using x-vga=on with vfio-pci leads to segfault
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
QEMU |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
bug occures at least with qemu 2.8.0 and 2.8.1 in 64bit-system
stripped cmd for minimal config:
qemu-system-i386 -m 2048 -M q35 -enable-kvm -nodefaults -nodefconfig -device ioh3420,
Backtrace is:
#0 0x00005555557ca836 in memory_
#1 0x00005555557ca9dc in memory_
#2 0x00005555557caa9a in memory_
#3 0x0000555555832e48 in vfio_probe_
#4 0x0000555555835433 in vfio_bar_
#5 0x000055555582f122 in vfio_realize (pdev=0x5555580
#6 0x0000555555a86195 in pci_qdev_realize (qdev=0x5555580
#7 0x00005555559be7b7 in device_set_realized (obj=0x55555805
#8 0x0000555555bb017f in property_set_bool (obj=0x55555805
#9 0x0000555555bae2e6 in object_property_set (obj=0x55555805
#10 0x0000555555bb184f in object_
#11 0x0000555555bae637 in object_
#12 0x00005555558fee4b in qdev_device_add (opts=0x555556b
#13 0x00005555559142c1 in device_init_func (opaque=0x0, opts=0x555556b1
#14 0x0000555555cc3bb7 in qemu_opts_foreach (list=0x5555565
#15 0x00005555559198aa in main (argc=12, argv=0x7fffffff
as I can see, it happens during initialization of the device-option.
seems that the code tries to loop over a memory-region mr, which is null from at least three calls before it crashes.
because there seems to be special handling for nvidia-cards, here're the pci-infos of the card:
01:00.0 VGA compatible controller [0300]: NVIDIA Corporation G72 [GeForce 7300 GS] [10de:01df] (rev a1) (prog-if 00 [VGA controller])
Subsystem: Gigabyte Technology Co., Ltd Device [1458:342a]
Flags: fast devsel, IRQ 16
Memory at de000000 (32-bit, non-prefetchable) [disabled] [size=16M]
Memory at c0000000 (64-bit, prefetchable) [disabled] [size=256M]
Memory at dd000000 (64-bit, non-prefetchable) [disabled] [size=16M]
Expansion ROM at df000000 [disabled] [size=128K]
Capabilities: [60] Power Management version 2
Capabilities: [68] MSI: Enable- Count=1/1 Maskable- 64bit+
Capabilities: [78] Express Endpoint, MSI 00
Capabilities: [100] Virtual Channel
Capabilities: [128] Power Budgeting <?>
Kernel driver in use: vfio-pci
at least with a similar card in another slot the crash does not occure.
(sorry, can't change the slots at the moment)
Changed in qemu: | |
status: | New → Fix Committed |
Changed in qemu: | |
status: | Fix Committed → Fix Released |
It's highly likely that a 7-series GeForce has a different BAR layout than a modern card and should be considered unsupported. Is the "similar card in another slot" also a 7-series or older card? Out of curiosity, add another -v to the lspci output (lspci -vv) so that it identifies which BARs are which. A more modern card looks like this:
Region 0: Memory at f6000000 (32-bit, non-prefetchable) [size=16M]
Region 1: Memory at e0000000 (64-bit, prefetchable) [size=256M]
Region 3: Memory at f0000000 (64-bit, prefetchable) [size=32M]
Region 5: I/O ports at e000 [size=128]
Expansion ROM at f7000000 [disabled] [size=512K]
Thus the quirk should be triggered on the I/O port BAR, which your card doesn't seem to have.