Index: cpu-exec.c
===================================================================
RCS file: /sources/qemu/qemu/cpu-exec.c,v
retrieving revision 1.97
diff -u -r1.97 cpu-exec.c
--- cpu-exec.c	30 Mar 2007 16:44:53 -0000	1.97
+++ cpu-exec.c	31 Mar 2007 11:59:52 -0000
@@ -360,6 +360,7 @@
                                  env->exception_is_int, 
                                  env->error_code, 
                                  env->exception_next_eip, 0);
+		    env->old_exception = -1;  // successful delivered
 #elif defined(TARGET_PPC)
                     do_interrupt(env);
 #elif defined(TARGET_MIPS)
Index: target-i386/helper.c
===================================================================
RCS file: /sources/qemu/qemu/target-i386/helper.c,v
retrieving revision 1.74
diff -u -r1.74 helper.c
--- target-i386/helper.c	1 Feb 2007 22:12:19 -0000	1.74
+++ target-i386/helper.c	31 Mar 2007 11:59:58 -0000
@@ -1192,6 +1193,37 @@
     }
 }
 
+
+/**
+ * Check nested exceptions and change to double or triple fault if
+ * needed. It should only be called, if this is not an
+ * interrrupt. Returns the new exception number.
+ */
+int check_exception(int intno, int *error_code)
+{
+  if (loglevel & CPU_LOG_INT)
+    fprintf(logfile, "%s()  old: %x new %x\n",__func__,  env->old_exception, intno);
+
+
+ if (env->old_exception == EXCP08_DBLE)
+   cpu_abort(env, "triple fault");
+
+ char  first_contributory  = env->old_exception == 0 || (env->old_exception >= 10 && env->old_exception <= 13);
+ char second_contributory  = intno == 0 || (intno >= 10 && intno <= 13);
+
+ if ((first_contributory && second_contributory) 
+     || (env->old_exception == EXCP0E_PAGE && (second_contributory || (intno == EXCP0E_PAGE))))
+   {
+     intno = EXCP08_DBLE;
+     *error_code = 0;
+   }
+
+ if (second_contributory || (intno == EXCP0E_PAGE) || (intno == EXCP08_DBLE))
+   env->old_exception = intno;
+ return intno;
+}
+
+
 /*
  * Signal an interruption. It is executed in the main CPU loop.
  * is_int is TRUE if coming from the int instruction. next_eip is the
@@ -1201,6 +1233,9 @@
 void raise_interrupt(int intno, int is_int, int error_code, 
                      int next_eip_addend)
 {
+    if (!is_int)
+        intno = check_exception(intno, &error_code);
+
     env->exception_index = intno;
     env->error_code = error_code;
     env->exception_is_int = is_int;
@@ -1211,6 +1246,8 @@
 /* same as raise_exception_err, but do not restore global registers */
 static void raise_exception_err_norestore(int exception_index, int error_code)
 {
+    exception_index = check_exception(exception_index, &error_code);
+
     env->exception_index = exception_index;
     env->error_code = error_code;
     env->exception_is_int = 0;
Index: target-i386/cpu.h
===================================================================
RCS file: /sources/qemu/qemu/target-i386/cpu.h,v
retrieving revision 1.41
diff -u -r1.41 cpu.h
--- target-i386/cpu.h	5 Feb 2007 22:06:27 -0000	1.41
+++ target-i386/cpu.h	31 Mar 2007 11:59:56 -0000
@@ -515,6 +515,7 @@
     uint32_t smbase;
     int interrupt_request; 
     int user_mode_only; /* user mode only simulation */
+    int old_exception;  /* exception in flight */
 
     CPU_COMMON