blob: 5f1dd9fc0fc0972354896f972be845c29c8412d0 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
|
x86: 0.997
i386: 0.900
assembly: 0.847
architecture: 0.838
device: 0.773
vnc: 0.768
graphic: 0.742
kernel: 0.698
ppc: 0.615
risc-v: 0.554
debug: 0.506
boot: 0.462
socket: 0.412
permissions: 0.405
arm: 0.386
TCG: 0.372
PID: 0.328
KVM: 0.326
semantic: 0.321
performance: 0.309
network: 0.279
VMM: 0.264
hypervisor: 0.205
virtual: 0.186
peripherals: 0.177
files: 0.113
register: 0.113
mistranslation: 0.073
user-level: 0.021
--------------------
x86: 1.000
i386: 0.977
assembly: 0.946
debug: 0.242
kernel: 0.071
TCG: 0.049
semantic: 0.042
risc-v: 0.034
virtual: 0.033
user-level: 0.033
register: 0.029
hypervisor: 0.027
files: 0.025
performance: 0.024
device: 0.012
PID: 0.012
network: 0.012
architecture: 0.010
peripherals: 0.009
boot: 0.005
permissions: 0.003
socket: 0.002
VMM: 0.001
graphic: 0.001
vnc: 0.001
KVM: 0.001
mistranslation: 0.001
ppc: 0.000
arm: 0.000
x86 CVT* series instructions fault
Description of problem:
For example, CVTSD2SS instruction converts SRC[63:0] double precision floating point to DEST[31:0] single precision floating point. Although the CVTSD2SS instruction uses only 8 bytes, if it overlaps page boundary, I think QEMU tries to access over the valid memory and crashes.
Steps to reproduce:
1. Compile this code
```
void main() {
mmap(0x555555559000, 0x1000, flag, ~~, 0);
asm("cvtsd2ss xmm1, qword ptr [0x555555559ff8]");
}
```
2. Execute. QEMU crashes but CPU does not.
Additional information:
This bug is discovered by research conducted by KAIST SoftSec.
|