Merge ~paelzer/ubuntu/+source/qemu:lp-1749393-emu-sbrk-space-FOCAL into ubuntu/+source/qemu:ubuntu/focal-devel

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

PPA: https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/4535

[Christian Ehrhardt  (paelzer)]

FYI: This is based on the current latest focal-proposed wich isn't imported yet.
The change/review is only for the last changelog stanza.

In a few hours this will resolve and the diff should also be correct here.

[Christian Ehrhardt  (paelzer)]

Rebased and refreshed, working the same still.

New build of qemu_4.2-3ubuntu6.19~focalppa3_source.changes started in the PPA.
The tests all completed before and in a VM that I used to debug bug 1928075.

[Christian Ehrhardt  (paelzer)]

PPA https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/4535
has a new build that also includes bug 1929926 which we wanted to piggy-back on another bug.

[Paride Legovini (paride)]

LGTM, both the upstream cherry-pick and the upstream backport look fully correct, with nice and complete DEP3 headers. The other debian/* changes are all good.

The PPA builds look fine. There are no autopkgtests but you reported the fixed package passes the KVM regression tests, which are even more meaningful.

Approve, but see my comment here:

https://bugs.launchpad.net/ubuntu/+source/qemu/+bug/1929926

review: Approve

[Christian Ehrhardt  (paelzer)]

Uploaded to -unapproved

diff --git a/debian/changelog b/debian/changelog
index 20c9285..34da269 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,12 @@
+qemu (1:4.2-3ubuntu6.19) focal; urgency=medium
+
+  * d/p/u/lp-1749393-linux-user-Reserve-space-for-brk.patch: fix static
+    use cases needing a lot of brk space (LP: #1749393)
+  * d/p/u/lp-1929926-target-s390x-Fix-translation-exception-on-illegal-in.patch:
+    fix uretprobe in s390x TCG (LP: #1929926)
+
+ -- Christian Ehrhardt <[e-mail]>  Mon, 26 Apr 2021 11:11:19 +0200
+
 qemu (1:4.2-3ubuntu6.18) focal; urgency=medium
 
   * enhance loading of old modules post upgrade (LP: #1913421)
diff --git a/debian/patches/series b/debian/patches/series
index 745af86..43a47e7 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -307,3 +307,5 @@ CVE-2021-3607.patch
 CVE-2021-3608.patch
 CVE-2021-20221.patch
 CVE-2021-20257.patch
+ubuntu/lp-1749393-linux-user-Reserve-space-for-brk.patch
+ubuntu/lp-1929926-target-s390x-Fix-translation-exception-on-illegal-in.patch
diff --git a/debian/patches/ubuntu/lp-1749393-linux-user-Reserve-space-for-brk.patch b/debian/patches/ubuntu/lp-1749393-linux-user-Reserve-space-for-brk.patch
 new file mode 100644
index 0000000..71a89aa
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1749393-linux-user-Reserve-space-for-brk.patch
@@ -0,0 +1,158 @@
+From 6fd5944980f4ccee728ce34bdaffc117db50b34d Mon Sep 17 00:00:00 2001
+From: Richard Henderson <[e-mail]>
+Date: Fri, 17 Jan 2020 13:02:45 -1000
+Subject: [PATCH] linux-user: Reserve space for brk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+With bad luck, we can wind up with no space at all for brk,
+which will generally cause the guest malloc to fail.
+
+This bad luck is easier to come by with ET_DYN (PIE) binaries,
+where either the stack or the interpreter (ld.so) gets placed
+immediately after the main executable.
+
+But there's nothing preventing this same thing from happening
+with ET_EXEC (normal) binaries, during probe_guest_base().
+
+In both cases, reserve some extra space via mmap and release
+it back to the system after loading the interpreter and
+allocating the stack.
+
+The choice of 16MB is somewhat arbitrary.  It's enough for libc
+to get going, but without being so large that 32-bit guests or
+32-bit hosts are in danger of running out of virtual address space.
+It is expected that libc will be able to fall back to mmap arenas
+after the limited brk space is exhausted.
+
+Launchpad: https://bugs.launchpad.net/qemu/+bug/1749393
+Signed-off-by: Richard Henderson <[e-mail]>
+Reviewed-by: Alex Bennée <[e-mail]>
+Tested-by: Alex Bennée <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Laurent Vivier <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=6fd5944980f4ccee728ce34bdaffc117db50b34d
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1749393
+Last-Update: 2021-04-26
+
+---
+ linux-user/elfload.c | 73 +++++++++++++++++++++++++++++++++-----------
+ linux-user/qemu.h    |  1 +
+ 2 files changed, 57 insertions(+), 17 deletions(-)
+
+diff --git a/linux-user/elfload.c b/linux-user/elfload.c
+index 511e450078..f3080a1635 100644
+--- a/linux-user/elfload.c
++++ b/linux-user/elfload.c
+@@ -10,6 +10,7 @@
+ #include "qemu/path.h"
+ #include "qemu/queue.h"
+ #include "qemu/guest-random.h"
++#include "qemu/units.h"
+ 
+ #ifdef _ARCH_PPC64
+ #undef ARCH_DLINFO
+@@ -2364,24 +2365,51 @@ static void load_elf_image(const char *image_name, int image_fd,
+         }
+     }
+ 
+-    load_addr = loaddr;
+-    if (ehdr->e_type == ET_DYN) {
+-        /* The image indicates that it can be loaded anywhere.  Find a
+-           location that can hold the memory space required.  If the
+-           image is pre-linked, LOADDR will be non-zero.  Since we do
+-           not supply MAP_FIXED here we'll use that address if and
+-           only if it remains available.  */
+-        load_addr = target_mmap(loaddr, hiaddr - loaddr, PROT_NONE,
+-                                MAP_PRIVATE | MAP_ANON | MAP_NORESERVE,
+-                                -1, 0);
+-        if (load_addr == -1) {
+-            goto exit_perror;
++    if (pinterp_name != NULL) {
++        /*
++         * This is the main executable.
++         *
++         * Reserve extra space for brk.
++         * We hold on to this space while placing the interpreter
++         * and the stack, lest they be placed immediately after
++         * the data segment and block allocation from the brk.
++         *
++         * 16MB is chosen as "large enough" without being so large
++         * as to allow the result to not fit with a 32-bit guest on
++         * a 32-bit host.
++         */
++        info->reserve_brk = 16 * MiB;
++        hiaddr += info->reserve_brk;
++
++        if (ehdr->e_type == ET_EXEC) {
++            /*
++             * Make sure that the low address does not conflict with
++             * MMAP_MIN_ADDR or the QEMU application itself.
++             */
++            probe_guest_base(image_name, loaddr, hiaddr);
+         }
+-    } else if (pinterp_name != NULL) {
+-        /* This is the main executable.  Make sure that the low
+-           address does not conflict with MMAP_MIN_ADDR or the
+-           QEMU application itself.  */
+-        probe_guest_base(image_name, loaddr, hiaddr);
++    }
++
++    /*
++     * Reserve address space for all of this.
++     *
++     * In the case of ET_EXEC, we supply MAP_FIXED so that we get
++     * exactly the address range that is required.
++     *
++     * Otherwise this is ET_DYN, and we are searching for a location
++     * that can hold the memory space required.  If the image is
++     * pre-linked, LOADDR will be non-zero, and the kernel should
++     * honor that address if it happens to be free.
++     *
++     * In both cases, we will overwrite pages in this range with mappings
++     * from the executable.
++     */
++    load_addr = target_mmap(loaddr, hiaddr - loaddr, PROT_NONE,
++                            MAP_PRIVATE | MAP_ANON | MAP_NORESERVE |
++                            (ehdr->e_type == ET_EXEC ? MAP_FIXED : 0),
++                            -1, 0);
++    if (load_addr == -1) {
++        goto exit_perror;
+     }
+     load_bias = load_addr - loaddr;
+ 
+@@ -2860,6 +2888,17 @@ int load_elf_binary(struct linux_binprm *bprm, struct image_info *info)
+     bprm->core_dump = &elf_core_dump;
+ #endif
+ 
++    /*
++     * If we reserved extra space for brk, release it now.
++     * The implementation of do_brk in syscalls.c expects to be able
++     * to mmap pages in this space.
++     */
++    if (info->reserve_brk) {
++        abi_ulong start_brk = HOST_PAGE_ALIGN(info->brk);
++        abi_ulong end_brk = HOST_PAGE_ALIGN(info->brk + info->reserve_brk);
++        target_munmap(start_brk, end_brk - start_brk);
++    }
++
+     return 0;
+ }
+ 
+diff --git a/linux-user/qemu.h b/linux-user/qemu.h
+index f6f5fe5fbb..560a68090e 100644
+--- a/linux-user/qemu.h
++++ b/linux-user/qemu.h
+@@ -35,6 +35,7 @@ struct image_info {
+         abi_ulong       end_data;
+         abi_ulong       start_brk;
+         abi_ulong       brk;
++        abi_ulong       reserve_brk;
+         abi_ulong       start_mmap;
+         abi_ulong       start_stack;
+         abi_ulong       stack_limit;
+-- 
+2.31.1
+
diff --git a/debian/patches/ubuntu/lp-1929926-target-s390x-Fix-translation-exception-on-illegal-in.patch b/debian/patches/ubuntu/lp-1929926-target-s390x-Fix-translation-exception-on-illegal-in.patch
 new file mode 100644
index 0000000..a151900
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1929926-target-s390x-Fix-translation-exception-on-illegal-in.patch
@@ -0,0 +1,96 @@
+From 86131c71b13257e095d8c4f4453d52cbc6553c07 Mon Sep 17 00:00:00 2001
+From: Ilya Leoshkevich <[e-mail]>
+Date: Fri, 16 Apr 2021 17:49:36 +0200
+Subject: [PATCH] target/s390x: Fix translation exception on illegal
+ instruction
+
+Hitting an uretprobe in a s390x TCG guest causes a SIGSEGV. What
+happens is:
+
+* uretprobe maps a userspace page containing an invalid instruction.
+* uretprobe replaces the target function's return address with the
+  address of that page.
+* When tb_gen_code() is called on that page, tb->size ends up being 0
+  (because the page starts with the invalid instruction), which causes
+  virt_page2 to point to the previous page.
+* The previous page is not mapped, so this causes a spurious
+  translation exception.
+
+tb->size must never be 0: even if there is an illegal instruction, the
+instruction bytes that have been looked at must count towards tb->size.
+So adjust s390x's translate_one() to act this way for both illegal
+instructions and instructions that are known to generate exceptions.
+
+Signed-off-by: Ilya Leoshkevich <[e-mail]>
+Reviewed-by: David Hildenbrand <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Cornelia Huck <[e-mail]>
+
+Origin: backport, https://git.qemu.org/?p=qemu.git;a=commit;h=86131c71b13257e095d8c4f4453d52cbc6553c07
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1929926
+Last-Update: 2021-10-12
+
+---
+ target/s390x/translate.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+--- a/target/s390x/translate.c
++++ b/target/s390x/translate.c
+@@ -6317,7 +6317,8 @@ static DisasJumpType translate_one(CPUS3
+         qemu_log_mask(LOG_UNIMP, "unimplemented opcode 0x%02x%02x\n",
+                       f.op, f.op2);
+         gen_illegal_opcode(s);
+-        return DISAS_NORETURN;
++        ret = DISAS_NORETURN;
++        goto out;
+     }
+ 
+ #ifndef CONFIG_USER_ONLY
+@@ -6333,7 +6334,8 @@ static DisasJumpType translate_one(CPUS3
+         /* privileged instruction */
+         if ((s->base.tb->flags & FLAG_MASK_PSTATE) && (insn->flags & IF_PRIV)) {
+             gen_program_exception(s, PGM_PRIVILEGED);
+-            return DISAS_NORETURN;
++            ret = DISAS_NORETURN;
++            goto out;
+         }
+ 
+         /* if AFP is not enabled, instructions and registers are forbidden */
+@@ -6360,7 +6362,8 @@ static DisasJumpType translate_one(CPUS3
+             }
+             if (dxc) {
+                 gen_data_exception(dxc);
+-                return DISAS_NORETURN;
++                ret = DISAS_NORETURN;
++                goto out;
+             }
+         }
+ 
+@@ -6368,7 +6371,8 @@ static DisasJumpType translate_one(CPUS3
+         if (insn->flags & IF_VEC) {
+             if (!((s->base.tb->flags & FLAG_MASK_VECTOR))) {
+                 gen_data_exception(0xfe);
+-                return DISAS_NORETURN;
++                ret = DISAS_NORETURN;
++                goto out;
+             }
+         }
+     }
+@@ -6381,7 +6385,8 @@ static DisasJumpType translate_one(CPUS3
+             (insn->spec & SPEC_r1_f128 && !is_fp_pair(get_field(&f, r1))) ||
+             (insn->spec & SPEC_r2_f128 && !is_fp_pair(get_field(&f, r2)))) {
+             gen_program_exception(s, PGM_SPECIFICATION);
+-            return DISAS_NORETURN;
++            ret = DISAS_NORETURN;
++            goto out;
+         }
+     }
+ 
+@@ -6440,6 +6445,7 @@ static DisasJumpType translate_one(CPUS3
+     }
+ #endif
+ 
++out:
+     /* Advance to the next instruction.  */
+     s->base.pc_next = s->pc_tmp;
+     return ret;