Changeset 70643 in vbox for trunk/src/VBox/VMM

Timestamp:

Jan 19, 2018 12:19:32 PM (7 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

120373

Message:

VMM/IEM: Fix incorrect register decoding and added canonical address checks in fsgsbase instructions emulation.

Location:

trunk/src/VBox/VMM

Files:

• VMMAll/IEMAll.cpp (modified) (1 diff)
• VMMAll/IEMAllInstructionsTwoByte0f.cpp.h (modified) (8 diffs)
• testcase/tstIEMCheckMc.cpp (modified) (1 diff)

trunk/src/VBox/VMM/VMMAll/IEMAll.cpp

@@ -11274 +11274 @@
             return iemRaiseUndefinedOpcode(pVCpu); \
     } while (0)
+#define IEM_MC_MAYBE_RAISE_NON_CANONICAL_ADDR_GP0(a_u64Addr) \
+    do { \
+        if (!IEM_IS_CANONICAL(a_u64Addr)) \
+            return iemRaiseGeneralProtectionFault0(pVCpu); \
+    } while (0)
 
 

trunk/src/VBox/VMM/VMMAll/IEMAllInstructionsTwoByte0f.cpp.h

@@ -6999 +6999 @@
         IEM_MC_ARG(uint64_t, u64Dst, 0);
         IEM_MC_FETCH_SREG_BASE_U64(u64Dst, X86_SREG_FS);
-        IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u64Dst);
+        IEM_MC_STORE_GREG_U64((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, u64Dst);
         IEM_MC_ADVANCE_RIP();
         IEM_MC_END();
@@ -7009 +7009 @@
         IEM_MC_ARG(uint32_t, u32Dst, 0);
         IEM_MC_FETCH_SREG_BASE_U32(u32Dst, X86_SREG_FS);
-        IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u32Dst);
+        IEM_MC_STORE_GREG_U32((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, u32Dst);
         IEM_MC_ADVANCE_RIP();
         IEM_MC_END();
@@ -7027 +7027 @@
         IEM_MC_ARG(uint64_t, u64Dst, 0);
         IEM_MC_FETCH_SREG_BASE_U64(u64Dst, X86_SREG_GS);
-        IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u64Dst);
+        IEM_MC_STORE_GREG_U64((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, u64Dst);
         IEM_MC_ADVANCE_RIP();
         IEM_MC_END();
@@ -7037 +7037 @@
         IEM_MC_ARG(uint32_t, u32Dst, 0);
         IEM_MC_FETCH_SREG_BASE_U32(u32Dst, X86_SREG_GS);
-        IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u32Dst);
+        IEM_MC_STORE_GREG_U32((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, u32Dst);
         IEM_MC_ADVANCE_RIP();
         IEM_MC_END();
@@ -7054 +7054 @@
         IEM_MC_MAYBE_RAISE_FSGSBASE_XCPT();
         IEM_MC_ARG(uint64_t, u64Dst, 0);
-        IEM_MC_FETCH_GREG_U64(u64Dst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+        IEM_MC_FETCH_GREG_U64(u64Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
+        IEM_MC_MAYBE_RAISE_NON_CANONICAL_ADDR_GP0(u64Dst);
         IEM_MC_STORE_SREG_BASE_U64(X86_SREG_FS, u64Dst);
         IEM_MC_ADVANCE_RIP();
@@ -7064 +7065 @@
         IEM_MC_MAYBE_RAISE_FSGSBASE_XCPT();
         IEM_MC_ARG(uint32_t, u32Dst, 0);
-        IEM_MC_FETCH_GREG_U32(u32Dst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+        IEM_MC_FETCH_GREG_U32(u32Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
         IEM_MC_STORE_SREG_BASE_U64(X86_SREG_FS, u32Dst);
         IEM_MC_ADVANCE_RIP();
@@ -7082 +7083 @@
         IEM_MC_MAYBE_RAISE_FSGSBASE_XCPT();
         IEM_MC_ARG(uint64_t, u64Dst, 0);
-        IEM_MC_FETCH_GREG_U64(u64Dst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+        IEM_MC_FETCH_GREG_U64(u64Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
+        IEM_MC_MAYBE_RAISE_NON_CANONICAL_ADDR_GP0(u64Dst);
         IEM_MC_STORE_SREG_BASE_U64(X86_SREG_GS, u64Dst);
         IEM_MC_ADVANCE_RIP();
@@ -7092 +7094 @@
         IEM_MC_MAYBE_RAISE_FSGSBASE_XCPT();
         IEM_MC_ARG(uint32_t, u32Dst, 0);
-        IEM_MC_FETCH_GREG_U32(u32Dst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+        IEM_MC_FETCH_GREG_U32(u32Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
         IEM_MC_STORE_SREG_BASE_U64(X86_SREG_GS, u32Dst);
         IEM_MC_ADVANCE_RIP();

trunk/src/VBox/VMM/testcase/tstIEMCheckMc.cpp

@@ -363 +363 @@
     do { AssertCompile(RT_IS_POWER_OF_TWO(a_cbAlign)); CHK_TYPE(RTGCPTR,  a_EffAddr); } while (0)
 #define IEM_MC_MAYBE_RAISE_FSGSBASE_XCPT()              do {} while (0)
+#define IEM_MC_MAYBE_RAISE_NON_CANONICAL_ADDR_GP0(a_u64Addr)    do {} while (0)
 
 #define IEM_MC_LOCAL(a_Type, a_Name) \