Bug 947691

Summary: piix-pm triggers assert during iofuzz test
Product: Red Hat Enterprise Linux 7 Reporter: Xiaoqing Wei <xwei>
Component: qemu-kvmAssignee: Gerd Hoffmann <kraxel>
Status: CLOSED CURRENTRELEASE QA Contact: Virtualization Bugs <virt-bugs>
Severity: medium Docs Contact:
Priority: medium    
Version: 7.0CC: acathrow, hhuang, juzhang, kraxel, michen, rhod, shuang, virt-maint
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: 1.5 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-01-20 09:49:02 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
tar cJf none

Description Xiaoqing Wei 2013-04-03 03:29:35 UTC
Description of problem:

piix-pm triggers assert during iofuzz test

Per https://bugzilla.redhat.com/show_bug.cgi?id=751937#c20

Version-Release number of selected component (if applicable):

qemu-kvm-1.4.0-1.el7.x86_64
spice-server-0.12.2-1.el7.x86_64
ipxe-roms-qemu-20120328-2.gitaac9718.el7.noarch
kernel-3.8.0-0.40.el7.x86_64


How reproducible:
Only once

Steps to Reproduce:
1. /home/staf-kvm-devel/autotest-devel/client/tests/kvm/qemu
    -S 
    -name 'vm1' 
    -nodefaults 
    -chardev socket,id=qmp_id_qmpmonitor1,path=/tmp/monitor-qmpmonitor1-20130328-150255-hEDZ97E9,server,nowait 
    -mon chardev=qmp_id_qmpmonitor1,mode=control 
    -chardev socket,id=serial_id_serial1,path=/tmp/serial-serial1-20130328-150255-hEDZ97E9,server,nowait 
    -device isa-serial,chardev=serial_id_serial1  
    -chardev socket,id=seabioslog_id_20130328-150255-hEDZ97E9,path=/tmp/seabios-20130328-150255-hEDZ97E9,server,nowait 
    -device isa-debugcon,chardev=seabioslog_id_20130328-150255-hEDZ97E9,iobase=0x402 
    -device ich9-usb-uhci1,id=usb1,bus=pci.0,addr=0x4 
    -drive file='/home/staf-kvm-devel/autotest-devel/client/tests/kvm/images/RHEL-Server-6.4-64-virtio.qcow2',if=none,id=drive-virtio-disk1,media=disk,cache=none,boot=off,snapshot=off,format=qcow2,aio=native 
    -device virtio-blk-pci,bus=pci.0,addr=0x5,drive=drive-virtio-disk1,id=virtio-disk1 
    -device virtio-net-pci,netdev=idqT5zN1,mac=9a:0d:0e:0f:10:11,bus=pci.0,addr=0x3,id='idhbkgmh' 
    -netdev tap,id=idqT5zN1,vhost=on,fd=22 
    -m 8192 
    -smp 4,maxcpus=4,cores=2,threads=1,sockets=2 
    -cpu 'SandyBridge' 
    -M pc 
    -device usb-tablet,id=usb-tablet1,bus=usb1.0,port=1 
    -spice port=3000,password=123456,addr=0,tls-port=3200,x509-dir=/tmp/spice_x509d,tls-channel=main,tls-channel=inputs,image-compression=auto_glz,jpeg-wan-compression=auto,zlib-glz-wan-compression=auto,streaming-video=all,agent-mouse=on,playback-compression=on,ipv4 
    -vga qxl 
    -global qxl-vga.vram_size=33554432    
    -rtc base=utc,clock=host,driftfix=slew  
    -boot order=cdn,once=c,menu=off       
    -no-kvm-pit-reinjection 
    -enable-kvm

2.


    KVM iofuzz test:
    1) Log into a guest
    2) Enumerate all IO port ranges through /proc/ioports
    3) On each port of the range:
        * Read it
        * Write 0 to it
        * Write a random value to a random port on a random order

3.
  
Actual results:

qemu-kvm core dumps.

(gdb) bt
#0  0x0000000000000000 in ?? ()
#1  0x00007fd3fbe6d942 in access_with_adjusted_size (addr=addr@entry=0, value=value@entry=0x7fd3eeba0ae8, size=1, access_size_min=<optimized out>, 
    access_size_max=<optimized out>, access=access@entry=0x7fd3fbe6df60 <memory_region_write_accessor>, opaque=opaque@entry=0x7fd3fed223b8)
    at /usr/src/debug/qemu-1.4.0/memory.c:364
#2  0x00007fd3fbe6efb7 in memory_region_iorange_write (iorange=<optimized out>, offset=0, width=1, data=0) at /usr/src/debug/qemu-1.4.0/memory.c:439
#3  0x00007fd3fbe6bc22 in kvm_handle_io (count=1, size=1, direction=1, data=<optimized out>, port=45064) at /usr/src/debug/qemu-1.4.0/kvm-all.c:1426
#4  kvm_cpu_exec (env=env@entry=0x7fd3fec6b590) at /usr/src/debug/qemu-1.4.0/kvm-all.c:1581
#5  0x00007fd3fbe15871 in qemu_kvm_cpu_thread_fn (arg=0x7fd3fec6b590) at /usr/src/debug/qemu-1.4.0/cpus.c:759
#6  0x00007fd3fa087d15 in start_thread (arg=0x7fd3eeba1700) at pthread_create.c:308
#7  0x00007fd3f67b746d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:114
(gdb) 


Expected results:
guest work well, not crash, qemu no core dump.

Additional info:
Host hw
processor	: 7
vendor_id	: GenuineIntel
cpu family	: 6
model		: 58
model name	: Intel(R) Core(TM) i7-3770 CPU @ 3.40GHz
stepping	: 9
microcode	: 0x13
cpu MHz		: 1600.000
cache size	: 8192 KB
physical id	: 0
siblings	: 8
core id		: 3
cpu cores	: 4
apicid		: 7
initial apicid	: 7
fpu		: yes
fpu_exception	: yes
cpuid level	: 13
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm ida arat epb xsaveopt pln pts dtherm tpr_shadow vnmi flexpriority ept vpid fsgsbase smep erms
bogomips	: 6784.31
clflush size	: 64
cache_alignment	: 64
address sizes	: 36 bits physical, 48 bits virtual
power management:

[root@hp-z220-02 client]# free -m
             total       used       free     shared    buffers     cached
Mem:         15668      15345        323          0          1      14809
-/+ buffers/cache:        534      15133
Swap:         7967          0       7967
[root@hp-z220-02 client]#

Comment 1 Xiaoqing Wei 2013-04-03 03:30:40 UTC
# gdb qemu-kvm /home/staf-kvm-devel/autotest-devel/client/results/default/kvm.smp4.8192m.repeat1.Host_RHEL.7.0.spice.qcow2.virtio_blk.virtio_net.RHEL.6.4.64.iofuzz/debug/crash.qemu.18456/core < bt.full 
GNU gdb (GDB) Red Hat Enterprise Linux (7.5.1-34.el7)
Copyright (C) 2012 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/bin/qemu-kvm...Reading symbols from /usr/lib/debug/usr/libexec/qemu-kvm.debug...done.
done.

warning: core file may not match specified executable file.
[New LWP 18460]
[New LWP 18464]
[New LWP 18456]
[New LWP 18463]
[New LWP 18461]
[New LWP 18462]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".

warning: Skipping deprecated .gdb_index section in /usr/lib/debug/lib64/libkeyutils.so.1.4.debug.
Do "set use-deprecated-index-sections on" before the file is read
to use the section anyway.
Core was generated by `/home/staf-kvm-devel/autotest-devel/client/tests/kvm/qemu -S -name vm1 -nodefau'.
Program terminated with signal 11, Segmentation fault.
#0  0x0000000000000000 in ?? ()
(gdb) #0  0x0000000000000000 in ?? ()
No symbol table info available.
#1  0x00007fd3fbe6d942 in access_with_adjusted_size (addr=addr@entry=0, value=value@entry=0x7fd3eeba0ae8, size=1, access_size_min=<optimized out>, 
    access_size_max=<optimized out>, access=access@entry=0x7fd3fbe6df60 <memory_region_write_accessor>, opaque=opaque@entry=0x7fd3fed223b8)
    at /usr/src/debug/qemu-1.4.0/memory.c:364
        access_mask = 255
        access_size = 1
        i = <optimized out>
#2  0x00007fd3fbe6efb7 in memory_region_iorange_write (iorange=<optimized out>, offset=0, width=1, data=0) at /usr/src/debug/qemu-1.4.0/memory.c:439
        mrio = <optimized out>
        mr = 0x7fd3fed223b8
        __PRETTY_FUNCTION__ = "memory_region_iorange_write"
#3  0x00007fd3fbe6bc22 in kvm_handle_io (count=1, size=1, direction=1, data=<optimized out>, port=45064) at /usr/src/debug/qemu-1.4.0/kvm-all.c:1426
        i = 0
        ptr = 0x7fd3fbbf1000 <Address 0x7fd3fbbf1000 out of bounds>
#4  kvm_cpu_exec (env=env@entry=0x7fd3fec6b590) at /usr/src/debug/qemu-1.4.0/kvm-all.c:1581
        cpu = 0x7fd3fec6b4a0
        run = 0x7fd3fbbf0000
        ret = <optimized out>
        run_ret = <optimized out>
#5  0x00007fd3fbe15871 in qemu_kvm_cpu_thread_fn (arg=0x7fd3fec6b590) at /usr/src/debug/qemu-1.4.0/cpus.c:759
---Type <return> to continue, or q <return> to quit---        cpu = 0x7fd3fec6b4a0
        r = <optimized out>
#6  0x00007fd3fa087d15 in start_thread (arg=0x7fd3eeba1700) at pthread_create.c:308
        __res = <optimized out>
        pd = 0x7fd3eeba1700
        now = <optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140548220000000, -4763835060918303541, 0, 140548438478848, 140548220000000, 140548442151884, 
                4775126448736945355, 4775083687543293131}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, 
              canceltype = 0}}}
        not_first_call = 0
        pagesize_m1 = <optimized out>
        sp = <optimized out>
        freesize = <optimized out>
#7  0x00007fd3f67b746d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:114
No locals.
(gdb) quit
[root@hp-z220-02 client]#

Comment 3 Xiaoqing Wei 2013-04-03 04:38:41 UTC
Created attachment 731042 [details]
tar cJf

Comment 4 Gerd Hoffmann 2013-05-14 12:30:03 UTC
http://patchwork.ozlabs.org/patch/243694/

Comment 5 Gerd Hoffmann 2013-06-12 12:23:59 UTC
upstream commit 2d3b989529727ccace243b953a181fbae04a30d1

Comment 7 Gerd Hoffmann 2014-01-20 09:49:02 UTC
Made it into upstream release 1.5, so rhel7 has the fix.