Bug 1660374

Summary: qemu core dump after unhotplug ahci controller and system_reset
Product: Red Hat Enterprise Linux Advanced Virtualization Reporter: FuXiangChun <xfu>
Component: qemu-kvmAssignee: Virtualization Maintenance <virt-maint>
qemu-kvm sub component: Storage QA Contact: qing.wang <qinwang>
Status: CLOSED CURRENTRELEASE Docs Contact:
Severity: high    
Priority: high CC: chayang, coli, juzhang, ngu, philmd, qzhang, rbalakri, virt-maint, xuwei
Version: 8.0Keywords: Triaged
Target Milestone: rc   
Target Release: 8.0   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-03-15 07:32:41 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description FuXiangChun 2018-12-18 08:54:49 UTC
Description of problem:
Boot RHEL8.0 guest, Then unhotplug ahci controller and execute system_reset command. qemu core dump.

Version-Release number of selected component (if applicable):
4.18.0-55.el8.x86_64
qemu-kvm-core-3.1.0-1.module+el8+2538+1516be75.x86_64
seabios-1.11.1-3.module+el8+2538+1516be75.x86_64

How reproducible:
always

Steps to Reproduce:
1.Boot RHEL8.0 guest as below

/usr/libexec/qemu-kvm -M pc -cpu Opteron_G5 -enable-kvm -m 2048 -smp 4,sockets=2,cores=2,threads=1 -usb -device usb-tablet,id=input0 \
-device usb-mouse,id=mouse -name seabios -uuid b03eea94-a502-4142-b541-96f86473a07a \
-drive file=/home/rhel80-1.qcow2,if=none,id=drive-system-disk1,format=qcow2,cache=none,aio=native,werror=stop,rerror=stop -device virtio-scsi-pci,id=scsi0,addr=0x5 -device scsi-hd,bus=scsi0.0,drive=drive-system-disk1,id=system-disk,bootindex=1 \

-device ahci,id=ahci1,addr=0x06 \

-drive file=/home/seabios/u5,if=none,id=drive-sata-disk-0-7,format=raw -device ide-drive,bus=ahci1.1,unit=0,drive=drive-sata-disk-0-7,id=sata-disk-0-7,bootindex=5 \
-drive file=/home/seabios/u6,if=none,id=drive-sata-disk-0-8,format=raw -device ide-drive,bus=ahci1.2,unit=0,drive=drive-sata-disk-0-8,id=sata-disk-0-8,bootindex=6 \
-vnc :1 \
-qmp tcp:0:4444,server,nowait \
-monitor stdio \

2.remove ahci controller 
{"execute":"device_del","arguments":{"id":"ahci1"}}

{"return": {}}
{"timestamp": {"seconds": 1545122817, "microseconds": 555011}, "event": "DEVICE_DELETED", "data": {"device": "sata-disk-0-7", "path": "/machine/peripheral/sata-disk-0-7"}}
{"timestamp": {"seconds": 1545122817, "microseconds": 555475}, "event": "DEVICE_DELETED", "data": {"device": "sata-disk-0-8", "path": "/machine/peripheral/sata-disk-0-8"}}
{"timestamp": {"seconds": 1545122818, "microseconds": 279607}, "event": "DEVICE_DELETED", "data": {"device": "ahci1", "path": "/machine/peripheral/ahci1"}}

3. (qemu) system_reset

Actual results:
Segmentation fault.

(gdb) bt
#0  0x000055577b6a182b in object_class_dynamic_cast ()
#1  0x000055577b6a1955 in object_dynamic_cast ()
#2  0x000055577b5ab3bc in fw_path_provider_try_get_dev_path ()
#3  0x000055577b5543c6 in get_boot_devices_list ()
#4  0x000055577b5fe4e4 in fw_cfg_machine_reset ()
#5  0x000055577b5ab132 in qemu_devices_reset ()
#6  0x000055577b4d66df in pc_machine_reset ()
#7  0x000055577b55a34a in qemu_system_reset ()
#8  0x000055577b55a528 in main_loop ()
#9  0x000055577b41ac24 in main ()


Expected results:
works

Additional info:

Comment 1 FuXiangChun 2018-12-18 09:02:21 UTC
I also tested seabios-1.11.1-2.el8+2055+38c90e40.x86_64, still can reproduce this bug.

Comment 3 Ademar Reis 2020-02-05 22:52:47 UTC
QEMU has been recently split into sub-components and as a one-time operation to avoid breakage of tools, we are setting the QEMU sub-component of this BZ to "General". Please review and change the sub-component if necessary the next time you review this BZ. Thanks

Comment 6 RHEL Program Management 2021-03-15 07:32:41 UTC
After evaluating this issue, there are no plans to address it further or fix it in an upcoming release.  Therefore, it is being closed.  If plans change such that this issue will be fixed in an upcoming release, then the bug can be reopened.

Comment 7 qing.wang 2021-07-27 08:25:17 UTC
It can not reproduce on
Red Hat Enterprise Linux release 8.5 Beta (Ootpa)
4.18.0-315.el8.x86_64
qemu-kvm-common-6.0.0-25.module+el8.5.0+11890+8e7c3f51.x86_64
edk2-ovmf-20200602gitca407c7246bf-5.el8.noarch

1. boot vm
/usr/libexec/qemu-kvm \
  -name src_vm1 \
  -machine q35 \
  -m 8G \
  -nodefaults \
  -vga qxl \
  -device pcie-root-port,id=pcie.0-root-port-2,slot=2,bus=pcie.0,multifunction=on \
  -device pcie-root-port,id=pcie.0-root-port-2-1,chassis=3,bus=pcie.0,addr=0x2.0x1 \
  -device pcie-root-port,id=pcie.0-root-port-2-2,chassis=4,bus=pcie.0,addr=0x2.0x2 \
  -device pcie-root-port,id=pcie.0-root-port-3,slot=3,bus=pcie.0 \
  -device pcie-root-port,id=pcie.0-root-port-4,slot=4,bus=pcie.0 \
  -device pcie-root-port,id=pcie.0-root-port-5,slot=5,bus=pcie.0 \
  -device pcie-root-port,id=pcie.0-root-port-7,slot=7,bus=pcie.0 \
  -device pcie-root-port,id=pcie.0-root-port-8,slot=8,bus=pcie.0 \
  -device pcie-root-port,id=pcie.0-root-port-9,slot=9,bus=pcie.0 \
  -device qemu-xhci,id=usb1,bus=pcie.0-root-port-2-1,addr=0x0 \
  -device usb-tablet,id=usb-tablet1,bus=usb1.0,port=1 \
  -object iothread,id=iothread0 \
  -device virtio-scsi-pci,id=scsi0,bus=pcie.0-root-port-2-2,addr=0x0,iothread=iothread0 \
  -blockdev driver=qcow2,file.driver=file,cache.direct=off,cache.no-flush=on,file.filename=/home/kvm_autotest_root/images/rhel840-64-virtio-scsi.qcow2,node-name=drive_image1 \
  -device scsi-hd,id=os1,drive=drive_image1,bootindex=0 \
  \
  \
  -blockdev driver=raw,file.driver=file,file.filename=/home/kvm_autotest_root/images/data.img,node-name=disk \
 \
 -device ahci,id=ahci,bus=pcie.0-root-port-4,addr=0x0  \
 -device ide-hd,drive=disk,bus=ahci.0 \
  \
  -vnc \
  :5 \
  -qmp tcp:0:5955,server,nowait \
  -monitor stdio \
  \
  -device virtio-net-pci,mac=9a:b5:b6:b1:b2:b5,id=idMmq1jH,vectors=4,netdev=idxgXAlm,bus=pcie.0-root-port-5,addr=0x0 \
  -netdev tap,id=idxgXAlm

2
 {"execute":"qmp_capabilities"}

  {"execute": "device_del", "arguments": {"id": "ahci"}}

3.system_reset