From: Jan Beulich <jbeulich@suse.com>
Date: Mon, 16 Dec 2019 16:37:09 +0000 (+0100)
Subject: x86emul: correct far branch handling for 64-bit mode
X-Git-Tag: archive/raspbian/4.14.0+80-gd101b417b7-1+rpi1^2~63^2~1045
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=2d696d61452f83c03a38981302efbbea8a7dfc41;p=xen.git

x86emul: correct far branch handling for 64-bit mode

AMD and friends explicitly specify that 64-bit operands aren't possible
for these insns. Nevertheless REX.W isn't fully ignored: It still
cancels a possible operand size override (0x66). Intel otoh explicitly
provides for 64-bit operands on the respective insn page of the SDM.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
---

diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c
index 742280de23..5503844c4a 100644
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -2519,9 +2519,16 @@ x86_decode_onebyte(
         case 6: /* push */
             if ( mode_64bit() && op_bytes == 4 )
                 op_bytes = 8;
-            /* fall through */
+            state->desc = DstNone | SrcMem | Mov;
+            break;
+
         case 3: /* call (far, absolute indirect) */
         case 5: /* jmp (far, absolute indirect) */
+            /* REX.W ignored on a vendor-dependent basis. */
+            if ( op_bytes == 8 &&
+                 (ctxt->cpuid->x86_vendor &
+                  (X86_VENDOR_AMD | X86_VENDOR_HYGON)) )
+                op_bytes = 4;
             state->desc = DstNone | SrcMem | Mov;
             break;
         }