Changeset 97517 in vbox for trunk/src/VBox/VMM/VMMAll

Timestamp:

Nov 11, 2022 10:56:02 PM (2 years ago)

Author:

vboxsync

Message:

VMM/IEM: Fixed indirect far calls in 64-bit mode where we would get the base address wrong when the target wasn't a 64-bit CS (L=1). bugref:9898

Location:

trunk/src/VBox/VMM/VMMAll

Files:

• IEMAllCImpl.cpp (modified) (1 diff)
• IEMAllInstructionsOneByte.cpp.h (modified) (1 diff)

trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp

@@ -2156 +2156 @@
     uint64_t u64Base;
     uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
-    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
-    {
-        if (!IEM_IS_CANONICAL(offSeg))
-        {
-            Log(("callf %04x:%016RX64 - not canonical -> #GP\n", uSel, offSeg));
-            return iemRaiseNotCanonical(pVCpu);
-        }
-        u64Base = 0;
-    }
-    else
-    {
-        if (offSeg > cbLimit)
-        {
-            Log(("callf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
+    if (   !Desc.Legacy.Gen.u1Long
+        || !IEM_IS_LONG_MODE(pVCpu))
+    {
+        if (RT_LIKELY(offSeg <= cbLimit))
+            u64Base = X86DESC_BASE(&Desc.Legacy);
+        else
+        {
+            Log(("jmpf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
             /** @todo Intel says this is \#GP(0)! */
             return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
         }
-        u64Base = X86DESC_BASE(&Desc.Legacy);
+    }
+    else if (IEM_IS_CANONICAL(offSeg))
+        u64Base = 0;
+    else
+    {
+        Log(("callf %04x:%016RX64 - not canonical -> #GP\n", uSel, offSeg));
+        return iemRaiseNotCanonical(pVCpu);
     }
 

trunk/src/VBox/VMM/VMMAll/IEMAllInstructionsOneByte.cpp.h

@@ -11518 +11518 @@
     /* 64-bit mode: Default is 32-bit, but only intel respects a REX.W prefix. */
     /** @todo what does VIA do? */
-    if (pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT || IEM_IS_GUEST_CPU_INTEL(pVCpu) || pVCpu->iem.s.enmEffOpSize != IEMMODE_64BIT)
+    if (pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT || pVCpu->iem.s.enmEffOpSize != IEMMODE_64BIT || IEM_IS_GUEST_CPU_INTEL(pVCpu))
     { /* likely */ }
     else