Queued, thanks. The part that stood out in patch 2 is the removal of svm_clr_intercept(), which also applies when the initialization is done in the wrong place. Either way, svm_clr_intercept() is always going to be called by svm_recalc_instruction_intercepts() if guest has the RDTSC bit in its CPUID. So I extracted that into a separate patch and squashed the rest of patch 2 into patch 1. Paolo