ifratric
diff --git a/‎.gitlab-ci.d/buildtest.yml
+11-1 b/‎.gitlab-ci.d/buildtest.yml
+11-1
diff --git a/‎MAINTAINERS
+3-1 b/‎MAINTAINERS
+3-1
diff --git a/‎VERSION
+1-1 b/‎VERSION
+1-1
diff --git a/‎accel/tcg/cpu-exec.c
+8 b/‎accel/tcg/cpu-exec.c
+8
diff --git a/‎accel/tcg/cputlb.c
+19 b/‎accel/tcg/cputlb.c
+19
diff --git a/‎accel/tcg/tcg-runtime.c
+27-6 b/‎accel/tcg/tcg-runtime.c
+27-6
diff --git a/‎accel/tcg/tcg-runtime.h
+2-1 b/‎accel/tcg/tcg-runtime.h
+2-1
diff --git a/‎accel/tcg/translator.c
+7-1 b/‎accel/tcg/translator.c
+7-1
diff --git a/‎backends/cryptodev-vhost.c
+2-2 b/‎backends/cryptodev-vhost.c
+2-2
diff --git a/‎backends/vhost-user.c
+2-2 b/‎backends/vhost-user.c
+2-2
diff --git a/‎block/block-backend.c
+13-2 b/‎block/block-backend.c
+13-2
diff --git a/‎configure
+1-1 b/‎configure
+1-1
diff --git a/‎cpu.c
+12-1 b/‎cpu.c
+12-1
diff --git a/‎docs/devel/code-of-conduct.rst
+2 b/‎docs/devel/code-of-conduct.rst
+2
diff --git a/‎docs/devel/index-process.rst
+1 b/‎docs/devel/index-process.rst
+1
@@ -494,7 +494,17 @@ check-gprof-gcov:
     IMAGE: ubuntu2004
     MAKE_CHECK_ARGS: check
   after_script:
-    - ${CI_PROJECT_DIR}/scripts/ci/coverage-summary.sh
+    - cd build
+    - gcovr --xml-pretty --exclude-unreachable-branches --print-summary
+        -o coverage.xml --root ${CI_PROJECT_DIR} . *.p
+  coverage: /^\s*lines:\s*\d+.\d+\%/
+  artifacts:
+    name: ${CI_JOB_NAME}-${CI_COMMIT_REF_NAME}-${CI_COMMIT_SHA}
+    expire_in: 2 days
+    reports:
+      coverage_report:
+        coverage_format: cobertura
+        path: build/coverage.xml
 
 build-oss-fuzz:
   extends: .native_build_job_template
 
@@ -23,7 +23,7 @@ Descriptions of section entries:
 	W: Web-page with status/info
 	Q: Patchwork web based patch tracking system site
 	T: SCM tree type and location.  Type is one of: git, hg, quilt, stgit.
-	S: Status, one of the following:
+	S: Status, one of the following (keep in sync with docs/devel/maintainers.rst):
 	   Supported:	Someone is actually paid to look after this.
 	   Maintained:	Someone actually looks after it.
 	   Odd Fixes:	It has a maintainer but they don't have time to do
@@ -1865,6 +1865,7 @@ F: hw/acpi/viot.h
 
 ACPI/AVOCADO/BIOSBITS
 M: Ani Sinha <[email protected]>
+M: Michael S. Tsirkin <[email protected]>
 S: Supported
 F: tests/avocado/acpi-bits/*
 F: tests/avocado/acpi-bits.py
@@ -2004,6 +2005,7 @@ F: docs/interop/vhost-user.rst
 F: contrib/vhost-user-*/
 F: backends/vhost-user.c
 F: include/sysemu/vhost-user-backend.h
+F: subprojects/libvhost-user/
 
 virtio
 M: Michael S. Tsirkin <[email protected]>
 
@@ -1 +1 @@
-7.1.91
+7.1.94
@@ -661,6 +661,12 @@ static inline void cpu_handle_debug_exception(CPUState *cpu)
     }
 }
 
+//// --- Begin LibAFL code ---
+
+void libafl_sync_breakpoint_cpu(void);
+
+//// --- End LibAFL code ---
+
 static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
 {
     //// --- Begin LibAFL code ---
@@ -670,6 +676,8 @@ static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
     if (cpu->exception_index == EXCP_LIBAFL_BP) {
         *ret = cpu->exception_index;
         cpu->exception_index = -1;
+        
+        libafl_sync_breakpoint_cpu();
         return true; 
     }
 
 
@@ -2312,6 +2312,12 @@ store_helper_unaligned(CPUArchState *env, target_ulong addr, uint64_t val,
     }
 }
 
+//// --- Begin LibAFL code ---
+
+void syx_snapshot_dirty_list_add_hostaddr(void* host_addr);
+
+//// --- End LibAFL code ---
+
 static inline void QEMU_ALWAYS_INLINE
 store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
              MemOpIdx oi, uintptr_t retaddr, MemOp op)
@@ -2389,6 +2395,12 @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
 
         haddr = (void *)((uintptr_t)addr + entry->addend);
 
+//// --- Begin LibAFL code ---
+
+        syx_snapshot_dirty_list_add_hostaddr(haddr);
+
+//// --- End LibAFL code ---
+
         /*
          * Keep these two store_memop separate to ensure that the compiler
          * is able to fold the entire function to a single instruction.
@@ -2413,6 +2425,13 @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
     }
 
     haddr = (void *)((uintptr_t)addr + entry->addend);
+
+//// --- Begin LibAFL code ---
+
+    syx_snapshot_dirty_list_add_hostaddr(haddr);
+
+//// --- End LibAFL code ---
+
     store_memop(haddr, val, op);
 }
 
 
@@ -40,6 +40,8 @@
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "qemu/main-loop.h"
+#include "hw/core/cpu.h"
+#include "sysemu/hw_accel.h"
 #include <stdlib.h>
 #include <string.h>
 
@@ -129,28 +131,47 @@ void libafl_load_qemu_snapshot(char *name, bool sync)
 int libafl_qemu_break_asap = 0;
 
 CPUState* libafl_breakpoint_cpu;
+vaddr libafl_breakpoint_pc;
+
+#ifdef TARGET_ARM
+#define THUMB_MASK(value) (value | libafl_breakpoint_cpu->env_ptr->thumb)
+#else
+#define THUMB_MASK(value) value
+#endif
 
 void libafl_qemu_trigger_breakpoint(CPUState* cpu);
 
+void libafl_sync_breakpoint_cpu(void);
+
+void libafl_sync_breakpoint_cpu(void)
+{
+    if (libafl_breakpoint_pc) {
+        CPUClass* cc = CPU_GET_CLASS(libafl_breakpoint_cpu);
+        cc->set_pc(libafl_breakpoint_cpu, THUMB_MASK(libafl_breakpoint_pc));
+    }
+    libafl_breakpoint_pc = 0;
+}
+
 void libafl_qemu_trigger_breakpoint(CPUState* cpu)
 {
+  libafl_breakpoint_cpu = cpu;
 #ifndef CONFIG_USER_ONLY
-    libafl_breakpoint_cpu = cpu;
-    cpu->stopped = true;
     qemu_system_debug_request();
-#else
+    cpu->stopped = true;
+#endif
     if (cpu->running) {
         cpu->exception_index = EXCP_LIBAFL_BP;
         cpu_loop_exit(cpu);
     } else {
         libafl_qemu_break_asap = 1;
     }
-#endif
 }
 
-void HELPER(libafl_qemu_handle_breakpoint)(CPUArchState *env)
+void HELPER(libafl_qemu_handle_breakpoint)(CPUArchState *env, target_ulong pc)
 {
-    libafl_qemu_trigger_breakpoint(env_cpu(env));
+    CPUState* cpu = env_cpu(env);
+    libafl_breakpoint_pc = pc;
+    libafl_qemu_trigger_breakpoint(cpu);
 }
 
 //// --- End LibAFL code ---
 
@@ -288,6 +288,7 @@ DEF_HELPER_FLAGS_5(gvec_bitsel, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
 
 //// --- Begin LibAFL code ---
 
-DEF_HELPER_FLAGS_1(libafl_qemu_handle_breakpoint, TCG_CALL_NO_RWG, void, env)
+DEF_HELPER_FLAGS_2(libafl_qemu_handle_breakpoint, TCG_CALL_NO_RWG,
+                   void, env, tl)
 
 //// --- End LibAFL code ---
@@ -145,7 +145,13 @@ void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
         struct libafl_breakpoint* bp = libafl_qemu_breakpoints;
         while (bp) {
             if (bp->addr == db->pc_next) {
-                gen_helper_libafl_qemu_handle_breakpoint(cpu_env);
+                TCGv tmp0 = tcg_const_tl(db->pc_next);
+                gen_helper_libafl_qemu_handle_breakpoint(cpu_env, tmp0);
+#if TARGET_LONG_BITS == 32
+                tcg_temp_free_i32(tmp0);
+#else
+                tcg_temp_free_i64(tmp0);
+#endif
             }
             bp = bp->next;
         }
 
@@ -94,7 +94,7 @@ cryptodev_vhost_start_one(CryptoDevBackendVhost *crypto,
         goto fail_notifiers;
     }
 
-    r = vhost_dev_start(&crypto->dev, dev);
+    r = vhost_dev_start(&crypto->dev, dev, false);
     if (r < 0) {
         goto fail_start;
     }
@@ -111,7 +111,7 @@ static void
 cryptodev_vhost_stop_one(CryptoDevBackendVhost *crypto,
                                  VirtIODevice *dev)
 {
-    vhost_dev_stop(&crypto->dev, dev);
+    vhost_dev_stop(&crypto->dev, dev, false);
     vhost_dev_disable_notifiers(&crypto->dev, dev);
 }
 
 
@@ -85,7 +85,7 @@ vhost_user_backend_start(VhostUserBackend *b)
     }
 
     b->dev.acked_features = b->vdev->guest_features;
-    ret = vhost_dev_start(&b->dev, b->vdev);
+    ret = vhost_dev_start(&b->dev, b->vdev, true);
     if (ret < 0) {
         error_report("Error start vhost dev");
         goto err_guest_notifiers;
@@ -120,7 +120,7 @@ vhost_user_backend_stop(VhostUserBackend *b)
         return;
     }
 
-    vhost_dev_stop(&b->dev, b->vdev);
+    vhost_dev_stop(&b->dev, b->vdev, true);
 
     if (k->set_guest_notifiers) {
         ret = k->set_guest_notifiers(qbus->parent,
 
@@ -2576,14 +2576,25 @@ static void blk_root_drained_end(BdrvChild *child, int *drained_end_counter)
 
 bool blk_register_buf(BlockBackend *blk, void *host, size_t size, Error **errp)
 {
+    BlockDriverState *bs = blk_bs(blk);
+
     GLOBAL_STATE_CODE();
-    return bdrv_register_buf(blk_bs(blk), host, size, errp);
+
+    if (bs) {
+        return bdrv_register_buf(bs, host, size, errp);
+    }
+    return true;
 }
 
 void blk_unregister_buf(BlockBackend *blk, void *host, size_t size)
 {
+    BlockDriverState *bs = blk_bs(blk);
+
     GLOBAL_STATE_CODE();
-    bdrv_unregister_buf(blk_bs(blk), host, size);
+
+    if (bs) {
+        bdrv_unregister_buf(bs, host, size);
+    }
 }
 
 int coroutine_fn blk_co_copy_range(BlockBackend *blk_in, int64_t off_in,
 
@@ -1807,7 +1807,7 @@ fi
 # functions to probe cross compilers
 
 container="no"
-if test $use_containers = "yes"; then
+if test $use_containers = "yes" && (has "docker" || has "podman"); then
     case $($python "$source_path"/tests/docker/docker.py probe) in
         *docker) container=docker ;;
         podman) container=podman ;;
 
@@ -98,6 +98,8 @@ void libafl_flush_jit(void);
 
 extern CPUState* libafl_breakpoint_cpu;
 
+extern int libafl_restoring_devices;
+
 /*
 void* libafl_qemu_g2h(CPUState *cpu, target_ulong x);
 target_ulong libafl_qemu_h2g(CPUState *cpu, void* x);
@@ -348,7 +350,15 @@ static int cpu_common_post_load(void *opaque, int version_id)
      * memory we've translated code from. So we must flush all TBs,
      * which will now be stale.
      */
-    tb_flush(cpu);
+    //tb_flush(cpu);
+
+//// --- Begin LibAFL code ---
+
+    // flushing the TBs every restore makes it really slow
+    // TODO handle writes to X code with specific calls to tb_invalidate_phys_addr
+    if (!libafl_restoring_devices) tb_flush(cpu);
+
+//// --- End LibAFL code ---
 
     return 0;
 }
@@ -610,6 +620,7 @@ void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr, MemTxAttrs attrs)
 
 void libafl_breakpoint_invalidate(CPUState *cpu, target_ulong pc)
 {
+    // TODO invalidate only the virtual pages related to the TB
     tb_flush(cpu);
 }
 
 
@@ -1,3 +1,5 @@
+.. _code_of_conduct:
+
 Code of Conduct
 ===============
 
 
@@ -8,6 +8,7 @@ Notes about how to interact with the community and how and where to submit patch
 
    code-of-conduct
    conflict-resolution
+   maintainers
    style
    submitting-a-patch
    trivial-patches
Original file line number	Diff line number	Diff line change
`@@ -661,6 +661,12 @@ static inline void cpu_handle_debug_exception(CPUState *cpu)`
`661`	`661`	`}`
`662`	`662`	`}`
`663`	`663`
	`664`	`+//// --- Begin LibAFL code ---`
	`665`	`+`
	`666`	`+void libafl_sync_breakpoint_cpu(void);`
	`667`	`+`
	`668`	`+//// --- End LibAFL code ---`
	`669`	`+`
`664`	`670`	`static inline bool cpu_handle_exception(CPUState cpu, int ret)`
`665`	`671`	`{`
`666`	`672`	`//// --- Begin LibAFL code ---`
`@@ -670,6 +676,8 @@ static inline bool cpu_handle_exception(CPUState cpu, int ret)`
`670`	`676`	`if (cpu->exception_index == EXCP_LIBAFL_BP) {`
`671`	`677`	`*ret = cpu->exception_index;`
`672`	`678`	`cpu->exception_index = -1;`
	`679`	`+`
	`680`	`+ libafl_sync_breakpoint_cpu();`
`673`	`681`	`return true;`
`674`	`682`	`}`
`675`	`683`
Original file line number	Diff line number	Diff line change
`@@ -94,7 +94,7 @@ cryptodev_vhost_start_one(CryptoDevBackendVhost *crypto,`
`94`	`94`	`goto fail_notifiers;`
`95`	`95`	`}`
`96`	`96`
`97`		`- r = vhost_dev_start(&crypto->dev, dev);`
	`97`	`+ r = vhost_dev_start(&crypto->dev, dev, false);`
`98`	`98`	`if (r < 0) {`
`99`	`99`	`goto fail_start;`
`100`	`100`	`}`
`@@ -111,7 +111,7 @@ static void`
`111`	`111`	`cryptodev_vhost_stop_one(CryptoDevBackendVhost *crypto,`
`112`	`112`	`VirtIODevice *dev)`
`113`	`113`	`{`
`114`		`- vhost_dev_stop(&crypto->dev, dev);`
	`114`	`+ vhost_dev_stop(&crypto->dev, dev, false);`
`115`	`115`	`vhost_dev_disable_notifiers(&crypto->dev, dev);`
`116`	`116`	`}`
`117`	`117`
Original file line number	Diff line number	Diff line change
`@@ -85,7 +85,7 @@ vhost_user_backend_start(VhostUserBackend *b)`
`85`	`85`	`}`
`86`	`86`
`87`	`87`	`b->dev.acked_features = b->vdev->guest_features;`
`88`		`- ret = vhost_dev_start(&b->dev, b->vdev);`
	`88`	`+ ret = vhost_dev_start(&b->dev, b->vdev, true);`
`89`	`89`	`if (ret < 0) {`
`90`	`90`	`error_report("Error start vhost dev");`
`91`	`91`	`goto err_guest_notifiers;`
`@@ -120,7 +120,7 @@ vhost_user_backend_stop(VhostUserBackend *b)`
`120`	`120`	`return;`
`121`	`121`	`}`
`122`	`122`
`123`		`- vhost_dev_stop(&b->dev, b->vdev);`
	`123`	`+ vhost_dev_stop(&b->dev, b->vdev, true);`
`124`	`124`
`125`	`125`	`if (k->set_guest_notifiers) {`
`126`	`126`	`ret = k->set_guest_notifiers(qbus->parent,`
Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,5 @@`
	`1`	`+.. _code_of_conduct:`
	`2`	`+`
`1`	`3`	`Code of Conduct`
`2`	`4`	`===============`
`3`	`5`