[Qemu-devel] Qemu crashes on AAM 0

[Qemu-devel] Qemu crashes on AAM 0

[Joris van Rantwijk]

Qemu crashes with a floating point exception when emulating the "AAM 0"
instruction. By "crash", I mean that the whole qemu process actually
blows up (not just the program running inside Qemu).

A real i386 machine would trigger a divide exception on AAM 0.
This instruction form is undocumented of course, but blowing up the emulator
seems a bit drastic. I'm willing to write/test/provide a patch to fix this,
please let me know if that would be appreciated.

To trigger this bug, I run the qemu-0.9.0 binary distribution for
linux-i386 on Linux 2.6.21, without kqemu. I boot it with a FreeDOS
floppy image, start DEBUG, assemble the instruction AAM 0, execute it, boom.

By the way, Qemu is an amazing piece of work. I used it often and I'm quite
impressed by its overal quality and stability.

Thanks,
  Joris.

Re: [Qemu-devel] Qemu crashes on AAM 0

[malc]

On Sat, 28 Apr 2007, Joris van Rantwijk wrote:

> Qemu crashes with a floating point exception when emulating the "AAM 0"
> instruction. By "crash", I mean that the whole qemu process actually
> blows up (not just the program running inside Qemu).
>
> A real i386 machine would trigger a divide exception on AAM 0.
> This instruction form is undocumented of course, but blowing up the emulator
> seems a bit drastic. I'm willing to write/test/provide a patch to fix this,
> please let me know if that would be appreciated.
>
> To trigger this bug, I run the qemu-0.9.0 binary distribution for
> linux-i386 on Linux 2.6.21, without kqemu. I boot it with a FreeDOS
> floppy image, start DEBUG, assemble the instruction AAM 0, execute it, boom.
>
> By the way, Qemu is an amazing piece of work. I used it often and I'm quite
> impressed by its overal quality and stability.

Following (given that real iron does indeed produce divide by zero
exception) should do the trick.

Index: op.c
===================================================================
RCS file: /cvsroot/qemu/qemu/target-i386/op.c,v
retrieving revision 1.47
diff -u -r1.47 op.c
--- op.c	1 Feb 2007 22:11:07 -0000	1.47
+++ op.c	29 Apr 2007 15:54:47 -0000
@@ -1004,6 +1004,9 @@
  {
      int base = PARAM1;
      int al, ah;
+    if (!base) {
+        raise_exception(EXCP00_DIVZ);
+    }
      al = EAX & 0xff;
      ah = al / base;
      al = al % base;

-- 
vale

[Qemu-devel] Re: Qemu crashes on AAM 0

[Joris van Rantwijk]

Hello,

I tried the fix from malc, but it does not work on my testcase.
The reason is that the compiler optimizes the test away, since
PARAM1 is a constant value at that point in the build process.

The following fix does work:
--- qemu-0.9.0-orig/target-i386/translate.c	2007-02-06 00:01:54.000000000 +0100
+++ qemu-0.9.0/target-i386/translate.c	2007-04-30 13:31:25.000000000 +0200
@@ -5326,8 +5326,12 @@
         if (CODE64(s))
             goto illegal_op;
         val = ldub_code(s->pc++);
-        gen_op_aam(val);
-        s->cc_op = CC_OP_LOGICB;
+        if (val == 0) {
+            gen_exception(s, EXCP00_DIVZ, pc_start - s->cs_base);
+        } else {
+            gen_op_aam(val);
+            s->cc_op = CC_OP_LOGICB;
+        }
         break;
     case 0xd5: /* aad */
         if (CODE64(s))
--

Joris.

On Sat, Apr 28, 2007 at 07:52:57PM +0200, Joris van Rantwijk wrote:
> Qemu crashes with a floating point exception when emulating the "AAM 0"
> instruction. By "crash", I mean that the whole qemu process actually
> blows up (not just the program running inside Qemu).

On Sun, 29 Apr 2007 at 19:55:24 +0400, malc wrote:
> Following (given that real iron does indeed produce divide by zero
> exception) should do the trick.
>
> Index: op.c
> ===================================================================
> RCS file: /cvsroot/qemu/qemu/target-i386/op.c,v
> retrieving revision 1.47
> diff -u -r1.47 op.c
> --- op.c        1 Feb 2007 22:11:07 -0000       1.47
> +++ op.c        29 Apr 2007 15:54:47 -0000
> @@ -1004,6 +1004,9 @@
>  {
>      int base = PARAM1;
>      int al, ah;
> +    if (!base) {
> +        raise_exception(EXCP00_DIVZ);
> +    }
>      al = EAX & 0xff;
>      ah = al / base;
>      al = al % base;