Bug 991288

Summary: VM has quit abnormally while iofuzz testing
Product: Red Hat Enterprise Linux 7 Reporter: CongLi <coli>
Component: qemu-kvmAssignee: Fam Zheng <famz>
Status: CLOSED DUPLICATE QA Contact: Virtualization Bugs <virt-bugs>
Severity: medium Docs Contact:
Priority: medium    
Version: 7.0CC: acathrow, bdas, coli, dgilbert, hhuang, juzhang, pbonzini, virt-maint, xwei
Target Milestone: rcKeywords: Reopened
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-04-18 06:41:37 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
iofuzz-autotest-debug file none

Description CongLi 2013-08-02 05:23:00 UTC
Description of problem:
VM has quit abnormally while iofuzz testing

Version-Release number of selected component (if applicable):
kernel-3.9.0-0.55.el7.x86_64
qemu-kvm-1.5.2-1.el7.x86_64

How reproducible:
Only once

Steps to Reproduce:
1./root/staf-kvm-devel/autotest-devel/client/tests/virt/qemu/qemu \
    -S \
    -name 'vm1' \
    -chardev socket,id=qmp_id_qmpmonitor1,path=/tmp/monitor-qmpmonitor1-20130530-191349-ZMSDl1gm,server,nowait \
    -mon chardev=qmp_id_qmpmonitor1,mode=control \
    -chardev socket,id=serial_id_serial1,path=/tmp/serial-serial1-20130530-191349-ZMSDl1gm,server,nowait \
    -device isa-serial,chardev=serial_id_serial1 \
    -chardev socket,id=seabioslog_id_20130530-191349-ZMSDl1gm,path=/tmp/seabios-20130530-191349-ZMSDl1gm,server,nowait \
    -device isa-debugcon,chardev=seabioslog_id_20130530-191349-ZMSDl1gm,iobase=0x402 \
    -device ich9-usb-uhci1,id=usb1,bus=pci.0,addr=0x4 \
    -drive file='/home/staf-kvm-devel/autotest-devel/client/tests/virt/shared/data/images/RHEL-Server-7.0-64.qcow2',if=none,id=drive-ide0-0-0,media=disk,cache=none,snapshot=off,format=qcow2,aio=native \
    -device ide-drive,bus=ide.0,unit=0,drive=drive-ide0-0-0 \
    -device rtl8139,netdev=idIg594w,mac=9a:3b:3c:3d:3e:3f,bus=pci.0,addr=0x3,id='idCSLDpm' \
    -netdev tap,id=idIg594w,fd=23 \
    -m 4096 \
    -smp 4,maxcpus=4,cores=2,threads=1,sockets=2 \
    -cpu 'SandyBridge' \
    -M pc \
    -device usb-tablet,id=usb-tablet1,bus=usb1.0,port=1 \
    -vnc :0 \
    -vga cirrus \
    -rtc base=utc,clock=host,driftfix=slew  \
    -boot order=cdn,once=c,menu=off   \
    -no-kvm-pit-reinjection \
    -enable-kvm
2.
    KVM iofuzz test:
    1) Log into a guest
    2) Enumerate all IO port ranges through /proc/ioports
    3) On each port of the range:
        * Read it
        * Write 0 to it
        * Write a random value to a random port on a random order

3.

Actual results:
VM has quit abnormally during write

Expected results:
VM works well

Additional info:
1. cpuinfo
processor	: 1
vendor_id	: AuthenticAMD
cpu family	: 15
model		: 67
model name	: Dual-Core AMD Opteron(tm) Processor 1216
stepping	: 3
cpu MHz		: 1000.000
cache size	: 1024 KB
physical id	: 0
siblings	: 2
core id		: 1
cpu cores	: 2
apicid		: 1
initial apicid	: 1
fpu		: yes
fpu_exception	: yes
cpuid level	: 1
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt rdtscp lm 3dnowext 3dnow rep_good nopl extd_apicid pni cx16 lahf_lm cmp_legacy svm extapic cr8_legacy
bogomips	: 2009.13
TLB size	: 1024 4K pages
clflush size	: 64
cache_alignment	: 64
address sizes	: 40 bits physical, 48 bits virtual
power management: ts fid vid ttp tm stc

Comment 3 Hai Huang 2013-08-02 12:05:24 UTC
Most likely a duplicate of https://bugzilla.redhat.com/show_bug.cgi?id=969945.

Comment 4 Hai Huang 2014-01-03 17:41:40 UTC

*** This bug has been marked as a duplicate of bug 969945 ***

Comment 5 CongLi 2014-03-26 09:35:40 UTC
Met this bug again on the following version:

kernel-3.10.0-114.el7.x86_64
qemu-kvm-rhev-1.5.3-57.el7ev.x86_64

Here are the qemu output:

3/25 12:59:13 DEBUG|   aexpect:1407| Sending command: echo -e '\0' | dd of=/dev/port seek=49172 bs=1 count=1
03/25 12:59:13 DEBUG|   aexpect:1407| Sending command: echo $?
03/25 12:59:14 DEBUG|    iofuzz:0035| outb(0xc015, 0x0)
03/25 12:59:14 DEBUG|   aexpect:1407| Sending command: echo -e '\0' | dd of=/dev/port seek=49173 bs=1 count=1
03/25 12:59:14 INFO |   aexpect:0907| [qemu output] qemu: virtio_ioport_write: unexpected address 0x15 value 0x0
03/25 12:59:14 DEBUG|   aexpect:1407| Sending command: echo $?
03/25 12:59:15 DEBUG|    iofuzz:0035| outb(0xc016, 0x0)
03/25 12:59:15 DEBUG|   aexpect:1407| Sending command: echo -e '\0' | dd of=/dev/port seek=49174 bs=1 count=1
03/25 12:59:15 DEBUG|   aexpect:1407| Sending command: echo $?
03/25 12:59:15 DEBUG|    iofuzz:0035| outb(0xc017, 0x0)
03/25 12:59:15 DEBUG|   aexpect:1407| Sending command: echo -e '\0' | dd of=/dev/port seek=49175 bs=1 count=1
03/25 12:59:15 INFO |   aexpect:0907| [qemu output] qemu: virtio_ioport_write: unexpected address 0x17 value 0x0
03/25 12:59:15 DEBUG|   aexpect:1407| Sending command: echo $?
03/25 12:59:16 DEBUG|    iofuzz:0035| outb(0xc018, 0x0)

03/25 12:59:45 DEBUG|   aexpect:1407| Sending command: echo -e '\0372' | dd of=/dev/port seek=49202 bs=1 count=1
03/25 12:59:45 INFO |   aexpect:0907| [qemu output] qemu: bad data written to virtio-scsi configuration space

As this bug dup to bz969945, and bz969945 has been 'VERIFIED', maybe they are different bugs.
So could we re-open it?

Thanks,
Cong

Comment 6 CongLi 2014-03-26 09:37:28 UTC
(In reply to CongLi from comment #5)

QEMU CML:

/home/staf-kvm-devel/autotest-devel/client/tests/virt/qemu/qemu \
    -S  \
    -name 'virt-tests-vm1'  \
    -sandbox off  \
    -M pc  \
    -nodefaults  \
    -vga cirrus  \
    -chardev socket,id=qmp_id_qmpmonitor1,path=/tmp/monitor-qmpmonitor1-20140325-125730-6svGNq1r,server,nowait \
    -mon chardev=qmp_id_qmpmonitor1,mode=control  \
    -chardev socket,id=serial_id_serial0,path=/tmp/serial-serial0-20140325-125730-6svGNq1r,server,nowait \
    -device isa-serial,chardev=serial_id_serial0  \
    -chardev socket,id=seabioslog_id_20140325-125730-6svGNq1r,path=/tmp/seabios-20140325-125730-6svGNq1r,server,nowait \
    -device isa-debugcon,chardev=seabioslog_id_20140325-125730-6svGNq1r,iobase=0x402 \
    -device ich9-usb-uhci1,id=usb1,bus=pci.0,addr=03 \
    -device virtio-scsi-pci,id=virtio_scsi_pci0,bus=pci.0,addr=04 \
    -drive id=drive_image1,if=none,cache=none,snapshot=off,aio=native,file=/home/staf-kvm-devel/autotest-devel/client/tests/virt/shared/data/images/RHEL-Server-7.0-64-virtio.raw \
    -device scsi-hd,id=image1,drive=drive_image1 \
    -device virtio-net-pci,mac=9a:27:28:29:2a:2b,id=idT5VEdz,netdev=idQUbjjt,bus=pci.0,addr=05  \
    -netdev tap,id=idQUbjjt,vhost=on  \
    -m 4096  \
    -smp 4,maxcpus=4,cores=2,threads=1,sockets=2  \
    -cpu 'Opteron_G4',+kvm_pv_unhalt \
    -device usb-tablet,id=usb-tablet1,bus=usb1.0,port=1  \
    -vnc :0  \
    -rtc base=utc,clock=host,driftfix=slew  \
    -boot order=cdn,once=c,menu=off  \
    -no-kvm-pit-reinjection \
    -enable-kvm

Comment 7 CongLi 2014-03-26 09:48:04 UTC
Created attachment 878921 [details]
iofuzz-autotest-debug file

Comment 8 Dr. David Alan Gilbert 2014-04-01 15:53:00 UTC
This is separate from the others; from comment #5

hw/scsi/virtio-scsi.c

static void virtio_scsi_set_config(VirtIODevice *vdev,
                                   const uint8_t *config)
{
    VirtIOSCSIConfig *scsiconf = (VirtIOSCSIConfig *)config;
    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(vdev);

    if ((uint32_t) ldl_raw(&scsiconf->sense_size) >= 65536 ||
        (uint32_t) ldl_raw(&scsiconf->cdb_size) >= 256) {
        error_report("bad data written to virtio-scsi configuration space");
        exit(1);
    }

    vs->sense_size = ldl_raw(&scsiconf->sense_size);
    vs->cdb_size = ldl_raw(&scsiconf->cdb_size);
}

Comment 9 Bandan Das 2014-04-04 17:43:27 UTC
(In reply to CongLi from comment #6)
> (In reply to CongLi from comment #5)
> 
Are you able to reproduce this on every run ?

Comment 10 CongLi 2014-04-08 00:37:49 UTC
(In reply to Bandan Das from comment #9)
> (In reply to CongLi from comment #6)
> > (In reply to CongLi from comment #5)
> > 
> Are you able to reproduce this on every run ?

According to the recent tests, I could say yes, can hit this issue on every run.

Thanks,
Cong

Comment 11 Fam Zheng 2014-04-18 06:41:37 UTC

*** This bug has been marked as a duplicate of bug 1067892 ***