From 89984cd2e5e70e23b63109988c1156c76a31121d Mon Sep 17 00:00:00 2001 From: bellard Date: Sun, 4 Dec 2005 22:17:10 +0000 Subject: [PATCH] segment validation fix in lret/iret git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@1684 c046a42c-6fe2-441c-8c8c-71466251a162 --- target-i386/helper.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/target-i386/helper.c b/target-i386/helper.c index 5c1d6cd80d..0c5e362c73 100644 --- a/target-i386/helper.c +++ b/target-i386/helper.c @@ -1584,7 +1584,7 @@ void load_seg(int seg_reg, int selector) if (!(e2 & DESC_CS_MASK) || !(e2 & DESC_C_MASK)) { /* if not conforming code, test rights */ - if (dpl < cpl || dpl < rpl) + if (dpl < cpl || dpl < rpl) raise_exception_err(EXCP0D_GPF, selector & 0xfffc); } } @@ -2152,10 +2152,10 @@ static inline void helper_ret_protected(int shift, int is_iret, int addend) sp_mask = get_sp_mask(ss_e2); /* validate data segments */ - validate_seg(R_ES, cpl); - validate_seg(R_DS, cpl); - validate_seg(R_FS, cpl); - validate_seg(R_GS, cpl); + validate_seg(R_ES, rpl); + validate_seg(R_DS, rpl); + validate_seg(R_FS, rpl); + validate_seg(R_GS, rpl); sp += addend; }