tb_gen_code() assumes that tb->size must never be zero, otherwise it
may produce spurious exceptions. For ARM this may happen when creating
a translation block for the commpage.

Fix by pretending that commpage translation blocks have at least one
instruction.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
---
 target/arm/translate.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index 62b1c2081b..885f69b044 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -9060,6 +9060,7 @@ static void arm_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
     unsigned int insn;
 
     if (arm_pre_translate_insn(dc)) {
+        dc->base.pc_next += 4;
         return;
     }
 
-- 
2.29.2

On Thu, 15 Apr 2021 at 14:03, Ilya Leoshkevich <iii@linux.ibm.com> wrote:
>
> tb_gen_code() assumes that tb->size must never be zero, otherwise it
> may produce spurious exceptions. For ARM this may happen when creating
> a translation block for the commpage.
>
> Fix by pretending that commpage translation blocks have at least one
> instruction.
>
> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
> ---
>  target/arm/translate.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/target/arm/translate.c b/target/arm/translate.c
> index 62b1c2081b..885f69b044 100644
> --- a/target/arm/translate.c
> +++ b/target/arm/translate.c
> @@ -9060,6 +9060,7 @@ static void arm_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
>      unsigned int insn;
>
>      if (arm_pre_translate_insn(dc)) {
> +        dc->base.pc_next += 4;
>          return;
>      }

Why does the call to arm_pre_translate_insn() in arm_tr_translate_insn() need
this change but not the one in thumb_tr_translate_insn() ?

thanks
-- PMM

On Fri, 2021-04-16 at 15:10 +0100, Peter Maydell wrote:
> On Thu, 15 Apr 2021 at 14:03, Ilya Leoshkevich <iii@linux.ibm.com>
> wrote:
> > 
> > tb_gen_code() assumes that tb->size must never be zero, otherwise
> > it
> > may produce spurious exceptions. For ARM this may happen when
> > creating
> > a translation block for the commpage.
> > 
> > Fix by pretending that commpage translation blocks have at least
> > one
> > instruction.
> > 
> > Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
> > ---
> >  target/arm/translate.c | 1 +
> >  1 file changed, 1 insertion(+)
> > 
> > diff --git a/target/arm/translate.c b/target/arm/translate.c
> > index 62b1c2081b..885f69b044 100644
> > --- a/target/arm/translate.c
> > +++ b/target/arm/translate.c
> > @@ -9060,6 +9060,7 @@ static void
> > arm_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
> >      unsigned int insn;
> > 
> >      if (arm_pre_translate_insn(dc)) {
> > +        dc->base.pc_next += 4;
> >          return;
> >      }
> 
> Why does the call to arm_pre_translate_insn() in
> arm_tr_translate_insn() need
> this change but not the one in thumb_tr_translate_insn() ?
> 
> thanks
> -- PMM
> 

My bad: the regtest did not hit it, and I haven't thought about it.
I will send a v5 with `dc->base.pc_next += 2;` there.