Bug 1356445

Summary: qemu core dump when booting with 'iommu=on' and vfio-pci
Product: Red Hat Enterprise Linux 7 Reporter: Pei Zhang <pezhang>
Component: qemu-kvm-rhevAssignee: Alex Williamson <alex.williamson>
Status: CLOSED NOTABUG QA Contact: Pei Zhang <pezhang>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 7.3CC: chayang, jinzhao, juzhang, knoel, michen, virt-maint, xfu
Target Milestone: rc   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-07-14 12:53:22 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Pei Zhang 2016-07-14 07:03:03 UTC
Description of problem:
Qemu core dump when booting qemu with 'iommu=on' and vfio-pci.

Version-Release number of selected component (if applicable):
qemu-img-rhev-2.6.0-13.el7.x86_64

How reproducible:
100%

Steps to Reproduce:
1. Boot guest with iommu=on and vfio-pci device
# /usr/libexec/qemu-kvm \
-M q35,iommu=on \
-device vfio-pci,host=01:00.0

(qemu) qemu: hardware error: Device at bus root.1 addr 00.0 requires iommu notifier which is currently not supported by intel-iommu emulation
CPU #0:
EAX=00000000 EBX=00000000 ECX=00000000 EDX=000206a1
ESI=00000000 EDI=00000000 EBP=00000000 ESP=00000000
EIP=0000fff0 EFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 00000000 0000ffff 00009300
CS =f000 ffff0000 0000ffff 00009b00
SS =0000 00000000 0000ffff 00009300
DS =0000 00000000 0000ffff 00009300
FS =0000 00000000 0000ffff 00009300
GS =0000 00000000 0000ffff 00009300
LDT=0000 00000000 0000ffff 00008200
TR =0000 00000000 0000ffff 00008b00
GDT=     00000000 0000ffff
IDT=     00000000 0000ffff
CR0=60000010 CR2=00000000 CR3=00000000 CR4=00000000
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000000
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00000000000000000000000000000000 XMM01=00000000000000000000000000000000
XMM02=00000000000000000000000000000000 XMM03=00000000000000000000000000000000
XMM04=00000000000000000000000000000000 XMM05=00000000000000000000000000000000
XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000
CPU #1:
EAX=00000000 EBX=00000000 ECX=00000000 EDX=000206a1
ESI=00000000 EDI=00000000 EBP=00000000 ESP=00000000
EIP=0000fff0 EFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 00000000 0000ffff 00009300
CS =f000 ffff0000 0000ffff 00009b00
SS =0000 00000000 0000ffff 00009300
DS =0000 00000000 0000ffff 00009300
FS =0000 00000000 0000ffff 00009300
GS =0000 00000000 0000ffff 00009300
LDT=0000 00000000 0000ffff 00008200
TR =0000 00000000 0000ffff 00008b00
GDT=     00000000 0000ffff
IDT=     00000000 0000ffff
CR0=60000010 CR2=00000000 CR3=00000000 CR4=00000000
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000000
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00000000000000000000000000000000 XMM01=00000000000000000000000000000000
XMM02=00000000000000000000000000000000 XMM03=00000000000000000000000000000000
XMM04=00000000000000000000000000000000 XMM05=00000000000000000000000000000000
XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000
Aborted (core dumped)

Actual results:
Qemu core dump.

Expected results:
Qemu should fail start up without core dump.

Additional info:
gdb info
(gdb) bt
#0  0x00007fffefe385f7 in raise () from /lib64/libc.so.6
#1  0x00007fffefe39ce8 in abort () from /lib64/libc.so.6
#2  0x00005555556f58fa in hw_error (
    fmt=fmt@entry=0x5555559b9e90 "Device at bus %s addr %02x.%d requires iommu notifier which is currently not supported by intel-iommu emulation") at /usr/src/debug/qemu-2.6.0/cpus.c:703
#3  0x000055555575187f in vtd_iommu_notify_started (iommu=<optimized out>)
    at /usr/src/debug/qemu-2.6.0/hw/i386/intel_iommu.c:1879
#4  0x000055555570c387 in memory_region_register_iommu_notifier (mr=0x555559667700, 
    n=n@entry=0x55555981d910) at /usr/src/debug/qemu-2.6.0/memory.c:1515
#5  0x000055555573b1e2 in vfio_listener_region_add (listener=0x555556bdc5b0, 
    section=0x7fffffffcac0) at /usr/src/debug/qemu-2.6.0/hw/vfio/common.c:384
#6  0x000055555570ded9 in listener_add_address_space (as=0x555559667610, listener=0x555556bdc5b0)
    at /usr/src/debug/qemu-2.6.0/memory.c:2187
#7  memory_listener_register (listener=listener@entry=0x555556bdc5b0, filter=<optimized out>)
    at /usr/src/debug/qemu-2.6.0/memory.c:2216
#8  0x000055555573bcad in vfio_connect_container (as=<optimized out>, group=0x55555981d8c0)
    at /usr/src/debug/qemu-2.6.0/hw/vfio/common.c:892
#9  vfio_get_group (groupid=15, as=<optimized out>)
    at /usr/src/debug/qemu-2.6.0/hw/vfio/common.c:1000
#10 0x000055555573f5bc in vfio_initfn (pdev=0x555559818000)
    at /usr/src/debug/qemu-2.6.0/hw/vfio/pci.c:2551
#11 0x0000555555866d54 in pci_default_realize (dev=0x555559818000, errp=0x7fffffffdd50)
    at hw/pci/pci.c:1893
---Type <return> to continue, or q <return> to quit---
#12 0x000055555586a028 in pci_qdev_realize (qdev=0x555559818000, errp=0x7fffffffddd0)
    at hw/pci/pci.c:1865
#13 0x0000555555813fa0 in device_set_realized (obj=0x555559818000, value=<optimized out>, 
    errp=0x7fffffffdf08) at hw/core/qdev.c:1066
#14 0x00005555558f250e in property_set_bool (obj=0x555559818000, v=<optimized out>, 
    name=<optimized out>, opaque=0x555559001fb0, errp=0x7fffffffdf08) at qom/object.c:1853
#15 0x00005555558f6167 in object_property_set_qobject (obj=0x555559818000, value=<optimized out>, 
    name=0x5555559ed3ed "realized", errp=0x7fffffffdf08) at qom/qom-qobject.c:26
#16 0x00005555558f3fe0 in object_property_set_bool (obj=0x555559818000, value=<optimized out>, 
    name=0x5555559ed3ed "realized", errp=0x7fffffffdf08) at qom/object.c:1150
#17 0x00005555557c4f8c in qdev_device_add (opts=0x555556b44050, errp=errp@entry=0x7fffffffdfe0)
    at qdev-monitor.c:617
#18 0x00005555557cedd7 in device_init_func (opaque=<optimized out>, opts=<optimized out>, 
    errp=<optimized out>) at vl.c:2362
#19 0x000055555599d0ea in qemu_opts_foreach (list=<optimized out>, 
    func=func@entry=0x5555557cedb0 <device_init_func>, opaque=opaque@entry=0x0, 
    errp=errp@entry=0x0) at util/qemu-option.c:1116
#20 0x00005555556c4970 in main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>)
    at vl.c:4552


2. This issue was found when verifying Bug 1346920 - vIOMMU: prevent unsupported configurations with vfio.

Comment 2 Alex Williamson 2016-07-14 12:53:22 UTC
This is the expected behavior.