From: Jan Beulich <jbeulich@suse.com>
Date: Fri, 15 Nov 2019 13:15:31 +0000 (+0100)
Subject: x86emul: 16-bit XBEGIN does not truncate rIP
X-Git-Tag: archive/raspbian/4.14.0+80-gd101b417b7-1+rpi1^2~63^2~1181
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=a72c508656c0a0fa573890b290064e6035971f86;p=xen.git

x86emul: 16-bit XBEGIN does not truncate rIP

SDM rev 071 points out this fact explicitly.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Release-acked-by: Juergen Gross <jgross@suse.com>
---

diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c
index 8f50a4f2de..777cac2b29 100644
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -4246,10 +4246,12 @@ x86_emulate(
         {
             /*
              * xbegin unconditionally aborts, xabort is unconditionally
-             * a nop.
+             * a nop. It also does not truncate the destination address to
+             * 16 bits when 16-bit operand size is in effect.
              */
             if ( b & 1 )
             {
+                op_bytes = 4;
                 jmp_rel((int32_t)src.val);
                 _regs.r(ax) = 0;
             }