Bug 989914

Summary: host will call trace and reboot automatically when passthrough host cdrom to guest
Product: Red Hat Enterprise Linux 6 Reporter: Sibiao Luo <sluo>
Component: qemu-kvmAssignee: John Snow <jsnow>
Status: CLOSED NEXTRELEASE QA Contact: Virtualization Bugs <virt-bugs>
Severity: low Docs Contact:
Priority: low    
Version: 6.5CC: chayang, juzhang, kwolf, mazhang, michen, mkenneth, qzhang, rbalakri, rpacheco, shuang, virt-maint, xfu
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-07-03 19:41:20 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Sibiao Luo 2013-07-30 07:21:20 UTC
Description of problem:
as subject, find this issue when verify bug 890011 and block my bug verification for bug 890011, so set high priority.

Version-Release number of selected component (if applicable):
host info:
2.6.32-401.el6.x86_64
qemu-kvm-0.12.1.2-2.382.el6.x86_64
seabios-0.6.1.2-28.el6.x86_64
guest info:
2.6.32-401.el6.x86_64

How reproducible:
100%

Steps to Reproduce:
1.insert a cdrom disk into host.
# ls -lh /dev/cdrom 
lrwxrwxrwx. 1 root root 3 Jul 30 15:14 /dev/cdrom -> sr0
2.boot a guest passthrough host cdrom to guest with scsi-block.
e.g:...-drive file=/dev/cdrom,if=none,id=drive-cd-disk,media=cdrom,format=raw,cache=none,werror=stop,rerror=stop -device virtio-scsi-pci,bus=pci.0,addr=0x7,id=scsi1 -device scsi-block,drive=drive-cd-disk,bus=scsi1.0,id=scsi_cd
3.

Actual results:
after step 2, host will call trace at once.
------------[ cut here ]------------                                            
kernel BUG at drivers/ata/libata-core.c:5104!                                   
invalid opcode: 0000 [#1] SMP                                                   
last sysfs file: /sys/kernel/mm/ksm/run                                         
CPU 1                                                                           
Modules linked in: ip6table_filter ip6_tables ebtable_nat ebtables ipt_MASQUERADE iptable_nat nf_nat nf_conntrack_ipv4 nf]
                                                                                
Pid: 2861, comm: qemu-kvm Not tainted 2.6.32-401.el6.x86_64 #1 Hewlett-Packard HP Compaq 8200 Elite MT PC/1495
RIP: 0010:[<ffffffff8138d59e>]  [<ffffffff8138d59e>] ata_qc_issue+0x29e/0x340  
RSP: 0018:ffff8802264bd7d8  EFLAGS: 00010046
RAX: 0000000000000001 RBX: ffff88022477c140 RCX: 0000000000000000
RDX: ffff88022477dd50 RSI: 0000000000000045 RDI: ffff88022477c140
RBP: ffff8802264bd828 R08: 0000000000000000 R09: ffff88022477c000
R10: ffff88022477c190 R11: 0000000000000000 R12: ffff88022477c000
R13: ffff88022477dd50 R14: 0000000000000001 R15: 0000000000000001
FS:  00007f12ad8ea700(0000) GS:ffff880028240000(0000) knlGS:0000000000000000
CS:  0010 DS: 002b ES: 002b CR0: 000000008005003b
CR2: 00007f1294f99c10 CR3: 0000000224695000 CR4: 00000000000427e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process qemu-kvm (pid: 2861, threadinfo ffff8802264bc000, task ffff880226eceae0)
Stack:
 ffff8802264bd818 ffffffff81378fe9 ffff880028210440 ffff880226c37ba0
<d> 0000000000000000 ffff88022477c140 0000000000000000 ffff88022477deb8
<d> ffffffff81395650 ffff88022477c000 ffff8802264bd878 ffffffff81392a47
Call Trace:
 [<ffffffff81378fe9>] ? scsi_get_command+0x89/0xc0
 [<ffffffff81395650>] ? ata_scsi_pass_thru+0x0/0x300
 [<ffffffff81392a47>] ata_scsi_translate+0xa7/0x180
 [<ffffffff81378200>] ? scsi_done+0x0/0x60
 [<ffffffff81378200>] ? scsi_done+0x0/0x60
 [<ffffffff813960dd>] ata_scsi_queuecmd+0xbd/0x2d0
 [<ffffffff81378491>] scsi_dispatch_cmd+0x101/0x360
 [<ffffffff8138021e>] scsi_request_fn+0x5ee/0x7a0
 [<ffffffff8108145d>] ? del_timer+0x7d/0xe0
 [<ffffffff8125ffd1>] __blk_run_queue+0x31/0x40
 [<ffffffff8125ad5a>] elv_insert+0xfa/0x190
 [<ffffffff8125ae30>] __elv_add_request+0x40/0x90
 [<ffffffff81267467>] blk_execute_rq_nowait+0x77/0x100
 [<ffffffff81267574>] blk_execute_rq+0x84/0xf0
 [<ffffffff8121ffe9>] ? security_capable+0x29/0x30
 [<ffffffff8107bd1a>] ? capable+0x2a/0x60
 [<ffffffff8126b83c>] ? blk_verify_command+0x2c/0x80
 [<ffffffff8126baa5>] sg_io+0x215/0x3d0
 [<ffffffff8126c430>] scsi_cmd_ioctl+0x400/0x470
 [<ffffffff810ab917>] ? futex_wait+0x227/0x380
 [<ffffffff8126c4f1>] scsi_cmd_blk_ioctl+0x51/0x70
 [<ffffffffa01b4a1d>] cdrom_ioctl+0x4d/0xe60 [cdrom]
 [<ffffffff81227b31>] ? avc_has_perm+0x71/0x90
 [<ffffffffa003e440>] sr_block_ioctl+0x60/0xb0 [sr_mod]
 [<ffffffff812691c7>] __blkdev_driver_ioctl+0x67/0x80
 [<ffffffff8126964d>] blkdev_ioctl+0x1ed/0x6e0
 [<ffffffff811be5fc>] block_ioctl+0x3c/0x40
 [<ffffffff81197cc2>] vfs_ioctl+0x22/0xa0
 [<ffffffff81197e64>] do_vfs_ioctl+0x84/0x580
 [<ffffffff811983e1>] sys_ioctl+0x81/0xa0
 [<ffffffff810dda7e>] ? __audit_syscall_exit+0x25e/0x290
 [<ffffffff8100b072>] system_call_fastpath+0x16/0x1b
Code: ff ff 0f 1f 00 4c 8b 3d a9 84 a6 00 e9 75 fe ff ff 48 83 bb a0 00 00 00 00 74 10 83 7b 54 00 74 0a 83 7b 64 00 0f 8 
RIP  [<ffffffff8138d59e>] ata_qc_issue+0x29e/0x340
 RSP <ffff8802264bd7d8>
Initializing cgroup subsys cpuset
Initializing cgroup subsys cpu
...

Expected results:
both guest and host work well.

Additional info:
# /usr/libexec/qemu-kvm -S -M rhel6.5.0 -cpu SandyBridge -enable-kvm -m 4096 -smp 4 -no-kvm-pit-reinjection -name sluo -uuid 43425b70-86e5-4664-bf2c-3b76699a8aec -rtc base=localtime,clock=host,driftfix=slew -device virtio-serial-pci,id=virtio-serial0,max_ports=16,vectors=0,bus=pci.0,addr=0x3 -chardev socket,id=channel1,path=/tmp/helloworld1,server,nowait -device virtserialport,chardev=channel1,name=com.redhat.rhevm.vdsm.1,bus=virtio-serial0.0,id=port1,nr=1 -chardev socket,id=channel2,path=/tmp/helloworld2,server,nowait -device virtserialport,chardev=channel2,name=com.redhat.rhevm.vdsm.2,bus=virtio-serial0.0,id=port2,nr=2 -drive file=/home/RHEL-Server-7.0-64.qcow2,if=none,id=drive-system-disk,format=qcow2,cache=none,aio=native,werror=stop,rerror=stop,serial="QEMU-DISK1" -device virtio-scsi-pci,bus=pci.0,addr=0x4,id=scsi0 -device scsi-hd,drive=drive-system-disk,id=system-disk,bootindex=1 -device virtio-balloon-pci,id=ballooning,bus=pci.0,addr=0x5 -global PIIX4_PM.disable_s3=0 -global PIIX4_PM.disable_s4=0 -netdev tap,id=hostnet0,vhost=off,script=/etc/qemu-ifup -device virtio-net-pci,netdev=hostnet0,id=virtio-net-pci0,mac=2C:41:38:B6:32:21,bus=pci.0,addr=0x6,bootindex=2 -drive file=/dev/cdrom,if=none,id=drive-cd-disk,media=cdrom,format=raw,cache=none,werror=stop,rerror=stop -device virtio-scsi-pci,bus=pci.0,addr=0x7,id=scsi1 -device scsi-block,drive=drive-cd-disk,bus=scsi1.0,id=scsi_cd -k en-us -boot menu=on -vnc :1 -spice port=5931,disable-ticketing -qmp tcp:0:4444,server,nowait -monitor stdio

Comment 2 Sibiao Luo 2013-07-30 07:28:49 UTC
my host cpu info:

processor	: 7
vendor_id	: GenuineIntel
cpu family	: 6
model		: 42
model name	: Intel(R) Core(TM) i7-2600 CPU @ 3.40GHz
stepping	: 7
cpu MHz		: 1600.000
cache size	: 8192 KB
physical id	: 0
siblings	: 8
core id		: 3
cpu cores	: 4
apicid		: 7
initial apicid	: 7
fpu		: yes
fpu_exception	: yes
cpuid level	: 13
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx rdtscp lm constant_tsc arch_perfmon pebs bts rep_good xtopology nonstop_tsc aperfmperf pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic popcnt tsc_deadline_timer aes xsave avx lahf_lm ida arat epb xsaveopt pln pts dts tpr_shadow vnmi flexpriority ept vpid
bogomips	: 6784.34
clflush size	: 64
cache_alignment	: 64
address sizes	: 36 bits physical, 48 bits virtual
power management:

Comment 4 Sibiao Luo 2013-08-01 09:17:28 UTC
(In reply to Sibiao Luo from comment #0)
> Version-Release number of selected component (if applicable):
> host info:
> 2.6.32-401.el6.x86_64
> qemu-kvm-0.12.1.2-2.382.el6.x86_64
> seabios-0.6.1.2-28.el6.x86_64
> guest info:
> 2.6.32-401.el6.x86_64
Note: I wrote the guest info by mistake, it's only hit by rhel7 guest, it cann't hit by rhel6.5 guest.
> Additional info:
> # /usr/libexec/qemu-kvm -S -M rhel6.5.0 -cpu SandyBridge -enable-kvm -m 4096
> -smp 4 -no-kvm-pit-reinjection -name sluo -uuid
> 43425b70-86e5-4664-bf2c-3b76699a8aec -rtc
> base=localtime,clock=host,driftfix=slew -device
> virtio-serial-pci,id=virtio-serial0,max_ports=16,vectors=0,bus=pci.0,
> addr=0x3 -chardev socket,id=channel1,path=/tmp/helloworld1,server,nowait
> -device
> virtserialport,chardev=channel1,name=com.redhat.rhevm.vdsm.1,bus=virtio-
> serial0.0,id=port1,nr=1 -chardev
> socket,id=channel2,path=/tmp/helloworld2,server,nowait -device
> virtserialport,chardev=channel2,name=com.redhat.rhevm.vdsm.2,bus=virtio-
> serial0.0,id=port2,nr=2 -drive
> file=/home/RHEL-Server-7.0-64.qcow2,if=none,id=drive-system-disk,
> format=qcow2,cache=none,aio=native,werror=stop,rerror=stop,serial="QEMU-
> DISK1" -device virtio-scsi-pci,bus=pci.0,addr=0x4,id=scsi0 -device
> scsi-hd,drive=drive-system-disk,id=system-disk,bootindex=1 -device
> virtio-balloon-pci,id=ballooning,bus=pci.0,addr=0x5 -global
> PIIX4_PM.disable_s3=0 -global PIIX4_PM.disable_s4=0 -netdev
> tap,id=hostnet0,vhost=off,script=/etc/qemu-ifup -device
> virtio-net-pci,netdev=hostnet0,id=virtio-net-pci0,mac=2C:41:38:B6:32:21,
> bus=pci.0,addr=0x6,bootindex=2 -drive
> file=/dev/cdrom,if=none,id=drive-cd-disk,media=cdrom,format=raw,cache=none,
> werror=stop,rerror=stop -device virtio-scsi-pci,bus=pci.0,addr=0x7,id=scsi1
> -device scsi-block,drive=drive-cd-disk,bus=scsi1.0,id=scsi_cd -k en-us -boot
> menu=on -vnc :1 -spice port=5931,disable-ticketing -qmp
> tcp:0:4444,server,nowait -monitor stdio

Comment 6 Sibiao Luo 2013-08-01 09:44:29 UTC
According comment #5, it's no longer regression issue, so i adjust the Priority/Severity to low/low.

Best Regards,
sluo

Comment 7 Ademar Reis 2013-08-01 23:41:17 UTC
Low priority, low impact, not a customer issue ==> Deferring to rhel-6.6 (at least) because of capacity.

Comment 11 mazhang 2014-07-18 09:37:01 UTC
Hit this problem on qemu-kvm-rhev-0.12.1.2-2.430.el6.x86_64.

Host:
qemu-guest-agent-0.12.1.2-2.430.el6.x86_64
qemu-kvm-rhev-debuginfo-0.12.1.2-2.430.el6.x86_64
qemu-img-rhev-0.12.1.2-2.430.el6.x86_64
qemu-kvm-rhev-tools-0.12.1.2-2.430.el6.x86_64
qemu-kvm-rhev-0.12.1.2-2.430.el6.x86_64
kernel-2.6.32-491.el6.x86_64

Guest:
RHEL7-64
kernel-3.10.0-123.el7.x86_64

Cli:
/usr/libexec/qemu-kvm \
-M rhel6.6.0 \
-cpu SandyBridge \
-m 4G \
-smp 4,sockets=1,cores=2,threads=2,maxcpus=160 \
-enable-kvm \
-name rhel6.6 \
-uuid 990ea161-6b67-47b2-b803-19fb01d30d12 \
-smbios type=1,manufacturer='Red Hat',product='RHEV Hypervisor',version=el6,serial=koTUXQrb,uuid=feebc8fd-f8b0-4e75-abc3-e63fcdb67170 \
-k en-us \
-rtc base=localtime,clock=host,driftfix=slew \
-nodefaults \
-monitor stdio \
-qmp tcp:0:6666,server,nowait \
-boot menu=on \
-bios /usr/share/seabios/bios.bin \
-chardev socket,id=seabios,path=/tmp/seabios0,server,nowait \
-device isa-debugcon,chardev=seabios,iobase=0x402 \
-monitor unix:/tmp/socket0,server,nowait -device sga \
-vga qxl \
-spice port=5900,disable-ticketing \
-netdev tap,id=hostnet0,vhost=on \
-device virtio-net-pci,netdev=hostnet0,id=net0 \
-usb \
-device usb-tablet,id=tablet0 \
-drive file=/home/rhel7-64.qcow2,if=none,id=drive-virtio-disk0,format=qcow2,cache=none,werror=stop,rerror=stop,aio=threads \
-device virtio-blk-pci,scsi=off,bus=pci.0,drive=drive-virtio-disk0,id=virtio-disk0,bootindex=1 \
-device virtio-scsi-pci,id=scsi0,bus=pci.0,addr=0x8 \
-drive file=/dev/sr0,if=none,id=drive-hostdev0,readonly=on \
-device scsi-generic,bus=scsi0.0,channel=0,scsi-id=0,lun=0,drive=drive-hostdev0,id=hostdev0 \

Result:
Host crash.
<4>------------[ cut here ]------------
<2>kernel BUG at drivers/ata/libata-core.c:5115!
<4>invalid opcode: 0000 [#1] SMP
<4>last sysfs file: /sys/devices/system/cpu/online
<4>CPU 3
<4>Modules linked in: cpufreq_ondemand acpi_cpufreq freq_table mperf bridge stp llc ipv6 dm_mirror vhost_net macvtap macvlan tun kvm_intel kvm iTCO_wdt iTCO_vendor_support tpm_infineon microcode serio_raw i2c_i801 sg lpc_ich mfd_core e1000e ptp pps_core snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_intel snd_hda_codec snd_hwdep snd_seq snd_seq_device snd_pcm snd_timer snd soundcore snd_page_alloc ext4 jbd2 mbcache sr_mod cdrom sd_mod crc_t10dif ahci xhci_hcd video output wmi radeon ttm drm_kms_helper drm i2c_algo_bit i2c_core dm_region_hash dm_log dm_mod [last unloaded: scsi_wait_scan]
<4>
<4>Pid: 2465, comm: qemu-kvm Not tainted 2.6.32-491.el6.x86_64 #1 Hewlett-Packard HP Compaq Elite 8300 MT/3397
<4>RIP: 0010:[<ffffffff81394abe>]  [<ffffffff81394abe>] ata_qc_issue+0x29e/0x340
<4>RSP: 0018:ffff88020fafdaa8  EFLAGS: 00010046
<4>RAX: 0000000000000001 RBX: ffff880213071640 RCX: 0000000000000018
<4>RDX: ffff880213071d58 RSI: 0000000000000045 RDI: ffff880213071640
<4>RBP: ffff88020fafdaf8 R08: ffff880213070000 R09: ffff880213071500
<4>R10: ffff880213071690 R11: 0000000000000000 R12: ffff880213070000
<4>R13: ffff880213071d58 R14: 0000000000000001 R15: 0000000000000001
<4>FS:  00007fb5b93fb700(0000) GS:ffff8800282c0000(0000) knlGS:0000000000000000
<4>CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
<4>CR2: 00007f19dd06a228 CR3: 00000002166be000 CR4: 00000000001427e0
<4>DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
<4>DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
<4>Process qemu-kvm (pid: 2465, threadinfo ffff88020fafc000, task ffff8802139f6040)
<4>Stack:
<4> ffff88020faf2488 0000000000000082 ffff88020fafdaf8 ffffffff8137f329
<4><d> ffff8802139f6040 ffff880213071640 0000000000000000 ffff880213071ec0
<4><d> ffffffff8139cc00 ffff880213070000 ffff88020fafdb48 ffffffff81399f97
<4>Call Trace:
<4> [<ffffffff8137f329>] ? scsi_get_command+0x89/0xc0
<4> [<ffffffff8139cc00>] ? ata_scsi_pass_thru+0x0/0x300
<4> [<ffffffff81399f97>] ata_scsi_translate+0xa7/0x180
<4> [<ffffffff8137e5f0>] ? scsi_done+0x0/0x60
<4> [<ffffffff8137e5f0>] ? scsi_done+0x0/0x60
<4> [<ffffffff8139d68d>] ata_scsi_queuecmd+0xbd/0x2d0
<4> [<ffffffff8137e845>] scsi_dispatch_cmd+0xe5/0x310
<4> [<ffffffff813870ee>] scsi_request_fn+0x5be/0x750
<4> [<ffffffff8108747d>] ? del_timer+0x7d/0xe0
<4> [<ffffffff8126a080>] ? elv_insert+0x110/0x190
<4> [<ffffffff8126ed32>] __generic_unplug_device+0x32/0x40
<4> [<ffffffff81276b7f>] blk_execute_rq_nowait+0x7f/0x110
<4> [<ffffffff81271480>] ? blk_get_request+0x70/0xa0
<4> [<ffffffffa0333af1>] sg_common_write+0x331/0x570 [sg]
<4> [<ffffffff812398e6>] ? selinux_capable+0x46/0x60
<4> [<ffffffff8108291a>] ? capable+0x2a/0x60
<4> [<ffffffffa0335183>] sg_new_write+0x293/0x390 [sg]
<4> [<ffffffffa033620b>] sg_ioctl+0xb2b/0xd00 [sg]
<4> [<ffffffff8108e4d0>] ? do_send_sig_info+0x70/0x90
<4> [<ffffffff811a354c>] vfs_ioctl+0x7c/0xa0
<4> [<ffffffff811a3694>] do_vfs_ioctl+0x84/0x580
<4> [<ffffffff811a3c11>] sys_ioctl+0x81/0xa0
<4> [<ffffffff810e5ade>] ? __audit_syscall_exit+0x25e/0x290
<4> [<ffffffff8100b072>] system_call_fastpath+0x16/0x1b
<4>Code: ff ff 0f 1f 00 4c 8b 3d a9 93 a6 00 e9 75 fe ff ff 48 83 bb a0 00 00 00 00 74 10 83 7b 54 00 74 0a 83 7b 64 00 0f 85 19 fe ff ff <0f> 0b eb fe 41 83 4d 38 06 49 8d 7d 28 48 c7 c6 b9 63 7f 81 31
<1>RIP  [<ffffffff81394abe>] ata_qc_issue+0x29e/0x340
<4> RSP <ffff88020fafdaa8>

Comment 14 Ademar Reis 2015-07-03 19:41:20 UTC
(In reply to Ademar Reis from comment #7)
> Low priority, low impact, not a customer issue ==> Deferring to rhel-6.6 (at
> least) because of capacity.

This has been deferred multiple times already and we've never seen a complaint from users, so I'm closing it as NEXTRELEASE (doesn't happen with RHEL7 hosts).