Bug 871329

Summary:	Kernel panic when running qemu-kvm with "-cpu host"
Product:	Red Hat Enterprise Linux 6	Reporter:	Shaolong Hu <shu>
Component:	kernel	Assignee:	Eduardo Habkost <ehabkost>
Status:	CLOSED DUPLICATE	QA Contact:	Virtualization Bugs <virt-bugs>
Severity:	high	Docs Contact:
Priority:	high
Version:	6.4	CC:	areis, chayang, juzhang, michen, qzhang
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-11-15 03:03:05 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Shaolong Hu 2012-10-30 09:00:46 UTC

Description of problem:
------------------------
Kernel panic when running qemu-kvm with "-cpu host".


Version-Release number of selected component (if applicable):
----------------------------------------------------------------
2.6.32-335.el6.x86_64
2.6.32-337.el6.x86_64

How reproducible:
------------------
100%


Steps to Reproduce:
---------------------

/usr/libexec/qemu-kvm -enable-kvm -M rhel6.4.0 -m 4G -name rhel6.3-64 -rtc base=utc,clock=host,driftfix=slew -no-kvm-pit-reinjection -uuid 3f2ea5cd-3d29-48ff-aab2-23df1b6ae213 -netdev tap,script=/etc/qemu-ifup,id=netdev0 -device virtio-net-pci,netdev=netdev0,id=device-net0,mac=00:24:7E:11:22:33 -boot order=cd -monitor stdio -device usb-tablet,id=input0 -chardev socket,id=s1,path=/tmp/s1,server,nowait -device isa-serial,chardev=s1 -vnc :10 -monitor tcp::1234,server,nowait -qmp tcp:0:5555,server,nowait -chardev socket,id=qmp_monitor_id_qmpmonitor1,path=/tmp/qmp,server,nowait -mon chardev=qmp_monitor_id_qmpmonitor1,mode=control -drive file=RHEL-Server-6.4-64-virtio.qcow2,cache=none,if=none,rerror=stop,werror=stop,id=drive-virtio-disk0,format=qcow2 -device virtio-blk-pci,drive=drive-virtio-disk0,id=device-virtio-disk0,bootindex=1 -readconfig ich9-ehci-uhci.cfg -cpu host
  

Actual results:
--------------------

Oops: 0002 [#1] SMP 
last sysfs file: /sys/devices/pci0000:00/0000:00:1d.0/usb6/6-1/6-1.1/speed
CPU 3 
Modules linked in: nfs lockd fscache auth_rpcgss nfs_acl sunrpc cpufreq_ondemand acpi_cpufreq freq_table mperf bridge stp llc ipv6 vhost_net macvtap macvlan tun kvm_intel kvm microcode iTCO_wdt iTCO_vendor_]

Pid: 1966, comm: qemu-kvm Tainted: G        W  ---------------    2.6.32-335.el6.x86_64 #1 LENOVO ThinkCentre M8000T/LENOVO
RIP: 0010:[<ffffffff8150a03f>]  [<ffffffff8150a03f>] _spin_lock_irqsave+0x1f/0x40
RSP: 0018:ffff8801f4f2f508  EFLAGS: 00010046
RAX: 0000000000010000 RBX: ffff88002838cc40 RCX: 000000000013003c
RDX: 0000000000000046 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff8801f4f2f508 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000003 R11: 00000000ffffff84 R12: 0000000000000000
R13: ffff8801f790d000 R14: 0000000000000000 R15: 0000000000000000
FS:  00007fdcc7fff700(0000) GS:ffff880028380000(0000) knlGS:0000000000000000
CS:  0010 DS: 002b ES: 002b CR0: 000000008005003b
CR2: 0000000000000000 CR3: 00000001f3233000 CR4: 00000000000426e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process qemu-kvm (pid: 1966, threadinfo ffff8801f4f2e000, task ffff8801f44f7540)
Stack:
 ffff8801f4f2f558 ffffffff8101edce ffffea00062bbbe0 00000000f4f2f548
<d> ffffffff81136e79 0000000000000008 0000000000000002 ffff8801f4f2f598
<d> ffff88002838cc40 0000000000000004 ffff8801f4f2f7d8 ffffffff81020255
Call Trace:
 [<ffffffff8101edce>] intel_get_event_constraints+0x8e/0x300
 [<ffffffff81136e79>] ? zone_statistics+0x99/0xc0
 [<ffffffff81020255>] x86_schedule_events+0x75/0x320
 [<ffffffff8116408b>] ? kmem_cache_alloc_node_trace+0x1cb/0x200
 [<ffffffff81127fff>] ? free_hot_page+0x2f/0x60
 [<ffffffffa03cb211>] ? __mmu_unsync_walk+0xd1/0x230 [kvm]
 [<ffffffff8101c258>] ? intel_pmu_enable_all+0xb8/0x160
 [<ffffffff8101b12f>] ? intel_pmu_disable_all+0x3f/0x110
 [<ffffffff8101ba93>] x86_pmu_add+0x103/0x170
 [<ffffffff8104821d>] ? get_user_pages_fast+0xdd/0x1c0
 [<ffffffffa03b24e6>] ? gfn_to_hva+0x16/0x90 [kvm]
 [<ffffffffa03cec73>] ? mmu_parent_walk.clone.7+0x63/0x100 [kvm]
 [<ffffffffa03b24e6>] ? gfn_to_hva+0x16/0x90 [kvm]
 [<ffffffff81013783>] ? native_sched_clock+0x13/0x80
 [<ffffffff81012b19>] ? sched_clock+0x9/0x10
 [<ffffffff81099905>] ? sched_clock_local+0x25/0x90
 [<ffffffff8110c971>] event_sched_in+0x91/0x1b0
 [<ffffffff81110cfe>] __perf_install_in_context+0x1de/0x200
 [<ffffffff8110adf0>] ? remote_function+0x0/0x60
 [<ffffffff8110ae38>] remote_function+0x48/0x60
 [<ffffffff810aa28c>] smp_call_function_single+0x8c/0x160
 [<ffffffff8110ae94>] task_function_call+0x44/0x50
 [<ffffffff81110b20>] ? __perf_install_in_context+0x0/0x200
 [<ffffffff8110dc39>] perf_install_in_context+0x69/0xe0
 [<ffffffff811106a5>] perf_event_create_kernel_counter+0x85/0xf0
 [<ffffffffa03dc9db>] reprogram_counter+0x9b/0xf0 [kvm]
 [<ffffffffa03dcb30>] reprogram_gp_counter+0x100/0x120 [kvm]
 [<ffffffffa03dcc99>] reprogram_idx+0x99/0xa0 [kvm]
 [<ffffffffa03dcf0f>] kvm_pmu_set_msr+0x15f/0x2f0 [kvm]
 [<ffffffffa03c28c5>] kvm_set_msr_common+0x585/0xa00 [kvm]
 [<ffffffffa031d106>] vmx_set_msr+0x96/0x250 [kvm_intel]
 [<ffffffffa031f652>] ? skip_emulated_instruction+0x62/0x70 [kvm_intel]
 [<ffffffffa031fd08>] handle_wrmsr+0x58/0xc0 [kvm_intel]
 [<ffffffff81038908>] ? x86_swiotlb_alloc_coherent+0x48/0x70
 [<ffffffffa031fef3>] vmx_handle_exit+0xc3/0x280 [kvm_intel]
 [<ffffffffa03c7c26>] kvm_arch_vcpu_ioctl_run+0x486/0x1040 [kvm]
 [<ffffffffa03b0ff4>] kvm_vcpu_ioctl+0x434/0x580 [kvm]
 [<ffffffff8104357c>] ? __do_page_fault+0x1ec/0x480
 [<ffffffff811907d2>] vfs_ioctl+0x22/0xa0
 [<ffffffff81190c9a>] do_vfs_ioctl+0x3aa/0x580
 [<ffffffff81190ef1>] sys_ioctl+0x81/0xa0
 [<ffffffff8100b072>] system_call_fastpath+0x16/0x1b
Code: c9 c3 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 0f 1f 44 00 00 9c 58 0f 1f 44 00 00 48 89 c2 fa 66 0f 1f 44 00 00 b8 00 00 01 00 <f0> 0f c1 07 0f b7 c8 c1 e8 10 39 c1 74 0e f3 90 0f b7 0f eb f5 
RIP  [<ffffffff8150a03f>] _spin_lock_irqsave+0x1f/0x40
 RSP <ffff8801f4f2f508>
CR2: 0000000000000000
do_IRQ: 0.185 No irq handler for vector (irq -1)
do_IRQ: 0.97 No irq handler for vector (irq -1)
[Firmware Bug]: the BIOS has corrupted hw-PMU resources (MSR 186 is 53003c)


Additional info:
-------------------
The call trace is given by 2.6.32-335.el6.x86_64


[root@localhost ~]# cat /proc/cpuinfo 
processor	: 0
vendor_id	: GenuineIntel
cpu family	: 6
model		: 23
model name	: Intel(R) Core(TM)2 Quad CPU    Q9500  @ 2.83GHz
stepping	: 10
cpu MHz		: 2000.000
cache size	: 3072 KB
physical id	: 0
siblings	: 4
core id		: 0
cpu cores	: 4
apicid		: 0
initial apicid	: 0
fpu		: yes
fpu_exception	: yes
cpuid level	: 13
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx lm constant_tsc arch_perfmon pebs bts rep_good aperfmperf pni dtes64 monitor ds_cpl vmx est tm2 ssse3 cx16 xtpr pdcm sse4_1 xsave lahf_lm dts tpr_shadow vnmi flexpriority
bogomips	: 5652.70
clflush size	: 64
cache_alignment	: 64
address sizes	: 36 bits physical, 48 bits virtual
power management:

Comment 2 Chao Yang 2012-10-30 09:12:25 UTC

FYI:
Seems a dupliate of bz869216 based on #c4

Comment 3 Qunfang Zhang 2012-10-30 09:20:52 UTC

Here's another one that is in POST status:
https://bugzilla.redhat.com/show_bug.cgi?id=865380

Comment 4 Eduardo Habkost 2012-11-14 19:28:22 UTC

Please retest using kernel-2.6.32-338.el6, to check if it's a duplicate of bug 865380.

Comment 5 Shaolong Hu 2012-11-15 03:03:05 UTC

With 2.6.32-338.el6.x86_64, won't hit the problem, duplicate.

*** This bug has been marked as a duplicate of bug 865380 ***