diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 5ab07a0..2453c67 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -206,6 +206,21 @@ struct __attribute__ ((__packed__)) level_state {
 	int launched;
 };
 
+enum vmcs_field_type {
+	VMCS_FIELD_TYPE_U16 = 0,
+	VMCS_FIELD_TYPE_U64 = 1,
+	VMCS_FIELD_TYPE_U32 = 2,
+	VMCS_FIELD_TYPE_ULONG = 3
+};
+
+#define VMCS_FIELD_LENGTH_OFFSET 13
+#define VMCS_FIELD_LENGTH_MASK 0x6000
+
+static inline int vmcs_field_length(unsigned long field)
+{
+	return (VMCS_FIELD_LENGTH_MASK & field) >> 13;
+}
+
 struct vmcs {
 	u32 revision_id;
 	u32 abort;
@@ -287,6 +302,411 @@ static inline struct vcpu_vmx *to_vmx(struct kvm_vcpu *vcpu)
 	return container_of(vcpu, struct vcpu_vmx, vcpu);
 }
 
+static unsigned short vmcs_field_to_offset_table[HOST_RIP+1];
+
+static void init_vmcs_field_to_offset_table(void)
+{
+	memset(vmcs_field_to_offset_table,0xff,
+	       sizeof(vmcs_field_to_offset_table));
+
+	vmcs_field_to_offset_table[VIRTUAL_PROCESSOR_ID] =
+		offsetof(struct shadow_vmcs, virtual_processor_id);
+	vmcs_field_to_offset_table[GUEST_ES_SELECTOR] =
+		offsetof(struct shadow_vmcs, guest_es_selector);
+	vmcs_field_to_offset_table[GUEST_CS_SELECTOR] =
+		offsetof(struct shadow_vmcs, guest_cs_selector);
+	vmcs_field_to_offset_table[GUEST_SS_SELECTOR] =
+		offsetof(struct shadow_vmcs, guest_ss_selector);
+	vmcs_field_to_offset_table[GUEST_DS_SELECTOR] =
+		offsetof(struct shadow_vmcs, guest_ds_selector);
+	vmcs_field_to_offset_table[GUEST_FS_SELECTOR] =
+		offsetof(struct shadow_vmcs, guest_fs_selector);
+	vmcs_field_to_offset_table[GUEST_GS_SELECTOR] =
+		offsetof(struct shadow_vmcs, guest_gs_selector);
+	vmcs_field_to_offset_table[GUEST_LDTR_SELECTOR] =
+		offsetof(struct shadow_vmcs, guest_ldtr_selector);
+	vmcs_field_to_offset_table[GUEST_TR_SELECTOR] =
+		offsetof(struct shadow_vmcs, guest_tr_selector);
+	vmcs_field_to_offset_table[HOST_ES_SELECTOR] =
+		offsetof(struct shadow_vmcs, host_es_selector);
+	vmcs_field_to_offset_table[HOST_CS_SELECTOR] =
+		offsetof(struct shadow_vmcs, host_cs_selector);
+	vmcs_field_to_offset_table[HOST_SS_SELECTOR] =
+		offsetof(struct shadow_vmcs, host_ss_selector);
+	vmcs_field_to_offset_table[HOST_DS_SELECTOR] =
+		offsetof(struct shadow_vmcs, host_ds_selector);
+	vmcs_field_to_offset_table[HOST_FS_SELECTOR] =
+		offsetof(struct shadow_vmcs, host_fs_selector);
+	vmcs_field_to_offset_table[HOST_GS_SELECTOR] =
+		offsetof(struct shadow_vmcs, host_gs_selector);
+	vmcs_field_to_offset_table[HOST_TR_SELECTOR] =
+		offsetof(struct shadow_vmcs, host_tr_selector);
+	vmcs_field_to_offset_table[IO_BITMAP_A] =
+		offsetof(struct shadow_vmcs, io_bitmap_a);
+	vmcs_field_to_offset_table[IO_BITMAP_A_HIGH] =
+		offsetof(struct shadow_vmcs, io_bitmap_a)+4;
+	vmcs_field_to_offset_table[IO_BITMAP_B] =
+		offsetof(struct shadow_vmcs, io_bitmap_b);
+	vmcs_field_to_offset_table[IO_BITMAP_B_HIGH] =
+		offsetof(struct shadow_vmcs, io_bitmap_b)+4;
+	vmcs_field_to_offset_table[MSR_BITMAP] =
+		offsetof(struct shadow_vmcs, msr_bitmap);
+	vmcs_field_to_offset_table[MSR_BITMAP_HIGH] =
+		offsetof(struct shadow_vmcs, msr_bitmap)+4;
+	vmcs_field_to_offset_table[VM_EXIT_MSR_STORE_ADDR] =
+		offsetof(struct shadow_vmcs, vm_exit_msr_store_addr);
+	vmcs_field_to_offset_table[VM_EXIT_MSR_STORE_ADDR_HIGH] =
+		offsetof(struct shadow_vmcs, vm_exit_msr_store_addr)+4;
+	vmcs_field_to_offset_table[VM_EXIT_MSR_LOAD_ADDR] =
+		offsetof(struct shadow_vmcs, vm_exit_msr_load_addr);
+	vmcs_field_to_offset_table[VM_EXIT_MSR_LOAD_ADDR_HIGH] =
+		offsetof(struct shadow_vmcs, vm_exit_msr_load_addr)+4;
+	vmcs_field_to_offset_table[VM_ENTRY_MSR_LOAD_ADDR] =
+		offsetof(struct shadow_vmcs, vm_entry_msr_load_addr);
+	vmcs_field_to_offset_table[VM_ENTRY_MSR_LOAD_ADDR_HIGH] =
+		offsetof(struct shadow_vmcs, vm_entry_msr_load_addr)+4;
+	vmcs_field_to_offset_table[TSC_OFFSET] =
+		offsetof(struct shadow_vmcs, tsc_offset);
+	vmcs_field_to_offset_table[TSC_OFFSET_HIGH] =
+		offsetof(struct shadow_vmcs, tsc_offset)+4;
+	vmcs_field_to_offset_table[VIRTUAL_APIC_PAGE_ADDR] =
+		offsetof(struct shadow_vmcs, virtual_apic_page_addr);
+	vmcs_field_to_offset_table[VIRTUAL_APIC_PAGE_ADDR_HIGH] =
+		offsetof(struct shadow_vmcs, virtual_apic_page_addr)+4;
+	vmcs_field_to_offset_table[APIC_ACCESS_ADDR] =
+		offsetof(struct shadow_vmcs, apic_access_addr);
+	vmcs_field_to_offset_table[APIC_ACCESS_ADDR_HIGH] =
+		offsetof(struct shadow_vmcs, apic_access_addr)+4;
+	vmcs_field_to_offset_table[EPT_POINTER] =
+		offsetof(struct shadow_vmcs, ept_pointer);
+	vmcs_field_to_offset_table[EPT_POINTER_HIGH] =
+		offsetof(struct shadow_vmcs, ept_pointer)+4;
+	vmcs_field_to_offset_table[GUEST_PHYSICAL_ADDRESS] =
+		offsetof(struct shadow_vmcs, guest_physical_address);
+	vmcs_field_to_offset_table[GUEST_PHYSICAL_ADDRESS_HIGH] =
+		offsetof(struct shadow_vmcs, guest_physical_address)+4;
+	vmcs_field_to_offset_table[VMCS_LINK_POINTER] =
+		offsetof(struct shadow_vmcs, vmcs_link_pointer);
+	vmcs_field_to_offset_table[VMCS_LINK_POINTER_HIGH] =
+		offsetof(struct shadow_vmcs, vmcs_link_pointer)+4;
+	vmcs_field_to_offset_table[GUEST_IA32_DEBUGCTL] =
+		offsetof(struct shadow_vmcs, guest_ia32_debugctl);
+	vmcs_field_to_offset_table[GUEST_IA32_DEBUGCTL_HIGH] =
+		offsetof(struct shadow_vmcs, guest_ia32_debugctl)+4;
+	vmcs_field_to_offset_table[GUEST_IA32_PAT] =
+		offsetof(struct shadow_vmcs, guest_ia32_pat);
+	vmcs_field_to_offset_table[GUEST_IA32_PAT_HIGH] =
+		offsetof(struct shadow_vmcs, guest_ia32_pat)+4;
+	vmcs_field_to_offset_table[GUEST_PDPTR0] =
+		offsetof(struct shadow_vmcs, guest_pdptr0);
+	vmcs_field_to_offset_table[GUEST_PDPTR0_HIGH] =
+		offsetof(struct shadow_vmcs, guest_pdptr0)+4;
+	vmcs_field_to_offset_table[GUEST_PDPTR1] =
+		offsetof(struct shadow_vmcs, guest_pdptr1);
+	vmcs_field_to_offset_table[GUEST_PDPTR1_HIGH] =
+		offsetof(struct shadow_vmcs, guest_pdptr1)+4;
+	vmcs_field_to_offset_table[GUEST_PDPTR2] =
+		offsetof(struct shadow_vmcs, guest_pdptr2);
+	vmcs_field_to_offset_table[GUEST_PDPTR2_HIGH] =
+		offsetof(struct shadow_vmcs, guest_pdptr2)+4;
+	vmcs_field_to_offset_table[GUEST_PDPTR3] =
+		offsetof(struct shadow_vmcs, guest_pdptr3);
+	vmcs_field_to_offset_table[GUEST_PDPTR3_HIGH] =
+		offsetof(struct shadow_vmcs, guest_pdptr3)+4;
+	vmcs_field_to_offset_table[HOST_IA32_PAT] =
+		offsetof(struct shadow_vmcs, host_ia32_pat);
+	vmcs_field_to_offset_table[HOST_IA32_PAT_HIGH] =
+		offsetof(struct shadow_vmcs, host_ia32_pat)+4;
+	vmcs_field_to_offset_table[PIN_BASED_VM_EXEC_CONTROL] =
+		offsetof(struct shadow_vmcs, pin_based_vm_exec_control);
+	vmcs_field_to_offset_table[CPU_BASED_VM_EXEC_CONTROL] =
+		offsetof(struct shadow_vmcs, cpu_based_vm_exec_control);
+	vmcs_field_to_offset_table[EXCEPTION_BITMAP] =
+		offsetof(struct shadow_vmcs, exception_bitmap);
+	vmcs_field_to_offset_table[PAGE_FAULT_ERROR_CODE_MASK] =
+		offsetof(struct shadow_vmcs, page_fault_error_code_mask);
+	vmcs_field_to_offset_table[PAGE_FAULT_ERROR_CODE_MATCH] =
+		offsetof(struct shadow_vmcs,
+				page_fault_error_code_match);
+	vmcs_field_to_offset_table[CR3_TARGET_COUNT] =
+		offsetof(struct shadow_vmcs, cr3_target_count);
+	vmcs_field_to_offset_table[VM_EXIT_CONTROLS] =
+		offsetof(struct shadow_vmcs, vm_exit_controls);
+	vmcs_field_to_offset_table[VM_EXIT_MSR_STORE_COUNT] =
+		offsetof(struct shadow_vmcs, vm_exit_msr_store_count);
+	vmcs_field_to_offset_table[VM_EXIT_MSR_LOAD_COUNT] =
+		offsetof(struct shadow_vmcs, vm_exit_msr_load_count);
+	vmcs_field_to_offset_table[VM_ENTRY_CONTROLS] =
+		offsetof(struct shadow_vmcs, vm_entry_controls);
+	vmcs_field_to_offset_table[VM_ENTRY_MSR_LOAD_COUNT] =
+		offsetof(struct shadow_vmcs, vm_entry_msr_load_count);
+	vmcs_field_to_offset_table[VM_ENTRY_INTR_INFO_FIELD] =
+		offsetof(struct shadow_vmcs, vm_entry_intr_info_field);
+	vmcs_field_to_offset_table[VM_ENTRY_EXCEPTION_ERROR_CODE] =
+		offsetof(struct shadow_vmcs,
+				vm_entry_exception_error_code);
+	vmcs_field_to_offset_table[VM_ENTRY_INSTRUCTION_LEN] =
+		offsetof(struct shadow_vmcs, vm_entry_instruction_len);
+	vmcs_field_to_offset_table[TPR_THRESHOLD] =
+		offsetof(struct shadow_vmcs, tpr_threshold);
+	vmcs_field_to_offset_table[SECONDARY_VM_EXEC_CONTROL] =
+		offsetof(struct shadow_vmcs, secondary_vm_exec_control);
+	vmcs_field_to_offset_table[VM_INSTRUCTION_ERROR] =
+		offsetof(struct shadow_vmcs, vm_instruction_error);
+	vmcs_field_to_offset_table[VM_EXIT_REASON] =
+		offsetof(struct shadow_vmcs, vm_exit_reason);
+	vmcs_field_to_offset_table[VM_EXIT_INTR_INFO] =
+		offsetof(struct shadow_vmcs, vm_exit_intr_info);
+	vmcs_field_to_offset_table[VM_EXIT_INTR_ERROR_CODE] =
+		offsetof(struct shadow_vmcs, vm_exit_intr_error_code);
+	vmcs_field_to_offset_table[IDT_VECTORING_INFO_FIELD] =
+		offsetof(struct shadow_vmcs, idt_vectoring_info_field);
+	vmcs_field_to_offset_table[IDT_VECTORING_ERROR_CODE] =
+		offsetof(struct shadow_vmcs, idt_vectoring_error_code);
+	vmcs_field_to_offset_table[VM_EXIT_INSTRUCTION_LEN] =
+		offsetof(struct shadow_vmcs, vm_exit_instruction_len);
+	vmcs_field_to_offset_table[VMX_INSTRUCTION_INFO] =
+		offsetof(struct shadow_vmcs, vmx_instruction_info);
+	vmcs_field_to_offset_table[GUEST_ES_LIMIT] =
+		offsetof(struct shadow_vmcs, guest_es_limit);
+	vmcs_field_to_offset_table[GUEST_CS_LIMIT] =
+		offsetof(struct shadow_vmcs, guest_cs_limit);
+	vmcs_field_to_offset_table[GUEST_SS_LIMIT] =
+		offsetof(struct shadow_vmcs, guest_ss_limit);
+	vmcs_field_to_offset_table[GUEST_DS_LIMIT] =
+		offsetof(struct shadow_vmcs, guest_ds_limit);
+	vmcs_field_to_offset_table[GUEST_FS_LIMIT] =
+		offsetof(struct shadow_vmcs, guest_fs_limit);
+	vmcs_field_to_offset_table[GUEST_GS_LIMIT] =
+		offsetof(struct shadow_vmcs, guest_gs_limit);
+	vmcs_field_to_offset_table[GUEST_LDTR_LIMIT] =
+		offsetof(struct shadow_vmcs, guest_ldtr_limit);
+	vmcs_field_to_offset_table[GUEST_TR_LIMIT] =
+		offsetof(struct shadow_vmcs, guest_tr_limit);
+	vmcs_field_to_offset_table[GUEST_GDTR_LIMIT] =
+		offsetof(struct shadow_vmcs, guest_gdtr_limit);
+	vmcs_field_to_offset_table[GUEST_IDTR_LIMIT] =
+		offsetof(struct shadow_vmcs, guest_idtr_limit);
+	vmcs_field_to_offset_table[GUEST_ES_AR_BYTES] =
+		offsetof(struct shadow_vmcs, guest_es_ar_bytes);
+	vmcs_field_to_offset_table[GUEST_CS_AR_BYTES] =
+		offsetof(struct shadow_vmcs, guest_cs_ar_bytes);
+	vmcs_field_to_offset_table[GUEST_SS_AR_BYTES] =
+		offsetof(struct shadow_vmcs, guest_ss_ar_bytes);
+	vmcs_field_to_offset_table[GUEST_DS_AR_BYTES] =
+		offsetof(struct shadow_vmcs, guest_ds_ar_bytes);
+	vmcs_field_to_offset_table[GUEST_FS_AR_BYTES] =
+		offsetof(struct shadow_vmcs, guest_fs_ar_bytes);
+	vmcs_field_to_offset_table[GUEST_GS_AR_BYTES] =
+		offsetof(struct shadow_vmcs, guest_gs_ar_bytes);
+	vmcs_field_to_offset_table[GUEST_LDTR_AR_BYTES] =
+		offsetof(struct shadow_vmcs, guest_ldtr_ar_bytes);
+	vmcs_field_to_offset_table[GUEST_TR_AR_BYTES] =
+		offsetof(struct shadow_vmcs, guest_tr_ar_bytes);
+	vmcs_field_to_offset_table[GUEST_INTERRUPTIBILITY_INFO] =
+		offsetof(struct shadow_vmcs,
+				guest_interruptibility_info);
+	vmcs_field_to_offset_table[GUEST_ACTIVITY_STATE] =
+		offsetof(struct shadow_vmcs, guest_activity_state);
+	vmcs_field_to_offset_table[GUEST_SYSENTER_CS] =
+		offsetof(struct shadow_vmcs, guest_sysenter_cs);
+	vmcs_field_to_offset_table[HOST_IA32_SYSENTER_CS] =
+		offsetof(struct shadow_vmcs, host_ia32_sysenter_cs);
+	vmcs_field_to_offset_table[CR0_GUEST_HOST_MASK] =
+		offsetof(struct shadow_vmcs, cr0_guest_host_mask);
+	vmcs_field_to_offset_table[CR4_GUEST_HOST_MASK] =
+		offsetof(struct shadow_vmcs, cr4_guest_host_mask);
+	vmcs_field_to_offset_table[CR0_READ_SHADOW] =
+		offsetof(struct shadow_vmcs, cr0_read_shadow);
+	vmcs_field_to_offset_table[CR4_READ_SHADOW] =
+		offsetof(struct shadow_vmcs, cr4_read_shadow);
+	vmcs_field_to_offset_table[CR3_TARGET_VALUE0] =
+		offsetof(struct shadow_vmcs, cr3_target_value0);
+	vmcs_field_to_offset_table[CR3_TARGET_VALUE1] =
+		offsetof(struct shadow_vmcs, cr3_target_value1);
+	vmcs_field_to_offset_table[CR3_TARGET_VALUE2] =
+		offsetof(struct shadow_vmcs, cr3_target_value2);
+	vmcs_field_to_offset_table[CR3_TARGET_VALUE3] =
+		offsetof(struct shadow_vmcs, cr3_target_value3);
+	vmcs_field_to_offset_table[EXIT_QUALIFICATION] =
+		offsetof(struct shadow_vmcs, exit_qualification);
+	vmcs_field_to_offset_table[GUEST_LINEAR_ADDRESS] =
+		offsetof(struct shadow_vmcs, guest_linear_address);
+	vmcs_field_to_offset_table[GUEST_CR0] =
+		offsetof(struct shadow_vmcs, guest_cr0);
+	vmcs_field_to_offset_table[GUEST_CR3] =
+		offsetof(struct shadow_vmcs, guest_cr3);
+	vmcs_field_to_offset_table[GUEST_CR4] =
+		offsetof(struct shadow_vmcs, guest_cr4);
+	vmcs_field_to_offset_table[GUEST_ES_BASE] =
+		offsetof(struct shadow_vmcs, guest_es_base);
+	vmcs_field_to_offset_table[GUEST_CS_BASE] =
+		offsetof(struct shadow_vmcs, guest_cs_base);
+	vmcs_field_to_offset_table[GUEST_SS_BASE] =
+		offsetof(struct shadow_vmcs, guest_ss_base);
+	vmcs_field_to_offset_table[GUEST_DS_BASE] =
+		offsetof(struct shadow_vmcs, guest_ds_base);
+	vmcs_field_to_offset_table[GUEST_FS_BASE] =
+		offsetof(struct shadow_vmcs, guest_fs_base);
+	vmcs_field_to_offset_table[GUEST_GS_BASE] =
+		offsetof(struct shadow_vmcs, guest_gs_base);
+	vmcs_field_to_offset_table[GUEST_LDTR_BASE] =
+		offsetof(struct shadow_vmcs, guest_ldtr_base);
+	vmcs_field_to_offset_table[GUEST_TR_BASE] =
+		offsetof(struct shadow_vmcs, guest_tr_base);
+	vmcs_field_to_offset_table[GUEST_GDTR_BASE] =
+		offsetof(struct shadow_vmcs, guest_gdtr_base);
+	vmcs_field_to_offset_table[GUEST_IDTR_BASE] =
+		offsetof(struct shadow_vmcs, guest_idtr_base);
+	vmcs_field_to_offset_table[GUEST_DR7] =
+		offsetof(struct shadow_vmcs, guest_dr7);
+	vmcs_field_to_offset_table[GUEST_RSP] =
+		offsetof(struct shadow_vmcs, guest_rsp);
+	vmcs_field_to_offset_table[GUEST_RIP] =
+		offsetof(struct shadow_vmcs, guest_rip);
+	vmcs_field_to_offset_table[GUEST_RFLAGS] =
+		offsetof(struct shadow_vmcs, guest_rflags);
+	vmcs_field_to_offset_table[GUEST_PENDING_DBG_EXCEPTIONS] =
+		offsetof(struct shadow_vmcs,
+				guest_pending_dbg_exceptions);
+	vmcs_field_to_offset_table[GUEST_SYSENTER_ESP] =
+		offsetof(struct shadow_vmcs, guest_sysenter_esp);
+	vmcs_field_to_offset_table[GUEST_SYSENTER_EIP] =
+		offsetof(struct shadow_vmcs, guest_sysenter_eip);
+	vmcs_field_to_offset_table[HOST_CR0] =
+		offsetof(struct shadow_vmcs, host_cr0);
+	vmcs_field_to_offset_table[HOST_CR3] =
+		offsetof(struct shadow_vmcs, host_cr3);
+	vmcs_field_to_offset_table[HOST_CR4] =
+		offsetof(struct shadow_vmcs, host_cr4);
+	vmcs_field_to_offset_table[HOST_FS_BASE] =
+		offsetof(struct shadow_vmcs, host_fs_base);
+	vmcs_field_to_offset_table[HOST_GS_BASE] =
+		offsetof(struct shadow_vmcs, host_gs_base);
+	vmcs_field_to_offset_table[HOST_TR_BASE] =
+		offsetof(struct shadow_vmcs, host_tr_base);
+	vmcs_field_to_offset_table[HOST_GDTR_BASE] =
+		offsetof(struct shadow_vmcs, host_gdtr_base);
+	vmcs_field_to_offset_table[HOST_IDTR_BASE] =
+		offsetof(struct shadow_vmcs, host_idtr_base);
+	vmcs_field_to_offset_table[HOST_IA32_SYSENTER_ESP] =
+		offsetof(struct shadow_vmcs, host_ia32_sysenter_esp);
+	vmcs_field_to_offset_table[HOST_IA32_SYSENTER_EIP] =
+		offsetof(struct shadow_vmcs, host_ia32_sysenter_eip);
+	vmcs_field_to_offset_table[HOST_RSP] =
+		offsetof(struct shadow_vmcs, host_rsp);
+	vmcs_field_to_offset_table[HOST_RIP] =
+		offsetof(struct shadow_vmcs, host_rip);
+}
+
+static inline unsigned short vmcs_field_to_offset(unsigned long field)
+{
+
+	if (field > HOST_RIP || vmcs_field_to_offset_table[field] == -1) {
+		printk(KERN_ERR "invalid vmcs encoding 0x%lx\n", field);
+		return -1;
+	}
+
+	return vmcs_field_to_offset_table[field];
+}
+
+static inline unsigned long nested_vmcs_readl(struct kvm_vcpu *vcpu,
+					      unsigned long field)
+{
+	struct vcpu_vmx *vmx = to_vmx(vcpu);
+	unsigned long *entry;
+
+	if (!vmx->nested.l2_state->shadow_vmcs) {
+		printk(KERN_ERR "%s invalid nested vmcs\n", __func__);
+		return -1;
+	}
+
+	entry = (unsigned long*)((char*)(vmx->nested.l2_state->shadow_vmcs) +
+				 vmcs_field_to_offset(field));
+	return *entry;
+}
+
+static inline u16 nested_vmcs_read16(struct kvm_vcpu *vcpu,
+				     unsigned long field)
+{
+	return nested_vmcs_readl(vcpu, field);
+}
+
+static inline u32 nested_vmcs_read32(struct kvm_vcpu *vcpu, unsigned long field)
+{
+	return nested_vmcs_readl(vcpu, field);
+}
+
+static inline u64 nested_vmcs_read64(struct kvm_vcpu *vcpu, unsigned long field)
+{
+	struct vcpu_vmx *vmx = to_vmx(vcpu);
+	u64 *entry;
+	if (!vmx->nested.l2_state->shadow_vmcs) {
+		printk(KERN_ERR "%s invalid nested vmcs\n", __func__);
+		return -1;
+	}
+
+	entry = (u64*)((char*)(vmx->nested.l2_state->shadow_vmcs) +
+				 vmcs_field_to_offset(field));
+	return *entry;
+}
+
+static inline void nested_vmcs_writel(struct kvm_vcpu *vcpu,
+				      unsigned long field, unsigned long value)
+{
+	struct vcpu_vmx *vmx = to_vmx(vcpu);
+	unsigned long entry = 
+		(unsigned long)(vmx->nested.l2_state->shadow_vmcs);
+
+	if (!vmx->nested.l2_state->shadow_vmcs) {
+		printk(KERN_ERR "%s invalid nested vmcs\n", __func__);
+		return;
+	}
+	entry += vmcs_field_to_offset(field);
+	*(unsigned long *)entry = value;
+}
+
+static inline void nested_vmcs_write16(struct kvm_vcpu *vcpu,
+				       unsigned long field, u16 value)
+{
+	struct vcpu_vmx *vmx = to_vmx(vcpu);
+	unsigned long entry = 
+		(unsigned long)(vmx->nested.l2_state->shadow_vmcs);
+
+	if (!vmx->nested.l2_state->shadow_vmcs) {
+		printk(KERN_ERR "%s invalid nested vmcs\n", __func__);
+		return;
+	}
+	entry += vmcs_field_to_offset(field);
+	*(u16 *)entry = value;
+}
+
+static inline void nested_vmcs_write32(struct kvm_vcpu *vcpu,
+				       unsigned long field, u32 value)
+{
+	struct vcpu_vmx *vmx = to_vmx(vcpu);
+	unsigned long entry = 
+		(unsigned long)(vmx->nested.l2_state->shadow_vmcs);
+
+	if (!vmx->nested.l2_state->shadow_vmcs) {
+		printk(KERN_ERR "%s invalid nested vmcs\n", __func__);
+		return;
+	}
+	entry += vmcs_field_to_offset(field);
+	*(u32 *)entry = value;
+}
+
+static inline void nested_vmcs_write64(struct kvm_vcpu *vcpu,
+				       unsigned long field, u64 value)
+{
+#ifdef CONFIG_X86_64
+	nested_vmcs_writel(vcpu, field, value);
+#else /* nested: 32 bit not actually tested */
+	nested_vmcs_writel(vcpu, field, value);
+	nested_vmcs_writel(vcpu, field+1, value >> 32);
+#endif
+}
+
 static struct page *nested_get_page(struct kvm_vcpu *vcpu,
 				    u64 vmcs_addr)
 {
@@ -3429,6 +3849,26 @@ static void clear_rflags_cf_zf(struct kvm_vcpu *vcpu)
 	vmx_set_rflags(vcpu, rflags);
 }
 
+static void set_rflags_to_vmx_fail_invalid(struct kvm_vcpu *vcpu)
+{
+	unsigned long rflags;
+	rflags = vmx_get_rflags(vcpu);
+	rflags |= X86_EFLAGS_CF;
+	rflags &= ~X86_EFLAGS_PF & ~X86_EFLAGS_AF & ~X86_EFLAGS_ZF &
+		~X86_EFLAGS_SF & ~X86_EFLAGS_OF;
+	vmx_set_rflags(vcpu, rflags);
+}
+
+static void set_rflags_to_vmx_fail_valid(struct kvm_vcpu *vcpu)
+{
+	unsigned long rflags;
+	rflags = vmx_get_rflags(vcpu);
+	rflags |= X86_EFLAGS_ZF;
+	rflags &= ~X86_EFLAGS_PF & ~X86_EFLAGS_AF & ~X86_EFLAGS_CF &
+		~X86_EFLAGS_SF & ~X86_EFLAGS_OF;
+	vmx_set_rflags(vcpu, rflags);
+}
+
 static int handle_vmclear(struct kvm_vcpu *vcpu)
 {
 	if (!nested_vmx_check_permission(vcpu))
@@ -3557,6 +3997,116 @@ static int handle_vmx_insn(struct kvm_vcpu *vcpu)
 	return 1;
 }
 
+static int handle_vmread(struct kvm_vcpu *vcpu)
+{
+	struct vcpu_vmx *vmx = to_vmx(vcpu);
+
+#ifndef CONFIG_X86_64
+	u64 value;
+#endif
+
+	if (!nested_vmx_check_permission(vcpu))
+		return 1;
+
+	if (!vmx->nested.l2_state->shadow_vmcs) {
+		printk(KERN_INFO "%s no shadow vmcs\n", __func__);
+		set_rflags_to_vmx_fail_invalid(vcpu);
+		return 1;
+	}
+
+	switch (vmcs_field_length(vcpu->arch.regs[VCPU_REGS_RDX])) {
+	case VMCS_FIELD_TYPE_U16:
+		vcpu->arch.regs[VCPU_REGS_RAX] =
+			nested_vmcs_read16(vcpu,
+					   vcpu->arch.regs[VCPU_REGS_RDX]);
+		break;
+	case VMCS_FIELD_TYPE_U32:
+		vcpu->arch.regs[VCPU_REGS_RAX] =
+			nested_vmcs_read32(vcpu,
+					   vcpu->arch.regs[VCPU_REGS_RDX]);
+		break;
+	case VMCS_FIELD_TYPE_U64:
+#ifdef CONFIG_X86_64
+		vcpu->arch.regs[VCPU_REGS_RAX] =
+		nested_vmcs_read64(vcpu,
+					   vcpu->arch.regs[VCPU_REGS_RDX]);
+#else /* nested: 32 bit not actually tested */
+		value =  nested_vmcs_read64(vcpu,
+					    vcpu->arch.regs[VCPU_REGS_RDX]);
+		vcpu->arch.regs[VCPU_REGS_RAX] = value;
+		vcpu->arch.regs[VCPU_REGS_RBX] = value >> 32;
+#endif
+	break;
+	case VMCS_FIELD_TYPE_ULONG:
+		vcpu->arch.regs[VCPU_REGS_RAX] =
+			nested_vmcs_readl(vcpu,
+					  vcpu->arch.regs[VCPU_REGS_RDX]);
+		break;
+	default:
+		printk(KERN_INFO "%s invalid field\n", __func__);
+		set_rflags_to_vmx_fail_valid(vcpu);
+		vmcs_write32(VM_INSTRUCTION_ERROR, 12);
+		return 1;
+	}
+
+	clear_rflags_cf_zf(vcpu);
+	skip_emulated_instruction(vcpu);
+	return 1;
+}
+
+static int handle_vmwrite(struct kvm_vcpu *vcpu)
+{
+	struct vcpu_vmx *vmx = to_vmx(vcpu);
+#ifndef CONFIG_X86_64
+	u64 value ;
+#endif
+
+	if (!nested_vmx_check_permission(vcpu))
+		return 1;
+
+	if (!vmx->nested.l2_state->shadow_vmcs) {
+		printk(KERN_INFO "%s no shadow vmcs\n", __func__);
+		set_rflags_to_vmx_fail_invalid(vcpu);
+		return 1;
+	}
+
+	switch (vmcs_field_length(vcpu->arch.regs[VCPU_REGS_RDX])) {
+	case VMCS_FIELD_TYPE_U16:
+		nested_vmcs_write16(vcpu, vcpu->arch.regs[VCPU_REGS_RDX],
+				    vcpu->arch.regs[VCPU_REGS_RAX]);
+		break;
+	case VMCS_FIELD_TYPE_U32:
+		nested_vmcs_write32(vcpu, vcpu->arch.regs[VCPU_REGS_RDX],
+				    vcpu->arch.regs[VCPU_REGS_RAX]);
+		break;
+	case VMCS_FIELD_TYPE_U64:
+#ifdef CONFIG_X86_64
+		nested_vmcs_write64(vcpu, vcpu->arch.regs[VCPU_REGS_RDX],
+				    vcpu->arch.regs[VCPU_REGS_RAX]);
+#else /* nested: 32 bit not actually tested */
+		value =  vcpu->arch.regs[VCPU_REGS_RAX] |
+			(vcpu->arch.regs[VCPU_REGS_RBX] << 32);
+		nested_vmcs_write64(vcpu,
+				    vcpu->arch.regs[VCPU_REGS_RDX], value);
+#endif
+		break;
+	case VMCS_FIELD_TYPE_ULONG:
+		nested_vmcs_writel(vcpu, vcpu->arch.regs[VCPU_REGS_RDX],
+				   vcpu->arch.regs[VCPU_REGS_RAX]);
+		break;
+	default:
+		printk(KERN_INFO "%s invalid field\n", __func__);
+		set_rflags_to_vmx_fail_valid(vcpu);
+		vmcs_write32(VM_INSTRUCTION_ERROR, 12);
+		return 1;
+	}
+
+	clear_rflags_cf_zf(vcpu);
+
+	skip_emulated_instruction(vcpu);
+	return 1;
+}
+
 static int handle_vmoff(struct kvm_vcpu *vcpu)
 {
 	struct vcpu_vmx *vmx = to_vmx(vcpu);
@@ -3877,9 +4427,9 @@ static int (*kvm_vmx_exit_handlers[])(struct kvm_vcpu *vcpu) = {
 	[EXIT_REASON_VMLAUNCH]                = handle_vmx_insn,
 	[EXIT_REASON_VMPTRLD]                 = handle_vmptrld,
 	[EXIT_REASON_VMPTRST]                 = handle_vmptrst,
-	[EXIT_REASON_VMREAD]                  = handle_vmx_insn,
+	[EXIT_REASON_VMREAD]                  = handle_vmread,
 	[EXIT_REASON_VMRESUME]                = handle_vmx_insn,
-	[EXIT_REASON_VMWRITE]                 = handle_vmx_insn,
+	[EXIT_REASON_VMWRITE]                 = handle_vmwrite,
 	[EXIT_REASON_VMOFF]                   = handle_vmoff,
 	[EXIT_REASON_VMON]                    = handle_vmon,
 	[EXIT_REASON_TPR_BELOW_THRESHOLD]     = handle_tpr_below_threshold,
@@ -4625,6 +5175,8 @@ int create_l2_state(struct kvm_vcpu *vcpu)
 	vmx->nested.l2_state->io_bitmap_a = vmcs_read64(IO_BITMAP_A);
 	vmx->nested.l2_state->io_bitmap_b = vmcs_read64(IO_BITMAP_B);
 
+	init_vmcs_field_to_offset_table();
+
 	return 0;
 }
 
