Bug 988256

Summary:	Segmentation fault when guest reboot after hotulnplug netkvm
Product:	Red Hat Enterprise Linux 7	Reporter:	lijin <lijin>
Component:	qemu-kvm	Assignee:	Marcel Apfelbaum <marcel>
Status:	CLOSED DUPLICATE	QA Contact:	Virtualization Bugs <virt-bugs>
Severity:	high	Docs Contact:
Priority:	high
Version:	7.0	CC:	451573170, acathrow, bcao, hhuang, juzhang, kzhang, lijin, pbonzini, qiguo, rhod, sluo, virt-maint, yunzheng
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-11-06 13:06:50 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description lijin 2013-07-25 08:10:26 UTC

Description of problem:
when guest do reboot after hotulnplug netkvm,Segmentation fault occurs

Version-Release number of selected component (if applicable):
kernel-3.10.0-0.rc7.64.el7.x86_64
qemu-kvm-1.5.1-2.el7.x86_64
virtio-win-prewhql-65
seabios-1.7.2.2-2.el7.x86_64
spice-server-0.12.3-1.el7.x86_64
vgabios-0.6c-9.el7.noarch

How reproducible:
100%

Steps to Reproduce:
1.boot a win2k8-R2 guest with netkvm:
/usr/libexec/qemu-kvm  \
-drive file=win2k8R2.qcow3,if=none,cache=none,media=disk,format=qcow2,id=drive-scsi-0 \
-device ide-drive,drive=drive-scsi-0,id=blk0,bootindex=0 \
-global PIIX4_PM.disable_s3=0 -global PIIX4_PM.disable_s4=0 \
-usb -device usb-tablet \
-monitor stdio \
-chardev socket,id=aaaa,path=/tmp/tttt,server,nowait \
-mon chardev=aaaa,mode=readline \
-spice port=5900,disable-ticketing -vga qxl \
-chardev file,path=/root/console.log,id=serial1 \
-device isa-serial,chardev=serial1,id=s1 \
-cpu 'Penryn' -M pc \
-smp 4,cores=2,threads=1,sockets=2 -m 6G \
-enable-kvm \
-netdev tap,sndbuf=0,id=hostnet1,vhost=on,script=/etc/qemu-ifup,downscript=no -device virtio-net-pci,netdev=hostnet1,id=net1,mac=00:52:12:16:54:46,bus=pci.0,addr=0x7 \

2.hotunplug netkvm
(qemu) device_del net1 
(qemu) netdev_del hostnet1

3.reboot guest

Actual results:
Segmentation fault occurs

Expected results:
guest works well

Additional info:
in rhel6 host,not hit this issue

Comment 1 lijin 2013-07-25 08:11:19 UTC

(gdb) bt
#0  0x00007f3fa72f7290 in __memcmp_sse4_1 () from /lib64/libc.so.6
#1  0x00007f3fabaacbc9 in patch_hypercalls (s=0x7f3fae26b490, s=0x7f3fae26b490)
    at /usr/src/debug/qemu-1.5.1/hw/i386/kvmvapic.c:549
#2  vapic_prepare (s=s@entry=0x7f3fae26b490) at /usr/src/debug/qemu-1.5.1/hw/i386/kvmvapic.c:614
#3  0x00007f3fabaacd0e in vapic_write (opaque=0x7f3fae26b490, addr=<optimized out>, data=<optimized out>, size=<optimized out>)
    at /usr/src/debug/qemu-1.5.1/hw/i386/kvmvapic.c:651

#4  0x00007f3fabacfc62 in access_with_adjusted_size (addr=addr@entry=0, value=value@entry=0x7f3f9ed9cb58, size=2,
    access_size_min=<optimized out>, access_size_max=<optimized out>, access=access@entry=
    0x7f3fabad0220 <memory_region_write_accessor>, opaque=opaque@entry=0x7f3fae26d7b8) at /usr/src/debug/qemu-1.5.1/memory.c:364
#5  0x00007f3fabad1137 in memory_region_iorange_write (iorange=<optimized out>, offset=0, width=2, data=32)
    at /usr/src/debug/qemu-1.5.1/memory.c:439
#6  0x00007f3fabace9dd in kvm_handle_io (count=1, size=2, direction=1, data=<optimized out>, port=126)
    at /usr/src/debug/qemu-1.5.1/kvm-all.c:1485
#7  kvm_cpu_exec (env=env@entry=0x7f3fae24d230) at /usr/src/debug/qemu-1.5.1/kvm-all.c:1634
#8  0x00007f3faba79dd5 in qemu_kvm_cpu_thread_fn (arg=0x7f3fae24d230) at /usr/src/debug/qemu-1.5.1/cpus.c:759
#9  0x00007f3fa9b02c53 in start_thread () from /lib64/libpthread.so.0
#10 0x00007f3fa728f0dd in clone () from /lib64/libc.so.6

Comment 2 guo jiang 2013-07-25 08:23:49 UTC

win2012 hit the same issue on rhel 7 host
package version:
 kernel-3.10.0-2.el7.x86_64
 others:the same as comment #0
(gdb) bt
#0  __memcmp_sse4_1 () at ../sysdeps/x86_64/multiarch/memcmp-sse4.S:1015
#1  0x00007f391a94fbc9 in patch_hypercalls (s=0x7f391ccdb420, s=0x7f391ccdb420)
    at /usr/src/debug/qemu-1.5.1/hw/i386/kvmvapic.c:549
#2  vapic_prepare (s=s@entry=0x7f391ccdb420) at /usr/src/debug/qemu-1.5.1/hw/i386/kvmvapic.c:614
#3  0x00007f391a94fd0e in vapic_write (opaque=0x7f391ccdb420, addr=<optimized out>, data=<optimized out>, 
    size=<optimized out>) at /usr/src/debug/qemu-1.5.1/hw/i386/kvmvapic.c:651
#4  0x00007f391a972c62 in access_with_adjusted_size (addr=addr@entry=0, value=value@entry=0x7f390eb2fb58, size=2, 
    access_size_min=<optimized out>, access_size_max=<optimized out>, 
    access=access@entry=0x7f391a973220 <memory_region_write_accessor>, opaque=opaque@entry=0x7f391ccdd748)
    at /usr/src/debug/qemu-1.5.1/memory.c:364
#5  0x00007f391a974137 in memory_region_iorange_write (iorange=<optimized out>, offset=0, width=2, data=32)
    at /usr/src/debug/qemu-1.5.1/memory.c:439
#6  0x00007f391a9719dd in kvm_handle_io (count=1, size=2, direction=1, data=<optimized out>, port=126)
    at /usr/src/debug/qemu-1.5.1/kvm-all.c:1485
#7  kvm_cpu_exec (env=env@entry=0x7f391ccbd040) at /usr/src/debug/qemu-1.5.1/kvm-all.c:1634
#8  0x00007f391a91cdd5 in qemu_kvm_cpu_thread_fn (arg=0x7f391ccbd040) at /usr/src/debug/qemu-1.5.1/cpus.c:759
#9  0x00007f39189a5c53 in start_thread (arg=0x7f390eb30700) at pthread_create.c:308
#10 0x00007f39161320dd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:113

Comment 4 Hai Huang 2013-07-25 13:17:31 UTC

Original description reports win2k8-R2 guest on rhel7 host,
Comment 1 reports win2012 hit the same issue on rhel 7 host.
Does this problem also occur with rhel7 guest?  

This would help us narrow down to whether this may be an Windows driver
issue, or in qemu.  Thank you.

Comment 5 guo jiang 2013-07-26 07:32:35 UTC

QE reproduced this issue on rhel7 guest.

(gdb) bt
#0  __memcmp_sse4_1 () at ../sysdeps/x86_64/multiarch/memcmp-sse4.S:1015
#1  0x00007f800d613bc9 in patch_hypercalls (s=0x7f800f706be0, s=0x7f800f706be0) at /usr/src/debug/qemu-1.5.1/hw/i386/kvmvapic.c:549
#2  vapic_prepare (s=s@entry=0x7f800f706be0) at /usr/src/debug/qemu-1.5.1/hw/i386/kvmvapic.c:614
#3  0x00007f800d613d0e in vapic_write (opaque=0x7f800f706be0, addr=<optimized out>, data=<optimized out>, size=<optimized out>)
    at /usr/src/debug/qemu-1.5.1/hw/i386/kvmvapic.c:651
#4  0x00007f800d636c62 in access_with_adjusted_size (addr=addr@entry=0, value=value@entry=0x7f80017f3b58, size=2, 
    access_size_min=<optimized out>, access_size_max=<optimized out>, 
    access=access@entry=0x7f800d637220 <memory_region_write_accessor>, opaque=opaque@entry=0x7f800f708f08)
    at /usr/src/debug/qemu-1.5.1/memory.c:364
#5  0x00007f800d638137 in memory_region_iorange_write (iorange=<optimized out>, offset=0, width=2, data=32)
    at /usr/src/debug/qemu-1.5.1/memory.c:439
#6  0x00007f800d6359dd in kvm_handle_io (count=1, size=2, direction=1, data=<optimized out>, port=126)
    at /usr/src/debug/qemu-1.5.1/kvm-all.c:1485
#7  kvm_cpu_exec (env=env@entry=0x7f800f6e8800) at /usr/src/debug/qemu-1.5.1/kvm-all.c:1634
#8  0x00007f800d5e0dd5 in qemu_kvm_cpu_thread_fn (arg=0x7f800f6e8800) at /usr/src/debug/qemu-1.5.1/cpus.c:759
#9  0x00007f800b669c53 in start_thread (arg=0x7f80017f4700) at pthread_create.c:308
#10 0x00007f8008df60dd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:113

Comment 6 Hai Huang 2013-07-26 12:40:04 UTC

segfault in patch_hypercalls  
(/usr/src/debug/qemu-1.5.1/hw/i386/kvmvapic.c:549)
Happens with various types of guests (Windows, RHEL7).

Appears to be another manisfestation of:
    https://bugzilla.redhat.com/show_bug.cgi?id=924164

Comment 7 danielgao 2013-08-31 16:23:28 UTC

http://lists.nongnu.org/archive/html/qemu-devel/2013-08/msg04546.html
Maybe it could fix the bug.

the origin path:
http://lists.gnu.org/archive/html/qemu-devel/2012-02/msg00519.html

Comment 8 Paolo Bonzini 2013-11-06 13:06:50 UTC


*** This bug has been marked as a duplicate of bug 920021 ***