Bug 1309227

Summary: lspci core dump in guest when there have 7 layers switches
Product: Red Hat Enterprise Linux 7 Reporter: jingzhao <jinzhao>
Component: qemu-kvm-rhevAssignee: Marcel Apfelbaum <marcel>
Status: CLOSED WONTFIX QA Contact: jingzhao <jinzhao>
Severity: low Docs Contact:
Priority: low    
Version: 7.2CC: chayang, juzhang, knoel, marcel, virt-maint, xfu
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-04-26 13:19:57 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description jingzhao 2016-02-17 09:39:17 UTC
Description of problem:
lspci core dump in guest when there have 8 layers switches

Version-Release number of selected component (if applicable):
kernel-3.10.0-349.el7.x86_64
qemu-kvm-rhev-2.3.0-31.el7_2.7.x86_64
guest:kernel-3.10.0-327.el7.x86_64

How reproducible:
3/3

Steps to Reproduce:
1. Boot guest with following cli:

/usr/libexec/qemu-kvm \
-M q35 \
-cpu SandyBridge \
-nodefaults -rtc base=utc \
-m 4G \
-smp 2,sockets=2,cores=1,threads=1 \
-enable-kvm \
-name rhel6 \
-uuid 990ea161-6b67-47b2-b803-19fb01d30d12 \
-smbios type=1,manufacturer='Red Hat',product='RHEV Hypervisor',version=el6,serial=koTUXQrb,uuid=feebc8fd-f8b0-4e75-abc3-e63fcdb67170 \
-k en-us \
-monitor stdio \
-serial unix:/tmp/serial0,server,nowait \
-boot menu=on \
-bios /usr/share/seabios/bios.bin \
-vga std \
-vnc :0 \
-drive file=/home/rhel.img,if=none,id=drive-virtio-disk0,format=raw,cache=none,werror=stop,rerror=stop,aio=threads \
-device virtio-blk-pci,scsi=off,bus=pcie.0,drive=drive-virtio-disk0,id=virtio-disk0,bootindex=0 \
-device ioh3420,bus=pcie.0,id=root.0,slot=1 \
-device ioh3420,bus=pcie.0,id=root.1,slot=2 \
-device x3130-upstream,bus=root.0,id=upstream1 \
-device xio3130-downstream,bus=upstream1,id=downstream1,chassis=1 \
-device x3130-upstream,bus=downstream1,id=upstream2 \
-device xio3130-downstream,bus=upstream2,id=downstream2,chassis=2 \
-device x3130-upstream,bus=downstream2,id=upstream3 \
-device xio3130-downstream,bus=upstream3,id=downstream3,chassis=3 \
-device x3130-upstream,bus=downstream3,id=upstream4 \
-device xio3130-downstream,bus=upstream4,id=downstream4,chassis=4 \
-device x3130-upstream,bus=downstream4,id=upstream5 \
-device xio3130-downstream,bus=upstream5,id=downstream5,chassis=5 \
-device x3130-upstream,bus=downstream5,id=upstream6 \
-device xio3130-downstream,bus=upstream6,id=downstream6,chassis=6 \
-device x3130-upstream,bus=downstream6,id=upstream7 \
-device xio3130-downstream,bus=upstream7,id=downstream7,chassis=7 \
-device x3130-upstream,bus=downstream7,id=upstream8 \
-device xio3130-downstream,bus=upstream8,id=downstream8,chassis=8 \
-device usb-ehci,bus=downstream2,id=ehci \
-drive if=none,file=/home/storage.qcow2,id=disk \
-device usb-storage,drive=disk,bus=ehci.0 \
-netdev tap,id=hostnet1,vhost=on \
-device virtio-net-pci,netdev=hostnet1,id=net1,mac=54:52:00:B6:40:22,bus=root.1 \

2. check the switches with "info qtree" on hmp
(qemu) info qtree
bus: main-system-bus
  type System
  dev: kvm-ioapic, id ""
    gpio-in "" 24
    gsi_base = 0 (0x0)
    mmio 00000000fec00000/0000000000001000
  dev: q35-pcihost, id ""
    MCFG = 2952790016 (0xb0000000)
    pci-hole64-size = 0 (0 B)
    short_root_bus = 0 (0x0)
    bus: pcie.0
      type PCIE
      dev: ioh3420, id "root.1"
        power_controller_present = true
        chassis = 0 (0x0)
        slot = 2 (0x2)
        port = 0 (0x0)
        aer_log_max = 8 (0x8)
        addr = 04.0
        romfile = ""
        rombar = 1 (0x1)
        multifunction = false
        command_serr_enable = true
        class PCI bridge, addr 00:04.0, pci id 8086:3420 (sub 0000:0000)
        bus: root.1
          type PCIE
          dev: virtio-net-pci, id "net1"
            ioeventfd = false
            vectors = 3 (0x3)
            virtio-pci-bus-master-bug-migration = false
            disable-legacy = false
            disable-modern = true
            addr = 00.0
            romfile = "pxe-virtio.rom"
            rombar = 1 (0x1)
            multifunction = false
            command_serr_enable = true
            class Ethernet controller, addr 12:00.0, pci id 1af4:1000 (sub 1af4:0001)
            bar 0: i/o at 0xc000 [0xc01f]
            bar 1: mem at 0xfe640000 [0xfe640fff]
            bar 6: mem at 0xffffffffffffffff [0x3fffe]
            bus: virtio-bus
              type virtio-pci-bus
              dev: virtio-net-device, id ""
                csum = true
                guest_csum = true
                gso = true
                guest_tso4 = true
                guest_tso6 = true
                guest_ecn = true
                guest_ufo = true
                guest_announce = true
                host_tso4 = true
                host_tso6 = true
                host_ecn = true
                host_ufo = true
                mrg_rxbuf = true
                status = true
                ctrl_vq = true
                ctrl_rx = true
                ctrl_vlan = true
                ctrl_rx_extra = true
                ctrl_mac_addr = true
                ctrl_guest_offloads = true
                mq = false
                mac = "54:52:00:b6:40:22"
                vlan = <null>
                netdev = "hostnet1"
                x-txtimer = 150000 (0x249f0)
                x-txburst = 256 (0x100)
                tx = ""
                indirect_desc = true
                event_idx = true
                notify_on_empty = true
                any_layout = true
      dev: ioh3420, id "root.0"
        power_controller_present = true
        chassis = 0 (0x0)
        slot = 1 (0x1)
        port = 0 (0x0)
        aer_log_max = 8 (0x8)
        addr = 03.0
        romfile = ""
        rombar = 1 (0x1)
        multifunction = false
        command_serr_enable = true
        class PCI bridge, addr 00:03.0, pci id 8086:3420 (sub 0000:0000)
        bus: root.0
          type PCIE
          dev: x3130-upstream, id "upstream1"
            port = 0 (0x0)
            aer_log_max = 8 (0x8)
            addr = 00.0
            romfile = ""
            rombar = 1 (0x1)
            multifunction = false
            command_serr_enable = true
            class PCI bridge, addr 01:00.0, pci id 104c:8232 (sub 0000:0000)
            bus: upstream1
              type PCIE
              dev: xio3130-downstream, id "downstream1"
                power_controller_present = true
                chassis = 1 (0x1)
                slot = 0 (0x0)
                port = 0 (0x0)
                aer_log_max = 8 (0x8)
                addr = 00.0
                romfile = ""
                rombar = 1 (0x1)
                multifunction = false
                command_serr_enable = true
                class PCI bridge, addr 02:00.0, pci id 104c:8233 (sub 0000:0000)
                bus: downstream1
                  type PCIE
                  dev: x3130-upstream, id "upstream2"
                    port = 0 (0x0)
                    aer_log_max = 8 (0x8)
                    addr = 00.0
                    romfile = ""
                    rombar = 1 (0x1)
                    multifunction = false
                    command_serr_enable = true
                    class PCI bridge, addr 03:00.0, pci id 104c:8232 (sub 0000:0000)
                    bus: upstream2
                      type PCIE
                      dev: xio3130-downstream, id "downstream2"
                        power_controller_present = true
                        chassis = 2 (0x2)
                        slot = 0 (0x0)
                        port = 0 (0x0)
                        aer_log_max = 8 (0x8)
                        addr = 00.0
                        romfile = ""
                        rombar = 1 (0x1)
                        multifunction = false
                        command_serr_enable = true
                        class PCI bridge, addr 04:00.0, pci id 104c:8233 (sub 0000:0000)
                        bus: downstream2
                          type PCIE
                          dev: usb-ehci, id "ehci"
                            maxframes = 128 (0x80)
                            addr = 01.0
                            romfile = ""
                            rombar = 1 (0x1)
                            multifunction = false
                            command_serr_enable = true
                            class USB controller, addr 05:01.0, pci id 8086:24cd (sub 1af4:1100)
                            bar 0: mem at 0xfe800000 [0xfe800fff]
                            bus: ehci.0
                              type usb-bus
                              dev: usb-storage, id ""
                                drive = ""
                                logical_block_size = 512 (0x200)
                                physical_block_size = 512 (0x200)
                                min_io_size = 0 (0x0)
                                opt_io_size = 0 (0x0)
                                discard_granularity = 4294967295 (0xffffffff)
                                removable = false
                                port = ""
                                serial = ""
                                full-path = true
                                msos-desc = true
                                addr 0.1, port 1, speed 480, name QEMU USB MSD, attached
                                bus: scsi.0
                                  type SCSI
                                  dev: scsi-disk, id ""
                                    drive = "disk"
                                    logical_block_size = 512 (0x200)
                                    physical_block_size = 512 (0x200)
                                    min_io_size = 0 (0x0)
                                    opt_io_size = 0 (0x0)
                                    discard_granularity = 4096 (0x1000)
                                    ver = "2.3.0"
                                    serial = ""
                                    vendor = "QEMU"
                                    product = "QEMU HARDDISK"
                                    removable = false
                                    dpofua = false
                                    wwn = 0 (0x0)
                                    port_wwn = 0 (0x0)
                                    port_index = 0 (0x0)
                                    max_unmap_size = 1073741824 (0x40000000)
                                    max_io_size = 2147483647 (0x7fffffff)
                                    channel = 0 (0x0)
                                    scsi-id = 0 (0x0)
                                    lun = 0 (0x0)
                          dev: x3130-upstream, id "upstream3"
                            port = 0 (0x0)
                            aer_log_max = 8 (0x8)
                            addr = 00.0
                            romfile = ""
                            rombar = 1 (0x1)
                            multifunction = false
                            command_serr_enable = true
                            class PCI bridge, addr 05:00.0, pci id 104c:8232 (sub 0000:0000)
                            bus: upstream3
                              type PCIE
                              dev: xio3130-downstream, id "downstream3"
                                power_controller_present = true
                                chassis = 3 (0x3)
                                slot = 0 (0x0)
                                port = 0 (0x0)
                                aer_log_max = 8 (0x8)
                                addr = 00.0
                                romfile = ""
                                rombar = 1 (0x1)
                                multifunction = false
                                command_serr_enable = true
                                class PCI bridge, addr 06:00.0, pci id 104c:8233 (sub 0000:0000)
                                bus: downstream3
                                  type PCIE
                                  dev: x3130-upstream, id "upstream4"
                                    port = 0 (0x0)
                                    aer_log_max = 8 (0x8)
                                    addr = 00.0
                                    romfile = ""
                                    rombar = 1 (0x1)
                                    multifunction = false
                                    command_serr_enable = true
                                    class PCI bridge, addr 07:00.0, pci id 104c:8232 (sub 0000:0000)
                                    bus: upstream4
                                      type PCIE
                                      dev: xio3130-downstream, id "downstream4"
                                        power_controller_present = true
                                        chassis = 4 (0x4)
                                        slot = 0 (0x0)
                                        port = 0 (0x0)
                                        aer_log_max = 8 (0x8)
                                        addr = 00.0
                                        romfile = ""
                                        rombar = 1 (0x1)
                                        multifunction = false
                                        command_serr_enable = true
                                        class PCI bridge, addr 08:00.0, pci id 104c:8233 (sub 0000:0000)
                                        bus: downstream4
                                          type PCIE
                                          dev: x3130-upstream, id "upstream5"
                                            port = 0 (0x0)
                                            aer_log_max = 8 (0x8)
                                            addr = 00.0
                                            romfile = ""
                                            rombar = 1 (0x1)
                                            multifunction = false
                                            command_serr_enable = true
                                            class PCI bridge, addr 09:00.0, pci id 104c:8232 (sub 0000:0000)
                                            bus: upstream5
                                              type PCIE
                                              dev: xio3130-downstream, id "downstream5"
                                                power_controller_present = true
                                                chassis = 5 (0x5)
                                                slot = 0 (0x0)
                                                port = 0 (0x0)
                                                aer_log_max = 8 (0x8)
                                                addr = 00.0
                                                romfile = ""
                                                rombar = 1 (0x1)
                                                multifunction = false
                                                command_serr_enable = true
                                                class PCI bridge, addr 0a:00.0, pci id 104c:8233 (sub 0000:0000)
                                                bus: downstream5
                                                  type PCIE
                                                  dev: x3130-upstream, id "upstream6"
                                                    port = 0 (0x0)
                                                    aer_log_max = 8 (0x8)
                                                    addr = 00.0
                                                    romfile = ""
                                                    rombar = 1 (0x1)
                                                    multifunction = false
                                                    command_serr_enable = true
                                                    class PCI bridge, addr 0b:00.0, pci id 104c:8232 (sub 0000:0000)
                                                    bus: upstream6
                                                      type PCIE
                                                      dev: xio3130-downstream, id "downstream6"
                                                        power_controller_present = true
                                                        chassis = 6 (0x6)
                                                        slot = 0 (0x0)
                                                        port = 0 (0x0)
                                                        aer_log_max = 8 (0x8)
                                                        addr = 00.0
                                                        romfile = ""
                                                        rombar = 1 (0x1)
                                                        multifunction = false
                                                        command_serr_enable = true
                                                        class PCI bridge, addr 0c:00.0, pci id 104c:8233 (sub 0000:0000)
                                                        bus: downstream6
                                                          type PCIE
                                                          dev: x3130-upstream, id "upstream7"
                                                            port = 0 (0x0)
                                                            aer_log_max = 8 (0x8)
                                                            addr = 00.0
                                                            romfile = ""
                                                            rombar = 1 (0x1)
                                                            multifunction = false
                                                            command_serr_enable = true
                                                            class PCI bridge, addr 0d:00.0, pci id 104c:8232 (sub 0000:0000)
                                                            bus: upstream7
                                                              type PCIE
                                                              dev: xio3130-downstream, id "downstream7"
                                                                power_controller_present = true
                                                                chassis = 7 (0x7)
                                                                slot = 0 (0x0)
                                                                port = 0 (0x0)
                                                                aer_log_max = 8 (0x8)
                                                                addr = 00.0
                                                                romfile = ""
                                                                rombar = 1 (0x1)
                                                                multifunction = false
                                                                command_serr_enable = true
                                                                class PCI bridge, addr 0e:00.0, pci id 104c:8233 (sub 0000:0000)
                                                                bus: downstream7
                                                                  type PCIE
                                                                  dev: x3130-upstream, id "upstream8"
                                                                    port = 0 (0x0)
                                                                    aer_log_max = 8 (0x8)
                                                                    addr = 00.0
                                                                    romfile = ""
                                                                    rombar = 1 (0x1)
                                                                    multifunction = false
                                                                    command_serr_enable = true
                                                                    class PCI bridge, addr 0f:00.0, pci id 104c:8232 (sub 0000:0000)
                                                                    bus: upstream8
                                                                      type PCIE
                                                                      dev: xio3130-downstream, id "downstream8"
                                                                        power_controller_present = true
                                                                        chassis = 8 (0x8)
                                                                        slot = 0 (0x0)
                                                                        port = 0 (0x0)
                                                                        aer_log_max = 8 (0x8)
                                                                        addr = 00.0
                                                                        romfile = ""
                                                                        rombar = 1 (0x1)
                                                                        multifunction = false
                                                                        command_serr_enable = true
                                                                        class PCI bridge, addr 10:00.0, pci id 104c:8233 (sub 0000:0000)
                                                                        bus: downstream8
                                                                          type PCIE
      dev: virtio-blk-pci, id "virtio-disk0"
        class = 0 (0x0)
        ioeventfd = true
        vectors = 2 (0x2)
        virtio-pci-bus-master-bug-migration = false
        disable-legacy = false
        disable-modern = true
        addr = 02.0
        romfile = ""
        rombar = 1 (0x1)
        multifunction = false
        command_serr_enable = true
        class SCSI controller, addr 00:02.0, pci id 1af4:1001 (sub 1af4:0002)
        bar 0: i/o at 0xd000 [0xd03f]
        bar 1: mem at 0xfea11000 [0xfea11fff]
        bus: virtio-bus
          type virtio-pci-bus
          dev: virtio-blk-device, id ""
            drive = "drive-virtio-disk0"
            logical_block_size = 512 (0x200)
            physical_block_size = 512 (0x200)
            min_io_size = 0 (0x0)
            opt_io_size = 0 (0x0)
            discard_granularity = 4294967295 (0xffffffff)
            cyls = 16383 (0x3fff)
            heads = 16 (0x10)
            secs = 63 (0x3f)
            serial = ""
            config-wce = true
            scsi = false
            request-merging = true
            x-data-plane = false
            indirect_desc = true
            event_idx = true
            notify_on_empty = true
            any_layout = false
      dev: VGA, id ""
        vgamem_mb = 16 (0x10)
        mmio = true
        qemu-extended-regs = true
        addr = 01.0
        romfile = "vgabios-stdvga.bin"
        rombar = 1 (0x1)
        multifunction = false
        command_serr_enable = true
        class VGA controller, addr 00:01.0, pci id 1234:1111 (sub 1af4:1100)
        bar 0: mem at 0xfd000000 [0xfdffffff]
        bar 2: mem at 0xfea10000 [0xfea10fff]
        bar 6: mem at 0xffffffffffffffff [0xfffe]
      dev: ICH9 SMB, id ""
        addr = 1f.3
        romfile = ""
        rombar = 1 (0x1)
        multifunction = true
        command_serr_enable = true
        class SMBus, addr 00:1f.3, pci id 8086:2930 (sub 1af4:1100)
        bar 4: i/o at 0x700 [0x73f]
        bus: i2c
          type i2c-bus
          dev: smbus-eeprom, id ""
            address = 87 (0x57)
          dev: smbus-eeprom, id ""
            address = 86 (0x56)
          dev: smbus-eeprom, id ""
            address = 85 (0x55)
          dev: smbus-eeprom, id ""
            address = 84 (0x54)
          dev: smbus-eeprom, id ""
            address = 83 (0x53)
          dev: smbus-eeprom, id ""
            address = 82 (0x52)
          dev: smbus-eeprom, id ""
            address = 81 (0x51)
          dev: smbus-eeprom, id ""
            address = 80 (0x50)
      dev: ich9-ahci, id ""
        addr = 1f.2
        romfile = ""
        rombar = 1 (0x1)
        multifunction = true
        command_serr_enable = true
        class SATA controller, addr 00:1f.2, pci id 8086:2922 (sub 1af4:1100)
        bar 4: i/o at 0xd080 [0xd09f]
        bar 5: mem at 0xfea12000 [0xfea12fff]
        bus: ide.5
          type IDE
        bus: ide.4
          type IDE
        bus: ide.3
          type IDE
        bus: ide.2
          type IDE
        bus: ide.1
          type IDE
        bus: ide.0
          type IDE
      dev: ICH9-LPC, id ""
        addr = 1f.0
        romfile = ""
        rombar = 1 (0x1)
        multifunction = true
        command_serr_enable = true
        class ISA bridge, addr 00:1f.0, pci id 8086:2918 (sub 1af4:1100)
        bus: isa.0
          type ISA
          dev: port92, id ""
          dev: vmmouse, id ""
          dev: vmport, id ""
          dev: i8042, id ""
            isa irqs 1,12
          dev: isa-serial, id ""
            index = 0 (0x0)
            iobase = 1016 (0x3f8)
            irq = 4 (0x4)
            chardev = "serial0"
            wakeup = 0 (0x0)
            isa irq 4
          dev: isa-pcspk, id ""
            iobase = 97 (0x61)
          dev: kvm-pit, id ""
            gpio-in "" 1
            iobase = 64 (0x40)
            lost_tick_policy = "delay"
          dev: mc146818rtc, id ""
            base_year = 0 (0x0)
            lost_tick_policy = "discard"
            isa irq 8
          dev: kvm-i8259, id ""
            iobase = 160 (0xa0)
            elcr_addr = 1233 (0x4d1)
            elcr_mask = 222 (0xde)
            master = false
          dev: kvm-i8259, id ""
            iobase = 32 (0x20)
            elcr_addr = 1232 (0x4d0)
            elcr_mask = 248 (0xf8)
            master = true
      dev: mch, id ""
        addr = 00.0
        romfile = ""
        rombar = 1 (0x1)
        multifunction = false
        command_serr_enable = true
        class Host bridge, addr 00:00.0, pci id 8086:29c0 (sub 1af4:1100)
  dev: fw_cfg_io, id ""
    iobase = 1296 (0x510)
  dev: kvmclock, id ""
  dev: kvmvapic, id ""
  dev: icc-bridge, id ""
    mmio 00000000fee00000/0000000000100000
    bus: icc
      type icc-bus
      dev: kvm-apic, id ""
        id = 1 (0x1)
        version = 20 (0x14)
        vapic = true
      dev: SandyBridge-x86_64-cpu, id ""
        pmu = false
        hv-spinlocks = -1 (0xffffffffffffffff)
        hv-relaxed = false
        hv-vapic = false
        hv-time = false
        check = false
        enforce = false
        kvm = true
      dev: kvm-apic, id ""
        id = 0 (0x0)
        version = 20 (0x14)
        vapic = true
      dev: SandyBridge-x86_64-cpu, id ""
        pmu = false
        hv-spinlocks = -1 (0xffffffffffffffff)
        hv-relaxed = false
        hv-vapic = false
        hv-time = false
        check = false
        enforce = false
        kvm = true

3. check the controller in guest with lspci

Actual results:
lspci core dump in the guest

[root@localhost ~]# lspci -vvv -t
-[0000:00]-+-00.0  Intel Corporation 82G33/G31/P35/P31 Express DRAM Controller
           +-01.0  Device 1234:1111
           +-02.0  Red Hat, Inc Virtio block device
           +-03.0-[01-11]----00.0-[02-11]----00.0-[03-11]----00.0-[04-11]----00.0-[05-11]----00.0-[06-11]----00.0-[07-11]----00.0-[08-11]----00.0-[09-11]----00.0-[0a-11]----00.0-[0b-11]----00.0-[0c-11]----00.0-[0d-11]----00.0-[0e-11]----00.0-[0f-11]----00.0-[10-11]----00.0-[11]--
           +-04.0-[12]----00.0  Red Hat, Inc Virtio network device
           +-1f.0  Intel Corporation 82801IB (ICH9) LPC Interface Controller
           +-1f.2  Intel Corporation 82801IR/IO/IH (ICH9R/DO/DH) 6 port SATA Controller [AHCI mode]
           \-1f.3  Intel Corporation 82801I (ICH9 Family) SMBus Controller
*** stack smashing detected ***: lspci terminated
======= Backtrace: =========
/lib64/libc.so.6(__fortify_fail+0x37)[0x7f042c750a77]
/lib64/libc.so.6(__fortify_fail+0x0)[0x7f042c750a40]
lspci[0x40a05e]
lspci[0x4019f6]
/lib64/libc.so.6(__libc_start_main+0xf5)[0x7f042c664b15]
lspci[0x401a31]
======= Memory map: ========
00400000-00410000 r-xp 00000000 fd:00 203092595                          /usr/sbin/lspci
0060f000-00610000 r--p 0000f000 fd:00 203092595                          /usr/sbin/lspci
00610000-00611000 rw-p 00010000 fd:00 203092595                          /usr/sbin/lspci
0130a000-0149f000 rw-p 00000000 00:00 0                                  [heap]
7f042c001000-7f042c016000 r-xp 00000000 fd:00 201326729                  /usr/lib64/libgcc_s-4.8.5-20150702.so.1
7f042c016000-7f042c215000 ---p 00015000 fd:00 201326729                  /usr/lib64/libgcc_s-4.8.5-20150702.so.1
7f042c215000-7f042c216000 r--p 00014000 fd:00 201326729                  /usr/lib64/libgcc_s-4.8.5-20150702.so.1
7f042c216000-7f042c217000 rw-p 00015000 fd:00 201326729                  /usr/lib64/libgcc_s-4.8.5-20150702.so.1
7f042c217000-7f042c222000 r-xp 00000000 fd:00 201342600                  /usr/lib64/libnss_files-2.17.so
7f042c222000-7f042c421000 ---p 0000b000 fd:00 201342600                  /usr/lib64/libnss_files-2.17.so
7f042c421000-7f042c422000 r--p 0000a000 fd:00 201342600                  /usr/lib64/libnss_files-2.17.so
7f042c422000-7f042c423000 rw-p 0000b000 fd:00 201342600                  /usr/lib64/libnss_files-2.17.so
7f042c423000-7f042c429000 rw-p 00000000 00:00 0 
7f042c429000-7f042c43f000 r-xp 00000000 fd:00 201342610                  /usr/lib64/libresolv-2.17.so
7f042c43f000-7f042c63f000 ---p 00016000 fd:00 201342610                  /usr/lib64/libresolv-2.17.so
7f042c63f000-7f042c640000 r--p 00016000 fd:00 201342610                  /usr/lib64/libresolv-2.17.so
7f042c640000-7f042c641000 rw-p 00017000 fd:00 201342610                  /usr/lib64/libresolv-2.17.so
7f042c641000-7f042c643000 rw-p 00000000 00:00 0 
7f042c643000-7f042c7f9000 r-xp 00000000 fd:00 201341814                  /usr/lib64/libc-2.17.so
7f042c7f9000-7f042c9f9000 ---p 001b6000 fd:00 201341814                  /usr/lib64/libc-2.17.so
7f042c9f9000-7f042c9fd000 r--p 001b6000 fd:00 201341814                  /usr/lib64/libc-2.17.so
7f042c9fd000-7f042c9ff000 rw-p 001ba000 fd:00 201341814                  /usr/lib64/libc-2.17.so
7f042c9ff000-7f042ca04000 rw-p 00000000 00:00 0 
7f042ca04000-7f042ca0f000 r-xp 00000000 fd:00 201844046                  /usr/lib64/libpci.so.3.2.1
7f042ca0f000-7f042cc0f000 ---p 0000b000 fd:00 201844046                  /usr/lib64/libpci.so.3.2.1
7f042cc0f000-7f042cc10000 r--p 0000b000 fd:00 201844046                  /usr/lib64/libpci.so.3.2.1
7f042cc10000-7f042cc11000 rw-p 0000c000 fd:00 201844046                  /usr/lib64/libpci.so.3.2.1
7f042cc11000-7f042cc32000 r-xp 00000000 fd:00 201341807                  /usr/lib64/ld-2.17.so
7f042ce1c000-7f042ce1f000 rw-p 00000000 00:00 0 
7f042ce2f000-7f042ce32000 rw-p 00000000 00:00 0 
7f042ce32000-7f042ce33000 r--p 00021000 fd:00 201341807                  /usr/lib64/ld-2.17.so
7f042ce33000-7f042ce34000 rw-p 00022000 fd:00 201341807                  /usr/lib64/ld-2.17.so
7f042ce34000-7f042ce35000 rw-p 00000000 00:00 0 
7ffe31304000-7ffe31325000 rw-p 00000000 00:00 0                          [stack]
7ffe31379000-7ffe3137b000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]
Aborted (core dumped)


Expected results:

lspci didn't core dump 

Additional info:

Comment 2 jingzhao 2016-02-17 09:47:45 UTC
Didn't hit this issue when set 7 layers switches

Comment 4 jingzhao 2016-07-22 05:56:25 UTC
qemu-img-rhev-2.6.0-14.el7.x86_64
kernel-3.10.0-470.el7.x86_64

1. Hit the issue with above environment
[root@localhost home]# sh attachment1 [details]-switch-layer.sh 7

[root@localhost home]# cat attachment1 [details]-switch-layer.sh 
#!/bin/sh

MACHINE=q35
SMP=4,cores=2,threads=2,sockets=1
MEM=2G
GUEST_IMG=/home/q35.qcow2
IMG_FORMAT=qcow2

CLI="/usr/libexec/qemu-kvm -enable-kvm -M $MACHINE -cpu SandyBridge -smp $SMP -m $MEM -name vm1 -drive file=$GUEST_IMG,if=none,id=guest-img,format=$IMG_FORMAT,werror=stop,rerror=stop -device ide-hd,drive=guest-img,bus=ide.0,unit=0,id=os-disk,bootindex=0 -spice port=5931,disable-ticketing -vga qxl -monitor stdio -serial unix:/tmp/console,server,nowait -qmp tcp:0:6666,server,nowait -chardev file,path=/home/seabios.log,id=seabios -device isa-debugcon,chardev=seabios,iobase=0x402 -boot menu=on,reboot-timeout=8,strict=on -device ioh3420,bus=pcie.0,id=root.0,slot=3 -device x3130-upstream,bus=root.0,id=upstream -device xio3130-downstream,bus=upstream,id=downstream0,chassis=1"
while [ ${i:=0} -lt ${1:-0} ]
do
    dstreamId=$((i+1))
    ustreamId=$((i+1))
    chassisId=$((dstreamId+1))
    blkDiskId=$((i))


    CLI="$CLI -device x3130-upstream,bus=downstream$i,id=upstream$ustreamId"    
    CLI="$CLI -device xio3130-downstream,bus=upstream$ustreamId,id=downstream$dstreamId,chassis=$chassisId"
    i=$((i+1))
done

$CLI

2. Also hit the issue with following steps
1) Boot guest with 6 switches
[root@localhost home]# sh attachment1 [details]-switch-layer.sh 6
2) hot plug disk to the switch
{"execute":"device_add","arguments":{"driver":"virtio-scsi-pci","id":"scsi3","bus":"downstream5","disable-legacy":true,"disable-modern":false}}
{"return": {}}
{"execute":"__com.redhat_drive_add", "arguments": {"file":"/home/block2.raw","format":"raw","id":"drive_datadisk3"}}
{"return": {}}
{"execute":"device_add","arguments":{"driver":"scsi-hd","drive":"drive_datadisk3","id":"device_datadisk3","bus":"scsi3.0"}}
{"return": {}}

Comment 6 jinchen 2017-06-30 05:09:20 UTC
Also reproduce the issue on qemu-kvm-rhev-2.9.0-14.

Detailed info:

qemu-kvm-rhev-2.9.0-14.el7.x86_64
kernel-3.10.0-690.el7.x86_64
OVMF-20170228-5.gitc325e41585e3.el7.noarch

[root@ibm-x3850x5-08 tmp]# sh switch-layer.sh 5

[root@ibm-x3850x5-08 tmp]# cat switch-layer.sh 
#!/bin/sh

MACHINE=q35
SMP=4,cores=2,threads=2,sockets=1
MEM=2G
GUEST_IMG=/home/jinchen/demo/test.qcow2-ovmf
IMG_FORMAT=qcow2

CLI="/usr/libexec/qemu-kvm -enable-kvm -M $MACHINE -cpu SandyBridge -smp $SMP -m $MEM -name vm1 -drive file=$GUEST_IMG,if=none,id=guest-img,format=$IMG_FORMAT,werror=stop,rerror=stop -device ide-hd,drive=guest-img,bus=ide.0,unit=0,id=os-disk,bootindex=0 -spice port=5931,disable-ticketing -vga qxl -monitor stdio -serial unix:/tmp/console,server,nowait -qmp tcp:0:6666,server,nowait -drive file=/usr/share/OVMF/OVMF_CODE.secboot.fd,if=pflash,format=raw,unit=0,readonly=on -drive file=/usr/share/OVMF/OVMF_VARS.fd,if=pflash,format=raw,unit=1 -boot menu=on,reboot-timeout=8,strict=on -device ioh3420,bus=pcie.0,id=root.0,slot=3 -device x3130-upstream,bus=root.0,id=upstream -device xio3130-downstream,bus=upstream,id=downstream0,chassis=1"
while [ ${i:=0} -lt ${1:-0} ]
do
    dstreamId=$((i+1))
    ustreamId=$((i+1))
    chassisId=$((dstreamId+1))
    blkDiskId=$((i))


    CLI="$CLI -device x3130-upstream,bus=downstream$i,id=upstream$ustreamId"    
    CLI="$CLI -device xio3130-downstream,bus=upstream$ustreamId,id=downstream$dstreamId,chassis=$chassisId"
    i=$((i+1))
done
   CLI="$CLI -device usb-ehci,bus=downstream$i,id=ehci"

$CLI

Actual results: 
   lspci core dumped in guest when there have 6 layers switches

Comment 7 jingzhao 2017-10-30 08:56:59 UTC
Hit the same issue on qemu-kvm-rhev-2.10.0-3.el7.x86_64 with 6 swith-layers

[root@localhost ~]# lspci -vvv -t
-[0000:00]-+-00.0  Intel Corporation 82G33/G31/P35/P31 Express DRAM Controller
           +-01.0  Red Hat, Inc. QXL paravirtual graphic card
           +-02.0  Intel Corporation 82540EM Gigabit Ethernet Controller
           +-03.0-[01-0f]----00.0-[02-0f]----00.0-[03-0f]----00.0-[04-0f]----00.0-[05-0f]----00.0-[06-0f]----00.0-[07-0f]----00.0-[08-0f]----00.0-[09-0f]----00.0-[0a-0f]----00.0-[0b-0f]----00.0-[0c-0f]----00.0-[0d-0f]----00.0-[0e-0f]----00.0-[0f]----00.0  Red Hat, Inc Virtio block device
           +-1f.0  Intel Corporation 82801IB (ICH9) LPC Interface Controller
           +-1f.2  Intel Corporation 82801IR/IO/IH (ICH9R/DO/DH) 6 port SATA Controller [AHCI mode]
           \-1f.3  Intel Corporation 82801I (ICH9 Family) SMBus Controller
*** stack smashing detected ***: lspci terminated
======= Backtrace: =========
/lib64/libc.so.6(__fortify_fail+0x37)[0x7f1349c36d87]
/lib64/libc.so.6(__fortify_fail+0x0)[0x7f1349c36d50]
lspci[0x40ad9e]
lspci[0x401bf6]
/lib64/libc.so.6(__libc_start_main+0xf5)[0x7f1349b48c05]
lspci[0x401c2f]
======= Memory map: ========
00400000-00411000 r-xp 00000000 fd:00 957529                             /usr/sbin/lspci
00610000-00611000 r--p 00010000 fd:00 957529                             /usr/sbin/lspci
00611000-00612000 rw-p 00011000 fd:00 957529                             /usr/sbin/lspci
00a19000-00bae000 rw-p 00000000 00:00 0                                  [heap]
7f134909f000-7f13490b6000 r-xp 00000000 fd:00 215388                     /usr/lib64/libpthread-2.17.so
7f13490b6000-7f13492b5000 ---p 00017000 fd:00 215388                     /usr/lib64/libpthread-2.17.so
7f13492b5000-7f13492b6000 r--p 00016000 fd:00 215388                     /usr/lib64/libpthread-2.17.so
7f13492b6000-7f13492b7000 rw-p 00017000 fd:00 215388                     /usr/lib64/libpthread-2.17.so
7f13492b7000-7f13492bb000 rw-p 00000000 00:00 0 
7f13492bb000-7f13492d0000 r-xp 00000000 fd:00 84                         /usr/lib64/libgcc_s-4.8.5-20150702.so.1
7f13492d0000-7f13494cf000 ---p 00015000 fd:00 84                         /usr/lib64/libgcc_s-4.8.5-20150702.so.1
7f13494cf000-7f13494d0000 r--p 00014000 fd:00 84                         /usr/lib64/libgcc_s-4.8.5-20150702.so.1
7f13494d0000-7f13494d1000 rw-p 00015000 fd:00 84                         /usr/lib64/libgcc_s-4.8.5-20150702.so.1
7f13494d1000-7f13494e6000 r-xp 00000000 fd:00 223049                     /usr/lib64/libz.so.1.2.7
7f13494e6000-7f13496e5000 ---p 00015000 fd:00 223049                     /usr/lib64/libz.so.1.2.7
7f13496e5000-7f13496e6000 r--p 00014000 fd:00 223049                     /usr/lib64/libz.so.1.2.7
7f13496e6000-7f13496e7000 rw-p 00015000 fd:00 223049                     /usr/lib64/libz.so.1.2.7
7f13496e7000-7f134970c000 r-xp 00000000 fd:00 223076                     /usr/lib64/liblzma.so.5.2.2
7f134970c000-7f134990b000 ---p 00025000 fd:00 223076                     /usr/lib64/liblzma.so.5.2.2
7f134990b000-7f134990c000 r--p 00024000 fd:00 223076                     /usr/lib64/liblzma.so.5.2.2
7f134990c000-7f134990d000 rw-p 00025000 fd:00 223076                     /usr/lib64/liblzma.so.5.2.2
7f134990d000-7f1349923000 r-xp 00000000 fd:00 215390                     /usr/lib64/libresolv-2.17.so
7f1349923000-7f1349b23000 ---p 00016000 fd:00 215390                     /usr/lib64/libresolv-2.17.so
7f1349b23000-7f1349b24000 r--p 00016000 fd:00 215390                     /usr/lib64/libresolv-2.17.so
7f1349b24000-7f1349b25000 rw-p 00017000 fd:00 215390                     /usr/lib64/libresolv-2.17.so
7f1349b25000-7f1349b27000 rw-p 00000000 00:00 0 
7f1349b27000-7f1349cdf000 r-xp 00000000 fd:00 215362                     /usr/lib64/libc-2.17.so
7f1349cdf000-7f1349edf000 ---p 001b8000 fd:00 215362                     /usr/lib64/libc-2.17.so
7f1349edf000-7f1349ee3000 r--p 001b8000 fd:00 215362                     /usr/lib64/libc-2.17.so
7f1349ee3000-7f1349ee5000 rw-p 001bc000 fd:00 215362                     /usr/lib64/libc-2.17.so
7f1349ee5000-7f1349eea000 rw-p 00000000 00:00 0 
7f1349eea000-7f1349eff000 r-xp 00000000 fd:00 316564                     /usr/lib64/libkmod.so.2.2.10
7f1349eff000-7f134a0fe000 ---p 00015000 fd:00 316564                     /usr/lib64/libkmod.so.2.2.10
7f134a0fe000-7f134a0ff000 r--p 00014000 fd:00 316564                     /usr/lib64/libkmod.so.2.2.10
7f134a0ff000-7f134a100000 rw-p 00015000 fd:00 316564                     /usr/lib64/libkmod.so.2.2.10
7f134a100000-7f134a10c000 r-xp 00000000 fd:00 322329                     /usr/lib64/libpci.so.3.5.1
7f134a10c000-7f134a30b000 ---p 0000c000 fd:00 322329                     /usr/lib64/libpci.so.3.5.1
7f134a30b000-7f134a30c000 r--p 0000b000 fd:00 322329                     /usr/lib64/libpci.so.3.5.1
7f134a30c000-7f134a30d000 rw-p 0000c000 fd:00 322329                     /usr/lib64/libpci.so.3.5.1
7f134a30d000-7f134a32e000 r-xp 00000000 fd:00 208315                     /usr/lib64/ld-2.17.so
7f134a515000-7f134a51b000 rw-p 00000000 00:00 0 
7f134a52b000-7f134a52e000 rw-p 00000000 00:00 0 
7f134a52e000-7f134a52f000 r--p 00021000 fd:00 208315                     /usr/lib64/ld-2.17.so
7f134a52f000-7f134a530000 rw-p 00022000 fd:00 208315                     /usr/lib64/ld-2.17.so
7f134a530000-7f134a531000 rw-p 00000000 00:00 0 
7fffebedf000-7fffebf00000 rw-p 00000000 00:00 0                          [stack]
7fffebf5a000-7fffebf5c000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]
Aborted (core dumped)


Thanks
Jing