Bug 1057425

Tested another two scenarios. For this two scenarios. Guest works well. and can see pci memory size inside guest via "lspci -vvv".

S1
Boot guest with below
-device qxl,id=video1,bus=pci.0,vram_size=536870912,addr=0x7 
-device qxl,id=video2,bus=pci.0,vram_size=536870912,addr=0x8 
-device qxl,id=video3,bus=pci.0,vram_size=536870912,addr=0x9  
-device qxl,id=video4,bus=pci.0,addr=0xa 
-device qxl,id=video5,bus=pci.0,addr=0xb

S2
Boot guest with below
-device qxl,id=video1,bus=pci.0,vram_size=268435456,addr=0x7 
-device qxl,id=video2,bus=pci.0,vram_size=268435456,addr=0x8 
-device qxl,id=video3,bus=pci.0,vram_size=268435456,addr=0x9 
-device qxl,id=video4,bus=pci.0,vram_size=268435456,addr=0xa  
-device qxl,id=video5,vram_size=268435456,bus=pci.0,addr=0xb 
-device qxl,id=video6,bus=pci.0,vram_size=268435456,addr=0xc 
-device qxl,id=video7,bus=pci.0,vram_size=268435456,addr=0xd 
-device qxl,id=video8,bus=pci.0,vram_size=268435456,addr=0xe 
-device qxl,id=video9,bus=pci.0,vram_size=268435456,addr=0xf

Probably a missing sanity check for MAX_CONSOLES somewhere, followed by overflowing the consoles[] array.  The max number of qxl devices supported is 4, thus this isn't critical enougth for 7.0, deferring.

http://patchwork.ozlabs.org/patch/352454/

Reproduce this bug as follow version:

Host:
# uname -r 
3.10.0-145.el7.x86_64
#rpm -q qemu-kvm-rhev
qemu-kvm-rhev-1.5.3-60.el7_0_0.6.x86_64


Steps:
1)Boot guest with  >9 qxl device
....
-spice port=5930,disable-ticketing -vga qxl -device qxl,id=video1,bus=pci.0,addr=0x7 -device qxl,id=video2,bus=pci.0,addr=0x8 -device qxl,id=video3,bus=pci.0,addr=0x9 -device qxl,id=video4,bus=pci.0,addr=0xa  -monitor stdio -device qxl,id=video5,bus=pci.0,addr=0xb -device qxl,id=video6,bus=pci.0,addr=0xc -device qxl,id=video7,bus=pci.0,addr=0xd -device qxl,id=video8,bus=pci.0,addr=0xe -device qxl,id=video9,bus=pci.0,addr=0xf -device qxl,id=video10,bus=pci.0,addr=0x10  -device qxl,id=video11,bus=pci.0,addr=0x11  -device qxl,id=video12,bus=pci.0,addr=0x12  -device qxl,id=video13,bus=pci.0,addr=0x13  -device qxl,id=video14,bus=pci.0,addr=0x14  


Results:

qemu coredump

QEMU 1.5.3 monitor - type 'help' for more information
(qemu) 
Program received signal SIGSEGV, Segmentation fault.
graphic_console_init (dev=0x555556781020, 
    hw_ops=hw_ops@entry=0x555555bfdc60 <qxl_ops>, 
    opaque=opaque@entry=0x555556781020) at ui/console.c:1635
1635	    s->hw_ops = hw_ops;
Missing separate debuginfos, use: debuginfo-install glibc-2.17-55.el7.x86_64
(gdb) bt
#0  graphic_console_init (dev=0x555556781020, 
    hw_ops=hw_ops@entry=0x555555bfdc60 <qxl_ops>, 
    opaque=opaque@entry=0x555556781020) at ui/console.c:1635
#1  0x000055555576ed9d in qxl_init_secondary (dev=0x555556781020)
    at /usr/src/debug/qemu-1.5.3/hw/display/qxl.c:2079
#2  0x00005555556ae212 in pci_qdev_init (qdev=0x555556781020)
    at hw/pci/pci.c:1720
#3  0x0000555555676c44 in device_realize (dev=0x555556781020, 
    err=0x7fffffffd9f0) at hw/core/qdev.c:178
#4  0x0000555555677bab in device_set_realized (obj=0x555556781020, 
    value=<optimized out>, err=0x7fffffffdb18) at hw/core/qdev.c:693
#5  0x000055555571cd6e in property_set_bool (obj=0x555556781020, 
    v=<optimized out>, opaque=0x5555567d9170, name=<optimized out>, 
    errp=0x7fffffffdb18) at qom/object.c:1302
#6  0x000055555571ee47 in object_property_set_qobject (
    obj=0x555556781020, value=<optimized out>, 
    name=0x5555558731fa "realized", errp=0x7fffffffdb18)
    at qom/qom-qobject.c:24
#7  0x000055555571e030 in object_property_set_bool (
    obj=obj@entry=0x555556781020, value=value@entry=true, 
    name=name@entry=0x5555558731fa "realized", 
    errp=errp@entry=0x7fffffffdb18) at qom/object.c:853
#8  0x000055555570be7f in qdev_device_add (opts=0x5555564e7420)
---Type <return> to continue, or q <return> to quit---
    at qdev-monitor.c:556
#9  0x00005555557493d9 in device_init_func (opts=<optimized out>, 
    opaque=<optimized out>) at vl.c:2290
#10 0x000055555585ea2b in qemu_opts_foreach (list=<optimized out>, 
    func=func@entry=0x5555557493d0 <device_init_func>, 
    opaque=opaque@entry=0x0, abort_on_failure=abort_on_failure@entry=1)
    at util/qemu-option.c:1198
#11 0x0000555555602df1 in main (argc=<optimized out>, 
    argv=<optimized out>, envp=<optimized out>) at vl.c:4257

Verify this bug as follow version:
Host:

# uname -r
3.10.0-144.el7.x86_64
# rpm -q qemu-kvm-rhev
qemu-kvm-rhev-2.1.0-2.el7.x86_64

Steps as same as reproduce

Results:
Guest work well,not hit qemu coredump

According to above test ,this bug has been fixed

Hi Gerd
   as above test this bug has been fixed on latest qemu-kvm-rhev version. Qemu core dump is a serious problem.Do you plan to modify it on qemu-kvm component ?

best regards
fang lang

(In reply to langfang from comment #9)
> Hi Gerd
>    as above test this bug has been fixed on latest qemu-kvm-rhev version.
> Qemu core dump is a serious problem.Do you plan to modify it on qemu-kvm
> component ?

No plans, not critical.

Segfaults which the guest can trigger are a serious problem indeed.  But that isn't the case here.  The segfault happens on startup, on a unsupported configuration.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2015-0624.html