Bug 601192

Summary: fork causes trouble for vcpu threads
Product: Red Hat Enterprise Linux 6 Reporter: Gerd Hoffmann <kraxel>
Component: kernelAssignee: Glauber Costa <gcosta>
Status: CLOSED CURRENTRELEASE QA Contact: Virtualization Bugs <virt-bugs>
Severity: medium Docs Contact:
Priority: low    
Version: 6.0CC: armbru, berrange, gcosta, kcao, michen, mkenneth, tburke, virt-maint
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 606953 (view as bug list) Environment:
Last Closed: 2010-07-09 02:10:35 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On:    
Bug Blocks: 579026, 606953    

Description Gerd Hoffmann 2010-06-07 12:42:34 UTC
Description of problem:
Guest stops running when qemu receives SIGCHILD.

Version-Release number of selected component (if applicable):

How reproducible:
(1) boot guest
(2) make qemu fork+exec something which exits quicky.
    "netdev_add tap,id=foo,script=/bin/true" will do.
Actual results:
Guest stops running.

Expected results:
Guest continues running.

Additional info:
Disabling the qemu SIGCHLD signal handler makes the problem disappear.  Not a good idea though.

Blocking SIGCHLD in the vcpu threads works too.  Not sure this is the correct fix or whenever it just papers over the underlying bug.

Comment 2 RHEL Product and Program Management 2010-06-07 17:03:19 UTC
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux major release.  Product Management has requested further
review of this request by Red Hat Engineering, for potential inclusion in a Red
Hat Enterprise Linux Major release.  This request is not yet committed for

Comment 3 Gerd Hoffmann 2010-06-08 08:58:16 UTC
Glauber, can you put your io-thread hat on and either comment on the possible fixes outlined in "Additional info" above or just grab this bug and handle it?

Comment 4 Glauber Costa 2010-06-08 17:47:38 UTC

I made some comments on this bug yesterday. Somehow, they are missing, no idea why.
I am already working on it.

Comment 5 Glauber Costa 2010-06-10 18:48:00 UTC
Ok, some more info:

It doesn't seem to happen with -no-kvm-irqchip. Investigating, I've found that after the receival of SIGCHLD, the kernel is blocked in kvm_vcpu_block. Also,
it is hardly triggable when the guest kernel hasn't reached userspace yet (probably because it halts less, during kernel boot).

The funny thing is that it never happens when one just sends SIGCHLD to the process. The signal handler is executed, but the problem does not appear.

I believe there is a race somewhere, where we consume a SIGCHLD when expecting SIG_IPI, and then this other signal is lost.

But right now, my biggest belief is that there is a race bug somewhere in the kernel, in the in-kernel apic implementation.

Comment 6 Glauber Costa 2010-06-10 19:45:03 UTC
Ok, I now reproduce it even when disabling the SIGCHLD signal handler.

This is conforming to my theory that we have a race with sigpending status.

Comment 7 Aristeu Rozanski 2010-07-01 16:23:13 UTC
Patch(es) available on kernel-2.6.32-42.el6

Comment 10 Cao, Chen 2010-07-05 12:07:22 UTC
I have tried on 
# uname -r

for tens of times, and cannot reproduce this bug.

but on
# uname -r

I can, sometimes, find the guest machine (rhel6) cannot execute commands
completely, i.e.
#  ping
PING ( 56(84) bytes of data.
64 bytes from icmp_seq=1 ttl=64 time=0.034 ms

and cannot go on any more.

and "top", "reboot" and some other commands cannot return any thing.

anyway, I cannot reproduce this on 2.6.32-42.el6.x86_64 kernel.

Additional info:
# rpm -q qemu-kvm

command that starts vm:
qemu-kvm -name vm1 -monitor stdio -drive file=./RHEL-Server-6.0-64.qcow2,if=ide,cache=none,aio=native  -m 2048 -smp 2 -vnc :0 -spice port=8000,disable-ticketing -usbdevice tablet -rtc-td-hack -cpu qemu64,+sse2 -no-kvm-pit-reinjection -net nic,vlan=0,netdev=DWxy,model=rtl8139,macaddr='02:6F:F6:3D:b9:b2' -netdev tap,id=DWxy,ifname=rtl8139_0_8000,script=.scripts/qemu-ifup-switch,downscript=no

command that trys to trigger this bug:
netdev_add tap,id=foo,script=/bin/true

Comment 11 Dor Laor 2010-07-12 09:31:44 UTC
*** Bug 585195 has been marked as a duplicate of this bug. ***