1.1 --- a/xen/arch/x86/traps.c	Thu Jan 25 13:02:03 2007 +0000
     1.2 +++ b/xen/arch/x86/traps.c	Thu Jan 25 13:05:15 2007 +0000
     1.3 @@ -1146,7 +1146,9 @@ static int emulate_privileged_op(struct 
     1.4          goto fail;
     1.5      op_default = op_bytes = (ar & (_SEGMENT_L|_SEGMENT_DB)) ? 4 : 2;
     1.6      ad_default = ad_bytes = (ar & _SEGMENT_L) ? 8 : op_default;
     1.7 -    if ( !(ar & (_SEGMENT_CODE|_SEGMENT_S|_SEGMENT_P)) )
     1.8 +    if ( !(ar & _SEGMENT_S) ||
     1.9 +         !(ar & _SEGMENT_P) ||
    1.10 +         !(ar & _SEGMENT_CODE) )
    1.11          goto fail;
    1.12  
    1.13      /* emulating only opcodes not allowing SS to be default */
    1.14 @@ -1234,7 +1236,8 @@ static int emulate_privileged_op(struct 
    1.15                                    &data_base, &data_limit, &ar,
    1.16                                    _SEGMENT_WR|_SEGMENT_S|_SEGMENT_DPL|_SEGMENT_P) )
    1.17                  goto fail;
    1.18 -            if ( !(ar & (_SEGMENT_S|_SEGMENT_P)) ||
    1.19 +            if ( !(ar & _SEGMENT_S) ||
    1.20 +                 !(ar & _SEGMENT_P) ||
    1.21                   (opcode & 2 ?
    1.22                    (ar & _SEGMENT_CODE) && !(ar & _SEGMENT_WR) :
    1.23                    (ar & _SEGMENT_CODE) || !(ar & _SEGMENT_WR)) )

     2.1 --- a/xen/arch/x86/x86_64/compat/entry.S	Thu Jan 25 13:02:03 2007 +0000
     2.2 +++ b/xen/arch/x86/x86_64/compat/entry.S	Thu Jan 25 13:05:15 2007 +0000
     2.3 @@ -24,7 +24,9 @@ ENTRY(compat_hypercall)
     2.4          movq  %rsp,%rdi
     2.5          movl  $0xDEADBEEF,%eax
     2.6          rep   stosq
     2.7 -        popq  %r9 ; popq  %r8 ; popq  %rcx; popq  %rdx; popq  %rsi; popq  %rdi
     2.8 +        popq  %r8 ; popq  %r9 ; xchgl %r8d,%r9d /* Args 5&6: zero extend */
     2.9 +        popq  %rdx; popq  %rcx; xchgl %edx,%ecx /* Args 3&4: zero extend */
    2.10 +        popq  %rdi; popq  %rsi; xchgl %edi,%esi /* Args 1&2: zero extend */
    2.11          movl  UREGS_rax(%rsp),%eax
    2.12          pushq %rax
    2.13          pushq UREGS_rip+8(%rsp)