Re: [Qemu-devel] [PATCH] target-s390x: fix LOAD MULTIPLE instruction on page boundary

[Aurelien Jarno <aurelien@aurel32.net>]

On 2015-05-21 14:42, Richard Henderson wrote:
> On 05/21/2015 02:32 PM, Aurelien Jarno wrote:
> > When consecutive memory locations are on page boundary a page fault
> > might occur when using the LOAD MULTIPLE instruction. In that case real
> > hardware doesn't load any register.
> > 
> > This is an important detail in case the base register is in the list
> > of registers to be loaded. If a page fault occurs this register might be
> > overwritten and when the instruction is later restarted the wrong
> > base register value is useD.
> > 
> > Fix this by first loading all values from memory and then writing them
> > back to the registers.
> > 
> > This fixes random segmentation faults seen in the guest.
> > 
> > Cc: Alexander Graf <agraf@suse.de>
> > Cc: Richard Henderson <rth@twiddle.net>
> > Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
> > ---
> >  target-s390x/translate.c | 56 +++++++++++++++++++++++++++++++++++++++++++-----
> >  1 file changed, 51 insertions(+), 5 deletions(-)
> 
> Hmm.  Seems to be un/under-specified in the PoO.  That said,

There is a small sentence in the PoO, in chapter "Program Execution",
section "Sequence of Storage Reference":

  It can normally be assumed that the execution of
  each instruction occurs as an indivisible event.

> Reviewed-by: Richard Henderson <rth@twiddle.net>
> 
> It would be nice to know if there ought to be similar up-front access checking
> for STM, to avoid errant partial stores.

I have just checked, the same is also true for STM instructions, though
it's probably more difficult to fix that in QEMU. Maybe we need a way to
check if a load/store will succeed, preferably without using a helper.

-- 
Aurelien Jarno                          GPG: 4096R/1DDD8C9B
aurelien@aurel32.net                 http://www.aurel32.net