Copyright (C) Intel Corporation. All Rights Reserved. # Notices and Disclaimers Intel technologies may require enabled hardware, software or service activation. No product or component can be absolutely secure. Your costs and results may vary. All product plans and roadmaps are subject to change without notice. The products described may contain design defects or errors known as errata which may cause the product to deviate from published specifications. Current characterized errata are available on request. Intel disclaims all express and implied warranties, including without limitation, the implied warranties of merchantability, fitness for a particular purpose, and non-infringement, as well as any warranty arising from course of performance, course of dealing, or usage in trade. Code names are used by Intel to identify products, technologies, or services that are in development and not publicly available. These are not “commercial” names and not intended to function as trademarks. No license (express or implied, by estoppel or otherwise) to any intellectual property rights is granted by this document, with the sole exception that a) you may publish an unmodified copy and b) code, identified as Sample Code in this document is licensed subject to the Zero-Clause BSD open source license (0BSD), [https://opensource.org/licenses/0BSD](https://opensource.org/licenses/0BSD). You may create software implementations based on this document and in compliance with the foregoing that are intended to execute on the Intel product(s) referenced in this document. No rights are granted to create modifications or derivatives of this document. You may not use or facilitate the use of this document in connection with any infringement or other legal analysis concerning Intel products described herein. You agree to grant Intel a non-exclusive, royalty-free license to any patent claim thereafter drafted which includes subject matter disclosed herein. If you give Intel any comments or suggestions related to this document or the information contained in it, Intel can use them in any way and disclose them to anyone, without payment or other obligations to you. You represent and warrant that you own, or have sufficient rights from the owner of, any such comments or suggestions, and the intellectual property rights in them, to grant the above permission. © Intel Corporation. Intel, the Intel logo, and other Intel marks are trademarks of Intel Corporation or its subsidiaries. Other names and brands may be claimed as the property of others. The code in this file is not 'Sample Code'. Std::Boolean::Not Std::Integer::Le Std::Integer::Ne Std::Integer::Positive_Divide Std::Bits::Add_int Data_Size_Of_Current_Mode In_64Bit_Mode Mem_Fetch Report_Invalid_Opcode Instr_JMP_FAR Next_IP let offset := Mem_Fetch?(ip, operand_size); let segment_selector := Mem_Fetch?(ip + (operand_size / 8), 16); if not ((Data_Size_Of_Current_Mode() != 64)) then Report_Invalid_Opcode!(); endif; LockPrefix #UD Mode64 #UD Next_IP := ip + (operand_size / 8) + 2; Instr_JMP_FAR?(operand_size, offset, segment_selector); ptr16:v offset ptrv segment_selector ptr16 let mode := Current_Mode(); if mode in { Real_Address_Mode, Virtual_8086_Mode } then let new_cs := Load_Real_Or_VM86_Segment(mode, segment_selector, CS); let new_rip := Zero_Extend(offset, 64); Check_New_RIP?(new_cs, new_rip); Branch_Far(new_cs, new_rip); else var new_cs := Load_Segment_Descriptor?(segment_selector, CS); // Call-Gate let seg_type := Get_Segment_Type(new_cs); if seg_type in { System16Bit_Call_Gate, System_Call_Gate } then if CR4.FRED == 0b1 or Unsigned(new_cs.descriptor.DPL) < CPL or Unsigned(new_cs.descriptor.DPL) < Unsigned(new_cs.selector.RPL) then Report_General_Protection_Exception!(Get_Error_Code_From_Selector(new_cs.selector)); endif; var new_rip : Bits(64); (new_cs, new_rip) := Get_Target_From_Gate?(new_cs); if not Is_Valid_Code_Segment(new_cs, CPL) then Report_General_Protection_Exception!(Get_Error_Code_From_Selector(new_cs.selector)); endif; Code_Segment_Checks?(new_cs); if new_cs.descriptor.A == 0b0 then new_cs := Set_Segment_Access_Bit?(new_cs); endif; Check_New_RIP?(new_cs, new_rip); if Is_Conforming_Code_Segment(new_cs) then new_cs.selector.RPL := CPL[0 +: 2]; endif; Branch_Far(new_cs, new_rip); if Is_End_Branch_Enabled(CPL) then CET::Set_Tracker_Status(CPL); endif; elsif Is_Task_Segment(new_cs) then Handle_Task?(new_cs, Task_Switch_Jmp, Next_IP); else if not Is_Valid_Code_Segment(new_cs, CPL) then Report_General_Protection_Exception!(Get_Error_Code_From_Selector(new_cs.selector)); endif; if Is_Non_Conforming_Code_Segment(new_cs) and Unsigned(new_cs.descriptor.DPL) < Unsigned(new_cs.selector.RPL) then Report_General_Protection_Exception!(Get_Error_Code_From_Selector(new_cs.selector)); endif; Code_Segment_Checks?(new_cs); let new_rip := Zero_Extend(offset, 64); Check_New_RIP?(new_cs, new_rip); if CET::Is_Shadow_Stack_Enabled(CPL) then if not Is_64Bit_Code_Segment(new_cs) and not Is_Zero(SSP[63:32]) then Report_General_Protection_Exception!(Zero(32)); endif; endif; new_cs := Load_Segment_Descriptor?(new_cs.selector, CS); if new_cs.descriptor.A == 0b0 then new_cs := Set_Segment_Access_Bit?(new_cs); endif; if Is_Conforming_Code_Segment(new_cs) then new_cs.selector.RPL := CPL[0 +: 2]; endif; if In_64Bit_Mode() and not Is_64Bit_Code_Segment(new_cs) then RSP[63:32] := Zero(32); endif; Branch_Far(new_cs, new_rip); if Is_End_Branch_Enabled(CPL) then CET::Set_Tracker_Status(CPL); endif; endif; endif; Std::Boolean::Not Std::Boolean::Strict_And Std::Boolean::Strict_Or Std::Integer::Lt Std::Bits::Unsigned Std::Bits::Eq Std::Bits::Is_Zero Std::Bits::Zero_Extend Std::Bits::Zero Branch_Far CET::Is_Shadow_Stack_Enabled CET::Set_Tracker_Status Check_New_RIP Code_Segment_Checks Current_Mode Get_Error_Code_From_Selector Get_Segment_Type Get_Target_From_Gate Handle_Task In_64Bit_Mode Is_64Bit_Code_Segment Is_Conforming_Code_Segment Is_End_Branch_Enabled Is_Non_Conforming_Code_Segment Is_Task_Segment Is_Valid_Code_Segment Load_Real_Or_VM86_Segment Load_Segment_Descriptor Report_General_Protection_Exception Set_Segment_Access_Bit RSP RSP_write False CS Real_Address_Mode CPL Virtual_8086_Mode SSP CR4 Task_Switch_Jmp System16Bit_Call_Gate System_Call_Gate Next_IP Std::Integer::Le Std::Integer::Positive_Divide Std::Bits::Add_int Effective_Address Handle_RIP_Relative_Address Logical_Mem_Read Report_Invalid_Opcode Instr_JMP_FAR False Memory_Read Normal_Alignment Next_IP let disp8n := 1; let (ea_offset, segment, next_ip0, is_rip_relative) := Effective_Address?(address_size, context, mod, rm, disp8n, ip); let effective_address := Handle_RIP_Relative_Address(address_size, is_rip_relative, ea_offset, next_ip0); LockPrefix #UD let offset := Logical_Mem_Read?(segment, effective_address, operand_size); let segment_selector := Logical_Mem_Read?(segment, effective_address + ((operand_size) / 8), 16); Next_IP := next_ip0; Instr_JMP_FAR?(operand_size, offset, segment_selector); m16:v offset ModRM:r/m mv segment_selector ModRM:r/m m16 Std::Boolean::Not Std::Bits::Add_int Std::Bits::Sign_Extend Mem_Fetch Report_Invalid_Opcode Instr_JMP_NEAR False Next_IP let operand_size := 64; let is_indirect := False; let is_no_track := False; let src := Sign_Extend(Mem_Fetch?(ip, 32), operand_size); if not (not context.rex2_prefix_present) then Report_Invalid_Opcode!(); endif; LockPrefix #UD Next_IP := ip + 4; Instr_JMP_NEAR?(operand_size, context, src, is_indirect, is_no_track); rel32 src rel32 is_indirect False is_no_track False let new_rip := if is_indirect then Zero_Extend(src, 64) else Relative_Branch_Wrap(context.operand_size, Next_IP + Sign_Extend(src, 64)); Check_New_RIP?(CS, new_rip); Branch_Near(new_rip); if is_indirect and Is_End_Branch_Enabled_And_Not_Suppressed(CPL) then if IA32_CET[CPL].NO_TRACK_EN == 0b0 or not is_no_track then CET::Set_Tracker_Status(CPL); endif; endif; Std::Boolean::Not Std::Boolean::Strict_And Std::Boolean::Strict_Or Std::Bits::Add Std::Bits::Eq Std::Bits::Sign_Extend Std::Bits::Zero_Extend Branch_Near CET::Set_Tracker_Status Check_New_RIP IA32_CET Is_End_Branch_Enabled_And_Not_Suppressed Relative_Branch_Wrap CS CPL Next_IP Std::Integer::Le Std::Integer::Min Std::Integer::Positive_Divide Std::Bits::Add_int Std::Bits::Sign_Extend In_64Bit_Mode Mem_Fetch Report_Invalid_Opcode Instr_JMP_NEAR False Next_IP let is_indirect := False; let is_no_track := False; let src := Sign_Extend(Mem_Fetch?(ip, Min(operand_size, 32)), operand_size); LockPrefix #UD Mode64 #UD Next_IP := ip + (Min(operand_size, 32) / 8); Instr_JMP_NEAR?(operand_size, context, src, is_indirect, is_no_track); relz src relz is_indirect False is_no_track False Std::Bits::Add_int Std::Bits::Sign_Extend In_64Bit_Mode Mem_Fetch Report_Invalid_Opcode Instr_JMP_NEAR False Next_IP let operand_size := 8; let is_indirect := False; let is_no_track := False; let src := Sign_Extend(Mem_Fetch?(ip, 8), operand_size); LockPrefix #UD Mode64 #UD Next_IP := ip + 1; Instr_JMP_NEAR?(operand_size, context, src, is_indirect, is_no_track); rel8 src rel8 is_indirect False is_no_track False Std::Boolean::Not Std::Bits::Add_int Std::Bits::Sign_Extend Mem_Fetch Report_Invalid_Opcode Instr_JMP_NEAR False Next_IP let operand_size := 64; let is_indirect := False; let is_no_track := False; let src := Sign_Extend(Mem_Fetch?(ip, 8), operand_size); if not (not context.rex2_prefix_present) then Report_Invalid_Opcode!(); endif; LockPrefix #UD Next_IP := ip + 1; Instr_JMP_NEAR?(operand_size, context, src, is_indirect, is_no_track); rel8 src rel8 is_indirect False is_no_track False Std::Integer::Add Std::Bits::Append Read_GPR Report_Invalid_Opcode Instr_JMP_NEAR True Next_IP let is_indirect := True; let is_no_track := context.no_track_prefix; let src := Read_GPR(context.rex_b4 ++ context.rex_b3 ++ rm, operand_size); LockPrefix #UD Next_IP := ip; Instr_JMP_NEAR?(operand_size, context, src, is_indirect, is_no_track); rv src ModRM:r/m rv is_indirect True is_no_track context.no_track_prefix Effective_Address Handle_RIP_Relative_Address Logical_Mem_Read Report_Invalid_Opcode Instr_JMP_NEAR True False Memory_Read Normal_Alignment Next_IP let is_indirect := True; let is_no_track := context.no_track_prefix; let disp8n := 1; let (ea_offset, segment, next_ip0, is_rip_relative) := Effective_Address?(address_size, context, mod, rm, disp8n, ip); let effective_address := Handle_RIP_Relative_Address(address_size, is_rip_relative, ea_offset, next_ip0); LockPrefix #UD let src := Logical_Mem_Read?(segment, effective_address, operand_size); Next_IP := next_ip0; Instr_JMP_NEAR?(operand_size, context, src, is_indirect, is_no_track); mv src ModRM:r/m mv is_indirect True is_no_track context.no_track_prefix branch Operand is sign-extended to operand_size bits.