From a62511bf14971ff581212decbbf57fc11b967840 Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Mon, 31 Oct 2016 08:57:47 +0100 Subject: [PATCH] VMX: fix realmode emulation SReg handling Commit 0888d36bb2 ("x86/emul: Correct the decoding of SReg3 operands") overlooked three places where x86_seg_cs was assumed to be zero. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Release-acked-by: Wei Liu --- xen/arch/x86/hvm/vmx/vmx.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/xen/arch/x86/hvm/vmx/vmx.c b/xen/arch/x86/hvm/vmx/vmx.c index 4d30eae2a7..9a8f69471b 100644 --- a/xen/arch/x86/hvm/vmx/vmx.c +++ b/xen/arch/x86/hvm/vmx/vmx.c @@ -1496,21 +1496,23 @@ static void vmx_update_guest_cr(struct vcpu *v, unsigned int cr) enum x86_segment s; struct segment_register reg[x86_seg_tr + 1]; + BUILD_BUG_ON(x86_seg_tr != x86_seg_gs + 1); + /* Entering or leaving real mode: adjust the segment registers. * Need to read them all either way, as realmode reads can update * the saved values we'll use when returning to prot mode. */ - for ( s = x86_seg_cs ; s <= x86_seg_tr ; s++ ) + for ( s = 0; s < ARRAY_SIZE(reg); s++ ) vmx_get_segment_register(v, s, ®[s]); v->arch.hvm_vmx.vmx_realmode = realmode; if ( realmode ) { - for ( s = x86_seg_cs ; s <= x86_seg_tr ; s++ ) + for ( s = 0; s < ARRAY_SIZE(reg); s++ ) vmx_set_segment_register(v, s, ®[s]); } else { - for ( s = x86_seg_cs ; s <= x86_seg_tr ; s++ ) + for ( s = 0; s < ARRAY_SIZE(reg); s++ ) if ( !(v->arch.hvm_vmx.vm86_segment_mask & (1<arch.hvm_vmx.vm86_saved_seg[s]); -- 2.30.2