Merge ~paelzer/ubuntu/+source/qemu:lp-1929926-uretprobe-s390x-tcg-HIRSUTE into ubuntu/+source/qemu:ubuntu/hirsute-devel

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

PPA: https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/4682

[Sergio Durigan Junior (sergiodj)]

Thanks for the MP, Christian.

It LGTM. The backport is OK, the fix looks correct, and the debian/-specific bits are also good.

The package has successfully built on the PPA, there are no autopkgtest results available yet. I am approving this MP conditionally on the autopkgtest tests passing.

Thanks.

review: Approve

[Christian Ehrhardt  (paelzer)]

Uploaded to -unapproved

diff --git a/debian/changelog b/debian/changelog
index f7983b9..ec5c1f7 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+qemu (1:5.2+dfsg-9ubuntu3.3) hirsute; urgency=medium
+
+  * d/p/u/lp-1929926-target-s390x-Fix-translation-exception-on-illegal-in.patch:
+    fix uretprobe in s390x TCG (LP: #1929926)
+
+ -- Christian Ehrhardt <[e-mail]>  Tue, 12 Oct 2021 09:04:44 +0200
+
 qemu (1:5.2+dfsg-9ubuntu3.2) hirsute; urgency=medium
 
   * d/rules fix microvm default machine type for a new build system
diff --git a/debian/patches/series b/debian/patches/series
index 30500b2..525e25c 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -74,3 +74,4 @@ CVE-2021-3544-8.patch
 CVE-2021-3582.patch
 CVE-2021-3607.patch
 CVE-2021-3608.patch
+ubuntu/lp-1929926-target-s390x-Fix-translation-exception-on-illegal-in.patch
diff --git a/debian/patches/ubuntu/lp-1929926-target-s390x-Fix-translation-exception-on-illegal-in.patch b/debian/patches/ubuntu/lp-1929926-target-s390x-Fix-translation-exception-on-illegal-in.patch
new file mode 100644
index 0000000..07027af
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1929926-target-s390x-Fix-translation-exception-on-illegal-in.patch
@@ -0,0 +1,101 @@
+From 86131c71b13257e095d8c4f4453d52cbc6553c07 Mon Sep 17 00:00:00 2001
+From: Ilya Leoshkevich <[e-mail]>
+Date: Fri, 16 Apr 2021 17:49:36 +0200
+Subject: [PATCH] target/s390x: Fix translation exception on illegal
+ instruction
+
+Hitting an uretprobe in a s390x TCG guest causes a SIGSEGV. What
+happens is:
+
+* uretprobe maps a userspace page containing an invalid instruction.
+* uretprobe replaces the target function's return address with the
+  address of that page.
+* When tb_gen_code() is called on that page, tb->size ends up being 0
+  (because the page starts with the invalid instruction), which causes
+  virt_page2 to point to the previous page.
+* The previous page is not mapped, so this causes a spurious
+  translation exception.
+
+tb->size must never be 0: even if there is an illegal instruction, the
+instruction bytes that have been looked at must count towards tb->size.
+So adjust s390x's translate_one() to act this way for both illegal
+instructions and instructions that are known to generate exceptions.
+
+Signed-off-by: Ilya Leoshkevich <[e-mail]>
+Reviewed-by: David Hildenbrand <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Cornelia Huck <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=86131c71b13257e095d8c4f4453d52cbc6553c07
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1929926
+Last-Update: 2021-10-12
+
+---
+ target/s390x/translate.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/target/s390x/translate.c b/target/s390x/translate.c
+index 4f953ddfba..e243624d2a 100644
+--- a/target/s390x/translate.c
++++ b/target/s390x/translate.c
+@@ -6412,7 +6412,8 @@ static DisasJumpType translate_one(CPUS390XState *env, DisasContext *s)
+         qemu_log_mask(LOG_UNIMP, "unimplemented opcode 0x%02x%02x\n",
+                       s->fields.op, s->fields.op2);
+         gen_illegal_opcode(s);
+-        return DISAS_NORETURN;
++        ret = DISAS_NORETURN;
++        goto out;
+     }
+ 
+ #ifndef CONFIG_USER_ONLY
+@@ -6428,7 +6429,8 @@ static DisasJumpType translate_one(CPUS390XState *env, DisasContext *s)
+         /* privileged instruction */
+         if ((s->base.tb->flags & FLAG_MASK_PSTATE) && (insn->flags & IF_PRIV)) {
+             gen_program_exception(s, PGM_PRIVILEGED);
+-            return DISAS_NORETURN;
++            ret = DISAS_NORETURN;
++            goto out;
+         }
+ 
+         /* if AFP is not enabled, instructions and registers are forbidden */
+@@ -6455,7 +6457,8 @@ static DisasJumpType translate_one(CPUS390XState *env, DisasContext *s)
+             }
+             if (dxc) {
+                 gen_data_exception(dxc);
+-                return DISAS_NORETURN;
++                ret = DISAS_NORETURN;
++                goto out;
+             }
+         }
+ 
+@@ -6463,7 +6466,8 @@ static DisasJumpType translate_one(CPUS390XState *env, DisasContext *s)
+         if (insn->flags & IF_VEC) {
+             if (!((s->base.tb->flags & FLAG_MASK_VECTOR))) {
+                 gen_data_exception(0xfe);
+-                return DISAS_NORETURN;
++                ret = DISAS_NORETURN;
++                goto out;
+             }
+         }
+ 
+@@ -6484,7 +6488,8 @@ static DisasJumpType translate_one(CPUS390XState *env, DisasContext *s)
+             (insn->spec & SPEC_r1_f128 && !is_fp_pair(get_field(s, r1))) ||
+             (insn->spec & SPEC_r2_f128 && !is_fp_pair(get_field(s, r2)))) {
+             gen_program_exception(s, PGM_SPECIFICATION);
+-            return DISAS_NORETURN;
++            ret = DISAS_NORETURN;
++            goto out;
+         }
+     }
+ 
+@@ -6544,6 +6549,7 @@ static DisasJumpType translate_one(CPUS390XState *env, DisasContext *s)
+     }
+ #endif
+ 
++out:
+     /* Advance to the next instruction.  */
+     s->base.pc_next = s->pc_tmp;
+     return ret;
+-- 
+2.33.0
+