120845 Commits

Author SHA1 Message Date
749db2de75 fixup! refactor hooks 2025-07-29 12:20:34 +00:00
6efafc2d44 fixup! refactor hooks 2025-07-28 11:56:03 +00:00
cc1eb211d5 fixup! add libafl_qemu_read_user_sp_unchecked 2025-07-23 10:20:07 +00:00
49db147f92 clear ptimers before each run 2025-07-23 08:41:26 +00:00
ad273375f8 missing header 2025-07-23 08:41:26 +00:00
208cf5be73 refactor hooks 2025-07-23 08:41:26 +00:00
16960d9d07 allow interrupts from multiple sources 2025-07-23 08:41:26 +00:00
d3fca27481 re-introduce native breakpoints 2025-07-23 08:41:26 +00:00
93bdbe3e18 WIP: work around iothread lock 2025-07-23 08:41:26 +00:00
7f3f2188bd move instrumentation to hook file 2025-07-23 08:41:26 +00:00
acc2e70812 add libafl_qemu_read_user_sp_unchecked 2025-07-23 08:41:22 +00:00
b006000ced read shift for timers, bump interrupt count 2025-07-23 08:40:58 +00:00
8a18ddc13d fix jump instrumentation 2025-07-23 08:40:58 +00:00
85346b9ede fix jmp instrumentation 2025-07-23 08:40:58 +00:00
3964bde281 simple standalone injection test 2025-07-23 08:40:56 +00:00
5046884758 fix build 2025-07-23 08:38:03 +00:00
3f164c57f0 fix jmp instrumentation 2025-07-23 08:38:03 +00:00
1de3f79bc3 fix build 2025-07-23 08:38:03 +00:00
d0df248628 add standalone debugging config 2025-07-23 08:38:03 +00:00
21249ee504 fuzz multiple interrupts 2025-07-23 08:38:03 +00:00
2f09bc50b6 add interrupt injection 2025-07-23 08:38:03 +00:00
c1d8c3242a add jmp instrumentation 2025-07-23 08:38:03 +00:00
Romain Malmain
0bea78a122
Merge pull request #115 from WorksButNotTested/dontdump
Fix madvise(MADV_DONTDUMP)
2025-05-09 01:28:38 +02:00
WorksButNotTested
ad4b20f018 Fix madvise(MADV_DONTDUMP) 2025-05-06 10:18:23 +00:00
Romain Malmain
d20fb07d99
Merge pull request #114 from WorksButNotTested/dontdump
Support madvise(MADV_DONTDUMP) when creating core dumps for qemu-user
2025-05-02 22:20:31 +02:00
WorksButNotTested
15fcf9af71 Support madvise(MADV_DONTDUMP) when creating core dumps for qemu-user
When running applications which make large (sparsely populated) address ranges
(e.g. when using address sanitizer with LibAFL) the inability to exclude these
regions from any core dump can result in very large files which fill the disk.
A coredump is obvously very useful for performing a post-mortem when fuzzing.

Whilst the man pages state that madvise provides only a hint (and hence can be
ignored), this patch adds support to handle MADV_DONTDUMP and set a
corresponding flag in the page flags, thus allowing QEMU to exclude these
regions from the core file.
2025-05-02 19:41:13 +01:00
Romain Malmain
54b1f3f8d9
Merge pull request #113 from AFLplusplus/update_qemu_v10_0_0
Update QEMU to v10.0.0
2025-05-02 20:29:16 +02:00
Romain Malmain
13757ee0e9
expose main symbol 2025-05-02 19:43:45 +02:00
Romain Malmain
5feca574fc
forgot include 2025-05-02 14:43:34 +02:00
Romain Malmain
d4a6db3260
forgot include 2025-05-02 14:36:38 +02:00
Romain Malmain
4b35c57b08
forgot include 2025-05-02 14:34:51 +02:00
Romain Malmain
92e59e0587
forgot include 2025-05-02 13:19:44 +02:00
Romain Malmain
94ef85a39a
enable manual action trigger 2025-05-02 11:26:24 +02:00
Romain Malmain
d744fc4f42
adapt to new decoder 2025-05-02 11:13:43 +02:00
Romain Malmain
a7e9d70e14
forgot 2025-04-30 13:51:55 +02:00
Romain Malmain
e0b8df9655
fix systemmode compilation 2025-04-30 13:47:55 +02:00
Romain Malmain
9366380915
format 2025-04-29 14:29:00 +02:00
Romain Malmain
7633d5fce5
reorganize stuff 2025-04-29 14:26:42 +02:00
Romain Malmain
5682a6d841 v10.0.0 release
-----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEhpWov9P5fNqsNXdanKSrs4Grc8gFAmgHmpAACgkQnKSrs4Gr
 c8h82wf/fVN/ZlYKLX7VJz0z+u3UB5MKuDUd+7LUwSGse9uIOH3K8PITkMyYgIti
 Sh8EKg9rhVzBEpiL9ZJfqCJjQTgJFk0O4xt3dPSGNsI2pZZcDwvQXFit7e/fafrY
 tUaTPdGuZ+i7s8Ooa+Z5tacI7n8KniQQkgf90oTnKhatmDmUbsVE0fma/2EmgqdI
 fO2mJKp5YiDsRf3vmuVKx/ltHYfL2tOvBOojeWBk9Zwr+czI2ku6Fy1Suu+tWeZ5
 setxSOCfY3G+qVsTm3n0d9OW/GPoQBsSVbSYua/74nQneNivTDAncndLFbFdj60g
 Q9n4t7tHN35Nh4XqkE0DhMGqPsQ3Og==
 =CFYe
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQSq9xYmtep25y1RrMYC5KE/dBVGigUCaBCxXQAKCRAC5KE/dBVG
 imXmAP0WaWyc2kmipvGyhdGor7F4PlG9LRHL0jM4Om5SM4lkzAD/WnyFAXtErEwl
 eK0c2d980jdVHS5h9tVDK5TpzcPCRA0=
 =Zk18
 -----END PGP SIGNATURE-----

Merge tag 'v10.0.0' into update_qemu_v10_0_0

v10.0.0 release
2025-04-29 13:00:44 +02:00
Stefan Hajnoczi
7c949c53e9 Update version for the v10.0.0 release
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-04-22 09:32:33 -04:00
Stefan Hajnoczi
a9cd5bc639 Update version for v10.0.0-rc4 release
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-04-15 11:54:04 -04:00
Antoine Damhet
e28fbd1c52 Revert "virtio-net: Copy received header to buffer"
This reverts commit 7987d2be5a8bc3a502f89ba8cf3ac3e09f64d1ce.

The goal was to remove the need to patch the (const) input buffer
with a recomputed UDP checksum by copying headers to a RW region and
inject the checksum there. The patch computed the checksum only from the
header fields (missing the rest of the payload) producing an invalid one
and making guests fail to acquire a DHCP lease.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2727
Cc: qemu-stable@nongnu.org
Signed-off-by: Antoine Damhet <adamhet@scaleway.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250408145345.142947-1-adamhet@scaleway.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-04-15 08:24:48 -04:00
Pierrick Bouvier
8bdd3a0308 tests/functional/test_aarch64_replay: reenable on macos
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250410225550.46807-3-pierrick.bouvier@linaro.org>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-04-14 11:03:16 -04:00
Pierrick Bouvier
fa3f3a33f3 system/main: transfer replay mutex ownership from main thread to main loop thread
On MacOS, UI event loop has to be ran in the main thread of a process.
Because of that restriction, on this platform, qemu main event loop is
ran on another thread [1].

This breaks record/replay feature, which expects thread running qemu_init
to initialize hold this lock, breaking associated functional tests on
MacOS.

Thus, as a generalization, and similar to how BQL is handled, we release
it after init, and reacquire the lock before entering main event loop,
avoiding a special case if a separate thread is used.

Tested on MacOS with:
$ meson test -C build --setup thorough --print-errorlogs \
func-x86_64-x86_64_replay func-arm-arm_replay func-aarch64-aarch64_replay
$ ./build/qemu-system-x86_64 -nographic -icount shift=auto,rr=record,rrfile=replay.log
$ ./build/qemu-system-x86_64 -nographic -icount shift=auto,rr=replay,rrfile=replay.log

[1] f5ab12caba

Fixes: https://gitlab.com/qemu-project/qemu/-/issues/2907
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250410225550.46807-2-pierrick.bouvier@linaro.org>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-04-14 11:03:16 -04:00
Stefan Hajnoczi
100e8e2b38 trivial patches for 2025-04-14
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEZKoqtTHVaQM2a/75gqpKJDselHgFAmf81fEACgkQgqpKJDse
 lHihiBAAlf/FCOGs4qCJuwuoeebI9WC22C+80hQPNMiXLvV7wQWJMqdf6UvPOUt/
 LUdndWrPb2hKKVzcv6mMEKl0wEAxOdxB1FiZZltKwIJiES1OXJcKjNSK84PTN/CN
 WDC/mVjv5v10X7x3xUHTqB1qr6MpWuSQLnfob5u40MVa43wZj6fJPeSYzHsWNgrx
 47xLlqFyGVv7mMtIxpYsrKoFypNaTTHggSydZnUkOQBIsXvxE9mEagIdNhjGQVNh
 gx76DWxYnjM932yIizKCQJhe2umetlHUR9dUEqWkI8xRA0pQVTE/p5c+rkIxCzeu
 uAadKOOGdRaHKjinyMQMoFTjC6CH8f1znWVwYJvsh2XLyJXb7PAo6jq3piUWLQpv
 OTXSQ2N/1FJeYEkliyjJibabviJpmdY3mzr/Bw0jJh3KYGm1Ub/lGjjaVes5PwHz
 xa5jnm2Dk9sdpWP2VCyxhlffs5iSOQblPBit4UeTyytg1SZohcWNevcz+AdrCUEE
 nYvxQoAl0euq6oAXDV1qsVl7HwgEm9FCiMJY8G94G890wGx9gPIZ+Ofp+9GHbve0
 sxY027EjvosX9Om2IRexmLpwnHRCUYw+09fD8iqs7ie/oN5ryTgYG5oZMAjAZC46
 Rd+dcuxxmT9uc5XZoZaGzloNmCDI7RjMAMAaSlwUMXHB0XA0wc8=
 =VgUD
 -----END PGP SIGNATURE-----

Merge tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu into staging

trivial patches for 2025-04-14

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEZKoqtTHVaQM2a/75gqpKJDselHgFAmf81fEACgkQgqpKJDse
# lHihiBAAlf/FCOGs4qCJuwuoeebI9WC22C+80hQPNMiXLvV7wQWJMqdf6UvPOUt/
# LUdndWrPb2hKKVzcv6mMEKl0wEAxOdxB1FiZZltKwIJiES1OXJcKjNSK84PTN/CN
# WDC/mVjv5v10X7x3xUHTqB1qr6MpWuSQLnfob5u40MVa43wZj6fJPeSYzHsWNgrx
# 47xLlqFyGVv7mMtIxpYsrKoFypNaTTHggSydZnUkOQBIsXvxE9mEagIdNhjGQVNh
# gx76DWxYnjM932yIizKCQJhe2umetlHUR9dUEqWkI8xRA0pQVTE/p5c+rkIxCzeu
# uAadKOOGdRaHKjinyMQMoFTjC6CH8f1znWVwYJvsh2XLyJXb7PAo6jq3piUWLQpv
# OTXSQ2N/1FJeYEkliyjJibabviJpmdY3mzr/Bw0jJh3KYGm1Ub/lGjjaVes5PwHz
# xa5jnm2Dk9sdpWP2VCyxhlffs5iSOQblPBit4UeTyytg1SZohcWNevcz+AdrCUEE
# nYvxQoAl0euq6oAXDV1qsVl7HwgEm9FCiMJY8G94G890wGx9gPIZ+Ofp+9GHbve0
# sxY027EjvosX9Om2IRexmLpwnHRCUYw+09fD8iqs7ie/oN5ryTgYG5oZMAjAZC46
# Rd+dcuxxmT9uc5XZoZaGzloNmCDI7RjMAMAaSlwUMXHB0XA0wc8=
# =VgUD
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 14 Apr 2025 05:31:29 EDT
# gpg:                using RSA key 64AA2AB531D56903366BFEF982AA4A243B1E9478
# gpg: Good signature from "Michael Tokarev <mjt@debian.org>" [unknown]
# gpg:                 aka "Michael Tokarev <mjt@corpit.ru>" [unknown]
# gpg:                 aka "Michael Tokarev <mjt@tls.msk.ru>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 9D8B E14E 3F2A 9DD7 9199  28F1 61AD 3D98 ECDF 2C8E
#      Subkey fingerprint: 64AA 2AB5 31D5 6903 366B  FEF9 82AA 4A24 3B1E 9478

* tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu:
  docs: Document removal of 64-bit on 32-bit emulation
  Fix objdump output parser in "nsis.py"
  docs: Fix some typos (found by codespell and typos)

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-04-14 11:02:35 -04:00
Stefan Hajnoczi
5befef5eed Final fixes for 10.0
- properly exit aarch64-softmmu tcg tests on unexpected exceptions
  - fix deadlock when uninstalling a plugin
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEZoWumedRZ7yvyN81+9DbCVqeKkQFAmf2P+0ACgkQ+9DbCVqe
 KkTHdAf/b4CGLNJBS7UV/eYxhgxJ2TM4KgfXm4FvrcS4V5rpNheMuLoQzgYDY+EC
 5ioANRcY+rOK2Yd+upO4SbaUyAvf7C5kAtMgs6AYiqbm5F8b47FS/q8f9mBBJ+qB
 tl2FU6hjVjymMRoaPqqpPkkkHy9YNHe48TP4ohGfD6336JA5MW6v8nhdK+d3fsan
 AUCSWAe8gxjmM6qnrhku6vvJ5EOiqpsb8zhsWVXdZesSG+1ATm6KCo6hDd0OkMrk
 si6ML5txU1rxx5VOkGlDUo7ZV2TE/zdgMyaP/kXGtKuj+ipLMzqNjlD50xPJu05b
 o4hTbt8erzxduVHrBKT5qhKQl8BEpw==
 =LN/t
 -----END PGP SIGNATURE-----

Merge tag 'pull-10.0-final-fixes-090425-1' of https://gitlab.com/stsquad/qemu into staging

Final fixes for 10.0

 - properly exit aarch64-softmmu tcg tests on unexpected exceptions
 - fix deadlock when uninstalling a plugin

# -----BEGIN PGP SIGNATURE-----
#
# iQEzBAABCgAdFiEEZoWumedRZ7yvyN81+9DbCVqeKkQFAmf2P+0ACgkQ+9DbCVqe
# KkTHdAf/b4CGLNJBS7UV/eYxhgxJ2TM4KgfXm4FvrcS4V5rpNheMuLoQzgYDY+EC
# 5ioANRcY+rOK2Yd+upO4SbaUyAvf7C5kAtMgs6AYiqbm5F8b47FS/q8f9mBBJ+qB
# tl2FU6hjVjymMRoaPqqpPkkkHy9YNHe48TP4ohGfD6336JA5MW6v8nhdK+d3fsan
# AUCSWAe8gxjmM6qnrhku6vvJ5EOiqpsb8zhsWVXdZesSG+1ATm6KCo6hDd0OkMrk
# si6ML5txU1rxx5VOkGlDUo7ZV2TE/zdgMyaP/kXGtKuj+ipLMzqNjlD50xPJu05b
# o4hTbt8erzxduVHrBKT5qhKQl8BEpw==
# =LN/t
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed 09 Apr 2025 05:37:49 EDT
# gpg:                using RSA key 6685AE99E75167BCAFC8DF35FBD0DB095A9E2A44
# gpg: Good signature from "Alex Bennée (Master Work Key) <alex.bennee@linaro.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6685 AE99 E751 67BC AFC8  DF35 FBD0 DB09 5A9E 2A44

* tag 'pull-10.0-final-fixes-090425-1' of https://gitlab.com/stsquad/qemu:
  tests/tcg/plugins: add plugin to test reset and uninstall
  plugins/loader: fix deadlock when resetting/uninstalling a plugin
  tests/tcg: fix semihosting SYS_EXIT for aarch64 in boot.S

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-04-14 11:02:09 -04:00
Richard Henderson
f3ca7ca222 docs: Document removal of 64-bit on 32-bit emulation
With acce728cbc6c we disallowed configuring 64-bit guests on
32-bit hosts, but forgot to document that in removed-features.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2025-04-14 12:30:09 +03:00
Arthur Sengileyev
b0b5af62ef Fix objdump output parser in "nsis.py"
In msys2 distribution objdump from gcc is using single tab character
prefix, but objdump from clang is using 4 white space characters instead.
The script will not identify any dll dependencies for a QEMU build
generated with clang. This in turn will fail the build, because there
will be no files inside dlldir and no setup file will be created.
Instead of checking for whitespace in prefix use lstrip to accommodate
for differences in outputs.

Signed-off-by: Arthur Sengileyev <arthur.sengileyev@gmail.com>
Reviewed-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2025-04-13 13:45:41 +03:00
Stefan Weil via
22e6d70294 docs: Fix some typos (found by codespell and typos)
Signed-off-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2025-04-13 13:45:04 +03:00
Pierrick Bouvier
d832ff9d02 tests/tcg/plugins: add plugin to test reset and uninstall
We perform a plugin reset, uninstall, and make sure we went through
those steps.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20250404032027.430575-3-pierrick.bouvier@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
2025-04-09 10:35:29 +01:00