QEMU With E2K User Support
Go to file
Stefan Hajnoczi abdd16f468 virtio: gracefully handle invalid region caches
The virtqueue code sets up MemoryRegionCaches to access the virtqueue
guest RAM data structures.  The code currently assumes that
VRingMemoryRegionCaches is initialized before device emulation code
accesses the virtqueue.  An assertion will fail in
vring_get_region_caches() when this is not true.  Device fuzzing found a
case where this assumption is false (see below).

Virtqueue guest RAM addresses can also be changed from a vCPU thread
while an IOThread is accessing the virtqueue.  This breaks the same
assumption but this time the caches could become invalid partway through
the virtqueue code.  The code fetches the caches RCU pointer multiple
times so we will need to validate the pointer every time it is fetched.

Add checks each time we call vring_get_region_caches() and treat invalid
caches as a nop: memory stores are ignored and memory reads return 0.

The fuzz test failure is as follows:

  $ qemu -M pc -device virtio-blk-pci,id=drv0,drive=drive0,addr=4.0 \
         -drive if=none,id=drive0,file=null-co://,format=raw,auto-read-only=off \
         -drive if=none,id=drive1,file=null-co://,file.read-zeroes=on,format=raw \
         -display none \
         -qtest stdio
  endianness
  outl 0xcf8 0x80002020
  outl 0xcfc 0xe0000000
  outl 0xcf8 0x80002004
  outw 0xcfc 0x7
  write 0xe0000000 0x24 0x00ffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffab5cffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffab0000000001
  inb 0x4
  writew 0xe000001c 0x1
  write 0xe0000014 0x1 0x0d

The following error message is produced:

  qemu-system-x86_64: /home/stefanha/qemu/hw/virtio/virtio.c:286: vring_get_region_caches: Assertion `caches != NULL' failed.

The backtrace looks like this:

  #0  0x00007ffff5520625 in raise () at /lib64/libc.so.6
  #1  0x00007ffff55098d9 in abort () at /lib64/libc.so.6
  #2  0x00007ffff55097a9 in _nl_load_domain.cold () at /lib64/libc.so.6
  #3  0x00007ffff5518a66 in annobin_assert.c_end () at /lib64/libc.so.6
  #4  0x00005555559073da in vring_get_region_caches (vq=<optimized out>) at qemu/hw/virtio/virtio.c:286
  #5  vring_get_region_caches (vq=<optimized out>) at qemu/hw/virtio/virtio.c:283
  #6  0x000055555590818d in vring_used_flags_set_bit (mask=1, vq=0x5555575ceea0) at qemu/hw/virtio/virtio.c:398
  #7  virtio_queue_split_set_notification (enable=0, vq=0x5555575ceea0) at qemu/hw/virtio/virtio.c:398
  #8  virtio_queue_set_notification (vq=vq@entry=0x5555575ceea0, enable=enable@entry=0) at qemu/hw/virtio/virtio.c:451
  #9  0x0000555555908512 in virtio_queue_set_notification (vq=vq@entry=0x5555575ceea0, enable=enable@entry=0) at qemu/hw/virtio/virtio.c:444
  #10 0x00005555558c697a in virtio_blk_handle_vq (s=0x5555575c57e0, vq=0x5555575ceea0) at qemu/hw/block/virtio-blk.c:775
  #11 0x0000555555907836 in virtio_queue_notify_aio_vq (vq=0x5555575ceea0) at qemu/hw/virtio/virtio.c:2244
  #12 0x0000555555cb5dd7 in aio_dispatch_handlers (ctx=ctx@entry=0x55555671a420) at util/aio-posix.c:429
  #13 0x0000555555cb67a8 in aio_dispatch (ctx=0x55555671a420) at util/aio-posix.c:460
  #14 0x0000555555cb307e in aio_ctx_dispatch (source=<optimized out>, callback=<optimized out>, user_data=<optimized out>) at util/async.c:260
  #15 0x00007ffff7bbc510 in g_main_context_dispatch () at /lib64/libglib-2.0.so.0
  #16 0x0000555555cb5848 in glib_pollfds_poll () at util/main-loop.c:219
  #17 os_host_main_loop_wait (timeout=<optimized out>) at util/main-loop.c:242
  #18 main_loop_wait (nonblocking=<optimized out>) at util/main-loop.c:518
  #19 0x00005555559b20c9 in main_loop () at vl.c:1683
  #20 0x0000555555838115 in main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at vl.c:4441

Reported-by: Alexander Bulekov <alxndr@bu.edu>
Cc: Michael Tsirkin <mst@redhat.com>
Cc: Cornelia Huck <cohuck@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20200207104619.164892-1-stefanha@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-02-27 03:45:54 -05:00
.gitlab-ci.d/edk2 gitlab-ci.yml: Add jobs to build EDK2 firmware binaries 2020-01-21 14:15:48 +01:00
accel * Register qdev properties as class properties (Marc-André) 2020-01-27 09:44:04 +00:00
audio audio/alsaaudio: Remove superfluous semicolons 2020-02-18 20:20:49 +01:00
authz authz: fix usage of bool in listfile.c 2020-02-07 12:22:19 +00:00
backends migration: Define VMSTATE_INSTANCE_ID_ANY 2020-01-20 09:10:23 +01:00
block block: Fix VM size field width in snapshot dump 2020-02-20 16:43:42 +01:00
bsd-user build: move TARGET_GPROF to config-host.mak 2020-02-12 16:29:27 +01:00
capstone@22ead3e0bf
chardev qemu/queue.h: add QLIST_SAFE_REMOVE() 2020-02-22 08:26:47 +00:00
contrib contrib/rdmacm-mux: Remove superfluous semicolon 2020-02-18 20:20:49 +01:00
crypto * More uses of RCU_READ_LOCK_GUARD (Dave, myself) 2019-12-20 11:20:25 +00:00
default-configs spapr: Add NVDIMM device support 2020-02-21 09:15:04 +11:00
disas target/mips: Add implementation of GINVT instruction 2020-01-29 19:28:52 +01:00
docs docs: Move tools documentation to tools manual 2020-02-25 10:48:06 +00:00
dtc@88f18909db
dump hmp: drop Error pointer indirection in hmp_handle_error 2019-12-18 08:36:16 +01:00
fpu softfp: Added hardfloat conversion from float32 to float64 2019-10-30 19:03:37 +01:00
fsdev virtfs-proxy-helper: Convert documentation to rST 2020-02-03 11:02:23 +00:00
gdb-xml target/riscv: Expose "priv" register for GDB for reads 2019-10-28 07:47:29 -07:00
hw virtio: gracefully handle invalid region caches 2020-02-27 03:45:54 -05:00
include vhost-user-blk: convert to new virtio_delete_queue 2020-02-25 08:32:56 -05:00
io io/channel-websock: treat 'binary' and no sub-protocol as the same 2020-02-07 12:22:18 +00:00
libdecnumber
linux-headers linux-headers: Update 2020-01-08 11:01:59 +11:00
linux-user target/arm: Add _aa32_ to isar_feature functions testing 32-bit ID registers 2020-02-21 16:07:00 +00:00
migration migration/rdma: rdma_accept_incoming_migration fix error handling 2020-02-13 10:55:55 +01:00
monitor qapi: Allow getting flat output from 'query-named-block-nodes' 2020-02-20 16:43:42 +01:00
nbd nbd: fix uninitialized variable warning 2020-01-08 16:08:17 +01:00
net chardev: Use QEMUChrEvent enum in IOEventHandler typedef 2020-01-08 11:15:35 +01:00
pc-bios hw/ppc/prep: Remove the deprecated "prep" machine and the OpenHackware BIOS 2020-02-02 14:07:57 +11:00
plugins plugins: Include trace/mem.h in api.c 2020-01-15 15:13:09 -10:00
po ui/gtk: fix gettext message's charset. 2019-11-21 09:42:30 +01:00
python/qemu python/qemu/machine: Allow to use other serial consoles than default 2020-02-07 15:12:48 +01:00
qapi qapi: Allow getting flat output from 'query-named-block-nodes' 2020-02-20 16:43:42 +01:00
qga qga/qapi-schema.json: minor format fixups for rST 2020-02-15 11:41:49 +01:00
qobject qstring: add qstring_free() 2020-01-24 20:59:13 +01:00
qom qapi/qmp: add ObjectPropertyInfo.default-value 2020-01-24 20:59:16 +01:00
replay replay: record and replay random number sources 2020-01-07 12:08:39 +01:00
roms hw/ppc/prep: Remove the deprecated "prep" machine and the OpenHackware BIOS 2020-02-02 14:07:57 +11:00
scripts softmmu: move vl.c to softmmu/ 2020-02-22 08:26:47 +00:00
scsi build: rename CONFIG_LIBCAP to CONFIG_LIBCAP_NG 2019-12-17 19:35:47 +01:00
slirp@126c04acba slirp: update with CVE-2019-14378 fix 2019-08-02 15:14:56 +04:00
softmmu main: keep rcu_atfork callback enabled for qtest 2020-02-22 08:26:48 +00:00
stubs stubs: add stubs for io_uring interface 2020-01-30 20:59:41 +00:00
target target/arm: Set MVFR0.FPSP for ARMv5 cpus 2020-02-21 16:07:03 +00:00
tcg tcg: Add tcg_gen_gvec_5_ptr 2020-02-12 14:58:36 -08:00
tests rebuild-expected-aml.sh: remind about the process 2020-02-25 08:23:18 -05:00
tools/virtiofsd virtiofsd: Remove fuse.h and struct fuse_module 2020-02-21 12:53:17 +00:00
trace qemu_set_log_filename: filename argument may be NULL 2020-01-30 21:33:50 +00:00
ui ui/input-barrier: Remove superfluous semicolon 2020-02-18 20:20:49 +01:00
util module: check module wasn't already initialized 2020-02-22 08:26:47 +00:00
.cirrus.yml ci: build out-of-tree 2019-12-18 20:17:55 +00:00
.dir-locals.el
.editorconfig editorconfig: add setting for shell scripts 2019-06-12 17:53:22 +01:00
.exrc
.gdbinit
.gitignore virtiofsd: add vhost-user.json file 2020-01-23 16:41:36 +00:00
.gitlab-ci-edk2.yml gitlab-ci.yml: Add jobs to build EDK2 firmware binaries 2020-01-21 14:15:48 +01:00
.gitlab-ci.yml gitlab-ci: Refresh the list of iotests 2020-02-04 09:00:57 +01:00
.gitmodules hw/ppc/prep: Remove the deprecated "prep" machine and the OpenHackware BIOS 2020-02-02 14:07:57 +11:00
.gitpublish
.mailmap mailmap: Add entry for Yu-Chen Lin 2020-02-18 20:20:49 +01:00
.patchew.yml ci: store Patchew configuration in the tree 2019-06-03 14:03:02 +02:00
.readthedocs.yml .readthedocs.yml: specify some minimum python requirements 2020-02-07 15:15:16 +01:00
.shippable.yml .shippable: --disable-docs for cross-compile tests 2020-02-04 17:13:29 +00:00
.travis.yml tests/acceptance: Add boot tests for some of the QEMU advent calendar images 2020-02-07 15:12:48 +01:00
arch_init.c hw/m68k: add Nubus macfb video card 2019-10-28 19:06:49 +01:00
balloon.c Clean up inclusion of exec/cpu-common.h 2019-08-16 13:31:52 +02:00
block.c qemu/queue.h: add QLIST_SAFE_REMOVE() 2020-02-22 08:26:47 +00:00
blockdev-nbd.c nbd: Allow description when creating NBD blockdev 2020-02-05 17:22:13 -06:00
blockdev.c qapi: Allow getting flat output from 'query-named-block-nodes' 2020-02-20 16:43:42 +01:00
blockjob.c blockjob: Fix error message for negative speed 2019-12-18 11:21:07 +01:00
bootdevice.c bootdevice: FW_CFG interface for LCHS values 2019-10-31 11:47:38 -04:00
Changelog
CODING_STYLE.rst docs: split the CODING_STYLE doc into distinct groups 2019-09-05 14:41:00 +01:00
configure fuzz: add configure flag --enable-fuzzing 2020-02-22 08:26:48 +00:00
COPYING
COPYING.LIB COPYING.LIB: Synchronize the LGPL 2.1 with the version from gnu.org 2019-01-30 11:01:22 +01:00
cpus-common.c cpu: introduce cpu_in_exclusive_context() 2019-10-28 15:12:38 +00:00
cpus.c Wrapper function to wait on condition for the main loop mutex 2020-02-03 11:33:10 +11:00
device_tree.c device_tree: Fix integer overflowing in load_device_tree() 2019-04-09 16:35:40 -07:00
device-hotplug.c Include hw/hw.h exactly where needed 2019-08-16 13:31:52 +02:00
disas.c plugin: add qemu_plugin_insn_disas helper 2019-10-28 15:12:38 +00:00
dma-helpers.c dma-helpers: ensure AIO callback is invoked after cancellation 2019-08-16 19:14:04 -04:00
exec-vary.c exec: Cache TARGET_PAGE_MASK for TARGET_PAGE_BITS_VARY 2019-10-28 10:35:20 +01:00
exec.c exec: keep ram block across fork when using qtest 2020-02-22 08:26:48 +00:00
gdbstub.c chardev: Use QEMUChrEvent enum in IOEventHandler typedef 2020-01-08 11:15:35 +01:00
gitdm.config contrib: gitdm: add a mapping for Janus Technologies 2019-03-12 19:31:29 +00:00
hmp-commands-info.hx riscv: hmp: Add a command to show virtual memory mappings 2019-09-17 08:42:43 -07:00
hmp-commands.hx hmp: Allow using qdev ID for qemu-io command 2019-12-19 18:04:25 +01:00
ioport.c Include qemu-common.h exactly where needed 2019-06-12 13:20:20 +02:00
iothread.c iothread: document about why we need explicit aio_poll() 2019-03-08 10:20:57 +00:00
job-qmp.c Include qemu-common.h exactly where needed 2019-06-12 13:20:20 +02:00
job.c job: drop job_drain 2019-09-10 08:58:43 +02:00
Kconfig.host configure: simplify vhost condition with Kconfig 2019-12-17 19:32:48 +01:00
LICENSE tcg/LICENSE: Remove out of date claim about TCG subdirectory licensing 2019-11-11 15:11:21 +01:00
MAINTAINERS fuzz: add fuzzer skeleton 2020-02-22 08:26:48 +00:00
Makefile docs: Move tools documentation to tools manual 2020-02-25 10:48:06 +00:00
Makefile.objs softmmu: move vl.c to softmmu/ 2020-02-22 08:26:47 +00:00
Makefile.target fuzz: add target/fuzz makefile rules 2020-02-22 08:26:48 +00:00
memory_ldst.inc.c memory: Single byte swap along the I/O path 2019-09-03 08:30:39 -07:00
memory_mapping.c Include qemu-common.h exactly where needed 2019-06-12 13:20:20 +02:00
memory.c memory.c: Use trace_event_get_state_backends() 2020-01-30 21:33:50 +00:00
module-common.c
os-posix.c os-posix: simplify os_find_datadir 2019-12-17 19:32:47 +01:00
os-win32.c glib: use portable g_setenv() 2019-12-17 09:05:23 +01:00
qdev-monitor.c qdev: use object_property_help() 2020-01-24 20:59:17 +01:00
qemu-bridge-helper.c build: rename CONFIG_LIBCAP to CONFIG_LIBCAP_NG 2019-12-17 19:35:47 +01:00
qemu-deprecated.texi ui: deprecate legacy -show-cursor option 2020-02-12 13:25:17 +01:00
qemu-doc.texi qemu-doc: Clarify extent of build platform support 2020-02-17 13:53:47 +01:00
qemu-edid.c Include qemu-common.h exactly where needed 2019-06-12 13:20:20 +02:00
qemu-img-cmds.hx qemu-img: Add --target-is-zero to convert 2020-02-20 16:43:42 +01:00
qemu-img.c qemu-img: Fix convert -n -B for backing-less targets 2020-02-20 16:43:42 +01:00
qemu-io-cmds.c block: Pass truncate exact=true where reasonable 2019-10-28 12:08:45 +01:00
qemu-io.c qemu-io: adds option to use aio engine 2020-01-30 20:59:42 +00:00
qemu-keymap.c Include qemu-common.h exactly where needed 2019-06-12 13:20:20 +02:00
qemu-nbd.c qemu-nbd: Removed deprecated --partition option 2020-02-05 17:29:49 -06:00
qemu-option-trace.texi qemu-nbd: Convert invocation documentation to rST 2020-01-23 15:22:39 +00:00
qemu-options-wrapper.h
qemu-options.h
qemu-options.hx docs: stop documenting the e1000 NIC model as the default 2020-02-07 12:22:19 +00:00
qemu-seccomp.c seccomp: report more useful errors from seccomp 2019-03-27 13:11:38 +01:00
qemu-tech.texi qemu-tech: Fix dangling @menu entries 2019-07-15 21:10:29 +02:00
qemu.nsi win32: fix README file in NSIS installer 2019-09-16 12:32:21 +02:00
qemu.sasl
qtest.c qtest: add in-process incoming command handler 2020-02-22 08:26:48 +00:00
README.rst docs: merge HACKING.rst contents into CODING_STYLE.rst 2019-09-05 14:27:06 +01:00
replication.c
replication.h Include qemu/module.h where needed, drop it from qemu-common.h 2019-06-12 13:18:33 +02:00
rules.mak Makefile: Ensure we don't run Sphinx in parallel for manpages 2020-02-03 10:46:32 +00:00
thunk.c thunk: improve readability of allocation loop 2019-03-11 18:48:20 +01:00
tpm.c
trace-events trace: add mmu_index to mem_info 2019-10-28 15:12:38 +00:00
VERSION Open 5.0 development tree 2019-12-13 11:59:06 +00:00
version.rc

===========
QEMU README
===========

QEMU is a generic and open source machine & userspace emulator and
virtualizer.

QEMU is capable of emulating a complete machine in software without any
need for hardware virtualization support. By using dynamic translation,
it achieves very good performance. QEMU can also integrate with the Xen
and KVM hypervisors to provide emulated hardware while allowing the
hypervisor to manage the CPU. With hypervisor support, QEMU can achieve
near native performance for CPUs. When QEMU emulates CPUs directly it is
capable of running operating systems made for one machine (e.g. an ARMv7
board) on a different machine (e.g. an x86_64 PC board).

QEMU is also capable of providing userspace API virtualization for Linux
and BSD kernel interfaces. This allows binaries compiled against one
architecture ABI (e.g. the Linux PPC64 ABI) to be run on a host using a
different architecture ABI (e.g. the Linux x86_64 ABI). This does not
involve any hardware emulation, simply CPU and syscall emulation.

QEMU aims to fit into a variety of use cases. It can be invoked directly
by users wishing to have full control over its behaviour and settings.
It also aims to facilitate integration into higher level management
layers, by providing a stable command line interface and monitor API.
It is commonly invoked indirectly via the libvirt library when using
open source applications such as oVirt, OpenStack and virt-manager.

QEMU as a whole is released under the GNU General Public License,
version 2. For full licensing details, consult the LICENSE file.


Building
========

QEMU is multi-platform software intended to be buildable on all modern
Linux platforms, OS-X, Win32 (via the Mingw64 toolchain) and a variety
of other UNIX targets. The simple steps to build QEMU are:


.. code-block:: shell

  mkdir build
  cd build
  ../configure
  make

Additional information can also be found online via the QEMU website:

* `<https://qemu.org/Hosts/Linux>`_
* `<https://qemu.org/Hosts/Mac>`_
* `<https://qemu.org/Hosts/W32>`_


Submitting patches
==================

The QEMU source code is maintained under the GIT version control system.

.. code-block:: shell

   git clone https://git.qemu.org/git/qemu.git

When submitting patches, one common approach is to use 'git
format-patch' and/or 'git send-email' to format & send the mail to the
qemu-devel@nongnu.org mailing list. All patches submitted must contain
a 'Signed-off-by' line from the author. Patches should follow the
guidelines set out in the CODING_STYLE.rst file.

Additional information on submitting patches can be found online via
the QEMU website

* `<https://qemu.org/Contribute/SubmitAPatch>`_
* `<https://qemu.org/Contribute/TrivialPatches>`_

The QEMU website is also maintained under source control.

.. code-block:: shell

  git clone https://git.qemu.org/git/qemu-web.git

* `<https://www.qemu.org/2017/02/04/the-new-qemu-website-is-up/>`_

A 'git-publish' utility was created to make above process less
cumbersome, and is highly recommended for making regular contributions,
or even just for sending consecutive patch series revisions. It also
requires a working 'git send-email' setup, and by default doesn't
automate everything, so you may want to go through the above steps
manually for once.

For installation instructions, please go to

*  `<https://github.com/stefanha/git-publish>`_

The workflow with 'git-publish' is:

.. code-block:: shell

  $ git checkout master -b my-feature
  $ # work on new commits, add your 'Signed-off-by' lines to each
  $ git publish

Your patch series will be sent and tagged as my-feature-v1 if you need to refer
back to it in the future.

Sending v2:

.. code-block:: shell

  $ git checkout my-feature # same topic branch
  $ # making changes to the commits (using 'git rebase', for example)
  $ git publish

Your patch series will be sent with 'v2' tag in the subject and the git tip
will be tagged as my-feature-v2.

Bug reporting
=============

The QEMU project uses Launchpad as its primary upstream bug tracker. Bugs
found when running code built from QEMU git or upstream released sources
should be reported via:

* `<https://bugs.launchpad.net/qemu/>`_

If using QEMU via an operating system vendor pre-built binary package, it
is preferable to report bugs to the vendor's own bug tracker first. If
the bug is also known to affect latest upstream code, it can also be
reported via launchpad.

For additional information on bug reporting consult:

* `<https://qemu.org/Contribute/ReportABug>`_


Contact
=======

The QEMU community can be contacted in a number of ways, with the two
main methods being email and IRC

* `<mailto:qemu-devel@nongnu.org>`_
* `<https://lists.nongnu.org/mailman/listinfo/qemu-devel>`_
* #qemu on irc.oftc.net

Information on additional methods of contacting the community can be
found online via the QEMU website:

* `<https://qemu.org/Contribute/StartHere>`_