* [PULL 1/5] accel/tcg: Introduce and use MO_ALIGN_TLB_ONLY
2025-10-31 11:53 [PULL 0/5] tcg/linux-user/test patch queue Richard Henderson
@ 2025-10-31 11:53 ` Richard Henderson
2025-10-31 11:53 ` [PULL 2/5] tcg: Simplify extract2 usage in tcg_gen_shifti_i64 Richard Henderson
` (4 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: Richard Henderson @ 2025-10-31 11:53 UTC (permalink / raw)
To: qemu-devel
Cc: Peter Maydell, Manos Pitsidianakis, Philippe Mathieu-Daudé
For Arm, we need 3 cases: (1) the alignment required when accessing
Normal memory, (2) the alignment required when accessing Device memory,
and (3) the atomicity of the access.
When we added TLB_CHECK_ALIGNED, we assumed that cases 2 and 3 were
identical, and thus used memop_atomicity_bits for TLB_CHECK_ALIGNED.
This is incorrect for multiple reasons, including that the atomicity
of the access is adjusted depending on whether or not we are executing
within a serial context.
For Arm, what is true is that there is an underlying alignment
requirement of the access, and for that access Normal memory
will support unalignement.
Introduce MO_ALIGN_TLB_ONLY to indicate that the alignment
specified in MO_AMASK only applies when the TLB entry has
TLB_CHECK_ALIGNED set; otherwise no alignment required.
Introduce memop_tlb_alignment_bits with an additional bool
argument that specifies whether TLB_CHECK_ALIGNED is set.
All other usage of memop_alignment_bits assumes it is not.
Remove memop_atomicity_bits as unused; it didn't properly
support MO_ATOM_SUBWORD anyway.
Update target/arm finalize_memop_atom to set MO_ALIGN_TLB_ONLY
when strict alignment isn't otherwise required.
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3171
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
include/exec/memop.h | 43 +++++++++++++++------------------
target/arm/tcg/translate.h | 4 +--
accel/tcg/cputlb.c | 13 +---------
target/arm/ptw.c | 2 +-
target/arm/tcg/translate-a64.c | 10 +++-----
target/arm/tcg/translate-neon.c | 2 +-
tcg/tcg.c | 10 +++++---
7 files changed, 35 insertions(+), 49 deletions(-)
diff --git a/include/exec/memop.h b/include/exec/memop.h
index cf7da3362e..799b5b4221 100644
--- a/include/exec/memop.h
+++ b/include/exec/memop.h
@@ -72,6 +72,16 @@ typedef enum MemOp {
MO_ALIGN_64 = 6 << MO_ASHIFT,
MO_ALIGN = MO_AMASK,
+ /*
+ * MO_ALIGN_TLB_ONLY:
+ * Apply MO_AMASK only along the TCG slow path if TLB_CHECK_ALIGNED
+ * is set; otherwise unaligned access is permitted.
+ * This is used by target/arm, where unaligned accesses are
+ * permitted for pages marked Normal but aligned accesses are
+ * required for pages marked Device.
+ */
+ MO_ALIGN_TLB_ONLY = 1 << 8,
+
/*
* MO_ATOM_* describes the atomicity requirements of the operation:
* MO_ATOM_IFALIGN: the operation must be single-copy atomic if it
@@ -104,7 +114,7 @@ typedef enum MemOp {
* size of the operation, if aligned. This retains the behaviour
* from before this field was introduced.
*/
- MO_ATOM_SHIFT = 8,
+ MO_ATOM_SHIFT = 9,
MO_ATOM_IFALIGN = 0 << MO_ATOM_SHIFT,
MO_ATOM_IFALIGN_PAIR = 1 << MO_ATOM_SHIFT,
MO_ATOM_WITHIN16 = 2 << MO_ATOM_SHIFT,
@@ -169,16 +179,16 @@ static inline MemOp size_memop(unsigned size)
}
/**
- * memop_alignment_bits:
+ * memop_tlb_alignment_bits:
* @memop: MemOp value
*
- * Extract the alignment size from the memop.
+ * Extract the alignment size for use with TLB_CHECK_ALIGNED.
*/
-static inline unsigned memop_alignment_bits(MemOp memop)
+static inline unsigned memop_tlb_alignment_bits(MemOp memop, bool tlb_check)
{
unsigned a = memop & MO_AMASK;
- if (a == MO_UNALN) {
+ if (a == MO_UNALN || (!tlb_check && (memop & MO_ALIGN_TLB_ONLY))) {
/* No alignment required. */
a = 0;
} else if (a == MO_ALIGN) {
@@ -191,28 +201,15 @@ static inline unsigned memop_alignment_bits(MemOp memop)
return a;
}
-/*
- * memop_atomicity_bits:
+/**
+ * memop_alignment_bits:
* @memop: MemOp value
*
- * Extract the atomicity size from the memop.
+ * Extract the alignment size from the memop.
*/
-static inline unsigned memop_atomicity_bits(MemOp memop)
+static inline unsigned memop_alignment_bits(MemOp memop)
{
- unsigned size = memop & MO_SIZE;
-
- switch (memop & MO_ATOM_MASK) {
- case MO_ATOM_NONE:
- size = MO_8;
- break;
- case MO_ATOM_IFALIGN_PAIR:
- case MO_ATOM_WITHIN16_PAIR:
- size = size ? size - 1 : 0;
- break;
- default:
- break;
- }
- return size;
+ return memop_tlb_alignment_bits(memop, false);
}
#endif
diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
index 9a85ea74db..b62104b4ae 100644
--- a/target/arm/tcg/translate.h
+++ b/target/arm/tcg/translate.h
@@ -744,8 +744,8 @@ static inline TCGv_ptr fpstatus_ptr(ARMFPStatusFlavour flavour)
*/
static inline MemOp finalize_memop_atom(DisasContext *s, MemOp opc, MemOp atom)
{
- if (s->align_mem && !(opc & MO_AMASK)) {
- opc |= MO_ALIGN;
+ if (!(opc & MO_AMASK)) {
+ opc |= MO_ALIGN | (s->align_mem ? 0 : MO_ALIGN_TLB_ONLY);
}
return opc | atom | s->be_data;
}
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index 631f1fe135..fd1606c856 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -1668,18 +1668,7 @@ static bool mmu_lookup1(CPUState *cpu, MMULookupPageData *data, MemOp memop,
if (likely(!maybe_resized)) {
/* Alignment has not been checked by tlb_fill_align. */
- int a_bits = memop_alignment_bits(memop);
-
- /*
- * This alignment check differs from the one above, in that this is
- * based on the atomicity of the operation. The intended use case is
- * the ARM memory type field of each PTE, where access to pages with
- * Device memory type require alignment.
- */
- if (unlikely(flags & TLB_CHECK_ALIGNED)) {
- int at_bits = memop_atomicity_bits(memop);
- a_bits = MAX(a_bits, at_bits);
- }
+ int a_bits = memop_tlb_alignment_bits(memop, flags & TLB_CHECK_ALIGNED);
if (unlikely(addr & ((1 << a_bits) - 1))) {
cpu_unaligned_access(cpu, addr, access_type, mmu_idx, ra);
}
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 23f6616811..2e6b149b2d 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -2352,7 +2352,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
* CPUs with ARM_FEATURE_LPAE but not ARM_FEATURE_V7VE anyway.)
*/
if (device) {
- unsigned a_bits = memop_atomicity_bits(memop);
+ unsigned a_bits = memop_tlb_alignment_bits(memop, true);
if (address & ((1 << a_bits) - 1)) {
fi->type = ARMFault_Alignment;
goto do_fault;
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index 3292d7cbfd..08b21d7dbf 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -3691,9 +3691,8 @@ static bool trans_STP(DisasContext *s, arg_ldstpair *a)
* In all cases, issue one operation with the correct atomicity.
*/
mop = a->sz + 1;
- if (s->align_mem) {
- mop |= (a->sz == 2 ? MO_ALIGN_4 : MO_ALIGN_8);
- }
+ mop |= (a->sz == 2 ? MO_ALIGN_4 : MO_ALIGN_8);
+ mop |= (s->align_mem ? 0 : MO_ALIGN_TLB_ONLY);
mop = finalize_memop_pair(s, mop);
if (a->sz == 2) {
TCGv_i64 tmp = tcg_temp_new_i64();
@@ -3742,9 +3741,8 @@ static bool trans_LDP(DisasContext *s, arg_ldstpair *a)
* since that reuses the most code below.
*/
mop = a->sz + 1;
- if (s->align_mem) {
- mop |= (a->sz == 2 ? MO_ALIGN_4 : MO_ALIGN_8);
- }
+ mop |= (a->sz == 2 ? MO_ALIGN_4 : MO_ALIGN_8);
+ mop |= (s->align_mem ? 0 : MO_ALIGN_TLB_ONLY);
mop = finalize_memop_pair(s, mop);
if (a->sz == 2) {
int o2 = s->be_data == MO_LE ? 32 : 0;
diff --git a/target/arm/tcg/translate-neon.c b/target/arm/tcg/translate-neon.c
index 844d2e29e4..e3c7d9217b 100644
--- a/target/arm/tcg/translate-neon.c
+++ b/target/arm/tcg/translate-neon.c
@@ -520,7 +520,7 @@ static bool trans_VLDST_multiple(DisasContext *s, arg_VLDST_multiple *a)
if (a->align) {
align = pow2_align(a->align + 2); /* 4 ** a->align */
} else {
- align = s->align_mem ? MO_ALIGN : 0;
+ align = MO_ALIGN | (s->align_mem ? 0 : MO_ALIGN_TLB_ONLY);
}
/*
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 294762c283..fbf09f5c82 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -3039,20 +3039,22 @@ void tcg_dump_ops(TCGContext *s, FILE *f, bool have_prefs)
case INDEX_op_qemu_ld2:
case INDEX_op_qemu_st2:
{
- const char *s_al, *s_op, *s_at;
+ const char *s_al, *s_tlb, *s_op, *s_at;
MemOpIdx oi = op->args[k++];
MemOp mop = get_memop(oi);
unsigned ix = get_mmuidx(oi);
+ s_tlb = mop & MO_ALIGN_TLB_ONLY ? "tlb+" : "";
s_al = alignment_name[(mop & MO_AMASK) >> MO_ASHIFT];
s_op = ldst_name[mop & (MO_BSWAP | MO_SSIZE)];
s_at = atom_name[(mop & MO_ATOM_MASK) >> MO_ATOM_SHIFT];
- mop &= ~(MO_AMASK | MO_BSWAP | MO_SSIZE | MO_ATOM_MASK);
+ mop &= ~(MO_AMASK | MO_BSWAP | MO_SSIZE |
+ MO_ATOM_MASK | MO_ALIGN_TLB_ONLY);
/* If all fields are accounted for, print symbolically. */
if (!mop && s_al && s_op && s_at) {
- col += ne_fprintf(f, ",%s%s%s,%u",
- s_at, s_al, s_op, ix);
+ col += ne_fprintf(f, ",%s%s%s%s,%u",
+ s_at, s_al, s_tlb, s_op, ix);
} else {
mop = get_memop(oi);
col += ne_fprintf(f, ",$0x%x,%u", mop, ix);
--
2.43.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PULL 2/5] tcg: Simplify extract2 usage in tcg_gen_shifti_i64
2025-10-31 11:53 [PULL 0/5] tcg/linux-user/test patch queue Richard Henderson
2025-10-31 11:53 ` [PULL 1/5] accel/tcg: Introduce and use MO_ALIGN_TLB_ONLY Richard Henderson
@ 2025-10-31 11:53 ` Richard Henderson
2025-10-31 11:53 ` [PULL 3/5] tests/functional: Mark the MIPS replay tests as flaky Richard Henderson
` (3 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: Richard Henderson @ 2025-10-31 11:53 UTC (permalink / raw)
To: qemu-devel; +Cc: Philippe Mathieu-Daudé, Manos Pitsidianakis
The else after the TCG_TARGET_HAS_extract2 test is exactly
the same as what tcg_gen_extract2_i32 would emit itself.
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
tcg/tcg-op.c | 22 ++++------------------
1 file changed, 4 insertions(+), 18 deletions(-)
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index dfa5c38728..ab7b409be6 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -1818,30 +1818,16 @@ static inline void tcg_gen_shifti_i64(TCGv_i64 ret, TCGv_i64 arg1,
tcg_gen_movi_i32(TCGV_LOW(ret), 0);
}
} else if (right) {
- if (tcg_op_supported(INDEX_op_extract2, TCG_TYPE_I32, 0)) {
- tcg_gen_extract2_i32(TCGV_LOW(ret),
- TCGV_LOW(arg1), TCGV_HIGH(arg1), c);
- } else {
- tcg_gen_shri_i32(TCGV_LOW(ret), TCGV_LOW(arg1), c);
- tcg_gen_deposit_i32(TCGV_LOW(ret), TCGV_LOW(ret),
- TCGV_HIGH(arg1), 32 - c, c);
- }
+ tcg_gen_extract2_i32(TCGV_LOW(ret), TCGV_LOW(arg1),
+ TCGV_HIGH(arg1), c);
if (arith) {
tcg_gen_sari_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), c);
} else {
tcg_gen_shri_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), c);
}
} else {
- if (tcg_op_supported(INDEX_op_extract2, TCG_TYPE_I32, 0)) {
- tcg_gen_extract2_i32(TCGV_HIGH(ret),
- TCGV_LOW(arg1), TCGV_HIGH(arg1), 32 - c);
- } else {
- TCGv_i32 t0 = tcg_temp_ebb_new_i32();
- tcg_gen_shri_i32(t0, TCGV_LOW(arg1), 32 - c);
- tcg_gen_deposit_i32(TCGV_HIGH(ret), t0,
- TCGV_HIGH(arg1), c, 32 - c);
- tcg_temp_free_i32(t0);
- }
+ tcg_gen_extract2_i32(TCGV_HIGH(ret), TCGV_LOW(arg1),
+ TCGV_HIGH(arg1), 32 - c);
tcg_gen_shli_i32(TCGV_LOW(ret), TCGV_LOW(arg1), c);
}
}
--
2.43.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PULL 3/5] tests/functional: Mark the MIPS replay tests as flaky
2025-10-31 11:53 [PULL 0/5] tcg/linux-user/test patch queue Richard Henderson
2025-10-31 11:53 ` [PULL 1/5] accel/tcg: Introduce and use MO_ALIGN_TLB_ONLY Richard Henderson
2025-10-31 11:53 ` [PULL 2/5] tcg: Simplify extract2 usage in tcg_gen_shifti_i64 Richard Henderson
@ 2025-10-31 11:53 ` Richard Henderson
2025-10-31 11:53 ` [PULL 4/5] tests/functional: Mark the MIPS Debian Wheezy " Richard Henderson
` (2 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: Richard Henderson @ 2025-10-31 11:53 UTC (permalink / raw)
To: qemu-devel; +Cc: Philippe Mathieu-Daudé, Thomas Huth
From: Philippe Mathieu-Daudé <philmd@linaro.org>
MIPS test_replay.py often times out (likely hang) under GitLab CI:
2/21 qemu:func-thorough+func-mips64el-thorough+thorough / func-mips64el-replay TIMEOUT 180.12s killed by signal 15 SIGTERM
The console.log file is empty, and recording.logs only shows:
qemu-system-mips64el: terminating on signal 15 from pid 344
Since this is a long term issue affecting our CI, disable the tests.
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251031094118.28440-2-philmd@linaro.org>
---
tests/functional/mips/test_replay.py | 2 ++
tests/functional/mips64el/test_replay.py | 2 ++
2 files changed, 4 insertions(+)
diff --git a/tests/functional/mips/test_replay.py b/tests/functional/mips/test_replay.py
index 4327481e35..747835bf00 100755
--- a/tests/functional/mips/test_replay.py
+++ b/tests/functional/mips/test_replay.py
@@ -5,6 +5,7 @@
# SPDX-License-Identifier: GPL-2.0-or-later
from qemu_test import Asset, skipSlowTest
+from qemu_test import skipFlakyTest
from replay_kernel import ReplayKernelBase
@@ -16,6 +17,7 @@ class MipsReplay(ReplayKernelBase):
'linux-image-2.6.32-5-4kc-malta_2.6.32-48_mips.deb'),
'16ca524148afb0626f483163e5edf352bc1ab0e4fc7b9f9d473252762f2c7a43')
+ @skipFlakyTest("https://gitlab.com/qemu-project/qemu/-/issues/2013")
def test_replay_mips_malta(self):
self.set_machine('malta')
kernel_path = self.archive_extract(self.ASSET_KERNEL_2_63_2,
diff --git a/tests/functional/mips64el/test_replay.py b/tests/functional/mips64el/test_replay.py
index 26a6ccff3f..05cc585f85 100755
--- a/tests/functional/mips64el/test_replay.py
+++ b/tests/functional/mips64el/test_replay.py
@@ -5,6 +5,7 @@
# SPDX-License-Identifier: GPL-2.0-or-later
from qemu_test import Asset, skipUntrustedTest
+from qemu_test import skipFlakyTest
from replay_kernel import ReplayKernelBase
@@ -16,6 +17,7 @@ class Mips64elReplay(ReplayKernelBase):
'linux-image-2.6.32-5-5kc-malta_2.6.32-48_mipsel.deb'),
'35eb476f03be589824b0310358f1c447d85e645b88cbcd2ac02b97ef560f9f8d')
+ @skipFlakyTest("https://gitlab.com/qemu-project/qemu/-/issues/2013")
def test_replay_mips64el_malta(self):
self.set_machine('malta')
kernel_path = self.archive_extract(self.ASSET_KERNEL_2_63_2,
--
2.43.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PULL 4/5] tests/functional: Mark the MIPS Debian Wheezy tests as flaky
2025-10-31 11:53 [PULL 0/5] tcg/linux-user/test patch queue Richard Henderson
` (2 preceding siblings ...)
2025-10-31 11:53 ` [PULL 3/5] tests/functional: Mark the MIPS replay tests as flaky Richard Henderson
@ 2025-10-31 11:53 ` Richard Henderson
2025-10-31 11:53 ` [PULL 5/5] linux-user: permit sendto() with NULL buf and 0 len Richard Henderson
2025-11-01 8:37 ` [PULL 0/5] tcg/linux-user/test patch queue Richard Henderson
5 siblings, 0 replies; 7+ messages in thread
From: Richard Henderson @ 2025-10-31 11:53 UTC (permalink / raw)
To: qemu-devel; +Cc: Philippe Mathieu-Daudé, Daniel P . Berrangé
From: Philippe Mathieu-Daudé <philmd@linaro.org>
test_malta.py sometimes times out (likely hang) under GitLab CI:
1/57 qemu:func-thorough+func-mips-thorough+thorough / func-mips-malta TIMEOUT 480.11s killed by signal 15 SIGTERM
console.log shows a soft lockup failure:
06:46,426: INIT: version 2.88 booting
06:46,942: [[36minfo[39;49m] Using makefile-style concurrent boot in runlevel S.
06:47,378: findfs: unable to resolve 'UUID=042f1883-e9a5-4801-bb9b-667b5c8e87ea'
06:50,448: [....] Starting the hotplug events dispatcher: udevd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c.
06:52,269: [....] Synthesizing the initial hotplug events...module e1000: dangerous R_MIPS_LO16 REL relocation
07:17,707: BUG: soft lockup - CPU#0 stuck for 22s! [modprobe:208]
07:17,707: Modules linked in:
07:17,707: Cpu 0
07:17,708: $ 0 : 00000000 1000a400 0000003d 87808b00
07:17,708: $ 4 : 87808b00 87808bf0 00000000 00000000
07:17,709: $ 8 : 86862100 86862100 86862100 86862100
07:17,709: $12 : 86862100 00000000 00000001 86862100
07:17,709: $16 : 87808a00 86862100 1000a401 c008fa60
07:17,709: $20 : 86862100 8041d230 00000000 ffff0000
07:17,710: $24 : 00000000 77711470
07:17,710: $28 : 87bb6000 87bb7df8 8041d230 801f7388
07:17,710: Hi : 00000000
07:17,710: Lo : 00000000
07:17,711: epc : 801f7308 kfree+0x104/0x19c
07:17,711: Not tainted
07:17,711: ra : 801f7388 kfree+0x184/0x19c
07:17,712: Status: 1000a403 KERNEL EXL IE
07:17,712: Cause : 50808000
07:17,712: PrId : 00019300 (MIPS 24Kc)
07:45,707: BUG: soft lockup - CPU#0 stuck for 22s! [modprobe:208]
07:45,707: Modules linked in:
Reported-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251031094118.28440-3-philmd@linaro.org>
---
tests/functional/mips/test_malta.py | 2 ++
tests/functional/mips64/test_malta.py | 2 ++
tests/functional/mips64el/test_malta.py | 1 +
tests/functional/mipsel/test_malta.py | 2 ++
4 files changed, 7 insertions(+)
diff --git a/tests/functional/mips/test_malta.py b/tests/functional/mips/test_malta.py
index 30279f0ff2..7a734bc069 100755
--- a/tests/functional/mips/test_malta.py
+++ b/tests/functional/mips/test_malta.py
@@ -9,6 +9,7 @@
import os
from qemu_test import LinuxKernelTest, Asset, wait_for_console_pattern
+from qemu_test import skipFlakyTest
from qemu_test import exec_command_and_wait_for_pattern
@@ -181,6 +182,7 @@ def test_mips_malta_cpio(self):
'debian_wheezy_mips_standard.qcow2'),
'de03599285b8382ad309309a6c4869f6c6c42a5cfc983342bab9ec0dfa7849a2')
+ @skipFlakyTest("https://gitlab.com/qemu-project/qemu/-/issues/3109")
def test_wheezy(self):
kernel_path = self.ASSET_WHEEZY_KERNEL.fetch()
image_path = self.ASSET_WHEEZY_DISK.fetch()
diff --git a/tests/functional/mips64/test_malta.py b/tests/functional/mips64/test_malta.py
index a553d3c5bc..91c57c56af 100755
--- a/tests/functional/mips64/test_malta.py
+++ b/tests/functional/mips64/test_malta.py
@@ -5,6 +5,7 @@
# SPDX-License-Identifier: GPL-2.0-or-later
from qemu_test import LinuxKernelTest, Asset
+from qemu_test import skipFlakyTest
from mips.test_malta import mips_check_wheezy
@@ -20,6 +21,7 @@ class MaltaMachineConsole(LinuxKernelTest):
'debian_wheezy_mips_standard.qcow2'),
'de03599285b8382ad309309a6c4869f6c6c42a5cfc983342bab9ec0dfa7849a2')
+ @skipFlakyTest("https://gitlab.com/qemu-project/qemu/-/issues/3109")
def test_wheezy(self):
kernel_path = self.ASSET_WHEEZY_KERNEL.fetch()
image_path = self.ASSET_WHEEZY_DISK.fetch()
diff --git a/tests/functional/mips64el/test_malta.py b/tests/functional/mips64el/test_malta.py
index 170147bfcc..e37463dc29 100755
--- a/tests/functional/mips64el/test_malta.py
+++ b/tests/functional/mips64el/test_malta.py
@@ -102,6 +102,7 @@ def test_mips64el_malta_5KEc_cpio(self):
'debian_wheezy_mipsel_standard.qcow2'),
'454f09ae39f7e6461c84727b927100d2c7813841f2a0a5dce328114887ecf914')
+ @skipFlakyTest("https://gitlab.com/qemu-project/qemu/-/issues/3109")
def test_wheezy(self):
kernel_path = self.ASSET_WHEEZY_KERNEL.fetch()
image_path = self.ASSET_WHEEZY_DISK.fetch()
diff --git a/tests/functional/mipsel/test_malta.py b/tests/functional/mipsel/test_malta.py
index 427e163d19..59ab4a6058 100755
--- a/tests/functional/mipsel/test_malta.py
+++ b/tests/functional/mipsel/test_malta.py
@@ -10,6 +10,7 @@
# SPDX-License-Identifier: GPL-2.0-or-later
from qemu_test import QemuSystemTest, LinuxKernelTest, Asset
+from qemu_test import skipFlakyTest
from qemu_test import interrupt_interactive_console_until_pattern
from qemu_test import wait_for_console_pattern
@@ -69,6 +70,7 @@ def test_mips_malta32el_nanomips_64k_dbg(self):
'debian_wheezy_mipsel_standard.qcow2'),
'454f09ae39f7e6461c84727b927100d2c7813841f2a0a5dce328114887ecf914')
+ @skipFlakyTest("https://gitlab.com/qemu-project/qemu/-/issues/3109")
def test_wheezy(self):
kernel_path = self.ASSET_WHEEZY_KERNEL.fetch()
image_path = self.ASSET_WHEEZY_DISK.fetch()
--
2.43.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PULL 5/5] linux-user: permit sendto() with NULL buf and 0 len
2025-10-31 11:53 [PULL 0/5] tcg/linux-user/test patch queue Richard Henderson
` (3 preceding siblings ...)
2025-10-31 11:53 ` [PULL 4/5] tests/functional: Mark the MIPS Debian Wheezy " Richard Henderson
@ 2025-10-31 11:53 ` Richard Henderson
2025-11-01 8:37 ` [PULL 0/5] tcg/linux-user/test patch queue Richard Henderson
5 siblings, 0 replies; 7+ messages in thread
From: Richard Henderson @ 2025-10-31 11:53 UTC (permalink / raw)
To: qemu-devel
Cc: Peter Maydell, qemu-stable, Michael Tokarev,
Philippe Mathieu-Daudé
From: Peter Maydell <peter.maydell@linaro.org>
If you pass sendto() a NULL buffer, this is usually an error
(causing an EFAULT return); however if you pass a 0 length then
we should not try to validate the buffer provided. Instead we
skip the copying of the user data and possible processing
through fd_trans_target_to_host_data, and call the host syscall
with NULL, 0.
(unlock_user() permits a NULL buffer pointer for "do nothing"
so we don't need to special case the unlock code.)
Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3102
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251028142001.3011630-1-peter.maydell@linaro.org>
---
linux-user/syscall.c | 25 ++++++++++++++-----------
1 file changed, 14 insertions(+), 11 deletions(-)
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 8546f48a05..2060e561a2 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -3581,7 +3581,7 @@ static abi_long do_sendto(int fd, abi_ulong msg, size_t len, int flags,
abi_ulong target_addr, socklen_t addrlen)
{
void *addr;
- void *host_msg;
+ void *host_msg = NULL;
void *copy_msg = NULL;
abi_long ret;
@@ -3589,16 +3589,19 @@ static abi_long do_sendto(int fd, abi_ulong msg, size_t len, int flags,
return -TARGET_EINVAL;
}
- host_msg = lock_user(VERIFY_READ, msg, len, 1);
- if (!host_msg)
- return -TARGET_EFAULT;
- if (fd_trans_target_to_host_data(fd)) {
- copy_msg = host_msg;
- host_msg = g_malloc(len);
- memcpy(host_msg, copy_msg, len);
- ret = fd_trans_target_to_host_data(fd)(host_msg, len);
- if (ret < 0) {
- goto fail;
+ if (len != 0) {
+ host_msg = lock_user(VERIFY_READ, msg, len, 1);
+ if (!host_msg) {
+ return -TARGET_EFAULT;
+ }
+ if (fd_trans_target_to_host_data(fd)) {
+ copy_msg = host_msg;
+ host_msg = g_malloc(len);
+ memcpy(host_msg, copy_msg, len);
+ ret = fd_trans_target_to_host_data(fd)(host_msg, len);
+ if (ret < 0) {
+ goto fail;
+ }
}
}
if (target_addr) {
--
2.43.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [PULL 0/5] tcg/linux-user/test patch queue
2025-10-31 11:53 [PULL 0/5] tcg/linux-user/test patch queue Richard Henderson
` (4 preceding siblings ...)
2025-10-31 11:53 ` [PULL 5/5] linux-user: permit sendto() with NULL buf and 0 len Richard Henderson
@ 2025-11-01 8:37 ` Richard Henderson
5 siblings, 0 replies; 7+ messages in thread
From: Richard Henderson @ 2025-11-01 8:37 UTC (permalink / raw)
To: qemu-devel
On 10/31/25 12:53, Richard Henderson wrote:
> The following changes since commit 3728de31925ae9658e2ce3d1ff9b63c83609f310:
>
> Merge tag 'single-binary-20251030' ofhttps://github.com/philmd/qemu into staging (2025-10-31 10:26:34 +0100)
>
> are available in the Git repository at:
>
> https://gitlab.com/rth7680/qemu.git tags/pull-misc-20251031
>
> for you to fetch changes up to 0db2de22fcbf90adafab9d9dd1fc8203c66bfa75:
>
> linux-user: permit sendto() with NULL buf and 0 len (2025-10-31 12:50:15 +0100)
>
> ----------------------------------------------------------------
> linux-user: permit sendto() with NULL buf and 0 len
> tests/functional: Mark the MIPS replay tests as flaky
> tests/functional: Mark the MIPS Debian Wheezy tests as flaky
> accel/tcg: Introduce and use MO_ALIGN_TLB_ONLY
> tcg: Simplify extract2 usage in tcg_gen_shifti_i64
Applied, thanks. Please update https://wiki.qemu.org/ChangeLog/10.2 as appropriate.
r~
^ permalink raw reply [flat|nested] 7+ messages in thread