Merge ~paelzer/ubuntu/+source/qemu:lp-1929926-uretprobe-s390x-tcg-FOCAL into ubuntu/+source/qemu:ubuntu/focal-devel

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

PPA: https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/4682

[Sergio Durigan Junior (sergiodj)]

Thanks for the MP, Christian.

It LGTM. The backport is OK, the fix looks correct, and the debian/-specific bits are also good.

I noticed that the package is still building on the PPA, so there are no autopkgtest results yet. I'm approving this MP conditionally on the autopkgtest tests passing :-).

Thanks.

review: Approve

[Christian Ehrhardt  (paelzer)]

This is now covered by https://code.launchpad.net/~paelzer/ubuntu/+source/qemu/+git/qemu/+merge/401771 which will have this as well.

[Christian Ehrhardt  (paelzer)]

Merged

diff --git a/debian/changelog b/debian/changelog
index 20c9285..94ff656 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+qemu (1:4.2-3ubuntu6.19) focal; urgency=medium
+
+  * d/p/u/lp-1929926-target-s390x-Fix-translation-exception-on-illegal-in.patch:
+    fix uretprobe in s390x TCG (LP: #1929926)
+
+ -- Christian Ehrhardt <[e-mail]>  Tue, 12 Oct 2021 09:02:03 +0200
+
 qemu (1:4.2-3ubuntu6.18) focal; urgency=medium
 
   * enhance loading of old modules post upgrade (LP: #1913421)
diff --git a/debian/patches/series b/debian/patches/series
index 745af86..9eb6858 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -307,3 +307,4 @@ CVE-2021-3607.patch
 CVE-2021-3608.patch
 CVE-2021-20221.patch
 CVE-2021-20257.patch
+ubuntu/lp-1929926-target-s390x-Fix-translation-exception-on-illegal-in.patch
diff --git a/debian/patches/ubuntu/lp-1929926-target-s390x-Fix-translation-exception-on-illegal-in.patch b/debian/patches/ubuntu/lp-1929926-target-s390x-Fix-translation-exception-on-illegal-in.patch
new file mode 100644
index 0000000..a151900
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1929926-target-s390x-Fix-translation-exception-on-illegal-in.patch
@@ -0,0 +1,96 @@
+From 86131c71b13257e095d8c4f4453d52cbc6553c07 Mon Sep 17 00:00:00 2001
+From: Ilya Leoshkevich <[e-mail]>
+Date: Fri, 16 Apr 2021 17:49:36 +0200
+Subject: [PATCH] target/s390x: Fix translation exception on illegal
+ instruction
+
+Hitting an uretprobe in a s390x TCG guest causes a SIGSEGV. What
+happens is:
+
+* uretprobe maps a userspace page containing an invalid instruction.
+* uretprobe replaces the target function's return address with the
+  address of that page.
+* When tb_gen_code() is called on that page, tb->size ends up being 0
+  (because the page starts with the invalid instruction), which causes
+  virt_page2 to point to the previous page.
+* The previous page is not mapped, so this causes a spurious
+  translation exception.
+
+tb->size must never be 0: even if there is an illegal instruction, the
+instruction bytes that have been looked at must count towards tb->size.
+So adjust s390x's translate_one() to act this way for both illegal
+instructions and instructions that are known to generate exceptions.
+
+Signed-off-by: Ilya Leoshkevich <[e-mail]>
+Reviewed-by: David Hildenbrand <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Cornelia Huck <[e-mail]>
+
+Origin: backport, https://git.qemu.org/?p=qemu.git;a=commit;h=86131c71b13257e095d8c4f4453d52cbc6553c07
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1929926
+Last-Update: 2021-10-12
+
+---
+ target/s390x/translate.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+--- a/target/s390x/translate.c
++++ b/target/s390x/translate.c
+@@ -6317,7 +6317,8 @@ static DisasJumpType translate_one(CPUS3
+         qemu_log_mask(LOG_UNIMP, "unimplemented opcode 0x%02x%02x\n",
+                       f.op, f.op2);
+         gen_illegal_opcode(s);
+-        return DISAS_NORETURN;
++        ret = DISAS_NORETURN;
++        goto out;
+     }
+ 
+ #ifndef CONFIG_USER_ONLY
+@@ -6333,7 +6334,8 @@ static DisasJumpType translate_one(CPUS3
+         /* privileged instruction */
+         if ((s->base.tb->flags & FLAG_MASK_PSTATE) && (insn->flags & IF_PRIV)) {
+             gen_program_exception(s, PGM_PRIVILEGED);
+-            return DISAS_NORETURN;
++            ret = DISAS_NORETURN;
++            goto out;
+         }
+ 
+         /* if AFP is not enabled, instructions and registers are forbidden */
+@@ -6360,7 +6362,8 @@ static DisasJumpType translate_one(CPUS3
+             }
+             if (dxc) {
+                 gen_data_exception(dxc);
+-                return DISAS_NORETURN;
++                ret = DISAS_NORETURN;
++                goto out;
+             }
+         }
+ 
+@@ -6368,7 +6371,8 @@ static DisasJumpType translate_one(CPUS3
+         if (insn->flags & IF_VEC) {
+             if (!((s->base.tb->flags & FLAG_MASK_VECTOR))) {
+                 gen_data_exception(0xfe);
+-                return DISAS_NORETURN;
++                ret = DISAS_NORETURN;
++                goto out;
+             }
+         }
+     }
+@@ -6381,7 +6385,8 @@ static DisasJumpType translate_one(CPUS3
+             (insn->spec & SPEC_r1_f128 && !is_fp_pair(get_field(&f, r1))) ||
+             (insn->spec & SPEC_r2_f128 && !is_fp_pair(get_field(&f, r2)))) {
+             gen_program_exception(s, PGM_SPECIFICATION);
+-            return DISAS_NORETURN;
++            ret = DISAS_NORETURN;
++            goto out;
+         }
+     }
+ 
+@@ -6440,6 +6445,7 @@ static DisasJumpType translate_one(CPUS3
+     }
+ #endif
+ 
++out:
+     /* Advance to the next instruction.  */
+     s->base.pc_next = s->pc_tmp;
+     return ret;