control.exit_info_2)),
                   env->eip);
 
     if (env->hflags & HF_INHIBIT_IRQ_MASK) {
-        stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.int_state),
+        stl_phys(cs->as,
+                 env->vm_vmcb + offsetof(struct vmcb, control.int_state),
                  SVM_INTERRUPT_SHADOW_MASK);
         env->hflags &= ~HF_INHIBIT_IRQ_MASK;
     } else {
-        stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.int_state), 0);
+        stl_phys(cs->as,
+                 env->vm_vmcb + offsetof(struct vmcb, control.int_state), 0);
     }
 
     /* Save the VM state in the vmcb */
@@ -578,39 +618,50 @@ void helper_vmexit(CPUX86State *env, uint32_t exit_code, uint64_t exit_info_1)
     svm_save_seg(env, env->vm_vmcb + offsetof(struct vmcb, save.ds),
                  &env->segs[R_DS]);
 
-    stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.gdtr.base),
+    stq_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb, save.gdtr.base),
              env->gdt.base);
-    stl_phys(env->vm_vmcb + offsetof(struct vmcb, save.gdtr.limit),
+    stl_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb, save.gdtr.limit),
              env->gdt.limit);
 
-    stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.idtr.base),
+    stq_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb, save.idtr.base),
              env->idt.base);
-    stl_phys(env->vm_vmcb + offsetof(struct vmcb, save.idtr.limit),
+    stl_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb, save.idtr.limit),
              env->idt.limit);
 
-    stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.efer), env->efer);
-    stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.cr0), env->cr[0]);
-    stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.cr2), env->cr[2]);
-    stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.cr3), env->cr[3]);
-    stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.cr4), env->cr[4]);
-
-    int_ctl = ldl_phys(env->vm_vmcb + offsetof(struct vmcb, control.int_ctl));
+    stq_phys(cs->as,
+             env->vm_vmcb + offsetof(struct vmcb, save.efer), env->efer);
+    stq_phys(cs->as,
+             env->vm_vmcb + offsetof(struct vmcb, save.cr0), env->cr[0]);
+    stq_phys(cs->as,
+             env->vm_vmcb + offsetof(struct vmcb, save.cr2), env->cr[2]);
+    stq_phys(cs->as,
+             env->vm_vmcb + offsetof(struct vmcb, save.cr3), env->cr[3]);
+    stq_phys(cs->as,
+             env->vm_vmcb + offsetof(struct vmcb, save.cr4), env->cr[4]);
+
+    int_ctl = ldl_phys(cs->as,
+                       env->vm_vmcb + offsetof(struct vmcb, control.int_ctl));
     int_ctl &= ~(V_TPR_MASK | V_IRQ_MASK);
     int_ctl |= env->v_tpr & V_TPR_MASK;
     if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) {
         int_ctl |= V_IRQ_MASK;
     }
-    stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.int_ctl), int_ctl);
+    stl_phys(cs->as,
+             env->vm_vmcb + offsetof(struct vmcb, control.int_ctl), int_ctl);
 
-    stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rflags),
+    stq_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb, save.rflags),
              cpu_compute_eflags(env));
-    stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rip),
+    stq_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb, save.rip),
              env->eip);
-    stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rsp), env->regs[R_ESP]);
-    stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.rax), env->regs[R_EAX]);
-    stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.dr7), env->dr[7]);
-    stq_phys(env->vm_vmcb + offsetof(struct vmcb, save.dr6), env->dr[6]);
-    stb_phys(env->vm_vmcb + offsetof(struct vmcb, save.cpl),
+    stq_phys(cs->as,
+             env->vm_vmcb + offsetof(struct vmcb, save.rsp), env->regs[R_ESP]);
+    stq_phys(cs->as,
+             env->vm_vmcb + offsetof(struct vmcb, save.rax), env->regs[R_EAX]);
+    stq_phys(cs->as,
+             env->vm_vmcb + offsetof(struct vmcb, save.dr7), env->dr[7]);
+    stq_phys(cs->as,
+             env->vm_vmcb + offsetof(struct vmcb, save.dr6), env->dr[6]);
+    stb_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb, save.cpl),
              env->hflags & HF_CPL_MASK);
 
     /* Reload the host state from vm_hsave */
@@ -621,29 +672,33 @@ void helper_vmexit(CPUX86State *env, uint32_t exit_code, uint64_t exit_info_1)
     cs->interrupt_request &= ~CPU_INTERRUPT_VIRQ;
     env->tsc_offset = 0;
 
-    env->gdt.base  = ldq_phys(env->vm_hsave + offsetof(struct vmcb,
+    env->gdt.base  = ldq_phys(cs->as, env->vm_hsave + offsetof(struct vmcb,
                                                        save.gdtr.base));
-    env->gdt.limit = ldl_phys(env->vm_hsave + offsetof(struct vmcb,
+    env->gdt.limit = ldl_phys(cs->as, env->vm_hsave + offsetof(struct vmcb,
                                                        save.gdtr.limit));
 
-    env->idt.base  = ldq_phys(env->vm_hsave + offsetof(struct vmcb,
+    env->idt.base  = ldq_phys(cs->as, env->vm_hsave + offsetof(struct vmcb,
                                                        save.idtr.base));
-    env->idt.limit = ldl_phys(env->vm_hsave + offsetof(struct vmcb,
+    env->idt.limit = ldl_phys(cs->as, env->vm_hsave + offsetof(struct vmcb,
                                                        save.idtr.limit));
 
-    cpu_x86_update_cr0(env, ldq_phys(env->vm_hsave + offsetof(struct vmcb,
+    cpu_x86_update_cr0(env, ldq_phys(cs->as,
+                                     env->vm_hsave + offsetof(struct vmcb,
                                                               save.cr0)) |
                        CR0_PE_MASK);
-    cpu_x86_update_cr4(env, ldq_phys(env->vm_hsave + offsetof(struct vmcb,
+    cpu_x86_update_cr4(env, ldq_phys(cs->as,
+                                     env->vm_hsave + offsetof(struct vmcb,
                                                               save.cr4)));
-    cpu_x86_update_cr3(env, ldq_phys(env->vm_hsave + offsetof(struct vmcb,
+    cpu_x86_update_cr3(env, ldq_phys(cs->as,
+                                     env->vm_hsave + offsetof(struct vmcb,
                                                               save.cr3)));
     /* we need to set the efer after the crs so the hidden flags get
        set properly */
-    cpu_load_efer(env, ldq_phys(env->vm_hsave + offsetof(struct vmcb,
+    cpu_load_efer(env, ldq_phys(cs->as, env->vm_hsave + offsetof(struct vmcb,
                                                          save.efer)));
     env->eflags = 0;
-    cpu_load_eflags(env, ldq_phys(env->vm_hsave + offsetof(struct vmcb,
+    cpu_load_eflags(env, ldq_phys(cs->as,
+                                  env->vm_hsave + offsetof(struct vmcb,
                                                            save.rflags)),
                     ~(CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C | DF_MASK));
     CC_OP = CC_OP_EFLAGS;
@@ -657,29 +712,35 @@ void helper_vmexit(CPUX86State *env, uint32_t exit_code, uint64_t exit_info_1)
     svm_load_seg_cache(env, env->vm_hsave + offsetof(struct vmcb, save.ds),
                        R_DS);
 
-    env->eip = ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.rip));
-    env->regs[R_ESP] = ldq_phys(env->vm_hsave +
+    env->eip = ldq_phys(cs->as,
+                        env->vm_hsave + offsetof(struct vmcb, save.rip));
+    env->regs[R_ESP] = ldq_phys(cs->as, env->vm_hsave +
                                 offsetof(struct vmcb, save.rsp));
-    env->regs[R_EAX] = ldq_phys(env->vm_hsave +
+    env->regs[R_EAX] = ldq_phys(cs->as, env->vm_hsave +
                                 offsetof(struct vmcb, save.rax));
 
-    env->dr[6] = ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.dr6));
-    env->dr[7] = ldq_phys(env->vm_hsave + offsetof(struct vmcb, save.dr7));
+    env->dr[6] = ldq_phys(cs->as,
+                          env->vm_hsave + offsetof(struct vmcb, save.dr6));
+    env->dr[7] = ldq_phys(cs->as,
+                          env->vm_hsave + offsetof(struct vmcb, save.dr7));
 
     /* other setups */
     cpu_x86_set_cpl(env, 0);
-    stq_phys(env->vm_vmcb + offsetof(struct vmcb, control.exit_code),
+    stq_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb, control.exit_code),
              exit_code);
-    stq_phys(env->vm_vmcb + offsetof(struct vmcb, control.exit_info_1),
+    stq_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb, control.exit_info_1),
              exit_info_1);
 
-    stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.exit_int_info),
-             ldl_phys(env->vm_vmcb + offsetof(struct vmcb,
+    stl_phys(cs->as,
+             env->vm_vmcb + offsetof(struct vmcb, control.exit_int_info),
+             ldl_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb,
                                               control.event_inj)));
-    stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.exit_int_info_err),
-             ldl_phys(env->vm_vmcb + offsetof(struct vmcb,
+    stl_phys(cs->as,
+             env->vm_vmcb + offsetof(struct vmcb, control.exit_int_info_err),
+             ldl_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb,
                                               control.event_inj_err)));
-    stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.event_inj), 0);
+    stl_phys(cs->as,
+             env->vm_vmcb + offsetof(struct vmcb, control.event_inj), 0);
 
     env->hflags2 &= ~HF2_GIF_MASK;
     /* FIXME: Resets the current ASID register to zero (host ASID). */