[PATCH 0/3] Fix BRASL and BRCL with large negative offsets

[PATCH 0/3] Fix BRASL and BRCL with large negative offsets

[Ilya Leoshkevich]

Hi,

I noticed that sometimes jumping backwards leads to crashes or hangs.
The problem is a missing cast.
Patches 1 and 2 fix the problem, patch 3 adds a test.

Best regards,
Ilya

Ilya Leoshkevich (3):
  s390x/tcg: Fix BRASL with a large negative offset
  s390x/tcg: Fix BRCL with a large negative offset
  tests/tcg/s390x: Test BRASL and BRCL with large negative offsets

 target/s390x/tcg/translate.c           |  4 ++--
 tests/tcg/s390x/Makefile.target        |  1 +
 tests/tcg/s390x/branch-relative-long.c | 29 ++++++++++++++++++++++++++
 3 files changed, 32 insertions(+), 2 deletions(-)
 create mode 100644 tests/tcg/s390x/branch-relative-long.c

-- 
2.35.1

[PATCH 1/3] s390x/tcg: Fix BRASL with a large negative offset

[Ilya Leoshkevich]

When RI2 is 0x80000000, qemu enters an infinite loop instead of jumping
backwards. Fix by adding a missing cast, like in in2_ri2().

Fixes: 8ac33cdb8bfb ("Convert BRANCH AND SAVE")
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
---
 target/s390x/tcg/translate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
index 904b51542f..41c8696185 100644
--- a/target/s390x/tcg/translate.c
+++ b/target/s390x/tcg/translate.c
@@ -1597,7 +1597,7 @@ static DisasJumpType op_bal(DisasContext *s, DisasOps *o)
 static DisasJumpType op_basi(DisasContext *s, DisasOps *o)
 {
     pc_to_link_info(o->out, s, s->pc_tmp);
-    return help_goto_direct(s, s->base.pc_next + 2 * get_field(s, i2));
+    return help_goto_direct(s, s->base.pc_next + (int64_t)get_field(s, i2) * 2);
 }
 
 static DisasJumpType op_bc(DisasContext *s, DisasOps *o)
-- 
2.35.1

Re: [PATCH 1/3] s390x/tcg: Fix BRASL with a large negative offset

[David Hildenbrand]

On 11.03.22 19:49, Ilya Leoshkevich wrote:
> When RI2 is 0x80000000, qemu enters an infinite loop instead of jumping
> backwards. Fix by adding a missing cast, like in in2_ri2().
> 
> Fixes: 8ac33cdb8bfb ("Convert BRANCH AND SAVE")
> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
> ---
>  target/s390x/tcg/translate.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
> index 904b51542f..41c8696185 100644
> --- a/target/s390x/tcg/translate.c
> +++ b/target/s390x/tcg/translate.c
> @@ -1597,7 +1597,7 @@ static DisasJumpType op_bal(DisasContext *s, DisasOps *o)
>  static DisasJumpType op_basi(DisasContext *s, DisasOps *o)
>  {
>      pc_to_link_info(o->out, s, s->pc_tmp);
> -    return help_goto_direct(s, s->base.pc_next + 2 * get_field(s, i2));
> +    return help_goto_direct(s, s->base.pc_next + (int64_t)get_field(s, i2) * 2);
>  }
>  
>  static DisasJumpType op_bc(DisasContext *s, DisasOps *o)

Reviewed-by: David Hildenbrand <david@redhat.com>

Thanks!

-- 
Thanks,

David / dhildenb

[PATCH 2/3] s390x/tcg: Fix BRCL with a large negative offset

[Ilya Leoshkevich]

When RI2 is 0x80000000, qemu enters an infinite loop instead of jumping
backwards. Fix by adding a missing cast, like in in2_ri2().

Fixes: 7233f2ed1717 ("target-s390: Convert BRANCH ON CONDITION")
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
---
 target/s390x/tcg/translate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
index 41c8696185..5acfc0ff9b 100644
--- a/target/s390x/tcg/translate.c
+++ b/target/s390x/tcg/translate.c
@@ -1201,7 +1201,7 @@ static DisasJumpType help_branch(DisasContext *s, DisasCompare *c,
                                  bool is_imm, int imm, TCGv_i64 cdest)
 {
     DisasJumpType ret;
-    uint64_t dest = s->base.pc_next + 2 * imm;
+    uint64_t dest = s->base.pc_next + (int64_t)imm * 2;
     TCGLabel *lab;
 
     /* Take care of the special cases first.  */
-- 
2.35.1

Re: [PATCH 2/3] s390x/tcg: Fix BRCL with a large negative offset

[David Hildenbrand]

On 11.03.22 19:49, Ilya Leoshkevich wrote:
> When RI2 is 0x80000000, qemu enters an infinite loop instead of jumping
> backwards. Fix by adding a missing cast, like in in2_ri2().
> 
> Fixes: 7233f2ed1717 ("target-s390: Convert BRANCH ON CONDITION")
> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
> ---
>  target/s390x/tcg/translate.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
> index 41c8696185..5acfc0ff9b 100644
> --- a/target/s390x/tcg/translate.c
> +++ b/target/s390x/tcg/translate.c
> @@ -1201,7 +1201,7 @@ static DisasJumpType help_branch(DisasContext *s, DisasCompare *c,
>                                   bool is_imm, int imm, TCGv_i64 cdest)
>  {
>      DisasJumpType ret;
> -    uint64_t dest = s->base.pc_next + 2 * imm;
> +    uint64_t dest = s->base.pc_next + (int64_t)imm * 2;
>      TCGLabel *lab;
>  
>      /* Take care of the special cases first.  */

Reviewed-by: David Hildenbrand <david@redhat.com>

-- 
Thanks,

David / dhildenb

[PATCH 3/3] tests/tcg/s390x: Test BRASL and BRCL with large negative offsets

[Ilya Leoshkevich]

Add a small test in order to prevent regressions.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
---
 tests/tcg/s390x/Makefile.target        |  1 +
 tests/tcg/s390x/branch-relative-long.c | 29 ++++++++++++++++++++++++++
 2 files changed, 30 insertions(+)
 create mode 100644 tests/tcg/s390x/branch-relative-long.c

diff --git a/tests/tcg/s390x/Makefile.target b/tests/tcg/s390x/Makefile.target
index 257c568c58..fd34b130f7 100644
--- a/tests/tcg/s390x/Makefile.target
+++ b/tests/tcg/s390x/Makefile.target
@@ -15,6 +15,7 @@ TESTS+=mvc
 TESTS+=shift
 TESTS+=trap
 TESTS+=signals-s390x
+TESTS+=branch-relative-long
 
 ifneq ($(HAVE_GDB_BIN),)
 GDB_SCRIPT=$(SRC_PATH)/tests/guest-debug/run-test.py
diff --git a/tests/tcg/s390x/branch-relative-long.c b/tests/tcg/s390x/branch-relative-long.c
new file mode 100644
index 0000000000..b9fcee9873
--- /dev/null
+++ b/tests/tcg/s390x/branch-relative-long.c
@@ -0,0 +1,29 @@
+#include <assert.h>
+#include <stddef.h>
+#include <sys/mman.h>
+
+int main(void)
+{
+    const unsigned short opcodes[] = {
+        0xc005,  /* brasl %r0 */
+        0xc0f4,  /* brcl 0xf */
+    };
+    size_t length = 0x100000006;
+    unsigned char *buf;
+    int i;
+
+    buf = mmap(NULL, length, PROT_READ | PROT_WRITE | PROT_EXEC,
+               MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+    assert(buf != MAP_FAILED);
+
+    *(unsigned short *)&buf[0] = 0x07fe;  /* br %r14 */
+    *(unsigned int *)&buf[0x100000002] = 0x80000000;
+    for (i = 0; i < sizeof(opcodes) / sizeof(opcodes[0]); i++) {
+        *(unsigned short *)&buf[0x100000000] = opcodes[i];
+        ((void (*)(void))&buf[0x100000000])();
+    }
+
+    munmap(buf, length);
+
+    return 0;
+}
-- 
2.35.1

Re: [PATCH 3/3] tests/tcg/s390x: Test BRASL and BRCL with large negative offsets

[David Hildenbrand]

On 11.03.22 19:49, Ilya Leoshkevich wrote:
> Add a small test in order to prevent regressions.
> 
> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
> ---
>  tests/tcg/s390x/Makefile.target        |  1 +
>  tests/tcg/s390x/branch-relative-long.c | 29 ++++++++++++++++++++++++++
>  2 files changed, 30 insertions(+)
>  create mode 100644 tests/tcg/s390x/branch-relative-long.c
> 
> diff --git a/tests/tcg/s390x/Makefile.target b/tests/tcg/s390x/Makefile.target
> index 257c568c58..fd34b130f7 100644
> --- a/tests/tcg/s390x/Makefile.target
> +++ b/tests/tcg/s390x/Makefile.target
> @@ -15,6 +15,7 @@ TESTS+=mvc
>  TESTS+=shift
>  TESTS+=trap
>  TESTS+=signals-s390x
> +TESTS+=branch-relative-long
>  
>  ifneq ($(HAVE_GDB_BIN),)
>  GDB_SCRIPT=$(SRC_PATH)/tests/guest-debug/run-test.py
> diff --git a/tests/tcg/s390x/branch-relative-long.c b/tests/tcg/s390x/branch-relative-long.c
> new file mode 100644
> index 0000000000..b9fcee9873
> --- /dev/null
> +++ b/tests/tcg/s390x/branch-relative-long.c
> @@ -0,0 +1,29 @@
> +#include <assert.h>
> +#include <stddef.h>
> +#include <sys/mman.h>
> +
> +int main(void)
> +{
> +    const unsigned short opcodes[] = {
> +        0xc005,  /* brasl %r0 */
> +        0xc0f4,  /* brcl 0xf */
> +    };
> +    size_t length = 0x100000006;
> +    unsigned char *buf;
> +    int i;
> +
> +    buf = mmap(NULL, length, PROT_READ | PROT_WRITE | PROT_EXEC,
> +               MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
> +    assert(buf != MAP_FAILED);
> +
> +    *(unsigned short *)&buf[0] = 0x07fe;  /* br %r14 */
> +    *(unsigned int *)&buf[0x100000002] = 0x80000000;
> +    for (i = 0; i < sizeof(opcodes) / sizeof(opcodes[0]); i++) {
> +        *(unsigned short *)&buf[0x100000000] = opcodes[i];
> +        ((void (*)(void))&buf[0x100000000])();
> +    }

Hmmm, can't we write some "nice" inline asm instead?


-- 
Thanks,

David / dhildenb

Re: [PATCH 3/3] tests/tcg/s390x: Test BRASL and BRCL with large negative offsets

[Ilya Leoshkevich]

On Fri, 2022-03-11 at 19:57 +0100, David Hildenbrand wrote:
> On 11.03.22 19:49, Ilya Leoshkevich wrote:
> > Add a small test in order to prevent regressions.
> > 
> > Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
> > ---
> >  tests/tcg/s390x/Makefile.target        |  1 +
> >  tests/tcg/s390x/branch-relative-long.c | 29
> > ++++++++++++++++++++++++++
> >  2 files changed, 30 insertions(+)
> >  create mode 100644 tests/tcg/s390x/branch-relative-long.c
> > 
> > diff --git a/tests/tcg/s390x/Makefile.target
> > b/tests/tcg/s390x/Makefile.target
> > index 257c568c58..fd34b130f7 100644
> > --- a/tests/tcg/s390x/Makefile.target
> > +++ b/tests/tcg/s390x/Makefile.target
> > @@ -15,6 +15,7 @@ TESTS+=mvc
> >  TESTS+=shift
> >  TESTS+=trap
> >  TESTS+=signals-s390x
> > +TESTS+=branch-relative-long
> >  
> >  ifneq ($(HAVE_GDB_BIN),)
> >  GDB_SCRIPT=$(SRC_PATH)/tests/guest-debug/run-test.py
> > diff --git a/tests/tcg/s390x/branch-relative-long.c
> > b/tests/tcg/s390x/branch-relative-long.c
> > new file mode 100644
> > index 0000000000..b9fcee9873
> > --- /dev/null
> > +++ b/tests/tcg/s390x/branch-relative-long.c
> > @@ -0,0 +1,29 @@
> > +#include <assert.h>
> > +#include <stddef.h>
> > +#include <sys/mman.h>
> > +
> > +int main(void)
> > +{
> > +    const unsigned short opcodes[] = {
> > +        0xc005,  /* brasl %r0 */
> > +        0xc0f4,  /* brcl 0xf */
> > +    };
> > +    size_t length = 0x100000006;
> > +    unsigned char *buf;
> > +    int i;
> > +
> > +    buf = mmap(NULL, length, PROT_READ | PROT_WRITE | PROT_EXEC,
> > +               MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
> > +    assert(buf != MAP_FAILED);
> > +
> > +    *(unsigned short *)&buf[0] = 0x07fe;  /* br %r14 */
> > +    *(unsigned int *)&buf[0x100000002] = 0x80000000;
> > +    for (i = 0; i < sizeof(opcodes) / sizeof(opcodes[0]); i++) {
> > +        *(unsigned short *)&buf[0x100000000] = opcodes[i];
> > +        ((void (*)(void))&buf[0x100000000])();
> > +    }
> 
> Hmmm, can't we write some "nice" inline asm instead?
> 
> 

If we do this in a straightforward way, then the resulting binary will
be 4G large.

But maybe there is a way to play games with sections, I'll need to
think about it.

Re: [PATCH 3/3] tests/tcg/s390x: Test BRASL and BRCL with large negative offsets

[Richard Henderson]

On 3/11/22 10:49, Ilya Leoshkevich wrote:
> +    size_t length = 0x100000006;
> +    unsigned char *buf;
> +    int i;
> +
> +    buf = mmap(NULL, length, PROT_READ | PROT_WRITE | PROT_EXEC,
> +               MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
> +    assert(buf != MAP_FAILED);

I'm thinking exit success here, as such a large allocation may well fail depending on the 
host.


r~

Re: [PATCH 3/3] tests/tcg/s390x: Test BRASL and BRCL with large negative offsets

[Christian Borntraeger]

Am 11.03.22 um 21:32 schrieb Richard Henderson:
> On 3/11/22 10:49, Ilya Leoshkevich wrote:
>> +    size_t length = 0x100000006;
>> +    unsigned char *buf;
>> +    int i;
>> +
>> +    buf = mmap(NULL, length, PROT_READ | PROT_WRITE | PROT_EXEC,
>> +               MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
>> +    assert(buf != MAP_FAILED);
> 
> I'm thinking exit success here, as such a large allocation may well fail depending on the host.

What about using MAP_NORESERVE ?

Re: [PATCH 3/3] tests/tcg/s390x: Test BRASL and BRCL with large negative offsets

[David Hildenbrand]

On 14.03.22 09:30, Christian Borntraeger wrote:
> 
> 
> Am 11.03.22 um 21:32 schrieb Richard Henderson:
>> On 3/11/22 10:49, Ilya Leoshkevich wrote:
>>> +    size_t length = 0x100000006;
>>> +    unsigned char *buf;
>>> +    int i;
>>> +
>>> +    buf = mmap(NULL, length, PROT_READ | PROT_WRITE | PROT_EXEC,
>>> +               MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
>>> +    assert(buf != MAP_FAILED);
>>
>> I'm thinking exit success here, as such a large allocation may well fail depending on the host.
> 
> What about using MAP_NORESERVE ?

+1


-- 
Thanks,

David / dhildenb

Re: [PATCH 3/3] tests/tcg/s390x: Test BRASL and BRCL with large negative offsets

[Richard Henderson]

On 3/14/22 01:30, Christian Borntraeger wrote:
> 
> 
> Am 11.03.22 um 21:32 schrieb Richard Henderson:
>> On 3/11/22 10:49, Ilya Leoshkevich wrote:
>>> +    size_t length = 0x100000006;
>>> +    unsigned char *buf;
>>> +    int i;
>>> +
>>> +    buf = mmap(NULL, length, PROT_READ | PROT_WRITE | PROT_EXEC,
>>> +               MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
>>> +    assert(buf != MAP_FAILED);
>>
>> I'm thinking exit success here, as such a large allocation may well fail depending on 
>> the host.
> 
> What about using MAP_NORESERVE ?

That can help, certainly.  But that doesn't affect RLIMIT_AS, or a 32-bit host.

r~