diff options
Diffstat (limited to 'results/classifier/mode-deepseek-r1:32b/output/system')
1162 files changed, 37220 insertions, 0 deletions
diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1020 b/results/classifier/mode-deepseek-r1:32b/output/system/1020 new file mode 100644 index 00000000..e3ff45b8 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1020 @@ -0,0 +1,18 @@ + + +Display mode 0x6 doubles lines +Description of problem: +When developing https://github.com/korneliuszo/ne2000xt I've occured problem with double lines in mode 0x06 of VGA display, problem doesn't exist in mode 0x05 +Steps to reproduce: +1. Call int 0x10, to setup video mode +2. put data into video ram (./cga.py -i 192.168.1.102 -I ~/a.png) +3. bad display +Additional information: +Bad display: + + +Same data, but in mode 0x05 + + +Same script as in bad display but run under 86Box + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1023 b/results/classifier/mode-deepseek-r1:32b/output/system/1023 new file mode 100644 index 00000000..23b570f8 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1023 @@ -0,0 +1,62 @@ + + +TCG & LA57 (5-level page tables) causes intermittent triple fault when setting %CR3 +Description of problem: +Enabling LA57 (5-level page tables) + TCG causes an intermittent triple fault when the kernel loads %cr3 in preparation for jumping to protected mode. It is quite rare, only happening on perhaps 1 in 20 runs. + +The observed behaviour for most users is that we see SeaBIOS messages, and no kernel messages, and qemu exits. (Triple fault in TCG code causes qemu to reset the virtual CPU, and we are using `-no-reboot` so that causes qemu to exit). + +There's a simple reproducer below. I enabled qemu -d options to capture the full instruction traces which can be found here: + +http://oirase.annexia.org/tmp/fullexec-failed (error case) +http://oirase.annexia.org/tmp/fullexec-good (successful run) + +I also added an `abort()` into qemu after the triple fault message in order to capture a stack trace, which can be found here: https://bugzilla.redhat.com/show_bug.cgi?id=2082806#c8 +Steps to reproduce: +1. Save the following script into a file, adjusting the two variables at the top as appropriate: + +``` +#!/bin/bash - + +# Point this to any kernel in /boot: +kernel=/boot/vmlinuz-4.18.0-387.el8.x86_64 + +# Point this to qemu: +qemu=/usr/libexec/qemu-kvm +#qemu=/home/rjones/d/qemu/build/qemu-system-x86_64 + +log=/tmp/log + +cpu=max +#cpu=max,la57=off + +while $qemu \ + -global virtio-blk-pci.scsi=off \ + -no-user-config \ + -nodefaults \ + -display none \ + -machine accel=tcg,graphics=off \ + -cpu "$cpu" \ + -m 2048 \ + -no-reboot \ + -rtc driftfix=slew \ + -no-hpet \ + -global kvm-pit.lost_tick_policy=discard \ + -kernel $kernel \ + -object rng-random,filename=/dev/urandom,id=rng0 \ + -device virtio-rng-pci,rng=rng0 \ + -device virtio-serial-pci \ + -serial stdio \ + -append "panic=1 console=ttyS0" >& $log && + grep -sq "Linux version" $log; do + echo -n . +done +``` + +2. Run the script. It will run qemu many times, checking that it reaches the kernel. +3. Eventually the script may exit. +4. Check `/tmp/log` and see if you only see SeaBIOS messages. +5. Modify the script to add `-cpu max,la57=off` and the error will stop happening. +Additional information: +Downstream bug report: https://bugzilla.redhat.com/show_bug.cgi?id=2082806 +LA57 was enabled here: https://gitlab.com/qemu-project/qemu/-/issues/661 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1024275 b/results/classifier/mode-deepseek-r1:32b/output/system/1024275 new file mode 100644 index 00000000..e8f4d457 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1024275 @@ -0,0 +1,14 @@ + + +bad iteraction between -daemonize and -nographic + + $ qemu -daemonize -nographic + $ _ + +After this, the terminal is switched to some weird mode, not processing cr/lf, and not showing the characters being typed (it is fixable by using `stty sane'). + +Something is seriously wrong here: When -daemonize is given, qemu not touch tty parameters at all. + +Thanks, + +/mjt \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1029 b/results/classifier/mode-deepseek-r1:32b/output/system/1029 new file mode 100644 index 00000000..f3d09533 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1029 @@ -0,0 +1,55 @@ + + +Unable to build qemu on macOS Monterey, M1 Pro +Description of problem: +qemu doesn't build, producing the following error: +``` +$ make +# snip +FAILED: libqemu-aarch64-softmmu.fa.p/target_arm_hvf_hvf.c.o +cc -Ilibqemu-aarch64-softmmu.fa.p -I. -I.. -Itarget/arm -I../target/arm -I../dtc/libfdt -I../capstone/include/capstone -Iqapi -Itrace -Iui -Iui/shader -I/opt/homebrew/Cellar/pixman/0.40.0/include/pixman-1 -I/opt/homebrew/Cellar/glib/2.72.1/include -I/opt/homebrew/Cellar/glib/2.72.1/include/glib-2.0 -I/opt/homebrew/Cellar/glib/2.72.1/lib/glib-2.0/include -I/opt/homebrew/opt/gettext/include -I/opt/homebrew/Cellar/pcre/8.45/include -fcolor-diagnostics -Wall -Winvalid-pch -std=gnu11 -O2 -g -iquote . -iquote /Users/duncanbayne/code/qemu -iquote /Users/duncanbayne/code/qemu/include -iquote /Users/duncanbayne/code/qemu/disas/libvixl -iquote /Users/duncanbayne/code/qemu/tcg/aarch64 -DOS_OBJECT_USE_OBJC=0 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -fno-common -fwrapv -Wold-style-definition -Wtype-limits -Wformat-security -Wformat-y2k -Winit-self -Wignored-qualifiers -Wempty-body -Wnested-externs -Wendif-labels -Wexpansion-to-defined -Wno-initializer-overrides -Wno-missing-include-dirs -Wno-shift-negative-value -Wno-string-plus-int -Wno-typedef-redefinition -Wno-tautological-type-limit-compare -Wno-psabi -fstack-protector-strong -DNEED_CPU_H '-DCONFIG_TARGET="aarch64-softmmu-config-target.h"' '-DCONFIG_DEVICES="aarch64-softmmu-config-devices.h"' -MD -MQ libqemu-aarch64-softmmu.fa.p/target_arm_hvf_hvf.c.o -MF libqemu-aarch64-softmmu.fa.p/target_arm_hvf_hvf.c.o.d -o libqemu-aarch64-softmmu.fa.p/target_arm_hvf_hvf.c.o -c ../target/arm/hvf/hvf.c +../target/arm/hvf/hvf.c:586:15: error: unknown type name 'ARMCPRegInfo'; did you mean 'ARMCPUInfo'? + const ARMCPRegInfo *ri; + ^~~~~~~~~~~~ + ARMCPUInfo +../target/arm/cpu-qom.h:38:3: note: 'ARMCPUInfo' declared here +} ARMCPUInfo; + ^ +../target/arm/hvf/hvf.c:589:14: error: implicit declaration of function 'get_arm_cp_reginfo' is invalid in C99 [-Werror,-Wimplicit-function-declaration] + ri = get_arm_cp_reginfo(arm_cpu->cp_regs, key); + ^ +../target/arm/hvf/hvf.c:589:12: warning: incompatible integer to pointer conversion assigning to 'const ARMCPUInfo *' (aka 'const struct ARMCPUInfo *') from 'int' [-Wint-conversion] + ri = get_arm_cp_reginfo(arm_cpu->cp_regs, key); + ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +../target/arm/hvf/hvf.c:591:26: error: no member named 'type' in 'struct ARMCPUInfo' + assert(!(ri->type & ARM_CP_NO_RAW)); + ~~ ^ +/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/include/assert.h:99:25: note: expanded from macro 'assert' + (__builtin_expect(!(e), 0) ? __assert_rtn(__func__, __ASSERT_FILE_NAME, __LINE__, #e) : (void)0) + ^ +../target/arm/hvf/hvf.c:591:33: error: use of undeclared identifier 'ARM_CP_NO_RAW' + assert(!(ri->type & ARM_CP_NO_RAW)); + ^ +1 warning and 4 errors generated. +ninja: build stopped: subcommand failed. +make[1]: *** [run-ninja] Error 1 +make: *** [all] Error 2 +``` +Steps to reproduce: +``` +git clone https://gitlab.com/qemu-project/qemu.git +cd qemu +./configure +make +``` +Additional information: +``` +$ cc --version +Apple clang version 13.1.6 (clang-1316.0.21.2.5) +Target: arm64-apple-darwin21.4.0 +Thread model: posix +InstalledDir: /Library/Developer/CommandLineTools/usr/bin + +$ ninja --version +1.10.2.git.kitware.jobserver-1 +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/103 b/results/classifier/mode-deepseek-r1:32b/output/system/103 new file mode 100644 index 00000000..90274f82 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/103 @@ -0,0 +1,3 @@ + + +9pfs does not honor open file handles on unlinked files diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1030 b/results/classifier/mode-deepseek-r1:32b/output/system/1030 new file mode 100644 index 00000000..2d327ed1 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1030 @@ -0,0 +1,3 @@ + + +Property 'rv32-riscv-cpu.x-v' not found diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1038 b/results/classifier/mode-deepseek-r1:32b/output/system/1038 new file mode 100644 index 00000000..5812cbce --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1038 @@ -0,0 +1,13 @@ + + +ppc 'max' CPU model is unlike the other targets 'max' CPU model +Description of problem: +On most targets the 'max' CPU model is either equivalent to 'host' (for KVM) or equivalent to all available CPU features (for TCG). + +On PPC64, however, this is not the case. Instead the 'max' model is an alias of the old '7400_v2.9' and simply doesn't work. + +This is confusing. At the very least the 'max' model alias should be deleted. Ideally a proper replacement would be introduced that matches semantics on other arches. +Steps to reproduce: +1. qemu-system-ppc64 -cpu max + +should be equiv to '-cpu host' or should expose all TCG features. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1042388 b/results/classifier/mode-deepseek-r1:32b/output/system/1042388 new file mode 100644 index 00000000..75c82ecd --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1042388 @@ -0,0 +1,16 @@ + + +qemu: Unsupported syscall: 257 (timer_create) + +Running qemu-arm-static for git HEAD. When I try to install ghc from debian into my arm chroot I get: + +Setting up ghc (7.4.1-4) ... +qemu: Unsupported syscall: 257 +ghc: timer_create: Function not implemented +qemu: Unsupported syscall: 257 +ghc-pkg: timer_create: Function not implemented +dpkg: error processing ghc (--configure): + subprocess installed post-installation script returned error exit status 1 +Errors were encountered while processing: + ghc +E: Sub-process /usr/bin/dpkg returned an error code (1) \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1047999 b/results/classifier/mode-deepseek-r1:32b/output/system/1047999 new file mode 100644 index 00000000..f4269ffe --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1047999 @@ -0,0 +1,90 @@ + + +error building process in sdlaudio.o + +./configure --enable-sdl --enable-virtfs --enable-vnc --enable-cocoa --enable-mixemu --enable-brlapi --enable-vnc-tls --enable-vnc-sasl --enable-vnc-jpeg --enable-vnc-png --enable-curses --enable-curl --enable-bluez --enable-tcg-interpreter --enable-nptl --enable-system --enable-user --enable-linux-user --enable-guest-base --enable-pie --enable-uuid --enable-vde --enable-attr --enable-docs --enable-vhost-net --enable-smartcard --enable-guest-agent --enable-seccomp --audio-drv-list="alsa oss sdl esd pa" --audio-card-list="ac97 es1370 sb16 cs4231a adlib gus hda" --prefix=/opt/qemu + +audio/sdlaudio.c:55: error: expected specifier-qualifier-list before ‘SDL_mutex’ +audio/sdlaudio.c: In function ‘sdl_logerr’: +audio/sdlaudio.c:69: warning: implicit declaration of function ‘SDL_GetError’ +audio/sdlaudio.c:69: warning: nested extern declaration of ‘SDL_GetError’ +audio/sdlaudio.c:69: warning: format ‘%s’ expects type ‘char *’, but argument 3 has type ‘int’ +audio/sdlaudio.c: In function ‘sdl_lock’: +audio/sdlaudio.c:74: warning: implicit declaration of function ‘SDL_LockMutex’ +audio/sdlaudio.c:74: warning: nested extern declaration of ‘SDL_LockMutex’ +audio/sdlaudio.c:74: error: ‘SDLAudioState’ has no member named ‘mutex’ +audio/sdlaudio.c: In function ‘sdl_unlock’: +audio/sdlaudio.c:83: warning: implicit declaration of function ‘SDL_UnlockMutex’ +audio/sdlaudio.c:83: warning: nested extern declaration of ‘SDL_UnlockMutex’ +audio/sdlaudio.c:83: error: ‘SDLAudioState’ has no member named ‘mutex’ +audio/sdlaudio.c: In function ‘sdl_post’: +audio/sdlaudio.c:92: warning: implicit declaration of function ‘SDL_SemPost’ +audio/sdlaudio.c:92: warning: nested extern declaration of ‘SDL_SemPost’ +audio/sdlaudio.c:92: error: ‘SDLAudioState’ has no member named ‘sem’ +audio/sdlaudio.c: In function ‘sdl_wait’: +audio/sdlaudio.c:101: warning: implicit declaration of function ‘SDL_SemWait’ +audio/sdlaudio.c:101: warning: nested extern declaration of ‘SDL_SemWait’ +audio/sdlaudio.c:101: error: ‘SDLAudioState’ has no member named ‘sem’ +audio/sdlaudio.c: In function ‘aud_to_sdlfmt’: +audio/sdlaudio.c:121: error: ‘AUDIO_S8’ undeclared (first use in this function) +audio/sdlaudio.c:121: error: (Each undeclared identifier is reported only once +audio/sdlaudio.c:121: error: for each function it appears in.) +audio/sdlaudio.c:124: error: ‘AUDIO_U8’ undeclared (first use in this function) +audio/sdlaudio.c:127: error: ‘AUDIO_S16LSB’ undeclared (first use in this function) +audio/sdlaudio.c:130: error: ‘AUDIO_U16LSB’ undeclared (first use in this function) +audio/sdlaudio.c: In function ‘sdl_to_audfmt’: +audio/sdlaudio.c:144: error: ‘AUDIO_S8’ undeclared (first use in this function) +audio/sdlaudio.c:149: error: ‘AUDIO_U8’ undeclared (first use in this function) +audio/sdlaudio.c:154: error: ‘AUDIO_S16LSB’ undeclared (first use in this function) +audio/sdlaudio.c:159: error: ‘AUDIO_U16LSB’ undeclared (first use in this function) +audio/sdlaudio.c:164: error: ‘AUDIO_S16MSB’ undeclared (first use in this function) +audio/sdlaudio.c:169: error: ‘AUDIO_U16MSB’ undeclared (first use in this function) +audio/sdlaudio.c: At top level: +audio/sdlaudio.c:182: error: expected ‘)’ before ‘*’ token +audio/sdlaudio.c: In function ‘sdl_close’: +audio/sdlaudio.c:222: error: ‘SDLAudioState’ has no member named ‘initialized’ +audio/sdlaudio.c:226: warning: implicit declaration of function ‘SDL_PauseAudio’ +audio/sdlaudio.c:226: warning: nested extern declaration of ‘SDL_PauseAudio’ +audio/sdlaudio.c:227: warning: implicit declaration of function ‘SDL_CloseAudio’ +audio/sdlaudio.c:227: warning: nested extern declaration of ‘SDL_CloseAudio’ +audio/sdlaudio.c:228: error: ‘SDLAudioState’ has no member named ‘initialized’ +audio/sdlaudio.c: At top level: +audio/sdlaudio.c:232: error: expected declaration specifiers or ‘...’ before ‘Uint8’ +audio/sdlaudio.c: In function ‘sdl_callback’: +audio/sdlaudio.c:274: error: ‘buf’ undeclared (first use in this function) +audio/sdlaudio.c: In function ‘sdl_init_out’: +audio/sdlaudio.c:339: error: ‘SDL_AudioSpec’ undeclared (first use in this function) +audio/sdlaudio.c:339: error: expected ‘;’ before ‘req’ +audio/sdlaudio.c:345: error: ‘req’ undeclared (first use in this function) +audio/sdlaudio.c:352: warning: implicit declaration of function ‘sdl_open’ +audio/sdlaudio.c:352: warning: nested extern declaration of ‘sdl_open’ +audio/sdlaudio.c:352: error: ‘obt’ undeclared (first use in this function) +audio/sdlaudio.c:370: error: ‘SDLAudioState’ has no member named ‘initialized’ +audio/sdlaudio.c: In function ‘sdl_audio_init’: +audio/sdlaudio.c:396: warning: implicit declaration of function ‘SDL_InitSubSystem’ +audio/sdlaudio.c:396: warning: nested extern declaration of ‘SDL_InitSubSystem’ +audio/sdlaudio.c:396: error: ‘SDL_INIT_AUDIO’ undeclared (first use in this function) +audio/sdlaudio.c:401: error: ‘SDLAudioState’ has no member named ‘mutex’ +audio/sdlaudio.c:401: warning: implicit declaration of function ‘SDL_CreateMutex’ +audio/sdlaudio.c:401: warning: nested extern declaration of ‘SDL_CreateMutex’ +audio/sdlaudio.c:402: error: ‘SDLAudioState’ has no member named ‘mutex’ +audio/sdlaudio.c:404: warning: implicit declaration of function ‘SDL_QuitSubSystem’ +audio/sdlaudio.c:404: warning: nested extern declaration of ‘SDL_QuitSubSystem’ +audio/sdlaudio.c:408: error: ‘SDLAudioState’ has no member named ‘sem’ +audio/sdlaudio.c:408: warning: implicit declaration of function ‘SDL_CreateSemaphore’ +audio/sdlaudio.c:408: warning: nested extern declaration of ‘SDL_CreateSemaphore’ +audio/sdlaudio.c:409: error: ‘SDLAudioState’ has no member named ‘sem’ +audio/sdlaudio.c:411: warning: implicit declaration of function ‘SDL_DestroyMutex’ +audio/sdlaudio.c:411: warning: nested extern declaration of ‘SDL_DestroyMutex’ +audio/sdlaudio.c:411: error: ‘SDLAudioState’ has no member named ‘mutex’ +audio/sdlaudio.c: In function ‘sdl_audio_fini’: +audio/sdlaudio.c:423: warning: implicit declaration of function ‘SDL_DestroySemaphore’ +audio/sdlaudio.c:423: warning: nested extern declaration of ‘SDL_DestroySemaphore’ +audio/sdlaudio.c:423: error: ‘SDLAudioState’ has no member named ‘sem’ +audio/sdlaudio.c:424: error: ‘SDLAudioState’ has no member named ‘mutex’ +audio/sdlaudio.c:425: error: ‘SDL_INIT_AUDIO’ undeclared (first use in this function) +make: *** [audio/sdlaudio.o] Error 1 + +System: +Linux insanelive 3.5.3-iatom-bfq #3 SMP Sat Sep 1 20:30:22 MSK 2012 i686 GNU/Linux +Debian 6.0.5 Squeeze \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1049 b/results/classifier/mode-deepseek-r1:32b/output/system/1049 new file mode 100644 index 00000000..6df2ffe2 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1049 @@ -0,0 +1,3 @@ + + +Have DeviceRealize return boolean indicating error diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/105 b/results/classifier/mode-deepseek-r1:32b/output/system/105 new file mode 100644 index 00000000..7608e2a4 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/105 @@ -0,0 +1,3 @@ + + +Gdb hangs when trying to single-step after an invalid instruction diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1053 b/results/classifier/mode-deepseek-r1:32b/output/system/1053 new file mode 100644 index 00000000..b35afcf3 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1053 @@ -0,0 +1,11 @@ + + +Executable PMP regions of size less than 4K always trigger an instruction access fault +Description of problem: +When configuring a PMP region that is less than 4K in size (Page size), and then trying to execute instructions inside said region, TCG always throws a PMP exception, even though the area allows code execution. +Additional information: +I've debugged the issue already, and it's happening because of the following optimization in TCG: + +TCG uses `get_page_addr_code_hostp` in order to try and get the translation cached for a whole page of instructions; if this function is unable to translate a whole page, it's supposed to simply return `-1`, and then the caller is supposed to translate and execute on a per-instruction basis. In this case `get_page_addr_code_hostp` calls `tlb_fill`, which then calls `riscv_cpu_tlb_fill`, which then calls `get_physical_address_pmp` to perform the PMP access checks. When said instructions are covered by a PMP region which is smaller than a page, this check then fails, since PMP regions must cover the whole access in order to allow it. At this point `riscv_cpu_tlb_fill` will see that a PMP fault happened, and since `probe` is set to false by `get_page_addr_code_hostp`, it will throw a RISC-V access fault exception instead of just returning a failure that `get_page_addr_code_hostp` can handle (by only accessing the memory of the specific instruction instead, which will be fully covered by the PMP region). + +I haven't tried to fix it myself (my first idea is to simply make `get_page_addr_code_hostp` set the probe flag), since I'm not sure if changing that part of TCG will affect other architectures that I'm not aware of. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1056 b/results/classifier/mode-deepseek-r1:32b/output/system/1056 new file mode 100644 index 00000000..4d3b7dd3 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1056 @@ -0,0 +1,3 @@ + + +Bad Performance of Windows 11 ARM64 VM on Windows 11 Qemu 7.0 Host System diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1057 b/results/classifier/mode-deepseek-r1:32b/output/system/1057 new file mode 100644 index 00000000..ade1a3fb --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1057 @@ -0,0 +1,25 @@ + + +AArch64: ISV is set to 1 in ESR_EL2 when taking a data abort with post-indexed instructions +Description of problem: +I think that I have a Qemu bug in my hands, but, I could still be missing something. Consider the following instruction: +`0x0000000000000000: C3 44 00 B8 str w3, [x6], #4` + +notice the last #4, I think this is what we would call a post-indexed instruction (falls into the category of instructions with writeback). As I understand it, those instructions should not have ISV=1 in ESR_EL2 when faulting. + +Here is the relevant part of the manual: + +``` +For other faults reported in ESR_EL2, ISV is 0 except for the following stage 2 aborts: +• AArch64 loads and stores of a single general-purpose register (including the register specified with 0b11111, including those with Acquire/Release semantics, but excluding Load Exclusive or Store Exclusive and excluding those with writeback). +``` + +However, I can see that Qemu sets ISV to 1 here. The ARM hardware that I tested gave me a value of ISV=0 for similar instructions. + +Another example of instruction: `0x00000000000002f8: 01 1C 40 38 ldrb w1, [x0, #1]!` +Steps to reproduce: +1. Run some hypervisor in EL2 +2. Create a guest running at EL1 that executes one of the mentioned instructions (and make the instruction fault by writing to some unmapped page in SLP) +3. Observe the value of ESR_EL2 on data abort + +Unfortunately, I cannot provide an image to reproduce this (the software is not open-source). But, I would be happy to help test a patch. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1058 b/results/classifier/mode-deepseek-r1:32b/output/system/1058 new file mode 100644 index 00000000..451594df --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1058 @@ -0,0 +1,10 @@ + + +NetBSD Sparc 8.2 OS doesn't seem to accept keyboard input (-nographic) +Description of problem: +The NetBSD appears to boot to the login prompt successfully, but when the login prompt appears, the system doesn't appear to recognize keyboard input and so I cannot login (I can't seem to boot into single user mode for the same reason). I can see the characters being typed on the terminal, but pressing the Enter key to submit input results in nothing. + +I've confirmed that this is an issue with NetBSD because I also attempted to spin up a Solaris 8 VM and a Solaris 2.6 VM with the `-nographic` flag turned on, and I was able to log in and interact with both of those virtual machines. +Steps to reproduce: +1. Use RHEL 8.6 as the base OS (**Update:** I've discovered that this error occurs under a different host OS too (Ubuntu 20.04 LTS in my case) +2. Start the NetBSD VM running the command as specified above diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1060 b/results/classifier/mode-deepseek-r1:32b/output/system/1060 new file mode 100644 index 00000000..4daa38b2 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1060 @@ -0,0 +1,35 @@ + + +RISC-V: mtval/stval is not correctly set to the instruction itself on illegal instructions +Description of problem: +QEMU 7.0 claims to support `stval`/`mtval` for illegal instructions, but `mtval`/`stval` is actually set to `0` +Steps to reproduce: +1. Assemble and link `mtval-illegal.elf`. The code simply sets up a trap handler and generates an illegal instruction exception + +2. Start QEMU with: + + ``` + qemu-system-riscv64 -cpu rv64,h=off -bios mtval-illegal.elf -nographic -icount shift=0 -s -S + ``` + +3. Attach with GDB: + + ``` + gdb mtval-illegal.elf + + # Within GDB + target extended-remote :1234 + break trap + disp $mtval + + # Keep single stepping until breakpoint + stepi + ``` + +4. When control flow reaches `trap`, `mtval` is written with `0` instead of the encoding of `csrw time, x0` (`0xc0101073`) +Additional information: +Writing `0` to `mtval` on a illegal instruction trap is allowed by the specs, but since the [changelog of QEMU 7.0][changelog] says it should be supported, I would consider it a bug. + +[changelog]: https://wiki.qemu.org/ChangeLog/7.0#RISC-V + +I encountered this when trying to figure out why my program worked with QEMU 6 but breaks with QEMU 7. It's more complicated, but in that case I managed to get `mtval` written with neither `0` nor the actual illegal instruction, but a different illegal instruction. I will try gathering up all the dependencies and write down the steps to reproduce if needed and if I find the time. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1060928 b/results/classifier/mode-deepseek-r1:32b/output/system/1060928 new file mode 100644 index 00000000..28de773c --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1060928 @@ -0,0 +1,293 @@ + + +Error in launch virtual server port + +.- configure +.- uname -a +.- script bash launcher +.- Error +.- output serial.c in statusRUN + +----------------------------------- + +.- configure + +./configure --target-list=i386-softmmu,x86_64-softmmu,\ +i386-linux-user,x86_64-linux-user --enable-vde --disable-vnc --enable-sdl \ +--audio-drv-list=oss,alsa,sdl,esd,pa \ +--audio-card-list=ac97,es1370,sb16,cs4231a,adlib,gus,hda &>status + +----------------------------------- + +.- uname -a +Linux Aspire5250 3.2.0-23-generic #36-Ubuntu SMP Tue Apr 10 20:39:51 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux + +----------------------------------- + +.- script bash launcher + +#!/bin/bash + +qemu-system-i386 -m 128 -display sdl -cpu pentium \ +-k es \ +-net nic,vlan=0,macaddr=52:54:00:12:02:04,model=pcnet \ +-net vde,vlan=0,sock=/var/run/vde2/tap0.ctl \ +-serial unix:/tmp/com1,server,nowait \ +-vga cirrus \ +-boot c -hda "/home/VirtualMachines/Discos/Hispa70_1.vmdk" \ +-cdrom "/home/VirtualMachines/CDROM/hf-7.0a.iso" 2>statusRUN + +echo -n "Pulsa enter para continuar . . . " && read REPLY + +----------------------------------- + +.- Error + +*** buffer overflow detected ***: qemu-system-i386 terminated +======= Backtrace: ========= +/lib/x86_64-linux-gnu/libc.so.6(__fortify_fail+0x37)[0x7f2759892007] +/lib/x86_64-linux-gnu/libc.so.6(+0x107f00)[0x7f2759890f00] +/lib/x86_64-linux-gnu/libc.so.6(+0x108fbe)[0x7f2759891fbe] +qemu-system-i386(+0xe5153)[0x7f275bfd8153] +qemu-system-i386(+0x1744f6)[0x7f275c0674f6] +qemu-system-i386(main+0xe77)[0x7f275bf5ef37] +/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xed)[0x7f27597aa76d] +qemu-system-i386(+0x70229)[0x7f275bf63229] +======= Memory map: ======== +41912000-43912000 rwxp 00000000 00:00 0 +7f2730000000-7f2730054000 rw-p 00000000 00:00 0 +7f2730054000-7f2734000000 ---p 00000000 00:00 0 +7f2736539000-7f273bdff000 r--p 00000000 08:05 1978631 /usr/lib/locale/locale-archive +7f273bdff000-7f273be00000 rw-p 00000000 00:00 0 +7f273be00000-7f2743e00000 rw-p 00000000 00:00 0 +7f2743e00000-7f2744000000 rw-p 00000000 00:00 0 +7f2744000000-7f2744021000 rw-p 00000000 00:00 0 +7f2744021000-7f2748000000 ---p 00000000 00:00 0 +7f274c000000-7f274c021000 rw-p 00000000 00:00 0 +7f274c021000-7f2750000000 ---p 00000000 00:00 0 +7f27500c5000-7f27500ca000 r-xp 00000000 08:05 1979531 /usr/lib/x86_64-linux-gnu/libXfixes.so.3.1.0 +7f27500ca000-7f27502c9000 ---p 00005000 08:05 1979531 /usr/lib/x86_64-linux-gnu/libXfixes.so.3.1.0 +7f27502c9000-7f27502ca000 r--p 00004000 08:05 1979531 /usr/lib/x86_64-linux-gnu/libXfixes.so.3.1.0 +7f27502ca000-7f27502cb000 rw-p 00005000 08:05 1979531 /usr/lib/x86_64-linux-gnu/libXfixes.so.3.1.0 +7f27502cb000-7f27502d4000 r-xp 00000000 08:05 1979549 /usr/lib/x86_64-linux-gnu/libXrender.so.1.3.0 +7f27502d4000-7f27504d3000 ---p 00009000 08:05 1979549 /usr/lib/x86_64-linux-gnu/libXrender.so.1.3.0 +7f27504d3000-7f27504d4000 r--p 00008000 08:05 1979549 /usr/lib/x86_64-linux-gnu/libXrender.so.1.3.0 +7f27504d4000-7f27504d5000 rw-p 00009000 08:05 1979549 /usr/lib/x86_64-linux-gnu/libXrender.so.1.3.0 +7f27504d5000-7f27504de000 r-xp 00000000 08:05 1979523 /usr/lib/x86_64-linux-gnu/libXcursor.so.1.0.2 +7f27504de000-7f27506dd000 ---p 00009000 08:05 1979523 /usr/lib/x86_64-linux-gnu/libXcursor.so.1.0.2 +7f27506dd000-7f27506de000 r--p 00008000 08:05 1979523 /usr/lib/x86_64-linux-gnu/libXcursor.so.1.0.2 +7f27506de000-7f27506df000 rw-p 00009000 08:05 1979523 /usr/lib/x86_64-linux-gnu/libXcursor.so.1.0.2 +7f27506df000-7f2750763000 rw-p 00000000 00:00 0 +7f2750775000-7f2750776000 rw-p 00000000 00:00 0 +7f2750776000-7f2750890000 rw-s 00000000 00:04 1736706 /SYSV00000000 (deleted) +7f2750890000-7f2750a00000 rw-p 00000000 00:00 0 +7f2750a00000-7f2751200000 rw-p 00000000 00:00 0 +7f2751200000-7f2751291000 rw-p 00000000 00:00 0 +7f2751291000-7f2751292000 ---p 00000000 00:00 0 +7f2751292000-7f2751a92000 rw-p 00000000 00:00 0 +7f2751a92000-7f2751a93000 ---p 00000000 00:00 0 +7f2751a93000-7f2752293000 rw-p 00000000 00:00 0 +7f2752293000-7f2752294000 ---p 00000000 00:00 0 +7f2752294000-7f2752a94000 rw-p 00000000 00:00 0 +7f2752a94000-7f2752a95000 ---p 00000000 00:00 0 +7f2752a95000-7f2753295000 rw-p 00000000 00:00 0 +7f2753295000-7f2753296000 ---p 00000000 00:00 0 +7f2753296000-7f2753a96000 rw-p 00000000 00:00 0 +7f2753a96000-7f2753aa2000 r-xp 00000000 08:05 660536 /lib/x86_64-linux-gnu/libnss_files-2.15.so +7f2753aa2000-7f2753ca1000 ---p 0000c000 08:05 660536 /lib/x86_64-linux-gnu/libnss_files-2.15.so +7f2753ca1000-7f2753ca2000 r--p 0000b000 08:05 660536 /lib/x86_64-linux-gnu/libnss_files-2.15.so +7f2753ca2000-7f2753ca3000 rw-p 0000c000 08:05 660536 /lib/x86_64-linux-gnu/libnss_files-2.15.so +7f2753ca3000-7f2753cad000 r-xp 00000000 08:05 660540 /lib/x86_64-linux-gnu/libnss_nis-2.15.so +7f2753cad000-7f2753ead000 ---p 0000a000 08:05 660540 /lib/x86_64-linux-gnu/libnss_nis-2.15.so +7f2753ead000-7f2753eae000 r--p 0000a000 08:05 660540 /lib/x86_64-linux-gnu/libnss_nis-2.15.so +7f2753eae000-7f2753eaf000 rw-p 0000b000 08:05 660540 /lib/x86_64-linux-gnu/libnss_nis-2.15.so +7f2753eaf000-7f2753eb7000 r-xp 00000000 08:05 660532 /lib/x86_64-linux-gnu/libnss_compat-2.15.so +7f2753eb7000-7f27540b6000 ---p 00008000 08:05 660532 /lib/x86_64-linux-gnu/libnss_compat-2.15.so +7f27540b6000-7f27540b7000 r--p 00007000 08:05 660532 /lib/x86_64-linux-gnu/libnss_compat-2.15.so +7f27540b7000-7f27540b8000 rw-p 00008000 08:05 660532 /lib/x86_64-linux-gnu/libnss_compat-2.15.so +7f27540b8000-7f2755cb9000 rw-p 00000000 00:00 0 +7f2755cb9000-7f2755cce000 r-xp 00000000 08:05 660506 /lib/x86_64-linux-gnu/libgcc_s.so.1 +7f2755cce000-7f2755ecd000 ---p 00015000 08:05 660506 /lib/x86_64-linux-gnu/libgcc_s.so.1 +7f2755ecd000-7f2755ece000 r--p 00014000 08:05 660506 /lib/x86_64-linux-gnu/libgcc_s.so.1 +7f2755ece000-7f2755ecf000 rw-p 00015000 08:05 660506 /lib/x86_64-linux-gnu/libgcc_s.so.1 +7f2755ecf000-7f2755ee7000 r-xp 00000000 08:05 660569 /lib/x86_64-linux-gnu/libresolv-2.15.so +7f2755ee7000-7f27560e7000 ---p 00018000 08:05 660569 /lib/x86_64-linux-gnu/libresolv-2.15.so +7f27560e7000-7f27560e8000 r--p 00018000 08:05 660569 /lib/x86_64-linux-gnu/libresolv-2.15.so +7f27560e8000-7f27560e9000 rw-p 00019000 08:05 660569 /lib/x86_64-linux-gnu/libresolv-2.15.so +7f27560e9000-7f27560eb000 rw-p 00000000 00:00 0 +7f27560eb000-7f27560f1000 r-xp 00000000 08:05 1979942 /usr/lib/x86_64-linux-gnu/libogg.so.0.7.1 +7f27560f1000-7f27562f0000 ---p 00006000 08:05 1979942 /usr/lib/x86_64-linux-gnu/libogg.so.0.7.1 +7f27562f0000-7f27562f1000 r--p 00005000 08:05 1979942 /usr/lib/x86_64-linux-gnu/libogg.so.0.7.1 +7f27562f1000-7f27562f2000 rw-p 00006000 08:05 1979942 /usr/lib/x86_64-linux-gnu/libogg.so.0.7.1 +7f27562f2000-7f275631d000 r-xp 00000000 08:05 1980105 /usr/lib/x86_64-linux-gnu/libvorbis.so.0.4.5 +7f275631d000-7f275651c000 ---p 0002b000 08:05 1980105 /usr/lib/x86_64-linux-gnu/libvorbis.so.0.4.5 +7f275651c000-7f275651d000 r--p 0002a000 08:05 1980105 /usr/lib/x86_64-linux-gnu/libvorbis.so.0.4.5 +7f275651d000-7f275651e000 rw-p 0002b000 08:05 1980105 /usr/lib/x86_64-linux-gnu/libvorbis.so.0.4.5 +7f275651e000-7f27567d1000 r-xp 00000000 08:05 1980107 /usr/lib/x86_64-linux-gnu/libvorbisenc.so.2.0.8 +7f27567d1000-7f27569d0000 ---p 002b3000 08:05 1980107 /usr/lib/x86_64-linux-gnu/libvorbisenc.so.2.0.8 +7f27569d0000-7f27569ec000 r--p 002b2000 08:05 1980107 /usr/lib/x86_64-linux-gnu/libvorbisenc.so.2.0.8 +7f27569ec000-7f27569ed000 rw-p 002ce000 08:05 1980107 /usr/lib/x86_64-linux-gnu/libvorbisenc.so.2.0.8 +7f27569ed000-7f2756a35000 r-xp 00000000 08:05 1979438 /usr/lib/x86_64-linux-gnu/libFLAC.so.8.2.0 +7f2756a35000-7f2756c35000 ---p 00048000 08:05 1979438 /usr/lib/x86_64-linux-gnu/libFLAC.so.8.2.0 +7f2756c35000-7f2756c36000 r--p 00048000 08:05 1979438 /usr/lib/x86_64-linux-gnu/libFLAC.so.8.2.0 +7f2756c36000-7f2756c37000 rw-p 00049000 08:05 1979438 /usr/lib/x86_64-linux-gnu/libFLAC.so.8.2.0 +7f2756c37000-7f2756c4e000 r-xp 00000000 08:05 660530 /lib/x86_64-linux-gnu/libnsl-2.15.so +7f2756c4e000-7f2756e4d000 ---p 00017000 08:05 660530 /lib/x86_64-linux-gnu/libnsl-2.15.so +7f2756e4d000-7f2756e4e000 r--p 00016000 08:05 660530 /lib/x86_64-linux-gnu/libnsl-2.15.so +7f2756e4e000-7f2756e4f000 rw-p 00017000 08:05 660530 /lib/x86_64-linux-gnu/libnsl-2.15.so +7f2756e4f000-7f2756e51000 rw-p 00000000 00:00 0 +7f2756e51000-7f2756e56000 r-xp 00000000 08:05 1979527 /usr/lib/x86_64-linux-gnu/libXdmcp.so.6.0.0 +7f2756e56000-7f2757055000 ---p 00005000 08:05 1979527 /usr/lib/x86_64-linux-gnu/libXdmcp.so.6.0.0 +7f2757055000-7f2757056000 r--p 00004000 08:05 1979527 /usr/lib/x86_64-linux-gnu/libXdmcp.so.6.0.0 +7f2757056000-7f2757057000 rw-p 00005000 08:05 1979527 /usr/lib/x86_64-linux-gnu/libXdmcp.so.6.0.0 +7f2757057000-7f2757059000 r-xp 00000000 08:05 1979516 /usr/lib/x86_64-linux-gnu/libXau.so.6.0.0 +7f2757059000-7f2757258000 ---p 00002000 08:05 1979516 /usr/lib/x86_64-linux-gnu/libXau.so.6.0.0 +7f2757258000-7f2757259000 r--p 00001000 08:05 1979516 /usr/lib/x86_64-linux-gnu/libXau.so.6.0.0 +7f2757259000-7f275725a000 rw-p 00002000 08:05 1979516 /usr/lib/x86_64-linux-gnu/libXau.so.6.0.0 +7f275725a000-7f2757286000 r-xp 00000000 08:05 660525 /lib/x86_64-linux-gnu/libncursesw.so.5.9 +7f2757286000-7f2757485000 ---p 0002c000 08:05 660525 /lib/x86_64-linux-gnu/libncursesw.so.5.9 +7f2757485000-7f2757486000 r--p 0002b000 08:05 660525 /lib/x86_64-linux-gnu/libncursesw.so.5.9 +7f2757486000-7f2757487000 rw-p 0002c000 08:05 660525 /lib/x86_64-linux-gnu/libncursesw.so.5.9 +7f2757487000-7f2757578000 r-xp 00000000 08:05 660575 /lib/x86_64-linux-gnu/libslang.so.2.2.4 +7f2757578000-7f2757778000 ---p 000f1000 08:05 660575 /lib/x86_64-linux-gnu/libslang.so.2.2.4 +7f2757778000-7f275777c000 r--p 000f1000 08:05 660575 /lib/x86_64-linux-gnu/libslang.so.2.2.4 +7f275777c000-7f2757794000 rw-p 000f5000 08:05 660575 /lib/x86_64-linux-gnu/libslang.so.2.2.4 +7f2757794000-7f27577f8000 rw-p 00000000 00:00 0 +7f27577f8000-7f27578da000 r-xp 00000000 08:05 1980059 /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.16 +7f27578da000-7f2757ad9000 ---p 000e2000 08:05 1980059 /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.16 +7f2757ad9000-7f2757ae1000 r--p 000e1000 08:05 1980059 /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.16 +7f2757ae1000-7f2757ae3000 rw-p 000e9000 08:05 1980059 /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.16 +7f2757ae3000-7f2757af8000 rw-p 00000000 00:00 0 +7f2757af8000-7f2757afd000 r-xp 00000000 08:05 1979573 /usr/lib/x86_64-linux-gnu/libasyncns.so.0.3.1 +7f2757afd000-7f2757cfc000 ---p 00005000 08:05 1979573 /usr/lib/x86_64-linux-gnu/libasyncns.so.0.3.1 +7f2757cfc000-7f2757cfd000 r--p 00004000 08:05 1979573 /usr/lib/x86_64-linux-gnu/libasyncns.so.0.3.1 +7f2757cfd000-7f2757cfe000 rw-p 00005000 08:05 1979573 /usr/lib/x86_64-linux-gnu/libasyncns.so.0.3.1 +7f2757cfe000-7f2757d5e000 r-xp 00000000 08:05 1980037 /usr/lib/x86_64-linux-gnu/libsndfile.so.1.0.25 +7f2757d5e000-7f2757f5e000 ---p 00060000 08:05 1980037 /usr/lib/x86_64-linux-gnu/libsndfile.so.1.0.25 +7f2757f5e000-7f2757f60000 r--p 00060000 08:05 1980037 /usr/lib/x86_64-linux-gnu/libsndfile.so.1.0.25 +7f2757f60000-7f2757f61000 rw-p 00062000 08:05 1980037 /usr/lib/x86_64-linux-gnu/libsndfile.so.1.0.25 +7f2757f61000-7f2757f65000 rw-p 00000000 00:00 0 +7f2757f65000-7f2757f6d000 r-xp 00000000 08:05 660594 /lib/x86_64-linux-gnu/libwrap.so.0.7.6 +7f2757f6d000-7f275816c000 ---p 00008000 08:05 660594 /lib/x86_64-linux-gnu/libwrap.so.0.7.6 +7f275816c000-7f275816d000 r--p 00007000 08:05 660594 /lib/x86_64-linux-gnu/libwrap.so.0.7.6 +7f275816d000-7f275816e000 rw-p 00008000 08:05 660594 /lib/x86_64-linux-gnu/libwrap.so.0.7.6 +7f275816e000-7f275818b000 r-xp 00000000 08:05 1980136 /usr/lib/x86_64-linux-gnu/libxcb.so.1.1.0 +7f275818b000-7f275838a000 ---p 0001d000 08:05 1980136 /usr/lib/x86_64-linux-gnu/libxcb.so.1.1.0 +7f275838a000-7f275838b000 r--p 0001c000 08:05 1980136 /usr/lib/x86_64-linux-gnu/libxcb.so.1.1.0 +7f275838b000-7f275838c000 rw-p 0001d000 08:05 1980136 /usr/lib/x86_64-linux-gnu/libxcb.so.1.1.0 +7f275838c000-7f27583ae000 r-xp 00000000 08:05 1979609 /usr/lib/x86_64-linux-gnu/libcaca.so.0.99.17 +7f27583ae000-7f27585ae000 ---p 00022000 08:05 1979609 /usr/lib/x86_64-linux-gnu/libcaca.so.0.99.17 +7f27585ae000-7f27585af000 r--p 00022000 08:05 1979609 /usr/lib/x86_64-linux-gnu/libcaca.so.0.99.17 +7f27585af000-7f2758652000 rw-p 00023000 08:05 1979609 /usr/lib/x86_64-linux-gnu/libcaca.so.0.99.17 +7f2758652000-7f2758657000 rw-p 00000000 00:00 0 +7f2758657000-7f2758667000 r-xp 00000000 08:05 1979529 /usr/lib/x86_64-linux-gnu/libXext.so.6.4.0 +7f2758667000-7f2758866000 ---p 00010000 08:05 1979529 /usr/lib/x86_64-linux-gnu/libXext.so.6.4.0 +7f2758866000-7f2758867000 r--p 0000f000 08:05 1979529 /usr/lib/x86_64-linux-gnu/libXext.so.6.4.0 +7f2758867000-7f2758868000 rw-p 00010000 08:05 1979529 /usr/lib/x86_64-linux-gnu/libXext.so.6.4.0 +7f2758868000-7f275886b000 r-xp 00000000 08:05 1993708 /usr/lib/x86_64-linux-gnu/libpulse-simple.so.0.0.3 +7f275886b000-7f2758a6a000 ---p 00003000 08:05 1993708 /usr/lib/x86_64-linux-gnu/libpulse-simple.so.0.0.3 +7f2758a6a000-7f2758a6b000 r--p 00002000 08:05 1993708 /usr/lib/x86_64-linux-gnu/libpulse-simple.so.0.0.3 +7f2758a6b000-7f2758a6c000 rw-p 00003000 08:05 1993708 /usr/lib/x86_64-linux-gnu/libpulse-simple.so.0.0.3 +7f2758a6c000-7f2758a9b000 r-xp 00000000 08:05 1982675 /usr/lib/x86_64-linux-gnu/libaudiofile.so.1.0.0 +7f2758a9b000-7f2758c9b000 ---p 0002f000 08:05 1982675 /usr/lib/x86_64-linux-gnu/libaudiofile.so.1.0.0 +7f2758c9b000-7f2758c9d000 r--p 0002f000 08:05 1982675 /usr/lib/x86_64-linux-gnu/libaudiofile.so.1.0.0 +7f2758c9d000-7f2758c9e000 rw-p 00031000 08:05 1982675 /usr/lib/x86_64-linux-gnu/libaudiofile.so.1.0.0 +7f2758c9e000-7f2758ce0000 r-xp 00000000 08:05 660497 /lib/x86_64-linux-gnu/libdbus-1.so.3.5.8 +7f2758ce0000-7f2758ee0000 ---p 00042000 08:05 660497 /lib/x86_64-linux-gnu/libdbus-1.so.3.5.8 +7f2758ee0000-7f2758ee1000 r--p 00042000 08:05 660497 /lib/x86_64-linux-gnu/libdbus-1.so.3.5.8 +7f2758ee1000-7f2758ee2000 rw-p 00043000 08:05 660497 /lib/x86_64-linux-gnu/libdbus-1.so.3.5.8 +7f2758ee2000-7f2758f3e000 r-xp 00000000 08:05 1993709 /usr/lib/x86_64-linux-gnu/libpulsecommon-1.1.so +7f2758f3e000-7f275913e000 ---p 0005c000 08:05 1993709 /usr/lib/x86_64-linux-gnu/libpulsecommon-1.1.so +7f275913e000-7f275913f000 r--p 0005c000 08:05 1993709 /usr/lib/x86_64-linux-gnu/libpulsecommon-1.1.so +7f275913f000-7f2759140000 rw-p 0005d000 08:05 1993709 /usr/lib/x86_64-linux-gnu/libpulsecommon-1.1.so +7f2759140000-7f2759147000 r-xp 00000000 08:05 1979876 /usr/lib/x86_64-linux-gnu/libjson.so.0.0.1 +7f2759147000-7f2759346000 ---p 00007000 08:05 1979876 /usr/lib/x86_64-linux-gnu/libjson.so.0.0.1 +7f2759346000-7f2759347000 r--p 00006000 08:05 1979876 /usr/lib/x86_64-linux-gnu/libjson.so.0.0.1 +7f2759347000-7f2759348000 rw-p 00007000 08:05 1979876 /usr/lib/x86_64-linux-gnu/libjson.so.0.0.1./RUN_HISPA_1: línea 17: 2952 Abortado (`core' generado) qemu-system-i386 -m 128 -display sdl -cpu pentium -k es -net nic,vlan=0,macaddr=52:54:00:12:02:04,model=pcnet -net vde,vlan=0,sock=/var/run/vde2/tap0.ctl -serial unix:/tmp/com1,server,nowait -vga cirrus -boot c -hda "/home/VirtualMachines/Discos/Hispa70_1.vmdk" -cdrom "/home/VirtualMachines/CDROM/hf-7.0a.iso" 2> statusRUN + +----------------------------------- + +.- output serial.c in statusRUN + +serial: write addr=0x01 val=0x02 +serial: read addr=0x01 val=0x02 +serial: read addr=0x02 val=0x02 +serial: write addr=0x01 val=0x00 +serial: read addr=0x01 val=0x00 +serial: write addr=0x01 val=0x00 +serial: read addr=0x01 val=0x00 +serial: write addr=0x01 val=0x00 +serial: read addr=0x03 val=0x00 +serial: write addr=0x03 val=0xbf +serial: speed=9600 parity=E data=8 stop=2 +serial: write addr=0x02 val=0x00 +serial: write addr=0x03 val=0x00 +serial: speed=9600 parity=N data=5 stop=1 +serial: write addr=0x02 val=0x01 +serial: read addr=0x02 val=0xc1 +serial: write addr=0x03 val=0x80 +serial: speed=9600 parity=N data=5 stop=1 +serial: read addr=0x02 val=0xc1 +serial: write addr=0x03 val=0xbf +serial: speed=9600 parity=E data=8 stop=2 +serial: read addr=0x02 val=0xc1 +serial: write addr=0x03 val=0x80 +serial: speed=9600 parity=N data=5 stop=1 +serial: write addr=0x02 val=0x21 +serial: read addr=0x02 val=0xc1 +serial: write addr=0x02 val=0x01 +serial: write addr=0x03 val=0x00 +serial: speed=9600 parity=N data=5 stop=1 +serial: write addr=0x04 val=0x00 +serial: write addr=0x02 val=0x06 +serial: read addr=0x00 val=0x00 +serial: write addr=0x01 val=0x00 +serial: write addr=0x02 val=0x06 +serial: read addr=0x05 val=0x60 +serial: read addr=0x00 val=0x00 +serial: read addr=0x02 val=0x01 +serial: read addr=0x06 val=0xb0 +serial: write addr=0x03 val=0x03 +serial: speed=9600 parity=N data=8 stop=1 +serial: write addr=0x04 val=0x0b +serial: write addr=0x01 val=0x0d +serial: read addr=0x05 val=0x60 +serial: read addr=0x00 val=0x00 +serial: read addr=0x02 val=0x01 +serial: read addr=0x06 val=0xb0 +serial: write addr=0x01 val=0x05 +serial: write addr=0x03 val=0x93 +serial: speed=9600 parity=N data=8 stop=1 +serial: write addr=0x00 val=0x0c +serial: speed=9600 parity=N data=8 stop=1 +serial: write addr=0x01 val=0x00 +serial: speed=9600 parity=N data=8 stop=1 +serial: write addr=0x03 val=0x13 +serial: speed=9600 parity=N data=8 stop=1 +serial: write addr=0x02 val=0x01 +serial: write addr=0x02 val=0x81 +serial: read addr=0x06 val=0xb0 +serial: write addr=0x04 val=0x09 +serial: read addr=0x05 val=0x60 +serial: read addr=0x06 val=0xb0 +serial: write addr=0x01 val=0x05 +serial: read addr=0x02 val=0xc1 +serial: read addr=0x06 val=0xb0 +serial: write addr=0x01 val=0x05 +serial: write addr=0x03 val=0x96 +serial: speed=9600 parity=N data=7 stop=2 +serial: write addr=0x00 val=0x60 +serial: speed=1200 parity=N data=7 stop=2 +serial: write addr=0x01 val=0x00 +serial: speed=1200 parity=N data=7 stop=2 +serial: write addr=0x03 val=0x16 +serial: speed=1200 parity=N data=7 stop=2 +serial: write addr=0x02 val=0x01 +serial: write addr=0x02 val=0x01 +serial: write addr=0x04 val=0x08 +serial: write addr=0x04 val=0x09 +serial: write addr=0x04 val=0x0b +serial: write addr=0x01 val=0x07 +serial: read addr=0x05 val=0x60 +serial: read addr=0x06 val=0xb0 +serial: write addr=0x00 val=0x41 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1062589 b/results/classifier/mode-deepseek-r1:32b/output/system/1062589 new file mode 100644 index 00000000..3aca92f3 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1062589 @@ -0,0 +1,90 @@ + + +Xp guest disk is corrupted when the data size exceeds 4 GB + +Host : +- 2.6.30.10 i686 pentium3 i386 GNU/Linux + +Guest : +- XPsp3 + +QEMU : +- QEMU emulator version 1.2.0 and 1.2.50 +- sudo /sources/qemu/i386-softmmu/qemu-system-i386 \ + -runas user -enable-kvm -rtc base=localtime -no-shutdown \ + -m 384 -usb -usbdevice tablet -vga std \ + -net nic,model=ne2k_pci -net tap,script=no,downscript=no \ + -drive file=/qemu/XP.img,index=0,media=disk,cache=writeback \ + -hdb /qemu/data.img \ + -drive index=2,media=cdrom,file=/jukebox/iso/xpProSP2.iso + +- image: /qemu/XP.img (before problem) +file format: qcow2 +virtual size: 10G (10737418240 bytes) +disk size: 3.9G +cluster_size: 65536 + +- chkdsk on Guest (before problem) +10474348 KB total disk space. +3519880 KB in 16982 files. +4440 KB in 898 indexes. +0 KB in bad sectors. +75980 KB in use by the system. +54432 KB occupied by the log file. +6874048 KB available on disk. + +4096 bytes in each allocation unit. +2618587 total allocation units on disk. +1718512 allocation units available on disk. + +- qemu-img check +Warning: cluster offset=0x42330b55100000 is after the end of the image file, can't properly check refcounts. +Warning: cluster offset=0x42330b55120000 is after the end of the image file, can't properly check refcounts. +ERROR l2_offset=42330b55110000: Table is not cluster aligned; L1 entry corrupted +Warning: cluster offset=0xa4d26d66440000 is after the end of the image file, can't properly check refcounts. +Warning: cluster offset=0xa4d26d66460000 is after the end of the image file, can't properly check refcounts. +ERROR l2_offset=a4d26d66453300: Table is not cluster aligned; L1 entry corrupted +ERROR: invalid cluster offset=0xad1f0047300000 +ERROR: invalid cluster offset=0xad1f0047320000 +ERROR l2_offset=ad1f0047309700: Table is not cluster aligned; L1 entry corrupted +ERROR OFLAG_COPIED: l2_offset=c452330b15090000 refcount=0 +Warning: cluster offset=0x52330b15080000 is after the end of the image file, can't properly check refcounts. +Warning: cluster offset=0x52330b150a0000 is after the end of the image file, can't properly check refcounts. +ERROR l2_offset=52330b15090000: Table is not cluster aligned; L1 entry corrupted +ERROR OFLAG_COPIED: l2_offset=cc5234077956330b refcount=0 +Warning: cluster offset=0x52340779560000 is after the end of the image file, can't properly check refcounts. +Warning: cluster offset=0x52340779580000 is after the end of the image file, can't properly check refcounts. +ERROR l2_offset=52340779563300: Table is not cluster aligned; L1 entry corrupted +ERROR refcount block 0 is not cluster aligned; refcount table entry corrupted +ERROR refcount block 1 is not cluster aligned; refcount table entry corrupted +ERROR refcount block 2 is outside image +ERROR refcount block 3 is not cluster aligned; refcount table entry corrupted +ERROR refcount block 4 is not cluster aligned; refcount table entry corrupted +ERROR refcount block 5 is not cluster aligned; refcount table entry corrupted +ERROR refcount block 6 is not cluster aligned; refcount table entry corrupted +ERROR refcount block 7 is not cluster aligned; refcount table entry corrupted +ERROR refcount block 8 is not cluster aligned; refcount table entry corrupted +ERROR refcount block 9 is not cluster aligned; refcount table entry corrupted +. +. +. +. +. +ERROR refcount block 16381 is not cluster aligned; refcount table entry corrupted +ERROR refcount block 16382 is outside image +ERROR refcount block 16383 is not cluster aligned; refcount table entry corrupted +ERROR cluster 0 refcount=0 reference=1 +ERROR cluster 1 refcount=0 reference=1 +ERROR cluster 3 refcount=0 reference=1 + +16396 errors were found on the image. +Data may be corrupted, or further writes to the image may corrupt it. + +8 internal errors have occurred during the check. + + +Hi, + +Everything is running pretty good until data size on disk C exceeds 4 GB. I Tried many options before figuring out that the problem occurs when data size exceeds 4 GB. I tried with QEMU 1.2.50, same problem. + +Best Regards. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1065 b/results/classifier/mode-deepseek-r1:32b/output/system/1065 new file mode 100644 index 00000000..c57507c8 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1065 @@ -0,0 +1,7 @@ + + +cputlb: uninitialized local variable in tlb_set_page_with_attrs cause SIGSEGV when a CPU access an unmapped IOMMU page +Description of problem: +When a TCG cpu accesses an unmapped page within an IOMMU region that causes a translation fault, QEMU SIGSEGVs in `io_readx`. +The reason was that in `address_space_translate_for_iotlb`, `xlat` is not set on a permission fault. +As a result, `xlat` in `tlb_set_page_with_attr` is uninitialized. This in turn causes various mis-calculation and eventually crashes in `io_readx`. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1067 b/results/classifier/mode-deepseek-r1:32b/output/system/1067 new file mode 100644 index 00000000..71eeb92b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1067 @@ -0,0 +1,86 @@ + + +SSH QEMU ISSUE by using with MacOs +Description of problem: +ssh connection between Qemu Image and Guest Host (MacOS) broken down after few minutes +Steps to reproduce: +1. Take the Qemu window and external ssh connection to backround, \ + wait until few minutes and the connection are frozen. \ + If we clicking to qemu window again, the ssh connection are available +Additional information: +The ssh connection settings by Macos: \ +Host * \ +AddKeysToAgent yes \ +IdentityFile ~/.ssh/id_rsa \ +IdentitiesOnly yes \ +ServerAliveInterval 3600 \ +TCPKeepAlive yes \ +ServerAliveCountMax 2 \ +\ +\ +SSH connection settings by Ubuntu Server: + +Include /etc/ssh/sshd_config.d/*.conf \ +\ +#Port 22 \ +#AddressFamily any \ +#ListenAddress 0.0.0.0 \ +#ListenAddress :: \ +#HostKey /etc/ssh/ssh_host_rsa_key \ +#HostKey /etc/ssh/ssh_host_ecdsa_key \ +#HostKey /etc/ssh/ssh_host_ed25519_key \ +#RekeyLimit default none \ +#SyslogFacility AUTH \ +#LogLevel INFO \ +#LoginGraceTime 2m \ +#PermitRootLogin prohibit-password \ +#StrictModes yes \ +#MaxAuthTries 6 \ +#MaxSessions 10 \ +#PubkeyAuthentication yes \ +#Expect .ssh/authorized_keys2 to be disregarded by default in future. \ +#AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2 \ +#AuthorizedPrincipalsFile none \ +#AuthorizedKeysCommand none \ +#AuthorizedKeysCommandUser nobody \ +#HostbasedAuthentication no \ +#IgnoreUserKnownHosts no \ +#IgnoreRhosts yes \ +#PasswordAuthentication yes \ +#PermitEmptyPasswords no \ +ChallengeResponseAuthentication no \ +#KerberosAuthentication no \ +#KerberosOrLocalPasswd yes \ +#KerberosTicketCleanup yes \ +#KerberosGetAFSToken no \ +#GSSAPIAuthentication no \ +#GSSAPICleanupCredentials yes \ +#GSSAPIStrictAcceptorCheck yes \ +#GSSAPIKeyExchange no \ +UsePAM yes \ +#AllowAgentForwarding yes \ +#AllowTcpForwarding yes \ +#GatewayPorts no \ +X11Forwarding yes \ +#X11DisplayOffset 10 \ +#X11UseLocalhost yes \ +#PermitTTY yes \ +PrintMotd no \ +#PrintLastLog yes \ +#TCPKeepAlive yes \ +#PermitUserEnvironment no \ +#Compression delayed \ +#ClientAliveInterval 0 \ +#ClientAliveCountMax 3 \ +#UseDNS no \ +#PidFile /var/run/sshd.pid \ +#MaxStartups 10:30:100 \ +#PermitTunnel no \ +#ChrootDirectory none \ +#VersionAddendum none \ +#Banner none \ +AcceptEnv LANG LC_* \ +PasswordAuthentication yes \ +ClientAliveInterval 600 \ +TCPKeepAlive yes \ +ClientAliveCountMax 10 \ diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1077838 b/results/classifier/mode-deepseek-r1:32b/output/system/1077838 new file mode 100644 index 00000000..2578936b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1077838 @@ -0,0 +1,32 @@ + + +qemu-nbd -r -c taints device for subsequent usage, even after -d + +Something about qemu-nbd -r -c /dev/nbd0 someimg leaves cruft behind - subsequent connections get marked readonly. + +This is on quantal, haven't checked precise or raring. + +To demonstrate: +# use one image +qemu-img create -f qcow2 /tmp/1.qcow2 100M +sudo qemu-nbd -c /dev/nbd2 /tmp/1.qcow2 +sudo mkfs -t ext4 /dev/nbd2 +sudo qemu-nbd -d /dev/nbd2 +# use a second one on the same nbd device, shows that reuse works: +qemu-img create -f qcow2 /tmp/2.qcow2 100M +sudo qemu-nbd -c /dev/nbd2 /tmp/2.qcow2 +sudo mkfs -t ext4 /dev/nbd2 +sudo qemu-nbd -d /dev/nbd2 +# connect an image in read only mode +sudo qemu-nbd -r -c /dev/nbd2 /tmp/2.qcow2 +sudo dumpe2fs /dev/nbd2 | head -n 3 +sudo qemu-nbd -d /dev/nbd2 +# now try to reuse in read-write mode again: +qemu-img create -f qcow2 /tmp/3.qcow2 100M +sudo qemu-nbd -c /dev/nbd2 /tmp/3.qcow2 +sudo mkfs -t ext4 /dev/nbd2 +# here it goes boom: +mke2fs 1.42.5 (29-Jul-2012) +/dev/nbd2: Operation not permitted while setting up superblock +# still need to cleanup +sudo qemu-nbd -d /dev/nbd2 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1078892 b/results/classifier/mode-deepseek-r1:32b/output/system/1078892 new file mode 100644 index 00000000..26043375 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1078892 @@ -0,0 +1,7 @@ + + +qemu doesn't general protection fault if there are reserved bits set in page-directory-pointer table entries + +While working on implementing 32-bit PAE mode in a custom operating system, which I was testing in QEMU, I noticed that my OS worked correctly, but resulted in a general protection fault when booted on VMware, VirtualBox, or bochs. + +According to the Intel Architecture Manual, Volume 3A, Section 4.4.1 "PDPTE Registers", "If any of the PDPTEs sets both the P flag (bit 0) and any reserved bit, the MOV to CR instruction causes a general-protection exception (#GP(0)) and the PDPTEs are not loaded." QEMU does not emulate this behavior. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1080 b/results/classifier/mode-deepseek-r1:32b/output/system/1080 new file mode 100644 index 00000000..504c5812 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1080 @@ -0,0 +1,3 @@ + + +Qemu build fails on Ubuntu diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1083 b/results/classifier/mode-deepseek-r1:32b/output/system/1083 new file mode 100644 index 00000000..17d35775 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1083 @@ -0,0 +1,3 @@ + + +Qemu on Windows - Emulate 64Bit CPU diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1087 b/results/classifier/mode-deepseek-r1:32b/output/system/1087 new file mode 100644 index 00000000..b6eec04c --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1087 @@ -0,0 +1,3 @@ + + +QEMU 7.0.0 fails to build on PowerPC diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1088 b/results/classifier/mode-deepseek-r1:32b/output/system/1088 new file mode 100644 index 00000000..fd08aaad --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1088 @@ -0,0 +1,3 @@ + + +QEMU 7.0.0 fails to build with linker that does not support --dynamic-list diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/109 b/results/classifier/mode-deepseek-r1:32b/output/system/109 new file mode 100644 index 00000000..a3afffb6 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/109 @@ -0,0 +1,3 @@ + + +Make Uninstall Rule Requested diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1093691 b/results/classifier/mode-deepseek-r1:32b/output/system/1093691 new file mode 100644 index 00000000..08079f19 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1093691 @@ -0,0 +1,34 @@ + + +QEMU build fails on OpenBSD/mips64 + +Building QEMU 1.2.1 on OpenBSD/mips64 fails as follows although I believe QEMU was also broken with 1.1.x as well.. + +cc -I/usr/obj/ports/qemu-1.2.1/qemu-1.2.1/slirp -I. -I/usr/obj/ports/qemu-1.2.1/qemu-1.2.1 -I/usr/obj/ports/qemu-1.2.1/qemu-1.2.1/fpu -I/usr/obj/ports/qemu-1.2.1/qemu-1.2.1/tcg - +I/usr/obj/ports/qemu-1.2.1/qemu-1.2.1/tcg/mips -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wall -Wundef -Wwrite-strings -Wmis +sing-prototypes -fno-strict-aliasing -I/usr/local/include -I/usr/X11R6/include -Wno-redundant-decls -DTIME_MAX=INT_MAX -Wendif-labels -Wmissing-include-dirs -Wnested-externs -Wf +ormat-security -Wformat-y2k -Winit-self -Wold-style-definition -I/usr/local/include/libpng -DHAS_AUDIO -DHAS_AUDIO_CHOICE -DTARGET_PHYS_ADDR_BITS=64 -I.. -I/usr/obj/ports/qemu-1 +.2.1/qemu-1.2.1/target-i386 -DNEED_CPU_H -I/usr/obj/ports/qemu-1.2.1/qemu-1.2.1/include -I/usr/local/include/libpng -pthread -I/usr/local/include/glib-2.0 -I/usr/local/lib/gli +b-2.0/include -I/usr/local/include -MMD -MP -MT tcg/tcg.o -MF tcg/tcg.d -O2 -pipe -c -o tcg/tcg.o /usr/obj/ports/qemu-1.2.1/qemu-1.2.1/tcg/tcg.c +In file included from /usr/obj/ports/qemu-1.2.1/qemu-1.2.1/tcg/tcg.c:50: +/usr/obj/ports/qemu-1.2.1/qemu-1.2.1/tcg/tcg-op.h: In function 'tcg_gen_div_i64': +/usr/obj/ports/qemu-1.2.1/qemu-1.2.1/tcg/tcg-op.h:1229: error: 'TCG_TARGET_HAS_div_i64' undeclared (first use in this function) +/usr/obj/ports/qemu-1.2.1/qemu-1.2.1/tcg/tcg-op.h:1229: error: (Each undeclared identifier is reported only once +/usr/obj/ports/qemu-1.2.1/qemu-1.2.1/tcg/tcg-op.h:1229: error: for each function it appears in.) +/usr/obj/ports/qemu-1.2.1/qemu-1.2.1/tcg/tcg-op.h:1231: error: 'TCG_TARGET_HAS_div2_i64' undeclared (first use in this function) +/usr/obj/ports/qemu-1.2.1/qemu-1.2.1/tcg/tcg-op.h: In function 'tcg_gen_rem_i64': +/usr/obj/ports/qemu-1.2.1/qemu-1.2.1/tcg/tcg-op.h:1248: error: 'TCG_TARGET_HAS_div_i64' undeclared (first use in this function) +/usr/obj/ports/qemu-1.2.1/qemu-1.2.1/tcg/tcg-op.h:1250: error: 'TCG_TARGET_HAS_div2_i64' undeclared (first use in this function) +/usr/obj/ports/qemu-1.2.1/qemu-1.2.1/tcg/tcg-op.h: In function 'tcg_gen_divu_i64': +/usr/obj/ports/qemu-1.2.1/qemu-1.2.1/tcg/tcg-op.h:1267: error: 'TCG_TARGET_HAS_div_i64' undeclared (first use in this function) +/usr/obj/ports/qemu-1.2.1/qemu-1.2.1/tcg/tcg-op.h:1269: error: 'TCG_TARGET_HAS_div2_i64' undeclared (first use in this function) +/usr/obj/ports/qemu-1.2.1/qemu-1.2.1/tcg/tcg-op.h: In function 'tcg_gen_remu_i64': +/usr/obj/ports/qemu-1.2.1/qemu-1.2.1/tcg/tcg-op.h:1286: error: 'TCG_TARGET_HAS_div_i64' undeclared (first use in this function) +/usr/obj/ports/qemu-1.2.1/qemu-1.2.1/tcg/tcg-op.h:1288: error: 'TCG_TARGET_HAS_div2_i64' undeclared (first use in this function) +/usr/obj/ports/qemu-1.2.1/qemu-1.2.1/tcg/tcg-op.h: In function 'tcg_gen_ext8s_i64': +/usr/obj/ports/qemu-1.2.1/qemu-1.2.1/tcg/tcg-op.h:1526: error: 'TCG_TARGET_HAS_ext8s_i64' undeclared (first use in this function) +/usr/obj/ports/qemu-1.2.1/qemu-1.2.1/tcg/tcg-op.h: In function 'tcg_gen_ext16s_i64': +/usr/obj/ports/qemu-1.2.1/qemu-1.2.1/tcg/tcg-op.h:1536: error: 'TCG_TARGET_HAS_ext16s_i64' undeclared (first use in this function) +... + +Attached is the full build log. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1095 b/results/classifier/mode-deepseek-r1:32b/output/system/1095 new file mode 100644 index 00000000..574f5388 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1095 @@ -0,0 +1,3 @@ + + +[QUESTION] What IF.... diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1095857 b/results/classifier/mode-deepseek-r1:32b/output/system/1095857 new file mode 100644 index 00000000..3117b09d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1095857 @@ -0,0 +1,13 @@ + + +incorrect handling of [r32] address (long mode) + +while executing in Long Mode (x86-64) instructions such as + +mov eax,[r15d] + +end up executing as + +mov eax,[r15] + +according to x86 programmer manuals the behavior of using the Address-Size override (in long mode) is supposed to ignore the high 32bits of the register. I use this fact in my operating system to reduce register usage (the high 32 bits of r15 holds other data). consequently a general protection exception occurs since the memory address isn't "canonical". this error doesn't always appear since the high 32 bits might not be zero in those conditions. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1096 b/results/classifier/mode-deepseek-r1:32b/output/system/1096 new file mode 100644 index 00000000..372be6f9 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1096 @@ -0,0 +1,3 @@ + + +New warning with GCC 13 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1103 b/results/classifier/mode-deepseek-r1:32b/output/system/1103 new file mode 100644 index 00000000..ce4b1e1b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1103 @@ -0,0 +1,3 @@ + + +VTCR fields are not checked when building parameters for aarch64 secure EL2 page table walk diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1104 b/results/classifier/mode-deepseek-r1:32b/output/system/1104 new file mode 100644 index 00000000..da3492b8 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1104 @@ -0,0 +1,3 @@ + + +PAN support for AArch32 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/111 b/results/classifier/mode-deepseek-r1:32b/output/system/111 new file mode 100644 index 00000000..e1192dc5 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/111 @@ -0,0 +1,3 @@ + + +[OSS-Fuzz] Assertion Failure: !in6_zero(&ip_addr) diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1110 b/results/classifier/mode-deepseek-r1:32b/output/system/1110 new file mode 100644 index 00000000..59a47640 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1110 @@ -0,0 +1,5 @@ + + +Add vhost-user-gpu support for cross architecture emulation +Additional information: +host:Android 12 with Linux kernel 4.14.186+ diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1119686 b/results/classifier/mode-deepseek-r1:32b/output/system/1119686 new file mode 100644 index 00000000..42f75ccf --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1119686 @@ -0,0 +1,17 @@ + + +Incorrect handling of icebp + +Wine conformance suite tests the behavior of various low-level Windows API functions. One of the tests involves checking the interaction of breakpoints and exceptions, and in particular the 'icebp' breakpoint. This test works on a Windows XP machine running either on the metal or in VMware ESX but fails when run in QEmu. + +To reproduce the issue grab the attached 'exception.exe' file and run it. If you get 'Test failed' lines like below then it means the problem is still present: + + exception.c:202: exception 0: 80000004 flags:0 addr:003F0000 + exception.c:208: Test failed: 0: Wrong exception address 003F0000/003F0001 + exception.c:214: this is the last test seen before the exception + exception: unhandled exception 80000004 at 003F0000 + exception.c:202: exception 0: c0000027 flags:2 addr:7C80E0B9 + exception.c:205: Test failed: 0: Wrong exception code c0000027/80000004 + exception.c:208: Test failed: 0: Wrong exception address 7C80E0B9/003F0001 + +Note that this bug was not present in QEmu 1.1.2+dfsg-5 (Debian Testing) but is now present in 1.4.0~rc0+dfsg-1exp (Debian Experimental). \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1121 b/results/classifier/mode-deepseek-r1:32b/output/system/1121 new file mode 100644 index 00000000..68200882 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1121 @@ -0,0 +1,72 @@ + + +Segmentation fault in aspeed-hace +Description of problem: + +Steps to reproduce: +1. run qemu-machine nf5280m7-bmc +2. it will seg falult when load fitimage +Additional information: +Captured by gdb + +``` +0x00007ffff6e08a06 in has_padding (pad_offset=<synthetic pointer>, total_msg_len=<synthetic pointer>, req_len=17, total_req_len=56476, iov=0x7ffff5e973c0) at ../hw/misc/aspeed_hace.c:129 +129 if (padding[*pad_offset] == 0x80) { +(gdb) p padding_size +$1 = 45 +(gdb) p *padding_offset +No symbol "padding_offset" in current context. +(gdb) p *pad_offset +$2 = 4294967268 +(gdb) bt +#0 0x00007ffff6e08a06 in has_padding (pad_offset=<synthetic pointer>, total_msg_len=<synthetic pointer>, req_len=17, total_req_len=56476, + iov=0x7ffff5e973c0) at ../hw/misc/aspeed_hace.c:129 +#1 gen_acc_mode_iov (cache=0x7ffff7fd5600 <iov_cache>, total_req_len=0x7ffff7fd55e4 <total_len>, count=0x7ffff7fd55e0 <count>, + req_len=0x7ffff5e973a8, id=<optimized out>, iov=0x7ffff5e973b0) at ../hw/misc/aspeed_hace.c:176 +#2 do_hash_operation (s=s@entry=0x7ffff60077b0, algo=3, sg_mode=sg_mode@entry=true, acc_mode=acc_mode@entry=true) + at ../hw/misc/aspeed_hace.c:235 +#3 0x00007ffff6e09001 in aspeed_hace_write (opaque=<optimized out>, addr=12, data=262488, size=<optimized out>) + at ../hw/misc/aspeed_hace.c:372 +#4 0x00007ffff706ad54 in memory_region_write_accessor (mr=mr@entry=0x7ffff6007ad0, addr=48, value=value@entry=0x7ffff5e98548, + size=size@entry=4, shift=<optimized out>, mask=mask@entry=4294967295, attrs=...) at ../softmmu/memory.c:492 +#5 0x00007ffff7068266 in access_with_adjusted_size_aligned (addr=addr@entry=48, value=value@entry=0x7ffff5e98548, size=size@entry=4, + access_size_min=<optimized out>, access_size_max=<optimized out>, access_fn=0x7ffff706acd0 <memory_region_write_accessor>, + mr=0x7ffff6007ad0, attrs=...) at ../softmmu/memory.c:553 +#6 0x00007ffff706c948 in memory_region_dispatch_write (mr=mr@entry=0x7ffff6007ad0, addr=addr@entry=48, data=<optimized out>, + data@entry=262488, op=op@entry=MO_32, attrs=...) at ../softmmu/memory.c:1650 +#7 0x00007ffff7157ea9 in io_writex (env=env@entry=0x7ffff5fe7f10, iotlbentry=0x7fff6803f200, mmu_idx=mmu_idx@entry=7, val=val@entry=262488, + addr=addr@entry=510459952, retaddr=retaddr@entry=140736149505328, op=MO_32) at ../accel/tcg/cputlb.c:1429 +#8 0x00007ffff715c7dc in store_helper (op=MO_32, retaddr=140736149505328, oi=<optimized out>, val=262488, addr=510459952, + env=0x7ffff5fe7f10) at ../accel/tcg/cputlb.c:2363 +#9 full_le_stl_mmu (env=0x7ffff5fe7f10, addr=<optimized out>, val=262488, oi=<optimized out>, retaddr=140736149505328) + at ../accel/tcg/cputlb.c:2451 +#10 0x00007fffb032c530 in code_gen_buffer () +#11 0x00007ffff714eace in cpu_tb_exec (cpu=cpu@entry=0x7ffff5fde1b0, itb=itb@entry=0x7fffb033e7c0 <code_gen_buffer+3401619>, + tb_exit=tb_exit@entry=0x7ffff5e98c2c) at ../accel/tcg/cpu-exec.c:357 +#12 0x00007ffff714fc68 in cpu_loop_exec_tb (tb_exit=0x7ffff5e98c2c, last_tb=<synthetic pointer>, + tb=0x7fffb033e7c0 <code_gen_buffer+3401619>, cpu=0x7ffff5fde1b0) at ../accel/tcg/cpu-exec.c:847 +#13 cpu_exec (cpu=cpu@entry=0x7ffff5fde1b0) at ../accel/tcg/cpu-exec.c:1006 +#14 0x00007ffff7163d54 in tcg_cpus_exec (cpu=cpu@entry=0x7ffff5fde1b0) at ../accel/tcg/tcg-accel-ops.c:68 +#15 0x00007ffff7163ea7 in mttcg_cpu_thread_fn (arg=arg@entry=0x7ffff5fde1b0) at ../accel/tcg/tcg-accel-ops-mttcg.c:96 +#16 0x00007ffff7344c31 in qemu_thread_start (args=<optimized out>) at ../util/qemu-thread-posix.c:556 +#17 0x00007ffff74c74eb in start_thread () +#18 0x00007ffff75649c0 in clone3 () +``` +the uboot: https://github.com/openbmc/u-boot/commit/0f245563c2cb3a6b4f1206db4f1a9f0325406094 + +we should remove the hash check, otherwise, the boot will stop at uboot-cli +``` +diff --git a/common/image-fit.c b/common/image-fit.c +index 3c8667f93d..c655b297e5 100644 +--- a/common/image-fit.c ++++ b/common/image-fit.c +@@ -1193,7 +1193,7 @@ static int fit_image_check_hash(const void *fit, int noffset, const void *data, + return -1; + } else if (memcmp(value, fit_value, value_len) != 0) { + *err_msgp = "Bad hash value"; +- return -1; ++ return 0; + } + + return 0; +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1127 b/results/classifier/mode-deepseek-r1:32b/output/system/1127 new file mode 100644 index 00000000..ff5e2922 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1127 @@ -0,0 +1,131 @@ + + +Various problems with running SunOS 4.1.4 +Description of problem: +Yes, I know, SunOS 4.1.4 is ancient, but I happened to find an original Solaris 1.1.2/SunOS 4.1.4 installation CD, and nostalgia got the better of me. + +It used to be possible to run SunOS 4.1.4 in QEMU 5.0.0, but starting with 6.0.0, whenever you try to boot, you see the following whenever SunOS tries to access a SCSI disk: + +``` +ok boot disk +Boot device: /iommu/sbus/espdma@f,400000/esp@f,800000/sd@3,0 File and args: +root on /iommu@f,e0000000/sbus@f,e0001000/espdma@f,400000/esp@f,800000/sd@3,0:a fstype 4.2 +Boot: vmunix +Size: 1548288+463688+225704 bytes +SuperSPARC: PAC ENABLED +SunOS Release 4.1.4 (GENERIC) #2: Fri Oct 14 11:09:47 PDT 1994 +Copyright (c) 1983-1993, Sun Microsystems, Inc. +cpu = SUNW,SPARCstation-20 +mod0 = TI,TMS390Z50 (mid = 8) +mem = 523836K (0x1ff8f000) +avail mem = 510947328 +cpu0 at Mbus 0x8 0x240000 +entering uniprocessor mode +Ethernet address = 52:54:0:12:34:56 +espdma0 at SBus slot f 0x400000 +esp0 at SBus slot f 0x800000 pri 4 (onboard) +esp0: data transfer overrun + State=DATA Last State=DATA_DONE + Latched stat=0x11<XZERO,IO> intr=0x10<BUS> fifo 0x0 + last msg out: EXTENDED; last msg in: COMMAND COMPLETE + DMA csr=0xa4240030<FLSH,INTEN> + addr=fff00034 last=fff00010 last_count=24 + Cmd dump for Target 3 Lun 0: + cdb=[ 0x12 0x0 0x0 0x0 0x24 0x0 ] + pkt_state 0xf<XFER,CMD,SEL,ARB> pkt_flags 0x9 pkt_statistics 0x0 + cmd_flags=0x5 cmd_timeout 0 + Mapped Dma Space: + Base = 0x10 Count = 0x24 + Transfer History: + Base = 0x10 Count = 0x24 + current phase 0x26=DATAIN stat=0x11 0x24 + current phase 0x1=CMD_START stat=0x12 0x12 + current phase 0x60=SELECT_SNDMSG stat=0x7 0x3 0x0 + current phase 0x23=SYNCHOUT stat=0x7 0x19 0xf + current phase 0xb=CMD_CMPLT stat=0x7 0x0 + current phase 0x27=STATUS stat=0x7 0x0 + current phase 0xb=CMD_CMPLT stat=0x13 + current phase 0x80=SEL_NO_ATN stat=0x0 0x3 0x0 + current phase 0x1=CMD_START stat=0x0 0x0 0x80 + current phase 0x1c=RESET stat=0x0 0x1f +``` + +This causes SunOS to ignore the disk, and later it tries to boot via ethernet instead. + +After some digging, I *think* I tracked down the problem. + +This commit seems to be what did it: + +commit 799d90d818ba38997e9f5de2163bbfc96256ac0b +Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> +Date: Thu Mar 4 22:10:58 2021 +0000 + + esp: transition to message out phase after SATN and stop command + + The SCSI bus should remain in the message out phase after the SATN and stop + command rather than transitioning to the command phase. A new ESPState variable + cmdbuf_cdb_offset is added which stores the offset of the CDB from the start + of cmdbuf when accumulating extended message out phase data. + + Currently any extended message out data is discarded in do_cmd() before the CDB + is processed in do_busid_cmd(). + + Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> + Reviewed-by: Laurent Vivier <laurent@vivier.eu> + Message-Id: <20210304221103.6369-38-mark.cave-ayland@ilande.co.uk> + +I determined this by rummaging through the changes to the esp.c driver between 5.0.0 and 6.0.0 until I stumbled across this one. I can make the problem go away with this simple change: + +``` +--- esp.c.orig 2022-04-19 12:10:27.000000000 -0700 ++++ esp.c 2022-07-25 19:57:06.602665000 -0700 +@@ -433,7 +433,7 @@ + trace_esp_handle_satn_stop(fifo8_num_used(&s->cmdfifo)); + s->do_cmd = 1; + s->cmdfifo_cdb_offset = 1; +- s->rregs[ESP_RSTAT] = STAT_MO; ++ s->rregs[ESP_RSTAT] = STAT_TC | STAT_CD /*STAT_MO*/; + s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC; + s->rregs[ESP_RSEQ] = SEQ_MO; + esp_raise_irq(s); +``` + +NOTE: I am not sure if this is a proper fix, as I don't know enough about SCSI or the esp controller. All I know is putting this back the way it was makes SunOS happy again. Unfortunately it may also break something else, so somebody more knowledgeable than I should investigate further. + +If you're worried that reproducing this will be difficult, don't be. I prepared detailed instructions, scripts and all the images you should need to create a virtual SunOS disk and install the OS on it. This includes the OpenProm images and installation ISO. + +You can find everything here (consult readme.txt for details): + +http://people.freebsd.org/~wpaul/sunos-qemu + +The quick install option is very simple. Once you finish writing the OS to the disk and try to boot off it the first time, you should encounter the error above. + +But wait, there's more. + +SunOS 4 has this quirk where it only works with CD-ROM drives that report a block size of 512 bytes, instead of the default of 2048. Now, I realize that just recently, there was a change committed that allows the guest to change the block size with the MODE SELECT command. However this doesn't seem to be good enough for SunOS (I tried it, it still hates the drive). Note that scsi-disk.c hard codes the block size for CD-ROMs to 2058 in scsi_cd_realize(). What would be really nice is if was possible to override this from the command line, and that addresses the problem quite nicely. + +At the same URL above, I also provided a small patch to scsi-disk.c which implements this feature. This allows the user to set the initial block size with logical_block_size=512 when specifying the device parameters. The qemu_sparc5.sh and qemu_sparc20.sh scripts show an example of this. + +One more thing: I wanted to simulate a SPARCstation 20, but I found that SunOS 4 would panic when I tried to boot it with this configuration, even if I used the correct SS20 OpenProm image. The problem here has to do with the SUNW,DBRIe device. QEMU doesn't simulate this device, but it creates dummy resources for it, including a PROM space. The problem is that this space is empty. This causes the OpenProm to create a node with an empty "name" property, which is a condition the SunOS kernel doesn't expect. The result is that the kernel tries to dereference a NULL pointer and panics. (The OpenProm code itself seems to let it slide.) + +To work around this, I patched the sun4m.c code to create the SUNW,DBRIe device such that its PROM space can actually be populated with an FCode image, and I created a simple one with a valid name property so that the kernel doesn't panic. SunOS complains later that it can't find the audio device because it's not actually implemented, but at least it doesn't crash. + +I don't know how this would actually be addressed in QEMU proper since the existing FCode images that QEMU uses come from OpenBios. + +Finally, one thing I haven't figured out is that using the -smp flag with SunOS 4 never seems to work. The OpenProms and the SunOS kernel only ever seem to detect one CPU. I am not that broken up about this though, because SunOS 4 never really did SMP very well to begin with. +Steps to reproduce: +Download all the files at: + +http://people.freebsd.org/~wpaul/sunos-qemu + +You can download just: + +http://people.freebsd.org/~wpaul/sunos-qemu/sunos-qemu.tar.gz + +if you want everything in one shot. + +Read the readme.txt file. This will walk you through trying to create a bootable SunOS system. You should apply the CD-ROM patch to scsi-disk.c and use the qemu_sparc5.sh script initially. This should allow you to install the miniroot from the CD image onto the virtual hard drive, but it will fail booting due to the esp controller problem. The qemu_sparc20.sh script will only boot successfully if you apply the sun4m.c patch and copy QEMU,dbri.bin to the QEMU firmware directory. +Additional information: +I'm not planning to provide a pull request for any of this. As I said, I'm not sure if my fixes are necessarily correct (especially the esp.c one). I'm satisfied that they work for me, but I want to leave it to the appropriate maintainers do decide how to best deal with these things. + +I would be happy to answer questions and test candidate fixes though. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1130 b/results/classifier/mode-deepseek-r1:32b/output/system/1130 new file mode 100644 index 00000000..f6d923c2 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1130 @@ -0,0 +1,31 @@ + + +error on run qemu-system-aarch64 -icount shift=1,align=off,sleep=on -smp 2 +Description of problem: +This issue happen with the most recent version. +* Compile parameters: +``` +./configure --target-list=aarch64-softmmu --prefix=pwd/release --disable-werror --enable-lto --enable-capstone --enable-system --enable-fdt --disable-xen --disable-kvm --enable-plugins +``` +* run： +``` +qemu-system-aarch64 -nographic -machine virt -cpu cortex-a57 -icount shift=1,align=off,sleep=on -smp 2 -vnc :2 -m 4080 -kernel /home/yuzy/mywork/linux/linux-5.15.30/arch/arm64/boot/Image.gz -initrd /home/yuzy/mywork/build/rootfs.cpio.gz +``` +* error occurred： +``` +** +ERROR:../accel/tcg/tcg-accel-ops.c:79:tcg_handle_interrupt: assertion failed: (qemu_mutex_iothread_locked()) +Aborted (core dumped) +``` +Steps to reproduce: +1. run qemu-system-aarch64 -machine virt -cpu cortex-a57 -icount shift=1,align=off,sleep=on -smp 2 -m 4080 -kernel Image.gz -initrd rootfs.cpio.gz +2. it will assertion failed: (qemu_mutex_iothread_locked()) +Additional information: +The following two situations are good： +``` +qemu-system-aarch64 -machine virt -cpu cortex-a57 -icount shift=1,align=off,sleep=on -smp 1 -m 4080 -kernel Image.gz -initrd rootfs.cpio.gz +``` +``` +qemu-system-aarch64 -machine virt -cpu cortex-a57 -smp 2 -m 4080 -kernel Image.gz -initrd rootfs.cpio.gz +``` +I assume the issues are: gic diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1131 b/results/classifier/mode-deepseek-r1:32b/output/system/1131 new file mode 100644 index 00000000..b774b7e9 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1131 @@ -0,0 +1,22 @@ + + +Multiboot: could not move values from provided mmap to another address directly. +Description of problem: +When using `-kernel` to load a Multiboot file which requires a memory map(MULTIBOOT_MEMORY_INFO flag) and trying to move the values in the provided mmap entries to another address directly, QEMU reboots. +```c +xxx = mmap->addr; +``` + +When moving with volatile, everything works well: +```c +volatile unsigned long long addr = mmap->addr; +xxx = addr; +``` +Steps to reproduce: +1. Source code here: [github/xtexChooser/toop/boot/multiboot/src/multiboot.c](https://github.com/xtexChooser/toop/blob/51153319d4f2320ae9a9277ffffad3f67a335fe9/boot/multiboot/src/multiboot.c#L32) +2. Minimized reproduce: [gist.github.com/xtexChooser/22017d662c8144b7abcb0b18c2afb09c](https://gist.github.com/xtexChooser/22017d662c8144b7abcb0b18c2afb09c) +3. I am sure that 0x00001210 is writable, it is empty in the memory map and QEMU works correctly when writing a zero value to here. +4. The reproducer is available without any module, when it works, it should keep running without any output, if QEMU reboots, the screen should flash as it clears and prints the BIOS information again. +5. If move with volatile(as the `multiboot_works.c` in reproducer), the reproducer works correctly. +Additional information: +# diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1133 b/results/classifier/mode-deepseek-r1:32b/output/system/1133 new file mode 100644 index 00000000..62e2d980 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1133 @@ -0,0 +1,12 @@ + + +unused memory filled with 0x00 instead of 0xFF +Description of problem: +Qemu, ever since it was made (so, since 2003), has this problem in DOS (either PC-DOS or MS-DOS and partly Windows 9x) not recognizing the memory available when the memory is filled with 0x00 but when it is filled with 0xFF it gets recognized properly, where should I patch qemu to solve this memory problem? + +Refer to +https://bugs.launchpad.net/qemu/+bug/1180923 +Steps to reproduce: +1. +2. +3. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1135 b/results/classifier/mode-deepseek-r1:32b/output/system/1135 new file mode 100644 index 00000000..2f468008 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1135 @@ -0,0 +1,14 @@ + + +Multiboot: invalid multiboot information block +Description of problem: +Breakpoint at 0x85d4, this is the entrypoint of this Multiboot loader. +According to the Multiboot specification, the EAX register should be a pointer to the Multiboot information block. When I am testing, it is 0x9500. However, when dumping the memory using `dump binary memory`, nearby memory areas are all zeros. + +When dumping some bigger memory aeras, I found that the module hasbeen loaded to the memory successfully, altough MBI was broken. +Steps to reproduce: + +Additional information: +multiboot: [multiboot](/uploads/55fdfcf30ada0af2d00badf11fcd308c/multiboot) + +toop: [toop](/uploads/de3b63ae021303c544105ba1498f3373/toop) diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1144 b/results/classifier/mode-deepseek-r1:32b/output/system/1144 new file mode 100644 index 00000000..cf233a76 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1144 @@ -0,0 +1,15 @@ + + +Cannot install on ArcoLinux +Description of problem: +I tried to install with my package manager +``` +paru -S qemu-git +``` +and got these errors +``` +qemu-git: /usr/share/qemu/bios-microvm.bin exists in filesystem (owned by seabios) +qemu-git: /usr/share/qemu/vgabios-ati.bin exists in filesystem (owned by seabios) +``` + +I tried searching around for a solution but I can't seem to find anything relevant to my situation. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1145 b/results/classifier/mode-deepseek-r1:32b/output/system/1145 new file mode 100644 index 00000000..a807746a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1145 @@ -0,0 +1,29 @@ + + +Support register name resolution in debugger part of monitor for `x` commands for ARM platforms +Additional information: +From the looks of `get_monitor_def()` function from `monitor/misc.c` it seems to be cross-target but somehow still doesn't work for some targets anyway. + +Then grepping for the actual target implementation, it seems only i386, PPC, SPARC, and M68K support it, but nor ARM, MIPS, RISC V, etc: +``` +[i] ℤ rg monitor_defs +target/sparc/monitor.c +59:const MonitorDef monitor_defs[] = { +162:const MonitorDef *target_monitor_defs(void) +164: return monitor_defs; + +target/ppc/monitor.c +86:const MonitorDef monitor_defs[] = { +102:const MonitorDef *target_monitor_defs(void) +104: return monitor_defs; + +target/i386/monitor.c +611:const MonitorDef monitor_defs[] = { +647:const MonitorDef *target_monitor_defs(void) +649: return monitor_defs; + +target/m68k/monitor.c +25:static const MonitorDef monitor_defs[] = { +59:const MonitorDef *target_monitor_defs(void) +61: return monitor_defs; +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1148 b/results/classifier/mode-deepseek-r1:32b/output/system/1148 new file mode 100644 index 00000000..91fe71b1 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1148 @@ -0,0 +1,273 @@ + + +Support Octal SPI mode and commands for NOR SPI devices +Additional information: +A good example of the Octal SPI (OPI) protocol use is in https://www.st.com/resource/en/application_note/dm00407776-octospi-interface-on-stm32-microcontrollers-stmicroelectronics.pdf + +It is also supported by the concrete drivers in Linux kernel: +- `drivers/mtd/spi-nor/core.c` +- `drivers/mtd/spi-nor/micron-st.c` +- `drivers/mtd/spi-nor/spansion.c` + +I tried to extract the Octal SPI part from that commit and got something like this, though obviously needs more cleaning up/improving: +```patch +--- + hw/block/m25p80.c | 93 ++++++++++++++++++++++++++++++++++------------- + 1 file changed, 68 insertions(+), 25 deletions(-) + +diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c +index 7d3d8b12e0..0aa46bf280 100644 +--- a/hw/block/m25p80.c ++++ b/hw/block/m25p80.c +@@ -361,6 +361,8 @@ typedef enum { + READ4 = 0x13, + FAST_READ = 0x0b, + FAST_READ4 = 0x0c, ++ O_FAST_READ = 0x9d, ++ O_FAST_READ4 = 0xfc, + DOR = 0x3b, + DOR4 = 0x3c, + QOR = 0x6b, +@@ -369,6 +371,11 @@ typedef enum { + DIOR4 = 0xbc, + QIOR = 0xeb, + QIOR4 = 0xec, ++ OOR = 0x8b, ++ OOR4 = 0x8c, ++ OOR4_MT35X = 0x7c, /* according mt35x datasheet */ ++ OIOR = 0xcb, ++ OIOR4 = 0xcc, + + PP = 0x02, + PP4 = 0x12, +@@ -379,6 +386,8 @@ typedef enum { + RDID_90 = 0x90, + RDID_AB = 0xab, + AAI_WP = 0xad, ++ OPP = 0x82, ++ OPP4 = 0x84, + + ERASE_4K = 0x20, + ERASE4_4K = 0x21, +@@ -422,6 +431,7 @@ typedef enum { + STATE_COLLECTING_DATA, + STATE_COLLECTING_VAR_LEN_DATA, + STATE_READING_DATA, ++ DUMMY_CYCLE_WAIT, + } CMDState; + + typedef enum { +@@ -654,12 +664,16 @@ static inline int get_addr_length(Flash *s) + case QPP_4: + case READ4: + case QIOR4: ++ case OIOR4: + case ERASE4_4K: + case ERASE4_32K: + case ERASE4_SECTOR: + case FAST_READ4: ++ case O_FAST_READ4: + case DOR4: + case QOR4: ++ case OOR4: ++ case OOR4_MT35X: + case DIOR4: + return 4; + default: +@@ -670,6 +684,7 @@ static inline int get_addr_length(Flash *s) + static void complete_collecting_data(Flash *s) + { + int i, n; ++ bool dummy_state = false; + + n = get_addr_length(s); + s->cur_addr = (n == 3 ? s->ear : 0); +@@ -689,9 +704,12 @@ static void complete_collecting_data(Flash *s) + case DPP: + case QPP: + case QPP_4: ++ case OPP: + case PP: ++ s->state = STATE_PAGE_PROGRAM; ++ break; ++ case OPP4: + case PP4: +- case PP4_4: + s->state = STATE_PAGE_PROGRAM; + break; + case AAI_WP: +@@ -702,16 +720,27 @@ static void complete_collecting_data(Flash *s) + case READ: + case READ4: + case FAST_READ: +- case FAST_READ4: ++ case O_FAST_READ: + case DOR: +- case DOR4: + case QOR: +- case QOR4: ++ case OOR: + case DIOR: +- case DIOR4: + case QIOR: ++ case OIOR: ++ case FAST_READ4: ++ case O_FAST_READ4: ++ case DOR4: ++ case QOR4: ++ case OOR4: ++ case OOR4_MT35X: ++ case DIOR4: + case QIOR4: +- s->state = STATE_READ; ++ case OIOR4: ++ if (dummy_state == false) { ++ s->state = STATE_READ; ++ } else { ++ s->state = DUMMY_CYCLE_WAIT; ++ } + break; + case ERASE_4K: + case ERASE4_4K: +@@ -744,7 +773,6 @@ static void complete_collecting_data(Flash *s) + s->write_enable = false; + } + break; +- case BRWR: + case EXTEND_ADDR_WRITE: + s->ear = s->data[0]; + break; +@@ -1038,6 +1066,7 @@ static void decode_qio_read_cmd(Flash *s) + s->needed_bytes += 3; + break; + default: ++ s->needed_bytes += 5; + break; + } + s->pos = 0; +@@ -1066,28 +1095,39 @@ static void decode_new_cmd(Flash *s, uint32_t value) + "M25P80: Invalid cmd within AAI programming sequence"); + } + ++ s->needed_bytes = 0; ++ + switch (value) { + ++ case ERASE4_SECTOR: ++ if (s->four_bytes_address_mode == false) { ++ s->needed_bytes += 1; ++ } + case ERASE_4K: +- case ERASE4_4K: + case ERASE_32K: +- case ERASE4_32K: + case ERASE_SECTOR: +- case ERASE4_SECTOR: ++ case OPP: + case PP: +- case PP4: ++ case QOR: ++ case OOR: ++ case FAST_READ: ++ case O_FAST_READ: ++ case DOR: + case DIE_ERASE: + case RDID_90: + case RDID_AB: +- s->needed_bytes = get_addr_length(s); ++ s->needed_bytes += get_addr_length(s); + s->pos = 0; + s->len = 0; + s->state = STATE_COLLECTING_DATA; + break; +- case READ: + case READ4: ++ if (s->four_bytes_address_mode == false) { ++ s->needed_bytes += 1; ++ } ++ case READ: + if (get_man(s) != MAN_NUMONYX || numonyx_mode(s) == MODE_STD) { +- s->needed_bytes = get_addr_length(s); ++ s->needed_bytes += get_addr_length(s); + s->pos = 0; + s->len = 0; + s->state = STATE_COLLECTING_DATA; +@@ -1098,7 +1138,7 @@ static void decode_new_cmd(Flash *s, uint32_t value) + break; + case DPP: + if (get_man(s) != MAN_NUMONYX || numonyx_mode(s) != MODE_QIO) { +- s->needed_bytes = get_addr_length(s); ++ s->needed_bytes += get_addr_length(s); + s->pos = 0; + s->len = 0; + s->state = STATE_COLLECTING_DATA; +@@ -1110,8 +1150,11 @@ static void decode_new_cmd(Flash *s, uint32_t value) + case QPP: + case QPP_4: + case PP4_4: ++ if (s->four_bytes_address_mode == false) { ++ s->needed_bytes += 1; ++ } + if (get_man(s) != MAN_NUMONYX || numonyx_mode(s) != MODE_DIO) { +- s->needed_bytes = get_addr_length(s); ++ s->needed_bytes += get_addr_length(s); + s->pos = 0; + s->len = 0; + s->state = STATE_COLLECTING_DATA; +@@ -1121,11 +1164,9 @@ static void decode_new_cmd(Flash *s, uint32_t value) + } + break; + +- case FAST_READ: + case FAST_READ4: + decode_fast_read_cmd(s); + break; +- case DOR: + case DOR4: + if (get_man(s) != MAN_NUMONYX || numonyx_mode(s) != MODE_QIO) { + decode_fast_read_cmd(s); +@@ -1134,14 +1175,13 @@ static void decode_new_cmd(Flash *s, uint32_t value) + "QIO mode\n", s->cmd_in_progress); + } + break; +- case QOR: + case QOR4: +- if (get_man(s) != MAN_NUMONYX || numonyx_mode(s) != MODE_DIO) { +- decode_fast_read_cmd(s); +- } else { +- qemu_log_mask(LOG_GUEST_ERROR, "M25P80: Cannot execute cmd %x in " +- "DIO mode\n", s->cmd_in_progress); +- } ++ case OOR4: ++ case OOR4_MT35X: ++ s->needed_bytes += 4; ++ s->pos = 0; ++ s->len = 0; ++ s->state = STATE_COLLECTING_DATA; + break; + + case DIOR: +@@ -1265,6 +1305,7 @@ static void decode_new_cmd(Flash *s, uint32_t value) + s->four_bytes_address_mode = false; + break; + case BRRD: ++ s->data_read_loop = false; + case EXTEND_ADDR_READ: + s->data[0] = s->ear; + s->pos = 0; +@@ -1475,6 +1516,8 @@ static uint32_t m25p80_transfer8(SSIPeripheral *ss, uint32_t tx) + } + break; + ++ case DUMMY_CYCLE_WAIT: ++ break; + default: + case STATE_IDLE: + decode_new_cmd(s, (uint8_t)tx); +-- +``` +There is also missing **0xfd** command for the DDR Octal I/O Fast Read for Micron MT35X chips. I am not sure if it's the same as the **0xfc** command in the Xilinx code though. + +Since I am not the author of the original commit, maybe Xilinx folks could take my patch, update/improve it and send to the mailing list. It will reduce the amount of the changes you have to apply in your fork as well :smile: + +cc @alistair23 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/115 b/results/classifier/mode-deepseek-r1:32b/output/system/115 new file mode 100644 index 00000000..2f090e8c --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/115 @@ -0,0 +1,3 @@ + + +shmat fails on 32-to-64 setup diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1151986 b/results/classifier/mode-deepseek-r1:32b/output/system/1151986 new file mode 100644 index 00000000..46727f65 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1151986 @@ -0,0 +1,232 @@ + + +buffer overflow after block-stream via QMP + +When a block-stream is initiated via QMP and the QMP socket is closed on client side before the job is finished, QEMU crashes with a buffer overflow. + +Afterwards I cannot boot from the last active image anymore. + +I was able to reproduce this with qemu-kvm and qemu-system-x86_64 on two different machines. + +Version: +QEMU emulator version 1.2.0 (qemu-kvm-1.2.0), Copyright (c) 2003-2008 Fabrice Bellard + +I started QEMU with the following script: + +qemu-kvm \ + -monitor vc \ + -m 512 \ + -hda "$1" \ + -net nic,vlan=0 \ + -net user,vlan=0 \ + -localtime \ + -smp 2 \ + -qmp tcp:localhost:4444,server,nowait + + +Backtrace: + +Formatting '/home/helge/images/vm01.2013-03-07_11:30:13.qcow2', fmt=qcow2 size=10485760000 backing_file='/home/helge/images/vm01.qcow2' backing_fmt='qcow2' encryption=off cluster_size=65536 lazy_refcounts=off +*** buffer overflow detected ***: qemu-kvm terminated +======= Backtrace: ========= +/usr/lib/libc.so.6(__fortify_fail+0x37)[0x7f054e91a8c7] +/usr/lib/libc.so.6(+0xfc9a0)[0x7f054e9189a0] +/usr/lib/libc.so.6(+0xfe837)[0x7f054e91a837] +qemu-kvm(+0xdb0dc)[0x7f055220b0dc] +qemu-kvm(+0x15f581)[0x7f055228f581] +qemu-kvm(main+0xf93)[0x7f05521a3e93] +/usr/lib/libc.so.6(__libc_start_main+0xf5)[0x7f054e83da15] +qemu-kvm(+0x77e8d)[0x7f05521a7e8d] +======= Memory map: ======== +7f051bdff000-7f051be00000 rw-p 00000000 00:00 0 +7f051be00000-7f053be00000 rw-p 00000000 00:00 0 +7f053be00000-7f053c000000 rw-p 00000000 00:00 0 +7f053c000000-7f053c021000 rw-p 00000000 00:00 0 +7f053c021000-7f0540000000 ---p 00000000 00:00 0 +7f05421e2000-7f05421f7000 r-xp 00000000 08:12 1175478 /usr/lib/libgcc_s.so.1 +7f05421f7000-7f05423f6000 ---p 00015000 08:12 1175478 /usr/lib/libgcc_s.so.1 +7f05423f6000-7f05423f7000 rw-p 00014000 08:12 1175478 /usr/lib/libgcc_s.so.1 +7f05423f7000-7f05423f8000 ---p 00000000 00:00 0 +7f05423f8000-7f0542bf8000 rw-p 00000000 00:00 0 [stack:27848] +7f0542bf8000-7f0542bfd000 r-xp 00000000 08:12 1198566 /usr/lib/libXfixes.so.3.1.0 +7f0542bfd000-7f0542dfd000 ---p 00005000 08:12 1198566 /usr/lib/libXfixes.so.3.1.0 +7f0542dfd000-7f0542dfe000 r--p 00005000 08:12 1198566 /usr/lib/libXfixes.so.3.1.0 +7f0542dfe000-7f0542dff000 rw-p 00006000 08:12 1198566 /usr/lib/libXfixes.so.3.1.0 +7f0542dff000-7f0542e00000 rw-p 00000000 00:00 0 +7f0542e00000-7f0543e00000 rw-p 00000000 00:00 0 +7f0543e00000-7f0544000000 rw-p 00000000 00:00 0 +7f0544000000-7f0544139000 rw-p 00000000 00:00 0 +7f0544139000-7f0548000000 ---p 00000000 00:00 0 +7f0548014000-7f054801e000 r-xp 00000000 08:12 1198746 /usr/lib/libXrender.so.1.3.0 +7f054801e000-7f054821d000 ---p 0000a000 08:12 1198746 /usr/lib/libXrender.so.1.3.0 +7f054821d000-7f054821e000 r--p 00009000 08:12 1198746 /usr/lib/libXrender.so.1.3.0 +7f054821e000-7f054821f000 rw-p 0000a000 08:12 1198746 /usr/lib/libXrender.so.1.3.0 +7f054821f000-7f0548228000 r-xp 00000000 08:12 1199189 /usr/lib/libXcursor.so.1.0.2 +7f0548228000-7f0548427000 ---p 00009000 08:12 1199189 /usr/lib/libXcursor.so.1.0.2 +7f0548427000-7f0548428000 r--p 00008000 08:12 1199189 /usr/lib/libXcursor.so.1.0.2 +7f0548428000-7f0548429000 rw-p 00009000 08:12 1199189 /usr/lib/libXcursor.so.1.0.2 +7f0548429000-7f0548721000 r--p 00000000 08:12 1175421 /usr/lib/locale/locale-archive +7f0548721000-7f0548733000 r-xp 00000000 08:12 1198126 /usr/lib/libXext.so.6.4.0 +7f0548733000-7f0548932000 ---p 00012000 08:12 1198126 /usr/lib/libXext.so.6.4.0 +7f0548932000-7f0548933000 r--p 00011000 08:12 1198126 /usr/lib/libXext.so.6.4.0 +7f0548933000-7f0548934000 rw-p 00012000 08:12 1198126 /usr/lib/libXext.so.6.4.0 +7f054895d000-7f05489c0000 rw-p 00000000 00:00 0 +7f054895d000-7f05489c0000 rw-p 00000000 00:00 0 [118/1982] +7f05489d3000-7f0548aed000 rw-s 00000000 00:04 69697543 /SYSV00000000 (deleted) +7f0548aed000-7f0548aee000 ---p 00000000 00:00 0 +7f0548aee000-7f05492ee000 rw-p 00000000 00:00 0 [stack:27612] +7f05492ee000-7f05492ef000 ---p 00000000 00:00 0 +7f05492ef000-7f0549aef000 rw-p 00000000 00:00 0 [stack:27611] +7f0549cef000-7f0549cf0000 rw-p 00000000 00:00 0 +7f0549cf0000-7f0549cf1000 ---p 00000000 00:00 0 +7f0549cf1000-7f054a4f1000 rw-p 00000000 00:00 0 [stack:27858] +7f054a4f1000-7f054a4fd000 r-xp 00000000 08:12 1175139 /usr/lib/libnss_files-2.17.so +7f054a4fd000-7f054a6fc000 ---p 0000c000 08:12 1175139 /usr/lib/libnss_files-2.17.so +7f054a6fc000-7f054a6fd000 r--p 0000b000 08:12 1175139 /usr/lib/libnss_files-2.17.so +7f054a6fd000-7f054a6fe000 rw-p 0000c000 08:12 1175139 /usr/lib/libnss_files-2.17.so +7f054a6fe000-7f054a704000 rw-p 00000000 00:00 0 +7f054a704000-7f054a719000 r-xp 00000000 08:12 1175108 /usr/lib/libnsl-2.17.so +7f054a719000-7f054a918000 ---p 00015000 08:12 1175108 /usr/lib/libnsl-2.17.so +7f054a918000-7f054a919000 r--p 00014000 08:12 1175108 /usr/lib/libnsl-2.17.so +7f054a919000-7f054a91a000 rw-p 00015000 08:12 1175108 /usr/lib/libnsl-2.17.so +7f054a91a000-7f054a91d000 rw-p 00000000 00:00 0 +7f054a91d000-7f054a923000 r-xp 00000000 08:12 1203255 /usr/lib/libogg.so.0.8.0 +7f054a923000-7f054ab22000 ---p 00006000 08:12 1203255 /usr/lib/libogg.so.0.8.0 +7f054ab22000-7f054ab23000 rw-p 00005000 08:12 1203255 /usr/lib/libogg.so.0.8.0 +7f054ab23000-7f054ab4f000 r-xp 00000000 08:12 1203266 /usr/lib/libvorbis.so.0.4.6 +7f054ab4f000-7f054ad4e000 ---p 0002c000 08:12 1203266 /usr/lib/libvorbis.so.0.4.6 +7f054ad4e000-7f054ad4f000 r--p 0002b000 08:12 1203266 /usr/lib/libvorbis.so.0.4.6 +7f054ad4f000-7f054ad50000 rw-p 0002c000 08:12 1203266 /usr/lib/libvorbis.so.0.4.6 +7f054ad50000-7f054b003000 r-xp 00000000 08:12 1203269 /usr/lib/libvorbisenc.so.2.0.9 +7f054b003000-7f054b202000 ---p 002b3000 08:12 1203269 /usr/lib/libvorbisenc.so.2.0.9 +7f054b202000-7f054b21e000 r--p 002b2000 08:12 1203269 /usr/lib/libvorbisenc.so.2.0.9 +7f054b21e000-7f054b21f000 rw-p 002ce000 08:12 1203269 /usr/lib/libvorbisenc.so.2.0.9 +7f054b21f000-7f054b269000 r-xp 00000000 08:12 1203337 /usr/lib/libFLAC.so.8.2.0 +7f054b269000-7f054b468000 ---p 0004a000 08:12 1203337 /usr/lib/libFLAC.so.8.2.0 +7f054b468000-7f054b46a000 rw-p 00049000 08:12 1203337 /usr/lib/libFLAC.so.8.2.0 +7f054b46a000-7f054b46f000 r-xp 00000000 08:12 1196541 /usr/lib/libXdmcp.so.6.0.0 +7f054b46f000-7f054b66e000 ---p 00005000 08:12 1196541 /usr/lib/libXdmcp.so.6.0.0 +7f054b66e000-7f054b66f000 r--p 00004000 08:12 1196541 /usr/lib/libXdmcp.so.6.0.0 +7f054b66f000-7f054b670000 rw-p 00005000 08:12 1196541 /usr/lib/libXdmcp.so.6.0.0 +7f054b670000-7f054b672000 r-xp 00000000 08:12 1196554 /usr/lib/libXau.so.6.0.0 +7f054b672000-7f054b872000 ---p 00002000 08:12 1196554 /usr/lib/libXau.so.6.0.0 +7f054b872000-7f054b873000 r--p 00002000 08:12 1196554 /usr/lib/libXau.so.6.0.0 +7f054b873000-7f054b874000 rw-p 00003000 08:12 1196554 /usr/lib/libXau.so.6.0.0 +7f054b874000-7f054b879000 r-xp 00000000 08:12 1203313 /usr/lib/libasyncns.so.0.3.1 +7f054b879000-7f054ba78000 ---p 00005000 08:12 1203313 /usr/lib/libasyncns.so.0.3.1 +7f054ba78000-7f054ba79000 r--p 00004000 08:12 1203313 /usr/lib/libasyncns.so.0.3.1 +7f054ba79000-7f054ba7a000 rw-p 00005000 08:12 1203313 /usr/lib/libasyncns.so.0.3.1 +7f054ba7a000-7f054bad9000 r-xp 00000000 08:12 1203348 /usr/lib/libsndfile.so.1.0.25 +7f054bad9000-7f054bcd9000 ---p 0005f000 08:12 1203348 /usr/lib/libsndfile.so.1.0.25 +7f054bcd9000-7f054bcdb000 r--p 0005f000 08:12 1203348 /usr/lib/libsndfile.so.1.0.25 +7f054bcdb000-7f054bcdc000 rw-p 00061000 08:12 1203348 /usr/lib/libsndfile.so.1.0.25 +7f054bcdc000-7f054bce0000 rw-p 00000000 00:00 0 +7f054bce0000-7f054bcfe000 r-xp 00000000 08:12 1216246 /usr/lib/libxcb.so.1.1.0 +7f054bcfe000-7f054befd000 ---p 0001e000 08:12 1216246 /usr/lib/libxcb.so.1.1.0 +7f054befd000-7f054befe000 r--p 0001d000 08:12 1216246 /usr/lib/libxcb.so.1.1.0 +7f054befe000-7f054beff000 rw-p 0001e000 08:12 1216246 /usr/lib/libxcb.so.1.1.0 +7f054beff000-7f054bf6c000 r-xp 00000000 08:12 1182009 /usr/lib/libgmp.so.10.1.1 +7f054bf6c000-7f054c16b000 ---p 0006d000 08:12 1182009 /usr/lib/libgmp.so.10.1.1 +7f054c16b000-7f054c16c000 r--p 0006c000 08:12 1182009 /usr/lib/libgmp.so.10.1.1 +7f054c16c000-7f054c175000 rw-p 0006d000 08:12 1182009 /usr/lib/libgmp.so.10.1.1 +7f054c175000-7f054c187000 r-xp 00000000 08:12 1195339 /usr/lib/libhogweed.so.2.3 +7f054c187000-7f054c386000 ---p 00012000 08:12 1195339 /usr/lib/libhogweed.so.2.3 +7f054c386000-7f054c387000 r--p 00011000 08:12 1195339 /usr/lib/libhogweed.so.2.3 +7f054c387000-7f054c388000 rw-p 00012000 08:12 1195339 /usr/lib/libhogweed.so.2.3 +7f054c388000-7f054c3b1000 r-xp 00000000 08:12 1195342 /usr/lib/libnettle.so.4.5 +7f054c3b1000-7f054c5b1000 ---p 00029000 08:12 1195342 /usr/lib/libnettle.so.4.5 +7f054c5b1000-7f054c5b2000 r--p 00029000 08:12 1195342 /usr/lib/libnettle.so.4.5 +7f054c5b2000-7f054c5b3000 rw-p 0002a000 08:12 1195342 /usr/lib/libnettle.so.4.5 +7f054c5b3000-7f054c5c5000 r-xp 00000000 08:12 1195333 /usr/lib/libtasn1.so.6.1.1 +7f054c5c5000-7f054c7c4000 ---p 00012000 08:12 1195333 /usr/lib/libtasn1.so.6.1.1 +7f054c7c4000-7f054c7c5000 r--p 00011000 08:12 1195333 /usr/lib/libtasn1.so.6.1.1 +7f054c7c5000-7f054c7c6000 rw-p 00012000 08:12 1195333 /usr/lib/libtasn1.so.6.1.1 +7f054c7c6000-7f054c7d9000 r-xp 00000000 08:12 1195353 /usr/lib/libp11-kit.so.0.0.0 +7f054c7d9000-7f054c9d8000 ---p 00013000 08:12 1195353 /usr/lib/libp11-kit.so.0.0.0 +7f054c9d8000-7f054c9d9000 r--p 00012000 08:12 1195353 /usr/lib/libp11-kit.so.0.0.0 +7f054c9d9000-7f054c9da000 rw-p 00013000 08:12 1195353 /usr/lib/libp11-kit.so.0.0.0 +7f054c9da000-7f054c9ed000 r-xp 00000000 08:12 1175130 /usr/lib/libresolv-2.17.so +7f054c9ed000-7f054cbed000 ---p 00013000 08:12 1175130 /usr/lib/libresolv-2.17.so +7f054cbed000-7f054cbee000 r--p 00013000 08:12 1175130 /usr/lib/libresolv-2.17.so +7f054cbee000-7f054cbef000 rw-p 00014000 08:12 1175130 /usr/lib/libresolv-2.17.so +7f054cbef000-7f054cbf1000 rw-p 00000000 00:00 0 +7f054cbf1000-7f054cbf9000 r-xp 00000000 08:12 1175116 /usr/lib/libcrypt-2.17.so +7f054cbf9000-7f054cdf8000 ---p 00008000 08:12 1175116 /usr/lib/libcrypt-2.17.so +7f054cdf8000-7f054cdf9000 r--p 00007000 08:12 1175116 /usr/lib/libcrypt-2.17.so +7f054cdf9000-7f054cdfa000 rw-p 00008000 08:12 1175116 /usr/lib/libcrypt-2.17.so +7f054cdfa000-7f054ce28000 rw-p 00000000 00:00 0 +7f054ce28000-7f054ce6c000 r-xp 00000000 08:12 1193776 /usr/lib/libdbus-1.so.3.7.2 +7f054ce6c000-7f054d06c000 ---p 00044000 08:12 1193776 /usr/lib/libdbus-1.so.3.7.2 +7f054d06c000-7f054d06d000 r--p 00044000 08:12 1193776 /usr/lib/libdbus-1.so.3.7.2 +7f054d06d000-7f054d06e000 rw-p 00045000 08:12 1193776 /usr/lib/libdbus-1.so.3.7.2 +7f054d06e000-7f054d0d4000 r-xp 00000000 08:12 792323 /usr/lib/pulseaudio/libpulsecommon-3.0.so +7f054d0d4000-7f054d2d3000 ---p 00066000 08:12 792323 /usr/lib/pulseaudio/libpulsecommon-3.0.so +7f054d2d3000-7f054d2d4000 r--p 00065000 08:12 792323 /usr/lib/pulseaudio/libpulsecommon-3.0.so +7f054d0d4000-7f054d2d3000 ---p 00066000 08:12 792323 /usr/lib/pulseaudio/libpulsecommon-3.0.so +7f054d2d3000-7f054d2d4000 r--p 00065000 08:12 792323 /usr/lib/pulseaudio/libpulsecommon-3.0.so +7f054d2d4000-7f054d2d6000 rw-p 00066000 08:12 792323 /usr/lib/pulseaudio/libpulsecommon-3.0.so +7f054d2d6000-7f054d2df000 r-xp 00000000 08:12 1184982 /usr/lib/libjson.so.0.1.0 +7f054d2df000-7f054d4de000 ---p 00009000 08:12 1184982 /usr/lib/libjson.so.0.1.0 +7f054d4de000-7f054d4df000 r--p 00008000 08:12 1184982 /usr/lib/libjson.so.0.1.0 +7f054d4df000-7f054d4e0000 rw-p 00009000 08:12 1184982 /usr/lib/libjson.so.0.1.0 +7f054d4e0000-7f054d6c0000 r-xp 00000000 08:12 1216755 /usr/lib/libcrypto.so.1.0.0 +7f054d6c0000-7f054d8c0000 ---p 001e0000 08:12 1216755 /usr/lib/libcrypto.so.1.0.0 +7f054d8c0000-7f054d8db000 r--p 001e0000 08:12 1216755 /usr/lib/libcrypto.so.1.0.0 +7f054d8db000-7f054d8e6000 rw-p 001fb000 08:12 1216755 /usr/lib/libcrypto.so.1.0.0 +7f054d8e6000-7f054d8ea000 rw-p 00000000 00:00 0 +7f054d8ea000-7f054d94c000 r-xp 00000000 08:12 1216754 /usr/lib/libssl.so.1.0.0 +7f054d94c000-7f054db4b000 ---p 00062000 08:12 1216754 /usr/lib/libssl.so.1.0.0 +7f054db4b000-7f054db4f000 r--p 00061000 08:12 1216754 /usr/lib/libssl.so.1.0.0 +7f054db4f000-7f054db56000 rw-p 00065000 08:12 1216754 /usr/lib/libssl.so.1.0.0 +7f054db56000-7f054db7d000 r-xp 00000000 08:12 1192299 /usr/lib/libssh2.so.1.0.1 +7f054db7d000-7f054dd7d000 ---p 00027000 08:12 1192299 /usr/lib/libssh2.so.1.0.1 +7f054dd7d000-7f054dd7e000 r--p 00027000 08:12 1192299 /usr/lib/libssh2.so.1.0.1 +7f054dd7e000-7f054dd7f000 rw-p 00028000 08:12 1192299 /usr/lib/libssh2.so.1.0.1 +7f054dd7f000-7f054dd80000 rw-p 00000000 00:00 0 +7f054dd80000-7f054dd83000 r-xp 00000000 08:12 1175118 /usr/lib/libdl-2.17.so +7f054dd83000-7f054df82000 ---p 00003000 08:12 1175118 /usr/lib/libdl-2.17.so +7f054df82000-7f054df83000 r--p 00002000 08:12 1175118 /usr/lib/libdl-2.17.so +7f054df83000-7f054df84000 rw-p 00003000 08:12 1175118 /usr/lib/libdl-2.17.so +7f054df84000-7f054df87000 r-xp 00000000 08:12 1195020 /usr/lib/libplds4.so +7f054df87000-7f054e186000 ---p 00003000 08:12 1195020 /usr/lib/libplds4.so +7f054e186000-7f054e187000 r--p 00002000 08:12 1195020 /usr/lib/libplds4.so +7f054e187000-7f054e188000 rw-p 00003000 08:12 1195020 /usr/lib/libplds4.so +7f054e188000-7f054e18c000 r-xp 00000000 08:12 1195021 /usr/lib/libplc4.so +7f054e18c000-7f054e38b000 ---p 00004000 08:12 1195021 /usr/lib/libplc4.so +7f054e38b000-7f054e38c000 r--p 00003000 08:12 1195021 /usr/lib/libplc4.so +7f054e38c000-7f054e38d000 rw-p 00004000 08:12 1195021 /usr/lib/libplc4.so +7f054e38d000-7f054e38e000 rw-p 00000000 00:00 0 +7f054e38e000-7f054e3b3000 r-xp 00000000 08:12 1195095 /usr/lib/libnssutil3.so +7f054e3b3000-7f054e5b2000 ---p 00025000 08:12 1195095 /usr/lib/libnssutil3.so +7f054e5b2000-7f054e5b8000 r--p 00024000 08:12 1195095 /usr/lib/libnssutil3.so +7f054e5b8000-7f054e5b9000 rw-p 0002a000 08:12 1195095 /usr/lib/libnssutil3.so +7f054e5b9000-7f054e61a000 r-xp 00000000 08:12 1183254 /usr/lib/libpcre.so.1.2.0 +7f054e61a000-7f054e81a000 ---p 00061000 08:12 1183254 /usr/lib/libpcre.so.1.2.0 +7f054e81a000-7f054e81b000 r--p 00061000 08:12 1183254 /usr/lib/libpcre.so.1.2.0 +7f054e81b000-7f054e81c000 rw-p 00062000 08:12 1183254 /usr/lib/libpcre.so.1.2.0 +7f054e81c000-7f054e9c0000 r-xp 00000000 08:12 1175073 /usr/lib/libc-2.17.so +7f054e9c0000-7f054ebbf000 ---p 001a4000 08:12 1175073 /usr/lib/libc-2.17.so +7f054ebbf000-7f054ebc3000 r--p 001a3000 08:12 1175073 /usr/lib/libc-2.17.so +7f054ebc3000-7f054ebc5000 rw-p 001a7000 08:12 1175073 /usr/lib/libc-2.17.so +7f054ebc5000-7f054ebca000 rw-p 00000000 00:00 0 +7f054ebca000-7f054ebdf000 r-xp 00000000 08:12 1181365 /usr/lib/libz.so.1.2.7 +7f054ebdf000-7f054edde000 ---p 00015000 08:12 1181365 /usr/lib/libz.so.1.2.7 +7f054edde000-7f054eddf000 r--p 00014000 08:12 1181365 /usr/lib/libz.so.1.2.7 +7f054eddf000-7f054ede0000 rw-p 00015000 08:12 1181365 /usr/lib/libz.so.1.2.7 +7f054ede0000-7f054eedd000 r-xp 00000000 08:12 1175074 /usr/lib/libm-2.17.so +7f054eedd000-7f054f0dc000 ---p 000fd000 08:12 1175074 /usr/lib/libm-2.17.so +7f054f0dc000-7f054f0dd000 r--p 000fc000 08:12 1175074 /usr/lib/libm-2.17.so +7f054f0dd000-7f054f0de000 rw-p 000fd000 08:12 1175074 /usr/lib/libm-2.17.so +7f054f0de000-7f054f211000 r-xp 00000000 08:12 1197495 /usr/lib/libX11.so.6.3.0 +7f054f211000-7f054f411000 ---p 00133000 08:12 1197495 /usr/lib/libX11.so.6.3.0 +7f054f411000-7f054f412000 r--p 00133000 08:12 1197495 /usr/lib/libX11.so.6.3.0 +7f054f412000-7f054f417000 rw-p 00134000 08:12 1197495 /usr/lib/libX11.so.6.3.0 +7f054f417000-7f054f47f000 r-xp 00000000 08:12 1207484 /usr/lib/libSDL-1.2.so.0.11.4 +7f054f47f000-7f054f67f000 ---p 00068000 08:12 1207484 /usr/lib/libSDL-1.2.so.0.11.4 +7f054f67f000-7f054f680000 r--p 00068000 08:12 1207484 /usr/lib/libSDL-1.2.so.0.11.4 +7f054f680000-7f054f681000 rw-p 00069000 08:12 1207484 /usr/lib/libSDL-1.2.so.0.11.4 +7f054f681000-7f054f6af000 rw-p 00000000 00:00 0 +7f054f6af000-7f054f7b1000 r-xp 00000000 08:12 1200422 /usr/lib/libgnutls.so.28.16.1 +7f054f7b1000-7f054f9b1000 ---p 00102000 08:12 1200422 /usr/lib/libgnutls.so.28.16.1 +7f054f9b1000-7f054f9b9000 r--p 00102000 08:12 1200422 /usr/lib/libgnutls.so.28.16.1 +7f054f9b9000-7f054f9bb000 rw-p 0010a000 08:12 1200422 /usr/lib/libgnutls.so.28.16.1 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1153 b/results/classifier/mode-deepseek-r1:32b/output/system/1153 new file mode 100644 index 00000000..bb97f400 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1153 @@ -0,0 +1,3 @@ + + +arm: wrong syndrome reported for FP and SIMD traps to AArch32 Hyp diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1154 b/results/classifier/mode-deepseek-r1:32b/output/system/1154 new file mode 100644 index 00000000..755446d0 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1154 @@ -0,0 +1,3 @@ + + +arm: M-profile loads and stores done via helpers should enforce alignment restrictions diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1156 b/results/classifier/mode-deepseek-r1:32b/output/system/1156 new file mode 100644 index 00000000..0a936d80 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1156 @@ -0,0 +1,3 @@ + + +Incorrect implementation of vmsumudm instruction diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1160 b/results/classifier/mode-deepseek-r1:32b/output/system/1160 new file mode 100644 index 00000000..5c57d2cd --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1160 @@ -0,0 +1,3 @@ + + +hw/riscv reset vector improvement diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1165 b/results/classifier/mode-deepseek-r1:32b/output/system/1165 new file mode 100644 index 00000000..939e0fcb --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1165 @@ -0,0 +1,5 @@ + + +About support LoongArch architecture +Additional information: +Start from Linux 5.19, maybe can find the compatible source code for LoongArch in the Linux Kernel source code archive. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1166 b/results/classifier/mode-deepseek-r1:32b/output/system/1166 new file mode 100644 index 00000000..427386f5 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1166 @@ -0,0 +1,27 @@ + + +Solaris 2.6 panic when debugging with gdb +Description of problem: +Running gdb with a breakpoint that gets hit triggers a panic: +``` +non parity synchronous error ctx=fa va=ef7d97c pa=c1a47c +``` + +One time I got of the following messages as well +``` +processor level 12 onboard interrupt not serviced +processor level 12 onboard interrupt not serviced +... +``` +Steps to reproduce: +1. Install Solaris 2.6 using https://learn.adafruit.com/build-your-own-sparc-with-qemu-and-solaris?view=all +2. Install https://archive.org/details/sun26gnu +3. Install http://download.nust.na/pub3/solaris/sunfreeware/pub/unixpackages/sparc/5.6/gdb-6.8-sol26-sparc-local.gz +4. Install http://download.nust.na/pub3/solaris/sunfreeware/pub/unixpackages/sparc/5.6/gcc-2.95.3-sol26-sparc-local.gz +5. Build a simple hello world program with debugging information +6. +``` +gdb ./hello +(gdb) break main +(gdb) run +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/117 b/results/classifier/mode-deepseek-r1:32b/output/system/117 new file mode 100644 index 00000000..106e2982 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/117 @@ -0,0 +1,3 @@ + + +nested 9p filesystem with security_model=mapped-xattr diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1173 b/results/classifier/mode-deepseek-r1:32b/output/system/1173 new file mode 100644 index 00000000..fa5800b7 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1173 @@ -0,0 +1,3 @@ + + +is that `fsgnjn.s` will affect other bits except sign bit. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1178101 b/results/classifier/mode-deepseek-r1:32b/output/system/1178101 new file mode 100644 index 00000000..41f6135d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1178101 @@ -0,0 +1,47 @@ + + +Could not enable gtk UI on build for Windows target + +$ ${QEMU_SRC_DIR}/configure --prefix=${BIN_ROOT} --cross-prefix=${HOST_TRIPLET}- --extra-cflags="-I${BIN_ROOT}/include" --extra-ldflags="-L${BIN_ROOT}/lib" --enable-gtk --disable-xen + +ERROR: User requested feature gtk + configure was not able to find it + + +$ cat config.log +# QEMU configure log Thu May 9 13:50:40 CST 2013 +# Configured with: '/home/cauchy/vcs/git/qemu/configure' '--prefix=/home/cauchy/w32' '--cross-prefix=i686-w64-mingw32-' '--extra-cflags=-I/home/cauchy/w32/include' '--extra-ldflags=-L/home/cauchy/w32/lib' '--enable-gtk' '--disable-xen' +# +i686-w64-mingw32-gcc -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wall -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -I/home/cauchy/w32/include -c -o /tmp/qemu-conf--18025-.o /tmp/qemu-conf--18025-.c +/tmp/qemu-conf--18025-.c:2:2: error: #error __linux__ not defined + #error __linux__ not defined + ^ +i686-w64-mingw32-gcc -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wall -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -I/home/cauchy/w32/include -c -o /tmp/qemu-conf--18025-.o /tmp/qemu-conf--18025-.c +i686-w64-mingw32-gcc -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wall -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -I/home/cauchy/w32/include -c -o /tmp/qemu-conf--18025-.o /tmp/qemu-conf--18025-.c +i686-w64-mingw32-gcc -D__USE_MINGW_ANSI_STDIO=1 -DWIN32_LEAN_AND_MEAN -DWINVER=0x501 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wall -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -I/home/cauchy/w32/include -o /tmp/qemu-conf--18025-.exe /tmp/qemu-conf--18025-.c -g -L/home/cauchy/w32/lib -liberty +i686-w64-mingw32-gcc -m32 -D__USE_MINGW_ANSI_STDIO=1 -DWIN32_LEAN_AND_MEAN -DWINVER=0x501 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wall -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -I/home/cauchy/w32/include -c -o /tmp/qemu-conf--18025-.o /tmp/qemu-conf--18025-.c +i686-w64-mingw32-gcc -m32 -D__USE_MINGW_ANSI_STDIO=1 -DWIN32_LEAN_AND_MEAN -DWINVER=0x501 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wall -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -I/home/cauchy/w32/include -Werror -Winitializer-overrides -o /tmp/qemu-conf--18025-.exe /tmp/qemu-conf--18025-.c -m32 -g -L/home/cauchy/w32/lib +i686-w64-mingw32-gcc: error: unrecognized command line option ‘-Winitializer-overrides’ +i686-w64-mingw32-gcc -m32 -D__USE_MINGW_ANSI_STDIO=1 -DWIN32_LEAN_AND_MEAN -DWINVER=0x501 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wall -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -I/home/cauchy/w32/include -Werror -Wendif-labels -o /tmp/qemu-conf--18025-.exe /tmp/qemu-conf--18025-.c -m32 -g -L/home/cauchy/w32/lib +i686-w64-mingw32-gcc -m32 -D__USE_MINGW_ANSI_STDIO=1 -DWIN32_LEAN_AND_MEAN -DWINVER=0x501 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wall -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -I/home/cauchy/w32/include -Wendif-labels -Werror -Wmissing-include-dirs -o /tmp/qemu-conf--18025-.exe /tmp/qemu-conf--18025-.c -m32 -g -L/home/cauchy/w32/lib +i686-w64-mingw32-gcc -m32 -D__USE_MINGW_ANSI_STDIO=1 -DWIN32_LEAN_AND_MEAN -DWINVER=0x501 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wall -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -I/home/cauchy/w32/include -Wendif-labels -Wmissing-include-dirs -Werror -Wempty-body -o /tmp/qemu-conf--18025-.exe /tmp/qemu-conf--18025-.c -m32 -g -L/home/cauchy/w32/lib +i686-w64-mingw32-gcc -m32 -D__USE_MINGW_ANSI_STDIO=1 -DWIN32_LEAN_AND_MEAN -DWINVER=0x501 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wall -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -I/home/cauchy/w32/include -Wendif-labels -Wmissing-include-dirs -Wempty-body -Werror -Wnested-externs -o /tmp/qemu-conf--18025-.exe /tmp/qemu-conf--18025-.c -m32 -g -L/home/cauchy/w32/lib +i686-w64-mingw32-gcc -m32 -D__USE_MINGW_ANSI_STDIO=1 -DWIN32_LEAN_AND_MEAN -DWINVER=0x501 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wall -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -I/home/cauchy/w32/include -Wendif-labels -Wmissing-include-dirs -Wempty-body -Wnested-externs -Werror -Wformat-security -o /tmp/qemu-conf--18025-.exe /tmp/qemu-conf--18025-.c -m32 -g -L/home/cauchy/w32/lib +i686-w64-mingw32-gcc -m32 -D__USE_MINGW_ANSI_STDIO=1 -DWIN32_LEAN_AND_MEAN -DWINVER=0x501 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wall -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -I/home/cauchy/w32/include -Wendif-labels -Wmissing-include-dirs -Wempty-body -Wnested-externs -Wformat-security -Werror -Wformat-y2k -o /tmp/qemu-conf--18025-.exe /tmp/qemu-conf--18025-.c -m32 -g -L/home/cauchy/w32/lib +i686-w64-mingw32-gcc -m32 -D__USE_MINGW_ANSI_STDIO=1 -DWIN32_LEAN_AND_MEAN -DWINVER=0x501 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wall -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -I/home/cauchy/w32/include -Wendif-labels -Wmissing-include-dirs -Wempty-body -Wnested-externs -Wformat-security -Wformat-y2k -Werror -Winit-self -o /tmp/qemu-conf--18025-.exe /tmp/qemu-conf--18025-.c -m32 -g -L/home/cauchy/w32/lib +i686-w64-mingw32-gcc -m32 -D__USE_MINGW_ANSI_STDIO=1 -DWIN32_LEAN_AND_MEAN -DWINVER=0x501 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wall -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -I/home/cauchy/w32/include -Wendif-labels -Wmissing-include-dirs -Wempty-body -Wnested-externs -Wformat-security -Wformat-y2k -Winit-self -Werror -Wignored-qualifiers -o /tmp/qemu-conf--18025-.exe /tmp/qemu-conf--18025-.c -m32 -g -L/home/cauchy/w32/lib +i686-w64-mingw32-gcc -m32 -D__USE_MINGW_ANSI_STDIO=1 -DWIN32_LEAN_AND_MEAN -DWINVER=0x501 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wall -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -I/home/cauchy/w32/include -Wendif-labels -Wmissing-include-dirs -Wempty-body -Wnested-externs -Wformat-security -Wformat-y2k -Winit-self -Wignored-qualifiers -Werror -Wold-style-declaration -o /tmp/qemu-conf--18025-.exe /tmp/qemu-conf--18025-.c -m32 -g -L/home/cauchy/w32/lib +i686-w64-mingw32-gcc -m32 -D__USE_MINGW_ANSI_STDIO=1 -DWIN32_LEAN_AND_MEAN -DWINVER=0x501 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wall -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -I/home/cauchy/w32/include -Wendif-labels -Wmissing-include-dirs -Wempty-body -Wnested-externs -Wformat-security -Wformat-y2k -Winit-self -Wignored-qualifiers -Wold-style-declaration -Werror -Wold-style-definition -o /tmp/qemu-conf--18025-.exe /tmp/qemu-conf--18025-.c -m32 -g -L/home/cauchy/w32/lib +i686-w64-mingw32-gcc -m32 -D__USE_MINGW_ANSI_STDIO=1 -DWIN32_LEAN_AND_MEAN -DWINVER=0x501 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wall -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -I/home/cauchy/w32/include -Wendif-labels -Wmissing-include-dirs -Wempty-body -Wnested-externs -Wformat-security -Wformat-y2k -Winit-self -Wignored-qualifiers -Wold-style-declaration -Wold-style-definition -Werror -Wtype-limits -o /tmp/qemu-conf--18025-.exe /tmp/qemu-conf--18025-.c -m32 -g -L/home/cauchy/w32/lib +i686-w64-mingw32-gcc -m32 -D__USE_MINGW_ANSI_STDIO=1 -DWIN32_LEAN_AND_MEAN -DWINVER=0x501 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wall -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -I/home/cauchy/w32/include -Wendif-labels -Wmissing-include-dirs -Wempty-body -Wnested-externs -Wformat-security -Wformat-y2k -Winit-self -Wignored-qualifiers -Wold-style-declaration -Wold-style-definition -Wtype-limits -Werror -fstack-protector-all -o /tmp/qemu-conf--18025-.exe /tmp/qemu-conf--18025-.c -m32 -g -L/home/cauchy/w32/lib +i686-w64-mingw32-gcc -m32 -D__USE_MINGW_ANSI_STDIO=1 -DWIN32_LEAN_AND_MEAN -DWINVER=0x501 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wall -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -I/home/cauchy/w32/include -Wendif-labels -Wmissing-include-dirs -Wempty-body -Wnested-externs -Wformat-security -Wformat-y2k -Winit-self -Wignored-qualifiers -Wold-style-declaration -Wold-style-definition -Wtype-limits -fstack-protector-all -Werror -fno-gcse -o /tmp/qemu-conf--18025-.exe /tmp/qemu-conf--18025-.c -m32 -g -L/home/cauchy/w32/lib +/tmp/qemu-conf--18025-.c:4:2: error: #error No bug in this compiler. + #error No bug in this compiler. + ^ +i686-w64-mingw32-gcc -m32 -D__USE_MINGW_ANSI_STDIO=1 -DWIN32_LEAN_AND_MEAN -DWINVER=0x501 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wall -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -I/home/cauchy/w32/include -Wendif-labels -Wmissing-include-dirs -Wempty-body -Wnested-externs -Wformat-security -Wformat-y2k -Winit-self -Wignored-qualifiers -Wold-style-declaration -Wold-style-definition -Wtype-limits -fstack-protector-all -o /tmp/qemu-conf--18025-.exe /tmp/qemu-conf--18025-.c -m32 -g -L/home/cauchy/w32/lib +i686-w64-mingw32-gcc -m32 -D__USE_MINGW_ANSI_STDIO=1 -DWIN32_LEAN_AND_MEAN -DWINVER=0x501 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wall -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -I/home/cauchy/w32/include -Wendif-labels -Wmissing-include-dirs -Wempty-body -Wnested-externs -Wformat-security -Wformat-y2k -Winit-self -Wignored-qualifiers -Wold-style-declaration -Wold-style-definition -Wtype-limits -fstack-protector-all -c -o /tmp/qemu-conf--18025-.o /tmp/qemu-conf--18025-.c +/tmp/qemu-conf--18025-.c:1:19: fatal error: sched.h: No such file or directory + #include <sched.h> + ^ +compilation terminated. +i686-w64-mingw32-gcc -m32 -D__USE_MINGW_ANSI_STDIO=1 -DWIN32_LEAN_AND_MEAN -DWINVER=0x501 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wall -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -I/home/cauchy/w32/include -Wendif-labels -Wmissing-include-dirs -Wempty-body -Wnested-externs -Wformat-security -Wformat-y2k -Winit-self -Wignored-qualifiers -Wold-style-declaration -Wold-style-definition -Wtype-limits -fstack-protector-all -o /tmp/qemu-conf--18025-.exe /tmp/qemu-conf--18025-.c -m32 -g -L/home/cauchy/w32/lib -lz \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1179731 b/results/classifier/mode-deepseek-r1:32b/output/system/1179731 new file mode 100644 index 00000000..44932458 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1179731 @@ -0,0 +1,5 @@ + + +is networking broken on windows hosts? + +just wondering as i just compiled the latest git and qemu goes into none responding mode when i try to do any networking stuff on guests (both linux and windows) \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1180 b/results/classifier/mode-deepseek-r1:32b/output/system/1180 new file mode 100644 index 00000000..8244da64 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1180 @@ -0,0 +1,168 @@ + + +Assertion failure in usb_cancel_packet() +Description of problem: +When I ran hcd-ohci with dev-storage, I found an assertion failure in +usb_cancel_packet() [1] due to p->state == USB_PACKET_COMPLETE. This is due to +the inconsistency when resetting device. + +``` c +static inline bool usb_packet_is_inflight(USBPacket *p) +{ + return (p->state == USB_PACKET_QUEUED || + p->state == USB_PACKET_ASYNC); +} + +void usb_cancel_packet(USBPacket * p) +{ + bool callback = (p->state == USB_PACKET_ASYNC); + assert(usb_packet_is_inflight(p)); // <------------------------------- [1] + usb_packet_set_state(p, USB_PACKET_CANCELED); + QTAILQ_REMOVE(&p->ep->queue, p, queue); + if (callback) { + usb_device_cancel_packet(p->ep->dev, p); + } +} +``` +Steps to reproduce: +Step 1: download the prepared rootfs and the image. + +https://drive.google.com/file/d/1B95zWWcomvZt1wms31Ddc9Xwlq-bfqhq/view?usp=sharing + +https://drive.google.com/file/d/1pxFzn49MKYmMMIIsaL9aUkzebRSYfq3J/view?usp=sharing + +Step 2: run the following script. + +``` bash +QEMU_PATH=../../../qemu/build/qemu-system-x86_64 +KERNEL_PATH=./bzImage +ROOTFS_PATH=./rootfs.ext2 +$QEMU_PATH \ + -M q35 -m 1G \ + -kernel $KERNEL_PATH \ + -drive file=$ROOTFS_PATH,if=virtio,format=raw \ + -append "root=/dev/vda console=ttyS0" \ + -net nic,model=virtio -net user \ + -usb \ + -device pci-ohci,num-ports=6 \ + -drive file=null-co://,if=none,format=raw,id=disk0 \ + -device usb-storage,port=1,drive=disk0 \ + -nographic +``` + +Step 3: with spawned shell (the user is root and the password is empty), run +`ohci-03`. +Additional information: +1 With crafted ED and TD, we can have the ohci->usb_packet's status to be +USB_RET_ASYNC [5]. And thus ohci->async_td is not NULL anymore [2]. + +``` +ed0 = { flags = 0x685f0900, tail = 0x0, head = &td0, next = 0 } + +td0 = { flags = 0x0, cbp = 0x1b8ffc, next = 0, be = 0x1b901a } +# data from cbp to be +55 53 42 43 00 00 00 00 00 00 00 00 00 00 00 03 USBC............ +e8 56 20 40 e8 56 20 40 e8 56 20 40 e8 56 20 + +ed1 = { flags = 0x08303080, tail = 0x0, head = &td1, next = 0 } + +td1 = { flags = 0x90000000, cbp = 0x19affc, next = 0, be = 0x19b01a } +# data from cbp to be +55 53 42 43 00 00 00 00 00 00 00 00 00 00 00 03 USBC............ +e8 56 20 40 e8 56 20 40 e8 56 20 40 e8 56 20 +``` + +``` c +static int ohci_service_td(OHCIState *ohci, struct ohci_ed *ed) +{ + // ... + usb_handle_packet(dev, &ohci->usb_packet); // <------------------- [4] + if (ohci->usb_packet.status == USB_RET_ASYNC) { + usb_device_flush_ep_queue(dev, ep); + ohci->async_td = addr; // <----------------------------------- [2] + return 1; + } +``` + +At the same time, the dev-storage will ref the current usb_packet +(ohci->usb_packet) [4][3]. + +``` +static void usb_msd_handle_data(USBDevice *dev, USBPacket *p) { + // ... + s->packet = p; // <----------------------------------------------- [3] + p->status = USB_RET_ASYNC; // <----------------------------------- [5] + // ... +} +``` + +2 We can first issue `MMIO_WRITE, 0xe0000054, 0x4, 0x4e33b4bf` to reset +the dev-storage device. This will mark the state of ohci->usb_packet to +USB_PACKET_COMPLETE and clear s->packet. + +``` +ohci_mem_write + ohci_port_set_status + usb_device_reset + usb_device_handle_reset + usb_msd_handle_reset + usb_msd_packet_complete + usb_packet_complete +``` + +3 We can then issue `MMIO_WRITE, 0xe0000004, 0x4, 0x3d8d323a` to reset the +roothub and this will invoke ohci_stop_endpoints() where usb_cancel_packet() +is invoked and thus [1] fails as the state of ohci->usb_packet has been changed +to USB_PACKET_COMPLETE. + +``` +ohci_set_ctl + ohci_roothub_reset + ohci_stop_endpoints + if (ohci->async_td != NULL) usb_cancel_packet(&ohci->usb_packet); + assert(usb_packet_is_inflight(p)); // boom +``` + +The above callstack are simplified. The complete callstack is in the following. + +``` +ohci_set_ctl + ohci_roothub_reset + usb_port_reset + usb_detach + ohci_detach + ohci_child_detach // <-------------------------------- [8] + usb_device_reset // <----------------------------------------- [6] + usb_device_handle_reset + usb_msd_handle_reset + usb_msd_packet_complete + usb_packet_complete + ohci_stop_endpoints // <------------------------------------------ [7] + if (ohci->async_td != NULL) usb_cancel_packet(&ohci->usb_packet); + assert(usb_packet_is_inflight(p)); // boom +``` + +Interestingly, in ohci_roothub_reset(), usb_device_reset() is also invoked [6] +just like what in step 2. I adjusted my PoC by removing step 2. However, I +cannot reproduce this assertion failure. Therefore, there is something different +bewteen [6] and step 2. + +Then, I found at [8], ohci_child_detach() cancels the ohci->usb_packet and reset +ohci->async_td. With step 2, as the status of the ohci->usb_packet has changed +to USB_PACKET_COMPLETE, usb_cancel_packet() will not be invoked. Without step 2, +as the status of the ohci->usb_packet is still USB_PACKET_ASYNC, +usb_cancel_packet() will be invoked and thus everything goes fine. + +``` +static void ohci_child_detach(USBPort *port1, USBDevice *dev) +{ + OHCIState *ohci = port1->opaque; + + if (ohci->async_td && + usb_packet_is_inflight(&ohci->usb_packet) && + ohci->usb_packet.ep->dev == dev) { + usb_cancel_packet(&ohci->usb_packet); + ohci->async_td = 0; + } +} +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1180923 b/results/classifier/mode-deepseek-r1:32b/output/system/1180923 new file mode 100644 index 00000000..faa151eb --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1180923 @@ -0,0 +1,5 @@ + + +unused memory filled with 0x00 instead of 0xFF + +Qemu, ever since it was made (so, since 2003), has this problem in DOS (either PC-DOS or MS-DOS and partly Windows 9x) not recognizing the memory available when the memory is filled with 0x00 but when it is filled with 0xFF it gets recognized properly, where should I patch qemu to solve this memory problem? \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1181 b/results/classifier/mode-deepseek-r1:32b/output/system/1181 new file mode 100644 index 00000000..96ff7f9d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1181 @@ -0,0 +1,3 @@ + + +Question for AVR experts... diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1185 b/results/classifier/mode-deepseek-r1:32b/output/system/1185 new file mode 100644 index 00000000..1a7e453c --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1185 @@ -0,0 +1,7 @@ + + +./configure has unprefixed calls to pkg-config and clang breaking cross-compilation +Description of problem: +The configure script (as generated) includes some calls to the toolchain without including cross compiler prefixes. This can very easily break cross compilation. Here are the locations: + +# diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1186 b/results/classifier/mode-deepseek-r1:32b/output/system/1186 new file mode 100644 index 00000000..15142081 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1186 @@ -0,0 +1,19 @@ + + +qos-test fails when built with LTO and gcc-12 +Description of problem: +The issue is already discussed here [1]. I'm simply building latest QEMU release and running the test suite. I thought the issue was fixed in 7.0 but it has resurfaced. Do QEMU dev's not build with LTO? I'm not able to debug this but I can test any proposed fixes etc. Thanks. + +[1] https://lore.kernel.org/all/1d3bbff9e92e7c8a24db9e140dcf3f428c2df103.camel@suse.com/ +Steps to reproduce: +1. Build QEMU with gcc-12 and LTO enabled +2. Run make check +3. Observe test suite failures in qos-test +Additional information: +``` +Summary of Failures: + + 2/265 qemu:qtest+qtest-aarch64 / qtest-aarch64/qos-test ERROR 0.59s killed by signal 6 SIGABRT + 3/265 qemu:qtest+qtest-i386 / qtest-i386/qos-test ERROR 0.22s killed by signal 6 SIGABRT + 7/265 qemu:qtest+qtest-x86_64 / qtest-x86_64/qos-test ERROR 0.40s killed by signal 6 SIGABRT +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1189 b/results/classifier/mode-deepseek-r1:32b/output/system/1189 new file mode 100644 index 00000000..b9c62cae --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1189 @@ -0,0 +1,3 @@ + + +Cannot Resolve Names When Host Is Running Systemd-Resolved diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1190 b/results/classifier/mode-deepseek-r1:32b/output/system/1190 new file mode 100644 index 00000000..982cefa7 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1190 @@ -0,0 +1,3 @@ + + +compiling v7.1 with --static fails with "/usr/bin/ld: cannot find -lmount" diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1192 b/results/classifier/mode-deepseek-r1:32b/output/system/1192 new file mode 100644 index 00000000..a13289c9 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1192 @@ -0,0 +1,137 @@ + + +Abort in xhci_find_stream() +Description of problem: +I triggered an abort in xhci_find_stream() [1]. This is because the +secondary stream arrays is enabled by setting linear stream array (LSA) bit (in +endpoint context) to 0. We may show warnings and drop this operation. + +``` c +static XHCIStreamContext *xhci_find_stream(XHCIEPContext *epctx, + unsigned int streamid, + uint32_t *cc_error) +{ + // ... + if (epctx->lsa) { + // ... + } else { + FIXME("secondary streams not implemented yet"); // <----------- [1] + } + // ... +``` +Steps to reproduce: +Step 1: download the prepared rootfs and the image. + +https://drive.google.com/file/d/10C2110VH-GrwACiPebC8-Vgcf5_Ny8Sd/view?usp=sharing +https://drive.google.com/file/d/1jAMf8rtTM8p88gamhNk4HC5Z34XtjUHw/view?usp=sharing + +Step 2: run the following script. + +``` bash +QEMU_PATH=../../../qemu/build/qemu-system-x86_64 +KERNEL_PATH=./bzImage +ROOTFS_PATH=./rootfs.ext2 +$QEMU_PATH \ + -M q35 -m 1G \ + -kernel $KERNEL_PATH \ + -drive file=$ROOTFS_PATH,if=virtio,format=raw \ + -append "root=/dev/vda console=ttyS0" \ + -net nic,model=virtio -net user \ + -drive file=null-co://,if=none,format=raw,id=disk0 \ + -device qemu-xhci,id=xhci -device usb-storage,drive=disk0 \ + -device usb-bot -device usb-tablet,bus=xhci.0 \ + -chardev null,id=cd0 -chardev null,id=cd1 \ + -device usb-braille,chardev=cd0 -device usb-ccid -device usb-ccid \ + -device usb-kbd -device usb-mouse -device usb-serial,chardev=cd1 \ + -device usb-tablet -device usb-wacom-tablet -device usb-audio \ + -nographic +``` + +Step 3: with spawned shell (the user is root and the password is empty), run +`xhci-00`. +Additional information: +``` +root@5b4fda3ee725:~/videzzo/videzzo_qemu/out-san# DEFAULT_INPUT_MAXSIZE=10000000 /root/videzzo/videzzo_qemu/out-san/qemu-videzzo-i386-target-videzzo-fuzz-xhci -max_len=10000000 -detect_leaks=0 poc-qemu-videzzo-i386-target-videzzo-fuzz-xhci-crash-4a11736abb111efe4b29a6931f403561f9a0f9ec +==71545==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases! +INFO: found LLVMFuzzerCustomMutator (0x55e05e05e640). Disabling -len_control by default. +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2668437424 +INFO: Loaded 1 modules (423456 inline 8-bit counters): 423456 [0x55e0606e8000, 0x55e06074f620), +INFO: Loaded 1 PC tables (423456 PCs): 423456 [0x55e060071ae0,0x55e0606e7ce0), +/root/videzzo/videzzo_qemu/out-san/qemu-videzzo-i386-target-videzzo-fuzz-xhci: Running 1 inputs 1 time(s) each. +INFO: Reading pre_seed_input if any ... +INFO: Executing pre_seed_input if any ... +Matching objects by name , *capabilities*, *operational*, *runtime*, *doorbell*, *usb3 port* +This process will fuzz the following MemoryRegions: + * usb3 port #1[0] (size 10) + * usb3 port #4[0] (size 10) + * capabilities[0] (size 40) + * usb3 port #3[0] (size 10) + * operational[0] (size 400) + * usb3 port #2[0] (size 10) + * runtime[0] (size 220) + * doorbell[0] (size 820) +This process will fuzz through the following interfaces: + * clock_step, EVENT_TYPE_CLOCK_STEP, 0xffffffff +0xffffffff, 255,255 + * capabilities, EVENT_TYPE_MMIO_READ, 0xe0000000 +0x40, 4,4 + * capabilities, EVENT_TYPE_MMIO_WRITE, 0xe0000000 +0x40, 4,4 + * operational, EVENT_TYPE_MMIO_READ, 0xe0000040 +0x400, 4,8 + * operational, EVENT_TYPE_MMIO_WRITE, 0xe0000040 +0x400, 4,8 + * runtime, EVENT_TYPE_MMIO_READ, 0xe0001000 +0x220, 4,8 + * runtime, EVENT_TYPE_MMIO_WRITE, 0xe0001000 +0x220, 4,8 + * doorbell, EVENT_TYPE_MMIO_READ, 0xe0002000 +0x820, 4,4 + * doorbell, EVENT_TYPE_MMIO_WRITE, 0xe0002000 +0x820, 4,4 + * usb3 port #4, EVENT_TYPE_MMIO_READ, 0xe0000470 +0x10, 4,4 + * usb3 port #4, EVENT_TYPE_MMIO_WRITE, 0xe0000470 +0x10, 4,4 + * usb3 port #1, EVENT_TYPE_MMIO_READ, 0xe0000440 +0x10, 4,4 + * usb3 port #1, EVENT_TYPE_MMIO_WRITE, 0xe0000440 +0x10, 4,4 + * usb3 port #2, EVENT_TYPE_MMIO_READ, 0xe0000450 +0x10, 4,4 + * usb3 port #2, EVENT_TYPE_MMIO_WRITE, 0xe0000450 +0x10, 4,4 + * usb3 port #3, EVENT_TYPE_MMIO_READ, 0xe0000460 +0x10, 4,4 + * usb3 port #3, EVENT_TYPE_MMIO_WRITE, 0xe0000460 +0x10, 4,4 +INFO: A corpus is not provided, starting from an empty corpus +#2 INITED cov: 3 ft: 4 corp: 1/1b exec/s: 0 rss: 197Mb +Running: poc-qemu-videzzo-i386-target-videzzo-fuzz-xhci-crash-4a11736abb111efe4b29a6931f403561f9a0f9ec +../hw/usb/hcd-xhci.c:1099:25: runtime error: shift exponent 156 is too large for 32-bit type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../hw/usb/hcd-xhci.c:1099:25 in +FIXME xhci_find_stream:998 secondary streams not implemented yet +==71545== ERROR: libFuzzer: deadly signal + #0 0x55e05a7f874e in __sanitizer_print_stack_trace /root/llvm-project/compiler-rt/lib/asan/asan_stack.cpp:86:3 + #1 0x55e05a7473c1 in fuzzer::PrintStackTrace() /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerUtil.cpp:210:38 + #2 0x55e05a720c06 in fuzzer::Fuzzer::CrashCallback() (.part.0) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:235:18 + #3 0x55e05a720cd2 in fuzzer::Fuzzer::CrashCallback() /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:207:1 + #4 0x55e05a720cd2 in fuzzer::Fuzzer::StaticCrashSignalCallback() /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:206:19 + #5 0x7fa0b025c41f (/lib/x86_64-linux-gnu/libpthread.so.0+0x1441f) + #6 0x7fa0b006e00a in __libc_signal_restore_set /build/glibc-SzIz7B/glibc-2.31/signal/../sysdeps/unix/sysv/linux/internal-signals.h:86:3 + #7 0x7fa0b006e00a in raise /build/glibc-SzIz7B/glibc-2.31/signal/../sysdeps/unix/sysv/linux/raise.c:48:3 + #8 0x7fa0b004d858 in abort /build/glibc-SzIz7B/glibc-2.31/stdlib/abort.c:79:7 + #9 0x55e05a828c9a in __wrap_abort /root/videzzo/videzzo_qemu/qemu/build-san-6/../tests/qtest/videzzo/less_crashes_wrappers.c:24:12 + #10 0x55e05bd528c3 in xhci_find_stream /root/videzzo/videzzo_qemu/qemu/build-san-6/../hw/usb/hcd-xhci.c:998:9 + #11 0x55e05bd46ca5 in xhci_kick_epctx /root/videzzo/videzzo_qemu/qemu/build-san-6/../hw/usb/hcd-xhci.c:1922:17 + #12 0x55e05bd7d7ff in xhci_kick_ep /root/videzzo/videzzo_qemu/qemu/build-san-6/../hw/usb/hcd-xhci.c:1838:5 + #13 0x55e05bd94ab9 in xhci_doorbell_write /root/videzzo/videzzo_qemu/qemu/build-san-6/../hw/usb/hcd-xhci.c:3163:13 + #14 0x55e05cfed443 in memory_region_write_accessor /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/memory.c:492:5 + #15 0x55e05cfecd81 in access_with_adjusted_size /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/memory.c:554:18 + #16 0x55e05cfeb68c in memory_region_dispatch_write /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/memory.c:1514:16 + #17 0x55e05d0760be in flatview_write_continue /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/physmem.c:2825:23 + #18 0x55e05d06443b in flatview_write /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/physmem.c:2867:12 + #19 0x55e05d063ef8 in address_space_write /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/physmem.c:2963:18 + #20 0x55e05a83813b in qemu_writel /root/videzzo/videzzo_qemu/qemu/build-san-6/../tests/qtest/videzzo/videzzo_qemu.c:1072:5 + #21 0x55e05a8365b5 in dispatch_mmio_write /root/videzzo/videzzo_qemu/qemu/build-san-6/../tests/qtest/videzzo/videzzo_qemu.c:1197:28 + #22 0x55e05e059fff in videzzo_dispatch_event /root/videzzo/videzzo.c:1122:5 + #23 0x55e05e05137b in __videzzo_execute_one_input /root/videzzo/videzzo.c:272:9 + #24 0x55e05e051250 in videzzo_execute_one_input /root/videzzo/videzzo.c:313:9 + #25 0x55e05a83f17c in videzzo_qemu /root/videzzo/videzzo_qemu/qemu/build-san-6/../tests/qtest/videzzo/videzzo_qemu.c:1472:12 + #26 0x55e05e05e8e2 in LLVMFuzzerTestOneInput /root/videzzo/videzzo.c:1891:18 + #27 0x55e05a72173d in fuzzer::Fuzzer::ExecuteCallback(unsigned char*, unsigned long) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:589:17 + #28 0x55e05a7044c4 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:21 + #29 0x55e05a70f43e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char*, unsigned long)) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:882:19 + #30 0x55e05a6fba46 in main /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:30 + #31 0x7fa0b004f082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16 + #32 0x55e05a6fba9d in _start (/root/videzzo/videzzo_qemu/out-san/qemu-videzzo-i386-target-videzzo-fuzz-xhci+0x265aa9d) + +NOTE: libFuzzer has rudimentary signal handlers. + Combine libFuzzer with AddressSanitizer or similar for better crash reports. +SUMMARY: libFuzzer: deadly signal +MS: 0 ; base unit: 0000000000000000000000000000000000000000 +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1193628 b/results/classifier/mode-deepseek-r1:32b/output/system/1193628 new file mode 100644 index 00000000..fc46056b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1193628 @@ -0,0 +1,24 @@ + + +Undefined References + +I've been able to make qemu on ubuntu 13.04 for all last releases: 1.4.0 -> 1.5.0 + +Unfortunately, when I launch one of them with a Cisco ASA, it crashes inside GNS3 (latest release) for Ubuntu. +The top GNS3 developer told me they experienced similar results and advised me to use qemu 1.1.0. + +The problem is that I cannot link that version. I always have these errors: + +"LINK qemu-ga +qemu-timer.o: In function `dynticks_rearm_timer': +/home/actionmystique/Downloads/qemu-1.1.0/qemu-timer.c:538: undefined reference to `timer_gettime' +/home/actionmystique/Downloads/qemu-1.1.0/qemu-timer.c:551: undefined reference to `timer_settime' +qemu-timer.o: In function `dynticks_stop_timer': +/home/actionmystique/Downloads/qemu-1.1.0/qemu-timer.c:524: undefined reference to `timer_delete' +qemu-timer.o: In function `dynticks_start_timer': +/home/actionmystique/Downloads/qemu-1.1.0/qemu-timer.c:510: undefined reference to `timer_create' +collect2: error: ld returned 1 exit status +make: *** [qemu-ga] Error 1" + +The man pages say we need to link with '-lrt' option, but I could not find it in the Makefile. +I do not know how to correct this issue. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1195882 b/results/classifier/mode-deepseek-r1:32b/output/system/1195882 new file mode 100644 index 00000000..531b9270 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1195882 @@ -0,0 +1,26 @@ + + +Make fails on Centos - can't find autoreconf + + [root@H002 qemu-1.4.2]# make +\ GEN i386-softmmu/config-devices.mak + GEN x86_64-softmmu/config-devices.mak + GEN alpha-softmmu/config-devices.mak + GEN arm-softmmu/config-devices.mak + GEN cris-softmmu/config-devices.mak + GEN lm32-softmmu/config-devices.mak + +( .... ) + +GEN unicore32-linux-user/config-devices.mak + GEN s390x-linux-user/config-devices.mak + GEN config-all-devices.mak + GEN config-host.h +(cd /opt/qemu/qemu-1.4.2/pixman; autoreconf -v --install) +/bin/sh: autoreconf: command not found +make: *** [/opt/qemu/qemu-1.4.2/pixman/configure] Error 127 + +***************** + +Exact same error for 1.5.1 build +So, qemu not supported on anything but Ubuntu? \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1201446 b/results/classifier/mode-deepseek-r1:32b/output/system/1201446 new file mode 100644 index 00000000..d6300a57 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1201446 @@ -0,0 +1,28 @@ + + +Instructions not supported by targeted CPU do not throw SIGILL + +We encountered a bug in another package that caused it to include CMOV instructions when targetting i486, resulting in an inability to run the package on real i486 and i586 hardware. We then attempted to use QEMU to reproduce the bug for easier debugging, since most developers have long since got rid of such old hardware. + +QEMU appears to continue to support *all* instructions when -cpu=486 is selected, regardless of what is advertised in CPUID to the guest. CPUID describes the host environment as a reasonably close approximation to a late-model i486, with very few instruction extensions - specifically excluding CMOV, which on real hardware is an optional extension to the i686 architecture. + +The result was that we could not reproduce the bug using QEMU, and must therefore attempt to debug it using a very limited stock of real hardware, which also has very limited performance for rebuilding the package. This completely defeats one of the main uses of QEMU, in our opinion. + +If this bug extends to other CPU architectures, it would affect all developers wishing to check whether their code conforms to restrictions imposed by any older or more restrictive ISA specification than the latest that QEMU supports, including the distinctions between ARMv7-A-NEON, ARMv7-A-VFPv3, ARMv7-A-VFPv3-d16, ARMv7-R, ARMv7-M, ARMv6-VFPv2, ARMv5-TE, ARMv4-T... all of which are currently shipping in new devices. + +Attached is a small C program which can easily be compiled to include CMOV instructions. It can be used to reproduce the bug: + +$ gcc -march=i486 -O2 -c minmax.c -o minmax +$ ./minmax +No arguments! +$ ./minmax 5 6 7 +max: 7 min: 5 +$ gcc -march=pentium2 -O2 -c minmax.c -o minmax-p2 +$ ./minmax-p2 +No arguments! +$ ./minmax-p2 5 6 7 +[Expected, occurs on real i4/586 hardware:] Illegal instruction +[Actual, within QEMU v1.2.0 with -cpu=486:] max: 7 min: 5 +$ + +The bug is likely not limited to CMOV, but would also apply to more recent ISA extensions - so 3DNow! instructions would appear to run on Intel guest CPUs, AVX on a Pentium-2, and other such weirdness. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1204 b/results/classifier/mode-deepseek-r1:32b/output/system/1204 new file mode 100644 index 00000000..2b4bac2a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1204 @@ -0,0 +1,31 @@ + + +AArch64 unaligned accesses are allowed by QEMU when SCTLR_EL3.A is 0, but SCTLR_EL3.M is also 0 +Description of problem: +As per the ARM ARM, when address translation is disabled and the access is not done from EL1/0 with HCR_EL2.DC set to 1, data accesses receive the 'Device-nGnRnE' memory attribute (D.8.2.10 The effects of disabling an address translation stage - DDi0487I.a, Page D8-5119). +Memory regions marked as Device do not support unaligned access. +Steps to reproduce: +Run the following snippet under EL3, and notice the last load instruction completes successfully (doesn't raise an alignment fault) +``` +.balign 8 +.global first_variable +first_variable: + .word 0x1 +.balign 4 +.global second_variable +second_variable: + .word 0x2 + +no_mmu_sctlr: .dword 0x0000000030C51834 + +.globl reproducer +reproducer: + ldr x1, no_mmu_sctlr // A=0,M=0 + msr sctlr_el3, x1 + dsb sy + isb + + ldr x0, =first_variable + ldr x1, [x0, #0] // Aligned - Success + ldr x1, [x0, #4] // Unaligned - Success??? (Should be failure) +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1205 b/results/classifier/mode-deepseek-r1:32b/output/system/1205 new file mode 100644 index 00000000..3df2c17e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1205 @@ -0,0 +1,9 @@ + + +Cannot use `-serial stdio` on macbook pro, apple silicon +Description of problem: +When I run the command above, it will show below: +``` +(qemu) qemu-system-aarch64: -serial stdio: cannot use stdio by multiple character devices +qemu-system-aarch64: -serial stdio: could not connect serial device to character backend 'stdio' +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1206 b/results/classifier/mode-deepseek-r1:32b/output/system/1206 new file mode 100644 index 00000000..2ed61646 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1206 @@ -0,0 +1,98 @@ + + +68k: movew %sp@+,%sr does not restore USP if switching from Supervisor to User mode +Description of problem: +Debugging issues with MacOS under qemu-system-m68k shows that the `movew %sp@+,%sr` instruction does not restore USP if switching from Supervisor to User mode. I've created a reproducer at https://gitlab.com/mcayland/qemu/-/commits/68k-move-to-sr-bug ([diff from git master](https://gitlab.com/mcayland/qemu/-/commit/fbcd078946c0e582bf8f1ac9a5a3a31cda2e6c38.diff)) which uses the following code snippet: + +``` +0x40800000 in MYROM () +warning: shared library handler failed to enable breakpoint +(gdb) disas $pc $pc+0x20 +Dump of assembler code from 0x40800000 to 0x40800020: +0x40800000 <MYROM+0>: lea 0x6000,%a0 +0x40800006 <MYROM+6>: movel %a0,%usp +0x40800008 <MYROM+8>: movew %sr,%d0 +0x4080000a <MYROM+10>: andiw #8191,%d0 +0x4080000e <MYROM+14>: movew %d0,%sp@- +0x40800010 <MYROM+16>: movew %sp@+,%sr +0x40800012 <MYROM+18>: bras 0x40800012 <MYROM+18> +``` + +Initially the ISP is set to 0x1000 in supervisor mode: the code above loads 0x6000 into %usp, moves the SR register into d0, clears the supervisor bit, and pushes the new SR value onto the stack. Finally the `movew %sp@+,%sr` instruction is executed which switches from supervisor mode to user mode but the resulting %sp is still the ISP value and not the USP: + +``` +0x40800000 in MYROM () +warning: shared library handler failed to enable breakpoint +(gdb) stepi +0x40800006 in MYROM () +(gdb) +0x40800008 in MYROM () +(gdb) +0x4080000a in MYROM () +(gdb) +0x4080000e in MYROM () +(gdb) +0x40800010 in MYROM () +(gdb) +0x40800010 in MYROM () +(gdb) i r $ps $sp +ps 0x2700 9984 +sp 0xffe 0xffe +(gdb) stepi +0x40800012 in MYROM () +(gdb) i r $ps $sp +ps 0x700 1792 +sp 0x1000 0x1000 <-- should be 0x6000 +``` + +Analysis with gdb shows that the `set_sr` helper is calling `m68k_switch_sp()` correctly but the resulting value is not seen in the guest: + +``` +Thread 3 "qemu-system-m68" hit Breakpoint 1, m68k_switch_sp (env=0x62d000030ae0) at ../target/m68k/helper.c:462 +462 env->sp[env->current_sp] = env->aregs[7]; +(gdb) p/x env->aregs[7] +$1 = 0xffe +(gdb) n +463 if (m68k_feature(env, M68K_FEATURE_M68000)) { +(gdb) +464 if (env->sr & SR_S) { +(gdb) +472 new_sp = M68K_USP; +(gdb) +478 env->aregs[7] = env->sp[new_sp]; +(gdb) +479 env->current_sp = new_sp; +(gdb) +480 } +(gdb) p/x env->aregs[7] +$2 = 0x6000 +``` + +The bug seems to be caused by the post-increment operator clobbering the stack pointer with the ISP after the instruction has been translated: + +``` +IN: +0x40800010: movew %sp@+,%sr + +OP: + ld_i32 tmp0,env,$0xfffffffffffffff0 + brcond_i32 tmp0,$0x0,lt,$L0 + + ---- 40800010 00000000 + mov_i32 tmp0,$0x1 + st_i32 tmp0,env,$0xfffffffffffffc18 + qemu_ld_i32 tmp0,A7,leuw,0 + bswap16_i32 tmp0,tmp0,iz,oz + add_i32 tmp3,A7,$0x2 + call set_sr,$0x0,$0,env,tmp0 + mov_i32 CC_OP,$0x1 + mov_i32 PC,$0x40800012 + mov_i32 A7,tmp3 + exit_tb $0x0 + set_label $L0 + exit_tb $0x7fe118f30043 +``` + +Here tmp3 which is generated from the ISP is written back to A7 **after** `set_sr` has switched the stack pointer. This appears to be part of the `delay_set_areg` mechanism which was introduced in 8a1e52b69d ("target-m68k: Delay autoinc writeback"). + +From what I can see it isn't possible to easily change the order of the `set_sr` helper and applying the post-increment since the post-increment is handled automatically after the instruction is translated as part of `do_writebacks()`. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1211943 b/results/classifier/mode-deepseek-r1:32b/output/system/1211943 new file mode 100644 index 00000000..cca96650 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1211943 @@ -0,0 +1,5 @@ + + +#GP and aligned move instruction + +When the operand of movaps, movapd or movdqa instruction isn't aligned, general-protection exception should be generated. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1224444 b/results/classifier/mode-deepseek-r1:32b/output/system/1224444 new file mode 100644 index 00000000..bebeade3 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1224444 @@ -0,0 +1,56 @@ + + +virtio-serial loses writes when used over virtio-mmio + +virtio-serial appears to lose writes, but only when used on top of virtio-mmio. The scenario is this: + +/home/rjones/d/qemu/arm-softmmu/qemu-system-arm \ + -global virtio-blk-device.scsi=off \ + -nodefconfig \ + -nodefaults \ + -nographic \ + -M vexpress-a15 \ + -machine accel=kvm:tcg \ + -m 500 \ + -no-reboot \ + -kernel /home/rjones/d/libguestfs/tmp/.guestfs-1001/kernel.27944 \ + -dtb /home/rjones/d/libguestfs/tmp/.guestfs-1001/dtb.27944 \ + -initrd /home/rjones/d/libguestfs/tmp/.guestfs-1001/initrd.27944 \ + -device virtio-scsi-device,id=scsi \ + -drive file=/home/rjones/d/libguestfs/tmp/libguestfsLa9dE2/scratch.1,cache=unsafe,format=raw,id=hd0,if=none \ + -device scsi-hd,drive=hd0 \ + -drive file=/home/rjones/d/libguestfs/tmp/.guestfs-1001/root.27944,snapshot=on,id=appliance,cache=unsafe,if=none \ + -device scsi-hd,drive=appliance \ + -device virtio-serial-device \ + -serial stdio \ + -chardev socket,path=/home/rjones/d/libguestfs/tmp/libguestfsLa9dE2/guestfsd.sock,id=channel0 \ + -device virtserialport,chardev=channel0,name=org.libguestfs.channel.0 \ + -append 'panic=1 mem=500M console=ttyAMA0 udevtimeout=600 no_timer_check acpi=off printk.time=1 cgroup_disable=memory root=/dev/sdb selinux=0 guestfs_verbose=1 TERM=xterm-256color' + +After the guest starts up, a daemon writes 4 bytes to a virtio-serial socket. The host side reads these 4 bytes correctly and writes a 64 byte message. The guest never sees this message. + +I enabled virtio-mmio debugging, and this is what is printed (## = my comment): + +## guest opens the socket: +trying to open virtio-serial channel '/dev/virtio-ports/org.libguestfs.channel.0' +virtio_mmio: virtio_mmio_write offset 0x50 value 0x3 +opened the socket, sock = 3 +udevadm settle +## guest writes 4 bytes to the socket: +virtio_mmio: virtio_mmio_write offset 0x50 value 0x5 +virtio_mmio: virtio_mmio setting IRQ 1 +virtio_mmio: virtio_mmio_read offset 0x60 +virtio_mmio: virtio_mmio_write offset 0x64 value 0x1 +virtio_mmio: virtio_mmio setting IRQ 0 +sent magic GUESTFS_LAUNCH_FLAG +## host reads 4 bytes successfully: +main_loop libguestfs: recv_from_daemon: received GUESTFS_LAUNCH_FLAG +libguestfs: [14605ms] appliance is up +Guest launched OK. +## host writes 64 bytes to socket: +libguestfs: writing the data to the socket (size = 64) +waiting for next request +libguestfs: data written OK +## hangs here forever with guest in read() call never receiving any data + +I am using qemu from git today (2d1fe1873a984). \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1225 b/results/classifier/mode-deepseek-r1:32b/output/system/1225 new file mode 100644 index 00000000..e8b5af1b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1225 @@ -0,0 +1,3 @@ + + +Can't update to Windows 11 22H2 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1227 b/results/classifier/mode-deepseek-r1:32b/output/system/1227 new file mode 100644 index 00000000..9088e1e0 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1227 @@ -0,0 +1,3 @@ + + +Guest Agent not waiting for Linux services to stop during shutdown diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1229 b/results/classifier/mode-deepseek-r1:32b/output/system/1229 new file mode 100644 index 00000000..9e9ce518 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1229 @@ -0,0 +1,11 @@ + + +there is no Makefile.objs in migration dir，how can I do if I need to edit it? +Description of problem: + +Steps to reproduce: +1. +2. +3. +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1230 b/results/classifier/mode-deepseek-r1:32b/output/system/1230 new file mode 100644 index 00000000..bca1b5fc --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1230 @@ -0,0 +1,25 @@ + + +qtest-aarch64/migration-test non-deterministic test failure +Description of problem: +The test suite fails: +``` +Summary of Failures: + + 32/619 qemu:qtest+qtest-aarch64 / qtest-aarch64/migration-test ERROR 161.19s killed by signal 6 SIGABRT + + +Ok: 552 +Expected Fail: 0 +Fail: 1 +Unexpected Pass: 0 +Skipped: 66 +Timeout: 0 + +Full log written to /tmp/guix-build-qemu-7.1.0.drv-0/qemu-7.1.0/b/qemu/meson-logs/testlog.txt +make: *** [Makefile.mtest:25: do-meson-check] Error 1 +``` + +See the full build log below. +Additional information: +[qt60pm4fcc63jcbwfgz86z6cwqgx4zgm-qemu-7.1.0.txt.gz](/uploads/6d7f0da152193213a7fe694e2d535879/qt60pm4fcc63jcbwfgz86z6cwqgx4zgm-qemu-7.1.0.txt.gz) diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1233 b/results/classifier/mode-deepseek-r1:32b/output/system/1233 new file mode 100644 index 00000000..7cb8d1ce --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1233 @@ -0,0 +1,3 @@ + + +is there a roadmap about when riscv-v extension will be implemented?? diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1234179 b/results/classifier/mode-deepseek-r1:32b/output/system/1234179 new file mode 100644 index 00000000..39e71b08 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1234179 @@ -0,0 +1,159 @@ + + +QEMU segfaults during Windows 7 unattended install + +During today's automated qemu.git testing, a segmentation fault while installing Windows 7 SP1 happened. + +qemu.git top commit: +10/02 01:30:24 INFO | git:0150| git commit ID is a684f3cf9b9b9c3cb82be87aafc463de8974610c (tag v1.4.0-4237-ga684f3c) + +commit a684f3cf9b9b9c3cb82be87aafc463de8974610c +Merge: 349cd52 1cf9412 +Author: Anthony Liguori <email address hidden> +Date: Mon Sep 30 17:15:27 2013 -0500 + + Merge remote-tracking branch 'kraxel/seabios-1.7.3.2' into staging + + # By Gerd Hoffmann + # Via Gerd Hoffmann + * kraxel/seabios-1.7.3.2: + update seabios from 1.7.2.2 to 1.7.3.2 + + Message-id: <email address hidden> + +We have the core file saved in our test servers, we can make arrangements to transfer it if there's someone interested in investigating further. The framework saved the 'bt full' of the core file, that was missing some debug info: + +[Thread debugging using libthread_db enabled] +Using host libthread_db library "/lib64/libthread_db.so.1". +Core was generated by `/usr/local/autotest/tests/virt/qemu/qemu -S -name virt-tests-vm1 -M pc -nodefau'. +Program terminated with signal 11, Segmentation fault. +#0 0x00007ffc8fb86cf0 in pixman_image_get_data () from /lib64/libpixman-1.so.0 +#0 0x00007ffc8fb86cf0 in pixman_image_get_data () from /lib64/libpixman-1.so.0 +No symbol table info available. +#1 0x00007ffc9165b05c in ?? () +No symbol table info available. +#2 0x00007ffc9382b540 in ?? () +No symbol table info available. +#3 0x00007ffc8f359a8d in clock_gettime () from /lib64/libc.so.6 +No symbol table info available. +#4 0x00007ffc9382b5a8 in ?? () +No symbol table info available. +#5 0x000000019382b4c0 in ?? () +No symbol table info available. +#6 0x0000000000000000 in ?? () +No symbol table info available. + +Extra info: + +Commits for the submodules: + +10/02 01:30:29 DEBUG|base_utils:0134| [stdout] Submodule path 'dtc': checked out 'bc895d6d09695d05ceb8b52486ffe861d6cfbdde' +10/02 01:30:51 DEBUG|base_utils:0134| [stdout] Submodule path 'pixman': checked out '97336fad32acf802003855cd8bd6477fa49a12e3' +10/02 01:30:58 DEBUG|base_utils:0134| [stdout] Submodule path 'roms/SLOF': checked out '8cfdfc43f4c4c8c8dfa4b7cf16f7c19c84eee812' +10/02 01:31:16 DEBUG|base_utils:0134| [stdout] Submodule path 'roms/ipxe': checked out '09c5109b8585178172c7608de8d52e9d9af0b680' +10/02 01:31:20 DEBUG|base_utils:0134| [stdout] Submodule path 'roms/openbios': checked out '0f3d51ef22ec9166beb3ed434d253029ed7cfe84' +10/02 01:31:21 DEBUG|base_utils:0134| [stdout] Submodule path 'roms/qemu-palcode': checked out 'c87a92639b28ac42bc8f6c67443543b405dc479b' +10/02 01:31:27 DEBUG|base_utils:0134| [stdout] Submodule path 'roms/seabios': checked out 'ece025f5980bae88fa677bc9c0d24d2e580e205d' +10/02 01:31:28 DEBUG|base_utils:0134| [stdout] Submodule path 'roms/sgabios': checked out '23d474943dcd55d0550a3d20b3d30e9040a4f15b' +10/02 01:31:31 DEBUG|base_utils:0134| [stdout] Submodule path 'roms/vgabios': checked out '19ea12c230ded95928ecaef0db47a82231c2e485' + +Configure options: + +10/02 01:31:32 DEBUG|base_utils:0099| Running '/usr/local/autotest/tmp/virt/src/qemu/configure --target-list=x86_64-softmmu --disable-strip --prefix=/usr/local/autotest/tests/virt/qemu/install_root' +10/02 01:31:35 DEBUG|env_proces:0829| (address cache) DHCP lease OK: 00:30:48:c5:d6:e2 --> 10.16.72.38 +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] Install prefix /usr/local/autotest/tests/virt/qemu/install_root +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] BIOS directory /usr/local/autotest/tests/virt/qemu/install_root/share/qemu +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] binary directory /usr/local/autotest/tests/virt/qemu/install_root/bin +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] library directory /usr/local/autotest/tests/virt/qemu/install_root/lib +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] libexec directory /usr/local/autotest/tests/virt/qemu/install_root/libexec +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] include directory /usr/local/autotest/tests/virt/qemu/install_root/include +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] config directory /usr/local/autotest/tests/virt/qemu/install_root/etc +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] local state directory /usr/local/autotest/tests/virt/qemu/install_root/var +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] Manual directory /usr/local/autotest/tests/virt/qemu/install_root/share/man +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] ELF interp prefix /usr/gnemul/qemu-%M +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] Source path /usr/local/autotest/tmp/virt/src/qemu +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] C compiler cc +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] Host C compiler cc +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] C++ compiler c++ +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] Objective-C compiler cc +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] CFLAGS -O2 -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -g +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] QEMU_CFLAGS -Werror -fPIE -DPIE -m64 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wall -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -Wendif-labels -Wmissing-include-dirs -Wempty-body -Wnested-externs -Wformat-security -Wformat-y2k -Winit-self -Wignored-qualifiers -Wold-style-declaration -Wold-style-definition -Wtype-limits -fstack-protector-all -I/usr/include/pixman-1 -I$(SRC_PATH)/dtc/libfdt +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] LDFLAGS -Wl,--warn-common -Wl,-z,relro -Wl,-z,now -pie -m64 -g +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] make make +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] install install +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] python python -B +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] smbd /usr/sbin/smbd +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] host CPU x86_64 +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] host big endian no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] target list x86_64-softmmu +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] tcg debug enabled no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] gprof enabled no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] sparse enabled no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] strip binaries no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] profiler no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] static build no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] -Werror enabled yes +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] pixman system +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] SDL support no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] GTK support no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] curses support yes +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] curl support yes +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] mingw32 support no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] Audio drivers oss +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] Block whitelist (rw) +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] Block whitelist (ro) +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] VirtFS support yes +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] VNC support yes +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] VNC TLS support no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] VNC SASL support yes +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] VNC JPEG support no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] VNC PNG support no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] VNC WS support no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] xen support no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] brlapi support no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] bluez support no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] Documentation no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] GUEST_BASE yes +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] PIE yes +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] vde support no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] Linux AIO support no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] ATTR/XATTR support yes +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] Install blobs yes +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] KVM support yes +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] RDMA support no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] TCG interpreter no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] fdt support yes +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] preadv support yes +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] fdatasync yes +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] madvise yes +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] posix_madvise yes +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] sigev_thread_id yes +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] uuid support no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] libcap-ng support no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] vhost-net support yes +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] vhost-scsi support yes +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] Trace backend nop +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] Trace output file trace-<pid> +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] spice support no (/) +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] rbd support no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] xfsctl support no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] nss used no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] libusb no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] usb net redir no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] GLX support no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] libiscsi support no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] build guest agent yes +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] QGA VSS support no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] seccomp support no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] coroutine backend ucontext +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] coroutine pool yes +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] GlusterFS support no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] virtio-blk-data-plane no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] gcov gcov +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] gcov enabled no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] TPM support no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] libssh2 support no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] TPM passthrough no +10/02 01:31:40 DEBUG|base_utils:0134| [stdout] QOM debugging yes +10/02 01:31:40 INFO |build_help:0617| Running parallel make on build dir +10/02 01:31:40 DEBUG|base_utils:0099| Running 'make -j 24' \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1237625 b/results/classifier/mode-deepseek-r1:32b/output/system/1237625 new file mode 100644 index 00000000..7cd778c5 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1237625 @@ -0,0 +1,50 @@ + + +Cannot read serial from /sys/bus/usb/devices/ + +After an update to qemu 1.6 I can't start any of my images. Qemu always crashs. I tried it with root and as a normal user... Here are some log entries I get: + +Type: Warning Num: 85 +Date: 2013.10.09 23:48:46 549 +Sender: bool System_Info::Scan_USB_Sys( QList<VM_USB> &list ) +Message: Cannot read serial from /sys/bus/usb/devices/ + +Type: Debug Num: 86 +Date: 2013.10.09 23:48:46 553 +Sender: void Virtual_Machine::QEMU_Started() +Message: QEMU Start + +Type: Debug Num: 87 +Date: 2013.10.09 23:48:46 554 +Sender: bool Virtual_Machine::operator==( const Virtual_Machine &vm ) const +Message: Begin + +Type: Debug Num: 88 +Date: 2013.10.09 23:48:46 554 +Sender: bool Virtual_Machine::operator==( const Virtual_Machine &vm ) const +Message: End + +Type: Debug Num: 89 +Date: 2013.10.09 23:48:46 575 +Sender: void Virtual_Machine::QEMU_Started() +Message: emit Loading_Complete() + +Type: Debug Num: 90 +Date: 2013.10.09 23:48:47 470 +Sender: void Virtual_Machine::QEMU_Finished( int exitCode, QProcess::ExitStatus exitStatus ) +Message: QEMU Finished + +Type: Debug Num: 91 +Date: 2013.10.09 23:48:47 470 +Sender: bool Virtual_Machine::operator==( const Virtual_Machine &vm ) const +Message: Begin + +Type: Debug Num: 92 +Date: 2013.10.09 23:48:47 470 +Sender: bool Virtual_Machine::operator==( const Virtual_Machine &vm ) const +Message: End + +Type: Error Num: 93 +Date: 2013.10.09 23:48:47 498 +Sender: QEMU Crashed! +Message: \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/124 b/results/classifier/mode-deepseek-r1:32b/output/system/124 new file mode 100644 index 00000000..8333675e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/124 @@ -0,0 +1,3 @@ + + +SIGSEGV when reading ARM GIC registers through GDB stub diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1241 b/results/classifier/mode-deepseek-r1:32b/output/system/1241 new file mode 100644 index 00000000..54eb52e4 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1241 @@ -0,0 +1,15 @@ + + +About showing the information of the csr +Description of problem: +cannot print the inforamtion after pulling the newest version of qemu +E.g info r csr +only fcsr frm fflags are shown. However , it should print out all the csrs such as mideleg mhartid etc in preivous version +info r mip +(GDB) Invalid register `mip' +Steps to reproduce: +1.running riscv64-unknown-elf-gdb kernel +2.target remote to the port i set in the xv6 makefile +3.type info r mip it shows the the probklem i mentioned above. I could use the print CSR in previous version of QEMU. +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1243 b/results/classifier/mode-deepseek-r1:32b/output/system/1243 new file mode 100644 index 00000000..8f583fb1 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1243 @@ -0,0 +1,3 @@ + + +Floating-point-exception in ide_set_sector diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1245 b/results/classifier/mode-deepseek-r1:32b/output/system/1245 new file mode 100644 index 00000000..d31f4939 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1245 @@ -0,0 +1,3 @@ + + +arm: cp15 support diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1245543 b/results/classifier/mode-deepseek-r1:32b/output/system/1245543 new file mode 100644 index 00000000..b9f1b3bb --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1245543 @@ -0,0 +1,25 @@ + + +Wrong implementation of SSE4.1 pmovzxbw and similar instructions + +QEMU 1.5.0 (and git version, as far as I can tell from the source code) has incorrect implementation of pmovzxbw and similar SSE4.1 instructions. The instruction zero-extends the first 8 8-bit elements of a vector to 16bit vector and puts them to another vector. The current implementation applies this operation only to the first element and zeros out the rest. + +To verify, compile the attached program for SSE4.1 (g++ -msse4.1 cvtint.cc). On real hardware, it produces the following output: + +$ ./a.out +1 0 2 0 3 0 4 0 5 0 6 0 7 0 8 0 + +On QEMU, the output is as follows: + +$ ./a.out +1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 + +QEMU is invoked as: + +qemu-system-x86_64 \ + -M pc -cpu Haswell,+sse4.1,+avx,+avx2,+fma,enforce -m 512 \ + -serial stdio -no-reboot \ + -kernel vmlinuz -initrd initrd.img \ + -netdev user,id=user.0 -device rtl8139,netdev=user.0 -redir tcp:2222::22 \ + -hda ubuntu-amd64.ext3 \ + --append "rw console=tty root=/dev/sda" \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1246 b/results/classifier/mode-deepseek-r1:32b/output/system/1246 new file mode 100644 index 00000000..984d9b30 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1246 @@ -0,0 +1,3 @@ + + +Win11_22H2_English_x64.iso won't boot diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1248168 b/results/classifier/mode-deepseek-r1:32b/output/system/1248168 new file mode 100644 index 00000000..b31cbfee --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1248168 @@ -0,0 +1,26 @@ + + +MIPS, self-modifying code and uncached memory + +Self-modifying code does not work properly in MIPS in uncached and unmapped kseg1 memory region. + +For example, when running this code I get unexpected behavior: + + 0: e3000010 b 0x390 + 4: 00000000 nop + ... + 380: 00701f40 mfc0 ra,c0_epc + 384: 0400e0bb swr zero,4(ra) + 388: 18000042 eret + 38c: 00000000 nop + 390: 25500000 move t2,zero + 394: 02000b34 li t3,0x2 + 398: 23504b01 subu t2,t2,t3 + 39c: e9003c0b j 0xcf003a4 + 3a0: 0a004a21 addi t2,t2,10 + 3a4: ffff0010 b 0x3a4 + 3a8: 00000000 nop + 3ac: 00000000 nop + + I expect that swr instruction in line 384 would change `addi t2,t2,1`0 to `nop` +This should work because no cache is used for this memory region. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1249 b/results/classifier/mode-deepseek-r1:32b/output/system/1249 new file mode 100644 index 00000000..83629a22 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1249 @@ -0,0 +1,3 @@ + + +qemu-edid Division By Zero -- by misuse of the option "-d" diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/125 b/results/classifier/mode-deepseek-r1:32b/output/system/125 new file mode 100644 index 00000000..bcf705de --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/125 @@ -0,0 +1,3 @@ + + +x86: ret, lret and iret with noncanonical IP saves wrong IP on the exception stack diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1252 b/results/classifier/mode-deepseek-r1:32b/output/system/1252 new file mode 100644 index 00000000..ac18ffed --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1252 @@ -0,0 +1,19 @@ + + +Debian Raspberry Pi images do not boot with version 7 and higher +Description of problem: +The Debian Bullseye RPi4 4GB image [here](https://raspi.debian.net/tested-images/) does not boot with versions 7 and higher, while it does boot with v6.2.0. The Bookworm image works with v7. +Steps to reproduce: +0. `export DEB_VERS=5.10.0-11` +1. `wget https://raspi.debian.net/tested/20220121_raspi_4_bullseye.img.xz` +2. `dd if=/dev/null of=disk-$DEB_VERS.img bs=1M seek=10240` + * NB: This creates a 10 GB file +3. `xzcat $RPI_IMG | dd of=disk-$DEB_VERS.img conv=notrunc status=progress` +4. `partx -a -v disk-$DEB_VERS.img` +5. `mount /dev/loop0p1 /mnt` +6. `cp /mnt/initrd.img-$DEB_VERS-arm64 .` +7. `cp /mnt/vmlinuz-$DEB_VERS-arm64 .` +8. `umount /mnt` +9. `qemu-system-aarch64 -M virt -m 4096 -cpu max -drive format=raw,file=disk-$DEB_VERS.img -nographic -append "console=tty0 console=ttyAMA0,115200 console=ttyS1,115200 root=LABEL=RASPIROOT rw fsck.repair=yes net.ifnames=0 cma=64M rootwait" -initrd initrd.img-$DEB_VERS-arm64 -kernel vmlinuz-$DEB_VERS-arm64` +Additional information: +The URL for the image in step 1 has been known to change, so if you get a 404, go to the URL above and find the correct one. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1253 b/results/classifier/mode-deepseek-r1:32b/output/system/1253 new file mode 100644 index 00000000..5ef349bf --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1253 @@ -0,0 +1,3 @@ + + +pull mirroring diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1253465 b/results/classifier/mode-deepseek-r1:32b/output/system/1253465 new file mode 100644 index 00000000..8f813e8f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1253465 @@ -0,0 +1,10 @@ + + +qemu-img: 'image' uses a vmdk feature which is not supported by this qemu version: VMDK version 3 + +qemu-img convert in.vmdk -O RAW out.img + +Fails with: +qemu-img: 'image' uses a vmdk feature which is not supported by this qemu version: VMDK version 3 + +qemu-img version 1.6.1 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1254 b/results/classifier/mode-deepseek-r1:32b/output/system/1254 new file mode 100644 index 00000000..026caf7a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1254 @@ -0,0 +1,57 @@ + + +hw: misc: edu: two off-by-one errors +Description of problem: +In `hw/misc/edu.c`, `edu_check_range()` fails for boundary conditions where `size2 == 0` and `size2 == size1`. +Steps to reproduce: +Two ways to reproduce (attached test program, [foo.c](/uploads/9cbef4f72d175b8336b58f607e262d7b/foo.c)) + +error: +1. `gcc -o foo foo.c` +2. `./foo` + +fix: +1. `gcc -DFIXED -o foo foo.c` +2. `./foo` + +Using `qtest`: (see "QEMU command line" above). +Additional information: +(output of `foo` without fix): +``` +EDU: DMA range 0x0000000000000000-0x0000000000000fff out of bounds (0x0000000000000000-0xffffffffffffffff)! +EDU: DMA range 0x0000000000000000-0x0000000000000fff out of bounds (0x0000000000000000-0x0000000000000fff)! +``` + +Output of `qtest` without the fix: +``` +qemu: hardware error: EDU: DMA range 0x0000000000000000-0x0000000000000fff out of bounds (0x0000000000040000-0x0000000000040fff)! +CPU #0: +EAX=00000000 EBX=00000000 ECX=00000000 EDX=00000663 +ESI=00000000 EDI=00000000 EBP=00000000 ESP=00000000 +EIP=0000fff0 EFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 +ES =0000 00000000 0000ffff 00009300 +CS =f000 ffff0000 0000ffff 00009b00 +SS =0000 00000000 0000ffff 00009300 +DS =0000 00000000 0000ffff 00009300 +FS =0000 00000000 0000ffff 00009300 +GS =0000 00000000 0000ffff 00009300 +LDT=0000 00000000 0000ffff 00008200 +TR =0000 00000000 0000ffff 00008b00 +GDT= 00000000 0000ffff +IDT= 00000000 0000ffff +CR0=60000010 CR2=00000000 CR3=00000000 CR4=00000000 +DR0=00000000 DR1=00000000 DR2=00000000 DR3=00000000 +DR6=ffff0ff0 DR7=00000400 +EFER=0000000000000000 +FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 +FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 +FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 +FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 +FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 +XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000 +XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000 +XMM04=0000000000000000 0000000000000000 XMM05=0000000000000000 0000000000000000 +XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000 +``` + +Patch has been submitted to `qemu-devel` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1256826 b/results/classifier/mode-deepseek-r1:32b/output/system/1256826 new file mode 100644 index 00000000..aeb1a08b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1256826 @@ -0,0 +1,13 @@ + + +INT instruction bug in WindowsXP + +This bug is in -no-kvm mode. + +In windowsXP at IDT entry 2&8 is Task gate + +when application use INT 2 or INT 8 it will cause blue screen in XP. + +I found it should cause #GP not generate hw interrupt. + +also I check this bug with -enable-kvm and works correctly. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1258168 b/results/classifier/mode-deepseek-r1:32b/output/system/1258168 new file mode 100644 index 00000000..940811b0 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1258168 @@ -0,0 +1,133 @@ + + +QEMU fails to build on CentOS 5.10 with --disable-pie reporting "/usr/bin/ld: -f may not be used without -shared " + +fails for (7dc65c0 (HEAD, origin/master, origin/HEAD, master) Open 2.0 development tree): + +... +libtool --mode=link --tag=CC cc -m64 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wall -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -Wendif-labels -Wmissing-include-dirs -Wnested-externs -Wformat-security -Wformat-y2k -Winit-self -Wold-style-definition -fstack-protector-all -I/usr/include/libpng12 -I/usr/include/nss3 -I/usr/include/nspr4 -pthread -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include -I/usr/include/pixman-1 -I/home/don/qemu/dtc/libfdt -pthread -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include -I/home/don/qemu/tests -O2 -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -g -Wl,--warn-common -m64 -g -o vscclient libcacard/vscclient.o libcacard.la -Wc,-fstack-protector-all -lrt -pthread -L/lib64 -lgthread-2.0 -lglib-2.0 -lz -L/usr/kerberos/lib64 -lcurl -ldl -lgssapi_krb5 -lkrb5 -lk5crypto -lcom_err -lidn -lssl -lcrypto -lz -luuid +cc -m64 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wall -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -Wendif-labels -Wmissing-include-dirs -Wnested-externs -Wformat-security -Wformat-y2k -Winit-self -Wold-style-definition -fstack-protector-all -I/usr/include/libpng12 -I/usr/include/nss3 -I/usr/include/nspr4 -pthread -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include -I/usr/include/pixman-1 -I/home/don/qemu/dtc/libfdt -pthread -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include -I/home/don/qemu/tests -O2 -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -g -Wl,--warn-common -m64 -g -o .libs/vscclient libcacard/vscclient.o -Wl,-fstack-protector-all -pthread ./.libs/libcacard.so -L/lib64 -L/usr/kerberos/lib64 -lssl3 -lsmime3 -lnss3 -lnssutil3 -lplds4 -lplc4 -lnspr4 -lpthread -lrt -lgthread-2.0 -lglib-2.0 -lcurl -ldl -lgssapi_krb5 -lkrb5 -lk5crypto -lcom_err -lidn -lssl -lcrypto -lz -luuid -Wl,--rpath -Wl,/usr/local/lib +/usr/bin/ld: -f may not be used without -shared +collect2: ld returned 1 exit status +make: *** [vscclient] Error 1 + +rm -rf out/tmp;mkdir out/tmp;pushd out/tmp;../../configure --disable-pie;make V=1 1>zz1 2>&1;popd +~/qemu/out/tmp ~/qemu +Install prefix /usr/local +BIOS directory /usr/local/share/qemu +binary directory /usr/local/bin +library directory /usr/local/lib +libexec directory /usr/local/libexec +include directory /usr/local/include +config directory /usr/local/etc +local state directory /usr/local/var +Manual directory /usr/local/share/man +ELF interp prefix /usr/gnemul/qemu-%M +Source path /home/don/qemu +C compiler cc +Host C compiler cc +C++ compiler c++ +Objective-C compiler cc +ARFLAGS rv +CFLAGS -O2 -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -g +QEMU_CFLAGS -m64 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wall -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -Wendif-labels -Wmissing-include-dirs -Wnested-externs -Wformat-security -Wformat-y2k -Winit-self -Wold-style-definition -fstack-protector-all -I/usr/include/libpng12 -I/usr/include/nss3 -I/usr/include/nspr4 -pthread -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include -I/usr/include/pixman-1 -I$(SRC_PATH)/dtc/libfdt +LDFLAGS -Wl,--warn-common -m64 -g +make make +install install +python python +smbd /usr/sbin/smbd +host CPU x86_64 +host big endian no +target list alpha-softmmu arm-softmmu cris-softmmu i386-softmmu lm32-softmmu m68k-softmmu microblaze-softmmu microblazeel-softmmu mips-softmmu mips64-softmmu mips64el-softmmu mipsel-softmmu moxie-softmmu or32-softmmu ppc-softmmu ppc64-softmmu ppcemb-softmmu s390x-softmmu sh4-softmmu sh4eb-softmmu sparc-softmmu sparc64-softmmu unicore32-softmmu x86_64-softmmu xtensa-softmmu xtensaeb-softmmu alpha-linux-user arm-linux-user armeb-linux-user cris-linux-user i386-linux-user m68k-linux-user microblaze-linux-user microblazeel-linux-user mips-linux-user mips64-linux-user mips64el-linux-user mipsel-linux-user mipsn32-linux-user mipsn32el-linux-user or32-linux-user ppc-linux-user ppc64-linux-user ppc64abi32-linux-user s390x-linux-user sh4-linux-user sh4eb-linux-user sparc-linux-user sparc32plus-linux-user sparc64-linux-user unicore32-linux-user x86_64-linux-user +tcg debug enabled no +gprof enabled no +sparse enabled no +strip binaries yes +profiler no +static build no +-Werror enabled no +pixman system +SDL support yes +GTK support no +curses support yes +curl support yes +mingw32 support no +Audio drivers oss +Block whitelist (rw) +Block whitelist (ro) +VirtFS support yes +VNC support yes +VNC TLS support no +VNC SASL support yes +VNC JPEG support yes +VNC PNG support yes +VNC WS support no +xen support yes +brlapi support no +bluez support no +Documentation yes +GUEST_BASE yes +PIE no +vde support no +Linux AIO support no +ATTR/XATTR support yes +Install blobs yes +KVM support yes +RDMA support no +TCG interpreter no +fdt support yes +preadv support no +fdatasync yes +madvise yes +posix_madvise yes +sigev_thread_id yes +uuid support yes +libcap-ng support no +vhost-net support yes +vhost-scsi support yes +Trace backend nop +Trace output file trace-<pid> +spice support no (/) +rbd support no +xfsctl support no +nss used yes +libusb no +usb net redir no +GLX support yes +libiscsi support no +build guest agent yes +QGA VSS support no +seccomp support no +coroutine backend ucontext +coroutine pool yes +GlusterFS support no +virtio-blk-data-plane no +gcov gcov +gcov enabled no +TPM support no +libssh2 support no +TPM passthrough no +QOM debugging yes +vhdx yes + +I bisect'd this to: + +dcs-xen-53:~/qemu>git-bisect good +37746c5eacf309fa019ea0fa45f776c36c561457 is the first bad commit +commit 37746c5eacf309fa019ea0fa45f776c36c561457 +Author: Marc-André Lureau <email address hidden> +Date: Mon Feb 25 23:31:12 2013 +0100 + + build-sys: must link with -fstack-protector + + It is needed to give that flag to the linker as well, but latest + libtool 2.4.2 still swallows that argument, so let's pass it with + libtool -Wc argument. + + qemu-1.4.0/stubs/arch-query-cpu-def.c:6: undefined reference to `__stack_chk_guard' + + Signed-off-by: Marc-André Lureau <email address hidden> + Reviewed-by: Alon Levy <email address hidden> + +:100755 100755 33d3354ea30838694020660f5822f551293d7e9a ee2e7e8ad9b8a23af96e4e404e3f7658efcbe74b M configure +:100644 100644 edc2552f0886c99608b97f85bd932460fa50da73 36aba2de1fa9e0f8acde7640818e94a28dd03c80 M rules.mak \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1259 b/results/classifier/mode-deepseek-r1:32b/output/system/1259 new file mode 100644 index 00000000..ad86d4cf --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1259 @@ -0,0 +1,3 @@ + + +RISC-V csr diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1260 b/results/classifier/mode-deepseek-r1:32b/output/system/1260 new file mode 100644 index 00000000..65b150e4 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1260 @@ -0,0 +1,3 @@ + + +RISC-V sstatus register is missing in qemu console / gdb diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1267955 b/results/classifier/mode-deepseek-r1:32b/output/system/1267955 new file mode 100644 index 00000000..e9cb6da8 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1267955 @@ -0,0 +1,44 @@ + + +[i386] Parity Flag Not Set On xor %eax,%eax + +Tested against qemu-1.7.0 as well as qemu-1.7.50 on Debian Sid + +Steps To Reproduce + +$ cat > prog.hex << EOF + +7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 +02 00 03 00 01 00 00 00 54 80 04 08 34 00 00 00 +00 00 00 00 00 00 00 00 34 00 20 00 01 00 28 00 +00 00 00 00 01 00 00 00 00 00 00 00 00 80 04 08 +00 80 04 08 76 00 00 00 76 00 00 00 05 00 00 00 +00 10 00 00 + +31 c0 +9c + +b8 04 00 00 00 +bb 01 00 00 00 +89 e1 +ba 04 00 00 00 +cd 80 + +b8 01 00 00 00 +bb 00 00 00 00 +cd 80 + +EOF + +$ xxd -p -r prog.hex > prog +$ chmod 700 prog + +$ ./prog | hexdump -vC +00000000 46 02 00 00 |F...| +00000004 + +$ qemu-i386 ./prog | hexdump -vC +00000000 42 02 00 00 |B...| +00000004 + +On the other hand if [xor %eax, %eax] (31 c0) is replaced with sub %eax,%eax (29 c0), then the parity flag is set correctly. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1268 b/results/classifier/mode-deepseek-r1:32b/output/system/1268 new file mode 100644 index 00000000..5a228141 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1268 @@ -0,0 +1,3 @@ + + +erst: undefined-behavior in memcpy in write_erst_record diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1273 b/results/classifier/mode-deepseek-r1:32b/output/system/1273 new file mode 100644 index 00000000..ace5fe46 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1273 @@ -0,0 +1,3 @@ + + +QEMU log problem diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1273944 b/results/classifier/mode-deepseek-r1:32b/output/system/1273944 new file mode 100644 index 00000000..7b7932f8 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1273944 @@ -0,0 +1,13 @@ + + +multiboot header has 0 in mem_upper field + +When booting a multiboot image,. mem_upper is now always zero. + +To test, build qemu from current git head, then do + cd tests/multiboot + ./run_test.sh + +You will see the test fail. In each case mem_upper is 0k. + +git-bisect says the bad commit is 0169c511554cb0014a00290b0d3d26c31a49818f in qemu.git \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1274 b/results/classifier/mode-deepseek-r1:32b/output/system/1274 new file mode 100644 index 00000000..8c508472 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1274 @@ -0,0 +1,34 @@ + + +Cannot debug init using "qemu -s -S" if init is compiled dynamically or if kvm is enabled +Description of problem: +I'm trying to connect from host to init process running in guest. I'm using this guide: https://qemu-project.gitlab.io/qemu/system/gdb.html . Everything works well, but there is two problems: +1. Debugging stops to work if I add "-enable-kvm" +2. Debugging stops to work if I remove "-static" when compiling init +Steps to reproduce: +I have absolutely fresh Debian sid system (as of 2022-10-22). I create the following file on it: +```c +#include <stdio.h> + +int +main () +{ + printf ("a\n"); + printf ("b\n"); + for (;;); +} +``` + +Then I compile it so: `gcc -static -g a.c`. Result is saved as `/root/a.out`. Then I run `sync; echo 3 > /proc/sys/vm/drop_caches; sync` to make sure this `/root/a.out` actually got to disk. + +Then I start the host system inside of qemu using well-known `-snapshot /dev/sda` trick. Exact command is here: + +```bash +qemu-system-x86_64 -daemonize -m 300M -s -S -kernel /vmlinuz -initrd /initrd.img -snapshot -append "root=/dev/sda init=/root/a.out" -drive file=/dev/sda,format=raw +``` + +(As you guessed, my disk has no partitions, it directly stores ext4 filesystem.) + +Then I type on host `gdb ./a.out`. And then inside of gdb I type `target remote localhost:1234`, then `br 7` (line 7 is `printf ("b\n")`, then `c`. Then guest OS boots and reaches init (i. e. `/root/a.out`). And then gdb actually pauses on line 7. I. e. everything works! + +But if I add `-enable-kvm` to qemu command line OR remove `-static` from gcc command line, then breakpoint doesn't work, i. e. gdb doesn't pause on breakpoint, the execution continues and the execution fails to infinite loop. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1275 b/results/classifier/mode-deepseek-r1:32b/output/system/1275 new file mode 100644 index 00000000..050daae1 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1275 @@ -0,0 +1,11 @@ + + +javac command stuck forever in qemu vm which does not use hardware virtualization +Description of problem: + +Steps to reproduce: +1. +2. +3. +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1277 b/results/classifier/mode-deepseek-r1:32b/output/system/1277 new file mode 100644 index 00000000..9cdd213c --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1277 @@ -0,0 +1,3 @@ + + +two instructions has executed twice diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1281 b/results/classifier/mode-deepseek-r1:32b/output/system/1281 new file mode 100644 index 00000000..19bab7b9 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1281 @@ -0,0 +1,3 @@ + + +xv6 kernel problem in single step mode diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1289 b/results/classifier/mode-deepseek-r1:32b/output/system/1289 new file mode 100644 index 00000000..87dc766d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1289 @@ -0,0 +1,3 @@ + + +plugin get registers diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/129 b/results/classifier/mode-deepseek-r1:32b/output/system/129 new file mode 100644 index 00000000..79c64837 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/129 @@ -0,0 +1,14 @@ + + +Build failure due to conflicts with the C++20 version header +Steps to reproduce: +qemu 5.2.0: +``` +brew install -s qemu +``` + +qemu 6.0.0: +``` +wget https://raw.githubusercontent.com/Homebrew/homebrew-core/02107501a48cc9d08480913ee1c79866dc60c23a/Formula/qemu.rb +brew install -s qemu.rb +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1290 b/results/classifier/mode-deepseek-r1:32b/output/system/1290 new file mode 100644 index 00000000..105ed775 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1290 @@ -0,0 +1,3 @@ + + +IO alignment probing delivers incorrect results on Linux when used with e.g. dm-crypt diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1290558 b/results/classifier/mode-deepseek-r1:32b/output/system/1290558 new file mode 100644 index 00000000..cd881fe6 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1290558 @@ -0,0 +1,15 @@ + + +color issue (ppc as guest) + +Hi, + +on my qemu 1.6.1 -- installed via fink on host Mac OS X 10.8 -- guest PowerPc with Mac OS X 10.4 from original install disk, boots fine but I observe a color issue exactly as described here: +http://virtuallyfun.superglobalmegacorp.com/?p=3197 +http://virtuallyfun.superglobalmegacorp.com/?p=3189 + +Has the problem been reported and/or fixed already? Is any workaround known or has one been suggested? +I apologize for a "fuzzy" problem description, but I am not an expert user. You may get in touch with me directly at <email address hidden> + +Thanks, +Joe. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1292 b/results/classifier/mode-deepseek-r1:32b/output/system/1292 new file mode 100644 index 00000000..7f10fc66 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1292 @@ -0,0 +1,5 @@ + + +Default jemalloc config doesn't work on Asahi Linux +Description of problem: +M1 Macs use 16KB pages, jemalloc builds with 4KB page by default. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1296882 b/results/classifier/mode-deepseek-r1:32b/output/system/1296882 new file mode 100644 index 00000000..b0d22ead --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1296882 @@ -0,0 +1,7 @@ + + +add next free device option to qemu-img + +I'd like to propose an option to be added to qemu-img which returns the next free NBD (the device file) very similar to losetup -f. It would make life a lot easier. + +Followers of this enhancement request might be interested in the following workaround: http://stackoverflow.com/questions/22535222/next-free-device-option-for-qemu-nbd/ \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1297 b/results/classifier/mode-deepseek-r1:32b/output/system/1297 new file mode 100644 index 00000000..83074177 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1297 @@ -0,0 +1,3 @@ + + +qemu: fatal: Lockup: can't escalate 3 to HardFault (current priority -1) diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/130 b/results/classifier/mode-deepseek-r1:32b/output/system/130 new file mode 100644 index 00000000..ca1ac306 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/130 @@ -0,0 +1,3 @@ + + +QEmu translation is incorrect when using REX in combination with LAHF/SAHF diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1303 b/results/classifier/mode-deepseek-r1:32b/output/system/1303 new file mode 100644 index 00000000..17a0192b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1303 @@ -0,0 +1,3 @@ + + +tcg/cputlb: code path is reachable in load_memop/store_memop() diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1304 b/results/classifier/mode-deepseek-r1:32b/output/system/1304 new file mode 100644 index 00000000..d1b9b325 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1304 @@ -0,0 +1,11 @@ + + +loadvm for arm vexpress-a9 +Description of problem: + +Steps to reproduce: +1. savevm test +2. loadvm test +3. After I execute savevm and loadvm,the guest is not responding +Additional information: +I have read this issue(https://github.com/panda-re/panda/issues/643). If secure is set to off,the guest works well. But I need to use security extensions,so secure cannot be set to off.What do I need to do to solve this problem？ diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1310324 b/results/classifier/mode-deepseek-r1:32b/output/system/1310324 new file mode 100644 index 00000000..93587f01 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1310324 @@ -0,0 +1,23 @@ + + +Commit 0f842f8a introduces regression when using tcg-interpreter + +Hi. + +Commit 0f842f8a246f2b5b51a11c13f933bf7a90ae8e96 apparently introduces a regression when using --enable-tcg-interpreter. The regression is manifested as follows: + + 1. Checkout any qemu commit later or equal that the one said above. Beside that one, I tested v1.7.1, v2.0.0 and a few other commits suggested to my by git bisect. + 2. Possibly cherry-pick commit a32b12741bf45bf3f46bffe5a79cb2548a060cd8, which fixes a compilation bug with --enable-tcg-interpreter. + 3. Compile with: ./configure --target-list=i386-softmmu --enable-tcg-interpreter && make -j8 + 4. Create an empty virtual disk and try to install Windows XP on it booting from Windows CD-ROM. After the loading program, the installer immediately crashes with blue screen (it should instead show the installation confirmation dialog and then the EULA acceptance dialog, if it worked correctly). + +I'm mentioning Windows XP because it is the problem I found. Probably other operating systems would fail as well. I can test others, if you think it would be helpful. I can also give you access to the very exact CD-ROM image I'm using. + +The exact command line I'm using is: +build_location/i386-softmmu/qemu-system-i386 -m 512 -drive file=winxp_test.img -cdrom wipxp_cdrom.iso + +Attached is the blue screen that I see (unfortunately it is Italian, but that's a standard error message and I hope this is not a problem). + +I'm not able to understand the nature of the commit to identify what could be the problem. My nose tells me that it may be some stupid mistake, for example in some offset constant, that nobody ever saw because tcg-interpreter is not much used. + +Thanks, Giovanni. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1311 b/results/classifier/mode-deepseek-r1:32b/output/system/1311 new file mode 100644 index 00000000..25f4aca6 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1311 @@ -0,0 +1,3 @@ + + +riscv-qemu can't record interrupt diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1314 b/results/classifier/mode-deepseek-r1:32b/output/system/1314 new file mode 100644 index 00000000..8b9f8c85 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1314 @@ -0,0 +1,42 @@ + + +68k: issues with fremx and fmodx +Description of problem: +Some of the mac68k folks have been testing my MacOS branch at https://github.com/mcayland/qemu/tree/q800.upstream2-vm and noticed problems with the values of some of the MacOS _Pack5 transcendental functions. This is easily visible when calling the `sin()` and `cos()` functions whereby some angle ranges use the values from the wrong section of the waveform and/or return values with the incorrect sign. + +SolraBizna was kind enough to write a 68K MacOS test program to generate a sine table (including dumping the hex values of the FP registers) that could be run on real hardware for comparison with QEMU. Using this it was discovered that the issue is related to the implementation of the `fremx` and `fmodx` instructions which can be found in [`floatx80_modrem()`](https://gitlab.com/qemu-project/qemu/-/blob/master/fpu/softfloat.c#L2601). + +I have taken the output of the test program run on a real 68040 Mac and used it to create a test harness at https://github.com/mcayland/qemu/commits/68k-fmodrem-bug [(diff from git master)](https://github.com/mcayland/qemu/commit/4afd6b7c3cad89df943ec43395f95dad7f368338.diff) which iterates over 100 points of the sine table and uses the registers to indicate any failures according to the following comment: + +``` + /* + * The test program below hangs when it completes and the exit + * condition can be determined using the monitor via "info + * registers" command as follows: + * + * D7 is the test number (0-99) + * D6 is the error code + * 0 = no error + * 1 = frem result incorrect + * 2 = frem fpsr result incorrect + * 3 = fmod result incorrect + * 4 = fmod fpsr result incorrect + * D2 is the actual result of the long comparison + * D1 is the expected result of the long comparison + * + * A successful termination of the test program is when D7 == 100 + * and D6 == 0. + */ +``` + +This enables the majority of debugging to be done directly using `info registers` in the monitor rather than manually stepping through the example code using the gdbstub. + +Based upon my local testing on `qemu-system-m68k` there are 2 main differences between QEMU and the output from a real 68040: + +- Differences in precision + +The very first `fremx` result comparison fails here returning `0x3ffe0000 0xc90fdaa2 0x2168c23c 0x........` instead of `0x3ffe0000 0xc90fdaa2 0x2168c238 0x........`. Fortunately the difference in precision is small, and while it may not be possible to fix this, at least it gives a measure of how QEMU's emulation compares to a real 68040. + +- Incorrect setting of the quotient byte + +Bits 16-23 of the FPSR are supposed to contain the sign and 7 LSBs of the quotient for `fremx` and `fmodx` instructions, which is used in _Pack5 to generate an offset into a lookup table for the transcendental functions. It appears that the main cause of the incorrect `sin()` and `cos()` functions is due to the quotient byte being set incorrectly by `fremx`, causing MacOS to jump to the wrong segment of the lookup table for certain angle ranges. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1316 b/results/classifier/mode-deepseek-r1:32b/output/system/1316 new file mode 100644 index 00000000..9c878efc --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1316 @@ -0,0 +1,3 @@ + + +qemu.qmp.protocol.ConnectError: Failed to establish connection: AF_UNIX path too long (on Darwin) diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1319 b/results/classifier/mode-deepseek-r1:32b/output/system/1319 new file mode 100644 index 00000000..303f9fcb --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1319 @@ -0,0 +1,15 @@ + + +Build warnings when building qemu with 'disable-tcg' for ppc64-softmmu target +Description of problem: +Building recent upstream qemu (HEAD 2c8311241d) for 'ppc64-softmmu' target is failing due to following build warnings: + +<snip> + ../target/ppc/cpu_init.c:7018:13: error: 'ppc_restore_state_to_opc' defined but not used [-Werror=unused-function] + 7018 | static void ppc_restore_state_to_opc(CPUState *cs, +<snip> +Steps to reproduce: +1. $ git clone --recurse-submodules https://gitlab.com/qemu-project/qemu.git +2. ./configure --target-list=ppc64-softmmu --disable-tcg && make +Additional information: +Patch for this issue has been posted and reviewed at https://lore.kernel.org/all/20221116131743.658708-1-vaibhav@linux.ibm.com/ diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/132 b/results/classifier/mode-deepseek-r1:32b/output/system/132 new file mode 100644 index 00000000..b6ce9ac8 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/132 @@ -0,0 +1,3 @@ + + +AVX instruction VMOVDQU implementation error for YMM registers diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1321 b/results/classifier/mode-deepseek-r1:32b/output/system/1321 new file mode 100644 index 00000000..37520367 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1321 @@ -0,0 +1,10 @@ + + +qemu-system-i386 runs slow after upgrading legacy project from qemu 2.9.0 to 7.1.0 +Description of problem: +Using several custom serial and irq devices including timers. +The same code (after some customisation in order to compile with new 7.1.0 API and meson build system runs about 50% slower. +We had to remove "-icount 4" switch which worked fine with 2.9.0 just to get to this point. +Even running with multi-threaded tcg did not help. +We don't use the new ptimer API but rather the old QEMUTimer. +Any suggestions to why we encounter this vast performance degradation? diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1324 b/results/classifier/mode-deepseek-r1:32b/output/system/1324 new file mode 100644 index 00000000..91a0570d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1324 @@ -0,0 +1,42 @@ + + +Unhandled exception when booting UEFI x86_64 system image +Description of problem: +I have a bootable Ubuntu 20.04-based operating system image that I typically flash to the internal storage of an embedded Intel Atom computer. When I try booting it under QEMU, I reach the GRUB boot menu, but when it attempts to start the kernel, it outputs: + +``` +ERROR:../target/i386/tcg/sysemu/excp_helper.c:517:raise_stage2: code should not be reached +Bail out! ERROR:../target/i386/tcg/sysemu/excp_helper.c:517:raise_stage2: code should not be reached +Aborted (core dumped) +``` + +The kernel settings configured in GRUB are: + +``` +linux /boot/vmlinuz-5.4.0-132-generic root=UUID=816fe083-fc26-4a0d-ae4a-68d1b16dfb66 ro console=uart,mmio32,0xd091c000 console=ttyS4,115200n8 console=tty0 ? +initrd /boot/initrd.img-5.4.0-132-generic +``` + +If I run an older QEMU 4.2.1 that ships with Ubuntu: + +``` +!!!! X64 Exception Type - 0D(#GP - General Protection) CPU Apic ID - 00000000 !!!! +ExceptionData - 0000000000000000 +RIP - 0000000007F2CD0E, CS - 0000000000000038, RFLAGS - 0000000000200206 +RAX - AFAFAFAFAFAFAFAF, RCX - 000000000657F408, RDX - AFAFAFAFAFAFAFAF +RBX - 0000000000000288, RSP - 0000000007F1BC48, RBP - 0000000007F336A0 +RSI - 0000000007F336F8, RDI - 0000000000001000 +R8 - 000000000657F408, R9 - 0000000000000320, R10 - 0000000000000000 +R11 - 0000000000000000, R12 - 0000000000000004, R13 - 000000000657F400 +R14 - 0000000000000000, R15 - 0000000000000000 +DS - 0000000000000030, ES - 0000000000000030, FS - 0000000000000030 +GS - 0000000000000030, SS - 0000000000000030 +CR0 - 0000000080010033, CR2 - 0000000000000000, CR3 - 0000000007C01000 +CR4 - 0000000000000668, CR8 - 0000000000000000 +DR0 - 0000000000000000, DR1 - 0000000000000000, DR2 - 0000000000000000 +DR3 - 0000000000000000, DR6 - 00000000FFFF0FF0, DR7 - 0000000000000400 +GDTR - 0000000007BEEA98 0000000000000047, LDTR - 0000000000000000 +IDTR - 00000000072D1018 0000000000000FFF, TR - 0000000000000000 +FXSAVE_STATE - 0000000007F1B8A0 +!!!! Find image based on IP(0x7F2CD0E) /build/edk2-xUnmxG/edk2-0~20191122.bd85bf54/Build/OvmfX64/RELEASE_GCC5/X64/MdeModulePkg/Core/Dxe/DxeMain/DEBUG/DxeCore.dll (ImageBase=0000000007F1D000, EntryPoint=0000000007F2FAAE) !!!! +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1327 b/results/classifier/mode-deepseek-r1:32b/output/system/1327 new file mode 100644 index 00000000..200c1e41 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1327 @@ -0,0 +1,92 @@ + + +vhost-user-test outputs scary messages +Description of problem: +The qos-test seems to output failure messages when run in verbose mode, see e.g.: + +https://gitlab.com/qemu-project/qemu/-/jobs/3340919275#L5615 + +``` +――――――――――――――――――――――――――――――――――――― ✀ ――――――――――――――――――――――――――――――――――――― +stderr: +qemu-system-aarch64: Failed to set msg fds. +qemu-system-aarch64: vhost VQ 0 ring restore failed: -22: Invalid argument (22) +qemu-system-aarch64: Failed to set msg fds. +qemu-system-aarch64: vhost_set_vring_endian failed: Invalid argument (22) +qemu-system-aarch64: Failed to set msg fds. +qemu-system-aarch64: vhost VQ 1 ring restore failed: -22: Invalid argument (22) +qemu-system-aarch64: Failed to set msg fds. +qemu-system-aarch64: vhost_set_vring_endian failed: Invalid argument (22) +qemu-system-aarch64: -chardev socket,id=chr-reconnect,path=/tmp/vhost-test-9B51V1/reconnect.sock,server=on: info: QEMU waiting for connection on: disconnected:unix:/tmp/vhost-test-9B51V1/reconnect.sock,server=on +qemu-system-aarch64: Failed to set msg fds. +qemu-system-aarch64: vhost VQ 0 ring restore failed: -22: Invalid argument (22) +qemu-system-aarch64: Failed to set msg fds. +qemu-system-aarch64: vhost_set_vring_endian failed: Invalid argument (22) +qemu-system-aarch64: Failed to set msg fds. +qemu-system-aarch64: vhost VQ 1 ring restore failed: -22: Invalid argument (22) +qemu-system-aarch64: Failed to set msg fds. +qemu-system-aarch64: vhost_set_vring_endian failed: Invalid argument (22) +qemu-system-aarch64: -chardev socket,id=chr-connect-fail,path=/tmp/vhost-test-49UUV1/connect-fail.sock,server=on: info: QEMU waiting for connection on: disconnected:unix:/tmp/vhost-test-49UUV1/connect-fail.sock,server=on +qemu-system-aarch64: -netdev vhost-user,id=hs0,chardev=chr-connect-fail,vhostforce=on: Failed to read msg header. Read 0 instead of 12. Original request 1. +qemu-system-aarch64: -netdev vhost-user,id=hs0,chardev=chr-connect-fail,vhostforce=on: vhost_backend_init failed: Protocol error +qemu-system-aarch64: -netdev vhost-user,id=hs0,chardev=chr-connect-fail,vhostforce=on: failed to init vhost_net for queue 0 +qemu-system-aarch64: -netdev vhost-user,id=hs0,chardev=chr-connect-fail,vhostforce=on: info: QEMU waiting for connection on: disconnected:unix:/tmp/vhost-test-49UUV1/connect-fail.sock,server=on +qemu-system-aarch64: Failed to write msg. Wrote -1 instead of 20. +qemu-system-aarch64: vhost VQ 0 ring restore failed: -22: Invalid argument (22) +qemu-system-aarch64: Failed to set msg fds. +qemu-system-aarch64: vhost_set_vring_endian failed: Invalid argument (22) +qemu-system-aarch64: Failed to set msg fds. +qemu-system-aarch64: vhost VQ 1 ring restore failed: -22: Invalid argument (22) +qemu-system-aarch64: Failed to set msg fds. +qemu-system-aarch64: vhost_set_vring_endian failed: Invalid argument (22) +qemu-system-aarch64: -chardev socket,id=chr-flags-mismatch,path=/tmp/vhost-test-LTKOV1/flags-mismatch.sock,server=on: info: QEMU waiting for connection on: disconnected:unix:/tmp/vhost-test-LTKOV1/flags-mismatch.sock,server=on +qemu-system-aarch64: Failed to write msg. Wrote -1 instead of 52. +qemu-system-aarch64: vhost_set_mem_table failed: Invalid argument (22) +qemu-system-aarch64: unable to start vhost net: 22: falling back on userspace virtio +vhost lacks feature mask 0x40000000 for backend +qemu-system-aarch64: failed to init vhost_net for queue 0 +qemu-system-aarch64: Failed to write msg. Wrote -1 instead of 20. +qemu-system-aarch64: vhost_set_vring_num failed: Invalid argument (22) +qemu-system-aarch64: unable to start vhost net: 22: falling back on userspace virtio +qemu-system-aarch64: Failed to set msg fds. +qemu-system-aarch64: vhost VQ 0 ring restore failed: -22: Invalid argument (22) +qemu-system-aarch64: Failed to set msg fds. +qemu-system-aarch64: vhost_set_vring_endian failed: Invalid argument (22) +qemu-system-aarch64: Failed to set msg fds. +qemu-system-aarch64: vhost VQ 1 ring restore failed: -22: Invalid argument (22) +qemu-system-aarch64: Failed to set msg fds. +qemu-system-aarch64: vhost_set_vring_endian failed: Invalid argument (22) +qemu-system-aarch64: Failed to set msg fds. +qemu-system-aarch64: vhost VQ 2 ring restore failed: -22: Invalid argument (22) +qemu-system-aarch64: Failed to set msg fds. +qemu-system-aarch64: vhost_set_vring_endian failed: Invalid argument (22) +qemu-system-aarch64: Failed to set msg fds. +qemu-system-aarch64: vhost VQ 3 ring restore failed: -22: Invalid argument (22) +qemu-system-aarch64: Failed to set msg fds. +qemu-system-aarch64: vhost_set_vring_endian failed: Invalid argument (22) +qemu-system-aarch64: Failed to set msg fds. +qemu-system-aarch64: vhost VQ 0 ring restore failed: -22: Invalid argument (22) +qemu-system-aarch64: Failed to set msg fds. +qemu-system-aarch64: vhost_set_vring_endian failed: Invalid argument (22) +qemu-system-aarch64: Failed to set msg fds. +qemu-system-aarch64: vhost VQ 1 ring restore failed: -22: Invalid argument (22) +qemu-system-aarch64: Failed to set msg fds. +qemu-system-aarch64: vhost_set_vring_endian failed: Invalid argument (22) +qemu-system-aarch64: Failed to set msg fds. +qemu-system-aarch64: vhost VQ 0 ring restore failed: -22: Invalid argument (22) +qemu-system-aarch64: Failed to set msg fds. +qemu-system-aarch64: vhost_set_vring_endian failed: Invalid argument (22) +qemu-system-aarch64: Failed to set msg fds. +qemu-system-aarch64: vhost VQ 1 ring restore failed: -22: Invalid argument (22) +qemu-system-aarch64: Failed to set msg fds. +qemu-system-aarch64: vhost_set_vring_endian failed: Invalid argument (22) +qemu-system-aarch64: Failed to set msg fds. +qemu-system-aarch64: vhost VQ 0 ring restore failed: -22: Invalid argument (22) +qemu-system-aarch64: Failed to set msg fds. +qemu-system-aarch64: vhost VQ 1 ring restore failed: -22: Invalid argument (22) +qemu-system-aarch64: Failed to set msg fds. +qemu-system-aarch64: vhost_set_vring_call failed: Invalid argument (22) +qemu-system-aarch64: Failed to set msg fds. +qemu-system-aarch64: vhost_set_vring_call failed: Invalid argument (22) +―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――― +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1331 b/results/classifier/mode-deepseek-r1:32b/output/system/1331 new file mode 100644 index 00000000..2bd3698c --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1331 @@ -0,0 +1,3 @@ + + +risc-v sstatus bug diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1335 b/results/classifier/mode-deepseek-r1:32b/output/system/1335 new file mode 100644 index 00000000..f742daf5 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1335 @@ -0,0 +1,3 @@ + + +hot to dump bitmap to disk diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1336192 b/results/classifier/mode-deepseek-r1:32b/output/system/1336192 new file mode 100644 index 00000000..ed47aee3 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1336192 @@ -0,0 +1,7 @@ + + +delvm does not delete snapshots on every disks + +Using more than one block device, using delvm does remove snapshot from the first block device, but does not remove snapshots from other blockdevs (complains about not finding snapshot on 1st blockdev). + +Attached patch fixes that. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/134 b/results/classifier/mode-deepseek-r1:32b/output/system/134 new file mode 100644 index 00000000..b6f7fb36 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/134 @@ -0,0 +1,3 @@ + + +Performance improvement when using "QEMU_FLATTEN" with softfloat type conversions diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1347 b/results/classifier/mode-deepseek-r1:32b/output/system/1347 new file mode 100644 index 00000000..7cf20229 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1347 @@ -0,0 +1,25 @@ + + +qemu-system-arm segfaults: arm_v7m_tcg_ops.restore_state_to_opc is NULL +Description of problem: +gdb backtrace: +``` +#0 0x0000000000000000 in ?? () +#1 0x0000555555eda714 in cpu_restore_state_from_tb (cpu=0x5555570020e0, tb=0x7fffb8f6ce80, host_pc=140735277023274) at ../accel/tcg/translate-all.c:311 +#2 0x0000555555eda785 in cpu_restore_state (cpu=0x5555570020e0, host_pc=140735277023274) at ../accel/tcg/translate-all.c:335 +#3 0x0000555555d01323 in arm_cpu_do_transaction_failed (cs=0x5555570020e0, physaddr=1073885184, addr=1073885184, size=4, access_type=MMU_DATA_LOAD, mmu_idx=1, attrs=..., response=1, retaddr=140735277023274) at ../target/arm/tlb_helper.c:199 +#4 0x0000555555ee4118 in cpu_transaction_failed (cpu=0x5555570020e0, physaddr=1073885184, addr=1073885184, size=4, access_type=MMU_DATA_LOAD, mmu_idx=1, attrs=..., response=1, retaddr=140735277023274) at ../accel/tcg/cputlb.c:1344 +#5 0x0000555555ee42aa in io_readx (env=0x555557003f50, full=0x5555580f26c0, mmu_idx=1, addr=1073885184, retaddr=140735277023274, access_type=MMU_DATA_LOAD, op=MO_32) at ../accel/tcg/cputlb.c:1380 +#6 0x0000555555ee59f2 in load_helper (env=0x555557003f50, addr=1073885184, oi=33, retaddr=140735277023274, op=MO_32, code_read=false, full_load=0x555555ee5dbf <full_le_ldul_mmu>) at ../accel/tcg/cputlb.c:1970 +#7 0x0000555555ee5e12 in full_le_ldul_mmu (env=0x555557003f50, addr=1073885184, oi=33, retaddr=140735277023274) at ../accel/tcg/cputlb.c:2070 +#8 0x0000555555ee5e44 in helper_le_ldul_mmu (env=0x555557003f50, addr=1073885184, oi=33, retaddr=140735277023274) at ../accel/tcg/cputlb.c:2077 +#9 0x00007fff7c31c0be in code_gen_buffer () +#10 0x0000555555ed15b8 in cpu_tb_exec (cpu=0x5555570020e0, itb=0x7fffb8f6ce80, tb_exit=0x7fff7a3fc068) at ../accel/tcg/cpu-exec.c:438 +#11 0x0000555555ed2185 in cpu_loop_exec_tb (cpu=0x5555570020e0, tb=0x7fffb8f6ce80, pc=2824872, last_tb=0x7fff7a3fc080, tb_exit=0x7fff7a3fc068) at ../accel/tcg/cpu-exec.c:868 +#12 0x0000555555ed2545 in cpu_exec (cpu=0x5555570020e0) at ../accel/tcg/cpu-exec.c:1032 +#13 0x0000555555ef3329 in tcg_cpus_exec (cpu=0x5555570020e0) at ../accel/tcg/tcg-accel-ops.c:69 +#14 0x0000555555ef39ca in mttcg_cpu_thread_fn (arg=0x5555570020e0) at ../accel/tcg/tcg-accel-ops-mttcg.c:95 +#15 0x00005555560b1e87 in qemu_thread_start (args=0x5555571358e0) at ../util/qemu-thread-posix.c:505 +#16 0x00007ffff7fb6cbe in start (p=0x7fff7a3fc1e0) at src/thread/pthread_create.c:195 +#17 0x00007ffff7fc3e7b in __clone () at src/thread/x86_64/clone.s:22 +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1347555 b/results/classifier/mode-deepseek-r1:32b/output/system/1347555 new file mode 100644 index 00000000..acd2d4fa --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1347555 @@ -0,0 +1,19 @@ + + +qemu build failure, hxtool is a bash script, not a /bin/sh script + +hxtool (part of the early build process) is a bash script. Running it with /bin/sh yields a syntax error on line 10: + + 10 STEXI*|ETEXI*|SQMP*|EQMP*) flag=$(($flag^1)) + +$(( expr )) is a bash extension, not part of /bin/sh. + +Note that replacing the sh in the first line in hxtool with /bin/bash does not help, because the script is run manually from the Makefile with sh: + +154 $(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -h < $< > $@," GEN $@") + +The fix is to change those lines to + +154 $(call quiet-command,bash $(SRC_PATH)/scripts/hxtool -h < $< > $@," GEN $@") + +(there are five or so). \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1349277 b/results/classifier/mode-deepseek-r1:32b/output/system/1349277 new file mode 100644 index 00000000..f19b6472 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1349277 @@ -0,0 +1,19 @@ + + +AArch64 emulation ignores SPSel=0 when taking (or returning from) an exception at EL1 or greater + +The AArch64 emulation ignores SPSel=0 when: + +(1) taking an interrupt from an exception level greater than EL0 (e.g., EL1t), + +(2) returning from an exception (via ERET) to an exception level greater than EL0 (e.g., EL1t), with SPSR_ELx[SPSel]=0. + +The attached patch fixes the problem in my application. + +Background: + +I'm running a standalone application (toy OS) that is performing preemptive multithreading between threads running at EL1t, with exception handling / context switching occurring at EL1h. This bug causes the stack pointer to be corrupted in the threads running at EL1t (they end up with a version of the EL1h stack pointer (SP_EL1)). + +Occurs in: + qemu-2.1.0-rc1 (found in) + commit c60a57ff497667780132a3fcdc1500c83af5d5c0 (current master) \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1350 b/results/classifier/mode-deepseek-r1:32b/output/system/1350 new file mode 100644 index 00000000..848c0953 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1350 @@ -0,0 +1,91 @@ + + +Regression in 7.2.0rc3: No snow by efi firmware in advent calendar 2020, door 15 anymore +Description of problem: +Advent calendar 2020, door 15 is expected to produce snow on the terminal while executing the provided efi firmware: + +> snow in micropython on slimbootloader by eldon +> ------------------------------------------- +> +> Today's advent is a custom efi firmware build of a new bootloader from intel called +> slimbootloader[1], a recent project by intel which has adapted micropython[2] as a +> utility for configuration and board testing. This build, however, will show snowfall on +> the console for a while. Eventually an exception drops the firmware into the micropython +> repl. +> +> [1] https://slimbootloader.github.io/supported-hardware/qemu.html +> [2] http://docs.micropython.org/en/latest/index.html + + +Snow does not fall anymore as it did with 7.1.0, it seems like execution is stopped/not started +Steps to reproduce: +- Build & Install from git source + ``` + /home/helge/qemu-project/qemu/configure --prefix=/home/helge/qemu-project/install \ + --target-list=x86_64-softmmu --disable-linux-user + make -j2 + make install + ``` + - Execute + ``` + PATH="/home/helge/qemu-project/install/bin" qemu-system-x86_64 \ + -m 256M -machine q35 -serial mon:stdio -vga none \ + -drive if=pflash,format=raw,file=snow.bin -boot a + ``` +Additional information: +Performing git bisect starting with tag v7.1.0 as good and tag v7.2.0-rc3 as bad reveals 92ec056a6b2fc5d5a5593121c5d9475d2a2461d6 as culprit: + ``` +$ git bisect start c4ffd91aba1c3d878e99a3e7ba8aad4826728ece 621da7789083b80d6f1ff1c0fb499334007b4f51 +binäre Suche: danach noch 965 Commits zum Testen übrig (ungefähr 10 Schritte) +[2ba341b3694cf3cff7b8a1df4cc765900d5c4f60] Merge tag 'kraxel-20221013-pull-request' of https://gitlab.com/kraxel/qemu into staging +$ git bisect good +binäre Suche: danach noch 482 Commits zum Testen übrig (ungefähr 9 Schritte) +[05c049f12b88370de7289bf39b14088c7d656caa] hw/isa/piix3: Remove extra ';' outside of functions +$ git bisect bad +binäre Suche: danach noch 228 Commits zum Testen übrig (ungefähr 8 Schritte) +[08a5d04606292b3cf6f5756bf2a095654a290626] Merge tag 'pull-tcg-20221026' of https://gitlab.com/rth7680/qemu into staging +$ git bisect bad +binäre Suche: danach noch 126 Commits zum Testen übrig (ungefähr 7 Schritte) +[168122419ed1c4087748e21131a523c6d9b632e1] target/arm: Change gen_goto_tb to work on displacements +$ git bisect bad +binäre Suche: danach noch 69 Commits zum Testen übrig (ungefähr 6 Schritte) +[2c65091fd9d387b8dca8115dbdd9c3c61f658a9e] Merge tag 'pull-ppc-20221017' of https://gitlab.com/danielhb/qemu into staging +$ git bisect good +binäre Suche: danach noch 34 Commits zum Testen übrig (ungefähr 5 Schritte) +[92ec056a6b2fc5d5a5593121c5d9475d2a2461d6] target/i386: reimplement 0x0f 0x60-0x6f, add AVX +$ git bisect bad +binäre Suche: danach noch 17 Commits zum Testen übrig (ungefähr 4 Schritte) +[8629e77be5f8106b3497cc197fbd57a12ae6333f] target/i386: Use probe_access_full for final stage2 translation +$ git bisect good +binäre Suche: danach noch 8 Commits zum Testen übrig (ungefähr 3 Schritte) +[20581aadec5e5a9d6836e4612b6f44a7cbda7d16] target/i386: validate VEX prefixes via the instructions' exception classes +$ git bisect good +binäre Suche: danach noch 4 Commits zum Testen übrig (ungefähr 2 Schritte) +[f05f9789f57d5394fc118fe31aa2a9f563311140] target/i386: extend helpers to support VEX.V 3- and 4- operand encodings +$ git bisect good +binäre Suche: danach noch 2 Commits zum Testen übrig (ungefähr 1 Schritt) +[620f75566a5d81d7b82b3788b83d0b95c7d21dcd] target/i386: provide 3-operand versions of unary scalar helpers +$ git bisect good +binäre Suche: danach noch 0 Commits zum Testen übrig (ungefähr 1 Schritt) +[b98f886c8f8661773047197d132efec97810b37a] target/i386: Introduce 256-bit vector helpers +$ git bisect good +92ec056a6b2fc5d5a5593121c5d9475d2a2461d6 is the first bad commit +commit 92ec056a6b2fc5d5a5593121c5d9475d2a2461d6 +Author: Paolo Bonzini <pbonzini@redhat.com> +Date: Tue Sep 20 05:42:45 2022 -0400 + + target/i386: reimplement 0x0f 0x60-0x6f, add AVX + + These are both MMX and SSE/AVX instructions, except for vmovdqu. In both + cases the inputs and output is in s->ptr{0,1,2}, so the only difference + between MMX, SSE, and AVX is which helper to call. + + Reviewed-by: Richard Henderson <richard.henderson@linaro.org> + Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> + + target/i386/tcg/decode-new.c.inc | 42 ++++++++ + target/i386/tcg/emit.c.inc | 202 +++++++++++++++++++++++++++++++++++++++ + target/i386/tcg/translate.c | 19 +++- + 3 files changed, 262 insertions(+), 1 deletion(-) + + ``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1350435 b/results/classifier/mode-deepseek-r1:32b/output/system/1350435 new file mode 100644 index 00000000..88e5d048 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1350435 @@ -0,0 +1,18 @@ + + +tcg.c:1693: tcg fatal error + +this started happening after the launchpad buildd trusty deploy +https://code.launchpad.net/~costamagnagianfranco/+archive/ubuntu/firefox/+build/6224439 + + +debconf-updatepo +qemu: uncaught target signal 11 (Segmentation fault) - core dumped +Segmentation fault (core dumped) +qemu: uncaught target signal 11 (Segmentation fault) - core dumped +Segmentation fault (core dumped) +/build/buildd/qemu-2.0.0+dfsg/tcg/tcg.c:1693: tcg fatal error +/build/buildd/qemu-2.0.0+dfsg/tcg/tcg.c:1693: tcg fatal error + +this seems to be the patch needed +https://patches.linaro.org/32473/ \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1358 b/results/classifier/mode-deepseek-r1:32b/output/system/1358 new file mode 100644 index 00000000..0a8b2884 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1358 @@ -0,0 +1,3 @@ + + +Remove CPUState::trace_dstate diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1359 b/results/classifier/mode-deepseek-r1:32b/output/system/1359 new file mode 100644 index 00000000..11986422 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1359 @@ -0,0 +1,3 @@ + + +open virtual format diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1363 b/results/classifier/mode-deepseek-r1:32b/output/system/1363 new file mode 100644 index 00000000..abb69d36 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1363 @@ -0,0 +1,5 @@ + + +TriCore: writing to registers is not working (as it's supposed to) +Description of problem: +Reading the tricore register list from QEMU works just fine. However, writing this registers is not working as expected. It looks like the bug is on QEMU's side, since third party gdb client faces the same issues. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1365 b/results/classifier/mode-deepseek-r1:32b/output/system/1365 new file mode 100644 index 00000000..c160e59f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1365 @@ -0,0 +1,26 @@ + + +qemu on m1 mac loses network connection after some time running +Description of problem: +While running qemu with podman machine on m1 mac, after a while the network connections will stop answering. +When running with the console window dmesg will start showing the following messages +``` +uq: 0x1, name: output.0, 2263286224 uses ago +[37689.0770611 virtio_net virtioo emposi: TX timeout on queue: 0, sq: output.o, uq: 0x1, name: output.0, 2268226224 uses ago +[37693.7877481 virtio_net virtio@ emposi: TX timeout on queue: 0, sq: output.o, uq: 0x1, name: output.0, 2273326224 uses ago +[37698.3116991 virtio_net virtioo emposi: TX timeout on queue: 0, sq: output.o, uq: 0x1, name: output.0, 2278226224 uses ago +[37702.9616661 virtio_net virtioo emposi: TX timeout on queue: 0, sq: output.o, uq: 0x1, name: output.0, 2283266224 uses ago +[37707.5462551 virtio_net virtiod empos1: IX timeout on queue: 0, sq: output.O, ug: Ox1, name: output.O, 2288226224 usecs ago +[37712.205242) virtio_net virtio@ enposI: IX timeout on queue: 0, sq: output.o, uq: 0x1, name: output. 0, 2293276224 uses ago +[37716.7708171 virtio_net virtiod enpOsi: IX timeout on queue: 0, sq: output.o, uq: 0x1, name: output. 0, 2298226224 uses ago + +``` +Steps to reproduce: +1. Run `/opt/homebrew/bin/qemu-system-aarch64 -m 12048 -smp 8 -fw_cfg name=opt/com.coreos/config,file=$HOME/.config/containers/podman/machine/qemu/podman-machine-default.ign -qmp unix:$TEMP/podman/qmp_podman-machine-default.sock,server=on,wait=off -netdev socket,id=vlan,fd=3 -device virtio-net-pci,netdev=vlan,mac=5a:94:ef:e4:0c:ee -device virtio-serial -chardev socket,path=$TEMP/podman/podman-machine-default_ready.sock,server=on,wait=off,id=apodman-machine-default_ready -device virtserialport,chardev=apodman-machine-default_ready,name=org.fedoraproject.port.0 -pidfile $TEMP/podman/podman-machine-default_vm.pid -accel hvf -accel tcg -cpu host -M virt,highmem=on -drive file=/opt/homebrew/share/qemu/edk2-aarch64-code.fd,if=pflash,format=raw,readonly=on -drive file=$HOME/.local/share/containers/podman/machine/qemu/podman-machine-default_ovmf_vars.fd,if=pflash,format=raw -virtfs local,path=$HOME,mount_tag=vol0,security_model=mapped-xattr -drive if=virtio,file=$HOME/.local/share/containers/podman/machine/qemu/podman-machine-default_fedora-coreos-37.20221127.2.0-qemu.aarch64.qcow2` +2. Keep using the system and eventually `ssh localhost +3. +Additional information: +network configuration + + +I will try to add more info as I get them diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1379 b/results/classifier/mode-deepseek-r1:32b/output/system/1379 new file mode 100644 index 00000000..6c6e78cd --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1379 @@ -0,0 +1,3 @@ + + +dump memory read write operations diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/138 b/results/classifier/mode-deepseek-r1:32b/output/system/138 new file mode 100644 index 00000000..ffe56dac --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/138 @@ -0,0 +1,3 @@ + + +Exclude keys from grab diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1381 b/results/classifier/mode-deepseek-r1:32b/output/system/1381 new file mode 100644 index 00000000..b3cba56c --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1381 @@ -0,0 +1,5 @@ + + +plugins: plugin_mem_cbs is not consistently NULL'ed when returning from execution +Description of problem: +This is an invariant that we should have been checking for; when returning from execution, cpu->plugin_mem_cbs should be NULL. Otherwise we open a door for a use-after-free; admittedly this door isn't that large (it requires a tb_flush to occur while we have the dangling plugin_mem_cbs), but at least one plugin user has encountered this problem: https://lists.nongnu.org/archive/html/qemu-devel/2022-11/msg02703.html diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1382 b/results/classifier/mode-deepseek-r1:32b/output/system/1382 new file mode 100644 index 00000000..cc1218f4 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1382 @@ -0,0 +1,42 @@ + + +x86-64 In long mode the Selector Error Code has an improperly encoded Selector Index when dealing with IDT descriptor indexes +Description of problem: +When in long mode an IDT descriptor is 16 bytes in size. When an exception is raised where an index to an IDT descriptor entry needs to be encoded in an error code's selector index field it appears that QEMU's software emulation improperly encodes the IDT descriptor index as if each entry is 8 bytes rather than 16. The effect is that the descriptor index is encoded with a value that is double what it should be. + +As an example if I have a *Segment Not Present* (#NP) exception handler (which has a selector error code pushed on the stack) that is raised when I try to generate a software interrupt 0x97 that is marked not present in its IDT descriptor entry - I expect that QEMU would properly encode the value 0x97 in the Selector Index of the Selector Error Code pushed on the stack. Instead, the value stored is actually 0x12E. 0x12E is double the expected value 0x97. + +You can observe this errant value in the output of QEMU when using the `-d int` option. I have cut out the unnecessary state information as I'm focussed on the `v=` and `e=`. + + 0: v=97 e=0000 i=1 cpl=0 IP=0008:0000000000008a0a pc=0000000000008a0a SP=0010:0000000000007c00 + 1: v=0b e=0972 i=0 cpl=0 IP=0008:0000000000008a0a pc=0000000000008a0a SP=0010:0000000000007c00 + +When I used `int 0x97` to generate the software interrupt it properly shows that `v=97` had occurred in the output above. Because 0x97 was marked not present exception 0x0b (Not Present) was raised as you can see in the second line. The problem is that `e=0972` is a Selector Error Code where *Bits 3..16* contain the value 0x12E instead of 0x97. **It isn't just the display value in QEMU's debug output that is wrong**, as the **Selector Error Code pushed on the interrupt stack is the same erroneous value**. + +This issue doesn't occur if you run QEMU with the `-enable-kvm` option; in BOCHS; or on real hardware. The value in those environments contains a Selector Error Code of 0x4ba. *Bits 3..16* of 0x4ba contains the descriptor index 0x97 as expected. See additional information for more details. +Steps to reproduce: +1. Put processor in long mode. 64-bit mode will suffice. +2. Load an IDT with: + - A valid Segment Not Present (#NP) 0x0B Exception Handler. Handler doesn't really need to do anything. + - At least one interrupt handler marked *Not Present* higher than 0x00. Interrupt 0x97 as an example. +3. Raise the interrupt with something like `int 0x097` for this example. +Additional information: +In order to test this problem out in other environments like real hardware and virtual machines I wrote a test program on a floppy disk image that can be run on machines and virtual machines that support legacy boot from floppy media (or emulated floppy media). The test program code can be found [in my Github repository](https://github.com/mpetch/SelectorErrorCodeTest). A pre-built [disk image](https://github.com/mpetch/SelectorErrorCodeTest/blob/main/disk.img) is also available. + +When the disk image is executed with QEMU using `qemu-system-x86_64 -fda disk.img` the result (with incorrect encoding) can be seen here: + + + +When QEMU is run with `qemu-system-x86_64 -fda disk.img -enable-kvm` the result (with correct encoding) can be seen here: + + + +Correct results are also obtained in BOCHS and real hardware. + +--- +The [Intel Software Development Manual Volume 3A](https://www.intel.ca/content/www/ca/en/architecture-and-technology/64-ia-32-architectures-software-developer-vol-3a-part-1-manual.html) documents the error code as: + + + +--- +# diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1383 b/results/classifier/mode-deepseek-r1:32b/output/system/1383 new file mode 100644 index 00000000..1371bb17 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1383 @@ -0,0 +1,3 @@ + + +Pentium Pro cpuid capabilities are wrong, resulting in wrong definition of athlon and others diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1385 b/results/classifier/mode-deepseek-r1:32b/output/system/1385 new file mode 100644 index 00000000..03140bfd --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1385 @@ -0,0 +1,3 @@ + + +-net option doesn't work diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1390 b/results/classifier/mode-deepseek-r1:32b/output/system/1390 new file mode 100644 index 00000000..4e16a214 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1390 @@ -0,0 +1,3 @@ + + +Any plans for P5020 P5040 CPUs? diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1395 b/results/classifier/mode-deepseek-r1:32b/output/system/1395 new file mode 100644 index 00000000..24c02566 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1395 @@ -0,0 +1,158 @@ + + +qemu-system-riscv32 cpu_transaction_failed cause Infinite loop when write mstatus ~"target: riscv" +Description of problem: +I wanna run FreeRTOS riscv, and use the FreeRTOS/Demo/RISC-V-Qemu-virt_GCC/Makefile to build elf.\ +When qemu execute to write mstatus as 0x1888(enable Interrupt, MIE:1, MIP:1, MPP:3), there is no response.\ +https://github.com/FreeRTOS/FreeRTOS-Kernel/blob/main/portable/GCC/RISC-V/portASM.S\ +line 274: csrrw x0, mstatus, x5 /* Interrupts enabled from here! */\ +opcode is hex 30029073\n +I use pstack to trace qemu thread, there is only one thread is active, and cpu loading is 100%.\ +then I use gdb attatch <pid> to trace the active thread, and it has a loop\ +cpu_loop_exit call siglongjmp and back to sigsetjmp in cpu_exec (cpu=cpu@entry=0x55e2294e4070) at ../accel/tcg/cpu-exec.c:936 +Steps to reproduce: +1.download FreeRTOS and build FreeRTOS/Demo/RISC-V-Qemu-virt_GCC\ +2.run qemu with gdb\ +3.hang when writing mstatus +Additional information: +I find that my issue occur when mtvec is zero and timer interrupt occur when writing mstatus(riscv_cpu_do_interrupt)\ +Although it should jump to 0x0 rather then hanging in while loop.\ +expected flow :cpu_handle_interrupt->check_for_breakpoints->break\ +actually flow: cpu_handle_interrupt->check_for_breakpoints->infinite loop\ +Qemu build command: +``` +./configure --target-list=riscv32-softmmu && make +``` + +pstack for qemu (only need to debug Thread 3) +``` +Thread 3 (Thread 0x7f83af6d3640 (LWP 5093) "qemu-system-ris"): +#0 0x000055cb31b1769f in riscv_cpu_exec_interrupt () +#1 0x0000000000000000 in () +Thread 2 (Thread 0x7f83b0119640 (LWP 5092) "qemu-system-ris"): +#0 0x00007f83b0400a3d in syscall () at /lib/x86_64-linux-gnu/libc.so.6 +#1 0x000055cb31e0bd52 in qemu_event_wait () +#2 0x0000000000000000 in () +Thread 1 (Thread 0x7f83b011ac00 (LWP 5090) "qemu-system-ris"): +#0 0x00007f83b03fae7e in ppoll () at /lib/x86_64-linux-gnu/libc.so.6 +#1 0x00007f83b0752500 in () at /lib/x86_64-linux-gnu/libglib-2.0.so.0 +#2 0x000055cb33241b30 in () +#3 0x0000000000000005 in () +#4 0x0000000000000000 in () +``` +backtrace for the infinite loop +``` +(gdb) bt +#0 cpu_loop_exit (cpu=0x55e2294e4070) at ../accel/tcg/cpu-exec-common.c:65 +#1 0x000055e2274efde4 in cpu_loop_exit_restore (cpu=cpu@entry=0x55e2294e4070, pc=pc@entry=0) + at ../accel/tcg/cpu-exec-common.c:76 +#2 0x000055e22737fff1 in riscv_cpu_do_transaction_failed + (cs=0x55e2294e4070, physaddr=<optimized out>, addr=0, size=<optimized out>, access_type=MMU_INST_FETCH, mmu_idx=<optimized out>, attrs=..., response=2, retaddr=0) + at ../target/riscv/cpu_helper.c:1165 +#3 0x000055e2274fa4a7 in cpu_transaction_failed + (retaddr=0, response=2, attrs=..., mmu_idx=3, access_type=MMU_INST_FETCH, size=<optimized out>, addr=0, physaddr=<optimized out>, cpu=0x55e2294e4070) at ../accel/tcg/cputlb.c:1344 +#4 io_readx + (env=env@entry=0x55e2294e53d0, full=full@entry=0x7fd90c029410, mmu_idx=3, addr=addr@entry=0, retaddr=retaddr@entry=0, access_type=access_type@entry=MMU_INST_FETCH, op=MO_16) + at ../accel/tcg/cputlb.c:1380 +#5 0x000055e2274fba28 in load_helper + (full_load=<optimized out>, code_read=true, op=MO_16, retaddr=0, oi=19, addr=0, env=0x55e2294e53d0) at ../accel/tcg/cputlb.c:1970 +#6 full_lduw_code (env=env@entry=0x55e2294e53d0, addr=addr@entry=0, oi=19, retaddr=0) + at ../accel/tcg/cputlb.c:2606 +#7 0x000055e22750827b in cpu_lduw_code (env=env@entry=0x55e2294e53d0, addr=addr@entry=0) + at ../accel/tcg/cputlb.c:2612 +#8 0x000055e2274f87fa in translator_lduw + (env=env@entry=0x55e2294e53d0, db=db@entry=0x7fd913dfe5a0, pc=0) + at ../accel/tcg/translator.c:216 +#9 0x000055e2273e423a in riscv_tr_translate_insn (dcbase=0x7fd913dfe5a0, cpu=<optimized out>) + at ../target/riscv/translate.c:1158 +#10 0x000055e2274f83d3 in translator_loop + (cpu=cpu@entry=0x55e2294e4070, tb=tb@entry=0x7fd91c000240 <code_gen_buffer+531>, max_insns=<optim + ized out>, pc=pc@entry=0, host_pc=host_pc@entry=0x55e2274efe74 <tb_htable_lookup+84>, ops=ops@entry=0x55e227a75c80 <riscv_tr_ops>, db=0x7fd913dfe5a0) at ../accel/tcg/translator.c:96 +#11 0x000055e227411760 in gen_intermediate_code + (cs=cs@entry=0x55e2294e4070, tb=tb@entry=0x7fd91c000240 <code_gen_buffer+531>, max_insns=<optimized out>, pc=pc@entry=0, host_pc=host_pc@entry=0x55e2274efe74 <tb_htable_lookup+84>) + at ../target/riscv/translate.c:1240 +#12 0x000055e2274f6954 in setjmp_gen_code + (env=env@entry=0x55e2294e53d0, tb=tb@entry=0x7fd91c000240 <code_gen_buffer+531>, pc=pc@entry=0, host_pc=0x55e2274efe74 <tb_htable_lookup+84>, max_insns=max_insns@entry=0x7fd913dfe744, ti=<optimized out>) at ../accel/tcg/translate-all.c:761 +#13 0x000055e2274f7294 in tb_gen_code + (cpu=cpu@entry=0x55e2294e4070, pc=0, cs_base=0, flags=1085443, cflags=<optimized out>, + cflags@entry=-16777216) at ../accel/tcg/translate-all.c:841 +#14 0x000055e2274f10cf in cpu_exec (cpu=cpu@entry=0x55e2294e4070) at ../accel/tcg/cpu-exec.c:1006 +#15 0x000055e22750a904 in tcg_cpus_exec (cpu=cpu@entry=0x55e2294e4070) + at ../accel/tcg/tcg-accel-ops.c:69 +#16 0x000055e22750aa57 in mttcg_cpu_thread_fn (arg=arg@entry=0x55e2294e4070) + at ../accel/tcg/tcg-accel-ops-mttcg.c:95 +#17 0x000055e227674b21 in qemu_thread_start (args=<optimized out>) + at ../util/qemu-thread-posix.c:505 +#18 0x00007fd9611a9b43 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442 +#19 0x00007fd96123ba00 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81 +``` + +disassembly code +``` +80001ac6 <xPortStartFirstTask>: +80001ac6: 85c1a103 lw sp,-1956(gp) # 800809fc <pxCurrentTCB> +80001aca: 4102 lw sp,0(sp) +80001acc: 4082 lw ra,0(sp) +80001ace: 43c2 lw t2,16(sp) +80001ad0: 4452 lw s0,20(sp) +80001ad2: 44e2 lw s1,24(sp) +80001ad4: 4572 lw a0,28(sp) +80001ad6: 5582 lw a1,32(sp) +80001ad8: 5612 lw a2,36(sp) +80001ada: 56a2 lw a3,40(sp) +80001adc: 5732 lw a4,44(sp) +80001ade: 57c2 lw a5,48(sp) +80001ae0: 5852 lw a6,52(sp) +80001ae2: 58e2 lw a7,56(sp) +80001ae4: 5972 lw s2,60(sp) +80001ae6: 4986 lw s3,64(sp) +80001ae8: 4a16 lw s4,68(sp) +80001aea: 4aa6 lw s5,72(sp) +80001aec: 4b36 lw s6,76(sp) +80001aee: 4bc6 lw s7,80(sp) +80001af0: 4c56 lw s8,84(sp) +80001af2: 4ce6 lw s9,88(sp) +80001af4: 4d76 lw s10,92(sp) +80001af6: 5d86 lw s11,96(sp) +80001af8: 5e16 lw t3,100(sp) +80001afa: 5ea6 lw t4,104(sp) +80001afc: 5f36 lw t5,108(sp) +80001afe: 5fc6 lw t6,112(sp) +80001b00: 52d6 lw t0,116(sp) +80001b02: 0007f317 auipc t1,0x7f +80001b06: ea232303 lw t1,-350(t1) # 800809a4 <pxCriticalNesting> +80001b0a: 00532023 sw t0,0(t1) +80001b0e: 52e6 lw t0,120(sp) +80001b10: 02a1 addi t0,t0,8 +80001b12: 30029073 csrw mstatus,t0 <--- hang on this line +80001b16: 42a2 lw t0,8(sp) +80001b18: 4332 lw t1,12(sp) +80001b1a: 07c10113 addi sp,sp,124 +80001b1e: 8082 ret +``` + +``` +(gdb) bt +#0 cpu_loop_exit (cpu=cpu@entry=0x564cd884b070) at ../accel/tcg/cpu-exec-common.c:65 +#1 0x0000564cd6685631 in helper_lookup_tb_ptr (env=0x564cd884c3d0) at ../accel/tcg/cpu-exec.c:400 +#2 0x00007f55dc00014c in code_gen_buffer () +#3 0x0000564cd668521b in cpu_tb_exec + (cpu=cpu@entry=0x564cd884b070, itb=itb@entry=0x7f55dc000040 <code_gen_buffer+19>, tb_exit=tb_exit@entry=0x7f56235f67ec) at ../accel/tcg/cpu-exec.c:438 +#4 0x0000564cd6685cfb in cpu_loop_exec_tb + (tb_exit=0x7f56235f67ec, last_tb=<synthetic pointer>, pc=<optimized out>, tb=0x7f55dc000040 <code_gen_buffer+19>, cpu=0x564cd884b070) at ../accel/tcg/cpu-exec.c:868 +#5 cpu_exec (cpu=cpu@entry=0x564cd884b070) at ../accel/tcg/cpu-exec.c:1032 +#6 0x0000564cd669f904 in tcg_cpus_exec (cpu=cpu@entry=0x564cd884b070) + at ../accel/tcg/tcg-accel-ops.c:69 +#7 0x0000564cd669fa57 in mttcg_cpu_thread_fn (arg=arg@entry=0x564cd884b070) + at ../accel/tcg/tcg-accel-ops-mttcg.c:95 +#8 0x0000564cd6809b21 in qemu_thread_start (args=<optimized out>) + at ../util/qemu-thread-posix.c:505 +#9 0x00007f562429ab43 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442 +#10 0x00007f562432ca00 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81 +``` + +I also build a very simple elf for qemu-virt-platform, just contain boot-loader and write mstatus as 0x1888, it can't reproduce.\ +I also build different qemu version such v6.0.0, it still can reproduce.\ +I has modify the march to the most simple arch:rv32i, is still can reproduce. + +~"target: riscv" diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1395958 b/results/classifier/mode-deepseek-r1:32b/output/system/1395958 new file mode 100644 index 00000000..3f297327 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1395958 @@ -0,0 +1,27 @@ + + +boost managed_shared_memory segment on arm emulator crashes + +The following code segment crashes when run: + +#include <boost/interprocess/managed_shared_memory.hpp> +#include <boost/interprocess/allocators/allocator.hpp> +#include <boost/interprocess/containers/map.hpp> +#include <boost/interprocess/containers/vector.hpp> +#include <boost/interprocess/containers/string.hpp> + +using namespace boost::interprocess; + +int main(int argc, char** argv) +{ + namespace bi = boost::interprocess; + const char* name = "foobar"; + bi::shared_memory_object::remove(name); + bi::managed_shared_memory segment(bi::create_only, name, 10 * 1024); +} + +using qemu-arm-static +qemu-arm version 1.5.0 (Debian 1.5.0-2013.06+git74+20130802+ef1b0ae-3linaroprecise1), Copyright (c) 2003-2008 Fabrice Bellard + + +Any idea? \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1398 b/results/classifier/mode-deepseek-r1:32b/output/system/1398 new file mode 100644 index 00000000..cacb161e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1398 @@ -0,0 +1,8 @@ + + +Kernel Fault in primary space mode while using user ASCE emulating s390x with AlmaLinux release 9.1 (Lime Lynx) +Description of problem: +Happens twice during startup, however the system keeps running. +Steps to reproduce: +1. Install Alma Linux s390x on in KVM on x86_64 +2. Start KVM diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1399939 b/results/classifier/mode-deepseek-r1:32b/output/system/1399939 new file mode 100644 index 00000000..33061bca --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1399939 @@ -0,0 +1,6 @@ + + +Qemu build with -faltivec and maltivec support in + +if is possible add the build support for qemu for have the -faltivec -maltivec in CPPFLAGS for make the emulation more faster on PPC equiped machine . +Thank you \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1400 b/results/classifier/mode-deepseek-r1:32b/output/system/1400 new file mode 100644 index 00000000..67d2c87a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1400 @@ -0,0 +1,3 @@ + + +helper_access_check_cp_reg() raising Undefined Instruction on big-endian host diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1400768 b/results/classifier/mode-deepseek-r1:32b/output/system/1400768 new file mode 100644 index 00000000..90a39336 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1400768 @@ -0,0 +1,72 @@ + + +Fatal error when running with '-machine isapc' on 2.1.2 + +all I have are the traces, should hopefully be easy to reproduce. + +# qemu-system-i386 -machine isapc +VNC server running on `::1:5900' +qemu: fatal: Trying to execute code outside RAM or ROM at 0x1a0dff44 + +EAX=000f0f88 EBX=00100000 ECX=07fc0000 EDX=0000002c +ESI=00006f5c EDI=08000000 EBP=07fc0000 ESP=fffe0014 +EIP=1a0dff44 EFL=00000046 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 +ES =0010 00000000 ffffffff 00cf9300 DPL=0 DS [-WA] +CS =0008 00000000 ffffffff 00cf9b00 DPL=0 CS32 [-RA] +SS =0010 00000000 ffffffff 00cf9300 DPL=0 DS [-WA] +DS =0010 00000000 ffffffff 00cf9300 DPL=0 DS [-WA] +FS =0010 00000000 ffffffff 00cf9300 DPL=0 DS [-WA] +GS =0010 00000000 ffffffff 00cf9300 DPL=0 DS [-WA] +LDT=0000 00000000 0000ffff 00008200 DPL=0 LDT +TR =0000 00000000 0000ffff 00008b00 DPL=0 TSS32-busy +GDT= 000f6be8 00000037 +IDT= 000f6c26 00000000 +CR0=60000011 CR2=00000000 CR3=00000000 CR4=00000000 +DR0=00000000 DR1=00000000 DR2=00000000 DR3=00000000 +DR6=ffff0ff0 DR7=00000400 +CCS=00000000 CCD=00000000 CCO=ADDB +EFER=0000000000000000 +FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 +FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 +FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 +FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 +FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 +XMM00=00000000000000000000000000000000 XMM01=00000000000000000000000000000000 +XMM02=00000000000000000000000000000000 XMM03=00000000000000000000000000000000 +XMM04=00000000000000000000000000000000 XMM05=00000000000000000000000000000000 +XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 +Aborted + + +# qemu-system-x86_64 -machine isapc +VNC server running on `::1:5900' +qemu: fatal: Trying to execute code outside RAM or ROM at 0x000000001a0dff44 + +EAX=000f0f88 EBX=00100000 ECX=07fc0000 EDX=0000002c +ESI=00006f5c EDI=08000000 EBP=07fc0000 ESP=fffe0014 +EIP=1a0dff44 EFL=00000046 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 +ES =0010 00000000 ffffffff 00cf9300 DPL=0 DS [-WA] +CS =0008 00000000 ffffffff 00cf9b00 DPL=0 CS32 [-RA] +SS =0010 00000000 ffffffff 00cf9300 DPL=0 DS [-WA] +DS =0010 00000000 ffffffff 00cf9300 DPL=0 DS [-WA] +FS =0010 00000000 ffffffff 00cf9300 DPL=0 DS [-WA] +GS =0010 00000000 ffffffff 00cf9300 DPL=0 DS [-WA] +LDT=0000 00000000 0000ffff 00008200 DPL=0 LDT +TR =0000 00000000 0000ffff 00008b00 DPL=0 TSS32-busy +GDT= 000f6be8 00000037 +IDT= 000f6c26 00000000 +CR0=60000011 CR2=00000000 CR3=00000000 CR4=00000000 +DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 +DR6=00000000ffff0ff0 DR7=0000000000000400 +CCS=00000000 CCD=00000000 CCO=ADDB +EFER=0000000000000000 +FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 +FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 +FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 +FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 +FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 +XMM00=00000000000000000000000000000000 XMM01=00000000000000000000000000000000 +XMM02=00000000000000000000000000000000 XMM03=00000000000000000000000000000000 +XMM04=00000000000000000000000000000000 XMM05=00000000000000000000000000000000 +XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 +Aborted \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1402 b/results/classifier/mode-deepseek-r1:32b/output/system/1402 new file mode 100644 index 00000000..be033ad7 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1402 @@ -0,0 +1,61 @@ + + +cpu-exec.c fails to compile - code path is reachable +Description of problem: +Building qemu (tested with both gcc11 and gcc12) fails with: + +``` +[34/76] Compiling C object libqemu-aarch64-softmmu.fa.p/accel_tcg_cpu-exec.c.o +FAILED: libqemu-aarch64-softmmu.fa.p/accel_tcg_cpu-exec.c.o +gcc -m64 -mcx16 -Ilibqemu-aarch64-softmmu.fa.p -I. -I.. -Itarget/arm +-I../target/arm -I../dtc/libfdt -Iqapi -Itrace -Iui -Iui/shader +-I/opt/ooce/include/pixman-1 +-I/data/omnios-build/omniosorg/qemu/libtasn1-4.19.0/out/include +-I/usr/include/glib-2.0 -I/usr/lib/amd64/glib-2.0/include +-fdiagnostics-color=auto -Wall -Winvalid-pch -std=gnu11 -O2 -g +-iquote . -iquote /data/omnios-build/omniosorg/qemu +-iquote /data/omnios-build/omniosorg/qemu/include +-iquote /data/omnios-build/omniosorg/qemu/tcg/i386 +-pthread -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -D__EXTENSIONS__ +-D_XOPEN_SOURCE=600 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE +-Wstrict-prototypes -Wredundant-decls -Wundef -Wwrite-strings -Wmissing-prototypes +-fno-strict-aliasing -fno-common -fwrapv -Wold-style-declaration -Wold-style-definition +-Wtype-limits -Wformat-security -Wformat-y2k -Winit-self -Wignored-qualifiers +-Wempty-body -Wnested-externs -Wendif-labels -Wexpansion-to-defined +-Wimplicit-fallthrough=2 -Wno-missing-include-dirs -Wno-shift-negative-value +-Wno-psabi -fstack-protector-strong -m64 -gdwarf-2 -gstrict-dwarf +-fno-omit-frame-pointer -fno-aggressive-loop-optimizations -DNEED_CPU_H +'-DCONFIG_TARGET="aarch64-softmmu-config-target.h"' +'-DCONFIG_DEVICES="aarch64-softmmu-config-devices.h"' -MD -MQ +libqemu-aarch64-softmmu.fa.p/accel_tcg_cpu-exec.c.o +-MF libqemu-aarch64-softmmu.fa.p/accel_tcg_cpu-exec.c.o.d +-o libqemu-aarch64-softmmu.fa.p/accel_tcg_cpu-exec.c.o +-c ../accel/tcg/cpu-exec.c +In file included from ../accel/tcg/cpu-exec.c:20: +In function 'tb_pc', + inlined from 'cpu_tb_exec' at ../accel/tcg/cpu-exec.c:465:13: +/data/omnios-build/omniosorg/qemu/include/qemu/osdep.h:184:35: error: call to 'qemu_build_not_reached_always' declared with attribute error: code path is reachable + 184 | #define qemu_build_not_reached() qemu_build_not_reached_always() + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +/data/omnios-build/omniosorg/qemu/include/exec/exec-all.h:608:5: note: in expansion of macro 'qemu_build_not_reached' + 608 | qemu_build_not_reached(); + | ^~~~~~~~~~~~~~~~~~~~~~ +``` +Additional information: +It appears that the compiler is not smart enough to realise that `TARGET_TB_PCREL` is false in the branch there or is not able to infer that from the `assert()`. + +Adding an explicit check as a workaround allows compilation to continue. + +```diff +--- a/accel/tcg/cpu-exec.c ++++ b/accel/tcg/cpu-exec.c +@@ -459,7 +459,7 @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit) + + if (cc->tcg_ops->synchronize_from_tb) { + cc->tcg_ops->synchronize_from_tb(cpu, last_tb); +- } else { ++ } else if (!TARGET_TB_PCREL) { + assert(!TARGET_TB_PCREL); + assert(cc->set_pc); + cc->set_pc(cpu, tb_pc(last_tb)); +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1402802 b/results/classifier/mode-deepseek-r1:32b/output/system/1402802 new file mode 100644 index 00000000..0244259b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1402802 @@ -0,0 +1,15 @@ + + +target-tricore/translate.c:3812: possible bad expression ? + + +From a run of cppcheck, a static analysis checker, over the +source code of qemu trunk, dated 20141215, is the new error: + +[qemu/target-tricore/translate.c:3812]: (style) Expression '(X & 0x3f) == 0x6f' is always false. + +Source code is + + if (unlikely((op1 & 0x3f) == OPCM_32_BRN_JTT)) { + +Suggest code rework. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1403 b/results/classifier/mode-deepseek-r1:32b/output/system/1403 new file mode 100644 index 00000000..f2bfe6be --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1403 @@ -0,0 +1,3 @@ + + +qemu 7.2: test-io-channel-command fails sporadically diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1405 b/results/classifier/mode-deepseek-r1:32b/output/system/1405 new file mode 100644 index 00000000..f08eccd4 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1405 @@ -0,0 +1,123 @@ + + +linux-user: calling SYS_get_thread_area and SYS_get_thread_area has incorrent result on multithread environment +Description of problem: + +Steps to reproduce: +1. Compile test.out by Command and source code: +``` +gcc -m32 -g test.c -lpthread -o test.out +``` +``` +#include <sys/syscall.h> +#include <unistd.h> +#include <stdio.h> +#include <pthread.h> +#include <asm/ldt.h> + +static inline int set_thread_area( struct user_desc *ptr ) +{ + return syscall( SYS_set_thread_area, ptr ); +} + +static inline int get_thread_area( struct user_desc *ptr ) +{ + return syscall( SYS_get_thread_area, ptr ); +} + +static unsigned int entry_number; + +static void* start_routine(void* ptr) +{ + struct user_desc user_desc0 = { entry_number }; + struct user_desc user_desc1 = { entry_number }; + struct user_desc user_desc2 = { entry_number }; + get_thread_area(&user_desc0); + printf("child thread: %u\n", user_desc0.base_addr); + + user_desc1.base_addr = 2; + user_desc1.limit = 0xFFF; + user_desc1.seg_32bit = 1; + set_thread_area( &user_desc1 ); + + get_thread_area(&user_desc2); + printf("child thread: %u\n", user_desc2.base_addr); + return NULL; +} + +int main(void) { + struct user_desc user_desc0 = { -1 }, user_desc1 = { 0 }, user_desc2 = { 0 }; + user_desc0.seg_32bit = 1; + user_desc0.useable = 1; + set_thread_area( &user_desc0 ); + + entry_number = user_desc0.entry_number; + + user_desc1.entry_number = entry_number; + user_desc1.base_addr = 1; + user_desc1.limit = 0xFFF; + user_desc1.seg_32bit = 1; + set_thread_area( &user_desc1 ); + + pthread_t thread_id; + pthread_create(&thread_id, NULL, &start_routine, NULL); + pthread_join(thread_id, NULL); + + user_desc2.entry_number = entry_number; + get_thread_area(&user_desc2); + printf("main thread: %u\n", user_desc2.base_addr); // main thread: 1 + return 0; +} + ``` +2. Correct Result: +``` +child thread: 1 +child thread: 2 +main thread: 1 +``` +qemu-i386 Print Result: +``` +child thread: 1 +child thread: 2 +main thread: 2 +``` +Additional information: +patch for fix the bug: + +https://lists.nongnu.org/archive/html/qemu-devel/2023-02/msg02203.html + +CPUX86State::gdt::base on differect threads must have different vaules, but it points to same memory. +value of CPUX86State::gdt::base must be copied when clone thread. + +https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/x86/kernel/tls.c + +SYS_set_thread_area call do_set_thread_area in kernel, it set user_desc to different memroy area on differernt threads. tls_array is in thread local memory. + +``` +static void set_tls_desc(struct task_struct *p, int idx, + const struct user_desc *info, int n) +{ + struct thread_struct *t = &p->thread; + struct desc_struct *desc = &t->tls_array[idx - GDT_ENTRY_TLS_MIN]; + int cpu; + + /* + * We must not get preempted while modifying the TLS. + */ + cpu = get_cpu(); + + while (n-- > 0) { + if (LDT_empty(info) || LDT_zero(info)) + memset(desc, 0, sizeof(*desc)); + else + fill_ldt(desc, info); + ++info; + ++desc; + } + + if (t == ¤t->thread) + load_TLS(t, cpu); + + put_cpu(); +} +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1406 b/results/classifier/mode-deepseek-r1:32b/output/system/1406 new file mode 100644 index 00000000..eb0c8459 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1406 @@ -0,0 +1,3 @@ + + +WANTED: Schematics, Service, Tech Notes, .pdf IBM Power4 970MP/FX Apple PowerMac G5 Early/Late 2005 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1406016 b/results/classifier/mode-deepseek-r1:32b/output/system/1406016 new file mode 100644 index 00000000..f08958d1 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1406016 @@ -0,0 +1,42 @@ + + +qemu-system-arm hangs at start on OS X + +Both from release 2.1.2 and built from a recent source, qemu-system-arm seems to hang on a mutex immediately after starting up, never getting to the point of actually booting. + +I've tried qemu-system-mipsel with another image and it worked fine, so this seems to be specific to the ARM runtime. I've tried two different ARM kernels, and I also ran into this with QEMU 2.1.2 release, installed from a bottle using homebrew. + +Host: Mac OS X 10.9.5 (Darwin Kernel Version 13.4.0) +QEMU version: built from HEAD@ab0302ee76 +Build command: ./configure --enable-cocoa --target-list=arm-softmmu,mipsel-softmmu && make +Run command: + +qemu-system-arm -M vexpress-a9 -cpu cortex-a9 -m 256 -sd disk.img -net nic,macaddr=52:54:00:fa:ce:13 -kernel vmlinuz-3.2.0-4-vexpress -initrd initrd.gz -append "root=/dev/ram" -display vnc=localhost:17 -net user,hostfwd=tcp::5022-:22 -append "console=ttyS0" + +I also tried this, with a different kernel & root: + +qemu-system-arm -kernel zImage -cpu arm1176 -m 256 -M versatilepb -no-reboot -serial stdio -hda rootfs-chromium.ext2 -append "root=/dev/sda" + +Thread dump: + +(lldb) thread list +Process 34364 stopped +* thread #1: tid = 0x135966, 0x00007fff89f4a746 libsystem_kernel.dylib`__psynch_mutexwait + 10, queue = 'com.apple.main-thread', stop reason = signal SIGSTOP + thread #2: tid = 0x13598b, 0x00007fff89f4ae6a libsystem_kernel.dylib`__workq_kernreturn + 10 + thread #3: tid = 0x13598c, 0x00007fff89f4b662 libsystem_kernel.dylib`kevent64 + 10, queue = 'com.apple.libdispatch-manager' + thread #7: tid = 0x1359b2, 0x00007fff89f4acc2 libsystem_kernel.dylib`__sigwait + 10 + thread #9: tid = 0x1359c1, 0x00000001091bc5d9 + thread #11: tid = 0x1359cc, 0x00007fff89f4a716 libsystem_kernel.dylib`__psynch_cvwait + 10 + thread #12: tid = 0x1359da, 0x00007fff89f46a1a libsystem_kernel.dylib`mach_msg_trap + 10, name = 'com.apple.audio.IOThread.client' + +------- +* thread #1: tid = 0x135966, 0x00007fff89f4a746 libsystem_kernel.dylib`__psynch_mutexwait + 10, queue = 'com.apple.main-thread', stop reason = signal SIGSTOP + * frame #0: 0x00007fff89f4a746 libsystem_kernel.dylib`__psynch_mutexwait + 10 + frame #1: 0x00007fff8e05f779 libsystem_pthread.dylib`_pthread_mutex_lock + 372 + frame #2: 0x000000010033e8e9 qemu-system-arm`qemu_mutex_lock(mutex=<unavailable>) + 25 at qemu-thread-posix.c:76 + frame #3: 0x000000010002d742 qemu-system-arm`qemu_mutex_lock_iothread + 98 at cpus.c:1137 + frame #4: 0x00000001002c84b5 qemu-system-arm`main_loop_wait [inlined] os_host_main_loop_wait(timeout=<unavailable>) + 191 at main-loop.c:242 + frame #5: 0x00000001002c83f6 qemu-system-arm`main_loop_wait(nonblocking=<unavailable>) + 278 at main-loop.c:494 + frame #6: 0x000000010014961a qemu-system-arm`qemu_main [inlined] main_loop + 73 at vl.c:1789 + frame #7: 0x00000001001495d1 qemu-system-arm`qemu_main(argc=<unavailable>, argv=<unavailable>, envp=<unavailable>) + 17057 at vl.c:4353 + frame #8: 0x000000010029b45e qemu-system-arm`-[QemuCocoaAppController startEmulationWithArgc:argv:](self=<unavailable>, _cmd=<unavailable>, argc=<unavailable>, argv=<unavailable>) + 30 at cocoa.m:897 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1407808 b/results/classifier/mode-deepseek-r1:32b/output/system/1407808 new file mode 100644 index 00000000..120dd12a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1407808 @@ -0,0 +1,11 @@ + + +virtual console gives strange response to ANSI DSR + +With "-serial vc" (which is the default), qemu make strange responses to the ANSI DSR escape sequence (\033[6n) which can confuse guests. + +Terminal emulators supporting the ANSI escape sequences usually support the "Device Status Report" escape sequence, \033[6n, to which as a response the terminal injects as input the response \033[n;mR, containing the current cursor position. An application running in the guest can use this escape sequence to, for example, figure out the size of the terminal it is running under, which can be useful as the guest has no other standard way to figure out a "size" for the serial port. + +Unfortunately, it seems that qemu when run with "-serial vc" (which appears to be the default), when qemu gets the \033[6n escape sequence on the serial port, it just responds with a single \033, and that's it! This can confuse an application, could concievably assume that a terminal either supports this escape sequence and injects the correct response (\033[n;mR), or doesn't support it and injects absolutely nothing as input - but not something in between. + +This caused a problem on one shell implementation on OSv that tried to figure out the terminal's size, and had to work around this unexpected behavior (see https://github.com/cloudius-systems/osv/commit/b79223584be40459861d1c12e1cb67e3e49e2a12). \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1407813 b/results/classifier/mode-deepseek-r1:32b/output/system/1407813 new file mode 100644 index 00000000..370c0507 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1407813 @@ -0,0 +1,11 @@ + + +QEMU wrongly translates newlines on serial output + +When using "-serial stdio", QEMU shows the guest serial port's output on the tty running qemu. As it should, QEMU sets the tty to raw mode. Or almost... Strangely, it neglects to remove one output-translation bit, ONLCR (see termios(3)) enabled on the tty. And it should have removed this output translation! + +The problem is that with this ONLCR, the guest has no way of outputting a bare linefeed ('\n') - every time the guest tries to output a bare linefeed to the serial port, the host tty will translate it to \r\n which will be sent to the underlying terminal (e.g., xterm). + +In most cases, this issue doesn't cause a problem: When the guest is running a Unix-like operating system which is itself in cooked mode, the guest itself will always output \r\n, and the hosts second translation (to \r\r\n) does no harm. But in certain cases, the guest can *really* want to output just \n, and have this \n reach the terminal emulator and do what a linefeed is supposed to do without a carriage-return - namely - just go one line down in the same column. + +As an illustration of this bug, consider a guest running a Unix-like operating system running a curses-based application (e.g., "vi"). If you look at the output of "infocmp xterm", you'll notice that cud1=^J. This means that if the curses library decides to move one line down (it can happen in some cursor movement situations) it might decide to print a linefeed (\n) to move one line down. The guest's operating system will not mess with this linefeed (because the guest is in raw mode), but then qemu's tty, because it was wrongly left in ONLCR mode, will change this \n to \r\n before it reaches the terminal - causing wrong cursor movement (instead the cursor going straight down, it moves to the first column of the next line). \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1409 b/results/classifier/mode-deepseek-r1:32b/output/system/1409 new file mode 100644 index 00000000..cfcf2bf8 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1409 @@ -0,0 +1,3 @@ + + +make check failed about qemu@7.2.0on suse15_aarch64 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/141 b/results/classifier/mode-deepseek-r1:32b/output/system/141 new file mode 100644 index 00000000..a314e937 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/141 @@ -0,0 +1,3 @@ + + +qemu-system-x86_64+gdb: unable to correctly disassemble "real mode" (i8086) instructions after attaching to QEMU started with "-S -s" options diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1414293 b/results/classifier/mode-deepseek-r1:32b/output/system/1414293 new file mode 100644 index 00000000..2d390b76 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1414293 @@ -0,0 +1,7 @@ + + +target-lm32/translate.c:336: bad ? : operator + +[qemu/target-lm32/translate.c:336]: (style) Same expression in both branches of ternary operator. + + int rY = (dc->format == OP_FMT_RR) ? dc->r0 : dc->r0; \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1415 b/results/classifier/mode-deepseek-r1:32b/output/system/1415 new file mode 100644 index 00000000..6c53fa05 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1415 @@ -0,0 +1,91 @@ + + +Abort in xlnx_dp_change_graphic_fmt() +Description of problem: +xlnx_dp_change_graphic_fmt() will directly abort if either graphic format or the +video format is not supported. + +Replacing abort() in xlnx_dp_change_graphic_fmt() to `return` might be OK but I +am not sure what side effect there is. +Steps to reproduce: +``` +export QEMU=/path/to/to/qemu-system-aarch64 + +cat << EOF | $QEMU \ +-machine xlnx-zcu102 -monitor none -serial none \ +-display none -nodefaults -qtest stdio +writel 0xfd4ab000 0xcf6e998 +EOF +``` +Additional information: +``` +==20455==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases! +INFO: found LLVMFuzzerCustomMutator (0x564934146c90). Disabling -len_control by default. +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 4022227410 +INFO: Loaded 1 modules (618619 inline 8-bit counters): 618619 [0x5649372a5000, 0x56493733c07b), +INFO: Loaded 1 PC tables (618619 PCs): 618619 [0x564936933f40,0x5649372a46f0), +./qemu-videzzo-aarch64-target-videzzo-fuzz-xlnx-dp: Running 1 inputs 1 time(s) each. +INFO: Reading pre_seed_input if any ... +INFO: Executing pre_seed_input if any ... +INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 4096 bytes +Matching objects by name , *.core*, *.v_blend*, *.av_buffer_manager*, *.audio* +This process will fuzz the following MemoryRegions: + * xlnx.v-dp.audio[0] (size 50) + * xlnx.v-dp.av_buffer_manager[0] (size 238) + * xlnx.v-dp.core[0] (size 3b0) + * xlnx.v-dp.v_blend[0] (size 1e0) +This process will fuzz through the following interfaces: + * clock_step, EVENT_TYPE_CLOCK_STEP, 0xffffffff +0xffffffff, 255,255 + * xlnx.v-dp.core, EVENT_TYPE_MMIO_READ, 0xfd4a0000 +0x3b0, 4,4 + * xlnx.v-dp.core, EVENT_TYPE_MMIO_WRITE, 0xfd4a0000 +0x3b0, 4,4 + * xlnx.v-dp.v_blend, EVENT_TYPE_MMIO_READ, 0xfd4aa000 +0x1e0, 4,4 + * xlnx.v-dp.v_blend, EVENT_TYPE_MMIO_WRITE, 0xfd4aa000 +0x1e0, 4,4 + * xlnx.v-dp.av_buffer_manager, EVENT_TYPE_MMIO_READ, 0xfd4ab000 +0x238, 4,4 + * xlnx.v-dp.av_buffer_manager, EVENT_TYPE_MMIO_WRITE, 0xfd4ab000 +0x238, 4,4 + * xlnx.v-dp.audio, EVENT_TYPE_MMIO_READ, 0xfd4ac000 +0x50, 1,4 + * xlnx.v-dp.audio, EVENT_TYPE_MMIO_WRITE, 0xfd4ac000 +0x50, 1,4 +INFO: A corpus is not provided, starting from an empty corpus +#2 INITED cov: 3 ft: 4 corp: 1/1b exec/s: 0 rss: 489Mb +Running: crash-8b178268936b24c569a421d702ef5b6d911c99e7 +aarch64: xlnx_dp_change_graphic_fmt: unsupported graphic format 2304 +==20455== ERROR: libFuzzer: deadly signal + #0 0x56492f51f10e in __sanitizer_print_stack_trace /root/llvm-project/compiler-rt/lib/asan/asan_stack.cpp:86:3 + #1 0x56492f46dd81 in fuzzer::PrintStackTrace() /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerUtil.cpp:210:38 + #2 0x56492f446cb6 in fuzzer::Fuzzer::CrashCallback() (.part.0) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:236:18 + #3 0x56492f446d82 in fuzzer::Fuzzer::CrashCallback() /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:208:1 + #4 0x56492f446d82 in fuzzer::Fuzzer::StaticCrashSignalCallback() /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:207:19 + #5 0x7f7a315a641f (/lib/x86_64-linux-gnu/libpthread.so.0+0x1441f) + #6 0x7f7a313b800a in __libc_signal_restore_set /build/glibc-SzIz7B/glibc-2.31/signal/../sysdeps/unix/sysv/linux/internal-signals.h:86:3 + #7 0x7f7a313b800a in raise /build/glibc-SzIz7B/glibc-2.31/signal/../sysdeps/unix/sysv/linux/raise.c:48:3 + #8 0x7f7a31397858 in abort /build/glibc-SzIz7B/glibc-2.31/stdlib/abort.c:79:7 + #9 0x56492f54f65a in __wrap_abort /root/videzzo/videzzo_qemu/qemu/build-san-6/../tests/qtest/videzzo/less_crashes_wrappers.c:24:12 + #10 0x56492fe7e0d7 in xlnx_dp_change_graphic_fmt /root/videzzo/videzzo_qemu/qemu/build-san-6/../hw/display/xlnx_dp.c:644:9 + #11 0x56492fe7be58 in xlnx_dp_avbufm_write /root/videzzo/videzzo_qemu/qemu/build-san-6/../hw/display/xlnx_dp.c:1046:9 + #12 0x5649330fa313 in memory_region_write_accessor /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/memory.c:492:5 + #13 0x5649330f9c51 in access_with_adjusted_size /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/memory.c:554:18 + #14 0x5649330f8576 in memory_region_dispatch_write /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/memory.c:1514:16 + #15 0x56493318672e in flatview_write_continue /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/physmem.c:2825:23 + #16 0x56493317486b in flatview_write /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/physmem.c:2867:12 + #17 0x564933174328 in address_space_write /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/physmem.c:2963:18 + #18 0x56492f55f0cb in qemu_writel /root/videzzo/videzzo_qemu/qemu/build-san-6/../tests/qtest/videzzo/videzzo_qemu.c:1088:5 + #19 0x56492f55d544 in dispatch_mmio_write /root/videzzo/videzzo_qemu/qemu/build-san-6/../tests/qtest/videzzo/videzzo_qemu.c:1229:28 + #20 0x56493414264f in videzzo_dispatch_event /root/videzzo/videzzo.c:1122:5 + #21 0x5649341399cb in __videzzo_execute_one_input /root/videzzo/videzzo.c:272:9 + #22 0x5649341398a0 in videzzo_execute_one_input /root/videzzo/videzzo.c:313:9 + #23 0x56492f56610c in videzzo_qemu /root/videzzo/videzzo_qemu/qemu/build-san-6/../tests/qtest/videzzo/videzzo_qemu.c:1504:12 + #24 0x564934146f32 in LLVMFuzzerTestOneInput /root/videzzo/videzzo.c:1891:18 + #25 0x56492f447826 in fuzzer::Fuzzer::ExecuteCallback(unsigned char*, unsigned long) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:594:17 + #26 0x56492f42a454 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:21 + #27 0x56492f4353fe in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char*, unsigned long)) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:885:19 + #28 0x56492f4219e6 in main /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:30 + #29 0x7f7a31399082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16 + #30 0x56492f421a3d in _start (/root/videzzo/videzzo_qemu/out-san/qemu-videzzo-aarch64-target-videzzo-fuzz-xlnx-dp+0x3291a3d) + +NOTE: libFuzzer has rudimentary signal handlers. + Combine libFuzzer with AddressSanitizer or similar for better crash reports. +SUMMARY: libFuzzer: deadly signal +MS: 0 ; base unit: 0000000000000000000000000000000000000000 +0x0,0xc,0x1c,0xb0,0x4a,0xfd,0x0,0x0,0x0,0x0,0x4,0x0,0x0,0x0,0x4,0x2,0x48,0x40,0x1,0x0,0x0,0x0,0x0,0x0,0x0,0xa,0x20,0xa1,0x4a,0xfd,0x0,0x0,0x0,0x0,0x4,0x0,0x0,0x0,0x0,0xe,0x8,0xc0,0x4a,0xfd,0x0,0x0,0x0,0x0,0x2,0x0,0x0,0x0,0x0,0x8,0x0,0x0,0x4a,0xfd,0x0,0x0,0x0,0x0,0x4,0x0,0x0,0x0,0x4,0x2,0x3e,0xc6,0x1,0x0,0x0,0x0,0x0,0x0,0x0,0xc,0x78,0xb1,0x4a,0xfd,0x0,0x0,0x0,0x0,0x4,0x0,0x0,0x0,0x1,0x9,0x4,0x2,0x4a,0xfd,0x0,0x0,0x0,0x0,0x4,0x0,0x0,0x0,0xc2,0x1b,0xe,0x7b,0x0,0x0,0x0,0x0,0x1,0xb,0x84,0xa1,0x4a,0xfd,0x0,0x0,0x0,0x0,0x4,0x0,0x0,0x0,0xd8,0x1f,0x9a,0x30,0x0,0x0,0x0,0x0,0x0,0x8,0x70,0x0,0x4a,0xfd,0x0,0x0,0x0,0x0,0x4,0x0,0x0,0x0,0x1,0x9,0xec,0x2,0x4a,0xfd,0x0,0x0,0x0,0x0,0x4,0x0,0x0,0x0,0x50,0x62,0xd6,0x13,0x0,0x0,0x0,0x0,0x0,0xa,0x18,0xa0,0x4a,0xfd,0x0,0x0,0x0,0x0,0x4,0x0,0x0,0x0,0x1,0xd,0x0,0xb0,0x4a,0xfd,0x0,0x0,0x0,0x0,0x4,0x0,0x0,0x0,0x98,0xe9,0xf6,0xc,0x0,0x0,0x0,0x0, +\x00\x0c\x1c\xb0J\xfd\x00\x00\x00\x00\x04\x00\x00\x00\x04\x02H@\x01\x00\x00\x00\x00\x00\x00\x0a \xa1J\xfd\x00\x00\x00\x00\x04\x00\x00\x00\x00\x0e\x08\xc0J\xfd\x00\x00\x00\x00\x02\x00\x00\x00\x00\x08\x00\x00J\xfd\x00\x00\x00\x00\x04\x00\x00\x00\x04\x02>\xc6\x01\x00\x00\x00\x00\x00\x00\x0cx\xb1J\xfd\x00\x00\x00\x00\x04\x00\x00\x00\x01\x09\x04\x02J\xfd\x00\x00\x00\x00\x04\x00\x00\x00\xc2\x1b\x0e{\x00\x00\x00\x00\x01\x0b\x84\xa1J\xfd\x00\x00\x00\x00\x04\x00\x00\x00\xd8\x1f\x9a0\x00\x00\x00\x00\x00\x08p\x00J\xfd\x00\x00\x00\x00\x04\x00\x00\x00\x01\x09\xec\x02J\xfd\x00\x00\x00\x00\x04\x00\x00\x00Pb\xd6\x13\x00\x00\x00\x00\x00\x0a\x18\xa0J\xfd\x00\x00\x00\x00\x04\x00\x00\x00\x01\x0d\x00\xb0J\xfd\x00\x00\x00\x00\x04\x00\x00\x00\x98\xe9\xf6\x0c\x00\x00\x00\x00 +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1415181 b/results/classifier/mode-deepseek-r1:32b/output/system/1415181 new file mode 100644 index 00000000..06322133 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1415181 @@ -0,0 +1,6 @@ + + +Access raw partitions from Windows + +I'm using a windows tablet that makes imposible usb booting. It would be nice to have access to raw partitions in order to run linux installers using qemu. I can successfully install several boot loaders using uefi, so I gues this feature would be very helpful. +Thanks! \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1416 b/results/classifier/mode-deepseek-r1:32b/output/system/1416 new file mode 100644 index 00000000..5d031660 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1416 @@ -0,0 +1,7 @@ + + +MTE tags are applied at page granularity (4K) instead of tag granularity (16) +Description of problem: +After upgrading to QEMU v7.2.0 from v7.1.0, when executing stg/ldg instructions on any address, QEMU behaves as if the instruction was executed on the page base of said address. + +I believe this was introduced in b8967ddf393aaf35fdbc07b4cb538a40f8b6fe37 (@rth7680), since in that commit `ptr_paddr` is changed to be calculated based on `CPUTLBEntryFull::phys_addr`, which contains the page base address, while beforehand it was calculated based on `host` which does have the page offset applied. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1417 b/results/classifier/mode-deepseek-r1:32b/output/system/1417 new file mode 100644 index 00000000..e44039bc --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1417 @@ -0,0 +1,7 @@ + + +QEMU fails an assertion when hitting a breakpoint that is set on a tlb-missed 2-stage translated AArch64 memory +Description of problem: +After upgrading to QEMU v7.2.0 from v7.1.0, when hitting an instruction breakpoint on a memory address that is translated by 2 stages of translation, and is not already cached in the TLB, QEMU fails the assertion at target/arm/ptw.c:301 (`assert(fi->type != ARMFault_None);`). + +I believe this was introduced in f3639a64f602ea5c1436eb9c9b89f42028e3a4a8 (@rth7680), since in that commit the failure check for the return value of `get_phys_addr_lpae()` changed from checking for true (meaning failure) to checking for false (which actually means success). diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1418 b/results/classifier/mode-deepseek-r1:32b/output/system/1418 new file mode 100644 index 00000000..d209cba0 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1418 @@ -0,0 +1,89 @@ + + +Underflow in xlnx_dp_aux_pop_tx_fifo() +Description of problem: +Pop from s->tx_fifo but s->tx_fifo has zero element. +Steps to reproduce: +``` +export QEMU=/path/to/qemu-system-aarch64 + +cat << EOF | $QEMU \ +-machine xlnx-zcu102 -monitor none -serial none \ +-display none -nodefaults -qtest stdio +writel 0xfd4a0100 0x19c4406f +EOF +``` +Additional information: +``` ++ DEFAULT_INPUT_MAXSIZE=10000000 ++ ./qemu-videzzo-aarch64-target-videzzo-fuzz-xlnx-dp -max_len=10000000 -detect_leaks=0 ./crash-c15714102f0b894dea5c22f38852311567380926.minimized +==14660==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases! +INFO: found LLVMFuzzerCustomMutator (0x55db5cf9b840). Disabling -len_control by default. +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1977030529 +INFO: Loaded 1 modules (618603 inline 8-bit counters): 618603 [0x55db600fa000, 0x55db6019106b), +INFO: Loaded 1 PC tables (618603 PCs): 618603 [0x55db5f788d60,0x55db600f9410), +./qemu-videzzo-aarch64-target-videzzo-fuzz-xlnx-dp: Running 1 inputs 1 time(s) each. +INFO: Reading pre_seed_input if any ... +INFO: Executing pre_seed_input if any ... +Matching objects by name , *.core*, *.v_blend*, *.av_buffer_manager*, *.audio* +This process will fuzz the following MemoryRegions: + * xlnx.v-dp.core[0] (size 3b0) + * xlnx.v-dp.v_blend[0] (size 1e0) + * xlnx.v-dp.audio[0] (size 50) + * xlnx.v-dp.av_buffer_manager[0] (size 238) +This process will fuzz through the following interfaces: + * clock_step, EVENT_TYPE_CLOCK_STEP, 0xffffffff +0xffffffff, 255,255 + * xlnx.v-dp.core, EVENT_TYPE_MMIO_READ, 0xfd4a0000 +0x3b0, 4,4 + * xlnx.v-dp.core, EVENT_TYPE_MMIO_WRITE, 0xfd4a0000 +0x3b0, 4,4 + * xlnx.v-dp.v_blend, EVENT_TYPE_MMIO_READ, 0xfd4aa000 +0x1e0, 4,4 + * xlnx.v-dp.v_blend, EVENT_TYPE_MMIO_WRITE, 0xfd4aa000 +0x1e0, 4,4 + * xlnx.v-dp.av_buffer_manager, EVENT_TYPE_MMIO_READ, 0xfd4ab000 +0x238, 4,4 + * xlnx.v-dp.av_buffer_manager, EVENT_TYPE_MMIO_WRITE, 0xfd4ab000 +0x238, 4,4 + * xlnx.v-dp.audio, EVENT_TYPE_MMIO_READ, 0xfd4ac000 +0x50, 1,4 + * xlnx.v-dp.audio, EVENT_TYPE_MMIO_WRITE, 0xfd4ac000 +0x50, 1,4 +INFO: A corpus is not provided, starting from an empty corpus +#2 INITED cov: 3 ft: 4 corp: 1/1b exec/s: 0 rss: 488Mb +Running: ./crash-c15714102f0b894dea5c22f38852311567380926.minimized +aarch64: xlnx_dp_aux_pop_tx_fifo: TX_FIFO underflow +==14660== ERROR: libFuzzer: deadly signal + #0 0x55db5837410e in __sanitizer_print_stack_trace /root/llvm-project/compiler-rt/lib/asan/asan_stack.cpp:86:3 + #1 0x55db582c2d81 in fuzzer::PrintStackTrace() /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerUtil.cpp:210:38 + #2 0x55db5829bcb6 in fuzzer::Fuzzer::CrashCallback() (.part.0) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:236:18 + #3 0x55db5829bd82 in fuzzer::Fuzzer::CrashCallback() /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:208:1 + #4 0x55db5829bd82 in fuzzer::Fuzzer::StaticCrashSignalCallback() /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:207:19 + #5 0x7f98a612541f (/lib/x86_64-linux-gnu/libpthread.so.0+0x1441f) + #6 0x7f98a5f3700a in __libc_signal_restore_set /build/glibc-SzIz7B/glibc-2.31/signal/../sysdeps/unix/sysv/linux/internal-signals.h:86:3 + #7 0x7f98a5f3700a in raise /build/glibc-SzIz7B/glibc-2.31/signal/../sysdeps/unix/sysv/linux/raise.c:48:3 + #8 0x7f98a5f16858 in abort /build/glibc-SzIz7B/glibc-2.31/stdlib/abort.c:79:7 + #9 0x55db583a465a in __wrap_abort /root/videzzo/videzzo_qemu/qemu/build-san-6/../tests/qtest/videzzo/less_crashes_wrappers.c:24:12 + #10 0x55db58cce4d8 in xlnx_dp_aux_pop_tx_fifo /root/videzzo/videzzo_qemu/qemu/build-san-6/../hw/display/xlnx_dp.c:476:9 + #11 0x55db58cc9ee7 in xlnx_dp_aux_set_command /root/videzzo/videzzo_qemu/qemu/build-san-6/../hw/display/xlnx_dp.c:524:22 + #12 0x55db58cc6a92 in xlnx_dp_write /root/videzzo/videzzo_qemu/qemu/build-san-6/../hw/display/xlnx_dp.c:800:9 + #13 0x55db5bf4eec3 in memory_region_write_accessor /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/memory.c:492:5 + #14 0x55db5bf4e801 in access_with_adjusted_size /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/memory.c:554:18 + #15 0x55db5bf4d126 in memory_region_dispatch_write /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/memory.c:1514:16 + #16 0x55db5bfdb2de in flatview_write_continue /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/physmem.c:2825:23 + #17 0x55db5bfc941b in flatview_write /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/physmem.c:2867:12 + #18 0x55db5bfc8ed8 in address_space_write /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/physmem.c:2963:18 + #19 0x55db583b40cb in qemu_writel /root/videzzo/videzzo_qemu/qemu/build-san-6/../tests/qtest/videzzo/videzzo_qemu.c:1088:5 + #20 0x55db583b2544 in dispatch_mmio_write /root/videzzo/videzzo_qemu/qemu/build-san-6/../tests/qtest/videzzo/videzzo_qemu.c:1229:28 + #21 0x55db5cf971ff in videzzo_dispatch_event /root/videzzo/videzzo.c:1122:5 + #22 0x55db5cf8e57b in __videzzo_execute_one_input /root/videzzo/videzzo.c:272:9 + #23 0x55db5cf8e450 in videzzo_execute_one_input /root/videzzo/videzzo.c:313:9 + #24 0x55db583bb10c in videzzo_qemu /root/videzzo/videzzo_qemu/qemu/build-san-6/../tests/qtest/videzzo/videzzo_qemu.c:1504:12 + #25 0x55db5cf9bae2 in LLVMFuzzerTestOneInput /root/videzzo/videzzo.c:1891:18 + #26 0x55db5829c826 in fuzzer::Fuzzer::ExecuteCallback(unsigned char*, unsigned long) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:594:17 + #27 0x55db5827f454 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:21 + #28 0x55db5828a3fe in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char*, unsigned long)) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:885:19 + #29 0x55db582769e6 in main /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:30 + #30 0x7f98a5f18082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16 + #31 0x55db58276a3d in _start (/root/bugs/metadata/xlnx_dp-06/qemu-videzzo-aarch64-target-videzzo-fuzz-xlnx-dp+0x3291a3d) + +NOTE: libFuzzer has rudimentary signal handlers. + Combine libFuzzer with AddressSanitizer or similar for better crash reports. +SUMMARY: libFuzzer: deadly signal +MS: 0 ; base unit: 0000000000000000000000000000000000000000 +0x1,0x9,0x0,0x1,0x4a,0xfd,0x0,0x0,0x0,0x0,0x4,0x0,0x0,0x0,0x6f,0x40,0xc4,0x19,0x0,0x0,0x0,0x0, +\x01\x09\x00\x01J\xfd\x00\x00\x00\x00\x04\x00\x00\x00o@\xc4\x19\x00\x00\x00\x00 +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1419 b/results/classifier/mode-deepseek-r1:32b/output/system/1419 new file mode 100644 index 00000000..7012f1ba --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1419 @@ -0,0 +1,94 @@ + + +Overflow in xlnx_dp_aux_push_rx_fifo() +Description of problem: +Pushing stuff into s->rx_fifo many times make s->rx_fifo overflow. +Steps to reproduce: +``` +export QEMU=/path/to/qemu-system-aarch64 + +cat << EOF | $QEMU \ +-machine xlnx-zcu102 -monitor none -serial none \ +-display none -nodefaults -qtest stdio +writel 0xfd4a0100 0x7fb141e6 +writel 0xfd4a0100 0x7fb141e6 +writel 0xfd4a0100 0x7fb141e6 +EOF +``` +Additional information: +``` +root@3728b1f90dbd:~/bugs/metadata/xlnx_dp-03# bash -x xlnx_dp-03.videzzo ++ DEFAULT_INPUT_MAXSIZE=10000000 ++ ./qemu-videzzo-aarch64-target-videzzo-fuzz-xlnx-dp -max_len=10000000 -detect_leaks=0 poc-qemu-videzzo-aarch64-target-videzzo-fuzz-xlnx-dp-crash-a6a2bd23ff0408dd50652670fdcdf9f5ceaab95d.minimized +==767==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases! +INFO: found LLVMFuzzerCustomMutator (0x55d36d8b3870). Disabling -len_control by default. +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1781001818 +INFO: Loaded 1 modules (618604 inline 8-bit counters): 618604 [0x55d370a12000, 0x55d370aa906c), +INFO: Loaded 1 PC tables (618604 PCs): 618604 [0x55d3700a0ce0,0x55d370a113a0), +./qemu-videzzo-aarch64-target-videzzo-fuzz-xlnx-dp: Running 1 inputs 1 time(s) each. +INFO: Reading pre_seed_input if any ... +INFO: Executing pre_seed_input if any ... +Matching objects by name , *.core*, *.v_blend*, *.av_buffer_manager*, *.audio* +This process will fuzz the following MemoryRegions: + * xlnx.v-dp.core[0] (size 3b0) + * xlnx.v-dp.v_blend[0] (size 1e0) + * xlnx.v-dp.audio[0] (size 50) + * xlnx.v-dp.av_buffer_manager[0] (size 238) +This process will fuzz through the following interfaces: + * clock_step, EVENT_TYPE_CLOCK_STEP, 0xffffffff +0xffffffff, 255,255 + * xlnx.v-dp.core, EVENT_TYPE_MMIO_READ, 0xfd4a0000 +0x3b0, 4,4 + * xlnx.v-dp.core, EVENT_TYPE_MMIO_WRITE, 0xfd4a0000 +0x3b0, 4,4 + * xlnx.v-dp.v_blend, EVENT_TYPE_MMIO_READ, 0xfd4aa000 +0x1e0, 4,4 + * xlnx.v-dp.v_blend, EVENT_TYPE_MMIO_WRITE, 0xfd4aa000 +0x1e0, 4,4 + * xlnx.v-dp.av_buffer_manager, EVENT_TYPE_MMIO_READ, 0xfd4ab000 +0x238, 4,4 + * xlnx.v-dp.av_buffer_manager, EVENT_TYPE_MMIO_WRITE, 0xfd4ab000 +0x238, 4,4 + * xlnx.v-dp.audio, EVENT_TYPE_MMIO_READ, 0xfd4ac000 +0x50, 1,4 + * xlnx.v-dp.audio, EVENT_TYPE_MMIO_WRITE, 0xfd4ac000 +0x50, 1,4 +INFO: A corpus is not provided, starting from an empty corpus +#2 INITED cov: 3 ft: 4 corp: 1/1b exec/s: 0 rss: 492Mb +Running: poc-qemu-videzzo-aarch64-target-videzzo-fuzz-xlnx-dp-crash-a6a2bd23ff0408dd50652670fdcdf9f5ceaab95d.minimized +qemu-videzzo-aarch64-target-videzzo-fuzz-xlnx-dp: ../util/fifo8.c:43: void fifo8_push_all(Fifo8 *, const uint8_t *, uint32_t): Assertion `fifo->num + num <= fifo->capacity' failed. +==767== ERROR: libFuzzer: deadly signal + #0 0x55d368c8c10e in __sanitizer_print_stack_trace /root/llvm-project/compiler-rt/lib/asan/asan_stack.cpp:86:3 + #1 0x55d368bdad81 in fuzzer::PrintStackTrace() /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerUtil.cpp:210:38 + #2 0x55d368bb3cb6 in fuzzer::Fuzzer::CrashCallback() (.part.0) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:236:18 + #3 0x55d368bb3d82 in fuzzer::Fuzzer::CrashCallback() /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:208:1 + #4 0x55d368bb3d82 in fuzzer::Fuzzer::StaticCrashSignalCallback() /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:207:19 + #5 0x7f9897d8741f (/lib/x86_64-linux-gnu/libpthread.so.0+0x1441f) + #6 0x7f9897b9900a in __libc_signal_restore_set /build/glibc-SzIz7B/glibc-2.31/signal/../sysdeps/unix/sysv/linux/internal-signals.h:86:3 + #7 0x7f9897b9900a in raise /build/glibc-SzIz7B/glibc-2.31/signal/../sysdeps/unix/sysv/linux/raise.c:48:3 + #8 0x7f9897b78858 in abort /build/glibc-SzIz7B/glibc-2.31/stdlib/abort.c:79:7 + #9 0x7f9897b78728 in __assert_fail_base /build/glibc-SzIz7B/glibc-2.31/assert/assert.c:92:3 + #10 0x7f9897b89fd5 in __assert_fail /build/glibc-SzIz7B/glibc-2.31/assert/assert.c:101:3 + #11 0x55d36d56bff3 in fifo8_push_all /root/videzzo/videzzo_qemu/qemu/build-san-6/../util/fifo8.c:43:5 + #12 0x55d3695e64d3 in xlnx_dp_aux_push_rx_fifo /root/videzzo/videzzo_qemu/qemu/build-san-6/../hw/display/xlnx_dp.c:436:5 + #13 0x55d3695e1e9a in xlnx_dp_aux_set_command /root/videzzo/videzzo_qemu/qemu/build-san-6/../hw/display/xlnx_dp.c:513:13 + #14 0x55d3695dea92 in xlnx_dp_write /root/videzzo/videzzo_qemu/qemu/build-san-6/../hw/display/xlnx_dp.c:805:9 + #15 0x55d36c866ef3 in memory_region_write_accessor /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/memory.c:492:5 + #16 0x55d36c866831 in access_with_adjusted_size /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/memory.c:554:18 + #17 0x55d36c865156 in memory_region_dispatch_write /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/memory.c:1514:16 + #18 0x55d36c8f330e in flatview_write_continue /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/physmem.c:2825:23 + #19 0x55d36c8e144b in flatview_write /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/physmem.c:2867:12 + #20 0x55d36c8e0f08 in address_space_write /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/physmem.c:2963:18 + #21 0x55d368ccc0cb in qemu_writel /root/videzzo/videzzo_qemu/qemu/build-san-6/../tests/qtest/videzzo/videzzo_qemu.c:1088:5 + #22 0x55d368cca544 in dispatch_mmio_write /root/videzzo/videzzo_qemu/qemu/build-san-6/../tests/qtest/videzzo/videzzo_qemu.c:1229:28 + #23 0x55d36d8af22f in videzzo_dispatch_event /root/videzzo/videzzo.c:1122:5 + #24 0x55d36d8a65ab in __videzzo_execute_one_input /root/videzzo/videzzo.c:272:9 + #25 0x55d36d8a6480 in videzzo_execute_one_input /root/videzzo/videzzo.c:313:9 + #26 0x55d368cd310c in videzzo_qemu /root/videzzo/videzzo_qemu/qemu/build-san-6/../tests/qtest/videzzo/videzzo_qemu.c:1504:12 + #27 0x55d36d8b3b12 in LLVMFuzzerTestOneInput /root/videzzo/videzzo.c:1891:18 + #28 0x55d368bb4826 in fuzzer::Fuzzer::ExecuteCallback(unsigned char*, unsigned long) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:594:17 + #29 0x55d368b97454 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:21 + #30 0x55d368ba23fe in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char*, unsigned long)) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:885:19 + #31 0x55d368b8e9e6 in main /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:30 + #32 0x7f9897b7a082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16 + #33 0x55d368b8ea3d in _start (/root/bugs/metadata/xlnx_dp-03/qemu-videzzo-aarch64-target-videzzo-fuzz-xlnx-dp+0x3291a3d) + +NOTE: libFuzzer has rudimentary signal handlers. + Combine libFuzzer with AddressSanitizer or similar for better crash reports. +SUMMARY: libFuzzer: deadly signal +MS: 0 ; base unit: 0000000000000000000000000000000000000000 +0x1,0x9,0x0,0x1,0x4a,0xfd,0x0,0x0,0x0,0x0,0x4,0x0,0x0,0x0,0xe6,0x41,0xb1,0x7f,0x0,0x0,0x0,0x0,0x1,0x9,0x0,0x1,0x4a,0xfd,0x0,0x0,0x0,0x0,0x4,0x0,0x0,0x0,0xe6,0x41,0xb1,0x7f,0x0,0x0,0x0,0x0,0x1,0x9,0x0,0x1,0x4a,0xfd,0x0,0x0,0x0,0x0,0x4,0x0,0x0,0x0,0xe6,0x41,0xb1,0x7f,0x0,0x0,0x0,0x0, +\x01\x09\x00\x01J\xfd\x00\x00\x00\x00\x04\x00\x00\x00\xe6A\xb1\x7f\x00\x00\x00\x00\x01\x09\x00\x01J\xfd\x00\x00\x00\x00\x04\x00\x00\x00\xe6A\xb1\x7f\x00\x00\x00\x00\x01\x09\x00\x01J\xfd\x00\x00\x00\x00\x04\x00\x00\x00\xe6A\xb1\x7f\x00\x00\x00\x00 +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1422 b/results/classifier/mode-deepseek-r1:32b/output/system/1422 new file mode 100644 index 00000000..79a335a4 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1422 @@ -0,0 +1,17 @@ + + +/wrkdirs/usr/ports/emulators/qemu/work-default/qemu-7.2.0/tcg/ppc/tcg-target.c.inc:1882:9: error: couldn't allocate output register for constraint 'Q' +Description of problem: +Qemu 7.2.0 doesn't build on powerpc64le. +Steps to reproduce: +Build qemu. +Additional information: +``` +FAILED: libqemu-aarch64-softmmu.fa.p/tcg_tcg.c.o +cc -m64 -mlittle-endian -Ilibqemu-aarch64-softmmu.fa.p -I. -I.. -Itarget/arm -I../target/arm -Iqapi -Itrace -Iui -Iui/shader -I/usr/local/include/pixman-1 -I/usr/local/include -I/wrkdirs/usr/ports/emulators/qemu/work-default/qemu-7.2.0 -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -fcolor-diagnostics -Wall -Winvalid-pch -std=gnu11 -O2 -g -iquote . -iquote /wrkdirs/usr/ports/emulators/qemu/work-default/qemu-7.2.0 -iquote /wrkdirs/usr/ports/emulators/qemu/work-default/qemu-7.2.0/include -iquote /wrkdirs/usr/ports/emulators/qemu/work-default/qemu-7.2.0/tcg/ppc -pthread -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -fno-common -fwrapv -Wold-style-definition -Wtype-limits -Wformat-security -Wformat-y2k -Winit-self -Wignored-qualifiers -Wempty-body -Wnested-externs -Wendif-labels -Wexpansion-to-defined -Wno-initializer-overrides -Wno-missing-include-dirs -Wno-shift-negative-value -Wno-string-plus-int -Wno-typedef-redefinition -Wno-tautological-type-limit-compare -Wno-psabi -Wno-gnu-variable-sized-type-not-at-end -fstack-protector-strong -O2 -pipe -fstack-protector-strong -fno-strict-aliasing '-DPREFIX=\""/usr/local\""' -fPIE -DNEED_CPU_H '-DCONFIG_TARGET="aarch64-softmmu-config-target.h"' '-DCONFIG_DEVICES="aarch64-softmmu-config-devices.h"' -MD -MQ libqemu-aarch64-softmmu.fa.p/tcg_tcg.c.o -MF libqemu-aarch64-softmmu.fa.p/tcg_tcg.c.o.d -o libqemu-aarch64-softmmu.fa.p/tcg_tcg.c.o -c ../tcg/tcg.c +In file included from ../tcg/tcg.c:432: +/wrkdirs/usr/ports/emulators/qemu/work-default/qemu-7.2.0/tcg/ppc/tcg-target.c.inc:1882:9: error: couldn't allocate output register for constraint 'Q' + asm("mr %%r6, %1\n\t" + ^ +1 error generated. +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1422307 b/results/classifier/mode-deepseek-r1:32b/output/system/1422307 new file mode 100644 index 00000000..eed3bf4c --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1422307 @@ -0,0 +1,41 @@ + + +qemu-nbd corrupts files + +Dear all, + +On Trusty, in certain situations, try to copy files over a qemu-nbd mounted file system leads to write errors (and thus, file corruption). + +Here is the last example I tried: +-> virtual disk is a VDI disk +-> It has only one partition, in FAT + +Here is my mount process: +# modprobe nbd max_part=63 +# qemu-nbd -c /dev/nbd0 "virtual_disk.vdi" +# partprobe /dev/nbd0 +# mount /dev/nbd0p1 /tmp/mnt/ + +Partition is properly mounted at that point: +/dev/nbd0p1 on /tmp/mnt type vfat (rw) + +Now, when I copy a file (rather big, ~28MB): +# cp file_to_copy /tmp/mnt/ ; sync +# md5sum /tmp/mnt/file_to_copy +2efc9f32e4267782b11d63d2f128a363 /tmp/mnt/file_to_copy +# umount /tmp/mnt +# mount /dev/nbd0p1 /tmp/mnt/ +# md5sum /tmp/mnt/file_to_copy +42b0a3bf73f704d03ce301716d7654de /tmp/mnt/file_to_copy + +The first hash was obviously the right one. + +On a previous attempt I did, I spotted thanks to vbindiff that parts of the file were just filed with 0s instead of actual data. +It will randomly work after several attempts to write. + +Version information: +# qemu-nbd --version +qemu-nbd version 0.0.1 +Written by Anthony Liguori. + +Cheers, \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1424 b/results/classifier/mode-deepseek-r1:32b/output/system/1424 new file mode 100644 index 00000000..80d289ec --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1424 @@ -0,0 +1,105 @@ + + +Overflow in xlnx_dp_aux_push_tx_fifo() +Description of problem: +Invoking xlnx_dp_aux_push_tx_fifo() 17 times overflow the s->tx_fifo. +Steps to reproduce: +``` +export QEMU=/path/to/qemu-system-aarch64 + +cat << EOF | $QEMU \ +-machine xlnx-zcu102 -monitor none -serial none \ +-display none -nodefaults -qtest stdio +writel 0xfd4a0104 0x6fed53ba +writel 0xfd4a0104 0x66554466 +writel 0xfd4a0104 0x6fed53ba +writel 0xfd4a0104 0x6fed53ba +writel 0xfd4a0104 0x666e0fa2 +writel 0xfd4a0104 0x666e0fa2 +writel 0xfd4a0104 0x666e0fa2 +writel 0xfd4a0104 0x6fed53ba +writel 0xfd4a0104 0x6fed53ba +writel 0xfd4a0104 0x66554466 +writel 0xfd4a0104 0x66554466 +writel 0xfd4a0104 0x66554466 +writel 0xfd4a0104 0x66554466 +writel 0xfd4a0104 0x66554466 +writel 0xfd4a0104 0x6fed53ba +writel 0xfd4a0104 0x6fed53ba +writel 0xfd4a0104 0x6fed53ba +EOF +``` +Additional information: +``` +root@621cbd136b6f:~/bugs/metadata/xlnx_dp-07# bash -x xlnx_dp-07.videzzo ++ DEFAULT_INPUT_MAXSIZE=10000000 ++ ./qemu-videzzo-aarch64-target-videzzo-fuzz-xlnx-dp -max_len=10000000 -detect_leaks=0 ./poc-qemu-videzzo-aarch64-target-videzzo-fuzz-xlnx-dp-crash-8070de484ac8d4d9bfff9b439311058e05b8b40f.minimized +==47609==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases! +INFO: found LLVMFuzzerCustomMutator (0x564c9e37c2b0). Disabling -len_control by default. +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2128347645 +INFO: Loaded 1 modules (600768 inline 8-bit counters): 600768 [0x564ca198f000, 0x564ca1a21ac0), +INFO: Loaded 1 PC tables (600768 PCs): 600768 [0x564ca1063b10,0x564ca198e710), +./qemu-videzzo-aarch64-target-videzzo-fuzz-xlnx-dp: Running 1 inputs 1 time(s) each. +INFO: Reading pre_seed_input if any ... +INFO: Executing pre_seed_input if any ... +Matching objects by name , *.core*, *.v_blend*, *.av_buffer_manager*, *.audio* +This process will fuzz the following MemoryRegions: + * xlnx.v-dp.core[0] (size 3b0) + * xlnx.v-dp.v_blend[0] (size 1e0) + * xlnx.v-dp.audio[0] (size 50) + * xlnx.v-dp.av_buffer_manager[0] (size 238) +This process will fuzz through the following interfaces: + * clock_step, EVENT_TYPE_CLOCK_STEP, 0xffffffff +0xffffffff, 255,255 + * xlnx.v-dp.core, EVENT_TYPE_MMIO_READ, 0xfd4a0000 +0x3b0, 4,4 + * xlnx.v-dp.core, EVENT_TYPE_MMIO_WRITE, 0xfd4a0000 +0x3b0, 4,4 + * xlnx.v-dp.v_blend, EVENT_TYPE_MMIO_READ, 0xfd4aa000 +0x1e0, 4,4 + * xlnx.v-dp.v_blend, EVENT_TYPE_MMIO_WRITE, 0xfd4aa000 +0x1e0, 4,4 + * xlnx.v-dp.av_buffer_manager, EVENT_TYPE_MMIO_READ, 0xfd4ab000 +0x238, 4,4 + * xlnx.v-dp.av_buffer_manager, EVENT_TYPE_MMIO_WRITE, 0xfd4ab000 +0x238, 4,4 + * xlnx.v-dp.audio, EVENT_TYPE_MMIO_READ, 0xfd4ac000 +0x50, 1,4 + * xlnx.v-dp.audio, EVENT_TYPE_MMIO_WRITE, 0xfd4ac000 +0x50, 1,4 +INFO: A corpus is not provided, starting from an empty corpus +#2 INITED cov: 3 ft: 4 corp: 1/1b exec/s: 0 rss: 510Mb +Running: ./poc-qemu-videzzo-aarch64-target-videzzo-fuzz-xlnx-dp-crash-8070de484ac8d4d9bfff9b439311058e05b8b40f.minimized +qemu-videzzo-aarch64-target-videzzo-fuzz-xlnx-dp: ../util/fifo8.c:43: void fifo8_push_all(Fifo8 *, const uint8_t *, uint32_t): Assertion `fifo->num + num <= fifo->capacity' failed. +==47609== ERROR: libFuzzer: deadly signal + #0 0x564c998420fe in __sanitizer_print_stack_trace /root/llvm-project/compiler-rt/lib/asan/asan_stack.cpp:86:3 + #1 0x564c99790d71 in fuzzer::PrintStackTrace() /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerUtil.cpp:210:38 + #2 0x564c99769ca6 in fuzzer::Fuzzer::CrashCallback() (.part.0) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:236:18 + #3 0x564c99769d72 in fuzzer::Fuzzer::CrashCallback() /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:208:1 + #4 0x564c99769d72 in fuzzer::Fuzzer::StaticCrashSignalCallback() /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:207:19 + #5 0x7f8ef929941f (/lib/x86_64-linux-gnu/libpthread.so.0+0x1441f) + #6 0x7f8ef90ab00a in __libc_signal_restore_set /build/glibc-SzIz7B/glibc-2.31/signal/../sysdeps/unix/sysv/linux/internal-signals.h:86:3 + #7 0x7f8ef90ab00a in raise /build/glibc-SzIz7B/glibc-2.31/signal/../sysdeps/unix/sysv/linux/raise.c:48:3 + #8 0x7f8ef908a858 in abort /build/glibc-SzIz7B/glibc-2.31/stdlib/abort.c:79:7 + #9 0x7f8ef908a728 in __assert_fail_base /build/glibc-SzIz7B/glibc-2.31/assert/assert.c:92:3 + #10 0x7f8ef909bfd5 in __assert_fail /build/glibc-SzIz7B/glibc-2.31/assert/assert.c:101:3 + #11 0x564c9e1cdbb3 in fifo8_push_all /root/videzzo/videzzo_qemu/qemu/out-san/../util/fifo8.c:43:5 + #12 0x564c9a189c13 in xlnx_dp_aux_push_tx_fifo /root/videzzo/videzzo_qemu/qemu/out-san/../hw/display/xlnx_dp.c:467:5 + #13 0x564c9a1842f2 in xlnx_dp_write /root/videzzo/videzzo_qemu/qemu/out-san/../hw/display/xlnx_dp.c:857:9 + #14 0x564c9d491e93 in memory_region_write_accessor /root/videzzo/videzzo_qemu/qemu/out-san/../softmmu/memory.c:493:5 + #15 0x564c9d4917d1 in access_with_adjusted_size /root/videzzo/videzzo_qemu/qemu/out-san/../softmmu/memory.c:555:18 + #16 0x564c9d4900f6 in memory_region_dispatch_write /root/videzzo/videzzo_qemu/qemu/out-san/../softmmu/memory.c:1515:16 + #17 0x564c9d5209ce in flatview_write_continue /root/videzzo/videzzo_qemu/qemu/out-san/../softmmu/physmem.c:2825:23 + #18 0x564c9d50e77b in flatview_write /root/videzzo/videzzo_qemu/qemu/out-san/../softmmu/physmem.c:2867:12 + #19 0x564c9d50e238 in address_space_write /root/videzzo/videzzo_qemu/qemu/out-san/../softmmu/physmem.c:2963:18 + #20 0x564c99882d48 in qemu_writel /root/videzzo/videzzo_qemu/qemu/out-san/../tests/qtest/videzzo/videzzo_qemu.c:1096:5 + #21 0x564c998810b3 in dispatch_mmio_write /root/videzzo/videzzo_qemu/qemu/out-san/../tests/qtest/videzzo/videzzo_qemu.c:1245:28 + #22 0x564c9e37772f in videzzo_dispatch_event /root/videzzo/videzzo.c:1140:5 + #23 0x564c9e36eaad in __videzzo_execute_one_input /root/videzzo/videzzo.c:288:9 + #24 0x564c9e36e854 in videzzo_execute_one_input /root/videzzo/videzzo.c:329:9 + #25 0x564c9988a08c in videzzo_qemu /root/videzzo/videzzo_qemu/qemu/out-san/../tests/qtest/videzzo/videzzo_qemu.c:1520:12 + #26 0x564c9e37c57b in LLVMFuzzerTestOneInput /root/videzzo/videzzo.c:1910:18 + #27 0x564c9976a816 in fuzzer::Fuzzer::ExecuteCallback(unsigned char*, unsigned long) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:594:17 + #28 0x564c9974d444 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:21 + #29 0x564c997583ee in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char*, unsigned long)) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:885:19 + #30 0x564c997449d6 in main /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:30 + #31 0x7f8ef908c082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16 + #32 0x564c99744a2d in _start (/root/bugs/metadata/xlnx_dp-07/qemu-videzzo-aarch64-target-videzzo-fuzz-xlnx-dp+0x3453a2d) + +NOTE: libFuzzer has rudimentary signal handlers. + Combine libFuzzer with AddressSanitizer or similar for better crash reports. +SUMMARY: libFuzzer: deadly signal +MS: 0 ; base unit: 0000000000000000000000000000000000000000 +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1425 b/results/classifier/mode-deepseek-r1:32b/output/system/1425 new file mode 100644 index 00000000..b8328e9f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1425 @@ -0,0 +1,86 @@ + + +Assertion failed in transfer_fifo() +Description of problem: +In transfer_fifo(), fifo32_pop() fails since less than 32 bytes are in the fifo. +Steps to reproduce: +``` +export QEMU=/path/to/qemu-system-aarch64 + +cat << EOF | $QEMU \ +-machine xlnx-zcu102 -monitor none -serial none \ +-display none -nodefaults -qtest stdio -audio none +writel 0xff070000 0x0f73720a +writel 0xff07003c 0x1f37ee63 +EOF +``` +Additional information: +``` +==31717==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases! +INFO: found LLVMFuzzerCustomMutator (0x55871da359f0). Disabling -len_control by default. +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1734665286 +INFO: Loaded 1 modules (618606 inline 8-bit counters): 618606 [0x558720b94000, 0x558720c2b06e), +INFO: Loaded 1 PC tables (618606 PCs): 618606 [0x558720222e60,0x558720b93540), +/root/videzzo/videzzo_qemu/out-san/qemu-videzzo-aarch64-target-videzzo-fuzz-xlnx-zynqmp-can: Running 1 inputs 1 time(s) each. +INFO: Reading pre_seed_input if any ... +INFO: Executing pre_seed_input if any ... +Matching objects by name , *xlnx.zynqmp-can* +This process will fuzz the following MemoryRegions: + * xlnx.zynqmp-can[1] (size 84) + * xlnx.zynqmp-can[0] (size 84) + * xlnx.zynqmp-can[1] (size 84) + * xlnx.zynqmp-can[0] (size 84) +This process will fuzz through the following interfaces: + * clock_step, EVENT_TYPE_CLOCK_STEP, 0xffffffff +0xffffffff, 255,255 + * xlnx.zynqmp-can, EVENT_TYPE_MMIO_READ, 0xff070000 +0x84, 4,4 + * xlnx.zynqmp-can, EVENT_TYPE_MMIO_WRITE, 0xff070000 +0x84, 4,4 + * xlnx.zynqmp-can, EVENT_TYPE_MMIO_READ, 0xff060000 +0x84, 4,4 + * xlnx.zynqmp-can, EVENT_TYPE_MMIO_WRITE, 0xff060000 +0x84, 4,4 +INFO: A corpus is not provided, starting from an empty corpus +#2 INITED cov: 3 ft: 4 corp: 1/1b exec/s: 0 rss: 491Mb +Running: poc-qemu-videzzo-aarch64-target-videzzo-fuzz-xlnx-zynqmp-can-crash-97ef02583c679111ba6ad823f573f139fac7c72e +qemu-videzzo-aarch64-target-videzzo-fuzz-xlnx-zynqmp-can: ../util/fifo8.c:62: uint8_t fifo8_pop(Fifo8 *): Assertion `fifo->num > 0' failed. +==31717== ERROR: libFuzzer: deadly signal + #0 0x558718e0e10e in __sanitizer_print_stack_trace /root/llvm-project/compiler-rt/lib/asan/asan_stack.cpp:86:3 + #1 0x558718d5cd81 in fuzzer::PrintStackTrace() /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerUtil.cpp:210:38 + #2 0x558718d35cb6 in fuzzer::Fuzzer::CrashCallback() (.part.0) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:236:18 + #3 0x558718d35d82 in fuzzer::Fuzzer::CrashCallback() /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:208:1 + #4 0x558718d35d82 in fuzzer::Fuzzer::StaticCrashSignalCallback() /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:207:19 + #5 0x7f3ad4eba41f (/lib/x86_64-linux-gnu/libpthread.so.0+0x1441f) + #6 0x7f3ad4ccc00a in __libc_signal_restore_set /build/glibc-SzIz7B/glibc-2.31/signal/../sysdeps/unix/sysv/linux/internal-signals.h:86:3 + #7 0x7f3ad4ccc00a in raise /build/glibc-SzIz7B/glibc-2.31/signal/../sysdeps/unix/sysv/linux/raise.c:48:3 + #8 0x7f3ad4cab858 in abort /build/glibc-SzIz7B/glibc-2.31/stdlib/abort.c:79:7 + #9 0x7f3ad4cab728 in __assert_fail_base /build/glibc-SzIz7B/glibc-2.31/assert/assert.c:92:3 + #10 0x7f3ad4cbcfd5 in __assert_fail /build/glibc-SzIz7B/glibc-2.31/assert/assert.c:101:3 + #11 0x55871d6eeac9 in fifo8_pop /root/videzzo/videzzo_qemu/qemu/build-san-6/../util/fifo8.c:62:5 + #12 0x55871a33f303 in fifo32_pop /root/videzzo/videzzo_qemu/qemu/include/qemu/fifo32.h:137:17 + #13 0x55871a334bb5 in transfer_fifo /root/videzzo/videzzo_qemu/qemu/build-san-6/../hw/net/can/xlnx-zynqmp-can.c:455:23 + #14 0x55871a32d4c0 in can_tx_post_write /root/videzzo/videzzo_qemu/qemu/build-san-6/../hw/net/can/xlnx-zynqmp-can.c:830:9 + #15 0x558719393dcb in register_write /root/videzzo/videzzo_qemu/qemu/build-san-6/../hw/core/register.c:122:9 + #16 0x558719397de8 in register_write_memory /root/videzzo/videzzo_qemu/qemu/build-san-6/../hw/core/register.c:203:5 + #17 0x55871c9e9073 in memory_region_write_accessor /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/memory.c:492:5 + #18 0x55871c9e89b1 in access_with_adjusted_size /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/memory.c:554:18 + #19 0x55871c9e72d6 in memory_region_dispatch_write /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/memory.c:1514:16 + #20 0x55871ca7548e in flatview_write_continue /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/physmem.c:2825:23 + #21 0x55871ca635cb in flatview_write /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/physmem.c:2867:12 + #22 0x55871ca63088 in address_space_write /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/physmem.c:2963:18 + #23 0x558718e4e0cb in qemu_writel /root/videzzo/videzzo_qemu/qemu/build-san-6/../tests/qtest/videzzo/videzzo_qemu.c:1081:5 + #24 0x558718e4c544 in dispatch_mmio_write /root/videzzo/videzzo_qemu/qemu/build-san-6/../tests/qtest/videzzo/videzzo_qemu.c:1222:28 + #25 0x55871da313af in videzzo_dispatch_event /root/videzzo/videzzo.c:1122:5 + #26 0x55871da2872b in __videzzo_execute_one_input /root/videzzo/videzzo.c:272:9 + #27 0x55871da28600 in videzzo_execute_one_input /root/videzzo/videzzo.c:313:9 + #28 0x558718e5510c in videzzo_qemu /root/videzzo/videzzo_qemu/qemu/build-san-6/../tests/qtest/videzzo/videzzo_qemu.c:1497:12 + #29 0x55871da35c92 in LLVMFuzzerTestOneInput /root/videzzo/videzzo.c:1891:18 + #30 0x558718d36826 in fuzzer::Fuzzer::ExecuteCallback(unsigned char*, unsigned long) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:594:17 + #31 0x558718d19454 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:21 + #32 0x558718d243fe in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char*, unsigned long)) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:885:19 + #33 0x558718d109e6 in main /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:30 + #34 0x7f3ad4cad082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16 + #35 0x558718d10a3d in _start (/root/videzzo/videzzo_qemu/out-san/qemu-videzzo-aarch64-target-videzzo-fuzz-xlnx-zynqmp-can+0x3291a3d) + +NOTE: libFuzzer has rudimentary signal handlers. + Combine libFuzzer with AddressSanitizer or similar for better crash reports. +SUMMARY: libFuzzer: deadly signal +MS: 0 ; base unit: 0000000000000000000000000000000000000000 +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1426 b/results/classifier/mode-deepseek-r1:32b/output/system/1426 new file mode 100644 index 00000000..bfdc2356 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1426 @@ -0,0 +1,40 @@ + + +On windows, display spice-app is not able to initialize, start spice-server and consequently can't use spice-client +Description of problem: +I want to try windows spice-client / virt-viewer.exe (v11.0.256) instead of gtk client. +Windows spice client virtviewer won't start like it does under Linux. +The error message indicaes that the spice-server itself failed to open spice sockets +The registry to handle ```spice://``` URI handler is configured. +Steps to reproduce: +1. just run command +Additional information: +URI handler in registry is configure using a regestry import file ```spiceproto.reg``` +``` +Windows Registry Editor Version 5.00 + +[HKEY_CLASSES_ROOT\spice] +"URL Protocol"="" + +[HKEY_CLASSES_ROOT\spice\DefaultIcon] +@="C:\\Program Files\\VirtViewer v11.0-256\\bin\\remote-viewer.exe,1" + +[HKEY_CLASSES_ROOT\spice\Extensions] +[HKEY_CLASSES_ROOT\spice\shell] +[HKEY_CLASSES_ROOT\spice\shell\open] +[HKEY_CLASSES_ROOT\spice\shell\open\command] +@="\"C:\\Program Files\\VirtViewer v11.0-256\\bin\\remote-viewer.exe\" \"%1\"" + +[HKEY_CLASSES_ROOT\spice+unix] +"URL Protocol"="" + +[HKEY_CLASSES_ROOT\spice+unix\DefaultIcon] +@="C:\\Program Files\\VirtViewer v11.0-256\\bin\\remote-viewer.exe,1" + +[HKEY_CLASSES_ROOT\spice+unix\Extensions] +[HKEY_CLASSES_ROOT\spice+unix\shell] +[HKEY_CLASSES_ROOT\spice+unix\shell\open] +[HKEY_CLASSES_ROOT\spice+unix\shell\open\command] +@="\"C:\\Program Files\\VirtViewer v11.0-256\\bin\\remote-viewer.exe\" \"%1\"" +``` +This URI handler is working, and can be seen to work by typing ```spice://abcdefg``` in firefox. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1427 b/results/classifier/mode-deepseek-r1:32b/output/system/1427 new file mode 100644 index 00000000..83d2f137 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1427 @@ -0,0 +1,376 @@ + + +Fifo overflow in transfer_fifo() +Description of problem: +In transfer_fifo(), fifo32_push() fails since less than 32 bytes are free in the +fifo. +Steps to reproduce: +``` +export QEMU=/path/to/qemu-system-aarch64 + +cat << EOF | $QEMU \ +-machine xlnx-zcu102 -monitor none -serial none \ +-display none -nodefaults -qtest stdio +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x554439e4 +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x7439dad1 +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x554439e4 +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x7439dad1 +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff070030 0x5b33c2da +writel 0xff070004 0x6847773b +writel 0xff070030 0x5b33c2da +writel 0xff070000 0x7a9e77fa +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff070038 0x3730c1d8 +writel 0xff070038 0x3730c1d8 +writel 0xff070038 0x3730c1d8 +writel 0xff070038 0x3730c1d8 +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff070038 0x3730c1d8 +writel 0xff070038 0x3730c1d8 +writel 0xff070038 0x3730c1d8 +writel 0xff070038 0x3730c1d8 +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff070038 0x3730c1d8 +writel 0xff070038 0x3730c1d8 +writel 0xff070038 0x3730c1d8 +writel 0xff070038 0x3730c1d8 +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff070038 0x3730c1d8 +writel 0xff070038 0x3730c1d8 +writel 0xff070038 0x3730c1d8 +writel 0xff070038 0x3730c1d8 +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff070038 0x3730c1d8 +writel 0xff070038 0x3730c1d8 +writel 0xff070038 0x3730c1d8 +writel 0xff070038 0x3730c1d8 +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff070038 0x0bbac0b1 +readl 0xff070054 +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff070038 0x3730c1d8 +writel 0xff070038 0x3730c1d8 +writel 0xff070038 0x3730c1d8 +writel 0xff070038 0x3730c1d8 +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff070038 0x3730c1d8 +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff070038 0x3730c1d8 +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff070038 0x3730c1d8 +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff070038 0x3730c1d8 +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff070038 0x3730c1d8 +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff070038 0x3730c1d8 +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff07003c 0x1f9c3bcd +writel 0xff070038 0x3730c1d8 +writel 0xff07003c 0x1f9c3bcd +writel 0xff070038 0x3730c1d8 +writel 0xff07003c 0x1f9c3bcd +EOF +``` +Additional information: +``` +==60953==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases! +INFO: found LLVMFuzzerCustomMutator (0x55c4943a85f0). Disabling -len_control by default. +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1771329340 +INFO: Loaded 1 modules (600781 inline 8-bit counters): 600781 [0x55c4979bb000, 0x55c497a4dacd), +INFO: Loaded 1 PC tables (600781 PCs): 600781 [0x55c49708fbf0,0x55c4979ba8c0), +./qemu-videzzo-aarch64-target-videzzo-fuzz-xlnx-zynqmp-can: Running 1 inputs 1 time(s) each. +INFO: Reading pre_seed_input if any ... +INFO: Executing pre_seed_input if any ... +Matching objects by name , *xlnx.zynqmp-can* +This process will fuzz the following MemoryRegions: + * xlnx.zynqmp-can[1] (size 84) + * xlnx.zynqmp-can[0] (size 84) + * xlnx.zynqmp-can[1] (size 84) + * xlnx.zynqmp-can[0] (size 84) +This process will fuzz through the following interfaces: + * clock_step, EVENT_TYPE_CLOCK_STEP, 0xffffffff +0xffffffff, 255,255 + * xlnx.zynqmp-can, EVENT_TYPE_MMIO_READ, 0xff070000 +0x84, 4,4 + * xlnx.zynqmp-can, EVENT_TYPE_MMIO_WRITE, 0xff070000 +0x84, 4,4 + * xlnx.zynqmp-can, EVENT_TYPE_MMIO_READ, 0xff060000 +0x84, 4,4 + * xlnx.zynqmp-can, EVENT_TYPE_MMIO_WRITE, 0xff060000 +0x84, 4,4 +INFO: A corpus is not provided, starting from an empty corpus +#2 INITED cov: 3 ft: 4 corp: 1/1b exec/s: 0 rss: 509Mb +Running: poc-qemu-videzzo-aarch64-target-videzzo-fuzz-xlnx-zynqmp-can-crash-8c83f08fb7643e6eb55af43e76de522c6f5fcef2.minimized.minimized +qemu-videzzo-aarch64-target-videzzo-fuzz-xlnx-zynqmp-can: ../util/fifo8.c:34: void fifo8_push(Fifo8 *, uint8_t): Assertion `fifo->num < fifo->capacity' failed. +==60953== ERROR: libFuzzer: deadly signal + #0 0x55c48f86e0fe in __sanitizer_print_stack_trace /root/llvm-project/compiler-rt/lib/asan/asan_stack.cpp:86:3 + #1 0x55c48f7bcd71 in fuzzer::PrintStackTrace() /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerUtil.cpp:210:38 + #2 0x55c48f795ca6 in fuzzer::Fuzzer::CrashCallback() (.part.0) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:236:18 + #3 0x55c48f795d72 in fuzzer::Fuzzer::CrashCallback() /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:208:1 + #4 0x55c48f795d72 in fuzzer::Fuzzer::StaticCrashSignalCallback() /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:207:19 + #5 0x7fe36599541f (/lib/x86_64-linux-gnu/libpthread.so.0+0x1441f) + #6 0x7fe3657a700a in __libc_signal_restore_set /build/glibc-SzIz7B/glibc-2.31/signal/../sysdeps/unix/sysv/linux/internal-signals.h:86:3 + #7 0x7fe3657a700a in raise /build/glibc-SzIz7B/glibc-2.31/signal/../sysdeps/unix/sysv/linux/raise.c:48:3 + #8 0x7fe365786858 in abort /build/glibc-SzIz7B/glibc-2.31/stdlib/abort.c:79:7 + #9 0x7fe365786728 in __assert_fail_base /build/glibc-SzIz7B/glibc-2.31/assert/assert.c:92:3 + #10 0x7fe365797fd5 in __assert_fail /build/glibc-SzIz7B/glibc-2.31/assert/assert.c:101:3 + #11 0x55c4941f98ef in fifo8_push /root/videzzo/videzzo_qemu/qemu/out-san/../util/fifo8.c:34:5 + #12 0x55c490d83bb0 in fifo32_push /root/videzzo/videzzo_qemu/qemu/include/qemu/fifo32.h:94:9 + #13 0x55c490d79d17 in transfer_fifo /root/videzzo/videzzo_qemu/qemu/out-san/../hw/net/can/xlnx-zynqmp-can.c:476:21 + #14 0x55c490d71a00 in can_tx_post_write /root/videzzo/videzzo_qemu/qemu/out-san/../hw/net/can/xlnx-zynqmp-can.c:836:9 + #15 0x55c48fdfaf9b in register_write /root/videzzo/videzzo_qemu/qemu/out-san/../hw/core/register.c:122:9 + #16 0x55c48fdfefb8 in register_write_memory /root/videzzo/videzzo_qemu/qemu/out-san/../hw/core/register.c:203:5 + #17 0x55c4934be1d3 in memory_region_write_accessor /root/videzzo/videzzo_qemu/qemu/out-san/../softmmu/memory.c:493:5 + #18 0x55c4934bdb11 in access_with_adjusted_size /root/videzzo/videzzo_qemu/qemu/out-san/../softmmu/memory.c:555:18 + #19 0x55c4934bc436 in memory_region_dispatch_write /root/videzzo/videzzo_qemu/qemu/out-san/../softmmu/memory.c:1515:16 + #20 0x55c49354cd0e in flatview_write_continue /root/videzzo/videzzo_qemu/qemu/out-san/../softmmu/physmem.c:2825:23 + #21 0x55c49353aabb in flatview_write /root/videzzo/videzzo_qemu/qemu/out-san/../softmmu/physmem.c:2867:12 + #22 0x55c49353a578 in address_space_write /root/videzzo/videzzo_qemu/qemu/out-san/../softmmu/physmem.c:2963:18 + #23 0x55c48f8aed48 in qemu_writel /root/videzzo/videzzo_qemu/qemu/out-san/../tests/qtest/videzzo/videzzo_qemu.c:1096:5 + #24 0x55c48f8ad0b3 in dispatch_mmio_write /root/videzzo/videzzo_qemu/qemu/out-san/../tests/qtest/videzzo/videzzo_qemu.c:1245:28 + #25 0x55c4943a3a6f in videzzo_dispatch_event /root/videzzo/videzzo.c:1140:5 + #26 0x55c49439aded in __videzzo_execute_one_input /root/videzzo/videzzo.c:288:9 + #27 0x55c49439ab94 in videzzo_execute_one_input /root/videzzo/videzzo.c:329:9 + #28 0x55c48f8b608c in videzzo_qemu /root/videzzo/videzzo_qemu/qemu/out-san/../tests/qtest/videzzo/videzzo_qemu.c:1520:12 + #29 0x55c4943a88bb in LLVMFuzzerTestOneInput /root/videzzo/videzzo.c:1910:18 + #30 0x55c48f796816 in fuzzer::Fuzzer::ExecuteCallback(unsigned char*, unsigned long) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:594:17 + #31 0x55c48f779444 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:21 + #32 0x55c48f7843ee in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char*, unsigned long)) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:885:19 + #33 0x55c48f7709d6 in main /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:30 + #34 0x7fe365788082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16 + #35 0x55c48f770a2d in _start (/root/bugs/metadata/xlnx_zynqmp_can-01/qemu-videzzo-aarch64-target-videzzo-fuzz-xlnx-zynqmp-can+0x3454a2d) + +NOTE: libFuzzer has rudimentary signal handlers. + Combine libFuzzer with AddressSanitizer or similar for better crash reports. +SUMMARY: libFuzzer: deadly signal +MS: 0 ; base unit: 0000000000000000000000000000000000000000 +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1428657 b/results/classifier/mode-deepseek-r1:32b/output/system/1428657 new file mode 100644 index 00000000..d647729c --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1428657 @@ -0,0 +1,72 @@ + + +qemu-system-arm does not ignore the lowest bit of pc when returning from interrrupt + +This was observed in qemu v2.1.3, running a sample app from + +FreeRTOS(FreeRTOSV7.5.2/FreeRTOS/Demo/CORTEX_LM3Sxxxx_Eclipse/RTOSDemo) + +In the sample code compiled with arm-none-eabi-gcc , version 4.8.2 (4.8.2-14ubuntu1+6) . + +qemu seems to be executing the wrong instrunction after returning from the SVCHandler. The svc handler changes the PSP register and the new stack contains an add return address, which should be allowed(http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.faqs/ka12545.html). The lowest bit of the address should be ignored, but it seems that qemu executes garbage after returning from the interrupt. + +qemu is run like this: + +qemu-system-arm -semihosting -machine lm3s6965evb -kernel RTOSDemo.axf -gdb tcp::1234 -S + + +this is the arm-gdb trace +Program received signal SIGINT, Interrupt. +IntDefaultHandler () at startup.c:231 +231 { +(gdb) bt +#0 IntDefaultHandler () at startup.c:231 +#1 0xfffffffc in ?? () + +(gdb) info registers +r0 0x0 0 +r1 0x14b4b4b4 347387060 +r2 0xa5a5a5a5 -1515870811 +r3 0xa5a5a53d -1515870915 +r4 0xa5a5a5a5 -1515870811 +r5 0xa5a5a5a5 -1515870811 +r6 0xa5a5a5a5 -1515870811 +r7 0x40d00542 1087374658 +r8 0xa5a5a5a5 -1515870811 +r9 0xa5a5a5a5 -1515870811 +r10 0xa5a5a5a5 -1515870811 +r11 0xa5a5a5a5 -1515870811 +r12 0xa5a5a5a5 -1515870811 +sp 0x20008380 0x20008380 +lr 0xfffffffd -3 +pc 0xc648 0xc648 <IntDefaultHandler> +cpsr 0x20000173 536871283 + +this exception occur after running SVC handler code + +(gdb) disassemble vPortSVCHandler +Dump of assembler code for function vPortSVCHandler: + 0x0000c24c <+0>: ldr r3, [pc, #24] ; (0xc268 <vPortSVCHandler+28>) + 0x0000c24e <+2>: ldr r1, [r3, #0] + 0x0000c250 <+4>: ldr r0, [r1, #0] + 0x0000c252 <+6>: ldmia.w r0!, {r4, r5, r6, r7, r8, r9, r10, r11} + 0x0000c256 <+10>: msr PSP, r0 + 0x0000c25a <+14>: mov.w r0, #0 + 0x0000c25e <+18>: msr BASEPRI, r0 + 0x0000c262 <+22>: orr.w lr, lr, #13 + 0x0000c266 <+26>: bx lr + 0x0000c268 <+28>: andcs r2, r0, r12, ror #5 +End of assembler dump. + +This stores this stack in PSP register: +(gdb) x /32 0x200052c8 +0x200052c8: 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 +0x200052d8: 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 +0x200052e8: 0x00000000 0x14b4b4b4 0xa5a5a5a5 0xa5a5a53d +0x200052f8: 0xa5a5a5a5 0x00000000 0x00003b49 0x21000000 +0x20005308: 0xa5a5a5a5 0xa5a5a5a5 0x200081b8 0x00000058 +0x20005318: 0x00000000 0x00000000 0x00000000 0x00000000 +0x20005328: 0x00000000 0x20005330 0xffffffff 0x20005330 +0x20005338: 0x20005330 0x00000000 0x20005344 0xffffffff + +It seems that qemu actually executes 0x00003b49 after the interrupt, but it should execute 0x00003b48 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/143 b/results/classifier/mode-deepseek-r1:32b/output/system/143 new file mode 100644 index 00000000..214b299c --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/143 @@ -0,0 +1,3 @@ + + +xhci HCIVERSION register read emulation incorrectly handled diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1430 b/results/classifier/mode-deepseek-r1:32b/output/system/1430 new file mode 100644 index 00000000..79730ad1 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1430 @@ -0,0 +1,112 @@ + + +Underflow in xlnx_dp_aux_push_rx_fifo() +Description of problem: +Pop two times from s->tx_fifo[2] but there is one element left. Since the fifo +is not empty, the check at [1] will fail. + +``` +static void xilinx_spips_flush_txfifo(XilinxSPIPS *s) +{ + // ... + for (;;) { + // ... + if (fifo8_is_empty(&s->tx_fifo)) { // ---------------> [1] + xilinx_spips_update_ixr(s); + return; + } else if (s->snoop_state == SNOOP_STRIPING || + s->snoop_state == SNOOP_NONE) { + for (i = 0; i < num_effective_busses(s); ++i) { + tx_rx[i] = fifo8_pop(&s->tx_fifo); // ---------> [2] + } + stripe8(tx_rx, num_effective_busses(s), false); + } else if (s->snoop_state >= SNOOP_ADDR) { + // ... +``` +Steps to reproduce: +``` +export QEMU=/path/to/qemu-system-aarch64 + +cat << EOF | $QEMU \ +-machine xlnx-zcu102 -monitor none -serial none \ +-display none -nodefaults -qtest stdio +writel 0xff0f00a0 0x74b13699 +readl 0xc1af068c +EOF +``` +Additional information: +``` +==64457==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases! +INFO: found LLVMFuzzerCustomMutator (0x55f8037f3440). Disabling -len_control by default. +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1864808059 +INFO: Loaded 1 modules (600775 inline 8-bit counters): 600775 [0x55f806e06000, 0x55f806e98ac7), +INFO: Loaded 1 PC tables (600775 PCs): 600775 [0x55f8064dab90,0x55f806e05800), +/root/videzzo/videzzo_qemu/out-san/qemu-videzzo-aarch64-target-videzzo-fuzz-xlnx-zynqmp-qspips: Running 1 inputs 1 time(s) each. +INFO: Reading pre_seed_input if any ... +INFO: Executing pre_seed_input if any ... +Matching objects by name , *spi*, *lqspi* +This process will fuzz the following MemoryRegions: + * spi[0] (size 200) + * spi[0] (size 200) + * lqspi[0] (size 2000000) + * spi[0] (size 200) +This process will fuzz through the following interfaces: + * clock_step, EVENT_TYPE_CLOCK_STEP, 0xffffffff +0xffffffff, 255,255 + * spi, EVENT_TYPE_MMIO_READ, 0xff050000 +0x200, 1,4 + * spi, EVENT_TYPE_MMIO_WRITE, 0xff050000 +0x200, 1,4 + * spi, EVENT_TYPE_MMIO_READ, 0xff040000 +0x200, 1,4 + * spi, EVENT_TYPE_MMIO_WRITE, 0xff040000 +0x200, 1,4 + * spi, EVENT_TYPE_MMIO_READ, 0xff0f0000 +0x200, 1,4 + * spi, EVENT_TYPE_MMIO_WRITE, 0xff0f0000 +0x200, 1,4 + * lqspi, EVENT_TYPE_MMIO_READ, 0xc0000000 +0x2000000, 4,4 + * lqspi, EVENT_TYPE_MMIO_WRITE, 0xc0000000 +0x2000000, 4,4 +INFO: A corpus is not provided, starting from an empty corpus +#2 INITED cov: 3 ft: 4 corp: 1/1b exec/s: 0 rss: 509Mb +Running: /root/videzzo/videzzo_qemu/out-san/poc-qemu-videzzo-aarch64-target-videzzo-fuzz-xlnx-zynqmp-qspips-crash-a2dce6d03fde8dc9cb50fb0c8708f307ca93d7c2.minimized +qemu-videzzo-aarch64-target-videzzo-fuzz-xlnx-zynqmp-qspips: ../util/fifo8.c:62: uint8_t fifo8_pop(Fifo8 *): Assertion `fifo->num > 0' failed. +==64457== ERROR: libFuzzer: deadly signal + #0 0x55f7fecb90fe in __sanitizer_print_stack_trace /root/llvm-project/compiler-rt/lib/asan/asan_stack.cpp:86:3 + #1 0x55f7fec07d71 in fuzzer::PrintStackTrace() /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerUtil.cpp:210:38 + #2 0x55f7febe0ca6 in fuzzer::Fuzzer::CrashCallback() (.part.0) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:236:18 + #3 0x55f7febe0d72 in fuzzer::Fuzzer::CrashCallback() /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:208:1 + #4 0x55f7febe0d72 in fuzzer::Fuzzer::StaticCrashSignalCallback() /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:207:19 + #5 0x7f67ea63a41f (/lib/x86_64-linux-gnu/libpthread.so.0+0x1441f) + #6 0x7f67ea44c00a in __libc_signal_restore_set /build/glibc-SzIz7B/glibc-2.31/signal/../sysdeps/unix/sysv/linux/internal-signals.h:86:3 + #7 0x7f67ea44c00a in raise /build/glibc-SzIz7B/glibc-2.31/signal/../sysdeps/unix/sysv/linux/raise.c:48:3 + #8 0x7f67ea42b858 in abort /build/glibc-SzIz7B/glibc-2.31/stdlib/abort.c:79:7 + #9 0x7f67ea42b728 in __assert_fail_base /build/glibc-SzIz7B/glibc-2.31/assert/assert.c:92:3 + #10 0x7f67ea43cfd5 in __assert_fail /build/glibc-SzIz7B/glibc-2.31/assert/assert.c:101:3 + #11 0x55f803645699 in fifo8_pop /root/videzzo/videzzo_qemu/qemu/out-san/../util/fifo8.c:62:5 + #12 0x55f8009d1ded in xilinx_spips_flush_txfifo /root/videzzo/videzzo_qemu/qemu/out-san/../hw/ssi/xilinx_spips.c:623:28 + #13 0x55f8009dc092 in lqspi_load_cache /root/videzzo/videzzo_qemu/qemu/out-san/../hw/ssi/xilinx_spips.c:1194:9 + #14 0x55f8009da069 in lqspi_read /root/videzzo/videzzo_qemu/qemu/out-san/../hw/ssi/xilinx_spips.c:1231:5 + #15 0x55f80294a61a in memory_region_read_with_attrs_accessor /root/videzzo/videzzo_qemu/qemu/out-san/../softmmu/memory.c:464:9 + #16 0x55f802908961 in access_with_adjusted_size /root/videzzo/videzzo_qemu/qemu/out-san/../softmmu/memory.c:555:18 + #17 0x55f8029060d8 in memory_region_dispatch_read1 /root/videzzo/videzzo_qemu/qemu/out-san/../softmmu/memory.c:1431:16 + #18 0x55f802905468 in memory_region_dispatch_read /root/videzzo/videzzo_qemu/qemu/out-san/../softmmu/memory.c:1458:9 + #19 0x55f802983a6d in flatview_read_continue /root/videzzo/videzzo_qemu/qemu/out-san/../softmmu/physmem.c:2892:23 + #20 0x55f802985078 in flatview_read /root/videzzo/videzzo_qemu/qemu/out-san/../softmmu/physmem.c:2934:12 + #21 0x55f802984b38 in address_space_read_full /root/videzzo/videzzo_qemu/qemu/out-san/../softmmu/physmem.c:2947:18 + #22 0x55f7fecebb51 in address_space_read /root/videzzo/videzzo_qemu/qemu/include/exec/memory.h:2873:18 + #23 0x55f7fecebb51 in qemu_readl /root/videzzo/videzzo_qemu/qemu/out-san/../tests/qtest/videzzo/videzzo_qemu.c:1037:5 + #24 0x55f7fece9c16 in dispatch_mmio_read /root/videzzo/videzzo_qemu/qemu/out-san/../tests/qtest/videzzo/videzzo_qemu.c:1051:35 + #25 0x55f8037ee8bf in videzzo_dispatch_event /root/videzzo/videzzo.c:1140:5 + #26 0x55f8037e5c3d in __videzzo_execute_one_input /root/videzzo/videzzo.c:288:9 + #27 0x55f8037e59e4 in videzzo_execute_one_input /root/videzzo/videzzo.c:329:9 + #28 0x55f7fed0108c in videzzo_qemu /root/videzzo/videzzo_qemu/qemu/out-san/../tests/qtest/videzzo/videzzo_qemu.c:1520:12 + #29 0x55f8037f370b in LLVMFuzzerTestOneInput /root/videzzo/videzzo.c:1910:18 + #30 0x55f7febe1816 in fuzzer::Fuzzer::ExecuteCallback(unsigned char*, unsigned long) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:594:17 + #31 0x55f7febc4444 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:21 + #32 0x55f7febcf3ee in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char*, unsigned long)) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:885:19 + #33 0x55f7febbb9d6 in main /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:30 + #34 0x7f67ea42d082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16 + #35 0x55f7febbba2d in _start (/root/videzzo/videzzo_qemu/out-san/qemu-videzzo-aarch64-target-videzzo-fuzz-xlnx-zynqmp-qspips+0x3454a2d) + +NOTE: libFuzzer has rudimentary signal handlers. + Combine libFuzzer with AddressSanitizer or similar for better crash reports. +SUMMARY: libFuzzer: deadly signal +MS: 0 ; base unit: 0000000000000000000000000000000000000000 +0x1,0xd,0xa0,0x0,0xf,0xff,0x0,0x0,0x0,0x0,0x4,0x0,0x0,0x0,0x99,0x36,0xb1,0x74,0x0,0x0,0x0,0x0,0x0,0xe,0x8c,0x6,0xaf,0xc1,0x0,0x0,0x0,0x0,0x4,0x0,0x0,0x0, +\x01\x0d\xa0\x00\x0f\xff\x00\x00\x00\x00\x04\x00\x00\x00\x996\xb1t\x00\x00\x00\x00\x00\x0e\x8c\x06\xaf\xc1\x00\x00\x00\x00\x04\x00\x00\x00 +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1432103 b/results/classifier/mode-deepseek-r1:32b/output/system/1432103 new file mode 100644 index 00000000..1e94f2b4 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1432103 @@ -0,0 +1,5 @@ + + +error in x86 executable segment permission check + +When the code segment register (%cs) selects an executable segment with no read permission, mov instructions that read from the segment via %cs prefix can still succeed without causing a general protection error. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1433 b/results/classifier/mode-deepseek-r1:32b/output/system/1433 new file mode 100644 index 00000000..0286e9c6 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1433 @@ -0,0 +1,159 @@ + + +Abort in lan9118_16bit_mode_[read|write]() +Description of problem: +[read|write][w|l] are allowed but [read|write]b are not allowed when mode_16bit is enabled. +Steps to reproduce: +``` +export QEMU=/path/to/qemu-system-arm + +cat << EOF | $QEMU \ +-machine smdkc210 -monitor none -serial none \ +-display none -qtest stdio +readb 0x5000070 +EOF +``` +Additional information: +``` +==1940==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases! +INFO: found LLVMFuzzerCustomMutator (0x5654b8eede90). Disabling -len_control by default. +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3248453476 +INFO: Loaded 1 modules (601357 inline 8-bit counters): 601357 [0x5654bbdd8000, 0x5654bbe6ad0d), +INFO: Loaded 1 PC tables (601357 PCs): 601357 [0x5654bb4aa340,0x5654bbdd7410), +./qemu-videzzo-arm-target-videzzo-fuzz-lan9118: Running 1 inputs 1 time(s) each. +INFO: Reading pre_seed_input if any ... +INFO: Executing pre_seed_input if any ... +INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 4096 bytes +Matching objects by name , *lan9118-mmio* +This process will fuzz the following MemoryRegions: + * lan9118-mmio[0] (size 100) +This process will fuzz through the following interfaces: + * clock_step, EVENT_TYPE_CLOCK_STEP, 0xffffffff +0xffffffff, 255,255 + * lan9118-mmio, EVENT_TYPE_MMIO_READ, 0x5000000 +0x100, 1,4 + * lan9118-mmio, EVENT_TYPE_MMIO_WRITE, 0x5000000 +0x100, 1,4 +INFO: A corpus is not provided, starting from an empty corpus +#2 INITED cov: 3 ft: 4 corp: 1/1b exec/s: 0 rss: 221Mb +Running: ./crash-663e5408ee573b1e9d073c796ffbaaae9bd583cb +qemu: hardware error: lan9118_read: Bad size 0x1 + +CPU #0: +R00=00000000 R01=00000000 R02=00000000 R03=00000000 +R04=00000000 R05=00000000 R06=00000000 R07=00000000 +R08=00000000 R09=00000000 R10=00000000 R11=00000000 +R12=00000000 R13=00000000 R14=00000000 R15=00000000 +PSR=400001d3 -Z-- A svc32 +s00=00000000 s01=00000000 d00=0000000000000000 +s02=00000000 s03=00000000 d01=0000000000000000 +s04=00000000 s05=00000000 d02=0000000000000000 +s06=00000000 s07=00000000 d03=0000000000000000 +s08=00000000 s09=00000000 d04=0000000000000000 +s10=00000000 s11=00000000 d05=0000000000000000 +s12=00000000 s13=00000000 d06=0000000000000000 +s14=00000000 s15=00000000 d07=0000000000000000 +s16=00000000 s17=00000000 d08=0000000000000000 +s18=00000000 s19=00000000 d09=0000000000000000 +s20=00000000 s21=00000000 d10=0000000000000000 +s22=00000000 s23=00000000 d11=0000000000000000 +s24=00000000 s25=00000000 d12=0000000000000000 +s26=00000000 s27=00000000 d13=0000000000000000 +s28=00000000 s29=00000000 d14=0000000000000000 +s30=00000000 s31=00000000 d15=0000000000000000 +s32=00000000 s33=00000000 d16=0000000000000000 +s34=00000000 s35=00000000 d17=0000000000000000 +s36=00000000 s37=00000000 d18=0000000000000000 +s38=00000000 s39=00000000 d19=0000000000000000 +s40=00000000 s41=00000000 d20=0000000000000000 +s42=00000000 s43=00000000 d21=0000000000000000 +s44=00000000 s45=00000000 d22=0000000000000000 +s46=00000000 s47=00000000 d23=0000000000000000 +s48=00000000 s49=00000000 d24=0000000000000000 +s50=00000000 s51=00000000 d25=0000000000000000 +s52=00000000 s53=00000000 d26=0000000000000000 +s54=00000000 s55=00000000 d27=0000000000000000 +s56=00000000 s57=00000000 d28=0000000000000000 +s58=00000000 s59=00000000 d29=0000000000000000 +s60=00000000 s61=00000000 d30=0000000000000000 +s62=00000000 s63=00000000 d31=0000000000000000 +FPSCR: 00000000 +CPU #1: +R00=00000000 R01=00000000 R02=00000000 R03=00000000 +R04=00000000 R05=00000000 R06=00000000 R07=00000000 +R08=00000000 R09=00000000 R10=00000000 R11=00000000 +R12=00000000 R13=00000000 R14=00000000 R15=00000000 +PSR=400001d3 -Z-- A svc32 +s00=00000000 s01=00000000 d00=0000000000000000 +s02=00000000 s03=00000000 d01=0000000000000000 +s04=00000000 s05=00000000 d02=0000000000000000 +s06=00000000 s07=00000000 d03=0000000000000000 +s08=00000000 s09=00000000 d04=0000000000000000 +s10=00000000 s11=00000000 d05=0000000000000000 +s12=00000000 s13=00000000 d06=0000000000000000 +s14=00000000 s15=00000000 d07=0000000000000000 +s16=00000000 s17=00000000 d08=0000000000000000 +s18=00000000 s19=00000000 d09=0000000000000000 +s20=00000000 s21=00000000 d10=0000000000000000 +s22=00000000 s23=00000000 d11=0000000000000000 +s24=00000000 s25=00000000 d12=0000000000000000 +s26=00000000 s27=00000000 d13=0000000000000000 +s28=00000000 s29=00000000 d14=0000000000000000 +s30=00000000 s31=00000000 d15=0000000000000000 +s32=00000000 s33=00000000 d16=0000000000000000 +s34=00000000 s35=00000000 d17=0000000000000000 +s36=00000000 s37=00000000 d18=0000000000000000 +s38=00000000 s39=00000000 d19=0000000000000000 +s40=00000000 s41=00000000 d20=0000000000000000 +s42=00000000 s43=00000000 d21=0000000000000000 +s44=00000000 s45=00000000 d22=0000000000000000 +s46=00000000 s47=00000000 d23=0000000000000000 +s48=00000000 s49=00000000 d24=0000000000000000 +s50=00000000 s51=00000000 d25=0000000000000000 +s52=00000000 s53=00000000 d26=0000000000000000 +s54=00000000 s55=00000000 d27=0000000000000000 +s56=00000000 s57=00000000 d28=0000000000000000 +s58=00000000 s59=00000000 d29=0000000000000000 +s60=00000000 s61=00000000 d30=0000000000000000 +s62=00000000 s63=00000000 d31=0000000000000000 +FPSCR: 00000000 +==1940== ERROR: libFuzzer: deadly signal + #0 0x5654b48090fe in __sanitizer_print_stack_trace /root/llvm-project/compiler-rt/lib/asan/asan_stack.cpp:86:3 + #1 0x5654b4757d71 in fuzzer::PrintStackTrace() /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerUtil.cpp:210:38 + #2 0x5654b4730ca6 in fuzzer::Fuzzer::CrashCallback() (.part.0) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:236:18 + #3 0x5654b4730d72 in fuzzer::Fuzzer::CrashCallback() /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:208:1 + #4 0x5654b4730d72 in fuzzer::Fuzzer::StaticCrashSignalCallback() /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:207:19 + #5 0x7fb6db17941f (/lib/x86_64-linux-gnu/libpthread.so.0+0x1441f) + #6 0x7fb6daf8b00a in __libc_signal_restore_set /build/glibc-SzIz7B/glibc-2.31/signal/../sysdeps/unix/sysv/linux/internal-signals.h:86:3 + #7 0x7fb6daf8b00a in raise /build/glibc-SzIz7B/glibc-2.31/signal/../sysdeps/unix/sysv/linux/raise.c:48:3 + #8 0x7fb6daf6a858 in abort /build/glibc-SzIz7B/glibc-2.31/stdlib/abort.c:79:7 + #9 0x5654b483964a in __wrap_abort /root/videzzo/videzzo_qemu/qemu/build-san-6/../tests/qtest/videzzo/less_crashes_wrappers.c:24:12 + #10 0x5654b6a64d84 in hw_error /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/cpus.c:128:5 + #11 0x5654b5ac50c7 in lan9118_16bit_mode_read /root/videzzo/videzzo_qemu/qemu/build-san-6/../hw/net/lan9118.c:1319:5 + #12 0x5654b7ee045b in memory_region_read_accessor /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/memory.c:440:11 + #13 0x5654b7ea0761 in access_with_adjusted_size /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/memory.c:554:18 + #14 0x5654b7e9db2c in memory_region_dispatch_read1 /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/memory.c:1424:16 + #15 0x5654b7e9d268 in memory_region_dispatch_read /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/memory.c:1457:9 + #16 0x5654b7f1946d in flatview_read_continue /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/physmem.c:2892:23 + #17 0x5654b7f1aa78 in flatview_read /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/physmem.c:2934:12 + #18 0x5654b7f1a538 in address_space_read_full /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/physmem.c:2947:18 + #19 0x5654b483a7ea in address_space_read /root/videzzo/videzzo_qemu/qemu/include/exec/memory.h:2869:18 + #20 0x5654b483a7ea in qemu_readb /root/videzzo/videzzo_qemu/qemu/build-san-6/../tests/qtest/videzzo/videzzo_qemu.c:1010:5 + #21 0x5654b483997e in dispatch_mmio_read /root/videzzo/videzzo_qemu/qemu/build-san-6/../tests/qtest/videzzo/videzzo_qemu.c:1034:35 + #22 0x5654b8ee984f in videzzo_dispatch_event /root/videzzo/videzzo.c:1122:5 + #23 0x5654b8ee0bcb in __videzzo_execute_one_input /root/videzzo/videzzo.c:272:9 + #24 0x5654b8ee0aa0 in videzzo_execute_one_input /root/videzzo/videzzo.c:313:9 + #25 0x5654b48500fc in videzzo_qemu /root/videzzo/videzzo_qemu/qemu/build-san-6/../tests/qtest/videzzo/videzzo_qemu.c:1497:12 + #26 0x5654b8eee132 in LLVMFuzzerTestOneInput /root/videzzo/videzzo.c:1891:18 + #27 0x5654b4731816 in fuzzer::Fuzzer::ExecuteCallback(unsigned char*, unsigned long) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:594:17 + #28 0x5654b4714444 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:21 + #29 0x5654b471f3ee in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char*, unsigned long)) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:885:19 + #30 0x5654b470b9d6 in main /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:30 + #31 0x7fb6daf6c082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16 + #32 0x5654b470ba2d in _start (/root/videzzo/videzzo_qemu/out-san/qemu-videzzo-arm-target-videzzo-fuzz-lan9118+0x300da2d) + +NOTE: libFuzzer has rudimentary signal handlers. + Combine libFuzzer with AddressSanitizer or similar for better crash reports. +SUMMARY: libFuzzer: deadly signal +MS: 0 ; base unit: 0000000000000000000000000000000000000000 +0x4,0x2,0x29,0x92,0xa,0x0,0x0,0x0,0x0,0x0,0x0,0x8,0x70,0x0,0x0,0x5,0x0,0x0,0x0,0x0,0x1,0x0,0x0,0x0,0x1,0x9,0x48,0x0,0x0,0x5,0x0,0x0,0x0,0x0,0x4,0x0,0x0,0x0,0x29,0x1f,0x8e,0x23,0x0,0x0,0x0,0x0, +\x04\x02)\x92\x0a\x00\x00\x00\x00\x00\x00\x08p\x00\x00\x05\x00\x00\x00\x00\x01\x00\x00\x00\x01\x09H\x00\x00\x05\x00\x00\x00\x00\x04\x00\x00\x00)\x1f\x8e#\x00\x00\x00\x00 +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1434 b/results/classifier/mode-deepseek-r1:32b/output/system/1434 new file mode 100644 index 00000000..78242424 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1434 @@ -0,0 +1,5 @@ + + +Windows on ARM64 host support +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1436 b/results/classifier/mode-deepseek-r1:32b/output/system/1436 new file mode 100644 index 00000000..dfface97 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1436 @@ -0,0 +1,63 @@ + + +Out of memory in hw/omap-dss for ARM +Description of problem: +In omap-dss, g_realloc() can allocate a large buffer using out of the memory. + +- [1] set pixels to any value +- [2] double pixels +- [3] allocate a large buffer + +``` +static void omap_rfbi_write(...) { + switch (addr) { + case 0x44: /* RFBI_PIXELCNT */ + s->rfbi.pixels = value; // ------------------------------------> [1] + break; + +static void omap_rfbi_transfer_start(struct omap_dss_s *s) { + len = s->rfbi.pixels * 2; // -------------------------------------> [2] + if (!data) { + if (len > bounce_len) { + bounce_buffer = g_realloc(bounce_buffer, len); // ---------> [3] + } +``` +Steps to reproduce: +``` +export QEMU=/path/to/qemu-system-arm + +cat << EOF | $QEMU \ +-machine n810,accel=qtest -m 128M -qtest stdio -monitor none -serial none \ +-display none -nodefaults -qtest stdio +writel 0x48050440 0x74a57907 +writel 0x48050858 0x34982d63 +writel 0x48050840 0x65a61a51 +EOF +``` +Additional information: +``` + +================================================================= +==1029323==ERROR: AddressSanitizer: requested allocation size 0xfffffffffffffffe (0x800 after adjustments for alignment, red zones etc.) exceeds maximum supported size of 0x10000000000 (thread T0) + #0 0x7f4650b4ec3e in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:163 + #1 0x7f464fa27f3f in g_realloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x57f3f) + #2 0x55cf6212c85b in omap_rfbi_write ../hw/display/omap_dss.c:761 + #3 0x55cf636b9c9b in memory_region_write_accessor ../softmmu/memory.c:493 + #4 0x55cf636ba132 in access_with_adjusted_size ../softmmu/memory.c:555 + #5 0x55cf636c76f8 in memory_region_dispatch_write ../softmmu/memory.c:1515 + #6 0x55cf637049b9 in flatview_write_continue ../softmmu/physmem.c:2825 + #7 0x55cf63704ddc in flatview_write ../softmmu/physmem.c:2867 + #8 0x55cf637057c4 in address_space_write ../softmmu/physmem.c:2963 + #9 0x55cf63716261 in qtest_process_command ../softmmu/qtest.c:533 + #10 0x55cf6371ac52 in qtest_process_inbuf ../softmmu/qtest.c:802 + #11 0x55cf6371ad43 in qtest_read ../softmmu/qtest.c:814 + #12 0x55cf63d4d5e5 in qemu_chr_be_write_impl ../chardev/char.c:201 + #13 0x55cf63d4d68c in qemu_chr_be_write ../chardev/char.c:213 + #14 0x55cf63d544c9 in fd_chr_read ../chardev/char-fd.c:72 + #15 0x55cf63938b9b in qio_channel_fd_source_dispatch ../io/channel-watch.c:84 + #16 0x7f464fa2204d in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5204d) + +==1029323==HINT: if you don't care about these errors you may set allocator_may_return_null=1 +SUMMARY: AddressSanitizer: allocation-size-too-big ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:163 in __interceptor_realloc +==1029323==ABORTING +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1437 b/results/classifier/mode-deepseek-r1:32b/output/system/1437 new file mode 100644 index 00000000..015db59c --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1437 @@ -0,0 +1,8 @@ + + +Nitrux doesn't finish boot process +Description of problem: +Boot process doesn't finish + +Steps to reproduce: +1.Load Nitrux ISO diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1437811 b/results/classifier/mode-deepseek-r1:32b/output/system/1437811 new file mode 100644 index 00000000..82fd743a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1437811 @@ -0,0 +1,9 @@ + + +target-tricore/op_helper.c:2576: bad if statement + +[qemu/target-tricore/op_helper.c:2576]: (style) Expression '(X & 0x400000) == 0x1' is always false. + + if ((env->PCXI & MASK_PCXI_UL) == 1) { + /* CTYP trap */ + } \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1438 b/results/classifier/mode-deepseek-r1:32b/output/system/1438 new file mode 100644 index 00000000..199b03ec --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1438 @@ -0,0 +1,9 @@ + + +Allow to use QEMU sockets as a CAN bus backend +Additional information: +Good possible example how it can be done is via UDP multicast in `python-can` library: +- https://python-can.readthedocs.io/en/master/interfaces/udp_multicast.html + +Another option, with less features is using a simple serial/character device like in: +- https://python-can.readthedocs.io/en/master/interfaces/serial.html diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1438144 b/results/classifier/mode-deepseek-r1:32b/output/system/1438144 new file mode 100644 index 00000000..9daa9edd --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1438144 @@ -0,0 +1,10 @@ + + +Page sizes are not interpreted correctly for E500/E500MC + +http://cache.freescale.com/files/32bit/doc/ref_manual/E500CORERM.pdf - see 2.12.5.2 MAS Register 1 (MAS1), p. 2-41 +http://cache.freescale.com/files/32bit/doc/ref_manual/E500MCRM.pdf - see 2.16.6.2 MAS Register 1 (MAS1), p. 2-54 + +According to these documents, variable page size for TLB1 is computed as 4K ** TSIZE. + +However, QEMU always treats it as if it was 1K << TSIZE, even if options like "-cpu e500mc" are supplied to qemu. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1440 b/results/classifier/mode-deepseek-r1:32b/output/system/1440 new file mode 100644 index 00000000..89996f15 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1440 @@ -0,0 +1,3 @@ + + +block/curl.c uses curl features deprecated in curl 7.55.0 and 7.85.0 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1440843 b/results/classifier/mode-deepseek-r1:32b/output/system/1440843 new file mode 100644 index 00000000..88c9fe06 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1440843 @@ -0,0 +1,16 @@ + + +Guest WinXP crashes when trying to use a USB spectrometer + +I'm using Amadeus spectrometer (OceanOptics USB250) via Windows-based software "Quantum". I've tried six ways of attaching it to QEMU: + +1. command line parameter "-device usb-host,hostbus=3,hostaddr=25" +2. command line parameter "-device usb-host,vendorid=0x2457,productid=0x1030" +3. command line parameter "-usbdevice host:2457:1030 +4. command line parameter "-usbdevice host:3.25" +5. qemu console command "usb_add host:2457:1030" +5. qemu console command "usb_add host:3.25" + +From these, only "-device ..." options work, i.e. numbers 1 and 2 in the list above, and all others lead to IRQL_NOT_LESS_OR_EQUAL BSOD in usbuhci.sys when I launch Quantum, which tries to start acquiring spectra. + +I've also tried to reproduce the crash with a flash drive, but couldn't — it seems to work reliably in this case. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1442 b/results/classifier/mode-deepseek-r1:32b/output/system/1442 new file mode 100644 index 00000000..8490bd97 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1442 @@ -0,0 +1,3 @@ + + +RISC-V qemu, get cpu tick diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1444 b/results/classifier/mode-deepseek-r1:32b/output/system/1444 new file mode 100644 index 00000000..49a031c8 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1444 @@ -0,0 +1,44 @@ + + +ld.so on aarch64 crashes (SIGSEGV) qemu-aarch64-static to verify attached executable +Description of problem: +I'm currently managing an automation to build a linux distribution from nothing. +The issues is when I try to cross compile gobject-introspection for aarch64 (it is currently working on arm) because the g-ir-compile phase requires a binary verification using ld-linux-aarch64-so-1 --verify GLib-2.0 process used by ldd, that crashes qemu-aarch64-static. +Original command is: ${SYSROOT}/lib/ld-linux-aarch64-so-1 --verify ${HOME}/builds/gobject-introspection_1.75.4/tmp-introspectnpyrhpje/GLib-2.0. +I simplified the problem bringing out the ld.so and GLib-2.0 binary to obtain the same result. + +This happens with glibc 2.35 and glibc 2.36 on aarch64 built with a gcc-12.2 cross compiler (x86 -> aarch64). + +[GLib-2.0](/uploads/47932b18278835fb13ef0de4c34872fa/GLib-2.0) + +[ld-linux-aarch64.so.1](/uploads/0ee01949285bea8ccfcebdc88a1d5b33/ld-linux-aarch64.so.1) + +I tried to debug the SIGSEGV but it's out completely out of my capacity. +Steps to reproduce: +1. Copy the 2 attached files in a directory: +2. Run: qemu-aarch64-static ./ld-linux-aarch64.so.1 --verify ./GLib-2.0 +3. Result: Segmentation fault. +Additional information: +I attach the output of gdb after install qemu debug symbols: + +``` +Thread 1 "qemu-aarch64-st" received signal SIGSEGV, Segmentation fault. +0x0000000000401088 in ?? () +(gdb) bt +#0 0x0000000000401088 in ?? () +#1 0x00000000006aa439 in g_malloc0 () +#2 0x000000000061bb4b in page_find_alloc (index=index@entry=1024, alloc=alloc@entry=1) + at ../accel/tcg/translate-all.c:494 +#3 0x000000000061db12 in page_set_flags (start=start@entry=4194304, end=end@entry=4206592, flags=9, flags@entry=73) + at ../accel/tcg/translate-all.c:2288 +#4 0x0000000000629f10 in target_mmap (start=<optimized out>, start@entry=4194304, len=<optimized out>, + len@entry=12288, target_prot=target_prot@entry=1, flags=2066, fd=fd@entry=3, offset=offset@entry=0) + at ../linux-user/mmap.c:629 +#5 0x0000000000641e1d in do_syscall1 (cpu_env=0x9e8c10, num=222, arg1=4194304, arg2=12288, arg3=1, + arg4=<optimized out>, arg5=3, arg6=0, arg8=<optimized out>, arg7=<optimized out>) at ../linux-user/syscall.c:9961 +#6 0x0000000000644c8c in do_syscall (cpu_env=cpu_env@entry=0x9e8c10, num=222, arg1=4194304, arg2=12288, arg3=1, + arg4=2066, arg5=3, arg6=0, arg7=0, arg8=0) at ../linux-user/syscall.c:13203 +#7 0x000000000040fca8 in cpu_loop (env=env@entry=0x9e8c10) at ../linux-user/aarch64/cpu_loop.c:93 +#8 0x000000000040267f in main (argc=<optimized out>, argv=0x7fffffffdfc8, envp=<optimized out>) + at ../linux-user/main.c:897 +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1446 b/results/classifier/mode-deepseek-r1:32b/output/system/1446 new file mode 100644 index 00000000..a8fee625 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1446 @@ -0,0 +1,177 @@ + + +Heap buffer overflow in nand_blk_write_512() +Description of problem: +I captured the negative-size-param (memcpy) in nand_blk_load_512() like below. + +``` +diff --git a/hw/block/nand.c b/hw/block/nand.c +index 8bc80e351..f68b23d05 100644 +--- a/hw/block/nand.c ++++ b/hw/block/nand.c +@@ -790,6 +790,10 @@ static void glue(nand_blk_load_, NAND_PAGE_SIZE)(NANDFlashState *s, + s->ioaddr = s->io + (PAGE_START(addr) & 0x1ff) + offset; + } + } else { ++ int size = NAND_PAGE_SIZE + OOB_SIZE - offset; ++ if (size < 0) { ++ return; ++ } + memcpy(s->io, s->storage + PAGE_START(s->addr) + + offset, NAND_PAGE_SIZE + OOB_SIZE - offset); + s->ioaddr = s->io; + +``` + +Then, I triggered an integer overflow in nand_blk_write_512() resulting in a +heap buffer overflow. Specifically, s->iolen is a signed integer[1], but based +on the function signature of mem_and(), s->iolen will be casted to an unsigned +integer[2]. Asan then captures a heap buffer overflow[3]. + +``` +static void glue(nand_blk_write_, NAND_PAGE_SIZE)(NANDFlashState *s) +{ + // ... + if (!s->blk) { + mem_and(s->storage + PAGE_START(s->addr) + (s->addr & PAGE_MASK) + + s->offset, s->io, s->iolen); // <--------------- [1] + } else if (s->mem_oob) { + // ... + +static void mem_and(uint8_t *dest, const uint8_t *src, size_t n) // <--- [2] +{ + int i; + for (i = 0; i < n; i++) { + dest[i] &= src[i]; // <----------------------------------------- [3] + } +} +``` +Steps to reproduce: +Please patch your hw/block/nand.c first. + +``` +export QEMU=/path/to/qemu-system-arm + +cat << EOF | $QEMU \ +-machine tosa -monitor none -serial none \ +-display none -qtest stdio +write 0x10000111 0x1 0xca +write 0x10000104 0x1 0x47 +write 0x1000ca04 0x1 0xd7 +write 0x1000ca01 0x1 0xe0 +write 0x1000ca04 0x1 0x71 +write 0x1000ca00 0x1 0x50 +write 0x1000ca04 0x1 0xd7 +read 0x1000ca02 0x1 +write 0x1000ca01 0x1 0x10 +EOF +``` +Additional information: +``` +==15750==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases! +INFO: found LLVMFuzzerCustomMutator (0x560e65814d70). Disabling -len_control by default. +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 4218744906 +INFO: Loaded 1 modules (601336 inline 8-bit counters): 601336 [0x560e68702000, 0x560e68794cf8), +INFO: Loaded 1 PC tables (601336 PCs): 601336 [0x560e67dd42a0,0x560e68701220), +/root/videzzo/videzzo_qemu/out-san/qemu-videzzo-arm-target-videzzo-fuzz-tc6393xb: Running 1 inputs 1 time(s) each. +INFO: Reading pre_seed_input if any ... +INFO: Executing pre_seed_input if any ... +Matching objects by name , *tc6393xb* +This process will fuzz the following MemoryRegions: + * tc6393xb.vram[0] (size 100000) + * tc6393xb[0] (size 10000) +This process will fuzz through the following interfaces: + * clock_step, EVENT_TYPE_CLOCK_STEP, 0xffffffff +0xffffffff, 255,255 + * tc6393xb.vram, EVENT_TYPE_MMIO_READ, 0x10100000 +0x100000, 1,4 + * tc6393xb.vram, EVENT_TYPE_MMIO_WRITE, 0x10100000 +0x100000, 1,4 + * tc6393xb, EVENT_TYPE_MMIO_READ, 0x10000000 +0x10000, 1,1 + * tc6393xb, EVENT_TYPE_MMIO_WRITE, 0x10000000 +0x10000, 1,1 +INFO: A corpus is not provided, starting from an empty corpus +#2 INITED cov: 3 ft: 4 corp: 1/1b exec/s: 0 rss: 281Mb +Running: /root/videzzo/videzzo_qemu/out-san/poc-qemu-videzzo-arm-target-videzzo-fuzz-tc6393xb-crash-35f3f537422c4e74ce65177b3d6369045e60b47f.minimized +================================================================= +==15750==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61f000000de0 at pc 0x560e61557210 bp 0x7ffcfc4a59f0 sp 0x7ffcfc4a59e8 +READ of size 1 at 0x61f000000de0 thread T0 + #0 0x560e6155720f in mem_and /root/videzzo/videzzo_qemu/qemu/build-san-6/../hw/block/nand.c:101:20 + #1 0x560e6155ac9c in nand_blk_write_512 /root/videzzo/videzzo_qemu/qemu/build-san-6/../hw/block/nand.c:663:9 + #2 0x560e61544200 in nand_command /root/videzzo/videzzo_qemu/qemu/build-san-6/../hw/block/nand.c:293:13 + #3 0x560e6153cc83 in nand_setio /root/videzzo/videzzo_qemu/qemu/build-san-6/../hw/block/nand.c:520:13 + #4 0x560e61a0a69e in tc6393xb_nand_writeb /root/videzzo/videzzo_qemu/qemu/build-san-6/../hw/display/tc6393xb.c:380:13 + #5 0x560e619f9bf7 in tc6393xb_writeb /root/videzzo/videzzo_qemu/qemu/build-san-6/../hw/display/tc6393xb.c:524:9 + #6 0x560e647c7d03 in memory_region_write_accessor /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/memory.c:492:5 + #7 0x560e647c7641 in access_with_adjusted_size /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/memory.c:554:18 + #8 0x560e647c5f66 in memory_region_dispatch_write /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/memory.c:1514:16 + #9 0x560e6485409e in flatview_write_continue /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/physmem.c:2825:23 + #10 0x560e648421eb in flatview_write /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/physmem.c:2867:12 + #11 0x560e64841ca8 in address_space_write /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/physmem.c:2963:18 + #12 0x560e61170162 in qemu_writeb /root/videzzo/videzzo_qemu/qemu/build-san-6/../tests/qtest/videzzo/videzzo_qemu.c:1080:5 + #13 0x560e6116eef7 in dispatch_mmio_write /root/videzzo/videzzo_qemu/qemu/build-san-6/../tests/qtest/videzzo/videzzo_qemu.c:1227:28 + #14 0x560e6581072f in videzzo_dispatch_event /root/videzzo/videzzo.c:1122:5 + #15 0x560e65807aab in __videzzo_execute_one_input /root/videzzo/videzzo.c:272:9 + #16 0x560e65807980 in videzzo_execute_one_input /root/videzzo/videzzo.c:313:9 + #17 0x560e611780fc in videzzo_qemu /root/videzzo/videzzo_qemu/qemu/build-san-6/../tests/qtest/videzzo/videzzo_qemu.c:1504:12 + #18 0x560e65815012 in LLVMFuzzerTestOneInput /root/videzzo/videzzo.c:1891:18 + #19 0x560e61059816 in fuzzer::Fuzzer::ExecuteCallback(unsigned char*, unsigned long) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:594:17 + #20 0x560e6103c444 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:21 + #21 0x560e610473ee in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char*, unsigned long)) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:885:19 + #22 0x560e610339d6 in main /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:30 + #23 0x7f79587d0082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16 + #24 0x560e61033a2d in _start (/root/videzzo/videzzo_qemu/out-san/qemu-videzzo-arm-target-videzzo-fuzz-tc6393xb+0x300fa2d) + +0x61f000000de0 is located 0 bytes to the right of 3424-byte region [0x61f000000080,0x61f000000de0) +allocated by thread T0 here: + #0 0x560e611276cf in malloc /root/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x7f7959a87e98 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x57e98) + #2 0x560e64b98871 in object_new /root/videzzo/videzzo_qemu/qemu/build-san-6/../qom/object.c:749:12 + #3 0x560e64b5d1a1 in qdev_new /root/videzzo/videzzo_qemu/qemu/build-san-6/../hw/core/qdev.c:153:19 + #4 0x560e61547ea5 in nand_init /root/videzzo/videzzo_qemu/qemu/build-san-6/../hw/block/nand.c:639:11 + #5 0x560e619f8772 in tc6393xb_init /root/videzzo/videzzo_qemu/qemu/build-san-6/../hw/display/tc6393xb.c:558:16 + #6 0x560e6390bad2 in tosa_init /root/videzzo/videzzo_qemu/qemu/build-san-6/../hw/arm/tosa.c:250:12 + #7 0x560e61730887 in machine_run_board_init /root/videzzo/videzzo_qemu/qemu/build-san-6/../hw/core/machine.c:1400:5 + #8 0x560e633bdd5b in qemu_init_board /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/vl.c:2485:5 + #9 0x560e633bda6c in qmp_x_exit_preconfig /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/vl.c:2581:5 + #10 0x560e633c4fef in qemu_init /root/videzzo/videzzo_qemu/qemu/build-san-6/../softmmu/vl.c:3584:9 + #11 0x560e611763f3 in LLVMFuzzerInitialize /root/videzzo/videzzo_qemu/qemu/build-san-6/../tests/qtest/videzzo/videzzo_qemu.c:1761:5 + #12 0x560e61043fab in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char*, unsigned long)) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:664:29 + #13 0x560e610339d6 in main /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:30 + #14 0x7f79587d0082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16 + +SUMMARY: AddressSanitizer: heap-buffer-overflow /root/videzzo/videzzo_qemu/qemu/build-san-6/../hw/block/nand.c:101:20 in mem_and +Shadow bytes around the buggy address: + 0x0c3e7fff8160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c3e7fff8170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c3e7fff8180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c3e7fff8190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c3e7fff81a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c3e7fff81b0: 00 00 00 00 00 00 00 00 00 00 00 00[fa]fa fa fa + 0x0c3e7fff81c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c3e7fff81d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c3e7fff81e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c3e7fff81f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c3e7fff8200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==15750==ABORTING +MS: 0 ; base unit: 0000000000000000000000000000000000000000 +0x1,0xb,0x12,0x1,0x0,0x10,0x0,0x0,0x0,0x0,0x1,0x0,0x0,0x0,0xca,0x4f,0x4d,0x5f,0x0,0x0,0x0,0x0,0x1,0xb,0x4,0x1,0x0,0x10,0x0,0x0,0x0,0x0,0x1,0x0,0x0,0x0,0x47,0xf0,0xc8,0x58,0x0,0x0,0x0,0x0,0x1,0xb,0x4,0xa1,0x0,0x10,0x0,0x0,0x0,0x0,0x1,0x0,0x0,0x0,0xd7,0x38,0xfc,0x29,0x0,0x0,0x0,0x0,0x1,0xb,0x1,0x9a,0x0,0x10,0x0,0x0,0x0,0x0,0x1,0x0,0x0,0x0,0xe0,0xb0,0x63,0x62,0x0,0x0,0x0,0x0,0x1,0xb,0x4,0x8a,0x0,0x10,0x0,0x0,0x0,0x0,0x1,0x0,0x0,0x0,0x71,0xaa,0x20,0x60,0x0,0x0,0x0,0x0,0x1,0xb,0x0,0x5,0x0,0x10,0x0,0x0,0x0,0x0,0x1,0x0,0x0,0x0,0x50,0x9f,0x0,0x40,0x0,0x0,0x0,0x0,0x1,0xb,0x4,0xa1,0x0,0x10,0x0,0x0,0x0,0x0,0x1,0x0,0x0,0x0,0xd7,0x38,0xfc,0x29,0x0,0x0,0x0,0x0,0x0,0xa,0x2,0x24,0x0,0x10,0x0,0x0,0x0,0x0,0x1,0x0,0x0,0x0,0x1,0xb,0x1,0xc5,0x0,0x10,0x0,0x0,0x0,0x0,0x1,0x0,0x0,0x0,0x10,0x8b,0x36,0x70,0x0,0x0,0x0,0x0, +\x01\x0b\x12\x01\x00\x10\x00\x00\x00\x00\x01\x00\x00\x00\xcaOM_\x00\x00\x00\x00\x01\x0b\x04\x01\x00\x10\x00\x00\x00\x00\x01\x00\x00\x00G\xf0\xc8X\x00\x00\x00\x00\x01\x0b\x04\xa1\x00\x10\x00\x00\x00\x00\x01\x00\x00\x00\xd78\xfc)\x00\x00\x00\x00\x01\x0b\x01\x9a\x00\x10\x00\x00\x00\x00\x01\x00\x00\x00\xe0\xb0cb\x00\x00\x00\x00\x01\x0b\x04\x8a\x00\x10\x00\x00\x00\x00\x01\x00\x00\x00q\xaa `\x00\x00\x00\x00\x01\x0b\x00\x05\x00\x10\x00\x00\x00\x00\x01\x00\x00\x00P\x9f\x00@\x00\x00\x00\x00\x01\x0b\x04\xa1\x00\x10\x00\x00\x00\x00\x01\x00\x00\x00\xd78\xfc)\x00\x00\x00\x00\x00\x0a\x02$\x00\x10\x00\x00\x00\x00\x01\x00\x00\x00\x01\x0b\x01\xc5\x00\x10\x00\x00\x00\x00\x01\x00\x00\x00\x10\x8b6p\x00\x00\x00\x00 +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1447 b/results/classifier/mode-deepseek-r1:32b/output/system/1447 new file mode 100644 index 00000000..bc9245d7 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1447 @@ -0,0 +1,9 @@ + + +riscv: reset_vec uses CSR even when disabled causing inability to boot +Steps to reproduce: +1. Run any rv32 binary with `./qemu-system-riscv32 -cpu rv32,d=off,f=off,Zicsr=off` + +To view using GDB use `./qemu-system-riscv32 -cpu rv32,d=off,f=off,Zicsr=off -S -s` +`gdb-multiarch --ex="target remote localhost:1234" -ex "layout asm"` +then type `si` till $pc jumps to zero on `csrr a0, mhartid` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1448985 b/results/classifier/mode-deepseek-r1:32b/output/system/1448985 new file mode 100644 index 00000000..1983ffd3 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1448985 @@ -0,0 +1,26 @@ + + +llvmpipe i386 crashes when running on qemu64 cpu + +I have installed Ubuntu 14.04.2 amd64 with all updates. +I have downloaded the Ubuntu 14.0.4.2 i386 iso (ubuntu-14.04.2-desktop-i386.iso, MD5SUM = a8a14f1f92c1ef35dae4966a2ae1a264). + +It does not boot to Unity from QEMU-KVM with the all following commands: +* sudo kvm -m 1536 -cdrom ubuntu-14.04.2-desktop-i386.iso +* sudo kvm -m 1536 -cdrom ubuntu-14.04.2-desktop-i386.iso -vga std +* sudo kvm -m 1536 -cdrom ubuntu-14.04.2-desktop-i386.iso -vga vmware + +ProblemType: Bug +DistroRelease: Ubuntu 14.04 +Package: qemu-kvm 2.0.0+dfsg-2ubuntu1.10 +ProcVersionSignature: Ubuntu 3.13.0-49.83-generic 3.13.11-ckt17 +Uname: Linux 3.13.0-49-generic x86_64 +NonfreeKernelModules: nvidia +ApportVersion: 2.14.1-0ubuntu3.10 +Architecture: amd64 +CurrentDesktop: Unity +Date: Mon Apr 27 14:11:31 2015 +InstallationDate: Installed on 2015-01-04 (112 days ago) +InstallationMedia: Ubuntu 14.04.1 LTS "Trusty Tahr" - Release amd64 (20140722.2) +SourcePackage: qemu +UpgradeStatus: No upgrade log present (probably fresh install) \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/145 b/results/classifier/mode-deepseek-r1:32b/output/system/145 new file mode 100644 index 00000000..8d9cde59 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/145 @@ -0,0 +1,3 @@ + + +Issues with qemu-img, libgfapi, and encryption at rest diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1450881 b/results/classifier/mode-deepseek-r1:32b/output/system/1450881 new file mode 100644 index 00000000..0a285c35 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1450881 @@ -0,0 +1,27 @@ + + +qemu-system-sparc MUTEX_HELD assert and libC lock errors + +Here I am cross-posting a comment I made on Artyom's blog. Atar responded that he "fixed these issues for some customers". I hoped that opening a bug to the opensource project might help develop the solution for the public domain. + +I now have a mostly-working Solaris 6 emulation, with great thanks to the valuable information in Artyom's blog, brezular.com, and the QEMU/Solaris 4.14 wikibook. + +setup detail; +QEMU (present git snapshot, reports --version 2.2.92) +-M SS-20, openboot/proprietary prom + +# uname -a +SunOS emu0 5.6 Generic_105181-33 sun4m sparc SUNW,SPARCstation-20 + +I continue to have a problem, which I have found others posted in blog comments, but have not seen a resolution yet. + +# /etc/init.d/init.dmi start +Run-time error, libC: +Trying to release a lock that was not acquired in this thread +(repeat above 1x) +Abort - core dumped + +as well as: +Assertion failed: MUTEX_HELD(&svc_mutex), file rpc/svc_run.c, line 766 + +which prints to the console periodically when "dmispd" is running. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1452062 b/results/classifier/mode-deepseek-r1:32b/output/system/1452062 new file mode 100644 index 00000000..7a702769 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1452062 @@ -0,0 +1,34 @@ + + +qemu-img will fail to convert images in 2.3.0 + +Hello guys, + + There seems to be a bug in qemu-img with 2.3.0 that wasn't there in 2.2.1 .... qemu convert will always fail converting. See the output below: + + +Started by upstream project "Create windows image" build number 73 +originally caused by: + Started by user anonymous +Building remotely on builder (builder lab) in workspace /var/lib/jenkins/remote/workspace/Prepare windows Image +[Prepare WS2008R2 Image] $ /bin/sh -xe /tmp/hudson4138890034689910617.sh ++ sudo bash -x /var/images/prepare_windows.sh WS2008R2 ++ set +x + +Preparing: windows +Virtio CD: virtio-win-0.1.96.iso + +Sparsifying... +qemu-img: error while compressing sector 11131648: Input/output error +virt-sparsify: error: external command failed: qemu-img convert -f +qcow2 -O 'qcow2' -c -o 'compat=0.10' '/tmp/sparsifyb459a0.qcow2' +'/var/images/generated/WS2008R2.qcow2' + +virt-sparsify: If reporting bugs, run virt-sparsify with debugging +enabled (-v) and include the complete output. +Build step 'Execute shell' marked build as failure +Warning: you have no plugins providing access control for builds, so falling back to legacy behavior of permitting any downstream builds to be triggered +Finished: FAILURE + +Thanks, +Dave \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1453 b/results/classifier/mode-deepseek-r1:32b/output/system/1453 new file mode 100644 index 00000000..ede80bb5 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1453 @@ -0,0 +1,3 @@ + + +Tricore: different definitions of pcxi register field diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1454 b/results/classifier/mode-deepseek-r1:32b/output/system/1454 new file mode 100644 index 00000000..1a111fcb --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1454 @@ -0,0 +1,64 @@ + + +QEMU TCG s390x fails an assertion while dispatching an FIXPT_DIVIDE exception on DR when compiled with LTO +Description of problem: +When running the attached minimal reproducer, with qemu-system-s390x version 7.2.0 compiled with LTO (`--enable-lto`) with GCC v12.2.1, QEMU fails an assertion and crashes: +``` +qemu-system-s390x: ../target/s390x/tcg/excp_helper.c:215: do_program_interrupt: Assertion `ilen == 2 || ilen == 4 || ilen == 6' failed. +Aborted (core dumped) +``` +Steps to reproduce: +1. Compile QEMU v7.2.0 for s390x with LTO enabled: + ``` + ../configure --target-list=s390x-softmmu --enable-lto + ``` +2. Compile the given reproducer assembler [lpswe-to-pgm.S](/uploads/200fb0e777ddd0ed26f51009e81c26ea/lpswe-to-pgm.S): + ``` + s390x-linux-gnu-gcc -march=z13 -m64 -nostdlib -nostartfiles -static -Wl,-Ttext=0 -Wl,--build-id=none lpswe-to-pgm.S -o lpswe-to-pgm + ``` +3. Execute QEMU on the reproducer: + ``` + ./qemu-system-s390x -kernel lpswe-to-pgm + ``` +Additional information: +I have debugged QEMU to try to find the root cause, and I believe I found it, but I'm not sure what the most appropriate way to fix it would be: + +QEMU executes the `DR` instruction by executing the `divs32` helper. + +When the helper sees that the final division result does not fit in 32 bits, it generates a program interrupt for fixed point divide by calling the `tcg_s390_program_interrupt` function, with the final parameter being the TCG host PC, which is found by calling `GETPC`. + +`tcg_s390_program_interrupt` then calls `cpu_restore_state`, and then as long as the host PC is valid, `cpu_restore_state` eventually calls `s390x_restore_state_to_opc` through a long chain of calls, which sets `CPUS390XState::int_pgm_ilen` to a valid value. + +Unfortunately when compiling with LTO, the host PC is not valid, which means we don't update `int_pgm_ilen`, resulting in the failed assertion. + +The reason the host PC is not valid when compiling with LTO, is that GCC decides to split `helper_divs32` into 2 parts, the actual div logic being the first part, and the call to `GETPC` & `tcg_s390_program_interrupt` being the second part. The way GCC implements it is by turning the second part into a separate function, which the first part calls - see disassembly below. (GCC then re-uses the second part in other similar TCG helpers) + +Because we now called the second part before calling `GETPC`, we have a new return address, and `GETPC` returns the address of the first part, instead of the TCG host PC. + +``` +000000000022c870 <helper_divs32>: + 22c870: 48 83 ec 08 sub rsp,0x8 + 22c874: 85 d2 test edx,edx + 22c876: 74 22 je 22c89a <helper_divs32+0x2a> + 22c878: 48 89 f0 mov rax,rsi + 22c87b: 48 63 ca movsxd rcx,edx + 22c87e: 48 99 cqo + 22c880: 48 f7 f9 idiv rcx + 22c883: 4c 63 c0 movsxd r8,eax + 22c886: 48 89 97 10 03 00 00 mov QWORD PTR [rdi+0x310],rdx + 22c88d: 49 39 c0 cmp r8,rax + 22c890: 75 17 jne 22c8a9 <helper_divs32+0x39> + 22c892: 4c 89 c0 mov rax,r8 + 22c895: 48 83 c4 08 add rsp,0x8 + 22c899: c3 ret + 22c89a: 48 8b 54 24 08 mov rdx,QWORD PTR [rsp+0x8] + 22c89f: be 09 00 00 00 mov esi,0x9 + 22c8a4: e8 47 e5 ff ff call 22adf0 <tcg_s390_program_interrupt> + 22c8a9: e8 b2 fe ff ff call 22c760 <helper_divs32.part.0> + +000000000022c760 <helper_divs32.part.0>: + 22c760: 48 83 ec 08 sub rsp,0x8 + 22c764: be 09 00 00 00 mov esi,0x9 + 22c769: 48 8b 54 24 08 mov rdx,QWORD PTR [rsp+0x8] + 22c76e: e8 7d e6 ff ff call 22adf0 <tcg_s390_program_interrupt> +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1455 b/results/classifier/mode-deepseek-r1:32b/output/system/1455 new file mode 100644 index 00000000..4d52ef62 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1455 @@ -0,0 +1,5 @@ + + +copy-paste not working +Description of problem: +copy-paste not working under Sway (wayland - wlroots) when I use `-display gtk`. This was broken recently. I have `spice-vdagent` as well as `spice-vdagentd` running properly in the guest, still copy-paste not working. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1460523 b/results/classifier/mode-deepseek-r1:32b/output/system/1460523 new file mode 100644 index 00000000..9410bf43 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1460523 @@ -0,0 +1,12 @@ + + +target-arm/op_helper.c:424: bad assert + +/home/dcb/qemu/trunk/qemu/target-arm/op_helper.c: In function ‘helper_access_check_cp_reg’: +/home/dcb/qemu/trunk/qemu/target-arm/op_helper.c:424:52: error: comparison of constant ‘3’ with boolean expression is always false [-Werror=bool-compare] + assert(!arm_is_secure(env) && !arm_current_el(env) == 3); + ^ + +Maybe + + assert(!arm_is_secure(env) && arm_current_el(env) != 3); \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1461 b/results/classifier/mode-deepseek-r1:32b/output/system/1461 new file mode 100644 index 00000000..cd70fdfa --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1461 @@ -0,0 +1,3 @@ + + +Virgl on Upstream windows builds? diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1467 b/results/classifier/mode-deepseek-r1:32b/output/system/1467 new file mode 100644 index 00000000..b1b5088e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1467 @@ -0,0 +1,3 @@ + + +guest agent file filtering diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1470536 b/results/classifier/mode-deepseek-r1:32b/output/system/1470536 new file mode 100644 index 00000000..6eb473e0 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1470536 @@ -0,0 +1,14 @@ + + +qemu-img incorrectly prints "qemu-img: Host floppy pass-through is deprecated" + +qemu-img incorrectly prints this warning when you use /dev/fd/<NN> to pass in file descriptors. A simple way to demonstrate this uses bash process substitution, so the following will only work if you are using bash as your shell: + +$ qemu-img info <( cat /dev/null ) +qemu-img: Host floppy pass-through is deprecated +Support for it will be removed in a future release. +qemu-img: Could not open '/dev/fd/63': Could not refresh total sector count: Illegal seek + +The root cause is a bug in block/raw-posix.c:floppy_probe_device() where it thinks anything starting with /dev/fd is a floppy drive, which is not the case here: + +http://git.qemu.org/?p=qemu.git;a=blob;f=block/raw-posix.c;h=cbe6574bf4da90a124436a40422dce3667da71e6;hb=HEAD#l2425 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1472 b/results/classifier/mode-deepseek-r1:32b/output/system/1472 new file mode 100644 index 00000000..085663b6 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1472 @@ -0,0 +1,7 @@ + + +Parameter 'sgx-epc.0.node' is unexpected +Description of problem: +qemu-system-x86_64: Parameter 'sgx-epc.0.node' is unexpected +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1473 b/results/classifier/mode-deepseek-r1:32b/output/system/1473 new file mode 100644 index 00000000..441047c8 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1473 @@ -0,0 +1,3 @@ + + +how to run qemu with sgx feature enabled diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1474 b/results/classifier/mode-deepseek-r1:32b/output/system/1474 new file mode 100644 index 00000000..5c7f375a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1474 @@ -0,0 +1,10 @@ + + +qemu stuck at creating vm when enabling sgx feature +Description of problem: +After execute the command line, qemu stucked. + + + + +After the info in the png, qemu clear the screen and then nothing happend. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1476 b/results/classifier/mode-deepseek-r1:32b/output/system/1476 new file mode 100644 index 00000000..8782feee --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1476 @@ -0,0 +1,3 @@ + + +Support for additional CMOS memory banks diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1478360 b/results/classifier/mode-deepseek-r1:32b/output/system/1478360 new file mode 100644 index 00000000..0c69214e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1478360 @@ -0,0 +1,134 @@ + + +Cant compile on ubuntu 14.04 x64 + +./configure --static +Install prefix /usr/local +BIOS directory /usr/local/share/qemu +binary directory /usr/local/bin +library directory /usr/local/lib +module directory /usr/local/lib/qemu +libexec directory /usr/local/libexec +include directory /usr/local/include +config directory /usr/local/etc +local state directory /usr/local/var +Manual directory /usr/local/share/man +ELF interp prefix /usr/gnemul/qemu-%M +Source path /home/slobodan/qemu +C compiler cc +Host C compiler cc +C++ compiler c++ +Objective-C compiler cc +ARFLAGS rv +CFLAGS -O2 -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -pthread -I/usr/include/glib-2.0 -I/usr/lib/x86_64-linux-gnu/glib-2.0/include -g +QEMU_CFLAGS -I/usr/include/pixman-1 -Werror -m64 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wall -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -fno-common -Wendif-labels -Wmissing-include-dirs -Wempty-body -Wnested-externs -Wformat-security -Wformat-y2k -Winit-self -Wignored-qualifiers -Wold-style-declaration -Wold-style-definition -Wtype-limits -fstack-protector-all -I/usr/include/p11-kit-1 -I/usr/include/libpng12 +LDFLAGS -Wl,--warn-common -m64 -static -g +make make +install install +python python -B +smbd /usr/sbin/smbd +module support no +host CPU x86_64 +host big endian no +target list aarch64-softmmu alpha-softmmu arm-softmmu cris-softmmu i386-softmmu lm32-softmmu m68k-softmmu microblaze-softmmu microblazeel-softmmu mips-softmmu mips64-softmmu mips64el-softmmu mipsel-softmmu moxie-softmmu or32-softmmu ppc-softmmu ppc64-softmmu ppcemb-softmmu s390x-softmmu sh4-softmmu sh4eb-softmmu sparc-softmmu sparc64-softmmu tricore-softmmu unicore32-softmmu x86_64-softmmu xtensa-softmmu xtensaeb-softmmu aarch64-linux-user alpha-linux-user arm-linux-user armeb-linux-user cris-linux-user i386-linux-user m68k-linux-user microblaze-linux-user microblazeel-linux-user mips-linux-user mips64-linux-user mips64el-linux-user mipsel-linux-user mipsn32-linux-user mipsn32el-linux-user or32-linux-user ppc-linux-user ppc64-linux-user ppc64abi32-linux-user ppc64le-linux-user s390x-linux-user sh4-linux-user sh4eb-linux-user sparc-linux-user sparc32plus-linux-user sparc64-linux-user unicore32-linux-user x86_64-linux-user +tcg debug enabled no +gprof enabled no +sparse enabled no +strip binaries yes +profiler no +static build yes +pixman system +SDL support no +GTK support yes +GNUTLS support yes +GNUTLS hash yes +GNUTLS gcrypt yes +GNUTLS nettle no () +VTE support no +curses support no +curl support no +mingw32 support no +Audio drivers oss +Block whitelist (rw) +Block whitelist (ro) +VirtFS support no +VNC support yes +VNC TLS support no +VNC SASL support no +VNC JPEG support yes +VNC PNG support yes +xen support no +brlapi support no +bluez support yes +Documentation no +GUEST_BASE yes +PIE no +vde support no +netmap support no +Linux AIO support no +ATTR/XATTR support yes +Install blobs yes +KVM support yes +RDMA support no +TCG interpreter no +fdt support yes +preadv support yes +fdatasync yes +madvise yes +posix_madvise yes +sigev_thread_id yes +uuid support yes +libcap-ng support no +vhost-net support yes +vhost-scsi support yes +Trace backends nop +spice support no +rbd support no +xfsctl support no +nss used no +libusb no +usb net redir no +OpenGL support no +libiscsi support no +libnfs support no +build guest agent yes +QGA VSS support no +QGA w32 disk info no +seccomp support no +coroutine backend ucontext +coroutine pool yes +GlusterFS support no +Archipelago support no +gcov gcov +gcov enabled no +TPM support yes +libssh2 support no +TPM passthrough yes +QOM debugging yes +vhdx yes +lzo support no +snappy support no +bzip2 support no +NUMA host support no +tcmalloc support no + +:~/qemu$ make + GEN config-host.h + GEN qemu-options.def + GEN qmp-commands.h + GEN qapi-types.h + GEN qapi-visit.h + GEN qapi-event.h + GEN trace/generated-events.h + GEN trace/generated-tracers.h + GEN trace/generated-tcg-tracers.h + GEN trace/generated-helpers-wrappers.h + GEN trace/generated-helpers.h + GEN tests/test-qapi-types.h + GEN tests/test-qapi-visit.h + GEN tests/test-qmp-commands.h + GEN tests/test-qapi-event.h + CC tests/qemu-iotests/socket_scm_helper.o + LINK tests/qemu-iotests/socket_scm_helper +c++: error: unrecognized command line option ‘-R’ +make: *** [tests/qemu-iotests/socket_scm_helper] Error 1 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1479 b/results/classifier/mode-deepseek-r1:32b/output/system/1479 new file mode 100644 index 00000000..53f1e593 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1479 @@ -0,0 +1,3 @@ + + +system/arm/cpu-features.html : text describing options is misrendered diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1480 b/results/classifier/mode-deepseek-r1:32b/output/system/1480 new file mode 100644 index 00000000..e85ddca9 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1480 @@ -0,0 +1,3 @@ + + +-cpu <whatever>,help should print the options available for that CPU type diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1481 b/results/classifier/mode-deepseek-r1:32b/output/system/1481 new file mode 100644 index 00000000..402a2fe9 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1481 @@ -0,0 +1,3 @@ + + +How to create Rootfs for sifive_u machine diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1483 b/results/classifier/mode-deepseek-r1:32b/output/system/1483 new file mode 100644 index 00000000..e3634810 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1483 @@ -0,0 +1,3 @@ + + +Failed to mount pmem device in qemu diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1484990 b/results/classifier/mode-deepseek-r1:32b/output/system/1484990 new file mode 100644 index 00000000..0affe4a8 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1484990 @@ -0,0 +1,21 @@ + + +fsfreeze-hook script should also ignored dpkg generated files + +Hello, + +In the fsfreeze-hook script, the following code check if some of the files should be ignored: + + +# Check whether file $1 is a backup or rpm-generated file and should be ignored +is_ignored_file() { + case "$1" in + *~ | *.bak | *.orig | *.rpmnew | *.rpmorig | *.rpmsave | *.sample) + return 0 ;; + esac + return 1 +} + +The functions should probably also skip dpkg generated files. + +I've found a list of the different extensions in the systemd source tree: https://github.com/systemd/systemd/blob/master/src/basic/util.c#L1871 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1486911 b/results/classifier/mode-deepseek-r1:32b/output/system/1486911 new file mode 100644 index 00000000..36a7dbe6 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1486911 @@ -0,0 +1,48 @@ + + +Error compilation qemu 2.3.1 on raspberry pi (RASPBIAN(debian)) + +When compiling from source occurs to me incomprehensible error. +Operation ./configure runs without problems, but among the logs make see this: + CP i386-softmmu / hw / i386 / acpi-dsdt.hex + CP i386-softmmu / hw / i386 / q35-acpi-dsdt.hex + CP i386-softmmu / hw / i386 / ssdt-tpm.hex + CC i386-softmmu / target-i386 / translate.o + CC m68k-softmmu / tcg / tcg-op.o + CC m68k-softmmu / tcg / optimize.o +In file included from /home/pi/Zagruzki/qemu-2.3.1/include/qapi/error.h:16:0, + from /home/pi/Zagruzki/qemu-2.3.1/include/qemu/option.h:31, + from /home/pi/Zagruzki/qemu-2.3.1/include/qemu-common.h:44, + from /home/pi/Zagruzki/qemu-2.3.1/tcg/optimize.c:31: +/home/pi/Zagruzki/qemu-2.3.1/qapi-types.h:196:8: error: unknown type name '$ uint64_t' +/home/pi/Zagruzki/qemu-2.3.1/rules.mak:57: Error the recipe for the purpose of «tcg / optimize.o» +make [1]: *** [tcg / optimize.o] Error 1 +Makefile: 173: error is the recipe for the purpose of «subdir-m68k-softmmu» +make: *** [subdir-m68k-softmmu] Error 2 +make: *** Waiting for jobs ... + +When you try to create a package using checkinstall is such error: +/home/pi/Zagruzki/qemu-2.3.1/target-mips/msa_helper.c: In function 'helper_msa_copy_s_df': +/home/pi/Zagruzki/qemu-2.3.1/target-mips/msa_helper.c:1269:1: error: unrecognizable insn: +(insn 123 122 124 3 (set (subreg: SI (reg: DI 169) 0) + (sign_extend: SI (mem / s / j: QI (plus: SI (reg: SI 167) + (const_int 440 [0x1b8])) [0 env_8 (D) -> active_fpu.fpr [ws_9 (D)]. wr.b S1 A8]))) /home/pi/Zagruzki/qemu-2.3.1/target- mips / msa_helper.c: 1253 -1 + (nil)) +/home/pi/Zagruzki/qemu-2.3.1/target-mips/msa_helper.c:1269:1: internal compiler error: in extract_insn, at recog.c: 2109 +Please submit a full bug report, +with preprocessed source if appropriate. +See <file: ///usr/share/doc/gcc-4.6/README.Bugs> for instructions. +Preprocessed source stored into /tmp/cc1quRqL.out file, please attach this to your bugreport. +/home/pi/Zagruzki/qemu-2.3.1/rules.mak:57: Error the recipe for the purpose of «target-mips / msa_helper.o» +make [1]: *** [target-mips / msa_helper.o] Error 1 +Makefile: 173: error is the recipe for the purpose of «subdir-mips64-softmmu» +make: *** [subdir-mips64-softmmu] Error 2 + +**** Installation unsuccessful. It cancels the creation of the package. + +Cleared ... OK + +Good luck. + +Log make, checkinstall from the terminal http://rghost.ru/7SK6y4bs6 +cc1quRqL.out applications \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1487 b/results/classifier/mode-deepseek-r1:32b/output/system/1487 new file mode 100644 index 00000000..408e4f6a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1487 @@ -0,0 +1,7 @@ + + +Mac OS X 10.4-10.6 i386/x86_64 not working on Apple Silicon +Description of problem: +Mac OS X panics early in the boot process. There are no issues using later versions of macOS or the PPC architecture +Steps to reproduce: +1. trying to boot 10.4/10.5/10.6 using i368/x86_64 emulation on apple silicon diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1491 b/results/classifier/mode-deepseek-r1:32b/output/system/1491 new file mode 100644 index 00000000..4304b781 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1491 @@ -0,0 +1,3 @@ + + +imx_epit will stop unexpectedly when couter rollover diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1492 b/results/classifier/mode-deepseek-r1:32b/output/system/1492 new file mode 100644 index 00000000..ee028ef0 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1492 @@ -0,0 +1,294 @@ + + +[coredump] [git master] qemu-x86_64 segfaults on ppc64le (4K page size) when trying to run android-studio inside chroot +Description of problem: +qemu-x86_64 segfaults when trying to run android-studio inside an Arch Linux x86_64 chroot from a Gentoo Linux ppc64le (4K page size) host. Hardware is a Raptor CS Talos 2 Power 9. +``` +[niko@talos2 ~]$ android-studio +/usr/bin/android-studio: line 200: 117922 Segmentation fault (core dumped) "$JAVA_BIN" -classpath "$CLASS_PATH" ${VM_OPTIONS} "-XX:ErrorFile=$HOME/java_error_in_studio_%p.log" "-XX:HeapDumpPath=$HOME/java_error_in_studio_.hprof" "-Djb.vmOptionsFile=${USER_VM_OPTIONS_FILE:-${VM_OPTIONS_FILE}}" ${IDE_PROPERTIES_PROPERTY} -Djava.system.class.loader=com.intellij.util.lang.PathClassLoader -Didea.strict.classpath=true -Didea.vendor.name=Google -Didea.paths.selector=AndroidStudio2022.1 -Didea.platform.prefix=AndroidStudio -Didea.jre.check=true -Dsplash=true com.intellij.idea.Main "$@" +``` +Steps to reproduce: +1. Create an Arch Linux chroot from a bootstrap tarball: https://wiki.archlinux.org/title/Install_Arch_Linux_from_existing_Linux#Method_A:_Using_the_bootstrap_tarball_(recommended) +2. Chroot into it using the following script: +``` +#!/bin/bash + +basedir="/home/niko/chroots/arch-x86_64" +cp /etc/resolv.conf ${basedir}/etc/ +cp /usr/bin/qemu-x86_64 ${basedir}/usr/bin/ +sed -i 's!#Server = http://archlinux.mirror.garr.it/archlinux/$repo/os/$arch!Server = http://archlinux.mirror.garr.it/archlinux/$repo/os/$a> +mount --make-slave --bind ${basedir} ${basedir} +mount -t proc none ${basedir}/proc +mount -t sysfs none ${basedir}/sys/ +mount --make-rslave --rbind /dev ${basedir}/dev +mount --make-rslave --rbind /run ${basedir}/run +chroot ${basedir} /bin/bash +sleep 3 +umount -R ${basedir}/run +umount -R ${basedir}/dev +umount ${basedir}/sys +umount ${basedir}/proc +umount ${basedir} +mount | grep chroots | grep arch-x86_64 | grep -v snap +``` +3. Initialize pacaman keyring and update system: +``` +# pacman-key --init +# pacman-key --populate +# pacman -Syu +``` +4. Install android-studio from the AUR (download `PKGBUILD` and run `makepkg -s`, finally install the package with `pacman -U <packagename>`): https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=android-studio +5. Create an unpriviledged account and run `android-studio` +6. Wait for the crash. +Additional information: +``` +Wed 2023-02-15 12:39:32 CET 117922 1000 1000 SIGSEGV present /home/niko/chroots/arch-x86_64/usr/bin/qemu-x86_64 > +talos2 ~ # coredumpctl gdb 117922 + PID: 117922 (java) + UID: 1000 (niko) + GID: 1000 (niko) + Signal: 11 (SEGV) + Timestamp: Wed 2023-02-15 12:39:25 CET (1min 47s ago) + Command Line: /usr/bin/qemu-x86_64 /opt/android-studio/jbr/bin/java -classpath /opt/android-studio/lib/util.jar:/opt/android-studio/lib/app.jar:/opt/android-studio/lib/3rd-party-rt.jar:/opt/android-studio/lib/jna.jar:/opt/android-studio/lib/platform-statistics-devkit.jar:/opt/android-studio/lib/jps-model.jar:/opt/android-studio/lib/rd-core.jar:/opt/android-studio/lib/rd-framework.jar:/opt/android-studio/lib/stats.jar:/opt/android-studio/lib/protobuf.jar:/opt/android-studio/lib/external-system-rt.jar:/opt/android-studio/lib/forms_rt.jar:/opt/android-studio/lib/intellij-test-discovery.jar:/opt/android-studio/lib/rd-swing.jar:/opt/android-studio/lib/annotations.jar:/opt/android-studio/lib/groovy.jar:/opt/android-studio/lib/annotations-java5.jar:/opt/android-studio/lib/byte-buddy-agent.jar:/opt/android-studio/lib/error-prone-annotations.jar:/opt/android-studio/lib/externalProcess-rt.jar:/opt/android-studio/lib/grpc-netty-shaded.jar:/opt/android-studio/lib/idea_rt.jar:/opt/android-studio/lib/intellij-coverage-agent-1.0.656.jar:/opt/android-studio/lib/junit.jar:/opt/android-studio/lib/junit4.jar:/opt/android-studio/lib/lz4-java.jar:/opt/android-studio/lib/platform-objectSerializer-annotations.jar:/opt/android-studio/lib/pty4j.jar:/opt/android-studio/lib/rd-text.jar:/opt/android-studio/lib/resources.jar:/opt/android-studio/lib/util_rt.jar:/opt/android-studio/lib/winp.jar:/opt/android-studio/lib/ant/lib/ant.jar:/opt/android-studio/lib/dbus-java-3.2.1.jar:/opt/android-studio/lib/java-utils-1.0.6.jar:/opt/android-studio/lib/jnr-unixsocket-0.23.jar:/opt/android-studio/lib/jnr-ffi-2.1.10.jar:/opt/android-studio/lib/jffi-1.2.19.jar:/opt/android-studio/lib/jffi-1.2.19-native.jar:/opt/android-studio/lib/asm-7.1.jar:/opt/android-studio/lib/asm-commons-7.1.jar:/opt/android-studio/lib/asm-analysis-7.1.jar:/opt/android-studio/lib/asm-tree-7.1.jar:/opt/android-studio/lib/asm-util-7.1.jar:/opt/android-studio/lib/jnr-a64asm-1.0.0.jar:/opt/android-studio/lib/jnr-x86asm-1.0.2.jar:/opt/android-studio/lib/jnr-constants-0.9.12.jar:/opt/android-studio/lib/jnr-enxio-0.21.jar:/opt/android-studio/lib/jnr-posix-3.0.50.jar -Xms256m -Xmx1280m -XX:ReservedCodeCacheSize=512m -XX:+IgnoreUnrecognizedVMOptions -XX:+UseG1GC -XX:SoftRefLRUPolicyMSPerMB=50 -XX:CICompilerCount=2 -XX:+HeapDumpOnOutOfMemoryError -XX:-OmitStackTraceInFastThrow -ea -Dsun.io.useCanonCaches=false $'-Djdk.http.auth.tunneling.disabledSchemes=""' -Djdk.attach.allowAttachSelf=true -Djdk.module.illegalAccess.silent=true -Djna.nosys=true -Djna.boot.library.path= -Didea.vendor.name=Google -Dkotlinx.coroutines.debug=off -Dsun.tools.attach.tmp.only=true -XX:ErrorFile=/home/niko/java_error_in_studio_%p.log -XX:HeapDumpPath=/home/niko/java_error_in_studio_.hprof -Djb.vmOptionsFile=/opt/android-studio/bin/studio64.vmoptions -Djava.system.class.loader=com.intellij.util.lang.PathClassLoader -Didea.strict.classpath=true -Didea.vendor.name=Google -Didea.paths.selector=AndroidStudio2022.1 -Didea.platform.prefix=AndroidStudio -Didea.jre.check=true -Dsplash=true com.intellij.idea.Main + Executable: /home/niko/chroots/arch-x86_64/usr/bin/qemu-x86_64 + Control Group: /user.slice/user-1000.slice/user@1000.service/session.slice/vte-spawn-a3a4897b-7df3-4b3e-a8fc-91898d4e7b51.scope + Unit: user@1000.service + User Unit: vte-spawn-a3a4897b-7df3-4b3e-a8fc-91898d4e7b51.scope + Slice: user-1000.slice + Owner UID: 1000 (niko) + Boot ID: 33cad872d21043ebbe3dd6581bdd28c6 + Machine ID: b3e834569b8ff461391f5ac061feb773 + Hostname: talos2 + Storage: /var/lib/systemd/coredump/core.java.1000.33cad872d21043ebbe3dd6581bdd28c6.117922.1676461165000000.zst (present) + Size on Disk: 226.7M + Message: Process 117922 (java) of user 1000 dumped core. + +GNU gdb (Gentoo 12.1 vanilla) 12.1 +Copyright (C) 2022 Free Software Foundation, Inc. +License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> +This is free software: you are free to change and redistribute it. +There is NO WARRANTY, to the extent permitted by law. +Type "show copying" and "show warranty" for details. +This GDB was configured as "powerpc64le-unknown-linux-gnu". +Type "show configuration" for configuration details. +For bug reporting instructions, please see: +<https://bugs.gentoo.org/>. +Find the GDB manual and other documentation resources online at: + <http://www.gnu.org/software/gdb/documentation/>. + +For help, type "help". +Type "apropos word" to search for commands related to "word"... +Reading symbols from /home/niko/chroots/arch-x86_64/usr/bin/qemu-x86_64... +BFD: warning: /var/tmp/coredump-R9M5K3: unsupported GNU_PROPERTY_TYPE (5) type: 0xc0000002 +BFD: warning: /var/tmp/coredump-R9M5K3: unsupported GNU_PROPERTY_TYPE (5) type: 0xc0010001 +BFD: warning: /var/tmp/coredump-R9M5K3: unsupported GNU_PROPERTY_TYPE (5) type: 0xc0010002 + +warning: Can't open file /opt/android-studio/jbr/bin/java during file-backed mapping note processing + +warning: Can't open file /usr/lib/ld-linux-x86-64.so.2 during file-backed mapping note processing + +warning: Can't open file /usr/lib/libpthread.so.0 during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/jbr/lib/jli/libjli.so during file-backed mapping note processing + +warning: Can't open file /usr/lib/libdl.so.2 during file-backed mapping note processing + +warning: Can't open file /usr/lib/libc.so.6 during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/jbr/lib/server/libjvm.so during file-backed mapping note processing + +warning: Can't open file /usr/lib/libm.so.6 during file-backed mapping note processing + +warning: Can't open file /usr/lib/librt.so.1 during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/jbr/lib/libverify.so during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/jbr/lib/libjava.so during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/jbr/lib/libjimage.so during file-backed mapping note processing + +warning: Can't open file /tmp/hsperfdata_niko/117922 during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/jbr/lib/libzip.so during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/jbr/lib/modules during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/jbr/lib/libnio.so during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/jbr/lib/libnet.so during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/lib/util.jar during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/lib/app.jar during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/lib/3rd-party-rt.jar during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/lib/jna.jar during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/lib/platform-statistics-devkit.jar during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/lib/jps-model.jar during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/lib/rd-core.jar during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/lib/rd-framework.jar during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/lib/stats.jar during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/lib/protobuf.jar during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/lib/external-system-rt.jar during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/lib/forms_rt.jar during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/lib/intellij-test-discovery.jar during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/lib/rd-swing.jar during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/lib/annotations.jar during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/lib/groovy.jar during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/lib/annotations-java5.jar during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/lib/byte-buddy-agent.jar during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/lib/error-prone-annotations.jar during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/lib/externalProcess-rt.jar during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/lib/grpc-netty-shaded.jar during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/lib/idea_rt.jar during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/lib/intellij-coverage-agent-1.0.656.jar during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/lib/junit.jar during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/lib/junit4.jar during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/lib/lz4-java.jar during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/lib/platform-objectSerializer-annotations.jar during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/lib/pty4j.jar during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/lib/rd-text.jar during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/lib/resources.jar during file-backed mapping note processing + +warning: Can't open file /opt/android-studio/lib/util_rt.jar during file-backed mapping note processing + +warning: core file may not match specified executable file. +[New LWP 117925] +[New LWP 117924] +[New LWP 117930] +[New LWP 117935] +[New LWP 117933] +[New LWP 117928] +[New LWP 117936] +[New LWP 117922] +[New LWP 117927] +[New LWP 117932] +[New LWP 117929] +[New LWP 117937] +[New LWP 117926] +[New LWP 117934] +[New LWP 117931] +[New LWP 117941] +[New LWP 117939] +[New LWP 117938] +[Thread debugging using libthread_db enabled] +Using host libthread_db library "/usr/lib64/libthread_db.so.1". +Core was generated by `/usr/bin/qemu-x86_64 /opt/android-studio/jbr/bin/java -classpath /opt/android-s'. +Program terminated with signal SIGSEGV, Segmentation fault. +#0 0x00000000102e1c68 in sigsuspend () +[Current thread is 1 (Thread 0x3fffbab18360 (LWP 117925))] +(gdb) info threads + Id Target Id Frame +* 1 Thread 0x3fffbab18360 (LWP 117925) 0x00000000102e1c68 in sigsuspend () + 2 Thread 0x3fffbb3cf360 (LWP 117924) 0x000000001033afec in syscall () + 3 Thread 0x3fffba9d3360 (LWP 117930) 0x000000001037df88 in __futex_abstimed_wait_cancelable64 () + 4 Thread 0x3fffba951360 (LWP 117935) safe_syscall_base () at ../common-user/host/ppc64/safe-syscall.inc.S:75 + 5 Thread 0x3fffba850360 (LWP 117933) safe_syscall_base () at ../common-user/host/ppc64/safe-syscall.inc.S:75 + 6 Thread 0x3fffbaa55360 (LWP 117928) safe_syscall_base () at ../common-user/host/ppc64/safe-syscall.inc.S:75 + 7 Thread 0x3fffba910360 (LWP 117936) 0x000000001037df88 in __futex_abstimed_wait_cancelable64 () + 8 Thread 0x409e2000 (LWP 117922) safe_syscall_base () at ../common-user/host/ppc64/safe-syscall.inc.S:75 + 9 Thread 0x3fffbaa96360 (LWP 117927) safe_syscall_base () at ../common-user/host/ppc64/safe-syscall.inc.S:75 + 10 Thread 0x3fffba891360 (LWP 117932) safe_syscall_base () at ../common-user/host/ppc64/safe-syscall.inc.S:75 + 11 Thread 0x3fffbaa14360 (LWP 117929) safe_syscall_base () at ../common-user/host/ppc64/safe-syscall.inc.S:75 + 12 Thread 0x3fffba60e360 (LWP 117937) 0x000000001037df88 in __futex_abstimed_wait_cancelable64 () + 13 Thread 0x3fffbaad7360 (LWP 117926) safe_syscall_base () at ../common-user/host/ppc64/safe-syscall.inc.S:75 + 14 Thread 0x3fffba992360 (LWP 117934) safe_syscall_base () at ../common-user/host/ppc64/safe-syscall.inc.S:75 + 15 Thread 0x3fffbabce360 (LWP 117931) 0x000000001037df88 in __futex_abstimed_wait_cancelable64 () + 16 Thread 0x3fffba7ce360 (LWP 117941) 0x000000001037df88 in __futex_abstimed_wait_cancelable64 () + 17 Thread 0x3fffba80f360 (LWP 117939) safe_syscall_base () at ../common-user/host/ppc64/safe-syscall.inc.S:75 + 18 Thread 0x3fffba5cd360 (LWP 117938) safe_syscall_base () at ../common-user/host/ppc64/safe-syscall.inc.S:75 +(gdb) thread 1 +[Switching to thread 1 (Thread 0x3fffbab18360 (LWP 117925))] +#0 0x00000000102e1c68 in sigsuspend () +(gdb) thread 2 +[Switching to thread 2 (Thread 0x3fffbb3cf360 (LWP 117924))] +#0 0x000000001033afec in syscall () +(gdb) thread 3 +[Switching to thread 3 (Thread 0x3fffba9d3360 (LWP 117930))] +#0 0x000000001037df88 in __futex_abstimed_wait_cancelable64 () +(gdb) thread 4 +[Switching to thread 4 (Thread 0x3fffba951360 (LWP 117935))] +#0 safe_syscall_base () at ../common-user/host/ppc64/safe-syscall.inc.S:75 +75 ../common-user/host/ppc64/safe-syscall.inc.S: No such file or directory. +(gdb) thread 5 +[Switching to thread 5 (Thread 0x3fffba850360 (LWP 117933))] +#0 safe_syscall_base () at ../common-user/host/ppc64/safe-syscall.inc.S:75 +75 in ../common-user/host/ppc64/safe-syscall.inc.S +(gdb) thread 6 +[Switching to thread 6 (Thread 0x3fffbaa55360 (LWP 117928))] +#0 safe_syscall_base () at ../common-user/host/ppc64/safe-syscall.inc.S:75 +75 in ../common-user/host/ppc64/safe-syscall.inc.S +(gdb) thread 7 +[Switching to thread 7 (Thread 0x3fffba910360 (LWP 117936))] +#0 0x000000001037df88 in __futex_abstimed_wait_cancelable64 () +(gdb) thread 8 +[Switching to thread 8 (Thread 0x409e2000 (LWP 117922))] +#0 safe_syscall_base () at ../common-user/host/ppc64/safe-syscall.inc.S:75 +75 in ../common-user/host/ppc64/safe-syscall.inc.S +(gdb) thread 9 +[Switching to thread 9 (Thread 0x3fffbaa96360 (LWP 117927))] +#0 safe_syscall_base () at ../common-user/host/ppc64/safe-syscall.inc.S:75 +75 in ../common-user/host/ppc64/safe-syscall.inc.S +(gdb) thread 10 +[Switching to thread 10 (Thread 0x3fffba891360 (LWP 117932))] +#0 safe_syscall_base () at ../common-user/host/ppc64/safe-syscall.inc.S:75 +75 in ../common-user/host/ppc64/safe-syscall.inc.S +(gdb) thread 11 +[Switching to thread 11 (Thread 0x3fffbaa14360 (LWP 117929))] +#0 safe_syscall_base () at ../common-user/host/ppc64/safe-syscall.inc.S:75 +75 in ../common-user/host/ppc64/safe-syscall.inc.S +(gdb) thread 12 +[Switching to thread 12 (Thread 0x3fffba60e360 (LWP 117937))] +#0 0x000000001037df88 in __futex_abstimed_wait_cancelable64 () +(gdb) thread 13 +[Switching to thread 13 (Thread 0x3fffbaad7360 (LWP 117926))] +#0 safe_syscall_base () at ../common-user/host/ppc64/safe-syscall.inc.S:75 +75 in ../common-user/host/ppc64/safe-syscall.inc.S +(gdb) thread 14 +[Switching to thread 14 (Thread 0x3fffba992360 (LWP 117934))] +#0 safe_syscall_base () at ../common-user/host/ppc64/safe-syscall.inc.S:75 +75 in ../common-user/host/ppc64/safe-syscall.inc.S +(gdb) thread 15 +[Switching to thread 15 (Thread 0x3fffbabce360 (LWP 117931))] +#0 0x000000001037df88 in __futex_abstimed_wait_cancelable64 () +(gdb) thread 16 +[Switching to thread 16 (Thread 0x3fffba7ce360 (LWP 117941))] +#0 0x000000001037df88 in __futex_abstimed_wait_cancelable64 () +(gdb) thread 17 +[Switching to thread 17 (Thread 0x3fffba80f360 (LWP 117939))] +#0 safe_syscall_base () at ../common-user/host/ppc64/safe-syscall.inc.S:75 +75 in ../common-user/host/ppc64/safe-syscall.inc.S +(gdb) thread 18 +[Switching to thread 18 (Thread 0x3fffba5cd360 (LWP 117938))] +#0 safe_syscall_base () at ../common-user/host/ppc64/safe-syscall.inc.S:75 +75 in ../common-user/host/ppc64/safe-syscall.inc.S +``` + +Download full coredump: https://drive.google.com/file/d/1t0Tm6-O6THrOFPp8uO-pbHqv8tZ6XWUe/view?usp=share_link diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1493 b/results/classifier/mode-deepseek-r1:32b/output/system/1493 new file mode 100644 index 00000000..46633844 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1493 @@ -0,0 +1,87 @@ + + +Devision by zero in uart_parameters_setup() +Description of problem: +s->r[R_BRGR] could be zero but there is no check[1]. + +``` +static void uart_parameters_setup(CadenceUARTState *s) +{ + QEMUSerialSetParams ssp; + unsigned int baud_rate, packet_size, input_clk; + input_clk = clock_get_hz(s->refclk); + + baud_rate = (s->r[R_MR] & UART_MR_CLKS) ? input_clk / 8 : input_clk; + baud_rate /= (s->r[R_BRGR] * (s->r[R_BDIV] + 1)); // ----> [1] +``` +Steps to reproduce: +Build with ASan. + +``` +export QEMU=/path/to/qemu-system-aarch64 + +cat << EOF | $QEMU \ +-machine xlnx-zcu102 -monitor none -serial none \ +-display none -nodefaults -qtest stdio +writel 0xff000018 0x12330000 +writew 0xff000004 0xbcc4 +EOF +``` +Additional information: +``` +==23==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases! +INFO: found LLVMFuzzerCustomMutator (0x55555d6bab70). Disabling -len_control by default. +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 4102190864 +INFO: Loaded 1 modules (603606 inline 8-bit counters): 603606 [0x555560d6e000, 0x555560e015d6), +INFO: Loaded 1 PC tables (603606 PCs): 603606 [0x5555604379b0,0x555560d6d710), +./qemu-videzzo-aarch64-target-videzzo-fuzz-cadence-uart: Running 1 inputs 1 time(s) each. +INFO: Reading pre_seed_input if any ... +INFO: Executing pre_seed_input if any ... +Matching objects by name , *uart* +This process will fuzz the following MemoryRegions: + * uart[0] (size 1000) + * uart[0] (size 1000) +This process will fuzz through the following interfaces: + * clock_step, EVENT_TYPE_CLOCK_STEP, 0xffffffff +0xffffffff, 255,255 + * uart, EVENT_TYPE_MMIO_READ, 0xff000000 +0x1000, 1,4 + * uart, EVENT_TYPE_MMIO_WRITE, 0xff000000 +0x1000, 1,4 + * uart, EVENT_TYPE_MMIO_READ, 0xff010000 +0x1000, 1,4 + * uart, EVENT_TYPE_MMIO_WRITE, 0xff010000 +0x1000, 1,4 +INFO: A corpus is not provided, starting from an empty corpus +#2 INITED cov: 3 ft: 4 corp: 1/1b exec/s: 0 rss: 512Mb +Running: ./poc-qemu-videzzo-aarch64-target-videzzo-fuzz-cadence-uart-crash-cef41ca061384b94899472d8e2e6b5a86b62d259.minimized +../hw/char/cadence_uart.c:181:15: runtime error: division by zero +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../hw/char/cadence_uart.c:181:15 in +AddressSanitizer:DEADLYSIGNAL +================================================================= +==23==ERROR: AddressSanitizer: FPE on unknown address 0x555558fee913 (pc 0x555558fee913 bp 0x7fffffffb5f0 sp 0x7fffffffb220 T0) + #0 0x555558fee913 in uart_parameters_setup /root/videzzo/videzzo_qemu/qemu/out-san/../hw/char/cadence_uart.c:181:15 + #1 0x555558fe8165 in uart_write /root/videzzo/videzzo_qemu/qemu/out-san/../hw/char/cadence_uart.c:471:9 + #2 0x55555c7bee3e in memory_region_write_with_attrs_accessor /root/videzzo/videzzo_qemu/qemu/out-san/../softmmu/memory.c:514:12 + #3 0x55555c7be051 in access_with_adjusted_size /root/videzzo/videzzo_qemu/qemu/out-san/../softmmu/memory.c:555:18 + #4 0x55555c7bcd1e in memory_region_dispatch_write /root/videzzo/videzzo_qemu/qemu/out-san/../softmmu/memory.c:1522:13 + #5 0x55555c84ce1e in flatview_write_continue /root/videzzo/videzzo_qemu/qemu/out-san/../softmmu/physmem.c:2826:23 + #6 0x55555c83abcb in flatview_write /root/videzzo/videzzo_qemu/qemu/out-san/../softmmu/physmem.c:2868:12 + #7 0x55555c83a688 in address_space_write /root/videzzo/videzzo_qemu/qemu/out-san/../softmmu/physmem.c:2964:18 + #8 0x555558b3e91e in qemu_writew /root/videzzo/videzzo_qemu/qemu/out-san/../tests/qtest/videzzo/videzzo_qemu.c:1101:5 + #9 0x555558b3d173 in dispatch_mmio_write /root/videzzo/videzzo_qemu/qemu/out-san/../tests/qtest/videzzo/videzzo_qemu.c:1253:28 + #10 0x55555d6b5fef in videzzo_dispatch_event /root/videzzo/videzzo.c:1140:5 + #11 0x55555d6ad36d in __videzzo_execute_one_input /root/videzzo/videzzo.c:288:9 + #12 0x55555d6ad114 in videzzo_execute_one_input /root/videzzo/videzzo.c:329:9 + #13 0x555558b4646c in videzzo_qemu /root/videzzo/videzzo_qemu/qemu/out-san/../tests/qtest/videzzo/videzzo_qemu.c:1530:12 + #14 0x55555d6bae3b in LLVMFuzzerTestOneInput /root/videzzo/videzzo.c:1910:18 + #15 0x555558a26bf6 in fuzzer::Fuzzer::ExecuteCallback(unsigned char*, unsigned long) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:594:17 + #16 0x555558a09824 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:21 + #17 0x555558a147ce in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char*, unsigned long)) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:885:19 + #18 0x555558a00db6 in main /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:30 + #19 0x7ffff607a082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16 + #20 0x555558a00e0d in _start (/root/bugs/metadata/cadence_uart-00/qemu-videzzo-aarch64-target-videzzo-fuzz-cadence-uart+0x34ace0d) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: FPE /root/videzzo/videzzo_qemu/qemu/out-san/../hw/char/cadence_uart.c:181:15 in uart_parameters_setup +==23==ABORTING +MS: 0 ; base unit: 0000000000000000000000000000000000000000 +0x1,0x9,0x18,0x0,0x0,0xff,0x0,0x0,0x0,0x0,0x4,0x0,0x0,0x0,0x0,0x0,0x33,0x12,0x0,0x0,0x0,0x0,0x1,0x9,0x4,0x0,0x0,0xff,0x0,0x0,0x0,0x0,0x2,0x0,0x0,0x0,0xc4,0xbc,0x4e,0x4c,0x0,0x0,0x0,0x0, +\x01\x09\x18\x00\x00\xff\x00\x00\x00\x00\x04\x00\x00\x00\x00\x003\x12\x00\x00\x00\x00\x01\x09\x04\x00\x00\xff\x00\x00\x00\x00\x02\x00\x00\x00\xc4\xbcNL\x00\x00\x00\x00 +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1497 b/results/classifier/mode-deepseek-r1:32b/output/system/1497 new file mode 100644 index 00000000..f83c88d4 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1497 @@ -0,0 +1,5 @@ + + +no documentation on plugins with mem_cb in their name +Additional information: +I'm especially interested in how vector ops under mask report their memory traffic diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1497479 b/results/classifier/mode-deepseek-r1:32b/output/system/1497479 new file mode 100644 index 00000000..14df5801 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1497479 @@ -0,0 +1,25 @@ + + +memory corruption with migrate/savevm in TCG mode + +[ISSUE] + +QEMU releases 2.3.1 and lower are forgetting to flush TLBs before enabling the global dirty pages log and entering the final stage of saving the VM. + +[DESCRIPTION] + +The situation is the following: +1. TLB misses is the only way for page dirtying in the TCG mode. +2. If TLB is hit by a running VM during the execution of the `ram_save_iterate' by migration thread (e.g. if VM is mostly idling) then some pages are missing in the dirty log. +3. These pages are then not migrated during `ram_save_complete'. +4. This makes memory content in a saved VM state differ from the actual VM memory. +5. If the affected area includes some Kernel data structures such as trees or lists this can cause Kernel to Oops after loading the saved state. + +[SOLUTION] + +A proposed solution is to flush TLB when `log_global_start' is called. +Here is the patch: https://bugs.launchpad.net/ubuntu/+source/qemu/+bug/1493049/+attachment/4459905/+files/tcg-commit-on-log-global-start.patch + +[LINKS] + +Ubuntu bug: https://bugs.launchpad.net/ubuntu/+source/qemu/+bug/1493049 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1498144 b/results/classifier/mode-deepseek-r1:32b/output/system/1498144 new file mode 100644 index 00000000..edaff340 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1498144 @@ -0,0 +1,31 @@ + + + Failure booting hurd with qemu-system-i386 on ARM + +Trying to boot debian-hurd-20150320.img ends with: + +qemu-system-i386: qemu-coroutine-lock.c:91: qemu_co_queue_restart_all: Assertion `qemu_in_coroutine()' failed. + +Program received signal SIGABRT, Aborted. +__libc_do_syscall () + at ../ports/sysdeps/unix/sysv/linux/arm/libc-do-syscall.S:44 +44 ../ports/sysdeps/unix/sysv/linux/arm/libc-do-syscall.S: No such file or directory. +(gdb) bt +#0 __libc_do_syscall () + at ../ports/sysdeps/unix/sysv/linux/arm/libc-do-syscall.S:44 +#1 0xb6ef8f0e in __GI_raise (sig=sig@entry=6) + at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 +#2 0xb6efb766 in __GI_abort () at abort.c:89 +#3 0xb6ef4150 in __assert_fail_base ( + fmt=0x1 <error: Cannot access memory at address 0x1>, + assertion=0x7f89a234 "qemu_in_coroutine()", assertion@entry=0x0, + file=0x7f89da58 "qemu-coroutine-lock.c", file@entry=0xb5660000 "\001", + line=91, line@entry=3069931692, + function=function@entry=0x7f89ab78 "qemu_co_queue_restart_all") + at assert.c:92 +#4 0xb6ef41e6 in __GI___assert_fail (assertion=0x0, file=0xb5660000 "\001", + line=3069931692, function=0x7f89ab78 "qemu_co_queue_restart_all") + at assert.c:101 +#5 0x7f59a6b4 in ?? () + +I was using the same setup as in Bug 893208 (i.e git checkout from 2015-09-15) \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/150 b/results/classifier/mode-deepseek-r1:32b/output/system/150 new file mode 100644 index 00000000..bf008028 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/150 @@ -0,0 +1,3 @@ + + +Illegal Instruction with HVF when encountering SSE instructions in the emulator diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1501 b/results/classifier/mode-deepseek-r1:32b/output/system/1501 new file mode 100644 index 00000000..5eefc71e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1501 @@ -0,0 +1,3 @@ + + +IBM AIX 73 not supported under QEMU diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1503 b/results/classifier/mode-deepseek-r1:32b/output/system/1503 new file mode 100644 index 00000000..864cdf26 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1503 @@ -0,0 +1,52 @@ + + +Writing to readonly memory should call cpu_transaction_failed +Description of problem: +Currently if a guest writes to ROM memory on a system that doesn't have some other form of memory protection enabled, QEMU will silently ignore the write (https://gitlab.com/qemu-project/qemu/-/blob/master/accel/tcg/cputlb.c#L2432). Instead, it should call cpu_transaction_failed (similar to what happens when a MMIO operation fails in `io_writex` and other places). For CPUs that don't care, it'll continue to be ignored, but for other CPUs the user will get a warning (with `-d guest_errors`) or an exception as appropriate. +Steps to reproduce: +N/A +Additional information: +The documentation for do_transaction_failed says: + +``` +@do_transaction_failed: Callback for handling failed memory transactions +(ie bus faults or external aborts; not MMU faults) +``` + +which seems reasonably well suited for this case. Here's an overview of what different CPUs currently do if do_transaction_failed is called: + +alpha_cpu_do_transaction_failed: + +* raises a EXCP_MCHK + +arm_cpu_do_transaction_failed: + +* raises ARMFault_SyncExternal with EXCP_DATA_ABORT + +loongarch_cpu_do_transaction_failed: + +* raises EXCCODE_ADEM + +m68k_cpu_transaction_failed: + +* raises EXCP_ACCESS (M68040 only) + +mb_cpu_transaction_failed: + +* raises EXCP_HW_EXCP with ESR_EC_DATA_BUS + +mips_cpu_do_transaction_failed: + +* raises EXCP_DBE (data bus error) + +riscv_cpu_do_transaction_failed: + +* raises RISCV_EXCP_STORE_AMO_ACCESS_FAULT + +sparc_cpu_do_transaction_failed: + +* raises an MMU fault + +xtensa_cpu_do_transaction_failed + +* raises LOAD_STORE_PIF_ADDR_ERROR_CAUSE diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1503031 b/results/classifier/mode-deepseek-r1:32b/output/system/1503031 new file mode 100644 index 00000000..44746ea1 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1503031 @@ -0,0 +1,13 @@ + + +32-to-64-bit call gate unsupported in IA32e mode + +In particular, the lcall implementation doesn't support the 64-bit TSS. + +helper_lcall_protected (target-i386/seg_helper.c:1884) calls get_ss_esp_from_tss() on a call gate to a lower privilege level, which tries to extract a 32-bit ESP and 16-bit SS from the TSS. In IA32e mode (64-bit or compatibility mode), this instead grabs the lower 32-bits of the target RSP, and 16 of the upper bits as the SS. Additionally, several of the subsequent checks are incorrect (even if the correct stack pointer were extracted). + +This isn't a problem for interrupts since the interrupts are given their own implementation entirely, that uses get_rsp_from_tss() rather than get_ss_esp_from_tss(). + +I believe the missing logic is from the branch starting "ELSE (* current TSS is 64-bit *)" in the CALL pseudocode in the Intel manual (page 3-124 of the PDF I have). + +Reproduced at master (c0b520dfb8890294a9f8879f4759172900585995), and also as of a qemu built a year ago. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1505 b/results/classifier/mode-deepseek-r1:32b/output/system/1505 new file mode 100644 index 00000000..6566c449 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1505 @@ -0,0 +1,3 @@ + + +guest agent: add --allow-rpcs / whitelist mode diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1505652 b/results/classifier/mode-deepseek-r1:32b/output/system/1505652 new file mode 100644 index 00000000..5edbdd69 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1505652 @@ -0,0 +1,54 @@ + + +An IO error happen when qemu snapshot-create + +My qemu version is 1.7.1,but when I try to make live snapshot by libvirt,the libvirt sometimes report an error :qemuMonitorJSONCheckError:377 : internal error: unable to execute QEMU command 'transaction': An IO error has occurred. + +Here is the command being snpshot create by virsh: +virsh snapshot-create snapshot-test.vm snapshot.xml --no-metadata --disk-only --reuse-external +the snapshot.xml: +<domainsnapshot> + <description>test</description> + <disks> + <disk name='vda' snapshot="external"> + <source dev='/home/disk/sbd8' file='/home/disk/sdb8' type="block"/> + </disk> + </disks> +</domainsnapshot> + + +I have read the qemu code about the snapshot create, and I find the qemu when call the function handle_aiocb_rw_linear(): +static ssize_t handle_aiocb_rw_linear(RawPosixAIOData *aiocb, char *buf) +{ + ssize_t offset = 0; + ssize_t len; + + while (offset < aiocb->aio_nbytes) { + if (aiocb->aio_type & QEMU_AIO_WRITE) { + len = pwrite(aiocb->aio_fildes, + (const char *)buf + offset, + aiocb->aio_nbytes - offset, + aiocb->aio_offset + offset); + } else { + len = pread(aiocb->aio_fildes, + buf + offset, + aiocb->aio_nbytes - offset, + aiocb->aio_offset + offset); + } + if (len == -1 && errno == EINTR) { + continue; + } else if (len == -1) { + offset = -errno; + break; + } else if (len == 0) { + break; + } + offset += len; + } + + return offset; +} + +The function pwrite happen error,the errono is 1,and the error describe:"pwrite failed, Operation not permitted (1, EPERM) because the process does not have the appropriate privileges to use the pwrite system call". +The qemu call stack about is: +external_snapshot_prepare()->bdrv_flush()->...->paio_submit->...->handle_aiocb_rw_linear. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1506 b/results/classifier/mode-deepseek-r1:32b/output/system/1506 new file mode 100644 index 00000000..a0ddd9c7 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1506 @@ -0,0 +1,3 @@ + + +QEMU not support 32-bit stack in unreal/flat/big 32-bit mode diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1509 b/results/classifier/mode-deepseek-r1:32b/output/system/1509 new file mode 100644 index 00000000..24a2250c --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1509 @@ -0,0 +1,163 @@ + + +ppc64 tcg guests get incorrect Capacity Entitlement values from SMP spapr machine's RTAS - examples given from AIX guest OS +Description of problem: +Entitled Capacity of the guest OS is not equal to the number of vCPUs you configure with QEMU. + +It only gives you 1/4 entitlements to your configured capacity, and if you increase the number of processors, it converts the LPAR capacity to hundredths of a core, throttling guest performance. +Steps to reproduce: +Definition of terms from lparstat: +Entitled Capacity: The number of processing units this LPAR is entitled to receive. +Maximum Capacity: The maximum number of processing units this LPAR was defined to ever have. Entitled capacity can be increased up to this value. + +Some examples: + +1 QEMU vCPU: +Entitled Capacity: 0.25 +Maximum Capacity: 1.00 + +2 QEMU vCPUs (-smp cpus=2,sockets=1,cores=2,threads=1): +Entitled Capacity = 0.50 +Maximum Capacity: 0.02 + +3 QEMU CPUs (-smp cpus=3,sockets=1,cores=3,threads=1): +Entitled Capacity = 0.75 +Maximum Capacity: 0.03 + +4 QEMU CPUs (-smp cpus=4,sockets=1,cores=4,threads=1): +Entitled Capacity = 1.00 +Maximum Capacity: 0.04 + +I believe these Entitled and Maximum values are comming from the spapr machine's MaxEntCap, DesProcs and MaxPlatProcs settings which get affected by -smp passed to QEMU. +Additional information: +Details: + +1 QEMU vCPU: + ``` +kens@aix-ppc64$ lparstat -i | head -20 +Node Name : aix-ppc64 +Partition Name : IBM AIX - IBM POWER9 +Partition Number : 0 +Type : Shared +Mode : Capped +Entitled Capacity : 0.25 +Partition Group-ID : 1 +Shared Pool ID : 1 +Online Virtual CPUs : 1 +Maximum Virtual CPUs : 1 +Minimum Virtual CPUs : 1 +Online Memory : 8192 MB +Maximum Memory : 8192 MB +Minimum Memory : 8192 MB +Variable Capacity Weight : 128 +Minimum Capacity : 0.01 +Maximum Capacity : 1.00 +Capacity Increment : 1.00 +Maximum Physical CPUs in system : 1 +Active Physical CPUs in system : 1 + ``` +2 QEMU vCPUs: + ``` +kens@aix-ppc64$ lparstat -i | head -20 +Node Name : aix-ppc64 +Partition Name : IBM AIX - IBM POWER9 +Partition Number : 0 +Type : Shared +Mode : Capped +Entitled Capacity : 0.50 +Partition Group-ID : 1 +Shared Pool ID : 1 +Online Virtual CPUs : 2 +Maximum Virtual CPUs : 2 +Minimum Virtual CPUs : 2 +Online Memory : 8192 MB +Maximum Memory : 8192 MB +Minimum Memory : 8192 MB +Variable Capacity Weight : 128 +Minimum Capacity : 0.02 +Maximum Capacity : 0.02 +Capacity Increment : 1.00 +Maximum Physical CPUs in system : 2 +Active Physical CPUs in system : 2 + ``` +3 QEMU vCPUs: + ``` +kens@aix-ppc64$ lparstat -i | head -20 +Node Name : aix-ppc64 +Partition Name : IBM AIX - IBM POWER9 +Partition Number : 0 +Type : Shared +Mode : Capped +Entitled Capacity : 0.75 +Partition Group-ID : 1 +Shared Pool ID : 1 +Online Virtual CPUs : 3 +Maximum Virtual CPUs : 3 +Minimum Virtual CPUs : 3 +Online Memory : 8192 MB +Maximum Memory : 8192 MB +Minimum Memory : 8192 MB +Variable Capacity Weight : 128 +Minimum Capacity : 0.03 +Maximum Capacity : 0.03 +Capacity Increment : 1.00 +Maximum Physical CPUs in system : 3 +Active Physical CPUs in system : 3 + ``` +4 QEMU vCPUs: + ``` +kens@aix-ppc64$ lparstat -i | head -2 +lparstat -i | head -2 +Node Name : aix-ppc64 +Partition Name : IBM AIX - IBM POWER9 +kens@aix-ppc64$ lparstat -i | head -20 +lparstat -i | head -20 +Node Name : aix-ppc64 +Partition Name : IBM AIX - IBM POWER9 +Partition Number : 0 +Type : Shared +Mode : Capped +Entitled Capacity : 1.00 +Partition Group-ID : 1 +Shared Pool ID : 1 +Online Virtual CPUs : 4 +Maximum Virtual CPUs : 4 +Minimum Virtual CPUs : 4 +Online Memory : 8192 MB +Maximum Memory : 8192 MB +Minimum Memory : 8192 MB +Variable Capacity Weight : 128 +Minimum Capacity : 0.04 +Maximum Capacity : 0.04 +Capacity Increment : 1.00 +Maximum Physical CPUs in system : 4 +Active Physical CPUs in system : 4 + ``` +So it seems to me like the OS assumes the following from the spapr machine settings: +Entitled Capacity = cpus / 4 (OS is assuming smt=4 threads maybe, see below) +Maximim Capacity = cpus / 100 (OS is assuming hundredths of a core, even though the Capacity Increment is 1.00, see below)) + +On a real Power system (POWER8, smt=8), it looks like this: + ``` +kens@aix72$ lparstat -i | head -20 +Node Name : aix72 +Partition Name : n1 +Partition Number : 1 +Type : Shared-SMT-4 +Mode : Uncapped +Entitled Capacity : 6.00 +Partition Group-ID : 32784 +Shared Pool ID : 0 +Online Virtual CPUs : 12 +Maximum Virtual CPUs : 28 +Minimum Virtual CPUs : 1 +Online Memory : 131072 MB +Maximum Memory : 196608 MB +Minimum Memory : 1024 MB +Variable Capacity Weight : 128 +Minimum Capacity : 0.50 +Maximum Capacity : 14.00 +Capacity Increment : 0.01 +Maximum Physical CPUs in system : 80 +Active Physical CPUs in system : 80 + ``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1510 b/results/classifier/mode-deepseek-r1:32b/output/system/1510 new file mode 100644 index 00000000..95d1195f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1510 @@ -0,0 +1,94 @@ + + +LibFuzzer: Deadly Signals +Description of problem: +``` +INFO: libFuzzer ignores flags that start with '--' +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1075449567 +INFO: Loaded 1 modules (323687 inline 8-bit counters): 323687 [0x558e9ece6000, 0x558e9ed35067), +INFO: Loaded 1 PC tables (323687 PCs): 323687 [0x558e9e7f5680,0x558e9ece5cf0), +./qemu-fuzz-i386: Running 1 inputs 1 time(s) each. +Running: crash-11075f8b34e355e114f92367a5e8b9bbb36a352d +Matching objects by name *usb* +Matching objects by name *ohci* +This process will try to fuzz the following MemoryRegions: + * bus master container[0] (size 0xffffffffffffffff) + * ohci[0] (size 0x100) + * bus master[0] (size 0xffffffffffffffff) +qemu-fuzz-i386: ../hw/usb/core.c:744: struct USBEndpoint *usb_ep_get(USBDevice *, int, int): Assertion `pid == USB_TOKEN_IN || pid == USB_TOKEN_OUT' failed. +==1763255== ERROR: libFuzzer: deadly signal + #0 0x558e9ad46cb1 in __sanitizer_print_stack_trace (/home/hyper/qemu/build/qemu-fuzz-i386+0x1f71cb1) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) + #1 0x558e9acb9548 in fuzzer::PrintStackTrace() (/home/hyper/qemu/build/qemu-fuzz-i386+0x1ee4548) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) + #2 0x558e9ac9efc3 in fuzzer::Fuzzer::CrashCallback() (/home/hyper/qemu/build/qemu-fuzz-i386+0x1ec9fc3) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) + #3 0x7faa5444251f (/lib/x86_64-linux-gnu/libc.so.6+0x4251f) (BuildId: 69389d485a9793dbe873f0ea2c93e02efaa9aa3d) + #4 0x7faa54496a7b in __pthread_kill_implementation nptl/./nptl/pthread_kill.c:43:17 + #5 0x7faa54496a7b in __pthread_kill_internal nptl/./nptl/pthread_kill.c:78:10 + #6 0x7faa54496a7b in pthread_kill nptl/./nptl/pthread_kill.c:89:10 + #7 0x7faa54442475 in gsignal signal/../sysdeps/posix/raise.c:26:13 + #8 0x7faa544287f2 in abort stdlib/./stdlib/abort.c:79:7 + #9 0x7faa5442871a in __assert_fail_base assert/./assert/assert.c:92:3 + #10 0x7faa54439e95 in __assert_fail assert/./assert/assert.c:101:3 + #11 0x558e9b6c89d9 in usb_ep_get /home/hyper/qemu/build/../hw/usb/core.c:744:5 + #12 0x558e9b701fa4 in ohci_service_td /home/hyper/qemu/build/../hw/usb/hcd-ohci.c:957:14 + #13 0x558e9b701fa4 in ohci_service_ed_list /home/hyper/qemu/build/../hw/usb/hcd-ohci.c:1122:21 + #14 0x558e9b6fa47b in ohci_frame_boundary /home/hyper/qemu/build/../hw/usb/hcd-ohci.c:1192:9 + #15 0x558e9cbe8b9c in timerlist_run_timers /home/hyper/qemu/build/../util/qemu-timer.c:576:9 + #16 0x558e9c2a9c7d in qtest_clock_warp /home/hyper/qemu/build/../softmmu/qtest.c:358:9 + #17 0x558e9c2a6411 in qtest_process_command /home/hyper/qemu/build/../softmmu/qtest.c:751:9 + #18 0x558e9c2a1f98 in qtest_process_inbuf /home/hyper/qemu/build/../softmmu/qtest.c:802:9 + #19 0x558e9c2a1db3 in qtest_server_inproc_recv /home/hyper/qemu/build/../softmmu/qtest.c:933:9 + #20 0x558e9c932980 in qtest_sendf /home/hyper/qemu/build/../tests/qtest/libqtest.c:600:5 + #21 0x558e9c932a84 in qtest_clock_step_next /home/hyper/qemu/build/../tests/qtest/libqtest.c:955:5 + #22 0x558e9ad86fed in generic_fuzz /home/hyper/qemu/build/../tests/qtest/fuzz/generic_fuzz.c:715:17 + #23 0x558e9ad7aae3 in LLVMFuzzerTestOneInput /home/hyper/qemu/build/../tests/qtest/fuzz/fuzz.c:152:5 + #24 0x558e9aca0553 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/hyper/qemu/build/qemu-fuzz-i386+0x1ecb553) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) + #25 0x558e9ac8a2cf in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/home/hyper/qemu/build/qemu-fuzz-i386+0x1eb52cf) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) + #26 0x558e9ac90026 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/hyper/qemu/build/qemu-fuzz-i386+0x1ebb026) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) + #27 0x558e9acb9e42 in main (/home/hyper/qemu/build/qemu-fuzz-i386+0x1ee4e42) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) + #28 0x7faa54429d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 + #29 0x7faa54429e3f in __libc_start_main csu/../csu/libc-start.c:392:3 + #30 0x558e9ac84b94 in _start (/home/hyper/qemu/build/qemu-fuzz-i386+0x1eafb94) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) + +NOTE: libFuzzer has rudimentary signal handlers. + Combine libFuzzer with AddressSanitizer or similar for better crash reports. +SUMMARY: libFuzzer: deadly signal +qemu-fuzz-i386: ../hw/usb/core.c:744: struct USBEndpoint *usb_ep_get(USBDevice *, int, int): Assertion `pid == USB_TOKEN_IN || pid == USB_TOKEN_OUT' failed. +==1763258== ERROR: libFuzzer: deadly signal + #0 0x558e9ad46cb1 in __sanitizer_print_stack_trace (/home/hyper/qemu/build/qemu-fuzz-i386+0x1f71cb1) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) + #1 0x558e9acb9548 in fuzzer::PrintStackTrace() (/home/hyper/qemu/build/qemu-fuzz-i386+0x1ee4548) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) + #2 0x558e9ac9efc3 in fuzzer::Fuzzer::CrashCallback() (/home/hyper/qemu/build/qemu-fuzz-i386+0x1ec9fc3) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) + #3 0x7faa5444251f (/lib/x86_64-linux-gnu/libc.so.6+0x4251f) (BuildId: 69389d485a9793dbe873f0ea2c93e02efaa9aa3d) + #4 0x7faa54496a7b in __pthread_kill_implementation nptl/./nptl/pthread_kill.c:43:17 + #5 0x7faa54496a7b in __pthread_kill_internal nptl/./nptl/pthread_kill.c:78:10 + #6 0x7faa54496a7b in pthread_kill nptl/./nptl/pthread_kill.c:89:10 + #7 0x7faa54442475 in gsignal signal/../sysdeps/posix/raise.c:26:13 + #8 0x7faa544287f2 in abort stdlib/./stdlib/abort.c:79:7 + #9 0x7faa5442871a in __assert_fail_base assert/./assert/assert.c:92:3 + #10 0x7faa54439e95 in __assert_fail assert/./assert/assert.c:101:3 + #11 0x558e9b6c89d9 in usb_ep_get /home/hyper/qemu/build/../hw/usb/core.c:744:5 + #12 0x558e9b701fa4 in ohci_service_td /home/hyper/qemu/build/../hw/usb/hcd-ohci.c:957:14 + #13 0x558e9b701fa4 in ohci_service_ed_list /home/hyper/qemu/build/../hw/usb/hcd-ohci.c:1122:21 + #14 0x558e9b6fa47b in ohci_frame_boundary /home/hyper/qemu/build/../hw/usb/hcd-ohci.c:1192:9 + #15 0x558e9cbe8b9c in timerlist_run_timers /home/hyper/qemu/build/../util/qemu-timer.c:576:9 + #16 0x558e9c2a9c7d in qtest_clock_warp /home/hyper/qemu/build/../softmmu/qtest.c:358:9 + #17 0x558e9c2a6411 in qtest_process_command /home/hyper/qemu/build/../softmmu/qtest.c:751:9 + #18 0x558e9c2a1f98 in qtest_process_inbuf /home/hyper/qemu/build/../softmmu/qtest.c:802:9 + #19 0x558e9c2a1db3 in qtest_server_inproc_recv /home/hyper/qemu/build/../softmmu/qtest.c:933:9 + #20 0x558e9c932980 in qtest_sendf /home/hyper/qemu/build/../tests/qtest/libqtest.c:600:5 + #21 0x558e9c932a84 in qtest_clock_step_next /home/hyper/qemu/build/../tests/qtest/libqtest.c:955:5 + #22 0x558e9ad86fed in generic_fuzz /home/hyper/qemu/build/../tests/qtest/fuzz/generic_fuzz.c:715:17 + #23 0x558e9ad7aae3 in LLVMFuzzerTestOneInput /home/hyper/qemu/build/../tests/qtest/fuzz/fuzz.c:152:5 + #24 0x558e9aca0553 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/hyper/qemu/build/qemu-fuzz-i386+0x1ecb553) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) + #25 0x558e9aca1175 in fuzzer::Fuzzer::TryDetectingAMemoryLeak(unsigned char const*, unsigned long, bool) (/home/hyper/qemu/build/qemu-fuzz-i386+0x1ecc175) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) + #26 0x558e9ac8a317 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/home/hyper/qemu/build/qemu-fuzz-i386+0x1eb5317) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) + #27 0x558e9ac90026 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/hyper/qemu/build/qemu-fuzz-i386+0x1ebb026) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) + #28 0x558e9acb9e42 in main (/home/hyper/qemu/build/qemu-fuzz-i386+0x1ee4e42) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) + #29 0x7faa54429d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 + #30 0x7faa54429e3f in __libc_start_main csu/../csu/libc-start.c:392:3 + #31 0x558e9ac84b94 in _start (/home/hyper/qemu/build/qemu-fuzz-i386+0x1eafb94) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) +``` +Steps to reproduce: +1. ./qemu-fuzz-i386 --fuzz-target=generic-fuzz-ohci +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1511 b/results/classifier/mode-deepseek-r1:32b/output/system/1511 new file mode 100644 index 00000000..99fe7f1a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1511 @@ -0,0 +1,3 @@ + + +Please a CPU model for ABI version for x86_64 i386 according to x86-64 psABI diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1511710 b/results/classifier/mode-deepseek-r1:32b/output/system/1511710 new file mode 100644 index 00000000..4e560473 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1511710 @@ -0,0 +1,9 @@ + + +unknown option --disable-modules + +MSYS64, Windows 7 x64 + +$ ./configure --target-list=i386-softmmu --static --prefix=/d/qemu/ --disable-system --disable-user --disable-linux-user --disable-bsd-user --disable-guest-base --disable-docs --disable-guest-agent --disable-guest-agent-msi --disable-pie --disable-modules --disable-debug-tcg --disable-debug-info --disable-sparse --disable-seccomp --disable-gnutls --disable-sdl--disable-gtk --disable-vte --disable-curses --disable-vnc --disable-vnc-tls --disable-vnc-sasl --disable-vnc-jpeg --disable-vnc-png --disable-cocoa --disable-virtfs --disable-xen --disable-xen-pci-passthro --disable-brlapi --disable-curl --disable-fdt --disable-bluez --disable-kvm --disable-rdma --disable-uuid --disable-vde --disable-netmap --disable-linux-aio --disable-cap-ng --disable-attr --disable-vhost-net --disable-spice --disable-rbd --disable-libiscsi --disable-libnfs --disable-smartcard-nss --disable-libusb --disable-usb-redir --disable-lzo --disable-snappy --disable-bzip2 --disable-coroutine-pool --disable-glusterfs --disable-archipelago --disable-tpm --disable-libssh2 --disable-vhdx --disable-numa --disable-tcmalloc +ERROR: unknown option --disable-modules +Try './configure --help' for more information \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1513 b/results/classifier/mode-deepseek-r1:32b/output/system/1513 new file mode 100644 index 00000000..259449f9 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1513 @@ -0,0 +1,3 @@ + + +CPU flags should be better documented diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1514 b/results/classifier/mode-deepseek-r1:32b/output/system/1514 new file mode 100644 index 00000000..70f6f992 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1514 @@ -0,0 +1,3 @@ + + +Cpu flags for ARM is surprising diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1517 b/results/classifier/mode-deepseek-r1:32b/output/system/1517 new file mode 100644 index 00000000..4dd29fb7 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1517 @@ -0,0 +1,3 @@ + + +TCG doesn't support requested feature: CPUID.80000001H:EDX.syscall [bit 11]/TCG doesn't support requested feature: CPUID.80000001H:EDX.lm [bit 29] diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1520 b/results/classifier/mode-deepseek-r1:32b/output/system/1520 new file mode 100644 index 00000000..5a992211 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1520 @@ -0,0 +1,51 @@ + + +x86 TCG acceleration running on s390x with -smp > host cpus slowed down by x10 +Description of problem: +This boots up a trivial guest using OVMF, when the conditions below are given it runs ~10x slower. + +I have found this breaking our tests of qemu 7.2 [(which due to Debian adding the offending change as backport is affected)](https://salsa.debian.org/qemu-team/qemu/-/blob/master/debian/patches/master/acpi-cpuhp-fix-guest-visible-maximum-access-size-to-.patch) by runnig an order of magnitude slower. + + +I was tracing it down (insert a long strange trip here) and found that it occurs: +- only with patch dab30fb "acpi: cpuhp: fix guest-visible maximum access size to the legacy reg block" applied + - latest master is still affetced +- only with s390x running emulation of x86 + - emulating x86 on ppc64 didn't show the same behavior +- only with -smp > host cpus + - smp 2 with 1 host cpu => slow + - smp 4 with 2 host cpu => slow + - any case where host cpu >= smp => fast + +On average good cases are on a 2964 s390x machine taking ~5-6 seconds for the good case. +The bad case is close to 60s which is the timeout of the automated tests. + +We all know -smp shouldn't be >host-cpus, and I totally admit that this is the definition of an edge case. +But I do not know what else might be affected and this just happened to be what the test does by default - and a slowdown by x10 seems too much even for edge cases to be just ignored. +And while we could just bump up the timeout (and probably will as an interim workaround) I wanted to file it here for your awareness. +Steps to reproduce: +You can recreate the same by using the commandline above and timing things on your own. + +Or you can use the [autopkgtest of edk2 in Ubuntu](https://git.launchpad.net/ubuntu/+source/edk2/tree/debian/tests/shell.py#n214) which have [shown this](https://autopkgtest.ubuntu.com/results/autopkgtest-lunar/lunar/s390x/e/edk2/20230224_094012_c95f4@/log.gz) first. +Additional information: +Only signed OVMF cases are affected, while aavmf and other OVMF are more or less on the same speed. + +``` +1 CPU / 1GB Memory +7.0 7.2 +6.54s 58.32s test_ovmf_ms +6.72s 56.96s test_ovmf_4m_ms +7.54s 55.47s test_ovmf_4m_secboot +7.56s 49.88s test_ovmf_secboot +7.01s 39.79s test_ovmf32_4m_secboot +7.38s 7.43s test_aavmf32 +7.27s 7.30s test_aavmf +7.26s 7.26s test_aavmf_snakeoil +5.83s 5.95s test_ovmf_4m +5.61s 5.81s test_ovmf_q35 +5.51s 5.64s test_ovmf_pc +5.26s 5.42s test_ovmf_snakeoil +``` + +Highlighting @cborntra since it is somewhat s390x related and @mjt0k as the patch is applied as backport in Debian. +I didn't find the handle of Laszlo (Author) to highlight him as well. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1523 b/results/classifier/mode-deepseek-r1:32b/output/system/1523 new file mode 100644 index 00000000..b6e02c2a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1523 @@ -0,0 +1,3 @@ + + +Tricore: no interrupts emulation diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1530 b/results/classifier/mode-deepseek-r1:32b/output/system/1530 new file mode 100644 index 00000000..981ad689 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1530 @@ -0,0 +1,13 @@ + + +Problem with sdl,gl=on windows 10 +Description of problem: +sdl window opens with black screen, freezes, then crashes +Steps to reproduce: +1. run the command +Additional information: +- Works fine with just `sdl`, running `gtk,gl=on` outputs `opengl is not supported by the display` +- tried with both `-vga virtio` and `vga std`, same result +- tried with SVM turned on and off (AMD cpu, ryzen 2600x), same result +- built the project `./configure --enable-gtk --enable-sdl --enable-opengl, saw the `OK` for all 3 +- have opengl ver 4.6 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1530386 b/results/classifier/mode-deepseek-r1:32b/output/system/1530386 new file mode 100644 index 00000000..91549fa7 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1530386 @@ -0,0 +1,10 @@ + + +command.com on win95 throws video mode out + +on a presumed-good copy of Windows 95 obtained from http://forum.xda-developers.com/showthread.php?t=1960870, the operating system boots successfully and shows up fine, but as soon as I double-click the MS-DOS icon, the window, while remaining the same size, goes to a different resolution and only shows a small portion of what it did, with strange colors and artifacts. tried first with the Debian 2.5 package, then with latest cvs sources, then with the 2.5.0 release, all the same problem. + +jcomeau@aspire:/usr/src/qemu-2.5.0/build$ cd /tmp/win95/SDL/ +jcomeau@aspire:/tmp/win95/SDL$ /usr/src/qemu-2.5.0/build/i386-softmmu/qemu-system-i386 c.img +jcomeau@aspire:/tmp/win95/SDL$ /usr/src/qemu-2.5.0/build/i386-softmmu/qemu-system-i386 --version +QEMU emulator version 2.5.0, Copyright (c) 2003-2008 Fabrice Bellard \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1533 b/results/classifier/mode-deepseek-r1:32b/output/system/1533 new file mode 100644 index 00000000..be19878e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1533 @@ -0,0 +1,3 @@ + + +qemu-i386 should not enable feature LM with named CPU models. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1534 b/results/classifier/mode-deepseek-r1:32b/output/system/1534 new file mode 100644 index 00000000..bd7b0b20 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1534 @@ -0,0 +1,3 @@ + + +usermode emulation warns about features that are system-only (x2apic, tsc-deadline, pcid, invpcid) diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1538 b/results/classifier/mode-deepseek-r1:32b/output/system/1538 new file mode 100644 index 00000000..5a00498b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1538 @@ -0,0 +1,3 @@ + + +igd.c gives up IGD legacy mode if no option ROM found diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/154 b/results/classifier/mode-deepseek-r1:32b/output/system/154 new file mode 100644 index 00000000..bd4d903e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/154 @@ -0,0 +1,3 @@ + + +readlink(2) returns incorrect size for /proc/self/exe diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1542 b/results/classifier/mode-deepseek-r1:32b/output/system/1542 new file mode 100644 index 00000000..6199534f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1542 @@ -0,0 +1,15 @@ + + +Non-Executable PMP regions of size less than 4K trigger instruction access faults non-deterministically +Description of problem: +When a non-executable PMP region of size less than 4K (page size) with a start address that is not 4K-aligned is created, QEMU will non-deterministically dispatch instruction access faults when instructions are executed from the PMP-covered region (will in some cases, won't in others, based on the current TLB state) +Steps to reproduce: +1. Create a PMP region of size less than 4K, that is not aligned to the start of the page, make it non-executable +2. Flush TLB with `sfence.vma x0, x0` +3. Jump to the start of the pmp-protected page and start executing instructions +4. Notice that no instruction access fault is reported once we reach the protected region inside the page +Additional information: +@rth7680 I believe this is at least partially an unintentional result of this commit that you authored: 7e0d9973ea665bf459b2dbd173d0e51bc6ca5216, which modified the behavior of `get_page_addr_code_hostp` probes to probe a single byte, instead of a full page size (signaled by passing 0). +This means that we initially probe the first byte of the page, see that no PMP faults are raised, and then assume that no other bytes in the page can cause a PMP fault. + +Note that I believe that simply changing this back to 0 from 1 is not enough, as this will likely simply reintroduce the issue I originally reported in #1053. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1542965 b/results/classifier/mode-deepseek-r1:32b/output/system/1542965 new file mode 100644 index 00000000..37158d81 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1542965 @@ -0,0 +1,7 @@ + + +Failed to set NBD socket ubuntu 15.10 & nbd client 3.10 + +Running command to mount using nbd fails +with error +/build/qemu-YZq7uh/qemu-2.3+dfsg/nbd.c:nbd_init():L670: Failed to set NBD socket \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1543 b/results/classifier/mode-deepseek-r1:32b/output/system/1543 new file mode 100644 index 00000000..577650b9 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1543 @@ -0,0 +1,3 @@ + + +Heap-use-after-free in e1000e_receive_internal diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1544 b/results/classifier/mode-deepseek-r1:32b/output/system/1544 new file mode 100644 index 00000000..2657a6f9 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1544 @@ -0,0 +1,3 @@ + + +Abort in net_tx_pkt_do_sw_fragmentation diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1546 b/results/classifier/mode-deepseek-r1:32b/output/system/1546 new file mode 100644 index 00000000..cfb2ac26 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1546 @@ -0,0 +1,3 @@ + + +Git build fail in fp tests diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1549298 b/results/classifier/mode-deepseek-r1:32b/output/system/1549298 new file mode 100644 index 00000000..069d3568 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1549298 @@ -0,0 +1,15 @@ + + +Add missing MSRs for powertop + +I reported this same bug on the powertop bugtracker [1] because I think both projects need to change something here. + +When running powertop it crashes and prints: + + unknown op '{' + read_msr cpu0 0xe8 : Input/output error + +It seems that powertop is trying to access model specific registers and because qemu doesn't emulate them it crashes. +Clearly powertop shouldn't crash in such case but I think it would also be better if qemu could add support for these registers. + +1: https://app.devzing.com/powertopbugs/bugzilla/show_bug.cgi?id=4 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/155 b/results/classifier/mode-deepseek-r1:32b/output/system/155 new file mode 100644 index 00000000..ef6e16d3 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/155 @@ -0,0 +1,3 @@ + + +MMX emulation is missing on HVF Acceleration diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1551 b/results/classifier/mode-deepseek-r1:32b/output/system/1551 new file mode 100644 index 00000000..29829c67 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1551 @@ -0,0 +1,42 @@ + + +qemu-system-arm: ../accel/tcg/cpu-exec.c:917: cpu_loop_exec_tb: Assertion `icount_enabled()' failed. +Description of problem: +When starting the guest, the mentioned assertion is triggered very soon: +``` +qemu-system-arm: ../accel/tcg/cpu-exec.c:917: cpu_loop_exec_tb: Assertion `icount_enabled()' failed. +``` +I'm able to successfully boot the same image with QEMU 7.2.0. + +The last output from the qemu logging with `-d guest_errors,in_asm,int,pcall,cpu` is +``` +---------------- +IN: +0x40209100: e92d4ff0 push {r4, r5, r6, r7, r8, sb, sl, fp, lr} +0x40209104: e28db020 add fp, sp, #0x20 +0x40209108: e24b3f49 sub r3, fp, #0x124 +0x4020910c: e24ddf43 sub sp, sp, #0x10c +0x40209110: e1a0e00f mov lr, pc +0x40209114: e3e0f0ff mvn pc, #0xff + +R00=4021000c R01=4020a5f8 R02=0000000f R03=40209100 +R04=40210018 R05=40210018 R06=4020c000 R07=40002000 +R08=00000000 R09=00000000 R10=00000000 R11=4020d7fc +R12=00000000 R13=4020d7f0 R14=4020074c R15=40209100 +PSR=2000011f --C- A sys32 +---------------- +IN: +0xffffff00: ee1d0f50 mrc p15, #0, r0, c13, c0, #2 + +R00=4021000c R01=4020a5f8 R02=0000000f R03=4020d6c8 +R04=40210018 R05=40210018 R06=4020c000 R07=40002000 +R08=00000000 R09=00000000 R10=00000000 R11=4020d7ec +R12=00000000 R13=4020d6c0 R14=40209118 R15=ffffff00 +PSR=2000011f --C- A sys32 +``` + +Please note that the L4Re OS uses `mvn pc, #0xff` to switch from EL1 to EL2 (system call). +Steps to reproduce: +1. Boot the attached image with the provided command line to trigger the assertion +Additional information: +I will attach the bootstrap image to this ticket. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1552549 b/results/classifier/mode-deepseek-r1:32b/output/system/1552549 new file mode 100644 index 00000000..6c055487 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1552549 @@ -0,0 +1,7 @@ + + +qemu-system-i386 verison 2.5.50 fails at lmsw instruction + +I cloned qemu source code from github.com, and compiled it on my Kubuntu 15.10 laptop to run my little OS. When booting my little OS, the virtual machine's screen keep blinking, I guess it's the virtual machine rebooting on and on automatically for some unknown reason, but there is no further information shown on Kubuntu's terminal. I'm pretty sure this problem is not caused by my little OS, because it works just fine in qemu-system-i386 version 2.5.0. + +I debugged my OS and find this problem happens when executing instruction "lmsw ax". Is this a bug, can anyone help me out? \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1557 b/results/classifier/mode-deepseek-r1:32b/output/system/1557 new file mode 100644 index 00000000..c6a32a4a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1557 @@ -0,0 +1,13 @@ + + +qemu-binfmt-conf.sh handles errors inconsistently +Description of problem: +We are installing qemu via multiarch/qemu-user-static docker image. https://github.com/multiarch/qemu-user-static + +What we have noticed is that because qemu-binfmt-conf.sh does not use `set -e`, its behavior with regards to failures is inconsistent. In short, registering the same thing into binfmt twice is an error (you get EEXIST). However, the exit code of qemu-binfmt-conf.sh itself seems to depend only on whether the last interpreter succeeded, leading to confusing and inconsistent results. +Steps to reproduce: +1. Register only qemu-arm-static interpreter with binfmt. +2. Run qemu-binfmt-conf.sh. Observe that the exit code is zero, and logs show the duplicate interpreter was rejected. +3. Remove all qemu interpreters. +3. Register only qemu-loongarch64-static interpreter (currently last in qemu_target_list) with binfmt. +3. Run qemu-binfmt-conf.sh. Observe that the exit code is non-zero, and logs show the duplicate interpreter was rejected. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/156 b/results/classifier/mode-deepseek-r1:32b/output/system/156 new file mode 100644 index 00000000..99b75c58 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/156 @@ -0,0 +1,3 @@ + + +-nodefaults has unclear documentation diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1561 b/results/classifier/mode-deepseek-r1:32b/output/system/1561 new file mode 100644 index 00000000..7156188a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1561 @@ -0,0 +1,29 @@ + + +Compile QEMU 6.2.0 fail for file not found +Description of problem: +Compile QEMU failed with error message: +``` +In file included from ../subprojects/libvhost-user/libvhost-user.c:45: +../subprojects/libvhost-user/libvhost-user.h:23:10: Fatal error：standard-headers/linux/virtio_ring.h：no such file or directory + 23 | #include "standard-headers/linux/virtio_ring.h" + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +``` +Steps to reproduce: +1. Download qemu-6.2.0 tarball at https://download.qemu.org/qemu-6.2.0.tar.xz +2. unzip the tarball to dir ```qemu-6.2.0``` +2. cd ```qemu-6.2.0```, and then ```./configure && make -j2``` +Additional information: +In ```qemu-6.2.0/subprojects/libvhost-user/libvhost-user.c:45```, the included files are: + +``` +#include <stdint.h> +#include <stdbool.h> +#include <stddef.h> +#include <poll.h> +#include <linux/vhost.h> +#include <pthread.h> +#include "standard-headers/linux/virtio_ring.h" +``` + +```standard-headers``` are in ```qemu-6.2.0/include/standard-headers/```, but above #include assume it's in the same dir of ```libvhost-user.c```. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1563 b/results/classifier/mode-deepseek-r1:32b/output/system/1563 new file mode 100644 index 00000000..ecdc446c --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1563 @@ -0,0 +1,5 @@ + + +lsi53c895a: DMA reentrancy issue leads to stack overflow (CVE-2023-0330) +Description of problem: +See https://bugzilla.redhat.com/show_bug.cgi?id=2160151. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1563931 b/results/classifier/mode-deepseek-r1:32b/output/system/1563931 new file mode 100644 index 00000000..0680bbc8 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1563931 @@ -0,0 +1,8 @@ + + +qemu-img should allow resizing image with snapshots + +Currently it's not possible to resize a disk image with qemu-img if image in question has snapshots associated. I'm not entirely sure this is technically possible but if it is, it would be really nice to support that. + +$ qemu-img --version +qemu-img version 2.4.1 (qemu-2.4.1-8.fc23), Copyright (c) 2004-2008 Fabrice Bellard \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1565 b/results/classifier/mode-deepseek-r1:32b/output/system/1565 new file mode 100644 index 00000000..055ec7e9 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1565 @@ -0,0 +1,36 @@ + + +s390x TCG migration failure +Description of problem: +We're seeing failures running s390x migration kvm-unit-tests tests with TCG. + +Some initial findings: + +What seems to be happening is that after migration a control block header accessed by the test code is all zeros which causes an unexpected exception. + +I did a bisection which points to c8df4a7aef ("migration: Split save_live_pending() into state_pending_*") as the culprit. +The migration issue persists after applying the fix e264705012 ("migration: I messed state_pending_exact/estimate") on top of c8df4a7aef. + +Applying + +``` +diff --git a/migration/ram.c b/migration/ram.c +index 56ff9cd29d..2dc546cf28 100644 +--- a/migration/ram.c ++++ b/migration/ram.c +@@ -3437,7 +3437,7 @@ static void ram_state_pending_exact(void *opaque, uint64_t max_size, + + uint64_t remaining_size = rs->migration_dirty_pages * TARGET_PAGE_SIZE; + +- if (!migration_in_postcopy()) { ++ if (!migration_in_postcopy() && remaining_size < max_size) { + qemu_mutex_lock_iothread(); + WITH_RCU_READ_LOCK_GUARD() { + migration_bitmap_sync_precopy(rs); +``` +on top fixes or hides the issue. (The comparison was removed by c8df4a7aef.) + +I arrived at this by experimentation, I haven't looked into why this makes a difference. +Steps to reproduce: +1. Run ACCEL=tcg ./run_tests.sh migration-skey-sequential with current QEMU master +2. Repeat until the test fails (doesn't happen every time, but still easy to reproduce) diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1566 b/results/classifier/mode-deepseek-r1:32b/output/system/1566 new file mode 100644 index 00000000..950d22f1 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1566 @@ -0,0 +1,11 @@ + + +qemo-8-0-0-rc2 error: redeclaration of 'enum fsconfig_command' +Description of problem: + +Steps to reproduce: +1. +2. +3. +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1568 b/results/classifier/mode-deepseek-r1:32b/output/system/1568 new file mode 100644 index 00000000..fa562a3b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1568 @@ -0,0 +1,41 @@ + + +qemu-system-m68k fails whenever the option "-d cpu_reset" is specified +Description of problem: +When specifying the option "-d cpu_reset", the following output is generated, and QEMU eventually crashes with a Segmentation fault: +``` +CPU Reset (CPU 0) +D0 = 00000000 A0 = 00000000 F0 = 0000 0000000000000000 ( 0) +D1 = 00000000 A1 = 00000000 F1 = 0000 0000000000000000 ( 0) +D2 = 00000000 A2 = 00000000 F2 = 0000 0000000000000000 ( 0) +D3 = 00000000 A3 = 00000000 F3 = 0000 0000000000000000 ( 0) +D4 = 00000000 A4 = 00000000 F4 = 0000 0000000000000000 ( 0) +D5 = 00000000 A5 = 00000000 F5 = 0000 0000000000000000 ( 0) +D6 = 00000000 A6 = 00000000 F6 = 0000 0000000000000000 ( 0) +D7 = 00000000 A7 = 00000000 F7 = 0000 0000000000000000 ( 0) +PC = 00000000 qemu: fatal: Bad CC_OP 0 +D0 = 00000000 A0 = 00000000 F0 = 0000 0000000000000000 ( 0) +D1 = 00000000 A1 = 00000000 F1 = 0000 0000000000000000 ( 0) +D2 = 00000000 A2 = 00000000 F2 = 0000 0000000000000000 ( 0) +D3 = 00000000 A3 = 00000000 F3 = 0000 0000000000000000 ( 0) +D4 = 00000000 A4 = 00000000 F4 = 0000 0000000000000000 ( 0) +D5 = 00000000 A5 = 00000000 F5 = 0000 0000000000000000 ( 0) +D6 = 00000000 A6 = 00000000 F6 = 0000 0000000000000000 ( 0) +D7 = 00000000 A7 = 00000000 F7 = 0000 0000000000000000 ( 0) +... +D0 = 00000000 A0 = 00000000 F0 = 0000 0000000000000000 ( 0) +D1 = 00000000 A1 = 00000000 F1 = 0000 0000000000000000 ( 0) +D2 = 00000000 A2 = 00000000 F2 = 0000 0000000000000000 ( 0) +D3 = 00000000 A3 = 00000000 F3 = 0000 0000000000000000 ( 0) +D4 = 00000000 A4 = 00000000 F4 = 0000 0000000000000000 ( 0) +D5 = 00000000 A5 = 00000000 F5 = 0000 0000000000000000 ( 0) +D6 = 00000000 A6 = 00000000 F6 = 0000 0000000000000000 ( 0) +D7 = 00000000 A7 = 00000000 F7 = 0000 0000000000000000 ( 0) +PC = 00000000 qemu: fatal: Bad CC_OP 0 +Segmentation fault (core dumped) +``` +This also happens with the other m68k machine types. +Steps to reproduce: +1. Run QEMU with the given command line. +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1570 b/results/classifier/mode-deepseek-r1:32b/output/system/1570 new file mode 100644 index 00000000..d874115d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1570 @@ -0,0 +1,65 @@ + + +Incorrect memory handling when booting redox +Description of problem: +During the boot of redox, I regularly get one of two errors when reading the HPET at base address `0xfed00000`: +- Incorrect translation from virtual address `0xffff8000fed00108` to random physical addresses, e.g. `0xfec00108` +- Invalid read at addr 0x0, size 8, region 'hpet', reason: invalid size (min:4 max:4) +Steps to reproduce: +1. Build the server version of the redox OS as per [the instructions](https://doc.redox-os.org/book/ch02-05-building-redox.html). +2. Run the qemu command line with multiple CPUs. The more CPUs the easier it is to reproduce. +3. The problem will manifest itself as a divide by zero error. See the corresponding [redox bug report](https://gitlab.redox-os.org/redox-os/kernel/-/issues/116). +Additional information: +The best evidence I have is a debug line I added to qemu before [the memory_region_dispatch_read line](https://gitlab.com/qemu-project/qemu/-/blob/master/accel/tcg/cputlb.c#L1375): + +``` +if ((mr_offset & 0x1ff) == 0x108) fprintf(stderr, "cputlb io_readx cpu %d addr=%llx mr_offset=%llx mr=%p mr->addr=%llx\n", current_cpu->cpu_index, addr, mr_offset, mr, mr->addr); +r = memory_region_dispatch_read(mr, mr_offset, &val, op, full->attrs); +``` + +That logs: + +``` +cputlb io_readx cpu 0 addr=ffff8000fed00108 mr_offset=108 mr=0x7fefb60d5720 mr->addr=fec00000 +``` + +The expected physical address is `0xfed00000` instead of `0xfec00000`. + +A more extensive log is this one: +``` +55027@1680283224.671665:memory_region_ops_read cpu 5 mr 0x7f9950890130 addr 0xfed000f0 value 0x949707cc size 4 name 'hpet' <- ok +55027@1680283224.671681:memory_region_ops_read cpu 5 mr 0x7f9950890130 addr 0xfed000f4 value 0x0 size 4 name 'hpet' <- ok +tlb_set_page_full: vaddr=0000000000474000 paddr=0x000000000536f000 prot=5 idx=1 +... +tlb_flush_by_mmuidx_async_work: mmu_idx:0xffff +tlb_flush_by_mmuidx_async_work: mmu_idx:0xffff +tlb_flush_by_mmuidx_async_work: mmu_idx:0xffff +tlb_flush_by_mmuidx_async_work: mmu_idx:0xffff +... +55027@1680283224.671951:memory_region_ops_read cpu 5 mr 0x7f9950882930 addr 0xfec00108 value 0x0 size 4 name 'ioapic' <- wrong +55027@1680283224.671958:memory_region_ops_read cpu 5 mr 0x7f9950882930 addr 0xfec0010c value 0x0 size 4 name 'ioapic' +55027@1680283224.671967:memory_region_ops_write cpu 2 mr 0x7f994d808d30 addr 0xcf8 value 0x8000fa80 size 4 name 'pci-conf-idx' +55027@1680283224.671986:memory_region_ops_read cpu 2 mr 0x7f994d808e40 addr 0xcfc value 0x80a805 size 4 name 'pci-conf-data' +55027@1680283224.672001:memory_region_ops_read cpu 5 mr 0x7f9950882930 addr 0xfec00000 value 0x0 size 4 name 'ioapic' <- wrong +55027@1680283224.672010:memory_region_ops_read cpu 5 mr 0x7f9950882930 addr 0xfec00004 value 0x0 size 4 name 'ioapic' +``` + +Some observations +- ~I seem to be the only one having this issue. Perhaps because I am the only one developing on MacOS. Maybe it's because I'm running an older intel mac.~. I managed to reproduce this on a Asus vivobook running linux +- The redox OS [reads the HPET](https://gitlab.redox-os.org/redox-os/kernel/-/blob/master/src/arch/x86_64/time.rs#L11) at addresses `0xf4`, `0x108`, `0x00` in that order. If I change the order to `0x00`, `0xf4`, `0x108`, the problem goes away. +- Even if I work around the problem by changing the order of the reads, the OS still randomly crashes. This could be related, but I can only speculate on that right now. +- Increasing qemu debug logging tends to push the problem to the 4vs8 size problem instead of the incorrect address one. The more logging, the more difficult it is to reproduce. +- I tried to bisect the issue and found I could only reproduce it after qemu version 5.2. However, the mac build broke during this process so I could not find the causal commit. Between 5.1 and 5.2 the performance is greatly increased though and I suspect whatever changed there caused the issue. +- I can't reproduce the problem with -smp 1 +- I have seen qemu segfault occasionally, but I didn't look further into it and I don't know if it's related to this issue. +- I have attempted to rule out a bug in redox. I am fairly certain nothing strange is going on there, but I can't say for sure. +- When I trigger the incorrect address bug, I mostly get a base address of `0xfec00000` which is the IO APIC. However, I do occasionally see other addresses too +- `info tlb` at the time of the fault shows + ``` + ffff8000fd3e6000: 00000000fd3e6000 X--DA---W + ffff8000fd3e7000: 00000000fd3e7000 X--DA---W + ffff8000fed00000: 00000000fed00000 X--DAC--W + ffff8000fee00000: 00000000fee00000 X--DA---W + fffffd8000000000: 0000000001e32000 XG-DA---W + fffffd8000001000: 0000000001e36000 XG-DA---W + ``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1573 b/results/classifier/mode-deepseek-r1:32b/output/system/1573 new file mode 100644 index 00000000..63577154 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1573 @@ -0,0 +1,3 @@ + + +TCP Previous segment not captured diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1574246 b/results/classifier/mode-deepseek-r1:32b/output/system/1574246 new file mode 100644 index 00000000..0ca4b0f5 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1574246 @@ -0,0 +1,23 @@ + + +Drunken keyboard in go32v2 programs + +QEMU 2.5.0, SeaBIOS 1.9.1; I've been noticing this bug for quite a while, though. + +Steps to reproduce: + +# Create a VM image, install DOS in it (doesn't matter which) and launch it. +# Launch a "bare DOS" DPMI host (not an operating system) in it; I tested with CWSDPMI and HDPMI32. +# Run a go32v2 program which reads keyboard input (say, the Lua interpreter: <http://www.ibiblio.org/pub/micro/pc-stuff/freedos/files/distributions/1.1/repos/devel/lua.zip>; the Free Pascal IDE will also do; on the other hand, DOS/4GW programs seem unaffected). +# Quickly type in something random (e.g. alternate between hitting "p" and "q"), then optionally move the cursor left and right. +# Observe how some keystrokes are missed, and some are caught twice. + +The issue does NOT arise: +* on bare metal DOS, +* in VirtualBox, +* in Bochs with stock Plex86 BIOS, +* in Bochs with SeaBIOS, +* in DOSEMU, +* in DOSBox, +* in QEMU when the DPMI host is Windows 3.11/9x +so at this point I'm reasonably sure that it's the fault of either QEMU or SeaBIOS, and probably the former. The issue arises regardless of whether KVM is enabled. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1574346 b/results/classifier/mode-deepseek-r1:32b/output/system/1574346 new file mode 100644 index 00000000..48895310 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1574346 @@ -0,0 +1,14 @@ + + +TCG: mov to segment register is incorrectly emulated for AMD CPUs + +In TCG mode, the effect of: + +xorl %eax, %eax +movl %eax, %gs + +is to mark the GS segment unusable and set its base to zero. After doing this, reading MSR_GS_BASE will return zero and using a GS prefix in long mode will treat the GS base as zero. + +This is correct for Intel CPUs but is incorrect for AMD CPUs. On an AMD CPU, writing 0 to %gs using mov, pop, or (I think) lgs will leave the base unchanged. + +To make it easier to use TCG to validate behavior on different CPUs, please consider changing the TCG behavior to match actual CPU behavior when emulating an AMD CPU. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1577841 b/results/classifier/mode-deepseek-r1:32b/output/system/1577841 new file mode 100644 index 00000000..940efdce --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1577841 @@ -0,0 +1,15 @@ + + +target-mips/helper.c:542: bad sizeof ? + +Recent versions of gcc say this: + +qemu/target-mips/helper.c:542:9: warning: ‘memset’ used with length equal to number of elements without multiplication by element size [-Wmemset-elt-size] + +Source code is + + memset(env->CP0_WatchLo, 0, sizeof(*env->CP0_WatchLo)); + +Maybe better code + + memset(env->CP0_WatchLo, 0, 8 * sizeof(target_ulong)); \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1578 b/results/classifier/mode-deepseek-r1:32b/output/system/1578 new file mode 100644 index 00000000..ae93140b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1578 @@ -0,0 +1,5 @@ + + +Send all the SVQ control commands in parallel instead of serialized +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1581 b/results/classifier/mode-deepseek-r1:32b/output/system/1581 new file mode 100644 index 00000000..d9402cde --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1581 @@ -0,0 +1,16 @@ + + +QEMU TCG crashes when running on windows +Description of problem: +QEMU crashes immediately after startup and shows an assertion failure： + +ERROR:C:/msys64/home/xxx/qemu/tcg/i386/tcg-target.c.inc:1085:tcg_out_addi_ptr: assertion failed: (64 == 32) + +Bail out! ERROR:C:/msys64/home/xxx/qemu/tcg/i386/tcg-target.c.inc:1085:tcg_out_addi_ptr: assertion failed: (64 == + 32) +Steps to reproduce: +NA +Additional information: +1. This problem only occurs when the host system is windows, and the same QEMU configuration does not have this problem when the host system is Linux. +2. This problem is related to the -smp parameter of QEMU. If the smp parameter is 1, this problem will not occur. +3. This problem does not exist in the QEMU version 7.2. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1581695 b/results/classifier/mode-deepseek-r1:32b/output/system/1581695 new file mode 100644 index 00000000..51d472e2 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1581695 @@ -0,0 +1,20 @@ + + +getifaddrs: Address family not supported by protocol + +Calling ip addr fails with the following error message: +Cannot open netlink socket: Address family not supported by protocol + + +My use case is running a docker raspberry pi arm container on Ubuntu 14.04 x64 with qemu-static. + +My steps to reproduce are the following: + +# docker pull philipz/rpi-raspbian:latest +# docker run -it --rm -v /usr/bin/qemu-arm-static:/usr/bin/qemu-arm-static philipz/rpi-raspbian bash +root@3b4ddc174279:/# ip addr +Cannot open netlink socket: Address family not supported by protocol + +A fix or an workaround would be awesome. + +note: we are also working with a embedded arm distro which has no package manager available, would be nice if the workaround would not depend on apt-get \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1581796 b/results/classifier/mode-deepseek-r1:32b/output/system/1581796 new file mode 100644 index 00000000..79aac6e7 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1581796 @@ -0,0 +1,15 @@ + + +console-gl.c:96:surface_gl_create_texture:code should not be reached + +Facing this if i enable gtk,gl option same is with sd2 gl options. + +PowerPc P5020 4gb ram Ubuntu Mate 16:04 + +tested on +RadeonSi 7750HD 2gb ddr3 +r600 6570 2gb ddr3 + + +Thanks +Luigi \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1582 b/results/classifier/mode-deepseek-r1:32b/output/system/1582 new file mode 100644 index 00000000..650d20dd --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1582 @@ -0,0 +1,3 @@ + + +Floating-point-exception in rtl8139_cplus_transmit_one diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1584 b/results/classifier/mode-deepseek-r1:32b/output/system/1584 new file mode 100644 index 00000000..63577154 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1584 @@ -0,0 +1,3 @@ + + +TCP Previous segment not captured diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1586 b/results/classifier/mode-deepseek-r1:32b/output/system/1586 new file mode 100644 index 00000000..5881e61e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1586 @@ -0,0 +1,109 @@ + + +qemu-8.0.0-rc3 mock build test stage failures +Description of problem: +https://bugzilla.redhat.com/show_bug.cgi?id=2185288 +Following files have been attached to that report +Attached : +- The rpmuild SPEC file so far (qemu.spec.20230408.v3.txt) +- testlog.20230408.v3.txt +- build.log.20230408.v3.txt +- hw_info.log.20230408.v3.txt +- installed_pkgs.log.20230408.v3.txt +- root.log.20230408.v3.txt +- state.log.20230408.v3.txt + +A number of test failure involving allwinner-i2c and pci_expander_bridge + +``` +Summary of Failures: + + 39/817 qemu:qtest+qtest-aarch64 / qtest-aarch64/test-hmp ERROR 32.55s killed by signal 6 SIGABRT + 41/817 qemu:qtest+qtest-arm / qtest-arm/test-hmp ERROR 34.48s killed by signal 6 SIGABRT + 1/817 qemu:qtest+qtest-aarch64 / qtest-aarch64/qom-test ERROR 210.93s killed by signal 6 SIGABRT + 3/817 qemu:qtest+qtest-arm / qtest-arm/qom-test ERROR 212.50s killed by signal 6 SIGABRT + 45/817 qemu:qtest+qtest-i386 / qtest-i386/bios-tables-test ERROR 272.50s killed by signal 6 SIGABRT + 68/817 qemu:qtest+qtest-x86_64 / qtest-x86_64/bios-tables-test ERROR 286.06s killed by signal 6 SIGABRT +230/817 qemu:qtest+qtest-aarch64 / qtest-aarch64/device-introspect-test ERROR 8.92s killed by signal 6 SIGABRT +270/817 qemu:qtest+qtest-arm / qtest-arm/device-introspect-test ERROR 5.95s killed by signal 6 SIGABRT +337/817 qemu:qtest+qtest-i386 / qtest-i386/cxl-test ERROR 0.90s killed by signal 6 SIGABRT +630/817 qemu:qtest+qtest-x86_64 / qtest-x86_64/cxl-test ERROR 0.84s killed by signal 6 SIGABRT + +Ok: 737 +Expected Fail: 0 +Fail: 10 +Unexpected Pass: 0 +Skipped: 70 +Timeout: 0 + +``` + +The below includes a last line of log snippet for each failure +``` + + 39/817 qemu:qtest+qtest-aarch64 / qtest-aarch64/test-hmp ERROR 32.55s killed by signal 6 SIGABRT + /builddir/build/BUILD/qemu-8.0.0/include/hw/i2c/allwinner-i2c.h:35:AW_I2C: Object 0x7fec734903a0 is not an instance of type allwinner.i2c +Broken pipe +../tests/qtest/libqtest.c:193: kill_qemu() detected QEMU death from signal 6 (Aborted) (core dumped) + + + 41/817 qemu:qtest+qtest-arm / qtest-arm/test-hmp ERROR 34.48s killed by signal 6 SIGABRT +/builddir/build/BUILD/qemu-8.0.0/include/hw/i2c/allwinner-i2c.h:35:AW_I2C: Object 0x55e683992440 is not an instance of type allwinner.i2c +Broken pipe +../tests/qtest/libqtest.c:193: kill_qemu() detected QEMU death from signal 6 (Aborted) (core dumped) + + + 1/817 qemu:qtest+qtest-aarch64 / qtest-aarch64/qom-test ERROR 210.93s killed by signal 6 SIGABRT +/builddir/build/BUILD/qemu-8.0.0/include/hw/i2c/allwinner-i2c.h:35:AW_I2C: Object 0x7fbddaf123a0 is not an instance of type allwinner.i2c +Broken pipe +../tests/qtest/libqtest.c:193: kill_qemu() detected QEMU death from signal 6 (Aborted) (core dumped) + + + 3/817 qemu:qtest+qtest-arm / qtest-arm/qom-test ERROR 212.50s killed by signal 6 SIGABRT +/builddir/build/BUILD/qemu-8.0.0/include/hw/i2c/allwinner-i2c.h:35:AW_I2C: Object 0x55c346ae4440 is not an instance of type allwinner.i2c +Broken pipe +../tests/qtest/libqtest.c:193: kill_qemu() detected QEMU death from signal 6 (Aborted) (core dumped) + +45/817 qemu:qtest+qtest-i386 / qtest-i386/bios-tables-test ERROR 272.50s killed by signal 6 SIGABRT +../hw/pci-bridge/pci_expander_bridge.c:54:PXB_DEV: Object 0x5636d9f16fa0 is not an instance of type pxb +Broken pipe +../tests/qtest/libqtest.c:193: kill_qemu() detected QEMU death from signal 6 (Aborted) (core dumped) + + +68/817 qemu:qtest+qtest-x86_64 / qtest-x86_64/bios-tables-test ERROR 286.06s killed by signal 6 SIGABRT +../hw/pci-bridge/pci_expander_bridge.c:54:PXB_DEV: Object 0x55e0736d8e20 is not an instance of type pxb +Broken pipe +../tests/qtest/libqtest.c:193: kill_qemu() detected QEMU death from signal 6 (Aborted) (core dumped) + +230/817 qemu:qtest+qtest-aarch64 / qtest-aarch64/device-introspect-test ERROR 8.92s killed by signal 6 SIGABRT +/builddir/build/BUILD/qemu-8.0.0/include/hw/i2c/allwinner-i2c.h:35:AW_I2C: Object 0x55ab62324420 is not an instance of type allwinner.i2c +Broken pipe +../tests/qtest/libqtest.c:193: kill_qemu() detected QEMU death from signal 6 (Aborted) (core dumped) + + +270/817 qemu:qtest+qtest-arm / qtest-arm/device-introspect-test ERROR 5.95s killed by signal 6 SIGABRT +----------------------------------- stderr ----------------------------------- +/builddir/build/BUILD/qemu-8.0.0/include/hw/i2c/allwinner-i2c.h:35:AW_I2C: Object 0x564fbf62ee90 is not an instance of type allwinner.i2c +Broken pipe +../tests/qtest/libqtest.c:193: kill_qemu() detected QEMU death from signal 6 (Aborted) (core dumped) + + + +337/817 qemu:qtest+qtest-i386 / qtest-i386/cxl-test ERROR 0.90s killed by signal 6 SIGABRT +../hw/pci-bridge/pci_expander_bridge.c:54:PXB_DEV: Object 0x55c66482d5f0 is not an instance of type pxb +Broken pipe +../tests/qtest/libqtest.c:193: kill_qemu() detected QEMU death from signal 6 (Aborted) (core dumped) + +630/817 qemu:qtest+qtest-x86_64 / qtest-x86_64/cxl-test ERROR 0.84s killed by signal 6 SIGABRT +../hw/pci-bridge/pci_expander_bridge.c:54:PXB_DEV: Object 0x5634e6278170 is not an instance of type pxb +Broken pipe +../tests/qtest/libqtest.c:193: kill_qemu() detected QEMU death from signal 6 (Aborted) (core dumped) +``` +Steps to reproduce: +1. Populate rpmbuild folders with ```rpm -i qemu-7.2.0-7.fc39.srpm``` from https://koji.fedoraproject.org/koji/packageinfo?packageID=3685 +2. Download to ```~/rpmbuild/SOURCES/qemu-8.0.0.tar.xz``` from ```https://download.qemu.org/qemu-8.0.0-rc3.tar.xz``` +3. craft ```~/SPECS/qemu.spec``` for qemu-8.0.0-rc3 (or download attachment of bugzilla bug) +4. recreate new qemu-8.0.0 srpm ```rpmbuild -bs SPECS/qemu.spec``` +5. run ```mock -r /etc/mock/fedora-38-x86_64.cfg --rebuild ~/rpmbuild/SRPMS/qemu-8.0.0-0.fc38.src.rpm``` +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1586756 b/results/classifier/mode-deepseek-r1:32b/output/system/1586756 new file mode 100644 index 00000000..20ba01e1 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1586756 @@ -0,0 +1,54 @@ + + +"-serial unix:" option of qemu-system-arm is broken in qemu 2.6.0 + +I found a bug of "-serial unix:PATH_TO_SOCKET" in qemu 2.6.0 (qemu 2.5.1 works fine). +Occasionally, a part of the output of qemu disappears in the bug. + +It looks like following commit is the cause: + +char: ensure all clients are in non-blocking mode (Author: Daniel P. Berrange <email address hidden>) +http://git.qemu.org/?p=qemu.git;a=commitdiff;h=64c800f808748522727847b9cdc73412f22dffb9 + +In this commit, UNIX socket is set to non-blocking mode, but qemu_chr_fe_write function doesn't handle EAGAIN. +You should fix code like that: + +--- +diff --git a/qemu-char.c b/qemu-char.c +index b597ee1..0361d78 100644 +--- a/qemu-char.c ++++ b/qemu-char.c +@@ -270,6 +270,7 @@ static int qemu_chr_fe_write_buffer(CharDriverState *s, const uint8_t *buf, int + int qemu_chr_fe_write(CharDriverState *s, const uint8_t *buf, int len) + { + int ret; ++ int offset = 0; + + if (s->replay && replay_mode == REPLAY_MODE_PLAY) { + int offset; +@@ -280,7 +281,21 @@ int qemu_chr_fe_write(CharDriverState *s, const uint8_t *buf, int len) + } + + qemu_mutex_lock(&s->chr_write_lock); +- ret = s->chr_write(s, buf, len); ++ ++ while (offset < len) { ++ retry: ++ ret = s->chr_write(s, buf, len); ++ if (ret < 0 && errno == EAGAIN) { ++ g_usleep(100); ++ goto retry; ++ } ++ ++ if (ret <= 0) { ++ break; ++ } ++ ++ offset += ret; ++ } + + if (ret > 0) { + qemu_chr_fe_write_log(s, buf, ret); +--- + +Or please do "git revert 64c800f808748522727847b9cdc73412f22dffb9". \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1587 b/results/classifier/mode-deepseek-r1:32b/output/system/1587 new file mode 100644 index 00000000..195e9f46 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1587 @@ -0,0 +1,27 @@ + + +Invalid memory access allowed (possibly due to TLB bypassing PMP after mret) +Description of problem: +A load instruction that should be blocked by PMP due to MPRV changing the effective privilege mode to U is allowed. The sequence that I observed was: + + +1. Be in machine mode. +2. Set MPP to U (0). +3. Set MPRV to 1. +4. Enter an ISR, setting MPP to M (3). +5. Load from address xxxx (populating the QEMU TLB). +6. Execute mret, setting MPP back to U (0). +7. Load from address xxxx, which should fail but succeeds without any TLB fill. +Steps to reproduce: +``` +git clone https://github.com/dreiss/qemu_pmp_repro +cd qemu_pmp_repro +./build_and_run.sh +``` +The `build_and_run.sh` script expects `riscv-none-elf-gcc` and `qemu-system-riscv64` on PATH. It will also attempt to run the reproducer with `spike`, the reference RISC-V emulator, which succeeds. +Additional information: +Adding a call to `tlb_flush` to `helper_mret` causes this test to pass in QEMU, but I don't know if that's a valid fix. + +Output from `build_and_run.sh`: + +[output.txt](/uploads/108547bcb160a8f0bfffe72ea77b215f/output.txt) diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/159 b/results/classifier/mode-deepseek-r1:32b/output/system/159 new file mode 100644 index 00000000..76d80326 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/159 @@ -0,0 +1,3 @@ + + +qemu-nbd -l and -s options don't work together diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1590 b/results/classifier/mode-deepseek-r1:32b/output/system/1590 new file mode 100644 index 00000000..934586c1 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1590 @@ -0,0 +1,123 @@ + + +Regression: ARMv8M secure mode debugging non-functional since ~v7.2.0 +Description of problem: +Prior to qemu commit 4a35855682cebb89f9630b07aa9fd37c4e8c733b, both semihosting printf calls and debugging via gdb work as expected. + +Builds of qemu containing commit 4a35855682cebb89f9630b07aa9fd37c4e8c733b do not produce any semihosting output and are not debuggable via gdb. +Steps to reproduce: +1. Run ``qemu-system-arm -machine mps2-an505 -nographic -semihosting -kernel build/mps2_an505_cm33_blink_demo.elf`` with qemu v7.1.0, note the "blinking" print to the console once a second. +2. Run ``qemu-system-arm -machine mps2-an505 -nographic -semihosting -kernel build/mps2_an505_cm33_blink_demo.elf`` with qemu v7.2.0, note that no messages are printed to the console. +3. Run ``qemu-system-arm -machine mps2-an505 -nographic -semihosting -kernel build/mps2_an505_cm33_blink_demo.elf -S -s`` and attach gdb with the following gdbinit file. +Additional information: +Log of successful gdb session with the attached patch on top of qemu master branch: +``` +% arm-none-eabi-gdb build/mps2_an505_cm33_blink_demo.elf +GNU gdb (Arm GNU Toolchain 12.2.MPACBTI-Rel1 (Build arm-12-mpacbti.34)) 13.1.90.20230307-git +Copyright (C) 2023 Free Software Foundation, Inc. +License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> +This is free software: you are free to change and redistribute it. +There is NO WARRANTY, to the extent permitted by law. +Type "show copying" and "show warranty" for details. +This GDB was configured as "--host=x86_64-apple-darwin19.6.0 --target=arm-none-eabi". +Type "show configuration" for configuration details. +For bug reporting instructions, please see: +<https://bugs.linaro.org/>. +Find the GDB manual and other documentation resources online at: + <http://www.gnu.org/software/gdb/documentation/>. + +For help, type "help". +Type "apropos word" to search for commands related to "word"... +Reading symbols from build/mps2_an505_cm33_blink_demo.elf... +The target architecture is set to "armv8-m.main". +Reset_Handler () at /FreeRTOS/FreeRTOS/Demo/ARM_MPS/startup.c:172 +172 { +Section .privileged_functions, range 0x10000000 -- 0x10008000: matched. +Section .text, range 0x10008000 -- 0x10019c18: matched. +Section .rodata, range 0x10019c18 -- 0x1001b270: matched. +Section .ARM.exidx, range 0x1001b270 -- 0x1001b278: matched. +Section .copy.table, range 0x1001b278 -- 0x1001b284: matched. +Section .data, range 0x1001b28c -- 0x1001bb90: matched. +Section .ram_vectors, range 0x1001bb90 -- 0x1001bdd0: matched. +Section .zero.table, range 0x1001b284 -- 0x1001b28c: matched. +Breakpoint 1 at 0x10009900: file /FreeRTOS/Demo/ARM_MPS/fault_handlers.c, line 494. +(gdb) s +174 asm volatile +(gdb) s +189 init_data_sections(); +(gdb) s +init_data_sections () at /FreeRTOS/FreeRTOS/Demo/ARM_MPS/startup.c:99 +99 for( pCopyTable = &__copy_table_start__; pCopyTable <= &__copy_table_end__; pCopyTable++ ) +(gdb) s +101 for( dataIndex = 0; dataIndex < pCopyTable->uxLen; dataIndex++ ) +(gdb) info locals +pCopyTable = 0x1001b278 +dataIndex = 0 +(gdb) print /x *0xE000ED08 +$1 = 0x10000000 +``` + +Log of an unsuccessful gdb session with qemu v7.2.0 +``` +pbartell@147dda7342a9 ARM_MPS % arm-none-eabi-gdb build/mps2_an505_cm33_blink_demo.elf +GNU gdb (Arm GNU Toolchain 12.2.MPACBTI-Rel1 (Build arm-12-mpacbti.34)) 13.1.90.20230307-git +Copyright (C) 2023 Free Software Foundation, Inc. +License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> +This is free software: you are free to change and redistribute it. +There is NO WARRANTY, to the extent permitted by law. +Type "show copying" and "show warranty" for details. +This GDB was configured as "--host=x86_64-apple-darwin19.6.0 --target=arm-none-eabi". +Type "show configuration" for configuration details. +For bug reporting instructions, please see: +<https://bugs.linaro.org/>. +Find the GDB manual and other documentation resources online at: + <http://www.gnu.org/software/gdb/documentation/>. + +For help, type "help". +Type "apropos word" to search for commands related to "word"... +Reading symbols from build/mps2_an505_cm33_blink_demo.elf... +The target architecture is set to "armv8-m.main". +Reset_Handler () at /FreeRTOS/FreeRTOS/Demo/ARM_MPS/startup.c:172 +172 { +Section .privileged_functions, range 0x10000000 -- 0x10008000: MIS-MATCHED! +Section .text, range 0x10008000 -- 0x10019c18: MIS-MATCHED! +Section .rodata, range 0x10019c18 -- 0x1001b270: MIS-MATCHED! +Section .ARM.exidx, range 0x1001b270 -- 0x1001b278: MIS-MATCHED! +Section .copy.table, range 0x1001b278 -- 0x1001b284: MIS-MATCHED! +Section .data, range 0x1001b28c -- 0x1001bb90: MIS-MATCHED! +Section .ram_vectors, range 0x1001bb90 -- 0x1001bdd0: MIS-MATCHED! +Section .zero.table, range 0x1001b284 -- 0x1001b28c: MIS-MATCHED! +warning: One or more sections of the target image does not match +the loaded file + +Breakpoint 1 at 0x10009900: file /FreeRTOS/FreeRTOS/Demo/ARM_MPS/fault_handlers.c, line 494. +(gdb) s +Reset_Handler () at /FreeRTOS/FreeRTOS/Demo/ARM_MPS/startup.c:174 +174 asm volatile +(gdb) s +Reset_Handler () at /FreeRTOS/FreeRTOS/Demo/ARM_MPS/startup.c:189 +189 init_data_sections(); +(gdb) s +init_data_sections () at /FreeRTOS/FreeRTOS/Demo/ARM_MPS/startup.c:95 +95 { +(gdb) s +init_data_sections () at /FreeRTOS/FreeRTOS/Demo/ARM_MPS/startup.c:99 +99 for( pCopyTable = &__copy_table_start__; pCopyTable <= &__copy_table_end__; pCopyTable++ ) +(gdb) info locals +pCopyTable = <error reading variable pCopyTable (Cannot access memory at address 0x381fffdc)> +dataIndex = <error reading variable dataIndex (Cannot access memory at address 0x381fffd8)> +(gdb) print /x *0xE000ED08 +$1 = 0x0 +(gdb) quit +``` + +.gdbinit file: +``` +set architecture armv8-m.main +target extended-remote :1234 +compare-sections +break HardFault_Handler +``` + +[mps2_an505_cm33_blink_demo.elf](/uploads/c86e086b00651a8d5392857b9e4a2c4d/mps2_an505_cm33_blink_demo.elf) +[target-arm-Fix-debugging-of-ARMv8M-Secure-code.patch](/uploads/5735d5f7d7b15dbbeb0c2d214a46c1a8/target-arm-Fix-debugging-of-ARMv8M-Secure-code.patch) diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1591 b/results/classifier/mode-deepseek-r1:32b/output/system/1591 new file mode 100644 index 00000000..f95b7f51 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1591 @@ -0,0 +1,3 @@ + + +test-mmap (4096 byte pages) on arm fails on ppc64le host diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1596160 b/results/classifier/mode-deepseek-r1:32b/output/system/1596160 new file mode 100644 index 00000000..8c0ac778 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1596160 @@ -0,0 +1,37 @@ + + +SIGSEGV in memory_region_access_valid on Sabre Lite board + +I'm trying to emulate a Sabre Lite board and booting U-Boot, but I'm encountering a SIGSEGV almost immediately after starting QEMU. + +QEMU version: 6f1d2d1c5ad20d464705b17318cb7ca495f8078a +U-Boot version: mx6qsabrelite_defconfig 2016.05 (with http://git.denx.de/?p=u-boot.git;a=commitdiff;h=1f516faa45611aedc8c2e3f303b3866f615d481e reverted, since it hangs the CPU) + +$ gdb --args ./arm-softmmu/qemu-system-arm -machine sabrelite -kernel ~/u-boot-2016.05/u-boot +GNU gdb (Ubuntu 7.7.1-0ubuntu5~14.04.2) 7.7.1 + +... + +(gdb) r +Starting program: /home/kota/qemu/build/arm-softmmu/qemu-system-arm -machine sabrelite -kernel /home/kota/u-boot-2016.05/u-boot +[Thread debugging using libthread_db enabled] +Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". +[New Thread 0x7fffe9074700 (LWP 18025)] +[New Thread 0x7fffe58c0700 (LWP 18027)] + +Program received signal SIGSEGV, Segmentation fault. +[Switching to Thread 0x7fffe58c0700 (LWP 18027)] +0x00005555557aaaa8 in memory_region_access_valid (mr=mr@entry=0x7fffe594e0e0, addr=addr@entry=0, size=size@entry=4, is_write=is_write@entry=true) at /home/kota/qemu/memory.c:1143 +1143 if (!mr->ops->valid.unaligned && (addr & (size - 1))) { +(gdb) bt +#0 0x00005555557aaaa8 in memory_region_access_valid (mr=mr@entry=0x7fffe594e0e0, addr=addr@entry=0, size=size@entry=4, is_write=is_write@entry=true) at /home/kota/qemu/memory.c:1143 +#1 0x00005555557aacbd in memory_region_dispatch_write (mr=0x7fffe594e0e0, addr=0, data=3925868734, size=4, attrs=...) at /home/kota/qemu/memory.c:1249 +#2 0x00007fffe645a4e4 in code_gen_buffer () +#3 0x0000555555778d4d in cpu_tb_exec (itb=<optimized out>, itb=<optimized out>, cpu=0x7fffe58c92e0) at /home/kota/qemu/cpu-exec.c:166 +#4 cpu_loop_exec_tb (sc=0x7fffe58bfab0, tb_exit=<synthetic pointer>, last_tb=0x7fffe58bfaa0, tb=<optimized out>, cpu=0x7fffe58c92e0) at /home/kota/qemu/cpu-exec.c:530 +#5 cpu_arm_exec (cpu=cpu@entry=0x7fffe58c1080) at /home/kota/qemu/cpu-exec.c:626 +#6 0x0000555555798a20 in tcg_cpu_exec (cpu=0x7fffe58c1080) at /home/kota/qemu/cpus.c:1541 +#7 tcg_exec_all () at /home/kota/qemu/cpus.c:1574 +#8 qemu_tcg_cpu_thread_fn (arg=<optimized out>) at /home/kota/qemu/cpus.c:1171 +#9 0x00007ffff27f1184 in start_thread (arg=0x7fffe58c0700) at pthread_create.c:312 +#10 0x00007ffff251e37d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1599539 b/results/classifier/mode-deepseek-r1:32b/output/system/1599539 new file mode 100644 index 00000000..07abba8b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1599539 @@ -0,0 +1,9 @@ + + +2.6.0: vvfat driver generates bad FAT entries + +The vvfat driver sometimes generates entries about which file system checking utilities generate complaints. + +For example, dosfsck will complain that the volume label entry has non-zero size. ScanDisk from Windows 9x complains about invalid dot (".") and dot-dot ("..") entries in directories and also about invalid long file name entries. MS-DOS ScanDisk also often manages to find "lost clusters" on the drive. + +Tangentially: qemu-img convert fat:test test.img doesn't seem to work -- it generates an 504MiB of zero bytes and hangs. qemu-img map fat:test generates an assertion failure. Having qemu-img working might have helped with debugging the above issue. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/160 b/results/classifier/mode-deepseek-r1:32b/output/system/160 new file mode 100644 index 00000000..1be1a085 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/160 @@ -0,0 +1,3 @@ + + +Record/replay example does not work diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1603636 b/results/classifier/mode-deepseek-r1:32b/output/system/1603636 new file mode 100644 index 00000000..8a743a3f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1603636 @@ -0,0 +1,147 @@ + + +Guest has not initialized the display yet on ubuntu 16.10 PPC + +Hi +tested with all kind of configure, with all kind of machine types but i have the same issue ... +on lastest quemo 2.6 "Guest has not initialized the display yet" +note with lastest git repository the situation become worst because on i386-softmmu i have the message but qemu exit alone because looklike there is not a bios + +this is gdb of i386-softmmu + +(gdb) run +Starting program: /home/amigaone/src/qemu/i386-softmmu/qemu-system-i386 +[Thread debugging using libthread_db enabled] +Using host libthread_db library "/lib/powerpc-linux-gnu/libthread_db.so.1". +[New Thread 0xf7f78b70 (LWP 25074)] +[New Thread 0xf770bb70 (LWP 25075)] +[New Thread 0xf6dfdb70 (LWP 25076)] +[New Thread 0xf65fdb70 (LWP 25077)] +[New Thread 0xf3337b70 (LWP 25078)] +[New Thread 0xe4146b70 (LWP 25087)] +qemu-system-i386: Trying to execute code outside RAM or ROM at 0x000a0000 +This usually means one of the following happened: + +(1) You told QEMU to execute a kernel for the wrong machine type, and it crashed on startup (eg trying to run a raspberry pi kernel on a versatilepb QEMU machine) +(2) You didn't give QEMU a kernel or BIOS filename at all, and QEMU executed a ROM full of no-op instructions until it fell off the end +(3) Your guest kernel has a bug and crashed by jumping off into nowhere + +This is almost always one of the first two, so check your command line and that you are using the right type of kernel for this machine. +If you think option (3) is likely then you can try debugging your guest with the -d debug options; in particular -d guest_errors will cause the log to include a dump of the guest register state at this point. + +Execution cannot continue; stopping here. + +[Thread 0xe4146b70 (LWP 25087) exited] +[Thread 0xf65fdb70 (LWP 25077) exited] +[Thread 0xf6dfdb70 (LWP 25076) exited] +[Thread 0xf770bb70 (LWP 25075) exited] +[Thread 0xf7f78b70 (LWP 25074) exited] +[Thread 0xf7f7c000 (LWP 25070) exited] +[Inferior 1 (process 25070) exited with code 01] + + +this is my ldd +ldd ./qemu-system-i386 + linux-vdso32.so.1 => (0x00100000) + libvirglrenderer.so.0 => /usr/local/lib/libvirglrenderer.so.0 (0x0ff8a000) + libepoxy.so.0 => /usr/lib/powerpc-linux-gnu/libepoxy.so.0 (0x0fe86000) + libgbm.so.1 => /usr/local/lib/libgbm.so.1 (0x0fe55000) + libX11.so.6 => /usr/lib/powerpc-linux-gnu/libX11.so.6 (0x0fcf2000) + libz.so.1 => /lib/powerpc-linux-gnu/libz.so.1 (0x0fcb1000) + libcurl-gnutls.so.4 => /usr/lib/powerpc-linux-gnu/libcurl-gnutls.so.4 (0x0fc10000) + libssh2.so.1 => /usr/lib/powerpc-linux-gnu/libssh2.so.1 (0x0fbbf000) + libbz2.so.1.0 => /lib/powerpc-linux-gnu/libbz2.so.1.0 (0x0fb7e000) + libpixman-1.so.0 => /usr/lib/powerpc-linux-gnu/libpixman-1.so.0 (0x0fadd000) + libutil.so.1 => /lib/powerpc-linux-gnu/libutil.so.1 (0x0faac000) + libnuma.so.1 => /usr/lib/powerpc-linux-gnu/libnuma.so.1 (0x0fa79000) + libncurses.so.5 => /lib/powerpc-linux-gnu/libncurses.so.5 (0x0fa28000) + libtinfo.so.5 => /lib/powerpc-linux-gnu/libtinfo.so.5 (0x0f9d7000) + libuuid.so.1 => /lib/powerpc-linux-gnu/libuuid.so.1 (0x0f9a6000) + libpng16.so.16 => /usr/lib/powerpc-linux-gnu/libpng16.so.16 (0x0f945000) + libjpeg.so.8 => /usr/lib/powerpc-linux-gnu/libjpeg.so.8 (0x0f8d4000) + libSDL2-2.0.so.0 => /usr/local/lib/libSDL2-2.0.so.0 (0x0f77d000) + libnettle.so.6 => /usr/lib/powerpc-linux-gnu/libnettle.so.6 (0x0f71c000) + libgnutls.so.30 => /usr/lib/powerpc-linux-gnu/libgnutls.so.30 (0x0f5ca000) + libgtk-x11-2.0.so.0 => /usr/lib/powerpc-linux-gnu/libgtk-x11-2.0.so.0 (0x0f0e6000) + libgdk-x11-2.0.so.0 => /usr/lib/powerpc-linux-gnu/libgdk-x11-2.0.so.0 (0x0f005000) + libcairo.so.2 => /usr/lib/powerpc-linux-gnu/libcairo.so.2 (0x0eec3000) + libgdk_pixbuf-2.0.so.0 => /usr/lib/powerpc-linux-gnu/libgdk_pixbuf-2.0.so.0 (0x0ee72000) + libgobject-2.0.so.0 => /usr/lib/powerpc-linux-gnu/libgobject-2.0.so.0 (0x0edf1000) + libglib-2.0.so.0 => /lib/powerpc-linux-gnu/libglib-2.0.so.0 (0x0eca0000) + libsnappy.so.1 => /usr/lib/powerpc-linux-gnu/libsnappy.so.1 (0x0ec6f000) + libusb-1.0.so.0 => /lib/powerpc-linux-gnu/libusb-1.0.so.0 (0x0ec2e000) + librt.so.1 => /lib/powerpc-linux-gnu/librt.so.1 (0x0ebfd000) + libm.so.6 => /lib/powerpc-linux-gnu/libm.so.6 (0x0eb0c000) + libgcc_s.so.1 => /lib/powerpc-linux-gnu/libgcc_s.so.1 (0x0eacb000) + libpthread.so.0 => /lib/powerpc-linux-gnu/libpthread.so.0 (0x0ea88000) + libc.so.6 => /lib/powerpc-linux-gnu/libc.so.6 (0x0e8d4000) + libdrm.so.2 => /usr/lib/powerpc-linux-gnu/libdrm.so.2 (0x0e8a3000) + libdl.so.2 => /lib/powerpc-linux-gnu/libdl.so.2 (0x0e872000) + libexpat.so.1 => /lib/powerpc-linux-gnu/libexpat.so.1 (0x0e821000) + libxcb.so.1 => /usr/lib/powerpc-linux-gnu/libxcb.so.1 (0x0e7e0000) + libidn.so.11 => /lib/powerpc-linux-gnu/libidn.so.11 (0x0e77f000) + librtmp.so.1 => /usr/lib/powerpc-linux-gnu/librtmp.so.1 (0x0e73e000) + libgssapi_krb5.so.2 => /usr/lib/powerpc-linux-gnu/libgssapi_krb5.so.2 (0x0e6cd000) + liblber-2.4.so.2 => /usr/lib/powerpc-linux-gnu/liblber-2.4.so.2 (0x0e69c000) + libldap_r-2.4.so.2 => /usr/lib/powerpc-linux-gnu/libldap_r-2.4.so.2 (0x0e61a000) + libgcrypt.so.20 => /lib/powerpc-linux-gnu/libgcrypt.so.20 (0x0e527000) + /lib/ld.so.1 (0x200a9000) + libsndio.so.6.1 => /usr/lib/powerpc-linux-gnu/libsndio.so.6.1 (0x0e4f4000) + libp11-kit.so.0 => /usr/lib/powerpc-linux-gnu/libp11-kit.so.0 (0x0e473000) + libtasn1.so.6 => /usr/lib/powerpc-linux-gnu/libtasn1.so.6 (0x0e432000) + libhogweed.so.4 => /usr/lib/powerpc-linux-gnu/libhogweed.so.4 (0x0e3d1000) + libgmp.so.10 => /usr/lib/powerpc-linux-gnu/libgmp.so.10 (0x0e330000) + libgmodule-2.0.so.0 => /usr/lib/powerpc-linux-gnu/libgmodule-2.0.so.0 (0x0e2ff000) + libpangocairo-1.0.so.0 => /usr/lib/powerpc-linux-gnu/libpangocairo-1.0.so.0 (0x0e2ce000) + libXfixes.so.3 => /usr/lib/powerpc-linux-gnu/libXfixes.so.3 (0x0e29d000) + libatk-1.0.so.0 => /usr/lib/powerpc-linux-gnu/libatk-1.0.so.0 (0x0e24c000) + libgio-2.0.so.0 => /usr/lib/powerpc-linux-gnu/libgio-2.0.so.0 (0x0e05a000) + libpangoft2-1.0.so.0 => /usr/lib/powerpc-linux-gnu/libpangoft2-1.0.so.0 (0x0e019000) + libpango-1.0.so.0 => /usr/lib/powerpc-linux-gnu/libpango-1.0.so.0 (0x0dfa8000) + libfontconfig.so.1 => /usr/lib/powerpc-linux-gnu/libfontconfig.so.1 (0x0df33000) + libXrender.so.1 => /usr/lib/powerpc-linux-gnu/libXrender.so.1 (0x0df02000) + libXinerama.so.1 => /usr/lib/powerpc-linux-gnu/libXinerama.so.1 (0x0dedf000) + libXi.so.6 => /usr/lib/powerpc-linux-gnu/libXi.so.6 (0x0de9e000) + libXrandr.so.2 => /usr/lib/powerpc-linux-gnu/libXrandr.so.2 (0x0de6d000) + libXcursor.so.1 => /usr/lib/powerpc-linux-gnu/libXcursor.so.1 (0x0de42000) + libXcomposite.so.1 => /usr/lib/powerpc-linux-gnu/libXcomposite.so.1 (0x0de1f000) + libXdamage.so.1 => /usr/lib/powerpc-linux-gnu/libXdamage.so.1 (0x0ddfc000) + libXext.so.6 => /usr/lib/powerpc-linux-gnu/libXext.so.6 (0x0ddc8000) + libfreetype.so.6 => /usr/lib/powerpc-linux-gnu/libfreetype.so.6 (0x0dcf7000) + libxcb-shm.so.0 => /usr/lib/powerpc-linux-gnu/libxcb-shm.so.0 (0x0dcc6000) + libxcb-render.so.0 => /usr/lib/powerpc-linux-gnu/libxcb-render.so.0 (0x0dc95000) + libffi.so.6 => /usr/lib/powerpc-linux-gnu/libffi.so.6 (0x0dc64000) + libpcre.so.3 => /lib/powerpc-linux-gnu/libpcre.so.3 (0x0dbd3000) + libstdc++.so.6 => /usr/lib/powerpc-linux-gnu/libstdc++.so.6 (0x0d9df000) + libudev.so.1 => /lib/powerpc-linux-gnu/libudev.so.1 (0x0d99d000) + libXau.so.6 => /usr/lib/powerpc-linux-gnu/libXau.so.6 (0x0d979000) + libXdmcp.so.6 => /usr/lib/powerpc-linux-gnu/libXdmcp.so.6 (0x0d948000) + libkrb5.so.3 => /usr/lib/powerpc-linux-gnu/libkrb5.so.3 (0x0d857000) + libk5crypto.so.3 => /usr/lib/powerpc-linux-gnu/libk5crypto.so.3 (0x0d806000) + libcom_err.so.2 => /lib/powerpc-linux-gnu/libcom_err.so.2 (0x0d7d5000) + libkrb5support.so.0 => /usr/lib/powerpc-linux-gnu/libkrb5support.so.0 (0x0d7a4000) + libresolv.so.2 => /lib/powerpc-linux-gnu/libresolv.so.2 (0x0d761000) + libsasl2.so.2 => /usr/lib/powerpc-linux-gnu/libsasl2.so.2 (0x0d720000) + libgssapi.so.3 => /usr/lib/powerpc-linux-gnu/libgssapi.so.3 (0x0d6be000) + libgpg-error.so.0 => /lib/powerpc-linux-gnu/libgpg-error.so.0 (0x0d67d000) + libasound.so.2 => /usr/lib/powerpc-linux-gnu/libasound.so.2 (0x0d54c000) + libbsd.so.0 => /lib/powerpc-linux-gnu/libbsd.so.0 (0x0d50b000) + libselinux.so.1 => /lib/powerpc-linux-gnu/libselinux.so.1 (0x0d4b9000) + libharfbuzz.so.0 => /usr/lib/powerpc-linux-gnu/libharfbuzz.so.0 (0x0d408000) + libthai.so.0 => /usr/lib/powerpc-linux-gnu/libthai.so.0 (0x0d3d7000) + libkeyutils.so.1 => /lib/powerpc-linux-gnu/libkeyutils.so.1 (0x0d3a6000) + libheimntlm.so.0 => /usr/lib/powerpc-linux-gnu/libheimntlm.so.0 (0x0d375000) + libkrb5.so.26 => /usr/lib/powerpc-linux-gnu/libkrb5.so.26 (0x0d2c3000) + libasn1.so.8 => /usr/lib/powerpc-linux-gnu/libasn1.so.8 (0x0d201000) + libhcrypto.so.4 => /usr/lib/powerpc-linux-gnu/libhcrypto.so.4 (0x0d19f000) + libroken.so.18 => /usr/lib/powerpc-linux-gnu/libroken.so.18 (0x0d15e000) + libgraphite2.so.3 => /usr/lib/powerpc-linux-gnu/libgraphite2.so.3 (0x0d10d000) + libdatrie.so.1 => /usr/lib/powerpc-linux-gnu/libdatrie.so.1 (0x0d0dc000) + libwind.so.0 => /usr/lib/powerpc-linux-gnu/libwind.so.0 (0x0d08b000) + libheimbase.so.1 => /usr/lib/powerpc-linux-gnu/libheimbase.so.1 (0x0d05a000) + libhx509.so.5 => /usr/lib/powerpc-linux-gnu/libhx509.so.5 (0x0cfe8000) + libsqlite3.so.0 => /usr/lib/powerpc-linux-gnu/libsqlite3.so.0 (0x0ceb6000) + libcrypt.so.1 => /lib/powerpc-linux-gnu/libcrypt.so.1 (0x0ce5e000) + + +Thanks \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1609 b/results/classifier/mode-deepseek-r1:32b/output/system/1609 new file mode 100644 index 00000000..a64f8885 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1609 @@ -0,0 +1,21 @@ + + +SPARC emulation: userspace program run from gdb crashes OS running in emulator +Description of problem: +SPARC emulation: userspace program run from gdb crashes OS running in emulator +Steps to reproduce: +As a user (not root!): +1. as -Q n -K PIC -b -L mandelbrot.s +2. ld -m a.out -o test +3. gdb ./test +4. run + +`as' is from gnu binutils (binutils-2.20.1-sol26-sparc-local.gz). +Additional information: +[mandelbrot.s](/uploads/edfe6f1fd01fa39ecce9ba4201454ae3/mandelbrot.s) + +screenshot: https://imgur.com/a/JD51DJA + +It could very well be a bug in my assembly code, but it is still strange that it crashes the whole system. + +~"kind::Bug"[in_asm.dat.xz](/uploads/6bb43ce2b7d6973da4751d236fb44e12/in_asm.dat.xz) diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1611 b/results/classifier/mode-deepseek-r1:32b/output/system/1611 new file mode 100644 index 00000000..a273bb74 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1611 @@ -0,0 +1,3 @@ + + +How to test rutabaga_gfx/gfxstream patches diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1616 b/results/classifier/mode-deepseek-r1:32b/output/system/1616 new file mode 100644 index 00000000..d8767d2e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1616 @@ -0,0 +1,3 @@ + + +convd on arm tcg test fails on arm64 (Apple M1) diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1619 b/results/classifier/mode-deepseek-r1:32b/output/system/1619 new file mode 100644 index 00000000..7a7ce4b0 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1619 @@ -0,0 +1,3 @@ + + +Emulate x86_64 on ARM machine diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/162 b/results/classifier/mode-deepseek-r1:32b/output/system/162 new file mode 100644 index 00000000..0fd59f62 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/162 @@ -0,0 +1,3 @@ + + +util/path.c/follow_path() does not handle "/" well diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1623 b/results/classifier/mode-deepseek-r1:32b/output/system/1623 new file mode 100644 index 00000000..46cb6eb3 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1623 @@ -0,0 +1,11 @@ + + +vec_lde and vec_expte semi-randomly produce the wrong results +Description of problem: +I found that while implementing the Altivec support for the rust [stdarch](https://github.com/rust-lang/stdarch). +Steps to reproduce: +1. Install rust nightly (e.g. using https://rustup.rs/) +2. `git clone https://github.com/rust-lang/stdarch` +3. You need to either cross compile or compile and run the tests for `crates/core_arch`. +Additional information: +Both `valgrind` and running on power9 produce the correct results diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1625295 b/results/classifier/mode-deepseek-r1:32b/output/system/1625295 new file mode 100644 index 00000000..c932f026 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1625295 @@ -0,0 +1,10 @@ + + +qemu-arm dies with libarmmem inside ld.so.preload + +When running raspbian inside qemu,the user has to first comment out the following line from /etc/ld.so.conf: + +/usr/lib/arm-linux-gnueabihf/libarmmem.so + + +Will future qemus will be able to work without changine /etc/ld.so.conf ? \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1628 b/results/classifier/mode-deepseek-r1:32b/output/system/1628 new file mode 100644 index 00000000..3efc2bd4 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1628 @@ -0,0 +1,132 @@ + + +windows 10 display scale will cause an exception +Description of problem: +windows dispaly sacle 150% or higher, windows system will exception +Steps to reproduce: +1. windows dispaly sacle 150% +Additional information: +- code in: qemu/hw/display/qxl-render.c + +static void qxl_unpack_chunks(void *dest, size_t size, PCIQXLDevice *qxl, + QXLDataChunk *chunk, uint32_t group_id) +{ + uint32_t max_chunks = 32; + size_t offset = 0; + size_t bytes; + for (;;) { + bytes = MIN(size - offset, chunk->data_size); + memcpy(dest + offset, chunk->data, bytes); + offset += bytes; + if (offset == size) { + return; + } + chunk = qxl_phys2virt(qxl, chunk->next_chunk, group_id, + sizeof(QXLDataChunk) + chunk->data_size); + **// get next chunk, but the chunk size use current chunk's data size, not next chunk's data size!!!!** + **// if next chunk alloc size < current chunk's data size, there will be exception ** + + if (!chunk) { + return; + } + max_chunks--; + if (max_chunks == 0) { + return; + } + } +} + + + +- code in: qxl_wddm_dod/QXLDod.cpp exist next chunk alloc size < current chunk's data size + +NTSTATUS QxlDevice::SetPointerShape(_In_ CONST DXGKARG_SETPOINTERSHAPE* pSetPointerShape) +{ +..... + res = (Resource *)AllocMem(MSPACE_TYPE_VRAM, CURSOR_ALLOC_SIZE, TRUE); // here we all the first QXLDataChunk , and alloc_size = (CURSOR_ALLOC_SIZE - sizeof(Resource) - sizeof(InternalCursor)) = 8118 + +..... + for (; src != src_end; src += pSetPointerShape->Pitch) { + if (!PutBytesAlign(&chunk, &now, &end, src, line_size, PAGE_SIZE - PAGE_SIZE % line_size, NULL)) { // in this function ,we will alloc next QXLDataChunk + .......... + break; + } + } +} + +BOOLEAN QxlDevice::PutBytesAlign(QXLDataChunk **chunk_ptr, UINT8 **now_ptr, + UINT8 **end_ptr, UINT8 *src, int size, + size_t alloc_size, PLIST_ENTRY pDelayed) +{ + ..... + size_t maxAllocSize = BITS_BUF_MAX - BITS_BUF_MAX % size; + alloc_size = MIN(alloc_size, maxAllocSize); + void *ptr = AllocMem(MSPACE_TYPE_VRAM, alloc_size + sizeof(QXLDataChunk), bForced); *** //here will alloc next QXLDataChunk and alloc_size = (PAGE_SIZE - PAGE_SIZE % line_size) = 3876 **** +} + + +eg: +dispaly sacle 150% ，mouse size will bu change to 57* 55 ，rgba data size = 12540, we need three QXLDataChunk + +QXLDataChunk* first; +first->data_size = 8118; +first->prev_chunk = 0; +first->next_chunk=second; +first->data = [alloc_size(8118), data_size(8118)] + +QXLDataChunk* second; +second->data_size = 3876; +second->prev_chunk = first; +second->next_chunk=third; +second->data = [alloc_size(3876), data_size(3876)] + +QXLDataChunk* third; +third->data_size = 546; +third->prev_chunk =second; +third->next_chunk=0; +third->data = [alloc_size(3876), data_size(546)] + + +chunk = first; +qxl_phys2virt(qxl, second, group_id, sizeof(QXLDataChunk) + 8118) + + +this size [sizeof(QXLDataChunk) + 8118] > second QXLDataChunk's alloc size , will cause qxl_get_check_slot_offset check fail + + +for second QXLDataChunk, we actual alloc size is (sizeof(QXLDataChunk) + 3876), but we assign (8118 + sizeof(QXLDataChunk)) will cause an exception + + +suggest code : + +static void qxl_unpack_chunks(void *dest, size_t size, PCIQXLDevice *qxl, + QXLDataChunk *chunk, uint32_t group_id) +{ + uint32_t max_chunks = 32; + size_t offset = 0; + size_t bytes; + QXLPHYSICAL next_chunk_phys = 0; + for (;;) { + bytes = MIN(size - offset, chunk->data_size); + memcpy(dest + offset, chunk->data, bytes); + offset += bytes; + if (offset == size) { + return; + } + next_chunk_phys = chunk->next_chunk; + chunk = qxl_phys2virt(qxl, next_chunk_phys, group_id, + sizeof(QXLDataChunk)); // fist time, only get the next chunk's data size; + if (!chunk) { + return; + } + chunk = qxl_phys2virt(qxl, next_chunk_phys, group_id, + sizeof(QXLDataChunk) + chunk->data_size); // second time, check data size and get data; + if (!chunk) { + return; + } + max_chunks--; + if (max_chunks == 0) { + return; + } + } +} diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/163 b/results/classifier/mode-deepseek-r1:32b/output/system/163 new file mode 100644 index 00000000..7f6284d4 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/163 @@ -0,0 +1,3 @@ + + +SPICE session's connection_id's are not unique diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1631625 b/results/classifier/mode-deepseek-r1:32b/output/system/1631625 new file mode 100644 index 00000000..c7179659 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1631625 @@ -0,0 +1,17 @@ + + +target-mips/dsp_helper.c: two possible bad shifts + +target-mips/dsp_helper.c:3480:1: error: V629 Consider inspecting the '0x01 << (size + 1)' expression. Bit shifting of the 32-bit value with a subsequent expansion to the 64-bit type. + +Source code is + + temp = temp & ((0x01 << (size + 1)) - 1); + +If size >= 32, then better code might be + + temp = temp & ((0x01UL << (size + 1)) - 1); + +target-mips/dsp_helper.c:3509:1: error: V629 Consider inspecting the '0x01 << (size + 1)' expression. Bit shifting of the 32-bit value with a subsequent expansion to the 64-bit type. + +Duplicate \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1632 b/results/classifier/mode-deepseek-r1:32b/output/system/1632 new file mode 100644 index 00000000..c4d00c56 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1632 @@ -0,0 +1,492 @@ + + +Porting support for GVM/AEHD to qemu 8.0 +Description of problem: +I'm trying to find reason why changes work fine with qemu 7.1 but it doesn't work with qemu 7.2 and 8.0. Could you recommend me point where I should investigate this bug/error when using GVM acceleration. I know it is not part of official QEMU and somebody is also working on that [topic ](https://gitlab.com/qemu-project/qemu/-/issues/1558). + + +``` +GVM is operational +** +ERROR:../util/qemu-thread-win32.c:207:qemu_sem_post: assertion failed: (sem->initialized) +** +ERROR:../util/qemu-thread-win32.c:207:qemu_sem_post: assertion failed: (sem->initialized) +Bail out! ERROR:../util/qemu-thread-win32.c:207:qemu_sem_post: assertion failed: (sem->initialized) +** +ERROR:../util/qemu-thread-win32.c:207:qemu_sem_post: assertion failed: (sem->initialized)Bail out! ERROR:../util/qemu-thread-win32.c:207:qemu_sem_post: assertion failed: (sem->initialized) + +** +ERROR:../util/qemu-thread-win32.c:207:qemu_sem_post: assertion failed: (sem->initialized) +Bail out! ERROR:../util/qemu-thread-win32.c:207:qemu_sem_post: assertion failed: (sem->initialized) +** +ERROR:../util/qemu-thread-win32.c:207:qemu_sem_post: assertion failed: (sem->initialized) +Bail out! ERROR:../util/qemu-thread-win32.c:207:qemu_sem_post: assertion failed: (sem->initialized) +** +ERROR:../util/qemu-thread-win32.c:207:qemu_sem_post: assertion failed: (sem->initialized)Bail out! ERROR:../util/qemu-thread-win32.c:207:qemu_sem_post: assertion failed: (sem->initialized) + +** +ERROR:../util/qemu-thread-win32.c:207:qemu_sem_post: assertion failed: (sem->initialized)Bail out! ERROR:../util/qemu-thread-win32.c:207:qemu_sem_post: assertion failed: (sem->initialized) + +** +ERROR:../util/qemu-thread-win32.c:207:qemu_sem_post: assertion failed: (sem->initialized) +Bail out! ERROR:../util/qemu-thread-win32.c:207:qemu_sem_post: assertion failed: (sem->initialized) +** +ERROR:../util/qemu-thread-win32.c:207:qemu_sem_post: assertion failed: (sem->initialized)Bail out! ERROR:../util/qemu-thread-win32.c:207:qemu_sem_post: assertion failed: (sem->initialized) + +** +ERROR:../util/qemu-thread-win32.c:207:qemu_sem_post: assertion failed: (sem->initialized)Bail out! ERROR:../util/qemu-thread-win32.c:207:qemu_sem_post: assertion failed: (sem->initialized) + +** +ERROR:../util/qemu-thread-win32.c:207:qemu_sem_post: assertion failed: (sem->initialized)Bail out! ERROR:../util/qemu-thread-win32.c:207:qemu_sem_post: assertion failed: (sem->initialized) + +** +ERROR:../util/qemu-thread-win32.c:207:qemu_sem_post: assertion failed: (sem->initialized)Bail out! ERROR:../util/qemu-thread-win32.c:207:qemu_sem_post: assertion failed: (sem->initialized) + +Bail out! ERROR:../util/qemu-thread-win32.c:207:qemu_sem_post: assertion failed: (sem->initialized) +``` +Steps to reproduce: +1. Checkout my fork with this branch [qemu-8.0-gvm](https://gitlab.com/MateuszKrawczuk/qemu/-/tree/qemu-8.0-gvm) +2. Build on windows using mingw64 +3. Try launch with using GVM acceleration +Additional information: +``` +./configure --enable-sdl --enable-gtk --enable-whpx --target-list=x86_64-softmmu +Using './build' as the directory for build output +ln: nie udało się utworzyć dowiązania symbolicznego 'x86_64-softmmu/qemu-system-x86_64.exe': No such file or directory +The Meson build system +Version: 0.61.5 +Source dir: C:/Users/AMD-RYZEN-PC/qemu +Build dir: C:/Users/AMD-RYZEN-PC/qemu/build +Build type: native build +Project name: qemu +Project version: 8.0.0 +C compiler for the host machine: cc -m64 -mcx16 (gcc 12.2.0 "cc (Rev10, Built by MSYS2 project) 12.2.0") +C linker for the host machine: cc -m64 -mcx16 ld.bfd 2.40 +Host machine cpu family: x86_64 +Host machine cpu: x86_64 +Program scripts/symlink-install-tree.py found: YES (C:/Users/AMD-RYZEN-PC/scoop/apps/msys2/2023-03-18/mingw64/bin/python3.exe C:/Users/AMD-RYZEN-PC/qemu/scripts/symlink-install-tree.py) +Program sh found: YES (C:\Users\AMD-RYZEN-PC\scoop\apps\msys2\2023-03-18\usr\bin/sh.EXE) +C++ compiler for the host machine: c++ -m64 -mcx16 (gcc 12.2.0 "c++ (Rev10, Built by MSYS2 project) 12.2.0") +C++ linker for the host machine: c++ -m64 -mcx16 ld.bfd 2.40 +Program python3 found: YES (C:/Users/AMD-RYZEN-PC/scoop/apps/msys2/2023-03-18/mingw64/bin/python3.exe) +Program bzip2 found: YES (C:\Users\AMD-RYZEN-PC\scoop\apps\msys2\2023-03-18\mingw64\bin/bzip2.EXE) +Program iasl found: NO +Compiler for C supports link arguments -Wl,-z,relro: NO +Compiler for C supports link arguments -Wl,-z,now: NO +Compiler for C supports link arguments -Wl,--no-seh: YES +Compiler for C supports link arguments -Wl,--nxcompat: YES +Compiler for C supports link arguments -Wl,--dynamicbase: YES +Compiler for C supports link arguments -Wl,--high-entropy-va: YES +Compiler for C++ supports link arguments -Wl,--warn-common: YES +Program cgcc found: NO +Library m found: YES +Run-time dependency threads found: YES +Library util found: NO +Program midl found: NO +Program widl found: YES +Library pathcch found: YES +Library ws2_32 found: YES +Library winmm found: YES +Windows resource compiler: GNU windres (GNU Binutils) 2.40 +Has header "WinHvPlatform.h" : YES +Has header "WinHvEmulation.h" : YES +Run-time dependency appleframeworks found: NO (tried framework) +Found pkg-config: C:\Users\AMD-RYZEN-PC\scoop\apps\msys2\2023-03-18\mingw64\bin/pkg-config.EXE (1.8.0) +Run-time dependency gio-2.0 found: YES 2.76.1 +Program C:/Users/AMD-RYZEN-PC/scoop/apps/msys2/2023-03-18/mingw64/bin/gdbus-codegen found: YES (C:/Users/AMD-RYZEN-PC/scoop/apps/msys2/2023-03-18/mingw64/bin/gdbus-codegen.exe) +Run-time dependency gio-unix-2.0 found: NO (tried pkgconfig) +Run-time dependency pixman-1 found: YES 0.42.2 +Run-time dependency zlib found: YES 1.2.13 +Has header "libaio.h" : NO +Run-time dependency liburing found: NO (tried pkgconfig) +Run-time dependency libnfs found: NO (tried pkgconfig) +Has header "attr/xattr.h" : NO +Run-time dependency appleframeworks found: NO (tried framework) +Run-time dependency appleframeworks found: NO (tried framework) +Run-time dependency libseccomp found: NO (tried pkgconfig) +Has header "cap-ng.h" : NO +Run-time dependency xkbcommon found: NO (tried pkgconfig) +Run-time dependency slirp found: YES 4.7.0 +Has header "libvdeplug.h" : NO +Run-time dependency jack found: NO (tried pkgconfig) +Run-time dependency sndio found: NO (tried pkgconfig) +Run-time dependency spice-protocol found: NO (tried pkgconfig) +Run-time dependency spice-server found: NO (tried pkgconfig) +Library rt found: NO +Run-time dependency libiscsi found: NO (tried pkgconfig) +Run-time dependency libzstd found: YES 1.5.5 +Run-time dependency virglrenderer found: YES 0.9.1 +Run-time dependency blkio found: NO (tried pkgconfig) +Run-time dependency libcurl found: NO (tried pkgconfig) +Run-time dependency ncurses found: NO (tried pkgconfig) +Run-time dependency ncursesw found: YES 6.4.20230211 +Has header "brlapi.h" : NO +Run-time dependency sdl2 found: YES 2.26.5 +Run-time dependency sdl2_image found: YES 2.6.3 +Library rados found: NO +Has header "rbd/librbd.h" : NO +Run-time dependency glusterfs-api found: NO (tried pkgconfig) +Run-time dependency libssh found: NO (tried pkgconfig) +Has header "bzlib.h" : YES +Library bz2 found: YES +Has header "lzfse.h" : NO +Has header "sys/soundcard.h" : NO +Has header "dsound.h" : YES +Run-time dependency epoxy found: YES 1.5.10 +Has header "epoxy/egl.h" with dependency epoxy: YES +Run-time dependency gbm found: NO (tried pkgconfig) +Run-time dependency gnutls found: NO (tried pkgconfig) +Run-time dependency gnutls found: NO (tried pkgconfig) +libgcrypt-config found: NO need ['>=1.8'] +Run-time dependency libgcrypt found: NO (tried config-tool) +Run-time dependency nettle found: NO (tried pkgconfig) +Run-time dependency gmp found: YES 6.2.1 +Run-time dependency gtk+-3.0 found: YES 3.24.38 +Run-time dependency gtk+-x11-3.0 found: NO (tried pkgconfig) +Run-time dependency vte-2.91 found: NO (tried pkgconfig) +Run-time dependency libpng found: YES 1.6.39 +Run-time dependency libjpeg found: YES 2.1.5.1 +Has header "sasl/sasl.h" : NO +Has header "security/pam_appl.h" : NO +Has header "snappy-c.h" : NO +Has header "lzo/lzo1x.h" : YES +Library lzo2 found: YES +Has header "numa.h" : NO +Library ibumad found: NO +Has header "rdma/rdma_cma.h" : NO +Library ibverbs found: NO +Run-time dependency xencontrol found: NO (tried pkgconfig) +Library xenstore found: NO +Library xenctrl found: NO +Library xendevicemodel found: NO +Library xenforeignmemory found: NO +Library xengnttab found: NO +Library xenevtchn found: NO +Library xentoolcore found: NO +Run-time dependency libcacard found: NO (tried pkgconfig) +Run-time dependency u2f-emu found: NO (tried pkgconfig) +Run-time dependency canokey-qemu found: NO (tried pkgconfig) +Run-time dependency libusbredirparser-0.5 found: NO (tried pkgconfig) +Run-time dependency libusb-1.0 found: YES 1.0.26 +Run-time dependency libpmem found: NO (tried pkgconfig) +Run-time dependency libdaxctl found: NO (tried pkgconfig) +Run-time dependency libkeyutils found: NO (tried pkgconfig) +Checking for function "gettid" : NO +Run-time dependency libselinux found: NO (tried pkgconfig) +Run-time dependency fuse3 found: NO (tried pkgconfig) +Run-time dependency libbpf found: NO (tried pkgconfig) +Run-time dependency libdw found: NO (tried pkgconfig) +Checking for function "pthread_fchdir_np" : NO +Has header "sys/epoll.h" : NO +Has header "linux/magic.h" : NO +Has header "valgrind/valgrind.h" : NO +Has header "linux/btrfs.h" : NO +Has header "libdrm/drm.h" : NO +Has header "pty.h" : NO +Has header "sys/disk.h" : NO +Has header "sys/ioccom.h" : NO +Has header "sys/kcov.h" : NO +Has header "afunix.h" : YES +Checking for function "close_range" : NO +Checking for function "accept4" : NO +Checking for function "clock_adjtime" : NO +Checking for function "dup3" : NO +Checking for function "fallocate" : NO +Checking for function "posix_fallocate" : NO +Checking for function "posix_memalign" : NO +Checking for function "_aligned_malloc" : YES +Checking for function "valloc" : NO +Checking for function "memalign" : NO +Checking for function "ppoll" : NO +Checking for function "preadv" : NO +Checking for function "pthread_fchdir_np" : NO (cached) +Checking for function "sendfile" : NO +Checking for function "setns" : NO +Checking for function "syncfs" : NO +Checking for function "sync_file_range" : NO +Checking for function "timerfd_create" : NO +Checking for function "copy_file_range" : NO +Checking for function "getifaddrs" : NO +Checking for function "openpty" with dependency -lutil: NO +Checking for function "strchrnul" : NO +Checking for function "system" : YES +Header <sys/epoll.h> has symbol "epoll_create1" : NO +Header <linux/falloc.h> has symbol "FALLOC_FL_PUNCH_HOLE" : NO +Header <linux/falloc.h> has symbol "FALLOC_FL_ZERO_RANGE" : NO +Has header "linux/fiemap.h" : NO +Checking for function "getrandom" : NO +Header <sys/inotify.h> has symbol "inotify_init" : NO +Header <sys/inotify.h> has symbol "inotify_init1" : NO +Header <sys/prctl.h> has symbol "PR_SET_TIMERSLACK" : NO +Header <linux/rtnetlink.h> has symbol "IFLA_PROTO_DOWN" : NO +Header <sys/sysmacros.h> has symbol "makedev" : NO +Header <getopt.h> has symbol "optreset" : NO +Header <netinet/in.h> has symbol "IPPROTO_MPTCP" : NO +Checking whether type "struct sigevent" has member "sigev_notify_thread_id" : NO +Checking whether type "struct stat" has member "st_atim" : NO +Checking for type "struct iovec" : NO +Checking for type "struct utmpx" : NO +Checking for type "struct mmsghdr" : NO +Header <linux/vm_sockets.h> has symbol "AF_VSOCK" : NO +Has header "vscoordint.h" : NO +Checking if "_lock_file and _unlock_file" : links: YES +Checking if "mingw setjmp and longjmp" : links: NO +Program scripts/minikconf.py found: YES (C:/Users/AMD-RYZEN-PC/scoop/apps/msys2/2023-03-18/mingw64/bin/python3.exe C:/Users/AMD-RYZEN-PC/qemu/scripts/minikconf.py) +Configuring x86_64-softmmu-config-target.h using configuration +Configuring x86_64-softmmu-config-devices.mak with command +Reading depfile: C:/Users/AMD-RYZEN-PC/qemu/build/meson-private/x86_64-softmmu-config-devices.mak.d +Configuring x86_64-softmmu-config-devices.h using configuration +Program scripts/make-config-poison.sh found: YES (sh C:/Users/AMD-RYZEN-PC/qemu/scripts/make-config-poison.sh) +Run-time dependency capstone found: NO (tried pkgconfig) +Library fdt found: NO +Configuring config-host.h using configuration +Program scripts/hxtool found: YES (sh C:/Users/AMD-RYZEN-PC/qemu/scripts/hxtool) +Program scripts/shaderinclude.py found: YES (C:/Users/AMD-RYZEN-PC/scoop/apps/msys2/2023-03-18/mingw64/bin/python3.exe C:/Users/AMD-RYZEN-PC/qemu/scripts/shaderinclude.py) +Program scripts/qapi-gen.py found: YES (C:/Users/AMD-RYZEN-PC/scoop/apps/msys2/2023-03-18/mingw64/bin/python3.exe C:/Users/AMD-RYZEN-PC/qemu/scripts/qapi-gen.py) +Program scripts/qemu-version.sh found: YES (sh C:/Users/AMD-RYZEN-PC/qemu/scripts/qemu-version.sh) +Program scripts/decodetree.py found: YES (C:/Users/AMD-RYZEN-PC/scoop/apps/msys2/2023-03-18/mingw64/bin/python3.exe C:/Users/AMD-RYZEN-PC/qemu/scripts/decodetree.py) +Program ../scripts/modules/module_block.py found: YES (C:/Users/AMD-RYZEN-PC/scoop/apps/msys2/2023-03-18/mingw64/bin/python3.exe C:/Users/AMD-RYZEN-PC/qemu/block/../scripts/modules/module_block.py) +Program ../scripts/block-coroutine-wrapper.py found: YES (C:/Users/AMD-RYZEN-PC/scoop/apps/msys2/2023-03-18/mingw64/bin/python3.exe C:/Users/AMD-RYZEN-PC/qemu/block/../scripts/block-coroutine-wrapper.py) +Program scripts/modinfo-collect.py found: YES (C:/Users/AMD-RYZEN-PC/scoop/apps/msys2/2023-03-18/mingw64/bin/python3.exe C:/Users/AMD-RYZEN-PC/qemu/scripts/modinfo-collect.py) +Program scripts/modinfo-generate.py found: YES (C:/Users/AMD-RYZEN-PC/scoop/apps/msys2/2023-03-18/mingw64/bin/python3.exe C:/Users/AMD-RYZEN-PC/qemu/scripts/modinfo-generate.py) +Program nm found: YES +Program scripts/undefsym.py found: YES (C:/Users/AMD-RYZEN-PC/scoop/apps/msys2/2023-03-18/mingw64/bin/python3.exe C:/Users/AMD-RYZEN-PC/qemu/scripts/undefsym.py) +Program scripts/feature_to_c.sh found: YES (sh C:/Users/AMD-RYZEN-PC/qemu/scripts/feature_to_c.sh) +Compiler for C supports link arguments -fstack-protector-all: YES +Compiler for C supports link arguments -fstack-protector-strong: YES +Compiler for C supports link arguments -Wl,--add-stdcall-alias: YES +Compiler for C supports link arguments -Wl,--enable-stdcall-fixup: YES +Library ole32 found: YES +Library oleaut32 found: YES +Library shlwapi found: YES +Library uuid found: YES +Library intl found: YES +Program windmc found: YES +Program windres found: YES +Program wixl found: NO +Configuring 50-edk2-i386-secure.json using configuration +Configuring 50-edk2-x86_64-secure.json using configuration +Configuring 60-edk2-aarch64.json using configuration +Configuring 60-edk2-arm.json using configuration +Configuring 60-edk2-i386.json using configuration +Configuring 60-edk2-x86_64.json using configuration +Program qemu-keymap found: NO +Program sphinx-build found: NO +Program diff found: YES (C:\Users\AMD-RYZEN-PC\scoop\apps\msys2\2023-03-18\usr\bin/diff.EXE) +Program dbus-daemon found: NO +Found CMake: C:\Users\AMD-RYZEN-PC\scoop\shims/cmake.EXE (3.26.3) +WARNING: CMake Toolchain: Failed to determine CMake compilers state +Run-time dependency gvnc-1.0 found: NO (tried pkgconfig and cmake) +Run-time dependency sysprof-capture-4 found: NO (tried pkgconfig and cmake) +Program initrd-stress.sh found: YES (sh C:/Users/AMD-RYZEN-PC/qemu/tests/migration/initrd-stress.sh) +Program xgettext found: YES (C:\Users\AMD-RYZEN-PC\scoop\apps\msys2\2023-03-18\mingw64\bin/xgettext.EXE) +Program scripts/nsis.py found: YES (C:/Users/AMD-RYZEN-PC/scoop/apps/msys2/2023-03-18/mingw64/bin/python3.exe C:/Users/AMD-RYZEN-PC/qemu/scripts/nsis.py) +Build targets in project: 516 + +qemu 8.0.0 + + Directories + Install prefix : C:/Users/AMD-RYZEN-PC/scoop/apps/msys2/2023-03-18/qemu + BIOS directory : share/ + firmware path : share/qemu-firmware + binary directory : C:/Users/AMD-RYZEN-PC/scoop/apps/msys2/2023-03-18/qemu/. + library directory : C:/Users/AMD-RYZEN-PC/scoop/apps/msys2/2023-03-18/qemu/lib + module directory : lib/ + libexec directory : C:/Users/AMD-RYZEN-PC/scoop/apps/msys2/2023-03-18/qemu/libexec + include directory : C:/Users/AMD-RYZEN-PC/scoop/apps/msys2/2023-03-18/qemu/include + config directory : C:/Users/AMD-RYZEN-PC/scoop/apps/msys2/2023-03-18/qemu/etc + local state directory : queried at runtime + Doc directory : C:/Users/AMD-RYZEN-PC/scoop/apps/msys2/2023-03-18/qemu/share/doc + Build directory : C:/Users/AMD-RYZEN-PC/qemu/build + Source path : C:/Users/AMD-RYZEN-PC/qemu + GIT submodules : ui/keycodemapdb meson tests/fp/berkeley-testfloat-3 tests/fp/berkeley-softfloat-3 dtc + + Host binaries + git : git + make : make + python : C:/Users/AMD-RYZEN-PC/scoop/apps/msys2/2023-03-18/mingw64/bin/python3.exe (version: 3.10) + sphinx-build : NO + gdb : /mingw64/bin/gdb-multiarch + iasl : NO + genisoimage : + wixl : NO + smbd : NO + + Configurable features + Documentation : NO + system-mode emulation : YES + user-mode emulation : NO + block layer : YES + Install blobs : YES + module support : NO + fuzzing support : NO + Audio drivers : dsound sdl + Trace backends : log + D-Bus display : NO + QOM debugging : NO + vhost-kernel support : NO + vhost-net support : NO + vhost-user support : NO + vhost-user-crypto support : NO + vhost-user-blk server support: NO + vhost-vdpa support : NO + build guest agent : YES + + Compilation + host CPU : x86_64 + host endianness : little + C compiler : cc -m64 -mcx16 + Host C compiler : cc -m64 -mcx16 + C++ compiler : c++ -m64 -mcx16 + CFLAGS : -g -O2 + CXXFLAGS : -g -O2 + QEMU_CFLAGS : -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -fno-pie -no-pie -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -fno-strict-aliasing -fno-common -fwrapv -Wundef -Wwrite-strings -Wmissing-prototypes -Wstrict-prototypes -Wredundant-decls -Wold-style-declaration -Wold-style-definition -Wtype-limits -Wformat-security -Wformat-y2k -Winit-self -Wignored-qualifiers -Wempty-body -Wnested-externs -Wendif-labels -Wexpansion-to-defined -Wimplicit-fallthrough=2 -Wmissing-format-attribute -Wno-missing-include-dirs -Wno-shift-negative-value -Wno-psabi -fstack-protector-strong + QEMU_CXXFLAGS : -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -fno-pie -no-pie -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -fno-strict-aliasing -fno-common -fwrapv -Wundef -Wwrite-strings -Wtype-limits -Wformat-security -Wformat-y2k -Winit-self -Wignored-qualifiers -Wempty-body -Wendif-labels -Wexpansion-to-defined -Wimplicit-fallthrough=2 -Wmissing-format-attribute -Wno-missing-include-dirs -Wno-shift-negative-value -Wno-psabi -fstack-protector-strong + QEMU_LDFLAGS : -fstack-protector-strong -Wl,--no-seh -Wl,--nxcompat -Wl,--dynamicbase -Wl,--high-entropy-va -Wl,--warn-common + profiler : NO + link-time optimization (LTO) : NO + PIE : NO + static build : NO + malloc trim support : NO + membarrier : NO + debug stack usage : NO + mutex debugging : NO + memory allocator : system + avx2 optimization : YES + avx512bw optimization : YES + avx512f optimization : NO + gprof : NO + gcov : NO + thread sanitizer : NO + CFI support : NO + strip binaries : NO + sparse : NO + mingw32 support : YES + + Cross compilers + x86_64 : cc + + Targets and accelerators + KVM support : NO + GVM support : YES + HAX support : YES + HVF support : NO + WHPX support : YES + NVMM support : NO + Xen support : NO + Xen emulation : NO + TCG support : YES + TCG backend : native (x86_64) + TCG plugins : NO + TCG debug enabled : NO + target list : x86_64-softmmu + default devices : YES + out of process emulation : NO + vfio-user server : NO + + Block layer support + coroutine backend : win32 + coroutine pool : YES + Block whitelist (rw) : + Block whitelist (ro) : + Use block whitelist in tools : NO + VirtFS support : NO + Live block migration : YES + replication support : YES + bochs support : YES + cloop support : YES + dmg support : YES + qcow v1 support : YES + vdi support : YES + vvfat support : YES + qed support : YES + parallels support : YES + FUSE exports : NO + VDUSE block exports : NO + + Crypto + TLS priority : NORMAL + GNUTLS support : NO + libgcrypt : NO + nettle : NO + AF_ALG support : NO + rng-none : NO + Linux keyring : NO + + Dependencies + SDL support : YES + SDL image support : YES 2.6.3 + GTK support : YES + pixman : YES 0.42.2 + VTE support : NO + slirp support : YES 4.7.0 + libtasn1 : NO + PAM : NO + iconv support : YES + curses support : YES + virgl support : YES 0.9.1 + blkio support : NO + curl support : NO + Multipath support : NO + PNG support : YES 1.6.39 + VNC support : YES + VNC SASL support : NO + VNC JPEG support : YES 2.1.5.1 + DirectSound support : YES + JACK support : NO + brlapi support : NO + vde support : NO + netmap support : NO + l2tpv3 support : NO + Linux AIO support : NO + Linux io_uring support : NO + ATTR/XATTR support : NO + RDMA support : NO + PVRDMA support : NO + fdt support : internal + libcap-ng support : NO + bpf support : NO + spice protocol support : NO + rbd support : NO + smartcard support : NO + U2F support : NO + libusb : YES 1.0.26 + usb net redir : NO + OpenGL support (epoxy) : YES 1.5.10 + GBM : NO + libiscsi support : NO + libnfs support : NO + QGA VSS support : YES + seccomp support : NO + GlusterFS support : NO + TPM support : NO + libssh support : NO + lzo support : YES + snappy support : NO + bzip2 support : YES + lzfse support : NO + zstd support : YES 1.5.5 + NUMA host support : NO + capstone : NO + libpmem support : NO + libdaxctl support : NO + libudev : NO + FUSE lseek : NO + selinux : NO + libdw : NO + + User defined options + Native files : config-meson.cross + bindir : + prefix : C:/Users/AMD-RYZEN-PC/scoop/apps/msys2/2023-03-18/qemu + werror : true + b_pie : false + gtk : enabled + qemu_suffix : + sdl : enabled + vfio_user_server : disabled + whpx : enabled + +Found ninja-1.11.1 at C:/Users/AMD-RYZEN-PC/scoop/apps/msys2/2023-03-18/usr/bin/ninja.exe +Running postconf script 'C:/Users/AMD-RYZEN-PC/scoop/apps/msys2/2023-03-18/mingw64/bin/python3.exe C:/Users/AMD-RYZEN-PC/qemu/scripts/symlink-install-tree.py' +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1639 b/results/classifier/mode-deepseek-r1:32b/output/system/1639 new file mode 100644 index 00000000..b2a00e28 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1639 @@ -0,0 +1,3 @@ + + +No supported machine for loongson-3A4000 mips64el diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/164 b/results/classifier/mode-deepseek-r1:32b/output/system/164 new file mode 100644 index 00000000..c2efb33e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/164 @@ -0,0 +1,3 @@ + + +qemu x86 TCG doesn't support AVX insns diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1644754 b/results/classifier/mode-deepseek-r1:32b/output/system/1644754 new file mode 100644 index 00000000..55a3248f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1644754 @@ -0,0 +1,100 @@ + + +gluster partial reads refusal conflicts with qcow2 + +there is an inconsistency in how qemu creates qcow2 files, which causes an error in the gluster (and possibly other block drivers) + +the problem is that the gluster backend expects the filesize to be 512 byte aligned, which is not the case anymore since 2.7.0 when using the file backend for qcow2 files with a backing file + +the error is then +Could not open 'gluster://gluster01/gv0/bar2.qcow2': Could not read L1 table: Input/output error + +steps to reproduce: + + * create a.qcow2 + * create b.qcow2 with a.qcow2 as base via filesystem (without gluster) + b.qcow2 filesize is not a multiple of 512 bytes + * move both files to a gluster share + * access to b.qcow2 via gluster block driver fails + +example: + +have a gluster server at 'gluster01' with a volume 'gv0' (gluster versions tested: 3.7.15,3.8.5,3.8.5) + +root@pc:~# mount -t glusterfs gluster01:/gv0 /mnt/gluster +root@pc:~# qemu-img create -f qcow2 gluster://gluster01/gv0/foo.qcow2 100M +Formatting 'gluster://gluster01/gv0/foo.qcow2', fmt=qcow2 size=104857600 encryption=off cluster_size=65536 lazy_refcounts=off refcount_bits=16 +root@pc:~# qemu-img info /mnt/gluster/foo.qcow2 +image: /mnt/gluster/foo.qcow2 +file format: qcow2 +virtual size: 100M (104857600 bytes) +disk size: 193K +cluster_size: 65536 +Format specific information: + compat: 1.1 + lazy refcounts: false + refcount bits: 16 + corrupt: false +root@pc:~# qemu-img info gluster://gluster01/gv0/foo.qcow2 +image: gluster://gluster01/gv0/foo.qcow2 +file format: qcow2 +virtual size: 100M (104857600 bytes) +disk size: 193K +cluster_size: 65536 +Format specific information: + compat: 1.1 + lazy refcounts: false + refcount bits: 16 + corrupt: false +root@pc:~# qemu-img create -f qcow2 -b foo.qcow2 gluster://gluster01/gv0/bar.qcow2 +Formatting 'gluster://gluster01/gv0/bar.qcow2', fmt=qcow2 size=104857600 backing_file=foo.qcow2 encryption=off cluster_size=65536 lazy_refcounts=off refcount_bits=16 +root@pc:~# qemu-img info /mnt/gluster/bar.qcow2 +image: /mnt/gluster/bar.qcow2 +file format: qcow2 +virtual size: 100M (104857600 bytes) +disk size: 193K +cluster_size: 65536 +backing file: foo.qcow2 (actual path: /mnt/gluster/foo.qcow2) +Format specific information: + compat: 1.1 + lazy refcounts: false + refcount bits: 16 + corrupt: false +root@pc:~# qemu-img info gluster://gluster01/gv0/bar.qcow2 +image: gluster://gluster01/gv0/bar.qcow2 +file format: qcow2 +virtual size: 100M (104857600 bytes) +disk size: 193K +cluster_size: 65536 +backing file: foo.qcow2 (actual path: gluster://gluster01/gv0/foo.qcow2) +Format specific information: + compat: 1.1 + lazy refcounts: false + refcount bits: 16 + corrupt: false +root@pc:~# qemu-img create -f qcow2 -b foo.qcow2 /mnt/gluster/bar2.qcow2 +Formatting '/mnt/gluster/bar2.qcow2', fmt=qcow2 size=104857600 backing_file=foo.qcow2 encryption=off cluster_size=65536 lazy_refcounts=off refcount_bits=16 +root@pc:~# qemu-img info /mnt/gluster/bar2.qcow2 +image: /mnt/gluster/bar2.qcow2 +file format: qcow2 +virtual size: 100M (104857600 bytes) +disk size: 193K +cluster_size: 65536 +backing file: foo.qcow2 (actual path: /mnt/gluster/foo.qcow2) +Format specific information: + compat: 1.1 + lazy refcounts: false + refcount bits: 16 + corrupt: false +root@pc:~# qemu-img info gluster://gluster01/gv0/bar2.qcow2 +qemu-img: Could not open 'gluster://gluster01/gv0/bar2.qcow2': Could not read L1 table: Input/output error +root@pc:~# ls -l /mnt/gluster/ +total 578 +-rw-r--r-- 1 root root 196616 Nov 25 09:07 bar2.qcow2 +-rw------- 1 root root 197120 Nov 25 09:07 bar.qcow2 +-rw------- 1 root root 197120 Nov 25 09:06 foo.qcow2 +drwxr-xr-x 6 root root 46 Nov 24 16:51 images + +here you can see that the file created with directory path is not 512 byte aligned, while the one created through the gluster api is + +also, when creating a qcow2 with the nfs block driver, the filesize is also a multiple of 512, but reading a non aligned file with nfs works however \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1649 b/results/classifier/mode-deepseek-r1:32b/output/system/1649 new file mode 100644 index 00000000..94f14e8c --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1649 @@ -0,0 +1,19 @@ + + +"slli" instruction before "la" and "csrw" sequence leads to failure in setting the cs register +Description of problem: +slli a0, a0, 8 (1) + la a0, mtimvec (2) + csrw mtvec, a0 (3) + mtimvec: (4) + +For the above assembly snippet, the mtvec could be successfully set to the value of a0 +without the presence of the line (1) or with the shift amount being zero. However, +the mtvec can never be set successfully with the presence of line (1). +Steps to reproduce: +1. Create a test.s file and put these 4 lines of assembly into the file +2. In terminal, run: "riscv64-unknown-elf-gcc -Ttext 0x80000000 -c test.s -o test", "riscv64-unknown-elf-objcopy test -S -O binary test", and "qemu-system-riscv64 test -s -S" +3. In another terminal window, run [riscv64-unknown-elf-gdb -ex "target remote localhost:1234" -ex "layout asm"]. Keep running si command in gdb until you are at 0x80000000 where you shall see the first instruction as shown in line (1). Then keep going till you have stepped over the instruction shown in line (3). Now, run "p $mtvec" in gdb, you shall see its value being 0. +4. Redo the above steps without line (1), you shall see mtvec loaded successfully with the correct value. +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1650175 b/results/classifier/mode-deepseek-r1:32b/output/system/1650175 new file mode 100644 index 00000000..c1dfa9d0 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1650175 @@ -0,0 +1,7 @@ + + +wrong version in 2.8.0-rc03 + +When you compile qemu the version still 2.7.93 instead 2.8.0-rc03 + +build/config-host.mak:VERSION=2.7.93 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1651 b/results/classifier/mode-deepseek-r1:32b/output/system/1651 new file mode 100644 index 00000000..006f9ea4 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1651 @@ -0,0 +1,3 @@ + + +bcm2835 timer jumps to max delay diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1652333 b/results/classifier/mode-deepseek-r1:32b/output/system/1652333 new file mode 100644 index 00000000..07de1e1b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1652333 @@ -0,0 +1,11 @@ + + +TCG mode fails to boot Linux kernel with qemu 2.6.0 and libvirt 2.0.0 + +Trying to boot a Cirros (minimal Linux) VM with qemu 2.6.0 and libvirt 2.0.0 in TCG mode fails for me. The VM gets stuck in "Starting up ..." and never moves on. The command line used to boot the VM was: + +LC_ALL=C PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin QEMU_AUDIO_DRV=none /usr/libexec/qemu-kvm -name guest=instance-00000002,debug-threads=on -S -object secret,id=masterKey0,format=raw,file=/var/lib/libvirt/qemu/domain-1-instance-00000002/master-key.aes -machine pc-i440fx-rhel7.3.0,accel=tcg,usb=off -cpu SandyBridge,+osxsave,+hypervisor,+xsaveopt -m 512 -realtime mlock=off -smp 1,sockets=1,cores=1,threads=1 -uuid ae38b0e1-b3ae-41ec-8e50-c89669a2ec1c -smbios 'type=1,manufacturer=Red Hat,product=OpenStack Compute,version=14.0.2-7.el7ost,serial=edd3a67d-6ce5-4c36-8f20-085d1097abb7,uuid=ae38b0e1-b3ae-41ec-8e50-c89669a2ec1c,family=Virtual Machine' -no-user-config -nodefaults -chardev socket,id=charmonitor,path=/var/lib/libvirt/qemu/domain-1-instance-00000002/monitor.sock,server,nowait -mon chardev=charmonitor,id=monitor,mode=control -rtc base=utc -no-shutdown -boot strict=on -device piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 -drive file=/var/lib/nova/instances/ae38b0e1-b3ae-41ec-8e50-c89669a2ec1c/disk,format=qcow2,if=none,id=drive-virtio-disk0,cache=none -device virtio-blk-pci,scsi=off,bus=pci.0,addr=0x4,drive=drive-virtio-disk0,id=virtio-disk0,bootindex=1 -netdev tap,fd=28,id=hostnet0 -device virtio-net-pci,netdev=hostnet0,id=net0,mac=fa:16:3e:c1:27:73,bus=pci.0,addr=0x3 -add-fd set=1,fd=31 -chardev file,id=charserial0,path=/dev/fdset/1,append=on -device isa-serial,chardev=charserial0,id=serial0 -chardev pty,id=charserial1 -device isa-serial,chardev=charserial1,id=serial1 -device usb-tablet,id=input0,bus=usb.0,port=1 -vnc 0.0.0.0:0 -k en-us -device cirrus-vga,id=video0,bus=pci.0,addr=0x2 -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x5 -msg timestamp=on + +A qcow2 image can be downloaded from http://download.cirros-cloud.net/0.3.4/cirros-0.3.4-x86_64-disk.img to reproduce the issue. I've seen a similar failure with a CentOS 7.2 image. + +I am also attaching the libvirt log from the failed VM. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1655 b/results/classifier/mode-deepseek-r1:32b/output/system/1655 new file mode 100644 index 00000000..a239261a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1655 @@ -0,0 +1,3 @@ + + +qemu-7.2.2 build failed diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1655708 b/results/classifier/mode-deepseek-r1:32b/output/system/1655708 new file mode 100644 index 00000000..edd13b2b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1655708 @@ -0,0 +1,17 @@ + + +target/ppc/int_helper.c:2806: strange expression ? + +target/ppc/int_helper.c:2806:25: warning: ‘*’ in boolean context, suggest ‘&&’ instead [-Wint-in-bool-context] + +Source code is + + zone_digit = (i * 2) ? b->u8[BCD_DIG_BYTE(i * 2)] >> 4 : zone_lead; + +Which I read as + + zone_digit = (i * 2) ? (b->u8[BCD_DIG_BYTE(i * 2)] >> 4) : zone_lead; + +so I think the compiler warning is for the i * 2 lhs of the ?. + +I am not sure what to suggest as a bugfix. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1657538 b/results/classifier/mode-deepseek-r1:32b/output/system/1657538 new file mode 100644 index 00000000..655876b8 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1657538 @@ -0,0 +1,32 @@ + + +qemu 2.7.x 2.8 softmmu dont work on BE machine + +Build on Be machine qemu 2.7.1 and 2.8 in pure softmmu (tgc) dont work on big endian hardware . +tested with ppc-softmmu,i386-softmmu,arm-softmmu same result: + +with : + ./qemu-system-i386 +Gtk-Message: Failed to load module "overlay-scrollbar" +qemu-system-i386: Trying to execute code outside RAM or ROM at 0x000a0000 +This usually means one of the following happened: + +(1) You told QEMU to execute a kernel for the wrong machine type, and it crashed on startup (eg trying to run a raspberry pi kernel on a versatilepb QEMU machine) +(2) You didn't give QEMU a kernel or BIOS filename at all, and QEMU executed a ROM full of no-op instructions until it fell off the end +(3) Your guest kernel has a bug and crashed by jumping off into nowhere + +This is almost always one of the first two, so check your command line and that you are using the right type of kernel for this machine. +If you think option (3) is likely then you can try debugging your guest with the -d debug options; in particular -d guest_errors will cause the log to include a dump of the guest register state at this point. + +Execution cannot continue; stopping here. + + +I try to add the -L option with ../pc-bios/bios.bin +and have the same result. + +note the ppc-softmmu and ppc64-softmmu work in kvm mode only emulated mode have issue. + + +tested on my hardware a Qriq P5040 and G5 4x970MP with Ubuntu Mate 16.10 +thanks +Luigi \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1658 b/results/classifier/mode-deepseek-r1:32b/output/system/1658 new file mode 100644 index 00000000..e4ce9f99 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1658 @@ -0,0 +1,62 @@ + + +Zephyr TF-M IPC example triggers failed assertion !arm_feature(env, ARM_FEATURE_M) on recent Qemu +Description of problem: +I can't run the TrustedFirmware-M IPC example in the Zephyr repo with recent Qemu (in particular v8.0.0). + +By bisecting, I got the last commit OK : v7.2.0-351-gfaa1451e7b + +``` +$ qemu-system-arm -M mps2-an521 -device loader,file=tfm_merged.hex -serial stdio +[INF] Beginning TF-M provisioning +[WRN] TFM_DUMMY_PROVISIONING is not suitable for production! This device is NOT SECURE +[Sec Thread] Secure image initializing! +Booting TF-M 8209cb2ed +Creating an empty ITS flash layout. +Creating an empty PS flash layout. +[INF][Crypto] Provisioning entropy seed... complete. +*** Booting Zephyr OS build zephyr-v3.3.0-4041-g7ba5ecf451ef *** +TF-M IPC on mps2_an521_ns +The version of the PSA Framework API is 257. +The PSA Crypto service minor version is 1. +Generating 256 bytes of random data: +71 03 DD 50 8E E5 00 C7 E0 61 7B EB 77 15 E9 38 +E9 A8 7D 0C 51 23 76 9F C3 61 E9 8B 8A 67 BD 14 +73 A3 2C 6E E5 8C E3 19 53 6B 50 55 A8 A7 F4 7B +56 03 60 AA 48 B6 DF 04 33 56 BE 84 43 FA 4E AC +D7 6E 2E 2E 1D 7E 46 69 D5 9B B0 42 5C 54 E4 09 +73 9E 4F 55 F8 3E 05 9E A3 DE 46 D3 E4 02 B0 9C +F3 21 9F 20 85 74 34 07 19 79 07 B8 02 B5 0E 90 +74 21 BE B5 09 4C D7 20 D8 43 F7 72 23 1C F0 3E +77 7B D3 70 29 72 69 D3 7F 1F 61 16 12 73 D5 89 +C5 8B D1 A3 7B 4B FD F5 11 C2 B1 9A C0 A5 F9 7B +16 3D 98 17 66 FE E9 F4 FE 37 76 62 E0 E6 83 99 +69 26 41 CD FF 0C 44 AC F9 F4 91 B8 CA 63 5E 1D +B9 C4 38 D6 0C 11 19 1B 94 BE C9 4F EC 2E 5A 05 +3F 72 5F 41 44 3C 91 39 AC 2D 50 75 DF FD D3 11 +39 F2 43 18 D7 69 B0 A3 99 0C C0 6E 83 84 1A A8 +B0 37 6C 8E 32 B2 8E 4F AA 12 97 09 09 87 D3 FD +qemu-system-arm: terminating on signal 2 +``` + +But after 452c67a427, for example v8.0.0-918-g6972ef1440, I get : + +``` +$ qemu-system-arm -M mps2-an521 -device loader,file=tfm_merged.hex -serial stdio +[INF] Beginning TF-M provisioning +[WRN] TFM_DUMMY_PROVISIONING is not suitable for production! This device is NOT SECURE +[Sec Thread] Secure image initializing! +Booting TF-M 8209cb2ed +Creating an empty ITS flash layout. +Creating an empty PS flash layout. +[INF][Crypto] Provisioning entropy seed... complete. +*** Booting Zephyr OS build zephyr-v3.3.0-4041-g7ba5ecf451ef *** +TF-M IPC on mps2_an521_ns +qemu-system-arm: ../target/arm/cpu.h:2396: arm_is_secure_below_el3: Assertion `!arm_feature(env, ARM_FEATURE_M)' failed. +Aborted +``` +Steps to reproduce: +1. Build the Zephyr tfm_merged.hex file from Zephyr 7ba5ecf451 https://github.com/zephyrproject-rtos/zephyr/commit/7ba5ecf451ef29f96b30dbe5f0e54c1865839093 : ``west -v build -p -b mps2_an521_ns ./samples/tfm_integration/tfm_ipc`` +2. Build qemu-system-arm and run : ``qemu-system-arm -M mps2-an521 -device loader,file=tfm_merged.hex -serial stdio`` +Additional information: +More info to build Zephyr TF-M IPC example on the official repo https://github.com/zephyrproject-rtos/zephyr/tree/main/samples/tfm_integration/tfm_ipc diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/166 b/results/classifier/mode-deepseek-r1:32b/output/system/166 new file mode 100644 index 00000000..ea5ec6a2 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/166 @@ -0,0 +1,3 @@ + + +qemu-bridge-helper failure but qemu not exit diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1661 b/results/classifier/mode-deepseek-r1:32b/output/system/1661 new file mode 100644 index 00000000..b3da064d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1661 @@ -0,0 +1,13 @@ + + +x86 cpu support request: LX Geode +Description of problem: +The Geode LX family of CPUs were used in early generations of the One Laptop Per Child (OLPC) systems (XO 1.0). + +They are _basically_ i686-compatible but they lack the 'long-nop' (0x0f 0x1f) instruction available on many other i686-class devices. + +Since i686 is a reasonably common baseline for toolchains and the software that is distributed using those toolchains, it would be convenient to be able to use QEMU to test boundary compatibility cases for this CPU. +Steps to reproduce: +N/A - feature does not currently exist +Additional information: +I'm not adding additional context here at the moment, but please let me know what else would be helpful to know (and/or if I'm off-track with this feature request for any reason). Thank you! diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1662 b/results/classifier/mode-deepseek-r1:32b/output/system/1662 new file mode 100644 index 00000000..97871ebf --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1662 @@ -0,0 +1,37 @@ + + +qemu-system-loongarch64 start Loongnix system coredump +Description of problem: + +Steps to reproduce: +1. build qemu: + ./configure --prefix=/usr --disable-werror --disable-gtk --target-list="loongarch64-softmmu"\ + --enable-debug + make -j32 +2. get bios and qcow2: + wget https://mirrors.wsyu.edu.cn/loongarch/archlinux/images/QEMU_EFI_7.2.fd + wget http://pkg.loongnix.cn/loongnix/isos/Loongnix-20.4/Loongnix-20.4.cartoon.gui.loongarch64.en.qcow2 +3. start Loongnix + ./build/qemu-system-loongarch64 \ + -m 8G \ + -cpu la464 \ + -machine virt \ + -smp 16 \ + -bios ./QEMU_EFI_7.2.fd \ + -serial stdio \ + -device virtio-gpu-pci \ + -net nic -net user \ + -device nec-usb-xhci,id=xhci,addr=0x1b \ + -device usb-tablet,id=tablet,bus=xhci.0,port=1 \ + -device usb-kbd,id=keyboard,bus=xhci.0,port=2 \ + -device virtio-blk-pci,drive=test -drive if=none,id=test,file=./Loongnix-20.4.cartoon.gui.loongarch64.en.qcow2 + +4. VNC connect +5. use the system + login loongson/Loongson20 +6. qemu coredump + + qemu-system-loongarch64: /root/work/qemu/include/tcg/tcg.h:675: temp_idx: Assertion `n >= 0 && n < tcg_ctx->nb_temps' failed. +./start-loongnix.sh: line 13: 40242 Aborted (core dumped) ./build/qemu-system-loongarch64 -m 8G -cpu la464 -machine virt -smp 16 -bios ./QEMU_EFI_7.2.fd -serial stdio -device virtio-gpu-pci -net nic -net user -device nec-usb-xhci,id=xhci,addr=0x1b -device usb-tablet,id=tablet,bus=xhci.0,port=1 -device usb-kbd,id=keyboard,bus=xhci.0,port=2 -device virtio-blk-pci,drive=test -drive if=none,id=test,file=./Loongnix-20.4.cartoon.gui.loongarch64.en.qcow2 +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1666 b/results/classifier/mode-deepseek-r1:32b/output/system/1666 new file mode 100644 index 00000000..e4a413cf --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1666 @@ -0,0 +1,3 @@ + + +About the develop environment diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1667 b/results/classifier/mode-deepseek-r1:32b/output/system/1667 new file mode 100644 index 00000000..26a3e8b8 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1667 @@ -0,0 +1,3 @@ + + +Tricore: missing a few TC1.6.2 instruction set diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1668041 b/results/classifier/mode-deepseek-r1:32b/output/system/1668041 new file mode 100644 index 00000000..72dda796 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1668041 @@ -0,0 +1,12 @@ + + +x86 Floating point exceptions - incorrect support? + +It seems that qemu does not correctly emulate the x86 support for optionally causing a floating-point exception (#FP) when, for example, dividing by zero. Reports such as: + +https://github.com/cloudius-systems/osv/issues/855 +http://stackoverflow.com/questions/15134189/qemu-div-by-zero-mxcsr-register + +suggest that setting the exception mask in the fpu cw or mxcsr (e.g., using a function like feenableexcept() in the guest OS) does not generate floating point exceptions on divide by zero. The problem only happens on pure QEMU - when a QEMU/KVM combination is used, the actual hardware does the floating point work, and does throw the exception on divide by zero if so requested. + +Looking at the qemu (2.8.0) source code, it seems to me it really lacks support for generating fpu exceptions: For example, helper_fdiv() in target-i386/fpu_helper.c, when it notices the divisor is zero, seems to set the divide-by-zero exception bit, but doesn't seem to check whether it needs to trigger an exception (when the right bits on the x87 or SSE control words are enabled). \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/167 b/results/classifier/mode-deepseek-r1:32b/output/system/167 new file mode 100644 index 00000000..e67d58cb --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/167 @@ -0,0 +1,3 @@ + + +qemu 4.0 doesnt support glsl 3.0 but yes older versions, that have no sense IMO diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1670 b/results/classifier/mode-deepseek-r1:32b/output/system/1670 new file mode 100644 index 00000000..2db7d758 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1670 @@ -0,0 +1,11 @@ + + +Cannot statically build x86_64-softmmu with Darwin(Intel) +Description of problem: +I am using `Podman` and currently,`Podman` uses qemu on macOS. The `Podman` team has adopted a scheme to dynamically compile `qemu` (https://github.com/containers/podman-machine-qemu). However, I am currently trying to use static compilation for both amd64 and arm64 targets. + +I have searched many articles online, most of which are about static compilation on Linux. Very few articles mention static compilation on macOS, and some mention that `softmmu` does not support static compilation. However, I have not found any concrete evidence to support this claim. + +I also want to ask another question: Does `qemu` support static compilation on macOS? +Additional information: +[meson-log.txt](/uploads/6e32691488533a06c64dc34ee4514135/meson-log.txt) diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1670509 b/results/classifier/mode-deepseek-r1:32b/output/system/1670509 new file mode 100644 index 00000000..355c6d62 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1670509 @@ -0,0 +1,9 @@ + + +sgabios outputs incorrect video modes + +When run with a bootstrap loader that uses int 0x10 with 0x1301 in %ax, incorrect video modes are output to the serial port. I believe the VGA image will be correct. This might also affect the returned values for some interrupts. + +This is caused because the set_cursor_position routine fails to save and restore %bx. + +I'm working on a fix for this. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1673 b/results/classifier/mode-deepseek-r1:32b/output/system/1673 new file mode 100644 index 00000000..681f8ef5 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1673 @@ -0,0 +1,51 @@ + + +compilation of 8.0.0 FAILED: target/hexagon/idef-generated-emitter.indented.c on ubuntu 18.04 +Description of problem: +Cannot compile on ubuntu 18.04. +Steps to reproduce: +1. get 8.0.0 tarball or git clone/submodule... on a ubuntu 18.04 system (with a few more recent tools in ~/opt, such as python 3.9) +2. ./configure --prefix=$HOME/opt && make +3. It finishes with this strange error: FAILED: target/hexagon/idef-generated-emitter.indented.c +``` +... +[850/10154] Compiling C object target/hexagon/idef-parser.p/meson-generated_idef-parser.yy.c.o +[851/10154] Compiling C object target/hexagon/idef-parser.p/meson-generated_idef-parser.tab.c.o +[852/10154] Compiling C object target/hexagon/idef-parser.p/_home_pbourguignon_opt_src_qemu-8.0.0_target_hexagon_idef-parser_parser-helpers.c.o +[853/10154] Linking target target/hexagon/idef-parser +[854/10154] Generating target/hexagon/idef-generated-tcg with a custom command +[855/10154] Generating target/hexagon/indent with a custom command +FAILED: target/hexagon/idef-generated-emitter.indented.c +/home/pbourguignon/bin/indent -linux target/hexagon/idef-generated-emitter.c -o target/hexagon/idef-generated-emitter.indented.c +Indenting region... +Indenting region... done +Directory `/home/pbourguignon/opt/src/qemu-8.0.0/build/-linux target/hexagon/idef-generated-emitter.c -o target/hexagon/' does not exist; create? (y or n) Error reading from stdin +ninja: build stopped: subcommand failed. +Makefile:165: recipe for target 'run-ninja' failed +make[1]: *** [run-ninja] Error 1 +make[1]: Leaving directory '/home/pbourguignon/opt/src/qemu-8.0.0/build' +GNUmakefile:10: recipe for target 'all' failed +make: *** [all] Error 2 +``` +Additional information: +https://dpaste.org/Hr9Zq +``` +~/opt/src/qemu-git +16:15[pbourguignon@frprld7818008 :0.0 qemu-git ]$ ls ~/opt/bin +./ ecl-config* pydoc3@ run-avr* run-microblaze* +../ emacs@ pydoc3.9* run-bfin* run-mips* +2to3@ emacs-27.2* python@ run-bpf* run-mn10300* +2to3-3.9* emacsclient* python3@ run-cr16* run-moxie* +bundle* erb* python3-config@ run-cris* run-msp430* +bundler* etags* python3.9* run-d10v* run-or1k* +ccl* gcore* python3.9-config* run-erc32* run-ppc* +ccmake* gdb* racc* run-frv* run-pru* +cmake* gdb-add-index* rake* run-ft32* run-riscv* +cpack* gdbserver* rbs* run-h8300* run-rl78* +ctags* gem* rdbg* run-iq2000* run-rx* +ctest* idle3@ rdoc* run-lm32* run-sh* +curl* idle3.9* ri* run-m32c* run-v850* +curl-config* irb* ruby* run-m32r* sbcl* +ebrowse* pip3* run-aarch64* run-m68hc11* sis* +ecl* pip3.9* run-arm* run-mcore* typeprof* +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1673130 b/results/classifier/mode-deepseek-r1:32b/output/system/1673130 new file mode 100644 index 00000000..bd5e89ef --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1673130 @@ -0,0 +1,75 @@ + + +qemu 2.7.0 receives SIGABRT in qemu_coroutine_enter() + +I've been experiencing frequent SIGABRTs (in addition to segfaults in #1671876) lately with qemu 2.7.0 running Ubuntu 16.04 guests. The crash usually happens in qemu_coroutine_enter(). I haven't seen this so far with any other guests or distros. + +Here is one stack trace I obtained +-------------------------------------------------------------------------- +(gdb) bt +#0 0x00007fd7cc676067 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 +#1 0x00007fd7cc677448 in __GI_abort () at abort.c:89 +#2 0x0000556aed247b6c in qemu_coroutine_enter (co=0x7fd574300df0) at /build/pb-qemu-pssKUp/pb-qemu-2.7.0/util/qemu-coroutine.c:113 +#3 0x0000556aed247e55 in qemu_co_queue_run_restart (co=0x7fd574300ce0) at /build/pb-qemu-pssKUp/pb-qemu-2.7.0/util/qemu-coroutine-lock.c:60 +#4 0x0000556aed2479a9 in qemu_coroutine_enter (co=0x7fd574300ce0) at /build/pb-qemu-pssKUp/pb-qemu-2.7.0/util/qemu-coroutine.c:119 +#5 0x0000556aed247e74 in qemu_co_queue_run_restart (co=0x7fd589111670) at /build/pb-qemu-pssKUp/pb-qemu-2.7.0/util/qemu-coroutine-lock.c:60 +#6 0x0000556aed2479a9 in qemu_coroutine_enter (co=0x7fd589111670) at /build/pb-qemu-pssKUp/pb-qemu-2.7.0/util/qemu-coroutine.c:119 +#7 0x0000556aed247e74 in qemu_co_queue_run_restart (co=0x7fd57430dba0) at /build/pb-qemu-pssKUp/pb-qemu-2.7.0/util/qemu-coroutine-lock.c:60 +#8 0x0000556aed2479a9 in qemu_coroutine_enter (co=0x7fd57430dba0) at /build/pb-qemu-pssKUp/pb-qemu-2.7.0/util/qemu-coroutine.c:119 +#9 0x0000556aed247e74 in qemu_co_queue_run_restart (co=0x7fd589119130) at /build/pb-qemu-pssKUp/pb-qemu-2.7.0/util/qemu-coroutine-lock.c:60 +#10 0x0000556aed2479a9 in qemu_coroutine_enter (co=0x7fd589119130) at /build/pb-qemu-pssKUp/pb-qemu-2.7.0/util/qemu-coroutine.c:119 +#11 0x0000556aed247e74 in qemu_co_queue_run_restart (co=0x7fd589117410) at /build/pb-qemu-pssKUp/pb-qemu-2.7.0/util/qemu-coroutine-lock.c:60 +#12 0x0000556aed2479a9 in qemu_coroutine_enter (co=0x7fd589117410) at /build/pb-qemu-pssKUp/pb-qemu-2.7.0/util/qemu-coroutine.c:119 +#13 0x0000556aed247e74 in qemu_co_queue_run_restart (co=0x7fd577f00e00) at /build/pb-qemu-pssKUp/pb-qemu-2.7.0/util/qemu-coroutine-lock.c:60 +#14 0x0000556aed2479a9 in qemu_coroutine_enter (co=0x7fd577f00e00) at /build/pb-qemu-pssKUp/pb-qemu-2.7.0/util/qemu-coroutine.c:119 +#15 0x0000556aed247fa0 in qemu_co_enter_next (queue=queue@entry=0x556aef34e5e0) at /build/pb-qemu-pssKUp/pb-qemu-2.7.0/util/qemu-coroutine-lock.c:106 +#16 0x0000556aed1e6060 in timer_cb (blk=0x556aef34e590, is_write=<optimized out>) at /build/pb-qemu-pssKUp/pb-qemu-2.7.0/block/throttle-groups.c:400 +#17 0x0000556aed1a3615 in timerlist_run_timers (timer_list=0x556aef3bad40) at /build/pb-qemu-pssKUp/pb-qemu-2.7.0/qemu-timer.c:528 +#18 0x0000556aed1a3679 in timerlistgroup_run_timers (tlg=tlg@entry=0x556af0738758) at /build/pb-qemu-pssKUp/pb-qemu-2.7.0/qemu-timer.c:564 +#19 0x0000556aed1a3f47 in aio_dispatch (ctx=ctx@entry=0x556af0738610) at /build/pb-qemu-pssKUp/pb-qemu-2.7.0/aio-posix.c:357 +#20 0x0000556aed1a40e8 in aio_poll (ctx=0x556af0738610, blocking=<optimized out>) at /build/pb-qemu-pssKUp/pb-qemu-2.7.0/aio-posix.c:479 +#21 0x0000556aed005c79 in iothread_run (opaque=0x556af07383c0) at /build/pb-qemu-pssKUp/pb-qemu-2.7.0/iothread.c:46 +#22 0x00007fd7cc9f40a4 in start_thread (arg=0x7fd7aafff700) at pthread_create.c:403 +#23 0x00007fd7cc72962d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111 +-------------------------------------------------------------------------- + +The code crashes here +-------------------------------------------------------------------------- +void qemu_coroutine_enter(Coroutine *co) +{ + Coroutine *self = qemu_coroutine_self(); + CoroutineAction ret; + + trace_qemu_coroutine_enter(self, co, co->entry_arg); + + if (co->caller) { + fprintf(stderr, "Co-routine re-entered recursively\n"); + abort(); <--- Code aborts here + } + + [...] +} +-------------------------------------------------------------------------- + +Debugging further we see: +-------------------------------------------------------------------------- +(gdb) frame 2 +#2 0x0000556aed247b6c in qemu_coroutine_enter (co=0x7fd574300df0) at /build/pb-qemu-pssKUp/pb-qemu-2.7.0/util/qemu-coroutine.c:113 +113 /build/pb-qemu-pssKUp/pb-qemu-2.7.0/util/qemu-coroutine.c: No such file or directory. +(gdb) print *co +$1 = {entry = 0x7fd793e95a58, entry_arg = 0x1, caller = 0x7fd793e95a38, pool_next = {sle_next = 0x10}, co_queue_wakeup = {sqh_first = 0x7fd6ebbd2000, sqh_last = 0x1000}, co_queue_next = { + sqe_next = 0x7fd6ebbd1000}} +(gdb) print *co->caller +$2 = {entry = 0x400400000001, entry_arg = 0xc546a20, caller = 0x0, pool_next = {sle_next = 0x0}, co_queue_wakeup = {sqh_first = 0x0, sqh_last = 0xffffea00061f7480}, co_queue_next = {sqe_next = 0x100000000000}} +(gdb) frame 4 +#4 0x0000556aed2479a9 in qemu_coroutine_enter (co=0x7fd574300ce0) at /build/pb-qemu-pssKUp/pb-qemu-2.7.0/util/qemu-coroutine.c:119 +119 in /build/pb-qemu-pssKUp/pb-qemu-2.7.0/util/qemu-coroutine.c +(gdb) print *co +$3 = {entry = 0xc00000053, entry_arg = 0x7fd500000001, caller = 0x7fd574300d88, pool_next = {sle_next = 0x7fd574300d90}, co_queue_wakeup = {sqh_first = 0x7fd6ebbd1000, sqh_last = 0x7fd574300e00}, + co_queue_next = {sqe_next = 0xc546a20}} +(gdb) print *co->caller +$4 = {entry = 0x230095a58, entry_arg = 0x230095a38, caller = 0x187dd2000, pool_next = {sle_next = 0x187dd1000}, co_queue_wakeup = {sqh_first = 0x187dd0000, sqh_last = 0x187dcf000}, co_queue_next = { + sqe_next = 0x184970000}} +-------------------------------------------------------------------------- + +The question is, why did qemu_coroutine_enter not complain when in earlier calls co->caller was not NULL? \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1675549 b/results/classifier/mode-deepseek-r1:32b/output/system/1675549 new file mode 100644 index 00000000..86f8018b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1675549 @@ -0,0 +1,16 @@ + + +tcg softmmu i386 crashes on BE hardware + +Hi, +today i try to test qemu 2.9rc 1 with qemu-system-i386 if i set display as sdl and i push a key on keyboard qemu exit with an error + +translate-common.c:34:tcg_handle_interrupt: assertion failed: (qemu_mutex_iothread_locked()) + +This issue was not present on qemu 2.8.0 + +Test Machine PowerMac G5 Quad Fedora 25 Server PPC64 +Qemu build with target-list=i386-softmuu --with-sdlabi=2.0 + +Ciao +Luigi \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1680 b/results/classifier/mode-deepseek-r1:32b/output/system/1680 new file mode 100644 index 00000000..6def7448 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1680 @@ -0,0 +1,104 @@ + + +qemu-system-x86_64: ../softmmu/memory.c:1111: memory_region_transaction_commit: Assertion `qemu_mutex_iothread_locked()' failed. +Description of problem: +While testing master build, I have the following crash on shutdown of the VM: +qemu-system-x86_64: ../softmmu/memory.c:1111: memory_region_transaction_commit: Assertion `qemu_mutex_iothread_locked()' failed. +Steps to reproduce: +1. Run VM +2. Once booted, do poweroff inside the Linux VM +3. When poweroff completes, qemu crashes. +Additional information: +```(gdb) bt full +#0 0x00007ffff29edacf in raise () at /lib64/libc.so.6 +#1 0x00007ffff29c0ea5 in abort () at /lib64/libc.so.6 +#2 0x00007ffff29c0d79 in _nl_load_domain.cold.0 () at /lib64/libc.so.6 +#3 0x00007ffff29e6426 in () at /lib64/libc.so.6 +#4 0x0000555555bed6d3 in memory_region_transaction_commit () at ../softmmu/memory.c:1111 + as = <optimized out> + __PRETTY_FUNCTION__ = "memory_region_transaction_commit" +#5 0x0000555555bef2bf in memory_region_add_eventfd (mr=mr@entry=0x555557c318a0, addr=<optimized out>, size=size@entry=0, match_data=<optimized out>, data=<optimized out>, e=<optimized out>) at ../softmmu/memory.c:2583 + mrfd = {addr = {start = 0, size = 0}, match_data = false, data = 0, e = 0x555557c41aa4} + i = <optimized out> +#6 0x0000555555a2c85c in virtio_pci_ioeventfd_assign (d=0x555557c30a00, notifier=0x555557c41aa4, n=0, assign=<optimized out>) at ../hw/virtio/virtio-pci.c:347 + proxy = 0x555557c30a00 + vdev = <optimized out> + vq = <optimized out> + legacy = true + modern = <optimized out> + fast_mmio = true + modern_pio = false + modern_mr = <optimized out> + modern_notify_mr = 0x555557c319c0 + legacy_mr = 0x555557c31430 + modern_addr = <optimized out> +#7 0x0000555555a2be78 in virtio_bus_set_host_notifier (bus=0x555557c38d50, n=n@entry=0, assign=assign@entry=true) at ../hw/virtio/virtio-bus.c:296 + vdev = <optimized out> + k = 0x555556a7b620 + proxy = 0x555557c30a00 + vq = 0x555557c41a30 + notifier = 0x555557c41aa4 + r = <optimized out> + __func__ = "virtio_bus_set_host_notifier" +#8 0x0000555555ba1595 in virtio_scsi_set_host_notifier (s=s@entry=0x555557c38dd0, n=n@entry=0, vq=<optimized out>) at /root/qemu/include/hw/virtio/virtio-bus.h:35 + qbus = <optimized out> + rc = <optimized out> +#9 0x0000555555ba1860 in virtio_scsi_dataplane_start (vdev=<optimized out>) at ../hw/scsi/virtio-scsi-dataplane.c:130 + i = <optimized out> + rc = <optimized out> + vq_init_count = 0 + qbus = 0x555557c38d50 + k = 0x555556a7b620 + vs = 0x555557c38dd0 + s = 0x555557c38dd0 +#10 0x0000555555a2bbd2 in virtio_bus_start_ioeventfd (bus=0x555557c38d50) at ../hw/virtio/virtio-bus.c:236 + k = <optimized out> + proxy = 0x555557c30a00 + vdev = 0x555557c38dd0 + vdc = 0x555556a19cc0 + r = <optimized out> + __func__ = "virtio_bus_start_ioeventfd" +#11 0x0000555555bc0739 in virtio_device_start_ioeventfd (vdev=vdev@entry=0x555557c38dd0) at ../hw/virtio/virtio.c:3741 + qbus = <optimized out> + vbus = <optimized out> +#12 0x0000555555b9fc80 in virtio_scsi_defer_to_dataplane (s=0x555557c38dd0) at ../hw/scsi/virtio-scsi.c:614 + s = 0x555557c38dd0 +#13 0x0000555555b9fc80 in virtio_scsi_defer_to_dataplane (s=0x555557c38dd0) at ../hw/scsi/virtio-scsi.c:608 + s = 0x555557c38dd0 +#14 0x0000555555b9fc80 in virtio_scsi_handle_event (vdev=<optimized out>, vq=<optimized out>) at ../hw/scsi/virtio-scsi.c:1011 + s = 0x555557c38dd0 +#15 0x0000555555bba2af in virtio_queue_notify_vq (vq=0x555557c41ac8) at ../hw/virtio/virtio.c:2248 + vdev = 0x555557c38dd0 +#16 0x0000555555de7b08 in aio_dispatch_handler (ctx=ctx@entry=0x555556c2c130, node=0x555557ffbff0) at ../util/aio-posix.c:356 + progress = false + poll_ready = true + revents = <optimized out> +#17 0x0000555555de861c in aio_dispatch_ready_handlers (ready_list=0x7fffde952fe8, ctx=0x555556c2c130) at ../util/aio-posix.c:401 + progress = false + node = <optimized out> + ready_list = {lh_first = 0x0} + progress = true + use_notify_me = <optimized out> + timeout = <optimized out> + start = <optimized out> + __PRETTY_FUNCTION__ = "aio_poll" +#18 0x0000555555de861c in aio_poll (ctx=0x555556c2c130, blocking=blocking@entry=true) at ../util/aio-posix.c:723 + ready_list = {lh_first = 0x0} + progress = true + use_notify_me = <optimized out> + timeout = <optimized out> + start = <optimized out> + __PRETTY_FUNCTION__ = "aio_poll" +#19 0x0000555555ca9ae6 in iothread_run (opaque=opaque@entry=0x555556943200) at ../iothread.c:63 + iothread = 0x555556943200 +#20 0x0000555555deaf6a in qemu_thread_start (args=<optimized out>) at ../util/qemu-thread-posix.c:541 + __cancel_buf = {__cancel_jmp_buf = {{__cancel_jmp_buf = {93825016192880, 1094026140696841148, 140737488341294, 140737488341295, 140737488341440, 140736927707584, 6520036150746942396, 1094028099712322492}, __mask_was_saved = 0}}, __pad = {0x7fffde953110, 0x0, 0x0, 0x0}} + __cancel_routine = 0x555555deafc0 <qemu_thread_atexit_notify> + __not_first_call = <optimized out> + qemu_thread_args = <optimized out> + start_routine = 0x555555ca9aa0 <iothread_run> + arg = 0x555556943200 + r = <optimized out> +#21 0x00007ffff2d6c1ca in start_thread () at /lib64/libpthread.so.0 +#22 0x00007ffff29d8e73 in clone () at /lib64/libc.so.6 +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1683 b/results/classifier/mode-deepseek-r1:32b/output/system/1683 new file mode 100644 index 00000000..9e9f80f3 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1683 @@ -0,0 +1,3 @@ + + +How to run qemu inside ubuntu:latest docker container? diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1690 b/results/classifier/mode-deepseek-r1:32b/output/system/1690 new file mode 100644 index 00000000..9404e7bf --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1690 @@ -0,0 +1,5 @@ + + +arguments to specify mapping offsets or map like a elf loader for memory backend file +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1693 b/results/classifier/mode-deepseek-r1:32b/output/system/1693 new file mode 100644 index 00000000..4eb13bc2 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1693 @@ -0,0 +1,31 @@ + + +qemu-system-nios2 not working on s390x (big endian) hosts +Description of problem: +qemu-system-nios2 fails to boot a Linux kernel on s390x hosts. +Steps to reproduce: +1. wget https://qemu-advcal.gitlab.io/qac-best-of-multiarch/download/day14.tar.xz +2. tar -xJf day14.tar.xz +3. cd day14/ +4. qemu-system-nios2 -nographic -kernel vmlinux.elf +Additional information: +When running with "-d in_asm", it seems like the code initially starts executing ok, but in one of the early translation blocks, there is a difference when comparing the log with a run from a x86 host: + +``` +IN: fdt_check_header +0xc81afd48: ldw r3,0(r4) +0xc81afd4c: srli r5,r3,24 +0xc81afd50: slli r2,r3,24 +0xc81afd54: or r2,r2,r5 +0xc81afd58: slli r5,r3,8 +0xc81afd5c: srli r3,r3,8 +0xc81afd60: andhi r5,r5,255 +0xc81afd64: andi r3,r3,65280 +0xc81afd68: or r2,r2,r5 +0xc81afd6c: or r2,r2,r3 +0xc81afd70: movhi r3,53262 +0xc81afd74: addi r3,r3,-275 +0xc81afd78: bne r2,r3,0xc81afde8 +``` + +On the x86 host, the branch at the end is not taken, while on the s390x host, the branch is taken. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1693667 b/results/classifier/mode-deepseek-r1:32b/output/system/1693667 new file mode 100644 index 00000000..93b47c85 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1693667 @@ -0,0 +1,30 @@ + + +-cpu haswell / broadwell have no MONITOR in features1 + +In qemu 2.9.0 if you run + + qemu-system-x86_64 -cpu Broadwell (or Haswell) + +then the CPU features1 flag include the SSE3 bit, but do NOT include the MONITOR/MWAIT bit. This is so even when the host includes the features. + + +Additionally, running qemu in this manner results in several error messages: + +warning: TCG doesn't support requested feature: CPUID.01H:ECX.fma [bit 12] +warning: TCG doesn't support requested feature: CPUID.01H:ECX.pcid [bit 17] +warning: TCG doesn't support requested feature: CPUID.01H:ECX.x2apic [bit 21] +warning: TCG doesn't support requested feature: CPUID.01H:ECX.tsc-deadline [bit 24] +warning: TCG doesn't support requested feature: CPUID.01H:ECX.avx [bit 28] +warning: TCG doesn't support requested feature: CPUID.01H:ECX.f16c [bit 29] +warning: TCG doesn't support requested feature: CPUID.01H:ECX.rdrand [bit 30] +warning: TCG doesn't support requested feature: CPUID.07H:EBX.hle [bit 4] +warning: TCG doesn't support requested feature: CPUID.07H:EBX.avx2 [bit 5] +warning: TCG doesn't support requested feature: CPUID.07H:EBX.invpcid [bit 10] +warning: TCG doesn't support requested feature: CPUID.07H:EBX.rtm [bit 11] +warning: TCG doesn't support requested feature: CPUID.07H:EBX.rdseed [bit 18] +warning: TCG doesn't support requested feature: CPUID.80000001H:ECX.3dnowprefetch + + +(Among possible other uses, the lack of the MONITOR feature bit causes NetBSD to fall-back on a +check-and-pause loop while an application CPU is waiting to be told to proceed by the boot CPU.) \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1694 b/results/classifier/mode-deepseek-r1:32b/output/system/1694 new file mode 100644 index 00000000..c78699f8 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1694 @@ -0,0 +1,3 @@ + + +cpu-x86-uarch-abi.py is missing "xsave" cpuid for x86-64-v3 && x86-64-v4 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1694998 b/results/classifier/mode-deepseek-r1:32b/output/system/1694998 new file mode 100644 index 00000000..f158ca31 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1694998 @@ -0,0 +1,13 @@ + + +PPC: msgsnd instruction leads to assertion + +I tried to send doorbells (using msgsnd) between cores in guest OS. On QEMU v2.9.0 usage of msgsnd instruction leads to error: +ERROR: <...>/qemu-new/translate-common.c:34:tcg_handle_interrupt: assertion failed: (qemu_mutex_iothread_locked()) + + +QEMU v2.8.0 works fine. + +QEMU run options: qemu-system-ppc -serial stdio -M ppce500 -cpu e500mc -smp 2 -m 512M -kernel pok.elf + +pok.elf attached \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1695169 b/results/classifier/mode-deepseek-r1:32b/output/system/1695169 new file mode 100644 index 00000000..bac0aa96 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1695169 @@ -0,0 +1,7 @@ + + +qga fail to start when pidfile path is missing + +The qga main program has two parameters: "--logfile" and "--pidfile" which specifies the paths to the logfile and pidfile. It assumes that the paths exit in the running OS but if not, the qga will fail to start.I think qga should create the missing paths. + +I found this bug exits in several Linux distributions including Ubuntu 14, Cent-OS 6 and 7 when the original and the latest master qga applies. I have a patch which can fix it. Should I patch it to the QEMU master branch? \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1698 b/results/classifier/mode-deepseek-r1:32b/output/system/1698 new file mode 100644 index 00000000..4c9a0bb7 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1698 @@ -0,0 +1,3 @@ + + +Global-buffer-overflow in QEMU TirCore TCG diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1699 b/results/classifier/mode-deepseek-r1:32b/output/system/1699 new file mode 100644 index 00000000..d53047d8 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1699 @@ -0,0 +1,3 @@ + + +Tricore: Call instruction wrong diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1699277 b/results/classifier/mode-deepseek-r1:32b/output/system/1699277 new file mode 100644 index 00000000..9bd26873 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1699277 @@ -0,0 +1,116 @@ + + +qemu-system-s390x: asserts while booting Debian Stretch installer + +QEMU 2.9.0 (Arch Linux) asserts when I try to install Debian Stretch. + +Steps to reproduce: + +wget http://ftp.debian.org/debian/dists/stretch/main/installer-s390x/current/images/generic/initrd.debian +wget http://ftp.debian.org/debian/dists/stretch/main/installer-s390x/current/images/generic/kernel.debian +qemu-img create -f qcow2 hda.qcow2 80G +qemu-system-s390x -kernel kernel.debian -initrd initrd.debian -nographic -drive file=hda.qcow2 + +Output: + +[ 0.051915] Linux version 4.9.0-3-s390x (<email address hidden>) (gcc version 6.3.0 20170516 (Debian 6.3.0-18) ) #1 SMP Debian 4.9.30-2 (2017-06-12) +[ 0.053000] setup: Linux is running under KVM in 64-bit mode +[ 0.053780] setup: Max memory size: 128MB +[ 0.067239] Write protected kernel read-only data: 8848k +[ 0.082461] Zone ranges: +[ 0.083717] DMA [mem 0x0000000000000000-0x000000007fffffff] +[ 0.084163] Normal empty +[ 0.084185] Movable zone start for each node +[ 0.084223] Early memory node ranges +[ 0.084306] node 0: [mem 0x0000000000000000-0x0000000007ffffff] +[ 0.084468] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff] +[ 0.087697] percpu: Embedded 19 pages/cpu @0000000007f87000 s40704 r8192 d28928 u77824 +[ 0.088991] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32256 +[ 0.089108] Kernel command line: +[ 0.096684] PID hash table entries: 512 (order: 0, 4096 bytes) +[ 0.096853] Dentry cache hash table entries: 16384 (order: 5, 131072 bytes) +[ 0.097041] Inode-cache hash table entries: 8192 (order: 4, 65536 bytes) +[ 0.102453] Memory: 105164K/131072K available (6060K kernel code, 802K rwdata, 2784K rodata, 508K init, 648K bss, 25908K reserved, 0K cma-reserved) +[ 0.109112] Hierarchical RCU implementation. +[ 0.109134] Build-time adjustment of leaf fanout to 64. +[ 0.109155] RCU restricting CPUs from NR_CPUS=256 to nr_cpu_ids=2. +[ 0.109194] RCU: Adjusting geometry for rcu_fanout_leaf=64, nr_cpu_ids=2 +[ 0.122047] NR_IRQS:3 nr_irqs:3 3 +[ 0.124317] clocksource: tod: mask: 0xffffffffffffffff max_cycles: 0x3b0a9be803b0a9, max_idle_ns: 1805497147909793 ns +[ 0.138366] console [ttyS1] enabled +[ 0.139126] pid_max: default: 32768 minimum: 301 +[ 0.143164] Security Framework initialized +[ 0.143215] Yama: disabled by default; enable with sysctl kernel.yama.* +[ 0.143955] AppArmor: AppArmor disabled by boot time parameter +[ 0.144489] Mount-cache hash table entries: 512 (order: 0, 4096 bytes) +[ 0.144538] Mountpoint-cache hash table entries: 512 (order: 0, 4096 bytes) +[ 0.156937] ftrace: allocating 19165 entries in 75 pages +[ 0.408921] cpu: 1 configured CPUs, 0 standby CPUs +[ 0.433942] Brought up 1 CPUs +[ 0.451811] devtmpfs: initialized +[ 0.467021] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns +[ 0.467549] futex hash table entries: 512 (order: 5, 131072 bytes) +[ 0.476626] NET: Registered protocol family 16 +[ 0.482575] The s390-virtio transport is deprecated. Please switch to a modern host providing virtio-ccw. +[ 0.693017] VFS: Disk quotas dquot_6.6.0 +[ 0.693296] VFS: Dquot-cache hash table entries: 512 (order 0, 4096 bytes) +[ 0.695029] hugetlbfs: disabling because there are no supported hugepage sizes +[ 0.703040] NET: Registered protocol family 2 +[ 0.709803] TCP established hash table entries: 1024 (order: 1, 8192 bytes) +[ 0.710003] TCP bind hash table entries: 1024 (order: 2, 16384 bytes) +[ 0.710134] TCP: Hash tables configured (established 1024 bind 1024) +[ 0.710879] UDP hash table entries: 256 (order: 1, 8192 bytes) +[ 0.711005] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes) +[ 0.712409] NET: Registered protocol family 1 +[ 0.717432] Unpacking initramfs... +[ 1.308935] random: fast init done +[ 1.597369] Freeing initrd memory: 10152K (0000000000f90000 - 000000000197a000) +[ 1.600200] hypfs: The hardware system does not support hypfs +[ 1.601718] hypfs: Initialization of hypfs failed with rc=-61 +[ 1.605317] audit: initializing netlink subsys (disabled) +[ 1.606211] audit: type=2000 audit(1497977949.601:1): initialized +[ 1.611137] workingset: timestamp_bits=46 max_order=15 bucket_order=0 +[ 1.612066] zbud: loaded +[ 1.642108] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 252) +[ 1.643111] io scheduler noop registered +[ 1.643160] io scheduler deadline registered +[ 1.643383] io scheduler cfq registered (default) +[ 1.644143] pci_hotplug: PCI Hot Plug PCI Core version: 0.5 +[ 1.644221] pciehp: PCI Express Hot Plug Controller Driver version: 0.4 +[ 1.645626] hvc_iucv: The z/VM IUCV HVC device driver cannot be used without z/VM +[ 1.647547] mousedev: PS/2 mouse device common for all mice +[ 1.649359] ledtrig-cpu: registered to indicate activity on CPUs +[ 1.649884] cio: Channel measurement facility initialized using format extended (mode autodetected) +[ 1.657228] NET: Registered protocol family 10 +[ 1.663924] mip6: Mobile IPv6 +[ 1.664068] NET: Registered protocol family 17 +[ 1.664195] mpls_gso: MPLS GSO support +[ 1.667936] registered taskstats version 1 +[ 1.669547] zswap: loaded using pool lzo/zbud +[ 1.674474] ima: No TPM chip found, activating TPM-bypass! +[ 1.739953] Freeing unused kernel memory: 508K (0000000000a6f000 - 0000000000aee000) +[ 1.740381] Write protected read-only-after-init data: 4k +** +ERROR:/build/qemu/src/qemu-2.9.0/translate-common.c:34:tcg_handle_interrupt: assertion failed: (qemu_mutex_iothread_locked()) +[1] 13880 abort (core dumped) qemu-system-s390x -kernel kernel.debian -initrd initrd.debian -nographic + +Trace: +#0 0x00007ffff10fb670 in raise () at /usr/lib/libc.so.6 +#1 0x00007ffff10fcd00 in abort () at /usr/lib/libc.so.6 +#2 0x00007ffff35dfc9d in g_assertion_message () at /usr/lib/libglib-2.0.so.0 +#3 0x00007ffff35dfd2a in g_assertion_message_expr () at /usr/lib/libglib-2.0.so.0 +#4 0x00005555556abb84 in () +#5 0x000055555572ab73 in css_adapter_interrupt () +#6 0x000055555571be68 in virtio_notify () +#7 0x00005555556f84ce in () +#8 0x00005555556f9afd in () +#9 0x00005555556fa78f in virtio_blk_handle_vq () +#10 0x000055555571b7f1 in virtio_queue_notify () +#11 0x000055555572ceb7 in () +#12 0x0000555555726f86 in s390_virtio_hypercall () +#13 0x0000555555752c85 in helper_diag () +#14 0x00007fffe46664bf in code_gen_buffer () +#15 0x00005555556ab2f5 in cpu_exec () +#16 0x00005555556ce08d in () +#17 0x00007ffff1474297 in start_thread () at /usr/lib/libpthread.so.0 +#18 0x00007ffff11b525f in clone () at /usr/lib/libc.so.6 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1699824 b/results/classifier/mode-deepseek-r1:32b/output/system/1699824 new file mode 100644 index 00000000..852170e7 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1699824 @@ -0,0 +1,231 @@ + + +qemu-system-sparc64 -M sun4v aborts on tribblix-sparc-0m16.iso + +qemu-system-sparc64 qemu-2.9.0-3.10.x86_64 on openSUSE Leap 42.3 using 'sun4v' machine aborts with tribblix. With 2048 MB of RAM it takes considerably more time to abort (but the core is always truncated). + +> qemu-system-sparc64 -m 1024 -cdrom tribblix-sparc-0m16.iso -boot d -nographic -M sun4v +qemu: fatal: Trap 0x0010 while trap level (6) >= MAXTL (6), Error state +pc: 0000000000000200 npc: 0000000000000204 +%g0-3: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +%g4-7: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +%o0-3: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +%o4-7: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +%l0-3: 000000003ff00000 000001ff00000000 000001fff0080000 0000000000000000 +%l4-7: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +%i0-3: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +%i4-7: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +%f00: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +%f08: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +%f16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +%f24: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +%f32: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +%f40: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +%f48: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +%f56: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +pstate: 00000014 ccr: 44 (icc: -Z-- xcc: -Z--) asi: 00 tl: 6 pil: 0 gl: 8 +tbr: 0000000000000000 hpstate: 0000000000000004 htba: 0000000000000000 +cansave: 6 canrestore: 0 otherwin: 0 wstate: 0 cleanwin: 6 cwp: 7 +fsr: 0000000000000000 y: 0000000000000000 fprs: 0000000000000000 + +Aborted (core dumped) + + + PID: 26999 (qemu-system-spa) + UID: 1000 (newman) + GID: 100 (users) + Signal: 6 (ABRT) + Timestamp: Thu 2017-06-22 16:19:02 CEST (1min 5s ago) + Command Line: qemu-system-sparc64 -m 1024 -cdrom tribblix-sparc-0m16.iso -boot d -nographic -M sun4v + Executable: /usr/bin/qemu-system-sparc64 + Control Group: / + Slice: -.slice + Boot ID: aa7431274f854fb7a02a773eefa8a9bb + Machine ID: 89c660865c00403a9bacef32b6828556 + Hostname: assam.suse.cz + Coredump: /var/lib/systemd/coredump/core.qemu-system-spa.1000.aa7431274f854fb7a02a773eefa8a9bb.26999.1498141142000000.xz + Message: Process 26999 (qemu-system-spa) of user 1000 dumped core. + + + +(gdb) thread apply all bt full + +Thread 4 (Thread 0x7f3896aca700 (LWP 27001)): +#0 0x00007f38bb983295 in do_futex_wait () at /lib64/libpthread.so.0 +#1 0x00007f38bb983349 in __new_sem_wait_slow () at /lib64/libpthread.so.0 +#2 0x00007f38bb9833f7 in sem_timedwait () at /lib64/libpthread.so.0 +#3 0x00005599ec6a1147 in qemu_sem_timedwait (sem=sem@entry=0x5599ef168628, ms=ms@entry=10000) at util/qemu-thread-posix.c:255 + rc = <optimized out> + ts = {tv_sec = 1498141152, tv_nsec = 280531000} + __func__ = "qemu_sem_timedwait" +#4 0x00005599ec69c83c in worker_thread (opaque=0x5599ef1685c0) at util/thread-pool.c:92 + req = <optimized out> + ret = <optimized out> + pool = 0x5599ef1685c0 +#5 0x00007f38bb97c744 in start_thread () at /lib64/libpthread.so.0 +#6 0x00007f38b79bdd3d in clone () at /lib64/libc.so.6 + +Thread 3 (Thread 0x7f38bee01c40 (LWP 26999)): +#0 0x00007f38b79b555f in ppoll () at /lib64/libc.so.6 +#1 0x00005599ec69d289 in ppoll (__ss=0x0, __timeout=0x7ffd1dcf2a20, __nfds=<optimized out>, __fds=<optimized out>) at /usr/include/bits/poll2.h:77 + ts = {tv_sec = 1, tv_nsec = 0} +Python Exception <class 'gdb.error'> That operation is not available on integers of more than 8 bytes.: +#2 0x00005599ec69d289 in qemu_poll_ns (fds=<optimized out>, nfds=<optimized out>, timeout=timeout@entry=1000000000) at util/qemu-timer.c:334 + ts = {tv_sec = 1, tv_nsec = 0} +Python Exception <class 'gdb.error'> That operation is not available on integers of more than 8 bytes.: +#3 0x00005599ec69dff8 in os_host_main_loop_wait (timeout=1000000000) at util/main-loop.c:255 + context = 0x5599ef147470 + ret = <optimized out> + spin_counter = 0 + ret = -283872144 + timeout = 1000 +#4 0x00005599ec69dff8 in main_loop_wait (nonblocking=<optimized out>) at util/main-loop.c:517 + ret = -283872144 + timeout = 1000 +#5 0x00005599ec3c8c5f in main_loop () at vl.c:1900 + i = <optimized out> + snapshot = <optimized out> + linux_boot = <optimized out> + initrd_filename = <optimized out> + kernel_filename = <optimized out> + kernel_cmdline = <optimized out> + boot_order = <optimized out> + boot_once = 0x0 + ds = <optimized out> + cyls = <optimized out> + heads = <optimized out> + secs = <optimized out> + translation = <optimized out> + opts = <optimized out> + hda_opts = <optimized out> + icount_opts = <optimized out> + accel_opts = <optimized out> + olist = <optimized out> + optind = 10 + optarg = 0x7ffd1dcf51d2 "sun4v" + loadvm = <optimized out> + machine_class = 0x5599ec6d6f6f + cpu_model = <optimized out> + vga_model = 0x5599ec6d6f81 "std" + qtest_chrdev = <optimized out> + qtest_log = <optimized out> + pid_file = <optimized out> + incoming = <optimized out> + defconfig = <optimized out> + userconfig = <optimized out> + nographic = <optimized out> + display_type = <optimized out> + display_remote = <optimized out> + log_mask = <optimized out> + log_file = <optimized out> + trace_file = <optimized out> + maxram_size = <optimized out> + ram_slots = <optimized out> + vmstate_dump_file = <optimized out> + main_loop_err = 0x0 + err = 0x0 + list_data_dirs = <optimized out> + bdo_queue = {sqh_first = 0x0, sqh_last = 0x7ffd1dcf2ba0} + rlimit_as = {rlim_cur = 18446744073709551615, rlim_max = 18446744073709551615} + __func__ = "main" + __FUNCTION__ = "main" +#6 0x00005599ec3c8c5f in main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at vl.c:4730 + i = <optimized out> + snapshot = <optimized out> + linux_boot = <optimized out> + initrd_filename = <optimized out> + kernel_filename = <optimized out> + kernel_cmdline = <optimized out> + boot_order = <optimized out> + boot_once = 0x0 + ds = <optimized out> + cyls = <optimized out> + heads = <optimized out> + secs = <optimized out> + translation = <optimized out> + opts = <optimized out> + hda_opts = <optimized out> + icount_opts = <optimized out> + accel_opts = <optimized out> + olist = <optimized out> + optind = 10 + optarg = 0x7ffd1dcf51d2 "sun4v" + loadvm = <optimized out> + machine_class = 0x5599ec6d6f6f + cpu_model = <optimized out> + vga_model = 0x5599ec6d6f81 "std" + qtest_chrdev = <optimized out> + qtest_log = <optimized out> + pid_file = <optimized out> + incoming = <optimized out> + defconfig = <optimized out> + userconfig = <optimized out> + nographic = <optimized out> + display_type = <optimized out> + display_remote = <optimized out> + log_mask = <optimized out> + log_file = <optimized out> + trace_file = <optimized out> + maxram_size = <optimized out> + ram_slots = <optimized out> + vmstate_dump_file = <optimized out> + main_loop_err = 0x0 + err = 0x0 + list_data_dirs = <optimized out> + bdo_queue = {sqh_first = 0x0, sqh_last = 0x7ffd1dcf2ba0} + rlimit_as = {rlim_cur = 18446744073709551615, rlim_max = 18446744073709551615} + __func__ = "main" + __FUNCTION__ = "main" + +Thread 2 (Thread 0x7f38abf99700 (LWP 27000)): +#0 0x00007f38b79b98e9 in syscall () at /lib64/libc.so.6 +#1 0x00005599ec6a12d6 in qemu_futex_wait (val=<optimized out>, f=<optimized out>) at /usr/src/debug/qemu-2.9.0/include/qemu/futex.h:26 + value = <optimized out> +#2 0x00005599ec6a12d6 in qemu_event_wait (ev=ev@entry=0x5599ed0f1e40 <rcu_gp_event>) at util/qemu-thread-posix.c:399 + value = <optimized out> +#3 0x00005599ec6b0a78 in wait_for_readers () at util/rcu.c:131 + qsreaders = {lh_first = 0x7f38abf99588} + index = <optimized out> + tmp = <optimized out> +#4 0x00005599ec6b0a78 in synchronize_rcu () at util/rcu.c:162 +#5 0x00005599ec6b0c79 in call_rcu_thread (opaque=<optimized out>) at util/rcu.c:256 + tries = 0 + n = 565 + node = <optimized out> +#6 0x00007f38bb97c744 in start_thread () at /lib64/libpthread.so.0 +#7 0x00007f38b79bdd3d in clone () at /lib64/libc.so.6 + +Thread 1 (Thread 0x7f38962c9700 (LWP 27002)): +#0 0x00007f38b79088d7 in raise () at /lib64/libc.so.6 +#1 0x00007f38b7909caa in abort () at /lib64/libc.so.6 +#2 0x00005599ec3d1125 in cpu_abort (cpu=cpu@entry=0x5599ef16f800, fmt=fmt@entry=0x5599ec6d3388 "Trap 0x%04x while trap level (%d) >= MAXTL (%d), Error state") at /usr/src/debug/qemu-2.9.0/exec.c:962 + ap = {{gp_offset = 40, fp_offset = 48, overflow_arg_area = 0x7f38962c88b0, reg_save_area = 0x7f38962c87d0}} + ap2 = {{gp_offset = 16, fp_offset = 48, overflow_arg_area = 0x7f38962c88b0, reg_save_area = 0x7f38962c87d0}} +#3 0x00005599ec4790b8 in sparc_cpu_do_interrupt (cs=0x5599ef16f800) at /usr/src/debug/qemu-2.9.0/target/sparc/int64_helper.c:119 + cpu = 0x5599ef16f800 + __func__ = "sparc_cpu_do_interrupt" + env = 0x5599ef177a98 + intno = 16 + tsptr = 0x6 +#4 0x00005599ec3dcf54 in cpu_handle_exception (ret=<synthetic pointer>, cpu=0x5599ef12e000) at /usr/src/debug/qemu-2.9.0/cpu-exec.c:463 + cc = 0x5599ef12e000 + cc = <optimized out> + __func__ = "cpu_exec" + ret = <optimized out> + sc = {diff_clk = 0, last_cpu_icount = 0, realtime_clock = <optimized out>} + __FUNCTION__ = "cpu_exec" +#5 0x00005599ec3dcf54 in cpu_exec (cpu=cpu@entry=0x5599ef16f800) at /usr/src/debug/qemu-2.9.0/cpu-exec.c:668 + cc = <optimized out> + __func__ = "cpu_exec" + ret = <optimized out> + sc = {diff_clk = 0, last_cpu_icount = 0, realtime_clock = <optimized out>} + __FUNCTION__ = "cpu_exec" +#6 0x00005599ec40796d in tcg_cpu_exec (cpu=0x5599ef16f800) at /usr/src/debug/qemu-2.9.0/cpus.c:1260 + ret = <optimized out> + r = -1775462656 + cpu = 0x5599ef16f800 +#7 0x00005599ec40796d in qemu_tcg_rr_cpu_thread_fn (arg=<optimized out>) at /usr/src/debug/qemu-2.9.0/cpus.c:1355 + r = -1775462656 + cpu = 0x5599ef16f800 +#8 0x00007f38bb97c744 in start_thread () at /lib64/libpthread.so.0 +#9 0x00007f38b79bdd3d in clone () at /lib64/libc.so.6 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1700 b/results/classifier/mode-deepseek-r1:32b/output/system/1700 new file mode 100644 index 00000000..41be6b4d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1700 @@ -0,0 +1,3 @@ + + +TriCore: helper_ret() is not correctly restoring PSW diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1706 b/results/classifier/mode-deepseek-r1:32b/output/system/1706 new file mode 100644 index 00000000..8d41cb94 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1706 @@ -0,0 +1,11 @@ + + +Allow TCG plugins to read registers +Additional information: +- `include/qemu/plugin.h` +- `include/qemu/qemu-plugin.h` + +PANDA implemented this already but it is not a very clean solution: +- https://github.com/panda-re/qemu/commit/b97c5a56edd0ba3b5f6ab16bf531ac1f7abaac04 (mentioned in QPP patch series: https://lore.kernel.org/qemu-devel/20221213213757.4123265-1-fasano@mit.edu/) + +I personally think the flag for the TB translation and execution callbacks makes more sense diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1706296 b/results/classifier/mode-deepseek-r1:32b/output/system/1706296 new file mode 100644 index 00000000..895d351e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1706296 @@ -0,0 +1,46 @@ + + +Booting NT 4 disk causes /home/rjones/d/qemu/cpus.c:1580:qemu_mutex_lock_iothread: assertion failed: (!qemu_mutex_iothread_locked()) + +Grab the NT 4 disk from https://archive.org/details/Microsoft_Windows_NT_Server_Version_4.0_227-075-385_CD-KEY_419-1343253_1996 + +Try to boot it as follows: + +qemu-system-x86_64 -hda disk.img -cdrom Microsoft_Windows_NT_Server_Version_4.0_227-075-385_CD-KEY_419-1343253_1996.iso -m 2048 -boot d -machine pc,accel=tcg +WARNING: Image format was not specified for 'disk.img' and probing guessed raw. + Automatically detecting the format is dangerous for raw images, write operations on block 0 will be restricted. + Specify the 'raw' format explicitly to remove the restrictions. +** +ERROR:/home/rjones/d/qemu/cpus.c:1580:qemu_mutex_lock_iothread: assertion failed: (!qemu_mutex_iothread_locked()) +Aborted (core dumped) + +The stack trace in the failing thread is: + +Thread 4 (Thread 0x7fffb0418700 (LWP 21979)): +#0 0x00007fffdd89b64b in raise () at /lib64/libc.so.6 +#1 0x00007fffdd89d450 in abort () at /lib64/libc.so.6 +#2 0x00007fffdff8c75d in g_assertion_message () at /lib64/libglib-2.0.so.0 +#3 0x00007fffdff8c7ea in g_assertion_message_expr () + at /lib64/libglib-2.0.so.0 +#4 0x00005555557a7d00 in qemu_mutex_lock_iothread () + at /home/rjones/d/qemu/cpus.c:1580 +#5 0x00005555557cb429 in io_writex (env=env@entry=0x555556751400, iotlbentry=0x55555675b678, + iotlbentry@entry=0x5aaaaae40c918, val=val@entry=8, addr=addr@entry=2148532220, retaddr=0, retaddr@entry=93825011136120, size=size@entry=4) + at /home/rjones/d/qemu/accel/tcg/cputlb.c:795 +#6 0x00005555557ce0f7 in io_writel (retaddr=93825011136120, addr=2148532220, val=8, index=255, mmu_idx=21845, env=0x555556751400) + at /home/rjones/d/qemu/softmmu_template.h:265 +#7 0x00005555557ce0f7 in helper_le_stl_mmu (env=env@entry=0x555556751400, addr=addr@entry=2148532220, val=val@entry=8, oi=<optimized out>, retaddr=93825011136120, retaddr@entry=0) at /home/rjones/d/qemu/softmmu_template.h:300 +#8 0x000055555587c0a4 in cpu_stl_kernel_ra (env=0x555556751400, ptr=2148532220, v=8, retaddr=0) at /home/rjones/d/qemu/include/exec/cpu_ldst_template.h:182 +#9 0x0000555555882610 in do_interrupt_protected (is_hw=<optimized out>, next_eip=<optimized out>, error_code=2, is_int=<optimized out>, intno=<optimized out>, env=0x555556751400) at /home/rjones/d/qemu/target/i386/seg_helper.c:758 +#10 0x0000555555882610 in do_interrupt_all (cpu=cpu@entry=0x555556749170, intno=<optimized out>, is_int=<optimized out>, error_code=2, next_eip=<optimized out>, is_hw=is_hw@entry=0) at /home/rjones/d/qemu/target/i386/seg_helper.c:1252 +#11 0x00005555558839d3 in x86_cpu_do_interrupt (cs=0x555556749170) + at /home/rjones/d/qemu/target/i386/seg_helper.c:1298 +#12 0x00005555557d2ccb in cpu_handle_exception (ret=<synthetic pointer>, cpu=0x5555566a4590) at /home/rjones/d/qemu/accel/tcg/cpu-exec.c:465 +#13 0x00005555557d2ccb in cpu_exec (cpu=cpu@entry=0x555556749170) + at /home/rjones/d/qemu/accel/tcg/cpu-exec.c:670 +#14 0x00005555557a855a in tcg_cpu_exec (cpu=0x555556749170) + at /home/rjones/d/qemu/cpus.c:1270 +#15 0x00005555557a855a in qemu_tcg_rr_cpu_thread_fn (arg=<optimized out>) + at /home/rjones/d/qemu/cpus.c:1365 +#16 0x00007fffddc3d36d in start_thread () at /lib64/libpthread.so.0 +#17 0x00007fffdd975b9f in clone () at /lib64/libc.so.6 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1708442 b/results/classifier/mode-deepseek-r1:32b/output/system/1708442 new file mode 100644 index 00000000..38c57af2 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1708442 @@ -0,0 +1,78 @@ + + +Crash(assert) during reading image from http url through qemu-nbd + +Description: +During reading image from nbd device mounted by qemu-nbd server with url backend I/O error happens +"blk_update_request: I/O error, dev nbd0, sector 42117" dmesg. After some investigation I found that qemu-nbd server aborts in aio_co_enter() assert in util/async.c:468. + + +Steps to reproduce: + +1) sudo go run qemu-nbd-bug-report/qemu-nbd-bug.go (see qemu-nbd-bug-report.tar.gz) + +or try directly + +1) qemu-nbd -c /dev/nbd0 -r -v --aio=native -f qcow2 json:{"file.driver":"http","file.url":"http://localhost:9666/image","file.readahead":3276800 +2) try read whole nbd device while error in dmesg appears x + +Versions: + +1) qemu built from sources(/configure --target-list=x86_64-softmmu --disable-user --enable-curl --enable-linux-aio --enable-virtfs --enable-debug --disable-pie +, top commit 5619c179057e24195ff19c8fe6d6a6cbcb16ed28): + +qemu-nbd -v +qemu-nbd 2.9.90 (v2.10.0-rc0-67-g5619c17) + +2) libcurl(built from sources, top commit 1767adf4399bb3be29121435e1bb1cc2bc05f7bf): + +curl -V +curl 7.55.0-DEV (Linux) libcurl/7.55.0-DEV OpenSSL/1.0.2g zlib/1.2.8 + + +Backtrace: +(gdb) bt +#0 0x00007f7131426428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54 +#1 0x00007f713142802a in __GI_abort () at abort.c:89 +#2 0x00007f713141ebd7 in __assert_fail_base (fmt=<optimized out>, assertion=assertion@entry=0x54c924 "self != co", + file=file@entry=0x54c871 "util/async.c", line=line@entry=468, + function=function@entry=0x54c980 <__PRETTY_FUNCTION__.24766> "aio_co_enter") at assert.c:92 +#3 0x00007f713141ec82 in __GI___assert_fail (assertion=0x54c924 "self != co", file=0x54c871 "util/async.c", line=468, + function=0x54c980 <__PRETTY_FUNCTION__.24766> "aio_co_enter") at assert.c:101 +#4 0x00000000004fe6a2 in aio_co_enter (ctx=0xf0ddb0, co=0xf14650) at util/async.c:468 +#5 0x00000000004fe637 in aio_co_wake (co=0xf14650) at util/async.c:456 +#6 0x0000000000495c8a in curl_read_cb (ptr=0xf566d9, size=1, nmemb=16135, opaque=0xf1cb90) at block/curl.c:275 +#7 0x00007f713242ac24 in Curl_client_chop_write () from /usr/lib/x86_64-linux-gnu/libcurl.so +#8 0x00007f713242ae03 in Curl_client_write () from /usr/lib/x86_64-linux-gnu/libcurl.so +#9 0x00007f713244e1cf in readwrite_data () from /usr/lib/x86_64-linux-gnu/libcurl.so +#10 0x00007f713244eb6f in Curl_readwrite () from /usr/lib/x86_64-linux-gnu/libcurl.so +#11 0x00007f713245c1bb in multi_runsingle () from /usr/lib/x86_64-linux-gnu/libcurl.so +#12 0x00007f713245d819 in multi_socket () from /usr/lib/x86_64-linux-gnu/libcurl.so +#13 0x00007f713245e067 in curl_multi_socket_action () from /usr/lib/x86_64-linux-gnu/libcurl.so +#14 0x0000000000497555 in curl_setup_preadv (bs=0xf16820, acb=0x7f712d379860) at block/curl.c:918 +#15 0x00000000004975fb in curl_co_preadv (bs=0xf16820, offset=6556160, bytes=512, qiov=0x7f712d379b40, flags=0) at block/curl.c:935 +#16 0x000000000047730f in bdrv_driver_preadv (bs=0xf16820, offset=6556160, bytes=512, qiov=0x7f712d379b40, flags=0) at block/io.c:836 +#17 0x0000000000477c1f in bdrv_aligned_preadv (child=0xf1be20, req=0x7f712d379a60, offset=6556160, bytes=512, align=1, + qiov=0x7f712d379b40, flags=0) at block/io.c:1086 +#18 0x0000000000478109 in bdrv_co_preadv (child=0xf1be20, offset=6556160, bytes=512, qiov=0x7f712d379b40, flags=0) at block/io.c:1180 +#19 0x0000000000437498 in qcow2_co_preadv (bs=0xf0fdc0, offset=21563904, bytes=512, qiov=0x7f712d379e80, flags=0) + at block/qcow2.c:1812 +#20 0x000000000047730f in bdrv_driver_preadv (bs=0xf0fdc0, offset=21563904, bytes=512, qiov=0x7f712d379e80, flags=0) + at block/io.c:836 +#21 0x0000000000477c1f in bdrv_aligned_preadv (child=0xf1c0d0, req=0x7f712d379d30, offset=21563904, bytes=512, align=1, + qiov=0x7f712d379e80, flags=0) at block/io.c:1086 +#22 0x0000000000478109 in bdrv_co_preadv (child=0xf1c0d0, offset=21563904, bytes=512, qiov=0x7f712d379e80, flags=0) + at block/io.c:1180 +#23 0x00000000004645ad in blk_co_preadv (blk=0xf1be90, offset=21563904, bytes=512, qiov=0x7f712d379e80, flags=0) + at block/block-backend.c:991 +#24 0x00000000004646fa in blk_read_entry (opaque=0x7f712d379ea0) at block/block-backend.c:1038 +#25 0x000000000046481c in blk_prw (blk=0xf1be90, offset=21563904, +---Type <return> to continue, or q <return> to quit--- + buf=0xf7f000 "2,NV\241t!\ti\312\vp\364\017Kl*\354\021\a\177\021\260\b\027\212\347\027\004\322\nG\340b\\\306pG\332\313\060\341;\002\360\063L\240\027T \211\341\305\022АE\230\356DǮ}\211\bx\016\a\b\313\350\316\064.\017\372\032-R\376z\261\263\350|cQ<\016S_L\340A\221\366~L#\001+\271\204\065~\327\023\027I\211\343\361\276zT$4\336\273ˏ\353ʪ\234\016_Z|TMk\"\370\002\363~\334\332.\a\375\265mӌ{/%\304֎\374sF<E\371\031o&\202\217\226\276>I\356\302\375F\340\332\324\021\202\232>\026\261\233\303tv\023\304\006\243\037\062BϏ\b\324rs\360'"..., bytes=512, co_entry=0x4646aa <blk_read_entry>, flags=0) at block/block-backend.c:1074 +#26 0x0000000000464f81 in blk_pread (blk=0xf1be90, offset=21563904, buf=0xf7f000, count=512) at block/block-backend.c:1227 +#27 0x00000000004906cb in nbd_trip (opaque=0xf5a940) at nbd/server.c:1380 +#28 0x000000000051c0a5 in coroutine_trampoline (i0=15812176, i1=0) at util/coroutine-ucontext.c:79 +#29 0x00007f713143b5d0 in ?? () from /lib/x86_64-linux-gnu/libc.so.6 +#30 0x00007f712d47a770 in ?? () +#31 0x0000000000000000 in ?? () +Backtrace stopped: Cannot access memory at address 0x7f712d37a000 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1709170 b/results/classifier/mode-deepseek-r1:32b/output/system/1709170 new file mode 100644 index 00000000..a0ac428d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1709170 @@ -0,0 +1,13 @@ + + +QEMU fails to honor O_TMPFILE + +When making a call like + + open("/tmp", O_TMPFILE | O_RDWR); + +under QEMU, we ged -EISDIR. + +Under any kernel 3.11 or later, we are supposed to get an unnamed file in /tmp. In case the filesystem for /tmp does not support unnamed files, we are supposed to get EOPNOTSUPP. + +[I don't know the QEMU version, since this happened in a system I don't have access to] \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/171 b/results/classifier/mode-deepseek-r1:32b/output/system/171 new file mode 100644 index 00000000..679aae06 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/171 @@ -0,0 +1,3 @@ + + +[RFE] option to suppress gemu_log() output diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1711 b/results/classifier/mode-deepseek-r1:32b/output/system/1711 new file mode 100644 index 00000000..c8b637f5 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1711 @@ -0,0 +1,3 @@ + + +unable to set PWD with guest-exec without starting a shell diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1711828 b/results/classifier/mode-deepseek-r1:32b/output/system/1711828 new file mode 100644 index 00000000..a0d8fccc --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1711828 @@ -0,0 +1,5 @@ + + +lock mov non generated #UD + +qemu 2.8.1 debian 9.1 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1713434 b/results/classifier/mode-deepseek-r1:32b/output/system/1713434 new file mode 100644 index 00000000..1483077e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1713434 @@ -0,0 +1,64 @@ + + +prom-env-test test aborted and core dumped + +On ppc64le architecture machine the following test case Aborted and Core dumped. + +# tests/prom-env-test --quiet --keep-going -m=quick --GTestLogFD=6 +** +ERROR:tests/libqtest.c:628:qtest_get_arch: assertion failed: (qemu != NULL) +Aborted (core dumped) + +Steps to re-produce: +clone from the git +configure & compile +run the unit tests by 'make check' + +(gdb) bt +#0 0x00003fff9d60eff0 in raise () from /lib64/libc.so.6 +#1 0x00003fff9d61136c in abort () from /lib64/libc.so.6 +#2 0x00003fff9de1aa04 in g_assertion_message () from /lib64/libglib-2.0.so.0 +#3 0x00003fff9de1ab0c in g_assertion_message_expr () from /lib64/libglib-2.0.so.0 +#4 0x000000001000cc30 in qtest_get_arch () at tests/libqtest.c:628 +#5 0x00000000100048f0 in main (argc=5, argv=0x3ffff2145538) at tests/prom-env-test.c:82 +(gdb) i r +r0 0xfa 250 +r1 0x3ffff2144d30 70368510627120 +r2 0x3fff9d7b9900 70367091333376 +r3 0x0 0 +r4 0x12a7 4775 +r5 0x6 6 +r6 0x8 8 +r7 0x1 1 +r8 0x0 0 +r9 0x0 0 +r10 0x0 0 +r11 0x0 0 +r12 0x0 0 +r13 0x3fff9dfa1950 70367099623760 +r14 0x0 0 +r15 0x0 0 +r16 0x0 0 +r17 0x0 0 +r18 0x0 0 +r19 0x0 0 +r20 0x0 0 +r21 0x0 0 +r22 0x0 0 +r23 0x0 0 +r24 0x0 0 +r25 0x0 0 +r26 0x0 0 +r27 0x100287f8 268601336 +r28 0x16841b40 377756480 +r29 0x4c 76 +r30 0x3ffff2144de8 70368510627304 +r31 0x6 6 +pc 0x3fff9d60eff0 0x3fff9d60eff0 <raise+96> +msr 0x900000000280f033 10376293541503627315 +cr 0x42000842 1107298370 +lr 0x3fff9d61136c 0x3fff9d61136c <abort+396> +ctr 0x0 0 +xer 0x0 0 +orig_r3 0x12a7 4775 +trap 0xc00 3072 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1714538 b/results/classifier/mode-deepseek-r1:32b/output/system/1714538 new file mode 100644 index 00000000..4feab359 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1714538 @@ -0,0 +1,5 @@ + + +Support for Raspberry Pi 3 Model B + +The raspberry pi 3 B uses a 64-bit instruction set. It would be useful if qemu could emulate the boardn \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1715715 b/results/classifier/mode-deepseek-r1:32b/output/system/1715715 new file mode 100644 index 00000000..a2e64572 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1715715 @@ -0,0 +1,45 @@ + + +[qemu-ppc] Segfault when booting from HD after MacOS9 install + +I created an empty 128G qcow2 image and booted from a Mac OS 9.2.1 Install CD, in which I was able to install the OS successfully to the hard drive. Upon reboot, this time from the hard drive directly, qemu-system-ppc segfaults. + +qemu --version reports "v2.10.0-244-gb07d1c2-dirty", but I used git commit b07d1c2f5607489d4d4a6a65ce36a3e896ac065e and built with "./configure --target-list=ppc-softmmu --enable-debug --disable-strip". + +Here is the command-line arguments: + +qemu-system-ppc -boot c -g 1024x768x32 -M mac99 -m 256 -prom-env 'auto-boot?=true' -prom-env 'boot-args=-v' -prom-env 'vga-ndrv?=true' -drive file=../os9.img,format=raw,media=cdrom -drive file=MacOS9.qcow2,format=qcow2,media=disk -spice port=5901,password=XXX -net nic,model=rtl8139 -net user -monitor stdio + +And the GDB backtrace: + +Program terminated with signal SIGSEGV, Segmentation fault. +#0 0x0000559065fe7d3a in timer_mod (ts=0x0, expire_time=888960717010) at util/qemu-timer.c:462 +462 timer_mod_ns(ts, expire_time * ts->scale); +[Current thread is 1 (Thread 0x7f60e43cb700 (LWP 9853))] +(gdb) bt +#0 0x0000559065fe7d3a in timer_mod (ts=0x0, expire_time=888960717010) at util/qemu-timer.c:462 +#1 0x0000559065d63769 in openpic_tmr_set_tmr (tmr=0x5590676fa7e0, val=96, enabled=true) at hw/intc/openpic.c:861 +#2 0x0000559065d63995 in openpic_tmr_write (opaque=0x5590676f71f0, addr=16, val=96, len=4) at hw/intc/openpic.c:912 +#3 0x0000559065b02811 in memory_region_write_accessor (mr=0x5590676f7710, addr=32, value=0x7f60e43c7da8, size=4, shift=0, mask=4294967295, attrs=...) at /home/bp/qemu/memory.c:529 +#4 0x0000559065b02a29 in access_with_adjusted_size (addr=32, value=0x7f60e43c7da8, size=1, access_size_min=4, access_size_max=4, access=0x559065b02727 <memory_region_write_accessor>, mr=0x5590676f7710, attrs=...) at /home/bp/qemu/memory.c:595 +#5 0x0000559065b051eb in memory_region_dispatch_write (mr=0x5590676f7710, addr=32, data=96, size=1, attrs=...) at /home/bp/qemu/memory.c:1337 +#6 0x0000559065aa3a36 in address_space_write_continue (as=0x559067614d90, addr=2147750160, attrs=..., buf=0x7f60e43c7ed0 "`_'\310`\177", len=1, addr1=32, l=1, mr=0x5590676f7710) at /home/bp/qemu/exec.c:2942 +#7 0x0000559065aa3b84 in address_space_write (as=0x559067614d90, addr=2147750160, attrs=..., buf=0x7f60e43c7ed0 "`_'\310`\177", len=1) at /home/bp/qemu/exec.c:2987 +#8 0x0000559065aa2ec0 in subpage_write (opaque=0x7f60c8275fc0, addr=272, value=96, len=1, attrs=...) at /home/bp/qemu/exec.c:2565 +#9 0x0000559065b02906 in memory_region_write_with_attrs_accessor (mr=0x7f60c8275fc0, addr=272, value=0x7f60e43c7fc8, size=1, shift=0, mask=255, attrs=...) at /home/bp/qemu/memory.c:555 +#10 0x0000559065b029d3 in access_with_adjusted_size (addr=272, value=0x7f60e43c7fc8, size=1, access_size_min=1, access_size_max=8, access=0x559065b02818 <memory_region_write_with_attrs_accessor>, mr=0x7f60c8275fc0, attrs=...) at /home/bp/qemu/memory.c:590 +#11 0x0000559065b0523a in memory_region_dispatch_write (mr=0x7f60c8275fc0, addr=272, data=96, size=1, attrs=...) at /home/bp/qemu/memory.c:1344 +#12 0x0000559065b175db in io_writex (env=0x7f60e43d42a0, iotlbentry=0x7f60e43e8130, mmu_idx=3, val=96, addr=2147750160, retaddr=140054158295744, size=1) at /home/bp/qemu/accel/tcg/cputlb.c:807 +#13 0x0000559065b18055 in io_writeb (env=0x7f60e43d42a0, mmu_idx=3, index=65, val=96 '`', addr=2147750160, retaddr=140054158295744) at /home/bp/qemu/softmmu_template.h:265 +#14 0x0000559065b181ea in helper_ret_stb_mmu (env=0x7f60e43d42a0, addr=2147750160, val=96 '`', oi=3, retaddr=140054158295744) at /home/bp/qemu/softmmu_template.h:300 +#15 0x00007f60e65ac2c0 in code_gen_buffer () +#16 0x0000559065b1ff26 in cpu_tb_exec (cpu=0x7f60e43cc010, itb=0x7f60e65ac5c0 <code_gen_buffer+935318>) at /home/bp/qemu/accel/tcg/cpu-exec.c:166 +#17 0x0000559065b20bfd in cpu_loop_exec_tb (cpu=0x7f60e43cc010, tb=0x7f60e65ac5c0 <code_gen_buffer+935318>, last_tb=0x7f60e43c8678, tb_exit=0x7f60e43c8674) at /home/bp/qemu/accel/tcg/cpu-exec.c:578 +#18 0x0000559065b20eed in cpu_exec (cpu=0x7f60e43cc010) at /home/bp/qemu/accel/tcg/cpu-exec.c:676 +#19 0x0000559065aebc3d in tcg_cpu_exec (cpu=0x7f60e43cc010) at /home/bp/qemu/cpus.c:1270 +#20 0x0000559065aebe64 in qemu_tcg_rr_cpu_thread_fn (arg=0x7f60e43cc010) at /home/bp/qemu/cpus.c:1365 +#21 0x00007f60f56f06ba in start_thread (arg=0x7f60e43cb700) at pthread_create.c:333 +#22 0x00007f60f542682d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 + + +Any idea what is going on? \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1719 b/results/classifier/mode-deepseek-r1:32b/output/system/1719 new file mode 100644 index 00000000..33ff2e09 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1719 @@ -0,0 +1,9 @@ + + +Allow TCG plugins to read memory +Additional information: +* `include/qemu/plugin.h` +* `include/qemu/qemu-plugin.h` +* `plugin/api.c` + +PANDA implemented this already (not sure if this solution is acceptable for the mainline QEMU): https://github.com/qemu/qemu/commit/72c661a7f141ab41fbce5e95eb3593b69f40e246 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/172 b/results/classifier/mode-deepseek-r1:32b/output/system/172 new file mode 100644 index 00000000..c4450af5 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/172 @@ -0,0 +1,3 @@ + + +qemu seems to lack support for pid namespace. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1721 b/results/classifier/mode-deepseek-r1:32b/output/system/1721 new file mode 100644 index 00000000..02da87bb --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1721 @@ -0,0 +1,64 @@ + + +Problem in combination with RabbitMQ and erlang +Description of problem: +I have a problem with rabbitMQ /erlang / Qemu on my local system. + +I use docker with: + +version: "3.6" +``` +services: + rabbitmq: + image: rabbitmq:3-management +``` + +Docker Desktop 4.20.1 (110738) +Docker version 24.0.2, build cb74dfc + +Apple Macbook Pro with M1 Chip Ventura 13.4. + +I deleted all containers and images related to rabbitMQ. Then when I do a: docker compose up -d + +I always get this error and rabbitMQ stopps: + +``` +rabbitmq-server-rabbitmq-1 | 2023-06-22 08:12:18.984151+00:00 [notice] <0.44.0> Application mnesia exited with reason: stopped +rabbitmq-server-rabbitmq-1 | 2023-06-22 08:12:20.658039+00:00 [info] <0.230.0> Waiting for Mnesia tables for 30000 ms, 9 retries left +rabbitmq-server-rabbitmq-1 | 2023-06-22 08:12:20.659274+00:00 [info] <0.230.0> Successfully synced tables from a peer +rabbitmq-server-rabbitmq-1 | 2023-06-22 08:12:20.662647+00:00 [notice] <0.283.0> Feature flags: attempt to enable `stream_sac_coordinator_unblock_group`... +rabbitmq-server-rabbitmq-1 | 2023-06-22 08:12:20.793670+00:00 [notice] <0.283.0> Feature flags: `stream_sac_coordinator_unblock_group` enabled +rabbitmq-server-rabbitmq-1 | qemu: uncaught target signal 11 (Segmentation fault) - core dumped +rabbitmq-server-rabbitmq-1 | Segmentation fault +``` + +In the past it worked, like 5 months ago. + +Reproduction steps docker compose up -d + +Expected behavior that the container runs and does not exit + +Additional context docker compose logs + +``` +rabbitmq-server-rabbitmq-1 | 2023-06-22 08:12:06.946635+00:00 [notice] <0.44.0> Application syslog exited with reason: stopped +rabbitmq-server-rabbitmq-1 | 2023-06-22 08:12:06.966134+00:00 [notice] <0.230.0> Logging: switching to configured handler(s); following messages may not be visible in this log output +rabbitmq-server-rabbitmq-1 | 2023-06-22 08:12:06.973002+00:00 [notice] <0.230.0> Logging: configured log handlers are now ACTIVE +rabbitmq-server-rabbitmq-1 | 2023-06-22 08:12:07.539052+00:00 [info] <0.230.0> ra: starting system quorum_queues +rabbitmq-server-rabbitmq-1 | 2023-06-22 08:12:07.539748+00:00 [info] <0.230.0> starting Ra system: quorum_queues in directory: /var/lib/rabbitmq/mnesia/rabbit@4fb71bcd203a/quorum/rabbit@4fb71bcd203a +rabbitmq-server-rabbitmq-1 | 2023-06-22 08:12:07.715984+00:00 [info] <0.261.0> ra system 'quorum_queues' running pre init for 0 registered servers +rabbitmq-server-rabbitmq-1 | 2023-06-22 08:12:07.749375+00:00 [info] <0.262.0> ra: meta data store initialised for system quorum_queues. 0 record(s) recovered +rabbitmq-server-rabbitmq-1 | 2023-06-22 08:12:07.786151+00:00 [notice] <0.267.0> WAL: ra_log_wal init, open tbls: ra_log_open_mem_tables, closed tbls: ra_log_closed_mem_tables +rabbitmq-server-rabbitmq-1 | 2023-06-22 08:12:07.857344+00:00 [info] <0.230.0> ra: starting system coordination +rabbitmq-server-rabbitmq-1 | 2023-06-22 08:12:07.857635+00:00 [info] <0.230.0> starting Ra system: coordination in directory: /var/lib/rabbitmq/mnesia/rabbit@4fb71bcd203a/coordination/rabbit@4fb71bcd203a +rabbitmq-server-rabbitmq-1 | 2023-06-22 08:12:07.868808+00:00 [info] <0.274.0> ra system 'coordination' running pre init for 0 registered servers +rabbitmq-server-rabbitmq-1 | 2023-06-22 08:12:07.874965+00:00 [info] <0.275.0> ra: meta data store initialised for system coordination. 0 record(s) recovered +rabbitmq-server-rabbitmq-1 | 2023-06-22 08:12:07.875747+00:00 [notice] <0.280.0> WAL: ra_coordination_log_wal init, open tbls: ra_coordination_log_open_mem_tables, closed tbls: ra_coordination_log_closed_mem_tables +rabbitmq-server-rabbitmq-1 | 2023-06-22 08:12:07.899618+00:00 [info] <0.230.0> +rabbitmq-server-rabbitmq-1 | 2023-06-22 08:12:07.899618+00:00 [info] <0.230.0> Starting RabbitMQ 3.12.0 on Erlang 25.3.2.2 [jit] +rabbitmq-server-rabbitmq-1 | 2023-06-22 08:12:07.899618+00:00 [info] <0.230.0> Copyright (c) 2007-2023 VMware, Inc. or its affiliates. +rabbitmq-server-rabbitmq-1 | 2023-06-22 08:12:07.899618+00:00 [info] <0.230.0> Licensed under the MPL 2.0. Website: https://rabbitmq.com +rabbitmq-server-rabbitmq-1 | +rabbitmq-server-rabbitmq-1 | +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1723984 b/results/classifier/mode-deepseek-r1:32b/output/system/1723984 new file mode 100644 index 00000000..7617911a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1723984 @@ -0,0 +1,19 @@ + + +ID_MMFR0 has an invalid value on aarch64 cpu (A57, A53) + +The ID_MMFR0 register, accessed from aarch64 state as an invalid value: +- ARM ARM v8 documentation (D7.2 General system control registers) described bits AuxReg[23:20] to be + "In ARMv8-A the only permitted value is 0010" +- Cortex A53 and Cortex A57 TRM describe the value to be 0x10201105, so AuxReg[23:20] is 0010 too +- in QEMU target/arm/cpu64.c, the relevant value is + cpu->id_mmfr0 = 0x10101105; + +The 1 should be changed to 2. + +Spotted & Tested on the following qemu revision: + +commit 48ae1f60d8c9a770e6da64407984d84e25253c69 +Merge: 78b62d3 b867eaa +Author: Peter Maydell <email address hidden> +Date: Mon Oct 16 14:28:13 2017 +0100 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1726 b/results/classifier/mode-deepseek-r1:32b/output/system/1726 new file mode 100644 index 00000000..3de94d6d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1726 @@ -0,0 +1,99 @@ + + +qemu-system-ppc64 option -smp 2 broken with commit 20b6643324a79860dcdfe811ffe4a79942bca21e +Description of problem: +I was trying to boot rhel9 image with upstream qemu-system-ppc64 -smp 2 option and observed a segfault (qemu crash). +After doing a git bisect, I found the first bad commit which introduced this issue is below: +``` +[qemu]# git bisect good +20b6643324a79860dcdfe811ffe4a79942bca21e is the first bad commit +commit 20b6643324a79860dcdfe811ffe4a79942bca21e +Author: Richard Henderson <richard.henderson@linaro.org> +Date: Mon Dec 5 17:45:02 2022 -0600 + + tcg/ppc: Reorg goto_tb implementation + + The old ppc64 implementation replaces 2 or 4 insns, which leaves a race + condition in which a thread could be stopped at a PC in the middle of + the sequence, and when restarted does not see the complete address + computation and branches to nowhere. + + The new implemetation replaces only one insn, swapping between + + b <dest> + and + mtctr r31 + + falling through to a general-case indirect branch. + + Reviewed-by: Alex Bennée <alex.bennee@linaro.org> + Signed-off-by: Richard Henderson <richard.henderson@linaro.org> + + tcg/ppc/tcg-target.c.inc | 152 +++++++++++++---------------------------------- + tcg/ppc/tcg-target.h | 3 +- + 2 files changed, 41 insertions(+), 114 deletions(-) +[qemu]# +``` +Steps to reproduce: +1. Run the qemu command line mentioned +2. Wait for the qemu to crash. +Additional information: +git bisect log: +``` +[root@ltcden6-lp2 qemu]# git bisect log +git bisect start +# status: waiting for both good and bad commits +# bad: [b455ce4c2f300c8ba47cba7232dd03261368a4cb] Merge tag 'q800-for-8.1-pull-request' of https://github.com/vivier/qemu-m68k into staging +git bisect bad b455ce4c2f300c8ba47cba7232dd03261368a4cb +# status: waiting for good commit(s), bad commit known +# good: [b247dba067bf2808de6395ff09ff0cb220ed7c95] tests/avocado: add explicit timeout for ppc64le TCG tests +git bisect good b247dba067bf2808de6395ff09ff0cb220ed7c95 +# bad: [3db629f03e8caf39526cd0415dac16a6a6484107] Merge tag 'pull-request-2023-02-27' of https://gitlab.com/thuth/qemu into staging +git bisect bad 3db629f03e8caf39526cd0415dac16a6a6484107 +# good: [777fa06376ce0249c76d0d852e8f7ed103a63864] Merge tag 'pull-loongarch-20221202' of https://gitlab.com/gaosong/qemu into staging +git bisect good 777fa06376ce0249c76d0d852e8f7ed103a63864 +# bad: [c66ffcd5358ba88e93e1ffb15ae42ca52dab12a8] target/riscv/cpu: set cpu->cfg in register_cpu_props() +git bisect bad c66ffcd5358ba88e93e1ffb15ae42ca52dab12a8 +# good: [bc92f261519d5c77c70cf2ebcf0a3b9a414d82d0] hw/intc: sifive_plic: Fix the pending register range check +git bisect good bc92f261519d5c77c70cf2ebcf0a3b9a414d82d0 +# good: [aa96ab7c9df59c615ca82b49c9062819e0a1c287] Merge tag 'pull-request-2023-01-09' of https://gitlab.com/thuth/qemu into staging +git bisect good aa96ab7c9df59c615ca82b49c9062819e0a1c287 +# good: [a8d6abe1292e1db1ad9be5b2b124b9c01bcda094] Merge tag 'mips-20230113' of https://github.com/philmd/qemu into staging +git bisect good a8d6abe1292e1db1ad9be5b2b124b9c01bcda094 +# bad: [ef4f031fab7b070816454949a1b6b6c7aa3cf503] Merge tag 'pull-tcg-20230117' of https://gitlab.com/rth7680/qemu into staging +git bisect bad ef4f031fab7b070816454949a1b6b6c7aa3cf503 +# good: [0fe1c98da9d9abb8e5dc4a67c7e3bcf19aad1e85] tcg: Change tb_target_set_jmp_target arguments +git bisect good 0fe1c98da9d9abb8e5dc4a67c7e3bcf19aad1e85 +# good: [701ed34833f53880ba38bde09b0846d01fc16d66] Merge tag 'pull-request-2023-01-18' of https://gitlab.com/thuth/qemu into staging +git bisect good 701ed34833f53880ba38bde09b0846d01fc16d66 +# bad: [20b6643324a79860dcdfe811ffe4a79942bca21e] tcg/ppc: Reorg goto_tb implementation +git bisect bad 20b6643324a79860dcdfe811ffe4a79942bca21e +# good: [90c0fee3a28b25d23081b3c435762cadde813ec4] tcg: Always define tb_target_set_jmp_target +git bisect good 90c0fee3a28b25d23081b3c435762cadde813ec4 +# good: [d59d83a1c38869b1e1a4f957eb939aaa8a342721] tcg/aarch64: Reorg goto_tb implementation +git bisect good d59d83a1c38869b1e1a4f957eb939aaa8a342721 +# first bad commit: [20b6643324a79860dcdfe811ffe4a79942bca21e] tcg/ppc: Reorg goto_tb implementation +``` + +gdb backtrace output: + +``` +Program terminated with signal SIGSEGV, Segmentation fault. +#0 0x00007fff4becfa8c in ?? () +[Current thread is 1 (Thread 0x7fff9e80e780 (LWP 31456))] +(gdb) bt +#0 0x00007fff4becfa8c in () +#1 0x00007fff5682d044 in code_gen_buffer () +#2 0x000000013e3224ec in cpu_tb_exec (cpu=cpu@entry=0x16144fb70, itb=itb@entry=0x7fff5682cf00 <code_gen_buffer+111332932>, tb_exit=tb_exit@entry=0x7fff9e80d7f0) at ../accel/tcg/cpu-exec.c:438 +#3 0x000000013e322ad4 in cpu_loop_exec_tb (tb_exit=0x7fff9e80d7f0, last_tb=<synthetic pointer>, pc=13835058055286981664, tb=0x7fff5682cf00 <code_gen_buffer+111332932>, cpu=<optimized out>) + at ../accel/tcg/cpu-exec.c:871 +#4 cpu_exec_loop (cpu=cpu@entry=0x16144fb70, sc=sc@entry=0x7fff9e80d940) at ../accel/tcg/cpu-exec.c:981 +#5 0x000000013e3234e8 in cpu_exec_setjmp (cpu=cpu@entry=0x16144fb70, sc=sc@entry=0x7fff9e80d940) at ../accel/tcg/cpu-exec.c:1012 +#6 0x000000013e323e64 in cpu_exec (cpu=0x16144fb70) at ../accel/tcg/cpu-exec.c:1038 +#7 0x000000013e35bba0 in tcg_cpus_exec (cpu=0x16144fb70) at ../accel/tcg/tcg-accel-ops.c:69 +#8 0x000000013e35bd90 in mttcg_cpu_thread_fn (arg=0x16144fb70) at ../accel/tcg/tcg-accel-ops-mttcg.c:95 +#9 0x000000013e57193c in qemu_thread_start (args=<optimized out>) at ../util/qemu-thread-posix.c:505 +#10 0x00007fffa12aa0f0 in start_thread (arg=0x7fff9e80e780) at pthread_create.c:443 +#11 0x00007fffa1352ec8 in clone () at ../sysdeps/unix/sysv/linux/powerpc/powerpc64/clone.S:107 +``` +For any further additional information contact me at : anushree.mathur@linux.vnet.ibm.com diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1728643 b/results/classifier/mode-deepseek-r1:32b/output/system/1728643 new file mode 100644 index 00000000..0486a6cf --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1728643 @@ -0,0 +1,106 @@ + + +qemu-io fails with Assertion `*host_offset != 0' failed + +git is at HEAD a93ece47fd9edbd4558db24300056c9a57d3bcd4 +This is on ppc64le architecture. + +Re-production steps: + +1. Copy the attached files named test.img to a directory +2. And customize the following command to point to the above directory and run the same. +# cp test.img copy.img +# qemu-io <path to>/copy.img -c "write 884736 34816" + +from gdb: +(gdb) bt +#0 0x00003fffad63eff0 in raise () from /lib64/libc.so.6 +#1 0x00003fffad64136c in abort () from /lib64/libc.so.6 +#2 0x00003fffad634c44 in __assert_fail_base () from /lib64/libc.so.6 +#3 0x00003fffad634d34 in __assert_fail () from /lib64/libc.so.6 +#4 0x000000001006426c in qcow2_alloc_cluster_offset (bs=0x391e9ad0, offset=884736, bytes=0x3fffaa89fb4c, host_offset=0x3fffaa89fb58, m=0x3fffaa89fb60) + at block/qcow2-cluster.c:1524 +#5 0x000000001004d3f4 in qcow2_co_pwritev (bs=0x391e9ad0, offset=884736, bytes=34816, qiov=0x3fffce0e2940, flags=0) at block/qcow2.c:1919 +#6 0x00000000100a9648 in bdrv_driver_pwritev (bs=0x391e9ad0, offset=884736, bytes=34816, qiov=0x3fffce0e2940, flags=16) at block/io.c:898 +#7 0x00000000100ab630 in bdrv_aligned_pwritev (child=0x391f51a0, req=0x3fffaa89fdd8, offset=884736, bytes=34816, align=1, qiov=0x3fffce0e2940, flags=16) + at block/io.c:1440 +#8 0x00000000100ac4ac in bdrv_co_pwritev (child=0x391f51a0, offset=884736, bytes=34816, qiov=0x3fffce0e2940, flags=BDRV_REQ_FUA) at block/io.c:1691 +#9 0x000000001008da0c in blk_co_pwritev (blk=0x391d9410, offset=884736, bytes=34816, qiov=0x3fffce0e2940, flags=BDRV_REQ_FUA) at block/block-backend.c:1085 +#10 0x000000001008db68 in blk_write_entry (opaque=0x3fffce0e2958) at block/block-backend.c:1110 +#11 0x00000000101aa444 in coroutine_trampoline (i0=958427472, i1=0) at util/coroutine-ucontext.c:79 +#12 0x00003fffad652b9c in makecontext () from /lib64/libc.so.6 +#13 0x0000000000000000 in ?? () +(gdb) bt full +#0 0x00003fffad63eff0 in raise () from /lib64/libc.so.6 +No symbol table info available. +#1 0x00003fffad64136c in abort () from /lib64/libc.so.6 +No symbol table info available. +#2 0x00003fffad634c44 in __assert_fail_base () from /lib64/libc.so.6 +No symbol table info available. +#3 0x00003fffad634d34 in __assert_fail () from /lib64/libc.so.6 +No symbol table info available. +#4 0x000000001006426c in qcow2_alloc_cluster_offset (bs=0x391e9ad0, offset=884736, bytes=0x3fffaa89fb4c, host_offset=0x3fffaa89fb58, m=0x3fffaa89fb60) + at block/qcow2-cluster.c:1524 + s = 0x391f5d80 + start = 919552 + remaining = 0 + cluster_offset = 399360 + cur_bytes = 34816 + ret = 1 + __PRETTY_FUNCTION__ = "qcow2_alloc_cluster_offset" +#5 0x000000001004d3f4 in qcow2_co_pwritev (bs=0x391e9ad0, offset=884736, bytes=34816, qiov=0x3fffce0e2940, flags=0) at block/qcow2.c:1919 + s = 0x391f5d80 + offset_in_cluster = 360448 + ret = 0 + cur_bytes = 34816 + cluster_offset = 0 + hd_qiov = {iov = 0x391b85a0, niov = 0, nalloc = 1, size = 0} + bytes_done = 0 + cluster_data = 0x0 + l2meta = 0x392074c0 + __PRETTY_FUNCTION__ = "qcow2_co_pwritev" +#6 0x00000000100a9648 in bdrv_driver_pwritev (bs=0x391e9ad0, offset=884736, bytes=34816, qiov=0x3fffce0e2940, flags=16) at block/io.c:898 + drv = 0x102036f0 <bdrv_qcow2> + sector_num = 958319760 + nb_sectors = 2340082071 + ret = 743104256 + __PRETTY_FUNCTION__ = "bdrv_driver_pwritev" +#7 0x00000000100ab630 in bdrv_aligned_pwritev (child=0x391f51a0, req=0x3fffaa89fdd8, offset=884736, bytes=34816, align=1, qiov=0x3fffce0e2940, flags=16) + at block/io.c:1440 + bs = 0x391e9ad0 + drv = 0x102036f0 <bdrv_qcow2> + waited = false + ret = 0 + end_sector = 1796 + bytes_remaining = 34816 + max_transfer = 2147483647 + __PRETTY_FUNCTION__ = "bdrv_aligned_pwritev" +#8 0x00000000100ac4ac in bdrv_co_pwritev (child=0x391f51a0, offset=884736, bytes=34816, qiov=0x3fffce0e2940, flags=BDRV_REQ_FUA) at block/io.c:1691 + bs = 0x391e9ad0 + req = {bs = 0x391e9ad0, offset = 884736, bytes = 34816, type = BDRV_TRACKED_WRITE, serialising = false, overlap_offset = 884736, + overlap_bytes = 34816, list = {le_next = 0x0, le_prev = 0x391ecd48}, co = 0x39207150, wait_queue = {entries = {sqh_first = 0x0, + sqh_last = 0x3fffaa89fe20}}, waiting_for = 0x0} + align = 1 +---Type <return> to continue, or q <return> to quit--- + head_buf = 0x0 + tail_buf = 0x0 + local_qiov = {iov = 0x3fffaa89fdb0, niov = -1433797136, nalloc = 16383, size = 884736} + use_local_qiov = false + ret = 0 + __PRETTY_FUNCTION__ = "bdrv_co_pwritev" +#9 0x000000001008da0c in blk_co_pwritev (blk=0x391d9410, offset=884736, bytes=34816, qiov=0x3fffce0e2940, flags=BDRV_REQ_FUA) at block/block-backend.c:1085 + ret = 0 + bs = 0x391e9ad0 +#10 0x000000001008db68 in blk_write_entry (opaque=0x3fffce0e2958) at block/block-backend.c:1110 + rwco = 0x3fffce0e2958 +#11 0x00000000101aa444 in coroutine_trampoline (i0=958427472, i1=0) at util/coroutine-ucontext.c:79 + arg = {p = 0x39207150, i = {958427472, 0}} + self = 0x39207150 + co = 0x39207150 +#12 0x00003fffad652b9c in makecontext () from /lib64/libc.so.6 +No symbol table info available. +#13 0x0000000000000000 in ?? () +No symbol table info available. + + +Will be attaching image_fuzzer images. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/173 b/results/classifier/mode-deepseek-r1:32b/output/system/173 new file mode 100644 index 00000000..6d6d1ccc --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/173 @@ -0,0 +1,3 @@ + + +unable to read symlinks when mounting 9p filesystem with security_model=mapped diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1730099 b/results/classifier/mode-deepseek-r1:32b/output/system/1730099 new file mode 100644 index 00000000..55d60793 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1730099 @@ -0,0 +1,11 @@ + + +Sometimes, when not touching the SDL window, the guest freezes + +I often just run some development guest machine, and leave its SDL window on a workspace I don’t touch, and only interact with it via TCP. + +And sometimes, the guest just freezes. + +After it gets the focus back, it comes back to life (starts responding via network). + +QEMU release version: 2.8.1.1 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1733 b/results/classifier/mode-deepseek-r1:32b/output/system/1733 new file mode 100644 index 00000000..af47007b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1733 @@ -0,0 +1,5 @@ + + +[riscv-pmp]: PMP_is_locked function has redundant top pmp check +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1735049 b/results/classifier/mode-deepseek-r1:32b/output/system/1735049 new file mode 100644 index 00000000..6bade4c3 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1735049 @@ -0,0 +1,9 @@ + + +Need MTTCG support for x86 guests + +MTTCG support is notably absent for x86_64 guests. The last Wiki update on MTTCG was back in 2015, and I am having some difficulty determining the current status of the underlying requirements to enable this feature on x86 hosts. + +For instance, has support for strong-on-weak memory consistency been added into QEMU GIT at this point? + +Thanks! \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1738 b/results/classifier/mode-deepseek-r1:32b/output/system/1738 new file mode 100644 index 00000000..f8dad3e8 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1738 @@ -0,0 +1,151 @@ + + +qemu-system-x86_64 crash during kernel PCI init with large number of busses +Description of problem: +When booting a Linux kernel under qemu-system-x86_64 (tcg) using a large number of PCI busses (25+), qemu crashes with an invalid memory access during kernel PCI init phase. Failure rate is not 100%; some kernel boots do succeed, but the failure rate increases as the number of pci busses increases. Note that no initrd is needed; crash happens before kernel even gets to the point of trying to mount root. +Steps to reproduce: +Launch qemu using command line above along with 4.19.x kernel image (have not tested 5.x). It may take a few tries but within about 20 boot attempts, qemu will crash at least once. +Additional information: +Final kernel logs before crash: +``` +... +[ 1.413615] ACPI: Added _OSI(Module Device) +[ 1.413947] ACPI: Added _OSI(Processor Device) +[ 1.414262] ACPI: Added _OSI(3.0 _SCP Extensions) +[ 1.414421] ACPI: Added _OSI(Processor Aggregator Device) +[ 1.414922] ACPI: Added _OSI(Linux-Dell-Video) +[ 1.415445] ACPI: Added _OSI(Linux-Lenovo-NV-HDMI-Audio) +[ 1.444489] ACPI: 1 ACPI AML tables successfully acquired and loaded +[ 1.468218] ACPI: Interpreter enabled +[ 1.469897] ACPI: (supports S0 S3 S4 S5) +[ 1.470200] ACPI: Using IOAPIC for interrupt routing +[ 1.471811] PCI: Using host bridge windows from ACPI; if necessary, use "pci=nocrs" and repog +[ 1.474421] ACPI: Enabled 2 GPEs in block 00 to 3F +[ 1.536854] ACPI: PCI Root Bridge [PCI0] (domain 0000 [bus 00-ff]) +[ 1.537996] acpi PNP0A08:00: _OSC: OS supports [ExtendedConfig ASPM ClockPM Segments MSI] +[ 1.540988] acpi PNP0A08:00: _OSC: platform does not support [LTR] +[ 1.542232] acpi PNP0A08:00: _OSC: OS now controls [PME AER PCIeCapability] +[ 1.546310] PCI host bridge to bus 0000:00 +[ 1.546650] pci_bus 0000:00: root bus resource [io 0x0000-0x0cf7 window] +[ 1.547471] pci_bus 0000:00: root bus resource [io 0x0d00-0xffff window] +[ 1.548039] pci_bus 0000:00: root bus resource [mem 0x000a0000-0x000bffff window] +[ 1.548421] pci_bus 0000:00: root bus resource [mem 0x80000000-0xafffffff window] +[ 1.549086] pci_bus 0000:00: root bus resource [mem 0xc0000000-0xfebfffff window] +[ 1.549945] pci_bus 0000:00: root bus resource [mem 0x280000000-0xa7fffffff window] +[ 1.550994] pci_bus 0000:00: root bus resource [bus 00-ff] +<...crash...> +``` + +QEMU backtrace: +``` +$ gdb build/qemu-system-x86_64 core.3475232 +<...> +Reading symbols from build/qemu-system-x86_64... +[New LWP 3475243] +[New LWP 3475244] +[New LWP 3475241] +[New LWP 3475238] +[New LWP 3475245] +[New LWP 3475239] +[New LWP 3475246] +[New LWP 3475240] +[New LWP 3475232] +[New LWP 3475242] +[New LWP 3475236] +[New LWP 3475247] +[Thread debugging using libthread_db enabled] +Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". +Core was generated by `build/qemu-system-x86_64 -m 8192 -smp cpus=10,threads=2 -nographic -machine q35'. +Program terminated with signal SIGSEGV, Segmentation fault. +#0 0x0000556065897e0e in memory_region_dispatch_write (mr=mr@entry=0x0, addr=addr@entry=768, data=data@entry=253, + op=op@entry=MO_32, attrs=...) at ../softmmu/memory.c:1497 +1497 if (mr->alias) { +[Current thread is 1 (Thread 0x7fe2e951d640 (LWP 3475243))] +(gdb) bt full +#0 0x0000556065897e0e in memory_region_dispatch_write + (mr=mr@entry=0x0, addr=addr@entry=768, data=data@entry=253, op=op@entry=MO_32, attrs=...) at ../softmmu/memory.c:1497 + size = <optimized out> +#1 0x00005560659112c2 in io_writex + (env=env@entry=0x556066bbd5d0, full=0x7fe08401ec70, mmu_idx=mmu_idx@entry=2, val=val@entry=253, addr=addr@entry=18446744073699050240, retaddr=retaddr@entry=140611404753775, op=MO_32) at ../accel/tcg/cputlb.c:1430 + _iothread_lock_auto = 0x1 + cpu = 0x556066bbb1e0 + mr_offset = 768 + section = 0x7fe078d7d570 + mr = 0x0 + r = <optimized out> +#2 0x0000556065915f14 in store_helper + (op=MO_32, retaddr=140611404753775, oi=<optimized out>, val=<optimized out>, addr=18446744073699050240, env=0x556066bbd5d0) + at ../accel/tcg/cputlb.c:2454 + full = <optimized out> + need_swap = false + a_bits = <optimized out> + mmu_idx = 2 + tlb_addr = <optimized out> + haddr = <optimized out> + size = 4 + index = <optimized out> + entry = 0x7fe08401bc40 +#3 full_le_stl_mmu (env=0x556066bbd5d0, addr=18446744073699050240, val=253, oi=<optimized out>, retaddr=140611404753775) + at ../accel/tcg/cputlb.c:2542 +#4 0x00007fe2a4d4eb6f in code_gen_buffer () +#5 0x00005560659065bb in cpu_tb_exec + (cpu=cpu@entry=0x556066bbb1e0, itb=itb@entry=0x7fe2a4d4e9c0 <code_gen_buffer+13953427>, tb_exit=tb_exit@entry=0x7fe2e951c758) + at ../accel/tcg/cpu-exec.c:460 + env = 0x556066bbd5d0 + ret = <optimized out> + last_tb = <optimized out> + tb_ptr = 0x7fe2a4d4ea80 <code_gen_buffer+13953619> + __PRETTY_FUNCTION__ = "cpu_tb_exec" +#6 0x0000556065906ab6 in cpu_loop_exec_tb + (tb_exit=0x7fe2e951c758, last_tb=<synthetic pointer>, pc=<optimized out>, tb=0x7fe2a4d4e9c0 <code_gen_buffer+13953427>, cpu=0x556066bbb1e0) at ../accel/tcg/cpu-exec.c:893 + insns_left = <optimized out> + __PRETTY_FUNCTION__ = "cpu_loop_exec_tb" + tb = 0x7fe2a4d4e9c0 <code_gen_buffer+13953427> + flags = <optimized out> + cflags = 4280811520 + cs_base = <optimized out> + pc = <optimized out> + last_tb = <optimized out> + tb_exit = 0 +--Type <RET> for more, q to quit, c to continue without paging-- + ret = <optimized out> +#7 cpu_exec_loop (cpu=cpu@entry=0x556066bbb1e0, sc=sc@entry=0x7fe2e951c7f0) at ../accel/tcg/cpu-exec.c:1013 + tb = 0x7fe2a4d4e9c0 <code_gen_buffer+13953427> + flags = <optimized out> + cflags = 4280811520 + cs_base = <optimized out> + pc = <optimized out> + last_tb = <optimized out> + tb_exit = 0 + ret = <optimized out> +#8 0x0000556065907311 in cpu_exec_setjmp (cpu=cpu@entry=0x556066bbb1e0, sc=sc@entry=0x7fe2e951c7f0) at ../accel/tcg/cpu-exec.c:1043 + __func__ = "cpu_exec_setjmp" +#9 0x00005560659079f0 in cpu_exec (cpu=cpu@entry=0x556066bbb1e0) at ../accel/tcg/cpu-exec.c:1069 + ret = <optimized out> + sc = {diff_clk = 0, last_cpu_icount = 0, realtime_clock = 0} +#10 0x000055606592a854 in tcg_cpus_exec (cpu=cpu@entry=0x556066bbb1e0) at ../accel/tcg/tcg-accel-ops.c:81 + ret = <optimized out> + __PRETTY_FUNCTION__ = "tcg_cpus_exec" +#11 0x000055606592a9a7 in mttcg_cpu_thread_fn (arg=arg@entry=0x556066bbb1e0) at ../accel/tcg/tcg-accel-ops-mttcg.c:95 + r = <optimized out> + + force_rcu = {notifier = {notify = 0x55606592aac0 <mttcg_force_rcu>, node = {le_next = 0x0, le_prev = 0x7fe2e951d4a0}}, cpu = 0x556066bbb1e0} + cpu = 0x556066bbb1e0 + __PRETTY_FUNCTION__ = "mttcg_cpu_thread_fn" + __func__ = "mttcg_cpu_thread_fn" +#12 0x0000556065aa2e91 in qemu_thread_start (args=<optimized out>) at ../util/qemu-thread-posix.c:541 + + __cancel_buf = {__cancel_jmp_buf = {{__cancel_jmp_buf = {140612553791040, -3809744250012005023, 93872529245600, 25, 140612607756368, 140729970282144, -7051494707616903839, -3809738403745854111}, __mask_was_saved = 0}}, __pad = {0x7fe2e951c970, 0x0, 0x0, 0x0}} + __cancel_routine = 0x556065aa2ee0 <qemu_thread_atexit_notify> + __not_first_call = <optimized out> + start_routine = 0x55606592a8a0 <mttcg_cpu_thread_fn> + arg = 0x556066bbb1e0 + r = <optimized out> +#13 0x00007fe2ec894b43 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442 + ret = <optimized out> + pd = <optimized out> + + unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140729970281792, 7053160723592154465, 140612553791040, 25, 140612607756368, 140729970282144, -7051494707570766495, -7051505217351676575}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}} + not_first_call = <optimized out> +#14 0x00007fe2ec926a00 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81 +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1738202 b/results/classifier/mode-deepseek-r1:32b/output/system/1738202 new file mode 100644 index 00000000..24e821f4 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1738202 @@ -0,0 +1,33 @@ + + +qemu 2.11 segfaults on elf file that worked with qemu2.7 + +running on cygwin in Windows 7 + +QEMU 2.10.93 segfaults: +$ /opt/qemu2.11/qemu-system-arm -M integratorcp -cpu cortex-m4 -semihosting -nographic -monitor null -serial null -no-reboot -kernel MFWso_Cycle_f1uP2_CUNIT_0.elf +Segmentation fault + +where QEMU 2.7.0 worked: +$ /opt/qemu2.7/qemu-system-arm -M integratorcp -cpu cortex-m4 -semihosting -nographic -monitor null -serial null -no-reboot -kernel MFWso_Cycle_f1uP2_CUNIT_0.elf +------------ CUnit_MFWso_Cycle_f1 ------------ + + + CUnit - A Unit testing framework for C - Version 2.1-0 + http://cunit.sourceforge.net/ + + +Suite: Suite_MFWso_Cycle_f1 + Test: MFWso_Cycle_f1() ... passed + Test: MFWso_GetPhysicalStateData() ... passed + Test: MFWso_GetOutputData() ... passed + Test: MFWso_GetSafeChannelOK() ... passed + +--Run Summary: Type Total Ran Passed Failed + suites 1 1 n/a 0 + tests 4 4 4 0 + asserts 54 54 54 0 + +---------------------------------------- + +Omitting the -cpu parameter results (for both versions) to hang of qemu (no output, no end, full cpu load). \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1738434 b/results/classifier/mode-deepseek-r1:32b/output/system/1738434 new file mode 100644 index 00000000..3d486553 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1738434 @@ -0,0 +1,30 @@ + + +CALL FWORD PTR [ESP] handled incorrectly + +To keep the story short, this 32-bit code crashes on 64-bit Windows whereas it works fine on real system and VMware: + + push 33h + push offset _far_call + call fword ptr[esp] + jmp _ret +_far_call: + retf +_ret: + +32-bit code running under WoW64 on 64-bit Windows has the ability to switch to the 64-bit mode via so called "Heaven's gate". In order to do that you have to make a far call/jmp by 0x33 selector how the code snippet above shows. QEMU throws an access violation exception whereas the code snippet runs with no problems on real CPU and VMware. By the way, this code works fine under QEMU, I hope it gives you a hint where to look: + + push 23h + push offset _far_call + call fword ptr[esp] + jmp _ret +_far_call: + retf +_ret: + +0x23 is a default 32-bit selector for 32-bit processes running under WoW64. + +Environment: +QEMU: 2.10.93, command line: qemu-system-x86_64.exe -m 2G -snapshot -cdrom full_path_to_iso fullP_path_to_img +Guest OS: Windows 7 x64 SP1 build 7601 or Windows 10 version 1709 build 16299.19 +Host OS: Windows 10 x64 version 1703 build 15063.786 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1740 b/results/classifier/mode-deepseek-r1:32b/output/system/1740 new file mode 100644 index 00000000..71d87a4e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1740 @@ -0,0 +1,75 @@ + + +QEMU Abort in Cortex-M Exception raising +Description of problem: +When an exception should be raised in a ARM Cortex-M board QEMU aborts. + +``` +$ qemu-system-arm --version +QEMU emulator version 8.0.2 + +$ qemu-system-arm -M stm32vldiscovery -device loader,file=/tmp/raw-hardfault.hex -d in_asm,exec,int +[...] +Trace 0: 0x7f2aa8000680 [00800400/00000110/00000110/ff200000] +---------------- +IN: +0x00000140: f64b 6eef movw lr, #0xbeef +0x00000144: f6cd 6ead movt lr, #0xdead +0x00000148: 4770 bx lr + +Linking TBs 0x7f2aa8000680 index 0 -> 0x7f2aa80007c0 +Trace 0: 0x7f2aa80007c0 [00800400/00000140/00000110/ff200000] +qemu-system-arm: ../qemu-8.0.2/target/arm/cpu.h:2396: arm_is_secure_below_el3: Assertion `!arm_feature(env, ARM_FEATURE_M)' failed. +``` + +Expected behavior: +``` +$ qemu-system-arm --version +QEMU emulator version 7.1.0 + +$ qemu-system-arm -M stm32vldiscovery -device loader,file=raw-hardfault.hex -d in_asm,exec,int +[...] +Trace 0: 0x7fb488000680 [00800400/00000110/00000110/ff000000] +---------------- +IN: +0x00000140: f64b 6eef movw lr, #0xbeef +0x00000144: f6cd 6ead movt lr, #0xdead +0x00000148: 4770 bx lr + +Linking TBs 0x7fb488000680 [00000110] index 0 -> 0x7fb488000780 [00000140] +Trace 0: 0x7fb488000780 [00800400/00000140/00000110/ff000000] +Taking exception 3 [Prefetch Abort] on CPU 0 +...at fault address 0xdeadbeee +...with CFSR.IACCVIOL +...BusFault with BFSR.STKERR +...taking pending nonsecure exception 3 +...loading from element 3 of non-secure vector table at 0xc +...loaded new PC 0x0 +``` +Steps to reproduce: +1. Run any Cortex-M firmware that raises an exception. (minimal example attached) +Additional information: +- Minimal Reproducer: +[raw-hardfault.hex](/uploads/113889116675b608e05748280d1db354/raw-hardfault.hex) +- Assert introduced in fcc7404eff24b4c8b322fb27ca5ae7f3113129c3. +- Stacktrace: +``` +#4 0x00007ffff6a483d6 in __assert_fail () from /usr/lib/libc.so.6 +#5 0x00007ffff73afe67 in arm_is_secure_below_el3 (env=0x55555712f9b0) at target/arm/cpu.h:2396 +#6 0x00007ffff73afedd in arm_is_el2_enabled (env=0x55555712f9b0) at target/arm/cpu.h:2448 +#7 0x00007ffff73afcd4 in arm_el_is_aa64 (env=0x55555712f9b0, el=0x1) at target/arm/cpu.h:2509 +#8 0x00007ffff73af68f in compute_fsr_fsc (env=0x55555712f9b0, fi=0x7fffffff7098, target_el=0x1, mmu_idx=0x1, ret_fsc=0x7fffffff6fe0) + at target/arm/tcg/tlb_helper.c:71 +#9 0x00007ffff73af483 in arm_deliver_fault (cpu=0x55555712d250, addr=0xdeadbeee, access_type=MMU_INST_FETCH, mmu_idx=0x1, fi=0x7fffffff7098) + at target/arm/tcg/tlb_helper.c:114 +#10 0x00007ffff73afa4c in arm_cpu_tlb_fill (cs=0x55555712d250, address=0xdeadbeee, size=0x1, access_type=MMU_INST_FETCH, mmu_idx=0x1, probe=0x0, retaddr=0x0) + at target/arm/tcg/tlb_helper.c:242 +#11 0x00007ffff74a3a1e in probe_access_internal (env=0x55555712f9b0, addr=0xdeadbeee, fault_size=0x1, access_type=MMU_INST_FETCH, mmu_idx=0x1, nonfault=0x0, phost=0x7fffffff71c8, + pfull=0x7fffffff71d0, retaddr=0x0) at accel/tcg/cputlb.c:1555 +#12 0x00007ffff74a4085 in get_page_addr_code_hostp (env=0x55555712f9b0, addr=0xdeadbeee, hostp=0x0) at accel/tcg/cputlb.c:1694 +#13 0x00007ffff7490c0f in get_page_addr_code (env=0x55555712f9b0, addr=0xdeadbeee) at include/exec/exec-all.h:748 +#14 0x00007ffff7490b2a in tb_htable_lookup (cpu=0x55555712d250, pc=0xdeadbeee, cs_base=0x800408, flags=0x110, cflags=0xff200200) at accel/tcg/cpu-exec.c:233 +#15 0x00007ffff748f719 in tb_lookup (cpu=0x55555712d250, pc=0xdeadbeee, cs_base=0x800408, flags=0x110, cflags=0xff200200) at accel/tcg/cpu-exec.c:270 +#16 0x00007ffff748f463 in helper_lookup_tb_ptr (env=0x55555712f9b0) at accel/tcg/cpu-exec.c:425 +#17 0x00007fff6800091c in code_gen_buffer () +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1742 b/results/classifier/mode-deepseek-r1:32b/output/system/1742 new file mode 100644 index 00000000..ac3f06e0 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1742 @@ -0,0 +1,97 @@ + + +Arm64 kernel run with qemu-system-aarch64 crashes handling program using SVE and Streaming SVE modes +Description of problem: +The userspace program shown, which switches between SVE/SME states, crashes the kernel on task switch when running under qemu-system-aarch64. This does not reproduce on an Arm Fast Model, but I can't be sure that that is not a timing difference. + +The kernel appears to have no space allocated to save SVE state for this process, but also believes that it should save the state, where it then faults. +Steps to reproduce: +1. Compile the following program: +``` +#include <sys/prctl.h> + +int main() { + asm volatile("msr s0_3_c4_c7_3, xzr" /*smstart*/); + prctl(PR_SVE_SET_VL, 8 * 4); + asm volatile("msr s0_3_c4_c7_3, xzr" /*smstart*/); + while (1) {} // Wait to be preempted? + return 0; +} +``` +With: +``` +$ aarch64-unknown-linux-gnu-gcc main.c -o main.o -g -O3 -march=armv8.6-a+sve +``` +Compiler version does not matter I don't think, but in case: +``` +$ aarch64-unknown-linux-gnu-gcc --version +aarch64-unknown-linux-gnu-gcc (crosstool-NG 1.25.0.85_61c4cca) 10.4.0 +``` +It is a 10.4.0 built with CrossToolNG. + +2. Boot Linux and run the program in the emulated environment. I've found looping it to be more consistent: +``` +$ while true; do ./main.o; done +``` +Though sometimes it will crash after only one run. +Additional information: +Here is the output from the kernel: +``` +$ /mnt/virt_root/sme_crash/main.o +[ 190.813392] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 +[ 190.818912] Mem abort info: +[ 190.819255] ESR = 0x0000000096000046 +[ 190.819727] EC = 0x25: DABT (current EL), IL = 32 bits +[ 190.820391] SET = 0, FnV = 0 +[ 190.820757] EA = 0, S1PTW = 0 +[ 190.821145] FSC = 0x06: level 2 translation fault +[ 190.821635] Data abort info: +[ 190.821978] ISV = 0, ISS = 0x00000046, ISS2 = 0x00000000 +[ 190.822490] CM = 0, WnR = 1, TnD = 0, TagAccess = 0 +[ 190.822991] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 +[ 190.823645] user pgtable: 4k pages, 48-bit VAs, pgdp=00000000475f1000 +[ 190.824269] [0000000000000000] pgd=0800000047645003, p4d=0800000047645003, pud=0800000047641003, pmd=0000000000000000 +[ 190.826225] Internal error: Oops: 0000000096000046 [#1] PREEMPT SMP +[ 190.826996] Modules linked in: +[ 190.827748] CPU: 0 PID: 198 Comm: main.o Not tainted 6.4.0-01761-g6aeadf7896bf #1 +[ 190.828638] Hardware name: linux,dummy-virt (DT) +[ 190.829304] pstate: 234000c5 (nzCv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--) +[ 190.830115] pc : sve_save_state+0x4/0xf0 +[ 190.831378] lr : fpsimd_save+0x184/0x1f0 +[ 190.831848] sp : ffff80008047bc70 +[ 190.832223] x29: ffff80008047bc70 x28: ffff0000036c49c0 x27: 0000000000000000 +[ 190.833182] x26: ffff0000036c4f58 x25: ffff0000036c49c0 x24: ffff0000036c5868 +[ 190.834045] x23: 0000000000000020 x22: ffff24441ea31000 x21: 0000000000000001 +[ 190.834894] x20: ffff00003fdc50b0 x19: ffffdbbc213940b0 x18: 0000000000000000 +[ 190.835759] x17: ffff24441ea31000 x16: ffff800080000000 x15: 0000000000000000 +[ 190.836593] x14: 000000000000026c x13: 0000000000000001 x12: 0000000000000020 +[ 190.837436] x11: 0000000000000000 x10: 0000000000000001 x9 : 0000000000000800 +[ 190.838323] x8 : ffff00003fdcffc0 x7 : ffff00003fdcff40 x6 : 0000000002da9c8c +[ 190.839149] x5 : 0000000000000001 x4 : 0000000000000000 x3 : 0000000000000000 +[ 190.839976] x2 : 0000000000000001 x1 : ffff0000036c56a0 x0 : 0000000000000440 +[ 190.840936] Call trace: +[ 190.841406] sve_save_state+0x4/0xf0 +[ 190.841993] fpsimd_thread_switch+0x24/0xd4 +[ 190.842572] __switch_to+0x20/0x1d4 +[ 190.843043] __schedule+0x2a0/0xa7c +[ 190.843488] schedule+0x5c/0xc4 +[ 190.843912] do_notify_resume+0x1a4/0x474 +[ 190.844410] el0_interrupt+0xc4/0xd4 +[ 190.844855] __el0_irq_handler_common+0x18/0x24 +[ 190.845350] el0t_64_irq_handler+0x10/0x1c +[ 190.845824] el0t_64_irq+0x190/0x194 +[ 190.846661] Code: 54000040 d51b4408 d65f03c0 d503245f (e5bb5800) +[ 190.847545] ---[ end trace 0000000000000000 ]--- +[ 190.848125] note: main.o[198] exited with irqs disabled +``` + +I have looked the kernel functions in the backtrace and it seems to be loading memory fine, so it's not obviously a code generation problem. The pointer loaded prior to the crash is definitely a nullptr. + +Removing any of the lines (`while (1) {}` aside) from the example seems to avoid the issue but again, could be timing. + +An important point here is that the kernel syscall ABI states that streaming mode will be exited on +a syscall. I have observed that this does happen as expected. This is why the test case does a syscall, then immediately goes back to streaming mode. And it is perhaps where the confusion starts. + +I have confirmed that SME is supported by the emulated CPU and other SME programs do run correctly. + +I initially thought this was to do with having many cores, but it reproduces on a single core also. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1744 b/results/classifier/mode-deepseek-r1:32b/output/system/1744 new file mode 100644 index 00000000..357b70f0 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1744 @@ -0,0 +1,3 @@ + + +Divide-by-zero in virtio_gpu_simple_process_cmd diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1746394 b/results/classifier/mode-deepseek-r1:32b/output/system/1746394 new file mode 100644 index 00000000..362cabbd --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1746394 @@ -0,0 +1,5 @@ + + +No provider of glEGLImageTargetTexture2DOES found with NVIDIA proprietary driver + +https://github.com/anholt/libepoxy/issues/148 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1747393 b/results/classifier/mode-deepseek-r1:32b/output/system/1747393 new file mode 100644 index 00000000..805b8600 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1747393 @@ -0,0 +1,5 @@ + + +nvme is missing support for NVME_ADM_CMD_ASYNC_EV_REQ + +NVME_ADM_CMD_ASYNC_EV_REQ is required by specification but apparently we will be responded by error when this command is used. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1748296 b/results/classifier/mode-deepseek-r1:32b/output/system/1748296 new file mode 100644 index 00000000..2b97e66f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1748296 @@ -0,0 +1,27 @@ + + +TCG throws Invalid Opcode when executing x86 BMI shlx instruction + +I am unable to use BMI in my project when running under TCG. I narrowed the problem down to incorrect instruction decoding for BMI instructions (which have a 2 byte VEX prefix). The gen_sse function in translate.c reaches the goto label do_0f_38_fx, but b does not equal 0x1f7, 0x2f7, or 0x3f7, so the switch takes the default path and raises an invalid opcode exception. + +The code executes correctly and passes the test under KVM. + +I have created a complete repro here: https://github.com/doug65536/qemu-bmibug + +The makefile has the following utility targets: + +debug-kvm: Build and run the VM using KVM and wait for gdbstub attach + +run: Run the test case with TCG, make fails if the test fails. (It will fail) + +run-kvm: Run the test case with KVM, make fails if the test fails. (It will succeed) + +debug: Build and run the VM with TCG and wait for GDB attach + +attach-gdb: Run GDB and attach to KVM gdbstub + +The VM runs with -cpu max. CPUID reports support for BMI, BMI2, and ABM. + +You can quickly verify the issue by executing `make run-kvm` to confirm that KVM passes, then `make run` to confirm that TCG fails. + +I believe the bug affects other BMI, BMI2, and ABM instructions, but I have only completely verified incorrect execution of SHLX. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1750 b/results/classifier/mode-deepseek-r1:32b/output/system/1750 new file mode 100644 index 00000000..83ab9a8c --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1750 @@ -0,0 +1,3 @@ + + +target/ppc/translate.c - ppc_fixup_cpu and VSX - is still necessary? diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1751 b/results/classifier/mode-deepseek-r1:32b/output/system/1751 new file mode 100644 index 00000000..273b9694 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1751 @@ -0,0 +1,3 @@ + + +s390 host: helper_st16_mmu: Assertion `(get_memop(oi) & MO_SIZE) == MO_128' failed diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1751422 b/results/classifier/mode-deepseek-r1:32b/output/system/1751422 new file mode 100644 index 00000000..a679fc82 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1751422 @@ -0,0 +1,6 @@ + + +some instructions translate error in x86 + +There is some instructions translation error on target i386 in many versions, such as 2.11.1, 2.10.2, 2.7.1 and so on. +The error translation instructions include les, lds. I has got a patch, but I have no idea how to apply it. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1753186 b/results/classifier/mode-deepseek-r1:32b/output/system/1753186 new file mode 100644 index 00000000..03f0ad87 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1753186 @@ -0,0 +1,18 @@ + + +qemu-nbd: always first snapshot loaded from VDI images with snapshots + +When mounting a virtual box disk image of a VM with snapshots, always the state of the first snapshot is shown. + +How to reproduce: +1. Create a new VirtualBox VM or use an existing one, while choosing VDI as the disk image format. +2. Create a snapshot of the VM. +3. Modify the file system from within the VM enough that differences to the snapshotted version are apparent. +4. Create another snapshot. +5. Shut down the VM. +6. Mount the partition from the disk image with `qemu-nbd -c /dev/nbd0 /path/to/disk.vdi; mount /dev/nbd0pX /mnt` + +Expected result: The mounted disk image shall represent the latest state of the VM +Actual result: The mounted disk image represents the VM state at the first snapshot + +version information: qemu-nbd-2.11.1(openSUSE Tumbleweed) \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1753437 b/results/classifier/mode-deepseek-r1:32b/output/system/1753437 new file mode 100644 index 00000000..2fa514f8 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1753437 @@ -0,0 +1,16 @@ + + +pc-bios/s390-ccw/libc: size_t should be unsigned + +qemu/pc-bios/s390-ccw/libc.c:82]: (style) Unsigned variable 'num_idx' can't be negative so it is unnecessary to test it. + +Source code is + + + while (num_idx >= 0) { + +but + + size_t num_idx = 1; /* account for NUL */ + +So there is no escape from the while loop. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1754038 b/results/classifier/mode-deepseek-r1:32b/output/system/1754038 new file mode 100644 index 00000000..7d655831 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1754038 @@ -0,0 +1,114 @@ + + +ARM M: Systick first wrap delayed (qemu-timers/icount prb?) + +When running this kind of code with qemu: + +static void SysTickISR(void) +{ + printf("SysTick\n"); +} + +void main() +{ + volatile int i, j; + printf("setup timer\n"); + *(uint32_t*) 0xE000E014 = 0x8FFFFF; //reload value + *(uint32_t*) 0xE000E018 = 0; //force reload + *(uint32_t*) 0xE000E010 = 7; //cpu clk + ISR + enable + + for (j = 0; j < 0x100; j++) { + for (i = 0; i < 0x100000; i++) + ; + printf("cnt %08x -- %8x\n", *(uint32_t*) 0xE000E018, *(uint32_t*)0xE000E010); + } +} + +I get the following output (comments added after '#'): + +setup timer +cnt 007cccca -- 7 +cnt 006998a2 -- 7 +cnt 00566479 -- 7 +cnt 0043304f -- 7 +cnt 002ffc26 -- 7 +cnt 001cc7fd -- 7 +cnt 000993d5 -- 7 +cnt 00000000 -- 7 <--- problem here, systick should wrap and raise isr +cnt 00000000 -- 7 +cnt 00000000 -- 7 +cnt 00000000 -- 7 +cnt 00000000 -- 7 +cnt 00000000 -- 7 +cnt 00000000 -- 7 +cnt 00000000 -- 7 +cnt 00000000 -- 7 +cnt 00000000 -- 7 +cnt 00000000 -- 7 +cnt 00000000 -- 7 +cnt 00000000 -- 7 +cnt 00000000 -- 7 +SysTick <--- delayed isr occuring here +cnt 000986e0 -- 10007 +SysTick +cnt 00865290 -- 10007 <---- then running fine as long as regs not modified +cnt 00731e51 -- 7 +cnt 005fea27 -- 7 +cnt 004cb5ff -- 7 +cnt 003981d6 -- 7 +cnt 00264dad -- 7 +cnt 00131984 -- 7 +SysTick +cnt 008fe545 -- 10007 +cnt 007cb106 -- 7 +cnt 00697cdd -- 7 +cnt 005648b4 -- 7 +cnt 0043148b -- 7 +cnt 002fe061 -- 7 +cnt 001cac38 -- 7 +cnt 00097810 -- 7 +SysTick +cnt 008643d6 -- 10007 +cnt 00730f97 -- 7 +cnt 005fdb6d -- 7 +cnt 004ca745 -- 7 +cnt 0039731c -- 7 +cnt 00263ef3 -- 7 +cnt 00130aca -- 7 +SysTick +cnt 008fd68b -- 10007 +cnt 007ca24c -- 7 +cnt 00696e23 -- 7 +cnt 005639fa -- 7 +cnt 004305d1 -- 7 +cnt 002fd1a8 -- 7 +cnt 001c9d7f -- 7 +cnt 00096956 -- 7 +SysTick +cnt 0086351d -- 10007 +cnt 007300dd -- 7 +cnt 005fccb4 -- 7 +cnt 004c988c -- 7 +cnt 00396463 -- 7 +cnt 00263039 -- 7 +cnt 0012fc10 -- 7 +[...] + +Command line and version: +qemu-system-arm -M lm3s6965evb -nographic -kernel hello.bin -monitor stdio -serial file:/dev/pts/6 -icount 4 -cpu cortex-m4 +QEMU 2.11.50 + +I am compiling from git repo, head is: +commit f32408f3b472a088467474ab152be3b6285b2d7b +Author: Daniel P. Berrangé <email address hidden> +Date: Tue Mar 6 13:43:17 2018 +0000 + +Config options: +./configure --target-list=arm-softmmu --enable-debug --disable-slirp --enable-tcg-interpreter --disable-blobs --disable-docs --disable-guest-agent --disable-gnutls --disable-nettle --disable-gcrypt --disable-sdl --disable-gtk --disable-vnc --disable-virtfs --disable-mpath --disable-xen --disable-brlapi --disable-curl --disable-bluez --disable-kvm --disable-hax --disable-hvf --disable-whpx --disable-rdma --disable-vde --disable-netmap --disable-linux-aio --disable-cap-ng --disable-attr --disable-vhost-net --disable-spice --disable-rbd --disable-libiscsi --disable-libnfs --disable-smartcard --disable-libusb --disable-live-block-migration --disable-usb-redir --disable-lzo --disable-snappy --disable-bzip2 --disable-seccomp --disable-glusterfs --disable-tpm --disable-libssh2 --disable-numa --disable-libxml2 --disable-tcmalloc --disable-jemalloc --disable-replication --disable-vhost-vsock --disable-opengl --disable-virglrenderer --disable-xfsctl --disable-qom-cast-debug --disable-vxhs --disable-crypto-afalg --disable-vhost-user --disable-capstone --disable-pie --extra-cflags=-mtune=native + + +Not working with git tag 2.10.0 (almost same config) + +Working with stock qemu-arm 2.5.0 from Ubuntu 16.04. + +I started investigating, though I am not familiar with qemu code and I could see that the execution is not geting out of qemu_tcg_rr_cpu_thread_fn() 'while' loop and timers are not triggered because the values in cpu->icount_extra or cpu->icount_budget are not to modified accordingly after the timer is set (host side) when the systick register is written (target side). \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1755479 b/results/classifier/mode-deepseek-r1:32b/output/system/1755479 new file mode 100644 index 00000000..3c96d611 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1755479 @@ -0,0 +1,27 @@ + + +Cortex M:qemu abort with optimized code and icount + +A basic program runs fine if compiled with flag -O0 with gcc, but triggers a qemu abort when compiled with -O1 and run with icount: +"qemu: fatal: IO on conditional branch instruction" + +I also noticed the problem on C source like this with -O0: +"int foo = *bar; bar++;" : OK +"int foo = *bar++;" : FAIL (!!!) + +Optimized binary attached to this ticket. + +command line: +qemu-system-arm -M lm3s6965evb -nographic -kernel hello.bin -serial file:$(tty) -icount 4 -cpu cortex-m4 +(working fine without icount) + +version: +QEMU emulator version 2.11.50 (v2.11.0-2146-gd9bbfea-dirty) + +Compilation options: +./configure --target-list=arm-softmmu --disable-slirp --disable-blobs --disable-docs --disable-guest-agent --disable-gnutls --disable-nettle --disable-gcrypt --disable-sdl --disable-gtk --disable-vnc --disable-virtfs --disable-mpath --disable-xen --disable-brlapi --disable-curl --disable-bluez --disable-kvm --disable-hax --disable-hvf --disable-whpx --disable-rdma --disable-vde --disable-netmap --disable-linux-aio --disable-cap-ng --disable-attr --disable-vhost-net --disable-spice --disable-rbd --disable-libiscsi --disable-libnfs --disable-smartcard --disable-libusb --disable-live-block-migration --disable-usb-redir --disable-lzo --disable-snappy --disable-bzip2 --disable-seccomp --disable-glusterfs --disable-tpm --disable-libssh2 --disable-numa --disable-libxml2 --disable-tcmalloc --disable-jemalloc --disable-replication --disable-vhost-vsock --disable-opengl --disable-virglrenderer --disable-xfsctl --disable-qom-cast-debug --disable-vxhs --disable-crypto-afalg --disable-vhost-user --disable-capstone --disable-pie --extra-cflags=-mtune=native + +I have also tested previous versions: +- stock qemu-system-arm 2.5.0 from ubuntu 16.04: OK +- git version: QEMU emulator version 2.10.0 (v2.10.2-dirty): OK +- git version: QEMU emulator version 2.10.90 (v2.11.0-rc0-dirty): FAIL \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1756538 b/results/classifier/mode-deepseek-r1:32b/output/system/1756538 new file mode 100644 index 00000000..f0cc5742 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1756538 @@ -0,0 +1,15 @@ + + +Minimal Ubuntu vs. Debian differences + +I'm using Qemu on Ubuntu (minimal) and Debian (minimal) on Android (Arch64) via Linux Deploy to run Windows guests. Here's a few issues I encountered: + +1) Qemu on (minimal) Debian 9 and Ubuntu cannot run Windows 7-10 guests (only Windows XP and below) because there's a black screen after the boot menu. Qemu on Debian 10, however, can run Windows 7. Incidentally, these distros run on the host in bios compatibility mode instead of UEFI. Ubuntu Desktop (full distro) on other hosts does not display the black screen when running Qemu. + +2) Qemu on Debian 9-10 (minimal) does not display fullscreen - but Ubuntu minimal does display full-screen. + +3) Qemu on Limbo PC Emulator and on Debian 9-10 only run windows guests at 1 GHz using the default Qemu CPU, but Ubuntu runs windows guests at 2 GHz using the default Qemu CPU. + +4) Enable KVM doesn't work, and virtualization isn't detected through Limbo PC Emulator and minimal Linux distros running on Android - perhaps is a problem with running Linux distros via Linux Deploy using Chroot on Android (not so much a Qemu-KVM issue) and failing to detect ARMv8-A CPUs that are indeed capable of virtualization. + +Can anyone explain these differences? I believe they are all using the latest versions of Qemu. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1756927 b/results/classifier/mode-deepseek-r1:32b/output/system/1756927 new file mode 100644 index 00000000..69c48b03 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1756927 @@ -0,0 +1,20 @@ + + +ARMv7 LPAE: IFSR doesn't have the LPAE bit in case of BKPT + +When a user application triggers a 'bkpt' instruction while LPAE is used, the bit [9] of IFSR is not correctly set during the prefetch abort exception. + +You'll find attached a minimal example to reproduce the issue (just run 'make all'). +The output I get is: + +supervisor +user +prefetch +short-descriptor + +The last entry should read 'long-descriptor'. + + +Qemu revision: 48ae1f60d8c9a770e6da64407984d84e25253c69 +Ubuntu verison: 16.04 LTS +Cross Compiler: gcc linaro 6.3.1-2017.02-x86_64_arm-eabi \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1757363 b/results/classifier/mode-deepseek-r1:32b/output/system/1757363 new file mode 100644 index 00000000..cb0706f1 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1757363 @@ -0,0 +1,35 @@ + + +infinite loop due to improper deal with "eret" on mips32 + +1.qemu 2.9.1 release on the official web build with tcg +2.cmd: qemu-system-mips -kernel kernelfile +3. host: ubuntu 16.04.1 with linux kernel 4.6.2 x86_64 + guest: mips bigendian 32bit (tplink firmware) + + +detail: + +static inline void exception_return(CPUMIPSState *env) +{ + debug_pre_eret(env); + if (env->CP0_Status & (1 << CP0St_ERL)) { + set_pc(env, env->CP0_ErrorEPC); + env->CP0_Status &= ~(1 << CP0St_ERL); + } else { + set_pc(env, env->CP0_EPC); + env->CP0_Status &= ~(1 << CP0St_EXL);====================> ISSUE???? + } + compute_hflags(env); + debug_post_eret(env); +} + +void helper_eret(CPUMIPSState *env) +{ + exception_return(env); + env->lladdr = 1; +} + + +In the Issue Line, there is no check CP0_Status whether int is disabled (should not enter int routine), +that result in the cpu can not jump out the int routine. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1758819 b/results/classifier/mode-deepseek-r1:32b/output/system/1758819 new file mode 100644 index 00000000..7f10eb74 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1758819 @@ -0,0 +1,7 @@ + + +HVF Illegal instruction: 4, High Sierra, v2.12-rc0 + +I've built v2.12.0-rc0 on MacOS using homebrew. I'm running 10.13.3 on a 5,1 Mac Pro with a X5690 processor. + +When I run 'qemu-system-x86_64 -M accel=hvf', I get a crash "Illegal instruction: 4". \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1759333 b/results/classifier/mode-deepseek-r1:32b/output/system/1759333 new file mode 100644 index 00000000..8b305e3b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1759333 @@ -0,0 +1,9 @@ + + +Illegal Instruction with HVF when encountering SSE instructions in the emulator + +The latest version of QEMU doesn't seem to support emulated SSE instructions with HVF acceleration on macOS. +The decoder will treat SSE instructions as invalid, get the instruction sizes wrong and quickly crash the guest OS because of illegal instructions. +After having a quick look at target/i386/hvf/x86_decode.c, it seems that SSE instruction emulation isn't implemented in the current version of the x86 emulator. + +A way to reproduce the issue is to run a macOS 10.13 guest with HVF acceleration enabled, this will crash once it's loading up the GUI. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1759522 b/results/classifier/mode-deepseek-r1:32b/output/system/1759522 new file mode 100644 index 00000000..f03fa370 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1759522 @@ -0,0 +1,58 @@ + + +windows qemu-img create vpc/vhdx error + +On windows, using qemu-img (version 2.11.90) to create vpc/vhdx virtual disk tends to fail. Here's the way to reproduce: + +1. Install qemu-w64-setup-20180321.exe + +2. Use `qemu-img create -f vhdx -o subformat=fixed disk.vhdx 512M` to create a vhdx: + Formatting 'disk.vhdx', fmt=vhdx size=536870912 log_size=1048576 block_size=0 subformat=fixed + +3. Execute `qemu-img info disk.vhdx` gives the result, (note the `disk size` is incorrect): + image: disk.vhdx + file format: vhdx + virtual size: 512M (536870912 bytes) + disk size: 1.4M + cluster_size: 8388608 + +4. On Windows 10 (V1709), double click disk.vhdx gives an error: + Make sure the file is in an NTFS volume and isn't in a compressed folder or volume. + + Using Disk Management -> Action -> Attach VHD gives an error: + The requested operation could not be completed due to a virtual disk system limitation. Virtual hard disk files must be uncompressed and uneccrypted and must not be sparse. + +Comparison with Windows 10 created VHDX: + +1. Using Disk Management -> Action -> Create VHD: + File name: win.vhdx + Virtual hard disk size: 512MB + Virtual hard disk format: VHDX + Virtual hard disk type: Fixed size + +2. Detach VHDX + +3. Execute `qemu-img info win.vhdx` gives the result: + image: win.vhdx + file format: vhdx + virtual size: 512M (536870912 bytes) + disk size: 516M + cluster_size: 33554432 + +Comparison with qemu-img under Ubuntu: + +1. Version: qemu-img version 2.5.0 (Debian 1:2.5+dfsg-5ubuntu10.16), Copyright (c) 2004-2008 Fabrice Bellard + +2. qemu-img create -f vhdx -o subformat=fixed lin.vhdx 512M + Formatting 'lin.vhdx', fmt=vhdx size=536870912 log_size=1048576 block_size=0 subformat=fixed + +3. qemu-img info lin.vhdx + image: lin.vhdx + file format: vhdx + virtual size: 512M (536870912 bytes) + disk size: 520M + cluster_size: 8388608 + +4. Load lin.vhdx under Windows 10 is ok + +The same thing happens on `vpc` format with or without `oformat=fixed`, it seems that windows version of qemu-img has some incorrect operation? My guess is that windows version of qemu-img doesn't handle the description field of vpc/vhdx, which leads to an incorrect `disk size` field. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1764 b/results/classifier/mode-deepseek-r1:32b/output/system/1764 new file mode 100644 index 00000000..333c4851 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1764 @@ -0,0 +1,3 @@ + + +lsusb fails with qemu-system-x86_64 command (qemu-system-x86 package) diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1766 b/results/classifier/mode-deepseek-r1:32b/output/system/1766 new file mode 100644 index 00000000..d5c43354 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1766 @@ -0,0 +1,5 @@ + + +-strace should print target program counter when SIGSEGV +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1767 b/results/classifier/mode-deepseek-r1:32b/output/system/1767 new file mode 100644 index 00000000..4d55c975 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1767 @@ -0,0 +1,5 @@ + + +Add iphone emulated device +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1771948 b/results/classifier/mode-deepseek-r1:32b/output/system/1771948 new file mode 100644 index 00000000..01ad5739 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1771948 @@ -0,0 +1,21 @@ + + +aarch64 msr CNTFRQ_EL0 + +Hello, + +I'm running qemu 2.12 on a raspberry pi 3 with the command: + +qemu-system-aarch64 -M raspi3 -serial stdio -kernel executable.bin + +On my start file (right in the beginning with the highest EL), the following instructions: + +ldr x0 , =19200000 +msr CNTFRQ_EL0, x0 + + +and qemu halts on the "msr CNTFRQ_EL0, x0" instruction. + +I believe this is not a normal behavior. + +Thank you \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1774 b/results/classifier/mode-deepseek-r1:32b/output/system/1774 new file mode 100644 index 00000000..00c74dc8 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1774 @@ -0,0 +1,25 @@ + + +8.1-rc0 failure to build with capstone 5.0 +Description of problem: +Use >=capstone-5.0 dependency, try to build qemu, get this error: +``` +/opt/homebrew/Cellar/capstone/5.0/include/capstone/tricore.h:561:3: error: +redefinition of 'tricore_feature' as different kind of symbol +} tricore_feature; + ^ +../target/tricore/cpu.h:261:19: note: previous definition is here +static inline int tricore_feature(CPUTriCoreState *env, int feature) + ^ +1 error generated. +``` + +The fix is trivial and it was already mentioned in the mailing list but wasn't fixed for rc0, so I figured it might have been forgotten about. + +https://lore.kernel.org/qemu-devel/CA+PgxXVxVKpT0SZ3N+Fc1YvXCiwkkbqm0FmLKqLTbgcDpYCNgg@mail.gmail.com/ + +If you meet any other problem with capstone (e.g. some regression), please don't hesitate to report it mainstream. + +There are plans to make a new patch release soon with fixes for some most annoying bugs since the 5.0 release: https://github.com/capstone-engine/capstone/issues/2081 + +https://github.com/capstone-engine/capstone/releases diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1774412 b/results/classifier/mode-deepseek-r1:32b/output/system/1774412 new file mode 100644 index 00000000..34773fb6 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1774412 @@ -0,0 +1,12 @@ + + +-icount sleep=on|off documentation is confusing + +The documentation for the -icount option in the qemu man page says: + +"When the virtual cpu is sleeping, the virtual time will advance at default speed unless sleep=on|off is specified. With sleep=on|off, the virtual time will jump to the next timer deadline instantly whenever the virtual cpu goes to sleep mode and will not advance if no timer is enabled." + +Taking this literally and specifying "sleep=on|off" on the command line does not work, so presumably the two instances of "sleep=on|off" should be either "sleep=on" or "sleep=off", +whichever is correct :) + +Also, the synopsis line "-icount [shift=N|auto][,rr=record|replay,rrfile=filename,rrsnapshot=snapshot" fails to mention the sleep keyword at all. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1774677 b/results/classifier/mode-deepseek-r1:32b/output/system/1774677 new file mode 100644 index 00000000..553c7679 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1774677 @@ -0,0 +1,22 @@ + + +-icount increases boot time by >10x + +When I specify the -icount option, some guest operations such as booting a Linux kernel take more than 10 times longer than otherwise. For example, the following will boot Aboriginal Linux to the login prompt about 6 seconds on my system (using TCG, not KVM): + +wget http://landley.net/aboriginal/downloads/old/binaries/1.4.5/system-image-i686.tar.gz +gunzip <system-image-i686.tar.gz | tar xfv - +cd system-image-i686 +sh run-emulator.sh + +If I replace the last line with + +QEMU_EXTRA="-icount shift=auto" sh run-emulator.sh + +booting to the login prompt takes about 1 minute 20 seconds. + +I have tried different values for "shift" other than the "auto" used above, but have not been able to find one that gives reasonable performance. Specifying "sleep=off" also did not help. + +During the slow boots, qemu appears to spend most of its time sleeping, not using the host CPU. + +I see this with multiple versions of qemu, including current git sources (c181ddaa176856b3cd2dfd12bbcf25fa9c884a97), and on multiple host OSes, including Debian 9 on x86_64. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1774830 b/results/classifier/mode-deepseek-r1:32b/output/system/1774830 new file mode 100644 index 00000000..2bcafe80 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1774830 @@ -0,0 +1,100 @@ + + +qemu monitor disassembled memory dump produces incorrect output + +Greetings, + +I've been using qemu-system-aarch64 to do some low-level programming targeting the raspberry pi 3. While I was debugging a problem in my code I noticed a very confusing inconsistency that I think is very likely a bug somewhere in how qemu's monitor produces it's disassembled output. + +Here's my version output (installed via homebrew on macOS 10.13.4) + +$ qemu-system-aarch64 --version +QEMU emulator version 2.12.0 +Copyright (c) 2003-2017 Fabrice Bellard and the QEMU Project developers + +Some system information (macOS 10.13.4): + +$ uname -a +Darwin Lillith.local 17.5.0 Darwin Kernel Version 17.5.0: Fri Apr 13 19:32:32 PDT 2018; root:xnu-4570.51.2~1/RELEASE_X86_64 x86_64 + +Here's an example of the problem I am seeing: + +qemu-system-aarch64 -S -M raspi3 -kernel kernel8.img -monitor stdio +QEMU 2.12.0 monitor - type 'help' for more information +(qemu) x /32x 0x80000 +0000000000080000: 0xd53800a1 0x92400421 0xb4000061 0xd503205f +0000000000080010: 0x17ffffff 0x58000161 0x9100003f 0x58000161 +0000000000080020: 0x180000e2 0x34000082 0xf800843f 0x51000442 +0000000000080030: 0x35ffffa2 0xd2806763 0x17ffffff 0x00000000 +0000000000080040: 0x00080000 0x00000000 0x00080050 0x00000000 +0000000000080050: 0x00000000 0x00000000 0x00000000 0x00000000 +0000000000080060: 0x00000000 0x00000000 0x00000000 0x00000000 +0000000000080070: 0x00000000 0x00000000 0x00000000 0x00000000 +(qemu) x /32i 0x80000 +0x00080000: d53800a1 mrs x1, mpidr_el1 +0x00080004: 92400421 and x1, x1, #3 +0x00080008: b4000061 cbz x1, #0x80014 +0x0008000c: d503205f wfe +0x00080010: 17ffffff b #0x8000c +0x00080014: 58000161 ldr x1, #0x80040 +0x00080018: 9100003f mov sp, x1 +0x0008001c: 58000161 ldr x1, #0x80048 +0x00080020: 92400421 and x1, x1, #3 +0x00080024: b4000061 cbz x1, #0x80030 +0x00080028: d503205f wfe +0x0008002c: 17ffffff b #0x80028 +0x00080030: 58000161 ldr x1, #0x8005c +0x00080034: 9100003f mov sp, x1 +0x00080038: 58000161 ldr x1, #0x80064 +0x0008003c: 180000e2 ldr w2, #0x80058 +0x00080040: 34000082 cbz w2, #0x80050 +0x00080044: f800843f str xzr, [x1], #8 +0x00080048: 51000442 sub w2, w2, #1 +0x0008004c: 35ffffa2 cbnz w2, #0x80040 +0x00080050: d2806763 movz x3, #0x33b +0x00080054: 17ffffff b #0x80050 +0x00080058: 00000000 .byte 0x00, 0x00, 0x00, 0x00 +0x0008005c: 00080000 .byte 0x00, 0x00, 0x08, 0x00 +0x00080060: 00000000 .byte 0x00, 0x00, 0x00, 0x00 +0x00080064: 00080050 .byte 0x50, 0x00, 0x08, 0x00 +0x00080068: 00000000 .byte 0x00, 0x00, 0x00, 0x00 +0x0008006c: 00000000 .byte 0x00, 0x00, 0x00, 0x00 +0x00080070: 00000000 .byte 0x00, 0x00, 0x00, 0x00 +0x00080074: 00000000 .byte 0x00, 0x00, 0x00, 0x00 +0x00080078: 00000000 .byte 0x00, 0x00, 0x00, 0x00 +0x0008007c: 00000000 .byte 0x00, 0x00, 0x00, 0x00 + +Please notice that between 0x80004 thru 0x8001c is repeated for some reason in the /32i formatted output which also causes the addresses for the following bytes to also be incorrect. + +Just in order to keep things as clear as possible, I'll also attach the binary shown above but disassembled by objdump instead of qemu. + +$ aarch64-elf-objdump -d kernel8.elf + +kernel8.elf: file format elf64-littleaarch64 + + +Disassembly of section .text: + +0000000000080000 <_start>: + 80000: d53800a1 mrs x1, mpidr_el1 + 80004: 92400421 and x1, x1, #0x3 + 80008: b4000061 cbz x1, 80014 <_start+0x14> + 8000c: d503205f wfe + 80010: 17ffffff b 8000c <_start+0xc> + 80014: 58000161 ldr x1, 80040 <_start+0x40> + 80018: 9100003f mov sp, x1 + 8001c: 58000161 ldr x1, 80048 <_start+0x48> + 80020: 180000e2 ldr w2, 8003c <_start+0x3c> + 80024: 34000082 cbz w2, 80034 <_start+0x34> + 80028: f800843f str xzr, [x1], #8 + 8002c: 51000442 sub w2, w2, #0x1 + 80030: 35ffffa2 cbnz w2, 80024 <_start+0x24> + 80034: d2806763 mov x3, #0x33b // #827 + 80038: 17ffffff b 80034 <_start+0x34> + 8003c: 00000000 .word 0x00000000 + 80040: 00080000 .word 0x00080000 + 80044: 00000000 .word 0x00000000 + 80048: 00080050 .word 0x00080050 + 8004c: 00000000 .word 0x00000000 + +Hopefully this is helpful information, please let me know if I left out anything really important. Thank you! \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1776 b/results/classifier/mode-deepseek-r1:32b/output/system/1776 new file mode 100644 index 00000000..dba62a5f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1776 @@ -0,0 +1,3 @@ + + +qemu-armel SEGFAULTs when trying to map a commpage on armel diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1778 b/results/classifier/mode-deepseek-r1:32b/output/system/1778 new file mode 100644 index 00000000..d9de5bae --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1778 @@ -0,0 +1,3 @@ + + +Spice audio play at wrong speed and frequency after qemu-7.2.0 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1781463 b/results/classifier/mode-deepseek-r1:32b/output/system/1781463 new file mode 100644 index 00000000..20351d43 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1781463 @@ -0,0 +1,101 @@ + + +qemu don't start *.abs firmware files + +Hello Devs, + +I'm here to report this bug/issue because i'm using Win64 Qemu but i can't start a *.abs firmware at normally this firmware is based in Linux Kernel and this type of firmware is made for STB Receivers, + +So this is all information i provide to get support. + +Files extracted by ( binwalk -e ) + + +Terminal output: + +# binwalk -e AMIKO_HD8150_2.4.43_emu.abs + +DECIMAL HEXADECIMAL DESCRIPTION + +-------------------------------------------------------------------------------- +196736 0x30080 LZMA compressed data, properties: 0x6C, dictionary size: 8388608 bytes, uncompressed size: 11883876 bytes +3866752 0x3B0080 LZMA compressed data, properties: 0x6C, dictionary size: 8388608 bytes, uncompressed size: 3255512 bytes +5636224 0x560080 LZMA compressed data, properties: 0x6C, dictionary size: 8388608 bytes, uncompressed size: 87904 bytes + + +Files extracted with ALI TOOLS or Ali FirmwareDecriptor. + +Windows files output: + +Software used: Ali Main Code Decrypter 8.9 + +Files unpacked: + +bootloader +MemCfg +maincode(AV) +seecode +default_lang +cipluskey +countryband +logo_user +logo_menu +logo_radio +logo_boot +patch +defaultdb(PRC) +userdb(64+64) + + +Terminal OUTPUT: + +# hexdump -C + +part of file + + +00b51a30 00 00 00 00 4c 69 62 63 6f 72 65 20 76 65 72 73 |....Libcore vers| +00b51a40 69 6f 6e 20 31 33 2e 31 36 2e 30 40 53 44 4b 34 |ion 13.16.0@SDK4| +00b51a50 2e 30 66 61 2e 31 33 2e 31 36 5f 32 30 31 36 31 |.0fa.13.16_20161| +00b51a60 30 31 39 28 67 63 63 20 76 65 72 73 69 6f 6e 20 |019(gcc version | +00b51a70 33 2e 34 2e 34 20 6d 69 70 73 73 64 65 2d 36 2e |3.4.4 mipssde-6.| +00b51a80 30 36 2e 30 31 2d 32 30 30 37 30 34 32 30 29 28 |06.01-20070420)(| +00b51a90 41 64 6d 69 6e 69 73 74 72 61 74 6f 72 40 20 46 |Administrator@ F| +00b51aa0 72 69 2c 20 4a 75 6c 20 32 38 2c 20 32 30 31 37 |ri, Jul 28, 2017| +00b51ab0 20 31 32 3a 35 33 3a 32 38 20 41 4d 29 0a 00 00 | 12:53:28 AM)...| +00b51ac0 44 4d 58 5f 53 33 36 30 31 5f 30 00 00 a1 03 18 |DMX_S3601_0.....| + + +When I use readelf it says files isn't an ELF file, so i can't run it like a kernel (Bootloader,Maincode, and etc. ) + +so this is the cmd output when i use qemu Win64 (I don't whant to use linux to do the emulation about this *.abs extension firmware so please help me for win64 version from Qemu) + +CMD OUTPUT: + + C:\Program Files\qemu>qemu-system-mips.exe -machine mips -cpu mips32r6-generic -drive file=C:\30080.bin,index=0,media=disk,format=raw + +qemu-system-mips.exe: warning: could not load MIPS bios 'mips_bios.bin' + +I also tried a lot of diferents qemu-system... and a lot of diferent configs like -machine -cpu -kernel -driver root= -PFLASH and etc... and nothing hapenned + +How can i reproduce this issue ? +Reply:. + +Donwload *.abs firmware in amikoreceiver.com (only *.abs) and download AliDekompressor in http://www.satedu.cba.pl/ + +Direct tools: + +FirmwareDecrypter_v8.9.zip : + +http://www.satedu.cba.pl/index.php?action=downloadfile&filename=FirmwareDecrypter_v8.9.zip&directory=Test%20Folder& + +Ali__tools_Console_v4.0__CRC_FIXER.rar : + +http://www.satedu.cba.pl/index.php?action=downloadfile&filename=Ali__tools_Console_v4.0__CRC_FIXER.rar&directory=Test%20Folder& + + +so if Qemu can explain how can i fix this issue this can be highly helpfull. + +With my best regards, +David Martins +Screamfox \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1783437 b/results/classifier/mode-deepseek-r1:32b/output/system/1783437 new file mode 100644 index 00000000..e66f39a6 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1783437 @@ -0,0 +1,11 @@ + + +read-modify-write page faults error code has write bit unset + +Consider the attached C file, which does a read-modify-write of the form `add [mem], reg`, where `mem` points to a non-present page. In the resulting page fault, the W/R bit is not set, while real hardware does set this bit. + +% gcc -m32 qemu-bug1.c&& ./a.out && qemu-i386 ./a.out +page fault: addr=0x70000000 err=0x6 +page fault: addr=0x70000000 err=0x4 + +Tested on the qemu-3.0.0-rc1 release. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1785 b/results/classifier/mode-deepseek-r1:32b/output/system/1785 new file mode 100644 index 00000000..c4d13ec7 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1785 @@ -0,0 +1,27 @@ + + +8.1.0rc0: Build failure when building static binaries, auto config incorrectly mark bzip2 as supported on my machine +Description of problem: +8.1.0rc0 fails to build when I build static binaries. + +``` +Jul 24 20:28:22 clang-13: warning: argument unused during compilation: '-pie' [-Wunused-command-line-argument] +Jul 24 20:28:22 ld.lld: error: attempted static link of dynamic object /usr/bin/../lib/libbz2.so +Jul 24 20:28:22 clang-13: error: linker command failed with exit code 1 (use -v to see invocation) +``` + +It seems that `./configure` mistaken my dynamic library of bzip2 as able to compile under static compilation. +Steps to reproduce: +1. `./configure --target-list=x86_64-softmmu --static` with bzip2 only dynamicly installed and static library not installed +2. see output + +You can see +``` + snappy support : NO + bzip2 support : YES + lzfse support : NO +``` + +which is wrong. Additionally, the compilation fails because the system only have bzip2 dynamicly but not staticly. +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1785308 b/results/classifier/mode-deepseek-r1:32b/output/system/1785308 new file mode 100644 index 00000000..933e38a2 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1785308 @@ -0,0 +1,7 @@ + + +0x8 exception encountered but not handled + +Present in all QEMU versions. + +OS is triple page faulting and crashing rather than handling the expected double page fault properly. The same OS works in Bochs so I know its not the problem. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1788 b/results/classifier/mode-deepseek-r1:32b/output/system/1788 new file mode 100644 index 00000000..6b390ea7 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1788 @@ -0,0 +1,31 @@ + + +Floating point rounding fails on mps3-an547 amd cortex-m55 while using LLVM-embedded-toolchain-for-Arm and Picolibic. +Description of problem: +Rounding of long double gives unexpected result. Simple code as example: +``` +#include <math.h> +int main(void) +{ + long double value = -8.5L; + long rounded_value = lrintl(value); + if( -8 == rounded_value ) + { + return 0; + } + return 1; +} +``` +Steps to reproduce: +1. Checkout project: [LLVM-embedded-toolchain-for-ARM](https://github.com/ARM-software/LLVM-embedded-toolchain-for-Arm) +2. Configure it with option -DLLVM_TOOLCHAIN_LIBRARY_VARIANTS=armv8.1m.main_hard_nofp_mve +3. Build project +4. Run Picolbic tests with ninja picolibc_armv8.1m.main_hard_nofp_mve-test + +As a result long_double test fails with incorrect rounding. +Last qemu version which successfully execute mentioned test is: qemu 7.0.0 downloaded via [qemu-7.0.0](https://download.qemu.org/qemu-7.0.0.tar.bz2). +Issue is present since qemu version 7.1. +Additional information: +As a result long_double test fails with incorrect rounding. +Last qemu version which successfully execute mentioned test is: qemu 7.0.0 downloaded via [qemu-7.0.0](https://download.qemu.org/qemu-7.0.0.tar.bz2). +Issue is present since qemu version 7.1. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1790 b/results/classifier/mode-deepseek-r1:32b/output/system/1790 new file mode 100644 index 00000000..226dfa20 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1790 @@ -0,0 +1,31 @@ + + +[AARCH64] STGP instruction is not writing the value of the second register to memory +Description of problem: +My application is built with Clang 16 and the option -fsanitize=memtag-stack. +It means the the MTE protection is activated for the stack. +The local variables are tagged and the compiler is often using the STGP instruction "Store Allocation Tag and Pair of registers" in order to transfer the value of two 64-bit registers to memory. +The following instruction was not working as expected: + 18004: 69000895 stgp x21, x2, [x4] +The value of the second register x2 is not transferred to the memory. +Only x21 is written. + +I think that the issue is in trans_STGP(). +We don't call finalize_memop_pair() like we do for in the general trans_STP(). + +``` +diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c +index 7d0c8f79a7..f599f3e136 100644 +--- a/target/arm/tcg/translate-a64.c ++++ b/target/arm/tcg/translate-a64.c +@@ -3034,6 +3034,8 @@ static bool trans_STGP(DisasContext *s, arg_ldstpair *a) + + tcg_rt = cpu_reg(s, a->rt); + tcg_rt2 = cpu_reg(s, a->rt2); ++ mop = a->sz + 1; ++ mop = finalize_memop_pair(s, mop); + + assert(a->sz == 3); +``` + +With this fix, my OS (Kinibi) is now able to boot. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1790018 b/results/classifier/mode-deepseek-r1:32b/output/system/1790018 new file mode 100644 index 00000000..a0848559 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1790018 @@ -0,0 +1,56 @@ + + +Assertion failure (or segmentation fault) running 32-bit x86 Linux guest on 64-bit PowerPC host + +Qemu 2.12.1 (also tried 2.12.0) +Linux gwyn 4.14.48-mc8-easy #1 SMP Sat Jun 30 23:29:01 CDT 2018 ppc64 GNU/Linux +gcc (Adelie 6.4.0-r9) 6.4.0 +GNU assembler (GNU Binutils) 2.30 +musl libc (powerpc64) Version 1.1.19 + +64-bit, 64-thread (16-core) POWER9 server in Big endian mode: +processor : 0 +cpu : POWER9, altivec supported +clock : 3000.000000MHz +revision : 2.2 (pvr 004e 1202) + +Scenario: + +Attempting to install Adélie Linux 32-bit x86 guest on 64-bit PowerPC host using qemu-system-i386. + + +Command line: + +/usr/bin/qemu-system-i386 -cdrom adelie-live-pmmx-1.0-beta1-20180807.iso -hda /dev/gwyn/x86 -m 512 -cpu pentium3 + + +Environment reproduction: + +CD image can be obtained at https://distfiles.adelielinux.org/adelie/1.0-beta1/iso/adelie-live-pmmx-1.0-beta1-20180807.iso +/dev/gwyn/x86 is an LVM2 logical volume, 4 GB in size, on NVMe storage +Qemu was built from sources on this machine, with some distribution patches applied for musl support (does not affect tcg/ppc/* code); patches and build recipe (which was modified: https://bpaste.net/show/1bbb1d07d7f2 for recipe patch) can be found at: https://code.foxkit.us/adelie/packages/blob/master/user/qemu/APKBUILD + + +Without --enable-debug-tcg: + +Thread 5 "qemu-system-i38" received signal SIGSEGV, Segmentation fault. +[Switching to LWP 14090] +0x39fb04787f63db78 in ?? () +(gdb) +(gdb) bt +#0 0x39fb04787f63db78 in () +#1 0x00003ffff1cdb160 in code_gen_buffer () +#2 0x0000000100362048 in cpu_tb_exec (itb=<optimized out>, cpu=<optimized out>) at /usr/src/packages/user/qemu/src/qemu-2.12.1/accel/tcg/cpu-exec.c:169 +#3 0x0000000100362048 in cpu_loop_exec_tb (tb_exit=<synthetic pointer>, last_tb=<synthetic pointer>, tb=<optimized out>, cpu=<optimized out>) at /usr/src/packages/user/qemu/src/qemu-2.12.1/accel/tcg/cpu-exec.c:626 +#4 0x0000000100362048 in cpu_exec (cpu=<optimized out>) at /usr/src/packages/user/qemu/src/qemu-2.12.1/accel/tcg/cpu-exec.c:734 +#5 0x00000001003211b4 in tcg_cpu_exec (cpu=<optimized out>) at /usr/src/packages/user/qemu/src/qemu-2.12.1/cpus.c:1362 +#6 0x00000001003211b4 in qemu_tcg_rr_cpu_thread_fn (arg=<optimized out>) at /usr/src/packages/user/qemu/src/qemu-2.12.1/cpus.c:1461 +#7 0x00003ffff7fa275c in start (p=0x3fffedb6a810) at src/thread/pthread_create.c:147 +#8 0x00003ffff7fae4c8 in __clone () at src/thread/powerpc64/clone.s:43 + + + +With --enable-debug-tcg: + +Assertion failed: disp == (int16_t) disp (/usr/src/packages/user/qemu/src/qemu-2.12.1/tcg/ppc/tcg-target.inc.c: reloc_pc14_val: 204) +zsh: abort qemu-system-i386 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1790260 b/results/classifier/mode-deepseek-r1:32b/output/system/1790260 new file mode 100644 index 00000000..0ea48201 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1790260 @@ -0,0 +1,13 @@ + + +binfmt support not working for x86 host and x86_64 guest + +this is a problem in the qemu-binfmt-conf.sh script and maybe somewhere else. the version i checked is the current github mirror https://github.com/qemu/qemu/blob/master/scripts/qemu-binfmt-conf.sh + +i am running linux mint 19 32bit on a 32bit x86 cpu and i want to run some applications that are only available as x86_64 packages. i use multiarch and qemu and it works for simple applications like cacafire. however i want to run the application natively from the shell without having to use qemu-x86_64 <path>. i also installed the binfmt-support package. when i run update-binfmts --display then an extry for x86_64 is missing and transparent execution is not working. + +the problem seems to be in the qemu-binfmt-conf.sh script. it disables the creation of entries for cpus of the same family. this is not a problem if you are using a 64bit cpu because 32bit binaries run on it natively but it doesnt work in the opposite way. hacking line 310 to + + if [ "$cpu" = "x86_64" ] || [ "$host_family" != "$family" ] ; then + +and running it with the --systemd ALL parameter causes a x86_64 config file to be created. it still doesnt work but that might have different causes. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1791 b/results/classifier/mode-deepseek-r1:32b/output/system/1791 new file mode 100644 index 00000000..366cd6bd --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1791 @@ -0,0 +1,42 @@ + + +qemu 8.1.0 rc tarballs are broken, missing subproject content +Description of problem: +The released tarballs for 8.1.0 rc releases (both rc0 adn rc1) are missing the +subproject content. Only the submodule content appears present +Steps to reproduce: +1. `wget http://download.qemu.org/qemu-8.1.0-rc1.tar.xz` +2. `tar Jxvf qemu-8.1.0-rc1.tar.xz` +3. `cd qemu-8.1.0-rc1` +4. `./configure --target-list=x86_64-softmmu --disable-download` + +``` +Using './build' as the directory for build output + +ERROR: missing subprojects + +This is not a GIT checkout but subproject content appears to +be missing. Do not use 'git archive' or GitHub download links +to acquire QEMU source archives. Non-GIT builds are only +supported with source archives linked from: + + https://www.qemu.org/download/#source + +Developers working with GIT can use scripts/archive-source.sh +if they need to create valid source archives. + +``` + +The missing subprojects are + +``` + berkeley-softfloat-3 + berkeley-testfloat-3 + dtc + keycodemapdb + libvfio-user +``` + +If I use 'make-release . 8.1.0-rc1' to create a tarball from git, it has all the expected content. + +IOW, either the release tarballs are not being created using 'make-release', or there's something broken with 'make-release' in some scenarios diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1792659 b/results/classifier/mode-deepseek-r1:32b/output/system/1792659 new file mode 100644 index 00000000..6104da03 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1792659 @@ -0,0 +1,36 @@ + + +watchpoints might not properly stop execution at the right address + +This bug has been tested with the latest development tree (19b599f7664b2ebfd0f405fb79c14dd241557452). + +I am using qemu-system-i386 with the gdbserver stub. I set a watchpoint on some address. When the watchpoint is hit, it will be reported by gdb, but it might happen that eip points to the wrong address (execution has not properly stopped when the watchpoint was hit). + +The setup I used to reproduce it is quite complex, but I believe I have found the cause of the bug, so I will describe that. + +The check_watchpoint() function sets cflags_next_tb in order to force the execution of only one instruction, and then exits the current tb. It then expects to be called again after that one instruction is executed, the watchpoint is hit and it is reported to gdb. + +The problem is that another interrupt might have been generated around the same time as the watchpoint. If the interrupt changes eip and execution goes on in another address, the value of cflags_next_tb will be spoiled. When we come back from the interrupt to the address where the watchpoint is hit, it is possible that a tb with multiple instructions is been executed, and therefore eip points to the wrong address, ahead of where it should be. + +In my case, the order is as follows: +* i8259 generates an IRQ + - cpu->interrupt_request contains both CPU_INTERRUPT_TGT_EXT_1 and CPU_INTERRUPT_HARD +* cpu_handle_interrupt() -> x86_cpu_exec_interrupt() is called + - it deals with CPU_INTERRUPT_TGT_EXT_1 + - execution continues +* I am exactly at the instruction where the watchpoint is hit. + - check_watchpoint() is called and cflags_next_tb is set to force the execution of only one instruction. + - execution breaks out of the loop with siglongjmp() +* cpu_handle_interrupt() -> x86_cpu_exec_interrupt() is called + - it deals with the IRQ. eip is changed and cflags_next_tb is spoiled + - execution continues at the IRQ + +[...] +* The kernel finishes dealing with the IRQ + +* I am back at the instruction where the watchpoint is hit. + - A tb is created and executed with two instructions instead of one + - eip is now ahead of the instruction that hit the watchpoint +* cpu_handle_interrupt() is called + - it deals with CPU_INTERRUPT_DEBUG + - the watchpoint is reported by gdb, but with the wrong eip. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1793183 b/results/classifier/mode-deepseek-r1:32b/output/system/1793183 new file mode 100644 index 00000000..64570cc3 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1793183 @@ -0,0 +1,25 @@ + + +apt source --compile qemu-system-x86 fails on last ubuntu 18.04.1 + +Error log: + +/tmp/qemu-2.10+dfsg/util/memfd.c:40:12: error: static declaration of ‘memfd_create’ follows non-static declaration + static int memfd_create(const char *name, unsigned int flags) + ^~~~~~~~~~~~ +In file included from /usr/include/x86_64-linux-gnu/bits/mman-linux.h:115:0, + from /usr/include/x86_64-linux-gnu/bits/mman.h:45, + from /usr/include/x86_64-linux-gnu/sys/mman.h:41, + from /tmp/qemu-2.10+dfsg/include/sysemu/os-posix.h:29, + from /tmp/qemu-2.10+dfsg/include/qemu/osdep.h:104, + from /tmp/qemu-2.10+dfsg/util/memfd.c:28: +/usr/include/x86_64-linux-gnu/bits/mman-shared.h:46:5: note: previous declaration of ‘memfd_create’ was here + int memfd_create (const char *__name, unsigned int __flags) __THROW; + ^~~~~~~~~~~~ +/tmp/qemu-2.10+dfsg/rules.mak:66: recipe for target 'util/memfd.o' failed +make[1]: *** [util/memfd.o] Error 1 +make[1]: *** Waiting for unfinished jobs.... +make[1]: Leaving directory '/tmp/qemu-2.10+dfsg/qemu-build' +debian/rules:121: recipe for target 'build-stamp' failed +make: *** [build-stamp] Error 2 +dpkg-buildpackage: error: debian/rules build subprocess returned exit status 2 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1794086 b/results/classifier/mode-deepseek-r1:32b/output/system/1794086 new file mode 100644 index 00000000..0d96f759 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1794086 @@ -0,0 +1,49 @@ + + +readlink(2) returns incorrect size for /proc/self/exe + +readlink(2) seems to ignore the size of supplied buffer for the resolved name and always returns the actual size of the resolved name instead. + +Steps to reproduce: + +```bash +echo '#include <stdio.h> +#include <stdlib.h> +#include <unistd.h> + +int main(int argc, const char** argv) +{ + if(argc < 2) exit(1); + char buf[1]; + printf("%d\n", readlink(argv[1], buf, sizeof(buf))); +}' >test.c + +# I used GCC mipsel cross-compiler to reproduce this bug +mipsel-linux-gnu-gcc-5.5 test.c -o a.out + +echo "PWD: `pwd`" +qemu-mipsel ./a.out /proc/self/exe +``` + +Expected output (observed when running a.out natively on Linux 4.17 amd64): +``` +PWD: /tmp/test +1 +``` + +Output observed when running with qemu-mipsel 2.1.2: +``` +PWD: /tmp/test +15 +``` + +According to POSIX description of readlink [1], the function shall return the number of bytes written to the supplied buffer, which obviously cannot exceed size of the buffer. + +Note that the bug is only reproduced with links within /proc filesystem; links to the regular files within /home are resolved normally. + +The bug is present in qemu-mipsel 2.1.2: + +# qemu-mipsel -version +qemu-mipsel version 2.1.2 (Debian 1:2.1+dfsg-12+deb8u6), Copyright (c) 2003-2008 Fabrice Bellard + +[1]: http://pubs.opengroup.org/onlinepubs/009695399/functions/readlink.html \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1795 b/results/classifier/mode-deepseek-r1:32b/output/system/1795 new file mode 100644 index 00000000..e2bf203a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1795 @@ -0,0 +1,10 @@ + + +PPC: not honouring single stepping through branches and skips a nip +Description of problem: +When debugging in MacsBug, tracing/stepping over any branches (e.g. blt, bgt) will land on the instruction immediately passed the expected address. It appears that branches will execute the target instruction then single step to the next instruction in one go, instead of single stepping to the target instruction. + +For example, if a blt should land on 13371234, stepping over the branch will land on 13371238. The instruction at 13371234 still executes, but this is not the behaviour on a baremetal Mac OS system. +Additional information: +A <a href="https://i.imgur.com/f6dguMt.png">screenshot</a> before the branch. +A <a href="https://imgur.com/WoVDtN7.png">screenshot<a/> after pressing 't' to step over the branch. Note that the PC is now 1E36CAB8 instead of the expected 1E36CAB4. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1796754 b/results/classifier/mode-deepseek-r1:32b/output/system/1796754 new file mode 100644 index 00000000..39e83388 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1796754 @@ -0,0 +1,19 @@ + + +ioctl SIOCGIFCONF causes qemu-aarch64-static to crash with "received signal outside vCPU context" + +To reproduce it, compile the attached crash.c under aarch64 to a.out and execute on x86_64 +qemu-aarch64-static ./a.out + +It will print the following and crash: + +socket=3 +qemu:handle_cpu_signal received signal outside vCPU context @ pc=0x60038cd6 +qemu:handle_cpu_signal received signal outside vCPU context @ pc=0x6000157a + +The version of qemu-aarch64-static is + +qemu-aarch64 version 3.0.0 (qemu-3.0.0-1.fc29) +Copyright (c) 2003-2017 Fabrice Bellard and the QEMU Project developers + +But it did also happen in previous versions so it is not a regression but a bug existed ever since. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1796816 b/results/classifier/mode-deepseek-r1:32b/output/system/1796816 new file mode 100644 index 00000000..700a16cd --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1796816 @@ -0,0 +1,22 @@ + + +Wrong keyboard in QEMU Windows for OpenSUSE PowerPC + +I am trying to run an OpenSUSE PowerPC Little Endian system under Microsoft Windows. I have an English UK keyboard. The keyboard is basically correct (I get a 'pound' sign when I press shift-3) but some of the keys are rendered incorrectly. The wrong keys are +\ renders as # (just right of left hand shift key) +| renders as ~ (shift-\) +' renders as ` (2 keys right of l) +@ renders as ¬ (shift-') +# renders as ' (3 keys right of l) +~ renders as @ (shift-#) + +QEMU command line was +>"\Program Files\qemu\qemu-system-ppc64.exe" -hda opensuse.qcow2 + +OpenSUSE was installed from download.opensuse.org/ports/ppc/tumbleweed/iso/openSUSE-Tumbleweed-DVD-ppc64le-Current.iso . + +I am running OpenSUSE in runlevel 3 (no X11). + +I don't really know whether the problem is with QEMU, the Windows port of QEMU, or with OpenSUSE Tumbleweed. + +This is with QEMU for Windows 3.0.0 from https://qemu.weilnetz.de/w64/ \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1798780 b/results/classifier/mode-deepseek-r1:32b/output/system/1798780 new file mode 100644 index 00000000..cbc9717c --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1798780 @@ -0,0 +1,15 @@ + + +hw/usb/dev-mtp.c:1616: bad test ? + +hw/usb/dev-mtp.c:1616:52: warning: logical ‘or’ of collectively exhaustive tests is always true [-Wlogical-op] + +Source code is + + if ((ret == -1) && (errno != EINTR || errno != EAGAIN || + errno != EWOULDBLOCK)) { + +Maybe better code + + if ((ret == -1) && (errno != EINTR && errno != EAGAIN && + errno != EWOULDBLOCK)) { \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1800 b/results/classifier/mode-deepseek-r1:32b/output/system/1800 new file mode 100644 index 00000000..aa55bf68 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1800 @@ -0,0 +1,34 @@ + + +8.1.0-rc1 Regression: donkey in qemu advent calender 03/2020 has graphical artifacts +Description of problem: +The game donkey shows graphical artifacts on playing. On changing the lane the car remains on its previous land as well. +A git bisect identified commit 592134617c98f37b8b39c6dd684e5a1832c071d2 as culprit +Steps to reproduce: +1. Download http://qemu-advent-calendar.org/2020/download/gw-basic.tar.xz +2. Start VM using command + ``` + qemu-system-i386 -m 16M -drive if=ide,format=qcow2,file=gwbasic.qcow2 + ``` +3. Wait for GW-Basic prompt and enter (see README): F3 - donkey - <ENTER> - F2 +4. Play to see graphical artifacts +Additional information: +``` +$ git bisect bad +592134617c98f37b8b39c6dd684e5a1832c071d2 is the first bad commit +commit 592134617c98f37b8b39c6dd684e5a1832c071d2 +Author: Richard Henderson +Date: Sun Oct 30 12:07:32 2022 +1100 + + accel/tcg: Reorg system mode store helpers + + Instead of trying to unify all operations on uint64_t, use + mmu_lookup() to perform the basic tlb hit and resolution. + Create individual functions to handle access by size. + + Reviewed-by: Peter Maydell <peter.maydell@linaro.org> + Signed-off-by: Richard Henderson <richard.henderson@linaro.org> + + accel/tcg/cputlb.c | 394 +++++++++++++++++++++++++---------------------------- + 1 file changed, 186 insertions(+), 208 deletions(-) +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1800156 b/results/classifier/mode-deepseek-r1:32b/output/system/1800156 new file mode 100644 index 00000000..9675bb86 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1800156 @@ -0,0 +1,7 @@ + + +windows 8.1 loose grab/leave window on windowed + +Hello, i am new to QEMU and i encounter that annoying issue (windowed) when i move the mouse a bit too much then it leave the window. + +Windows 8.1, Latest QEMU (Windows binaries). \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1802915 b/results/classifier/mode-deepseek-r1:32b/output/system/1802915 new file mode 100644 index 00000000..14e0336e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1802915 @@ -0,0 +1,9 @@ + + +GTK display refresh rate is throttled + +Guest OS running with GL enabled GTK display shows a reduced refresh rate, e.g. moving cursor around with iGVT-g DMA Buf. + +It seems that a default refresh interval GUI_REFRESH_INTERVAL_DEFAULT (30ms) is defined in include/ui/console.h, throttling the display refresh rate at 33Hz. + +To correct this throttle issue, a shorter interval should be applied to display change listener or the default value should be used. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1803 b/results/classifier/mode-deepseek-r1:32b/output/system/1803 new file mode 100644 index 00000000..02de73f4 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1803 @@ -0,0 +1,16 @@ + + +8.x x86_64 system emulation/tcg regression (general protection fault) +Description of problem: +Running the ISO available at https://repo.chimera-linux.org/live/20230611/chimera-linux-x86_64-LIVE-20230611-gnome.iso with the above qemu command line, the graphical environment fails to come up. The system boots, and login prompt shows up; then graphical environment startup is attempted, with Wayland (you can tell as the login prompt cursor no longer blinks, being "frozen" for possibly up to a few minutes due to emulation cost). Then the graphical startup crashes (you can tell because the cursor starts blinking again) and an X11-based startup is attempted (you can tell by the X11 cross cursor) which however never fully comes up either. +Steps to reproduce: +1. Download the ISO and run with the command line above. +2. See the issue. +Additional information: +It is possible to then switch to tty2 (View->compatmonitor0, `sendkey ctrl-alt-f2`), log in as `root:chimera` or `anon:chimera` as the console prompt instructs, and type in `dmesg` (as `root`) or `doas dmesg` (as `anon`) and see that the `dmesg` contains a number of general protection faults, like this: + + + +The system used to work, but I am not sure which is the last version of QEMU where this worked, I believe 7.x. In 8.0.3 (likewise running in a Chimera environment, but it was also tested on Alpine, and I had somebody on Arch Linux test it with 8.0.2 just to rule out possible issues caused by a musl-based host environment) it crashes. It only appears to affect the `x86_64` guest architecture, as the other-architecture ISOs have graphical environment come up fine after some minutes (e.g. `ppc64le` with `qemu-system-ppc64 -M pseries-2.11,cap-htm=off -m 2048 -boot d -cdrom chimera-linux-ppc64le-LIVE-20230611-gnome.iso` works just fine). It also appears to only affect TCG emulation, as KVM likewise works fine (same command line, just `-enable-kvm` added). + +Apologies for a large testcase, but it seems to need specific graphical-adjacent services to reproduce. It should be consistently reproducible though. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1804323 b/results/classifier/mode-deepseek-r1:32b/output/system/1804323 new file mode 100644 index 00000000..7fbef08b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1804323 @@ -0,0 +1,123 @@ + + +qemu segfaults in virtio-scsi driver if underlying device returns -EIO + +Reported downstream in Fedora: https://bugzilla.redhat.com/show_bug.cgi?id=1650975 + +Using qemu from git and reasonably recent nbdkit, this command injects -EIO +errors into the block device which virtio-scsi is reading from: + +$ nbdkit --filter=error memory size=64M error-rate=100% \ + --run 'x86_64-softmmu/qemu-system-x86_64 -device virtio-scsi,id=scsi -drive file=$nbd,format=raw,id=hd0,if=none -device scsi-hd,drive=hd0' +nbdkit: memory[1]: error: injecting EIO error into pread +nbdkit: memory[1]: error: injecting EIO error into pread +qemu-system-x86_64: hw/scsi/scsi-bus.c:1374: scsi_req_complete: Assertion `req->status == -1' failed. + +The stack trace is: + +Thread 5 (Thread 0x7f33e1f8b700 (LWP 10474)): +#0 0x00007f33fe0bf371 in __GI___poll (fds=0x559b07199490, nfds=1, timeout=-1) + at ../sysdeps/unix/sysv/linux/poll.c:29 +#1 0x00007f34061df5e6 in () at /lib64/libglib-2.0.so.0 +#2 0x00007f34061df710 in g_main_context_iteration () + at /lib64/libglib-2.0.so.0 +#3 0x00007f34061df761 in () at /lib64/libglib-2.0.so.0 +#4 0x00007f34062086ea in () at /lib64/libglib-2.0.so.0 +#5 0x00007f33fe19b58e in start_thread (arg=<optimized out>) + at pthread_create.c:486 +#6 0x00007f33fe0ca593 in clone () + at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 + +Thread 4 (Thread 0x7f33e3fff700 (LWP 10473)): +#0 0x00007f33fe1a4a8d in __lll_lock_wait () + at ../sysdeps/unix/sysv/linux/x86_64/lowlevellock.S:103 +#1 0x00007f33fe19ddf8 in __GI___pthread_mutex_lock (mutex=mutex@entry=0x559b054697a0 <qemu_global_mutex>) at ../nptl/pthread_mutex_lock.c:78 +#2 0x0000559b04f6b103 in qemu_mutex_lock_impl (mutex=0x559b054697a0 <qemu_global_mutex>, file=0x559b04f87041 "/home/rjones/d/qemu/exec.c", line=3197) + at util/qemu-thread-posix.c:66 +#3 0x0000559b04b722ee in qemu_mutex_lock_iothread_impl (file=file@entry=0x559b04f87041 "/home/rjones/d/qemu/exec.c", line=line@entry=3197) + at /home/rjones/d/qemu/cpus.c:1845 +#4 0x0000559b04b31859 in prepare_mmio_access (mr=<optimized out>, mr=<optimized out>) at /home/rjones/d/qemu/exec.c:3197 +#5 0x0000559b04b381d4 in address_space_ldub (as=<optimized out>, addr=<optimized out>, attrs=..., result=result@entry=0x0) + at /home/rjones/d/qemu/memory_ldst.inc.c:188 +#6 0x0000559b04c61cd0 in helper_inb (env=<optimized out>, port=<optimized out>) at /home/rjones/d/qemu/target/i386/cpu.h:1846 +#7 0x00007f33e889dc3e in code_gen_buffer () +#8 0x0000559b04bb3b87 in cpu_tb_exec (itb=<optimized out>, cpu=0x7f33e8876100 <code_gen_buffer+684243>) at /home/rjones/d/qemu/accel/tcg/cpu-exec.c:171 +#9 0x0000559b04bb3b87 in cpu_loop_exec_tb (tb_exit=<synthetic pointer>, last_tb=<synthetic pointer>, tb=<optimized out>, cpu=0x7f33e8876100 <code_gen_buffer+684243>) at /home/rjones/d/qemu/accel/tcg/cpu-exec.c:615 +#10 0x0000559b04bb3b87 in cpu_exec (cpu=cpu@entry=0x559b05db57a0) + at /home/rjones/d/qemu/accel/tcg/cpu-exec.c:725 +#11 0x0000559b04b7088f in tcg_cpu_exec (cpu=0x559b05db57a0) + at /home/rjones/d/qemu/cpus.c:1425 +#12 0x0000559b04b72c03 in qemu_tcg_cpu_thread_fn (arg=0x559b05db57a0) + at /home/rjones/d/qemu/cpus.c:1729 +#13 0x0000559b04b72c03 in qemu_tcg_cpu_thread_fn (arg=arg@entry=0x559b05db57a0) + at /home/rjones/d/qemu/cpus.c:1703 +#14 0x0000559b04f6afba in qemu_thread_start (args=<optimized out>) + at util/qemu-thread-posix.c:498 +#15 0x00007f33fe19b58e in start_thread (arg=<optimized out>) + at pthread_create.c:486 +#16 0x00007f33fe0ca593 in clone () + at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 + +Thread 3 (Thread 0x7f33e178a700 (LWP 10475)): +#0 0x00007f33fe0bf371 in __GI___poll (fds=0x559b071aa760, nfds=2, timeout=-1) + at ../sysdeps/unix/sysv/linux/poll.c:29 +#1 0x00007f34061df5e6 in () at /lib64/libglib-2.0.so.0 +#2 0x00007f34061df9a2 in g_main_loop_run () at /lib64/libglib-2.0.so.0 +#3 0x00007f34032ca90a in () at /lib64/libgio-2.0.so.0 +#4 0x00007f34062086ea in () at /lib64/libglib-2.0.so.0 +#5 0x00007f33fe19b58e in start_thread (arg=<optimized out>) + at pthread_create.c:486 +#6 0x00007f33fe0ca593 in clone () + at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 + +Thread 2 (Thread 0x7f33eb050700 (LWP 10471)): +#0 0x00007f33fe1a5400 in __GI___nanosleep (requested_time=0x7f33eb04d270, remaining=0x7f33eb04d280) at ../sysdeps/unix/sysv/linux/nanosleep.c:28 +#1 0x00007f3406209e17 in g_usleep () at /lib64/libglib-2.0.so.0 +#2 0x0000559b04f7cb80 in call_rcu_thread (opaque=opaque@entry=0x0) + at util/rcu.c:253 +#3 0x0000559b04f6afba in qemu_thread_start (args=<optimized out>) + at util/qemu-thread-posix.c:498 +#4 0x00007f33fe19b58e in start_thread (arg=<optimized out>) + at pthread_create.c:486 +#5 0x00007f33fe0ca593 in clone () + at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 + +Thread 1 (Thread 0x7f33eb9b42c0 (LWP 10470)): +#0 0x00007f33fe00553f in __GI_raise (sig=sig@entry=6) + at ../sysdeps/unix/sysv/linux/raise.c:50 +#1 0x00007f33fdfef895 in __GI_abort () at abort.c:79 +#2 0x00007f33fdfef769 in __assert_fail_base (fmt=0x7f33fe156ea8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x559b050203cf "req->status == -1", file=0x559b050203aa "hw/scsi/scsi-bus.c", line=1374, function=0x559b05020dc0 <__PRETTY_FUNCTION__.32414> "scsi_req_complete") at assert.c:92 +#3 0x00007f33fdffd9f6 in __GI___assert_fail (assertion=assertion@entry=0x559b050203cf "req->status == -1", file=file@entry=0x559b050203aa "hw/scsi/scsi-bus.c", line=line@entry=1374, function=function@entry=0x559b05020dc0 <__PRETTY_FUNCTION__.32414> "scsi_req_complete") at assert.c:101 +#4 0x0000559b04da23c0 in scsi_req_complete (req=<optimized out>, status=<optimized out>) at hw/scsi/scsi-bus.c:1374 +#5 0x0000559b04d9cc60 in scsi_dma_complete_noio (r=0x559b069c3600, ret=<optimized out>) at hw/scsi/scsi-disk.c:281 +#6 0x0000559b04d9cd0f in scsi_dma_complete (opaque=0x559b069c3600, ret=-5) + at hw/scsi/scsi-disk.c:302 +#7 0x0000559b04c91607 in dma_complete (ret=-5, dbs=0x559b07808000) + at dma-helpers.c:116 +#8 0x0000559b04c91607 in dma_blk_cb (opaque=0x559b07808000, ret=-5) + at dma-helpers.c:138 +#9 0x0000559b04ec411e in blk_aio_complete (acb=0x559b07514fa0) + at block/block-backend.c:1345 +#10 0x0000559b04f7e32b in coroutine_trampoline (i0=<optimized out>, i1=<optimized out>) at util/coroutine-ucontext.c:116 +#11 0x00007f33fe01b200 in __start_context () + at ../sysdeps/unix/sysv/linux/x86_64/__start_context.S:91 +#12 0x00007ffc0896b040 in () +#13 0x0000000000000000 in () + +I bisected this to: + +40dce4ee61c68395f6d463fae792f61b7c003bce is the first bad commit +commit 40dce4ee61c68395f6d463fae792f61b7c003bce +Author: Paolo Bonzini <email address hidden> +Date: Sat Oct 13 11:52:34 2018 +0200 + + scsi-disk: fix rerror/werror=ignore + + rerror=ignore was returning true from scsi_handle_rw_error but the callers were not + calling scsi_req_complete when rerror=ignore returns true (this is the correct thing + to do when true is returned after executing a passthrough command). Fix this by + calling it in scsi_handle_rw_error. + + Signed-off-by: Paolo Bonzini <email address hidden> + +:040000 040000 311386b9b91d77840a849459ab6ae41a37fd7f42 8adcda67d7487bcc18966f096c9923da3b8dc0b9 M hw \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1807052 b/results/classifier/mode-deepseek-r1:32b/output/system/1807052 new file mode 100644 index 00000000..c1a9a784 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1807052 @@ -0,0 +1,227 @@ + + +Qemu hangs during migration + +Source server: linux 4.19.5 qemu-3.0.0 from source, libvirt 4.9 +Dest server: linux 4.18.19 qemu-3.0.0 from source, libvirt 4.9 + +When this VM is running on source server: + +/usr/bin/qemu-system-x86_64 -name guest=testvm,debug-threads=on -S -object secret,id=masterKey0,format=raw,file=/var/lib/libvirt/qemu/domain-13-testvm/master-key.aes -machine pc-q35-3.0,accel=kvm,usb=off,dump-guest-core=off -cpu Skylake-Server-IBRS,ss=on,hypervisor=on,tsc_adjust=on,clflushopt=on,umip=on,pku=on,ssbd=on,xsaves=on,topoext=on,hv_time,hv_relaxed,hv_vapic,hv_spinlocks=0x1fff,hv_vpindex,hv_runtime,hv_synic,hv_stimer,hv_reset,hv_vendor_id=KVM Hv -m 4096 -realtime mlock=off -smp 2,sockets=2,cores=1,threads=1 -object iothread,id=iothread1 -uuid 3b00b788-ee91-4e45-80a6-c7319da71225 -no-user-config -nodefaults -chardev socket,id=charmonitor,fd=23,server,nowait -mon chardev=charmonitor,id=monitor,mode=control -rtc base=localtime,driftfix=slew -global kvm-pit.lost_tick_policy=delay -no-hpet -no-shutdown -boot strict=on -device pcie-root-port,port=0x10,chassis=1,id=pci.1,bus=pcie.0,multifunction=on,addr=0x2 -device pcie-root-port,port=0x11,chassis=2,id=pci.2,bus=pcie.0,addr=0x2.0x1 -device pcie-pci-bridge,id=pci.3,bus=pci.1,addr=0x0 -device pcie-root-port,port=0x12,chassis=4,id=pci.4,bus=pcie.0,addr=0x2.0x2 -device pcie-root-port,port=0x13,chassis=5,id=pci.5,bus=pcie.0,addr=0x2.0x3 -device piix3-usb-uhci,id=usb,bus=pci.3,addr=0x1 -device virtio-scsi-pci,iothread=iothread1,id=scsi0,bus=pci.4,addr=0x0 -drive file=/dev/zvol/datastore/vm/testvm-vda,format=raw,if=none,id=drive-scsi0-0-0-0,cache=writeback,aio=threads -device scsi-hd,bus=scsi0.0,channel=0,scsi-id=0,lun=0,drive=drive-scsi0-0-0-0,id=scsi0-0-0-0,bootindex=2,write-cache=on -drive if=none,id=drive-sata0-0-4,media=cdrom,readonly=on -device ide-cd,bus=ide.4,drive=drive-sata0-0-4,id=sata0-0-4,bootindex=1 -netdev tap,fd=25,id=hostnet0,vhost=on,vhostfd=26 -device virtio-net-pci,netdev=hostnet0,id=net0,mac=52:54:00:a2:b7:a1,bus=pci.2,addr=0x0 -device usb-tablet,id=input0,bus=usb.0,port=1 -vnc 127.0.0.1:0 -device cirrus-vga,id=video0,bus=pcie.0,addr=0x1 -s -sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny -msg timestamp=on + +I try to migrate it and the disks to the other side: + +virsh migrate --live --undefinesource --persistent --verbose --copy-storage-all testvm qemu+ssh://wasvirt1/system + +We get to 99% then hang with both sides in the pause state. + +Source server is stuck here: +(gdb) bt full +#0 0x00007f327994f3c1 in ppoll () at /lib64/libc.so.6 +#1 0x000000000086167b in qemu_poll_ns (fds=<optimized out>, nfds=nfds@entry=1, timeout=<optimized out>) at util/qemu-timer.c:322 +#2 0x0000000000863302 in aio_poll (ctx=0x21044e0, blocking=blocking@entry=true) at util/aio-posix.c:629 + node = <optimized out> + i = <optimized out> + ret = 0 + progress = <optimized out> + timeout = <optimized out> + start = <optimized out> + __PRETTY_FUNCTION__ = "aio_poll" +#3 0x00000000007e0d52 in nbd_client_close (bs=0x2ba2400) at block/nbd-client.c:62 + waited_ = <optimized out> + wait_ = 0x2ba563c + ctx_ = 0x2109bb0 + bs_ = 0x2ba2400 + client = 0x31287e0 + client = <optimized out> + request = {handle = 0, from = 0, len = 0, flags = 0, type = 2} +#4 0x00000000007e0d52 in nbd_client_close (bs=0x2ba2400) at block/nbd-client.c:965 + client = <optimized out> + request = {handle = 0, from = 0, len = 0, flags = 0, type = 2} +#5 0x00000000007de5ca in nbd_close (bs=<optimized out>) at block/nbd.c:491 + s = 0x31287e0 +#6 0x00000000007823d6 in bdrv_unref (bs=0x2ba2400) at block.c:3352 + ban = <optimized out> + ban_next = <optimized out> + child = <optimized out> + next = <optimized out> +#7 0x00000000007823d6 in bdrv_unref (bs=0x2ba2400) at block.c:3560 +#8 0x00000000007823d6 in bdrv_unref (bs=0x2ba2400) at block.c:4616 +#9 0x0000000000782403 in bdrv_unref (bs=0x2af96f0) at block.c:3359 + ban = <optimized out> + ban_next = <optimized out> + child = <optimized out> + next = <optimized out> +#10 0x0000000000782403 in bdrv_unref (bs=0x2af96f0) at block.c:3560 +#11 0x0000000000782403 in bdrv_unref (bs=0x2af96f0) at block.c:4616 +#12 0x0000000000785784 in block_job_remove_all_bdrv (job=job@entry=0x2f32570) at blockjob.c:200 + c = 0x23bac30 + l = 0x20dd330 = {0x23bac30, 0x2b89410} +#13 0x00000000007ceb5f in mirror_exit (job=0x2f32570, opaque=0x7f326407a350) at block/mirror.c:700 + s = 0x2f32570 + bjob = 0x2f32570 + data = 0x7f326407a350 + bs_opaque = 0x30d5600 + replace_aio_context = <optimized out> + src = 0x2131080 + target_bs = 0x2af96f0 + mirror_top_bs = 0x210eb70 + local_err = 0x0 +#14 0x0000000000786452 in job_defer_to_main_loop_bh (opaque=0x7f32640786a0) at job.c:973 + data = 0x7f32640786a0 + job = <optimized out> + aio_context = 0x2109bb0 +#15 0x000000000085fd3f in aio_bh_poll (ctx=ctx@entry=0x21044e0) at util/async.c:118 +---Type <return> to continue, or q <return> to quit--- + bh = <optimized out> + bhp = <optimized out> + next = 0x2ea86e0 + ret = 1 + deleted = false +#16 0x00000000008631b0 in aio_dispatch (ctx=0x21044e0) at util/aio-posix.c:436 +#17 0x000000000085fc1e in aio_ctx_dispatch (source=<optimized out>, callback=<optimized out>, user_data=<optimized out>) at util/async.c:261 + ctx = <optimized out> +#18 0x00007f327f17d797 in g_main_context_dispatch () at /usr/lib64/libglib-2.0.so.0 +#19 0x00000000008622ed in main_loop_wait () at util/main-loop.c:215 + context = 0x2104900 + pfds = <optimized out> + context = 0x2104900 + ret = 1 + ret = 1 + timeout = 4294967295 + timeout_ns = <optimized out> +#20 0x00000000008622ed in main_loop_wait (timeout=<optimized out>) at util/main-loop.c:238 + context = 0x2104900 + ret = 1 + ret = 1 + timeout = 4294967295 + timeout_ns = <optimized out> +#21 0x00000000008622ed in main_loop_wait (nonblocking=nonblocking@entry=0) at util/main-loop.c:497 + ret = 1 + timeout = 4294967295 + timeout_ns = <optimized out> +#22 0x0000000000595dee in main_loop () at vl.c:1866 +#23 0x000000000041f35d in main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at vl.c:4644 + i = <optimized out> + snapshot = 0 + linux_boot = <optimized out> + initrd_filename = 0x0 + kernel_filename = <optimized out> + kernel_cmdline = <optimized out> + boot_order = 0x918f44 "cad" + boot_once = 0x0 + ds = <optimized out> + opts = <optimized out> + machine_opts = <optimized out> + icount_opts = <optimized out> + accel_opts = 0x0 + olist = <optimized out> + optind = 71 + optarg = 0x7ffdfc94df69 "timestamp=on" + loadvm = 0x0 + machine_class = 0x0 + cpu_model = 0x7ffdfc94d864 "Skylake-Server-IBRS,ss=on,hypervisor=on,tsc_adjust=on,clflushopt=on,umip=on,pku=on,ssbd=on,xsaves=on,topoext=on,hv_time,hv_relaxed,hv_vapic,hv_spinlocks=0x1fff,hv_vpindex,hv_runtime,hv_synic,hv_stimer"... + vga_model = 0x0 + qtest_chrdev = 0x0 + qtest_log = 0x0 + pid_file = <optimized out> + incoming = 0x0 + userconfig = <optimized out> +---Type <return> to continue, or q <return> to quit--- + nographic = false + display_remote = <optimized out> + log_mask = <optimized out> + log_file = <optimized out> + trace_file = <optimized out> + maxram_size = 4294967296 + ram_slots = 0 + vmstate_dump_file = 0x0 + main_loop_err = 0x0 + err = 0x0 + list_data_dirs = false + dir = <optimized out> + dirs = <optimized out> + bdo_queue = {sqh_first = 0x0, sqh_last = 0x7ffdfc94c170} + __func__ = "main" + +Strace shows: +ppoll([{fd=9, events=POLLIN|POLLERR|POLLHUP}], 1, NULL, NULL, 8 + +Which points to this: + +ls -al /proc/2286/fd/9 +lrwx------ 1 root users 64 Dec 5 13:04 /proc/2286/fd/9 -> anon_inode:[eventfd] + +The dest side is stuck here: + +(gdb) bt full +#0 0x00007f21f070d3c1 in ppoll () at /lib64/libc.so.6 +#1 0x0000000000861659 in qemu_poll_ns (fds=<optimized out>, nfds=<optimized out>, timeout=timeout@entry=2999926258) at util/qemu-timer.c:334 + ts = {tv_sec = 2, tv_nsec = 999926258} +Python Exception <class 'gdb.error'> That operation is not available on integers of more than 8 bytes.: +#2 0x00000000008622a4 in main_loop_wait (timeout=<optimized out>) at util/main-loop.c:233 + context = 0x2142900 + ret = <optimized out> + ret = -1295041038 + timeout = 4294967295 + timeout_ns = <optimized out> +#3 0x00000000008622a4 in main_loop_wait (nonblocking=nonblocking@entry=0) at util/main-loop.c:497 + ret = -1295041038 + timeout = 4294967295 + timeout_ns = <optimized out> +#4 0x0000000000595dee in main_loop () at vl.c:1866 +#5 0x000000000041f35d in main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at vl.c:4644 + i = <optimized out> + snapshot = 0 + linux_boot = <optimized out> + initrd_filename = 0x0 + kernel_filename = <optimized out> + kernel_cmdline = <optimized out> + boot_order = 0x918f44 "cad" + boot_once = 0x0 + ds = <optimized out> + opts = <optimized out> + machine_opts = <optimized out> + icount_opts = <optimized out> + accel_opts = 0x0 + olist = <optimized out> + optind = 73 + optarg = 0x7ffdd6ee8f69 "timestamp=on" + loadvm = 0x0 + machine_class = 0x0 + cpu_model = 0x7ffdd6ee8854 "Skylake-Server-IBRS,ss=on,hypervisor=on,tsc_adjust=on,clflushopt=on,umip=on,pku=on,ssbd=on,xsaves=on,topoext=on,hv_time,hv_relaxed,hv_vapic,hv_spinlocks=0x1fff,hv_vpindex,hv_runtime,hv_synic,hv_stimer"... + vga_model = 0x0 + qtest_chrdev = 0x0 + qtest_log = 0x0 + pid_file = <optimized out> + incoming = 0x7ffdd6ee8f0a "defer" + userconfig = <optimized out> + nographic = false + display_remote = <optimized out> + log_mask = <optimized out> + log_file = <optimized out> + trace_file = <optimized out> + maxram_size = 4294967296 + ram_slots = 0 + vmstate_dump_file = 0x0 + main_loop_err = 0x0 + err = 0x0 + list_data_dirs = false + dir = <optimized out> + dirs = <optimized out> + bdo_queue = {sqh_first = 0x0, sqh_last = 0x7ffdd6ee6630} +---Type <return> to continue, or q <return> to quit--- + __func__ = "main" + +Strace show this over and over +ppoll([{fd=6, events=POLLIN}, {fd=7, events=POLLIN}, {fd=9, events=POLLIN}, {fd=10, events=POLLIN}, {fd=21, events=POLLIN}, {fd=22, events=POLLIN}, {fd=23, events=POLLIN}, {fd=24, events=POLLIN}, {fd=27, events=POLLIN}], 9, {0, 594527977}, NULL, 8) = 0 (Timeout) + +lrwx------ 1 root users 64 Dec 5 13:15 /proc/20170/fd/10 -> anon_inode:[eventfd] +lrwx------ 1 root users 64 Dec 5 13:15 /proc/20170/fd/21 -> socket:[42631161] +lrwx------ 1 root users 64 Dec 5 13:15 /proc/20170/fd/22 -> socket:[42631165] +lrwx------ 1 root users 64 Dec 5 13:15 /proc/20170/fd/23 -> socket:[42631167] +lrwx------ 1 root users 64 Dec 5 13:15 /proc/20170/fd/24 -> socket:[42631168] +lrwx------ 1 root users 64 Dec 5 13:15 /proc/20170/fd/27 -> socket:[42690422] +lrwx------ 1 root users 64 Dec 5 13:15 /proc/20170/fd/6 -> anon_inode:[eventfd] +lrwx------ 1 root users 64 Dec 5 13:15 /proc/20170/fd/7 -> anon_inode:[signalfd] +lrwx------ 1 root users 64 Dec 5 13:15 /proc/20170/fd/9 -> anon_inode:[eventfd] \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1807675 b/results/classifier/mode-deepseek-r1:32b/output/system/1807675 new file mode 100644 index 00000000..3a38025e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1807675 @@ -0,0 +1,32 @@ + + +qemu commit 80422b0: tcg.c crash in temp_load + +As discussed in #1803160 I'm opening a new ticket for the new bug. + +QEMU version: +------------- + +qemu from git, master branch commit 80422b00196a7af4c6efb628fae0ad8b644e98af + +Summary: +-------- + +TCG crashes in i386 and x86_64 when it tries to execute some specific illegal instructions. When running full OS emulation, both the guest system and QEMU crash. + +$ qemu-i386 tcg_crash1.elf +/home/alberto/Documents/qemu/tcg/tcg.c:2863: tcg fatal error +qemu: uncaught target signal 11 (Segmentation fault) - core dumped +zsh: segmentation fault (core dumped) ./qemu/build/i386-linux-user/qemu-i386 tcg_crash1.elf + +Invalid instructions: + +f0 invalid +40 inc eax +a7 cmpsd dword [esi], dword ptr es:[edi] +48 dec eax + +Testcase: +--------- + +Find ELF file attached. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1808 b/results/classifier/mode-deepseek-r1:32b/output/system/1808 new file mode 100644 index 00000000..decea90e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1808 @@ -0,0 +1,73 @@ + + +qemu-system-i386: Crash in tcg_handle_interrupt on fpu_raise_exception call +Description of problem: +While I was messing with an old Linux system, QEMU crashed as I tried to run `make test` on a package: +``` +ERROR:../accel/tcg/tcg-accel-ops.c:83:tcg_handle_interrupt: assertion failed: (qemu_mutex_iothread_locked()) +Bail out! ERROR:../accel/tcg/tcg-accel-ops.c:83:tcg_handle_interrupt: assertion failed: (qemu_mutex_iothread_locked()) +``` +Running QEMU straight from the master branch (c167c80) didn't help either. The backtrace is as follows: +``` +(gdb) bt +#0 0x00007ffff55ac26c in () at /usr/lib/libc.so.6 +#1 0x00007ffff555ca08 in raise () at /usr/lib/libc.so.6 +#2 0x00007ffff5545538 in abort () at /usr/lib/libc.so.6 +#3 0x00007ffff6bae05e in g_assertion_message + (domain=domain@entry=0x0, file=file@entry=0x555555f90a98 "../accel/tcg/tcg-accel-ops.c", line=line@entry=83, func=func@entry=0x55555607a130 <__func__.3> "tcg_handle_interrupt", message=message@entry=0x7fff9c15ee10 "assertion failed: (qemu_mutex_iothread_locked())") at ../glib/glib/gtestutils.c:3450 +#4 0x00007ffff6c0ef40 in g_assertion_message_expr + (domain=domain@entry=0x0, file=file@entry=0x555555f90a98 "../accel/tcg/tcg-accel-ops.c", line=line@entry=83, func=func@entry=0x55555607a130 <__func__.3> "tcg_handle_interrupt", expr=expr@entry=0x555555f79cf8 "qemu_mutex_iothread_locked()") at ../glib/glib/gtestutils.c:3476 +#5 0x0000555555c97369 in tcg_handle_interrupt (cpu=0x555557434cb0, mask=2) at ../accel/tcg/tcg-accel-ops.c:83 +#6 tcg_handle_interrupt (cpu=0x555557434cb0, mask=2) at ../accel/tcg/tcg-accel-ops.c:81 +#7 0x0000555555b4d58b in pic_irq_request (opaque=<optimized out>, irq=<optimized out>, level=1) at ../hw/i386/x86.c:555 +#8 0x0000555555b4f218 in gsi_handler (opaque=0x5555579423d0, n=13, level=1) at ../hw/i386/x86.c:611 +#9 0x00007fffa42bde14 in code_gen_buffer () +#10 0x0000555555c724bb in cpu_tb_exec (cpu=cpu@entry=0x555557434cb0, itb=<optimized out>, tb_exit=tb_exit@entry=0x7fffe9bfd658) at ../accel/tcg/cpu-exec.c:457 +#11 0x0000555555c7298e in cpu_loop_exec_tb (tb_exit=0x7fffe9bfd658, last_tb=<synthetic pointer>, pc=3221283547, tb=<optimized out>, cpu=<optimized out>) at ../accel/tcg/cpu-exec.c:919 +#12 cpu_exec_loop (cpu=cpu@entry=0x555557434cb0, sc=sc@entry=0x7fffe9bfd6f0) at ../accel/tcg/cpu-exec.c:1040 +#13 0x0000555555c731dd in cpu_exec_setjmp (cpu=cpu@entry=0x555557434cb0, sc=sc@entry=0x7fffe9bfd6f0) at ../accel/tcg/cpu-exec.c:1057 +#14 0x0000555555c73810 in cpu_exec (cpu=cpu@entry=0x555557434cb0) at ../accel/tcg/cpu-exec.c:1083 +#15 0x0000555555c974ff in tcg_cpus_exec (cpu=cpu@entry=0x555557434cb0) at ../accel/tcg/tcg-accel-ops.c:75 +#16 0x0000555555c97657 in mttcg_cpu_thread_fn (arg=arg@entry=0x555557434cb0) at ../accel/tcg/tcg-accel-ops-mttcg.c:95 +#17 0x0000555555e283e8 in qemu_thread_start (args=0x5555574935f0) at ../util/qemu-thread-posix.c:541 +#18 0x00007ffff55aa44b in () at /usr/lib/libc.so.6 +#19 0x00007ffff562de40 in () at /usr/lib/libc.so.6 +``` + +After further testing, it seems related to inftest.awk. However, the crash doesn't occur right after I run the file, but only when I do specific operations afterwards. + +With `-accel kvm` +``` +> gawk -f test/inftest.awk +(output trimmed) +1e+305 1e+302 +1e+308 1e+305 +gawk: test/inftest.awk:3: fatal: floating point exception +> echo Test # No crash +Test +> cat test/inftest.awk # No crash +``` + +With `-accel tcg` +``` +> gawk -f test/inftest.awk +(output trimmed) +1e+308 1e+305 +Infinity 1e+308 +Infinity Infinity +loop terminated +> echo Test # No crash +Test +> cat test/inftest.awk # QEMU crash +``` +Steps to reproduce: +1. Start the VM +2. Press any key except for enter to go through the SVGA prompt +3. Enter `root` to login. No password is required +4. Run `cd /usr/src2/gawk-2.14` +5. Run `gawk -f test/inftest.awk` +6. Run certain commands that interact with the kernel (ex. `ls`, `cat test/inftest.awk`, `whoami`) +7. Observe the crash +Additional information: +[00000-bootFloppy.raw](/uploads/379f6b601132980af4ea721fe77dbae4/00000-bootFloppy.raw) +[artifact.qcow2](/uploads/d721a35bc55e764e17087e8bc1a7531e/artifact.qcow2) diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1809144 b/results/classifier/mode-deepseek-r1:32b/output/system/1809144 new file mode 100644 index 00000000..bd14a38d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1809144 @@ -0,0 +1,37 @@ + + +SVM instructions fail with SVME bit enabled + +I was trying to use QEMU/TCG to emulate some stuff that uses SVM. +I know SVM is only partially implemented but I gave it a try anyway. + +I found that if SVM is enabled in the same basic block in which there's a call to VMSAVE/etc, +the call fails as illegal op because the flags don't get updated correctly. + +The pseudocode for the asm I'm running is: + +``` +EFER |= SVME; set the appropriate bit with wrmsr +vmsave +``` + +This is an example of the relevant translate.c code: + +``` + if (!(s->flags & HF_SVME_MASK) || !s->pe) { + goto illegal_op; + } + if (s->cpl != 0) { + gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); + break; + } +``` + +s->flags doesn't get updated after the wrmsr instruction and so QEMU raises an illegal opcode interrupt. + +A quick fix is to make the tb end after `wrmsr` instructions, but it's an hack afaik. +I'm not too comfortable with QEMU's code, so I don't know what a proper fix would be. + +Cheers, + +thebabush \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1810 b/results/classifier/mode-deepseek-r1:32b/output/system/1810 new file mode 100644 index 00000000..a4bf89e8 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1810 @@ -0,0 +1,193 @@ + + +heap-buffer-overflow in esp_do_dma() +Description of problem: +Got a heap-buffer-overflow error when fuzzing the device am53c974. +Steps to reproduce: +Minimized reproducer: + +```plaintext +cat << EOF | ./qemu-system-x86_64 -display none -machine accel=qtest, -m 512M -device \ +am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \ +id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest /dev/null\ + -qtest stdio +outl 0xcf8 0x80001010 +outl 0xcfc 0xc000 +outl 0xcf8 0x80001004 +outw 0xcfc 0x05 +outl 0xc03d 0x03000000 +outl 0xc047 0x065a9d80 +outl 0xc00a 0xc10000 +write 0x65a9d 0x1 0x04 +write 0x65a9e 0x1 0x10 +outl 0xc03d 0x03000000 +outl 0xc00a 0xc10000 +outl 0xc00b 0x0800 +outl 0xc00b 0x00 +outl 0xc00b 0x0800 +outl 0xc00b 0x0800 +outl 0xc00b 0x0800 +outl 0xc00b 0x0400 +outl 0xc00b 0x0800 +outl 0xc00b 0x0800 +outw 0xc00b 0x1000 +outw 0xc00b 0x9000 +EOF +``` +Additional information: +The crash report triggered by the reproducer is: + +```plaintext +[I 0.000000] OPENED +[R +0.022834] outl 0xcf8 0x80001010 +[S +0.022864] OK +OK +[R +0.022874] outl 0xcfc 0xc000 +[S +0.022887] OK +OK +[R +0.022942] outl 0xcf8 0x80001004 +[S +0.022990] OK +OK +[R +0.023028] outw 0xcfc 0x05 +[S +0.023508] OK +OK +[R +0.023518] outl 0xc03d 0x03000000 +[S +0.023527] OK +OK +[R +0.023532] outl 0xc047 0x065a9d80 +[S +0.023537] OK +OK +[R +0.023544] outl 0xc00a 0xc10000 +[S +0.023573] OK +OK +[R +0.023581] write 0x65a9d 0x1 0x04 +[S +0.023891] OK +OK +[R +0.023900] write 0x65a9e 0x1 0x10 +[S +0.023906] OK +OK [R +0.023910] outl 0xc03d 0x03000000 +[S +0.023917] OK +OK +[R +0.023921] outl 0xc00a 0xc10000 +[S +0.023983] OK +OK +[R +0.023581] write 0x65a9d 0x1 0x04 +[S +0.023891] OK +OK +[R +0.023900] write 0x65a9e 0x1 0x10 +[S +0.023906] OK +OK [R +0.023910] outl 0xc03d 0x03000000 +[S +0.023917] OK +OK +[R +0.023921] outl 0xc00a 0xc10000 +[S +0.023983] OK +OK +[R +0.023991] outl 0xc00b 0x0800 +[S +0.023998] OK +OK +[R +0.024002] outl 0xc00b 0x00 +[S +0.024008] OK +OK +[R +0.024014] outl 0xc00b 0x0800 +[S +0.024028] OK +OK +[R +0.024034] outl 0xc00b 0x0800 +[S +0.024040] OK +OK +[R +0.024051] outl 0xc00b 0x0800 +[S +0.024058] OK +OK +[R +0.024065] outl 0xc00b 0x0400 +[S +0.024073] OK +OK +[R +0.024082] outl 0xc00b 0x0800 +[S +0.024089] OK +OK +[R +0.024104] outl 0xc00b 0x0800 +[S +0.024121] OK +OK +[R +0.024133] outw 0xc00b 0x1000 +[S +0.024150] OK +OK +[R +0.024159] outw 0xc00b 0x9000 +================================================================= +==63330==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62500020c000 at pc 0x5601fffcf1d4 bp 0x7ffe1920dcf0 sp 0x7ffe1920d4b0 +WRITE of size 32736 at 0x62500020c000 thread T0 + #0 0x5601fffcf1d3 in __asan_memcpy ../../llvm-project-15.0.0.src/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x5602015f506b in flatview_read_continue ../softmmu/physmem.c:2726:13 + #2 0x5602015f5ee3 in flatview_read ../softmmu/physmem.c:2762:12 + #3 0x5602015f5bf7 in address_space_read_full ../softmmu/physmem.c:2775:18 + #4 0x560200943ef0 in dma_memory_rw_relaxed ../include/sysemu/dma.h:87:12 + #5 0x560200943ef0 in dma_memory_rw ../include/sysemu/dma.h:130:12 + #6 0x560200943ef0 in pci_dma_rw ../hw/pci/pci_device.h:233:12 + #7 0x560200943ef0 in esp_pci_dma_memory_rw ../hw/scsi/esp-pci.c:283:5 + #8 0x56020092db7e in esp_do_dma ../hw/scsi/esp.c + #9 0x560200935774 in handle_ti ../hw/scsi/esp.c:912:9 + #10 0x560200932db6 in esp_reg_write ../hw/scsi/esp.c:1083:13 + #11 0x56020094574d in esp_pci_io_write ../hw/scsi/esp-pci.c:214:9 + #12 0x5602015b5f23 in memory_region_write_accessor ../softmmu/memory.c:493:5 + #13 0x5602015b56aa in access_with_adjusted_size ../softmmu/memory.c:569:18 + #14 0x5602015b4a50 in memory_region_dispatch_write ../softmmu/memory.c + #15 0x5602015fefbf in flatview_write_continue ../softmmu/physmem.c:2653:23 + #16 0x5602015f6463 in flatview_write ../softmmu/physmem.c:2695:12 + #17 0x5602015f6177 in address_space_write ../softmmu/physmem.c:2791:18 + #18 0x5602015a7e99 in cpu_outw ../softmmu/ioport.c:75:5 + #19 0x560200d28daa in qtest_process_command ../softmmu/qtest.c:483:13 + #20 0x560200d2795b in qtest_process_inbuf ../softmmu/qtest.c:788:9 + #21 0x560201b581a6 in fd_chr_read ../chardev/char-fd.c:72:9 + #22 0x7f8fce57e04d in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5204d) (BuildId: 5fdb313daf182a33a858ba2cc945211b11d34561) + #23 0x560201dc540f in glib_pollfds_poll ../util/main-loop.c:290:9 + #24 0x560201dc540f in os_host_main_loop_wait ../util/main-loop.c:313:5 + #25 0x560201dc540f in main_loop_wait ../util/main-loop.c:592:11 + #26 0x560200d34f76 in qemu_main_loop ../softmmu/runstate.c:732:9 + #27 0x56020173e835 in qemu_default_main ../softmmu/main.c:37:14 + #28 0x7f8fcd3a5082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16 + #29 0x5601fff2009d in _start ./qemu-system-x86_64+0x1e9109d) + +0x62500020c000 is located 0 bytes to the right of 4096-byte region [0x62500020b000,0x62500020c000) +allocated by thread T0 here: + #0 0x5601fffd0a0c in posix_memalign ../../llvm-project-15.0.0.src/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x560201db83da in qemu_try_memalign ../util/memalign.c:53:11 + #2 0x560201db8762 in qemu_memalign ../util/memalign.c:73:15 + #3 0x5602008c779e in scsi_req_enqueue ../hw/scsi/scsi-bus.c:906:10 + #4 0x56020093bd2f in do_command_phase ../hw/scsi/esp.c:296:15 + #5 0x56020093bd2f in do_cmd ../hw/scsi/esp.c:344:5 + #6 0x560200932911 in esp_reg_write ../hw/scsi/esp.c:1112:13 + #7 0x56020094574d in esp_pci_io_write ../hw/scsi/esp-pci.c:214:9 + #8 0x5602015b5f23 in memory_region_write_accessor ../softmmu/memory.c:493:5 + #9 0x5602015b56aa in access_with_adjusted_size ../softmmu/memory.c:569:18 + +SUMMARY: AddressSanitizer: heap-buffer-overflow ./llvm-project-15.0.0.src/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c4a800397b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c4a800397c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c4a800397d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c4a800397e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c4a800397f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c4a80039800:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4a80039810: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4a80039820: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4a80039830: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4a80039840: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4a80039850: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==63330==ABORTING +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1810956 b/results/classifier/mode-deepseek-r1:32b/output/system/1810956 new file mode 100644 index 00000000..3f8fa9e7 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1810956 @@ -0,0 +1,10 @@ + + +qemu-2.12.1 crashes when running malicious bootloader. + +Running specific bootloader on Qemu causes fatal error and +hence SIGABRT in /qemu-2.12.1/tcg/tcg.c on line 2684. + +Bootloader binary code is included in attachments. +The code was generated by assembling a valid bootloader, then +appending random-bytes from file `/dev/urandom` to the binary file. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1811244 b/results/classifier/mode-deepseek-r1:32b/output/system/1811244 new file mode 100644 index 00000000..29c2d3be --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1811244 @@ -0,0 +1,42 @@ + + +qemu 3.1/i386 crashes/guest hangs when MTTCG is enabled + +When MTTCG is enabled, QEMU 3.1.0 sometimes crashes when running the following command line: + +qemu-system-i386 -kernel /home/jermar/Kernkonzept/software/l4/.build-i386/bin/x86_gen/bootstrap -append bootstrap -initrd "/home/jermar/work/software/l4/fiasco/.build-i386/fiasco -serial_esc,/home/jermar/Kernkonzept/software/l4/.build-i386/bin/x86_gen/l4f/sigma0 ,/home/jermar/Kernkonzept/software/l4/.build-i386/bin/x86_gen/l4f/moe rom/ahci.cfg,/home/jermar/Kernkonzept/software/l4/.build-i386/bin/x86_gen/l4f/ned ,test_env.lua ,/home/jermar/Kernkonzept/software/l4/pkg/ahci-driver/examples/md5sum/ahci.cfg ,/home/jermar/Kernkonzept/software/l4/.build-i386/bin/x86_gen/l4f/l4re ,/home/jermar/Kernkonzept/software/l4/pkg/ahci-driver/examples/md5sum/ahci.io ,/home/jermar/Kernkonzept/software/l4/.build-i386/bin/x86_gen/l4f/io ,/home/jermar/Kernkonzept/software/l4/.build-i386/bin/x86_gen/l4f/ahci-drv ,/home/jermar/Kernkonzept/software/l4/.build-i386/bin/x86_gen/l4f/ahci-md5-sync" -smp 4 -accel tcg,thread=multi -device ahci,id=ahci0 -drive if=none,file=/home/jermar/Kernkonzept/software/l4/.build-i386/pkg/ahci-driver/test/examples/test_ahci.img,format=raw,id=drive-sata0-0-0 -device ide-drive,bus=ahci0.0,drive=drive-sata0-0-0,id=sata0-0-0 -serial stdio -nographic -monitor none + +The host is x86_64. + +The stack at the time of the crash (core dump and debug binary linked below[1]): + +Core was generated by `qemu-system-i386 -kernel /home/jermar/Kernkonzept/software/l4/.build-i386/bin/x'. +Program terminated with signal SIGSEGV, Segmentation fault. +#0 io_writex (env=env@entry=0x565355ca0140, iotlbentry=iotlbentry@entry=0x565355ca9120, mmu_idx=2, val=val@entry=0, addr=addr@entry=3938451632, retaddr=retaddr@entry=140487132809203, recheck=false, size=4) + at /home/jermar/software/HelenOS/helenos.git/contrib/qemu/qemu-3.1.0/accel/tcg/cputlb.c:791 +791 if (mr->global_locking && !qemu_mutex_iothread_locked()) { +[Current thread is 1 (Thread 0x7fc5af7fe700 (LWP 3625719))] +Missing separate debuginfos, use: dnf debuginfo-install SDL2-2.0.9-1.fc29.x86_64 at-spi2-atk-2.30.0-1.fc29.x86_64 at-spi2-core-2.30.0-2.fc29.x86_64 atk-2.30.0-1.fc29.x86_64 bzip2-libs-1.0.6-28.fc29.x86_64 cairo4 +(gdb) bt +#0 0x0000565354f5f365 in io_writex + (env=env@entry=0x565355ca0140, iotlbentry=iotlbentry@entry=0x565355ca9120, mmu_idx=2, val=val@entry=0, addr=addr@entry=3938451632, retaddr=retaddr@entry=140487132809203, recheck=false, size=4) + at /home/jermar/software/HelenOS/helenos.git/contrib/qemu/qemu-3.1.0/accel/tcg/cputlb.c:791 +#1 0x0000565354f621b2 in io_writel (recheck=<optimized out>, retaddr=140487132809203, addr=3938451632, val=0, index=0, mmu_idx=2, env=0x565355ca0140) + at /home/jermar/software/HelenOS/helenos.git/contrib/qemu/qemu-3.1.0/accel/tcg/softmmu_template.h:310 +#2 0x0000565354f621b2 in helper_le_stl_mmu (env=0x565355ca0140, addr=<optimized out>, val=0, oi=34, retaddr=140487132809203) + at /home/jermar/software/HelenOS/helenos.git/contrib/qemu/qemu-3.1.0/accel/tcg/softmmu_template.h:310 +#3 0x00007fc5b5a587f3 in code_gen_buffer () +#4 0x0000565354f75fd0 in cpu_tb_exec (itb=<optimized out>, cpu=0x7fc5b5a5aa40 <code_gen_buffer+12266006>) at /home/jermar/software/HelenOS/helenos.git/contrib/qemu/qemu-3.1.0/accel/tcg/cpu-exec.c:171 +#5 0x0000565354f75fd0 in cpu_loop_exec_tb (tb_exit=<synthetic pointer>, last_tb=<synthetic pointer>, tb=<optimized out>, cpu=0x7fc5b5a5aa40 <code_gen_buffer+12266006>) + at /home/jermar/software/HelenOS/helenos.git/contrib/qemu/qemu-3.1.0/accel/tcg/cpu-exec.c:615 +#6 0x0000565354f75fd0 in cpu_exec (cpu=cpu@entry=0x565355c97e90) at /home/jermar/software/HelenOS/helenos.git/contrib/qemu/qemu-3.1.0/accel/tcg/cpu-exec.c:725 +#7 0x0000565354f33b1f in tcg_cpu_exec (cpu=0x565355c97e90) at /home/jermar/software/HelenOS/helenos.git/contrib/qemu/qemu-3.1.0/cpus.c:1429 +#8 0x0000565354f35e83 in qemu_tcg_cpu_thread_fn (arg=0x565355c97e90) at /home/jermar/software/HelenOS/helenos.git/contrib/qemu/qemu-3.1.0/cpus.c:1733 +#9 0x0000565354f35e83 in qemu_tcg_cpu_thread_fn (arg=arg@entry=0x565355c97e90) at /home/jermar/software/HelenOS/helenos.git/contrib/qemu/qemu-3.1.0/cpus.c:1707 +#10 0x00005653552ec5da in qemu_thread_start (args=<optimized out>) at util/qemu-thread-posix.c:498 +#11 0x00007fc5b858a58e in start_thread () at /lib64/libpthread.so.0 +#12 0x00007fc5b84b96a3 in clone () at /lib64/libc.so.6 + +Another symptom that occurs more often than this crash is that the guest hangs while waiting for another CPU to complete a cross-CPU call. Disabling MTTCG makes both symptoms go away. + +[1] Core file + debug binary: http://jermar.eu/ref/qemu-mttcg-core.tar.xz \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1813201 b/results/classifier/mode-deepseek-r1:32b/output/system/1813201 new file mode 100644 index 00000000..a999588d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1813201 @@ -0,0 +1,57 @@ + + +QEMU TCG i386 / x86_64 system emulation crash when executing int instruction + +QEMU version: +------------- + +qemu from git, master branch commit d058a37a6e8daa8d71a6f2b613eb415b69363755 + +Release versions are also affected. + +Summary: +-------- + +QEMU i386 and x86_64 system emulation crash when executing the following "int" instruction: + +cd08 int 8 + +This generates a kernel NULL pointer dereference error in Linux, and a BSOD error in Windows. + +No special permissions are required to execute the instruction, any unprivileged user can execute it. + +This issue has been reproduced in QEMU running in TCG mode. KVM is not affected. + +Kernel panic log: + +[ 111.091138] BUG: unable to handle kernel NULL pointer dereference at 00000014 +[ 111.092145] IP: [<ce0513ad>] doublefault_fn+0xd/0x130 +[ 111.092145] *pdpt = 0000000000000000 *pde = f000ff53f000ff53 [ 111.092145] +[ 111.092145] Oops: 0000 [#1] SMP +[ 111.092145] Modules linked in: kvm_amd bochs_drm ppdev ttm drm_kms_helper drm kvm irqbypass evdev pcspkr serio_raw sg parport_pc parport button ip_tables x_tables autofs4 ext4 crc16 jbd2 crc32c_generic fscrypto ecb xts lrw gf128mul ablk_helper cryptd aes_i586 mbcache sr_mod sd_mod cdrom ata_generic ata_piix libata psmouse e1000 scsi_mod i2c_piix4 floppy +[ 111.092145] CPU: 0 PID: 409 Comm: int8.elf Not tainted 4.9.0-8-686-pae #1 Debian 4.9.130-2 +[ 111.092145] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-0-ga698c8995f-prebuilt.qemu.org 04/01/2014 +[ 111.092145] task: f6c88a80 task.stack: f6e52000 +[ 111.092145] EIP: 0060:[<ce0513ad>] EFLAGS: 00004086 CPU: 0 +[ 111.092145] EIP is at doublefault_fn+0xd/0x130 +[ 111.092145] EAX: 00000000 EBX: 00000000 ECX: 00000000 EDX: 00000000 +[ 111.092145] ESI: 00000000 EDI: 00000000 EBP: ce8f13fc ESP: ce8f13d4 +[ 111.092145] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 +[ 111.092145] CR0: 8005003b CR2: 00000014 CR3: 0e8e1000 CR4: 000006f0 +[ 111.092145] Stack: +[ 111.092145] 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 +[ 111.092145] 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 +[ 111.092145] 00000000 00000000 00000000 00000000 fed00000 ce474ad0 00000000 00017d78 +[ 111.092145] Call Trace: +[ 111.092145] Code: 86 fd ff eb a3 89 f6 8d bc 27 00 00 00 00 55 89 e5 3e 8d 74 26 00 5d e9 e2 79 fd ff 66 90 55 89 e5 56 53 83 ec 20 3e 8d 74 26 00 <65> a1 14 00 00 00 89 45 f4 31 c0 31 c0 c7 45 f0 00 00 00 00 66 +[ 111.092145] EIP: [<ce0513ad>] [ 111.092145] doublefault_fn+0xd/0x130 +[ 111.092145] SS:ESP 0068:ce8f13d4 +[ 111.092145] CR2: 0000000000000014 +[ 111.092145] ---[ end trace 8afa7884b76cafc1 ]--- + +Testcase: +--------- + +void main() { + asm("int $0x8"); +} \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1813305 b/results/classifier/mode-deepseek-r1:32b/output/system/1813305 new file mode 100644 index 00000000..4bbad09a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1813305 @@ -0,0 +1,19 @@ + + +trace-root.h is not regerenerated after re-configure + +Hi, + +I've just realized that after I reconfigured my qemu with +../configure --target-list=arm-softmmu,arm-linux-user,aarch64-softmmu,aarch64-linux-user --enable-trace-backends=simple + +$ make +did rebuild some stuff for the 'simple' trace, but it did not update trace-root.h until after I +$ make clean + + +I took me while to understand why I didn't get the traces I wanted (my trace-root.h still thought it was configured for the default 'log'). + +I didn't check how easy it is to fix this in the build system. + +Thanks \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1813460 b/results/classifier/mode-deepseek-r1:32b/output/system/1813460 new file mode 100644 index 00000000..af3d75a3 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1813460 @@ -0,0 +1,13 @@ + + +qemu/target/arm/translate-a64.c:2039: bad test ? + +qemu/target/arm/translate-a64.c:2039]: (warning) Logical disjunction always evaluates to true: op3 != 2 || op3 != 3. + +Source code is + + if (op3 != 2 || op3 != 3) { + +Maybe better code + + if (op3 != 2 && op3 != 3) { \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1814381 b/results/classifier/mode-deepseek-r1:32b/output/system/1814381 new file mode 100644 index 00000000..0512cebf --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1814381 @@ -0,0 +1,27 @@ + + +qemu can't resolve ::1 when no network is available + +I'm not sure if this is a qemu thing or a getaddrinfo/glibc thing, or +even just something about my laptop. However we have a test failure +in nbdkit which only occurs when my laptop is not connected to wifi or +other networking. It boils down to: + + $ qemu-img info --image-opts "file.driver=nbd,file.host=::1,file.port=1234" + qemu-img: Could not open 'file.driver=nbd,file.host=::1,file.port=1234': addre +ss resolution failed for ::1:1234: Address family for hostname not supported + +In a successful case it should connect to a local NBD server on port +1234, but if you don't have that you will see: + + qemu-img: Could not open 'file.driver=nbd,file.host=::1,file.port=1234': Faile +d to connect socket: Connection refused + +I can ‘ping6 ::1’ fine. + +It also works if I replace ‘::1’ with ‘localhost6’. + +My /etc/hosts contains: + +127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 +::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1815143 b/results/classifier/mode-deepseek-r1:32b/output/system/1815143 new file mode 100644 index 00000000..06403ff7 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1815143 @@ -0,0 +1,87 @@ + + + qemu-system-s390x fails when running without kvm: fatal: EXECUTE on instruction prefix 0x7f4 not implemented + +just wondering if TCG implements instruction prefix 0x7f4 + +server3:~ # zcat /boot/vmlinux-4.4.162-94.72-default.gz > /tmp/kernel + +--> starting qemu with kvm enabled works fine +server3:~ # qemu-system-s390x -nographic -kernel /tmp/kernel -initrd /boot/initrd -enable-kvm +Initializing cgroup subsys cpuset +Initializing cgroup subsys cpu +Initializing cgroup subsys cpuacct +Linux version 4.4.162-94.72-default (geeko@buildhost) (gcc version 4.8.5 (SUSE Linux) ) #1 SMP Mon Nov 12 18:57:45 UTC 2018 (9de753f) +setup.289988: Linux is running under KVM in 64-bit mode +setup.b050d0: The maximum memory size is 128MB +numa.196305: NUMA mode: plain +Write protected kernel read-only data: 8692k +[...] + +--> but starting qemu without kvm enabled works fails +server3:~ # qemu-system-s390x -nographic -kernel /tmp/kernel -initrd /boot/initrd +qemu: fatal: EXECUTE on instruction prefix 0x7f4 not implemented + +PSW=mask 0000000180000000 addr 000000000067ed6e cc 00 +R00=0000000080000000 R01=000000000067ed76 R02=0000000000000000 R03=0000000000000000 +R04=0000000000111548 R05=0000000000000000 R06=0000000000000000 R07=0000000000000000 +R08=00000000000100f6 R09=0000000000000000 R10=0000000000000000 R11=0000000000000000 +R12=0000000000ae2000 R13=0000000000681978 R14=0000000000111548 R15=000000000000bef0 +F00=0000000000000000 F01=0000000000000000 F02=0000000000000000 F03=0000000000000000 +F04=0000000000000000 F05=0000000000000000 F06=0000000000000000 F07=0000000000000000 +F08=0000000000000000 F09=0000000000000000 F10=0000000000000000 F11=0000000000000000 +F12=0000000000000000 F13=0000000000000000 F14=0000000000000000 F15=0000000000000000 +V00=00000000000000000000000000000000 V01=00000000000000000000000000000000 +V02=00000000000000000000000000000000 V03=00000000000000000000000000000000 +V04=00000000000000000000000000000000 V05=00000000000000000000000000000000 +V06=00000000000000000000000000000000 V07=00000000000000000000000000000000 +V08=00000000000000000000000000000000 V09=00000000000000000000000000000000 +V10=00000000000000000000000000000000 V11=00000000000000000000000000000000 +V12=00000000000000000000000000000000 V13=00000000000000000000000000000000 +V14=00000000000000000000000000000000 V15=00000000000000000000000000000000 +V16=00000000000000000000000000000000 V17=00000000000000000000000000000000 +V18=00000000000000000000000000000000 V19=00000000000000000000000000000000 +V20=00000000000000000000000000000000 V21=00000000000000000000000000000000 +V22=00000000000000000000000000000000 V23=00000000000000000000000000000000 +V24=00000000000000000000000000000000 V25=00000000000000000000000000000000 +V26=00000000000000000000000000000000 V27=00000000000000000000000000000000 +V28=00000000000000000000000000000000 V29=00000000000000000000000000000000 +V30=00000000000000000000000000000000 V31=00000000000000000000000000000000 +C00=0000000000000000 C01=0000000000000000 C02=0000000000000000 C03=0000000000000000 +C04=0000000000000000 C05=0000000000000000 C06=0000000000000000 C07=0000000000000000 +C08=0000000000000000 C09=0000000000000000 C10=0000000000000000 C11=0000000000000000 +C12=0000000000000000 C13=0000000000000000 C14=0000000000000000 C15=0000000000000000 + +Aborted (core dumped) + + +server3:~ # lscpu +Architecture: s390x +CPU op-mode(s): 32-bit, 64-bit +Byte Order: Big Endian +CPU(s): 2 +On-line CPU(s) list: 0,1 +Thread(s) per core: 1 +Core(s) per socket: 1 +Socket(s) per book: 1 +Book(s) per drawer: 1 +Drawer(s): 2 +NUMA node(s): 1 +Vendor ID: IBM/S390 +Machine type: 2964 +BogoMIPS: 20325.00 +Hypervisor: z/VM 6.4.0 +Hypervisor vendor: IBM +Virtualization type: full +Dispatching mode: horizontal +L1d cache: 128K +L1i cache: 96K +L2d cache: 2048K +L2i cache: 2048K +L3 cache: 65536K +L4 cache: 491520K +NUMA node0 CPU(s): 0-63 +Flags: esan3 zarch stfle msa ldisp eimm dfp edat etf3eh highgprs te vx sie +server3:~ # uname -a +Linux server3 4.4.126-94.22-default #1 SMP Wed Apr 11 07:45:03 UTC 2018 (9649989) s390x s390x s390x GNU/Linux +server3:~ # \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1815423 b/results/classifier/mode-deepseek-r1:32b/output/system/1815423 new file mode 100644 index 00000000..258a5496 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1815423 @@ -0,0 +1,66 @@ + + +x86_64 TCG: Incorrect floating point cast to int. + +I used exaample from: +https://stackoverflow.com/questions/3986795/what-is-the-result-of-casting-float-inf-inf-and-nan-to-integer-in-c + +#include <stdio.h> +#include <math.h> + +int main(int argc, char** argv) { + float a = INFINITY; + float b = -INFINITY; + float c = NAN; + + printf("float %f %f %f\n", a, b, c); + printf("int %d %d %d\n", (int) a, (int) b, (int) c); + printf("uint %u %u %u\n", (unsigned int) a, (unsigned int) b, (unsigned int) c); + printf("lint %ld %ld %ld\n", (long int) a, (long int) b, (long int) b); + printf("luint %lu %lu %lu\n", (unsigned long int) a, (unsigned long int) b, (unsigned long int) c); + + return 0; +} + +And got different results on real computer and on qemu. + +output from real HW is the same as on stackoverflow: + +$ gcc test.c && ./a.out +float inf -inf nan +int -2147483648 -2147483648 -2147483648 +uint 0 0 0 +lint -9223372036854775808 -9223372036854775808 -9223372036854775808 +luint 0 9223372036854775808 9223372036854775808 + + +But on qemu I got another results: + +float inf -inf nan +int 2147483647 -2147483648 2147483647 +uint 4294967295 0 4294967295 +lint 9223372036854775807 -9223372036854775808 -9223372036854775808 +luint 18446744073709551615 9223372036854775808 9223372036854775807 + +qemu launch string: +/qemu-system-x86_64 -m 1024 -cpu core2duo -serial stdio -netdev user,id=network0 -device e1000,netdev=network0 -kernel my_kernel + + +qemu version: +x86_64-softmmu/qemu-system-x86_64 --version +QEMU emulator version 3.1.50 (v3.1.0-1676-ge47f81b617-dirty) +Copyright (c) 2003-2019 Fabrice Bellard and the QEMU Project developers + + +This bug affect some javascript (surprise) calculations: + +var conversion = "01234567890"; +var x; +var result = conversion[x & 42]; +console.log(result) + + +In example, var x is "undefined" +and when do calculation "x & 42" on js we should get 0 (it is documented feature), but actually got "42" + +and "result" sould be "0" but actually we got "undefined" \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1815911 b/results/classifier/mode-deepseek-r1:32b/output/system/1815911 new file mode 100644 index 00000000..cda089af --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1815911 @@ -0,0 +1,21 @@ + + +aptitude crashes qemu-m68k with handle_cpu_signal received signal outside vCPU context + +When building a package with sbuild on Debian, sbuild can use aptitude to resolve dependencies. + +Recently, some changes introduced to aptitude or related packages cause qemu to crash: + +(sid-m68k-sbuild)root@nofan:/# aptitude -y --without-recommends -o Dpkg::Options::=--force-confold -o Aptitude::CmdLine::Ignore-Trust-Violations=false -o Aptitude::ProblemResolver::StepScore=100 -o Aptitude::ProblemResolver::SolutionCost="safety, priority, non-default-versions" -o Aptitude::ProblemResolver::Hints::KeepDummy="reject sbuild-build-depends-core-dummy :UNINST" -o Aptitude::ProblemResolver::Keep-All-Level=55000 -o Aptitude::ProblemResolver::Remove-Essential-Level=maximum install vim +Warning: Invalid locale (please review locale settings, this might lead to problems later): + locale::facet::_S_create_c_locale name not valid +The following NEW packages will be installed: + libgpm2{a} vim vim-common{a} vim-runtime{a} xxd{a} +0 packages upgraded, 5 newly installed, 0 to remove and 1 not upgraded. +Need to get 7225 kB/7260 kB of archives. After unpacking 33.5 MB will be used. +qemu:handle_cpu_signal received signal outside vCPU context @ pc=0x6019d1bf +qemu:handle_cpu_signal received signal outside vCPU context @ pc=0x601b64ab +Segmentation fault +(sid-m68k-sbuild)root@nofan:/# + +The crash does not reproduce on real hardware running Debian unstable. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1817239 b/results/classifier/mode-deepseek-r1:32b/output/system/1817239 new file mode 100644 index 00000000..f79202bb --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1817239 @@ -0,0 +1,52 @@ + + +add '--targets' option to qemu-binfmt-conf.sh + +I'd like to ask for the addition of option '--targets' to scripts/qemu-binfmt-conf.sh, in order to allow registering the interpreters for the given list of architectures only, instead of using all of the ones defined in qemu_target_list. The following is a possible patch that implements it: + + qemu-binfmt-conf.sh | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/qemu-binfmt-conf.sh b/qemu-binfmt-conf.sh +index b5a1674..be4a19b 100644 +--- a/qemu-binfmt-conf.sh ++++ b/qemu-binfmt-conf.sh +@@ -170,6 +170,7 @@ usage() { + Usage: qemu-binfmt-conf.sh [--qemu-path PATH][--debian][--systemd CPU] + [--help][--credential yes|no][--exportdir PATH] + [--persistent yes|no][--qemu-suffix SUFFIX] ++ [--targets TARGETS] + + Configure binfmt_misc to use qemu interpreter + +@@ -189,6 +190,8 @@ Usage: qemu-binfmt-conf.sh [--qemu-path PATH][--debian][--systemd CPU] + --persistent: if yes, the interpreter is loaded when binfmt is + configured and remains in memory. All future uses + are cloned from the open file. ++ --targets: comma-separated list of targets. If provided, only ++ the targets in the list are registered. + + To import templates with update-binfmts, use : + +@@ -324,7 +327,7 @@ CREDENTIAL=no + PERSISTENT=no + QEMU_SUFFIX="" + +-options=$(getopt -o ds:Q:S:e:hc:p: -l debian,systemd:,qemu-path:,qemu-suffix:,exportdir:,help,credential:,persistent: -- "$@") ++options=$(getopt -o ds:Q:S:e:hc:p:t: -l debian,systemd:,qemu-path:,qemu-suffix:,exportdir:,help,credential:,persistent:,targets: -- "$@") + eval set -- "$options" + + while true ; do +@@ -380,6 +383,10 @@ while true ; do + shift + PERSISTENT="$1" + ;; ++ -t|--targets) ++ shift ++ qemu_target_list="$(echo "$1" | tr ',' ' ')" ++ ;; + *) + break + ;; +-- +2.20.1 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1817846 b/results/classifier/mode-deepseek-r1:32b/output/system/1817846 new file mode 100644 index 00000000..6f4ffec1 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1817846 @@ -0,0 +1,48 @@ + + +Qemu 3.1 Aarch64 TLBI VAE1, x0 + +Hello, + +In my code I'm trying to remove some permissions to a 4KiB MMU descriptor. After that I invalidate the MMU with + +TLBI VAE1, x0 + +where x0 is the start of the address of the 4 KiB page. + +In Qemu 2.12 this did not work, but I worked around it with: + + + /* invalidate the address */ + TLBI VAE1, x0 + + + /*****************************************************************/ + /*****************************************************************/ + /* NOTE: THIS IS A TRICK FOR QEMU!!!!!!!!!!!! */ + /* Apparently we have to change the TTBR0_EL1 when we change a descriptor (especially to remove permissions) */ + /* Otherwise qemu (2.12) will continue with the same descriptor with permissions! **/ + /*****************************************************************/ + /*****************************************************************/ + + /* do a trick (in qemu) */ + mrs x1 , TTBR0_EL1 + + ldr x2 , =kernelTable0Table + + msr TTBR0_EL1 , x2 + + isb + + msr TTBR0_EL1 , x1 + + /* return from function */ + ret + + +That is, I just replaced the TTBR0_EL1 with a temporary value, and then restored it. (guess qemu 2.12 just needed to reload the values again). + +However, even this procedure is not working with qemu 3.1. (I just tested again with qemu 2.12 and the code works fine, with qemu 3.1 it does not). + +Thanks, +Pharos team \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1820 b/results/classifier/mode-deepseek-r1:32b/output/system/1820 new file mode 100644 index 00000000..4795771d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1820 @@ -0,0 +1,12 @@ + + +whpx is slower than tcg +Description of problem: +I find whpx much slower than tcg, which is rather odd. +Steps to reproduce: +1. Enable Hyper-V +2. run qemu with **-accel whpx,kernel-irqchip=off** +Additional information: +my cpu: intel i7 6500u +memory: 8go +my gpu: intel graphics 520 hd diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1820686 b/results/classifier/mode-deepseek-r1:32b/output/system/1820686 new file mode 100644 index 00000000..4f823b4f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1820686 @@ -0,0 +1,7 @@ + + +risc-v: 'c.unimp' instruction decoded as 'c.addi4spn fp, 0' + +QEMU 3.1 incorrectly decodes the "c.unimp" instruction (opcode 0x0000) as an "addi4spn fp, 0" when either of the two following bytes are non-zero. This is because the ctx->opcode value used when decoding the instruction is actually filled with a 32-bit load (to handle normal uncompressed instructions) but when a compressed instruction is found only the low 16 bits are valid. Other reserved/illegal bit patterns with the addi4spn opcode are also incorrectly decoded. + +I believe that the switch to decodetree on master happened to fix this issue, but hopefully it is helpful to have this recorded somewhere. I've included a simple one line patch if anyone wants to backport this. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1822 b/results/classifier/mode-deepseek-r1:32b/output/system/1822 new file mode 100644 index 00000000..04200ba3 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1822 @@ -0,0 +1,9 @@ + + +Signed source tarball for 8.0.4 missing +Description of problem: +Hi! I package this project for Arch Linux. I would like to upgrade to 8.0.4, but unfortunately there is no signed source tarball for that version available yet. +Steps to reproduce: +1. Go to https://download.qemu.org/ and find no source tarball for 8.0.4 +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1823 b/results/classifier/mode-deepseek-r1:32b/output/system/1823 new file mode 100644 index 00000000..5dd02c72 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1823 @@ -0,0 +1,13 @@ + + +qemu-system-riscv64 Property 'virt-machine.aclint' not found +Description of problem: + +Steps to reproduce: +1. run ./qemu-system-riscv64 -M virt,aclint=on +2. command output: +``` +qemu-system-riscv64: Property 'virt-machine.aclint' not found +``` +Additional information: +The aclint property is registered in the virt_machine_class_init function and depends on the condition tcg_enabled(), but the initialization of tcg_enabled() is later than the call of virt_machine_class_init. This caused the aclint property to never be registered. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1823169 b/results/classifier/mode-deepseek-r1:32b/output/system/1823169 new file mode 100644 index 00000000..6adad33f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1823169 @@ -0,0 +1,7 @@ + + +qemu displays message "Setup failed, please check external storage is available and has enough room." + +I tried to launch the Android app PokerStarsFR, and after it began initialization, the launch failed with the above error. I'm running qemu on a Dell XPS 13 (9370) laptop running Ubuntu 16.04 LTS. The standard apps launch OK, but this one does not. I had downloaded it from the PokerStars site https://www.pokerstars.fr/en/poker/download/android/. + +I am running qemu version 2.5.0 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1823790 b/results/classifier/mode-deepseek-r1:32b/output/system/1823790 new file mode 100644 index 00000000..fced173a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1823790 @@ -0,0 +1,23 @@ + + +QEMU mishandling of SO_PEERSEC forces systemd into tight loop + +While building Debian images for embedded ARM target systems I detected that QEMU seems to force newer systemd daemons into a tight loop. + +My setup is the following: + +Host machine: Ubuntu 18.04, amd64 +LXD container: Debian Buster, arm64, systemd 241 +QEMU: qemu-aarch64-static, 4.0.0-rc2 (custom build) and 3.1.0 (Debian 1:3.1+dfsg-7) + +To easily reproduce the issue I have created the following repository: +https://github.com/lueschem/edi-qemu + +The call where systemd gets looping is the following: +2837 getsockopt(3,1,31,274891889456,274887218756,274888927920) = -1 errno=34 (Numerical result out of range) + +Furthermore I also verified that the issue is not related to LXD. +The same behavior can be reproduced using systemd-nspawn. + +This issue reported against systemd seems to be related: +https://github.com/systemd/systemd/issues/11557 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1824853 b/results/classifier/mode-deepseek-r1:32b/output/system/1824853 new file mode 100644 index 00000000..33c23c12 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1824853 @@ -0,0 +1,52 @@ + + +4.0.0-rc3 crashes with tcg/tcg.c:3952: tcg_gen_code: Assertion `s->gen_insn_end_off[num_insns] == off' failed + +I tried to bootstrap and regtested gcc trunk (gcc svn rev 270278, datestamp 20190411) inside my arm64-gentoo installation under qemu-system-aarch64. + +Qemu version was 4.0.0-rc3 and -cpu cortex-a57. Qemu configured with only --target-list=aarch64-softmmu,aarch64-linux-user and compiled using gcc "version 5.5.0 20171010 (Ubuntu 5.5.0-12ubuntu1~16.04)". + +Executable created from gcc/testsuite/gcc.target/aarch64/advsimd-intrinsics/vldX.c compiled with -O2 crashed the whole qemu-system. + +To investigate a bit I also manually run +~/gcc/inst/trunk/bin/gcc ~/gcc/src/trunk/gcc/testsuite/gcc.target/aarch64/advsimd-intrinsics/vldX.c +with different options like: +-O0 -lm -o d0.exe +-O1 -lm -o d1.exe +-O2 -lm -o d2.exe +-O0 -static -lm -o s0.exe +-O1 -static -lm -o s1.exe +-O2 -static -lm -o s2.exe + +So, now I have 6 different arm64 executables created with different optimization levels. O0 and O1 versions run ok. +Three sN.exe static executables I've also tried in qemu user mode (with same -cpu), no issue in user mode. + +And inside qemu-system I can see that +running "d2.exe" (attached) gives: +tcg/tcg.c:3952: tcg_gen_code: Assertion `s->gen_insn_end_off[num_insns] == off' failed. + +And running "s2.exe" gives: +tcg/tcg.c:320: set_jmp_reset_offset: Assertion `s->tb_jmp_reset_offset[which] == off' failed. + +It seems like this test is an counter-example for logic that "tcg_ctx->nb_ops < 4000" implies tcg will fit into 16-bit signed size (see tcg_op_buf_full comments). + +Richard's changes in abebf92597186 and 9f754620651d were not enough, translation block must be smaller, or we have to find some proper way to bail out when buffer overflows. +I don't know why this situation is not caught by code_gen_highwater logic in tcg.c + +I've also tried this "bail out" patch + +diff --git a/tcg/tcg.c b/tcg/tcg.c +--- a/tcg/tcg.c ++++ b/tcg/tcg.c +@@ -3949,7 +3949,8 @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb) + size_t off = tcg_current_code_size(s); + s->gen_insn_end_off[num_insns] = off; + /* Assert that we do not overflow our stored offset. */ +- assert(s->gen_insn_end_off[num_insns] == off); ++ if (s->gen_insn_end_off[num_insns] != off) ++ return -1; + } + num_insns++; + for (i = 0; i < TARGET_INSN_START_WORDS; ++i) { + +But then running "d2.exe" just hangs the whole qemu-system. It seems that when tcg_gen_code return -1 (like in highwater logic mentioned before), we just re-call it again and again. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1825311 b/results/classifier/mode-deepseek-r1:32b/output/system/1825311 new file mode 100644 index 00000000..08b05686 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1825311 @@ -0,0 +1,5 @@ + + +mips_cpu_handle_mmu_fault renders all accessed pages executable + +On MIPS, data accesses to pages mapped in the TLB result in mips_cpu_handle_mmu_fault() marking the page unconditionally executable, even if the TLB entry has the XI bit set. Later on, when there is an attempt to execute this page, no exception is generated, even though TLBXI is expected. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1825359 b/results/classifier/mode-deepseek-r1:32b/output/system/1825359 new file mode 100644 index 00000000..1edf0c27 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1825359 @@ -0,0 +1,80 @@ + + +cpu_ld*_code() triggers MMU_DATA_LOAD i.s.o. MMU_INST_FETCH + +commit 377b155bde451d5ac545fbdcdfbf6ca17a4228f5 +Merge: c876180938 328eb60dc1 +Author: Peter Maydell <peter.x@x.x> ; masked for anti-spamming purposes +Date: Mon Mar 11 18:26:37 2019 +0000 +https://github.com/qemu/qemu/commit/377b155bde451d5ac545fbdcdfbf6ca17a4228f5 +-------------------------------------------------- + +cpu_ld*_code() is used for loading code data as the name suggests. Although, it begins +accessing memory with MMU_INST_FETCH access type, somewhere down the road, when the +"io_readx(..., access_type=MMU_INST_FETCH, ...)" is called, it is ignoring this "access_type" +while calling the "tlb_fill()" with a _hardcoded_ MMU_DATA_LOAD: + +cputlb.c +-------- +static uint64_t io_readx(..., MMUAccessType access_type, ...) +{ + + if (recheck) { + CPUTLBEntry *entry; + target_ulong tlb_addr; + + tlb_fill(cpu, addr, size, MMU_DATA_LOAD, mmu_idx, retaddr); + ... +} +-------- + +This is an issue, because there can exist _small_ regions of memory (smaller than the +TARGET_PAGE_SIZE) that are only executable and not readable. + +TL;DR + +What happens is at first, a "tlb_fill(..., access_type=MMU_INST_FETCH, ...)" is +triggered by "tb_lookup_cpu_state()". To be precise, this is the call stack which is good behavior: +--- +#0 tlb_fill (cs=..., vaddr=684, size=0, access_type=MMU_INST_FETCH, mmu_idx=0, retaddr=0) at target/arc/mmu.c:602 +#1 get_page_addr_code (env=..., addr=684) at accel/tcg/cputlb.c:1045 +#2 tb_htable_lookup (cpu=..., pc=684, cs_base=0, flags=0, cf_mask=4278190080) at accel/tcg/cpu-exec.c:337 +#3 tb_lookup__cpu_state (cpu=..., pc=..., cs_base=..., flags=..., cf_mask=4278190080) at include/exec/tb-lookup.h:43 +#4 tb_find (cpu=..., last_tb=... <code_gen_buffer+17811>, tb_exit=0, cf_mask=0) at accel/tcg/cpu-exec.c:404 +#5 cpu_exec (cpu=...) at accel/tcg/cpu-exec.c:729 +#6 tcg_cpu_exec (cpu=...) at cpus.c:1430 +#7 qemu_tcg_rr_cpu_thread_fn (arg=...) at cpus.c:1531 +#8 qemu_thread_start (args=...) at util/qemu-thread-posix.c:502 +--- + +After this call, TLB is filled with an entry that its size field is small, say 32 bytes. +This causes a TLB_RECHECK for consequent memory accesses, which is logical. However, +in our decoder, we use cpu_lduw_code() to read the instructions and decode them. As mentioned, +in the beginning, the access_type=MMU_INST_FETCH is lost in "io_readx()" while calling "tlb_fill()", +and now THIS CAUSES A GUEST EXCEPTION BECAUSE THAT REGION IS NOT ALLOWED TO BE READ. Here, +comes that trace call of the _bad_ behavior: +--- +#0 tlb_fill (..., access_type=MMU_DATA_LOAD, ...) at target/arc/mmu.c:605 +#1 io_readx (..., access_type=MMU_INST_FETCH, size=2) at accel/tcg/cputlb.c:881 +#2 io_readw (..., access_type=MMU_INST_FETCH) at accel/tcg/softmmu_template.h:106 +#3 helper_le_ldw_cmmu (..., oi=16, retaddr=0) at accel/tcg/softmmu_template.h:146 +#4 cpu_lduw_code_ra (env=..., ptr=684, retaddr=0) at include/exec/cpu_ldst_template.h:102 +#5 cpu_lduw_code (env=..., ptr=684) at include/exec/cpu_ldst_template.h:114 +#6 read_and_decode_context (ctx=..., opcode_p=...) at target/arc/arc-decoder.c:1479 +#7 arc_decode (ctx=...) at target/arc/arc-decoder.c:1736 +#8 decode_opc (env=..., ctx=...) at target/arc/translate.c:313 +#9 arc_tr_translate_insn (dcbase=..., cpu=...) at target/arc/translate.c:335 +#10 translator_loop (.. <code_gen_buffer+18131>) at accel/tcg/translator.c:107 +#11 gen_intermediate_code (cpu=..., tb=... <code_gen_buffer+18131>) at target/arc/translate.c:413 +#12 tb_gen_code (cpu=..., pc=684, cs_base=0, flags=0, cflags=-16711679) at accel/tcg/translate-all.c:1723 +#13 tb_find (cpu=..., last_tb=... <code_gen_buffer+17811>, tb_exit=0, cf_mask=0) at accel/tcg/cpu-exec.c:407 +#14 cpu_exec (cpu=...) at accel/tcg/cpu-exec.c:729 +#15 tcg_cpu_exec (cpu=...) at cpus.c:1430 + +--- + +Do you confirm if this is an issue? Maybe there are other ways to read an instruction with +MMU_INST_FETCH access that I don't know about. + +Last but not least, although this is not a security issue for QEMU per se, but it is hindering a +security feature for the guest. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1826 b/results/classifier/mode-deepseek-r1:32b/output/system/1826 new file mode 100644 index 00000000..21107929 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1826 @@ -0,0 +1,31 @@ + + +Segfault in memory_region_dispatch_write() +Description of problem: +Several possible outcomes +- Kernel freeze and rcu lockup messages. +- segfault + +For segfault, using gdb. +``` +in memory_region_dispatch_write (mr=mr@entry=0x130013001300013, addr=addr@entry=176, data=dat@entry=0, op=op@entry=M0_42, attrs=...) at ../../softwmmu/memory.c:1515 +1515 if (mr->alias) { + +in memory_region_dispatch_write( .. as above...) +in io_writex(env=env@entry=0x555556a84320, full=full@entry=0x7ffda010f630, mmu_idx=mmu_idx@entry=0, val=0, addr=addr@entry=18446744073699049648, retaddr=retaddr@entry=140736023420498, op=MO_32) at ../../accel/tcg/cputlb.c:1448 +in do_st_mmio_leN (env=env@entry=0x555556a84320, full=full@entry=0x7ffda010f630, val_le=<optmized out>, val_le@entry=0, addr=addr@entry=18446744073699049648, size=size@entry=4, mmu_idx=mmu_idx@entry=0, ra=140736023420498) at ../../accel/tcg/cputlb.c:2755 +in do_st_4 (ra=<optmized_out>, memop=<optimized out> mmu_idx=0, val=0, p=0x7ffff529c140, env=0x555556a84320) at ../../accel/tcg/cputbl.c:2921 +do_st4_mmu (env=0x555556a84320, addr=<optimized out> val=<optmized out>, oi=<otpmized out> ra=140736023420498) at ../../accel/tcg/cputlb.c:3006 +in code_gen_buffer() +in cpu_tb_exec(..) //getting lazy on typing as seems unlikely anything useful beyond here. +in cpu_loop_exec_tb() +cpu_exec_loop +in cpu_exec_setjmp() +in cpu_exec() +in tcg_cpus_exec() +``` +Steps to reproduce: +1. Boot. +2. Use gdb to grab back trace after segfault. +Additional information: +Seems to segfault mid way through PCI enumeration in the kernel. Which device seems to vary between runs. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1827 b/results/classifier/mode-deepseek-r1:32b/output/system/1827 new file mode 100644 index 00000000..446e011b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1827 @@ -0,0 +1,3 @@ + + +Turn DPRINTF macro use into tracepoints diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1827871 b/results/classifier/mode-deepseek-r1:32b/output/system/1827871 new file mode 100644 index 00000000..ba319943 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1827871 @@ -0,0 +1,45 @@ + + +Race condition when rebooting with the TCG backend + +Reporting this as present in QEMU 3.1.0, although I don't see any commit in current git master (a6ae23831b05a11880b40f7d58e332c45a6b04f7) that would suggest this issue is fixed. + + $ uname -a + Linux boole 4.19.0-4-686-pae #1 SMP Debian 4.19.28-2 (2019-03-15) i686 GNU/Linux + $ qemu -version + QEMU emulator version 3.1.0 (Debian 1:3.1+dfsg-7) + Copyright (c) 2003-2018 Fabrice Bellard and the QEMU Project developers + +Here's an excerpt from the code which handles reboot requests in SeaBIOS 1.12, located in src/fw/shadow.c: + + // Request a QEMU system reset. Do the reset in this function as + // the BIOS code was overwritten above and not all BIOS + // functionality may be available. + + // Attempt PCI style reset + outb(0x02, PORT_PCI_REBOOT); + outb(0x06, PORT_PCI_REBOOT); + + // Next try triple faulting the CPU to force a reset + asm volatile("int3"); + +This compiles to the following: + + (qemu) x/10i 0xf1993 + 0x000f1993: b0 02 movb $2, %al + 0x000f1995: ee outb %al, %dx + 0x000f1996: b0 06 movb $6, %al + 0x000f1998: ee outb %al, %dx + 0x000f1999: cc int3 + 0x000f199a: 80 3d 0d 53 0f 00 08 cmpb $8, 0xf530d + 0x000f19a1: 75 52 jne 0xf19f5 + 0x000f19a3: a1 10 53 0f 00 movl 0xf5310, %eax + 0x000f19a8: 8b 15 14 53 0f 00 movl 0xf5314, %edx + 0x000f19ae: 89 c3 movl %eax, %ebx + +Now, with the TCG backend, upon reaching the second outb instruction, the thread executing JIT-ed opcodes invokes qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET). This signals another thread to reset the guest CPU registers to their initial state. However, the execution thread is *not* stopped, which means it will keep executing already-translated instructions in the TCG buffer. In particular, the bootstrap value of the EIP register will be overwritten. On my machine, this usually results in the guest CPU finding itself in real mode, CS base 0xffff0000, EIP 0x0000199e, which in real mode disassembles to this: + + (qemu) xp/1i 0xf199e + 0x000f199e: 0f 00 08 strw 0(%bx, %si) + +This instruction triggers a #UD exception, and given that SeaBIOS handles #UD by immediately returning, it manifests as the guest locking up with 100% CPU usage every other reboot. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1828867 b/results/classifier/mode-deepseek-r1:32b/output/system/1828867 new file mode 100644 index 00000000..f643d8c7 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1828867 @@ -0,0 +1,10 @@ + + +QEmu translation is incorrect when using REX in combination with LAHF/SAHF + +When translating code that is using LAHF and SAHF in combination with the REX prefix then qemu translates incorrectly. +These two instructions only ever use the AH register. Contrary to other instructions where if you use REX + high bit offsets then it'll pull in rsp and a few other registers. +On hardware the REX prefix doesn't effect behaviour of these instructions at all. +QEMU incorrectly selects RSP as the register of choice here due to this combination of REX + AH register usage. + +I've attached a patch that is super terrible just so I can work around the issue locally and to sort of show off how it is to be "fixed" \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1829682 b/results/classifier/mode-deepseek-r1:32b/output/system/1829682 new file mode 100644 index 00000000..fc321bd0 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1829682 @@ -0,0 +1,155 @@ + + +QEMU PPC SYSTEM regression - 3.1.0 and GIT - Fail to boot AIX + +Built from source on a debian system + +Linux db08 4.9.0-8-amd64 #1 SMP Debian 4.9.130-2 (2018-10-27) x86_64 GNU/Linux +gcc version 6.3.0 20170516 (Debian 6.3.0-18+deb9u1) + +Last git commit (from queued gdibson repository) + +starting AIX 7.2 TL 2 SP 2 with the following : (the install was done under qemu 3.1.0) + +qemu-system-ppc64 -M pseries \ + -cpu power7 \ + -cdrom AIX_v7.2_Install_7200-02-02-1806_DVD_1_of_2_32018.iso \ + -net nic \ + -net tap,ifname=tap2,script=no \ + -drive file=DISK1.IMG,if=none,id=drive-virtio-disk0 \ + -device virtio-scsi-pci,id=scsi -device scsi-hd,drive=drive-virtio-disk0 \ + -m 4G \ + -serial stdio \ + -monitor unix:ms,server,nowait \ + -accel tcg \ + -k fr \ + -nographic \ + -prom-env input-device=/vdevice/vty@71000000 \ + -prom-env output-device=/vdevice/vty@71000000 \ + -prom-env diag-switch?=false \ + -prom-env boot-command="boot /pci@800000020000000/scsi@2/disk@100000000000000 -s verbose" + +Yields this : + + +^M +SLOF^[[0m^[[?25l **********************************************************************^M +^[[1mQEMU Starting^M +^[[0m Build Date = Jan 14 2019 18:00:39^M + FW Version = git-a5b428e1c1eae703^M + Press "s" to enter Open Firmware.^M^M +^M^M +^[[0m^[[?25hC0000^MC0100^MC0120^MC0140^MC0200^MC0240^MC0260^MC02E0^MC0300^MC0320^MC0340^MC0360^MC0370^MC0380^MC0371^MC0372^MC0373^MC0374^MC03F0^MC0400^MC0480^MC04C0^MC04D0^MC0500^MPopulating /vdevice methods^M +Populating /vdevice/vty@71000000^M +Populating /vdevice/nvram@71000001^M +Populating /vdevice/l-lan@71000002^M +Populating /vdevice/v-scsi@71000003^M + SCSI: Looking for devices^M + 8200000000000000 CD-ROM : "QEMU QEMU CD-ROM 2.5+"^M +C05A0^MPopulating /pci@800000020000000^M + 00 0000 (D) : 1234 1111 qemu vga^M + 00 0800 (D) : 1033 0194 serial bus [ usb-xhci ]^M + 00 1000 (D) : 1af4 1004 virtio [ scsi ]^M +Populating /pci@800000020000000/scsi@2^M + SCSI: Looking for devices^M + 100000000000000 DISK : "QEMU QEMU HARDDISK 2.5+"^M +C0600^MC06C0^MC0700^MC0800^MC0880^MC0890^MC08A0^MC08A8^MInstalling QEMU fb^M +^M +^M +^M +C08B0^MScanning USB ^M + XHCI: Initializing^M + USB Keyboard ^M + USB mouse ^M +C08C0^MC08D0^MNo console specified using screen & keyboard^M +User selected input-device console: /vdevice/vty@71000000^M +User selected output-device console: /vdevice/vty@71000000^M +C08E0^MC08E8^MC08FF^M ^M + Welcome to Open Firmware^M +^M + Copyright (c) 2004, 2017 IBM Corporation All rights reserved.^M + This program and the accompanying materials are made available^M + under the terms of the BSD License available at^M + http://www.opensource.org/licenses/bsd-license.php^M +^M +^M +Trying to load: -s verbose from: /pci@800000020000000/scsi@2/disk@100000000000000 ... Successfully loaded^M +^M + ---> qemu,pseries detected <---^M +^M +^M +^M +^M +^M +^M +^M +-------------------------------------------------------------------------------^M + Welcome to AIX.^M + boot image timestamp: 05:56:13 04/20/2019^M + processor count: 1; memory size: 4096MB; kernel size: 38426884^M + boot device: /pci@800000020000000/scsi@2/disk@100000000000000^M +^M +8000FFEC bytes of free memory remain at address 7FFF0014^M +load address: 0x00004000 aixmon size: 0x000D2C00 boot image size: 0x01A6B430^M +^LAIX vm,uuid property contains invalid data^Mload address: 0x00004000 aixmon size: 0x000D2C00 boot image size: 0x01A6B430^M +^LAIX vm,uuid property contains invalid data^M +get_ppp return code: 0xFFFFFFFE^M +^M +AKVM: hcall-multi-tce detected but overridden, allow with "multce" boot argument^M +The temporary memory region list is at 1 percent capacity.^M +The temporary IPLCB is at 1 percent capacity.^M +The IPLCB address is 0x0FFF9000^M +name offset size^M +ipl_cb_and_bit_map 00000000 ......00005958^M +bit_map........... 00000790 ......00000006^M +ipl_info.......... 000001C8 ......00000024^M +splpar_info....... 000001EC ......00000048^M +system_info....... 00000234 ......000000C4^M +processor_info.... 000002F8 ......00000148^M +lpar_id_info...... 00000440 ......00000088^M +dr_proc_info...... 000004C8 ......00000008^M +dr_mem_info....... 000004D0 ......00000028^M +lpar_info......... 000004F8 ......00000014^M +segment page...... 00000518 ......00000028^M +processor page.... 00000540 ......00000010^M +res_asso_id....... 00000550 ......00000050^M +res_asso_group.... 000005A0 ......00000048^M +asso_ref_pnt...... 000005E8 ......00000010^M +residual.......... 00000820 ......00005138^M +fwad_info......... 000005F8 ......00000040^M +contig mem rsv.... 00000738 ......00000058^M + region address region length attr label^M +0 0x0000000000000000 0x000000000FFF7000 0x01 0x01^M +1 0x000000000FFF7000 0x0000000000002000 0x01 0x03^M +2 0x000000000FFF9000 0x0000000000006000 0x01 0x02^M +3 0x000000000FFFF000 0x0000000000000014 0x00 0x05^M +4 0x000000000FFFF014 0x00000000F0000FEC 0x01 0x01^M +5 0x0000000100000000 0xFFFFFFFF00000000 0x00 0x07^M +----------------------------^M +^M +0000012C bytes of free memory remain at address 00004000^M +compressed kernel addr: D6C00; sz: 98CE33; uncompressed kernel addr: 1DB59600^M + name source dest size flags^M + 0 .data 1e6f9840 2000000 12bdd20 1^M + 1 basecfg 1b04000 fff5000 15d9 1^M + 2 ramfs a63a30 efe9000 100b82a 1^M + 3 .text 1db59840 d6c00 ba0000 1^M + 4 .ldr 1f9b7560 c77000 a9523 1^M + 5 symtab 1fe0aaf4 d21000 1f4410 1^M + 6 kern. hdr 1db59600 0 240 1^M + 7 .bss 0 32bdd20 27222e0 2^M +free space between BSS and RAM filesystem: 09609000^M +^M +entry_point: 0x000D6C28^M + kernel debugger setting: enabled^M +-------------------------------------------------------------------------------^M +^LStarLED{A20}^M +Data Storage Interrupt - PROC^M +.dispatch+000098 lwz r0,1830(r6) r0=0,1830(r6)=F00000002FF48E30^M +KDB(0)> + +(apologies for all the ^M - they are emitted by qemu or AIX - not sure) + +Using the same command to boot AIX from 3.1.0 works (no DSI Interrupt). - Other problems occur later, but no Kernel interrupt, only user space problems - and that's another problem - but one at a time ! + +--Ivan \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/183 b/results/classifier/mode-deepseek-r1:32b/output/system/183 new file mode 100644 index 00000000..8413c6a2 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/183 @@ -0,0 +1,3 @@ + + +Cannot use usb-host on Mac OS diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1830821 b/results/classifier/mode-deepseek-r1:32b/output/system/1830821 new file mode 100644 index 00000000..2b55879a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1830821 @@ -0,0 +1,9 @@ + + +Expose ARCH_CAP_MDS_NO in guest + +Description: + +MDS_NO is bit 5 of ARCH_CAPABILITIES. Expose this bit to guest. + +Target Qemu: 4.1 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1831545 b/results/classifier/mode-deepseek-r1:32b/output/system/1831545 new file mode 100644 index 00000000..0d672bd5 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1831545 @@ -0,0 +1,23 @@ + + +"accel/tcg: demacro cputlb" break qemu-system-x86_64 on 32-bit x86 host + +As described in https://lists.gnu.org/archive/html/qemu-devel//2019-05/msg07362.html I run into TCG regression in qemu-git. + +Unfortunately, fix from bug https://bugs.launchpad.net/qemu/+bug/1830872 seems to be nonn-effective for my case. + +For reproduction (on 32-bit x86 host, in my case Slackware with gcc 5.5.0): + +./configure --target-list=x86_64-softmmu --disable-werror --enable-debug-tcg + +make (-j5 in my case) + +try to boot any 64-bit kernel: + +x86_64-softmmu/qemu-system-x86_64 -kernel /boot/bzImage-4.12.0-x64 -accel tcg + +result is - qemu appear to hang right after "Booting the kernel" line. Decompression (xz) was ok. + +Tested with qemu-git commit e2a58ff493a2e00db3e963c1839c5374500110f2 + +32-bit OS can be booted fine, and -enable-kvm also allow 64 bit kernel/os to boot. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1832 b/results/classifier/mode-deepseek-r1:32b/output/system/1832 new file mode 100644 index 00000000..5fc7bfac --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1832 @@ -0,0 +1,3 @@ + + +i386 test registers are not handled diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1832250 b/results/classifier/mode-deepseek-r1:32b/output/system/1832250 new file mode 100644 index 00000000..5f390e4a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1832250 @@ -0,0 +1,59 @@ + + +arm32v6/golang:1.10-alpine is broken for qemu 2.8 on MacOS cross-compilation + +FROM arm32v6/golang:1.10-alpine + +docker build -t openhorizon/ibm.gps_arm:2.0.7 -f ./Dockerfile.arm . +Sending build context to Docker daemon 110.6kB +Step 1/12 : FROM arm32v6/golang:1.10-alpine +1.10-alpine: Pulling from arm32v6/golang +05276f4299f2: Pull complete +5657e63df536: Pull complete +febca98d0249: Pull complete +5053a7aa5dea: Pull complete +d048463a3701: Pull complete +b628c679d668: Pull complete +Digest: sha256:94c5fd97b17d0e9fe89e011446bedda4784cb0af7a60494989e2a21c0dcba92f +Status: Downloaded newer image for arm32v6/golang:1.10-alpine + ---> 3110964e8c9a +Step 2/12 : RUN apk --no-cache update && apk add git + ---> Running in 14ffb11506bb +fetch http://dl-cdn.alpinelinux.org/alpine/v3.9/main/armhf/APKINDEX.tar.gz +fetch http://dl-cdn.alpinelinux.org/alpine/v3.9/community/armhf/APKINDEX.tar.gz +v3.9.4-24-g4e2ff29bbe [http://dl-cdn.alpinelinux.org/alpine/v3.9/main] +v3.9.4-25-g65097c9cdc [http://dl-cdn.alpinelinux.org/alpine/v3.9/community] +OK: 9547 distinct packages available +fetch http://dl-cdn.alpinelinux.org/alpine/v3.9/main/armhf/APKINDEX.tar.gz +fetch http://dl-cdn.alpinelinux.org/alpine/v3.9/community/armhf/APKINDEX.tar.gz +(1/7) Installing nghttp2-libs (1.35.1-r0) +(2/7) Installing libssh2 (1.8.2-r0) +(3/7) Installing libcurl (7.64.0-r2) +(4/7) Installing libgcc (8.3.0-r0) +(5/7) Installing expat (2.2.6-r0) +(6/7) Installing pcre2 (10.32-r1) +(7/7) Installing git (2.20.1-r0) +Executing busybox-1.29.3-r10.trigger +OK: 18 MiB in 22 packages +Removing intermediate container 14ffb11506bb + ---> 6890ea7ed09b +Step 3/12 : RUN mkdir -p /build/bin + ---> Running in 44e52d78d7b4 +Removing intermediate container 44e52d78d7b4 + ---> 0763afda41d1 +Step 4/12 : COPY src /build/src + ---> 05bab9a72a34 +Step 5/12 : WORKDIR /build + ---> Running in 5a663caff249 +Removing intermediate container 5a663caff249 + ---> 5a6ca53c00de +Step 6/12 : RUN env GOPATH=/build GOOPTIONS_ARM='CGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=6' go get github.com/kellydunn/golang-geo + ---> Running in 05b09ee0c206 +Removing intermediate container 05b09ee0c206 + ---> e68c6e222e51 +Step 7/12 : RUN env GOPATH=/build GOOPTIONS_ARM='CGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=6' go build -o /build/bin/armv6_gps /build/src/main.go + ---> Running in ea6d2707e35f +qemu-arm: /build/qemu-rwi8RH/qemu-2.8+dfsg/translate-all.c:175: tb_lock: Assertion `!have_tb_lock' failed. +qemu-arm: /build/qemu-rwi8RH/qemu-2.8+dfsg/translate-all.c:175: tb_lock: Assertion `!have_tb_lock' failed. +The command '/bin/sh -c env GOPATH=/build GOOPTIONS_ARM='CGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=6' go build -o /build/bin/armv6_gps /build/src/main.go' returned a non-zero code: 139 +make: *** [build] Error 139 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1832281 b/results/classifier/mode-deepseek-r1:32b/output/system/1832281 new file mode 100644 index 00000000..fc928a2b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1832281 @@ -0,0 +1,53 @@ + + +tcg bug master / 4.0.0 v8 operation >>> and |= + +vm guest is linux, executed with tcg +running this Node.js snippet leads to + +$ node +> a = undefined +undefined +> a >>> 0 +4294967295 + +host node +$ node +> a = undefined +undefined +> a >>> 0 +0 + +same with |= + +node +Welcome to Node.js v12.4.0. +Type ".help" for more information. +> let buffer +undefined +> buffer |= 0 +0 + +vm with tcg: + +$ ./out/Release/node --version +v12.4.0 +./out/Release/node -e "let buffer; buffer |= 0; console.log(buffer);" +-1 + + +vm guest is debian x86_64 latest release +vm guest is started with ./x86_64-softmmu/qemu-system-x86_64 -vnc :0 -cdrom debian-9.9.0-amd64-netinst.iso -m 4G -smp cores=6,threads=1,sockets=1 -nic user,hostfwd=tcp:ipv4addr:2233-:22 -cpu qemu64 debian.img + +git tag v4.0.0 and master, commit a578cdfbdd8f9beff5ced52b7826ddb1669abbbf, for building qemu-system-x86_64 was used. + +Node.js as compiled on the vm guest (v12.4.0 / master) + + +see also +https://github.com/nodejs/node/issues/19348#issuecomment-500465502 + +I need further assistance to track down the cause of the bug. + +Kind regards +Manuel \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1834613 b/results/classifier/mode-deepseek-r1:32b/output/system/1834613 new file mode 100644 index 00000000..f3f1cb12 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1834613 @@ -0,0 +1,50 @@ + + +Crypto related operations failing on Alpine Linux on QEMU 4.0 + +I'm unable to boot the netboot image of Alpine Linux using QEMU 4.0. + +Steps to reproduce: + +curl -O http://dl-cdn.alpinelinux.org/alpine/v3.10/releases/ppc64le/netboot/vmlinuz-vanilla +curl -O http://dl-cdn.alpinelinux.org/alpine/v3.10/releases/ppc64le/netboot/initramfs-vanilla +qemu-system-ppc64 -kernel vmlinuz-vanilla -initrd initramfs-vanilla -nographic -append "console=hvc0 ip=dhcp alpine_repo=http://dl-cdn.alpinelinux.org/alpine/v3.10/main" + +The init script will automatically download and install an in-memory Alpine Linux environment. However, with QEMU 4.0, the installation process will fail with "BAD SIGNATURE" errors: + + + + * Installing packages to root filesystem: fetch http://dl-cdn.alpinelinux.org/alpine/edge/main/ppc64le/APKINDEX.tar.gz +(1/20) Installing musl (1.1.22-r2) +ERROR: musl-1.1.22-r2: BAD signature (2/20) Installing busybox (1.30.1-r2) +ERROR: busybox-1.30.1-r2: BAD signature (3/20) Installing alpine-baselayout (3.1.2-r0) +Executing alpine-baselayout-3.1.2-r0.pre-install ERROR: alpine-baselayout-3.1.2-r0.pre-install: script exited with error 127 +ERROR: alpine-baselayout-3.1.2-r0: BAD signature (4/20) Installing openrc (0.41.2-r1) +ERROR: openrc-0.41.2-r1: BAD signature (5/20) Installing alpine-conf (3.8.3-r0) +ERROR: alpine-conf-3.8.3-r0: BAD signature (6/20) Installing libcrypto1.1 (1.1.1c-r0) +ERROR: libcrypto1.1-1.1.1c-r0: BAD signature (7/20) Installing libssl1.1 (1.1.1c-r0) +ERROR: libssl1.1-1.1.1c-r0: BAD signature (8/20) Installing ca-certificates-cacert (20190108-r0) +ERROR: ca-certificates-cacert-20190108-r0: BAD signature (9/20) Installing libtls-standalone (2.9.1-r0) +ERROR: libtls-standalone-2.9.1-r0: BAD signature (10/20) Installing ssl_client (1.30.1-r2) +ERROR: ssl_client-1.30.1-r2: BAD signature (11/20) Installing zlib (1.2.11-r1) +ERROR: zlib-1.2.11-r1: BAD signature (12/20) Installing apk-tools (2.10.4-r1) +ERROR: apk-tools-2.10.4-r1: BAD signature (13/20) Installing busybox-suid (1.30.1-r2) +ERROR: busybox-suid-1.30.1-r2: BAD signature (14/20) Installing busybox-initscripts (3.1-r7) +ERROR: busybox-initscripts-3.1-r7: BAD signature (15/20) Installing scanelf (1.2.3-r0) +ERROR: scanelf-1.2.3-r0: BAD signature (16/20) Installing musl-utils (1.1.22-r2) +ERROR: musl-utils-1.1.22-r2: BAD signature (17/20) Installing libc-utils (0.7.1-r0) +ERROR: libc-utils-0.7.1-r0: BAD signature (18/20) Installing alpine-keys (2.1-r2) +ERROR: alpine-keys-2.1-r2: BAD signature (19/20) Installing alpine-base (3.10.0-r0) +ERROR: alpine-base-3.10.0-r0: BAD signature (20/20) Installing openssl (1.1.1c-r0) +ERROR: openssl-1.1.1c-r0: BAD signature 20 errors; 0 MiB in 0 packages +ok. +grep: /sysroot/etc/inittab: No such file or directory +/sbin/init not found in new root. Launching emergency recovery shell +Type exit to continue boot. +sh: can't access tty; job control turned off +/ # + + +If I boot up a disk image created by a previous version QEMU, crypto related operations like verifying a RSA signature using the "openssl" command will also fail. + +I didn't see these errors on previous QEMU versions or other architectures on QEMU 4.0 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1835694 b/results/classifier/mode-deepseek-r1:32b/output/system/1835694 new file mode 100644 index 00000000..cff8ac35 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1835694 @@ -0,0 +1,384 @@ + + +hardware-based time keeping + +Hi all, + +I hope you're all doing well. + +As i was looking for a solution for a particular problem in Qemu/KVM +virtualization. + +My issue is that I have a virtual machine that runs well in VMware and when +I migrated that to Qemu/KVM-enabled environment, it didn't work! I figured +out that under VMware hypervisor, VMware supplies CPU TSC and Performance +Counters values to the guest VM with the option +"monitor_control.pseudo_perfctr = TRUE" set the vmx configuration file, +Ref.: https://www.vmware.com/pdf/vmware_timekeeping.pdf + +My question is, is there any similar option in Qemu/KVM-enabled environment +that I can use to get my VM working the same way as in the VMware +environment? + +I almost tried all options in Qemu with regards to CPU but no avail. + +To elaborate more, the VM I'm trying to port under Qemu/KVM environment is +a an old version of Cisco virtual ASA Firewall. The VM image is actually +meant to be run under VMware ESXi and with that +"*monitor_control.pseudo_perfctr += TRUE*" option it can also run in Vware Workstation as well. *Yes, this +option that makes it run under VMware and if it's removed from the +configuration vmx file then the VM boots half way and crashes the same way +it crashes under Qemu*. That dictates it's the option in interest that +needs to be found in Qemu/KVM. I have a copy of this VM in the below link +in case you would like to try its behavior in under VMware. I downloaded it +from a youtube previously to test it out: + +https://drive.google.com/open?id=1SEXws18hoj2sWGk8iFqqH8RpBZsBNpRH + +Once you power on the VM you can telnet to 127.0.0.1 on port 3000 to see +the boot process. If you remove that option i mentioned to you and boot the +VM again you'll see the crashing in process. + + +I've converted that vmdk disk images into Qemu disks "qcow2" format and i +ran them using the below command line on Ubuntu: + +/opt/qemu/bin/qemu-system-x86_64 -L -nographic -device +e1000-82545em,netdev=net0,mac=50:00:00:6a:00:00 -netdev +tap,id=net0,ifname=vunl0_33_0,script=no -device +e1000-82545em,netdev=net1,mac=50:00:00:6a:00:01 -netdev +tap,id=net1,ifname=vunl0_33_1,script=no -device +e1000-82545em,netdev=net2,mac=50:00:00:6a:00:02 -netdev +tap,id=net2,ifname=vunl0_33_2,script=no -device +e1000-82545em,netdev=net3,mac=50:00:00:6a:00:03 -netdev +tap,id=net3,ifname=vunl0_33_3,script=no -machine type=pc-1.0 *-cpu +host,migratable=off,invtsc=on,pmu=on* -m 4096 -hda hda.qcow2 -hdb hdb.qcow2 +-serial telnet:0.0.0.0:3000,server,nowait -monitor +tcp:127.0.0.1:42379,server,nowait +-nographic -display none -enable-kvm + + +Once you power on the VM you can telnet to xx.xx.xx.xx 3000 (where the xx +IP is the Ubuntu machine IP) to see the crashing in process. You may need +to wait for a while for the status messages to appear in the terminal +window. + +I assume it's a cpu issue because in page 9 of the Vmware pdf reference +file; it says there are machine instructions become available when this +option "*monitor_control.pseudo_perfctr = TRUE*" is enabled: + +The following machine instructions then become available: + +Instruction Time Value Returned +rdpmc 0x10000 Physical host TSC +rdpmc 0x10001 Elapsed real time in ns +rdpmc 0x10002 Elapsed apparent time in ns + +Therefore, I used many of the Qemu cpu options such as these: + +-cpu host,migratable=no,+invtsc (ref: https://wiki.qemu.org/ChangeLog/2.1) +-cpu host, tsc-frequency=xxxx (ref: https://lists.gnu.org/archive/ +html/qemu-devel/2017-01/msg03555.html) + -cpu host,migratable=off,invtsc=true,pmu=true + +Not sure if i'm hitting the wrong option! + +The log I'm getting when the VM boots up looks like the following crash +happens at the blue colored log: + +---------------------------------------------------------------------------------------------------------------------------- +Loading... + +Starting image verification +Hash Computation: 100% Done! +Computed Hash SHA2: 63c1e8aa9de3d0c6e738dc91be8e1784 + 5caf64af4cf06cf6a3c5da7200d478dd + 938d380d2b1064f6a349401c7860f50e + cc4eeb98a0ae16c097dbc9447d4d6626 + +Get key records from key storage: Primary, key_store_type: 2 +Embedded Hash SHA2: 63c1e8aa9de3d0c6e738dc91be8e1784 + 5caf64af4cf06cf6a3c5da7200d478dd + 938d380d2b1064f6a349401c7860f50e + cc4eeb98a0ae16c097dbc9447d4d6626 + +The digital signature of the running image verified successfully +Processor memory 3183296512, Reserved memory: 0 + +Total NICs found: 4 +i82545EM rev03 Gigabit Ethernet @ irq10 dev 6 index 03 MAC: 5000.006a.0003 +i82545EM rev03 Gigabit Ethernet @ irq10 dev 5 index 02 MAC: 5000.006a.0002 +i82545EM rev03 Gigabit Ethernet @ irq11 dev 4 index 01 MAC: 5000.006a.0001 +i82545EM rev03 Gigabit Ethernet @ irq11 dev 3 index 00 MAC: 5000.006a.0000 + +Thread Name: lina_flash_init_thread +Page fault: Unknown + r8 0x0000000000000790 + r9 0x00007fff3fa8b000 + r10 0x0000000000000001 + r11 0x000000000210e130 + r12 0x00000000062ebfc0 + r13 0x0000000000010001 + r14 0x0000000000000000 + r15 0x00000000062ebfc0 + rdi 0x00000000062ebfc0 + rsi 0x0000000006c17c20 + rbp 0x00007fff4056f4e0 + rbx 0x00000000062ebfc0 + rdx 0x00007fff40566f10 + rax 0x0000000000000001 + rcx 0x0000000000010001 + rsp 0x00007fff4056f4b0 + rip 0x0000000001581130 + eflags 0x0000000000013202 + csgsfs 0x0000000000000033 +error code 0x0000000000000000 + vector 0x000000000000000d + old mask 0xffffffde3e3b5a05 + cr2 0x0000000000000000 + +Cisco Adaptive Security Appliance Software Version 9.3(1) + +Compiled on Wed 23-Jul-14 18:16 PDT by builders +Hardware: ASAv +Crashinfo collected on 03:42:24.059 UTC Tue Nov 28 2017 + +Traceback: +0: 0x0000000000422118 +1: 0x0000000000422152 +2: 0x0000000000424331 +3: 0x00000000015874a9 +4: 0x00007ffffecd55f0 +5: 0x0000000000558d85 +6: 0x00000000008f5a2b +7: 0x00000000008fd361 +8: 0x0000000000428a15 +Stack dump: base:0x00007fff4056f2e0 size:178, active:178 + entries above '==': return PC preceded by input parameters + entries below '==': local variables followed by saved regs + '==Fn': stack frame n, contains next stack frame + '*': stack pointer at crash + rdi rsi rdx rcx r8 r9 : Arguments 1 through 6 to leaf function + For example: + 0x00007fffeeeeef00: 0x0000000000000009 : arg9 + 0x00007fffeeeeeefc: 0x0000000000000008 : arg8 + 0x00007fffeeeeeef8: 0x0000000000000007 : arg7 + 0x00007fffeeeeeef4: 0x0000000000000abc : return PC + 0x00007fffeeeeeef0: 0x00007fffeeeeef20 ==F2: stack frame F2 + 0x00007fffeeeeeeec: 0x0000000000000def : local variable + 0x00007fffeeeeeee8: 0x0000000000000123 : local variable or saved reg + 0x00007fffeeeeeee4: 0x0000000000000456 : local variable or saved reg + 0x00007fffeeeeeee0: 0x0000000000000789 : local variable or saved reg +0x00007fff4056f870: 0x00007fff4056f7e0 +0x00007fff4056f868: 0x0000000000000000 +0x00007fff4056f860: 0x00000038a11c0123 +0x00007fff4056f858: 0x0000000000000083 +0x00007fff4056f850: 0x00007fff16a864c8 +0x00007fff4056f848: 0x0000000000000000 +0x00007fff4056f840: 0x00000000a11ccdef +0x00007fff4056f838-0x00007fff4056f808: 0x0000000000000000 +0x00007fff4056f800: 0x0000000000429867 +0x00007fff4056f7f8: 0x00007fff4056f860 +0x00007fff4056f7f0: 0x00007fff40567100 +0x00007fff4056f7e8: 0x0000000000000000 +0x00007fff4056f7e0: 0x00000030a11c0123 +0x00007fff4056f7d8: 0x0000000000000083 +0x00007fff4056f7d0: 0x00007fff16a864c8 +0x00007fff4056f7c8: 0x0000000000000000 +0x00007fff4056f7c0: 0x00000000a11ccdef +0x00007fff4056f7b8: 0x0fffffff0fffffff +0x00007fff4056f7b0-0x00007fff4056f7a8: 0x0000000000000000 +0x00007fff4056f7a0: 0x00000000062cc8a0 +0x00007fff4056f798: 0x0000000000000000 +0x00007fff4056f790: 0x00007fff4056f6e0 +0x00007fff4056f788: 0x00007fff4056f758 +0x00007fff4056f780: 0x0000000000000000 +0x00007fff4056f778: 0x00007fff3ff48620 +0x00007fff4056f770-0x00007fff4056f730: 0x0000000000000000 +0x00007fff4056f728: 0x0000000004d14940 +0x00007fff4056f720: 0x000000000041d690 +0x00007fff4056f718: 0x0000000002777640 +0x00007fff4056f710: 0x0000000200010010 +0x00007fff4056f708: 0x0000000006c17d40 +0x00007fff4056f700: 0x00007fff4056f6e0 +0x00007fff4056f6f8: 0x00007fff40150e80 +0x00007fff4056f6f0: 0x000000000638e598 +0x00007fff4056f6e8: 0x00007fff3ff48620 +0x00007fff4056f6e0: 0x00007fff4056f778 +0x00007fff4056f6d8: 0x00000000deadfeed +0x00007fff4056f6d0-0x00007fff4056f6c8: 0x0000000000000000 +0x00007fff4056f6c0: 0x000000000041e1f6 +0x00007fff4056f6b8: 0x00007fff40571fd0 +0x00007fff4056f6b0: 0x00007fff40560cf0 +0x00007fff4056f6a8: 0x0000000000000000 +0x00007fff4056f6a0: 0x000000f0a11c0123 +0x00007fff4056f698: 0x0000000000000143 +0x00007fff4056f690: 0x00007fff16a864c8 +0x00007fff4056f688: 0x0000000000000000 +0x00007fff4056f680: 0x00000000a11ccdef +0x00007fff4056f678-0x00007fff4056f660: 0x0000000000000000 ==F5 +0x00007fff4056f658: 0x000000009abcdef0 +0x00007fff4056f650-0x00007fff4056f5b8: 0x123456789abcdef0 +0x00007fff4056f5b0: 0x0000000000428a01 +0x00007fff4056f5a8: 0x00007fff4056f570 +0x00007fff4056f5a0-0x00007fff4056f590: 0x0000000000000000 +0x00007fff4056f588: 0xffffffffffffdf98 +0x00007fff4056f580: 0x00007fff4056f670 +0x00007fff4056f578: 0x00007fff3ff48370 +0x00007fff4056f570: 0x0000000000000000 +0x00007fff4056f568: 0x0000000000428a15 +0x00007fff4056f560: 0x00007fff4056f670 ==F4 +0x00007fff4056f558: 0x00000000008fd361 +0x00007fff4056f550: 0x00007fff4056f560 ==F3 +0x00007fff4056f548: 0x00000000008f5a2b +0x00007fff4056f540: 0x00007fff4056f550 ==F2 +0x00007fff4056f538: 0x0000000000000000 +0x00007fff4056f530: 0xffffffffffffdf98 +0x00007fff4056f528: 0x00007fff3ff48370 +0x00007fff4056f520: 0x00000000008fba90 +0x00007fff4056f518: 0x00000000008fb908 +0x00007fff4056f510: 0x00007fff4056f550 +0x00007fff4056f508: 0x00000000008fb87e +0x00007fff4056f500: 0x00007fff4056f510 +0x00007fff4056f4f8: 0x0000000000000000 +0x00007fff4056f4f0: 0xffffffffffffdf98 +0x00007fff4056f4e8: 0x0000000000558d85 +0x00007fff4056f4e0: 0x00007fff4056f540 ==F1 +0x00007fff4056f4d8-0x00007fff4056f4d0: 0x0000000000000000 +0x00007fff4056f4c8: 0x0000000000000001 +0x00007fff4056f4c0-0x00007fff4056f4b8: 0x00000000062ebfc0 +0x00007fff4056f4b0: 0x0000000000000000 * +0x00007fff4056f4a8: 0x00000000008fd973 +0x00007fff4056f4a0: 0x00007fff4056f4d0 +0x00007fff4056f498: 0x00007fff40563908 +0x00007fff4056f490: 0x00007fff4056f4d0 +0x00007fff4056f488: 0x00000000009d4b01 +0x00007fff4056f480: 0x00007fff4056f4a0 +0x00007fff4056f478-0x00007fff4056f470: 0x0000000000000000 +0x00007fff4056f468: 0x00007fff418d6390 +0x00007fff4056f460: 0x0000000000000000 +0x00007fff4056f458: 0x000000000201b9f8 +0x00007fff4056f450: 0x00007fff4056f480 +0x00007fff4056f448: 0x00007fff40563908 +0x00007fff4056f440: 0x0000000000000001 +0x00007fff4056f438: 0x00007fff405619a0 +0x00007fff4056f430: 0x00007fff40563908 +0x00007fff4056f428: 0x0000000000000001 +0x00007fff4056f420: 0x0000000000000000 +0x00007fff4056f418: 0x0000000001627125 +0x00007fff4056f410: 0x00007fff4056f450 +0x00007fff4056f408: 0x00007fff3fa8b010 +0x00007fff4056f400: 0x00007fff46505845 +0x00007fff4056f3f8-0x00007fff4056f3c8: 0x0000000000000000 +0x00007fff4056f3c0: 0x0000000000000003 +0x00007fff4056f3b8-0x00007fff4056f3a8: 0x0000000000000000 +0x00007fff4056f3a0: 0x0000000000000240 +0x00007fff4056f398: 0x0000000000000003 +0x00007fff4056f390: 0x0000024446505853 +0x00007fff4056f388-0x00007fff4056f310: 0x0000000000000000 +0x00007fff4056f308: 0x424b7e25fece8fc2 +0x00007fff4056f300: 0x2cc4f98473045e95 +0x00007fff4056f2f8: 0x18fa9b6c57ca0e78 +0x00007fff4056f2f0: 0x081e2a254ab96aa4 +0x00007fff4056f2e8: 0x0000000300000000 + +Begin to dump crashinfo to flash.... + +core0: An internal error occurred. Specifically, a programming assertion +was +violated. Copy the error message exactly as it appears, and get the +output of the show version command and the contents of the configuration +file. Then call your technical support representative. + +assertion "_vf_mode_init" failed: file "vf_api.c", line 136 +core0 same core snap_count=1 signo=6 RIP=7ffffecd43fb + + +----------------------------------------------- +Traceback output aborted. +Flushing first exception frame: +Page fault: Unknown + r8 0x0000000000000790 + r9 0x00007fff3fa8b000 + r10 0x0000000000000001 + r11 0x000000000210e130 + r12 0x00000000062ebfc0 + r13 0x0000000000010001 + r14 0x0000000000000000 + r15 0x00000000062ebfc0 + rdi 0x00000000062ebfc0 + rsi 0x0000000006c17c20 + rbp 0x00007fff4056f4e0 + rbx 0x00000000062ebfc0 + rdx 0x00007fff40566f10 + rax 0x0000000000000001 + rcx 0x0000000000010001 + rsp 0x00007fff4056f4b0 + rip 0x0000000001581130 + eflags 0x0000000000013202 + csgsfs 0x0000000000000033 +error code 0x0000000000000000 + vector 0x000000000000000d + old mask 0xffffffde3e3b5a05 + cr2 0x0000000000000000 +Nested traceback attempted via signal, from: +Abort: Unknown + r8 0x000000000000003c + r9 0x0000000005097a27 + r10 0x00007fff4056de28 + r11 0x0000000000003206 + r12 0x0000000000000001 + r13 0x00007fff4056df80 + r14 0x0000000000000000 + r15 0x0000000000000006 + rdi 0x0000000000000008 + rsi 0x00007fff4056df80 + rbp 0x00007fff4056dfc0 + rbx 0x00007fff29f6b780 + rdx 0x0000000000000010 + rax 0x0000000000000010 + rcx 0xffffffffffffffff + rsp 0x00007fff4056df50 + rip 0x00007ffffecd43fb + eflags 0x0000000000003206 + csgsfs 0x1234000000000033 +error code 0x0000000000000000 + vector 0x000000000000000d + old mask 0xffffffde3e3b5a05 + cr2 0x0000000000000000 + +Cisco Adaptive Security Appliance Software Version 9.3(1) + +Compiled on Wed 23-Jul-14 18:16 PDT by builders +Hardware: ASAv +Crashinfo collected on 03:42:24.059 UTC Tue Nov 28 2017 + +Traceback: +0: 0x0000000000422118 +1: 0x00000000004221f8 +2: 0x000000000042226d +3: 0x0000000001587076 +4: 0x00007ffffecd55f0 +5: 0x00000000015820a0 +6: 0x000000000212d482 +7: 0x000000000139f304 +8: 0x000000000213f315 +9: 0x0000000001460873 +10: 0x0000000001488625 +11: 0x0000000000423e7a +12: 0x00000000004244dc +13: 0x00000000015874a9 +14: 0x00007ffffecd55f0 +15: 0x0000000000558d85 +16: 0x00000000008f5a2b +17: 0x00000000008fd361 +18: 0x0000000000428a15 +----------------------------------------------- +Process shutdown finished +Rebooting..... + +Thanks in advance for your help! :) + +Regards, +Abdullah Alhaddad \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1835827 b/results/classifier/mode-deepseek-r1:32b/output/system/1835827 new file mode 100644 index 00000000..0369c563 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1835827 @@ -0,0 +1,7 @@ + + +HTIF symbols no longer recognized by RISC-V spike board + +Tested commit: f34edbc760b0f689deddd175fc08732ecb46665f + +I belive this was introduced in 0ac24d56c5e7d32423ea78ac58a06b444d1df04d when the spike's load_kernel() was moved to riscv_load_kernel() which no longer included htif_symbol_callback(). \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1836 b/results/classifier/mode-deepseek-r1:32b/output/system/1836 new file mode 100644 index 00000000..ed0e1853 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1836 @@ -0,0 +1,3 @@ + + +AIX no longer boots diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1836136 b/results/classifier/mode-deepseek-r1:32b/output/system/1836136 new file mode 100644 index 00000000..00dc58f8 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1836136 @@ -0,0 +1,5 @@ + + +u-boot: any plans to update u-boot to v2019.07 + +Just want to pulse about the plan to update u-boot binary to latest v2019.07. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1837049 b/results/classifier/mode-deepseek-r1:32b/output/system/1837049 new file mode 100644 index 00000000..125360c4 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1837049 @@ -0,0 +1,125 @@ + + +qemu-system-ppc segfaults with -display sdl + +Hello. + +I was trying to debug this segfault: +https://lists.nongnu.org/archive/html/qemu-ppc/2019-07/msg00186.html + +I recompiled latest qemu from git (commit 0b18cfb8f1828c905139b54c8644b0d8f4aad879 ), using this configure line: +./configure --target-list=i386-softmmu,x86_64-softmmu,ppc-softmmu --audio-drv-list=alsa --disable-werror --extra-cflags="-Og" --enable-debug-tcg + +after this I tried original line under gdb, it was still segfaulting: + +--------------copy----------------- +gdb ./ppc-softmmu/qemu-system-ppc +GNU gdb (GDB) 7.11.1 +Copyright (C) 2016 Free Software Foundation, Inc. +License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> +This is free software: you are free to change and redistribute it. +There is NO WARRANTY, to the extent permitted by law. Type "show copying" +and "show warranty" for details. +This GDB was configured as "i586-slackware-linux". +Type "show configuration" for configuration details. +For bug reporting instructions, please see: +<http://www.gnu.org/software/gdb/bugs/>. +Find the GDB manual and other documentation resources online at: +<http://www.gnu.org/software/gdb/documentation/>. +For help, type "help". +Type "apropos word" to search for commands related to "word"... +Reading symbols from ./ppc-softmmu/qemu-system-ppc...done. +warning: File "/dev/shm/qemu/.gdbinit" auto-loading has been declined by your `auto-load safe-path' set to "$debugdir:$datadir/auto-load". +To enable execution of this file add + add-auto-load-safe-path /dev/shm/qemu/.gdbinit +line to your configuration file "/home/guest/.gdbinit". +To completely disable this security protection add + set auto-load safe-path / +line to your configuration file "/home/guest/.gdbinit". +For more information about this security protection see the +"Auto-loading safe path" section in the GDB manual. E.g., run from the shell: + info "(gdb)Auto-loading safe path" +(gdb) run -M mac99,via=pmu -L ../queue-vga/pc-bios -cdrom /mnt/sdb1/PPC-img/lubuntu-16.04-desktop-powerpc.iso -m 512 -display sdl,gl=on -vga std -d guest_errors,unimp -boot d -cpu G4 -g 1024x768x24 -device ES1370 +Starting program: /dev/shm/qemu/ppc-softmmu/qemu-system-ppc -M mac99,via=pmu -L ../queue-vga/pc-bios -cdrom /mnt/sdb1/PPC-img/lubuntu-16.04-desktop-powerpc.iso -m 512 -display sdl,gl=on -vga std -d guest_errors,unimp -boot d -cpu G4 -g 1024x768x24 -device ES1370 +[Thread debugging using libthread_db enabled] +Using host libthread_db library "/lib/libthread_db.so.1". +[New Thread 0xf560cb40 (LWP 8100)] +[New Thread 0xf4c1ab40 (LWP 8101)] +[New Thread 0xec1b7b40 (LWP 8102)] +[New Thread 0xc5821b40 (LWP 8104)] +[Thread 0xf4c1ab40 (LWP 8101) exited] +[New Thread 0xf4c1ab40 (LWP 8119)] + +Thread 4 "qemu-system-ppc" received signal SIGSEGV, Segmentation fault. +[Switching to Thread 0xec1b7b40 (LWP 8102)] +0xf26c2e44 in code_gen_buffer () +(gdb) bt full +#0 0xffffffff in code_gen_buffer () +#1 0x56710cf6 in cpu_exec (itb=<optimized out>, cpu=<optimized out>) at /dev/shm/qemu/accel/tcg/cpu-exec.c:173 + env = <optimized out> + ret = <optimized out> + last_tb = <optimized out> + tb_exit = <optimized out> + tb_ptr = 0xf26c2cc0 <code_gen_buffer+103976094> "‹]ш…Ы\017ЊБ\020" + ret = 0 + insns_left = <optimized out> + cflags = <optimized out> + tb = 0x5722fe58 + last_tb = <optimized out> + tb_exit = <optimized out> + cc = <optimized out> + __func__ = "cpu_exec" + ret = <optimized out> + sc = <optimized out> +#2 0x56710cf6 in cpu_exec (tb_exit=<synthetic pointer>, last_tb=<synthetic pointer>, tb=<optimized out>, cpu=<optimized out>) at /dev/shm/qemu/accel/tcg/cpu-exec.c:621 + ret = 0 + insns_left = <optimized out> + cflags = <optimized out> + tb = 0x5722fe58 + last_tb = <optimized out> + tb_exit = <optimized out> + cc = <optimized out> + __func__ = "cpu_exec" + ret = <optimized out> + sc = <optimized out> +#3 0x56710cf6 in cpu_exec (cpu=0x573db8f8) at /dev/shm/qemu/accel/tcg/cpu-exec.c:732 + cflags = <optimized out> + tb = 0x5722fe58 + last_tb = <optimized out> + tb_exit = <optimized out> + cc = <optimized out> + __func__ = "cpu_exec" + ret = <optimized out> + sc = <optimized out> +#4 0x566cfade in tcg_cpu_exec (cpu=0x573db8f8) at /dev/shm/qemu/cpus.c:1435 + ret = <optimized out> +#5 0x566d1e6d in qemu_tcg_rr_cpu_thread_fn (arg=0x573db8f8) at /dev/shm/qemu/cpus.c:1537 + r = <optimized out> + cpu = 0x573db8f8 + __PRETTY_FUNCTION__ = "qemu_tcg_rr_cpu_thread_fn" +#6 0x56b56fe0 in qemu_thread_start (args=0x57400668) at util/qemu-thread-posix.c:502 + __cancel_buf = {__cancel_jmp_buf = {{__cancel_jmp_buf = {1461911128, 1463813736, 1461911128, -333745816, 247778263, 1392237730}, __mask_was_saved = 0}}, __pad = {0xec1b70d0, 0x0, 0x0, 0x0}} + __cancel_routine = 0x56b57040 <qemu_thread_atexit_notify> + __not_first_call = <optimized out> + qemu_thread_args = 0x57400668 + start_routine = 0x566d1a30 <qemu_tcg_rr_cpu_thread_fn> + arg = 0x573db8f8 + r = <optimized out> +#7 0xffffffff in start_thread () at /lib/libpthread.so.0 +#8 0xffffffff in clone () at /lib/libc.so.6 +(gdb) quit +A debugging session is active. + + Inferior 1 [process 8096] will be killed. + +Quit anyway? (y or n) y +--------------copy end---------- + +But when I take away -display sdl, or replace it with -display gtk - same line was booting to desktop! + +Changing cpu to G3 also allowed boot: + +./ppc-softmmu/qemu-system-ppc -M mac99,via=pmu -L ../queue-vga/pc-bios -cdrom /mnt/sdb1/PPC-img/lubuntu-16.04-desktop-powerpc.iso -m 512 -display sdl -vga std -d guest_errors,unimp -boot d -cpu G3 -g 1024x768x24 -device ES1370 + +This is 32-bit qemu complied with Slackware's gcc 5.5.0. +64-bit qemu works fine. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1838658 b/results/classifier/mode-deepseek-r1:32b/output/system/1838658 new file mode 100644 index 00000000..01bdbdfc --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1838658 @@ -0,0 +1,15 @@ + + +qemu 4.0.0 broken by glib update + +In brief, an install CD will successfully boot with qemu 4.0.0 built with glib 2.58.3, but freeze during boot with qemu 4.0.0 built with glib 2.60.0. I tracked it down to glib's GHashTable improvements. qemu is happy with a glib built from +``` + git checkout -f 2.60.4 + git revert --no-edit 86c6f7e2b..3bed8a13b + git revert --no-edit 75f8ec1df9b48b0c3a13a9125f2c7d7c5adf5159 + git revert --no-edit 603fb5958..d3074a748 + git revert --no-edit 0b45ddc55..0600dd322 +``` +When the GHashTable improvements were committed, there was already a preemptive note about any breakage being due to using private implementation details, hence mentioning it here rather than with glib. + +For the full saga, see: http://gnats.netbsd.org/54310 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1838946 b/results/classifier/mode-deepseek-r1:32b/output/system/1838946 new file mode 100644 index 00000000..10ca9f02 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1838946 @@ -0,0 +1,570 @@ + + +qemu 3.10 golang crash + +Encountered below crashes in qemu 3.10 arm +Also have raised the same in golang groups. But seems like in ARM32 hardware, the below commands works fine, only in qemu if crashes. +https://groups.google.com/forum/?utm_medium=email&utm_source=footer#!topic/golang-nuts/1txPOGa4aGc + +Need some pointers to narrow down + +Please see log below. + +$ qemu-arm-static --version +qemu-arm version 3.1.0 (qemu-3.1.0-6.fc30) +Copyright (c) 2003-2018 Fabrice Bellard and the QEMU Project developers + + + + +arheneus@bbdee4f6f57d:/sonic/src/telemetry/test$ /usr/local/go/bin/go get -v github.com/Azure/sonic-telemetry/dialout/dialout_client_cli +github.com/openconfig/ygot (download) +github.com/kylelemons/godebug (download) +github.com/openconfig/goyang (download) +SIGSEGV: segmentation violation +PC=0x4512c m=12 sigcode=1 + +goroutine 15 [syscall]: +syscall.Syscall6(0x118, 0x1, 0x11c3, 0xf513b0, 0x1000004, 0x0, 0x0, 0x1c63c, 0x15e54, 0xe280a0) + /usr/local/go/src/syscall/asm_linux_arm.s:45 +0x8 fp=0xf51380 sp=0xf5137c pc=0x88298 +os.(*Process).blockUntilWaitable(0xf80300, 0xf80300, 0x0, 0x0) + /usr/local/go/src/os/wait_waitid.go:31 +0x64 fp=0xf51438 sp=0xf51380 pc=0xa94a0 +os.(*Process).wait(0xf80300, 0x13, 0xe6e1d0, 0xeba010) + /usr/local/go/src/os/exec_unix.go:22 +0x2c fp=0xf51470 sp=0xf51438 pc=0xa2d58 +os.(*Process).Wait(0xf80300, 0x4d5f58, 0x4d5f5c, 0x4d5f54) + /usr/local/go/src/os/exec.go:125 +0x1c fp=0xf51484 sp=0xf51470 pc=0xa2494 +os/exec.(*Cmd).Wait(0xe14000, 0x0, 0x0) + /usr/local/go/src/os/exec/exec.go:465 +0x40 fp=0xf514bc sp=0xf51484 pc=0xf8620 +os/exec.(*Cmd).Run(0xe14000, 0xd5c720, 0xf30000) + /usr/local/go/src/os/exec/exec.go:309 +0x44 fp=0xf514cc sp=0xf514bc pc=0xf7e1c +cmd/go/internal/work.(*Builder).toolID(0xd5cf60, 0x497ee2, 0x7, 0x2c, 0x116f8e0) + /usr/local/go/src/cmd/go/internal/work/buildid.go:193 +0x2e0 fp=0xf515bc sp=0xf514cc pc=0x3549bc +cmd/go/internal/work.(*Builder).buildActionID(0xd5cf60, 0x1177d90, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) + /usr/local/go/src/cmd/go/internal/work/exec.go:223 +0xb8c fp=0xf51978 sp=0xf515bc pc=0x3594fc +cmd/go/internal/work.(*Builder).build(0xd5cf60, 0x1177d90, 0x0, 0x0) + /usr/local/go/src/cmd/go/internal/work/exec.go:373 +0x3d3c fp=0xf51f44 sp=0xf51978 pc=0x35e374 +cmd/go/internal/work.(*Builder).Do.func1(0x1177d90) + /usr/local/go/src/cmd/go/internal/work/exec.go:107 +0x58 fp=0xf51f84 sp=0xf51f44 pc=0x38287c +cmd/go/internal/work.(*Builder).Do.func2(0xdf0070, 0xd5cf60, 0x10427a0) + /usr/local/go/src/cmd/go/internal/work/exec.go:165 +0x84 fp=0xf51fdc sp=0xf51f84 pc=0x382b24 +runtime.goexit() + /usr/local/go/src/runtime/asm_arm.s:867 +0x4 fp=0xf51fdc sp=0xf51fdc pc=0x67f44 +created by cmd/go/internal/work.(*Builder).Do + /usr/local/go/src/cmd/go/internal/work/exec.go:152 +0x2e4 + +goroutine 1 [semacquire]: +sync.runtime_Semacquire(0xdf0078) + /usr/local/go/src/runtime/sema.go:56 +0x2c +sync.(*WaitGroup).Wait(0xdf0070) + /usr/local/go/src/sync/waitgroup.go:130 +0x84 +cmd/go/internal/work.(*Builder).Do(0xd5cf60, 0x1177290) + /usr/local/go/src/cmd/go/internal/work/exec.go:174 +0x304 +cmd/go/internal/work.InstallPackages(0xc82078, 0x1, 0x1, 0xc0e938, 0x1, 0x2) + /usr/local/go/src/cmd/go/internal/work/build.go:506 +0xa88 +cmd/go/internal/get.runGet(0x810d78, 0xc82078, 0x1, 0x1) + /usr/local/go/src/cmd/go/internal/get/get.go:196 +0x1b0 +main.main() + /usr/local/go/src/cmd/go/main.go:219 +0x93c + +goroutine 19 [syscall]: +os/signal.signal_recv(0x0) + /usr/local/go/src/runtime/sigqueue.go:139 +0x130 +os/signal.loop() + /usr/local/go/src/os/signal/signal_unix.go:23 +0x14 +created by os/signal.init.0 + /usr/local/go/src/os/signal/signal_unix.go:29 +0x30 + +goroutine 13 [syscall]: +syscall.Syscall6(0x118, 0x1, 0x11ec, 0x10153b0, 0x1000004, 0x0, 0x0, 0x1c63c, 0x15e54, 0xe001e0) + /usr/local/go/src/syscall/asm_linux_arm.s:45 +0x8 +os.(*Process).blockUntilWaitable(0xe62840, 0xe62840, 0x0, 0x0) + /usr/local/go/src/os/wait_waitid.go:31 +0x64 +os.(*Process).wait(0xe62840, 0x1, 0xc0e360, 0xe00160) + /usr/local/go/src/os/exec_unix.go:22 +0x2c +os.(*Process).Wait(0xe62840, 0x4d5f58, 0x4d5f5c, 0x4d5f54) + /usr/local/go/src/os/exec.go:125 +0x1c +os/exec.(*Cmd).Wait(0xf8e0b0, 0x0, 0x0) + /usr/local/go/src/os/exec/exec.go:465 +0x40 +os/exec.(*Cmd).Run(0xf8e0b0, 0xca8060, 0xe6cd00) + /usr/local/go/src/os/exec/exec.go:309 +0x44 +cmd/go/internal/work.(*Builder).toolID(0xd5cf60, 0x49631b, 0x3, 0x11, 0x1015890) + /usr/local/go/src/cmd/go/internal/work/buildid.go:193 +0x2e0 +cmd/go/internal/work.(*Builder).buildActionID(0xd5cf60, 0xfb6210, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) + /usr/local/go/src/cmd/go/internal/work/exec.go:225 +0x11d4 +cmd/go/internal/work.(*Builder).build(0xd5cf60, 0xfb6210, 0x0, 0x0) + /usr/local/go/src/cmd/go/internal/work/exec.go:373 +0x3d3c +cmd/go/internal/work.(*Builder).Do.func1(0xfb6210) + /usr/local/go/src/cmd/go/internal/work/exec.go:107 +0x58 +cmd/go/internal/work.(*Builder).Do.func2(0xdf0070, 0xd5cf60, 0x10427a0) + /usr/local/go/src/cmd/go/internal/work/exec.go:165 +0x84 +created by cmd/go/internal/work.(*Builder).Do + /usr/local/go/src/cmd/go/internal/work/exec.go:152 +0x2e4 + +goroutine 14 [syscall]: +syscall.Syscall6(0x118, 0x1, 0x11ed, 0xe393b0, 0x1000004, 0x0, 0x0, 0x1c63c, 0x15e54, 0xd280f0) + /usr/local/go/src/syscall/asm_linux_arm.s:45 +0x8 +os.(*Process).blockUntilWaitable(0x115c4e0, 0x115c4e0, 0x0, 0x0) + /usr/local/go/src/os/wait_waitid.go:31 +0x64 +os.(*Process).wait(0x115c4e0, 0x1, 0xe78160, 0xd28070) + /usr/local/go/src/os/exec_unix.go:22 +0x2c +os.(*Process).Wait(0x115c4e0, 0x4d5f58, 0x4d5f5c, 0x4d5f54) + /usr/local/go/src/os/exec.go:125 +0x1c +os/exec.(*Cmd).Wait(0x10b8000, 0x0, 0x0) + /usr/local/go/src/os/exec/exec.go:465 +0x40 +os/exec.(*Cmd).Run(0x10b8000, 0xf3e060, 0xf0c000) + /usr/local/go/src/os/exec/exec.go:309 +0x44 +cmd/go/internal/work.(*Builder).toolID(0xd5cf60, 0x49631b, 0x3, 0x11, 0xe39890) + /usr/local/go/src/cmd/go/internal/work/buildid.go:193 +0x2e0 +cmd/go/internal/work.(*Builder).buildActionID(0xd5cf60, 0x1177b80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) + /usr/local/go/src/cmd/go/internal/work/exec.go:225 +0x11d4 +cmd/go/internal/work.(*Builder).build(0xd5cf60, 0x1177b80, 0x0, 0x0) + /usr/local/go/src/cmd/go/internal/work/exec.go:373 +0x3d3c +cmd/go/internal/work.(*Builder).Do.func1(0x1177b80) + /usr/local/go/src/cmd/go/internal/work/exec.go:107 +0x58 +cmd/go/internal/work.(*Builder).Do.func2(0xdf0070, 0xd5cf60, 0x10427a0) + /usr/local/go/src/cmd/go/internal/work/exec.go:165 +0x84 +created by cmd/go/internal/work.(*Builder).Do + /usr/local/go/src/cmd/go/internal/work/exec.go:152 +0x2e4 + +goroutine 16 [runnable]: +os/exec.(*Cmd).writerDescriptor(0x10b80b0, 0x54bd38, 0xf3e120, 0xf3e0c0, 0x0, 0x0) + /usr/local/go/src/os/exec/exec.go:257 +0x484 +os/exec.(*Cmd).stderr(0x10b80b0, 0x1112090, 0x0, 0x0) + /usr/local/go/src/os/exec/exec.go:254 +0xac +os/exec.(*Cmd).Start(0x10b80b0, 0x496701, 0xf3e120) + /usr/local/go/src/os/exec/exec.go:372 +0xa8 +os/exec.(*Cmd).Run(0x10b80b0, 0xf3e120, 0xf0c300) + /usr/local/go/src/os/exec/exec.go:306 +0x1c +cmd/go/internal/work.(*Builder).toolID(0xd5cf60, 0x49631b, 0x3, 0x11, 0xf49890) + /usr/local/go/src/cmd/go/internal/work/buildid.go:193 +0x2e0 +cmd/go/internal/work.(*Builder).buildActionID(0xd5cf60, 0x1177ce0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) + /usr/local/go/src/cmd/go/internal/work/exec.go:225 +0x11d4 +cmd/go/internal/work.(*Builder).build(0xd5cf60, 0x1177ce0, 0x0, 0x0) + /usr/local/go/src/cmd/go/internal/work/exec.go:373 +0x3d3c +cmd/go/internal/work.(*Builder).Do.func1(0x1177ce0) + /usr/local/go/src/cmd/go/internal/work/exec.go:107 +0x58 +cmd/go/internal/work.(*Builder).Do.func2(0xdf0070, 0xd5cf60, 0x10427a0) + /usr/local/go/src/cmd/go/internal/work/exec.go:165 +0x84 +created by cmd/go/internal/work.(*Builder).Do + /usr/local/go/src/cmd/go/internal/work/exec.go:152 +0x2e4 + +goroutine 82 [runnable]: +syscall.Syscall(0x3, 0xb, 0x11c2000, 0x8000, 0x0, 0x0, 0x0) + /usr/local/go/src/syscall/asm_linux_arm.s:14 +0x8 +syscall.read(0xb, 0x11c2000, 0x8000, 0x8000, 0x10ea501, 0x0, 0x0) + /usr/local/go/src/syscall/zsyscall_linux_arm.go:732 +0x40 +syscall.Read(0xb, 0x11c2000, 0x8000, 0x8000, 0xdedf9577, 0xe9841d9d, 0xdbb1d24e) + /usr/local/go/src/syscall/syscall_unix.go:172 +0x34 +internal/poll.(*FD).Read(0xd9c140, 0x11c2000, 0x8000, 0x8000, 0x0, 0x0, 0x0) + /usr/local/go/src/internal/poll/fd_unix.go:165 +0xf0 +os.(*File).read(0xcdc0f0, 0x11c2000, 0x8000, 0x8000, 0x11c3700, 0x1d, 0x6940) + /usr/local/go/src/os/file_unix.go:249 +0x3c +os.(*File).Read(0xcdc0f0, 0x11c2000, 0x8000, 0x8000, 0x171d, 0x0, 0x0) + /usr/local/go/src/os/file.go:108 +0x4c +io.copyBuffer(0xe77be000, 0xe88380, 0x54c3f8, 0xcdc0f0, 0x11c2000, 0x8000, 0x8000, 0x443d58, 0x47a900, 0x0, ...) + /usr/local/go/src/io/io.go:402 +0xd8 +io.Copy(0xe77be000, 0xe88380, 0x54c3f8, 0xcdc0f0, 0xe88380, 0x0, 0x40, 0xb) + /usr/local/go/src/io/io.go:364 +0x48 +cmd/go/internal/cache.FileHash(0xe628a0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ...) + /usr/local/go/src/cmd/go/internal/cache/hash.go:149 +0x240 +cmd/go/internal/work.(*Builder).fileHash(0xd5cf60, 0xe628a0, 0x25, 0xe628a0, 0x25) + /usr/local/go/src/cmd/go/internal/work/buildid.go:396 +0x24 +cmd/go/internal/work.(*Builder).buildActionID(0xd5cf60, 0x1177760, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) + /usr/local/go/src/cmd/go/internal/work/exec.go:292 +0x5ec +cmd/go/internal/work.(*Builder).build(0xd5cf60, 0x1177760, 0x0, 0x0) + /usr/local/go/src/cmd/go/internal/work/exec.go:373 +0x3d3c +cmd/go/internal/work.(*Builder).Do.func1(0x1177760) + /usr/local/go/src/cmd/go/internal/work/exec.go:107 +0x58 +cmd/go/internal/work.(*Builder).Do.func2(0xdf0070, 0xd5cf60, 0x10427a0) + /usr/local/go/src/cmd/go/internal/work/exec.go:165 +0x84 +created by cmd/go/internal/work.(*Builder).Do + /usr/local/go/src/cmd/go/internal/work/exec.go:152 +0x2e4 + +goroutine 83 [syscall]: +syscall.Syscall6(0x118, 0x1, 0x11d1, 0xf4d3b0, 0x1000004, 0x0, 0x0, 0x1c63c, 0x15e54, 0xe280b0) + /usr/local/go/src/syscall/asm_linux_arm.s:45 +0x8 +os.(*Process).blockUntilWaitable(0xf80330, 0xf80330, 0x0, 0x0) + /usr/local/go/src/os/wait_waitid.go:31 +0x64 +os.(*Process).wait(0xf80330, 0x1, 0xc7e1b0, 0xe28010) + /usr/local/go/src/os/exec_unix.go:22 +0x2c +os.(*Process).Wait(0xf80330, 0x4d5f58, 0x4d5f5c, 0x4d5f54) + /usr/local/go/src/os/exec.go:125 +0x1c +os/exec.(*Cmd).Wait(0x11760b0, 0x0, 0x0) + /usr/local/go/src/os/exec/exec.go:465 +0x40 +os/exec.(*Cmd).Run(0x11760b0, 0xfc8060, 0xefa800) + /usr/local/go/src/os/exec/exec.go:309 +0x44 +cmd/go/internal/work.(*Builder).toolID(0xd5cf60, 0x497ee2, 0x7, 0x2c, 0xf278e0) + /usr/local/go/src/cmd/go/internal/work/buildid.go:193 +0x2e0 +cmd/go/internal/work.(*Builder).buildActionID(0xd5cf60, 0x1177e40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) + /usr/local/go/src/cmd/go/internal/work/exec.go:223 +0xb8c +cmd/go/internal/work.(*Builder).build(0xd5cf60, 0x1177e40, 0x0, 0x0) + /usr/local/go/src/cmd/go/internal/work/exec.go:373 +0x3d3c +cmd/go/internal/work.(*Builder).Do.func1(0x1177e40) + /usr/local/go/src/cmd/go/internal/work/exec.go:107 +0x58 +cmd/go/internal/work.(*Builder).Do.func2(0xdf0070, 0xd5cf60, 0x10427a0) + /usr/local/go/src/cmd/go/internal/work/exec.go:165 +0x84 +created by cmd/go/internal/work.(*Builder).Do + /usr/local/go/src/cmd/go/internal/work/exec.go:152 +0x2e4 + +goroutine 84 [syscall]: +syscall.Syscall6(0x118, 0x1, 0x11cf, 0xf453b0, 0x1000004, 0x0, 0x0, 0x1c63c, 0x15e54, 0xeba040) + /usr/local/go/src/syscall/asm_linux_arm.s:45 +0x8 +os.(*Process).blockUntilWaitable(0xf74180, 0xf74180, 0x0, 0x0) + /usr/local/go/src/os/wait_waitid.go:31 +0x64 +os.(*Process).wait(0xf74180, 0x1, 0x1112070, 0x100e010) + /usr/local/go/src/os/exec_unix.go:22 +0x2c +os.(*Process).Wait(0xf74180, 0x4d5f58, 0x4d5f5c, 0x4d5f54) + /usr/local/go/src/os/exec.go:125 +0x1c +os/exec.(*Cmd).Wait(0xfe8000, 0x0, 0x0) + /usr/local/go/src/os/exec/exec.go:465 +0x40 +os/exec.(*Cmd).Run(0xfe8000, 0xe10060, 0xf18000) + /usr/local/go/src/os/exec/exec.go:309 +0x44 +cmd/go/internal/work.(*Builder).toolID(0xd5cf60, 0x497ee2, 0x7, 0x2c, 0x10878e0) + /usr/local/go/src/cmd/go/internal/work/buildid.go:193 +0x2e0 +cmd/go/internal/work.(*Builder).buildActionID(0xd5cf60, 0x1177a20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) + /usr/local/go/src/cmd/go/internal/work/exec.go:223 +0xb8c +cmd/go/internal/work.(*Builder).build(0xd5cf60, 0x1177a20, 0x0, 0x0) + /usr/local/go/src/cmd/go/internal/work/exec.go:373 +0x3d3c +cmd/go/internal/work.(*Builder).Do.func1(0x1177a20) + /usr/local/go/src/cmd/go/internal/work/exec.go:107 +0x58 +cmd/go/internal/work.(*Builder).Do.func2(0xdf0070, 0xd5cf60, 0x10427a0) + /usr/local/go/src/cmd/go/internal/work/exec.go:165 +0x84 +created by cmd/go/internal/work.(*Builder).Do + /usr/local/go/src/cmd/go/internal/work/exec.go:152 +0x2e4 + +goroutine 85 [syscall]: +syscall.Syscall6(0x118, 0x1, 0x11d5, 0xe373b0, 0x1000004, 0x0, 0x0, 0x1c63c, 0x15e54, 0xeba050) + /usr/local/go/src/syscall/asm_linux_arm.s:45 +0x8 +os.(*Process).blockUntilWaitable(0xf741b0, 0xf741b0, 0x0, 0x0) + /usr/local/go/src/os/wait_waitid.go:31 +0x64 +os.(*Process).wait(0xf741b0, 0x50, 0xc0e290, 0xe00090) + /usr/local/go/src/os/exec_unix.go:22 +0x2c +os.(*Process).Wait(0xf741b0, 0x4d5f58, 0x4d5f5c, 0x4d5f54) + /usr/local/go/src/os/exec.go:125 +0x1c +os/exec.(*Cmd).Wait(0xf8e000, 0x0, 0x0) + /usr/local/go/src/os/exec/exec.go:465 +0x40 +os/exec.(*Cmd).Run(0xf8e000, 0xcb5e00, 0xe6ca00) + /usr/local/go/src/os/exec/exec.go:309 +0x44 +cmd/go/internal/work.(*Builder).toolID(0xd5cf60, 0x497ee2, 0x7, 0x2c, 0xf2b8e0) + /usr/local/go/src/cmd/go/internal/work/buildid.go:193 +0x2e0 +cmd/go/internal/work.(*Builder).buildActionID(0xd5cf60, 0x1177ef0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) + /usr/local/go/src/cmd/go/internal/work/exec.go:223 +0xb8c +cmd/go/internal/work.(*Builder).build(0xd5cf60, 0x1177ef0, 0x0, 0x0) + /usr/local/go/src/cmd/go/internal/work/exec.go:373 +0x3d3c +cmd/go/internal/work.(*Builder).Do.func1(0x1177ef0) + /usr/local/go/src/cmd/go/internal/work/exec.go:107 +0x58 +cmd/go/internal/work.(*Builder).Do.func2(0xdf0070, 0xd5cf60, 0x10427a0) + /usr/local/go/src/cmd/go/internal/work/exec.go:165 +0x84 +created by cmd/go/internal/work.(*Builder).Do + /usr/local/go/src/cmd/go/internal/work/exec.go:152 +0x2e4 + +goroutine 31 [IO wait]: +internal/poll.runtime_pollWait(0xecac29c0, 0x72, 0x9cc90) + /usr/local/go/src/runtime/netpoll.go:173 +0x44 +internal/poll.(*pollDesc).wait(0xd7c3d4, 0x72, 0xffffff01, 0x54cc68, 0x7e0240) + /usr/local/go/src/internal/poll/fd_poll_runtime.go:85 +0x7c +internal/poll.(*pollDesc).waitRead(0xd7c3d4, 0x1040601, 0x200, 0x200) + /usr/local/go/src/internal/poll/fd_poll_runtime.go:90 +0x2c +internal/poll.(*FD).Read(0xd7c3c0, 0x1040600, 0x200, 0x200, 0x0, 0x0, 0x0) + /usr/local/go/src/internal/poll/fd_unix.go:169 +0x14c +os.(*File).read(0xe78168, 0x1040600, 0x200, 0x200, 0x1040600, 0x0, 0x0) + /usr/local/go/src/os/file_unix.go:249 +0x3c +os.(*File).Read(0xe78168, 0x1040600, 0x200, 0x200, 0xe9d2f000, 0xff667d78, 0x3) + /usr/local/go/src/os/file.go:108 +0x4c +bytes.(*Buffer).ReadFrom(0xf3e060, 0x54c3f8, 0xe78168, 0xe9d2f000, 0xf3e060, 0x1b001, 0xcf62b0) + /usr/local/go/src/bytes/buffer.go:206 +0xb0 +io.copyBuffer(0x54bd38, 0xf3e060, 0x54c3f8, 0xe78168, 0x0, 0x0, 0x0, 0x0, 0xcf60c0, 0x0, ...) + /usr/local/go/src/io/io.go:388 +0x300 +io.Copy(0x54bd38, 0xf3e060, 0x54c3f8, 0xe78168, 0x19, 0xfa910, 0xcf6280, 0xf977dc) + /usr/local/go/src/io/io.go:364 +0x48 +os/exec.(*Cmd).writerDescriptor.func1(0xcf6280, 0xf977dc) + /usr/local/go/src/os/exec/exec.go:279 +0x38 +os/exec.(*Cmd).Start.func1(0x10b8000, 0xd280c0) + /usr/local/go/src/os/exec/exec.go:400 +0x1c +created by os/exec.(*Cmd).Start + /usr/local/go/src/os/exec/exec.go:399 +0x41c + +goroutine 30 [IO wait]: +internal/poll.runtime_pollWait(0xecac2dc0, 0x72, 0x9cc90) + /usr/local/go/src/runtime/netpoll.go:173 +0x44 +internal/poll.(*pollDesc).wait(0xd7c354, 0x72, 0xffffff01, 0x54cc68, 0x7e0240) + /usr/local/go/src/internal/poll/fd_poll_runtime.go:85 +0x7c +internal/poll.(*pollDesc).waitRead(0xd7c354, 0xddc001, 0x200, 0x200) + /usr/local/go/src/internal/poll/fd_poll_runtime.go:90 +0x2c +internal/poll.(*FD).Read(0xd7c340, 0xddc000, 0x200, 0x200, 0x0, 0x0, 0x0) + /usr/local/go/src/internal/poll/fd_unix.go:169 +0x14c +os.(*File).read(0xe78148, 0xddc000, 0x200, 0x200, 0xddc000, 0x0, 0x0) + /usr/local/go/src/os/file_unix.go:249 +0x3c +os.(*File).Read(0xe78148, 0xddc000, 0x200, 0x200, 0xe9d2f000, 0xff667d78, 0x5) + /usr/local/go/src/os/file.go:108 +0x4c +bytes.(*Buffer).ReadFrom(0xf3e000, 0x54c3f8, 0xe78148, 0xe9d2f000, 0xf3e000, 0x1b001, 0xcf62b0) + /usr/local/go/src/bytes/buffer.go:206 +0xb0 +io.copyBuffer(0x54bd38, 0xf3e000, 0x54c3f8, 0xe78148, 0x0, 0x0, 0x0, 0x0, 0xcf6140, 0x0, ...) + /usr/local/go/src/io/io.go:388 +0x300 +io.Copy(0x54bd38, 0xf3e000, 0x54c3f8, 0xe78148, 0x0, 0xfa910, 0xcf6280, 0xf95fdc) + /usr/local/go/src/io/io.go:364 +0x48 +os/exec.(*Cmd).writerDescriptor.func1(0xcf6280, 0xf95fdc) + /usr/local/go/src/os/exec/exec.go:279 +0x38 +os/exec.(*Cmd).Start.func1(0x10b8000, 0xd280a0) + /usr/local/go/src/os/exec/exec.go:400 +0x1c +created by os/exec.(*Cmd).Start + /usr/local/go/src/os/exec/exec.go:399 +0x41c + +goroutine 37 [IO wait]: +internal/poll.runtime_pollWait(0xecac2f40, 0x72, 0x9cc90) + /usr/local/go/src/runtime/netpoll.go:173 +0x44 +internal/poll.(*pollDesc).wait(0xdc8514, 0x72, 0xffffff01, 0x54cc68, 0x7e0240) + /usr/local/go/src/internal/poll/fd_poll_runtime.go:85 +0x7c +internal/poll.(*pollDesc).waitRead(0xdc8514, 0x1040801, 0x200, 0x200) + /usr/local/go/src/internal/poll/fd_poll_runtime.go:90 +0x2c +internal/poll.(*FD).Read(0xdc8500, 0x1040800, 0x200, 0x200, 0x0, 0x0, 0x0) + /usr/local/go/src/internal/poll/fd_unix.go:169 +0x14c +os.(*File).read(0xc0e338, 0x1040800, 0x200, 0x200, 0x1040800, 0x0, 0x0) + /usr/local/go/src/os/file_unix.go:249 +0x3c +os.(*File).Read(0xc0e338, 0x1040800, 0x200, 0x200, 0xe9d2f000, 0xff669250, 0x3) + /usr/local/go/src/os/file.go:108 +0x4c +bytes.(*Buffer).ReadFrom(0xca8000, 0x54c3f8, 0xc0e338, 0xe9d2f000, 0xca8000, 0x16601, 0xc36f54) + /usr/local/go/src/bytes/buffer.go:206 +0xb0 +io.copyBuffer(0x54bd38, 0xca8000, 0x54c3f8, 0xc0e338, 0x0, 0x0, 0x0, 0x0, 0xd9c0c0, 0x0, ...) + /usr/local/go/src/io/io.go:388 +0x300 +io.Copy(0x54bd38, 0xca8000, 0x54c3f8, 0xc0e338, 0xd9c100, 0xfa910, 0xd9c100, 0xc36fdc) + /usr/local/go/src/io/io.go:364 +0x48 +os/exec.(*Cmd).writerDescriptor.func1(0xd9c100, 0xc36fdc) + /usr/local/go/src/os/exec/exec.go:279 +0x38 +os/exec.(*Cmd).Start.func1(0xf8e0b0, 0xe00190) + /usr/local/go/src/os/exec/exec.go:400 +0x1c +created by os/exec.(*Cmd).Start + /usr/local/go/src/os/exec/exec.go:399 +0x41c + +goroutine 114 [IO wait]: +internal/poll.runtime_pollWait(0xecac23c0, 0x72, 0x9cc90) + /usr/local/go/src/runtime/netpoll.go:173 +0x44 +internal/poll.(*pollDesc).wait(0xce8694, 0x72, 0xffffff01, 0x54cc68, 0x7e0240) + /usr/local/go/src/internal/poll/fd_poll_runtime.go:85 +0x7c +internal/poll.(*pollDesc).waitRead(0xce8694, 0x108e001, 0x200, 0x200) + /usr/local/go/src/internal/poll/fd_poll_runtime.go:90 +0x2c +internal/poll.(*FD).Read(0xce8680, 0x108e000, 0x200, 0x200, 0x0, 0x0, 0x0) + /usr/local/go/src/internal/poll/fd_unix.go:169 +0x14c +os.(*File).read(0xe6e1b8, 0x108e000, 0x200, 0x200, 0x108e000, 0x0, 0x0) + /usr/local/go/src/os/file_unix.go:249 +0x3c +os.(*File).Read(0xe6e1b8, 0x108e000, 0x200, 0x200, 0xe9d2f000, 0x4e9d0, 0xc37f18) + /usr/local/go/src/os/file.go:108 +0x4c +bytes.(*Buffer).ReadFrom(0x1024000, 0x54c3f8, 0xe6e1b8, 0xe9d2f000, 0x1024000, 0x1177a01, 0xd5cf98) + /usr/local/go/src/bytes/buffer.go:206 +0xb0 +io.copyBuffer(0x54bd38, 0x1024000, 0x54c3f8, 0xe6e1b8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, ...) + /usr/local/go/src/io/io.go:388 +0x300 +io.Copy(0x54bd38, 0x1024000, 0x54c3f8, 0xe6e1b8, 0x1, 0x0, 0x0, 0x0) + /usr/local/go/src/io/io.go:364 +0x48 +os/exec.(*Cmd).writerDescriptor.func1(0x0, 0x0) + /usr/local/go/src/os/exec/exec.go:279 +0x38 +os/exec.(*Cmd).Start.func1(0xe14000, 0x1042840) + /usr/local/go/src/os/exec/exec.go:400 +0x1c +created by os/exec.(*Cmd).Start + /usr/local/go/src/os/exec/exec.go:399 +0x41c + +goroutine 115 [IO wait]: +internal/poll.runtime_pollWait(0xecac22c0, 0x72, 0x9cc90) + /usr/local/go/src/runtime/netpoll.go:173 +0x44 +internal/poll.(*pollDesc).wait(0xce8714, 0x72, 0xffffff01, 0x54cc68, 0x7e0240) + /usr/local/go/src/internal/poll/fd_poll_runtime.go:85 +0x7c +internal/poll.(*pollDesc).waitRead(0xce8714, 0x108e601, 0x200, 0x200) + /usr/local/go/src/internal/poll/fd_poll_runtime.go:90 +0x2c +internal/poll.(*FD).Read(0xce8700, 0x108e600, 0x200, 0x200, 0x0, 0x0, 0x0) + /usr/local/go/src/internal/poll/fd_unix.go:169 +0x14c +os.(*File).read(0xe6e1d8, 0x108e600, 0x200, 0x200, 0x108e600, 0x0, 0x0) + /usr/local/go/src/os/file_unix.go:249 +0x3c +os.(*File).Read(0xe6e1d8, 0x108e600, 0x200, 0x200, 0xe9d2f000, 0x0, 0x0) + /usr/local/go/src/os/file.go:108 +0x4c +bytes.(*Buffer).ReadFrom(0xd5c720, 0x54c3f8, 0xe6e1d8, 0xe9d2f000, 0xd5c720, 0x1, 0x0) + /usr/local/go/src/bytes/buffer.go:206 +0xb0 +io.copyBuffer(0x54bd38, 0xd5c720, 0x54c3f8, 0xe6e1d8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ...) + /usr/local/go/src/io/io.go:388 +0x300 +io.Copy(0x54bd38, 0xd5c720, 0x54c3f8, 0xe6e1d8, 0x0, 0x0, 0x0, 0x0) + /usr/local/go/src/io/io.go:364 +0x48 +os/exec.(*Cmd).writerDescriptor.func1(0x0, 0x0) + /usr/local/go/src/os/exec/exec.go:279 +0x38 +os/exec.(*Cmd).Start.func1(0xe14000, 0x1042860) + /usr/local/go/src/os/exec/exec.go:400 +0x1c +created by os/exec.(*Cmd).Start + /usr/local/go/src/os/exec/exec.go:399 +0x41c + +goroutine 116 [IO wait]: +internal/poll.runtime_pollWait(0xecac2c40, 0x72, 0x9cc90) + /usr/local/go/src/runtime/netpoll.go:173 +0x44 +internal/poll.(*pollDesc).wait(0xc72214, 0x72, 0xffffff01, 0x54cc68, 0x7e0240) + /usr/local/go/src/internal/poll/fd_poll_runtime.go:85 +0x7c +internal/poll.(*pollDesc).waitRead(0xc72214, 0xea4201, 0x200, 0x200) + /usr/local/go/src/internal/poll/fd_poll_runtime.go:90 +0x2c +internal/poll.(*FD).Read(0xc72200, 0xea4200, 0x200, 0x200, 0x0, 0x0, 0x0) + /usr/local/go/src/internal/poll/fd_unix.go:169 +0x14c +os.(*File).read(0xc7e190, 0xea4200, 0x200, 0x200, 0xea4200, 0x0, 0x0) + /usr/local/go/src/os/file_unix.go:249 +0x3c +os.(*File).Read(0xc7e190, 0xea4200, 0x200, 0x200, 0xe9d2f000, 0x3e206820, 0x3331203e) + /usr/local/go/src/os/file.go:108 +0x4c +bytes.(*Buffer).ReadFrom(0xfc8000, 0x54c3f8, 0xc7e190, 0xe9d2f000, 0xfc8000, 0x61686d01, 0x32336873) + /usr/local/go/src/bytes/buffer.go:206 +0xb0 +io.copyBuffer(0x54bd38, 0xfc8000, 0x54c3f8, 0xc7e190, 0x0, 0x0, 0x0, 0x34202b20, 0x7361682a, 0x79656b68, ...) + /usr/local/go/src/io/io.go:388 +0x300 +io.Copy(0x54bd38, 0xfc8000, 0x54c3f8, 0xc7e190, 0x70283233, 0x68090a29, 0x72203d20, 0x5f6c746f) + /usr/local/go/src/io/io.go:364 +0x48 +os/exec.(*Cmd).writerDescriptor.func1(0x203d5e20, 0x3e3e2068) + /usr/local/go/src/os/exec/exec.go:279 +0x38 +os/exec.(*Cmd).Start.func1(0x11760b0, 0xe28040) + /usr/local/go/src/os/exec/exec.go:400 +0x1c +created by os/exec.(*Cmd).Start + /usr/local/go/src/os/exec/exec.go:399 +0x41c + +goroutine 117 [IO wait]: +internal/poll.runtime_pollWait(0xecac2740, 0x72, 0x9cc90) + /usr/local/go/src/runtime/netpoll.go:173 +0x44 +internal/poll.(*pollDesc).wait(0xc72294, 0x72, 0xffffff01, 0x54cc68, 0x7e0240) + /usr/local/go/src/internal/poll/fd_poll_runtime.go:85 +0x7c +internal/poll.(*pollDesc).waitRead(0xc72294, 0xea4001, 0x200, 0x200) + /usr/local/go/src/internal/poll/fd_poll_runtime.go:90 +0x2c +internal/poll.(*FD).Read(0xc72280, 0xea4000, 0x200, 0x200, 0x0, 0x0, 0x0) + /usr/local/go/src/internal/poll/fd_unix.go:169 +0x14c +os.(*File).read(0xc7e1b8, 0xea4000, 0x200, 0x200, 0xea4000, 0x0, 0x0) + /usr/local/go/src/os/file_unix.go:249 +0x3c +os.(*File).Read(0xc7e1b8, 0xea4000, 0x200, 0x200, 0xe9d2f000, 0x0, 0x0) + /usr/local/go/src/os/file.go:108 +0x4c +bytes.(*Buffer).ReadFrom(0xfc8060, 0x54c3f8, 0xc7e1b8, 0xe9d2f000, 0xfc8060, 0x1, 0x0) + /usr/local/go/src/bytes/buffer.go:206 +0xb0 +io.copyBuffer(0x54bd38, 0xfc8060, 0x54c3f8, 0xc7e1b8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ...) + /usr/local/go/src/io/io.go:388 +0x300 +io.Copy(0x54bd38, 0xfc8060, 0x54c3f8, 0xc7e1b8, 0x0, 0x0, 0x0, 0x0) + /usr/local/go/src/io/io.go:364 +0x48 +os/exec.(*Cmd).writerDescriptor.func1(0x0, 0x0) + /usr/local/go/src/os/exec/exec.go:279 +0x38 +os/exec.(*Cmd).Start.func1(0x11760b0, 0xe28070) + /usr/local/go/src/os/exec/exec.go:400 +0x1c +created by os/exec.(*Cmd).Start + /usr/local/go/src/os/exec/exec.go:399 +0x41c + +goroutine 130 [IO wait]: +internal/poll.runtime_pollWait(0xecac25c0, 0x72, 0x9cc90) + /usr/local/go/src/runtime/netpoll.go:173 +0x44 +internal/poll.(*pollDesc).wait(0xc8a114, 0x72, 0xffffff01, 0x54cc68, 0x7e0240) + /usr/local/go/src/internal/poll/fd_poll_runtime.go:85 +0x7c +internal/poll.(*pollDesc).waitRead(0xc8a114, 0xea4401, 0x200, 0x200) + /usr/local/go/src/internal/poll/fd_poll_runtime.go:90 +0x2c +internal/poll.(*FD).Read(0xc8a100, 0xea4400, 0x200, 0x200, 0x0, 0x0, 0x0) + /usr/local/go/src/internal/poll/fd_unix.go:169 +0x14c +os.(*File).read(0x1112058, 0xea4400, 0x200, 0x200, 0xea4400, 0x0, 0x0) + /usr/local/go/src/os/file_unix.go:249 +0x3c +os.(*File).Read(0x1112058, 0xea4400, 0x200, 0x200, 0xe9d2f000, 0x0, 0x0) + /usr/local/go/src/os/file.go:108 +0x4c +bytes.(*Buffer).ReadFrom(0xe10000, 0x54c3f8, 0x1112058, 0xe9d2f000, 0xe10000, 0x1177d01, 0xd5cf98) + /usr/local/go/src/bytes/buffer.go:206 +0xb0 +io.copyBuffer(0x54bd38, 0xe10000, 0x54c3f8, 0x1112058, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, ...) + /usr/local/go/src/io/io.go:388 +0x300 +io.Copy(0x54bd38, 0xe10000, 0x54c3f8, 0x1112058, 0x1, 0x0, 0x0, 0x0) + /usr/local/go/src/io/io.go:364 +0x48 +os/exec.(*Cmd).writerDescriptor.func1(0x0, 0x0) + /usr/local/go/src/os/exec/exec.go:279 +0x38 +os/exec.(*Cmd).Start.func1(0xfe8000, 0x100e040) + /usr/local/go/src/os/exec/exec.go:400 +0x1c +created by os/exec.(*Cmd).Start + /usr/local/go/src/os/exec/exec.go:399 +0x41c + +goroutine 131 [IO wait]: +internal/poll.runtime_pollWait(0xecac24c0, 0x72, 0x9cc90) + /usr/local/go/src/runtime/netpoll.go:173 +0x44 +internal/poll.(*pollDesc).wait(0xc8a214, 0x72, 0xffffff01, 0x54cc68, 0x7e0240) + /usr/local/go/src/internal/poll/fd_poll_runtime.go:85 +0x7c +internal/poll.(*pollDesc).waitRead(0xc8a214, 0x1044001, 0x200, 0x200) + /usr/local/go/src/internal/poll/fd_poll_runtime.go:90 +0x2c +internal/poll.(*FD).Read(0xc8a200, 0x1044000, 0x200, 0x200, 0x0, 0x0, 0x0) + /usr/local/go/src/internal/poll/fd_unix.go:169 +0x14c +os.(*File).read(0x1112078, 0x1044000, 0x200, 0x200, 0x1044000, 0x0, 0x0) + /usr/local/go/src/os/file_unix.go:249 +0x3c +os.(*File).Read(0x1112078, 0x1044000, 0x200, 0x200, 0xe9d2f000, 0xa, 0x2) + /usr/local/go/src/os/file.go:108 +0x4c +bytes.(*Buffer).ReadFrom(0xe10060, 0x54c3f8, 0x1112078, 0xe9d2f000, 0xe10060, 0x1, 0x2) + /usr/local/go/src/bytes/buffer.go:206 +0xb0 +io.copyBuffer(0x54bd38, 0xe10060, 0x54c3f8, 0x1112078, 0x0, 0x0, 0x0, 0xee3e90, 0x27, 0xd2, ...) + /usr/local/go/src/io/io.go:388 +0x300 +io.Copy(0x54bd38, 0xe10060, 0x54c3f8, 0x1112078, 0x2, 0xedca50, 0x2b, 0xbc) + /usr/local/go/src/io/io.go:364 +0x48 +os/exec.(*Cmd).writerDescriptor.func1(0x0, 0x0) + /usr/local/go/src/os/exec/exec.go:279 +0x38 +os/exec.(*Cmd).Start.func1(0xfe8000, 0x100e060) + /usr/local/go/src/os/exec/exec.go:400 +0x1c +created by os/exec.(*Cmd).Start + /usr/local/go/src/os/exec/exec.go:399 +0x41c + +goroutine 132 [IO wait]: +internal/poll.runtime_pollWait(0xecac2240, 0x72, 0x9cc90) + /usr/local/go/src/runtime/netpoll.go:173 +0x44 +internal/poll.(*pollDesc).wait(0xdc82d4, 0x72, 0xffffff01, 0x54cc68, 0x7e0240) + /usr/local/go/src/internal/poll/fd_poll_runtime.go:85 +0x7c +internal/poll.(*pollDesc).waitRead(0xdc82d4, 0x1044201, 0x200, 0x200) + /usr/local/go/src/internal/poll/fd_poll_runtime.go:90 +0x2c +internal/poll.(*FD).Read(0xdc82c0, 0x1044200, 0x200, 0x200, 0x0, 0x0, 0x0) + /usr/local/go/src/internal/poll/fd_unix.go:169 +0x14c +os.(*File).read(0xc0e270, 0x1044200, 0x200, 0x200, 0x1044200, 0x0, 0x0) + /usr/local/go/src/os/file_unix.go:249 +0x3c +os.(*File).Read(0xc0e270, 0x1044200, 0x200, 0x200, 0xe9d2f000, 0x0, 0x0) + /usr/local/go/src/os/file.go:108 +0x4c +bytes.(*Buffer).ReadFrom(0xcb5800, 0x54c3f8, 0xc0e270, 0xe9d2f000, 0xcb5800, 0x1, 0x0) + /usr/local/go/src/bytes/buffer.go:206 +0xb0 +io.copyBuffer(0x54bd38, 0xcb5800, 0x54c3f8, 0xc0e270, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ...) + /usr/local/go/src/io/io.go:388 +0x300 +io.Copy(0x54bd38, 0xcb5800, 0x54c3f8, 0xc0e270, 0x0, 0x0, 0x0, 0x0) + /usr/local/go/src/io/io.go:364 +0x48 +os/exec.(*Cmd).writerDescriptor.func1(0x0, 0xcc9f80) + /usr/local/go/src/os/exec/exec.go:279 +0x38 +os/exec.(*Cmd).Start.func1(0xf8e000, 0xe000c0) + /usr/local/go/src/os/exec/exec.go:400 +0x1c +created by os/exec.(*Cmd).Start + /usr/local/go/src/os/exec/exec.go:399 +0x41c + +goroutine 133 [IO wait]: +internal/poll.runtime_pollWait(0xecac27c0, 0x72, 0x9cc90) + /usr/local/go/src/runtime/netpoll.go:173 +0x44 +internal/poll.(*pollDesc).wait(0xdc8354, 0x72, 0xffffff01, 0x54cc68, 0x7e0240) + /usr/local/go/src/internal/poll/fd_poll_runtime.go:85 +0x7c +internal/poll.(*pollDesc).waitRead(0xdc8354, 0x1040401, 0x200, 0x200) + /usr/local/go/src/internal/poll/fd_poll_runtime.go:90 +0x2c +internal/poll.(*FD).Read(0xdc8340, 0x1040400, 0x200, 0x200, 0x0, 0x0, 0x0) + /usr/local/go/src/internal/poll/fd_unix.go:169 +0x14c +os.(*File).read(0xc0e298, 0x1040400, 0x200, 0x200, 0x1040400, 0x0, 0x0) + /usr/local/go/src/os/file_unix.go:249 +0x3c +os.(*File).Read(0xc0e298, 0x1040400, 0x200, 0x200, 0xe9d2f000, 0x0, 0x10b81d0) + /usr/local/go/src/os/file.go:108 +0x4c +bytes.(*Buffer).ReadFrom(0xcb5e00, 0x54c3f8, 0xc0e298, 0xe9d2f000, 0xcb5e00, 0x1, 0x0) + /usr/local/go/src/bytes/buffer.go:206 +0xb0 +io.copyBuffer(0x54bd38, 0xcb5e00, 0x54c3f8, 0xc0e298, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ...) + /usr/local/go/src/io/io.go:388 +0x300 +io.Copy(0x54bd38, 0xcb5e00, 0x54c3f8, 0xc0e298, 0x0, 0x0, 0x0, 0x0) + /usr/local/go/src/io/io.go:364 +0x48 +os/exec.(*Cmd).writerDescriptor.func1(0x0, 0x0) + /usr/local/go/src/os/exec/exec.go:279 +0x38 +os/exec.(*Cmd).Start.func1(0xf8e000, 0xe000e0) + /usr/local/go/src/os/exec/exec.go:400 +0x1c +created by os/exec.(*Cmd).Start + /usr/local/go/src/os/exec/exec.go:399 +0x41c +qemu: uncaught target signal 11 (Segmentation fault) - core dumped +Segmentation fault (core dumped) + + + + +-------------- + +With newer golang version +go version +go version go1.11.9 linux/arm +- show quoted text - +GOGCCFLAGS="-fPIC -marm -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build218432843=/tmp/go-build -gno-record-gcc-switches" + + +$ /usr/local/go/bin/go get -v github.com/Azure/sonic-telemetry/dialout/dialout_client_cli +panic: runtime error: invalid memory address or nil pointer dereference +[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x66180] + +goroutine 11fatal error: [malloc deadlock +, panic during panic +[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x66180] + +108033889401^Ifatal error: unexpected signal during runtime execution +stack trace unavailable \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1839325 b/results/classifier/mode-deepseek-r1:32b/output/system/1839325 new file mode 100644 index 00000000..cf3118fd --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1839325 @@ -0,0 +1,73 @@ + + +Go programs crash on qemu-sh4 due to issues with atomics + +After #1738545 [1] was fixed, Go applications work fine on qemu-arm but still crash on qemu-sh4. From the backtrace, it looks like an issue with the atomics in qemu-sh4: + +(sid-sh4-sbuild)root@epyc:/# cat hello.go +package main + +import "fmt" + +func main() { + fmt.Println("hello world") +} + +(sid-sh4-sbuild)root@epyc:/# gccgo-9 hello.go -o hello +(sid-sh4-sbuild)root@epyc:/# ./hello +panic: ( runtime runtime.errorString) (0x7f74527c,0x80a038) +fatal error: panic on system stack +panic: ( runtime runtime.errorString) (0x7f74527c,0x80a038) +fatal error: panic on system stack + +runtime stack: +runtime..z2finternal..z2fatomic.Load64 + ../../../src/libgo/go/runtime/internal/atomic/atomic.c:37 +runtime_mstart + ../../../src/libgo/runtime/proc.c:596 + +goroutine 1 [running]: + goroutine running on other thread; stack unavailable + +runtime stack: +runtime..z2finternal..z2fatomic.Load64 + ../../../src/libgo/go/runtime/internal/atomic/atomic.c:37 +runtime_mstart + ../../../src/libgo/runtime/proc.c:596 +(sid-sh4-sbuild)root@epyc:/# + +The same sample Go program runs fine on my SH7785LCR SH4 evaluation board: + +root@tirpitz:~> uname -a +Linux tirpitz 3.16.7-ckt7 #8 PREEMPT Fri Oct 21 18:47:41 CEST 2016 sh4a GNU/Linux +root@tirpitz:~> cat hello.go +package main + +import "fmt" + +func main() { + fmt.Println("hello world") +} + +root@tirpitz:~> gccgo-9 hello.go -o hello +root@tirpitz:~> ./hello +hello world +root@tirpitz:~> + +Please note: In order to be able to reproduce this, one also needs to revert commit 61dedf2af7 [2], otherwise the Go application crashes differently: + +(sid-sh4-sbuild)root@epyc:/# ./hello +Unhandled trap: 0x180 +pc=0x7e5f7f9e sr=0x00000000 pr=0x7ee3d582 fpscr=0x00080004 +spc=0x00000000 ssr=0x00000000 gbr=0x7e590480 vbr=0x00000000 +sgr=0x00000000 dbr=0x00000000 delayed_pc=0x7e5f7f60 fpul=0x00034f3b +r0=0x008007d4 r1=0x00000000 r2=0xfffe0b2a r3=0x00000002 +r4=0x008006e4 r5=0x00872000 r6=0x00200000 r7=0x00000000 +r8=0x7f7bca7c r9=0x7fffebd4 r10=0x00800480 r11=0x7f7bc0f0 +r12=0x7f7a3fa4 r13=0x008004c0 r14=0x7f7b2238 r15=0x7fffebd0 +r16=0x00000000 r17=0x00000000 r18=0x00000000 r19=0x00000000 +r20=0x00000000 r21=0x00000000 r22=0x00000000 r23=0x00000000 +(sid-sh4-sbuild)root@epyc:/# + +> [1] https://bugs.launchpad.net/bugs/1738545 +> [2] https://bugs.launchpad.net/bugs/1796520 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/184 b/results/classifier/mode-deepseek-r1:32b/output/system/184 new file mode 100644 index 00000000..af983e6a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/184 @@ -0,0 +1,3 @@ + + +SSE CMP ops with 8bit immediate throw sigill with oversized byte diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1840 b/results/classifier/mode-deepseek-r1:32b/output/system/1840 new file mode 100644 index 00000000..938127b3 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1840 @@ -0,0 +1,3 @@ + + +Amend RISCV machine default value diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1840646 b/results/classifier/mode-deepseek-r1:32b/output/system/1840646 new file mode 100644 index 00000000..546778d6 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1840646 @@ -0,0 +1,13 @@ + + +qemu-4.1.0/roms/SLOF/lib/libnet/ping.c:122: logical fault + +qemu-4.1.0/roms/SLOF/lib/libnet/ping.c:122:16: warning: Logical conjunction always evaluates to false: alen <= 0 && alen >= sizeof(args) - 1. [incorrectLogicOperator] + +Source code is + + if (alen <= 0 && alen >= sizeof(args) - 1) { + +Maybe better code: + + if (alen <= 0 || alen >= sizeof(args) - 1) { \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1841491 b/results/classifier/mode-deepseek-r1:32b/output/system/1841491 new file mode 100644 index 00000000..a1d01822 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1841491 @@ -0,0 +1,37 @@ + + +floating point emulation can fail to set FE_UNDERFLOW + +Floating point emulation can fail to set FE_UNDERFLOW in some circumstances. This shows up often in glibc's "math" tests. A similar test is attached. + +This is similar to bug #1841442, but not the same problem, and I don't think the fix will be in the same code. + +On ppc64le native: +-- +$ gcc -c -O2 fma.c +$ gcc -O2 test-fma.c fma.o -lm -o test-fma +$ ./test-fma $(./test-fma) +fma(0x1.ffffffffffffcp-1022, 0x1.0000000000001p-1, 0x0.0000000000001p-1022) +0x0 + +0xa000000 +FE_INEXACT FE_UNDERFLOW +0x1p-1022 +-- + +On qemu-system-ppc64: +-- +$ ./test-fma $(./test-fma) +fma(0x1.ffffffffffffcp-1022, 0x1.0000000000001p-1, 0x0.0000000000001p-1022) +0x0 + +0x2000000 +FE_INEXACT +0x1p-1022 +-- + +QEMU versions vary, but not too much, and are pretty close to git HEAD: +- 586f3dced9 (HEAD -> master, origin/master, origin/HEAD) Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20190822' into staging +- 864ab31 Update version for v4.1.0-rc4 release + +There are worse symptoms on qemu-x86_64, but this is apparently not surprising per https://bugs.launchpad.net/qemu/+bug/1841442/comments/6. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1841592 b/results/classifier/mode-deepseek-r1:32b/output/system/1841592 new file mode 100644 index 00000000..e0c4da79 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1841592 @@ -0,0 +1,11 @@ + + +ppc: softfloat float implementation issues + +Per bug #1841491, Richard Henderson (rth) said: +> The float test failure is part of a larger problem for target/powerpc in which all float +> routines are implemented incorrectly. They are all implemented as double operations with +> rounding to float as a second step. Which not only produces incorrect exceptions, as in +> this case, but incorrect > numerical results from the double rounding. +> +> This should probably be split to a separate bug... \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1842 b/results/classifier/mode-deepseek-r1:32b/output/system/1842 new file mode 100644 index 00000000..d4626525 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1842 @@ -0,0 +1,17 @@ + + +keyutils meson regression in 8.1.0 +Description of problem: +keyutils is no longer found by meson during the build. + +commit 0db0fbb5cf8955d4f7a4a82bde32cfd93bd042ea appears to be buggy: +``` +$ grep KEYUTILS config-host.h +#undef CONFIG_KEYUTILS +``` +Steps to reproduce: +1. Have keyutils installed +2. Build QEMU 8.1.0 +3. Note that keyutils is no longer linked into the build + +Thanks diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1842774 b/results/classifier/mode-deepseek-r1:32b/output/system/1842774 new file mode 100644 index 00000000..3947e08f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1842774 @@ -0,0 +1,5 @@ + + +Enhanced Hardware Support - Finalize Naming + +This feature request will provide the final naming of the next machine \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1842916 b/results/classifier/mode-deepseek-r1:32b/output/system/1842916 new file mode 100644 index 00000000..b9b451ce --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1842916 @@ -0,0 +1,5 @@ + + +[18.04 FEAT] Enhanced Hardware Support - Finalize Naming + +This feature request will provide the final naming of the next machine \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1843254 b/results/classifier/mode-deepseek-r1:32b/output/system/1843254 new file mode 100644 index 00000000..812ce8c7 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1843254 @@ -0,0 +1,5 @@ + + +arm emulation of HCR.TID3 traps are not implemented + +On ARM (aarch64), HCR_EL2.TID3 [bit18] is supposed to trap ID group 3, which includes the ID_AA64{PFR,DFR,ISAR,MMFR,AFR}*_EL1 registers. However, setting that HCR bit has no effect and accesses to those ID registers are not trapped to EL2 with an EC syndrome value of 0x18. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1843651 b/results/classifier/mode-deepseek-r1:32b/output/system/1843651 new file mode 100644 index 00000000..5557c192 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1843651 @@ -0,0 +1,82 @@ + + +m68k fpu bug + +On gcc123 cfarm machine, +I was testing m68k executables generated by Free Pascal Compiler. + +muller@gcc123:~/pas/check$ cat inf.pp +function get_double(x : double):double; + begin + get_double:=x; + end; + + +var + y : double; + py : pbyte; + i : byte; +begin + y:=1.0/0.0; + py:=@y; +{$ifdef ENDIAN_LITTLE} + write('little endian y='); + for i:=7 downto 0 do +{$else not ENDIAN_LITTLE} + write('big endian y='); + for i:=0 to 7 do +{$endif} + write(hexstr(py[i],2)); + writeln; + y:=get_double(y)+1; +{$ifdef ENDIAN_LITTLE} + write('little endian y='); + for i:=7 downto 0 do +{$else not ENDIAN_LITTLE} + write('big endian y='); + for i:=0 to 7 do +{$endif} + write(hexstr(py[i],2)); + writeln; +end. +muller@gcc123:~/pas/check$ ppc68k inf +Free Pascal Compiler version 3.3.1-r20:42973M [2019/09/11] for m68k +Copyright (c) 1993-2019 by Florian Klaempfl and others +Target OS: Linux for m68k +Compiling inf.pp +Assembling program +Linking inf +33 lines compiled, 0.1 sec +muller@gcc123:~/pas/check$ ./inf +big endian y=7FF0000000000000 +big endian y=7FFFFFFFFFFFFFFF +muller@gcc123:~/pas/check$ qemu-m68k ./inf +big endian y=7FF0000000000000 +big endian y=7FFFFFFFFFFFFFFF +muller@gcc123:~/pas/check$ ~/sys-root/bin/qemu-m68k ./inf +qemu-m68k qemu-m68k-fixed +muller@gcc123:~/pas/check$ ~/sys-root/bin/qemu-m68k-fixed ./inf +big endian y=7FF0000000000000 +big endian y=7FF0000000000000 + +~/sys-root/bin/qemu-m68k is 4.1.0 release, +~/sys-root/bin/qemu-m68k-fixed is the same source with a unique change: + +gnu/qemu/qemu-4.1.0/fpu/softfloat-specialize.h:214:#if defined(TARGET_M68K) +gnu/qemu/qemu-4.1.0/fpu/softfloat-specialize.h-215-#define floatx80_infinity_low LIT64(0x0000000000000000) +gnu/qemu/qemu-4.1.0/fpu/softfloat-specialize.h-216-#else +gnu/qemu/qemu-4.1.0/fpu/softfloat-specialize.h-217-#define floatx80_infinity_low LIT64(0x8000000000000000) +gnu/qemu/qemu-4.1.0/fpu/softfloat-specialize.h-218-#endif + +the M68K branch value is set to the same value as the other branch. + +The problem of the M68K specific floatx86_infinity_low values +is that is enters in conflict with +muller@gcc123:~/pas/check$ grep -nA6 invalid_enc /home/muller/gnu/qemu/qemu-4.1.0/include/fpu/softfloat.h +752:static inline bool floatx80_invalid_encoding(floatx80 a) +753-{ +754- return (a.low & (1ULL << 63)) == 0 && (a.high & 0x7FFF) != 0; +755-} + +And thus the m68k variant of floatx80 representing +Infinity is +considered as an invalid encoding, and thus converted into a NaN 7FFFFFFFFFFFFFFF \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1843795 b/results/classifier/mode-deepseek-r1:32b/output/system/1843795 new file mode 100644 index 00000000..4e92f229 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1843795 @@ -0,0 +1,33 @@ + + +'mtfsf' instruction can clear FI incorrectly + +Using mtfsf instruction can clear the FPSCR FI bit incorrectly. This code snippet exhibits the issue: +-- + fpscr.ll = 0x1fffffff; + __builtin_mtfsf (0b11111111, fpscr.d); + fpscr.d = __builtin_mffs (); +-- + +On POWER9 hardware: +mffs : FPSCR = 0x000000007ffff7ff + +On qemu (git master; "-cpu POWER9"): +-- +$ ./mtfsf +mffs : FPSCR = 0x000000007ffdffff +-- + +Two differences: +bit 52: "reserved", so maybe a "don't care" case +bit 46: "FI" + +$ git log -1 master +commit 89ea03a7dc83ca36b670ba7f787802791fcb04b1 +Merge: 019217c 2531164 +Author: Peter Maydell <email address hidden> +Date: Mon Sep 9 09:48:34 2019 +0100 + +I tracked the clear is coming from do_float_check_status, likely the one in gen_mtfsf, but then I get lost figuring out what _should_ be happening. :-/ + +Test attached. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1844597 b/results/classifier/mode-deepseek-r1:32b/output/system/1844597 new file mode 100644 index 00000000..e9aad2b4 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1844597 @@ -0,0 +1,90 @@ + + +fc1120a7f5f2d4b601003205c598077d3eb11ad2 causes a kernel panic in vfp_init on a clang built kernel + +Commit 4cdabee7d6d2 ("ARM: configs: aspeed_g5: Enable AST2600") [1] in the Linux kernel enabled CONFIG_VFP. When building this config with Clang, the resulting kernel does not boot after commit fc1120a7f5 ("target/arm: Implement NSACR gating of floating point") [2] (present since the 4.1.0 release). + +The QEMU command: + +qemu-system-arm -m 512m \ + -machine romulus-bmc \ + -no-reboot \ + -dtb out/arch/arm/boot/dts/aspeed-bmc-opp-romulus.dtb \ + -initrd rootfs.cpio \ + -display none \ + -serial mon:stdio \ + -kernel ${KBF}/arch/arm/boot/zImage + +If it is needed, the rootfs we are using is provided at a link below [3]. + +Debugging with QEMU reveals that the kernel panics in vfp_init, specifically at the line: + +vfpsid = fmrx(FPSID); + +in arch/arm/vfp/vfpmodule.c because of an illegal instruction: + +[ 0.058685] VFP support v0.3: +[ 0.059159] Internal error: Oops - undefined instruction: 0 [#1] SMP ARM +[ 0.059525] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.3.0-next-20190918-dirty #1 +[ 0.059547] Hardware name: Generic DT based system +[ 0.059702] PC is at vfp_init+0x50/0x1f4 +[ 0.059721] LR is at vfp_init+0x4c/0x1f4 +[ 0.059738] pc : [<80b0383c>] lr : [<80b03838>] psr: 60000153 +[ 0.059756] sp : 9e497ec0 ip : 00000020 fp : 9e497ed8 +[ 0.059773] r10: 00000000 r9 : ffffe000 r8 : 80c06048 +[ 0.059792] r7 : 00000000 r6 : 80c0caac r5 : 80c6c418 r4 : 80b037ec +[ 0.059811] r3 : 00000000 r2 : 339aa372 r1 : 00000000 r0 : 00000012 +[ 0.059859] Flags: nZCv IRQs on FIQs off Mode SVC_32 ISA ARM Segment none +[ 0.059883] Control: 00c5387d Table: 80004008 DAC: 00000051 +[ 0.059997] Process swapper/0 (pid: 1, stack limit = 0x(ptrval)) +[ 0.060048] Stack: (0x9e497ec0 to 0x9e498000) +[ 0.060205] 7ec0: 80b037ec 80b6bf0c 80b037ec ffffffff 00000000 00000000 9e497f48 80b01100 +[ 0.060310] 7ee0: 00000000 9eeff9e0 80a85734 809eb9be 00000000 8014b7f4 9eeff9e0 80a85734 +[ 0.060408] 7f00: 9e497f48 8014b7f4 000000a4 00000001 00000001 00000000 80b0133c 9e497f38 +[ 0.060509] 7f20: 00000000 9eeff9d5 339aa372 80b6be80 80b6bf0c 00000000 00000000 00000000 +[ 0.060606] 7f40: 00000000 00000000 9e497f70 80b01864 00000001 00000001 00000000 80b0133c +[ 0.060703] 7f60: 00000001 8085d268 00000000 00000000 9e497f80 80b01758 00000000 00000000 +[ 0.060800] 7f80: 9e497f90 80b015e4 00000000 8085d268 9e497fa8 8085d27c 00000000 8085d268 +[ 0.060897] 7fa0: 00000000 00000000 00000000 801010e8 00000000 00000000 00000000 00000000 +[ 0.060993] 7fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 +[ 0.061090] 7fe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000 +[ 0.061625] [<80b0383c>] (vfp_init) from [<80b01100>] (do_one_initcall+0xa8/0x1e0) +[ 0.061722] [<80b01100>] (do_one_initcall) from [<80b01864>] (do_initcall_level+0xfc/0x12c) +[ 0.061742] [<80b01864>] (do_initcall_level) from [<80b01758>] (do_basic_setup+0x2c/0x3c) +[ 0.061759] [<80b01758>] (do_basic_setup) from [<80b015e4>] (kernel_init_freeable+0x68/0x104) +[ 0.061777] [<80b015e4>] (kernel_init_freeable) from [<8085d27c>] (kernel_init+0x14/0x26c) +[ 0.061798] [<8085d27c>] (kernel_init) from [<801010e8>] (ret_from_fork+0x14/0x2c) +[ 0.061835] Exception stack(0x9e497fb0 to 0x9e497ff8) +[ 0.061896] 7fa0: 00000000 00000000 00000000 00000000 +[ 0.061998] 7fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 +[ 0.062080] 7fe0: 00000000 00000000 00000000 00000000 00000013 00000000 +[ 0.062263] Code: e5860000 e59f0174 ebd9d8fc e59f5170 (eef04a10) +[ 0.062679] ---[ end trace 2d338c91e4e74562 ]--- + +Before fc1120a7f5: + +[ 0.069418] VFP support v0.3: implementor 41 architecture 1 part 20 variant b rev 5 + +Should you need to reproduce this locally: + +* clang 9.0.0 or later is needed to build this config. If you do not have easy access to such a build, we have a clang build script available [4] that can help with this: + +% ./build-llvm.py --branch llvmorg-9.0.0-rc6 \ + --build-stage1-only \ + --projects clang \ + --targets ARM + +* Because of an unrelated build issue, linux-next needs to be used (or the singular patch that resolves it needs to be cherry-picked on top of 4cdabee7d6d2 [5]). The kernel make command used: + +% make -j$(nproc) -s \ + ARCH=arm \ + CC=clang \ + CROSS_COMPILE=arm-linux-gnueabi- \ + O=out \ + distclean aspeed_g5_defconfig all + +[1]: https://git.kernel.org/linus/4cdabee7d6d2e439fea726a101e448c4ca6837f4 +[2]: https://git.qemu.org/?p=qemu.git;a=commit;h=fc1120a7f5f2d4b601003205c598077d3eb11ad2 +[3]: https://github.com/ClangBuiltLinux/continuous-integration/blob/800d84bf8c55ee04c50ed4c78144a96d889a91c5/images/arm/rootfs.cpio +[4]: https://github.com/ClangBuiltLinux/tc-build +[5]: http://git.armlinux.org.uk/cgit/linux-arm.git/commit/?id=7b3948597372e5a6b314208ac320362c204b7f0f \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1846816 b/results/classifier/mode-deepseek-r1:32b/output/system/1846816 new file mode 100644 index 00000000..b9b9f685 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1846816 @@ -0,0 +1,121 @@ + + +Booting error on AIX 6.1 "Illegal Trap Instruction Interrupt in Kernel"" + +# ls -ltr +total 8750584 +-rw-rw-r-- 1 linux linux 4274997248 Oct 4 18:33 AIX.vol1.iso +-rw-rw-r-- 1 linux linux 4293888000 Oct 4 18:45 AIX.vol2.iso +-rw-rw-r-- 1 linux linux 391485440 Oct 4 18:50 AIX.vol3.iso +-rw-r--r-- 1 root root 204608 Oct 4 19:00 AIX61.img + +# qemu-system-ppc64 -cpu POWER8,compat=power7 -machine pseries -m 8192 -serial mon:stdio \ +> -drive file=/qemu/BST/AIX61.img,if=none,id=drive-virtio-disk0 \ +> -device virtio-scsi-pci,id=scsi -device scsi-hd,drive=drive-virtio-disk0 \ +> -cdrom /qemu/BST/AIX.vol1.iso \ +> -prom-env boot-command='boot cdrom: -s verbose' + + +VNC server running on ::1:5900 +qemu-system-ppc64: warning: TCG doesn't support requested feature, cap-ibs=workaround + + +SLOF ********************************************************************** +QEMU Starting + Build Date = Jul 3 2019 12:26:14 + FW Version = git-ba1ab360eebe6338 + Press "s" to enter Open Firmware. + +Populating /vdevice methods +Populating /vdevice/vty@71000000 +Populating /vdevice/nvram@71000001 +Populating /vdevice/l-lan@71000002 +Populating /vdevice/v-scsi@71000003 + SCSI: Looking for devices + 8200000000000000 CD-ROM : "QEMU QEMU CD-ROM 2.5+" +Populating /pci@800000020000000 + 00 0000 (D) : 1234 1111 qemu vga + 00 0800 (D) : 1033 0194 serial bus [ usb-xhci ] + 00 1000 (D) : 1af4 1004 virtio [ scsi ] +Populating /pci@800000020000000/scsi@2 + SCSI: Looking for devices + 100000000000000 DISK : "QEMU QEMU HARDDISK 2.5+" +Installing QEMU fb + + + +Scanning USB + XHCI: Initializing + USB Keyboard + USB mouse +No console specified using screen & keyboard + + Welcome to Open Firmware + + Copyright (c) 2004, 2017 IBM Corporation All rights reserved. + This program and the accompanying materials are made available + under the terms of the BSD License available at + http://www.opensource.org/licenses/bsd-license.php + + +Trying to load: -s verbose from: /vdevice/v-scsi@71000003/disk@8200000000000000: ... Successfully loaded +qemu-system-ppc64: Couldn't negotiate a suitable PVR during CAS +AIX +StarLED{814} + +AIX Version 6.1 +exec(/etc/init){1,0} + +INIT: EXECUTING /sbin/rc.boot 1 +exec(/usr/bin/sh,-c,/sbin/rc.boot 1){1114146,1} +exec(/sbin/rc.boot,/sbin/rc.boot,1){1114146,1} ++ PHASE=1 ++ + bootinfo -p +exec(/usr/sbin/bootinfo,-p){1179684,1114146} +PLATFORM=chrp ++ [ ! -x /usr/lib/boot/bin/bootinfo_chrp ] ++ [ 1 -eq 1 ] ++ 1> /usr/lib/libc.a ++ init -c unlink /usr/lib/boot/bin/!(*_chrp) +exec(/etc/init,-c,unlink /usr/lib/boot/bin/!(*_chrp)){1179686,1114146} ++ chramfs -t +exec(/usr/sbin/chramfs,-t){1179688,1114146} ++ init -c unlink /usr/sbin/chramfs ++ 1> /dev/null +exec(/etc/init,-c,unlink /usr/sbin/chramfs){1179690,1114146} ++ + bootinfo -t +exec(/usr/sbin/bootinfo,-t){1179692,1114146} +BOOTYPE=3 ++ [ 0 -ne 0 ] ++ [ -z 3 ] ++ unset pdev_to_ldev undolt native_netboot_cfg ++ unset disknet_odm_init config_ATM ++ /usr/lib/methods/showled 0x510 DEV CFG 1 START +exec(/usr/lib/methods/showled,0x510,DEV CFG 1 START){1179694,1114146} ++ cfgmgr -f -v +exec(/usr/sbin/cfgmgr,-f,-v){1179696,1114146} +cfgmgr is running in phase 1 +---------------- +Time: 0 LEDS: 0x538 +Invoking top level program -- "/etc/methods/defsys" +exec(/bin/sh,-c,/etc/methods/defsys ){1245222,1179696} +exec(/etc/methods/defsys){1245222,1179696} +exec(/bin/sh,-c,/usr/lib/methods/define_rspc -n -c sys -s node -t chrp){1310760,1245222} +exec(/usr/lib/methods/define_rspc,-n,-c,sys,-s,node,-t,chrp){1310760,1245222} +Time: 0 LEDS: 0x539 +Return code = 0 +***** stdout ***** +sys0 + +*** no stderr **** +---------------- +Attempting to configure device 'sys0' +Time: 0 LEDS: 0x811 +Invoking /usr/lib/methods/cfgsys_chrp -1 -l sys0 +exec(/bin/sh,-c,/usr/lib/methods/cfgsys_chrp -1 -l sys0){1245224,1179696} +Number of running methods: 1 +exec(/usr/lib/methods/cfgsys_chrp,-1,-l,sys0){1245224,1179696} +LED{A20} +Illegal Trap Instruction Interrupt in Kernel +04151A74 tweqi r0,0 r0=0 +KDB(0)> \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1847 b/results/classifier/mode-deepseek-r1:32b/output/system/1847 new file mode 100644 index 00000000..a95a9919 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1847 @@ -0,0 +1,3 @@ + + +TriCore missing ftoq31, ftoq31z, and q31tof instructions diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1847232 b/results/classifier/mode-deepseek-r1:32b/output/system/1847232 new file mode 100644 index 00000000..68805e9f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1847232 @@ -0,0 +1,15 @@ + + +qemu TCG in s390x mode issue with calculating HASH + +When using go on s390x on Debian x64 (buster) (host) and debian s390x (sid) (guest) I run into the following problem : + +The following occurs while trying to build a custom project : + +go: <email address hidden>: Get https://proxy.golang.org/github.com/%21factom%21project/basen/@v/v0.0.0-20150613233007-fe3947df716e.mod: local error: tls: bad record MAC + +Doing a git bisect I find that this problem only occurs on and after commit 08ef92d556c584c7faf594ff3af46df456276e1b + +Before that commit, all works fine. Past this commit, build always fails. + +Without any proof, It looks like a hash calculation bug related to using z/Arch vector facilities... \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1848 b/results/classifier/mode-deepseek-r1:32b/output/system/1848 new file mode 100644 index 00000000..17008011 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1848 @@ -0,0 +1,27 @@ + + +8.1.0 build failure ../accel/tcg/cputlb.c: In function ‘do_ld_mmio_beN’: error: call to ‘qemu_build_not_reached_always’ declared with attribute error: code path is reachable +Description of problem: +Error when building with -Og. Does not occur with -O2. + +``` +FAILED: libqemu-i386-softmmu.fa.p/accel_tcg_cputlb.c.o +x86_64-pc-linux-gnu-gcc -m64 -mcx16 -Ilibqemu-i386-softmmu.fa.p -I. -I.. -Itarget/i386 -I../target/i386 -Iqapi -Itrace -Iui -Iui/shader -I/usr/include/pixman-1 -I/usr/include/spice-server -I/usr/include/spice-1 -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include -I/usr/include/opus -fdiagnostics-color=auto -Wall -Winvalid-pch -std=gnu11 -O2 -fstack-protector-strong -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -Wundef -Wwrite-strings -Wmissing-prototypes -Wstrict-prototypes -Wredundant-decls -Wold-style-declaration -Wold-style-definition -Wtype-limits -Wformat-security -Wformat-y2k -Winit-self -Wignored-qualifiers -Wempty-body -Wnested-externs -Wendif-labels -Wexpansion-to-defined -Wimplicit-fallthrough=2 -Wmissing-format-attribute -Wno-missing-include-dirs -Wno-shift-negative-value -Wno-psabi -isystem /x/portage/app-emulation/qemu-8.1.0/work/qemu-8.1.0/linux-headers -isystem linux-headers -iquote . -iquote /x/portage/app-emulation/qemu-8.1.0/work/qemu-8.1.0 -iquote /x/portage/app-emulation/qemu-8.1.0/work/qemu-8.1.0/include -iquote /x/portage/app-emulation/qemu-8.1.0/work/qemu-8.1.0/host/include/x86_64 -iquote /x/portage/app-emulation/qemu-8.1.0/work/qemu-8.1.0/host/include/generic -iquote /x/portage/app-emulation/qemu-8.1.0/work/qemu-8.1.0/tcg/i386 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -fno-strict-aliasing -fno-common -fwrapv -march=amdfam10 -Og -g -fPIE -isystem../linux-headers -isystemlinux-headers -DNEED_CPU_H '-DCONFIG_TARGET="i386-softmmu-config-target.h"' '-DCONFIG_DEVICES="i386-softmmu-config-devices.h"' -MD -MQ libqemu-i386-softmmu.fa.p/accel_tcg_cputlb.c.o -MF libqemu-i386-softmmu.fa.p/accel_tcg_cputlb.c.o.d -o libqemu-i386-softmmu.fa.p/accel_tcg_cputlb.c.o -c ../accel/tcg/cputlb.c +In file included from ../accel/tcg/cputlb.c:20: +../accel/tcg/cputlb.c: In function ‘do_ld_mmio_beN’: +/x/portage/app-emulation/qemu-8.1.0/work/qemu-8.1.0/include/qemu/osdep.h:244:35: error: call to ‘qemu_build_not_reached_always’ declared with attribute error: code path is reachable + 244 | #define qemu_build_not_reached() qemu_build_not_reached_always() + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +../accel/tcg/cputlb.c:2121:13: note: in expansion of macro ‘qemu_build_not_reached’ + 2121 | qemu_build_not_reached(); + | ^~~~~~~~~~~~~~~~~~~~~~ +../accel/tcg/cputlb.c: In function ‘do_st_mmio_leN’: +/x/portage/app-emulation/qemu-8.1.0/work/qemu-8.1.0/include/qemu/osdep.h:244:35: error: call to ‘qemu_build_not_reached_always’ declared with attribute error: code path is reachable + 244 | #define qemu_build_not_reached() qemu_build_not_reached_always() + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +../accel/tcg/cputlb.c:2764:13: note: in expansion of macro ‘qemu_build_not_reached’ + 2764 | qemu_build_not_reached(); + | ^~~~~~~~~~~~~~~~~~~~~~ +``` + +Downstream bug: https://bugs.gentoo.org/913083 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1849234 b/results/classifier/mode-deepseek-r1:32b/output/system/1849234 new file mode 100644 index 00000000..4e5225dd --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1849234 @@ -0,0 +1,5 @@ + + +Macos Catalina bug + +When I want to boot anything with qemu it just stops responding. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1849879 b/results/classifier/mode-deepseek-r1:32b/output/system/1849879 new file mode 100644 index 00000000..d234ea69 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1849879 @@ -0,0 +1,12 @@ + + +qemu-arm should accept vmrs apsr_nzcv, fpscr on M-profile + +I've noticed that qemu-arm for cortex-M considers +vmrs apsr_nzcv, fpscr +as an illegal instruction. + +In this case, rt==15 means APSR, and the instruction should be accepted and executed like for A-profile. + +I posted a small patch: +https://lists.gnu.org/archive/html/qemu-devel/2019-10/msg06978.html \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1850570 b/results/classifier/mode-deepseek-r1:32b/output/system/1850570 new file mode 100644 index 00000000..bbf99669 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1850570 @@ -0,0 +1,39 @@ + + +Cannot use usb-host on Mac OS + +Usb-host will not work on Mac OS 10.15. Qemu runs, though it gives these errors and the drive does not show up. Also, when Qemu is starting the drive ejects and remounts twice. Qemu built with ./configure --target-list=i386-softmmu,x86_64-softmmu --enable-sdl --disable-cocoa --enable-sdl-image. + +qemu-system-i386 image.qcow -usb -device usb-kbd -device usb-host,vendorid=0x0781,productid=0x5571 +libusb: error [darwin_claim_interface] USBInterfaceOpen: another process has device opened for exclusive access +libusb: error [darwin_claim_interface] interface not found +libusb: error [darwin_claim_interface] interface not found +libusb: error [darwin_claim_interface] interface not found +libusb: error [darwin_claim_interface] interface not found +libusb: error [darwin_claim_interface] interface not found +libusb: error [darwin_claim_interface] interface not found +libusb: error [darwin_claim_interface] interface not found +libusb: error [darwin_claim_interface] interface not found +libusb: error [darwin_claim_interface] interface not found +libusb: error [darwin_claim_interface] interface not found +libusb: error [darwin_claim_interface] interface not found +libusb: error [darwin_claim_interface] interface not found +libusb: error [darwin_claim_interface] interface not found +libusb: error [darwin_claim_interface] interface not found +libusb: error [darwin_claim_interface] interface not found +libusb: error [darwin_claim_interface] USBInterfaceOpen: another process has device opened for exclusive access +libusb: error [darwin_claim_interface] interface not found +libusb: error [darwin_claim_interface] interface not found +libusb: error [darwin_claim_interface] interface not found +libusb: error [darwin_claim_interface] interface not found +libusb: error [darwin_claim_interface] interface not found +libusb: error [darwin_claim_interface] interface not found +libusb: error [darwin_claim_interface] interface not found +libusb: error [darwin_claim_interface] interface not found +libusb: error [darwin_claim_interface] interface not found +libusb: error [darwin_claim_interface] interface not found +libusb: error [darwin_claim_interface] interface not found +libusb: error [darwin_claim_interface] interface not found +libusb: error [darwin_claim_interface] interface not found +libusb: error [darwin_claim_interface] interface not found +libusb: error [darwin_claim_interface] interface not found \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1851939 b/results/classifier/mode-deepseek-r1:32b/output/system/1851939 new file mode 100644 index 00000000..d58bd780 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1851939 @@ -0,0 +1,18 @@ + + +RISC-V mstatus TSR bit not correctly implemented + +Hi, + +since qemu 4.1.0 the TSR bit in mstatus register is supported. But it does not allow for executing sret in m-mode. + +From the RISC-V specifications: +"When TSR=1, attempts to execute SRET while executing in S-mode will raise an illegal instruction +exception. When TSR=0, this operation is permitted in S-mode." + +This means an exception should only be raised when executing in S-mode, but not in M-mode, hence you should change the condition in helper_sret (target/riscv/op_helper.c) from: + if (env->priv_ver >= PRIV_VERSION_1_10_0 && + get_field(env->mstatus, MSTATUS_TSR)) +to: + if (env->priv_ver >= PRIV_VERSION_1_10_0 && + get_field(env->mstatus, MSTATUS_TSR) && !(env->priv >= PRV_M)) \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1852781 b/results/classifier/mode-deepseek-r1:32b/output/system/1852781 new file mode 100644 index 00000000..d36a5e32 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1852781 @@ -0,0 +1,34 @@ + + +qemu s390x on focal - applications breaking + +Running qemu-system-s390x (1:4.0+dfsg-0ubuntu10) on an x86-64 Focal host with an upgrade of a Eoan s390x VM to a Focal s390x is triggering random breakage, for example: + +sudo apt-get update && sudo apt-get dist-upgrade + +... +... + +Unpacking debianutils (4.9) over (4.8.6.3) ... +Setting up debianutils (4.9) ... +Use of uninitialized value $ARGV[0] in string ne at /usr/sbin/update-mime line 43. +(Reading database ... 83640 files and directories currently installed.) +Preparing to unpack .../bash_5.0-5ubuntu1_s390x.deb ... +Unpacking bash (5.0-5ubuntu1) over (5.0-4ubuntu1) ... +Setting up bash (5.0-5ubuntu1) ... +[12124.788618] User process fault: interruption code 0007 ilc:3 in bash[2aa3d780000+149000] +dpkg: error processing package bash (--configure): + installed bash package post-installation script subprocess was killed by signal (Floating point exception), core du +mped +Errors were encountered while processing: + bash +E: Sub-process /usr/bin/dpkg returned an error code (1) + +And now bash is completely broken: + +cking@eoan-s390x:~$ bash +[12676.204389] User process fault: interruption code 0007 ilc:3 in bash[2aa14780000+149000] + +Floating point exception (core dumped) + +The upgrade works OK on a s390x, so I'm assuming it's something to do with the qemu emulation. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1853 b/results/classifier/mode-deepseek-r1:32b/output/system/1853 new file mode 100644 index 00000000..4c3ca674 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1853 @@ -0,0 +1,3 @@ + + +Errors when install QEMU from source code diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1855072 b/results/classifier/mode-deepseek-r1:32b/output/system/1855072 new file mode 100644 index 00000000..8280e36d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1855072 @@ -0,0 +1,7 @@ + + +ARM: HCR.TVM traps are not implemented + +On AARCH64, setting HCR.TVM to 1 is supposed to trap all writes to CTLR_EL1, TTBR0_EL1, TTBR1_EL1, TCR_EL1, ESR_EL1, FAR_EL1, AFSR0_EL1, AFSR1_EL1, MAIR_EL1, AMAIR_EL1, and CONTEXTIDR_EL1. However, it currently has no effect (QEMU emulator version 4.1.1). + +It is also likely that TRVM will not trap, but, I didn't verify this. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1856 b/results/classifier/mode-deepseek-r1:32b/output/system/1856 new file mode 100644 index 00000000..86bcc3dc --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1856 @@ -0,0 +1,15 @@ + + +Replay got stuck with consecutive hardware interrupts coming +Description of problem: +I recorded bin file using **_rr=record_** command line. But it got stuck when replaying this record bin file. The icount number would never change after stucking if I typed _**info replay**_ with qmp command line. + +I found that the following instructions should be a sequence of consecutive hardware interrupts after stucking once checking the trace log of +both replay and record log using _**-d in_asm,int**_. +Steps to reproduce: +1.pulling from remote which the newest commit ID is 156618d9ea67f2f2e31d9dedd97f2dcccbe6808c +2.emulating Windows 7 OS on aarch64 Host with TCG acceleration mechanism +3.using **_rr=record_** to make replay file and tracing guest code and interrupts using _**-d in_asm,int**_ +4.replaying the previous file and also tracing guest code and interrupts +Additional information: +# diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1856706 b/results/classifier/mode-deepseek-r1:32b/output/system/1856706 new file mode 100644 index 00000000..74a072f6 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1856706 @@ -0,0 +1,15 @@ + + +target/mips/op_helper.c:971:duplicated branches ? + +qemu-4.2.0/target/mips/op_helper.c:971:8: warning: this condition has identical branches [-Wduplicated-branches] + +Source code is + + if (other_tc == other->current_tc) { + tccause = other->CP0_Cause; + } else { + tccause = other->CP0_Cause; + } + +Possible cut'n'paste error ? \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1857640 b/results/classifier/mode-deepseek-r1:32b/output/system/1857640 new file mode 100644 index 00000000..6230a241 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1857640 @@ -0,0 +1,133 @@ + + +qemu-system-i386 registers clobbered after gdb set due to k_gs_base bug in gdbstub + +Due to a bug in /target/i386/gdbstub.c, setting registers in gdb causes the ones following k_gs_base to get clobbered. + +I'm using qemu version 4.2.50 on an msys64 and start qemu's i386 with a gdb server. + +$ qemu-system-i386 -version +QEMU emulator version 4.2.50 (v4.2.0-363-gdd5b0f9549-dirty) +Copyright (c) 2003-2019 Fabrice Bellard and the QEMU Project developers + +$ qemu-system-i386 -gdb tcp::29096 -S +C:\msys64\usr\local\qemu-system-i386.exe: invalid accelerator kvm +C:\msys64\usr\local\qemu-system-i386.exe: falling back to tcg + + +I start a gdb client, connect to the server, display the register state, set k_gs_base, display the register state again, and notice an issue. (Setting other registers also clobbers the ones after k_gs_base). + +$ gdb -q +(gdb) target remote :29096 +... +(gdb) info regs +... +gs_base 0x0 0 +k_gs_base 0x0 0 +cr0 0x60000010 [ CD NW ET ] +cr2 0x0 0 +... +(gdb) set $k_gs_base = 0x41414141 +(gdb) info regs +... +gs_base 0x0 0 +k_gs_base 0x0 0 +cr0 0x41414151 [ CD WP ET PE ] +cr2 0x60000010 1610612752 +... + + +In the gdbstub code, I notice that the read and write functions are not symmetric for IDX_SEG_REGS + 8, which corresponds to k_gs_base. + +$ cat /usr/local/src/qemu-4.2.0/target/i386/gdbstub.c +... +int x86_cpu_gdb_read_register(CPUState *cs, uint8_t *mem_buf, int n) +{ +... + case IDX_SEG_REGS + 8: +#ifdef TARGET_X86_64 + if ((env->hflags & HF_CS64_MASK) || GDB_FORCE_64) { + return gdb_get_reg64(mem_buf, env->kernelgsbase); + } + return gdb_get_reg32(mem_buf, env->kernelgsbase); +#else + return gdb_get_reg32(mem_buf, 0); +#endif +... +} +... +int x86_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n) +{ +... +#ifdef TARGET_X86_64 + case IDX_SEG_REGS + 8: + if (env->hflags & HF_CS64_MASK) { + env->kernelgsbase = ldq_p(mem_buf); + return 8; + } + env->kernelgsbase = ldl_p(mem_buf); + return 4; +#endif +... +} +... + + +I change the write function, rebuild, and verify that the issue is resolved. + +$ cat /usr/local/src/qemu-4.2.0/target/i386/gdbstub.c +int x86_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n) +{ +... + case IDX_SEG_REGS + 8: +#ifdef TARGET_X86_64 + if (env->hflags & HF_CS64_MASK) { + env->kernelgsbase = ldq_p(mem_buf); + return 8; + } + env->kernelgsbase = ldl_p(mem_buf); + return 4; +#else + return 4; +#endif +... +} +... + +$ make +... +$ make install +... + +$ qemu-system-i386 -gdb tcp::29096 -S + +$ gdb -q +(gdb) target remote :29096 +... +(gdb) info regs +... +gs_base 0x0 0 +k_gs_base 0x0 0 +cr0 0x60000010 [ CD NW ET ] +cr2 0x0 0 +... +(gdb) set $k_gs_base = 0x41414141 +(gdb) info regs +... +gs_base 0x0 0 +k_gs_base 0x0 0 +cr0 0x60000010 [ CD NW ET ] +cr2 0x0 0 +... + + +I'll submit the patch below. + +$ diff gdbstub.c gdbstub.c.bkp +353d352 +< case IDX_SEG_REGS + 8: +354a354 +> case IDX_SEG_REGS + 8: +362,363d361 +< #else +< return 4; \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1858046 b/results/classifier/mode-deepseek-r1:32b/output/system/1858046 new file mode 100644 index 00000000..6bef7cbf --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1858046 @@ -0,0 +1,30 @@ + + +qemu-aarch64 hangs on cptofs during a build of NixOS SD card image + +First, thank you for this incredible project. + +While following this guide to build my own image of NixOS: https://nixos.wiki/wiki/NixOS_on_ARM#Compiling_through_QEMU on ARM Aarch64. + +I encountered a very strange behavior, qemu is correctly used and build most of the binaries until it executes this exact line over qemu: https://github.com/NixOS/nixpkgs/blob/master/nixos/lib/make-ext4-fs.nix#L55 + +At this step, the qemu process goes to 100 % of CPU, hangs in a certain syscall I don't know which one (according to strace & gdb which has no symbols so breaking and looking the backtrace was useless). + +According to iotop, no I/O was done. + +And it spent all its time in this syscall during more than 10 hours, which looks anomalous to me. + +I attach some of my CPU info: + +model : 142 +model name : Intel(R) Core(TM) i7-8550U CPU @ 1.80GHz +stepping : 10 +microcode : 0x96 +cpu MHz : 3107.071 +cache size : 8192 KB + +I'm using a ThinkPad T480 to perform those builds, I'm uncertain of how to debug further this issue, I discussed this with some people over #nixos-aarch64 and they told me they didn't know how to debug it further too. + +I tried all with this package: https://aur.archlinux.org/packages/qemu-arm-static/ — I'm currently compiling qemu-git to see if it happens on upstream too. Will comment when it's done. + +Thank you in advance! \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1859021 b/results/classifier/mode-deepseek-r1:32b/output/system/1859021 new file mode 100644 index 00000000..3f0064a7 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1859021 @@ -0,0 +1,34 @@ + + +qemu-system-aarch64 (tcg): cval + voff overflow not handled, causes qemu to hang + +The Armv8 architecture reference manual states that for any timer set (e.g. CNTP* and CNTV*), the condition for such timer to generate an interrupt (if enabled & unmasked) is: + +CVAL <= CNT(P/V)CT + +Although this is arguably sloppy coding, I have seen code that is therefore assuming it can set CVAL to a very high value (e.g. UINT64_MAX) and leave the interrupt enabled in CTL, and never get the interrupt. + +On latest master commit as the time of writing, there is an integer overflow in target/arm/helper.c gt_recalc_timer affecting the virtual timer when the interrupt is enabled in CTL: + + /* Next transition is when we hit cval */ + nexttick = gt->cval + offset; + +When this overflow happens, I notice that qemu is no longer responsive and that I have to SIGKILL the process: + - qemu takes nearly all the cpu time of the cores it is running on (e.g. 50% cpu usage if running on half the cores) and is completely unresponsive + - no guest interrupt (reported via -d int) is generated + +Here the minimal code example to reproduce the issue: + + mov x0, #1 + msr cntvoff_el2, x0 + mov x0, #-1 + msr cntv_cval_el0, x0 + mov x0, #1 + msr cntv_ctl_el0, x0 // interrupt generation enabled, not masked; qemu will start to hang here + +Options used: +-nographic -machine virt,virtualization=on,gic-version=2,accel=tcg -cpu cortex-a57 +-smp 4 -m 1024 -kernel whatever.elf -d unimp,guest_errors,int -semihosting-config enable,target=native +-serial mon:stdio + +Version used: 4.2 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1859291 b/results/classifier/mode-deepseek-r1:32b/output/system/1859291 new file mode 100644 index 00000000..5109a501 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1859291 @@ -0,0 +1,5 @@ + + +RISC-V incorrect exception generated + +When using 'ecall' from supervisor mode, user exception is raised instead of supervisor exception. The problem is located under 'target/riscv/insn_trans/trans_priviledged.inc.c' in function 'static bool trans_ecall(DisasContext *ctx, arg_ecall *a)'. Best regards, Serge Teodori \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1859723 b/results/classifier/mode-deepseek-r1:32b/output/system/1859723 new file mode 100644 index 00000000..e3ba0654 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1859723 @@ -0,0 +1,9 @@ + + +Qemu ungrabs before cursor reaches border + +This was first reported https://bugzilla.redhat.com/show_bug.cgi?id=1285378 + +video: https://peertube.co.uk/videos/watch/fedaa432-79ef-4d30-bd0e-26c806e48db0 + +version: QEMU emulator version 4.2.0 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1860920 b/results/classifier/mode-deepseek-r1:32b/output/system/1860920 new file mode 100644 index 00000000..8a78f458 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1860920 @@ -0,0 +1,25 @@ + + +qemu-s390x-softmmu: crash + +Trying to compile and use rust programs on an s390x emulated machine, crash in qemu/target/s390x/translate.c line 3894 + +Steps to reproduce: +on a amd64 PC, installed debian on s390x emulated by qemu, seems to work fine (installed some packages, etc.) +installed rust cargo (both from rustup and from debian) +cargo install anything makes *qemu* crash when beginning to compile + +Technical details: +* host: amd64 Linux +* qemu v4.2.0 (recompiled from git with debug options using configure --target-list=s390x-softmmu --enable-debug) (problem appears also with older versions of qemu from git, with default compilation options, with qemu from debian, etc.) +* compiled with gcc 9.2 +* command line, relevant part: qemu-system-s390x -snapshot -machine s390-ccw-virtio -cpu max,zpci=on -serial mon:stdio -display none -m 512 +(tested with -smp 4 -m 4096 as well and without snapshotting) +* command line, less relevant part: -drive file=./debian.qcow2,if=none,id=drive-virtio-disk0,format=qcow2,cache=none -device virtio-blk-ccw,devno=fe.0.0001,drive=drive-virtio-disk0,id=virtio-disk0,bootindex=1,scsi=off -netdev user,id=mynet0,hostfwd=tcp::2223-:22 -device virtio-net-pci,netdev=mynet0 +* core dump: abort in qemu/target/s390x/translate.c line 3894 ; s->field: op has value 0xEC and op2 has value 0x54 +(more info available if needed) + +Tried to patch source to add 0x54 case to no avail. +Tried other cpu variants to no avail as well. + +Reporting this in security as well since it also looks very much like a DoS (albeit somewhat minor), feel free to tell me to report the bug somewhere else. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1861551 b/results/classifier/mode-deepseek-r1:32b/output/system/1861551 new file mode 100644 index 00000000..176ea629 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1861551 @@ -0,0 +1,53 @@ + + +Errors while compiling source + +OS type: Mac OS X 10.11.6 +List of errors: +qemu-io-cmds.c:837:5: warning: implicit declaration of function 'clock_gettime' is invalid in C99 [-Wimplicit-function-declaration] + clock_gettime(CLOCK_MONOTONIC, &t1); + ^ +qemu-io-cmds.c:837:19: error: use of undeclared identifier 'CLOCK_MONOTONIC' + clock_gettime(CLOCK_MONOTONIC, &t1); + ^ +qemu-io-cmds.c:843:19: error: use of undeclared identifier 'CLOCK_MONOTONIC' + clock_gettime(CLOCK_MONOTONIC, &t2); + ^ +qemu-io-cmds.c:970:19: error: use of undeclared identifier 'CLOCK_MONOTONIC' + clock_gettime(CLOCK_MONOTONIC, &t1); + ^ +qemu-io-cmds.c:972:19: error: use of undeclared identifier 'CLOCK_MONOTONIC' + clock_gettime(CLOCK_MONOTONIC, &t2); + ^ +qemu-io-cmds.c:1184:19: error: use of undeclared identifier 'CLOCK_MONOTONIC' + clock_gettime(CLOCK_MONOTONIC, &t1); + ^ +qemu-io-cmds.c:1194:19: error: use of undeclared identifier 'CLOCK_MONOTONIC' + clock_gettime(CLOCK_MONOTONIC, &t2); + ^ +qemu-io-cmds.c:1306:19: error: use of undeclared identifier 'CLOCK_MONOTONIC' + clock_gettime(CLOCK_MONOTONIC, &t1); + ^ +qemu-io-cmds.c:1308:19: error: use of undeclared identifier 'CLOCK_MONOTONIC' + clock_gettime(CLOCK_MONOTONIC, &t2); + ^ +qemu-io-cmds.c:1351:19: error: use of undeclared identifier 'CLOCK_MONOTONIC' + clock_gettime(CLOCK_MONOTONIC, &t2); + ^ +qemu-io-cmds.c:1383:19: error: use of undeclared identifier 'CLOCK_MONOTONIC' + clock_gettime(CLOCK_MONOTONIC, &t2); + ^ +qemu-io-cmds.c:1518:19: error: use of undeclared identifier 'CLOCK_MONOTONIC' + clock_gettime(CLOCK_MONOTONIC, &ctx->t1); + ^ +qemu-io-cmds.c:1663:23: error: use of undeclared identifier 'CLOCK_MONOTONIC' + clock_gettime(CLOCK_MONOTONIC, &ctx->t1); + ^ +qemu-io-cmds.c:1885:19: error: use of undeclared identifier 'CLOCK_MONOTONIC' + clock_gettime(CLOCK_MONOTONIC, &t1); + ^ +qemu-io-cmds.c:1887:19: error: use of undeclared identifier 'CLOCK_MONOTONIC' + clock_gettime(CLOCK_MONOTONIC, &t2); + ^ +1 warning and 14 errors generated. +make: *** [qemu-io-cmds.o] Error 1 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1861562 b/results/classifier/mode-deepseek-r1:32b/output/system/1861562 new file mode 100644 index 00000000..2ed9460a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1861562 @@ -0,0 +1,114 @@ + + +piix crashes on mips when using multiple cpus + +Crash occurred while testing commit 330edfcc84a7: + +$ qemu-system-mips64el -cpu I6400 -append "clocksource=GIC console=ttyS0" -smp 8 -kernel vmlinux +Linux version 4.7.0-rc1 (phil@x1) (gcc version 6.3.0 20170516 (Debian 6.3.0-18) ) #1 SMP Sat Feb 1 13:15:19 UTC 2020 +earlycon: uart8250 at I/O port 0x3f8 (options '38400n8') +bootconsole [uart8250] enabled +CPU0 revision is: 0001a900 (MIPS I6400) +FPU revision is: 20f30300 +MSA revision is: 00000300 +MIPS: machine is mti,malta +Software DMA cache coherency enabled +Determined physical RAM map: + memory: 0000000008000000 @ 0000000000000000 (usable) +Zone ranges: + DMA [mem 0x0000000000000000-0x0000000000ffffff] + DMA32 [mem 0x0000000001000000-0x00000000ffffffff] + Normal empty +Movable zone start for each node +Early memory node ranges + node 0: [mem 0x0000000000000000-0x0000000007ffffff] +Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff] +VP topology {8} total 8 +Primary instruction cache 64kB, VIPT, 4-way, linesize 64 bytes. +Primary data cache 64kB, 4-way, VIPT, no aliases, linesize 64 bytes +percpu: Embedded 5 pages/cpu @980000000107c000 s29664 r8192 d44064 u81920 +Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8163 +Kernel command line: clocksource=GIC console=ttyS0 +log_buf_len individual max cpu contribution: 4096 bytes +log_buf_len total cpu_extra contributions: 28672 bytes +log_buf_len min size: 32768 bytes +log_buf_len: 65536 bytes +early log buf free: 30432(92%) +PID hash table entries: 512 (order: -2, 4096 bytes) +Dentry cache hash table entries: 16384 (order: 3, 131072 bytes) +Inode-cache hash table entries: 8192 (order: 2, 65536 bytes) +Writing ErrCtl register=00000000 +Readback ErrCtl register=00000000 +MAAR configuration: + [0]: 0x0000000000010000-0x0000000007ffffff speculate + [1]: disabled + [2]: disabled + [3]: disabled + [4]: disabled + [5]: disabled + [6]: disabled + [7]: disabled +Memory: 121104K/131072K available (5253K kernel code, 380K rwdata, 1276K rodata, 304K init, 278K bss, 9968K reserved, 0K cma-reserved) +Hierarchical RCU implementation. + Build-time adjustment of leaf fanout to 64. +NR_IRQS:256 +CPU frequency 200.00 MHz +GIC frequency 100.00 MHz +clocksource: GIC: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112702515 ns +clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112355619 ns +sched_clock: 32 bits at 100MHz, resolution 9ns, wraps every 21474556923ns +... +Primary instruction cache 64kB, VIPT, 4-way, linesize 64 bytes. +Primary data cache 64kB, 4-way, VIPT, no aliases, linesize 64 bytes +CPU7 revision is: 0001a900 (MIPS I6400) +FPU revision is: 20f30300 +MSA revision is: 00000300 +Synchronize counters for CPU 7: done. +Brought up 8 CPUs +devtmpfs: initialized +clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns +NET: Registered protocol family 16 +pm-cps: CPC does not support clock gating +vgaarb: loaded +SCSI subsystem initialized +PCI host bridge to bus 0000:00 +pci_bus 0000:00: root bus resource [mem 0x10000000-0x17ffffff] +pci_bus 0000:00: root bus resource [io 0x1000-0x1fffff] +pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0] +pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff] +pci 0000:00:00.0: [Firmware Bug]: reg 0x14: invalid BAR (can't size) +pci 0000:00:00.0: [Firmware Bug]: reg 0x18: invalid BAR (can't size) +pci 0000:00:00.0: [Firmware Bug]: reg 0x1c: invalid BAR (can't size) +pci 0000:00:00.0: [Firmware Bug]: reg 0x20: invalid BAR (can't size) +pci 0000:00:00.0: [Firmware Bug]: reg 0x24: invalid BAR (can't size) +pci 0000:00:0a.1: legacy IDE quirk: reg 0x10: [io 0x01f0-0x01f7] +pci 0000:00:0a.1: legacy IDE quirk: reg 0x14: [io 0x03f6] +pci 0000:00:0a.1: legacy IDE quirk: reg 0x18: [io 0x0170-0x0177] +pci 0000:00:0a.1: legacy IDE quirk: reg 0x1c: [io 0x0376] +Aborted (core dumped) + +(gdb) bt +#0 0x00007fe1e8d37e35 in raise () at /lib64/libc.so.6 +#1 0x00007fe1e8d22895 in abort () at /lib64/libc.so.6 +#2 0x000055d442b388ba in acpi_gpe_ioport_get_ptr (addr=addr@entry=49312, ar=ar@entry=0x55d4444212d0) at hw/acpi/core.c:670 +#3 0x000055d442b388ba in acpi_gpe_ioport_writeb (ar=ar@entry=0x55d4444212d0, addr=addr@entry=49312, val=val@entry=181) at hw/acpi/core.c:680 +#4 0x000055d442d3f363 in gpe_writeb (opaque=0x55d444420800, addr=49312, val=181, width=<optimized out>) at hw/acpi/piix4.c:553 +#5 0x000055d442b9534b in memory_region_write_accessor (mr=mr@entry=0x55d4444211e0, addr=49312, value=value@entry=0x7fe1ddff9ef8, size=size@entry=1, shift=<optimized out>, mask=mask@entry=255, attrs=...) + at memory.c:483 +#6 0x000055d442b9305e in access_with_adjusted_size (addr=addr@entry=49312, value=value@entry=0x7fe1ddff9ef8, size=size@entry=8, access_size_min=<optimized out>, access_size_max=<optimized out>, access_fn=access_fn@entry= + 0x55d442b95220 <memory_region_write_accessor>, mr=0x55d4444211e0, attrs=...) at memory.c:544 +#7 0x000055d442b976b4 in memory_region_dispatch_write (mr=mr@entry=0x55d4444211e0, addr=addr@entry=49312, data=<optimized out>, data@entry=327163317, op=op@entry=MO_64, attrs=...) at memory.c:1475 +#8 0x000055d442ba44fd in io_writex + (env=env@entry=0x55d443ec8f60, mmu_idx=mmu_idx@entry=0, val=val@entry=327163317, addr=addr@entry=10376293541929074848, retaddr=140608199778784, op=MO_64, iotlbentry=<optimized out>, iotlbentry=<optimized out>) + at accel/tcg/cputlb.c:980 +#9 0x000055d442baa43c in store_helper (op=MO_64, retaddr=140608199778784, oi=<optimized out>, val=<optimized out>, addr=10376293541929074848, env=0x55d443ec8f60) at accel/tcg/cputlb.c:1788 +#10 0x000055d442baa43c in helper_le_stq_mmu (env=0x55d443ec8f60, addr=10376293541929074848, val=327163317, oi=<optimized out>, retaddr=140608199778784) at accel/tcg/cputlb.c:1920 +#11 0x00007fe1e5cce1e0 in code_gen_buffer () +#12 0x000055d442bbc6d3 in cpu_tb_exec (itb=<optimized out>, cpu=0x0) at accel/tcg/cpu-exec.c:172 +#13 0x000055d442bbc6d3 in cpu_loop_exec_tb (tb_exit=<synthetic pointer>, last_tb=<synthetic pointer>, tb=<optimized out>, cpu=0x0) at accel/tcg/cpu-exec.c:618 +#14 0x000055d442bbc6d3 in cpu_exec (cpu=cpu@entry=0x55d443ec0550) at accel/tcg/cpu-exec.c:731 +#15 0x000055d442b88580 in tcg_cpu_exec (cpu=0x55d443ec0550) at cpus.c:1405 +#16 0x000055d442b8a6f4 in qemu_tcg_cpu_thread_fn (arg=arg@entry=0x55d443ec0550) at cpus.c:1713 +#17 0x000055d442faeb7b in qemu_thread_start (args=<optimized out>) at util/qemu-thread-posix.c:519 +#18 0x00007fe1e8ece4c0 in start_thread () at /lib64/libpthread.so.0 +#19 0x00007fe1e8dfc163 in clone () at /lib64/libc.so.6 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1861946 b/results/classifier/mode-deepseek-r1:32b/output/system/1861946 new file mode 100644 index 00000000..c228770d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1861946 @@ -0,0 +1,215 @@ + + +qemu-4.2.0 qemu-system-i386 not receive scancode 86 of spanish keyboard (ascii chars '<' & '>') + +Hello. + +I am using qemu-4.2.0 for Windows 64 downloaded from https://qemu.weilnetz.de/w64/, +and I use qemu-system-i386.exe for run Minix 3.1.2a: + + C:\Program Files\qemu> qemu-system-i386 minix3hd.qcow + +All is Ok except the keyboard (spanish). + +Actually the Spanish keyboard has always worked well until the version qemu-2.11.0 included. But after that version and until the current version the Spanish keyboard has worked with some very annoying bugs. + +The bugs that I encountered in the current version 4.2.0 on Windows are: + +1) Scancode 86 (ascii '<') is not received from the Spanish keyboard. + +2) Scancode 41 should be interpreted as 39 (41 -> 39). + +3) in the same way: +12 -> 53 +13 -> 27 +26 -> 12 +27 -> 13 +43 -> 41 +53 -> 43 + +4) Finally and very important in Spain is that scancode 39 should produce the national characters 'ñ' and 'Ñ' + +I have checked the scancodes sent by running a floppy disk image with a boot sector that echoed the scancodes sent by pressing the different keys, so the errors are not due in any case to the operating system, but to the virtual machine or at most to the BIOS. + +In Minix 3.1.2a I tried to alleviate the errors by modifying the keymap: /usr/lib/keymaps/spanish.map. I have managed to solve all the errors except the one corresponding to scancode 86 (ascii '<') since when the key is pressed on the Spanish keyboard the scancode 86 is not sent. + +I accompany the modified keymap: https://github.com/Stichting-MINIX-Research-Foundation/minix/blob/R3.1.2/drivers/tty/keymaps/spanish.src for it could be clarifying in any way. + +Thank you very much for qemu and the new version 4.2.0. Apart from these small details, all the improvements that have been included are greatly appreciated. + +Greetings. Pedro Pablo. + +------------------------- spanish.src (modified #if 0 #else #endif) ------------------------- + +/* Keymap for Spanish MF-2 keyboard. */ +/* Modified by Javier Garcia Martin <email address hidden> */ + +u16_t keymap[NR_SCAN_CODES * MAP_COLS] = { + +/* scan-code !Shift Shift Alt AltGr Alt+Sh Ctrl */ +/* +==================================================================== +*/ +/* 00 - none */ 0, 0, 0, 0, 0, 0, +/* 01 - ESC */ C('['), C('['), CA('['),C('['), C('['), C('['), +/* 02 - '1' */ '1', '!', A('1'), '|', '!', C('A'), +/* 03 - '2' */ '2', '"', A('2'), '@', '"', C('@'), +/* 04 - '3' */ '3', 0372, A('3'), '#', 0372, C('C'), +/* 05 - '4' */ '4', '$', A('4'), '4', '$', C('D'), +/* 06 - '5' */ '5', '%', A('5'), '5', '%', C('E'), +/* 07 - '6' */ '6', '&', A('6'), 0252, '&', C('F'), +/* 08 - '7' */ '7', '/', A('7'), '{', '/', C('G'), +/* 09 - '8' */ '8', '(', A('8'), '(', '(', C('H'), +/* 10 - '9' */ '9', ')', A('9'), ')', ')', C('I'), +/* 11 - '0' */ '0', '=', A('0'), '=', '=', C('@'), +#if 0 +/* 12 - '-' */ '\'', '?', A('\''),'?', '?', C('_'), /* debería ser como la (53) */ +#else +/* 53 - '/' */ '-', '_', A('-'), '-', '_', C('@'), +#endif +#if 0 +/* 13 - '=' */ 0255, 0250, A(0255),0250, 0250, C('@'), /* deberia ser como la (27) */ +#else +/* 27 - ']' */ '+', '*', A('+'), ']', '*', C(']'), +#endif +/* 14 - BS */ C('H'), C('H'), CA('H'),C('H'), C('H'), 0177, +/* 15 - TAB */ C('I'), C('I'), CA('I'),C('I'), C('I'), C('I'), +/* 16 - 'q' */ L('q'), 'Q', A('q'), 'q', 'Q', C('Q'), +/* 17 - 'w' */ L('w'), 'W', A('w'), 'w', 'W', C('W'), +/* 18 - 'e' */ L('e'), 'E', A('e'), 'e', 'E', C('E'), +/* 19 - 'r' */ L('r'), 'R', A('r'), 'r', 'R', C('R'), +/* 20 - 't' */ L('t'), 'T', A('t'), 't', 'T', C('T'), +/* 21 - 'y' */ L('y'), 'Y', A('y'), 'y', 'Y', C('Y'), +/* 22 - 'u' */ L('u'), 'U', A('u'), 'u', 'U', C('U'), +/* 23 - 'i' */ L('i'), 'I', A('i'), 'i', 'I', C('I'), +/* 24 - 'o' */ L('o'), 'O', A('o'), 'o', 'O', C('O'), +/* 25 - 'p' */ L('p'), 'P', A('p'), 'p', 'P', C('P'), +#if 0 +/* 26 - '[' */ '`', '^', A('`'),'[', '^', C('['), /* debería ser como la (12) */ +#else +/* 12 - '-' */ '\'', '?', A('\''),'?', '?', C('_'), +#endif +#if 0 +/* 27 - ']' */ '+', '*', A('+'), ']', '*', C(']'), /* deberia ser como la (13) */ +#else +/* 13 - '=' */ 0255, 0250, A(0255),0250, 0250, C('@'), +#endif +/* 28 - CR/LF */ C('M'), C('M'), CA('M'),C('M'), C('M'), C('J'), +/* 29 - Ctrl */ CTRL, CTRL, CTRL, CTRL, CTRL, CTRL, +/* 30 - 'a' */ L('a'), 'A', A('a'), 'a', 'A', C('A'), +/* 31 - 's' */ L('s'), 'S', A('s'), 's', 'S', C('S'), +/* 32 - 'd' */ L('d'), 'D', A('d'), 'd', 'D', C('D'), +/* 33 - 'f' */ L('f'), 'F', A('f'), 'f', 'F', C('F'), +/* 34 - 'g' */ L('g'), 'G', A('g'), 'g', 'G', C('G'), +/* 35 - 'h' */ L('h'), 'H', A('h'), 'h', 'H', C('H'), +/* 36 - 'j' */ L('j'), 'J', A('j'), 'j', 'J', C('J'), +/* 37 - 'k' */ L('k'), 'K', A('k'), 'k', 'K', C('K'), +/* 38 - 'l' */ L('l'), 'L', A('l'), 'l', 'L', C('L'), +#if 0 +/* 39 - ';' */ L(0244),0245, A(0244),0244, 0245, C('@'), /* deberia ser como la (26) */ +#else +/* 26 - '[' */ '`', '^', A('`'),'[', '^', C('['), +#endif +/* 40 - '\'' */ '\'', '"', A('\''),'{', '"', C('@'), +#if 0 +/* 41 - '`' */ 0247, 0246, A(0247),'\\', 0246, C('@'), /* deberia ser como la (ñÑ) */ +#else +/* 39 - ';' */ L(0244),0245, A(0244),0244, 0245, C('@'), +#endif +/* 42 - l. SHIFT*/ SHIFT, SHIFT, SHIFT, SHIFT, SHIFT, SHIFT, +#if 0 +/* 43 - '\\' */ L(0207),0200, A(0207),'}', 0200, C('@'), /* deberia ser como la (41) */ +#elif 0 +/* 41 - '`' */ 0247, 0246, A(0247),'\\', 0246, C('@'), +#else +/* 41 - '`' */ '<', '>', A('<'), '\\', 0246, C('@'), /* añadimos < y > */ +#endif +/* 44 - 'z' */ L('z'), 'Z', A('z'), 'z', 'Z', C('Z'), +/* 45 - 'x' */ L('x'), 'X', A('x'), 'x', 'X', C('X'), +/* 46 - 'c' */ L('c'), 'C', A('c'), 'c', 'C', C('C'), +/* 47 - 'v' */ L('v'), 'V', A('v'), 'v', 'V', C('V'), +/* 48 - 'b' */ L('b'), 'B', A('b'), 'b', 'B', C('B'), +/* 49 - 'n' */ L('n'), 'N', A('n'), 'n', 'N', C('N'), +/* 50 - 'm' */ L('m'), 'M', A('m'), 'm', 'M', C('M'), +/* 51 - ',' */ ',', ';', A(','), ',', ';', C('@'), +/* 52 - '.' */ '.', ':', A('.'), '.', ':', C('@'), +#if 0 +/* 53 - '/' */ '-', '_', A('-'), '-', '_', C('@'), /* deberia ser como la (43) */ +#else +/* 43 - '\\' */ L(0207),0200, A(0207),'}', 0200, C('@'), +#endif +/* 54 - r. SHIFT*/ SHIFT, SHIFT, SHIFT, SHIFT, SHIFT, SHIFT, +/* 55 - '*' */ '*', '*', A('*'), '*', '*', C('M'), +/* 56 - ALT */ ALT, ALT, ALT, ALT, ALT, ALT, +/* 57 - ' ' */ ' ', ' ', A(' '), ' ', ' ', C('@'), +/* 58 - CapsLck */ CALOCK, CALOCK, CALOCK, CALOCK, CALOCK, CALOCK, +/* 59 - F1 */ F1, SF1, AF1, AF1, ASF1, CF1, +/* 60 - F2 */ F2, SF2, AF2, AF2, ASF2, CF2, +/* 61 - F3 */ F3, SF3, AF3, AF3, ASF3, CF3, +/* 62 - F4 */ F4, SF4, AF4, AF4, ASF4, CF4, +/* 63 - F5 */ F5, SF5, AF5, AF5, ASF5, CF5, +/* 64 - F6 */ F6, SF6, AF6, AF6, ASF6, CF6, +/* 65 - F7 */ F7, SF7, AF7, AF7, ASF7, CF7, +/* 66 - F8 */ F8, SF8, AF8, AF8, ASF8, CF8, +/* 67 - F9 */ F9, SF9, AF9, AF9, ASF9, CF9, +/* 68 - F10 */ F10, SF10, AF10, AF10, ASF10, CF10, +/* 69 - NumLock */ NLOCK, NLOCK, NLOCK, NLOCK, NLOCK, NLOCK, +/* 70 - ScrLock */ SLOCK, SLOCK, SLOCK, SLOCK, SLOCK, SLOCK, +/* 71 - Home */ HOME, '7', AHOME, AHOME, '7', CHOME, +/* 72 - CurUp */ UP, '8', AUP, AUP, '8', CUP, +/* 73 - PgUp */ PGUP, '9', APGUP, APGUP, '9', CPGUP, +/* 74 - '-' */ NMIN, '-', ANMIN, ANMIN, '-', CNMIN, +/* 75 - Left */ LEFT, '4', ALEFT, ALEFT, '4', CLEFT, +/* 76 - MID */ MID, '5', AMID, AMID, '5', CMID, +/* 77 - Right */ RIGHT, '6', ARIGHT, ARIGHT, '6', CRIGHT, +/* 78 - '+' */ PLUS, '+', APLUS, APLUS, '+', CPLUS, +/* 79 - End */ END, '1', AEND, AEND, '1', CEND, +/* 80 - Down */ DOWN, '2', ADOWN, ADOWN, '2', CDOWN, +/* 81 - PgDown */ PGDN, '3', APGDN, APGDN, '3', CPGDN, +/* 82 - Insert */ INSRT, '0', AINSRT, AINSRT, '0', CINSRT, +/* 83 - Delete */ 0177, '.', A(0177),0177, '.', 0177, +/* 84 - Enter */ C('M'), C('M'), CA('M'),C('M'), C('M'), C('J'), +/* 85 - ??? */ 0, 0, 0, 0, 0, 0, +/* 86 - ??? */ '<', '>', A('<'), '<', '>', C('@'), +/* 87 - F11 */ F11, SF11, AF11, AF11, ASF11, CF11, +/* 88 - F12 */ F12, SF12, AF12, AF12, ASF12, CF12, +/* 89 - ??? */ 0, 0, 0, 0, 0, 0, +/* 90 - ??? */ 0, 0, 0, 0, 0, 0, +/* 91 - ??? */ 0, 0, 0, 0, 0, 0, +/* 92 - ??? */ 0, 0, 0, 0, 0, 0, +/* 93 - ??? */ 0, 0, 0, 0, 0, 0, +/* 94 - ??? */ 0, 0, 0, 0, 0, 0, +/* 95 - ??? */ 0, 0, 0, 0, 0, 0, +/* 96 - EXT_KEY */ EXTKEY, EXTKEY, EXTKEY, EXTKEY, EXTKEY, EXTKEY, +/* 97 - ??? */ 0, 0, 0, 0, 0, 0, +/* 98 - ??? */ 0, 0, 0, 0, 0, 0, +/* 99 - ??? */ 0, 0, 0, 0, 0, 0, +/*100 - ??? */ 0, 0, 0, 0, 0, 0, +/*101 - ??? */ 0, 0, 0, 0, 0, 0, +/*102 - ??? */ 0, 0, 0, 0, 0, 0, +/*103 - ??? */ 0, 0, 0, 0, 0, 0, +/*104 - ??? */ 0, 0, 0, 0, 0, 0, +/*105 - ??? */ 0, 0, 0, 0, 0, 0, +/*106 - ??? */ 0, 0, 0, 0, 0, 0, +/*107 - ??? */ 0, 0, 0, 0, 0, 0, +/*108 - ??? */ 0, 0, 0, 0, 0, 0, +/*109 - ??? */ 0, 0, 0, 0, 0, 0, +/*110 - ??? */ 0, 0, 0, 0, 0, 0, +/*111 - ??? */ 0, 0, 0, 0, 0, 0, +/*112 - ??? */ 0, 0, 0, 0, 0, 0, +/*113 - ??? */ 0, 0, 0, 0, 0, 0, +/*114 - ??? */ 0, 0, 0, 0, 0, 0, +/*115 - ??? */ 0, 0, 0, 0, 0, 0, +/*116 - ??? */ 0, 0, 0, 0, 0, 0, +/*117 - ??? */ 0, 0, 0, 0, 0, 0, +/*118 - ??? */ 0, 0, 0, 0, 0, 0, +/*119 - ??? */ 0, 0, 0, 0, 0, 0, +/*120 - ??? */ 0, 0, 0, 0, 0, 0, +/*121 - ??? */ 0, 0, 0, 0, 0, 0, +/*122 - ??? */ 0, 0, 0, 0, 0, 0, +/*123 - ??? */ 0, 0, 0, 0, 0, 0, +/*124 - ??? */ 0, 0, 0, 0, 0, 0, +/*125 - ??? */ 0, 0, 0, 0, 0, 0, +/*126 - ??? */ 0, 0, 0, 0, 0, 0, +/*127 - ??? */ 0, 0, 0, 0, 0, 0 +}; \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1862415 b/results/classifier/mode-deepseek-r1:32b/output/system/1862415 new file mode 100644 index 00000000..fb60e709 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1862415 @@ -0,0 +1,82 @@ + + +-nic user cannot receive TFTP response from outside on windows 10 host + +Configuration: +qemu is on a windows 10 host, address 192.168.1.24 +A tftp server, which is atftpd, is at address 192.168.1.31 +a guest is started by: +``` +.\qemu-system-x86_64.exe -accel hax \ +-nic user,id=n1,tftp-server-name=192.168.1.31,bootfile=tftp://192.168.1.31/grub/i386-pc/core.0 \ +-object filter-dump,id=f1,netdev=n1,file=dump.dat +``` + +qemu v4.2.0-11797-g2890edc853-dirty, from https://qemu.weilnetz.de/w64/ +windows 10 1909 18363.628 + +Here is the captured traffic from dump.dat, no filter applied: +No. Time Source Destination Protocol Length Info +1 0.000000 0.0.0.0 255.255.255.255 DHCP 439 DHCP Discover - Transaction ID 0xdb38340e +2 0.000081 10.0.2.2 255.255.255.255 DHCP 590 DHCP Offer - Transaction ID 0xdb38340e +3 1.035670 0.0.0.0 255.255.255.255 DHCP 439 DHCP Discover - Transaction ID 0xdb38340e +4 1.035693 10.0.2.2 255.255.255.255 DHCP 590 DHCP Offer - Transaction ID 0xdb38340e +5 3.068055 0.0.0.0 255.255.255.255 DHCP 451 DHCP Request - Transaction ID 0xdb38340e +6 3.068099 10.0.2.2 255.255.255.255 DHCP 590 DHCP ACK - Transaction ID 0xdb38340e +7 3.068209 RealtekU_12:34:56 Broadcast ARP 42 ARP Announcement for 10.0.2.15 +8 3.148419 RealtekU_12:34:56 Broadcast ARP 42 Who has 10.0.2.2? Tell 10.0.2.15 +9 3.148449 52:55:0a:00:02:02 RealtekU_12:34:56 ARP 64 10.0.2.2 is at 52:55:0a:00:02:02 +10 3.148511 10.0.2.15 192.168.1.31 TFTP 91 Read Request, File: grub/i386-pc/core.0, Transfer type: octet, blksize=1432, tsize=0 +11 3.398093 10.0.2.15 192.168.1.31 TFTP 91 Read Request, File: grub/i386-pc/core.0, Transfer type: octet, blksize=1432, tsize=0 +12 3.946041 10.0.2.15 192.168.1.31 TFTP 91 Read Request, File: grub/i386-pc/core.0, Transfer type: octet, blksize=1432, tsize=0 +13 4.990262 10.0.2.15 192.168.1.31 TFTP 91 Read Request, File: grub/i386-pc/core.0, Transfer type: octet, blksize=1432, tsize=0 +14 7.022839 10.0.2.15 192.168.1.31 TFTP 91 Read Request, File: grub/i386-pc/core.0, Transfer type: octet, blksize=1432, tsize=0 +15 11.087041 10.0.2.15 192.168.1.31 TFTP 91 Read Request, File: grub/i386-pc/core.0, Transfer type: octet, blksize=1432, tsize=0 + + +Here is the captured traffic at host NIC, filered by from or to 192.168.1.31 +No. Time Source Destination Protocol Length Info +14140 57.729066 192.168.1.24 192.168.1.31 TFTP 91 Read Request, File: grub/i386-pc/core.0, Transfer type: octet, blksize=1432, tsize=0 +14141 57.732988 192.168.1.31 192.168.1.24 TFTP 69 Option Acknowledgement, tsize=45542, blksize=1432 +14255 57.977995 192.168.1.24 192.168.1.31 TFTP 91 Read Request, File: grub/i386-pc/core.0, Transfer type: octet, blksize=1432, tsize=0 +14256 57.979876 192.168.1.31 192.168.1.24 TFTP 69 Option Acknowledgement, tsize=45542, blksize=1432 +14275 58.525939 192.168.1.24 192.168.1.31 TFTP 91 Read Request, File: grub/i386-pc/core.0, Transfer type: octet, blksize=1432, tsize=0 +14276 58.527819 192.168.1.31 192.168.1.24 TFTP 69 Option Acknowledgement, tsize=45542, blksize=1432 +14328 59.570178 192.168.1.24 192.168.1.31 TFTP 91 Read Request, File: grub/i386-pc/core.0, Transfer type: octet, blksize=1432, tsize=0 +14329 59.581024 192.168.1.31 192.168.1.24 TFTP 69 Option Acknowledgement, tsize=45542, blksize=1432 +14383 61.602742 192.168.1.24 192.168.1.31 TFTP 91 Read Request, File: grub/i386-pc/core.0, Transfer type: octet, blksize=1432, tsize=0 +14384 61.605554 192.168.1.31 192.168.1.24 TFTP 69 Option Acknowledgement, tsize=45542, blksize=1432 +14730 62.736572 192.168.1.31 192.168.1.24 TFTP 69 Option Acknowledgement, tsize=45542, blksize=1432 +14741 62.987924 192.168.1.31 192.168.1.24 TFTP 69 Option Acknowledgement, tsize=45542, blksize=1432 +14756 63.533477 192.168.1.31 192.168.1.24 TFTP 69 Option Acknowledgement, tsize=45542, blksize=1432 +14815 64.577653 192.168.1.31 192.168.1.24 TFTP 69 Option Acknowledgement, tsize=45542, blksize=1432 +14916 65.666959 192.168.1.24 192.168.1.31 TFTP 91 Read Request, File: grub/i386-pc/core.0, Transfer type: octet, blksize=1432, tsize=0 +14917 65.668778 192.168.1.31 192.168.1.24 TFTP 69 Option Acknowledgement, tsize=45542, blksize=1432 +15235 66.615186 192.168.1.31 192.168.1.24 TFTP 69 Option Acknowledgement, tsize=45542, blksize=1432 +15481 67.745250 192.168.1.31 192.168.1.24 TFTP 69 Option Acknowledgement, tsize=45542, blksize=1432 +15509 67.991523 192.168.1.31 192.168.1.24 TFTP 69 Option Acknowledgement, tsize=45542, blksize=1432 +15566 68.539050 192.168.1.31 192.168.1.24 TFTP 69 Option Acknowledgement, tsize=45542, blksize=1432 +16691 69.583531 192.168.1.31 192.168.1.24 TFTP 69 Option Acknowledgement, tsize=45542, blksize=1432 +17457 70.675366 192.168.1.31 192.168.1.24 TFTP 69 Option Acknowledgement, tsize=45542, blksize=1432 +17599 71.615337 192.168.1.31 192.168.1.24 TFTP 69 Option Acknowledgement, tsize=45542, blksize=1432 +17904 72.747338 192.168.1.31 192.168.1.24 TFTP 69 Option Acknowledgement, tsize=45542, blksize=1432 +18012 72.995681 192.168.1.31 192.168.1.24 TFTP 69 Option Acknowledgement, tsize=45542, blksize=1432 +18192 73.544257 192.168.1.31 192.168.1.24 TFTP 69 Option Acknowledgement, tsize=45542, blksize=1432 +18360 74.588002 192.168.1.31 192.168.1.24 TFTP 69 Option Acknowledgement, tsize=45542, blksize=1432 +18981 75.679037 192.168.1.31 192.168.1.24 TFTP 69 Option Acknowledgement, tsize=45542, blksize=1432 +19270 76.620528 192.168.1.31 192.168.1.24 TFTP 69 Option Acknowledgement, tsize=45542, blksize=1432 +19839 77.752338 192.168.1.31 192.168.1.24 TFTP 69 Option Acknowledgement, tsize=45542, blksize=1432 +19852 78.001267 192.168.1.31 192.168.1.24 TFTP 69 Option Acknowledgement, tsize=45542, blksize=1432 +19917 78.548965 192.168.1.31 192.168.1.24 TFTP 69 Option Acknowledgement, tsize=45542, blksize=1432 +20066 79.593232 192.168.1.31 192.168.1.24 TFTP 69 Option Acknowledgement, tsize=45542, blksize=1432 +20140 80.684604 192.168.1.31 192.168.1.24 TFTP 69 Option Acknowledgement, tsize=45542, blksize=1432 +20220 81.625996 192.168.1.31 192.168.1.24 TFTP 69 Option Acknowledgement, tsize=45542, blksize=1432 +20537 82.824574 192.168.1.31 192.168.1.24 TFTP 69 Option Acknowledgement, tsize=45542, blksize=1432 +20551 83.033318 192.168.1.31 192.168.1.24 TFTP 69 Option Acknowledgement, tsize=45542, blksize=1432 +20607 83.555510 192.168.1.31 192.168.1.24 TFTP 69 Option Acknowledgement, tsize=45542, blksize=1432 +20734 84.598612 192.168.1.31 192.168.1.24 TFTP 69 Option Acknowledgement, tsize=45542, blksize=1432 +20816 85.691535 192.168.1.31 192.168.1.24 TFTP 69 Option Acknowledgement, tsize=45542, blksize=1432 +20898 86.631036 192.168.1.31 192.168.1.24 TFTP 69 Option Acknowledgement, tsize=45542, blksize=1432 +22311 90.695296 192.168.1.31 192.168.1.24 TFTP 69 Option Acknowledgement, tsize=45542, blksize=1432 + +From the traffic, the guest sent the request properly, and it is rerouted outside properly, and the server respond to it properly. However, the guest never received the response. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1862874 b/results/classifier/mode-deepseek-r1:32b/output/system/1862874 new file mode 100644 index 00000000..596b1625 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1862874 @@ -0,0 +1,68 @@ + + +java may stuck for a long time in system mode with "-cpu max" + +Bug Description: +Run "java -version" in guest VM, java may stuck for a long time (several hours) and then recover. + +Steps to reproduce: +1. Launch VM by attached simple script: launch.sh +2. Execute "java -version" and then print "date" in a loop + while : + do + /home/bot/jdk/bin/java -version + date + done +3. A long time gap will be observed: may > 24 hours. + +Technical details: +* host: x86_64 Linux 4.15.0-70-generic +* qemu v4.2.0 +* java: tried two versions: openjdk-11-jre-headless or compiled java-13 +* command-line: (See details in launch.sh) +/home/bot/qemu/qemu-build/qemu-4.2.0/binaries/bin/qemu-system-x86_64 \ + -drive "file=${img},format=qcow2" \ + -drive "file=${user_data},format=raw" \ + -cpu max \ + -m 24G \ + -serial mon:stdio \ + -smp 8 \ + -nographic \ +; + +* Observed by java core dump generated by "kill -SIGSEGV" when java stucked: +Different pthreads are blocked on their own condition variables: + + Id Target Id Frame + 1 Thread 0x7f48a041a080 (LWP 22470) __GI_raise (sig=sig@entry=6) + at ../sysdeps/unix/sysv/linux/raise.c:51 + 2 Thread 0x7f487197d700 (LWP 22473) 0x00007f489f5c49f3 in futex_wait_cancelable (private=<optimized out>, expected=0, futex_word=0x7f48980197c0) + at ../sysdeps/unix/sysv/linux/futex-internal.h:88 + 3 Thread 0x7f4861b89700 (LWP 22483) 0x00007f489f5c4ed9 in futex_reltimed_wait_cancelable (private=<optimized out>, reltime=0x7f4861b88960, expected=0, + futex_word=0x7f489801b084) + at ../sysdeps/unix/sysv/linux/futex-internal.h:142 + 4 Thread 0x7f4861e8c700 (LWP 22480) 0x00007f489f5c76d6 in futex_abstimed_wait_cancelable (private=0, abstime=0x0, expected=0, futex_word=0x7f48980107c0) + at ../sysdeps/unix/sysv/linux/futex-internal.h:205 + 5 Thread 0x7f4861c8a700 (LWP 22482) 0x00007f489f5c4ed9 in futex_reltimed_wait_cancelable (private=<optimized out>, reltime=0x7f4861c89800, expected=0, + futex_word=0x7f489801ed44) + at ../sysdeps/unix/sysv/linux/futex-internal.h:142 + 6 Thread 0x7f48a0418700 (LWP 22471) 0x00007f4880b13200 in ?? () + 7 Thread 0x7f48703ea700 (LWP 22478) 0x00007f489f5c49f3 in futex_wait_cancelable (private=<optimized out>, expected=0, futex_word=0x7f489801dfc0) + at ../sysdeps/unix/sysv/linux/futex-internal.h:88 + 8 Thread 0x7f48702e9700 (LWP 22479) 0x00007f489f5c49f3 in futex_wait_cancelable (private=<optimized out>, expected=0, futex_word=0x7f489838cd84) + at ../sysdeps/unix/sysv/linux/futex-internal.h:88 + 9 Thread 0x7f4870f71700 (LWP 22475) 0x00007f489f5c49f3 in futex_wait_cancelable (private=<optimized out>, expected=0, futex_word=0x7f489801a300) + at ../sysdeps/unix/sysv/linux/futex-internal.h:88 + 10 Thread 0x7f487187b700 (LWP 22474) 0x00007f489f5c76d6 in futex_abstimed_wait_cancelable (private=0, abstime=0x0, expected=0, futex_word=0x7f48980cf770) + at ../sysdeps/unix/sysv/linux/futex-internal.h:205 + 11 Thread 0x7f4871a7f700 (LWP 22472) 0x00007f489f5c76d6 in futex_abstimed_wait_cancelable (private=0, abstime=0x0, expected=0, futex_word=0x7f489809ba30) + at ../sysdeps/unix/sysv/linux/futex-internal.h:205 + 12 Thread 0x7f4861d8b700 (LWP 22481) 0x00007f489f5c4ed9 in futex_reltimed_wait_cancelable (private=<optimized out>, reltime=0x7f4861d8a680, expected=0, + futex_word=0x7f489801ed44) + at ../sysdeps/unix/sysv/linux/futex-internal.h:142 + 13 Thread 0x7f48704ec700 (LWP 22477) 0x00007f489f5c4ed9 in futex_reltimed_wait_cancelable (private=<optimized out>, reltime=0x7f48704eb910, expected=0, + futex_word=0x7f489801d120) + at ../sysdeps/unix/sysv/linux/futex-internal.h:142 + 14 Thread 0x7f4870e6f700 (LWP 22476) 0x00007f489f5c4ed9 in futex_reltimed_wait_cancelable (private=<optimized out>, reltime=0x7f4870e6eb20, expected=0, + futex_word=0x7f489828abd0) + at ../sysdeps/unix/sysv/linux/futex-internal.h:142 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1863 b/results/classifier/mode-deepseek-r1:32b/output/system/1863 new file mode 100644 index 00000000..f3e991a7 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1863 @@ -0,0 +1,74 @@ + + +Assertion `core->delayed_causes == 0` failed in hw/net/e1000e_core.c:353 during fuzzing +Description of problem: +Got an assertion failure `core->delayed_causes == 0` when fuzzing e1000e. +Steps to reproduce: +Minimized reproducer for the error: + +```plaintext +cat << EOF | ./qemu-system-x86_64 -display none -machine accel=qtest, -m 512M -M q35 \ +-nodefaults -device e1000e,netdev=net0 -netdev user,id=net0 -qtest \ +/dev/null -qtest stdio +outl 0xcf8 0x80000810 +outl 0xcfc 0xe0000000 +outl 0xcf8 0x80000804 +outw 0xcfc 0x06 +write 0xe000042a 0x2 0x0241 +write 0xe0000402 0x2 0x0200 +write 0x400b 0x1 0x88 +write 0xe0000438 0x4 0x01040000 +outl 0xcf8 0x800008a3 +outb 0xcfc 0x80 +EOF +``` +Additional information: +The crash report triggered by the reproducer is: + +```plaintext +qemu-fuzz-x86_64: /../hw/net/e1000e_core.c:353: uint32_t e1000e_intmgr_collect_delayed_causes(E1000ECore *): Assertion `core->delayed_causes == 0' failed. +==2036033== ERROR: libFuzzer: deadly signal + #0 0x5606ff6c555e in __sanitizer_print_stack_trace ../../../llvm-project-15.0.0.src/compiler-rt/lib/asan/asan_stack.cpp:87:3 + #1 0x5606ff607bb1 in fuzzer::PrintStackTrace() ../../../llvm-project-15.0.0.src/compiler-rt/lib/fuzzer/FuzzerUtil.cpp:210:38 + #2 0x5606ff5e2486 in fuzzer::Fuzzer::CrashCallback() (.part.0) ../../../llvm-project-15.0.0.src/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:233:18 + #3 0x5606ff5e254d in fuzzer::Fuzzer::CrashCallback() ../../../llvm-project-15.0.0.src/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:205:1 + #4 0x5606ff5e254d in fuzzer::Fuzzer::StaticCrashSignalCallback() ../../../llvm-project-15.0.0.src/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:204:19 + #5 0x7f7490e4e41f (/lib/x86_64-linux-gnu/libpthread.so.0+0x1441f) (BuildId: 7b4536f41cdaa5888408e82d0836e33dcf436466) + #6 0x7f7490c4200a in __libc_signal_restore_set /build/glibc-SzIz7B/glibc-2.31/signal/../sysdeps/unix/sysv/linux/internal-signals.h:86:3 + #7 0x7f7490c4200a in raise /build/glibc-SzIz7B/glibc-2.31/signal/../sysdeps/unix/sysv/linux/raise.c:48:3 + #8 0x7f7490c21858 in abort /build/glibc-SzIz7B/glibc-2.31/stdlib/abort.c:79:7 + #9 0x7f7490c21728 in __assert_fail_base /build/glibc-SzIz7B/glibc-2.31/assert/assert.c:92:3 + #10 0x7f7490c32fd5 in __assert_fail /build/glibc-SzIz7B/glibc-2.31/assert/assert.c:101:3 + #11 0x5606ffd20c33 in e1000e_intmgr_collect_delayed_causes ../hw/net/e1000e_core.c:353:9 + #12 0x5606ffd20c33 in e1000e_set_interrupt_cause ../hw/net/e1000e_core.c:2203:12 + #13 0x5606ffd1bd1b in e1000e_receive_internal ../hw/net/e1000e_core.c:1751:9 + #14 0x56070055a58a in qemu_deliver_packet_iov ../net/net.c:820:15 + #15 0x56070055e215 in qemu_net_queue_deliver ../net/queue.c:164:11 + #16 0x56070055f9ca in qemu_net_queue_flush ../net/queue.c:286:15 + #17 0x56070054f5c8 in qemu_flush_or_purge_queued_packets ../net/net.c:681:9 + #18 0x5606ffd14ff5 in e1000e_start_recv ../hw/net/e1000e_core.c:983:9 + #19 0x5606ffd3c33b in e1000e_set_rx_control ../hw/net/e1000e_core.c:1959:9 + #20 0x5606ffd20fe8 in e1000e_core_write ../hw/net/e1000e_core.c:3306:9 + #21 0x560700caeb43 in memory_region_write_accessor ../softmmu/memory.c:493:5 + #22 0x560700cae2ca in access_with_adjusted_size ../softmmu/memory.c:569:18 + #23 0x560700cad670 in memory_region_dispatch_write ../softmmu/memory.c + #24 0x560700cf7d6f in flatview_write_continue ../softmmu/physmem.c:2677:23 + #25 0x560700cef213 in flatview_write ../softmmu/physmem.c:2719:12 + #26 0x560700ceef27 in address_space_write ../softmmu/physmem.c:2815:18 + #27 0x560700420b2f in qtest_process_command ../softmmu/qtest.c:558:13 + #28 0x56070041ecfb in qtest_process_inbuf ../softmmu/qtest.c:810:9 + #29 0x56070041eb19 in qtest_server_inproc_recv ../softmmu/qtest.c:941:9 + #30 0x56070126a792 in qtest_sendf ../tests/qtest/libqtest.c:607:5 + #31 0x56070126ae9e in qtest_write ../tests/qtest/libqtest.c:1072:5 + #32 0x56070126ae9e in qtest_writel ../tests/qtest/libqtest.c:1088:5 + #33 0x5606ff7058cb in __wrap_qtest_writel ../tests/qtest/fuzz/qtest_wrappers.c:180:9 + #34 0x5606ff70d5f2 in op_write ../tests/qtest/fuzz/generic_fuzz.c:485:13 + #35 0x5606ff70bd2f in generic_fuzz ../tests/qtest/fuzz/generic_fuzz.c:666:13 + #36 0x5606ff7008e7 in LLVMFuzzerTestOneInput ../tests/qtest/fuzz/fuzz.c:158:5 + #37 0x5606ff5e2d08 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) ../../../llvm-project-15.0.0.src/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:612:15 + #38 0x5606ff5c6124 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) ../../../llvm-project-15.0.0.src/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:21 + #39 0x5606ff5d2b0a in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) ../../../llvm-project-15.0.0.src/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:19 + #40 0x5606ff5bd8d6 in main ../../../llvm-project-15.0.0.src/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:30 + #41 0x7f7490c23082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16 + #42 0x5606ff5bd95d in _start (./qemu-fuzz-x86_64+0x1ef595d) +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1863025 b/results/classifier/mode-deepseek-r1:32b/output/system/1863025 new file mode 100644 index 00000000..13c13b5c --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1863025 @@ -0,0 +1,48 @@ + + +Use-after-free after flush in TCG accelerator + +I believe I found a UAF in TCG that can lead to a guest VM escape. The security +list informed me "This can not be treated as a security issue." and to post it +here. I am looking at the 4.2.0 source code. The issue requires a race and I +will try to describe it in terms of three concurrent threads. + +I am looking +at the 4.2.0 source code. The issue requires a race and I will try to describe +it in terms of three concurrent threads. + +Thread A: + +A1. qemu_tcg_cpu_thread_fn runs work loop +A2. qemu_wait_io_event => qemu_wait_io_event_common => process_queued_cpu_work +A3. start_exclusive critical section entered +A4. do_tb_flush is called, TB memory freed/re-allocated +A5. end_exclusive exits critical section + +Thread B: + +B1. qemu_tcg_cpu_thread_fn runs work loop +B2. tcg_cpu_exec => cpu_exec => tb_find => tb_gen_code +B3. tcg_tb_alloc obtains a new TB + +Thread C: + +C1. qemu_tcg_cpu_thread_fn runs work loop +C2. cpu_exec_step_atomic executes +C3. TB obtained with tb_lookup__cpu_state or tb_gen_code +C4. start_exclusive critical section entered +C5. cpu_tb_exec executes the TB code +C6. end_exclusive exits critical section + +Consider the following sequence of events: + B2 => B3 => C3 (same TB as B2) => A3 => A4 (TB freed) => A5 => B2 => + B3 (re-allocates TB from B2) => C4 => C5 (freed/reused TB now executing) => C6 + +In short, because thread C uses the TB in the critical section, there is no +guarantee that the pointer has not been "freed" (rather the memory is marked as +re-usable) and therefore a use-after-free occurs. + +Since the TCG generated code can be in the same memory as the TB data structure, +it is possible for an attacker to overwrite the UAF pointer with code generated +from TCG. This can overwrite key pointer values and could lead to code +execution on the host outside of the TCG sandbox. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1863486 b/results/classifier/mode-deepseek-r1:32b/output/system/1863486 new file mode 100644 index 00000000..b7e9ac95 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1863486 @@ -0,0 +1,75 @@ + + +aarch64/tcg crash with malloc(): unsorted double linked list corrupted + +Based on commit b29c3e23f64938784c42ef9fca896829e3c19120, +QEMU configured with --enable-debug --extra-cflags=-ggdb. + +Download Raspberry Pi 3 UEFI Firmware v1.15 from: +https://github.com/pbatard/RPi3/releases/tag/v1.15 +(unzip RPi3_UEFI_Firmware_v1.15.zip) + +Run QEMU with: + +$ qemu-system-aarch64 -M raspi3 \ + -serial null -serial stdio \ + -device loader,file=RPI_EFI.fd,force-raw=true + +Normal behavior: + +NOTICE: Booting Trusted Firmware +NOTICE: BL1: v2.1(release):v2.1 +NOTICE: BL1: Built : 15:26:06, May 13 2019 +NOTICE: rpi3: Detected: Raspberry Pi 3 Model B (1GB, Sony, UK) [0x00a02082] +NOTICE: BL1: Booting BL2 +ERROR: rpi3_sdhost: timeout status 0x40 +NOTICE: BL2: v2.1(release):v2.1 +NOTICE: BL2: Built : 15:26:01, May 13 2019 +NOTICE: BL1: Booting BL31 +NOTICE: BL31: v2.1(release):v2.1 +NOTICE: BL31: Built : 15:26:04, May 13 2019 +=UEFI firmware (version UEFI Firmware v1.15 built at 11:58:44 on Feb 14 2020) +======== + +Synchronous Exception at 0x0000000037A1A4E8 + +But I sometimes get: + +NOTICE: Booting Trusted Firmware +NOTICE: BL1: v2.1(release):v2.1 +NOTICE: BL1: Built : 15:26:06, May 13 2019 +NOTICE: rpi3: Detected: Raspberry Pi 3 Model B (1GB, Sony, UK) [0x00a02082] +NOTICE: BL1: Booting BL2 +ERROR: rpi3_sdhost: timeout status 0x40 +NOTICE: BL2: v2.1(release):v2.1 +NOTICE: BL2: Built : 15:26:01, May 13 2019 +NOTICE: BL1: Booting BL31 +NOTICE: BL31: v2.1(release):v2.1 +NOTICE: BL31: Built : 15:26:04, May 13 2019 +=UEFI firmware (version UEFI Firmware v1.15 built at 11:58:44 on Feb 14 2020) +========malloc(): unsorted double linked list corrupted + +Thread 3 "qemu-system-aar" received signal SIGABRT, Aborted. +[Switching to Thread 0x7fffe9c22700 (LWP 22746)] +0x00007ffff515ce35 in raise () from /lib64/libc.so.6 +(gdb) bt +#0 0x00007ffff515ce35 in raise () at /lib64/libc.so.6 +#1 0x00007ffff5147895 in abort () at /lib64/libc.so.6 +#2 0x00007ffff51a008f in __libc_message () at /lib64/libc.so.6 +#3 0x00007ffff51a740c in () at /lib64/libc.so.6 +#4 0x00007ffff51aa48c in _int_malloc () at /lib64/libc.so.6 +#5 0x00007ffff51aad4e in _int_memalign () at /lib64/libc.so.6 +#6 0x00007ffff51abdda in _mid_memalign () at /lib64/libc.so.6 +#7 0x00007ffff51ad3c6 in posix_memalign () at /lib64/libc.so.6 +#8 0x00007ffff7be2407 in slab_allocator_alloc_chunk () at /lib64/libglib-2.0.so.0 +#9 0x00007ffff7be3573 in g_slice_alloc () at /lib64/libglib-2.0.so.0 +#10 0x00007ffff7bf410a in g_tree_insert_internal () at /lib64/libglib-2.0.so.0 +#11 0x0000555555853f10 in tcg_tb_insert (tb=0x7fffd44b4d80 <code_gen_buffer+4934995>) at tcg/tcg.c:425 +#12 0x00005555558dbe3d in tb_gen_code (cpu=0x555556afa640, pc=933332960, cs_base=0, flags=2216689664, cflags=-16252928) at accel/tcg/translate-all.c:1875 +#13 0x00005555558d7c73 in tb_find (cpu=0x555556afa640, last_tb=0x7fffd44b4c40 <code_gen_buffer+4934675>, tb_exit=0, cf_mask=524288) at accel/tcg/cpu-exec.c:406 +#14 0x00005555558d8543 in cpu_exec (cpu=0x555556afa640) at accel/tcg/cpu-exec.c:730 +#15 0x00005555558981e1 in tcg_cpu_exec (cpu=0x555556afa640) at cpus.c:1405 +#16 0x0000555555898a37 in qemu_tcg_cpu_thread_fn (arg=0x555556afa640) at cpus.c:1713 +#17 0x0000555556057af8 in qemu_thread_start (args=0x555557511570) at util/qemu-thread-posix.c:519 +#18 0x00007ffff52f34c0 in start_thread () at /lib64/libpthread.so.0 +#19 0x00007ffff5221163 in clone () at /lib64/libc.so.6 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1863685 b/results/classifier/mode-deepseek-r1:32b/output/system/1863685 new file mode 100644 index 00000000..86dc16a8 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1863685 @@ -0,0 +1,10 @@ + + +ARM: HCR.TSW traps are not implemented + +On 32-bit and 64-bit ARM platforms, setting HCR.TSW is supposed to "Trap data or unified cache maintenance instructions that operate by Set/Way." Quoting the ARM manual: + +If EL1 is using AArch64 state, accesses to DC ISW, DC CSW, DC CISW are trapped to EL2, reported using EC syndrome value 0x18. +If EL1 is using AArch32 state, accesses to DCISW, DCCSW, DCCISW are trapped to EL2, reported using EC syndrome value 0x03. + +However, QEMU does not trap those instructions/registers. This was tested on the branch master of the git repo. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1864 b/results/classifier/mode-deepseek-r1:32b/output/system/1864 new file mode 100644 index 00000000..39ba47b9 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1864 @@ -0,0 +1,23 @@ + + +x86 VM with TCG and SMP fails to start on 8.1.0 +Description of problem: +I'm running Colima on MacOS to run Docker. After upgrading qemu to 8.1.0 my x86_64 VM fails to start. If I downgrade qemu to 8.0.4 everything runs normally. Relevant logs: + +``` +[ 60.976187] rcu: 0-...!: (0 ticks this GP) idle=0d58/0/0x0 softirq=44/44 fqs=0 (false positive?) +[ 60.979262] (detected by 1, t=6005 jiffies, g=-1171, q=1981 ncpus=2) +[ 60.982317] Sending NMI from CPU 1 to CPUs 0: +[ 11.583693] NMI backtrace for cpu 0 skipped: idling at native_safe_halt+0xb/0x10 +[ 11.583693] INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 2.006 msecs +[ 60.982317] rcu: rcu_preempt kthread timer wakeup didn't happen for 6004 jiffies! g-1171 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 +[ 60.982317] rcu: Possible timer handling issue on cpu=0 timer-softirq=15 +[ 60.982317] rcu: rcu_preempt kthread starved for 6005 jiffies! g-1171 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=0 +[ 60.982317] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. +[ 60.982317] rcu: RCU grace-period kthread stack dump: +[ 60.982317] task:rcu_preempt state:I stack:0 pid:15 ppid:2 flags:0x00004000 +``` + +[serial.log](/uploads/1039eceff37133504eb93401df1db137/serial.log) +Steps to reproduce: +1. `colima start --arch x86_64` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1865 b/results/classifier/mode-deepseek-r1:32b/output/system/1865 new file mode 100644 index 00000000..4a72ab55 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1865 @@ -0,0 +1,26 @@ + + +ERROR:../target/s390x/tcg/cc_helper.c:128:cc_calc_addu: assertion failed: (carry_out <= 1) +Description of problem: +Installation progresses OK, but QEMU asserts during post-installation setup tasks: + +Performing post-installation setup tasks +** +ERROR:../target/s390x/tcg/cc_helper.c:128:cc_calc_addu: assertion failed: (carry_out <= 1) +Bail out! ERROR:../target/s390x/tcg/cc_helper.c:128:cc_calc_addu: assertion failed: (carry_out <= 1) +./install.sh: line 25: 158224 Aborted (core dumped) $QEMU/qemu-system-s390x -M s390-ccw-virtio -smp 1 -m 4G +-nographic -display none -serial mon:stdio -device virtio-scsi -drive file=$ISO,format=raw,if=none,id=c1 -device scsi-cd,dri +ve=c1 -hda $DISK -kernel $KERNEL -initrd $INITRD -net nic,model=virtio,netdev=net1 -netdev user,id=net1 -D debug.log +Steps to reproduce: +1. Download ClefOS 7.7 ISO from [sinenomine](https://download.sinenomine.net/clefos) +2. Download Fedora 27 ISO and extract kernel.img and initrd.img, for boot purposes +3. Boot ClefOS ISO using Fedora kernel/initrd +4. Go through a minimal install, observe crash during post-installation setup tasks +Additional information: +See script log and install.sh attached. [install-and-output.zip](/uploads/87eb8484344402ea9c68784f89ea3339/install-and-output.zip) + +I have tried QEMU 7.2.5 and 8.1 on my Fedora 38 AMD host. + +My goal is to create RHEL7, SLES12, Ubuntu20 (or compatible) VMs for s390x software builds. +So far only Ubuntu20 has been successful. +RHEL7 fails due to kernel issues described in QEMU issue 906, so I'm trying ClefOS (CentOS for z) based on a procedure [here](https://www.linuxquestions.org/questions/linux-server-73/install-clefos-7-5-an-open-source-version-of-rhel-7-5-s390x-using-qemu-4175658710/) diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1866 b/results/classifier/mode-deepseek-r1:32b/output/system/1866 new file mode 100644 index 00000000..26123ee4 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1866 @@ -0,0 +1,3 @@ + + +mips/mip64 virtio broken on master (and 8.1.0 with tcg fix) diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1866577 b/results/classifier/mode-deepseek-r1:32b/output/system/1866577 new file mode 100644 index 00000000..639797a6 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1866577 @@ -0,0 +1,15 @@ + + +powerpc-none-eabi-gdb.exe GDB 9.1 with QEMU 4.2 gdb-stub comes with Reply contains invalid hex digit 79 + +I am using powerpc-none-eabi-gdb with qemu 4.2, but it comes with +the following error: + +undefinedC:\CI-Tools\msys64\powerpc-none-eabi\usr\local\bin\powerpc-none-eabi-gdb.exe: warning: Couldn't determine a path for the index cache directory. + +```Not implemented stop reason (assuming exception): undefined``` +The target architecture is assumed to be powerpc:603 + +``` +Reply contains invalid hex digit 79 +``` \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1866892 b/results/classifier/mode-deepseek-r1:32b/output/system/1866892 new file mode 100644 index 00000000..597c8d7e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1866892 @@ -0,0 +1,81 @@ + + +guest OS catches a page fault bug when running dotnet + +The linux guest OS catches a page fault bug when running the dotnet application. + +host = metal = x86_64 +host OS = ubuntu 19.10 +qemu emulation, without KVM, with "tiny code generator" tcg; no plugins; built from head/master +guest emulation = x86_64 +guest OS = ubuntu 19.10 +guest app = dotnet, running any program + +qemu sha=7bc4d1980f95387c4cc921d7a066217ff4e42b70 (head/master Mar 10, 2020) + +qemu invocation is: + +qemu/build/x86_64-softmmu/qemu-system-x86_64 \ + -m size=4096 \ + -smp cpus=1 \ + -machine type=pc-i440fx-5.0,accel=tcg \ + -cpu Skylake-Server-v1 \ + -nographic \ + -bios OVMF-pure-efi.fd \ + -drive if=none,id=hd0,file=ubuntu-19.10-server-cloudimg-amd64.img \ + -device virtio-blk,drive=hd0 \ + -drive if=none,id=cloud,file=linux_cloud_config.img \ + -device virtio-blk,drive=cloud \ + -netdev user,id=user0,hostfwd=tcp::2223-:22 \ + -device virtio-net,netdev=user0 + + +Here's the guest kernel console output: + + +[ 2834.005449] BUG: unable to handle page fault for address: 00007fffffffc2c0 +[ 2834.009895] #PF: supervisor read access in user mode +[ 2834.013872] #PF: error_code(0x0001) - permissions violation +[ 2834.018025] IDT: 0xfffffe0000000000 (limit=0xfff) GDT: 0xfffffe0000001000 (limit=0x7f) +[ 2834.022242] LDTR: NULL +[ 2834.026306] TR: 0x40 -- base=0xfffffe0000003000 limit=0x206f +[ 2834.030395] PGD 80000000360d0067 P4D 80000000360d0067 PUD 36105067 PMD 36193067 PTE 8000000076d8e867 +[ 2834.038672] Oops: 0001 [#4] SMP PTI +[ 2834.042707] CPU: 0 PID: 13537 Comm: dotnet Tainted: G D 5.3.0-29-generic #31-Ubuntu +[ 2834.050591] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015 +[ 2834.054785] RIP: 0033:0x1555547eaeda +[ 2834.059017] Code: d0 00 00 00 4c 8b a7 d8 00 00 00 4c 8b af e0 00 00 00 4c 8b b7 e8 00 00 00 4c 8b bf f0 00 00 00 48 8b bf b0 00 00 00 9d 74 02 <48> cf 48 8d 64 24 30 5d c3 90 cc c3 66 90 55 4c 8b a7 d8 00 00 00 +[ 2834.072103] RSP: 002b:00007fffffffc2c0 EFLAGS: 00000202 +[ 2834.076507] RAX: 0000000000000000 RBX: 00001554b401af38 RCX: 0000000000000001 +[ 2834.080832] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007fffffffcfb0 +[ 2834.085010] RBP: 00007fffffffd730 R08: 0000000000000000 R09: 00007fffffffd1b0 +[ 2834.089184] R10: 0000155555331dd5 R11: 00001555553ad8d0 R12: 0000000000000002 +[ 2834.093350] R13: 0000000000000001 R14: 0000000000000001 R15: 00001554b401d388 +[ 2834.097309] FS: 0000155554fa5740 GS: 0000000000000000 +[ 2834.101131] Modules linked in: isofs nls_iso8859_1 dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua ppdev input_leds serio_raw parport_pc parport sch_fq_codel ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel aes_x86_64 crypto_simd cryptd glue_helper virtio_net psmouse net_failover failover virtio_blk floppy +[ 2834.122539] CR2: 00007fffffffc2c0 +[ 2834.126867] ---[ end trace dfae51f1d9432708 ]--- +[ 2834.131239] RIP: 0033:0x14d793262eda +[ 2834.135715] Code: Bad RIP value. +[ 2834.140243] RSP: 002b:00007ffddb4e2980 EFLAGS: 00000202 +[ 2834.144615] RAX: 0000000000000000 RBX: 000014d6f402acb8 RCX: 0000000000000002 +[ 2834.148943] RDX: 0000000001cd6950 RSI: 0000000000000000 RDI: 00007ffddb4e3670 +[ 2834.153335] RBP: 00007ffddb4e3df0 R08: 0000000000000001 R09: 00007ffddb4e3870 +[ 2834.157774] R10: 000014d793da9dd5 R11: 000014d793e258d0 R12: 0000000000000002 +[ 2834.162132] R13: 0000000000000001 R14: 0000000000000001 R15: 000014d6f402d040 +[ 2834.166239] FS: 0000155554fa5740(0000) GS:ffff97213ba00000(0000) knlGS:0000000000000000 +[ 2834.170529] CS: 0033 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 2834.174751] CR2: 000014d793262eb0 CR3: 0000000036130000 CR4: 00000000007406f0 +[ 2834.178892] PKRU: 55555554 + +I run the application from a shell with `ulimit -s unlimited` (unlimited stack to size). + +The application creates a number of threads, and those threads make a lot of calls to sigaltstack() and mprotect(); see the relevant source for dotnet here https://github.com/dotnet/runtime/blob/15ec69e47b4dc56098e6058a11ccb6ae4d5d4fa1/src/coreclr/src/pal/src/thread/thread.cpp#L2467 + +using strace -f on the app shows that no alt stacks come anywhere near the failing address; all alt stacks are in the heap, as expected. None of the mmap/mprotect/munmap syscalls were given arguments in the high memory 0x7fffffff0000 and up. + +gdb (with default signal stop/print/pass semantics) does not report any signals prior to the kernel bug being tripped, so I doubt the alternate signal stack is actually used. + +When I run the same dotnet binary on the host (eg, on "bare metal"), the host kernel seems happy and dotnet runs as expected. + +I have not tried different qemu or guest or host O/S. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1867072 b/results/classifier/mode-deepseek-r1:32b/output/system/1867072 new file mode 100644 index 00000000..d4326217 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1867072 @@ -0,0 +1,11 @@ + + +ARM: tag bits cleared in FAR_EL1 + +The ARM Architecture Reference Manual provides the following for FAR_EL1: + +"For a Data Abort or Watchpoint exception, if address tagging is enabled for the address accessed by the data access that caused the exception, then this field includes the tag." + +However, I have found that the tag bits in FAR_EL1 are always clear, even if the tag bits were set in the original access. + +I can reproduce the problem on both 4.1.1 and master (6e8a73e911f066527e775e04b98f31ebd19db600). \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1868055 b/results/classifier/mode-deepseek-r1:32b/output/system/1868055 new file mode 100644 index 00000000..99dc008f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1868055 @@ -0,0 +1,77 @@ + + +cannot run golang app with docker, version 17.09.1-ce, disabling core 0 and qemu-arm, version 2.7. + +Hello! +I figure out that sometimes simple go application is not working. +I am using docker + qemu-arm + go( for armv7l). + +These are version info below. + +root@VDBS1535:~# docker -v +Docker version 17.09.1-ce, build 19e2cf6 + +bash-3.2# qemu-arm --version +qemu-arm version 2.7.0, Copyright (c) 2003-2016 Fabrice Bellard and the QEMU Project developers + +$ go version +go version go1.12.6 linux/arm +$ go env +GOARCH="arm" +GOBIN="" +GOCACHE="/home/quickbuild/.cache/go-build" +GOEXE="" +GOFLAGS="" +GOHOSTARCH="arm" +GOHOSTOS="linux" +GOOS="linux" +GOPATH="/home/quickbuild/go" +GOPROXY="" +GORACE="" +GOROOT="/usr/lib/golang" +GOTMPDIR="" +GOTOOLDIR="/usr/lib/golang/pkg/tool/linux_arm" +GCCGO="gccgo" +GOARM="7" +CC="gcc" +CXX="g++" +CGO_ENABLED="1" +GOMOD="" +CGO_CFLAGS="-g -O2" +CGO_CPPFLAGS="" +CGO_CXXFLAGS="-g -O2" +CGO_FFLAGS="-g -O2" +CGO_LDFLAGS="-g -O2" +PKG_CONFIG="pkg-config" +GOGCCFLAGS="-fPIC -marm -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build242285369=/tmp/go-build -gno-record-gcc-switches" + +This issue is come only when I disable core 0 using a command below. +please check "--cpuset-cpus=1-55" option. + +sudo docker run --privileged -d -i -t --cpuset-cpus=1-55 --mount type=bind,source="/home/dw83kim/mnt",destination="/mnt" --network host --name="ubuntu_core1" ubuntu:xenial-20200212 + + +This is what I have tested in the environment above. + +package main +func main(){ + for i:=0; i<1000; i++ { + println("Hello world") + } +} + +This is one of the error logs have faced sometimes not always. + +bash-3.2# go run test.go +fatal error: schedule: holding locks +panic during panic +SIGILL: illegal instruction +PC=0xc9ec4c m=3 sigcode=2 + +goroutine 122 [runnable]: +qemu: uncaught target signal 11 (Segmentation fault) - core dumped +Segmentation fault (core dumped) +bash-3.2# + +Please check it. +Thanks in advance. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1868527 b/results/classifier/mode-deepseek-r1:32b/output/system/1868527 new file mode 100644 index 00000000..d89d55cb --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1868527 @@ -0,0 +1,19 @@ + + +alignment may overlap the TLB flags + +Hi, +In QEMU-4.2.0, or git-9b26a610936deaf436af9b7e39e4b7f0a35e4409, alignment may overlap the TLB flags. +For example, the alignment: MO_ALIGN_32, + MO_ALIGN_32 = 5 << MO_ASHIFT, +and the TLB flag: TLB_DISCARD_WRITE +#define TLB_DISCARD_WRITE (1 << (TARGET_PAGE_BITS_MIN - 6)) + +then, in the function "get_alignment_bits", the assert may fail: + +#if defined(CONFIG_SOFTMMU) + /* The requested alignment cannot overlap the TLB flags. */ + tcg_debug_assert((TLB_FLAGS_MASK & ((1 << a) - 1)) == 0); +#endif + +However, the alignment of MO_ALIGN_32 is not used for now, so the assert cannot be triggered in current version. Anyway it seems like a potential conflict. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1869497 b/results/classifier/mode-deepseek-r1:32b/output/system/1869497 new file mode 100644 index 00000000..e1d8fb42 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1869497 @@ -0,0 +1,12 @@ + + +x86_cpu_gdb_read_register segfaults when gdb requests registers + +When attempting to attach to the gdbstub, a segfault occurs. + +I traced this down to a problem in a call to gdb_get_reg16 where the mem_buf +was being treated like a uint8_t* instead of a GByteArray. The buffer passed +to gdb_get_reg16 ends up passing an invalid GByteArray pointer, which subsequently +causes a segfault in memcpy. + +I have a fix for this - just need to educate myself on how to submit a patch. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/187 b/results/classifier/mode-deepseek-r1:32b/output/system/187 new file mode 100644 index 00000000..323ff402 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/187 @@ -0,0 +1,3 @@ + + +Cannot boot arm kernel images on s390x diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1872113 b/results/classifier/mode-deepseek-r1:32b/output/system/1872113 new file mode 100644 index 00000000..6c122bfe --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1872113 @@ -0,0 +1,53 @@ + + +qemu docs fails to build with Sphinx 3.0.x + +We've just updated Sphinx to version 3.0.1 and qemu fails to build the docs with this version. + +Here's the relevant section in the build log. + +CONFDIR="/etc/qemu" /usr/bin/sphinx-build-3 -W -b html -D version=4.2.92 -D release="4.2.92 (qemu-5.0.0-0.rc2.0.1.mga8)" -d .doctrees/devel-html /home/iurt/rpmbuild/BUILD/qemu-5.0.0-rc2/docs/devel docs/devel +Running Sphinx v3.0.1 +making output directory... done +building [mo]: targets for 0 po files that are out of date +building [html]: targets for 14 source files that are out of date +updating environment: [new config] 14 added, 0 changed, 0 removed +reading sources... [ 7%] bitops +reading sources... [ 14%] decodetree +reading sources... [ 21%] index +reading sources... [ 28%] kconfig +reading sources... [ 35%] loads-stores +reading sources... [ 42%] memory +reading sources... [ 50%] migration +reading sources... [ 57%] reset +reading sources... [ 64%] s390-dasd-ipl +reading sources... [ 71%] secure-coding-practices +reading sources... [ 78%] stable-process +reading sources... [ 85%] tcg +reading sources... [ 92%] tcg-plugins +reading sources... [100%] testing + + +Warning, treated as error: +/home/iurt/rpmbuild/BUILD/qemu-5.0.0-rc2/docs/../include/exec/memory.h:3:Type must be either just a name or a typedef-like declaration. +If just a name: + Error in declarator or parameters + Invalid C declaration: Expected identifier in nested name, got keyword: struct [error at 6] + struct MemoryListener + ------^ +If typedef-like declaration: + Error in declarator or parameters + Invalid C declaration: Expected identifier in nested name. [error at 21] + struct MemoryListener + ---------------------^ + +make: *** [Makefile:1095: docs/devel/index.html] Error 2 +make: *** Waiting for unfinished jobs.... + +I found this commit for memory.h that includes the section that faults. +https://github.com/qemu/qemu/commit/5d248213180749e674fbccbacc6ee9c38499abb3#diff-d892cbf314945b44699534cc1de4ebbd + +You can see the whol build log here. +https://pkgsubmit.mageia.org/uploads/failure/cauldron/core/release/20200410161120.tv.duvel.699/log/qemu-5.0.0-0.rc2.0.1.mga8/build.0.20200410161338.log + +System: Mageia Cauldron \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1873335 b/results/classifier/mode-deepseek-r1:32b/output/system/1873335 new file mode 100644 index 00000000..713c9706 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1873335 @@ -0,0 +1,7 @@ + + +Dos Keypad is not working for numbers - numlock is not working + +Hello, +i tried to use Qemu 4.2 for Dos, but there is problem what in Dos is not possible turn on Numlock for input numbers, so games need it.. Numlock only working as arrow keys. + I tested bough Windows and Linux builds. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1873337 b/results/classifier/mode-deepseek-r1:32b/output/system/1873337 new file mode 100644 index 00000000..de185244 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1873337 @@ -0,0 +1,13 @@ + + +Arrow keys press is double in some programs in Dos + +Hello, +im trying to use Qemu for Dos machines. + + But there is problem with some programs that arrow key press is double in some problems. As advanced Filemanagers - Dos Navigator or File Wizard, same Scandisk. + +There is gif: +https://www.vogons.org/download/file.php?id=77141&mode=view + + Its blocking to use such problem, unless you use Numlock key for it, but im used 25+ years to arrow keys and its bug.. I guess that it would mess with some games too. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1873339 b/results/classifier/mode-deepseek-r1:32b/output/system/1873339 new file mode 100644 index 00000000..0601a75b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1873339 @@ -0,0 +1,9 @@ + + +Qemu DOS Quake - 640x480 and above resolutions - Unable to load VESA palette in dos prompt and game crashing are not working + +I have problem make Quake Demo working with 640x480+, with 320x200 working fine. +I tried 3 virtual videocards settings: -vga cirrus 640x480 is not available, probably emulated GPU has not enough VRAM or some Vesa2 utility is needed. For -vga std and -vga vmware // 640x480 is available in game menu, but when i tried to set it, im getting: Unable to load VESA palette in dos prompt and game crashing. +With vmware svgaII other Q2DOS 640x480 and 1024x768 its working fine, so it not working only with some games. + + Qemu 4.2, its same on Linux and Windows. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1874264 b/results/classifier/mode-deepseek-r1:32b/output/system/1874264 new file mode 100644 index 00000000..83d5061a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1874264 @@ -0,0 +1,360 @@ + + +AIX 7.2 TL4 SP1 cannot IPL with QEMU >2.11.2 ppc64-softmmu + +kens@LAPTOP-JN77KAC2$ qemu-system-ppc64 -version +QEMU emulator version 4.2.93 (v5.0.0-rc3-8-g3119154db0-dirty) +Copyright (c) 2003-2020 Fabrice Bellard and the QEMU Project developers + +qemu-system-ppc64 \ + -name "IBM AIX - IBM POWER9" \ + -M pseries \ + -cpu POWER9 \ + -smp 8 \ + -m 8192 \ + -nodefaults \ + -nographic \ + -prom-env input-device=/vdevice/vty@71000000 \ + -prom-env output-device=/vdevice/vty@71000000 \ + -serial tcp::9019,server,nowait \ + -monitor tcp::9020,server,nowait \ + -netdev type=user,id=mynet0,hostfwd=tcp:127.0.0.1:9018-10.0.2.18:22 \ + -device virtio-net-pci,netdev=mynet0 \ + -drive file=images/aix-ppc64.img,format=qcow2,if=none,id=hd,media=disk,cache=unsafe \ + -device virtio-scsi-pci,id=scsi -device scsi-hd,drive=hd \ + -drive file=images/iso/blank-cdrom,format=raw,media=cdrom,cache=unsafe + +------------------------------------------------------------------------------- + Welcome to AIX. + boot image timestamp: 14:18:40 03/27/2020 + processor count: 8; memory size: 8192MB; kernel size: 45422205 + boot device: /pci@800000020000000/scsi@1/disk@100000000000000 + AIX vm,uuid property contains invalid data +processing splpar characteristic: MaxEntCap +processing splpar characteristic: DesMem +processing splpar characteristic: DesProcs +processing splpar characteristic: MaxPlatProcs +processing splpar characteristic: HostThrs + +AKVM: hcall-multi-tce detected but overridden, allow with "multce" boot argument +------------------------------------------------------------------------------- + Starqemu-system-ppc64: OS terminated: 888 102 700 C20 + + +qemu-system-ppc64 \ + -name "IBM AIX - IBM POWER8" \ + -M pseries \ + -cpu POWER8 \ + -smp 8 \ + -m 8192 \ + -nodefaults \ + -nographic \ + -prom-env input-device=/vdevice/vty@71000000 \ + -prom-env output-device=/vdevice/vty@71000000 \ + -serial tcp::9019,server,nowait \ + -monitor tcp::9020,server,nowait \ + -netdev type=user,id=mynet0,hostfwd=tcp:127.0.0.1:9018-10.0.2.18:22 \ + -device virtio-net-pci,netdev=mynet0 \ + -drive file=images/aix-ppc64.img,format=qcow2,if=none,id=hd,media=disk,cache=unsafe \ + -device virtio-scsi-pci,id=scsi -device scsi-hd,drive=hd \ + -drive file=images/iso/blank-cdrom,format=raw,media=cdrom,cache=unsafe + +------------------------------------------------------------------------------- + Welcome to AIX. + boot image timestamp: 14:18:40 03/27/2020 + processor count: 8; memory size: 8192MB; kernel size: 45422205 + boot device: /pci@800000020000000/scsi@1/disk@100000000000000 + AIX vm,uuid property contains invalid data +processing splpar characteristic: MaxEntCap +processing splpar characteristic: DesMem +processing splpar characteristic: DesProcs +processing splpar characteristic: MaxPlatProcs +processing splpar characteristic: HostThrs + +AKVM: hcall-multi-tce detected but overridden, allow with "multce" boot argument +------------------------------------------------------------------------------- + Star** +ERROR:/home/kens/tmp/qemu/cpus.c:1727:qemu_tcg_cpu_thread_fn: assertion failed: (cpu->halted) + + +kens@LAPTOP-JN77KAC2$ qemu-system-ppc64 -version +QEMU emulator version 2.11.2 +Copyright (c) 2003-2017 Fabrice Bellard and the QEMU Project developers + +qemu-system-ppc64 \ + -name "IBM AIX - IBM POWER9" \ + -M pseries,cap-htm=off \ + -cpu POWER9 \ + -smp 8 \ + -m 8192 \ + -nodefaults \ + -nographic \ + -prom-env input-device=/vdevice/vty@71000000 \ + -prom-env output-device=/vdevice/vty@71000000 \ + -serial tcp::9019,server,nowait \ + -monitor tcp::9020,server,nowait \ + -netdev type=user,id=mynet0,hostfwd=tcp:127.0.0.1:9018-10.0.2.18:22 \ + -device virtio-net-pci,netdev=mynet0 \ + -drive file=images/aix-ppc64.img,format=qcow2,if=none,id=hd,media=disk,cache=unsafe \ + -device virtio-scsi-pci,id=scsi -device scsi-hd,drive=hd \ + -drive file=images/iso/blank-cdrom,format=raw,media=cdrom,cache=unsafe + +------------------------------------------------------------------------------- + Welcome to AIX. + boot image timestamp: 14:18:40 03/27/2020 + processor count: 8; memory size: 8192MB; kernel size: 45422205 + boot device: /pci@800000020000000/scsi@1/disk@100000000000000 + AIX vm,uuid property contains invalid data +processing splpar characteristic: MaxEntCap +processing splpar characteristic: DesMem +processing splpar characteristic: DesProcs +processing splpar characteristic: MaxPlatProcs + +AKVM: hcall-multi-tce detected but overridden, allow with "multce" boot argument +------------------------------------------------------------------------------- + Star +0539 +0811 +0539 +0812 +0708 +0811 +0811 +0811 +0811 +0811 +0811 +0811 +0811 +078c +25b6 +25b6 +25b6 +25b6 +25b6 +25b6 +25b6 +25b6 +25b6 +25b6 +25b6 +078c +0539 +2071 +0539 +2073 +0539 +25b3vscsi_send_capabilities: capabilities size mismatch ! +VSCSI: Unknown MAD type 09 + +0539 +0538 +0539 +0591 +0539 +0538 +0539 +0538 +0539 +25b0 +0539 + +0511 +0551 +0517 +0517 +0517 +0517 +0553 +0517 +0517 +0538 +0539 +0538 +0539 +270b +0539 +0538 +0539 +2070 +0539 +0538 +0539 +0811 +0539 +0811 +0539 +0812 +0708 +0811 +0811 +0811 +0811 +0811 +0811 +0811 +0811 +078c +25b6 +25b6 +25b6 +25b6 +25b6 +25b6 +25b6 +25b6 +25b6 +25b6 +25b6 +078c +04ee +078c +0727 +0727 +2071 +2072 +2072 +2071 +0539 +25b3 +0539 +25b5 +0539 +0538 +0539 +0538 +0539 +0538 +0539 +0538 +0539 +0538 +0581 +0539 +0538 +0539 +7000 +0539 +0538 +0539 +0538 +0539 +0538 +0581 +0581 +0539 +0538 +0539 +25b0 +0539 +0538 +0539 +0538 +0539 +0731 +0539 +0538 +0539 +0538 +0539 +0538 +0539 +0538 +0539 +0538 +0539 +0538 +0539 +0538 +0539 +0538 +0539 +0538 +0539 +0538 +0539 +0538 +0539 +0538 +0539 +0538 +0539 +0538 +0539 +0538 +0539 +0538 +0539 +0538 +0539 +0538 +0539 +0538 +0539 +2028 +0539 +0538 +0539 + +0c33 +Saving Base Customize Data to boot disk +Starting the sync daemon +Starting the error daemon + +System initialization completed. +TE=OFF +CHKEXEC=OFF +CHKSHLIB=OFF +CHKSCRIPT=OFF +CHKKERNEXT=OFF +STOP_UNTRUSTD=OFF +STOP_ON_CHKFAIL=OFF +LOCK_KERN_POLICIES=OFF +TSD_FILES_LOCK=OFF +TSD_LOCK=OFF +TEP=OFF +TLP=OFF +Successfully updated the Kernel Authorization Table. +Successfully updated the Kernel Role Table. +Successfully updated the Kernel Command Table. +Successfully updated the Kernel Device Table. +Successfully updated the Kernel Object Domain Table. +Successfully updated the Kernel Domains Table. +Successfully updated the Kernel RBAC log level. +Successfully updated the Kernel RBAC log level. +OPERATIONAL MODE Security Flags +ROOT : ENABLED +TRACEAUTH : DISABLED +System runtime mode is now OPERATIONAL MODE. +Setting tunable parameters...complete +Checking for srcmstr active...complete +Starting tcpip daemons: +0513-059 The sendmail Subsystem has been started. Subsystem PID is 4456846. +0513-059 The syslogd Subsystem has been started. Subsystem PID is 4522382. +0513-059 The portmap Subsystem has been started. Subsystem PID is 4194776. +0513-059 The inetd Subsystem has been started. Subsystem PID is 4129230. +0513-059 The snmpmibd Subsystem has been started. Subsystem PID is 4325672. +Finished starting tcpip daemons. + + +AIX Version 7 +Copyright IBM Corporation, 1982, 2019. +Console login: root +root's Password: + +******************************************************************************* +* * +* * +* Welcome to AIX Version 7.2! * +* * +* * +* Please see the README file in /usr/lpp/bos for information pertinent to * +* this release of the AIX Operating System. * +* * +* * +******************************************************************************* +Last login: Wed Apr 22 07:21:19 EDT 2020 on /dev/vty0 + +root@aix-ppc64# oslevel -s +7200-04-01-1939 +root@aix-ppc64# \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1875819 b/results/classifier/mode-deepseek-r1:32b/output/system/1875819 new file mode 100644 index 00000000..8680a59a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1875819 @@ -0,0 +1,5 @@ + + +[Feature request] prebuilt testing docker images + +Instead of building qemu:docker images locally, we should pull the one built from Travis/Shippable/GitLab by default, and build it only when manually requested. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1877136 b/results/classifier/mode-deepseek-r1:32b/output/system/1877136 new file mode 100644 index 00000000..21d00c76 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1877136 @@ -0,0 +1,58 @@ + + +Qemu GDB Arm core registers XML description not valid for M-profile + +When trying to debug an armv7-m binary running on Qemu, GDB makes some mistakes due to mistakenly believing the target is not M-profile. + +One observable is that backtraces over signal handlers are not handled correctly -- since the special M-profile EXC_RETURN value is not recognised. That happens because GDB doesn't think the target is M-profile. + +This happens because GDB sees a reported feature set from the Qemu remote connection that includes the feature `org.gnu.gdb.arm.core`. + +As described in the GDB online docs, for "M-profile targets (e.g. Cortex-M3), the ‘org.gnu.gdb.arm.core’ feature is replaced by ‘org.gnu.gdb.arm.m-profile’" +https://sourceware.org/gdb/current/onlinedocs/gdb/ARM-Features.html + +From a scan of the Qemu source code on commit ea1329bb3a8d5cd25b70e3dbf73e7ded4d5ad756 it seems that when emulating an arm core it uses `arm-core.xml` unconditionally for `CPUClass->gdb_core_xml_file`, and that means the only feature provided is `org.gnu.gdb.arm.core`. + +Note that even though there is a command to set the architecture in GDB, setting the target architecture to an M-profile core is still not a valid workaround. +This is because the target description overrides everything in setting the `is_m` attribute within GDB. + +Reproduction of the observable: +Using the examples here https://git.linaro.org/people/peter.maydell/m-profile-tests.git/tree/ . +Build the examples, and run +``` +qemu-system-arm -s -S -no-reboot -M lm3s6965evb -m 16 -serial stdio -display none -net nic -net user,restrict=on -d guest_errors,unimp -kernel test3-kern.bin +``` + +Then in a GDB session +``` +vshcmd: > arm-none-eabi-gdb -q +(gdb) +vshcmd: > file test3-kern.elf +Reading symbols from test3-kern.elf... +(gdb) +vshcmd: > target remote localhost:1234 +Remote debugging using localhost:1234 +_start () at init-m.S:53 +53 mov r0, #0 +(gdb) +vshcmd: > show architecture +The target architecture is set automatically (currently armv7) +(gdb) +vshcmd: > break svc +Breakpoint 1 at 0x6fc: svc. (2 locations) +(gdb) +vshcmd: > cont +Continuing. + +Breakpoint 1, svc () at test3.c:16 +16 int test = SEQ(); +(gdb) +vshcmd: > bt +#0 svc () at test3.c:16 +#1 0xfffffff8 in ?? () +Backtrace stopped: previous frame identical to this frame (corrupt stack?) +(gdb) +vshcmd: > print/x $lr +$1 = 0xfffffff9 +(gdb) +``` \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1877418 b/results/classifier/mode-deepseek-r1:32b/output/system/1877418 new file mode 100644 index 00000000..4d72df3a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1877418 @@ -0,0 +1,8 @@ + + +qemu-nbd freezes access to VDI file + +Mounted Oracle Virtualbox .vdi drive, which has GTP+BTRFS: +sudo qemu-nbd -c /dev/nbd0 /storage/btrfs.vdi + +Then I am operating on the btrfs filesystem and suddenly it freezes. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1877781 b/results/classifier/mode-deepseek-r1:32b/output/system/1877781 new file mode 100644 index 00000000..6222101f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1877781 @@ -0,0 +1,7 @@ + + +TCG does not support x2APIC emulation + +This is not a bug so much as a feature request. + +It would be great if there was a pure-software emulation of the x2APIC on x86_64, so that it could be used on systems that don't support such providing a thing on via a host-based solution (e.g., KVM etc). KVM provides this, but that doesn't help if you're working on a machine that doesn't support KVM. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1878253 b/results/classifier/mode-deepseek-r1:32b/output/system/1878253 new file mode 100644 index 00000000..a829539f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1878253 @@ -0,0 +1,58 @@ + + +null-ptr dereference in address_space_to_flatview through ide + +Hello, +While fuzzing, I found an input that triggers a null-ptr dereference in +address_space_to_flatview through ide: + +==31699==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000020 (pc 0x55e0f562bafd bp 0x7ffee92355b0 sp 0x7ffee92354e0 T0) +==31699==The signal is caused by a READ memory access. +==31699==Hint: address points to the zero page. + #0 0x55e0f562bafd in address_space_to_flatview /home/alxndr/Development/qemu/include/exec/memory.h:693:12 + #1 0x55e0f562bafd in address_space_write /home/alxndr/Development/qemu/exec.c:3267:14 + #2 0x55e0f562dd9c in address_space_unmap /home/alxndr/Development/qemu/exec.c:3592:9 + #3 0x55e0f5ab8277 in dma_memory_unmap /home/alxndr/Development/qemu/include/sysemu/dma.h:145:5 + #4 0x55e0f5ab8277 in dma_blk_unmap /home/alxndr/Development/qemu/dma-helpers.c:104:9 + #5 0x55e0f5ab8277 in dma_blk_cb /home/alxndr/Development/qemu/dma-helpers.c:139:5 + #6 0x55e0f617a6b8 in blk_aio_complete /home/alxndr/Development/qemu/block/block-backend.c:1398:9 + #7 0x55e0f617a6b8 in blk_aio_complete_bh /home/alxndr/Development/qemu/block/block-backend.c:1408:5 + #8 0x55e0f6355efb in aio_bh_call /home/alxndr/Development/qemu/util/async.c:136:5 + #9 0x55e0f6355efb in aio_bh_poll /home/alxndr/Development/qemu/util/async.c:164:13 + #10 0x55e0f63608ce in aio_dispatch /home/alxndr/Development/qemu/util/aio-posix.c:380:5 + #11 0x55e0f635799a in aio_ctx_dispatch /home/alxndr/Development/qemu/util/async.c:306:5 + #12 0x7f16e85d69ed in g_main_context_dispatch (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4e9ed) + #13 0x55e0f635e384 in glib_pollfds_poll /home/alxndr/Development/qemu/util/main-loop.c:219:9 + #14 0x55e0f635e384 in os_host_main_loop_wait /home/alxndr/Development/qemu/util/main-loop.c:242:5 + #15 0x55e0f635e384 in main_loop_wait /home/alxndr/Development/qemu/util/main-loop.c:518:11 + #16 0x55e0f593d676 in qemu_main_loop /home/alxndr/Development/qemu/softmmu/vl.c:1664:9 + #17 0x55e0f6267c6a in main /home/alxndr/Development/qemu/softmmu/main.c:49:5 + #18 0x7f16e7186e0a in __libc_start_main /build/glibc-GwnBeO/glibc-2.30/csu/../csu/libc-start.c:308:16 + #19 0x55e0f55727b9 in _start (/home/alxndr/Development/qemu/build/i386-softmmu/qemu-system-i386+0x9027b9) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /home/alxndr/Development/qemu/include/exec/memory.h:693:12 in address_space_to_flatview + +I can reproduce it in qemu 5.0 using: + +cat << EOF | ~/Development/qemu/build/i386-softmmu/qemu-system-i386 -M pc -nographic -drive file=null-co://,if=ide,cache=writeback,format=raw -nodefaults -display none -nographic -qtest stdio -monitor none -serial none +outl 0xcf8 0x80000920 +outl 0xcfc 0xc001 +outl 0xcf8 0x80000924 +outl 0xcf8 0x80000904 +outw 0xcfc 0x7 +outb 0x1f7 0xc8 +outw 0x3f6 0xe784 +outw 0x3f6 0xeb01 +outb 0xc005 0x21 +write 0x2103 0x1 0x4e +outb 0xc000 0x1b +outw 0x1f7 0xff35 +EOF + +I also attached the traces to this launchpad report, in case the formatting is broken: + +qemu-system-i386 -M pc -nographic -drive file=null-co://,if=ide,cache=writeback,format=raw -nodefaults -display none -nographic -qtest stdio -monitor none -serial none < attachment + +Please let me know if I can provide any further info. +-Alex \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1878642 b/results/classifier/mode-deepseek-r1:32b/output/system/1878642 new file mode 100644 index 00000000..c98dd73d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1878642 @@ -0,0 +1,53 @@ + + +Assertion failure in pci_bus_get_irq_level + +Hello, +I found an input which triggers an assertion failure in pci_bus_get_irq_level: + +qemu-system-i386: /home/alxndr/Development/qemu/hw/pci/pci.c:268: int pci_bus_get_irq_level(PCIBus *, int): Assertion `irq_num < bus->nirq' failed. +Aborted +#0 0x00007ffff686d761 in __GI_raise (sig=sig@entry=0x6) at ../sysdeps/unix/sysv/linux/raise.c:50 +#1 0x00007ffff685755b in __GI_abort () at abort.c:79 +#2 0x00007ffff685742f in __assert_fail_base (fmt=0x7ffff69bdb48 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x555557f9bca0 <str> "irq_num < bus->nirq", file=0x555557f9bbe0 <str> "/home/alxndr/Development/qemu/hw/pci/pci.c", line=0x10c, function=<optimized out>) at assert.c:92 +#3 0x00007ffff6866092 in __GI___assert_fail (assertion=0x555557f9bca0 <str> "irq_num < bus->nirq", file=0x555557f9bbe0 <str> "/home/alxndr/Development/qemu/hw/pci/pci.c", line=0x10c, function=0x555557f9bc40 <__PRETTY_FUNCTION__.pci_bus_get_irq_level> "int pci_bus_get_irq_level(PCIBus *, int)") at assert.c:101 +#4 0x0000555557060c34 in pci_bus_get_irq_level (bus=0x61d000096080, irq_num=0xef) at /home/alxndr/Development/qemu/hw/pci/pci.c:268 +#5 0x0000555556657391 in ich9_lpc_update_apic (lpc=0x62a000006200, gsi=0xff) at /home/alxndr/Development/qemu/hw/isa/lpc_ich9.c:249 +#6 0x0000555556658ea7 in ich9_set_sci (opaque=0x62a000006200, irq_num=0x0, level=0x1) at /home/alxndr/Development/qemu/hw/isa/lpc_ich9.c:354 +#7 0x0000555556ccefc6 in qemu_set_irq (irq=0x60600002af80, level=0x1) at /home/alxndr/Development/qemu/hw/core/irq.c:44 +#8 0x0000555556bc06fd in acpi_update_sci (regs=0x62a000006c80, irq=0x60600002af80) at /home/alxndr/Development/qemu/hw/acpi/core.c:723 +#9 0x0000555556bccb08 in ich9_pm_update_sci_fn (regs=0x62a000006c80) at /home/alxndr/Development/qemu/hw/acpi/ich9.c:56 +#10 0x0000555556bc10ee in acpi_pm_evt_write (opaque=0x62a000006c80, addr=0x2, val=0x2049, width=0x2) at /home/alxndr/Development/qemu/hw/acpi/core.c:456 +#11 0x00005555564938b5 in memory_region_write_accessor (mr=0x62a000006db0, addr=0x2, value=0x7fffffff9c70, size=0x2, shift=0x0, mask=0xffff, attrs=...) at /home/alxndr/Development/qemu/memory.c:483 +#12 0x000055555649328a in access_with_adjusted_size (addr=0x2, value=0x7fffffff9c70, size=0x2, access_size_min=0x1, access_size_max=0x4, access_fn=0x555556493360 <memory_region_write_accessor>, mr=0x62a000006db0, attrs=...) at /home/alxndr/Development/qemu/memory.c:544 +#13 0x0000555556491df6 in memory_region_dispatch_write (mr=0x62a000006db0, addr=0x2, data=0x2049, op=MO_16, attrs=...) at /home/alxndr/Development/qemu/memory.c:1476 +#14 0x00005555562cbbf4 in flatview_write_continue (fv=0x606000033fe0, addr=0x5d02, attrs=..., ptr=0x7fffffffa4e0, len=0x4, addr1=0x2, l=0x2, mr=0x62a000006db0) at /home/alxndr/Development/qemu/exec.c:3137 +#15 0x00005555562bbad9 in flatview_write (fv=0x606000033fe0, addr=0x5d02, attrs=..., buf=0x7fffffffa4e0, len=0x4) at /home/alxndr/Development/qemu/exec.c:3177 +#16 0x00005555562bb609 in address_space_write (as=0x55555968f940 <address_space_io>, addr=0x5d02, attrs=..., buf=0x7fffffffa4e0, len=0x4) at /home/alxndr/Development/qemu/exec.c:3268 +#17 0x0000555556478c0a in cpu_outl (addr=0x5d02, val=0xedf82049) at /home/alxndr/Development/qemu/ioport.c:80 +#18 0x000055555648166f in qtest_process_command (chr=0x555559691d00 <qtest_chr>, words=0x60300009ef20) at /home/alxndr/Development/qemu/qtest.c:396 +#19 0x000055555647f187 in qtest_process_inbuf (chr=0x555559691d00 <qtest_chr>, inbuf=0x61900000f680) at /home/alxndr/Development/qemu/qtest.c:710 +#20 0x000055555647e8b4 in qtest_read (opaque=0x555559691d00 <qtest_chr>, buf=0x7fffffffca40 "outl 0xcf8 0x8400f841\noutl 0xcfc 0xebed205d\noutl 0x5d02 0xedf82049\n-M pc-q35-5.0 -device intel-hda,id=hda0 -device hda-output,bus=hda0.0 -device hda-micro,bus=hda0.0 -device hda-duplex,bus=hda0.0 -display none -nodefaults -nographic\n", size=0xe9) at /home/alxndr/Development/qemu/qtest.c:722 +#21 0x00005555579c260c in qemu_chr_be_write_impl (s=0x60f000001f30, buf=0x7fffffffca40 "outl 0xcf8 0x8400f841\noutl 0xcfc 0xebed205d\noutl 0x5d02 0xedf82049\n-M pc-q35-5.0 -device intel-hda,id=hda0 -device hda-output,bus=hda0.0 -device hda-micro,bus=hda0.0 -device hda-duplex,bus=hda0.0 -display none -nodefaults -nographic\n", len=0xe9) at /home/alxndr/Development/qemu/chardev/char.c:183 +#22 0x00005555579c275b in qemu_chr_be_write (s=0x60f000001f30, buf=0x7fffffffca40 "outl 0xcf8 0x8400f841\noutl 0xcfc 0xebed205d\noutl 0x5d02 0xedf82049\n-M pc-q35-5.0 -device intel-hda,id=hda0 -device hda-output,bus=hda0.0 -device hda-micro,bus=hda0.0 -device hda-duplex,bus=hda0.0 -display none -nodefaults -nographic\n", len=0xe9) at /home/alxndr/Development/qemu/chardev/char.c:195 +#23 0x00005555579cb97a in fd_chr_read (chan=0x6080000026a0, cond=G_IO_IN, opaque=0x60f000001f30) at /home/alxndr/Development/qemu/chardev/char-fd.c:68 +#24 0x0000555557a530ea in qio_channel_fd_source_dispatch (source=0x60c00002ef00, callback=0x5555579cb540 <fd_chr_read>, user_data=0x60f000001f30) at /home/alxndr/Development/qemu/io/channel-watch.c:84 +#25 0x00007ffff7ca8898 in g_main_context_dispatch () at /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0 +#26 0x0000555557c10b85 in glib_pollfds_poll () at /home/alxndr/Development/qemu/util/main-loop.c:219 +#27 0x0000555557c0f57e in os_host_main_loop_wait (timeout=0x0) at /home/alxndr/Development/qemu/util/main-loop.c:242 +#28 0x0000555557c0f177 in main_loop_wait (nonblocking=0x0) at /home/alxndr/Development/qemu/util/main-loop.c:518 +#29 0x000055555689fd1e in qemu_main_loop () at /home/alxndr/Development/qemu/softmmu/vl.c:1664 +#30 0x0000555557a6a29d in main (argc=0x17, argv=0x7fffffffe148, envp=0x7fffffffe208) at /home/alxndr/Development/qemu/softmmu/main.c:49 + +I can reproduce this in qemu 5.0 using these qtest commands: + +cat << EOF | ./qemu-system-i386 \ +-qtest stdio -nographic -monitor none -serial none \ +-M pc-q35-5.0 +outl 0xcf8 0x8400f841 +outl 0xcfc 0xebed205d +outl 0x5d02 0xedf82049 +EOF + +Please let me know if I can provide any further info. +-Alex \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1878645 b/results/classifier/mode-deepseek-r1:32b/output/system/1878645 new file mode 100644 index 00000000..5523fbe2 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1878645 @@ -0,0 +1,53 @@ + + +null-ptr dereference in ich9_apm_ctrl_changed + +Hello, +While fuzzing, I found an input which triggers a NULL pointer dereference in +tcg_handle_interrupt. It seems the culprint is a "cpu" pointer - maybe this bug +is specific to QTest? + +==23862==ERROR: AddressSanitizer: SEGV on unknown address 0x0000000000b4 (pc 0x55b9dc7c9dce bp 0x7ffc346a0900 sp 0x7ffc346a0880 T0) +==23862==The signal is caused by a READ memory access. +==23862==Hint: address points to the zero page. + #0 0x55b9dc7c9dce in tcg_handle_interrupt /home/alxndr/Development/qemu/accel/tcg/tcg-all.c:57:21 + #1 0x55b9dc904799 in cpu_interrupt /home/alxndr/Development/qemu/include/hw/core/cpu.h:872:5 + #2 0x55b9dc9085e8 in ich9_apm_ctrl_changed /home/alxndr/Development/qemu/hw/isa/lpc_ich9.c:442:13 + #3 0x55b9dd19cdc8 in apm_ioport_writeb /home/alxndr/Development/qemu/hw/isa/apm.c:50:13 + #4 0x55b9dc73f8b4 in memory_region_write_accessor /home/alxndr/Development/qemu/memory.c:483:5 + #5 0x55b9dc73f289 in access_with_adjusted_size /home/alxndr/Development/qemu/memory.c:544:18 + #6 0x55b9dc73ddf5 in memory_region_dispatch_write /home/alxndr/Development/qemu/memory.c:1476:16 + #7 0x55b9dc577bf3 in flatview_write_continue /home/alxndr/Development/qemu/exec.c:3137:23 + #8 0x55b9dc567ad8 in flatview_write /home/alxndr/Development/qemu/exec.c:3177:14 + #9 0x55b9dc567608 in address_space_write /home/alxndr/Development/qemu/exec.c:3268:18 + #10 0x55b9dc723fe7 in cpu_outb /home/alxndr/Development/qemu/ioport.c:60:5 + #11 0x55b9dc72d3c0 in qtest_process_command /home/alxndr/Development/qemu/qtest.c:392:13 + #12 0x55b9dc72b186 in qtest_process_inbuf /home/alxndr/Development/qemu/qtest.c:710:9 + #13 0x55b9dc72a8b3 in qtest_read /home/alxndr/Development/qemu/qtest.c:722:5 + #14 0x55b9ddc6e60b in qemu_chr_be_write_impl /home/alxndr/Development/qemu/chardev/char.c:183:9 + #15 0x55b9ddc6e75a in qemu_chr_be_write /home/alxndr/Development/qemu/chardev/char.c:195:9 + #16 0x55b9ddc77979 in fd_chr_read /home/alxndr/Development/qemu/chardev/char-fd.c:68:9 + #17 0x55b9ddcff0e9 in qio_channel_fd_source_dispatch /home/alxndr/Development/qemu/io/channel-watch.c:84:12 + #18 0x7f7161eac897 in g_main_context_dispatch (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4e897) + #19 0x55b9ddebcb84 in glib_pollfds_poll /home/alxndr/Development/qemu/util/main-loop.c:219:9 + #20 0x55b9ddebb57d in os_host_main_loop_wait /home/alxndr/Development/qemu/util/main-loop.c:242:5 + #21 0x55b9ddebb176 in main_loop_wait /home/alxndr/Development/qemu/util/main-loop.c:518:11 + #22 0x55b9dcb4bd1d in qemu_main_loop /home/alxndr/Development/qemu/softmmu/vl.c:1664:9 + #23 0x55b9ddd1629c in main /home/alxndr/Development/qemu/softmmu/main.c:49:5 + #24 0x7f7160a5ce0a in __libc_start_main /build/glibc-GwnBeO/glibc-2.30/csu/../csu/libc-start.c:308:16 + #25 0x55b9dc49c819 in _start (/home/alxndr/Development/qemu/build/i386-softmmu/qemu-system-i386+0xc9c819) + + +I can reproduce this in qemu 5.0 built with AddressSanitizer using these qtest commands: + +cat << EOF | ./qemu-system-i386 \ +-qtest stdio -nographic -monitor none -serial none \ +-M pc-q35-5.0 +outl 0xcf8 0x8400f841 +outl 0xcfc 0xaa215d6d +outl 0x6d30 0x2ef8ffbe +outb 0xb2 0x20 +EOF + +Please let me know if I can provide any further info. +-Alex \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1878651 b/results/classifier/mode-deepseek-r1:32b/output/system/1878651 new file mode 100644 index 00000000..b3ce87d2 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1878651 @@ -0,0 +1,69 @@ + + +Assertion failure in e1000e_write_to_rx_buffers + +Hello, +While fuzzing, I found an input which triggers an assertion failure in e1000e_write_to_rx_buffers: +/home/alxndr/Development/qemu/hw/net/e1000e_core.c:1424: void e1000e_write_to_rx_buffers(E1000ECore *, hwaddr (*)[4], e1000e_ba_state *, const char *, dma_addr_t): Assertion `bastate->cur_idx < MAX_PS_BUFFERS' failed. +#0 0x00007ffff686d761 in __GI_raise (sig=sig@entry=0x6) at ../sysdeps/unix/sysv/linux/raise.c:50 +#1 0x00007ffff685755b in __GI_abort () at abort.c:79 +#2 0x00007ffff685742f in __assert_fail_base (fmt=0x7ffff69bdb48 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x555557f691e0 <str> "bastate->cur_idx < MAX_PS_BUFFERS", file=0x555557f5a080 <str> "/home/alxndr/Development/qemu/hw/net/e1000e_core.c", line=0x590, function=<optimized out>) at assert.c:92 +#3 0x00007ffff6866092 in __GI___assert_fail (assertion=0x555557f691e0 <str> "bastate->cur_idx < MAX_PS_BUFFERS", file=0x555557f5a080 <str> "/home/alxndr/Development/qemu/hw/net/e1000e_core.c", line=0x590, function=0x555557f69240 <__PRETTY_FUNCTION__.e1000e_write_to_rx_buffers> "void e1000e_write_to_rx_buffers(E1000ECore *, hwaddr (*)[4], e1000e_ba_state *, const char *, dma_addr_t)") at assert.c:101 +#4 0x0000555556f8fbcd in e1000e_write_to_rx_buffers (core=0x7fffee07c4e0, ba=0x7fffffff8860, bastate=0x7fffffff88a0, data=0x7fffe61b8021 "", data_len=0x2000) at /home/alxndr/Development/qemu/hw/net/e1000e_core.c:1424 +#5 0x0000555556f82f14 in e1000e_write_packet_to_guest (core=0x7fffee07c4e0, pkt=0x61100004b900, rxr=0x7fffffff8d10, rss_info=0x7fffffff8d30) at /home/alxndr/Development/qemu/hw/net/e1000e_core.c:1582 +#6 0x0000555556f80960 in e1000e_receive_iov (core=0x7fffee07c4e0, iov=0x61900004e780, iovcnt=0x4) at /home/alxndr/Development/qemu/hw/net/e1000e_core.c:1709 +#7 0x0000555556f7d457 in e1000e_nc_receive_iov (nc=0x614000007460, iov=0x61900004e780, iovcnt=0x4) at /home/alxndr/Development/qemu/hw/net/e1000e.c:213 +#8 0x0000555556f64738 in net_tx_pkt_sendv (pkt=0x631000028800, nc=0x614000007460, iov=0x61900004e780, iov_cnt=0x4) at /home/alxndr/Development/qemu/hw/net/net_tx_pkt.c:544 +#9 0x0000555556f63f0e in net_tx_pkt_send (pkt=0x631000028800, nc=0x614000007460) at /home/alxndr/Development/qemu/hw/net/net_tx_pkt.c:620 +#10 0x0000555556f650e5 in net_tx_pkt_send_loopback (pkt=0x631000028800, nc=0x614000007460) at /home/alxndr/Development/qemu/hw/net/net_tx_pkt.c:633 +#11 0x0000555556fb026a in e1000e_tx_pkt_send (core=0x7fffee07c4e0, tx=0x7fffee09c748, queue_index=0x0) at /home/alxndr/Development/qemu/hw/net/e1000e_core.c:664 +#12 0x0000555556faebf6 in e1000e_process_tx_desc (core=0x7fffee07c4e0, tx=0x7fffee09c748, dp=0x7fffffff9520, queue_index=0x0) at /home/alxndr/Development/qemu/hw/net/e1000e_core.c:743 +#13 0x0000555556fadfa8 in e1000e_start_xmit (core=0x7fffee07c4e0, txr=0x7fffffff9720) at /home/alxndr/Development/qemu/hw/net/e1000e_core.c:934 +#14 0x0000555556fa308b in e1000e_set_tdt (core=0x7fffee07c4e0, index=0xe06, val=0x563) at /home/alxndr/Development/qemu/hw/net/e1000e_core.c:2451 +#15 0x0000555556f84d7e in e1000e_core_write (core=0x7fffee07c4e0, addr=0x438, val=0x563, size=0x4) at /home/alxndr/Development/qemu/hw/net/e1000e_core.c:3261 +#16 0x0000555556f79497 in e1000e_mmio_write (opaque=0x7fffee079800, addr=0x438, val=0x563, size=0x4) at /home/alxndr/Development/qemu/hw/net/e1000e.c:109 +#17 0x00005555564938b5 in memory_region_write_accessor (mr=0x7fffee07c110, addr=0x438, value=0x7fffffff9d90, size=0x4, shift=0x0, mask=0xffffffff, attrs=...) at /home/alxndr/Development/qemu/memory.c:483 +#18 0x000055555649328a in access_with_adjusted_size (addr=0x438, value=0x7fffffff9d90, size=0x2, access_size_min=0x4, access_size_max=0x4, access_fn=0x555556493360 <memory_region_write_accessor>, mr=0x7fffee07c110, attrs=...) at /home/alxndr/Development/qemu/memory.c:544 +#19 0x0000555556491df6 in memory_region_dispatch_write (mr=0x7fffee07c110, addr=0x438, data=0x563, op=MO_16, attrs=...) at /home/alxndr/Development/qemu/memory.c:1476 +#20 0x00005555562cbbf4 in flatview_write_continue (fv=0x606000037820, addr=0xe1020438, attrs=..., ptr=0x61900009ba80, len=0x2, addr1=0x438, l=0x2, mr=0x7fffee07c110) at /home/alxndr/Development/qemu/exec.c:3137 +#21 0x00005555562bbad9 in flatview_write (fv=0x606000037820, addr=0xe1020023, attrs=..., buf=0x61900009ba80, len=0x417) at /home/alxndr/Development/qemu/exec.c:3177 +#22 0x00005555562bb609 in address_space_write (as=0x6080000027a0, addr=0xe1020023, attrs=..., buf=0x61900009ba80, len=0x417) at /home/alxndr/Development/qemu/exec.c:3268 +#23 0x0000555556488c07 in qtest_process_command (chr=0x555559691d00 <qtest_chr>, words=0x60400001e210) at /home/alxndr/Development/qemu/qtest.c:567 +#24 0x000055555647f187 in qtest_process_inbuf (chr=0x555559691d00 <qtest_chr>, inbuf=0x61900000f680) at /home/alxndr/Development/qemu/qtest.c:710 +#25 0x000055555647e8b4 in qtest_read (opaque=0x555559691d00 <qtest_chr>, buf=0x7fffffffc9e0 "e2d1b0002e10000000006ff4d055e2d1b0002e10000000006ff4f055e2d1b0002e10000000006ff51055e2d1b0002e10000000006ff53055e2d1b0002e10000000006ff55055e2d1b0002e10000000006ff57055e2d1b0002e10000000006ff59055e2d1b0002e10000000006ff5b055e2d1b0002e10000000006ff5d055e2d1b0002e10000000006ff5f055e2d1b0002e10000000006ff61055e2d1b0002e10000000006ff6305\n-M pc-q35-5.0 -device sdhci-pci,sd-spec-version=3 -device sd-card,drive=mydrive -drive if=sd,index=0,file=null-co://,format=raw,id=mydrive -nographic -nographic\n002e10000000006ff27055e2d1b0002e10000000006ff29055e2d1b0002e10000000006ff2b055e2d1b0002e10000000006ff2d055e2d1b0002e10000000006ff2f055e2d1b0002e10000000006ff31055e2d1b0002e10000000006ff33055e2d1b0002e10000000006ff35055e2d1b0002e10000000006ff37055e2d1b0002e10000000006ff39055e2d1b0002e10000000006ff3b055e2d1b0002e10000000006ff3d055e2d1b0002e10000000006ff3f055e2d1b0002e10000000006ff41055e2d1b0002e10000000006ff43055e2d1b0002e10000000006ff45055e2d1b0002e10000000006ff47055e2d1b0002e10000000006ff49055e2d1b0002e10000000006ff4b055\360U", size=0x1f2) at /home/alxndr/Development/qemu/qtest.c:722 +#26 0x00005555579c260c in qemu_chr_be_write_impl (s=0x60f000001d50, buf=0x7fffffffc9e0 "e2d1b0002e10000000006ff4d055e2d1b0002e10000000006ff4f055e2d1b0002e10000000006ff51055e2d1b0002e10000000006ff53055e2d1b0002e10000000006ff55055e2d1b0002e10000000006ff57055e2d1b0002e10000000006ff59055e2d1b0002e10000000006ff5b055e2d1b0002e10000000006ff5d055e2d1b0002e10000000006ff5f055e2d1b0002e10000000006ff61055e2d1b0002e10000000006ff6305\n-M pc-q35-5.0 -device sdhci-pci,sd-spec-version=3 -device sd-card,drive=mydrive -drive if=sd,index=0,file=null-co://,format=raw,id=mydrive -nographic -nographic\n002e10000000006ff27055e2d1b0002e10000000006ff29055e2d1b0002e10000000006ff2b055e2d1b0002e10000000006ff2d055e2d1b0002e10000000006ff2f055e2d1b0002e10000000006ff31055e2d1b0002e10000000006ff33055e2d1b0002e10000000006ff35055e2d1b0002e10000000006ff37055e2d1b0002e10000000006ff39055e2d1b0002e10000000006ff3b055e2d1b0002e10000000006ff3d055e2d1b0002e10000000006ff3f055e2d1b0002e10000000006ff41055e2d1b0002e10000000006ff43055e2d1b0002e10000000006ff45055e2d1b0002e10000000006ff47055e2d1b0002e10000000006ff49055e2d1b0002e10000000006ff4b055\360U", len=0x1f2) at /home/alxndr/Development/qemu/chardev/char.c:183 +#27 0x00005555579c275b in qemu_chr_be_write (s=0x60f000001d50, buf=0x7fffffffc9e0 "e2d1b0002e10000000006ff4d055e2d1b0002e10000000006ff4f055e2d1b0002e10000000006ff51055e2d1b0002e10000000006ff53055e2d1b0002e10000000006ff55055e2d1b0002e10000000006ff57055e2d1b0002e10000000006ff59055e2d1b0002e10000000006ff5b055e2d1b0002e10000000006ff5d055e2d1b0002e10000000006ff5f055e2d1b0002e10000000006ff61055e2d1b0002e10000000006ff6305\n-M pc-q35-5.0 -device sdhci-pci,sd-spec-version=3 -device sd-card,drive=mydrive -drive if=sd,index=0,file=null-co://,format=raw,id=mydrive -nographic -nographic\n002e10000000006ff27055e2d1b0002e10000000006ff29055e2d1b0002e10000000006ff2b055e2d1b0002e10000000006ff2d055e2d1b0002e10000000006ff2f055e2d1b0002e10000000006ff31055e2d1b0002e10000000006ff33055e2d1b0002e10000000006ff35055e2d1b0002e10000000006ff37055e2d1b0002e10000000006ff39055e2d1b0002e10000000006ff3b055e2d1b0002e10000000006ff3d055e2d1b0002e10000000006ff3f055e2d1b0002e10000000006ff41055e2d1b0002e10000000006ff43055e2d1b0002e10000000006ff45055e2d1b0002e10000000006ff47055e2d1b0002e10000000006ff49055e2d1b0002e10000000006ff4b055\360U", len=0x1f2) at /home/alxndr/Development/qemu/chardev/char.c:195 +#28 0x00005555579cb97a in fd_chr_read (chan=0x6080000026a0, cond=G_IO_IN, opaque=0x60f000001d50) at /home/alxndr/Development/qemu/chardev/char-fd.c:68 +#29 0x0000555557a530ea in qio_channel_fd_source_dispatch (source=0x60c00002b780, callback=0x5555579cb540 <fd_chr_read>, user_data=0x60f000001d50) at /home/alxndr/Development/qemu/io/channel-watch.c:84 +#30 0x00007ffff7ca8898 in g_main_context_dispatch () at /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0 +#31 0x0000555557c10b85 in glib_pollfds_poll () at /home/alxndr/Development/qemu/util/main-loop.c:219 +#32 0x0000555557c0f57e in os_host_main_loop_wait (timeout=0x39c63cc8) at /home/alxndr/Development/qemu/util/main-loop.c:242 +#33 0x0000555557c0f177 in main_loop_wait (nonblocking=0x0) at /home/alxndr/Development/qemu/util/main-loop.c:518 +#34 0x000055555689fd1e in qemu_main_loop () at /home/alxndr/Development/qemu/softmmu/vl.c:1664 +#35 0x0000555557a6a29d in main (argc=0x13, argv=0x7fffffffe0e8, envp=0x7fffffffe188) at /home/alxndr/Development/qemu/softmmu/main.c:49 + + +I can reproduce this in qemu 5.0 using these qtest commands: + +cat << EOF | ./qemu-system-i386 \ +-qtest stdio -nographic -monitor none -serial none \ +-M pc-q35-5.0 +outl 0xcf8 0x80001010 +outl 0xcfc 0xe1020000 +outl 0xcf8 0x80001014 +outl 0xcf8 0x80001004 +outw 0xcfc 0x7 +outl 0xcf8 0x800010a2 +write 0xe1020618 0x14 0x0000d0ff2d05575f215e1b0000000000d0ff2d05 +write 0x27 0x800c 0x08004500feffffff00007b06f +write 0x1b8006 0x8001 0x2f0 +write 0xe1020023 0x417 0x0002e10000000006ffcf055e2d1b0002e10000000006ffd1055e2d1b0002e10000000006ffd3055e2d1b0002e10000000006ffd5055e2d1b0002e10000000006ffd7055e2d1b0002e10000000006ffd9055e2d1b0002e10000000006ffdb055e2d1b0002e10000000006ffdd055e2d1b0002e10000000006ffdf055e2d1b0002e10000000006ffe1055e2d1b0002e10000000006ffe3055e2d1b0002e10000000006ffe5055e2d1b0002e10000000006ffe7055e2d1b0002e10000000006ffe9055e2d1b0002e10000000006ffeb055e2d1b0002e10000000006ffed055e2d1b0002e10000000006ffef055e2d1b0002e10000000006fff1055e2d1b0002e10000000006fff3055e2d1b0002e10000000006fff5055e2d1b0002e10000000006fff7055e2d1b0002e10000000006fff9055e2d1b0002e10000000006fffb055e2d1b0002e10000000006fffd055e2d1b0002e10000000006ffff055e2d1b0002e10000000006ff01055e2d1b0002e10000000006ff03055e2d1b0002e10000000006ff05055e2d1b0002e10000000006ff07055e2d1b0002e10000000006ff09055e2d1b0002e10000000006ff0b055e2d1b0002e10000000006ff0d055e2d1b0002e10000000006ff0f055e2d1b0002e10000000006ff11055e2d1b0002e10000000006ff13055e2d1b0002e10000000006ff15055e2d1b0002e10000000006ff17055e2d1b0002e10000000006ff19055e2d1b0002e10000000006ff1b055e2d1b0002e10000000006ff1d055e2d1b0002e10000000006ff1f055e2d1b0002e10000000006ff21055e2d1b0002e10000000006ff23055e2d1b0002e10000000006ff25055e2d1b0002e10000000006ff27055e2d1b0002e10000000006ff29055e2d1b0002e10000000006ff2b055e2d1b0002e10000000006ff2d055e2d1b0002e10000000006ff2f055e2d1b0002e10000000006ff31055e2d1b0002e10000000006ff33055e2d1b0002e10000000006ff35055e2d1b0002e10000000006ff37055e2d1b0002e10000000006ff39055e2d1b0002e10000000006ff3b055e2d1b0002e10000000006ff3d055e2d1b0002e10000000006ff3f055e2d1b0002e10000000006ff41055e2d1b0002e10000000006ff43055e2d1b0002e10000000006ff45055e2d1b0002e10000000006ff47055e2d1b0002e10000000006ff49055e2d1b0002e10000000006ff4b055e2d1b0002e10000000006ff4d055e2d1b0002e10000000006ff4f055e2d1b0002e10000000006ff51055e2d1b0002e10000000006ff53055e2d1b0002e10000000006ff55055e2d1b0002e10000000006ff57055e2d1b0002e10000000006ff59055e2d1b0002e10000000006ff5b055e2d1b0002e10000000006ff5d055e2d1b0002e10000000006ff5f055e2d1b0002e10000000006ff61055e2d1b0002e10000000006ff6305 +EOF + +Also attaching them to this report, in case they are formatted incorrectly: +./qemu-system-i386 \ +-qtest stdio -nographic -monitor none -serial none \ +-M pc-q35-5.0 < attachment + +Please let me know if I can provide any further info. +-Alex \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1879 b/results/classifier/mode-deepseek-r1:32b/output/system/1879 new file mode 100644 index 00000000..1495d22d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1879 @@ -0,0 +1,11 @@ + + +ARM Cortex-A15 Emulation Not Working +Description of problem: +I want to make a VM with Windows RT 8.1 but it fails because it can't find a file for the to-emulate ARM CPU. +Steps to reproduce: +1. Use virt-manager to make a VM with the ARM architecture. +2. Make sure the emulated CPU is an ARM Cortex-A15. +3. Try installing and making the VM, it will fail with the error. +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1879531 b/results/classifier/mode-deepseek-r1:32b/output/system/1879531 new file mode 100644 index 00000000..3b5626bc --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1879531 @@ -0,0 +1,101 @@ + + +Stack-overflow in _eth_get_rss_ex_dst_addr + +Hello, +While fuzzing, I found a 1-byte stack-overflow (read) through the +e1000e. + +==10318==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffdb76c16c2 at pc 0x55594f1a69e1 bp 0x7ffdb76c15a0 sp 0x7ffdb76c1598 +READ of size 1 at 0x7ffdb76c16c2 thread T0 + #0 0x55594f1a69e0 in _eth_get_rss_ex_dst_addr /home/alxndr/Development/qemu/net/eth.c:410:17 + #1 0x55594f1a39da in eth_parse_ipv6_hdr /home/alxndr/Development/qemu/net/eth.c:532:17 + #2 0x55594ebc34f2 in net_tx_pkt_parse_headers /home/alxndr/Development/qemu/hw/net/net_tx_pkt.c:228:14 + #3 0x55594ebc2149 in net_tx_pkt_parse /home/alxndr/Development/qemu/hw/net/net_tx_pkt.c:273:9 + #4 0x55594ec1ba76 in e1000e_process_tx_desc /home/alxndr/Development/qemu/hw/net/e1000e_core.c:737:29 + #5 0x55594ec1aea4 in e1000e_start_xmit /home/alxndr/Development/qemu/hw/net/e1000e_core.c:934:9 + #6 0x55594ec0e70e in e1000e_set_tdt /home/alxndr/Development/qemu/hw/net/e1000e_core.c:2451:9 + #7 0x55594ebec435 in e1000e_core_write /home/alxndr/Development/qemu/hw/net/e1000e_core.c:3261:9 + #8 0x55594ebdf11b in e1000e_mmio_write /home/alxndr/Development/qemu/hw/net/e1000e.c:109:5 + #9 0x55594dfd98b1 in memory_region_write_accessor /home/alxndr/Development/qemu/memory.c:483:5 + #10 0x55594dfd9211 in access_with_adjusted_size /home/alxndr/Development/qemu/memory.c:544:18 + #11 0x55594dfd7c30 in memory_region_dispatch_write /home/alxndr/Development/qemu/memory.c:1476:16 + #12 0x55594dde24b8 in flatview_write_continue /home/alxndr/Development/qemu/exec.c:3137:23 + #13 0x55594ddd12dc in flatview_write /home/alxndr/Development/qemu/exec.c:3177:14 + #14 0x55594ddd0dec in address_space_write /home/alxndr/Development/qemu/exec.c:3268:18 + #15 0x55594dfcdbdc in qtest_process_command /home/alxndr/Development/qemu/qtest.c:567:9 + #16 0x55594dfc3700 in qtest_process_inbuf /home/alxndr/Development/qemu/qtest.c:710:9 + #17 0x55594dfc2cc8 in qtest_read /home/alxndr/Development/qemu/qtest.c:722:5 + #18 0x55594f74b259 in qemu_chr_be_write_impl /home/alxndr/Development/qemu/chardev/char.c:183:9 + #19 0x55594f74b3ee in qemu_chr_be_write /home/alxndr/Development/qemu/chardev/char.c:195:9 + #20 0x55594f7556fc in fd_chr_read /home/alxndr/Development/qemu/chardev/char-fd.c:68:9 + #21 0x55594f7ea488 in qio_channel_fd_source_dispatch /home/alxndr/Development/qemu/io/channel-watch.c:84:12 + #22 0x7f43f6c1d897 in g_main_context_dispatch (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4e897) + #23 0x55594f9dea5d in glib_pollfds_poll /home/alxndr/Development/qemu/util/main-loop.c:219:9 + #24 0x55594f9dd1d7 in os_host_main_loop_wait /home/alxndr/Development/qemu/util/main-loop.c:242:5 + #25 0x55594f9dcd6e in main_loop_wait /home/alxndr/Development/qemu/util/main-loop.c:518:11 + #26 0x55594e44cd01 in qemu_main_loop /home/alxndr/Development/qemu/softmmu/vl.c:1664:9 + #27 0x55594f803c21 in main /home/alxndr/Development/qemu/softmmu/main.c:49:5 + #28 0x7f43f57b4e0a in __libc_start_main /build/glibc-GwnBeO/glibc-2.30/csu/../csu/libc-start.c:308:16 + #29 0x55594dd03889 in _start (/home/alxndr/Development/qemu/build/i386-softmmu/qemu-system-i386+0xdbd889) + +Address 0x7ffdb76c16c2 is located in stack of thread T0 at offset 34 in frame + #0 0x55594f1a303f in eth_parse_ipv6_hdr /home/alxndr/Development/qemu/net/eth.c:486 + + This frame has 1 object(s): + [32, 34) 'ext_hdr' (line 487) <== Memory access at offset 34 overflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /home/alxndr/Development/qemu/net/eth.c:410:17 in _eth_get_rss_ex_dst_addr +Shadow bytes around the buggy address: + 0x100036ed0280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x100036ed0290: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x100036ed02a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x100036ed02b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x100036ed02c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x100036ed02d0: 00 00 00 00 f1 f1 f1 f1[02]f3 f3 f3 00 00 00 00 + 0x100036ed02e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x100036ed02f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x100036ed0300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x100036ed0310: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x100036ed0320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==10318==ABORTING + +I can reproduce it in qemu 5.0 built with address sanitizer using: + +cat << EOF | ./qemu-system-i386 -M pc-q35-5.0 -accel qtest -qtest stdio -monitor none -serial none -nographic +outl 0xcf8 0x80001010 +outl 0xcfc 0xe1020000 +outl 0xcf8 0x80001014 +outl 0xcf8 0x80001004 +outw 0xcfc 0x7 +outl 0xcf8 0x800010a2 +write 0x25 0x2b 0x86dd1900ff5df747002bfc90dd1900ff5df747002bfc9add1900ff5df747002bfca4dd1900ff5df747002b +write 0xe1020030 0x409 0x190002e100000000350908077cdd190002e100000000350912077cdd190002e10000000035091c077cdd190002e100000000350926077cdd190002e100000000350930077cdd190002e10000000035093a077cdd190002e100000000350944077cdd190002e10000000035094e077cdd190002e100000000350958077cdd190002e100000000350962077cdd190002e10000000035096c077cdd190002e100000000350976077cdd190002e100000000350980077cdd190002e10000000035098a077cdd190002e100000000350994077cdd190002e10000000035099e077cdd190002e1000000003509a8077cdd190002e1000000003509b2077cdd190002e1000000003509bc077cdd190002e1000000003509c6077cdd190002e1000000003509d0077cdd190002e1000000003509da077cdd190002e1000000003509e4077cdd190002e1000000003509ee077cdd190002e1000000003509f8077cdd190002e100000000350902077cdd190002e10000000035090c077cdd190002e100000000350916077cdd190002e100000000350920077cdd190002e10000000035092a077cdd190002e100000000350934077cdd190002e10000000035093e077cdd190002e100000000350948077cdd190002e100000000350952077cdd190002e10000000035095c077cdd190002e100000000350966077cdd190002e100000000350970077cdd190002e10000000035097a077cdd190002e100000000350984077cdd190002e10000000035098e077cdd190002e100000000350998077cdd190002e1000000003509a2077cdd190002e1000000003509ac077cdd190002e1000000003509b6077cdd190002e1000000003509c0077cdd190002e1000000003509ca077cdd190002e1000000003509d4077cdd190002e1000000003509de077cdd190002e1000000003509e8077cdd190002e1000000003509f2077cdd190002e1000000003509fc077cdd190002e100000000350906077cdd190002e100000000350910077cdd190002e10000000035091a077cdd190002e100000000350924077cdd190002e10000000035092e077cdd190002e100000000350938077cdd190002e100000000350942077cdd190002e10000000035094c077cdd190002e100000000350956077cdd190002e100000000350960077cdd190002e10000000035096a077cdd190002e100000000350974077cdd190002e10000000035097e077cdd190002e100000000350988077cdd190002e100000000350992077cdd190002e10000000035099c077cdd190002e1000000003509a6077cdd190002e1000000003509b0077cdd190002e1000000003509ba077cdd190002e1000000003509c4077cdd190002e1000000003509ce077cdd190002e1000000003509d8077cdd190002e1000000003509e2 +EOF + +Also attaching these commands. They can be executed with +./qemu-system-i386 -M pc-q35-5.0 -accel qtest -qtest stdio -monitor none -serial none -nographic < attachment + +Let me know if I can provide any further info. +-Alex \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/188 b/results/classifier/mode-deepseek-r1:32b/output/system/188 new file mode 100644 index 00000000..eb690478 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/188 @@ -0,0 +1,3 @@ + + +savevm with hax saves wrong register state diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1880189 b/results/classifier/mode-deepseek-r1:32b/output/system/1880189 new file mode 100644 index 00000000..74de4fdd --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1880189 @@ -0,0 +1,109 @@ + + +I/O writes make cirrus_invalidate_region() crash + +As of commit d19f1ab0, LLVM libFuzzer found: + +qemu-fuzz-i386: hw/display/cirrus_vga.c:646: void cirrus_invalidate_region(CirrusVGAState *, int, int, int, int): Assertion `off_cur_end >= off_cur' failed. +==1336555== ERROR: libFuzzer: deadly signal + #0 0xaaaaaf943ce4 in __sanitizer_print_stack_trace + #1 0xaaaaaf899474 in fuzzer::PrintStackTrace() + #2 0xaaaaaf884c80 in fuzzer::Fuzzer::CrashCallback() + #3 0xffff9b4e8568 (linux-vdso.so.1+0x568) + #4 0xffff99ac406c in __libc_signal_restore_set /build/glibc-w4ZToO/glibc-2.31/signal/../sysdeps/unix/sysv/linux/internal-signals.h:86:3 + #5 0xffff99ac406c in raise /build/glibc-w4ZToO/glibc-2.31/signal/../sysdeps/unix/sysv/linux/raise.c:48:3 + #6 0xffff99ab0d64 in abort /build/glibc-w4ZToO/glibc-2.31/stdlib/abort.c:79:7 + #7 0xffff99abd5d8 in __assert_fail_base /build/glibc-w4ZToO/glibc-2.31/assert/assert.c:92:3 + #8 0xffff99abd640 in __assert_fail /build/glibc-w4ZToO/glibc-2.31/assert/assert.c:101:3 + #9 0xaaaab040768c in cirrus_invalidate_region + #10 0xaaaab0405404 in cirrus_bitblt_solidfill + #11 0xaaaab0402a88 in cirrus_bitblt_start + #12 0xaaaab04046a8 in cirrus_write_bitblt + #13 0xaaaab0400db4 in cirrus_vga_write_gr + #14 0xaaaab03fd33c in cirrus_vga_ioport_write + #15 0xaaaaafb41674 in memory_region_write_accessor + #16 0xaaaaafb411ec in access_with_adjusted_size + #17 0xaaaaafb40180 in memory_region_dispatch_write + #18 0xaaaaaf995dfc in flatview_write_continue + #19 0xaaaaaf985bd8 in flatview_write + #20 0xaaaaaf98574c in address_space_write + #21 0xaaaab110510c in ioport_fuzz_qtest + #22 0xaaaab1103a48 in i440fx_fuzz_qtest + #23 0xaaaab11010d8 in LLVMFuzzerTestOneInput + +Reproducer: + +qemu-system-i386 -M isapc,accel=qtest -vga cirrus -qtest stdio << 'EOF' +outl 0x03b1 0x2fdc1001 +outb 0x03cc 0xe +outb 0x03cc 0xe +outb 0x03cc 0x2f +outb 0x03cc 0xe +outb 0x03cc 0x2f +outb 0x03cc 0xe +outl 0x03cc 0xedc100e +outb 0x03cc 0x2f +outl 0x03cc 0xe24f40e +outl 0x03cc 0x2f23dc12 +outl 0x03cc 0xe23f40e +outl 0x03cc 0xe31dc12 +outb 0x03cc 0x2f +outl 0x03cc 0xe2af40e +outl 0x03cc 0x2f235612 +outl 0x03cc 0xe23f40e +outl 0x03cc 0xe31dc12 +outb 0x03cc 0x2f +outl 0x03cc 0x2fdcf40e +outb 0x03cc 0xe +outl 0x03cc 0xedc100e +outb 0x03cc 0x2f +outl 0x03cc 0xe24f40e +outl 0x03cc 0xe23dc12 +outb 0x03cc 0x2f +outl 0x03cc 0xedc100e +outl 0x03cc 0x2fdc400e +outb 0x03cc 0xe +outl 0x03cc 0xe130100e +outb 0x03cc 0x2f +outl 0x03cc 0xe23f40e +outl 0x03cc 0xe31dc12 +outb 0x03cc 0x2f +outl 0x03cc 0xe33f40e +outl 0x03cc 0xdc235612 +outb 0x03cc 0xe +outl 0x03cc 0x2fdc400e +outb 0x03cc 0xe +outl 0x03cc 0xfb24100e +outb 0x03cc 0x2f +outl 0x03cc 0xdc10dc0e +outl 0x03cc 0x2f31dc12 +outl 0x03cc 0xe23f40e +outl 0x03cc 0xe31dc12 +outb 0x03cc 0x2f +outl 0x03cc 0xe23f40e +outl 0x03cc 0xe31dc12 +outb 0x03cc 0x2f +outl 0x03cc 0x1021f40e +EOF +qemu-system-i386: hw/display/cirrus_vga.c:645: cirrus_invalidate_region: Assertion `off_cur_end >= off_cur' failed. +Aborted (core dumped) + +(gdb) bt +#0 0x00007f1d019fee35 in raise () at /lib64/libc.so.6 +#1 0x00007f1d019e9895 in abort () at /lib64/libc.so.6 +#2 0x00007f1d019e9769 in _nl_load_domain.cold () at /lib64/libc.so.6 +#3 0x00007f1d019f7566 in annobin_assert.c_end () at /lib64/libc.so.6 +#4 0x00005645cb447a37 in cirrus_invalidate_region (s=0x5645cd237540, off_begin=2097204, off_pitch=251, bytesperline=1, lines=7169) at hw/display/cirrus_vga.c:645 +#5 0x00005645cb447cc8 in cirrus_bitblt_solidfill (s=0x5645cd237540, blt_rop=0) at hw/display/cirrus_vga.c:704 +#6 0x00005645cb448886 in cirrus_bitblt_start (s=0x5645cd237540) at hw/display/cirrus_vga.c:1005 +#7 0x00005645cb448dd1 in cirrus_write_bitblt (s=0x5645cd237540, reg_value=47) at hw/display/cirrus_vga.c:1090 +#8 0x00005645cb449b02 in cirrus_vga_write_gr (s=0x5645cd237540, reg_index=49, reg_value=47) at hw/display/cirrus_vga.c:1593 +#9 0x00005645cb44bb2f in cirrus_vga_ioport_write (opaque=0x5645cd237540, addr=975, val=47, size=1) at hw/display/cirrus_vga.c:2686 +#10 0x00005645cb1e0d6e in memory_region_write_accessor (mr=0x5645cd247f10, addr=31, value=0x7fff178d6c18, size=1, shift=24, mask=255, attrs=...) at memory.c:483 +#11 0x00005645cb1e0f7f in access_with_adjusted_size (addr=28, value=0x7fff178d6c18, size=4, access_size_min=1, access_size_max=1, access_fn= + 0x5645cb1e0c8b <memory_region_write_accessor>, mr=0x5645cd247f10, attrs=...) at memory.c:544 +#12 0x00005645cb1e3e9d in memory_region_dispatch_write (mr=0x5645cd247f10, addr=28, data=791796754, op=MO_32, attrs=...) at memory.c:1476 +#13 0x00005645cb1845e5 in flatview_write_continue (fv=0x5645cd65e510, addr=972, attrs=..., ptr=0x7fff178d6da4, len=4, addr1=28, l=4, mr=0x5645cd247f10) at exec.c:3137 +#14 0x00005645cb18472a in flatview_write (fv=0x5645cd65e510, addr=972, attrs=..., buf=0x7fff178d6da4, len=4) at exec.c:3177 +#15 0x00005645cb184a7d in address_space_write (as=0x5645cbd7bb20 <address_space_io>, addr=972, attrs=..., buf=0x7fff178d6da4, len=4) at exec.c:3268 +#16 0x00005645cb1db385 in cpu_outl (addr=972, val=791796754) at ioport.c:80 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1880326 b/results/classifier/mode-deepseek-r1:32b/output/system/1880326 new file mode 100644 index 00000000..062c70c5 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1880326 @@ -0,0 +1,327 @@ + + +memory writes make artist_rop8() crash + +As of commit d19f1ab0, LLVM libFuzzer found: + +================================================================= +==6814==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7fd89f97bd5a at pc 0x55dc44594db5 bp 0x7ffd6f461b40 sp 0x7ffd6f461b38 +READ of size 1 at 0x7fd89f97bd5a thread T0 + #0 0x55dc44594db4 in artist_rop8 + #1 0x55dc44595fd9 in draw_line + #2 0x55dc445937e4 in draw_line_size + #3 0x55dc4458ee9d in artist_reg_write + #4 0x55dc43f77ba7 in memory_region_write_accessor + #5 0x55dc43f775b8 in access_with_adjusted_size + #6 0x55dc43f762b3 in memory_region_dispatch_write + #7 0x55dc43dbb322 in flatview_write_continue + #8 0x55dc43dab2e2 in flatview_write + #9 0x55dc43daae14 in address_space_write + +0x7fd89f97bd5a is located 1122 bytes to the right of 16777464-byte region [0x7fd89e97b800,0x7fd89f97b8f8) +allocated by thread T0 here: + #0 0x55dc43d87abf in operator new(unsigned long) + #1 0x55dc43c4274d in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) + #2 0x55dc43c3a526 in main (qemu-fuzz-hppa+0x982526) + #3 0x7fd8d05edf42 in __libc_start_main (/lib64/libc.so.6+0x23f42) + +SUMMARY: AddressSanitizer: heap-buffer-overflow (qemu-fuzz-hppa+0x12dcdb4) in artist_rop8 +Shadow bytes around the buggy address: + 0x0ffb93f27750: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ffb93f27760: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ffb93f27770: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ffb93f27780: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ffb93f27790: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x0ffb93f277a0: fa fa fa fa fa fa fa fa fa fa fa[fa]fa fa fa fa + 0x0ffb93f277b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ffb93f277c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ffb93f277d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ffb93f277e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ffb93f277f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==6814==ABORTING + +How to reproduce: + +qemu-system-hppa -S -qtest stdio -accel qtest -display none < EOF +writeb 0xf8100081 0x40 +writeb 0xf81000c5 0x40 +writeb 0xf8100e44 0x2b +writeb 0xf8100e44 0x56 +writeb 0xf8100e44 0x10 +writeb 0xf8100600 0x0 +writeb 0xf8100821 0x21 +writeb 0xf8100b01 0x14 +writew 0xf8100044 0x1245 +writeb 0xf8100a0e 0x50 +writeb 0xf8100a02 0x49 +writeb 0xf8100821 0x0 +writew 0xf8100014 0x0 +writeb 0xf8100e46 0x46 +writeb 0xf8100052 0xe +writeb 0xf8100621 0x14 +writeb 0xf8100b01 0x14 +writew 0xf8100044 0x1241 +writeb 0xf8100b02 0x25 +writeb 0xf8100b01 0x4 +writeb 0xf8100e46 0xb0 +writeb 0xf8100b02 0x0 +writel 0xf81000c4 0x49494949 +writeb 0xf8100b02 0x10 +writew 0xf8100010 0x11 +writew 0xf8100044 0x1212 +writew 0xf8100044 0x1245 +writew 0xf8100050 0xe2a +writeb 0xf8100002 0x11 +writeb 0xf8100081 0xec +writeb 0xf8100081 0xec +writeb 0xf810030e 0xe +writeb 0xf810000e 0x44 +writeb 0xf8100000 0xe +writeb 0xf8100044 0xe +writeb 0xf8100000 0xe +writeb 0xf810030e 0x13 +writeb 0xf8100b44 0x2a +writeb 0xf8100bf8 0x4 +writeb 0xf8100007 0x45 +writeb 0xf81000ff 0xff +writew 0xf8100044 0xf042 +writew 0xf8100000 0x45 +writew 0xf8100044 0xf042 +writeb 0xf8100000 0xc5 +writeb 0xf81000ff 0xff +writel 0xf8100044 0x101364ff +writel 0xf81000c4 0xfba0a0a0 +writeb 0xf8100000 0x2a +writeb 0xf81000c5 0x40 +writeb 0xf81000ff 0xdf +writew 0xf8100000 0x4144 +writeb 0xf81000df 0x0 +writew 0xf8100044 0x4400 +writel 0xf8100044 0x101364ff +writel 0xf81000c4 0xfb490045 +writeb 0xf8100000 0x2a +writeb 0xf81000c5 0x40 +writel 0xf8100044 0x101364ff +writel 0xf8100bc4 0x49004545 +writeb 0xf8100000 0x2a +writeb 0xf81000c5 0x40 +writeb 0xf810000e 0x21 +writeb 0xf8100000 0x2a +writeb 0xf81000c3 0x40 +writeb 0xf81000ff 0xdf +writew 0xf8100044 0x1210 +writew 0xf8100044 0x1210 +writew 0xf8100010 0x4412 +writew 0xf8100010 0x4412 +writew 0xf8100044 0x1210 +writew 0xf8100044 0x1210 +writew 0xf8100044 0x1210 +writew 0xf8100000 0x4144 +writew 0xf8100044 0x4400 +writew 0xf8100000 0x4144 +writew 0xf81000bc 0xc100 +writew 0xf8100000 0x4144 +writew 0xf81000bc 0xc100 +writew 0xf8100044 0x1210 +writel 0xf8100044 0xfb53000a +writew 0xf8100044 0x1210 +writel 0xf8100044 0xfb53000a +writew 0xf8100044 0x1210 +writel 0xf8100044 0xfba7000a +writew 0xf8100044 0x1210 +writew 0xf8100044 0x1210 +writew 0xf8100000 0x4144 +writew 0xf8100000 0x4144 +writew 0xf8100000 0x4144 +writew 0xf8100044 0x4400 +writew 0xf8100044 0x4411 +writew 0xf8100044 0x1210 +writew 0xf8100044 0x1210 +writew 0xf8100044 0x1210 +writew 0xf8100044 0x1212 +writew 0xf8100044 0x4445 +writeb 0xf81000ff 0xff +writeb 0xf8100121 0x14 +writeb 0xf8100121 0x14 +writeb 0xf8100421 0x0 +writeb 0xf8100421 0x28 +writeb 0xf8100000 0x2a +writeb 0xf81000c5 0x40 +writeb 0xf8100040 0x0 +writeb 0xf8100007 0x45 +writeb 0xf8100007 0x45 +writeb 0xf8100bf8 0x4 +writeb 0xf8100bf8 0x4 +writeb 0xf8100bf8 0x4 +writeb 0xf8100bf8 0x4 +writeb 0xf8100bf8 0x4 +writew 0xf8100060 0x11 +writew 0xf8100060 0x11 +writew 0xf8100060 0x17 +writeb 0xf8100446 0x46 +writeb 0xf8100604 0x50 +writeb 0xf8100821 0x21 +writeb 0xf8100108 0x21 +writeb 0xf810010c 0x21 +writeb 0xf8100081 0xec +writeb 0xf8100041 0xec +writel 0xf8100044 0x101364ff +writel 0xf81000c4 0xfba0a0a0 +writel 0xf8100044 0x101364ff +writel 0xf81000c4 0xfba0a0a0 +writel 0xf8100044 0x101364ff +writel 0xf81000c4 0xfba0a0a0 +writeb 0xf8100052 0x24 +writew 0xf8100000 0x4144 +writeb 0xf81000df 0x0 +writew 0xf8100044 0x4400 +writew 0xf8100000 0x4144 +writeb 0xf81000df 0x41 +writeb 0xf8100504 0x50 +writew 0xf8100010 0x4412 +writew 0xf8100010 0x4412 +writew 0xf8100094 0x4145 +writel 0xf8100044 0x10424410 +writel 0xf81000a0 0xa0a0492a +writel 0xf8100044 0x10040000 +writeb 0xf8100007 0x44 +writeb 0xf81000ff 0xff +writeb 0xf8100007 0x44 +writeb 0xf81000ff 0x4 +writel 0xf8100044 0x10134900 +writeb 0xf8100000 0x2a +writeb 0xf81000c5 0x40 +writeb 0xf8100000 0x2a +writeb 0xf81000c5 0x40 +writew 0xf8100040 0x1212 +writew 0xf8100044 0x1245 +writew 0xf8100040 0x1212 +writew 0xf8100040 0x5002 +writew 0xf8100040 0x5002 +writew 0xf8100040 0x502a +writeb 0xf8100081 0x40 +writeb 0xf810005d 0x40 +writeb 0xf8100030 0x5d +writeb 0xf8100e44 0x44 +writeb 0xf8100044 0x3 +writeb 0xf8100044 0x3 +writeb 0xf8100044 0x13 +writew 0xf8100044 0x1210 +writew 0xf8100044 0x1210 +writew 0xf8100044 0x1210 +writew 0xf8100044 0x6d10 +writeb 0xf8100044 0x6d +writeb 0xf8100000 0x2a +writeb 0xf8100044 0x40 +writeb 0xf8100045 0xec +writew 0xf8100044 0x1210 +writew 0xf8100044 0x1245 +writel 0xf8100044 0x101364ff +writel 0xf81000c4 0xfba0a0a0 +writel 0xf8100044 0x101364ff +writel 0xf8100044 0x101364ff +writel 0xf8100044 0x101364ff +writel 0xf8100008 0xfba0a0a0 +writel 0xf8100044 0x4208fba0 +writew 0xf8100010 0x4412 +writew 0xf8100010 0x4412 +writew 0xf8100010 0x4412 +writew 0xf8100010 0x4412 +writew 0xf8100010 0x4412 +writew 0xf8100000 0x4144 +writeb 0xf810030e 0xe +writeb 0xf810030e 0xe +writeb 0xf810032b 0xe +writeb 0xf810032b 0xe +writew 0xf8100010 0x4412 +writew 0xf81000ca 0x4441 +writew 0xf8100010 0x4412 +writew 0xf8100010 0x4412 +writew 0xf8100010 0x4412 +writew 0xf8100010 0x4412 +writeb 0xf8100080 0xe +writeb 0xf8100080 0xd8 +writeb 0xf8100080 0x26 +writeb 0xf8100040 0x80 +writeb 0xf8100040 0x26 +writeb 0xf81000c3 0x40 +writeb 0xf81000ff 0xdf +writeb 0xf81000c3 0x40 +writeb 0xf81000ff 0xdf +writew 0xf8100014 0x4000 +writeb 0xf8100000 0xe +writeb 0xf8100000 0x9e +writeb 0xf8100000 0x3c +writeb 0xf8100000 0x3c +writeb 0xf8100000 0x3c +writew 0xf8100000 0x4144 +writeb 0xf81000df 0x41 +writeb 0xf8100007 0x45 +writeb 0xf81000ff 0xff +writeb 0xf8100007 0xb4 +writeb 0xf81000ff 0xff +writeb 0xf8100007 0xb4 +writeb 0xf8100007 0xb4 +writel 0xf8100044 0x10139c05 +writel 0xf81000c4 0xfba0a0a0 +writeb 0xf8100604 0x50 +writeb 0xf8100021 0xe +writeb 0xf8100021 0xe +writeb 0xf8100021 0xe +writeb 0xf8100021 0x90 +writew 0xf8100010 0x11 +writew 0xf8100010 0x11 +writew 0xf8100010 0x11 +writeb 0xf8100021 0xe +writeb 0xf8100021 0xe +writeb 0xf8100021 0xe +writeb 0xf8100021 0xe +writeb 0xf8100021 0xe +writew 0xf8100010 0x4412 +writew 0xf8100010 0x4412 +writew 0xf8100010 0x4412 +writew 0xf8100010 0x4412 +writew 0xf8100010 0x4412 +writeb 0xf8100021 0xe +writeb 0xf8100021 0xe +writeb 0xf8100021 0x21 +writeb 0xf8100021 0x21 +writeb 0xf8100000 0x0 +writeb 0xf8100e04 0x46 +EOF + +Program terminated with signal SIGSEGV, Segmentation fault. +#0 0x000056367b2085c0 in artist_rop8 (s=0x56367d38b510, dst=0x7f9f972fffff <error: Cannot access memory at address 0x7f9f972fffff>, val=0 '\000') at hw/display/artist.c:284 +284 *dst &= ~plane_mask; +(gdb) bt +#0 0x000056367b2085c0 in artist_rop8 (s=0x56367d38b510, dst=0x7f9f972fffff <error: Cannot access memory at address 0x7f9f972fffff>, val=0 '\000') at hw/display/artist.c:284 +#1 0x000056367b209325 in draw_line (s=0x56367d38b510, x1=-20480, y1=-1, x2=0, y2=17920, update_start=true, skip_pix=-1, max_pix=-1) at hw/display/artist.c:646 +#2 0x000056367b2095a0 in draw_line_size (s=0x56367d38b510, update_start=true) at hw/display/artist.c:696 +#3 0x000056367b20a214 in artist_reg_write (opaque=0x56367d38b510, addr=1052164, val=70, size=1) at hw/display/artist.c:932 +#4 0x000056367b06ea7c in memory_region_write_accessor (mr=0x56367d38ba10, addr=1052164, value=0x7fff112132d8, size=1, shift=0, mask=255, attrs=...) at memory.c:483 +#5 0x000056367b06ec33 in access_with_adjusted_size (addr=1052164, value=0x7fff112132d8, size=1, access_size_min=1, access_size_max=4, access_fn= + 0x56367b06e999 <memory_region_write_accessor>, mr=0x56367d38ba10, attrs=...) at memory.c:540 +#6 0x000056367b071bb4 in memory_region_dispatch_write (mr=0x56367d38ba10, addr=1052164, data=70, op=MO_8, attrs=...) at memory.c:1477 +#7 0x000056367b00fe33 in flatview_write_continue (fv=0x56367d6f9fa0, addr=4161801732, attrs=..., ptr=0x7fff112134e0, len=1, addr1=1052164, l=1, mr=0x56367d38ba10) at exec.c:3147 +#8 0x000056367b00ff81 in flatview_write (fv=0x56367d6f9fa0, addr=4161801732, attrs=..., buf=0x7fff112134e0, len=1) at exec.c:3190 +#9 0x000056367b0102eb in address_space_write (as=0x56367cff99c0, addr=4161801732, attrs=..., buf=0x7fff112134e0, len=1) at exec.c:3289 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1880518 b/results/classifier/mode-deepseek-r1:32b/output/system/1880518 new file mode 100644 index 00000000..26ab3768 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1880518 @@ -0,0 +1,18 @@ + + +issue while installing docker inside s390x container + +This is in reference to https://github.com/multiarch/qemu-user-static/issues/108. +I am facing issue while installing docker inside s390x container under qemu on Ubuntu 18.04 host running on amd64. +Following are the contents of /proc/sys/fs/binfmt_misc/qemu-s390x on Intel host after running +docker run --rm --privileged multiarch/qemu-user-static --reset -p yes +enabled +interpreter /usr/bin/qemu-s390x-static +flags: F +offset 0 +magic 7f454c4602020100000000000000000000020016 +mask ffffffffffffff00fffffffffffffffffffeffff +I could get docker service up with the following trick. +printf '{"iptables": false,"ip-masq": false,"bridge": "none" }' > /etc/docker/daemon.json +But even though docker service comes up, images are not getting pulled, docker pull fails with the following error. +failed to register layer: Error processing tar file(exit status 1): \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1880763 b/results/classifier/mode-deepseek-r1:32b/output/system/1880763 new file mode 100644 index 00000000..f2da1f61 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1880763 @@ -0,0 +1,8 @@ + + +Missing page crossing check in use_goto_tb() for rx target + +Currently the rx target doesn't have the page crossing check in its +use_goto_tb() function. +This is a required feature for stable system mode emulations that all +other targets implement. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1881 b/results/classifier/mode-deepseek-r1:32b/output/system/1881 new file mode 100644 index 00000000..fd8f82bd --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1881 @@ -0,0 +1,17 @@ + + +netdev-socket test_stream_unix() is unreliable +Description of problem: +test_stream_unix is unreliable and causes random CI job failures such as this one: +https://gitlab.com/qemu-project/qemu/-/jobs/5020899550 + +``` +576/839 ERROR:../tests/qtest/netdev-socket.c:293:test_stream_unix: assertion failed (resp == expect): ("st0: index=0,type=stream,connection error\r\n" == "st0: index=0,type=stream,unix:/tmp/netdev-socket.UW5IA2/stream_unix\r\n") ERROR +576/839 qemu:qtest+qtest-sh4 / qtest-sh4/netdev-socket ERROR 62.85s killed by signal 6 SIGABRT +>>> MALLOC_PERTURB_=249 QTEST_QEMU_BINARY=./qemu-system-sh4 QTEST_QEMU_STORAGE_DAEMON_BINARY=./storage-daemon/qemu-storage-daemon G_TEST_DBUS_DAEMON=/home/gitlab-runner/builds/-LCfcJ2T/0/qemu-project/qemu/tests/dbus-vmstate-daemon.sh QTEST_QEMU_IMG=./qemu-img /home/gitlab-runner/builds/-LCfcJ2T/0/qemu-project/qemu/build/tests/qtest/netdev-socket --tap -k +――――――――――――――――――――――――――――――――――――― ✀ ――――――――――――――――――――――――――――――――――――― +stderr: +** +ERROR:../tests/qtest/netdev-socket.c:293:test_stream_unix: assertion failed (resp == expect): ("st0: index=0,type=stream,connection error\r\n" == "st0: index=0,type=stream,unix:/tmp/netdev-socket.UW5IA2/stream_unix\r\n") +(test program exited with status code -6) +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1881506 b/results/classifier/mode-deepseek-r1:32b/output/system/1881506 new file mode 100644 index 00000000..7e786eff --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1881506 @@ -0,0 +1,7 @@ + + +TCG doesn't support a lot of features that should be supported + +This is quite odd, and I'm not sure about how to get around it. I'm writing an OS in Rust and require APIC support. When I boot my kernel with qemu-system-x86_64, however, it dumps out a [lot] of warnings; it claims that TCG doesn't support FMA, X2APIC, AVX, F16C, AVX2, RDSEED, SHA-NI, FXSR-OPT, misalignsse, 3dnowprefetch, osvw, topoext, perfctr-core, clzero, xsaveerptr, ibpb, nrip-save, xsavec, and xsaves, but prints these warnings over 80 times before finally doing what I told it to do. Running QEMU 5.0.0 (unknown commit hash), as follows: +qemu-system-x86_64 -drive format=raw,file=target\x86_64-kernel-none\debug\bootimage-kernel.bin -serial stdio -no-reboot -hdb disk.img -s -m 4G -usb -rtc base=utc,clock=host -cpu EPYC-v3,+acpi,+apic,+rdrand,+rdseed,+sse,+sse2,+sse4.1,+sse4.2,+sse4a,+ssse3,+syscall,+x2apic -smp cpus=8 -soundhw all +I would run using HAXM, but my kernel requires RDRAND, and QEMU does not, to my knowledge, automatically support RDRAND (and I don't know how to enable it). \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1881729 b/results/classifier/mode-deepseek-r1:32b/output/system/1881729 new file mode 100644 index 00000000..bc4da04b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1881729 @@ -0,0 +1,5 @@ + + +target_read_memory in disas.c ignores possible errors + +`target_read_memory` in `disas.c` ignores (possible) errors. This leads to disassembler possibly disassembling garbage. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1883400 b/results/classifier/mode-deepseek-r1:32b/output/system/1883400 new file mode 100644 index 00000000..529fe206 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1883400 @@ -0,0 +1,20 @@ + + +Windows 10 extremely slow and unresponsive + +Hi, + +Fedora 32, x64 +qemu-5.0.0-2.fc32.x86_64 + +https://www.microsoft.com/en-us/software-download/windows10ISO +Win10_2004_English_x64.iso + +Windows 10 is excruciatingly slow since upgrading to 5.0.0-2.fc32. Disabling your repo and downgrading to 2:4.2.0-7.fc32 and corrects the issue (the package in the Fedora repo). + +You can duplicate this off of the Windows 10 ISO (see above) and do not even have to install Windows 10 itself. + +Please fix, + +Many thanks, +-T \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1883593 b/results/classifier/mode-deepseek-r1:32b/output/system/1883593 new file mode 100644 index 00000000..7edcc814 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1883593 @@ -0,0 +1,11 @@ + + +Windows XP takes much longer to boot in TCG mode since 5.0 + +Since upgrading from 4.2 to 5.0, a Windows XP VM takes much longer to boot. + +It hangs about three minutes on "welcome" screen with the blue background, while previously the total boot time was less than a minute. + +The issue only happens in TCG mode (not with KVM) and also happens with the current master which includes the uring patches (7d3660e7). + +I can reproduce this issue with a clean XP install with no flags other than `-m 2G`. After booting, the performance seems to be normal. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1884095 b/results/classifier/mode-deepseek-r1:32b/output/system/1884095 new file mode 100644 index 00000000..5584c43e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1884095 @@ -0,0 +1,25 @@ + + +QEMU not sufficiently focused on qEMUlation, with resulting holes in TCG emulation coverage + +It seems that QEMU has stopped emphasizing the EMU part of the name, and is too much focused on virtualization. + +My interest is at running legacy operating systems, and as such, they must run on foreign CPU platforms. m68 on intel, intel on ARM, etc. +Time doesn't stand still, and reliance on KVM and similar x86-on-x86 tricks, which allow the delegation of certain CPU features to the host CPU is going to not work going forward. + +If the rumored transition of Apple to ARM is going to take place, people will want to e.g. emulate for testing or legacy purposes a variety of operating systems, incl. NeXTSTEP, Windows, earlier versions of MacOS on ARM Macs. + +Testing that scenario, i.e. macOS on an ARM board with the lowest possible CPU capable of running modern macOS, results in these problems (and of course utter failure achieving the goal): + +qemu-system-x86_64: warning: TCG doesn't support requested feature: CPUID.01H:ECX.fma [bit 12] +qemu-system-x86_64: warning: TCG doesn't support requested feature: CPUID.01H:ECX.avx [bit 28] +qemu-system-x86_64: warning: TCG doesn't support requested feature: CPUID.07H:EBX.avx2 [bit 5] +qemu-system-x86_64: warning: TCG doesn't support requested feature: CPUID.80000007H:EDX.invtsc [bit 8] +qemu-system-x86_64: warning: TCG doesn't support requested feature: CPUID.0DH:EAX.xsavec [bit 1] + +And this is emulating a lowly Penryn CPU with the required CPU flags for macOS: +-cpu Penryn,vendor=GenuineIntel,+sse3,+sse4.2,+aes,+xsave,+avx,+xsaveopt,+xsavec,+xgetbv1,+avx2,+bmi2,+smep,+bmi1,+fma,+movbe,+invtsc + +Attempting to emulate a more feature laden intel CPU results in even more issues. + +I would propose that no CPU should be considered supported unless it can be fully handled by TCG on a non-native host. KVM, native-on-native etc. are nice to have, but peripheral to qEMUlation when it boils down to it. At the very least, there should be a CLEAR distinction which CPUs require KVM to be used, and which can be fully emulated. It should not require wasting an afternoon to figure out that an emulation attempt is futile because TCG lacks essential functionality. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1884169 b/results/classifier/mode-deepseek-r1:32b/output/system/1884169 new file mode 100644 index 00000000..8993dca3 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1884169 @@ -0,0 +1,7 @@ + + +There is no option group 'fsdev' for OSX + +When I try to use -fsoption on OSX I receive this error: + +-fsdev local,security_model=mapped,id=fsdev0,path=devel/dmos-example: There is no option group 'fsdev' \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1884693 b/results/classifier/mode-deepseek-r1:32b/output/system/1884693 new file mode 100644 index 00000000..6c9df813 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1884693 @@ -0,0 +1,57 @@ + + +Assertion failure in address_space_unmap through ahci_map_clb_address + +Hello, +Reproducer: +cat << EOF | ./i386-softmmu/qemu-system-i386 -qtest stdio -monitor none -serial none -M pc-q35-5.0 -nographic +outl 0xcf8 0x8000fa24 +outl 0xcfc 0xe1068000 +outl 0xcf8 0x8000fa04 +outw 0xcfc 0x7 +outl 0xcf8 0x8000fb20 +write 0xe1068304 0x1 0x21 +write 0xe1068318 0x1 0x21 +write 0xe1068384 0x1 0x21 +write 0xe1068398 0x2 0x21 +EOF + +Stack trace: +#0 0x55bfabfe9ea0 in __libc_start_main /build/glibc-GwnBeO/glibc-2.30/csu/../csu/libc-start.c:308:16 +#1 0x55bfabfc8ef9 in __sanitizer_print_stack_trace (build/i386-softmmu/qemu-fuzz-i386+0x7b7ef9) +#2 0x55bfabfaf933 in fuzzer::PrintStackTrace() FuzzerUtil.cpp:210:5 +#3 0x7f88df76110f (/lib/x86_64-linux-gnu/libpthread.so.0+0x1410f) +#4 0x7f88df5a4760 in __libc_signal_restore_set /build/glibc-GwnBeO/glibc-2.30/signal/../sysdeps/unix/sysv/linux/internal-signals.h:84:10 +#5 0x7f88df5a4760 in raise /build/glibc-GwnBeO/glibc-2.30/signal/../sysdeps/unix/sysv/linux/raise.c:48:3 +#6 0x7f88df58e55a in abort /build/glibc-GwnBeO/glibc-2.30/stdlib/abort.c:79:7 +#7 0x7f88df58e42e in __assert_fail_base /build/glibc-GwnBeO/glibc-2.30/assert/assert.c:92:3 +#8 0x7f88df59d091 in __assert_fail /build/glibc-GwnBeO/glibc-2.30/assert/assert.c:101:3 +#9 0x55bfabff7182 in address_space_unmap exec.c:3602:9 +#10 0x55bfac4a452f in dma_memory_unmap include/sysemu/dma.h:148:5 +#11 0x55bfac4a452f in map_page hw/ide/ahci.c:254:9 +#12 0x55bfac4a1f98 in ahci_map_clb_address hw/ide/ahci.c:748:5 +#13 0x55bfac4a1f98 in ahci_cond_start_engines hw/ide/ahci.c:276:14 +#14 0x55bfac4a074e in ahci_port_write hw/ide/ahci.c:339:9 +#15 0x55bfac4a074e in ahci_mem_write hw/ide/ahci.c:513:9 +#16 0x55bfac0e0dc2 in memory_region_write_accessor memory.c:483:5 +#17 0x55bfac0e0bde in access_with_adjusted_size memory.c:544:18 +#18 0x55bfac0e0917 in memory_region_dispatch_write memory.c +#19 0x55bfabffa4fd in flatview_write_continue exec.c:3146:23 +#20 0x55bfabff569b in flatview_write exec.c:3186:14 +#21 0x55bfabff569b in address_space_write exec.c:3280:18 +#22 0x55bfac8982a9 in op_write_pattern tests/qtest/fuzz/general_fuzz.c:407:5 +#23 0x55bfac897749 in general_fuzz tests/qtest/fuzz/general_fuzz.c:481:17 +#24 0x55bfac8930a2 in LLVMFuzzerTestOneInput tests/qtest/fuzz/fuzz.c:136:5 +#25 0x55bfabfb0e68 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) FuzzerLoop.cpp:558:15 +#26 0x55bfabfb0485 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool*) FuzzerLoop.cpp:470:3 +#27 0x55bfabfb18a1 in fuzzer::Fuzzer::MutateAndTestOne() FuzzerLoop.cpp:701:19 +#28 0x55bfabfb2305 in fuzzer::Fuzzer::Loop(std::vector<fuzzer::SizedFile, fuzzer::fuzzer_allocator<fuzzer::SizedFile> >&) FuzzerLoop.cpp:837:5 +#29 0x55bfabfa2018 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) FuzzerDriver.cpp:846:6 +#30 0x55bfabfb8722 in main FuzzerMain.cpp:19:10 +#31 0x7f88df58fe0a in __libc_start_main /build/glibc-GwnBeO/glibc-2.30/csu/../csu/libc-start.c:308:16 +#32 0x55bfabf97869 in _start (build/i386-softmmu/qemu-fuzz-i386+0x786869) + +The same error can be triggered through ahci_map_fis_address @ hw/ide/ahci.c:721:5 +Found with generic device fuzzer: https://<email address hidden>/ + +Please let me know if I can provide any further info. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1884831 b/results/classifier/mode-deepseek-r1:32b/output/system/1884831 new file mode 100644 index 00000000..858aeb4a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1884831 @@ -0,0 +1,23 @@ + + +qemu-nbd fails to discard bigger chunks + +This report is moved from systemd to here: +https://github.com/systemd/systemd/issues/16242 + +A qemu-nbd device reports that it can discard a lot of bytes: + +cat /sys/block/nbd0/queue/discard_max_bytes +2199023255040 + +And indeed, discard works with small images: + +$ qemu-img create -f qcow2 /tmp/image.img 2M +$ sudo qemu-nbd --connect=/dev/nbd0 /tmp/image.img +$ sudo blkdiscard /dev/nbd0 + +but not for bigger ones (still smaller than discard_max_bytes): + +$ qemu-img create -f qcow2 /tmp/image.img 5G +$ sudo qemu-nbd --connect=/dev/nbd0 /tmp/image.img +$ sudo blkdiscard /dev/nbd0 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1885718 b/results/classifier/mode-deepseek-r1:32b/output/system/1885718 new file mode 100644 index 00000000..70b2e7c5 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1885718 @@ -0,0 +1,11 @@ + + +qemu/target/mips/op_helper.c:943:5: style:inconclusive: Found duplicate branches for 'if' and 'else' + +Source code is + + if (other_tc == other->current_tc) { + tccause = other->CP0_Cause; + } else { + tccause = other->CP0_Cause; + } \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1885889 b/results/classifier/mode-deepseek-r1:32b/output/system/1885889 new file mode 100644 index 00000000..2a8d39ab --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1885889 @@ -0,0 +1,41 @@ + + +ERROR: core-image-minimal-1.0-r0 do_rootfs: The postinstall intercept hook 'update_font_cache' failed, + +Hello, + +I am trying to build bitbake core-image-minimal getting following error. + +santhosh@santhosh-VirtualBox:~/Denverton/Source/BSP/poky/build$ bitbake core-image-minimal +Loading cache: 100% |###############################################################################################| Time: 0:00:00 +Loaded 1370 entries from dependency cache. +NOTE: Resolving any missing task queue dependencies + +Build Configuration: +BB_VERSION = "1.44.0" +BUILD_SYS = "x86_64-linux" +NATIVELSBSTRING = "universal" +TARGET_SYS = "x86_64-poky-linux" +MACHINE = "ddsmdnv" +DISTRO = "poky" +DISTRO_VERSION = "3.0.2" +TUNE_FEATURES = "m64 corei7" +TARGET_FPU = "" +meta +meta-poky +meta-ddsmdnv = "DDSM_Denverton_PHASE_1_FDJ_Release:471fec241d3a1a4b70ad58135fe229eab2b6a196" + +Initialising tasks: 100% |##########################################################################################| Time: 0:00:05 +Sstate summary: Wanted 413 Found 0 Missed 413 Current 937 (0% match, 69% complete) +NOTE: Executing Tasks +NOTE: Setscene tasks completed +ERROR: core-image-minimal-1.0-r0 do_rootfs: The postinstall intercept hook 'update_font_cache' failed, details in /home/santhosh/Denverton/Source/BSP/poky/build/tmp/work/ddsmdnv-poky-linux/core-image-minimal/1.0-r0/temp/log.do_rootfs +ERROR: Logfile of failure stored in: /home/santhosh/Denverton/Source/BSP/poky/build/tmp/work/ddsmdnv-poky-linux/core-image-minimal/1.0-r0/temp/log.do_rootfs.9682 +ERROR: Task (/home/santhosh/Denverton/Source/BSP/poky/meta-ddsmdnv/recipes-core/images/core-image-minimal.bb:do_rootfs) failed with exit code '1' + + +Could you please help me on how to fix this issue. + +Thank you. + +Santhosh \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1886811 b/results/classifier/mode-deepseek-r1:32b/output/system/1886811 new file mode 100644 index 00000000..d4bd95b6 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1886811 @@ -0,0 +1,25 @@ + + +systemd complains Failed to enqueue loopback interface start request: Operation not supported + +This symptom seems similar to +https://bugs.launchpad.net/qemu/+bug/1823790 + +Host Linux: Debian 11 Bullseye (testing) on x84-64 architecture +qemu version: latest git of git commit hash eb2c66b10efd2b914b56b20ae90655914310c925 +compiled with "./configure --static --disable-system" + +Down stream bug report at https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=964289 +Bug report (closed) to systemd: https://github.com/systemd/systemd/issues/16359 + +systemd in armhf and armel (both little endian 32-bit) containers fail to start with +Failed to enqueue loopback interface start request: Operation not supported + +How to reproduce on Debian (and probably Ubuntu): +mmdebstrap --components="main contrib non-free" --architectures=armhf --variant=important bullseye /var/lib/machines/armhf-bullseye +systemd-nspawn -D /var/lib/machines/armhf-bullseye -b + +When "armhf" architecture is replaced with "mips" (32-bit big endian) or "ppc64" +(64-bit big endian), the container starts up fine. + +The same symptom is also observed with "powerpc" (32-bit big endian) architecture. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1887641 b/results/classifier/mode-deepseek-r1:32b/output/system/1887641 new file mode 100644 index 00000000..be646007 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1887641 @@ -0,0 +1,9 @@ + + +PCI bus not available for hda + +I'm trying to boot Mac OS 9.2.2 image in order to install it on a qcow disk image. I'm using Linux Mint MATE 20 and QEMU emulator version 4.2.0 (Debian 1:4.2-3ubuntu6.3). When I boot, I've got this error message and boot fails : + +$ /usr/bin/qemu-system-ppc -monitor stdio -soundhw hda -k fr -machine accel=tcg -m 512 -cdrom /home/david/Bureau/debian-10.0.0-powerpc-NETINST-1.iso -drive file="/home/david/.aqemu/iMacG3_hard_disk_HDA.img",if=ide,index=0 -virtfs local,id=shared_folder_dev_0,path=/home/david/Bureau,security_model=none,mount_tag=shared0 -boot order=dc,menu=on -net nic,macaddr=00:a2:6d:80:10:8f,model=rtl8139 -net user -net user,smb=/home/david/Bureau -rtc base=localtime -name "Debian + LXDE sur iMac G3" -M mac99 +QEMU 4.2.0 monitor - type 'help' for more information +(qemu) qemu-system-ppc: PCI bus not available for hda \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1887820 b/results/classifier/mode-deepseek-r1:32b/output/system/1887820 new file mode 100644 index 00000000..f950fbee --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1887820 @@ -0,0 +1,9 @@ + + +TCG test targets missing from 'make check-help' + +We can run the TCG tests using: + +$ make run-tcg-tests-$TARGET-softmmu + +This is not listed in 'make check-help'. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1887854 b/results/classifier/mode-deepseek-r1:32b/output/system/1887854 new file mode 100644 index 00000000..59ef14a4 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1887854 @@ -0,0 +1,25 @@ + + +Spurious Data Abort on qemu-system-aarch64 + +When running RTEMS test psxndbm01.exe built for AArch64-ilp32 (this code is not yet publically available), the test generates a spurious data abort (the MMU and alignment checks should be disabled according to bits 1, 0 of SCTLR_EL1). The abort information is as follows: +Taking exception 4 [Data Abort] +...from EL1 to EL1 +...with ESR 0x25/0x96000010 +...with FAR 0x104010ca28 +...with ELR 0x400195d8 +...to EL1 PC 0x40018200 PSTATE 0x3c5 + +The ESR indicates that a synchronous external abort has occurred. +ESR EC field: 0b100101 + +From the ARMv8 technical manual: Data Abort taken without a change in Exception level. Used for MMU faults generated by data accesses, alignment faults other than those caused by Stack Pointer misalignment, and synchronous External aborts, including synchronous parity or ECC errors. Not used for debug related exceptions. + +ESR ISS field: 0b10000 + +From the ARMv8 technical manual: Synchronous External abort, not on translation table walk or hardware update of translation table. + +The following command line is used to invoke qemu: +qemu-system-aarch64 -machine virt -cpu cortex-a53 -m 256M -no-reboot -nographic -serial mon:stdio -kernel build/aarch64/a53_ilp32_qemu/testsuites/psxtests/psxndbm01.exe -D qemu.log -d in_asm,int,cpu_reset,unimp,guest_errors + +This occurs on Qemu 3.1.0 as distributed via Debian and on Qemu 4.1 as built by the RTEMS source builder (4.1+minor patches). \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1888165 b/results/classifier/mode-deepseek-r1:32b/output/system/1888165 new file mode 100644 index 00000000..2b90889a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1888165 @@ -0,0 +1,16 @@ + + +loopz/loopnz clearing previous instruction's modified flags on cx -> 0 + +If you run QBasic in qemu, printing a double-type single-digit number will print an extra decimal point (e.g. PRINT CDBL(3) prints "3.") that does not appear when running on a real CPU (or on qemu with -enable-kvm). I tracked this down to the state of the status flags after a loopnz instruction. + +After executing a sequence like this in qemu: + + mov bx,1 + mov cx,1 + dec bx ; sets Z bit in flags +A: loopnz A ; should not modify flags + +Z is incorrectly clear afterwards. loopz does the same thing (but not plain loop). Interestingly, inserting pushf+popf after dec results in Z set, so loopnz/loopz does not always clear Z itself but is rather interfering with the previous instruction's flag setting. + +Version 5.1.0-rc0, x86-64 host. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1889033 b/results/classifier/mode-deepseek-r1:32b/output/system/1889033 new file mode 100644 index 00000000..1635e865 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1889033 @@ -0,0 +1,96 @@ + + +qemu-img permission denied on vmdk creation on CIFS share + + +- on a CIFS mount qemu-img claims not to have permissions to write into a file. +- VMDK sparse file creation succeeds +- VMDK Flat file creation create the flat-file, but fails to write the description-file +- VMDK flat file creation succeeds on native linux mount such as ~/tmp or /tmp +- same effect as root or non-root +- same effect with selinux setenforce 0 + +a) I would have expected that the monolithic flat would have created only one large file just like sparse, but it seems to create a description file, in addition to the storing file. +b) I am aware that qemu-img may have problem opening very large files on CIFS, however, this file is not very large + +Windows-10 latest updated 2004 19041.388 +Linux VM, Fedora-32 in Virtualbox 6.1.12 +# rpm -qa | grep qemu-img +qemu-img-4.2.0-7.fc32.x86_64 + +mount options: +mount -t cifs //10.x,x,x/$shname /mnt/hshare -o defaults,username=gana,rw,uid=1000,gid=1000,vers=3.0 + +[root@fedora ~]# cd /mnt/hshare/some/folder/createvmdk/ +[root@fedora createvmdk]# qemu-img create -f vmdk test1.vmdk 100M -o subformat=monolithicFlat +Formatting 'test1.vmdk', fmt=vmdk size=104857600 compat6=off hwversion=undefined subformat=monolithicFlat +qemu-img: test1.vmdk: Could not write description: Permission denied +[root@fedora createvmdk]# ls -l test1*.* +-rwxr-xr-x. 1 gana gana 104857600 Jul 26 23:02 test1-flat.vmdk +-rwxr-xr-x. 1 gana gana 0 Jul 26 23:02 test1.vmdk +[root@fedora createvmdk]# du -k test1*.* +0 test1-flat.vmdk +0 test1.vmdk +# (doesn't seem to be really flat) + +creation in /tmp works +# cd /tmp +[root@fedora tmp]# qemu-img create -f vmdk test1.vmdk 100M -o subformat=monolithicFlat +Formatting 'test1.vmdk', fmt=vmdk size=104857600 compat6=off hwversion=undefined subformat=monolithicFlat +[root@fedora tmp]# ls -l /tmp/test1*.* +-rw-r--r--. 1 root root 104857600 Jul 26 22:43 /tmp/test1-flat.vmdk +-rw-r--r--. 1 root root 313 Jul 26 22:43 /tmp/test1.vmdk +[root@fedora createvmdk]# du -k /tmp/test1*.* +4 /tmp/test1-flat.vmdk +4 /tmp/test1.vmdk + +[root@fedora createvmdk]# cat /tmp/test1.vmdk +# Disk DescriptorFile +version=1 +CID=5f13c13d +parentCID=ffffffff +createType="monolithicFlat" + +# Extent description +RW 204800 FLAT "test1-flat.vmdk" 0 + +# The Disk Data Base +#DDB + +ddb.virtualHWVersion = "4" +ddb.geometry.cylinders = "203" +ddb.geometry.heads = "16" +ddb.geometry.sectors = "63" +ddb.adapterType = "ide" + + +On the other-hand creating a sparse file works +cd /mnt/hshare/some/folder/createvmdk/ +[root@fedora createvmdk]# qemu-img create -f vmdk test2.vmdk 100M -o subformat=monolithicSparse +Formatting 'test2.vmdk', fmt=vmdk size=104857600 compat6=off hwversion=undefined subformat=monolithicSparse +[root@fedora createvmdk]# ls l test2*.* +-rwxr-xr-x. 1 gana gana 65536 Jul 26 22:52 test2.vmdk +[root@fedora createvmdk]# du -k /tmp/test2*.* +12 /tmp/test2.vmdk + +test2.vmdk is a binary file +inside it, located among garbled ascii characters is an embedded VMDK description +```` +# Disk DescriptorFile +version=1 +CID=cf302a20 +parentCID=ffffffff +createType="monolithicSparse" + +# Extent description +RW 204800 SPARSE "test2.vmdk" + +# The Disk Data Base +#DDB + +ddb.virtualHWVersion = "4" +ddb.geometry.cylinders = "203" +ddb.geometry.heads = "16" +ddb.geometry.sectors = "63" +ddb.adapterType = "ide" +``` \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1889621 b/results/classifier/mode-deepseek-r1:32b/output/system/1889621 new file mode 100644 index 00000000..36dca126 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1889621 @@ -0,0 +1,99 @@ + + +ARM Highbank Crashes Realted to GIC + +Hello, +Here are some QTest reproducers for crashes on ARM Highbank that all seem to be related to the gic device. + +Reproducer 1: +cat << EOF | ./arm-softmmu/qemu-system-arm -machine highbank \ +-nographic -monitor none -serial none -qtest stdio +writel 0xfff11f00 0x8405f559 +writel 0xfff117fd 0x5c057bd8 +EOF + +==10595==ERROR: AddressSanitizer: SEGV on unknown address 0x62b000013e01 (pc 0x55b6ab85cc91 bp 0x7fff60bd4d70 sp 0x7fff60bd4ce0 T0) +==10595==The signal is caused by a READ memory access. + #0 0x55b6ab85cc91 in gic_get_current_cpu /home/alxndr/Development/qemu/general-fuzz/hw/intc/arm_gic.c:60:12 + #1 0x55b6ab85e1bd in gic_dist_writeb /home/alxndr/Development/qemu/general-fuzz/hw/intc/arm_gic.c:1182:11 + #2 0x55b6ab855a97 in gic_dist_write /home/alxndr/Development/qemu/general-fuzz/hw/intc/arm_gic.c:1514:9 + #3 0x55b6aa1650d4 in memory_region_write_with_attrs_accessor /home/alxndr/Development/qemu/general-fuzz/softmmu/memory.c:503:12 + #4 0x55b6aa163ac6 in access_with_adjusted_size /home/alxndr/Development/qemu/general-fuzz/softmmu/memory.c:544:18 + #5 0x55b6aa161f35 in memory_region_dispatch_write /home/alxndr/Development/qemu/general-fuzz/softmmu/memory.c:1473:13 + #6 0x55b6a9313949 in flatview_write_continue /home/alxndr/Development/qemu/general-fuzz/exec.c:3176:23 + #7 0x55b6a92fca11 in flatview_write /home/alxndr/Development/qemu/general-fuzz/exec.c:3216:14 + #8 0x55b6a92fc54e in address_space_write /home/alxndr/Development/qemu/general-fuzz/exec.c:3308:18 +================================================================= + +Reproducer 2: +cat << EOF | ./arm-softmmu/qemu-system-arm -machine highbank \ +-nographic -monitor none -serial none -qtest stdio +writeq 0xfff11f00 0x613a650f0fda6555 +EOF + +==1375==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x608000001c80 at pc 0x5618928c486e bp 0x7ffe22c4ee10 sp 0x7ffe22c4ee08 +READ of size 8 at 0x608000001c80 thread T0 + #0 0x5618928c486d in address_space_translate_iommu /home/alxndr/Development/qemu/general-fuzz/exec.c:451:23 + #1 0x561892850acc in flatview_do_translate /home/alxndr/Development/qemu/general-fuzz/exec.c:524:16 + #2 0x5618928514ad in flatview_translate /home/alxndr/Development/qemu/general-fuzz/exec.c:584:15 + #3 0x5618928b1e14 in flatview_write_continue /home/alxndr/Development/qemu/general-fuzz/exec.c:3199:14 + #4 0x56189289aa11 in flatview_write /home/alxndr/Development/qemu/general-fuzz/exec.c:3216:14 + #5 0x56189289a54e in address_space_write /home/alxndr/Development/qemu/general-fuzz/exec.c:3308:18 + #6 0x5618937a5e13 in qtest_process_command /home/alxndr/Development/qemu/general-fuzz/softmmu/qtest.c:452:13 + #7 0x56189379d89f in qtest_process_inbuf /home/alxndr/Development/qemu/general-fuzz/softmmu/qtest.c:710:9 + #8 0x56189379c680 in qtest_read /home/alxndr/Development/qemu/general-fuzz/softmmu/qtest.c:722:5 +================================================================= + +Reproducer 3: +cat << EOF | ./arm-softmmu/qemu-system-arm -machine highbank \ +-nographic -monitor none -serial none -qtest stdio +writeq 0xfff11000 0x700000b +writeq 0xfff11f00 0x4f4f4fff54a7afaf +writel 0xfff10100 0x600001ff +EOF + +==23743==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62b000006a92 at pc 0x55d690d980e1 bp 0x7ffe606082d0 sp 0x7ffe606082c8 +READ of size 1 at 0x62b000006a92 thread T0 + #0 0x55d690d980e0 in gic_get_best_irq /home/alxndr/Development/qemu/general-fuzz/hw/intc/arm_gic.c:94:13 + #1 0x55d690d9485b in gic_update_internal /home/alxndr/Development/qemu/general-fuzz/hw/intc/arm_gic.c:185:13 + #2 0x55d690d90376 in gic_update /home/alxndr/Development/qemu/general-fuzz/hw/intc/arm_gic.c:226:5 + #3 0x55d690dc0879 in gic_cpu_write /home/alxndr/Development/qemu/general-fuzz/hw/intc/arm_gic.c:1758:9 + #4 0x55d690da41c0 in gic_thiscpu_write /home/alxndr/Development/qemu/general-fuzz/hw/intc/arm_gic.c:1777:12 + #5 0x55d68f6b30d4 in memory_region_write_with_attrs_accessor /home/alxndr/Development/qemu/general-fuzz/softmmu/memory.c:503:12 + #6 0x55d68f6b1ac6 in access_with_adjusted_size /home/alxndr/Development/qemu/general-fuzz/softmmu/memory.c:544:18 + #7 0x55d68f6aff35 in memory_region_dispatch_write /home/alxndr/Development/qemu/general-fuzz/softmmu/memory.c:1473:13 + #8 0x55d68e861949 in flatview_write_continue /home/alxndr/Development/qemu/general-fuzz/exec.c:3176:23 + #9 0x55d68e84aa11 in flatview_write /home/alxndr/Development/qemu/general-fuzz/exec.c:3216:14 + #10 0x55d68e84a54e in address_space_write /home/alxndr/Development/qemu/general-fuzz/exec.c:3308:18 + #11 0x55d68f755537 in qtest_process_command /home/alxndr/Development/qemu/general-fuzz/softmmu/qtest.c:447:13 + #12 0x55d68f74d89f in qtest_process_inbuf /home/alxndr/Development/qemu/general-fuzz/softmmu/qtest.c:710:9 + #13 0x55d68f74c680 in qtest_read /home/alxndr/Development/qemu/general-fuzz/softmmu/qtest.c:722:5 + #14 0x55d692dddc36 in qemu_chr_be_write_impl /home/alxndr/Development/qemu/general-fuzz/chardev/char.c:188:9 + #15 0x55d692dddd79 in qemu_chr_be_write /home/alxndr/Development/qemu/general-fuzz/chardev/char.c:200:9 + #16 0x55d692df105e in fd_chr_read /home/alxndr/Development/qemu/general-fuzz/chardev/char-fd.c:68:9 + #17 0x55d692f395df in qio_channel_fd_source_dispatch /home/alxndr/Development/qemu/general-fuzz/io/channel-watch.c:84:12 + #18 0x7f69a1b50897 in g_main_context_dispatch (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4e897) + #19 0x55d6932f5c83 in glib_pollfds_poll /home/alxndr/Development/qemu/general-fuzz/util/main-loop.c:217:9 + #20 0x55d6932f35b6 in os_host_main_loop_wait /home/alxndr/Development/qemu/general-fuzz/util/main-loop.c:240:5 + #21 0x55d6932f2f97 in main_loop_wait /home/alxndr/Development/qemu/general-fuzz/util/main-loop.c:516:11 + #22 0x55d68f76c62d in qemu_main_loop /home/alxndr/Development/qemu/general-fuzz/softmmu/vl.c:1676:9 + #23 0x55d692f6f20c in main /home/alxndr/Development/qemu/general-fuzz/softmmu/main.c:49:5 + #24 0x7f69a06d6e0a in __libc_start_main /build/glibc-GwnBeO/glibc-2.30/csu/../csu/libc-start.c:308:16 + #25 0x55d68e753459 in _start (/home/alxndr/Development/qemu/general-fuzz/build/arm-softmmu/qemu-system-arm+0x3254459) + +0x62b000006a92 is located 2 bytes to the right of 26768-byte region [0x62b000000200,0x62b000006a90) +allocated by thread T0 here: + #0 0x55d68e7cbe4d in malloc (/home/alxndr/Development/qemu/general-fuzz/build/arm-softmmu/qemu-system-arm+0x32cce4d) + #1 0x7f69a1b56500 in g_malloc (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x54500) + #2 0x55d69254f231 in object_new /home/alxndr/Development/qemu/general-fuzz/qom/object.c:708:12 + #3 0x55d69034bf01 in qdev_new /home/alxndr/Development/qemu/general-fuzz/hw/core/qdev.c:136:12 + #4 0x55d68f2b7aa4 in calxeda_init /home/alxndr/Development/qemu/general-fuzz/hw/arm/highbank.c:319:15 + #5 0x55d68f2b6466 in highbank_init /home/alxndr/Development/qemu/general-fuzz/hw/arm/highbank.c:411:5 + #6 0x55d6903d43f1 in machine_run_board_init /home/alxndr/Development/qemu/general-fuzz/hw/core/machine.c:1134:5 + #7 0x55d68f77e0ee in qemu_init /home/alxndr/Development/qemu/general-fuzz/softmmu/vl.c:4356:5 + #8 0x55d692f6f207 in main /home/alxndr/Development/qemu/general-fuzz/softmmu/main.c:48:5 + #9 0x7f69a06d6e0a in __libc_start_main /build/glibc-GwnBeO/glibc-2.30/csu/../csu/libc-start.c:308:16 + + +Let me know if I can provide any further info. +-Alex \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/189 b/results/classifier/mode-deepseek-r1:32b/output/system/189 new file mode 100644 index 00000000..309e76c4 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/189 @@ -0,0 +1,3 @@ + + +Intel GVT-g works in X11, segfaults in wayland diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1890310 b/results/classifier/mode-deepseek-r1:32b/output/system/1890310 new file mode 100644 index 00000000..dd9569b2 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1890310 @@ -0,0 +1,49 @@ + + +Segfault in artist.c:block_move + +Hello, +Reproducer: + +cat << EOF | ./hppa-softmmu/qemu-system-hppa -m 64 -display none \ +-qtest stdio -accel qtest +writeq 0xf8100802 0xff5c651ffffb7c5c +writeq 0xf8100afb 0x25e000000000000 +EOF + +AddressSanitizer:DEADLYSIGNAL +================================================================= +==12686==ERROR: AddressSanitizer: SEGV on unknown address 0x7f001a540000 (pc 0x55af3a373078 bp 0x7ffc23001a00 sp 0x7ffc23001670 T0) +==12686==The signal is caused by a READ memory access. + #0 0x55af3a373078 in block_move /hw/display/artist.c:525:13 + #1 0x55af3a365fbc in artist_reg_write /hw/display/artist.c:964:9 + #2 0x55af39a577a3 in memory_region_write_accessor /softmmu/memory.c:483:5 + #3 0x55af39a56adc in access_with_adjusted_size /softmmu/memory.c:539:18 + #4 0x55af39a54873 in memory_region_dispatch_write /softmmu/memory.c:1466:16 + #5 0x55af39102056 in flatview_write_continue /exec.c:3176:23 + #6 0x55af390ea866 in flatview_write /exec.c:3216:14 + #7 0x55af390ea387 in address_space_write /exec.c:3308:18 + #8 0x55af39afe604 in qtest_process_command /softmmu/qtest.c:452:13 + #9 0x55af39af5c08 in qtest_process_inbuf /softmmu/qtest.c:710:9 + #10 0x55af39af4895 in qtest_read /softmmu/qtest.c:722:5 + #11 0x55af3bfb0c43 in qemu_chr_be_write_impl /chardev/char.c:188:9 + #12 0x55af3bfb0dc7 in qemu_chr_be_write /chardev/char.c:200:9 + #13 0x55af3bfc50b3 in fd_chr_read /chardev/char-fd.c:68:9 + #14 0x55af3c119474 in qio_channel_fd_source_dispatch /io/channel-watch.c:84:12 + #15 0x7f0028f60897 in g_main_context_dispatch (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4e897) + #16 0x55af3c51137b in glib_pollfds_poll /util/main-loop.c:217:9 + #17 0x55af3c50eaab in os_host_main_loop_wait /util/main-loop.c:240:5 + #18 0x55af3c50e444 in main_loop_wait /util/main-loop.c:516:11 + #19 0x55af39b16d00 in qemu_main_loop /softmmu/vl.c:1676:9 + #20 0x55af3c151261 in main /softmmu/main.c:49:5 + #21 0x7f0027ae6e0a in __libc_start_main /build/glibc-GwnBeO/glibc-2.30/csu/../csu/libc-start.c:308:16 + #22 0x55af38ff5729 in _start (/home/alxndr/Development/qemu/general-fuzz/build/hppa-softmmu/qemu-system-hppa+0x22d4729) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /hw/display/artist.c:525:13 in block_move +==12686==ABORTING + +The error occurs even with Message-Id: <email address hidden> applied (I collected the above trace with the patch-set applied) + +Thanks +-Alex \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1890360 b/results/classifier/mode-deepseek-r1:32b/output/system/1890360 new file mode 100644 index 00000000..1e98a0fa --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1890360 @@ -0,0 +1,72 @@ + + +Assertion failure in address_space_unmap through virtio-blk + +Hello, +Reproducer: +cat << EOF | ./i386-softmmu/qemu-system-i386 \ +-drive id=mydrive,file=null-co://,size=2M,format=raw,if=none \ +-device virtio-blk,drive=mydrive \ +-nodefaults -nographic -qtest stdio +outl 0xcf8 0x80001010 +outl 0xcfc 0xc001 +outl 0xcf8 0x80001014 +outl 0xcf8 0x80001004 +outw 0xcfc 0x7 +outl 0xc006 0x3aff9090 +outl 0xcf8 0x8000100e +outl 0xcfc 0x41005e1e +write 0x3b00002 0x1 0x5e +write 0x3b00004 0x1 0x5e +write 0x3aff5e6 0x1 0x11 +write 0x3aff5eb 0x1 0xc6 +write 0x3aff5ec 0x1 0xc6 +write 0x7 0x1 0xff +write 0x8 0x1 0xfb +write 0xc 0x1 0x11 +write 0xe 0x1 0x5e +write 0x5e8 0x1 0x11 +write 0x5ec 0x1 0xc6 +outl 0x410e 0x10e +EOF + + +qemu-fuzz-i386: /exec.c:3623: void address_space_unmap(AddressSpace *, void *, hwaddr, _Bool, hwaddr): Assertion `mr != NULL' failed. +==789== ERROR: libFuzzer: deadly signal + #8 in __assert_fail /build/glibc-GwnBeO/glibc-2.30/assert/assert.c:101:3 + #9 in address_space_unmap /exec.c:3623:9 + #10 in dma_memory_unmap /include/sysemu/dma.h:145:5 + #11 in virtqueue_unmap_sg /hw/virtio/virtio.c:690:9 + #12 in virtqueue_fill /hw/virtio/virtio.c:843:5 + #13 in virtqueue_push /hw/virtio/virtio.c:917:5 + #14 in virtio_blk_req_complete /hw/block/virtio-blk.c:83:5 + #15 in virtio_blk_handle_request /hw/block/virtio-blk.c:671:13 + #16 in virtio_blk_handle_vq /hw/block/virtio-blk.c:780:17 + #17 in virtio_queue_notify_aio_vq /hw/virtio/virtio.c:2324:15 + #18 in virtio_queue_host_notifier_aio_read /hw/virtio/virtio.c:3495:9 + #19 in aio_dispatch_handler /util/aio-posix.c:328:9 + #20 in aio_dispatch_handlers /util/aio-posix.c:371:20 + #21 in aio_dispatch /util/aio-posix.c:381:5 + #22 in aio_ctx_dispatch /util/async.c:306:5 + #23 in g_main_context_dispatch + + +With -trace virtio\* + +... +[S +0.099667] OK +[R +0.099681] write 0x5ec 0x1 0xc6 +OK +[S +0.099690] OK +[R +0.099700] outl 0x410e 0x10e +29575@1596590112.074339:virtio_queue_notify vdev 0x62d000030590 n 0 vq 0x7f9b93fc9800 +29575@1596590112.074423:virtio_blk_data_plane_start dataplane 0x60600000f260 +OK +[S +0.099833] OK +29575@1596590112.076459:virtio_queue_notify vdev 0x62d000030590 n 0 vq 0x7f9b93fc9800 +29575@1596590112.076642:virtio_blk_handle_read vdev 0x62d000030590 req 0x611000043e80 sector 0 nsectors 0 +29575@1596590112.076651:virtio_blk_req_complete vdev 0x62d000030590 req 0x611000043e80 status 1 +qemu-system-i386: /home/alxndr/Development/qemu/general-fuzz/exec.c:3623: void address_space_unmap(AddressSpace *, void *, hwaddr, _Bool, hwaddr): Assertion `mr != NULL' failed. + + +-Alex \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1890370 b/results/classifier/mode-deepseek-r1:32b/output/system/1890370 new file mode 100644 index 00000000..4d0ac9ef --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1890370 @@ -0,0 +1,76 @@ + + +Segfault in artist vram_bit_write + +Hello, +Reproducer: + +cat << EOF | ./hppa-softmmu/qemu-system-hppa -m 64 -display none \ +-qtest stdio -accel qtest +writeq 0xf810049f 0xffffffffffffffff +writew 0xf8118001 0xff7c +writew 0xf8118000 0x8300 +writeq 0xf81005fb 0x5c18006400189e +EOF + + +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /hw/display/artist.c:402:17 in +AddressSanitizer:DEADLYSIGNAL +================================================================= +==23157==ERROR: AddressSanitizer: SEGV on unknown address 0x7f17563fffff (pc 0x560ce3ad742c bp 0x7ffe310c62e0 sp 0x7ffe310c5a60 T0) +==23157==The signal is caused by a WRITE memory access. + #0 0x560ce3ad742c in vram_bit_write /hw/display/artist.c:402:43 + #1 0x560ce3acf2ab in artist_reg_write /hw/display/artist.c:892:9 + #2 0x560ce31c37a3 in memory_region_write_accessor /softmmu/memory.c:483:5 + #3 0x560ce31c2adc in access_with_adjusted_size /softmmu/memory.c:539:18 + #4 0x560ce31c0873 in memory_region_dispatch_write /softmmu/memory.c:1466:16 + #5 0x560ce286e056 in flatview_write_continue /exec.c:3176:23 + #6 0x560ce2856866 in flatview_write /exec.c:3216:14 + #7 0x560ce2856387 in address_space_write /exec.c:3308:18 + #8 0x560ce326a604 in qtest_process_command /softmmu/qtest.c:452:13 + #9 0x560ce3261c08 in qtest_process_inbuf /softmmu/qtest.c:710:9 + #10 0x560ce3260895 in qtest_read /softmmu/qtest.c:722:5 + #11 0x560ce571d343 in qemu_chr_be_write_impl /chardev/char.c:188:9 + #12 0x560ce571d4c7 in qemu_chr_be_write /chardev/char.c:200:9 + #13 0x560ce57317b3 in fd_chr_read /chardev/char-fd.c:68:9 + #14 0x560ce5885b74 in qio_channel_fd_source_dispatch /io/channel-watch.c:84:12 + #15 0x7f1665259897 in g_main_context_dispatch (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4e897) + #16 0x560ce5c7da7b in glib_pollfds_poll /util/main-loop.c:217:9 + #17 0x560ce5c7b1ab in os_host_main_loop_wait /util/main-loop.c:240:5 + #18 0x560ce5c7ab44 in main_loop_wait /util/main-loop.c:516:11 + #19 0x560ce3282d00 in qemu_main_loop /softmmu/vl.c:1676:9 + #20 0x560ce58bd961 in main /softmmu/main.c:49:5 + #21 0x7f1663ddfe0a in __libc_start_main /build/glibc-GwnBeO/glibc-2.30/csu/../csu/libc-start.c:308:16 + #22 0x560ce2761729 in _start (/home/alxndr/Development/qemu/general-fuzz/build/hppa-softmmu/qemu-system-hppa+0x22d4729) + + +With -trace artist\* + +[I 1596601002.853158] OPENED +[R +0.047035] writeq 0xf810049f 0xffffffffffffffff +24590@1596601002.900238:artist_reg_write 1 0x10049f <- 0xff +24590@1596601002.900258:artist_reg_write 4 0x1004a0 VRAM_IDX <- 0xffffffff +24590@1596601002.900269:artist_reg_write 2 0x1004a4 <- 0xffff +24590@1596601002.900280:artist_reg_write 1 0x1004a6 <- 0xff +OK +[S +0.047130] OK +[R +0.047159] writew 0xf8118001 0xff7c +24590@1596601002.900331:artist_reg_write 1 0x118001 CMAP_BM_ACCESS <- 0xff +24590@1596601002.900344:artist_reg_write 1 0x118002 CMAP_BM_ACCESS <- 0x7c +OK +[S +0.047194] OK +[R +0.047213] writew 0xf8118000 0x8300 +24590@1596601002.900383:artist_reg_write 2 0x118000 CMAP_BM_ACCESS <- 0x8300 +OK +[S +0.047231] OK +[R +0.047243] writeq 0xf81005fb 0x5c18006400189e +24590@1596601002.900410:artist_reg_write 1 0x1005fb <- 0x0 +24590@1596601002.900418:artist_reg_write 4 0x1005fc <- 0x5c180064 +24590@1596601002.900424:artist_reg_write 2 0x100600 VRAM_WRITE_INCR_X <- 0x18 +/home/alxndr/Development/qemu/general-fuzz/hw/display/artist.c:402:17: runtime error: store to misaligned address 0x7fd01d3fffff for type 'uint32_t' (aka 'unsigned int'), which requires 4 byte alignment +0x7fd01d3fffff: note: pointer points here +<memory cannot be printed> +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/alxndr/Development/qemu/general-fuzz/hw/display/artist.c:402:17 in +AddressSanitizer:DEADLYSIGNAL + +-Alex \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1890545 b/results/classifier/mode-deepseek-r1:32b/output/system/1890545 new file mode 100644 index 00000000..f7301da8 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1890545 @@ -0,0 +1,27 @@ + + +(ARM64) qemu-x86_64+schroot(Debian bullseye) can't run chrome and can't load HTML + +First I creat a file system that is debian(bullseye amd64)on arm64 machine，then I download google-chrome，however, when I ran Google browser, some errors occurred. + +$ google-chrome --no-sandbox +or +$ qemu-x86_64-static google-chrome --no-sandbox + +qemu: uncaught target signal 5 (Trace/breakpoint trap) - core dumped +qemu: uncaught target signal 5 (Trace/breakpoint trap) - core dumped +[1661:1661:0806/074307.502638:ERROR:nacl_fork_delegate_linux.cc(323)] Bad NaCl helper startup ack (0 bytes) +[1664:1664:0806/074307.504159:ERROR:nacl_fork_delegate_linux.cc(323)] Bad NaCl helper startup ack (0 bytes) +qemu: uncaught target signal 5 (Trace/breakpoint trap) - core dumped +qemu: uncaught target signal 5 (Trace/breakpoint trap) - core dumped +[1637:1678:0806/074308.337567:ERROR:file_path_watcher_linux.cc(315)] inotify_init() failed: Function not implemented (38) +Fontconfig warning: "/etc/fonts/fonts.conf", line 100: unknown element "blank" +qemu: unknown option 'type=utility' +[1637:1680:0806/074313.598432:FATAL:gpu_data_manager_impl_private.cc(439)] GPU process isn't usable. Goodbye. +qemu: uncaught target signal 5 (Trace/breakpoint trap) - core dumped +Trace/breakpoint trap + +Why? +And then I run firefox,it can be opened, but it can't load any web pages and HTML. +I really need help！ +Thank. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1891341 b/results/classifier/mode-deepseek-r1:32b/output/system/1891341 new file mode 100644 index 00000000..20c7f75c --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1891341 @@ -0,0 +1,163 @@ + + +Heap-use-after-free in usb_packet_copy through iov_to_buf + +Hello, +Reproducer: + +cat << EOF | ./i386-softmmu/qemu-system-i386 -device nec-usb-xhci \ +-trace usb\* -device usb-audio -device usb-storage,drive=mydrive \ +-drive id=mydrive,file=null-co://,size=2M,format=raw,if=none \ +-nodefaults -nographic -qtest stdio +outl 0xcf8 0x80001016 +outl 0xcfc 0x3c009f0d +outl 0xcf8 0x80001004 +outl 0xcfc 0xc77695e +writel 0x9f0d000000000040 0xffff3655 +writeq 0x9f0d000000002000 0xff2f9e0000000000 +write 0x1d 0x1 0x27 +write 0x2d 0x1 0x2e +write 0x17232 0x1 0x03 +write 0x17254 0x1 0x06 +write 0x17278 0x1 0x34 +write 0x3d 0x1 0x27 +write 0x40 0x1 0x2e +write 0x41 0x1 0x72 +write 0x42 0x1 0x01 +write 0x4d 0x1 0x2e +write 0x4f 0x1 0x01 +writeq 0x9f0d000000002000 0x5c051a0100000000 +write 0x34001d 0x1 0x13 +write 0x340026 0x1 0x30 +write 0x340028 0x1 0x08 +write 0x34002c 0x1 0xfe +write 0x34002d 0x1 0x08 +write 0x340037 0x1 0x5e +write 0x34003a 0x1 0x05 +write 0x34003d 0x1 0x05 +write 0x34004d 0x1 0x13 +writeq 0x9f0d000000002000 0xff00010100400009 +EOF + + +Abridged trace: +... +[R +0.032356] writel 0x9f0d000000000040 0xffff3655 +4760@1597243414.491762:usb_xhci_oper_write off 0x0000, val 0xffff3655 +4760@1597243414.491765:usb_xhci_run +4760@1597243414.491769:usb_xhci_irq_intx level 0 +OK +[S +0.032371] OK +[R +0.032376] writeq 0x9f0d000000002000 0xff2f9e0000000000 +4760@1597243414.491784:usb_xhci_doorbell_write off 0x0000, val 0x00000000 +4760@1597243414.491793:usb_xhci_fetch_trb addr 0x0000000000000000, TRB_RESERVED, p 0x0000000000000000, s 0x00000000, c 0x00000000 +4760@1597243414.491798:usb_xhci_doorbell_write off 0x0004, val 0xff2f9e00 +OK +[S +0.032400] OK +... + +[R +0.032495] writeq 0x9f0d000000002000 0x5c051a0100000000 +4760@1597243414.491899:usb_xhci_doorbell_write off 0x0000, val 0x00000000 +4760@1597243414.491902:usb_xhci_fetch_trb addr 0x0000000000000010, CR_ENABLE_SLOT, p 0x0000000000000000, s 0x00000000, c 0x00002700 +4760@1597243414.491906:usb_xhci_slot_enable slotid 1 +4760@1597243414.491909:usb_xhci_fetch_trb addr 0x0000000000000020, CR_ADDRESS_DEVICE, p 0x0000000000000000, s 0x00000000, c 0x00002e00 +4760@1597243414.491914:usb_xhci_fetch_trb addr 0x0000000000000030, CR_ENABLE_SLOT, p 0x0000000000000000, s 0x00000000, c 0x00002700 +4760@1597243414.491917:usb_xhci_slot_enable slotid 2 +4760@1597243414.491920:usb_xhci_fetch_trb addr 0x0000000000000040, CR_ADDRESS_DEVICE, p 0x000000000001722e, s 0x00000000, c 0x01002e00 +4760@1597243414.491925:usb_xhci_slot_address slotid 1, port 2 +4760@1597243414.491931:usb_xhci_ep_enable slotid 1, epid 1 +4760@1597243414.491937:usb_xhci_fetch_trb addr 0x0000000000000050, TRB_RESERVED, p 0x0000000000000000, s 0x00000000, c 0x00000000 +4760@1597243414.491941:usb_xhci_doorbell_write off 0x0004, val 0x5c051a01 +4760@1597243414.491945:usb_xhci_ep_kick slotid 1, epid 1, streamid 23557 +4760@1597243414.491955:usb_xhci_fetch_trb addr 0x0000000000340000, TRB_RESERVED, p 0x0000000000000000, s 0x00000000, c 0x00000000 +OK +[S +0.032563] OK +... + +OK +[S +0.032643] OK +[R +0.032648] writeq 0x9f0d000000002000 0xff00010100400009 +4760@1597243414.492052:usb_xhci_doorbell_write off 0x0000, val 0x00400009 +4760@1597243414.492055:usb_xhci_doorbell_write off 0x0004, val 0xff000101 +4760@1597243414.492058:usb_xhci_ep_kick slotid 1, epid 1, streamid 65280 +4760@1597243414.492063:usb_xhci_fetch_trb addr 0x0000000000340010, TR_STATUS, p 0x0000000000000000, s 0x00000000, c 0x00001300 +4760@1597243414.492067:usb_xhci_xfer_start 0x611000045140: slotid 1, epid 1, streamid 0 +4760@1597243414.492074:usb_xhci_fetch_trb addr 0x0000000000340020, TR_SETUP, p 0x0030000000000000, s 0x00000008, c 0x000008fe +4760@1597243414.492078:usb_xhci_fetch_trb addr 0x0000000000340030, TR_NORMAL, p 0x5e00000000000000, s 0x00050000, c 0x00000500 +4760@1597243414.492081:usb_xhci_fetch_trb addr 0x0000000000340040, TR_STATUS, p 0x0000000000000000, s 0x00000000, c 0x00001300 +4760@1597243414.492084:usb_xhci_xfer_start 0x611000045280: slotid 1, epid 1, streamid 0 +4760@1597243414.492089:usb_packet_state_change bus 0, port 2, ep 0, packet 0x611000045288, state undef -> setup +================================================================= +==4760==ERROR: AddressSanitizer: heap-use-after-free on address 0x625000341000 at pc 0x562d20cd6847 bp 0x7ffccc326780 sp 0x7ffccc325f48 +READ of size 48 at 0x625000341000 thread T0 + #0 0x562d20cd6846 in __asan_memcpy (build/i386-softmmu/qemu-system-i386+0x250d846) + #1 0x562d22a6b374 in iov_to_buf_full util/iov.c:52:13 + #2 0x562d21ee5139 in iov_to_buf include/qemu/iov.h:62:16 + #3 0x562d21ee5139 in usb_packet_copy hw/usb/core.c:595:9 + #4 0x562d21ee96b4 in do_parameter hw/usb/core.c:284:9 + #5 0x562d21ee96b4 in usb_process_one hw/usb/core.c:369:13 + #6 0x562d21ee6ad8 in usb_handle_packet hw/usb/core.c:419:9 + #7 0x562d21f927b6 in xhci_kick_epctx hw/usb/hcd-xhci.c + #8 0x562d21fb337d in xhci_doorbell_write hw/usb/hcd-xhci.c:3162:13 + #9 0x562d212f1b8e in memory_region_write_accessor softmmu/memory.c:483:5 + #10 0x562d212f158b in access_with_adjusted_size softmmu/memory.c:544:18 + #11 0x562d212f0d9b in memory_region_dispatch_write softmmu/memory.c + #12 0x562d20d344d2 in flatview_write_continue exec.c:3176:23 + #13 0x562d20d29e6b in flatview_write exec.c:3216:14 + #14 0x562d20d29e6b in address_space_write exec.c:3308:18 + #15 0x562d213322a9 in qtest_process_command softmmu/qtest.c:452:13 + #16 0x562d2132f087 in qtest_process_inbuf softmmu/qtest.c:710:9 + #17 0x562d22802293 in fd_chr_read chardev/char-fd.c:68:9 + #18 0x7f6b5673b897 in g_main_context_dispatch (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4e897) + #19 0x562d22a821b3 in glib_pollfds_poll util/main-loop.c:217:9 + #20 0x562d22a821b3 in os_host_main_loop_wait util/main-loop.c:240:5 + #21 0x562d22a821b3 in main_loop_wait util/main-loop.c:516:11 + #22 0x562d21340008 in qemu_main_loop softmmu/vl.c:1676:9 + #23 0x562d228b10fd in main softmmu/main.c:49:5 + +0x625000341000 is located 0 bytes inside of 4096-byte region [0x625000341000,0x625000342000) +freed by thread T0 here: + #0 0x562d20cd716d in free (build/i386-softmmu/qemu-system-i386+0x250e16d) + #1 0x562d22a02242 in qemu_vfree util/oslib-posix.c:247:5 + #2 0x562d20d2d019 in address_space_unmap exec.c:3637:5 + #3 0x562d21f09bbb in dma_memory_unmap include/sysemu/dma.h:145:5 + #4 0x562d21f09bbb in usb_packet_unmap hw/usb/libhw.c:65:9 + #5 0x562d21f0966f in usb_packet_map hw/usb/libhw.c:54:5 + #6 0x562d21f985f1 in xhci_setup_packet hw/usb/hcd-xhci.c:1618:5 + #7 0x562d21f92143 in xhci_fire_ctl_transfer hw/usb/hcd-xhci.c:1722:9 + #8 0x562d21f92143 in xhci_kick_epctx hw/usb/hcd-xhci.c:1991:13 + #9 0x562d21fb337d in xhci_doorbell_write hw/usb/hcd-xhci.c:3162:13 + #10 0x562d212f1b8e in memory_region_write_accessor softmmu/memory.c:483:5 + #11 0x562d212f158b in access_with_adjusted_size softmmu/memory.c:544:18 + #12 0x562d212f0d9b in memory_region_dispatch_write softmmu/memory.c + #13 0x562d20d344d2 in flatview_write_continue exec.c:3176:23 + #14 0x562d20d29e6b in flatview_write exec.c:3216:14 + #15 0x562d20d29e6b in address_space_write exec.c:3308:18 + #16 0x562d213322a9 in qtest_process_command softmmu/qtest.c:452:13 + #17 0x562d2132f087 in qtest_process_inbuf softmmu/qtest.c:710:9 + #18 0x562d22802293 in fd_chr_read chardev/char-fd.c:68:9 + #19 0x7f6b5673b897 in g_main_context_dispatch + +previously allocated by thread T0 here: + #0 0x562d20cd7ea7 in posix_memalign (build/i386-softmmu/qemu-system-i386+0x250eea7) + #1 0x562d22a01995 in qemu_try_memalign util/oslib-posix.c:207:11 + #2 0x562d22a01d48 in qemu_memalign util/oslib-posix.c:223:27 + #3 0x562d20d2c8f0 in address_space_map exec.c:3586:25 + #4 0x562d21f093cb in dma_memory_map include/sysemu/dma.h:135:9 + #5 0x562d21f093cb in usb_packet_map hw/usb/libhw.c:39:19 + #6 0x562d21f985f1 in xhci_setup_packet hw/usb/hcd-xhci.c:1618:5 + #7 0x562d21f92143 in xhci_fire_ctl_transfer hw/usb/hcd-xhci.c:1722:9 + #8 0x562d21f92143 in xhci_kick_epctx hw/usb/hcd-xhci.c:1991:13 + #9 0x562d21fb337d in xhci_doorbell_write hw/usb/hcd-xhci.c:3162:13 + #10 0x562d212f1b8e in memory_region_write_accessor softmmu/memory.c:483:5 + #11 0x562d212f158b in access_with_adjusted_size softmmu/memory.c:544:18 + #12 0x562d212f0d9b in memory_region_dispatch_write softmmu/memory.c + #13 0x562d20d344d2 in flatview_write_continue exec.c:3176:23 + #14 0x562d20d29e6b in flatview_write exec.c:3216:14 + #15 0x562d20d29e6b in address_space_write exec.c:3308:18 + #16 0x562d213322a9 in qtest_process_command softmmu/qtest.c:452:13 + #17 0x562d2132f087 in qtest_process_inbuf softmmu/qtest.c:710:9 + #18 0x562d22802293 in fd_chr_read chardev/char-fd.c:68:9 + #19 0x7f6b5673b897 in g_main_context_dispatch + +-Alex \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1891354 b/results/classifier/mode-deepseek-r1:32b/output/system/1891354 new file mode 100644 index 00000000..c749f747 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1891354 @@ -0,0 +1,116 @@ + + +Heap-use-after-free in usb_packet_unmap + +Hello, +Reproducer: + +cat << EOF | ./i386-softmmu/qemu-system-i386 -device nec-usb-xhci \ +-trace usb\* -device usb-audio -device usb-storage,drive=mydrive \ +-drive id=mydrive,file=null-co://,size=2M,format=raw,if=none \ +-nodefaults -nographic -qtest stdio +outl 0xcf8 0x80001010 +outl 0xcfc 0xc0202 +outl 0xcf8 0x80001004 +outl 0xcfc 0x1c77695e +writel 0xc0040 0xffffd855 +writeq 0xc2000 0xff05140100000000 +write 0x1d 0x1 0x27 +write 0x2d 0x1 0x2e +write 0x17232 0x1 0x03 +write 0x17254 0x1 0x05 +write 0x17276 0x1 0x72 +write 0x17278 0x1 0x02 +write 0x3d 0x1 0x27 +write 0x40 0x1 0x2e +write 0x41 0x1 0x72 +write 0x42 0x1 0x01 +write 0x4d 0x1 0x2e +write 0x4f 0x1 0x01 +write 0x2007c 0x1 0xc7 +writeq 0xc2000 0x5c05140100000000 +write 0x20070 0x1 0x80 +write 0x20078 0x1 0x08 +write 0x2007c 0x1 0xfe +write 0x2007d 0x1 0x08 +write 0x20081 0x1 0xff +write 0x20082 0x1 0x0b +write 0x20089 0x1 0x8c +write 0x2008d 0x1 0x04 +write 0x2009d 0x1 0x10 +writeq 0xc2000 0x2505ef019e092f00 +EOF + +20091==ERROR: AddressSanitizer: heap-use-after-free on address 0x611000045030 at pc 0x55db79edeef2 bp 0x7ffc4020b2b0 sp 0x7ffc4020b2a8 +READ of size 4 at 0x611000045030 thread T0 + #0 0x55db79edeef1 in usb_packet_unmap hw/usb/libhw.c:64:28 + #1 0x55db79ede66f in usb_packet_map hw/usb/libhw.c:54:5 + #2 0x55db79f6d5f1 in xhci_setup_packet hw/usb/hcd-xhci.c:1618:5 + #3 0x55db79f67143 in xhci_fire_ctl_transfer hw/usb/hcd-xhci.c:1722:9 + #4 0x55db79f67143 in xhci_kick_epctx hw/usb/hcd-xhci.c:1991:13 + #5 0x55db79f8837d in xhci_doorbell_write hw/usb/hcd-xhci.c:3162:13 + #6 0x55db792c6b8e in memory_region_write_accessor softmmu/memory.c:483:5 + #7 0x55db792c658b in access_with_adjusted_size softmmu/memory.c:544:18 + #8 0x55db792c5d9b in memory_region_dispatch_write softmmu/memory.c + #9 0x55db78d094d2 in flatview_write_continue exec.c:3176:23 + #10 0x55db78cfee6b in flatview_write exec.c:3216:14 + #11 0x55db78cfee6b in address_space_write exec.c:3308:18 + #12 0x55db793072a9 in qtest_process_command softmmu/qtest.c:452:13 + #13 0x55db79304087 in qtest_process_inbuf softmmu/qtest.c:710:9 + #14 0x55db7a7d7293 in fd_chr_read chardev/char-fd.c:68:9 + #15 0x7fc5d7f1a897 in g_main_context_dispatch + #16 0x55db7aa571b3 in glib_pollfds_poll util/main-loop.c:217:9 + #17 0x55db7aa571b3 in os_host_main_loop_wait util/main-loop.c:240:5 + #18 0x55db7aa571b3 in main_loop_wait util/main-loop.c:516:11 + #19 0x55db79315008 in qemu_main_loop softmmu/vl.c:1676:9 + #20 0x55db7a8860fd in main softmmu/main.c:49:5 + +0x611000045030 is located 48 bytes inside of 256-byte region [0x611000045000,0x611000045100) +freed by thread T0 here: + #0 0x55db78cac16d in free (build/i386-softmmu/qemu-system-i386+0x250e16d) + #1 0x55db79f7c0e8 in xhci_ep_nuke_xfers hw/usb/hcd-xhci.c:1252:9 + #2 0x55db79f7b454 in xhci_disable_ep hw/usb/hcd-xhci.c:1279:5 + #3 0x55db79f79af7 in xhci_disable_slot hw/usb/hcd-xhci.c:2048:13 + #4 0x55db79f5aea3 in xhci_reset hw/usb/hcd-xhci.c:2706:9 + #5 0x55db79f82f49 in xhci_oper_write hw/usb/hcd-xhci.c:2966:13 + #6 0x55db792c6b8e in memory_region_write_accessor softmmu/memory.c:483:5 + #7 0x55db792c658b in access_with_adjusted_size softmmu/memory.c:544:18 + #8 0x55db792c5d9b in memory_region_dispatch_write softmmu/memory.c + #9 0x55db78d094d2 in flatview_write_continue exec.c:3176:23 + #10 0x55db78cfee6b in flatview_write exec.c:3216:14 + #11 0x55db78cfee6b in address_space_write exec.c:3308:18 + #12 0x55db78d01fe7 in address_space_unmap exec.c:3634:9 + #13 0x55db79edebbb in dma_memory_unmap include/sysemu/dma.h:145:5 + #14 0x55db79edebbb in usb_packet_unmap hw/usb/libhw.c:65:9 + #15 0x55db79ede66f in usb_packet_map hw/usb/libhw.c:54:5 + #16 0x55db79f6d5f1 in xhci_setup_packet hw/usb/hcd-xhci.c:1618:5 + #17 0x55db79f67143 in xhci_fire_ctl_transfer hw/usb/hcd-xhci.c:1722:9 + #18 0x55db79f67143 in xhci_kick_epctx hw/usb/hcd-xhci.c:1991:13 + #19 0x55db79f8837d in xhci_doorbell_write hw/usb/hcd-xhci.c:3162:13 + #20 0x55db792c6b8e in memory_region_write_accessor softmmu/memory.c:483:5 + #21 0x55db792c658b in access_with_adjusted_size softmmu/memory.c:544:18 + #22 0x55db792c5d9b in memory_region_dispatch_write softmmu/memory.c + #23 0x55db78d094d2 in flatview_write_continue exec.c:3176:23 + #24 0x55db78cfee6b in flatview_write exec.c:3216:14 + #25 0x55db78cfee6b in address_space_write exec.c:3308:18 + #26 0x55db793072a9 in qtest_process_command softmmu/qtest.c:452:13 + #27 0x55db79304087 in qtest_process_inbuf softmmu/qtest.c:710:9 + #28 0x55db7a7d7293 in fd_chr_read chardev/char-fd.c:68:9 + #29 0x7fc5d7f1a897 in g_main_context_dispatch + +previously allocated by thread T0 here: + #0 0x55db78cac562 in calloc (build/i386-softmmu/qemu-system-i386+0x250e562) + #1 0x7fc5d7f20548 in g_malloc0 (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x54548) + #2 0x55db79f8837d in xhci_doorbell_write hw/usb/hcd-xhci.c:3162:13 + #3 0x55db792c6b8e in memory_region_write_accessor softmmu/memory.c:483:5 + #4 0x55db792c658b in access_with_adjusted_size softmmu/memory.c:544:18 + #5 0x55db792c5d9b in memory_region_dispatch_write softmmu/memory.c + #6 0x55db78d094d2 in flatview_write_continue exec.c:3176:23 + #7 0x55db78cfee6b in flatview_write exec.c:3216:14 + #8 0x55db78cfee6b in address_space_write exec.c:3308:18 + #9 0x55db793072a9 in qtest_process_command softmmu/qtest.c:452:13 + #10 0x55db79304087 in qtest_process_inbuf softmmu/qtest.c:710:9 + #11 0x55db7a7d7293 in fd_chr_read chardev/char-fd.c:68:9 + #12 0x7fc5d7f1a897 in g_main_context_dispatch + +-Alex \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1891748 b/results/classifier/mode-deepseek-r1:32b/output/system/1891748 new file mode 100644 index 00000000..9b9eda25 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1891748 @@ -0,0 +1,16 @@ + + +qemu-arm-static 5.1 can't run gcc + +Issue discovered while trying to build pikvm (1) + +Long story short: when using qemu-arm-static 5.1, gcc exits whith message: + +Allocating guest commpage: Operation not permitted + + +when using qemu-arm-static v5.0, gcc "works" + +Steps to reproduce will follow + +(1) https://github.com/pikvm/pikvm/blob/master/pages/building_os.md \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1891749 b/results/classifier/mode-deepseek-r1:32b/output/system/1891749 new file mode 100644 index 00000000..0d70db0a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1891749 @@ -0,0 +1,5 @@ + + +CGA Mode 6 is only 100 pixels tall, when it's supposed to be 200 + +I have written a program that used CGA Mode 6 (640x200 black and white). However qemu-system-i386 only displays the first 100 pixels, effectively limiting the resolution of mode 6 to 640x100. When running the same program on a real computer it uses the whole 640x200 pixels. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1892960 b/results/classifier/mode-deepseek-r1:32b/output/system/1892960 new file mode 100644 index 00000000..f78f4237 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1892960 @@ -0,0 +1,218 @@ + + +Heap-overflow in flatview_read through sdhci_data_transfer + +Hello, +Reproducer: +cat << EOF | ./qemu-system-i386 -nodefaults \ +-device sdhci-pci,sd-spec-version=3 \ +-device sd-card,drive=mydrive \ +-drive if=sd,index=0,file=null-co://,format=raw,id=mydrive \ +-nographic -qtest stdio -accel qtest +outl 0xcf8 0x80001010 +outl 0xcfc 0xd7055dba +outl 0xcf8 0x80001003 +outl 0xcfc 0x86b1d733 +writeq 0xd7055d2b 0x84126e0ed7d7355e +writeq 0xd7055d23 0x13bd7d7346e0129 +writeq 0xd7055d05 0x615bfb845e05c42c +write 0x0 0x1 0x39 +write 0x5 0x1 0x06 +write 0x6 0x1 0x35 +write 0x7 0x1 0x01 +write 0x1350600 0x1 0x39 +writew 0xd7055d0e 0x846e +write 0x1350600 0x1 0x29 +write 0x1350602 0x1 0x1a +write 0x1350608 0x1 0x39 +clock_step +writeq 0xd7055d03 0x6d00000026000000 +clock_step +EOF + +The trace: + +[R +0.077745] outl 0xcf8 0x80001010 +OK +[S +0.077773] OK +[R +0.077792] outl 0xcfc 0xd7055dba +OK +[S +0.077813] OK +[R +0.077826] outl 0xcf8 0x80001003 +OK +[S +0.077835] OK +[R +0.077846] outl 0xcfc 0x86b1d733 +OK +[S +0.080186] OK +[R +0.080204] writeq 0xd7055d2b 0x84126e0ed7d7355e +752161@1598405049.572123:sdhci_access wr8: addr[0x002b] <- 0x0000005e (94) +752161@1598405049.572133:sdhci_access wr32: addr[0x002c] <- 0x0ed7d735 (249026357) +752161@1598405049.572142:sdhci_access wr16: addr[0x0030] <- 0x0000126e (4718) +752161@1598405049.572150:sdhci_access wr8: addr[0x0032] <- 0x00000084 (132) +OK +[S +0.080255] OK +[R +0.080267] writeq 0xd7055d23 0x13bd7d7346e0129 +752161@1598405049.572176:sdhci_error Non-sequential access to Buffer Data Port registeris prohibited + +752161@1598405049.572181:sdhci_access wr8: addr[0x0023] <- 0x00000029 (41) +752161@1598405049.572187:sdhci_access wr32: addr[0x0024] <- 0xd7346e01 (3610537473) +752161@1598405049.572193:sdhci_access wr16: addr[0x0028] <- 0x00003bd7 (15319) +752161@1598405049.572200:sdhci_access wr8: addr[0x002a] <- 0x00000001 (1) +OK +[S +0.080303] OK +[R +0.080316] writeq 0xd7055d05 0x615bfb845e05c42c +752161@1598405049.572226:sdhci_access wr8: addr[0x0005] <- 0x0000002c (44) +752161@1598405049.572233:sdhci_access wr16: addr[0x0006] <- 0x000005c4 (1476) +752161@1598405049.572240:sdhci_access wr32: addr[0x0008] <- 0x5bfb845e (1543210078) +752161@1598405049.572247:sdhci_access wr8: addr[0x000c] <- 0x00000061 (97) +OK +[S +0.080350] OK +[R +0.080362] write 0x0 0x1 0x39 +OK +[S +0.080606] OK +[R +0.080617] write 0x5 0x1 0x06 +OK +[S +0.080629] OK +[R +0.080639] write 0x6 0x1 0x35 +OK +[S +0.080648] OK +[R +0.080657] write 0x7 0x1 0x01 +OK +[S +0.080665] OK +[R +0.080675] write 0x1350600 0x1 0x39 +OK +[S +0.080863] OK +[R +0.080875] writew 0xd7055d0e 0x846e +752161@1598405049.572786:sdhci_send_command CMD132 ARG[0x5bfb845e] +752161@1598405049.572810:sdhci_error timeout waiting for command response +752161@1598405049.572822:sdhci_adma_loop addr=0x01350600, len=0, attr=0x39 +752161@1598405049.572827:sdhci_adma link: admasysaddr=0x1350600 +752161@1598405049.572833:sdhci_adma_loop addr=0x00000000, len=0, attr=0x39 +752161@1598405049.572837:sdhci_adma link: admasysaddr=0x0 +752161@1598405049.572842:sdhci_adma_loop addr=0x01350600, len=0, attr=0x39 +752161@1598405049.572845:sdhci_adma link: admasysaddr=0x1350600 +752161@1598405049.572851:sdhci_adma_loop addr=0x00000000, len=0, attr=0x39 +752161@1598405049.572854:sdhci_adma link: admasysaddr=0x0 +752161@1598405049.572859:sdhci_adma_loop addr=0x01350600, len=0, attr=0x39 +752161@1598405049.572862:sdhci_adma link: admasysaddr=0x1350600 +752161@1598405049.572875:sdhci_access wr16: addr[0x000e] <- 0x0000846e (33902) +OK +[S +0.080979] OK +[R +0.080991] write 0x1350600 0x1 0x29 +OK +[S +0.081001] OK +[R +0.081011] write 0x1350602 0x1 0x1a +OK +[S +0.081019] OK +[R +0.081029] write 0x1350608 0x1 0x39 +OK +[S +0.081037] OK +[R +0.081045] clock_step +752161@1598405049.572962:sdhci_adma_loop addr=0x00000000, len=26, attr=0x29 +752161@1598405049.572972:sdhci_adma_loop addr=0x00000000, len=0, attr=0x39 +752161@1598405049.572977:sdhci_adma link: admasysaddr=0x0 +752161@1598405049.572981:sdhci_adma_loop addr=0x01350600, len=0, attr=0x39 +752161@1598405049.572985:sdhci_adma link: admasysaddr=0x1350600 +752161@1598405049.572989:sdhci_adma_loop addr=0x00000000, len=26, attr=0x29 +752161@1598405049.572997:sdhci_adma_loop addr=0x00000000, len=0, attr=0x39 +752161@1598405049.573001:sdhci_adma link: admasysaddr=0x0 +OK 100 +[S +0.081112] OK 100 +[R +0.081126] writeq 0xd7055d03 0x6d00000026000000 +752161@1598405049.573038:sdhci_access wr8: addr[0x0003] <- 0x00000000 (0) +752161@1598405049.573045:sdhci_access wr32: addr[0x0004] <- 0x00260000 (2490368) +752161@1598405049.573051:sdhci_access wr16: addr[0x0008] <- 0x00000000 (0) +752161@1598405049.573057:sdhci_access wr8: addr[0x000a] <- 0x0000006d (109) +OK +[S +0.081162] OK +[R +0.081171] clock_step +752161@1598405049.573085:sdhci_adma_loop addr=0x01350600, len=0, attr=0x39 +752161@1598405049.573090:sdhci_adma link: admasysaddr=0x1350600 +752161@1598405049.573096:sdhci_adma_loop addr=0x00000000, len=26, attr=0x29 +================================================================= +==752161==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61500001e500 at pc 0x5651bce1a940 bp 0x7fff16a81f50 sp 0x7fff16a81718 +WRITE of size 786432 at 0x61500001e500 thread T0 + #0 0x5651bce1a93f in __asan_memcpy (/home/alxndr/Development/qemu/general-fuzz/build/qemu-system-i386+0x2d2893f) + #1 0x5651bf4197ce in flatview_read_continue /home/alxndr/Development/qemu/general-fuzz/build/../exec.c:3246:13 + #2 0x5651bf41bff3 in flatview_read /home/alxndr/Development/qemu/general-fuzz/build/../exec.c:3279:12 + #3 0x5651bf41bb48 in address_space_read_full /home/alxndr/Development/qemu/general-fuzz/build/../exec.c:3292:18 + #4 0x5651bf41cce8 in address_space_rw /home/alxndr/Development/qemu/general-fuzz/build/../exec.c:3320:16 + #5 0x5651bd623b67 in dma_memory_rw_relaxed /home/alxndr/Development/qemu/general-fuzz/include/sysemu/dma.h:87:18 + #6 0x5651bd623585 in dma_memory_rw /home/alxndr/Development/qemu/general-fuzz/include/sysemu/dma.h:110:12 + #7 0x5651bd6227b7 in dma_memory_read /home/alxndr/Development/qemu/general-fuzz/include/sysemu/dma.h:116:12 + #8 0x5651bd61b052 in sdhci_do_adma /home/alxndr/Development/qemu/general-fuzz/build/../hw/sd/sdhci.c:792:21 + #9 0x5651bd60d3c4 in sdhci_data_transfer /home/alxndr/Development/qemu/general-fuzz/build/../hw/sd/sdhci.c:887:13 + #10 0x5651c0c4d917 in timerlist_run_timers /home/alxndr/Development/qemu/general-fuzz/build/../util/qemu-timer.c:572:9 + #11 0x5651c0c4de51 in qemu_clock_run_timers /home/alxndr/Development/qemu/general-fuzz/build/../util/qemu-timer.c:586:12 + #12 0x5651bf562a13 in qtest_clock_warp /home/alxndr/Development/qemu/general-fuzz/build/../softmmu/cpus.c:507:9 + #13 0x5651bf74f5d8 in qtest_process_command /home/alxndr/Development/qemu/general-fuzz/build/../softmmu/qtest.c:665:9 + #14 0x5651bf73d63e in qtest_process_inbuf /home/alxndr/Development/qemu/general-fuzz/build/../softmmu/qtest.c:710:9 + #15 0x5651bf73c3e3 in qtest_read /home/alxndr/Development/qemu/general-fuzz/build/../softmmu/qtest.c:722:5 + #16 0x5651c0842762 in qemu_chr_be_write_impl /home/alxndr/Development/qemu/general-fuzz/build/../chardev/char.c:188:9 + #17 0x5651c08428aa in qemu_chr_be_write /home/alxndr/Development/qemu/general-fuzz/build/../chardev/char.c:200:9 + #18 0x5651c0868514 in fd_chr_read /home/alxndr/Development/qemu/general-fuzz/build/../chardev/char-fd.c:68:9 + #19 0x5651c0754736 in qio_channel_fd_source_dispatch /home/alxndr/Development/qemu/general-fuzz/build/../io/channel-watch.c:84:12 + #20 0x7fac88fad4cd in g_main_context_dispatch (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x504cd) + #21 0x5651c0cdfc67 in glib_pollfds_poll /home/alxndr/Development/qemu/general-fuzz/build/../util/main-loop.c:217:9 + #22 0x5651c0cdd567 in os_host_main_loop_wait /home/alxndr/Development/qemu/general-fuzz/build/../util/main-loop.c:240:5 + #23 0x5651c0cdcf47 in main_loop_wait /home/alxndr/Development/qemu/general-fuzz/build/../util/main-loop.c:516:11 + #24 0x5651bf4bb08d in qemu_main_loop /home/alxndr/Development/qemu/general-fuzz/build/../softmmu/vl.c:1676:9 + #25 0x5651bce4d51c in main /home/alxndr/Development/qemu/general-fuzz/build/../softmmu/main.c:50:5 + #26 0x7fac887b6cc9 in __libc_start_main csu/../csu/libc-start.c:308:16 + #27 0x5651bcda2cf9 in _start (/home/alxndr/Development/qemu/general-fuzz/build/qemu-system-i386+0x2cb0cf9) + +0x61500001e500 is located 0 bytes to the right of 512-byte region [0x61500001e300,0x61500001e500) +allocated by thread T0 here: + #0 0x5651bce1b5b2 in calloc (/home/alxndr/Development/qemu/general-fuzz/build/qemu-system-i386+0x2d295b2) + #1 0x7fac88fb3210 in g_malloc0 (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x56210) + #2 0x5651bd8cd222 in sdhci_pci_realize /home/alxndr/Development/qemu/general-fuzz/build/../hw/sd/sdhci-pci.c:36:5 + #3 0x5651bd88c228 in pci_qdev_realize /home/alxndr/Development/qemu/general-fuzz/build/../hw/pci/pci.c:2114:9 + #4 0x5651c07a4ec9 in device_set_realized /home/alxndr/Development/qemu/general-fuzz/build/../hw/core/qdev.c:864:13 + #5 0x5651bfe384b8 in property_set_bool /home/alxndr/Development/qemu/general-fuzz/build/../qom/object.c:2202:5 + #6 0x5651bfe2c1cf in object_property_set /home/alxndr/Development/qemu/general-fuzz/build/../qom/object.c:1349:5 + #7 0x5651bfe49471 in object_property_set_qobject /home/alxndr/Development/qemu/general-fuzz/build/../qom/qom-qobject.c:28:10 + #8 0x5651bfe2d890 in object_property_set_bool /home/alxndr/Development/qemu/general-fuzz/build/../qom/object.c:1416:15 + #9 0x5651c078cc64 in qdev_realize /home/alxndr/Development/qemu/general-fuzz/build/../hw/core/qdev.c:379:12 + #10 0x5651bd8bd8cc in qdev_device_add /home/alxndr/Development/qemu/general-fuzz/build/../qdev-monitor.c:676:10 + #11 0x5651bf4e3e43 in device_init_func /home/alxndr/Development/qemu/general-fuzz/build/../softmmu/vl.c:2101:11 + #12 0x5651c0af71e4 in qemu_opts_foreach /home/alxndr/Development/qemu/general-fuzz/build/../util/qemu-option.c:1172:14 + #13 0x5651bf4cd04b in qemu_init /home/alxndr/Development/qemu/general-fuzz/build/../softmmu/vl.c:4384:5 + #14 0x5651bce4d517 in main /home/alxndr/Development/qemu/general-fuzz/build/../softmmu/main.c:49:5 + #15 0x7fac887b6cc9 in __libc_start_main csu/../csu/libc-start.c:308:16 + +SUMMARY: AddressSanitizer: heap-buffer-overflow (/home/alxndr/Development/qemu/general-fuzz/build/qemu-system-i386+0x2d2893f) in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c2a7fffbc50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2a7fffbc60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fffbc70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fffbc80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fffbc90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c2a7fffbca0:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2a7fffbcb0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c2a7fffbcc0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c2a7fffbcd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c2a7fffbce0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c2a7fffbcf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==752161==ABORTING + +-Alex \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1892966 b/results/classifier/mode-deepseek-r1:32b/output/system/1892966 new file mode 100644 index 00000000..16bbcb80 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1892966 @@ -0,0 +1,80 @@ + + +Null-pointer dereference in blk_bs through ide_cancel_dma_sync + +Hello, +Reproducer: +cat << EOF | ./qemu-system-i386 -M pc \ +-drive file=null-co://,if=none,format=raw,id=disk0 \ +-device ide-hd,drive=disk0,bus=ide.1,unit=1 \ +-display none -nodefaults -display none -qtest stdio -accel qtest +outw 0x176 0x35b3 +outb 0x376 0x5f +outb 0x376 0x40 +outl 0xcf8 0x80000904 +outl 0xcfc 0x5c0525b7 +outb 0x176 0x0 +outl 0xcf8 0x8000091e +outl 0xcfc 0xd7580584 +write 0x187 0x1 0x34 +write 0x277 0x1 0x34 +write 0x44f 0x1 0x5c +write 0x53f 0x1 0x5c +write 0x717 0x1 0x34 +write 0x807 0x1 0x34 +write 0x9df 0x1 0x5c +write 0xbb7 0x1 0x34 +write 0xca7 0x1 0x34 +write 0xe7f 0x1 0x5c +write 0xf6f 0x1 0x5c +outb 0xd758 0x5f +outb 0xd758 0x40 +EOF + + +Trace: +[S +0.083320] OK +[R +0.083328] outb 0xd758 0x5f +OK +[S +0.084167] OK +[R +0.084183] outb 0xd758 0x40 +../block/block-backend.c:714:17: runtime error: member access within null pointer of type 'BlockBackend' (aka 'struct BlockBackend') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../block/block-backend.c:714:17 in +AddressSanitizer:DEADLYSIGNAL +================================================================= +==843136==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010 (pc 0x5593520d8ebc bp 0x7ffc0bb9e0b0 sp 0x7ffc0bb9e010 T0) +==843136==The signal is caused by a READ memory access. +==843136==Hint: address points to the zero page. + #0 0x5593520d8ebc in blk_bs /home/alxndr/Development/qemu/general-fuzz/build/../block/block-backend.c:714:12 + #1 0x5593520d2d07 in blk_drain /home/alxndr/Development/qemu/general-fuzz/build/../block/block-backend.c:1715:28 + #2 0x55935096e9dc in ide_cancel_dma_sync /home/alxndr/Development/qemu/general-fuzz/build/../hw/ide/core.c:723:9 + #3 0x55934f96b9ed in bmdma_cmd_writeb /home/alxndr/Development/qemu/general-fuzz/build/../hw/ide/pci.c:298:13 + #4 0x55934fea0547 in bmdma_write /home/alxndr/Development/qemu/general-fuzz/build/../hw/ide/piix.c:75:9 + #5 0x55935175dde0 in memory_region_write_accessor /home/alxndr/Development/qemu/general-fuzz/build/../softmmu/memory.c:483:5 + #6 0x55935175d2bd in access_with_adjusted_size /home/alxndr/Development/qemu/general-fuzz/build/../softmmu/memory.c:544:18 + #7 0x55935175af70 in memory_region_dispatch_write /home/alxndr/Development/qemu/general-fuzz/build/../softmmu/memory.c:1466:16 + #8 0x5593513b98a6 in flatview_write_continue /home/alxndr/Development/qemu/general-fuzz/build/../exec.c:3176:23 + #9 0x5593513a2878 in flatview_write /home/alxndr/Development/qemu/general-fuzz/build/../exec.c:3216:14 + #10 0x5593513a23a8 in address_space_write /home/alxndr/Development/qemu/general-fuzz/build/../exec.c:3308:18 + #11 0x559351803e07 in cpu_outb /home/alxndr/Development/qemu/general-fuzz/build/../softmmu/ioport.c:60:5 + #12 0x5593516c7b6d in qtest_process_command /home/alxndr/Development/qemu/general-fuzz/build/../softmmu/qtest.c:392:13 + #13 0x5593516c363e in qtest_process_inbuf /home/alxndr/Development/qemu/general-fuzz/build/../softmmu/qtest.c:710:9 + #14 0x5593516c23e3 in qtest_read /home/alxndr/Development/qemu/general-fuzz/build/../softmmu/qtest.c:722:5 + #15 0x5593527c8762 in qemu_chr_be_write_impl /home/alxndr/Development/qemu/general-fuzz/build/../chardev/char.c:188:9 + #16 0x5593527c88aa in qemu_chr_be_write /home/alxndr/Development/qemu/general-fuzz/build/../chardev/char.c:200:9 + #17 0x5593527ee514 in fd_chr_read /home/alxndr/Development/qemu/general-fuzz/build/../chardev/char-fd.c:68:9 + #18 0x5593526da736 in qio_channel_fd_source_dispatch /home/alxndr/Development/qemu/general-fuzz/build/../io/channel-watch.c:84:12 + #19 0x7f3be18ef4cd in g_main_context_dispatch (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x504cd) + #20 0x559352c65c67 in glib_pollfds_poll /home/alxndr/Development/qemu/general-fuzz/build/../util/main-loop.c:217:9 + #21 0x559352c63567 in os_host_main_loop_wait /home/alxndr/Development/qemu/general-fuzz/build/../util/main-loop.c:240:5 + #22 0x559352c62f47 in main_loop_wait /home/alxndr/Development/qemu/general-fuzz/build/../util/main-loop.c:516:11 + #23 0x55935144108d in qemu_main_loop /home/alxndr/Development/qemu/general-fuzz/build/../softmmu/vl.c:1676:9 + #24 0x55934edd351c in main /home/alxndr/Development/qemu/general-fuzz/build/../softmmu/main.c:50:5 + #25 0x7f3be10f8cc9 in __libc_start_main csu/../csu/libc-start.c:308:16 + #26 0x55934ed28cf9 in _start (/home/alxndr/Development/qemu/general-fuzz/build/qemu-system-i386+0x2cb0cf9) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /home/alxndr/Development/qemu/general-fuzz/build/../block/block-backend.c:714:12 in blk_bs +==843136==ABORTING + +-Alex \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1894071 b/results/classifier/mode-deepseek-r1:32b/output/system/1894071 new file mode 100644 index 00000000..72ac69f7 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1894071 @@ -0,0 +1,21 @@ + + +qemu-i386-static ioctl return -14 (Bad Address) + +I use qemu-i386-static on 64 bit ARM.But I don't know how to solve some problems. +First I added some ioctl operations. +Then I tried to do some DRM operations like test.c. +This is successful when I use qemu-x86_64-static,but it failed when I use qemu-i386-static. +I can get some strace info like this: + +403 openat(AT_FDCWD,"/dev/dri/card0",O_RDWR|O_LARGEFILE|O_CLOEXEC) = 4 +403 ioctl(4,DRM_IOCTL_GET_CAP,{1,0}) = 0 ({1,1}) +403 ioctl(4,DRM_IOCTL_MODE_GETRESOURCES,{0,0,0,0,0,0,0,0,0,0,0,0}) = 0 ({0,0,0,0,0,2,2,2,0,16384,0,16384}) +403 brk(NULL) = 0x40006000 +403 brk(0x40027000) = 0x40027000 +403 brk(0x40028000) = 0x40028000 +403 ioctl(4,DRM_IOCTL_MODE_GETRESOURCES,{0,1073766816,1073766832,1073766848,0,2,2,2,0,16384,0,16384}) = -1 errno=14 (Bad address) + +And there are similar errors in other self driven operations. +I want to know if it is QEMU's problem, so I hope to get some help. +Thank you! \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1895363 b/results/classifier/mode-deepseek-r1:32b/output/system/1895363 new file mode 100644 index 00000000..4c012d49 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1895363 @@ -0,0 +1,9 @@ + + +borland IDEs double up cursor key presses (need timing on PS2 port input) + +Most DOS-era IDEs from Borland (I have tried Borland C++ 2.0, Borland C++ 3.1 and Turbo Pascal 7.1) exhibit strange responses to the keyboard. Cursor keys are registered twice, so each press of a cursor key causes the cursor to move twice. Also the other keys occasionally are missed or duplicated. + +From an internet search, the problem appears to be this. These programs read the PS2 input register multiple times per incoming byte, on the assumption that the byte will remain there for at least a few hundred microseconds, before the next byte (if any) appears there. qemu treats a read of the register by the guest as an acknowledgement of the incoming byte and puts the next byte into the register immediately, thus breaking the programs that expect each successive byte to stay in place for a while. + +The obvious solution is to use a timer to advance through the queued bytes. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1896298 b/results/classifier/mode-deepseek-r1:32b/output/system/1896298 new file mode 100644 index 00000000..e3e8a307 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1896298 @@ -0,0 +1,21 @@ + + +TCG memory leak with FreeDOS 'edit' + +qemu trunk as of today leaks memory FAST when freedos' edit is running. + +To reproduce, download: + +https://www.ibiblio.org/pub/micro/pc-stuff/freedos/files/repositories/1.3/cdrom.iso + +Then run: + +$ qemu-system-i386 -cdrom cdrom.iso + +select your language then select "return to DOS", then type + +> edit + +it will consume memory at ~10MB/s + +This does NOT happen when adding -enable-kvm \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1897680 b/results/classifier/mode-deepseek-r1:32b/output/system/1897680 new file mode 100644 index 00000000..52efbd4a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1897680 @@ -0,0 +1,16 @@ + + +memory address over 0x2000_7ffc is not accessible in mps2-an505 + +I currently run qemu with the following options +`qemu-system-aarch64 -machine mps2-an505 -cpu cortex-m33 -m 16` + +For some reason, memory address over 0x2000_7ffc is not accessible. +It can be tested in gdb as follow. + +(gdb) x/x 0x20007ffc +0x20007ffc: 0x00000000 +(gdb) x/x 0x20007ffd +0x20007ffd: Cannot access memory at address 0x20007ffd +(gdb) x/x 0x20008000 +0x20008000: Cannot access memory at address 0x20008000 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1898011 b/results/classifier/mode-deepseek-r1:32b/output/system/1898011 new file mode 100644 index 00000000..1c9fc4b4 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1898011 @@ -0,0 +1,32 @@ + + +mmap MAP_NORESERVE of 2^42 bytes consumes 16Gb of actual RAM + +Run this program: + +#include <sys/mman.h> +#include <stdio.h> +int main() { + for (int i = 30; i <= 44; i++) { + fprintf(stderr, "trying 2**%d\n", i); + mmap((void*)0x600000000000,1ULL << i, + PROT_NONE, + MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED|MAP_NORESERVE,-1,0); + } +} + +(tried qemu-x86_64 and qemu-aarch64, 4.2.1 and trunk/5.1.50) + +On each iteration qemu will consume 2x more physical RAM, +e.g. when mapping 2^42 it will have RSS of 16Gb. + +On normal linux it works w/o consuming much RAM, due to MAP_NORESERVE. + +Also: qemu -strace prints 0 instead of the correct size starting from size=2^32 +and prints -2147483648 for size=2^31. + +mmap(0x0000600000000000,1073741824,PROT_NONE,MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED|MAP_NORESERVE,-1,0) = 0x0000600000000000 + +mmap(0x0000600000000000,-2147483648,PROT_NONE,MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED|MAP_NORESERVE,-1,0) = 0x0000600000000000 + +mmap(0x0000600000000000,0,PROT_NONE,MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED|MAP_NORESERVE,-1,0) = 0x0000600000000000 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1899728 b/results/classifier/mode-deepseek-r1:32b/output/system/1899728 new file mode 100644 index 00000000..c1551b7f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1899728 @@ -0,0 +1,22 @@ + + +Qemu-5.1.0 build from source man entry not found + +Hello together, + +i build qemu-5.1.0 from source on centos 8 withe the following command: + +../configure --prefix=/usr --target-list=x86_64-softmmu,x86_64-linux-user + +make -j4 + +make install + +The build and the installation finished successfully. But when i try the command + +man qemu-system-x86_64 + +i got the message "No manual entry found". What i do wrong ? + +Best regards +Damian \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/190 b/results/classifier/mode-deepseek-r1:32b/output/system/190 new file mode 100644 index 00000000..3db702d3 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/190 @@ -0,0 +1,3 @@ + + +'set_link net0 off' not working with e1000e driver diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1900122 b/results/classifier/mode-deepseek-r1:32b/output/system/1900122 new file mode 100644 index 00000000..540e3319 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1900122 @@ -0,0 +1,112 @@ + + +Unsupported ioctl: cmd=0xffffffff80685600 when accessing /dev/video* in aarch64 guest + +**Description:** +Any attempt to work with video in aarch64 architecture emulated on x86_64 leads currently to the error "Function not implemented". For example: + +``` +# v4l2-ctl -l --verbose +Failed to open /dev/video0: Function not implemented + +root@12dd9b6fcfcb:/# ll /dev/video* +crw-rw---- 1 root video 81, 0 Oct 16 09:23 /dev/video0 +crw-rw---- 1 root video 81, 1 Oct 16 09:23 /dev/video1 + +``` + +**Steps to reproduce the issue:** + +I have a following setup: + +Host Hardware: x86_64 equipped with a webcam (tried different webcams) +Host OS: Ubuntu 20.04.1 + +Guest Architecture: aarch64 +Guest OS: Ubuntu 20.04 (also tried 16.x and 18.x) + +Emulation: quemu-user-static (also tried binfmt) + +Guest OS is running via Docker + QEMU + +``` +➜ cat /proc/sys/fs/binfmt_misc/qemu-aarch64 +enabled +interpreter /usr/bin/qemu-aarch64-static +flags: F +offset 0 +magic 7f454c460201010000000000000000000200b700 +mask ffffffffffffff00fffffffffffffffffeffffff +``` + +**Results received:** +see desrciption. + +**Environment:** + +<!-- The host architecture is available for only x86_64 --> +* QEMU version: (if you can know it): + +ipxe-qemu-256k-compat-efi-roms/focal,now 1.0.0+git-20150424.a25a16d-0ubuntu4 all [installed,automatic] +ipxe-qemu/focal-updates,now 1.0.0+git-20190109.133f4c4-0ubuntu3.2 all [installed,automatic] +qemu-block-extra/focal-updates,now 1:4.2-3ubuntu6.7 amd64 [installed,automatic] +qemu-kvm/focal-updates,now 1:4.2-3ubuntu6.7 amd64 [installed] +qemu-system-common/focal-updates,now 1:4.2-3ubuntu6.7 amd64 [installed,automatic] +qemu-system-data/focal-updates,now 1:4.2-3ubuntu6.7 all [installed,automatic] +qemu-system-gui/focal-updates,now 1:4.2-3ubuntu6.7 amd64 [installed,automatic] +qemu-system-x86/focal-updates,now 1:4.2-3ubuntu6.7 amd64 [installed,automatic] +qemu-user-binfmt/focal-updates,now 1:4.2-3ubuntu6.7 amd64 [installed,automatic] +qemu-user/focal-updates,now 1:4.2-3ubuntu6.7 amd64 [installed] +qemu-utils/focal-updates,now 1:4.2-3ubuntu6.7 amd64 [installed,automatic] +qemu/focal-updates,now 1:4.2-3ubuntu6.7 amd64 [installed] + +* Container application: Docker + +**Output of `docker version`, `podman version` or `singularity version`** + +``` +➜ docker version +Client: Docker Engine - Community + Version: 20.10.0-beta1 + API version: 1.40 + Go version: go1.13.15 + Git commit: ac365d7 + Built: Tue Oct 13 18:15:22 2020 + OS/Arch: linux/amd64 + Context: default + Experimental: true + +Server: Docker Engine - Community + Engine: + Version: 19.03.13 + API version: 1.40 (minimum version 1.12) + Go version: go1.13.15 + Git commit: 4484c46d9d + Built: Wed Sep 16 17:01:20 2020 + OS/Arch: linux/amd64 + Experimental: false + containerd: + Version: 1.4.1 + GitCommit: c623d1b36f09f8ef6536a057bd658b3aa8632828 + runc: + Version: 1.0.0-rc92 + GitCommit: ff819c7e9184c13b7c2607fe6c30ae19403a7aff + docker-init: + Version: 0.18.0 + GitCommit: fec3683 + +``` + +Guest aarch64 runs in privileged mode: + +`docker run --privileged --device=/dev/video0:/dev/video0 --env DISPLAY=unix$DISPLAY -v $XAUTH:/root/.Xauthority -v /tmp/.X11-unix:/tmp/.X11-unix -it --rm arm64v8/ubuntu:20.04 bash` + +**Additional information:** +I tried also binfmt way to register emulators. The output of `v4l-ctl` was a little bit different: + +``` +# v4l2-ctl -l +Unsupported ioctl: cmd=0xffffffff80685600 +Failed to open /dev/video0: Function not implemented + +``` \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1902112 b/results/classifier/mode-deepseek-r1:32b/output/system/1902112 new file mode 100644 index 00000000..45bbbcba --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1902112 @@ -0,0 +1,45 @@ + + +[OSS-Fuzz] Issue 26693: qemu:qemu-fuzz-i386-target-generic-fuzz-xhci: Index-out-of-bounds in xhci_runtime_write + +OSS-Fuzz Report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26693 + +=== Reproducer (build with --enable-sanitizers) === +export UBSAN_OPTIONS="print_stacktrace=1:silence_unsigned_overflow=1" +cat << EOF | ./qemu-system-i386 -display none -machine\ + accel=qtest, -m 512M -machine q35 -nodefaults -drive\ + file=null-co://,if=none,format=raw,id=disk0 -device\ + qemu-xhci,id=xhci -device usb-tablet,bus=xhci.0\ + -device usb-bot -device usb-storage,drive=disk0\ + -chardev null,id=cd0 -chardev null,id=cd1 -device\ + usb-braille,chardev=cd0 -device usb-ccid -device\ + usb-ccid -device usb-kbd -device usb-mouse -device\ + usb-serial,chardev=cd1 -device usb-tablet -device\ + usb-wacom-tablet -device usb-audio -qtest stdio +outl 0xcf8 0x80000803 +outl 0xcfc 0x18caffff +outl 0xcf8 0x80000810 +outl 0xcfc 0x555a2e46 +write 0x555a1004 0x4 0xe7b9aa7a +EOF + +=== Stack Trace === + +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../hw/usb/hcd-xhci.c:3012:30 in +../hw/usb/hcd-xhci.c:3012:30: runtime error: index -1 out of bounds for type 'XHCIInterrupter [16]' +#0 0x55bd2e97c8b0 in xhci_runtime_write /src/qemu/hw/usb/hcd-xhci.c:3012:30 +#1 0x55bd2edfdd13 in memory_region_write_accessor /src/qemu/softmmu/memory.c:484:5 +#2 0x55bd2edfdb14 in access_with_adjusted_size /src/qemu/softmmu/memory.c:545:18 +#3 0x55bd2edfd54b in memory_region_dispatch_write /src/qemu/softmmu/memory.c:0:13 +#4 0x55bd2ed7fa46 in flatview_write_continue /src/qemu/softmmu/physmem.c:2767:23 +#5 0x55bd2ed7cac0 in flatview_write /src/qemu/softmmu/physmem.c:2807:14 +#6 0x55bd2ed7c9f8 in address_space_write /src/qemu/softmmu/physmem.c:2899:18 +#7 0x55bd2e85cf9b in __wrap_qtest_writeq /src/qemu/tests/qtest/fuzz/qtest_wrappers.c:187:9 +#8 0x55bd2e85b7b1 in op_write /src/qemu/tests/qtest/fuzz/generic_fuzz.c:476:13 +#9 0x55bd2e85a84c in generic_fuzz /src/qemu/tests/qtest/fuzz/generic_fuzz.c:678:17 +#10 0x55bd2e85dd6f in LLVMFuzzerTestOneInput /src/qemu/tests/qtest/fuzz/fuzz.c:150:5 +#11 0x55bd2e7e9661 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:595:15 +#12 0x55bd2e7d4732 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 +#13 0x55bd2e7da7ee in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:852:9 +#14 0x55bd2e8027d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 +#15 0x7f3d153b783f in __libc_start_main \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1902267 b/results/classifier/mode-deepseek-r1:32b/output/system/1902267 new file mode 100644 index 00000000..553c3982 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1902267 @@ -0,0 +1,33 @@ + + +CPU not support 32-bit stack in 32-bit unreal mode + +QEMU version 5.0.0 supports 32-bit and 16-bit unreal mode. Great! +Unfortunately, QEMU does not support 32-bit stack in unreal 32-bit mode. +After the INT instruction, the stack is switched to 16-bit, which should not be the case. +At BOCHS, my code works 100%. At QEMU not works. + +Sample code to find out: + +use32 +cli +mov ax,cs +shl eax,16 +mov ax,NewInt80h +mov [IDT32+4*80h],eax +mov edx,esp +mov esp,0x10000 +int 80h +NewInt80h: +xchg esp,edx +cmp edx,0x10000-6 +jnz IsStack16Bit + +Stack selector loaded from GDT: +GDT: +real32_GDT +dq 0 +dw 0xFFFF,0x0000,9A00h,0xCF ; 32-bit code descriptor +dw 0xFFFF,0x0000,9200h,0x8F ; 4 GB data descriptor +dw 0xFFFF,0x0000,9A00h,0x00 ; 16-bit code descriptor +dw 0xFFFF,0x0000,9200h,0xCF ; 32-bit data descriptor stack \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1902306 b/results/classifier/mode-deepseek-r1:32b/output/system/1902306 new file mode 100644 index 00000000..d4c00c67 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1902306 @@ -0,0 +1,12 @@ + + +Allow setting usb storage device ID parameters + +Some stubborn software requires certain VID/PID/Serial to authenticate and refuses to start in emulation. This poses a problem with unsupported programs which often require keeping an ancient hardware praying that the USB stick will not die before the (often defunct) company making it. + +Virtualizing such environment is desired. However, QEMU doesn't allow setting VID/PID/Serial/Name of emulated USB devices, but instead uses hardcoded values: https://github.com/qemu/qemu/blob/c99fa56b95a72f6debd50a280561895d078ae020/hw/usb/dev-storage.c#L95 + +This request (including a patch) was already made in 2015 on the list but never got any response: https://lists.nongnu.org/archive/html/qemu-discuss/2015-07/msg00072.html + + +WDYT of adding such functionality? \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1902612 b/results/classifier/mode-deepseek-r1:32b/output/system/1902612 new file mode 100644 index 00000000..c556c6ab --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1902612 @@ -0,0 +1,47 @@ + + +assert issue locates in xhci_kick_epctx() in hw/usb/hcd-xhci.c + +Hello, + +I found an assertion failure through hw/usb/hcd-xhci.c. + +This was found in latest version 5.1.0. + +An assertion-failure flaw was found in xhci_kick_epctx() in hw/usb/hcd-xhci.c . XHCI slot's endpoint context is enabled in xhci_configure_slot(), whose ep_ctx structure is controlled by user. With uninitialized endPoint context could trigger assert(ring->dequeue != 0). The guest system could use this flaw to crash the qemu resulting in denial of service. + +To reproduce the assertion failure, please run the QEMU with following command line. + +$ qemu-system-x86_64 -enable-kvm -boot c -m 2G -drive format=qcow2,file=./ubuntu.img -nic user,model=rtl8139,hostfwd=tcp:0.0.0.0:5555-:22 -device nec-usb-xhci,id=xhci -device usb-tablet,bus=xhci.0,port=1,id=usbdev1 + +The poc is attached. + +Backtrace is as follows: +#0 0x00007f6dfd4c4f47 in __GI_raise (sig=sig@entry=0x6) at ../sysdeps/unix/sysv/linux/raise.c:51 +#1 0x00007f6dfd4c68b1 in __GI_abort () at abort.c:79 +#2 0x00007f6dfd4b642a in __assert_fail_base (fmt=0x7f6dfd63da38 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x55e9b9d38a64 "ring->dequeue != 0", file=file@entry=0x55e9b9d388c0 "hw/usb/hcd-xhci.c", line=line@entry=0x7a3, function=function@entry=0x55e9b9d3a5c0 <__PRETTY_FUNCTION__.29754> "xhci_kick_epctx") at assert.c:92 +#3 0x00007f6dfd4b64a2 in __GI___assert_fail (assertion=assertion@entry=0x55e9b9d38a64 "ring->dequeue != 0", file=file@entry=0x55e9b9d388c0 "hw/usb/hcd-xhci.c", line=line@entry=0x7a3, function=function@entry=0x55e9b9d3a5c0 <__PRETTY_FUNCTION__.29754> "xhci_kick_epctx") at assert.c:101 +#4 0x000055e9b9a3292f in xhci_kick_epctx (epctx=0x7f6da836b510, streamid=streamid@entry=0x0) at hw/usb/hcd-xhci.c:1955 +#5 0x000055e9b9a3c64b in xhci_kick_ep (streamid=0x0, epid=0x1, slotid=0x11, xhci=0x7f6df8b38010) at hw/usb/hcd-xhci.c:1861 +#6 0x000055e9b9a3c64b in xhci_doorbell_write (ptr=0x7f6df8b38010, reg=0x11, val=0x1, size=<optimized out>) at hw/usb/hcd-xhci.c:3162 +#7 0x000055e9b977d274 in memory_region_write_accessor (mr=0x7f6df8b38d80, addr=0x44, value=<optimized out>, size=0x1, shift=<optimized out>, mask=<optimized out>, attrs=...) at /home/zjusvn/qemu5-hypervisor/qemu-5.0.0/memory.c:483 +#8 0x000055e9b977ad86 in access_with_adjusted_size (addr=addr@entry=0x44, value=value@entry=0x7f6dfb915f88, size=size@entry=0x1, access_size_min=<optimized out>, access_size_max=<optimized out>, access_fn=0x55e9b977d1f0 <memory_region_write_accessor>, mr=0x7f6df8b38d80, attrs=...) at /home/zjusvn/qemu5-hypervisor/qemu-5.0.0/memory.c:544 +#9 0x000055e9b977f4c8 in memory_region_dispatch_write (mr=mr@entry=0x7f6df8b38d80, addr=0x44, data=<optimized out>, op=<optimized out>, attrs=attrs@entry=...) at /home/zjusvn/qemu5-hypervisor/qemu-5.0.0/memory.c:1483 +#10 0x000055e9b972c691 in flatview_write_continue (fv=fv@entry=0x7f6da951f750, addr=addr@entry=0xfebf2044, attrs=..., ptr=ptr@entry=0x7f6dfb9160e0, len=len@entry=0x1, addr1=<optimized out>, l=<optimized out>, mr=0x7f6df8b38d80) at /home/zjusvn/qemu5-hypervisor/qemu-5.0.0/exec.c:3137 +#11 0x000055e9b972c826 in flatview_write (fv=0x7f6da951f750, addr=0xfebf2044, attrs=..., buf=buf@entry=0x7f6dfb9160e0, len=0x1) at /home/zjusvn/qemu5-hypervisor/qemu-5.0.0/exec.c:3177 +#12 0x000055e9b972c89a in subpage_write (opaque=<optimized out>, addr=<optimized out>, value=<optimized out>, len=<optimized out>, attrs=...) at /home/zjusvn/qemu5-hypervisor/qemu-5.0.0/exec.c:2789 +#13 0x000055e9b977b269 in memory_region_write_with_attrs_accessor (mr=0x7f6da9534650, addr=0x44, value=<optimized out>, size=0x1, shift=<optimized out>, mask=<optimized out>, attrs=...) at /home/zjusvn/qemu5-hypervisor/qemu-5.0.0/memory.c:503 +#14 0x000055e9b977ad86 in access_with_adjusted_size (addr=addr@entry=0x44, value=value@entry=0x7f6dfb9161f8, size=size@entry=0x1, access_size_min=<optimized out>, access_size_max=<optimized out>, access_fn=0x55e9b977b1e0 <memory_region_write_with_attrs_accessor>, mr=0x7f6da9534650, attrs=...) at /home/zjusvn/qemu5-hypervisor/qemu-5.0.0/memory.c:544 +#15 0x000055e9b977f4c8 in memory_region_dispatch_write (mr=0x7f6da9534650, addr=addr@entry=0x44, data=<optimized out>, data@entry=0x1, op=op@entry=MO_8, attrs=...) at /home/zjusvn/qemu5-hypervisor/qemu-5.0.0/memory.c:1483 +#16 0x000055e9b979021f in io_writex (env=env@entry=0x55e9baed5b50, iotlbentry=iotlbentry@entry=0x7f6da8b8bc10, mmu_idx=mmu_idx@entry=0x1, val=val@entry=0x1, addr=addr@entry=0x7fbba0601044, retaddr=retaddr@entry=0x7f6db9d90d48, op=MO_8) at /home/zjusvn/qemu5-hypervisor/qemu-5.0.0/accel/tcg/cputlb.c:1084 +#17 0x000055e9b9794c42 in store_helper (op=MO_8, retaddr=0x7f6db9d90d48, oi=<optimized out>, val=<optimized out>, addr=0x7fbba0601044, env=0x55e9baed5b50) at /home/zjusvn/qemu5-hypervisor/qemu-5.0.0/accel/tcg/cputlb.c:1954 +#18 0x000055e9b9794c42 in helper_ret_stb_mmu (env=0x55e9baed5b50, addr=0x7fbba0601044, val=0x1, oi=<optimized out>, retaddr=0x7f6db9d90d48) at /home/zjusvn/qemu5-hypervisor/qemu-5.0.0/accel/tcg/cputlb.c:2056 +#19 0x00007f6db9d90d48 in code_gen_buffer () +#20 0x000055e9b97a5217 in cpu_tb_exec (itb=<optimized out>, cpu=0x7f6db9d240c0 <code_gen_buffer+97665171>) at /home/zjusvn/qemu5-hypervisor/qemu-5.0.0/accel/tcg/cpu-exec.c:172 +#21 0x000055e9b97a5217 in cpu_loop_exec_tb (tb_exit=<synthetic pointer>, last_tb=<synthetic pointer>, tb=<optimized out>, cpu=0x7f6db9d240c0 <code_gen_buffer+97665171>) at /home/zjusvn/qemu5-hypervisor/qemu-5.0.0/accel/tcg/cpu-exec.c:619 +#22 0x000055e9b97a5217 in cpu_exec (cpu=cpu@entry=0x55e9baecd2f0) at /home/zjusvn/qemu5-hypervisor/qemu-5.0.0/accel/tcg/cpu-exec.c:732 +#23 0x000055e9b976ff9f in tcg_cpu_exec (cpu=0x55e9baecd2f0) at /home/zjusvn/qemu5-hypervisor/qemu-5.0.0/cpus.c:1405 +#24 0x000055e9b97723cb in qemu_tcg_cpu_thread_fn (arg=arg@entry=0x55e9baecd2f0) at /home/zjusvn/qemu5-hypervisor/qemu-5.0.0/cpus.c:1713 +#25 0x000055e9b9be7d66 in qemu_thread_start (args=<optimized out>) at util/qemu-thread-posix.c:519 +#26 0x00007f6dfd87e6db in start_thread (arg=0x7f6dfb917700) at pthread_create.c:463 +#27 0x00007f6dfd5a7a3f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1904 b/results/classifier/mode-deepseek-r1:32b/output/system/1904 new file mode 100644 index 00000000..0512ce61 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1904 @@ -0,0 +1,18 @@ + + +Windows LTO build fails +Description of problem: +LTO likes to delete `win32_close_exception_handler` which causes an error when linking +``` +[2736/5786] Linking target qemu-system-avr.exe +FAILED: qemu-system-avr.exe +"cc" "-m64" "-mcx16" @qemu-system-avr.exe.rsp +`win32_close_exception_handler' referenced in section `.xdata' of C:\msys64\tmp\cceRwR4N.ltrans59.ltrans.o: defined in discarded section `.text' of libqemuutil.a.p/util_oslib-win32.c.obj (symbol from plugin) +collect2.exe: error: ld returned 1 exit status +``` +Steps to reproduce: +1. `./configure --enable-lto` +2. `make` +Additional information: +Looks like the offending commit is d89f30b4df13dfe389a4d6cf8a30b2f87c4c166e "win32: wrap socket close() with an exception handler". +Undoing the commit or marking the exception handler as `__attribute__ ((noinline, used))` both appear to fix the issue. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1904464 b/results/classifier/mode-deepseek-r1:32b/output/system/1904464 new file mode 100644 index 00000000..c76803c5 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1904464 @@ -0,0 +1,19 @@ + + +Build fails with 64 bits time_t + +time element is deprecated on new input_event structure in kernel's +input.h [1] + +This will avoid the following build failure: + +hw/input/virtio-input-host.c: In function 'virtio_input_host_handle_status': +hw/input/virtio-input-host.c:198:28: error: 'struct input_event' has no member named 'time' + 198 | if (gettimeofday(&evdev.time, NULL)) { + | ^ + +Fixes: + - http://autobuild.buildroot.org/results/a538167e288c14208d557cd45446df86d3d599d5 + - http://autobuild.buildroot.org/results/efd4474fb4b6c0ce0ab3838ce130429c51e43bbb + +[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=152194fe9c3f \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1905226 b/results/classifier/mode-deepseek-r1:32b/output/system/1905226 new file mode 100644 index 00000000..a5683752 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1905226 @@ -0,0 +1,17 @@ + + +intel-hda: stream reset bits are broken + +From HD audio spec, section 3.3.35: + +"Stream Reset (SRST): Writing a 1 causes the corresponding stream to be reset. [...] After the stream hardware has completed sequencing into the reset state, it will report a 1 in this bit. Software must read a 1 from this bit to verify that the stream is in reset. Writing a 0 causes the corresponding stream to exit reset. When the stream hardware is ready to begin operation, it will report a 0 in this bit. Software must read a 0 from this bit before accessing any of the stream registers." + +So to reset a stream I set the bit, but it never reads back as 1 so the driver either times out or will hang forever waiting for it to become 1. I looked into why this happens and found that as of the latest version (8110fa1), in function intel_hda_set_st_ctl() of the https://github.com/qemu/qemu/blob/master/hw/audio/intel-hda.c, + + if (st->ctl & 0x01) { + /* reset */ + dprint(d, 1, "st #%d: reset\n", reg->stream); + st->ctl = SD_STS_FIFO_READY << 24; + } + +This causes the bit to immediately become set to 0 even if I write a 1, and clearly does not meet the spec. I checked behaviour of real hardware and it works as expected, i.e. I see the bit will become 1 and 0 when I write to it. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1905444 b/results/classifier/mode-deepseek-r1:32b/output/system/1905444 new file mode 100644 index 00000000..ec162643 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1905444 @@ -0,0 +1,48 @@ + + +[OSS-Fuzz] Issue 27796 in oss-fuzz: qemu:qemu-fuzz-i386-target-generic-fuzz-xhci: Stack-overflow in address_space_stl_internal + + affects qemu + +OSS-Fuzz Report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27796 + +=== Reproducer (build with --enable-sanitizers) === +cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, \ +-m 512M -machine q35 -nodefaults \ +-drive file=null-co://,if=none,format=raw,id=disk0 \ +-device qemu-xhci,id=xhci -device usb-tablet,bus=xhci.0 \ +-qtest-log none -qtest stdio +outl 0xcf8 0x80000803 +outw 0xcfc 0x5e46 +outl 0xcf8 0x80000810 +outl 0xcfc 0xff5a5e46 +write 0xff5a5020 0x6 0xffffffff0b70 +outl 0xcf8 0x80000893 +outb 0xcfc 0x93 +writel 0xff5a7000 0xff5a5020 +write 0xff5a700c 0x4 0x0c0c2e58 +write 0xff5a4040 0x4 0x00d26001 +write 0xff5a4044 0x4 0x0000030 +EOF + +=== Stack Trace === +==50473==ERROR: AddressSanitizer: stack-overflow on address 0x7ffe3ec97e28 (pc 0x55e292eac159 bp 0x7ffe3ec98670 sp 0x7ffe3ec97e30 T0) +#0 0x55e292eac159 in __asan_memcpy (u-system-i386+0x2a0e159) +#1 0x55e2944bc04e in flatview_do_translate softmmu/physmem.c:513:12 +#2 0x55e2944dbe90 in flatview_translate softmmu/physmem.c:563:15 +#3 0x55e2944dbe90 in address_space_translate include/exec/memory.h:2362:12 +#4 0x55e2944dbe90 in address_space_stl_internal memory_ldst.c.inc:316:10 +#5 0x55e29393d2a0 in xhci_intr_update hw/usb/hcd-xhci.c:554:13 +#6 0x55e29393efb9 in xhci_runtime_write hw/usb/hcd-xhci.c:3032:9 +#7 0x55e294230428 in memory_region_write_accessor softmmu/memory.c:484:5 +#8 0x55e29422fe63 in access_with_adjusted_size softmmu/memory.c:545:18 +#9 0x55e29422f6fc in memory_region_dispatch_write softmmu/memory.c +#10 0x55e2944dc03c in address_space_stl_internal memory_ldst.c.inc:319:13 +#11 0x55e29393d2a0 in xhci_intr_update hw/usb/hcd-xhci.c:554:13 +#12 0x55e29393efb9 in xhci_runtime_write hw/usb/hcd-xhci.c:3032:9 +#13 0x55e294230428 in memory_region_write_accessor softmmu/memory.c:484:5 +#14 0x55e29422fe63 in access_with_adjusted_size softmmu/memory.c:545:18 +#15 0x55e29422f6fc in memory_region_dispatch_write softmmu/memory.c +#16 0x55e2944dc03c in address_space_stl_internal memory_ldst.c.inc:319:13 +#17 0x55e29393d2a0 in xhci_intr_update hw/usb/hcd-xhci.c:554:13 +#18 0x55e29393efb9 in xhci_runtime_write hw/usb/hcd-xhci.c:3032:9 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1906 b/results/classifier/mode-deepseek-r1:32b/output/system/1906 new file mode 100644 index 00000000..cc6a5b7b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1906 @@ -0,0 +1,36 @@ + + +Failed to compile QEMU 7.0.0 source code. recipe for target 'run-ninja' failed. +Description of problem: +Failed to compiling the download QEMU 7.0.0 source code. It seems to be due to something wrong with ninja. +The followings are error logs after executing command "make -j$(nproc)": + +changing dir to build for make ""... +make[1]: Entering directory '/home/liangke/os-env/qemu-7.0.0/build' +/usr/bin/ninja build.ninja && touch build.ninja.stamp +**ninja: no work to do.** +... +... +... +[1350/2396] Compiling C object libqemu-riscv64-softmmu.fa.p/target_riscv_translate.c.o +**FAILED: libqemu-riscv64-softmmu.fa.p/target_riscv_translate.c.o** +cc -m64 -mcx16 -Ilibqemu-riscv64-softmmu.fa.p -I. -I.. -Itarget/riscv -I../target/riscv -I../dtc/libfdt -I../capstone/include/capstone -Iqapi -Itrace -Iui -Iui/shader -I/usr/include/pixman-1 -I/usr/include/glib-2.0 -I/usr/lib/x86_64-linux-gnu/glib-2.0/include -fdiagnostics-color=auto -Wall -Winvalid-pch -std=gnu11 -O2 -g -isystem /home/liangke/os-env/qemu-7.0.0/linux-headers -isystem linux-headers -iquote . -iquote /home/liangke/os-env/qemu-7.0.0 -iquote /home/liangke/os-env/qemu-7.0.0/include -iquote /home/liangke/os-env/qemu-7.0.0/disas/libvixl -iquote /home/liangke/os-env/qemu-7.0.0/tcg/i386 -pthread -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -fno-common -fwrapv -Wold-style-declaration -Wold-style-definition -Wtype-limits -Wformat-security -Wformat-y2k -Winit-self -Wignored-qualifiers -Wempty-body -Wnested-externs -Wendif-labels -Wexpansion-to-defined -Wimplicit-fallthrough=2 -Wno-missing-include-dirs -Wno-shift-negative-value -Wno-psabi -fstack-protector-strong -fPIE -isystem../linux-headers -isystemlinux-headers -DNEED_CPU_H '-DCONFIG_TARGET="riscv64-softmmu-config-target.h"' '-DCONFIG_DEVICES="riscv64-softmmu-config-devices.h"' -MD -MQ libqemu-riscv64-softmmu.fa.p/target_riscv_translate.c.o -MF libqemu-riscv64-softmmu.fa.p/target_riscv_translate.c.o.d -o libqemu-riscv64-softmmu.fa.p/target_riscv_translate.c.o -c ../target/riscv/translate.c +**cc: fatal error: Killed signal terminated program cc1** +**compilation terminated.** +**ninja: build stopped: subcommand failed.** +**Makefile:163: recipe for target 'run-ninja' failed** +**make[1]: *** [run-ninja] Error 1** +make[1]: Leaving directory '/home/liangke/os-env/qemu-7.0.0/build' +**GNUmakefile:10: recipe for target 'all' failed** +**make: *** [all] Error 2** +Steps to reproduce: +1. cd qemu-7.0.0 source code folder; +2. ./configure --target-list=riscv64-softmmu,riscv64-linux-user; +3. make -j$(nproc) +Additional information: +1. I downloaded the source code from https://download.qemu.org/qemu-7.0.0.tar.xz. +2. my compiling prerequisites: +sudo apt install autoconf automake autotools-dev curl libmpc-dev libmpfr-dev libgmp-dev \ + gawk build-essential bison flex texinfo gperf libtool patchutils bc ninja-build \ + zlib1g-dev libexpat-dev pkg-config libglib2.0-dev libpixman-1-dev git tmux python3 +3. Found ninja-1.8.2 at /usr/bin/ninja diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1906516 b/results/classifier/mode-deepseek-r1:32b/output/system/1906516 new file mode 100644 index 00000000..92aff13e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1906516 @@ -0,0 +1,93 @@ + + +[RISCV] sfence.vma need to end the translation block + +QEMU emulator version 5.0.0 + +sfence.vma will flush the tlb, so after this instruction, the translation block should be end. The following code will only work in single step mode: +``` +relocate: + li a0, OFFSET + + la t0, 1f + add t0, t0, a0 + csrw stvec, t0 + + la t0, early_pgtbl + srl t0, t0, PAGE_SHIFT + li t1, SATP_SV39 + or t0, t1, t0 + + csrw satp, t0 +1: + sfence.vma + la t0, trap_s + csrw stvec, t0 + ret +``` + +In this code, I want to relocate pc to virtual address with the OFFSET prefix, before writing to satp, pc run at physic address, stvec has been set a label 1 with a virtual prefix and virtual address has been mapping in early_pgtbl, after writing satp, there will throw a page fault, and pc will set to virtual address of label 1. + +The problem is that, in this situation, the translation block will not end after sfence.vma, and stvec will be set to trap_s, + +``` +---------------- +IN: +Priv: 1; Virt: 0 +0x00000000800000dc: 00a080b3 add ra,ra,a0 +0x00000000800000e0: 00007297 auipc t0,28672 # 0x800070e0 +0x00000000800000e4: f2028293 addi t0,t0,-224 +0x00000000800000e8: 00c2d293 srli t0,t0,12 +0x00000000800000ec: fff0031b addiw t1,zero,-1 +0x00000000800000f0: 03f31313 slli t1,t1,63 +0x00000000800000f4: 005362b3 or t0,t1,t0 +0x00000000800000f8: 18029073 csrrw zero,satp,t0 + +---------------- +IN: +Priv: 1; Virt: 0 +0x00000000800000fc: 12000073 sfence.vma zero,zero +0x0000000080000100: 00000297 auipc t0,0 # 0x80000100 +0x0000000080000104: 1c828293 addi t0,t0,456 +0x0000000080000108: 10529073 csrrw zero,stvec,t0 + +riscv_raise_exception: 12 +riscv_raise_exception: 12 +riscv_raise_exception: 12 +riscv_raise_exception: 12 +... +``` + +So, the program will crash, and the program will work in single step mode: +``` +---------------- +IN: +Priv: 1; Virt: 0 +0x00000000800000f8: 18029073 csrrw zero,satp,t0 + +---------------- +IN: +Priv: 1; Virt: 0 +0x00000000800000fc: 12000073 sfence.vma zero,zero + +riscv_raise_exception: 12 +---------------- +IN: +Priv: 1; Virt: 0 +0xffffffff800000fc: 12000073 sfence.vma zero,zero + +---------------- +IN: +Priv: 1; Virt: 0 +0xffffffff80000100: 00000297 auipc t0,0 # 0xffffffff80000100 + +``` +The pc will set to label 1, instead of trap_s. + +I try to patch the code in fence.i in trans_rvi.inc.c to sfence.vma: +``` + tcg_gen_movi_tl(cpu_pc, ctx->pc_succ_insn); + exit_tb(ctx); + ctx->base.is_jmp = DISAS_NORETURN; +``` +This codes can help to end the tranlate block, since I'm not a qemu guy, I'm not sure if this is a corret method. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1907 b/results/classifier/mode-deepseek-r1:32b/output/system/1907 new file mode 100644 index 00000000..7f6684a5 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1907 @@ -0,0 +1,59 @@ + + +QEMU LoongArch regression after merging LASX changes +Description of problem: +After enabling LASX in qemu (@gaosong), booting Gentoo Linux with latest glibc master (w/ LSX & LASX optimized libc routines) will fail in systemd: + +``` +[ 10.350207] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000085 +[ 10.350557] CPU: 5 PID: 1 Comm: systemd Not tainted 6.5.2-gentoo #2 +[ 10.350655] Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015 +[ 10.350961] Stack : 0072617764726148 0000000000000000 9000000000223440 90000001000e4000 +[ 10.351181] 90000001000e7990 90000001000e7998 0000000000000000 90000001000e7ad8 +[ 10.351294] 90000001000e7ad0 90000001000e7ad0 90000001000e7900 0000000000000001 +[ 10.351406] 0000000000000001 90000001000e7998 ec94a2e1446052e6 9000000100438140 +[ 10.351519] 0000000000000001 0000000000000003 0000000000000000 0000000000000030 +[ 10.351630] 0000000000000000 00000000000559bf 00000000056e0000 0000000000000004 +[ 10.351745] 0000000000000000 0000000000000000 900000000162b438 900000000177e000 +[ 10.351856] 00000000400004d8 0000000000000001 0000000000000018 90000001000e7c84 +[ 10.351968] 0000000000020000 0000000000000000 9000000000223458 00007ffff0341af0 +[ 10.352081] 00000000000000b0 0000000000000004 0000000000000000 0000000000071c1c +[ 10.352196] ... +[ 10.352277] Call Trace: +[ 10.352482] [<9000000000223458>] show_stack+0x5c/0x180 +[ 10.353518] [<9000000001178d4c>] dump_stack_lvl+0x60/0x88 +[ 10.353592] [<900000000115cd7c>] panic+0x13c/0x308 +[ 10.353670] [<900000000024244c>] do_exit+0x860/0x868 +[ 10.353735] [<900000000024261c>] do_group_exit+0x34/0x94 +[ 10.353803] [<9000000000250514>] get_signal+0x75c/0x804 +[ 10.353869] [<90000000002254c4>] arch_do_signal_or_restart+0x74/0xae0 +[ 10.353944] [<90000000002c738c>] exit_to_user_mode_loop.isra.0+0x90/0x10c +[ 10.354041] [<9000000001179ff0>] irqentry_exit_to_user_mode+0x1c/0x28 +[ 10.354119] [<90000000011792f8>] do_bp+0xcc/0x2ac +[ 10.354222] [<90000001005a1924>] 0x90000001005a1924 +[ 10.354522] [<00007ffff0341af0>] 0x7ffff0341af0 +``` + +Full log: + +[stderr](/uploads/61b9870ae2441c9a25f44791c67889b8/stderr) + +Instruction trace `-d in_asm,out_asm,op` (very large): + +[log.tar.zstd](https://cloud.tsinghua.edu.cn/f/a83eac6d44694ede8cb1/?dl=1) + +I also tried to boot LoongArchLinux whose glibc does not have LSX/LASX optimized C routines, and it can boot without problems. If I chroot from LoongArchLinux into Gentoo Linux, running `emerge` command will SIGSEGV. + +If I disable LASX in CPUCFG2, the problem is gone: + +```cpp +// data = FIELD_DP32(data, CPUCFG2, LASX, 1), +``` + +I guess the bug is related to LASX assemblies in [glibc](https://github.com/bminor/glibc/tree/master/sysdeps/loongarch/lp64/multiarch). +Steps to reproduce: +1. Launch qemu +2. Wait for systemd to be killed +3. Collect logs +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1907210 b/results/classifier/mode-deepseek-r1:32b/output/system/1907210 new file mode 100644 index 00000000..4e54fd3b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1907210 @@ -0,0 +1,20 @@ + + +QEMU gdbstub command "?" issue + +I am using some third party GDB client, and I have noticed that every time "?" command is send from the client, QEMU gdbstub removes all break points. This behaviour is not expected since "?" command should only return stop reason. +Here is documentation from official gdb: +‘?’ Indicate the reason the target halted. The reply is the same as for step and +continue. This packet has a special interpretation when the target is in non-stop +mode; see Section E.10 [Remote Non-Stop], page 733. +Reply: See Section E.3 [Stop Reply Packets], page 693, for the reply specifications. + +With some help on the irc, we have been able to pin point the failure point(in attachement file gdbstub.c). +Function that handles "?" command has this comment in it: + /* + * Remove all the breakpoints when this query is issued, + * because gdb is doing an initial connect and the state + * should be cleaned up. + */ +From which it is clear that developer that wrote that code assumed, that because most popular gdb client only uses "?" command at initial connect, it is safe to also remove all BPs. +In my opinion initial connect should be detected in some other way, and not with "?" command. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1907497 b/results/classifier/mode-deepseek-r1:32b/output/system/1907497 new file mode 100644 index 00000000..c136c821 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1907497 @@ -0,0 +1,60 @@ + + +[OSS-Fuzz] Issue 28435 qemu:qemu-fuzz-i386-target-generic-fuzz-intel-hda: Stack-overflow in ldl_le_dma + + affects qemu + +=== Reproducer (build with --enable-sanitizers) === + +cat << EOF | ./qemu-system-i386 -machine q35 -nodefaults \ +-device intel-hda,id=hda0 -device hda-output,bus=hda0.0 \ +-device hda-micro,bus=hda0.0 -device hda-duplex,bus=hda0.0 \ +-qtest stdio +outl 0xcf8 0x80000804 +outw 0xcfc 0xffff +write 0x0 0x1 0x12 +write 0x2 0x1 0x2f +outl 0xcf8 0x80000811 +outl 0xcfc 0x5a6a4406 +write 0x6a44005a 0x1 0x11 +write 0x6a44005c 0x1 0x3f +write 0x6a442050 0x4 0x0000446a +write 0x6a44204a 0x1 0xf3 +write 0x6a44204c 0x1 0xff +writeq 0x6a44005a 0x17b3f0011 +write 0x6a442050 0x4 0x0000446a +write 0x6a44204a 0x1 0xf3 +write 0x6a44204c 0x1 0xff +EOF + +=== Stack Trace === +==411958==ERROR: AddressSanitizer: stack-overflow on address 0x7ffcaeb8bc88 (pc 0x55c7c9dc1159 bp 0x7ffcaeb8c4d0 sp 0x7ffcaeb8bc90 T0) + #0 0x55c7c9dc1159 in __asan_memcpy (u-system-i386+0x2a13159) + #1 0x55c7cb2a457e in flatview_do_translate softmmu/physmem.c:513:12 + #2 0x55c7cb2bdab0 in flatview_translate softmmu/physmem.c:563:15 + #3 0x55c7cb2bdab0 in flatview_read softmmu/physmem.c:2861:10 + #4 0x55c7cb2bdab0 in address_space_read_full softmmu/physmem.c:2875:18 + #5 0x55c7caaec937 in dma_memory_rw_relaxed include/sysemu/dma.h:87:18 + #6 0x55c7caaec937 in dma_memory_rw include/sysemu/dma.h:110:12 + #7 0x55c7caaec937 in dma_memory_read include/sysemu/dma.h:116:12 + #8 0x55c7caaec937 in ldl_le_dma include/sysemu/dma.h:179:1 + #9 0x55c7caaec937 in ldl_le_pci_dma include/hw/pci/pci.h:816:1 + #10 0x55c7caaec937 in intel_hda_corb_run hw/audio/intel-hda.c:338:16 + #11 0x55c7cb2e7198 in memory_region_write_accessor softmmu/memory.c:491:5 + #12 0x55c7cb2e6bd3 in access_with_adjusted_size softmmu/memory.c:552:18 + #13 0x55c7cb2e646c in memory_region_dispatch_write softmmu/memory.c + #14 0x55c7cb2c8445 in flatview_write_continue softmmu/physmem.c:2759:23 + #15 0x55c7cb2bdfb8 in flatview_write softmmu/physmem.c:2799:14 + #16 0x55c7cb2bdfb8 in address_space_write softmmu/physmem.c:2891:18 + #17 0x55c7caae2c54 in dma_memory_rw_relaxed include/sysemu/dma.h:87:18 + #18 0x55c7caae2c54 in dma_memory_rw include/sysemu/dma.h:110:12 + #19 0x55c7caae2c54 in dma_memory_write include/sysemu/dma.h:122:12 + #20 0x55c7caae2c54 in stl_le_dma include/sysemu/dma.h:179:1 + #21 0x55c7caae2c54 in stl_le_pci_dma include/hw/pci/pci.h:816:1 + #22 0x55c7caae2c54 in intel_hda_response hw/audio/intel-hda.c:370:5 + #23 0x55c7caaeca00 in intel_hda_corb_run hw/audio/intel-hda.c:342:9 + #24 0x55c7cb2e7198 in memory_region_write_accessor softmmu/memory.c:491:5 +... + +OSS-Fuzz Report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28435 + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1907909 b/results/classifier/mode-deepseek-r1:32b/output/system/1907909 new file mode 100644 index 00000000..3964ed0a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1907909 @@ -0,0 +1,57 @@ + + +assertion failure in am53c974 + +Hello, + +Using hypervisor fuzzer, hyfuzz, I found an assertion failure through am53c974 emulator. + +A malicious guest user/process could use this flaw to abort the QEMU process on the host, resulting in a denial of service. + +This was found in version 5.2.0 (master) + + +qemu-system-i386: ../hw/scsi/esp.c:402: void esp_do_dma(ESPState *): Assertion `s->cmdlen <= sizeof(s->cmdbuf) && len <= sizeof(s->cmdbuf) - s->cmdlen' failed. + +#0 __GI_raise (sig=sig@entry=0x6) at ../sysdeps/unix/sysv/linux/raise.c:51 +51 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory. +[Current thread is 1 (Thread 0x7fdd25dc4700 (LWP 28983))] +gdb-peda$ bt +#0 0x00007fdd3f8b5f47 in __GI_raise (sig=sig@entry=0x6) at ../sysdeps/unix/sysv/linux/raise.c:51 +#1 0x00007fdd3f8b78b1 in __GI_abort () at abort.c:79 +#2 0x00007fdd3f8a742a in __assert_fail_base (fmt=0x7fdd3fa2ea38 "%s%s%s:%u: %s%sAssertion `%s' failed.\\n%n", assertion=assertion@entry=0x55b3e11a51c6 "s->cmdlen <= sizeof(s->cmdbuf) && len <= sizeof(s->cmdbuf) - s->cmdlen", file=file@entry=0x55b3e11a4f73 "../hw/scsi/esp.c", line=line@entry=0x192, function=function@entry=0x55b3e11a520d "void esp_do_dma(ESPState *)") at assert.c:92 +#3 0x00007fdd3f8a74a2 in __GI___assert_fail (assertion=0x55b3e11a51c6 "s->cmdlen <= sizeof(s->cmdbuf) && len <= sizeof(s->cmdbuf) - s->cmdlen", file=0x55b3e11a4f73 "../hw/scsi/esp.c", line=0x192, function=0x55b3e11a520d "void esp_do_dma(ESPState *)") at assert.c:101 +#4 0x000055b3e0941441 in esp_do_dma (s=0x55b3e49d1c88) at ../hw/scsi/esp.c:401 +#5 0x000055b3e0944261 in handle_ti (s=0x55b3e49d1c88) at ../hw/scsi/esp.c:549 +#6 0x000055b3e093fdf9 in esp_dma_enable (s=0x55b3e49d1c88, irq=<optimized out>, level=<optimized out>) + at ../hw/scsi/esp.c:79 +#7 0x000055b3e0897930 in esp_pci_dma_write (pci=<optimized out>, saddr=<optimized out>, val=<optimized +out>) at ../hw/scsi/esp-pci.c:83 +#8 0x000055b3e0897930 in esp_pci_io_write (opaque=<optimized out>, addr=<optimized out>, val=0xcf, size=0x4) at ../hw/scsi/esp-pci.c:209 +#9 0x000055b3e0e8f798 in memory_region_write_accessor (mr=<optimized out>, addr=<optimized out>, value=<optimized out>, size=<optimized out>, shift=<optimized out>, mask=<optimized out>, attrs=...) + at ../softmmu/memory.c:491 +#10 0x000055b3e0e8f58e in access_with_adjusted_size (addr=<optimized out>, value=<optimized out>, size=<optimized out>, access_size_min=<optimized out>, access_size_max=<optimized out>, access_fn=<optimized out>, mr=<optimized out>, attrs=...) at ../softmmu/memory.c:552 +#11 0x000055b3e0e8f58e in memory_region_dispatch_write (mr=0x55b3e49d1b70, addr=<optimized out>, data=<optimized out>, op=<optimized out>, attrs=...) at ../softmmu/memory.c:1501 +#12 0x000055b3e0e21541 in address_space_stb (as=<optimized out>, addr=<optimized out>, val=0xffffffcf, attrs=..., result=0x0) at ../memory_ldst.c.inc:382 +#13 0x00007fdcd84a4a7f in code_gen_buffer () +#14 0x000055b3e0e57da0 in cpu_tb_exec (cpu=0x55b3e3c33650, itb=<optimized out>) + at ../accel/tcg/cpu-exec.c:178 +#15 0x000055b3e0e589eb in cpu_loop_exec_tb (tb=<optimized out>, cpu=<optimized out>, last_tb=<optimized +out>, tb_exit=<optimized out>) at ../accel/tcg/cpu-exec.c:658 +#16 0x000055b3e0e589eb in cpu_exec (cpu=0x55b3e3c33650) at ../accel/tcg/cpu-exec.c:771 +#17 0x000055b3e0e87b9f in tcg_cpu_exec (cpu=<optimized out>) at ../accel/tcg/tcg-cpus.c:243 +#18 0x000055b3e0e87b9f in tcg_cpu_thread_fn (arg=0x55b3e3c33650) at ../accel/tcg/tcg-cpus.c:427 +#19 0x000055b3e115f775 in qemu_thread_start (args=<optimized out>) at ../util/qemu-thread-posix.c:521 +#20 0x00007fdd3fc6f6db in start_thread (arg=0x7fdd25dc4700) at pthread_create.c:463 +#21 0x00007fdd3f998a3f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 + +To reproduce the assertion failure, please run the QEMU with the following command line. + + +$ ./qemu-system-i386 -m 512 -drive file=./hyfuzz.img,index=0,media=disk,format=raw -device am53c974,id=scsi -device scsi-hd,drive=SysDisk -drive id=SysDisk,if=none,file=./disk.img + +Please let me know if I can provide any further info. + +Thank you. + +- Cheolwoo, Myung (Seoul National University) \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1907938 b/results/classifier/mode-deepseek-r1:32b/output/system/1907938 new file mode 100644 index 00000000..61cf5d5a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1907938 @@ -0,0 +1,74 @@ + + +[OSS-Fuzz] Issue 28524 virtio-blk: ASSERT: !s->dataplane_started + + affects qemu + +=== Reproducer === + +cat << EOF |./qemu-system-i386 -display none -m 512M -machine q35 \ +-device virtio-blk,drive=disk0 \ +-drive file=null-co://,id=disk0,if=none,format=raw -qtest stdio +outl 0xcf8 0x8000181f +outl 0xcfc 0xa044d79 +outl 0xcf8 0x80001802 +outl 0xcf8 0x80001804 +outl 0xcfc 0xb9045dff +outl 0xcf8 0x8000180e +outl 0xcfc 0xfb9465a +outl 0xf85 0x9e1ea5c2 +write 0x9f002 0x1 0x04 +write 0x9f004 0x1 0x04 +write 0x9e040 0x1 0x04 +write 0x9e043 0x1 0x01 +write 0x9e048 0x1 0x10 +write 0x9e04c 0x1 0x01 +write 0x9e04e 0x1 0x6e +write 0x1000004 0x1 0x01 +write 0x9e6e3 0x1 0x01 +write 0x9e6eb 0x1 0x04 +write 0x9e6ec 0x1 0x6e +write 0x9f006 0x1 0x04 +write 0x9f008 0x1 0x04 +write 0x9f00a 0x1 0x04 +outl 0xf8f 0xc +EOF + +=== Stack Trace === + +qemu-fuzz-i386: ../hw/block/virtio-blk.c:917: void virtio_blk_reset(VirtIODevice *): Assertion `!s->dataplane_started' failed. +==702068== ERROR: libFuzzer: deadly signal +#0 0x55bd6fc9f311 in __sanitizer_print_stack_trace (fuzz-i386+0x2b16311) +#1 0x55bd6fbe83d8 in fuzzer::PrintStackTrace() (fuzz-i386+0x2a5f3d8) +#2 0x55bd6fbce413 in fuzzer::Fuzzer::CrashCallback() (fuzz-i386+0x2a45413) +#3 0x7ff5241b813f (/lib/x86_64-linux-gnu/libpthread.so.0+0x1413f) +#4 0x7ff523feddb0 in __libc_signal_restore_set signal/../sysdeps/unix/sysv/linux/internal-signals.h:86:3 +#5 0x7ff523feddb0 in raise signal/../sysdeps/unix/sysv/linux/raise.c:48:3 +#6 0x7ff523fd7536 in abort stdlib/abort.c:79:7 +#7 0x7ff523fd740e in __assert_fail_base assert/assert.c:92:3 +#8 0x7ff523fe65b1 in __assert_fail assert/assert.c:101:3 +#9 0x55bd7116c435 in virtio_blk_reset hw/block/virtio-blk.c:917:5 +#10 0x55bd710c94a2 in virtio_reset hw/virtio/virtio.c:2001:9 +#11 0x55bd6ff0e0a5 in virtio_pci_reset hw/virtio/virtio-pci.c:1886:5 +#12 0x55bd6ff10686 in virtio_ioport_write hw/virtio/virtio-pci.c:339:13 +#13 0x55bd6ff10686 in virtio_pci_config_write hw/virtio/virtio-pci.c:456:9 +#14 0x55bd713fd025 in memory_region_write_accessor softmmu/memory.c:491:5 +#15 0x55bd713fca93 in access_with_adjusted_size softmmu/memory.c:552:18 +#16 0x55bd713fc2f0 in memory_region_dispatch_write softmmu/memory.c +#17 0x55bd70e4bf36 in flatview_write_continue softmmu/physmem.c:2759:23 +#18 0x55bd70e41bbb in flatview_write softmmu/physmem.c:2799:14 +#19 0x55bd70e41bbb in address_space_write softmmu/physmem.c:2891:18 +#20 0x55bd71153462 in cpu_outl softmmu/ioport.c:80:5 +#21 0x55bd712d586e in qtest_process_command softmmu/qtest.c:483:13 +#22 0x55bd712d35bf in qtest_process_inbuf softmmu/qtest.c:797:9 +#23 0x55bd712d3315 in qtest_server_inproc_recv softmmu/qtest.c:904:9 +#24 0x55bd71910df8 in qtest_sendf tests/qtest/libqtest.c:438:5 +#25 0x55bd71911fae in qtest_out tests/qtest/libqtest.c:952:5 +#26 0x55bd71911fae in qtest_outl tests/qtest/libqtest.c:968:5 +#27 0x55bd6fcd1aa2 in op_out tests/qtest/fuzz/generic_fuzz.c:395:13 +#28 0x55bd6fcd04e9 in generic_fuzz tests/qtest/fuzz/generic_fuzz.c:680:17 +#29 0x55bd6fcc9723 in LLVMFuzzerTestOneInput tests/qtest/fuzz/fuzz.c:151:5 + +OSS-Fuzz Report: +https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28524 + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1908266 b/results/classifier/mode-deepseek-r1:32b/output/system/1908266 new file mode 100644 index 00000000..73de3de2 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1908266 @@ -0,0 +1,5 @@ + + +spice unnecessary forces nographic + +When spice is enabled, qemu does not give the graphical window. It should not imply -nographic but only -display none. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1908513 b/results/classifier/mode-deepseek-r1:32b/output/system/1908513 new file mode 100644 index 00000000..de8a5d06 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1908513 @@ -0,0 +1,57 @@ + + +assertion failure in mptsas1068 emulator + +Using hypervisor fuzzer, hyfuzz, I found an assertion failure through mptsas1068 emulator. + +A malicious guest user/process could use this flaw to abort the QEMU process on the host, resulting in a denial of service. + +This was found in version 5.2.0 (master) + + +qemu-system-i386: ../hw/scsi/mptsas.c:968: void mptsas_interrupt_status_write(MPTSASState *): Assertion +`s->intr_status & MPI_HIS_DOORBELL_INTERRUPT' failed. +[1] 16951 abort (core dumped) /home/cwmyung/prj/hyfuzz/src/qemu-5.2/build/qemu-system-i386 -m 512 -drive + +Program terminated with signal SIGABRT, Aborted. +#0 __GI_raise (sig=sig@entry=0x6) at ../sysdeps/unix/sysv/linux/raise.c:51 +51 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory. +[Current thread is 1 (Thread 0x7fc7d6023700 (LWP 23475))] +gdb-peda$ bt +#0 0x00007fc7efa13f47 in __GI_raise (sig=sig@entry=0x6) at ../sysdeps/unix/sysv/linux/raise.c:51 +#1 0x00007fc7efa158b1 in __GI_abort () at abort.c:79 +#2 0x00007fc7efa0542a in __assert_fail_base (fmt=0x7fc7efb8ca38 "%s%s%s:%u: %s%sAssertion `%s' failed.\\n%n", assertion=assertion@entry=0x56439214d593 "s->intr_status & MPI_HIS_DOORBELL_INTERRUPT", file=file@entry=0x56439214d4a7 "../hw/scsi/mptsas.c", line=line@entry=0x3c8, function=function@entry=0x56439214d81c "void mptsas_interrupt_status_write(MPTSASState *)") at assert.c:92 +#3 0x00007fc7efa054a2 in __GI___assert_fail (assertion=0x56439214d593 "s->intr_status & MPI_HIS_DOORBELL_INTERRUPT", file=0x56439214d4a7 "../hw/scsi/mptsas.c", line=0x3c8, function=0x56439214d81c "void mptsas_interrupt_status_write(MPTSASState *)") at assert.c:101 +#4 0x0000564391a43963 in mptsas_interrupt_status_write (s=<optimized out>) at ../hw/scsi/mptsas.c:968 +#5 0x0000564391a43963 in mptsas_mmio_write (opaque=0x5643943dd5b0, addr=0x30, val=0x18000000, size=<optimized out>) at ../hw/scsi/mptsas.c:1052 +#6 0x0000564391e08798 in memory_region_write_accessor (mr=<optimized out>, addr=<optimized out>, value=<optimized out>, size=<optimized out>, shift=<optimized out>, mask=<optimized out>, attrs=...) + at ../softmmu/memory.c:491 +#7 0x0000564391e0858e in access_with_adjusted_size (addr=<optimized out>, value=<optimized out>, size=<optimized out>, access_size_min=<optimized out>, access_size_max=<optimized out>, access_fn=<optimized out>, mr=<optimized out>, attrs=...) at ../softmmu/memory.c:552 +#8 0x0000564391e0858e in memory_region_dispatch_write (mr=0x5643943ddea0, addr=<optimized out>, data=<optimized out>, op=<optimized out>, attrs=...) at ../softmmu/memory.c:1501 +#9 0x0000564391eff228 in io_writex (iotlbentry=<optimized out>, mmu_idx=<optimized out>, val=<optimized out>, addr=<optimized out>, retaddr=<optimized out>, op=<optimized out>, env=<optimized out>) + at ../accel/tcg/cputlb.c:1378 +#10 0x0000564391eff228 in store_helper (env=<optimized out>, addr=<optimized out>, val=<optimized out>, oi=<optimized out>, retaddr=<optimized out>, op=MO_32) at ../accel/tcg/cputlb.c:2397 +#11 0x0000564391eff228 in helper_le_stl_mmu (env=<optimized out>, addr=<optimized out>, val=0x2, oi=<optimized out>, retaddr=0x7fc78841b401) at ../accel/tcg/cputlb.c:2463 +#12 0x00007fc78841b401 in code_gen_buffer () +#13 0x0000564391dd0da0 in cpu_tb_exec (cpu=0x56439363e650, itb=<optimized out>) at ../accel/tcg/cpu-exec.c:178 +#14 0x0000564391dd19eb in cpu_loop_exec_tb (tb=<optimized out>, cpu=<optimized out>, last_tb=<optimized out>, tb_exit=<optimized out>) at ../accel/tcg/cpu-exec.c:658 +#15 0x0000564391dd19eb in cpu_exec (cpu=0x56439363e650) at ../accel/tcg/cpu-exec.c:771 +#16 0x0000564391e00b9f in tcg_cpu_exec (cpu=<optimized out>) at ../accel/tcg/tcg-cpus.c:243 +#17 0x0000564391e00b9f in tcg_cpu_thread_fn (arg=0x56439363e650) at ../accel/tcg/tcg-cpus.c:427 +#18 0x00005643920d8775 in qemu_thread_start (args=<optimized out>) at ../util/qemu-thread-posix.c:521 +#19 0x00007fc7efdcd6db in start_thread (arg=0x7fc7d6023700) at pthread_create.c:463 + +To reproduce this issue, please run the QEMU with the following command line. + + +# To enable ASan option, please set configuration with the following command +$ ./configure --target-list=i386-softmmu --disable-werror --enable-sanitizers +$ make + +# To reproduce this issue, please run the QEMU process with the following command line. +$ ./qemu-system-i386 -m 512 -drive file=./hyfuzz.img,index=0,media=disk,format=raw -device mptsas1068,id=scsi -device scsi-hd,drive=SysDisk -drive id=SysDisk,if=none,file=./disk.img + +Please let me know if I can provide any further info. +Thank you. + +- Cheolwoo, Myung (Seoul National University) \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1908515 b/results/classifier/mode-deepseek-r1:32b/output/system/1908515 new file mode 100644 index 00000000..1a05990e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1908515 @@ -0,0 +1,71 @@ + + +assertion failure in lsi53c810 emulator + +Hello, + +Using hypervisor fuzzer, hyfuzz, I found an assertion failure through lsi53c810 emulator. + +A malicious guest user/process could use this flaw to abort the QEMU process on the host, resulting in a denial of service. + +This was found in version 5.2.0 (master) + + +qemu-system-i386: ../hw/scsi/lsi53c895a.c:624: void lsi_do_dma(LSIState *, int): Assertion `s->current' +failed. +[1] 1406 abort (core dumped) /home/cwmyung/prj/hyfuzz/src/qemu-5.2/build/i386-softmmu/qemu-system-i386 -m + +Program terminated with signal SIGABRT, Aborted. +#0 __GI_raise (sig=sig@entry=0x6) at ../sysdeps/unix/sysv/linux/raise.c:51 +51 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory. +[Current thread is 1 (Thread 0x7fa9310a8700 (LWP 2076))] +gdb-peda$ bt +#0 0x00007fa94aa98f47 in __GI_raise (sig=sig@entry=0x6) at ../sysdeps/unix/sysv/linux/raise.c:51 +#1 0x00007fa94aa9a8b1 in __GI_abort () at abort.c:79 +#2 0x00007fa94aa8a42a in __assert_fail_base (fmt=0x7fa94ac11a38 "%s%s%s:%u: %s%sAssertion `%s' failed.\\n%n", assertion=assertion@entry=0x562851c9eab9 "s->current", file=file@entry=0x562851c9d4f9 "../hw/scsi/lsi53c895a.c", line=line@entry=0x270, function=function@entry=0x562851c9de43 "void lsi_do_dma(LSIState *, int)") at assert.c:92 +#3 0x00007fa94aa8a4a2 in __GI___assert_fail (assertion=0x562851c9eab9 "s->current", file=0x562851c9d4f9 "../hw/scsi/lsi53c895a.c", line=0x270, function=0x562851c9de43 "void lsi_do_dma(LSIState *, int)") + at assert.c:101 +#4 0x00005628515d9605 in lsi_do_dma (s=0x562855559060, out=0x1) at ../hw/scsi/lsi53c895a.c:624 +#5 0x00005628515d5317 in lsi_execute_script (s=<optimized out>) at ../hw/scsi/lsi53c895a.c:1250 +#6 0x00005628515cec49 in lsi_reg_writeb (s=0x562855559060, offset=0x2f, val=0x1e) + at ../hw/scsi/lsi53c895a.c:2005 +#7 0x0000562851952798 in memory_region_write_accessor (mr=<optimized out>, addr=<optimized out>, value=<optimized out>, size=<optimized out>, shift=<optimized out>, mask=<optimized out>, attrs=...) + at ../softmmu/memory.c:491 +#8 0x000056285195258e in access_with_adjusted_size (addr=<optimized out>, value=<optimized out>, size=<optimized out>, access_size_min=<optimized out>, access_size_max=<optimized out>, access_fn=<optimized out>, mr=<optimized out>, attrs=...) at ../softmmu/memory.c:552 +#9 0x000056285195258e in memory_region_dispatch_write (mr=0x562855559960, addr=<optimized out>, data=<optimized out>, op=<optimized out>, attrs=...) at ../softmmu/memory.c:1501 +#10 0x00005628518e5305 in flatview_write_continue (fv=0x7fa92871f040, addr=0xfebf302c, attrs=..., ptr=0x7fa9310a49b8, len=0x4, addr1=0x7fa9310a3410, l=<optimized out>, mr=0x562855559960) + at ../softmmu/physmem.c:2759 +#11 0x00005628518e6ef6 in flatview_write (fv=0x7fa92871f040, addr=0xfebf302c, attrs=..., len=0x4, buf=<optimized out>) at ../softmmu/physmem.c:2799 +#12 0x00005628518e6ef6 in subpage_write (opaque=<optimized out>, addr=<optimized out>, value=<optimized out>, len=<optimized out>, attrs=...) at ../softmmu/physmem.c:2465 +#13 0x00005628519529a2 in memory_region_write_with_attrs_accessor (mr=<optimized out>, addr=<optimized out>, value=<optimized out>, size=<optimized out>, shift=<optimized out>, mask=<optimized out>, attrs=...) at ../softmmu/memory.c:511 +#14 0x00005628519525e1 in access_with_adjusted_size (addr=<optimized out>, size=<optimized out>, access_size_min=<optimized out>, access_size_max=<optimized out>, mr=<optimized out>, attrs=..., value=<optimized out>, access_fn=<optimized out>) at ../softmmu/memory.c:552 +#15 0x00005628519525e1 in memory_region_dispatch_write (mr=<optimized out>, addr=<optimized out>, data=<optimized out>, op=<optimized out>, attrs=...) at ../softmmu/memory.c:1508 +#16 0x0000562851a49228 in io_writex (iotlbentry=<optimized out>, mmu_idx=<optimized out>, val=<optimized out>, addr=<optimized out>, retaddr=<optimized out>, op=<optimized out>, env=<optimized out>) + at ../accel/tcg/cputlb.c:1378 +#17 0x0000562851a49228 in store_helper (env=<optimized out>, addr=<optimized out>, val=<optimized out>, oi=<optimized out>, retaddr=<optimized out>, op=MO_32) at ../accel/tcg/cputlb.c:2397 +#18 0x0000562851a49228 in helper_le_stl_mmu (env=<optimized out>, addr=<optimized out>, val=0x2, oi=<optimized out>, retaddr=0x7fa8e44032ee) at ../accel/tcg/cputlb.c:2463 +#19 0x00007fa8e44032ee in code_gen_buffer () +#20 0x000056285191ada0 in cpu_tb_exec (cpu=0x5628547b81a0, itb=<optimized out>) + at ../accel/tcg/cpu-exec.c:178 +#21 0x000056285191b9eb in cpu_loop_exec_tb (tb=<optimized out>, cpu=<optimized out>, last_tb=<optimized out>, tb_exit=<optimized out>) at ../accel/tcg/cpu-exec.c:658 +#22 0x000056285191b9eb in cpu_exec (cpu=0x5628547b81a0) at ../accel/tcg/cpu-exec.c:771 +#23 0x000056285194ab9f in tcg_cpu_exec (cpu=<optimized out>) at ../accel/tcg/tcg-cpus.c:243 +#24 0x000056285194ab9f in tcg_cpu_thread_fn (arg=0x5628547b81a0) at ../accel/tcg/tcg-cpus.c:427 +#25 0x0000562851c22775 in qemu_thread_start (args=<optimized out>) at ../util/qemu-thread-posix.c:521 +#26 0x00007fa94ae526db in start_thread (arg=0x7fa9310a8700) at pthread_create.c:463 +#27 0x00007fa94ab7ba3f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 + +To reproduce this issue, please run the QEMU with the following command line. + + +# To enable ASan option, please set configuration with the following command +$ ./configure --target-list=i386-softmmu --disable-werror --enable-sanitizers +$ make + +# To reproduce this issue, please run the QEMU process with the following command line. +$ ./qemu-system-i386 -m 512 -drive file=./hyfuzz.img,index=0,media=disk,format=raw -device lsi53c810,id=scsi -device scsi-hd,drive=SysDisk -drive id=SysDisk,if=none,file=./disk.img + +Please let me know if I can provide any further info. +Thank you. + +- Cheolwoo, Myung (Seoul National University) \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1909392 b/results/classifier/mode-deepseek-r1:32b/output/system/1909392 new file mode 100644 index 00000000..e9dca18b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1909392 @@ -0,0 +1,22 @@ + + +qemu-arm crashes (SIGSEGV) when executing push instruction + +Dear all, +I am afraid I found a problem, it seems like qemu-arm crashes when executing assembly push instruction. +I use qemu version 5.2.0, but it checked an older version (4.2.1) and the problem was also present. I start qemu using "qemu-arm -cpu cortex-m4 -singlestep -g 1234 <path to elf file>" +Callstack before crash (host) +#0 0x000055555575961f in stl_he_p (ptr=0x2002fffc, v=0) at /home/faust1002/Programming/qemu/qemu-5.2.0/include/qemu/bswap.h:353 +#1 0x0000555555759716 in stl_le_p (ptr=0x2002fffc, v=0) at /home/faust1002/Programming/qemu/qemu-5.2.0/include/qemu/bswap.h:395 +#2 0x000055555575d3c3 in tcg_qemu_tb_exec (env=0x555555d28050, tb_ptr=0x7fffe800010a "\r\b") at ../tcg/tci.c:1221 +#3 0x00005555556bd982 in cpu_tb_exec (cpu=0x555555d1fd70, itb=0x7fffe8000000) at ../accel/tcg/cpu-exec.c:178 +#4 0x00005555556be57e in cpu_loop_exec_tb (cpu=0x555555d1fd70, tb=0x7fffe8000000, last_tb=0x7fffffffd8a8, tb_exit=0x7fffffffd8a0) at ../accel/tcg/cpu-exec.c:658 +#5 0x00005555556be7ea in cpu_exec (cpu=0x555555d1fd70) at ../accel/tcg/cpu-exec.c:771 +#6 0x000055555560af1d in cpu_loop (env=0x555555d28050) at ../linux-user/arm/cpu_loop.c:237 +#7 0x00005555557415a7 in main (argc=7, argv=0x7fffffffe0f8, envp=0x7fffffffe138) at ../linux-user/main.c:861 +Callstack before crash (target) +Program received signal SIGSEGV, Segmentation fault. +Reset_Handler () at startup.s:48 +48 push {r14} +Please find the elf file I use attached. +Kind regards \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1909823 b/results/classifier/mode-deepseek-r1:32b/output/system/1909823 new file mode 100644 index 00000000..d5fce662 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1909823 @@ -0,0 +1,9 @@ + + +RDPMC check on PCE is backwards + +At [this line](https://github.com/qemu/qemu/blob/75ee62ac606bfc9eb59310b9446df3434bf6e8c2/target/i386/tcg/misc_helper.c#L225) the check on CR4_PCE_MASK is backwards: it's raising an exception if the flag is set (and CPL != 0) rather than if the flag is clear. + +It's low priority at the moment because the instruction isn't implemented, so you get an illegal opcode exception when expecting a GPF, or vice versa, but it's a time bomb for if it is ever implemented. + +The Intel docs also indicate that CR0.PE influences the protection; I don't know if that's already reflected in env->hflags & HF_CPL_MASK. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/191 b/results/classifier/mode-deepseek-r1:32b/output/system/191 new file mode 100644 index 00000000..95bff0a5 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/191 @@ -0,0 +1,3 @@ + + +qemu64 CPU model is incorrect diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1910505 b/results/classifier/mode-deepseek-r1:32b/output/system/1910505 new file mode 100644 index 00000000..f7624e41 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1910505 @@ -0,0 +1,69 @@ + + +atomic failure linking with --enable-sanitizers on 32-bit Linux hosts + +As of commit 50536341b47, using --enable-sanitizers on 32-bit Linux host: +- displays various warnings +- fails linking + +Using Ubuntu 18.04 (release 20201211.1) and Clang10 on i386: + +[139/675] Compiling C object softmmu.fa.p/softmmu_icount.c.o +In file included from ../softmmu/icount.c:31: +In file included from include/exec/exec-all.h:23: +In file included from ../target/mips/cpu.h:4: +In file included from ../target/mips/cpu-qom.h:23: +In file included from include/hw/core/cpu.h:23: +In file included from include/hw/qdev-core.h:5: +In file included from include/qemu/bitmap.h:16: +In file included from include/qemu/bitops.h:17: +include/qemu/atomic.h:463:12: warning: misaligned atomic operation may +incur significant performance penalty [-Watomic-alignment] + return qatomic_read__nocheck(ptr); + ^ +include/qemu/atomic.h:129:5: note: expanded from macro +'qatomic_read__nocheck' + __atomic_load_n(ptr, __ATOMIC_RELAXED) + ^ +include/qemu/atomic.h:473:5: warning: misaligned atomic operation may +incur significant performance penalty [-Watomic-alignment] + qatomic_set__nocheck(ptr, val); + ^ +include/qemu/atomic.h:138:5: note: expanded from macro +'qatomic_set__nocheck' + __atomic_store_n(ptr, i, __ATOMIC_RELAXED) + ^ +2 warnings generated. +[...] + +[850/2216] Linking target tests/test-hbitmap +FAILED: tests/test-hbitmap +clang -o tests/test-hbitmap tests/test-hbitmap.p/test-hbitmap.c.o +tests/test-hbitmap.p/iothread.c.o -Wl,--as-needed -Wl,--no-undefined +-pie -Wl,--whole-archive libblock.fa libcrypto.fa libauthz.fa libqom.fa +libio.fa -Wl,--no-whole-archive -Wl,--warn-common -fsanitize=undefined +-fsanitize=address -Wl,-z,relro -Wl,-z,now -m32 -ggdb +-fstack-protector-strong -Wl,--start-group libqemuutil.a +subprojects/libvhost-user/libvhost-user-glib.a +subprojects/libvhost-user/libvhost-user.a libblock.fa libcrypto.fa +libauthz.fa libqom.fa libio.fa @block.syms -lgio-2.0 -lgobject-2.0 +-lglib-2.0 -lgio-2.0 -lgobject-2.0 -lglib-2.0 -pthread -lutil -lgnutls +-lm -lgthread-2.0 -lglib-2.0 /usr/lib/i386-linux-gnu/libglib-2.0.so +-liscsi -lgthread-2.0 -lglib-2.0 -laio -lcurl +/usr/lib/i386-linux-gnu/libz.so -lrbd -lrados -lnettle -lgnutls +-Wl,--end-group +libblock.fa(block_io.c.o): In function `stat64_max': +include/qemu/stats64.h:58: undefined reference to `__atomic_load_8' +include/qemu/stats64.h:60: undefined reference to +`__atomic_compare_exchange_8' +libblock.fa(block_qapi.c.o): In function `stat64_get': +include/qemu/stats64.h:40: undefined reference to `__atomic_load_8' +libqemuutil.a(util_qsp.c.o): In function `qatomic_set_u64': +include/qemu/atomic.h:478: undefined reference to `__atomic_store_8' +libqemuutil.a(util_qsp.c.o): In function `qatomic_read_u64': +include/qemu/atomic.h:468: undefined reference to `__atomic_load_8' +clang: error: linker command failed with exit code 1 (use -v to see +invocation) + +Issue previously reported on the list here: +https://<email address hidden>/msg770128.html \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1910826 b/results/classifier/mode-deepseek-r1:32b/output/system/1910826 new file mode 100644 index 00000000..cd365d89 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1910826 @@ -0,0 +1,66 @@ + + +[OSS-Fuzz] Issue 29224 rtl8139: Stack-overflow in rtlNUMBER_transmit_one + +=== Reproducer === +cat << EOF | ../build/qemu-system-i386 -machine q35 \ +-nodefaults -device rtl8139,netdev=net0 \ +-netdev user,id=net0 -display none -qtest stdio +outl 0xcf8 0x80000804 +outb 0xcfc 0x26 +outl 0xcf8 0x80000817 +outb 0xcfc 0xff +write 0x1 0x1 0x42 +write 0x5 0x1 0x42 +write 0x9 0x1 0x42 +write 0xd 0x1 0x42 +write 0xff000044 0x4 0x11 +write 0xff000037 0x1 0x1c +writel 0xff000030 0xff000000 +write 0xff000040 0x4 0x100006 +write 0xff000010 0x4 0x01020 +EOF + +=== Stack Trace === +==2819215==ERROR: AddressSanitizer: stack-overflow on address 0x7ffd2c714040 (pc 0x5639b3a933d9 bp 0x7ffd2c716210 sp 0x7ffd2c714040 T0) +#0 rtl8139_transmit_one /src/qemu/hw/net/rtl8139.c:1815 +#1 rtl8139_transmit /src/qemu/hw/net/rtl8139.c:2388:9 +#2 rtl8139_TxStatus_write /src/qemu/hw/net/rtl8139.c:2442:5 +#3 rtl8139_io_writel /src/qemu/hw/net/rtl8139.c:2865:13 +#4 rtl8139_ioport_write /src/qemu/hw/net/rtl8139.c:3290:9 +#5 memory_region_write_accessor /src/qemu/softmmu/memory.c:491:5 +#6 access_with_adjusted_size /src/qemu/softmmu/memory.c:552:18 +#7 memory_region_dispatch_write /src/qemu/softmmu/memory.c:0:13 +#8 flatview_write_continue /src/qemu/softmmu/physmem.c:2759:23 +#9 flatview_write /src/qemu/softmmu/physmem.c:2799:14 +#10 address_space_write /src/qemu/softmmu/physmem.c:2891:18 +#11 address_space_rw /src/qemu/softmmu/physmem.c:2901:16 +#12 dma_memory_rw_relaxed /src/qemu/include/sysemu/dma.h:88:12 +#13 dma_memory_rw /src/qemu/include/sysemu/dma.h:127:12 +#14 pci_dma_rw /src/qemu/include/hw/pci/pci.h:801:12 +#15 pci_dma_write /src/qemu/include/hw/pci/pci.h:837:12 +#16 rtl8139_write_buffer /src/qemu/hw/net/rtl8139.c:778:5 +#17 rtl8139_do_receive /src/qemu/hw/net/rtl8139.c:1172:9 +#18 rtl8139_transfer_frame /src/qemu/hw/net/rtl8139.c:1798:9 +#19 rtl8139_transmit_one /src/qemu/hw/net/rtl8139.c:1845:5 +#20 rtl8139_transmit /src/qemu/hw/net/rtl8139.c:2388:9 +#21 rtl8139_TxStatus_write /src/qemu/hw/net/rtl8139.c:2442:5 +#22 rtl8139_io_writel /src/qemu/hw/net/rtl8139.c:2865:13 +#23 rtl8139_ioport_write /src/qemu/hw/net/rtl8139.c:3290:9 +#24 memory_region_write_accessor /src/qemu/softmmu/memory.c:491:5 +#25 access_with_adjusted_size /src/qemu/softmmu/memory.c:552:18 +#26 memory_region_dispatch_write /src/qemu/softmmu/memory.c:0:13 +#27 flatview_write_continue /src/qemu/softmmu/physmem.c:2759:23 +#28 flatview_write /src/qemu/softmmu/physmem.c:2799:14 +#29 address_space_write /src/qemu/softmmu/physmem.c:2891:18 +#30 address_space_rw /src/qemu/softmmu/physmem.c:2901:16 +#31 dma_memory_rw_relaxed /src/qemu/include/sysemu/dma.h:88:12 +#32 dma_memory_rw /src/qemu/include/sysemu/dma.h:127:12 +#33 pci_dma_rw /src/qemu/include/hw/pci/pci.h:801:12 +#34 pci_dma_write /src/qemu/include/hw/pci/pci.h:837:12 +#35 rtl8139_write_buffer /src/qemu/hw/net/rtl8139.c:778:5 +#36 rtl8139_do_receive /src/qemu/hw/net/rtl8139.c:1172:9 +#37 rtl8139_transfer_frame /src/qemu/hw/net/rtl8139.c:1798:9 +Repeat until we run out of stack + +https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29224 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1911351 b/results/classifier/mode-deepseek-r1:32b/output/system/1911351 new file mode 100644 index 00000000..f3a80c62 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1911351 @@ -0,0 +1,43 @@ + + +x86-64 MTTCG Does not update page table entries atomically + +It seems like the qemu tcg code for x86-64 doesn't write the access and dirty flags of the page table entries atomically. Instead, they first read the entry, see if they need to set the page table entry, and then overwrite the entry. So if you have two threads running at the same time, one accessing the virtual address over and over again, and the other modifying the page table entry, it is possible that after the second thread modifies the page table entry, qemu overwrites the value with the old page table entry value, with the access/dirty flags set. + +Here's a unit test that reproduces this behavior: + +https://github.com/mvanotti/kvm-unit-tests/commit/09f9722807271226a714b04f25174776454b19cd + +You can run it with: + +``` +/usr/bin/qemu-system-x86_64 --no-reboot -nodefaults \ +-device pc-testdev -device isa-debug-exit,iobase=0xf4,iosize=0x4 \ +-vnc none -serial stdio -device pci-testdev \ +-smp 4 -machine q35 --accel tcg,thread=multi \ +-kernel x86/mmu-race.flat # -initrd /tmp/tmp.avvPpezMFf +``` + +Expected output (failure): + +``` +kvm-unit-tests$ make && /usr/bin/qemu-system-x86_64 --no-reboot -nodefaults -device pc-testdev -device isa-debug-exit,iobase=0xf4,iosize=0x4 -vnc none -serial stdio -device pci-testdev -smp 4 -machine q35 --accel tcg,thread=multi -kernel x86/mmu-race.flat # -initrd /tmp/tmp.avvPpezMFf +enabling apic +enabling apic +enabling apic +enabling apic +paging enabled +cr0 = 80010011 +cr3 = 627000 +cr4 = 20 +found 4 cpus +PASS: Need more than 1 CPU +Detected overwritten PTE: + want: 0x000000000062e007 + got: 0x000000000062d027 +FAIL: PTE not overwritten +PASS: All Reads were zero +SUMMARY: 3 tests, 1 unexpected failures +``` + +This bug has allows user-to-root privilege escalation inside the guest VM: if the user is able overwrite an entry that belongs to a second-to-last level page table, and is able to allocate the referenced page, then the user would be in control of a last-level page table, being able to map any memory they want. This is not uncommon in situations where memory is being decomitted. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1911666 b/results/classifier/mode-deepseek-r1:32b/output/system/1911666 new file mode 100644 index 00000000..827c7baa --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1911666 @@ -0,0 +1,72 @@ + + +ZDI-CAN-10904: QEMU Plan 9 File System TOCTOU Privilege Escalation Vulnerability + +-- CVSS ----------------------------------------- + +7.5: AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H + +-- ABSTRACT ------------------------------------- + +Trend Micro's Zero Day Initiative has identified a vulnerability affecting the following products: +QEMU - QEMU + +-- VULNERABILITY DETAILS ------------------------ + +Version tested:5.0.0-rc3 +Installer file:qemu-5.0.0-rc3.tar.xz +Platform tested:ubuntu 18.04 x64 desktop +Analysis Basically v9fs* functions called from guest kernel are executed under specific thread(I call it main thread later). But when it calls some file related system calls, qemu uses its own coroutine thread(worker thread). Then it returns(yield return) without waiting result of system call and start to execute next v9fs* function. + +In v9fsmarkfidsunreclaim() function, it stores fidlist member (head of singly linked list) to its stack. + + -> https://github.com/qemu/qemu/blob/f3bac27cc1e303e1860cc55b9b6889ba39dee587/hw/9pfs/9p.c#L506 + +And if it uses coroutine, it restore fid_list from stack and restart whole loop. + + -> https://github.com/qemu/qemu/blob/f3bac27cc1e303e1860cc55b9b6889ba39dee587/hw/9pfs/9p.c#L526 + +v9fsclunk() function calls clunkfid() which unlink fid from list, and free it. + + -> https://github.com/qemu/qemu/blob/f3bac27cc1e303e1860cc55b9b6889ba39dee587/hw/9pfs/9p.c#L2060-L2091 + +So if v9fsclunk() is called while v9fsmarkfidsunreclaim()'s coroutine is being executed, it restores "FREED" fidp from stack and use it. + +it can be reproduced with the qemu binary, which is given +it can also be reproduced with own ASAN build (5.0.0-rc3 and 4.2.0 are tested) + +../qemu-5.0.0-rc3/x86_64-softmmu/qemu-system-x86_64 -M pc -kernel ./bzImage -initrd ./rootfs.cpio -append "root=/dev/ram console=tty1 console=ttyS0 rdinit=/bin/sh" -nographic -enable-kvm -fsdev local,id=test_dev,path=/home/xxx/sandbox,security_model=none -device virtio-9p-pci,fsdev=test_dev,mount_tag=victim_tag + +$ ./do.sh +expected ASAN report is printed +the race is in coroutine, so the threads are the same one + +================================================================= + ==46645==ERROR: AddressSanitizer: heap-use-after-free on address 0x610000047948 at pc 0x5563d8c28f0f bp0 +READ of size 2 at 0x610000047948 thread T0 + + #0 0x5563d8c28f0e in v9fs_mark_fids_unreclaim hw/9pfs/9p.c:508 + #1 0x5563d8c3e9e3 in v9fs_remove hw/9pfs/9p.c:2988 + #2 0x5563d98d310d in coroutine_trampoline util/coroutine-ucontext.c:115 + #3 0x7fadac6396af (/lib/x86_64-linux-gnu/libc.so.6+0x586af) + + 0x610000047948 is located 8 bytes inside of 192-byte region [0x610000047940,0x610000047a00) freed by thread T0 here: + + #0 0x7fadafa5f7a8 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xde7a8) + #1 0x5563d8c27a60 in free_fid hw/9pfs/9p.c:371 + #2 0x5563d8c27fcc in put_fid hw/9pfs/9p.c:396 + #3 0x5563d8c37267 in v9fs_clunk hw/9pfs/9p.c:2085 + #4 0x5563d98d310d in coroutine_trampoline util/coroutine-ucontext.c:115 + #5 0x7fadac6396af (/lib/x86_64-linux-gnu/libc.so.6+0x586af) + +previously allocated by thread T0 here: + #0 0x7fadafa5fd28 in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xded28) + #1 0x7fadaf0c8b10 in g_malloc0 (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x51b10) + #2 0x5563d8c30ecc in v9fs_attach hw/9pfs/9p.c:1412 + #3 0x5563d98d310d in coroutine_trampoline util/coroutine-ucontext.c:115 + #4 0x7fadac6396af (/lib/x86_64-linux-gnu/libc.so.6+0x586af) + + +This vulnerability was discovered by: + +Ryota Shiga(@Garyo) of Flatt Security working with Trend Micro Zero Day Initiative \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1911839 b/results/classifier/mode-deepseek-r1:32b/output/system/1911839 new file mode 100644 index 00000000..0dbd59f5 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1911839 @@ -0,0 +1,72 @@ + + +[OSS-Fuzz] Issue 29586 e1000e: Memcpy-param-overlap in flatview_write_continue + +=== Reproducer === +cat << EOF | ./qemu-system-i386 -M q35 -accel qtest \ +-qtest stdio -nographic -nodefaults -device \ +e1000e,netdev=net0 -netdev user,id=net0 +outl 0xcf8 0x80000811 +outl 0xcfc 0x5ac600 +outl 0xcf8 0x80000801 +outl 0xcfc 0x26000000 +write 0x5ac60100 0x4 0x56000302 +write 0x5ac6011a 0x2 0x1006 +write 0x5ac60120 0x1 0x25 +write 0x5ac6042a 0x2 0x4048 +write 0x5ac60431 0x1 0x04 +write 0x4240 0x1 0xff +write 0x4241 0x1 0x01 +write 0x4249 0x1 0xf5 +write 0x1ff 0x1 0x11 +write 0x5ac60401 0x1 0x12 +write 0x5ac6043a 0x2 0x3000 +write 0x5ac60112 0x2 0xf090 +write 0x5ac60430 0x1 0x0 +write 0x239 0x1 0xff +write 0x2bb 0x1 0x41 +write 0x9531 0x1 0xff +write 0x9532 0x1 0xff +write 0x9533 0x1 0xff +write 0x9534 0x1 0xff +write 0x9535 0x1 0xff +write 0x9536 0x1 0xff +write 0x9537 0x1 0xff +write 0x5ac60403 0x1 0x12 +EOF + +=== Stack Trace === +==1364==ERROR: AddressSanitizer: memcpy-param-overlap: memory ranges [0x7f90b7e00025,0x7f90b7e00604) and [0x7f90b7e00225, 0x7f90b7e00804) overlap +#0 __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 +#1 flatview_write_continue /src/qemu/softmmu/physmem.c:2764:13 +#2 flatview_write /src/qemu/softmmu/physmem.c:2799:14 +#3 address_space_write /src/qemu/softmmu/physmem.c:2891:18 +#4 address_space_rw /src/qemu/softmmu/physmem.c:2901:16 +#5 dma_memory_rw_relaxed /src/qemu/include/sysemu/dma.h:88:12 +#6 dma_memory_rw /src/qemu/include/sysemu/dma.h:127:12 +#7 pci_dma_rw /src/qemu/include/hw/pci/pci.h:801:12 +#8 pci_dma_write /src/qemu/include/hw/pci/pci.h:837:12 +#9 e1000e_write_to_rx_buffers /src/qemu/hw/net/e1000e_core.c:1405:9 +#10 e1000e_write_packet_to_guest /src/qemu/hw/net/e1000e_core.c:1575:21 +#11 e1000e_receive_iov /src/qemu/hw/net/e1000e_core.c:1702:9 +#12 e1000e_nc_receive_iov /src/qemu/hw/net/e1000e.c:214:12 +#13 net_tx_pkt_sendv /src/qemu/hw/net/net_tx_pkt.c:556:9 +#14 net_tx_pkt_send /src/qemu/hw/net/net_tx_pkt.c:633:9 +#15 net_tx_pkt_send_loopback /src/qemu/hw/net/net_tx_pkt.c:646:11 +#16 e1000e_tx_pkt_send /src/qemu/hw/net/e1000e_core.c:657:16 +#17 e1000e_process_tx_desc /src/qemu/hw/net/e1000e_core.c:736:17 +#18 e1000e_start_xmit /src/qemu/hw/net/e1000e_core.c:927:9 +#19 e1000e_set_tctl /src/qemu/hw/net/e1000e_core.c:2424:9 +#20 e1000e_core_write /src/qemu/hw/net/e1000e_core.c:3256:9 +#21 e1000e_mmio_write /src/qemu/hw/net/e1000e.c:110:5 +#22 memory_region_write_accessor /src/qemu/softmmu/memory.c:491:5 +#23 access_with_adjusted_size /src/qemu/softmmu/memory.c:552:18 +#24 memory_region_dispatch_write /src/qemu/softmmu/memory.c:0:13 +#25 flatview_write_continue /src/qemu/softmmu/physmem.c:2759:23 +#26 flatview_write /src/qemu/softmmu/physmem.c:2799:14 +#27 address_space_write /src/qemu/softmmu/physmem.c:2891:18 +#28 __wrap_qtest_writeq /src/qemu/tests/qtest/fuzz/qtest_wrappers.c:187:9 +#29 op_write /src/qemu/tests/qtest/fuzz/generic_fuzz.c:479:13 +#30 generic_fuzz /src/qemu/tests/qtest/fuzz/generic_fuzz.c:681:17 + +OSS-Fuzz Report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29586 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1912107 b/results/classifier/mode-deepseek-r1:32b/output/system/1912107 new file mode 100644 index 00000000..09cf2c01 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1912107 @@ -0,0 +1,10 @@ + + +Option to constrain linux-user exec() to emulated CPU only + +When trying to reproduce a bug someone reported on an actual AMD K10[1], I tried to directly throw `qemu_x86-64 -cpu +phenom path/to/wrongly-labelled-instruction-set/gcc 1.c` at the problem, but failed to get an "illegal instruction" as expected. A quick investigation reveals that the error is actually caused by one of gcc's child processess, and that the said process is being ran directly on the host. A similar problem happens with trying to call stuff with /usr/bin/env. + + [1]: https://github.com/Homebrew/brew/issues/1034 + +Since both the host and the guest are x86_64, I deemed binfmt inapplicable to my case. I believe that QEMU should offer a way to modify exec() and other spawning syscalls so that execution remains on an emulated CPU in such a case. Call it an extra layer of binfmt, if you must. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1912934 b/results/classifier/mode-deepseek-r1:32b/output/system/1912934 new file mode 100644 index 00000000..1454948c --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1912934 @@ -0,0 +1,19 @@ + + +QEMU emulation of fmadds instruction on powerpc64le is buggy + +The attached program test-fmadds.c tests the fmadds instruction on powerpc64le. + +Result on real hardware (POWER8E processor): +$ ./a.out ; echo $? +0 + +Result in Alpine Linux 3.13/powerpcle, emulated by QEMU 5.0.0 on Ubuntu 16.04: +$ ./a.out ; echo $? +32 + +Result in Debian 8.6.0/ppc64el, emulated by QEMU 2.9.0 on Ubuntu 16.04: +$ ./a.out ; echo $? +32 + +Through 'nm --dynamic qemu-system-ppc64 | grep fma' I can see that QEMU is NOT using the fmaf() or fma() function from the host system's libc; this function is working fine in glibc of the host system (see https://www.gnu.org/software/gnulib/manual/html_node/fmaf.html ). \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1913510 b/results/classifier/mode-deepseek-r1:32b/output/system/1913510 new file mode 100644 index 00000000..2466ef83 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1913510 @@ -0,0 +1,103 @@ + + +[Fuzz] qemu-system-i386 virtio-mouse: Assertion in address_space_lduw_le_cached failed + +--[ Reproducer + +cat << EOF | ./build/qemu-system-i386 -machine q35,accel=qtest -nodefaults \ +-device virtio-mouse -display none -qtest stdio +outl 0xcf8 0x80000820 +outl 0xcfc 0xe0004000 +outl 0xcf8 0x80000804 +outb 0xcfc 0x02 +write 0xe000400c 0x4 0x003fe62e +write 0xe0004016 0x1 0x01 +write 0xe0004024 0x1 0x01 +write 0xe000401c 0x1 0x01 +write 0xe0007007 0x1 0x00 +write 0xe0004018 0x1 0x41 +write 0xe0007007 0x1 0x00 +EOF + + +--[ Output + +[I 1611805425.711054] OPENED +[R +0.040080] outl 0xcf8 0x80000820 +OK +[S +0.040117] OK +[R +0.040136] outl 0xcfc 0xe0004000 +OK +[S +0.040155] OK +[R +0.040165] outl 0xcf8 0x80000804 +OK +[S +0.040172] OK +[R +0.040184] outb 0xcfc 0x02 +OK +[S +0.040683] OK +[R +0.040702] write 0xe000400c 0x4 0x003fe62e +OK +[S +0.040735] OK +[R +0.040743] write 0xe0004016 0x1 0x01 +OK +[S +0.040748] OK +[R +0.040755] write 0xe0004024 0x1 0x01 +OK +[S +0.040760] OK +[R +0.040767] write 0xe000401c 0x1 0x01 +OK +[S +0.040785] OK +[R +0.040792] write 0xe0007007 0x1 0x00 +OK +[S +0.040810] OK +[R +0.040817] write 0xe0004018 0x1 0x41 +OK +[S +0.040822] OK +[R +0.040839] write 0xe0007007 0x1 0x00 +qemu-system-i386: /home/ubuntu/qemu/include/exec/memory_ldst_cached.h.inc:54: uint32_t address_space_lduw_le_cached(MemoryRegionCache *, hwaddr, MemTxAttrs, MemTxResult *): Assertion `addr < cache->len && 2 <= cache->len - addr' failed. + + +-- [ Original ASAN report + +qemu-fuzz-i386: /home/ubuntu/qemu/include/exec/memory_ldst_cached.h.inc:54: uint32_t address_space_lduw_le_cached(MemoryRegionCache *, hwaddr, MemTxAttrs, MemTxResult *): Assertion `addr < cache->len && 2 <= cache->len - addr' failed. +==3406167== ERROR: libFuzzer: deadly signal + #0 0x5644e4ae0f21 in __sanitizer_print_stack_trace (/home/ubuntu/qemu/build/qemu-fuzz-i386+0x2a47f21) + #1 0x5644e4a29fe8 in fuzzer::PrintStackTrace() (/home/ubuntu/qemu/build/qemu-fuzz-i386+0x2990fe8) + #2 0x5644e4a10023 in fuzzer::Fuzzer::CrashCallback() (/home/ubuntu/qemu/build/qemu-fuzz-i386+0x2977023) + #3 0x7f77e2a4b3bf (/lib/x86_64-linux-gnu/libpthread.so.0+0x153bf) + #4 0x7f77e285c18a in raise (/lib/x86_64-linux-gnu/libc.so.6+0x4618a) + #5 0x7f77e283b858 in abort (/lib/x86_64-linux-gnu/libc.so.6+0x25858) + #6 0x7f77e283b728 (/lib/x86_64-linux-gnu/libc.so.6+0x25728) + #7 0x7f77e284cf35 in __assert_fail (/lib/x86_64-linux-gnu/libc.so.6+0x36f35) + #8 0x5644e60051b2 in address_space_lduw_le_cached /home/ubuntu/qemu/include/exec/memory_ldst_cached.h.inc:54:5 + #9 0x5644e60051b2 in lduw_le_phys_cached /home/ubuntu/qemu/include/exec/memory_ldst_phys.h.inc:91:12 + #10 0x5644e60051b2 in virtio_lduw_phys_cached /home/ubuntu/qemu/include/hw/virtio/virtio-access.h:166:12 + #11 0x5644e5ff476d in vring_avail_ring /home/ubuntu/qemu/build/../hw/virtio/virtio.c:327:12 + #12 0x5644e5ff476d in vring_get_used_event /home/ubuntu/qemu/build/../hw/virtio/virtio.c:333:12 + #13 0x5644e5ff476d in virtio_split_should_notify /home/ubuntu/qemu/build/../hw/virtio/virtio.c:2473:35 + #14 0x5644e5ff476d in virtio_should_notify /home/ubuntu/qemu/build/../hw/virtio/virtio.c:2524:16 + #15 0x5644e5ff5556 in virtio_notify /home/ubuntu/qemu/build/../hw/virtio/virtio.c:2566:14 + #16 0x5644e5571d2a in virtio_input_handle_sts /home/ubuntu/qemu/build/../hw/input/virtio-input.c:100:5 + #17 0x5644e5ff20ec in virtio_queue_notify /home/ubuntu/qemu/build/../hw/virtio/virtio.c:2366:9 + #18 0x5644e60908fb in memory_region_write_accessor /home/ubuntu/qemu/build/../softmmu/memory.c:491:5 + #19 0x5644e6090363 in access_with_adjusted_size /home/ubuntu/qemu/build/../softmmu/memory.c:552:18 + #20 0x5644e608fbc0 in memory_region_dispatch_write /home/ubuntu/qemu/build/../softmmu/memory.c + #21 0x5644e5b97bc6 in flatview_write_continue /home/ubuntu/qemu/build/../softmmu/physmem.c:2759:23 + #22 0x5644e5b8d328 in flatview_write /home/ubuntu/qemu/build/../softmmu/physmem.c:2799:14 + #23 0x5644e5b8d328 in address_space_write /home/ubuntu/qemu/build/../softmmu/physmem.c:2891:18 + #24 0x5644e6018906 in qtest_process_command /home/ubuntu/qemu/build/../softmmu/qtest.c:539:13 + #25 0x5644e60159df in qtest_process_inbuf /home/ubuntu/qemu/build/../softmmu/qtest.c:797:9 + #26 0x5644e6015735 in qtest_server_inproc_recv /home/ubuntu/qemu/build/../softmmu/qtest.c:904:9 + #27 0x5644e667cf68 in qtest_sendf /home/ubuntu/qemu/build/../tests/qtest/libqtest.c:438:5 + #28 0x5644e667e54e in qtest_write /home/ubuntu/qemu/build/../tests/qtest/libqtest.c:1002:5 + #29 0x5644e667e54e in qtest_writeq /home/ubuntu/qemu/build/../tests/qtest/libqtest.c:1023:5 + #30 0x5644e4b1037e in __wrap_qtest_writeq /home/ubuntu/qemu/build/../tests/qtest/fuzz/qtest_wrappers.c:190:9 + #31 0x5644e4b1c33d in op_write /home/ubuntu/qemu/build/../tests/qtest/fuzz/generic_fuzz.c:479:13 + #32 0x5644e4b1a259 in generic_fuzz /home/ubuntu/qemu/build/../tests/qtest/fuzz/generic_fuzz.c:681:17 + #33 0x5644e4b0b333 in LLVMFuzzerTestOneInput /home/ubuntu/qemu/build/../tests/qtest/fuzz/fuzz.c:151:5 + #34 0x5644e4a11581 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/ubuntu/qemu/build/qemu-fuzz-i386+0x2978581) + #35 0x5644e49fcc92 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/home/ubuntu/qemu/build/qemu-fuzz-i386+0x2963c92) + #36 0x5644e4a02cfe in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/ubuntu/qemu/build/qemu-fuzz-i386+0x2969cfe) + #37 0x5644e4a2a7c2 in main (/home/ubuntu/qemu/build/qemu-fuzz-i386+0x29917c2) + #38 0x7f77e283d0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2) + #39 0x5644e49d739d in _start (/home/ubuntu/qemu/build/qemu-fuzz-i386+0x293e39d) \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1913667 b/results/classifier/mode-deepseek-r1:32b/output/system/1913667 new file mode 100644 index 00000000..189b605a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1913667 @@ -0,0 +1,38 @@ + + +FPE in npcm7xx_clk_update_pll + +I've been working on integrating the generic-fuzzer with ARM machines on OSS-Fuzz so we can fuzz devices on architectures beyond i386 devices. Since I saw that there is some active development for the Nuvoton machines, I thought it might be useful to fuzz the NPCM750 machine + +Reproducer: +cat << EOF | ./qemu-system-aarch64 -M npcm750-evb \ +-accel qtest -qtest stdio +write 0xf080100c 0x4 0x00 +write 0xf080100c 0x4 0x00 +EOF + +Trace: +../hw/misc/npcm7xx_clk.c:131:14: runtime error: division by zero +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../hw/misc/npcm7xx_clk.c:131:14 in +AddressSanitizer:DEADLYSIGNAL +================================================================= +==717855==ERROR: AddressSanitizer: FPE on unknown address 0x5619201fcd8c (pc 0x5619201fcd8c bp 0x7ffc94214e50 sp 0x7ffc94214e30 T0) +#0 0x5619201fcd8c in npcm7xx_clk_update_pll /hw/misc/npcm7xx_clk.c:131:14 +#1 0x5619201ff5dc in npcm7xx_clk_write /hw/misc/npcm7xx_clk.c:799:13 +#2 0x5619214781fe in memory_region_write_accessor /softmmu/memory.c:491:5 +#3 0x561921477bfb in access_with_adjusted_size /softmmu/memory.c:552:18 +#4 0x561921477467 in memory_region_dispatch_write /softmmu/memory.c +#5 0x561921807ffb in flatview_write_continue /softmmu/physmem.c:2759:23 +#6 0x5619217fd71b in flatview_write /softmmu/physmem.c:2799:14 +#7 0x5619217fd71b in address_space_write /softmmu/physmem.c:2891:18 +#8 0x561921465eee in qtest_process_command /softmmu/qtest.c:539:13 +#9 0x561921462b97 in qtest_process_inbuf /softmmu/qtest.c:797:9 +#10 0x561921cb3286 in fd_chr_read /chardev/char-fd.c:68:9 +#11 0x7f4ad283baae in g_main_context_dispatch (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x51aae) +#12 0x56192230e363 in glib_pollfds_poll /util/main-loop.c:232:9 +#13 0x56192230e363 in os_host_main_loop_wait /util/main-loop.c:255:5 +#14 0x56192230e363 in main_loop_wait /util/main-loop.c:531:11 +#15 0x5619213c9599 in qemu_main_loop /softmmu/runstate.c:721:9 +#16 0x56191f6561fd in main /softmmu/main.c:50:5 +#17 0x7f4ad22e0cc9 in __libc_start_main csu/../csu/libc-start.c:308:16 +#18 0x56191f5a9bc9 in _start (/home/alxndr/Development/qemu/build/qemu-system-aarch64+0x3350bc9) \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1913668 b/results/classifier/mode-deepseek-r1:32b/output/system/1913668 new file mode 100644 index 00000000..c5bac285 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1913668 @@ -0,0 +1,37 @@ + + +FPE in npcm7xx_pwm_calculate_freq + +Reproducer: +cat << EOF | ./qemu-system-aarch64 -M npcm750-evb \ +-accel qtest -qtest stdio +write 0xf0103008 0x4 0x09000000 +write 0xf010300c 0x4 0xffffffff +EOF + +Trace: +../hw/misc/npcm7xx_pwm.c:94:17: runtime error: division by zero +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../hw/misc/npcm7xx_pwm.c:94:17 in +AddressSanitizer:DEADLYSIGNAL +================================================================= +==717868==ERROR: AddressSanitizer: FPE on unknown address 0x5597c7190150 (pc 0x5597c7190150 bp 0x7fffcb17c5d0 sp 0x7fffcb17c4e0 T0) +#0 0x5597c7190150 in npcm7xx_pwm_calculate_freq /hw/misc/npcm7xx_pwm.c:94:17 +#1 0x5597c7190150 in npcm7xx_pwm_update_freq /hw/misc/npcm7xx_pwm.c:122:21 +#2 0x5597c718f06d in npcm7xx_pwm_write /hw/misc/npcm7xx_pwm.c +#3 0x5597c8d241fe in memory_region_write_accessor /softmmu/memory.c:491:5 +#4 0x5597c8d23bfb in access_with_adjusted_size /softmmu/memory.c:552:18 +#5 0x5597c8d23467 in memory_region_dispatch_write /softmmu/memory.c +#6 0x5597c90b3ffb in flatview_write_continue /softmmu/physmem.c:2759:23 +#7 0x5597c90a971b in flatview_write /softmmu/physmem.c:2799:14 +#8 0x5597c90a971b in address_space_write /softmmu/physmem.c:2891:18 +#9 0x5597c8d11eee in qtest_process_command /softmmu/qtest.c:539:13 +#10 0x5597c8d0eb97 in qtest_process_inbuf /softmmu/qtest.c:797:9 +#11 0x5597c955f286 in fd_chr_read /chardev/char-fd.c:68:9 +#12 0x7f994c124aae in g_main_context_dispatch (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x51aae) +#13 0x5597c9bba363 in glib_pollfds_poll /util/main-loop.c:232:9 +#14 0x5597c9bba363 in os_host_main_loop_wait /util/main-loop.c:255:5 +#15 0x5597c9bba363 in main_loop_wait /util/main-loop.c:531:11 +#16 0x5597c8c75599 in qemu_main_loop /softmmu/runstate.c:721:9 +#17 0x5597c6f021fd in main /softmmu/main.c:50:5 +#18 0x7f994bbc9cc9 in __libc_start_main csu/../csu/libc-start.c:308:16 +#19 0x5597c6e55bc9 in _start (/home/alxndr/Development/qemu/build/qemu-system-aarch64+0x3350bc9) \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1913914 b/results/classifier/mode-deepseek-r1:32b/output/system/1913914 new file mode 100644 index 00000000..34bf8439 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1913914 @@ -0,0 +1,61 @@ + + +arm_gic: Abort in gic_clear_pending_sgi + +Reproducer: +cat << EOF | ./qemu-system-aarch64 \ +-machine virt,accel=qtest -qtest stdio +write 0x8000000 0x1 0x02 +write 0x8010000 0x1 0x03 +write 0x8010004 0x1 0x10 +write 0x8000f2f 0x1 0x0 +writel 0x8000f00 0x2065559 +write 0x8000d56 0x1 0x0 +readl 0x801000b +EOF + +Stacktrace: +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../qemu/hw/intc/arm_gic.c:173:28 in +../qemu/hw/intc/arm_gic.c:173:28: runtime error: load of misaligned address 0x6290000215c1 for type 'uint32_t' (aka 'unsigned int'), which requires 16 byte alignment +0x6290000215c1: note: pointer points here + 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 1c 00 00 80 60 00 00 00 00 00 00 00 + ^ +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../qemu/hw/intc/arm_gic.c:173:28 in +[R +0.117623] readl 0x8010015 +[R +0.117718] readl 0x801000b +qemu-fuzz-aarch64: ../qemu/hw/intc/arm_gic.c:580: uint32_t gic_clear_pending_sgi(GICState *, int, int): Assertion `s->sgi_pending[irq][cpu] != 0' failed. +==762== ERROR: libFuzzer: deadly signal + #0 0x563d4e2371f1 in __sanitizer_print_stack_trace (/home/alxndr/build-asan/qemu-fuzz-aarch64+0x350d1f1) + #1 0x563d4e182348 in fuzzer::PrintStackTrace() (/home/alxndr/build-asan/qemu-fuzz-aarch64+0x3458348) + #2 0x563d4e167493 in fuzzer::Fuzzer::CrashCallback() (/home/alxndr/build-asan/qemu-fuzz-aarch64+0x343d493) + #3 0x7feabe05350f (/lib/x86_64-linux-gnu/libpthread.so.0+0x1350f) + #4 0x7feabde8e080 in __libc_signal_restore_set /build/glibc-suXNNi/glibc-2.29/signal/../sysdeps/unix/sysv/linux/internal-signals.h:84:10 + #5 0x7feabde8e080 in raise /build/glibc-suXNNi/glibc-2.29/signal/../sysdeps/unix/sysv/linux/raise.c:48:3 + #6 0x7feabde79534 in abort /build/glibc-suXNNi/glibc-2.29/stdlib/abort.c:79:7 + #7 0x7feabde7940e in __assert_fail_base /build/glibc-suXNNi/glibc-2.29/assert/assert.c:92:3 + #8 0x7feabde86b91 in __assert_fail /build/glibc-suXNNi/glibc-2.29/assert/assert.c:101:3 + #9 0x563d4eba2a3c in gic_clear_pending_sgi /home/alxndr/build-asan/../qemu/hw/intc/arm_gic.c:580:9 + #10 0x563d4eba2a3c in gic_acknowledge_irq /home/alxndr/build-asan/../qemu/hw/intc/arm_gic.c:630:19 + #11 0x563d4ebb4ca4 in gic_cpu_read /home/alxndr/build-asan/../qemu/hw/intc/arm_gic.c:1615:17 + #12 0x563d4ebab538 in gic_thiscpu_read /home/alxndr/build-asan/../qemu/hw/intc/arm_gic.c:1771:12 + #13 0x563d5029ec2d in memory_region_read_with_attrs_accessor /home/alxndr/build-asan/../qemu/softmmu/memory.c:464:9 + #14 0x563d502705f3 in access_with_adjusted_size /home/alxndr/build-asan/../qemu/softmmu/memory.c:552:18 + #15 0x563d5026eb44 in memory_region_dispatch_read1 /home/alxndr/build-asan/../qemu/softmmu/memory.c + #16 0x563d5026eb44 in memory_region_dispatch_read /home/alxndr/build-asan/../qemu/softmmu/memory.c:1449:9 + #17 0x563d5048c5bf in flatview_read_continue /home/alxndr/build-asan/../qemu/softmmu/physmem.c:2822:23 + #18 0x563d504a9a9b in address_space_read /home/alxndr/qemu/include/exec/memory.h:2484:26 + #19 0x563d504a9a9b in qtest_process_command /home/alxndr/build-asan/../qemu/softmmu/qtest.c:568:13 + #20 0x563d504a497f in qtest_process_inbuf /home/alxndr/build-asan/../qemu/softmmu/qtest.c:797:9 + #21 0x563d504a46d5 in qtest_server_inproc_recv /home/alxndr/build-asan/../qemu/softmmu/qtest.c:904:9 + #22 0x563d50ce5cc8 in qtest_sendf /home/alxndr/build-asan/../qemu/tests/qtest/libqtest.c:438:5 + #23 0x563d50ce73a3 in qtest_read /home/alxndr/build-asan/../qemu/tests/qtest/libqtest.c:1032:5 + #24 0x563d4e264499 in __wrap_qtest_readl /home/alxndr/build-asan/../qemu/tests/qtest/fuzz/qtest_wrappers.c:138:16 + #25 0x563d4e26ee5b in op_read /home/alxndr/build-asan/../qemu/tests/qtest/fuzz/generic_fuzz.c:432:13 + #26 0x563d4e26dc46 in generic_fuzz /home/alxndr/build-asan/../qemu/tests/qtest/fuzz/generic_fuzz.c:681:17 + #27 0x563d4e261283 in LLVMFuzzerTestOneInput /home/alxndr/build-asan/../qemu/tests/qtest/fuzz/fuzz.c:151:5 + #28 0x563d4e168b51 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/alxndr/build-asan/qemu-fuzz-aarch64+0x343eb51) + #29 0x563d4e1542c2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/home/alxndr/build-asan/qemu-fuzz-aarch64+0x342a2c2) + #30 0x563d4e159d76 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/alxndr/build-asan/qemu-fuzz-aarch64+0x342fd76) + #31 0x563d4e182a32 in main (/home/alxndr/build-asan/qemu-fuzz-aarch64+0x3458a32) + #32 0x7feabde7abba in __libc_start_main /build/glibc-suXNNi/glibc-2.29/csu/../csu/libc-start.c:308:16 + #33 0x563d4e12e989 in _start (/home/alxndr/build-asan/qemu-fuzz-aarch64+0x3404989) \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1913916 b/results/classifier/mode-deepseek-r1:32b/output/system/1913916 new file mode 100644 index 00000000..07f59bd5 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1913916 @@ -0,0 +1,70 @@ + + +aarch64-virt: heap-buffer-overflow in address_space_lookup_region + +Reproducer: +cat << EOF | ./qemu-system-aarch64 \ +-machine virt,accel=qtest -qtest stdio +writel 0x8000f00 0xff4affb0 +writel 0x8000f00 0xf2f8017f +writeq 0x801000e 0x5a5a5a6c8ff7004b +writeq 0x8010010 0x5a5a5a5a73ba2f00 +writel 0x8000000 0x3bf5a03 +writel 0x8000000 0x3bf5a03 +writeq 0x8010000 0x10ffff03fbffffff +writel 0x8000f1f 0x5a55fc00 +readl 0x8011f00 +readl 0x80000d3 +readl 0x80000d3 +clock_step +writeq 0x4010008004 0x4604fffdffc54c01 +writeq 0x4010008002 0xf7478b3f5aff5a55 +writel 0x8000f00 0x2d6954 +writel 0x800005a 0x2706fcf +readq 0x800002c +readw 0x9000004 +readq 0x800002c +writeq 0x801000e 0x5555017f00017f00 +writew 0x8010000 0x55 +writew 0x8010000 0x465a +writew 0x8010000 0x55 +writew 0x8010000 0xaf00 +writeq 0x8010015 0x3b5a5a5555460000 +writeq 0x8010015 0xd546002b2b000000 +writeq 0x8010015 0xc44ea5aaaab9ffff +readq 0x8000a5a +EOF + +Stacktrace: +==638893==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x629000022b84 at pc 0x55915c484d92 bp 0x7ffcde114a00 sp 0x7ffcde1149f8 +READ of size 2 at 0x629000022b84 thread T0 + #0 0x55915c484d91 in address_space_lookup_region /home/alxndr/Development/qemu/build/../softmmu/physmem.c:345:36 + #1 0x55915c484d91 in address_space_translate_internal /home/alxndr/Development/qemu/build/../softmmu/physmem.c:359:15 + #2 0x55915c481d90 in flatview_do_translate /home/alxndr/Development/qemu/build/../softmmu/physmem.c:497:15 + #3 0x55915c48214e in flatview_translate /home/alxndr/Development/qemu/build/../softmmu/physmem.c:563:15 + #4 0x55915c107ff9 in address_space_read /home/alxndr/Development/qemu/include/exec/memory.h:2477:18 + #5 0x55915c107ff9 in qtest_process_command /home/alxndr/Development/qemu/build/../softmmu/qtest.c:572:13 + #6 0x55915c102b97 in qtest_process_inbuf /home/alxndr/Development/qemu/build/../softmmu/qtest.c:797:9 + #7 0x55915c953286 in fd_chr_read /home/alxndr/Development/qemu/build/../chardev/char-fd.c:68:9 + #8 0x7f02be25daae in g_main_context_dispatch (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x51aae) + #9 0x55915cfae363 in glib_pollfds_poll /home/alxndr/Development/qemu/build/../util/main-loop.c:232:9 + #10 0x55915cfae363 in os_host_main_loop_wait /home/alxndr/Development/qemu/build/../util/main-loop.c:255:5 + #11 0x55915cfae363 in main_loop_wait /home/alxndr/Development/qemu/build/../util/main-loop.c:531:11 + #12 0x55915c069599 in qemu_main_loop /home/alxndr/Development/qemu/build/../softmmu/runstate.c:721:9 + #13 0x55915a2f61fd in main /home/alxndr/Development/qemu/build/../softmmu/main.c:50:5 + #14 0x7f02bdd02cc9 in __libc_start_main csu/../csu/libc-start.c:308:16 + #15 0x55915a249bc9 in _start (/home/alxndr/Development/qemu/build/qemu-system-aarch64+0x3350bc9) + +0x629000022b84 is located 660 bytes to the right of 18160-byte region [0x62900001e200,0x6290000228f0) +allocated by thread T0 here: + #0 0x55915a2c3c3d in malloc (/home/alxndr/Development/qemu/build/qemu-system-aarch64+0x33cac3d) + #1 0x7f02be263a88 in g_malloc (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x57a88) + #2 0x55915c932cbd in qdev_new /home/alxndr/Development/qemu/build/../hw/core/qdev.c:153:19 + #3 0x55915b559360 in create_gic /home/alxndr/Development/qemu/build/../hw/arm/virt.c:631:16 + #4 0x55915b5449d2 in machvirt_init /home/alxndr/Development/qemu/build/../hw/arm/virt.c:1966:5 + #5 0x55915a62bac0 in machine_run_board_init /home/alxndr/Development/qemu/build/../hw/core/machine.c:1169:5 + #6 0x55915c02b8d8 in qemu_init_board /home/alxndr/Development/qemu/build/../softmmu/vl.c:2455:5 + #7 0x55915c02b8d8 in qmp_x_exit_preconfig /home/alxndr/Development/qemu/build/../softmmu/vl.c:2526:5 + #8 0x55915c035d91 in qemu_init /home/alxndr/Development/qemu/build/../softmmu/vl.c:3533:9 + #9 0x55915a2f61f8 in main /home/alxndr/Development/qemu/build/../softmmu/main.c:49:5 + #10 0x7f02bdd02cc9 in __libc_start_main csu/../csu/libc-start.c:308:16 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1914849 b/results/classifier/mode-deepseek-r1:32b/output/system/1914849 new file mode 100644 index 00000000..609436bd --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1914849 @@ -0,0 +1,56 @@ + + +mprotect fails after MacOS 11.2 on arm mac + +I got the following error when I ran qemu on arm mac(MacOS 11.2). + +``` +$ ./qemu-system-x86_64 +qemu-system-x86_64: qemu_mprotect__osdep: mprotect failed: Permission denied +** +ERROR:../tcg/tcg.c:844:tcg_region_init: assertion failed: (!rc) +Bail out! ERROR:../tcg/tcg.c:844:tcg_region_init: assertion failed: (!rc) +[1] 34898 abort ./qemu-system-x86_64 +``` + +I tested the same version of qemu on intel mac(MacOS 11.2), but it works fine. + +And my friend told me that they did not have this error with MacOS 11.1. + +So, I think it is CPU architecture or an OS version dependent error. + + +Environment: + +Qemu commit id: d0dddab40e472ba62b5f43f11cc7dba085dabe71 +OS: MacOS 11.2(20D64) +Hardware: MacBook Air (M1, 2020) + + +How to build: + +``` +mkdir build/ +cd build/ +../configure --target-list=aarch64-softmmu,x86_64-softmmu +make +``` + + +How to reproduce: + +``` +./qemu-system-x86_64 +``` + + +Error message: + +``` +$ ./qemu-system-x86_64 +qemu-system-x86_64: qemu_mprotect__osdep: mprotect failed: Permission denied +** +ERROR:../tcg/tcg.c:844:tcg_region_init: assertion failed: (!rc) +Bail out! ERROR:../tcg/tcg.c:844:tcg_region_init: assertion failed: (!rc) +[1] 34898 abort ./qemu-system-x86_64 +``` \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1915535 b/results/classifier/mode-deepseek-r1:32b/output/system/1915535 new file mode 100644 index 00000000..d4ee3c4a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1915535 @@ -0,0 +1,70 @@ + + +Assertion `child->perm & BLK_PERM_WRITE' failed in bdrv_co_write_req_prepare through atapi + +Maybe this is a duplicate of https://bugs.launchpad.net/qemu/+bug/1906693 ... +In any case, ATAPI is probably a lot more common than megasas, so this might be a more useful reproducer + +==Reproducer== + +cat << EOF | ./qemu-system-i386 -display none \ +-m 512M -machine q35 -nodefaults \ +-drive file=null-co://,if=none,format=raw,id=disk0 \ +-device ide-cd,drive=disk0 -machine accel=qtest -qtest stdio +outl 0xcf8 0x8000fa24 +outl 0xcfc 0xe0000000 +outl 0xcf8 0x8000fa04 +outw 0xcfc 0x06 +write 0xe0000398 0x1 0x01 +write 0x63 0x1 0x06 +write 0x68 0x1 0x06 +write 0x69 0x1 0xf8 +write 0x6a 0x1 0xff +write 0xfff806 0x1 0x27 +write 0xfff807 0x1 0x80 +write 0xfff808 0x1 0x61 +write 0x1005734 0x1 0x3f +write 0x1005774 0x1 0x20 +write 0x1005784 0x1 0x34 +write 0x10057a4 0x1 0x27 +write 0x10057b4 0x1 0x3f +write 0x10057c3 0x1 0xce +write 0x10057d4 0x1 0x1a +write 0x10057e3 0x1 0xff +write 0x10057e4 0x1 0x3f +write 0x10057f4 0x1 0x38 +write 0x1005814 0x1 0x3e +write 0x1005823 0x1 0x60 +write 0x1005824 0x1 0x2d +write 0x1005833 0x1 0x74 +write 0x1005834 0x1 0x01 +write 0x1005863 0x1 0xff +write 0x1005883 0x1 0x5a +write 0x1005884 0x1 0x06 +write 0xe00003b8 0x1 0x08 +EOF + + +==Stack Trace== +i386: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x5a00) +qemu-fuzz-i386-target-generic-fuzz-ahci-atapi: ../block/io.c:1982: int +bdrv_co_write_req_prepare(BdrvChild *, int64_t, int64_t, BdrvTrackedRequest +*, int): Assertion `child->perm & BLK_PERM_WRITE' failed. +==279048== ERROR: libFuzzer: deadly signal +#0 0x560c92718f50 in __sanitizer_print_stack_trace /src/llvm-project/compiler-rt/lib/ubsan/ubsan_diag_standalone.cpp:33:3 +#1 0x560c926c2f98 in fuzzer::PrintStackTrace() /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerUtil.cpp:210:5 +#2 0x560c926a7fd3 in fuzzer::Fuzzer::CrashCallback() /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:233:3 +#3 0x7ff7d707038f in libpthread.so.0 +#4 0x7ff7d66a8437 in raise +#5 0x7ff7d66aa039 in abort +#6 0x7ff7d66a0be6 in libc.so.6 +#7 0x7ff7d66a0c91 in __assert_fail +#8 0x560c92f4fc79 in bdrv_co_write_req_prepare /src/qemu/block/io.c:1982:13 +#9 0x560c92f4c974 in bdrv_aligned_pwritev /src/qemu/block/io.c:2065:11 +#10 0x560c92f4b937 in bdrv_co_pwritev_part /src/qemu/block/io.c:2270:11 +#11 0x560c92f392e7 in blk_do_pwritev_part /src/qemu/block/block-backend.c:1260:11 +#12 0x560c92f39a55 in blk_aio_write_entry /src/qemu/block/block-backend.c:1476:17 +#13 0x560c930d19d5 in coroutine_trampoline /src/qemu/util/coroutine-ucontext.c:173:9 +#14 0x7ff7d66bd5df in libc.so.6 + +OSS-Fuzz link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30857 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1915539 b/results/classifier/mode-deepseek-r1:32b/output/system/1915539 new file mode 100644 index 00000000..8411026d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1915539 @@ -0,0 +1,96 @@ + + +Null-ptr dereference on AHCICmdHdr in ahci_pio_transfer + +== Reproducer == + +cat << EOF | ./qemu-system-i386 -display none \ +-m 512M -machine q35 -nodefaults \ +-drive file=null-co://,if=none,format=raw,id=disk0 \ +-device ide-hd,drive=disk0 -machine accel=qtest -qtest stdio +outl 0xcf8 0x8000fa24 +outl 0xcfc 0xe0000000 +outl 0xcf8 0x8000fa04 +outw 0xcfc 0x06 +write 0x10a 0x1 0x02 +write 0xe0000398 0x1 0x01 +write 0x20000 0x1 0x27 +write 0x20001 0x1 0x80 +write 0x20002 0x1 0x20 +write 0x20005 0x1 0x02 +write 0xe00003b8 0x2 0x0101 +write 0xe0000004 0x1 0x01 +write 0x2bb 0x1 0x00 +write 0x2bf 0x1 0x00 +write 0x2cf 0x1 0x00 +write 0x2db 0x1 0x00 +write 0x2df 0x1 0x00 +write 0x2ed 0x1 0x00 +write 0x2ef 0x1 0x00 +write 0x2fb 0x1 0x00 +write 0x2ff 0x1 0x00 +write 0x31f 0x1 0x00 +write 0x32b 0x1 0x00 +write 0x32f 0x1 0x00 +write 0x337 0x1 0x00 +write 0x33f 0x1 0x00 +write 0x347 0x1 0x00 +write 0x357 0x1 0x00 +write 0x35f 0x1 0x00 +write 0x36b 0x1 0x00 +write 0x36f 0x1 0x00 +write 0x377 0x1 0x00 +write 0x37f 0x1 0x00 +write 0x397 0x1 0x00 +write 0x39f 0x1 0x00 +write 0x3ab 0x1 0x00 +write 0x3af 0x1 0x00 +write 0x3b7 0x1 0x00 +write 0x3bf 0x1 0x00 +write 0x3c7 0x1 0x00 +write 0x3d7 0x1 0x00 +write 0x3df 0x1 0x00 +write 0x3eb 0x1 0x00 +write 0x3ef 0x1 0x00 +write 0x3f7 0x1 0x00 +write 0x3ff 0x1 0x00 +write 0xe0000394 0x1 0x00 +write 0xe0000398 0x1 0x01 +EOF + +== Stack Trace == +../hw/ide/ahci.c:1349:46: runtime error: member access within null pointer of +type 'AHCICmdHdr' (aka 'struct AHCICmdHdr') SUMMARY: +UndefinedBehaviorSanitizer: undefined-behavior ../hw/ide/ahci.c:1349:46 in +../hw/ide/ahci.c:1349:46: runtime error: load of null pointer of type +'uint16_t' (aka 'unsigned short') +SUMMARY: UndefinedBehaviorSanitizer: +undefined-behavior ../hw/ide/ahci.c:1349:46 in AddressSanitizer:DEADLYSIGNAL +================================================================= +==238806==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc +0x555787d414c9 bp 0x7fffe1bb41a0 sp 0x7fffe1bb3fe0 T0) +==238806==The signal is caused by a READ memory access. +==238806==Hint: address points to the zero page. +#0 0x555787d414c9 in ahci_pio_transfer build/../hw/ide/ahci.c:1349:46 +#1 0x5557886089d6 in ide_transfer_start_norecurse build/../hw/ide/core.c:553:5 +#2 0x555788638945 in ide_transfer_start build/../hw/ide/core.c:560:9 +#3 0x555788638945 in ide_sector_read_cb build/../hw/ide/core.c:761:5 +#4 0x55578860c989 in ide_buffered_readv_cb build/../hw/ide/core.c:656:9 +#5 0x5557898999d6 in blk_aio_complete build/../block/block-backend.c:1412:9 +#6 0x555789db8d26 in aio_bh_poll build/../util/async.c:164:13 +#7 0x555789d80704 in aio_dispatch build/../util/aio-posix.c:381:5 +#8 0x555789dbd94c in aio_ctx_dispatch build/../util/async.c:306:5 +#9 0x7f6dcedcfbaa in g_main_context_dispatch (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x51baa) +#10 0x555789dc3763 in glib_pollfds_poll build/../util/main-loop.c:232:9 +#11 0x555789dc3763 in os_host_main_loop_wait build/../util/main-loop.c:255:5 +#12 0x555789dc3763 in main_loop_wait build/../util/main-loop.c:531:11 +#13 0x555789206a49 in qemu_main_loop build/../softmmu/runstate.c:722:9 +#14 0x555787d052ed in main build/../softmmu/main.c:50:5 +#15 0x7f6dcd84ecc9 in __libc_start_main csu/../csu/libc-start.c:308:16 +#16 0x555787c5b619 in _start (system-i386+0x2a13619) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV build/../hw/ide/ahci.c:1349:46 in ahci_pio_transfer +==238806==ABORTING + +OSS-Fuzz link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30861 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1915682 b/results/classifier/mode-deepseek-r1:32b/output/system/1915682 new file mode 100644 index 00000000..9ab38ebf --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1915682 @@ -0,0 +1,100 @@ + + +i386-linux-user wine exception regression tests fail + +When trying to run wine (latest devel from git) regression tests for ntdll in a statically linked qemu-i386 (commit 392b9a74b9b621c52d05e37bc6f41f1bbab5c6f8) on arm32 (raspberry pi 4) in a debian buster chroot, the exception tests fail at the first test with an infinite exception loop. + +WINEDEBUG=+seh wine wine/dlls/ntdll/tests/ntdll_test.exe exception + + +Working x86_64 system running 32-bit code + +0024:warn:seh:dispatch_exception EXCEPTION_ACCESS_VIOLATION exception (code=c0000005) raised +0024:trace:seh:dispatch_exception eax=00000000 ebx=7ffc2000 ecx=004e0ef4 edx=003c0004 esi=003c0000 edi=00000000 +0024:trace:seh:dispatch_exception ebp=0085fa08 esp=0085f9ac cs=0023 ds=002b es=002b fs=0063 gs=006b flags=00010246 +0024:trace:seh:call_vectored_handlers calling handler at 7B00B460 code=c0000005 flags=0 +0024:trace:seh:call_vectored_handlers handler at 7B00B460 returned 0 +0024:trace:seh:call_stack_handlers calling handler at 004178B0 code=c0000005 flags=0 +0024:trace:seh:call_stack_handlers handler at 004178B0 returned 0 +0024:trace:seh:dispatch_exception call_stack_handlers continuing +0024:trace:seh:NtGetContextThread 0xfffffffe: dr0=42424240 dr1=00000000 dr2=126bb070 dr3=0badbad0 dr6=00000000 dr7=ffff0115 + + +Non-working qemu + +0024:warn:seh:dispatch_exception EXCEPTION_ACCESS_VIOLATION exception (code=c0000005) raised +0024:trace:seh:dispatch_exception eax=00000000 ebx=3ffe2000 ecx=004e0ef4 edx=003c0004 esi=003c0000 edi=00000000 +0024:trace:seh:dispatch_exception ebp=0085fa08 esp=0085f9ac cs=0023 ds=002b es=002b fs=003b gs=0033 flags=00000246 +0024:trace:seh:call_vectored_handlers calling handler at 7B00B460 code=c0000005 flags=0 +0024:trace:seh:call_vectored_handlers handler at 7B00B460 returned 0 +0024:trace:seh:call_stack_handlers calling handler at 004178B0 code=c0000005 flags=0 +0024:trace:seh:call_stack_handlers handler at 004178B0 returned 0 +0024:trace:seh:dispatch_exception call_stack_handlers continuing +0024:trace:seh:dispatch_exception call_stack_handlers ret status = 0 +0024:trace:seh:dispatch_exception code=0 flags=1 addr=7BC2389C ip=7bc2389c tid=0024 + +The non-working verion is never managing to set the CPU context using NtContinue/SetContextThread back to the correct running thread stack and IP. It executes as if the context restore just returns to the function that called NtContinue() (dispatch_exception(), not the function that raised the exception or one of its parent exception handlers). + +It looks like NtSetContextThread(), specifically the asm function set_full_cpu_context() is being handled incorrectly. + +wine code below. note interesting use of iret with no previous interrupt call. The exception handler is called with a jmp. + +/*********************************************************************** + * set_full_cpu_context + * + * Set the new CPU context. + */ +extern void set_full_cpu_context( const CONTEXT *context ); +__ASM_GLOBAL_FUNC( set_full_cpu_context, + "movl $0,%fs:0x1f8\n\t" /* x86_thread_data()->syscall_frame = NULL */ + "movl 4(%esp),%ecx\n\t" + "movw 0x8c(%ecx),%gs\n\t" /* SegGs */ + "movw 0x90(%ecx),%fs\n\t" /* SegFs */ + "movw 0x94(%ecx),%es\n\t" /* SegEs */ + "movl 0x9c(%ecx),%edi\n\t" /* Edi */ + "movl 0xa0(%ecx),%esi\n\t" /* Esi */ + "movl 0xa4(%ecx),%ebx\n\t" /* Ebx */ + "movl 0xb4(%ecx),%ebp\n\t" /* Ebp */ + "movw %ss,%ax\n\t" + "cmpw 0xc8(%ecx),%ax\n\t" /* SegSs */ + "jne 1f\n\t" + /* As soon as we have switched stacks the context structure could + * be invalid (when signal handlers are executed for example). Copy + * values on the target stack before changing ESP. */ + "movl 0xc4(%ecx),%eax\n\t" /* Esp */ + "leal -4*4(%eax),%eax\n\t" + "movl 0xc0(%ecx),%edx\n\t" /* EFlags */ + ".byte 0x36\n\t" + "movl %edx,3*4(%eax)\n\t" + "movl 0xbc(%ecx),%edx\n\t" /* SegCs */ + ".byte 0x36\n\t" + "movl %edx,2*4(%eax)\n\t" + "movl 0xb8(%ecx),%edx\n\t" /* Eip */ + ".byte 0x36\n\t" + "movl %edx,1*4(%eax)\n\t" + "movl 0xb0(%ecx),%edx\n\t" /* Eax */ + ".byte 0x36\n\t" + "movl %edx,0*4(%eax)\n\t" + "pushl 0x98(%ecx)\n\t" /* SegDs */ + "movl 0xa8(%ecx),%edx\n\t" /* Edx */ + "movl 0xac(%ecx),%ecx\n\t" /* Ecx */ + "popl %ds\n\t" + "movl %eax,%esp\n\t" + "popl %eax\n\t" + "iret\n" + /* Restore the context when the stack segment changes. We can't use + * the same code as above because we do not know if the stack segment + * is 16 or 32 bit, and 'movl' will throw an exception when we try to + * access memory above the limit. */ + "1:\n\t" + "movl 0xa8(%ecx),%edx\n\t" /* Edx */ + "movl 0xb0(%ecx),%eax\n\t" /* Eax */ + "movw 0xc8(%ecx),%ss\n\t" /* SegSs */ + "movl 0xc4(%ecx),%esp\n\t" /* Esp */ + "pushl 0xc0(%ecx)\n\t" /* EFlags */ + "pushl 0xbc(%ecx)\n\t" /* SegCs */ + "pushl 0xb8(%ecx)\n\t" /* Eip */ + "pushl 0x98(%ecx)\n\t" /* SegDs */ + "movl 0xac(%ecx),%ecx\n\t" /* Ecx */ + "popl %ds\n\t" + "iret" ) \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1916112 b/results/classifier/mode-deepseek-r1:32b/output/system/1916112 new file mode 100644 index 00000000..cbacabb0 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1916112 @@ -0,0 +1,61 @@ + + +Illegal instruction crash of QEMU on Jetson Nano + +I have a jetson nano (arm64 SBC) and I want to check the native emulation performance of Raspbian Buster. I used the info available here: + +https://github.com/dhruvvyas90/qemu-rpi-kernel/tree/master/native-emuation + +I have Xubuntut 20.04 with KVM enabled kernel running on the Jetson Nano + +However QEMU crashes with "Illegal Instruction" during kernel boot. I have a built latest QEMU from sources with following configuration + +./configure --prefix=/usr/local --target-list=aarch64-softmmu,arm-softmmu --enable-guest-agent --enable-vnc --enable-vnc-jpeg --enable-vnc-png --enable-kvm --enable-spice --enable-sdl --enable-gtk --enable-virglrenderer --enable-opengl + +qemu-system-aarch64 --version +QEMU emulator version 5.2.50 (v5.2.0-1731-g5b19cb63d9) + +When I run as follows: + +../build/qemu-system-aarch64 -M raspi3 +-append "rw earlyprintk loglevel=8 console=ttyAMA0,115200 dwc_otg.lpm_enable=0 root=/dev/mmcblk0p2 rootdelay=1" +-dtb ./bcm2710-rpi-3-b-plus.dtb +-sd /media/96747D21747D0571/JetsonNano/2020-08-20-raspios-buster-armhf-full.qcow2 +-kernel ./kernel8.img +-m 1G -smp 4 -serial stdio -usb -device usb-mouse -device usb-kbd + +I get : +[ 74.994834] systemd[1]: Condition check resulted in FUSE Control File System being skipped. +[ 76.281274] systemd[1]: Starting Apply Kernel Variables... +Starting Apply Kernel Variables... +Illegal instruction (core dumped) + +When I use GDB I see this: + +Thread 8 "qemu-system-aar" received signal SIGILL, Illegal instruction. +[Switching to Thread 0x7fad7f9ba0 (LWP 28037)] +0x0000007f888ac690 in code_gen_buffer () +(gdb) bt +#0 0x0000007f888ac690 in code_gen_buffer () +#1 0x0000005555d7c038 in cpu_tb_exec (tb_exit=, itb=, cpu=0x7fb4502c40) +at ../accel/tcg/cpu-exec.c:191 +#2 cpu_loop_exec_tb (tb_exit=, last_tb=, tb=, cpu=0x7fb4502c40) +at ../accel/tcg/cpu-exec.c:708 +#3 cpu_exec (cpu=cpu@entry=0x7fb4502c40) at ../accel/tcg/cpu-exec.c:819 +.. + +I have just two questions: + +Is this a problem with QEMU or is there anything specific build or options I need to use. Any specific version of QEMU should be used ? + +Why is TCG used as the accelerator when KVM is present. Is it possible and how to use KVM ? + +If I enabled the KVM then I get this error: + +../build/qemu-system-aarch64 -M raspi3 -enable-kvm -append "rw earlyprintk loglevel=8 console=ttyAMA0,115200 dwc_otg.lpm_enable=0 root=/dev/mmcblk0p2 rootdelay=1" -dtb ./bcm2710-rpi-3-b-plus.dtb -sd /media/96747D21747D0571/JetsonNano/2020-08-20-raspios-buster-armhf-full.qcow2 -kernel ./kernel8.img -m 1G -smp 4 -serial stdio -usb -device usb-mouse -device usb-kbd +WARNING: Image format was not specified for '/media/96747D21747D0571/JetsonNano/2020-08-20-raspios-buster-armhf-full.img' and probing guessed raw. + Automatically detecting the format is dangerous for raw images, write operations on block 0 will be restricted. + Specify the 'raw' format explicitly to remove the restrictions. +qemu-system-aarch64: ../softmmu/physmem.c:750: cpu_address_space_init: Assertion `asidx == 0 || !kvm_enabled()' failed. + +Thanks a lot. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1916269 b/results/classifier/mode-deepseek-r1:32b/output/system/1916269 new file mode 100644 index 00000000..a2f96bcb --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1916269 @@ -0,0 +1,21 @@ + + +TCG: QEMU incorrectly raises exception on SSE4.2 CRC32 instruction + +If I run FreeBSD on QEMU 5.2 with TCG acceleration -cpu Nehalem, I get a FPU exception when executing crc32 (https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=253617). This is not a problem with the default CPU (or KVM) since that does not support SSE 4.2. + +Attaching GDB shows this is triggered in target/i386/tcg/translate.c:3067 + + /* simple MMX/SSE operation */ + if (s->flags & HF_TS_MASK) { + gen_exception(s, EXCP07_PREX, pc_start - s->cs_base); + return; + } + +However, according to https://software.intel.com/sites/default/files/m/8/b/8/D9156103.pdf, page 61 the CRC32 instruction works no matter what the value of the TS bit. + +The code sequence in question is: +0xffffffff8105a4de <+126>: f2 48 0f 38 f1 de crc32q %rsi,%rbx +0xffffffff8105a4e4 <+132>: f2 48 0f 38 f1 ca crc32q %rdx,%rcx. + +This should work even with the FPU disabled. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1916394 b/results/classifier/mode-deepseek-r1:32b/output/system/1916394 new file mode 100644 index 00000000..5739997e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1916394 @@ -0,0 +1,20 @@ + + +[git] Cannot build qemu: FAILED: target/hexagon/semantics_generated.pyinc + +Hello. + +I tried to build Qemu at commit 4115aec9af2a3de5fa89a0b1daa12debcd7741ff but it stops with this error message: + +[code] +Found ninja-1.10.2 at /usr/bin/ninja +[632/9068] Generating semantics_generated.pyinc with a custom command +FAILED: target/hexagon/semantics_generated.pyinc +@INPUT@ target/hexagon/semantics_generated.pyinc +/bin/sh: line 1: @INPUT@: command not found +[637/9068] Compiling C object fsdev/vi...proxy-helper.p/virtfs-proxy-helper.c.o +ninja: build stopped: subcommand failed. +[/code] + +ninja version: 1.10.2 +meson version: 0.57.1 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1917 b/results/classifier/mode-deepseek-r1:32b/output/system/1917 new file mode 100644 index 00000000..930118f8 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1917 @@ -0,0 +1,53 @@ + + +cargo on ppc64 fails: invalid instruction: *EDIT*: on ntpdate as well +Description of problem: +Machine boots, +but when compiling a rust library, the following issue appears: +``` +cargo build --release --manifest-path rust-src/Cargo.toml +cargo[376]: illegal instruction (4) at 12e0933c0 nip 12e0933c0 lr 12dd7c768 code 1 in cargo[12dc10000+956000] +cargo[376]: code: 00000000 00000000 00000000 7c0802a6 f8010010 f821ff11 fba100d8 60000000 +cargo[376]: code: fbc100e0 8862cd50 28030000 418200d4 <104214c4> 38810070 3bc00000 7c4021ce +make: *** [Makefile:133: rust-src/target/release/libbcachefs_rust.a] Illegal instruction (core dumped) +make: *** Waiting for unfinished jobs.... +ar[375]: illegal instruction (4) at 3fff9b2a4dac nip 3fff9b2a4dac lr 3fff9b2a4da4 code 1 in libLLVM-16.so.1[3fff99f10000+792f000] +ar[375]: code: f87d0028 7fa3eb78 b29d0090 f89d0020 4810a8c1 60000000 7f83e378 7fa4eb78 +ar[375]: code: 7fc5f378 49bfd3e1 e8410028 60000000 <104214c4> 38810070 fb610080 eba29fe0 +make: *** [Makefile:129: libbcachefs.a] Illegal instruction (core dumped) +make: *** Deleting file 'libbcachefs.a' +``` +the core dump files of cargo and ar are attached + +~~I have no clue whether this is a rustc or qemu bug, so please let me know if this issue should be forwarded to rust devs~~ +EDIT: as this happens with ntpdate as well, I think it's an emulator issue: + +``` +ntpdig[1179]: illegal instruction (4) at 102382c4 nip 102382c4 lr 102382a8 code 1 in python3.11[10000000+63e000] +ntpdig[1179]: code: 3d22ffdd c8094448 fc1e0000 41c2022c 4bde9b5d e8410028 3d42ffdd 39200000 +ntpdig[1179]: code: c80a4450 91230000 fc1e0000 41c001a4 <ffe0f02c> fc1ff800 41c30280 3d22ffdd +``` +Steps to reproduce: +1. create a debian ppc64 root image using debian sid & debootstrap +2. install rust using rustup +3. compile bcachefs-tools in ppc64 + +2b. Install ntpdate using apt-get ntpdate +3b. run ntpdate +Additional information: +Core dump command: +``` +cat /proc/sys/kernel/core_pattern +|/bin/cp --sparse=always /dev/stdin /host//repos/janpieter/linux/bcachefs/ktest-out/core.%e.PID%p.SIG%s.TIME%t +``` + + +[core.ar.PID374.SIG4.TIME1696070088.xz](/uploads/6a540c4d13351871b1e22153ad87ab99/core.ar.PID374.SIG4.TIME1696070088.xz) AR core dump + +[core.ar.PID375.SIG4.TIME1696070088.xz](/uploads/7c314eba58c2190e3a9fbd88f8eb1242/core.ar.PID375.SIG4.TIME1696070088.xz) AR core dump + +[core.cargo.PID375.SIG4.TIME1696070087.xz](/uploads/0097d457eb2d25e0123874b59405647a/core.cargo.PID375.SIG4.TIME1696070087.xz) cargo core dump + +[core.cargo.PID376.SIG4.TIME1696070087.xz](/uploads/53834fa9608036d6de9dafc3f778f165/core.cargo.PID376.SIG4.TIME1696070087.xz) cargo core dump + +[core.ntpdig.PID1171.SIG4.TIME1696070657.xz](/uploads/8a96d86338d7c6bebe39657a24f570d8/core.ntpdig.PID1171.SIG4.TIME1696070657.xz) ntpdig core dump diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1917082 b/results/classifier/mode-deepseek-r1:32b/output/system/1917082 new file mode 100644 index 00000000..ba32660c --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1917082 @@ -0,0 +1,130 @@ + + +[OSS-Fuzz] Issue 27574 e1000: Loopback-related stack-overflow + +=== Reproducer === +cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \ +512M -M q35 -nodefaults -device e1000,netdev=net0 -netdev user,id=net0 \ +-qtest /dev/null -qtest stdio +outl 0xcf8 0x80000813 +outl 0xcfc 0xfe +outl 0xcf8 0x80000803 +outw 0xcfc 0x0600 +write 0xfe000102 0x1 0x0a +writel 0xfe000020 0x420ff00 +write 0xfe00280a 0x2 0x0828 +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +clock_step +write 0xfe00281b 0x1 0x08 +write 0xf9b 0x1 0x01 +write 0x2170 0x1 0x14 +write 0x2171 0x1 0x38 +write 0x2173 0x1 0xfe +write 0xfe000402 0x1 0x02 +write 0xfe00380a 0x2 0x0210 +write 0xfe003818 0x1 0xfa +EOF + +=== Stack-trace === +==288216==ERROR: AddressSanitizer: stack-overflow on address 0x7fff51c96f48 (pc 0x56247061af36 bp 0x7fff51c97790 sp 0x7fff51c96f50 T0) +#0 0x56247061af36 in __asan_memcpy (/home/alxndr/Development/qemu/build/qemu-system-i386+0x2baff36) +#1 0x5624718eb70d in flatview_read_continue /home/alxndr/Development/qemu/build/../softmmu/physmem.c:2846:13 +#2 0x5624718ecd1b in flatview_read /home/alxndr/Development/qemu/build/../softmmu/physmem.c:2879:12 +#3 0x5624718ecd1b in address_space_read_full /home/alxndr/Development/qemu/build/../softmmu/physmem.c:2892:18 +#4 0x562470bcb75b in dma_memory_rw_relaxed /home/alxndr/Development/qemu/include/sysemu/dma.h:88:12 +#5 0x562470bcb75b in dma_memory_rw /home/alxndr/Development/qemu/include/sysemu/dma.h:127:12 +#6 0x562470bcb75b in pci_dma_rw /home/alxndr/Development/qemu/include/hw/pci/pci.h:803:12 +#7 0x562470bcb75b in pci_dma_read /home/alxndr/Development/qemu/include/hw/pci/pci.h:821:12 +#8 0x562470bcb75b in e1000_receive_iov /home/alxndr/Development/qemu/build/../hw/net/e1000.c:954:9 +#9 0x562470bca465 in e1000_receive /home/alxndr/Development/qemu/build/../hw/net/e1000.c:1025:12 +#10 0x562470bc9671 in e1000_send_packet /home/alxndr/Development/qemu/build/../hw/net/e1000.c:549:9 +#11 0x562470bc7dd8 in xmit_seg /home/alxndr/Development/qemu/build/../hw/net/e1000.c +#12 0x562470bc4dfe in process_tx_desc /home/alxndr/Development/qemu/build/../hw/net/e1000.c:701:9 +#13 0x562470bc4dfe in start_xmit /home/alxndr/Development/qemu/build/../hw/net/e1000.c:756:9 +#14 0x562470bc4dfe in set_tctl /home/alxndr/Development/qemu/build/../hw/net/e1000.c:1127:5 +#15 0x5624719ef2f6 in memory_region_write_accessor /home/alxndr/Development/qemu/build/../softmmu/memory.c:491:5 +#16 0x5624719eed63 in access_with_adjusted_size /home/alxndr/Development/qemu/build/../softmmu/memory.c:552:18 +#17 0x5624719ee5c0 in memory_region_dispatch_write /home/alxndr/Development/qemu/build/../softmmu/memory.c +#18 0x5624718f7776 in flatview_write_continue /home/alxndr/Development/qemu/build/../softmmu/physmem.c:2776:23 +#19 0x5624718ed13b in flatview_write /home/alxndr/Development/qemu/build/../softmmu/physmem.c:2816:14 +#20 0x5624718ed13b in address_space_write /home/alxndr/Development/qemu/build/../softmmu/physmem.c:2908:18 +#21 0x562470bcba6b in dma_memory_rw_relaxed /home/alxndr/Development/qemu/include/sysemu/dma.h:88:12 +#22 0x562470bcba6b in dma_memory_rw /home/alxndr/Development/qemu/include/sysemu/dma.h:127:12 +#23 0x562470bcba6b in pci_dma_rw /home/alxndr/Development/qemu/include/hw/pci/pci.h:803:12 +#24 0x562470bcba6b in pci_dma_write /home/alxndr/Development/qemu/include/hw/pci/pci.h:839:12 +#25 0x562470bcba6b in e1000_receive_iov /home/alxndr/Development/qemu/build/../hw/net/e1000.c:967:21 +#26 0x562470bca465 in e1000_receive /home/alxndr/Development/qemu/build/../hw/net/e1000.c:1025:12 +#27 0x562470bc9671 in e1000_send_packet /home/alxndr/Development/qemu/build/../hw/net/e1000.c:549:9 +... \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1917085 b/results/classifier/mode-deepseek-r1:32b/output/system/1917085 new file mode 100644 index 00000000..1c7dc3a0 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1917085 @@ -0,0 +1,64 @@ + + + [OSS-Fuzz] Issue 30588 pcnet: Loopback-related stack-overflow + +=== Reproducer === +cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \ +512M -machine q35 -nodefaults -device pcnet,netdev=net0 -netdev \ +user,id=net0 -qtest /dev/null -qtest stdio +outl 0xcf8 0x80000810 +outl 0xcfc 0xc001 +outl 0xcf8 0x80000804 +outw 0xcfc 0x7 +outl 0xc011 0xff14ff +outl 0xcf8 0x80000815 +outl 0xcfc 0xffffffff +outl 0xc015 0x35a +inl 0xc012 +outw 0xc010 0x6165 +outw 0xc010 0x1127 +write 0x0 0x1 0x56 +write 0x2 0x1 0xff +write 0x15 0x1 0xff +write 0x16 0x1 0xff +write 0x17 0x1 0xff +write 0x18 0x1 0xfd +write 0x19 0x1 0x59 +write 0x1a 0x1 0xfe +write 0x1b 0x1 0xff +outw 0xc010 0x1db +EOF + +=== Stack-trace === +==312573==ERROR: AddressSanitizer: stack-overflow on address 0x7ffd5bb4cec8 (pc 0x55a8f1c9cf36 bp 0x7ffd5bb4d710 sp 0x7ffd5bb4ced0 T0) +#0 0x55a8f1c9cf36 in __asan_memcpy (/home/alxndr/Development/qemu/build/qemu-system-i386+0x2baff36) +#1 0x55a8f2f54ddf in flatview_do_translate /home/alxndr/Development/qemu/build/../softmmu/physmem.c:518:12 +#2 0x55a8f2f6ec8e in flatview_translate /home/alxndr/Development/qemu/build/../softmmu/physmem.c:568:15 +#3 0x55a8f2f6ec8e in flatview_read /home/alxndr/Development/qemu/build/../softmmu/physmem.c:2878:10 +#4 0x55a8f2f6ec8e in address_space_read_full /home/alxndr/Development/qemu/build/../softmmu/physmem.c:2892:18 +#5 0x55a8f273036e in pcnet_rmd_load /home/alxndr/Development/qemu/build/../hw/net/pcnet.c:381:9 +#6 0x55a8f272e386 in pcnet_rdte_poll /home/alxndr/Development/qemu/build/../hw/net/pcnet.c:896:9 +#7 0x55a8f27299d0 in pcnet_receive /home/alxndr/Development/qemu/build/../hw/net/pcnet.c:1016:9 +#8 0x55a8f27406be in pcnet_transmit /home/alxndr/Development/qemu/build/../hw/net/pcnet.c:1253:13 +#9 0x55a8f2735b4c in pcnet_poll_timer /home/alxndr/Development/qemu/build/../hw/net/pcnet.c:1322:9 +#10 0x55a8f273c353 in pcnet_ioport_readl /home/alxndr/Development/qemu/build/../hw/net/pcnet.c:1660:5 +#11 0x55a8f2727361 in pcnet_ioport_read /home/alxndr/Development/qemu/build/../hw/net/pcnet-pci.c:107:20 +#12 0x55a8f309e9f6 in memory_region_read_accessor /home/alxndr/Development/qemu/build/../softmmu/memory.c:442:11 +#13 0x55a8f3070d63 in access_with_adjusted_size /home/alxndr/Development/qemu/build/../softmmu/memory.c:552:18 +#14 0x55a8f306f222 in memory_region_dispatch_read1 /home/alxndr/Development/qemu/build/../softmmu/memory.c +#15 0x55a8f306f222 in memory_region_dispatch_read /home/alxndr/Development/qemu/build/../softmmu/memory.c:1449:9 +#16 0x55a8f2f6d88f in flatview_read_continue /home/alxndr/Development/qemu/build/../softmmu/physmem.c:2839:23 +#17 0x55a8f2f6ed1b in flatview_read /home/alxndr/Development/qemu/build/../softmmu/physmem.c:2879:12 +#18 0x55a8f2f6ed1b in address_space_read_full /home/alxndr/Development/qemu/build/../softmmu/physmem.c:2892:18 +#19 0x55a8f273036e in pcnet_rmd_load /home/alxndr/Development/qemu/build/../hw/net/pcnet.c:381:9 +#20 0x55a8f2729d97 in pcnet_receive /home/alxndr/Development/qemu/build/../hw/net/pcnet.c:1028:17 +#21 0x55a8f27406be in pcnet_transmit /home/alxndr/Development/qemu/build/../hw/net/pcnet.c:1253:13 +#22 0x55a8f2735b4c in pcnet_poll_timer /home/alxndr/Development/qemu/build/../hw/net/pcnet.c:1322:9 +#23 0x55a8f273c353 in pcnet_ioport_readl /home/alxndr/Development/qemu/build/../hw/net/pcnet.c:1660:5 +#24 0x55a8f2727361 in pcnet_ioport_read /home/alxndr/Development/qemu/build/../hw/net/pcnet-pci.c:107:20 +#25 0x55a8f309e9f6 in memory_region_read_accessor /home/alxndr/Development/qemu/build/../softmmu/memory.c:442:11 +#26 0x55a8f3070d63 in access_with_adjusted_size /home/alxndr/Development/qemu/build/../softmmu/memory.c:552:18 +#27 0x55a8f306f222 in memory_region_dispatch_read1 /home/alxndr/Development/qemu/build/../softmmu/memory.c +#28 0x55a8f306f222 in memory_region_dispatch_read /home/alxndr/Development/qemu/build/../softmmu/memory.c:1449:9 +#29 0x55a8f2f6d88f in flatview_read_continue /home/alxndr/Development/qemu/build/../softmmu/physmem.c:2839:23 +#30 0x55a8f2f6ed1b in flatview_read /home/alxndr/Development/qemu/build/../softmmu/physmem.c:2879:12 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1917661 b/results/classifier/mode-deepseek-r1:32b/output/system/1917661 new file mode 100644 index 00000000..07127462 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1917661 @@ -0,0 +1,17 @@ + + +qemu gdb wrong registers group for riscv64 + +Step to reproduce: +1. run qemu-system-riscv64 in gdb mode +2. attach gdb +3. set a breakpoint and run +4. print register-groups using "maintenance print register-groups" command + +... + sbadaddr 4162 4162 1628 8 long all,general + msounteren 4163 4163 1636 8 long all,general + mbadaddr 4164 4164 1644 8 long all,general + htimedeltah 4165 4165 1652 8 long all,general + +These registers don't belong to general group, instead they belong to all, system and csr groups. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1918 b/results/classifier/mode-deepseek-r1:32b/output/system/1918 new file mode 100644 index 00000000..06df10ed --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1918 @@ -0,0 +1,51 @@ + + +Build failure on FreeBSD 13.2-RELEASE-p3 amd64 with --vhost-user +Description of problem: +- Assumption that the python interpreter is in PATH as `python3` +- Attempt to include Linux headers on a FreeBSD system +Steps to reproduce: +1. `$ ./configure --prefix=/opt/qemu --enable-vhost-user` (log attached below) +2. `$ ninja -C build` +3. See it running a python script without an explicit python interpreter +4. Work around by invoking the python script through the interpreter that meson found: + +```diff +diff --git a/ui/meson.build b/ui/meson.build +index 0a1e8272a3..c6456f54c4 100644 +--- a/ui/meson.build ++++ b/ui/meson.build +@@ -81,7 +81,7 @@ if dbus_display + input: 'dbus-display1.xml', + output: 'dbus-display1.xml', + env: env, +- command: [xml_pp, '@INPUT@', '@OUTPUT@']) ++ command: [python, xml_pp, '@INPUT@', '@OUTPUT@']) + dbus_display1 = custom_target('dbus-display gdbus-codegen', + output: ['dbus-display1.h', 'dbus-display1.c'], + input: xml, + +``` + +5. Then fails trying to include a Linux header: + +```console +/usr/bin/cc -m64 -mcx16 -Ilibcommon.fa.p -I../common-user/host/x86_64 -I../bsd-user/include -Isubprojects/dtc/libfdt -I../subprojects/dtc/libfdt -Iui -I../ui -I/usr/local/include/capstone -I/usr/local/include/pixman-1 -I/usr/local/include/l +ibpng16 -I/usr/local/include -I/usr/local/include/p11-kit-1 -I/usr/local/include/SDL2 -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/usr/local/include/gio-unix-2.0 -I/usr/local/include/slirp -I/usr/local/include/gtk-3.0 +-I/usr/local/include/pango-1.0 -I/usr/local/include/harfbuzz -I/usr/local/include/freetype2 -I/usr/local/include/fribidi -I/usr/local/include/cairo -I/usr/local/include/gdk-pixbuf-2.0 -I/usr/local/include/libepoll-shim -I/usr/local/include/ +atk-1.0 -I/usr/local/include/at-spi2-atk/2.0 -I/usr/local/include/at-spi-2.0 -I/usr/local/include/dbus-1.0 -I/usr/local/lib/dbus-1.0/include -I/usr/local/include/vte-2.91 -I/usr/local/include/webp -fcolor-diagnostics -Wall -Winvalid-pch -st +d=gnu11 -O2 -g -fstack-protector-strong -Wundef -Wwrite-strings -Wmissing-prototypes -Wstrict-prototypes -Wredundant-decls -Wold-style-definition -Wtype-limits -Wformat-security -Wformat-y2k -Winit-self -Wignored-qualifiers -Wempty-body -Wn +ested-externs -Wendif-labels -Wexpansion-to-defined -Wmissing-format-attribute -Wno-initializer-overrides -Wno-missing-include-dirs -Wno-shift-negative-value -Wno-string-plus-int -Wno-typedef-redefinition -Wno-tautological-type-limit-compar +e -Wno-psabi -Wno-gnu-variable-sized-type-not-at-end -Wthread-safety -iquote . -iquote /usr/home/nico/build/qemu -iquote /usr/home/nico/build/qemu/include -iquote /usr/home/nico/build/qemu/host/include/x86_64 -iquote /usr/home/nico/build/qe +mu/host/include/generic -iquote /usr/home/nico/build/qemu/tcg/i386 -pthread -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -fno-strict-aliasing -fno-common -fwrapv -fPIE -DAVIF_DLL -DHWY_SHARED_DEFINE -D_REENTRANT -D_THREAD_SAFE - +MD -MQ libcommon.fa.p/hw_net_vhost_net.c.o -MF libcommon.fa.p/hw_net_vhost_net.c.o.d -o libcommon.fa.p/hw_net_vhost_net.c.o -c ../hw/net/vhost_net.c +In file included from ../hw/net/vhost_net.c:37: +/usr/home/nico/build/qemu/linux-headers/linux/vhost.h:14:10: fatal error: 'linux/vhost_types.h' file not found +#include <linux/vhost_types.h> + ^~~~~~~~~~~~~~~~~~~~~ +``` + +I don't know what that is about. Full build log is attached below. +Additional information: +[config_log](/uploads/49d1c33d4b3951f79f826a701ceff1c2/config_log) +[build_log_fail](/uploads/2cb3b49e7503a430457c4d99b1c60dbe/build_log_fail) diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1919253 b/results/classifier/mode-deepseek-r1:32b/output/system/1919253 new file mode 100644 index 00000000..98b33e4f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1919253 @@ -0,0 +1,88 @@ + + +QEMU doesn't build reproducibly anymore in 5.2.0 + +It used to be that building QEMU 5.1.0 twice in a row, using Guix, would result in bit-for-bit identical results. + +Starting with 5.2.0, this is no longer true. Here's a summary of which files have non-determinism: + +Here's a summary of the differing files: + +$ diff -r /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0{,-check} +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-aarch64 and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-aarch64 differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-aarch64_be and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-aarch64_be differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-alpha and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-alpha differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-arm and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-arm differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-armeb and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-armeb differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-cris and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-cris differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-edid and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-edid differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-ga and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-ga differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-hppa and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-hppa differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-i386 and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-i386 differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-img and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-img differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-io and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-io differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-keymap and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-keymap differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-m68k and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-m68k differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-microblaze and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-microblaze differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-microblazeel and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-microblazeel differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-mips and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-mips differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-mips64 and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-mips64 differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-mips64el and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-mips64el differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-mipsel and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-mipsel differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-mipsn32 and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-mipsn32 differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-mipsn32el and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-mipsn32el differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-nbd and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-nbd differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-nios2 and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-nios2 differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-or1k and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-or1k differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-ppc and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-ppc differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-ppc64 and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-ppc64 differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-ppc64le and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-ppc64le differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-pr-helper and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-pr-helper differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-riscv32 and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-riscv32 differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-riscv64 and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-riscv64 differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-s390x and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-s390x differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-sh4 and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-sh4 differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-sh4eb and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-sh4eb differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-sparc and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-sparc differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-sparc32plus and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-sparc32plus differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-sparc64 and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-sparc64 differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-storage-daemon and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-storage-daemon differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-system-aarch64 and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-system-aarch64 differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-system-alpha and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-system-alpha differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-system-arm and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-system-arm differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-system-avr and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-system-avr differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-system-cris and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-system-cris differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-system-hppa and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-system-hppa differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-system-i386 and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-system-i386 differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-system-m68k and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-system-m68k differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-system-microblaze and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-system-microblaze differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-system-microblazeel and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-system-microblazeel differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-system-mips and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-system-mips differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-system-mips64 and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-system-mips64 differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-system-mips64el and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-system-mips64el differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-system-mipsel and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-system-mipsel differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-system-moxie and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-system-moxie differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-system-nios2 and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-system-nios2 differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-system-or1k and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-system-or1k differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-system-ppc and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-system-ppc differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-system-ppc64 and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-system-ppc64 differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-system-riscv32 and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-system-riscv32 differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-system-riscv64 and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-system-riscv64 differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-system-rx and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-system-rx differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-system-s390x and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-system-s390x differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-system-sh4 and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-system-sh4 differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-system-sh4eb and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-system-sh4eb differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-system-sparc and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-system-sparc differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-system-sparc64 and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-system-sparc64 differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-system-tricore and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-system-tricore differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-system-x86_64 and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-system-x86_64 differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-system-xtensa and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-system-xtensa differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-system-xtensaeb and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-system-xtensaeb differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-x86_64 and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-x86_64 differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-xtensa and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-xtensa differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/bin/qemu-xtensaeb and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/bin/qemu-xtensaeb differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/libexec/qemu-bridge-helper and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/libexec/qemu-bridge-helper differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/libexec/vhost-user-gpu and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/libexec/vhost-user-gpu differ +Binary files /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0/libexec/virtiofsd and /gnu/store/l286mbanw78qgbn54gs5j23qm0v9abhw-qemu-5.2.0-check/libexec/virtiofsd differ + +Attached is a sample log of diffoscope for the qemu-aarch64 binary. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/192 b/results/classifier/mode-deepseek-r1:32b/output/system/192 new file mode 100644 index 00000000..1e079282 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/192 @@ -0,0 +1,3 @@ + + +xv6 Bootloop diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1920 b/results/classifier/mode-deepseek-r1:32b/output/system/1920 new file mode 100644 index 00000000..f824e337 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1920 @@ -0,0 +1,13 @@ + + +regrssion on 8.1.x: java/maven fails to run on qemu-aarch64 +Description of problem: +Java process crashes when running simple "mvn -version" command inside qemu-aarch64. "java -version" works. +Last known working version: 8.0.3 (qemu-8.0.3-4.fc39) +Failing versions: 8.1.1 (qemu-8.1.1-1.fc39) and 8.1.0 (qemu-8.1.0-1.fc39) +The same image works on native arm64 machine. +Steps to reproduce: +1. podman run --platform linux/arm64 docker.io/library/maven:3.9-eclipse-temurin-20 mvn -version +2. should display few lines of version information and not a NullPointerException +Additional information: +podman version 4.7.0 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1920602 b/results/classifier/mode-deepseek-r1:32b/output/system/1920602 new file mode 100644 index 00000000..aa247b9b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1920602 @@ -0,0 +1,21 @@ + + +QEMU crash after a QuickBASIC program integer overflow + +A trivial program compiler with QuickBASIC 4.5 with integer overflow will crash QEMU when ran under MS-DOS 5.0 or FreeDOS 1.2: + +C:\KILLER>type killer.bas +A% = VAL("99999"):PRINT A% + +C:\KILLER>killer.exe +** + ERROR:../qemu-5.2.0/accel/tcg/tcg-cpus.c:541:tcg_handle_interrupt: assertion failed: (qemu_mutex_iothread_locked()) +Aborted + +QEMU version v5.2, compiler for ARM, and started with command line: + +qemu-system-i386 -curses -cpu 486 -m 1 -drive dos.img + +The same test under Ubuntu QEMU and KVM/x86_64 (QEMU emulator version 4.2.1 (Debian 1:4.2-3ubuntu6.14)) will just silently hang the QEMU. On DOSBOX, the machine does not die and program outputs the value -31073. + +The EXE to reproduce the issue is attached. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1920934 b/results/classifier/mode-deepseek-r1:32b/output/system/1920934 new file mode 100644 index 00000000..4aee5c76 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1920934 @@ -0,0 +1,119 @@ + + +Heap-use-after-free in io_writex / cputlb.c results in Linux kernel crashes + +qemu version: git 5ca634afcf83215a9a54ca6e66032325b5ffb5f6; 5.2.0 + +We've encountered that booting the Linux kernel in TCG mode, results in a racy heap-use-after-free. The bug can be detected by ASan [A], but in the majority of runs results in a crashing kernel [B]. + +To reproduce, the following command line was used: + +$> while ./qemu-system-x86_64 -no-reboot -smp 10 -m 2G -kernel arch/x86/boot/bzImage -nographic -append "oops=panic panic_on_warn=1 panic=1 kfence.sample_interval=1 nokaslr"; do sleep 0.5s; done + +The crashes in the kernel [B] appear to receive an interrupt in a code location where the instructions are periodically patched (via the jump_label infrastructure). + +[A]: +================================================================= +==3552508==ERROR: AddressSanitizer: heap-use-after-free on address 0x6190007fef50 at pc 0x55885b0b4d1b bp 0x7f83baffb800 sp 0x7f83baffb7f8 +READ of size 8 at 0x6190007fef50 thread T4 +[ 4.616506][ T1] pci 0000:00:02.0: reg 0x18: [mem 0xfebf0000-0xfebf0fff] +[ 4.670567][ T1] pci 0000:00:02.0: reg 0x30: [mem 0xfebe0000-0xfebeffff pref] +[ 4.691345][ T1] pci 0000:00:03.0: [8086:100e] type 00 class 0x020000 +[ 4.701540][ T1] pci 0000:00:03.0: reg 0x10: [mem 0xfebc0000-0xfebdffff] +[ 4.711076][ T1] pci 0000:00:03.0: reg 0x14: [io 0xc000-0xc03f] +[ 4.746869][ T1] pci 0000:00:03.0: reg 0x30: [mem 0xfeb80000-0xfebbffff pref] +[ 4.813612][ T1] ACPI: PCI Interrupt Link [LNKA] (IRQs 5 *10 11) + #0 0x55885b0b4d1a in io_writex ../accel/tcg/cputlb.c:1408 + #1 0x55885b0d3b9f in store_helper ../accel/tcg/cputlb.c:2444 + #2 0x55885b0d3b9f in helper_le_stl_mmu ../accel/tcg/cputlb.c:2510 +[ 4.820927][ T1] ACPI: PCI Interrupt Link [LNKB] (IRQs 5 *10 11) + #3 0x7f843cedf8dc (<unknown module>) + +0x6190007fef50 is located 208 bytes inside of 1024-byte region [0x6190007fee80,0x6190007ff280) +freed by thread T11 here: + #0 0x7f8483f431f8 in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:164 + #1 0x7f8483586de7 in g_realloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x57de7) + +previously allocated by thread T11 here: + #0 0x7f8483f431f8 in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:164 + #1 0x7f8483586de7 in g_realloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x57de7) + +Thread T4 created by T0 here: +[ 4.827679][ T1] ACPI: PCI Interrupt Link [LNKC] (IRQs 5 10 *11) +[ 4.835143][ T1] ACPI: PCI Interrupt Link [LNKD] (IRQs 5 10 *11) +[ 4.838441][ T1] ACPI: PCI Interrupt Link [LNKS] (IRQs *9) + #0 0x7f8483eee2a2 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:214 + #1 0x55885b7cf0de in qemu_thread_create ../util/qemu-thread-posix.c:558 + +Thread T11 created by T0 here: + #0 0x7f8483eee2a2 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:214 + #1 0x55885b7cf0de in qemu_thread_create ../util/qemu-thread-posix.c:558 + +SUMMARY: AddressSanitizer: heap-use-after-free ../accel/tcg/cputlb.c:1408 in io_writex +Shadow bytes around the buggy address: + 0x0c32800f7d90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c32800f7da0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c32800f7db0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c32800f7dc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c32800f7dd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x0c32800f7de0: fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd + 0x0c32800f7df0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c32800f7e00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c32800f7e10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c32800f7e20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c32800f7e30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==3552508==ABORTING + + +[B]: +[ 6.029269][ C4] int3: 0000 [#1] PREEMPT SMP +[ 6.029269][ C4] CPU: 4 PID: 34 Comm: cpuhp/4 Not tainted 5.12.0-rc4 #2 +[ 6.029269][ C4] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 +[ 6.029269][ C4] RIP: 0010:kmem_cache_alloc_trace+0xdd/0x2f0 +[ 6.029269][ C4] Code: de e8 a7 2e 02 00 85 c0 74 0d 48 89 ef e8 bb 60 00 00 e9 e3 00 00 00 4d 85 f6 0f 84 da 00 00 00 4c 89 6c 24 08 48 8b 2c 24 cc <98> 01 00 00 45 31 ed 4c 89 6c 24 10 4d 85 ed 0f 85 99 00 00 00 49 +[ 6.029269][ C4] RSP: 0018:ffffc90000483cc0 EFLAGS: 00000286 +[ 6.029269][ C4] RAX: 0000000000000000 RBX: 0000000000000dc0 RCX: ffff888003b717c0 +[ 6.029269][ C4] RDX: 0000000000000000 RSI: 0000000000000dc0 RDI: ffff888003842a00 +[ 6.029269][ C4] RBP: 0000000000000110 R08: 0000000000000000 R09: 0000000000000000 +[ 6.029269][ C4] R10: ffffffff81248e22 R11: 00000000fa83b201 R12: 0000000000000dc0 +[ 6.029269][ C4] R13: 0000000000000000 R14: ffff888003842a00 R15: ffffffff8150e1c9 +[ 6.029269][ C4] FS: 0000000000000000(0000) GS:ffff88803ea00000(0000) knlGS:0000000000000000 +[ 6.029269][ C4] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 6.029269][ C4] CR2: 0000000000000000 CR3: 0000000002011000 CR4: 00000000000006e0 +[ 6.029269][ C4] Call Trace: +[ 6.029269][ C4] device_add+0x59/0x7b0 +[ 6.029269][ C4] device_create+0xea/0x130 +[ 6.029269][ C4] ? cpu_report_death+0x40/0x40 +[ 6.029269][ C4] ? cpu_report_death+0x40/0x40 +[ 6.029269][ C4] ? msr_devnode+0x20/0x20 +[ 6.029269][ C4] msr_device_create+0x28/0x40 +[ 6.029269][ C4] cpuhp_invoke_callback+0x140/0x2f0 +[ 6.029269][ C4] ? finish_task_switch+0x8c/0x230 +[ 6.029269][ C4] ? cpu_report_death+0x40/0x40 +[ 6.029269][ C4] cpuhp_thread_fun+0x118/0x1a0 +[ 6.029269][ C4] ? cpu_report_death+0x40/0x40 +[ 6.029269][ C4] smpboot_thread_fn+0x1b9/0x270 +[ 6.029269][ C4] kthread+0x14b/0x160 +[ 6.029269][ C4] ? kthread_unuse_mm+0xf0/0xf0 +[ 6.029269][ C4] ret_from_fork+0x1f/0x30 +[ 6.029269][ C4] ---[ end trace 1336f71544bb94e4 ]--- \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1921 b/results/classifier/mode-deepseek-r1:32b/output/system/1921 new file mode 100644 index 00000000..58e13fe4 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1921 @@ -0,0 +1,32 @@ + + +qemu-system-x86_64 segfaults in iotlb_to_section() on riscv64 +Description of problem: +QEMU segfaults when booting up the Arch Linux x86_64 installation ISO. The ISO could be downloaded from https://geo.mirror.pkgbuild.com/iso/2023.09.01/archlinux-2023.09.01-x86_64.iso or any other Arch Linux mirrors. + +The crash often happens after "Probing EDD...". It's more reliably reproducible with higher `-smp` numbers, and may hang with "rcu_preempt detected stalls" without the -smp option. +Additional information: +I have reproduced the same issues with different RISC-V hardware, including SG2042 and TH1520. + +Errors: +``` +qemu-system-x86_64: ../qemu-8.1.1/softmmu/physmem.c:2419: iotlb_to_section: Assertion `section_index < d->map.sections_nb' failed. +``` + +Backtrace: +``` +#0 0x0000003fa74f0ece in __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44 +#1 0x0000003fa74f0f0e in __pthread_kill_internal (signo=6, threadid=<optimized out>) at pthread_kill.c:78 +#2 0x0000003fa74ba912 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26 +#3 0x0000003fa74aa164 in __GI_abort () at abort.c:79 +#4 0x0000003fa74b54a4 in __assert_fail_base + (fmt=0x3fa7594c10 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x2ae1de0458 "section_index < d->map.sections_nb", file=file@entry=0x2ae1ddf980 "../qemu-8.1.1/softmmu/physmem.c", line=line@entry=2419, function=function@entry=0x2ae1f05f20 <__PRETTY_FUNCTION__.11> "iotlb_to_section") at assert.c:92 +#5 0x0000003fa74b54f8 in __assert_fail (assertion=0x2ae1de0458 "section_index < d->map.sections_nb", file=0x2ae1ddf980 "../qemu-8.1.1/softmmu/physmem.c", line=2419, function=0x2ae1f05f20 <__PRETTY_FUNCTION__.11> "iotlb_to_section") at assert.c:101 +#6 0x0000002ae1b69788 in iotlb_to_section () at ../qemu-8.1.1/softmmu/physmem.c:2419 +#7 0x0000002ae1b9d774 in io_writex () at ../qemu-8.1.1/accel/tcg/cputlb.c:1432 +#8 0x0000002ae1b9d924 in do_st_mmio_leN () at ../qemu-8.1.1/accel/tcg/cputlb.c:2755 +#9 0x0000002ae1ba127c in do_st_4 () at ../qemu-8.1.1/accel/tcg/cputlb.c:2921 +#10 do_st4_mmu () at ../qemu-8.1.1/accel/tcg/cputlb.c:3006 +#11 0x0000003f600dd7ec in code_gen_buffer () +#12 0x5f085e2755518600 in () +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1921061 b/results/classifier/mode-deepseek-r1:32b/output/system/1921061 new file mode 100644 index 00000000..afb9a56d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1921061 @@ -0,0 +1,9 @@ + + +Corsair iCUE Install Fails, qemu VM Reboots + +Hi, + +I had this working before, but in the latest version of QEMU (built from master), when I try to install Corsair iCUE, and it gets to the driver install point => my Windows 10 VM just reboots! I would be happy to capture logs, but ... what logs exist for an uncontrolled reboot? Thinking they are lost in the reboot :-(. + +Thanks! \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1921138 b/results/classifier/mode-deepseek-r1:32b/output/system/1921138 new file mode 100644 index 00000000..2d2f2f2f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1921138 @@ -0,0 +1,15 @@ + + +tcg.c:3329: tcg fatal error + +I am currently building my own kernel with bootloader and qemu crashed after I have set an IDT in protected mode and then create a invalid opcode exception with the opcode 0xff. + +My code is here: https://github.com/Luis-Hebendanz/svm_kernel/blob/qemu_crash/svm_kernel/external/bootloader/src/main.rs#L80 + +Build instructions are here: https://github.com/Luis-Hebendanz/svm_kernel/tree/qemu_crash + +A precompiled binary is here: https://cloud.gchq.icu/s/LcjoDWRW2CbxJ5i + +I executed the following command: qemu-system-x86_64 -smp cores=4 -cdrom target/x86_64-os/debug/bootimage-svm_kernel.iso -serial stdio -display none -m 4G + +I am running QEMU emulator version 5.1.0 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1922773 b/results/classifier/mode-deepseek-r1:32b/output/system/1922773 new file mode 100644 index 00000000..9333c792 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1922773 @@ -0,0 +1,99 @@ + + +RISCV32 illegal instruction exception + +I'm running a machine learning model on qemu riscv32 and I ran into illegal instruction exception for some reason. I wasn't sure if this is a bug and if so whether it is related to zephyr or qemu, however I'll try to provide as much as information to get a better understanding. + +Here is the assembly code that I'm running: + +0x8000bd74 <+0>: lw a4,0(a0) + 0x8000bd76 <+2>: lw a5,8(a0) + 0x8000bd78 <+4>: lw a0,0(a4) + 0x8000bd7a <+6>: lw a1,0(a5) + 0x8000bd7c <+8>: li a3,0 + 0x8000bd7e <+10>: j 0x8000bda4 <fused_nn_pad_layout_transform+48> + 0x8000bd80 <+12>: addi a5,a3,-2 + 0x8000bd84 <+16>: li a2,27 + 0x8000bd86 <+18>: bgeu a2,a5,0x8000bdae <fused_nn_pad_layout_transform+58> +=> 0x8000bd8a <+22>: fmv.w.x fa5,zero + 0x8000bd8e <+26>: slli a5,a3,0x5 + 0x8000bd92 <+30>: add a5,a5,a4 + 0x8000bd94 <+32>: slli a5,a5,0x2 + 0x8000bd96 <+34>: add a5,a5,a1 + 0x8000bd98 <+36>: fsw fa5,0(a5) + 0x8000bd9a <+38>: addi a4,a4,1 + 0x8000bd9c <+40>: li a5,31 + 0x8000bd9e <+42>: bge a5,a4,0x8000bd80 <fused_nn_pad_layout_transform+12> + 0x8000bda2 <+46>: addi a3,a3,1 + 0x8000bda4 <+48>: li a5,31 + 0x8000bda6 <+50>: blt a5,a3,0x8000bde0 <fused_nn_pad_layout_transform+108> + 0x8000bdaa <+54>: li a4,0 + 0x8000bdac <+56>: j 0x8000bd9c <fused_nn_pad_layout_transform+40> + 0x8000bdae <+58>: li a5,1 + 0x8000bdb0 <+60>: bge a5,a4,0x8000bdd4 <fused_nn_pad_layout_transform+96> + 0x8000bdb4 <+64>: li a5,29 + 0x8000bdb6 <+66>: blt a5,a4,0x8000bdda <fused_nn_pad_layout_transform+102> + 0x8000bdba <+70>: li a5,28 + 0x8000bdbc <+72>: mul a5,a3,a5 + 0x8000bdc0 <+76>: add a5,a5,a4 + 0x8000bdc2 <+78>: lui a2,0x40000 + 0x8000bdc6 <+82>: addi a2,a2,-58 # 0x3fffffc6 + 0x8000bdca <+86>: add a5,a5,a2 + 0x8000bdcc <+88>: slli a5,a5,0x2 + 0x8000bdce <+90>: add a5,a5,a0 + 0x8000bdd0 <+92>: flw fa5,0(a5) + 0x8000bdd2 <+94>: j 0x8000bd8e <fused_nn_pad_layout_transform+26> + 0x8000bdd4 <+96>: fmv.w.x fa5,zero + 0x8000bdd8 <+100>: j 0x8000bd8e <fused_nn_pad_layout_transform+26> + 0x8000bdda <+102>: fmv.w.x fa5,zero + 0x8000bdde <+106>: j 0x8000bd8e <fused_nn_pad_layout_transform+26> + 0x8000bde0 <+108>: li a0,0 + 0x8000bde2 <+110>: ret + +My code breaks on line 0x8000bd8a and then the mcause register is loaded with value 0x02 which translates to illegal instruction. Please let me know if you need more information about this. + +I also posted this on ZephyrProject in case it is related to the Zephyr: https://github.com/zephyrproject-rtos/zephyr/issues/34026 + +I have tested on both QEMU 5.1.0 and 5.2.0 versions. I ran the same code on qemu riscv64 and didn't have the same problem. Here is the assembly code that is generated for the same operation: + +=> 0x000000008000b446 <+0>: ld a4,0(a0) + 0x000000008000b448 <+2>: ld a5,8(a0) + 0x000000008000b44a <+4>: ld a0,0(a4) + 0x000000008000b44c <+6>: ld a1,0(a5) + 0x000000008000b44e <+8>: li a3,0 + 0x000000008000b450 <+10>: j 0x8000b476 <fused_nn_pad_layout_transform+48> + 0x000000008000b452 <+12>: addiw a5,a3,-2 + 0x000000008000b456 <+16>: li a2,27 + 0x000000008000b458 <+18>: bgeu a2,a5,0x8000b480 <fused_nn_pad_layout_transform+58> + 0x000000008000b45c <+22>: li a2,0 + 0x000000008000b460 <+26>: slliw a5,a3,0x5 + 0x000000008000b464 <+30>: addw a5,a5,a4 + 0x000000008000b466 <+32>: slli a5,a5,0x2 + 0x000000008000b468 <+34>: add a5,a5,a1 + 0x000000008000b46a <+36>: sw a2,0(a5) + 0x000000008000b46c <+38>: addiw a4,a4,1 + 0x000000008000b46e <+40>: li a5,31 + 0x000000008000b470 <+42>: bge a5,a4,0x8000b452 <fused_nn_pad_layout_transform+12> + 0x000000008000b474 <+46>: addiw a3,a3,1 + 0x000000008000b476 <+48>: li a5,31 + 0x000000008000b478 <+50>: blt a5,a3,0x8000b4ac <fused_nn_pad_layout_transform+102> + 0x000000008000b47c <+54>: li a4,0 + 0x000000008000b47e <+56>: j 0x8000b46e <fused_nn_pad_layout_transform+40> + 0x000000008000b480 <+58>: li a5,1 + 0x000000008000b482 <+60>: bge a5,a4,0x8000b4a0 <fused_nn_pad_layout_transform+90> + 0x000000008000b486 <+64>: li a5,29 + 0x000000008000b488 <+66>: blt a5,a4,0x8000b4a6 <fused_nn_pad_layout_transform+96> + 0x000000008000b48c <+70>: li a5,28 + 0x000000008000b48e <+72>: mulw a5,a5,a3 + 0x000000008000b492 <+76>: addw a5,a5,a4 + 0x000000008000b494 <+78>: addiw a5,a5,-58 + 0x000000008000b498 <+82>: slli a5,a5,0x2 + 0x000000008000b49a <+84>: add a5,a5,a0 + 0x000000008000b49c <+86>: lw a2,0(a5) + 0x000000008000b49e <+88>: j 0x8000b460 <fused_nn_pad_layout_transform+26> + 0x000000008000b4a0 <+90>: li a2,0 + 0x000000008000b4a4 <+94>: j 0x8000b460 <fused_nn_pad_layout_transform+26> + 0x000000008000b4a6 <+96>: li a2,0 + 0x000000008000b4aa <+100>: j 0x8000b460 <fused_nn_pad_layout_transform+26> + 0x000000008000b4ac <+102>: li a0,0 + 0x000000008000b4ae <+104>: ret \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1923197 b/results/classifier/mode-deepseek-r1:32b/output/system/1923197 new file mode 100644 index 00000000..12f3ccc5 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1923197 @@ -0,0 +1,39 @@ + + +RISC-V priviledged instruction error + +Hello when performing an MRET with MPP set to something else than 0b11 in MSTATUS, 'Invalid Instruction' exception will be triggered. The problem appeared in code after version 5.2.0. + +<pre> + # setup interrupt handling for monitor mode + la t0, entry_loop + la t1, entry_trap + li t2, 0x888 + li t3, 0x1880 # MPP in MSTATUS selects to which mode to return & MPIE selects if to enable interrupts after MRET + csrw mepc, t0 + csrw mtvec, t1 + csrs mie, t2 + csrs mstatus, t3 + + # if supervisor mode not supported, then loop forever + csrr t0, misa + li t1, 0x40000 + and t2, t1, t0 + beqz t2, 1f + + # setup interrupt i& exception delegation for supervisor mode + li t0, 0xc0000000 # 3 GiB (entry address of supervisor) + li t1, 0x1000 + #li t2, 0x300 # bit 8 & 9 is for ecall from user & supervisor mode + #li t3, 0x222 + csrw mepc, t0 + csrc mstatus, t1 + #csrs medeleg, t2 + #csrs mideleg, t3 + + # pass mhartid as first parameter to supervisor + csrr a0, mhartid + +1: + mret +</pre> \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1923629 b/results/classifier/mode-deepseek-r1:32b/output/system/1923629 new file mode 100644 index 00000000..bacb9c1f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1923629 @@ -0,0 +1,15 @@ + + +RISC-V Vector Instruction vssub.vv not saturating + +I noticed doing a negate ( 0 – 0x80000000 ) using vssub.vv produces an incorrect result of 0x80000000 (should saturate to 0x7FFFFFFF). + +Here is the bit of the code: + + vmv.v.i v16, 0 + … +8f040457 vssub.vv v8,v16,v8 + +I believe the instruction encoding is correct (vssub.vv with vd = v8, vs2 = v16, rs1 = v8), but the result does not saturate in QEMU. + +I’ve just tested with what I think is the latest branch ( https://github.com/sifive/qemu/tree/rvv-1.0-upstream-v7 commit 26 Feb 2021: 1151361fa7d45cc90d69086ccf1a4d8397931811 ) and the problem still exists. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1924669 b/results/classifier/mode-deepseek-r1:32b/output/system/1924669 new file mode 100644 index 00000000..683aaffa --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1924669 @@ -0,0 +1,12 @@ + + +VFP code cannot see CPACR write in the same TB + +If FPU is enabled by writing to CPACR, and the code is in the same translation block as the following VFP code, qemu generates "v7M NOCP UsageFault". + +This can be reproduced with git HEAD (commit 8fe9f1f891eff4e37f82622b7480ee748bf4af74). + +The target binary is attached. The qemu command is: +qemu-system-arm -nographic -monitor null -serial null -semihosting -machine mps2-an505 -cpu cortex-m33 -kernel cpacr_vfp.elf -d in_asm,int,exec,cpu,cpu_reset,unimp,guest_errors,nochain -D log + +If the code is changed a little, so that they are not in the same block, VFP code can see the effect of CPACR, or -singlestep of qemu has the same result. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1926277 b/results/classifier/mode-deepseek-r1:32b/output/system/1926277 new file mode 100644 index 00000000..1d84b124 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1926277 @@ -0,0 +1,39 @@ + + +MIPS MT dvpe does not regard VPEConf0.MVP + +Hi, + +According to MIPS32® Architecture for Programmers VolumeIV-f: The MIPS® MT Application-Specific Extension to the MIPS32® Architecture, for instruction: dvpe, evpe: + +If the VPE executing the instruction is not a Master VPE, with the MVP bit of the VPEConf0 register set, the EVP bit is unchanged by the instruction. + +The pseudo code is: + +data ← MVPControl +GPR[rt] ← data +if(VPEConf0.MVP = 1) then + MVPControl.EVP ← sc +endif + +However the helper functions of dvpe, evpe does not regard the VPEConf0.MVP bit, namely, it does not check if the VPE is a master VPE. Code is copied below as: + +target_ulong helper_dvpe(CPUMIPSState *env) +{ + CPUState *other_cs = first_cpu; + target_ulong prev = env->mvp->CP0_MVPControl; + + CPU_FOREACH(other_cs) { + MIPSCPU *other_cpu = MIPS_CPU(other_cs); + /* Turn off all VPEs except the one executing the dvpe. */ + if (&other_cpu->env != env) { + other_cpu->env.mvp->CP0_MVPControl &= ~(1 << CP0MVPCo_EVP); + mips_vpe_sleep(other_cpu); + } + } + return prev; +} + +Is this a bug? + +QEMU head commit: 0cef06d18762374c94eb4d511717a4735d668a24 is checked. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1926759 b/results/classifier/mode-deepseek-r1:32b/output/system/1926759 new file mode 100644 index 00000000..0e7ca213 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1926759 @@ -0,0 +1,20 @@ + + +WFI instruction results in unhandled CPU exception + +Hi + +I refer to the WFI instruction. The bytecode is 0xe320f003. After the execution, qemu exit with the following crash log. + +qemu: unhandled CPU exception 0x10001 - aborting +R00=00000001 R01=40800b34 R02=40800b3c R03=000102ec +R04=00010a28 R05=00010158 R06=00087460 R07=00010158 +R08=00000000 R09=00000000 R10=00085b7c R11=408009f4 +R12=40800a08 R13=408009f0 R14=0001057c R15=000102f8 +PSR=60000010 -ZC- A usr32 +qemu:handle_cpu_signal received signal outside vCPU context @ pc=0x7f5c21d0fa12 + +WFI aims to enter a low-power state and wait for interrupt. The raised exception seems not a right behavior. I can provide a testcase if you needed. Many thanks. + +Regards +Muhui \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1943 b/results/classifier/mode-deepseek-r1:32b/output/system/1943 new file mode 100644 index 00000000..0722ebb1 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1943 @@ -0,0 +1,26 @@ + + +Weird error trying to autodetect CHS disk geometry +Description of problem: +Error: "SSD Read Error" + +Something about the contents of the disk causes qemu to wildly misdetect the disk geometry. +This disk started as a blank disk, and had a FAT filesystem written to it from inside it; thus +writing the detected geometry to the disk. And this caused the detected geometry to change to +something nonsensical. +Steps to reproduce: +1. Unpack the attached [hd.bz2](/uploads/53f5bb00cdd563223bea1f7a0f86fe1c/hd.bz2) to hd.img +2. Run qemu -hda hd.img +3. Observe error +Additional information: +The following command appears to fix the problem; however it is wrong: + +qemu -drive if=none,id=dr,file=hd.img -device ide-hd,drive=dr,cyls=1023,heads=16,secs=63 + +The problem with this command is this command yields only 504MB instead of the 512MB the +disk is actually formatted to be. CHS translation should be enabled on this disk but won't +be with this command. + +This command was copied essentially blindly from "Removed features" because that's what comes +up for a google search for "qemu specify geometry" and I don't understand the command well +enough to correct it. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1945540 b/results/classifier/mode-deepseek-r1:32b/output/system/1945540 new file mode 100644 index 00000000..73b24518 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1945540 @@ -0,0 +1,65 @@ + + +Java crashes on s390x VM with SIGILL/ILL_PRVOPC at '__kernel_getcpu+0x8' + +Host environment + +- Operating system: Ubuntu 20.04.3 LTS Desktop +- OS/kernel version: Linux tower 5.11.0-37-generic #41~20.04.2-Ubuntu + SMP Fri Sep 24 09:06:38 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux +- Architecture: amd64 +- QEMU flavor: qemu-system-s390x +- QEMU version: QEMU emulator version 4.2.1 (Debian 1:4.2-3ubuntu6.17) +- QEMU command line: See attached file 'command-line.txt' + +Emulated/Virtualized environment + +- Operating system: Ubuntu 20.04.3 LTS Server +- OS/kernel version: Linux s390x-focal 5.4.0-88-generic #99-Ubuntu + SMP Thu Sep 23 17:27:44 UTC 2021 s390x s390x s390x GNU/Linux +- Architecture: s390x + +Description of problem + +Java crashes as shown below: + +$ java --version +# +# A fatal error has been detected by the Java Runtime Environment: +# +# SIGILL (0x4) at pc=0x000003ff9f5fe6f4, pid=6789, tid=6818 +# +# JRE version: (17.0+35) (build ) +# Java VM: OpenJDK 64-Bit Server VM (17+35-snap, mixed mode, sharing, +# tiered, compressed oops, compressed class ptrs, g1 gc, linux-s390x) +# Problematic frame: +# C [linux-vdso64.so.1+0x6f8] __kernel_getcpu+0x8 +# +# Core dump will be written. Default location: core.6789 (may not +# exist) +# +# An error report file with more information is saved as: +# /home/ubuntu/src/hs_err_pid6789.log +# +# +Aborted (core dumped) + +Steps to reproduce + +Run any Java program to reproduce the problem. + +Because the 'openjdk' packages in Ubuntu run the 'java' command during installation, they hit the same error and fail to install. As an alternative, you can install the OpenJDK Snap package for the 's390x' architecture as follows: + + $ sudo snap install openjdk + +The OpenJDK Snap package has been tested to work on a real IBM/S390 8561 system, namely the IBM LinuxONE III LT1 at Marist College: + + Marist College Installs World’s First IBM LinuxONE III™ + https://www.marist.edu/-/marist-first-linuxone-iii + +Additional information + +See the following attached files: + +command-line.txt - the command-line used to start the virtual machine +hs_err_pid6789.log - the log file resulting from 'java --version' \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/195 b/results/classifier/mode-deepseek-r1:32b/output/system/195 new file mode 100644 index 00000000..73952c34 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/195 @@ -0,0 +1,3 @@ + + +wavcapture does not record silence diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1950 b/results/classifier/mode-deepseek-r1:32b/output/system/1950 new file mode 100644 index 00000000..6f00efd9 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1950 @@ -0,0 +1,11 @@ + + +[AARCH64] GP bit (BTI) lost during two stages translation +Description of problem: +I noticed that the BTI faults were not reported. +That's because the GP (guarded page) information is lost during the two stages translation in get_phys_addr_twostage(). +The "guarded" information is correctly retrieved by the first call to get_phys_addr_nogpc() but overwritten by the the second call to get_phys_addr_nogpc(). +The call to combine_cacheattrs() copies cacheattrs1.guarded but this field is never modified. + +The attached patch fixes the issue for me. +[get_phys_addr_twostage_bti_gp_bit_lost_master.patch](/uploads/2fbe8090f92c43a63e39ee66ab2daf47/get_phys_addr_twostage_bti_gp_bit_lost_master.patch) diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1951 b/results/classifier/mode-deepseek-r1:32b/output/system/1951 new file mode 100644 index 00000000..b3d1a25a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1951 @@ -0,0 +1,140 @@ + + +MacOS requires root to pass through USB devices properly +Description of problem: +If I run qemu as a normal user, the PlutoSDR USB device will not work in the VM. For example, the umass device will remain attached to the host system, and will not appear in the guest system. The device will appear in the guest system, but it will fail to be configured: +``` +usb_alloc_device: Failure selecting configuration index 0:USB_ERR_STALLED, port 2, addr 2 (ignored) +``` + +I believe that similar issues are happening w/ guest OS's Ubuntu 20.04 and 22.04, but I have not tested them to confirm. + +There is no error message (that I noticed) that reports that this might be an issue and that you need to run qemu as root. +Steps to reproduce: +1. Run qemu like above +2. Plug in a PlutoSDR +3. See that the device appears in the guest, but does not attach completely +Additional information: +The confusing part is that a simple device, an RTL-SDR device will appear to work fine when passed through w/o running as root making things more confusing to debug. + +When run qemu as a normal user, the console (includes FreeBSD kernel messages: +``` +login: qemu-system-aarch64: libusb_detach_kernel_driver: -3 [ACCESS] +qemu-system-aarch64: libusb_detach_kernel_driver: -3 [ACCESS] +qemu-system-aarch64: libusb_detach_kernel_driver: -3 [ACCESS] +qemu-system-aarch64: libusb_detach_kernel_driver: -3 [ACCESS] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_detach_kernel_driver: -3 [ACCESS] +qemu-system-aarch64: libusb_detach_kernel_driver: -3 [ACCESS] +qemu-system-aarch64: libusb_detach_kernel_driver: -3 [ACCESS] +qemu-system-aarch64: libusb_detach_kernel_driver: -3 [ACCESS] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_detach_kernel_driver: -3 [ACCESS] +qemu-system-aarch64: libusb_detach_kernel_driver: -3 [ACCESS] +qemu-system-aarch64: libusb_detach_kernel_driver: -3 [ACCESS] +qemu-system-aarch64: libusb_detach_kernel_driver: -3 [ACCESS] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +usb_alloc_device: Failure selecting configuration index 0:USB_ERR_STALLED, port 2, addr 2 (ignored) +ugen1.2: <Analog Devices Inc. PlutoSDR (ADALM-PLUTO)> at usbus1 +qemu-system-aarch64: libusb_detach_kernel_driver: -3 [ACCESS] +qemu-system-aarch64: libusb_detach_kernel_driver: -3 [ACCESS] +qemu-system-aarch64: libusb_detach_kernel_driver: -3 [ACCESS] +qemu-system-aarch64: libusb_detach_kernel_driver: -3 [ACCESS] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_detach_kernel_driver: -3 [ACCESS] +qemu-system-aarch64: libusb_detach_kernel_driver: -3 [ACCESS] +qemu-system-aarch64: libusb_detach_kernel_driver: -3 [ACCESS] +qemu-system-aarch64: libusb_detach_kernel_driver: -3 [ACCESS] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +``` + +It's not clear what action, if any needs to be taken w/ these error messages. At a minimum, qemu should complain loudly about needing to be run as root, but would be best if it didn't need to run as root, like other VM systems. + +If I run qemu as root (via sudo), it attachs as expected: +``` +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +qemu-system-aarch64: libusb_kernel_driver_active: -5 [NOT_FOUND] +ugen1.2: <Analog Devices Inc. PlutoSDR (ADALM-PLUTO)> at usbus1 +umass0 on uhub0 +umass0: <Mass Storage> on usbus1 +umass0: SCSI over Bulk-Only; quirks = 0x0000 +umass0:0:0: Attached to scbus0 +da0 at umass-sim0 bus 0 scbus0 target 0 lun 0 +da0: <Linux File-Stor Gadget 0414> Removable Direct Access SCSI-2 device +da0: 40.000MB/s transfers +da0: 30MB (61441 512 byte sectors) +da0: quirks=0x2<NO_6_BYTE> +urndis0 on uhub0 +urndis0: <RNDIS Communications Control> on usbus1 +umodem0 on uhub0 +umodem0: <CDC Abstract Control Model (ACM)> on usbus1 +umodem0: data interface 4, has no CM over data, has no break +``` + +Trying root was inspired by: +https://github.com/libusb/libusb/issues/1014 + +From that issue, it appears that this is a qemu build issue and does not have the proper entitlements. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1954 b/results/classifier/mode-deepseek-r1:32b/output/system/1954 new file mode 100644 index 00000000..befdf791 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1954 @@ -0,0 +1,30 @@ + + +guest-fsfreeze can't work well on windows +Description of problem: +I used qemu 5.0 to cross-compile windows gqa on the fedroa30 system.And install it on guest with windows10,but i can't work well. +Steps to reproduce: +1. ./configure --cross-prefix=x86_64-w64-mingw32- --enable-guest-agent-msi --with-vss-sdk=/root/vssdk/VSSSDK72 + + my vssdk download from:[vssdk](https://www.microsoft.com/en-us/download/details.aspx?id=23490),i install it on my pc and copy to /root/vssdk/VSSSDK72 + +2. make qemu-ga -j4 + +3. and then install qemu-ga-x86_64.msi on windows10,it report the error: +  + +4.then I ./configure not with "--with-vss-sdk",the qemu-ga-x86_64.msi can install successfully. + +5.So, I install gga first. Then ./configure with "--with-vss-sdk" to make get the qemu-ga.exe + +6.replace qemu-ga.exe and reboot gga service,then execute the command "virsh domfsfreeze" on host,but it report error: + + error: Unable to freeze filesystems + error: internal error: unable to execute QEMU agent command 'guest-fsfreeze-freeze': failed to add \\?\Volume{d1ee1072-0000-0000-0000-100000000000}\ to snapshot set: + + +**I looked at the windows Event Viewer,it get the error:** + + Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied. + +I have referred to this [document](https://www.ryadel.com/en/volume-shadow-copy-service-error-unexpected-error-querying-for-the-ivsswritercallback-interface-how-to-fix-that/),but it not work. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1956 b/results/classifier/mode-deepseek-r1:32b/output/system/1956 new file mode 100644 index 00000000..773ab7b2 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1956 @@ -0,0 +1,3 @@ + + +[x86,microvm] Update microvm documentation with ACPI option diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1958 b/results/classifier/mode-deepseek-r1:32b/output/system/1958 new file mode 100644 index 00000000..f81da3ce --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1958 @@ -0,0 +1,23 @@ + + +PPC msgsnd for DOORBELL CRITICAL masked by MSR[EE] instead of MSR[CE] +Description of problem: +When executing PPC instruction "msgsnd r3. with r3 = 0x08000001" an DOORBELL CRITICAL exception is raised on core number 1. But this exception is masked by MSR\[EE\] bit, the MSR\[EE\] should be set to 1 in core1 to get this exception. But the NXP E500MCRM.pdf reference manual indicates that MSR\[CE\] is the mask bit for DOORBELL_CRITICAL Exception. +Additional information: +In qemu-8.1.2/target/ppc/excp_helper.c i try to change in ppc_next_unmasked_interrupt_generic function: + +``` +if (FIELD_EX64(env->msr, MSR, CE)) { + /* Critical doorbell */ + if (env->pending_interrupts & PPC_INTERRUPT_CDOORBELL) { <- move this part from (async_deliver != 0) + return PPC_INTERRUPT_CDOORBELL; + } + /* External critical interrupt */ + if (env->pending_interrupts & PPC_INTERRUPT_CEXT) { + return PPC_INTERRUPT_CEXT; + } +} +``` + + +And it seems to work in my case. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1961 b/results/classifier/mode-deepseek-r1:32b/output/system/1961 new file mode 100644 index 00000000..8d973e13 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1961 @@ -0,0 +1,3 @@ + + +Commit accel/tcg: Always require can_do_io breaks riscv64 bare metal firmware diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1962 b/results/classifier/mode-deepseek-r1:32b/output/system/1962 new file mode 100644 index 00000000..a549a71e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1962 @@ -0,0 +1,31 @@ + + +systemd-tmpfiles-setup-dev-early.service fails in emulated systemd-nspawn container +Description of problem: +When booting a fresh `debootstrap`ed Debian Trixie/testing rootfs with foreign architecture via `systemd-nspawn` and `qemu-user-static`, invoked via `systemd-binfmt`, the `systemd-tmpfiles-setup-dev-early.service` service within the guest fails, which leads to `/dev` not existing (respectively no default content), so that several other guest system components fail as well, like any console/shell access: +``` +Starting systemd-tmpfiles-setup-dev-early.service - Create Static Device Nodes in /dev gracefully... +systemd-tmpfiles-setup-dev-early.service: Failed to set up credentials: Invalid argument +systemd-tmpfiles-setup-dev-early.service: Main process exited, code=exited, status=243/CREDENTIALS +systemd-tmpfiles-setup-dev-early.service: Failed with result 'exit-code'. +[FAILED] Failed to start systemd-tmpfiles-setup-dev-early.service - Create Static Device Nodes in /dev gracefully. +See 'systemctl status systemd-tmpfiles-setup-dev-early.service' for details. +Starting systemd-tmpfiles-setup-dev.service - Create Static Device Nodes in /dev... +systemd-tmpfiles-setup-dev.service: Failed to set up credentials: Invalid argument +systemd-tmpfiles-setup-dev.service: Main process exited, code=exited, status=243/CREDENTIALS +systemd-tmpfiles-setup-dev.service: Failed with result 'exit-code'. +[FAILED] Failed to start systemd-tmpfiles-setup-dev.service - Create Static Device Nodes in /dev. +See 'systemctl status systemd-tmpfiles-setup-dev.service' for details. +``` +Steps to reproduce: +1. `apt install debootstrap systemd-container qemu-user-static` +2. `systemctl restart systemd-binfmt` +3. `mkdir rootfs` +4. `debootstrap --variant=minbase --include=systemd-sysv --arch=arm64 trixie ./rootfs 'https://deb.debian.org/debian'` +5. `systemd-nspawn -bD rootfs` +Additional information: +On Bookworm guest systems and/or without QEMU emulation, this works without issues, so I guess systemd recently started to use a certain syscall for the `ImportCredential=tmpfiles.*` method in systemd units, which is not supported by QEMU, probably similar to https://github.com/systemd/systemd/pull/28954? + +I hope it is fine to report it here. Always difficult to decide whether to report to the distribution (Debian) or one, and in case which, of the related projects, which do not work together. + +Debian Trixie currently ships `systemd 254.4-1` btw. I am not sure whether the issue was introduced with 253 or 254, since the linked issue prevented booting such containers on an earlier stage with 253, which was fixed in 254, which has the here reported issue. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1963 b/results/classifier/mode-deepseek-r1:32b/output/system/1963 new file mode 100644 index 00000000..812a9307 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1963 @@ -0,0 +1,30 @@ + + +EOF is not detected, when semihosting is reading from stdin +Description of problem: +QEMU hangs. +Steps to reproduce: +1. Run the program with stdin from a pipe. +Additional information: +The code is compiled from this source: +``` +#include <stdio.h> + +int main(int argc, char** argv) { + int i = -1; + int result = scanf("%d", &i); + printf("result = %d, i = %d\n", result, i); + return 0; +} +``` +compiled with GCC and picolibc: +``` +arm-none-eabi-gcc --specs=picolibc.specs -march=armv7-m ~/sources/picolibc/git/test-stdin.c -o test-stdin -lc -lsemihost --crt0=hosted -O0 -g +``` +[test-stdin](/uploads/dbd2650c8e0aaca353fd7630ac9c8440/test-stdin) +The execution hangs at semihosting SYS_READC(0x7) call: +``` + movs r0, #7 +(...) + bkpt #0xab +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1967 b/results/classifier/mode-deepseek-r1:32b/output/system/1967 new file mode 100644 index 00000000..0063491a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1967 @@ -0,0 +1,3 @@ + + +Guest SIGRTMIN remapped incorrectly diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1968 b/results/classifier/mode-deepseek-r1:32b/output/system/1968 new file mode 100644 index 00000000..5ea19026 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1968 @@ -0,0 +1,3 @@ + + +scripts (checkpatch): make braces {} necessary for 'for' loops diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1969 b/results/classifier/mode-deepseek-r1:32b/output/system/1969 new file mode 100644 index 00000000..93c98a52 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1969 @@ -0,0 +1,3 @@ + + +Test fails with SIGSEGV because of use-after-free diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1970 b/results/classifier/mode-deepseek-r1:32b/output/system/1970 new file mode 100644 index 00000000..ed8bf7a1 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1970 @@ -0,0 +1,3 @@ + + +A64 LDRA decode scales the immediate by wrong amount diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1970563 b/results/classifier/mode-deepseek-r1:32b/output/system/1970563 new file mode 100644 index 00000000..bd58c69e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1970563 @@ -0,0 +1,7 @@ + + +Qemu 1:6.2+dfsg-2ubuntu6 deadlock bug + +There is a known bug that will cause VM deadlock, the patch should be merged and released: + +https://gitlab.com/qemu-project/qemu/-/commit/1dbbe6f172810026c51dc84ed927a3cc23017949#841723aa93098d8ab3b5068795e10ae7cf2a3179 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1972 b/results/classifier/mode-deepseek-r1:32b/output/system/1972 new file mode 100644 index 00000000..75ad88b9 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1972 @@ -0,0 +1,41 @@ + + +Windows TCG plugin build fails with mingw cross-compile images +Description of problem: +It looks like the mingw variants of the compiler are sensitive to the order of linking: + +``` +bash-5.2$ x86_64-w64-mingw32-gcc -m64 -mcx16 plugins/qemu_plugin_api.lib -o tests/plugin/libinsn.dll tests/plugin/libinsn.dll.p/insn.c.obj tests/plugin/libinsn.dll.p/.._.._contrib_plugins_win32_linker.c.obj plugins/qemu_plugin_api.lib -Wl,--allow-shlib-undefined -shared -Wl,--start-group -Wl,--out-implib=tests/plugin/libinsn.dll.a -fstack-protector-strong -Wl,--no-seh -Wl,--nxcompat -Wl,--dynamicbase -Wl,--high-entropy-va -Wl,--warn-common /usr/x86_64-w64-mingw32/sys-root/mingw/lib/libglib-2.0.dll.a /usr/x86_64-w64-mingw32/sys-root/mingw/lib/libintl.dll.a /usr/x86_64-w64-mingw32/sys-root/mingw/lib/libgmodule-2.0.dll.a -lkernel32 -luser32 -lgdi32 -lwinspool -lshell32 -lole32 -loleaut32 -luuid -lcomdlg32 -ladvapi32 -Wl,--end-group +bash-5.2$ x86_64-w64-mingw32-gcc -m64 -mcx16 plugins/qemu_plugin_api.lib -o tests/plugin/libinsn.dll tests/plugin/libinsn.dll.p/insn.c.obj tests/plugin/libinsn.dll.p/.._.._contrib_plugins_win32_linker.c.obj -Wl,--allow-shlib-undefined -shared -Wl,--start-group -Wl,--out-implib=tests/plugin/libinsn.dll.a -fstack-protector-strong -Wl,--no-seh -Wl,--nxcompat -Wl,--dynamicbase -Wl,--high-entropy-va -Wl,--warn-common /usr/x86_64-w64-mingw32/sys-root/mingw/lib/libglib-2.0.dll.a /usr/x86_64-w64-mingw32/sys-root/mingw/lib/libintl.dll.a /usr/x86_64-w64-mingw32/sys-root/mingw/lib/libgmodule-2.0.dll.a -lkernel32 -luser32 -lgdi32 -lwinspool -lshell32 -lole32 -loleaut32 -luuid -lcomdlg32 -ladvapi32 -Wl,--end-group +/usr/lib/gcc/x86_64-w64-mingw32/12.2.1/../../../../x86_64-w64-mingw32/bin/ld: tests/plugin/libinsn.dll.p/insn.c.obj: in function `vcpu_tb_trans': +/tmp/qemu-test/build/../src/tests/plugin/insn.c:90: undefined reference to `__imp_qemu_plugin_tb_n_insns' +/usr/lib/gcc/x86_64-w64-mingw32/12.2.1/../../../../x86_64-w64-mingw32/bin/ld: /tmp/qemu-test/build/../src/tests/plugin/insn.c:100: undefined reference to `__imp_qemu_plugin_insn_vaddr' +/usr/lib/gcc/x86_64-w64-mingw32/12.2.1/../../../../x86_64-w64-mingw32/bin/ld: /tmp/qemu-test/build/../src/tests/plugin/insn.c:97: undefined reference to `__imp_qemu_plugin_register_vcpu_insn_exec_inline' +/usr/lib/gcc/x86_64-w64-mingw32/12.2.1/../../../../x86_64-w64-mingw32/bin/ld: /tmp/qemu-test/build/../src/tests/plugin/insn.c:94: undefined reference to `__imp_qemu_plugin_tb_get_insn' +/usr/lib/gcc/x86_64-w64-mingw32/12.2.1/../../../../x86_64-w64-mingw32/bin/ld: /tmp/qemu-test/build/../src/tests/plugin/insn.c:101: undefined reference to `__imp_qemu_plugin_register_vcpu_insn_exec_cb' +/usr/lib/gcc/x86_64-w64-mingw32/12.2.1/../../../../x86_64-w64-mingw32/bin/ld: /tmp/qemu-test/build/../src/tests/plugin/insn.c:107: undefined reference to `__imp_qemu_plugin_insn_size' +/usr/lib/gcc/x86_64-w64-mingw32/12.2.1/../../../../x86_64-w64-mingw32/bin/ld: /tmp/qemu-test/build/../src/tests/plugin/insn.c:121: undefined reference to `__imp_qemu_plugin_insn_disas' +/usr/lib/gcc/x86_64-w64-mingw32/12.2.1/../../../../x86_64-w64-mingw32/bin/ld: /tmp/qemu-test/build/../src/tests/plugin/insn.c:130: undefined reference to `__imp_qemu_plugin_register_vcpu_insn_exec_cb' +/usr/lib/gcc/x86_64-w64-mingw32/12.2.1/../../../../x86_64-w64-mingw32/bin/ld: tests/plugin/libinsn.dll.p/insn.c.obj: in function `plugin_exit': +/tmp/qemu-test/build/../src/tests/plugin/insn.c:168: undefined reference to `__imp_qemu_plugin_outs' +/usr/lib/gcc/x86_64-w64-mingw32/12.2.1/../../../../x86_64-w64-mingw32/bin/ld: /tmp/qemu-test/build/../src/tests/plugin/insn.c:168: undefined reference to `__imp_qemu_plugin_outs' +/usr/lib/gcc/x86_64-w64-mingw32/12.2.1/../../../../x86_64-w64-mingw32/bin/ld: /tmp/qemu-test/build/../src/tests/plugin/insn.c:168: undefined reference to `__imp_qemu_plugin_outs' +/usr/lib/gcc/x86_64-w64-mingw32/12.2.1/../../../../x86_64-w64-mingw32/bin/ld: tests/plugin/libinsn.dll.p/insn.c.obj: in function `vcpu_insn_matched_exec_before': +/tmp/qemu-test/build/../src/tests/plugin/insn.c:83: undefined reference to `__imp_qemu_plugin_outs' +/usr/lib/gcc/x86_64-w64-mingw32/12.2.1/../../../../x86_64-w64-mingw32/bin/ld: tests/plugin/libinsn.dll.p/insn.c.obj: in function `qemu_plugin_install': +/tmp/qemu-test/build/../src/tests/plugin/insn.c:199: undefined reference to `__imp_qemu_plugin_bool_parse' +/usr/lib/gcc/x86_64-w64-mingw32/12.2.1/../../../../x86_64-w64-mingw32/bin/ld: /tmp/qemu-test/build/../src/tests/plugin/insn.c:215: undefined reference to `__imp_qemu_plugin_register_vcpu_tb_trans_cb' +/usr/lib/gcc/x86_64-w64-mingw32/12.2.1/../../../../x86_64-w64-mingw32/bin/ld: /tmp/qemu-test/build/../src/tests/plugin/insn.c:216: undefined reference to `__imp_qemu_plugin_register_atexit_cb' +collect2: error: ld returned 1 exit status + + +If you move the qemu_plugin_api.lib to after the other .obj files, it works: + +bash-5.2$ x86_64-w64-mingw32-gcc -m64 -mcx16 plugins/qemu_plugin_api.lib -o tests/plugin/libinsn.dll tests/plugin/libinsn.dll.p/insn.c.obj tests/plugin/libinsn.dll.p/.._.._contrib_plugins_win32_linker.c.obj plugins/qemu_plugin_api.lib -Wl,--allow-shlib-undefined -shared -Wl,--start-group -Wl,--out-implib=tests/plugin/libinsn.dll.a -fstack-protector-strong -Wl,--no-seh -Wl,--nxcompat -Wl,--dynamicbase -Wl,--high-entropy-va -Wl,--warn-common /usr/x86_64-w64-mingw32/sys-root/mingw/lib/libglib-2.0.dll.a /usr/x86_64-w64-mingw32/sys-root/mingw/lib/libintl.dll.a /usr/x86_64-w64-mingw32/sys-root/mingw/lib/libgmodule-2.0.dll.a -lkernel32 -luser32 -lgdi32 -lwinspool -lshell32 -lole32 -loleaut32 -luuid -lcomdlg32 -ladvapi32 -Wl,--end-group +bash-5.2$ echo $? +0 +``` +Steps to reproduce: +``` +make docker-test-build@fedora-win64-cross J=30 V=1 EXTRA_CONFIGURE_OPTS="--enable-fdt=internal --enable-plugins" NETWORK=1 +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1974 b/results/classifier/mode-deepseek-r1:32b/output/system/1974 new file mode 100644 index 00000000..91db15fe --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1974 @@ -0,0 +1,3 @@ + + +Default console changes break Xen command-line diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1976 b/results/classifier/mode-deepseek-r1:32b/output/system/1976 new file mode 100644 index 00000000..c63e78cd --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1976 @@ -0,0 +1,51 @@ + + +SIGILL (ILL_OPC) on RISC-V Vector Operations, Bad MSTATUS_VS register +Description of problem: +When building AOSP Android and launching the public Cuttlefish RISC-V image, various binaries on the system will crash on boot with SIGILL, ILL_OPC. The crashes are random - binaries will crash largely at boot and then only crash infrequently after that. It is not always the case that the same binary will crash first, but if a binary crashes, it will always crash at the same location, usually the first vector instruction. At the time of writing, this is often the 'vsetvli' or 'vfirst.m' instruction. + +After building QEMU at head and intentionally triggering a SIGABRT prior to the ILL_OPC exception, I caught the following backtrace in gdb: + +``` +(gdb) bt +#0 __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at ./nptl/pthread_kill.c:44 +#1 0x00007f8e570bb15f in __pthread_kill_internal (signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:78 +#2 0x00007f8e5706d472 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26 +#3 0x00007f8e570574b2 in __GI_abort () at ./stdlib/abort.c:79 +#4 0x0000565536e817d7 in vs (env=<optimized out>, csrno=<optimized out>) at ../target/riscv/csr.c:101 +#5 vs (env=<optimized out>, csrno=<optimized out>) at ../target/riscv/csr.c:95 +#6 0x0000565536e83d5b in riscv_csrrw_check (write_mask=false, csrno=3106, env=0x7f8e4e2b0ed0) at ../target/riscv/csr.c:4286 +#7 riscv_csrrw (env=env@entry=0x7f8e4e2b0ed0, csrno=3106, ret_value=ret_value@entry=0x7f8bdedfbee0, new_value=new_value@entry=0, write_mask=write_mask@entry=0) + at ../target/riscv/csr.c:4366 +#8 0x0000565536e86b52 in helper_csrr (env=0x7f8e4e2b0ed0, csr=<optimized out>) at ../target/riscv/op_helper.c:54 +#9 0x00007f8de9f1af73 in code_gen_buffer () +#10 0x0000565536fa39cb in cpu_tb_exec (cpu=cpu@entry=0x7f8e4e2ae710, itb=itb@entry=0x7f8de9f1ab40 <code_gen_buffer+99724051>, tb_exit=tb_exit@entry=0x7f8bdedfc444) + at ../accel/tcg/cpu-exec.c:458 +#11 0x0000565536fa3ea1 in cpu_loop_exec_tb + (tb_exit=0x7f8bdedfc444, last_tb=<synthetic pointer>, pc=<optimized out>, tb=0x7f8de9f1ab40 <code_gen_buffer+99724051>, cpu=<optimized out>) + at ../accel/tcg/cpu-exec.c:920 +#12 cpu_exec_loop (cpu=cpu@entry=0x7f8e4e2ae710, sc=sc@entry=0x7f8bdedfc4f0) at ../accel/tcg/cpu-exec.c:1041 +#13 0x0000565536fa469d in cpu_exec_setjmp (cpu=cpu@entry=0x7f8e4e2ae710, sc=sc@entry=0x7f8bdedfc4f0) at ../accel/tcg/cpu-exec.c:1058 +#14 0x0000565536fa4c6b in cpu_exec (cpu=cpu@entry=0x7f8e4e2ae710) at ../accel/tcg/cpu-exec.c:1084 +#15 0x0000565536fbfedf in tcg_cpus_exec (cpu=cpu@entry=0x7f8e4e2ae710) at ../accel/tcg/tcg-accel-ops.c:76 +#16 0x0000565536fc0023 in mttcg_cpu_thread_fn (arg=arg@entry=0x7f8e4e2ae710) at ../accel/tcg/tcg-accel-ops-mttcg.c:95 +#17 0x0000565537144288 in qemu_thread_start (args=0x565538c01840) at ../util/qemu-thread-posix.c:541 +#18 0x00007f8e570b93ec in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:444 +#19 0x00007f8e57139a4c in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81 +``` + +Debugging in this path, it appears that the reason we're experiencing a SIGILL here is that when building a qemu-system-riscv64 binary (and thus !CONFIG_USER_ONLY), we check to see if 'riscv_cpu_vector_enabled(env)', which checks if `env->mstatus & MSTATUS_VS`. + +Interestingly, logging in this path confirms that the CPU environment of this thread does think the RVV extension is enabled (verified with `riscv_has_ext(env, RVV)`. My rough guess as to what's happening: + +1. We're not setting the MSTATUS_VS flag on initialization of the CPU, nor are we setting the mstatus_vs state to INITIALIZED. Without this, when a new thread is spawned for a vCPU, it's incorrectly determining that it can't handle vector instructions. +2. It's working sometimes because in some of the 'write_*' calls in `riscv/csr.c`, we flip the MSTATUS_VS flag on, so if one of those calls occurs first, all subsequent vector operations work too. (To be honest, I'm not quite following why we make the decision to set MSTATUS in these calls, shouldn't this be configured at CPU initialization?) +Steps to reproduce: +Please forgive the poor reproduction case, I'm still trying to wrap my head around what's going on, so haven't been able to harden a smaller example yet that would reproduce. In theory, tip-of-tree QEMU + a stock Linux system with a program that triggers a call to QEMU's vlenb instruction ahead of all other vector instructions would be the ideal case, but I'm still figuring out how to go about doing that. + +My current reproduction case is as follows: + +1. Introduce a small hack in `target/riscv/csr.c`'s `vs` function - add an `abort` call here: https://github.com/qemu/qemu/blob/master/target/riscv/csr.c#L99 +2. Build tip-of-tree QEMU for qemu-system-riscv64. +3. Use https://github.com/google/android-riscv64#can-i-try-it to build the Android RISC-V emulator. When launching the emulator, use the '-qemu_binary_dir' option to point to the directory containing the QEMU built in the previous step. +4. In a few moments, the emulator will attempt to start but abort fairly quickly (I've got a 128-core machine, and it fails consistently in about 5 seconds). diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1981 b/results/classifier/mode-deepseek-r1:32b/output/system/1981 new file mode 100644 index 00000000..8dd2c5e7 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1981 @@ -0,0 +1,12 @@ + + +wrong address of pmpaddr13 and pmpaddr14 CSRs +Description of problem: +In qemu\disas\riscv.c lines 2119 & 2120 it seems that there is a confusion about the correct address of the pmpaddr13 and pmpaddr14 CSRs +``` +line 2117 case 0x03bb: return "pmpaddr11"; +line 2118 case 0x03bc: return "pmpaddr12"; +**line 2119 case 0x03bd: return "pmpaddr14"; <--- pmpaddr13 should be here +line 2120 case 0x03be: return "pmpaddr13"; <--- pmpaddr14 should be here** +line 2121 case 0x03bf: return "pmpaddr15"; +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1984 b/results/classifier/mode-deepseek-r1:32b/output/system/1984 new file mode 100644 index 00000000..a630bff4 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1984 @@ -0,0 +1,3 @@ + + +Fails to start dataplane while using vdpa-dev with vduse backend diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/1995 b/results/classifier/mode-deepseek-r1:32b/output/system/1995 new file mode 100644 index 00000000..01aae1de --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/1995 @@ -0,0 +1,3 @@ + + +No equivalent of `-boot once` for `bootindex` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2001 b/results/classifier/mode-deepseek-r1:32b/output/system/2001 new file mode 100644 index 00000000..ff215818 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2001 @@ -0,0 +1,45 @@ + + +qemu_img convert and drive mirror migrate the same raw disk to rbd volume, will get the different USED size in ceph cluster. +Description of problem: +qemu_img convert and drive mirror migrate the same raw disk to rbd volume, will get the different USED size in ceph cluster. +Steps to reproduce: +create raw and qcow2 disk + +1. qemu-img create -f raw lvm_volume_1.raw 12G +2. qemu-img create -f qcow2 lvm_volume_1.qcow2 12G + + install a centos OS + +3. qemu-system-x86_64 -m 4096 -drive file=lvm_volume_1.qcow2,format=qcow2,index=0 -nographic -cdrom CentOS-8.3.2011-x86_64-dvd1.iso -vnc :25 + + convert the qcow2 OS disk to q raw OS disk + +4. qemu-img convert -f qcow2 -O raw ./lvm_volume_1.qcow2 ./lvm_volume_1.raw + + create a qemu-rbd process + +5. qemu-nbd --fork -x node1 -p 1238 rbd:cephpool- test/volume_1:id=xxx:key=xxx:mon_host=xxx:auth_supported=cephx + + boot the raw OS disk + +6. qemu-system-x86_64 -hda ./lvm_volume_1.raw -m 4096 -smp 4 -vnc :25 -monitor stdio + + migrate the raw OS disk to a ceph volume + +7. drive_mirror -n -f #block125 nbd:localhost:1238:exportname=node1 raw + + check the rbd volume USED size in ceph cluster + "rbd du cephpool-test/volume_1" + the ceph rbd volume PROVISION and USED are the same size + + convert the raw OS disk to a ceph volume + +8. qemu-img convert -n -f raw -O raw ./lvm_volume_1.raw rbd:cephpool- +test/volume_2:id=xxx:key=xxx:mon_host=xxx:auth_supported=cephx + + check the rbd volume USED size in ceph cluster + "rbd du cephpool-test/volume_2" + the ceph rbd volume PROVISION and USED are different PROVISION > USED +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2005 b/results/classifier/mode-deepseek-r1:32b/output/system/2005 new file mode 100644 index 00000000..05c9dda2 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2005 @@ -0,0 +1,31 @@ + + +qemu-system-aarch64: ../target/arm/helper.c:6757: sve_vqm1_for_el_sm: Assertion `sm' failed. +Description of problem: +Qemu crashes when sve is completely disabled for CPU model "max" (`-cpu max,sve=off`). Using any CPU model which does not include SVE, or using only e.g. SVE128 (`-cpu max,sve128=on`) works fine.\ +\ +`#0 0x00007f94b8291dec in __pthread_kill_implementation () at /lib64/libc.so.6 `\ +`#1 0x00007f94b823f0c6 in raise () at /lib64/libc.so.6 `\ +`#2 0x00007f94b82268d7 in abort () at /lib64/libc.so.6 `\ +`#3 0x00007f94b82267eb in _nl_load_domain.cold () at /lib64/libc.so.6 `\ +`#4 0x00007f94b8237016 in () at /lib64/libc.so.6 `\ +`#5 0x000055d6794aa698 in sve_vqm1_for_el_sm (env=env@entry=0x55d67c6ff9b0, el=el@entry=1, sm=false) at ../target/arm/helper.c:6757 `\ +`#6 0x000055d6794afc29 in sve_vqm1_for_el (el=1, env=0x55d67c6ff9b0) at ../target/arm/helper.c:6763 `\ +`#7 smcr_write (env=0x55d67c6ff9b0, ri=0x55d67c78f600, value=<optimized out>) at ../target/arm/helper.c:6887 `\ +`#8 0x00007f9469bad101 in code_gen_buffer () `\ +`#9 0x000055d67977dc19 in cpu_tb_exec (cpu=cpu@entry=0x55d67c6fd1f0, itb=<optimized out>, tb_exit=tb_exit@entry=0x7f94acdcc4c4) at ../accel/tcg/cpu-exec.c:457 `\ +`#10 0x000055d67977e59f in cpu_loop_exec_tb (tb_exit=0x7f94acdcc4c4, last_tb=<synthetic pointer>, pc=<optimized out>, tb=<optimized out>, cpu=<optimized out>) at ../accel/tcg/cpu-exec.c:919 `\ +`#11 cpu_exec_loop (cpu=cpu@entry=0x55d67c6fd1f0, sc=sc@entry=0x7f94acdcc570) at ../accel/tcg/cpu-exec.c:1040 `\ +`#12 0x000055d67977ee7d in cpu_exec_setjmp (cpu=0x55d67c6fd1f0, sc=0x7f94acdcc570) at ../accel/tcg/cpu-exec.c:1057 `\ +`#13 0x000055d679787c3d in cpu_exec (cpu=0x55d67c6fd1f0) at ../accel/tcg/cpu-exec.c:1083 `\ +`#14 0x000055d6797a1d52 in tcg_cpus_exec (cpu=0x55d67c6fd1f0) at ../accel/tcg/tcg-accel-ops.c:75 `\ +`#15 mttcg_cpu_thread_fn (arg=arg@entry=0x55d67c6fd1f0) at ../accel/tcg/tcg-accel-ops-mttcg.c:95 `\ +`#16 0x000055d679938698 in qemu_thread_start (args=0x55d67c7a1500) at ../util/qemu-thread-posix.c:541 `\ +`#17 0x00007f94b828ff44 in start_thread () at /lib64/libc.so.6 `\ +`#18 0x00007f94b8318314 in clone () at /lib64/``libc.so``.6`\ + \ +This happens when the system is booting, i.e. grub has just finished, loaded kernel and initrd, and the kernel has just began to run, i.e. early in the kernel startup. +Steps to reproduce: +1. +2. +3. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2009 b/results/classifier/mode-deepseek-r1:32b/output/system/2009 new file mode 100644 index 00000000..bccd799a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2009 @@ -0,0 +1,3 @@ + + +ld: warning: -undefined error is deprecated diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/201 b/results/classifier/mode-deepseek-r1:32b/output/system/201 new file mode 100644 index 00000000..788e7ad5 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/201 @@ -0,0 +1,3 @@ + + +Create an asynchronous Python QMP library diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2011 b/results/classifier/mode-deepseek-r1:32b/output/system/2011 new file mode 100644 index 00000000..3901fbf8 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2011 @@ -0,0 +1,3 @@ + + +ARM emulation layer for Windows x86_64 OS request diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2013 b/results/classifier/mode-deepseek-r1:32b/output/system/2013 new file mode 100644 index 00000000..3f808137 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2013 @@ -0,0 +1,80 @@ + + +The avocado test replay_kernel.py:ReplayKernelNormal.test_mips64el_malta is unreliable +Description of problem: +This test keeps hanging on CI +Steps to reproduce: +Run the test on GitLab's CI infrastructure and it will hang on replay. Examples: https://gitlab.com/stsquad/qemu/-/jobs/5664260736 +Additional information: +Excerpt from log: + +``` +18:02:49 DEBUG| Transitioning from 'Runstate.CONNECTING' to 'Runstate.RUNNING'. +18:02:49 DEBUG| Opening console file +18:02:49 DEBUG| Opening console socket +18:02:49 DEBUG| [ 0.000000] Initializing cgroup subsys cpuset +18:02:49 DEBUG| [ 0.000000] Initializing cgroup subsys cpu +18:02:49 DEBUG| [ 0.000000] Linux version 2.6.32-5-5kc-malta (Debian 2.6.32-48) (ben@decadent.org.uk) (gcc version 4.3.5 (Debian 4.3.5-4) ) #1 Fri Feb 15 21:38:11 UTC 2013 +18:02:49 DEBUG| [ 0.000000] +18:02:49 DEBUG| [ 0.000000] LINUX started... +18:02:49 DEBUG| [ 0.000000] bootconsole [early0] enabled +18:02:49 DEBUG| [ 0.000000] CPU revision is: 000182a0 (MIPS 20Kc) +18:02:49 DEBUG| [ 0.000000] FPU revision is: 000f8200 +18:02:49 DEBUG| [ 0.000000] Checking for the multiply/shift bug... no. +18:02:49 DEBUG| [ 0.000000] Checking for the daddiu bug... no. +18:02:49 DEBUG| [ 0.000000] Determined physical RAM map: +18:02:49 DEBUG| [ 0.000000] memory: 0000000000001000 @ 0000000000000000 (reserved) +18:02:49 DEBUG| [ 0.000000] memory: 00000000000ef000 @ 0000000000001000 (ROM data) +18:02:49 DEBUG| [ 0.000000] memory: 0000000000659000 @ 00000000000f0000 (reserved) +18:02:49 DEBUG| [ 0.000000] memory: 00000000078b7000 @ 0000000000749000 (usable) +18:02:49 DEBUG| [ 0.000000] Wasting 104440 bytes for tracking 1865 unused pages +18:02:49 DEBUG| [ 0.000000] Initrd not found or empty - disabling initrd +18:02:49 DEBUG| [ 0.000000] Zone PFN ranges: +18:02:49 DEBUG| [ 0.000000] DMA 0x00000000 -> 0x00001000 +18:02:49 DEBUG| [ 0.000000] Normal 0x00001000 -> 0x00008000 +18:02:49 DEBUG| [ 0.000000] Movable zone start PFN for each node +18:02:49 DEBUG| [ 0.000000] early_node_map[1] active PFN ranges +18:02:49 DEBUG| [ 0.000000] 0: 0x00000000 -> 0x00008000 +18:02:49 DEBUG| [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32320 +18:02:49 DEBUG| [ 0.000000] Kernel command line: printk.time=1 panic=-1 console=ttyS0 +18:02:49 DEBUG| Shutting down VM appliance; timeout=30 +18:02:49 DEBUG| Attempting graceful termination +18:02:49 DEBUG| Closing console file +18:02:49 DEBUG| Closing console socket +18:02:49 DEBUG| Politely asking QEMU to terminate +... + +18:02:49 DEBUG| Transitioning from 'Runstate.CONNECTING' to 'Runstate.RUNNING'. +18:02:49 DEBUG| Opening console file +18:02:49 DEBUG| Opening console socket +18:02:49 DEBUG| [ 0.000000] Initializing cgroup subsys cpuset +18:02:49 DEBUG| [ 0.000000] Initializing cgroup subsys cpu +18:02:49 DEBUG| [ 0.000000] Linux version 2.6.32-5-5kc-malta (Debian 2.6.32-48) (ben@decadent.org.uk) (gcc version 4.3.5 (Debian 4.3.5-4) ) #1 Fri Feb 15 21:38:11 UTC 2013 +18:02:49 DEBUG| [ 0.000000] +18:02:49 DEBUG| [ 0.000000] LINUX started... +18:02:49 DEBUG| [ 0.000000] bootconsole [early0] enabled +18:02:49 DEBUG| [ 0.000000] CPU revision is: 000182a0 (MIPS 20Kc) +18:02:49 DEBUG| [ 0.000000] FPU revision is: 000f8200 +18:02:49 DEBUG| [ 0.000000] Checking for the multiply/shift bug... no. +18:02:49 DEBUG| [ 0.000000] Checking for the daddiu bug... no. +18:02:49 DEBUG| [ 0.000000] Determined physical RAM map: +18:02:49 DEBUG| [ 0.000000] memory: 0000000000001000 @ 0000000000000000 (reserved) +18:02:49 DEBUG| [ 0.000000] memory: 00000000000ef000 @ 0000000000001000 (ROM data) +18:02:49 DEBUG| [ 0.000000] memory: 0000000000659000 @ 00000000000f0000 (reserved) +18:02:49 DEBUG| [ 0.000000] m +18:04:48 ERROR| +18:04:48 ERROR| Reproduced traceback from: /builds/stsquad/qemu/build/pyvenv/lib/python3.10/site-packages/avocado/core/test.py:770 +18:04:48 ERROR| Traceback (most recent call last): +18:04:48 ERROR| File "/builds/stsquad/qemu/build/tests/avocado/replay_kernel.py", line 147, in test_mips64el_malta +18:04:48 ERROR| self.run_rr(kernel_path, kernel_command_line, console_pattern, shift=5) +18:04:48 ERROR| File "/builds/stsquad/qemu/build/tests/avocado/replay_kernel.py", line 78, in run_rr +18:04:48 ERROR| t2 = self.run_vm(kernel_path, kernel_command_line, console_pattern, +18:04:48 ERROR| File "/builds/stsquad/qemu/build/tests/avocado/replay_kernel.py", line 61, in run_vm +18:04:48 ERROR| self.wait_for_console_pattern(console_pattern, vm) +18:04:48 ERROR| File "/builds/stsquad/qemu/build/tests/avocado/boot_linux_console.py", line 52, in wait_for_console_pattern +18:04:48 ERROR| wait_for_console_pattern(self, success_message, +18:04:48 ERROR| File "/builds/stsquad/qemu/build/tests/avocado/avocado_qemu/__init__.py", line 199, in wait_for_console_pattern +18:04:48 ERROR| _console_interaction(test, success_message, failure_message, None, vm=vm) +18:04:48 ERROR| File "/builds/stsquad/qemu/build/tests/avocado/avocado_qemu/__init__.py", line 148, in _console_interaction +18:04:48 ERROR| msg = console.readline().decode().strip() +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2021 b/results/classifier/mode-deepseek-r1:32b/output/system/2021 new file mode 100644 index 00000000..345d6cbe --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2021 @@ -0,0 +1,3 @@ + + +crashing when trying to read data from sensor though usb diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2028 b/results/classifier/mode-deepseek-r1:32b/output/system/2028 new file mode 100644 index 00000000..1a922598 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2028 @@ -0,0 +1,3 @@ + + +CAN sja1000 standard frame filter bug diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2030 b/results/classifier/mode-deepseek-r1:32b/output/system/2030 new file mode 100644 index 00000000..accd9619 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2030 @@ -0,0 +1,19 @@ + + +Unreachable code +Description of problem: +There is always a false condition in the function `alloc_code_gen_buffer_splitwx_memfd` in the file `tcg/region.c`. If `buf_rw == NULL` we go to the mark __fail__: + +https://gitlab.com/qemu-project/qemu/-/blob/master/tcg/region.c?ref_type=heads#L580-L583 + +But the value of `buf_rx` is __`MAP_FAILED`__: + +https://gitlab.com/qemu-project/qemu/-/blob/master/tcg/region.c?ref_type=heads#L577 + +And this line will never be reached: + +https://gitlab.com/qemu-project/qemu/-/blob/master/tcg/region.c?ref_type=heads#L601 + +Found by Linux Verification Center (portal.linuxtesting.ru) with SVACE. + +Author A. Voronin. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2032 b/results/classifier/mode-deepseek-r1:32b/output/system/2032 new file mode 100644 index 00000000..2305a274 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2032 @@ -0,0 +1,33 @@ + + +qemu-guest-agent not starting +Description of problem: +Trace found in syslog : +``` +syslog:Dec 11 13:45:08 mail systemd[1]: dev-virtio\x2dports-org.qemu.guest_agent.0.device: Job dev-virtio\x2dports-org.qemu.guest_agent.0.device/start timed out. +syslog:Dec 11 13:45:08 mail systemd[1]: Timed out waiting for device /dev/virtio-ports/org.qemu.guest_agent.0. +syslog:Dec 11 13:45:08 mail systemd[1]: qemu-guest-agent.service: Job qemu-guest-agent.service/start failed with result 'dependency'. +syslog:Dec 11 13:45:08 mail systemd[1]: dev-virtio\x2dports-org.qemu.guest_agent.0.device: Job dev-virtio\x2dports-org.qemu.guest_agent.0.device/start failed with result 'timeout'. +``` +Steps to reproduce: +systemctl start qemu-guest-agent +Additional information: +Messages when installing the systemd unit : +``` +systemctl enable qemu-guest-agent +Synchronizing state of qemu-guest-agent.service with SysV service script with /lib/systemd/systemd-sysv-install. +Executing: /lib/systemd/systemd-sysv-install enable qemu-guest-agent +The unit files have no installation config (WantedBy=, RequiredBy=, Also=, +Alias= settings in the [Install] section, and DefaultInstance= for template +units). This means they are not meant to be enabled using systemctl. + +Possible reasons for having this kind of units are: +• A unit may be statically enabled by being symlinked from another unit's + .wants/ or .requires/ directory. +• A unit's purpose may be to act as a helper for some other unit which has + a requirement dependency on it. +• A unit may be started when needed via activation (socket, path, timer, + D-Bus, udev, scripted systemctl call, ...). +• In case of template units, the unit is meant to be enabled with some + instance name specified. + ``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2034 b/results/classifier/mode-deepseek-r1:32b/output/system/2034 new file mode 100644 index 00000000..a63b2825 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2034 @@ -0,0 +1,10 @@ + + +ERROR:../accel/tcg/cpu-exec-common.c:56:cpu_loop_exit_atomic: assertion failed: (!cpu_in_serial_context(cpu)) +Description of problem: +``` +cat boot.log +aarch64>** +aarch64>ERROR:../accel/tcg/cpu-exec-common.c:56:cpu_loop_exit_atomic: assertion failed: (!cpu_in_serial_context(cpu)) +aarch64>Bail out! ERROR:../accel/tcg/cpu-exec-common.c:56:cpu_loop_exit_atomic: assertion failed: (!cpu_in_serial_context(cpu)) +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/204 b/results/classifier/mode-deepseek-r1:32b/output/system/204 new file mode 100644 index 00000000..1cb65ca1 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/204 @@ -0,0 +1,3 @@ + + +Dos Keypad is not working for numbers - numlock is not working diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2040 b/results/classifier/mode-deepseek-r1:32b/output/system/2040 new file mode 100644 index 00000000..ed58a50d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2040 @@ -0,0 +1,26 @@ + + +x86 TCG incorrectly truncates physical addresses to 32 bits when PAE is enabled +Description of problem: +Originally observed as 32-bit Windows failing to boot on systems with RAM above 4G when using TCG (but working fine under KVM). Windows kernel debugger showed the kernel allocating a block of memory but somehow failing to create a page table mapping for it. + +Bisection in QEMU produced the first bad commit as 4a1e9d4 ("target/i386: Use atomic operations for pte updates"), which changed the PTE accessing code from using e.g. `x86_ldq_phys()` to using `probe_access_full()` and `ldq_p()`. + +Further deconstruction of the changes in this commit found that at some point during the boot, the value obtained from `ldq_p()` was completely different to the value obtained from `x86_ldq_phys()`. Debugging revealed that the underlying host addresses used by each method were exactly 4G apart, with the new method (`ldq_p()`) accessing a host location 4G below the correct address. + +Inspection of the code revealed one place where addresses are truncated to 32 bits, which would cause this 4G offset: in `get_physical_address()` we have the code: + +``` + if (!(env->hflags & HF_LMA_MASK)) { + /* Without long mode we can only address 32bits in real mode */ + out->paddr = (uint32_t)out->paddr; + } +``` + +This looks wrong, since PAE allows for physical addresses above 4G to be accessed without long mode. (This is the whole point of PAE.) + +A quick experiment shows that commenting out the above block of code fixes the symptom and allows Windows 10 to boot with RAM above 4G. + +I suspect that the test should be checking for PAE being enabled rather than long mode being enabled. (Enabling PAE is part of setting up the CPU for long mode, so it is impossible to be in long mode without PAE already enabled.) +Steps to reproduce: +Run the command given above. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2048 b/results/classifier/mode-deepseek-r1:32b/output/system/2048 new file mode 100644 index 00000000..541a4e4f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2048 @@ -0,0 +1,3 @@ + + +Host: Wayland sdl display problem diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2049 b/results/classifier/mode-deepseek-r1:32b/output/system/2049 new file mode 100644 index 00000000..e2bdf88f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2049 @@ -0,0 +1,13 @@ + + +drive-mirror RBD thin +Description of problem: +I found that this problem was first discovered in 2014. There was a post +[2014 bug description](https://lists.gnu.org/archive/html/qemu-devel/2014-10/msg01231.html )、 +[2014 patch](https://patchwork.ozlabs.org/project/qemu-devel/patch/1433747185-16797-2-git-send-email-famz@redhat.com/) +mentioning this bug. +The patch in the post said that this problem had been solved, but after trying and asking, I found that the problem had not been solved. +Later, I saw this problem in the [2017 bug description](https://forum.proxmox.com/threads/drive-mirror-rbd-thin.33250/#post-613502) forum and it was said that there was a patch to fix it, but it was not. +I tried the latest qemu version and found that this problem has not been solved. +Additional information: +nbd is normal, but rbd is wrong！ diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2054 b/results/classifier/mode-deepseek-r1:32b/output/system/2054 new file mode 100644 index 00000000..eb2c57f5 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2054 @@ -0,0 +1,44 @@ + + +chacha20-s390 broken in 8.2.0 in TCG on s390x +Description of problem: +When running linux guest in qemu-system-s390x in TCG mode, it fails at selftests of crypto algorithms, namely at chacha20: +``` +[ 10.546690] alg: skcipher: chacha20-s390 encryption test failed (wrong result) on test vector 1, cfg="in-place (one sglist)" +[ 10.546914] alg: self-tests for chacha20 using chacha20-s390 failed (rc=-22) +[ 10.546969] ------------[ cut here ]------------ +[ 10.546998] alg: self-tests for chacha20 using chacha20-s390 failed (rc=-22) +[ 10.547182] WARNING: CPU: 1 PID: 109 at crypto/testmgr.c:5936 alg_test+0x55a/0x5b8 +[ 10.547510] Modules linked in: net_failover chacha_s390(+) libchacha virtio_blk(+) failover +[ 10.547854] CPU: 1 PID: 109 Comm: cryptomgr_test Not tainted 6.5.0-5-s390x #1 Debian 6.5.13-1 +[ 10.548002] Hardware name: QEMU 8561 QEMU (KVM/Linux) +[ 10.548101] Krnl PSW : 0704c00180000000 00000000005df8fe (alg_test+0x55e/0x5b8) +[ 10.548207] R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:0 PM:0 RI:0 EA:3 +[ 10.548291] Krnl GPRS: 0000000000000000 0000000001286408 00000000005df8fa 0000000001286408 +[ 10.548337] 000000000014bf14 00000000001c6ba8 0000000001838b3c 0000000000000005 +[ 10.548475] 00000000025a4880 00000000025a4800 ffffffffffffffea 00000000ffffffea +[ 10.548521] 000000003e649200 00000000ffffffff 00000000005df8fa 000003800016bcf8 +[ 10.549504] Krnl Code: 00000000005df8ee: c020003b5828 larl %r2,0000000000d4a93e +[ 10.549504] 00000000005df8f4: c0e5ffdb62d2 brasl %r14,000000000014be98 +[ 10.549504] #00000000005df8fa: af000000 mc 0,0 +[ 10.549504] >00000000005df8fe: a7f4fee6 brc 15,00000000005df6ca +[ 10.549504] 00000000005df902: b9040042 lgr %r4,%r2 +[ 10.549504] 00000000005df906: b9040039 lgr %r3,%r9 +[ 10.549504] 00000000005df90a: c020003b57df larl %r2,0000000000d4a8c8 +[ 10.549504] 00000000005df910: 18bd lr %r11,%r13 +[ 10.550004] Call Trace: +[ 10.550375] [<00000000005df8fe>] alg_test+0x55e/0x5b8 +[ 10.550467] ([<00000000005df8fa>] alg_test+0x55a/0x5b8) +[ 10.550489] [<00000000005d9fbc>] cryptomgr_test+0x34/0x60 +[ 10.550514] [<000000000017d004>] kthread+0x124/0x130 +[ 10.550539] [<0000000000103124>] __ret_from_fork+0x3c/0x50 +[ 10.550562] [<0000000000b1dfca>] ret_from_fork+0xa/0x30 +[ 10.550611] Last Breaking-Event-Address: +[ 10.550626] [<000000000014bf20>] __warn_printk+0x88/0x110 +[ 10.550723] ---[ end trace 0000000000000000 ]--- +``` +An interesting issue here - it does not happen on, say, amd64 host running qemu-system-s390x, but happens on s390x host. I haven't tried other hosts though. + +Bisection points at v8.1.0-2627-gab84dc398b commit, "tcg/optimize: Optimize env memory operations". + +https://lore.kernel.org/qemu-devel/d5e8f88b-1d19-4e00-8dc2-b20e0cd34931@tls.msk.ru/T/#u is the original report on qemu-devel. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2055 b/results/classifier/mode-deepseek-r1:32b/output/system/2055 new file mode 100644 index 00000000..6c89053a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2055 @@ -0,0 +1,9 @@ + + +Unable to set the PBMTE bit in the menvcfg register for RISCV 64 bit +Description of problem: +We are unable to program the PBMTE bit in the menvcfg register of a RV64 machine. The following is the command that was used to do this. + +write_csr(menvcfg,PTE_PBMT); +Steps to reproduce: +1. A simple test program with the above command should be able to reproduce this issue. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2055003 b/results/classifier/mode-deepseek-r1:32b/output/system/2055003 new file mode 100644 index 00000000..053f562e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2055003 @@ -0,0 +1,67 @@ + + +Qemu cmdline core dumped with more(8193 or more) cpus + +---Debugger--- +A debugger is not configured + +---Steps to Reproduce--- + +---Problem Description--- + Qemu cmdline core dumped with more(8193 or more) cpus + +---Debugger--- +A debugger is not configured + +---Steps to Reproduce--- + Qemu cmdline core dumped when more number of CPUs were given. + + +[root@ltcmihawk39 ~]# qemu-system-ppc64 -accel tcg -smp 10,maxcpus=9000 +** +ERROR:../tcg/region.c:782:tcg_region_init: assertion failed: (region_size >= 2 * page_size) +Bail out! ERROR:../tcg/region.c:782:tcg_region_init: assertion failed: (region_size >= 2 * page_size) +Aborted (core dumped) + +Expected Result: +Warning message like "Number of cpus requested exceeds the cpus supported" + +Actual Result: +core dumped + +Steps to Reproduce: +-------------------- + +1. Clone the upstream qemu from https://gitlab.com/qemu-project/qemu.git +2. Compile qemu with below steps. + cd qemu/ + git submodule init + git submodule update --recursive + ./configure --target-list=ppc64-softmmu --prefix=/usr + make + make install +3. set maxcpus=8193 or more + + +[root@ltcmihawk39 ~]# qemu-system-ppc64 --version +QEMU emulator version 8.0.94 (v8.1.0-rc4) +Copyright (c) 2003-2023 Fabrice Bellard and the QEMU Project developers + +NOTE: This behavior is observed only when qemu is built without disabling the tcg. + +Contact Information = <email address hidden> + +Machine Type = x + +---uname output--- +x + +Action needed + +Our IBM Dev want to include this patch in latest Canonical distro. + +Need the distro to review and integrate fixes provided by IBM + +https://github.com/qemu/qemu/commit/c4f91d7b7be76c47015521ab0109c6e998a369b0 + +Need to include this commit in latest Canonical distro. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2057 b/results/classifier/mode-deepseek-r1:32b/output/system/2057 new file mode 100644 index 00000000..fd1cbe0b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2057 @@ -0,0 +1,7 @@ + + +QEMU 8.2 configure error +Description of problem: +please see output upper +Steps to reproduce: +1. Just run ./configure diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2064 b/results/classifier/mode-deepseek-r1:32b/output/system/2064 new file mode 100644 index 00000000..e7e6d1a1 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2064 @@ -0,0 +1,14 @@ + + +QEMU v8.2.0-rc4 and above will not take SMI +Description of problem: +Starting from v8.2.0-rc4, the x86 QEMU system will take SMI from an incorrect starting address. Without any firmware relocation, sending an SMI will move the RIP to 0x8000, instead of the traditional 0x38000. This caused the existing UEFI drivers not functional during SMI relocation step. + +After some investigation, the issue was caused by this commit: https://github.com/qemu/qemu/commit/b5e0d5d22fbffc3d8f7d3e86d7a2d05a1a974e27. There seems to be 2 issues with this change: + +1. This code section https://github.com/qemu/qemu/blob/7425b6277f12e82952cede1f531bfc689bf77fb1/target/i386/tcg/translate.c#L568C1-L572C6 was updated from calculating `cpu_eip` based on `s->pc` to `s->base.pc_next`. This will cause undetermined behavior. +2. This code section https://github.com/qemu/qemu/blob/7425b6277f12e82952cede1f531bfc689bf77fb1/target/i386/tcg/translate.c#L2848C1-L2869C67 added the routine of updating `new_pc`, which is later used `tcg_gen_addi_tl`. This will cause the `new_pc` to be populated with undesirable value and thus cause faulting behaviors. +Steps to reproduce: +1. Launch once booting UEFI firmware, and the system will get stuck at the SMM base relocation logic. +Additional information: +I verified that after fixing the 2 issues mentioned above, the SMI can be correctly invoked at desired location. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2065579 b/results/classifier/mode-deepseek-r1:32b/output/system/2065579 new file mode 100644 index 00000000..a6bd7d77 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2065579 @@ -0,0 +1,78 @@ + + +[UBUNTU 22.04] OS guest boot issues on 9p filesystem + +=== Reported by <email address hidden> - 2024-05-13 03:53:01 === + +---Problem Description--- +OS guest boot issues on 9p filesystem due to unix domain sockets open failure + +Contact Information = <email address hidden> + +Machine Type = 3931-7G4 + +---uname output--- +5.15.0-92-generic #102-Ubuntu SMP Wed Jan 10 09:35:24 UTC 2024 s390x s390x s390x GNU/Linux + +---Steps to Reproduce--- + #!/bin/bash + +# Cleanup target dir +[ -d ./target ] && rm -rf target +mkdir target + +# Add configuration updates +mkdir -p ./target/etc/initramfs-tools/ +echo 9p >> ./target/etc/initramfs-tools/modules +echo 9pnet_virtio >> ./target/etc/initramfs-tools/modules + +# Add the test script +cat > ./target/test_init << EOF +#!/bin/bash + +echo "Test for unix domain sockets" + +nc -Ul /socket & +sleep 1 +echo "Sockets work" | nc -UN /socket || echo "Sockets fail" + +echo o > /proc/sysrq-trigger +sleep 999 +EOF +chmod 700 ./target/test_init + +# Create an Ubuntu 23.10 around it +echo "Creating Ubuntu target OS" +debootstrap --variant=minbase\ + --include=udev,kmod,initramfs-tools,systemd,netcat-openbsd,linux-image-generic \ + --exclude=man,bash-completion \ + mantic ./target > /dev/null || exit 1 + +# Run the test in 9p forwarded filesystem +echo "Running OS in qemu" +qemu-system-s390x \ + -m 8192 \ + -smp 4 \ + -nodefaults -nographic -no-reboot -no-user-config \ + -kernel ./target/boot/vmlinuz \ + -initrd ./target/boot/initrd.img \ + -append 'root=fsRoot rw rootfstype=9p rootflags=trans=virtio,version=9p2000.L,msize=512000,cache=mmap,posixacl console=ttysclp0 init=/test_init quiet' \ + -fsdev local,security_model=passthrough,multidevs=remap,id=fsdev-fsRoot,path=./target \ + -device virtio-9p-pci,id=fsRoot,fsdev=fsdev-fsRoot,mount_tag=fsRoot \ + -device virtio-serial-ccw -device sclpconsole,chardev=console \ + -chardev stdio,id=console,signal=off + + +---Debugger--- +A debugger is not configured + +Userspace rpm: qemu-(current).deb + +Userspace tool common name: qemu + +Userspace tool obtained from project website: na + +The userspace tool has the following bit modes: both + +*Additional Instructions for <email address hidden>: +-Attach ltrace and strace of userspace application. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2067 b/results/classifier/mode-deepseek-r1:32b/output/system/2067 new file mode 100644 index 00000000..56205dbd --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2067 @@ -0,0 +1,3 @@ + + +screen unblanking issue with debian 12 gui diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2072 b/results/classifier/mode-deepseek-r1:32b/output/system/2072 new file mode 100644 index 00000000..c674973f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2072 @@ -0,0 +1,3 @@ + + +Regression in 8.2: Synchronous Exception when running a VM on AArch64 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2076 b/results/classifier/mode-deepseek-r1:32b/output/system/2076 new file mode 100644 index 00000000..3b5c8937 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2076 @@ -0,0 +1,3 @@ + + +stringop-overread warning in tests/tcg/multiarch/sha1.c diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/209 b/results/classifier/mode-deepseek-r1:32b/output/system/209 new file mode 100644 index 00000000..dec06044 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/209 @@ -0,0 +1,3 @@ + + +the version number of qemu 6.0.0 is still 5.2.0 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2092 b/results/classifier/mode-deepseek-r1:32b/output/system/2092 new file mode 100644 index 00000000..6090ca4a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2092 @@ -0,0 +1,72 @@ + + +i386: TCG + virtiofs fails to boot Fedora/CentOS/OpenSUSE since QEMU v7.2 +Description of problem: +When booting from virtiofs with TCG acceleration, after switch root from initramfs to rootfs, the system crashes horribly, see logs below. The failures only happen when TCG acceleration is used with a virtiofs rootfs. Switching TCG for KVM acceleration or virtiofs for a disk image makes the issue disappear. This has started happening since QEMU version 7.2. Using any qemu version before QEMU version 7.2 works fine. Additionally, it only seems to happen with CentOS Stream, Fedora and OpenSUSE. Using Debian, Ubuntu or Arch Linux, this combination boots fine. + +cc @bonzini since you made quite a few changes to TCG acceleration in QEMU v7.2. +Steps to reproduce: +1. `git clone https://github.com/systemd/mkosi` +2. `cd mkosi` +3. `bin/mkosi -d fedora -t directory --tools-tree=default --qemu-kvm=no --debug qemu` (this will build an image first so will take a while. Depending on your distribution you might need to install `dnf` and `bubblewrap`) +Additional information: +``` +<initramfs boot logs skipped for brevity> +Welcome to Fedora Linux 39 (Thirty Nine)! + +[ 37.137287] systemd[1]: Initializing machine ID from random generator. +[ 37.209193] kauditd_printk_skb: 9 callbacks suppressed +[ 37.209227] audit: type=1334 audit(1704961693.242:45): prog-id=16 op=LOAD +[ 37.210718] audit: type=1334 audit(1704961693.243:46): prog-id=16 op=UNLOAD +[ 37.211491] audit: type=1334 audit(1704961693.244:47): prog-id=17 op=LOAD +[ 37.212766] audit: type=1334 audit(1704961693.245:48): prog-id=17 op=UNLOAD +[ 37.241136] audit: type=1334 audit(1704961693.274:49): prog-id=18 op=LOAD +[ 37.242803] audit: type=1334 audit(1704961693.275:50): prog-id=18 op=UNLOAD +[ 37.244114] audit: type=1334 audit(1704961693.277:51): prog-id=19 op=LOAD +[ 37.245790] audit: type=1334 audit(1704961693.278:52): prog-id=19 op=UNLOAD +[ 37.259849] audit: type=1334 audit(1704961693.291:53): prog-id=20 op=LOAD +[ 37.260072] audit: type=1334 audit(1704961693.292:54): prog-id=20 op=UNLOAD +[ 37.870091] systemd[1]: bpf-lsm: BPF LSM hook not enabled in the kernel, BPF LSM not supported +[ 38.074465] Process 299(false) has RLIMIT_CORE set to 1 +[ 38.074793] Aborting core +[ 38.077885] Process 297(false) has RLIMIT_CORE set to 1 +[ 38.078066] Aborting core +[ 38.079360] Process 298(false) has RLIMIT_CORE set to 1 +[ 38.079516] Aborting core +[ 38.114888] Process 301(false) has RLIMIT_CORE set to 1 +[ 38.115072] Aborting core +[ 38.217830] Process 305(false) has RLIMIT_CORE set to 1 +[ 38.218038] Aborting core +[ 38.219161] Process 304(false) has RLIMIT_CORE set to 1 +[ 38.219337] Aborting core +[ 38.287937] Process 308(false) has RLIMIT_CORE set to 1 +[ 38.288169] Aborting core +[ 38.323829] Process 309(false) has RLIMIT_CORE set to 1 +[ 38.324045] Aborting core +[ 38.325457] Process 310(false) has RLIMIT_CORE set to 1 +[ 38.325811] Aborting core +[ 38.447773] Process 315(false) has RLIMIT_CORE set to 1 +[ 38.447934] Aborting core +[ 38.449525] Process 314(false) has RLIMIT_CORE set to 1 +[ 38.449768] Aborting core +[ 38.462210] (sd-execu[291]: /usr/lib/systemd/system-generators/systemd-integritysetup-generator terminated by signal SEGV. +[ 38.478826] Process 316(false) has RLIMIT_CORE set to 1 +[ 38.479001] Aborting core +[ 42.397416] systemd[1]: Populated /etc with preset unit settings. +[ 42.532156] show_signal_msg: 68 callbacks suppressed +[ 42.535164] systemd[1]: segfault at b0 ip 00007f3ca95074ed sp 00007ffc7aa5f1c0 error 4 in libsystemd-core-254.7-1.fc39.so[7f3ca944c000+135000] likely on CPU 0 (core 0, socket 0) +[ 42.536289] Code: 00 48 89 fb 75 6f c6 87 88 04 00 00 01 48 8b 7f 70 45 31 ed 48 85 ff 75 1e e9 7f 00 00 00 0f 1f 80 00 00 00 00 e8 f3 24 f5 ff <48> 8b 7b 70 41 83 c5 01 48 85 ff 74 66 f6 87 63 04 00 00 01 75 e5 +[ 42.543019] systemd[1]: Caught <SEGV> from PID 176. +[ 42.543516] audit: type=1701 audit(1704961698.576:99): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=317 comm="systemd" exe="/usr/lib/systemd/systemd" sig=11 res=1 +[ 42.593878] traps: false[318] general protection fault ip:7fcccd942fa0 sp:7ffd528a8020 error:0 in libc.so.6[7fcccd928000+160000] +[ 42.594494] Process 318(false) has RLIMIT_CORE set to 1 +[ 42.594831] Aborting core +[ 42.595808] audit: type=1701 audit(1704961698.627:100): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=318 comm="false" exe="/usr/bin/false" sig=11 res=1 +[ 42.603224] systemd[1]: Caught <SEGV>, dumped core as pid 317. +[ 42.604202] systemd[1]: Freezing execution. +[ 42.656248] audit: type=1335 audit(1704961698.689:101): pid=1 uid=0 auid=4294967295 tty=(none) ses=4294967295 comm="systemd" exe="/usr/lib/systemd/systemd" nl-mcgrp=1 op=disconnect res=1 +[ 42.657685] audit: type=1334 audit(1704961698.690:102): prog-id=14 op=UNLOAD +[ 42.657852] audit: type=1334 audit(1704961698.690:103): prog-id=15 op=UNLOAD +[ 42.658011] audit: type=1334 audit(1704961698.690:104): prog-id=11 op=UNLOAD +[ 42.658201] audit: type=1334 audit(1704961698.690:105): prog-id=12 op=UNLOAD +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2094 b/results/classifier/mode-deepseek-r1:32b/output/system/2094 new file mode 100644 index 00000000..f4a484a3 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2094 @@ -0,0 +1,9 @@ + + +Various record/replay avocado tests hang when run under gitlab CI +Description of problem: +While previous fixes have gone in including #2010 and #2013 we are still seeing +hangs on CI. Some examples: + + https://gitlab.com/thuth/qemu/-/jobs/5910241580#L227 + https://gitlab.com/thuth/qemu/-/jobs/5910241593#L396 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2096 b/results/classifier/mode-deepseek-r1:32b/output/system/2096 new file mode 100644 index 00000000..23b90cd3 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2096 @@ -0,0 +1,3 @@ + + +test-x86-cpuid-compat qtest produces warnings on TCG diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2098 b/results/classifier/mode-deepseek-r1:32b/output/system/2098 new file mode 100644 index 00000000..1c13efe8 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2098 @@ -0,0 +1,3 @@ + + +AArch32 Arm CPUs no longer support the 'vfp' property diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2104 b/results/classifier/mode-deepseek-r1:32b/output/system/2104 new file mode 100644 index 00000000..b4a58aa5 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2104 @@ -0,0 +1,3 @@ + + +source code of function trace_memory_region_ops_write() diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2105 b/results/classifier/mode-deepseek-r1:32b/output/system/2105 new file mode 100644 index 00000000..724f8f7f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2105 @@ -0,0 +1,3 @@ + + +memory trace not logging every memory write operation diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2107 b/results/classifier/mode-deepseek-r1:32b/output/system/2107 new file mode 100644 index 00000000..f3625dd1 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2107 @@ -0,0 +1,3 @@ + + +target/riscv: zve32x/zve64x are not supported diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/211 b/results/classifier/mode-deepseek-r1:32b/output/system/211 new file mode 100644 index 00000000..6d769a4e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/211 @@ -0,0 +1,3 @@ + + +qemu-aarch64-static segfault if /proc not mounted inside chroot diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2113 b/results/classifier/mode-deepseek-r1:32b/output/system/2113 new file mode 100644 index 00000000..9acdd44f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2113 @@ -0,0 +1,3 @@ + + +x64-freebsd-13-build CI job fails with "/usr/local/lib/libtasn1.so: undefined reference to strverscmp@FBSD_1.7" diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/212 b/results/classifier/mode-deepseek-r1:32b/output/system/212 new file mode 100644 index 00000000..bdfa5d49 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/212 @@ -0,0 +1,3 @@ + + +ppc64 TCG application crashes diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2120 b/results/classifier/mode-deepseek-r1:32b/output/system/2120 new file mode 100644 index 00000000..512d4961 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2120 @@ -0,0 +1,3 @@ + + +arm64: Typo in isar_feature_aa64_tidcp1 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2126 b/results/classifier/mode-deepseek-r1:32b/output/system/2126 new file mode 100644 index 00000000..c3e6f17b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2126 @@ -0,0 +1,3 @@ + + +iotest-144 sometimes fails due to minor reordering of output diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2128 b/results/classifier/mode-deepseek-r1:32b/output/system/2128 new file mode 100644 index 00000000..db405312 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2128 @@ -0,0 +1,3 @@ + + +avocado tests using landley.net URLs sometimes time out fetching assets diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2129 b/results/classifier/mode-deepseek-r1:32b/output/system/2129 new file mode 100644 index 00000000..2dda3828 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2129 @@ -0,0 +1,3 @@ + + +migration-test sometimes fails diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2130 b/results/classifier/mode-deepseek-r1:32b/output/system/2130 new file mode 100644 index 00000000..fab6b830 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2130 @@ -0,0 +1,3 @@ + + +latest code missing "singlestep" diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2131 b/results/classifier/mode-deepseek-r1:32b/output/system/2131 new file mode 100644 index 00000000..0f9f5f0b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2131 @@ -0,0 +1,3 @@ + + +tcg mem plugin, udata always zero diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2134 b/results/classifier/mode-deepseek-r1:32b/output/system/2134 new file mode 100644 index 00000000..04bbc595 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2134 @@ -0,0 +1,3 @@ + + +[Tricore Board]How to map LOCAL. DSPR/LOCAL.PSPR to other CPU globle_DSPR/globle_PSPR diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2137 b/results/classifier/mode-deepseek-r1:32b/output/system/2137 new file mode 100644 index 00000000..986ed84a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2137 @@ -0,0 +1,3 @@ + + +RISC-V Vector Slowdowns diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2138 b/results/classifier/mode-deepseek-r1:32b/output/system/2138 new file mode 100644 index 00000000..666d617e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2138 @@ -0,0 +1,24 @@ + + +Build failure on macOS when using --disable-cocoa +Description of problem: +Build fails: + +``` +../qemu-8.2.1/meson.build:3741:13: ERROR: No host machine compiler for 'audio/coreaudio.m' +``` +Steps to reproduce: +1. On macOS run `./configure --disable-cocoa` + +Result: + +``` +Compiler for language objc skipped: feature cocoa disabled +``` +``` +../meson.build:3741:13: ERROR: No host machine compiler for 'audio/coreaudio.m' +``` +Additional information: +It seems your build script contains the assumption that an Objective-C compiler is not needed when the Cocoa UI is disabled, but it still appears to be needed to compile the CoreAudio code regardless of UI. + +This was originally reported to MacPorts here: https://trac.macports.org/ticket/67984 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2142 b/results/classifier/mode-deepseek-r1:32b/output/system/2142 new file mode 100644 index 00000000..5b611957 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2142 @@ -0,0 +1,3 @@ + + +`-machine microvm -cpu host` crashes when guest attempts to check CPUID SGX bits diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2146 b/results/classifier/mode-deepseek-r1:32b/output/system/2146 new file mode 100644 index 00000000..3d26a01d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2146 @@ -0,0 +1,116 @@ + + +qemu-system-aarch64 Segfaults +Description of problem: +Never finishes the script below always segfaults after a few hours +in seemingly random functions. +Steps to reproduce: +This is what i did with qemu version 8.2.1 +inside test directory: +1. wget https://download.qemu.org/qemu-8.2.1.tar.xz +2. tar xvJf qemu-8.2.1.tar.xz +3. cd qemu-8.2.1 +4. ./configure --target-list="aarch64-linux-user, aarch64-softmmu" --enable-slirp (crashes with and without --enable-debug) +5. make -j$(nproc) +6. ln -sf "$PWD/build/qemu-system-aarch64" "../qemu-system-aarch64" +7. cd .. + +Now the VM +1. wget -O installer-linux https://deb.debian.org/debian/dists/bookworm/main/installer-arm64/current/images/netboot/debian-installer/arm64/linux +2. wget -O installer-initrd.gz https://deb.debian.org/debian/dists/bookworm/main/installer-arm64/current/images/netboot/debian-installer/arm64/initrd.gz +3. qemu-img create -f qcow2 hda.qcow2 15G +4. ./qemu-system-aarch64 -M virt -m 6G -cpu cortex-a72 \ + -kernel installer-linux \ + -initrd installer-initrd.gz \ + -drive if=none,file=hda.qcow2,format=qcow2,id=hd \ + -device virtio-blk-pci,drive=hd \ + -netdev user,id=mynet \ + -device virtio-net-pci,netdev=mynet \ + -nographic -no-reboot \ + -accel tcg,thread=multi \ + -smp 8 +5. Install minimal debian inside the VM +6. sudo virt-copy-out -a hda.qcow2 /boot/vmlinuz-6.1.0-17-arm64 /boot/initrd.img-6.1.0-17-arm64 . +7. ./qemu-system-aarch64 -M virt -m 6G -cpu cortex-a72 \ + -kernel vmlinuz-6.1.0-17-arm64 \ + -initrd initrd.img-6.1.0-17-arm64 \ + -append 'root=/dev/vda2' \ + -drive if=none,file=hda.qcow2,format=qcow2,id=hd \ + -device virtio-blk-pci,drive=hd \ + -netdev user,id=mynet,hostfwd=tcp::10022-:22 \ + -device virtio-net-pci,netdev=mynet \ + -nographic \ + -accel tcg,thread=multi \ + -smp 8 +8. Now run this script inside some directory inside the VM(you might need to install gcc first) + +#!/bin/bash + +wget --no-clobber https://sourceware.org/pub/binutils/releases/binutils-2.41.tar.xz +wget --no-clobber https://ftp.gnu.org/gnu/mpfr/mpfr-4.2.0.tar.xz +wget --no-clobber https://ftp.gnu.org/gnu/gmp/gmp-6.3.0.tar.xz +wget --no-clobber https://ftp.gnu.org/gnu/mpc/mpc-1.3.1.tar.gz +wget --no-clobber https://ftp.gnu.org/gnu/gcc/gcc-13.2.0/gcc-13.2.0.tar.xz + +BUG_TARGET="$(uname -m)-bug-linux-gnu" + +tar -xf binutils-2.41.tar.xz +cd binutils-2.41 +mkdir -vp build +cd build +../configure --prefix=$PWD \ + --with-sysroot=$PWD \ + --target=$BUG_TARGET \ + --disable-nls \ + --enable-gprofng=no \ + --disable-werror \ + --disable-gdb +make --jobs $(nproc) +cd ../.. +rm -rf binutils + +tar -xf gcc-13.2.0.tar.xz +cd gcc-13.2.0 +tar -xf ../mpfr-4.2.0.tar.xz +tar -xf ../gmp-6.3.0.tar.xz +tar -xf ../mpc-1.3.1.tar.gz +mv mpfr-4.2.0 mpfr +mv gmp-6.3.0 gmp +mv mpc-1.3.1 mpc +mkdir -vp build +cd build +../configure --prefix=$PWD \ + --with-sysroot=$PWD \ + --target=$BUG_TARGET \ + --with-glibc-version=2.38 \ + --with-newlib \ + --without-headers \ + --enable-default-pie \ + --enable-default-ssp \ + --disable-nls \ + --disable-shared \ + --disable-multilib \ + --disable-threads \ + --disable-libatomic \ + --disable-libgomp \ + --disable-libquadmath \ + --disable-libssp \ + --disable-libvtv \ + --disable-libstdcxx \ + --enable-languages=c,c++ +make --jobs $(nproc) +cd ../.. +rm -rf gcc +Additional information: +I tried all the versions listed above, 6.2 usually segfaults in binutils while the other two run further. + +Example: +``` +Program terminated with signal SIGSEGV, Segmentation fault. +#0 0x000055555615dd37 in tlb_index (cpu=<Cannot access memory at address 0x7fffefffe1c8>, + mmu_idx=<Cannot access memory at address 0x7fffefffe1c0>, + addr=<Cannot access memory at address 0x7fffefffe1b8>) + at qemu-8.2.1/include/exec/cpu_ldst.h:367 +367 uintptr_t size_mask = cpu->neg.tlb.f[mmu_idx].mask >> CPU_TLB_ENTRY_BITS; +[Current thread is 1 (LWP 857562)] +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/215 b/results/classifier/mode-deepseek-r1:32b/output/system/215 new file mode 100644 index 00000000..9ff0218e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/215 @@ -0,0 +1,3 @@ + + +x86 Floating point exceptions - incorrect support? diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2150 b/results/classifier/mode-deepseek-r1:32b/output/system/2150 new file mode 100644 index 00000000..e977045d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2150 @@ -0,0 +1,15 @@ + + +ERROR:tcg/optimize.c:580:do_constant_folding_2: code should not be reached +Description of problem: +After booting Windows 10 or 11 (ARM) QEMU suddenly quits with: + +ERROR:tcg/optimize.c:580:do_constant_folding_2: code should not be reached + +It seems like it is missing an OPCODE in that function? +Steps to reproduce: +1. Boot Windows +2. QEMU quits +3. +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2152 b/results/classifier/mode-deepseek-r1:32b/output/system/2152 new file mode 100644 index 00000000..0d5f9958 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2152 @@ -0,0 +1,3 @@ + + +TCG plugin to keep track what byte is load/store into memory diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2153 b/results/classifier/mode-deepseek-r1:32b/output/system/2153 new file mode 100644 index 00000000..153566ba --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2153 @@ -0,0 +1,3 @@ + + +ubuntu-20.04-s390x-all CI job is very flaky diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2154 b/results/classifier/mode-deepseek-r1:32b/output/system/2154 new file mode 100644 index 00000000..1d92c9ea --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2154 @@ -0,0 +1,9 @@ + + +ID_AA64MMFR2_EL1 is all zeros +Description of problem: +When the `ID_AA64MMFR2_EL1` register is read via `mrs x[n], ID_AA64MMFR2_EL1`, it is read as all zeros. This is at the very least not correct for `ID_AA64MMFR2_EL1.ST`, which describes support for small translation tables (FEAT_TTST). +Steps to reproduce: +1. Run `mrs x[n], ID_AA64MMFR2_EL1` within qemu-system-aarch64 +Additional information: +FEAT_TTST is a relatively new aarch64 feature that appears to have caused many problems basically everywhere. However, [qemu has reportedly implemented it](https://www.qemu.org/2021/04/30/qemu-6-0-0/). diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2159 b/results/classifier/mode-deepseek-r1:32b/output/system/2159 new file mode 100644 index 00000000..cdc6dbb1 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2159 @@ -0,0 +1,179 @@ + + +qemu-system-x86_64 crashes in temp_load (tcg) on i686 host +Description of problem: +qemu crashes early +Steps to reproduce: +1. compile qemu git (commit commit 5d1fc614413b10dd94858b07a1b2e26b1aa0296c (origin/master, origin/HEAD) +) with line +../configure --prefix=/usr --enable-virglrenderer --libdir=lib --audio-drv-list=alsa,oss --enable-opengl --extra-cflags="-I/usr/X11R7/include -O2 -march=i686 -mtune=native -m32 -Wno-maybe-uninitialized -Wno-nested-externs -Wno-implicit-function-declaration" --disable-werror + +2. setarch i686 ninja (kernel is x86_64 on host) +3. try to boot 64-bit x86 Salix/Slackel (Slackware live images) +Additional information: +``` + gdb x86_64-softmmu/qemu-system-x86_64 +GNU gdb (GDB) 11.2 +Copyright (C) 2022 Free Software Foundation, Inc. +License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> +This is free software: you are free to change and redistribute it. +There is NO WARRANTY, to the extent permitted by law. +Type "show copying" and "show warranty" for details. +This GDB was configured as "i586-slackware-linux". +Type "show configuration" for configuration details. +For bug reporting instructions, please see: +<https://www.gnu.org/software/gdb/bugs/>. +Find the GDB manual and other documentation resources online at: + <http://www.gnu.org/software/gdb/documentation/>. + +For help, type "help". +Type "apropos word" to search for commands related to "word"... +Reading symbols from x86_64-softmmu/qemu-system-x86_64... +warning: File "/dev/shm/qemu/.gdbinit" auto-loading has been declined by your `auto-load safe-path' set to "$debugdir:$datadir/auto-load". +To enable execution of this file add + add-auto-load-safe-path /dev/shm/qemu/.gdbinit +line to your configuration file "/root/.config/gdb/gdbinit". +To completely disable this security protection add + set auto-load safe-path / +line to your configuration file "/root/.config/gdb/gdbinit". +For more information about this security protection see the +--Type <RET> for more, q to quit, c to continue without paging-- +"Auto-loading safe path" section in the GDB manual. E.g., run from the shell: + info "(gdb)Auto-loading safe path" +(gdb) r -m 1000 -cdrom /home/guest/ISO/sla +slackellive64-openbox-7.7.1.iso slackware-8.0-install-d1.iso +(gdb) r -m 1000 -cdrom /home/guest/ISO/slackellive64-openbox-7.7.1.iso +Starting program: /dev/shm/qemu/build/x86_64-softmmu/qemu-system-x86_64 -m 1000 -cdrom /home/guest/ISO/slackellive64-openbox-7.7.1.iso +[Thread debugging using libthread_db enabled] +Using host libthread_db library "/lib/libthread_db.so.1". +[New Thread 0xf3e79b00 (LWP 27354)] +[New Thread 0xf2f09b00 (LWP 27355)] +[New Thread 0xb1917b00 (LWP 27356)] +[New Thread 0xaf60cb00 (LWP 27357)] +[Thread 0xaf60cb00 (LWP 27357) exited] +[New Thread 0xaf60cb00 (LWP 27358)] +[New Thread 0xaec86b00 (LWP 27359)] +[Thread 0xaf60cb00 (LWP 27358) exited] +[Thread 0xaec86b00 (LWP 27359) exited] +[New Thread 0xaec86b00 (LWP 27360)] +[New Thread 0xaf60cb00 (LWP 27361)] +[Thread 0xaec86b00 (LWP 27360) exited] +[Thread 0xaf60cb00 (LWP 27361) exited] +[Thread 0xf2f09b00 (LWP 27355) exited] + +Thread 4 "qemu-system-x86" received signal SIGSEGV, Segmentation fault. +[Switching to Thread 0xb1917b00 (LWP 27356)] +0x56d08a95 in temp_load (s=0xb1000610, ts=ts@entry=0xb1001f40, desired_regs=<optimized out>, allocated_regs=2097200, preferred_regs=0) at ../tcg/tcg.c:4441 +4441 tcg_out_ld(s, ts->type, reg, ts->mem_base->reg, ts->mem_offset); +(gdb) bt full +#0 0x56d08a95 in temp_load + (s=0xb1000610, ts=ts@entry=0xb1001f40, desired_regs=<optimized out>, allocated_regs=2097200, preferred_regs=0) at ../tcg/tcg.c:4441 + reg = TCG_REG_ECX + __func__ = "temp_load" +#1 0x56d0fe23 in tcg_reg_alloc_op (op=<optimized out>, s=<optimized out>) + at ../tcg/tcg.c:4881 + i_required_regs = <optimized out> + copyto_new_reg = false + ts2 = <optimized out> + i1 = <optimized out> + i_preferred_regs = <optimized out> + allocate_new_reg = <optimized out> + i2 = <optimized out> + i = 0 + new_args = + {1, 5, 2852, 0, 64, 0, 0, 1467284236, 4149882880, 2829350448, 1, 1456305553, 4149882880, 2969568784, 2969568920, 2969568944} + arg_life = <optimized out> + i_allocated_regs = <optimized out> + nb_oargs = <optimized out> + arg = <optimized out> + const_args = +--Type <RET> for more, q to quit, c to continue without paging-- + {0, 0, 0, 0, 1, 1, 1467284236, -1315870200, 1487331864, -1069806704, 0, 1467284236, 1456520351, 1489883472, 2, -1325347776} + k = <optimized out> + arg_ct = <optimized out> + o_allocated_regs = <optimized out> + nb_iargs = <optimized out> + reg = <optimized out> + ts = 0xb1001f40 + op_cond = <optimized out> + opc = <optimized out> + i = <optimized out> + start_words = <optimized out> + num_insns = <optimized out> + op = <optimized out> + __PRETTY_FUNCTION__ = "tcg_gen_code" +#2 tcg_gen_code + (s=<optimized out>, tb=<optimized out>, pc_start=<optimized out>) + at ../tcg/tcg.c:6216 + opc = <optimized out> + i = <optimized out> + start_words = <optimized out> + num_insns = <optimized out> + op = <optimized out> +--Type <RET> for more, q to quit, c to continue without paging-- + __PRETTY_FUNCTION__ = "tcg_gen_code" +#3 0x56af0118 in setjmp_gen_code + (env=env@entry=0x57afab90, tb=tb@entry=0xf0b7d580 <code_gen_buffer+8389982>, pc=18446744072243800976, host_pc=0xc03c0b90, max_insns=0xb1916acc, ti=<optimized out>) at ../accel/tcg/translate-all.c:284 + ret = <optimized out> + __PRETTY_FUNCTION__ = "setjmp_gen_code" +#4 0x56af06e2 in tb_gen_code + (cpu=0x57af8860, pc=18446744072243800976, cs_base=0, flags=4244144, cflags=<optimized out>) at ../accel/tcg/translate-all.c:359 + env = 0x57afab90 + tb = 0xf0b7d580 <code_gen_buffer+8389982> + existing_tb = <optimized out> + phys_pc = 245525392 + phys_p2 = <optimized out> + gen_code_buf = 0xf0b7d600 <code_gen_buffer+8390110> "‹]ш…Ы\017Њр" + gen_code_size = <optimized out> + search_size = <optimized out> + max_insns = 64 + host_pc = 0xc03c0b90 + __PRETTY_FUNCTION__ = "tb_gen_code" + __func__ = "tb_gen_code" +#5 0x56ae75bd in cpu_exec_loop +--Type <RET> for more, q to quit, c to continue without paging-- + (cpu=cpu@entry=0x57af8860, sc=sc@entry=0xb1916c24) + at ../accel/tcg/cpu-exec.c:982 + jc = <optimized out> + h = <optimized out> + tb = 0x0 + flags = <optimized out> + cflags = 4278321152 + pc = <optimized out> + cs_base = <optimized out> + last_tb = <optimized out> + tb_exit = 0 + ret = <optimized out> +#6 0x56ae7a70 in cpu_exec_setjmp + (cpu=cpu@entry=0x57af8860, sc=sc@entry=0xb1916c24) + at ../accel/tcg/cpu-exec.c:1028 +#7 0x56ae83a8 in cpu_exec (cpu=<optimized out>) + at ../accel/tcg/cpu-exec.c:1054 + ret = <optimized out> + sc = {diff_clk = 0, last_cpu_icount = 0, realtime_clock = 0} + _rcu_read_auto = 0x1 +#8 0x56b0ff5e in tcg_cpu_exec (cpu=0x57af8860) + at ../accel/tcg/tcg-accel-ops.c:76 + ret = <optimized out> +--Type <RET> for more, q to quit, c to continue without paging-- + __PRETTY_FUNCTION__ = "tcg_cpu_exec" +#9 0x56b10a47 in rr_cpu_thread_fn (arg=<optimized out>) + at ../accel/tcg/tcg-accel-ops-rr.c:261 + r = <optimized out> + cpu_budget = <optimized out> + force_rcu = + {notify = 0x56b106e0 <rr_force_rcu>, node = {le_next = 0x0, le_prev = 0xb19179b0}} + cpu = 0x57af8860 + __PRETTY_FUNCTION__ = "rr_cpu_thread_fn" +#10 0x56cc77e5 in qemu_thread_start (args=0x57b51ce0) + at ../util/qemu-thread-posix.c:541 + __cancel_buf = + {__cancel_jmp_buf = {{__cancel_jmp_buf = {1467284236, 1471487200, 1471152128, -1315869272, 1617656260, -631423478}, __mask_was_saved = 0}}, __pad = {0xb1916d64, 0x0, 0x0, 0x0}} + __cancel_routine = 0x56cc7840 <qemu_thread_atexit_notify> + __not_first_call = <optimized out> + start_routine = 0x56b10818 <rr_cpu_thread_fn> + arg = 0x57af8860 + r = <optimized out> +#11 0xf63d5328 in start_thread () at /lib/libpthread.so.0 +#12 0xf604ef06 in clone () at /lib/libc.so.6 +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2161 b/results/classifier/mode-deepseek-r1:32b/output/system/2161 new file mode 100644 index 00000000..fe4e29e0 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2161 @@ -0,0 +1,3 @@ + + +warnings when building lockstep plugin on s390 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2162 b/results/classifier/mode-deepseek-r1:32b/output/system/2162 new file mode 100644 index 00000000..f096a491 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2162 @@ -0,0 +1,3 @@ + + +Some subtests have over-optimistic timeouts and time out on the s390 runner diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2165 b/results/classifier/mode-deepseek-r1:32b/output/system/2165 new file mode 100644 index 00000000..a2f451ff --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2165 @@ -0,0 +1,70 @@ + + +m68k: 68000 strict alignment requirements not emulated correctly +Description of problem: +Unaligned accesses should cause an address error on the 68000 but apparently currently don't. +Steps to reproduce: +1. Create a 68000 based QEMU machine to port u-boot/linux +2. Get u-boot/linux working perfectly on your QEMU machine +3. Copy kernel over to your real 68000 hardware +4. Notice that the kernel doesn't work +5. Spend a day adding inline assembly all over the kernel to work out where the real hardware is locking up +6. Find that the issue is probably memmove() being called with an unaligned src pointer: + +C level.. + +``` +Breakpoint 1, memmove (n=215, src=0x2059df <printk_shared_pbufs+215>, dest=0x2059ee <printk_shared_pbufs+230>) at ../arch/m68k/lib/memmove.c:152 +152 *--sdest = *--ssrc; +(gdb) bt +#0 memmove (n=215, src=0x2059df <printk_shared_pbufs+215>, dest=0x2059ee <printk_shared_pbufs+230>) at ../arch/m68k/lib/memmove.c:152 +#1 memmove (dest=<optimized out>, src=<optimized out>, n=<optimized out>) at ../arch/m68k/lib/memmove.c:10 +#2 0x000265b6 in record_print_text (r=<optimized out>, syslog=<optimized out>, time=<optimized out>) at ../kernel/printk/printk.c:1472 +#3 0x00027be6 in printk_get_next_message (pmsg=<optimized out>, seq=<optimized out>, is_extended=<optimized out>, may_suppress=<optimized out>) at ../kernel/printk/printk.c:2952 +#4 0x00027e5a in console_emit_next_record (cookie=0, handover=0x1d9e37, con=0x1edf14 <early_con>) at ../kernel/printk/printk.c:3019 +#5 console_flush_all (do_cond_resched=false, next_seq=0x1d9e38, handover=0x1d9e37) at ../kernel/printk/printk.c:3118 +#6 0x00027fc8 in console_unlock () at ../kernel/printk/printk.c:3187 +#7 0x00028a04 in vprintk_emit (facility=0, level=<optimized out>, dev_info=0x0, fmt=0x1bd051 "\0016printk: %s%sconsole [%s%d] enabled\n", args=0x1d9e98) at ../kernel/printk/printk.c:2359 +#8 0x00028a26 in vprintk_default (fmt=0x1bd051 "\0016printk: %s%sconsole [%s%d] enabled\n", args=0x1d9e98) at ../kernel/printk/printk.c:2374 +#9 0x00028c22 in vprintk (fmt=0x1bd051 "\0016printk: %s%sconsole [%s%d] enabled\n", args=0x1d9e98) at ../kernel/printk/printk_safe.c:45 +#10 0x0019d016 in _printk (fmt=0x1bd051 "\0016printk: %s%sconsole [%s%d] enabled\n") at ../kernel/printk/printk.c:2384 +#11 0x0002857e in register_console (newcon=<optimized out>) at ../kernel/printk/printk.c:3693 +#12 0x001fbf1e in register_earlycon (match=<optimized out>, buf=0x0) at ../drivers/tty/serial/earlycon.c:161 +#13 setup_earlycon (buf=<optimized out>) at ../drivers/tty/serial/earlycon.c:212 +#14 0x001fbf72 in param_setup_earlycon (buf=0x2009e9 <tmp_cmdline+9> "mc68ez328,0xfffff900") at ../drivers/tty/serial/earlycon.c:244 +#15 0x001f1102 in do_early_param (param=0x2009e0 <tmp_cmdline> "earlycon", val=0x2009e9 <tmp_cmdline+9> "mc68ez328,0xfffff900", unused=0x1b96c6 "early options", arg=0x0) + at ../init/main.c:744 +#16 0x00017eac in parse_one (handle_unknown=<optimized out>, arg=<optimized out>, max_level=<optimized out>, min_level=<optimized out>, num_params=<optimized out>, params=<optimized out>, + doing=0x1b96c6 "early options", val=0x2009e9 <tmp_cmdline+9> "mc68ez328,0xfffff900", param=0x2009e0 <tmp_cmdline> "earlycon") at ../kernel/params.c:154 +#17 parse_args (doing=<optimized out>, args=0x2009fe <tmp_cmdline+30> "console=ttyDB0 root=/dev/mmcblk0p2 rootfstype=squashfs rootwait", params=<optimized out>, num=<optimized out>, + min_level=<optimized out>, max_level=<optimized out>, arg=<optimized out>, unknown=<optimized out>) at ../kernel/params.c:189 +#18 0x001f13ea in parse_early_options (cmdline=0x2009e0 <tmp_cmdline> "earlycon") at ../init/main.c:754 +#19 0x001f1420 in parse_early_param () at ../init/main.c:769 +#20 0x001f1570 in start_kernel () at ../init/main.c:908 +#21 0x000004b8 in _clear_bss () at ../arch/m68k/dt/head.S:95 +#22 0x00000000 in ?? () +``` + +Asm level: + +``` +152 *--sdest = *--ssrc; + 0x0019bed8 <+324>: movel %a1,%d2 + 0x0019beda <+326>: subql #2,%d2 + 0x0019bedc <+328>: movel %a2,%d1 + 0x0019bede <+330>: subql #2,%d1 +=> 0x0019bee0 <+332>: movew %a1@(-2),%a2@(-2) +``` + +This is a word store so needs to be aligned but a1 isn't aligned so we should get an address error: + +``` +(gdb) print/x $a1 +$3 = 0x2059df +(gdb) print/x $a2 +$4 = 0x2059ee +``` + + +7. Check QEMU source code to work out why it doesn't crash the cpu at the same place. +8. Notice it doesn't seem to check the alignment. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2166 b/results/classifier/mode-deepseek-r1:32b/output/system/2166 new file mode 100644 index 00000000..2e3076a8 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2166 @@ -0,0 +1,3 @@ + + +RISC-V qemu has bug on the return value of function qemu_plugin_mem_size_shift() diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2169 b/results/classifier/mode-deepseek-r1:32b/output/system/2169 new file mode 100644 index 00000000..a06d1ca2 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2169 @@ -0,0 +1,395 @@ + + +qemu-system-s390x crashes with s390_swap_bfp_rounding_mode: code should not be reached +Description of problem: +Ubuntu 23.10 was installed on a s390x emulated platform some time ago. The system was setup, an open source project was built and tested. The system rebooted several times. + +Several days later, qemu crashed while the command `apt update` was running in the guest. The error was: +``` +ERROR:../target/s390x/tcg/fpu_helper.c:449:s390_swap_bfp_rounding_mode: code should not be reached +Bail out! ERROR:../target/s390x/tcg/fpu_helper.c:449:s390_swap_bfp_rounding_mode: code should not be reached +Abort trap: 6 +``` + +Now, each time the virtual machine is booted, qemu immediately crashes all the time at the end of the boot with the same error. The virtual machine is no longer usable. +Steps to reproduce: +1. Run the above command. +2. It crashes at the end of the boot. +Additional information: +The disk image `disk.qcow2` is 3.7 GB large, too large to be attached here. + +Full boot log: +``` +qemu-system-s390x -machine s390-ccw-virtio -cpu max,zpci=on -smp 8 -m 8192 -nographic \ + -drive file=disk.qcow2,format=qcow2,if=none,id=drive-virtio-disk0,cache=none \ + -device virtio-blk-ccw,devno=fe.0.0002,drive=drive-virtio-disk0,bootindex=1 \ + -nic user,hostfwd=tcp::2222-:22 +LOADPARM=[ ] +Using virtio-blk. +Using SCSI scheme. +......... +KASLR disabled: CPU has no PRNG +KASLR disabled: CPU has no PRNG +[ 0.561037] Linux version 6.5.0-14-generic (buildd@bos02-s390x-003) (s390x-linux-gnu-gcc-13 (Ubuntu 13.2.0-4ubuntu3) 13.2.0, GNU ld (GNU Binutils for Ubuntu) 2.41) #14-Ubuntu SMP Tue Nov 14 14:16:58 UTC 2023 (Ubuntu 6.5.0-14.14-generic 6.5.3) +[ 0.562868] setup: Linux is running under KVM in 64-bit mode +[ 0.601125] setup: The maximum memory size is 8192MB +[ 0.601577] setup: Relocating AMODE31 section of size 0x00003000 +[ 0.603756] cpu: 8 configured CPUs, 0 standby CPUs +[ 34.401410] Write protected kernel read-only data: 22272k +[ 34.548843] Zone ranges: +[ 34.548873] DMA [mem 0x0000000000000000-0x000000007fffffff] +[ 34.549570] Normal [mem 0x0000000080000000-0x00000001ffffffff] +[ 34.549609] Movable zone start for each node +[ 34.549633] Early memory node ranges +[ 34.549664] node 0: [mem 0x0000000000000000-0x00000001ffffffff] +[ 34.549979] Initmem setup node 0 [mem 0x0000000000000000-0x00000001ffffffff] +[ 34.619124] percpu: Embedded 31 pages/cpu s87552 r8192 d31232 u126976 +[ 34.621042] Kernel command line: root=/dev/disk/by-path/ccw-0.0.0002-part1 +[ 34.622253] random: crng init done +[ 34.624460] Dentry cache hash table entries: 1048576 (order: 11, 8388608 bytes, linear) +[ 34.625511] Inode-cache hash table entries: 524288 (order: 10, 4194304 bytes, linear) +[ 34.626568] Fallback order for Node 0: 0 +[ 34.627026] Built 1 zonelists, mobility grouping on. Total pages: 2064384 +[ 34.627069] Policy zone: Normal +[ 34.627356] mem auto-init: stack:all(zero), heap alloc:on, heap free:off +[ 34.669390] Memory: 8169740K/8388608K available (14780K kernel code, 3496K rwdata, 7492K rodata, 6376K init, 1312K bss, 218868K reserved, 0K cma-reserved) +[ 34.677279] SLUB: HWalign=256, Order=0-3, MinObjects=0, CPUs=8, Nodes=1 +[ 34.678165] ftrace: allocating 38640 entries in 151 pages +[ 34.967308] ftrace: allocated 151 pages with 5 groups +[ 34.977052] rcu: Hierarchical RCU implementation. +[ 34.977093] rcu: RCU restricting CPUs from NR_CPUS=512 to nr_cpu_ids=8. +[ 34.977196] Rude variant of Tasks RCU enabled. +[ 34.977209] Tracing variant of Tasks RCU enabled. +[ 34.977329] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies. +[ 34.977360] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=8 +[ 35.023854] NR_IRQS: 3, nr_irqs: 3, preallocated irqs: 3 +[ 35.026445] rcu: srcu_init: Setting srcu_struct sizes based on contention. +[ 35.027768] clocksource: tod: mask: 0xffffffffffffffff max_cycles: 0x3b0a9be803b0a9, max_idle_ns: 1805497147909793 ns +[ 35.032313] Console: colour dummy device 80x25 +[ 35.036054] printk: console [ttysclp0] enabled +[ 35.038867] pid_max: default: 32768 minimum: 301 +[ 35.044407] LSM: initializing lsm=lockdown,capability,landlock,yama,apparmor,integrity +[ 35.044879] landlock: Up and running. +[ 35.044911] Yama: becoming mindful. +[ 35.046994] AppArmor: AppArmor initialized +[ 35.048281] Mount-cache hash table entries: 16384 (order: 5, 131072 bytes, linear) +[ 35.048366] Mountpoint-cache hash table entries: 16384 (order: 5, 131072 bytes, linear) +[ 35.079199] RCU Tasks Rude: Setting shift to 3 and lim to 1 rcu_task_cb_adjust=1. +[ 35.079584] RCU Tasks Trace: Setting shift to 3 and lim to 1 rcu_task_cb_adjust=1. +[ 35.081422] rcu: Hierarchical SRCU implementation. +[ 35.081465] rcu: Max phase no-delay instances is 1000. +[ 35.087248] smp: Bringing up secondary CPUs ... +[ 35.109842] smp: Brought up 1 node, 8 CPUs +[ 35.133520] devtmpfs: initialized +[ 35.143534] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns +[ 35.143848] futex hash table entries: 2048 (order: 7, 524288 bytes, linear) +[ 35.155409] NET: Registered PF_NETLINK/PF_ROUTE protocol family +[ 35.158309] audit: initializing netlink subsys (disabled) +[ 35.160126] audit: type=2000 audit(1708008415.080:1): state=initialized audit_enabled=0 res=1 +[ 35.162149] Spectre V2 mitigation: execute trampolines +[ 35.218877] iommu: Default domain type: Translated +[ 35.218963] iommu: DMA domain TLB invalidation policy: strict mode +[ 35.221010] SCSI subsystem initialized +[ 35.221925] pps_core: LinuxPPS API ver. 1 registered +[ 35.221953] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it> +[ 35.233495] NetLabel: Initializing +[ 35.233538] NetLabel: domain hash size = 128 +[ 35.233569] NetLabel: protocols = UNLABELED CIPSOv4 CALIPSO +[ 35.234452] NetLabel: unlabeled traffic allowed by default +[ 35.490582] VFS: Disk quotas dquot_6.6.0 +[ 35.490828] VFS: Dquot-cache hash table entries: 512 (order 0, 4096 bytes) +[ 35.492088] hugetlbfs: disabling because there are no supported hugepage sizes +[ 35.494605] AppArmor: AppArmor Filesystem Enabled +[ 35.537129] NET: Registered PF_INET protocol family +[ 35.538412] IP idents hash table entries: 131072 (order: 8, 1048576 bytes, linear) +[ 35.553748] tcp_listen_portaddr_hash hash table entries: 4096 (order: 4, 65536 bytes, linear) +[ 35.554033] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear) +[ 35.554241] TCP established hash table entries: 65536 (order: 7, 524288 bytes, linear) +[ 35.555185] TCP bind hash table entries: 65536 (order: 9, 2097152 bytes, linear) +[ 35.555971] TCP: Hash tables configured (established 65536 bind 65536) +[ 35.558027] MPTCP token hash table entries: 8192 (order: 5, 196608 bytes, linear) +[ 35.558386] UDP hash table entries: 4096 (order: 5, 131072 bytes, linear) +[ 35.558715] UDP-Lite hash table entries: 4096 (order: 5, 131072 bytes, linear) +[ 35.560408] NET: Registered PF_UNIX/PF_LOCAL protocol family +[ 35.560888] NET: Registered PF_XDP protocol family +[ 35.566276] Trying to unpack rootfs image as initramfs... +[ 35.583376] kvm-s390: SIE is not available +[ 35.584037] hypfs: The hardware system does not support hypfs +[ 35.686516] Initialise system trusted keyrings +[ 35.688015] Key type blacklist registered +[ 35.689131] workingset: timestamp_bits=45 max_order=21 bucket_order=0 +[ 35.689516] zbud: loaded +[ 35.693314] squashfs: version 4.0 (2009/01/31) Phillip Lougher +[ 35.695879] fuse: init (API version 7.38) +[ 35.699171] integrity: Platform Keyring initialized +[ 35.808827] Key type asymmetric registered +[ 35.808973] Asymmetric key parser 'x509' registered +[ 35.809365] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 248) +[ 35.810660] io scheduler mq-deadline registered +[ 35.816790] hvc_iucv: The z/VM IUCV HVC device driver cannot be used without z/VM +[ 35.846919] loop: module loaded +[ 35.851530] tun: Universal TUN/TAP device driver, 1.6 +[ 35.853032] device-mapper: core: CONFIG_IMA_DISABLE_HTABLE is disabled. Duplicate IMA measurements will not be recorded in the IMA log. +[ 35.853186] device-mapper: uevent: version 1.0.3 +[ 35.854080] device-mapper: ioctl: 4.48.0-ioctl (2023-03-01) initialised: dm-devel@redhat.com +[ 35.854360] drop_monitor: Initializing network drop monitor service +[ 35.963712] NET: Registered PF_INET6 protocol family +[ 36.335556] Freeing initrd memory: 23592K +[ 36.587317] Segment Routing with IPv6 +[ 36.587633] In-situ OAM (IOAM) with IPv6 +[ 36.588291] NET: Registered PF_PACKET protocol family +[ 36.589147] Key type dns_resolver registered +[ 36.590364] cio: Channel measurement facility initialized using format extended (mode autodetected) +[ 36.592594] sclp_sd: Store Data request failed (eq=2, di=3, response=0x40f0, flags=0x00, status=0, rc=-5) +[ 36.593406] ap: The hardware system does not support AP instructions +[ 36.599059] virtio_blk virtio0: 1/0/0 default/read/poll queues +[ 36.604778] virtio_blk virtio0: [vda] 62914560 512-byte logical blocks (32.2 GB/30.0 GiB) +[ 36.621065] registered taskstats version 1 +[ 36.623865] vda: vda1 +[ 36.630114] Loading compiled-in X.509 certificates +[ 36.639995] Loaded X.509 cert 'Build time autogenerated kernel key: ffca65de79457ba2128edde155db56e4bec9b799' +[ 36.642859] Loaded X.509 cert 'Canonical Ltd. Live Patch Signing: 14df34d1a87cf37625abec039ef2bf521249b969' +[ 36.646267] Loaded X.509 cert 'Canonical Ltd. Kernel Module Signing: 88f752e560a1e0737e31163a466ad7b70a850c19' +[ 36.646336] blacklist: Loading compiled-in revocation X.509 certificates +[ 36.647551] Loaded X.509 cert 'Canonical Ltd. Secure Boot Signing: 61482aa2830d0ab2ad5af10b7250da9033ddcef0' +[ 36.647791] Loaded X.509 cert 'Canonical Ltd. Secure Boot Signing (2017): 242ade75ac4a15e50d50c84b0d45ff3eae707a03' +[ 36.648026] Loaded X.509 cert 'Canonical Ltd. Secure Boot Signing (ESM 2018): 365188c1d374d6b07c3c8f240f8ef722433d6a8b' +[ 36.648252] Loaded X.509 cert 'Canonical Ltd. Secure Boot Signing (2019): c0746fd6c5da3ae827864651ad66ae47fe24b3e8' +[ 36.648455] Loaded X.509 cert 'Canonical Ltd. Secure Boot Signing (2021 v1): a8d54bbb3825cfb94fa13c9f8a594a195c107b8d' +[ 36.648669] Loaded X.509 cert 'Canonical Ltd. Secure Boot Signing (2021 v2): 4cf046892d6fd3c9a5b03f98d845f90851dc6a8c' +[ 36.648876] Loaded X.509 cert 'Canonical Ltd. Secure Boot Signing (2021 v3): 100437bb6de6e469b581e61cd66bce3ef4ed53af' +[ 36.649092] Loaded X.509 cert 'Canonical Ltd. Secure Boot Signing (Ubuntu Core 2019): c1d57b8f6b743f23ee41f4f7ee292f06eecadfb9' +[ 36.679176] Key type .fscrypt registered +[ 36.679250] Key type fscrypt-provisioning registered +[ 36.788001] Key type encrypted registered +[ 36.788125] AppArmor: AppArmor sha1 policy hashing enabled +[ 36.788580] ima: No TPM chip found, activating TPM-bypass! +[ 36.788676] Loading compiled-in module X.509 certificates +[ 36.791454] Loaded X.509 cert 'Build time autogenerated kernel key: ffca65de79457ba2128edde155db56e4bec9b799' +[ 36.791525] ima: Allocated hash algorithm: sha1 +[ 36.793195] ima: No architecture policies found +[ 36.793649] evm: Initialising EVM extended attributes: +[ 36.793691] evm: security.selinux +[ 36.793729] evm: security.SMACK64 +[ 36.793751] evm: security.SMACK64EXEC +[ 36.793772] evm: security.SMACK64TRANSMUTE +[ 36.793792] evm: security.SMACK64MMAP +[ 36.793817] evm: security.apparmor +[ 36.793837] evm: security.ima +[ 36.793857] evm: security.capability +[ 36.793882] evm: HMAC attrs: 0x1 +[ 36.814426] Freeing unused kernel image (initmem) memory: 6376K +[ 36.855771] Write protected read-only-after-init data: 144k +[ 38.034069] Checked W+X mappings: passed, no unexpected W+X pages found +[ 38.034295] Run /init as init process +Loading, please wait... +Starting systemd-udevd version 253.5-1ubuntu6.1 +[ 41.012145] virtio_net virtio1 enc0: renamed from eth0 +Begin: Starting firmware auto-configuration ... done. +Begin: Loading essential drivers ... [ 48.602928] raid6: vx128x8 gen() 3084 MB/s +[ 48.603058] raid6: using algorithm vx128x8 gen() 3084 MB/s +[ 48.773302] raid6: .... xor() 1800 MB/s, rmw enabled +[ 48.773433] raid6: using s390xc recovery algorithm +[ 48.783956] xor: automatically using best checksumming function xc +done. +Begin: Running /scripts/init-premount ... done. +Begin: Mounting root file system ... Begin: Running /scripts/local-top ... done. +Begin: Running /scripts/local-premount ... [ 49.837645] Btrfs loaded, zoned=yes, fsverity=yes +Scanning for Btrfs filesystems +done. +Begin: Will now check root file system ... fsck from util-linux 2.39.1 +[/usr/sbin/fsck.ext4 (1) -- /dev/vda1] fsck.ext4 -a -C0 /dev/vda1 +/dev/vda1: recovering journal +/dev/vda1: clean, 123948/1966080 files, 1902224/7863808 blocks +done. +[ 50.624887] EXT4-fs (vda1): mounted filesystem b33ae246-95a1-494e-b967-9ab636fd714d ro with ordered data mode. Quota mode: none. +done. +Begin: Running /scripts/local-bottom ... done. +Begin: Running /scripts/init-bottom ... done. +[ 52.531666] systemd[1]: systemd 253.5-1ubuntu6.1 running in system mode (+PAM +AUDIT +SELINUX +APPARMOR +IMA +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN +IPTC +KMOD +LIBCRYPTSETUP +LIBFDISK +PCRE2 -PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD -BPF_FRAMEWORK -XKBCOMMON +UTMP +SYSVINIT default-hierarchy=unified) +[ 52.531979] systemd[1]: Detected virtualization kvm. +[ 52.532228] systemd[1]: Detected architecture s390x. + +Welcome to Ubuntu 23.10! + +[ 52.545927] systemd[1]: Hostname set to <vms390x>. +[ 52.738383] systemd[1]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set +[ 54.251527] (sd-execu[322]: /usr/lib/systemd/system-generators/s390-cpi-vars failed with exit status 1. +[ 56.207233] systemd[1]: Queued start job for default target graphical.target. +[ 56.324910] systemd[1]: Created slice system-modprobe.slice - Slice /system/modprobe. +[ OK ] Created slice system-modpr…lice - Slice /system/modprobe. +[ 56.342133] systemd[1]: Created slice system-serial\x2dgetty.slice - Slice /system/serial-getty. +[ OK ] Created slice system-seria… - Slice /system/serial-getty. +[ 56.354987] systemd[1]: Created slice user.slice - User and Session Slice. +[ OK ] Created slice user.slice - User and Session Slice. +[ 56.359125] systemd[1]: Started systemd-ask-password-wall.path - Forward Password Requests to Wall Directory Watch. +[ OK ] Started systemd-ask-passwo… Requests to Wall Directory Watch. +[ 56.370074] systemd[1]: Set up automount proc-sys-fs-binfmt_misc.automount - Arbitrary Executable File Formats File System Automount Point. +[ OK ] Set up automount proc-sys-…rmats File System Automount Point. +[ 56.373118] systemd[1]: Reached target integritysetup.target - Local Integrity Protected Volumes. +[ OK ] Reached target integrityse…Local Integrity Protected Volumes. +[ 56.374764] systemd[1]: Reached target slices.target - Slice Units. +[ OK ] Reached target slices.target - Slice Units. +[ 56.375999] systemd[1]: Reached target snapd.mounts-pre.target - Mounting snaps. +[ OK ] Reached target snapd.mounts-pre.target - Mounting snaps. +[ 56.377421] systemd[1]: Reached target veritysetup.target - Local Verity Protected Volumes. +[ OK ] Reached target veritysetup… - Local Verity Protected Volumes. +[ 56.381860] systemd[1]: Listening on dm-event.socket - Device-mapper event daemon FIFOs. +[ OK ] Listening on dm-event.sock… Device-mapper event daemon FIFOs. +[ 56.388375] systemd[1]: Listening on lvm2-lvmpolld.socket - LVM2 poll daemon socket. +[ OK ] Listening on lvm2-lvmpolld…ket - LVM2 poll daemon socket. +[ 56.394056] systemd[1]: Listening on multipathd.socket - multipathd control socket. +[ OK ] Listening on multipathd.so…t - multipathd control socket. +[ 56.399560] systemd[1]: Listening on syslog.socket - Syslog Socket. +[ OK ] Listening on syslog.socket - Syslog Socket. +[ 56.404487] systemd[1]: Listening on systemd-fsckd.socket - fsck to fsckd communication Socket. +[ OK ] Listening on systemd-fsckd…sck to fsckd communication Socket. +[ 56.407621] systemd[1]: Listening on systemd-initctl.socket - initctl Compatibility Named Pipe. +[ OK ] Listening on systemd-initc… initctl Compatibility Named Pipe. +[ 56.414642] systemd[1]: Listening on systemd-journald-dev-log.socket - Journal Socket (/dev/log). +[ OK ] Listening on systemd-journ…t - Journal Socket (/dev/log). +[ 56.421162] systemd[1]: Listening on systemd-journald.socket - Journal Socket. +[ OK ] Listening on systemd-journald.socket - Journal Socket. +[ 56.429706] systemd[1]: Listening on systemd-networkd.socket - Network Service Netlink Socket. +[ OK ] Listening on systemd-netwo… - Network Service Netlink Socket. +[ 56.436982] systemd[1]: Listening on systemd-udevd-control.socket - udev Control Socket. +[ OK ] Listening on systemd-udevd….socket - udev Control Socket. +[ 56.443136] systemd[1]: Listening on systemd-udevd-kernel.socket - udev Kernel Socket. +[ OK ] Listening on systemd-udevd…l.socket - udev Kernel Socket. +[ 56.450850] systemd[1]: dev-hugepages.mount - Huge Pages File System was skipped because of an unmet condition check (ConditionPathExists=/sys/kernel/mm/hugepages). +[ 56.516995] systemd[1]: Mounting dev-mqueue.mount - POSIX Message Queue File System... + Mounting dev-mqueue.mount…OSIX Message Queue File System... +[ 56.554312] systemd[1]: Mounting sys-kernel-debug.mount - Kernel Debug File System... + Mounting sys-kernel-debug.… - Kernel Debug File System... +[ 56.589207] systemd[1]: Mounting sys-kernel-tracing.mount - Kernel Trace File System... + Mounting sys-kernel-tracin… - Kernel Trace File System... +[ 56.651284] systemd[1]: Starting systemd-journald.service - Journal Service... + Starting systemd-journald.service - Journal Service... +[ 56.683040] systemd[1]: Starting keyboard-setup.service - Set the console keyboard layout... + Starting keyboard-setup.se…Set the console keyboard layout... +[ 56.729933] systemd[1]: Starting kmod-static-nodes.service - Create List of Static Device Nodes... + Starting kmod-static-nodes…ate List of Static Device Nodes... +[ 56.765378] systemd[1]: Starting lvm2-monitor.service - Monitoring of LVM2 mirrors, snapshots etc. using dmeventd or progress polling... + Starting lvm2-monitor.serv…ng dmeventd or progress polling... +[ 56.768638] systemd[1]: lxd-agent.service - LXD - agent was skipped because of an unmet condition check (ConditionPathExists=/dev/virtio-ports/org.linuxcontainers.lxd). +[ 56.806941] systemd[1]: Starting modprobe@configfs.service - Load Kernel Module configfs... + Starting modprobe@configfs…m - Load Kernel Module configfs... +[ 56.852266] systemd[1]: Starting modprobe@dm_mod.service - Load Kernel Module dm_mod... + Starting modprobe@dm_mod.s…[0m - Load Kernel Module dm_mod... +[ 56.907919] systemd[1]: Starting modprobe@drm.service - Load Kernel Module drm... + Starting modprobe@drm.service - Load Kernel Module drm... +[ 56.962524] systemd[1]: Starting modprobe@efi_pstore.service - Load Kernel Module efi_pstore... + Starting modprobe@efi_psto…- Load Kernel Module efi_pstore... +[ 57.014414] systemd[1]: Starting modprobe@fuse.service - Load Kernel Module fuse... + Starting modprobe@fuse.ser…e - Load Kernel Module fuse... +[ 57.069081] systemd-journald[352]: Collecting audit messages is disabled. +[ 57.076472] systemd[1]: Starting modprobe@loop.service - Load Kernel Module loop... + Starting modprobe@loop.ser…e - Load Kernel Module loop... +[ 57.085874] systemd[1]: netplan-ovs-cleanup.service - OpenVSwitch configuration for cleanup was skipped because of an unmet condition check (ConditionFileIsExecutable=/usr/bin/ovs-vsctl). +[ 57.095668] systemd[1]: systemd-fsck-root.service - File System Check on Root Device was skipped because of an unmet condition check (ConditionPathExists=!/run/initramfs/fsck-root). +[ 57.168905] systemd[1]: Starting systemd-modules-load.service - Load Kernel Modules... + Starting systemd-modules-l…rvice - Load Kernel Modules... +[ 57.226498] systemd[1]: Starting systemd-remount-fs.service - Remount Root and Kernel File Systems... + Starting systemd-remount-f…nt Root and Kernel File Systems... +[ 57.287754] systemd[1]: Starting systemd-udev-trigger.service - Coldplug All udev Devices... + Starting systemd-udev-trig…[0m - Coldplug All udev Devices... +[ 57.419867] systemd[1]: Mounted dev-mqueue.mount - POSIX Message Queue File System. +[ OK ] Mounted dev-mqueue.mount…OSIX Message Queue File System. +[ 57.432129] systemd[1]: Mounted sys-kernel-debug.mount - Kernel Debug File System. +[ OK ] Mounted sys-kernel-debug.m…nt - Kernel Debug File System. +[ 57.443392] systemd[1]: Mounted sys-kernel-tracing.mount - Kernel Trace File System. +[ OK ] Mounted sys-kernel-tracing…nt - Kernel Trace File System. +[ 57.455168] systemd[1]: Finished kmod-static-nodes.service - Create List of Static Device Nodes. +[ OK ] Finished kmod-static-nodes…reate List of Static Device Nodes. +[ 57.466903] systemd[1]: Started systemd-journald.service - Journal Service. +[ OK ] Started systemd-journald.service - Journal Service. +[ OK ] Finished modprobe@configfs…[0m - Load Kernel Module configfs. +[ 57.555558] EXT4-fs (vda1): re-mounted b33ae246-95a1-494e-b967-9ab636fd714d r/w. Quota mode: none. +[ OK ] Finished modprobe@dm_mod.s…e - Load Kernel Module dm_mod. +[ OK ] Finished modprobe@efi_psto…m - Load Kernel Module efi_pstore. +[ OK ] Finished modprobe@fuse.service - Load Kernel Module fuse. +[ OK ] Finished modprobe@loop.service - Load Kernel Module loop. +[ OK ] Finished systemd-modules-l…service - Load Kernel Modules. +[ OK ] Finished systemd-remount-f…ount Root and Kernel File Systems. + Activating swap swap.img.swap - /swap.img... + Mounting sys-fs-fuse-conne… - FUSE Control File System... +[ 57.885897] Adding 4085756k swap on /swap.img. Priority:-2 extents:7 across:4388860k FS + Mounting sys-kernel-config…ernel Configuration File System... + Starting multipathd.servic…per Multipath Device Controller... + Starting systemd-journal-f…h Journal to Persistent Storage... + Starting systemd-random-se… - Load/Save OS Random Seed... + Starting systemd-sysctl.se…ce - Apply Kernel Variables... + Starting systemd-sysusers.…rvice - Create System Users... +[ OK ] Activated swap swap.img.swap - /swap.img. +[ 58.206094] systemd-journald[352]: Received client request to flush runtime journal. +[ 58.228283] systemd-journald[352]: File /var/log/journal/accea1250e0f4fe291f8c3b31e7720d7/system.journal corrupted or uncleanly shut down, renaming and replacing. +[ OK ] Finished lvm2-monitor.serv…sing dmeventd or progress polling. +[ OK ] Finished modprobe@drm.service - Load Kernel Module drm. +[ OK ] Mounted sys-fs-fuse-connec…nt - FUSE Control File System. +[ OK ] Mounted sys-kernel-config.… Kernel Configuration File System. +[ OK ] Finished systemd-random-se…ce - Load/Save OS Random Seed. +[ OK ] Finished systemd-sysctl.service - Apply Kernel Variables. +[ OK ] Reached target swap.target - Swaps. +[ OK ] Finished systemd-sysusers.service - Create System Users. + Starting systemd-tmpfiles-…ate Static Device Nodes in /dev... +[ OK ] Finished systemd-journal-f…ush Journal to Persistent Storage. +[ OK ] Finished keyboard-setup.se…- Set the console keyboard layout. +[ OK ] Started multipathd.service…apper Multipath Device Controller. +[ OK ] Finished systemd-tmpfiles-…reate Static Device Nodes in /dev. +[ OK ] Reached target local-fs-pr…reparation for Local File Systems. + Mounting snap-core22-865.m…t unit for core22, revision 865... + Mounting snap-lxd-25850.mo…nt unit for lxd, revision 25850... + Mounting snap-snapd-20294.… unit for snapd, revision 20294... + Mounting snap-snapd-20676.… unit for snapd, revision 20676... + Starting systemd-udevd.ser…ger for Device Events and Files... +[ OK ] Mounted snap-core22-865.mo…unt unit for core22, revision 865. +[ OK ] Mounted snap-lxd-25850.mou…ount unit for lxd, revision 25850. +[ OK ] Mounted snap-snapd-20294.m…nt unit for snapd, revision 20294. +[ OK ] Mounted snap-snapd-20676.m…nt unit for snapd, revision 20676. +[ OK ] Reached target snapd.mounts.target - Mounted snaps. +[ OK ] Reached target local-fs.target - Local File Systems. + Starting apparmor.service - Load AppArmor profiles... + Starting console-setup.ser…m - Set console font and keymap... + Starting finalrd.service…me dir for shutdown pivot root... + Starting plymouth-read-wri…mouth To Write Out Runtime Data... + Starting systemd-binfmt.se…et Up Additional Binary Formats... + Starting systemd-tmpfiles-… Volatile Files and Directories... + Starting ufw.service - Uncomplicated firewall... +[ OK ] Finished systemd-udev-trig…e - Coldplug All udev Devices. +[ OK ] Finished console-setup.ser…[0m - Set console font and keymap. +[ OK ] Finished finalrd.service…time dir for shutdown pivot root. +[ OK ] Finished plymouth-read-wri…lymouth To Write Out Runtime Data. +[ OK ] Finished ufw.service - Uncomplicated firewall. +[ OK ] Reached target network-pre…get - Preparation for Network. + Mounting proc-sys-fs-binfm…utable File Formats File System... +[ OK ] Mounted proc-sys-fs-binfmt…ecutable File Formats File System. +[ OK ] Finished systemd-binfmt.se… Set Up Additional Binary Formats. +[ OK ] Started systemd-udevd.serv…nager for Device Events and Files. +[ OK ] Started systemd-ask-passwo…quests to Console Directory Watch. +[ OK ] Reached target cryptsetup.…get - Local Encrypted Volumes. + Starting systemd-networkd.…ice - Network Configuration... +[ OK ] Finished systemd-tmpfiles-…te Volatile Files and Directories. + Starting systemd-resolved.…e - Network Name Resolution... + Starting systemd-timesyncd… - Network Time Synchronization... + Starting systemd-update-ut…rd System Boot/Shutdown in UTMP... +[ OK ] Finished systemd-update-ut…cord System Boot/Shutdown in UTMP. +[ OK ] Found device dev-ttysclp0.device - /dev/ttysclp0. +[ OK ] Started systemd-networkd.service - Network Configuration. + Starting systemd-networkd-…it for Network to be Configured... +[ OK ] Started systemd-timesyncd.…0m - Network Time Synchronization. +[ OK ] Reached target time-set.target - System Time Set. +[ OK ] Finished systemd-networkd-…Wait for Network to be Configured. +[ OK ] Finished apparmor.service - Load AppArmor profiles. + Starting snapd.apparmor.se…les managed internally by snapd... +[ OK ] Started systemd-resolved.s…ice - Network Name Resolution. +[ OK ] Reached target network.target - Network. +[ OK ] Reached target network-online.target - Network is Online. +[ OK ] Reached target nss-lookup.…m - Host and Network Name Lookups. +[ OK ] Reached target remote-fs-p…eparation for Remote File Systems. +[ OK ] Reached target remote-fs.target - Remote File Systems. +[ OK ] Finished blk-availability.…m - Availability of block devices. +** +ERROR:../target/s390x/tcg/fpu_helper.c:449:s390_swap_bfp_rounding_mode: code should not be reached +Bail out! ERROR:../target/s390x/tcg/fpu_helper.c:449:s390_swap_bfp_rounding_mode: code should not be reached +Abort trap: 6 +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/217 b/results/classifier/mode-deepseek-r1:32b/output/system/217 new file mode 100644 index 00000000..368f7233 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/217 @@ -0,0 +1,3 @@ + + +Qemu does not force SSE data alignment diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2176 b/results/classifier/mode-deepseek-r1:32b/output/system/2176 new file mode 100644 index 00000000..2202b10b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2176 @@ -0,0 +1,3 @@ + + +Events delivered during Capabilities Negotiation mode diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2177 b/results/classifier/mode-deepseek-r1:32b/output/system/2177 new file mode 100644 index 00000000..789ae49d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2177 @@ -0,0 +1,3 @@ + + +msys2-32bit CI job fails with "error: target not found: mingw-w64-i686-dtc" diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/218 b/results/classifier/mode-deepseek-r1:32b/output/system/218 new file mode 100644 index 00000000..8719c70f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/218 @@ -0,0 +1,3 @@ + + +qemu-storage-daemon --nbd-server fails with "too many connections" error diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2181 b/results/classifier/mode-deepseek-r1:32b/output/system/2181 new file mode 100644 index 00000000..72641910 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2181 @@ -0,0 +1,5 @@ + + +-icount mips/gips/kips options on QEMU for more advanced icount option +Additional information: +Changing IPS in QEMU affects the frequency of VGA updates, the duration of time before a key starts to autorepeat, and the measurement of BogoMips and other benchmarks. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2182 b/results/classifier/mode-deepseek-r1:32b/output/system/2182 new file mode 100644 index 00000000..baa92777 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2182 @@ -0,0 +1,3 @@ + + +Replication and Network diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2183 b/results/classifier/mode-deepseek-r1:32b/output/system/2183 new file mode 100644 index 00000000..6ba5b863 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2183 @@ -0,0 +1,22 @@ + + +aarch-64 emulation much slower since release 8.1.5 (issue also present on 8.2.1) +Description of problem: +Since QEMU 8.1.5 our aarch64 based emulation got much slower. We use a linux 5.4 kernel which we cross-compile with the ARM toolchain. Things that are noticable: +- Boot time got a lot longer +- All memory accesses seem to take 3x longer (can be verified by e.g. executing below script, address does not matter): +``` +date +for i in $(seq 0 1000); do + devmem 0x200000000 2>/dev/null +done +date +``` +Steps to reproduce: +Just boot an ARM based kernel on the virt machine and execute above script. +Additional information: +I've tried reproducing the issue on the master branch. There the issue is not present. It only seems to be present on releases 8.1.5 and 8.2.1. + +I've narrowed the problem down to following commit on the 8.2 branch (@bonzini): ef74024b76bf285e247add8538c11cb3c7399a1a accel/tcg: Revert mapping of PCREL translation block to multiple virtual addresses. + +Let me know if any other information / tests are required. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2185 b/results/classifier/mode-deepseek-r1:32b/output/system/2185 new file mode 100644 index 00000000..d22f6ed6 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2185 @@ -0,0 +1,3 @@ + + +spapr watchdog should honour watchdog-set-action etc monitor commands diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/219 b/results/classifier/mode-deepseek-r1:32b/output/system/219 new file mode 100644 index 00000000..fb967455 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/219 @@ -0,0 +1,3 @@ + + +Request A Port of QEMU to UWP for xbox dev mode diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2191 b/results/classifier/mode-deepseek-r1:32b/output/system/2191 new file mode 100644 index 00000000..413559bb --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2191 @@ -0,0 +1,3 @@ + + +Support exposing exports based on authentication diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2193 b/results/classifier/mode-deepseek-r1:32b/output/system/2193 new file mode 100644 index 00000000..2606074d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2193 @@ -0,0 +1,32 @@ + + +qemu-system-mips64el 70 times slower than qemu -ppc64, -riscv64, -s390x +Description of problem: +I installed Debian 12 inside a `qemu-system-mips64el` virtual machine. The performances are awfully slow, roughly 70 times slower than other qemu targets on the same host, namely ppc64, riscv64, s390x. + +The idea is to recompile and test an open source project on various platforms. + +Using a command such as `time make path/to/bin/file.o`, I compiled one single source file on the host and within qemu for various targets. The same source file, inside the same project, is used in all cases. + +The results are shown below (the "x" number between parentheses is the time factor compared to the compilation on the host). + +- Host (native): 0m1.316s +- qemu-system-ppc64: 0m31.622s (x24) +- qemu-system-riscv64: 0m40.691s (x31) +- qemu-system-s390x: 0m43.459s (x33) +- qemu-system-mips64el: 48m33.587s (x2214) + +The compilation of the same source is 24 to 33 times slower on the first three emulated targets, compared to the same compilation on the host, which is understandable. However, the same compilation on the mips64el target is 2214 time slower than the host, roughly 70 times slower than other emulated targets. + +Why do we have such a tremendous difference between qemu mips64el and other targets? +Additional information: +For reference, here are the other qemu to boot the other targets. Guest OS are Debian 12 or Ubuntu 22. +``` +qemu-system-ppc64 -smp 8 -m 8192 -nographic ... +qemu-system-riscv64 -machine virt -smp 8 -m 8192 -nographic ... +qemu-system-s390x -machine s390-ccw-virtio -cpu max,zpci=on -smp 8 -m 8192 -nographic ... +``` + +The other targets use `-smp 8` while qemu-system-mips64el does not support smp. However, the test compiles one single source file and does not (or marginally) use more than one CPU. + +Arguably, each compilation addresses a different target, uses a different backend, and the compilation time is not necessarily identical. OK, but 70 times slower seems way too much for this. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2198 b/results/classifier/mode-deepseek-r1:32b/output/system/2198 new file mode 100644 index 00000000..4003fc91 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2198 @@ -0,0 +1,27 @@ + + +Unable to run OS/2 Warp4.52 +Description of problem: +Operating system crashes upon boot. +Steps to reproduce: +1. Install OS/2 Warp4 +2. Apply Fixpack15 +3. Try to boot the system +Additional information: +This is a very old bug that seems to render a whole family of Operating Systems (OS/2 Warp4 and eComStation) unusable under Qemu. +Warp4 works, in the sense that it does install and run, but just until it is updated to 4.52 (which is necessary to get a useable guest) + +I found traces of its existence as far as: +https://bugs.launchpad.net/qemu/+bug/1743441 +https://lists.gnu.org/archive/html/qemu-devel/2019-02/msg02337.html + +And i found the issue brieffly commented at https://www.os2world.com/forum/index.php?topic=2346.0 +I quote: + +'Regarding QEMU/KVM, OS/2 runs in QEMU mostly fine. Except the trap in os2lvm.dmd and non-working netbeui.os2 and +tcpbeui.os2. The problem with os2lvm.dmd is because QEMU closely follows the intel spec, which is incorrect. The spec says +that 16-bit SGDT instruction behaves the same like in i286 processor. But it's not true, it behaves like i386 instruction. So, QEMU +emulates SGDT 16-bit instruction incorrectly. OS2LVM.DMD uses 16-bit SGDT instruction and it hits the problem.' + +After a brief discussion on the Warp4 group at groups.io where I was told that this is indeed a Qemu bug, I thought someone has +to report on that. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2205 b/results/classifier/mode-deepseek-r1:32b/output/system/2205 new file mode 100644 index 00000000..6a57520b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2205 @@ -0,0 +1,52 @@ + + +9p rootfs issues +Description of problem: +I've created qemu guest per https://wiki.qemu.org/Documentation/9p_root_fs guidelines. debootstrap fails on this guest. +Steps to reproduce: +``` +root@ubuntu-dev:~# debootstrap --arch amd64 --variant=minbase noble /var/tmp/new_root/ +I: Retrieving InRelease +I: Checking Release signature +E: Error executing gpgv to check Release signature +root@ubuntu-dev:~# +``` +Additional information: +I noticed, that gpg key extracted by debootstrap from the InRelease is corrupted: +``` +root@ubuntu-dev:~# head /var/tmp/new_root/var/lib/apt/lists/archive.ubuntu.com_ubuntu_dists_noble_Release.gpg +-----BEGIN PGP SIGNATURE----- +-----BEGIN PGP SIGNATURE----- + +-----BEGIN PGP SIGNATURE----- +-----BEGIN PGP SIGNATURE----- + +iQIzBAEBCgAdFiEE9uyzdiR07anSG3Aihxkg0ZkbyTwFAmXkbkUACgkQhxkg0Zkb +-----BEGIN PGP SIGNATURE----- +-----BEGIN PGP SIGNATURE----- + +root@ubuntu-dev:~# +``` +I also noticed that on the 9p filesystem appending to files corrupts them: +``` +root@ubuntu-dev:~# echo 1 >/var/tmp/test +root@ubuntu-dev:~# cat /var/tmp/test +1 +root@ubuntu-dev:~# echo 2 >>/var/tmp/test +root@ubuntu-dev:~# cat /var/tmp/test +1 +1 +2 +root@ubuntu-dev:~# +``` +This is not happening on the tmpfs: +``` +root@ubuntu-dev:~# echo 1 >/tmp/test +root@ubuntu-dev:~# cat /tmp/test +1 +root@ubuntu-dev:~# echo 2 >>/tmp/test +root@ubuntu-dev:~# cat /tmp/test +1 +2 +root@ubuntu-dev:~# +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2207 b/results/classifier/mode-deepseek-r1:32b/output/system/2207 new file mode 100644 index 00000000..aaa434f9 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2207 @@ -0,0 +1,13 @@ + + +WerFault.exe – Application Error. The memory could not be read in Win7 i386 +Description of problem: +WerFault Application Errors always occur when I open IE or even control panel. It's OK on QEMU 7.2 & 8.0 version according to my debug experience about qemu-system-i386 flavor in the last few months. +Steps to reproduce: +1. pulling _tag: v8.2.0_ code +2. emulating Windows 7 OS on aarch64 Host with TCG acceleration mechanism +3. just opening IE for maybe two or three times after the virtual machine has started +Additional information: +The error is displayed by Chinese. It says _WerFault.exe – Application Error. The instruction at 0x779f77b2 referenced memory at 0x6d0f6d20. The memory could not be read._ in English + + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2215 b/results/classifier/mode-deepseek-r1:32b/output/system/2215 new file mode 100644 index 00000000..888edf55 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2215 @@ -0,0 +1,3 @@ + + +qemu-8.2.2 compile failure against musl diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2216 b/results/classifier/mode-deepseek-r1:32b/output/system/2216 new file mode 100644 index 00000000..99a6e59f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2216 @@ -0,0 +1,5 @@ + + +Incresaed artifacts generation speed with paralleled process +Additional information: +`parallel-jobs` was referenced `main` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2217 b/results/classifier/mode-deepseek-r1:32b/output/system/2217 new file mode 100644 index 00000000..c385accf --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2217 @@ -0,0 +1,3 @@ + + +Changing screen grab diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2229 b/results/classifier/mode-deepseek-r1:32b/output/system/2229 new file mode 100644 index 00000000..66bf6106 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2229 @@ -0,0 +1,7 @@ + + +tcg/tcg.c:813:tcg_register_thread: assertion failed: (n < tcg_max_ctxs) +Description of problem: +When running qemu-system-microblazeel with the xlnx-zynqmp-pmu machine and an additional xlnx-zynqmp-pmu-soc device, TCG crashes via an assertion. +Steps to reproduce: +Run: `` ./qemu-system-microblazeel -machine xlnx-zynqmp-pmu -device xlnx-zynqmp-pmu-soc `` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/223 b/results/classifier/mode-deepseek-r1:32b/output/system/223 new file mode 100644 index 00000000..ee2a6de6 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/223 @@ -0,0 +1,3 @@ + + +guest migration 100% cpu freeze bug diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2230 b/results/classifier/mode-deepseek-r1:32b/output/system/2230 new file mode 100644 index 00000000..e1164310 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2230 @@ -0,0 +1,143 @@ + + +Problems running x86_64 programs on loongarch64 platform +Description of problem: +There is also a running service program on the platform, and **gate_svr** program needs to communicate with it. The following problem occurs: +``` +ERROR:../plugins/core.c:220:qemu_plugin_vcpu_init_hook: assertion failed: (success) +Bail out! ERROR:../plugins/core.c:220:qemu_plugin_vcpu_init_hook: assertion failed: (success) +``` +The following is the log： +``` +[root@localhost bin]# ./gate_svr -y 0 -g 1 -p 18700 -i 127.0.0.1 -l 127.0.0.1,18082 +V4.3.20.1-build-20240126.210622 +NdsGate : start +yan_lis:0 +unix_domain_name=/tmp/test_1.ss +conf dir: /root/sql_proxy/gate/conf + + +indicate port:18700 +indicate ipv6_support:0 +indicate link-ctl:127.0.0.1,18082 + +directory:/root/operating/oci_test/bin +processname:gate_svr +model_path_in:/root/operating/oci_test/conf/in model_path_out:/root/operating/oci_test/conf/out +tr: 写入错误: 断开的管道 +tr: 写入错误 + +---------------------------------------------------------------------- + +Create SGA, shmid = 53608511 +---------------------------------------------------------------------- + +Attach SGA, shmid = 53608511, sga_address = 0xffb5700000 +---------------------------------------------------------------------- + +Init SGA, shmid = 53608511, sga_address = 0xffb5700000,ret = 0 +---------------------------------------------------------------------- +tr: 写入错误: 断开的管道 +tr: 写入错误 +fc_shmid:50003996 +tr: 写入错误: 断开的管道 +tr: 写入错误 +ai_shmid:50036765 +/tmp/alarm_report_log is exist, no need create +NdsGate : start thread->>anhua_lock_detecter sucess! shmid_t=53608511 loop_time=3 +new NCSocket sk_:6 +-------------Detect Mutex----------- +mypid = 20953 +ControllerClient::startConnect ip:127.0.0.1, port:18082 +connect success, socket:6 +NdsGate : connect to controller ok, send handshake packet ...sk:6 +check cen_time_enable 0 0 +NdsGate : handshake ok, gate id is 1 +get_node_name->gid=1,node_name=configuration_1 +shm get ok, config_store len: 9924 + + +start config init... + +---------------------------------------------------------------------- +Ƥ׃½㏶א... + +~~~~~~~~~~~~~~~~~~~~~~log1 +~~~~~~~~~~~~~~~~~~~~~~log2 +~~~~~~~~~~~~~~~~~~~~~~log3 +~~~~~~~~~~~~~~~~~~~~~~log4 +~~~~~~~~~~~~~~~~~~~~~~log5 +~~~~~~~~~~~~~~~~~~~~~~log6 +~~~~~~~~~~~~~~~~~~~~~~log7 +~~~~~~~~~~~~~~~~~~~~~~log8 +Ƥ׃½㏶ºŊ±: 0.000000(s) + + +---------------------------------------------------------------------- + + +log file name->./nds.log_0 +g_ai_check=0 +nds_config_rule_database_creatºŊ±: 0.000000(s) +nds_config_app_rule_database_creatºŊ±: 0.000000(s) +nds_config_real_database_creatºŊ±: 0.000000(s) +nds_config_virtual_database_creatºŊ±: 0.000000(s) +nds_config_app_creatºŊ±: 0.000000(s) +nds_config_app_server_createºŊ±: 0.000000(s) + + +app-vdb-ip config list: + + +inner_list=1 +default_list=2 + +---------------------------------------------------------------------- + +Start attach, shmid = 53608511 +---------------------------------------------------------------------- + +Attach SGA, shmid = 53608511, sga_address = 0xff65000000 +---------------------------------------------------------------------- +1 + +Load rules, shmid = 53608511, sga_address = 0xff65000000,ret = -1 +2---------------------------------------------------------------------- + +SqlEngine_AppRulesMap ret=0 + +---------------------------------------------------------------------- +gate disconnect from ctl ok + +ctl config trans_mode=1 +getReadBufferLength bev is null !! sock:-646169440 + +gate_net_name:bond1 +grep: /etc/keepalived/keepalived.conf: 没有那个文件或目录 + +get_bond_ip->cmd=grep -w -A 2 'virtual_ipaddress' /etc/keepalived/keepalived.conf|grep bond1|grep -v 'virtual_ipaddress'|awk '{print $1}' +grep: /etc/keepalived/keepalived.conf: 没有那个文件或目录 + +get_bond_ip->cmd=grep -w -A 2 'virtual_ipaddress' /etc/keepalived/keepalived.conf|grep bond1|grep -v 'virtual_ipaddress'|awk '{print $1}' +grep: /etc/keepalived/keepalived.conf: 没有那个文件或目录 + +get_bond_ip->cmd=grep -w -A 2 'virtual_ipaddress_excluded' /etc/keepalived/keepalived.conf|grep bond1|grep -v 'virtual_ipaddress_excluded'|awk '{print $1}' +grep: /etc/keepalived/keepalived.conf: 没有那个文件或目录 + +get_bond_ip->cmd=grep -w -A 2 'virtual_ipaddress_excluded' /etc/keepalived/keepalived.conf|grep bond1|grep -v 'virtual_ipaddress_excluded'|awk '{print $1}' +grep: /etc/keepalived/keepalived.conf: 没有那个文件或目录 + +get_bond_ip->cmd=grep -w -A 2 'virtual_ipaddress' /etc/keepalived/keepalived.conf|grep bond1|grep -v 'virtual_ipaddress'|awk '{print $1}' +grep: /etc/keepalived/keepalived.conf: 没有那个文件或目录 + +get_bond_ip->cmd=grep -w -A 2 'virtual_ipaddress' /etc/keepalived/keepalived.conf|grep bond1|grep -v 'virtual_ipaddress'|awk '{print $1}' + +listen_ip(ipv4):0.0.0.0 + +gate_epoll_start... +** +ERROR:../plugins/core.c:220:qemu_plugin_vcpu_init_hook: assertion failed: (success) +Bail out! ERROR:../plugins/core.c:220:qemu_plugin_vcpu_init_hook: assertion failed: (success) +``` +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2236 b/results/classifier/mode-deepseek-r1:32b/output/system/2236 new file mode 100644 index 00000000..2ac90bcb --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2236 @@ -0,0 +1,3 @@ + + +32-bit PPC CPUs are reported based on 64-bit base CPU diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2240 b/results/classifier/mode-deepseek-r1:32b/output/system/2240 new file mode 100644 index 00000000..5b36a4d0 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2240 @@ -0,0 +1,6 @@ + + +Please provide useful defaults for machine and cpu +Additional information: +See https://bugs.debian.org/1040212 and https://salsa.debian.org/helmutg/debvm/-/issues/15 for the preceding discussion and +https://salsa.debian.org/helmutg/debvm/-/blob/main/bin/debvm-run and https://salsa.debian.org/kernel-team/initramfs-tools/-/merge_requests/80 for the used machine and cpu values. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2241 b/results/classifier/mode-deepseek-r1:32b/output/system/2241 new file mode 100644 index 00000000..e6d63ddb --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2241 @@ -0,0 +1,3 @@ + + +QMP Commands dont't work properly diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2253 b/results/classifier/mode-deepseek-r1:32b/output/system/2253 new file mode 100644 index 00000000..fea349c0 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2253 @@ -0,0 +1,3 @@ + + +NO_CAST.INTEGER_OVERFLOW in /hw/net/eepro100.c diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2254 b/results/classifier/mode-deepseek-r1:32b/output/system/2254 new file mode 100644 index 00000000..c2fff5c4 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2254 @@ -0,0 +1,3 @@ + + +UNCHECKED_FUNC_RES.LIB.STRICT in /io/channel-socket.c diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2256 b/results/classifier/mode-deepseek-r1:32b/output/system/2256 new file mode 100644 index 00000000..a83b60ca --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2256 @@ -0,0 +1,3 @@ + + +cirrus CI jobs failing diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2259 b/results/classifier/mode-deepseek-r1:32b/output/system/2259 new file mode 100644 index 00000000..e6148e91 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2259 @@ -0,0 +1,16 @@ + + +The cause code of a trap changes when qemu is nested in another qemu +Description of problem: +I am studying the feasibility of doing some practical work on RISCV plates. Since I don't have these boards yet, I'm emulating it with qemu. The practice in turn consists of launching with qemu a very small operating system with two tasks that make a series of system calls. + +When I run this practice on my host it works correctly, but when I run it on an Ubuntu emulated in riscv with qemu, the cause code for the trap changes (the first bit of the code). + +The demo can be found in this repository: https://github.com/Sft570/qemu-bug-report +Steps to reproduce: +1. Clone the repository on the host and run the demo with "make qemu" +2. Emulate with qemu ubuntu in riscv, clone the repository and run the demo with "make qemu". + +The error displayed shows the change of the cause code bit. You can analyze its behavior in the trap.c file in the src folder. +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2265 b/results/classifier/mode-deepseek-r1:32b/output/system/2265 new file mode 100644 index 00000000..561d2ad1 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2265 @@ -0,0 +1,50 @@ + + +qemu-system-x86_64 crash creating snapshot +Description of problem: +I'm facing a crash in qemu-system-x86_64.\ +I crash because bs->children.lh_first is null and QLIST_NEXT try dereference the pointer. It triggers a SIGSEGV\ +The manner to reproduce is too complex to give on gitlab and the version is not recent. (I reproduce also with 7.1)\ + +here is the stack: + +(gdb) p bs->children\ +$1 = {lh_first = 0x0}\ +(gdb)\ +(gdb) p child\ +$2 = (BdrvChild *) 0x0\ +(gdb)\ + if (bs->implicit) {\ + /* For implicit nodes, just copy everything from the single child */\ + child = QLIST_FIRST(&bs->children);\ +----->> assert(QLIST_NEXT(child, next) == NULL);\ + pstrcpy(bs->exact_filename, sizeof(bs->exact_filename),\ + + +#0 bdrv_refresh_filename (bs=0x562927927000) at ../qemu-6.2.0/block.c:7525\ +#1 0x000056292527dd97 in bdrv_block_device_info (blk=blk@entry=0x0, bs=bs@entry=0x562927927000, flat=flat@entry=true, errp=errp@entry=0x7ffcef7e8318) at ../qemu-6.2.0/block/qapi.c:58\ +#2 0x00005629252470c0 in bdrv_named_nodes_list (flat=true, errp=errp@entry=0x7ffcef7e8318) at ../qemu-6.2.0/block.c:5863\ +#3 0x000056292523da7e in qmp_query_named_block_nodes (has_flat=<optimized out>, flat=<optimized out>, errp=errp@entry=0x7ffcef7e8318) at ../qemu-6.2.0/blockdev.c:2935\ +#4 0x0000562925301ebd in qmp_marshal_query_named_block_nodes (args=<optimized out>, ret=0x7fc833c83e88, errp=0x7fc833c83e80) at qapi/qapi-commands-block-core.c:423\ +#5 0x0000562925344129 in do_qmp_dispatch_bh (opaque=0x7fc833c83e90) at ../qemu-6.2.0/qapi/qmp-dispatch.c:129 +#6 0x000056292535ecf5 in aio_bh_call (bh=0x5629295ab560) at ../qemu-6.2.0/util/async.c:141\ +#7 aio_bh_poll (ctx=ctx@entry=0x5629276c93e0) at ../qemu-6.2.0/util/async.c:169\ +#8 0x000056292534cf9e in aio_dispatch (ctx=0x5629276c93e0) at ../qemu-6.2.0/util/aio-posix.c:381\ +#9 0x000056292535eb9e in aio_ctx_dispatch (source=<optimized out>, callback=<optimized out>, user_data=<optimized out>) at ../qemu-6.2.0/util/async.c:311\ +#10 0x00007fc8351cafee in g_match_info_fetch_pos () from /lib/x86_64-linux-gnu/libglib-2.0.so.0\ +#11 0x00007fc800000000 in ?? ()\ +#12 0x000003a05cb8b408 in ?? ()\ +#13 0x0000000000000000 in ?? ()\ + +The case lh_first = 0x0 seems to be common, but never when bs->implicit is true. bs->implicit seems to be switch to true by another thread.\ +Because the qemu version and the system are too old, I'm not expecting a patch, I'm just requesting an opinion.\ + +I fixed the problem by just doing:\ +child = QLIST_FIRST(&bs->children);\ +if (bs->implicit && (child != NULL)) {\ + assert(QLIST_NEXT(child, next) == NULL);\ + ....\ +}\ +I don't have the qemu knowledge to evaluate it and consequences.\ +Is there anyone who have any idea ?\ +Thank you very much.\ diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2267 b/results/classifier/mode-deepseek-r1:32b/output/system/2267 new file mode 100644 index 00000000..e775d7c6 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2267 @@ -0,0 +1,554 @@ + + +Out of bounds access in tx_fifo_push() +Description of problem: +I detected an out-of-bounds access in tx_fifo_push with my fuzzer. + +Stack trace (part):\ +`hw/net/lan9118.c:798:17: runtime error: index 2048 out of bounds for`\ +`type 'uint8_t[2048]' (aka 'unsigned char[2048]')`\ + `#0 0x563ec9a057b1 in tx_fifo_push hw/net/lan9118.c:798:43`\ + `#1 0x563ec99fbb28 in lan9118_writel hw/net/lan9118.c:1042:9`\ + `#2 0x563ec99f2de2 in lan9118_16bit_mode_write hw/net/lan9118.c:1205:9`\ + `#3 0x563ecbf78013 in memory_region_write_accessor system/memory.c:497:5`\ + `#4 0x563ecbf776f5 in access_with_adjusted_size system/memory.c:573:18`\ + `#5 0x563ecbf75643 in memory_region_dispatch_write system/memory.c:1521:16`\ + `#6 0x563ecc01bade in flatview_write_continue_step system/physmem.c:2713:18`\ + `#7 0x563ecc01b374 in flatview_write_continue system/physmem.c:2743:19`\ + `#8 0x563ecbff1c9b in flatview_write system/physmem.c:2774:12`\ + `#9 0x563ecbff1768 in address_space_write system/physmem.c:2894:18`\ +`...` +Steps to reproduce: +Reproducer:\ +export QEMU_ARGS="-display none -machine accel=qtest, -m 512M -machine smdkc210"\ +cat \<\< EOF | ./qemu-system-arm $QEMU_ARGS -qtest /dev/null -qtest stdio\ +outl 0xcf8 0x80000010\ +outl 0xcfc 0x5000000\ +outl 0xcf8 0x80000004\ +outl 0xcfc 0x07\ +writew 0x5000030 0x4918237b\ +writew 0x5000030 0x4918237b\ +writel 0x500003c 0x223bd37f\ +writel 0x500003c 0x223bd37f\ +writel 0x500003c 0x223bd37f\ +writew 0x500003c 0x223bd37f\ +writel 0x500003c 0x223bd37f\ +writew 0x500003c 0x223bd37f\ +writel 0x500003c 0x223bd37f\ +writel 0x500003c 0x223bd37f\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0xcb06897\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x17954990\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x17954990\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0xcb06897\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x17954990\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0xcb06897\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000024 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x17954990\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0xcb06897\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000024 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x17954990\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000024 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0xcb06897\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0xcb06897\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x17954990\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0xcb06897\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x17954990\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x17954990\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0xcb06897\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x17954990\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0xcb06897\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0xcb06897\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x17954990\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0xcb06897\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x17954990\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0xcb06897\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x17954990\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0xcb06897\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x17954990\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0xcb06897\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x17954990\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x17954990\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0xcb06897\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +writel 0x5000020 0x6a035c1b\ +EOF +Additional information: +Ack: Chuhong Yuan (hslester96@gmail.com) diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2275 b/results/classifier/mode-deepseek-r1:32b/output/system/2275 new file mode 100644 index 00000000..f787000b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2275 @@ -0,0 +1,11 @@ + + +qemu crash +Description of problem: + +Steps to reproduce: +1. +2. +3. +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2278 b/results/classifier/mode-deepseek-r1:32b/output/system/2278 new file mode 100644 index 00000000..cb496aa7 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2278 @@ -0,0 +1,3 @@ + + +Build issue on OpenBSD with Clang 16 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/228 b/results/classifier/mode-deepseek-r1:32b/output/system/228 new file mode 100644 index 00000000..e8f8d012 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/228 @@ -0,0 +1,3 @@ + + +TCG test targets missing from 'make check-help' diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2280 b/results/classifier/mode-deepseek-r1:32b/output/system/2280 new file mode 100644 index 00000000..a77f1b8e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2280 @@ -0,0 +1,3 @@ + + +Not Installing Properly diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2281 b/results/classifier/mode-deepseek-r1:32b/output/system/2281 new file mode 100644 index 00000000..6b41edc3 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2281 @@ -0,0 +1,9 @@ + + +[bugfix incl.] Solaris Debuggers Panic OS with "Nonparity Synchronous Error" +Description of problem: +General use of a debugger (mdb, adb, gdb), such as single-stepping, causing a breakpoint to trigger, and/or simply running a program will cause a kernel panic of "Nonparity Synchronous Error" on many versions of Solaris / SunOS. + +This a well reported issue. + +# diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2286 b/results/classifier/mode-deepseek-r1:32b/output/system/2286 new file mode 100644 index 00000000..a9a29c7a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2286 @@ -0,0 +1,3 @@ + + +QEMU RISC-V TCG: amo insn fault does not throw AMO fault diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2290 b/results/classifier/mode-deepseek-r1:32b/output/system/2290 new file mode 100644 index 00000000..ec1e296c --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2290 @@ -0,0 +1,145 @@ + + +Wrong multiplication result of 'long double' on m68k +Description of problem: +In both x86 and m68k, 'long double' is an 80-bit format consisting of + - 1 bit sign, 15 bits exponent, + - 1 explicit 1 bit, 63 fraction bits. + +According to <https://en.wikipedia.org/wiki/Extended_precision> and +<https://www.nxp.com/docs/en/reference-manual/M68000PRM.pdf> table 1-6 (page 1-23), with two differences: + - In m68k, there are 16 zero bits as filler after the sign/exponent + word, so that the total size is 96 bits. + - In x86, the minimum exponent of normalized numbers is 1; + in m68k, the minimum exponent of normalized numbers is 0. + +The latter difference is reflected in the values of LDBL_MIN_EXP and +LDBL_MIN in gcc: + +In x86: +``` +$ echo '#include <float.h>' | gcc -E -dM - | grep __LDBL_MIN_EXP_ +#define LDBL_MIN_EXP __LDBL_MIN_EXP__ +#define __LDBL_MIN_EXP__ (-16381) +$ echo '#include <float.h>' | gcc -E -dM - | grep __LDBL_MIN__ +#define __LDBL_MIN__ 3.36210314311209350626267781732175260e-4932L +#define LDBL_MIN __LDBL_MIN__ +``` +In m68k (I use Debian 12/Linux): +``` +$ echo '#include <float.h>' | gcc -E -dM - | grep __LDBL_MIN_EXP_ +#define LDBL_MIN_EXP __LDBL_MIN_EXP__ +#define __LDBL_MIN_EXP__ (-16382) +$ echo '#include <float.h>' | gcc -E -dM - | grep __LDBL_MIN__ +#define __LDBL_MIN__ 1.68105157155604675313e-4932L +#define LDBL_MIN __LDBL_MIN__ +``` +Steps to reproduce: +Take this program, foo.c: +``` +/* Show extended-precision https://en.wikipedia.org/wiki/Extended_precision + multiplication bug in QEMU. */ + +#include <stdio.h> + +static void +show (const long double *p) +{ +#ifdef __m68k__ + printf("<S,E: 0x%08X M: 0x%08X%08X>", + ((const unsigned int *) p)[0], + ((const unsigned int *) p)[1], + ((const unsigned int *) p)[2]); +#else /* x86 */ + printf("<S,E: 0x%04X M: 0x%08X%08X>", + ((const unsigned short *) p)[4], + ((const unsigned int *) p)[1], + ((const unsigned int *) p)[0]); +#endif + printf (" = %La = %Lg", *p, *p); +} + +static void +show_mult (long double a, long double b) +{ + printf ("Factors: "); + show (&a); + printf ("\n and: "); + show (&b); + long double c = a * b; + printf ("\nProduct: "); + show (&c); + printf ("\n\n"); +} + +/* Return 2^n. */ +static long double +pow2l (int n) +{ + int k = n; + volatile long double x = 1; + volatile long double y = 2; + /* Invariant: 2^n == x * y^k. */ + if (k < 0) + { + y = 0.5L; + k = - k; + } + while (k > 0) + { + if (k != 2 * (k / 2)) + { + x = x * y; + k = k - 1; + } + if (k == 0) + break; + y = y * y; + k = k / 2; + } + /* Now k == 0, hence x == 2^n. */ + return x; +} + +int main () +{ + show_mult (pow2l (-16382), 0.5L); + show_mult (pow2l (-16381), 0.25L); + return 0; +} +``` +Its output on x86: +``` +$ ./a.out +Factors: <S,E: 0x0001 M: 0x8000000000000000> = 0x8p-16385 = 3.3621e-4932 + and: <S,E: 0x3FFE M: 0x8000000000000000> = 0x8p-4 = 0.5 +Product: <S,E: 0x0000 M: 0x4000000000000000> = 0x4p-16385 = 1.68105e-4932 + +Factors: <S,E: 0x0002 M: 0x8000000000000000> = 0x8p-16384 = 6.72421e-4932 + and: <S,E: 0x3FFD M: 0x8000000000000000> = 0x8p-5 = 0.25 +Product: <S,E: 0x0000 M: 0x4000000000000000> = 0x4p-16385 = 1.68105e-4932 +``` +Its output on m68k: +``` +$ ./a.out +Factors: <S,E: 0x00010000 M: 0x8000000000000000> = 0x8p-16385 = 3.3621e-4932 + and: <S,E: 0x3FFE0000 M: 0x8000000000000000> = 0x8p-4 = 0.5 +Product: <S,E: 0x00000000 M: 0x4000000000000000> = 0x4p-16386 = 8.40526e-4933 + +Factors: <S,E: 0x00020000 M: 0x8000000000000000> = 0x8p-16384 = 6.72421e-4932 + and: <S,E: 0x3FFD0000 M: 0x8000000000000000> = 0x8p-5 = 0.25 +Product: <S,E: 0x00000000 M: 0x4000000000000000> = 0x4p-16386 = 8.40526e-4933 +``` +The product, computed by QEMU, is incorrect. It is only half as large as the +correct value. The expected output should be: +``` +Factors: <S,E: 0x00010000 M: 0x8000000000000000> = 0x8p-16385 = 3.3621e-4932 + and: <S,E: 0x3FFE0000 M: 0x8000000000000000> = 0x8p-4 = 0.5 +Product: <S,E: 0x00000000 M: 0x8000000000000000> = 0x8p-16386 = 1.68105e-4932 + +Factors: <S,E: 0x00020000 M: 0x8000000000000000> = 0x8p-16384 = 6.72421e-4932 + and: <S,E: 0x3FFD0000 M: 0x8000000000000000> = 0x8p-5 = 0.25 +Product: <S,E: 0x00000000 M: 0x8000000000000000> = 0x8p-16386 = 1.68105e-4932 +``` +Additional information: +In QEMU's source code, I would guess that this multiplication is performed by the `floatx80_mul` function. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2295 b/results/classifier/mode-deepseek-r1:32b/output/system/2295 new file mode 100644 index 00000000..9d534e2b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2295 @@ -0,0 +1,6 @@ + + +Support Apple Silicon acceleration for x86 / x86_64 guests +Additional information: +* [Top-level discussion on UTM downstream](https://github.com/utmapp/UTM/issues/5460) +* [Discussion on memory access instructions on UTM downstream](https://github.com/utmapp/UTM/issues/2366) diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2297 b/results/classifier/mode-deepseek-r1:32b/output/system/2297 new file mode 100644 index 00000000..efce4f17 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2297 @@ -0,0 +1,3 @@ + + +Incorrect String: PowerMAC (Media Access Control instead of Macintosh) diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2299 b/results/classifier/mode-deepseek-r1:32b/output/system/2299 new file mode 100644 index 00000000..ede9018a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2299 @@ -0,0 +1,205 @@ + + +UFS Device sanitizers error +Description of problem: +Sanitizers error reported by Zheyu Ma zheyuma97@gmail.com + +The following log can reveal it: + +==3619819==ERROR: AddressSanitizer: heap-buffer-overflow on address + +0x62a000011200 at pc 0x7f9f9903a2c3 bp 0x7ffd44e1ee60 sp 0x7ffd44e1e608 + +WRITE of size 20512 at 0x62a000011200 thread T0 + +``` +#0 0x7f9f9903a2c2 in __interceptor_memcpy +``` + +../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:827 + +``` +#1 0x5f23331ea4fc in memcpy +``` + +/usr/include/x86_64-linux-gnu/bits/string_fortified.h:29 + +``` +#2 0x5f23331ea4fc in flatview_read_continue_step +``` + +../system/physmem.c:2818 + +``` +#3 0x5f23331eab72 in flatview_read_continue ../system/physmem.c:2835 + +#4 0x5f23331eadc4 in flatview_read ../system/physmem.c:2865 + +#5 0x5f23331ec2a5 in address_space_read_full ../system/physmem.c:2878 + +#6 0x5f23331ec2a5 in address_space_rw ../system/physmem.c:2906 + +#7 0x5f23326b7ad0 in ufs_dma_read_req_upiu ../hw/ufs/ufs.c:129 + +#8 0x5f23326b7ad0 in ufs_dma_read_upiu ../hw/ufs/ufs.c:185 + +#9 0x5f23326b7ad0 in ufs_exec_req ../hw/ufs/ufs.c:1021 + +#10 0x5f23326b7ad0 in ufs_process_req ../hw/ufs/ufs.c:1066 + +#11 0x5f2333a9160d in aio_bh_call ../util/async.c:171 + +#12 0x5f2333a91f45 in aio_bh_poll ../util/async.c:218 + +#13 0x5f2333a217a9 in aio_dispatch ../util/aio-posix.c:423 + +#14 0x5f2333a90d01 in aio_ctx_dispatch ../util/async.c:360 + +#15 0x7f9f985c4d3a in g_main_context_dispatch +``` + +(/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x55d3a) + +``` +#16 0x5f2333a9690f in glib_pollfds_poll ../util/main-loop.c:287 + +#17 0x5f2333a9690f in os_host_main_loop_wait ../util/main-loop.c:310 + +#18 0x5f2333a9690f in main_loop_wait ../util/main-loop.c:589 + +#19 0x5f23329370e0 in qemu_main_loop ../system/runstate.c:783 + +#20 0x5f23333b4d7a in qemu_default_main ../system/main.c:37 + +#21 0x7f9f97629d8f in __libc_start_call_main +``` + +../sysdeps/nptl/libc_start_call_main.h:58 + +``` +#22 0x7f9f97629e3f in __libc_start_main_impl ../csu/libc-start.c:392 + +#23 0x5f2331c8df64 in _start +``` + +(/home/joey/repo/qemu/build/qemu-system-x86_64+0x2ea8f64) + +0x62a000011200 is located 0 bytes to the right of 20480-byte region + +\[0x62a00000c200,0x62a000011200) + +allocated by thread T0 here: + +``` +#0 0x7f9f990b4a57 in __interceptor_calloc +``` + +../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154 + +``` +#1 0x7f9f985cdc50 in g_malloc0 +``` + +(/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5ec50) + +``` +#2 0xf0e808deae299ff (<unknown module>) +``` + +SUMMARY: AddressSanitizer: heap-buffer-overflow + +../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:827 + +in \__interceptor_memcpy + +Shadow bytes around the buggy address: + +0x0c547fffa1f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + +0x0c547fffa200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + +0x0c547fffa210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + +0x0c547fffa220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + +0x0c547fffa230: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + +=\>0x0c547fffa240:\[fa\]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + +0x0c547fffa250: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + +0x0c547fffa260: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + +0x0c547fffa270: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + +0x0c547fffa280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + +0x0c547fffa290: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + +Shadow byte legend (one shadow byte represents 8 application bytes): + +Addressable: 00 + +Partially addressable: 01 02 03 04 05 06 07 + +Heap left redzone: fa + +Freed heap region: fd + +Stack left redzone: f1 + +Stack mid redzone: f2 + +Stack right redzone: f3 + +Stack after return: f5 + +Stack use after scope: f8 + +Global redzone: f9 + +Global init order: f6 + +Poisoned by user: f7 + +Container overflow: fc + +Array cookie: ac + +Intra object redzone: bb + +ASan internal: fe + +Left alloca redzone: ca + +Right alloca redzone: cb + +Shadow gap: cc + +==3619819==ABORTING + +And Here is a simple PoC: + +cat \<\< EOF \\ + +qemu-system-x86_64 \\ + +\-display none -machine accel=qtest -m 512M -M q35 -nodefaults -drive \\ + +file=[null-co://,if=none,id=disk0](null-co://,if=none,id=disk0) -device ufs,id=ufs_bus -device \\ + +ufs-lu,drive=disk0,bus=ufs_bus -qtest stdio + +outl 0xcf8 0x80000810 + +outl 0xcfc 0xe0000000 + +outl 0xcf8 0x80000804 + +outw 0xcfc 0x06 + +write 0xe0000058 0x1 0xa7 + +write 0xa 0x1 0x50 + +EOF diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/230 b/results/classifier/mode-deepseek-r1:32b/output/system/230 new file mode 100644 index 00000000..0d4c7126 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/230 @@ -0,0 +1,3 @@ + + +Confuse error message in virtio_init_region_cache() diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2300 b/results/classifier/mode-deepseek-r1:32b/output/system/2300 new file mode 100644 index 00000000..7ef01818 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2300 @@ -0,0 +1,3 @@ + + +Unintialized variable in double_cpdo.c diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2301 b/results/classifier/mode-deepseek-r1:32b/output/system/2301 new file mode 100644 index 00000000..123083b5 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2301 @@ -0,0 +1,3 @@ + + +GitLab Windows Server 2019 runner is deprecated diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2306 b/results/classifier/mode-deepseek-r1:32b/output/system/2306 new file mode 100644 index 00000000..ccd3e201 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2306 @@ -0,0 +1,3 @@ + + +A bug of ptimer that the freq can't set more than 1000M diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2307 b/results/classifier/mode-deepseek-r1:32b/output/system/2307 new file mode 100644 index 00000000..71f5de99 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2307 @@ -0,0 +1,41 @@ + + +QEMU Windows COM port filenames not recognized i.e. \\.\COM19 or \\.\CNCA0 +Steps to reproduce: +1. Run qemu-system-arm with the comand line above. +2. QEMU fails with `qemu-system-arm.exe: -gdb \\.\CNCA8: '\\.\CNCA8' is not a valid char driver` +3. ```qemu-system-arm.exe -machine mps2-an500 -gdb \\.\COM19 +qemu-system-arm.exe: -gdb \\.\COM19: '\\.\COM19' is not a valid char driver +``` +Additional information: +Windows allows COM ports numbered 10 and higher to be prefixed with a `\\.\` escape as in `\\.\COM17`. Such COM port assignments are not uncommon when a plurality of USB serial adapters. +Equally problematic are virtual COM port designations such as `\\.\CNCA8` created by the Windows 10x64 driver package known as `com0com`: https://pete.akeo.ie/2011/07/com0com-signed-drivers.html + +Upon checking the source pulled from the Github mirror an initial fix was to simply modify /chardev/char.c, but this appears insufficient. Sadly. + +Please ask if more information is required. I am actively working on extending an existing QEMU machine emulation. A patch to fix this problem is below. Please comment if applicable. + +Jerry. + +``` +diff --git a/chardev/char.c b/chardev/char.c +index 3c43fb1278..7a3f342c72 100644 +--- a/chardev/char.c ++++ b/chardev/char.c +@@ -418,6 +418,13 @@ QemuOpts *qemu_chr_parse_compat(const char *label, const char *filename, + qemu_opt_set(opts, "path", filename, &error_abort); + return opts; + } ++ // JME ++ if (strstart(filename, "\\\\.\\", NULL)) { ++ qemu_opt_set(opts, "backend", "serial", &error_abort); ++ qemu_opt_set(opts, "path", filename, &error_abort); ++ return opts; ++ } ++ + if (strstart(filename, "file:", &p)) { + qemu_opt_set(opts, "backend", "file", &error_abort); + qemu_opt_set(opts, "path", p, &error_abort); + +``` +/label ~"kind::Bug" diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2316 b/results/classifier/mode-deepseek-r1:32b/output/system/2316 new file mode 100644 index 00000000..d8f9c618 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2316 @@ -0,0 +1,38 @@ + + +aarch64 virt cortex-a53 libc printf (with argument) hello world strange behavior +Description of problem: +My hello world get lost after + +`0x0000000040000370 <+48>: str q0, [sp, #80]` + +in + +``` + 0x1f8: udf #0 + 0x1fc: udf #0 +=> 0x200: udf #0 + 0x204: udf #0 + 0x208: udf #0 + 0x20c: udf #0 + 0x210: udf #0 + 0x214: udf #0 +``` + +By bisecting, I got the last commit OK : v8.2.0-2033-g49fa457ca5 + +``` +$ qemu-system-aarch64 -M virt,secure=on,gic-version=3 -cpu cortex-a53 -kernel aarch64-none-elf-a.elf -serial stdio -display none +printf with an integer : 42 +``` + +But after v8.2.0-2034-g59754f85ed https://gitlab.com/qemu-project/qemu/-/commit/59754f85ed35cbd5f4bf2663ca2136c78d5b2413 (for example with latest v9.0.0-265-gfd87be1dad), it doesn't work anymore. +Steps to reproduce: +1. Build qemu-system-aarch64 with ``./configure --prefix=$PREFIX --target-list=aarch64-softmmu --disable-user --disable-linux-user --disable-bsd-user --enable-kvm --enable-tcg --disable-gnutls --disable-nettle --disable-gtk --disable-iconv --disable-curses --disable-curl --disable-vnc --disable-vnc-jpeg --disable-attr --disable-libusb --disable-opengl --disable-tpm --disable-bzip2 && make -j$(nproc) && make install`` + +2. Run my hello world : ``qemu-system-aarch64 -M virt,secure=on,gic-version=3 -cpu cortex-a53 -kernel aarch64-none-elf-a.elf -serial stdio -display none`` +Additional information: +I provide here the hello world (elf + map). Of course the problem might be that it (qemu and/or hello world) was not built correctly and that everything was working by chance before v8.2.0-2033-g49fa457ca5 +[aarch64-none-elf-a.elf](/uploads/daf7f37aec260c56d4be5fd90554dce3/aarch64-none-elf-a.elf) +[aarch64-none-elf-a.map](/uploads/5564cee13a214e7eb8d6d4bf79f09682/aarch64-none-elf-a.map) +Depending on the investigation, I can provide what's needed to rebuild it. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2320 b/results/classifier/mode-deepseek-r1:32b/output/system/2320 new file mode 100644 index 00000000..dd721097 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2320 @@ -0,0 +1,3 @@ + + +-Wchar-subscripts warnings in target/i386/tcg/decode-new.c.inc diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2322 b/results/classifier/mode-deepseek-r1:32b/output/system/2322 new file mode 100644 index 00000000..f07e98c5 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2322 @@ -0,0 +1,3 @@ + + +Qemu 9 make install failed on Ubuntu 23.10 ARM64 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2323 b/results/classifier/mode-deepseek-r1:32b/output/system/2323 new file mode 100644 index 00000000..a0a69278 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2323 @@ -0,0 +1,28 @@ + + +Win/Super key not working correctly under Windows hosts +Description of problem: +I accidentally noticed `Win` key (VK_LWIN) not working correctly on Windows hosts, more specifically: + +1. It is impossible to "hold" `Win`. If one presses and holds `Win`, the guest is spammed with `Win` keypresses, instead of receiving a single `Win` keypress at the point of releasing the button (VK_LWIN button up). +2. It is impossible to make key combinations (shortcuts, hotkeys etc.) that involve the `Win/Super` key. Maybe implicitly solved by fixing #1. + +This behavior is present starting from bc8e883065f36581e4f2352c31a1dfa5f65a82f2 (ui/sdl2: disable SDL_HINT_GRAB_KEYBOARD on Windows). Before it, on the SDL2 keyboard hook `Win/Super` key worked correctly. I demonstrate the problem on Fedora/WinXP, but it affects all guests. +Steps to reproduce: +1. (see additional information) +2. +3. +Additional information: +Short video demonstration on a WinXP guest and a Fedora 39 guest. The qemus used are (qemu-8.0.2 e0968d21e27ef9c406f709180a39a076e786efbe; working correctly) and (qemu-9.0.0 from the release tarball qemu-9.0.0.tar.xz; buggy) + +1. In the WinXP video, I'm pressing and holding the `Win` key for about 3 seconds. In the correct version, the start menu is opened only at the point of release. In the buggy version, the start menu is opened repeatedly tens of times (flickering). You can see the point of release in Nirsoft's KeyboardStateView, when VK_LWIN loses the "pressed" asterisk. + + At the end of the video I'm trying to use the `Win+e` shortcut for WinExplorer. In the buggy version, Outlook is opened instead. This is because the keypresses are processed individually, first `Win` opens the start menu and then `e` opens email application (in this case outlook). In the correct version WinExplorer is opened. + +  +  + +2. In the Fedora video, I'm trying to set up a simple shortcut, I'm pressing on my keyboard `LCTRL+LALT+Super+E`. In the buggy version, the `Super` key is not picked up. All the shortcut combinations involving `Super` are therefore not working. + +  +  diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2328 b/results/classifier/mode-deepseek-r1:32b/output/system/2328 new file mode 100644 index 00000000..bf6a44de --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2328 @@ -0,0 +1,3 @@ + + +sha1.c:161:13: warning: ‘SHA1Transform’ reading 64 bytes from a region of size 0 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2329 b/results/classifier/mode-deepseek-r1:32b/output/system/2329 new file mode 100644 index 00000000..2e56fc65 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2329 @@ -0,0 +1,3 @@ + + +Windows 64-bit, qemu-monitor, change diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/233 b/results/classifier/mode-deepseek-r1:32b/output/system/233 new file mode 100644 index 00000000..024ff88c --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/233 @@ -0,0 +1,3 @@ + + +QEMU installer with WHPX support diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/234 b/results/classifier/mode-deepseek-r1:32b/output/system/234 new file mode 100644 index 00000000..7209a6b3 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/234 @@ -0,0 +1,3 @@ + + +Failure building with clang-10 and libssh diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2340 b/results/classifier/mode-deepseek-r1:32b/output/system/2340 new file mode 100644 index 00000000..5161d866 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2340 @@ -0,0 +1,35 @@ + + +SPARC fp operation INVALID trap hangs on offending instruction. +Description of problem: +An IEEE Invalid Operation exception is typically not enabled in programs - but if it is and an Invalid Operation occurs, a hardware TRAP should be generated which eventually becomes a SIGFPE. However, instead, the program seems to hang on the offending instruction, never moving forward. + +This small C example (you'll need a C compiler) demonstrates the problem, by enabling the INValid floating-pt exception, then executing the FDTOI instruction which causes an INValid trap because the floating-pt source operand is too large for the 32-bit integer result . The SPARC V9 manual specifies that exception should happen, so it's correct to generate the trap. However, the program simply hangs on the FDTOI instruction instead of receiving the signal. + +It could be something in trap emulation that is the underlying culprit here - other possible IEEE traps (such as division-by-zero) might similarly fail? + +`#include <ieeefp.h>` + +`main()` + +`{` + + `double val;` + + `int i;` + + `fpsetmask(FP_X_INV);` + + `val = 1000000000000003.0; /* Number that is too large for int */` + + `printf("val is %f\n", val);` + + `i = val;` + + `printf("i is %d\n", i);` + +`}` +Steps to reproduce: +1. Enable IEEE iNValid operation traps in the TEM in the FSR. +2. Generate an instruction that causes an iNValid trap +3. Instruction hangs, no SIGFPE is generated diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2351 b/results/classifier/mode-deepseek-r1:32b/output/system/2351 new file mode 100644 index 00000000..bb5f1a16 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2351 @@ -0,0 +1,17 @@ + + +Raspberry Pi: Unable to start raspios bookworm +Description of problem: +I am able to start RaspiOS bullseye (2023-05-03-raspios-bullseye-arm64-lite) in both, the rpi3 and rpi4 configurations, by first extracting the DTB and the kernel from the downloaded image (see the command lines). + +When I attempt to start RaspiOS bookworm (2024-03-15-raspios-bookworm-arm64-lite), I only get the following messages on the host's terminal: + +``` +usbnet: failed control transaction: request 0x8006 value 0x600 index 0x0 length 0xa +usbnet: failed control transaction: request 0x8006 value 0x600 index 0x0 length 0xa +usbnet: failed control transaction: request 0x8006 value 0x600 index 0x0 length 0xa +``` + +[start-raspios.sh](/uploads/041fb113d1d0d920e52f3b11a9f51290/start-raspios.sh) +Steps to reproduce: +To reproduce, adapt the attached script, download the raspios images and run it. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2352 b/results/classifier/mode-deepseek-r1:32b/output/system/2352 new file mode 100644 index 00000000..a6eec0b2 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2352 @@ -0,0 +1,3 @@ + + +spapr-vlan hotplug diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2354 b/results/classifier/mode-deepseek-r1:32b/output/system/2354 new file mode 100644 index 00000000..0faa9ff6 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2354 @@ -0,0 +1,9 @@ + + +Compile error with In function ‘vhost_scsi_set_workers’: +Steps to reproduce: +1. ./configure +2. ./make +Additional information: +I suspect something is misconfigured on my system, but I followed the straighforward directions +for building and I am running stock Debian 12. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2355 b/results/classifier/mode-deepseek-r1:32b/output/system/2355 new file mode 100644 index 00000000..9d86ca63 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2355 @@ -0,0 +1,81 @@ + + +buffer overflow in aspeed gpio +Description of problem: +The following log reveals it: + +``` +==2602930==ERROR: AddressSanitizer: global-buffer-overflow on address 0x55a5da29e128 at pc 0x55a5d700dc62 bp 0x7fff096c4e90 sp 0x7fff096c4e88 +READ of size 2 at 0x55a5da29e128 thread T0 + #0 0x55a5d700dc61 in aspeed_gpio_read /home/joey/repo/qemu/build/../hw/gpio/aspeed_gpio.c:564:14 + #1 0x55a5d933f3ab in memory_region_read_accessor /home/joey/repo/qemu/build/../system/memory.c:445:11 + #2 0x55a5d92fba40 in access_with_adjusted_size /home/joey/repo/qemu/build/../system/memory.c:573:18 + #3 0x55a5d92f842c in memory_region_dispatch_read1 /home/joey/repo/qemu/build/../system/memory.c:1426:16 + #4 0x55a5d92f7b68 in memory_region_dispatch_read /home/joey/repo/qemu/build/../system/memory.c:1459:9 + #5 0x55a5d9376ad1 in flatview_read_continue_step /home/joey/repo/qemu/build/../system/physmem.c:2836:18 + #6 0x55a5d9376399 in flatview_read_continue /home/joey/repo/qemu/build/../system/physmem.c:2877:19 + #7 0x55a5d93775b8 in flatview_read /home/joey/repo/qemu/build/../system/physmem.c:2907:12 + #8 0x55a5d9377078 in address_space_read_full /home/joey/repo/qemu/build/../system/physmem.c:2920:18 + #9 0x55a5d8189aa2 in address_space_read /home/joey/repo/qemu/include/exec/memory.h:3100:18 + #10 0x55a5d8189aa2 in qtest_process_command /home/joey/repo/qemu/build/../system/qtest.c:597:13 + #11 0x55a5d818231d in qtest_process_inbuf /home/joey/repo/qemu/build/../system/qtest.c:811:9 + #12 0x55a5d81915ae in qtest_read /home/joey/repo/qemu/build/../system/qtest.c:823:5 + #13 0x55a5d9bc115d in qemu_chr_be_write_impl /home/joey/repo/qemu/build/../chardev/char.c:214:9 + #14 0x55a5d9bc1219 in qemu_chr_be_write /home/joey/repo/qemu/build/../chardev/char.c:226:9 + #15 0x55a5d9bccd25 in fd_chr_read /home/joey/repo/qemu/build/../chardev/char-fd.c:72:9 + #16 0x55a5d95d958c in qio_channel_fd_source_dispatch /home/joey/repo/qemu/build/../io/channel-watch.c:84:12 + #17 0x7f8909babc43 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x55c43) + #18 0x55a5d9f62319 in glib_pollfds_poll /home/joey/repo/qemu/build/../util/main-loop.c:287:9 + #19 0x55a5d9f60c53 in os_host_main_loop_wait /home/joey/repo/qemu/build/../util/main-loop.c:310:5 + #20 0x55a5d9f6081c in main_loop_wait /home/joey/repo/qemu/build/../util/main-loop.c:589:11 + #21 0x55a5d8198807 in qemu_main_loop /home/joey/repo/qemu/build/../system/runstate.c:796:9 + #22 0x55a5d9544c6c in qemu_default_main /home/joey/repo/qemu/build/../system/main.c:37:14 + #23 0x55a5d9544cb7 in main /home/joey/repo/qemu/build/../system/main.c:48:12 + #24 0x7f8909229d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 + #25 0x7f8909229e3f in __libc_start_main csu/../csu/libc-start.c:392:3 + #26 0x55a5d671ed34 in _start (/home/joey/repo/qemu/build/qemu-system-aarch64+0x2773d34) + +0x55a5da29e128 is located 24 bytes to the left of global variable '<string literal>' defined in '../hw/gpio/aspeed_gpio.c:1180:23' (0x55a5da29e140) of size 20 + '<string literal>' is ascii string 'aspeed.gpio-ast2500' +0x55a5da29e128 is located 22 bytes to the right of global variable '<string literal>' defined in '/home/joey/repo/qemu/include/hw/gpio/aspeed_gpio.h:17:1' (0x55a5da29e100) of size 18 + '<string literal>' is ascii string 'ASPEED_GPIO_CLASS' +SUMMARY: AddressSanitizer: global-buffer-overflow /home/joey/repo/qemu/build/../hw/gpio/aspeed_gpio.c:564:14 in aspeed_gpio_read +Shadow bytes around the buggy address: + 0x0ab53b44bbd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ab53b44bbe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ab53b44bbf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ab53b44bc00: 00 00 00 00 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 + 0x0ab53b44bc10: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 +=>0x0ab53b44bc20: 00 00 02 f9 f9[f9]f9 f9 00 00 04 f9 f9 f9 f9 f9 + 0x0ab53b44bc30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ab53b44bc40: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 04 f9 + 0x0ab53b44bc50: f9 f9 f9 f9 00 00 00 01 f9 f9 f9 f9 00 00 00 00 + 0x0ab53b44bc60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ab53b44bc70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +``` +Steps to reproduce: +``` +cat << EOF | qemu-system-aarch64 -display \ +none -machine accel=qtest, -m 512M -machine ast1030-evb -qtest stdio +readq 0x7e780272 +EOF +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2366 b/results/classifier/mode-deepseek-r1:32b/output/system/2366 new file mode 100644 index 00000000..10a40e58 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2366 @@ -0,0 +1,3 @@ + + +qemu8.2 check test failed diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2367 b/results/classifier/mode-deepseek-r1:32b/output/system/2367 new file mode 100644 index 00000000..667488da --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2367 @@ -0,0 +1,3 @@ + + +qemu8.2 check test failed diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2368 b/results/classifier/mode-deepseek-r1:32b/output/system/2368 new file mode 100644 index 00000000..27db8ea3 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2368 @@ -0,0 +1,3 @@ + + +Get get_maintainer.pl working with cover letter files diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/237 b/results/classifier/mode-deepseek-r1:32b/output/system/237 new file mode 100644 index 00000000..752ca606 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/237 @@ -0,0 +1,3 @@ + + +[Feature request] x86: dump MSR features in human form diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2377 b/results/classifier/mode-deepseek-r1:32b/output/system/2377 new file mode 100644 index 00000000..ac3b232f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2377 @@ -0,0 +1,27 @@ + + +Debootstrapping debian-bullseye arm64 segfaults with qemu >=8.1 +Steps to reproduce: +1. Use qemu >= 8.1 (version <= 8.0.x work well) +2. Install `debootstrap` package +3. Run `sudo debootstrap --arch=arm64 bullseye root11-arm64` + +This fails to chroot into the system being debootstrapped: + +``` +$ sudo debootstrap --arch=arm64 bullseye root11-arm64 +... +W: Failure trying to run: chroot "/home/3/root11" /sbin/ldconfig +W: See /home/3/root11/debootstrap/debootstrap.log for details +$ tail -n2 /home/3/root11/debootstrap/debootstrap.log +qemu: uncaught target signal 11 (Segmentation fault) - core dumped +/usr/share/debootstrap/functions: line 1092: 3869 Segmentation fault chroot "/home/3/root11" "$@" +``` +Additional information: +Failure happens only when debootstrapping "bullseye" with "arm64" architecture. +Older (e.g. <= "buster") and newer (e.g. > "bookworm") distros are deboostrapped OK. +Other (e.g. "armhf" and others) architectures are debootstrapped OK. + +Qemu version <8.1 (e.g. 8.0.5 I use in Gentoo or versions in Debian <= bookworm) don't have the bug. + +Originally faced the issue with Gentoo host. Recently rechecked with Debian Trixie host. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2381 b/results/classifier/mode-deepseek-r1:32b/output/system/2381 new file mode 100644 index 00000000..c8c4176f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2381 @@ -0,0 +1,5 @@ + + +Modern x86 TSC features under TCG +Additional information: +I may be able to find a volunteer to implement this. If this feature does not appear to be a good first task, please let me know. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2383 b/results/classifier/mode-deepseek-r1:32b/output/system/2383 new file mode 100644 index 00000000..d6313ac0 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2383 @@ -0,0 +1,5 @@ + + +Support SMRR for x86 emulation +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2389 b/results/classifier/mode-deepseek-r1:32b/output/system/2389 new file mode 100644 index 00000000..8587cbb1 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2389 @@ -0,0 +1,36 @@ + + +Mutex initialization assertion failure due to incompatibility with macOS setrlimit() syscall +Description of problem: +Running the command with with any set of arguments instantly crashes with the following error message: + +``` +Assertion failed: (mutex->initialized), function qemu_mutex_lock_impl, file ../util/qemu-thread-posix.c, line 92. +zsh: abort ./qemu-system-x86_64 +``` +Steps to reproduce: +As per instructions for building from scratch: + +1. `mkdir build && cd build` +2. `../configure --prefix=$PWD/.. --audio-drv-list=sdl --disable-cocoa --enable-sdl --enable-sdl-image` +3. `make && make install` +4. `cd ../bin` +5. `./qemu-system-x86_64` +Additional information: +The issue is coming from the `os_setup_limits()` function in `os-posix.c`. As it turns out, the `setrlimit()` syscall behaves subtly different on macOS than on Linux systems, and the macOS man pages explicitly forbade the code on line 273. + +Line 273 from `os-posix.c`: + +``` +nofile.rlim_cur = nofile.rlim_max; +``` + +macOS `setrlimit()` man page: + +``` +COMPATIBILITY + setrlimit() now returns with errno set to EINVAL in places that historically succeeded. It no longer accepts "rlim_cur = RLIM_INFINITY" for + RLIM_NOFILE. Use "rlim_cur = min(OPEN_MAX, rlim_max)". +``` + +The man page thankfully gives us the [patch](/uploads/e7c8c6e3b5620c3b1ee34e89661097f3/qemu.patch) diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2396 b/results/classifier/mode-deepseek-r1:32b/output/system/2396 new file mode 100644 index 00000000..e734531a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2396 @@ -0,0 +1,3 @@ + + +Exception in interrupt handling after upgrading from 8.0 to 9.0 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/240 b/results/classifier/mode-deepseek-r1:32b/output/system/240 new file mode 100644 index 00000000..55d1465d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/240 @@ -0,0 +1,3 @@ + + +qemu-3.1.0-rc0: mips emulation hangs when executing invalid instructions diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2401 b/results/classifier/mode-deepseek-r1:32b/output/system/2401 new file mode 100644 index 00000000..6ff661ad --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2401 @@ -0,0 +1,3 @@ + + +"-nic none" option has no equivalent in config file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2403 b/results/classifier/mode-deepseek-r1:32b/output/system/2403 new file mode 100644 index 00000000..90598a08 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2403 @@ -0,0 +1,16 @@ + + +WHPX accelerator fails to boot guest Windows 7 +Description of problem: +I get Qemu freezed on Starting Windows screen when trying to boot Windows 7 Professional +Steps to reproduce: +1. Run qemu with the above command line and until Starting Windows screen appears. +2. See qemu freezed. +Additional information: +tcg accelerator works ok, though (Windows 7 successfully boots as expected on native hardware): + +- `qemu-system-x86_64.exe -accel tcg -cpu Westmere,aes=on,avx=on,sse4.1=on,sse4.2=on,ssse3=on,x2apic=on,xsave=on -m 4G -machine q35 -device qxl-vga,vgamem_mb=64 -hda Windows7_Disk.qcow2 -boot d -cdrom Windows7.iso` + + This bug seems to have the same roots: https://gitlab.com/qemu-project/qemu/-/issues/1859 + + {width=579 height=477} diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2406 b/results/classifier/mode-deepseek-r1:32b/output/system/2406 new file mode 100644 index 00000000..f276f758 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2406 @@ -0,0 +1,9 @@ + + +SDL UI on KMSDRM Frontend flips qemu-consoles +Description of problem: +If I launch qemu on the kms/drm console (without X11 or Wayland), the screen flips automatically between all qemu-consoles. The first (500?) milliseconds, there is the maschine output (boot messages), than the next (200?) milliseconds there is the monitor0 console, the next milliseconds, the serial0 console, and than the parallel0 console. And again from beginning (maschine, monitor0, serial0, parallel0, ... maschine, monitor0, serial0, parallel0, ...) - I dont press any key. + +If I disable monitor0, serial0, parallel0, all is fine, except one thing: I cannot issue a command on monitor0, because its disabled ;). +Steps to reproduce: +1. Start qemu without X11 and without wayland on the KMSDRM console. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2412 b/results/classifier/mode-deepseek-r1:32b/output/system/2412 new file mode 100644 index 00000000..29336504 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2412 @@ -0,0 +1,102 @@ + + +Race condition in megasas device +Description of problem: +Race condition DoS in megasas device was found during **fuzzing**. I'm not sure about **worst case impact**, but for now I can make a suggestion: worst case might be leading to **DoS**, but probably it's a rabbit hole. So if we dig deeper we might find something like CWE-200 or CWE-202 (Exposure of Sensitive Information to an Unauthorized Actor and so on). Also, I think that we should analyse thread usage in this case and make all operations thread-safe, but it's not my business of course. As a consequence, I do not suggest any patch (at least for now). +Steps to reproduce: +This command: + +`cat << EOF | ./build/qemu-system-x86_64 \`\ +`-display none -machine accel=qtest, -m 512M -machine q35 -nodefaults \`\ +`-device megasas -device scsi-cd,drive=null0 -blockdev \`\ +`driver=null-co,read-zeroes=on,node-name=null0 -qtest stdio`\ +`outl 0xcf8 0x80000818`\ +`outl 0xcfc 0xc000`\ +`outl 0xcf8 0x80000804`\ +`outw 0xcfc 0x05`\ +`write 0x20 0x1 0x03`\ +`write 0x26 0x1 0x08`\ +`write 0x27 0x1 0x01`\ +`write 0x30 0x1 0x02`\ +`write 0x40 0x1 0x08`\ +`write 0x57 0x1 0x01`\ +`write 0x5a 0x1 0x08`\ +`outl 0xc03d 0x20000000`\ +`outl 0xc03d 0x00`\ +`EOF`\ +\ +Results in:\ +\ +`[R +0.081916] outl 0xcf8 0x80000818`\ +`[S +0.081986] OK`\ +`OK`\ +`[R +0.082033] outl 0xcfc 0xc000`\ +`[S +0.082083] OK`\ +`OK`\ +`[R +0.082102] outl 0xcf8 0x80000804`\ +`[S +0.082117] OK`\ +`OK`\ +`[R +0.082133] outw 0xcfc 0x05`\ +`[S +0.082926] OK`\ +`OK`\ +`[R +0.082961] write 0x20 0x1 0x03`\ +`[S +0.083688] OK`\ +`OK`\ +`[R +0.083731] write 0x26 0x1 0x08`\ +`[S +0.083754] OK`\ +`OK`\ +`[R +0.083780] write 0x27 0x1 0x01`\ +`[S +0.083799] OK`\ +`OK`\ +`[R +0.083817] write 0x30 0x1 0x02`\ +`[S +0.083850] OK`\ +`OK`\ +`[R +0.083872] write 0x40 0x1 0x08`\ +`[S +0.083903] OK`\ +`OK`\ +`[R +0.083925] write 0x57 0x1 0x01`\ +`[S +0.083947] OK`\ +`OK`\ +`[R +0.083962] write 0x5a 0x1 0x08`\ +`[S +0.083985] OK`\ +`OK`\ +`[R +0.084000] outl 0xc03d 0x20000000`\ +`[S +0.085531] OK`\ +`OK`\ +`[R +0.085570] outl 0xc03d 0x00`\ +`[S +0.085673] OK`\ +`OK`\ +`qemu/include/exec/memory.h:1152:12: runtime error: member access within null pointer of type 'AddressSpace' (aka 'struct AddressSpace')`\ +`SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior qemu/include/exec/memory.h:1152:12 in` \ +`AddressSanitizer:DEADLYSIGNAL`\ +`=================================================================`\ +`==168244==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000020 (pc 0x56259b9829ac bp 0x000000000001 sp 0x7ffe62140220 T0)`\ +`==168244==The signal is caused by a READ memory access.`\ +`==168244==Hint: address points to the zero page.`\ + `#0 0x56259b9829ac in address_space_to_flatview qemu/include/exec/memory.h:1152:12`\ + `#1 0x56259b9829ac in address_space_write qemu/build/../system/physmem.c:2929:14`\ + `#2 0x56259b98665e in address_space_unmap qemu/build/../system/physmem.c:3272:9`\ + `#3 0x56259af31dce in dma_memory_unmap qemu/include/sysemu/dma.h:236:5`\ + `#4 0x56259af31dce in dma_blk_unmap qemu/build/../system/dma-helpers.c:93:9`\ + `#5 0x56259af2f220 in dma_complete qemu/build/../system/dma-helpers.c:105:5`\ + `#6 0x56259af2f220 in dma_blk_cb qemu/build/../system/dma-helpers.c:129:9`\ + `#7 0x56259bce7041 in blk_aio_complete qemu/build/../block/block-backend.c:1555:9`\ + `#8 0x56259c224495 in aio_bh_call qemu/build/../util/async.c:171:5`\ + `#9 0x56259c224ca6 in aio_bh_poll qemu/build/../util/async.c:218:13`\ + `#10 0x56259c1b9b89 in aio_dispatch qemu/build/../util/aio-posix.c:423:5`\ + `#11 0x56259c228f40 in aio_ctx_dispatch qemu/build/../util/async.c:360:5`\ + `#12 0x7f2b8c0a07a8 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x547a8) (BuildId: 9f90bd7bbfcf84a1f1c5a6102f70e6264837b9d4)`\ + `#13 0x56259c22a1ed in glib_pollfds_poll qemu/build/../util/main-loop.c:287:9`\ + `#14 0x56259c22a1ed in os_host_main_loop_wait qemu/build/../util/main-loop.c:310:5`\ + `#15 0x56259c22a1ed in main_loop_wait qemu/build/../util/main-loop.c:589:11`\ + `#16 0x56259af5159e in qemu_main_loop qemu/build/../system/runstate.c:796:9`\ + `#17 0x56259baefdb4 in qemu_default_main qemu/build/../system/main.c:37:14`\ + `#18 0x7f2b8aff7249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 82ce4e6e4ef08fa58a3535f7437bd3e592db5ac0)`\ + `#19 0x7f2b8aff7304 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x27304) (BuildId: 82ce4e6e4ef08fa58a3535f7437bd3e592db5ac0)`\ + `#20 0x562599f60b70 in _start (qemu/build/qemu-system-x86_64+0x20feb70) (BuildId: 48f1333e9a9d60383d8c9e0db5f690e7c26e1bb2)`\ +`AddressSanitizer can not provide additional info.`\ +`SUMMARY: AddressSanitizer: SEGV qemu/include/exec/memory.h:1152:12 in address_space_to_flatview`\ +`==168244==ABORTING` + +\ +But, if we manually put all of those qtest commands and wait for each command to complete, QEMU doesn't fail. It's because of possible race condition - while QEMU still mapping memory, we already starting to unmap it. It results in this crash. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2413 b/results/classifier/mode-deepseek-r1:32b/output/system/2413 new file mode 100644 index 00000000..0c56d3cb --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2413 @@ -0,0 +1,35 @@ + + +Use of TSTEQ/TSTNE has regressed the cdrom test when running a 32 bit build of qemu-system-x86_64 using TCG +Description of problem: +The test freezes, eventually timing out. The bisect was confused by other SEV related things so I had to whittle down the config to --disable-kvm. +Steps to reproduce: +1. '../../configure' '--disable-docs' '--disable-user' '--cross-prefix=i686-linux-gnu-' '--target-list=x86_64-softmmu' '--enable-debug' '--disable-kvm' +2. ninja +3. meson test -t 0.05 qtest-x86_64/cdrom-test V=1 +Additional information: +Bisect run pointed at: + +``` +commit 15957eb9efe2da67c796612cead95cba28ba9bda +Author: Paolo Bonzini <pbonzini@redhat.com> +Date: Fri Oct 27 05:57:31 2023 +0200 + + target/i386: use TSTEQ/TSTNE to test low bits + + When testing the sign bit or equality to zero of a partial register, it + is useful to use a single TSTEQ or TSTNE operation. It can also be used + to test the parity flag, using bit 0 of the population count. + + Do not do this for target_ulong-sized values however; the optimizer would + produce a comparison against zero anyway, and it avoids shifts by 64 + which are undefined behavior. + + Reviewed-by: Richard Henderson <richard.henderson@linaro.org> + Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> + + target/i386/tcg/translate.c | 28 ++++++++++++++++++++-------- + target/i386/tcg/emit.c.inc | 5 ++--- + 2 files changed, 22 insertions(+), 11 deletions(-) +bisect found first bad commit⏎ +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/242 b/results/classifier/mode-deepseek-r1:32b/output/system/242 new file mode 100644 index 00000000..964ac470 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/242 @@ -0,0 +1,3 @@ + + +Implementation of Virtual Battery for Battery Status diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2424 b/results/classifier/mode-deepseek-r1:32b/output/system/2424 new file mode 100644 index 00000000..5d0477a9 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2424 @@ -0,0 +1,320 @@ + + +Fatal error: futex robust_list not initialized by pthreads (Unknown syscall 386) +Description of problem: +Seems like steamcmd modified their binary with a function unimplemented by QEMU just recently. This was working perfectly until then. I did some strace debugging and came up with this error: `set_robust_list(0x40b7be2c,12) = -1 errno=38 (Function not implemented)`. I even tried doing `qemu-arm` over `box86` just to see if it'll work but still got that same error. However, using `box86` alone worked. + +I have my reasons of wanting to use `qemu-i386` over `box86` mainly due to it being compilable into an ARM64 binary unlike `box86` which is only an ARM binary. Performance doesn't really matter as it's only being used to download server files. Running QEMU was the only option working for people on M-series Macs to run steamcmd in a container reliably over Docker Desktop as those CPUs don't have 32-bit support. Even if I force them to use only `box86`, Mac's Docker Desktop runs QEMU over the image to emulate 32-bit support which causes the same error. +Steps to reproduce: +1. Install Docker +2. Run `docker run -it --pull=always sonroyaalmerol/steamcmd-arm64:root` +3. Inside the container shell, run `LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/home/steam/steamcmd/linux32 qemu-i386-static /home/steam/steamcmd/linux32/steamcmd +@sSteamCmdForcePlatformType linux +@sSteamCmdForcePlatformBitness 64 +force_install_dir "/palworld" +login anonymous +app_update 2394010 validate +quit` +Additional information: +I'm running all these inside a Docker container. I maintain a Docker image that is meant to be a base image for steamcmd-based dedicated servers (https://github.com/sonroyaalmerol/steamcmd-arm64). + +I tried both the `qemu-user-static` package from Debian repos (which I believe is v7.2) and building straight from the source (stable-9.0 tag) with no luck. + +strace from the command: +``` +25 brk(NULL) = 0x00a89000 +25 mmap2(NULL,8192,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS,-1,0) = 0x40839000 +25 access("/etc/ld.so.preload",R_OK) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"tls/i686/sse2/libdl.so.2",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"tls/i686/libdl.so.2",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"tls/sse2/libdl.so.2",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"tls/libdl.so.2",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"i686/sse2/libdl.so.2",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"i686/libdl.so.2",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"sse2/libdl.so.2",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"libdl.so.2",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"/home/steam/steamcmd/linux32/tls/i686/sse2/libdl.so.2",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 statx(AT_FDCWD,"/home/steam/steamcmd/linux32/tls/i686/sse2",AT_NO_AUTOMOUNT|AT_STATX_SYNC_AS_STAT,STATX_BASIC_STATS,0x407ffdb8) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"/home/steam/steamcmd/linux32/tls/i686/libdl.so.2",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 statx(AT_FDCWD,"/home/steam/steamcmd/linux32/tls/i686",AT_NO_AUTOMOUNT|AT_STATX_SYNC_AS_STAT,STATX_BASIC_STATS,0x407ffdb8) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"/home/steam/steamcmd/linux32/tls/sse2/libdl.so.2",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 statx(AT_FDCWD,"/home/steam/steamcmd/linux32/tls/sse2",AT_NO_AUTOMOUNT|AT_STATX_SYNC_AS_STAT,STATX_BASIC_STATS,0x407ffdb8) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"/home/steam/steamcmd/linux32/tls/libdl.so.2",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 statx(AT_FDCWD,"/home/steam/steamcmd/linux32/tls",AT_NO_AUTOMOUNT|AT_STATX_SYNC_AS_STAT,STATX_BASIC_STATS,0x407ffdb8) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"/home/steam/steamcmd/linux32/i686/sse2/libdl.so.2",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 statx(AT_FDCWD,"/home/steam/steamcmd/linux32/i686/sse2",AT_NO_AUTOMOUNT|AT_STATX_SYNC_AS_STAT,STATX_BASIC_STATS,0x407ffdb8) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"/home/steam/steamcmd/linux32/i686/libdl.so.2",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 statx(AT_FDCWD,"/home/steam/steamcmd/linux32/i686",AT_NO_AUTOMOUNT|AT_STATX_SYNC_AS_STAT,STATX_BASIC_STATS,0x407ffdb8) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"/home/steam/steamcmd/linux32/sse2/libdl.so.2",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 statx(AT_FDCWD,"/home/steam/steamcmd/linux32/sse2",AT_NO_AUTOMOUNT|AT_STATX_SYNC_AS_STAT,STATX_BASIC_STATS,0x407ffdb8) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"/home/steam/steamcmd/linux32/libdl.so.2",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 statx(AT_FDCWD,"/home/steam/steamcmd/linux32",AT_NO_AUTOMOUNT|AT_STATX_SYNC_AS_STAT,STATX_BASIC_STATS,0x407ffdb8) = 0 +25 openat(AT_FDCWD,"/etc/ld.so.cache",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3 +25 statx(3,"",AT_EMPTY_PATH|AT_NO_AUTOMOUNT|AT_STATX_SYNC_AS_STAT,STATX_BASIC_STATS,0x407ffe38) = 0 +25 mmap2(NULL,11734,PROT_READ,MAP_PRIVATE,3,0) = 0x4083b000 +25 close(3) = 0 +25 openat(AT_FDCWD,"/lib/i386-linux-gnu/libdl.so.2",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3 +25 read(3,0x408000a0,512) = 512 +25 statx(3,"",AT_EMPTY_PATH|AT_NO_AUTOMOUNT|AT_STATX_SYNC_AS_STAT,STATX_BASIC_STATS,0x407ffdd8) = 0 +25 mmap2(NULL,16392,PROT_READ,MAP_PRIVATE|MAP_DENYWRITE,3,0) = 0x4083e000 +25 mmap2(0x4083f000,4096,PROT_EXEC|PROT_READ,MAP_PRIVATE|MAP_DENYWRITE|MAP_FIXED,3,0x1) = 0x4083f000 +25 mmap2(0x40840000,4096,PROT_READ,MAP_PRIVATE|MAP_DENYWRITE|MAP_FIXED,3,0x2) = 0x40840000 +25 mmap2(0x40841000,8192,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_DENYWRITE|MAP_FIXED,3,0x2) = 0x40841000 +25 close(3) = 0 +25 openat(AT_FDCWD,"tls/i686/sse2/librt.so.1",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"tls/i686/librt.so.1",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"tls/sse2/librt.so.1",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"tls/librt.so.1",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"i686/sse2/librt.so.1",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"i686/librt.so.1",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"sse2/librt.so.1",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"librt.so.1",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"/home/steam/steamcmd/linux32/librt.so.1",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"/lib/i386-linux-gnu/librt.so.1",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3 +25 read(3,0x40800080,512) = 512 +25 statx(3,"",AT_EMPTY_PATH|AT_NO_AUTOMOUNT|AT_STATX_SYNC_AS_STAT,STATX_BASIC_STATS,0x407ffdb8) = 0 +25 mmap2(NULL,16400,PROT_READ,MAP_PRIVATE|MAP_DENYWRITE,3,0) = 0x40843000 +25 mmap2(0x40844000,4096,PROT_EXEC|PROT_READ,MAP_PRIVATE|MAP_DENYWRITE|MAP_FIXED,3,0x1) = 0x40844000 +25 mmap2(0x40845000,4096,PROT_READ,MAP_PRIVATE|MAP_DENYWRITE|MAP_FIXED,3,0x2) = 0x40845000 +25 mmap2(0x40846000,8192,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_DENYWRITE|MAP_FIXED,3,0x2) = 0x40846000 +25 close(3) = 0 +25 openat(AT_FDCWD,"tls/i686/sse2/libm.so.6",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"tls/i686/libm.so.6",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"tls/sse2/libm.so.6",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"tls/libm.so.6",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"i686/sse2/libm.so.6",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"i686/libm.so.6",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"sse2/libm.so.6",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"libm.so.6",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"/home/steam/steamcmd/linux32/libm.so.6",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"/lib/i386-linux-gnu/libm.so.6",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3 +25 read(3,0x40800060,512) = 512 +25 statx(3,"",AT_EMPTY_PATH|AT_NO_AUTOMOUNT|AT_STATX_SYNC_AS_STAT,STATX_BASIC_STATS,0x407ffd98) = 0 +25 mmap2(NULL,1065052,PROT_READ,MAP_PRIVATE|MAP_DENYWRITE,3,0) = 0x40848000 +25 mmap2(0x40855000,786432,PROT_EXEC|PROT_READ,MAP_PRIVATE|MAP_DENYWRITE|MAP_FIXED,3,0xd) = 0x40855000 +25 mmap2(0x40915000,221184,PROT_READ,MAP_PRIVATE|MAP_DENYWRITE|MAP_FIXED,3,0xcd) = 0x40915000 +25 mmap2(0x4094b000,8192,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_DENYWRITE|MAP_FIXED,3,0x103) = 0x4094b000 +25 close(3) = 0 +25 openat(AT_FDCWD,"tls/i686/sse2/libpthread.so.0",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"tls/i686/libpthread.so.0",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"tls/sse2/libpthread.so.0",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"tls/libpthread.so.0",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"i686/sse2/libpthread.so.0",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"i686/libpthread.so.0",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"sse2/libpthread.so.0",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"libpthread.so.0",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"/home/steam/steamcmd/linux32/libpthread.so.0",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"/lib/i386-linux-gnu/libpthread.so.0",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3 +25 read(3,0x40800040,512) = 512 +25 statx(3,"",AT_EMPTY_PATH|AT_NO_AUTOMOUNT|AT_STATX_SYNC_AS_STAT,STATX_BASIC_STATS,0x407ffd78) = 0 +25 mmap2(NULL,16392,PROT_READ,MAP_PRIVATE|MAP_DENYWRITE,3,0) = 0x4094d000 +25 mmap2(0x4094e000,4096,PROT_EXEC|PROT_READ,MAP_PRIVATE|MAP_DENYWRITE|MAP_FIXED,3,0x1) = 0x4094e000 +25 mmap2(0x4094f000,4096,PROT_READ,MAP_PRIVATE|MAP_DENYWRITE|MAP_FIXED,3,0x2) = 0x4094f000 +25 mmap2(0x40950000,8192,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_DENYWRITE|MAP_FIXED,3,0x2) = 0x40950000 +25 close(3) = 0 +25 openat(AT_FDCWD,"tls/i686/sse2/libc.so.6",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"tls/i686/libc.so.6",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"tls/sse2/libc.so.6",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"tls/libc.so.6",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"i686/sse2/libc.so.6",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"i686/libc.so.6",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"sse2/libc.so.6",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"libc.so.6",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"/home/steam/steamcmd/linux32/libc.so.6",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"/lib/i386-linux-gnu/libc.so.6",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3 +25 read(3,0x40800020,512) = 512 +25 statx(3,"",AT_EMPTY_PATH|AT_NO_AUTOMOUNT|AT_STATX_SYNC_AS_STAT,STATX_BASIC_STATS,0x407ffd58) = 0 +25 mmap2(NULL,2259228,PROT_READ,MAP_PRIVATE|MAP_DENYWRITE,3,0) = 0x40952000 +25 mmap2(0x40974000,1544192,PROT_EXEC|PROT_READ,MAP_PRIVATE|MAP_DENYWRITE|MAP_FIXED,3,0x22) = 0x40974000 +25 mmap2(0x40aed000,524288,PROT_READ,MAP_PRIVATE|MAP_DENYWRITE|MAP_FIXED,3,0x19b) = 0x40aed000 +25 mmap2(0x40b6d000,12288,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_DENYWRITE|MAP_FIXED,3,0x21b) = 0x40b6d000 +25 mmap2(0x40b70000,39196,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED,-1,0) = 0x40b70000 +25 close(3) = 0 +25 mmap2(NULL,8192,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS,-1,0) = 0x40b7a000 +25 mmap2(NULL,16384,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS,-1,0) = 0x40b7c000 +25 set_thread_area(0x408008b0) = 0 +25 set_tid_address(0x40b7be28) = 25 +25 set_robust_list(0x40b7be2c,12) = -1 errno=38 (Function not implemented) +25 Unknown syscall 386 +25 mprotect(0x40b6d000,8192,PROT_READ) = 0 +25 mprotect(0x40950000,4096,PROT_READ) = 0 +25 mprotect(0x4094b000,4096,PROT_READ) = 0 +25 mprotect(0x40846000,4096,PROT_READ) = 0 +25 mprotect(0x40841000,4096,PROT_READ) = 0 +25 mprotect(0x00a18000,143360,PROT_READ) = 0 +25 mprotect(0x40833000,8192,PROT_READ) = 0 +25 ugetrlimit(3,1082132628,1085730804,1,2097152,1082133208) = 0 +25 munmap(0x4083b000,11734) = 0 +25 getrandom(0x40b72b50,4,1) = 4 +25 brk(NULL) = 0x00a89000 +25 brk(0x00aaa000) = 0x00aaa000 +25 brk(0x00aab000) = 0x00aab000 +25 brk(0x00acc000) = 0x00acc000 +25 futex(0x00a867f0,FUTEX_PRIVATE_FLAG|FUTEX_WAKE,2147483647,NULL,0x40b6eff4,1085730804) = 0 +25 futex(0x00a867f8,FUTEX_PRIVATE_FLAG|FUTEX_WAKE,2147483647,NULL,0x40b6eff4,1085730804) = 0 +25 clock_gettime64(CLOCK_BOOTTIME,0x40800b6c) = 0 ({tv_sec=4668200,tv_nsec=47711961}) +25 gettid() = 25 +25 clock_gettime64(CLOCK_BOOTTIME,0x40800b5c) = 0 ({tv_sec=4668200,tv_nsec=48585844}) +25 getpid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 rt_sigprocmask(SIG_BLOCK,0x407fe9f0,NULL,8) = 0 +25 rt_sigaction(SIGPIPE,0x407fe804,0x407fe890) = 0 +25 ugetrlimit(7,1082125036,1085730804,10725408,13,1082133352) = 0 +25 prlimit64(0,RLIMIT_NOFILE,{rlim_cur=1048576,rlim_max=1048576},NULL) = 0 +25 openat(AT_FDCWD,"/usr/lib/locale/locale-archive",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3 +25 statx(3,"",AT_EMPTY_PATH|AT_NO_AUTOMOUNT|AT_STATX_SYNC_AS_STAT,STATX_BASIC_STATS,0x407fe5bc) = 0 +25 mmap2(NULL,2097152,PROT_READ,MAP_PRIVATE,3,0) = 0x40b80000 +25 mmap2(NULL,2596864,PROT_READ,MAP_PRIVATE,3,0x6f) = 0x40d80000 +25 close(3) = 0 +25 readlink("/proc/self/exe",0x00a8c450,4095) = 37 +25 readlink("/proc/self/exe",0x00a45060,4095) = 37 +25 chdir("/home/steam/steamcmd") = 0 +25 gettid() = 25 +25 clock_gettime64(CLOCK_BOOTTIME,0x407fe92c) = 0 ({tv_sec=4668200,tv_nsec=87889751}) +25 clock_gettime64(CLOCK_BOOTTIME,0x407fe92c) = 0 ({tv_sec=4668200,tv_nsec=89062235}) +25 clock_gettime64(CLOCK_REALTIME_COARSE,0x407fea1c) = 0 ({tv_sec=1720063413,tv_nsec=948892664}) +25 openat(AT_FDCWD,"/home/steam/steamcmd/steam.cfg",O_RDONLY|O_LARGEFILE) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"/home/steam/steamcmd/Steam.cfg",O_RDONLY|O_LARGEFILE) = -1 errno=2 (No such file or directory) +25 readlink("/root",0x407fb530,1023) = -1 errno=22 (Invalid argument) +25 readlink("/root/.steam",0x407fb530,1023) = -1 errno=2 (No such file or directory) +25 stat64("/root/.steam/steam",0x407fb8f0) = -1 errno=2 (No such file or directory) +25 mkdir("/root/Steam/logs",0777) = -1 errno=17 (File exists) +25 stat64("/root/Steam/logs/bootstrap_log.txt",0x407fd8f0) = 0 +25 lstat64("/root/Steam/logs",0x407fd850) = 0 +25 openat(AT_FDCWD,"/root/Steam/logs/bootstrap_log.txt",O_RDWR|O_LARGEFILE) = 3 +25 flock(3,5,10725408,2,10725408,1082120376) = 0 +25 fcntl64(3,F_SETFD,1) = 0 +25 _llseek(3,0,0,0x407fd8a0,SEEK_END) = 0 +25 write(3,0x9022f3,4) = 4 +25 clock_gettime64(CLOCK_REALTIME_COARSE,0x407fd90c) = 0 ({tv_sec=1720063413,tv_nsec=960892708}) +25 openat(AT_FDCWD,"/etc/localtime",O_RDONLY|O_CLOEXEC) = 4 +25 statx(4,"",AT_EMPTY_PATH|AT_NO_AUTOMOUNT|AT_STATX_SYNC_AS_STAT,STATX_BASIC_STATS,0x407fd65c) = 0 +25 statx(4,"",AT_EMPTY_PATH|AT_NO_AUTOMOUNT|AT_STATX_SYNC_AS_STAT,STATX_BASIC_STATS,0x407fd52c) = 0 +25 read(4,0xaa28b0,4096) = 114 +25 _llseek(4,4294967295,4294967236,0x407fd630,SEEK_CUR) = 0 +25 read(4,0xaa28b0,4096) = 60 +25 close(4) = 0 +25 write(3,0xa90d60,68) = 68 +25 clock_gettime64(CLOCK_REALTIME_COARSE,0x407fd90c) = 0 ({tv_sec=1720063413,tv_nsec=976892768}) +25 write(3,0xa922e0,276) = 276 +25 getcwd(0xaa28b0,4096) = 21 +25 stat64("/home/steam/steamcmd/package/beta",0x407fb8e0) = -1 errno=2 (No such file or directory) +25 openat(AT_FDCWD,"/home/steam/steamcmd/package/steam_cmd_linux.manifest",O_RDONLY|O_LARGEFILE) = 4 +25 flock(4,5,10725408,0,10725408,1082116024) = 0 +25 fcntl64(4,F_SETFD,1) = 0 +25 fstat64(4,0x407fc890) = 0 +25 read(4,0xab1e20,1838) = 1838 +25 close(4) = 0 +25 mmap2(NULL,266240,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS,-1,0) = 0x40ffa000 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 gettid() = 25 +25 munmap(0x40ffa000,266240) = 0 +25 openat(AT_FDCWD,"/home/steam/steamcmd/linux32/crashhandler.so",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 4 +25 read(4,0x407fc180,512) = 512 +25 statx(4,"",AT_EMPTY_PATH|AT_NO_AUTOMOUNT|AT_STATX_SYNC_AS_STAT,STATX_BASIC_STATS,0x407fbeb8) = 0 +25 mmap2(NULL,661476,PROT_READ,MAP_PRIVATE|MAP_DENYWRITE,4,0) = 0x40ffa000 +25 mmap2(0x41002000,442368,PROT_EXEC|PROT_READ,MAP_PRIVATE|MAP_DENYWRITE|MAP_FIXED,4,0x8) = 0x41002000 +25 mmap2(0x4106e000,147456,PROT_READ,MAP_PRIVATE|MAP_DENYWRITE|MAP_FIXED,4,0x74) = 0x4106e000 +25 mmap2(0x41092000,16384,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_DENYWRITE|MAP_FIXED,4,0x97) = 0x41092000 +25 mmap2(0x41096000,22500,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED,-1,0) = 0x41096000 +25 close(4) = 0 +25 mprotect(0x41092000,12288,PROT_READ) = 0 +25 clock_gettime64(CLOCK_REALTIME,0x407fc2ec) = 0 ({tv_sec=1720063414,tv_nsec=1788981}) +25 clock_gettime64(CLOCK_BOOTTIME,0x407fc31c) = 0 ({tv_sec=4668200,tv_nsec=139217662}) +25 gettid() = 25 +25 futex(0x41099f4c,FUTEX_PRIVATE_FLAG|FUTEX_WAKE,2147483647,NULL,0x40b6eff4,1085730804) = 0 +25 futex(0x41099f54,FUTEX_PRIVATE_FLAG|FUTEX_WAKE,2147483647,NULL,0x40b6eff4,1085730804) = 0 +25 clock_gettime64(CLOCK_BOOTTIME,0x407fc2ec) = 0 ({tv_sec=4668200,tv_nsec=147181452}) +25 getpid() = 25 +25 openat(AT_FDCWD,"/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq",O_RDONLY) = -1 errno=2 (No such file or directory) +25 clock_gettime64(CLOCK_REALTIME,0x407fc05c) = 0 ({tv_sec=1720063414,tv_nsec=15478752}) +25 clock_nanosleep(CLOCK_REALTIME,0,{tv_sec = 0,tv_nsec = 5000000},{tv_sec = 7,tv_nsec = 1593058279}) = 0 +25 clock_gettime64(CLOCK_REALTIME,0x407fc05c) = 0 ({tv_sec=1720063414,tv_nsec=21040173}) +25 clock_gettime64(CLOCK_REALTIME,0x407fc05c) = 0 ({tv_sec=1720063414,tv_nsec=21460575}) +25 clock_nanosleep(CLOCK_REALTIME,0,{tv_sec = 0,tv_nsec = 5000000},{tv_sec = 7,tv_nsec = 1593058279}) = 0 +25 clock_gettime64(CLOCK_REALTIME,0x407fc05c) = 0 ({tv_sec=1720063414,tv_nsec=26631394}) +25 openat(AT_FDCWD,"/proc/cpuinfo",O_RDONLY) = 4 +25 statx(4,"",AT_EMPTY_PATH|AT_NO_AUTOMOUNT|AT_STATX_SYNC_AS_STAT,STATX_BASIC_STATS,0x407fb8fc) = 0 +25 read(4,0xaa2ff0,1024) = 968 +25 read(4,0xaa2ff0,1024) = 0 +25 close(4) = 0 +25 gettid() = 25 +25 write(2,0x407fb120,57)Unable to determine CPU Frequency. Try defining CPU_MHZ. + = 57 +25 write(2,0x40b6fd47,1) + = 1 +25 statx(1,"",AT_EMPTY_PATH|AT_NO_AUTOMOUNT|AT_STATX_SYNC_AS_STAT,STATX_BASIC_STATS,0x407fa8fc) = 0 +25 write(1,0xaa2ff0,57)Unable to determine CPU Frequency. Try defining CPU_MHZ. + = 57 +25 openat(AT_FDCWD,"/proc/cpuinfo",O_RDONLY) = 4 +25 statx(4,"",AT_EMPTY_PATH|AT_NO_AUTOMOUNT|AT_STATX_SYNC_AS_STAT,STATX_BASIC_STATS,0x407fc1cc) = 0 +25 read(4,0xaa3400,1024) = 968 +25 read(4,0xaa3400,1024) = 0 +25 close(4) = 0 +25 write(1,0xaa2ff0,52)Redirecting stderr to '/root/Steam/logs/stderr.txt' + = 52 +25 openat(AT_FDCWD,"/root/Steam/logs/stderr.txt",O_WRONLY|O_CREAT|O_LARGEFILE|O_TRUNC,0666) = 4 +25 dup3(4,2,0)Logging directory: '/root/Steam/logs' +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2425 b/results/classifier/mode-deepseek-r1:32b/output/system/2425 new file mode 100644 index 00000000..3593cf81 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2425 @@ -0,0 +1,9 @@ + + +Add support for the 1366x768 resolution to the -vga std output +Additional information: +There is a Debian [issue](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=700055) about it back from 2013. The is also a 2024 thread [thread](https://lists.nongnu.org/archive/html/qemu-discuss/2024-07/msg00003.html) about it on the `qemu-user` mailing list. + +I failed to make it a feature reqeust by keeping the template text +`/label ~"kind::Feature Request"` +at the end of the message: *Gitlab* removes it automatically. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2426 b/results/classifier/mode-deepseek-r1:32b/output/system/2426 new file mode 100644 index 00000000..2a890371 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2426 @@ -0,0 +1,3 @@ + + +How to determine which cpu microarchitecture is suitable for use on Windows 11? diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2427 b/results/classifier/mode-deepseek-r1:32b/output/system/2427 new file mode 100644 index 00000000..b47031dd --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2427 @@ -0,0 +1,143 @@ + + +Heap-buffer-overflow in virtio-sound +Description of problem: +The following log reveals it: + +``` +==852995==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50400002f2f9 at pc 0x5b291f531ba9 bp 0x7ffd8e80c0a0 sp 0x7ffd8e80c098 +WRITE of size 2 at 0x50400002f2f9 thread T0 + #0 0x5b291f531ba8 in clip_natural_int16_t_from_stereo audio/mixeng_template.h:133:16 + #1 0x5b291f4ea707 in audio_pcm_sw_read audio/audio.c:604:5 + #2 0x5b291f4e9502 in AUD_read audio/audio.c:900:16 + #3 0x5b291e6db7c7 in virtio_snd_pcm_in_cb hw/audio/virtio-snd.c:1279:24 + #4 0x5b291f4f3017 in audio_run_in audio/audio.c:1331:21 + #5 0x5b291f4eda89 in audio_run audio/audio.c:1389:5 + #6 0x5b291fa34311 in alsa_poll_handler audio/alsaaudio.c:205:9 + #7 0x5b2921054bb3 in aio_dispatch_handler util/aio-posix.c:372:9 + #8 0x5b292104b9d5 in aio_dispatch_handlers util/aio-posix.c:414:20 + #9 0x5b292104b4b9 in aio_dispatch util/aio-posix.c:424:5 + #10 0x5b29210ede0e in aio_ctx_dispatch util/async.c:360:5 + #11 0x79b4f927fd3a in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x55d3a) (BuildId: 224ac2a88b72bc8e2fe8566ee28fae789fc69241) + #12 0x5b29210f1851 in glib_pollfds_poll util/main-loop.c:287:9 + #13 0x5b29210f007a in os_host_main_loop_wait util/main-loop.c:310:5 + #14 0x5b29210efc24 in main_loop_wait util/main-loop.c:589:11 + #15 0x5b291f5e5475 in qemu_main_loop system/runstate.c:795:9 + #16 0x5b292067eefb in qemu_default_main system/main.c:37:14 + #17 0x5b292067ef7d in main system/main.c:48:12 + #18 0x79b4f8829d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 + #19 0x79b4f8829e3f in __libc_start_main csu/../csu/libc-start.c:392:3 + #20 0x5b291e29bef4 in _start (/usr/local/bin/qemu-system-x86_64+0x1c8fef4) + +0x50400002f2f9 is located 1 bytes after 40-byte region [0x50400002f2d0,0x50400002f2f8) +allocated by thread T0 here: + #0 0x5b291e339758 in calloc /home/runner/work/llvm-project/llvm-project/final/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:77:3 + #1 0x79b4f9288c50 in g_malloc0 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5ec50) (BuildId: 224ac2a88b72bc8e2fe8566ee28fae789fc69241) + #2 0x5b29202d0efd in virtio_queue_notify hw/virtio/virtio.c:2297:9 + #3 0x5b291f3d242e in virtio_pci_notify_write hw/virtio/virtio-pci.c:1721:9 + #4 0x5b29203c82a4 in memory_region_write_accessor system/memory.c:497:5 + #5 0x5b29203c7951 in access_with_adjusted_size system/memory.c:573:18 + #6 0x5b29203c57eb in memory_region_dispatch_write system/memory.c:1521:16 + #7 0x5b292046cb42 in flatview_write_continue_step system/physmem.c:2757:18 + #8 0x5b292046c3c1 in flatview_write_continue system/physmem.c:2787:19 + #9 0x5b29204424c9 in flatview_write system/physmem.c:2818:12 + #10 0x5b2920441f1e in address_space_write system/physmem.c:2938:18 + #11 0x5b291f5d8eac in qtest_process_command system/qtest.c:643:9 + #12 0x5b291f5cfec5 in qtest_process_inbuf system/qtest.c:776:9 + #13 0x5b291f5de05e in qtest_read system/qtest.c:788:5 + #14 0x5b2920d2aef0 in qemu_chr_be_write_impl chardev/char.c:214:9 + #15 0x5b2920d2afb1 in qemu_chr_be_write chardev/char.c:226:9 + #16 0x5b2920d37388 in fd_chr_read chardev/char-fd.c:72:9 + #17 0x5b2920719767 in qio_channel_fd_source_dispatch io/channel-watch.c:84:12 + #18 0x79b4f927fc43 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x55c43) (BuildId: 224ac2a88b72bc8e2fe8566ee28fae789fc69241) + +SUMMARY: AddressSanitizer: heap-buffer-overflow audio/mixeng_template.h:133:16 in clip_natural_int16_t_from_stereo +Shadow bytes around the buggy address: + 0x50400002f000: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd + 0x50400002f080: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd + 0x50400002f100: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd + 0x50400002f180: fa fa 00 00 00 00 00 fa fa fa fd fd fd fd fd fd + 0x50400002f200: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd +=>0x50400002f280: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 00[fa] + 0x50400002f300: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd + 0x50400002f380: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd + 0x50400002f400: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd + 0x50400002f480: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd + 0x50400002f500: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +``` +Steps to reproduce: +``` +cat << EOF | qemu-system-x86_64 -display none \ +-machine accel=qtest, -m 512M -machine q35 -device \ +virtio-sound,audiodev=my_audiodev,streams=2 -audiodev \ +alsa,id=my_audiodev -qtest stdio +outl 0xcf8 0x80001804 +outw 0xcfc 0x7 +outl 0xcf8 0x80001820 +outl 0xcfc 0xe0008000 +write 0xe0008020 0x4 0x00001000 +write 0xe0008028 0x4 0x00101000 +write 0xe0008016 0x1 0x03 +write 0xe0008020 0x4 0x00901000 +write 0xe0008028 0x4 0x00a01000 +write 0xe0008016 0x1 0x00 +write 0xe000801c 0x1 0x01 +write 0xe0008016 0x1 0x03 +write 0xe000801c 0x1 0x01 +write 0x100008 0x1 0x08 +write 0x109008 0x1 0x04 +write 0x11e000 0x1 0x04 +write 0x11e001 0x1 0x01 +write 0x11e004 0x1 0x01 +write 0x100081 0x1 0xe0 +write 0x100082 0x1 0x11 +write 0x100088 0x1 0x08 +write 0x10100a 0x1 0x08 +write 0x151000 0x1 0x01 +write 0x1090c1 0x1 0x10 +write 0x1090c2 0x1 0x15 +write 0x1090c8 0x1 0x04 +write 0x10a00c 0x1 0x0c +write 0x10a002 0x1 0x05 +write 0xe000b00c 0x1 0x03 +write 0x101002 0x1 0x1d +write 0xe000b001 0x1 0x00 +outl 0xcfc 0xe0008000 +outl 0xcf8 0x80001885 +outl 0xcf8 0x80001870 +outl 0xcf8 0x80001878 +inl 0xcfc +outl 0xcf8 0x80001870 +outl 0xcf8 0x80001863 +outl 0xcf8 0x80001853 +inb 0xcfc +outl 0xcf8 0x80001854 +inb 0xcfc +inb 0xcfc +outl 0xcf8 0x80001898 +inb 0xcfc +outl 0xcf8 0x80001899 +outl 0xcf8 0x80001870 +inb 0xcfc +inb 0xcfc +EOF +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2438 b/results/classifier/mode-deepseek-r1:32b/output/system/2438 new file mode 100644 index 00000000..03cb9e08 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2438 @@ -0,0 +1,3 @@ + + +QEMU needs compat tweak to build against upstream capstone 6 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/244 b/results/classifier/mode-deepseek-r1:32b/output/system/244 new file mode 100644 index 00000000..af2061df --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/244 @@ -0,0 +1,3 @@ + + +MIPS MT dvpe does not regard VPEConf0.MVP diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2444 b/results/classifier/mode-deepseek-r1:32b/output/system/2444 new file mode 100644 index 00000000..1c698350 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2444 @@ -0,0 +1,3 @@ + + +Use of vulnerable function 'strcpy' at can_socketcan.c:213. This function is unsafe. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2449 b/results/classifier/mode-deepseek-r1:32b/output/system/2449 new file mode 100644 index 00000000..8255dbc1 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2449 @@ -0,0 +1,3 @@ + + +How to extract FIS (personal question) diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/245 b/results/classifier/mode-deepseek-r1:32b/output/system/245 new file mode 100644 index 00000000..33493b54 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/245 @@ -0,0 +1,3 @@ + + +watchpoints might not properly stop execution at the right address diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2451 b/results/classifier/mode-deepseek-r1:32b/output/system/2451 new file mode 100644 index 00000000..ec027f8b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2451 @@ -0,0 +1,3 @@ + + +Italian language (po) not updated diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2452 b/results/classifier/mode-deepseek-r1:32b/output/system/2452 new file mode 100644 index 00000000..22f422b3 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2452 @@ -0,0 +1,3 @@ + + +memory allocation for AMDVIIOTLBEntry in amdvi_update_iotlb() diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2453 b/results/classifier/mode-deepseek-r1:32b/output/system/2453 new file mode 100644 index 00000000..39d10d2d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2453 @@ -0,0 +1,11 @@ + + +qemu-system-rx aborts when trying to run the u-boot binary +Description of problem: +I tried to run the tests/avocado/machine_rx_gdbsim.py:RxGdbSimMachine.test_uboot test (which is not run by default since it is marked as flaky), but seems like QEMU now always aborts when trying to run with the u-boot bios. +Steps to reproduce: +1. wget https://acc.dl.osdn.jp/users/23/23888/u-boot.bin.gz +2. gunzip u-boot.bin.gz +3. qemu-system-rx -nographic -M gdbsim-r5f562n8 -bios u-boot.bin +Additional information: +Aborts with: ``qemu-system-rx: ../../devel/qemu/accel/tcg/translator.c:286: translator_ld: Assertion `((base ^ pc) & TARGET_PAGE_MASK) == 0' failed.`` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2456 b/results/classifier/mode-deepseek-r1:32b/output/system/2456 new file mode 100644 index 00000000..4eda21d7 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2456 @@ -0,0 +1,3 @@ + + +check-tcg multi-threaded tests fail on ppc64 on clang-user CI job diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/246 b/results/classifier/mode-deepseek-r1:32b/output/system/246 new file mode 100644 index 00000000..7f7bf1b4 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/246 @@ -0,0 +1,3 @@ + + +Build fails with 64 bits time_t diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2469 b/results/classifier/mode-deepseek-r1:32b/output/system/2469 new file mode 100644 index 00000000..a5f9ef83 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2469 @@ -0,0 +1,3 @@ + + +/s390x/migration/precopy/tcp/plain/switchover-ack may hang diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2471 b/results/classifier/mode-deepseek-r1:32b/output/system/2471 new file mode 100644 index 00000000..0b826829 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2471 @@ -0,0 +1,3 @@ + + +error handling in of_dpa_cmd_add_acl() diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2472 b/results/classifier/mode-deepseek-r1:32b/output/system/2472 new file mode 100644 index 00000000..b8f0005d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2472 @@ -0,0 +1,3 @@ + + +optimize nvme_directive_receive() function diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2473 b/results/classifier/mode-deepseek-r1:32b/output/system/2473 new file mode 100644 index 00000000..8e7e4394 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2473 @@ -0,0 +1,5 @@ + + +qemu-system-aarch64: Stop execution on unhandled exceptions +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2475 b/results/classifier/mode-deepseek-r1:32b/output/system/2475 new file mode 100644 index 00000000..bc3db9ab --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2475 @@ -0,0 +1,3 @@ + + +Inconsistency between cpu_tb_exec() and qemu_plugin_register_vcpu_tb_exec_cb()? diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2477 b/results/classifier/mode-deepseek-r1:32b/output/system/2477 new file mode 100644 index 00000000..8b4c410b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2477 @@ -0,0 +1,3 @@ + + +GDB_HAS_MTE detection is incomplete diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/248 b/results/classifier/mode-deepseek-r1:32b/output/system/248 new file mode 100644 index 00000000..5d1b43a0 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/248 @@ -0,0 +1,3 @@ + + +Reconnect failed with loopback virtio1.1 server mode test diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2481 b/results/classifier/mode-deepseek-r1:32b/output/system/2481 new file mode 100644 index 00000000..f57aa225 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2481 @@ -0,0 +1,3 @@ + + +Possible dereference of NULL diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2484 b/results/classifier/mode-deepseek-r1:32b/output/system/2484 new file mode 100644 index 00000000..11791b92 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2484 @@ -0,0 +1,3 @@ + + +Confusing query-gic-capabilities output in --without-default-devices config diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2488 b/results/classifier/mode-deepseek-r1:32b/output/system/2488 new file mode 100644 index 00000000..a341f546 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2488 @@ -0,0 +1,67 @@ + + +m68k: 68030 (?): fmove.p doesn't work (6888[1|2] emulation isn't implemented??) +Description of problem: +The following code should be executing a move to the fpu and then a move from it and then branching. + +``` + ff813590 f2 10 4f 00 fmove.p (A0),FP6 + ff813594 f2 11 6f 7f fmove.p FP6,(A1) {#0x7f} + ff813598 61 00 fe 52 bsr.w SUB_ff8133ec +``` + +However, hitting the instruction at `0xff813590` causes the `PC` to go off into the weeds and then the emulation gets stuck and never proceeds. + +Before executing the instruction the CPU state looks like this + +``` +(qemu) info registers + +CPU#0 +D0 = ffffffff A0 = ff813584 F0 = c004 cc00000000000000 ( -51) +D1 = 0000ffff A1 = 0000335e F1 = c00d a866000000000000 ( -21555) +D2 = 00000002 A2 = ff8138a2 F2 = 401b 91a2b3c000000000 ( 3.0542e+08) +D3 = 00000003 A3 = ff824008 F3 = 3fb4 ab3c4d0000000000 ( 3.54107e-23) +D4 = 00000004 A4 = ff81dbb6 F4 = 3d12 919a22ab33bc4000 (3.84141e-226) +D5 = 00000000 A5 = 00000400 F5 = 1020 8060708090a0b0c0 ( 0) +D6 = 0000000c A6 = 00003790 F6 = 7fff ffffffffffffffff ( nan) +D7 = 00000000 A7 = 0000316e F7 = 7fff ffffffffffffffff ( nan) +PC = ff813590 SR = 2708 T:0 I:7 SI -N--- +FPSR = 00000000 ---- + FPCR = 0000 X RN + A7(MSP) = 00000000 A7(USP) = 80000000 ->A7(ISP) = 00003796 +VBR = 0x0000338e +SFC = 3 DFC 0 +SSW 00000000 TCR 00000000 URP 00000000 SRP 00000000 +DTTR0/1: 00000000/00000000 ITTR0/1: 00000000/00000000 +MMUSR 00000000, fault at 00000000 +``` + +After single stepping: + +``` +(qemu) info registers + +CPU#0 +D0 = ffffffff A0 = ff813584 F0 = c004 cc00000000000000 ( -51) +D1 = 0000ffff A1 = 0000335e F1 = c00d a866000000000000 ( -21555) +D2 = 00000002 A2 = ff8138a2 F2 = 401b 91a2b3c000000000 ( 3.0542e+08) +D3 = 00000003 A3 = ff824008 F3 = 3fb4 ab3c4d0000000000 ( 3.54107e-23) +D4 = 00000004 A4 = ff81dbb6 F4 = 3d12 919a22ab33bc4000 (3.84141e-226) +D5 = 00000000 A5 = 00000400 F5 = 1020 8060708090a0b0c0 ( 0) +D6 = 0000000c A6 = 00003790 F6 = 7fff ffffffffffffffff ( nan) +D7 = 00000000 A7 = 00003166 F7 = 7fff ffffffffffffffff ( nan) +PC = ff8138a2 SR = 2708 T:0 I:7 SI -N--- +FPSR = 00000000 ---- + FPCR = 0000 X RN + A7(MSP) = 00000000 A7(USP) = 80000000 ->A7(ISP) = 0000316e +VBR = 0x0000338e +SFC = 3 DFC 0 +SSW 00000000 TCR 00000000 URP 00000000 SRP 00000000 +DTTR0/1: 00000000/00000000 ITTR0/1: 00000000/00000000 +MMUSR 00000000, fault at 00000000 +``` + +With this code the `VBR` doesn't point at an actual vector table from what I can tell and it is pointing at some memory that contains `0xff8138a2` so I guess it hits the instruction, the FPU isn't implemented so it tries to do an `F-line exception` instead but the vector table doesn't actually contain a handler and it's trying to execute garbage that causes the lock up. + +Basically, I guess I need to implement the 6888[1|2] for this code to work. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2489 b/results/classifier/mode-deepseek-r1:32b/output/system/2489 new file mode 100644 index 00000000..00a1aacc --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2489 @@ -0,0 +1,94 @@ + + +qemu-system-x86_64 TCG coredumps when using qemu_plugin_register_vcpu_mem_cb +Description of problem: +QEMU freezes, then exits with `Segmentation fault (core dumped)`. +Steps to reproduce: +1. Install Windows 7 SP1 into `disk.qcow2`. +2. Start the machine, and use `savevm snapshot` at the login screen, then exit. +3. `./qemu-system-x86_64 -m 1G -M q35 -drive file=disk.qcow2 -nic none -loadvm snapshot -plugin contrib/plugins/libexeclog.so` +Additional information: +QEMU runs normally without the plugin. + +This bug can also be reproduced with a simpler plugin just calling `qemu_plugin_register_vcpu_mem_cb` once per instruction: +[minimal_plugin.diff](/uploads/6e6c1af21df90379e726e693a53f7b8f/minimal_plugin.diff). + +Log using `-d op,in_asm,out_asm,plugin -D log`: [log.gz](/uploads/ccfd26c4845422d63f72a357f8fc1137/log.gz) + +GDB full backtrace: +``` +(gdb) bt f +#0 stw_he_p (v=0, ptr=0x2) at /REDACTED/qemu/include/qemu/bswap.h:265 +No locals. +#1 stw_le_p (v=0, ptr=0x2) at /REDACTED/qemu/include/qemu/bswap.h:319 +No locals. +#2 access_stw (ac=ac@entry=0x7f1652dfec70, addr=addr@entry=18446735827410705922, val=val@entry=0) at ../target/i386/tcg/access.c:143 + p = 0x2 +#3 0x000055dfca88534e in do_xsave_fpu (ac=ac@entry=0x7f1652dfec70, ptr=ptr@entry=18446735827410705920) at ../target/i386/tcg/fpu_helper.c:2537 + env = 0x55dff34fe630 + fpus = 0 + fptag = <optimized out> + i = <optimized out> + addr = <optimized out> +#4 0x000055dfca88caf8 in do_fxsave (ptr=18446735827410705920, ac=0x7f1652dfec70) at ../target/i386/tcg/fpu_helper.c:2632 + env = 0x55dff34fe630 + env = <optimized out> +#5 helper_fxsave (env=<optimized out>, ptr=18446735827410705920) at ../target/i386/tcg/fpu_helper.c:2656 + ra = <optimized out> + ac = {vaddr = 18446735827410705920, haddr1 = 0x0, haddr2 = 0x0, size = 512, size1 = 512, mmu_idx = 4, env = 0x55dff34fe630, + ra = 139732667533971} +#6 0x00007f160c030a93 in code_gen_buffer () +No locals. +#7 0x000055dfca979986 in cpu_tb_exec (cpu=cpu@entry=0x55dff34fbe70, itb=itb@entry=0x7f160c030940 <code_gen_buffer+198931>, + tb_exit=tb_exit@entry=0x7f1652dff228) at ../accel/tcg/cpu-exec.c:458 + ret = <optimized out> + last_tb = <optimized out> + tb_ptr = 0x7f160c030a00 <code_gen_buffer+199123> + __PRETTY_FUNCTION__ = "cpu_tb_exec" +#8 0x000055dfca979edd in cpu_loop_exec_tb (tb_exit=0x7f1652dff228, last_tb=<synthetic pointer>, pc=<optimized out>, + tb=0x7f160c030940 <code_gen_buffer+198931>, cpu=0x55dff34fbe70) at ../accel/tcg/cpu-exec.c:908 + insns_left = <optimized out> + __PRETTY_FUNCTION__ = "cpu_loop_exec_tb" + insns_left = <optimized out> + _a15 = <optimized out> + _b16 = <optimized out> +#9 cpu_exec_loop (cpu=cpu@entry=0x55dff34fbe70, sc=sc@entry=0x7f1652dff2c0) at ../accel/tcg/cpu-exec.c:1022 + tb = 0x7f160c030940 <code_gen_buffer+198931> + flags = <optimized out> + cflags = 4278321152 + pc = <optimized out> + cs_base = <optimized out> + last_tb = <optimized out> + tb_exit = 1 + ret = <optimized out> +#10 0x000055dfca97a6fd in cpu_exec_setjmp (cpu=cpu@entry=0x55dff34fbe70, sc=sc@entry=0x7f1652dff2c0) at ../accel/tcg/cpu-exec.c:1039 +No locals. +#11 0x000055dfca97ae79 in cpu_exec (cpu=cpu@entry=0x55dff34fbe70) at ../accel/tcg/cpu-exec.c:1065 + ret = <optimized out> + sc = {diff_clk = 0, last_cpu_icount = 0, realtime_clock = 0} + _rcu_read_auto = 0x1 +#12 0x000055dfca9a35af in tcg_cpu_exec (cpu=cpu@entry=0x55dff34fbe70) at ../accel/tcg/tcg-accel-ops.c:78 +--Type <RET> for more, q to quit, c to continue without paging--c + ret = <optimized out> + __PRETTY_FUNCTION__ = "tcg_cpu_exec" +#13 0x000055dfca9a3703 in mttcg_cpu_thread_fn (arg=arg@entry=0x55dff34fbe70) at ../accel/tcg/tcg-accel-ops-mttcg.c:95 + r = <optimized out> + force_rcu = {notifier = {notify = 0x55dfca9a37f0 <mttcg_force_rcu>, node = {le_next = 0x0, le_prev = 0x7f1652e00528}}, cpu = 0x55dff34fbe70} + cpu = 0x55dff34fbe70 + __PRETTY_FUNCTION__ = "mttcg_cpu_thread_fn" + __func__ = "mttcg_cpu_thread_fn" +#14 0x000055dfcab7e898 in qemu_thread_start (args=0x55dff355dd80) at ../util/qemu-thread-posix.c:541 + __cancel_buf = {__cancel_jmp_buf = {{__cancel_jmp_buf = {94420348558720, 3438567870158976394, -1656, 0, 140727865026624, 139734089805824, + 8803266606146106762, 3438582454403577226}, __mask_was_saved = 0}}, __pad = {0x7f1652dff430, 0x0, 0x0, 0x0}} + __cancel_routine = 0x55dfcab7e8f0 <qemu_thread_atexit_notify> + __cancel_arg = <optimized out> + __not_first_call = <optimized out> + qemu_thread_args = <optimized out> + start_routine = 0x55dfca9a3600 <mttcg_cpu_thread_fn> + arg = 0x55dff34fbe70 + r = <optimized out> +#15 0x00007f165e090272 in start_thread () from /nix/store/dbcw19dshdwnxdv5q2g6wldj6syyvq7l-glibc-2.39-52/lib/libc.so.6 +No symbol table info available. +#16 0x00007f165e10bdec in clone3 () from /nix/store/dbcw19dshdwnxdv5q2g6wldj6syyvq7l-glibc-2.39-52/lib/libc.so.6 +No symbol table info available. +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/249 b/results/classifier/mode-deepseek-r1:32b/output/system/249 new file mode 100644 index 00000000..7e28b1a8 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/249 @@ -0,0 +1,3 @@ + + +guest OS catches a page fault bug when running dotnet diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2497 b/results/classifier/mode-deepseek-r1:32b/output/system/2497 new file mode 100644 index 00000000..0bfbc312 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2497 @@ -0,0 +1,5 @@ + + +m68k: fpu: FPIAR register is not implemented +Description of problem: +QEMU doesn't currently implement the `FPIAR` register in the FPU which is fine in most cases but test code (like that in 147bug) that is testing if instructions like `fmove` are working correctly by writing to the register and reading it back don't get the value written when reading it back and detect a failure. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2500 b/results/classifier/mode-deepseek-r1:32b/output/system/2500 new file mode 100644 index 00000000..47383172 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2500 @@ -0,0 +1,6 @@ + + +m68k: mmu: 68030 mmu instructions are missing +Description of problem: +The 68030 has some mmu instructions like `pmove` that are only valid for the 68030 (and maybe the external mmu for the 68020??). +QEMU doesn't currently implement `pmove` and the encoding of `pmove` seems to be the same as an f-line instruction that should generate an f-line exception on everything except the 68030 so currently an f-line exception happens instead of the intended load/store to the mmu. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2502 b/results/classifier/mode-deepseek-r1:32b/output/system/2502 new file mode 100644 index 00000000..a4a25f13 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2502 @@ -0,0 +1,15 @@ + + +Old amd64 Ubuntu won't start +Description of problem: +While taking a trip down memory lane, I noticed that old Ubuntu amd64 live CDs won't boot in qemu-system-x86_64, while i386 ones work fine. I can confirm this for 6.06 and prior releases, while 8.04 and forward are OK (I don't have interim releases isos). +Steps to reproduce: +1. Launch qemu-system-x86_64 with Ubuntu 6.06.1 amd64 live CD +2. Press "Start or install Ubuntu" +3. PANIC: early exception rip (etc, please see screenshot below) +Additional information: + + +I tried a few versions of QEMU and I can tell you that everything worked fine in 7.0.0 and it first broke in 7.1.0. I don't have a more precise bisect, sorry. I also tried in Fedora 40 with QEMU 8.2.2 and I have the same issue, so I don't think it's distro related. + +On the other hand, on a completely different PC with an Intel Core i3-330M I have no issue at all, even with QEMU 8.2.3, so it might be AMD/Ryzen related. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2507 b/results/classifier/mode-deepseek-r1:32b/output/system/2507 new file mode 100644 index 00000000..32c46381 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2507 @@ -0,0 +1,15 @@ + + +m68k: fpu: frestore with NULL state should reset FPU state +Description of problem: +According to the PRM: + +``` +Floating-Point Status Register: Cleared if the state size is NULL; otherwise, not affected. +``` + +But this does not currently happen. +Steps to reproduce: +1. set a value in fpsr +2. do frestore with state size zero +3. read back fpsr and notice it isn't zero. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2511 b/results/classifier/mode-deepseek-r1:32b/output/system/2511 new file mode 100644 index 00000000..17ba3ca6 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2511 @@ -0,0 +1,34 @@ + + +Regression 9.1.0rc2: target/i386/tcg/access.c:18: access_prepare_mmu: Assertion '...' failed. +Description of problem: +Executing QEMU command line crashes with + ``` +qemu-system-x86_64: ../target/i386/tcg/access.c:18: access_prepare_mmu: Assertion `size > 0 && size <= TARGET_PAGE_SIZE' failed. + ``` +Steps to reproduce: +1. Download https://www.qemu-advent-calendar.org/2020/download/day07.tar.gz +2. Execute with QEMU command line +Additional information: +git bisect finishes with: + ``` +8b131065080af3cf2dda04e4e190c5a74fec2f31 is the first bad commit +commit 8b131065080af3cf2dda04e4e190c5a74fec2f31 +Author: Paolo Bonzini <pbonzini@redhat.com> +Date: Tue Jun 18 09:13:49 2024 +0200 + + target/i386/tcg: use X86Access for TSS access + + This takes care of probing the vaddr range in advance, and is also faster + because it avoids repeated TLB lookups. It also matches the Intel manual + better, as it says "Checks that the current (old) TSS, new TSS, and all + segment descriptors used in the task switch are paged into system memory"; + note however that it's not clear how the processor checks for segment + descriptors, and this check is not included in the AMD manual. + + Reviewed-by: Richard Henderson <richard.henderson@linaro.org> + Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> + + target/i386/tcg/seg_helper.c | 110 +++++++++++++++++++++++-------------------- + 1 file changed, 58 insertions(+), 52 deletions(-) + ``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2512 b/results/classifier/mode-deepseek-r1:32b/output/system/2512 new file mode 100644 index 00000000..e909c8a6 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2512 @@ -0,0 +1,47 @@ + + +macOS builds of target arm-softmmu broken +Description of problem: +Attempting to build for target `arm-softmmu` on macOS fails with errors: + +``` +[919/2786] Compiling C object libblock.a.p/block_file-posix.c.o +FAILED: libblock.a.p/block_file-posix.c.o +clang -Ilibblock.a.p -I. -I.. -Iqapi -Itrace -Iui -Iui/shader -Iblock -I/nix/store/vb7baj6dq2mvynfh6zmwxz57w83h7w0q-zlib-1.3.1-dev/include -I/nix/store/k1yzx1ykpwmhqvyr0j5fxvs9px7k92m7-glib-2.80.4-dev/include/glib-2.0 -I/nix/store/fm2kb8jvvc9s9nhi2gpr3jp6xxjxcvkq-glib-2.80.4/lib/glib-2.0/include -I/nix/store/k1yzx1ykpwmhqvyr0j5fxvs9px7k92m7-glib-2.80.4-dev/include -fcolor-diagnostics -Wall -Winvalid-pch -std=gnu11 -O2 -g -fstack-protector-strong -Wempty-body -Wendif-labels -Wexpansion-to-defined -Wformat-security -Wformat-y2k -Wignored-qualifiers -Winit-self -Wmissing-format-attribute -Wmissing-prototypes -Wnested-externs -Wold-style-definition -Wredundant-decls -Wstrict-prototypes -Wtype-limits -Wundef -Wvla -Wwrite-strings -Wno-gnu-variable-sized-type-not-at-end -Wno-initializer-overrides -Wno-missing-include-dirs -Wno-psabi -Wno-shift-negative-value -Wno-string-plus-int -Wno-tautological-type-limit-compare -Wno-typedef-redefinition -iquote . -iquote /Users/josh/workspace/qemu -iquote /Users/josh/workspace/qemu/include -iquote /Users/josh/workspace/qemu/host/include/aarch64 -iquote /Users/josh/workspace/qemu/host/include/generic -iquote /Users/josh/workspace/qemu/tcg/aarch64 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -fno-strict-aliasing -fno-common -fwrapv -fno-pie -ftrivial-auto-var-init=zero -fzero-call-used-regs=used-gpr -MD -MQ libblock.a.p/block_file-posix.c.o -MF libblock.a.p/block_file-posix.c.o.d -o libblock.a.p/block_file-posix.c.o -c ../block/file-posix.c +../block/file-posix.c:1501:19: error: variable has incomplete type 'struct statfs' + struct statfs buf; + ^ +../block/file-posix.c:1501:12: note: forward declaration of 'struct statfs' + struct statfs buf; + ^ +../block/file-posix.c:1503:10: error: call to undeclared function 'fstatfs'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] + if (!fstatfs(s->fd, &buf)) { + ^ +2 errors generated. +``` +Steps to reproduce: +1. nix-shell -p python3 ninja pkg-config glib +2. ./configure --target-list=arm-softmmu +3. make +Additional information: +The following patch fixes the issue (although I'm not sure whether this is the most appropriate fix): + +``` +diff --git a/block/file-posix.c b/block/file-posix.c +index ff928b5e85..6c78db3b0b 100644 +--- a/block/file-posix.c ++++ b/block/file-posix.c +@@ -44,10 +44,10 @@ + + #if defined(__APPLE__) && (__MACH__) + #include <sys/ioctl.h> +-#if defined(HAVE_HOST_BLOCK_DEVICE) +-#include <paths.h> + #include <sys/param.h> + #include <sys/mount.h> ++#if defined(HAVE_HOST_BLOCK_DEVICE) ++#include <paths.h> + #include <IOKit/IOKitLib.h> + #include <IOKit/IOBSD.h> + #include <IOKit/storage/IOMediaBSDClient.h> +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2515 b/results/classifier/mode-deepseek-r1:32b/output/system/2515 new file mode 100644 index 00000000..b1cdc51f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2515 @@ -0,0 +1,48 @@ + + +qemu -daemonize crashes on macOS with "NSPlaceholderDate initialize may have been in progress in another thread" +Description of problem: +Context: I build [an open source project](https://tsduck.io/) on several operating systems and architectures. For riscv64, s390x, ppc64, I build in emulated virtual machines. The three emulated OS work correctly when running qemu manually and the project is correctly built. + +Now, I want to automate the process in a script: for each target architecture, boot the VM (start qemu as a background process), connect to the VM using ssh, build the software, collect the binaries, shut down the VM. + +Starting the same qemu command as used interactively as a background process with `&` does not work and fails immediately, apparently because of the lack of stdin. So, I added option `-daemonize` (and removed `-nographic` because an error message says the two options are incompatible). + +Using `-daemonize` instead of `-nographic`, all qemu command immediately fail with the following error: + +``` +objc[1141]: +[__NSPlaceholderDate initialize] may have been in progress in another thread when fork() was called. +objc[1141]: +[__NSPlaceholderDate initialize] may have been in progress in another thread when fork() was called. We cannot safely call it or ignore it in the fork() child process. Crashing instead. Set a breakpoint on objc_initializeAfterForkError to debug. +``` +Steps to reproduce: +``` +$ qemu-system-riscv64 -machine virt -smp 8 -m 8192 -daemonize \ + -bios fw_jump.bin -kernel u-boot.bin \ + -device virtio-net-device,netdev=net \ + -netdev user,id=net,hostfwd=tcp::2233-:22 \ + -drive file=disk.qcow2,format=qcow2,if=virtio -device virtio-rng-pci +objc[1141]: +[__NSPlaceholderDate initialize] may have been in progress in another thread when fork() was called. +objc[1141]: +[__NSPlaceholderDate initialize] may have been in progress in another thread when fork() was called. We cannot safely call it or ignore it in the fork() child process. Crashing instead. Set a breakpoint on objc_initializeAfterForkError to debug. + + +$ qemu-system-s390x -machine s390-ccw-virtio -cpu max,zpci=on -smp 8 -m 8192 -daemonize \ + -drive file=disk.qcow2,format=qcow2,if=none,id=drive-virtio-disk0,cache=none \ + -device virtio-blk-ccw,devno=fe.0.0002,drive=drive-virtio-disk0,bootindex=1 \ + -nic user,hostfwd=tcp::2288-:22 +objc[1209]: +[__NSPlaceholderDate initialize] may have been in progress in another thread when fork() was called. +objc[1209]: +[__NSPlaceholderDate initialize] may have been in progress in another thread when fork() was called. We cannot safely call it or ignore it in the fork() child process. Crashing instead. Set a breakpoint on objc_initializeAfterForkError to debug. + + +$ qemu-system-ppc64 -smp 8 -m 8192 -daemonize \ + -drive file=disk.qcow2,format=qcow2 -nic user,hostfwd=tcp::2299-:22 +qemu-system-ppc64: warning: TCG doesn't support requested feature, cap-cfpc=workaround +qemu-system-ppc64: warning: TCG doesn't support requested feature, cap-sbbc=workaround +qemu-system-ppc64: warning: TCG doesn't support requested feature, cap-ibs=workaround +qemu-system-ppc64: warning: TCG doesn't support requested feature, cap-ccf-assist=on +objc[1166]: +[__NSPlaceholderDate initialize] may have been in progress in another thread when fork() was called. +objc[1166]: +[__NSPlaceholderDate initialize] may have been in progress in another thread when fork() was called. We cannot safely call it or ignore it in the fork() child process. Crashing instead. Set a breakpoint on objc_initializeAfterForkError to debug. +``` + +All the above commands work correctly when using `-nographic` instead of `-daemonize`. The virtual disks are the same as in the interactive runs, with a fully configured Linux OS (Ubuntu or Debian). +Additional information: +From a [report from here](https://stackoverflow.com/questions/63041445/python-os-high-sierra-nsplaceholderdate-error), I tried to define the environment variable `OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES` before running qemu. The `[__NSPlaceholderDate initialize]` errors disappear but qemu still crashes immediately. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2516 b/results/classifier/mode-deepseek-r1:32b/output/system/2516 new file mode 100644 index 00000000..b6ddd590 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2516 @@ -0,0 +1,3 @@ + + +Qemu 9.1 dropped support for Ubuntu 20.04 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2519 b/results/classifier/mode-deepseek-r1:32b/output/system/2519 new file mode 100644 index 00000000..8a7a3114 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2519 @@ -0,0 +1,3 @@ + + +make check TIMEOUT_MULTIPLIER variable is undocumented diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2524 b/results/classifier/mode-deepseek-r1:32b/output/system/2524 new file mode 100644 index 00000000..1f802e90 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2524 @@ -0,0 +1,5 @@ + + +Reverse debugging is broken on release and stable branches +Description of problem: +Master branch has commit 94962ff00d09674047aed896e87ba09736cd6941, which reverts incorrect commit and fix reverse debugging. But this commit is missing in 9.0.x 9.1.x releases branches and in stable branches too. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2526 b/results/classifier/mode-deepseek-r1:32b/output/system/2526 new file mode 100644 index 00000000..a56e3808 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2526 @@ -0,0 +1,41 @@ + + +qemu-system-aarch64: Build of system emulators with --static failed on aarch64 Ubuntu 22.04 for tests/unit/test-bitcnt +Description of problem: +Build Qemu got error: +``` +[1107/2870] Compiling C object tcg/libtcg_system.fa.p/perf.c.o +[1108/2870] Linking target tests/unit/test-bitcnt +FAILED: tests/unit/test-bitcnt +cc -o tests/unit/test-bitcnt tests/unit/test-bitcnt.p/test-bitcnt.c.o -Wl,--as-needed -Wl,--no-undefined -pie -Wl,--whole-archive libevent-loop-base.fa libqom.fa -Wl,--no-whole-archive -static-pie -fstack-protector-strong -Wl,-z,relro -Wl,-z,now -Wl,--start-group libqemuutil.a subprojects/libvhost-user/libvhost-user-glib.a subprojects/libvhost-user/libvhost-user.a libevent-loop-base.fa libqom.fa /usr/lib/aarch64-linux-gnu/libgio-2.0.a /usr/lib/aarch64-linux-gnu/libgmodule-2.0.a -pthread /usr/lib/aarch64-linux-gnu/libz.a -ldl /usr/lib/aarch64-linux-gnu/libblkid.a /usr/lib/aarch64-linux-gnu/libselinux.a /usr/lib/aarch64-linux-gnu/libsepol.a /usr/lib/aarch64-linux-gnu/libpcre2-8.a /usr/lib/aarch64-linux-gnu/libgobject-2.0.a /usr/lib/aarch64-linux-gnu/libffi.a /usr/lib/aarch64-linux-gnu/libglib-2.0.a -lm /usr/lib/aarch64-linux-gnu/libpcre.a -lmount -lmount -Wl,--end-group +/usr/bin/ld: cannot find -lmount: No such file or directory +/usr/bin/ld: cannot find -lmount: No such file or directory +collect2: error: ld returned 1 exit status +[1109/2870] Linking target tests/unit/test-qapi-util +FAILED: tests/unit/test-qapi-util +cc -o tests/unit/test-qapi-util tests/unit/test-qapi-util.p/test-qapi-util.c.o -Wl,--as-needed -Wl,--no-undefined -pie -Wl,--whole-archive libevent-loop-base.fa libqom.fa -Wl,--no-whole-archive -static-pie -fstack-protector-strong -Wl,-z,relro -Wl,-z,now -Wl,--start-group libqemuutil.a subprojects/libvhost-user/libvhost-user-glib.a subprojects/libvhost-user/libvhost-user.a libevent-loop-base.fa libqom.fa /usr/lib/aarch64-linux-gnu/libgio-2.0.a /usr/lib/aarch64-linux-gnu/libgmodule-2.0.a -pthread /usr/lib/aarch64-linux-gnu/libz.a -ldl /usr/lib/aarch64-linux-gnu/libblkid.a /usr/lib/aarch64-linux-gnu/libselinux.a /usr/lib/aarch64-linux-gnu/libsepol.a /usr/lib/aarch64-linux-gnu/libpcre2-8.a /usr/lib/aarch64-linux-gnu/libgobject-2.0.a /usr/lib/aarch64-linux-gnu/libffi.a /usr/lib/aarch64-linux-gnu/libglib-2.0.a -lm /usr/lib/aarch64-linux-gnu/libpcre.a -lmount -lmount -Wl,--end-group +/usr/bin/ld: cannot find -lmount: No such file or directory +/usr/bin/ld: cannot find -lmount: No such file or directory +collect2: error: ld returned 1 exit status +[1110/2870] Linking target tests/unit/check-qom-interface +FAILED: tests/unit/check-qom-interface +cc -o tests/unit/check-qom-interface tests/unit/check-qom-interface.p/check-qom-interface.c.o -Wl,--as-needed -Wl,--no-undefined -pie -Wl,--whole-archive libevent-loop-base.fa libqom.fa -Wl,--no-whole-archive -static-pie -fstack-protector-strong -Wl,-z,relro -Wl,-z,now -Wl,--start-group libqemuutil.a subprojects/libvhost-user/libvhost-user-glib.a subprojects/libvhost-user/libvhost-user.a libevent-loop-base.fa libqom.fa /usr/lib/aarch64-linux-gnu/libgio-2.0.a /usr/lib/aarch64-linux-gnu/libgmodule-2.0.a -pthread /usr/lib/aarch64-linux-gnu/libz.a -ldl /usr/lib/aarch64-linux-gnu/libblkid.a /usr/lib/aarch64-linux-gnu/libselinux.a /usr/lib/aarch64-linux-gnu/libsepol.a /usr/lib/aarch64-linux-gnu/libpcre2-8.a /usr/lib/aarch64-linux-gnu/libgobject-2.0.a /usr/lib/aarch64-linux-gnu/libffi.a /usr/lib/aarch64-linux-gnu/libglib-2.0.a -lm /usr/lib/aarch64-linux-gnu/libpcre.a -lmount -lmount -Wl,--end-group +/usr/bin/ld: cannot find -lmount: No such file or directory +/usr/bin/ld: cannot find -lmount: No such file or directory +collect2: error: ld returned 1 exit status +``` +After install libmount-dev, this error is still there. +If we just run: +``` +./configure --target-list=aarch64-softmmu --enable-kvm +make -16 +``` +This works well. +Steps to reproduce: +``` +1. ./configure --target-list=aarch64-softmmu --enable-kvm --disable-brlapi --disable-docs --disable-curses --disable-gtk --disable-opengl --disable-sdl --disable-spice --disable-vte --disable-vnc --disable-vnc-jpeg --disable-png --disable-vnc-sasl --disable-auth-pam --disable-glusterfs --disable-libiscsi --disable-libnfs --disable-libssh --disable-bzip2 --disable-lzo --disable-snappy --disable-slirp --disable-libusb --disable-usb-redir --static --disable-qom-cast-debug --disable-libudev --disable-curl --disable-rdma --disable-tools --enable-virtfs --disable-bsd-user --disable-linux-user --disable-sparse --disable-vde --disable-nettle --disable-xen --disable-linux-aio --disable-capstone --disable-virglrenderer --disable-replication --disable-smartcard --disable-guest-agent --disable-guest-agent-msi --disable-vvfat --disable-vdi --disable-qed --disable-qcow1 --disable-bochs --disable-cloop --disable-dmg --disable-parallels --disable-colo-proxy --disable-debug-graph-lock --disable-hexagon-idef-parser --disable-libdw --disable-pipewire --disable-pixman --disable-relocatable --disable-rutabaga-gfx --disable-vmdk --disable-avx512bw --disable-vpc --disable-vhdx --disable-hv-balloon + +2.make -j16 +``` +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2527 b/results/classifier/mode-deepseek-r1:32b/output/system/2527 new file mode 100644 index 00000000..da7f37a3 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2527 @@ -0,0 +1,3 @@ + + +bFLT parser doesn't select MMU-less CPU diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2533 b/results/classifier/mode-deepseek-r1:32b/output/system/2533 new file mode 100644 index 00000000..1ca36285 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2533 @@ -0,0 +1,3 @@ + + +Black screen while I'm trying to emulate Android using "-machine raspi4b" diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2535 b/results/classifier/mode-deepseek-r1:32b/output/system/2535 new file mode 100644 index 00000000..690f9d2b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2535 @@ -0,0 +1,3 @@ + + +Security patch of CVE-2024-4693 backport request diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2542 b/results/classifier/mode-deepseek-r1:32b/output/system/2542 new file mode 100644 index 00000000..70cf6ebd --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2542 @@ -0,0 +1,3 @@ + + +qemu-system-arm failure with picolibc tests since 59754f85ed35cbd5f4bf2663ca2136c78d5b2413 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2548 b/results/classifier/mode-deepseek-r1:32b/output/system/2548 new file mode 100644 index 00000000..c728102c --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2548 @@ -0,0 +1,408 @@ + + +Assert failure in `usb_ep_get` : Assertion `pid == USB_TOKEN_IN || pid == USB_TOKEN_OUT` failed. +Description of problem: +Assert failure in `usb_ep_get` : Assertion `pid == USB_TOKEN_IN || pid == USB_TOKEN_OUT` failed. + +The TD PID needs to be either `USB_TOKEN_IN` or `USB_TOKEN_OUT` in `usb_ep_get`, but in the caller `uhci_handle_td` it may be `USB_TOKEN_SETUP`. + +An unprivileged guest user may be able to reach the assertion, I think this bug is quite akin to CVE-2024-3567 (https://gitlab.com/qemu-project/qemu/-/issues/2273) : + +Users are not directly able to craft URBs, however as a user, one might be able to find a kernel path that would send a TD with PID `USB_TOKEN_SETUP` to QEMU (which is called `USB_PID_SETUP` in Linux). +For instance in the Linux Kernel, `uhci_submit_control` in `drivers/usb/host/uhci-q.c:789` does link a `USB_PID_SETUP` TD to the URB. +Steps to reproduce: +Minimized reproducer: + +``` +cat << EOF | ./qemu/build2/qemu-system-x86_64 -machine q35 -nodefaults \ +-device \ +ich9-usb-ehci1,bus=pcie.0,addr=1d.7,multifunction=on,id=ich9-ehci-1 \ +-device ich9-usb-uhci1,bus=pcie.0,addr=1d.0,multifunction=on,masterbus=i\ +ch9-ehci-1.0,firstport=0 -device ich9-usb-uhci2,bus=pcie.0,addr=1d.1,mul\ +tifunction=on,masterbus=ich9-ehci-1.0,firstport=2 -device ich9-usb-uhci3\ +,bus=pcie.0,addr=1d.2,multifunction=on,masterbus=ich9-ehci-1.0,firstport\ +=4 -drive if=none,id=usbcdrom,media=cdrom -device \ +usb-tablet,bus=ich9-ehci-1.0,port=1,usb_version=1 -device \ +usb-storage,bus=ich9-ehci-1.0,port=2,drive=usbcdrom -qtest stdio +outl 0xcf8 0x8000e900 +inw 0xcfc +outl 0xcf8 0x8000e920 +outl 0xcfc 0xffffffff +outl 0xcf8 0x8000e920 +inl 0xcfc +outl 0xcf8 0x8000e920 +outl 0xcfc 0xc001 +outl 0xcf8 0x8000e904 +inw 0xcfc +outl 0xcf8 0x8000e904 +outw 0xcfc 0x7 +outl 0xcf8 0x8000e904 +inw 0xcfc +outl 0xcf8 0x8000ef00 +inw 0xcfc +outl 0xcf8 0x8000ef10 +outl 0xcfc 0xffffffff +outl 0xcf8 0x8000ef10 +inl 0xcfc +outl 0xcf8 0x8000ef10 +outl 0xcfc 0xe0000000 +outl 0xcf8 0x8000ef04 +inw 0xcfc +outl 0xcf8 0x8000ef04 +outw 0xcfc 0x7 +outl 0xcf8 0x8000ef04 +inw 0xcfc +outl 0xcf8 0x8000ea00 +inw 0xcfc +outl 0xcf8 0x8000ea20 +outl 0xcfc 0xffffffff +outl 0xcf8 0x8000ea20 +inl 0xcfc +outl 0xcf8 0x8000ea20 +outl 0xcfc 0xc021 +outl 0xcf8 0x8000ea04 +inw 0xcfc +outl 0xcf8 0x8000ea04 +outw 0xcfc 0x7 +outl 0xcf8 0x8000ea04 +inw 0xcfc +outl 0xcf8 0x8000e800 +inw 0xcfc +outl 0xcf8 0x8000e820 +outl 0xcfc 0xffffffff +outl 0xcf8 0x8000e820 +inl 0xcfc +outl 0xcf8 0x8000e820 +outl 0xcfc 0xc041 +outl 0xcf8 0x8000e804 +inw 0xcfc +outl 0xcf8 0x8000e804 +outw 0xcfc 0x7 +outl 0xcf8 0x8000e804 +inw 0xcfc +outl 0xcf8 0x8000fa00 +inw 0xcfc +outl 0xcf8 0x8000fa20 +outl 0xcfc 0xffffffff +outl 0xcf8 0x8000fa20 +inl 0xcfc +outl 0xcf8 0x8000fa20 +outl 0xcfc 0xc061 +outl 0xcf8 0x8000fa24 +outl 0xcfc 0xffffffff +outl 0xcf8 0x8000fa24 +inl 0xcfc +outl 0xcf8 0x8000fa24 +outl 0xcfc 0xe0001000 +outl 0xcf8 0x8000fa04 +inw 0xcfc +outl 0xcf8 0x8000fa04 +outw 0xcfc 0x7 +outl 0xcf8 0x8000fa04 +inw 0xcfc +outl 0xcf8 0x8000ea20 +outl 0xcfc 0x625f69a0 +outb 0xc040 0x46 +outb 0xc040 0x69 +inb 0xc000 +outb 0xc040 0x46 +clock_step +outb 0xc040 0x69 +clock_step +write 0x0 0x4 0x64657669 +write 0x69766560 0x8 0x000000ff6c46f228 +write 0x69766568 0x8 0x2d323334319c6c65 +write 0xff000000 0x8 0x000000ff6c6f6766 +write 0xff000008 0x8 0x8d6c65652d736400 +outb 0xc040 0x69 +outl 0xcf8 0x8000ef76 +outw 0xcfc 0x6563 +outb 0xc040 0x46 +clock_step +outb 0xc040 0x69 +inb 0xc000 +clock_step +write 0x4 0x4 0x64657669 +write 0x69766560 0x8 0x000000ff6c46f228 +write 0x69766568 0x8 0x2d323334319c6c65 +write 0xff000000 0x8 0x000000ff6c6f6766 +write 0xff000008 0x8 0x8d6c65652d736400 +outb 0xc040 0x69 +outw 0xc003 0x6769 +outb 0xc040 0x69 +readq 0xe0000074 +outb 0xc040 0x46 +clock_step +outb 0xc040 0x69 +clock_step +write 0x8 0x4 0x00000100 +write 0x10000 0x10 0x000000ff6c46f2282d00363939333336 +write 0xff000000 0x8 0x6465766963656d69 +write 0xff000008 0x8 0x740d00699b652d63 +write 0x69766560 0x8 0x000000ff6c46f228 +write 0x69766568 0x8 0x2d323334319c6c65 +clock_step +write 0xc 0x4 0x000000ff +write 0xff000000 0x8 0x0000010000000069 +write 0xff000008 0x8 0x636c395f61707269 +write 0x10000 0x10 0x000000ff6c46f2282d00363939333336 +outw 0xc003 0x6f00 +outb 0xc040 0x69 +outl 0xc053 0x6378616d +clock_step +write 0x10 0x4 0x000000ff +write 0xff000000 0x8 0x6465766963656d69 +write 0xff000008 0x8 0x740d00699b652d63 +write 0x69766560 0x8 0x000000ff6c46f228 +write 0x69766568 0x8 0x2d323334319c6c65 +outb 0xc051 0x6d +outb 0xc04f 0x61 +outb 0xc040 0x69 +clock_step +write 0x14 0x4 0x000000ff +write 0xff000000 0x8 0x0000010000000069 +write 0xff000008 0x8 0x636c395f61707269 +write 0x10000 0x10 0x000000ff6c46f2282d00363939333336 +EOF +``` + +# Additional information +The crash report triggered by the reproducer is: + +``` +[R +0.033173] outl 0xcf8 0x8000e900 +[S +0.033189] [R +0.033195] inw 0xcfc +[S +0.033205] [R +0.033212] outl 0xcf8 0x8000e920 +[S +0.033218] [R +0.033222] outl 0xcfc 0xffffffff +[S +0.033231] [R +0.033235] outl 0xcf8 0x8000e920 +[S +0.033241] [R +0.033245] inl 0xcfc +[S +0.033250] [R +0.033255] outl 0xcf8 0x8000e920 +[S +0.033261] [R +0.033265] outl 0xcfc 0xc001 +[S +0.033271] [R +0.033275] outl 0xcf8 0x8000e904 +[S +0.033281] [R +0.033285] inw 0xcfc +[S +0.033290] [R +0.033295] outl 0xcf8 0x8000e904 +[S +0.033300] [R +0.033306] outw 0xcfc 0x7 +[S +0.033755] [R +0.033767] outl 0xcf8 0x8000e904 +[S +0.033774] [R +0.033779] inw 0xcfc +[S +0.033785] [R +0.033792] outl 0xcf8 0x8000ef00 +[S +0.033798] [R +0.033802] inw 0xcfc +[S +0.033808] [R +0.033813] outl 0xcf8 0x8000ef10 +[S +0.033818] [R +0.033840] outl 0xcfc 0xffffffff +[S +0.033848] [R +0.033853] outl 0xcf8 0x8000ef10 +[S +0.033859] [R +0.033864] inl 0xcfc +[S +0.033870] [R +0.033875] outl 0xcf8 0x8000ef10 +[S +0.033880] [R +0.033884] outl 0xcfc 0xe0000000 +[S +0.033891] [R +0.033895] outl 0xcf8 0x8000ef04 +[S +0.033901] [R +0.033904] inw 0xcfc +[S +0.033909] [R +0.033916] outl 0xcf8 0x8000ef04 +[S +0.033922] [R +0.033926] outw 0xcfc 0x7 +[S +0.034381] [R +0.034389] outl 0xcf8 0x8000ef04 +[S +0.034395] [R +0.034399] inw 0xcfc +[S +0.034405] [R +0.034412] outl 0xcf8 0x8000ea00 +[S +0.034417] [R +0.034421] inw 0xcfc +[S +0.034427] [R +0.034431] outl 0xcf8 0x8000ea20 +[S +0.034437] [R +0.034441] outl 0xcfc 0xffffffff +[S +0.034448] [R +0.034452] outl 0xcf8 0x8000ea20 +[S +0.034457] [R +0.034463] inl 0xcfc +[S +0.034469] [R +0.034474] outl 0xcf8 0x8000ea20 +[S +0.034480] [R +0.034484] outl 0xcfc 0xc021 +[S +0.034490] [R +0.034494] outl 0xcf8 0x8000ea04 +[S +0.034500] [R +0.034504] inw 0xcfc +[S +0.034509] [R +0.034515] outl 0xcf8 0x8000ea04 +[S +0.034521] [R +0.034525] outw 0xcfc 0x7 +[S +0.034948] [R +0.034955] outl 0xcf8 0x8000ea04 +[S +0.034961] [R +0.034965] inw 0xcfc +[S +0.034971] [R +0.034989] outl 0xcf8 0x8000e800 +[S +0.034996] [R +0.035000] inw 0xcfc +[S +0.035005] [R +0.035010] outl 0xcf8 0x8000e820 +[S +0.035016] [R +0.035020] outl 0xcfc 0xffffffff +[S +0.035027] [R +0.035033] outl 0xcf8 0x8000e820 +[S +0.035039] [R +0.035043] inl 0xcfc +[S +0.035048] [R +0.035053] outl 0xcf8 0x8000e820 +[S +0.035059] [R +0.035065] outl 0xcfc 0xc041 +[S +0.035071] [R +0.035075] outl 0xcf8 0x8000e804 +[S +0.035081] [R +0.035084] inw 0xcfc +[S +0.035089] [R +0.035094] outl 0xcf8 0x8000e804 +[S +0.035100] [R +0.035103] outw 0xcfc 0x7 +[S +0.035525] [R +0.035532] outl 0xcf8 0x8000e804 +[S +0.035538] [R +0.035542] inw 0xcfc +[S +0.035548] [R +0.035553] outl 0xcf8 0x8000fa00 +[S +0.035558] [R +0.035562] inw 0xcfc +[S +0.035567] [R +0.035572] outl 0xcf8 0x8000fa20 +[S +0.035578] [R +0.035581] outl 0xcfc 0xffffffff +[S +0.035589] [R +0.035594] outl 0xcf8 0x8000fa20 +[S +0.035600] [R +0.035604] inl 0xcfc +[S +0.035609] [R +0.035613] outl 0xcf8 0x8000fa20 +[S +0.035618] [R +0.035623] outl 0xcfc 0xc061 +[S +0.035629] [R +0.035633] outl 0xcf8 0x8000fa24 +[S +0.035638] [R +0.035642] outl 0xcfc 0xffffffff +[S +0.035648] [R +0.035652] outl 0xcf8 0x8000fa24 +[S +0.035658] [R +0.035664] inl 0xcfc +[S +0.035669] [R +0.035673] outl 0xcf8 0x8000fa24 +[S +0.035679] [R +0.035683] outl 0xcfc 0xe0001000 +[S +0.035689] [R +0.035696] outl 0xcf8 0x8000fa04 +[S +0.035702] [R +0.035706] inw 0xcfc +[S +0.035711] [R +0.035716] outl 0xcf8 0x8000fa04 +[S +0.035722] [R +0.035725] outw 0xcfc 0x7 +[S +0.036402] [R +0.036412] outl 0xcf8 0x8000fa04 +[S +0.036418] [R +0.036422] inw 0xcfc +[S +0.036434] [R +0.036442] outl 0xcf8 0x8000ea20 +[S +0.036448] [R +0.036463] outl 0xcfc 0x625f69a0 +[S +0.036906] [I +0.036981] CLOSED +x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] outb 0xc040 0x46 +x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] outb 0xc040 0x69 +x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] inb 0xc000 +x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] outb 0xc040 0x46 +x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] clock_step +x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] outb 0xc040 0x69 +x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] clock_step +[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] write 0x0 0x4 0x64657669 +[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] write 0x69766560 0x8 0x000000ff6c46f228 +[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] write 0x69766568 0x8 0x2d323334319c6c65 +[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] write 0xff000000 0x8 0x000000ff6c6f6766 +[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] write 0xff000008 0x8 0x8d6c65652d736400 +x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] outb 0xc040 0x69 +x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] outl 0xcf8 0x8000ef76 +x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] outw 0xcfc 0x6563 +x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] outb 0xc040 0x46 +x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] clock_step +x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] outb 0xc040 0x69 +x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] inb 0xc000 +x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] clock_step +[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] write 0x4 0x4 0x64657669 +[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] write 0x69766560 0x8 0x000000ff6c46f228 +[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] write 0x69766568 0x8 0x2d323334319c6c65 +[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] write 0xff000000 0x8 0x000000ff6c6f6766 +[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] write 0xff000008 0x8 0x8d6c65652d736400 +x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] outb 0xc040 0x69 +x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] outw 0xc003 0x6769 +x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] outb 0xc040 0x69 +x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] readq 0xe0000074 +x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] outb 0xc040 0x46 +x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] clock_step +x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] outb 0xc040 0x69 +x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] clock_step +[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] write 0x8 0x4 0x00000100 +[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] write 0x10000 0x10 0x000000ff6c46f2282d00363939333336 +[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] write 0xff000000 0x8 0x6465766963656d69 +[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] write 0xff000008 0x8 0x740d00699b652d63 +[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] write 0x69766560 0x8 0x000000ff6c46f228 +[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] write 0x69766568 0x8 0x2d323334319c6c65 +x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] clock_step +[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] write 0xc 0x4 0x000000ff +[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] write 0xff000000 0x8 0x0000010000000069 +[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] write 0xff000008 0x8 0x636c395f61707269 +[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] write 0x10000 0x10 0x000000ff6c46f2282d00363939333336 +x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] outw 0xc003 0x6f00 +x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] outb 0xc040 0x69 +x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] outl 0xc053 0x6378616d +x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] clock_step +[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] write 0x10 0x4 0x000000ff +[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] write 0xff000000 0x8 0x6465766963656d69 +[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] write 0xff000008 0x8 0x740d00699b652d63 +[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] write 0x69766560 0x8 0x000000ff6c46f228 +[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] write 0x69766568 0x8 0x2d323334319c6c65 +x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] outb 0xc051 0x6d +x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] outb 0xc04f 0x61 +x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] outb 0xc040 0x69 +x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] clock_step +[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] write 0x14 0x4 0x000000ff +[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] write 0xff000000 0x8 0x0000010000000069 +[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] write 0xff000008 0x8 0x636c395f61707269 +[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed +[R +0.000000] write 0x10000 0x10 0x000000ff6c46f2282d00363939333336 +qemu-fuzz-x86_64: ../hw/usb/core.c:744: struct USBEndpoint *usb_ep_get(USBDevice *, int, int): Assertion `pid == USB_TOKEN_IN || pid == USB_TOKEN_OUT' failed. +==892641== ERROR: libFuzzer: deadly signal + #0 0x557dd985fc41 in __sanitizer_print_stack_trace (/home/hypervisor/qemu_fuzz/qemu/build2/qemu-fuzz-x86_64+0x20b2c41) (BuildId: 1208fb4c12f2da2381e7763dabbbdabaf2db65e5) + #1 0x557dd97cfa58 in fuzzer::PrintStackTrace() (/home/hypervisor/qemu_fuzz/qemu/build2/qemu-fuzz-x86_64+0x2022a58) (BuildId: 1208fb4c12f2da2381e7763dabbbdabaf2db65e5) + #2 0x557dd97b5ae3 in fuzzer::Fuzzer::CrashCallback() (/home/hypervisor/qemu_fuzz/qemu/build2/qemu-fuzz-x86_64+0x2008ae3) (BuildId: 1208fb4c12f2da2381e7763dabbbdabaf2db65e5) + #3 0x7fd7e623c45f (/lib/x86_64-linux-gnu/libc.so.6+0x3c45f) (BuildId: d320ce4e63925d698610ed423fc4b1f0e8ed51f1) + #4 0x7fd7e629152a in __pthread_kill_implementation nptl/pthread_kill.c:43:17 + #5 0x7fd7e629152a in __pthread_kill_internal nptl/pthread_kill.c:78:10 + #6 0x7fd7e629152a in pthread_kill nptl/pthread_kill.c:89:10 + #7 0x7fd7e623c3b5 in raise signal/../sysdeps/posix/raise.c:26:13 + #8 0x7fd7e622287b in abort stdlib/abort.c:79:7 + #9 0x7fd7e622279a in __assert_fail_base assert/assert.c:92:3 + #10 0x7fd7e6233b65 in __assert_fail assert/assert.c:101:3 + #11 0x557dda3b67c6 in usb_ep_get /home/hypervisor/qemu_fuzz/qemu/build2/../hw/usb/core.c:744:5 + #12 0x557dda3d8820 in uhci_handle_td /home/hypervisor/qemu_fuzz/qemu/build2/../hw/usb/hcd-uhci.c:819:14 + #13 0x557dda3d41ed in uhci_process_frame /home/hypervisor/qemu_fuzz/qemu/build2/../hw/usb/hcd-uhci.c:1022:15 + #14 0x557dda3cbf7e in uhci_frame_timer /home/hypervisor/qemu_fuzz/qemu/build2/../hw/usb/hcd-uhci.c:1121:9 + #15 0x557ddb90c0ff in timerlist_run_timers /home/hypervisor/qemu_fuzz/qemu/build2/../util/qemu-timer.c:576:9 + #16 0x557ddb90d3e8 in qemu_clock_run_timers /home/hypervisor/qemu_fuzz/qemu/build2/../util/qemu-timer.c:590:12 + #17 0x557ddb90d3e8 in qemu_clock_advance_virtual_time /home/hypervisor/qemu_fuzz/qemu/build2/../util/qemu-timer.c:696:9 + #18 0x557dda67fa2f in qtest_process_command /home/hypervisor/qemu_fuzz/qemu/build2/../system/qtest.c:722:9 + #19 0x557dda67b3bb in qtest_process_inbuf /home/hypervisor/qemu_fuzz/qemu/build2/../system/qtest.c:776:9 + #20 0x557dda67acf6 in qtest_server_inproc_recv /home/hypervisor/qemu_fuzz/qemu/build2/../system/qtest.c:907:9 + #21 0x557ddb5fa3e2 in qtest_sendf /home/hypervisor/qemu_fuzz/qemu/build2/../tests/qtest/libqtest.c:640:5 + #22 0x557ddb5fa4f4 in qtest_clock_step_next /home/hypervisor/qemu_fuzz/qemu/build2/../tests/qtest/libqtest.c:1009:5 + #23 0x557ddb67c2ef in generic_fuzz /home/hypervisor/qemu_fuzz/qemu/build2/../tests/qtest/fuzz/generic_fuzz.c:667:13 + #24 0x557ddb66e807 in LLVMFuzzerTestOneInput /home/hypervisor/qemu_fuzz/qemu/build2/../tests/qtest/fuzz/fuzz.c:158:5 + #25 0x557dd97b6f52 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/hypervisor/qemu_fuzz/qemu/build2/qemu-fuzz-x86_64+0x2009f52) (BuildId: 1208fb4c12f2da2381e7763dabbbdabaf2db65e5) + #26 0x557dd97a1080 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/home/hypervisor/qemu_fuzz/qemu/build2/qemu-fuzz-x86_64+0x1ff4080) (BuildId: 1208fb4c12f2da2381e7763dabbbdabaf2db65e5) + #27 0x557dd97a6d07 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/hypervisor/qemu_fuzz/qemu/build2/qemu-fuzz-x86_64+0x1ff9d07) (BuildId: 1208fb4c12f2da2381e7763dabbbdabaf2db65e5) + #28 0x557dd97d0292 in main (/home/hypervisor/qemu_fuzz/qemu/build2/qemu-fuzz-x86_64+0x2023292) (BuildId: 1208fb4c12f2da2381e7763dabbbdabaf2db65e5) + #29 0x7fd7e6223a8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 + #30 0x7fd7e6223b48 in __libc_start_main csu/../csu/libc-start.c:360:3 + #31 0x557dd979b884 in _start (/home/hypervisor/qemu_fuzz/qemu/build2/qemu-fuzz-x86_64+0x1fee884) (BuildId: 1208fb4c12f2da2381e7763dabbbdabaf2db65e5) +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/255 b/results/classifier/mode-deepseek-r1:32b/output/system/255 new file mode 100644 index 00000000..ca8806c6 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/255 @@ -0,0 +1,3 @@ + + +Build on sparc64 fails with "undefined reference to `fdt_check_full'" diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2550 b/results/classifier/mode-deepseek-r1:32b/output/system/2550 new file mode 100644 index 00000000..a85aa09e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2550 @@ -0,0 +1,27 @@ + + +GICv3 vGIC system registers not initialized on ARM Cortex-A15 +Description of problem: +For Cortex-A15, the GICv3 vGIC registers are not initialized like for AArch64 CPUs, for example Cotex-A35, Cortex-A55, etc +Steps to reproduce: +The setup is not trivial. I can provide a boot image on request. But I hope the problem is straight-forward. +Additional information: +Suggested fix: +```diff +index 20c2737f17..136b513bda 100644 +--- a/target/arm/tcg/cpu32.c ++++ b/target/arm/tcg/cpu32.c +@@ -569,6 +569,12 @@ static void cortex_a15_initfn(Object *obj) + cpu->ccsidr[1] = 0x201fe00a; /* 32K L1 icache */ + cpu->ccsidr[2] = 0x711fe07a; /* 4096K L2 unified cache */ + cpu->isar.reset_pmcr_el0 = 0x410F3000; ++ ++ /* From B3.5 VGIC Type register */ ++ cpu->gic_num_lrs = 4; ++ cpu->gic_vpribits = 5; ++ cpu->gic_vprebits = 5; ++ + define_arm_cp_regs(cpu, cortexa15_cp_reginfo); + } + +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2554 b/results/classifier/mode-deepseek-r1:32b/output/system/2554 new file mode 100644 index 00000000..0800e055 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2554 @@ -0,0 +1,13 @@ + + +qemu-system-arm: thumb2: vector table branch instruction not followed +Description of problem: +When an undefined instruction is hit and causes an exception that causes a jump to the undef vector at 0x04; translation of the branch instruction found there appears to fail since instead of branching to the handler it steps to the next instruction - the next entry in the vector table, translates that, and on stepping once again moves to the next entry in the vector table. Eventually it steps out of the table and (re)enters the _start subroutine pointed to by vector 0x0. +Steps to reproduce: +This is related to issue #2542 in as much as I am hunting down failures in the picolibc 1.8.6 test suite on Debian. After fixing issues such as the failure to enable the MMU and some others via incorporating upstream commits I'm left with 10 tests, all for exception handling, that result in meson (build system) TIMEOUT instead of EXPECTEDFAIL. All of these tests should fail instantly and cause Qemu to exit but it continues - apparently spinning in an endless loop as described above until meson kills it. + +Creating a small reproducer has proved challenging and nigh impossible (for me) - even identifying the crux as described here has taken 4 days. However with the help of `qemu-system-arm -d in_asm,op,out_asm ...` and `gdb-multiarch` I believe I may have produced a focused report that will help figure this out. + +# +Additional information: +Since this is hard to debug I can give remote ssh access via `tmate` to directly control the debug session if necessary. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2557 b/results/classifier/mode-deepseek-r1:32b/output/system/2557 new file mode 100644 index 00000000..8b50e25d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2557 @@ -0,0 +1,3 @@ + + +balloon size startup parameter needed diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2564 b/results/classifier/mode-deepseek-r1:32b/output/system/2564 new file mode 100644 index 00000000..a7349fad --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2564 @@ -0,0 +1,3 @@ + + +ubuntu-22.04-s390x-all-system CI job often times out diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2567 b/results/classifier/mode-deepseek-r1:32b/output/system/2567 new file mode 100644 index 00000000..3600623c --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2567 @@ -0,0 +1,80 @@ + + +crash in target/i386/tcg/translate.c on loongarch64 Linux debian 6.11.0-rc7 +Description of problem: +``` + ERROR:target/i386/tcg/translate.c:748:gen_helper_out_func: code should not be reached + Bail out! ERROR:target/i386/tcg/translate.c:748:gen_helper_out_func: code should not be reached + 已中止（核心已转储） + ``` +Steps to reproduce: +1. windows x64 has been installed into win7_x64.qcow2 +2. windows x64 in win7_x64.qcow2 has been run for several times by the same command line +3. crash occurred when windows was starting up +Additional information: +``` +Hint: You are currently not seeing messages from other users and the system. + Users in groups 'adm', 'systemd-journal' can see all messages. + Pass -q to turn off this notice. + PID: 61627 (qemu-system-x86) + UID: 1000 (tsingkong) + GID: 1001 (tsingkong) + Signal: 6 (ABRT) + Timestamp: Tue 2024-09-10 15:59:05 CST (18h ago) + Command Line: qemu-system-x86_64 -name win7_x64 -hda /SATA/QEMU/win7_x64.qcow2 -boot c -cpu qemu64 -smp sockets=1,cores=4,threads=1 -m 8G -device VGA -netdev user,id=lan -device rtl8139,netdev=lan -usb -device usb-tablet -rtc base=localtime -monitor stdio + Executable: /usr/bin/qemu-system-x86_64 + Control Group: /user.slice/user-1000.slice/user@1000.service/app.slice/app-org.kde.konsole-353cf168c0a84fbe8cdc2b8b72cba71e.scope + Unit: user@1000.service + User Unit: app-org.kde.konsole-353cf168c0a84fbe8cdc2b8b72cba71e.scope + Slice: user-1000.slice + Owner UID: 1000 (tsingkong) + Boot ID: 49cf5288d7af4b97be341fe599f0c8df + Machine ID: 3ab0590011874c2e916d2eeef4585dfb + Hostname: debian + Storage: /var/lib/systemd/coredump/core.qemu-system-x86.1000.49cf5288d7af4b97be341fe599f0c8df.61627.1725955145000000.zst (present) + Size on Disk: 285.9M + Message: Process 61627 (qemu-system-x86) of user 1000 dumped core. + + Module libsystemd.so.0 from deb systemd-256.5-2.loong64 + Module libgcc_s.so.1 from deb gcc-14-14.2.0-4.loong64 + Module libstdc++.so.6 from deb gcc-14-14.2.0-4.loong64 + Module libblkid.so.1 from deb util-linux-2.40.2-8.loong64 + Module libatomic.so.1 from deb gcc-14-14.2.0-4.loong64 + Module libmount.so.1 from deb util-linux-2.40.2-8.loong64 + Module libzstd.so.1 from deb libzstd-1.5.6+dfsg-1.loong64 + Module libudev.so.1 from deb systemd-256.5-2.loong64 + Stack trace of thread 61637: + #0 0x00007ffff2536968 __pthread_kill_implementation (libc.so.6 + 0x76968) + #1 0x00007ffff24f17dc __GI_raise (libc.so.6 + 0x317dc) + #2 0x00007ffff24dd238 __GI_abort (libc.so.6 + 0x1d238) + #3 0x00007ffff2ccf704 g_assertion_message (libglib-2.0.so.0 + 0x93704) + #4 0x00007ffff2ccf768 g_assertion_message_expr (libglib-2.0.so.0 + 0x93768) + #5 0x000055555630c440 n/a (qemu-system-x86_64 + 0x830440) + #6 0x00005555563286e8 n/a (qemu-system-x86_64 + 0x84c6e8) + #7 0x000055555632ef0c n/a (qemu-system-x86_64 + 0x852f0c) + #8 0x00005555563f9108 translator_loop (qemu-system-x86_64 + 0x91d108) + #9 0x0000555556332474 gen_intermediate_code (qemu-system-x86_64 + 0x856474) + #10 0x00005555563f7c08 n/a (qemu-system-x86_64 + 0x91bc08) + #11 0x00005555563f8204 tb_gen_code (qemu-system-x86_64 + 0x91c204) + #12 0x00005555563ecd54 n/a (qemu-system-x86_64 + 0x910d54) + #13 0x00005555563ed288 n/a (qemu-system-x86_64 + 0x911288) + #14 0x00005555563edb98 cpu_exec (qemu-system-x86_64 + 0x911b98) + #15 0x00007fffdc006c5c tcg_cpu_exec (accel-tcg-x86_64.so + 0x2c5c) + #16 0x00007fffdc006df4 n/a (accel-tcg-x86_64.so + 0x2df4) + #17 0x0000555556636000 n/a (qemu-system-x86_64 + 0xb5a000) + #18 0x00007ffff2534ca4 start_thread (libc.so.6 + 0x74ca4) + #19 0x00007ffff259cbcc __thread_start3 (libc.so.6 + 0xdcbcc) + + Stack trace of thread 61640: + #0 0x00005555563fd620 n/a (qemu-system-x86_64 + 0x921620) + #1 0x0000555556401b44 get_page_addr_code_hostp (qemu-system-x86_64 + 0x925b44) + #2 0x00005555563ebda8 n/a (qemu-system-x86_64 + 0x90fda8) + #3 0x00005555563ed5f0 helper_lookup_tb_ptr (qemu-system-x86_64 + 0x9115f0) + #4 0x00007fff8d39309c n/a (n/a + 0x0) + ELF object binary architecture: LoongArch + +``` + +core.qemu-system-x86.1000.49cf5288d7af4b97be341fe599f0c8df.61627.1725955145000000.zst + +https://mega.nz/file/M9ZVzQYS#Z8kw6_cul56nd_p2iwz2SRb4Yb_1K8gqH2YlBBjKk6U diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2568 b/results/classifier/mode-deepseek-r1:32b/output/system/2568 new file mode 100644 index 00000000..659edc1f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2568 @@ -0,0 +1,3 @@ + + +[AARCH64] HPFAR_EL2.NS not set for non secure read in S-EL1 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/257 b/results/classifier/mode-deepseek-r1:32b/output/system/257 new file mode 100644 index 00000000..eb364215 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/257 @@ -0,0 +1,3 @@ + + +[Archlinux][git]With git revision e58c7a3b, packaging with meson install is broken. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2570 b/results/classifier/mode-deepseek-r1:32b/output/system/2570 new file mode 100644 index 00000000..77bc3877 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2570 @@ -0,0 +1,57 @@ + + +TCG Plugins: "Code should not be reached" error after resetting plugin from vcpu_tb_trans callback +Description of problem: +In a TCG plugin, using the `qemu_plugin_reset` method from within a `vcpu_tb_trans` callback produces the following error. If this isn't a supported use case, it should probably be described in the documentation. If this is supposed to work, it doesn't seem to. + +``` +** +ERROR:/home/user/git/qemu/tcg/i386/tcg-target.c.inc:3018:tcg_out_op: code should not be reached +Bail out! ERROR:/home/user/git/qemu/tcg/i386/tcg-target.c.inc:3018:tcg_out_op: code should not be reached +Aborted (core dumped) +``` +Steps to reproduce: +1. Build the current head of master (4b7ea33074450bc6148c8e1545d78f179e64adb4) with the below `min` plugin (i.e., add to contrib/plugins and update contrib/plugins/Makefile so it is built) +2. `../configure --enable-plugins --target-list=x86_64-softmmu --disable-docs` +3. `make && make plugins` +4. Get a qcow, e.g., the Ubuntu Bionic qcow from [here](https://panda.re/qcows/linux/ubuntu/1804/x86_64/bionic-server-cloudimg-amd64-noaslr-nokaslr.qcow2). +5. `./qemu-system-x86_64 -plugin contrib/plugins/libmin.so bionic-server-cloudimg-amd64-noaslr-nokaslr.qcow2 -nographic` + +The first three lines are output by the plugin as expected, the error after that and the abort are unexpected: +``` +Translating basic block +Reset request issued +Reset finished +** +ERROR:/home/user/git/qemu/tcg/i386/tcg-target.c.inc:3018:tcg_out_op: code should not be reached +Bail out! ERROR:/home/user/git/qemu/tcg/i386/tcg-target.c.inc:3018:tcg_out_op: code should not be reached +Aborted (core dumped) +``` +Additional information: +contrib/plugins/min.c +```c +#include <stdio.h> +#include <qemu-plugin.h> + +QEMU_PLUGIN_EXPORT int qemu_plugin_version = QEMU_PLUGIN_VERSION; + +qemu_plugin_id_t plugin_id = {0}; + +static void post_reset(qemu_plugin_id_t id) { + printf("Reset finished\n"); +} + +static void vcpu_tb_trans(qemu_plugin_id_t id, struct qemu_plugin_tb *tb) { + printf("Translating basic block\n"); + qemu_plugin_reset(plugin_id, post_reset); + printf("Reset request issued\n"); +} + +QEMU_PLUGIN_EXPORT int qemu_plugin_install(qemu_plugin_id_t id, + const qemu_info_t *info, int argc, char **argv) { + + qemu_plugin_register_vcpu_tb_trans_cb(id, vcpu_tb_trans); + plugin_id = id; + return 0; +} +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2578 b/results/classifier/mode-deepseek-r1:32b/output/system/2578 new file mode 100644 index 00000000..20ca44c4 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2578 @@ -0,0 +1,16 @@ + + +x86: exception during hardware interrupt pushes wrong error code +Description of problem: +Exceptions during IDT traversal push the wrong error code when triggered by a hardware interrupt. +The EXT bit in TCG mode is never set. However, it works fine in KVM mode as hardware is generating the number. +Steps to reproduce: +1. load a short IDT e.g. with 64 entries +2. trigger a self IPI through the LAPIC with a vector 100 +3. the pushed error code is 802 instead of 803. +Additional information: +It can be fixed in the lines `raise_exception_err(env, EXCP0D_GPF, intno * 8 + 2);` in `seg_helper.c` +which must include the `is_hw` field when calculating the error number. Something like `intno * 8 + 2 + (is_hw != 0)` +works here. + +Nevertheless, all the other exception cases in the `do_interrupt_*` functions have to set the same bit as well. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2579 b/results/classifier/mode-deepseek-r1:32b/output/system/2579 new file mode 100644 index 00000000..fb4e9d10 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2579 @@ -0,0 +1,3 @@ + + +Is there a plan to fix the vulnerabilities CVE-2023-1386 and CVE-2021-3735? diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/258 b/results/classifier/mode-deepseek-r1:32b/output/system/258 new file mode 100644 index 00000000..4776be05 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/258 @@ -0,0 +1,3 @@ + + +Add Illumnos VM image diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2581 b/results/classifier/mode-deepseek-r1:32b/output/system/2581 new file mode 100644 index 00000000..beb0e2d7 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2581 @@ -0,0 +1,14 @@ + + +Assert failure "target/i386/tcg/translate.c:748:gen_helper_out_func" when emulating Windows +Description of problem: +qemu crashes with: +``` +ERROR:../target/i386/tcg/translate.c:748:gen_helper_out_func: code should not be reached +``` +Steps to reproduce: +1. Run the command listed above +2. Wait a random amount of time (anywhere between 30mins to 2hours) +3. Qemu will crash at some point +Additional information: +- Relevant part of the macOS crash log: [qemu-crash.txt](/uploads/5cc296fd0e8c603ba08379749a67071d/qemu-crash.txt) diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2585 b/results/classifier/mode-deepseek-r1:32b/output/system/2585 new file mode 100644 index 00000000..7d2a37e1 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2585 @@ -0,0 +1,9 @@ + + +qemu-system-arm highmem support broken with TCG +Additional information: +I initially bisected this to commit 39a1fd25287f ("target/arm: Fix handling of LPAE block descriptors"), which introduced an identical bug by masking the wrong address bits due to a type mismatch, but this was in turn fixed by commit c2360eaa0262 ("target/arm: Fix qemu-system-arm handling of LPAE block descriptors for highmem"). The bug resurfaced between qemu-7.1.0 and qemu-7.2.0 after commit f3639a64f602 ("target/arm: Use softmmu tlbs for page table walking"), but may be caused by the preceding 4a35855682ce ("target/arm: Plumb debug into S1Translate") which fails to boot for an unrelated reason. + +I reproduced this on qemu-7.2 as shipped by Debian as well as on qemu-9.1 (built locally). + +Part of this problem appeared to be hidden by the 'highmem=on' argument not having the intended effect during parts of the bisection, which I worked around by overriding the 'pa_bits' variable in machvirt_init(). diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2588 b/results/classifier/mode-deepseek-r1:32b/output/system/2588 new file mode 100644 index 00000000..f44b3886 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2588 @@ -0,0 +1,45 @@ + + +qemu-system-arm regression: NonSecure World can change Secure World MMU mapping. +Description of problem: +A NonSecure execution context is able to override MMU L1 translation table +flags set by Secure context on Secure World memory. + +This is not consistent with the same code running on real hardware and it's a +regression over past qemu releases as 9.0.0 behaves correctly. +Steps to reproduce: +This has been tested with +[GoTEE-example](https://github.com/usbarmory/GoTEE-example) as follows: + +``` +# building tamago +wget https://github.com/usbarmory/tamago-go/archive/refs/tags/latest.zip +unzip latest.zip +cd tamago-go-latest/src && ./all.bash +cd ../bin && export TAMAGO=`pwd`/go + +# building and running GoTEE-example +wget https://github.com/usbarmory/GoTEE-example/archive/refs/heads/master.zip +unzip master.zip +cd GoTEE-example +export TARGET=usbarmory && make clean && make nonsecure_os_go && make trusted_applet_go && make trusted_os && make qemu +``` + +# +Additional information: +The issue relates to the fact that the NonSecure World, at startup, configures +the MMU with the NX bit for the entire address space not belonging to its +firmware .text area. + +On real hardware this MMU configuration by NonSecure world does not affect the +Secure World translation tables. + +On qemu 9.1.0, however it does and this is inconsistent with real hardware +behavior. On qemu 9.0.0 the behaviour is correct so the issue has been +introduced between these two releases. + +The switch between Secure and NonSecure is done +[here](https://github.com/usbarmory/GoTEE/blob/7e62563c0628fed3ee0aebb4702e22be9bb636e3/monitor/exec_arm.s#L73). + +The MMU first level address table which sets the NX bit is done +[here](https://github.com/usbarmory/tamago/blob/273d67cd811dfcb1782c0fe596ac14d43d0ce117/arm/mmu.go#L85). diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2591 b/results/classifier/mode-deepseek-r1:32b/output/system/2591 new file mode 100644 index 00000000..ab23ea91 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2591 @@ -0,0 +1,3 @@ + + +Black screen and DTB errors while trying to emulate the kernel of the RaspiOS (based on Debian Bookworm) using the parameter -machine raspi4b diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2597 b/results/classifier/mode-deepseek-r1:32b/output/system/2597 new file mode 100644 index 00000000..9c6a8c6a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2597 @@ -0,0 +1,3 @@ + + +qemu-i386 crashes on ppc64el diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2599 b/results/classifier/mode-deepseek-r1:32b/output/system/2599 new file mode 100644 index 00000000..5aa13b7d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2599 @@ -0,0 +1,3 @@ + + +[x86] RET imm16 not align with native machine diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2605 b/results/classifier/mode-deepseek-r1:32b/output/system/2605 new file mode 100644 index 00000000..2bf3029e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2605 @@ -0,0 +1,3 @@ + + +amd64/v4 support diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2607 b/results/classifier/mode-deepseek-r1:32b/output/system/2607 new file mode 100644 index 00000000..329ccacc --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2607 @@ -0,0 +1,69 @@ + + +msys2 build failed +Description of problem: + +Steps to reproduce: +1. Install MSYS2 and QEMU build dependencies +2. Update (pacman -Syu) +3. Build: +``` +./configure --enable-sdl --enable-fdt=system --disable-docs --target-list=arm-softmmu,aarch64-softmmu --enable-avx2 +make -j16 +``` +Additional information: +See: https://github.com/msys2/MINGW-packages/issues/22104#issuecomment-2393727818 + +output: +``` +FAILED: libcommon.a.p/net_tap-win32.c.obj +"cc" "-m64" "-Ilibcommon.a.p" "-ID:/a/_temp/msys64/mingw64/include/capstone" "-ID:/a/_temp/msys64/mingw64/include/p11-kit-1" "-ID:/a/_temp/msys64/mingw64/include/pixman-1" "-ID:/a/_temp/msys64/mingw64/include/libpng16" "-ID:/a/_temp/msys64/mingw64/include/spice-server" "-ID:/a/_temp/msys64/mingw64/include/spice-1" "-ID:/a/_temp/msys64/mingw64/include/cacard" "-ID:/a/_temp/msys64/mingw64/include/nss3" "-ID:/a/_temp/msys64/mingw64/include/nspr" "-ID:/a/_temp/msys64/mingw64/include/glib-2.0" "-ID:/a/_temp/msys64/mingw64/lib/glib-2.0/include" "-ID:/a/_temp/msys64/mingw64/include/libusb-1.0" "-ID:/a/_temp/msys64/mingw64/include/SDL2" "-ID:/a/_temp/msys64/mingw64/include/slirp" "-ID:/a/_temp/msys64/mingw64/include/ncursesw" "-ID:/a/_temp/msys64/mingw64/include/gtk-3.0" "-ID:/a/_temp/msys64/mingw64/include/pango-1.0" "-ID:/a/_temp/msys64/mingw64/include/harfbuzz" "-ID:/a/_temp/msys64/mingw64/include/cairo" "-ID:/a/_temp/msys64/mingw64/include/freetype2" "-ID:/a/_temp/msys64/mingw64/include/gdk-pixbuf-2.0" "-ID:/a/_temp/msys64/mingw64/include/webp" "-ID:/a/_temp/msys64/mingw64/include/atk-1.0" "-ID:/a/_temp/msys64/mingw64/include/fribidi" "-ID:/a/_temp/msys64/mingw64/include/rav1e" "-ID:/a/_temp/msys64/mingw64/include/svt-av1" "-fdiagnostics-color=auto" "-Wall" "-Winvalid-pch" "-Werror" "-std=gnu11" "-O2" "-g" "-fstack-protector-strong" "-Wempty-body" "-Wendif-labels" "-Wexpansion-to-defined" "-Wformat-security" "-Wformat-y2k" "-Wignored-qualifiers" "-Wimplicit-fallthrough=2" "-Winit-self" "-Wmissing-format-attribute" "-Wmissing-prototypes" "-Wnested-externs" "-Wold-style-declaration" "-Wold-style-definition" "-Wredundant-decls" "-Wshadow=local" "-Wstrict-prototypes" "-Wtype-limits" "-Wundef" "-Wvla" "-Wwrite-strings" "-Wno-missing-include-dirs" "-Wno-psabi" "-Wno-shift-negative-value" "-iquote" "." "-iquote" "D:/a/qemu/qemu" "-iquote" "D:/a/qemu/qemu/include" "-iquote" "D:/a/qemu/qemu/host/include/x86_64" "-iquote" "D:/a/qemu/qemu/host/include/generic" "-iquote" "D:/a/qemu/qemu/tcg/i386" "-msse2" "-mcx16" "-D_GNU_SOURCE" "-D_FILE_OFFSET_BITS=64" "-D_LARGEFILE_SOURCE" "-fno-strict-aliasing" "-fno-common" "-fwrapv" "-fno-pie" "-no-pie" "-ftrivial-auto-var-init=zero" "-fzero-call-used-regs=used-gpr" "-DHWY_SHARED_DEFINE" "-DAVIF_DLL" "-DEB_DLL" "-DLIBDEFLATE_DLL" "-DNCURSES_WIDECHAR" "-DNCURSES_WIDECHAR=1" "-Dmain=SDL_main" "-DSTRUCT_IOVEC_DEFINED" -MD -MQ libcommon.a.p/net_tap-win32.c.obj -MF "libcommon.a.p/net_tap-win32.c.obj.d" -o libcommon.a.p/net_tap-win32.c.obj "-c" ../net/tap-win32.c +../net/tap-win32.c: In function 'tap_win32_open': +../net/tap-win32.c:343:19: error: '%s' directive output may be truncated writing up to 255 bytes into a region of size 176 [-Werror=format-truncation=] + 343 | "%s\\%s\\Connection", + | ^~ + 344 | NETWORK_CONNECTIONS_KEY, enum_name); + | ~~~~~~~~~ +In function 'get_device_guid', + inlined from 'tap_win32_open' at ../net/tap-win32.c:616:10: +../net/tap-win32.c:341:9: note: 'snprintf' output between 92 and 347 bytes into a destination of size 256 + 341 | snprintf(connection_string, + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ + 342 | sizeof(connection_string), + | ~~~~~~~~~~~~~~~~~~~~~~~~~~ + 343 | "%s\\%s\\Connection", + | ~~~~~~~~~~~~~~~~~~~~~ + 344 | NETWORK_CONNECTIONS_KEY, enum_name); + | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +../net/tap-win32.c: In function 'tap_win32_open': +../net/tap-win32.c:242:58: error: '%s' directive output may be truncated writing up to 255 bytes into a region of size 178 [-Werror=format-truncation=] + 242 | snprintf (unit_string, sizeof(unit_string), "%s\\%s", + | ^~ + 243 | ADAPTER_KEY, enum_name); + | ~~~~~~~~~ +In function 'is_tap_win32_dev', + inlined from 'get_device_guid' at ../net/tap-win32.c:368:21, + inlined from 'tap_win32_open' at ../net/tap-win32.c:616:10: +../net/tap-win32.c:242:9: note: 'snprintf' output between 79 and 334 bytes into a destination of size 256 + 242 | snprintf (unit_string, sizeof(unit_string), "%s\\%s", + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + 243 | ADAPTER_KEY, enum_name); + | ~~~~~~~~~~~~~~~~~~~~~~~ +../net/tap-win32.c: In function 'tap_win32_open': +../net/tap-win32.c:620:52: error: '%s' directive output may be truncated writing up to 255 bytes into a region of size 245 [-Werror=format-truncation=] + 620 | snprintf (device_path, sizeof(device_path), "%s%s%s", + | ^~ + 621 | USERMODEDEVICEDIR, + 622 | device_guid, + | ~~~~~~~~~~~ +../net/tap-win32.c:620:5: note: 'snprintf' output between 16 and 271 bytes into a destination of size 256 + 620 | snprintf (device_path, sizeof(device_path), "%s%s%s", + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + 621 | USERMODEDEVICEDIR, + | ~~~~~~~~~~~~~~~~~~ + 622 | device_guid, + | ~~~~~~~~~~~~ + 623 | TAPSUFFIX); + | ~~~~~~~~~~ +cc1.exe: all warnings being treated as errors +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2610 b/results/classifier/mode-deepseek-r1:32b/output/system/2610 new file mode 100644 index 00000000..1e3d1192 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2610 @@ -0,0 +1,3 @@ + + +pl011: incorrect IBRD_MASK and FBRD_MASK diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2615 b/results/classifier/mode-deepseek-r1:32b/output/system/2615 new file mode 100644 index 00000000..7db0df4d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2615 @@ -0,0 +1,12 @@ + + +tpm_emulator: the qemu process will be blocked while receiving an unexpected ctrl command's response from the swtpm +Description of problem: +When the swtpm sends the unexpected ctrl command's repsonse to the qemu process, the qemu will be blocked. When we use the gdb to attach the qemu process, we will find out that the qemu process is blocked in `recv_msg` function. +Steps to reproduce: +1.The QEMU process sends a `CMD_GET_TPMESTABLISHED` control command to the swtpm. +2.If the swtpm is not currently active (`tpm_running` is false), it responds to the QEMU process with an err_not_running message, which has a fixed size of 4 bytes. +(Reference: https://github.com/stefanberger/swtpm/blob/master/src/swtpm/ctrlchannel.c#L938) +3. However, the QEMU process expects to receive a valid response (ptm_est est) of 8 bytes. Consequently, the QEMU process will be blocked in the recv_msg function if the response does not match the expected format. +Additional information: +After analysing the source codes in `tpm_emulator.c`, we found that qemu does not process the unexpected ctrol command response from the swtpm correctly (e.g. `CMD_GET_TPMESTABLISHED`). The qemu would be blocked in this function if it received unexpected response from the swtpm (https://gitlab.com/qemu-project/qemu/-/blob/3e9f48bcdabe57f8f90cf19f01bbbf3c86937267/backends/tpm/tpm_emulator.c#L140). diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2617 b/results/classifier/mode-deepseek-r1:32b/output/system/2617 new file mode 100644 index 00000000..ac9c335d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2617 @@ -0,0 +1,11 @@ + + +Go no +Description of problem: + +Steps to reproduce: +1. +2. +3. +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2618 b/results/classifier/mode-deepseek-r1:32b/output/system/2618 new file mode 100644 index 00000000..4349990a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2618 @@ -0,0 +1,3 @@ + + +INTEGER_OVERFLOW in sparc.c diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2627 b/results/classifier/mode-deepseek-r1:32b/output/system/2627 new file mode 100644 index 00000000..fa72a647 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2627 @@ -0,0 +1,3 @@ + + +Possible incorrect exception order in RISC-V diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2634 b/results/classifier/mode-deepseek-r1:32b/output/system/2634 new file mode 100644 index 00000000..9fdf8ea1 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2634 @@ -0,0 +1,179 @@ + + +Replay/record does not work with `rrsnapshot`/`loadvm` +Description of problem: +Qemu's record/replay feature does not properly work when using snapshots (like rrsnapshot). + +Record/replay without snapshotting works just fine, but when using `rrsnapshot=...` the replay is stuck at boot. `loadvm` monitor command also gets qemu stuck. + +Record command: + +``` +$ qemu-system-x86_64 \ + -cpu SandyBridge -smp 1 \ + -serial stdio -display none \ + -m 4096 \ + -drive file=./empty.qcow2,id=rr \ + -kernel ./boot/vmlinuz-lts \ + -initrd ./boot/initramfs-lts . + -monitor telnet::12345,server,nowait \ + -append "console=ttyS0 root=/dev/ram0 alpine_dev=cdrom:iso9660 modules=loop,squashfs,sd-mod,usb-storage quiet" \ + -icount shift=auto,rrfile=rr,rr=record,rrsnapshot=init +``` + +Broken replay command, which gets qemu stuck: + +``` +$ qemu-system-x86_64 \ + -cpu SandyBridge -smp 1 \ + -serial stdio -display none \ + -m 4096 \ + -drive file=./empty.qcow2,id=rr \ + -kernel ./boot/vmlinuz-lts \ + -initrd ./boot/initramfs-lts . + -monitor telnet::12345,server,nowait \ + -append "console=ttyS0 root=/dev/ram0 alpine_dev=cdrom:iso9660 modules=loop,squashfs,sd-mod,usb-storage quiet" \ + -icount shift=auto,rrfile=rr,rr=replay,rrsnapshot=init + +qemu-system-x86_64: warning: TCG doesn't support requested feature: CPUID.01H:ECX.tsc-deadline [bit 24] +``` + +Record/replay without `rrsnapshot`/`loadvm`/etc works as expected. +Steps to reproduce: +To reproduce i've used alpine linux kernel as the guest: + +``` +wget https://dl-cdn.alpinelinux.org/alpine/v3.20/releases/x86_64/alpine-standard-3.20.3-x86_64.iso +7z x alpine-standard-3.20.3-x86_64.iso +``` + +Prerequisites - an empty qcow2 file for snapshots: + +``` +qemu-img create -f qcow2 empty.qcow2 1G +``` + +Running an alpine linux kernel with `rr=record` - works just fine, kernel boots, accepts input. + +``` +$ qemu-system-x86_64 \ + -cpu SandyBridge -smp 1 \ + -serial stdio -display none \ + -m 4096 \ + -drive file=./empty.qcow2,id=rr \ + -kernel ./boot/vmlinuz-lts \ + -initrd ./boot/initramfs-lts . + -monitor telnet::12345,server,nowait \ + -append "console=ttyS0 root=/dev/ram0 alpine_dev=cdrom:iso9660 modules=loop,squashfs,sd-mod,usb-storage quiet" \ + -icount shift=auto,rrfile=rr,rr=record,rrsnapshot=init + +qemu-system-x86_64: warning: TCG doesn't support requested feature: CPUID.01H:ECX.tsc-deadline [bit 24] +mount: mounting /dev/ram0 on /sysroot failed: Invalid argument +Mounting root failed. +initramfs emergency recovery shell launched. Type 'exit' to continue boot +sh: can't access tty; job control turned off +~ # ls -alh +total 32K +drwx------ 18 root root 0 Oct 21 13:02 . +drwx------ 18 root root 0 Oct 21 13:02 .. +-rw------- 1 root root 8 Oct 21 13:02 .ash_history +drwxr-xr-x 2 root root 0 Jun 18 12:44 .modloop +drwxr-xr-x 2 root root 0 Oct 21 13:02 bin +drwxr-xr-x 9 root root 2.5K Oct 21 13:02 dev +drwxr-xr-x 4 root root 0 Oct 21 13:02 etc +-rwxr-xr-x 1 root root 25.9K Jun 18 12:44 init +drwxr-xr-x 5 root root 0 Jun 18 12:44 lib +drwxr-xr-x 5 root root 0 Jun 18 12:44 media +drwxr-xr-x 2 root root 0 Jun 18 12:44 newroot +dr-xr-xr-x 114 root root 0 Oct 21 13:02 proc +drwx------ 2 root root 0 Sep 4 12:53 root +drwxr-xr-x 3 root root 0 Oct 21 13:02 run +drwxr-xr-x 2 root root 0 Oct 21 13:02 sbin +dr-xr-xr-x 13 root root 0 Oct 21 13:02 sys +drwxr-xr-x 2 root root 0 Oct 21 13:02 sysroot +drwxr-xr-x 2 root root 0 Oct 21 13:02 tmp +drwxr-xr-x 5 root root 0 Oct 21 13:02 usr +drwxr-xr-x 3 root root 0 Jun 18 12:44 var +~ # echo "AAAAAAAA?" +AAAAAAAA? +~ # +``` + +`rr`-file is produced, which can be used for replaying **without** `rrsnapshot`-option: + +``` +$ qemu-system-x86_64 \ + -cpu SandyBridge -smp 1 \ + -serial stdio -display none \ + -m 4096 \ + -drive file=./empty.qcow2,id=rr \ + -kernel ./boot/vmlinuz-lts \ + -initrd ./boot/initramfs-lts . + -monitor telnet::12345,server,nowait \ + -append "console=ttyS0 root=/dev/ram0 alpine_dev=cdrom:iso9660 modules=loop,squashfs,sd-mod,usb-storage quiet" \ + -icount shift=auto,rrfile=rr,rr=replay + +qemu-system-x86_64: warning: TCG doesn't support requested feature: CPUID.01H:ECX.tsc-deadline [bit 24] +mount: mounting /dev/ram0 on /sysroot failed: Invalid argument +Mounting root failed. +initramfs emergency recovery shell launched. Type 'exit' to continue boot +sh: can't access tty; job control turned off +~ # ls -alh +total 32K +drwx------ 18 root root 0 Oct 21 13:02 . +drwx------ 18 root root 0 Oct 21 13:02 .. +-rw------- 1 root root 8 Oct 21 13:02 .ash_history +drwxr-xr-x 2 root root 0 Jun 18 12:44 .modloop +drwxr-xr-x 2 root root 0 Oct 21 13:02 bin +drwxr-xr-x 9 root root 2.5K Oct 21 13:02 dev +drwxr-xr-x 4 root root 0 Oct 21 13:02 etc +-rwxr-xr-x 1 root root 25.9K Jun 18 12:44 init +drwxr-xr-x 5 root root 0 Jun 18 12:44 lib +drwxr-xr-x 5 root root 0 Jun 18 12:44 media +drwxr-xr-x 2 root root 0 Jun 18 12:44 newroot +dr-xr-xr-x 114 root root 0 Oct 21 13:02 proc +drwx------ 2 root root 0 Sep 4 12:53 root +drwxr-xr-x 3 root root 0 Oct 21 13:02 run +drwxr-xr-x 2 root root 0 Oct 21 13:02 sbin +dr-xr-xr-x 13 root root 0 Oct 21 13:02 sys +drwxr-xr-x 2 root root 0 Oct 21 13:02 sysroot +drwxr-xr-x 2 root root 0 Oct 21 13:02 tmp +drwxr-xr-x 5 root root 0 Oct 21 13:02 usr +drwxr-xr-x 3 root root 0 Jun 18 12:44 var +~ # echo "AAAAAAAA?" +AAAAAAAA? +~ # +``` + +As you can see, replaying emulation session works as expected. How ever, if I add the `rrsnapshot`-option, it gets stuck: + +``` +$ qemu-system-x86_64 \ + -cpu SandyBridge -smp 1 \ + -serial stdio -display none \ + -m 4096 \ + -drive file=./empty.qcow2,id=rr \ + -kernel ./boot/vmlinuz-lts \ + -initrd ./boot/initramfs-lts . + -monitor telnet::12345,server,nowait \ + -append "console=ttyS0 root=/dev/ram0 alpine_dev=cdrom:iso9660 modules=loop,squashfs,sd-mod,usb-storage quiet" \ + -icount shift=auto,rrfile=rr,rr=replay,rrsnapshot=init + +qemu-system-x86_64: warning: TCG doesn't support requested feature: CPUID.01H:ECX.tsc-deadline [bit 24] +``` + +This also can be reproduced without `rrsnapshot` option, by issuing `loadvm init` from qemu monitor: + +``` +$ telnet localhost 12345 +qemu> loadvm init +... +``` + +Or, by using `gdb` and issuing reverse-commands that require `loadvm` to load previous state, like `reverse-stepi` or `reverse-continue`. + +Attaching a debugger & using debug-prints shows some thread being stuck in the [`rcu.c`](https://gitlab.com/qemu-project/qemu/-/blob/master/util/rcu.c), near the `qemu_event_wait(&rcu_call_ready_event);`. I've tried to wait for quite some time (about an hour) and there was no result. +Additional information: +**Qemu build.** Qemu binary built from sources of 9.1.0 with `--target-list=x86_64-softmmu`. + +**Host machine.** An almost clean Ubuntu 20.04 with necessary packages for building qemu from the latest release sources. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/264 b/results/classifier/mode-deepseek-r1:32b/output/system/264 new file mode 100644 index 00000000..11f8689b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/264 @@ -0,0 +1,3 @@ + + +qed leaked clusters diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/265 b/results/classifier/mode-deepseek-r1:32b/output/system/265 new file mode 100644 index 00000000..966086d3 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/265 @@ -0,0 +1,3 @@ + + +x86: retf or iret pagefault sets wrong error code diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2656 b/results/classifier/mode-deepseek-r1:32b/output/system/2656 new file mode 100644 index 00000000..3fdad42e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2656 @@ -0,0 +1,3 @@ + + +impossible to specify pauth-impdef=on when specifying multiple accelerators diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2659 b/results/classifier/mode-deepseek-r1:32b/output/system/2659 new file mode 100644 index 00000000..1cce12ed --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2659 @@ -0,0 +1,3 @@ + + +msys2-64bit test-aio intermittent CI failure with "test_timer_schedule: assertion failed: (aio_poll(ctx, true)) FAIL" diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/266 b/results/classifier/mode-deepseek-r1:32b/output/system/266 new file mode 100644 index 00000000..3ed3d25d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/266 @@ -0,0 +1,3 @@ + + +'mtfsf' instruction can clear FI incorrectly diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2660 b/results/classifier/mode-deepseek-r1:32b/output/system/2660 new file mode 100644 index 00000000..d8ebf73f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2660 @@ -0,0 +1,3 @@ + + +EDK2 subhook submodule missing diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2662 b/results/classifier/mode-deepseek-r1:32b/output/system/2662 new file mode 100644 index 00000000..51c1f3c6 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2662 @@ -0,0 +1,13 @@ + + +powerpc: MSR_ILE bit must not be restored in rfi +Description of problem: +On processors that implement the MSR_ILE bit (that is, G4 and prior), the MSR_ILE bit is not restored by the `rfi` instruction. + +qemu, however, does restore this bit from `srr1`. + +Some ppcel operating systems rely on MSR_ILE not being restored by `rfi`, for example, Windows NT when taking a syscall. +Additional information: +Patch provided: [rfi_msr_ile.patch](/uploads/aa661fc8bcbb47585ff63f8e4ebb38ba/rfi_msr_ile.patch) + +The correct behaviour for G4 and prior is performed for later processors too. Given PPC970 and later have that bit documented as reserved, this should not be a problem. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/267 b/results/classifier/mode-deepseek-r1:32b/output/system/267 new file mode 100644 index 00000000..b0df2026 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/267 @@ -0,0 +1,3 @@ + + +qemu-x86_64 segment prefixes error diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2672 b/results/classifier/mode-deepseek-r1:32b/output/system/2672 new file mode 100644 index 00000000..453b0ab8 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2672 @@ -0,0 +1,22 @@ + + +Skipping a jal instruction in riscv64 baremetal emulation +Description of problem: +The binary contains an illegal instruction after a jal. Normally the jal should be taken but the illegal instructi[aia_tests2.elf](/uploads/b8b646b01d7bcc15b51c36ddbffacac7/aia_tests2.elf)on next to the jal is executed generating and illegal instruction exception: + +``` +0x80006070: 00200513 addi a0,zero,2 +0x80006074: 89cff0ef jal ra,-3940 # 0x80005110 + +---------------- +IN: _Z15int_switch_modehh +0x80006078: 0000 illegal + +---------------- +IN: mtvec_table +0x8000e600: 64d0406f j 20044 # 0x8001344c +``` +Steps to reproduce: +1. Execute the same binary with QEMU. +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2673 b/results/classifier/mode-deepseek-r1:32b/output/system/2673 new file mode 100644 index 00000000..4a7c4b47 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2673 @@ -0,0 +1,7 @@ + + +qemu-system-riscv32 does not pass official riscv-tests +Description of problem: +I run riscv-tests using the above command and find qemu raises Illegalinstruction when `sret` in the machine mode.Therefore qemu cannot pass the rv32ui-v-and test. +Additional information: +The tests https://github.com/riscv-software-src/riscv-tests diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2677 b/results/classifier/mode-deepseek-r1:32b/output/system/2677 new file mode 100644 index 00000000..79fa314e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2677 @@ -0,0 +1,3 @@ + + +edit doc on building diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2679 b/results/classifier/mode-deepseek-r1:32b/output/system/2679 new file mode 100644 index 00000000..14c1f570 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2679 @@ -0,0 +1,3 @@ + + +TCX emulation missing 1152x900 mode diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2685 b/results/classifier/mode-deepseek-r1:32b/output/system/2685 new file mode 100644 index 00000000..720110ea --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2685 @@ -0,0 +1,3 @@ + + +Netbsd 10.0 AMD64 as host fails in tcg? diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2689 b/results/classifier/mode-deepseek-r1:32b/output/system/2689 new file mode 100644 index 00000000..d9ba4fbb --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2689 @@ -0,0 +1,3 @@ + + +arm64be tuxrun test is sometimes failing with I/O errors diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2697 b/results/classifier/mode-deepseek-r1:32b/output/system/2697 new file mode 100644 index 00000000..d8c76d7f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2697 @@ -0,0 +1,3 @@ + + +system/physmem: gdb memory rw no access on armv7m MPU diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2698 b/results/classifier/mode-deepseek-r1:32b/output/system/2698 new file mode 100644 index 00000000..a3d17983 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2698 @@ -0,0 +1,11 @@ + + +virtualization not working with TCG mode on macOS +Description of problem: +TCG is supposed to work with virtualization=on option but it stops without priting anything. +if I set it to off, I can get to the prompt. +Steps to reproduce: +1. Execute the qemu +2. Hung. +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2700 b/results/classifier/mode-deepseek-r1:32b/output/system/2700 new file mode 100644 index 00000000..42e6b941 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2700 @@ -0,0 +1,10 @@ + + +Windows 11 24H2 (x64) fails to boot +Description of problem: +When trying to boot Windows 11 24H2 (including the installer), the guest will just restart. +Steps to reproduce: +1. Download Windows 11 ISO from: https://www.microsoft.com/en-us/software-download/windows11 +2. Run the command above +Additional information: +I tested it on an M4 Pro Mac running TCG. Other users have reported the same issue with M3 running TCG and Intel i9 running HVF. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2702 b/results/classifier/mode-deepseek-r1:32b/output/system/2702 new file mode 100644 index 00000000..c864f4e6 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2702 @@ -0,0 +1,55 @@ + + +qtest-arm/sse-timer-test sometimes fails on s390x host +Description of problem: +The sse-timer-test sometimes fails on the s390x runner in Travis, see: + +https://app.travis-ci.com/github/huth/qemu/jobs/628508770#L6337 : + +``` +>>> G_TEST_DBUS_DAEMON=/home/travis/build/huth/qemu/tests/dbus-vmstate-daemon.sh MSAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1:print_stacktrace=1 MESON_TEST_ITERATION=1 UBSAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1:print_stacktrace=1 ASAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1 PYTHON=/home/travis/build/huth/qemu/build/pyvenv/bin/python3 MALLOC_PERTURB_=165 QTEST_QEMU_BINARY=./qemu-system-arm /home/travis/build/huth/qemu/build/tests/qtest/sse-timer-test --tap -k + +▶ 70/287 ERROR:../tests/qtest/sse-timer-test.c:91:test_counter: assertion failed (readl(COUNTER_BASE + CNTCV_LO) == 100): (0 == 100) ERROR + + 70/287 qemu:qtest+qtest-arm / qtest-arm/sse-timer-test ERROR 0.71s killed by signal 6 SIGABRT + +――――――――――――――――――――――――――――――――――――― ✀ ――――――――――――――――――――――――――――――――――――― + +stderr: + +** + +ERROR:../tests/qtest/sse-timer-test.c:91:test_counter: assertion failed (readl(COUNTER_BASE + CNTCV_LO) == 100): (0 == 100) + +(test program exited with status code -6) + +―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――― +``` + +https://app.travis-ci.com/github/huth/qemu/jobs/628373181#L6336 : + +``` +>>> G_TEST_DBUS_DAEMON=/home/travis/build/huth/qemu/tests/dbus-vmstate-daemon.sh PYTHON=/home/travis/build/huth/qemu/build/pyvenv/bin/python3 UBSAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1:print_stacktrace=1 ASAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1 MSAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1:print_stacktrace=1 QTEST_QEMU_BINARY=./qemu-system-arm MALLOC_PERTURB_=250 MESON_TEST_ITERATION=1 /home/travis/build/huth/qemu/build/tests/qtest/sse-timer-test --tap -k + +▶ 70/287 ERROR:../tests/qtest/sse-timer-test.c:91:test_counter: assertion failed (readl(COUNTER_BASE + CNTCV_LO) == 100): (0 == 100) ERROR + + 70/287 qemu:qtest+qtest-arm / qtest-arm/sse-timer-test ERROR 0.95s killed by signal 6 SIGABRT + +――――――――――――――――――――――――――――――――――――― ✀ ――――――――――――――――――――――――――――――――――――― + +stderr: + +** + +ERROR:../tests/qtest/sse-timer-test.c:91:test_counter: assertion failed (readl(COUNTER_BASE + CNTCV_LO) == 100): (0 == 100) + +(test program exited with status code -6) + +―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――― +``` +Steps to reproduce: +1. Run the QEMU CI on Travis +Additional information: +It seems to be a new or intermittent problem, two weeks ago it was still working fine: + +https://app.travis-ci.com/github/huth/qemu/jobs/627999506#L6325 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2706 b/results/classifier/mode-deepseek-r1:32b/output/system/2706 new file mode 100644 index 00000000..65dd313a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2706 @@ -0,0 +1,3 @@ + + +MigrationCapability "dirty-bitmaps off" diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2708 b/results/classifier/mode-deepseek-r1:32b/output/system/2708 new file mode 100644 index 00000000..31176b60 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2708 @@ -0,0 +1,3 @@ + + +aarch64 register MDCCINT_EL1 exhibits bizzare behavior diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/271 b/results/classifier/mode-deepseek-r1:32b/output/system/271 new file mode 100644 index 00000000..c26dcfdb --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/271 @@ -0,0 +1,3 @@ + + +ARM cpu emulation regression on QEMU 4.2.0 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2715 b/results/classifier/mode-deepseek-r1:32b/output/system/2715 new file mode 100644 index 00000000..cf30d9ea --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2715 @@ -0,0 +1,3 @@ + + +QEMU AARCH64 only supports canonical addresses running on x64. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2716 b/results/classifier/mode-deepseek-r1:32b/output/system/2716 new file mode 100644 index 00000000..8d743c20 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2716 @@ -0,0 +1,9 @@ + + +migrate incoming with fd transfer issue +Steps to reproduce: +1. +2. +3. +Additional information: +# diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2717 b/results/classifier/mode-deepseek-r1:32b/output/system/2717 new file mode 100644 index 00000000..ff1b9080 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2717 @@ -0,0 +1,14 @@ + + +semihosting link to risc-v details in document is changed +Description of problem: + +Steps to reproduce: +1. Open https://gitlab.com/qemu-project/qemu/-/blob/master/docs/about/emulation.rst +2. Goto Supported Targets section +3. Click RISC-V link in the table +4. Got 404 + +New url looks like https://github.com/riscv-non-isa/riscv-semihosting/blob/main/riscv-semihosting.adoc +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2718 b/results/classifier/mode-deepseek-r1:32b/output/system/2718 new file mode 100644 index 00000000..29c4813e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2718 @@ -0,0 +1,104 @@ + + +9.2.0 build failure: FAILED: libcommon.a.p/hw_intc_arm_gicv3_its.c.o +Description of problem: +Unable to build 9.2.0 via our docker container based builder inside a ChromeOS M97 based Docker container (using glibc 2.32). +Steps to reproduce: +1. See build logs. (I thought this was a vte issue, but libvte is the current version, `0.78.2`.) +Additional information: +``` +FAILED: libcommon.a.p/hw_intc_arm_gicv3_its.c.o +cc -m64 -Ilibcommon.a.p -I../common-user/host/x86_64 -I../linux-user/include/host/x86_64 -I../linux-user/include -Isubprojects/dtc/libfdt -I../subprojects/dtc/libfdt -Isubprojects/libvduse -I../subprojects/libvduse -I/usr/local/include/p11-kit-1 -I/usr/local/include/pixman-1 -I/usr/local/include/libpng16 -I/usr/local/include/libusb-1.0 -I/usr/local/include/SDL2 -I/usr/local/include/libmount -I/usr/local/include/blkid -I/usr/local/include/glib-2.0 -I/usr/local/lib64/glib-2.0/include -I/usr/local/include/gio-unix-2.0 -I/usr/local/include/slirp -I/usr/local/include/ncursesw -I/usr/local/include/gtk-3.0 -I/usr/local/include/at-spi2-atk/2.0 -I/usr/local/include/at-spi-2.0 -I/usr/local/include/dbus-1.0 -I/usr/local/lib64/dbus-1.0/include -I/usr/local/include/pango-1.0 -I/usr/local/include/harfbuzz -I/usr/local/include/fribidi -I/usr/local/include/atk-1.0 -I/usr/local/include/cairo -I/usr/local/include/freetype2 -I/usr/local/include/gdk-pixbuf-2.0 -I/usr/local/include/webp -I/usr/local/include/vte-2.91 -I/usr/local/include/pipewire-0.3 -I/usr/local/include/spa-0.2 -flto=auto -fdiagnostics-color=auto -Wall -Winvalid-pch -Werror -std=gnu11 -O2 -g -fstack-protector-strong -Wempty-body -Wendif-labels -Wexpansion-to-defined -Wformat-security -Wformat-y2k -Wignored-qualifiers -Wimplicit-fallthrough=2 -Winit-self -Wmissing-format-attribute -Wmissing-prototypes -Wnested-externs -Wold-style-declaration -Wold-style-definition -Wredundant-decls -Wshadow=local -Wstrict-prototypes -Wtype-limits -Wundef -Wvla -Wwrite-strings -Wno-missing-include-dirs -Wno-psabi -Wno-shift-negative-value -isystem /usr/local/tmp/crew/qemu.20241211185452.dir/linux-headers -isystem linux-headers -iquote . -iquote /usr/local/tmp/crew/qemu.20241211185452.dir -iquote /usr/local/tmp/crew/qemu.20241211185452.dir/include -iquote /usr/local/tmp/crew/qemu.20241211185452.dir/host/include/x86_64 -iquote /usr/local/tmp/crew/qemu.20241211185452.dir/host/include/generic -iquote /usr/local/tmp/crew/qemu.20241211185452.dir/tcg/i386 -pthread -mcx16 -msse2 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -fno-strict-aliasing -fno-common -fwrapv -ftrivial-auto-var-init=zero -fzero-call-used-regs=used-gpr -O3 -pipe -ffat-lto-objects -fPIC -fuse-ld=mold -flto=auto -fPIE -D_DEFAULT_SOURCE -D_XOPEN_SOURCE=600 -DNCURSES_WIDECHAR=1 -D_REENTRANT -DSTRUCT_IOVEC_DEFINED -MD -MQ libcommon.a.p/hw_intc_arm_gicv3_its.c.o -MF libcommon.a.p/hw_intc_arm_gicv3_its.c.o.d -o libcommon.a.p/hw_intc_arm_gicv3_its.c.o -c ../hw/intc/arm_gicv3_its.c +In file included from ../hw/intc/trace.h:1, + from ../hw/intc/arm_gicv3_its.c:16: +In function ‘_nocheck__trace_gicv3_its_dte_read’, + inlined from ‘trace_gicv3_its_dte_read’ at trace/trace-hw_intc.h:6634:9, + inlined from ‘get_dte’ at ../hw/intc/arm_gicv3_its.c:312:9, + inlined from ‘process_vmapti’ at ../hw/intc/arm_gicv3_its.c:680:9: +../hw/intc/trace-events:222:13: error: ‘dte.ittaddr’ may be used uninitialized [-Werror=maybe-uninitialized] + 222 | gicv3_its_dte_read(uint32_t devid, int valid, uint32_t size, uint64_t ittaddr) "GICv3 ITS: Device Table read for DeviceID 0x%x: valid %d size 0x%x ITTaddr 0x%" PRIx64 + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +../hw/intc/arm_gicv3_its.c: In function ‘process_vmapti’: +../hw/intc/arm_gicv3_its.c:654:13: note: ‘dte.ittaddr’ was declared here + 654 | DTEntry dte; + | ^~~ +In function ‘_nocheck__trace_gicv3_its_dte_read’, + inlined from ‘trace_gicv3_its_dte_read’ at trace/trace-hw_intc.h:6634:9, + inlined from ‘get_dte’ at ../hw/intc/arm_gicv3_its.c:312:9, + inlined from ‘process_vmapti’ at ../hw/intc/arm_gicv3_its.c:680:9: +../hw/intc/trace-events:222:13: error: ‘dte.size’ may be used uninitialized [-Werror=maybe-uninitialized] + 222 | gicv3_its_dte_read(uint32_t devid, int valid, uint32_t size, uint64_t ittaddr) "GICv3 ITS: Device Table read for DeviceID 0x%x: valid %d size 0x%x ITTaddr 0x%" PRIx64 + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +../hw/intc/arm_gicv3_its.c: In function ‘process_vmapti’: +../hw/intc/arm_gicv3_its.c:654:13: note: ‘dte.size’ was declared here + 654 | DTEntry dte; + | ^~~ +In function ‘_nocheck__trace_gicv3_its_dte_read’, + inlined from ‘trace_gicv3_its_dte_read’ at trace/trace-hw_intc.h:6634:9, + inlined from ‘get_dte’ at ../hw/intc/arm_gicv3_its.c:312:9, + inlined from ‘process_mapti’ at ../hw/intc/arm_gicv3_its.c:608:9: +../hw/intc/trace-events:222:13: error: ‘dte.ittaddr’ may be used uninitialized [-Werror=maybe-uninitialized] + 222 | gicv3_its_dte_read(uint32_t devid, int valid, uint32_t size, uint64_t ittaddr) "GICv3 ITS: Device Table read for DeviceID 0x%x: valid %d size 0x%x ITTaddr 0x%" PRIx64 + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +../hw/intc/arm_gicv3_its.c: In function ‘process_mapti’: +../hw/intc/arm_gicv3_its.c:586:13: note: ‘dte.ittaddr’ was declared here + 586 | DTEntry dte; + | ^~~ +In function ‘_nocheck__trace_gicv3_its_dte_read’, + inlined from ‘trace_gicv3_its_dte_read’ at trace/trace-hw_intc.h:6634:9, + inlined from ‘get_dte’ at ../hw/intc/arm_gicv3_its.c:312:9, + inlined from ‘process_mapti’ at ../hw/intc/arm_gicv3_its.c:608:9: +../hw/intc/trace-events:222:13: error: ‘dte.size’ may be used uninitialized [-Werror=maybe-uninitialized] + 222 | gicv3_its_dte_read(uint32_t devid, int valid, uint32_t size, uint64_t ittaddr) "GICv3 ITS: Device Table read for DeviceID 0x%x: valid %d size 0x%x ITTaddr 0x%" PRIx64 + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +../hw/intc/arm_gicv3_its.c: In function ‘process_mapti’: +../hw/intc/arm_gicv3_its.c:586:13: note: ‘dte.size’ was declared here + 586 | DTEntry dte; + | ^~~ +In function ‘lookup_vte’, + inlined from ‘vmovp_callback’ at ../hw/intc/arm_gicv3_its.c:1036:14: +../hw/intc/arm_gicv3_its.c:459:8: error: ‘vte.rdbase’ may be used uninitialized [-Werror=maybe-uninitialized] + 459 | if (vte->rdbase >= s->gicv3->num_cpu) { + | ^ +../hw/intc/arm_gicv3_its.c: In function ‘vmovp_callback’: +../hw/intc/arm_gicv3_its.c:1033:13: note: ‘vte.rdbase’ was declared here + 1033 | VTEntry vte; + | ^~~ +In function ‘_nocheck__trace_gicv3_its_vte_write’, + inlined from ‘trace_gicv3_its_vte_write’ at trace/trace-hw_intc.h:6789:9, + inlined from ‘update_vte’ at ../hw/intc/arm_gicv3_its.c:944:5, + inlined from ‘vmovp_callback’ at ../hw/intc/arm_gicv3_its.c:1051:10: +../hw/intc/trace-events:227:13: error: ‘vte.vptaddr’ may be used uninitialized [-Werror=maybe-uninitialized] + 227 | gicv3_its_vte_write(uint32_t vpeid, int valid, uint32_t vptsize, uint64_t vptaddr, uint32_t rdbase) "GICv3 ITS: vPE Table write for vPEID 0x%x: valid %d VPTsize 0x%x VPTaddr 0x%" PRIx64 " RDbase 0x%x" + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +../hw/intc/arm_gicv3_its.c: In function ‘vmovp_callback’: +../hw/intc/arm_gicv3_its.c:1033:13: note: ‘vte.vptaddr’ was declared here + 1033 | VTEntry vte; + | ^~~ +In function ‘_nocheck__trace_gicv3_its_vte_write’, + inlined from ‘trace_gicv3_its_vte_write’ at trace/trace-hw_intc.h:6789:9, + inlined from ‘update_vte’ at ../hw/intc/arm_gicv3_its.c:944:5, + inlined from ‘vmovp_callback’ at ../hw/intc/arm_gicv3_its.c:1051:10: +../hw/intc/trace-events:227:13: error: ‘vte.vptsize’ may be used uninitialized [-Werror=maybe-uninitialized] + 227 | gicv3_its_vte_write(uint32_t vpeid, int valid, uint32_t vptsize, uint64_t vptaddr, uint32_t rdbase) "GICv3 ITS: vPE Table write for vPEID 0x%x: valid %d VPTsize 0x%x VPTaddr 0x%" PRIx64 " RDbase 0x%x" + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +../hw/intc/arm_gicv3_its.c: In function ‘vmovp_callback’: +../hw/intc/arm_gicv3_its.c:1033:13: note: ‘vte.vptsize’ was declared here + 1033 | VTEntry vte; + | ^~~ +In function ‘lookup_vte’, + inlined from ‘vmovp_callback’ at ../hw/intc/arm_gicv3_its.c:1036:14: +../hw/intc/arm_gicv3_its.c:453:13: error: ‘MEM <unsigned char> [(struct VTEntry *)&vte]’ may be used uninitialized [-Werror=maybe-uninitialized] + 453 | if (!vte->valid) { + | ~~~^~~~~~~ +../hw/intc/arm_gicv3_its.c: In function ‘vmovp_callback’: +../hw/intc/arm_gicv3_its.c:1033:13: note: ‘MEM <unsigned char> [(struct VTEntry *)&vte]’ was declared here + 1033 | VTEntry vte; + | ^~~ +cc1: all warnings being treated as errors + +``` + +Full Build log: + +[qemu-build-log.zip](/uploads/db227e4a6bbbcfccd0e1e3ccaacf1aec/qemu-build-log.zip) diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2719 b/results/classifier/mode-deepseek-r1:32b/output/system/2719 new file mode 100644 index 00000000..38848f2f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2719 @@ -0,0 +1,3 @@ + + +9.2.0 tarball contains unrelated files diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/272 b/results/classifier/mode-deepseek-r1:32b/output/system/272 new file mode 100644 index 00000000..3910a53c --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/272 @@ -0,0 +1,3 @@ + + +QEMU: block/vvfat driver issues diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2721 b/results/classifier/mode-deepseek-r1:32b/output/system/2721 new file mode 100644 index 00000000..6778aba3 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2721 @@ -0,0 +1,3 @@ + + +Failure with macOS 15.2 on ARM64: Property 'host-arm-cpu.sme' not found diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2737 b/results/classifier/mode-deepseek-r1:32b/output/system/2737 new file mode 100644 index 00000000..307ce7cd --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2737 @@ -0,0 +1,3 @@ + + +Plans for Adding RISC-V Vector (RVV) Backend Support? diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2746 b/results/classifier/mode-deepseek-r1:32b/output/system/2746 new file mode 100644 index 00000000..c08b55df --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2746 @@ -0,0 +1,3 @@ + + +NO_CAST.INTEGER_OVERFLOW in /hw/net/e1000.c diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2748 b/results/classifier/mode-deepseek-r1:32b/output/system/2748 new file mode 100644 index 00000000..127358ae --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2748 @@ -0,0 +1,252 @@ + + +Windows specific main loop deadlock when using serial pipe communication +Description of problem: +Attaching WinDBG (or for that matter, any other serial end that sends data quickly enough) causes QEMU to deadlock. +Steps to reproduce: +1. Fire up QEMU with Windows (serial debugging enable) +2. Restart +3. At boot time, plug-in host WinDBG +Additional information: +WinDBG QEMU stacktrace +``` +0:020> g +(34c4.2330): Control-C exception - code 40010005 (first chance) +First chance exceptions are reported before any exception handling. +This exception may be expected and handled. +KERNELBASE!CtrlRoutine+0x1be: +00007ffe`82ace6ce 0f1f440000 nop dword ptr [rax+rax] +0:019> g +(34c4.3b3c): Break instruction exception - code 80000003 (first chance) +ntdll!DbgBreakPoint: +00007ffe`850d4090 cc int 3 +0:017> ~*k + + 0 Id: 34c4.28b8 Suspend: 1 Teb: 0000009f`a24ac000 Unfrozen +Child-SP RetAddr Call Site +0000009f`a27f7388 00007ffe`829e6656 ntdll!NtCreateEvent+0x14 +0000009f`a27f7390 00007ff7`38abcbd6 KERNELBASE!PeekNamedPipe+0xa6 +0000009f`a27f7460 00007ff7`38bb8f11 qemu_system_x86_64!win_chr_pipe_poll+0x84 +0000009f`a27f74d0 00007ff7`38bb93fb qemu_system_x86_64!os_host_main_loop_wait+0x133 +0000009f`a27ffba0 00007ff7`38686c45 qemu_system_x86_64!main_loop_wait+0xce +0000009f`a27ffc00 00007ff7`38ac2f14 qemu_system_x86_64!qemu_main_loop+0x2b +0000009f`a27ffc40 00007ff7`38ac2f52 qemu_system_x86_64!qemu_default_main+0x14 +0000009f`a27ffc80 00007ff7`38bdeede qemu_system_x86_64!SDL_main+0x26 +0000009f`a27ffcb0 00007ff7`3838140a qemu_system_x86_64!__mingw_enum_import_library_names+0x24e +0000009f`a27ffd30 00007ff7`383814f6 qemu_system_x86_64!__tmainCRTStartup+0xea +0000009f`a27ffd70 00007ffe`83ca259d qemu_system_x86_64!mainCRTStartup+0x16 +0000009f`a27ffda0 00007ffe`8508af38 KERNEL32!BaseThreadInitThunk+0x1d +0000009f`a27ffdd0 00000000`00000000 ntdll!RtlUserThreadStart+0x28 + + 1 Id: 34c4.2738 Suspend: 1 Teb: 0000009f`a24ae000 Unfrozen +Child-SP RetAddr Call Site +0000009f`a29ffaa8 00007ffe`8506586e ntdll!NtWaitForWorkViaWorkerFactory+0x14 +0000009f`a29ffab0 00007ffe`83ca259d ntdll!TppWorkerThread+0x2ee +0000009f`a29ffd90 00007ffe`8508af38 KERNEL32!BaseThreadInitThunk+0x1d +0000009f`a29ffdc0 00000000`00000000 ntdll!RtlUserThreadStart+0x28 + + 2 Id: 34c4.35e4 Suspend: 1 Teb: 0000009f`a24b0000 Unfrozen +Child-SP RetAddr Call Site +0000009f`a2bffa88 00007ffe`8506586e ntdll!NtWaitForWorkViaWorkerFactory+0x14 +0000009f`a2bffa90 00007ffe`83ca259d ntdll!TppWorkerThread+0x2ee +0000009f`a2bffd70 00007ffe`8508af38 KERNEL32!BaseThreadInitThunk+0x1d +0000009f`a2bffda0 00000000`00000000 ntdll!RtlUserThreadStart+0x28 + + 3 Id: 34c4.24f0 Suspend: 1 Teb: 0000009f`a24b2000 Unfrozen +Child-SP RetAddr Call Site +0000009f`a2dff838 00007ffe`8506586e ntdll!NtWaitForWorkViaWorkerFactory+0x14 +0000009f`a2dff840 00007ffe`83ca259d ntdll!TppWorkerThread+0x2ee +0000009f`a2dffb20 00007ffe`8508af38 KERNEL32!BaseThreadInitThunk+0x1d +0000009f`a2dffb50 00000000`00000000 ntdll!RtlUserThreadStart+0x28 + + 4 Id: 34c4.2898 Suspend: 1 Teb: 0000009f`a24b4000 Unfrozen "pool" +Child-SP RetAddr Call Site +0000009f`a2fffb58 00007ffe`850997db ntdll!NtWaitForAlertByThreadId+0x14 +0000009f`a2fffb60 00007ffe`829df2e9 ntdll!RtlSleepConditionVariableSRW+0x13b +0000009f`a2fffbe0 00007ffd`cb1c6903 KERNELBASE!SleepConditionVariableSRW+0x29 +0000009f`a2fffc20 00007ffd`cb235399 libglib_2_0_0!g_byte_array_sort_with_data+0x143 +0000009f`a2fffc80 00007ffd`cb234a41 libglib_2_0_0!g_get_num_processors+0x2c9 +0000009f`a2fffce0 00007ffd`cb2696f7 libglib_2_0_0!g_test_get_path+0x51 +0000009f`a2fffd20 00007ffe`8424e634 libglib_2_0_0!g_private_replace+0x117 +0000009f`a2fffd50 00007ffe`8424e70c msvcrt!_callthreadstartex+0x28 +0000009f`a2fffd80 00007ffe`83ca259d msvcrt!_threadstartex+0x7c +0000009f`a2fffdb0 00007ffe`8508af38 KERNEL32!BaseThreadInitThunk+0x1d +0000009f`a2fffde0 00000000`00000000 ntdll!RtlUserThreadStart+0x28 + + 5 Id: 34c4.2ed8 Suspend: 1 Teb: 0000009f`a24b6000 Unfrozen +Child-SP RetAddr Call Site +0000009f`a31ff9b8 00007ffe`829a9cee ntdll!NtWaitForSingleObject+0x14 +0000009f`a31ff9c0 00007ff7`38b9f99f KERNELBASE!WaitForSingleObjectEx+0x8e +0000009f`a31ffa60 00007ff7`38baba83 qemu_system_x86_64!qemu_event_wait+0xe3 +0000009f`a31ffac0 00007ff7`38b9faf2 qemu_system_x86_64!call_rcu_thread+0x6c +0000009f`a31ffb00 00007ffe`8424e634 qemu_system_x86_64!win32_start_routine+0x4e +0000009f`a31ffb50 00007ffe`8424e70c msvcrt!_callthreadstartex+0x28 +0000009f`a31ffb80 00007ffe`83ca259d msvcrt!_threadstartex+0x7c +0000009f`a31ffbb0 00007ffe`8508af38 KERNEL32!BaseThreadInitThunk+0x1d +0000009f`a31ffbe0 00000000`00000000 ntdll!RtlUserThreadStart+0x28 + + 6 Id: 34c4.2980 Suspend: 1 Teb: 0000009f`a24b8000 Unfrozen +Child-SP RetAddr Call Site +0000009f`a35ff888 00007ffe`82dc54a7 win32u!NtUserMsgWaitForMultipleObjectsEx+0x14 +0000009f`a35ff890 00007ffe`71373c70 USER32!MsgWaitForMultipleObjects+0x57 +0000009f`a35ff8d0 00007ffe`71373bc9 gdiplus!BackgroundThreadProc+0x70 +0000009f`a35ff940 00007ffe`83ca259d gdiplus!DllRefCountSafeThreadThunk+0x29 +0000009f`a35ff970 00007ffe`8508af38 KERNEL32!BaseThreadInitThunk+0x1d +0000009f`a35ff9a0 00000000`00000000 ntdll!RtlUserThreadStart+0x28 + + 7 Id: 34c4.3880 Suspend: 1 Teb: 0000009f`a24ba000 Unfrozen +Child-SP RetAddr Call Site +0000009f`a37ff808 00007ffe`829c6849 ntdll!NtWaitForMultipleObjects+0x14 +0000009f`a37ff810 00007ffe`837707ad KERNELBASE!WaitForMultipleObjectsEx+0xe9 +0000009f`a37ffaf0 00007ffe`8377061a combase!WaitCoalesced+0xa9 +0000009f`a37ffd90 00007ffe`8377040f combase!CROIDTable::WorkerThreadLoop+0x5a +0000009f`a37ffde0 00007ffe`83770829 combase!CRpcThread::WorkerLoop+0x57 +0000009f`a37ffe60 00007ffe`83ca259d combase!CRpcThreadCache::RpcWorkerThreadEntry+0x29 +0000009f`a37ffe90 00007ffe`8508af38 KERNEL32!BaseThreadInitThunk+0x1d +0000009f`a37ffec0 00000000`00000000 ntdll!RtlUserThreadStart+0x28 + + 8 Id: 34c4.1bd0 Suspend: 1 Teb: 0000009f`a24bc000 Unfrozen +Child-SP RetAddr Call Site +0000009f`a39ffaa8 00007ffe`8506586e ntdll!NtWaitForWorkViaWorkerFactory+0x14 +0000009f`a39ffab0 00007ffe`83ca259d ntdll!TppWorkerThread+0x2ee +0000009f`a39ffd90 00007ffe`8508af38 KERNEL32!BaseThreadInitThunk+0x1d +0000009f`a39ffdc0 00000000`00000000 ntdll!RtlUserThreadStart+0x28 + + 9 Id: 34c4.20fc Suspend: 1 Teb: 0000009f`a24be000 Unfrozen +Child-SP RetAddr Call Site +0000009f`a3bffa78 00007ffe`8506586e ntdll!NtWaitForWorkViaWorkerFactory+0x14 +0000009f`a3bffa80 00007ffe`83ca259d ntdll!TppWorkerThread+0x2ee +0000009f`a3bffd60 00007ffe`8508af38 KERNEL32!BaseThreadInitThunk+0x1d +0000009f`a3bffd90 00000000`00000000 ntdll!RtlUserThreadStart+0x28 + + 10 Id: 34c4.1768 Suspend: 1 Teb: 0000009f`a24c0000 Unfrozen +Child-SP RetAddr Call Site +0000009f`a3dff438 00007ffe`8457a212 win32u!NtUserMsgWaitForMultipleObjectsEx+0x14 +0000009f`a3dff440 00007ffe`8456fa2e shcore!WorkThreadManager::CThread::ThreadProc+0xbf2 +0000009f`a3dff6f0 00007ffe`8456f9f1 shcore!WorkThreadManager::CThread::s_ExecuteThreadProc+0x22 +0000009f`a3dff730 00007ffe`83ca259d shcore!<lambda_9844335fc14345151eefcc3593dd6895>::<lambda_invoker_cdecl>+0x11 +0000009f`a3dff760 00007ffe`8508af38 KERNEL32!BaseThreadInitThunk+0x1d +0000009f`a3dff790 00000000`00000000 ntdll!RtlUserThreadStart+0x28 + + 11 Id: 34c4.3ac0 Suspend: 1 Teb: 0000009f`a24d6000 Unfrozen +Child-SP RetAddr Call Site +0000009f`a41fead0 00007ffe`8506d249 ntdll!RtlpAllocateHeap+0x835 +0000009f`a41fed30 00007ffe`85134832 ntdll!RtlpAllocateHeapInternal+0x6c9 +0000009f`a41fee30 00007ffe`850ee2e8 ntdll!RtlDebugAllocateHeap+0x102 +0000009f`a41feed0 00007ffe`8506d249 ntdll!RtlpAllocateHeap+0x7f1a8 +0000009f`a41ff130 00007ffe`85059634 ntdll!RtlpAllocateHeapInternal+0x6c9 +0000009f`a41ff230 00007ffe`85058877 ntdll!LdrpAllocateTls+0x108 +0000009f`a41ff300 00007ffe`850a45af ntdll!LdrpInitializeThread+0x6f +0000009f`a41ff3e0 00007ffe`850a44e3 ntdll!_LdrpInitialize+0x93 +0000009f`a41ff460 00007ffe`850a440e ntdll!LdrpInitializeInternal+0x6b +0000009f`a41ff6e0 00000000`00000000 ntdll!LdrInitializeThunk+0xe + + 12 Id: 34c4.3fac Suspend: 1 Teb: 0000009f`a24c4000 Unfrozen +Child-SP RetAddr Call Site +0000009f`a43ff268 00007ffe`85067e65 ntdll!NtWaitForAlertByThreadId+0x14 +0000009f`a43ff270 00007ff7`38b9edcd ntdll!RtlAcquireSRWLockExclusive+0x165 +0000009f`a43ff2e0 00007ff7`386771e6 qemu_system_x86_64!qemu_mutex_lock_impl+0x73 +0000009f`a43ff320 00007ff7`388b5654 qemu_system_x86_64!bql_lock_impl+0x78 +0000009f`a43ff370 00007ff7`388b5b00 qemu_system_x86_64!prepare_mmio_access+0x30 +0000009f`a43ff3b0 00007ff7`388b5c6c qemu_system_x86_64!flatview_read_continue_step+0xa0 +0000009f`a43ff430 00007ff7`388b5db9 qemu_system_x86_64!flatview_read_continue+0x66 +0000009f`a43ff480 00007ff7`388b5e60 qemu_system_x86_64!flatview_read+0xe2 +0000009f`a43ff500 00007ff7`388b5fb6 qemu_system_x86_64!address_space_read_full+0x78 +0000009f`a43ff570 00007ff7`38786ddf qemu_system_x86_64!address_space_rw+0x68 +0000009f`a43ff5c0 00007ffd`c624af05 qemu_system_x86_64!whpx_emu_ioport_callback+0x63 +0000009f`a43ff610 00007ffd`c62523d5 WinHvEmulation!IoPortHandler::NotifyIoPortRead+0x45 +0000009f`a43ff640 00007ffd`c624b916 WinHvEmulation!EmulatorVp::DispatchIoPortOperation+0x159 +0000009f`a43ff690 00007ffd`c624a77f WinHvEmulation!EmulatorVp::TrySimpleIoEmulation+0xc2 +0000009f`a43ff800 00007ffd`c6248caf WinHvEmulation!EmulatorWrapper::TryEmulationHelper<<lambda_6e350ef384ad69a259a7e747c2fadeeb> &>+0xcb +0000009f`a43ff8a0 00007ff7`38787201 WinHvEmulation!WHvEmulatorTryIoEmulation+0x10f +0000009f`a43ff930 00007ff7`38788cd6 qemu_system_x86_64!whpx_handle_portio+0x73 +0000009f`a43ff9a0 00007ff7`38789bd2 qemu_system_x86_64!whpx_vcpu_run+0x4a8 +0000009f`a43ffb20 00007ff7`3878c008 qemu_system_x86_64!whpx_vcpu_exec+0x54 +0000009f`a43ffb60 00007ff7`38b9faf2 qemu_system_x86_64!whpx_cpu_thread_fn+0xfb +0000009f`a43ffbb0 00007ffe`8424e634 qemu_system_x86_64!win32_start_routine+0x4e +0000009f`a43ffc00 00007ffe`8424e70c msvcrt!_callthreadstartex+0x28 +0000009f`a43ffc30 00007ffe`83ca259d msvcrt!_threadstartex+0x7c +0000009f`a43ffc60 00007ffe`8508af38 KERNEL32!BaseThreadInitThunk+0x1d +0000009f`a43ffc90 00000000`00000000 ntdll!RtlUserThreadStart+0x28 + + 13 Id: 34c4.3ecc Suspend: 1 Teb: 0000009f`a24c6000 Unfrozen +Child-SP RetAddr Call Site +0000009f`a45ff8c8 00007ffe`829a9cee ntdll!NtWaitForSingleObject+0x14 +0000009f`a45ff8d0 00007ffd`e15631e2 KERNELBASE!WaitForSingleObjectEx+0x8e +0000009f`a45ff970 00007ffd`e156b621 WinHvPlatform!WHvApi::Processor::RunVp+0x486 +0000009f`a45ffbe0 00007ff7`38788b9a WinHvPlatform!WHvRunVirtualProcessor+0x31 +0000009f`a45ffc20 00007ff7`38789bd2 qemu_system_x86_64!whpx_vcpu_run+0x36c +0000009f`a45ffda0 00007ff7`3878c008 qemu_system_x86_64!whpx_vcpu_exec+0x54 +0000009f`a45ffde0 00007ff7`38b9faf2 qemu_system_x86_64!whpx_cpu_thread_fn+0xfb +0000009f`a45ffe30 00007ffe`8424e634 qemu_system_x86_64!win32_start_routine+0x4e +0000009f`a45ffe80 00007ffe`8424e70c msvcrt!_callthreadstartex+0x28 +0000009f`a45ffeb0 00007ffe`83ca259d msvcrt!_threadstartex+0x7c +0000009f`a45ffee0 00007ffe`8508af38 KERNEL32!BaseThreadInitThunk+0x1d +0000009f`a45fff10 00000000`00000000 ntdll!RtlUserThreadStart+0x28 + + 14 Id: 34c4.3d08 Suspend: 1 Teb: 0000009f`a24c8000 Unfrozen +Child-SP RetAddr Call Site +0000009f`a47ff1a8 00007ffe`829a9cee ntdll!NtWaitForSingleObject+0x14 +0000009f`a47ff1b0 00007ffd`e15631e2 KERNELBASE!WaitForSingleObjectEx+0x8e +0000009f`a47ff250 00007ffd`e156b621 WinHvPlatform!WHvApi::Processor::RunVp+0x486 +0000009f`a47ff4c0 00007ff7`38788b9a WinHvPlatform!WHvRunVirtualProcessor+0x31 +0000009f`a47ff500 00007ff7`38789bd2 qemu_system_x86_64!whpx_vcpu_run+0x36c +0000009f`a47ff680 00007ff7`3878c008 qemu_system_x86_64!whpx_vcpu_exec+0x54 +0000009f`a47ff6c0 00007ff7`38b9faf2 qemu_system_x86_64!whpx_cpu_thread_fn+0xfb +0000009f`a47ff710 00007ffe`8424e634 qemu_system_x86_64!win32_start_routine+0x4e +0000009f`a47ff760 00007ffe`8424e70c msvcrt!_callthreadstartex+0x28 +0000009f`a47ff790 00007ffe`83ca259d msvcrt!_threadstartex+0x7c +0000009f`a47ff7c0 00007ffe`8508af38 KERNEL32!BaseThreadInitThunk+0x1d +0000009f`a47ff7f0 00000000`00000000 ntdll!RtlUserThreadStart+0x28 + + 15 Id: 34c4.3eb4 Suspend: 1 Teb: 0000009f`a24ca000 Unfrozen +Child-SP RetAddr Call Site +0000009f`a49ff278 00007ffe`829a9cee ntdll!NtWaitForSingleObject+0x14 +0000009f`a49ff280 00007ffd`e15631e2 KERNELBASE!WaitForSingleObjectEx+0x8e +0000009f`a49ff320 00007ffd`e156b621 WinHvPlatform!WHvApi::Processor::RunVp+0x486 +0000009f`a49ff590 00007ff7`38788b9a WinHvPlatform!WHvRunVirtualProcessor+0x31 +0000009f`a49ff5d0 00007ff7`38789bd2 qemu_system_x86_64!whpx_vcpu_run+0x36c +0000009f`a49ff750 00007ff7`3878c008 qemu_system_x86_64!whpx_vcpu_exec+0x54 +0000009f`a49ff790 00007ff7`38b9faf2 qemu_system_x86_64!whpx_cpu_thread_fn+0xfb +0000009f`a49ff7e0 00007ffe`8424e634 qemu_system_x86_64!win32_start_routine+0x4e +0000009f`a49ff830 00007ffe`8424e70c msvcrt!_callthreadstartex+0x28 +0000009f`a49ff860 00007ffe`83ca259d msvcrt!_threadstartex+0x7c +0000009f`a49ff890 00007ffe`8508af38 KERNEL32!BaseThreadInitThunk+0x1d +0000009f`a49ff8c0 00000000`00000000 ntdll!RtlUserThreadStart+0x28 + + 16 Id: 34c4.3844 Suspend: 1 Teb: 0000009f`a24cc000 Unfrozen +Child-SP RetAddr Call Site +0000009f`a4bff328 00007ffe`829c6849 ntdll!NtWaitForMultipleObjects+0x14 +0000009f`a4bff330 00007ffd`cb215d94 KERNELBASE!WaitForMultipleObjectsEx+0xe9 +0000009f`a4bff610 00007ffd`cb21607a libglib_2_0_0!g_pattern_match_simple+0x214 +0000009f`a4bff690 00007ffd`cb216612 libglib_2_0_0!g_pattern_match_simple+0x4fa +0000009f`a4bff6e0 00007ffd`cb203740 libglib_2_0_0!g_poll+0x392 +0000009f`a4bffbd0 00007ffd`cb204180 libglib_2_0_0!g_get_monotonic_time+0xac0 +0000009f`a4bffc60 00007ffd`c9eaa829 libglib_2_0_0!g_main_loop_run+0x120 +0000009f`a4bffcb0 00007ffd`e5ab4e2b libspice_server_1!spice_server_init+0x1ca9 +0000009f`a4bffcf0 00007ffe`8424e634 libwinpthread_1!pthread_create_wrapper+0x9b +0000009f`a4bffd30 00007ffe`8424e70c msvcrt!_callthreadstartex+0x28 +0000009f`a4bffd60 00007ffe`83ca259d msvcrt!_threadstartex+0x7c +0000009f`a4bffd90 00007ffe`8508af38 KERNEL32!BaseThreadInitThunk+0x1d +0000009f`a4bffdc0 00000000`00000000 ntdll!RtlUserThreadStart+0x28 + +# 17 Id: 34c4.3b3c Suspend: 1 Teb: 0000009f`a24d8000 Unfrozen +Child-SP RetAddr Call Site +0000009f`c4dffd08 00007ffe`8510735e ntdll!DbgBreakPoint +0000009f`c4dffd10 00007ffe`83ca259d ntdll!DbgUiRemoteBreakin+0x4e +0000009f`c4dffd40 00007ffe`8508af38 KERNEL32!BaseThreadInitThunk+0x1d +0000009f`c4dffd70 00000000`00000000 ntdll!RtlUserThreadStart+0x28 + + 18 Id: 34c4.16c4 Suspend: 1 Teb: 0000009f`a24d0000 Unfrozen +Child-SP RetAddr Call Site +0000009f`c53ffb58 00007ffe`850997db ntdll!NtWaitForAlertByThreadId+0x14 +0000009f`c53ffb60 00007ffe`829df2e9 ntdll!RtlSleepConditionVariableSRW+0x13b +0000009f`c53ffbe0 00007ff7`38b9f403 KERNELBASE!SleepConditionVariableSRW+0x29 +0000009f`c53ffc20 00007ff7`38bbc9e5 qemu_system_x86_64!qemu_cond_timedwait_impl+0x92 +0000009f`c53ffc70 00007ff7`38b9faf2 qemu_system_x86_64!worker_thread+0xc9 +0000009f`c53ffce0 00007ffe`8424e634 qemu_system_x86_64!win32_start_routine+0x4e +0000009f`c53ffd30 00007ffe`8424e70c msvcrt!_callthreadstartex+0x28 +0000009f`c53ffd60 00007ffe`83ca259d msvcrt!_threadstartex+0x7c +0000009f`c53ffd90 00007ffe`8508af38 KERNEL32!BaseThreadInitThunk+0x1d +0000009f`c53ffdc0 00000000`00000000 ntdll!RtlUserThreadStart+0x28 +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2757 b/results/classifier/mode-deepseek-r1:32b/output/system/2757 new file mode 100644 index 00000000..bc4f3dbc --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2757 @@ -0,0 +1,3 @@ + + +EGL can't handle multi plane textures diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2760 b/results/classifier/mode-deepseek-r1:32b/output/system/2760 new file mode 100644 index 00000000..1bbe1fae --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2760 @@ -0,0 +1,3 @@ + + +Some Aarch64 system registers not available via the debugger diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2765 b/results/classifier/mode-deepseek-r1:32b/output/system/2765 new file mode 100644 index 00000000..81e1c097 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2765 @@ -0,0 +1,3 @@ + + +InputMethodKit warnings on macOS Sequoia diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2770 b/results/classifier/mode-deepseek-r1:32b/output/system/2770 new file mode 100644 index 00000000..f8fd74aa --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2770 @@ -0,0 +1,16 @@ + + +Build failure due to missing keyctl_pkey_encrypt +Description of problem: + +Steps to reproduce: +1. git checkout v7.2.0 +2. ./configure --target-list=arm-softmmu;make +3. ../backends/cryptodev-lkcf.c: In function ‘cryptodev_lkcf_execute_task’: +../backends/cryptodev-lkcf.c:358:19: error: implicit declaration of function ‘keyctl_pkey_encrypt’; did you mean ‘keyctl_reject’? [-Werror=implicit-function-declaration] + ret = keyctl_pkey_encrypt(key_id, op_desc, + ^~~~~~~~~~~~~~~~~~~ + keyctl_reject +../backends/cryptodev-lkcf.c:358:19: error: nested extern declaration of ‘keyctl_pkey_encrypt’ [-Werror=nested-externs] +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2774 b/results/classifier/mode-deepseek-r1:32b/output/system/2774 new file mode 100644 index 00000000..106c8cd3 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2774 @@ -0,0 +1,5 @@ + + +Consider adding an `aliases` node to RISC-V DTB that includes `serial0` alias +Additional information: +Example of an [aliases section for physical SoC](https://github.com/torvalds/linux/blob/b62cef9a5c673f1b8083159f5dc03c1c5daced2f/arch/riscv/boot/dts/sophgo/cv1800b-milkv-duo.dts#L14-L20). diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2776 b/results/classifier/mode-deepseek-r1:32b/output/system/2776 new file mode 100644 index 00000000..cde5b07e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2776 @@ -0,0 +1,3 @@ + + +OHCI: Incorrectly reports an overrun error diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/278 b/results/classifier/mode-deepseek-r1:32b/output/system/278 new file mode 100644 index 00000000..53317737 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/278 @@ -0,0 +1,3 @@ + + +jack audio dev produces no sound diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2782 b/results/classifier/mode-deepseek-r1:32b/output/system/2782 new file mode 100644 index 00000000..a9dd972e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2782 @@ -0,0 +1,12 @@ + + +WHPX won't enable x86_64v3 level instructions +Description of problem: +x86_64v3 support is not available inside guest +Steps to reproduce: +1. Boot the image +2. Open terminal +3. Run `/lib64/ld-linux-x86-64.so.2 --help` and check which levels are available in the output +4. Or run `/lib64/ld-linux-x86-64.so.2 --list-diagnostics | grep isa` and check `isa_1` value (expected 7 for v3 (3 bits being set)) +Additional information: +Due to this some Linux distribution, like Centos Stream 10, will not be able to boot with WHPX acceleration enabled. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2784 b/results/classifier/mode-deepseek-r1:32b/output/system/2784 new file mode 100644 index 00000000..af6fa331 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2784 @@ -0,0 +1,219 @@ + + +SIGILL during DPDK e1000e device initialization - VMOVD instruction fails in QEMU +Description of problem: +I think it's a QEMU issue, but it could be rather a DPDK issue. +When using DPDK with QEMU's e1000e device, the initialization fails with SIGILL (Illegal Instruction) during the LED initialization phase. The issue occurs specifically with the e1000e device and not with other network devices. + +Output from GDB: +``` +Starting DPDK initialization... +EAL: Detected CPU lcores: 4 +EAL: Detected NUMA nodes: 1 +EAL: Auto-detected process type: PRIMARY +EAL: Detected shared linkage of DPDK +EAL: Multi-process socket /var/run/dpdk/rte/mp_socket +EAL: Selected IOVA mode 'PA' +EAL: VFIO support initialized +EAL: Using IOMMU type 1 (Type 1) +EAL: Ignore mapping IO port bar(2) +EAL: Probe PCI driver: net_e1000_em (8086:10d3) device: 0000:01:00.0 (socket -1) + +Thread 1 "hello" received signal SIGILL, Illegal instruction. +0x00007ffff1d4f63e in e1000_id_led_init_generic () + from /usr/local/lib/x86_64-linux-gnu/dpdk/pmds-24.0/librte_net_e1000.so.24.0 + +1: x/i $pc +=> 0x7ffff1d4f63e <e1000_id_led_init_generic+94>: vmovd 0xe00(%rax),%xmm0 +``` + +PCI device information: +``` +01:00.0 Ethernet controller: Intel Corporation 82574L Gigabit Network Connection + Subsystem: Intel Corporation 82574L Gigabit Network Connection + Physical Slot: 0 + Control: I/O+ Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR+ FastB2B- DisINTx- + Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- + Interrupt: pin A routed to IRQ 22 + IOMMU group: 6 + Region 0: Memory at fe840000 (32-bit, non-prefetchable) [size=128K] + Region 1: Memory at fe860000 (32-bit, non-prefetchable) [size=128K] + Region 2: I/O ports at c000 [size=32] + Region 3: Memory at fe880000 (32-bit, non-prefetchable) [size=16K] + Expansion ROM at fe800000 [disabled] [size=256K] +``` + +GDB Analysis: +The crash occurs during LED initialization when attempting to execute a VMOVD instruction. The register RAX contains value 0x1 at the time of crash, which appears incorrect as it should contain the base address of the device's memory-mapped region (around 0xfe840000 based on PCI info). + +Both host and guest have AVX/AVX2 support +- The issue appears to be related to memory mapping or address translation +- The SIGILL occurs consistently at the same point during device initialization +- This issue only occurs with e1000e device; other network devices work correctly + +Please let me know if you need any additional information. +Additional information: +Test program: +```c +#include <rte_eal.h> +#include <rte_debug.h> +#include <rte_lcore.h> +#include <rte_memory.h> +#include <rte_log.h> +#include <rte_dev.h> +#include <rte_bus.h> +#include <rte_ethdev.h> +#include <rte_kvargs.h> + +// Callback function for memory segment walking +static int dump_memseg(const struct rte_memseg_list *msl, + const struct rte_memseg *ms, void *arg) { + size_t *total_mem = arg; + *total_mem += ms->len; + return 0; +} + +static void print_device_info(uint16_t port_id) { + struct rte_eth_dev_info dev_info; + int ret = rte_eth_dev_info_get(port_id, &dev_info); + if (ret != 0) { + printf("Error getting device info for port %u: %s\n", + port_id, rte_strerror(-ret)); + return; + } + + printf("\nDevice Info for Port %u:\n", port_id); + printf(" Driver name: %s\n", dev_info.driver_name); + + // Get device capabilities + printf(" Capabilities:\n"); + printf(" Maximum RX queues: %u\n", dev_info.max_rx_queues); + printf(" Maximum TX queues: %u\n", dev_info.max_tx_queues); + printf(" Maximum MTU: %u\n", dev_info.max_mtu); + printf(" Minimum RX buffers: %u\n", dev_info.min_rx_bufsize); + printf(" Maximum RX descriptors: %u\n", dev_info.rx_desc_lim.nb_max); + printf(" Maximum TX descriptors: %u\n", dev_info.tx_desc_lim.nb_max); + + // Get and print link status + struct rte_eth_link link; + ret = rte_eth_link_get_nowait(port_id, &link); + if (ret < 0) { + printf(" Link status: unknown\n"); + } else { + printf(" Link status: %s\n", link.link_status ? "up" : "down"); + if (link.link_status) { + printf(" Speed: %u Mbps\n", link.link_speed); + printf(" Duplex: %s\n", + link.link_duplex == RTE_ETH_LINK_FULL_DUPLEX ? + "full" : "half"); + } + } + + // Get and print MAC address + struct rte_ether_addr mac_addr; + ret = rte_eth_macaddr_get(port_id, &mac_addr); + if (ret < 0) { + printf(" MAC address: unknown\n"); + } else { + printf(" MAC address: %02X:%02X:%02X:%02X:%02X:%02X\n", + mac_addr.addr_bytes[0], mac_addr.addr_bytes[1], + mac_addr.addr_bytes[2], mac_addr.addr_bytes[3], + mac_addr.addr_bytes[4], mac_addr.addr_bytes[5]); + } + + // Get statistics + struct rte_eth_stats stats; + ret = rte_eth_stats_get(port_id, &stats); + if (ret == 0) { + printf(" Statistics:\n"); + printf(" RX packets: %" PRIu64 "\n", stats.ipackets); + printf(" TX packets: %" PRIu64 "\n", stats.opackets); + printf(" RX bytes: %" PRIu64 "\n", stats.ibytes); + printf(" TX bytes: %" PRIu64 "\n", stats.obytes); + printf(" RX errors: %" PRIu64 "\n", stats.ierrors); + printf(" TX errors: %" PRIu64 "\n", stats.oerrors); + } +} + +// Print runtime configurations +void print_runtime_config(void) { + // Core and NUMA information + printf("\n=== CPU and Memory Configuration ===\n"); + printf("Main lcore ID: %u\n", rte_get_main_lcore()); + printf("Number of available lcores: %u\n", rte_lcore_count()); + + // Print available lcores and their status + printf("\nLcore status:\n"); + unsigned int lcore_id; + RTE_LCORE_FOREACH(lcore_id) { + printf(" Lcore %u - Role: %s, Socket: %d\n", + lcore_id, + lcore_id == rte_get_main_lcore() ? "Main" : "Worker", + rte_lcore_to_socket_id(lcore_id)); + } + + // Memory and NUMA information + printf("\n=== Memory Configuration ===\n"); + printf("Number of NUMA nodes: %u\n", rte_socket_count()); + printf("IOVA mode: %s\n", rte_eal_iova_mode() == RTE_IOVA_PA ? "PA" : "VA"); + + // Service and Process information + printf("\n=== Process Information ===\n"); + printf("Process type: %s\n", + rte_eal_process_type() == RTE_PROC_PRIMARY ? "Primary" : + rte_eal_process_type() == RTE_PROC_SECONDARY ? "Secondary" : "Invalid"); + + // Runtime options + printf("\n=== Runtime Options ===\n"); + printf("Current log level: %d\n", rte_log_get_global_level()); + + // Memory allocation policy + printf("Hugepage info: %s\n", + rte_eal_has_hugepages() ? "Using hugepages" : "Not using hugepages"); + + // Memory segments info + printf("\n=== Memory Segments ===\n"); + size_t total_memory = 0; + + // Walk through all memory segments + int ret = rte_memseg_walk(dump_memseg, &total_memory); + if (ret < 0) { + printf("Failed to walk memory segments\n"); + } else { + printf("Total memory: %zu MB\n", total_memory >> 20); + } +} + +int main(int argc, char **argv) { + printf("Starting DPDK initialization...\n"); + + // Set log level to debug + rte_log_set_global_level(RTE_LOG_DEBUG); + + int ret = rte_eal_init(argc, argv); + if (ret < 0) { + rte_panic("Cannot init EAL: %s\n", rte_strerror(-ret)); + } + printf("EAL initialization successful\n"); + + // Get number of available ports + uint16_t nb_ports = rte_eth_dev_count_avail(); + printf("\nNumber of available ethernet ports: %u\n", nb_ports); + + // Print info for each port + uint16_t port_id; + RTE_ETH_FOREACH_DEV(port_id) { + print_device_info(port_id); + } + + printf("\nProceeding with runtime configuration...\n"); + print_runtime_config(); + + printf("\nCleaning up...\n"); + rte_eal_cleanup(); + return 0; +} +``` +Compile command: `gcc -o hello hello.c $(pkg-config --cflags libdpdk) $(pkg-config --libs libdpdk) -DRTE_LOG_LEVEL=RTE_LOG_DEBUG` + +Launch command: `sudo gdb --args ./hello -l 0 -n 1 --proc-type=auto -m 256 --iova-mode=pa --log-level=8 --match-allocations -a 0000:01:00.0` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2786 b/results/classifier/mode-deepseek-r1:32b/output/system/2786 new file mode 100644 index 00000000..72145421 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2786 @@ -0,0 +1,13 @@ + + +deleting files fails on vvfat (was: "error handling renames") +Description of problem: +When working with files, renaming or saving from IDE, QEMU halts with the error message: + +"Error handling renames (-2)" +Steps to reproduce: +1. +2. +3. +Additional information: +a previous del failed, the directories are not synced so the rename on the drive fails when the file with the target file name still exists on the real directory. So the real issue is a failed del. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2789 b/results/classifier/mode-deepseek-r1:32b/output/system/2789 new file mode 100644 index 00000000..035d1ce8 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2789 @@ -0,0 +1,3 @@ + + +Emulate a folder instead of creating the iso diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/279 b/results/classifier/mode-deepseek-r1:32b/output/system/279 new file mode 100644 index 00000000..101a4271 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/279 @@ -0,0 +1,3 @@ + + +x86-64 MTTCG Does not update page table entries atomically diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2795 b/results/classifier/mode-deepseek-r1:32b/output/system/2795 new file mode 100644 index 00000000..26a9b24d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2795 @@ -0,0 +1,162 @@ + + +qemu-system-aarch64 crash when issuing set_link net on in monitor +Description of problem: +Boot the guest. On the host, connect to the qemu monitor and issue the following commmands: +``` +set_link net0 off +ethtool enp0s1 on the guest now shows the link going down +set_link net0 on +``` + +qemu crashes as follows (virtio net): +``` +Thread 1 "qemu-system-aar" received signal SIGSEGV, Segmentation fault. +object_get_class (obj=obj@entry=0x0) at ../qemu/qom/object.c:1049 +1049 return obj->class; +(gdb) bt +#0 object_get_class (obj=obj@entry=0x0) at ../qemu/qom/object.c:1049 +#1 0x000055555602dd0f in QIO_CHANNEL_GET_CLASS (obj=0x0) + at /home/tsailer/src/daedalean/exp-bertcard-emu/qemu/include/io/channel.h:29 +#2 qio_channel_writev_full + (errp=0x0, flags=0, nfds=0, fds=0x0, niov=2, iov=0x7fffffff5190, ioc=0x0) + at ../qemu/io/channel.c:87 +#3 qio_channel_writev + (ioc=0x0, iov=iov@entry=0x7fffffff5190, niov=2, errp=errp@entry=0x0) + at ../qemu/io/channel.c:305 +#4 0x0000555555c42a66 in net_stream_receive + (nc=0x5555578477d0, buf=<optimized out>, size=90) + at ../qemu/net/stream.c:98 +#5 0x0000555555c3d327 in nc_sendv_compat + (flags=<optimized out>, iovcnt=1, iov=0x7fffffff52f0, nc=0x5555578477d0) + at ../qemu/net/net.c:784 +#6 qemu_deliver_packet_iov + (sender=<optimized out>, flags=<optimized out>, iov=0x7fffffff52f0, iovcnt=1, opaque=0x5555578477d0) at ../qemu/net/net.c:830 +#7 0x0000555555c4106c in qemu_net_queue_deliver_iov + (iovcnt=1, iov=0x7fffffff52f0, flags=0, sender=0x5555583049d8, queue=0x55555783c5e0) at ../qemu/net/queue.c:179 +#8 qemu_net_queue_send_iov + (queue=0x55555783c5e0, sender=0x5555583049d8, flags=flags@entry=0, iov=iov@entry=0x7fffffff52f0, iovcnt=iovcnt@entry=1, sent_cb=sent_cb@entry=0x555555f28fa0 <virtio_net_tx_complete>) at ../qemu/net/queue.c:235 +#9 0x0000555555c3ed63 in qemu_sendv_packet_async + (sent_cb=0x555555f28fa0 <virtio_net_tx_complete>, iovcnt=1, iov=0x7fffffff52f0, sender=<optimized out>) at ../qemu/net/net.c:875 +#10 0x0000555555f28c1d in virtio_net_flush_tx (q=q@entry=0x5555582fcb00) + at ../qemu/hw/net/virtio-net.c:2795 +#11 0x0000555555f28f18 in virtio_net_tx_bh (opaque=0x5555582fcb00) + at ../qemu/hw/net/virtio-net.c:2948 +#12 0x00005555561c2f47 in aio_bh_call (bh=bh@entry=0x5555582d0b30) + at ../qemu/util/async.c:172 +#13 0x00005555561c311e in aio_bh_poll (ctx=ctx@entry=0x5555574c3c10) + at ../qemu/util/async.c:219 +#14 0x00005555561ab382 in aio_dispatch (ctx=0x5555574c3c10) + at ../qemu/util/aio-posix.c:424 +#15 0x00005555561c2d82 in aio_ctx_dispatch + (source=<optimized out>, callback=<optimized out>, user_data=<optimized out>) at ../qemu/util/async.c:361 +#16 0x00007ffff7ad5d3b in g_main_context_dispatch () + at /lib/x86_64-linux-gnu/libglib-2.0.so.0 +#17 0x00005555561c45d8 in glib_pollfds_poll () at ../qemu/util/main-loop.c:287 +#18 os_host_main_loop_wait (timeout=0) at ../qemu/util/main-loop.c:310 +#19 main_loop_wait (nonblocking=nonblocking@entry=0) + at ../qemu/util/main-loop.c:589 +#20 0x0000555555bf2569 in qemu_main_loop () at ../qemu/system/runstate.c:835 +#21 0x00005555561047fa in qemu_default_main () at ../qemu/system/main.c:37 +#22 0x00007ffff7229d90 in __libc_start_call_main + (main=main@entry=0x5555558e5080 <main>, argc=argc@entry=44, argv=argv@entry=0x7fffffffd6c8) + at ../sysdeps/nptl/libc_start_call_main.h:58 +#23 0x00007ffff7229e40 in __libc_start_main_impl + (main=0x5555558e5080 <main>, argc=44, argv=0x7fffffffd6c8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffd6b8) + at ../csu/libc-start.c:392 +#24 0x00005555558e6095 in _start () + +Crash with e1000e: +[ 16.846673] e1000e 0000:00:02.0 enp0s2: NIC Link is Down +[ 18.495388] e1000e 0000:00:02.0 enp0s2: NIC Link is Up 1000 Mbps Full Duplex, Flow Control: Rx/Tx + +Thread 5 "qemu-system-aar" received signal SIGSEGV, Segmentation fault. +[Switching to Thread 0x7fffafe00640 (LWP 641377)] +object_get_class (obj=obj@entry=0x0) at ../qemu/qom/object.c:1049 +1049 return obj->class; +(gdb) bt +#0 object_get_class (obj=obj@entry=0x0) at ../qemu/qom/object.c:1049 +#1 0x000055555602dd0f in QIO_CHANNEL_GET_CLASS (obj=0x0) + at /home/tsailer/src/daedalean/exp-bertcard-emu/qemu/include/io/channel.h:29 +#2 qio_channel_writev_full + (errp=0x0, flags=0, nfds=0, fds=0x0, niov=2, iov=0x7fffafdfe9b0, ioc=0x0) + at ../qemu/io/channel.c:87 +#3 qio_channel_writev + (ioc=0x0, iov=iov@entry=0x7fffafdfe9b0, niov=2, errp=errp@entry=0x0) + at ../qemu/io/channel.c:305 +#4 0x0000555555c42a66 in net_stream_receive + (nc=0x5555578589b0, buf=<optimized out>, size=90) + at ../qemu/net/stream.c:98 +#5 0x0000555555c3d327 in nc_sendv_compat + (flags=<optimized out>, iovcnt=3, iov=0x55555850b280, nc=0x5555578589b0) + at ../qemu/net/net.c:784 +#6 qemu_deliver_packet_iov + (sender=<optimized out>, flags=<optimized out>, iov=0x55555850b280, iovcnt=3, opaque=0x5555578589b0) at ../qemu/net/net.c:830 +#7 0x0000555555c4106c in qemu_net_queue_deliver_iov + (iovcnt=3, iov=0x55555850b280, flags=0, sender=0x5555584facf8, queue=0x55555783c6d0) at ../qemu/net/queue.c:179 +#8 qemu_net_queue_send_iov + (queue=0x55555783c6d0, sender=0x5555584facf8, flags=0, iov=0x55555850b280, iovcnt=3, sent_cb=0x0) at ../qemu/net/queue.c:235 +#9 0x0000555555a62737 in net_tx_pkt_send_custom + (pkt=0x5555584fb200, offload=<optimized out>, callback=0x555555a61150 <net_tx_pkt_sendv>, context=0x5555584facf8) at ../qemu/hw/net/net_tx_pkt.c:847 +#10 0x0000555555a62819 in net_tx_pkt_send + (pkt=<optimized out>, nc=<optimized out>) + at ../qemu/hw/net/net_tx_pkt.c:816 +#11 0x0000555555a6dd2a in e1000e_tx_pkt_send + (queue_index=<optimized out>, tx=0x555558480cc8, core=0x555558460a60) + at ../qemu/hw/net/e1000e_core.c:654 +#12 e1000e_process_tx_desc + (queue_index=<optimized out>, dp=0x7fffafdfeb20, tx=0x555558480cc8, core=0x555558460a60) at ../qemu/hw/net/e1000e_core.c:731 +#13 e1000e_start_xmit (core=0x555558460a60, txr=txr@entry=0x7fffafdfeb90) + at ../qemu/hw/net/e1000e_core.c:921 +#14 0x0000555555a6dfcc in e1000e_set_tdt + (core=<optimized out>, index=<optimized out>, val=<optimized out>) + at ../qemu/hw/net/e1000e_core.c:2432 +#15 0x0000555555f72044 in memory_region_write_accessor + (mr=0x555558460610, addr=14360, value=<optimized out>, size=4, shift=<optimized out>, mask=<optimized out>, attrs=...) at ../qemu/system/memory.c:497 +#16 0x0000555555f7320e in access_with_adjusted_size + (addr=addr@entry=14360, value=value@entry=0x7fffafdfece8, size=size@entry=4, + access_size_min=<optimized out>, access_size_max=<optimized out>, access_fn=0x555555f71fc0 <memory_region_write_accessor>, mr=<optimized out>, attrs=...) at ../qemu/system/memory.c:573 +#17 0x0000555555f743ad in memory_region_dispatch_write + (mr=mr@entry=0x555558460610, addr=addr@entry=14360, data=<optimized out>, + data@entry=19, op=op@entry=MO_32, attrs=...) + at ../qemu/system/memory.c:1560 +#18 0x0000555555fc6cc9 in int_st_mmio_leN + (cpu=cpu@entry=0x55555789a140, full=full@entry=0x7fffa47eab90, val_le=val_le@entry=19, addr=addr@entry=18446743801007585304, size=size@entry=4, mmu_idx=mmu_idx@entry=2, ra=140736286290890, mr=0x555558460610, mr_offset=14360) + at ../qemu/accel/tcg/cputlb.c:2489 +#19 0x0000555555fc6ec8 in do_st_mmio_leN + (cpu=0x55555789a140, full=0x7fffa47eab90, val_le=19, addr=18446743801007585304, size=4, mmu_idx=2, ra=140736286290890) at ../qemu/accel/tcg/cputlb.c:2524 +#20 0x0000555555fcb55a in do_st_4 + (ra=<optimized out>, memop=<optimized out>, mmu_idx=<optimized out>, val=19, p=<optimized out>, cpu=<optimized out>) at ../qemu/accel/tcg/cputlb.c:2694 +#21 do_st4_mmu + (cpu=0x55555789a140, addr=140736144075184, val=19, oi=2, ra=140736286290890) at ../qemu/accel/tcg/cputlb.c:2770 +#22 0x00007fffb859f416 in code_gen_buffer () +#23 0x0000555555fbb6a6 in cpu_tb_exec + (cpu=cpu@entry=0x55555789a140, itb=itb@entry=0x7fffb859f2c0 <code_gen_buffer+140112531>, tb_exit=tb_exit@entry=0x7fffafdff444) + at ../qemu/accel/tcg/cpu-exec.c:458 +#24 0x0000555555fbbc2f in cpu_loop_exec_tb + (tb_exit=0x7fffafdff444, last_tb=<synthetic pointer>, pc=<optimized out>, tb=0x7fffb859f2c0 <code_gen_buffer+140112531>, cpu=0x55555789a140) + at ../qemu/accel/tcg/cpu-exec.c:908 +#25 cpu_exec_loop (cpu=cpu@entry=0x55555789a140, sc=sc@entry=0x7fffafdff4f0) + at ../qemu/accel/tcg/cpu-exec.c:1022 +#26 0x0000555555fbc3d1 in cpu_exec_setjmp + (cpu=cpu@entry=0x55555789a140, sc=sc@entry=0x7fffafdff4f0) + at ../qemu/accel/tcg/cpu-exec.c:1039 +#27 0x0000555555fbcb9d in cpu_exec (cpu=cpu@entry=0x55555789a140) + at ../qemu/accel/tcg/cpu-exec.c:1065 +#28 0x0000555555fd8123 in tcg_cpu_exec (cpu=cpu@entry=0x55555789a140) + at ../qemu/accel/tcg/tcg-accel-ops.c:78 +#29 0x0000555555fd8280 in mttcg_cpu_thread_fn (arg=arg@entry=0x55555789a140) + at ../qemu/accel/tcg/tcg-accel-ops-mttcg.c:95 +#30 0x00005555561ae740 in qemu_thread_start (args=0x555557883000) + at ../qemu/util/qemu-thread-posix.c:541 +#31 0x00007ffff7294ac3 in start_thread (arg=<optimized out>) + at ./nptl/pthread_create.c:442 +#32 0x00007ffff7326850 in clone3 () + at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81 +``` +Steps to reproduce: +1. Boot guest +2. monitor: set_link net0 off +3. monitor: set_link net0 on +Additional information: +Same behaviour with d6430c17d7113d3c38480dc34e59d00b0504e2f7 (master as of 2025-01-19). diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2797 b/results/classifier/mode-deepseek-r1:32b/output/system/2797 new file mode 100644 index 00000000..4a53937b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2797 @@ -0,0 +1,5 @@ + + +arm/raspi.c - incease memory limit +Additional information: +I can attempt to make a PR that increases this limit, but not sure if others would find it useful. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2801 b/results/classifier/mode-deepseek-r1:32b/output/system/2801 new file mode 100644 index 00000000..0b79f034 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2801 @@ -0,0 +1,3 @@ + + +Implement Raspberry PI Zero 2 W. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2803 b/results/classifier/mode-deepseek-r1:32b/output/system/2803 new file mode 100644 index 00000000..7c35508f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2803 @@ -0,0 +1,110 @@ + + +Assert failure in virtio-net device in address_space_lduw_le_cached +Description of problem: +Issue was found by fuzzing. Assert + +``` +qemu/include/exec/memory_ldst_cached.h.inc:30: uint16_t address_space_lduw_le_cached(MemoryRegionCache *, hwaddr, MemTxAttrs, MemTxResult *): Assertion `addr < cache->len && 2 <= cache->len - addr' failed. +``` +can be triggered with some qtest commands. This is pretty similar to [issue_302](https://gitlab.com/qemu-project/qemu/-/issues/302) and [issue_781](https://gitlab.com/qemu-project/qemu/-/issues/781), but kinda different. In [issue_781](https://gitlab.com/qemu-project/qemu/-/issues/781) there is a comment, that issue was `Possibly fixed by commit 10d35e58 ("virtio-pci: fix queue_enable write").`, but unfortunately it is not - we can still trigger this assert with other set of command-line arguments and qtest commands. +Steps to reproduce: +Command: + +``` +cat << EOF | ./qemu-system-x86_64 -display none -machine accel=qtest, -m 512M -M q35 -nodefaults -device virtio-net,netdev=net0,packed=on -netdev user,id=net0 -qtest stdio +outl 0xcf8 0x80000810 +outl 0xcfc 0xc000 +outl 0xcf8 0x80000820 +outl 0xcfc 0xe0004000 +outl 0xcf8 0x80000804 +outw 0xcfc 0x7 +write 0xe0004008 0x1 0x01 +write 0xe000400c 0x1 0x04 +outl 0xc00b 0x01000000 +outl 0xc006 0x38380000 +outl 0xc001 0x00 +outl 0xc00f 0x04000100 +write 0x3839003 0x1 0x01 +EOF +``` + +Results in + +``` +[I 0.000000] OPENED +[R +0.028638] outl 0xcf8 0x80000810 +[S +0.028692] OK +OK +[R +0.028705] outl 0xcfc 0xc000 +[S +0.028729] OK +OK +[R +0.028738] outl 0xcf8 0x80000820 +[S +0.028748] OK +OK +[R +0.028763] outl 0xcfc 0xe0004000 +[S +0.028784] OK +OK +[R +0.028800] outl 0xcf8 0x80000804 +[S +0.029483] OK +OK +[R +0.029509] outw 0xcfc 0x7 +[S +0.029820] OK +OK +[R +0.029833] write 0xe0004008 0x1 0x01 +[S +0.029846] OK +OK +[R +0.029853] write 0xe000400c 0x1 0x04 +[S +0.029882] OK +OK +[R +0.029894] outl 0xc00b 0x01000000 +[S +0.029909] OK +OK +[R +0.029923] outl 0xc006 0x38380000 +[S +0.029938] OK +OK +[R +0.029944] outl 0xc001 0x00 +[S +0.029953] OK +OK +[R +0.029959] outl 0xc00f 0x04000100 +[S +0.030073] OK +OK +[R +0.030091] write 0x3839003 0x1 0x01 +[S +0.030106] OK +OK +qemu-system-x86_64: /home/artemiin/Work/original_qemu/include/exec/memory_ldst_cached.h.inc:30: uint16_t address_space_lduw_le_cached(MemoryRegionCache *, hwaddr, MemTxAttrs, MemTxResult *): Assertion `addr < cache->len && 2 <= cache->len - addr' failed. +``` +Additional information: +There is a stack trace from libFuzzer output: + +``` +#0 0x5555561bcfc1 in __sanitizer_print_stack_trace (qemu/build/qemu-fuzz-x86_64+0xc68fc1) (BuildId: 97b846e788f9dda2a285e5ea004d922c4886a315) +<some_asert_calls> +#6 0x7ffff48d4471 in abort stdlib/abort.c:79:7 +#7 0x7ffff48d4394 in __assert_fail_base assert/assert.c:92:3 +#8 0x7ffff48e2eb1 in __assert_fail assert/assert.c:101:3 +#9 0x555557043c41 in address_space_lduw_le_cached qemu/include/exec/memory_ldst_cached.h.inc:30:5 +#10 0x555557043c41 in lduw_le_phys_cached qemu/include/exec/memory_ldst_phys.h.inc:67:12 +#11 0x555557043c41 in virtio_lduw_phys_cached qemu/include/hw/virtio/virtio-access.h:166:12 +#12 0x555557030a78 in vring_avail_ring qemu/build/../hw/virtio/virtio.c:389:12 +#13 0x555557030a78 in virtqueue_get_head qemu/build/../hw/virtio/virtio.c:1043:13 +#14 0x555557030a78 in virtqueue_split_pop qemu/build/../hw/virtio/virtio.c:1540:10 +#15 0x555557030a78 in virtqueue_pop qemu/build/../hw/virtio/virtio.c:1790:16 +#16 0x555556f9aaf9 in virtio_net_flush_tx qemu/build/../hw/net/virtio-net.c:2746:16 +#17 0x555556f9a4dc in virtio_net_tx_bh qemu/build/../hw/net/virtio-net.c:2953:11 +#18 0x5555577152e2 in aio_bh_call qemu/build/../util/async.c:171:5 +#19 0x555557715830 in aio_bh_poll qemu/build/../util/async.c:218:13 +#20 0x5555576ce2d7 in aio_dispatch qemu/build/../util/aio-posix.c:423:5 +#21 0x555557717918 in aio_ctx_dispatch qemu/build/../util/async.c:360:5 +#22 0x7ffff69837a8 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x547a8) (BuildId: 9f90bd7bbfcf84a1f1c5a6102f70e6264837b9d4) +#23 0x5555577187cd in glib_pollfds_poll qemu/build/../util/main-loop.c:287:9 +#24 0x5555577187cd in os_host_main_loop_wait qemu/build/../util/main-loop.c:310:5 +#25 0x5555577187cd in main_loop_wait qemu/build/../util/main-loop.c:589:11 +#26 0x5555571ce309 in flush_events qemu/build/../tests/qtest/fuzz/fuzz.c:50:9 +#27 0x5555571d662b in generic_fuzz qemu/build/../tests/qtest/fuzz/generic_fuzz.c:669:13 +#28 0x5555571ce7de in LLVMFuzzerTestOneInput qemu/build/../tests/qtest/fuzz/fuzz.c:158:5 +<fuzzer_init_calls> +#35 0x5555560e2510 in _start (qemu/build/qemu-fuzz-x86_64+0xb8e510) (BuildId: 97b846e788f9dda2a285e5ea004d922c4886a315 +``` + +FYI @mstredhat diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2806 b/results/classifier/mode-deepseek-r1:32b/output/system/2806 new file mode 100644 index 00000000..175ee4e3 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2806 @@ -0,0 +1,11 @@ + + +Build from source failed on Arch Linux with target-list=arm-softmmu,arm-linux-user +Description of problem: +When I tried to build the latest QEMU version, the build process top at 'linking test-qos' +Steps to reproduce: +1. Clone the latest git version of QEMU +2. Configure --target-list=arm-softmmu,arm-linux-user +3. Make +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/281 b/results/classifier/mode-deepseek-r1:32b/output/system/281 new file mode 100644 index 00000000..fe25e362 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/281 @@ -0,0 +1,3 @@ + + +External modules retreval using Go1.15 on s390x appears to have checksum and ECDSA verification issues diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2810 b/results/classifier/mode-deepseek-r1:32b/output/system/2810 new file mode 100644 index 00000000..bee868b1 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2810 @@ -0,0 +1,3 @@ + + +Boot zboot images on riscv64 and loogarch64 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2812 b/results/classifier/mode-deepseek-r1:32b/output/system/2812 new file mode 100644 index 00000000..850787f0 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2812 @@ -0,0 +1,3 @@ + + +Crash initializing audio device diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2814 b/results/classifier/mode-deepseek-r1:32b/output/system/2814 new file mode 100644 index 00000000..376286d4 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2814 @@ -0,0 +1,3 @@ + + +Convert gdb_core_xml_file to function for https://linaro.atlassian.net/browse/QEMU-487 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2816 b/results/classifier/mode-deepseek-r1:32b/output/system/2816 new file mode 100644 index 00000000..101b73f8 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2816 @@ -0,0 +1,16 @@ + + +qemu-9.2.1 windows can not load files if kernel is linux-6.13.x +Description of problem: +qemu-9.2 and 9.2.1 emulating windows-10 both gave this +bug "externe exception 80000004." emulating windows-10 +when a program tries to load a file. +qemu emulating windows-10 runs without this bug when using +kernel linux-6.12.14 and older. +Steps to reproduce: +1.start a prog, in my case sprint-layout-6.0, try to open/load a file. +2. +3. +Additional information: +Im not shure if the bug is with qemu or kernel. +You can decide better what causes this bug. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2817 b/results/classifier/mode-deepseek-r1:32b/output/system/2817 new file mode 100644 index 00000000..df621cd8 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2817 @@ -0,0 +1,53 @@ + + +Strange floating-point behaviour under Windows with some CPU models +Description of problem: +I'm encountering a very weird bug with some floating-point maths code, but only under very specific configurations. First I thought it was a Clang bug, but then further digging eventually showed it to only occur under Windows VMs with specific QEMU CPU options, I'm not certain whether it is a QEMU/KVM bug or a Windows bug, but thought starting here would be easiest. + +When compiled under MSVC Clang with modern CPU instructions disabled (e.g. `-march=pentium3` or `-march=pentium-mmx`), the `floorf()` call in the following program always returns 0.0, while the truncation works correctly: + +``` +#include <math.h> +#include <stdio.h> +#include <stdlib.h> + +int main(int argc, char **argv) +{ + float n = atof(argv[1]); + printf("n = %f\n", n); + + float f = floorf(n); + printf("f = %f\n", f); + + float c = (int)(n); + printf("c = %f\n", c); + + return 0; +} +``` + +Example output on an affected VM: + +``` +C:\Users\Administrator> floorf-p3.exe 10 +n = 10.000000 +f = 0.000000 +c = 10.000000 + +C:\Users\Administrator> floorf-p4.exe 10 +n = 10.000000 +f = 10.000000 +c = 10.000000 +``` + +(`floorf-p3.exe` was compiled with `-march=pentium3` and `floorf-p4.exe` with `-march=pentium4` above) + +I've tried a few QEMU CPU models on a variety of Intel/AMD VM hosts and two different Windows versions (10 and Server 2022), and observed the following: + +* `host-passthrough` - works (on AMD and Intel hosts) +* `qemu64` - broken +* `EPYC-Milan` - works +* `Westmere` - works +* `Penryn` - broken + +(I also reported this via the mailing list, but I think it might've swallowed my post) diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2821 b/results/classifier/mode-deepseek-r1:32b/output/system/2821 new file mode 100644 index 00000000..87e62cab --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2821 @@ -0,0 +1,25 @@ + + +Emulated newer x86 chipsets are noticably slower on cpu-bound loads than "-cpu qemu64" +Description of problem: +I noticed that "-cpu qemu64" is much faster than "-cpu max" or "-cpu Icelake-Server-noTSX" for cpu bound loads, and with more than one cpu under load. +Steps to reproduce: +1. Run a guest as per "qemu-system-x86_64 -cpu max [..]" command from above. Any linux distro should do. +2. run through the setup questions if you use Fedora-Server-KVM-41-1.4.x86_64.qcow2 from the example command line above +3. log into the guest via ssh, i.e. "ssh chris@amd64" here +4. cd /dev/shm; wget http://archive.apache.org/dist/httpd/httpd-2.4.57.tar.bz2; wget https://fluxcoil.net/files/tmp/job_httpd_extract_cpu.sh +6. bash ./job_httpd_extract_cpu.sh 4 300 +8. cat /tmp/counter + +Step 6 is executing a script which simply uses 4 parallel loops, where each loop runs "bzcat httpd-2.4.57.tar.bz2" constantly. After 300sec, the successful uncompressions over all 4 loops are summed up and stored in /tmp/counter. + +- result with "-cpu qemu64": 96 +- result with "-cpu max": 84 +- result with "-cpu Icelake-Server-noTSX": 44 +Additional information: +- For "-cpu Icelake-Server-noTSX" on this Thinkpad T590 I get these warnings, I think they are not relevant: + qemu-system-x86_64: warning: TCG doesn't support requested feature: CPUID.01H:ECX.pcid [bit 17] + qemu-system-x86_64: warning: TCG doesn't support requested feature: CPUID.01H:ECX.tsc-deadline [bit 24] + [..] +- I also looked at Broadwell etc, and all of them seem in the same ballpark. + Graph over some emulated architectures: https://fluxcoil.net/files/tmp/gnuplot_cpu-performance-emulated-only.png diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/283 b/results/classifier/mode-deepseek-r1:32b/output/system/283 new file mode 100644 index 00000000..1e2e0532 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/283 @@ -0,0 +1,3 @@ + + +TCG memory leak with FreeDOS 'edit' diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2830 b/results/classifier/mode-deepseek-r1:32b/output/system/2830 new file mode 100644 index 00000000..5c9b9f9e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2830 @@ -0,0 +1,3 @@ + + +gdbstub: breakpoint/watchpoint increments warp timer on single-core icount mode, breaking determinism diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2847 b/results/classifier/mode-deepseek-r1:32b/output/system/2847 new file mode 100644 index 00000000..0b58df59 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2847 @@ -0,0 +1,3 @@ + + +Provide short option for UEFI firmware diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2850 b/results/classifier/mode-deepseek-r1:32b/output/system/2850 new file mode 100644 index 00000000..cae689ec --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2850 @@ -0,0 +1,5 @@ + + +Available in a version for Windows on arm +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2855 b/results/classifier/mode-deepseek-r1:32b/output/system/2855 new file mode 100644 index 00000000..21f54bbc --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2855 @@ -0,0 +1,31 @@ + + +masking mode field in mepc before mret +Description of problem: +I thought I found a bug in OpenSBI (https://github.com/riscv-software-src/opensbi/issues/391) but it actually is a QEMU bug. +It is described here: https://lists.infradead.org/pipermail/opensbi/2025-March/008166.html +Steps to reproduce: +1. use an application with vectored mode enabled (The RISC-V Instruction Set Manual: Volume II: Privileged Architecture / chapter 10.1.2) in QEMU +2. trigger an illegal instruction interrupt (handle it in machine mode - not by medeleg) +3. in a machine mode trap: Store STVEC in MEPC. +4. do a mret +5. the first bits of mepc are not masked so the address in mepc (comming from (v)stvec) will be false after mret +Additional information: +My guess is that the instructions from the following quote (masking of lower bits in mepc) from the official spec must be implemented here: +https://gitlab.com/qemu-project/qemu/-/blob/master/target/riscv/op_helper.c?ref_type=heads#L387 +Maybe also somewhere else. + +> 3.1.14. Machine Exception Program Counter (mepc) +> +> mepc is an MXLEN-bit read/write register formatted as shown in Figure 21. The low bit of mepc +> (mepc[0]) is always zero. On implementations that support only IALIGN=32, the two low bits +> (mepc[1:0]) are always zero. +> +> If an implementation allows IALIGN to be either 16 or 32 (by changing CSR misa, for example), then, +> whenever IALIGN=32, bit mepc[1] is masked on reads so that it appears to be 0. This masking occurs +> also for the implicit read by the MRET instruction. Though masked, mepc[1] remains writable when +> IALIGN=32. +> +> mepc is a WARL register that must be able to hold all valid virtual addresses. It need not be capable of +> holding all possible invalid addresses. Prior to writing mepc, implementations may convert an invalid +> address into some other invalid address that mepc is capable of holding. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2858 b/results/classifier/mode-deepseek-r1:32b/output/system/2858 new file mode 100644 index 00000000..6ec9f9a7 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2858 @@ -0,0 +1,3 @@ + + +QEMU Command Not Working diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2859 b/results/classifier/mode-deepseek-r1:32b/output/system/2859 new file mode 100644 index 00000000..6ec9f9a7 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2859 @@ -0,0 +1,3 @@ + + +QEMU Command Not Working diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/286 b/results/classifier/mode-deepseek-r1:32b/output/system/286 new file mode 100644 index 00000000..b4bd4c9d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/286 @@ -0,0 +1,3 @@ + + +Performance degradation for WinXP boot time after b55f54bc diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2863 b/results/classifier/mode-deepseek-r1:32b/output/system/2863 new file mode 100644 index 00000000..204e2e85 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2863 @@ -0,0 +1,3 @@ + + +Invalid read reason: rejected diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2868 b/results/classifier/mode-deepseek-r1:32b/output/system/2868 new file mode 100644 index 00000000..d1a63bc5 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2868 @@ -0,0 +1,5 @@ + + +amd iommu pte is only 32bits not 64bits. +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/287 b/results/classifier/mode-deepseek-r1:32b/output/system/287 new file mode 100644 index 00000000..8a0441af --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/287 @@ -0,0 +1,3 @@ + + +block copy job sometimes hangs on the last block for minutes diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2870 b/results/classifier/mode-deepseek-r1:32b/output/system/2870 new file mode 100644 index 00000000..8580ffbd --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2870 @@ -0,0 +1,3 @@ + + +How to Create BE32-Type Instruction Emulation diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2871 b/results/classifier/mode-deepseek-r1:32b/output/system/2871 new file mode 100644 index 00000000..ffb438b5 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2871 @@ -0,0 +1,3 @@ + + +loongarch64: unknown register name 'f0' in asm diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2885 b/results/classifier/mode-deepseek-r1:32b/output/system/2885 new file mode 100644 index 00000000..37061cd8 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2885 @@ -0,0 +1,3 @@ + + +Unable to increase CPU's for existing RISCV VM diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/289 b/results/classifier/mode-deepseek-r1:32b/output/system/289 new file mode 100644 index 00000000..e09e8480 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/289 @@ -0,0 +1,3 @@ + + +Guest freezes until there is a keyboard input on Windows version diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2890 b/results/classifier/mode-deepseek-r1:32b/output/system/2890 new file mode 100644 index 00000000..f7435ced --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2890 @@ -0,0 +1,3 @@ + + +RFE: Individual ON_SHUTDOWN diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2892 b/results/classifier/mode-deepseek-r1:32b/output/system/2892 new file mode 100644 index 00000000..1f5d2a39 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2892 @@ -0,0 +1,3 @@ + + +Outdated documentation about MicroVMs diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2894 b/results/classifier/mode-deepseek-r1:32b/output/system/2894 new file mode 100644 index 00000000..d4f328a9 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2894 @@ -0,0 +1,27 @@ + + +There is a bug in versions 2025-02-10 and later that causes virtual machines to be created with incorrect SMP settings with warnings about TCG features when setting more than 2 cores with the smp option in the default TCG acceleration (see main text). +Description of problem: +When using qemu-system-x86_64 in versions 9.2.50 and later, if you create a virtual machine with 2 or more cores using the smp option, + +``` +qemu-system-x86_64: warning: TCG doesn't support requested feature: CPUID.01H:EDX.ht [bit 28] +qemu-system-x86_64: warning: TCG doesn't support requested feature: CPUID.80000001H:ECX.cmp-legacy [bit 1] +``` +The log will be displayed as many as the number of cores you have enabled, and the created virtual machine will be displayed as having a 1-core CPU with the number of cores you have enabled. +* I have not tested whether the same symptom occurs on versions 9.2.50 and later for other environments (Linux and the WoA version released on March 26th). +Steps to reproduce: +1. Create a virtual machine with more than two cores using TCG acceleration, which is the default acceleration, by using options such as 'qemu-system-x86_64 -smp 2' or 'qemu-system-x86_64 -smp sockets=1,cores=2,threads=1'. +2. 'qemu-system-x86_64: warning: TCG doesn't support requested feature: CPUID.01H:EDX.ht [bit 28]' and +'qemu-system-x86_64: warning: TCG doesn't support requested feature: CPUID.80000001H:ECX.cmp-legacy [bit 1]' +The log is generated as many as the number of cores set and the virtual machine is created. +3. When checking the CPU information of the booted virtual machine, it does not show that there is one CPU with the specified number of cores, but rather that there is a single core CPU with the specified number of cores. +Additional information: +``` +>qemu-system-x86_64 -M q35 -smp 2 -m 4g -display sdl -usb -device usb-tablet -drive file=MasterOS.vdi,id=disk,if=none -drive file="C:\Program Files\qemu\share\edk2-x86_64-code.fd",id=efi,readonly=on,format=raw,if=pflash -device ahci,id=ahci -device ide-hd,drive=disk,bus=ahci.1 -rtc base=localtime +``` + +``` +>qemu-system-x86_64 -M q35 -smp 4 -m 4g -display sdl -usb -device usb-tablet -drive file=MasterOS.vdi,id=disk,if=none -drive file="C:\Program Files\qemu\share\edk2-x86_64-code.fd",id=efi,readonly=on,format=raw,if=pflash -device ahci,id=ahci -device ide-hd,drive=disk,bus=ahci.1 -rtc base=localtime +``` + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2899 b/results/classifier/mode-deepseek-r1:32b/output/system/2899 new file mode 100644 index 00000000..bafef391 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2899 @@ -0,0 +1,38 @@ + + +Regression 10.0.0rc1: Segmentation fault on executing QEMU advent calendar 2014, day 4 +Description of problem: +On executing QEMU, a segmentation fault occurs +Steps to reproduce: +1. Download https://www.qemu-advent-calendar.org/2014/download/stxmas.tar.xz +2. Execute with QEMU command line +Additional information: +git bisect finishes with: + +``` +456709db50f424d112bc5f07260fdc51555f3a24 is the first bad commit +commit 456709db50f424d112bc5f07260fdc51555f3a24 +Author: Paolo Bonzini <pbonzini@redhat.com> +Date: Sun Dec 15 10:06:10 2024 +0100 + + target/i386: execute multiple REP/REPZ iterations without leaving TB + + Use a TCG loop so that it is not necessary to go through the setup steps + of REP and through the I/O check on every iteration. Interestingly, this + is not a particularly effective optimization on its own, though it avoids + the cost of correct RF emulation that was added in the previous patch. + The main benefit lies in allowing the hoisting of loop invariants outside + the loop, which will happen separately. + + The loop exits when the low 16 bits of CX/ECX/RCX are zero (so generally + speaking the string operation runs in 65536 iteration batches) to give + the main loop an opportunity to pick up interrupts. + + Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> + Reviewed-by: Richard Henderson <richard.henderson@linaro.org> + Link: https://lore.kernel.org/r/20241215090613.89588-12-pbonzini@redhat.com + Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> + + target/i386/tcg/translate.c | 55 ++++++++++++++++++++++++++++++++++++++++----- + 1 file changed, 49 insertions(+), 6 deletions(-) +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2901 b/results/classifier/mode-deepseek-r1:32b/output/system/2901 new file mode 100644 index 00000000..f20eee07 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2901 @@ -0,0 +1,3 @@ + + +Critical typo in qemu_source_dir/plugins/loader.c diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2906 b/results/classifier/mode-deepseek-r1:32b/output/system/2906 new file mode 100644 index 00000000..5c4caa57 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2906 @@ -0,0 +1,15 @@ + + +x86 (32-bit) multicore very slow, but x86-64 is fast (on macOS arm64 host) +Description of problem: +More cores doesn't slow down a x86-32 guest on an x86-64 host, nor does it slow down an x86-64 guest on an arm64 host. However, adding extra cores massively slows down an x86-32 guest on an arm64 host. +Steps to reproduce: +1. Run 32-bit guest or 32-bit installer +2. +3. + +I have replicated this over several OSes using homebrew qemu, source-built qemu and UTM. This is not to be confused with a different bug in UTM that caused its version of QEMU to be slow. + +This also seems to apply to 32-bit processes in an x86-64 guest. +Additional information: +https://github.com/utmapp/UTM/issues/5468 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/291 b/results/classifier/mode-deepseek-r1:32b/output/system/291 new file mode 100644 index 00000000..85333a88 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/291 @@ -0,0 +1,3 @@ + + +deadlock in e1000e diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2911 b/results/classifier/mode-deepseek-r1:32b/output/system/2911 new file mode 100644 index 00000000..e2b5bd6e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2911 @@ -0,0 +1,67 @@ + + +G5/970 emulation not complete enough for OSX ? +Description of problem: +Leopard image that boots on G4 does not boot on G5 +Steps to reproduce: +1. Find preinstalled hdd image on Archive.org: MacOSLeopard.img +2. Try to boot it like above with -cpu 970, or 970FX +3. Observe early hang +Additional information: +``` +cpus[0] = 0x7f794b3e3040 0x7f794b3e5bc0 +cpus[1] = 0x7f794afe3ec0 0x7f794afe6a40 +Trying to write invalid spr 276 (0x114) at 00000000000b6634 +Trying to read invalid spr 277 (0x115) at 00000000000b6638 +Trying to read invalid spr 276 (0x114) at 00000000000b663c +Trying to write invalid spr 277 (0x115) at 00000000000b6658 +Trying to write invalid spr 276 (0x114) at 00000000000b665c +Trying to read invalid spr 276 (0x114) at 00000000000b6660 +Trying to write invalid spr 277 (0x115) at 00000000000b670c +Trying to write invalid spr 276 (0x114) at 00000000000b6710 +Trying to read invalid spr 276 (0x114) at 00000000000b6714 +invalid/unsupported opcode: 00 - 00 - 00 - 00 (00000000) 0000000000000000 +Trying to write invalid spr 304 (0x130) at 0000000000003e14 +Trying to read invalid spr 304 (0x130) at 0000000000003e38 +Trying to write invalid spr 304 (0x130) at 0000000000003e14 +Trying to read invalid spr 304 (0x130) at 0000000000003e38 +Trying to write invalid spr 304 (0x130) at 0000000000003e14 +Trying to read invalid spr 304 (0x130) at 0000000000003e38 +Trying to write invalid spr 304 (0x130) at 0000000000003e14 +Trying to read invalid spr 304 (0x130) at 0000000000003e38 +Trying to write invalid spr 304 (0x130) at 0000000000003e14 +Trying to read invalid spr 304 (0x130) at 0000000000003e38 +Trying to write invalid spr 304 (0x130) at 0000000000003e14 +Trying to read invalid spr 304 (0x130) at 0000000000003e38 +Trying to write invalid spr 304 (0x130) at 0000000000003e14 +Trying to read invalid spr 304 (0x130) at 0000000000003e38 +Trying to read invalid spr 304 (0x130) at 0000000000003e38 +Trying to read invalid spr 304 (0x130) at 0000000000003e38 +invalid/unsupported opcode: 00 - 00 - 00 - 00 (00000000) 0000000000000008 + +last lin repeats infinitely. +``` + +from my email to qemu-ppc list: + +SPR 304 was already in target/ppc/cpu_init.c + +but sadly after adding those it still dies early :( + +I looked at + +IBM PowerPC 970FX RISC Microprocessor 11.6 SCOM Facility + +but whole thing a bit more complex than pair of regs. + +==== + +11.6.1 Processor Core SCOM SPR Access Each processor (core) has two special purpose registers (SPRs) used to access the SCOM interface: SCOMC and SCOMD. SCOMC and SCOMD are both 64-bit read/write SPRs and are used for SCOM Control and SCOM Data respectively. The interface is implemented as a direct connection to the parallel-to-serial converter, which handles the arbitration between the core and service processor. + +11.6.2 Operating System Protocol to Access SCOM SPRs In the PowerPC 970FX, SCOMC and SCOMD are complete operations. They do not require a software protocol in order to function properly except to disable external (asynchronous) interrupts. Software must check the error bits after performing an SCOMC to ensure that the command successfully completed. Table 11-14 Operating System Code to Access SCOM outlines a general software protocol for using these registers. + +==== + +Low level asm init for OSX XNU kernel seems to live at + +https://github.com/apple-oss-distributions/xnu/blob/xnu-1228/osfmk/ppc/start.s diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2913 b/results/classifier/mode-deepseek-r1:32b/output/system/2913 new file mode 100644 index 00000000..3dc17144 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2913 @@ -0,0 +1,3 @@ + + +vmapple machine unusable with macOS 15.4 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/292 b/results/classifier/mode-deepseek-r1:32b/output/system/292 new file mode 100644 index 00000000..32014e02 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/292 @@ -0,0 +1,3 @@ + + +keyboard errors in DOS, found links to similar errors for reference diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2932 b/results/classifier/mode-deepseek-r1:32b/output/system/2932 new file mode 100644 index 00000000..120e6d6e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2932 @@ -0,0 +1,3 @@ + + +QEMU flag fuzz targets not WAI diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2935 b/results/classifier/mode-deepseek-r1:32b/output/system/2935 new file mode 100644 index 00000000..d2a09b7e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2935 @@ -0,0 +1,26 @@ + + +strchrnul detection not suitable for macOS +Description of problem: +When qemu is compiled on macOS 15.4, targeting an earlier macOS version (e.g., 15.1), and then run on this earlier macOS version (15.1), it segfaults. This is because: + +- the meson test for strchrnul succeeds (the function is present in the library) +- the strchrnul function is therefore used +- but that function was introduced in the system's libc in 15.4 only + +The root cause for the bug is that the meson test for strchrnul does not include the appropriate header. Indeed, see the documentation for meson on compiler.has_function (https://mesonbuild.com/Compiler-properties.html#does-a-function-exist) + +> Note that, on macOS programs can be compiled targeting older macOS versions than the one that the program is compiled on. It can't be assumed that the OS version that is compiled on matches the OS version that the binary will run on. +> +> Therefore when detecting function availability with compiler.has_function(), it is important to specify the correct header in the prefix argument. + +The correct fix would be, in qemu's meson.build, to change: + +`cc.has_function('strchrnul')` + +into `cc.has_function('strchrnul', prefix : '#include <string>')` + +This is the recommended best practice and would allow correct detection on all platforms, including macOS. +Steps to reproduce: +1. Install qemu from Homebrew, which is built on macOS 15.4 +2. Run it on a machine with macOS < 15.4 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/294 b/results/classifier/mode-deepseek-r1:32b/output/system/294 new file mode 100644 index 00000000..b65d02c5 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/294 @@ -0,0 +1,3 @@ + + +Keyboard keys get stuck diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2942 b/results/classifier/mode-deepseek-r1:32b/output/system/2942 new file mode 100644 index 00000000..0d9e033c --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2942 @@ -0,0 +1,67 @@ + + +arm: TCG debug assertion failure when handling an ISB or SB insn inside an IT block +Description of problem: +ARM thumb `IT` instruction triggers TCG debug asserts. + +``` +$ ./qemu-system-arm --version +QEMU emulator version 10.0.0 (v10.0.0) + +$ ./qemu-system-arm -M stm32vldiscovery -nographic -device loader,file=raw-it-bug.hex -d in_asm,exec +[...] +Trace 0: 0x72a584000800 [00800400/0000000000000164/00000110/ff020000] +---------------- +IN: +0x00000108: f000 f80a bl #0x120 + +Trace 0: 0x72a584000940 [00800400/0000000000000108/00000110/ff020000] +qemu-system-arm: ../tcg/tcg-op.c:3343: void tcg_gen_goto_tb(unsigned int): Assertion `(tcg_ctx->goto_tb_issue_mask & (1 << idx)) == 0' failed. +``` + +Expected behavior: +``` +$ qemu-system-arm -M stm32vldiscovery -device loader,file=raw-hardfault.hex -d in_asm,exec,int +[...] +Trace 0: 0x7df6dc000800 [00800400/0000000000000164/00000110/ff020000] +---------------- +IN: +0x00000108: f000 f80a bl #0x120 + +Trace 0: 0x7df6dc000940 [00800400/0000000000000108/00000110/ff020000] +---------------- +IN: +0x00000120: 2302 movs r3, #2 +0x00000122: bf00 nop +0x00000124: f04f 25e0 mov.w r5, #-0x1fff2000 +0x00000128: f8d5 1d10 ldr.w r1, [r5, #0xd10] +0x0000012c: f041 0014 orr r0, r1, #0x14 +0x00000130: f8c5 0d10 str.w r0, [r5, #0xd10] +0x00000134: f8d5 0200 ldr.w r0, [r5, #0x200] +0x00000138: f8d5 6100 ldr.w r6, [r5, #0x100] +0x0000013c: 4206 tst r6, r0 +0x0000013e: bf02 ittt eq +0x00000140: f3bf 8f4f dsbeq sy +0x00000144: bf20 wfeeq + +Linking TBs 0x7df6dc000940 index 0 -> 0x7df6dc000a80 +Trace 0: 0x7df6dc000a80 [00800400/0000000000000120/00000110/ff020000] +[...] +Trace 0: 0x7df6dc001fc0 [00800400/0000000000000170/00000110/ff020000] +Taking exception 3 [Prefetch Abort] on CPU 0 +...at fault address 0xdeadbeee +...with CFSR.IACCVIOL +...BusFault with BFSR.STKERR +...taking pending nonsecure exception 3 +...loading from element 3 of non-secure vector table at 0xc +...loaded new PC 0x111 +---------------- +IN: +0x00000110: e7fe b #0x110 +``` +Steps to reproduce: +1. Build QEMU with `CONFIG_DEBUG_TCG` enabled, e.g. with `./configure --enable-debug`. +1. Run Cortex-M firmware with `IT` instruction. (minimal example attached) +Additional information: +- Minimal Reproducer: [raw-it-bug.hex](/uploads/3ae30ab78f49bbc933e48c51f6bf2a2b/raw-it-bug.hex) +- Reproduced on `main`, `v10.0.0` and `v9.1.0`. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2952 b/results/classifier/mode-deepseek-r1:32b/output/system/2952 new file mode 100644 index 00000000..a3c07a8b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2952 @@ -0,0 +1,16 @@ + + +Truncated bits while writing value to registers of RISC-V +Description of problem: +As mentioned above +Steps to reproduce: +``` +# 1. Compile the `test.S`: +riscv32-unknown-linux-gnu-gcc -g -static -nostartfiles -o test hello.S + +# 2. Execute the binary: +qemu-riscv32 ./test + +# 3. Check exit code +echo $? +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/296 b/results/classifier/mode-deepseek-r1:32b/output/system/296 new file mode 100644 index 00000000..b107c421 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/296 @@ -0,0 +1,3 @@ + + +Enabling OpenGL for GUI doesn't work on old laptop diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2964 b/results/classifier/mode-deepseek-r1:32b/output/system/2964 new file mode 100644 index 00000000..f001b212 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2964 @@ -0,0 +1,11 @@ + + +How to get the icount value after qemu terminal exit +Description of problem: + +Steps to reproduce: +1. +2. +3. +Additional information: +/label ~"kind::Bug" diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2969 b/results/classifier/mode-deepseek-r1:32b/output/system/2969 new file mode 100644 index 00000000..a7838941 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2969 @@ -0,0 +1,214 @@ + + +Raspberry Pi 4 Model B Rev 1.5 ("raspi4b"): No keyboard input after booting; "raspi3b" works +Description of problem: +I am using a `non-root` setup. + +# +Steps to reproduce: +1. Install `latest` QEMU version from `Master branch`. As of writing commit hash `757a34115e7491744a63dfc3d291fd1de5297ee2`: +```bash +$ ACCEPT_KEYWORDS="**" \ +USE="qemu_softmmu_targets_aarch64 qemu_softmmu_targets_x86_64 qemu_user_targets_aarch64 qemu_user_targets_x86_64 -ncurses slirp spice virtfs aio alsa bzip2 curl dock fdt filecaps gnutls jpeg oss pam pin-upstream-blobs png pulseaudio python_targets_python3_12 python_targets_python3_13 seccomp slirp spice udev usb vhost-net virtfs vnc xattr zstd" \ +emerge --oneshot =app-emulation/qemu-9999 +``` + +All `USE flags` can be found [below](#use-flags-app-emulationqemu). + +2. Install `slirp4netns`, `libslirp` and `tigervnc`: +```bash +$ USE="-opengl -server" emerge --oneshot =app-containers/slirp4netns-1.2.0 =net-libs/libslirp-4.7.0 =net-misc/tigervnc-1.15.0 +``` + +All `USE flags` can be found [below](#use-flags-net-misctigervnc). + +3. Prepare directory structure in the `current working directory`: +```bash +$ mkdir "rpi3_model_b/" "rpi4_model_b_rev1.5/" +``` + +4. Download `DTB` and `Kernel image files` from the [`Raspberry Pi firmware Git repository`](https://github.com/raspberrypi/firmware/tree/0ea28740607daed588912930379ed6ad40cfc4be/boot): +```bash +$ wget "https://github.com/raspberrypi/firmware/raw/0ea28740607daed588912930379ed6ad40cfc4be/boot/bcm2710-rpi-3-b.dtb" \ + --output-document="./rpi3_model_b/bcm2710-rpi-3-b_from_master_branch_0ea28740607daed588912930379ed6ad40cfc4be.dtb" +$ wget "https://github.com/raspberrypi/firmware/raw/0ea28740607daed588912930379ed6ad40cfc4be/boot/bcm2711-rpi-4-b.dtb" \ + --output-document="./rpi4_model_b_rev1.5/bcm2711-rpi-4-b_from_master_branch_0ea28740607daed588912930379ed6ad40cfc4be.dtb" +$ wget "https://github.com/raspberrypi/firmware/raw/0ea28740607daed588912930379ed6ad40cfc4be/boot/kernel8.img" \ + --output-document="./kernel8_from_master_branch_0ea28740607daed588912930379ed6ad40cfc4be.img" +``` + +5. Download, verify and extract `Raspberry Pi OS Lite` image files: +```bash +$ wget \ + "https://downloads.raspberrypi.com/raspios_lite_arm64/images/raspios_lite_arm64-2024-11-19/2024-11-19-raspios-bookworm-arm64-lite.img.xz" \ + "https://downloads.raspberrypi.com/raspios_lite_arm64/images/raspios_lite_arm64-2024-11-19/2024-11-19-raspios-bookworm-arm64-lite.img.xz.sha256" \ + "https://downloads.raspberrypi.com/raspios_lite_arm64/images/raspios_lite_arm64-2024-11-19/2024-11-19-raspios-bookworm-arm64-lite.img.xz.sig" \ + "https://downloads.raspberrypi.com/raspios_lite_arm64/images/raspios_lite_arm64-2025-05-13/2025-05-13-raspios-bookworm-arm64-lite.img.xz" \ + "https://downloads.raspberrypi.com/raspios_lite_arm64/images/raspios_lite_arm64-2025-05-13/2025-05-13-raspios-bookworm-arm64-lite.img.xz.sha256" \ + "https://downloads.raspberrypi.com/raspios_lite_arm64/images/raspios_lite_arm64-2025-05-13/2025-05-13-raspios-bookworm-arm64-lite.img.xz.sig" +$ sha256sum --check *.sha256 +2024-11-19-raspios-bookworm-arm64-lite.img.xz: OK +2025-05-13-raspios-bookworm-arm64-lite.img.xz: OK +$ for i in *.sig; do echo "${i}"; gpg --verify "${i}" "${i%\.sig}"; done +2024-11-19-raspios-bookworm-arm64-lite.img.xz.sig +gpg: Signature made Tue Nov 19 15:51:51 2024 CET +gpg: using RSA key 54C3DD610D9D1B4AF82A37758738CD6B956F460C +gpg: Good signature from "Raspberry Pi Downloads Signing Key" [full] +2025-05-13-raspios-bookworm-arm64-lite.img.xz.sig +gpg: Signature made Tue May 13 08:52:21 2025 CEST +gpg: using RSA key 54C3DD610D9D1B4AF82A37758738CD6B956F460C +gpg: Good signature from "Raspberry Pi Downloads Signing Key" [full] +$ for i in *.xz; do pixz -d "${i}"; done +$ LS_COLORS="" tree -FC --noreport +./ +├── 2024-11-19-raspios-bookworm-arm64-lite.img.xz.sha256 +├── 2024-11-19-raspios-bookworm-arm64-lite.img.xz.sig +├── 2024-11-19-raspios-bookworm-arm64-lite.img +├── 2025-05-13-raspios-bookworm-arm64-lite.img.xz.sha256 +├── 2025-05-13-raspios-bookworm-arm64-lite.img.xz.sig +├── 2025-05-13-raspios-bookworm-arm64-lite.img +├── kernel8_from_master_branch_0ea28740607daed588912930379ed6ad40cfc4be.img +├── rpi3_model_b/ +│ ├── bcm2710-rpi-3-b_from_master_branch_0ea28740607daed588912930379ed6ad40cfc4be.dtb +└── rpi4_model_b_rev1.5/ + └── bcm2711-rpi-4-b_from_master_branch_0ea28740607daed588912930379ed6ad40cfc4be.dtb +``` + +6. Grow `image size` to make it be a `power of 2`: +```bash +$ qemu-img resize -f raw "./2024-11-19-raspios-bookworm-arm64-lite.img" 4G +Image resized. +$ qemu-img resize -f raw "./2025-05-13-raspios-bookworm-arm64-lite.img" 4G +Image resized. +``` + +7. Get `DTB` and `Kernel images files` from the `Raspberry Pi OS image files`, prepare a `user` and `SSHD`: +```bash +$ losetup --find --partscan --show "./2024-11-19-raspios-bookworm-arm64-lite.img" +/dev/loop0 +$ mount "/dev/loop0p1" "/mnt/" +$ cp "/mnt/bcm2710-rpi-3-b.dtb" "./rpi3_model_b/bcm2710-rpi-3-b_2024-11-19.dtb" +$ cp "/mnt/bcm2711-rpi-4-b.dtb" "./rpi4_model_b_rev1.5/bcm2711-rpi-4-b_2024-11-19.dtb" +$ cp "/mnt/kernel8.img" "./kernel8_2024-11-19.img" +$ touch "/mnt/ssh" +$ echo "pi:$(openssl passwd -6)" > "/mnt/userconf" +Password: 1234 +Verifying - Password: 1234 +$ umount "/mnt/" +$ losetup --find --partscan --show "./2025-05-13-raspios-bookworm-arm64-lite.img" +/dev/loop1 +$ mount "/dev/loop1p1" "/mnt/" +$ cp "/mnt/bcm2710-rpi-3-b.dtb" "./rpi3_model_b/bcm2710-rpi-3-b_2025-05-13.dtb" +$ cp "/mnt/bcm2711-rpi-4-b.dtb" "./rpi4_model_b_rev1.5/bcm2711-rpi-4-b_2025-05-13.dtb" +$ cp "/mnt/kernel8.img" "./kernel8_2025-05-13.img" +$ touch "/mnt/ssh" +$ echo "pi:$(openssl passwd -6)" > "/mnt/userconf" +Password: 1234 +Verifying - Password: 1234 +$ umount "/mnt/" +$ losetup --list +NAME SIZELIMIT OFFSET AUTOCLEAR RO BACK-FILE DIO LOG-SEC +/dev/loop1 0 0 0 0 /home/<some_username>/qemu/2025-05-13-raspios-bookworm-arm64-lite.img 0 512 +/dev/loop0 0 0 0 0 /home/<some_username>/qemu/2024-11-19-raspios-bookworm-arm64-lite.img 0 512 +$ losetup --detach "/dev/loop0" "/dev/loop1" +$ losetup --list +$ LS_COLORS="" tree -FC --noreport +./ +├── 2024-11-19-raspios-bookworm-arm64-lite.img +├── 2024-11-19-raspios-bookworm-arm64-lite.img.xz.sha256 +├── 2024-11-19-raspios-bookworm-arm64-lite.img.xz.sig +├── 2025-05-13-raspios-bookworm-arm64-lite.img +├── 2025-05-13-raspios-bookworm-arm64-lite.img.xz.sha256 +├── 2025-05-13-raspios-bookworm-arm64-lite.img.xz.sig +├── kernel8_2024-11-19.img +├── kernel8_2025-05-13.img +├── kernel8_from_master_branch_0ea28740607daed588912930379ed6ad40cfc4be.img +├── rpi3_model_b/ +│ ├── bcm2710-rpi-3-b_2024-11-19.dtb +│ ├── bcm2710-rpi-3-b_2025-05-13.dtb +│ ├── bcm2710-rpi-3-b_from_master_branch_0ea28740607daed588912930379ed6ad40cfc4be.dtb +└── rpi4_model_b_rev1.5/ + ├── bcm2711-rpi-4-b_2024-11-19.dtb + ├── bcm2711-rpi-4-b_2025-05-13.dtb + └── bcm2711-rpi-4-b_from_master_branch_0ea28740607daed588912930379ed6ad40cfc4be.dtb +``` + +8. Execute the first `qemu-system-aarch64` command at `QEMU command line` [above](#host-environment): +```bash +$ qemu-system-aarch64 \ + -vnc "unix:/run/user/$(id --user)/qemu-vnc.sock" + [...] +``` + +8.1. Warnings will be returned: + +`raspi4b`: +```no-highlight +qemu-system-aarch64: warning: bcm2711 dtc: brcm,bcm2711-pcie has been disabled! +qemu-system-aarch64: warning: bcm2711 dtc: brcm,bcm2711-rng200 has been disabled! +qemu-system-aarch64: warning: bcm2711 dtc: brcm,bcm2711-thermal has been disabled! +qemu-system-aarch64: warning: bcm2711 dtc: brcm,bcm2711-genet-v5 has been disabled! +``` + +`raspi3b`: +```no-highlight +usbnet: failed control transaction: request 0x8006 value 0x600 index 0x0 length 0xa +usbnet: failed control transaction: request 0x8006 value 0x600 index 0x0 length 0xa +usbnet: failed control transaction: request 0x8006 value 0x600 index 0x0 length 0xa +``` + +9. Connect via `VNC` via `UNIX socket`: +```bash +$ vncviewer "/run/user/$(id --user)/qemu-vnc.sock" +``` + +10. Press and hold the `f key` or `right arrow` in the `tigervnc window`, even while booting. There should be **no** characters at all. For `raspi3b` there will be. + +11. Open the `QEMU console` via `CTRL+ALT+2`. + +11.1. Try to send a `reboot command`: +```bash +> sendkey ctrl-alt-delete +``` + +11.2. `Raspberry Pi OS` will **not** reboot or receive any keyboard inputs, but `raspi3b` will. + +12. Try to connect via `SSH` from `another shell`: +```bash +$ ssh -p 2222 pi@127.0.0.1 +``` + +12.1. The connection will time out: +```no-highlight +Connection timed out during banner exchange +Connection to 127.0.0.1 port 2222 timed out +``` + +12.2. `slirp4netns` will continuously return errors in the shell, where `qemu-system-aarch64` was executed: +```no-highlight +[...] +qemu-system-aarch64: Slirp: Failed to send packet, ret: -1 +qemu-system-aarch64: Slirp: Failed to send packet, ret: -1 +[...] +``` + +13. Go to the shell, where `qemu-system-aarch64` was executed and send a `SIGTERM (15)` signal to the process: +```no-highlight +Press CTRL+C +``` + +13.1. If this does not work, `terminate` the process form `another shell`: +```bash +$ ps aux | grep "qemu-system-aarch64" +<some_username> 24399 149 3.1 4265780 522276 pts/2 SNl+ 21:32 4:21 qemu-system-aarch64 -vnc unix:/run/user/[...] +$ kill -SIGTERM 24399 +``` + +13.2. In the worst case, `kill` the process in a dirty way: +```bash +$ kill -SIGKILL 24339 +``` + +14. Repeat step `8` to `13` with the next `qemu-system-aarch64` command at `QEMU command line` [above](#host-environment). `Keyboard inputs` will only work for `raspi3` and `SSH` only for number `4` and `6`. If keyboard inputs are possible, one can log in with the user `pi` and password `1234` or use the `QEMU console` (`CTRL+ALT+2`) to reboot: `sendkey ctrl-alt-delete`. +Additional information: +# diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/297 b/results/classifier/mode-deepseek-r1:32b/output/system/297 new file mode 100644 index 00000000..a13bce18 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/297 @@ -0,0 +1,3 @@ + + +SD card size constraint conceptually wrong diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2983 b/results/classifier/mode-deepseek-r1:32b/output/system/2983 new file mode 100644 index 00000000..1981fa5c --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2983 @@ -0,0 +1,117 @@ + + +qemu-system-riscv64 randomly turns MPP bits to 0 in the mstatus word. +Description of problem: +ToyOs runs the kernel in machine mode and user programs in user mode. This is specific choice on my part to make sure the kernel code runs with machine address and user code runs with virtual addresses. This is different than Linux, NetBSD or other OSes I know that run the kernel in supervisor mode. When running in machine mode and running kernel code, I get a a trap. My error message looks like this: + +PANIC: Unexpected trap from machine mode! + mepc = 0x800002a8, mcause = 2, mtval=0xe78023 mstatus=0xa00000080 + +Notice, the mstatus bits show the trap was due to a privileged instruction being run by a "user" mode instruction. In the "assignment version" used for the above, no user code was run. It was just multiple threads running in machine mode. Also, the trap function is run with the MPP bits of 0, so even trying to recover from this trap can't be done as trying to manipulate the mstatus will generate yet again another trap to the same place and still running in "user" mode. + +This change does not happen on every run. It happens more consistently recently when trying to debug the kernel with gdb. This must be a race condition somewhere. + +The kernel is written in C++ with C libraries. +Steps to reproduce: +1. You will need to have access to my kernel and possibly my code base. This is a code base that I want to stay at WWU (Western Washington University). +2. Give the command "bmake run". It often completes with no problems, but if you run it often enough it will generate this trap from "machine mode". The example above had four good runs with no errors and on the fifth run it blew up. There is not guaranteed way to get this to have a problem. (This is why I haven't reported it before, I kept trying to get a minimal code set that had the problem, but I couldn't do it.) +Additional information: +This is a bug has been a problem for several years. It didn't strike very often on some versions of qemu. I think one of the 7.x.x versions happened not too often. But with newer, faster machines and a different version of Linux, this bug has become a big problem for me and my students. + +Here is a sample bad run: (All compilation has been done before so this just makes sure everything is up-to-date and then runs qemu-system-riscv64. In this assignment, no user mode code is being run. Threads are all running in machine mode for the entire time. I am getting clock interrupts on the CPU, but that does not appear to be the problem.) + +$ bmake run +if ! [ -e toolbin ] ; then mkdir toolbin ; fi; +(cd tools; bmake install) +(cd toy_fs; bmake) +`toyfs' is up to date. +(cd mkdep; bmake) +`mkdep' is up to date. +(cd toy_fs; bmake install) +(cd mkdep; bmake install) +Making in /home/phil/447/csci447_s25/lib +Making in /home/phil/447/csci447_s25/kernel +`DISK' is up to date. +qemu-system-riscv64 -machine virt -bios none -m 1G -smp 1 -nographic -global virtio-mmio.force-legacy=false -drive file=DISK,if=none,format=raw,id=x0 -device virtio-blk-device,drive=x0,bus=virtio-mmio-bus.0 -kernel kernel/kernel -gdb tcp::27277 +Initializing scheduler ... +Initializing frame set... +Initializing thread set ... +Initializing process set ... +Initializing fcb set ... +Initializing OpenFile set ... +Initializing pipe set ... +Initializing vertio ... +Initializing filesystem ... +Starting os_main ... +PANIC: Unexpected trap from machine mode! + mepc = 0x800002a8, mcause = 2, mtval=0xe78023 mstatus=0xa00000080 +attach with gdb! +QEMU: Terminated + +$ riscv64-unknown-elf-addr2line -e kernel/kernel 0x800002a8 +/home/phil/447/csci447_s25/kernel/runtime.S:350 + +And that instruction turns out to be "mret", the return from the clock interrupt. + +The following is a error free run of this. + +$ bmake run +if ! [ -e toolbin ] ; then mkdir toolbin ; fi; +(cd tools; bmake install) +(cd toy_fs; bmake) +`toyfs' is up to date. +(cd mkdep; bmake) +`mkdep' is up to date. +(cd toy_fs; bmake install) +(cd mkdep; bmake install) +Making in /home/phil/447/csci447_s25/lib +Making in /home/phil/447/csci447_s25/kernel +`DISK' is up to date. +qemu-system-riscv64 -machine virt -bios none -m 1G -smp 1 -nographic -global virtio-mmio.force-legacy=false -drive file=DISK,if=none,format=raw,id=x0 -device virtio-blk-device,drive=x0,bus=virtio-mmio-bus.0 -kernel kernel/kernel -gdb tcp::27277 +Initializing scheduler ... +Initializing frame set... +Initializing thread set ... +Initializing process set ... +Initializing fcb set ... +Initializing OpenFile set ... +Initializing pipe set ... +Initializing vertio ... +Initializing filesystem ... +Starting os_main ... + +Welcome to Toy OS, hartid = 0 +Assignment 3 ... + +********** Frame Tester ********** +1.3.2.4.5.6.7.8.9.10.12.11.13.14.15.16.17.18.19.20.21.22.23.24.25.26.27.28.29.30.31.32.33.34.35.36.37.38.39.40.41.42.43.44.45.46.47.48.49.50.51.52.53.54.55.56.57.58.59.60.61.62.63.64.65.66.67.68.69.70.71.72.73.74.75.76.77.78.79.80.81.82.83.85.84.87.86.88.89.91.92.90.93.94.95.96.97.98.99.100.101.102.103.104.105.106.107.108.109.110.111.113.112.114.115.116.117.119.118.120.121.122.123.124.125.126.127.128.129.130.131.132.133.134.135.136.137.138.139.140.161.162.163.164.166.165.167.168.169.170.171.172.173.174.175.177.178.176.179.180.181.182.183.184.185.186.187.188.189.190.191.194.193.192.195.197.196.198.200.199.201.202.203.204.206.205.207.209.208.210.211.212.214.213.215.216.217.218.219.220.221.222.223.224.225.226.227.228.230.231.229.232.233.234.235.236.237.238.239.240.241.242.243.244.245.246.247.248.249.250.252.253.251.254.255.256.257.258.259.260.261.262.263.264.265.266.267.268.269.270.271.273.272.274.275.276.277.278.279.280.281.282.283.284.285.286.287.288.289.290.291.292.293.294.295.296.297.298.299.300.301.302.303.304.305.306.308.307.309.310.311.312.313.314.315.316.317.318.319.320.341.342.343.344.345.346.347.348.349.350.351.353.352.354.356.355.357.358.359.360.361.362.363.364.365.366.367.368.369.370.371.372.373.374.375.376.377.378.379.380.382.381.383.384.385.386.387.388.389.390.391.392.394.395.393.396.397.398.399.400.401.402.403.404.405.406.407.409.408.410.411.412.413.414.415.416.417.418.420.419.421.422.423.425.426.424.427.428.429.430.432.431.433.434.435.436.437.438.439.440.441.442.443.444.445.446.447.448.449.450.451.452.453.455.454.457.456.458.459.460.461.462.463.464.465.466.467.468.469.470.471.472.473.474.475.476.477.478.479.480.481.482.483.484.485.486.487.488.489.490.491.492.493.494.495.496.497.498.499.500.521.523.522.524.525.526.528.527.529.530.531.532.533.534.535.536.537.538.539.540.542.544.543.541.545.546.548.547.549.551.550.553.552.555.554.557.556.559.558.560.561.562.563.564.565.566.567.568.569.570.571.572.573.574.575.576.577.578.579.580.581.582.583.584.585.586.587.588.589.590.591.592.593.594.595.596.597.598.599.600.601.602.603.604.605.606.607.608.609.610.611.612.613.614.615.616.617.618.619.620.621.622.623.624.625.626.627.628.629.630.631.632.633.634.635.636.637.638.639.640.641.642.643.644.645.646.647.648.649.650.651.652.653.654.655.656.657.658.659.660.661.662.663.664.665.666.667.668.669.670.671.672.673.675.674.676.677.678.679.680.701.702.704.703.705.706.707.708.709.711.710.712.713.714.715.716.717.718.719.720.723.722.721.724.725.727.726.728.729.730.731.732.733.734.735.737.736.738.739.741.740.742.744.743.746.747.745.748.749.750.751.752.753.754.756.755.757.758.759.761.760.762.763.764.765.766.767.768.769.770.771.772.773.774.775.776.777.778.780.779.781.782.783.784.785.786.787.788.789.790.791.792.793.794.795.797.796.798.799.800.801.802.803.804.805.806.807.808.809.810.811.812.813.814.815.816.817.818.819.820.821.822.823.825.824.826.827.828.829.830.831.832.833.834.835.836.837.838.839.840.841.842.843.844.845.846.847.848.849.850.851.852.853.854.855.856.857.858.859.860.882.881.884.883.885.886.888.887.890.889.891.892.893.894.895.896.897.898.899.901.900.902.903.904.905.906.907.908.909.910.911.913.912.914.915.916.917.918.919.920.921.922.923.924.925.926.928.927.929.930.931.932.933.934.935.936.937.939.938.940.941.942.943.944.945.946.947.948.949.950.951.952.953.954.955.956.957.958.959.961.960.962.963.964.965.966.967.968.969.970.971.972.973.974.975.976.977.978.979.980.981.982.983.984.985.986.987.988.989.990.991.992.993.994.995.996.997.998.999.1000.1001.1002.1003.1004.1005.1006.1008.1007.1009.1010.1011.1012.1014.1013.1015.1016.1017.1018.1019.1020.1021.1022.1023.1024.1025.1026.1027.1028.1029.1030.1031.1032.1033.1034.1035.1036.1037.1038.1039.1040.1061.1062.1063.1065.1064.1066.1069.1067.1068.1070.1071.1072.1073.1074.1075.1076.1077.1078.1079.1080.1082.1081.1084.1083.1085.1086.1087.1088.1089.1090.1091.1093.1092.1094.1095.1097.1096.1098.1099.1100.1101.1102.1103.1104.1105.1106.1107.1109.1108.1110.1111.1112.1113.1114.1115.1117.1116.1118.1119.1120.1121.1122.1123.1124.1125.1126.1127.1128.1129.1130.1131.1132.1133.1134.1135.1136.1137.1138.1139.1140.1141.1142.1143.1144.1145.1146.1147.1148.1149.1150.1151.1152.1153.1154.1155.1156.1157.1158.1159.1160.1161.1162.1163.1164.1165.1166.1167.1168.1169.1170.1172.1171.1173.1174.1175.1176.1177.1178.1179.1180.1181.1182.1183.1184.1185.1186.1187.1188.1189.1190.1191.1192.1193.1194.1195.1196.1197.1198.1199.1201.1200.1202.1203.1204.1205.1207.1206.1208.1209.1210.1211.1212.1213.1214.1215.1216.1217.1218.1219.1220.1241.1242.1244.1243.1245.1246.1247.1248.1249.1251.1250.1252.1253.1254.1255.1256.1257.1258.1259.1260.1261.1262.1263.1264.1265.1266.1267.1269.1268.1270.1272.1271.1274.1273.1275.1276.1277.1278.1279.1280.1281.1283.1282.1284.1285.1287.1286.1288.1290.1289.1291.1292.1293.1294.1295.1296.1297.1299.1298.1300.1301.1302.1303.1304.1305.1306.1307.1308.1309.1310.1311.1312.1313.1315.1314.1316.1317.1318.1319.1320.1321.1322.1323.1324.1325.1326.1327.1328.1329.1330.1331.1332.1333.1335.1334.1336.1337.1338.1339.1340.1341.1342.1343.1344.1345.1346.1347.1348.1349.1350.1351.1352.1353.1354.1355.1356.1357.1358.1360.1361.1359.1362.1364.1363.1365.1366.1367.1370.1369.1368.1371.1372.1373.1375.1374.1376.1377.1378.1379.1380.1381.1382.1383.1384.1385.1386.1387.1388.1389.1390.1391.1392.1393.1394.1395.1396.1397.1398.1400.1401.1419.1422.1423.1424.1426.1425.1427.1428.1429.1431.1430.1432.1434.1435.1433.1437.1436.1438.1440.1439.1441.1447.1442.1443.1444.1445.1446.1448.1449.1450.1452.1453.1451.1454.1455.1456.1457.1459.1458.1461.1460.1462.1463.1464.1465.1466.1467.1468.1469.1470.1471.1472.1473.1474.1475.1476.1477.1478.1479.1480.1481.1482.1483.1484.1486.1485.1487.1488.1489.1490.1491.1492.1493.1494.1495.1496.1498.1497.1499.1500.1501.1502.1503.1504.1505.1506.1507.1508.1509.1510.1511.1512.1513.1514.1515.1516.1517.1519.1518.1520.1521.1522.1523.1524.1525.1526.1527.1528.1529.1530.1531.1532.1533.1534.1535.1536.1537.1538.1539.1540.1541.1542.1543.1544.1545.1547.1546.1548.1549.1550.1551.1553.1552.1554.1555.1556.1557.1558.1559.1560.1561.1562.1563.1564.1565.1566.1567.1568.1569.1570.1571.1572.1573.1574.1575.1576.1577.1578.1579.1581.1600.1602.1603.1604.1605.1607.1606.1608.1609.1610.1612.1611.1613.1614.1616.1615.1617.1618.1619.1622.1621.1620.1623.1624.1625.1626.1627.1628.1629.1630.1631.1632.1633.1635.1634.1636.1637.1638.1639.1640.1641.1642.1643.1644.1646.1645.1647.1648.1650.1649.1652.1651.1653.1654.1655.1656.1657.1658.1659.1660.1661.1663.1662.1664.1665.1666.1667.1668.1669.1670.1671.1672.1673.1674.1675.1676.1677.1678.1679.1680.1681.1682.1683.1685.1684.1686.1687.1688.1689.1691.1690.1692.1693.1694.1695.1696.1698.1697.1699.1700.1701.1702.1703.1704.1705.1706.1707.1708.1709.1710.1711.1713.1712.1714.1715.1717.1716.1718.1719.1720.1721.1722.1723.1724.1725.1726.1727.1728.1729.1730.1731.1732.1733.1734.1735.1736.1737.1738.1739.1740.1741.1742.1743.1744.1745.1746.1747.1748.1749.1751.1750.1752.1753.1754.1755.1756.1757.1758.1759.1762.1780.1781.1784.1785.1783.1787.1788.1786.1789.1790.1791.1792.1794.1793.1795.1796.1799.1797.1800.1798. +Frame 0, used 0x Frame 1, used 0x Frame 2, used 0x +Frame 3, used 438x Frame 4, used 435x Frame 5, used 429x +Frame 6, used 420x Frame 7, used 414x Frame 8, used 407x +Frame 9, used 396x Frame 10, used 391x Frame 11, used 386x +Frame 12, used 374x Frame 13, used 372x Frame 14, used 367x +Frame 15, used 361x Frame 16, used 353x Frame 17, used 345x +Frame 18, used 342x Frame 19, used 335x Frame 20, used 330x +Frame 21, used 329x Frame 22, used 325x Frame 23, used 319x +Frame 24, used 271x Frame 25, used 262x Frame 26, used 255x +Frame 27, used 141x Frame 28, used 108x Frame 29, used 95x +********** Test Done ********** + +********** Thread Tester ********** +3.4.5.6.7.8.9.10.11.12.13.14.15.16.17.18.19.2.22.20.30.31.24.21.23.25.26.32.27.33.39.40.41.28.29.35.34.36.42.44.48.49.50.37.51.38.45.46.52.55.57.43.58.60.53.61.62.56.63.65.67.68.47.70.71.64.72.73.74.69.54.77.78.59.81.82.75.83.76.85.79.86.89.91.92.84.93.66.87.80.94.96.98.101.102.103.95.88.104.97.99.105.108.110.111.112.113.100.114.107.115.109.117.119.120.122.106.116.124.125.90.126.129.130.131.132.133.127.134.135.128.136.138.139.141.142.143.144.123.145.140.146.148.149.151.153.152.154.118.147.156.121.159.160.161.162.163.157.164.150.137.166.169.170.171.172.158.174.167.175.155.176.178.173.181.182.168.183.184.179.185.165.187.177.188.189.186.180.190.192.191.193.195.196.197.194.198.199.200.201. +********** Test Done ********** + +********** Process Tester ********** +5.6.7.8.9.10.2.3.11.4.23.22.24.19.21.12.13.14.25.26.29.28.15.16.17.30.18.20.34.35.38.39.32.40.31.27.41.33.43.44.48.49.50.42.36.51.37.45.52.54.56.58.59.60.61.46.47.53.62.57.67.68.69.70.71.55.63.64.65.73.76.78.79.72.81.66.74.82.75.83.86.88.90.91.77.84.92.85.93.80.95.97.99.101.87.102.94.89.103.96.98.100.108.112.104.113.105.114.106.107.109.115.110.122.123.124.116.111.117.118.119.125.120.132.134.121.126.127.135.130.128.136.129.139.133.131.145.138.137.142.140.143.146.141.155.147.148.144.149.152.150.151.153.156.157.158.154.162.159.160.161.163.166.164.167.165.168.172.170.169.180.173.176.171.174.181.175.177.178.179.188.189.182.185.183.190.186.184.187.191.193.194.192.195.196.197.198.199.200.201. +********** Test Done ********** + +********** OpenFile Tester ********** +3.4.5.2.8.6.9.7.11.10.13.12.14.16.15.17.18.19.21.20.22.23.24.26.25.27.28.29.31.30.32.33.34.36.35.37.39.38.40.41.42.43.45.44.47.46.49.48.50.52.51.53.55.54.56.58.57.59.60.62.61.63.65.66.64.67.69.68.70.71.72.74.73.76.77.75.78.80.79.81.82.83.85.84.86.87.88.90.89.91.92.94.95.93.97.96.98.99.100.102.101.103.105.104.106.108.107.109.111.110.113.112.115.114.116.117.118.119.120.121.122.123.124.125.126.127.128.129.130.131.132.133.134.135.136.138.137.139.140.141.142.143.144.145.146.147.148.149.150.152.151.153.154.155.156.157.158.159.160.161.162.163.164.166.165.167.168.169.170.172.171.173.174.176.175.177.178.180.179.181.183.182.185.184.186.187.188.189.190.191.192.194.193.195.197.196.198.199.200.201. +********** Test Done ********** + +********** FileControlBlock Tester ********** +2.3.4.5.6.7.8.9.10.2!W1.3!W2.5!W3.4!W4.6!W5.7!W6.8!W7.9!W8.10!F12.2!12.3!W1.12.5!W2.12.W3.12.12.12.12.12.10!4!W4.6!W5.7!9!W6.W7.8!W8.F12.12.12.20.12.12.12.20.12.12.12.20.20.20.20.20.20.20. +********** Test Done ********** + +All Assignment 3 tests done. + +I call this a "heisenbug" as I never know when it will strike and stop ToyOS from running. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2984 b/results/classifier/mode-deepseek-r1:32b/output/system/2984 new file mode 100644 index 00000000..7ff77da1 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2984 @@ -0,0 +1,55 @@ + + +CPU hotplug crashed the guest when using virt-type as qemu! +Description of problem: +Guest is getting crashing and getting into shutoff state when I am trying to hotplug much more cpus than present in the host! This is happening only when i give virt-type as qemu. +Additional information: +Tried reproducing while attaching gdb shows below backtrace which happened after hotplugging 249 CPUs in TCG mode: + +``` +Thread 261 "CPU 249/TCG" received signal SIGABRT, Aborted. +[Switching to Thread 0x7ff97c00ea20 (LWP 51567)] +0x00007fff84cac3e8 in __pthread_kill_implementation () from target:/lib64/glibc-hwcaps/power10/libc.so.6 +(gdb) bt +#0 0x00007fff84cac3e8 in __pthread_kill_implementation () from target:/lib64/glibc-hwcaps/power10/libc.so.6 +#1 0x00007fff84c46ba0 in raise () from target:/lib64/glibc-hwcaps/power10/libc.so.6 +#2 0x00007fff84c29354 in abort () from target:/lib64/glibc-hwcaps/power10/libc.so.6 +#3 0x00007fff850f1e30 in g_assertion_message () from target:/lib64/libglib-2.0.so.0 +#4 0x00007fff850f1ebc in g_assertion_message_expr () from target:/lib64/libglib-2.0.so.0 +#5 0x00000001376c6f00 in tcg_region_initial_alloc__locked (s=0x7fff7c000f30) at ../tcg/region.c:396 +#6 0x00000001376c6fa8 in tcg_region_initial_alloc (s=0x7fff7c000f30) at ../tcg/region.c:402 +#7 0x00000001376dae08 in tcg_register_thread () at ../tcg/tcg.c:1011 +#8 0x000000013768b7e4 in mttcg_cpu_thread_fn (arg=0x143e884f0) at ../accel/tcg/tcg-accel-ops-mttcg.c:77 +#9 0x0000000137bbb2d0 in qemu_thread_start (args=0x143b4aff0) at ../util/qemu-thread-posix.c:542 +#10 0x00007fff84ca9be0 in start_thread () from target:/lib64/glibc-hwcaps/power10/libc.so.6 +#11 0x00007fff84d4ef3c in __clone3 () from target:/lib64/glibc-hwcaps/power10/libc.so.6 +(gdb) +``` + +which points to below code: + +``` +/* + * Perform a context's first region allocation. + * This function does _not_ increment region.agg_size_full. + */ +static void tcg_region_initial_alloc__locked(TCGContext *s) +{ + bool err = tcg_region_alloc__locked(s); + g_assert(!err); +} +``` + +Here, tcg_region_alloc__locked returns true on failure when max region allocation is reached and therefore intentionally asserted as TCG can't proceed without it. + +``` +static bool tcg_region_alloc__locked(TCGContext *s) +{ + if (region.current == region.n) { + return true; + } + tcg_region_assign(s, region.current); + region.current++; + return false; +} +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2986 b/results/classifier/mode-deepseek-r1:32b/output/system/2986 new file mode 100644 index 00000000..0e363941 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2986 @@ -0,0 +1,3 @@ + + +ARM register DBGDTR_EL0 incorrectly causes undefined exception diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/2987 b/results/classifier/mode-deepseek-r1:32b/output/system/2987 new file mode 100644 index 00000000..25326d62 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/2987 @@ -0,0 +1,9 @@ + + +QEMU TCG failed to boot Windows 98 Second Edition +Description of problem: +QEMU TCG failed at booting Windows 98 Second Edition 4.10.2222B. + +Bisected to commit e54ef98c8a80d16158bab4341d9a898701270528 +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/299 b/results/classifier/mode-deepseek-r1:32b/output/system/299 new file mode 100644 index 00000000..33bf370f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/299 @@ -0,0 +1,3 @@ + + +Tulip NIC not working on OpenBSD/hppa (and more) diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/304 b/results/classifier/mode-deepseek-r1:32b/output/system/304 new file mode 100644 index 00000000..8f06b934 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/304 @@ -0,0 +1,3 @@ + + +assertion failure in mptsas1068 emulator diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/304636 b/results/classifier/mode-deepseek-r1:32b/output/system/304636 new file mode 100644 index 00000000..4fd46663 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/304636 @@ -0,0 +1,39 @@ + + +-hda FAT:. limited to 504MBytes + +Binary package hint: qemu + +The size of the virtual FAT file system (for sharing a particular directory with Guest OS) is hard-coded to be limited to 504MBytes, in block-vvfat.c +-- +/* 504MB disk*/ +bs->cyls=1024; bs->heads=16; bs->secs=63; +-- + +If the directory contents exceeds this is stops with an assert +-- +qemu: block-vvfat.c:97: array_get: Assertion `index < array->next' failed. +Aborted +-- + +Also the FAT16 mode (default) only uses 8KByte cluster sizes which prevents the above being increased. 16KByte and 32KByte sectors can be selected with the following patch +-- +--- block-vvfat.c_orig 2008-12-02 12:37:28.000000000 -0700 ++++ block-vvfat.c 2008-12-02 19:50:35.000000000 -0700 +@@ -1042,6 +1042,12 @@ + s->fat_type = 32; + } else if (strstr(dirname, ":16:")) { + s->fat_type = 16; ++ } else if (strstr(dirname, ":16-16K:")) { ++ s->fat_type = 16; ++ s->sectors_per_cluster=0x20; ++ } else if (strstr(dirname, ":16-32K:")) { ++ s->fat_type = 16; ++ s->sectors_per_cluster=0x40; + } else if (strstr(dirname, ":12:")) { + s->fat_type = 12; + s->sector_count=2880; +-- + +Cheers, +Mungewell \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/305 b/results/classifier/mode-deepseek-r1:32b/output/system/305 new file mode 100644 index 00000000..bcb3925e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/305 @@ -0,0 +1,3 @@ + + +assertion failure in lsi53c810 emulator diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/313 b/results/classifier/mode-deepseek-r1:32b/output/system/313 new file mode 100644 index 00000000..3c4fe368 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/313 @@ -0,0 +1,3 @@ + + +-daemonize not working on macOS diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/314 b/results/classifier/mode-deepseek-r1:32b/output/system/314 new file mode 100644 index 00000000..ee062b92 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/314 @@ -0,0 +1,3 @@ + + +qemu-user vm86() segfaults handling interrupt with ss:sp in same page as cs:ip diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/315 b/results/classifier/mode-deepseek-r1:32b/output/system/315 new file mode 100644 index 00000000..3d1a5e32 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/315 @@ -0,0 +1,3 @@ + + +3d accel does not take care of 1280x960 setting diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/318 b/results/classifier/mode-deepseek-r1:32b/output/system/318 new file mode 100644 index 00000000..952b45d6 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/318 @@ -0,0 +1,3 @@ + + +QEMU crash after a QuickBASIC program integer overflow diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/319 b/results/classifier/mode-deepseek-r1:32b/output/system/319 new file mode 100644 index 00000000..e3808c92 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/319 @@ -0,0 +1,3 @@ + + +Openjdk11+ fails to install on s390x diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/320 b/results/classifier/mode-deepseek-r1:32b/output/system/320 new file mode 100644 index 00000000..5a7670cd --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/320 @@ -0,0 +1,3 @@ + + +Corsair iCUE Install Fails, qemu VM Reboots diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/325 b/results/classifier/mode-deepseek-r1:32b/output/system/325 new file mode 100644 index 00000000..85aab5bd --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/325 @@ -0,0 +1,3 @@ + + +Latest QEMU crashes when switching color depth of ReactOS diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/327 b/results/classifier/mode-deepseek-r1:32b/output/system/327 new file mode 100644 index 00000000..76a707aa --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/327 @@ -0,0 +1,3 @@ + + +Storage | Two decimal digits precision diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/329 b/results/classifier/mode-deepseek-r1:32b/output/system/329 new file mode 100644 index 00000000..6ad8171e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/329 @@ -0,0 +1,3 @@ + + +qemu 6.0.0 fails to build with clang-11 and --enable-debug diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/330 b/results/classifier/mode-deepseek-r1:32b/output/system/330 new file mode 100644 index 00000000..ccb99a3e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/330 @@ -0,0 +1,3 @@ + + +TCG does not support x2APIC emulation diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/334 b/results/classifier/mode-deepseek-r1:32b/output/system/334 new file mode 100644 index 00000000..cab69331 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/334 @@ -0,0 +1,3 @@ + + +macOS App Nap feature gradually freezes QEMU process diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/335 b/results/classifier/mode-deepseek-r1:32b/output/system/335 new file mode 100644 index 00000000..6afd44ee --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/335 @@ -0,0 +1,3 @@ + + +Broken tap networking on macOS host diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/340 b/results/classifier/mode-deepseek-r1:32b/output/system/340 new file mode 100644 index 00000000..37167860 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/340 @@ -0,0 +1,3 @@ + + +qemu: uncaught target signal 6 (Aborted) - core dumped on Apple Silicon M1 arm64 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/342 b/results/classifier/mode-deepseek-r1:32b/output/system/342 new file mode 100644 index 00000000..8cf48fed --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/342 @@ -0,0 +1,3 @@ + + +Assertion `child->perm & BLK_PERM_WRITE' failed in bdrv_co_write_req_prepare through atapi diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/343 b/results/classifier/mode-deepseek-r1:32b/output/system/343 new file mode 100644 index 00000000..52580885 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/343 @@ -0,0 +1,3 @@ + + +madvise reports success, but doesn't implement WIPEONFORK. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/346 b/results/classifier/mode-deepseek-r1:32b/output/system/346 new file mode 100644 index 00000000..4f38f329 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/346 @@ -0,0 +1,3 @@ + + +Guest refuses to accept keyboard input when accelerated with WHPX diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/349 b/results/classifier/mode-deepseek-r1:32b/output/system/349 new file mode 100644 index 00000000..5e40c332 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/349 @@ -0,0 +1,3 @@ + + +USB folder sharing causing segment fault diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/352 b/results/classifier/mode-deepseek-r1:32b/output/system/352 new file mode 100644 index 00000000..61dc8686 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/352 @@ -0,0 +1,3 @@ + + +audio input crack diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/353 b/results/classifier/mode-deepseek-r1:32b/output/system/353 new file mode 100644 index 00000000..da77c0cd --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/353 @@ -0,0 +1,3 @@ + + +video capture, slowness diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/361 b/results/classifier/mode-deepseek-r1:32b/output/system/361 new file mode 100644 index 00000000..d4c0c3e2 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/361 @@ -0,0 +1,3 @@ + + +-cpu host results in unsupported AVX512 instructions diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/362 b/results/classifier/mode-deepseek-r1:32b/output/system/362 new file mode 100644 index 00000000..203cf450 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/362 @@ -0,0 +1,3 @@ + + +check of PMR capability is missing for PMRCTL register write diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/367 b/results/classifier/mode-deepseek-r1:32b/output/system/367 new file mode 100644 index 00000000..ac801a3b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/367 @@ -0,0 +1,3 @@ + + +qemu-system-aarch64 crash on qemu 6.0 - Windows 10 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/369 b/results/classifier/mode-deepseek-r1:32b/output/system/369 new file mode 100644 index 00000000..c920b810 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/369 @@ -0,0 +1,3 @@ + + +Remove leading underscores from #defines diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/371 b/results/classifier/mode-deepseek-r1:32b/output/system/371 new file mode 100644 index 00000000..e5483649 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/371 @@ -0,0 +1,3 @@ + + +Indentation should be done with spaces, not with TABs, in the block subsystem diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/372 b/results/classifier/mode-deepseek-r1:32b/output/system/372 new file mode 100644 index 00000000..4a52f387 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/372 @@ -0,0 +1,3 @@ + + +Indentation should be done with spaces, not with TABs, in the TCG / CPU subsystem diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/374 b/results/classifier/mode-deepseek-r1:32b/output/system/374 new file mode 100644 index 00000000..9e188c0f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/374 @@ -0,0 +1,3 @@ + + +Indentation should be done with spaces, not with TABs, in the PPC subsystem diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/377 b/results/classifier/mode-deepseek-r1:32b/output/system/377 new file mode 100644 index 00000000..f6b49d14 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/377 @@ -0,0 +1,3 @@ + + +Indentation should be done with spaces, not with TABs, in the net subsystem diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/380 b/results/classifier/mode-deepseek-r1:32b/output/system/380 new file mode 100644 index 00000000..d8e50bee --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/380 @@ -0,0 +1,3 @@ + + +Windows 7 fails to boot diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/387 b/results/classifier/mode-deepseek-r1:32b/output/system/387 new file mode 100644 index 00000000..c983bb4d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/387 @@ -0,0 +1,3 @@ + + +SD-Card not working anymore on x86 targets diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/388 b/results/classifier/mode-deepseek-r1:32b/output/system/388 new file mode 100644 index 00000000..12bc41e4 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/388 @@ -0,0 +1,3 @@ + + +Can not pass hw device names as alsa input and output devices diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/389 b/results/classifier/mode-deepseek-r1:32b/output/system/389 new file mode 100644 index 00000000..7236e5ae --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/389 @@ -0,0 +1,3 @@ + + +Add multiboot2 support diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/393 b/results/classifier/mode-deepseek-r1:32b/output/system/393 new file mode 100644 index 00000000..fe787bd3 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/393 @@ -0,0 +1,3 @@ + + +tests/vm: Warn when cross-build VM is run with TCG accelerator diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/394 b/results/classifier/mode-deepseek-r1:32b/output/system/394 new file mode 100644 index 00000000..40766c1c --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/394 @@ -0,0 +1,3 @@ + + +Windows 7 crashing due to PAGE_FAULT_IN_NONPAGED_AREA diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/395 b/results/classifier/mode-deepseek-r1:32b/output/system/395 new file mode 100644 index 00000000..c6ec3316 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/395 @@ -0,0 +1,3 @@ + + +Write a python style guide document diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/397 b/results/classifier/mode-deepseek-r1:32b/output/system/397 new file mode 100644 index 00000000..60c327d4 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/397 @@ -0,0 +1,3 @@ + + +Cannot run qemu at all diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/399 b/results/classifier/mode-deepseek-r1:32b/output/system/399 new file mode 100644 index 00000000..8f07c0c3 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/399 @@ -0,0 +1,3 @@ + + +drive-backup job hangs in a 'paused' state after unsuccessful first attempt diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/401 b/results/classifier/mode-deepseek-r1:32b/output/system/401 new file mode 100644 index 00000000..c373f2d0 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/401 @@ -0,0 +1,3 @@ + + +Wishlist: nvme-ns: allow specifying eui-64 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/403 b/results/classifier/mode-deepseek-r1:32b/output/system/403 new file mode 100644 index 00000000..21020331 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/403 @@ -0,0 +1,3 @@ + + +MTE false positives for unaligned accesses diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/404 b/results/classifier/mode-deepseek-r1:32b/output/system/404 new file mode 100644 index 00000000..dc89074f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/404 @@ -0,0 +1,3 @@ + + +Windows XP takes much longer to boot in TCG mode since 5.0 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/409 b/results/classifier/mode-deepseek-r1:32b/output/system/409 new file mode 100644 index 00000000..d75daa1d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/409 @@ -0,0 +1,3 @@ + + +tar can only read 4096 bytes from some files on 9p diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/410 b/results/classifier/mode-deepseek-r1:32b/output/system/410 new file mode 100644 index 00000000..601d5da2 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/410 @@ -0,0 +1,3 @@ + + +Abort in audio_bug triggered in sb16/pl041 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/411 b/results/classifier/mode-deepseek-r1:32b/output/system/411 new file mode 100644 index 00000000..a6405838 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/411 @@ -0,0 +1,3 @@ + + +Abort when runs into unsupported AUXCommand in xlnx_dp_aux_set_command diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/414 b/results/classifier/mode-deepseek-r1:32b/output/system/414 new file mode 100644 index 00000000..c3e780dd --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/414 @@ -0,0 +1,3 @@ + + +Error handling: Use &error_abort instead of NULL for errp parameters for may-not-fail invocations diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/415 b/results/classifier/mode-deepseek-r1:32b/output/system/415 new file mode 100644 index 00000000..4e957ece --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/415 @@ -0,0 +1,3 @@ + + +Error handling: Use TFR() macro where applicable diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/420 b/results/classifier/mode-deepseek-r1:32b/output/system/420 new file mode 100644 index 00000000..2e6c42db --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/420 @@ -0,0 +1,3 @@ + + +Some x86_64 SSE operations have incorrect/erratic behaviours diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/435 b/results/classifier/mode-deepseek-r1:32b/output/system/435 new file mode 100644 index 00000000..38365fc8 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/435 @@ -0,0 +1,3 @@ + + +RISC-V: Support more cores diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/436 b/results/classifier/mode-deepseek-r1:32b/output/system/436 new file mode 100644 index 00000000..3efc5d4f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/436 @@ -0,0 +1,3 @@ + + +window 8 stuck during boot on Qemu diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/439 b/results/classifier/mode-deepseek-r1:32b/output/system/439 new file mode 100644 index 00000000..202172a3 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/439 @@ -0,0 +1,3 @@ + + +Hard crash - qemu-6.0.0 with windows 10 guest diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/441 b/results/classifier/mode-deepseek-r1:32b/output/system/441 new file mode 100644 index 00000000..4229a347 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/441 @@ -0,0 +1,3 @@ + + +qemu-img: "Could not open backing image to determine size" when backing image is encrypted diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/443 b/results/classifier/mode-deepseek-r1:32b/output/system/443 new file mode 100644 index 00000000..0161d202 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/443 @@ -0,0 +1,3 @@ + + +QEMU on Windows aarch64 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/444 b/results/classifier/mode-deepseek-r1:32b/output/system/444 new file mode 100644 index 00000000..699bba84 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/444 @@ -0,0 +1,3 @@ + + +EFI stub: ERROR: This 64 KB granular kernel is not supported by your CPU diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/446 b/results/classifier/mode-deepseek-r1:32b/output/system/446 new file mode 100644 index 00000000..c9fa6d43 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/446 @@ -0,0 +1,3 @@ + + +usb-audio does not work with Mac OS diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/448 b/results/classifier/mode-deepseek-r1:32b/output/system/448 new file mode 100644 index 00000000..c8165988 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/448 @@ -0,0 +1,3 @@ + + +raspi0 machine leads to kernel panic of latest raspberry pi os kernel diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/455 b/results/classifier/mode-deepseek-r1:32b/output/system/455 new file mode 100644 index 00000000..c46d2183 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/455 @@ -0,0 +1,36 @@ + + +Pressing special keys (specially ctrl) sticks the key or makes it repeat the next key until ESC or Ctrl is pressed. +Description of problem: +Well, I'm using it in a daily basis, since it is my VM to isolate the environment for work. + +It was compiled from source for _jack_ support, the only thing that I cared about. I'll be honest : I don't remember the special parameters, nothing unusual though. I'm not in the need for _rt_ kernels. + +When I press `Ctrl` and sometimes when I press other special keys, one of the three options occur : +1. It repeats all the keys pressed next, like if I was pressing it for a long time. + - Example : `a` turns into `aaaaaaaaaaaaaaa...`(continues) + - It repeats until I press `Esc` or `Ctrl` again. +1. `Ctrl` continues as pressed and everything I type occurs with `Ctrl`. + - Example : `a` turns into `Ctrl-A` + - Probably caused by the previous option. +1. It does what is expected, like `Ctrl-C` +Steps to reproduce: +1. Run the specified config. +1. Test `Ctrl-C` + `Ctrl-V` using text editors. + - I think that using a graphical one is faster to see it happening. + - Examples + - Atom + - Eclipse + - Kate + - VsCode + - It also occurred using a _pty_ but since I generally use the _middle-mouse-button_ with _ptys_. + - I'm not aware of the frequency that it happens. + - It also occurs with the mouse (`Ctrl-mouseclick`). + - For example: instead of going to a _Firefox_'s tab, it selects it. + +I don't know any other step here, the use case is trivial coding. +Additional information: +- I have already tried to disable "keyboard repeat" in config. + - At first it seems to work but the `Ctrl` key can get stuck like in the description and then I'm unable to get out of it (everything is sent as if it was with `Ctrl`) without pressing `Ctrl`+`ESC`. I have no idea of why. + - The problem seems to occur less frequently. +- It also happened before setting up `qemu-guest-agent`. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/457 b/results/classifier/mode-deepseek-r1:32b/output/system/457 new file mode 100644 index 00000000..22eb6965 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/457 @@ -0,0 +1,3 @@ + + +qemu-system-s390x segfaults in do_tb_phys_invalidate at ../accel/tcg/translate-all.c:1482 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/458 b/results/classifier/mode-deepseek-r1:32b/output/system/458 new file mode 100644 index 00000000..4fd9aa17 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/458 @@ -0,0 +1,3 @@ + + +Xfer:features:read truncating xml sent to gdb frontends diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/46 b/results/classifier/mode-deepseek-r1:32b/output/system/46 new file mode 100644 index 00000000..54f3f9e6 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/46 @@ -0,0 +1,3 @@ + + +Investigate suitibility of GitLab Issue Tracker for QEMU diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/461 b/results/classifier/mode-deepseek-r1:32b/output/system/461 new file mode 100644 index 00000000..e8608935 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/461 @@ -0,0 +1,3 @@ + + +What's your plan of Raspberry 3/3B/4B diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/463 b/results/classifier/mode-deepseek-r1:32b/output/system/463 new file mode 100644 index 00000000..af0e4b69 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/463 @@ -0,0 +1,27 @@ + + +[Build][git]Build process stop in libqemuutil.a.p/qobject_json-streamer.c.o +Description of problem: +Hello. + +I tried qemu to get build with revision 9aef0954195cc592e86846dbbe7f3c2c5603690a but it stops really quick at task 238/9335. + +Here is the beginning of the error log: + +``` +[238/9335] Compiling C object libqemuutil.a.p/qobject_json-streamer.c.o +FAILED: libqemuutil.a.p/qobject_json-streamer.c.o +cc -Ilibqemuutil.a.p -I. -I.. -Isubprojects/libvhost-user -I../subprojects/libvhost-user -Itrace -Iqapi -Iui -Iui/shader -I/usr/include/p11-kit-1 -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/include/libmount -I/usr/include/blkid -I/usr/include/gio-unix-2.0 -I/usr/include/pixman-1 -fdiagnostics-color=auto -pipe -Wall -Winvalid-pch -std=gnu11 -O2 -g -isystem /build/qemu-git/src/qemu/linux-headers -isystem linux-headers -iquote . -iquote /build/qemu-git/src/qemu -iquote /build/qemu-git/src/qemu/include -iquote /build/qemu-git/src/qemu/disas/libvixl -iquote /build/qemu-git/src/qemu/tcg/i386 -pthread -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -m64 -mcx16 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -fno-common -fwrapv -Wold-style-declaration -Wold-style-definition -Wtype-limits -Wformat-security -Wformat-y2k -Winit-self -Wignored-qualifiers -Wempty-body -Wnested-externs -Wendif-labels -Wexpansion-to-defined -Wimplicit-fallthrough=2 -Wno-missing-include-dirs -Wno-shift-negative-value -Wno-psabi -fstack-protector-strong -march=x86-64 -mtune=generic -O2 -fno-plt -fexceptions -Wp,-D_FORTIFY_SOURCE=2 -Wformat -Werror=format-security -fstack-clash-protection -fcf-protection -fPIC -MD -MQ libqemuutil.a.p/qobject_json-streamer.c.o -MF libqemuutil.a.p/qobject_json-streamer.c.o.d -o libqemuutil.a.p/qobject_json-streamer.c.o -c ../qobject/json-streamer.c +In file included from ../qobject/json-streamer.c:14: +/build/qemu-git/src/qemu/include/qemu/osdep.h:259:58: error: operator '&&' has no right operand + 259 | #if defined(HAVE_BROKEN_SIZE_MAX) && HAVE_BROKEN_SIZE_MAX + | +``` +Steps to reproduce: +1. Grab qemu-git code at commit 9aef0954195cc592e86846dbbe7f3c2c5603690a +2. use these configure options: --prefix=/usr --sysconfdir=/etc --localstatedir=/var --libexecdir=/usr/lib/qemu --smbd=/usr/bin/smbd --enable-modules --enable-sdl --disable-werror --enable-vhost-user --enable-slirp=system --enable-xfsctl --audio-drv-list="pa alsa sdl" +3. run building process. +Additional information: +Attaching full build log. + +I'm using gcc 11.1.0. My last complete build was based on commit 9bef7ea9 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/47 b/results/classifier/mode-deepseek-r1:32b/output/system/47 new file mode 100644 index 00000000..60e91b07 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/47 @@ -0,0 +1,3 @@ + + +A typo in target/riscv/insn32-64.decode diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/476 b/results/classifier/mode-deepseek-r1:32b/output/system/476 new file mode 100644 index 00000000..be64b69e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/476 @@ -0,0 +1,3 @@ + + +QEMU with x86-64 EFI disk image and 'nographic' option crashes WSL2 window diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/481 b/results/classifier/mode-deepseek-r1:32b/output/system/481 new file mode 100644 index 00000000..8c98d46b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/481 @@ -0,0 +1,3 @@ + + +Implement I2C for BCM2835 (raspi) diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/482 b/results/classifier/mode-deepseek-r1:32b/output/system/482 new file mode 100644 index 00000000..27477d10 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/482 @@ -0,0 +1,3 @@ + + +Unable to set SVE VL to 1024 bits or above since 7b6a2198 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/484 b/results/classifier/mode-deepseek-r1:32b/output/system/484 new file mode 100644 index 00000000..36614a40 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/484 @@ -0,0 +1,3 @@ + + +6.1 Regression: machine pflash parsing diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/486 b/results/classifier/mode-deepseek-r1:32b/output/system/486 new file mode 100644 index 00000000..3bcd2566 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/486 @@ -0,0 +1,3 @@ + + +/dev/input/mouse0: is not an evdev device diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/487 b/results/classifier/mode-deepseek-r1:32b/output/system/487 new file mode 100644 index 00000000..ad4144e3 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/487 @@ -0,0 +1,3 @@ + + +sdhci: out of bounds read on sd->sd_status diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/489 b/results/classifier/mode-deepseek-r1:32b/output/system/489 new file mode 100644 index 00000000..e3738554 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/489 @@ -0,0 +1,39 @@ + + +Assertion raised when hitting gdb break point in qemu-system-avr +Description of problem: +An assertion is triggered when inserting a break point via gdb and continuing from gdb until hitting the break point: +``` +./qemu-system-avr -nographic -machine uno -s -S -bios simpletest.bin +Starting up... +qemu-system-avr: ../accel/tcg/translate-all.c:1476: tb_gen_code: Assertion `tb->size != 0' failed. +Aborted (core dumped) +``` +The matching gdb session: +``` +~/gdb/gdb-10.1-OK/gdb/avr-gdb +GNU gdb (GDB) 10.1 +[snipped copyright notice ] +(gdb) tar rem :1234 +Remote debugging using :1234 +warning: Target-supplied registers are not supported by the current architecture +warning: No executable has been specified and target does not support +determining executable automatically. Try using the "file" command. +0x00000000 in ?? () +(gdb) b *0xb2 +Breakpoint 1 at 0xb2 +(gdb) c +Continuing. +Remote connection closed +(gdb) +``` +Steps to reproduce: +1. Start qemu with command line given in description above +2. Connect to qemu session using avr-gdb, also given in description. +3. From avr-gdb, place a break point somewhere in code, then continue +4. When qemu reaches break point, an assertion is raised +Additional information: +1. When running without a break point there is no assertion +2. Problem appears to be triggered only when inserted break point is hit. +3. Stepping in gdb works +4. This problem isn't evident in qemu 6.0.0 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/491 b/results/classifier/mode-deepseek-r1:32b/output/system/491 new file mode 100644 index 00000000..b3074e13 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/491 @@ -0,0 +1,3 @@ + + +There is a code error here diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/495 b/results/classifier/mode-deepseek-r1:32b/output/system/495 new file mode 100644 index 00000000..4a789780 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/495 @@ -0,0 +1,3 @@ + + +sdhci: Another way to trigger Assertion wpnum < sd->wpgrps_size failed diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/496 b/results/classifier/mode-deepseek-r1:32b/output/system/496 new file mode 100644 index 00000000..a92b5fb1 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/496 @@ -0,0 +1,15 @@ + + +qemu-system-aarch64: ../accel/tcg/cpu-exec.c:681: cpu_loop_exec_tb: Assertion 'icount_enabled()' failed +Description of problem: +When I use qemu-system-aarch64 start a Debian(ARM64) on a mips64el host(ARM64 and X86_64 host don't have this bug), I get a bug as follows: + + +`qemu-system-aarch64: ../accel/tcg/cpu-exec.c:681: cpu_loop_exec_tb: Assertion 'icount_enabled()' failed` + + +The crash code is in ../accel/tcg/cpu-exec.c:681, the code in qemu v5.2.0 as follows: + + +``` +# diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/500 b/results/classifier/mode-deepseek-r1:32b/output/system/500 new file mode 100644 index 00000000..cf5e865f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/500 @@ -0,0 +1,3 @@ + + +6.1.0-rc0 Regression: Parameter 'audiodev' is missing diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/501 b/results/classifier/mode-deepseek-r1:32b/output/system/501 new file mode 100644 index 00000000..3c22720d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/501 @@ -0,0 +1,3 @@ + + +6.1.0-rc0 Regression: No keyboard input possible diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/502 b/results/classifier/mode-deepseek-r1:32b/output/system/502 new file mode 100644 index 00000000..557fc98a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/502 @@ -0,0 +1,3 @@ + + +6.1.0-rc0 Regression: No mouse input possible diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/503 b/results/classifier/mode-deepseek-r1:32b/output/system/503 new file mode 100644 index 00000000..d1280a42 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/503 @@ -0,0 +1,3 @@ + + +QEMU aarch64 Segmentation fault on Mac OSX, machine raspi3 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/508 b/results/classifier/mode-deepseek-r1:32b/output/system/508 new file mode 100644 index 00000000..63394438 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/508 @@ -0,0 +1,3 @@ + + +x86_64 cmpxchg behavior in qemu tcg does not match the real CPU diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/510 b/results/classifier/mode-deepseek-r1:32b/output/system/510 new file mode 100644 index 00000000..13211bff --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/510 @@ -0,0 +1,3 @@ + + +QEMU registers support on x64 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/518 b/results/classifier/mode-deepseek-r1:32b/output/system/518 new file mode 100644 index 00000000..57ca1aca --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/518 @@ -0,0 +1,3 @@ + + +Android for arm guest diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/52 b/results/classifier/mode-deepseek-r1:32b/output/system/52 new file mode 100644 index 00000000..2eb15da1 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/52 @@ -0,0 +1,3 @@ + + +PowerPC64: tlbivax does not work for addresses above 4G diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/521 b/results/classifier/mode-deepseek-r1:32b/output/system/521 new file mode 100644 index 00000000..6b77c203 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/521 @@ -0,0 +1,3 @@ + + +Assert mr != NULL through megaraid diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/53 b/results/classifier/mode-deepseek-r1:32b/output/system/53 new file mode 100644 index 00000000..984e2475 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/53 @@ -0,0 +1,3 @@ + + +RISC-V Disassembler/translator instruction decoding disagreement diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/536 b/results/classifier/mode-deepseek-r1:32b/output/system/536 new file mode 100644 index 00000000..bf352713 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/536 @@ -0,0 +1,3 @@ + + +Null-ptr dereference in ich9_apm_ctrl_changed diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/546 b/results/classifier/mode-deepseek-r1:32b/output/system/546 new file mode 100644 index 00000000..13618998 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/546 @@ -0,0 +1,3 @@ + + +Global-buffer-overflow in mode_sense_page diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/547 b/results/classifier/mode-deepseek-r1:32b/output/system/547 new file mode 100644 index 00000000..c5bf3869 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/547 @@ -0,0 +1,3 @@ + + +e1000: Loop blocking QEMU with high CPU usage diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/548 b/results/classifier/mode-deepseek-r1:32b/output/system/548 new file mode 100644 index 00000000..451ac71d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/548 @@ -0,0 +1,3 @@ + + +Null-ptr dereference in megasas_finish_dcmd diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/549 b/results/classifier/mode-deepseek-r1:32b/output/system/549 new file mode 100644 index 00000000..1a21b0bc --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/549 @@ -0,0 +1,3 @@ + + +FPE in npcm7xx_clk_update_pll diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/550 b/results/classifier/mode-deepseek-r1:32b/output/system/550 new file mode 100644 index 00000000..f14fb8d1 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/550 @@ -0,0 +1,3 @@ + + +FPE in npcm7xx_adc_convert diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/551 b/results/classifier/mode-deepseek-r1:32b/output/system/551 new file mode 100644 index 00000000..25bf7c38 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/551 @@ -0,0 +1,3 @@ + + +Null-ptr dereference in megasas_command_complete diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/557 b/results/classifier/mode-deepseek-r1:32b/output/system/557 new file mode 100644 index 00000000..aa59800d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/557 @@ -0,0 +1,3 @@ + + +Stack-overflow through pcnet_tmd_load diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/565 b/results/classifier/mode-deepseek-r1:32b/output/system/565 new file mode 100644 index 00000000..d70188da --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/565 @@ -0,0 +1,3 @@ + + +maybe-uninitialized warning in Xtensa flush_window_regs() diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/567 b/results/classifier/mode-deepseek-r1:32b/output/system/567 new file mode 100644 index 00000000..f40b1213 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/567 @@ -0,0 +1,3 @@ + + +qemu 6.1.0 build fail on alpine linux diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/568228 b/results/classifier/mode-deepseek-r1:32b/output/system/568228 new file mode 100644 index 00000000..b3aaea2f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/568228 @@ -0,0 +1,260 @@ + + +/home/qemu-0.12.3/tcg/tcg.c:1367: tcg fatal error + +I get the following error each time I start emulation in QEMU 0.12.3 on a Sun SunFire 280R running Debian Lenny 5.03 for Sparc64: + +/home/qemu-0.12.3/tcg/tcg.c:1367: tcg fatal error + +I had the same problem in Qemu 0.11.1. + +Here are informations about my system, I am not a programmer so I don't know what information to give, if you need more info just ask me: + +sunfire:/home# uname -a +Linux sunfire 2.6.26 #1 Thu Apr 8 17:09:17 EDT 2010 sparc64 GNU/Linux +sunfire:/home# dmesg +nges: +[ 0.000000] Normal 0 -> 130933 +[ 0.000000] Movable zone start PFN for each node +[ 0.000000] early_node_map[7] active PFN ranges +[ 0.000000] 0: 0 -> 129023 +[ 0.000000] 0: 129024 -> 130666 +[ 0.000000] 0: 130796 -> 130803 +[ 0.000000] 0: 130805 -> 130815 +[ 0.000000] 0: 130818 -> 130826 +[ 0.000000] 0: 130828 -> 130916 +[ 0.000000] 0: 130919 -> 130933 +[ 0.000000] On node 0 totalpages: 130792 +[ 0.000000] Normal zone: 896 pages used for memmap +[ 0.000000] Normal zone: 0 pages reserved +[ 0.000000] Normal zone: 129896 pages, LIFO batch:15 +[ 0.000000] Movable zone: 0 pages used for memmap +[ 0.000000] Booting Linux... +[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 129896 +[ 0.000000] Kernel command line: root=/dev/sdb2 ro +[ 0.000000] PID hash table entries: 4096 (order: 12, 32768 bytes) +[ 0.000000] clocksource: mult[c80000] shift[16] +[ 0.000000] clockevent: mult[147ae14] shift[32] +[ 380.165881] Console: colour dummy device 80x25 +[ 380.183520] console handover: boot [earlyprom0] -> real [tty0] +[ 380.208131] Dentry cache hash table entries: 131072 (order: 7, 1048576 bytes) +[ 380.210503] Inode-cache hash table entries: 65536 (order: 6, 524288 bytes) +[ 380.235415] Memory: 1022064k available (4952k kernel code, 2064k data, 192k init) [fffff80000000000,000000003feea000] +[ 380.312667] Calibrating delay using timer specific routine.. 9.99 BogoMIPS (lpj=19990) +[ 380.312839] Security Framework initialized +[ 380.312870] SELinux: Disabled at boot. +[ 380.312889] Capability LSM initialized +[ 380.312935] Mount-cache hash table entries: 512 +[ 380.313505] Initializing cgroup subsys ns +[ 380.313524] Initializing cgroup subsys cpuacct +[ 380.313536] Initializing cgroup subsys devices +[ 380.314346] net_namespace: 1208 bytes +[ 380.314892] NET: Registered protocol family 16 +[ 380.325288] PCI: Probing for controllers. +[ 380.325332] /pci@8,700000: SCHIZO PCI Bus Module ver[4:0] +[ 380.325349] /pci@8,700000: PCI IO[7ffef000000] MEM[7fe00000000] +[ 380.329864] /pci@8,600000: SCHIZO PCI Bus Module ver[4:0] +[ 380.329881] /pci@8,600000: PCI IO[7ffed000000] MEM[7fd00000000] +[ 380.334466] PCI: Scanning PBM /pci@8,600000 +[ 380.334976] PCI: Scanning PBM /pci@8,700000 +[ 380.336347] ebus0: [flashprom] [bbc] [ppm] [i2c -> (dimm-fru) (dimm-fru) (dimm-fru) (dimm-fru) (nvram) (idprom)] [i2c -> (cpu-fru) (temperature) (fan-control) (motherboard-fru) (i2c-bridge)] [beep] [rtc] [gpio] [pmc] [floppy] [parallel] [serial] +[ 380.349031] usbcore: registered new interface driver usbfs +[ 380.349274] usbcore: registered new interface driver hub +[ 380.349452] usbcore: registered new device driver usb +[ 380.353275] /pci@8,700000/ebus@5/rtc@1,300070: Clock regs at 000007fe7e300070 +[ 380.354631] NET: Registered protocol family 2 +[ 380.356677] Switched to high resolution mode on CPU 0 +[ 380.388803] IP route cache hash table entries: 8192 (order: 3, 65536 bytes) +[ 380.389510] TCP established hash table entries: 32768 (order: 6, 524288 bytes) +[ 380.391238] TCP bind hash table entries: 32768 (order: 5, 262144 bytes) +[ 380.392036] TCP: Hash tables configured (established 32768 bind 32768) +[ 380.392052] TCP reno registered +[ 380.400796] NET: Registered protocol family 1 +[ 380.401078] checking if image is initramfs... it is +[ 381.658428] Freeing initrd memory: 5829k freed +[ 381.659077] Mini RTC Driver +[ 381.659365] /memory-controller@0,400000: US3 memory controller at 0000040000400000 [ACTIVE] +[ 381.660085] audit: initializing netlink socket (disabled) +[ 381.660134] type=2000 audit(1271905721.644:1): initialized +[ 381.660454] Total HugeTLB memory allocated, 0 +[ 381.660756] VFS: Disk quotas dquot_6.5.1 +[ 381.660865] Dquot-cache hash table entries: 1024 (order 0, 8192 bytes) +[ 381.661363] Installing knfsd (copyright (C) 1996 <email address hidden>). +[ 381.662280] NTFS driver 2.1.29 [Flags: R/W]. +[ 381.662397] msgmni has been set to 2009 +[ 381.662746] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253) +[ 381.662775] io scheduler noop registered +[ 381.662788] io scheduler anticipatory registered +[ 381.662801] io scheduler deadline registered +[ 381.662844] io scheduler cfq registered (default) +[ 381.668602] Console: switching to colour frame buffer device 80x30 +[ 381.672374] fb0: TVP4020 frame buffer device, memory = 8192K. +[ 381.681745] [drm] Initialized drm 1.1.0 20060810 +[ 381.683020] f0086398: ttyS0 at MMIO 0x7fe7e400000 (irq = 10) is a SAB82532 V3.2 +[ 381.686005] f0086398: ttyS1 at MMIO 0x7fe7e400040 (irq = 10) is a SAB82532 V3.2 +[ 381.694246] brd: module loaded +[ 381.698234] loop: module loaded +[ 381.700507] sungem.c:v0.98 8/24/03 David S. Miller (<email address hidden>) +[ 381.703764] PHY ID: 18074c1, addr: 0 +[ 381.704753] eth0: Sun GEM (PCI) 10/100/1000BaseT Ethernet 00:03:ba:12:bb:58 +[ 381.707196] eth0: Found Generic MII PHY +[ 381.709903] Uniform Multi-Platform E-IDE driver +[ 381.712557] ide: Assuming 33MHz system bus speed for PIO modes; override with idebus=xx +[ 381.719917] ohci_hcd: 2006 August 04 USB 1.1 'Open' Host Controller (OHCI) Driver +[ 381.719963] ohci_hcd 0000:00:05.3: OHCI Host Controller +[ 381.723674] ohci_hcd 0000:00:05.3: new USB bus registered, assigned bus number 1 +[ 381.731670] ohci_hcd 0000:00:05.3: irq 13, io mem 0x7fe01000000 +[ 381.792942] usb usb1: configuration #1 chosen from 1 choice +[ 381.797235] hub 1-0:1.0: USB hub found +[ 381.801563] hub 1-0:1.0: 4 ports detected +[ 381.909230] usb usb1: New USB device found, idVendor=1d6b, idProduct=0001 +[ 381.913796] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 +[ 381.923701] usb usb1: Product: OHCI Host Controller +[ 381.928419] usb usb1: Manufacturer: Linux 2.6.26 ohci_hcd +[ 381.933108] usb usb1: SerialNumber: 0000:00:05.3 +[ 381.937761] USB Universal Host Controller Interface driver v3.0 +[ 381.942637] mice: PS/2 mouse device common for all mice +[ 382.164665] usb 1-2: new low speed USB device using ohci_hcd and address 2 +[ 382.331310] usb 1-2: configuration #1 chosen from 1 choice +[ 382.336918] usb 1-2: New USB device found, idVendor=049f, idProduct=000e +[ 382.341070] usb 1-2: New USB device strings: Mfr=4, Product=20, SerialNumber=0 +[ 382.349921] usb 1-2: Product: Compaq Internet Keyboard +[ 382.354146] usb 1-2: Manufacturer: Chicony +[ 382.612663] usb 1-3: new full speed USB device using ohci_hcd and address 3 +[ 382.777825] usb 1-3: configuration #1 chosen from 1 choice +[ 382.783275] usb 1-3: New USB device found, idVendor=058f, idProduct=6387 +[ 382.787329] usb 1-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3 +[ 382.791996] usb 1-3: Product: Mass Storage +[ 382.795814] usb 1-3: Manufacturer: Generic +[ 382.799482] usb 1-3: SerialNumber: 0AC899D6 +[ 383.056664] usb 1-4: new low speed USB device using ohci_hcd and address 4 +[ 383.221349] usb 1-4: configuration #1 chosen from 1 choice +[ 383.226691] usb 1-4: New USB device found, idVendor=045e, idProduct=0039 +[ 383.230537] usb 1-4: New USB device strings: Mfr=1, Product=3, SerialNumber=0 +[ 383.235076] usb 1-4: Product: Microsoft 5-Button Mouse with IntelliEye(TM) +[ 383.238730] usb 1-4: Manufacturer: Microsoft +[ 383.248269] input: Chicony Compaq Internet Keyboard as /class/input/input0 +[ 383.264794] input,hidraw0: USB HID v1.10 Keyboard [Chicony Compaq Internet Keyboard] on usb-0000:00:05.3-2 +[ 383.286678] input: Chicony Compaq Internet Keyboard as /class/input/input1 +[ 383.304765] input,hidraw1: USB HID v1.10 Device [Chicony Compaq Internet Keyboard] on usb-0000:00:05.3-2 +[ 383.317738] input: Microsoft Microsoft 5-Button Mouse with IntelliEye(TM) as /class/input/input2 +[ 383.340859] input,hidraw2: USB HID v1.10 Mouse [Microsoft Microsoft 5-Button Mouse with IntelliEye(TM)] on usb-0000:00:05.3-4 +[ 383.349107] usbcore: registered new interface driver usbhid +[ 383.353153] usbhid: v2.6:USB HID core driver +[ 383.357245] Advanced Linux Sound Architecture Driver Version 1.0.16. +[ 383.402450] PCI: Enabling device: (0000:00:03.0), cmd 1 +[ 384.100863] eth0: Link is up at 100 Mbps, full-duplex. +[ 384.846600] usbcore: registered new interface driver snd-usb-audio +[ 384.851077] ALSA device list: +[ 384.855394] #0: Ensoniq AudioPCI ENS1371 at 0x7ffef000500, irq 17 +[ 384.861036] TCP cubic registered +[ 384.865480] NET: Registered protocol family 17 +[ 384.870147] RPC: Registered udp transport module. +[ 384.874530] RPC: Registered tcp transport module. +[ 384.879100] registered taskstats version 1 +[ 384.883476] drivers/rtc/hctosys.c: unable to open rtc device (rtc0) +[ 386.429586] SCSI subsystem initialized +[ 386.509039] ohci1394: fw-host0: OHCI-1394 1.0 (PCI): IRQ=[12] MMIO=[7fe00120000-7fe001207ff] Max Packet=[2048] IR/IT contexts=[4/4] +[ 386.596175] QLogic Fibre Channel HBA Driver: 8.02.01-k4 +[ 386.600382] PCI: Enabling device: (0001:00:04.0), cmd 3 +[ 386.602464] qla2xxx 0001:00:04.0: Found an ISP2200, irq 20, iobase 0x000007fd00100000 +[ 386.612339] qla2xxx 0001:00:04.0: Configuring PCI space... +[ 386.616586] qla2xxx 0001:00:04.0: Configure NVRAM parameters... +[ 386.714919] qla2xxx 0001:00:04.0: Inconsistent NVRAM detected: checksum=0x0 id=<4>qla2xxx 0001:00:04.0: Falling back to functioning (yet invalid -- WWPN) defaults. +[ 386.728340] qla2xxx 0001:00:04.0: Verifying loaded RISC code... +[ 386.734153] PCI: Enabling device: (0000:00:06.0), cmd 147 +[ 386.735307] sym0: <875> rev 0x37 at pci 0000:00:06.0 irq 14 +[ 386.826112] sym0: No NVRAM, ID 7, Fast-20, SE, parity checking +[ 386.837235] sym0: SCSI BUS has been reset. +[ 386.841214] scsi1 : sym-2.2.3 +[ 386.847653] PCI: Enabling device: (0000:00:06.1), cmd 147 +[ 386.848824] sym1: <875> rev 0x37 at pci 0000:00:06.1 irq 15 +[ 386.939517] sym1: No NVRAM, ID 7, Fast-20, SE, parity checking +[ 386.950672] sym1: SCSI BUS has been reset. +[ 386.954818] scsi2 : sym-2.2.3 +[ 386.965219] firmware: requesting ql2200_fw.bin +[ 387.039293] Initializing USB Mass Storage driver... +[ 387.043558] scsi3 : SCSI emulation for USB Mass Storage devices +[ 387.050004] usbcore: registered new interface driver usb-storage +[ 387.054012] USB Mass Storage support registered. +[ 387.057924] usb-storage: device found at 3 +[ 387.057930] usb-storage: waiting for device to settle before scanning +[ 388.004887] ieee1394: Host added: ID:BUS[0-00:1023] GUID[0003bafffe12bb58] +[ 391.590521] scsi 1:0:6:0: CD-ROM TOSHIBA DVD-ROM SD-M1401 1009 PQ: 0 ANSI: 2 +[ 391.599122] target1:0:6: Beginning Domain Validation +[ 391.603264] target1:0:6: asynchronous +[ 391.608968] target1:0:6: FAST-20 SCSI 20.0 MB/s ST (50 ns, offset 16) +[ 391.614104] target1:0:6: Domain Validation skipping write tests +[ 391.618025] target1:0:6: Ending Domain Validation +[ 392.057675] usb-storage: device scan complete +[ 392.063643] scsi 3:0:0:0: Direct-Access Generic Flash Disk 8.07 PQ: 0 ANSI: 2 +[ 394.008952] Driver 'sr' needs updating - please use bus_type methods +[ 394.017708] sr0: scsi3-mmc drive: 40x/40x cd/rw xa/form2 cdda tray +[ 394.021916] Uniform CD-ROM driver Revision: 3.20 +[ 394.026310] sr 1:0:6:0: Attached scsi CD-ROM sr0 +[ 394.056732] sr 1:0:6:0: Attached scsi generic sg0 type 5 +[ 394.357542] scsi 3:0:0:0: Attached scsi generic sg1 type 0 +[ 394.413753] Driver 'sd' needs updating - please use bus_type methods +[ 394.437062] sd 3:0:0:0: [sda] 4103936 512-byte hardware sectors (2101 MB) +[ 394.450042] sd 3:0:0:0: [sda] Write Protect is off +[ 394.454315] sd 3:0:0:0: [sda] Mode Sense: 03 00 00 00 +[ 394.454322] sd 3:0:0:0: [sda] Assuming drive cache: write through +[ 394.481010] sd 3:0:0:0: [sda] 4103936 512-byte hardware sectors (2101 MB) +[ 394.493994] sd 3:0:0:0: [sda] Write Protect is off +[ 394.498261] sd 3:0:0:0: [sda] Mode Sense: 03 00 00 00 +[ 394.498268] sd 3:0:0:0: [sda] Assuming drive cache: write through +[ 394.502483] sda: +[ 394.548320] sd 3:0:0:0: [sda] Attached SCSI removable disk +[ 397.912726] qla2xxx 0001:00:04.0: Allocated (252 KB) for firmware dump... +[ 398.044667] qla2xxx 0001:00:04.0: LIP reset occured (f8ef). +[ 398.049170] scsi0 : qla2xxx +[ 398.054582] qla2xxx 0001:00:04.0: +[ 398.054586] QLogic Fibre Channel HBA Driver: 8.02.01-k4 +[ 398.054590] QLogic QLA22xx - +[ 398.054592] ISP2200: PCI (66 MHz) @ 0001:00:04.0 hdma-, host#=0, fw=2.02.08 TP +[ 398.091669] qla2xxx 0001:00:04.0: LIP occured (f8ef). +[ 398.097133] qla2xxx 0001:00:04.0: LOOP UP detected (1 Gbps). +[ 398.110704] scsi 0:0:0:0: Direct-Access SEAGATE ST336605FSUN36G 0638 PQ: 0 ANSI: 3 +[ 398.126430] scsi 0:0:1:0: Direct-Access SEAGATE ST336605FSUN36G 0638 PQ: 0 ANSI: 3 +[ 398.144907] scsi: waiting for bus probes to complete ... +[ 398.153043] sd 0:0:0:0: [sdb] 71132959 512-byte hardware sectors (36420 MB) +[ 398.159977] sd 0:0:0:0: [sdb] Write Protect is off +[ 398.164380] sd 0:0:0:0: [sdb] Mode Sense: db 00 10 08 +[ 398.168750] sd 0:0:0:0: [sdb] Write cache: disabled, read cache: enabled, supports DPO and FUA +[ 398.181593] sd 0:0:0:0: [sdb] 71132959 512-byte hardware sectors (36420 MB) +[ 398.188754] sd 0:0:0:0: [sdb] Write Protect is off +[ 398.193390] sd 0:0:0:0: [sdb] Mode Sense: db 00 10 08 +[ 398.197775] sd 0:0:0:0: [sdb] Write cache: disabled, read cache: enabled, supports DPO and FUA +[ 398.207949] sdb: sdb1 sdb2 sdb3 sdb4 +[ 398.219180] sd 0:0:0:0: [sdb] Attached SCSI disk +[ 398.223902] sd 0:0:0:0: Attached scsi generic sg2 type 0 +[ 398.232492] sd 0:0:1:0: [sdc] 71132959 512-byte hardware sectors (36420 MB) +[ 398.239757] sd 0:0:1:0: [sdc] Write Protect is off +[ 398.244397] sd 0:0:1:0: [sdc] Mode Sense: db 00 10 08 +[ 398.249021] sd 0:0:1:0: [sdc] Write cache: disabled, read cache: enabled, supports DPO and FUA +[ 398.262681] sd 0:0:1:0: [sdc] 71132959 512-byte hardware sectors (36420 MB) +[ 398.270173] sd 0:0:1:0: [sdc] Write Protect is off +[ 398.274917] sd 0:0:1:0: [sdc] Mode Sense: db 00 10 08 +[ 398.279543] sd 0:0:1:0: [sdc] Write cache: disabled, read cache: enabled, supports DPO and FUA +[ 398.289888] sdc: sdc1 sdc3 +[ 398.304581] sd 0:0:1:0: [sdc] Attached SCSI disk +[ 398.309417] sd 0:0:1:0: Attached scsi generic sg3 type 0 +[ 398.768132] kjournald starting. Commit interval 5 seconds +[ 398.772864] EXT3-fs: mounted filesystem with ordered data mode. +[ 401.026534] udevd version 125 started +[ 405.141436] Adding 1566320k swap on /dev/sdb4. Priority:-1 extents:1 across:1566320k +[ 405.604286] EXT3 FS on sdb2, internal journal +[ 408.242503] eth0: Link is up at 100 Mbps, full-duplex. +[ 408.249685] eth0: Pause is disabled +[ 410.325778] NET: Registered protocol family 10 +[ 410.330075] lo: Disabled Privacy Extensions +[ 414.287849] NFSD: Using /var/lib/nfs/v4recovery as the NFSv4 state recovery directory +[ 414.307535] NFSD: starting 90-second grace period +[ 418.763886] NET: Registered protocol family 5 +[ 420.772658] eth0: no IPv6 routers present +[ 550.132380] ioctl32(xfce4-terminal:3010): Unknown cmd fd(8) cmd(0000530b){t:'S';sz:0} arg(f7e8a380) on /dev/pts/0 +[ 550.132405] ioctl32(xfce4-terminal:3010): Unknown cmd fd(8) cmd(0000530b){t:'S';sz:0} arg(f7e8a388) on /dev/pts/0 +[ 550.132420] ioctl32(xfce4-terminal:3010): Unknown cmd fd(8) cmd(0000530b){t:'S';sz:0} arg(f7e8a390) on /dev/pts/0 +[ 2388.411343] ioctl32(synaptic:3478): Unknown cmd fd(16) cmd(0000530b){t:'S';sz:0} arg(f755a380) on /dev/pts/1 +[ 2388.411368] ioctl32(synaptic:3478): Unknown cmd fd(16) cmd(0000530b){t:'S';sz:0} arg(f755a388) on /dev/pts/1 +[ 2388.411383] ioctl32(synaptic:3478): Unknown cmd fd(16) cmd(0000530b){t:'S';sz:0} arg(f755a390) on /dev/pts/1 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/57 b/results/classifier/mode-deepseek-r1:32b/output/system/57 new file mode 100644 index 00000000..f683d290 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/57 @@ -0,0 +1,3 @@ + + +IDE short PRDT abort diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/571 b/results/classifier/mode-deepseek-r1:32b/output/system/571 new file mode 100644 index 00000000..005ffe4d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/571 @@ -0,0 +1,3 @@ + + +maybe-uninitialized warning in mips cpu_loop() diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/573 b/results/classifier/mode-deepseek-r1:32b/output/system/573 new file mode 100644 index 00000000..7911f618 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/573 @@ -0,0 +1,3 @@ + + +maybe-uninitialized warning in pnv_phb3_translate_iommu() diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/580 b/results/classifier/mode-deepseek-r1:32b/output/system/580 new file mode 100644 index 00000000..7ed17637 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/580 @@ -0,0 +1,19 @@ + + +access internet from guest +Description of problem: +I can ssh back to host using ssh 10.0.2.2. +Also I can login to guest from host using ssh riscv@localhost -p 3333. +However, +I could not get internet access from the guest os system, such as: +``` +[riscv@fedora-riscv ~]$ wget www.google.com +--2019-12-15 05:53:04-- http://www.google.com/ +Resolving www.google.com (www.google.com)... 216.58.194.164, 2607:f8b0:4005:804::2004 +Connecting to www.google.com (www.google.com)|216.58.194.164|:80... failed: Connection refused. +Connecting to www.google.com (www.google.com)|2607:f8b0:4005:804::2004|:80... failed: Network is unreachable. +``` +Therefore, I could not use dnf to install packages. +Any help will be appreciated. +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/584146 b/results/classifier/mode-deepseek-r1:32b/output/system/584146 new file mode 100644 index 00000000..8eaad3c9 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/584146 @@ -0,0 +1,9 @@ + + +Virtual fat breaks with -snapshot + +When using fat emulation together with snapshot, qemu fails to find the directory for the fat "filesystem". + +See Debian bug#504049, http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504049 and discussion on qemu-devel with Kevin Wolf, http://marc.info/?t=126850802800001 for details. + +There's a workaround for this bug: when using full path for fat:/dir/name it works. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/584155 b/results/classifier/mode-deepseek-r1:32b/output/system/584155 new file mode 100644 index 00000000..053364b6 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/584155 @@ -0,0 +1,6 @@ + + +support horisontal mouse wheel + +Brad Jorsch provided a series of patches to support horisontal mouse scrolling in qemu-emulated mouse. +See Debian bug#579968 -- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=579968 and submission to qemu-devel list at http://<email address hidden>/msg30991.html . \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/585 b/results/classifier/mode-deepseek-r1:32b/output/system/585 new file mode 100644 index 00000000..5f7a2233 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/585 @@ -0,0 +1,3 @@ + + +mret trigger exception when pmp equals false diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/589 b/results/classifier/mode-deepseek-r1:32b/output/system/589 new file mode 100644 index 00000000..c5579248 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/589 @@ -0,0 +1,3 @@ + + +Error installing QGA file under virtual machine of windows system diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/59 b/results/classifier/mode-deepseek-r1:32b/output/system/59 new file mode 100644 index 00000000..fd59bf85 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/59 @@ -0,0 +1,3 @@ + + +ide/core.c ATA Major Version reporting incorrect diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/60 b/results/classifier/mode-deepseek-r1:32b/output/system/60 new file mode 100644 index 00000000..4a03dcd8 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/60 @@ -0,0 +1,3 @@ + + +qemu-system-aarch64 (tcg): cval + voff overflow not handled, causes qemu to hang diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/600 b/results/classifier/mode-deepseek-r1:32b/output/system/600 new file mode 100644 index 00000000..7de6f234 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/600 @@ -0,0 +1,3 @@ + + +Have 'info mtree' accept an (optional) 'name' parameter to pick a specific address space diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/601 b/results/classifier/mode-deepseek-r1:32b/output/system/601 new file mode 100644 index 00000000..7fafda10 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/601 @@ -0,0 +1,22 @@ + + +import tensorflow causes qemu: uncaught target signal 6 (Aborted) - core dumped +Description of problem: +Crashes when importing tensorflow in Docker container under --platorm linux/amd64 on M1 Mac +``` +2021-09-06 13:35:24.435613: F tensorflow/core/lib/monitoring/sampler.cc:42] Check failed: bucket_limits_[i] > bucket_limits_[i - 1] (0 vs. 10) +qemu: uncaught target signal 6 (Aborted) - core dumped +``` +Steps to reproduce: +See https://gitlab.com/ryan-feather/docker-tensorflow-qemu-bug/ for Dockerfile and description of steps repeating here. +1. Using the dockerfile +``` +FROM python:3.9-buster +RUN pip install tensorflow==2.6.0 + +``` +2. `docker buildx build --iidfile build.id --platform linux/amd64 . --progress=plain` +3. ``` docker run --platform linux/amd64 `cat build.id` python -c "import tensorflow"``` +Additional information: +See +https://github.com/docker/for-mac/issues/5342 where the Docker team suggests this is a qemu bug. I couldn't find where anyone had opened one of these here, so hopefully this isn't a duplicate. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/603 b/results/classifier/mode-deepseek-r1:32b/output/system/603 new file mode 100644 index 00000000..c6e6924d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/603 @@ -0,0 +1,3 @@ + + +Unable to use mps2-an386 machine with qemu-6.0.0 version code diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/612 b/results/classifier/mode-deepseek-r1:32b/output/system/612 new file mode 100644 index 00000000..5bf1fa9a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/612 @@ -0,0 +1,3 @@ + + +Much larger traces with qemu-6.1 than qemu-6.0 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/613 b/results/classifier/mode-deepseek-r1:32b/output/system/613 new file mode 100644 index 00000000..00742167 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/613 @@ -0,0 +1,3 @@ + + +ARM cortex-m55 LOB instructions make QEMU crash diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/620 b/results/classifier/mode-deepseek-r1:32b/output/system/620 new file mode 100644 index 00000000..3969a56f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/620 @@ -0,0 +1,3 @@ + + +QEMU gdbstub should add memtag support for aarch64 MTE diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/624 b/results/classifier/mode-deepseek-r1:32b/output/system/624 new file mode 100644 index 00000000..29b08fa6 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/624 @@ -0,0 +1,339 @@ + + +powerpc: halt and reboot via firmware via cuda fail +Description of problem: +Both shutdown and reboot cause errors preventing the action from occuring. With logging turned on as above, it can be seen that the issue is with CUDA. If the option `-M mac99,via=pmu` is given the action happens as expected. + +``` +# qemu-system-ppc -trace 'cuda_*' -d unimp,guest_errors -serial file:/dev/stdout -hda /tmp/grub-shell.CdAU68FI6P/grub.iso -boot c +WARNING: Image format was not specified for '/tmp/grub-shell.CdAU68FI6P/grub.iso' and probing guessed raw. + Automatically detecting the format is dangerous for raw images, write operations on block 0 will be restricted. + Specify the 'raw' format explicitly to remove the restrictions. +cuda_delay_set_sr_int +cuda_data_send send: 0x00 +cuda_delay_set_sr_int +cuda_data_send send: 0x00 +cuda_delay_set_sr_int +cuda_delay_set_sr_int +cuda_packet_receive length 2 +cuda_packet_receive_data [0] 0x00 +cuda_packet_receive_data [1] 0x00 +cuda_packet_send length 3 +cuda_packet_send_data [0] 0x00 +cuda_packet_send_data [1] 0x00 +cuda_packet_send_data [2] 0x00 +cuda_delay_set_sr_int +cuda_data_recv recv: 0x00 +cuda_delay_set_sr_int +cuda_data_recv recv: 0x00 +cuda_delay_set_sr_int +cuda_data_recv recv: 0x00 +cuda_delay_set_sr_int +cuda_delay_set_sr_int +cuda_data_send send: 0x00 +cuda_delay_set_sr_int +cuda_data_send send: 0x1f +cuda_delay_set_sr_int +cuda_delay_set_sr_int +cuda_packet_receive length 2 +cuda_packet_receive_data [0] 0x00 +cuda_packet_receive_data [1] 0x1f +cuda_packet_send length 3 +cuda_packet_send_data [0] 0x00 +cuda_packet_send_data [1] 0x02 +cuda_packet_send_data [2] 0x1f +cuda_delay_set_sr_int +cuda_data_recv recv: 0x00 +cuda_delay_set_sr_int +cuda_data_recv recv: 0x02 +cuda_delay_set_sr_int +cuda_data_recv recv: 0x1f +cuda_delay_set_sr_int +cuda_delay_set_sr_int +cuda_data_send send: 0x00 +cuda_delay_set_sr_int +cuda_data_send send: 0x2f +cuda_delay_set_sr_int +cuda_delay_set_sr_int +cuda_packet_receive length 2 +cuda_packet_receive_data [0] 0x00 +cuda_packet_receive_data [1] 0x2f +cuda_packet_send length 4 +cuda_packet_send_data [0] 0x00 +cuda_packet_send_data [1] 0x00 +cuda_packet_send_data [2] 0x02 +cuda_packet_send_data [3] 0x01 +cuda_delay_set_sr_int +cuda_data_recv recv: 0x00 +cuda_delay_set_sr_int +cuda_data_recv recv: 0x00 +cuda_delay_set_sr_int +cuda_data_recv recv: 0x02 +cuda_delay_set_sr_int +cuda_data_recv recv: 0x01 +cuda_delay_set_sr_int +cuda_delay_set_sr_int +cuda_data_send send: 0x00 +cuda_delay_set_sr_int +cuda_data_send send: 0x2b +cuda_delay_set_sr_int +cuda_data_send send: 0x28 +cuda_delay_set_sr_int +cuda_data_send send: 0xfe +cuda_delay_set_sr_int +cuda_delay_set_sr_int +cuda_packet_receive length 4 +cuda_packet_receive_data [0] 0x00 +cuda_packet_receive_data [1] 0x2b +cuda_packet_receive_data [2] 0x28 +cuda_packet_receive_data [3] 0xfe +cuda_packet_send length 3 +cuda_packet_send_data [0] 0x00 +cuda_packet_send_data [1] 0x00 +cuda_packet_send_data [2] 0x2b +cuda_delay_set_sr_int +cuda_data_recv recv: 0x00 +cuda_delay_set_sr_int +cuda_data_recv recv: 0x00 +cuda_delay_set_sr_int +cuda_data_recv recv: 0x2b +cuda_delay_set_sr_int +cuda_delay_set_sr_int +cuda_data_send send: 0x00 +cuda_delay_set_sr_int +cuda_data_send send: 0x81 +cuda_delay_set_sr_int +cuda_delay_set_sr_int +cuda_packet_receive length 2 +cuda_packet_receive_data [0] 0x00 +cuda_packet_receive_data [1] 0x81 +cuda_packet_send length 3 +cuda_packet_send_data [0] 0x00 +cuda_packet_send_data [1] 0x00 +cuda_packet_send_data [2] 0x81 +cuda_delay_set_sr_int +cuda_data_recv recv: 0x00 +cuda_delay_set_sr_int +cuda_data_recv recv: 0x00 +cuda_delay_set_sr_int +cuda_data_recv recv: 0x81 +cuda_delay_set_sr_int +cuda_delay_set_sr_int +cuda_data_send send: 0x00 +cuda_delay_set_sr_int +cuda_data_send send: 0x2f +cuda_delay_set_sr_int +cuda_delay_set_sr_int +cuda_packet_receive length 2 +cuda_packet_receive_data [0] 0x00 +cuda_packet_receive_data [1] 0x2f +cuda_packet_send length 3 +cuda_packet_send_data [0] 0x00 +cuda_packet_send_data [1] 0x02 +cuda_packet_send_data [2] 0x2f +cuda_delay_set_sr_int +cuda_data_recv recv: 0x00 +cuda_delay_set_sr_int +cuda_data_recv recv: 0x02 +cuda_delay_set_sr_int +cuda_data_recv recv: 0x2f +cuda_delay_set_sr_int +cuda_delay_set_sr_int +cuda_data_send send: 0x00 +cuda_delay_set_sr_int +cuda_data_send send: 0x3f +cuda_delay_set_sr_int +cuda_delay_set_sr_int +cuda_packet_receive length 2 +cuda_packet_receive_data [0] 0x00 +cuda_packet_receive_data [1] 0x3f +cuda_packet_send length 4 +cuda_packet_send_data [0] 0x00 +cuda_packet_send_data [1] 0x00 +cuda_packet_send_data [2] 0x03 +cuda_packet_send_data [3] 0x02 +cuda_delay_set_sr_int +cuda_data_recv recv: 0x00 +cuda_delay_set_sr_int +cuda_data_recv recv: 0x00 +cuda_delay_set_sr_int +cuda_data_recv recv: 0x03 +cuda_delay_set_sr_int +cuda_data_recv recv: 0x02 +cuda_delay_set_sr_int +cuda_delay_set_sr_int +cuda_data_send send: 0x00 +cuda_delay_set_sr_int +cuda_data_send send: 0x3b +cuda_delay_set_sr_int +cuda_data_send send: 0x29 +cuda_delay_set_sr_int +cuda_data_send send: 0xfe +cuda_delay_set_sr_int +cuda_delay_set_sr_int +cuda_packet_receive length 4 +cuda_packet_receive_data [0] 0x00 +cuda_packet_receive_data [1] 0x3b +cuda_packet_receive_data [2] 0x29 +cuda_packet_receive_data [3] 0xfe +cuda_packet_send length 3 +cuda_packet_send_data [0] 0x00 +cuda_packet_send_data [1] 0x00 +cuda_packet_send_data [2] 0x3b +cuda_delay_set_sr_int +cuda_data_recv recv: 0x00 +cuda_delay_set_sr_int +cuda_data_recv recv: 0x00 +cuda_delay_set_sr_int +cuda_data_recv recv: 0x3b +cuda_delay_set_sr_int +cuda_delay_set_sr_int +cuda_data_send send: 0x00 +cuda_delay_set_sr_int +cuda_data_send send: 0x91 +cuda_delay_set_sr_int +cuda_delay_set_sr_int +cuda_packet_receive length 2 +cuda_packet_receive_data [0] 0x00 +cuda_packet_receive_data [1] 0x91 +cuda_packet_send length 3 +cuda_packet_send_data [0] 0x00 +cuda_packet_send_data [1] 0x00 +cuda_packet_send_data [2] 0x91 +cuda_delay_set_sr_int +cuda_data_recv recv: 0x00 +cuda_delay_set_sr_int +cuda_data_recv recv: 0x00 +cuda_delay_set_sr_int +cuda_data_recv recv: 0x91 +cuda_delay_set_sr_int +cuda_delay_set_sr_int +cuda_data_send send: 0x00 +cuda_delay_set_sr_int +cuda_data_send send: 0x3f +cuda_delay_set_sr_int +cuda_delay_set_sr_int +cuda_packet_receive length 2 +cuda_packet_receive_data [0] 0x00 +cuda_packet_receive_data [1] 0x3f +cuda_packet_send length 3 +cuda_packet_send_data [0] 0x00 +cuda_packet_send_data [1] 0x02 +cuda_packet_send_data [2] 0x3f +cuda_delay_set_sr_int +cuda_data_recv recv: 0x00 +cuda_delay_set_sr_int +cuda_data_recv recv: 0x02 +cuda_delay_set_sr_int +cuda_data_recv recv: 0x3f +cuda_delay_set_sr_int +cuda_delay_set_sr_int +cuda_data_send send: 0x00 +cuda_delay_set_sr_int +cuda_data_send send: 0x4f +cuda_delay_set_sr_int +cuda_delay_set_sr_int +cuda_packet_receive length 2 +cuda_packet_receive_data [0] 0x00 +cuda_packet_receive_data [1] 0x4f +cuda_packet_send length 3 +cuda_packet_send_data [0] 0x00 +cuda_packet_send_data [1] 0x02 +cuda_packet_send_data [2] 0x4f +cuda_delay_set_sr_int +cuda_data_recv recv: 0x00 +cuda_delay_set_sr_int +cuda_data_recv recv: 0x02 +cuda_delay_set_sr_int +cuda_data_recv recv: 0x4f +cuda_delay_set_sr_int +cuda_delay_set_sr_int +cuda_data_send send: 0x00 +cuda_delay_set_sr_int +cuda_data_send send: 0x5f +cuda_delay_set_sr_int +cuda_delay_set_sr_int +cuda_packet_receive length 2 +cuda_packet_receive_data [0] 0x00 +cuda_packet_receive_data [1] 0x5f +cuda_packet_send length 3 +cuda_packet_send_data [0] 0x00 +cuda_packet_send_data [1] 0x02 +cuda_packet_send_data [2] 0x5f +cuda_delay_set_sr_int +cuda_data_recv recv: 0x00 +cuda_delay_set_sr_int +cuda_data_recv recv: 0x02 +cuda_delay_set_sr_int +cuda_data_recv recv: 0x5f +cuda_delay_set_sr_int +cuda_delay_set_sr_int +cuda_data_send send: 0x00 +cuda_delay_set_sr_int +cuda_data_send send: 0x7f +cuda_delay_set_sr_int +cuda_delay_set_sr_int +cuda_packet_receive length 2 +cuda_packet_receive_data [0] 0x00 +cuda_packet_receive_data [1] 0x7f +cuda_packet_send length 3 +cuda_packet_send_data [0] 0x00 +cuda_packet_send_data [1] 0x02 +cuda_packet_send_data [2] 0x7f +cuda_delay_set_sr_int +cuda_data_recv recv: 0x00 +cuda_delay_set_sr_int +cuda_data_recv recv: 0x02 +cuda_delay_set_sr_int +cuda_data_recv recv: 0x7f +cuda_delay_set_sr_int +cuda_delay_set_sr_int + +>> ============================================================= +>> OpenBIOS 1.1 [Aug 12 2021 13:35] +>> Configuration device id QEMU version 1 machine id 2 +>> CPUs: 1 +>> Memory: 128M +>> UUID: 00000000-0000-0000-0000-000000000000 +>> CPU type PowerPC,750 +milliseconds isn't unique. +>> switching to new context: +>> call-method block-size failed with error ffffffdf +>> call-method block-size failed with error ffffffdf +cuda_data_send send: 0x01 +cuda_delay_set_sr_int +cuda_data_send send: 0x0a +cuda_delay_set_sr_int +cuda_data_send send: 0xfa +cuda_delay_set_sr_int +cuda_delay_set_sr_int +cuda_packet_receive length 3 +cuda_packet_receive_data [0] 0x01 +cuda_packet_receive_data [1] 0x0a +cuda_packet_receive_data [2] 0xfa +cuda_receive_packet_cmd handling command POWERDOWN +CUDA: POWERDOWN: wrong parameters 2 +cuda_packet_send length 4 +cuda_packet_send_data [0] 0x02 +cuda_packet_send_data [1] 0x05 +cuda_packet_send_data [2] 0x01 +cuda_packet_send_data [3] 0x0a +cuda_delay_set_sr_int +cuda_data_recv recv: 0x02 +cuda_delay_set_sr_int +cuda_data_recv recv: 0x05 +cuda_delay_set_sr_int +cuda_data_recv recv: 0x01 +cuda_delay_set_sr_int +cuda_data_recv recv: 0x0a +cuda_delay_set_sr_int +cuda_delay_set_sr_int +>> interpret shut-down failed with error ffffffed +>> interpret poweroff failed with error ffffffed +``` +Steps to reproduce: +1. Download attached iso file: [grub.iso.xz](/uploads/dea8f2bde4d90b9928f54bb9b73d76e9/grub.iso.xz) +2. Decompress iso +3. Run qemu as specified above +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/627 b/results/classifier/mode-deepseek-r1:32b/output/system/627 new file mode 100644 index 00000000..dbf79d50 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/627 @@ -0,0 +1,9 @@ + + +VI.EXE crashes on start under QEMU; works under BOCHS +Description of problem: +vi.exe hangs on startup; can be verified to work in bochs +Steps to reproduce: +1. Run vi.exe from DOS prompt; hang is evident immediately as ~ ~ ~ ~ doesn't show up +Additional information: +Actual [vi.exe](/uploads/d77076b8187489253c6ad8f1ab3ec247/vi.exe) attached; it's ridiculously old; the kind of thing that belongs on archive.org; I think I actually own this copy program by inheritance; but if the copyright holder objects we'll have to take it down again. :( diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/629 b/results/classifier/mode-deepseek-r1:32b/output/system/629 new file mode 100644 index 00000000..0900c01a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/629 @@ -0,0 +1,12 @@ + + +Trying to use EGA or VGA functions from QBASIC doesn't work +Description of problem: +QBASIC can't start any graphics mode beyond CGA + +Some other programs that default to EGA crash trying to start graphics; none that I've tried can start EGA at all; believe to be the same bug; will file separately if it turns out to not be +Steps to reproduce: +1. Boot +2. Start QBASIC +3. Run a program consisting of only "SCREEN 12" for VGA or "SCREEN 9" for EGA +4. Get error message "Illegal Function Call" diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/629791 b/results/classifier/mode-deepseek-r1:32b/output/system/629791 new file mode 100644 index 00000000..8c27d476 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/629791 @@ -0,0 +1,7 @@ + + +sysret sets invalid ss + +I'm developing an OS. I use only sysret to enter user space. When an interrupt occurred, it would GPF on iretq'ing from it. On investigating, the cs on the stack is 0x2b (valid and correct). The ss on the stack is 0x20, which has a rpl of 0 which is incorrect. iretq checks that and gpf's. Making the irq handler manually modify it to 0x23 fixes it locally. + +This happens on the non-kvm'ed qemu. I haven't tried the kvm'ed one. Qemu version 0.12.5. I haven't tried with the current development version either. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/63 b/results/classifier/mode-deepseek-r1:32b/output/system/63 new file mode 100644 index 00000000..e8f191f7 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/63 @@ -0,0 +1,3 @@ + + +Illegal delay slot code causes abort on mips64 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/630 b/results/classifier/mode-deepseek-r1:32b/output/system/630 new file mode 100644 index 00000000..34b05888 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/630 @@ -0,0 +1,3 @@ + + +ubuntu-18.04-s390x-all job timeouts at 1h diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/632 b/results/classifier/mode-deepseek-r1:32b/output/system/632 new file mode 100644 index 00000000..78b6cad2 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/632 @@ -0,0 +1,3 @@ + + +We should document "make install DESTDIR=wherever" diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/639 b/results/classifier/mode-deepseek-r1:32b/output/system/639 new file mode 100644 index 00000000..8a6cc6b3 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/639 @@ -0,0 +1,3 @@ + + +Crash using riscv.shakti.cclass.soc device diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/64 b/results/classifier/mode-deepseek-r1:32b/output/system/64 new file mode 100644 index 00000000..fb2b2af1 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/64 @@ -0,0 +1,3 @@ + + +raspi3 machine can not shutdown diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/642 b/results/classifier/mode-deepseek-r1:32b/output/system/642 new file mode 100644 index 00000000..92ec4286 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/642 @@ -0,0 +1,6 @@ + + +Slow QEMU I/O on macOS host +Description of problem: +QEMU on macOS host gives very low I/O speed. Tested with fio tool, compared to linux host +Tested on QEMU v6.1.0, and the recent master diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/644 b/results/classifier/mode-deepseek-r1:32b/output/system/644 new file mode 100644 index 00000000..3758ad02 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/644 @@ -0,0 +1,11 @@ + + +generic loader does not do virtual to physical address translation when loading MIPS ELF +Description of problem: + +Steps to reproduce: +1.build two ELFs, whose virtual address is at kseg0<p> +2.load one ELF with generic loader "-device loader,file=test1.elf", the other ELF with "-kernel test2.elf"<p> +3.generic loader loads test1.elf without doing address translation, while mipssim load_kernel will do that with cpu_mips_kseg0_to_phys<p> +Additional information: +generic_loader_realize calls load_elf_as with the argument translate_fn=NULL. Maybe, we can set translate_fn when elf_machine is EM_MIPS. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/645 b/results/classifier/mode-deepseek-r1:32b/output/system/645 new file mode 100644 index 00000000..18e6d767 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/645 @@ -0,0 +1,3 @@ + + +Centos6.8 compiling qeum-2.12.0 failed, Does centos6.8 not support qeum-2.12.0? diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/647 b/results/classifier/mode-deepseek-r1:32b/output/system/647 new file mode 100644 index 00000000..6e7926fc --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/647 @@ -0,0 +1,303 @@ + + +scsi_device_purge_requests() waits infinietly +Description of problem: +QEMU hangs typing `system_reset` in the monitor, the monitor becomes unresponsive, as does VNC. +Steps to reproduce: +1. In the guest as root: `dd if=/dev/sda ibs=2K obs=1M of=/dev/null` +2. In the host monitor: `(qemu) system_reset` +3. Attach with gdb +4. Press ^C in the unresponsive monitor +``` +Thread 1 "qemu-system-x86" received signal SIGINT, Interrupt. +0x00007ffff749796e in ppoll () from /lib64/libc.so.6 +(gdb) bt +#0 0x00007ffff749796e in ppoll () at /lib64/libc.so.6 +#1 0x00005555570e829a in ppoll () +#2 0x0000555559624473 in qemu_poll_ns (fds=0x6060000204e0, nfds=1, timeout=-1) at ../util/qemu-timer.c:336 +#3 0x0000555559651973 in fdmon_poll_wait (ctx=0x61300004d900, ready_list=0x7fffffffb200, timeout=-1) at ../util/fdmon-poll.c:80 +#4 0x00005555595f48f1 in aio_poll (ctx=0x61300004d900, blocking=true) at ../util/aio-posix.c:607 +#5 0x0000555559041dac in bdrv_do_drained_begin (bs=0x62900000a200, recursive=false, parent=0x0, ignore_bds_parents=false, poll=true) at ../block/io.c:473 +#6 0x00005555590414a3 in bdrv_drained_begin (bs=0x62900000a200) at ../block/io.c:479 +#7 0x000055555916f180 in blk_drain (blk=0x618000001080) at ../block/block-backend.c:1732 +#8 0x000055555778f140 in scsi_device_purge_requests (sdev=0x617000004d80, sense=...) at ../hw/scsi/scsi-bus.c:1638 +#9 0x0000555557842df9 in scsi_disk_reset (dev=0x617000004d80) at ../hw/scsi/scsi-disk.c:2248 +#10 0x00005555592a557e in device_transitional_reset (obj=0x617000004d80) at ../hw/core/qdev.c:1028 +#11 0x00005555592a7eb7 in resettable_phase_hold (obj=0x617000004d80, opaque=0x0, type=RESET_TYPE_COLD) at ../hw/core/resettable.c:182 +#12 0x000055555928a2e8 in bus_reset_child_foreach (obj=0x62d0000268d8, cb=0x5555592a78e0 <resettable_phase_hold>, opaque=0x0, type=RESET_TYPE_COLD) at ../hw/core/bus.c:97 +#13 0x00005555592aaaac in resettable_child_foreach (rc=0x60e000026f40, obj=0x62d0000268d8, cb=0x5555592a78e0 <resettable_phase_hold>, opaque=0x0, type=RESET_TYPE_COLD) at ../hw/core/resettable.c:96 +#14 0x00005555592a7b9a in resettable_phase_hold (obj=0x62d0000268d8, opaque=0x0, type=RESET_TYPE_COLD) at ../hw/core/resettable.c:173 +#15 0x00005555592a1c55 in device_reset_child_foreach (obj=0x62d000026680, cb=0x5555592a78e0 <resettable_phase_hold>, opaque=0x0, type=RESET_TYPE_COLD) at ../hw/core/qdev.c:366 +#16 0x00005555592aaaac in resettable_child_foreach (rc=0x60e000040a80, obj=0x62d000026680, cb=0x5555592a78e0 <resettable_phase_hold>, opaque=0x0, type=RESET_TYPE_COLD) at ../hw/core/resettable.c:96 +#17 0x00005555592a7b9a in resettable_phase_hold (obj=0x62d000026680, opaque=0x0, type=RESET_TYPE_COLD) at ../hw/core/resettable.c:173 +#18 0x000055555928a2e8 in bus_reset_child_foreach (obj=0x62d0000265f8, cb=0x5555592a78e0 <resettable_phase_hold>, opaque=0x0, type=RESET_TYPE_COLD) at ../hw/core/bus.c:97 +#19 0x00005555592aaaac in resettable_child_foreach (rc=0x60e000026680, obj=0x62d0000265f8, cb=0x5555592a78e0 <resettable_phase_hold>, opaque=0x0, type=RESET_TYPE_COLD) at ../hw/core/resettable.c:96 +#20 0x00005555592a7b9a in resettable_phase_hold (obj=0x62d0000265f8, opaque=0x0, type=RESET_TYPE_COLD) at ../hw/core/resettable.c:173 +#21 0x00005555592a1c55 in device_reset_child_foreach (obj=0x62d00001e400, cb=0x5555592a78e0 <resettable_phase_hold>, opaque=0x0, type=RESET_TYPE_COLD) at ../hw/core/qdev.c:366 +#22 0x00005555592aaaac in resettable_child_foreach (rc=0x60e000042300, obj=0x62d00001e400, cb=0x5555592a78e0 <resettable_phase_hold>, opaque=0x0, type=RESET_TYPE_COLD) at ../hw/core/resettable.c:96 +#23 0x00005555592a7b9a in resettable_phase_hold (obj=0x62d00001e400, opaque=0x0, type=RESET_TYPE_COLD) at ../hw/core/resettable.c:173 +#24 0x000055555928a2e8 in bus_reset_child_foreach (obj=0x62200005c260, cb=0x5555592a78e0 <resettable_phase_hold>, opaque=0x0, type=RESET_TYPE_COLD) at ../hw/core/bus.c:97 +#25 0x00005555592aaaac in resettable_child_foreach (rc=0x60e00002e2c0, obj=0x62200005c260, cb=0x5555592a78e0 <resettable_phase_hold>, opaque=0x0, type=RESET_TYPE_COLD) at ../hw/core/resettable.c:96 +#26 0x00005555592a7b9a in resettable_phase_hold (obj=0x62200005c260, opaque=0x0, type=RESET_TYPE_COLD) at ../hw/core/resettable.c:173 +#27 0x00005555592a1c55 in device_reset_child_foreach (obj=0x62200005b900, cb=0x5555592a78e0 <resettable_phase_hold>, opaque=0x0, type=RESET_TYPE_COLD) at ../hw/core/qdev.c:366 +#28 0x00005555592aaaac in resettable_child_foreach (rc=0x60e000030940, obj=0x62200005b900, cb=0x5555592a78e0 <resettable_phase_hold>, opaque=0x0, type=RESET_TYPE_COLD) at ../hw/core/resettable.c:96 +#29 0x00005555592a7b9a in resettable_phase_hold (obj=0x62200005b900, opaque=0x0, type=RESET_TYPE_COLD) at ../hw/core/resettable.c:173 +#30 0x000055555928a2e8 in bus_reset_child_foreach (obj=0x61d00008a280, cb=0x5555592a78e0 <resettable_phase_hold>, opaque=0x0, type=RESET_TYPE_COLD) at ../hw/core/bus.c:97 +#31 0x00005555592aaaac in resettable_child_foreach (rc=0x60e00002e2c0, obj=0x61d00008a280, cb=0x5555592a78e0 <resettable_phase_hold>, opaque=0x0, type=RESET_TYPE_COLD) at ../hw/core/resettable.c:96 +#32 0x00005555592a7b9a in resettable_phase_hold (obj=0x61d00008a280, opaque=0x0, type=RESET_TYPE_COLD) at ../hw/core/resettable.c:173 +#33 0x00005555592a1c55 in device_reset_child_foreach (obj=0x62a000006200, cb=0x5555592a78e0 <resettable_phase_hold>, opaque=0x0, type=RESET_TYPE_COLD) at ../hw/core/qdev.c:366 +#34 0x00005555592aaaac in resettable_child_foreach (rc=0x60e000030160, obj=0x62a000006200, cb=0x5555592a78e0 <resettable_phase_hold>, opaque=0x0, type=RESET_TYPE_COLD) at ../hw/core/resettable.c:96 +#35 0x00005555592a7b9a in resettable_phase_hold (obj=0x62a000006200, opaque=0x0, type=RESET_TYPE_COLD) at ../hw/core/resettable.c:173 +#36 0x000055555928a2e8 in bus_reset_child_foreach (obj=0x60c000020a40, cb=0x5555592a78e0 <resettable_phase_hold>, opaque=0x0, type=RESET_TYPE_COLD) at ../hw/core/bus.c:97 +#37 0x00005555592aaaac in resettable_child_foreach (rc=0x60e00002fde0, obj=0x60c000020a40, cb=0x5555592a78e0 <resettable_phase_hold>, opaque=0x0, type=RESET_TYPE_COLD) at ../hw/core/resettable.c:96 +#38 0x00005555592a7b9a in resettable_phase_hold (obj=0x60c000020a40, opaque=0x0, type=RESET_TYPE_COLD) at ../hw/core/resettable.c:173 +#39 0x00005555592a6e04 in resettable_assert_reset (obj=0x60c000020a40, type=RESET_TYPE_COLD) at ../hw/core/resettable.c:60 +#40 0x00005555592a6cb7 in resettable_reset (obj=0x60c000020a40, type=RESET_TYPE_COLD) at ../hw/core/resettable.c:45 +#41 0x00005555592a9337 in resettable_cold_reset_fn (opaque=0x60c000020a40) at ../hw/core/resettable.c:269 +#42 0x00005555592a6c35 in qemu_devices_reset () at ../hw/core/reset.c:69 +#43 0x00005555582fb4f5 in pc_machine_reset (machine=0x616000000380) at ../hw/i386/pc.c:1764 +#44 0x0000555558a58e56 in qemu_system_reset (reason=SHUTDOWN_CAUSE_HOST_QMP_SYSTEM_RESET) at ../softmmu/runstate.c:443 +#45 0x0000555558a5a746 in main_loop_should_exit () at ../softmmu/runstate.c:688 +#46 0x0000555558a5a57e in qemu_main_loop () at ../softmmu/runstate.c:722 +#47 0x00005555571acaef in main (argc=58, argv=0x7fffffffd8f8, envp=0x7fffffffdad0) at ../softmmu/main.c:50 +(gdb) +(gdb) fr 5 +#5 0x0000555559041dac in bdrv_do_drained_begin (bs=0x62900000a200, recursive=false, parent=0x0, ignore_bds_parents=false, poll=true) at ../block/io.c:473 +473 BDRV_POLL_WHILE(bs, bdrv_drain_poll_top_level(bs, recursive, parent)); +(gdb) p *bs +$1 = {open_flags = 24578, encrypted = false, sg = false, probed = false, force_share = false, implicit = false, drv = 0x55555b0b0c60 <bdrv_qcow2>, opaque = 0x615000015200, aio_context = 0x6130000df080, + aio_notifiers = {lh_first = 0x0}, walking_aio_notifiers = false, filename = "nvme://0000:bc:00.0/1", '\000' <repeats 4074 times>, backing_file = '\000' <repeats 4095 times>, + auto_backing_file = '\000' <repeats 4095 times>, backing_format = '\000' <repeats 15 times>, full_open_options = 0x621002ba2100, exact_filename = "nvme://0000:bc:00.0/1", '\000' <repeats 4074 times>, + backing = 0x0, file = 0x608000002ba0, bl = {request_alignment = 1, max_pdiscard = 0, pdiscard_alignment = 65536, max_pwrite_zeroes = 0, pwrite_zeroes_alignment = 65536, opt_transfer = 0, + max_transfer = 131072, max_hw_transfer = 0, min_mem_alignment = 512, opt_mem_alignment = 4096, max_iov = 1024}, supported_read_flags = 0, supported_write_flags = 0, supported_zero_flags = 260, + supported_truncate_flags = 2, node_name = "drive_nvme1", '\000' <repeats 20 times>, node_list = {tqe_next = 0x0, tqe_circ = {tql_next = 0x0, tql_prev = 0x6290000092d0}}, bs_list = {tqe_next = 0x0, + tqe_circ = {tql_next = 0x0, tql_prev = 0x6290000092e0}}, monitor_list = {tqe_next = 0x0, tqe_circ = {tql_next = 0x0, tql_prev = 0x6290000092f0}}, refcnt = 2, op_blockers = {{ + lh_first = 0x0} <repeats 16 times>}, inherits_from = 0x0, children = {lh_first = 0x608000002ba0}, parents = {lh_first = 0x608000003620}, options = 0x621000019100, explicit_options = 0x62100001a500, + detect_zeroes = BLOCKDEV_DETECT_ZEROES_OPTIONS_OFF, backing_blocker = 0x0, total_sectors = 41943040, write_threshold_offset = 0, dirty_bitmap_mutex = {lock = {__data = {__lock = 0, __count = 0, __owner = 0, + __nusers = 0, __kind = 0, __spins = 0, __elision = 0, __list = {__prev = 0x0, __next = 0x0}}, __size = '\000' <repeats 39 times>, __align = 0}, file = 0x0, line = 0, initialized = true}, + dirty_bitmaps = {lh_first = 0x0}, wr_highest_offset = {value = 17686634496}, copy_on_read = 0, in_flight = 128, serialising_in_flight = 0, io_plugged = 0, enable_write_cache = 0, quiesce_counter = 1, + recursive_quiesce_counter = 0, write_gen = 101, reqs_lock = {locked = 0, ctx = 0x0, from_push = {slh_first = 0x0}, to_pop = {slh_first = 0x0}, handoff = 0, sequence = 0, holder = 0x0}, tracked_requests = { + lh_first = 0x7ffc251b48a0}, flush_queue = {entries = {sqh_first = 0x0, sqh_last = 0x62900000e470}}, active_flush_req = false, flushed_gen = 81, never_freeze = false} +(gdb) fr 4 +#4 0x00005555595f48f1 in aio_poll (ctx=0x61300004d900, blocking=true) at ../util/aio-posix.c:607 +607 ret = ctx->fdmon_ops->wait(ctx, &ready_list, timeout); +(gdb) p timeout +$5 = -1 +(gdb) p blocking +$6 = true +(gdb) p *ctx +$3 = {source = {callback_data = 0x0, callback_funcs = 0x0, source_funcs = 0x55555b42d900 <aio_source_funcs>, ref_count = 2, context = 0x60f000000400, priority = 0, flags = 33, source_id = 1, + poll_fds = 0x615000001790 = {0x60d000000860}, prev = 0x0, next = 0x61300004d3c0, name = 0x602000010a10 "aio-context", priv = 0x619000003830}, lock = {m = {lock = {__data = {__lock = 0, __count = 0, + __owner = 0, __nusers = 0, __kind = 1, __spins = 0, __elision = 0, __list = {__prev = 0x0, __next = 0x0}}, __size = '\000' <repeats 16 times>, "\001", '\000' <repeats 22 times>, __align = 0}, + file = 0x0, line = 0, initialized = true}}, aio_handlers = {lh_first = 0x60d000000860}, deleted_aio_handlers = {lh_first = 0x0}, notify_me = 2, list_lock = {count = 4}, bh_list = {slh_first = 0x0}, + bh_slice_list = {sqh_first = 0x0, sqh_last = 0x61300004d9b8}, notified = false, notifier = {rfd = 7, wfd = 7, initialized = true}, scheduled_coroutines = {slh_first = 0x0}, co_schedule_bh = 0x604000001110, + thread_pool = 0x0, tlg = {tl = {0x60b00000a1d0, 0x60b00000a280, 0x60b00000a330, 0x60b00000a3e0}}, external_disable_cnt = 0, poll_disable_cnt = 0, poll_ns = 0, poll_max_ns = 0, poll_grow = 0, + poll_shrink = 0, aio_max_batch = 0, poll_aio_handlers = {lh_first = 0x60d000000860}, poll_started = false, epollfd = 6, fdmon_ops = 0x55555a4ebbc0 <fdmon_poll_ops>} +(gdb) p ctx->bh_list +$8 = {slh_first = 0x0} +(gdb) p ctx->bh_slice_list +$9 = {sqh_first = 0x0, sqh_last = 0x61300004d9b8} +(gdb) p *ctx->bh_slice_list.sqh_last +$11 = (struct BHListSlice *) 0x0 +(gdb) p ctx->tlg +$12 = {tl = {0x60b00000a1d0, 0x60b00000a280, 0x60b00000a330, 0x60b00000a3e0}} +(gdb) p timerlist_deadline_ns(ctx->tlg.tl[0]) +$14 = -1 +(gdb) p timerlist_deadline_ns(ctx->tlg.tl[1]) +$15 = -1 +(gdb) p timerlist_deadline_ns(ctx->tlg.tl[2]) +$16 = -1 +(gdb) p timerlist_deadline_ns(ctx->tlg.tl[3]) +$17 = -1 +``` +What I see is: +- timerlistgroup_deadline_ns() -> -1 +- aio_compute_timeout() -> -1 +- aio_poll() -> -1 + +So scsi_device_purge_requests() waits indefinitively. +Additional information: +``` +../configure --enable-trace-backends=log --disable-docs --enable-debug --extra-cflags='-ggdb -fPIE' --disable-user --disable-tools --target-list=x86_64-softmmu --cc=clang --cxx=clang++ --enable-sanitizers --disable-vhost-user +qemu 6.1.0 + + Directories + Install prefix: /usr/local + BIOS directory: share/qemu + firmware path: /usr/local/share/qemu-firmware + binary directory: bin + library directory: lib + module directory: lib/qemu + libexec directory: libexec + include directory: include + config directory: /usr/local/etc + local state directory: /usr/local/var + Manual directory: share/man + Doc directory: /usr/local/share/doc + Build directory: /home/philmd/qemu/build + Source path: /home/philmd/qemu + GIT submodules: ui/keycodemapdb meson tests/fp/berkeley-testfloat-3 tests/fp/berkeley-softfloat-3 dtc capstone slirp + + Host binaries + git: git + make: make + python: /usr/bin/python3 (version: 3.9) + sphinx-build: NO + gdb: /usr/bin/gdb + genisoimage: /usr/bin/mkisofs + smbd: "/usr/sbin/smbd" + + Configurable features + Documentation: NO + system-mode emulation: YES + user-mode emulation: NO + block layer: YES + Install blobs: YES + module support: NO + fuzzing support: NO + Audio drivers: oss + Trace backends: log + QOM debugging: YES + vhost-kernel support: YES + vhost-net support: YES + vhost-crypto support: NO + vhost-scsi support: YES + vhost-vsock support: YES + vhost-user support: NO + vhost-user-blk server support: NO + vhost-user-fs support: NO + vhost-vdpa support: YES + build guest agent: YES + + Compilation + host CPU: x86_64 + host endianness: little + C compiler: clang + Host C compiler: clang + C++ compiler: clang++ + CFLAGS: -O0 -g + CXXFLAGS: -O0 -g + QEMU_CFLAGS: -fsanitize=undefined -fsanitize=address -m64 -mcx16 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -fno-common -fwrapv -ggdb -fPIE -Wold-style-definition -Wtype-limits -Wformat-security -Wformat-y2k -Winit-self -Wignored-qualifiers -Wempty-body -Wnested-externs -Wendif-labels -Wexpansion-to-defined -Wno-initializer-overrides -Wno-missing-include-dirs -Wno-shift-negative-value -Wno-string-plus-int -Wno-typedef-redefinition -Wno-tautological-type-limit-compare -Wno-psabi -fstack-protector-strong + QEMU_LDFLAGS: -Wl,--warn-common -fsanitize=undefined -fsanitize=address -Wl,-z,relro -Wl,-z,now -m64 -ggdb -fPIE -fstack-protector-strong + profiler: NO + link-time optimization (LTO): NO + PIE: YES + static build: NO + malloc trim support: YES + membarrier: NO + debug stack usage: NO + mutex debugging: YES + memory allocator: system + avx2 optimization: NO + avx512f optimization: NO + gprof enabled: NO + gcov: NO + thread sanitizer: NO + CFI support: NO + strip binaries: NO + sparse: NO + mingw32 support: NO + x86_64 tests: x86_64-linux-gnu-gcc via debian-amd64-cross + + Targets and accelerators + KVM support: YES + HAX support: NO + HVF support: NO + WHPX support: NO + NVMM support: NO + Xen support: NO + TCG support: YES + TCG backend: native (x86_64) + TCG plugins: YES + TCG debug enabled: YES + target list: x86_64-softmmu + default devices: YES + out of process emulation: YES + + Block layer support + coroutine backend: ucontext + coroutine pool: YES + Block whitelist (rw): + Block whitelist (ro): + Use block whitelist in tools: NO + VirtFS support: NO + build virtiofs daemon: NO + Live block migration: YES + replication support: YES + bochs support: YES + cloop support: YES + dmg support: YES + qcow v1 support: YES + vdi support: YES + vvfat support: YES + qed support: YES + parallels support: YES + FUSE exports: NO + + Crypto + TLS priority: "NORMAL" + GNUTLS support: YES + GNUTLS crypto: YES + libgcrypt: NO + nettle: NO + crypto afalg: NO + rng-none: NO + Linux keyring: YES + + Dependencies + SDL support: NO + SDL image support: NO + GTK support: NO + pixman: YES + VTE support: NO + slirp support: internal + libtasn1: YES + PAM: NO + iconv support: YES + curses support: YES + virgl support: NO + curl support: NO + Multipath support: NO + VNC support: YES + VNC SASL support: YES + VNC JPEG support: YES + VNC PNG support: NO + brlapi support: NO + vde support: NO + netmap support: NO + Linux AIO support: NO + Linux io_uring support: NO + ATTR/XATTR support: YES + RDMA support: NO + PVRDMA support: NO + fdt support: internal + libcap-ng support: NO + bpf support: NO + spice support: NO + rbd support: NO + xfsctl support: NO + smartcard support: NO + U2F support: NO + libusb: NO + usb net redir: NO + OpenGL support: NO + GBM: NO + libiscsi support: NO + libnfs support: NO + seccomp support: NO + GlusterFS support: NO + TPM support: YES + libssh support: NO + lzo support: NO + snappy support: NO + bzip2 support: NO + lzfse support: NO + zstd support: NO + NUMA host support: NO + libxml2: NO + capstone: internal + libpmem support: NO + libdaxctl support: NO + libudev: NO + FUSE lseek: NO + ``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/655 b/results/classifier/mode-deepseek-r1:32b/output/system/655 new file mode 100644 index 00000000..1b2cd454 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/655 @@ -0,0 +1,34 @@ + + +Java crashes on s390x VM with SIGILL/ILL_PRVOPC at '__kernel_getcpu+0x8' +Description of problem: +The `java` command fails with the following message: + +```console +$ /usr/lib/jvm/java-17-openjdk-s390x/bin/java --version +# +# A fatal error has been detected by the Java Runtime Environment: +# +# SIGILL (0x4) at pc=0x000003ff9e4fe6f4, pid=2883, tid=2884 +# +# JRE version: (17.0+35) (build ) +# Java VM: OpenJDK 64-Bit Server VM (17+35-Ubuntu-120.04, mixed +# mode, sharing, tiered, compressed oops, compressed class ptrs, +# serial gc, linux-s390x) +# Problematic frame: +# C [linux-vdso64.so.1+0x6f8] __kernel_getcpu+0x8 +# +# Core dump will be written. Default location: Core dumps may +# be processed with "/usr/share/apport/apport %p %s %c %d %P %E" +# (or dumping to /home/ubuntu/core.2883) +# +# An error report file with more information is saved as: +# /home/ubuntu/hs_err_pid2883.log +# +# +Aborted (core dumped) +``` +Steps to reproduce: +1. Run `java --version` +Additional information: +The corresponding log file is attached as the file [hs_err_pid2883.log](/uploads/1631b6a0f0aad2f77c4928ed6bb540c6/hs_err_pid2883.log). diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/657 b/results/classifier/mode-deepseek-r1:32b/output/system/657 new file mode 100644 index 00000000..1bcb430d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/657 @@ -0,0 +1,3 @@ + + +qemu no valid state has been set by load or init-program Mac OS X Tiger diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/658 b/results/classifier/mode-deepseek-r1:32b/output/system/658 new file mode 100644 index 00000000..20ff93c5 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/658 @@ -0,0 +1,3 @@ + + +Missing documentation for TCG ctpop opcode diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/66 b/results/classifier/mode-deepseek-r1:32b/output/system/66 new file mode 100644 index 00000000..8fe1e71f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/66 @@ -0,0 +1,3 @@ + + +-hda FAT:. limited to 504MBytes diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/660 b/results/classifier/mode-deepseek-r1:32b/output/system/660 new file mode 100644 index 00000000..ac7a84bd --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/660 @@ -0,0 +1,11 @@ + + +User emulation does not use host GPU +Description of problem: + +Steps to reproduce: +1. Make a Arch Linux chroot (though any Linux system should work) on Linux +2. run `glxinfo | grep OpenGL +3. It's using llvmpipe, not whatever GPU/driver that the hosts use +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/667791 b/results/classifier/mode-deepseek-r1:32b/output/system/667791 new file mode 100644 index 00000000..79e33187 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/667791 @@ -0,0 +1,41 @@ + + +Cygwin build fails due to ui/vnc-etc-tight.c + +Configure: +./configure \ +--prefix="./install/bin/" \ +--interp-prefix="./install/bin-%M/" \ +--cc="gcc -mno-cygwin" \ +--host-cc="gcc" \ +--disable-sdl \ +--enable-system \ +--disable-user \ +--disable-linux-user \ +--disable-darwin-user \ +--disable-bsd-user \ +--disable-xen \ +--disable-brlapi \ +--disable-vnc-tls \ +--disable-vnc-sasl \ +--disable-vnc-jpeg \ +--disable-vnc-png \ +--disable-vnc-thread \ +--disable-curses \ +--disable-curl \ +--disable-bluez \ +--disable-kvm \ +--disable-nptl \ +--disable-vde \ +--disable-vhost-net + +Versions of software +Cygwin 1.7 +GNU Make 3.81 +GCC 3.4.4 (/usr/lib/gcc/i686-pc-cygwin/3.4.4/libgcc.a) +QEMU 0.13.0 + +Result: +Function tight_detect_smooth_image24(...) uses "uint" type, that appears to be not defined in this scope. Prepending this function with +typedef unsigned int uint; +fixes build. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/668 b/results/classifier/mode-deepseek-r1:32b/output/system/668 new file mode 100644 index 00000000..dde4b27b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/668 @@ -0,0 +1,23 @@ + + +No trace verbs +Description of problem: +I am trying to follow [this tutorial](https://github.com/ryanprescott/realtek-verb-tools/wiki/How-to-sniff-verbs-from-a-Windows-sound-driver) to get my sound working again, but I am stuck at the step where I have to analyse the verbs, because I get none. They say I should get things similar to this: +``` +CORB[1] = 0xf0000 (caddr:0x0 nid:0x0 control:0xf00 param:0x0) +CORB[2] = 0xf0002 (caddr:0x0 nid:0x0 control:0xf00 param:0x2) +CORB[3] = 0xf0004 (caddr:0x0 nid:0x0 control:0xf00 param:0x4) +RIRBWP advance to 3, last WP 0 +CORB caddr:0x0 nid:0x0 control:0xf00 param:0x0 response:0x10ec0245 (ex 0x0) +CORB caddr:0x0 nid:0x0 control:0xf00 param:0x2 response:0x100001 (ex 0x0) +CORB caddr:0x0 nid:0x0 control:0xf00 param:0x4 response:0x10001 (ex 0x0) +``` +in the `qemu-output.txt` file, but instead I am getting [this](https://github.com/ryanprescott/realtek-verb-tools/files/7331986/qemu-output.txt) in the console. + +How do I get verbs in the first format ? + +I tried compiling qemu from source with this: `./configure --enable-trace-backends=log --target-list=x86_64-softmmu`, but that produced the same result as using the `qemu-system-x86_64` command that I got by installing qemu with my package manager. +Steps to reproduce: +https://github.com/ryanprescott/realtek-verb-tools/wiki/How-to-sniff-verbs-from-a-Windows-sound-driver +Additional information: +I don't know, as me if I am missing something diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/67 b/results/classifier/mode-deepseek-r1:32b/output/system/67 new file mode 100644 index 00000000..dd52d4e7 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/67 @@ -0,0 +1,3 @@ + + +incomplete emulation of fstenv under TCG diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/670 b/results/classifier/mode-deepseek-r1:32b/output/system/670 new file mode 100644 index 00000000..5c275434 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/670 @@ -0,0 +1,12 @@ + + +qemu x86_64 for microsoft windows hangs when booting a Debian Live 11.1 iso file +Description of problem: +qemu displays the boot screen from the live linux iso and starts the boot, but no more display is performed even when waiting for approximately 30 minutes +Steps to reproduce: +1. Get hold of a Live Linux iso from Debian 11.1 +2. Set up the Microsoft Windows version of qemu from https://qemu.weilnetz.de/ +3. Attempt to boot the Live Linux iso +Additional information: +I also tested older versions of QEMU from the Weilnetz web site. 6.0.0 and 5.2.0 are bad; 5.1.0 and older are good. I then tested the same command line ( no acceleration ) under Linux Tumbleweed 20211014 with qemu 6.1.0 and the iso booted successfully. I have not tried with isos from distributions other than Debian 11.1 . So there is a bug with the Microsoft Windows-specific code in qemu. +If you need the specific Live Linux that I was using, let me know and I will get it to you somehow. It is several GB in size so I cannot upload it anywhere conveniently. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/672 b/results/classifier/mode-deepseek-r1:32b/output/system/672 new file mode 100644 index 00000000..e49430a5 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/672 @@ -0,0 +1,5 @@ + + +Slow emulation of mac99 (PowerPC G4) due to being single-threaded. +Additional information: +None diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/672934 b/results/classifier/mode-deepseek-r1:32b/output/system/672934 new file mode 100644 index 00000000..4df263bd --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/672934 @@ -0,0 +1,9 @@ + + +FPU incorrect on Mac OS X + +I am using the 0.13.0 release version of QEMU on Mac OS X 10.6.4. I work for a university and the affected guest OS is our own research OS. I believe I found a bug in QEMU's FPU emulation, which only triggers on the Mac. You can reproduce the problem by booting the attached ISO image. + +Investigating the problem, I found that the lua interpreter in our loader component (called "ned") internally uses doubles to represent all lua-numbers. These doubles are showing completely wrong values on QEMU/Mac, resulting in the lua code not processing properly. + +I also attached a patch which fixes the problem for me. The attached ZIP-file also contains "before" and "after" screenshots. Note that booting the ISO on a real machine or on a Linux-QEMU always shows the correct "after" behavior. Only QEMU on the Mac exhibits the wrong "before" behavior without my patch. The patch might break other systems setting the CONFIG_BSD flag, so maybe the preprocessor should check for __APPLE__ instead to make the fix Mac-only. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/676 b/results/classifier/mode-deepseek-r1:32b/output/system/676 new file mode 100644 index 00000000..ae55af33 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/676 @@ -0,0 +1,56 @@ + + +Throws a PF when it should throw a GF/SS +Description of problem: +QEMU misreports what should be a #GP as a #PF +``` +check_exception old: 0xffffffff new 0xe + 0: v=0e e=0001 i=0 cpl=0 IP=0028:ffffffffb28fa53b pc=ffffffffb28fa53b SP=0030:ffffffffb2901210 CR2=1fbf7020000772a4 +RAX=1fbf7020000772a4 RBX=0000000000000000 RCX=ffff80000006a0a8 RDX=ffff80000006a038 +RSI=1fbff0200000d26c RDI=0000000000000080 RBP=ffffffffb2901230 RSP=ffffffffb2901210 +R8 =ffffffffb28fb37f R9 =0000000000000000 R10=0000000000000000 R11=0000000000000000 +R12=0000000000000000 R13=0000000000000000 R14=0000000000000000 R15=0000000000000000 +RIP=ffffffffb28fa53b RFL=00000007 [-----PC] CPL=0 II=0 A20=1 SMM=0 HLT=0 +ES =0030 0000000000000000 00000000 00009300 DPL=0 DS [-WA] +CS =0028 0000000000000000 00000000 00209a00 DPL=0 CS64 [-R-] +SS =0030 0000000000000000 00000000 00009300 DPL=0 DS [-WA] +DS =0030 0000000000000000 00000000 00009300 DPL=0 DS [-WA] +FS =0030 0000000000000000 00000000 00009300 DPL=0 DS [-WA] +GS =0030 0000000000000000 00000000 00009300 DPL=0 DS [-WA] +LDT=0000 0000000000000000 00000000 00008200 DPL=0 LDT +TR =0000 0000000000000000 0000ffff 00008b00 DPL=0 TSS64-busy +GDT= 000000000000edc0 00000037 +IDT= 000000000002e6a0 000000ff +CR0=80000013 CR2=1fbf7020000772a4 CR3=0000000000058000 CR4=000006a0 +DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 +DR6=00000000ffff0ff0 DR7=0000000000000400 +CCS=3f7fe0400001a4d9 CCD=1fbff0200000d26c CCO=SARQ +EFER=0000000000000501 +``` + +Now, `CR2=1fbf7020000772a4` is of course a non-canonical address, and therefore should not generate a #PF, rather it should generate a #GP. I also tried to generate a #SS by dereferencing a non-canonical address through the stack, and that also throws a #PF instead of a #SS + +``` +check_exception old: 0xffffffff new 0xe + 0: v=0e e=0001 i=0 cpl=0 IP=0028:fffffffff4bda92a pc=fffffffff4bda92a SP=0030:1fbf7020000772a4 CR2=1fbf70200007729c +RAX=0000000000000000 RBX=0000000000000000 RCX=0000000000000000 RDX=fffffffff4bdb998 +RSI=0000000000000000 RDI=fffffffff4bdb998 RBP=fffffffff4bdf290 RSP=1fbf7020000772a4 +R8 =0000000000000000 R9 =0000000000000000 R10=0000000000000000 R11=0000000000000000 +R12=0000000000000000 R13=0000000000000000 R14=0000000000000000 R15=0000000000000000 +RIP=fffffffff4bda92a RFL=00000046 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 +ES =0030 0000000000000000 00000000 00009300 DPL=0 DS [-WA] +CS =0028 0000000000000000 00000000 00209a00 DPL=0 CS64 [-R-] +SS =0030 0000000000000000 00000000 00009300 DPL=0 DS [-WA] +DS =0030 0000000000000000 00000000 00009300 DPL=0 DS [-WA] +FS =0030 0000000000000000 00000000 00009300 DPL=0 DS [-WA] +GS =0030 0000000000000000 00000000 00009300 DPL=0 DS [-WA] +LDT=0000 0000000000000000 00000000 00008200 DPL=0 LDT +TR =0000 0000000000000000 0000ffff 00008b00 DPL=0 TSS64-busy +GDT= 000000000000edc0 00000037 +IDT= 000000000002e6a0 000000ff +CR0=80000011 CR2=1fbf70200007729c CR3=00000000bffa5000 CR4=00000020 +``` +Steps to reproduce: +1. Dereference a non-canonical address +2. QEMU gives you a page fault instead of a gpf +3. reconsider life diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/677 b/results/classifier/mode-deepseek-r1:32b/output/system/677 new file mode 100644 index 00000000..98086cd4 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/677 @@ -0,0 +1,3 @@ + + +Qemu crashes when trying to load kernel inside of WSL2 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/683 b/results/classifier/mode-deepseek-r1:32b/output/system/683 new file mode 100644 index 00000000..e3efa052 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/683 @@ -0,0 +1,3 @@ + + +certain programs make QEMU crash with "tcg fatal error" diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/687 b/results/classifier/mode-deepseek-r1:32b/output/system/687 new file mode 100644 index 00000000..45cf34ba --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/687 @@ -0,0 +1,3 @@ + + +what is the DMAR? diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/694 b/results/classifier/mode-deepseek-r1:32b/output/system/694 new file mode 100644 index 00000000..0fcd7250 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/694 @@ -0,0 +1,3 @@ + + +Crash using MIPS I7200 CPU with non-nanoMIPS ELF diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/696834 b/results/classifier/mode-deepseek-r1:32b/output/system/696834 new file mode 100644 index 00000000..e3306681 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/696834 @@ -0,0 +1,33 @@ + + +FP exception reporting not working on NetBSD host + +I recognize that NetBSD is not one of the officially supported host OS. However, qemu 0.13.0 is available in the NetBSD pkgsrc collection, and works quite well. Well, with one exception (pun intended): It seems that Floating Point exceptions don't get reported properly. + +The following code-snippet demonstrates the problem: + + +volatile int flt_signal = 0; + +static sigjmp_buf sigfpe_flt_env; +static void +sigfpe_flt_action(int signo, siginfo_t *info, void *ptr) +{ + flt_signal++; +} + +void trigger(void) +{ + struct sigaction sa; + double d = strtod("0", NULL); + + if (sigsetjmp(sigfpe_flt_env, 0) == 0) { + sa.sa_flags = SA_SIGINFO; + sa.sa_sigaction = sigfpe_flt_action; + sigemptyset(&sa.sa_mask); + sigaction(SIGFPE, &sa, NULL); + fpsetmask(FP_X_INV|FP_X_DZ|FP_X_OFL|FP_X_UFL|FP_X_IMP); + printf("%g\n", 1 / d); + } + printf("FPE signal handler invoked %d times.\n"); +} \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/699 b/results/classifier/mode-deepseek-r1:32b/output/system/699 new file mode 100644 index 00000000..9c69be8e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/699 @@ -0,0 +1,3 @@ + + +SGX QEMU release diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/702 b/results/classifier/mode-deepseek-r1:32b/output/system/702 new file mode 100644 index 00000000..cfd65271 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/702 @@ -0,0 +1,3 @@ + + +Setup a gitlab shared runner for bsd-user testing diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/71 b/results/classifier/mode-deepseek-r1:32b/output/system/71 new file mode 100644 index 00000000..10bbdd72 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/71 @@ -0,0 +1,3 @@ + + +AC97 can allocate ~500MB of host RAM diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/710 b/results/classifier/mode-deepseek-r1:32b/output/system/710 new file mode 100644 index 00000000..4ab30482 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/710 @@ -0,0 +1,3 @@ + + +maybe-uninitialized warning building target/m68k/ with -O3 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/711 b/results/classifier/mode-deepseek-r1:32b/output/system/711 new file mode 100644 index 00000000..3bd551e2 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/711 @@ -0,0 +1,3 @@ + + +ATI Rage video card emulation diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/713 b/results/classifier/mode-deepseek-r1:32b/output/system/713 new file mode 100644 index 00000000..ffed77fb --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/713 @@ -0,0 +1,3 @@ + + +Missing safe-syscall.inc.S for mips diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/72 b/results/classifier/mode-deepseek-r1:32b/output/system/72 new file mode 100644 index 00000000..a8b08ecf --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/72 @@ -0,0 +1,3 @@ + + +mouse offset or invisible wall 2.11.0-3 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/724 b/results/classifier/mode-deepseek-r1:32b/output/system/724 new file mode 100644 index 00000000..5736b38a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/724 @@ -0,0 +1,3 @@ + + +esp: heap-buffer-overflow in esp_fifo_pop_buf diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/732 b/results/classifier/mode-deepseek-r1:32b/output/system/732 new file mode 100644 index 00000000..b0905652 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/732 @@ -0,0 +1,3 @@ + + +Can not use --enable-fuzzing on Ubuntu 20.04 Aarch64 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/736 b/results/classifier/mode-deepseek-r1:32b/output/system/736 new file mode 100644 index 00000000..48bda489 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/736 @@ -0,0 +1,49 @@ + + +qemu-system-arm crash (hardware error: tsc210x_txrx: FIXME: bad SPI word width 24) +Description of problem: +The `tests/avocado/machine_arm_n8x0.py:N8x0Machine.test_n800` will sometimes trigger situation where the test does not progress and ends up interrupted. One example is [here](https://gitlab.com/qemu-project/qemu/-/jobs/1796742618#L242): + +``` +(075/171) tests/avocado/machine_arm_n8x0.py:N8x0Machine.test_n800: INTERRUPTED: Test interrupted by SIGTERM\nRunner error occurred: Timeout reached\nOriginal status: ERROR\n{'name': '075-tests/avocado/machine_arm_n8x0.py:N8x0Machine.test_n800', 'logdir': '/builds/qem +``` +Steps to reproduce: +1. ./tests/venv/bin/avocado assets fetch tests/avocado/machine_arm_n8x0.py +2. nc -l -U /var/tmp/qemu-monitor.sock +3. ./qemu-system-arm -display none -vga none -chardev socket,id=mon,path=/var/tmp/qemu-monitor.sock -mon chardev=mon,mode=control -machine n800 -serial null -chardev socket,id=console,path=/var/tmp/qemu-51887-console.sock,server=on,wait=off -serial chardev:console -kernel $HOME/avocado/data/cache/by_location/07af9de13713c2905e8c6a88d6600eb1bc885c5c/meego-arm-n8x0-1.0.80.20100712.1431-vmlinuz-2.6.35~rc4-129.1-n8x0 -append 'printk.time=0 console=ttyS1' +Additional information: +``` +#0 __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44 +#1 0x00007ffff4d498c3 in __pthread_kill_internal (signo=6, threadid=<optimized out>) at pthread_kill.c:78 +#2 0x00007ffff4cfc6b6 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26 +#3 0x00007ffff4ce67d3 in __GI_abort () at abort.c:79 +#4 0x0000555555e544b3 in hw_error (fmt=0x555556264da8 "%s: FIXME: bad SPI word width %i\n") at ../../src/qemu/softmmu/cpus.c:126 +#5 0x0000555555a8f4b8 in tsc210x_txrx (opaque=0x5555579e9820, value=6468416, len=24) at ../../src/qemu/hw/input/tsc210x.c:913 +#6 0x0000555555bf49c1 in omap_mcspi_transfer_run (s=0x555557757d10, chnum=0) at ../../src/qemu/hw/ssi/omap_spi.c:93 +#7 0x0000555555bf536b in omap_mcspi_write (opaque=0x555557757d10, addr=56, value=6468416, size=4) at ../../src/qemu/hw/ssi/omap_spi.c:335 +#8 0x0000555555e68f05 in memory_region_write_accessor + (mr=0x555557757d10, addr=56, value=0x7fffe7034cc8, size=4, shift=0, mask=4294967295, attrs=...) at ../../src/qemu/softmmu/memory.c:492 +#9 0x0000555555e6914b in access_with_adjusted_size (addr=56, value=0x7fffe7034cc8, size=4, access_size_min=1, access_size_max=4, access_fn= + 0x555555e68e0f <memory_region_write_accessor>, mr=0x555557757d10, attrs=...) at ../../src/qemu/softmmu/memory.c:554 +#10 0x0000555555e6c1e4 in memory_region_dispatch_write (mr=0x555557757d10, addr=56, data=6468416, op=MO_32, attrs=...) + at ../../src/qemu/softmmu/memory.c:1504 +#11 0x0000555555fa9936 in io_writex + (env=0x555556e419f0, iotlbentry=0x7fff581ad800, mmu_idx=10, val=6468416, addr=4194926648, retaddr=140734913962650, op=MO_32) + at ../../src/qemu/accel/tcg/cputlb.c:1420 +#12 0x0000555555fac1b1 in store_helper (env=0x555556e419f0, addr=4194926648, val=6468416, oi=42, retaddr=140734913962650, op=MO_32) + at ../../src/qemu/accel/tcg/cputlb.c:2355 +#13 0x0000555555fac571 in full_le_stl_mmu (env=0x555556e419f0, addr=4194926648, val=6468416, oi=42, retaddr=140734913962650) + at ../../src/qemu/accel/tcg/cputlb.c:2443 +#14 0x0000555555fac5a9 in helper_le_stl_mmu (env=0x555556e419f0, addr=4194926648, val=6468416, oi=42, retaddr=140734913962650) + at ../../src/qemu/accel/tcg/cputlb.c:2449 +#15 0x00007fff668de29a in code_gen_buffer () +#16 0x0000555555f95c5d in cpu_tb_exec (cpu=0x555556e37c60, itb=0x7fffa3aae140, tb_exit=0x7fffe703540c) at ../../src/qemu/accel/tcg/cpu-exec.c:357 +#17 0x0000555555f96afe in cpu_loop_exec_tb (cpu=0x555556e37c60, tb=0x7fffa3aae140, last_tb=0x7fffe7035420, tb_exit=0x7fffe703540c) + at ../../src/qemu/accel/tcg/cpu-exec.c:833 +#18 0x0000555555f96ed7 in cpu_exec (cpu=0x555556e37c60) at ../../src/qemu/accel/tcg/cpu-exec.c:992 +#19 0x0000555555fb9682 in tcg_cpus_exec (cpu=0x555556e37c60) at ../../src/qemu/accel/tcg/tcg-accel-ops.c:67 +#20 0x0000555555fb9a13 in mttcg_cpu_thread_fn (arg=0x555556e37c60) at ../../src/qemu/accel/tcg/tcg-accel-ops-mttcg.c:95 +#21 0x0000555556179831 in qemu_thread_start (args=0x55555700dbc0) at ../../src/qemu/util/qemu-thread-posix.c:556 +#22 0x00007ffff4d47b17 in start_thread (arg=<optimized out>) at pthread_create.c:435 +#23 0x00007ffff4dcc6c0 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81 +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/737 b/results/classifier/mode-deepseek-r1:32b/output/system/737 new file mode 100644 index 00000000..4a84c64d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/737 @@ -0,0 +1,5 @@ + + +s390x/tcg: Implement Miscellaneous-Instruction-Extensions Facility 3 for the s390x +Additional information: +http://publibfp.dhe.ibm.com/epubs/pdf/a227832c.pdf diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/738 b/results/classifier/mode-deepseek-r1:32b/output/system/738 new file mode 100644 index 00000000..08f9e1a2 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/738 @@ -0,0 +1,5 @@ + + +s390x/tcg: Implement Vector-Enhancements Facility 2 for s390x +Additional information: +http://publibfp.dhe.ibm.com/epubs/pdf/a227832c.pdf diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/739 b/results/classifier/mode-deepseek-r1:32b/output/system/739 new file mode 100644 index 00000000..2ae9639d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/739 @@ -0,0 +1,19 @@ + + +qemu option -snapshot not work for blockdev disk +Description of problem: +If disk image configured with a -blockdev option, option -snapshot not work: all changes write to disk image instead of temporary files. +Steps to reproduce: +1. Run qemu guest with -blockdev disk image file and -snapshot options +2. Create file test.txt on guest disk +3. Power off guest +4. Run qemu guest again +5. File test.txt present on guest disk +Additional information: +When i replace -blockdev options to legacy -drive option +``` +-snapshot +-drive if=none,id=ssd1-format,media=disk,cache=none,aio=native,discard=unmap,detect-zeroes=unmap,format=qcow2,file=images/windows21h2.qcow2 +-device scsi-hd,bus=scsi0.0,channel=0,scsi-id=0,lun=0,device_id=drive-scsi0-0-0-0,drive=ssd1-format,id=scsi0-0-0-0,write-cache=on,bootindex=1 +``` +-snapshot option work fine diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/741 b/results/classifier/mode-deepseek-r1:32b/output/system/741 new file mode 100644 index 00000000..d96be53f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/741 @@ -0,0 +1,3 @@ + + +Document "net/net.h" API diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/741115 b/results/classifier/mode-deepseek-r1:32b/output/system/741115 new file mode 100644 index 00000000..17feb739 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/741115 @@ -0,0 +1,10 @@ + + +Add support of coprocessor cp15, cp14 registers exposion in the embedded gdb server + +Please add support of exposion of ARM coprocesor registers/logic at the embedded gdb server, + for example of cp15, cp14, etc registers. + +Related project http://jtagarmgdbsrvr.sourceforge.net/index.html + +Also filled bug in the GDB http://sourceware.org/bugzilla/show_bug.cgi?id=12602 \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/744 b/results/classifier/mode-deepseek-r1:32b/output/system/744 new file mode 100644 index 00000000..9253dc09 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/744 @@ -0,0 +1,5 @@ + + +ppc64: Implement the remaining PowerISA v3.1 instructions +Additional information: +[PowerISA_public.v3.1.pdf](https://wiki.raptorcs.com/w/images/f/f5/PowerISA_public.v3.1.pdf) diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/749 b/results/classifier/mode-deepseek-r1:32b/output/system/749 new file mode 100644 index 00000000..646f0de2 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/749 @@ -0,0 +1,3 @@ + + +Enhance QEMU live patching diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/750 b/results/classifier/mode-deepseek-r1:32b/output/system/750 new file mode 100644 index 00000000..37ef7dc4 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/750 @@ -0,0 +1,35 @@ + + +/proc/cpuinfo doesn't present guest cpuinfo for most architectures (including M1 Macs) +Description of problem: +I tried to start Blender inside an amd docker container, emulated on M1 Mac, running noVNC to access the the GUI via Chrome. +From Blender versions 2.8 and higher I get the following error message: + +``` + ArchError: Could not find 'cpu MHz' in /proc/cpuinfo + Function: Arch_InitTickTimer + File: /home/sybren/buildbot-builder/linux_glibc217_x86_64_cmake/build_deps/deps/build/usd/src/external_usd/pxr/base/arch/timing.cpp + Line: 133 +qemu: uncaught target signal 6 (Aborted) - core dumped +Aborted +``` + +I posted the problem to Blender [here](https://developer.blender.org/T92956) as well as to docker [here](https://github.com/docker/for-mac/issues/6047). +Steps to reproduce: +You need: +- ✅ M1 Mac +- ✅ Docker Desktop 4.1.1 (69879) + +Setup the Container: + +1. Unzip the attached file +2. In a terminal go to the unzipped folder +3. run `source build-and-launch.sh` to build the image and spin up a container +4. open a browser and go to [http://localhost:6901](http://localhost:6901) +5. login using password `pass` +6. see the README.txt on the Desktop you just logged into +7. == Follow the README instructions == + + + +[blender-bug-report-202111091146.zip](/uploads/340ada45a9ee0585cfc0cdfcc1932fb4/blender-bug-report-202111091146.zip) diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/757 b/results/classifier/mode-deepseek-r1:32b/output/system/757 new file mode 100644 index 00000000..83163db3 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/757 @@ -0,0 +1,3 @@ + + +intel-hda: stream reset bits are broken diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/757702 b/results/classifier/mode-deepseek-r1:32b/output/system/757702 new file mode 100644 index 00000000..b7436a0b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/757702 @@ -0,0 +1,5 @@ + + +ARM: singlestepping insn which UNDEFs should stop at UNDEF vector insn, not after it + +ARMv7a has lot of undefined instruction from its instruction opcode space. This undefined instructions are very useful for replacing sensitive non-priviledged instructions of guest operating systems (virtualization). The undefined instruction exception executes at <exception_base> + 0x4, where <exception_base> can be 0x0 or 0xfff00000. Currently, in qemu 0.14.0 undefined instruction fault at 0x8 offset instead of 0x4. This was not a problem with qemu 0.13.0, seems like this is a new bug. As as example, if we try to execute value "0xec019800" in qemu 0.14.0 then it should cause undefined exception at <exception_base>+0x4 since "0xec019800" is an undefined instruction. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/765 b/results/classifier/mode-deepseek-r1:32b/output/system/765 new file mode 100644 index 00000000..4e985d2c --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/765 @@ -0,0 +1,67 @@ + + +Issue with Docker on M1 Mac +Description of problem: +I'm trying to run a docker container using the following command: + +``` +docker run --platform=linux/amd64 --rm uphold/litecoin-core \ + -printtoconsole \ + -regtest=1 \ + -rpcallowip=172.17.0.0/16 \ + -rpcauth='foo:1e72f95158becf7170f3bac8d9224$957a46166672d61d3218c167a223ed5290389e9990cc57397d24c979b4853f8e' +``` + +It should run the docker container, instead it throws the following error: +``` +/entrypoint.sh: assuming arguments for litecoind +/entrypoint.sh: setting data directory to /home/litecoin/.litecoin +runtime: failed to create new OS thread (have 2 already; errno=22) +fatal error: newosproc + +runtime stack: +runtime.throw(0x4cb21f, 0x9) + /usr/local/go/src/runtime/panic.go:566 +0x95 +runtime.newosproc(0xc420028000, 0xc420037fc0) + /usr/local/go/src/runtime/os_linux.go:160 +0x194 +runtime.newm(0x4d6db8, 0x0) + /usr/local/go/src/runtime/proc.go:1572 +0x132 +runtime.main.func1() + /usr/local/go/src/runtime/proc.go:126 +0x36 +runtime.systemstack(0x53ae00) + /usr/local/go/src/runtime/asm_amd64.s:298 +0x79 +runtime.mstart() + /usr/local/go/src/runtime/proc.go:1079 + +goroutine 1 [running]: +runtime.systemstack_switch() + /usr/local/go/src/runtime/asm_amd64.s:252 fp=0xc420022768 sp=0xc420022760 +runtime.main() + /usr/local/go/src/runtime/proc.go:127 +0x6c fp=0xc4200227c0 sp=0xc420022768 +runtime.goexit() + /usr/local/go/src/runtime/asm_amd64.s:2086 +0x1 fp=0xc4200227c8 sp=0xc4200227c0 +``` +Steps to reproduce: +1. Run the following in a terminal window on a Mac with an M1 chip: +``` +docker run --platform=linux/amd64 --rm uphold/litecoin-core \ + -printtoconsole \ + -regtest=1 \ + -rpcallowip=172.17.0.0/16 \ + -rpcauth='foo:1e72f95158becf7170f3bac8d9224$957a46166672d61d3218c167a223ed5290389e9990cc57397d24c979b4853f8e' +``` +Additional information: +I increased the limits using ``ulimit`` as follows: + +``` +clemens@M1-MacBook-Pro ~ % ulimit -a +-t: cpu time (seconds) unlimited +-f: file size (blocks) unlimited +-d: data seg size (kbytes) unlimited +-s: stack size (kbytes) 8176 +-c: core file size (blocks) 0 +-v: address space (kbytes) unlimited +-l: locked-in-memory size (kbytes) unlimited +-u: processes 5333 +-n: file descriptors 256 +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/766 b/results/classifier/mode-deepseek-r1:32b/output/system/766 new file mode 100644 index 00000000..cd2edebb --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/766 @@ -0,0 +1,29 @@ + + +qemu-system-x86_64: Reboot loop after Machine->Reset +Description of problem: +When using tcg, the virtual machine goes into a reboot loop after the VM +is rebooted through UI->Machine->Reboot menu, or through outb(0xcf9, 0xf). +There might be other reboot mechanisms that result in the same loop. + +The loop doesn't occur when using kvm: +qemu-system-x86_64 -M q35 -enable-kvm +Steps to reproduce: +1. Run the command. (The one without -enable-kvm.) +2. From the UI, click on Machine->Reset. +3. See that the VM locks up, instead of resetting. +Additional information: +The reboot loop occurs because a variable defined by Seabios cannot be updated, possibly because the memory is read-only. + +The variable in question is [HaveRunPost](https://github.com/coreboot/seabios/blob/2dd4b9b3f84019668719344b40dba79d681be41c/src/fw/shadow.c#L194). If HaveRunPost is non-zero, the BIOS follows the resume path. When the reset is clicked, the BIOS does indeed gain control and follow the resume path because HaveRunPost is 2. The control ends up at qemu_reboot, which should reset HaveRunPost to 0 and trigger another reset, so that this second time around, the BIOS sees HaveRunPost as 0, and follows the initialization path instead. + +But, even though the instruction to update HaveRunPost seems to run, the value remains non-zero (2 to be exact). + +``` + // HaveRunPost has value 2 here. + barrier(); + HaveRunPost = 0; + barrier(); + // If a dprintf(1, "%x\n", HaveRunPost); is placed here, the value printed is 2 and not 0! + // With kvm-enabled, this dprintf prints 0. +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/77 b/results/classifier/mode-deepseek-r1:32b/output/system/77 new file mode 100644 index 00000000..dfc35984 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/77 @@ -0,0 +1,3 @@ + + +msmouse not recognized in guest diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/770 b/results/classifier/mode-deepseek-r1:32b/output/system/770 new file mode 100644 index 00000000..56442aa2 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/770 @@ -0,0 +1,3 @@ + + +READ memory access in /hw/acpi/pcihp.c diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/773 b/results/classifier/mode-deepseek-r1:32b/output/system/773 new file mode 100644 index 00000000..b1968b30 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/773 @@ -0,0 +1,29 @@ + + +TCG profiler build fails +Description of problem: +Attempting to build with --enable-profiler fails +Steps to reproduce: +1. ../../configure --enable-profiler +2. make +Additional information: +[975/3221] Compiling C object libcommon.fa.p/monitor_qmp-cmds.c.o + FAILED: libcommon.fa.p/monitor_qmp-cmds.c.o + cc -m64 -mcx16 -Ilibcommon.fa.p -I../../dtc/libfdt -I/usr/include/capstone -I/usr/include/pixman-1 -I/usr/include/spice-server -I/usr/include/spice-1 -I/usr/include/libpng16 + -I/usr/include/p11-kit-1 -I/usr/include/libmount -I/usr/include/blkid -I/usr/include/glib-2.0 -I/usr/lib/x86_64-linux-gnu/glib-2.0/include -I/usr/include/gio-unix-2.0 -I/us + r/include/slirp -I/usr/include/virgl -I/usr/include/libusb-1.0 -I/usr/include/cacard -I/usr/include/nss -I/usr/include/nspr -I/usr/include/PCSC -I/usr/include/gtk-3.0 -I/usr + /include/at-spi2-atk/2.0 -I/usr/include/at-spi-2.0 -I/usr/include/dbus-1.0 -I/usr/lib/x86_64-linux-gnu/dbus-1.0/include -I/usr/include/cairo -I/usr/include/pango-1.0 -I/usr/ + include/fribidi -I/usr/include/harfbuzz -I/usr/include/atk-1.0 -I/usr/include/uuid -I/usr/include/freetype2 -I/usr/include/gdk-pixbuf-2.0 -I/usr/include/vte-2.91 -fdiagnosti + cs-color=auto -Wall -Winvalid-pch -Werror -std=gnu11 -O2 -g -isystem /home/alex/lsrc/qemu.git/linux-headers -isystem linux-headers -iquote . -iquote /home/alex/lsrc/qemu.git + -iquote /home/alex/lsrc/qemu.git/include -iquote /home/alex/lsrc/qemu.git/disas/libvixl -iquote /home/alex/lsrc/qemu.git/tcg/i386 -pthread -U_FORTIFY_SOURCE -D_FORTIFY_SOUR + CE=2 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -fno-co + mmon -fwrapv -Wold-style-declaration -Wold-style-definition -Wtype-limits -Wformat-security -Wformat-y2k -Winit-self -Wignored-qualifiers -Wempty-body -Wnested-externs -Wend + if-labels -Wexpansion-to-defined -Wimplicit-fallthrough=2 -Wno-missing-include-dirs -Wno-shift-negative-value -Wno-psabi -fstack-protector-strong -fPIE -D_DEFAULT_SOURCE -D_ + XOPEN_SOURCE=600 -DNCURSES_WIDECHAR=1 -D_REENTRANT -DSTRUCT_IOVEC_DEFINED -MD -MQ libcommon.fa.p/monitor_qmp-cmds.c.o -MF libcommon.fa.p/monitor_qmp-cmds.c.o.d -o libcommon. + fa.p/monitor_qmp-cmds.c.o -c ../../monitor/qmp-cmds.c + ../../monitor/qmp-cmds.c: In function ‘qmp_x_query_profile’: + ../../monitor/qmp-cmds.c:369:21: error: implicit declaration of function ‘tcg_cpu_exec_time’ [-Werror=implicit-function-declaration] + 369 | cpu_exec_time = tcg_cpu_exec_time(); + | ^~~~~~~~~~~~~~~~~ + ../../monitor/qmp-cmds.c:369:21: error: nested extern declaration of ‘tcg_cpu_exec_time’ [-Werror=nested-externs] + cc1: all warnings being treated as errors diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/778 b/results/classifier/mode-deepseek-r1:32b/output/system/778 new file mode 100644 index 00000000..e873e392 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/778 @@ -0,0 +1,3 @@ + + +heap-buffer-overflow in megasas_sgl_get_len diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/781 b/results/classifier/mode-deepseek-r1:32b/output/system/781 new file mode 100644 index 00000000..f43433a1 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/781 @@ -0,0 +1,3 @@ + + +Assertion `addr < cache->len && 2 <= cache->len - addr' failed in address_space_stw_le_cached diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/783 b/results/classifier/mode-deepseek-r1:32b/output/system/783 new file mode 100644 index 00000000..2397bcfc --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/783 @@ -0,0 +1,5 @@ + + +risc-v: provide CPU without MMU +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/785 b/results/classifier/mode-deepseek-r1:32b/output/system/785 new file mode 100644 index 00000000..1a122aa6 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/785 @@ -0,0 +1,3 @@ + + +Build failure on macOS with jack diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/786211 b/results/classifier/mode-deepseek-r1:32b/output/system/786211 new file mode 100644 index 00000000..0bdac15a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/786211 @@ -0,0 +1,5 @@ + + +Missing checks for valid, writable, firmware in fw_cfg_write + +The `fw_cfg_write` function in the firmware emulation is missing checks to ensure that the firmware being written is (a) a valid index, and (b) writable. This can lead to a segmentation fault and potentially (in the case of writing to FW_CFG_INVALID), memory corruption, although the attacker has fairly limited control over whether and what corruption is possible. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/788 b/results/classifier/mode-deepseek-r1:32b/output/system/788 new file mode 100644 index 00000000..6e928d0f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/788 @@ -0,0 +1,3 @@ + + +FEAT_PAuth trapping behaviour incorrectly emulated on Secure-EL0/1 with Secure-EL2 disabled diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/788697 b/results/classifier/mode-deepseek-r1:32b/output/system/788697 new file mode 100644 index 00000000..ac770b08 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/788697 @@ -0,0 +1,5 @@ + + +[PowerPC] [patch] mtmsr does not preserve high bits of MSR + +The mtmsr instruction on 64-bit PPC does not preserve the high-order 32-bits of the MSR the way it is supposed to, instead setting them to 0, which takes 64-bit code out of 64-bit mode. There is some code that does the right thing, but it brokenly only preserves these bits when the thread is not in 64-bit mode (i.e. when it doesn't matter). The attached patch unconditionally enables this code when TARGET_PPC64 is set, per the ISA spec, which fixes early boot failures trying to start FreeBSD/powerpc64 under qemu. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/79 b/results/classifier/mode-deepseek-r1:32b/output/system/79 new file mode 100644 index 00000000..3b348f3e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/79 @@ -0,0 +1,3 @@ + + +support horisontal mouse wheel diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/790 b/results/classifier/mode-deepseek-r1:32b/output/system/790 new file mode 100644 index 00000000..438e2299 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/790 @@ -0,0 +1,3 @@ + + +Attribute bits in stage 1/stage 2 block descriptors are not fully masked during AArch64 page table walks diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/792 b/results/classifier/mode-deepseek-r1:32b/output/system/792 new file mode 100644 index 00000000..a2261a78 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/792 @@ -0,0 +1,3 @@ + + +Qemu's helper mechanism usage related issues diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/795 b/results/classifier/mode-deepseek-r1:32b/output/system/795 new file mode 100644 index 00000000..58e7b55e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/795 @@ -0,0 +1,3 @@ + + +meson.build: coreaudio check failed diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/796 b/results/classifier/mode-deepseek-r1:32b/output/system/796 new file mode 100644 index 00000000..95aeb9e5 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/796 @@ -0,0 +1,19 @@ + + +make -j126 check failed in qemu@6.2.0 on ubuntu_aarch64 +Steps to reproduce: +the issue + +```console +[root@localhost build]#make -j126 check +Running test fp-test-sqrt +Running test fp-test-sub +Running test fp-test-log2 +** +ERROR:../tests/unit/test-qga.c:718:test_qga_config: assertion failed (err == ""): ("/home/stage/root/spack-stage-qemu-6.2.0-532ksrh2smva65sb3ghqox222237khs5/spack-src/build/qga/qemu-ga: symbol lookup error: /home/stage/root/spack-stage-qemu-6.2.0-532ksrh2smva65sb3ghqox222237khs5/spack-src/build/qga/qemu-ga: undefined symbol: g_unix_get_passwd_entry\n" == "") +ERROR test-qga - Bail out! ERROR:../tests/unit/test-qga.c:718:test_qga_config: assertion failed (err == ""): ("/home/stage/root/spack-stage-qemu-6.2.0-532ksrh2smva65sb3ghqox222237khs5/spack-src/build/qga/qemu-ga: symbol lookup error: /home/stage/root/spack-stage-qemu-6.2.0-532ksrh2smva65sb3ghqox222237khs5/spack-src/build/qga/qemu-ga: undefined symbol: g_unix_get_passwd_entry\n" == "") +make: *** [Makefile.mtest:1472: run-test-182] Error 1 +make: *** Waiting for unfinished jobs.... +…… +``` +I don't know why happen,can you help me? diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/799 b/results/classifier/mode-deepseek-r1:32b/output/system/799 new file mode 100644 index 00000000..69ac31ac --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/799 @@ -0,0 +1,49 @@ + + +TCG Optimizer crashes on AArch64 SVE2 instruction +Description of problem: +QEMU crashes due to an assertion in the TCG optimizer when optimizing an SVE2 instruction: +``` +Unrecognized operation 145 in do_constant_folding. +../tcg/optimize.c:458: tcg fatal error +``` +Steps to reproduce: +1. Compile the following minimized reproducer: (a pre-compiled image is provided for convenience - [reproducer.img](/uploads/0bddbfac55306a297fee59dd2f6923cf/reproducer.img)) +```asm +.org 0x0 +entry: + mrs x1, cptr_el3 + orr x9, x1, #0x100 + msr cptr_el3, x9 + + msr cptr_el2, xzr + + mov x1, #0x3 + mrs x9, cpacr_el1 + bfi x9, x1, #16, #2 + bfi x9, x1, #20, #2 + msr cpacr_el1, x9 + + mov x9, 512 + mov x0, x9 + asr x0, x0, 7 + sub x9, x0, #1 + msr zcr_el1, x9 + + mov x9, 512 + mov x0, x9 + asr x0, x0, 7 + sub x9, x0, #1 + msr zcr_el2, x9 + + mov x9, 512 + mov x0, x9 + asr x0, x0, 7 + sub x9, x0, #1 + msr zcr_el3, x9 + + uqxtnt z11.s, z22.d +``` +2. Execute it using the command line given above. +Additional information: +I tested latest master as well, and the problem persists. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/807893 b/results/classifier/mode-deepseek-r1:32b/output/system/807893 new file mode 100644 index 00000000..ea52ea9d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/807893 @@ -0,0 +1,33 @@ + + +qemu privilege escalation + +If qemu is started as root, with -runas, the extra groups is not dropped correctly + +/proc/`pidof qemu`/status +.. +Uid: 100 100 100 100 +Gid: 100 100 100 100 +FDSize: 32 +Groups: 0 1 2 3 4 6 10 11 26 27 +... + +The fix is to add initgroups() or setgroups(1, [gid]) where appropriate to os-posix.c. + +The extra gid's allow read or write access to other files (such as /dev etc). + +Emulating the qemu code: + +# python +... +>>> import os +>>> os.setgid(100) +>>> os.setuid(100) +>>> os.execve("/bin/sh", [ "/bin/sh" ], os.environ) +sh-4.1$ xxd /dev/sda | head -n2 +0000000: eb48 9000 0000 0000 0000 0000 0000 0000 .H.............. +0000010: 0000 0000 0000 0000 0000 0000 0000 0000 ................ +sh-4.1$ ls -l /dev/sda +brw-rw---- 1 root disk 8, 0 Jul 8 11:54 /dev/sda +sh-4.1$ id +uid=100(qemu00) gid=100(users) groups=100(users),0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),26(tape),27(video) \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/83 b/results/classifier/mode-deepseek-r1:32b/output/system/83 new file mode 100644 index 00000000..97b26fc4 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/83 @@ -0,0 +1,3 @@ + + +QEMU x87 emulation of trig and other complex ops is only at 64-bit precision, not 80-bit diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/842290 b/results/classifier/mode-deepseek-r1:32b/output/system/842290 new file mode 100644 index 00000000..7e781862 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/842290 @@ -0,0 +1,13 @@ + + +MIPS Malta mini-bootloader print function has bad jump instruction + +One of the hardcoded bootloader library instructions in the MIPS Malta mini-bootloader's print function is: + +stl_raw(p++, 0x08000205); /* j 814 */ + +Since this function is loaded at 0xbfc00808, this jump jumps to the middle of nowhere. The properly-encoded instruction is: + +stl_raw(p++, 0x0bf00205); /* j 814 */ + +With this patch, the print function behaves as expected. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/843 b/results/classifier/mode-deepseek-r1:32b/output/system/843 new file mode 100644 index 00000000..f58f6a2e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/843 @@ -0,0 +1,5 @@ + + +qemu-binfmt-conf causes duplicate magic mips headers when installing all patterns +Description of problem: +The magic/mask patterns are the same for mips[el] and nipsn32[el] diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/844 b/results/classifier/mode-deepseek-r1:32b/output/system/844 new file mode 100644 index 00000000..2e3fc186 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/844 @@ -0,0 +1,46 @@ + + +Close gap for x86_64-v3 ABI in TCG - CPU support for fma, f16c, avx, avx2 features required +Description of problem: +There are 3 additional ABIs defined by a collaboration of vendors for the `x86_64` architecture, over the original baseline: + +* https://gitlab.com/x86-psABIs/x86-64-ABI/-/blob/master/x86-64-ABI/low-level-sys-info.tex + +This is no problem for KVM assuming suitable host hardware, but TCG is currently unable to support more than the original baseline and the `x86_64-v2` step. + +For `x86_64-v3` there are some gaps in its emulation coverage. This can be seen by taking `Nehalem` which is a good fit for `x86_64-v2`, and requesting the extra v3 features: + +``` +$ qemu-system-x86_64 -accel tcg -cpu Nehalem,+avx,+avx2,+bmi1,+bmi2,+f16c,+fma,+abm,+movbe +qemu-system-x86_64: warning: TCG doesn't support requested feature: CPUID.01H:ECX.fma [bit 12] +qemu-system-x86_64: warning: TCG doesn't support requested feature: CPUID.01H:ECX.avx [bit 28] +qemu-system-x86_64: warning: TCG doesn't support requested feature: CPUID.01H:ECX.f16c [bit 29] +qemu-system-x86_64: warning: TCG doesn't support requested feature: CPUID.07H:EBX.avx2 [bit 5] +``` + +IOW, the strict bare minimum TCG needs in order to satisfy `x86_64-v3` is `fma`, `f16c`, `avx` and `avx2` support + +If we want to fully support a named CPU model satisfying v3, then `Haswell` is the closest and that has a few additional gaps + +``` +$ qemu-system-x86_64 -accel tcg -cpu Haswell-noTSX +qemu-system-x86_64: warning: TCG doesn't support requested feature: CPUID.01H:ECX.fma [bit 12] +qemu-system-x86_64: warning: TCG doesn't support requested feature: CPUID.01H:ECX.pcid [bit 17] +qemu-system-x86_64: warning: TCG doesn't support requested feature: CPUID.01H:ECX.x2apic [bit 21] +qemu-system-x86_64: warning: TCG doesn't support requested feature: CPUID.01H:ECX.tsc-deadline [bit 24] +qemu-system-x86_64: warning: TCG doesn't support requested feature: CPUID.01H:ECX.avx [bit 28] +qemu-system-x86_64: warning: TCG doesn't support requested feature: CPUID.01H:ECX.f16c [bit 29] +qemu-system-x86_64: warning: TCG doesn't support requested feature: CPUID.07H:EBX.avx2 [bit 5] +qemu-system-x86_64: warning: TCG doesn't support requested feature: CPUID.07H:EBX.invpcid [bit 10] + +``` + +Those additional gaps wouldn't impact ability to execute binaries build for the `x86_64-v3` ABI though, so not as important. + +The reason `x86_64-v3` compatibility in TCG matters is because sooner or later some Linux OS are going to set this as the baseline for their compiler toolchain. There is a proposal to set this in `Fedora ELN`, which is what feeds in to a possible future `RHEL-10`. + +I imagine adding these extra features would be non-negligible work in TCG / take some time to complete. + +Thus I file this bug for the purpose of suggesting these 4 specific missing features be considered a priority to address, compared to other missing CPU features in TCG that might be considered more of a 'nice to have'. + +eg looking further the `x86_64-v4` baseline brings in a requirement for `avx512f`, `avx512bw`, `avx512cd`, `avx512dq`, `avx512vl` which TCG also lacks, but I don't think they really need to be considered important at this point in time. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/847 b/results/classifier/mode-deepseek-r1:32b/output/system/847 new file mode 100644 index 00000000..09206129 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/847 @@ -0,0 +1,32 @@ + + +rdhpr %htstate unimplemented in translator +Description of problem: +I accidentally mixed up a copy of T1 and T2 sun4v firmwares and was able to trigger the following TCG assert ``tcg_reg_alloc_mov: Assertion `ts->val_type == TEMP_VAL_REG' failed.`` upon boot. + +Having discovered my mistake I was expecting the guest to crash at some point but without triggering an +assert. +Steps to reproduce: +1. Download the attached file bug.tar.gz and extract it + +2. Apply the following diff to update the UART address for the T2 firmware + +``` +diff --git a/hw/sparc64/niagara.c b/hw/sparc64/niagara.c +index ccad2c43a3..7af64bd50f 100644 +--- a/hw/sparc64/niagara.c ++++ b/hw/sparc64/niagara.c +@@ -51,7 +51,7 @@ typedef struct NiagaraBoardState { + + #define NIAGARA_PARTITION_RAM_BASE 0x80000000ULL + +-#define NIAGARA_UART_BASE 0x1f10000000ULL ++#define NIAGARA_UART_BASE 0xfff0c2c000ULL + + #define NIAGARA_NVRAM_BASE 0x1f11000000ULL + #define NIAGARA_NVRAM_SIZE 0x2000 +``` + +3. Run `./qemu-system-sparc64 -M niagara -L ./bug/ -m 256 -nographic` +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/85 b/results/classifier/mode-deepseek-r1:32b/output/system/85 new file mode 100644 index 00000000..c080ec9e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/85 @@ -0,0 +1,3 @@ + + +info registers' command leads to segfault with -M none diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/852 b/results/classifier/mode-deepseek-r1:32b/output/system/852 new file mode 100644 index 00000000..4776b036 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/852 @@ -0,0 +1,33 @@ + + +ppc64le: possible SIMD issue casting double to int +Description of problem: +Working with numpy in a ppc64le VM, I ran into a strange double -to casting issue, specifically when casting an array of 1.0 values to 1 values. The numpy folks guided me to a small reproducible test case. + +The attached [convert.c](/uploads/2dd7936f4defccf816ffee7c7c002e77/convert.c) creates double and int arrays of length `1 <= n <= 16`. The double array is filled with the value 1.0, and both arrays are passed to a function that converts the value. + +With `-O2`, output is as expected (truncated here): + +``` +i = 1: 1 +i = 2: 1 1 +i = 3: 1 1 1 +i = 4: 1 1 1 1 +i = 5: 1 1 1 1 1 +i = 6: 1 1 1 1 1 1 +``` + +With `-O3`, all values that fit into blocks of four become zero: +``` +i = 1: 1 +i = 2: 1 1 +i = 3: 1 1 1 +i = 4: 0 0 0 0 +i = 5: 0 0 0 0 1 +i = 6: 0 0 0 0 1 1 +``` + +I tested this with executables compiled on a physical ppc64le host, where the issue is not reproducible. +Steps to reproduce: +1. `gcc -O2 -o convert convert.c && ./convert` +2. `gcc -O3 -o convert convert.c && ./convert` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/859 b/results/classifier/mode-deepseek-r1:32b/output/system/859 new file mode 100644 index 00000000..7a776535 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/859 @@ -0,0 +1,3 @@ + + +PowerPC's Virtual Open Firmware uses an unsupported instruction in older CPUs diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/87 b/results/classifier/mode-deepseek-r1:32b/output/system/87 new file mode 100644 index 00000000..eff18ebe --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/87 @@ -0,0 +1,3 @@ + + +doesn't clear screen on boot diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/870 b/results/classifier/mode-deepseek-r1:32b/output/system/870 new file mode 100644 index 00000000..bbefcb14 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/870 @@ -0,0 +1,14 @@ + + +Throws a #GP when it should throw a #SS +Description of problem: +When stacks are switched as part of a 64-bit mode privilege-level change (resulting from an interrupt), IA-32e mode loads only an inner-level RSP from the TSS. If the value of rsp from tss is a non-canonical form. It will trigger #SS. But when I test it in qemu it throws #GP instead of #SS +Steps to reproduce: +In order to confirm that it is the #SS triggered by the non-canonical address, We can verify on a real machine. +1. Set the value of the current core's `TSS.IST7` to the the non-canonical address. +2. Set the `ist` field of the interrupt 4 (Overflow Exception) descriptor to 7. +3. Execute the `INT 4` instruction in Ring 3 and it will be taken over by the #SS handler. + +Repeat the above steps in qemu this exception will be taken over by #GP +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/872 b/results/classifier/mode-deepseek-r1:32b/output/system/872 new file mode 100644 index 00000000..eecbf107 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/872 @@ -0,0 +1,3 @@ + + +linux-user getsockopt(fd, SOL_SOCKET, SO_ERROR) returns host errno to target diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/873 b/results/classifier/mode-deepseek-r1:32b/output/system/873 new file mode 100644 index 00000000..8059fc52 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/873 @@ -0,0 +1,3 @@ + + +Meson warns about a broken Python install on Debian/Ubuntu diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/876 b/results/classifier/mode-deepseek-r1:32b/output/system/876 new file mode 100644 index 00000000..6a10b36f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/876 @@ -0,0 +1,36 @@ + + +snek-arm fails on s390x with qemu >6.1 +Description of problem: +snek is a language inspired by python for embedded. The tests run snek code natively (in this case on s390x) as well as in python3 as well as emulated for arm. +The latter is what fails... + +the Ubuntu testing has spotted this in: + +- https://autopkgtest.ubuntu.com/results/autopkgtest-jammy/jammy/s390x/s/snek/20220211_065108_2144a@/log.gz +- https://autopkgtest.ubuntu.com/results/autopkgtest-jammy/jammy/s390x/s/snek/20220212_050524_3b7ee@/log.gz +- https://autopkgtest.ubuntu.com/results/autopkgtest-jammy/jammy/s390x/s/snek/20220214_080226_46968@/log.gz + +In there all work, but one test fails reproducible, that is `test/pass-slice.py` + +When eliminating the automation in makefiles and all that it comes down to: +``` +$ qemu-system-arm -chardev stdio,mux=on,id=stdio0 -serial none -monitor none -semihosting-config enable=on,chardev=stdio0,arg='snek',arg=test/pass-slice.py -machine mps2-an385,accel=tcg -cpu cortex-m3 -kernel /usr/share/snek/snek-qemu-arm-1.7.elf -nographic -bios none +fail: [::-5] (model 'o' impl '') +``` + +To be clear: +- the test for python3 works on all platforms +- the test for snek-native works on all platforms +- the test for snek-arm work on all platforms except s390x +- with qemu 6.0 this worked, but the more recent qemu 6.2 makes it fail +- only some subtests of pass-slice.py fail (see below) + +I've gone into some details for the snek side of things in [the bug report there](https://github.com/keith-packard/snek/issues/58). +Steps to reproduce: +1. get an s390x system +2. get the snek elf file for arm +3. run qemu-system-arm as shown above + +P.S. I tried this on latest head (building qemu in an F35 container) and it fails there as well, hence I'm listing commit 2d88a3a595 as affected as well. +We know 6.0 was ok, so likely 6.0->6.1 brought the issue, I have not yet checked if a bisect is feasible for this. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/879 b/results/classifier/mode-deepseek-r1:32b/output/system/879 new file mode 100644 index 00000000..21223b93 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/879 @@ -0,0 +1,5 @@ + + +Microphone support for Macbooks +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/882 b/results/classifier/mode-deepseek-r1:32b/output/system/882 new file mode 100644 index 00000000..94afd502 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/882 @@ -0,0 +1,475 @@ + + +Build fails: error: ‘struct statx’ has no member named ‘stx_mnt_id’ +Description of problem: +When trying to build qemu (both version 6.2.0 and upstream git), the build fails with the mentioned error message +Steps to reproduce: +1. Configure qemu with the following arguments (target list removed for the sake of brevity): +``` +./configure \ + --prefix=/usr \ + --sysconfdir=/etc \ + --localstatedir=/var \ + --libexecdir=/usr/lib/qemu \ + --smbd=/usr/bin/smbd \ + --enable-modules \ + --enable-sdl \ + --enable-slirp=system \ + --disable-werror +``` +2. Try to build qemu +3. Build fails on target tools/virtiofsd/virtiofsd.p/passthrough_ll.c.o +Additional information: +Meson output: +``` ++ ./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var --libexecdir=/usr/lib/qemu --smbd=/usr/bin/smbd --enable-modules --enable-sdl --enable-slirp=system --disable-werror --target-list=x86_64-softmmu,x86_64-linux-user,aarch64-softmmu,aarch64-linux-user,ppc64-softmmu,ppc64-linux-user,riscv32-softmmu,riscv32-linux-user,riscv64-softmmu,riscv64-linux-user,arm-softmmu,arm-linux-user,avr-softmmu +Using './build' as the directory for build output +The Meson build system +Version: 0.61.2 +Source dir: /home/mae/dev/qemubuild/qemu +Build dir: /home/mae/dev/qemubuild/qemu/build +Build type: native build +Project name: qemu +Project version: 6.2.50 +C compiler for the host machine: gcc -m64 -mcx16 (gcc 11.2.0 "gcc (GCC) 11.2.0") +C linker for the host machine: gcc -m64 -mcx16 ld.bfd 2.37 +Host machine cpu family: x86_64 +Host machine cpu: x86_64 +Program sh found: YES (/usr/bin/sh) +Program python3 found: YES (/usr/bin/python) +Program bzip2 found: YES (/usr/bin/bzip2) +C++ compiler for the host machine: g++ -m64 -mcx16 (gcc 11.2.0 "g++ (GCC) 11.2.0") +C++ linker for the host machine: g++ -m64 -mcx16 ld.bfd 2.37 +Program cgcc found: NO +Library m found: YES +Run-time dependency threads found: YES +Library util found: YES +Run-time dependency appleframeworks found: NO (tried framework) +Found pkg-config: /usr/bin/pkg-config (1.8.0) +Run-time dependency pixman-1 found: YES 0.40.0 +Run-time dependency zlib found: YES 1.2.11 +Has header "libaio.h" : YES +Library aio found: YES +Run-time dependency liburing found: YES 2.0 +Run-time dependency libnfs found: YES 5.0.1 +Run-time dependency appleframeworks found: NO (tried framework) +Run-time dependency libseccomp found: YES 2.5.3 +Has header "cap-ng.h" : YES +Library cap-ng found: YES +Run-time dependency xkbcommon found: YES 1.4.0 +Has header "libvdeplug.h" : YES +Library vdeplug found: YES +Run-time dependency libpulse found: YES 15.0 +Run-time dependency alsa found: YES 1.2.6.1 +Run-time dependency jack found: NO (tried pkgconfig) +Run-time dependency spice-protocol found: YES 0.14.4 +Run-time dependency spice-server found: YES 0.15.0 +Library rt found: YES +Run-time dependency libiscsi found: YES 1.19.0 +Run-time dependency libzstd found: YES 1.5.2 +Run-time dependency virglrenderer found: YES 0.9.1 +Run-time dependency libcurl found: YES 7.81.0 +Run-time dependency libudev found: YES 250 +Library mpathpersist found: NO +Run-time dependency ncursesw found: YES 6.3.20211021 +Has header "brlapi.h" : NO +Run-time dependency sdl2 found: YES 2.0.18 +Run-time dependency sdl2_image found: YES 2.0.5 +Library rados found: NO +Has header "rbd/librbd.h" : NO +Run-time dependency glusterfs-api found: NO (tried pkgconfig) +Run-time dependency libssh found: YES 0.9.6 +Has header "bzlib.h" : YES +Library bz2 found: YES +Has header "lzfse.h" : NO +Has header "sys/soundcard.h" : YES +Run-time dependency gbm found: YES 21.3.1 +Run-time dependency gnutls found: YES 3.7.3 +Run-time dependency gtk+-3.0 found: YES 3.24.31 +Run-time dependency gtk+-x11-3.0 found: YES 3.24.31 +Run-time dependency vte-2.91 found: YES 0.66.2 +Run-time dependency x11 found: YES 1.7.3.1 +Run-time dependency libpng found: YES 1.6.37 +Run-time dependency libjpeg found: YES 2.1.2 +Has header "sasl/sasl.h" : YES +Library sasl2 found: YES +Has header "security/pam_appl.h" : YES +Library pam found: YES +Has header "snappy-c.h" : YES +Library snappy found: YES +Has header "lzo/lzo1x.h" : YES +Library lzo2 found: YES +Run-time dependency libcacard found: YES 2.7.0 +Run-time dependency u2f-emu found: NO (tried pkgconfig) +Run-time dependency libusbredirparser-0.5 found: YES 0.12.0 +Run-time dependency libusb-1.0 found: YES 1.0.25 +Run-time dependency libpmem found: NO (tried pkgconfig) +Run-time dependency libdaxctl found: YES 72.1+ +Run-time dependency libtasn1 found: YES 4.18.0 +Run-time dependency libkeyutils found: YES 1.6.3 +Checking for function "gettid" : YES +Run-time dependency libselinux found: NO (tried pkgconfig) +Run-time dependency fuse3 found: YES 3.10.5 +Run-time dependency libbpf found: YES 0.7.0 +Has header "sys/epoll.h" : YES +Has header "linux/magic.h" : YES +Has header "valgrind/valgrind.h" : YES +Has header "linux/btrfs.h" : YES +Has header "libdrm/drm.h" : YES +Has header "pty.h" : YES +Has header "sys/disk.h" : NO +Has header "sys/ioccom.h" : NO +Has header "sys/kcov.h" : NO +Checking for function "accept4" : YES +Checking for function "clock_adjtime" : YES +Checking for function "dup3" : YES +Checking for function "fallocate" : YES +Checking for function "posix_fallocate" : YES +Checking for function "posix_memalign" : YES +Checking for function "ppoll" : YES +Checking for function "preadv" : YES +Checking for function "sem_timedwait" with dependency threads: YES +Checking for function "sendfile" : YES +Checking for function "setns" : YES +Checking for function "unshare" : YES +Checking for function "syncfs" : YES +Checking for function "sync_file_range" : YES +Checking for function "timerfd_create" : YES +Checking for function "copy_file_range" : YES +Checking for function "openpty" with dependency -lutil: YES +Checking for function "strchrnul" : YES +Checking for function "system" : YES +Header <byteswap.h> has symbol "bswap_32" : YES +Header <sys/epoll.h> has symbol "epoll_create1" : YES +Header <unistd.h> has symbol "environ" : YES +Header <linux/falloc.h> has symbol "FALLOC_FL_PUNCH_HOLE" : YES +Header <linux/falloc.h> has symbol "FALLOC_FL_KEEP_SIZE" : YES +Header <linux/falloc.h> has symbol "FALLOC_FL_ZERO_RANGE" : YES +Has header "linux/fiemap.h" : YES +Header <linux/fs.h> has symbol "FS_IOC_FIEMAP" : YES +Checking for function "getrandom" : YES +Header <sys/random.h> has symbol "GRND_NONBLOCK" : YES +Header <sys/inotify.h> has symbol "inotify_init" : YES +Header <sys/inotify.h> has symbol "inotify_init1" : YES +Header <machine/bswap.h> has symbol "bswap32" : NO +Header <sys/prctl.h> has symbol "PR_SET_TIMERSLACK" : YES +Header <linux/rtnetlink.h> has symbol "IFLA_PROTO_DOWN" : YES +Header <sys/sysmacros.h> has symbol "makedev" : YES +Header <getopt.h> has symbol "optreset" : NO +Header <netinet/in.h> has symbol "IPPROTO_MPTCP" : YES +Checking whether type "struct sigevent" has member "sigev_notify_thread_id" : NO +Checking whether type "struct stat" has member "st_atim" : YES +Checking for type "struct iovec" : YES +Checking for type "struct utmpx" : YES +Checking for type "struct mmsghdr" : YES +Program scripts/minikconf.py found: YES (/usr/bin/python /home/mae/dev/qemubuild/qemu/scripts/minikconf.py) +Configuring x86_64-softmmu-config-target.h using configuration +Configuring x86_64-softmmu-config-devices.mak with command +Reading depfile: /home/mae/dev/qemubuild/qemu/build/meson-private/x86_64-softmmu-config-devices.mak.d +Configuring x86_64-softmmu-config-devices.h using configuration +Configuring x86_64-linux-user-config-target.h using configuration +Configuring aarch64-softmmu-config-target.h using configuration +Configuring aarch64-softmmu-config-devices.mak with command +Reading depfile: /home/mae/dev/qemubuild/qemu/build/meson-private/aarch64-softmmu-config-devices.mak.d +Configuring aarch64-softmmu-config-devices.h using configuration +Configuring aarch64-linux-user-config-target.h using configuration +Configuring ppc64-softmmu-config-target.h using configuration +Configuring ppc64-softmmu-config-devices.mak with command +Reading depfile: /home/mae/dev/qemubuild/qemu/build/meson-private/ppc64-softmmu-config-devices.mak.d +Configuring ppc64-softmmu-config-devices.h using configuration +Configuring ppc64-linux-user-config-target.h using configuration +Configuring riscv32-softmmu-config-target.h using configuration +Configuring riscv32-softmmu-config-devices.mak with command +Reading depfile: /home/mae/dev/qemubuild/qemu/build/meson-private/riscv32-softmmu-config-devices.mak.d +Configuring riscv32-softmmu-config-devices.h using configuration +Configuring riscv32-linux-user-config-target.h using configuration +Configuring riscv64-softmmu-config-target.h using configuration +Configuring riscv64-softmmu-config-devices.mak with command +Reading depfile: /home/mae/dev/qemubuild/qemu/build/meson-private/riscv64-softmmu-config-devices.mak.d +Configuring riscv64-softmmu-config-devices.h using configuration +Configuring riscv64-linux-user-config-target.h using configuration +Configuring arm-softmmu-config-target.h using configuration +Configuring arm-softmmu-config-devices.mak with command +Reading depfile: /home/mae/dev/qemubuild/qemu/build/meson-private/arm-softmmu-config-devices.mak.d +Configuring arm-softmmu-config-devices.h using configuration +Configuring arm-linux-user-config-target.h using configuration +Configuring avr-softmmu-config-target.h using configuration +Configuring avr-softmmu-config-devices.mak with command +Reading depfile: /home/mae/dev/qemubuild/qemu/build/meson-private/avr-softmmu-config-devices.mak.d +Configuring avr-softmmu-config-devices.h using configuration +Program scripts/make-config-poison.sh found: YES (/home/mae/dev/qemubuild/qemu/scripts/make-config-poison.sh) +Run-time dependency capstone found: NO (tried pkgconfig) +Configuring capstone-defs.h using configuration +Run-time dependency slirp found: YES 4.6.1 +Library fdt found: YES +Configuring config-host.h using configuration +Program scripts/hxtool found: YES (/home/mae/dev/qemubuild/qemu/scripts/hxtool) +Program scripts/shaderinclude.pl found: YES (/usr/bin/env perl /home/mae/dev/qemubuild/qemu/scripts/shaderinclude.pl) +Program scripts/qapi-gen.py found: YES (/usr/bin/python /home/mae/dev/qemubuild/qemu/scripts/qapi-gen.py) +Program scripts/qemu-version.sh found: YES (/home/mae/dev/qemubuild/qemu/scripts/qemu-version.sh) + +Executing subproject libvhost-user + +libvhost-user| Project name: libvhost-user +libvhost-user| Project version: undefined +libvhost-user| C compiler for the host machine: gcc -m64 -mcx16 (gcc 11.2.0 "gcc (GCC) 11.2.0") +libvhost-user| C linker for the host machine: gcc -m64 -mcx16 ld.bfd 2.37 +libvhost-user| Dependency threads found: YES unknown (cached) +libvhost-user| Dependency glib-2.0 found: YES 2.71.2 (overridden) +libvhost-user| Build targets in project: 10 +libvhost-user| Subproject libvhost-user finished. + +Program scripts/decodetree.py found: YES (/usr/bin/python /home/mae/dev/qemubuild/qemu/scripts/decodetree.py) +Program ../scripts/modules/module_block.py found: YES (/usr/bin/python /home/mae/dev/qemubuild/qemu/block/../scripts/modules/module_block.py) +Program ../scripts/block-coroutine-wrapper.py found: YES (/usr/bin/python /home/mae/dev/qemubuild/qemu/block/../scripts/block-coroutine-wrapper.py) +Program scripts/modinfo-collect.py found: YES (/home/mae/dev/qemubuild/qemu/scripts/modinfo-collect.py) +Program scripts/modinfo-generate.py found: YES (/home/mae/dev/qemubuild/qemu/scripts/modinfo-generate.py) +Program nm found: YES +Program scripts/undefsym.py found: YES (/usr/bin/python /home/mae/dev/qemubuild/qemu/scripts/undefsym.py) +Program scripts/feature_to_c.sh found: YES (/bin/sh /home/mae/dev/qemubuild/qemu/scripts/feature_to_c.sh) +Configuring 50-qemu-gpu.json using configuration +Configuring 50-qemu-virtiofsd.json using configuration +Configuring 50-edk2-i386-secure.json using configuration +Configuring 50-edk2-x86_64-secure.json using configuration +Configuring 60-edk2-aarch64.json using configuration +Configuring 60-edk2-arm.json using configuration +Configuring 60-edk2-i386.json using configuration +Configuring 60-edk2-x86_64.json using configuration +Program qemu-keymap found: NO +Program cp found: YES (/usr/bin/cp) +Program sphinx-build-3 sphinx-build found: NO +Program python3 found: YES (/usr/bin/python) +Program diff found: YES (/usr/bin/diff) +Program dbus-daemon found: YES (/usr/bin/dbus-daemon) +Program initrd-stress.sh found: YES (/home/mae/dev/qemubuild/qemu/tests/migration/initrd-stress.sh) +Program xgettext found: YES (/usr/bin/xgettext) +Build targets in project: 744 + +qemu 6.2.50 + + Directories + Install prefix : /usr + BIOS directory : share/qemu + firmware path : /usr/share/qemu-firmware + binary directory : bin + library directory : lib + module directory : lib/qemu + libexec directory : lib/qemu + include directory : include + config directory : /etc + local state directory : /var + Manual directory : share/man + Doc directory : /usr/share/doc + Build directory : /home/mae/dev/qemubuild/qemu/build + Source path : /home/mae/dev/qemubuild/qemu + GIT submodules : ui/keycodemapdb tests/fp/berkeley-testfloat-3 tests/fp/berkeley-softfloat-3 dtc capstone + + Host binaries + git : git + make : make + python : /usr/bin/python (version: 3.10) + sphinx-build : NO + gdb : /usr/bin/gdb + genisoimage : + smbd : "/usr/bin/smbd" + + Configurable features + Documentation : NO + system-mode emulation : YES + user-mode emulation : YES + block layer : YES + Install blobs : YES + module support : YES + alternative module path : NO + fuzzing support : NO + Audio drivers : pa oss + Trace backends : log + D-Bus display : YES + QOM debugging : YES + vhost-kernel support : YES + vhost-net support : YES + vhost-crypto support : YES + vhost-scsi support : YES + vhost-vsock support : YES + vhost-user support : YES + vhost-user-blk server support: YES + vhost-user-fs support : YES + vhost-vdpa support : YES + build guest agent : YES + + Compilation + host CPU : x86_64 + host endianness : little + C compiler : gcc -m64 -mcx16 + Host C compiler : gcc -m64 -mcx16 + C++ compiler : g++ -m64 -mcx16 + CFLAGS : -march=native -mtune=native -O3 -pipe -fno-plt -fexceptions -Wp,-D_FORTIFY_SOURCE=2 -Wformat -Werror=format-security -fstack-clash-protection -fcf-protection -O2 -g + CXXFLAGS : -march=native -mtune=native -O3 -pipe -fno-plt -fexceptions -Wp,-D_FORTIFY_SOURCE=2 -Wformat -Werror=format-security -fstack-clash-protection -fcf-protection -Wp,-D_GLIBCXX_ASSERTIONS -O2 -g + LDFLAGS : -march=native -mtune=native -O3 -pipe -fno-plt -fexceptions -Wp,-D_FORTIFY_SOURCE=2 -Wformat -Werror=format-security -fstack-clash-protection -fcf-protection -Wp,-D_GLIBCXX_ASSERTIONS -Wl,-O1,--sort-common,--as-needed,-z,relro,-z,now + QEMU_CFLAGS : -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -fno-common -fwrapv -Wold-style-declaration -Wold-style-definition -Wtype-limits -Wformat-security -Wformat-y2k -Winit-self -Wignored-qualifiers -Wempty-body -Wnested-externs -Wendif-labels -Wexpansion-to-defined -Wimplicit-fallthrough=2 -Wno-missing-include-dirs -Wno-shift-negative-value -Wno-psabi -fstack-protector-strong + QEMU_LDFLAGS : -Wl,--warn-common -Wl,-z,relro -Wl,-z,now -fstack-protector-strong + profiler : NO + link-time optimization (LTO) : NO + PIE : YES + static build : NO + malloc trim support : YES + membarrier : NO + debug stack usage : NO + mutex debugging : NO + memory allocator : system + avx2 optimization : YES + avx512f optimization : NO + gprof enabled : NO + gcov : NO + thread sanitizer : NO + CFI support : NO + strip binaries : NO + sparse : NO + mingw32 support : NO + x86_64 tests : gcc + + Targets and accelerators + KVM support : YES + HAX support : NO + HVF support : NO + WHPX support : NO + NVMM support : NO + Xen support : NO + TCG support : YES + TCG backend : native (x86_64) + TCG plugins : YES + TCG debug enabled : NO + target list : x86_64-softmmu x86_64-linux-user aarch64-softmmu aarch64-linux-user ppc64-softmmu ppc64-linux-user riscv32-softmmu riscv32-linux-user riscv64-softmmu riscv64-linux-user arm-softmmu arm-linux-user avr-softmmu + default devices : YES + out of process emulation : YES + + Block layer support + coroutine backend : ucontext + coroutine pool : YES + Block whitelist (rw) : + Block whitelist (ro) : + Use block whitelist in tools : NO + VirtFS support : YES + build virtiofs daemon : YES + Live block migration : YES + replication support : YES + bochs support : YES + cloop support : YES + dmg support : YES + qcow v1 support : YES + vdi support : YES + vvfat support : YES + qed support : YES + parallels support : YES + FUSE exports : YES 3.10.5 + + Crypto + TLS priority : "NORMAL" + GNUTLS support : YES 3.7.3 + GNUTLS crypto : YES + libgcrypt : NO + nettle : NO + crypto afalg : NO + rng-none : NO + Linux keyring : YES + + Dependencies + SDL support : YES + SDL image support : YES 2.0.5 + GTK support : YES + pixman : YES 0.40.0 + VTE support : YES 0.66.2 + slirp support : YES 4.6.1 + libtasn1 : YES 4.18.0 + PAM : YES + iconv support : YES + curses support : YES + virgl support : YES 0.9.1 + curl support : YES 7.81.0 + Multipath support : NO + VNC support : YES + VNC SASL support : YES + VNC JPEG support : YES 2.1.2 + VNC PNG support : YES 1.6.37 + OSS support : YES + ALSA support : YES 1.2.6.1 + PulseAudio support : YES 15.0 + JACK support : NO + brlapi support : NO + vde support : YES + netmap support : NO + l2tpv3 support : YES + Linux AIO support : YES + Linux io_uring support : YES 2.0 + ATTR/XATTR support : YES + RDMA support : NO + PVRDMA support : NO + fdt support : system + libcap-ng support : YES + bpf support : YES 0.7.0 + spice protocol support : YES 0.14.4 + spice server support : YES 0.15.0 + rbd support : NO + smartcard support : YES 2.7.0 + U2F support : NO + libusb : YES 1.0.25 + usb net redir : YES 0.12.0 + OpenGL support : YES + GBM : YES 21.3.1 + libiscsi support : YES 1.19.0 + libnfs support : YES 5.0.1 + seccomp support : YES 2.5.3 + GlusterFS support : NO + TPM support : YES + libssh support : YES 0.9.6 + lzo support : YES + snappy support : YES + bzip2 support : YES + lzfse support : NO + zstd support : YES 1.5.2 + NUMA host support : YES + capstone : internal + libpmem support : NO + libdaxctl support : YES 72.1+ + libudev : YES 250 + FUSE lseek : YES + selinux : NO + + Subprojects + libvhost-user : YES + + User defined options + Native files : config-meson.cross + bindir : /usr/bin + datadir : /usr/share + debug : true + includedir : /usr/include + libdir : /usr/lib + libexecdir : /usr/lib/qemu + localedir : /usr/share/locale + localstatedir : /var + mandir : /usr/share/man + optimization : 2 + prefix : /usr + sysconfdir : /etc + werror : false + b_coverage : false + b_lto : false + b_pie : true + audio_drv_list : default + capstone : auto + cfi : false + default_devices : true + docdir : /usr/share/doc + fdt : auto + qemu_firmwarepath : /usr/share/qemu-firmware + qemu_suffix : qemu + sdl : enabled + slirp : system + sphinx_build : + tcg : enabled + trace_file : trace + xen : disabled + +Found ninja-1.10.2 at /usr/bin/ninja +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/887883 b/results/classifier/mode-deepseek-r1:32b/output/system/887883 new file mode 100644 index 00000000..a7f2c600 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/887883 @@ -0,0 +1,35 @@ + + +Coverity scan revealed defects + +Coverity scan detected some issues such as RESOURCE_LEAK and REVERSE_INULL etc on qemu-1.0rc1: + +Analysis summary report: +------------------------ +Files analyzed : 830 +Total LoC input to cov-analyze : 576549 +Functions analyzed : 20721 +Paths analyzed : 858376 +New defects found : 428 Total + 2 ARRAY_VS_SINGLETON + 9 CHECKED_RETURN + 19 CONSTANT_EXPRESSION_RESULT + 60 DEADCODE + 43 FORWARD_NULL + 14 INFINITE_LOOP + 36 MISSING_BREAK + 3 MISSING_LOCK + 47 NEGATIVE_RETURNS + 1 NO_EFFECT + 11 NULL_RETURNS + 51 OVERRUN_STATIC + 1 RESOURCE_LEAK + 79 REVERSE_INULL + 20 SIGN_EXTENSION + 7 SIZEOF_MISMATCH + 15 UNINIT + 5 UNREACHABLE + 2 UNUSED_VALUE + 3 USE_AFTER_FREE + +For details, please see attachment. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/888 b/results/classifier/mode-deepseek-r1:32b/output/system/888 new file mode 100644 index 00000000..9f517907 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/888 @@ -0,0 +1,9 @@ + + +TCG <--> KVM behavior difference (TCG bug) +Description of problem: +This app couldn't start in TCG mode in QEMU 6.2, but with KVM everything is good. Until version 6.0 it also works with TCG. +As I checked - problem git commit is 5f9529006ea37560c97b05661a84472431d25b91. +Steps to reproduce: +1. Install Allplayer +2. Try to run it in TCG and KVM mode with QEMU 6.2 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/889053 b/results/classifier/mode-deepseek-r1:32b/output/system/889053 new file mode 100644 index 00000000..b0588de2 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/889053 @@ -0,0 +1,17 @@ + + +x86: FPU_MAX, FPU_MIN incorrect + +Dear All, + +Bug was found in qemu.git. +Now (0.15, 1.0) all fpu is softfpu. +See target-i386/ops_sse.h: +#define FPU_MIN(size, a, b) (a) < (b) ? (a) : (b) +#define FPU_MAX(size, a, b) (a) > (b) ? (a) : (b) +It is incorrect now, becouse float64 (or 32) is (typedef) uint64_t (or 32). +And if we have signed operands we get error... + +There is a test with this error (spec shinx3 test data, results diffs on machine and qemu (linux)) and fixed patch. See attach. + +Daniil. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/891 b/results/classifier/mode-deepseek-r1:32b/output/system/891 new file mode 100644 index 00000000..863d4172 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/891 @@ -0,0 +1,3 @@ + + +how to know jpeg-wan-compression is in force diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/896 b/results/classifier/mode-deepseek-r1:32b/output/system/896 new file mode 100644 index 00000000..55835e8a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/896 @@ -0,0 +1,3 @@ + + +tcg/arm emits UNPREDICTABLE LDRD insn diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/897 b/results/classifier/mode-deepseek-r1:32b/output/system/897 new file mode 100644 index 00000000..d257d110 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/897 @@ -0,0 +1,3 @@ + + +Warning with "qemu-s390x -cpu max" diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/898 b/results/classifier/mode-deepseek-r1:32b/output/system/898 new file mode 100644 index 00000000..8d61d3e0 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/898 @@ -0,0 +1,3 @@ + + +check-tcg sha512-mvx test is failing on s390x hosts diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/90 b/results/classifier/mode-deepseek-r1:32b/output/system/90 new file mode 100644 index 00000000..1a184386 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/90 @@ -0,0 +1,3 @@ + + +vga/std lacks few wide screen modes. diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/902 b/results/classifier/mode-deepseek-r1:32b/output/system/902 new file mode 100644 index 00000000..4a36da00 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/902 @@ -0,0 +1,3 @@ + + +BootLinuxS390X test failing due to a TCG bug diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/903 b/results/classifier/mode-deepseek-r1:32b/output/system/903 new file mode 100644 index 00000000..55d5ade9 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/903 @@ -0,0 +1,357 @@ + + +m1 MacOS panic testing lima with qemu HEAD/7.0.0 +Description of problem: +I'm trying to help the `lima` project test the latest version of lima on m1 with the latest qemu https://github.com/lima-vm/lima/issues/713 and I got a panic and was told to report back in the qemu issue tracker. + +I created a VM with 8GiB memory, and got a panic. + + +lima version: +``` +⎈ |rancher-desktop:default) ~ ❯❯❯ limactl --version ✘ 1 +limactl version HEAD-1164273 +``` + +qemu version: +``` +(⎈ |rancher-desktop:default) ~ ❯❯❯ qemu-system-aarch64 --version +QEMU emulator version 6.2.50 (v6.2.0-2380-g1416688c53) +Copyright (c) 2003-2022 Fabrice Bellard and the QEMU Project developers +``` + +MacOS panic: + +``` +panic(cpu 3 caller 0xfffffe001db6ea58): vm_fault() KERN_FAILURE from guest fault on state 0xfffffe6032c98000 @sleh.c:3091 +Debugger message: panic +Memory ID: 0x6 +OS release type: User +OS version: 21A559 +Kernel version: Darwin Kernel Version 21.1.0: Wed Oct 13 17:33:01 PDT 2021; root:xnu-8019.41.5~1/RELEASE_ARM64_T6000 +Fileset Kernelcache UUID: 3B2CA3833A09A383D66FB36667ED9CBF +Kernel UUID: 67BCB41B-BAA4-3634-8E51-B0210457E324 +iBoot version: iBoot-7429.41.5 +secure boot?: YES +Paniclog version: 13 +KernelCache slide: 0x00000000160d8000 +KernelCache base: 0xfffffe001d0dc000 +Kernel slide: 0x0000000016900000 +Kernel text base: 0xfffffe001d904000 +Kernel text exec slide: 0x00000000169e8000 +Kernel text exec base: 0xfffffe001d9ec000 +mach_absolute_time: 0x1661a3f15fc +Epoch Time: sec usec + Boot : 0x622a7219 0x00029f9b + Sleep : 0x622ba92c 0x00061dca + Wake : 0x622ba9d3 0x000ae46d + Calendar: 0x622bc0fb 0x000caf67 + +Zone info: +Foreign : 0xfffffe0025c14000 - 0xfffffe0025c28000 +Native : 0xfffffe10003bc000 - 0xfffffe30003bc000 +Readonly : 0 - 0 +Metadata : 0xfffffe64105d0000 - 0xfffffe641c53c000 +Bitmaps : 0xfffffe641c53c000 - 0xfffffe6433f6c000 +CORE 0 PVH locks held: None +CORE 1 PVH locks held: None +CORE 2 PVH locks held: None +CORE 3 PVH locks held: None +CORE 4 PVH locks held: None +CORE 5 PVH locks held: None +CORE 6 PVH locks held: None +CORE 7 PVH locks held: None +CORE 8 PVH locks held: None +CORE 9 PVH locks held: None +CORE 0: PC=0xfffffe001da72c6c, LR=0xfffffe001da72c6c, FP=0xfffffe6110abbef0 +CORE 1: PC=0xfffffe001f2cdbe0, LR=0xfffffe001f2ceb54, FP=0xfffffe611027b600 +CORE 2: PC=0xfffffe001da72c70, LR=0xfffffe001da72c6c, FP=0xfffffe603778bef0 +CORE 3 is the one that panicked. Check the full backtrace for details. +CORE 4: PC=0xfffffe001da72c6c, LR=0xfffffe001da72c6c, FP=0xfffffe61166fbef0 +CORE 5: PC=0xfffffe001da72c70, LR=0xfffffe001da72c6c, FP=0xfffffe6110a6bef0 +CORE 6: PC=0xfffffe001da72c70, LR=0xfffffe001da72c6c, FP=0xfffffe61121cbef0 +CORE 7: PC=0xfffffe001da72c70, LR=0xfffffe001da72c6c, FP=0xfffffe60b4be3ef0 +CORE 8: PC=0xfffffe001da72c70, LR=0xfffffe001da72c6c, FP=0xfffffe6032af3ef0 +CORE 9: PC=0xfffffe001da72c70, LR=0xfffffe001da72c6c, FP=0xfffffe6090a4bef0 +Panicked task 0xfffffe150e4ccd50: 17757 pages, 10 threads: pid 21141: qemu-system-aarc +Panicked thread: 0xfffffe1515ae87d8, backtrace: 0xfffffe60d51e3300, tid: 979402 + lr: 0xfffffe001da3e488 fp: 0xfffffe60d51e3370 + lr: 0xfffffe001da3e158 fp: 0xfffffe60d51e33e0 + lr: 0xfffffe001db7a558 fp: 0xfffffe60d51e3400 + lr: 0xfffffe001db6d2d4 fp: 0xfffffe60d51e3480 + lr: 0xfffffe001db6ac9c fp: 0xfffffe60d51e3540 + lr: 0xfffffe001d9f37f8 fp: 0xfffffe60d51e3550 + lr: 0xfffffe001da3ddcc fp: 0xfffffe60d51e38f0 + lr: 0xfffffe001da3ddcc fp: 0xfffffe60d51e3960 + lr: 0xfffffe001e23c748 fp: 0xfffffe60d51e3980 + lr: 0xfffffe001db6ea58 fp: 0xfffffe60d51e39e0 + lr: 0xfffffe001db6e5dc fp: 0xfffffe60d51e3a50 + lr: 0xfffffe001d9fe828 fp: 0xfffffe60d51e3a60 + lr: 0xfffffe001db823f4 fp: 0xfffffe60d51e3e50 + lr: 0xfffffe001db6b140 fp: 0xfffffe60d51e3f10 + lr: 0xfffffe001d9f37f8 fp: 0xfffffe60d51e3f20 + +last started kext at 1368960011: com.apple.filesystems.smbfs 4.0 (addr 0xfffffe001d8ea490, size 64483) +loaded kexts: +com.apple.filesystems.smbfs 4.0 +com.apple.filesystems.autofs 3.0 +com.apple.fileutil 20.036.15 +com.apple.UVCService 1 +com.apple.driver.AppleUSBTopCaseDriver 5010.1 +com.apple.iokit.SCSITaskUserClient 452.30.4 +com.apple.driver.AppleIntelI210Ethernet 2.3.1 +com.apple.driver.AppleBiometricServices 1 +com.apple.driver.CoreKDL 1 +com.apple.driver.AppleTopCaseHIDEventDriver 5010.1 +com.apple.driver.SEPHibernation 1 +com.apple.driver.BCMWLANFirmware4387.Hashstore 1 +com.apple.driver.DiskImages.ReadWriteDiskImage 493.0.0 +com.apple.driver.DiskImages.UDIFDiskImage 493.0.0 +com.apple.driver.DiskImages.RAMBackingStore 493.0.0 +com.apple.driver.DiskImages.FileBackingStore 493.0.0 +com.apple.filesystems.apfs 1933.41.2 +com.apple.driver.AppleUSBDeviceNCM 5.0.0 +com.apple.driver.AppleThunderboltIP 4.0.3 +com.apple.driver.AppleFileSystemDriver 3.0.1 +com.apple.nke.l2tp 1.9 +com.apple.filesystems.tmpfs 1 +com.apple.filesystems.lifs 1 +com.apple.IOTextEncryptionFamily 1.0.0 +com.apple.filesystems.hfs.kext 582.40.4 +com.apple.security.BootPolicy 1 +com.apple.BootCache 40 +com.apple.AppleFSCompression.AppleFSCompressionTypeZlib 1.0.0 +com.apple.AppleFSCompression.AppleFSCompressionTypeDataless 1.0.0d1 +com.apple.driver.AppleCS42L84Audio 502.6 +com.apple.driver.ApplePMP 1 +com.apple.driver.AppleSmartIO2 1 +com.apple.driver.AppleSN012776Amp 502.6 +com.apple.AppleEmbeddedSimpleSPINORFlasher 1 +com.apple.driver.AppleT6000SOCTuner 1 +com.apple.driver.AppleT6000CLPCv3 1 +com.apple.driver.AppleSmartBatteryManager 161.0.0 +com.apple.driver.AppleALSColorSensor 1.0.0d1 +com.apple.driver.AppleAOPVoiceTrigger 100.1 +com.apple.driver.ApplePMPFirmware 1 +com.apple.driver.AppleMCDP29XXUpdateSupport 1 +com.apple.driver.AppleM68Buttons 1.0.0d1 +com.apple.driver.AppleSamsungSerial 1.0.0d1 +com.apple.driver.AppleSerialShim 1 +com.apple.driver.usb.AppleSynopsysUSB40XHCI 1 +com.apple.driver.AppleSDXC 3.1.1 +com.apple.driver.AppleSPMIPMU 1.0.1 +com.apple.AGXG13X 187.57 +com.apple.driver.AppleAVD 415 +com.apple.driver.AppleAVE2 501.6.9 +com.apple.driver.AppleJPEGDriver 4.7.8 +com.apple.driver.AppleProResHW 126.2.0 +com.apple.driver.AppleMobileDispT600X-DCP 140.0 +com.apple.driver.AppleDPDisplayTCON 1 +com.apple.driver.AppleEventLogHandler 1 +com.apple.driver.AppleS5L8960XNCO 1 +com.apple.driver.AppleT6001PMGR 1 +com.apple.driver.AppleS8000AES 1 +com.apple.driver.AppleS8000DWI 1.0.0d1 +com.apple.driver.AppleInterruptControllerV2 1.0.0d1 +com.apple.driver.AppleT8110DART 1 +com.apple.driver.AppleBluetoothModule 1 +com.apple.driver.AppleBCMWLANBusInterfacePCIe 1 +com.apple.driver.AppleS5L8920XPWM 1.0.0d1 +com.apple.driver.AudioDMAController-T600x 100.51 +com.apple.driver.AppleT6000DART 1 +com.apple.driver.AppleSPIMC 1 +com.apple.driver.AppleS5L8940XI2C 1.0.0d2 +com.apple.driver.AppleT6000 1 +com.apple.iokit.IOUserEthernet 1.0.1 +com.apple.driver.usb.AppleUSBUserHCI 1 +com.apple.iokit.IOKitRegistryCompatibility 1 +com.apple.iokit.EndpointSecurity 1 +com.apple.driver.AppleDiskImages2 126.40.1 +com.apple.AppleSystemPolicy 2.0.0 +com.apple.nke.applicationfirewall 402 +com.apple.kec.InvalidateHmac 1 +com.apple.kec.AppleEncryptedArchive 1 +com.apple.driver.driverkit.serial 6.0.0 +com.apple.kext.triggers 1.0 +com.apple.driver.AppleUSBMergeNub 900.4.2 +com.apple.driver.usb.cdc.ecm 5.0.0 +com.apple.driver.usb.cdc.acm 5.0.0 +com.apple.driver.usb.serial 6.0.0 +com.apple.driver.usb.cdc.ncm 5.0.0 +com.apple.iokit.IOAVBFamily 1010.2 +com.apple.plugin.IOgPTPPlugin 1000.11 +com.apple.driver.usb.IOUSBHostHIDDevice 1.2 +com.apple.driver.usb.cdc 5.0.0 +com.apple.driver.AppleUSBAudio 412.8 +com.apple.iokit.IOAudioFamily 300.10 +com.apple.vecLib.kext 1.2.0 +com.apple.iokit.IOEthernetAVBController 1.1.0 +com.apple.driver.usb.AppleUSBXHCIPCI 1.2 +com.apple.driver.AppleMesaSEPDriver 100.99 +com.apple.iokit.IOBiometricFamily 1 +com.apple.driver.AppleHIDKeyboard 228 +com.apple.driver.AppleHSBluetoothDriver 5010.1 +com.apple.driver.IOBluetoothHIDDriver 9.0.0 +com.apple.driver.AppleActuatorDriver 5400.25 +com.apple.driver.AppleMultitouchDriver 5400.25 +com.apple.driver.AppleThunderboltPCIUpAdapter 4.1.1 +com.apple.driver.AppleThunderboltDPOutAdapter 8.5.0 +com.apple.driver.AppleSEPHDCPManager 1.0.1 +com.apple.driver.AppleTrustedAccessory 1 +com.apple.iokit.AppleSEPGenericTransfer 1 +com.apple.driver.DiskImages.KernelBacked 493.0.0 +com.apple.driver.AppleXsanScheme 3 +com.apple.driver.usb.networking 5.0.0 +com.apple.driver.AppleThunderboltUSBDownAdapter 1.0.4 +com.apple.driver.AppleThunderboltPCIDownAdapter 4.1.1 +com.apple.driver.AppleThunderboltDPInAdapter 8.5.0 +com.apple.driver.AppleThunderboltDPAdapterFamily 8.5.0 +com.apple.nke.ppp 1.9 +com.apple.driver.AppleHIDTransportSPI 5400.30 +com.apple.driver.AppleHIDTransport 5400.30 +com.apple.driver.AppleInputDeviceSupport 5400.30 +com.apple.driver.AppleBSDKextStarter 3 +com.apple.filesystems.hfs.encodings.kext 1 +com.apple.driver.AppleConvergedIPCOLYBTControl 1 +com.apple.driver.AppleConvergedPCI 1 +com.apple.driver.AppleBluetoothDebug 1 +com.apple.driver.AppleBTM 1.0.1 +com.apple.driver.AppleDiagnosticDataAccessReadOnly 1.0.0 +com.apple.driver.AppleCSEmbeddedAudio 502.6 +com.apple.driver.AppleDCPDPTXProxy 1.0.0 +com.apple.driver.DCPDPFamilyProxy 1 +com.apple.driver.ApplePassthroughPPM 3.0 +com.apple.driver.AppleAOPAudio 102.2 +com.apple.driver.AppleEmbeddedAudio 502.6 +com.apple.iokit.AppleARMIISAudio 100.1 +com.apple.driver.AppleSPU 1 +com.apple.iokit.IONVMeFamily 2.1.0 +com.apple.driver.AppleNANDConfigAccess 1.0.0 +com.apple.AGXFirmwareKextG13XRTBuddy 187.57 +com.apple.AGXFirmwareKextRTBuddy64 187.57 +com.apple.driver.AppleHPM 3.4.4 +com.apple.driver.DCPAVFamilyProxy 1 +com.apple.driver.AppleStockholmControl 1.0.0 +com.apple.driver.AppleT6000TypeCPhy 1 +com.apple.driver.AppleT8103TypeCPhy 1 +com.apple.driver.AppleUSBXDCIARM 1.0 +com.apple.driver.AppleUSBXDCI 1.0 +com.apple.iokit.IOUSBDeviceFamily 2.0.0 +com.apple.driver.usb.AppleSynopsysUSBXHCI 1 +com.apple.driver.usb.AppleUSBXHCI 1.2 +com.apple.driver.AppleEmbeddedUSBHost 1 +com.apple.driver.usb.AppleUSBHub 1.2 +com.apple.driver.usb.AppleUSBHostCompositeDevice 1.2 +com.apple.driver.AppleDialogPMU 1.0.1 +com.apple.driver.AppleSPMI 1.0.1 +com.apple.driver.usb.AppleUSBHostPacketFilter 1.0 +com.apple.iokit.IOGPUFamily 35.11 +com.apple.iokit.IOMobileGraphicsFamily-DCP 343.0.0 +com.apple.driver.AppleDCP 1 +com.apple.driver.AppleFirmwareKit 1 +com.apple.iokit.IOMobileGraphicsFamily 343.0.0 +com.apple.driver.AppleSART 1 +com.apple.driver.ApplePMGR 1 +com.apple.driver.AppleARMWatchdogTimer 1 +com.apple.driver.AppleDisplayCrossbar 1.0.0 +com.apple.iokit.IODisplayPortFamily 1.0.0 +com.apple.driver.AppleTypeCPhy 1 +com.apple.driver.AppleThunderboltNHI 7.2.8 +com.apple.driver.AppleT6000PCIeC 1 +com.apple.iokit.IOThunderboltFamily 9.3.2 +com.apple.driver.ApplePIODMA 1 +com.apple.driver.AppleT600xPCIe 1 +com.apple.driver.AppleMultiFunctionManager 1 +com.apple.driver.AppleBluetoothDebugService 1 +com.apple.driver.AppleBCMWLANCore 1.0.0 +com.apple.iokit.IO80211Family 1200.12.2b1 +com.apple.driver.IOImageLoader 1.0.0 +com.apple.driver.AppleOLYHAL 1 +com.apple.driver.corecapture 1.0.4 +com.apple.driver.AppleEmbeddedPCIE 1 +com.apple.driver.AppleMCA2-T600x 600.95 +com.apple.driver.AppleEmbeddedAudioLibs 100.9.1 +com.apple.driver.AppleFirmwareUpdateKext 1 +com.apple.driver.AppleH13CameraInterface 4.79.0 +com.apple.driver.AppleH10PearlCameraInterface 17.0.3 +com.apple.driver.AppleGPIOICController 1.0.2 +com.apple.driver.AppleFireStormErrorHandler 1 +com.apple.driver.AppleMobileApNonce 1 +com.apple.iokit.IOTimeSyncFamily 1000.11 +com.apple.driver.DiskImages 493.0.0 +com.apple.iokit.IOGraphicsFamily 593 +com.apple.iokit.IOBluetoothSerialManager 9.0.0 +com.apple.iokit.IOBluetoothHostControllerUSBTransport 9.0.0 +com.apple.iokit.IOBluetoothHostControllerUARTTransport 9.0.0 +com.apple.iokit.IOBluetoothHostControllerTransport 9.0.0 +com.apple.driver.IOBluetoothHostControllerPCIeTransport 9.0.0 +com.apple.iokit.IOBluetoothFamily 9.0.0 +com.apple.driver.FairPlayIOKit 68.13.0 +com.apple.iokit.CoreAnalyticsFamily 1 +com.apple.iokit.CSRBluetoothHostControllerUSBTransport 9.0.0 +com.apple.iokit.BroadcomBluetoothHostControllerUSBTransport 9.0.0 +com.apple.driver.AppleSSE 1.0 +com.apple.driver.AppleSEPKeyStore 2 +com.apple.driver.AppleUSBTDM 532.40.7 +com.apple.iokit.IOUSBMassStorageDriver 209.40.6 +com.apple.iokit.IOPCIFamily 2.9 +com.apple.iokit.IOSCSIBlockCommandsDevice 452.30.4 +com.apple.iokit.IOSCSIArchitectureModelFamily 452.30.4 +com.apple.driver.AppleIPAppender 1.0 +com.apple.driver.AppleFDEKeyStore 28.30 +com.apple.driver.AppleEffaceableStorage 1.0 +com.apple.driver.AppleCredentialManager 1.0 +com.apple.driver.KernelRelayHost 1 +com.apple.iokit.IOUSBHostFamily 1.2 +com.apple.driver.AppleUSBHostMergeProperties 1.2 +com.apple.driver.usb.AppleUSBCommon 1.0 +com.apple.driver.AppleSMC 3.1.9 +com.apple.driver.RTBuddy 1.0.0 +com.apple.driver.AppleEmbeddedTempSensor 1.0.0 +com.apple.driver.AppleARMPMU 1.0 +com.apple.iokit.IOAccessoryManager 1.0.0 +com.apple.driver.AppleOnboardSerial 1.0 +com.apple.iokit.IOSkywalkFamily 1.0 +com.apple.driver.mDNSOffloadUserClient 1.0.1b8 +com.apple.iokit.IONetworkingFamily 3.4 +com.apple.iokit.IOSerialFamily 11 +com.apple.driver.AppleSEPManager 1.0.1 +com.apple.driver.AppleA7IOP 1.0.2 +com.apple.driver.IOSlaveProcessor 1 +com.apple.driver.AppleBiometricSensor 2 +com.apple.iokit.IOHIDFamily 2.0.0 +com.apple.driver.AppleANELoadBalancer 5.33.2 +com.apple.driver.AppleH11ANEInterface 5.33.0 +com.apple.AUC 1.0 +com.apple.iokit.IOAVFamily 1.0.0 +com.apple.iokit.IOHDCPFamily 1.0.0 +com.apple.iokit.IOCECFamily 1 +com.apple.iokit.IOAudio2Family 1.0 +com.apple.driver.AppleIISController 100.1 +com.apple.driver.AppleAudioClockLibs 100.9.1 +com.apple.driver.AppleM2ScalerCSCDriver 265.0.0 +com.apple.iokit.IOSurface 302.9 +com.apple.driver.IODARTFamily 1 +com.apple.security.quarantine 4 +com.apple.security.sandbox 300.0 +com.apple.kext.AppleMatch 1.0.0d1 +com.apple.driver.AppleMobileFileIntegrity 1.0.5 +com.apple.security.AppleImage4 4.1.0 +com.apple.kext.CoreTrust 1 +com.apple.iokit.IOCryptoAcceleratorFamily 1.0.1 +com.apple.driver.AppleARMPlatform 1.0.2 +com.apple.iokit.IOStorageFamily 2.1 +com.apple.iokit.IOSlowAdaptiveClockingFamily 1.0.0 +com.apple.iokit.IOReportFamily 47 +com.apple.kec.pthread 1 +com.apple.kec.Libm 1 +com.apple.kec.corecrypto 12.0 + + + +** Stackshot Succeeded ** Bytes Traced 478480 (Uncompressed 1208976) ** +``` +Steps to reproduce: +1. See https://github.com/lima-vm/lima/issues/713 +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/904 b/results/classifier/mode-deepseek-r1:32b/output/system/904 new file mode 100644 index 00000000..39fd3087 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/904 @@ -0,0 +1,18 @@ + + +RISC-V: Cannot set SEIP bit of mip csr register in M mode +Description of problem: + +Steps to reproduce: +1. run assembly instructions **in M mode**: +``` +not t0, x0 // set t0 to 0b11..11 +csrs mip, t0 // write mip with t0, mip registers are WARL(Write Any Values, Reads Legal Values) +csrr t1, mip // read value from mip to t1 +``` +2. GDB enters the command `display/z $t1` to see that the content of the t1 register is 0x466, which means that the SEIP bit of mip is not set. +3. According to page 47 of [riscv-privileged-20211203](https://github.com/riscv/riscv-isa-manual/releases/download/Priv-v1.12/riscv-privileged-20211203.pdf), `SEIP is writable in mip`. +4. According to page 81 of the same manual,`If implemented, SEIP is read-only in sip`. +5. However, the above code and results show that the SEIP bit of mip cannot be set by software **in M mode**. +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/905 b/results/classifier/mode-deepseek-r1:32b/output/system/905 new file mode 100644 index 00000000..8dd7849e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/905 @@ -0,0 +1,3 @@ + + +Null-ptr dereference in blk_bs diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/906 b/results/classifier/mode-deepseek-r1:32b/output/system/906 new file mode 100644 index 00000000..8fc764c1 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/906 @@ -0,0 +1,3 @@ + + +Cannot IPL this ISO image diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/912 b/results/classifier/mode-deepseek-r1:32b/output/system/912 new file mode 100644 index 00000000..fb6c8e94 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/912 @@ -0,0 +1,3 @@ + + +Cannot access RHEL8_s390x installed OS using SSH from host OS network diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/913 b/results/classifier/mode-deepseek-r1:32b/output/system/913 new file mode 100644 index 00000000..66363c77 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/913 @@ -0,0 +1,3 @@ + + +QEMU Sharing Host files with Guest diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/914 b/results/classifier/mode-deepseek-r1:32b/output/system/914 new file mode 100644 index 00000000..47b09656 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/914 @@ -0,0 +1,3 @@ + + +Raspi4 emulation diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/918 b/results/classifier/mode-deepseek-r1:32b/output/system/918 new file mode 100644 index 00000000..b728a7a1 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/918 @@ -0,0 +1,3 @@ + + +TILE Cpu Host & Emulator support? diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/919 b/results/classifier/mode-deepseek-r1:32b/output/system/919 new file mode 100644 index 00000000..cb263787 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/919 @@ -0,0 +1,7 @@ + + +Slow in Windows +Description of problem: +Eg . Win8.1 in QEMU on Windows is very slow and other os also are very slow +Steps to reproduce: +Just run a qemu instance diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/921 b/results/classifier/mode-deepseek-r1:32b/output/system/921 new file mode 100644 index 00000000..41118eb8 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/921 @@ -0,0 +1,625 @@ + + +qemu 7.0-rc0 warning: cannot get sys attribute capabilities 0 +Description of problem: +The guest fp not working properly +Steps to reproduce: +1. Start the docker +``` +docker run -it --name qemu --rm \ + --privileged \ + --ipc=host \ + -v /dev/log:/dev/log \ + -v /dev/vhost-net:/dev/vhost-net \ + -v /sys/kernel/debug:/sys/kernel/debug \ + -v $ROOT:$ROOT \ + -p 2222:22 \ + -p 1234:1234 \ + -p 1235:1235 \ + -e ROOT=$ROOT \ + -e XDG_RUNTIME_DIR=/tmp \ + -e WAYLAND_DISPLAY=$WAYLAND_DISPLAY \ + -v $XDG_RUNTIME_DIR/$WAYLAND_DISPLAY:/tmp/$WAYLAND_DISPLAY \ + qemu +``` +2.This is in the docker +``` ++ build/docker/qemu-system-x86_64 -enable-kvm -M q35 -smp 1 -m 4G -cpu host -net nic,model=virtio -net user,hostfwd=tcp::22-:22,hostfwd=tcp::1234-:1234 -hda /data/xemu-opengl/image/ubuntu.qcow2 -initrd /data/xemu-opengl/image/rootfs.cpio.gz -kernel /data/xemu-opengl/kernel/arch/x86_64/boot/bzImage -append 'root=/dev/sda3 nokaslr' -usb -device usb-tablet -object memory-backend-memfd,id=mem1,size=4G -machine memory-backend=mem1 -device virtio-vga-gl,context_init=true,blob=true,hostmem=1G -vga none -display sdl,gl=on,show-cursor=on -d guest_errors +qemu-system-x86_64: warning: cannot get sys attribute capabilities 0 +qemu-system-x86_64: warning: cannot get sys attribute capabilities 0 +qemu-system-x86_64: warning: cannot get sys attribute capabilities 0 +qemu-system-x86_64: warning: host doesn't support requested feature: CPUID.0DH:EAX [bit 1] +qemu-system-x86_64: warning: host doesn't support requested feature: CPUID.0DH:EAX [bit 2] +qemu-system-x86_64: warning: cannot get sys attribute capabilities 0 +``` + +3. In geust +``` +dmesg +[ 0.000000] Linux version 5.16.14 (root@5bc45822eca9) (gcc (Ubuntu 11.2.0-7ubuntu2) 11.2.0, GNU ld (GNU Binutils for Ubuntu) 2.37) #3 SMP PREEMPT Sun Mar 13 23:24:16 UTC 2022 +[ 0.000000] Command line: root=/dev/sda3 nokaslr +[ 0.000000] x86/fpu: FP/SSE not present amongst the CPU's xstate features: 0x1. +[ 0.000000] signal: max sigframe size: 1440 +[ 0.000000] BIOS-provided physical RAM map: +[ 0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable +[ 0.000000] BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved +[ 0.000000] BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved +[ 0.000000] BIOS-e820: [mem 0x0000000000100000-0x000000007ffddfff] usable +[ 0.000000] BIOS-e820: [mem 0x000000007ffde000-0x000000007fffffff] reserved +[ 0.000000] BIOS-e820: [mem 0x00000000b0000000-0x00000000bfffffff] reserved +[ 0.000000] BIOS-e820: [mem 0x00000000fed1c000-0x00000000fed1ffff] reserved +[ 0.000000] BIOS-e820: [mem 0x00000000feffc000-0x00000000feffffff] reserved +[ 0.000000] BIOS-e820: [mem 0x00000000fffc0000-0x00000000ffffffff] reserved +[ 0.000000] BIOS-e820: [mem 0x0000000100000000-0x000000017fffffff] usable +[ 0.000000] NX (Execute Disable) protection: active +[ 0.000000] SMBIOS 2.8 present. +[ 0.000000] DMI: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 +[ 0.000000] e820: update [mem 0x00000000-0x00000fff] usable ==> reserved +[ 0.000000] e820: remove [mem 0x000a0000-0x000fffff] usable +[ 0.000000] last_pfn = 0x180000 max_arch_pfn = 0x400000000 +[ 0.000000] x86/PAT: Configuration [0-7]: WB WC UC- UC WB WP UC- WT +[ 0.000000] last_pfn = 0x7ffde max_arch_pfn = 0x400000000 +[ 0.000000] found SMP MP-table at [mem 0x000f5b70-0x000f5b7f] +[ 0.000000] Using GB pages for direct mapping +[ 0.000000] RAMDISK: [mem 0x7ffcf000-0x7ffcffff] +[ 0.000000] ACPI: Early table checksum verification disabled +[ 0.000000] ACPI: RSDP 0x00000000000F5980 000014 (v00 BOCHS ) +[ 0.000000] ACPI: RSDT 0x000000007FFE22CB 000038 (v01 BOCHS BXPC 00000001 BXPC 00000001) +[ 0.000000] ACPI: FACP 0x000000007FFE20C3 0000F4 (v03 BOCHS BXPC 00000001 BXPC 00000001) +[ 0.000000] ACPI: DSDT 0x000000007FFE0040 002083 (v01 BOCHS BXPC 00000001 BXPC 00000001) +[ 0.000000] ACPI: FACS 0x000000007FFE0000 000040 +[ 0.000000] ACPI: APIC 0x000000007FFE21B7 000078 (v01 BOCHS BXPC 00000001 BXPC 00000001) +[ 0.000000] ACPI: HPET 0x000000007FFE222F 000038 (v01 BOCHS BXPC 00000001 BXPC 00000001) +[ 0.000000] ACPI: MCFG 0x000000007FFE2267 00003C (v01 BOCHS BXPC 00000001 BXPC 00000001) +[ 0.000000] ACPI: WAET 0x000000007FFE22A3 000028 (v01 BOCHS BXPC 00000001 BXPC 00000001) +[ 0.000000] ACPI: Reserving FACP table memory at [mem 0x7ffe20c3-0x7ffe21b6] +[ 0.000000] ACPI: Reserving DSDT table memory at [mem 0x7ffe0040-0x7ffe20c2] +[ 0.000000] ACPI: Reserving FACS table memory at [mem 0x7ffe0000-0x7ffe003f] +[ 0.000000] ACPI: Reserving APIC table memory at [mem 0x7ffe21b7-0x7ffe222e] +[ 0.000000] ACPI: Reserving HPET table memory at [mem 0x7ffe222f-0x7ffe2266] +[ 0.000000] ACPI: Reserving MCFG table memory at [mem 0x7ffe2267-0x7ffe22a2] +[ 0.000000] ACPI: Reserving WAET table memory at [mem 0x7ffe22a3-0x7ffe22ca] +[ 0.000000] No NUMA configuration found +[ 0.000000] Faking a node at [mem 0x0000000000000000-0x000000017fffffff] +[ 0.000000] NODE_DATA(0) allocated [mem 0x17fffa000-0x17fffdfff] +[ 0.000000] Zone ranges: +[ 0.000000] DMA [mem 0x0000000000001000-0x0000000000ffffff] +[ 0.000000] DMA32 [mem 0x0000000001000000-0x00000000ffffffff] +[ 0.000000] Normal [mem 0x0000000100000000-0x000000017fffffff] +[ 0.000000] Movable zone start for each node +[ 0.000000] Early memory node ranges +[ 0.000000] node 0: [mem 0x0000000000001000-0x000000000009efff] +[ 0.000000] node 0: [mem 0x0000000000100000-0x000000007ffddfff] +[ 0.000000] node 0: [mem 0x0000000100000000-0x000000017fffffff] +[ 0.000000] Initmem setup node 0 [mem 0x0000000000001000-0x000000017fffffff] +[ 0.000000] On node 0, zone DMA: 1 pages in unavailable ranges +[ 0.000000] On node 0, zone DMA: 97 pages in unavailable ranges +[ 0.000000] On node 0, zone Normal: 34 pages in unavailable ranges +[ 0.000000] ACPI: PM-Timer IO Port: 0x608 +[ 0.000000] ACPI: LAPIC_NMI (acpi_id[0xff] dfl dfl lint[0x1]) +[ 0.000000] IOAPIC[0]: apic_id 0, version 17, address 0xfec00000, GSI 0-23 +[ 0.000000] ACPI: INT_SRC_OVR (bus 0 bus_irq 0 global_irq 2 dfl dfl) +[ 0.000000] ACPI: INT_SRC_OVR (bus 0 bus_irq 5 global_irq 5 high level) +[ 0.000000] ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 9 high level) +[ 0.000000] ACPI: INT_SRC_OVR (bus 0 bus_irq 10 global_irq 10 high level) +[ 0.000000] ACPI: INT_SRC_OVR (bus 0 bus_irq 11 global_irq 11 high level) +[ 0.000000] ACPI: Using ACPI (MADT) for SMP configuration information +[ 0.000000] ACPI: HPET id: 0x8086a201 base: 0xfed00000 +[ 0.000000] TSC deadline timer available +[ 0.000000] smpboot: Allowing 1 CPUs, 0 hotplug CPUs +[ 0.000000] PM: hibernation: Registered nosave memory: [mem 0x00000000-0x00000fff] +[ 0.000000] PM: hibernation: Registered nosave memory: [mem 0x0009f000-0x0009ffff] +[ 0.000000] PM: hibernation: Registered nosave memory: [mem 0x000a0000-0x000effff] +[ 0.000000] PM: hibernation: Registered nosave memory: [mem 0x000f0000-0x000fffff] +[ 0.000000] PM: hibernation: Registered nosave memory: [mem 0x7ffde000-0x7fffffff] +[ 0.000000] PM: hibernation: Registered nosave memory: [mem 0x80000000-0xafffffff] +[ 0.000000] PM: hibernation: Registered nosave memory: [mem 0xb0000000-0xbfffffff] +[ 0.000000] PM: hibernation: Registered nosave memory: [mem 0xc0000000-0xfed1bfff] +[ 0.000000] PM: hibernation: Registered nosave memory: [mem 0xfed1c000-0xfed1ffff] +[ 0.000000] PM: hibernation: Registered nosave memory: [mem 0xfed20000-0xfeffbfff] +[ 0.000000] PM: hibernation: Registered nosave memory: [mem 0xfeffc000-0xfeffffff] +[ 0.000000] PM: hibernation: Registered nosave memory: [mem 0xff000000-0xfffbffff] +[ 0.000000] PM: hibernation: Registered nosave memory: [mem 0xfffc0000-0xffffffff] +[ 0.000000] [mem 0xc0000000-0xfed1bfff] available for PCI devices +[ 0.000000] clocksource: refined-jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 1910969940391419 ns +[ 0.000000] setup_percpu: NR_CPUS:64 nr_cpumask_bits:64 nr_cpu_ids:1 nr_node_ids:1 +[ 0.000000] percpu: Embedded 52 pages/cpu s174744 r8192 d30056 u2097152 +[ 0.000000] pcpu-alloc: s174744 r8192 d30056 u2097152 alloc=1*2097152 +[ 0.000000] pcpu-alloc: [0] 0 +[ 0.000000] Fallback order for Node 0: 0 +[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 1031902 +[ 0.000000] Policy zone: Normal +[ 0.000000] Kernel command line: root=/dev/sda3 nokaslr +[ 0.000000] Unknown kernel command line parameters "nokaslr", will be passed to user space. +[ 0.000000] Dentry cache hash table entries: 524288 (order: 10, 4194304 bytes, linear) +[ 0.000000] Inode-cache hash table entries: 262144 (order: 9, 2097152 bytes, linear) +[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off +[ 0.000000] Memory: 4019736K/4193776K available (16398K kernel code, 2621K rwdata, 5052K rodata, 1252K init, 1332K bss, 173784K reserved, 0K cma-reserved) +[ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 +[ 0.000000] Dynamic Preempt: full +[ 0.000000] rcu: Preemptible hierarchical RCU implementation. +[ 0.000000] rcu: RCU event tracing is enabled. +[ 0.000000] rcu: RCU restricting CPUs from NR_CPUS=64 to nr_cpu_ids=1. +[ 0.000000] Trampoline variant of Tasks RCU enabled. +[ 0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 100 jiffies. +[ 0.000000] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=1 +[ 0.000000] NR_IRQS: 4352, nr_irqs: 256, preallocated irqs: 16 +[ 0.000000] random: get_random_bytes called from start_kernel+0x492/0x65f with crng_init=0 +[ 0.000000] Console: colour VGA+ 80x25 +[ 0.000000] printk: console [tty0] enabled +[ 0.000000] ACPI: Core revision 20210930 +[ 0.000000] clocksource: hpet: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604467 ns +[ 0.001000] APIC: Switch to symmetric I/O mode setup +[ 0.002000] ..TIMER: vector=0x30 apic1=0 pin1=2 apic2=-1 pin2=-1 +[ 0.010000] tsc: Unable to calibrate against PIT +[ 0.011000] tsc: using HPET reference calibration +[ 0.012000] tsc: Detected 3699.687 MHz processor +[ 0.000260] clocksource: tsc-early: mask: 0xffffffffffffffff max_cycles: 0x6aa85c29371, max_idle_ns: 881590506582 ns +[ 0.001636] Calibrating delay loop (skipped), value calculated using timer frequency.. 7399.37 BogoMIPS (lpj=3699687) +[ 0.002617] pid_max: default: 32768 minimum: 301 +[ 0.003888] LSM: Security Framework initializing +[ 0.004744] SELinux: Initializing. +[ 0.006672] Mount-cache hash table entries: 8192 (order: 4, 65536 bytes, linear) +[ 0.007869] Mountpoint-cache hash table entries: 8192 (order: 4, 65536 bytes, linear) +[ 0.014682] x86/cpu: User Mode Instruction Prevention (UMIP) activated +[ 0.016974] Last level iTLB entries: 4KB 512, 2MB 255, 4MB 127 +[ 0.017603] Last level dTLB entries: 4KB 512, 2MB 255, 4MB 127, 1GB 0 +[ 0.018602] Spectre V1 : Mitigation: usercopy/swapgs barriers and __user pointer sanitization +[ 0.018623] Spectre V2 : Mitigation: Retpolines +[ 0.019603] Spectre V2 : Spectre v2 / SpectreRSB mitigation: Filling RSB on context switch +[ 0.020637] Spectre V2 : mitigation: Enabling conditional Indirect Branch Prediction Barrier +[ 0.021603] Speculative Store Bypass: Mitigation: Speculative Store Bypass disabled via prctl +[ 0.083192] Freeing SMP alternatives memory: 44K +[ 0.086287] smpboot: CPU0: AMD Ryzen Threadripper 3970X 32-Core Processor (family: 0x17, model: 0x31, stepping: 0x0) +[ 0.088185] Performance Events: Fam17h+ core perfctr, AMD PMU driver. +[ 0.088635] ... version: 0 +[ 0.089365] ... bit width: 48 +[ 0.089610] ... generic registers: 6 +[ 0.090332] ... value mask: 0000ffffffffffff +[ 0.090611] ... max period: 00007fffffffffff +[ 0.091424] ... fixed-purpose events: 0 +[ 0.091614] ... event mask: 000000000000003f +[ 0.092889] rcu: Hierarchical SRCU implementation. +[ 0.095245] smp: Bringing up secondary CPUs ... +[ 0.095612] smp: Brought up 1 node, 1 CPU +[ 0.096340] smpboot: Max logical packages: 1 +[ 0.096609] smpboot: Total of 1 processors activated (7399.37 BogoMIPS) +[ 0.169912] devtmpfs: initialized +[ 0.175284] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 1911260446275000 ns +[ 0.175676] futex hash table entries: 256 (order: 2, 16384 bytes, linear) +[ 0.177611] PM: RTC time: 10:29:46, date: 2022-03-20 +[ 0.183040] NET: Registered PF_NETLINK/PF_ROUTE protocol family +[ 0.187536] audit: initializing netlink subsys (disabled) +[ 0.191857] thermal_sys: Registered thermal governor 'step_wise' +[ 0.191877] thermal_sys: Registered thermal governor 'user_space' +[ 0.192675] audit: type=2000 audit(1647772186.201:1): state=initialized audit_enabled=0 res=1 +[ 0.194185] cpuidle: using governor menu +[ 0.198008] PCI: MMCONFIG for domain 0000 [bus 00-ff] at [mem 0xb0000000-0xbfffffff] (base 0xb0000000) +[ 0.198662] PCI: MMCONFIG at [mem 0xb0000000-0xbfffffff] reserved in E820 +[ 0.200081] PCI: Using configuration type 1 for base access +[ 0.204517] kprobes: kprobe jump-optimization is enabled. All kprobes are optimized if possible. +[ 0.205408] HugeTLB registered 2.00 MiB page size, pre-allocated 0 pages +[ 0.206698] ACPI: Added _OSI(Module Device) +[ 0.207453] ACPI: Added _OSI(Processor Device) +[ 0.207610] ACPI: Added _OSI(3.0 _SCP Extensions) +[ 0.208402] ACPI: Added _OSI(Processor Aggregator Device) +[ 0.208611] ACPI: Added _OSI(Linux-Dell-Video) +[ 0.209375] ACPI: Added _OSI(Linux-Lenovo-NV-HDMI-Audio) +[ 0.209614] ACPI: Added _OSI(Linux-HPI-Hybrid-Graphics) +[ 0.212597] ACPI: 1 ACPI AML tables successfully acquired and loaded +[ 0.215363] ACPI: Interpreter enabled +[ 0.215779] ACPI: PM: (supports S0 S3 S4 S5) +[ 0.216543] ACPI: Using IOAPIC for interrupt routing +[ 0.216649] PCI: Using host bridge windows from ACPI; if necessary, use "pci=nocrs" and report a bug +[ 0.217739] ACPI: Enabled 2 GPEs in block 00 to 3F +[ 0.221429] ACPI: PCI Root Bridge [PCI0] (domain 0000 [bus 00-ff]) +[ 0.221679] acpi PNP0A08:00: _OSC: OS supports [ExtendedConfig ASPM ClockPM Segments MSI HPX-Type3] +[ 0.222638] acpi PNP0A08:00: _OSC: platform does not support [LTR] +[ 0.223563] acpi PNP0A08:00: _OSC: OS now controls [PME PCIeCapability] +[ 0.223907] PCI host bridge to bus 0000:00 +[ 0.224612] pci_bus 0000:00: root bus resource [io 0x0000-0x0cf7 window] +[ 0.225562] pci_bus 0000:00: root bus resource [io 0x0d00-0xffff window] +[ 0.225610] pci_bus 0000:00: root bus resource [mem 0x000a0000-0x000bffff window] +[ 0.226616] pci_bus 0000:00: root bus resource [mem 0x80000000-0xafffffff window] +[ 0.227610] pci_bus 0000:00: root bus resource [mem 0xc0000000-0xfebfffff window] +[ 0.228611] pci_bus 0000:00: root bus resource [mem 0x180000000-0x97fffffff window] +[ 0.229611] pci_bus 0000:00: root bus resource [bus 00-ff] +[ 0.230749] pci 0000:00:00.0: [8086:29c0] type 00 class 0x060000 +[ 0.233477] pci 0000:00:01.0: [1af4:1000] type 00 class 0x020000 +[ 0.234636] pci 0000:00:01.0: reg 0x10: [io 0xc040-0xc05f] +[ 0.236087] pci 0000:00:01.0: reg 0x14: [mem 0xfebd0000-0xfebd0fff] +[ 0.239084] pci 0000:00:01.0: reg 0x20: [mem 0x1c0000000-0x1c0003fff 64bit pref] +[ 0.240327] pci 0000:00:01.0: reg 0x30: [mem 0xfeb80000-0xfebbffff pref] +[ 0.242540] pci 0000:00:02.0: [1af4:1050] type 00 class 0x030000 +[ 0.245344] pci 0000:00:02.0: reg 0x10: [mem 0xfe000000-0xfe7fffff pref] +[ 0.247587] pci 0000:00:02.0: reg 0x14: [mem 0xfebd1000-0xfebd1fff] +[ 0.250649] pci 0000:00:02.0: reg 0x18: [mem 0x1c0004000-0x1c0007fff 64bit pref] +[ 0.253628] pci 0000:00:02.0: reg 0x20: [mem 0x180000000-0x1bfffffff 64bit pref] +[ 0.256753] pci 0000:00:02.0: reg 0x30: [mem 0xfebc0000-0xfebcffff pref] +[ 0.258570] pci 0000:00:02.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] +[ 0.263325] pci 0000:00:1d.0: [8086:2934] type 00 class 0x0c0300 +[ 0.265363] pci 0000:00:1d.0: reg 0x20: [io 0xc060-0xc07f] +[ 0.266765] pci 0000:00:1d.1: [8086:2935] type 00 class 0x0c0300 +[ 0.269437] pci 0000:00:1d.1: reg 0x20: [io 0xc080-0xc09f] +[ 0.270732] pci 0000:00:1d.2: [8086:2936] type 00 class 0x0c0300 +[ 0.273371] pci 0000:00:1d.2: reg 0x20: [io 0xc0a0-0xc0bf] +[ 0.274696] pci 0000:00:1d.7: [8086:293a] type 00 class 0x0c0320 +[ 0.276035] pci 0000:00:1d.7: reg 0x10: [mem 0xfebd2000-0xfebd2fff] +[ 0.279317] pci 0000:00:1f.0: [8086:2918] type 00 class 0x060100 +[ 0.280866] pci 0000:00:1f.0: quirk: [io 0x0600-0x067f] claimed by ICH6 ACPI/GPIO/TCO +[ 0.282331] pci 0000:00:1f.2: [8086:2922] type 00 class 0x010601 +[ 0.284903] pci 0000:00:1f.2: reg 0x20: [io 0xc0c0-0xc0df] +[ 0.286143] pci 0000:00:1f.2: reg 0x24: [mem 0xfebd3000-0xfebd3fff] +[ 0.287991] pci 0000:00:1f.3: [8086:2930] type 00 class 0x0c0500 +[ 0.290370] pci 0000:00:1f.3: reg 0x20: [io 0x0700-0x073f] +[ 0.293435] ACPI: PCI: Interrupt link LNKA configured for IRQ 10 +[ 0.293726] ACPI: PCI: Interrupt link LNKB configured for IRQ 10 +[ 0.294744] ACPI: PCI: Interrupt link LNKC configured for IRQ 11 +[ 0.295723] ACPI: PCI: Interrupt link LNKD configured for IRQ 11 +[ 0.296740] ACPI: PCI: Interrupt link LNKE configured for IRQ 10 +[ 0.297763] ACPI: PCI: Interrupt link LNKF configured for IRQ 10 +[ 0.298722] ACPI: PCI: Interrupt link LNKG configured for IRQ 11 +[ 0.299743] ACPI: PCI: Interrupt link LNKH configured for IRQ 11 +[ 0.300662] ACPI: PCI: Interrupt link GSIA configured for IRQ 16 +[ 0.301579] ACPI: PCI: Interrupt link GSIB configured for IRQ 17 +[ 0.301618] ACPI: PCI: Interrupt link GSIC configured for IRQ 18 +[ 0.302625] ACPI: PCI: Interrupt link GSID configured for IRQ 19 +[ 0.303570] ACPI: PCI: Interrupt link GSIE configured for IRQ 20 +[ 0.303617] ACPI: PCI: Interrupt link GSIF configured for IRQ 21 +[ 0.304524] ACPI: PCI: Interrupt link GSIG configured for IRQ 22 +[ 0.304617] ACPI: PCI: Interrupt link GSIH configured for IRQ 23 +[ 0.307401] iommu: Default domain type: Translated +[ 0.307611] iommu: DMA domain TLB invalidation policy: lazy mode +[ 0.309801] pci 0000:00:02.0: vgaarb: setting as boot VGA device +[ 0.310602] pci 0000:00:02.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none +[ 0.310612] pci 0000:00:02.0: vgaarb: bridge control possible +[ 0.311469] vgaarb: loaded +[ 0.312823] SCSI subsystem initialized +[ 0.314995] libata version 3.00 loaded. +[ 0.315348] ACPI: bus type USB registered +[ 0.315984] usbcore: registered new interface driver usbfs +[ 0.316671] usbcore: registered new interface driver hub +[ 0.317497] usbcore: registered new device driver usb +[ 0.317760] pps_core: LinuxPPS API ver. 1 registered +[ 0.318568] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it> +[ 0.318672] PTP clock support registered +[ 0.320169] Advanced Linux Sound Architecture Driver Initialized. +[ 0.322001] NetLabel: Initializing +[ 0.322614] NetLabel: domain hash size = 128 +[ 0.323353] NetLabel: protocols = UNLABELED CIPSOv4 CALIPSO +[ 0.323799] NetLabel: unlabeled traffic allowed by default +[ 0.324864] PCI: Using ACPI for IRQ routing +[ 0.486511] PCI: pci_cache_line_size set to 64 bytes +[ 0.487017] e820: reserve RAM buffer [mem 0x0009fc00-0x0009ffff] +[ 0.487056] e820: reserve RAM buffer [mem 0x7ffde000-0x7fffffff] +[ 0.488868] hpet0: at MMIO 0xfed00000, IRQs 2, 8, 0 +[ 0.489610] hpet0: 3 comparators, 64-bit 100.000000 MHz counter +[ 0.493993] clocksource: Switched to clocksource tsc-early +[ 0.595279] VFS: Disk quotas dquot_6.6.0 +[ 0.604747] VFS: Dquot-cache hash table entries: 512 (order 0, 4096 bytes) +[ 0.606192] pnp: PnP ACPI init +[ 0.607564] system 00:05: [mem 0xb0000000-0xbfffffff window] has been reserved +[ 0.612917] pnp: PnP ACPI: found 6 devices +[ 0.630876] clocksource: acpi_pm: mask: 0xffffff max_cycles: 0xffffff, max_idle_ns: 2085701024 ns +[ 0.635819] NET: Registered PF_INET protocol family +[ 0.639137] IP idents hash table entries: 65536 (order: 7, 524288 bytes, linear) +[ 0.648315] tcp_listen_portaddr_hash hash table entries: 2048 (order: 3, 32768 bytes, linear) +[ 0.649938] TCP established hash table entries: 32768 (order: 6, 262144 bytes, linear) +[ 0.656731] TCP bind hash table entries: 32768 (order: 7, 524288 bytes, linear) +[ 0.668799] TCP: Hash tables configured (established 32768 bind 32768) +[ 0.670725] UDP hash table entries: 2048 (order: 4, 65536 bytes, linear) +[ 0.675922] UDP-Lite hash table entries: 2048 (order: 4, 65536 bytes, linear) +[ 0.677641] NET: Registered PF_UNIX/PF_LOCAL protocol family +[ 0.683489] RPC: Registered named UNIX socket transport module. +[ 0.684419] RPC: Registered udp transport module. +[ 0.685233] RPC: Registered tcp transport module. +[ 0.686051] RPC: Registered tcp NFSv4.1 backchannel transport module. +[ 0.690218] pci_bus 0000:00: resource 4 [io 0x0000-0x0cf7 window] +[ 0.691147] pci_bus 0000:00: resource 5 [io 0x0d00-0xffff window] +[ 0.692046] pci_bus 0000:00: resource 6 [mem 0x000a0000-0x000bffff window] +[ 0.695623] pci_bus 0000:00: resource 7 [mem 0x80000000-0xafffffff window] +[ 0.702621] pci_bus 0000:00: resource 8 [mem 0xc0000000-0xfebfffff window] +[ 0.703550] pci_bus 0000:00: resource 9 [mem 0x180000000-0x97fffffff window] +[ 0.709679] ACPI: \_SB_.GSIA: Enabled at IRQ 16 +[ 0.711527] ACPI: \_SB_.GSIB: Enabled at IRQ 17 +[ 0.717245] ACPI: \_SB_.GSIC: Enabled at IRQ 18 +[ 0.718745] ACPI: \_SB_.GSID: Enabled at IRQ 19 +[ 0.720153] PCI: CLS 0 bytes, default 64 +[ 0.725883] PCI-DMA: Using software bounce buffering for IO (SWIOTLB) +[ 0.726841] software IO TLB: mapped [mem 0x000000007bfcf000-0x000000007ffcf000] (64MB) +[ 0.728264] Unpacking initramfs... +[ 0.744075] Freeing initrd memory: 4K +[ 0.756363] Initialise system trusted keyrings +[ 0.758663] workingset: timestamp_bits=56 max_order=20 bucket_order=0 +[ 0.764972] NFS: Registering the id_resolver key type +[ 0.767942] Key type id_resolver registered +[ 0.768863] Key type id_legacy registered +[ 0.770030] 9p: Installing v9fs 9p2000 file system support +[ 0.775964] Key type asymmetric registered +[ 0.776761] Asymmetric key parser 'x509' registered +[ 0.777862] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251) +[ 0.779862] io scheduler mq-deadline registered +[ 0.780675] io scheduler kyber registered +[ 0.782859] input: Power Button as /devices/LNXSYSTM:00/LNXPWRBN:00/input/input0 +[ 0.787721] ACPI: button: Power Button [PWRF] +[ 0.791799] ACPI: \_SB_.GSIF: Enabled at IRQ 21 +[ 0.795895] ACPI: \_SB_.GSIG: Enabled at IRQ 22 +[ 0.802029] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled +[ 0.803727] 00:03: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A +[ 0.806289] Non-volatile memory driver v1.3 +[ 0.807110] Linux agpgart interface v0.103 +[ 0.808280] ACPI: bus type drm_connector registered +[ 0.810106] [drm] pci: virtio-vga detected at 0000:00:02.0 +[ 0.811033] virtio-pci 0000:00:02.0: vgaarb: deactivate vga console +[ 0.812950] Console: switching to colour dummy device 80x25 +[ 0.814010] [drm] Host memory window: 0x180000000 +0x40000000 +[ 0.814014] [drm] features: +virgl +edid +resource_blob +host_visible +[ 0.814015] [drm] features: +context_init +[ 0.815749] [drm] number of scanouts: 1 +[ 0.815764] [drm] number of cap sets: 1 +[ 0.822421] [drm] cap set 0: id 4, max-version 0, max-size 20 +[ 0.823816] [drm] Initialized virtio_gpu 0.1.0 0 for virtio1 on minor 0 +[ 0.835655] loop: module loaded +[ 0.836198] ahci 0000:00:1f.2: version 3.0 +[ 0.838738] ahci 0000:00:1f.2: AHCI 0001.0000 32 slots 6 ports 1.5 Gbps 0x3f impl SATA mode +[ 0.838743] ahci 0000:00:1f.2: flags: 64bit ncq only +[ 0.844268] scsi host0: ahci +[ 0.845062] scsi host1: ahci +[ 0.845675] scsi host2: ahci +[ 0.846482] scsi host3: ahci +[ 0.847257] scsi host4: ahci +[ 0.847860] scsi host5: ahci +[ 0.848240] ata1: SATA max UDMA/133 abar m4096@0xfebd3000 port 0xfebd3100 irq 27 +[ 0.848266] ata2: SATA max UDMA/133 abar m4096@0xfebd3000 port 0xfebd3180 irq 27 +[ 0.848281] ata3: SATA max UDMA/133 abar m4096@0xfebd3000 port 0xfebd3200 irq 27 +[ 0.848295] ata4: SATA max UDMA/133 abar m4096@0xfebd3000 port 0xfebd3280 irq 27 +[ 0.848310] ata5: SATA max UDMA/133 abar m4096@0xfebd3000 port 0xfebd3300 irq 27 +[ 0.848324] ata6: SATA max UDMA/133 abar m4096@0xfebd3000 port 0xfebd3380 irq 27 +[ 0.854343] e100: Intel(R) PRO/100 Network Driver +[ 0.854365] e100: Copyright(c) 1999-2006 Intel Corporation +[ 0.854401] e1000: Intel(R) PRO/1000 Network Driver +[ 0.854403] e1000: Copyright (c) 1999-2006 Intel Corporation. +[ 0.854505] e1000e: Intel(R) PRO/1000 Network Driver +[ 0.854506] e1000e: Copyright(c) 1999 - 2015 Intel Corporation. +[ 0.854562] sky2: driver version 1.30 +[ 0.855224] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver +[ 0.855227] ehci-pci: EHCI PCI platform driver +[ 0.856209] ehci-pci 0000:00:1d.7: EHCI Host Controller +[ 0.856447] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 +[ 0.857195] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfebd2000 +[ 0.863684] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 +[ 0.863941] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 5.16 +[ 0.863946] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 +[ 0.863948] usb usb1: Product: EHCI Host Controller +[ 0.863950] usb usb1: Manufacturer: Linux 5.16.14 ehci_hcd +[ 0.863952] usb usb1: SerialNumber: 0000:00:1d.7 +[ 0.864286] hub 1-0:1.0: USB hub found +[ 0.864294] hub 1-0:1.0: 6 ports detected +[ 0.864919] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver +[ 0.864953] ohci-pci: OHCI PCI platform driver +[ 0.865050] uhci_hcd: USB Universal Host Controller Interface driver +[ 0.865658] uhci_hcd 0000:00:1d.0: UHCI Host Controller +[ 0.865792] uhci_hcd 0000:00:1d.0: new USB bus registered, assigned bus number 2 +[ 0.866072] uhci_hcd 0000:00:1d.0: irq 16, io port 0x0000c060 +[ 0.866256] usb usb2: New USB device found, idVendor=1d6b, idProduct=0001, bcdDevice= 5.16 +[ 0.866259] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1 +[ 0.866262] usb usb2: Product: UHCI Host Controller +[ 0.866263] usb usb2: Manufacturer: Linux 5.16.14 uhci_hcd +[ 0.866265] usb usb2: SerialNumber: 0000:00:1d.0 +[ 0.866537] hub 2-0:1.0: USB hub found +[ 0.866542] hub 2-0:1.0: 2 ports detected +[ 0.867382] uhci_hcd 0000:00:1d.1: UHCI Host Controller +[ 0.867567] uhci_hcd 0000:00:1d.1: new USB bus registered, assigned bus number 3 +[ 0.867827] uhci_hcd 0000:00:1d.1: irq 17, io port 0x0000c080 +[ 0.868033] usb usb3: New USB device found, idVendor=1d6b, idProduct=0001, bcdDevice= 5.16 +[ 0.868037] usb usb3: New USB device strings: Mfr=3, Product=2, SerialNumber=1 +[ 0.868039] usb usb3: Product: UHCI Host Controller +[ 0.868040] usb usb3: Manufacturer: Linux 5.16.14 uhci_hcd +[ 0.868042] usb usb3: SerialNumber: 0000:00:1d.1 +[ 0.868240] hub 3-0:1.0: USB hub found +[ 0.868245] hub 3-0:1.0: 2 ports detected +[ 0.869174] uhci_hcd 0000:00:1d.2: UHCI Host Controller +[ 0.869321] uhci_hcd 0000:00:1d.2: new USB bus registered, assigned bus number 4 +[ 0.869553] uhci_hcd 0000:00:1d.2: irq 18, io port 0x0000c0a0 +[ 0.869959] usb usb4: New USB device found, idVendor=1d6b, idProduct=0001, bcdDevice= 5.16 +[ 0.869963] usb usb4: New USB device strings: Mfr=3, Product=2, SerialNumber=1 +[ 0.869965] usb usb4: Product: UHCI Host Controller +[ 0.870002] usb usb4: Manufacturer: Linux 5.16.14 uhci_hcd +[ 0.870003] usb usb4: SerialNumber: 0000:00:1d.2 +[ 0.870149] hub 4-0:1.0: USB hub found +[ 0.870153] hub 4-0:1.0: 2 ports detected +[ 0.870910] usbcore: registered new interface driver usblp +[ 0.870991] usbcore: registered new interface driver usb-storage +[ 0.871112] i8042: PNP: PS/2 Controller [PNP0303:KBD,PNP0f13:MOU] at 0x60,0x64 irq 1,12 +[ 0.873033] serio: i8042 KBD port at 0x60,0x64 irq 1 +[ 0.873240] serio: i8042 AUX port at 0x60,0x64 irq 12 +[ 0.874086] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input1 +[ 0.878739] rtc_cmos 00:04: RTC can wake from S4 +[ 0.880210] rtc_cmos 00:04: registered as rtc0 +[ 0.880321] rtc_cmos 00:04: alarms up to one day, y3k, 242 bytes nvram, hpet irqs +[ 0.880886] i801_smbus 0000:00:1f.3: SMBus using PCI interrupt +[ 0.881236] i2c i2c-0: 1/1 memory slots populated (from DMI) +[ 0.881239] i2c i2c-0: Memory type 0x07 not supported yet, not instantiating SPD +[ 0.881737] device-mapper: ioctl: 4.45.0-ioctl (2021-03-22) initialised: dm-devel@redhat.com +[ 0.882038] hid: raw HID events driver (C) Jiri Kosina +[ 0.882495] usbcore: registered new interface driver usbhid +[ 0.882498] usbhid: USB HID core driver +[ 0.890838] Initializing XFRM netlink socket +[ 0.891351] NET: Registered PF_INET6 protocol family +[ 0.893594] Segment Routing with IPv6 +[ 0.893647] In-situ OAM (IOAM) with IPv6 +[ 0.893870] sit: IPv6, IPv4 and MPLS over IPv4 tunneling driver +[ 0.894342] NET: Registered PF_PACKET protocol family +[ 0.894821] 9pnet: Installing 9P2000 support +[ 0.894914] Key type dns_resolver registered +[ 0.895481] IPI shorthand broadcast: enabled +[ 0.895672] sched_clock: Marking stable (908022380, -12397814)->(1044483817, -148859251) +[ 0.895978] registered taskstats version 1 +[ 0.895980] Loading compiled-in X.509 certificates +[ 0.897126] cryptomgr_test (53) used greatest stack depth: 15480 bytes left +[ 0.897149] cryptomgr_test (54) used greatest stack depth: 15448 bytes left +[ 0.898086] cryptomgr_test (69) used greatest stack depth: 15392 bytes left +[ 0.900491] PM: Magic number: 14:469:477 +[ 0.901051] printk: console [netcon0] enabled +[ 0.901053] netconsole: network logging started +[ 0.901456] cfg80211: Loading compiled-in X.509 certificates for regulatory database +[ 0.903159] kworker/u2:6 (76) used greatest stack depth: 14656 bytes left +[ 0.903680] cfg80211: Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7' +[ 0.903771] ALSA device list: +[ 0.903773] No soundcards found. +[ 0.904412] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2 +[ 0.904450] cfg80211: failed to load regulatory.db +[ 1.094640] usb 1-1: new high-speed USB device number 2 using ehci-pci +[ 1.146521] ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300) +[ 1.146780] ata1.00: ATA-7: QEMU HARDDISK, 2.5+, max UDMA/100 +[ 1.146785] ata1.00: 33554432 sectors, multi 16: LBA48 NCQ (depth 32) +[ 1.146810] ata1.00: applying bridge limits +[ 1.147076] ata1.00: configured for UDMA/100 +[ 1.147318] ata2: SATA link down (SStatus 0 SControl 300) +[ 1.154178] ata3: SATA link up 1.5 Gbps (SStatus 113 SControl 300) +[ 1.154371] ata3.00: ATAPI: QEMU DVD-ROM, 2.5+, max UDMA/100 +[ 1.154375] ata3.00: applying bridge limits +[ 1.154673] ata3.00: configured for UDMA/100 +[ 1.155258] ata4: SATA link down (SStatus 0 SControl 300) +[ 1.155530] ata5: SATA link down (SStatus 0 SControl 300) +[ 1.155833] ata6: SATA link down (SStatus 0 SControl 300) +[ 1.157704] scsi 0:0:0:0: Direct-Access ATA QEMU HARDDISK 2.5+ PQ: 0 ANSI: 5 +[ 1.158268] sd 0:0:0:0: [sda] 33554432 512-byte logical blocks: (17.2 GB/16.0 GiB) +[ 1.158307] sd 0:0:0:0: [sda] Write Protect is off +[ 1.158309] sd 0:0:0:0: [sda] Mode Sense: 00 3a 00 00 +[ 1.158316] sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA +[ 1.158993] sd 0:0:0:0: Attached scsi generic sg0 type 0 +[ 1.165858] scsi 2:0:0:0: CD-ROM QEMU QEMU DVD-ROM 2.5+ PQ: 0 ANSI: 5 +[ 1.175815] sda: sda1 sda2 sda3 +[ 1.176475] sd 0:0:0:0: [sda] Attached SCSI disk +[ 1.181093] sr 2:0:0:0: [sr0] scsi3-mmc drive: 4x/4x cd/rw xa/form2 tray +[ 1.181149] cdrom: Uniform CD-ROM driver Revision: 3.20 +[ 1.197445] sr 2:0:0:0: Attached scsi CD-ROM sr0 +[ 1.197689] sr 2:0:0:0: Attached scsi generic sg1 type 5 +[ 1.224877] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 +[ 1.224885] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 +[ 1.224887] usb 1-1: Product: QEMU USB Tablet +[ 1.224889] usb 1-1: Manufacturer: QEMU +[ 1.224891] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 +[ 1.231334] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb1/1-1/1-1:1.0/0003:0627:0001.0001/input/input4 +[ 1.231474] hid-generic 0003:0627:0001.0001: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 +[ 1.484028] random: fast init done +[ 1.486085] input: ImExPS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input3 +[ 1.486277] md: Waiting for all devices to be available before autodetect +[ 1.486280] md: If you don't use raid, use raid=noautodetect +[ 1.486308] md: Autodetecting RAID arrays. +[ 1.486310] md: autorun ... +[ 1.486311] md: ... autorun DONE. +[ 1.489760] EXT4-fs (sda3): INFO: recovery required on readonly filesystem +[ 1.489764] EXT4-fs (sda3): write access will be enabled during recovery +[ 1.549515] EXT4-fs (sda3): recovery complete +[ 1.551218] EXT4-fs (sda3): mounted filesystem with ordered data mode. Opts: (null). Quota mode: none. +[ 1.551395] VFS: Mounted root (ext4 filesystem) readonly on device 8:3. +[ 1.552185] devtmpfs: mounted +[ 1.564828] Freeing unused kernel image (initmem) memory: 1252K +[ 1.565429] Write protecting the kernel read-only data: 24576k +[ 1.588472] Freeing unused kernel image (text/rodata gap) memory: 2032K +[ 1.599305] Freeing unused kernel image (rodata/data gap) memory: 1092K +[ 1.600131] Run /sbin/init as init process +[ 1.600145] with arguments: +[ 1.600145] /sbin/init +[ 1.600145] nokaslr +[ 1.600146] with environment: +[ 1.600146] HOME=/ +[ 1.600146] TERM=linux +[ 1.719163] systemd[1]: systemd 248.3-1ubuntu8.2 running in system mode. (+PAM +AUDIT +SELINUX +APPARMOR +IMA +SMACK +SECCOMP +GCRYPT +GNUTLS -OPENSSL +ACL +BLKID +CURL +ELFUTILS -FIDO2 +IDN2 -IDN +IPTC +KMOD +LIBCRYPTSETUP -LIBFDISK +PCRE2 -PWQUALITY -P11KIT -QRENCODE +BZIP2 +LZ4 +XZ +ZLIB +ZSTD -XKBCOMMON +UTMP +SYSVINIT default-hierarchy=unified) +[ 1.719924] systemd[1]: Detected virtualization kvm. +[ 1.719999] systemd[1]: Detected architecture x86-64. +[ 1.721691] systemd[1]: Hostname set to <lygstate-Standard-PC-Q35-ICH9-2009>. +[ 1.742316] (sd-executor) (84) used greatest stack depth: 13744 bytes left +[ 1.747792] tsc: Refined TSC clocksource calibration: 3699.944 MHz +[ 1.747936] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x6aaa423949d, max_idle_ns: 881591081251 ns +[ 1.748220] clocksource: Switched to clocksource tsc +[ 1.804055] friendly-recove (87) used greatest stack depth: 13736 bytes left +[ 1.857049] openvpn-generat (89) used greatest stack depth: 13672 bytes left +[ 1.857104] ls (104) used greatest stack depth: 13616 bytes left +[ 2.049195] systemd[1]: Queued start job for default target Graphical Interface. +[ 2.053399] systemd[1]: Created slice system-modprobe.slice. +[ 2.055075] systemd[1]: Created slice system-systemd\x2dfsck.slice. +[ 2.055330] systemd[1]: Created slice User and Session Slice. +[ 2.055443] systemd[1]: Started Forward Password Requests to Wall Directory Watch. +[ 2.057210] systemd[1]: Set up automount Arbitrary Executable File Formats File System Automount Point. +[ 2.057325] systemd[1]: Reached target User and Group Name Lookups. +[ 2.057352] systemd[1]: Reached target Remote File Systems. +[ 2.057371] systemd[1]: Reached target Slices. +[ 2.057397] systemd[1]: Reached target Local Verity Integrity Protected Volumes. +[ 2.058182] systemd[1]: Listening on Syslog Socket. +[ 2.058530] systemd[1]: Listening on fsck to fsckd communication Socket. +[ 2.058768] systemd[1]: Listening on initctl Compatibility Named Pipe. +[ 2.059725] systemd[1]: Listening on Journal Audit Socket. +[ 2.059946] systemd[1]: Listening on Journal Socket (/dev/log). +[ 2.060156] systemd[1]: Listening on Journal Socket. +[ 2.060815] systemd[1]: Listening on udev Control Socket. +[ 2.060970] systemd[1]: Listening on udev Kernel Socket. +[ 2.065155] systemd[1]: Mounting Huge Pages File System... +[ 2.069417] systemd[1]: Mounting POSIX Message Queue File System... +[ 2.079658] systemd[1]: Mounting Kernel Debug File System... +[ 2.082741] systemd[1]: Mounting Kernel Trace File System... +[ 2.083848] systemd[1]: systemd-journald.service: unit configures an IP firewall, but the local system does not support BPF/cgroup firewalling. +[ 2.083853] systemd[1]: (This warning is only shown for the first unit using IP firewalling.) +[ 2.089029] systemd[1]: Starting Journal Service... +[ 2.275345] systemd[1]: Starting Set the console keyboard layout... +[ 2.331794] systemd[1]: Condition check resulted in Create list of static device nodes for the current kernel being skipped. +[ 2.373032] systemd[1]: Starting Load Kernel Module configfs... +[ 2.390012] systemd[1]: Starting Load Kernel Module drm... +[ 2.401425] systemd[1]: Starting Load Kernel Module fuse... +[ 2.418703] systemd[1]: Condition check resulted in Set Up Additional Binary Formats being skipped. +[ 2.420064] systemd[1]: Starting File System Check on Root Device... +[ 2.432087] systemd[1]: Starting Load Kernel Modules... +[ 2.452273] systemd[1]: Starting Coldplug All udev Devices... +[ 2.468269] systemd[1]: Starting Uncomplicated firewall... +[ 2.518424] systemd[1]: Mounted Huge Pages File System. +[ 2.518764] systemd[1]: Mounted POSIX Message Queue File System. +[ 2.518974] systemd[1]: Mounted Kernel Debug File System. +[ 2.519140] systemd[1]: Mounted Kernel Trace File System. +[ 2.530711] systemd[1]: modprobe@configfs.service: Deactivated successfully. +[ 2.531730] systemd[1]: Finished Load Kernel Module configfs. +[ 2.538860] systemd[1]: modprobe@drm.service: Deactivated successfully. +[ 2.544760] systemd[1]: Finished Load Kernel Module drm. +[ 2.545030] systemd[1]: modprobe@fuse.service: Deactivated successfully. +[ 2.546685] systemd[1]: Finished Load Kernel Module fuse. +[ 2.546931] systemd[1]: systemd-modules-load.service: Main process exited, code=exited, status=1/FAILURE +[ 2.546980] systemd[1]: systemd-modules-load.service: Failed with result 'exit-code'. +[ 2.549652] systemd[1]: Failed to start Load Kernel Modules. +[ 2.552638] systemd[1]: Finished Uncomplicated firewall. +[ 2.553148] systemd[1]: Condition check resulted in FUSE Control File System being skipped. +[ 2.553189] systemd[1]: Condition check resulted in Kernel Configuration File System being skipped. +[ 2.557719] systemd[1]: Started File System Check Daemon to report status. +[ 2.566265] systemd[1]: Starting Apply Kernel Variables... +[ 2.579756] systemd[1]: Started Journal Service. +[ 2.641573] random: crng init done +[ 2.718179] EXT4-fs (sda3): re-mounted. Opts: errors=remount-ro. Quota mode: none. +[ 2.732681] Adding 752916k swap on /swapfile. Priority:-2 extents:3 across:769300k +[ 2.733844] swapon (132) used greatest stack depth: 13568 bytes left +[ 2.735312] systemd-journald[110]: Received client request to flush runtime journal. +[ 2.743169] systemd-journald[110]: File /var/log/journal/6baf11e8245c4ca98eface85b84be32f/system.journal corrupted or uncleanly shut down, renaming and replacing. +[ 2.811309] loop0: detected capacity change from 0 to 203424 +[ 2.815025] loop1: detected capacity change from 0 to 126632 +[ 2.815152] loop2: detected capacity change from 0 to 8 +[ 2.827343] loop3: detected capacity change from 0 to 307976 +[ 2.841748] loop0: detected capacity change from 0 to 133552 +[ 2.843903] loop4: detected capacity change from 0 to 496320 +[ 2.847378] loop1: detected capacity change from 0 to 111048 +[ 2.914163] journal-offline (149) used greatest stack depth: 13344 bytes left +[ 3.788267] virtio_net virtio0 enp0s1: renamed from eth0 +[ 9.114766] language-option (340) used greatest stack depth: 12992 bytes left +[ 12.965077] loop0: detected capacity change from 0 to 8 +[ 15.602770] systemd-journald[110]: File /var/log/journal/6baf11e8245c4ca98eface85b84be32f/user-1000.journal corrupted or uncleanly shut down, renaming and replacing. +[ 19.878209] virtio_gpu virtio1: [drm] drm_plane_enable_fb_damage_clips() not called +[ 313.191235] loop0: detected capacity change from 0 to 8 +[ 334.252458] loop0: detected capacity change from 0 to 126760 +[ 336.575589] loop0: detected capacity change from 0 to 226664 +[ 613.230337] loop0: detected capacity change from 0 to 8 +[ 660.444496] kworker/dying (50) used greatest stack depth: 12400 bytes left +[ 809.013491] clocksource: timekeeping watchdog on CPU0: hpet wd-wd read-back delay of 65260ns +[ 809.013577] clocksource: wd-tsc-wd read-back delay of 1983150ns, clock-skew test skipped! +[ 913.163318] loop0: detected capacity change from 0 to 8 +[ 1213.159179] loop0: detected capacity change from 0 to 8 +[ 1513.151818] loop0: detected capacity change from 0 to 8 +[ 1813.150457] loop0: detected capacity change from 0 to 8 +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/925 b/results/classifier/mode-deepseek-r1:32b/output/system/925 new file mode 100644 index 00000000..61a32cd3 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/925 @@ -0,0 +1,20 @@ + + +AArch64 SVE2 LD/ST instructions segfault on MMIO addresses +Description of problem: +During execution of the following SVE2 instruction: `ld1b {z9.s}, p2/z, [x17, z26.s, sxtw]` with the following register state: +``` +(gdb) p $x17 +$1 = 0xffffffe2 +(gdb) p $z26.s.u +$2 = {0x0 <repeats 16 times>} +(gdb) p $p2 +$3 = {0xc4, 0x0, 0x9d, 0x0, 0xe5, 0x0, 0x83, 0x0, 0x80, 0xce, 0x3f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x46, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x56, 0x1a, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf0, 0xd8, 0x96, 0xee, 0xfc, 0x7f, 0x0, 0x0, 0x50, 0xce, 0x94, 0x1, 0x0, 0x0, 0x0, 0x0, 0xf0, 0xd8, 0x96, 0xee, 0xfc, 0x7f, 0x0, 0x0, 0x10, 0x38, 0x40, 0x3, 0x0, 0x0, 0x0, 0x0} +``` +QEMU segfaults due to a null pointer access. Note that after translation this address is an MMIO address that points to a UART device. +Additional information: +A quick look at the implementation of the SVE2 load/store host memory access functions I've noticed that the `TLB_MMIO` flag is ignored in `sve_probe_page`, which means that users use the (null) host address as if it was pointing to real memory. This function (or the ones above it) should (probably) throw the appropriate external data abort, otherwise this needs to be instrumented to support reading from MMIO mapped devices. + +<details><summary>Reproducer seed for my future self</summary> +S6008340160849309262|Q|cd4t|pq|w5|lK124 +</details> diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/926 b/results/classifier/mode-deepseek-r1:32b/output/system/926 new file mode 100644 index 00000000..53478b25 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/926 @@ -0,0 +1,3 @@ + + +block-backend assertion with Cocoa UI diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/928 b/results/classifier/mode-deepseek-r1:32b/output/system/928 new file mode 100644 index 00000000..b4ec8a1b --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/928 @@ -0,0 +1,86 @@ + + +QEMU/TCG generates #GP instead #SS for RBP/RSP based faults +Description of problem: +Setting RSP/RBP to a non-canonical address and trying to access a memory location based on RSP/RBP generates a #GP under QEMU/TCG while it should generate an #SS exception instead. This difference in behavior triggers a [Xen selftest](https://github.com/xen-project/xen/blob/1145d94c738e/xen/arch/x86/extable.c#L142-L144) violation as can be seen below. + +- A successful run should look like this, e.g. when run under KVM: + +``` +(XEN) Running stub recovery selftests... +(XEN) Fixup #UD[0000]: ffff82d07fffe040 [ffff82d07fffe040] -> ffff82d04038b9e7 +(XEN) Fixup #GP[0000]: ffff82d07fffe041 [ffff82d07fffe041] -> ffff82d04038b9e7 +(XEN) Fixup #SS[0000]: ffff82d07fffe040 [ffff82d07fffe040] -> ffff82d04038b9e7 +(XEN) Fixup #BP[0000]: ffff82d07fffe041 [ffff82d07fffe041] -> ffff82d04038b9e7 +``` + +- Under QEMU/TCG it triggers this scary warning: + +``` +(XEN) Running stub recovery selftests... +(XEN) Fixup #UD[0000]: ffff82d07fffe040 [ffff82d07fffe040] -> ffff82d04038b9e7 +(XEN) Fixup #GP[0000]: ffff82d07fffe041 [ffff82d07fffe041] -> ffff82d04038b9e7 +(XEN) Fixup #GP[0000]: ffff82d07fffe040 [ffff82d07fffe040] -> ffff82d04038b9e7 +(XEN) Selftest 2 failed: Opc 02 04 04 c3 expected 12[0000], got 13[0000] +(XEN) Fixup #BP[0000]: ffff82d07fffe041 [ffff82d07fffe041] -> ffff82d04038b9e7 +[...] +(XEN) *************************************************** +(XEN) SELFTEST FAILURE: CORRECT BEHAVIOR CANNOT BE GUARANTEED +(XEN) *************************************************** +(XEN) 3... 2... 1... +``` +Steps to reproduce: +The attached program ([noncanon.c](/uploads/34599a2fe23c6bbf1e9efd8cb8704537/noncanon.c)) generates the following output when run on native hardware or under KVM: + +```shell-session +minipli@bell:~$ for i in "" -sp -bp; do ./noncanon $i; done +Non-canonical acces via RAX: SIGSEGV, signo 11, error 0, code 128, addr (nil) +Non-canonical acces via RSP: SIGBUS, signo 7, error 0, code 128, addr (nil) +Non-canonical acces via RBP: SIGBUS, signo 7, error 0, code 128, addr (nil) +``` + +However, when run under QEMU using TCG, I get the following output: + +```shell-session +root@box:~# for i in "" -sp -bp; do ./noncanon $i; done +Non-canonical acces via RAX: SIGSEGV, signo 11, error 0, code 128, addr (nil) +Non-canonical acces via RSP: SIGSEGV, signo 11, error 0, code 128, addr (nil) +Non-canonical acces via RBP: SIGSEGV, signo 11, error 0, code 128, addr (nil) +``` + +Please note how RSP/RBP based access generates SIGSEGV instead of the expected SIGBUS. +Additional information: +The problem seems to be that QEMU always generates a #GP for non-canonical addresses, while it should differentiate, based on the register that led to the non-canonical address: #SS if RSP/RBP is involved, #GP otherwise. However, short of an instruction decoder, I don't see how this can easily be told apart. + +```diff +diff --git a/target/i386/tcg/sysemu/excp_helper.c b/target/i386/tcg/sysemu/excp_helper.c +index e1b6d8868338..ac4a6351a49d 100644 +--- a/target/i386/tcg/sysemu/excp_helper.c ++++ b/target/i386/tcg/sysemu/excp_helper.c +@@ -386,6 +386,7 @@ static int handle_mmu_fault(CPUState *cs, vaddr addr, int size, + sext = (int64_t)addr >> (pg_mode & PG_MODE_LA57 ? 56 : 47); + if (sext != 0 && sext != -1) { + env->error_code = 0; ++ // XXX: or EXCP0C_STACK for SP/BP bassed error + cs->exception_index = EXCP0D_GPF; + return 1; + } +``` + +Relevant excerpt from the Intel SDM: + +> **6.15 EXCEPTION AND INTERRUPT REFERENCE** +> [...] +> **Interrupt 12—Stack Fault Exception (#SS)** +> [...] +> - A canonical violation is detected in 64-bit mode during an operation that reference memory using the stack pointer register containing a non-canonical memory address. + +Please note the lack of mentioning the base pointer register, but tests on real hardware show it's subject to this as well. + +The AMD manual is more precise about that: +> **8.2.13 #SS—Stack Exception (Vector 12)** +> An #SS exception can occur in the following situations: +> - Implied stack references in which the stack address is not in canonical form. Implied stack references include all push and pop instructions, and any instruction using RSP or RBP as a base register +> [...] + +It explicitly mentions "any instruction using RSP or RBP as a base register". diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/930 b/results/classifier/mode-deepseek-r1:32b/output/system/930 new file mode 100644 index 00000000..1b91c46f --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/930 @@ -0,0 +1,3 @@ + + +Impossible to make windows 98 work on Qemu ver. 5.2 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/931 b/results/classifier/mode-deepseek-r1:32b/output/system/931 new file mode 100644 index 00000000..b9b61b77 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/931 @@ -0,0 +1,3 @@ + + +Create GitLab 7.1 milestone diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/94 b/results/classifier/mode-deepseek-r1:32b/output/system/94 new file mode 100644 index 00000000..20e51f4d --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/94 @@ -0,0 +1,3 @@ + + +MIPS r4k "TLB modified exception" generated for TLB entries that are not visible to the TLBP instruction diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/942 b/results/classifier/mode-deepseek-r1:32b/output/system/942 new file mode 100644 index 00000000..d54f7dfe --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/942 @@ -0,0 +1,3 @@ + + +No TPM support for riscv64 in QEMU diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/944 b/results/classifier/mode-deepseek-r1:32b/output/system/944 new file mode 100644 index 00000000..fba7378e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/944 @@ -0,0 +1,30 @@ + + +9p virtfs issue under MacOS in 7.0.0-rc1 +Description of problem: +9p virtfs under MacOS has an issue with sed inline replacements (sed -i). +The issue somewhere in xattr I believe +Steps to reproduce: +1. /Users/sid/ is mounted via 9p virtfs from MacOS host +2. +``` +[core@localhost ~]$ sed -i 's/aaa/zzz/g' /Users/sid/q/123 +sed: preserving permissions for ‘/Users/sid/q/sed3MLMjp’: Protocol not supported +``` +Additional information: +strace part with error +``` +openat(AT_FDCWD, "/proc/thread-self/attr/fscreate", O_RDWR|O_CLOEXEC) = 5 +write(5, NULL, 0) = 0 +close(5) = 0 +newfstatat(3, "", {st_mode=S_IFREG|0644, st_size=12, ...}, AT_EMPTY_PATH) = 0 +read(3, "qqq\nzzz\nsss\n", 8192) = 12 +newfstatat(4, "", {st_mode=S_IFREG|0600, st_size=0, ...}, AT_EMPTY_PATH) = 0 +read(3, "", 8192) = 0 +fchown(4, 501, 1000) = 0 +fgetxattr(3, "system.posix_acl_access", 0x7ffd6dbd18b0, 132) = -1 ENODATA (No data available) +newfstatat(3, "", {st_mode=S_IFREG|0644, st_size=12, ...}, AT_EMPTY_PATH) = 0 +fsetxattr(4, "system.posix_acl_access", "\2\0\0\0\1\0\6\0\377\377\377\377\4\0\4\0\377\377\377\377 \0\4\0\377\377\377\377", 28, 0) = -1 EPROTONOSUPPORT (Protocol not supported) +fsetxattr(4, "system.posix_acl_access", "\2\0\0\0\1\0\6\0\377\377\377\377\4\0\4\0\377\377\377\377 \0\4\0\377\377\377\377", 28, 0) = -1 EPROTONOSUPPORT (Protocol not supported) +fchmod(4, 0100644) = 0 +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/946 b/results/classifier/mode-deepseek-r1:32b/output/system/946 new file mode 100644 index 00000000..55a9aeec --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/946 @@ -0,0 +1,14 @@ + + +qemu-img can't create qcow2 file on nfs path，which report error(Image is not in qcow2 format) +Description of problem: +I mount a nfs disk on my host,and use qemu-img to create a qcow2 file on this nfs path,but it not work,i have no idea,This problem has come up before in red-hat community: +[BUGID:1817640](https://bugzilla.redhat.com/show_bug.cgi?id=1817640#) +Steps to reproduce: + + +**strace file:** +[qemu-img-strace.log](/uploads/85517b7550ba1ea459f85cfd37b74332/qemu-img-strace.log) + +See form this strace file,in the line 1077,we can see pread64 read result is empty,it casuse the error,but i don't know why the resulut is empty. + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/948 b/results/classifier/mode-deepseek-r1:32b/output/system/948 new file mode 100644 index 00000000..63d7e907 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/948 @@ -0,0 +1,34 @@ + + +7.0.0-rc1, -rc2 cannot build - config-poison.h is not generated +Description of problem: +`make` halts with: + +``` +[557/2583] Generating module_block.h with a custom command +[558/2583] Generating block-gen.c with a custom command +[559/2583] Generating x86_64-softmmu-gdbstub-xml.c with a custom command (wrapped by meson to capture output) +[560/2583] Compiling C object libpage-vary-common.a.p/page-vary-common.c.o +[561/2583] Generating trace-target_sparc.c with a custom command +[562/2583] Generating trace-target_s390x_kvm.c with a custom command +ninja: job failed: clang -m64 -mcx16 -Ilibpage-vary-common.a.p -I. -I.. -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -flto -fcolor-diagnostics -Wall -Winvalid-pch -std=gnu11 -O2 -g -isystem /home/dummy/qemu-7.0.0-rc2/linux-headers -isystem linux-headers -iquote . -iquote /home/dummy/qemu-7.0.0-rc2 -iquote /home/dummy/qemu-7.0.0-rc2/include -iquote /home/dummy/qemu-7.0.0-rc2/disas/libvixl -iquote /home/dummy/qemu-7.0.0-rc2/tcg/i386 -pthread -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -fno-common -fwrapv -Wold-style-definition -Wtype-limits -Wformat-security -Wformat-y2k -Winit-self -Wignored-qualifiers -Wempty-body -Wnested-externs -Wendif-labels -Wexpansion-to-defined -Wno-initializer-overrides -Wno-missing-include-dirs -Wno-shift-negative-value -Wno-string-plus-int -Wno-typedef-redefinition -Wno-tautological-type-limit-compare -Wno-psabi -fstack-protector-strong -fsanitize=cfi-icall -fsanitize-cfi-icall-generalize-pointers -fPIE -fno-lto -fno-sanitize=cfi-icall -MD -MQ libpage-vary-common.a.p/page-vary-common.c.o -MF libpage-vary-common.a.p/page-vary-common.c.o.d -o libpage-vary-common.a.p/page-vary-common.c.o -c ../page-vary-common.c +In file included from ../page-vary-common.c:22: +In file included from /home/dummy/qemu-7.0.0-rc2/include/qemu/osdep.h:34: +/home/dummy/qemu-7.0.0-rc2/include/exec/poison.h:7:10: fatal error: 'config-poison.h' file not found +#include "config-poison.h" + ^~~~~~~~~~~~~~~~~ +1 error generated. +ninja: subcommand failed +make[1]: *** [Makefile:163: run-ninja] Error 1 +make[1]: Leaving directory '/home/dummy/qemu-7.0.0-rc2/build' +make: *** [GNUmakefile:11: all] Error 2 + +``` + +It seems that `config-poison.h` is not generated in `configure` and is not explicitly a dependency for some of necessary object file. +Steps to reproduce: +1. `docker pull alpine:3.15` +2. `docker build -t qemubad .` with the attached dockerfile +Additional information: +6.2.0 is good +7.0.0-rc0, 7.0.0-rc1, 7.0.0-rc2 exhibits the issue diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/949 b/results/classifier/mode-deepseek-r1:32b/output/system/949 new file mode 100644 index 00000000..d6f4f111 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/949 @@ -0,0 +1,316 @@ + + +M1 MacOS Panic with qemu version 6.2.0 +Description of problem: +After running the command above, the macbook freeze and reboots, here is the stacktrace: +``` +panic(cpu 2 caller 0xfffffe001748de90): vm_fault() KERN_FAILURE from guest fault on state 0xfffffe600c57c000 @sleh.c:3091 +Debugger message: panic +Memory ID: 0x1 +OS release type: User +OS version: 21D62 +Kernel version: Darwin Kernel Version 21.3.0: Wed Jan 5 21:37:58 PST 2022; root:xnu-8019.80.24~20/RELEASE_ARM64_T6000 +Fileset Kernelcache UUID: FA4EB485BA9DC1EBAA5D0E80232A48CC +Kernel UUID: BADF56F4-2876-3FF4-AC12-F25E78B09AA1 +iBoot version: iBoot-7429.81.3 +secure boot?: YES +Paniclog version: 13 +KernelCache slide: 0x000000000f9e8000 +KernelCache base: 0xfffffe00169ec000 +Kernel slide: 0x000000001021c000 +Kernel text base: 0xfffffe0017220000 +Kernel text exec slide: 0x0000000010304000 +Kernel text exec base: 0xfffffe0017308000 +mach_absolute_time: 0x2c74ea4beb +Epoch Time: sec usec + Boot : 0x62437319 0x0002a603 + Sleep : 0x62441e87 0x00018bb3 + Wake : 0x62442289 0x00044ebb + Calendar: 0x62442c00 0x000ccb26 + +Zone info: +Foreign : 0xfffffe001fb94000 - 0xfffffe001fba8000 +Native : 0xfffffe10001a8000 - 0xfffffe30001a8000 +Readonly : 0xfffffe14cce74000 - 0xfffffe1666808000 +Metadata : 0xfffffe62f056c000 - 0xfffffe62fc4f0000 +Bitmaps : 0xfffffe62fc4f0000 - 0xfffffe6302084000 +CORE 0 PVH locks held: None +CORE 1 PVH locks held: None +CORE 2 PVH locks held: None +CORE 3 PVH locks held: None +CORE 4 PVH locks held: None +CORE 5 PVH locks held: None +CORE 6 PVH locks held: None +CORE 7 PVH locks held: None +CORE 0: PC=0xfffffe001738ef4c, LR=0xfffffe001738ef4c, FP=0xfffffe60ba06bef0 +CORE 1: PC=0xfffffe001738ef4c, LR=0xfffffe001738ef4c, FP=0xfffffe60b7003ef0 +CORE 2 is the one that panicked. Check the full backtrace for details. +CORE 3: PC=0xfffffe001738ef50, LR=0xfffffe001738ef4c, FP=0xfffffe600c773ef0 +CORE 4: PC=0xfffffe001738ef50, LR=0xfffffe001738ef4c, FP=0xfffffe60a4dabef0 +CORE 5: PC=0xfffffe001738ef50, LR=0xfffffe001738ef4c, FP=0xfffffe600c683ef0 +CORE 6: PC=0xfffffe001738ef50, LR=0xfffffe001738ef4c, FP=0xfffffe60a5553ef0 +CORE 7: PC=0xfffffe001738ef4c, LR=0xfffffe001738ef4c, FP=0xfffffe60b7ae3ef0 +Panicked task 0xfffffe2997ce2d48: 24310 pages, 11 threads: pid 12708: qemu-system-aarc +Panicked thread: 0xfffffe1ffd861860, backtrace: 0xfffffe600c5c3300, tid: 97347 + lr: 0xfffffe001735a4e8 fp: 0xfffffe600c5c3370 + lr: 0xfffffe001735a1b8 fp: 0xfffffe600c5c33e0 + lr: 0xfffffe001749a2bc fp: 0xfffffe600c5c3400 + lr: 0xfffffe001748c6c8 fp: 0xfffffe600c5c3480 + lr: 0xfffffe001748a118 fp: 0xfffffe600c5c3540 + lr: 0xfffffe001730f7f8 fp: 0xfffffe600c5c3550 + lr: 0xfffffe0017359e2c fp: 0xfffffe600c5c38f0 + lr: 0xfffffe0017359e2c fp: 0xfffffe600c5c3960 + lr: 0xfffffe0017b6d738 fp: 0xfffffe600c5c3980 + lr: 0xfffffe001748de90 fp: 0xfffffe600c5c39e0 + lr: 0xfffffe001748da14 fp: 0xfffffe600c5c3a50 + lr: 0xfffffe001731a828 fp: 0xfffffe600c5c3a60 + lr: 0xfffffe00174a222c fp: 0xfffffe600c5c3e50 + lr: 0xfffffe001748a530 fp: 0xfffffe600c5c3f10 + lr: 0xfffffe001730f7f8 fp: 0xfffffe600c5c3f20 + +last started kext at 861542788: com.apple.driver.driverkit.serial 6.0.0 (addr 0xfffffe00170fced0, size 3432) +loaded kexts: +com.apple.fileutil 20.036.15 +com.apple.filesystems.autofs 3.0 +com.apple.driver.AppleBiometricServices 1 +com.apple.driver.CoreKDL 1 +com.apple.driver.AppleTopCaseHIDEventDriver 5020.1 +com.apple.driver.DiskImages.ReadWriteDiskImage 493.0.0 +com.apple.driver.DiskImages.UDIFDiskImage 493.0.0 +com.apple.driver.DiskImages.RAMBackingStore 493.0.0 +com.apple.driver.DiskImages.FileBackingStore 493.0.0 +com.apple.driver.SEPHibernation 1 +com.apple.driver.BCMWLANFirmware4387.Hashstore 1 +com.apple.filesystems.apfs 1933.80.3 +com.apple.driver.AppleUSBDeviceNCM 5.0.0 +com.apple.driver.AppleThunderboltIP 4.0.3 +com.apple.driver.AppleFileSystemDriver 3.0.1 +com.apple.nke.l2tp 1.9 +com.apple.filesystems.tmpfs 1 +com.apple.filesystems.lifs 1 +com.apple.IOTextEncryptionFamily 1.0.0 +com.apple.filesystems.hfs.kext 582.60.2 +com.apple.security.BootPolicy 1 +com.apple.BootCache 40 +com.apple.AppleFSCompression.AppleFSCompressionTypeZlib 1.0.0 +com.apple.AppleFSCompression.AppleFSCompressionTypeDataless 1.0.0d1 +com.apple.AppleEmbeddedSimpleSPINORFlasher 1 +com.apple.driver.ApplePMP 1 +com.apple.driver.AppleCS42L84Audio 530.2 +com.apple.driver.AppleSmartIO2 1 +com.apple.driver.AppleSN012776Amp 530.2 +com.apple.driver.AppleT6000SOCTuner 1 +com.apple.driver.AppleT6000CLPCv3 1 +com.apple.driver.AppleSmartBatteryManager 161.0.0 +com.apple.driver.AppleALSColorSensor 1.0.0d1 +com.apple.driver.AppleAOPVoiceTrigger 100.1 +com.apple.driver.ApplePMPFirmware 1 +com.apple.driver.AppleSPMIPMU 1.0.1 +com.apple.driver.AppleM68Buttons 1.0.0d1 +com.apple.driver.AppleSDXC 3.1.1 +com.apple.driver.AppleSamsungSerial 1.0.0d1 +com.apple.driver.AppleSerialShim 1 +com.apple.AGXG13X 188.10 +com.apple.driver.AppleAVD 555 +com.apple.driver.AppleAVE2 530.3.0 +com.apple.driver.AppleJPEGDriver 4.7.9 +com.apple.driver.AppleProResHW 128.2.0 +com.apple.driver.AppleMobileDispT600X-DCP 140.0 +com.apple.driver.usb.AppleSynopsysUSB40XHCI 1 +com.apple.driver.AppleMCDP29XXUpdateSupport 1 +com.apple.driver.AppleDPDisplayTCON 1 +com.apple.driver.AppleEventLogHandler 1 +com.apple.driver.AppleS5L8960XNCO 1 +com.apple.driver.AppleT6000PMGR 1 +com.apple.driver.AppleS8000AES 1 +com.apple.driver.AppleS8000DWI 1.0.0d1 +com.apple.driver.AppleInterruptControllerV2 1.0.0d1 +com.apple.driver.AppleT8110DART 1 +com.apple.driver.AppleBluetoothModule 1 +com.apple.driver.AppleBCMWLANBusInterfacePCIe 1 +com.apple.driver.AppleS5L8920XPWM 1.0.0d1 +com.apple.driver.AudioDMAController-T600x 100.51 +com.apple.driver.AppleT6000DART 1 +com.apple.driver.AppleSPIMC 1 +com.apple.driver.AppleS5L8940XI2C 1.0.0d2 +com.apple.driver.AppleT6000 1 +com.apple.iokit.IOUserEthernet 1.0.1 +com.apple.driver.usb.AppleUSBUserHCI 1 +com.apple.iokit.IOKitRegistryCompatibility 1 +com.apple.iokit.EndpointSecurity 1 +com.apple.driver.AppleDiskImages2 126.60.3 +com.apple.AppleSystemPolicy 2.0.0 +com.apple.nke.applicationfirewall 402 +com.apple.kec.InvalidateHmac 1 +com.apple.kec.AppleEncryptedArchive 1 +com.apple.driver.driverkit.serial 6.0.0 +com.apple.kext.triggers 1.0 +com.apple.iokit.IOAVBFamily 1010.2 +com.apple.plugin.IOgPTPPlugin 1000.11 +com.apple.iokit.IOEthernetAVBController 1.1.0 +com.apple.driver.AppleMesaSEPDriver 100.99 +com.apple.iokit.IOBiometricFamily 1 +com.apple.driver.AppleHIDKeyboard 228 +com.apple.driver.AppleActuatorDriver 5430.21 +com.apple.driver.AppleMultitouchDriver 5430.21 +com.apple.driver.AppleHSBluetoothDriver 5020.1 +com.apple.driver.IOBluetoothHIDDriver 9.0.0 +com.apple.driver.DiskImages.KernelBacked 493.0.0 +com.apple.driver.AppleSEPHDCPManager 1.0.1 +com.apple.driver.AppleTrustedAccessory 1 +com.apple.iokit.AppleSEPGenericTransfer 1 +com.apple.driver.AppleXsanScheme 3 +com.apple.driver.usb.networking 5.0.0 +com.apple.driver.AppleThunderboltUSBDownAdapter 1.0.4 +com.apple.driver.AppleThunderboltPCIDownAdapter 4.1.1 +com.apple.driver.AppleThunderboltDPInAdapter 8.5.1 +com.apple.driver.AppleThunderboltDPAdapterFamily 8.5.1 +com.apple.nke.ppp 1.9 +com.apple.driver.AppleBSDKextStarter 3 +com.apple.filesystems.hfs.encodings.kext 1 +com.apple.driver.AppleConvergedIPCOLYBTControl 1 +com.apple.driver.AppleConvergedPCI 1 +com.apple.driver.AppleBluetoothDebug 1 +com.apple.driver.AppleBTM 1.0.1 +com.apple.driver.AppleHIDTransportSPI 5400.30 +com.apple.driver.AppleHIDTransport 5400.30 +com.apple.driver.AppleInputDeviceSupport 5400.30 +com.apple.driver.AppleDCPDPTXProxy 1.0.0 +com.apple.driver.DCPDPFamilyProxy 1 +com.apple.driver.AppleDiagnosticDataAccessReadOnly 1.0.0 +com.apple.driver.AppleCSEmbeddedAudio 530.2 +com.apple.driver.ApplePassthroughPPM 3.0 +com.apple.driver.AppleAOPAudio 102.2 +com.apple.driver.AppleEmbeddedAudio 530.2 +com.apple.iokit.AppleARMIISAudio 100.1 +com.apple.driver.AppleSPU 1 +com.apple.AGXFirmwareKextG13XRTBuddy 188.10 +com.apple.AGXFirmwareKextRTBuddy64 188.10 +com.apple.driver.AppleStockholmControl 1.0.0 +com.apple.iokit.IONVMeFamily 2.1.0 +com.apple.driver.AppleNANDConfigAccess 1.0.0 +com.apple.driver.AppleDialogPMU 1.0.1 +com.apple.driver.usb.AppleUSBHostPacketFilter 1.0 +com.apple.iokit.IOGPUFamily 35.11 +com.apple.driver.DCPAVFamilyProxy 1 +com.apple.iokit.IOMobileGraphicsFamily-DCP 343.0.0 +com.apple.driver.AppleDCP 1 +com.apple.driver.AppleFirmwareKit 1 +com.apple.iokit.IOMobileGraphicsFamily 343.0.0 +com.apple.driver.AppleSPMI 1.0.1 +com.apple.driver.AppleUSBXDCIARM 1.0 +com.apple.driver.AppleUSBXDCI 1.0 +com.apple.iokit.IOUSBDeviceFamily 2.0.0 +com.apple.driver.usb.AppleSynopsysUSBXHCI 1 +com.apple.driver.usb.AppleUSBXHCI 1.2 +com.apple.driver.AppleEmbeddedUSBHost 1 +com.apple.driver.usb.AppleUSBHub 1.2 +com.apple.driver.usb.AppleUSBHostCompositeDevice 1.2 +com.apple.driver.AppleT6000TypeCPhy 1 +com.apple.driver.AppleT8103TypeCPhy 1 +com.apple.driver.AppleHPM 3.4.4 +com.apple.driver.AppleSART 1 +com.apple.driver.ApplePMGR 1 +com.apple.driver.AppleARMWatchdogTimer 1 +com.apple.driver.AppleDisplayCrossbar 1.0.0 +com.apple.iokit.IODisplayPortFamily 1.0.0 +com.apple.driver.AppleTypeCPhy 1 +com.apple.driver.AppleThunderboltNHI 7.2.8 +com.apple.driver.AppleT6000PCIeC 1 +com.apple.iokit.IOThunderboltFamily 9.3.3 +com.apple.driver.ApplePIODMA 1 +com.apple.driver.AppleT600xPCIe 1 +com.apple.driver.AppleMultiFunctionManager 1 +com.apple.driver.AppleBluetoothDebugService 1 +com.apple.driver.AppleBCMWLANCore 1.0.0 +com.apple.iokit.IO80211Family 1200.12.2b1 +com.apple.driver.IOImageLoader 1.0.0 +com.apple.driver.AppleOLYHAL 1 +com.apple.driver.corecapture 1.0.4 +com.apple.driver.AppleEmbeddedPCIE 1 +com.apple.driver.AppleMCA2-T600x 600.95 +com.apple.driver.AppleEmbeddedAudioLibs 100.9.1 +com.apple.driver.AppleFirmwareUpdateKext 1 +com.apple.driver.AppleH13CameraInterface 4.87.0 +com.apple.driver.AppleH10PearlCameraInterface 17.0.3 +com.apple.driver.AppleGPIOICController 1.0.2 +com.apple.driver.AppleFireStormErrorHandler 1 +com.apple.driver.AppleMobileApNonce 1 +com.apple.iokit.IOTimeSyncFamily 1000.11 +com.apple.driver.DiskImages 493.0.0 +com.apple.iokit.IOGraphicsFamily 593 +com.apple.iokit.IOBluetoothSerialManager 9.0.0 +com.apple.iokit.IOBluetoothHostControllerUSBTransport 9.0.0 +com.apple.iokit.IOBluetoothHostControllerUARTTransport 9.0.0 +com.apple.iokit.IOBluetoothHostControllerTransport 9.0.0 +com.apple.driver.IOBluetoothHostControllerPCIeTransport 9.0.0 +com.apple.iokit.IOBluetoothFamily 9.0.0 +com.apple.driver.FairPlayIOKit 68.13.1 +com.apple.iokit.CSRBluetoothHostControllerUSBTransport 9.0.0 +com.apple.iokit.BroadcomBluetoothHostControllerUSBTransport 9.0.0 +com.apple.driver.AppleSSE 1.0 +com.apple.driver.AppleSEPKeyStore 2 +com.apple.driver.AppleUSBTDM 532.40.7 +com.apple.iokit.IOUSBMassStorageDriver 209.40.6 +com.apple.iokit.IOPCIFamily 2.9 +com.apple.iokit.IOSCSIBlockCommandsDevice 452.60.2 +com.apple.iokit.IOSCSIArchitectureModelFamily 452.60.2 +com.apple.driver.AppleIPAppender 1.0 +com.apple.driver.AppleFDEKeyStore 28.30 +com.apple.driver.AppleEffaceableStorage 1.0 +com.apple.driver.AppleCredentialManager 1.0 +com.apple.driver.KernelRelayHost 1 +com.apple.iokit.IOUSBHostFamily 1.2 +com.apple.driver.AppleUSBHostMergeProperties 1.2 +com.apple.driver.usb.AppleUSBCommon 1.0 +com.apple.driver.AppleSMC 3.1.9 +com.apple.driver.RTBuddy 1.0.0 +com.apple.driver.AppleEmbeddedTempSensor 1.0.0 +com.apple.driver.AppleARMPMU 1.0 +com.apple.iokit.IOAccessoryManager 1.0.0 +com.apple.driver.AppleOnboardSerial 1.0 +com.apple.iokit.IOSkywalkFamily 1.0 +com.apple.driver.mDNSOffloadUserClient 1.0.1b8 +com.apple.iokit.IONetworkingFamily 3.4 +com.apple.iokit.IOSerialFamily 11 +com.apple.driver.AppleSEPManager 1.0.1 +com.apple.driver.AppleA7IOP 1.0.2 +com.apple.driver.IOSlaveProcessor 1 +com.apple.driver.AppleBiometricSensor 2 +com.apple.iokit.IOHIDFamily 2.0.0 +com.apple.iokit.CoreAnalyticsFamily 1 +com.apple.driver.AppleANELoadBalancer 5.35.2 +com.apple.driver.AppleH11ANEInterface 5.35.0 +com.apple.AUC 1.0 +com.apple.iokit.IOAVFamily 1.0.0 +com.apple.iokit.IOHDCPFamily 1.0.0 +com.apple.iokit.IOCECFamily 1 +com.apple.iokit.IOAudio2Family 1.0 +com.apple.driver.AppleIISController 100.1 +com.apple.driver.AppleAudioClockLibs 100.9.1 +com.apple.driver.AppleM2ScalerCSCDriver 265.0.0 +com.apple.iokit.IOSurface 302.11.1 +com.apple.driver.IODARTFamily 1 +com.apple.security.quarantine 4 +com.apple.security.sandbox 300.0 +com.apple.kext.AppleMatch 1.0.0d1 +com.apple.driver.AppleMobileFileIntegrity 1.0.5 +com.apple.security.AppleImage4 4.2.0 +com.apple.kext.CoreTrust 1 +com.apple.iokit.IOCryptoAcceleratorFamily 1.0.1 +com.apple.driver.AppleARMPlatform 1.0.2 +com.apple.iokit.IOStorageFamily 2.1 +com.apple.iokit.IOSlowAdaptiveClockingFamily 1.0.0 +com.apple.iokit.IOReportFamily 47 +com.apple.kec.pthread 1 +com.apple.kec.Libm 1 +com.apple.kec.corecrypto 12.0 + + + +** Stackshot Succeeded ** Bytes Traced 456730 (Uncompressed 1205472) ** +``` +Steps to reproduce: +1. run the qemu command above +Additional information: + diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/953 b/results/classifier/mode-deepseek-r1:32b/output/system/953 new file mode 100644 index 00000000..9ed23535 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/953 @@ -0,0 +1,3 @@ + + +qemu-system-aarch64 asserts trying to execute STXP on hosts without HAVE_CMPXCHG128 diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/954 b/results/classifier/mode-deepseek-r1:32b/output/system/954 new file mode 100644 index 00000000..587b3e89 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/954 @@ -0,0 +1,1259 @@ + + +qemu 6.2.0 with SEV in x86_64 initrd unpack ? +Description of problem: +The guest kernel panic from qemu 6.2.0, works fine on 6.0.0 and 6.1.0, works fine without SEV on 6.2.0 too. + +From our research it seems that initrd is not unpacked and initialized in an SEV context on 6.2.0 as we can see in logs without SEV that the initrd is well unpacked. Please have a look on additional informations for all the logs. + +We can see this crash during guest initialization: +``` +[ 0.252891] VFS: Cannot open root device \(null)\ or unknown-block(0,0): error -6 +[ 0.253054] Please append a correct \root=\ boot option; here are the available partitions: +[ 0.253179] 0100 4096 ram0 +[ 0.253181] (driver?) +[ 0.253285] 0101 4096 ram1 +[ 0.253286] (driver?) +[ 0.253389] 0102 4096 ram2 +[ 0.253390] (driver?) +[ 0.253490] 0103 4096 ram3 +[ 0.253491] (driver?) +[ 0.253595] 0104 4096 ram4 +[ 0.253596] (driver?) +[ 0.253708] 0105 4096 ram5 +[ 0.253709] (driver?) +[ 0.253816] 0106 4096 ram6 +[ 0.253817] (driver?) +[ 0.253965] 0107 4096 ram7 +[ 0.253967] (driver?) +[ 0.254065] 0108 4096 ram8 +[ 0.254066] (driver?) +[ 0.254170] 0109 4096 ram9 +[ 0.254171] (driver?) +[ 0.254274] 010a 4096 ram10 +[ 0.254276] (driver?) +[ 0.254392] 010b 4096 ram11 +[ 0.254393] (driver?) +[ 0.254514] 010c 4096 ram12 +[ 0.254516] (driver?) +[ 0.254639] 010d 4096 ram13 +[ 0.254640] (driver?) +[ 0.254755] 010e 4096 ram14 +[ 0.254756] (driver?) +[ 0.254871] 010f 4096 ram15 +[ 0.254872] (driver?) +[ 0.254996] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0) +[ 0.255115] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.15.31 #1 +[ 0.255215] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 +[ 0.255339] Call Trace: +[ 0.255387] <TASK> +[ 0.255430] dump_stack_lvl+0x34/0x44 +[ 0.255499] panic+0xe8/0x27a +[ 0.255563] mount_block_root+0x16b/0x1fe +[ 0.255631] ? rest_init+0xc0/0xc0 +[ 0.255692] prepare_namespace+0x131/0x160 +[ 0.255757] ? rest_init+0xc0/0xc0 +[ 0.255823] kernel_init+0x11/0x100 +[ 0.255889] ret_from_fork+0x22/0x30 +[ 0.255969] </TASK> +[ 0.256061] Kernel Offset: disabled +[ 0.256130] Rebooting in 1 seconds.. +``` +Steps to reproduce: +1. build kernel with right config (build_kernel from kata-containers) with sev support (-x sev) & get kata-containers initrd +2. Launch the command on a AMD SEV compatible device + +This is a complex problem I guess I can provide more informations if needed. +Additional information: +We didn't see any logs from QEMU when running this command line even when putting -D file... + +Complete output from QEMU 6.2.0 with SEV : +``` +[ 0.000000] Linux version 5.10.25 (gitlab-runner@runner-buildah0) (gcc (Debian 11.2.0-12) 11.2.0, GNU ld (GNU Binutils for Debian) 2.37) #1 SMP Tue Dec 7 11:43:22 CET 2021 +[ 0.000000] Command line: tsc=reliable no_timer_check rcupdate.rcu_expedited=1 i8042.direct=1 i8042.dumbkbd=1 i8042.nopnp=1 i8042.noaux=1 noreplace-smp reboot=k console=hvc0 console=hvc1 console=ttyS0 cryptomgr.notests net.ifnames=0 pci=lastbus=0 debug panic=1 nr_cpus=32 scsi_mod.scan=none agent.log=debug +[ 0.000000] x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers' +[ 0.000000] x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers' +[ 0.000000] x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers' +[ 0.000000] x86/fpu: xstate_offset[2]: 576, xstate_sizes[2]: 256 +[ 0.000000] x86/fpu: Enabled xstate features 0x7, context size is 832 bytes, using 'compacted' format. +[ 0.000000] BIOS-provided physical RAM map: +[ 0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009ffff] usable +[ 0.000000] BIOS-e820: [mem 0x0000000000100000-0x00000000007fffff] usable +[ 0.000000] BIOS-e820: [mem 0x0000000000800000-0x0000000000807fff] ACPI NVS +[ 0.000000] BIOS-e820: [mem 0x0000000000808000-0x000000000080ffff] usable +[ 0.000000] BIOS-e820: [mem 0x0000000000810000-0x00000000008fffff] ACPI NVS +[ 0.000000] BIOS-e820: [mem 0x0000000000900000-0x000000007f6eefff] usable +[ 0.000000] BIOS-e820: [mem 0x000000007f6ef000-0x000000007f96efff] reserved +[ 0.000000] BIOS-e820: [mem 0x000000007f96f000-0x000000007f97efff] ACPI data +[ 0.000000] BIOS-e820: [mem 0x000000007f97f000-0x000000007f9fefff] ACPI NVS +[ 0.000000] BIOS-e820: [mem 0x000000007f9ff000-0x000000007fe5ffff] usable +[ 0.000000] BIOS-e820: [mem 0x000000007fe60000-0x000000007fe7ffff] reserved +[ 0.000000] BIOS-e820: [mem 0x000000007fe80000-0x000000007fffffff] ACPI NVS +[ 0.000000] BIOS-e820: [mem 0x00000000b0000000-0x00000000bfffffff] reserved +[ 0.000000] NX (Execute Disable) protection: active +[ 0.000000] efi: EFI v2.70 by EDK II +[ 0.000000] efi: SMBIOS=0x7f7ab000 ACPI=0x7f97e000 ACPI 2.0=0x7f97e014 MEMATTR=0x7e9d8118 +[ 0.000000] SMBIOS 2.8 present. +[ 0.000000] DMI: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 +[ 0.000000] Hypervisor detected: KVM +[ 0.000000] kvm-clock: Using msrs 4b564d01 and 4b564d00 +[ 0.000000] kvm-clock: cpu 0, msr 3d401001, primary cpu clock +[ 0.000000] kvm-clock: using sched offset of 4061892066 cycles +[ 0.000003] clocksource: kvm-clock: mask: 0xffffffffffffffff max_cycles: 0x1cd42e4dffb, max_idle_ns: 881590591483 ns +[ 0.000006] tsc: Detected 2994.372 MHz processor +[ 0.000159] e820: update [mem 0x00000000-0x00000fff] usable ==> reserved +[ 0.000162] e820: remove [mem 0x000a0000-0x000fffff] usable +[ 0.000169] last_pfn = 0x7fe60 max_arch_pfn = 0x400000000 +[ 0.000215] MTRR default type: write-back +[ 0.000216] MTRR fixed ranges enabled: +[ 0.000218] 00000-9FFFF write-back +[ 0.000219] A0000-FFFFF uncachable +[ 0.000220] MTRR variable ranges enabled: +[ 0.000222] 0 base 0000C0000000 mask FFFFC0000000 uncachable +[ 0.000224] 1 base 0000B0000000 mask FFFFF0000000 uncachable +[ 0.000225] 2 base 001000000000 mask FFF800000000 uncachable +[ 0.000226] 3 disabled +[ 0.000227] 4 disabled +[ 0.000228] 5 disabled +[ 0.000229] 6 disabled +[ 0.000229] 7 disabled +[ 0.000277] x86/PAT: Configuration [0-7]: WB WC UC- UC WB WP UC- WT +[ 0.008747] Using GB pages for direct mapping +[ 0.009448] Secure boot could not be determined +[ 0.009466] ACPI: Early table checksum verification disabled +[ 0.009476] ACPI: RSDP 0x000000007F97E014 000024 (v02 BOCHS ) +[ 0.009482] ACPI: XSDT 0x000000007F97D0E8 000054 (v01 BOCHS BXPC 00000001 01000013) +[ 0.009490] ACPI: FACP 0x000000007F978000 0000F4 (v03 BOCHS BXPC 00000001 BXPC 00000001) +[ 0.009497] ACPI: DSDT 0x000000007F979000 003EAE (v01 BOCHS BXPC 00000001 BXPC 00000001) +[ 0.009502] ACPI: FACS 0x000000007F9DD000 000040 +[ 0.009506] ACPI: APIC 0x000000007F977000 000170 (v01 BOCHS BXPC 00000001 BXPC 00000001) +[ 0.009510] ACPI: HPET 0x000000007F976000 000038 (v01 BOCHS BXPC 00000001 BXPC 00000001) +[ 0.009515] ACPI: SRAT 0x000000007F975000 0002D0 (v01 BOCHS BXPC 00000001 BXPC 00000001) +[ 0.009519] ACPI: MCFG 0x000000007F974000 00003C (v01 BOCHS BXPC 00000001 BXPC 00000001) +[ 0.009523] ACPI: WAET 0x000000007F973000 000028 (v01 BOCHS BXPC 00000001 BXPC 00000001) +[ 0.009532] ACPI: Local APIC address 0xfee00000 +[ 0.009575] Zone ranges: +[ 0.009576] DMA [mem 0x0000000000001000-0x0000000000ffffff] +[ 0.009578] DMA32 [mem 0x0000000001000000-0x000000007fe5ffff] +[ 0.009580] Normal empty +[ 0.009581] Device empty +[ 0.009582] Movable zone start for each node +[ 0.009583] Early memory node ranges +[ 0.009585] node 0: [mem 0x0000000000001000-0x000000000009ffff] +[ 0.009587] node 0: [mem 0x0000000000100000-0x00000000007fffff] +[ 0.009588] node 0: [mem 0x0000000000808000-0x000000000080ffff] +[ 0.009589] node 0: [mem 0x0000000000900000-0x000000007f6eefff] +[ 0.009590] node 0: [mem 0x000000007f9ff000-0x000000007fe5ffff] +[ 0.009592] Initmem setup node 0 [mem 0x0000000000001000-0x000000007fe5ffff] +[ 0.009595] On node 0 totalpages: 522743 +[ 0.009596] DMA zone: 59 pages used for memmap +[ 0.009597] DMA zone: 1814 pages reserved +[ 0.009599] DMA zone: 3751 pages, LIFO batch:0 +[ 0.009931] DMA zone: 29017 pages in unavailable ranges +[ 0.009933] DMA32 zone: 8122 pages used for memmap +[ 0.009934] DMA32 zone: 518992 pages, LIFO batch:63 +[ 0.014254] DMA32 zone: 1200 pages in unavailable ranges +[ 0.014984] ACPI: PM-Timer IO Port: 0x608 +[ 0.014988] ACPI: Local APIC address 0xfee00000 +[ 0.015002] ACPI: LAPIC_NMI (acpi_id[0xff] dfl dfl lint[0x1]) +[ 0.015201] IOAPIC[0]: apic_id 0, version 32, address 0xfec00000, GSI 0-23 +[ 0.015205] ACPI: INT_SRC_OVR (bus 0 bus_irq 0 global_irq 2 dfl dfl) +[ 0.015207] ACPI: INT_SRC_OVR (bus 0 bus_irq 5 global_irq 5 high level) +[ 0.015209] ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 9 high level) +[ 0.015210] ACPI: INT_SRC_OVR (bus 0 bus_irq 10 global_irq 10 high level) +[ 0.015212] ACPI: INT_SRC_OVR (bus 0 bus_irq 11 global_irq 11 high level) +[ 0.015213] ACPI: IRQ0 used by override. +[ 0.015214] ACPI: IRQ5 used by override. +[ 0.015216] ACPI: IRQ9 used by override. +[ 0.015217] ACPI: IRQ10 used by override. +[ 0.015217] ACPI: IRQ11 used by override. +[ 0.015220] Using ACPI (MADT) for SMP configuration information +[ 0.015223] ACPI: HPET id: 0x8086a201 base: 0xfed00000 +[ 0.015228] TSC deadline timer available +[ 0.015233] smpboot: Allowing 32 CPUs, 31 hotplug CPUs +[ 0.015245] kvm-guest: KVM setup pv remote TLB flush +[ 0.015254] kvm-guest: setup PV sched yield +[ 0.015272] [mem 0xc0000000-0xffffffff] available for PCI devices +[ 0.015274] Booting paravirtualized kernel on KVM +[ 0.015278] clocksource: refined-jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645519600211568 ns +[ 0.020479] setup_percpu: NR_CPUS:240 nr_cpumask_bits:240 nr_cpu_ids:32 nr_node_ids:1 +[ 0.021723] percpu: Embedded 42 pages/cpu s143360 r0 d28672 u262144 +[ 0.021732] pcpu-alloc: s143360 r0 d28672 u262144 alloc=1*2097152 +[ 0.021734] pcpu-alloc: [0] 00 01 02 03 04 05 06 07 [0] 08 09 10 11 12 13 14 15 +[ 0.021744] pcpu-alloc: [0] 16 17 18 19 20 21 22 23 [0] 24 25 26 27 28 29 30 31 +[ 0.027310] kvm-guest: KVM setup async PF for cpu 0 +[ 0.027318] kvm-guest: stealtime: cpu 0, msr 7d622080 +[ 0.027332] Built 1 zonelists, mobility grouping on. Total pages: 512748 +[ 0.027335] Kernel command line: tsc=reliable no_timer_check rcupdate.rcu_expedited=1 i8042.direct=1 i8042.dumbkbd=1 i8042.nopnp=1 i8042.noaux=1 noreplace-smp reboot=k console=hvc0 console=hvc1 console=ttyS0 cryptomgr.notests net.ifnames=0 pci=lastbus=0 debug panic=1 nr_cpus=32 scsi_mod.scan=none agent.log=debug +[ 0.027480] printk: log_buf_len individual max cpu contribution: 4096 bytes +[ 0.027481] printk: log_buf_len total cpu_extra contributions: 126976 bytes +[ 0.027483] printk: log_buf_len min size: 131072 bytes +[ 0.027731] printk: log_buf_len: 262144 bytes +[ 0.027733] printk: early log buf free: 123344(94%) +[ 0.027942] Dentry cache hash table entries: 262144 (order: 9, 2097152 bytes, linear) +[ 0.028047] Inode-cache hash table entries: 131072 (order: 8, 1048576 bytes, linear) +[ 0.028190] mem auto-init: stack:off, heap alloc:off, heap free:off +[ 0.041061] Memory: 1815804K/2090972K available (10242K kernel code, 956K rwdata, 1456K rodata, 892K init, 3564K bss, 274912K reserved, 0K cma-reserved) +[ 0.041173] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=32, Nodes=1 +[ 0.041309] rcu: Hierarchical RCU implementation. +[ 0.041311] rcu: RCU restricting CPUs from NR_CPUS=240 to nr_cpu_ids=32. +[ 0.041312] All grace periods are expedited (rcu_expedited). +[ 0.041313] Tracing variant of Tasks RCU enabled. +[ 0.041315] rcu: RCU calculated value of scheduler-enlistment delay is 25 jiffies. +[ 0.041316] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=32 +[ 0.041372] NR_IRQS: 15616, nr_irqs: 680, preallocated irqs: 16 +[ 0.041910] rcu: Offload RCU callbacks from CPUs: (none). +[ 0.042080] random: get_random_bytes called from start_kernel+0x2fc/0x4ae with crng_init=0 +[ 0.042159] Console: colour dummy device 80x25 +[ 0.162231] printk: console [ttyS0] enabled +[ 0.175286] AMD Memory Encryption Features active: SEV +[ 0.176044] ACPI: Core revision 20200925 +[ 0.176768] clocksource: hpet: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604467 ns +[ 0.178070] APIC: Switch to symmetric I/O mode setup +[ 0.180011] x2apic enabled +[ 0.182376] Switched APIC routing to physical x2apic. +[ 0.183044] kvm-guest: setup PV IPIs +[ 0.189694] ..TIMER: vector=0x30 apic1=0 pin1=2 apic2=-1 pin2=-1 +[ 0.190655] clocksource: tsc-early: mask: 0xffffffffffffffff max_cycles: 0x2b29812ce43, max_idle_ns: 440795323173 ns +[ 0.191992] Calibrating delay loop (skipped) preset value.. 5988.74 BogoMIPS (lpj=11977488) +[ 0.193096] pid_max: default: 32768 minimum: 301 +[ 0.224045] LSM: Security Framework initializing +[ 0.225340] Mount-cache hash table entries: 4096 (order: 3, 32768 bytes, linear) +[ 0.226368] Mountpoint-cache hash table entries: 4096 (order: 3, 32768 bytes, linear) +[ 0.227912] x86/cpu: User Mode Instruction Prevention (UMIP) activated +[ 0.228021] Last level iTLB entries: 4KB 512, 2MB 255, 4MB 127 +[ 0.228758] Last level dTLB entries: 4KB 512, 2MB 255, 4MB 127, 1GB 0 +[ 0.229578] Spectre V1 : Mitigation: usercopy/swapgs barriers and __user pointer sanitization +[ 0.230655] Spectre V2 : Mitigation: Full AMD retpoline +[ 0.231993] Spectre V2 : Spectre v2 / SpectreRSB mitigation: Filling RSB on context switch +[ 0.233038] Spectre V2 : Enabling Restricted Speculation for firmware calls +[ 0.234868] Spectre V2 : mitigation: Enabling conditional Indirect Branch Prediction Barrier +[ 0.235997] Speculative Store Bypass: Mitigation: Speculative Store Bypass disabled via prctl and seccomp +[ 0.237657] Freeing SMP alternatives memory: 28K +[ 0.238528] smpboot: CPU0: AMD EPYC 7302P 16-Core Processor (family: 0x17, model: 0x31, stepping: 0x0) +[ 0.239991] Performance Events: Fam17h+ core perfctr, AMD PMU driver. +[ 0.239991] ... version: 0 +[ 0.239991] ... bit width: 48 +[ 0.239991] ... generic registers: 6 +[ 0.239997] ... value mask: 0000ffffffffffff +[ 0.240552] ... max period: 00007fffffffffff +[ 0.241107] ... fixed-purpose events: 0 +[ 0.241610] ... event mask: 000000000000003f +[ 0.242405] rcu: Hierarchical SRCU implementation. +[ 0.243319] smp: Bringing up secondary CPUs ... +[ 0.243787] smp: Brought up 1 node, 1 CPU +[ 0.244000] smpboot: Max logical packages: 32 +[ 0.244475] smpboot: Total of 1 processors activated (5988.74 BogoMIPS) +[ 0.245487] devtmpfs: initialized +[ 0.245852] x86/mm: Memory block size: 128MB +[ 0.246502] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns +[ 0.247472] futex hash table entries: 8192 (order: 7, 524288 bytes, linear) +[ 0.248308] NET: Registered protocol family 16 +[ 0.249031] DMA: preallocated 256 KiB GFP_KERNEL pool for atomic allocations +[ 0.250111] DMA: preallocated 256 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations +[ 0.251331] DMA: preallocated 256 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations +[ 0.252043] thermal_sys: Registered thermal governor 'step_wise' +[ 0.252048] cpuidle: using governor menu +[ 0.253569] ACPI: bus type PCI registered +[ 0.253974] acpiphp: ACPI Hot Plug PCI Controller Driver version: 0.5 +[ 0.254656] PCI: MMCONFIG for domain 0000 [bus 00-ff] at [mem 0xb0000000-0xbfffffff] (base 0xb0000000) +[ 0.255546] PCI: MMCONFIG at [mem 0xb0000000-0xbfffffff] reserved in E820 +[ 0.256020] PCI: Using configuration type 1 for base access +[ 0.257219] HugeTLB registered 1.00 GiB page size, pre-allocated 0 pages +[ 0.257889] HugeTLB registered 2.00 MiB page size, pre-allocated 0 pages +[ 0.258633] ACPI: Added _OSI(Module Device) +[ 0.259073] ACPI: Added _OSI(Processor Device) +[ 0.259531] ACPI: Added _OSI(3.0 _SCP Extensions) +[ 0.259999] ACPI: Added _OSI(Processor Aggregator Device) +[ 0.260534] ACPI: Added _OSI(Linux-Dell-Video) +[ 0.260979] ACPI: Added _OSI(Linux-Lenovo-NV-HDMI-Audio) +[ 0.261508] ACPI: Added _OSI(Linux-HPI-Hybrid-Graphics) +[ 0.263748] ACPI: 1 ACPI AML tables successfully acquired and loaded +[ 0.264963] ACPI: Interpreter enabled +[ 0.265375] ACPI: (supports S0 S5) +[ 0.265743] ACPI: Using IOAPIC for interrupt routing +[ 0.266290] PCI: Using host bridge windows from ACPI; if necessary, use "pci=nocrs" and report a bug +[ 0.267390] ACPI: Enabled 3 GPEs in block 00 to 3F +[ 0.272364] ACPI: PCI Root Bridge [PCI0] (domain 0000 [bus 00-ff]) +[ 0.273025] acpi PNP0A08:00: _OSC: OS supports [ExtendedConfig ASPM ClockPM Segments MSI HPX-Type3] +[ 0.274136] acpi PNP0A08:00: _OSC: platform does not support [PCIeHotplug LTR] +[ 0.275108] acpi PNP0A08:00: _OSC: OS now controls [SHPCHotplug PME PCIeCapability] +[ 0.276009] PCI host bridge to bus 0000:00 +[ 0.276413] pci_bus 0000:00: root bus resource [io 0x0000-0x0cf7 window] +[ 0.277047] pci_bus 0000:00: root bus resource [io 0x0d00-0xffff window] +[ 0.277707] pci_bus 0000:00: root bus resource [mem 0x000a0000-0x000bffff window] +[ 0.278440] pci_bus 0000:00: root bus resource [mem 0x80000000-0xafffffff window] +[ 0.279154] pci_bus 0000:00: root bus resource [mem 0xc0000000-0xfebfffff window] +[ 0.279885] pci_bus 0000:00: root bus resource [mem 0x1000000000-0x17ffffffff window] +[ 0.279995] pci_bus 0000:00: root bus resource [bus 00-ff] +[ 0.280579] pci 0000:00:00.0: [8086:29c0] type 00 class 0x060000 +[ 0.281678] pci 0000:00:01.0: [1af4:1043] type 00 class 0x078000 +[ 0.283998] pci 0000:00:01.0: reg 0x14: [mem 0xc0003000-0xc0003fff] +[ 0.287128] pci 0000:00:01.0: reg 0x20: [mem 0x1000000000-0x1000003fff 64bit pref] +[ 0.288918] pci 0000:00:02.0: [1b36:0001] type 01 class 0x060400 +[ 0.294626] pci 0000:00:03.0: [1af4:1048] type 00 class 0x010000 +[ 0.296349] pci 0000:00:03.0: reg 0x14: [mem 0xc0002000-0xc0002fff] +[ 0.299044] pci 0000:00:03.0: reg 0x20: [mem 0x1000004000-0x1000007fff 64bit pref] +[ 0.300892] pci 0000:00:04.0: [1af4:1044] type 00 class 0x00ff00 +[ 0.303526] pci 0000:00:04.0: reg 0x20: [mem 0x1000008000-0x100000bfff 64bit pref] +[ 0.304902] pci 0000:00:05.0: [1af4:1049] type 00 class 0x000200 +[ 0.306875] pci 0000:00:05.0: reg 0x14: [mem 0xc0001000-0xc0001fff] +[ 0.309436] pci 0000:00:05.0: reg 0x20: [mem 0x100000c000-0x100000ffff 64bit pref] +[ 0.311525] pci 0000:00:1f.0: [8086:2918] type 00 class 0x060100 +[ 0.312373] pci 0000:00:1f.0: quirk: [io 0x0600-0x067f] claimed by ICH6 ACPI/GPIO/TCO +[ 0.314653] pci 0000:00:1f.2: [8086:2922] type 00 class 0x010601 +[ 0.318160] pci 0000:00:1f.2: reg 0x20: [io 0x6040-0x605f] +[ 0.319336] pci 0000:00:1f.2: reg 0x24: [mem 0xc0000000-0xc0000fff] +[ 0.320607] pci 0000:00:1f.3: [8086:2930] type 00 class 0x0c0500 +[ 0.323429] pci 0000:00:1f.3: reg 0x20: [io 0x6000-0x603f] +[ 0.325167] pci_bus 0000:01: extended config space not accessible +[ 0.325943] acpiphp: Slot [0] registered +[ 0.326344] acpiphp: Slot [1] registered +[ 0.326753] acpiphp: Slot [2] registered +[ 0.327153] acpiphp: Slot [3] registered +[ 0.327557] acpiphp: Slot [4] registered +[ 0.327962] acpiphp: Slot [5] registered +[ 0.328009] acpiphp: Slot [6] registered +[ 0.328416] acpiphp: Slot [7] registered +[ 0.328817] acpiphp: Slot [8] registered +[ 0.329218] acpiphp: Slot [9] registered +[ 0.329625] acpiphp: Slot [10] registered +[ 0.330033] acpiphp: Slot [11] registered +[ 0.330448] acpiphp: Slot [12] registered +[ 0.330854] acpiphp: Slot [13] registered +[ 0.331261] acpiphp: Slot [14] registered +[ 0.331675] acpiphp: Slot [15] registered +[ 0.332008] acpiphp: Slot [16] registered +[ 0.332419] acpiphp: Slot [17] registered +[ 0.332827] acpiphp: Slot [18] registered +[ 0.333234] acpiphp: Slot [19] registered +[ 0.333647] acpiphp: Slot [20] registered +[ 0.334055] acpiphp: Slot [21] registered +[ 0.334468] acpiphp: Slot [22] registered +[ 0.334886] acpiphp: Slot [23] registered +[ 0.335298] acpiphp: Slot [24] registered +[ 0.335702] acpiphp: Slot [25] registered +[ 0.336008] acpiphp: Slot [26] registered +[ 0.336420] acpiphp: Slot [27] registered +[ 0.336824] acpiphp: Slot [28] registered +[ 0.337232] acpiphp: Slot [29] registered +[ 0.337636] acpiphp: Slot [30] registered +[ 0.338041] acpiphp: Slot [31] registered +[ 0.338650] pci 0000:00:02.0: PCI bridge to [bus 01] +[ 0.339776] pci_bus 0000:00: on NUMA node 0 +[ 0.340242] ACPI: PCI Interrupt Link [LNKA] (IRQs 5 *10 11) +[ 0.340849] ACPI: PCI Interrupt Link [LNKB] (IRQs 5 *10 11) +[ 0.341462] ACPI: PCI Interrupt Link [LNKC] (IRQs 5 10 *11) +[ 0.342076] ACPI: PCI Interrupt Link [LNKD] (IRQs 5 10 *11) +[ 0.342685] ACPI: PCI Interrupt Link [LNKE] (IRQs 5 *10 11) +[ 0.343300] ACPI: PCI Interrupt Link [LNKF] (IRQs 5 *10 11) +[ 0.343918] ACPI: PCI Interrupt Link [LNKG] (IRQs 5 10 *11) +[ 0.344059] ACPI: PCI Interrupt Link [LNKH] (IRQs 5 10 *11) +[ 0.344636] ACPI: PCI Interrupt Link [GSIA] (IRQs *16) +[ 0.345142] ACPI: PCI Interrupt Link [GSIB] (IRQs *17) +[ 0.345660] ACPI: PCI Interrupt Link [GSIC] (IRQs *18) +[ 0.346245] ACPI: PCI Interrupt Link [GSID] (IRQs *19) +[ 0.346799] ACPI: PCI Interrupt Link [GSIE] (IRQs *20) +[ 0.347365] ACPI: PCI Interrupt Link [GSIF] (IRQs *21) +[ 0.347889] ACPI: PCI Interrupt Link [GSIG] (IRQs *22) +[ 0.348004] ACPI: PCI Interrupt Link [GSIH] (IRQs *23) +[ 0.349647] iommu: Default domain type: Translated +[ 0.350207] vgaarb: loaded +[ 0.350578] SCSI subsystem initialized +[ 0.350959] pps_core: LinuxPPS API ver. 1 registered +[ 0.351500] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it> +[ 0.352007] PTP clock support registered +[ 0.352415] Registered efivars operations +[ 0.352914] PCI: Using ACPI for IRQ routing +[ 0.353321] PCI: pci_cache_line_size set to 64 bytes +[ 0.353916] e820: reserve RAM buffer [mem 0x00810000-0x008fffff] +[ 0.354487] e820: reserve RAM buffer [mem 0x7f6ef000-0x7fffffff] +[ 0.355053] e820: reserve RAM buffer [mem 0x7fe60000-0x7fffffff] +[ 0.355719] clocksource: Switched to clocksource kvm-clock +[ 0.355991] pnp: PnP ACPI init +[ 0.355991] pnp 00:00: Plug and Play ACPI device, IDs PNP0303 (active) +[ 0.355991] pnp 00:01: Plug and Play ACPI device, IDs PNP0f13 (active) +[ 0.355991] pnp 00:02: Plug and Play ACPI device, IDs PNP0501 (active) +[ 0.355991] pnp 00:03: Plug and Play ACPI device, IDs PNP0b00 (active) +[ 0.355991] system 00:04: [mem 0xb0000000-0xbfffffff window] has been reserved +[ 0.356347] system 00:04: Plug and Play ACPI device, IDs PNP0c01 (active) +[ 0.357410] pnp: PnP ACPI: found 5 devices +[ 0.362961] clocksource: acpi_pm: mask: 0xffffff max_cycles: 0xffffff, max_idle_ns: 2085701024 ns +[ 0.363871] NET: Registered protocol family 2 +[ 0.364474] tcp_listen_portaddr_hash hash table entries: 1024 (order: 2, 16384 bytes, linear) +[ 0.365307] TCP established hash table entries: 16384 (order: 5, 131072 bytes, linear) +[ 0.366095] TCP bind hash table entries: 16384 (order: 6, 262144 bytes, linear) +[ 0.366893] TCP: Hash tables configured (established 16384 bind 16384) +[ 0.367563] UDP hash table entries: 1024 (order: 3, 32768 bytes, linear) +[ 0.368255] UDP-Lite hash table entries: 1024 (order: 3, 32768 bytes, linear) +[ 0.369036] NET: Registered protocol family 1 +[ 0.369533] pci 0000:00:02.0: PCI bridge to [bus 01] +[ 0.371860] pci_bus 0000:00: resource 4 [io 0x0000-0x0cf7 window] +[ 0.372477] pci_bus 0000:00: resource 5 [io 0x0d00-0xffff window] +[ 0.373092] pci_bus 0000:00: resource 6 [mem 0x000a0000-0x000bffff window] +[ 0.373765] pci_bus 0000:00: resource 7 [mem 0x80000000-0xafffffff window] +[ 0.374428] pci_bus 0000:00: resource 8 [mem 0xc0000000-0xfebfffff window] +[ 0.375109] pci_bus 0000:00: resource 9 [mem 0x1000000000-0x17ffffffff window] +[ 0.375904] PCI: CLS 0 bytes, default 64 +[ 0.376370] PCI-DMA: Using software bounce buffering for IO (SWIOTLB) +[ 0.377008] software IO TLB: mapped [mem 0x000000006f600000-0x0000000073600000] (64MB) +[ 0.377807] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x2b29812ce43, max_idle_ns: 440795323173 ns +[ 0.379980] workingset: timestamp_bits=46 max_order=19 bucket_order=0 +[ 0.381847] fuse: init (API version 7.32) +[ 0.382462] SGI XFS with security attributes, no debug enabled +[ 0.383337] 9p: Installing v9fs 9p2000 file system support +[ 0.383950] NET: Registered protocol family 38 +[ 0.384407] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 249) +[ 0.385291] shpchp: Standard Hot Plug PCI Controller Driver version: 0.4 +[ 0.386003] input: Power Button as /devices/LNXSYSTM:00/LNXPWRBN:00/input/input0 +[ 0.386731] ACPI: Power Button [PWRF] +[ 0.387428] PCI Interrupt Link [GSIF] enabled at IRQ 21 +[ 0.388885] PCI Interrupt Link [GSIH] enabled at IRQ 23 +[ 0.390255] PCI Interrupt Link [GSIE] enabled at IRQ 20 +[ 0.393749] Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled +[ 0.394570] 00:02: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A +[ 0.409740] software IO TLB: Memory encryption is active and system is using DMA bounce buffers +[ 0.411320] printk: console [hvc0] enabled +[ 0.413415] brd: module loaded +[ 0.414644] loop: module loaded +[ 0.416081] scsi host0: Virtio SCSI HBA +[ 0.417023] random: fast init done +[ 0.417469] VFIO - User Level meta-driver version: 0.3 +[ 0.418175] random: crng init done +[ 0.418975] xt_time: kernel timezone is -0000 +[ 0.419488] IPVS: Registered protocols (TCP, UDP, SCTP, AH, ESP) +[ 0.420221] IPVS: Connection hash table configured (size=4096, memory=64Kbytes) +[ 0.421119] IPVS: ipvs loaded. +[ 0.421478] IPVS: [rr] scheduler registered. +[ 0.421979] IPVS: [wrr] scheduler registered. +[ 0.422475] IPVS: [lc] scheduler registered. +[ 0.422970] IPVS: [wlc] scheduler registered. +[ 0.423461] IPVS: [fo] scheduler registered. +[ 0.423982] IPVS: [ovf] scheduler registered. +[ 0.424546] IPVS: [lblc] scheduler registered. +[ 0.425067] IPVS: [lblcr] scheduler registered. +[ 0.425580] IPVS: [dh] scheduler registered. +[ 0.426081] IPVS: [sh] scheduler registered. +[ 0.426572] IPVS: [sed] scheduler registered. +[ 0.427084] IPVS: [nq] scheduler registered. +[ 0.427578] IPVS: ftp: loaded support on port[0] = 21 +[ 0.428167] IPVS: [sip] pe registered. +[ 0.428794] ipt_CLUSTERIP: ClusterIP Version 0.8 loaded successfully +[ 0.429549] Initializing XFRM netlink socket +[ 0.430136] NET: Registered protocol family 10 +[ 0.430960] Segment Routing with IPv6 +[ 0.431417] NET: Registered protocol family 17 +[ 0.431971] 9pnet: Installing 9P2000 support +[ 0.433142] NET: Registered protocol family 40 +[ 0.433718] IPI shorthand broadcast: enabled +[ 0.434218] sched_clock: Marking stable (290414430, 142054672)->(447457221, -14988119) +[ 0.435600] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6 +[ 0.436567] Please append a correct "root=" boot option; here are the available partitions: +[ 0.437750] 0100 4096 ram0 +[ 0.437750] (driver?) +[ 0.438478] 0101 4096 ram1 +[ 0.438478] (driver?) +[ 0.439182] 0102 4096 ram2 +[ 0.439183] (driver?) +[ 0.439896] 0103 4096 ram3 +[ 0.439897] (driver?) +[ 0.440629] 0104 4096 ram4 +[ 0.440630] (driver?) +[ 0.441346] 0105 4096 ram5 +[ 0.441346] (driver?) +[ 0.442052] 0106 4096 ram6 +[ 0.442053] (driver?) +[ 0.442756] 0107 4096 ram7 +[ 0.442756] (driver?) +[ 0.443457] 0108 4096 ram8 +[ 0.443457] (driver?) +[ 0.444177] 0109 4096 ram9 +[ 0.444177] (driver?) +[ 0.444893] 010a 4096 ram10 +[ 0.444893] (driver?) +[ 0.445609] 010b 4096 ram11 +[ 0.445610] (driver?) +[ 0.446339] 010c 4096 ram12 +[ 0.446340] (driver?) +[ 0.447056] 010d 4096 ram13 +[ 0.447057] (driver?) +[ 0.447781] 010e 4096 ram14 +[ 0.447781] (driver?) +[ 0.448512] 010f 4096 ram15 +[ 0.448513] (driver?) +[ 0.449263] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0) +[ 0.450170] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.10.25 #1 +[ 0.450848] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 +[ 0.451699] Call Trace: +[ 0.451995] dump_stack+0x57/0x6a +[ 0.452378] panic+0xf6/0x292 +[ 0.452745] mount_block_root+0x2aa/0x324 +[ 0.453197] ? rest_init+0xaa/0xaa +[ 0.453587] prepare_namespace+0x131/0x160 +[ 0.454053] ? rest_init+0xaa/0xaa +[ 0.454442] kernel_init+0x5/0xf6 +[ 0.454838] ret_from_fork+0x22/0x30 +[ 0.455282] Kernel Offset: disabled +[ 0.455676] Rebooting in 1 seconds.. +``` + +Complete output from QEMU 6.2.0 without SEV : +``` +[ 0.000000] Linux version 5.10.25 (gitlab-runner@runner-buildah0) (gcc (Debian 11.2.0-12) 11.2.0, GNU ld (GNU Binutils for Debian) 2.37) #1 SMP Tue Dec 7 11:43:22 CET 2021 +[ 0.000000] Command line: tsc=reliable no_timer_check rcupdate.rcu_expedited=1 i8042.direct=1 i8042.dumbkbd=1 i8042.nopnp=1 i8042.noaux=1 noreplace-smp reboot=k console=hvc0 console=hvc1 console=ttyS0 cryptomgr.notests net.ifnames=0 pci=lastbus=0 debug panic=1 nr_cpus=32 scsi_mod.scan=none agent.log=debug +[ 0.000000] x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers' +[ 0.000000] x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers' +[ 0.000000] x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers' +[ 0.000000] x86/fpu: xstate_offset[2]: 576, xstate_sizes[2]: 256 +[ 0.000000] x86/fpu: Enabled xstate features 0x7, context size is 832 bytes, using 'compacted' format. +[ 0.000000] BIOS-provided physical RAM map: +[ 0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009ffff] usable +[ 0.000000] BIOS-e820: [mem 0x0000000000100000-0x00000000007fffff] usable +[ 0.000000] BIOS-e820: [mem 0x0000000000800000-0x0000000000807fff] ACPI NVS +[ 0.000000] BIOS-e820: [mem 0x0000000000808000-0x000000000080ffff] usable +[ 0.000000] BIOS-e820: [mem 0x0000000000810000-0x00000000008fffff] ACPI NVS +[ 0.000000] BIOS-e820: [mem 0x0000000000900000-0x000000007f6eefff] usable +[ 0.000000] BIOS-e820: [mem 0x000000007f6ef000-0x000000007f96efff] reserved +[ 0.000000] BIOS-e820: [mem 0x000000007f96f000-0x000000007f97efff] ACPI data +[ 0.000000] BIOS-e820: [mem 0x000000007f97f000-0x000000007f9fefff] ACPI NVS +[ 0.000000] BIOS-e820: [mem 0x000000007f9ff000-0x000000007fe5ffff] usable +[ 0.000000] BIOS-e820: [mem 0x000000007fe60000-0x000000007fe7ffff] reserved +[ 0.000000] BIOS-e820: [mem 0x000000007fe80000-0x000000007fffffff] ACPI NVS +[ 0.000000] BIOS-e820: [mem 0x00000000b0000000-0x00000000bfffffff] reserved +[ 0.000000] NX (Execute Disable) protection: active +[ 0.000000] efi: EFI v2.70 by EDK II +[ 0.000000] efi: SMBIOS=0x7f7ab000 ACPI=0x7f97e000 ACPI 2.0=0x7f97e014 MEMATTR=0x7e687118 +[ 0.000000] SMBIOS 2.8 present. +[ 0.000000] DMI: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 +[ 0.000000] Hypervisor detected: KVM +[ 0.000000] kvm-clock: Using msrs 4b564d01 and 4b564d00 +[ 0.000000] kvm-clock: cpu 0, msr 37201001, primary cpu clock +[ 0.000000] kvm-clock: using sched offset of 2589542167 cycles +[ 0.000002] clocksource: kvm-clock: mask: 0xffffffffffffffff max_cycles: 0x1cd42e4dffb, max_idle_ns: 881590591483 ns +[ 0.000004] tsc: Detected 2994.372 MHz processor +[ 0.000078] e820: update [mem 0x00000000-0x00000fff] usable ==> reserved +[ 0.000081] e820: remove [mem 0x000a0000-0x000fffff] usable +[ 0.000084] last_pfn = 0x7fe60 max_arch_pfn = 0x400000000 +[ 0.000106] MTRR default type: write-back +[ 0.000107] MTRR fixed ranges enabled: +[ 0.000108] 00000-9FFFF write-back +[ 0.000109] A0000-FFFFF uncachable +[ 0.000110] MTRR variable ranges enabled: +[ 0.000111] 0 base 0000C0000000 mask FFFFC0000000 uncachable +[ 0.000111] 1 base 0000B0000000 mask FFFFF0000000 uncachable +[ 0.000112] 2 base 001000000000 mask FFF800000000 uncachable +[ 0.000113] 3 disabled +[ 0.000113] 4 disabled +[ 0.000114] 5 disabled +[ 0.000114] 6 disabled +[ 0.000114] 7 disabled +[ 0.000141] x86/PAT: Configuration [0-7]: WB WC UC- UC WB WP UC- WT +[ 0.004269] Using GB pages for direct mapping +[ 0.004654] Secure boot could not be determined +[ 0.004655] RAMDISK: [mem 0x6f1ee000-0x757f5fff] +[ 0.004668] ACPI: Early table checksum verification disabled +[ 0.004673] ACPI: RSDP 0x000000007F97E014 000024 (v02 BOCHS ) +[ 0.004676] ACPI: XSDT 0x000000007F97D0E8 000054 (v01 BOCHS BXPC 00000001 01000013) +[ 0.004682] ACPI: FACP 0x000000007F978000 0000F4 (v03 BOCHS BXPC 00000001 BXPC 00000001) +[ 0.004686] ACPI: DSDT 0x000000007F979000 003EAE (v01 BOCHS BXPC 00000001 BXPC 00000001) +[ 0.004688] ACPI: FACS 0x000000007F9DD000 000040 +[ 0.004690] ACPI: APIC 0x000000007F977000 000170 (v01 BOCHS BXPC 00000001 BXPC 00000001) +[ 0.004692] ACPI: HPET 0x000000007F976000 000038 (v01 BOCHS BXPC 00000001 BXPC 00000001) +[ 0.004694] ACPI: SRAT 0x000000007F975000 0002D0 (v01 BOCHS BXPC 00000001 BXPC 00000001) +[ 0.004696] ACPI: MCFG 0x000000007F974000 00003C (v01 BOCHS BXPC 00000001 BXPC 00000001) +[ 0.004698] ACPI: WAET 0x000000007F973000 000028 (v01 BOCHS BXPC 00000001 BXPC 00000001) +[ 0.004703] ACPI: Local APIC address 0xfee00000 +[ 0.004734] Zone ranges: +[ 0.004735] DMA [mem 0x0000000000001000-0x0000000000ffffff] +[ 0.004736] DMA32 [mem 0x0000000001000000-0x000000007fe5ffff] +[ 0.004737] Normal empty +[ 0.004738] Device empty +[ 0.004739] Movable zone start for each node +[ 0.004740] Early memory node ranges +[ 0.004741] node 0: [mem 0x0000000000001000-0x000000000009ffff] +[ 0.004742] node 0: [mem 0x0000000000100000-0x00000000007fffff] +[ 0.004743] node 0: [mem 0x0000000000808000-0x000000000080ffff] +[ 0.004743] node 0: [mem 0x0000000000900000-0x000000007f6eefff] +[ 0.004744] node 0: [mem 0x000000007f9ff000-0x000000007fe5ffff] +[ 0.004746] Initmem setup node 0 [mem 0x0000000000001000-0x000000007fe5ffff] +[ 0.004747] On node 0 totalpages: 522743 +[ 0.004748] DMA zone: 59 pages used for memmap +[ 0.004749] DMA zone: 1814 pages reserved +[ 0.004750] DMA zone: 3751 pages, LIFO batch:0 +[ 0.005315] DMA zone: 29017 pages in unavailable ranges +[ 0.005316] DMA32 zone: 8122 pages used for memmap +[ 0.005317] DMA32 zone: 518992 pages, LIFO batch:63 +[ 0.011640] DMA32 zone: 1200 pages in unavailable ranges +[ 0.012025] ACPI: PM-Timer IO Port: 0x608 +[ 0.012028] ACPI: Local APIC address 0xfee00000 +[ 0.012037] ACPI: LAPIC_NMI (acpi_id[0xff] dfl dfl lint[0x1]) +[ 0.012063] IOAPIC[0]: apic_id 0, version 17, address 0xfec00000, GSI 0-23 +[ 0.012065] ACPI: INT_SRC_OVR (bus 0 bus_irq 0 global_irq 2 dfl dfl) +[ 0.012067] ACPI: INT_SRC_OVR (bus 0 bus_irq 5 global_irq 5 high level) +[ 0.012068] ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 9 high level) +[ 0.012069] ACPI: INT_SRC_OVR (bus 0 bus_irq 10 global_irq 10 high level) +[ 0.012070] ACPI: INT_SRC_OVR (bus 0 bus_irq 11 global_irq 11 high level) +[ 0.012071] ACPI: IRQ0 used by override. +[ 0.012072] ACPI: IRQ5 used by override. +[ 0.012073] ACPI: IRQ9 used by override. +[ 0.012073] ACPI: IRQ10 used by override. +[ 0.012074] ACPI: IRQ11 used by override. +[ 0.012076] Using ACPI (MADT) for SMP configuration information +[ 0.012077] ACPI: HPET id: 0x8086a201 base: 0xfed00000 +[ 0.012082] TSC deadline timer available +[ 0.012085] smpboot: Allowing 32 CPUs, 31 hotplug CPUs +[ 0.012093] kvm-guest: KVM setup pv remote TLB flush +[ 0.012099] kvm-guest: setup PV sched yield +[ 0.012110] [mem 0xc0000000-0xffffffff] available for PCI devices +[ 0.012116] Booting paravirtualized kernel on KVM +[ 0.012119] clocksource: refined-jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645519600211568 ns +[ 0.015048] setup_percpu: NR_CPUS:240 nr_cpumask_bits:240 nr_cpu_ids:32 nr_node_ids:1 +[ 0.016599] percpu: Embedded 42 pages/cpu s143360 r0 d28672 u262144 +[ 0.016605] pcpu-alloc: s143360 r0 d28672 u262144 alloc=1*2097152 +[ 0.016606] pcpu-alloc: [0] 00 01 02 03 04 05 06 07 [0] 08 09 10 11 12 13 14 15 +[ 0.016611] pcpu-alloc: [0] 16 17 18 19 20 21 22 23 [0] 24 25 26 27 28 29 30 31 +[ 0.016637] kvm-guest: KVM setup async PF for cpu 0 +[ 0.016641] kvm-guest: stealtime: cpu 0, msr 6e822080 +[ 0.016645] Built 1 zonelists, mobility grouping on. Total pages: 512748 +[ 0.016646] Kernel command line: tsc=reliable no_timer_check rcupdate.rcu_expedited=1 i8042.direct=1 i8042.dumbkbd=1 i8042.nopnp=1 i8042.noaux=1 noreplace-smp reboot=k console=hvc0 console=hvc1 console=ttyS0 cryptomgr.notests net.ifnames=0 pci=lastbus=0 debug panic=1 nr_cpus=32 scsi_mod.scan=none agent.log=debug +[ 0.016721] printk: log_buf_len individual max cpu contribution: 4096 bytes +[ 0.016722] printk: log_buf_len total cpu_extra contributions: 126976 bytes +[ 0.016723] printk: log_buf_len min size: 131072 bytes +[ 0.016904] printk: log_buf_len: 262144 bytes +[ 0.016905] printk: early log buf free: 123296(94%) +[ 0.017240] Dentry cache hash table entries: 262144 (order: 9, 2097152 bytes, linear) +[ 0.017535] Inode-cache hash table entries: 131072 (order: 8, 1048576 bytes, linear) +[ 0.017618] mem auto-init: stack:off, heap alloc:off, heap free:off +[ 0.021841] Memory: 1782444K/2090972K available (10242K kernel code, 956K rwdata, 1456K rodata, 892K init, 3564K bss, 308272K reserved, 0K cma-reserved) +[ 0.021920] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=32, Nodes=1 +[ 0.022033] rcu: Hierarchical RCU implementation. +[ 0.022034] rcu: RCU restricting CPUs from NR_CPUS=240 to nr_cpu_ids=32. +[ 0.022035] All grace periods are expedited (rcu_expedited). +[ 0.022036] Tracing variant of Tasks RCU enabled. +[ 0.022037] rcu: RCU calculated value of scheduler-enlistment delay is 25 jiffies. +[ 0.022038] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=32 +[ 0.022058] NR_IRQS: 15616, nr_irqs: 680, preallocated irqs: 16 +[ 0.022381] rcu: Offload RCU callbacks from CPUs: (none). +[ 0.022525] random: get_random_bytes called from start_kernel+0x2fc/0x4ae with crng_init=0 +[ 0.022585] Console: colour dummy device 80x25 +[ 0.103996] printk: console [ttyS0] enabled +[ 0.104387] ACPI: Core revision 20200925 +[ 0.104866] clocksource: hpet: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604467 ns +[ 0.105761] APIC: Switch to symmetric I/O mode setup +[ 0.106341] x2apic enabled +[ 0.106708] Switched APIC routing to physical x2apic. +[ 0.107178] kvm-guest: setup PV IPIs +[ 0.108191] ..TIMER: vector=0x30 apic1=0 pin1=2 apic2=-1 pin2=-1 +[ 0.108739] clocksource: tsc-early: mask: 0xffffffffffffffff max_cycles: 0x2b29812ce43, max_idle_ns: 440795323173 ns +[ 0.109650] Calibrating delay loop (skipped) preset value.. 5988.74 BogoMIPS (lpj=11977488) +[ 0.113651] pid_max: default: 32768 minimum: 301 +[ 0.129407] LSM: Security Framework initializing +[ 0.129680] Mount-cache hash table entries: 4096 (order: 3, 32768 bytes, linear) +[ 0.130330] Mountpoint-cache hash table entries: 4096 (order: 3, 32768 bytes, linear) +[ 0.131738] x86/cpu: User Mode Instruction Prevention (UMIP) activated +[ 0.132339] Last level iTLB entries: 4KB 512, 2MB 255, 4MB 127 +[ 0.132849] Last level dTLB entries: 4KB 512, 2MB 255, 4MB 127, 1GB 0 +[ 0.133655] Spectre V1 : Mitigation: usercopy/swapgs barriers and __user pointer sanitization +[ 0.134398] Spectre V2 : Mitigation: Full AMD retpoline +[ 0.134857] Spectre V2 : Spectre v2 / SpectreRSB mitigation: Filling RSB on context switch +[ 0.135570] Spectre V2 : Enabling Restricted Speculation for firmware calls +[ 0.136182] Spectre V2 : mitigation: Enabling conditional Indirect Branch Prediction Barrier +[ 0.136913] Speculative Store Bypass: Mitigation: Speculative Store Bypass disabled via prctl and seccomp +[ 0.137807] Freeing SMP alternatives memory: 28K +[ 0.138326] smpboot: CPU0: AMD EPYC 7302P 16-Core Processor (family: 0x17, model: 0x31, stepping: 0x0) +[ 0.141129] Performance Events: Fam17h+ core perfctr, AMD PMU driver. +[ 0.141649] ... version: 0 +[ 0.141657] ... bit width: 48 +[ 0.142342] ... generic registers: 6 +[ 0.143012] ... value mask: 0000ffffffffffff +[ 0.143904] ... max period: 00007fffffffffff +[ 0.144790] ... fixed-purpose events: 0 +[ 0.145529] ... event mask: 000000000000003f +[ 0.145867] rcu: Hierarchical SRCU implementation. +[ 0.147346] smp: Bringing up secondary CPUs ... +[ 0.148411] smp: Brought up 1 node, 1 CPU +[ 0.149351] smpboot: Max logical packages: 32 +[ 0.149660] smpboot: Total of 1 processors activated (5988.74 BogoMIPS) +[ 0.151208] devtmpfs: initialized +[ 0.151830] x86/mm: Memory block size: 128MB +[ 0.152836] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns +[ 0.153662] futex hash table entries: 8192 (order: 7, 524288 bytes, linear) +[ 0.155199] NET: Registered protocol family 16 +[ 0.156041] DMA: preallocated 256 KiB GFP_KERNEL pool for atomic allocations +[ 0.157242] DMA: preallocated 256 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations +[ 0.157661] DMA: preallocated 256 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations +[ 0.159023] thermal_sys: Registered thermal governor 'step_wise' +[ 0.159027] cpuidle: using governor menu +[ 0.161335] ACPI: bus type PCI registered +[ 0.161655] acpiphp: ACPI Hot Plug PCI Controller Driver version: 0.5 +[ 0.162805] PCI: MMCONFIG for domain 0000 [bus 00-ff] at [mem 0xb0000000-0xbfffffff] (base 0xb0000000) +[ 0.164441] PCI: MMCONFIG at [mem 0xb0000000-0xbfffffff] reserved in E820 +[ 0.165592] PCI: Using configuration type 1 for base access +[ 0.166553] HugeTLB registered 1.00 GiB page size, pre-allocated 0 pages +[ 0.167679] HugeTLB registered 2.00 MiB page size, pre-allocated 0 pages +[ 0.169123] ACPI: Added _OSI(Module Device) +[ 0.169657] ACPI: Added _OSI(Processor Device) +[ 0.170402] ACPI: Added _OSI(3.0 _SCP Extensions) +[ 0.171180] ACPI: Added _OSI(Processor Aggregator Device) +[ 0.172120] ACPI: Added _OSI(Linux-Dell-Video) +[ 0.172866] ACPI: Added _OSI(Linux-Lenovo-NV-HDMI-Audio) +[ 0.173655] ACPI: Added _OSI(Linux-HPI-Hybrid-Graphics) +[ 0.176672] ACPI: 1 ACPI AML tables successfully acquired and loaded +[ 0.178693] ACPI: Interpreter enabled +[ 0.179358] ACPI: (supports S0 S5) +[ 0.179937] ACPI: Using IOAPIC for interrupt routing +[ 0.180969] PCI: Using host bridge windows from ACPI; if necessary, use "pci=nocrs" and report a bug +[ 0.181842] ACPI: Enabled 3 GPEs in block 00 to 3F +[ 0.188692] ACPI: PCI Root Bridge [PCI0] (domain 0000 [bus 00-ff]) +[ 0.189662] acpi PNP0A08:00: _OSC: OS supports [ExtendedConfig ASPM ClockPM Segments MSI HPX-Type3] +[ 0.191262] acpi PNP0A08:00: _OSC: platform does not support [PCIeHotplug LTR] +[ 0.192546] acpi PNP0A08:00: _OSC: OS now controls [SHPCHotplug PME PCIeCapability] +[ 0.193820] PCI host bridge to bus 0000:00 +[ 0.194509] pci_bus 0000:00: root bus resource [io 0x0000-0x0cf7 window] +[ 0.195642] pci_bus 0000:00: root bus resource [io 0x0d00-0xffff window] +[ 0.196770] pci_bus 0000:00: root bus resource [mem 0x000a0000-0x000bffff window] +[ 0.197654] pci_bus 0000:00: root bus resource [mem 0x80000000-0xafffffff window] +[ 0.198902] pci_bus 0000:00: root bus resource [mem 0xc0000000-0xfebfffff window] +[ 0.200182] pci_bus 0000:00: root bus resource [mem 0x1000000000-0x17ffffffff window] +[ 0.201533] pci_bus 0000:00: root bus resource [bus 00-ff] +[ 0.201712] pci 0000:00:00.0: [8086:29c0] type 00 class 0x060000 +[ 0.203324] pci 0000:00:01.0: [1af4:1003] type 00 class 0x078000 +[ 0.205657] pci 0000:00:01.0: reg 0x10: [io 0x60c0-0x60ff] +[ 0.208353] pci 0000:00:01.0: reg 0x14: [mem 0xc0003000-0xc0003fff] +[ 0.213657] pci 0000:00:01.0: reg 0x20: [mem 0x1000000000-0x1000003fff 64bit pref] +[ 0.218281] pci 0000:00:02.0: [1b36:0001] type 01 class 0x060400 +[ 0.223034] pci 0000:00:03.0: [1af4:1004] type 00 class 0x010000 +[ 0.225394] pci 0000:00:03.0: reg 0x10: [io 0x6080-0x60bf] +[ 0.226822] pci 0000:00:03.0: reg 0x14: [mem 0xc0002000-0xc0002fff] +[ 0.230911] pci 0000:00:03.0: reg 0x20: [mem 0x1000004000-0x1000007fff 64bit pref] +[ 0.235919] pci 0000:00:04.0: [1af4:1005] type 00 class 0x00ff00 +[ 0.237656] pci 0000:00:04.0: reg 0x10: [io 0x6120-0x613f] +[ 0.241656] pci 0000:00:04.0: reg 0x20: [mem 0x1000008000-0x100000bfff 64bit pref] +[ 0.244288] pci 0000:00:05.0: [1af4:1009] type 00 class 0x000200 +[ 0.247672] pci 0000:00:05.0: reg 0x10: [io 0x6040-0x607f] +[ 0.249624] pci 0000:00:05.0: reg 0x14: [mem 0xc0001000-0xc0001fff] +[ 0.252855] pci 0000:00:05.0: reg 0x20: [mem 0x100000c000-0x100000ffff 64bit pref] +[ 0.257540] pci 0000:00:1f.0: [8086:2918] type 00 class 0x060100 +[ 0.258154] pci 0000:00:1f.0: quirk: [io 0x0600-0x067f] claimed by ICH6 ACPI/GPIO/TCO +[ 0.259985] pci 0000:00:1f.2: [8086:2922] type 00 class 0x010601 +[ 0.264875] pci 0000:00:1f.2: reg 0x20: [io 0x6100-0x611f] +[ 0.267416] pci 0000:00:1f.2: reg 0x24: [mem 0xc0000000-0xc0000fff] +[ 0.269582] pci 0000:00:1f.3: [8086:2930] type 00 class 0x0c0500 +[ 0.271746] pci 0000:00:1f.3: reg 0x20: [io 0x6000-0x603f] +[ 0.274063] pci_bus 0000:01: extended config space not accessible +[ 0.275352] acpiphp: Slot [0] registered +[ 0.276038] acpiphp: Slot [1] registered +[ 0.277675] acpiphp: Slot [2] registered +[ 0.278353] acpiphp: Slot [3] registered +[ 0.279150] acpiphp: Slot [4] registered +[ 0.279837] acpiphp: Slot [5] registered +[ 0.280509] acpiphp: Slot [6] registered +[ 0.281280] acpiphp: Slot [7] registered +[ 0.281677] acpiphp: Slot [8] registered +[ 0.282360] acpiphp: Slot [9] registered +[ 0.283032] acpiphp: Slot [10] registered +[ 0.283814] acpiphp: Slot [11] registered +[ 0.284510] acpiphp: Slot [12] registered +[ 0.285203] acpiphp: Slot [13] registered +[ 0.285678] acpiphp: Slot [14] registered +[ 0.286378] acpiphp: Slot [15] registered +[ 0.287111] acpiphp: Slot [16] registered +[ 0.288055] acpiphp: Slot [17] registered +[ 0.288803] acpiphp: Slot [18] registered +[ 0.289541] acpiphp: Slot [19] registered +[ 0.289674] acpiphp: Slot [20] registered +[ 0.290384] acpiphp: Slot [21] registered +[ 0.291086] acpiphp: Slot [22] registered +[ 0.291778] acpiphp: Slot [23] registered +[ 0.292480] acpiphp: Slot [24] registered +[ 0.293211] acpiphp: Slot [25] registered +[ 0.293674] acpiphp: Slot [26] registered +[ 0.294385] acpiphp: Slot [27] registered +[ 0.295071] acpiphp: Slot [28] registered +[ 0.295953] acpiphp: Slot [29] registered +[ 0.296769] acpiphp: Slot [30] registered +[ 0.297594] acpiphp: Slot [31] registered +[ 0.297916] pci 0000:00:02.0: PCI bridge to [bus 01] +[ 0.300138] pci_bus 0000:00: on NUMA node 0 +[ 0.301275] ACPI: PCI Interrupt Link [LNKA] (IRQs 5 *10 11) +[ 0.301748] ACPI: PCI Interrupt Link [LNKB] (IRQs 5 *10 11) +[ 0.302965] ACPI: PCI Interrupt Link [LNKC] (IRQs 5 10 *11) +[ 0.304172] ACPI: PCI Interrupt Link [LNKD] (IRQs 5 10 *11) +[ 0.305263] ACPI: PCI Interrupt Link [LNKE] (IRQs 5 *10 11) +[ 0.305787] ACPI: PCI Interrupt Link [LNKF] (IRQs 5 *10 11) +[ 0.306849] ACPI: PCI Interrupt Link [LNKG] (IRQs 5 10 *11) +[ 0.308110] ACPI: PCI Interrupt Link [LNKH] (IRQs 5 10 *11) +[ 0.309202] ACPI: PCI Interrupt Link [GSIA] (IRQs *16) +[ 0.309667] ACPI: PCI Interrupt Link [GSIB] (IRQs *17) +[ 0.310565] ACPI: PCI Interrupt Link [GSIC] (IRQs *18) +[ 0.311446] ACPI: PCI Interrupt Link [GSID] (IRQs *19) +[ 0.312329] ACPI: PCI Interrupt Link [GSIE] (IRQs *20) +[ 0.313253] ACPI: PCI Interrupt Link [GSIF] (IRQs *21) +[ 0.313672] ACPI: PCI Interrupt Link [GSIG] (IRQs *22) +[ 0.314722] ACPI: PCI Interrupt Link [GSIH] (IRQs *23) +[ 0.317172] iommu: Default domain type: Translated +[ 0.317728] vgaarb: loaded +[ 0.318310] SCSI subsystem initialized +[ 0.318954] pps_core: LinuxPPS API ver. 1 registered +[ 0.319804] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it> +[ 0.321326] PTP clock support registered +[ 0.321687] Registered efivars operations +[ 0.322500] PCI: Using ACPI for IRQ routing +[ 0.323211] PCI: pci_cache_line_size set to 64 bytes +[ 0.324206] e820: reserve RAM buffer [mem 0x00810000-0x008fffff] +[ 0.325212] e820: reserve RAM buffer [mem 0x7f6ef000-0x7fffffff] +[ 0.325657] e820: reserve RAM buffer [mem 0x7fe60000-0x7fffffff] +[ 0.326754] clocksource: Switched to clocksource kvm-clock +[ 0.327844] pnp: PnP ACPI init +[ 0.328425] pnp 00:00: Plug and Play ACPI device, IDs PNP0303 (active) +[ 0.329649] pnp 00:01: Plug and Play ACPI device, IDs PNP0f13 (active) +[ 0.329809] pnp 00:02: Plug and Play ACPI device, IDs PNP0501 (active) +[ 0.331078] pnp 00:03: Plug and Play ACPI device, IDs PNP0b00 (active) +[ 0.332465] system 00:04: [mem 0xb0000000-0xbfffffff window] has been reserved +[ 0.333902] system 00:04: Plug and Play ACPI device, IDs PNP0c01 (active) +[ 0.335579] pnp: PnP ACPI: found 5 devices +[ 0.341670] clocksource: acpi_pm: mask: 0xffffff max_cycles: 0xffffff, max_idle_ns: 2085701024 ns +[ 0.343568] NET: Registered protocol family 2 +[ 0.345189] tcp_listen_portaddr_hash hash table entries: 1024 (order: 2, 16384 bytes, linear) +[ 0.346697] TCP established hash table entries: 16384 (order: 5, 131072 bytes, linear) +[ 0.348298] TCP bind hash table entries: 16384 (order: 6, 262144 bytes, linear) +[ 0.349954] TCP: Hash tables configured (established 16384 bind 16384) +[ 0.351468] UDP hash table entries: 1024 (order: 3, 32768 bytes, linear) +[ 0.352774] UDP-Lite hash table entries: 1024 (order: 3, 32768 bytes, linear) +[ 0.354001] NET: Registered protocol family 1 +[ 0.354738] pci 0000:00:02.0: PCI bridge to [bus 01] +[ 0.359275] pci_bus 0000:00: resource 4 [io 0x0000-0x0cf7 window] +[ 0.360332] pci_bus 0000:00: resource 5 [io 0x0d00-0xffff window] +[ 0.361390] pci_bus 0000:00: resource 6 [mem 0x000a0000-0x000bffff window] +[ 0.362681] pci_bus 0000:00: resource 7 [mem 0x80000000-0xafffffff window] +[ 0.364042] pci_bus 0000:00: resource 8 [mem 0xc0000000-0xfebfffff window] +[ 0.365243] pci_bus 0000:00: resource 9 [mem 0x1000000000-0x17ffffffff window] +[ 0.366666] PCI: CLS 0 bytes, default 64 +[ 0.367453] Trying to unpack rootfs image as initramfs... +[ 2.474287] Freeing initrd memory: 104480K +[ 2.474789] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x2b29812ce43, max_idle_ns: 440795323173 ns +[ 2.476083] workingset: timestamp_bits=46 max_order=19 bucket_order=0 +[ 2.477757] fuse: init (API version 7.32) +[ 2.478215] SGI XFS with security attributes, no debug enabled +[ 2.478997] 9p: Installing v9fs 9p2000 file system support +[ 2.479591] NET: Registered protocol family 38 +[ 2.480035] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 249) +[ 2.480870] shpchp: Standard Hot Plug PCI Controller Driver version: 0.4 +[ 2.481582] input: Power Button as /devices/LNXSYSTM:00/LNXPWRBN:00/input/input0 +[ 2.482309] ACPI: Power Button [PWRF] +[ 2.482943] PCI Interrupt Link [GSIF] enabled at IRQ 21 +[ 2.484131] PCI Interrupt Link [GSIH] enabled at IRQ 23 +[ 2.485303] PCI Interrupt Link [GSIE] enabled at IRQ 20 +[ 2.486896] Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled +[ 2.487599] 00:02: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A +[ 2.513070] printk: console [hvc0] enabled +[ 2.514550] brd: module loaded +[ 2.515360] random: fast init done +[ 2.516052] loop: module loaded +[ 2.516563] random: crng init done +[ 2.517477] scsi host0: Virtio SCSI HBA +[ 2.518342] VFIO - User Level meta-driver version: 0.3 +[ 2.519286] xt_time: kernel timezone is -0000 +[ 2.519803] IPVS: Registered protocols (TCP, UDP, SCTP, AH, ESP) +[ 2.520504] IPVS: Connection hash table configured (size=4096, memory=64Kbytes) +[ 2.521364] IPVS: ipvs loaded. +[ 2.521734] IPVS: [rr] scheduler registered. +[ 2.522232] IPVS: [wrr] scheduler registered. +[ 2.522732] IPVS: [lc] scheduler registered. +[ 2.523234] IPVS: [wlc] scheduler registered. +[ 2.523733] IPVS: [fo] scheduler registered. +[ 2.524237] IPVS: [ovf] scheduler registered. +[ 2.524741] IPVS: [lblc] scheduler registered. +[ 2.525253] IPVS: [lblcr] scheduler registered. +[ 2.525778] IPVS: [dh] scheduler registered. +[ 2.526281] IPVS: [sh] scheduler registered. +[ 2.526770] IPVS: [sed] scheduler registered. +[ 2.527273] IPVS: [nq] scheduler registered. +[ 2.527761] IPVS: ftp: loaded support on port[0] = 21 +[ 2.528335] IPVS: [sip] pe registered. +[ 2.528913] ipt_CLUSTERIP: ClusterIP Version 0.8 loaded successfully +[ 2.529668] Initializing XFRM netlink socket +[ 2.530243] NET: Registered protocol family 10 +[ 2.530990] Segment Routing with IPv6 +[ 2.531446] NET: Registered protocol family 17 +[ 2.531980] 9pnet: Installing 9P2000 support +[ 2.532904] NET: Registered protocol family 40 +[ 2.533452] IPI shorthand broadcast: enabled +[ 2.533957] sched_clock: Marking stable (2450694990, 83251786)->(2555552194, -21605418) +[ 2.535774] Freeing unused decrypted memory: 2036K +[ 2.536717] Freeing unused kernel image (initmem) memory: 892K +[ 2.537482] Write protecting the kernel read-only data: 14336k +[ 2.538869] Freeing unused kernel image (text/rodata gap) memory: 2044K +[ 2.539890] Freeing unused kernel image (rodata/data gap) memory: 592K +[ 2.540714] Run /init as init process +[ 2.541191] with arguments: +[ 2.541582] /init +[ 2.541885] with environment: +[ 2.542325] HOME=/ +[ 2.542640] TERM=linux +``` + +Expected output as previous versions +Complete output from QEMU 6.0.0 with SEV : +``` +[ 0.000000] Linux version 5.10.25 (gitlab-runner@runner-buildah0) (gcc (Debian 11.2.0-12) 11.2.0, GNU ld (GNU Binutils for Debian) 2.37) #1 SMP Tue Dec 7 11:43:22 CET 2021 +[ 0.000000] Command line: tsc=reliable no_timer_check rcupdate.rcu_expedited=1 i8042.direct=1 i8042.dumbkbd=1 i8042.nopnp=1 i8042.noaux=1 noreplace-smp reboot=k console=hvc0 console=hvc1 console=ttyS0 cryptomgr.notests net.ifnames=0 pci=lastbus=0 debug panic=1 nr_cpus=32 scsi_mod.scan=none agent.log=debug +[ 0.000000] x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers' +[ 0.000000] x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers' +[ 0.000000] x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers' +[ 0.000000] x86/fpu: xstate_offset[2]: 576, xstate_sizes[2]: 256 +[ 0.000000] x86/fpu: Enabled xstate features 0x7, context size is 832 bytes, using 'compacted' format. +[ 0.000000] BIOS-provided physical RAM map: +[ 0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009ffff] usable +[ 0.000000] BIOS-e820: [mem 0x0000000000100000-0x00000000007fffff] usable +[ 0.000000] BIOS-e820: [mem 0x0000000000800000-0x0000000000807fff] ACPI NVS +[ 0.000000] BIOS-e820: [mem 0x0000000000808000-0x000000000080ffff] usable +[ 0.000000] BIOS-e820: [mem 0x0000000000810000-0x00000000008fffff] ACPI NVS +[ 0.000000] BIOS-e820: [mem 0x0000000000900000-0x000000007f6eefff] usable +[ 0.000000] BIOS-e820: [mem 0x000000007f6ef000-0x000000007f96efff] reserved +[ 0.000000] BIOS-e820: [mem 0x000000007f96f000-0x000000007f97efff] ACPI data +[ 0.000000] BIOS-e820: [mem 0x000000007f97f000-0x000000007f9fefff] ACPI NVS +[ 0.000000] BIOS-e820: [mem 0x000000007f9ff000-0x000000007fe5ffff] usable +[ 0.000000] BIOS-e820: [mem 0x000000007fe60000-0x000000007fe7ffff] reserved +[ 0.000000] BIOS-e820: [mem 0x000000007fe80000-0x000000007fffffff] ACPI NVS +[ 0.000000] BIOS-e820: [mem 0x00000000b0000000-0x00000000bfffffff] reserved +[ 0.000000] NX (Execute Disable) protection: active +[ 0.000000] efi: EFI v2.70 by EDK II +[ 0.000000] efi: SMBIOS=0x7f7ab000 ACPI=0x7f97e000 ACPI 2.0=0x7f97e014 MEMATTR=0x7e9d8118 +[ 0.000000] SMBIOS 2.8 present. +[ 0.000000] DMI: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 +[ 0.000000] Hypervisor detected: KVM +[ 0.000000] kvm-clock: Using msrs 4b564d01 and 4b564d00 +[ 0.000000] kvm-clock: cpu 0, msr 14201001, primary cpu clock +[ 0.000001] kvm-clock: using sched offset of 3987202924 cycles +[ 0.000004] clocksource: kvm-clock: mask: 0xffffffffffffffff max_cycles: 0x1cd42e4dffb, max_idle_ns: 881590591483 ns +[ 0.000006] tsc: Detected 2994.372 MHz processor +[ 0.000158] e820: update [mem 0x00000000-0x00000fff] usable ==> reserved +[ 0.000161] e820: remove [mem 0x000a0000-0x000fffff] usable +[ 0.000168] last_pfn = 0x7fe60 max_arch_pfn = 0x400000000 +[ 0.000215] MTRR default type: write-back +[ 0.000216] MTRR fixed ranges enabled: +[ 0.000218] 00000-9FFFF write-back +[ 0.000220] A0000-FFFFF uncachable +[ 0.000220] MTRR variable ranges enabled: +[ 0.000222] 0 base 0000C0000000 mask FFFFC0000000 uncachable +[ 0.000224] 1 base 0000B0000000 mask FFFFF0000000 uncachable +[ 0.000226] 2 base 001000000000 mask FFF800000000 uncachable +[ 0.000227] 3 disabled +[ 0.000227] 4 disabled +[ 0.000228] 5 disabled +[ 0.000229] 6 disabled +[ 0.000230] 7 disabled +[ 0.000274] x86/PAT: Configuration [0-7]: WB WC UC- UC WB WP UC- WT +[ 0.008664] Using GB pages for direct mapping +[ 0.009370] Secure boot could not be determined +[ 0.009372] RAMDISK: [mem 0x6f1ee000-0x757f5fff] +[ 0.009399] ACPI: Early table checksum verification disabled +[ 0.009410] ACPI: RSDP 0x000000007F97E014 000024 (v02 BOCHS ) +[ 0.009415] ACPI: XSDT 0x000000007F97D0E8 000054 (v01 BOCHS BXPC 00000001 01000013) +[ 0.009423] ACPI: FACP 0x000000007F978000 0000F4 (v03 BOCHS BXPC 00000001 BXPC 00000001) +[ 0.009430] ACPI: DSDT 0x000000007F979000 003278 (v01 BOCHS BXPC 00000001 BXPC 00000001) +[ 0.009435] ACPI: FACS 0x000000007F9DD000 000040 +[ 0.009439] ACPI: APIC 0x000000007F977000 000170 (v01 BOCHS BXPC 00000001 BXPC 00000001) +[ 0.009443] ACPI: HPET 0x000000007F976000 000038 (v01 BOCHS BXPC 00000001 BXPC 00000001) +[ 0.009448] ACPI: SRAT 0x000000007F975000 0002D0 (v01 BOCHS BXPC 00000001 BXPC 00000001) +[ 0.009452] ACPI: MCFG 0x000000007F974000 00003C (v01 BOCHS BXPC 00000001 BXPC 00000001) +[ 0.009456] ACPI: WAET 0x000000007F973000 000028 (v01 BOCHS BXPC 00000001 BXPC 00000001) +[ 0.009466] ACPI: Local APIC address 0xfee00000 +[ 0.009507] Zone ranges: +[ 0.009508] DMA [mem 0x0000000000001000-0x0000000000ffffff] +[ 0.009511] DMA32 [mem 0x0000000001000000-0x000000007fe5ffff] +[ 0.009513] Normal empty +[ 0.009514] Device empty +[ 0.009516] Movable zone start for each node +[ 0.009517] Early memory node ranges +[ 0.009518] node 0: [mem 0x0000000000001000-0x000000000009ffff] +[ 0.009520] node 0: [mem 0x0000000000100000-0x00000000007fffff] +[ 0.009521] node 0: [mem 0x0000000000808000-0x000000000080ffff] +[ 0.009522] node 0: [mem 0x0000000000900000-0x000000007f6eefff] +[ 0.009523] node 0: [mem 0x000000007f9ff000-0x000000007fe5ffff] +[ 0.009525] Initmem setup node 0 [mem 0x0000000000001000-0x000000007fe5ffff] +[ 0.009528] On node 0 totalpages: 522743 +[ 0.009529] DMA zone: 59 pages used for memmap +[ 0.009531] DMA zone: 1814 pages reserved +[ 0.009532] DMA zone: 3751 pages, LIFO batch:0 +[ 0.009843] DMA zone: 29017 pages in unavailable ranges +[ 0.009845] DMA32 zone: 8122 pages used for memmap +[ 0.009846] DMA32 zone: 518992 pages, LIFO batch:63 +[ 0.014033] DMA32 zone: 1200 pages in unavailable ranges +[ 0.014785] ACPI: PM-Timer IO Port: 0x608 +[ 0.014788] ACPI: Local APIC address 0xfee00000 +[ 0.014803] ACPI: LAPIC_NMI (acpi_id[0xff] dfl dfl lint[0x1]) +[ 0.014994] IOAPIC[0]: apic_id 0, version 32, address 0xfec00000, GSI 0-23 +[ 0.014998] ACPI: INT_SRC_OVR (bus 0 bus_irq 0 global_irq 2 dfl dfl) +[ 0.015001] ACPI: INT_SRC_OVR (bus 0 bus_irq 5 global_irq 5 high level) +[ 0.015003] ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 9 high level) +[ 0.015005] ACPI: INT_SRC_OVR (bus 0 bus_irq 10 global_irq 10 high level) +[ 0.015006] ACPI: INT_SRC_OVR (bus 0 bus_irq 11 global_irq 11 high level) +[ 0.015007] ACPI: IRQ0 used by override. +[ 0.015009] ACPI: IRQ5 used by override. +[ 0.015010] ACPI: IRQ9 used by override. +[ 0.015011] ACPI: IRQ10 used by override. +[ 0.015011] ACPI: IRQ11 used by override. +[ 0.015014] Using ACPI (MADT) for SMP configuration information +[ 0.015017] ACPI: HPET id: 0x8086a201 base: 0xfed00000 +[ 0.015021] TSC deadline timer available +[ 0.015027] smpboot: Allowing 32 CPUs, 31 hotplug CPUs +[ 0.015039] kvm-guest: KVM setup pv remote TLB flush +[ 0.015048] kvm-guest: setup PV sched yield +[ 0.015065] [mem 0xc0000000-0xffffffff] available for PCI devices +[ 0.015066] Booting paravirtualized kernel on KVM +[ 0.015070] clocksource: refined-jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645519600211568 ns +[ 0.020345] setup_percpu: NR_CPUS:240 nr_cpumask_bits:240 nr_cpu_ids:32 nr_node_ids:1 +[ 0.021575] percpu: Embedded 42 pages/cpu s143360 r0 d28672 u262144 +[ 0.021585] pcpu-alloc: s143360 r0 d28672 u262144 alloc=1*2097152 +[ 0.021587] pcpu-alloc: [0] 00 01 02 03 04 05 06 07 [0] 08 09 10 11 12 13 14 15 +[ 0.021596] pcpu-alloc: [0] 16 17 18 19 20 21 22 23 [0] 24 25 26 27 28 29 30 31 +[ 0.027137] kvm-guest: KVM setup async PF for cpu 0 +[ 0.027144] kvm-guest: stealtime: cpu 0, msr 7d622080 +[ 0.027159] Built 1 zonelists, mobility grouping on. Total pages: 512748 +[ 0.027161] Kernel command line: tsc=reliable no_timer_check rcupdate.rcu_expedited=1 i8042.direct=1 i8042.dumbkbd=1 i8042.nopnp=1 i8042.noaux=1 noreplace-smp reboot=k console=hvc0 console=hvc1 console=ttyS0 cryptomgr.notests net.ifnames=0 pci=lastbus=0 debug panic=1 nr_cpus=32 scsi_mod.scan=none agent.log=debug +[ 0.027288] printk: log_buf_len individual max cpu contribution: 4096 bytes +[ 0.027290] printk: log_buf_len total cpu_extra contributions: 126976 bytes +[ 0.027291] printk: log_buf_len min size: 131072 bytes +[ 0.027523] printk: log_buf_len: 262144 bytes +[ 0.027524] printk: early log buf free: 123296(94%) +[ 0.027737] Dentry cache hash table entries: 262144 (order: 9, 2097152 bytes, linear) +[ 0.027850] Inode-cache hash table entries: 131072 (order: 8, 1048576 bytes, linear) +[ 0.027991] mem auto-init: stack:off, heap alloc:off, heap free:off +[ 0.040909] Memory: 1711324K/2090972K available (10242K kernel code, 956K rwdata, 1456K rodata, 892K init, 3564K bss, 379392K reserved, 0K cma-reserved) +[ 0.041029] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=32, Nodes=1 +[ 0.041170] rcu: Hierarchical RCU implementation. +[ 0.041171] rcu: RCU restricting CPUs from NR_CPUS=240 to nr_cpu_ids=32. +[ 0.041173] All grace periods are expedited (rcu_expedited). +[ 0.041174] Tracing variant of Tasks RCU enabled. +[ 0.041176] rcu: RCU calculated value of scheduler-enlistment delay is 25 jiffies. +[ 0.041177] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=32 +[ 0.041233] NR_IRQS: 15616, nr_irqs: 680, preallocated irqs: 16 +[ 0.041739] rcu: Offload RCU callbacks from CPUs: (none). +[ 0.041913] random: get_random_bytes called from start_kernel+0x2fc/0x4ae with crng_init=0 +[ 0.041995] Console: colour dummy device 80x25 +[ 0.140890] printk: console [ttyS0] enabled +[ 0.154171] AMD Memory Encryption Features active: SEV +[ 0.154858] ACPI: Core revision 20200925 +[ 0.155536] clocksource: hpet: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604467 ns +[ 0.156743] APIC: Switch to symmetric I/O mode setup +[ 0.158619] x2apic enabled +[ 0.160959] Switched APIC routing to physical x2apic. +[ 0.161554] kvm-guest: setup PV IPIs +[ 0.168397] ..TIMER: vector=0x30 apic1=0 pin1=2 apic2=-1 pin2=-1 +[ 0.169300] clocksource: tsc-early: mask: 0xffffffffffffffff max_cycles: 0x2b29812ce43, max_idle_ns: 440795323173 ns +[ 0.170521] Calibrating delay loop (skipped) preset value.. 5988.74 BogoMIPS (lpj=11977488) +[ 0.171487] pid_max: default: 32768 minimum: 301 +[ 0.202181] LSM: Security Framework initializing +[ 0.202548] Mount-cache hash table entries: 4096 (order: 3, 32768 bytes, linear) +[ 0.203685] Mountpoint-cache hash table entries: 4096 (order: 3, 32768 bytes, linear) +[ 0.205011] x86/cpu: User Mode Instruction Prevention (UMIP) activated +[ 0.205802] Last level iTLB entries: 4KB 512, 2MB 255, 4MB 127 +[ 0.206525] Last level dTLB entries: 4KB 512, 2MB 255, 4MB 127, 1GB 0 +[ 0.207435] Spectre V1 : Mitigation: usercopy/swapgs barriers and __user pointer sanitization +[ 0.208419] Spectre V2 : Mitigation: Full AMD retpoline +[ 0.209026] Spectre V2 : Spectre v2 / SpectreRSB mitigation: Filling RSB on context switch +[ 0.209975] Spectre V2 : Enabling Restricted Speculation for firmware calls +[ 0.210523] Spectre V2 : mitigation: Enabling conditional Indirect Branch Prediction Barrier +[ 0.211737] Speculative Store Bypass: Mitigation: Speculative Store Bypass disabled via prctl and seccomp +[ 0.213043] Freeing SMP alternatives memory: 28K +[ 0.213721] smpboot: CPU0: AMD EPYC 7302P 16-Core Processor (family: 0x17, model: 0x31, stepping: 0x0) +[ 0.214519] Performance Events: Fam17h+ core perfctr, AMD PMU driver. +[ 0.214519] ... version: 0 +[ 0.214519] ... bit width: 48 +[ 0.214519] ... generic registers: 6 +[ 0.214519] ... value mask: 0000ffffffffffff +[ 0.214525] ... max period: 00007fffffffffff +[ 0.215142] ... fixed-purpose events: 0 +[ 0.215616] ... event mask: 000000000000003f +[ 0.216346] rcu: Hierarchical SRCU implementation. +[ 0.217174] smp: Bringing up secondary CPUs ... +[ 0.217714] smp: Brought up 1 node, 1 CPU +[ 0.218184] smpboot: Max logical packages: 32 +[ 0.218527] smpboot: Total of 1 processors activated (5988.74 BogoMIPS) +[ 0.219686] devtmpfs: initialized +[ 0.220119] x86/mm: Memory block size: 128MB +[ 0.220864] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns +[ 0.221995] futex hash table entries: 8192 (order: 7, 524288 bytes, linear) +[ 0.222863] NET: Registered protocol family 16 +[ 0.223660] DMA: preallocated 256 KiB GFP_KERNEL pool for atomic allocations +[ 0.224813] DMA: preallocated 256 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations +[ 0.225857] DMA: preallocated 256 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations +[ 0.226565] thermal_sys: Registered thermal governor 'step_wise' +[ 0.226569] cpuidle: using governor menu +[ 0.228447] ACPI: bus type PCI registered +[ 0.228925] acpiphp: ACPI Hot Plug PCI Controller Driver version: 0.5 +[ 0.229775] PCI: MMCONFIG for domain 0000 [bus 00-ff] at [mem 0xb0000000-0xbfffffff] (base 0xb0000000) +[ 0.230527] PCI: MMCONFIG at [mem 0xb0000000-0xbfffffff] reserved in E820 +[ 0.231331] PCI: Using configuration type 1 for base access +[ 0.232839] HugeTLB registered 1.00 GiB page size, pre-allocated 0 pages +[ 0.233641] HugeTLB registered 2.00 MiB page size, pre-allocated 0 pages +[ 0.234545] ACPI: Added _OSI(Module Device) +[ 0.235040] ACPI: Added _OSI(Processor Device) +[ 0.235568] ACPI: Added _OSI(3.0 _SCP Extensions) +[ 0.236115] ACPI: Added _OSI(Processor Aggregator Device) +[ 0.236745] ACPI: Added _OSI(Linux-Dell-Video) +[ 0.237264] ACPI: Added _OSI(Linux-Lenovo-NV-HDMI-Audio) +[ 0.237886] ACPI: Added _OSI(Linux-HPI-Hybrid-Graphics) +[ 0.240277] ACPI: 1 ACPI AML tables successfully acquired and loaded +[ 0.242125] ACPI: Interpreter enabled +[ 0.242530] ACPI: (supports S0 S5) +[ 0.242933] ACPI: Using IOAPIC for interrupt routing +[ 0.243537] PCI: Using host bridge windows from ACPI; if necessary, use "pci=nocrs" and report a bug +[ 0.244744] ACPI: Enabled 2 GPEs in block 00 to 3F +[ 0.250149] ACPI: PCI Root Bridge [PCI0] (domain 0000 [bus 00-ff]) +[ 0.250531] acpi PNP0A08:00: _OSC: OS supports [ExtendedConfig ASPM ClockPM Segments MSI HPX-Type3] +[ 0.251661] acpi PNP0A08:00: _OSC: platform does not support [LTR] +[ 0.252454] acpi PNP0A08:00: _OSC: OS now controls [PCIeHotplug SHPCHotplug PME PCIeCapability] +[ 0.253626] PCI host bridge to bus 0000:00 +[ 0.254115] pci_bus 0000:00: root bus resource [io 0x0000-0x0cf7 window] +[ 0.254526] pci_bus 0000:00: root bus resource [io 0x0d00-0xffff window] +[ 0.255309] pci_bus 0000:00: root bus resource [mem 0x000a0000-0x000bffff window] +[ 0.256179] pci_bus 0000:00: root bus resource [mem 0x80000000-0xafffffff window] +[ 0.257045] pci_bus 0000:00: root bus resource [mem 0xc0000000-0xfebfffff window] +[ 0.257910] pci_bus 0000:00: root bus resource [mem 0x1000000000-0x17ffffffff window] +[ 0.258525] pci_bus 0000:00: root bus resource [bus 00-ff] +[ 0.259223] pci 0000:00:00.0: [8086:29c0] type 00 class 0x060000 +[ 0.260509] pci 0000:00:01.0: [1af4:1043] type 00 class 0x078000 +[ 0.263098] pci 0000:00:01.0: reg 0x14: [mem 0xc0003000-0xc0003fff] +[ 0.267149] pci 0000:00:01.0: reg 0x20: [mem 0x1000000000-0x1000003fff 64bit pref] +[ 0.269843] pci 0000:00:02.0: [1b36:0001] type 01 class 0x060400 +[ 0.275338] pci 0000:00:03.0: [1af4:1048] type 00 class 0x010000 +[ 0.277811] pci 0000:00:03.0: reg 0x14: [mem 0xc0002000-0xc0002fff] +[ 0.281320] pci 0000:00:03.0: reg 0x20: [mem 0x1000004000-0x1000007fff 64bit pref] +[ 0.284951] pci 0000:00:04.0: [1af4:1044] type 00 class 0x00ff00 +[ 0.287749] pci 0000:00:04.0: reg 0x20: [mem 0x1000008000-0x100000bfff 64bit pref] +[ 0.289851] pci 0000:00:05.0: [1af4:1049] type 00 class 0x000200 +[ 0.292301] pci 0000:00:05.0: reg 0x14: [mem 0xc0001000-0xc0001fff] +[ 0.295709] pci 0000:00:05.0: reg 0x20: [mem 0x100000c000-0x100000ffff 64bit pref] +[ 0.298275] pci 0000:00:1f.0: [8086:2918] type 00 class 0x060100 +[ 0.299038] pci 0000:00:1f.0: quirk: [io 0x0600-0x067f] claimed by ICH6 ACPI/GPIO/TCO +[ 0.300211] pci 0000:00:1f.2: [8086:2922] type 00 class 0x010601 +[ 0.306084] pci 0000:00:1f.2: reg 0x20: [io 0x6040-0x605f] +[ 0.307285] pci 0000:00:1f.2: reg 0x24: [mem 0xc0000000-0xc0000fff] +[ 0.309200] pci 0000:00:1f.3: [8086:2930] type 00 class 0x0c0500 +[ 0.312072] pci 0000:00:1f.3: reg 0x20: [io 0x6000-0x603f] +[ 0.314207] pci_bus 0000:01: extended config space not accessible +[ 0.314817] pci 0000:00:02.0: PCI bridge to [bus 01] +[ 0.317358] pci_bus 0000:00: on NUMA node 0 +[ 0.318107] ACPI: PCI Interrupt Link [LNKA] (IRQs 5 *10 11) +[ 0.318611] ACPI: PCI Interrupt Link [LNKB] (IRQs 5 *10 11) +[ 0.319355] ACPI: PCI Interrupt Link [LNKC] (IRQs 5 10 *11) +[ 0.320094] ACPI: PCI Interrupt Link [LNKD] (IRQs 5 10 *11) +[ 0.320826] ACPI: PCI Interrupt Link [LNKE] (IRQs 5 *10 11) +[ 0.321565] ACPI: PCI Interrupt Link [LNKF] (IRQs 5 *10 11) +[ 0.322302] ACPI: PCI Interrupt Link [LNKG] (IRQs 5 10 *11) +[ 0.322608] ACPI: PCI Interrupt Link [LNKH] (IRQs 5 10 *11) +[ 0.323292] ACPI: PCI Interrupt Link [GSIA] (IRQs *16) +[ 0.323908] ACPI: PCI Interrupt Link [GSIB] (IRQs *17) +[ 0.324522] ACPI: PCI Interrupt Link [GSIC] (IRQs *18) +[ 0.325132] ACPI: PCI Interrupt Link [GSID] (IRQs *19) +[ 0.325746] ACPI: PCI Interrupt Link [GSIE] (IRQs *20) +[ 0.326356] ACPI: PCI Interrupt Link [GSIF] (IRQs *21) +[ 0.326533] ACPI: PCI Interrupt Link [GSIG] (IRQs *22) +[ 0.327148] ACPI: PCI Interrupt Link [GSIH] (IRQs *23) +[ 0.329169] iommu: Default domain type: Translated +[ 0.329808] vgaarb: loaded +[ 0.330245] SCSI subsystem initialized +[ 0.330537] pps_core: LinuxPPS API ver. 1 registered +[ 0.331124] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it> +[ 0.332182] PTP clock support registered +[ 0.332667] Registered efivars operations +[ 0.333281] PCI: Using ACPI for IRQ routing +[ 0.333783] PCI: pci_cache_line_size set to 64 bytes +[ 0.334528] e820: reserve RAM buffer [mem 0x00810000-0x008fffff] +[ 0.335230] e820: reserve RAM buffer [mem 0x7f6ef000-0x7fffffff] +[ 0.335932] e820: reserve RAM buffer [mem 0x7fe60000-0x7fffffff] +[ 0.336675] clocksource: Switched to clocksource kvm-clock +[ 0.337485] pnp: PnP ACPI init +[ 0.337896] pnp 00:00: Plug and Play ACPI device, IDs PNP0303 (active) +[ 0.338519] pnp 00:01: Plug and Play ACPI device, IDs PNP0f13 (active) +[ 0.338519] pnp 00:02: Plug and Play ACPI device, IDs PNP0501 (active) +[ 0.338519] pnp 00:03: Plug and Play ACPI device, IDs PNP0b00 (active) +[ 0.338920] system 00:04: [mem 0xb0000000-0xbfffffff window] has been reserved +[ 0.339770] system 00:04: Plug and Play ACPI device, IDs PNP0c01 (active) +[ 0.341103] pnp: PnP ACPI: found 5 devices +[ 0.346943] clocksource: acpi_pm: mask: 0xffffff max_cycles: 0xffffff, max_idle_ns: 2085701024 ns +[ 0.348014] NET: Registered protocol family 2 +[ 0.348722] tcp_listen_portaddr_hash hash table entries: 1024 (order: 2, 16384 bytes, linear) +[ 0.349720] TCP established hash table entries: 16384 (order: 5, 131072 bytes, linear) +[ 0.350698] TCP bind hash table entries: 16384 (order: 6, 262144 bytes, linear) +[ 0.351620] TCP: Hash tables configured (established 16384 bind 16384) +[ 0.352423] UDP hash table entries: 1024 (order: 3, 32768 bytes, linear) +[ 0.353213] UDP-Lite hash table entries: 1024 (order: 3, 32768 bytes, linear) +[ 0.354115] NET: Registered protocol family 1 +[ 0.354654] pci 0000:00:02.0: PCI bridge to [bus 01] +[ 0.357279] pci_bus 0000:00: resource 4 [io 0x0000-0x0cf7 window] +[ 0.358008] pci_bus 0000:00: resource 5 [io 0x0d00-0xffff window] +[ 0.358744] pci_bus 0000:00: resource 6 [mem 0x000a0000-0x000bffff window] +[ 0.359541] pci_bus 0000:00: resource 7 [mem 0x80000000-0xafffffff window] +[ 0.360345] pci_bus 0000:00: resource 8 [mem 0xc0000000-0xfebfffff window] +[ 0.361145] pci_bus 0000:00: resource 9 [mem 0x1000000000-0x17ffffffff window] +[ 0.362089] PCI: CLS 0 bytes, default 64 +[ 0.362638] Trying to unpack rootfs image as initramfs... +[ 2.307254] Freeing initrd memory: 104480K +[ 2.307791] PCI-DMA: Using software bounce buffering for IO (SWIOTLB) +[ 2.308521] software IO TLB: mapped [mem 0x0000000069000000-0x000000006d000000] (64MB) +[ 2.309454] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x2b29812ce43, max_idle_ns: 440795323173 ns +[ 2.311063] workingset: timestamp_bits=46 max_order=19 bucket_order=0 +[ 2.313608] fuse: init (API version 7.32) +[ 2.314181] SGI XFS with security attributes, no debug enabled +[ 2.315435] 9p: Installing v9fs 9p2000 file system support +[ 2.316233] NET: Registered protocol family 38 +[ 2.316827] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 249) +[ 2.317926] shpchp: Standard Hot Plug PCI Controller Driver version: 0.4 +[ 2.318847] input: Power Button as /devices/LNXSYSTM:00/LNXPWRBN:00/input/input0 +[ 2.319752] ACPI: Power Button [PWRF] +[ 2.320661] PCI Interrupt Link [GSIF] enabled at IRQ 21 +[ 2.322549] PCI Interrupt Link [GSIH] enabled at IRQ 23 +[ 2.324157] PCI Interrupt Link [GSIE] enabled at IRQ 20 +[ 2.326555] Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled +[ 2.327388] 00:02: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A +[ 2.341959] software IO TLB: Memory encryption is active and system is using DMA bounce buffers +[ 2.344242] printk: console [hvc0] enabled +[ 2.346335] brd: module loaded +[ 2.347023] random: fast init done +[ 2.347786] random: crng init done +[ 2.349418] loop: module loaded +[ 2.351182] scsi host0: Virtio SCSI HBA +[ 2.352317] VFIO - User Level meta-driver version: 0.3 +[ 2.353380] xt_time: kernel timezone is -0000 +[ 2.354028] IPVS: Registered protocols (TCP, UDP, SCTP, AH, ESP) +[ 2.354873] IPVS: Connection hash table configured (size=4096, memory=64Kbytes) +[ 2.355859] IPVS: ipvs loaded. +[ 2.356319] IPVS: [rr] scheduler registered. +[ 2.356933] IPVS: [wrr] scheduler registered. +[ 2.357542] IPVS: [lc] scheduler registered. +[ 2.358152] IPVS: [wlc] scheduler registered. +[ 2.358787] IPVS: [fo] scheduler registered. +[ 2.359343] IPVS: [ovf] scheduler registered. +[ 2.359968] IPVS: [lblc] scheduler registered. +[ 2.360595] IPVS: [lblcr] scheduler registered. +[ 2.361236] IPVS: [dh] scheduler registered. +[ 2.361846] IPVS: [sh] scheduler registered. +[ 2.362468] IPVS: [sed] scheduler registered. +[ 2.363060] IPVS: [nq] scheduler registered. +[ 2.363623] IPVS: ftp: loaded support on port[0] = 21 +[ 2.364272] IPVS: [sip] pe registered. +[ 2.364967] ipt_CLUSTERIP: ClusterIP Version 0.8 loaded successfully +[ 2.365818] Initializing XFRM netlink socket +[ 2.366474] NET: Registered protocol family 10 +[ 2.367351] Segment Routing with IPv6 +[ 2.367888] NET: Registered protocol family 17 +[ 2.368518] 9pnet: Installing 9P2000 support +[ 2.369955] NET: Registered protocol family 40 +[ 2.370608] IPI shorthand broadcast: enabled +[ 2.371198] sched_clock: Marking stable (2249797515, 120751625)->(2381329269, -10780129) +[ 2.373554] Freeing unused decrypted memory: 2036K +[ 2.374622] Freeing unused kernel image (initmem) memory: 892K +[ 2.375403] Write protecting the kernel read-only data: 14336k +[ 2.377004] Freeing unused kernel image (text/rodata gap) memory: 2044K +[ 2.378219] Freeing unused kernel image (rodata/data gap) memory: 592K +[ 2.379114] Run /init as init process +[ 2.379599] with arguments: +[ 2.380009] /init +[ 2.380321] with environment: +[ 2.380749] HOME=/ +[ 2.381071] TERM=linux +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/959852 b/results/classifier/mode-deepseek-r1:32b/output/system/959852 new file mode 100644 index 00000000..6c950501 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/959852 @@ -0,0 +1,31 @@ + + +Build fails: osx 10.7, deprecated CoreAudio APIs + +Virtual audio driver for darwin is using deprecated APIs. + +○ → ./configure --cc=/usr/bin/gcc --disable-darwin-user --disable-bsd-user --disable-guest-agent + + +○ → make +. +. +. + CC audio/noaudio.o + CC audio/wavaudio.o + CC audio/mixeng.o + CC audio/coreaudio.o +audio/coreaudio.c: In function ‘isPlaying’: +audio/coreaudio.c:152: warning: ‘AudioDeviceGetProperty’ is deprecated (declared at /System/Library/Frameworks/CoreAudio.framework/Headers/AudioHardware.h:2640) +audio/coreaudio.c: In function ‘coreaudio_init_out’: +audio/coreaudio.c:310: warning: ‘AudioHardwareGetProperty’ is deprecated (declared at /System/Library/Frameworks/CoreAudio.framework/Headers/AudioHardware.h:1270) +audio/coreaudio.c:326: warning: ‘AudioDeviceGetProperty’ is deprecated (declared at /System/Library/Frameworks/CoreAudio.framework/Headers/AudioHardware.h:2640) +audio/coreaudio.c:353: warning: ‘AudioDeviceSetProperty’ is deprecated (declared at /System/Library/Frameworks/CoreAudio.framework/Headers/AudioHardware.h:2675) +audio/coreaudio.c:370: warning: ‘AudioDeviceGetProperty’ is deprecated (declared at /System/Library/Frameworks/CoreAudio.framework/Headers/AudioHardware.h:2640) +audio/coreaudio.c:386: warning: ‘AudioDeviceGetProperty’ is deprecated (declared at /System/Library/Frameworks/CoreAudio.framework/Headers/AudioHardware.h:2640) +audio/coreaudio.c:403: warning: ‘AudioDeviceSetProperty’ is deprecated (declared at /System/Library/Frameworks/CoreAudio.framework/Headers/AudioHardware.h:2675) +audio/coreaudio.c:419: warning: ‘AudioDeviceAddIOProc’ is deprecated (declared at /System/Library/Frameworks/CoreAudio.framework/Headers/AudioHardware.h:2419) +audio/coreaudio.c:431: warning: ‘AudioDeviceRemoveIOProc’ is deprecated (declared at /System/Library/Frameworks/CoreAudio.framework/Headers/AudioHardware.h:2433) +audio/coreaudio.c: In function ‘coreaudio_fini_out’: +audio/coreaudio.c:456: warning: ‘AudioDeviceRemoveIOProc’ is deprecated (declared at /System/Library/Frameworks/CoreAudio.framework/Headers/AudioHardware.h:2433) + CC audio/wavcapture.o \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/964 b/results/classifier/mode-deepseek-r1:32b/output/system/964 new file mode 100644 index 00000000..440d0d92 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/964 @@ -0,0 +1,42 @@ + + +arm64 defconfig kernel (4.14.275) no longer boots after FEAT_LPA implementation in TCG +Description of problem: +I am not really sure if this is a bug or merely a scenario where this is not expected to work. After 7a928f43d8724bdf0777d7fc67a5ad973a0bf4bf, the attached `Image.gz` (`ARCH=arm64 defconfig`, based on the latest `linux-4.14.y`) just hangs with no output when using `-cpu max` (or `-cpu max,lpa2=off` due to 69b2265d5fe8e0f401d75e175e0a243a7d505e53). At 0af312b6edd231e1c8d0dec12494a80bc39ac761, `-cpu max` works just fine, as shown by the bisect log below. + +``` +$ git bisect log +# bad: [99eb313ddbbcf73c1adcdadceba1423b691c6d05] ui/cocoa: Use the standard about panel +# good: [44f28df24767cf9dca1ddc9b23157737c4cbb645] Update version for v6.2.0 release +git bisect start '99eb313ddbbcf73c1adcdadceba1423b691c6d05' 'v6.2.0' +# good: [2fc1b44dd0e7ea9ad5920352fd04179e4d6836d9] target/riscv: rvv-1.0: Allow Zve32f extension to be turned on +git bisect good 2fc1b44dd0e7ea9ad5920352fd04179e4d6836d9 +# good: [e64e27d5cb103b7764f1a05b6eda7e7fedd517c5] 9pfs: Fix segfault in do_readdir_many caused by struct dirent overread +git bisect good e64e27d5cb103b7764f1a05b6eda7e7fedd517c5 +# good: [747ffe28cad7129e1d326d943228fdcbe109530d] pnv/xive2: Add support XIVE2 P9-compat mode (or Gen1) +git bisect good 747ffe28cad7129e1d326d943228fdcbe109530d +# bad: [4377683df969e715e3cb2dbd258e44f9ff51f788] edid: Fix clock of Detailed Timing Descriptor +git bisect bad 4377683df969e715e3cb2dbd258e44f9ff51f788 +# good: [755e8d7cb6ce2ba62d282ffbb367de391fe0cc3d] migration: Move static var in ram_block_from_stream() into global +git bisect good 755e8d7cb6ce2ba62d282ffbb367de391fe0cc3d +# bad: [6629bf78aac7e53f83fd0bcbdbe322e2302dfd1f] Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20220302' into staging +git bisect bad 6629bf78aac7e53f83fd0bcbdbe322e2302dfd1f +# good: [0af312b6edd231e1c8d0dec12494a80bc39ac761] target/arm: Implement FEAT_LVA +git bisect good 0af312b6edd231e1c8d0dec12494a80bc39ac761 +# bad: [dc8bc9d6574aa563ed2fcc0ff495e77a2a2a8faa] target/arm: Report KVM's actual PSCI version to guest in dtb +git bisect bad dc8bc9d6574aa563ed2fcc0ff495e77a2a2a8faa +# bad: [d976de218c534735e307fc4a6c03e3ae764fd419] target/arm: Fix TLBIRange.base for 16k and 64k pages +git bisect bad d976de218c534735e307fc4a6c03e3ae764fd419 +# bad: [13e481c9335582fc7eed12e24e8d4d7068b24ff8] target/arm: Extend arm_fi_to_lfsc to level -1 +git bisect bad 13e481c9335582fc7eed12e24e8d4d7068b24ff8 +# bad: [7a928f43d8724bdf0777d7fc67a5ad973a0bf4bf] target/arm: Implement FEAT_LPA +git bisect bad 7a928f43d8724bdf0777d7fc67a5ad973a0bf4bf +# first bad commit: [7a928f43d8724bdf0777d7fc67a5ad973a0bf4bf] target/arm: Implement FEAT_LPA +``` + +A `4.19.237` kernel boots right up with `-cpu max`/`-cpu max,lpa2=off`. Is this expected behavior given the age of the kernel or is there something else going on here? If this is expected, should we be using something like `-cpu cortex-a72` for these older kernels? +Steps to reproduce: +Run the above command with the attached `Image.gz` and `rootfs.cpio`. +Additional information: +[Image.gz](/uploads/7b25b70f210354663b8e391290d3f39c/Image.gz) +[rootfs.cpio](/uploads/4793be1a500bdf615e212d3379c4c175/rootfs.cpio) diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/965133 b/results/classifier/mode-deepseek-r1:32b/output/system/965133 new file mode 100644 index 00000000..9d7c80f5 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/965133 @@ -0,0 +1,39 @@ + + +Sparc64 crash on start + +qemu version 1.0.1 compiled on a Ubuntu live on a HP laptop win a x64 architecture. + +With more than 4G of memory sparc64 machine crash on start. + +command line: qemu-system-sparc64 -m 4G + +output: +VNC server running on `127.0.0.1:5900' +qemu: fatal: Trap 0x0064 while trap level (5) >= MAXTL (5), Error state +pc: 00000000ffd04c80 npc: 00000000ffd04c84 +General Registers: +%g0-3: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +%g4-7: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 + +Current Register Window: +%o0-3: 00000000ffd00000 0000000000080000 0000000000080000 0000000000000000 +%o4-7: 0000000000000000 0000000000000000 00000000fff754e1 00000000ffd144d4 +%l0-3: 0000000100000000 00000000fff75c4d 0000000000000000 0000000000000000 +%l4-7: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +%i0-3: 0000000000000000 0000000000000000 0000000100000000 0000000000000036 +%i4-7: 00000000ffe87418 00000000ffe87648 00000000fff75591 00000000ffd0bf54 + +Floating Point Registers: +%f00: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +%f08: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +%f16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +%f24: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +%f32: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +%f40: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +%f48: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +%f56: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +pstate: 00000414 ccr: 99 (icc: N--C xcc: N--C) asi: 00 tl: 5 pil: 0 +cansave: 5 canrestore: 1 otherwin: 0 wstate: 0 cleanwin: 6 cwp: 3 +fsr: 0000000000000000 y: 0000000000000000 fprs: 0000000000000000 +Aborted (core dumped) \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/965327 b/results/classifier/mode-deepseek-r1:32b/output/system/965327 new file mode 100644 index 00000000..8747c1f2 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/965327 @@ -0,0 +1,738 @@ + + +virtio-pci: can't reserve io 0x0000-0x001f + +Before 2012-03-05 I was able to successfully enable a virtio-pci block device from a sPAPR pseries ppc64 Linux guest. With the current git master branch after this date I get the following error: + +virtio-pci 0000:00:00.0: device not available (can't reserve [io 0x0000-0x001f]) +virtio-pci: probe of 0000:00:00.0 failed with error -22 +virtio-pci 0000:00:01.0: device not available (can't reserve [io 0x0000-0x003f]) +virtio-pci: probe of 0000:00:01.0 failed with error -22 + + +Full details: + +----------------- +command line: +----------------- + ./testing/qemu/ppc64-softmmu/qemu-system-ppc64 \ + -L ./testing/qemu/pc-bios \ + -M pseries \ + -m 1024 \ + -rtc base=localtime \ + -parallel none \ + -netdev type=user,id=mynet0,hostfwd=tcp:127.0.0.1:9011-10.0.2.11:22 \ + -device virtio-net-pci,netdev=mynet0 \ + -drive file=images/suse-ppc.img,if=virtio,index=0,media=disk,cache=unsafe \ + -kernel images/iso/suseboot/vmlinux \ + -append "root=/dev/mapper/system-root ro audit=0 selinux=0 apparmor=0 console=tty0 console=ttyPZ0" \ + -initrd images/iso/suseboot/initrd.img \ + -gdb tcp::1234 + + +------------------------------------------------------ +BEFORE virtio-pci "bug/user error?" introduced: +------------------------------------------------------ +sPAPR memory map: +RTAS : 0x3fff0000..3fff0013 +FDT : 0x3ffe0000..3ffeffff +Kernel : 0x00400000..01abad7b +Ramdisk : 0x01ad0000..02053df7 +Firmware load : 0x00000000..000d6ec0 +Firmware runtime : 0x3d7e0000..3ffe0000 +sPAPR reset + +SLOF ********************************************************************** +QEMU Starting +Build Date = Mar 3 2012 21:46:40 + FW Version = git-440e662879c4fc3c + Press "s" to enter Open Firmware. + +Populating /vdevice methods +Populating /vdevice/v-scsi@2000 +VSCSI: Initializing +VSCSI: Looking for disks + SCSI ID 2 CD-ROM : "QEMU QEMU CD-ROM 1.0." +Populating /vdevice/vty@30000000 +Populating /pci@0,0 + Adapters on 0000000000000000 + 00 0000 (D) : 1af4 1000 virtio [ net ] + 00 0800 (D) : 1af4 1001 virtio [ block ] +No NVRAM common partition, re-initializing... +Using default console: /vdevice/vty@30000000 +Detected RAM kernel at 400000 (16bad7c bytes) + + Welcome to Open Firmware + + Copyright (c) 2004, 2011 IBM Corporation All rights reserved. + This program and the accompanying materials are made available + under the terms of the BSD License available at + http://www.opensource.org/licenses/bsd-license.php + +Booting from memory... +OF stdout device is: /vdevice/vty@30000000 +Preparing to boot Linux version 3.2.0-2-ppc64 (geeko@buildhost) (gcc version 4.6.2 20111212 [gcc-4_6-branch revision 182222] (SUSE Linux) ) #1 SMP Wed Jan 25 10:51:08 UTC 2012 (2206a5c) +Detected machine type: 0000000000000101 +Max number of cores passed to firmware: 1024 (NR_CPUS = 1024) +Calling ibm,client-architecture-support... not implemented +couldn't open /packages/elf-loader +command line: root=/dev/mapper/system-root ro audit=0 selinux=0 apparmor=0 console=tty0 console=ttyPZ0 +memory layout at init: + memory_limit : 0000000000000000 (16 MB aligned) + alloc_bottom : 0000000001ad0000 + alloc_top : 0000000030000000 + alloc_top_hi : 0000000040000000 + rmo_top : 0000000030000000 + ram_top : 0000000040000000 +instantiating rtas at 0x000000002fff0000... done +Querying for OPAL presence... not there. +boot cpu hw idx 0 +copying OF device tree... +Building dt strings... +Building dt structure... +Device tree strings 0x00000000020e0000 -> 0x00000000020e0635 +Device tree struct 0x00000000020f0000 -> 0x0000000002100000 +Calling quiesce... +returning from prom_init +Using pSeries machine description +Using 1TB segments +Found initrd at 0xc000000001ad0000:0xc000000002053df8 +bootconsole [udbg0] enabled +CPU maps initialized for 1 thread per core +Starting Linux PPC64 #1 SMP Wed Jan 25 10:51:08 UTC 2012 (2206a5c) +----------------------------------------------------- +ppc64_pft_size = 0x18 +physicalMemorySize = 0x40000000 +htab_hash_mask = 0x1ffff +----------------------------------------------------- +Initializing cgroup subsys cpuset +Initializing cgroup subsys cpu +Linux version 3.2.0-2-ppc64 (geeko@buildhost) (gcc version 4.6.2 20111212 [gcc-4_6-branch revision 182222] (SUSE Linux) ) #1 SMP Wed Jan 25 10:51:08 UTC 2012 (2206a5c) +CF000012 +Setup Arch[boot]0012 Setup Arch +PCI host bridge /pci@0,0 ranges: + IO 0x0000010080000000..0x000001008000ffff -> 0x0000000000000000 + MEM 0x00000100a0000000..0x00000100bfffffff -> 0x0000000080000000 +Zone PFN ranges: + DMA 0x00000000 -> 0x00004000 + Normal empty +Movable zone start PFN for each node +early_node_map[1] active PFN ranges + 0: 0x00000000 -> 0x00004000 +CF000015 +Setup Done[boot]0015 Setup Done +PERCPU: Embedded 2 pages/cpu @c000000002200000 s83840 r0 d47232 u1048576 +Built 1 zonelists in Node order, mobility grouping on. Total pages: 16370 +Policy zone: DMA +Kernel command line: root=/dev/mapper/system-root ro audit=0 selinux=0 apparmor=0 console=tty0 console=ttyPZ0 +audit: disabled (until reboot) +PID hash table entries: 4096 (order: -1, 32768 bytes) +freeing bootmem node 0 +Memory: 1014336k/1048576k available (18112k kernel code, 34240k reserved, 2048k data, 3115k bss, 6272k init) +Hierarchical RCU implementation. + CONFIG_RCU_FANOUT set to non-default value of 32 + RCU dyntick-idle grace-period acceleration is enabled. +NR_IRQS:512 nr_irqs:512 16 +clocksource: timebase mult[7d0000] shift[22] registered +Console: colour dummy device 80x25 +console [tty0] enabled +Using pSeries machine description +Using 1TB segments +Found initrd at 0xc000000001ad0000:0xc000000002053df8 +bootconsole [udbg0] enabled +CPU maps initialized for 1 thread per core +Starting Linux PPC64 #1 SMP Wed Jan 25 10:51:08 UTC 2012 (2206a5c) +----------------------------------------------------- +ppc64_pft_size = 0x18 +physicalMemorySize = 0x40000000 +htab_hash_mask = 0x1ffff +----------------------------------------------------- +Initializing cgroup subsys cpuset +Initializing cgroup subsys cpu +Linux version 3.2.0-2-ppc64 (geeko@buildhost) (gcc version 4.6.2 20111212 [gcc-4_6-branch revision 182222] (SUSE Linux) ) #1 SMP Wed Jan 25 10:51:08 UTC 2012 (2206a5c) +[boot]0012 Setup Arch +PCI host bridge /pci@0,0 ranges: + IO 0x0000010080000000..0x000001008000ffff -> 0x0000000000000000 + MEM 0x00000100a0000000..0x00000100bfffffff -> 0x0000000080000000 +Zone PFN ranges: + DMA 0x00000000 -> 0x00004000 + Normal empty +Movable zone start PFN for each node +early_node_map[1] active PFN ranges + 0: 0x00000000 -> 0x00004000 +[boot]0015 Setup Done +PERCPU: Embedded 2 pages/cpu @c000000002200000 s83840 r0 d47232 u1048576 +Built 1 zonelists in Node order, mobility grouping on. Total pages: 16370 +Policy zone: DMA +Kernel command line: root=/dev/mapper/system-root ro audit=0 selinux=0 apparmor=0 console=tty0 console=ttyPZ0 +audit: disabled (until reboot) +PID hash table entries: 4096 (order: -1, 32768 bytes) +freeing bootmem node 0 +Memory: 1014336k/1048576k available (18112k kernel code, 34240k reserved, 2048k data, 3115k bss, 6272k init) +Hierarchical RCU implementation. + CONFIG_RCU_FANOUT set to non-default value of 32 + RCU dyntick-idle grace-period acceleration is enabled. +NR_IRQS:512 nr_irqs:512 16 +clocksource: timebase mult[7d0000] shift[22] registered +Console: colour dummy device 80x25 +console [tty0] enabled +console [hvc0] enabled +console [hvc0] enabled +allocated 524288 bytes of page_cgroup +allocated 524288 bytes of page_cgroup +please try 'cgroup_disable=memory' option if you don't want memory cgroups +please try 'cgroup_disable=memory' option if you don't want memory cgroups +pid_max: default: 32768 minimum: 301 +pid_max: default: 32768 minimum: 301 +Security Framework initialized +Security Framework initialized +AppArmor: AppArmor disabled by boot time parameter +AppArmor: AppArmor disabled by boot time parameter +Dentry cache hash table entries: 131072 (order: 4, 1048576 bytes) +Dentry cache hash table entries: 131072 (order: 4, 1048576 bytes) +Inode-cache hash table entries: 65536 (order: 3, 524288 bytes) +Inode-cache hash table entries: 65536 (order: 3, 524288 bytes) +Mount-cache hash table entries: 4096 +Mount-cache hash table entries: 4096 +Initializing cgroup subsys cpuacct +Initializing cgroup subsys cpuacct +Initializing cgroup subsys memory +Initializing cgroup subsys memory +Initializing cgroup subsys devices +Initializing cgroup subsys devices +Initializing cgroup subsys freezer +Initializing cgroup subsys freezer +Initializing cgroup subsys net_cls +Initializing cgroup subsys net_cls +Initializing cgroup subsys blkio +Initializing cgroup subsys blkio +Initializing cgroup subsys perf_event +Initializing cgroup subsys perf_event +POWER7 performance monitor hardware support registered +POWER7 performance monitor hardware support registered +Brought up 1 CPUs +Brought up 1 CPUs +Enabling Asymmetric SMT scheduling +Enabling Asymmetric SMT scheduling +devtmpfs: initialized +devtmpfs: initialized +print_constraints: dummy: +print_constraints: dummy: +NET: Registered protocol family 16 +NET: Registered protocol family 16 +IBM eBus Device Driver +IBM eBus Device Driver +nvram: No room to create ibm,rtas-log partition, deleting any obsolete OS partitions... +nvram: No room to create ibm,rtas-log partition, deleting any obsolete OS partitions... +nvram: Failed to find or create ibm,rtas-log partition, err -28 +nvram: Failed to find or create ibm,rtas-log partition, err -28 +nvram: No room to create lnx,oops-log partition, deleting any obsolete OS partitions... +nvram: No room to create lnx,oops-log partition, deleting any obsolete OS partitions... +nvram: Failed to find or create lnx,oops-log partition, err -28 +nvram: Failed to find or create lnx,oops-log partition, err -28 +SUSE Linux +#1 SMP Wed Jan 2CPU Hotplug not supported by firmware - disabling. +CPU Hotplug not supported by firmware - disabling. +PCI: Probing PCI hardware +PCI: Probing PCI hardware +pci_dma_dev_setup_pSeriesLP: no DMA window found for pci dev=0000:00:00.0 dn=/pci@0,0/ethernet@0 +pci_dma_dev_setup_pSeriesLP: no DMA window found for pci dev=0000:00:00.0 dn=/pci@0,0/ethernet@0 +pci_dma_dev_setup_pSeriesLP: no DMA window found for pci dev=0000:00:01.0 dn=/pci@0,0/scsi@1 +pci_dma_dev_setup_pSeriesLP: no DMA window found for pci dev=0000:00:01.0 dn=/pci@0,0/scsi@1 +opal: Node not found +opal: Node not found +bio: create slab <bio-0> at 0 +bio: create slab <bio-0> at 0 +vgaarb: loaded +vgaarb: loaded +usbcore: registered new interface driver usbfs +usbcore: registered new interface driver usbfs +usbcore: registered new interface driver hub +usbcore: registered new interface driver hub +usbcore: registered new device driver usb +usbcore: registered new device driver usb +NetLabel: Initializing +NetLabel: Initializing +NetLabel: domain hash size = 128 +NetLabel: domain hash size = 128 +NetLabel: protocols = UNLABELED CIPSOv4 +NetLabel: protocols = UNLABELED CIPSOv4 +NetLabel: unlabeled traffic allowed by default +NetLabel: unlabeled traffic allowed by default +Switching to clocksource timebase +Switching to clocksource timebase +NET: Registered protocol family 2 +NET: Registered protocol family 2 +IP route cache hash table entries: 8192 (order: 0, 65536 bytes) +IP route cache hash table entries: 8192 (order: 0, 65536 bytes) +TCP established hash table entries: 32768 (order: 3, 524288 bytes) +TCP established hash table entries: 32768 (order: 3, 524288 bytes) +TCP bind hash table entries: 32768 (order: 3, 524288 bytes) +TCP bind hash table entries: 32768 (order: 3, 524288 bytes) +TCP: Hash tables configured (established 32768 bind 32768) +TCP: Hash tables configured (established 32768 bind 32768) +TCP reno registered +TCP reno registered +UDP hash table entries: 2048 (order: 0, 65536 bytes) +UDP hash table entries: 2048 (order: 0, 65536 bytes) +UDP-Lite hash table entries: 2048 (order: 0, 65536 bytes) +UDP-Lite hash table entries: 2048 (order: 0, 65536 bytes) +NET: Registered protocol family 1 +NET: Registered protocol family 1 +Unpacking initramfs... +Unpacking initramfs... +Freeing initrd memory: 5696k freed +Freeing initrd memory: 5696k freed +rtasd: No event-scan on system +rtasd: No event-scan on system +rtas_flash: no firmware flash support +rtas_flash: no firmware flash support +IOMMU table initialized, virtual merging enabled +IOMMU table initialized, virtual merging enabled +vio 30000000: Warning: IOMMU dma not supported: mask 0xffffffffffffffff, table unavailable +vio 30000000: Warning: IOMMU dma not supported: mask 0xffffffffffffffff, table unavailable +HugeTLB registered 16 MB page size, pre-allocated 0 pages +HugeTLB registered 16 MB page size, pre-allocated 0 pages +VFS: Disk quotas dquot_6.5.2 +VFS: Disk quotas dquot_6.5.2 +Dquot-cache hash table entries: 8192 (order 0, 65536 bytes) +Dquot-cache hash table entries: 8192 (order 0, 65536 bytes) +msgmni has been set to 1992 +msgmni has been set to 1992 +Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253) +Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253) +io scheduler noop registered +io scheduler noop registered +io scheduler deadline registered +io scheduler deadline registered +io scheduler cfq registered (default) +io scheduler cfq registered (default) +pci_hotplug: PCI Hot Plug PCI Core version: 0.5 +pci_hotplug: PCI Hot Plug PCI Core version: 0.5 +rpaphp: RPA HOT Plug PCI Controller Driver version: 0.1 +rpaphp: RPA HOT Plug PCI Controller Driver version: 0.1 +rpadlpar_io_init: partition not DLPAR capable +rpadlpar_io_init: partition not DLPAR capable +Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled +Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled +pmac_zilog: 0.6 (Benjamin Herrenschmidt <email address hidden>) +pmac_zilog: 0.6 (Benjamin Herrenschmidt <email address hidden>) +Fixed MDIO Bus: probed +Fixed MDIO Bus: probed +arcnet loaded. +arcnet loaded. +ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver +ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver +ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver +ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver +mousedev: PS/2 mouse device common for all mice +mousedev: PS/2 mouse device common for all mice +EDAC MC: Ver: 2.1.0 +EDAC MC: Ver: 2.1.0 +usbcore: registered new interface driver usbhid +usbcore: registered new interface driver usbhid +usbhid: USB HID core driver +usbhid: USB HID core driver +TCP cubic registered +TCP cubic registered +NET: Registered protocol family 10 +NET: Registered protocol family 10 +NET: Registered protocol family 15 +NET: Registered protocol family 15 +lib80211: common routines for IEEE802.11 drivers +lib80211: common routines for IEEE802.11 drivers +Registering the dns_resolver key type +Registering the dns_resolver key type +libceph: loaded (mon/osd proto 15/24, osdmap 5/6 5/6) +libceph: loaded (mon/osd proto 15/24, osdmap 5/6 5/6) +turn off boot console udbg0 +turn off boot console udbg0 +registered taskstats version 1 +/home/abuild/rpmbuild/BUILD/kernel-ppc64-3.2.0/linux-3.2/drivers/rtc/hctosys.c: unable to open rtc device (rtc0) +Freeing unused kernel memory: 6272k freed +doing fast boot +device-mapper: uevent: version 1.0.3 +device-mapper: ioctl: 4.22.0-ioctl (2011-10-19) initialised: <email address hidden> +SCSI subsystem initialized +alua: device handler registered +rdac: device handler registered +hp_sw: device handler registered +emc: device handler registered +Creating device nodes with udev +udevd[78]: starting version 173 +virtio-pci 0000:00:00.0: enabling device (0100 -> 0101) +virtio-pci 0000:00:01.0: enabling device (0100 -> 0101) +udevd[95]: failed to execute '/etc/sysconfig/network/scripts/ifup-sysctl' '/etc/sysconfig/network/scripts/ifup-sysctl lo -o hotplug': No such file or directory + + vda: [mac] vda1 vda2 vda3 vda4 +mount: devpts already mounted or /dev/pts busy +mount: according to mtab, devpts is already mounted on /dev/pts +Boot logging started on /dev/hvc0(/dev/console) at Mon Mar 26 10:04:22 2012 +md: linear personality registered for level -1 + 3 logical volume(s) in volume group "system" now active + 3 logical volume(s) in volume group "system" now active +resume device not found (ignoring) +Waiting for device /dev/mapper/system-root to appear: ok +fsck from util-linux 2.21 +[/sbin/fsck.ext4 (1) -- /] fsck.ext4 -a /dev/mapper/system-root + +[...continues normally...] + + +------------------------------------------------------ +AFTER virtio-pci "bug/user error?" introduced: +------------------------------------------------------ +sPAPR memory map: +RTAS : 0x3fff0000..3fff0013 +FDT : 0x3ffe0000..3ffeffff +Kernel : 0x00400000..01abad7b +Ramdisk : 0x01ad0000..02053df7 +Firmware load : 0x00000000..000d6ec0 +Firmware runtime : 0x3d7e0000..3ffe0000 +sPAPR reset + +SLOF ********************************************************************** +QEMU Starting +Build Date = Mar 3 2012 21:46:40 + FW Version = git-440e662879c4fc3c + Press "s" to enter Open Firmware. + +Populating /vdevice methods +Populating /vdevice/v-scsi@2000 +VSCSI: Initializing +VSCSI: Looking for disks +Populating /vdevice/vty@30000000 +Populating /pci@800000020000001,0 + Adapters on 0800000020000001 + 00 0000 (D) : 1af4 1000 virtio [ net ] + 00 0800 (D) : 1af4 1001 virtio [ block ] +No NVRAM common partition, re-initializing... +Using default console: /vdevice/vty@30000000 +Detected RAM kernel at 400000 (16bad7c bytes) + + Welcome to Open Firmware + + Copyright (c) 2004, 2011 IBM Corporation All rights reserved. + This program and the accompanying materials are made available + under the terms of the BSD License available at + http://www.opensource.org/licenses/bsd-license.php + +Booting from memory... +OF stdout device is: /vdevice/vty@30000000 +Preparing to boot Linux version 3.2.0-2-ppc64 (geeko@buildhost) (gcc version 4.6.2 20111212 [gcc-4_6-branch revision 182222] (SUSE Linux) ) #1 SMP Wed Jan 25 10:51:08 UTC 2012 (2206a5c) +Detected machine type: 0000000000000101 +Max number of cores passed to firmware: 1024 (NR_CPUS = 1024) +Calling ibm,client-architecture-support... not implemented +couldn't open /packages/elf-loader +command line: root=/dev/mapper/system-root ro audit=0 selinux=0 apparmor=0 console=tty0 console=ttyPZ0 +memory layout at init: + memory_limit : 0000000000000000 (16 MB aligned) + alloc_bottom : 0000000001ad0000 + alloc_top : 0000000030000000 + alloc_top_hi : 0000000040000000 + rmo_top : 0000000030000000 + ram_top : 0000000040000000 +instantiating rtas at 0x000000002fff0000... done +Querying for OPAL presence... not there. +boot cpu hw idx 0 +copying OF device tree... +Building dt strings... +Building dt structure... +Device tree strings 0x00000000020e0000 -> 0x00000000020e062f +Device tree struct 0x00000000020f0000 -> 0x0000000002100000 +Calling quiesce... +returning from prom_init +Using pSeries machine description +Using 1TB segments +Found initrd at 0xc000000001ad0000:0xc000000002053df8 +bootconsole [udbg0] enabled +CPU maps initialized for 1 thread per core +Starting Linux PPC64 #1 SMP Wed Jan 25 10:51:08 UTC 2012 (2206a5c) +----------------------------------------------------- +ppc64_pft_size = 0x18 +physicalMemorySize = 0x40000000 +htab_hash_mask = 0x1ffff +----------------------------------------------------- +Initializing cgroup subsys cpuset +Initializing cgroup subsys cpu +Linux version 3.2.0-2-ppc64 (geeko@buildhost) (gcc version 4.6.2 20111212 [gcc-4_6-branch revision 182222] (SUSE Linux) ) #1 SMP Wed Jan 25 10:51:08 UTC 2012 (2206a5c) +CF000012 +Setup Arch[boot]0012 Setup Arch +PCI host bridge /pci@800000020000001,0 ranges: + IO 0x0000000000000100..0x80000000000000ff -> 0xa0fa220000000000 +Zone PFN ranges: + DMA 0x00000000 -> 0x00004000 + Normal empty +Movable zone start PFN for each node +early_node_map[1] active PFN ranges + 0: 0x00000000 -> 0x00004000 +CF000015 +Setup Done[boot]0015 Setup Done +PERCPU: Embedded 2 pages/cpu @c000000002200000 s83840 r0 d47232 u1048576 +Built 1 zonelists in Node order, mobility grouping on. Total pages: 16370 +Policy zone: DMA +Kernel command line: root=/dev/mapper/system-root ro audit=0 selinux=0 apparmor=0 console=tty0 console=ttyPZ0 +audit: disabled (until reboot) +PID hash table entries: 4096 (order: -1, 32768 bytes) +freeing bootmem node 0 +Memory: 1014336k/1048576k available (18112k kernel code, 34240k reserved, 2048k data, 3115k bss, 6272k init) +Hierarchical RCU implementation. + CONFIG_RCU_FANOUT set to non-default value of 32 + RCU dyntick-idle grace-period acceleration is enabled. +NR_IRQS:512 nr_irqs:512 16 +clocksource: timebase mult[7d0000] shift[22] registered +Console: colour dummy device 80x25 +console [tty0] enabled +Using pSeries machine description +Using 1TB segments +Found initrd at 0xc000000001ad0000:0xc000000002053df8 +bootconsole [udbg0] enabled +CPU maps initialized for 1 thread per core +Starting Linux PPC64 #1 SMP Wed Jan 25 10:51:08 UTC 2012 (2206a5c) +----------------------------------------------------- +ppc64_pft_size = 0x18 +physicalMemorySize = 0x40000000 +htab_hash_mask = 0x1ffff +----------------------------------------------------- +Initializing cgroup subsys cpuset +Initializing cgroup subsys cpu +Linux version 3.2.0-2-ppc64 (geeko@buildhost) (gcc version 4.6.2 20111212 [gcc-4_6-branch revision 182222] (SUSE Linux) ) #1 SMP Wed Jan 25 10:51:08 UTC 2012 (2206a5c) +[boot]0012 Setup Arch +PCI host bridge /pci@800000020000001,0 ranges: + IO 0x0000000000000100..0x80000000000000ff -> 0xa0fa220000000000 +Zone PFN ranges: + DMA 0x00000000 -> 0x00004000 + Normal empty +Movable zone start PFN for each node +early_node_map[1] active PFN ranges + 0: 0x00000000 -> 0x00004000 +[boot]0015 Setup Done +PERCPU: Embedded 2 pages/cpu @c000000002200000 s83840 r0 d47232 u1048576 +Built 1 zonelists in Node order, mobility grouping on. Total pages: 16370 +Policy zone: DMA +Kernel command line: root=/dev/mapper/system-root ro audit=0 selinux=0 apparmor=0 console=tty0 console=ttyPZ0 +audit: disabled (until reboot) +PID hash table entries: 4096 (order: -1, 32768 bytes) +freeing bootmem node 0 +Memory: 1014336k/1048576k available (18112k kernel code, 34240k reserved, 2048k data, 3115k bss, 6272k init) +Hierarchical RCU implementation. + CONFIG_RCU_FANOUT set to non-default value of 32 + RCU dyntick-idle grace-period acceleration is enabled. +NR_IRQS:512 nr_irqs:512 16 +clocksource: timebase mult[7d0000] shift[22] registered +Console: colour dummy device 80x25 +console [tty0] enabled +console [hvc0] enabled +console [hvc0] enabled +allocated 524288 bytes of page_cgroup +allocated 524288 bytes of page_cgroup +please try 'cgroup_disable=memory' option if you don't want memory cgroups +please try 'cgroup_disable=memory' option if you don't want memory cgroups +pid_max: default: 32768 minimum: 301 +pid_max: default: 32768 minimum: 301 +Security Framework initialized +Security Framework initialized +AppArmor: AppArmor disabled by boot time parameter +AppArmor: AppArmor disabled by boot time parameter +Dentry cache hash table entries: 131072 (order: 4, 1048576 bytes) +Dentry cache hash table entries: 131072 (order: 4, 1048576 bytes) +Inode-cache hash table entries: 65536 (order: 3, 524288 bytes) +Inode-cache hash table entries: 65536 (order: 3, 524288 bytes) +Mount-cache hash table entries: 4096 +Mount-cache hash table entries: 4096 +Initializing cgroup subsys cpuacct +Initializing cgroup subsys cpuacct +Initializing cgroup subsys memory +Initializing cgroup subsys memory +Initializing cgroup subsys devices +Initializing cgroup subsys devices +Initializing cgroup subsys freezer +Initializing cgroup subsys freezer +Initializing cgroup subsys net_cls +Initializing cgroup subsys net_cls +Initializing cgroup subsys blkio +Initializing cgroup subsys blkio +Initializing cgroup subsys perf_event +Initializing cgroup subsys perf_event +POWER7 performance monitor hardware support registered +POWER7 performance monitor hardware support registered +Brought up 1 CPUs +Brought up 1 CPUs +Enabling Asymmetric SMT scheduling +Enabling Asymmetric SMT scheduling +devtmpfs: initialized +devtmpfs: initialized +print_constraints: dummy: +print_constraints: dummy: +NET: Registered protocol family 16 +NET: Registered protocol family 16 +IBM eBus Device Driver +IBM eBus Device Driver +nvram: No room to create ibm,rtas-log partition, deleting any obsolete OS partitions... +nvram: No room to create ibm,rtas-log partition, deleting any obsolete OS partitions... +nvram: Failed to find or create ibm,rtas-log partition, err -28 +nvram: Failed to find or create ibm,rtas-log partition, err -28 +nvram: No room to create lnx,oops-log partition, deleting any obsolete OS partitions... +nvram: No room to create lnx,oops-log partition, deleting any obsolete OS partitions... +nvram: Failed to find or create lnx,oops-log partition, err -28 +nvram: Failed to find or create lnx,oops-log partition, err -28 +SUSE Linux +#1 SMP Wed Jan 2CPU Hotplug not supported by firmware - disabling. +CPU Hotplug not supported by firmware - disabling. +PCI: Probing PCI hardware +PCI: Probing PCI hardware +vmap allocation for size 2376249136786767872 failed: use vmalloc=<size> to increase size. +vmap allocation for size 2376249136786767872 failed: use vmalloc=<size> to increase size. +PCI: Memory resource 0 not set for host bridge /pci@800000020000001,0 (domain 0) +PCI: Memory resource 0 not set for host bridge /pci@800000020000001,0 (domain 0) +pci_dma_dev_setup_pSeriesLP: no DMA window found for pci dev=0000:00:00.0 dn=/pci@800000020000001,0/ethernet@0 +pci_dma_dev_setup_pSeriesLP: no DMA window found for pci dev=0000:00:00.0 dn=/pci@800000020000001,0/ethernet@0 +pci_dma_dev_setup_pSeriesLP: no DMA window found for pci dev=0000:00:01.0 dn=/pci@800000020000001,0/scsi@1 +pci_dma_dev_setup_pSeriesLP: no DMA window found for pci dev=0000:00:01.0 dn=/pci@800000020000001,0/scsi@1 +PCI: Cannot allocate resource region 0 of device 0000:00:00.0, will remap +PCI: Cannot allocate resource region 0 of device 0000:00:00.0, will remap +PCI: Cannot allocate resource region 6 of device 0000:00:00.0, will remap +PCI: Cannot allocate resource region 6 of device 0000:00:00.0, will remap +PCI: Cannot allocate resource region 0 of device 0000:00:01.0, will remap +PCI: Cannot allocate resource region 0 of device 0000:00:01.0, will remap +opal: Node not found +opal: Node not found +bio: create slab <bio-0> at 0 +bio: create slab <bio-0> at 0 +vgaarb: loaded +vgaarb: loaded +usbcore: registered new interface driver usbfs +usbcore: registered new interface driver usbfs +usbcore: registered new interface driver hub +usbcore: registered new interface driver hub +usbcore: registered new device driver usb +usbcore: registered new device driver usb +NetLabel: Initializing +NetLabel: Initializing +NetLabel: domain hash size = 128 +NetLabel: domain hash size = 128 +NetLabel: protocols = UNLABELED CIPSOv4 +NetLabel: protocols = UNLABELED CIPSOv4 +NetLabel: unlabeled traffic allowed by default +NetLabel: unlabeled traffic allowed by default +Switching to clocksource timebase +Switching to clocksource timebase +NET: Registered protocol family 2 +NET: Registered protocol family 2 +IP route cache hash table entries: 8192 (order: 0, 65536 bytes) +IP route cache hash table entries: 8192 (order: 0, 65536 bytes) +TCP established hash table entries: 32768 (order: 3, 524288 bytes) +TCP established hash table entries: 32768 (order: 3, 524288 bytes) +TCP bind hash table entries: 32768 (order: 3, 524288 bytes) +TCP bind hash table entries: 32768 (order: 3, 524288 bytes) +TCP: Hash tables configured (established 32768 bind 32768) +TCP: Hash tables configured (established 32768 bind 32768) +TCP reno registered +TCP reno registered +UDP hash table entries: 2048 (order: 0, 65536 bytes) +UDP hash table entries: 2048 (order: 0, 65536 bytes) +UDP-Lite hash table entries: 2048 (order: 0, 65536 bytes) +UDP-Lite hash table entries: 2048 (order: 0, 65536 bytes) +NET: Registered protocol family 1 +NET: Registered protocol family 1 +Unpacking initramfs... +Unpacking initramfs... +Freeing initrd memory: 5696k freed +Freeing initrd memory: 5696k freed +rtasd: No event-scan on system +rtasd: No event-scan on system +rtas_flash: no firmware flash support +rtas_flash: no firmware flash support +IOMMU table initialized, virtual merging enabled +IOMMU table initialized, virtual merging enabled +vio 30000000: Warning: IOMMU dma not supported: mask 0xffffffffffffffff, table unavailable +vio 30000000: Warning: IOMMU dma not supported: mask 0xffffffffffffffff, table unavailable +HugeTLB registered 16 MB page size, pre-allocated 0 pages +HugeTLB registered 16 MB page size, pre-allocated 0 pages +VFS: Disk quotas dquot_6.5.2 +VFS: Disk quotas dquot_6.5.2 +Dquot-cache hash table entries: 8192 (order 0, 65536 bytes) +Dquot-cache hash table entries: 8192 (order 0, 65536 bytes) +msgmni has been set to 1992 +msgmni has been set to 1992 +Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253) +Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253) +io scheduler noop registered +io scheduler noop registered +io scheduler deadline registered +io scheduler deadline registered +io scheduler cfq registered (default) +io scheduler cfq registered (default) +pci_hotplug: PCI Hot Plug PCI Core version: 0.5 +pci_hotplug: PCI Hot Plug PCI Core version: 0.5 +rpaphp: RPA HOT Plug PCI Controller Driver version: 0.1 +rpaphp: RPA HOT Plug PCI Controller Driver version: 0.1 +rpadlpar_io_init: partition not DLPAR capable +rpadlpar_io_init: partition not DLPAR capable +Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled +Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled +pmac_zilog: 0.6 (Benjamin Herrenschmidt <email address hidden>) +pmac_zilog: 0.6 (Benjamin Herrenschmidt <email address hidden>) +Fixed MDIO Bus: probed +Fixed MDIO Bus: probed +arcnet loaded. +arcnet loaded. +ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver +ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver +ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver +ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver +mousedev: PS/2 mouse device common for all mice +mousedev: PS/2 mouse device common for all mice +EDAC MC: Ver: 2.1.0 +EDAC MC: Ver: 2.1.0 +usbcore: registered new interface driver usbhid +usbcore: registered new interface driver usbhid +usbhid: USB HID core driver +usbhid: USB HID core driver +TCP cubic registered +TCP cubic registered +NET: Registered protocol family 10 +NET: Registered protocol family 10 +NET: Registered protocol family 15 +NET: Registered protocol family 15 +lib80211: common routines for IEEE802.11 drivers +lib80211: common routines for IEEE802.11 drivers +Registering the dns_resolver key type +Registering the dns_resolver key type +libceph: loaded (mon/osd proto 15/24, osdmap 5/6 5/6) +libceph: loaded (mon/osd proto 15/24, osdmap 5/6 5/6) +turn off boot console udbg0 +turn off boot console udbg0 +registered taskstats version 1 +/home/abuild/rpmbuild/BUILD/kernel-ppc64-3.2.0/linux-3.2/drivers/rtc/hctosys.c: unable to open rtc device (rtc0) +Freeing unused kernel memory: 6272k freed +doing fast boot +device-mapper: uevent: version 1.0.3 +device-mapper: ioctl: 4.22.0-ioctl (2011-10-19) initialised: <email address hidden> +SCSI subsystem initialized +alua: device handler registered +rdac: device handler registered +hp_sw: device handler registered +emc: device handler registered +Creating device nodes with udev +udevd[78]: starting version 173 +virtio-pci 0000:00:00.0: device not available (can't reserve [io 0x0000-0x001f]) +virtio-pci: probe of 0000:00:00.0 failed with error -22 +virtio-pci 0000:00:01.0: device not available (can't reserve [io 0x0000-0x003f]) +virtio-pci: probe of 0000:00:01.0 failed with error -22 +udevd[98]: failed to execute '/etc/sysconfig/network/scripts/ifup-sysctl' '/etc/sysconfig/network/scripts/ifup-sysctl lo -o hotplug': No such file or directory + +mount: devpts already mounted or /dev/pts busy +mount: according to mtab, devpts is already mounted on /dev/pts +Boot logging started on /dev/hvc0(/dev/console) at Mon Mar 26 09:55:36 2012 +md: linear personality registered for level -1 + Volume group "system" not found + Volume group "system" not found +resume device not found (ignoring) +Waiting for device /dev/mapper/system-root to appear: Reading all physical volumes. This may take a while... + No volume groups found + Volume group "system" not found + Volume group "system" not found + Reading all physical volumes. This may take a while... + +[...no virtio-pci block device found, so above scan loops...] \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/968 b/results/classifier/mode-deepseek-r1:32b/output/system/968 new file mode 100644 index 00000000..ce0a65e9 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/968 @@ -0,0 +1,97 @@ + + +QEMU guest agent fails to install if COM+ Application: QEMU Guest Agent VSS Provider not properly uninstalled +Description of problem: +QEMU guest agent fails to install if COM+ Application: QEMU Guest Agent VSS Provider not properly uninstalled +Steps to reproduce: +1. Install QEMU guest agent +2. Uninstall QEMU guest agent (in rare cases it didn't uninstall the COM+ component) +3. Install QEMU guest agent and get error: `Product: QEMU guest agent -- Error 1722. There is a problem with this Windows Installer package. A program run as part of the setup did not finish as expected. Contact your support personnel or package vendor. Action RegisterCom, location: cmd.exe, command: /c "C:\Program Files\Qemu-ga\qemu-ga.exe" -s vss-install` +Additional information: +1. **Qemu GA is already uninstalled:** + +``` +gwmi Win32_Product + + +IdentifyingNumber : {EE3877E4-07B0-41F2-ADB8-B45133DDCE37} +Name : Spice Agent 0.10.0-5 (64-bit) +Vendor : Red Hat, Inc. +Version : 0.10.5 +Caption : Spice Agent 0.10.0-5 (64-bit) + +IdentifyingNumber : {4C49C419-DE39-421B-B0F8-5F0DE1486869} +Name : Virtio-win-driver-installer +Vendor : Red Hat, Inc. +Version : 0.1.189 +Caption : Virtio-win-driver-installer + +IdentifyingNumber : {85F4CBCB-9BBC-4B50-A7D8-E1106771498D} +Name : Orca +Vendor : Microsoft Corporation +Version : 3.1.5299.0000 +Caption : Orca + +IdentifyingNumber : {89F4137D-6C26-4A84-BDB8-2E5A4BB71E00} +Name : Microsoft Silverlight +Vendor : Microsoft Corporation +Version : 5.1.50918.0 +Caption : Microsoft Silverlight + +IdentifyingNumber : {AB392F9F-0C0C-4098-B5BA-B1E84E62D6CE} +Name : Icinga 2 +Vendor : Icinga GmbH +Version : 2.11.0 +Caption : Icinga 2 +``` + +2. **Extract files from installer and run `qemu-ga.exe -s vss-install`** + +It fails with: `QGA VSS Provider is already installed. (Error: 80004004) Vorgang abgebrochen` + +3. **Uninstall COM+ component: `qemu-ga.exe -s vss-uninstall`** + +`Removing COM+ Application: QEMU Guest Agent VSS Provider` + +4. **Now you can install GA** + +``` +gwmi Win32_Product + + +IdentifyingNumber : {EE3877E4-07B0-41F2-ADB8-B45133DDCE37} +Name : Spice Agent 0.10.0-5 (64-bit) +Vendor : Red Hat, Inc. +Version : 0.10.5 +Caption : Spice Agent 0.10.0-5 (64-bit) + +IdentifyingNumber : {4C49C419-DE39-421B-B0F8-5F0DE1486869} +Name : Virtio-win-driver-installer +Vendor : Red Hat, Inc. +Version : 0.1.189 +Caption : Virtio-win-driver-installer + +IdentifyingNumber : {85F4CBCB-9BBC-4B50-A7D8-E1106771498D} +Name : Orca +Vendor : Microsoft Corporation +Version : 3.1.5299.0000 +Caption : Orca + +IdentifyingNumber : {99AD6A3C-F854-4E6E-865F-11D4A5E46172} +Name : QEMU guest agent +Vendor : RedHat +Version : 101.1.0 +Caption : QEMU guest agent + +IdentifyingNumber : {89F4137D-6C26-4A84-BDB8-2E5A4BB71E00} +Name : Microsoft Silverlight +Vendor : Microsoft Corporation +Version : 5.1.50918.0 +Caption : Microsoft Silverlight + +IdentifyingNumber : {AB392F9F-0C0C-4098-B5BA-B1E84E62D6CE} +Name : Icinga 2 +Vendor : Icinga GmbH +Version : 2.11.0 +Caption : Icinga 2 +``` diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/969 b/results/classifier/mode-deepseek-r1:32b/output/system/969 new file mode 100644 index 00000000..c394e2d3 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/969 @@ -0,0 +1,3 @@ + + +qemu: Georgian translation diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/974958 b/results/classifier/mode-deepseek-r1:32b/output/system/974958 new file mode 100644 index 00000000..fe0ba115 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/974958 @@ -0,0 +1,12 @@ + + +It dumps when following this tutorial on hello world os + +http://mikeos.berlios.de/write-your-own-os.html + + +Following the steps, + +it works on ubuntu, + +but on osx, it ALWAYS dumps. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/98 b/results/classifier/mode-deepseek-r1:32b/output/system/98 new file mode 100644 index 00000000..fd6a2378 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/98 @@ -0,0 +1,3 @@ + + +Curses Keyboard Broken On OS X diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/980 b/results/classifier/mode-deepseek-r1:32b/output/system/980 new file mode 100644 index 00000000..fab38bb2 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/980 @@ -0,0 +1,18 @@ + + +Binary emulation of a Solaris-8-compiled dynamically linked C program gives a bus error immediately on startup when running with qemu-sparc +Description of problem: +I am currently trying to use binary emulation to run a dynamically-linked executable C program that was written and compiled on a Solaris 8 VM. However, when I do so, I immediately get a bus error, and I'm not sure what the cause is. Below I'll delineate all of the steps I took to recreate this. +Steps to reproduce: +1. Start Solaris 8 VM (this was done via QEMU, actually, and there are no issues here) +2. Write a simple `.c` program. +3. Compile that program with `/usr/local/bin/gcc`. The name of the program is `binary_emulation`. +4. Test program on the VM to ensure functionality. +5. Stop VM. +6. Mount `.qcow2` on the Linux host so I can easily extract files from it. +7. Copy the entire `/` directory off to `~/binary_emulation/target` +8. Copy `binary_emulation` to a separate directory. +9. `cd` to `.../qemu/build` +10. Run `./qemu-sparc -L ~/binary_emulation/target ~/binary_emulation/binary_emulation` +Additional information: +# diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/99 b/results/classifier/mode-deepseek-r1:32b/output/system/99 new file mode 100644 index 00000000..e45d677a --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/99 @@ -0,0 +1,3 @@ + + +Feature Request: Please add TCG OPAL 2 emulation support to the virtio disk emulation diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/995758 b/results/classifier/mode-deepseek-r1:32b/output/system/995758 new file mode 100644 index 00000000..1b72c37e --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/995758 @@ -0,0 +1,11 @@ + + +Possibly inaccurate statement in PC Platform Docs + +The documentation at: + +http://wiki.qemu.org/Documentation/Platforms/PC + +Contains the statement that the processor, after reset, executes code starting from address 0xFFFFF, corresponding to the last byte of the single megabyte of memory in the old 8086 address range. + +From my recollection of working in the microcomputer industry in the late 1980's, execution actually starts in real mode at the start of the last 16 bytes of addressable memory, at 0xFFFF0. Think about it - if it's the last byte there's no room for an address operand to accompany a 1-byte opcode. \ No newline at end of file diff --git a/results/classifier/mode-deepseek-r1:32b/output/system/996798 b/results/classifier/mode-deepseek-r1:32b/output/system/996798 new file mode 100644 index 00000000..1778bf45 --- /dev/null +++ b/results/classifier/mode-deepseek-r1:32b/output/system/996798 @@ -0,0 +1,13 @@ + + +Incorrect order of task switching + +In Intel specifications (http://download.intel.com/design/processor/manuals/253668.pdf 7.3), we can see: + + 8. Saves the state of the current (old) task in the current task’s TSS. + +… + + 11. Loads the task register with the segment selector and descriptor for the new task's TSS. + +But, in QEMU code (https://raw.github.com/qemu/QEMU/v1.0/target-i386/op_helper.c :375), the order is reversed: TSS registers & segments loads BEFORE save old task state. \ No newline at end of file |