Bug 1572851

Summary: Core dumped after migration when with usb-host
Product: Red Hat Enterprise Linux 7 Reporter: yduan
Component: qemu-kvm-rhevAssignee: Gerd Hoffmann <kraxel>
Status: CLOSED ERRATA QA Contact: Qianqian Zhu <qizhu>
Severity: high Docs Contact:
Priority: high    
Version: 7.5CC: chayang, dgilbert, jinzhao, juzhang, knoel, kraxel, ngu, virt-maint, xfu, yduan
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Linux   
Whiteboard:
Fixed In Version: qemu-kvm-rhev-2.12.0-7.el7 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-11-01 11:07:33 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description yduan 2018-04-28 06:37:49 UTC
Description of problem:
Core dumped after migration when with usb-host.

Version-Release number of selected component (if applicable):
3.10.0-877.el7.x86_64
qemu-kvm-rhev-2.10.0-21.el7_5.2.x86_64

How reproducible:
3/3

Steps to Reproduce:
1.Launch a src:
"/usr/libexec/qemu-kvm -usb -device usb-host -monitor stdio"

2.Launch a dest on the same host:
"/usr/libexec/qemu-kvm -usb -device usb-host -monitor stdio -incoming tcp:0:1234"

3.Do migration:
(qemu) migrate -d tcp:127.0.0.1:1234

Actual results:
qemu-kvm: hw/usb/bus.c:519: usb_check_attach: Assertion `!dev->attached' failed.
Aborted (core dumped)

Expected results:
No core dumped

Additional info:
1.# lsusb
Bus 002 Device 002: ID 8087:0024 Intel Corp. Integrated Rate Matching Hub
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 002: ID 8087:0024 Intel Corp. Integrated Rate Matching Hub
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 004 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 003 Device 005: ID 0461:4d22 Primax Electronics, Ltd 
Bus 003 Device 004: ID 0557:2213 ATEN International Co., Ltd CS682 2-Port USB 2.0 DVI KVM Switch
Bus 003 Device 002: ID 0557:7000 ATEN International Co., Ltd Hub
Bus 003 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

2.(gdb) bt
#0  0x00007fdc103e1207 in raise () at /lib64/libc.so.6
#1  0x00007fdc103e28f8 in abort () at /lib64/libc.so.6
#2  0x00007fdc103da026 in __assert_fail_base () at /lib64/libc.so.6
#3  0x00007fdc103da0d2 in  () at /lib64/libc.so.6
#4  0x000056368cf0df23 in usb_check_attach (dev=dev@entry=0x56368f745800, errp=errp@entry=0x7ffe28f12f60) at hw/usb/bus.c:519
#5  0x000056368cf0df82 in usb_device_attach (dev=dev@entry=0x56368f745800, errp=errp@entry=0x7ffe28f12fd0) at hw/usb/bus.c:540
#6  0x000056368cf27f8b in usb_host_open (s=s@entry=0x56368f745800, dev=<optimized out>) at hw/usb/host-libusb.c:903
#7  0x000056368cf282e2 in usb_host_auto_check (unused=<optimized out>) at hw/usb/host-libusb.c:1670
#8  0x000056368ce4c252 in vm_state_notify (running=running@entry=1, state=state@entry=RUN_STATE_RUNNING) at vl.c:1623
#9  0x000056368cd6d9b0 in vm_prepare_start () at /usr/src/debug/qemu-2.10.0/cpus.c:1848
#10 0x000056368cd6da19 in vm_start () at /usr/src/debug/qemu-2.10.0/cpus.c:1858
#11 0x000056368cf32bb5 in process_incoming_migration_bh (opaque=0x56368d64cf40 <mis_current.31937>)
    at migration/migration.c:295
#12 0x000056368d050e01 in aio_bh_poll (bh=0x563690aec8a0) at util/async.c:90
#13 0x000056368d050e01 in aio_bh_poll (ctx=ctx@entry=0x56368f70de00) at util/async.c:118
#14 0x000056368d053d60 in aio_dispatch (ctx=0x56368f70de00) at util/aio-posix.c:436
#15 0x000056368d050cde in aio_ctx_dispatch (source=<optimized out>, callback=<optimized out>, user_data=<optimized out>)
    at util/async.c:261
#16 0x00007fdc120218f9 in g_main_context_dispatch () at /lib64/libglib-2.0.so.0
#17 0x000056368d052ffc in main_loop_wait () at util/main-loop.c:213
#18 0x000056368d052ffc in main_loop_wait (timeout=<optimized out>) at util/main-loop.c:261
#19 0x000056368d052ffc in main_loop_wait (nonblocking=nonblocking@entry=0) at util/main-loop.c:515
#20 0x000056368cd3299a in main () at vl.c:1937
#21 0x000056368cd3299a in main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at vl.c:4828

3.https://bugzilla.redhat.com/show_bug.cgi?id=1571171#c12

4.(gdb) bt full
#0  0x00007fdc103e1207 in raise () at /lib64/libc.so.6
#1  0x00007fdc103e28f8 in abort () at /lib64/libc.so.6
#2  0x00007fdc103da026 in __assert_fail_base () at /lib64/libc.so.6
#3  0x00007fdc103da0d2 in  () at /lib64/libc.so.6
#4  0x000056368cf0df23 in usb_check_attach (dev=dev@entry=0x56368f745800, errp=errp@entry=0x7ffe28f12f60) at hw/usb/bus.c:519
        bus = 0x563690cb49d0
        port = 0x563690cb4ab8
        devspeed = "\374.\361(\376\177\000\000\060X\334\021\334\177\000\000\000Xt\217\066V\000\000\"\000\000\000\000\000\000"
        portspeed = "i\000\000\000\000\000\000\000\217{\362\214\000\000\000\000\t\002\"\000\000\000\000\000\240ˮ\220\066V\000"
        __PRETTY_FUNCTION__ = "usb_check_attach"
        __func__ = "usb_check_attach"
#5  0x000056368cf0df82 in usb_device_attach (dev=dev@entry=0x56368f745800, errp=errp@entry=0x7ffe28f12fd0) at hw/usb/bus.c:540
        port = 0x563690cb4ab8
        local_err = 0x0
#6  0x000056368cf27f8b in usb_host_open (s=s@entry=0x56368f745800, dev=<optimized out>) at hw/usb/host-libusb.c:903
        udev = 0x56368f745800
        __func__ = "usb_host_open"
        bus_num = 3
        addr = 5
        rc = <optimized out>
        local_err = 0x0
#7  0x000056368cf282e2 in usb_host_auto_check (unused=<optimized out>) at hw/usb/host-libusb.c:1670
        s = 0x56368f745800
        f = 0x56368f746eb0
        devs = 0x56368f5e1ae0
        ddesc = 
          {bLength = 18 '\022', bDescriptorType = 1 '\001', bcdUSB = 512, bDeviceClass = 0 '\000', bDeviceSubClass = 0 '\000', bDeviceProtocol = 0 '\000', bMaxPacketSize0 = 8 '\b', idVendor = 1121, idProduct = 19746, bcdDevice = 512, iManufacturer = 0 '\000', iProduct = 2 '\002', iSerialNumber = 0 '\000', bNumConfigurations = 1 '\001'}
---Type <return> to continue, or q <return> to quit---
        unconnected = 0
        i = <optimized out>
        n = <optimized out>
#8  0x000056368ce4c252 in vm_state_notify (running=running@entry=1, state=state@entry=RUN_STATE_RUNNING) at vl.c:1623
        e = <optimized out>
        next = 0x56369093d900
#9  0x000056368cd6d9b0 in vm_prepare_start () at /usr/src/debug/qemu-2.10.0/cpus.c:1848
        requested = RUN_STATE__MAX
        res = 0
#10 0x000056368cd6da19 in vm_start () at /usr/src/debug/qemu-2.10.0/cpus.c:1858
#11 0x000056368cf32bb5 in process_incoming_migration_bh (opaque=0x56368d64cf40 <mis_current.31937>)
    at migration/migration.c:295
        local_err = 0x0
        mis = 0x56368d64cf40 <mis_current.31937>
#12 0x000056368d050e01 in aio_bh_poll (bh=0x563690aec8a0) at util/async.c:90
        bh = <optimized out>
        bhp = <optimized out>
        next = 0x563690aecb40
        ret = 1
        deleted = false
#13 0x000056368d050e01 in aio_bh_poll (ctx=ctx@entry=0x56368f70de00) at util/async.c:118
        bh = <optimized out>
        bhp = <optimized out>
        next = 0x563690aecb40
        ret = 1
        deleted = false
#14 0x000056368d053d60 in aio_dispatch (ctx=0x56368f70de00) at util/aio-posix.c:436
#15 0x000056368d050cde in aio_ctx_dispatch (source=<optimized out>, callback=<optimized out>, user_data=<optimized out>)
    at util/async.c:261
        ctx = <optimized out>
---Type <return> to continue, or q <return> to quit---
#16 0x00007fdc120218f9 in g_main_context_dispatch () at /lib64/libglib-2.0.so.0
#17 0x000056368d052ffc in main_loop_wait () at util/main-loop.c:213
        context = 0x56368f5bb4a0
        pfds = <optimized out>
        context = 0x56368f5bb4a0
        ret = 0
        spin_counter = 1
        ret = 0
        timeout = 1000
        timeout_ns = <optimized out>
#18 0x000056368d052ffc in main_loop_wait (timeout=<optimized out>) at util/main-loop.c:261
        context = 0x56368f5bb4a0
        ret = 0
        spin_counter = 1
        ret = 0
        timeout = 1000
        timeout_ns = <optimized out>
#19 0x000056368d052ffc in main_loop_wait (nonblocking=nonblocking@entry=0) at util/main-loop.c:515
        ret = 0
        timeout = 1000
        timeout_ns = <optimized out>
#20 0x000056368cd3299a in main () at vl.c:1937
        i = <optimized out>
        snapshot = <optimized out>
        linux_boot = <optimized out>
        initrd_filename = <optimized out>
        kernel_filename = <optimized out>
        kernel_cmdline = <optimized out>
        boot_order = <optimized out>
        boot_once = 0x0
---Type <return> to continue, or q <return> to quit---
        cyls = <optimized out>
        heads = <optimized out>
        secs = <optimized out>
        translation = <optimized out>
        opts = <optimized out>
        machine_opts = <optimized out>
        hda_opts = <optimized out>
        icount_opts = <optimized out>
        accel_opts = <optimized out>
        olist = <optimized out>
        optind = 8
        optarg = 0x7ffe28f14652 "tcp:0:1234"
        loadvm = <optimized out>
        machine_class = 0x0
        cpu_model = <optimized out>
        vga_model = 0x56368d086cf9 "std"
        qtest_chrdev = <optimized out>
        qtest_log = <optimized out>
        pid_file = <optimized out>
        incoming = <optimized out>
        defconfig = <optimized out>
        userconfig = <optimized out>
        nographic = <optimized out>
        display_type = <optimized out>
        display_remote = <optimized out>
        log_mask = <optimized out>
        log_file = <optimized out>
        trace_file = <optimized out>
        maxram_size = <optimized out>
        ram_slots = <optimized out>
---Type <return> to continue, or q <return> to quit---
        vmstate_dump_file = <optimized out>
        main_loop_err = 0x0
        err = 0x0
        list_data_dirs = <optimized out>
        bdo_queue = {sqh_first = 0x0, sqh_last = 0x7ffe28f133b0}
        __func__ = "main"
        __FUNCTION__ = "main"
#21 0x000056368cd3299a in main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at vl.c:4828
        i = <optimized out>
        snapshot = <optimized out>
        linux_boot = <optimized out>
        initrd_filename = <optimized out>
        kernel_filename = <optimized out>
        kernel_cmdline = <optimized out>
        boot_order = <optimized out>
        boot_once = 0x0
        cyls = <optimized out>
        heads = <optimized out>
        secs = <optimized out>
        translation = <optimized out>
        opts = <optimized out>
        machine_opts = <optimized out>
        hda_opts = <optimized out>
        icount_opts = <optimized out>
        accel_opts = <optimized out>
        olist = <optimized out>
        optind = 8
        optarg = 0x7ffe28f14652 "tcp:0:1234"
        loadvm = <optimized out>
        machine_class = 0x0
---Type <return> to continue, or q <return> to quit---
        cpu_model = <optimized out>
        vga_model = 0x56368d086cf9 "std"
        qtest_chrdev = <optimized out>
        qtest_log = <optimized out>
        pid_file = <optimized out>
        incoming = <optimized out>
        defconfig = <optimized out>
        userconfig = <optimized out>
        nographic = <optimized out>
        display_type = <optimized out>
        display_remote = <optimized out>
        log_mask = <optimized out>
        log_file = <optimized out>
        trace_file = <optimized out>
        maxram_size = <optimized out>
        ram_slots = <optimized out>
        vmstate_dump_file = <optimized out>
        main_loop_err = 0x0
        err = 0x0
        list_data_dirs = <optimized out>
        bdo_queue = {sqh_first = 0x0, sqh_last = 0x7ffe28f133b0}
        __func__ = "main"
        __FUNCTION__ = "main"

Comment 3 Chao Yang 2018-05-03 02:21:29 UTC
(In reply to Gerd Hoffmann from comment #2)
> https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=15958210

No abort any more by using above build.

Comment 4 Gerd Hoffmann 2018-05-03 08:10:24 UTC
https://patchwork.ozlabs.org/patch/907865/

Comment 5 Gerd Hoffmann 2018-06-13 11:07:41 UTC
upstream commit 3280ea8edede3814553aa19fa27a58daedd48ad9

Comment 7 Miroslav Rezanina 2018-07-04 08:26:22 UTC
Fix included in qemu-kvm-rhev-2.12.0-7.el7

Comment 9 Qianqian Zhu 2018-07-09 05:23:23 UTC
Reproduced with qemu-kvm-rhev-2.12.0-4.el7.x86_64& kernel-3.10.0-889.el7.x86_64:
Steps and result same as comment 0.

Verified with qemu-kvm-rhev-2.12.0-7.el7.x86_64:
Result, migration success, device status correct.
Source qemu:
(qemu) info usbhost 
  Bus 3, Addr 3, Port 2.1, Speed 1.5 Mb/s
    Class 00: USB device 0557:2213, CS-1734A V4.2.411
Destination qemu:
(qemu) info usbhost 
  Bus 3, Addr 3, Port 2.1, Speed 1.5 Mb/s
    Class 00: USB device 0557:2213, CS-1734A V4.2.411
Destination qemu before and after migration:
(qemu) info status 
VM status: paused (inmigrate)
(qemu) info status 
VM status: running

Moving to VERIFIED.

Comment 10 errata-xmlrpc 2018-11-01 11:07:33 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:3443