Re: [PATCH v2] target/s390x: Fix translation exception on illegal instruction

[Cornelia Huck]

On Tue, 13 Apr 2021 18:52:57 +0200
Ilya Leoshkevich <iii@linux.ibm.com> wrote:

> Hitting an uretprobe in a s390x TCG guest causes a SIGSEGV. What
> happens is:
> 
> * uretprobe maps a userspace page containing an invalid instruction.
> * uretprobe replaces the target function's return address with the
>   address of that page.
> * When tb_gen_code() is called on that page, tb->size ends up being 0
>   (because the page starts with the invalid instruction), which causes
>   virt_page2 to point to the previous page.
> * The previous page is not mapped, so this causes a spurious
>   translation exception.
> 
> The bug is that tb->size must never be 0: even if there is an illegal
> instruction, the instruction bytes that have been looked at must count
> towards tb->size. So adjust s390x's translate_one() to act this way
> for both illegal instructions and instructions that are known to
> generate exceptions.
> 
> Also add an assertion to tb_gen_code() in order to detect such
> situations in future.
> 
> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
> ---
> 
> v1: https://lists.nongnu.org/archive/html/qemu-devel/2021-04/msg02037.html
> v1 -> v2: Fix target/s390x instead of trying to tolerate tb->size == 0
>           in tb_gen_code().
> 
>  accel/tcg/translate-all.c |  1 +
>  target/s390x/translate.c  | 16 +++++++++++-----
>  2 files changed, 12 insertions(+), 5 deletions(-)

I assume this bug is not usually hit during normal usage, right? It's
probably not release critical, so I'll line it up for 6.1 instead.