[Qemu-devel] X86_64 ucomisd memory access

[Qemu-devel] X86_64 ucomisd memory access

[Alexander Bluhm]

I am running a software emulated OpenBSD/amd64 on an OpenBSD/amd64
host with qemu-system-x86_64 version 1.7.0.

A perl process within the emulated machine gets a segmentation fault
at this instruction:

0x00000cbf3e13f53c <S_sv_2iuv_common+108>:      ucomisd 0x28(%rax),%xmm0

The accessed address at 0x28(%rax) is 0xcbf38d13ff8, that is 8 bytes
before a page boundary.  The next page is not mapped.  The instruction
ucomisd should access a 64 bit memory location, so the perl programm
and the address layout are legal.  qemu generates a wrong page fault
as it assumes a 16 byte operation.

This patch fixes the problem, it is against qemu 1.7.0.

Signed-off-by: Alexander Bluhm <bluhm@openbsd.org>

--- target-i386/translate.c.orig	Wed Nov 27 23:15:55 2013
+++ target-i386/translate.c	Sun Jan 12 14:44:17 2014
@@ -4579,7 +4579,11 @@ static void gen_sse(CPUX86State *env, DisasContext *s,
                         gen_ldq_env_A0(s->mem_index, offsetof(CPUX86State,xmm_t0.XMM_D(0)));
                     }
                 } else {
-                    gen_ldo_env_A0(s->mem_index, op2_offset);
+		    if (b == 0x2e || b == 0x2f) {
+			gen_ldq_env_A0(s->mem_index, op2_offset);
+		    } else {
+			gen_ldo_env_A0(s->mem_index, op2_offset);
+		    }
                 }
             } else {
                 rm = (modrm & 7) | REX_B(s);