1.1 --- a/xen/arch/x86/x86_emulate.c	Wed Aug 23 23:12:56 2006 +0100
     1.2 +++ b/xen/arch/x86/x86_emulate.c	Thu Aug 24 09:49:41 2006 +0100
     1.3 @@ -632,14 +632,6 @@ x86_emulate_memop(
     1.4          }
     1.5          break;
     1.6      case DstMem:
     1.7 -        /*
     1.8 -         * We expect that the fault occurred while accessing the explicit
     1.9 -         * destination memory operand. This is clearly not the case if the
    1.10 -         * fault occurred on a read access (eg. POP has an *implicit* operand
    1.11 -         * but we expect that the guest never uses special memory as stack).
    1.12 -         */
    1.13 -        if ( !(_regs.error_code & PFEC_write_access) )
    1.14 -            goto cannot_emulate;
    1.15          dst.type  = OP_MEM;
    1.16          dst.ptr   = (unsigned long *)cr2;
    1.17          dst.bytes = (d & ByteOp) ? 1 : op_bytes;
    1.18 @@ -684,14 +676,6 @@ x86_emulate_memop(
    1.19      case SrcMem:
    1.20          src.bytes = (d & ByteOp) ? 1 : op_bytes;
    1.21      srcmem_common:
    1.22 -        /*
    1.23 -         * We expect that the fault occurred while accessing the explicit
    1.24 -         * source memory operand. This is clearly not the case if the fault
    1.25 -         * occurred on a write access (eg. PUSH has an *implicit* operand
    1.26 -         * but we expect that the guest never uses special memory as stack).
    1.27 -         */
    1.28 -        if ( _regs.error_code & PFEC_write_access )
    1.29 -            goto cannot_emulate;
    1.30          src.type  = OP_MEM;
    1.31          src.ptr   = (unsigned long *)cr2;
    1.32          if ( (rc = ops->read_emulated((unsigned long)src.ptr, 
    1.33 @@ -797,6 +781,13 @@ x86_emulate_memop(
    1.34          dst.val = src.val;
    1.35          break;
    1.36      case 0x8f: /* pop (sole member of Grp1a) */
    1.37 +        /*
    1.38 +         * If the faulting access was a read it means that the fault occurred
    1.39 +         * when accessing the implicit stack operand. We assume the guest never
    1.40 +         * uses special memory areas as stack space.
    1.41 +         */
    1.42 +        if ( !(_regs.error_code & PFEC_write_access) )
    1.43 +            goto cannot_emulate; /* fault on stack access: bail */
    1.44          /* 64-bit mode: POP always pops a 64-bit operand. */
    1.45          if ( mode == X86EMUL_MODE_PROT64 )
    1.46              dst.bytes = 8;
    1.47 @@ -874,6 +865,13 @@ x86_emulate_memop(
    1.48              emulate_1op("dec", dst, _regs.eflags);
    1.49              break;
    1.50          case 6: /* push */
    1.51 +            /*
    1.52 +             * If the faulting access was a write it means that the fault
    1.53 +             * occurred when accessing the implicit stack operand. We assume
    1.54 +             * the guest never uses special memory areas as stack space.
    1.55 +             */
    1.56 +            if ( _regs.error_code & PFEC_write_access )
    1.57 +                goto cannot_emulate; /* fault on stack access: bail */
    1.58              /* 64-bit mode: PUSH always pushes a 64-bit operand. */
    1.59              if ( mode == X86EMUL_MODE_PROT64 )
    1.60              {