Merge ~sergiodj/ubuntu/+source/qemu:tcg-crash-mantic into ubuntu/+source/qemu:ubuntu/mantic-devel

[Sergio Durigan Junior]

This MP fixes QEMU bug #2051965 on Mantic.

This is a tricky bug; you can take a look at the Test Plan to see how to reproduce it. There will be SRUs for Jammy and Mantic; the former will be more complex to review, and the latter will be more straightforward (although not without its complexities). As of this writing, the Jammy SRU is not ready yet because I'm still working on backporting the needed patches.

I'm particularly interested in a double check of the 3 patches being backported to fix the bug. Let me know if you spot any problems or missing patches, please.

PPA: https://launchpad.net/~sergiodj/+archive/ubuntu/qemu-bug2051965/+packages

dep8 results will be posted soon.

[Christian Ehrhardt  (paelzer)]

Some trivial findings first:

- patches are in debian/patches/ubuntu/ but the CL says - d/p/lp... should be - d/p/u/lp...
- some places mention kernel "6.13" while it is "6.3"
- avoid some ambiguities by stating clearly that the kernel >=6.3 is in meant to be the one in the guest, otherwise some might think "so what, 6.3 isn't supported in jammy/mantic anyway" or similar

On the patches:
- lp-2051965-accel-tcg-Split-out-cpu_exec_longjmp_cleanup.patch
  That seems fine, it just moves identical code to a shared function
  The assert should not matter, and on the actual binary this most likely is inlined and thereby as before
- lp-2051965-accel-tcg-Always-lock-pages-before-translation.patch
  Wow, this is more busy.
  Conceptually it is ok - at high abstraction more locking is slower but safer.
  It didn't help that the diff was hard to read by so muhc movement
  But eventually the new code is easier to read with just one kind of locking instead of 4
  I spent some time in a rabbit hole reading this, but it is either ok or too complex for me
  to see the issue
- lp-2051965-accel-tcg-Clear-tcg_ctx-gen_tb-on-buffer-overflow.patch
  That one is easy again, clearing a condition introduced by the former
- I found no other fixups than the one you already spotted

I can see why you said Jammy backport might be more complex, there are probably plenty of changes to that code. My gut says that you'd be ok to backport quite some more changes (instead of only adapting those three patches) if you need it, but that is up to you as you see fit.

+1 on this one with the minor things fixed.

For the "where issues occur" in the SRU statement, the most important bit is that this seems purely in tcg code, so we can assume that HW-virt will not be affected ever.

review: Approve

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: sergiodj, paelzer
Uploaders: sergiodj, paelzer
MP auto-approved

review: Approve

[Sergio Durigan Junior (sergiodj)]

On Wednesday, February 14 2024, Christian Ehrhardt  wrote:

> Review: Approve

Thanks for the review, Christian.

> Some trivial findings first:
>
> - patches are in debian/patches/ubuntu/ but the CL says - d/p/lp... should be - d/p/u/lp...

Ah, indeed. Thanks, I'll fix it.

> - some places mention kernel "6.13" while it is "6.3"

Doh. Fixed.

> - avoid some ambiguities by stating clearly that the kernel >=6.3 is in meant to be the one in the guest, otherwise some might think "so what, 6.3 isn't supported in jammy/mantic anyway" or similar

Done.

> I can see why you said Jammy backport might be more complex, there are
> probably plenty of changes to that code. My gut says that you'd be ok
> to backport quite some more changes (instead of only adapting those
> three patches) if you need it, but that is up to you as you see fit.

Yeah, I've been collecting the "adjacent" patches that will need to be
backported on Jammy. I think it should be fine at the end of the day.

> +1 on this one with the minor things fixed.

Thanks. I'll wait until I have the Jammy MP ready before I upload this
one.

> For the "where issues occur" in the SRU statement, the most important bit is that this seems purely in tcg code, so we can assume that HW-virt will not be affected ever.

ACK. I'm putting off writing the rest of the SRU template until I have
a clear picture of what the Jammy MP will be.

Cheers,

--
Sergio
GPG key ID: E92F D0B3 6B14 F1F4 D8E0 EB2F 106D A1C8 C3CB BF14

[Sergio Durigan Junior (sergiodj)]

On Wednesday, February 14 2024, Sergio Durigan Junior wrote:

>> For the "where issues occur" in the SRU statement, the most important bit is that this seems purely in tcg code, so we can assume that HW-virt will not be affected ever.
>
> ACK. I'm putting off writing the rest of the SRU template until I have
> a clear picture of what the Jammy MP will be.

The Jammy fix will take a bit longer, so I'm going ahead and uploading
this one. The reporter is being affected by the Mantic bug, so
hopefully this will unblock him while I figure out the Jammy fix.

Uploaded:

$ dput qemu_8.0.4+dfsg-1ubuntu3.23.10.3_source.changes
Trying to upload package to ubuntu
Checking signature on .changes
gpg: /home/sergio/work/qemu/qemu_8.0.4+dfsg-1ubuntu3.23.10.3_source.changes: Valid signature from 106DA1C8C3CBBF14
Checking signature on .dsc
gpg: /home/sergio/work/qemu/qemu_8.0.4+dfsg-1ubuntu3.23.10.3.dsc: Valid signature from 106DA1C8C3CBBF14
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading qemu_8.0.4+dfsg-1ubuntu3.23.10.3.dsc: done.
  Uploading qemu_8.0.4+dfsg-1ubuntu3.23.10.3.debian.tar.xz: done.
  Uploading qemu_8.0.4+dfsg-1ubuntu3.23.10.3_source.buildinfo: done.
  Uploading qemu_8.0.4+dfsg-1ubuntu3.23.10.3_source.changes: done.
Successfully uploaded packages.

--
Sergio
GPG key ID: E92F D0B3 6B14 F1F4 D8E0 EB2F 106D A1C8 C3CB BF14

[Andreas Hasenack (ahasenack)]

This was released already, marking as merged.

diff --git a/debian/changelog b/debian/changelog
index fe1973e..e055d38 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+qemu (1:8.0.4+dfsg-1ubuntu3.23.10.3) mantic; urgency=medium
+
+  * d/p/u/lp-2051965-*.patch: Fix QEMU crash when using TCG acceleration
+    with guest Linux kernel >= 6.3. (LP: #2051965)
+
+ -- Sergio Durigan Junior <[e-mail]>  Tue, 13 Feb 2024 18:26:17 -0500
+
 qemu (1:8.0.4+dfsg-1ubuntu3.23.10.2) mantic-security; urgency=medium
 
   * SECURITY UPDATE: OOB read in RDMA device
diff --git a/debian/patches/series b/debian/patches/series
index 75c6b02..553651c 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -36,3 +36,6 @@ CVE-2023-40360.patch
 CVE-2023-4135.patch
 CVE-2023-42467.patch
 CVE-2023-5088.patch
+ubuntu/lp-2051965-accel-tcg-Split-out-cpu_exec_longjmp_cleanup.patch
+ubuntu/lp-2051965-accel-tcg-Always-lock-pages-before-translation.patch
+ubuntu/lp-2051965-accel-tcg-Clear-tcg_ctx-gen_tb-on-buffer-overflow.patch
diff --git a/debian/patches/ubuntu/lp-2051965-accel-tcg-Always-lock-pages-before-translation.patch b/debian/patches/ubuntu/lp-2051965-accel-tcg-Always-lock-pages-before-translation.patch
new file mode 100644
index 0000000..2d567b0
--- /dev/null
+++ b/debian/patches/ubuntu/lp-2051965-accel-tcg-Always-lock-pages-before-translation.patch
@@ -0,0 +1,621 @@
+From deba78709ae8ce103e2248413857747f804cd1ef Mon Sep 17 00:00:00 2001
+From: Richard Henderson <[e-mail]>
+Date: Thu, 6 Jul 2023 17:55:48 +0100
+Subject: [PATCH] accel/tcg: Always lock pages before translation
+
+We had done this for user-mode by invoking page_protect
+within the translator loop.  Extend this to handle system
+mode as well.  Move page locking out of tb_link_page.
+
+Reported-by: Liren Wei <[e-mail]>
+Reported-by: Richard W.M. Jones <[e-mail]>
+Signed-off-by: Richard Henderson <[e-mail]>
+Tested-by: Richard W.M. Jones <[e-mail]>
+
+Origin: backport, https://gitlab.com/qemu-project/qemu/commit/deba78709a
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/2051965
+Last-Update: 2024-02-13
+
+---
+ accel/tcg/cpu-exec.c      |  20 ++++
+ accel/tcg/internal.h      |  30 ++++-
+ accel/tcg/tb-maint.c      | 244 ++++++++++++++++++++------------------
+ accel/tcg/translate-all.c |  43 ++++++-
+ accel/tcg/translator.c    |  34 ++++--
+ 5 files changed, 237 insertions(+), 134 deletions(-)
+
+--- qemu-tcg-crash-mantic.orig/accel/tcg/cpu-exec.c	2024-02-13 18:18:45.276155938 -0500
++++ qemu-tcg-crash-mantic/accel/tcg/cpu-exec.c	2024-02-13 18:18:45.276155938 -0500
+@@ -539,6 +539,26 @@ static void cpu_exec_longjmp_cleanup(CPU
+     if (have_mmap_lock()) {
+         mmap_unlock();
+     }
++#else
++    /*
++     * For softmmu, a tlb_fill fault during translation will land here,
++     * and we need to release any page locks held.  In system mode we
++     * have one tcg_ctx per thread, so we know it was this cpu doing
++     * the translation.
++     *
++     * Alternative 1: Install a cleanup to be called via an exception
++     * handling safe longjmp.  It seems plausible that all our hosts
++     * support such a thing.  We'd have to properly register unwind info
++     * for the JIT for EH, rather that just for GDB.
++     *
++     * Alternative 2: Set and restore cpu->jmp_env in tb_gen_code to
++     * capture the cpu_loop_exit longjmp, perform the cleanup, and
++     * jump again to arrive here.
++     */
++    if (tcg_ctx->gen_tb) {
++        tb_unlock_pages(tcg_ctx->gen_tb);
++        tcg_ctx->gen_tb = NULL;
++    }
+ #endif
+     if (qemu_mutex_iothread_locked()) {
+         qemu_mutex_unlock_iothread();
+--- qemu-tcg-crash-mantic.orig/accel/tcg/internal.h	2024-02-13 18:18:45.276155938 -0500
++++ qemu-tcg-crash-mantic/accel/tcg/internal.h	2024-02-13 18:18:45.276155938 -0500
+@@ -10,6 +10,7 @@
+ #define ACCEL_TCG_INTERNAL_H
+ 
+ #include "exec/exec-all.h"
++#include "exec/translate-all.h"
+ 
+ /*
+  * Access to the various translations structures need to be serialised
+@@ -35,6 +36,32 @@ static inline void page_table_config_ini
+ void page_table_config_init(void);
+ #endif
+ 
++#ifdef CONFIG_USER_ONLY
++/*
++ * For user-only, page_protect sets the page read-only.
++ * Since most execution is already on read-only pages, and we'd need to
++ * account for other TBs on the same page, defer undoing any page protection
++ * until we receive the write fault.
++ */
++static inline void tb_lock_page0(tb_page_addr_t p0)
++{
++    page_protect(p0);
++}
++
++static inline void tb_lock_page1(tb_page_addr_t p0, tb_page_addr_t p1)
++{
++    page_protect(p1);
++}
++
++static inline void tb_unlock_page1(tb_page_addr_t p0, tb_page_addr_t p1) { }
++static inline void tb_unlock_pages(TranslationBlock *tb) { }
++#else
++void tb_lock_page0(tb_page_addr_t);
++void tb_lock_page1(tb_page_addr_t, tb_page_addr_t);
++void tb_unlock_page1(tb_page_addr_t, tb_page_addr_t);
++void tb_unlock_pages(TranslationBlock *);
++#endif
++
+ #ifdef CONFIG_SOFTMMU
+ void tb_invalidate_phys_range_fast(ram_addr_t ram_addr,
+                                    unsigned size,
+@@ -48,8 +75,7 @@ TranslationBlock *tb_gen_code(CPUState *
+ void page_init(void);
+ void tb_htable_init(void);
+ void tb_reset_jump(TranslationBlock *tb, int n);
+-TranslationBlock *tb_link_page(TranslationBlock *tb, tb_page_addr_t phys_pc,
+-                               tb_page_addr_t phys_page2);
++TranslationBlock *tb_link_page(TranslationBlock *tb);
+ bool tb_invalidate_phys_page_unwind(tb_page_addr_t addr, uintptr_t pc);
+ void cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
+                                uintptr_t host_pc);
+--- qemu-tcg-crash-mantic.orig/accel/tcg/tb-maint.c	2024-02-13 18:18:45.276155938 -0500
++++ qemu-tcg-crash-mantic/accel/tcg/tb-maint.c	2024-02-13 18:20:49.096346316 -0500
+@@ -71,17 +71,7 @@ typedef struct PageDesc PageDesc;
+  */
+ #define assert_page_locked(pd) tcg_debug_assert(have_mmap_lock())
+ 
+-static inline void page_lock_pair(PageDesc **ret_p1, tb_page_addr_t phys1,
+-                                  PageDesc **ret_p2, tb_page_addr_t phys2,
+-                                  bool alloc)
+-{
+-    *ret_p1 = NULL;
+-    *ret_p2 = NULL;
+-}
+-
+-static inline void page_unlock(PageDesc *pd) { }
+-static inline void page_lock_tb(const TranslationBlock *tb) { }
+-static inline void page_unlock_tb(const TranslationBlock *tb) { }
++static inline void tb_lock_pages(const TranslationBlock *tb) { }
+ 
+ /*
+  * For user-only, since we are protecting all of memory with a single lock,
+@@ -97,7 +87,7 @@ static void tb_remove_all(void)
+ }
+ 
+ /* Call with mmap_lock held. */
+-static void tb_record(TranslationBlock *tb, PageDesc *p1, PageDesc *p2)
++static void tb_record(TranslationBlock *tb)
+ {
+     target_ulong addr;
+     int flags;
+@@ -392,12 +382,108 @@ static void page_lock(PageDesc *pd)
+     qemu_spin_lock(&pd->lock);
+ }
+ 
++/* Like qemu_spin_trylock, returns false on success */
++static bool page_trylock(PageDesc *pd)
++{
++    bool busy = qemu_spin_trylock(&pd->lock);
++    if (!busy) {
++        page_lock__debug(pd);
++    }
++    return busy;
++}
++
+ static void page_unlock(PageDesc *pd)
+ {
+     qemu_spin_unlock(&pd->lock);
+     page_unlock__debug(pd);
+ }
+ 
++void tb_lock_page0(tb_page_addr_t paddr)
++{
++    page_lock(page_find_alloc(paddr >> TARGET_PAGE_BITS, true));
++}
++
++void tb_lock_page1(tb_page_addr_t paddr0, tb_page_addr_t paddr1)
++{
++    tb_page_addr_t pindex0 = paddr0 >> TARGET_PAGE_BITS;
++    tb_page_addr_t pindex1 = paddr1 >> TARGET_PAGE_BITS;
++    PageDesc *pd0, *pd1;
++
++    if (pindex0 == pindex1) {
++        /* Identical pages, and the first page is already locked. */
++        return;
++    }
++
++    pd1 = page_find_alloc(pindex1, true);
++    if (pindex0 < pindex1) {
++        /* Correct locking order, we may block. */
++        page_lock(pd1);
++        return;
++    }
++
++    /* Incorrect locking order, we cannot block lest we deadlock. */
++    if (!page_trylock(pd1)) {
++        return;
++    }
++
++    /*
++     * Drop the lock on page0 and get both page locks in the right order.
++     * Restart translation via longjmp.
++     */
++    pd0 = page_find_alloc(pindex0, false);
++    page_unlock(pd0);
++    page_lock(pd1);
++    page_lock(pd0);
++    siglongjmp(tcg_ctx->jmp_trans, -3);
++}
++
++void tb_unlock_page1(tb_page_addr_t paddr0, tb_page_addr_t paddr1)
++{
++    tb_page_addr_t pindex0 = paddr0 >> TARGET_PAGE_BITS;
++    tb_page_addr_t pindex1 = paddr1 >> TARGET_PAGE_BITS;
++
++    if (pindex0 != pindex1) {
++        page_unlock(page_find_alloc(pindex1, false));
++    }
++}
++
++static void tb_lock_pages(TranslationBlock *tb)
++{
++    tb_page_addr_t paddr0 = tb_page_addr0(tb);
++    tb_page_addr_t paddr1 = tb_page_addr1(tb);
++    tb_page_addr_t pindex0 = paddr0 >> TARGET_PAGE_BITS;
++    tb_page_addr_t pindex1 = paddr1 >> TARGET_PAGE_BITS;
++
++    if (unlikely(paddr0 == -1)) {
++        return;
++    }
++    if (unlikely(paddr1 != -1) && pindex0 != pindex1) {
++        if (pindex0 < pindex1) {
++            page_lock(page_find_alloc(pindex0, true));
++            page_lock(page_find_alloc(pindex1, true));
++            return;
++        }
++        page_lock(page_find_alloc(pindex1, true));
++    }
++    page_lock(page_find_alloc(pindex0, true));
++}
++
++void tb_unlock_pages(TranslationBlock *tb)
++{
++    tb_page_addr_t paddr0 = tb_page_addr0(tb);
++    tb_page_addr_t paddr1 = tb_page_addr1(tb);
++    tb_page_addr_t pindex0 = paddr0 >> TARGET_PAGE_BITS;
++    tb_page_addr_t pindex1 = paddr1 >> TARGET_PAGE_BITS;
++
++    if (unlikely(paddr0 == -1)) {
++        return;
++    }
++    if (unlikely(paddr1 != -1) && pindex0 != pindex1) {
++        page_unlock(page_find_alloc(pindex1, false));
++    }
++    page_unlock(page_find_alloc(pindex0, false));
++}
++
+ static inline struct page_entry *
+ page_entry_new(PageDesc *pd, tb_page_addr_t index)
+ {
+@@ -421,13 +507,10 @@ static void page_entry_destroy(gpointer
+ /* returns false on success */
+ static bool page_entry_trylock(struct page_entry *pe)
+ {
+-    bool busy;
+-
+-    busy = qemu_spin_trylock(&pe->pd->lock);
++    bool busy = page_trylock(pe->pd);
+     if (!busy) {
+         g_assert(!pe->locked);
+         pe->locked = true;
+-        page_lock__debug(pe->pd);
+     }
+     return busy;
+ }
+@@ -605,8 +688,7 @@ static void tb_remove_all(void)
+  * Add the tb in the target page and protect it if necessary.
+  * Called with @p->lock held.
+  */
+-static inline void tb_page_add(PageDesc *p, TranslationBlock *tb,
+-                               unsigned int n)
++static void tb_page_add(PageDesc *p, TranslationBlock *tb, unsigned int n)
+ {
+     bool page_already_protected;
+ 
+@@ -626,15 +708,21 @@ static inline void tb_page_add(PageDesc
+     }
+ }
+ 
+-static void tb_record(TranslationBlock *tb, PageDesc *p1, PageDesc *p2)
++static void tb_record(TranslationBlock *tb)
+ {
+-    tb_page_add(p1, tb, 0);
+-    if (unlikely(p2)) {
+-        tb_page_add(p2, tb, 1);
++    tb_page_addr_t paddr0 = tb_page_addr0(tb);
++    tb_page_addr_t paddr1 = tb_page_addr1(tb);
++    tb_page_addr_t pindex0 = paddr0 >> TARGET_PAGE_BITS;
++    tb_page_addr_t pindex1 = paddr0 >> TARGET_PAGE_BITS;
++
++    assert(paddr0 != -1);
++    if (unlikely(paddr1 != -1) && pindex0 != pindex1) {
++        tb_page_add(page_find_alloc(pindex1, false), tb, 1);
+     }
++    tb_page_add(page_find_alloc(pindex0, false), tb, 0);
+ }
+ 
+-static inline void tb_page_remove(PageDesc *pd, TranslationBlock *tb)
++static void tb_page_remove(PageDesc *pd, TranslationBlock *tb)
+ {
+     TranslationBlock *tb1;
+     uintptr_t *pprev;
+@@ -654,74 +742,16 @@ static inline void tb_page_remove(PageDe
+ 
+ static void tb_remove(TranslationBlock *tb)
+ {
+-    PageDesc *pd;
+-
+-    pd = page_find(tb->page_addr[0] >> TARGET_PAGE_BITS);
+-    tb_page_remove(pd, tb);
+-    if (unlikely(tb->page_addr[1] != -1)) {
+-        pd = page_find(tb->page_addr[1] >> TARGET_PAGE_BITS);
+-        tb_page_remove(pd, tb);
+-    }
+-}
+-
+-static void page_lock_pair(PageDesc **ret_p1, tb_page_addr_t phys1,
+-                           PageDesc **ret_p2, tb_page_addr_t phys2, bool alloc)
+-{
+-    PageDesc *p1, *p2;
+-    tb_page_addr_t page1;
+-    tb_page_addr_t page2;
+-
+-    assert_memory_lock();
+-    g_assert(phys1 != -1);
+-
+-    page1 = phys1 >> TARGET_PAGE_BITS;
+-    page2 = phys2 >> TARGET_PAGE_BITS;
+-
+-    p1 = page_find_alloc(page1, alloc);
+-    if (ret_p1) {
+-        *ret_p1 = p1;
+-    }
+-    if (likely(phys2 == -1)) {
+-        page_lock(p1);
+-        return;
+-    } else if (page1 == page2) {
+-        page_lock(p1);
+-        if (ret_p2) {
+-            *ret_p2 = p1;
+-        }
+-        return;
+-    }
+-    p2 = page_find_alloc(page2, alloc);
+-    if (ret_p2) {
+-        *ret_p2 = p2;
+-    }
+-    if (page1 < page2) {
+-        page_lock(p1);
+-        page_lock(p2);
+-    } else {
+-        page_lock(p2);
+-        page_lock(p1);
+-    }
+-}
+-
+-/* lock the page(s) of a TB in the correct acquisition order */
+-static void page_lock_tb(const TranslationBlock *tb)
+-{
+-    page_lock_pair(NULL, tb_page_addr0(tb), NULL, tb_page_addr1(tb), false);
+-}
+-
+-static void page_unlock_tb(const TranslationBlock *tb)
+-{
+-    PageDesc *p1 = page_find(tb_page_addr0(tb) >> TARGET_PAGE_BITS);
+-
+-    page_unlock(p1);
+-    if (unlikely(tb_page_addr1(tb) != -1)) {
+-        PageDesc *p2 = page_find(tb_page_addr1(tb) >> TARGET_PAGE_BITS);
+-
+-        if (p2 != p1) {
+-            page_unlock(p2);
+-        }
++    tb_page_addr_t paddr0 = tb_page_addr0(tb);
++    tb_page_addr_t paddr1 = tb_page_addr1(tb);
++    tb_page_addr_t pindex0 = paddr0 >> TARGET_PAGE_BITS;
++    tb_page_addr_t pindex1 = paddr0 >> TARGET_PAGE_BITS;
++
++    assert(paddr0 != -1);
++    if (unlikely(paddr1 != -1) && pindex0 != pindex1) {
++        tb_page_remove(page_find_alloc(pindex1, false), tb);
+     }
++    tb_page_remove(page_find_alloc(pindex0, false), tb);
+ }
+ #endif /* CONFIG_USER_ONLY */
+ 
+@@ -926,18 +956,16 @@ static void tb_phys_invalidate__locked(T
+ void tb_phys_invalidate(TranslationBlock *tb, tb_page_addr_t page_addr)
+ {
+     if (page_addr == -1 && tb_page_addr0(tb) != -1) {
+-        page_lock_tb(tb);
++        tb_lock_pages(tb);
+         do_tb_phys_invalidate(tb, true);
+-        page_unlock_tb(tb);
++        tb_unlock_pages(tb);
+     } else {
+         do_tb_phys_invalidate(tb, false);
+     }
+ }
+ 
+ /*
+- * Add a new TB and link it to the physical page tables. phys_page2 is
+- * (-1) to indicate that only one page contains the TB.
+- *
++ * Add a new TB and link it to the physical page tables.
+  * Called with mmap_lock held for user-mode emulation.
+  *
+  * Returns a pointer @tb, or a pointer to an existing TB that matches @tb.
+@@ -945,43 +973,29 @@ void tb_phys_invalidate(TranslationBlock
+  * for the same block of guest code that @tb corresponds to. In that case,
+  * the caller should discard the original @tb, and use instead the returned TB.
+  */
+-TranslationBlock *tb_link_page(TranslationBlock *tb, tb_page_addr_t phys_pc,
+-                               tb_page_addr_t phys_page2)
++TranslationBlock *tb_link_page(TranslationBlock *tb)
+ {
+-    PageDesc *p;
+-    PageDesc *p2 = NULL;
+     void *existing_tb = NULL;
+     uint32_t h;
+ 
+     assert_memory_lock();
+     tcg_debug_assert(!(tb->cflags & CF_INVALID));
+ 
+-    /*
+-     * Add the TB to the page list, acquiring first the pages's locks.
+-     * We keep the locks held until after inserting the TB in the hash table,
+-     * so that if the insertion fails we know for sure that the TBs are still
+-     * in the page descriptors.
+-     * Note that inserting into the hash table first isn't an option, since
+-     * we can only insert TBs that are fully initialized.
+-     */
+-    page_lock_pair(&p, phys_pc, &p2, phys_page2, true);
+-    tb_record(tb, p, p2);
++    tb_record(tb);
+ 
+     /* add in the hash table */
+-    h = tb_hash_func(phys_pc, (tb->cflags & CF_PCREL ? 0 : tb->pc),
++    h = tb_hash_func(tb_page_addr0(tb), (tb->cflags & CF_PCREL ? 0 : tb->pc),
+                      tb->flags, tb->cflags, tb->trace_vcpu_dstate);
+     qht_insert(&tb_ctx.htable, tb, h, &existing_tb);
+ 
+     /* remove TB from the page(s) if we couldn't insert it */
+     if (unlikely(existing_tb)) {
+         tb_remove(tb);
+-        tb = existing_tb;
++        tb_unlock_pages(tb);
++        return existing_tb;
+     }
+ 
+-    if (p2 && p2 != p) {
+-        page_unlock(p2);
+-    }
+-    page_unlock(p);
++    tb_unlock_pages(tb);
+     return tb;
+ }
+ 
+--- qemu-tcg-crash-mantic.orig/accel/tcg/translate-all.c	2024-02-13 18:18:45.276155938 -0500
++++ qemu-tcg-crash-mantic/accel/tcg/translate-all.c	2024-02-13 18:22:38.708335591 -0500
+@@ -304,7 +304,7 @@ TranslationBlock *tb_gen_code(CPUState *
+ {
+     CPUArchState *env = cpu->env_ptr;
+     TranslationBlock *tb, *existing_tb;
+-    tb_page_addr_t phys_pc;
++    tb_page_addr_t phys_pc, phys_p2;
+     tcg_insn_unit *gen_code_buf;
+     int gen_code_size, search_size, max_insns;
+ #ifdef CONFIG_PROFILER
+@@ -330,6 +330,7 @@ TranslationBlock *tb_gen_code(CPUState *
+     QEMU_BUILD_BUG_ON(CF_COUNT_MASK + 1 != TCG_MAX_INSNS);
+ 
+  buffer_overflow:
++    assert_no_pages_locked();
+     tb = tcg_tb_alloc(tcg_ctx);
+     if (unlikely(!tb)) {
+         /* flush must be done */
+@@ -351,8 +352,12 @@ TranslationBlock *tb_gen_code(CPUState *
+     tb->trace_vcpu_dstate = *cpu->trace_dstate;
+     tb_set_page_addr0(tb, phys_pc);
+     tb_set_page_addr1(tb, -1);
++    if (phys_pc != -1) {
++        tb_lock_page0(phys_pc);
++    }
++
+     tcg_ctx->gen_tb = tb;
+- tb_overflow:
++ restart_translate:
+ 
+ #ifdef CONFIG_PROFILER
+     /* includes aborted translations because of exceptions */
+@@ -378,6 +383,7 @@ TranslationBlock *tb_gen_code(CPUState *
+             qemu_log_mask(CPU_LOG_TB_OP | CPU_LOG_TB_OP_OPT,
+                           "Restarting code generation for "
+                           "code_gen_buffer overflow\n");
++            tb_unlock_pages(tb);
+             goto buffer_overflow;
+ 
+         case -2:
+@@ -396,14 +402,39 @@ TranslationBlock *tb_gen_code(CPUState *
+                           "Restarting code generation with "
+                           "smaller translation block (max %d insns)\n",
+                           max_insns);
+-            goto tb_overflow;
++
++            /*
++             * The half-sized TB may not cross pages.
++             * TODO: Fix all targets that cross pages except with
++             * the first insn, at which point this can't be reached.
++             */
++            phys_p2 = tb_page_addr1(tb);
++            if (unlikely(phys_p2 != -1)) {
++                tb_unlock_page1(phys_pc, phys_p2);
++                tb_set_page_addr1(tb, -1);
++            }
++            goto restart_translate;
++
++        case -3:
++            /*
++             * We had a page lock ordering problem.  In order to avoid
++             * deadlock we had to drop the lock on page0, which means
++             * that everything we translated so far is compromised.
++             * Restart with locks held on both pages.
++             */
++            qemu_log_mask(CPU_LOG_TB_OP | CPU_LOG_TB_OP_OPT,
++                          "Restarting code generation with re-locked pages");
++            goto restart_translate;
+ 
+         default:
+             g_assert_not_reached();
+         }
+     }
++    tcg_ctx->gen_tb = NULL;
++
+     search_size = encode_search(tb, (void *)gen_code_buf + gen_code_size);
+     if (unlikely(search_size < 0)) {
++        tb_unlock_pages(tb);
+         goto buffer_overflow;
+     }
+     tb->tc.size = gen_code_size;
+@@ -522,6 +553,7 @@ TranslationBlock *tb_gen_code(CPUState *
+      * before attempting to link to other TBs or add to the lookup table.
+      */
+     if (tb_page_addr0(tb) == -1) {
++        assert_no_pages_locked();
+         return tb;
+     }
+ 
+@@ -536,7 +568,9 @@ TranslationBlock *tb_gen_code(CPUState *
+      * No explicit memory barrier is required -- tb_link_page() makes the
+      * TB visible in a consistent state.
+      */
+-    existing_tb = tb_link_page(tb, tb_page_addr0(tb), tb_page_addr1(tb));
++    existing_tb = tb_link_page(tb);
++    assert_no_pages_locked();
++
+     /* if the TB already exists, discard what we just translated */
+     if (unlikely(existing_tb != tb)) {
+         uintptr_t orig_aligned = (uintptr_t)gen_code_buf;
+--- qemu-tcg-crash-mantic.orig/accel/tcg/translator.c	2024-02-13 18:18:45.276155938 -0500
++++ qemu-tcg-crash-mantic/accel/tcg/translator.c	2024-02-13 18:23:08.420308318 -0500
+@@ -17,6 +17,7 @@
+ #include "exec/translator.h"
+ #include "exec/plugin-gen.h"
+ #include "exec/replay-core.h"
++#include "internal.h"
+ 
+ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest)
+ {
+@@ -47,10 +48,6 @@ void translator_loop(CPUState *cpu, Tran
+     db->host_addr[0] = host_pc;
+     db->host_addr[1] = NULL;
+ 
+-#ifdef CONFIG_USER_ONLY
+-    page_protect(pc);
+-#endif
+-
+     ops->init_disas_context(db, cpu);
+     tcg_debug_assert(db->is_jmp == DISAS_NEXT);  /* no early exit */
+ 
+@@ -158,22 +155,36 @@ static void *translator_access(CPUArchSt
+         host = db->host_addr[1];
+         base = TARGET_PAGE_ALIGN(db->pc_first);
+         if (host == NULL) {
+-            tb_page_addr_t phys_page =
+-                get_page_addr_code_hostp(env, base, &db->host_addr[1]);
++            tb_page_addr_t page0, old_page1, new_page1;
++
++            new_page1 = get_page_addr_code_hostp(env, base, &db->host_addr[1]);
+ 
+             /*
+              * If the second page is MMIO, treat as if the first page
+              * was MMIO as well, so that we do not cache the TB.
+              */
+-            if (unlikely(phys_page == -1)) {
++            if (unlikely(new_page1 == -1)) {
++                tb_unlock_pages(tb);
+                 tb_set_page_addr0(tb, -1);
+                 return NULL;
+             }
+ 
+-            tb_set_page_addr1(tb, phys_page);
+-#ifdef CONFIG_USER_ONLY
+-            page_protect(end);
+-#endif
++            /*
++             * If this is not the first time around, and page1 matches,
++             * then we already have the page locked.  Alternately, we're
++             * not doing anything to prevent the PTE from changing, so
++             * we might wind up with a different page, requiring us to
++             * re-do the locking.
++             */
++            old_page1 = tb_page_addr1(tb);
++            if (likely(new_page1 != old_page1)) {
++                page0 = tb_page_addr0(tb);
++                if (unlikely(old_page1 != -1)) {
++                    tb_unlock_page1(page0, old_page1);
++                }
++                tb_set_page_addr1(tb, new_page1);
++                tb_lock_page1(page0, new_page1);
++            }
+             host = db->host_addr[1];
+         }
+ 
diff --git a/debian/patches/ubuntu/lp-2051965-accel-tcg-Clear-tcg_ctx-gen_tb-on-buffer-overflow.patch b/debian/patches/ubuntu/lp-2051965-accel-tcg-Clear-tcg_ctx-gen_tb-on-buffer-overflow.patch
new file mode 100644
index 0000000..bf6b2a0
--- /dev/null
+++ b/debian/patches/ubuntu/lp-2051965-accel-tcg-Clear-tcg_ctx-gen_tb-on-buffer-overflow.patch
@@ -0,0 +1,34 @@
+From ad17868eb162a5466d8ad43e5ccb428776403308 Mon Sep 17 00:00:00 2001
+From: Richard Henderson <[e-mail]>
+Date: Wed, 26 Jul 2023 12:58:08 -0700
+Subject: [PATCH] accel/tcg: Clear tcg_ctx->gen_tb on buffer overflow
+
+On overflow of code_gen_buffer, we unlock the guest pages we had been
+translating, but failed to clear gen_tb.  On restart, if we cannot
+allocate a TB, we exit to the main loop to perform the flush of all
+TBs as soon as possible.  With garbage in gen_tb, we hit an assert:
+
+../src/accel/tcg/tb-maint.c:348:page_unlock__debug: \
+    assertion failed: (page_is_locked(pd))
+
+Fixes: deba78709ae8 ("accel/tcg: Always lock pages before translation")
+Signed-off-by: Richard Henderson <[e-mail]>
+
+Origin: upstream, https://gitlab.com/qemu-project/qemu/commit/ad17868eb1
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/2051965
+Last-Update: 2024-02-13
+
+---
+ accel/tcg/translate-all.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- qemu-tcg-crash-mantic.orig/accel/tcg/translate-all.c	2024-02-13 18:24:31.688184016 -0500
++++ qemu-tcg-crash-mantic/accel/tcg/translate-all.c	2024-02-13 18:24:31.684184024 -0500
+@@ -384,6 +384,7 @@ TranslationBlock *tb_gen_code(CPUState *
+                           "Restarting code generation for "
+                           "code_gen_buffer overflow\n");
+             tb_unlock_pages(tb);
++            tcg_ctx->gen_tb = NULL;
+             goto buffer_overflow;
+ 
+         case -2:
diff --git a/debian/patches/ubuntu/lp-2051965-accel-tcg-Split-out-cpu_exec_longjmp_cleanup.patch b/debian/patches/ubuntu/lp-2051965-accel-tcg-Split-out-cpu_exec_longjmp_cleanup.patch
new file mode 100644
index 0000000..9398854
--- /dev/null
+++ b/debian/patches/ubuntu/lp-2051965-accel-tcg-Split-out-cpu_exec_longjmp_cleanup.patch
@@ -0,0 +1,90 @@
+From cb62bd15e14e304617d250158b77d0deb032f032 Mon Sep 17 00:00:00 2001
+From: Richard Henderson <[e-mail]>
+Date: Thu, 6 Jul 2023 08:45:13 +0100
+Subject: [PATCH] accel/tcg: Split out cpu_exec_longjmp_cleanup
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Share the setjmp cleanup between cpu_exec_step_atomic
+and cpu_exec_setjmp.
+
+Reviewed-by: Alex Bennée <[e-mail]>
+Reviewed-by: Philippe Mathieu-Daudé <[e-mail]>
+Reviewed-by: Richard W.M. Jones <[e-mail]>
+Signed-off-by: Richard Henderson <[e-mail]>
+
+Origin: backport, https://gitlab.com/qemu-project/qemu/commit/cb62bd15e1
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/2051965
+Last-Update: 2024-02-13
+
+---
+ accel/tcg/cpu-exec.c | 43 +++++++++++++++++++------------------------
+ 1 file changed, 19 insertions(+), 24 deletions(-)
+
+--- qemu-tcg-crash-mantic.orig/accel/tcg/cpu-exec.c	2024-02-13 19:51:45.182071910 -0500
++++ qemu-tcg-crash-mantic/accel/tcg/cpu-exec.c	2024-02-13 19:54:41.056353084 -0500
+@@ -529,6 +529,23 @@ static void cpu_exec_exit(CPUState *cpu)
+     }
+ }
+ 
++static void cpu_exec_longjmp_cleanup(CPUState *cpu)
++{
++    /* Non-buggy compilers preserve this; assert the correct value. */
++    g_assert(cpu == current_cpu);
++
++#ifndef CONFIG_SOFTMMU
++    clear_helper_retaddr();
++    if (have_mmap_lock()) {
++        mmap_unlock();
++    }
++#endif
++    if (qemu_mutex_iothread_locked()) {
++        qemu_mutex_unlock_iothread();
++    }
++    assert_no_pages_locked();
++}
++
+ void cpu_exec_step_atomic(CPUState *cpu)
+ {
+     CPUArchState *env = cpu->env_ptr;
+@@ -570,16 +587,7 @@ void cpu_exec_step_atomic(CPUState *cpu)
+         cpu_tb_exec(cpu, tb, &tb_exit);
+         cpu_exec_exit(cpu);
+     } else {
+-#ifndef CONFIG_SOFTMMU
+-        clear_helper_retaddr();
+-        if (have_mmap_lock()) {
+-            mmap_unlock();
+-        }
+-#endif
+-        if (qemu_mutex_iothread_locked()) {
+-            qemu_mutex_unlock_iothread();
+-        }
+-        assert_no_pages_locked();
++        cpu_exec_longjmp_cleanup(cpu);
+     }
+ 
+     /*
+@@ -1024,20 +1032,7 @@ static int cpu_exec_setjmp(CPUState *cpu
+ {
+     /* Prepare setjmp context for exception handling. */
+     if (unlikely(sigsetjmp(cpu->jmp_env, 0) != 0)) {
+-        /* Non-buggy compilers preserve this; assert the correct value. */
+-        g_assert(cpu == current_cpu);
+-
+-#ifndef CONFIG_SOFTMMU
+-        clear_helper_retaddr();
+-        if (have_mmap_lock()) {
+-            mmap_unlock();
+-        }
+-#endif
+-        if (qemu_mutex_iothread_locked()) {
+-            qemu_mutex_unlock_iothread();
+-        }
+-
+-        assert_no_pages_locked();
++        cpu_exec_longjmp_cleanup(cpu);
+     }
+ 
+     return cpu_exec_loop(cpu, sc);