Go to file
Cindy Lu a8e63ff289 virtio-pci: Fix the use of an uninitialized irqfd
The crash was reported in MAC OS and NixOS, here is the link for this bug
https://gitlab.com/qemu-project/qemu/-/issues/2334
https://gitlab.com/qemu-project/qemu/-/issues/2321

In this bug, they are using the virtio_input device. The guest notifier was
not supported for this device, The function virtio_pci_set_guest_notifiers()
was not called, and the vector_irqfd was not initialized.

So the fix is adding the check for vector_irqfd in virtio_pci_get_notifier()

The function virtio_pci_get_notifier() can be used in various devices.
It could also be called when VIRTIO_CONFIG_S_DRIVER_OK is not set. In this situation,
the vector_irqfd being NULL is acceptable. We can allow the device continue to boot

If the vector_irqfd still hasn't been initialized after VIRTIO_CONFIG_S_DRIVER_OK
is set, it means that the function set_guest_notifiers was not called before the
driver started. This indicates that the device is not using the notifier.
At this point, we will let the check fail.

This fix is verified in vyatta,MacOS,NixOS,fedora system.

The bt tree for this bug is:
Thread 6 "CPU 0/KVM" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7c817be006c0 (LWP 1269146)]
kvm_virtio_pci_vq_vector_use () at ../qemu-9.0.0/hw/virtio/virtio-pci.c:817
817         if (irqfd->users == 0) {
(gdb) thread apply all bt
...
Thread 6 (Thread 0x7c817be006c0 (LWP 1269146) "CPU 0/KVM"):
0  kvm_virtio_pci_vq_vector_use () at ../qemu-9.0.0/hw/virtio/virtio-pci.c:817
1  kvm_virtio_pci_vector_use_one () at ../qemu-9.0.0/hw/virtio/virtio-pci.c:893
2  0x00005983657045e2 in memory_region_write_accessor () at ../qemu-9.0.0/system/memory.c:497
3  0x0000598365704ba6 in access_with_adjusted_size () at ../qemu-9.0.0/system/memory.c:573
4  0x0000598365705059 in memory_region_dispatch_write () at ../qemu-9.0.0/system/memory.c:1528
5  0x00005983659b8e1f in flatview_write_continue_step.isra.0 () at ../qemu-9.0.0/system/physmem.c:2713
6  0x000059836570ba7d in flatview_write_continue () at ../qemu-9.0.0/system/physmem.c:2743
7  flatview_write () at ../qemu-9.0.0/system/physmem.c:2774
8  0x000059836570bb76 in address_space_write () at ../qemu-9.0.0/system/physmem.c:2894
9  0x0000598365763afe in address_space_rw () at ../qemu-9.0.0/system/physmem.c:2904
10 kvm_cpu_exec () at ../qemu-9.0.0/accel/kvm/kvm-all.c:2917
11 0x000059836576656e in kvm_vcpu_thread_fn () at ../qemu-9.0.0/accel/kvm/kvm-accel-ops.c:50
12 0x0000598365926ca8 in qemu_thread_start () at ../qemu-9.0.0/util/qemu-thread-posix.c:541
13 0x00007c8185bcd1cf in ??? () at /usr/lib/libc.so.6
14 0x00007c8185c4e504 in clone () at /usr/lib/libc.so.6

Fixes: 2ce6cff94d ("virtio-pci: fix use of a released vector")
Cc: qemu-stable@nongnu.org
Signed-off-by: Cindy Lu <lulu@redhat.com>
Message-Id: <20240806093715.65105-1-lulu@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-08-20 06:57:47 -04:00
.github/workflows github: fix config mistake preventing repo lockdown commenting 2022-04-26 16:12:26 +01:00
.gitlab/issue_templates .gitlab/issue_templates: Move suggestions into comments 2022-12-15 15:19:24 +01:00
.gitlab-ci.d ci: refresh package lists with lcitool 2024-08-16 09:16:03 +02:00
accel Revert "replay: stop us hanging in rr_wait_io_event" 2024-08-16 14:04:19 +01:00
audio ui: add more tracing for dbus 2024-07-22 12:47:28 +04:00
authz error: Drop superfluous #include "qapi/qmp/qerror.h" 2023-02-23 13:56:14 +01:00
backends vfio queue: 2024-07-24 12:58:46 +10:00
block block/blkio: use FUA flag on write zeroes only if supported 2024-08-12 11:41:29 -04:00
bsd-user bsd-user: Add target.h for aarch64. 2024-07-24 16:02:07 -06:00
chardev chardev: set record/replay on the base device of a muxed device 2024-08-16 14:04:19 +01:00
common-user common-user/host/ppc: Implement safe-syscall.inc.S 2023-01-23 14:39:48 -10:00
configs bsd-user: Add aarch64 build to tree 2024-07-23 10:56:30 -06:00
contrib contrib/plugins/execlog: Fix shadowed declaration warning 2024-08-20 00:49:14 +02:00
crypto crypto/tlscredspsk: Free username on finalize 2024-08-20 00:49:14 +02:00
disas disas/riscv: Add decode for Zawrs extension 2024-07-18 12:08:44 +10:00
docs docs/devel: update tcg-plugins page 2024-08-16 14:13:07 +01:00
dump dump: make range overlap check more readable 2024-07-23 20:30:36 +02:00
ebpf ebpf: Added traces back. Changed source set for eBPF to 'system'. 2024-06-04 15:14:26 +08:00
fpu target/sparc: Implement FMAf extension 2024-06-05 09:05:10 -07:00
fsdev configure, meson: rename targetos to host_os 2023-12-31 09:11:29 +01:00
gdb-xml Hexagon: lldb read/write predicate registers p0/p1/p2/p3 2024-08-07 20:34:41 -07:00
gdbstub virtio,pci,pc: features,fixes 2024-07-24 09:32:04 +10:00
host/include util/cpuinfo-riscv: Support host/cpuinfo.h for riscv 2024-07-03 10:24:12 -07:00
hw virtio-pci: Fix the use of an uninitialized irqfd 2024-08-20 06:57:47 -04:00
include docs: Fix some typos (found by typos) and grammar issues 2024-08-16 14:12:59 +01:00
io crypto: propagate errors from TLS session I/O callbacks 2024-07-24 10:39:10 +01:00
libdecnumber libdecnumber/dpd/decimal64: Fix compiler warning from Clang 15 2022-11-11 09:13:52 +01:00
linux-headers linux-header: PPC: KVM: Update one-reg ids for DEXCR, HASHKEYR and HASHPKEYR 2024-07-26 09:21:06 +10:00
linux-user linux-user/mips: Select Loongson CPU for Loongson binaries 2024-08-20 00:49:13 +02:00
migration savevm: Fix load_snapshot error path crash 2024-08-16 14:04:19 +01:00
monitor gdbstub: move enums into separate header 2024-06-24 10:14:17 +01:00
nbd nbd/server: CVE-2024-7409: Drop non-negotiating clients 2024-08-08 16:25:33 -05:00
net vhost: Add VIRTIO_NET_F_RSC_EXT to vhost feature bits 2024-08-20 06:57:47 -04:00
pc-bios roms/opensbi: Update to v1.5.1 2024-08-06 15:01:01 +10:00
plugins plugins: fix race condition with scoreboards 2024-08-16 14:13:07 +01:00
po po: update Italian translation 2024-08-13 19:01:42 +02:00
python python: enable testing for 3.13 2024-07-12 16:36:20 -04:00
qapi docs: Fix some typos (found by typos) and grammar issues 2024-08-16 14:12:59 +01:00
qga docs: Fix some typos (found by typos) and grammar issues 2024-08-16 14:12:59 +01:00
qobject docs/interop: Convert qmp-spec.txt to rST 2023-05-22 10:21:01 +02:00
qom target/sparc/cpu: Rename the CPU models with a "+" in their names 2024-05-05 21:02:47 +01:00
replay Revert "replay: stop us hanging in rr_wait_io_event" 2024-08-16 14:04:19 +01:00
roms roms/opensbi: Update to v1.5.1 2024-08-06 15:01:01 +10:00
scripts tests/avocado: excercise scripts/replay-dump.py in replay tests 2024-08-16 14:04:19 +01:00
scsi configure, meson: rename targetos to host_os 2023-12-31 09:11:29 +01:00
semihosting semihosting: Restrict to TCG 2024-07-22 09:38:16 +01:00
stats meson: Replace softmmu_ss -> system_ss 2023-06-20 10:01:30 +02:00
storage-daemon Revert "meson: Propagate gnutls dependency" 2024-07-03 18:41:26 +02:00
stubs meson: Drop the .fa library suffix 2024-07-03 18:41:26 +02:00
subprojects libvhost-user: mask F_INFLIGHT_SHMFD if memfd is not supported 2024-07-02 09:27:56 -04:00
system replay: allow runstate shutdown->running when replaying trace 2024-08-16 14:04:19 +01:00
target Various fixes 2024-08-20 09:17:41 +10:00
tcg tcg/ppc: Sync tcg_out_test and constraints 2024-08-08 09:03:35 +10:00
tests Various fixes 2024-08-20 09:17:41 +10:00
tools qemu-vmsr-helper: implement --verbose/-v 2024-07-31 13:15:06 +02:00
trace trace: Remove deprecated 'vcpu' field from QMP trace events 2024-06-04 11:53:43 +02:00
ui ui/console: Note in '-display help' that some backends support suboptions 2024-08-06 16:24:14 +02:00
util module: Prevent crash by resetting local_err in module_load_qom_all() 2024-08-13 16:35:47 +02:00
.dir-locals.el Add .dir-locals.el file to configure emacs coding style 2015-10-08 19:46:01 +03:00
.editorconfig .editorconfig: update the automatic mode setting for Emacs 2021-03-10 15:34:11 +00:00
.exrc qemu: add .exrc 2012-09-07 09:02:44 +03:00
.gdbinit .gdbinit: load QEMU sub-commands when gdb starts 2017-06-07 14:38:45 +01:00
.git-blame-ignore-revs metadata: add .git-blame-ignore-revs 2023-04-04 15:56:44 +01:00
.gitattributes gitattributes: Cover Objective-C source files 2022-03-29 00:15:14 +02:00
.gitignore configure: rename --enable-pypi to --enable-download, control subprojects too 2023-06-06 16:30:01 +02:00
.gitlab-ci.yml docs: Document GitLab custom CI/CD variables 2021-07-29 07:56:01 +02:00
.gitmodules meson: subprojects: replace berkeley-{soft,test}float-3 with wraps 2023-06-06 16:30:01 +02:00
.gitpublish Add a git-publish configuration file 2018-03-05 09:03:17 +00:00
.mailmap MAINTAINERS: Update Sriram Yagnaraman mail address 2024-04-24 16:03:38 +02:00
.patchew.yml scripts/checkpatch: roll diff tweaking into checkpatch itself 2021-06-25 10:08:33 +01:00
.readthedocs.yml readthodocs: fully specify a build environment 2024-01-12 13:23:48 +00:00
.travis.yml .travis.yml: Install python3-tomli in all build jobs 2024-07-02 09:47:47 +02:00
block.c block: Parse filenames only when explicitly requested 2024-07-02 18:12:30 +02:00
blockdev-nbd.c nbd/server: CVE-2024-7409: Close stray clients at server-stop 2024-08-08 16:34:04 -05:00
blockdev.c qapi: blockdev-backup: add discard-source parameter 2024-05-28 15:52:15 +03:00
blockjob.c block: remove AioContext locking 2023-12-21 22:49:27 +01:00
configure configure: Fix GDB version detection for GDB_HAS_MTE 2024-08-16 14:04:19 +01:00
COPYING
COPYING.LIB COPYING.LIB: Synchronize the LGPL 2.1 with the version from gnu.org 2019-01-30 11:01:22 +01:00
cpu-common.c cpu-common.c: export cpu_get_free_index to be reused later 2024-07-26 09:21:06 +10:00
cpu-target.c cpu-target: don't set cpu->thread_id to bogus value 2024-06-04 10:02:39 +02:00
event-loop-base.c util/event-loop-base: Introduce options to set the thread pool size 2022-05-09 10:43:23 +01:00
gitdm.config contrib/gitdm: add group map for AMD 2023-03-22 15:08:26 +00:00
hmp-commands-info.hx hmp-commands-info.hx: Add missing info command for stats subcommand 2024-06-30 19:51:44 +03:00
hmp-commands.hx hmp/migration: Fix "migrate" command's documentation 2024-05-08 09:22:37 -03:00
iothread.c iothread: Simplify expression in qemu_in_iothread() 2024-02-13 10:59:25 +03:00
job-qmp.c qapi job: Elide redundant has_FOO in generated C 2022-12-14 20:04:47 +01:00
job.c block: remove AioContext locking 2023-12-21 22:49:27 +01:00
Kconfig meson: Introduce target-specific Kconfig 2021-07-09 18:21:34 +02:00
Kconfig.host kconfig: express dependency of individual boards on libfdt 2024-05-10 15:45:15 +02:00
LICENSE tcg/LICENSE: Remove out of date claim about TCG subdirectory licensing 2019-11-11 15:11:21 +01:00
MAINTAINERS docs/interop/prl-xml.txt: Convert to rST 2024-08-09 17:37:55 +01:00
Makefile Makefile: trigger re-configure on updated pythondeps 2024-08-16 14:04:19 +01:00
meson_options.txt meson: remove dead optimization option 2024-06-28 14:44:51 +02:00
meson.build meson.build: Check for the availability of __attribute__((gcc_struct)) on MSYS2 2024-08-16 09:15:19 +02:00
module-common.c all: Clean up includes 2016-02-04 17:41:30 +00:00
os-posix.c os-posix: Expand setrlimit() syscall compatibility 2024-06-30 19:51:44 +03:00
os-win32.c Remove qemu-common.h include from most units 2022-04-06 14:31:55 +02:00
page-target.c exec: Expose 'target_page.h' API to user emulation 2024-04-26 15:28:11 +02:00
page-vary-common.c Remove qemu-common.h include from most units 2022-04-06 14:31:55 +02:00
page-vary-target.c exec: Rename target specific page-vary.c -> page-vary-target.c 2023-10-04 11:03:54 -07:00
pythondeps.toml Python: bump minimum sphinx version to 3.4.3 2024-07-12 16:36:20 -04:00
qemu-bridge-helper.c qemu-bridge-helper: relocate path to default ACL 2020-09-30 19:11:36 +02:00
qemu-edid.c qemu-edid: Restrict input parameter -d to avoid division by zero 2022-10-12 13:38:15 +02:00
qemu-img-cmds.hx docs/devel/docs: Document .hx file syntax 2024-01-15 17:12:22 +00:00
qemu-img.c block: remove AioContext locking 2023-12-21 22:49:27 +01:00
qemu-io-cmds.c qemu-io: add cvtnum() error handling for zone commands 2024-06-10 11:05:43 +02:00
qemu-io.c block: remove AioContext locking 2023-12-21 22:49:27 +01:00
qemu-keymap.c qemu-keymap: Make references to allocations static 2024-05-29 12:41:56 +02:00
qemu-nbd.c nbd/server: Plumb in new args to nbd_client_add() 2024-08-08 15:05:27 -05:00
qemu-options.hx hw/i386/pc: Ensure vmport prerequisites are fulfilled 2024-08-20 00:49:14 +02:00
qemu.nsi nsis installer: Fix mouse-over descriptions for emulators 2022-03-18 10:55:15 +00:00
qemu.sasl sasl: remove comment about obsolete kerberos versions 2021-06-14 13:28:50 +01:00
README.rst README.rst: add the missing punctuations 2024-07-17 14:04:15 +03:00
replication.c replication: move include out of root directory 2021-05-26 14:49:46 +02:00
trace-events tracepoints: move physmem trace points 2024-07-05 12:33:37 +01:00
VERSION Update version for v9.1.0-rc2 release 2024-08-15 20:32:37 +10:00
version.rc configure: remove CONFIG_FILEVERSION and CONFIG_PRODUCTVERSION 2021-01-02 21:03:37 +01:00

===========
QEMU README
===========

QEMU is a generic and open source machine & userspace emulator and
virtualizer.

QEMU is capable of emulating a complete machine in software without any
need for hardware virtualization support. By using dynamic translation,
it achieves very good performance. QEMU can also integrate with the Xen
and KVM hypervisors to provide emulated hardware while allowing the
hypervisor to manage the CPU. With hypervisor support, QEMU can achieve
near native performance for CPUs. When QEMU emulates CPUs directly it is
capable of running operating systems made for one machine (e.g. an ARMv7
board) on a different machine (e.g. an x86_64 PC board).

QEMU is also capable of providing userspace API virtualization for Linux
and BSD kernel interfaces. This allows binaries compiled against one
architecture ABI (e.g. the Linux PPC64 ABI) to be run on a host using a
different architecture ABI (e.g. the Linux x86_64 ABI). This does not
involve any hardware emulation, simply CPU and syscall emulation.

QEMU aims to fit into a variety of use cases. It can be invoked directly
by users wishing to have full control over its behaviour and settings.
It also aims to facilitate integration into higher level management
layers, by providing a stable command line interface and monitor API.
It is commonly invoked indirectly via the libvirt library when using
open source applications such as oVirt, OpenStack and virt-manager.

QEMU as a whole is released under the GNU General Public License,
version 2. For full licensing details, consult the LICENSE file.


Documentation
=============

Documentation can be found hosted online at
`<https://www.qemu.org/documentation/>`_. The documentation for the
current development version that is available at
`<https://www.qemu.org/docs/master/>`_ is generated from the ``docs/``
folder in the source tree, and is built by `Sphinx
<https://www.sphinx-doc.org/en/master/>`_.


Building
========

QEMU is multi-platform software intended to be buildable on all modern
Linux platforms, OS-X, Win32 (via the Mingw64 toolchain) and a variety
of other UNIX targets. The simple steps to build QEMU are:


.. code-block:: shell

  mkdir build
  cd build
  ../configure
  make

Additional information can also be found online via the QEMU website:

* `<https://wiki.qemu.org/Hosts/Linux>`_
* `<https://wiki.qemu.org/Hosts/Mac>`_
* `<https://wiki.qemu.org/Hosts/W32>`_


Submitting patches
==================

The QEMU source code is maintained under the GIT version control system.

.. code-block:: shell

   git clone https://gitlab.com/qemu-project/qemu.git

When submitting patches, one common approach is to use 'git
format-patch' and/or 'git send-email' to format & send the mail to the
qemu-devel@nongnu.org mailing list. All patches submitted must contain
a 'Signed-off-by' line from the author. Patches should follow the
guidelines set out in the `style section
<https://www.qemu.org/docs/master/devel/style.html>`_ of
the Developers Guide.

Additional information on submitting patches can be found online via
the QEMU website:

* `<https://wiki.qemu.org/Contribute/SubmitAPatch>`_
* `<https://wiki.qemu.org/Contribute/TrivialPatches>`_

The QEMU website is also maintained under source control.

.. code-block:: shell

  git clone https://gitlab.com/qemu-project/qemu-web.git

* `<https://www.qemu.org/2017/02/04/the-new-qemu-website-is-up/>`_

A 'git-publish' utility was created to make above process less
cumbersome, and is highly recommended for making regular contributions,
or even just for sending consecutive patch series revisions. It also
requires a working 'git send-email' setup, and by default doesn't
automate everything, so you may want to go through the above steps
manually for once.

For installation instructions, please go to:

*  `<https://github.com/stefanha/git-publish>`_

The workflow with 'git-publish' is:

.. code-block:: shell

  $ git checkout master -b my-feature
  $ # work on new commits, add your 'Signed-off-by' lines to each
  $ git publish

Your patch series will be sent and tagged as my-feature-v1 if you need to refer
back to it in the future.

Sending v2:

.. code-block:: shell

  $ git checkout my-feature # same topic branch
  $ # making changes to the commits (using 'git rebase', for example)
  $ git publish

Your patch series will be sent with 'v2' tag in the subject and the git tip
will be tagged as my-feature-v2.

Bug reporting
=============

The QEMU project uses GitLab issues to track bugs. Bugs
found when running code built from QEMU git or upstream released sources
should be reported via:

* `<https://gitlab.com/qemu-project/qemu/-/issues>`_

If using QEMU via an operating system vendor pre-built binary package, it
is preferable to report bugs to the vendor's own bug tracker first. If
the bug is also known to affect latest upstream code, it can also be
reported via GitLab.

For additional information on bug reporting consult:

* `<https://wiki.qemu.org/Contribute/ReportABug>`_


ChangeLog
=========

For version history and release notes, please visit
`<https://wiki.qemu.org/ChangeLog/>`_ or look at the git history for
more detailed information.


Contact
=======

The QEMU community can be contacted in a number of ways, with the two
main methods being email and IRC:

* `<mailto:qemu-devel@nongnu.org>`_
* `<https://lists.nongnu.org/mailman/listinfo/qemu-devel>`_
* #qemu on irc.oftc.net

Information on additional methods of contacting the community can be
found online via the QEMU website:

* `<https://wiki.qemu.org/Contribute/StartHere>`_