| Message ID | 20220811095534.241224-4-iii@linux.ibm.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | linux-user: Fix siginfo_t contents when jumping to non-readable pages | expand |
On 8/11/22 02:55, Ilya Leoshkevich wrote: > Right now translator stops right *after* the end of a page, which > breaks reporting of fault locations when the last instruction of a > multi-insn translation block crosses a page boundary. > > Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> > --- > target/s390x/tcg/translate.c | 15 +++++++++++---- > 1 file changed, 11 insertions(+), 4 deletions(-) > > diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c > index e2ee005671..8e45a0e0d3 100644 > --- a/target/s390x/tcg/translate.c > +++ b/target/s390x/tcg/translate.c > @@ -6609,6 +6609,14 @@ static void s390x_tr_insn_start(DisasContextBase *dcbase, CPUState *cs) > dc->insn_start = tcg_last_op(); > } > > +static target_ulong get_next_pc(CPUS390XState *env, DisasContext *s, > + uint64_t pc) > +{ > + uint64_t insn = ld_code2(env, s, pc); > + > + return pc + get_ilen((insn >> 8) & 0xff); > +} > + > static void s390x_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs) > { > CPUS390XState *env = cs->env_ptr; > @@ -6616,10 +6624,9 @@ static void s390x_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs) > > dc->base.is_jmp = translate_one(env, dc); > if (dc->base.is_jmp == DISAS_NEXT) { > - uint64_t page_start; > - > - page_start = dc->base.pc_first & TARGET_PAGE_MASK; > - if (dc->base.pc_next - page_start >= TARGET_PAGE_SIZE || dc->ex_value) { > + if (!is_same_page(dcbase, dc->base.pc_next) || > + !is_same_page(dcbase, get_next_pc(env, dc, dc->base.pc_next)) || > + dc->ex_value) { > dc->base.is_jmp = DISAS_TOO_MANY; > } > }
diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c index e2ee005671..8e45a0e0d3 100644 --- a/target/s390x/tcg/translate.c +++ b/target/s390x/tcg/translate.c @@ -6609,6 +6609,14 @@ static void s390x_tr_insn_start(DisasContextBase *dcbase, CPUState *cs) dc->insn_start = tcg_last_op(); } +static target_ulong get_next_pc(CPUS390XState *env, DisasContext *s, + uint64_t pc) +{ + uint64_t insn = ld_code2(env, s, pc); + + return pc + get_ilen((insn >> 8) & 0xff); +} + static void s390x_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs) { CPUS390XState *env = cs->env_ptr; @@ -6616,10 +6624,9 @@ static void s390x_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs) dc->base.is_jmp = translate_one(env, dc); if (dc->base.is_jmp == DISAS_NEXT) { - uint64_t page_start; - - page_start = dc->base.pc_first & TARGET_PAGE_MASK; - if (dc->base.pc_next - page_start >= TARGET_PAGE_SIZE || dc->ex_value) { + if (!is_same_page(dcbase, dc->base.pc_next) || + !is_same_page(dcbase, get_next_pc(env, dc, dc->base.pc_next)) || + dc->ex_value) { dc->base.is_jmp = DISAS_TOO_MANY; } }
Right now translator stops right *after* the end of a page, which breaks reporting of fault locations when the last instruction of a multi-insn translation block crosses a page boundary. Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> --- target/s390x/tcg/translate.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)