diff -r 42eee0575ab7 xen/arch/x86/hvm/platform.c
--- a/xen/arch/x86/hvm/platform.c	Tue May 16 18:52:53 2006
+++ b/xen/arch/x86/hvm/platform.c	Thu May 18 14:09:36 2006
@@ -830,7 +830,7 @@
         unsigned long count = GET_REPEAT_COUNT();
         unsigned long size = mmio_inst.op_size;
         int sign = regs->eflags & EF_DF ? -1 : 1;
-        unsigned long addr = 0;
+        unsigned long addr, high_addr, low_addr;
         int dir;
 
         /* determine non-MMIO address */
@@ -851,6 +851,13 @@
                 addr = regs->edi;
             }
         }
+	if (sign > 0) {
+	    high_addr = addr + count * size - 1;
+	    low_addr  = addr;
+	} else {
+	    high_addr = addr + size - 1;
+	    low_addr  = addr - (count-1) * size;
+	}
 
         mmio_opp->flags = mmio_inst.flags;
         mmio_opp->instr = mmio_inst.instr;
@@ -865,7 +872,8 @@
          * copy ourself. After this copy succeeds, "rep movs" is executed
          * again.
          */
-        if ((addr & PAGE_MASK) != ((addr + sign * (size - 1)) & PAGE_MASK)) {
+        if ((addr & PAGE_MASK) != ((addr + size - 1) & PAGE_MASK)) {
+	    /* one movs crosses page border */
             unsigned long value = 0;
 
             mmio_opp->flags |= OVERLAP;
@@ -876,15 +884,14 @@
                 hvm_copy(&value, addr, size, HVM_COPY_IN);
             send_mmio_req(IOREQ_TYPE_COPY, gpa, 1, size, value, dir, 0);
         } else {
-            if ((addr & PAGE_MASK) != ((addr + sign * (count * size - 1)) & PAGE_MASK)) {
+	    if ((high_addr & PAGE_MASK) != (low_addr & PAGE_MASK)) {
+                /* $count movs will cross page border */
                 regs->eip -= inst_len; /* do not advance %eip */
-
-                if (sign > 0)
-                    count = (PAGE_SIZE - (addr & ~PAGE_MASK)) / size;
-                else
-                    count = (addr & ~PAGE_MASK) / size;
+		if (sign > 0)
+		    count = (PAGE_SIZE - (addr & ~PAGE_MASK)) / size;
+		else
+		    count = ((high_addr + size - 1) & ~PAGE_MASK) / size;
             }
-
             send_mmio_req(IOREQ_TYPE_COPY, gpa, count, size, addr, dir, 1);
         }
         break;