x86emul: correct VEX/XOP/EVEX operand size handling for 16-bit code Operand size defaults to 32 bits in that case, but would not have been set that way in the absence of an operand size override. Reported-by: Wei Liu Signed-off-by: Jan Beulich --- a/xen/arch/x86/x86_emulate/x86_emulate.c +++ b/xen/arch/x86/x86_emulate/x86_emulate.c @@ -2298,6 +2298,11 @@ x86_decode( case 8: /* VEX / XOP / EVEX */ generate_exception_if(rex_prefix || vex.pfx, EXC_UD); + /* + * With operand size override disallowed (see above), op_bytes + * should not have changed from its default. + */ + ASSERT(op_bytes == def_op_bytes); vex.raw[0] = modrm; if ( b == 0xc5 ) @@ -2326,7 +2331,8 @@ x86_decode( } else { - ASSERT(op_bytes == 4); + /* Operand size fixed at 4 (no override via W bit). */ + op_bytes = 4; vex.b = 1; } switch ( b )