From: Ilya Leoshkevich <iii@linux.ibm.com>
To: Cornelia Huck <cohuck@redhat.com>, Thomas Huth <thuth@redhat.com>,
Richard Henderson <richard.henderson@linaro.org>,
David Hildenbrand <david@redhat.com>,
Paolo Bonzini <pbonzini@redhat.com>,
Peter Maydell <peter.maydell@linaro.org>
Cc: Christian Borntraeger <borntraeger@de.ibm.com>,
qemu-s390x@nongnu.org, qemu-arm@nongnu.org,
qemu-devel@nongnu.org, Ilya Leoshkevich <iii@linux.ibm.com>
Subject: [PATCH v3 1/3] target/s390x: Fix translation exception on illegal instruction
Date: Wed, 14 Apr 2021 15:41:10 +0200 [thread overview]
Message-ID: <20210414134112.25620-2-iii@linux.ibm.com> (raw)
In-Reply-To: <20210414134112.25620-1-iii@linux.ibm.com>
Hitting an uretprobe in a s390x TCG guest causes a SIGSEGV. What
happens is:
* uretprobe maps a userspace page containing an invalid instruction.
* uretprobe replaces the target function's return address with the
address of that page.
* When tb_gen_code() is called on that page, tb->size ends up being 0
(because the page starts with the invalid instruction), which causes
virt_page2 to point to the previous page.
* The previous page is not mapped, so this causes a spurious
translation exception.
tb->size must never be 0: even if there is an illegal instruction, the
instruction bytes that have been looked at must count towards tb->size.
So adjust s390x's translate_one() to act this way for both illegal
instructions and instructions that are known to generate exceptions.
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
---
target/s390x/translate.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
diff --git a/target/s390x/translate.c b/target/s390x/translate.c
index 4f953ddfba..e243624d2a 100644
--- a/target/s390x/translate.c
+++ b/target/s390x/translate.c
@@ -6412,7 +6412,8 @@ static DisasJumpType translate_one(CPUS390XState *env, DisasContext *s)
qemu_log_mask(LOG_UNIMP, "unimplemented opcode 0x%02x%02x\n",
s->fields.op, s->fields.op2);
gen_illegal_opcode(s);
- return DISAS_NORETURN;
+ ret = DISAS_NORETURN;
+ goto out;
}
#ifndef CONFIG_USER_ONLY
@@ -6428,7 +6429,8 @@ static DisasJumpType translate_one(CPUS390XState *env, DisasContext *s)
/* privileged instruction */
if ((s->base.tb->flags & FLAG_MASK_PSTATE) && (insn->flags & IF_PRIV)) {
gen_program_exception(s, PGM_PRIVILEGED);
- return DISAS_NORETURN;
+ ret = DISAS_NORETURN;
+ goto out;
}
/* if AFP is not enabled, instructions and registers are forbidden */
@@ -6455,7 +6457,8 @@ static DisasJumpType translate_one(CPUS390XState *env, DisasContext *s)
}
if (dxc) {
gen_data_exception(dxc);
- return DISAS_NORETURN;
+ ret = DISAS_NORETURN;
+ goto out;
}
}
@@ -6463,7 +6466,8 @@ static DisasJumpType translate_one(CPUS390XState *env, DisasContext *s)
if (insn->flags & IF_VEC) {
if (!((s->base.tb->flags & FLAG_MASK_VECTOR))) {
gen_data_exception(0xfe);
- return DISAS_NORETURN;
+ ret = DISAS_NORETURN;
+ goto out;
}
}
@@ -6484,7 +6488,8 @@ static DisasJumpType translate_one(CPUS390XState *env, DisasContext *s)
(insn->spec & SPEC_r1_f128 && !is_fp_pair(get_field(s, r1))) ||
(insn->spec & SPEC_r2_f128 && !is_fp_pair(get_field(s, r2)))) {
gen_program_exception(s, PGM_SPECIFICATION);
- return DISAS_NORETURN;
+ ret = DISAS_NORETURN;
+ goto out;
}
}
@@ -6544,6 +6549,7 @@ static DisasJumpType translate_one(CPUS390XState *env, DisasContext *s)
}
#endif
+out:
/* Advance to the next instruction. */
s->base.pc_next = s->pc_tmp;
return ret;
--
2.29.2
next prev parent reply other threads:[~2021-04-14 13:46 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-04-14 13:41 [PATCH v3 0/3] accel/tcg: Make sure that tb->size != 0 after translation Ilya Leoshkevich
2021-04-14 13:41 ` Ilya Leoshkevich [this message]
2021-04-14 14:47 ` [PATCH v3 1/3] target/s390x: Fix translation exception on illegal instruction David Hildenbrand
2021-04-14 13:41 ` [PATCH v3 2/3] target/arm: Make sure that commpage's tb->size != 0 Ilya Leoshkevich
2021-04-14 13:41 ` [PATCH v3 3/3] accel/tcg: Assert that tb->size != 0 after translation Ilya Leoshkevich
2021-04-14 14:48 ` David Hildenbrand
2021-04-14 16:45 ` Ilya Leoshkevich
2021-04-14 18:03 ` Max Filippov
2021-04-14 19:43 ` Richard Henderson
2021-04-15 1:23 ` Max Filippov
2021-04-15 11:14 ` Ilya Leoshkevich
2021-04-15 14:33 ` Richard Henderson
2021-04-15 15:02 ` Peter Maydell
2021-04-15 20:20 ` Max Filippov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210414134112.25620-2-iii@linux.ibm.com \
--to=iii@linux.ibm.com \
--cc=borntraeger@de.ibm.com \
--cc=cohuck@redhat.com \
--cc=david@redhat.com \
--cc=pbonzini@redhat.com \
--cc=peter.maydell@linaro.org \
--cc=qemu-arm@nongnu.org \
--cc=qemu-devel@nongnu.org \
--cc=qemu-s390x@nongnu.org \
--cc=richard.henderson@linaro.org \
--cc=thuth@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.