Changeset 60780 in vbox

Timestamp:

May 2, 2016 9:03:50 AM (9 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

106978

Message:

iemMemApplySegment: handle NULL segments.

File:

• trunk/src/VBox/VMM/VMMAll/IEMAll.cpp (modified) (1 diff)

trunk/src/VBox/VMM/VMMAll/IEMAll.cpp

@@ -6236 +6236 @@
             RTGCPTR32 GCPtrLast32  = GCPtrFirst32 + (uint32_t)cbMem - 1;
 
-            Assert(pSel->Attr.n.u1Present);
-            Assert(pSel->Attr.n.u1DescType);
-            if (!(pSel->Attr.n.u4Type & X86_SEL_TYPE_CODE))
+            if (   pSel->Attr.n.u1Present
+                && !pSel->Attr.n.u1Unusable)
             {
-                if (   (fAccess & IEM_ACCESS_TYPE_WRITE)
-                    && !(pSel->Attr.n.u4Type & X86_SEL_TYPE_WRITE) )
-                    return iemRaiseSelectorInvalidAccess(pIemCpu, iSegReg, fAccess);
-
-                if (!IEM_IS_REAL_OR_V86_MODE(pIemCpu))
+                Assert(pSel->Attr.n.u1DescType);
+                if (!(pSel->Attr.n.u4Type & X86_SEL_TYPE_CODE))
                 {
-                    /** @todo CPL check. */
+                    if (   (fAccess & IEM_ACCESS_TYPE_WRITE)
+                        && !(pSel->Attr.n.u4Type & X86_SEL_TYPE_WRITE) )
+                        return iemRaiseSelectorInvalidAccess(pIemCpu, iSegReg, fAccess);
+
+                    if (!IEM_IS_REAL_OR_V86_MODE(pIemCpu))
+                    {
+                        /** @todo CPL check. */
+                    }
+
+                    /*
+                     * There are two kinds of data selectors, normal and expand down.
+                     */
+                    if (!(pSel->Attr.n.u4Type & X86_SEL_TYPE_DOWN))
+                    {
+                        if (   GCPtrFirst32 > pSel->u32Limit
+                            || GCPtrLast32  > pSel->u32Limit) /* yes, in real mode too (since 80286). */
+                            return iemRaiseSelectorBounds(pIemCpu, iSegReg, fAccess);
+                    }
+                    else
+                    {
+                       /*
+                        * The upper boundary is defined by the B bit, not the G bit!
+                        */
+                       if (   GCPtrFirst32 < pSel->u32Limit + UINT32_C(1)
+                           || GCPtrLast32  > (pSel->Attr.n.u1DefBig ? UINT32_MAX : UINT32_C(0xffff)))
+                          return iemRaiseSelectorBounds(pIemCpu, iSegReg, fAccess);
+                    }
+                    *pGCPtrMem = GCPtrFirst32 += (uint32_t)pSel->u64Base;
                 }
-
-                /*
-                 * There are two kinds of data selectors, normal and expand down.
-                 */
-                if (!(pSel->Attr.n.u4Type & X86_SEL_TYPE_DOWN))
+                else
                 {
+
+                    /*
+                     * Code selector and usually be used to read thru, writing is
+                     * only permitted in real and V8086 mode.
+                     */
+                    if (   (   (fAccess & IEM_ACCESS_TYPE_WRITE)
+                            || (   (fAccess & IEM_ACCESS_TYPE_READ)
+                               && !(pSel->Attr.n.u4Type & X86_SEL_TYPE_READ)) )
+                        && !IEM_IS_REAL_OR_V86_MODE(pIemCpu) )
+                        return iemRaiseSelectorInvalidAccess(pIemCpu, iSegReg, fAccess);
+
                     if (   GCPtrFirst32 > pSel->u32Limit
                         || GCPtrLast32  > pSel->u32Limit) /* yes, in real mode too (since 80286). */
                         return iemRaiseSelectorBounds(pIemCpu, iSegReg, fAccess);
+
+                    if (!IEM_IS_REAL_OR_V86_MODE(pIemCpu))
+                    {
+                        /** @todo CPL check. */
+                    }
+
+                    *pGCPtrMem  = GCPtrFirst32 += (uint32_t)pSel->u64Base;
                 }
-                else
-                {
-                   /*
-                    * The upper boundary is defined by the B bit, not the G bit!
-                    */
-                   if (   GCPtrFirst32 < pSel->u32Limit + UINT32_C(1)
-                       || GCPtrLast32  > (pSel->Attr.n.u1DefBig ? UINT32_MAX : UINT32_C(0xffff)))
-                      return iemRaiseSelectorBounds(pIemCpu, iSegReg, fAccess);
-                }
-                *pGCPtrMem = GCPtrFirst32 += (uint32_t)pSel->u64Base;
             }
             else
-            {
-
-                /*
-                 * Code selector and usually be used to read thru, writing is
-                 * only permitted in real and V8086 mode.
-                 */
-                if (   (   (fAccess & IEM_ACCESS_TYPE_WRITE)
-                        || (   (fAccess & IEM_ACCESS_TYPE_READ)
-                           && !(pSel->Attr.n.u4Type & X86_SEL_TYPE_READ)) )
-                    && !IEM_IS_REAL_OR_V86_MODE(pIemCpu) )
-                    return iemRaiseSelectorInvalidAccess(pIemCpu, iSegReg, fAccess);
-
-                if (   GCPtrFirst32 > pSel->u32Limit
-                    || GCPtrLast32  > pSel->u32Limit) /* yes, in real mode too (since 80286). */
-                    return iemRaiseSelectorBounds(pIemCpu, iSegReg, fAccess);
-
-                if (!IEM_IS_REAL_OR_V86_MODE(pIemCpu))
-                {
-                    /** @todo CPL check. */
-                }
-
-                *pGCPtrMem  = GCPtrFirst32 += (uint32_t)pSel->u64Base;
-            }
+                return iemRaiseGeneralProtectionFault0(pIemCpu);
             return VINF_SUCCESS;
         }