VMRUN

if not efer >> 12 & 1:
    fault(UD)                    # EFER.SVME clear: SVM off
if CPL > 0:
    fault(GP, 0)
a = addr.read()                  # the VMCB's physical address
if a & 0xFFF or a >> maxphyaddr:
    fault(GP, 0)
if intercepted(0x80):
    vm_exit(0x80)                # in a guest: to its hypervisor
save_host(msr[VM_HSAVE_PA])      # for the #VMEXIT that returns:
                                 # the selectors of ES, CS, SS and
                                 # DS, GDTR, IDTR, EFER, CR0, CR3,
                                 # CR4, RFLAGS, RSP, RAX and the RIP
                                 # after VMRUN
if not vmcb_ok():
    phys_write(a + 0x70, 64, -1) # #VMEXIT(INVALID), 15.5.1: the
    gif = 0                      # exit code -1, the host's state
                                 # back, and the host goes on after
                                 # VMRUN
else:
    es = phys_read(a + 0x400, 16)  # each selector with the
    cs = phys_read(a + 0x410, 16)  # attributes, limit and base
    ss = phys_read(a + 0x420, 16)  # after it, which the notation
    ds = phys_read(a + 0x430, 16)  # does not name
    base = phys_read(a + 0x468, 64)  # GDTR: the base in bits
    lim = phys_read(a + 0x464, 16)   # 79:16, the limit in 15:0
    gdtr = base << 16 | lim
    base = phys_read(a + 0x488, 64)
    lim = phys_read(a + 0x484, 16)
    idtr = base << 16 | lim
    efer = phys_read(a + 0x4D0, 64)
    cr0 = phys_read(a + 0x558, 64)
    cr2 = phys_read(a + 0x640, 64)
    cr3 = phys_read(a + 0x550, 64)
    cr4 = phys_read(a + 0x548, 64)
    dr6 = phys_read(a + 0x568, 64)
    dr7 = phys_read(a + 0x560, 64)
    set_rflags(phys_read(a + 0x570, 64))
    rip = phys_read(a + 0x578, 64)
    rsp = phys_read(a + 0x5D8, 64)
    rax = phys_read(a + 0x5F8, 64)
    set_cpl(phys_read(a + 0x4CB, 8))
    gif = 1                      # the guest takes interrupts
# the control area loads too: the intercepts, TSC_OFFSET, the
# virtual interrupts, the guest's ASID, nested paging with nCR3
# and the guest's PAT; TLB_CONTROL (058H) flushes the TLB as it
# says, and an event in EVENTINJ (0A8H, valid bit 31) is delivered
# before the guest's first instruction. A #VMEXIT stores the
# guest's state back and reloads the host's (15.6)