Original Xbox Emulator for Windows, macOS, and Linux (Active Development)
Go to file
Philippe Mathieu-Daudé 6e4ed42397 hw/hppa/dino: Fix reg800_keep_bits overrun (CID 1419387 1419393 1419394)
Coverity reports:

  *** CID 1419387:  Memory - illegal accesses  (OVERRUN)
  /hw/hppa/dino.c: 267 in dino_chip_read_with_attrs()
  261             val = s->ilr & s->imr & s->icr;
  262             break;
  263         case DINO_TOC_ADDR:
  264             val = s->toc_addr;
  265             break;
  266         case DINO_GMASK ... DINO_TLTIM:
  >>>     CID 1419387:  Memory - illegal accesses  (OVERRUN)
  >>>     Overrunning array "s->reg800" of 12 4-byte elements at element index 12 (byte offset 48) using index "(addr - 2048UL) / 4UL" (which evaluates to 12).
  267             val = s->reg800[(addr - DINO_GMASK) / 4];
  268             if (addr == DINO_PAMR) {
  269                 val &= ~0x01;  /* LSB is hardwired to 0 */
  270             }
  271             if (addr == DINO_MLTIM) {
  272                 val &= ~0x07;  /* 3 LSB are hardwired to 0 */

  *** CID 1419393:  Memory - corruptions  (OVERRUN)
  /hw/hppa/dino.c: 363 in dino_chip_write_with_attrs()
  357             /* These registers are read-only.  */
  358             break;
  359
  360         case DINO_GMASK ... DINO_TLTIM:
  361             i = (addr - DINO_GMASK) / 4;
  362             val &= reg800_keep_bits[i];
  >>>     CID 1419393:  Memory - corruptions  (OVERRUN)
  >>>     Overrunning array "s->reg800" of 12 4-byte elements at element index 12 (byte offset 48) using index "i" (which evaluates to 12).
  363             s->reg800[i] = val;
  364             break;
  365
  366         default:
  367             /* Controlled by dino_chip_mem_valid above.  */
  368             g_assert_not_reached();

  *** CID 1419394:  Memory - illegal accesses  (OVERRUN)
  /hw/hppa/dino.c: 362 in dino_chip_write_with_attrs()
  356         case DINO_IRR1:
  357             /* These registers are read-only.  */
  358             break;
  359
  360         case DINO_GMASK ... DINO_TLTIM:
  361             i = (addr - DINO_GMASK) / 4;
  >>>     CID 1419394:  Memory - illegal accesses  (OVERRUN)
  >>>     Overrunning array "reg800_keep_bits" of 12 4-byte elements at element index 12 (byte offset 48) using index "i" (which evaluates to 12).
  362             val &= reg800_keep_bits[i];
  363             s->reg800[i] = val;
  364             break;
  365
  366         default:
  367             /* Controlled by dino_chip_mem_valid above.  */

Indeed the array should contain 13 entries, the undocumented
register 0x82c is missing. Fix by increasing the array size
and adding the missing register.

CID 1419387 can be verified with:

  $ echo x 0xfff80830 | hppa-softmmu/qemu-system-hppa -S -monitor stdio -display none
  QEMU 4.2.50 monitor - type 'help' for more information
  (qemu) x 0xfff80830
  qemu/hw/hppa/dino.c:267:15: runtime error: index 12 out of bounds for type 'uint32_t [12]'
  SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/phil/source/qemu/hw/hppa/dino.c:267:15 in
  00000000fff80830: 0x00000000

and CID 1419393/1419394 with:

  $ echo writeb 0xfff80830 0x69 \
    | hppa-softmmu/qemu-system-hppa -S -accel qtest -qtest stdio -display none
  [I 1581634452.654113] OPENED
  [R +4.105415] writeb 0xfff80830 0x69
  qemu/hw/hppa/dino.c:362:16: runtime error: index 12 out of bounds for type 'const uint32_t [12]'
  SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior qemu/hw/hppa/dino.c:362:16 in
  =================================================================
  ==29607==ERROR: AddressSanitizer: global-buffer-overflow on address 0x5577dae32f30 at pc 0x5577d93f2463 bp 0x7ffd97ea11b0 sp 0x7ffd97ea11a8
  READ of size 4 at 0x5577dae32f30 thread T0
      #0 0x5577d93f2462 in dino_chip_write_with_attrs qemu/hw/hppa/dino.c:362:16
      #1 0x5577d9025664 in memory_region_write_with_attrs_accessor qemu/memory.c:503:12
      #2 0x5577d9024920 in access_with_adjusted_size qemu/memory.c:539:18
      #3 0x5577d9023608 in memory_region_dispatch_write qemu/memory.c:1482:13
      #4 0x5577d8e3177a in flatview_write_continue qemu/exec.c:3166:23
      #5 0x5577d8e20357 in flatview_write qemu/exec.c:3206:14
      #6 0x5577d8e1fef4 in address_space_write qemu/exec.c:3296:18
      #7 0x5577d8e20693 in address_space_rw qemu/exec.c:3306:16
      #8 0x5577d9011595 in qtest_process_command qemu/qtest.c:432:13
      #9 0x5577d900d19f in qtest_process_inbuf qemu/qtest.c:705:9
      #10 0x5577d900ca22 in qtest_read qemu/qtest.c:717:5
      #11 0x5577da8c4254 in qemu_chr_be_write_impl qemu/chardev/char.c:183:9
      #12 0x5577da8c430c in qemu_chr_be_write qemu/chardev/char.c:195:9
      #13 0x5577da8cf587 in fd_chr_read qemu/chardev/char-fd.c:68:9
      #14 0x5577da9836cd in qio_channel_fd_source_dispatch qemu/io/channel-watch.c:84:12
      #15 0x7faf44509ecc in g_main_context_dispatch (/lib64/libglib-2.0.so.0+0x4fecc)
      #16 0x5577dab75f96 in glib_pollfds_poll qemu/util/main-loop.c:219:9
      #17 0x5577dab74797 in os_host_main_loop_wait qemu/util/main-loop.c:242:5
      #18 0x5577dab7435a in main_loop_wait qemu/util/main-loop.c:518:11
      #19 0x5577d9514eb3 in main_loop qemu/vl.c:1682:9
      #20 0x5577d950699d in main qemu/vl.c:4450:5
      #21 0x7faf41a87f42 in __libc_start_main (/lib64/libc.so.6+0x23f42)
      #22 0x5577d8cd4d4d in _start (qemu/build/sanitizer/hppa-softmmu/qemu-system-hppa+0x1256d4d)

  0x5577dae32f30 is located 0 bytes to the right of global variable 'reg800_keep_bits' defined in 'qemu/hw/hppa/dino.c:87:23' (0x5577dae32f00) of size 48
  SUMMARY: AddressSanitizer: global-buffer-overflow qemu/hw/hppa/dino.c:362:16 in dino_chip_write_with_attrs
  Shadow bytes around the buggy address:
    0x0aaf7b5be590: 00 f9 f9 f9 f9 f9 f9 f9 00 02 f9 f9 f9 f9 f9 f9
    0x0aaf7b5be5a0: 07 f9 f9 f9 f9 f9 f9 f9 07 f9 f9 f9 f9 f9 f9 f9
    0x0aaf7b5be5b0: 07 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00
    0x0aaf7b5be5c0: 00 00 00 02 f9 f9 f9 f9 00 00 00 00 00 00 00 00
    0x0aaf7b5be5d0: 00 00 00 00 00 00 00 00 00 00 00 03 f9 f9 f9 f9
  =>0x0aaf7b5be5e0: 00 00 00 00 00 00[f9]f9 f9 f9 f9 f9 00 00 00 00
    0x0aaf7b5be5f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x0aaf7b5be600: 00 00 01 f9 f9 f9 f9 f9 00 00 00 00 07 f9 f9 f9
    0x0aaf7b5be610: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
    0x0aaf7b5be620: 00 00 00 05 f9 f9 f9 f9 00 00 00 00 07 f9 f9 f9
    0x0aaf7b5be630: f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9 07 f9 f9 f9
  Shadow byte legend (one shadow byte represents 8 application bytes):
    Addressable:           00
    Partially addressable: 01 02 03 04 05 06 07
    Heap left redzone:       fa
    Freed heap region:       fd
    Stack left redzone:      f1
    Stack mid redzone:       f2
    Stack right redzone:     f3
    Stack after return:      f5
    Stack use after scope:   f8
    Global redzone:          f9
    Global init order:       f6
    Poisoned by user:        f7
    Container overflow:      fc
    Array cookie:            ac
    Intra object redzone:    bb
    ASan internal:           fe
    Left alloca redzone:     ca
    Right alloca redzone:    cb
    Shadow gap:              cc
  ==29607==ABORTING

Fixes: Covertiy CID 1419387 / 1419393 / 1419394 (commit 18092598a5)
Acked-by: Helge Deller <deller@gmx.de>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20200218063355.18577-3-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2020-02-18 11:22:10 -08:00
.gitlab-ci.d/edk2 gitlab-ci.yml: Add jobs to build EDK2 firmware binaries 2020-01-21 14:15:48 +01:00
accel * Register qdev properties as class properties (Marc-André) 2020-01-27 09:44:04 +00:00
audio audio: proper support for float samples in mixeng 2020-02-06 14:35:57 +01:00
authz authz: fix usage of bool in listfile.c 2020-02-07 12:22:19 +00:00
backends migration: Define VMSTATE_INSTANCE_ID_ANY 2020-01-20 09:10:23 +01:00
block block: fix crash on zero-length unaligned write and read 2020-02-07 16:46:59 +00:00
bsd-user build: move TARGET_GPROF to config-host.mak 2020-02-12 16:29:27 +01:00
capstone@22ead3e0bf disas: Add capstone as submodule 2017-10-26 11:56:20 +02:00
chardev * Compat machines fix (Denis) 2020-01-10 17:16:49 +00:00
contrib libvhost-user: Fix some memtable remap cases 2020-01-23 16:41:37 +00:00
crypto * More uses of RCU_READ_LOCK_GUARD (Dave, myself) 2019-12-20 11:20:25 +00:00
default-configs hw/misc: Add the STM32F4xx Sysconfig device 2020-01-17 14:09:29 +00:00
disas target/mips: Add implementation of GINVT instruction 2020-01-29 19:28:52 +01:00
docs configure: Check that sphinx-build is using Python 3 2020-02-15 11:41:49 +01:00
dtc@88f18909db Update dtc/libfdt submodule to v1.4.7 2018-10-02 13:53:26 +10:00
dump hmp: drop Error pointer indirection in hmp_handle_error 2019-12-18 08:36:16 +01:00
fpu softfp: Added hardfloat conversion from float32 to float64 2019-10-30 19:03:37 +01:00
fsdev virtfs-proxy-helper: Convert documentation to rST 2020-02-03 11:02:23 +00:00
gdb-xml target/riscv: Expose "priv" register for GDB for reads 2019-10-28 07:47:29 -07:00
hw hw/hppa/dino: Fix reg800_keep_bits overrun (CID 1419387 1419393 1419394) 2020-02-18 11:22:10 -08:00
include monitor: Move monitor option parsing to monitor/monitor.c 2020-02-17 13:47:48 +01:00
io io/channel-websock: treat 'binary' and no sub-protocol as the same 2020-02-07 12:22:18 +00:00
libdecnumber build: remove CONFIG_LIBDECNUMBER 2017-10-16 18:03:52 +02:00
linux-headers linux-headers: Update 2020-01-08 11:01:59 +11:00
linux-user linux-user: xtensa: Remove unused constant TARGET_NR_syscall_count 2020-02-17 10:28:50 +01:00
migration migration/rdma: rdma_accept_incoming_migration fix error handling 2020-02-13 10:55:55 +01:00
monitor monitor: Move qmp_query_qmp_schema to qmp-cmds-control.c 2020-02-17 13:53:47 +01:00
nbd nbd: fix uninitialized variable warning 2020-01-08 16:08:17 +01:00
net chardev: Use QEMUChrEvent enum in IOEventHandler typedef 2020-01-08 11:15:35 +01:00
pc-bios hw/ppc/prep: Remove the deprecated "prep" machine and the OpenHackware BIOS 2020-02-02 14:07:57 +11:00
plugins plugins: Include trace/mem.h in api.c 2020-01-15 15:13:09 -10:00
po ui/gtk: fix gettext message's charset. 2019-11-21 09:42:30 +01:00
python/qemu python/qemu/machine: Allow to use other serial consoles than default 2020-02-07 15:12:48 +01:00
qapi qapi: Split control.json off misc.json 2020-02-17 13:53:47 +01:00
qga qga/qapi-schema.json: minor format fixups for rST 2020-02-15 11:41:49 +01:00
qobject qstring: add qstring_free() 2020-01-24 20:59:13 +01:00
qom qapi/qmp: add ObjectPropertyInfo.default-value 2020-01-24 20:59:16 +01:00
replay replay: record and replay random number sources 2020-01-07 12:08:39 +01:00
roms hw/ppc/prep: Remove the deprecated "prep" machine and the OpenHackware BIOS 2020-02-02 14:07:57 +11:00
scripts Migration pull request 2020-02-14 17:57:15 +00:00
scsi build: rename CONFIG_LIBCAP to CONFIG_LIBCAP_NG 2019-12-17 19:35:47 +01:00
slirp@126c04acba slirp: update with CVE-2019-14378 fix 2019-08-02 15:14:56 +04:00
stubs stubs: add stubs for io_uring interface 2020-01-30 20:59:41 +00:00
target RISC-V Patches for the 5.0 Soft Freeze, Part 2 2020-02-14 18:37:11 +00:00
tcg tcg: Add tcg_gen_gvec_5_ptr 2020-02-12 14:58:36 -08:00
tests qapi: Split control.json off misc.json 2020-02-17 13:53:47 +01:00
tools/virtiofsd virtiofsd: do_read missing NULL check 2020-02-10 17:24:43 +00:00
trace qemu_set_log_filename: filename argument may be NULL 2020-01-30 21:33:50 +00:00
ui qapi: Split control.json off misc.json 2020-02-17 13:53:47 +01:00
util Remove support for CLOCK_MONOTONIC not being defined 2020-02-12 16:23:01 +01:00
.cirrus.yml ci: build out-of-tree 2019-12-18 20:17:55 +00:00
.dir-locals.el Add .dir-locals.el file to configure emacs coding style 2015-10-08 19:46:01 +03:00
.editorconfig editorconfig: add setting for shell scripts 2019-06-12 17:53:22 +01:00
.exrc qemu: add .exrc 2012-09-07 09:02:44 +03:00
.gdbinit .gdbinit: load QEMU sub-commands when gdb starts 2017-06-07 14:38:45 +01:00
.gitignore virtiofsd: add vhost-user.json file 2020-01-23 16:41:36 +00:00
.gitlab-ci-edk2.yml gitlab-ci.yml: Add jobs to build EDK2 firmware binaries 2020-01-21 14:15:48 +01:00
.gitlab-ci.yml gitlab-ci: Refresh the list of iotests 2020-02-04 09:00:57 +01:00
.gitmodules hw/ppc/prep: Remove the deprecated "prep" machine and the OpenHackware BIOS 2020-02-02 14:07:57 +11:00
.gitpublish Add a git-publish configuration file 2018-03-05 09:03:17 +00:00
.mailmap MAINTAINERS: update Leif Lindholm's address 2020-02-06 10:45:42 +01:00
.patchew.yml ci: store Patchew configuration in the tree 2019-06-03 14:03:02 +02:00
.readthedocs.yml .readthedocs.yml: specify some minimum python requirements 2020-02-07 15:15:16 +01:00
.shippable.yml .shippable: --disable-docs for cross-compile tests 2020-02-04 17:13:29 +00:00
.travis.yml tests/acceptance: Add boot tests for some of the QEMU advent calendar images 2020-02-07 15:12:48 +01:00
CODING_STYLE.rst docs: split the CODING_STYLE doc into distinct groups 2019-09-05 14:41:00 +01:00
COPYING COPYING: update from FSF 2008-10-12 17:54:42 +00:00
COPYING.LIB COPYING.LIB: Synchronize the LGPL 2.1 with the version from gnu.org 2019-01-30 11:01:22 +01:00
Changelog Use HTTPS for qemu.org and other domains 2017-11-21 13:34:13 +00:00
Kconfig.host configure: simplify vhost condition with Kconfig 2019-12-17 19:32:48 +01:00
LICENSE tcg/LICENSE: Remove out of date claim about TCG subdirectory licensing 2019-11-11 15:11:21 +01:00
MAINTAINERS RISC-V Patches for the 5.0 Soft Freeze, Part 2 2020-02-14 18:37:11 +00:00
Makefile Makefile: Fix typo in dependency list for interop manpages 2020-02-15 11:41:49 +01:00
Makefile.objs Makefile: Keep trace-events-subdirs ordered 2020-01-30 21:33:50 +00:00
Makefile.target crypto: move common bits for all emulators to libqemuutil 2019-12-17 19:32:48 +01:00
README.rst docs: merge HACKING.rst contents into CODING_STYLE.rst 2019-09-05 14:27:06 +01:00
VERSION Open 5.0 development tree 2019-12-13 11:59:06 +00:00
arch_init.c hw/m68k: add Nubus macfb video card 2019-10-28 19:06:49 +01:00
balloon.c Clean up inclusion of exec/cpu-common.h 2019-08-16 13:31:52 +02:00
block.c block: fix memleaks in bdrv_refresh_filename 2020-02-06 13:47:45 +01:00
blockdev-nbd.c nbd: Allow description when creating NBD blockdev 2020-02-05 17:22:13 -06:00
blockdev.c blockdev: adds bdrv_parse_aio to use io_uring 2020-01-30 20:59:41 +00:00
blockjob.c blockjob: Fix error message for negative speed 2019-12-18 11:21:07 +01:00
bootdevice.c bootdevice: FW_CFG interface for LCHS values 2019-10-31 11:47:38 -04:00
configure QAPI patches for 2020-02-15 2020-02-16 21:15:26 +00:00
cpus-common.c cpu: introduce cpu_in_exclusive_context() 2019-10-28 15:12:38 +00:00
cpus.c Wrapper function to wait on condition for the main loop mutex 2020-02-03 11:33:10 +11:00
device-hotplug.c Include hw/hw.h exactly where needed 2019-08-16 13:31:52 +02:00
device_tree.c device_tree: Fix integer overflowing in load_device_tree() 2019-04-09 16:35:40 -07:00
disas.c plugin: add qemu_plugin_insn_disas helper 2019-10-28 15:12:38 +00:00
dma-helpers.c dma-helpers: ensure AIO callback is invoked after cancellation 2019-08-16 19:14:04 -04:00
exec-vary.c exec: Cache TARGET_PAGE_MASK for TARGET_PAGE_BITS_VARY 2019-10-28 10:35:20 +01:00
exec.c Fix breakpoint invalidation. 2020-02-13 18:00:38 +00:00
gdbstub.c chardev: Use QEMUChrEvent enum in IOEventHandler typedef 2020-01-08 11:15:35 +01:00
gitdm.config contrib: gitdm: add a mapping for Janus Technologies 2019-03-12 19:31:29 +00:00
hmp-commands-info.hx riscv: hmp: Add a command to show virtual memory mappings 2019-09-17 08:42:43 -07:00
hmp-commands.hx hmp: Allow using qdev ID for qemu-io command 2019-12-19 18:04:25 +01:00
ioport.c Include qemu-common.h exactly where needed 2019-06-12 13:20:20 +02:00
iothread.c iothread: document about why we need explicit aio_poll() 2019-03-08 10:20:57 +00:00
job-qmp.c Include qemu-common.h exactly where needed 2019-06-12 13:20:20 +02:00
job.c job: drop job_drain 2019-09-10 08:58:43 +02:00
memory.c memory.c: Use trace_event_get_state_backends() 2020-01-30 21:33:50 +00:00
memory_ldst.inc.c memory: Single byte swap along the I/O path 2019-09-03 08:30:39 -07:00
memory_mapping.c Include qemu-common.h exactly where needed 2019-06-12 13:20:20 +02:00
module-common.c all: Clean up includes 2016-02-04 17:41:30 +00:00
os-posix.c os-posix: simplify os_find_datadir 2019-12-17 19:32:47 +01:00
os-win32.c glib: use portable g_setenv() 2019-12-17 09:05:23 +01:00
qdev-monitor.c qdev: use object_property_help() 2020-01-24 20:59:17 +01:00
qemu-bridge-helper.c build: rename CONFIG_LIBCAP to CONFIG_LIBCAP_NG 2019-12-17 19:35:47 +01:00
qemu-deprecated.texi ui: deprecate legacy -show-cursor option 2020-02-12 13:25:17 +01:00
qemu-doc.texi qemu-doc: Clarify extent of build platform support 2020-02-17 13:53:47 +01:00
qemu-edid.c Include qemu-common.h exactly where needed 2019-06-12 13:20:20 +02:00
qemu-img-cmds.hx qemu-img: Place the '-i aio' option in alphabetical order 2020-02-06 11:09:36 +01:00
qemu-img.c qemu-img: adds option to use aio engine for benchmarking 2020-01-30 20:59:42 +00:00
qemu-io-cmds.c block: Pass truncate exact=true where reasonable 2019-10-28 12:08:45 +01:00
qemu-io.c qemu-io: adds option to use aio engine 2020-01-30 20:59:42 +00:00
qemu-keymap.c Include qemu-common.h exactly where needed 2019-06-12 13:20:20 +02:00
qemu-nbd.c qemu-nbd: Removed deprecated --partition option 2020-02-05 17:29:49 -06:00
qemu-option-trace.texi qemu-nbd: Convert invocation documentation to rST 2020-01-23 15:22:39 +00:00
qemu-options-wrapper.h qemu-img: remove references to GEN_DOCS 2018-05-20 08:35:54 +03:00
qemu-options.h Clean up ill-advised or unusual header guards 2016-07-12 16:20:46 +02:00
qemu-options.hx docs: stop documenting the e1000 NIC model as the default 2020-02-07 12:22:19 +00:00
qemu-seccomp.c seccomp: report more useful errors from seccomp 2019-03-27 13:11:38 +01:00
qemu-tech.texi qemu-tech: Fix dangling @menu entries 2019-07-15 21:10:29 +02:00
qemu.nsi win32: fix README file in NSIS installer 2019-09-16 12:32:21 +02:00
qemu.sasl Default to GSSAPI (Kerberos) instead of DIGEST-MD5 for SASL 2017-05-09 14:41:47 +01:00
qtest.c chardev: Use QEMUChrEvent enum in IOEventHandler typedef 2020-01-08 11:15:35 +01:00
replication.c replication: Introduce new APIs to do replication operation 2016-09-13 11:00:56 +01:00
replication.h Include qemu/module.h where needed, drop it from qemu-common.h 2019-06-12 13:18:33 +02:00
rules.mak Makefile: Ensure we don't run Sphinx in parallel for manpages 2020-02-03 10:46:32 +00:00
thunk.c thunk: improve readability of allocation loop 2019-03-11 18:48:20 +01:00
tpm.c tpm: Clean up error reporting in tpm_init_tpmdev() 2018-10-19 14:51:34 +02:00
trace-events trace: add mmu_index to mem_info 2019-10-28 15:12:38 +00:00
version.rc Use HTTPS for qemu.org and other domains 2017-11-21 13:34:13 +00:00
vl.c monitor: Move monitor option parsing to monitor/monitor.c 2020-02-17 13:47:48 +01:00

README.rst

===========
QEMU README
===========

QEMU is a generic and open source machine & userspace emulator and
virtualizer.

QEMU is capable of emulating a complete machine in software without any
need for hardware virtualization support. By using dynamic translation,
it achieves very good performance. QEMU can also integrate with the Xen
and KVM hypervisors to provide emulated hardware while allowing the
hypervisor to manage the CPU. With hypervisor support, QEMU can achieve
near native performance for CPUs. When QEMU emulates CPUs directly it is
capable of running operating systems made for one machine (e.g. an ARMv7
board) on a different machine (e.g. an x86_64 PC board).

QEMU is also capable of providing userspace API virtualization for Linux
and BSD kernel interfaces. This allows binaries compiled against one
architecture ABI (e.g. the Linux PPC64 ABI) to be run on a host using a
different architecture ABI (e.g. the Linux x86_64 ABI). This does not
involve any hardware emulation, simply CPU and syscall emulation.

QEMU aims to fit into a variety of use cases. It can be invoked directly
by users wishing to have full control over its behaviour and settings.
It also aims to facilitate integration into higher level management
layers, by providing a stable command line interface and monitor API.
It is commonly invoked indirectly via the libvirt library when using
open source applications such as oVirt, OpenStack and virt-manager.

QEMU as a whole is released under the GNU General Public License,
version 2. For full licensing details, consult the LICENSE file.


Building
========

QEMU is multi-platform software intended to be buildable on all modern
Linux platforms, OS-X, Win32 (via the Mingw64 toolchain) and a variety
of other UNIX targets. The simple steps to build QEMU are:


.. code-block:: shell

  mkdir build
  cd build
  ../configure
  make

Additional information can also be found online via the QEMU website:

* `<https://qemu.org/Hosts/Linux>`_
* `<https://qemu.org/Hosts/Mac>`_
* `<https://qemu.org/Hosts/W32>`_


Submitting patches
==================

The QEMU source code is maintained under the GIT version control system.

.. code-block:: shell

   git clone https://git.qemu.org/git/qemu.git

When submitting patches, one common approach is to use 'git
format-patch' and/or 'git send-email' to format & send the mail to the
qemu-devel@nongnu.org mailing list. All patches submitted must contain
a 'Signed-off-by' line from the author. Patches should follow the
guidelines set out in the CODING_STYLE.rst file.

Additional information on submitting patches can be found online via
the QEMU website

* `<https://qemu.org/Contribute/SubmitAPatch>`_
* `<https://qemu.org/Contribute/TrivialPatches>`_

The QEMU website is also maintained under source control.

.. code-block:: shell

  git clone https://git.qemu.org/git/qemu-web.git

* `<https://www.qemu.org/2017/02/04/the-new-qemu-website-is-up/>`_

A 'git-publish' utility was created to make above process less
cumbersome, and is highly recommended for making regular contributions,
or even just for sending consecutive patch series revisions. It also
requires a working 'git send-email' setup, and by default doesn't
automate everything, so you may want to go through the above steps
manually for once.

For installation instructions, please go to

*  `<https://github.com/stefanha/git-publish>`_

The workflow with 'git-publish' is:

.. code-block:: shell

  $ git checkout master -b my-feature
  $ # work on new commits, add your 'Signed-off-by' lines to each
  $ git publish

Your patch series will be sent and tagged as my-feature-v1 if you need to refer
back to it in the future.

Sending v2:

.. code-block:: shell

  $ git checkout my-feature # same topic branch
  $ # making changes to the commits (using 'git rebase', for example)
  $ git publish

Your patch series will be sent with 'v2' tag in the subject and the git tip
will be tagged as my-feature-v2.

Bug reporting
=============

The QEMU project uses Launchpad as its primary upstream bug tracker. Bugs
found when running code built from QEMU git or upstream released sources
should be reported via:

* `<https://bugs.launchpad.net/qemu/>`_

If using QEMU via an operating system vendor pre-built binary package, it
is preferable to report bugs to the vendor's own bug tracker first. If
the bug is also known to affect latest upstream code, it can also be
reported via launchpad.

For additional information on bug reporting consult:

* `<https://qemu.org/Contribute/ReportABug>`_


Contact
=======

The QEMU community can be contacted in a number of ways, with the two
main methods being email and IRC

* `<mailto:qemu-devel@nongnu.org>`_
* `<https://lists.nongnu.org/mailman/listinfo/qemu-devel>`_
* #qemu on irc.oftc.net

Information on additional methods of contacting the community can be
found online via the QEMU website:

* `<https://qemu.org/Contribute/StartHere>`_