Bug 1476181

Summary: qemu core dumped after hotplug one cpu core with a negative core id
Product: Red Hat Enterprise Linux 7 Reporter: Xujun Ma <xuma>
Component: qemu-kvmAssignee: Laurent Vivier <lvivier>
Status: CLOSED ERRATA QA Contact: Xujun Ma <xuma>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 7.4-AltCC: bugproxy, hannsj_uhl, knoel, lvivier, mrezanin, qzhang, rbalakri, virt-maint
Target Milestone: rc   
Target Release: 7.4-Alt   
Hardware: ppc64le   
OS: Linux   
Whiteboard:
Fixed In Version: qemu-kvm-2.9.0-20.el7a Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-11-09 11:31:17 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1440030    

Description Xujun Ma 2017-07-28 08:25:14 UTC
Description of problem:
qemu core dumped  after hotplug one cpu core with a negative core id

Version-Release number of selected component (if applicable):
host:4.11.0-10.el7a.ppc64le
guest:4.11.0-16.el7a.ppc64le
qemu:qemu-kvm-2.9.0-18.el7a.ppc64le

How reproducible:
100%

Steps to Reproduce:
1.Boot guest with command
/usr/libexec/qemu-kvm \
 -name vm \
 -m 8192 \
 -rtc base=utc,clock=host \
 -smp 2,maxcpus=4,cores=4,threads=1,sockets=1 \
 -chardev stdio,mux=on,id=serial_id_serial0,server,nowait \
 -device spapr-vty,id=serial111,chardev=serial_id_serial0 \
 -mon chardev=serial_id_serial0,mode=readline \
 -nodefaults \
 -device virtio-scsi-pci,bus=pci.0,addr=0x5 \
 -device scsi-hd,id=scsi-hd0,drive=scsi-hd-dr0,bootindex=1\
 -drive file=pegas.qcow2,if=none,id=scsi-hd-dr0,format=qcow2,cache=none \
 -device virtio-net-pci,netdev=net0,id=nic0,mac=70:e2:84:14:e7:84 \
 -netdev tap,id=net0,script=/etc/qemu-ifup,downscript=/etc/qemu-ifdown,vhost=on 
2.Hotplug cpu core
(qemu) device_add host-spapr-cpu-core,core-id=-2,id=core
3.(qemu)q

Actual results:
(qemu) device_add host-spapr-cpu-core,core-id=-2,id=core1
Can't create CPU with id -2 in KVM
Adjust the number of cpus to -2 or try to raise the number of threads per core
(qemu) q
guest.sh: line 18: 14761 Segmentation fault      (core dumped) /usr/libexec/qemu-kvm -name vm -m 8192 -rtc base=utc,clock=host -smp 2,maxcpus=4,cores=4,threads=1,sockets=1 -chardev stdio,mux=on,id=serial_id_serial0,server,nowait -device spapr-vty,id=serial111,chardev=serial_id_serial0 -mon chardev=serial_id_serial0,mode=readline -nodefaults -device virtio-scsi-pci,bus=pci.0,addr=0x5 -device scsi-hd,id=scsi-hd0,drive=scsi-hd-dr0,bootindex=1 -drive file=pegas.qcow2,if=none,id=scsi-hd-dr0,format=qcow2,cache=none -device virtio-net-pci,netdev=net0,id=nic0,mac=70:e2:84:14:e7:84 -netdev tap,id=net0,script=/etc/qemu-ifup,downscript=/etc/qemu-ifdown,vhost=on


Expected results:
step2:invalid core id -2
step3:no core dumped



Additional info:

same issue on power8
RHEL7.4,
host kernel 3.10.0-689.el7.ppc64le
qemu:qemu-kvm-rhev-2.9.0-14.el7.ppc64le
guest kernel:3.10.0-671.el7.ppc64le

Comment 2 Laurent Vivier 2017-08-02 10:36:02 UTC
*** Bug 1475747 has been marked as a duplicate of this bug. ***

Comment 3 Laurent Vivier 2017-08-02 10:50:34 UTC
I have proposed a fix upstream:

http://lists.nongnu.org/archive/html/qemu-devel/2017-08/msg00281.html

Comment 4 Miroslav Rezanina 2017-08-08 11:25:35 UTC
Fix included in qemu-kvm-2.9.0-20.el7a

Comment 6 Xujun Ma 2017-08-10 01:00:07 UTC
Reproduced the issue on old version:
Version-Release number of selected component (if applicable):
host:4.11.0-10.el7a.ppc64le
guest:4.11.0-16.el7a.ppc64le
qemu:qemu-kvm-2.9.0-18.el7a.ppc64le

Steps to Reproduce:
1.Boot guest with command
/usr/libexec/qemu-kvm \
 -name vm \
 -m 8192 \
 -rtc base=utc,clock=host \
 -smp 2,maxcpus=4,cores=4,threads=1,sockets=1 \
 -chardev stdio,mux=on,id=serial_id_serial0,server,nowait \
 -device spapr-vty,id=serial111,chardev=serial_id_serial0 \
 -mon chardev=serial_id_serial0,mode=readline \
 -nodefaults \
 -device virtio-scsi-pci,bus=pci.0,addr=0x5 \
 -device scsi-hd,id=scsi-hd0,drive=scsi-hd-dr0,bootindex=1\
 -drive file=pegas.qcow2,if=none,id=scsi-hd-dr0,format=qcow2,cache=none \
 -device virtio-net-pci,netdev=net0,id=nic0,mac=70:e2:84:14:e7:84 \
 -netdev tap,id=net0,script=/etc/qemu-ifup,downscript=/etc/qemu-ifdown,vhost=on 
2.Hotplug cpu core
(qemu) device_add host-spapr-cpu-core,core-id=-2,id=core
3.(qemu)q

Actual results:
(qemu) device_add host-spapr-cpu-core,core-id=-2,id=core1
Can't create CPU with id -2 in KVM
Adjust the number of cpus to -2 or try to raise the number of threads per core
(qemu) q
guest.sh: line 18: 14761 Segmentation fault      (core dumped) /usr/libexec/qemu-kvm -name vm -m 8192 -rtc base=utc,clock=host -smp 2,maxcpus=4,cores=4,threads=1,sockets=1 -chardev stdio,mux=on,id=serial_id_serial0,server,nowait -device spapr-vty,id=serial111,chardev=serial_id_serial0 -mon chardev=serial_id_serial0,mode=readline -nodefaults -device virtio-scsi-pci,bus=pci.0,addr=0x5 -device scsi-hd,id=scsi-hd0,drive=scsi-hd-dr0,bootindex=1 -drive file=pegas.qcow2,if=none,id=scsi-hd-dr0,format=qcow2,cache=none -device virtio-net-pci,netdev=net0,id=nic0,mac=70:e2:84:14:e7:84 -netdev tap,id=net0,script=/etc/qemu-ifup,downscript=/etc/qemu-ifdown,vhost=on


Verified the issue on the latest build:
Version-Release number of selected component (if applicable):
host:4.11.0-10.el7a.ppc64le
guest:4.11.0-16.el7a.ppc64le
qemu:qemu-kvm-2.9.0-20.el7a.ppc64le

Steps to Verify:

The same as above

Actual results:

(qemu) device_add host-spapr-cpu-core,core-id=-2,id=core
Invalid core id -2
(qemu) q

Negative core id is invalid and no core dumped when exit.So the bug has been fixed.

Comment 8 errata-xmlrpc 2017-11-09 11:31:17 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2017:3169