)]}'
{
  "commit": "e43ced8be18dda77c229ab09f85136a4d600d40d",
  "tree": "11c92a9971fb5d2a7e6bae6dd83093dfd50b63cd",
  "parents": [
    "ba68dd7d475ee2f83e285a21cac3e5e8e8c54bff"
  ],
  "author": {
    "name": "Ilya Leoshkevich",
    "email": "iii@linux.ibm.com",
    "time": "Tue Jan 28 01:12:42 2025 +0100"
  },
  "committer": {
    "name": "Thomas Huth",
    "email": "thuth@redhat.com",
    "time": "Thu Jan 30 10:39:37 2025 +0100"
  },
  "message": "target/s390x: Fix MVC not always invalidating translation blocks\n\nNode.js crashes in qemu-system-s390x with random SIGSEGVs / SIGILLs.\n\nThe v8 JIT used by Node.js can garbage collect and overwrite unused\ncode. Overwriting is performed by WritableJitAllocation::CopyCode(),\nwhich ultimately calls memcpy(). For certain sizes, memcpy() uses the\nMVC instruction.\n\nQEMU implements MVC and other similar instructions using helpers. While\nTCG store ops invalidate affected translation blocks automatically,\nhelpers must do this manually by calling probe_access_flags(). The MVC\nhelper does this using the access_prepare() -\u003e access_prepare_nf() -\u003e\ns390_probe_access() -\u003e probe_access_flags() call chain.\n\nAt the last step of this chain, the store size is replaced with 0. This\ncauses the probe_access_flags() -\u003e notdirty_write() -\u003e\ntb_invalidate_phys_range_fast() chain to miss some translation blocks.\n\nWhen this happens, QEMU executes a mix of old and new code. This\nquickly leads to either a SIGSEGV or a SIGILL in case the old code\nends in the middle of a new instruction.\n\nFix by passing the true size.\n\nReported-by: Berthold Gunreben \u003cazouhr@opensuse.org\u003e\nCc: Sarah Kriesch \u003cada.lovelace@gmx.de\u003e\nCc: qemu-stable@nongnu.org\nCloses: https://bugzilla.opensuse.org/show_bug.cgi?id\u003d1235709\nSigned-off-by: Ilya Leoshkevich \u003ciii@linux.ibm.com\u003e\nReviewed-by: Richard Henderson \u003crichard.henderson@linaro.org\u003e\nReviewed-by: David Hildenbrand \u003cdavid@redhat.com\u003e\nFixes: e2faabee78ff (\"accel/tcg: Forward probe size on to notdirty_write\")\nMessage-ID: \u003c20250128001338.11474-1-iii@linux.ibm.com\u003e\nSigned-off-by: Thomas Huth \u003cthuth@redhat.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "32717acb7d1ee910c17ae30b6d2f233ef19b7bb4",
      "old_mode": 33188,
      "old_path": "target/s390x/tcg/mem_helper.c",
      "new_id": "c6ab2901e5ad0ccb34dbdce3ebe248a6ac368517",
      "new_mode": 33188,
      "new_path": "target/s390x/tcg/mem_helper.c"
    }
  ]
}