Changeset 98030 in vbox

Timestamp:

Jan 9, 2023 11:01:06 AM (23 months ago)

Author:

vboxsync

Message:

IEM/retf: Fixed imm16 parameter pop values above 255. bugref:10282

File:

• trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp (modified) (18 diffs)

trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp

@@ -2242 +2242 @@
     VBOXSTRICTRC    rcStrict;
     RTCPTRUNION     uPtrFrame;
-    uint64_t        uNewRsp;
+    RTUINT64U       NewRsp;
     uint64_t        uNewRip;
     uint16_t        uNewCs;
@@ -2254 +2254 @@
     rcStrict = iemMemStackPopBeginSpecial(pVCpu, cbRetPtr,
                                           enmEffOpSize == IEMMODE_16BIT ? 1 : enmEffOpSize == IEMMODE_32BIT ? 3 : 7,
-                                          &uPtrFrame.pv, &uNewRsp);
+                                          &uPtrFrame.pv, &NewRsp.u);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -2294 +2294 @@
 
         /* commit the operation. */
-        pVCpu->cpum.GstCtx.rsp           = uNewRsp;
+        if (cbPop)
+            iemRegAddToRspEx(pVCpu, &NewRsp, cbPop);
+        pVCpu->cpum.GstCtx.rsp           = NewRsp.u;
         pVCpu->cpum.GstCtx.rip           = uNewRip;
         pVCpu->cpum.GstCtx.cs.Sel        = uNewCs;
@@ -2300 +2302 @@
         pVCpu->cpum.GstCtx.cs.fFlags     = CPUMSELREG_FLAGS_VALID;
         pVCpu->cpum.GstCtx.cs.u64Base    = (uint32_t)uNewCs << 4;
-        if (cbPop)
-            iemRegAddToRsp(pVCpu, cbPop);
         return iemRegFinishClearingRF(pVCpu);
     }
@@ -2379 +2379 @@
     {
         /* Read the outer stack pointer stored *after* the parameters. */
-        rcStrict = iemMemStackPopContinueSpecial(pVCpu, cbPop /*off*/, cbRetPtr, &uPtrFrame.pv, uNewRsp);
+        rcStrict = iemMemStackPopContinueSpecial(pVCpu, cbPop /*off*/, cbRetPtr, &uPtrFrame.pv, NewRsp.u);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
 
         uint16_t uNewOuterSs;
-        uint64_t uNewOuterRsp;
+        RTUINT64U NewOuterRsp;
         if (enmEffOpSize == IEMMODE_16BIT)
         {
-            uNewOuterRsp = uPtrFrame.pu16[0];
-            uNewOuterSs  = uPtrFrame.pu16[1];
+            NewOuterRsp.u = uPtrFrame.pu16[0];
+            uNewOuterSs   = uPtrFrame.pu16[1];
         }
         else if (enmEffOpSize == IEMMODE_32BIT)
         {
-            uNewOuterRsp = uPtrFrame.pu32[0];
-            uNewOuterSs  = uPtrFrame.pu16[2];
+            NewOuterRsp.u = uPtrFrame.pu32[0];
+            uNewOuterSs   = uPtrFrame.pu16[2];
         }
         else
         {
-            uNewOuterRsp = uPtrFrame.pu64[0];
-            uNewOuterSs  = uPtrFrame.pu16[4];
+            NewOuterRsp.u = uPtrFrame.pu64[0];
+            uNewOuterSs   = uPtrFrame.pu16[4];
         }
         rcStrict = iemMemStackPopDoneSpecial(pVCpu, uPtrFrame.pv);
@@ -2415 +2415 @@
             {
                 Log(("retf %04x:%08RX64 %04x:%08RX64 -> invalid stack selector, #GP\n",
-                     uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
+                     uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u));
                 return iemRaiseGeneralProtectionFault0(pVCpu);
             }
@@ -2432 +2432 @@
         if ((uNewCs & X86_SEL_RPL) != (uNewOuterSs & X86_SEL_RPL))
         {
-            Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.RPL != CS.RPL -> #GP(SS)\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
+            Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.RPL != CS.RPL -> #GP(SS)\n", uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u));
             return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
         }
@@ -2442 +2442 @@
         {
             Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not a writable data segment (u1DescType=%u u4Type=%#x) -> #GP(SS).\n",
-                 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u1DescType, DescSs.Legacy.Gen.u4Type));
+                 uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u, DescSs.Legacy.Gen.u1DescType, DescSs.Legacy.Gen.u4Type));
             return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
         }
@@ -2452 +2452 @@
         {
             Log(("retf %04x:%08RX64 %04x:%08RX64 - SS has both L & D set -> #GP(SS).\n",
-                 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
+                 uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u));
             return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
         }
@@ -2460 +2460 @@
         {
             Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.DPL(%u) != CS.RPL (%u) -> #GP(SS).\n",
-                 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u2Dpl, uNewCs & X86_SEL_RPL));
+                 uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u, DescSs.Legacy.Gen.u2Dpl, uNewCs & X86_SEL_RPL));
             return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
         }
@@ -2467 +2467 @@
         if (!DescSs.Legacy.Gen.u1Present)
         {
-            Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not present -> #NP(SS).\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
+            Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not present -> #NP(SS).\n", uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u));
             return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
         }
@@ -2484 +2484 @@
             if (!IEM_IS_CANONICAL(uNewRip))
             {
-                Log(("retf %04x:%08RX64 %04x:%08RX64 - not canonical -> #GP.\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
+                Log(("retf %04x:%08RX64 %04x:%08RX64 - not canonical -> #GP.\n", uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u));
                 return iemRaiseNotCanonical(pVCpu);
             }
@@ -2494 +2494 @@
             {
                 Log(("retf %04x:%08RX64 %04x:%08RX64 - out of bounds (%#x)-> #GP(CS).\n",
-                     uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, cbLimitCs));
+                     uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u, cbLimitCs));
                 /** @todo Intel says this is \#GP(0)! */
                 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
@@ -2536 +2536 @@
         pVCpu->cpum.GstCtx.cs.u32Limit       = cbLimitCs;
         pVCpu->cpum.GstCtx.cs.u64Base        = u64Base;
-        pVCpu->iem.s.enmCpuMode     = iemCalcCpuMode(pVCpu);
+        pVCpu->iem.s.enmCpuMode              = iemCalcCpuMode(pVCpu);
         pVCpu->cpum.GstCtx.ss.Sel            = uNewOuterSs;
         pVCpu->cpum.GstCtx.ss.ValidSel       = uNewOuterSs;
@@ -2546 +2546 @@
         else
             pVCpu->cpum.GstCtx.ss.u64Base    = X86DESC_BASE(&DescSs.Legacy);
+        if (cbPop)
+            iemRegAddToRspEx(pVCpu, &NewOuterRsp, cbPop);
         if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
-            pVCpu->cpum.GstCtx.rsp           = uNewOuterRsp;
+            pVCpu->cpum.GstCtx.rsp           = NewOuterRsp.u;
         else if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
-            pVCpu->cpum.GstCtx.rsp           = (uint32_t)uNewOuterRsp;
+            pVCpu->cpum.GstCtx.rsp           = (uint32_t)NewOuterRsp.u;
         else
-            pVCpu->cpum.GstCtx.sp            = (uint16_t)uNewOuterRsp;
-
-        pVCpu->iem.s.uCpl           = (uNewCs & X86_SEL_RPL);
+            pVCpu->cpum.GstCtx.sp            = (uint16_t)NewOuterRsp.u;
+
+        pVCpu->iem.s.uCpl                    = (uNewCs & X86_SEL_RPL);
         iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.ds);
         iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.es);
@@ -2561 +2563 @@
         /** @todo check if the hidden bits are loaded correctly for 64-bit
          *        mode. */
-
-        if (cbPop)
-            iemRegAddToRsp(pVCpu, cbPop);
     }
     /*
@@ -2612 +2611 @@
 
         /* commit */
+        if (cbPop)
+            iemRegAddToRspEx(pVCpu, &NewRsp, cbPop);
         if (!pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
-            pVCpu->cpum.GstCtx.sp        = (uint16_t)uNewRsp;
+            pVCpu->cpum.GstCtx.sp        = (uint16_t)NewRsp.u;
         else
-            pVCpu->cpum.GstCtx.rsp       = uNewRsp;
+            pVCpu->cpum.GstCtx.rsp       = NewRsp.u;
         if (enmEffOpSize == IEMMODE_16BIT)
             pVCpu->cpum.GstCtx.rip       = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
@@ -2628 +2629 @@
         /** @todo check if the hidden bits are loaded correctly for 64-bit
          *        mode.  */
-        pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
-        if (cbPop)
-            iemRegAddToRsp(pVCpu, cbPop);
+        pVCpu->iem.s.enmCpuMode          = iemCalcCpuMode(pVCpu);
     }