QEMU With E2K User Support
Go to file
Greg Kurz 37035df51e nvram: Exit QEMU if NVRAM cannot contain all -prom-env data
Since commit 61f20b9dc5 ("spapr_nvram: Pre-initialize the NVRAM to
support the -prom-env parameter"), pseries machines can pre-initialize
the "system" partition in the NVRAM with the data passed to all -prom-env
parameters on the QEMU command line.

In this case it is assumed that all the data fits in 64 KiB, but the user
can easily pass more and crash QEMU:

$ qemu-system-ppc64 -M pseries $(for ((x=0;x<128;x++)); do \
  echo -n " -prom-env " ; printf "%0.sx" {1..1024}; \
  done) # this requires ~128 Kib
malloc(): corrupted top size
Aborted (core dumped)

This happens because we don't check if all the prom-env data fits in
the NVRAM and chrp_nvram_set_var() happily memcpy() it passed the
buffer.

This crash affects basically all ppc/ppc64 machine types that use -prom-env:
- pseries (all versions)
- g3beige
- mac99

and also sparc/sparc64 machine types:
- LX
- SPARCClassic
- SPARCbook
- SS-10
- SS-20
- SS-4
- SS-5
- SS-600MP
- Voyager
- sun4u
- sun4v

Add a max_len argument to chrp_nvram_create_system_partition() so that
it can check the available size before writing to memory.

Since NVRAM is populated at machine init, it seems reasonable to consider
this error as fatal. So, instead of reporting an error when we detect that
the NVRAM is too small and adapt all machine types to handle it, we simply
exit QEMU in all cases. This is still better than crashing. If someone
wants another behavior, I guess this can be reworked later.

Tested with:

$ yes q | \
  (for arch in ppc ppc64 sparc sparc64; do \
       echo == $arch ==; \
       qemu=${arch}-softmmu/qemu-system-$arch; \
       for mach in $($qemu -M help | awk '! /^Supported/ { print $1 }'); do \
           echo $mach; \
           $qemu -M $mach -monitor stdio -nodefaults -nographic \
           $(for ((x=0;x<128;x++)); do \
                 echo -n " -prom-env " ; printf "%0.sx" {1..1024}; \
             done) >/dev/null; \
        done; echo; \
   done)

Without the patch, affected machine types cause QEMU to report some
memory corruption and crash:

malloc(): corrupted top size

free(): invalid size

*** stack smashing detected ***: terminated

With the patch, QEMU prints the following message and exits:

NVRAM is too small. Try to pass less data to -prom-env

It seems that the conditions for the crash have always existed, but it
affects pseries, the machine type I care for, since commit 61f20b9dc5
only.

Fixes: 61f20b9dc5 ("spapr_nvram: Pre-initialize the NVRAM to support the -prom-env parameter")
RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1867739
Reported-by: John Snow <jsnow@redhat.com>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Signed-off-by: Greg Kurz <groug@kaod.org>
Message-Id: <159736033937.350502.12402444542194031035.stgit@bahia.lan>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2020-08-14 13:34:31 +10:00
.github
.gitlab-ci.d gitlab-ci/containers: Add missing wildcard where we should look for changes 2020-07-15 11:52:43 +01:00
accel accel/xen: Fix xen_enabled() behavior on target-agnostic objects 2020-08-04 10:21:35 +01:00
audio ossaudio: fix out of bounds write 2020-07-13 11:38:40 +02:00
authz
backends tpm_emulator: Report an error if chardev is missing 2020-07-24 12:44:13 -04:00
block qcow2-cluster: Fix integer left shift error in qcow2_alloc_cluster_link_l2() 2020-08-05 14:56:11 +01:00
bsd-user
capstone@22ead3e0bf
chardev chardev: Extract system emulation specific code 2020-07-13 11:59:47 +04:00
contrib libvhost-user: Report descriptor index on panic 2020-07-27 10:28:28 -04:00
crypto
default-configs hw/avr: Add limited support for some Arduino boards 2020-07-11 11:02:05 +02:00
disas disas/sh4: Add missing fallthrough annotations 2020-07-13 11:40:52 +02:00
docs spapr: Clarify error and documentation for broken KVM XICS 2020-08-12 13:16:27 +10:00
dtc@85e5d83984
dump error: Eliminate error_propagate() manually 2020-07-10 15:18:08 +02:00
fpu fpu/softfloat: fix up float16 nan recognition 2020-07-15 11:52:43 +01:00
fsdev
gdb-xml target/avr: CPU class: Add GDB support 2020-07-10 17:58:32 +02:00
hw nvram: Exit QEMU if NVRAM cannot contain all -prom-env data 2020-08-14 13:34:31 +10:00
include nvram: Exit QEMU if NVRAM cannot contain all -prom-env data 2020-08-14 13:34:31 +10:00
io
libdecnumber
linux-headers linux-headers: update again to 5.8 2020-07-10 19:26:55 -04:00
linux-user linux-user: Use getcwd syscall directly 2020-07-27 22:05:34 +02:00
migration migration: Fix typos in bitmap migration comments 2020-07-27 15:42:21 -05:00
monitor monitor/misc: Remove unused "chardev/char-mux.h" include 2020-07-13 11:59:47 +04:00
nbd nbd: Fix large trim/zero requests 2020-07-28 08:49:29 -05:00
net colo-compare: Remove superfluous NULL-pointer checks for s->iothread 2020-08-04 14:14:48 +08:00
pc-bios seabios: update to master snapshot 2020-08-03 07:01:02 +02:00
plugins
po
python/qemu python/qemu: Change ConsoleSocket to optionally drain socket. 2020-07-27 09:41:56 +01:00
qapi schemas: Add vim modeline 2020-08-03 08:28:08 +02:00
qga schemas: Add vim modeline 2020-08-03 08:28:08 +02:00
qobject
qom qom: Make info qom-tree sort children more efficiently 2020-07-21 17:39:37 +02:00
replay
roms seabios: update to master snapshot 2020-08-03 07:01:02 +02:00
scripts Get rid of the libqemustub.a remainders 2020-08-05 11:45:43 +02:00
scsi qom: Change object_get_canonical_path_component() not to malloc 2020-07-21 16:23:43 +02:00
slirp@ce94eba204 slirp: update to latest stable-4.2 branch 2020-07-28 18:27:59 +04:00
softmmu semihosting: defer connect_chardevs a little more to use serialx 2020-07-27 09:40:03 +01:00
storage-daemon schemas: Add vim modeline 2020-08-03 08:28:08 +02:00
stubs Revert "tpm: Clean up error reporting in tpm_init_tpmdev()" 2020-07-24 12:44:13 -04:00
target target/ppc: Integrate icount to purr, vtb, and tbu40 2020-08-13 10:03:01 +10:00
tcg target/ppc: add vmulld to INDEX_op_mul_vec case 2020-08-12 13:16:27 +10:00
tests Get rid of the libqemustub.a remainders 2020-08-05 11:45:43 +02:00
tools/virtiofsd
trace trace/simple: Allow enabling simple traces from command line 2020-07-29 16:39:56 +01:00
ui bugfixes for audio, usb, ui and docs. 2020-07-13 16:58:44 +01:00
util util/oslib-win32: add qemu_get_host_physmem implementation 2020-07-27 09:40:16 +01:00
.cirrus.yml .cirrus.yml: add bash to the brew packages 2020-07-11 15:53:29 +01:00
.dir-locals.el
.editorconfig
.exrc
.gdbinit
.gitignore .gitignore: un-ignore .gitlab-ci.d 2020-07-11 15:53:00 +01:00
.gitlab-ci.yml gitlab-ci: Fix Avocado cache usage 2020-08-05 10:39:55 +02:00
.gitmodules
.gitpublish
.mailmap
.patchew.yml
.readthedocs.yml
.shippable.yml shippable: add one more qemu to registry url 2020-07-27 09:39:57 +01:00
.travis.yml .travis.yml: skip ppc64abi32-linux-user with plugins 2020-07-15 11:57:17 +01:00
block.c block: Require aligned image size to avoid assertion failure 2020-07-17 14:20:57 +02:00
blockdev-nbd.c
blockdev.c block: Add support to warn on backing file change without format 2020-07-14 15:18:59 +02:00
blockjob.c
bootdevice.c error: Eliminate error_propagate() manually 2020-07-10 15:18:08 +02:00
Changelog
CODING_STYLE.rst
configure configure: Allow to build tools without pixman 2020-07-24 17:36:03 +02:00
COPYING
COPYING.LIB
cpus-common.c cpus: Move CPU code from exec.c to cpus-common.c 2020-07-10 18:02:24 -04:00
device_tree.c
disas.c
dma-helpers.c
exec-vary.c
exec.c cpus: Move CPU code from exec.c to cpus-common.c 2020-07-10 18:02:24 -04:00
gdbstub.c qom: Change object_get_canonical_path_component() not to malloc 2020-07-21 16:23:43 +02:00
gitdm.config
hmp-commands-info.hx
hmp-commands.hx
iothread.c qom: Change object_get_canonical_path_component() not to malloc 2020-07-21 16:23:43 +02:00
job-qmp.c
job.c
Kconfig Makefile: simplify MINIKCONF rules 2020-07-10 18:02:21 -04:00
Kconfig.host accel/Kconfig: Extract accel selectors into their own config 2020-07-10 18:02:21 -04:00
LICENSE
MAINTAINERS MAINTAINERS: Cover the firmware JSON schema 2020-07-27 10:28:28 -04:00
Makefile Get rid of the libqemustub.a remainders 2020-08-05 11:45:43 +02:00
Makefile.objs
Makefile.target softmmu: move softmmu only files from root 2020-07-10 18:02:24 -04:00
memory_ldst.inc.c
module-common.c
os-posix.c qemu/osdep: Document os_find_datadir() return value 2020-07-21 16:13:04 +02:00
os-win32.c qemu/osdep: Document os_find_datadir() return value 2020-07-21 16:13:04 +02:00
qdev-monitor.c qdev: Fix device_add DRIVER,help to print to monitor 2020-07-21 17:22:44 +02:00
qemu-bridge-helper.c
qemu-edid.c
qemu-img-cmds.hx
qemu-img.c qemu-img resize: Require --shrink for shrinking all image formats 2020-07-17 14:20:57 +02:00
qemu-io-cmds.c block: nbd: Fix convert qcow2 compressed to nbd 2020-07-28 09:54:19 -05:00
qemu-io.c
qemu-keymap.c
qemu-nbd.c
qemu-options-wrapper.h
qemu-options.h
qemu-options.hx ipmi: Fix a man page entry 2020-07-17 11:39:46 -05:00
qemu-seccomp.c
qemu-storage-daemon.c
qemu.nsi
qemu.sasl
README.rst
replication.c
replication.h
rules.mak
thunk.c
tpm.c tpm: Improve help on TPM types when none are available 2020-07-24 12:44:13 -04:00
trace-events
VERSION Update version for v5.1.0 release 2020-08-11 17:07:03 +01:00
version.rc

===========
QEMU README
===========

QEMU is a generic and open source machine & userspace emulator and
virtualizer.

QEMU is capable of emulating a complete machine in software without any
need for hardware virtualization support. By using dynamic translation,
it achieves very good performance. QEMU can also integrate with the Xen
and KVM hypervisors to provide emulated hardware while allowing the
hypervisor to manage the CPU. With hypervisor support, QEMU can achieve
near native performance for CPUs. When QEMU emulates CPUs directly it is
capable of running operating systems made for one machine (e.g. an ARMv7
board) on a different machine (e.g. an x86_64 PC board).

QEMU is also capable of providing userspace API virtualization for Linux
and BSD kernel interfaces. This allows binaries compiled against one
architecture ABI (e.g. the Linux PPC64 ABI) to be run on a host using a
different architecture ABI (e.g. the Linux x86_64 ABI). This does not
involve any hardware emulation, simply CPU and syscall emulation.

QEMU aims to fit into a variety of use cases. It can be invoked directly
by users wishing to have full control over its behaviour and settings.
It also aims to facilitate integration into higher level management
layers, by providing a stable command line interface and monitor API.
It is commonly invoked indirectly via the libvirt library when using
open source applications such as oVirt, OpenStack and virt-manager.

QEMU as a whole is released under the GNU General Public License,
version 2. For full licensing details, consult the LICENSE file.


Building
========

QEMU is multi-platform software intended to be buildable on all modern
Linux platforms, OS-X, Win32 (via the Mingw64 toolchain) and a variety
of other UNIX targets. The simple steps to build QEMU are:


.. code-block:: shell

  mkdir build
  cd build
  ../configure
  make

Additional information can also be found online via the QEMU website:

* `<https://qemu.org/Hosts/Linux>`_
* `<https://qemu.org/Hosts/Mac>`_
* `<https://qemu.org/Hosts/W32>`_


Submitting patches
==================

The QEMU source code is maintained under the GIT version control system.

.. code-block:: shell

   git clone https://git.qemu.org/git/qemu.git

When submitting patches, one common approach is to use 'git
format-patch' and/or 'git send-email' to format & send the mail to the
qemu-devel@nongnu.org mailing list. All patches submitted must contain
a 'Signed-off-by' line from the author. Patches should follow the
guidelines set out in the CODING_STYLE.rst file.

Additional information on submitting patches can be found online via
the QEMU website

* `<https://qemu.org/Contribute/SubmitAPatch>`_
* `<https://qemu.org/Contribute/TrivialPatches>`_

The QEMU website is also maintained under source control.

.. code-block:: shell

  git clone https://git.qemu.org/git/qemu-web.git

* `<https://www.qemu.org/2017/02/04/the-new-qemu-website-is-up/>`_

A 'git-publish' utility was created to make above process less
cumbersome, and is highly recommended for making regular contributions,
or even just for sending consecutive patch series revisions. It also
requires a working 'git send-email' setup, and by default doesn't
automate everything, so you may want to go through the above steps
manually for once.

For installation instructions, please go to

*  `<https://github.com/stefanha/git-publish>`_

The workflow with 'git-publish' is:

.. code-block:: shell

  $ git checkout master -b my-feature
  $ # work on new commits, add your 'Signed-off-by' lines to each
  $ git publish

Your patch series will be sent and tagged as my-feature-v1 if you need to refer
back to it in the future.

Sending v2:

.. code-block:: shell

  $ git checkout my-feature # same topic branch
  $ # making changes to the commits (using 'git rebase', for example)
  $ git publish

Your patch series will be sent with 'v2' tag in the subject and the git tip
will be tagged as my-feature-v2.

Bug reporting
=============

The QEMU project uses Launchpad as its primary upstream bug tracker. Bugs
found when running code built from QEMU git or upstream released sources
should be reported via:

* `<https://bugs.launchpad.net/qemu/>`_

If using QEMU via an operating system vendor pre-built binary package, it
is preferable to report bugs to the vendor's own bug tracker first. If
the bug is also known to affect latest upstream code, it can also be
reported via launchpad.

For additional information on bug reporting consult:

* `<https://qemu.org/Contribute/ReportABug>`_


Contact
=======

The QEMU community can be contacted in a number of ways, with the two
main methods being email and IRC

* `<mailto:qemu-devel@nongnu.org>`_
* `<https://lists.nongnu.org/mailman/listinfo/qemu-devel>`_
* #qemu on irc.oftc.net

Information on additional methods of contacting the community can be
found online via the QEMU website:

* `<https://qemu.org/Contribute/StartHere>`_