KVM: x86 emulator: consolidate segment accessors
[linux-2.6-microblaze.git] / arch / x86 / kvm / emulate.c
index a2d343c..5999248 100644 (file)
 #define MemAbs      (1<<11)      /* Memory operand is absolute displacement */
 #define String      (1<<12)     /* String instruction (rep capable) */
 #define Stack       (1<<13)     /* Stack instruction (push/pop) */
+#define GroupMask   (7<<14)     /* Opcode uses one of the group mechanisms */
 #define Group       (1<<14)     /* Bits 3:5 of modrm byte extend opcode */
-#define GroupDual   (1<<15)     /* Alternate decoding of mod == 3 */
-#define Prefix      (1<<16)     /* Instruction varies with 66/f2/f3 prefix */
+#define GroupDual   (2<<14)     /* Alternate decoding of mod == 3 */
+#define Prefix      (3<<14)     /* Instruction varies with 66/f2/f3 prefix */
+#define RMExt       (4<<14)     /* Opcode extension in ModRM r/m if mod == 3 */
 #define Sse         (1<<17)     /* SSE Vector instruction */
-#define RMExt       (1<<18)     /* Opcode extension in ModRM r/m if mod == 3 */
 /* Misc flags */
 #define Prot        (1<<21) /* instruction generates #UD if not in prot-mode */
 #define VendorSpecific (1<<22) /* Vendor specific instruction */
@@ -262,42 +263,42 @@ struct gprefix {
                             "w", "r", _LO32, "r", "", "r")
 
 /* Instruction has three operands and one operand is stored in ECX register */
-#define __emulate_2op_cl(_op, _cl, _src, _dst, _eflags, _suffix, _type)        \
-       do {                                                                    \
-               unsigned long _tmp;                                             \
-               _type _clv  = (_cl).val;                                        \
-               _type _srcv = (_src).val;                                       \
-               _type _dstv = (_dst).val;                                       \
-                                                                               \
-               __asm__ __volatile__ (                                          \
-                       _PRE_EFLAGS("0", "5", "2")                              \
-                       _op _suffix " %4,%1 \n"                                 \
-                       _POST_EFLAGS("0", "5", "2")                             \
-                       : "=m" (_eflags), "+r" (_dstv), "=&r" (_tmp)            \
-                       : "c" (_clv) , "r" (_srcv), "i" (EFLAGS_MASK)           \
-                       );                                                      \
-                                                                               \
-               (_cl).val  = (unsigned long) _clv;                              \
-               (_src).val = (unsigned long) _srcv;                             \
-               (_dst).val = (unsigned long) _dstv;                             \
+#define __emulate_2op_cl(_op, _cl, _src, _dst, _eflags, _suffix, _type)        \
+       do {                                                            \
+               unsigned long _tmp;                                     \
+               _type _clv  = (_cl).val;                                \
+               _type _srcv = (_src).val;                               \
+               _type _dstv = (_dst).val;                               \
+                                                                       \
+               __asm__ __volatile__ (                                  \
+                       _PRE_EFLAGS("0", "5", "2")                      \
+                       _op _suffix " %4,%1 \n"                         \
+                       _POST_EFLAGS("0", "5", "2")                     \
+                       : "=m" (_eflags), "+r" (_dstv), "=&r" (_tmp)    \
+                       : "c" (_clv) , "r" (_srcv), "i" (EFLAGS_MASK)   \
+                       );                                              \
+                                                                       \
+               (_cl).val  = (unsigned long) _clv;                      \
+               (_src).val = (unsigned long) _srcv;                     \
+               (_dst).val = (unsigned long) _dstv;                     \
        } while (0)
 
-#define emulate_2op_cl(_op, _cl, _src, _dst, _eflags)                          \
-       do {                                                                    \
-               switch ((_dst).bytes) {                                         \
-               case 2:                                                         \
-                       __emulate_2op_cl(_op, _cl, _src, _dst, _eflags,         \
-                                               "w", unsigned short);           \
-                       break;                                                  \
-               case 4:                                                         \
-                       __emulate_2op_cl(_op, _cl, _src, _dst, _eflags,         \
-                                               "l", unsigned int);             \
-                       break;                                                  \
-               case 8:                                                         \
-                       ON64(__emulate_2op_cl(_op, _cl, _src, _dst, _eflags,    \
-                                               "q", unsigned long));           \
-                       break;                                                  \
-               }                                                               \
+#define emulate_2op_cl(_op, _cl, _src, _dst, _eflags)                  \
+       do {                                                            \
+               switch ((_dst).bytes) {                                 \
+               case 2:                                                 \
+                       __emulate_2op_cl(_op, _cl, _src, _dst, _eflags, \
+                                        "w", unsigned short);          \
+                       break;                                          \
+               case 4:                                                 \
+                       __emulate_2op_cl(_op, _cl, _src, _dst, _eflags, \
+                                        "l", unsigned int);            \
+                       break;                                          \
+               case 8:                                                 \
+                       ON64(__emulate_2op_cl(_op, _cl, _src, _dst, _eflags, \
+                                             "q", unsigned long));     \
+                       break;                                          \
+               }                                                       \
        } while (0)
 
 #define __emulate_1op(_op, _dst, _eflags, _suffix)                     \
@@ -360,13 +361,25 @@ struct gprefix {
        } while (0)
 
 /* instruction has only one source operand, destination is implicit (e.g. mul, div, imul, idiv) */
-#define emulate_1op_rax_rdx(_op, _src, _rax, _rdx, _eflags)                    \
-       do {                                                                    \
-               switch((_src).bytes) {                                          \
-               case 1: __emulate_1op_rax_rdx(_op, _src, _rax, _rdx, _eflags, "b"); break; \
-               case 2: __emulate_1op_rax_rdx(_op, _src, _rax, _rdx,  _eflags, "w"); break; \
-               case 4: __emulate_1op_rax_rdx(_op, _src, _rax, _rdx, _eflags, "l"); break; \
-               case 8: ON64(__emulate_1op_rax_rdx(_op, _src, _rax, _rdx, _eflags, "q")); break; \
+#define emulate_1op_rax_rdx(_op, _src, _rax, _rdx, _eflags)            \
+       do {                                                            \
+               switch((_src).bytes) {                                  \
+               case 1:                                                 \
+                       __emulate_1op_rax_rdx(_op, _src, _rax, _rdx,    \
+                                             _eflags, "b");            \
+                       break;                                          \
+               case 2:                                                 \
+                       __emulate_1op_rax_rdx(_op, _src, _rax, _rdx,    \
+                                             _eflags, "w");            \
+                       break;                                          \
+               case 4:                                                 \
+                       __emulate_1op_rax_rdx(_op, _src, _rax, _rdx,    \
+                                             _eflags, "l");            \
+                       break;                                          \
+               case 8:                                                 \
+                       ON64(__emulate_1op_rax_rdx(_op, _src, _rax, _rdx, \
+                                                  _eflags, "q"));      \
+                       break;                                          \
                }                                                       \
        } while (0)
 
@@ -402,7 +415,7 @@ struct gprefix {
        (_type)_x;                                                      \
 })
 
-#define insn_fetch_arr(_arr, _size, _eip)                                \
+#define insn_fetch_arr(_arr, _size, _eip)                              \
 ({     rc = do_insn_fetch(ctxt, ops, (_eip), _arr, (_size));           \
        if (rc != X86EMUL_CONTINUE)                                     \
                goto done;                                              \
@@ -426,7 +439,7 @@ static int emulator_check_intercept(struct x86_emulate_ctxt *ctxt,
                .next_rip   = ctxt->eip,
        };
 
-       return ctxt->ops->intercept(ctxt->vcpu, &info, stage);
+       return ctxt->ops->intercept(ctxt, &info, stage);
 }
 
 static inline unsigned long ad_mask(struct decode_cache *c)
@@ -464,6 +477,13 @@ static inline void jmp_rel(struct decode_cache *c, int rel)
        register_address_increment(c, &c->eip, rel);
 }
 
+static u32 desc_limit_scaled(struct desc_struct *desc)
+{
+       u32 limit = get_desc_limit(desc);
+
+       return desc->g ? (limit << 12) | 0xfff : limit;
+}
+
 static void set_seg_override(struct decode_cache *c, int seg)
 {
        c->has_seg_override = true;
@@ -476,7 +496,7 @@ static unsigned long seg_base(struct x86_emulate_ctxt *ctxt,
        if (ctxt->mode == X86EMUL_MODE_PROT64 && seg < VCPU_SREG_FS)
                return 0;
 
-       return ops->get_cached_segment_base(seg, ctxt->vcpu);
+       return ops->get_cached_segment_base(ctxt, seg);
 }
 
 static unsigned seg_override(struct x86_emulate_ctxt *ctxt,
@@ -489,21 +509,6 @@ static unsigned seg_override(struct x86_emulate_ctxt *ctxt,
        return c->seg_override;
 }
 
-static int linearize(struct x86_emulate_ctxt *ctxt,
-                    struct segmented_address addr,
-                    unsigned size, bool write,
-                    ulong *linear)
-{
-       struct decode_cache *c = &ctxt->decode;
-       ulong la;
-
-       la = seg_base(ctxt, ctxt->ops, addr.seg) + addr.ea;
-       if (c->ad_bytes != 8)
-               la &= (u32)-1;
-       *linear = la;
-       return X86EMUL_CONTINUE;
-}
-
 static int emulate_exception(struct x86_emulate_ctxt *ctxt, int vec,
                             u32 error, bool valid)
 {
@@ -523,6 +528,11 @@ static int emulate_gp(struct x86_emulate_ctxt *ctxt, int err)
        return emulate_exception(ctxt, GP_VECTOR, err, true);
 }
 
+static int emulate_ss(struct x86_emulate_ctxt *ctxt, int err)
+{
+       return emulate_exception(ctxt, SS_VECTOR, err, true);
+}
+
 static int emulate_ud(struct x86_emulate_ctxt *ctxt)
 {
        return emulate_exception(ctxt, UD_VECTOR, 0, false);
@@ -543,6 +553,109 @@ static int emulate_nm(struct x86_emulate_ctxt *ctxt)
        return emulate_exception(ctxt, NM_VECTOR, 0, false);
 }
 
+static u16 get_segment_selector(struct x86_emulate_ctxt *ctxt, unsigned seg)
+{
+       u16 selector;
+       struct desc_struct desc;
+
+       ctxt->ops->get_segment(ctxt, &selector, &desc, NULL, seg);
+       return selector;
+}
+
+static void set_segment_selector(struct x86_emulate_ctxt *ctxt, u16 selector,
+                                unsigned seg)
+{
+       u16 dummy;
+       u32 base3;
+       struct desc_struct desc;
+
+       ctxt->ops->get_segment(ctxt, &dummy, &desc, &base3, seg);
+       ctxt->ops->set_segment(ctxt, selector, &desc, base3, seg);
+}
+
+static int __linearize(struct x86_emulate_ctxt *ctxt,
+                    struct segmented_address addr,
+                    unsigned size, bool write, bool fetch,
+                    ulong *linear)
+{
+       struct decode_cache *c = &ctxt->decode;
+       struct desc_struct desc;
+       bool usable;
+       ulong la;
+       u32 lim;
+       u16 sel;
+       unsigned cpl, rpl;
+
+       la = seg_base(ctxt, ctxt->ops, addr.seg) + addr.ea;
+       switch (ctxt->mode) {
+       case X86EMUL_MODE_REAL:
+               break;
+       case X86EMUL_MODE_PROT64:
+               if (((signed long)la << 16) >> 16 != la)
+                       return emulate_gp(ctxt, 0);
+               break;
+       default:
+               usable = ctxt->ops->get_segment(ctxt, &sel, &desc, NULL,
+                                               addr.seg);
+               if (!usable)
+                       goto bad;
+               /* code segment or read-only data segment */
+               if (((desc.type & 8) || !(desc.type & 2)) && write)
+                       goto bad;
+               /* unreadable code segment */
+               if (!fetch && (desc.type & 8) && !(desc.type & 2))
+                       goto bad;
+               lim = desc_limit_scaled(&desc);
+               if ((desc.type & 8) || !(desc.type & 4)) {
+                       /* expand-up segment */
+                       if (addr.ea > lim || (u32)(addr.ea + size - 1) > lim)
+                               goto bad;
+               } else {
+                       /* exapand-down segment */
+                       if (addr.ea <= lim || (u32)(addr.ea + size - 1) <= lim)
+                               goto bad;
+                       lim = desc.d ? 0xffffffff : 0xffff;
+                       if (addr.ea > lim || (u32)(addr.ea + size - 1) > lim)
+                               goto bad;
+               }
+               cpl = ctxt->ops->cpl(ctxt);
+               rpl = sel & 3;
+               cpl = max(cpl, rpl);
+               if (!(desc.type & 8)) {
+                       /* data segment */
+                       if (cpl > desc.dpl)
+                               goto bad;
+               } else if ((desc.type & 8) && !(desc.type & 4)) {
+                       /* nonconforming code segment */
+                       if (cpl != desc.dpl)
+                               goto bad;
+               } else if ((desc.type & 8) && (desc.type & 4)) {
+                       /* conforming code segment */
+                       if (cpl < desc.dpl)
+                               goto bad;
+               }
+               break;
+       }
+       if (fetch ? ctxt->mode != X86EMUL_MODE_PROT64 : c->ad_bytes != 8)
+               la &= (u32)-1;
+       *linear = la;
+       return X86EMUL_CONTINUE;
+bad:
+       if (addr.seg == VCPU_SREG_SS)
+               return emulate_ss(ctxt, addr.seg);
+       else
+               return emulate_gp(ctxt, addr.seg);
+}
+
+static int linearize(struct x86_emulate_ctxt *ctxt,
+                    struct segmented_address addr,
+                    unsigned size, bool write,
+                    ulong *linear)
+{
+       return __linearize(ctxt, addr, size, write, false, linear);
+}
+
+
 static int segmented_read_std(struct x86_emulate_ctxt *ctxt,
                              struct segmented_address addr,
                              void *data,
@@ -554,8 +667,7 @@ static int segmented_read_std(struct x86_emulate_ctxt *ctxt,
        rc = linearize(ctxt, addr, size, false, &linear);
        if (rc != X86EMUL_CONTINUE)
                return rc;
-       return ctxt->ops->read_std(linear, data, size, ctxt->vcpu,
-                                  &ctxt->exception);
+       return ctxt->ops->read_std(ctxt, linear, data, size, &ctxt->exception);
 }
 
 static int do_fetch_insn_byte(struct x86_emulate_ctxt *ctxt,
@@ -567,10 +679,15 @@ static int do_fetch_insn_byte(struct x86_emulate_ctxt *ctxt,
        int size, cur_size;
 
        if (eip == fc->end) {
+               unsigned long linear;
+               struct segmented_address addr = { .seg=VCPU_SREG_CS, .ea=eip};
                cur_size = fc->end - fc->start;
                size = min(15UL - cur_size, PAGE_SIZE - offset_in_page(eip));
-               rc = ops->fetch(ctxt->cs_base + eip, fc->data + cur_size,
-                               size, ctxt->vcpu, &ctxt->exception);
+               rc = __linearize(ctxt, addr, size, false, true, &linear);
+               if (rc != X86EMUL_CONTINUE)
+                       return rc;
+               rc = ops->fetch(ctxt, linear, fc->data + cur_size,
+                               size, &ctxt->exception);
                if (rc != X86EMUL_CONTINUE)
                        return rc;
                fc->end += size;
@@ -951,8 +1068,8 @@ static int read_emulated(struct x86_emulate_ctxt *ctxt,
                if (mc->pos < mc->end)
                        goto read_cached;
 
-               rc = ops->read_emulated(addr, mc->data + mc->end, n,
-                                       &ctxt->exception, ctxt->vcpu);
+               rc = ops->read_emulated(ctxt, addr, mc->data + mc->end, n,
+                                       &ctxt->exception);
                if (rc != X86EMUL_CONTINUE)
                        return rc;
                mc->end += n;
@@ -991,8 +1108,8 @@ static int segmented_write(struct x86_emulate_ctxt *ctxt,
        rc = linearize(ctxt, addr, size, true, &linear);
        if (rc != X86EMUL_CONTINUE)
                return rc;
-       return ctxt->ops->write_emulated(linear, data, size,
-                                        &ctxt->exception, ctxt->vcpu);
+       return ctxt->ops->write_emulated(ctxt, linear, data, size,
+                                        &ctxt->exception);
 }
 
 static int segmented_cmpxchg(struct x86_emulate_ctxt *ctxt,
@@ -1006,8 +1123,8 @@ static int segmented_cmpxchg(struct x86_emulate_ctxt *ctxt,
        rc = linearize(ctxt, addr, size, true, &linear);
        if (rc != X86EMUL_CONTINUE)
                return rc;
-       return ctxt->ops->cmpxchg_emulated(linear, orig_data, data,
-                                          size, &ctxt->exception, ctxt->vcpu);
+       return ctxt->ops->cmpxchg_emulated(ctxt, linear, orig_data, data,
+                                          size, &ctxt->exception);
 }
 
 static int pio_in_emulated(struct x86_emulate_ctxt *ctxt,
@@ -1030,7 +1147,7 @@ static int pio_in_emulated(struct x86_emulate_ctxt *ctxt,
                if (n == 0)
                        n = 1;
                rc->pos = rc->end = 0;
-               if (!ops->pio_in_emulated(size, port, rc->data, n, ctxt->vcpu))
+               if (!ops->pio_in_emulated(ctxt, size, port, rc->data, n))
                        return 0;
                rc->end = n * size;
        }
@@ -1040,28 +1157,22 @@ static int pio_in_emulated(struct x86_emulate_ctxt *ctxt,
        return 1;
 }
 
-static u32 desc_limit_scaled(struct desc_struct *desc)
-{
-       u32 limit = get_desc_limit(desc);
-
-       return desc->g ? (limit << 12) | 0xfff : limit;
-}
-
 static void get_descriptor_table_ptr(struct x86_emulate_ctxt *ctxt,
                                     struct x86_emulate_ops *ops,
                                     u16 selector, struct desc_ptr *dt)
 {
        if (selector & 1 << 2) {
                struct desc_struct desc;
+               u16 sel;
+
                memset (dt, 0, sizeof *dt);
-               if (!ops->get_cached_descriptor(&desc, NULL, VCPU_SREG_LDTR,
-                                               ctxt->vcpu))
+               if (!ops->get_segment(ctxt, &sel, &desc, NULL, VCPU_SREG_LDTR))
                        return;
 
                dt->size = desc_limit_scaled(&desc); /* what if limit > 65535? */
                dt->address = get_desc_base(&desc);
        } else
-               ops->get_gdt(dt, ctxt->vcpu);
+               ops->get_gdt(ctxt, dt);
 }
 
 /* allowed just for 8 bytes segments */
@@ -1079,8 +1190,7 @@ static int read_segment_descriptor(struct x86_emulate_ctxt *ctxt,
        if (dt.size < index * 8 + 7)
                return emulate_gp(ctxt, selector & 0xfffc);
        addr = dt.address + index * 8;
-       ret = ops->read_std(addr, desc, sizeof *desc, ctxt->vcpu,
-                           &ctxt->exception);
+       ret = ops->read_std(ctxt, addr, desc, sizeof *desc, &ctxt->exception);
 
        return ret;
 }
@@ -1101,8 +1211,7 @@ static int write_segment_descriptor(struct x86_emulate_ctxt *ctxt,
                return emulate_gp(ctxt, selector & 0xfffc);
 
        addr = dt.address + index * 8;
-       ret = ops->write_std(addr, desc, sizeof *desc, ctxt->vcpu,
-                            &ctxt->exception);
+       ret = ops->write_std(ctxt, addr, desc, sizeof *desc, &ctxt->exception);
 
        return ret;
 }
@@ -1162,7 +1271,7 @@ static int load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
 
        rpl = selector & 3;
        dpl = seg_desc.dpl;
-       cpl = ops->cpl(ctxt->vcpu);
+       cpl = ops->cpl(ctxt);
 
        switch (seg) {
        case VCPU_SREG_SS:
@@ -1218,8 +1327,7 @@ static int load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
                        return ret;
        }
 load:
-       ops->set_segment_selector(selector, seg, ctxt->vcpu);
-       ops->set_cached_descriptor(&seg_desc, 0, seg, ctxt->vcpu);
+       ops->set_segment(ctxt, selector, &seg_desc, 0, seg);
        return X86EMUL_CONTINUE;
 exception:
        emulate_exception(ctxt, err_vec, err_code, true);
@@ -1282,17 +1390,18 @@ static inline int writeback(struct x86_emulate_ctxt *ctxt,
        return X86EMUL_CONTINUE;
 }
 
-static inline void emulate_push(struct x86_emulate_ctxt *ctxt,
-                               struct x86_emulate_ops *ops)
+static int em_push(struct x86_emulate_ctxt *ctxt)
 {
        struct decode_cache *c = &ctxt->decode;
+       struct segmented_address addr;
 
-       c->dst.type  = OP_MEM;
-       c->dst.bytes = c->op_bytes;
-       c->dst.val = c->src.val;
        register_address_increment(c, &c->regs[VCPU_REGS_RSP], -c->op_bytes);
-       c->dst.addr.mem.ea = register_address(c, c->regs[VCPU_REGS_RSP]);
-       c->dst.addr.mem.seg = VCPU_SREG_SS;
+       addr.ea = register_address(c, c->regs[VCPU_REGS_RSP]);
+       addr.seg = VCPU_SREG_SS;
+
+       /* Disable writeback. */
+       c->dst.type = OP_NONE;
+       return segmented_write(ctxt, addr, &c->src.val, c->op_bytes);
 }
 
 static int emulate_pop(struct x86_emulate_ctxt *ctxt,
@@ -1313,6 +1422,13 @@ static int emulate_pop(struct x86_emulate_ctxt *ctxt,
        return rc;
 }
 
+static int em_pop(struct x86_emulate_ctxt *ctxt)
+{
+       struct decode_cache *c = &ctxt->decode;
+
+       return emulate_pop(ctxt, ctxt->ops, &c->dst.val, c->op_bytes);
+}
+
 static int emulate_popf(struct x86_emulate_ctxt *ctxt,
                       struct x86_emulate_ops *ops,
                       void *dest, int len)
@@ -1320,7 +1436,7 @@ static int emulate_popf(struct x86_emulate_ctxt *ctxt,
        int rc;
        unsigned long val, change_mask;
        int iopl = (ctxt->eflags & X86_EFLAGS_IOPL) >> IOPL_SHIFT;
-       int cpl = ops->cpl(ctxt->vcpu);
+       int cpl = ops->cpl(ctxt);
 
        rc = emulate_pop(ctxt, ops, &val, len);
        if (rc != X86EMUL_CONTINUE)
@@ -1354,14 +1470,24 @@ static int emulate_popf(struct x86_emulate_ctxt *ctxt,
        return rc;
 }
 
-static void emulate_push_sreg(struct x86_emulate_ctxt *ctxt,
-                             struct x86_emulate_ops *ops, int seg)
+static int em_popf(struct x86_emulate_ctxt *ctxt)
 {
        struct decode_cache *c = &ctxt->decode;
 
-       c->src.val = ops->get_segment_selector(seg, ctxt->vcpu);
+       c->dst.type = OP_REG;
+       c->dst.addr.reg = &ctxt->eflags;
+       c->dst.bytes = c->op_bytes;
+       return emulate_popf(ctxt, ctxt->ops, &c->dst.val, c->op_bytes);
+}
+
+static int emulate_push_sreg(struct x86_emulate_ctxt *ctxt,
+                            struct x86_emulate_ops *ops, int seg)
+{
+       struct decode_cache *c = &ctxt->decode;
+
+       c->src.val = get_segment_selector(ctxt, seg);
 
-       emulate_push(ctxt, ops);
+       return em_push(ctxt);
 }
 
 static int emulate_pop_sreg(struct x86_emulate_ctxt *ctxt,
@@ -1379,8 +1505,7 @@ static int emulate_pop_sreg(struct x86_emulate_ctxt *ctxt,
        return rc;
 }
 
-static int emulate_pusha(struct x86_emulate_ctxt *ctxt,
-                         struct x86_emulate_ops *ops)
+static int em_pusha(struct x86_emulate_ctxt *ctxt)
 {
        struct decode_cache *c = &ctxt->decode;
        unsigned long old_esp = c->regs[VCPU_REGS_RSP];
@@ -1391,23 +1516,25 @@ static int emulate_pusha(struct x86_emulate_ctxt *ctxt,
                (reg == VCPU_REGS_RSP) ?
                (c->src.val = old_esp) : (c->src.val = c->regs[reg]);
 
-               emulate_push(ctxt, ops);
-
-               rc = writeback(ctxt, ops);
+               rc = em_push(ctxt);
                if (rc != X86EMUL_CONTINUE)
                        return rc;
 
                ++reg;
        }
 
-       /* Disable writeback. */
-       c->dst.type = OP_NONE;
-
        return rc;
 }
 
-static int emulate_popa(struct x86_emulate_ctxt *ctxt,
-                       struct x86_emulate_ops *ops)
+static int em_pushf(struct x86_emulate_ctxt *ctxt)
+{
+       struct decode_cache *c = &ctxt->decode;
+
+       c->src.val =  (unsigned long)ctxt->eflags;
+       return em_push(ctxt);
+}
+
+static int em_popa(struct x86_emulate_ctxt *ctxt)
 {
        struct decode_cache *c = &ctxt->decode;
        int rc = X86EMUL_CONTINUE;
@@ -1420,7 +1547,7 @@ static int emulate_popa(struct x86_emulate_ctxt *ctxt,
                        --reg;
                }
 
-               rc = emulate_pop(ctxt, ops, &c->regs[reg], c->op_bytes);
+               rc = emulate_pop(ctxt, ctxt->ops, &c->regs[reg], c->op_bytes);
                if (rc != X86EMUL_CONTINUE)
                        break;
                --reg;
@@ -1440,37 +1567,32 @@ int emulate_int_real(struct x86_emulate_ctxt *ctxt,
 
        /* TODO: Add limit checks */
        c->src.val = ctxt->eflags;
-       emulate_push(ctxt, ops);
-       rc = writeback(ctxt, ops);
+       rc = em_push(ctxt);
        if (rc != X86EMUL_CONTINUE)
                return rc;
 
        ctxt->eflags &= ~(EFLG_IF | EFLG_TF | EFLG_AC);
 
-       c->src.val = ops->get_segment_selector(VCPU_SREG_CS, ctxt->vcpu);
-       emulate_push(ctxt, ops);
-       rc = writeback(ctxt, ops);
+       c->src.val = get_segment_selector(ctxt, VCPU_SREG_CS);
+       rc = em_push(ctxt);
        if (rc != X86EMUL_CONTINUE)
                return rc;
 
        c->src.val = c->eip;
-       emulate_push(ctxt, ops);
-       rc = writeback(ctxt, ops);
+       rc = em_push(ctxt);
        if (rc != X86EMUL_CONTINUE)
                return rc;
 
-       c->dst.type = OP_NONE;
-
-       ops->get_idt(&dt, ctxt->vcpu);
+       ops->get_idt(ctxt, &dt);
 
        eip_addr = dt.address + (irq << 2);
        cs_addr = dt.address + (irq << 2) + 2;
 
-       rc = ops->read_std(cs_addr, &cs, 2, ctxt->vcpu, &ctxt->exception);
+       rc = ops->read_std(ctxt, cs_addr, &cs, 2, &ctxt->exception);
        if (rc != X86EMUL_CONTINUE)
                return rc;
 
-       rc = ops->read_std(eip_addr, &eip, 2, ctxt->vcpu, &ctxt->exception);
+       rc = ops->read_std(ctxt, eip_addr, &eip, 2, &ctxt->exception);
        if (rc != X86EMUL_CONTINUE)
                return rc;
 
@@ -1646,10 +1768,10 @@ static inline int emulate_grp3(struct x86_emulate_ctxt *ctxt,
        return X86EMUL_CONTINUE;
 }
 
-static inline int emulate_grp45(struct x86_emulate_ctxt *ctxt,
-                              struct x86_emulate_ops *ops)
+static int emulate_grp45(struct x86_emulate_ctxt *ctxt)
 {
        struct decode_cache *c = &ctxt->decode;
+       int rc = X86EMUL_CONTINUE;
 
        switch (c->modrm_reg) {
        case 0: /* inc */
@@ -1663,17 +1785,17 @@ static inline int emulate_grp45(struct x86_emulate_ctxt *ctxt,
                old_eip = c->eip;
                c->eip = c->src.val;
                c->src.val = old_eip;
-               emulate_push(ctxt, ops);
+               rc = em_push(ctxt);
                break;
        }
        case 4: /* jmp abs */
                c->eip = c->src.val;
                break;
        case 6: /* push */
-               emulate_push(ctxt, ops);
+               rc = em_push(ctxt);
                break;
        }
-       return X86EMUL_CONTINUE;
+       return rc;
 }
 
 static inline int emulate_grp9(struct x86_emulate_ctxt *ctxt,
@@ -1737,8 +1859,10 @@ setup_syscalls_segments(struct x86_emulate_ctxt *ctxt,
                        struct x86_emulate_ops *ops, struct desc_struct *cs,
                        struct desc_struct *ss)
 {
+       u16 selector;
+
        memset(cs, 0, sizeof(struct desc_struct));
-       ops->get_cached_descriptor(cs, NULL, VCPU_SREG_CS, ctxt->vcpu);
+       ops->get_segment(ctxt, &selector, cs, NULL, VCPU_SREG_CS);
        memset(ss, 0, sizeof(struct desc_struct));
 
        cs->l = 0;              /* will be adjusted later */
@@ -1768,44 +1892,44 @@ emulate_syscall(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
        struct desc_struct cs, ss;
        u64 msr_data;
        u16 cs_sel, ss_sel;
+       u64 efer = 0;
 
        /* syscall is not available in real mode */
        if (ctxt->mode == X86EMUL_MODE_REAL ||
            ctxt->mode == X86EMUL_MODE_VM86)
                return emulate_ud(ctxt);
 
+       ops->get_msr(ctxt, MSR_EFER, &efer);
        setup_syscalls_segments(ctxt, ops, &cs, &ss);
 
-       ops->get_msr(ctxt->vcpu, MSR_STAR, &msr_data);
+       ops->get_msr(ctxt, MSR_STAR, &msr_data);
        msr_data >>= 32;
        cs_sel = (u16)(msr_data & 0xfffc);
        ss_sel = (u16)(msr_data + 8);
 
-       if (is_long_mode(ctxt->vcpu)) {
+       if (efer & EFER_LMA) {
                cs.d = 0;
                cs.l = 1;
        }
-       ops->set_cached_descriptor(&cs, 0, VCPU_SREG_CS, ctxt->vcpu);
-       ops->set_segment_selector(cs_sel, VCPU_SREG_CS, ctxt->vcpu);
-       ops->set_cached_descriptor(&ss, 0, VCPU_SREG_SS, ctxt->vcpu);
-       ops->set_segment_selector(ss_sel, VCPU_SREG_SS, ctxt->vcpu);
+       ops->set_segment(ctxt, cs_sel, &cs, 0, VCPU_SREG_CS);
+       ops->set_segment(ctxt, ss_sel, &ss, 0, VCPU_SREG_SS);
 
        c->regs[VCPU_REGS_RCX] = c->eip;
-       if (is_long_mode(ctxt->vcpu)) {
+       if (efer & EFER_LMA) {
 #ifdef CONFIG_X86_64
                c->regs[VCPU_REGS_R11] = ctxt->eflags & ~EFLG_RF;
 
-               ops->get_msr(ctxt->vcpu,
+               ops->get_msr(ctxt,
                             ctxt->mode == X86EMUL_MODE_PROT64 ?
                             MSR_LSTAR : MSR_CSTAR, &msr_data);
                c->eip = msr_data;
 
-               ops->get_msr(ctxt->vcpu, MSR_SYSCALL_MASK, &msr_data);
+               ops->get_msr(ctxt, MSR_SYSCALL_MASK, &msr_data);
                ctxt->eflags &= ~(msr_data | EFLG_RF);
 #endif
        } else {
                /* legacy mode */
-               ops->get_msr(ctxt->vcpu, MSR_STAR, &msr_data);
+               ops->get_msr(ctxt, MSR_STAR, &msr_data);
                c->eip = (u32)msr_data;
 
                ctxt->eflags &= ~(EFLG_VM | EFLG_IF | EFLG_RF);
@@ -1821,7 +1945,9 @@ emulate_sysenter(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
        struct desc_struct cs, ss;
        u64 msr_data;
        u16 cs_sel, ss_sel;
+       u64 efer = 0;
 
+       ctxt->ops->get_msr(ctxt, MSR_EFER, &efer);
        /* inject #GP if in real mode */
        if (ctxt->mode == X86EMUL_MODE_REAL)
                return emulate_gp(ctxt, 0);
@@ -1834,7 +1960,7 @@ emulate_sysenter(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
 
        setup_syscalls_segments(ctxt, ops, &cs, &ss);
 
-       ops->get_msr(ctxt->vcpu, MSR_IA32_SYSENTER_CS, &msr_data);
+       ops->get_msr(ctxt, MSR_IA32_SYSENTER_CS, &msr_data);
        switch (ctxt->mode) {
        case X86EMUL_MODE_PROT32:
                if ((msr_data & 0xfffc) == 0x0)
@@ -1851,21 +1977,18 @@ emulate_sysenter(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
        cs_sel &= ~SELECTOR_RPL_MASK;
        ss_sel = cs_sel + 8;
        ss_sel &= ~SELECTOR_RPL_MASK;
-       if (ctxt->mode == X86EMUL_MODE_PROT64
-               || is_long_mode(ctxt->vcpu)) {
+       if (ctxt->mode == X86EMUL_MODE_PROT64 || (efer & EFER_LMA)) {
                cs.d = 0;
                cs.l = 1;
        }
 
-       ops->set_cached_descriptor(&cs, 0, VCPU_SREG_CS, ctxt->vcpu);
-       ops->set_segment_selector(cs_sel, VCPU_SREG_CS, ctxt->vcpu);
-       ops->set_cached_descriptor(&ss, 0, VCPU_SREG_SS, ctxt->vcpu);
-       ops->set_segment_selector(ss_sel, VCPU_SREG_SS, ctxt->vcpu);
+       ops->set_segment(ctxt, cs_sel, &cs, 0, VCPU_SREG_CS);
+       ops->set_segment(ctxt, ss_sel, &ss, 0, VCPU_SREG_SS);
 
-       ops->get_msr(ctxt->vcpu, MSR_IA32_SYSENTER_EIP, &msr_data);
+       ops->get_msr(ctxt, MSR_IA32_SYSENTER_EIP, &msr_data);
        c->eip = msr_data;
 
-       ops->get_msr(ctxt->vcpu, MSR_IA32_SYSENTER_ESP, &msr_data);
+       ops->get_msr(ctxt, MSR_IA32_SYSENTER_ESP, &msr_data);
        c->regs[VCPU_REGS_RSP] = msr_data;
 
        return X86EMUL_CONTINUE;
@@ -1894,7 +2017,7 @@ emulate_sysexit(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
 
        cs.dpl = 3;
        ss.dpl = 3;
-       ops->get_msr(ctxt->vcpu, MSR_IA32_SYSENTER_CS, &msr_data);
+       ops->get_msr(ctxt, MSR_IA32_SYSENTER_CS, &msr_data);
        switch (usermode) {
        case X86EMUL_MODE_PROT32:
                cs_sel = (u16)(msr_data + 16);
@@ -1914,10 +2037,8 @@ emulate_sysexit(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
        cs_sel |= SELECTOR_RPL_MASK;
        ss_sel |= SELECTOR_RPL_MASK;
 
-       ops->set_cached_descriptor(&cs, 0, VCPU_SREG_CS, ctxt->vcpu);
-       ops->set_segment_selector(cs_sel, VCPU_SREG_CS, ctxt->vcpu);
-       ops->set_cached_descriptor(&ss, 0, VCPU_SREG_SS, ctxt->vcpu);
-       ops->set_segment_selector(ss_sel, VCPU_SREG_SS, ctxt->vcpu);
+       ops->set_segment(ctxt, cs_sel, &cs, 0, VCPU_SREG_CS);
+       ops->set_segment(ctxt, ss_sel, &ss, 0, VCPU_SREG_SS);
 
        c->eip = c->regs[VCPU_REGS_RDX];
        c->regs[VCPU_REGS_RSP] = c->regs[VCPU_REGS_RCX];
@@ -1934,7 +2055,7 @@ static bool emulator_bad_iopl(struct x86_emulate_ctxt *ctxt,
        if (ctxt->mode == X86EMUL_MODE_VM86)
                return true;
        iopl = (ctxt->eflags & X86_EFLAGS_IOPL) >> IOPL_SHIFT;
-       return ops->cpl(ctxt->vcpu) > iopl;
+       return ops->cpl(ctxt) > iopl;
 }
 
 static bool emulator_io_port_access_allowed(struct x86_emulate_ctxt *ctxt,
@@ -1944,11 +2065,11 @@ static bool emulator_io_port_access_allowed(struct x86_emulate_ctxt *ctxt,
        struct desc_struct tr_seg;
        u32 base3;
        int r;
-       u16 io_bitmap_ptr, perm, bit_idx = port & 0x7;
+       u16 tr, io_bitmap_ptr, perm, bit_idx = port & 0x7;
        unsigned mask = (1 << len) - 1;
        unsigned long base;
 
-       ops->get_cached_descriptor(&tr_seg, &base3, VCPU_SREG_TR, ctxt->vcpu);
+       ops->get_segment(ctxt, &tr, &tr_seg, &base3, VCPU_SREG_TR);
        if (!tr_seg.p)
                return false;
        if (desc_limit_scaled(&tr_seg) < 103)
@@ -1957,13 +2078,12 @@ static bool emulator_io_port_access_allowed(struct x86_emulate_ctxt *ctxt,
 #ifdef CONFIG_X86_64
        base |= ((u64)base3) << 32;
 #endif
-       r = ops->read_std(base + 102, &io_bitmap_ptr, 2, ctxt->vcpu, NULL);
+       r = ops->read_std(ctxt, base + 102, &io_bitmap_ptr, 2, NULL);
        if (r != X86EMUL_CONTINUE)
                return false;
        if (io_bitmap_ptr + port/8 > desc_limit_scaled(&tr_seg))
                return false;
-       r = ops->read_std(base + io_bitmap_ptr + port/8, &perm, 2, ctxt->vcpu,
-                         NULL);
+       r = ops->read_std(ctxt, base + io_bitmap_ptr + port/8, &perm, 2, NULL);
        if (r != X86EMUL_CONTINUE)
                return false;
        if ((perm >> bit_idx) & mask)
@@ -2004,11 +2124,11 @@ static void save_state_to_tss16(struct x86_emulate_ctxt *ctxt,
        tss->si = c->regs[VCPU_REGS_RSI];
        tss->di = c->regs[VCPU_REGS_RDI];
 
-       tss->es = ops->get_segment_selector(VCPU_SREG_ES, ctxt->vcpu);
-       tss->cs = ops->get_segment_selector(VCPU_SREG_CS, ctxt->vcpu);
-       tss->ss = ops->get_segment_selector(VCPU_SREG_SS, ctxt->vcpu);
-       tss->ds = ops->get_segment_selector(VCPU_SREG_DS, ctxt->vcpu);
-       tss->ldt = ops->get_segment_selector(VCPU_SREG_LDTR, ctxt->vcpu);
+       tss->es = get_segment_selector(ctxt, VCPU_SREG_ES);
+       tss->cs = get_segment_selector(ctxt, VCPU_SREG_CS);
+       tss->ss = get_segment_selector(ctxt, VCPU_SREG_SS);
+       tss->ds = get_segment_selector(ctxt, VCPU_SREG_DS);
+       tss->ldt = get_segment_selector(ctxt, VCPU_SREG_LDTR);
 }
 
 static int load_state_from_tss16(struct x86_emulate_ctxt *ctxt,
@@ -2033,11 +2153,11 @@ static int load_state_from_tss16(struct x86_emulate_ctxt *ctxt,
         * SDM says that segment selectors are loaded before segment
         * descriptors
         */
-       ops->set_segment_selector(tss->ldt, VCPU_SREG_LDTR, ctxt->vcpu);
-       ops->set_segment_selector(tss->es, VCPU_SREG_ES, ctxt->vcpu);
-       ops->set_segment_selector(tss->cs, VCPU_SREG_CS, ctxt->vcpu);
-       ops->set_segment_selector(tss->ss, VCPU_SREG_SS, ctxt->vcpu);
-       ops->set_segment_selector(tss->ds, VCPU_SREG_DS, ctxt->vcpu);
+       set_segment_selector(ctxt, tss->ldt, VCPU_SREG_LDTR);
+       set_segment_selector(ctxt, tss->es, VCPU_SREG_ES);
+       set_segment_selector(ctxt, tss->cs, VCPU_SREG_CS);
+       set_segment_selector(ctxt, tss->ss, VCPU_SREG_SS);
+       set_segment_selector(ctxt, tss->ds, VCPU_SREG_DS);
 
        /*
         * Now load segment descriptors. If fault happenes at this stage
@@ -2071,7 +2191,7 @@ static int task_switch_16(struct x86_emulate_ctxt *ctxt,
        int ret;
        u32 new_tss_base = get_desc_base(new_desc);
 
-       ret = ops->read_std(old_tss_base, &tss_seg, sizeof tss_seg, ctxt->vcpu,
+       ret = ops->read_std(ctxt, old_tss_base, &tss_seg, sizeof tss_seg,
                            &ctxt->exception);
        if (ret != X86EMUL_CONTINUE)
                /* FIXME: need to provide precise fault address */
@@ -2079,13 +2199,13 @@ static int task_switch_16(struct x86_emulate_ctxt *ctxt,
 
        save_state_to_tss16(ctxt, ops, &tss_seg);
 
-       ret = ops->write_std(old_tss_base, &tss_seg, sizeof tss_seg, ctxt->vcpu,
+       ret = ops->write_std(ctxt, old_tss_base, &tss_seg, sizeof tss_seg,
                             &ctxt->exception);
        if (ret != X86EMUL_CONTINUE)
                /* FIXME: need to provide precise fault address */
                return ret;
 
-       ret = ops->read_std(new_tss_base, &tss_seg, sizeof tss_seg, ctxt->vcpu,
+       ret = ops->read_std(ctxt, new_tss_base, &tss_seg, sizeof tss_seg,
                            &ctxt->exception);
        if (ret != X86EMUL_CONTINUE)
                /* FIXME: need to provide precise fault address */
@@ -2094,10 +2214,10 @@ static int task_switch_16(struct x86_emulate_ctxt *ctxt,
        if (old_tss_sel != 0xffff) {
                tss_seg.prev_task_link = old_tss_sel;
 
-               ret = ops->write_std(new_tss_base,
+               ret = ops->write_std(ctxt, new_tss_base,
                                     &tss_seg.prev_task_link,
                                     sizeof tss_seg.prev_task_link,
-                                    ctxt->vcpu, &ctxt->exception);
+                                    &ctxt->exception);
                if (ret != X86EMUL_CONTINUE)
                        /* FIXME: need to provide precise fault address */
                        return ret;
@@ -2112,7 +2232,7 @@ static void save_state_to_tss32(struct x86_emulate_ctxt *ctxt,
 {
        struct decode_cache *c = &ctxt->decode;
 
-       tss->cr3 = ops->get_cr(3, ctxt->vcpu);
+       tss->cr3 = ops->get_cr(ctxt, 3);
        tss->eip = c->eip;
        tss->eflags = ctxt->eflags;
        tss->eax = c->regs[VCPU_REGS_RAX];
@@ -2124,13 +2244,13 @@ static void save_state_to_tss32(struct x86_emulate_ctxt *ctxt,
        tss->esi = c->regs[VCPU_REGS_RSI];
        tss->edi = c->regs[VCPU_REGS_RDI];
 
-       tss->es = ops->get_segment_selector(VCPU_SREG_ES, ctxt->vcpu);
-       tss->cs = ops->get_segment_selector(VCPU_SREG_CS, ctxt->vcpu);
-       tss->ss = ops->get_segment_selector(VCPU_SREG_SS, ctxt->vcpu);
-       tss->ds = ops->get_segment_selector(VCPU_SREG_DS, ctxt->vcpu);
-       tss->fs = ops->get_segment_selector(VCPU_SREG_FS, ctxt->vcpu);
-       tss->gs = ops->get_segment_selector(VCPU_SREG_GS, ctxt->vcpu);
-       tss->ldt_selector = ops->get_segment_selector(VCPU_SREG_LDTR, ctxt->vcpu);
+       tss->es = get_segment_selector(ctxt, VCPU_SREG_ES);
+       tss->cs = get_segment_selector(ctxt, VCPU_SREG_CS);
+       tss->ss = get_segment_selector(ctxt, VCPU_SREG_SS);
+       tss->ds = get_segment_selector(ctxt, VCPU_SREG_DS);
+       tss->fs = get_segment_selector(ctxt, VCPU_SREG_FS);
+       tss->gs = get_segment_selector(ctxt, VCPU_SREG_GS);
+       tss->ldt_selector = get_segment_selector(ctxt, VCPU_SREG_LDTR);
 }
 
 static int load_state_from_tss32(struct x86_emulate_ctxt *ctxt,
@@ -2140,7 +2260,7 @@ static int load_state_from_tss32(struct x86_emulate_ctxt *ctxt,
        struct decode_cache *c = &ctxt->decode;
        int ret;
 
-       if (ops->set_cr(3, tss->cr3, ctxt->vcpu))
+       if (ops->set_cr(ctxt, 3, tss->cr3))
                return emulate_gp(ctxt, 0);
        c->eip = tss->eip;
        ctxt->eflags = tss->eflags | 2;
@@ -2157,13 +2277,13 @@ static int load_state_from_tss32(struct x86_emulate_ctxt *ctxt,
         * SDM says that segment selectors are loaded before segment
         * descriptors
         */
-       ops->set_segment_selector(tss->ldt_selector, VCPU_SREG_LDTR, ctxt->vcpu);
-       ops->set_segment_selector(tss->es, VCPU_SREG_ES, ctxt->vcpu);
-       ops->set_segment_selector(tss->cs, VCPU_SREG_CS, ctxt->vcpu);
-       ops->set_segment_selector(tss->ss, VCPU_SREG_SS, ctxt->vcpu);
-       ops->set_segment_selector(tss->ds, VCPU_SREG_DS, ctxt->vcpu);
-       ops->set_segment_selector(tss->fs, VCPU_SREG_FS, ctxt->vcpu);
-       ops->set_segment_selector(tss->gs, VCPU_SREG_GS, ctxt->vcpu);
+       set_segment_selector(ctxt, tss->ldt_selector, VCPU_SREG_LDTR);
+       set_segment_selector(ctxt, tss->es, VCPU_SREG_ES);
+       set_segment_selector(ctxt, tss->cs, VCPU_SREG_CS);
+       set_segment_selector(ctxt, tss->ss, VCPU_SREG_SS);
+       set_segment_selector(ctxt, tss->ds, VCPU_SREG_DS);
+       set_segment_selector(ctxt, tss->fs, VCPU_SREG_FS);
+       set_segment_selector(ctxt, tss->gs, VCPU_SREG_GS);
 
        /*
         * Now load segment descriptors. If fault happenes at this stage
@@ -2203,7 +2323,7 @@ static int task_switch_32(struct x86_emulate_ctxt *ctxt,
        int ret;
        u32 new_tss_base = get_desc_base(new_desc);
 
-       ret = ops->read_std(old_tss_base, &tss_seg, sizeof tss_seg, ctxt->vcpu,
+       ret = ops->read_std(ctxt, old_tss_base, &tss_seg, sizeof tss_seg,
                            &ctxt->exception);
        if (ret != X86EMUL_CONTINUE)
                /* FIXME: need to provide precise fault address */
@@ -2211,13 +2331,13 @@ static int task_switch_32(struct x86_emulate_ctxt *ctxt,
 
        save_state_to_tss32(ctxt, ops, &tss_seg);
 
-       ret = ops->write_std(old_tss_base, &tss_seg, sizeof tss_seg, ctxt->vcpu,
+       ret = ops->write_std(ctxt, old_tss_base, &tss_seg, sizeof tss_seg,
                             &ctxt->exception);
        if (ret != X86EMUL_CONTINUE)
                /* FIXME: need to provide precise fault address */
                return ret;
 
-       ret = ops->read_std(new_tss_base, &tss_seg, sizeof tss_seg, ctxt->vcpu,
+       ret = ops->read_std(ctxt, new_tss_base, &tss_seg, sizeof tss_seg,
                            &ctxt->exception);
        if (ret != X86EMUL_CONTINUE)
                /* FIXME: need to provide precise fault address */
@@ -2226,10 +2346,10 @@ static int task_switch_32(struct x86_emulate_ctxt *ctxt,
        if (old_tss_sel != 0xffff) {
                tss_seg.prev_task_link = old_tss_sel;
 
-               ret = ops->write_std(new_tss_base,
+               ret = ops->write_std(ctxt, new_tss_base,
                                     &tss_seg.prev_task_link,
                                     sizeof tss_seg.prev_task_link,
-                                    ctxt->vcpu, &ctxt->exception);
+                                    &ctxt->exception);
                if (ret != X86EMUL_CONTINUE)
                        /* FIXME: need to provide precise fault address */
                        return ret;
@@ -2245,9 +2365,9 @@ static int emulator_do_task_switch(struct x86_emulate_ctxt *ctxt,
 {
        struct desc_struct curr_tss_desc, next_tss_desc;
        int ret;
-       u16 old_tss_sel = ops->get_segment_selector(VCPU_SREG_TR, ctxt->vcpu);
+       u16 old_tss_sel = get_segment_selector(ctxt, VCPU_SREG_TR);
        ulong old_tss_base =
-               ops->get_cached_segment_base(VCPU_SREG_TR, ctxt->vcpu);
+               ops->get_cached_segment_base(ctxt, VCPU_SREG_TR);
        u32 desc_limit;
 
        /* FIXME: old_tss_base == ~0 ? */
@@ -2263,7 +2383,7 @@ static int emulator_do_task_switch(struct x86_emulate_ctxt *ctxt,
 
        if (reason != TASK_SWITCH_IRET) {
                if ((tss_selector & 3) > next_tss_desc.dpl ||
-                   ops->cpl(ctxt->vcpu) > next_tss_desc.dpl)
+                   ops->cpl(ctxt) > next_tss_desc.dpl)
                        return emulate_gp(ctxt, 0);
        }
 
@@ -2307,9 +2427,8 @@ static int emulator_do_task_switch(struct x86_emulate_ctxt *ctxt,
                                         &next_tss_desc);
        }
 
-       ops->set_cr(0,  ops->get_cr(0, ctxt->vcpu) | X86_CR0_TS, ctxt->vcpu);
-       ops->set_cached_descriptor(&next_tss_desc, 0, VCPU_SREG_TR, ctxt->vcpu);
-       ops->set_segment_selector(tss_selector, VCPU_SREG_TR, ctxt->vcpu);
+       ops->set_cr(ctxt, 0,  ops->get_cr(ctxt, 0) | X86_CR0_TS);
+       ops->set_segment(ctxt, tss_selector, &next_tss_desc, 0, VCPU_SREG_TR);
 
        if (has_error_code) {
                struct decode_cache *c = &ctxt->decode;
@@ -2317,7 +2436,7 @@ static int emulator_do_task_switch(struct x86_emulate_ctxt *ctxt,
                c->op_bytes = c->ad_bytes = (next_tss_desc.type & 8) ? 4 : 2;
                c->lock_prefix = 0;
                c->src.val = (unsigned long) error_code;
-               emulate_push(ctxt, ops);
+               ret = em_push(ctxt);
        }
 
        return ret;
@@ -2337,11 +2456,8 @@ int emulator_task_switch(struct x86_emulate_ctxt *ctxt,
        rc = emulator_do_task_switch(ctxt, ops, tss_selector, reason,
                                     has_error_code, error_code);
 
-       if (rc == X86EMUL_CONTINUE) {
-               rc = writeback(ctxt, ops);
-               if (rc == X86EMUL_CONTINUE)
-                       ctxt->eip = c->eip;
-       }
+       if (rc == X86EMUL_CONTINUE)
+               ctxt->eip = c->eip;
 
        return (rc == X86EMUL_UNHANDLEABLE) ? EMULATION_FAILED : EMULATION_OK;
 }
@@ -2357,12 +2473,6 @@ static void string_addr_inc(struct x86_emulate_ctxt *ctxt, unsigned seg,
        op->addr.mem.seg = seg;
 }
 
-static int em_push(struct x86_emulate_ctxt *ctxt)
-{
-       emulate_push(ctxt, ctxt->ops);
-       return X86EMUL_CONTINUE;
-}
-
 static int em_das(struct x86_emulate_ctxt *ctxt)
 {
        struct decode_cache *c = &ctxt->decode;
@@ -2409,7 +2519,7 @@ static int em_call_far(struct x86_emulate_ctxt *ctxt)
        ulong old_eip;
        int rc;
 
-       old_cs = ctxt->ops->get_segment_selector(VCPU_SREG_CS, ctxt->vcpu);
+       old_cs = get_segment_selector(ctxt, VCPU_SREG_CS);
        old_eip = c->eip;
 
        memcpy(&sel, c->src.valptr + c->op_bytes, 2);
@@ -2420,20 +2530,12 @@ static int em_call_far(struct x86_emulate_ctxt *ctxt)
        memcpy(&c->eip, c->src.valptr, c->op_bytes);
 
        c->src.val = old_cs;
-       emulate_push(ctxt, ctxt->ops);
-       rc = writeback(ctxt, ctxt->ops);
+       rc = em_push(ctxt);
        if (rc != X86EMUL_CONTINUE)
                return rc;
 
        c->src.val = old_eip;
-       emulate_push(ctxt, ctxt->ops);
-       rc = writeback(ctxt, ctxt->ops);
-       if (rc != X86EMUL_CONTINUE)
-               return rc;
-
-       c->dst.type = OP_NONE;
-
-       return X86EMUL_CONTINUE;
+       return em_push(ctxt);
 }
 
 static int em_ret_near_imm(struct x86_emulate_ctxt *ctxt)
@@ -2451,6 +2553,72 @@ static int em_ret_near_imm(struct x86_emulate_ctxt *ctxt)
        return X86EMUL_CONTINUE;
 }
 
+static int em_add(struct x86_emulate_ctxt *ctxt)
+{
+       struct decode_cache *c = &ctxt->decode;
+
+       emulate_2op_SrcV("add", c->src, c->dst, ctxt->eflags);
+       return X86EMUL_CONTINUE;
+}
+
+static int em_or(struct x86_emulate_ctxt *ctxt)
+{
+       struct decode_cache *c = &ctxt->decode;
+
+       emulate_2op_SrcV("or", c->src, c->dst, ctxt->eflags);
+       return X86EMUL_CONTINUE;
+}
+
+static int em_adc(struct x86_emulate_ctxt *ctxt)
+{
+       struct decode_cache *c = &ctxt->decode;
+
+       emulate_2op_SrcV("adc", c->src, c->dst, ctxt->eflags);
+       return X86EMUL_CONTINUE;
+}
+
+static int em_sbb(struct x86_emulate_ctxt *ctxt)
+{
+       struct decode_cache *c = &ctxt->decode;
+
+       emulate_2op_SrcV("sbb", c->src, c->dst, ctxt->eflags);
+       return X86EMUL_CONTINUE;
+}
+
+static int em_and(struct x86_emulate_ctxt *ctxt)
+{
+       struct decode_cache *c = &ctxt->decode;
+
+       emulate_2op_SrcV("and", c->src, c->dst, ctxt->eflags);
+       return X86EMUL_CONTINUE;
+}
+
+static int em_sub(struct x86_emulate_ctxt *ctxt)
+{
+       struct decode_cache *c = &ctxt->decode;
+
+       emulate_2op_SrcV("sub", c->src, c->dst, ctxt->eflags);
+       return X86EMUL_CONTINUE;
+}
+
+static int em_xor(struct x86_emulate_ctxt *ctxt)
+{
+       struct decode_cache *c = &ctxt->decode;
+
+       emulate_2op_SrcV("xor", c->src, c->dst, ctxt->eflags);
+       return X86EMUL_CONTINUE;
+}
+
+static int em_cmp(struct x86_emulate_ctxt *ctxt)
+{
+       struct decode_cache *c = &ctxt->decode;
+
+       emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
+       /* Disable writeback. */
+       c->dst.type = OP_NONE;
+       return X86EMUL_CONTINUE;
+}
+
 static int em_imul(struct x86_emulate_ctxt *ctxt)
 {
        struct decode_cache *c = &ctxt->decode;
@@ -2484,7 +2652,7 @@ static int em_rdtsc(struct x86_emulate_ctxt *ctxt)
        struct decode_cache *c = &ctxt->decode;
        u64 tsc = 0;
 
-       ctxt->ops->get_msr(ctxt->vcpu, MSR_IA32_TSC, &tsc);
+       ctxt->ops->get_msr(ctxt, MSR_IA32_TSC, &tsc);
        c->regs[VCPU_REGS_RAX] = (u32)tsc;
        c->regs[VCPU_REGS_RDX] = tsc >> 32;
        return X86EMUL_CONTINUE;
@@ -2512,12 +2680,106 @@ static int em_invlpg(struct x86_emulate_ctxt *ctxt)
 
        rc = linearize(ctxt, c->src.addr.mem, 1, false, &linear);
        if (rc == X86EMUL_CONTINUE)
-               emulate_invlpg(ctxt->vcpu, linear);
+               ctxt->ops->invlpg(ctxt, linear);
+       /* Disable writeback. */
+       c->dst.type = OP_NONE;
+       return X86EMUL_CONTINUE;
+}
+
+static int em_clts(struct x86_emulate_ctxt *ctxt)
+{
+       ulong cr0;
+
+       cr0 = ctxt->ops->get_cr(ctxt, 0);
+       cr0 &= ~X86_CR0_TS;
+       ctxt->ops->set_cr(ctxt, 0, cr0);
+       return X86EMUL_CONTINUE;
+}
+
+static int em_vmcall(struct x86_emulate_ctxt *ctxt)
+{
+       struct decode_cache *c = &ctxt->decode;
+       int rc;
+
+       if (c->modrm_mod != 3 || c->modrm_rm != 1)
+               return X86EMUL_UNHANDLEABLE;
+
+       rc = ctxt->ops->fix_hypercall(ctxt);
+       if (rc != X86EMUL_CONTINUE)
+               return rc;
+
+       /* Let the processor re-execute the fixed hypercall */
+       c->eip = ctxt->eip;
+       /* Disable writeback. */
+       c->dst.type = OP_NONE;
+       return X86EMUL_CONTINUE;
+}
+
+static int em_lgdt(struct x86_emulate_ctxt *ctxt)
+{
+       struct decode_cache *c = &ctxt->decode;
+       struct desc_ptr desc_ptr;
+       int rc;
+
+       rc = read_descriptor(ctxt, ctxt->ops, c->src.addr.mem,
+                            &desc_ptr.size, &desc_ptr.address,
+                            c->op_bytes);
+       if (rc != X86EMUL_CONTINUE)
+               return rc;
+       ctxt->ops->set_gdt(ctxt, &desc_ptr);
+       /* Disable writeback. */
+       c->dst.type = OP_NONE;
+       return X86EMUL_CONTINUE;
+}
+
+static int em_vmmcall(struct x86_emulate_ctxt *ctxt)
+{
+       struct decode_cache *c = &ctxt->decode;
+       int rc;
+
+       rc = ctxt->ops->fix_hypercall(ctxt);
+
+       /* Disable writeback. */
+       c->dst.type = OP_NONE;
+       return rc;
+}
+
+static int em_lidt(struct x86_emulate_ctxt *ctxt)
+{
+       struct decode_cache *c = &ctxt->decode;
+       struct desc_ptr desc_ptr;
+       int rc;
+
+       rc = read_descriptor(ctxt, ctxt->ops, c->src.addr.mem,
+                            &desc_ptr.size,
+                            &desc_ptr.address,
+                            c->op_bytes);
+       if (rc != X86EMUL_CONTINUE)
+               return rc;
+       ctxt->ops->set_idt(ctxt, &desc_ptr);
        /* Disable writeback. */
        c->dst.type = OP_NONE;
        return X86EMUL_CONTINUE;
 }
 
+static int em_smsw(struct x86_emulate_ctxt *ctxt)
+{
+       struct decode_cache *c = &ctxt->decode;
+
+       c->dst.bytes = 2;
+       c->dst.val = ctxt->ops->get_cr(ctxt, 0);
+       return X86EMUL_CONTINUE;
+}
+
+static int em_lmsw(struct x86_emulate_ctxt *ctxt)
+{
+       struct decode_cache *c = &ctxt->decode;
+       ctxt->ops->set_cr(ctxt, 0, (ctxt->ops->get_cr(ctxt, 0) & ~0x0eul)
+                         | (c->src.val & 0x0f));
+       c->dst.type = OP_NONE;
+       return X86EMUL_CONTINUE;
+}
+
 static bool valid_cr(int nr)
 {
        switch (nr) {
@@ -2545,6 +2807,7 @@ static int check_cr_write(struct x86_emulate_ctxt *ctxt)
        struct decode_cache *c = &ctxt->decode;
        u64 new_val = c->src.val64;
        int cr = c->modrm_reg;
+       u64 efer = 0;
 
        static u64 cr_reserved_bits[] = {
                0xffffffff00000000ULL,
@@ -2562,13 +2825,13 @@ static int check_cr_write(struct x86_emulate_ctxt *ctxt)
 
        switch (cr) {
        case 0: {
-               u64 cr4, efer;
+               u64 cr4;
                if (((new_val & X86_CR0_PG) && !(new_val & X86_CR0_PE)) ||
                    ((new_val & X86_CR0_NW) && !(new_val & X86_CR0_CD)))
                        return emulate_gp(ctxt, 0);
 
-               cr4 = ctxt->ops->get_cr(4, ctxt->vcpu);
-               ctxt->ops->get_msr(ctxt->vcpu, MSR_EFER, &efer);
+               cr4 = ctxt->ops->get_cr(ctxt, 4);
+               ctxt->ops->get_msr(ctxt, MSR_EFER, &efer);
 
                if ((new_val & X86_CR0_PG) && (efer & EFER_LME) &&
                    !(cr4 & X86_CR4_PAE))
@@ -2579,11 +2842,12 @@ static int check_cr_write(struct x86_emulate_ctxt *ctxt)
        case 3: {
                u64 rsvd = 0;
 
-               if (is_long_mode(ctxt->vcpu))
+               ctxt->ops->get_msr(ctxt, MSR_EFER, &efer);
+               if (efer & EFER_LMA)
                        rsvd = CR3_L_MODE_RESERVED_BITS;
-               else if (is_pae(ctxt->vcpu))
+               else if (ctxt->ops->get_cr(ctxt, 4) & X86_CR4_PAE)
                        rsvd = CR3_PAE_RESERVED_BITS;
-               else if (is_paging(ctxt->vcpu))
+               else if (ctxt->ops->get_cr(ctxt, 0) & X86_CR0_PG)
                        rsvd = CR3_NONPAE_RESERVED_BITS;
 
                if (new_val & rsvd)
@@ -2592,10 +2856,10 @@ static int check_cr_write(struct x86_emulate_ctxt *ctxt)
                break;
                }
        case 4: {
-               u64 cr4, efer;
+               u64 cr4;
 
-               cr4 = ctxt->ops->get_cr(4, ctxt->vcpu);
-               ctxt->ops->get_msr(ctxt->vcpu, MSR_EFER, &efer);
+               cr4 = ctxt->ops->get_cr(ctxt, 4);
+               ctxt->ops->get_msr(ctxt, MSR_EFER, &efer);
 
                if ((efer & EFER_LMA) && !(new_val & X86_CR4_PAE))
                        return emulate_gp(ctxt, 0);
@@ -2611,7 +2875,7 @@ static int check_dr7_gd(struct x86_emulate_ctxt *ctxt)
 {
        unsigned long dr7;
 
-       ctxt->ops->get_dr(7, &dr7, ctxt->vcpu);
+       ctxt->ops->get_dr(ctxt, 7, &dr7);
 
        /* Check if DR7.Global_Enable is set */
        return dr7 & (1 << 13);
@@ -2626,7 +2890,7 @@ static int check_dr_read(struct x86_emulate_ctxt *ctxt)
        if (dr > 7)
                return emulate_ud(ctxt);
 
-       cr4 = ctxt->ops->get_cr(4, ctxt->vcpu);
+       cr4 = ctxt->ops->get_cr(ctxt, 4);
        if ((cr4 & X86_CR4_DE) && (dr == 4 || dr == 5))
                return emulate_ud(ctxt);
 
@@ -2652,7 +2916,7 @@ static int check_svme(struct x86_emulate_ctxt *ctxt)
 {
        u64 efer;
 
-       ctxt->ops->get_msr(ctxt->vcpu, MSR_EFER, &efer);
+       ctxt->ops->get_msr(ctxt, MSR_EFER, &efer);
 
        if (!(efer & EFER_SVME))
                return emulate_ud(ctxt);
@@ -2662,10 +2926,10 @@ static int check_svme(struct x86_emulate_ctxt *ctxt)
 
 static int check_svme_pa(struct x86_emulate_ctxt *ctxt)
 {
-       u64 rax = kvm_register_read(ctxt->vcpu, VCPU_REGS_RAX);
+       u64 rax = ctxt->decode.regs[VCPU_REGS_RAX];
 
        /* Valid physical address? */
-       if (rax & 0xffff000000000000)
+       if (rax & 0xffff000000000000ULL)
                return emulate_gp(ctxt, 0);
 
        return check_svme(ctxt);
@@ -2673,9 +2937,9 @@ static int check_svme_pa(struct x86_emulate_ctxt *ctxt)
 
 static int check_rdtsc(struct x86_emulate_ctxt *ctxt)
 {
-       u64 cr4 = ctxt->ops->get_cr(4, ctxt->vcpu);
+       u64 cr4 = ctxt->ops->get_cr(ctxt, 4);
 
-       if (cr4 & X86_CR4_TSD && ctxt->ops->cpl(ctxt->vcpu))
+       if (cr4 & X86_CR4_TSD && ctxt->ops->cpl(ctxt))
                return emulate_ud(ctxt);
 
        return X86EMUL_CONTINUE;
@@ -2683,10 +2947,10 @@ static int check_rdtsc(struct x86_emulate_ctxt *ctxt)
 
 static int check_rdpmc(struct x86_emulate_ctxt *ctxt)
 {
-       u64 cr4 = ctxt->ops->get_cr(4, ctxt->vcpu);
-       u64 rcx = kvm_register_read(ctxt->vcpu, VCPU_REGS_RCX);
+       u64 cr4 = ctxt->ops->get_cr(ctxt, 4);
+       u64 rcx = ctxt->decode.regs[VCPU_REGS_RCX];
 
-       if ((!(cr4 & X86_CR4_PCE) && ctxt->ops->cpl(ctxt->vcpu)) ||
+       if ((!(cr4 & X86_CR4_PCE) && ctxt->ops->cpl(ctxt)) ||
            (rcx > 3))
                return emulate_gp(ctxt, 0);
 
@@ -2722,7 +2986,7 @@ static int check_perm_out(struct x86_emulate_ctxt *ctxt)
 #define N    D(0)
 #define EXT(_f, _e) { .flags = ((_f) | RMExt), .u.group = (_e) }
 #define G(_f, _g) { .flags = ((_f) | Group), .u.group = (_g) }
-#define GD(_f, _g) { .flags = ((_f) | Group | GroupDual), .u.gdual = (_g) }
+#define GD(_f, _g) { .flags = ((_f) | GroupDual), .u.gdual = (_g) }
 #define I(_f, _e) { .flags = (_f), .u.execute = (_e) }
 #define II(_f, _e, _i) \
        { .flags = (_f), .u.execute = (_e), .intercept = x86_intercept_##_i }
@@ -2735,9 +2999,9 @@ static int check_perm_out(struct x86_emulate_ctxt *ctxt)
 #define D2bvIP(_f, _i, _p) DIP((_f) | ByteOp, _i, _p), DIP(_f, _i, _p)
 #define I2bv(_f, _e)  I((_f) | ByteOp, _e), I(_f, _e)
 
-#define D6ALU(_f) D2bv((_f) | DstMem | SrcReg | ModRM),                        \
-               D2bv(((_f) | DstReg | SrcMem | ModRM) & ~Lock),         \
-               D2bv(((_f) & ~Lock) | DstAcc | SrcImm)
+#define I6ALU(_f, _e) I2bv((_f) | DstMem | SrcReg | ModRM, _e),                \
+               I2bv(((_f) | DstReg | SrcMem | ModRM) & ~Lock, _e),     \
+               I2bv(((_f) & ~Lock) | DstAcc | SrcImm, _e)
 
 static struct opcode group7_rm1[] = {
        DI(SrcNone | ModRM | Priv, monitor),
@@ -2747,7 +3011,7 @@ static struct opcode group7_rm1[] = {
 
 static struct opcode group7_rm3[] = {
        DIP(SrcNone | ModRM | Prot | Priv, vmrun,   check_svme_pa),
-       DI(SrcNone | ModRM | Prot | VendorSpecific, vmmcall),
+       II(SrcNone | ModRM | Prot | VendorSpecific, em_vmmcall, vmmcall),
        DIP(SrcNone | ModRM | Prot | Priv, vmload,  check_svme_pa),
        DIP(SrcNone | ModRM | Prot | Priv, vmsave,  check_svme_pa),
        DIP(SrcNone | ModRM | Prot | Priv, stgi,    check_svme),
@@ -2761,8 +3025,16 @@ static struct opcode group7_rm7[] = {
        DIP(SrcNone | ModRM, rdtscp, check_rdtsc),
        N, N, N, N, N, N,
 };
+
 static struct opcode group1[] = {
-       X7(D(Lock)), N
+       I(Lock, em_add),
+       I(Lock, em_or),
+       I(Lock, em_adc),
+       I(Lock, em_sbb),
+       I(Lock, em_and),
+       I(Lock, em_sub),
+       I(Lock, em_xor),
+       I(0, em_cmp),
 };
 
 static struct opcode group1A[] = {
@@ -2799,15 +3071,17 @@ static struct opcode group6[] = {
 static struct group_dual group7 = { {
        DI(ModRM | Mov | DstMem | Priv, sgdt),
        DI(ModRM | Mov | DstMem | Priv, sidt),
-       DI(ModRM | SrcMem | Priv, lgdt), DI(ModRM | SrcMem | Priv, lidt),
-       DI(SrcNone | ModRM | DstMem | Mov, smsw), N,
-       DI(SrcMem16 | ModRM | Mov | Priv, lmsw),
-       DI(SrcMem | ModRM | ByteOp | Priv | NoAccess, invlpg),
+       II(ModRM | SrcMem | Priv, em_lgdt, lgdt),
+       II(ModRM | SrcMem | Priv, em_lidt, lidt),
+       II(SrcNone | ModRM | DstMem | Mov, em_smsw, smsw), N,
+       II(SrcMem16 | ModRM | Mov | Priv, em_lmsw, lmsw),
+       II(SrcMem | ModRM | ByteOp | Priv | NoAccess, em_invlpg, invlpg),
 }, {
-       D(SrcNone | ModRM | Priv | VendorSpecific), EXT(0, group7_rm1),
+       I(SrcNone | ModRM | Priv | VendorSpecific, em_vmcall),
+       EXT(0, group7_rm1),
        N, EXT(0, group7_rm3),
-       DI(SrcNone | ModRM | DstMem | Mov, smsw), N,
-       DI(SrcMem16 | ModRM | Mov | Priv, lmsw), EXT(0, group7_rm7),
+       II(SrcNone | ModRM | DstMem | Mov, em_smsw, smsw), N,
+       II(SrcMem16 | ModRM | Mov | Priv, em_lmsw, lmsw), EXT(0, group7_rm7),
 } };
 
 static struct opcode group8[] = {
@@ -2832,33 +3106,34 @@ static struct gprefix pfx_0f_6f_0f_7f = {
 
 static struct opcode opcode_table[256] = {
        /* 0x00 - 0x07 */
-       D6ALU(Lock),
+       I6ALU(Lock, em_add),
        D(ImplicitOps | Stack | No64), D(ImplicitOps | Stack | No64),
        /* 0x08 - 0x0F */
-       D6ALU(Lock),
+       I6ALU(Lock, em_or),
        D(ImplicitOps | Stack | No64), N,
        /* 0x10 - 0x17 */
-       D6ALU(Lock),
+       I6ALU(Lock, em_adc),
        D(ImplicitOps | Stack | No64), D(ImplicitOps | Stack | No64),
        /* 0x18 - 0x1F */
-       D6ALU(Lock),
+       I6ALU(Lock, em_sbb),
        D(ImplicitOps | Stack | No64), D(ImplicitOps | Stack | No64),
        /* 0x20 - 0x27 */
-       D6ALU(Lock), N, N,
+       I6ALU(Lock, em_and), N, N,
        /* 0x28 - 0x2F */
-       D6ALU(Lock), N, I(ByteOp | DstAcc | No64, em_das),
+       I6ALU(Lock, em_sub), N, I(ByteOp | DstAcc | No64, em_das),
        /* 0x30 - 0x37 */
-       D6ALU(Lock), N, N,
+       I6ALU(Lock, em_xor), N, N,
        /* 0x38 - 0x3F */
-       D6ALU(0), N, N,
+       I6ALU(0, em_cmp), N, N,
        /* 0x40 - 0x4F */
        X16(D(DstReg)),
        /* 0x50 - 0x57 */
        X8(I(SrcReg | Stack, em_push)),
        /* 0x58 - 0x5F */
-       X8(D(DstReg | Stack)),
+       X8(I(DstReg | Stack, em_pop)),
        /* 0x60 - 0x67 */
-       D(ImplicitOps | Stack | No64), D(ImplicitOps | Stack | No64),
+       I(ImplicitOps | Stack | No64, em_pusha),
+       I(ImplicitOps | Stack | No64, em_popa),
        N, D(DstReg | SrcMem32 | ModRM | Mov) /* movsxd (x86/64) */ ,
        N, N, N, N,
        /* 0x68 - 0x6F */
@@ -2886,17 +3161,18 @@ static struct opcode opcode_table[256] = {
        /* 0x98 - 0x9F */
        D(DstAcc | SrcNone), I(ImplicitOps | SrcAcc, em_cwd),
        I(SrcImmFAddr | No64, em_call_far), N,
-       DI(ImplicitOps | Stack, pushf), DI(ImplicitOps | Stack, popf), N, N,
+       II(ImplicitOps | Stack, em_pushf, pushf),
+       II(ImplicitOps | Stack, em_popf, popf), N, N,
        /* 0xA0 - 0xA7 */
        I2bv(DstAcc | SrcMem | Mov | MemAbs, em_mov),
        I2bv(DstMem | SrcAcc | Mov | MemAbs, em_mov),
        I2bv(SrcSI | DstDI | Mov | String, em_mov),
-       D2bv(SrcSI | DstDI | String),
+       I2bv(SrcSI | DstDI | String, em_cmp),
        /* 0xA8 - 0xAF */
        D2bv(DstAcc | SrcImm),
        I2bv(SrcAcc | DstDI | Mov | String, em_mov),
        I2bv(SrcSI | DstAcc | Mov | String, em_mov),
-       D2bv(SrcAcc | DstDI | String),
+       I2bv(SrcAcc | DstDI | String, em_cmp),
        /* 0xB0 - 0xB7 */
        X8(I(ByteOp | DstReg | SrcImm | Mov, em_mov)),
        /* 0xB8 - 0xBF */
@@ -3020,7 +3296,7 @@ static struct opcode twobyte_table[256] = {
 #undef D2bv
 #undef D2bvIP
 #undef I2bv
-#undef D6ALU
+#undef I6ALU
 
 static unsigned imm_size(struct decode_cache *c)
 {
@@ -3078,9 +3354,9 @@ x86_decode_insn(struct x86_emulate_ctxt *ctxt, void *insn, int insn_len)
        struct decode_cache *c = &ctxt->decode;
        int rc = X86EMUL_CONTINUE;
        int mode = ctxt->mode;
-       int def_op_bytes, def_ad_bytes, dual, goffset, simd_prefix;
+       int def_op_bytes, def_ad_bytes, goffset, simd_prefix;
        bool op_prefix = false;
-       struct opcode opcode, *g_mod012, *g_mod3;
+       struct opcode opcode;
        struct operand memop = { .type = OP_NONE };
 
        c->eip = ctxt->eip;
@@ -3088,7 +3364,6 @@ x86_decode_insn(struct x86_emulate_ctxt *ctxt, void *insn, int insn_len)
        c->fetch.end = c->fetch.start + insn_len;
        if (insn_len > 0)
                memcpy(c->fetch.data, insn, insn_len);
-       ctxt->cs_base = seg_base(ctxt, ops, VCPU_SREG_CS);
 
        switch (mode) {
        case X86EMUL_MODE_REAL:
@@ -3175,44 +3450,43 @@ done_prefixes:
        }
        c->d = opcode.flags;
 
-       if (c->d & Group) {
-               dual = c->d & GroupDual;
-               c->modrm = insn_fetch(u8, 1, c->eip);
-               --c->eip;
-
-               if (c->d & GroupDual) {
-                       g_mod012 = opcode.u.gdual->mod012;
-                       g_mod3 = opcode.u.gdual->mod3;
-               } else
-                       g_mod012 = g_mod3 = opcode.u.group;
-
-               c->d &= ~(Group | GroupDual);
-
-               goffset = (c->modrm >> 3) & 7;
-
-               if ((c->modrm >> 6) == 3)
-                       opcode = g_mod3[goffset];
-               else
-                       opcode = g_mod012[goffset];
-
-               if (opcode.flags & RMExt) {
+       while (c->d & GroupMask) {
+               switch (c->d & GroupMask) {
+               case Group:
+                       c->modrm = insn_fetch(u8, 1, c->eip);
+                       --c->eip;
+                       goffset = (c->modrm >> 3) & 7;
+                       opcode = opcode.u.group[goffset];
+                       break;
+               case GroupDual:
+                       c->modrm = insn_fetch(u8, 1, c->eip);
+                       --c->eip;
+                       goffset = (c->modrm >> 3) & 7;
+                       if ((c->modrm >> 6) == 3)
+                               opcode = opcode.u.gdual->mod3[goffset];
+                       else
+                               opcode = opcode.u.gdual->mod012[goffset];
+                       break;
+               case RMExt:
                        goffset = c->modrm & 7;
                        opcode = opcode.u.group[goffset];
-               }
-
-               c->d |= opcode.flags;
-       }
-
-       if (c->d & Prefix) {
-               if (c->rep_prefix && op_prefix)
+                       break;
+               case Prefix:
+                       if (c->rep_prefix && op_prefix)
+                               return X86EMUL_UNHANDLEABLE;
+                       simd_prefix = op_prefix ? 0x66 : c->rep_prefix;
+                       switch (simd_prefix) {
+                       case 0x00: opcode = opcode.u.gprefix->pfx_no; break;
+                       case 0x66: opcode = opcode.u.gprefix->pfx_66; break;
+                       case 0xf2: opcode = opcode.u.gprefix->pfx_f2; break;
+                       case 0xf3: opcode = opcode.u.gprefix->pfx_f3; break;
+                       }
+                       break;
+               default:
                        return X86EMUL_UNHANDLEABLE;
-               simd_prefix = op_prefix ? 0x66 : c->rep_prefix;
-               switch (simd_prefix) {
-               case 0x00: opcode = opcode.u.gprefix->pfx_no; break;
-               case 0x66: opcode = opcode.u.gprefix->pfx_66; break;
-               case 0xf2: opcode = opcode.u.gprefix->pfx_f2; break;
-               case 0xf3: opcode = opcode.u.gprefix->pfx_f3; break;
                }
+
+               c->d &= ~GroupMask;
                c->d |= opcode.flags;
        }
 
@@ -3457,13 +3731,13 @@ x86_emulate_insn(struct x86_emulate_ctxt *ctxt)
        }
 
        if ((c->d & Sse)
-           && ((ops->get_cr(0, ctxt->vcpu) & X86_CR0_EM)
-               || !(ops->get_cr(4, ctxt->vcpu) & X86_CR4_OSFXSR))) {
+           && ((ops->get_cr(ctxt, 0) & X86_CR0_EM)
+               || !(ops->get_cr(ctxt, 4) & X86_CR4_OSFXSR))) {
                rc = emulate_ud(ctxt);
                goto done;
        }
 
-       if ((c->d & Sse) && (ops->get_cr(0, ctxt->vcpu) & X86_CR0_TS)) {
+       if ((c->d & Sse) && (ops->get_cr(ctxt, 0) & X86_CR0_TS)) {
                rc = emulate_nm(ctxt);
                goto done;
        }
@@ -3476,7 +3750,7 @@ x86_emulate_insn(struct x86_emulate_ctxt *ctxt)
        }
 
        /* Privileged instruction can be executed only in CPL=0 */
-       if ((c->d & Priv) && ops->cpl(ctxt->vcpu)) {
+       if ((c->d & Priv) && ops->cpl(ctxt)) {
                rc = emulate_gp(ctxt, 0);
                goto done;
        }
@@ -3557,75 +3831,33 @@ special_insn:
                goto twobyte_insn;
 
        switch (c->b) {
-       case 0x00 ... 0x05:
-             add:              /* add */
-               emulate_2op_SrcV("add", c->src, c->dst, ctxt->eflags);
-               break;
        case 0x06:              /* push es */
-               emulate_push_sreg(ctxt, ops, VCPU_SREG_ES);
+               rc = emulate_push_sreg(ctxt, ops, VCPU_SREG_ES);
                break;
        case 0x07:              /* pop es */
                rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_ES);
                break;
-       case 0x08 ... 0x0d:
-             or:               /* or */
-               emulate_2op_SrcV("or", c->src, c->dst, ctxt->eflags);
-               break;
        case 0x0e:              /* push cs */
-               emulate_push_sreg(ctxt, ops, VCPU_SREG_CS);
-               break;
-       case 0x10 ... 0x15:
-             adc:              /* adc */
-               emulate_2op_SrcV("adc", c->src, c->dst, ctxt->eflags);
+               rc = emulate_push_sreg(ctxt, ops, VCPU_SREG_CS);
                break;
        case 0x16:              /* push ss */
-               emulate_push_sreg(ctxt, ops, VCPU_SREG_SS);
+               rc = emulate_push_sreg(ctxt, ops, VCPU_SREG_SS);
                break;
        case 0x17:              /* pop ss */
                rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_SS);
                break;
-       case 0x18 ... 0x1d:
-             sbb:              /* sbb */
-               emulate_2op_SrcV("sbb", c->src, c->dst, ctxt->eflags);
-               break;
        case 0x1e:              /* push ds */
-               emulate_push_sreg(ctxt, ops, VCPU_SREG_DS);
+               rc = emulate_push_sreg(ctxt, ops, VCPU_SREG_DS);
                break;
        case 0x1f:              /* pop ds */
                rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_DS);
                break;
-       case 0x20 ... 0x25:
-             and:              /* and */
-               emulate_2op_SrcV("and", c->src, c->dst, ctxt->eflags);
-               break;
-       case 0x28 ... 0x2d:
-             sub:              /* sub */
-               emulate_2op_SrcV("sub", c->src, c->dst, ctxt->eflags);
-               break;
-       case 0x30 ... 0x35:
-             xor:              /* xor */
-               emulate_2op_SrcV("xor", c->src, c->dst, ctxt->eflags);
-               break;
-       case 0x38 ... 0x3d:
-             cmp:              /* cmp */
-               emulate_2op_SrcV("cmp", c->src, c->dst, ctxt->eflags);
-               break;
        case 0x40 ... 0x47: /* inc r16/r32 */
                emulate_1op("inc", c->dst, ctxt->eflags);
                break;
        case 0x48 ... 0x4f: /* dec r16/r32 */
                emulate_1op("dec", c->dst, ctxt->eflags);
                break;
-       case 0x58 ... 0x5f: /* pop reg */
-       pop_instruction:
-               rc = emulate_pop(ctxt, ops, &c->dst.val, c->op_bytes);
-               break;
-       case 0x60:      /* pusha */
-               rc = emulate_pusha(ctxt, ops);
-               break;
-       case 0x61:      /* popa */
-               rc = emulate_popa(ctxt, ops);
-               break;
        case 0x63:              /* movsxd */
                if (ctxt->mode != X86EMUL_MODE_PROT64)
                        goto cannot_emulate;
@@ -3644,26 +3876,6 @@ special_insn:
                if (test_cc(c->b, ctxt->eflags))
                        jmp_rel(c, c->src.val);
                break;
-       case 0x80 ... 0x83:     /* Grp1 */
-               switch (c->modrm_reg) {
-               case 0:
-                       goto add;
-               case 1:
-                       goto or;
-               case 2:
-                       goto adc;
-               case 3:
-                       goto sbb;
-               case 4:
-                       goto and;
-               case 5:
-                       goto sub;
-               case 6:
-                       goto xor;
-               case 7:
-                       goto cmp;
-               }
-               break;
        case 0x84 ... 0x85:
        test:
                emulate_2op_SrcV("test", c->src, c->dst, ctxt->eflags);
@@ -3685,7 +3897,7 @@ special_insn:
                        rc = emulate_ud(ctxt);
                        goto done;
                }
-               c->dst.val = ops->get_segment_selector(c->modrm_reg, ctxt->vcpu);
+               c->dst.val = get_segment_selector(ctxt, c->modrm_reg);
                break;
        case 0x8d: /* lea r16/r32, m */
                c->dst.val = c->src.addr.mem.ea;
@@ -3723,23 +3935,8 @@ special_insn:
                case 8: c->dst.val = (s32)c->dst.val; break;
                }
                break;
-       case 0x9c: /* pushf */
-               c->src.val =  (unsigned long) ctxt->eflags;
-               emulate_push(ctxt, ops);
-               break;
-       case 0x9d: /* popf */
-               c->dst.type = OP_REG;
-               c->dst.addr.reg = &ctxt->eflags;
-               c->dst.bytes = c->op_bytes;
-               rc = emulate_popf(ctxt, ops, &c->dst.val, c->op_bytes);
-               break;
-       case 0xa6 ... 0xa7:     /* cmps */
-               c->dst.type = OP_NONE; /* Disable writeback. */
-               goto cmp;
        case 0xa8 ... 0xa9:     /* test ax, imm */
                goto test;
-       case 0xae ... 0xaf:     /* scas */
-               goto cmp;
        case 0xc0 ... 0xc1:
                emulate_grp2(ctxt);
                break;
@@ -3747,7 +3944,8 @@ special_insn:
                c->dst.type = OP_REG;
                c->dst.addr.reg = &c->eip;
                c->dst.bytes = c->op_bytes;
-               goto pop_instruction;
+               rc = em_pop(ctxt);
+               break;
        case 0xc4:              /* les */
                rc = emulate_load_segment(ctxt, ops, VCPU_SREG_ES);
                break;
@@ -3801,7 +3999,7 @@ special_insn:
                long int rel = c->src.val;
                c->src.val = (unsigned long) c->eip;
                jmp_rel(c, rel);
-               emulate_push(ctxt, ops);
+               rc = em_push(ctxt);
                break;
        }
        case 0xe9: /* jmp rel */
@@ -3811,7 +4009,8 @@ special_insn:
        jump_far:
                memcpy(&sel, c->src.valptr + c->op_bytes, 2);
 
-               if (load_segment_descriptor(ctxt, ops, sel, VCPU_SREG_CS))
+               rc = load_segment_descriptor(ctxt, ops, sel, VCPU_SREG_CS);
+               if (rc != X86EMUL_CONTINUE)
                        goto done;
 
                c->eip = 0;
@@ -3835,12 +4034,12 @@ special_insn:
        case 0xef: /* out dx,(e/r)ax */
                c->dst.val = c->regs[VCPU_REGS_RDX];
        do_io_out:
-               ops->pio_out_emulated(c->src.bytes, c->dst.val,
-                                     &c->src.val, 1, ctxt->vcpu);
+               ops->pio_out_emulated(ctxt, c->src.bytes, c->dst.val,
+                                     &c->src.val, 1);
                c->dst.type = OP_NONE;  /* Disable writeback. */
                break;
        case 0xf4:              /* hlt */
-               ctxt->vcpu->arch.halt_request = 1;
+               ctxt->ops->halt(ctxt);
                break;
        case 0xf5:      /* cmc */
                /* complement carry flag from eflags reg */
@@ -3879,7 +4078,7 @@ special_insn:
                break;
        case 0xfe: /* Grp4 */
        grp45:
-               rc = emulate_grp45(ctxt, ops);
+               rc = emulate_grp45(ctxt);
                break;
        case 0xff: /* Grp5 */
                if (c->modrm_reg == 5)
@@ -3946,94 +4145,27 @@ done:
 
 twobyte_insn:
        switch (c->b) {
-       case 0x01: /* lgdt, lidt, lmsw */
-               switch (c->modrm_reg) {
-                       u16 size;
-                       unsigned long address;
-
-               case 0: /* vmcall */
-                       if (c->modrm_mod != 3 || c->modrm_rm != 1)
-                               goto cannot_emulate;
-
-                       rc = kvm_fix_hypercall(ctxt->vcpu);
-                       if (rc != X86EMUL_CONTINUE)
-                               goto done;
-
-                       /* Let the processor re-execute the fixed hypercall */
-                       c->eip = ctxt->eip;
-                       /* Disable writeback. */
-                       c->dst.type = OP_NONE;
-                       break;
-               case 2: /* lgdt */
-                       rc = read_descriptor(ctxt, ops, c->src.addr.mem,
-                                            &size, &address, c->op_bytes);
-                       if (rc != X86EMUL_CONTINUE)
-                               goto done;
-                       realmode_lgdt(ctxt->vcpu, size, address);
-                       /* Disable writeback. */
-                       c->dst.type = OP_NONE;
-                       break;
-               case 3: /* lidt/vmmcall */
-                       if (c->modrm_mod == 3) {
-                               switch (c->modrm_rm) {
-                               case 1:
-                                       rc = kvm_fix_hypercall(ctxt->vcpu);
-                                       break;
-                               default:
-                                       goto cannot_emulate;
-                               }
-                       } else {
-                               rc = read_descriptor(ctxt, ops, c->src.addr.mem,
-                                                    &size, &address,
-                                                    c->op_bytes);
-                               if (rc != X86EMUL_CONTINUE)
-                                       goto done;
-                               realmode_lidt(ctxt->vcpu, size, address);
-                       }
-                       /* Disable writeback. */
-                       c->dst.type = OP_NONE;
-                       break;
-               case 4: /* smsw */
-                       c->dst.bytes = 2;
-                       c->dst.val = ops->get_cr(0, ctxt->vcpu);
-                       break;
-               case 6: /* lmsw */
-                       ops->set_cr(0, (ops->get_cr(0, ctxt->vcpu) & ~0x0eul) |
-                                   (c->src.val & 0x0f), ctxt->vcpu);
-                       c->dst.type = OP_NONE;
-                       break;
-               case 5: /* not defined */
-                       emulate_ud(ctxt);
-                       rc = X86EMUL_PROPAGATE_FAULT;
-                       goto done;
-               case 7: /* invlpg*/
-                       rc = em_invlpg(ctxt);
-                       break;
-               default:
-                       goto cannot_emulate;
-               }
-               break;
        case 0x05:              /* syscall */
                rc = emulate_syscall(ctxt, ops);
                break;
        case 0x06:
-               emulate_clts(ctxt->vcpu);
+               rc = em_clts(ctxt);
                break;
        case 0x09:              /* wbinvd */
-               kvm_emulate_wbinvd(ctxt->vcpu);
+               (ctxt->ops->wbinvd)(ctxt);
                break;
        case 0x08:              /* invd */
        case 0x0d:              /* GrpP (prefetch) */
        case 0x18:              /* Grp16 (prefetch/nop) */
                break;
        case 0x20: /* mov cr, reg */
-               c->dst.val = ops->get_cr(c->modrm_reg, ctxt->vcpu);
+               c->dst.val = ops->get_cr(ctxt, c->modrm_reg);
                break;
        case 0x21: /* mov from dr to reg */
-               ops->get_dr(c->modrm_reg, &c->dst.val, ctxt->vcpu);
+               ops->get_dr(ctxt, c->modrm_reg, &c->dst.val);
                break;
        case 0x22: /* mov reg, cr */
-               if (ops->set_cr(c->modrm_reg, c->src.val, ctxt->vcpu)) {
+               if (ops->set_cr(ctxt, c->modrm_reg, c->src.val)) {
                        emulate_gp(ctxt, 0);
                        rc = X86EMUL_PROPAGATE_FAULT;
                        goto done;
@@ -4041,9 +4173,9 @@ twobyte_insn:
                c->dst.type = OP_NONE;
                break;
        case 0x23: /* mov from reg to dr */
-               if (ops->set_dr(c->modrm_reg, c->src.val &
+               if (ops->set_dr(ctxt, c->modrm_reg, c->src.val &
                                ((ctxt->mode == X86EMUL_MODE_PROT64) ?
-                                ~0ULL : ~0U), ctxt->vcpu) < 0) {
+                                ~0ULL : ~0U)) < 0) {
                        /* #UD condition is already handled by the code above */
                        emulate_gp(ctxt, 0);
                        rc = X86EMUL_PROPAGATE_FAULT;
@@ -4056,7 +4188,7 @@ twobyte_insn:
                /* wrmsr */
                msr_data = (u32)c->regs[VCPU_REGS_RAX]
                        | ((u64)c->regs[VCPU_REGS_RDX] << 32);
-               if (ops->set_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], msr_data)) {
+               if (ops->set_msr(ctxt, c->regs[VCPU_REGS_RCX], msr_data)) {
                        emulate_gp(ctxt, 0);
                        rc = X86EMUL_PROPAGATE_FAULT;
                        goto done;
@@ -4065,7 +4197,7 @@ twobyte_insn:
                break;
        case 0x32:
                /* rdmsr */
-               if (ops->get_msr(ctxt->vcpu, c->regs[VCPU_REGS_RCX], &msr_data)) {
+               if (ops->get_msr(ctxt, c->regs[VCPU_REGS_RCX], &msr_data)) {
                        emulate_gp(ctxt, 0);
                        rc = X86EMUL_PROPAGATE_FAULT;
                        goto done;
@@ -4094,7 +4226,7 @@ twobyte_insn:
                c->dst.val = test_cc(c->b, ctxt->eflags);
                break;
        case 0xa0:        /* push fs */
-               emulate_push_sreg(ctxt, ops, VCPU_SREG_FS);
+               rc = emulate_push_sreg(ctxt, ops, VCPU_SREG_FS);
                break;
        case 0xa1:       /* pop fs */
                rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_FS);
@@ -4111,7 +4243,7 @@ twobyte_insn:
                emulate_2op_cl("shld", c->src2, c->src, c->dst, ctxt->eflags);
                break;
        case 0xa8:      /* push gs */
-               emulate_push_sreg(ctxt, ops, VCPU_SREG_GS);
+               rc = emulate_push_sreg(ctxt, ops, VCPU_SREG_GS);
                break;
        case 0xa9:      /* pop gs */
                rc = emulate_pop_sreg(ctxt, ops, VCPU_SREG_GS);