From: Ilya Leoshkevich <iii@linux.ibm.com>
To: Cornelia Huck <cohuck@redhat.com>
Cc: Peter Maydell <peter.maydell@linaro.org>,
Thomas Huth <thuth@redhat.com>,
David Hildenbrand <david@redhat.com>,
Richard Henderson <richard.henderson@linaro.org>,
qemu-devel@nongnu.org,
Christian Borntraeger <borntraeger@de.ibm.com>,
qemu-s390x@nongnu.org, Paolo Bonzini <pbonzini@redhat.com>
Subject: Re: [PATCH v2] target/s390x: Fix translation exception on illegal instruction
Date: Wed, 14 Apr 2021 12:27:03 +0200 [thread overview]
Message-ID: <710e154736b7e118ae12587a468a8c198cab028c.camel@linux.ibm.com> (raw)
In-Reply-To: <9ffa39db0e16efa173119d3b9746bb312e214d87.camel@linux.ibm.com>
On Wed, 2021-04-14 at 11:19 +0200, Ilya Leoshkevich wrote:
> On Wed, 2021-04-14 at 10:38 +0200, Cornelia Huck wrote:
> > On Tue, 13 Apr 2021 18:52:57 +0200
> > Ilya Leoshkevich <iii@linux.ibm.com> wrote:
> >
> > > Hitting an uretprobe in a s390x TCG guest causes a SIGSEGV. What
> > > happens is:
> > >
> > > * uretprobe maps a userspace page containing an invalid
> > > instruction.
> > > * uretprobe replaces the target function's return address with the
> > > address of that page.
> > > * When tb_gen_code() is called on that page, tb->size ends up being
> > > 0
> > > (because the page starts with the invalid instruction), which
> > > causes
> > > virt_page2 to point to the previous page.
> > > * The previous page is not mapped, so this causes a spurious
> > > translation exception.
> > >
> > > The bug is that tb->size must never be 0: even if there is an
> > > illegal
> > > instruction, the instruction bytes that have been looked at must
> > > count
> > > towards tb->size. So adjust s390x's translate_one() to act this way
> > > for both illegal instructions and instructions that are known to
> > > generate exceptions.
> > >
> > > Also add an assertion to tb_gen_code() in order to detect such
> > > situations in future.
> > >
> > > Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
> > > ---
> > >
> > > v1:
> > > https://lists.nongnu.org/archive/html/qemu-devel/2021-04/msg02037.html
> > > v1 -> v2: Fix target/s390x instead of trying to tolerate tb->size
> > > == 0
> > > in tb_gen_code().
> > >
> > > accel/tcg/translate-all.c | 1 +
> > > target/s390x/translate.c | 16 +++++++++++-----
> > > 2 files changed, 12 insertions(+), 5 deletions(-)
> >
> > I assume this bug is not usually hit during normal usage, right? It's
> > probably not release critical, so I'll line it up for 6.1 instead.
>
> Yes, I saw it only with uprobes, and then it leads only to a process
> crash, not to a kernel crash. Thanks!
Seems like the new assertion triggers on ARM:
https://gitlab.com/cohuck/qemu/-/jobs/1178409450
What are the rules in s390x-next-staging, can we amend the patch, or
only commit a follow-up? In either case, I think we'll need something
like this (untested):
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -9060,6 +9060,7 @@ static void
arm_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
unsigned int insn;
if (arm_pre_translate_insn(dc)) {
+ dc->base.pc_next += 4;
return;
}
I'm currently trying to debug this in more detail and test the fix.
next prev parent reply other threads:[~2021-04-14 10:28 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-04-13 16:52 [PATCH v2] target/s390x: Fix translation exception on illegal instruction Ilya Leoshkevich
2021-04-14 0:34 ` Richard Henderson
2021-04-14 7:34 ` David Hildenbrand
2021-04-14 8:38 ` Cornelia Huck
2021-04-14 9:19 ` Ilya Leoshkevich
2021-04-14 10:27 ` Ilya Leoshkevich [this message]
2021-04-14 10:39 ` Cornelia Huck
2021-04-14 10:48 ` Cornelia Huck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=710e154736b7e118ae12587a468a8c198cab028c.camel@linux.ibm.com \
--to=iii@linux.ibm.com \
--cc=borntraeger@de.ibm.com \
--cc=cohuck@redhat.com \
--cc=david@redhat.com \
--cc=pbonzini@redhat.com \
--cc=peter.maydell@linaro.org \
--cc=qemu-devel@nongnu.org \
--cc=qemu-s390x@nongnu.org \
--cc=richard.henderson@linaro.org \
--cc=thuth@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).