The 'trace_event_get_state' macro is a wrapper around the
'trace_event_get_state_dynamic_by_id' macro, which is a direct
check of the _TRACE_...._DSTATE global variable.
The only code that should be using this is the generated trace
probes, but the name looks rather appealing causing it to be
mistakenly used in other places, instead of the recommended
'trace_event_get_state_dynamic_backends'.
Removing the 'trace_event_get_state' macro reduces the potential
for confusion.
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-id: 20261102142844.3464712-26-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Finish the removal of the "disable" event property by removing code
that parses properties and the backend code generators.
This "fixes" a bug in the UST backends which looked for a property
called "disabled" instead of "disable".
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-id: 20261102142844.3464712-25-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
The TraceEvent struct contains a "bool sstate" field which track whether
a trace event was disabled statically. i.e. at build time via the
"disable" property annotation in trace-events.
The only runtime use of this field is to let "trace-event-get-state"
report that an event is "unavailable" instead of reporting an error for
an unknown trace event.
Trace events are not ABI so their names can change and the event can
come and go at any time. Thus there is little utility in reporting the
existence of a disabled event that cannot ever be used at runtime.
Removing the "bool sstate" field from TraceEvent saves 8 bytes of
space in the struct, adding up to approx 64 KB across all current
events.
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-id: 20261102142844.3464712-24-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
If emitting a trace event requires computation for the parameters
passed to the probe, the callers should guard that computation
with trace_event_by_state_backends(), which is a macro expanding
to a check of the "TRACE_...._DSTATE()" expression. For the
log backend this should include a check for LOG_TRACE being
present in the configured log level.
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Each backend generates the same trace_event_get_state_dynamic_by_id()
call for the TRACE....DSTATE() macro body, so when multiple backends
are enabled, the same check is repeated:
#define TRACE_TEST_WIBBLE_BACKEND_DSTATE() ( \
QEMU_TEST_WIBBLE_ENABLED() || \
trace_event_get_state_dynamic_by_id(TRACE_TEST_WIBBLE) || \
trace_event_get_state_dynamic_by_id(TRACE_TEST_WIBBLE) || \
trace_event_get_state_dynamic_by_id(TRACE_TEST_WIBBLE) || \
trace_event_get_state_dynamic_by_id(TRACE_TEST_WIBBLE) || \
tracepoint_enabled(qemu, test_wibble) || \
false)
Expanding the use of the 'backend.check_trace_event_get_state'
attr in the C header generator removes the duplication, in the
same way that the Rust generator already does.
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-id: 20261102142844.3464712-17-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Previously these variables had two distinct semantics. For
most probes DSTATE was treated as a simple boolean, while
for vcpu probes it was treated as a bitmask of vCPU indexes.
With vcpu probes removed, it is now exclusively a boolean
and thus using uint16_t is a waste of memory.
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-id: 20261102142844.3464712-10-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
The UST trace backend fails to compile on version 2.14.0, as we
pass a "char **" arg as to ctf_string(), which only expects 'char *'.
It should instead be treated the same way as generic pointers, and
emitted as hex.
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-id: 20261102142844.3464712-4-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
a couple of last minutes fixes:
- make checkpatch validate fixes against upstream branch
- terminate block on x86 RDMSR
- fix common_tuxrun_gdb call on s390x
# -----BEGIN PGP SIGNATURE-----
#
# iQEzBAABCgAdFiEEZoWumedRZ7yvyN81+9DbCVqeKkQFAmrqGEwACgkQ+9DbCVqe
# KkThNgf+MpbujBo17IK3z88LwmYQbObBy1lonUhKS15XgQ97rZ1qVYBG3uM7U3RG
# Ap/R8XqeN7OIqyeaaEChQ8nkUgN9pmiSEnwfSFmT0eSZbF/kXtHOqGSeNkLUZhT6
# AFwBkjqCicmpF5G0uoUAKXQDQIEhxprwMAlOfVaee/sM4RIUKvIMGms0jrhDrms1
# 7A98HCnHv3FoFKnC4/wb9/XQAmoJQp7yso+x+aE/Dv2QiaVf/jdPrc6yambWSXcm
# 7q3KUlMkN+CUmFRZTlBBiMwHy9IooR4h7KE1x1vib8R6cSieNqYpTBpBmXifGAj0
# uYATASPqhnCb/2p95jKFq5UPJQXUVQ==
# =xh+I
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 03 Nov 2026 09:22:20 AM PST
# gpg: using RSA key 6685AE99E75167BCAFC8DF35FBD0DB095A9E2A44
# gpg: Good signature from "Alex Bennée (Master Work Key) <alex.bennee@linaro.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6685 AE99 E751 67BC AFC8 DF35 FBD0 DB09 5A9E 2A44
* tag 'pull-11.2-misc-fixes-031126-1' of https://gitlab.com/stsquad/qemu:
tests/functional: fix call to common_tuxrun_gdb
target/i386: terminate a tcg block on gen_RDMSR
scripts/checkpatch: validate fixes against upstream repo
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* target/i386/tcg: bugfixes and cleanups
* AGENTS.md: add final instructions
* meson: rewrite scripts/qemu-version.sh directly in meson.build
# -----BEGIN PGP SIGNATURE-----
#
# iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmrp4jAUHHBib256aW5p
# QHJlZGhhdC5jb20ACgkQv/vSX3jHroNpqQf+MSIq1hU468taSkdyWWr6ZmYKqNCL
# HJ2BXhojBlPbxTS3zRo/WfBUDeoysm+xkbgQLQu2FjDa4j/w5r1ibU2CzDq0GbYu
# +hvGaKlV2gyc/0Efp1m/LdY0ugZc+QtJyBtwVf13sclPEWnX/wPGQPUlUFvAYIif
# ciERbbH5QZ39th/gu2rbIOGNwm0epfRw/dcu41s3HrClQQ57eMCtrzQ6IXb13P3h
# NKSTwktsZf0kZ7LYGroKlQe+Soi4O3bFt9hruJ16W/7Zsu7wUKII0A474K9ppTuo
# ZqlSvS06+zUEE/b2QfcfMCHy+7sQVMXHONAbnAzHO2VLp7RKUWb9xXe/OQ==
# =Q1VY
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 03 Nov 2026 05:31:28 AM PST
# gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83
# gpg: issuer "pbonzini@redhat.com"
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [unknown]
# gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1
# Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83
* tag 'for-upstream' of https://gitlab.com/bonzini/qemu:
meson: rewrite scripts/qemu-version.sh directly in meson.build
include: introduce qemu/version.h
target/i386: terminate a tcg block on gen_RDMSR
AGENTS.md: add final instructions
target/i386/tcg: remove F operand type
target/i386/tcg: remove X and Y operand types
target/i386/tcg: reject VEX.NP for MMX instructions
target/i386/tcg: inline gen_leave
target/i386/tcg: change popl_esp_hack to an X86InsnSpecial
target/i386: raise #DE for INT_MIN / -1 in IDIV helpers
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
The current check for a referenced fix commit relies on the developer
keeping their master branch up to date which is not always guaranteed.
If you create your branches directly from the upstream repo this will
keep failing. Besides the local master could be anything.
Improve the logic to divine which remote is pointing at the upstream
repo and use the remote master to check the fixes.
checkpatch complains about the line lengths but this seems to be
standard for the perl script so I didn't try and fix it.
Acked-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Message-ID: <20261030183054.2875292-1-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
QAPI patches for 2026-11-02
# -----BEGIN PGP SIGNATURE-----
#
# iQJGBAABCgAwFiEENUvIs9frKmtoZ05fOHC0AOuRhlMFAmro2HsSHGFybWJydUBy
# ZWRoYXQuY29tAAoJEDhwtADrkYZTUgYQALkOmmEhdlD5iatEU3Jcl7yy0Pto53tp
# 7sOP2AjxW0Hy4LJFFGGS6C8t5i+AZVuKHoydmUVY7RZBEoVhVnqD6Ia58dF1uzDJ
# RvPbkKrYXlkfKaAsL9XkTf3+/RxCRUBriHbua90YuIIbvj3f4uzM0bQLpu8M5M4l
# 8BT4NsbgqLp5XwndH9oxlxUH69nTuIwdYZSdnYTXJpnx6ySR89nDhXFzVBVre4Oy
# nD/wtGvLfN8ULDic6eOLIr9ks8YGcAP7jIgqmnIvvooewMXJm1utmzd1MUQNgSC8
# /r++STOkGYe4dAyOjgAC4ZOHj2U3IMOltiXIKaN8+Hz/j2rM71xnyeqX9o92SFwh
# dKBJbHOj6yf/FrsD4pbakpd9R/gNe+tUqEXnSopo8msZL1qE7SNRF69Ri+aFfgdt
# VUQB2fZgj+dvTOY7GIa7Yr1Mj8U9Y3rmDsJ20nEqgNPaj3jserDueJ8xfgrifYdh
# zFCEjr7RIW9F8wO6uQN62Et4/tA7VWVF8tt70BKdq96OJ+RhHVWVECgcnTlS/gTn
# 4psihUoBa+whwYJk8Q6uMUhpT9rHXQrwxqZFtMlItWg9wKkAjqsc2PzUJT1tZfee
# GrPuMBDQfW9zvIlB6DZcZuPIh5Y3fBj4aiHPsIcNxj8GeqwVu+n8m/xLJ/BqVEGr
# FNb1esRYontl
# =fjYB
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 02 Nov 2026 10:37:47 AM PST
# gpg: using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653
# gpg: issuer "armbru@redhat.com"
# gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [unknown]
# gpg: aka "Markus Armbruster <armbru@pond.sub.org>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653
* tag 'pull-qapi-2026-11-02-v2' of https://repo.or.cz/qemu/armbru: (74 commits)
tests/qmp-cmd-test: assert qapi-type resolves in query-qmp-schema
qom: use QAPITypeInfo in object_property_get_enum
qom: Drop object_property_add_enum() parameter @lookup
hw/i386: convert PCSouthBridgeOption to QAPI enum
qdev: PropertyInfo.enum_table is no longer used, drop
qdev: convert PropertyInfo definitions to use qapi_type
target/riscv: convert PropertyInfo definitions to use qapi_type
hw: convert device-local PropertyInfo definitions to use qapi_type
hw/ufs: Convert PropertyInfo to QAPITypeInfo
qdev: convert system PropertyInfo definitions to use qapi_type
qdev: convert core PropertyInfo definitions to use qapi_type
qdev: add qapi_type field to PropertyInfo with fallback registration
hw/s390x: convert BootCertificatesList to QAPI-aware registration
hw/ppc/spapr_drc: convert fdt property to QAPI-aware registration
hw/s390-virtio-ccw: convert loadparm property to QAPI-aware registration
hw/nvdimm: convert UUID property to QAPI-aware registration
qom: replace object_property_add_tm with StructTm QAPI type
virtio-balloon: convert guest-stats property to QAPI type
i386/x86: convert SgxEPCList property to QAPI-aware registration
accel/hvf: convert OnOffSplit property to QAPI-aware registration
...
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Invoking git and creating a .h file does not need a shell script.
Embed the logic directly in meson.build.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
New QAPISchemaGenTypeInfoVisitor produces per-module
qapi-type-infos-*.h/c files. Each file declares QAPITypeInfo constants
pairing the QAPI type name with its masked introspection name.
We want per-module .h for less recompiling when we touch QAPI types.
Unfortunately, the per-module .c usually all change then, because the
masked names all change.
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20261101201717.3911097-10-armbru@redhat.com>
The re.sub() call replaces every hyphen in 'what' with the system module
infix. This produces broken filenames for multi-hyphen names (e.g.
'qapi-type-infos' becomes 'qapi-builtin-type-builtin-infos').
Add count=1 so only the first hyphen is replaced.
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20261101201717.3911097-9-armbru@redhat.com>
query-qmp-schema elides types not reachable from commands and events.
It currently emits 1251 out of 1385 definitions, and elides 134 types.
Whether that's worthwhile is debatable.
Marc-André Lureau would like to make QOM introspection (qom-list &
friends) refer to QAPI types. We additionally need types reachable
from QOM properties.
Unfortunately, the QAPI generator knows nothing about QOM properties.
We could manually mark the QAPI types to elide, or the QAPI types not
to elide even though they are not reachable from commands and events.
Feels very much not worthwhile to me.
We could conservatively approximate "reachable from QOM properties" by
"available for use with QOM properties". These are the built-in and
user-defined types, and their arrays. With that, we'd elide just 38
out of 1385 definitions. Too few to be worthwhile.
Simply emit everything.
Output of query-qmp-schema grows from 247KiB to 274KiB for me.
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20261101201717.3911097-5-armbru@redhat.com>
query-qmp-schema masks type names, because they are not part of the
external interface. Marc-André Lureau would like to also use them
with qom-list & friends. Trouble is the masked names are buried deep
in QAPISchemaGenIntrospectVisitor. Lift them into schema.py: new
QAPISchemaDefinition method introspection_name() returns a
definition's name for use in introspection.
This changes the masked names, which is fine.
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20261101201717.3911097-3-armbru@redhat.com>
[Two type hints fixed]
Commit 060b5a9323 (qapi: Dumb down QAPISchema.lookup_entity())
accidentally relaxed QAPISchema.lookup_entity()'s return type to
QAPISchemaEntity. Tighten it back to QAPISchemaDefinition, and rename
the method to .lookup_defn().
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20261101201717.3911097-2-armbru@redhat.com>
This script allows to easily build a qemu release container, based on
dockerfile introduced in previous commit.
It names image "qemu/$version" and automatically detects which ubuntu
version should be used to build it.
$ ./scripts/build_release_container.sh v3.1.0
$ podman run -it --rm qemu/v3.1.0 qemu-system-arm --version
QEMU emulator version 3.1.0 (-dirty)
Copyright (c) 2003-2018 Fabrice Bellard and the QEMU Project developers
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/qemu-devel/20261029000853.15166-3-pierrick.bouvier@oss.qualcomm.com
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
The checkpatch.pl script insists that Fixes tags are at the start of
each line of its input. Although this is where they ought to be
in the commit message, it is not where the script will see them
in common usage patterns like
git show <hash> | ./scripts/checkpatch.pl -
because 'git show' prefaces each line of the commit message body with
four spaces. Allow spaces before the Fixes tag; this matches how we
check for e.g. Signed-off-by: tags.
Fixes: 910e1d41be ("scripts/checkpatch: validate Fixes: tag format and commit ancestry")
Reported-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Tested-by: Stefano Garzarella <sgarzare@redhat.com>
Message-ID: <20261023152357.1614817-1-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Assets cached before the stamp files were introduced have no
corresponding .stamp file. The script already copes with that when
reading the timestamp, by assuming the QEMU v10.1 release date, which
makes such assets eligible for removal.
However, since commit c1bb594fe4, removing the asset also
unconditionally unlinks its .stamp file. For these old entries that
file does not exist, so unlink() raises FileNotFoundError and the
script aborts after deleting the first such asset, leaving the rest of
the cache uncleaned and returning an error.
Pass missing_ok=True so that a missing .stamp file is not an error.
Fixes: c1bb594fe4 ("scripts/clean_functional_cache: Remove also .stamp files")
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Since commit cfc96df65e, riscv_pmu_ctr_get_fixed_counters_val()
returns the complete 64-bit fixed-counter value. The RV32 counter
access paths, however, still perform parts of the offset calculation
on separately extracted 32-bit halves.
In particular, riscv_pmu_write_ctrh() deposits the low 32 bits of the
complete fixed-counter value into the high half of mhpmcounter_prev.
riscv_pmu_read_ctr() also subtracts a 32-bit half of the previous value
from the complete 64-bit fixed-counter value. Consequently, writes to
mcycleh can be lost and carries between the low and high halves are not
handled correctly.
Keep the fixed-counter offset calculation entirely in 64 bits. Before
a running counter is partially written, materialize its current
architectural value and reset the fixed-counter baseline. On reads,
calculate the complete 64-bit counter value before extracting the half
requested by RV32.
Register RV32 system TCG tests with the Meson build. Add a test for
high-half writes, low-to-high carry, and preserving the carried high
half across a subsequent low-half write.
Fixes: cfc96df65e ("target/riscv: Remove upper_half from riscv_pmu_ctr_get_fixed_counters_val")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4219
Signed-off-by: Zephyr Li <fritchleybohrer@gmail.com>
Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Chao Liu <chao.liu@processmission.com>
Message-ID: <20261008035150.2223-1-fritchleybohrer@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Adapt the kernel's checkpatch Fixes: tag validation for QEMU.
Add a git_commit_info() helper to resolve commit hashes and validate
the Fixes: tag in commit messages. The canonical form is:
Fixes: <12+ chars of sha1> ("<title line>")
The check validates capitalization, spacing, hash length, lowercase
hex, and quoted title. When the format is wrong and the commit can
be resolved, suggest the corrected Fixes: line.
When running inside a git repository, also verify that the referenced
commit is an ancestor of master.
Lines matching "Fixes: CVE-*" are skipped. The check can be disabled
with --no-fixes-tag.
Link: https://lore.kernel.org/qemu-devel/20260806171333.328864-1-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
init_coredump() creates a Coredump object for every coredump session. That
implies opening and scanning the actual coredump file. For non-detailed
'qemu bt' invocation we don't really need it.
Les't only create the object when the core is about to be patched, i.e.
for '--detailed'.
Fixes: 42f3c143c3 ("scripts/qemugdb: coroutine: Add option for obtaining detailed trace in coredump")
Signed-off-by: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
Message-ID: <20260804151743.937694-10-andrey.drobyshev@virtuozzo.com>
Tested-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
'qemu bt' on a coredump takes significant time before the first
coroutine frame is even printed. The bulk of the delay is resolving a
name.
co_tls_current is a file static variable, and CoroutineUContext is defined
in the same compilation unit, so resolving either of them by name makes gdb
expand every symtab in the binary.
Look the static up with gdb.lookup_static_symbol(), which is served from
the gdb's in-memory index, and scope the type lookup to the symtab that
comes with it. This significantly speeds up 'qemu bt' processing.
Signed-off-by: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
Message-ID: <20260804151743.937694-9-andrey.drobyshev@virtuozzo.com>
Tested-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
init_coredump() picks the core dump and the executable out of fixed lines
of 'info files' output. With no target loaded that output is empty, and
'qemu bt' dies with:
IndexError: list index out of range
Search the whole output for the core dump file instead, and take the
executable from gdb.current_progspace(), which doesn't need parsing at
all. Neither can raise if the pattern isn't there, so an unexpected
output format now just means "not a coredump" rather than a traceback.
That alone only moves the problem to gdb.execute("bt"), whose gdb.error
escapes invoke() and still gets reported as a python traceback. At the
same time plain 'bt' just prints 'No stack.'. Let's mimick this
behaviour and simply report an error if there's no selected thread.
Fixes: 42f3c143c3 ("scripts/qemugdb: coroutine: Add option for obtaining detailed trace in coredump")
Signed-off-by: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
Message-ID: <20260804151743.937694-8-andrey.drobyshev@virtuozzo.com>
Tested-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Both commands claim the coredump is copied before its registers get
patched, but patch_regs() writes to the coredump itself. Describe what
actually happens, so that nobody expects their coredump to be left alone.
Fix a typo in "runing" while at it.
Fixes: 42f3c143c3 ("scripts/qemugdb: coroutine: Add option for obtaining detailed trace in coredump")
Signed-off-by: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
Message-ID: <20260804151743.937694-7-andrey.drobyshev@virtuozzo.com>
Tested-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
patch_regs() and restore_regs() open the coredump with 'ab', i.e. with
O_APPEND. This repositions the file offset to the end of the file before
every write. The seek() to pt_regs therefore has no effect: instead of
patching the saved registers, we just append the binary blob with patched
regs at the end of the file.
Nothing fails, and the gdb subprocess still prints a plausible backtrace.
However it's a backtrace of the crashed thread rather than of the
requested coroutine. The .ptregs blob kept for recovery is dead for the
same reason as there's never anything to restore.
Open the file with 'r+b' so that the writes actually land where seek()
points.
Fixes: 42f3c143c3 ("scripts/qemugdb: coroutine: Add option for obtaining detailed trace in coredump")
Signed-off-by: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
Message-ID: <20260804151743.937694-6-andrey.drobyshev@virtuozzo.com>
Tested-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
dump_backtrace() walks the frame pointer chain until rbp is NULL.
However, when glibc is built with no frame pointers, rbp is never NULL
during unwind. Instead, we see garbage in the outermost frame. This
results into:
#17 0x5610b6e9f2d9 in main<+1720> () at ../qemu-io.c:674
#18 0x7f26cc10230e in __libc_start_call_main<+125> () at
../sysdeps/nptl/libc_start_call_main.h:58
Traceback (most recent call last):
File "/.../scripts/qemugdb/coroutine.py", line 409, in invoke
bt_jmpbuf(coroutine_to_jmpbuf(co_ptr), is_coredump,
File "/.../scripts/qemugdb/coroutine.py", line 296, in bt_jmpbuf
dump_backtrace(regs)
File "/.../scripts/qemugdb/coroutine.py", line 247, in dump_backtrace
while rbp:
^^^
gdb.MemoryError: Cannot access memory at address 0x4
Error occurred in Python: Cannot access memory at address 0x4
As a fix, stop on the first link that can't be read. Since
gdb.parse_and_eval() returns a lazy value, force the actual memory read
by wrapping it in int() and immediately catching potential gdb.MemoryError.
Fixes: 772f86839f ("scripts/qemu-gdb: Support coroutine dumps in coredumps")
Signed-off-by: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
Message-ID: <20260804151743.937694-5-andrey.drobyshev@virtuozzo.com>
Tested-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
When calling 'qemu bt' / 'qemu coroutine' in a live process, we get:
AttributeError: 'NoneType' object has no attribute 'restore_regs'
That's because for both commands finally: blocks attempt to restore
patched regs unconditionally. Fix this by guarding regs restoration by
'if is_coredump'.
Fixes: 42f3c143c3 ("scripts/qemugdb: coroutine: Add option for obtaining detailed trace in coredump")
Signed-off-by: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
Message-ID: <20260804151743.937694-4-andrey.drobyshev@virtuozzo.com>
Tested-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Currently upon invocation of 'qemu bt' / 'qemu coroutine' we try live
process backtrace dump first, and if it fails - fallback to coredump.
That causes us needless work and catching an exception. In my previous
commit 42f3c143c3 ("scripts/qemugdb: coroutine: Add option for obtaining
detailed trace in coredump") class Coredump was introduced, and each
invocation already calls init_coredump(). Let's just pass the result of
this call further as a bool param and make a decision based upon it.
Apply the same pattern to obtaining coroutine pointer.
Note that we deliberately lose a safety net here: the bare except used to
swallow any failure of the live dump, not just the absence of a live
process, and silently fall back to the raw unwind. Such a failure is now
reported to the user instead.
Signed-off-by: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
Message-ID: <20260804151743.937694-3-andrey.drobyshev@virtuozzo.com>
Tested-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Currently, whenever gdb.execute() fails and throws an exception,
previously selected frame gets leaked. I.e.:
(gdb) frame N
(gdb) qemu bt # throws exception
(gdb) frame # shows 0, not N
As a fix, wrap gdb.execute() commands in try/finally, so that selected
frame gets restored no matter what.
Fixes: 4cbf8efc5b ("scripts/gdb: fix 'qemu coroutine' when users selects a non topmost stack frame")
Signed-off-by: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
Message-ID: <20260804151743.937694-2-andrey.drobyshev@virtuozzo.com>
Tested-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
In 43e7ad1a3f, I adjusted the insertion algorithm for inserting
something after the "introduction" to cope with both the old and new
syntax while we converted QAPI to the new syntax. There's a bug in
that code that only shows up in a handful of cases and only when using
the new syntax while this affordance/flex code is still enabled.
In the case that we do actually have a real bona-fide intro section,
we want to insert directly after that real-deal intro section, not
after any plaintext sections that may follow it. This code adjusts the
temporary code to strongly prefer inserting after the actual intro
section if it exists.
Once again: once conversion is done, you will be delighted by how much
of this ugly code goes away.
Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20260917194614.549584-6-jsnow@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
