x86emul: 16-bit XBEGIN does not truncate rIP

SDM rev 071 points out this fact explicitly.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Release-acked-by: Juergen Gross <jgross@suse.com>

diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c
index 8f50a4f2de5f8f64b86100b3fa758a47cb3ce293..777cac2b29c66781d3f8daa6ce6f8ca9a9eb1baf 100644 (file)
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -4246,10 +4246,12 @@ x86_emulate(
         {
             /*
              * xbegin unconditionally aborts, xabort is unconditionally
-             * a nop.
+             * a nop. It also does not truncate the destination address to
+             * 16 bits when 16-bit operand size is in effect.
              */
             if ( b & 1 )
             {
+                op_bytes = 4;
                 jmp_rel((int32_t)src.val);
                 _regs.r(ax) = 0;
             }