sys: improve kvm description

Allow fuzzer to change types of segment descriptors.
Alter more flags.
Allow fuzzer to do a random vmwrite.

6 files changed, 268 insertions, 134 deletions

diff --git a/csource/common.go b/csource/common.go
index b1e058794..2fbe81ec8 100644
--- a/csource/common.go
+++ b/csource/common.go
@@ -372,7 +372,7 @@ const char kvm_asm32_vm86[] = "\x66\xb8\xb8\x00\x0f\x00\xd8\xea\x00\x00\x00\x00\
 const char kvm_asm32_paged_vm86[] = "\x0f\x20\xc0\x0d\x00\x00\x00\x80\x0f\x22\xc0\x66\xb8\xb8\x00\x0f\x00\xd8\xea\x00\x00\x00\x00\xd0\x00";
 const char kvm_asm64_vm86[] = "\x0f\x20\xc0\x0d\x00\x00\x00\x80\x0f\x22\xc0\x66\xb8\xb8\x00\x0f\x00\xd8\xea\x00\x00\x00\x00\xd0\x00";
 const char kvm_asm64_enable_long[] = "\x0f\x20\xc0\x0d\x00\x00\x00\x80\x0f\x22\xc0\xea\xde\xc0\xad\x0b\x50\x00\x48\xc7\xc0\xd8\x00\x00\x00\x0f\x00\xd8";
-const char kvm_asm64_init_vm[] = "\x0f\x20\xc0\x0d\x00\x00\x00\x80\x0f\x22\xc0\xea\xde\xc0\xad\x0b\x50\x00\x48\xc7\xc0\xd8\x00\x00\x00\x0f\x00\xd8\x48\xc7\xc1\x3a\x00\x00\x00\x0f\x32\x48\x83\xc8\x05\x0f\x30\x0f\x20\xe0\x48\x0d\x00\x20\x00\x00\x0f\x22\xe0\x48\xc7\xc1\x80\x04\x00\x00\x0f\x32\x48\xc7\xc2\x00\x60\x00\x00\x89\x02\x48\xc7\xc2\x00\x70\x00\x00\x89\x02\x48\xc7\xc0\x00\x5f\x00\x00\xf3\x0f\xc7\x30\x48\xc7\xc0\x08\x5f\x00\x00\x66\x0f\xc7\x30\x0f\xc7\x30\x48\xc7\xc1\x81\x04\x00\x00\x0f\x32\x48\x83\xc8\x3f\x48\x21\xd0\x48\xc7\xc2\x00\x40\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x02\x40\x00\x00\x48\xb8\x84\x9e\x99\xf3\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x1e\x40\x00\x00\x48\xc7\xc0\x81\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc1\x83\x04\x00\x00\x0f\x32\x48\x0d\xff\x6f\x03\x00\x48\x21\xd0\x48\xc7\xc2\x0c\x40\x00\x00\x0f\x79\xd0\x48\xc7\xc1\x84\x04\x00\x00\x0f\x32\x48\x0d\xff\x17\x00\x00\x48\x21\xd0\x48\xc7\xc2\x12\x40\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x04\x2c\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x00\x28\x00\x00\x48\xc7\xc0\xff\xff\xff\xff\x0f\x79\xd0\x48\xc7\xc2\x02\x0c\x00\x00\x48\xc7\xc0\x50\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc0\x58\x00\x00\x00\x48\xc7\xc2\x00\x0c\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x04\x0c\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x06\x0c\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x08\x0c\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0a\x0c\x00\x00\x0f\x79\xd0\x48\xc7\xc0\xd8\x00\x00\x00\x48\xc7\xc2\x0c\x0c\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x02\x2c\x00\x00\x48\xc7\xc0\x00\x05\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x00\x4c\x00\x00\x48\xc7\xc0\x50\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x10\x6c\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x12\x6c\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x0f\x20\xc0\x48\xc7\xc2\x00\x6c\x00\x00\x48\x89\xc0\x0f\x79\xd0\x0f\x20\xd8\x48\xc7\xc2\x02\x6c\x00\x00\x48\x89\xc0\x0f\x79\xd0\x0f\x20\xe0\x48\xc7\xc2\x04\x6c\x00\x00\x48\x89\xc0\x0f\x79\xd0\x48\xc7\xc2\x06\x6c\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x08\x6c\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0a\x6c\x00\x00\x48\xc7\xc0\x00\x3a\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0c\x6c\x00\x00\x48\xc7\xc0\x00\x10\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0e\x6c\x00\x00\x48\xc7\xc0\x00\x38\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x14\x6c\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x16\x6c\x00\x00\x48\x8b\x04\x25\x10\x5f\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x00\x00\x00\x00\x48\xc7\xc0\x01\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x02\x00\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x00\x20\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x02\x20\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x04\x20\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x06\x20\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc1\x77\x02\x00\x00\x0f\x32\x48\xc1\xe2\x20\x48\x09\xd0\x48\xc7\xc2\x00\x2c\x00\x00\x48\x89\xc0\x0f\x79\xd0\x48\xc7\xc2\x04\x40\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0a\x40\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0e\x40\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x10\x40\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x16\x40\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x14\x40\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x00\x60\x00\x00\x48\xc7\xc0\xff\xff\xff\xff\x0f\x79\xd0\x48\xc7\xc2\x02\x60\x00\x00\x48\xc7\xc0\xff\xff\xff\xff\x0f\x79\xd0\x48\xc7\xc2\x1c\x20\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x1e\x20\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x20\x20\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x22\x20\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x00\x08\x00\x00\x48\xc7\xc0\x58\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x02\x08\x00\x00\x48\xc7\xc0\x50\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x04\x08\x00\x00\x48\xc7\xc0\x58\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x06\x08\x00\x00\x48\xc7\xc0\x58\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x08\x08\x00\x00\x48\xc7\xc0\x58\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0a\x08\x00\x00\x48\xc7\xc0\x58\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0c\x08\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0e\x08\x00\x00\x48\xc7\xc0\xd8\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x12\x68\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x14\x68\x00\x00\x48\xc7\xc0\x00\x3a\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x16\x68\x00\x00\x48\xc7\xc0\x00\x10\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x18\x68\x00\x00\x48\xc7\xc0\x00\x38\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x00\x48\x00\x00\x48\xc7\xc0\xff\xff\x0f\x00\x0f\x79\xd0\x48\xc7\xc2\x02\x48\x00\x00\x48\xc7\xc0\xff\xff\x0f\x00\x0f\x79\xd0\x48\xc7\xc2\x04\x48\x00\x00\x48\xc7\xc0\xff\xff\x0f\x00\x0f\x79\xd0\x48\xc7\xc2\x06\x48\x00\x00\x48\xc7\xc0\xff\xff\x0f\x00\x0f\x79\xd0\x48\xc7\xc2\x08\x48\x00\x00\x48\xc7\xc0\xff\xff\x0f\x00\x0f\x79\xd0\x48\xc7\xc2\x0a\x48\x00\x00\x48\xc7\xc0\xff\xff\x0f\x00\x0f\x79\xd0\x48\xc7\xc2\x0c\x48\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0e\x48\x00\x00\x48\xc7\xc0\xff\x1f\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x10\x48\x00\x00\x48\xc7\xc0\xff\x1f\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x12\x48\x00\x00\x48\xc7\xc0\xff\x1f\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x14\x48\x00\x00\x48\xc7\xc0\x93\x40\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x16\x48\x00\x00\x48\xc7\xc0\x9b\x20\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x18\x48\x00\x00\x48\xc7\xc0\x93\x40\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x1a\x48\x00\x00\x48\xc7\xc0\x93\x40\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x1c\x48\x00\x00\x48\xc7\xc0\x93\x40\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x1e\x48\x00\x00\x48\xc7\xc0\x93\x40\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x20\x48\x00\x00\x48\xc7\xc0\x82\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x22\x48\x00\x00\x48\xc7\xc0\x8b\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x1c\x68\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x1e\x68\x00\x00\x48\xc7\xc0\x00\x91\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x20\x68\x00\x00\x48\xc7\xc0\x02\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x06\x28\x00\x00\x48\xc7\xc0\x00\x05\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0a\x28\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0c\x28\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0e\x28\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x10\x28\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x0f\x20\xc0\x48\xc7\xc2\x00\x68\x00\x00\x48\x89\xc0\x0f\x79\xd0\x0f\x20\xd8\x48\xc7\xc2\x02\x68\x00\x00\x48\x89\xc0\x0f\x79\xd0\x0f\x20\xe0\x48\xc7\xc2\x04\x68\x00\x00\x48\x89\xc0\x0f\x79\xd0\x0f\x01\xc2\x48\xc7\xc2\x00\x44\x00\x00\x0f\x78\xd0\xf4";
+const char kvm_asm64_init_vm[] = "\x0f\x20\xc0\x0d\x00\x00\x00\x80\x0f\x22\xc0\xea\xde\xc0\xad\x0b\x50\x00\x48\xc7\xc0\xd8\x00\x00\x00\x0f\x00\xd8\x48\xc7\xc1\x3a\x00\x00\x00\x0f\x32\x48\x83\xc8\x05\x0f\x30\x0f\x20\xe0\x48\x0d\x00\x20\x00\x00\x0f\x22\xe0\x48\xc7\xc1\x80\x04\x00\x00\x0f\x32\x48\xc7\xc2\x00\x60\x00\x00\x89\x02\x48\xc7\xc2\x00\x70\x00\x00\x89\x02\x48\xc7\xc0\x00\x5f\x00\x00\xf3\x0f\xc7\x30\x48\xc7\xc0\x08\x5f\x00\x00\x66\x0f\xc7\x30\x0f\xc7\x30\x48\xc7\xc1\x81\x04\x00\x00\x0f\x32\x48\x83\xc8\x3f\x48\x21\xd0\x48\xc7\xc2\x00\x40\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x02\x40\x00\x00\x48\xb8\x84\x9e\x99\xf3\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x1e\x40\x00\x00\x48\xc7\xc0\x81\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc1\x83\x04\x00\x00\x0f\x32\x48\x0d\xff\x6f\x03\x00\x48\x21\xd0\x48\xc7\xc2\x0c\x40\x00\x00\x0f\x79\xd0\x48\xc7\xc1\x84\x04\x00\x00\x0f\x32\x48\x0d\xff\x17\x00\x00\x48\x21\xd0\x48\xc7\xc2\x12\x40\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x04\x2c\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x00\x28\x00\x00\x48\xc7\xc0\xff\xff\xff\xff\x0f\x79\xd0\x48\xc7\xc2\x02\x0c\x00\x00\x48\xc7\xc0\x50\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc0\x58\x00\x00\x00\x48\xc7\xc2\x00\x0c\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x04\x0c\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x06\x0c\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x08\x0c\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0a\x0c\x00\x00\x0f\x79\xd0\x48\xc7\xc0\xd8\x00\x00\x00\x48\xc7\xc2\x0c\x0c\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x02\x2c\x00\x00\x48\xc7\xc0\x00\x05\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x00\x4c\x00\x00\x48\xc7\xc0\x50\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x10\x6c\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x12\x6c\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x0f\x20\xc0\x48\xc7\xc2\x00\x6c\x00\x00\x48\x89\xc0\x0f\x79\xd0\x0f\x20\xd8\x48\xc7\xc2\x02\x6c\x00\x00\x48\x89\xc0\x0f\x79\xd0\x0f\x20\xe0\x48\xc7\xc2\x04\x6c\x00\x00\x48\x89\xc0\x0f\x79\xd0\x48\xc7\xc2\x06\x6c\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x08\x6c\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0a\x6c\x00\x00\x48\xc7\xc0\x00\x3a\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0c\x6c\x00\x00\x48\xc7\xc0\x00\x10\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0e\x6c\x00\x00\x48\xc7\xc0\x00\x38\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x14\x6c\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x16\x6c\x00\x00\x48\x8b\x04\x25\x10\x5f\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x00\x00\x00\x00\x48\xc7\xc0\x01\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x02\x00\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x00\x20\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x02\x20\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x04\x20\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x06\x20\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc1\x77\x02\x00\x00\x0f\x32\x48\xc1\xe2\x20\x48\x09\xd0\x48\xc7\xc2\x00\x2c\x00\x00\x48\x89\xc0\x0f\x79\xd0\x48\xc7\xc2\x04\x40\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0a\x40\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0e\x40\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x10\x40\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x16\x40\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x14\x40\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x00\x60\x00\x00\x48\xc7\xc0\xff\xff\xff\xff\x0f\x79\xd0\x48\xc7\xc2\x02\x60\x00\x00\x48\xc7\xc0\xff\xff\xff\xff\x0f\x79\xd0\x48\xc7\xc2\x1c\x20\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x1e\x20\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x20\x20\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x22\x20\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x00\x08\x00\x00\x48\xc7\xc0\x58\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x02\x08\x00\x00\x48\xc7\xc0\x50\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x04\x08\x00\x00\x48\xc7\xc0\x58\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x06\x08\x00\x00\x48\xc7\xc0\x58\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x08\x08\x00\x00\x48\xc7\xc0\x58\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0a\x08\x00\x00\x48\xc7\xc0\x58\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0c\x08\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0e\x08\x00\x00\x48\xc7\xc0\xd8\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x12\x68\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x14\x68\x00\x00\x48\xc7\xc0\x00\x3a\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x16\x68\x00\x00\x48\xc7\xc0\x00\x10\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x18\x68\x00\x00\x48\xc7\xc0\x00\x38\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x00\x48\x00\x00\x48\xc7\xc0\xff\xff\x0f\x00\x0f\x79\xd0\x48\xc7\xc2\x02\x48\x00\x00\x48\xc7\xc0\xff\xff\x0f\x00\x0f\x79\xd0\x48\xc7\xc2\x04\x48\x00\x00\x48\xc7\xc0\xff\xff\x0f\x00\x0f\x79\xd0\x48\xc7\xc2\x06\x48\x00\x00\x48\xc7\xc0\xff\xff\x0f\x00\x0f\x79\xd0\x48\xc7\xc2\x08\x48\x00\x00\x48\xc7\xc0\xff\xff\x0f\x00\x0f\x79\xd0\x48\xc7\xc2\x0a\x48\x00\x00\x48\xc7\xc0\xff\xff\x0f\x00\x0f\x79\xd0\x48\xc7\xc2\x0c\x48\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0e\x48\x00\x00\x48\xc7\xc0\xff\x1f\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x10\x48\x00\x00\x48\xc7\xc0\xff\x1f\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x12\x48\x00\x00\x48\xc7\xc0\xff\x1f\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x14\x48\x00\x00\x48\xc7\xc0\x93\x40\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x16\x48\x00\x00\x48\xc7\xc0\x9b\x20\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x18\x48\x00\x00\x48\xc7\xc0\x93\x40\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x1a\x48\x00\x00\x48\xc7\xc0\x93\x40\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x1c\x48\x00\x00\x48\xc7\xc0\x93\x40\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x1e\x48\x00\x00\x48\xc7\xc0\x93\x40\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x20\x48\x00\x00\x48\xc7\xc0\x82\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x22\x48\x00\x00\x48\xc7\xc0\x8b\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x1c\x68\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x1e\x68\x00\x00\x48\xc7\xc0\x00\x91\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x20\x68\x00\x00\x48\xc7\xc0\x02\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x06\x28\x00\x00\x48\xc7\xc0\x00\x05\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0a\x28\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0c\x28\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0e\x28\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x10\x28\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x0f\x20\xc0\x48\xc7\xc2\x00\x68\x00\x00\x48\x89\xc0\x0f\x79\xd0\x0f\x20\xd8\x48\xc7\xc2\x02\x68\x00\x00\x48\x89\xc0\x0f\x79\xd0\x0f\x20\xe0\x48\xc7\xc2\x04\x68\x00\x00\x48\x89\xc0\x0f\x79\xd0\x48\xc7\xc2\x18\x5f\x00\x00\x48\xc7\xc1\x20\x5f\x00\x00\x48\x31\xc0\x0f\x78\xd0\x48\x31\xc8\x0f\x79\xd0\x0f\x01\xc2\x48\xc7\xc2\x00\x44\x00\x00\x0f\x78\xd0\xf4";
 const char kvm_asm64_vm_exit[] = "\x48\xc7\xc3\x00\x44\x00\x00\x0f\x78\xda\x48\xc7\xc3\x02\x44\x00\x00\x0f\x78\xd9\x48\xc7\xc0\x00\x64\x00\x00\x0f\x78\xc0\x48\xc7\xc3\x1e\x68\x00\x00\x0f\x78\xdb\xf4";
 const char kvm_asm64_cpl3[] = "\x0f\x20\xc0\x0d\x00\x00\x00\x80\x0f\x22\xc0\xea\xde\xc0\xad\x0b\x50\x00\x48\xc7\xc0\xd8\x00\x00\x00\x0f\x00\xd8\x48\xc7\xc0\x6b\x00\x00\x00\x8e\xd8\x8e\xc0\x8e\xe0\x8e\xe8\x48\xc7\xc4\x80\x0f\x00\x00\x48\xc7\x04\x24\x1d\xba\x00\x00\x48\xc7\x44\x24\x04\x63\x00\x00\x00\x48\xc7\x44\x24\x08\x80\x0f\x00\x00\x48\xc7\x44\x24\x0c\x6b\x00\x00\x00\xcb";
 
@@ -399,6 +399,8 @@ const char kvm_asm64_cpl3[] = "\x0f\x20\xc0\x0d\x00\x00\x00\x80\x0f\x22\xc0\xea\
 #define ADDR_VAR_VMXON_PTR 0x5f00
 #define ADDR_VAR_VMCS_PTR 0x5f08
 #define ADDR_VAR_VMEXIT_PTR 0x5f10
+#define ADDR_VAR_VMWRITE_FLD 0x5f18
+#define ADDR_VAR_VMWRITE_VAL 0x5f20
 #define ADDR_VAR_VMXON 0x6000
 #define ADDR_VAR_VMCS 0x7000
 #define ADDR_VAR_VMEXIT_CODE 0x9000
@@ -751,33 +753,6 @@ static uintptr_t syz_kvm_setup_cpu(uintptr_t a0, uintptr_t a1, uintptr_t a2, uin
 	regs.rip = guest_mem + ADDR_TEXT;
 	regs.rsp = ADDR_STACK0;
 
-	if (opt_count > 2)
-		opt_count = 2;
-	for (i = 0; i < opt_count; i++) {
-		uint64_t typ = 0;
-		uint64_t val = 0;
-		NONFAILING(typ = opt_array_ptr[i].typ);
-		NONFAILING(val = opt_array_ptr[i].val);
-		switch (typ) {
-		case 1:
-			sregs.cr0 ^= val & (CR0_MP | CR0_EM | CR0_ET | CR0_NE | CR0_WP | CR0_AM | CR0_NW | CR0_CD);
-			break;
-		case 2:
-			sregs.cr4 ^= val & (CR4_VME | CR4_PVI | CR4_TSD | CR4_DE | CR4_MCE | CR4_PGE | CR4_PCE |
-					    CR4_OSFXSR | CR4_OSXMMEXCPT | CR4_UMIP | CR4_VMXE | CR4_SMXE | CR4_FSGSBASE | CR4_PCIDE |
-					    CR4_OSXSAVE | CR4_SMEP | CR4_SMAP | CR4_PKE);
-			break;
-		case 3:
-			sregs.efer ^= val & (EFER_SCE | EFER_NXE | EFER_SVME | EFER_LMSLE | EFER_FFXSR | EFER_TCE);
-			break;
-		case 4:
-			regs.rflags ^= val & ((1 << 8) | (1 << 9) | (1 << 10) | (1 << 12) | (1 << 13) | (1 << 14) |
-					      (1 << 15) | (1 << 18) | (1 << 19) | (1 << 20) | (1 << 21));
-			break;
-		}
-	}
-	regs.rflags |= 2;
-
 	sregs.gdt.base = guest_mem + ADDR_GDT;
 	sregs.gdt.limit = 256 * sizeof(uint64_t) - 1;
 	uint64_t* gdt = (uint64_t*)(host_mem + sregs.gdt.base);
@@ -793,9 +768,8 @@ static uintptr_t syz_kvm_setup_cpu(uintptr_t a0, uintptr_t a1, uintptr_t a2, uin
 	seg_ldt.g = 0;
 	seg_ldt.db = 1;
 	seg_ldt.l = 0;
-	uint64_t* ldt = (uint64_t*)(host_mem + sregs.ldt.base);
-	fill_segment_descriptor(gdt, ldt, &seg_ldt);
 	sregs.ldt = seg_ldt;
+	uint64_t* ldt = (uint64_t*)(host_mem + sregs.ldt.base);
 
 	struct kvm_segment seg_cs16;
 	seg_cs16.selector = SEL_CS16;
@@ -808,61 +782,49 @@ static uintptr_t syz_kvm_setup_cpu(uintptr_t a0, uintptr_t a1, uintptr_t a2, uin
 	seg_cs16.g = 0;
 	seg_cs16.db = 0;
 	seg_cs16.l = 0;
-	fill_segment_descriptor(gdt, ldt, &seg_cs16);
 
 	struct kvm_segment seg_ds16 = seg_cs16;
 	seg_ds16.selector = SEL_DS16;
 	seg_ds16.type = 3;
-	fill_segment_descriptor(gdt, ldt, &seg_ds16);
 
 	struct kvm_segment seg_cs16_cpl3 = seg_cs16;
 	seg_cs16_cpl3.selector = SEL_CS16_CPL3;
 	seg_cs16_cpl3.dpl = 3;
-	fill_segment_descriptor(gdt, ldt, &seg_cs16_cpl3);
 
 	struct kvm_segment seg_ds16_cpl3 = seg_ds16;
 	seg_ds16_cpl3.selector = SEL_DS16_CPL3;
 	seg_ds16_cpl3.dpl = 3;
-	fill_segment_descriptor(gdt, ldt, &seg_ds16_cpl3);
 
 	struct kvm_segment seg_cs32 = seg_cs16;
 	seg_cs32.selector = SEL_CS32;
 	seg_cs32.db = 1;
-	fill_segment_descriptor(gdt, ldt, &seg_cs32);
 
 	struct kvm_segment seg_ds32 = seg_ds16;
 	seg_ds32.selector = SEL_DS32;
 	seg_ds32.db = 1;
-	fill_segment_descriptor(gdt, ldt, &seg_ds32);
 
 	struct kvm_segment seg_cs32_cpl3 = seg_cs32;
 	seg_cs32_cpl3.selector = SEL_CS32_CPL3;
 	seg_cs32_cpl3.dpl = 3;
-	fill_segment_descriptor(gdt, ldt, &seg_cs32_cpl3);
 
 	struct kvm_segment seg_ds32_cpl3 = seg_ds32;
 	seg_ds32_cpl3.selector = SEL_DS32_CPL3;
 	seg_ds32_cpl3.dpl = 3;
-	fill_segment_descriptor(gdt, ldt, &seg_ds32_cpl3);
 
 	struct kvm_segment seg_cs64 = seg_cs16;
 	seg_cs64.selector = SEL_CS64;
 	seg_cs64.l = 1;
-	fill_segment_descriptor(gdt, ldt, &seg_cs64);
 
 	struct kvm_segment seg_ds64 = seg_ds32;
 	seg_ds64.selector = SEL_DS64;
-	fill_segment_descriptor(gdt, ldt, &seg_ds64);
 
 	struct kvm_segment seg_cs64_cpl3 = seg_cs64;
 	seg_cs64_cpl3.selector = SEL_CS64_CPL3;
 	seg_cs64_cpl3.dpl = 3;
-	fill_segment_descriptor(gdt, ldt, &seg_cs64_cpl3);
 
 	struct kvm_segment seg_ds64_cpl3 = seg_ds64;
 	seg_ds64_cpl3.selector = SEL_DS64_CPL3;
 	seg_ds64_cpl3.dpl = 3;
-	fill_segment_descriptor(gdt, ldt, &seg_ds64_cpl3);
 
 	struct kvm_segment seg_tss32;
 	seg_tss32.selector = SEL_TSS32;
@@ -875,53 +837,44 @@ static uintptr_t syz_kvm_setup_cpu(uintptr_t a0, uintptr_t a1, uintptr_t a2, uin
 	seg_tss32.g = 0;
 	seg_tss32.db = 0;
 	seg_tss32.l = 0;
-	fill_segment_descriptor(gdt, ldt, &seg_tss32);
 
 	struct kvm_segment seg_tss32_2 = seg_tss32;
 	seg_tss32_2.selector = SEL_TSS32_2;
 	seg_tss32_2.base = ADDR_VAR_TSS32_2;
-	fill_segment_descriptor(gdt, ldt, &seg_tss32_2);
 
 	struct kvm_segment seg_tss32_cpl3 = seg_tss32;
 	seg_tss32_cpl3.selector = SEL_TSS32_CPL3;
 	seg_tss32_cpl3.base = ADDR_VAR_TSS32_CPL3;
-	fill_segment_descriptor(gdt, ldt, &seg_tss32_cpl3);
 
 	struct kvm_segment seg_tss32_vm86 = seg_tss32;
 	seg_tss32_vm86.selector = SEL_TSS32_VM86;
 	seg_tss32_vm86.base = ADDR_VAR_TSS32_VM86;
-	fill_segment_descriptor(gdt, ldt, &seg_tss32_vm86);
 
 	struct kvm_segment seg_tss16 = seg_tss32;
 	seg_tss16.selector = SEL_TSS16;
 	seg_tss16.base = ADDR_VAR_TSS16;
 	seg_tss16.limit = 0xff;
 	seg_tss16.type = 1;
-	fill_segment_descriptor(gdt, ldt, &seg_tss16);
 
 	struct kvm_segment seg_tss16_2 = seg_tss16;
 	seg_tss16_2.selector = SEL_TSS16_2;
 	seg_tss16_2.base = ADDR_VAR_TSS16_2;
 	seg_tss16_2.dpl = 0;
-	fill_segment_descriptor(gdt, ldt, &seg_tss16_2);
 
 	struct kvm_segment seg_tss16_cpl3 = seg_tss16;
 	seg_tss16_cpl3.selector = SEL_TSS16_CPL3;
 	seg_tss16_cpl3.base = ADDR_VAR_TSS16_CPL3;
 	seg_tss16_cpl3.dpl = 3;
-	fill_segment_descriptor(gdt, ldt, &seg_tss16_cpl3);
 
 	struct kvm_segment seg_tss64 = seg_tss32;
 	seg_tss64.selector = SEL_TSS64;
 	seg_tss64.base = ADDR_VAR_TSS64;
 	seg_tss64.limit = 0x1ff;
-	fill_segment_descriptor_dword(gdt, ldt, &seg_tss64);
 
 	struct kvm_segment seg_tss64_cpl3 = seg_tss64;
 	seg_tss64_cpl3.selector = SEL_TSS64_CPL3;
 	seg_tss64_cpl3.base = ADDR_VAR_TSS64_CPL3;
 	seg_tss64_cpl3.dpl = 3;
-	fill_segment_descriptor_dword(gdt, ldt, &seg_tss64_cpl3);
 
 	struct kvm_segment seg_cgate16;
 	seg_cgate16.selector = SEL_CGATE16;
@@ -935,33 +888,28 @@ static uintptr_t syz_kvm_setup_cpu(uintptr_t a0, uintptr_t a1, uintptr_t a2, uin
 	seg_cgate16.db = 0;
 	seg_cgate16.l = 0;
 	seg_cgate16.avl = 0;
-	fill_segment_descriptor(gdt, ldt, &seg_cgate16);
 
 	struct kvm_segment seg_tgate16 = seg_cgate16;
 	seg_tgate16.selector = SEL_TGATE16;
 	seg_tgate16.type = 3;
 	seg_cgate16.base = SEL_TSS16_2;
 	seg_tgate16.limit = 0;
-	fill_segment_descriptor(gdt, ldt, &seg_tgate16);
 
 	struct kvm_segment seg_cgate32 = seg_cgate16;
 	seg_cgate32.selector = SEL_CGATE32;
 	seg_cgate32.type = 12;
 	seg_cgate32.base = SEL_CS32 | (2 << 16);
-	fill_segment_descriptor(gdt, ldt, &seg_cgate32);
 
 	struct kvm_segment seg_tgate32 = seg_cgate32;
 	seg_tgate32.selector = SEL_TGATE32;
 	seg_tgate32.type = 11;
 	seg_tgate32.base = SEL_TSS32_2;
 	seg_tgate32.limit = 0;
-	fill_segment_descriptor(gdt, ldt, &seg_tgate32);
 
 	struct kvm_segment seg_cgate64 = seg_cgate16;
 	seg_cgate64.selector = SEL_CGATE64;
 	seg_cgate64.type = 12;
 	seg_cgate64.base = SEL_CS64;
-	fill_segment_descriptor_dword(gdt, ldt, &seg_cgate64);
 
 	int kvmfd = open("/dev/kvm", O_RDWR);
 	char buf[sizeof(struct kvm_cpuid2) + 128 * sizeof(struct kvm_cpuid_entry2)];
@@ -972,7 +920,7 @@ static uintptr_t syz_kvm_setup_cpu(uintptr_t a0, uintptr_t a1, uintptr_t a2, uin
 	ioctl(cpufd, KVM_SET_CPUID2, cpuid);
 	close(kvmfd);
 
-	const char* text_prefix;
+	const char* text_prefix = 0;
 	int text_prefix_size = 0;
 	char* host_text = host_mem + ADDR_TEXT;
 
@@ -1104,8 +1052,9 @@ static uintptr_t syz_kvm_setup_cpu(uintptr_t a0, uintptr_t a1, uintptr_t a2, uin
 		}
 	}
 
+	struct tss16* tss16 = (struct tss16*)(host_mem + seg_tss16_2.base);
 	NONFAILING(
-	    struct tss16* tss = (struct tss16*)(host_mem + seg_tss16_2.base);
+	    struct tss16* tss = tss16;
 	    memset(tss, 0, sizeof(*tss));
 	    tss->ss0 = tss->ss1 = tss->ss2 = SEL_DS16;
 	    tss->sp0 = tss->sp1 = tss->sp2 = ADDR_STACK0;
@@ -1114,8 +1063,9 @@ static uintptr_t syz_kvm_setup_cpu(uintptr_t a0, uintptr_t a1, uintptr_t a2, uin
 	    tss->cs = SEL_CS16;
 	    tss->es = tss->ds = tss->ss = SEL_DS16;
 	    tss->ldt = SEL_LDT);
+	struct tss16* tss16_cpl3 = (struct tss16*)(host_mem + seg_tss16_cpl3.base);
 	NONFAILING(
-	    struct tss16* tss = (struct tss16*)(host_mem + seg_tss16_cpl3.base);
+	    struct tss16* tss = tss16_cpl3;
 	    memset(tss, 0, sizeof(*tss));
 	    tss->ss0 = tss->ss1 = tss->ss2 = SEL_DS16;
 	    tss->sp0 = tss->sp1 = tss->sp2 = ADDR_STACK0;
@@ -1124,8 +1074,9 @@ static uintptr_t syz_kvm_setup_cpu(uintptr_t a0, uintptr_t a1, uintptr_t a2, uin
 	    tss->cs = SEL_CS16_CPL3;
 	    tss->es = tss->ds = tss->ss = SEL_DS16_CPL3;
 	    tss->ldt = SEL_LDT);
+	struct tss32* tss32 = (struct tss32*)(host_mem + seg_tss32_vm86.base);
 	NONFAILING(
-	    struct tss32* tss = (struct tss32*)(host_mem + seg_tss32_vm86.base);
+	    struct tss32* tss = tss32;
 	    memset(tss, 0, sizeof(*tss));
 	    tss->ss0 = tss->ss1 = tss->ss2 = SEL_DS32;
 	    tss->sp0 = tss->sp1 = tss->sp2 = ADDR_STACK0;
@@ -1134,8 +1085,9 @@ static uintptr_t syz_kvm_setup_cpu(uintptr_t a0, uintptr_t a1, uintptr_t a2, uin
 	    tss->ldt = SEL_LDT;
 	    tss->cr3 = sregs.cr3;
 	    tss->io_bitmap = offsetof(struct tss32, io_bitmap));
+	struct tss32* tss32_cpl3 = (struct tss32*)(host_mem + seg_tss32_2.base);
 	NONFAILING(
-	    struct tss32* tss = (struct tss32*)(host_mem + seg_tss32_2.base);
+	    struct tss32* tss = tss32_cpl3;
 	    memset(tss, 0, sizeof(*tss));
 	    tss->ss0 = tss->ss1 = tss->ss2 = SEL_DS32;
 	    tss->sp0 = tss->sp1 = tss->sp2 = ADDR_STACK0;
@@ -1147,15 +1099,17 @@ static uintptr_t syz_kvm_setup_cpu(uintptr_t a0, uintptr_t a1, uintptr_t a2, uin
 	    tss->ldt = SEL_LDT;
 	    tss->cr3 = sregs.cr3;
 	    tss->io_bitmap = offsetof(struct tss32, io_bitmap));
+	struct tss64* tss64 = (struct tss64*)(host_mem + seg_tss64.base);
 	NONFAILING(
-	    struct tss64* tss = (struct tss64*)(host_mem + seg_tss64.base);
+	    struct tss64* tss = tss64;
 	    memset(tss, 0, sizeof(*tss));
 	    tss->rsp[0] = ADDR_STACK0;
 	    tss->rsp[1] = ADDR_STACK0;
 	    tss->rsp[2] = ADDR_STACK0;
 	    tss->io_bitmap = offsetof(struct tss64, io_bitmap));
+	struct tss64* tss64_cpl3 = (struct tss64*)(host_mem + seg_tss64_cpl3.base);
 	NONFAILING(
-	    struct tss64* tss = (struct tss64*)(host_mem + seg_tss64_cpl3.base);
+	    struct tss64* tss = tss64_cpl3;
 	    memset(tss, 0, sizeof(*tss));
 	    tss->rsp[0] = ADDR_STACK0;
 	    tss->rsp[1] = ADDR_STACK0;
@@ -1186,6 +1140,95 @@ static uintptr_t syz_kvm_setup_cpu(uintptr_t a0, uintptr_t a1, uintptr_t a2, uin
 	NONFAILING(memcpy(host_mem + ADDR_VAR_SYSRET, "\x0f\x07\xf4", 3));
 	NONFAILING(memcpy(host_mem + ADDR_VAR_SYSEXIT, "\x0f\x35\xf4", 3));
 
+	NONFAILING(*(uint64_t*)(host_mem + ADDR_VAR_VMWRITE_FLD) = 0);
+	NONFAILING(*(uint64_t*)(host_mem + ADDR_VAR_VMWRITE_VAL) = 0);
+
+	if (opt_count > 2)
+		opt_count = 2;
+	for (i = 0; i < opt_count; i++) {
+		uint64_t typ = 0;
+		uint64_t val = 0;
+		NONFAILING(typ = opt_array_ptr[i].typ);
+		NONFAILING(val = opt_array_ptr[i].val);
+		switch (typ % 9) {
+		case 0:
+			sregs.cr0 ^= val & (CR0_MP | CR0_EM | CR0_ET | CR0_NE | CR0_WP | CR0_AM | CR0_NW | CR0_CD);
+			break;
+		case 1:
+			sregs.cr4 ^= val & (CR4_VME | CR4_PVI | CR4_TSD | CR4_DE | CR4_MCE | CR4_PGE | CR4_PCE |
+					    CR4_OSFXSR | CR4_OSXMMEXCPT | CR4_UMIP | CR4_VMXE | CR4_SMXE | CR4_FSGSBASE | CR4_PCIDE |
+					    CR4_OSXSAVE | CR4_SMEP | CR4_SMAP | CR4_PKE);
+			break;
+		case 2:
+			sregs.efer ^= val & (EFER_SCE | EFER_NXE | EFER_SVME | EFER_LMSLE | EFER_FFXSR | EFER_TCE);
+			break;
+		case 3:
+			val &= ((1 << 8) | (1 << 9) | (1 << 10) | (1 << 12) | (1 << 13) | (1 << 14) |
+				(1 << 15) | (1 << 18) | (1 << 19) | (1 << 20) | (1 << 21));
+			regs.rflags ^= val;
+			NONFAILING(tss16->flags ^= val);
+			NONFAILING(tss16_cpl3->flags ^= val);
+			NONFAILING(tss32->flags ^= val);
+			NONFAILING(tss32_cpl3->flags ^= val);
+			break;
+		case 4:
+			seg_cs16.type = val & 0xf;
+			seg_cs32.type = val & 0xf;
+			seg_cs64.type = val & 0xf;
+			break;
+		case 5:
+			seg_cs16_cpl3.type = val & 0xf;
+			seg_cs32_cpl3.type = val & 0xf;
+			seg_cs64_cpl3.type = val & 0xf;
+			break;
+		case 6:
+			seg_ds16.type = val & 0xf;
+			seg_ds32.type = val & 0xf;
+			seg_ds64.type = val & 0xf;
+			break;
+		case 7:
+			seg_ds16_cpl3.type = val & 0xf;
+			seg_ds32_cpl3.type = val & 0xf;
+			seg_ds64_cpl3.type = val & 0xf;
+			break;
+		case 8:
+			NONFAILING(*(uint64_t*)(host_mem + ADDR_VAR_VMWRITE_FLD) = (val & 0xffff));
+			NONFAILING(*(uint64_t*)(host_mem + ADDR_VAR_VMWRITE_VAL) = (val >> 16));
+			break;
+		default:
+			fail("bad kvm setup opt");
+		}
+	}
+	regs.rflags |= 2;
+
+	fill_segment_descriptor(gdt, ldt, &seg_ldt);
+	fill_segment_descriptor(gdt, ldt, &seg_cs16);
+	fill_segment_descriptor(gdt, ldt, &seg_ds16);
+	fill_segment_descriptor(gdt, ldt, &seg_cs16_cpl3);
+	fill_segment_descriptor(gdt, ldt, &seg_ds16_cpl3);
+	fill_segment_descriptor(gdt, ldt, &seg_cs32);
+	fill_segment_descriptor(gdt, ldt, &seg_ds32);
+	fill_segment_descriptor(gdt, ldt, &seg_cs32_cpl3);
+	fill_segment_descriptor(gdt, ldt, &seg_ds32_cpl3);
+	fill_segment_descriptor(gdt, ldt, &seg_cs64);
+	fill_segment_descriptor(gdt, ldt, &seg_ds64);
+	fill_segment_descriptor(gdt, ldt, &seg_cs64_cpl3);
+	fill_segment_descriptor(gdt, ldt, &seg_ds64_cpl3);
+	fill_segment_descriptor(gdt, ldt, &seg_tss32);
+	fill_segment_descriptor(gdt, ldt, &seg_tss32_2);
+	fill_segment_descriptor(gdt, ldt, &seg_tss32_cpl3);
+	fill_segment_descriptor(gdt, ldt, &seg_tss32_vm86);
+	fill_segment_descriptor(gdt, ldt, &seg_tss16);
+	fill_segment_descriptor(gdt, ldt, &seg_tss16_2);
+	fill_segment_descriptor(gdt, ldt, &seg_tss16_cpl3);
+	fill_segment_descriptor_dword(gdt, ldt, &seg_tss64);
+	fill_segment_descriptor_dword(gdt, ldt, &seg_tss64_cpl3);
+	fill_segment_descriptor(gdt, ldt, &seg_cgate16);
+	fill_segment_descriptor(gdt, ldt, &seg_tgate16);
+	fill_segment_descriptor(gdt, ldt, &seg_cgate32);
+	fill_segment_descriptor(gdt, ldt, &seg_tgate32);
+	fill_segment_descriptor_dword(gdt, ldt, &seg_cgate64);
+
 	if (ioctl(cpufd, KVM_SET_SREGS, &sregs))
 		return -1;
 	if (ioctl(cpufd, KVM_SET_REGS, &regs))
diff --git a/executor/common_kvm_amd64.h b/executor/common_kvm_amd64.h
index f5d061bb1..dd37733ed 100644
--- a/executor/common_kvm_amd64.h
+++ b/executor/common_kvm_amd64.h
@@ -322,33 +322,6 @@ static uintptr_t syz_kvm_setup_cpu(uintptr_t a0, uintptr_t a1, uintptr_t a2, uin
 	regs.rip = guest_mem + ADDR_TEXT;
 	regs.rsp = ADDR_STACK0;
 
-	if (opt_count > 2)
-		opt_count = 2;
-	for (i = 0; i < opt_count; i++) {
-		uint64_t typ = 0;
-		uint64_t val = 0;
-		NONFAILING(typ = opt_array_ptr[i].typ);
-		NONFAILING(val = opt_array_ptr[i].val);
-		switch (typ) {
-		case 1:
-			sregs.cr0 ^= val & (CR0_MP | CR0_EM | CR0_ET | CR0_NE | CR0_WP | CR0_AM | CR0_NW | CR0_CD);
-			break;
-		case 2:
-			sregs.cr4 ^= val & (CR4_VME | CR4_PVI | CR4_TSD | CR4_DE | CR4_MCE | CR4_PGE | CR4_PCE |
-					    CR4_OSFXSR | CR4_OSXMMEXCPT | CR4_UMIP | CR4_VMXE | CR4_SMXE | CR4_FSGSBASE | CR4_PCIDE |
-					    CR4_OSXSAVE | CR4_SMEP | CR4_SMAP | CR4_PKE);
-			break;
-		case 3:
-			sregs.efer ^= val & (EFER_SCE | EFER_NXE | EFER_SVME | EFER_LMSLE | EFER_FFXSR | EFER_TCE);
-			break;
-		case 4:
-			regs.rflags ^= val & ((1 << 8) | (1 << 9) | (1 << 10) | (1 << 12) | (1 << 13) | (1 << 14) |
-					      (1 << 15) | (1 << 18) | (1 << 19) | (1 << 20) | (1 << 21));
-			break;
-		}
-	}
-	regs.rflags |= 2; // bit 1 is always set
-
 	sregs.gdt.base = guest_mem + ADDR_GDT;
 	sregs.gdt.limit = 256 * sizeof(uint64_t) - 1;
 	uint64_t* gdt = (uint64_t*)(host_mem + sregs.gdt.base);
@@ -364,9 +337,8 @@ static uintptr_t syz_kvm_setup_cpu(uintptr_t a0, uintptr_t a1, uintptr_t a2, uin
 	seg_ldt.g = 0;
 	seg_ldt.db = 1;
 	seg_ldt.l = 0;
-	uint64_t* ldt = (uint64_t*)(host_mem + sregs.ldt.base);
-	fill_segment_descriptor(gdt, ldt, &seg_ldt);
 	sregs.ldt = seg_ldt;
+	uint64_t* ldt = (uint64_t*)(host_mem + sregs.ldt.base);
 
 	struct kvm_segment seg_cs16;
 	seg_cs16.selector = SEL_CS16;
@@ -379,61 +351,49 @@ static uintptr_t syz_kvm_setup_cpu(uintptr_t a0, uintptr_t a1, uintptr_t a2, uin
 	seg_cs16.g = 0;
 	seg_cs16.db = 0;
 	seg_cs16.l = 0;
-	fill_segment_descriptor(gdt, ldt, &seg_cs16);
 
 	struct kvm_segment seg_ds16 = seg_cs16;
 	seg_ds16.selector = SEL_DS16;
 	seg_ds16.type = 3;
-	fill_segment_descriptor(gdt, ldt, &seg_ds16);
 
 	struct kvm_segment seg_cs16_cpl3 = seg_cs16;
 	seg_cs16_cpl3.selector = SEL_CS16_CPL3;
 	seg_cs16_cpl3.dpl = 3;
-	fill_segment_descriptor(gdt, ldt, &seg_cs16_cpl3);
 
 	struct kvm_segment seg_ds16_cpl3 = seg_ds16;
 	seg_ds16_cpl3.selector = SEL_DS16_CPL3;
 	seg_ds16_cpl3.dpl = 3;
-	fill_segment_descriptor(gdt, ldt, &seg_ds16_cpl3);
 
 	struct kvm_segment seg_cs32 = seg_cs16;
 	seg_cs32.selector = SEL_CS32;
 	seg_cs32.db = 1;
-	fill_segment_descriptor(gdt, ldt, &seg_cs32);
 
 	struct kvm_segment seg_ds32 = seg_ds16;
 	seg_ds32.selector = SEL_DS32;
 	seg_ds32.db = 1;
-	fill_segment_descriptor(gdt, ldt, &seg_ds32);
 
 	struct kvm_segment seg_cs32_cpl3 = seg_cs32;
 	seg_cs32_cpl3.selector = SEL_CS32_CPL3;
 	seg_cs32_cpl3.dpl = 3;
-	fill_segment_descriptor(gdt, ldt, &seg_cs32_cpl3);
 
 	struct kvm_segment seg_ds32_cpl3 = seg_ds32;
 	seg_ds32_cpl3.selector = SEL_DS32_CPL3;
 	seg_ds32_cpl3.dpl = 3;
-	fill_segment_descriptor(gdt, ldt, &seg_ds32_cpl3);
 
 	struct kvm_segment seg_cs64 = seg_cs16;
 	seg_cs64.selector = SEL_CS64;
 	seg_cs64.l = 1;
-	fill_segment_descriptor(gdt, ldt, &seg_cs64);
 
 	struct kvm_segment seg_ds64 = seg_ds32;
 	seg_ds64.selector = SEL_DS64;
-	fill_segment_descriptor(gdt, ldt, &seg_ds64);
 
 	struct kvm_segment seg_cs64_cpl3 = seg_cs64;
 	seg_cs64_cpl3.selector = SEL_CS64_CPL3;
 	seg_cs64_cpl3.dpl = 3;
-	fill_segment_descriptor(gdt, ldt, &seg_cs64_cpl3);
 
 	struct kvm_segment seg_ds64_cpl3 = seg_ds64;
 	seg_ds64_cpl3.selector = SEL_DS64_CPL3;
 	seg_ds64_cpl3.dpl = 3;
-	fill_segment_descriptor(gdt, ldt, &seg_ds64_cpl3);
 
 	struct kvm_segment seg_tss32;
 	seg_tss32.selector = SEL_TSS32;
@@ -446,53 +406,44 @@ static uintptr_t syz_kvm_setup_cpu(uintptr_t a0, uintptr_t a1, uintptr_t a2, uin
 	seg_tss32.g = 0;
 	seg_tss32.db = 0;
 	seg_tss32.l = 0;
-	fill_segment_descriptor(gdt, ldt, &seg_tss32);
 
 	struct kvm_segment seg_tss32_2 = seg_tss32;
 	seg_tss32_2.selector = SEL_TSS32_2;
 	seg_tss32_2.base = ADDR_VAR_TSS32_2;
-	fill_segment_descriptor(gdt, ldt, &seg_tss32_2);
 
 	struct kvm_segment seg_tss32_cpl3 = seg_tss32;
 	seg_tss32_cpl3.selector = SEL_TSS32_CPL3;
 	seg_tss32_cpl3.base = ADDR_VAR_TSS32_CPL3;
-	fill_segment_descriptor(gdt, ldt, &seg_tss32_cpl3);
 
 	struct kvm_segment seg_tss32_vm86 = seg_tss32;
 	seg_tss32_vm86.selector = SEL_TSS32_VM86;
 	seg_tss32_vm86.base = ADDR_VAR_TSS32_VM86;
-	fill_segment_descriptor(gdt, ldt, &seg_tss32_vm86);
 
 	struct kvm_segment seg_tss16 = seg_tss32;
 	seg_tss16.selector = SEL_TSS16;
 	seg_tss16.base = ADDR_VAR_TSS16;
 	seg_tss16.limit = 0xff;
 	seg_tss16.type = 1;
-	fill_segment_descriptor(gdt, ldt, &seg_tss16);
 
 	struct kvm_segment seg_tss16_2 = seg_tss16;
 	seg_tss16_2.selector = SEL_TSS16_2;
 	seg_tss16_2.base = ADDR_VAR_TSS16_2;
 	seg_tss16_2.dpl = 0;
-	fill_segment_descriptor(gdt, ldt, &seg_tss16_2);
 
 	struct kvm_segment seg_tss16_cpl3 = seg_tss16;
 	seg_tss16_cpl3.selector = SEL_TSS16_CPL3;
 	seg_tss16_cpl3.base = ADDR_VAR_TSS16_CPL3;
 	seg_tss16_cpl3.dpl = 3;
-	fill_segment_descriptor(gdt, ldt, &seg_tss16_cpl3);
 
 	struct kvm_segment seg_tss64 = seg_tss32;
 	seg_tss64.selector = SEL_TSS64;
 	seg_tss64.base = ADDR_VAR_TSS64;
 	seg_tss64.limit = 0x1ff;
-	fill_segment_descriptor_dword(gdt, ldt, &seg_tss64);
 
 	struct kvm_segment seg_tss64_cpl3 = seg_tss64;
 	seg_tss64_cpl3.selector = SEL_TSS64_CPL3;
 	seg_tss64_cpl3.base = ADDR_VAR_TSS64_CPL3;
 	seg_tss64_cpl3.dpl = 3;
-	fill_segment_descriptor_dword(gdt, ldt, &seg_tss64_cpl3);
 
 	struct kvm_segment seg_cgate16;
 	seg_cgate16.selector = SEL_CGATE16;
@@ -506,33 +457,28 @@ static uintptr_t syz_kvm_setup_cpu(uintptr_t a0, uintptr_t a1, uintptr_t a2, uin
 	seg_cgate16.db = 0;
 	seg_cgate16.l = 0;
 	seg_cgate16.avl = 0;
-	fill_segment_descriptor(gdt, ldt, &seg_cgate16);
 
 	struct kvm_segment seg_tgate16 = seg_cgate16;
 	seg_tgate16.selector = SEL_TGATE16;
 	seg_tgate16.type = 3;
 	seg_cgate16.base = SEL_TSS16_2;
 	seg_tgate16.limit = 0;
-	fill_segment_descriptor(gdt, ldt, &seg_tgate16);
 
 	struct kvm_segment seg_cgate32 = seg_cgate16;
 	seg_cgate32.selector = SEL_CGATE32;
 	seg_cgate32.type = 12;
 	seg_cgate32.base = SEL_CS32 | (2 << 16); // selector + param count
-	fill_segment_descriptor(gdt, ldt, &seg_cgate32);
 
 	struct kvm_segment seg_tgate32 = seg_cgate32;
 	seg_tgate32.selector = SEL_TGATE32;
 	seg_tgate32.type = 11;
 	seg_tgate32.base = SEL_TSS32_2;
 	seg_tgate32.limit = 0;
-	fill_segment_descriptor(gdt, ldt, &seg_tgate32);
 
 	struct kvm_segment seg_cgate64 = seg_cgate16;
 	seg_cgate64.selector = SEL_CGATE64;
 	seg_cgate64.type = 12;
 	seg_cgate64.base = SEL_CS64;
-	fill_segment_descriptor_dword(gdt, ldt, &seg_cgate64);
 
 	int kvmfd = open("/dev/kvm", O_RDWR);
 	char buf[sizeof(struct kvm_cpuid2) + 128 * sizeof(struct kvm_cpuid_entry2)];
@@ -543,7 +489,7 @@ static uintptr_t syz_kvm_setup_cpu(uintptr_t a0, uintptr_t a1, uintptr_t a2, uin
 	ioctl(cpufd, KVM_SET_CPUID2, cpuid);
 	close(kvmfd);
 
-	const char* text_prefix;
+	const char* text_prefix = 0;
 	int text_prefix_size = 0;
 	char* host_text = host_mem + ADDR_TEXT;
 
@@ -677,8 +623,9 @@ static uintptr_t syz_kvm_setup_cpu(uintptr_t a0, uintptr_t a1, uintptr_t a2, uin
 		}
 	}
 
+	struct tss16* tss16 = (struct tss16*)(host_mem + seg_tss16_2.base);
 	NONFAILING(
-	    struct tss16* tss = (struct tss16*)(host_mem + seg_tss16_2.base);
+	    struct tss16* tss = tss16;
 	    memset(tss, 0, sizeof(*tss));
 	    tss->ss0 = tss->ss1 = tss->ss2 = SEL_DS16;
 	    tss->sp0 = tss->sp1 = tss->sp2 = ADDR_STACK0;
@@ -687,8 +634,9 @@ static uintptr_t syz_kvm_setup_cpu(uintptr_t a0, uintptr_t a1, uintptr_t a2, uin
 	    tss->cs = SEL_CS16;
 	    tss->es = tss->ds = tss->ss = SEL_DS16;
 	    tss->ldt = SEL_LDT);
+	struct tss16* tss16_cpl3 = (struct tss16*)(host_mem + seg_tss16_cpl3.base);
 	NONFAILING(
-	    struct tss16* tss = (struct tss16*)(host_mem + seg_tss16_cpl3.base);
+	    struct tss16* tss = tss16_cpl3;
 	    memset(tss, 0, sizeof(*tss));
 	    tss->ss0 = tss->ss1 = tss->ss2 = SEL_DS16;
 	    tss->sp0 = tss->sp1 = tss->sp2 = ADDR_STACK0;
@@ -697,8 +645,9 @@ static uintptr_t syz_kvm_setup_cpu(uintptr_t a0, uintptr_t a1, uintptr_t a2, uin
 	    tss->cs = SEL_CS16_CPL3;
 	    tss->es = tss->ds = tss->ss = SEL_DS16_CPL3;
 	    tss->ldt = SEL_LDT);
+	struct tss32* tss32 = (struct tss32*)(host_mem + seg_tss32_vm86.base);
 	NONFAILING(
-	    struct tss32* tss = (struct tss32*)(host_mem + seg_tss32_vm86.base);
+	    struct tss32* tss = tss32;
 	    memset(tss, 0, sizeof(*tss));
 	    tss->ss0 = tss->ss1 = tss->ss2 = SEL_DS32;
 	    tss->sp0 = tss->sp1 = tss->sp2 = ADDR_STACK0;
@@ -707,8 +656,9 @@ static uintptr_t syz_kvm_setup_cpu(uintptr_t a0, uintptr_t a1, uintptr_t a2, uin
 	    tss->ldt = SEL_LDT;
 	    tss->cr3 = sregs.cr3;
 	    tss->io_bitmap = offsetof(struct tss32, io_bitmap));
+	struct tss32* tss32_cpl3 = (struct tss32*)(host_mem + seg_tss32_2.base);
 	NONFAILING(
-	    struct tss32* tss = (struct tss32*)(host_mem + seg_tss32_2.base);
+	    struct tss32* tss = tss32_cpl3;
 	    memset(tss, 0, sizeof(*tss));
 	    tss->ss0 = tss->ss1 = tss->ss2 = SEL_DS32;
 	    tss->sp0 = tss->sp1 = tss->sp2 = ADDR_STACK0;
@@ -720,15 +670,17 @@ static uintptr_t syz_kvm_setup_cpu(uintptr_t a0, uintptr_t a1, uintptr_t a2, uin
 	    tss->ldt = SEL_LDT;
 	    tss->cr3 = sregs.cr3;
 	    tss->io_bitmap = offsetof(struct tss32, io_bitmap));
+	struct tss64* tss64 = (struct tss64*)(host_mem + seg_tss64.base);
 	NONFAILING(
-	    struct tss64* tss = (struct tss64*)(host_mem + seg_tss64.base);
+	    struct tss64* tss = tss64;
 	    memset(tss, 0, sizeof(*tss));
 	    tss->rsp[0] = ADDR_STACK0;
 	    tss->rsp[1] = ADDR_STACK0;
 	    tss->rsp[2] = ADDR_STACK0;
 	    tss->io_bitmap = offsetof(struct tss64, io_bitmap));
+	struct tss64* tss64_cpl3 = (struct tss64*)(host_mem + seg_tss64_cpl3.base);
 	NONFAILING(
-	    struct tss64* tss = (struct tss64*)(host_mem + seg_tss64_cpl3.base);
+	    struct tss64* tss = tss64_cpl3;
 	    memset(tss, 0, sizeof(*tss));
 	    tss->rsp[0] = ADDR_STACK0;
 	    tss->rsp[1] = ADDR_STACK0;
@@ -760,6 +712,95 @@ static uintptr_t syz_kvm_setup_cpu(uintptr_t a0, uintptr_t a1, uintptr_t a2, uin
 	NONFAILING(memcpy(host_mem + ADDR_VAR_SYSRET, "\x0f\x07\xf4", 3));
 	NONFAILING(memcpy(host_mem + ADDR_VAR_SYSEXIT, "\x0f\x35\xf4", 3));
 
+	NONFAILING(*(uint64_t*)(host_mem + ADDR_VAR_VMWRITE_FLD) = 0);
+	NONFAILING(*(uint64_t*)(host_mem + ADDR_VAR_VMWRITE_VAL) = 0);
+
+	if (opt_count > 2)
+		opt_count = 2;
+	for (i = 0; i < opt_count; i++) {
+		uint64_t typ = 0;
+		uint64_t val = 0;
+		NONFAILING(typ = opt_array_ptr[i].typ);
+		NONFAILING(val = opt_array_ptr[i].val);
+		switch (typ % 9) {
+		case 0:
+			sregs.cr0 ^= val & (CR0_MP | CR0_EM | CR0_ET | CR0_NE | CR0_WP | CR0_AM | CR0_NW | CR0_CD);
+			break;
+		case 1:
+			sregs.cr4 ^= val & (CR4_VME | CR4_PVI | CR4_TSD | CR4_DE | CR4_MCE | CR4_PGE | CR4_PCE |
+					    CR4_OSFXSR | CR4_OSXMMEXCPT | CR4_UMIP | CR4_VMXE | CR4_SMXE | CR4_FSGSBASE | CR4_PCIDE |
+					    CR4_OSXSAVE | CR4_SMEP | CR4_SMAP | CR4_PKE);
+			break;
+		case 2:
+			sregs.efer ^= val & (EFER_SCE | EFER_NXE | EFER_SVME | EFER_LMSLE | EFER_FFXSR | EFER_TCE);
+			break;
+		case 3:
+			val &= ((1 << 8) | (1 << 9) | (1 << 10) | (1 << 12) | (1 << 13) | (1 << 14) |
+				(1 << 15) | (1 << 18) | (1 << 19) | (1 << 20) | (1 << 21));
+			regs.rflags ^= val;
+			NONFAILING(tss16->flags ^= val);
+			NONFAILING(tss16_cpl3->flags ^= val);
+			NONFAILING(tss32->flags ^= val);
+			NONFAILING(tss32_cpl3->flags ^= val);
+			break;
+		case 4:
+			seg_cs16.type = val & 0xf;
+			seg_cs32.type = val & 0xf;
+			seg_cs64.type = val & 0xf;
+			break;
+		case 5:
+			seg_cs16_cpl3.type = val & 0xf;
+			seg_cs32_cpl3.type = val & 0xf;
+			seg_cs64_cpl3.type = val & 0xf;
+			break;
+		case 6:
+			seg_ds16.type = val & 0xf;
+			seg_ds32.type = val & 0xf;
+			seg_ds64.type = val & 0xf;
+			break;
+		case 7:
+			seg_ds16_cpl3.type = val & 0xf;
+			seg_ds32_cpl3.type = val & 0xf;
+			seg_ds64_cpl3.type = val & 0xf;
+			break;
+		case 8:
+			NONFAILING(*(uint64_t*)(host_mem + ADDR_VAR_VMWRITE_FLD) = (val & 0xffff));
+			NONFAILING(*(uint64_t*)(host_mem + ADDR_VAR_VMWRITE_VAL) = (val >> 16));
+			break;
+		default:
+			fail("bad kvm setup opt");
+		}
+	}
+	regs.rflags |= 2; // bit 1 is always set
+
+	fill_segment_descriptor(gdt, ldt, &seg_ldt);
+	fill_segment_descriptor(gdt, ldt, &seg_cs16);
+	fill_segment_descriptor(gdt, ldt, &seg_ds16);
+	fill_segment_descriptor(gdt, ldt, &seg_cs16_cpl3);
+	fill_segment_descriptor(gdt, ldt, &seg_ds16_cpl3);
+	fill_segment_descriptor(gdt, ldt, &seg_cs32);
+	fill_segment_descriptor(gdt, ldt, &seg_ds32);
+	fill_segment_descriptor(gdt, ldt, &seg_cs32_cpl3);
+	fill_segment_descriptor(gdt, ldt, &seg_ds32_cpl3);
+	fill_segment_descriptor(gdt, ldt, &seg_cs64);
+	fill_segment_descriptor(gdt, ldt, &seg_ds64);
+	fill_segment_descriptor(gdt, ldt, &seg_cs64_cpl3);
+	fill_segment_descriptor(gdt, ldt, &seg_ds64_cpl3);
+	fill_segment_descriptor(gdt, ldt, &seg_tss32);
+	fill_segment_descriptor(gdt, ldt, &seg_tss32_2);
+	fill_segment_descriptor(gdt, ldt, &seg_tss32_cpl3);
+	fill_segment_descriptor(gdt, ldt, &seg_tss32_vm86);
+	fill_segment_descriptor(gdt, ldt, &seg_tss16);
+	fill_segment_descriptor(gdt, ldt, &seg_tss16_2);
+	fill_segment_descriptor(gdt, ldt, &seg_tss16_cpl3);
+	fill_segment_descriptor_dword(gdt, ldt, &seg_tss64);
+	fill_segment_descriptor_dword(gdt, ldt, &seg_tss64_cpl3);
+	fill_segment_descriptor(gdt, ldt, &seg_cgate16);
+	fill_segment_descriptor(gdt, ldt, &seg_tgate16);
+	fill_segment_descriptor(gdt, ldt, &seg_cgate32);
+	fill_segment_descriptor(gdt, ldt, &seg_tgate32);
+	fill_segment_descriptor_dword(gdt, ldt, &seg_cgate64);
+
 	if (ioctl(cpufd, KVM_SET_SREGS, &sregs))
 		return -1;
 	if (ioctl(cpufd, KVM_SET_REGS, &regs))
diff --git a/executor/kvm.S b/executor/kvm.S
index 9f4df257e..896c59104 100644
--- a/executor/kvm.S
+++ b/executor/kvm.S
@@ -134,10 +134,10 @@ kvm_asm64_init_vm:
 	// Write VMCS revision into VMXON and VMCS regions
 	mov $MSR_IA32_VMX_BASIC, %rcx
 	rdmsr
-	mov $ADDR_VAR_VMXON,%rdx
-	mov %eax,(%rdx)
-	mov $ADDR_VAR_VMCS,%rdx
-	mov %eax,(%rdx)
+	mov $ADDR_VAR_VMXON, %rdx
+	mov %eax, (%rdx)
+	mov $ADDR_VAR_VMCS, %rdx
+	mov %eax, (%rdx)
 
 	mov $ADDR_VAR_VMXON_PTR, %rax
 	vmxon (%rax)
@@ -290,6 +290,16 @@ kvm_asm64_init_vm:
 	mov %cr4, %rax
 	VMSET(0x00006804, %rax) // Guest CR4
 
+	// Write 1 additional random field.
+	mov $ADDR_VAR_VMWRITE_FLD, %rax
+	mov (%rax), %rdx
+	mov $ADDR_VAR_VMWRITE_VAL, %rax
+	mov (%rax), %rcx
+	xor %rax, %rax
+	vmread %rdx, %rax
+	xor %rcx, %rax
+	vmwrite %rax, %rdx
+
 	vmlaunch
 
 	mov $0x00004400, %rdx
diff --git a/executor/kvm.S.h b/executor/kvm.S.h
index c6a53c798..e61ea3d9a 100644
--- a/executor/kvm.S.h
+++ b/executor/kvm.S.h
@@ -5,6 +5,6 @@ const char kvm_asm32_vm86[] = "\x66\xb8\xb8\x00\x0f\x00\xd8\xea\x00\x00\x00\x00\
 const char kvm_asm32_paged_vm86[] = "\x0f\x20\xc0\x0d\x00\x00\x00\x80\x0f\x22\xc0\x66\xb8\xb8\x00\x0f\x00\xd8\xea\x00\x00\x00\x00\xd0\x00";
 const char kvm_asm64_vm86[] = "\x0f\x20\xc0\x0d\x00\x00\x00\x80\x0f\x22\xc0\x66\xb8\xb8\x00\x0f\x00\xd8\xea\x00\x00\x00\x00\xd0\x00";
 const char kvm_asm64_enable_long[] = "\x0f\x20\xc0\x0d\x00\x00\x00\x80\x0f\x22\xc0\xea\xde\xc0\xad\x0b\x50\x00\x48\xc7\xc0\xd8\x00\x00\x00\x0f\x00\xd8";
-const char kvm_asm64_init_vm[] = "\x0f\x20\xc0\x0d\x00\x00\x00\x80\x0f\x22\xc0\xea\xde\xc0\xad\x0b\x50\x00\x48\xc7\xc0\xd8\x00\x00\x00\x0f\x00\xd8\x48\xc7\xc1\x3a\x00\x00\x00\x0f\x32\x48\x83\xc8\x05\x0f\x30\x0f\x20\xe0\x48\x0d\x00\x20\x00\x00\x0f\x22\xe0\x48\xc7\xc1\x80\x04\x00\x00\x0f\x32\x48\xc7\xc2\x00\x60\x00\x00\x89\x02\x48\xc7\xc2\x00\x70\x00\x00\x89\x02\x48\xc7\xc0\x00\x5f\x00\x00\xf3\x0f\xc7\x30\x48\xc7\xc0\x08\x5f\x00\x00\x66\x0f\xc7\x30\x0f\xc7\x30\x48\xc7\xc1\x81\x04\x00\x00\x0f\x32\x48\x83\xc8\x3f\x48\x21\xd0\x48\xc7\xc2\x00\x40\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x02\x40\x00\x00\x48\xb8\x84\x9e\x99\xf3\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x1e\x40\x00\x00\x48\xc7\xc0\x81\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc1\x83\x04\x00\x00\x0f\x32\x48\x0d\xff\x6f\x03\x00\x48\x21\xd0\x48\xc7\xc2\x0c\x40\x00\x00\x0f\x79\xd0\x48\xc7\xc1\x84\x04\x00\x00\x0f\x32\x48\x0d\xff\x17\x00\x00\x48\x21\xd0\x48\xc7\xc2\x12\x40\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x04\x2c\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x00\x28\x00\x00\x48\xc7\xc0\xff\xff\xff\xff\x0f\x79\xd0\x48\xc7\xc2\x02\x0c\x00\x00\x48\xc7\xc0\x50\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc0\x58\x00\x00\x00\x48\xc7\xc2\x00\x0c\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x04\x0c\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x06\x0c\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x08\x0c\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0a\x0c\x00\x00\x0f\x79\xd0\x48\xc7\xc0\xd8\x00\x00\x00\x48\xc7\xc2\x0c\x0c\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x02\x2c\x00\x00\x48\xc7\xc0\x00\x05\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x00\x4c\x00\x00\x48\xc7\xc0\x50\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x10\x6c\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x12\x6c\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x0f\x20\xc0\x48\xc7\xc2\x00\x6c\x00\x00\x48\x89\xc0\x0f\x79\xd0\x0f\x20\xd8\x48\xc7\xc2\x02\x6c\x00\x00\x48\x89\xc0\x0f\x79\xd0\x0f\x20\xe0\x48\xc7\xc2\x04\x6c\x00\x00\x48\x89\xc0\x0f\x79\xd0\x48\xc7\xc2\x06\x6c\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x08\x6c\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0a\x6c\x00\x00\x48\xc7\xc0\x00\x3a\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0c\x6c\x00\x00\x48\xc7\xc0\x00\x10\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0e\x6c\x00\x00\x48\xc7\xc0\x00\x38\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x14\x6c\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x16\x6c\x00\x00\x48\x8b\x04\x25\x10\x5f\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x00\x00\x00\x00\x48\xc7\xc0\x01\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x02\x00\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x00\x20\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x02\x20\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x04\x20\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x06\x20\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc1\x77\x02\x00\x00\x0f\x32\x48\xc1\xe2\x20\x48\x09\xd0\x48\xc7\xc2\x00\x2c\x00\x00\x48\x89\xc0\x0f\x79\xd0\x48\xc7\xc2\x04\x40\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0a\x40\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0e\x40\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x10\x40\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x16\x40\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x14\x40\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x00\x60\x00\x00\x48\xc7\xc0\xff\xff\xff\xff\x0f\x79\xd0\x48\xc7\xc2\x02\x60\x00\x00\x48\xc7\xc0\xff\xff\xff\xff\x0f\x79\xd0\x48\xc7\xc2\x1c\x20\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x1e\x20\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x20\x20\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x22\x20\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x00\x08\x00\x00\x48\xc7\xc0\x58\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x02\x08\x00\x00\x48\xc7\xc0\x50\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x04\x08\x00\x00\x48\xc7\xc0\x58\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x06\x08\x00\x00\x48\xc7\xc0\x58\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x08\x08\x00\x00\x48\xc7\xc0\x58\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0a\x08\x00\x00\x48\xc7\xc0\x58\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0c\x08\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0e\x08\x00\x00\x48\xc7\xc0\xd8\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x12\x68\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x14\x68\x00\x00\x48\xc7\xc0\x00\x3a\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x16\x68\x00\x00\x48\xc7\xc0\x00\x10\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x18\x68\x00\x00\x48\xc7\xc0\x00\x38\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x00\x48\x00\x00\x48\xc7\xc0\xff\xff\x0f\x00\x0f\x79\xd0\x48\xc7\xc2\x02\x48\x00\x00\x48\xc7\xc0\xff\xff\x0f\x00\x0f\x79\xd0\x48\xc7\xc2\x04\x48\x00\x00\x48\xc7\xc0\xff\xff\x0f\x00\x0f\x79\xd0\x48\xc7\xc2\x06\x48\x00\x00\x48\xc7\xc0\xff\xff\x0f\x00\x0f\x79\xd0\x48\xc7\xc2\x08\x48\x00\x00\x48\xc7\xc0\xff\xff\x0f\x00\x0f\x79\xd0\x48\xc7\xc2\x0a\x48\x00\x00\x48\xc7\xc0\xff\xff\x0f\x00\x0f\x79\xd0\x48\xc7\xc2\x0c\x48\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0e\x48\x00\x00\x48\xc7\xc0\xff\x1f\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x10\x48\x00\x00\x48\xc7\xc0\xff\x1f\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x12\x48\x00\x00\x48\xc7\xc0\xff\x1f\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x14\x48\x00\x00\x48\xc7\xc0\x93\x40\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x16\x48\x00\x00\x48\xc7\xc0\x9b\x20\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x18\x48\x00\x00\x48\xc7\xc0\x93\x40\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x1a\x48\x00\x00\x48\xc7\xc0\x93\x40\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x1c\x48\x00\x00\x48\xc7\xc0\x93\x40\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x1e\x48\x00\x00\x48\xc7\xc0\x93\x40\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x20\x48\x00\x00\x48\xc7\xc0\x82\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x22\x48\x00\x00\x48\xc7\xc0\x8b\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x1c\x68\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x1e\x68\x00\x00\x48\xc7\xc0\x00\x91\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x20\x68\x00\x00\x48\xc7\xc0\x02\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x06\x28\x00\x00\x48\xc7\xc0\x00\x05\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0a\x28\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0c\x28\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0e\x28\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x10\x28\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x0f\x20\xc0\x48\xc7\xc2\x00\x68\x00\x00\x48\x89\xc0\x0f\x79\xd0\x0f\x20\xd8\x48\xc7\xc2\x02\x68\x00\x00\x48\x89\xc0\x0f\x79\xd0\x0f\x20\xe0\x48\xc7\xc2\x04\x68\x00\x00\x48\x89\xc0\x0f\x79\xd0\x0f\x01\xc2\x48\xc7\xc2\x00\x44\x00\x00\x0f\x78\xd0\xf4";
+const char kvm_asm64_init_vm[] = "\x0f\x20\xc0\x0d\x00\x00\x00\x80\x0f\x22\xc0\xea\xde\xc0\xad\x0b\x50\x00\x48\xc7\xc0\xd8\x00\x00\x00\x0f\x00\xd8\x48\xc7\xc1\x3a\x00\x00\x00\x0f\x32\x48\x83\xc8\x05\x0f\x30\x0f\x20\xe0\x48\x0d\x00\x20\x00\x00\x0f\x22\xe0\x48\xc7\xc1\x80\x04\x00\x00\x0f\x32\x48\xc7\xc2\x00\x60\x00\x00\x89\x02\x48\xc7\xc2\x00\x70\x00\x00\x89\x02\x48\xc7\xc0\x00\x5f\x00\x00\xf3\x0f\xc7\x30\x48\xc7\xc0\x08\x5f\x00\x00\x66\x0f\xc7\x30\x0f\xc7\x30\x48\xc7\xc1\x81\x04\x00\x00\x0f\x32\x48\x83\xc8\x3f\x48\x21\xd0\x48\xc7\xc2\x00\x40\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x02\x40\x00\x00\x48\xb8\x84\x9e\x99\xf3\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x1e\x40\x00\x00\x48\xc7\xc0\x81\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc1\x83\x04\x00\x00\x0f\x32\x48\x0d\xff\x6f\x03\x00\x48\x21\xd0\x48\xc7\xc2\x0c\x40\x00\x00\x0f\x79\xd0\x48\xc7\xc1\x84\x04\x00\x00\x0f\x32\x48\x0d\xff\x17\x00\x00\x48\x21\xd0\x48\xc7\xc2\x12\x40\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x04\x2c\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x00\x28\x00\x00\x48\xc7\xc0\xff\xff\xff\xff\x0f\x79\xd0\x48\xc7\xc2\x02\x0c\x00\x00\x48\xc7\xc0\x50\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc0\x58\x00\x00\x00\x48\xc7\xc2\x00\x0c\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x04\x0c\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x06\x0c\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x08\x0c\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0a\x0c\x00\x00\x0f\x79\xd0\x48\xc7\xc0\xd8\x00\x00\x00\x48\xc7\xc2\x0c\x0c\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x02\x2c\x00\x00\x48\xc7\xc0\x00\x05\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x00\x4c\x00\x00\x48\xc7\xc0\x50\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x10\x6c\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x12\x6c\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x0f\x20\xc0\x48\xc7\xc2\x00\x6c\x00\x00\x48\x89\xc0\x0f\x79\xd0\x0f\x20\xd8\x48\xc7\xc2\x02\x6c\x00\x00\x48\x89\xc0\x0f\x79\xd0\x0f\x20\xe0\x48\xc7\xc2\x04\x6c\x00\x00\x48\x89\xc0\x0f\x79\xd0\x48\xc7\xc2\x06\x6c\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x08\x6c\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0a\x6c\x00\x00\x48\xc7\xc0\x00\x3a\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0c\x6c\x00\x00\x48\xc7\xc0\x00\x10\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0e\x6c\x00\x00\x48\xc7\xc0\x00\x38\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x14\x6c\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x16\x6c\x00\x00\x48\x8b\x04\x25\x10\x5f\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x00\x00\x00\x00\x48\xc7\xc0\x01\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x02\x00\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x00\x20\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x02\x20\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x04\x20\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x06\x20\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc1\x77\x02\x00\x00\x0f\x32\x48\xc1\xe2\x20\x48\x09\xd0\x48\xc7\xc2\x00\x2c\x00\x00\x48\x89\xc0\x0f\x79\xd0\x48\xc7\xc2\x04\x40\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0a\x40\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0e\x40\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x10\x40\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x16\x40\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x14\x40\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x00\x60\x00\x00\x48\xc7\xc0\xff\xff\xff\xff\x0f\x79\xd0\x48\xc7\xc2\x02\x60\x00\x00\x48\xc7\xc0\xff\xff\xff\xff\x0f\x79\xd0\x48\xc7\xc2\x1c\x20\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x1e\x20\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x20\x20\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x22\x20\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x00\x08\x00\x00\x48\xc7\xc0\x58\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x02\x08\x00\x00\x48\xc7\xc0\x50\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x04\x08\x00\x00\x48\xc7\xc0\x58\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x06\x08\x00\x00\x48\xc7\xc0\x58\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x08\x08\x00\x00\x48\xc7\xc0\x58\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0a\x08\x00\x00\x48\xc7\xc0\x58\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0c\x08\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0e\x08\x00\x00\x48\xc7\xc0\xd8\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x12\x68\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x14\x68\x00\x00\x48\xc7\xc0\x00\x3a\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x16\x68\x00\x00\x48\xc7\xc0\x00\x10\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x18\x68\x00\x00\x48\xc7\xc0\x00\x38\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x00\x48\x00\x00\x48\xc7\xc0\xff\xff\x0f\x00\x0f\x79\xd0\x48\xc7\xc2\x02\x48\x00\x00\x48\xc7\xc0\xff\xff\x0f\x00\x0f\x79\xd0\x48\xc7\xc2\x04\x48\x00\x00\x48\xc7\xc0\xff\xff\x0f\x00\x0f\x79\xd0\x48\xc7\xc2\x06\x48\x00\x00\x48\xc7\xc0\xff\xff\x0f\x00\x0f\x79\xd0\x48\xc7\xc2\x08\x48\x00\x00\x48\xc7\xc0\xff\xff\x0f\x00\x0f\x79\xd0\x48\xc7\xc2\x0a\x48\x00\x00\x48\xc7\xc0\xff\xff\x0f\x00\x0f\x79\xd0\x48\xc7\xc2\x0c\x48\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0e\x48\x00\x00\x48\xc7\xc0\xff\x1f\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x10\x48\x00\x00\x48\xc7\xc0\xff\x1f\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x12\x48\x00\x00\x48\xc7\xc0\xff\x1f\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x14\x48\x00\x00\x48\xc7\xc0\x93\x40\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x16\x48\x00\x00\x48\xc7\xc0\x9b\x20\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x18\x48\x00\x00\x48\xc7\xc0\x93\x40\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x1a\x48\x00\x00\x48\xc7\xc0\x93\x40\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x1c\x48\x00\x00\x48\xc7\xc0\x93\x40\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x1e\x48\x00\x00\x48\xc7\xc0\x93\x40\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x20\x48\x00\x00\x48\xc7\xc0\x82\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x22\x48\x00\x00\x48\xc7\xc0\x8b\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x1c\x68\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x1e\x68\x00\x00\x48\xc7\xc0\x00\x91\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x20\x68\x00\x00\x48\xc7\xc0\x02\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x06\x28\x00\x00\x48\xc7\xc0\x00\x05\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0a\x28\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0c\x28\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x0e\x28\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x48\xc7\xc2\x10\x28\x00\x00\x48\xc7\xc0\x00\x00\x00\x00\x0f\x79\xd0\x0f\x20\xc0\x48\xc7\xc2\x00\x68\x00\x00\x48\x89\xc0\x0f\x79\xd0\x0f\x20\xd8\x48\xc7\xc2\x02\x68\x00\x00\x48\x89\xc0\x0f\x79\xd0\x0f\x20\xe0\x48\xc7\xc2\x04\x68\x00\x00\x48\x89\xc0\x0f\x79\xd0\x48\xc7\xc2\x18\x5f\x00\x00\x48\xc7\xc1\x20\x5f\x00\x00\x48\x31\xc0\x0f\x78\xd0\x48\x31\xc8\x0f\x79\xd0\x0f\x01\xc2\x48\xc7\xc2\x00\x44\x00\x00\x0f\x78\xd0\xf4";
 const char kvm_asm64_vm_exit[] = "\x48\xc7\xc3\x00\x44\x00\x00\x0f\x78\xda\x48\xc7\xc3\x02\x44\x00\x00\x0f\x78\xd9\x48\xc7\xc0\x00\x64\x00\x00\x0f\x78\xc0\x48\xc7\xc3\x1e\x68\x00\x00\x0f\x78\xdb\xf4";
 const char kvm_asm64_cpl3[] = "\x0f\x20\xc0\x0d\x00\x00\x00\x80\x0f\x22\xc0\xea\xde\xc0\xad\x0b\x50\x00\x48\xc7\xc0\xd8\x00\x00\x00\x0f\x00\xd8\x48\xc7\xc0\x6b\x00\x00\x00\x8e\xd8\x8e\xc0\x8e\xe0\x8e\xe8\x48\xc7\xc4\x80\x0f\x00\x00\x48\xc7\x04\x24\x1d\xba\x00\x00\x48\xc7\x44\x24\x04\x63\x00\x00\x00\x48\xc7\x44\x24\x08\x80\x0f\x00\x00\x48\xc7\x44\x24\x0c\x6b\x00\x00\x00\xcb";
diff --git a/executor/kvm.h b/executor/kvm.h
index feb21490d..18b88d1f9 100644
--- a/executor/kvm.h
+++ b/executor/kvm.h
@@ -24,6 +24,8 @@
 #define ADDR_VAR_VMXON_PTR 0x5f00
 #define ADDR_VAR_VMCS_PTR 0x5f08
 #define ADDR_VAR_VMEXIT_PTR 0x5f10
+#define ADDR_VAR_VMWRITE_FLD 0x5f18
+#define ADDR_VAR_VMWRITE_VAL 0x5f20
 #define ADDR_VAR_VMXON 0x6000
 #define ADDR_VAR_VMCS 0x7000
 #define ADDR_VAR_VMEXIT_CODE 0x9000
diff --git a/sys/kvm.txt b/sys/kvm.txt
index 9898ca046..abc2baf8b 100644
--- a/sys/kvm.txt
+++ b/sys/kvm.txt
@@ -195,28 +195,66 @@ kvm_setup_opt_x86 [
 	cr4	kvm_setup_opt_cr4
 	efer	kvm_setup_opt_efer
 	flags	kvm_setup_opt_flags
+	cstype0	kvm_setup_opt_cstype0
+	cstype3	kvm_setup_opt_cstype3
+	dstype0	kvm_setup_opt_dstype0
+	dstype3	kvm_setup_opt_dstype3
+	vmwrite	kvm_setup_opt_vmwrite
 ] [varlen]
 
 kvm_setup_opt_cr0 {
-	typ	const[1, int64]
+	typ	const[0, int64]
 	val	flags[kvm_x86_cr0, int64]
 }
 
 kvm_setup_opt_cr4 {
-	typ	const[2, int64]
+	typ	const[1, int64]
 	val	flags[kvm_x86_cr4, int64]
 }
 
 kvm_setup_opt_efer {
-	typ	const[3, int64]
+	typ	const[2, int64]
 	val	flags[kvm_x86_efer, int64]
 }
 
 kvm_setup_opt_flags {
-	typ	const[4, int64]
+	typ	const[3, int64]
 	val	flags[kvm_x86_rflags, int64]
 }
 
+kvm_setup_opt_cstype0 {
+	typ	const[4, int64]
+	val	int64[0:15]
+}
+
+kvm_setup_opt_cstype3 {
+	typ	const[5, int64]
+	val	int64[0:15]
+}
+
+kvm_setup_opt_dstype0 {
+	typ	const[6, int64]
+	val	int64[0:15]
+}
+
+kvm_setup_opt_dstype3 {
+	typ	const[7, int64]
+	val	int64[0:15]
+}
+
+kvm_setup_opt_vmwrite {
+	typ	const[8, int64]
+# Low 16 bits are field index, high 48 bits are value.
+	sz	const[0, int64:1]
+	fld	int64:5
+	pad0	const[0, int64:4]
+	ftyp	int64:2
+	pad1	const[0, int64:1]
+	fsz	int64:2
+	pad2	const[0, int64:1]
+	val	int64:48
+}
+
 kvm_setup_opt_arm64 [
 # unions need at least 2 fields, but we have only 1 now, but we want to have it as union for future extention
 	featur1	kvm_setup_opt_feature