Bug 1203914 - qemu's i6300esb watchdog implementation will trigger immediately if timeout is set sufficiently large
Summary: qemu's i6300esb watchdog implementation will trigger immediately if timeout i...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: qemu-kvm-rhev
Version: 7.2
Hardware: All
OS: Unspecified
unspecified
medium
Target Milestone: rc
: 7.2
Assignee: David Gibson
QA Contact: Virtualization Bugs
URL:
Whiteboard:
Depends On:
Blocks: 1247893
TreeView+ depends on / blocked
 
Reported: 2015-03-19 23:59 UTC by David Gibson
Modified: 2015-12-04 16:32 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 1247893 (view as bug list)
Environment:
Last Closed: 2015-12-04 16:32:07 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2015:2546 normal SHIPPED_LIVE qemu-kvm-rhev bug fix and enhancement update 2015-12-04 21:11:56 UTC

Description David Gibson 2015-03-19 23:59:10 UTC
Description of problem:

An integer overflow in qemu's implementation of the i6300esb watchdog timer means that if the guest programs a sufficiently large timeout time (but still within the range the device is supposed to support), the watchdog will trigger immediately, potentially killing the guest.

Version-Release number of selected component (if applicable):

qemu-kvm-rhev-2.2.0-5.el7.ppc64

How reproducible:

100%, with correct configuraiton

Steps to Reproduce:
1. Create a qemu guest including the i6300esb watchdog device.  For example the following qemu command line is suitable:

qemu-system-x86_64 \
    -machine pc \
    -enable-kvm \
    -m 2048 \
    -no-user-config \
    -nodefaults \
    -vga std \
    -chardev stdio,id=charmonitor,mux=on,signal=off \
    -mon chardev=charmonitor,id=monitor \
    -rtc base=utc \
    -boot strict=on \
    -drive file=DISKIMAGE.qcow2,if=none,id=drive0,format=qcow2 \
    -device virtio-blk-pci,drive=drive0,id=blk0,bootindex=1 \
    -netdev user,id=net0 \
    -device virtio-net-pci,netdev=net0 \
    -device i6300esb,id=watchdog0 -watchdog-action pause

2. Install a Linux guest under this qemu
3. Log into the guest, unload the i6300esb driver:
    # rmmod i6300esb
4. Reload the i6300esb driver with an altered heartbeat module parameter:
    # modprobe i6300esb heartbeat=2046
5. Open the watchdog device, for example with:
    # python
    >>> open("/dev/watchdog")

Actual results:

As soon as the watchdog device is opened, the watchdog immediately triggers, pausing the guest (with the example qemu command line above).

Expected results:

Watchdog does not trigger for ~2046 seconds, as specified by the heartbeat parameter.

Additional info:

This bug probably affects qemu-kvm (not RHEV) and RHEL6 as well, though I haven't tested so far.

Comment 1 David Gibson 2015-03-20 03:47:09 UTC
I've posted an upstream fix for this (and bug 1198936).

See http://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04372.html

Comment 2 Shaolong Hu 2015-03-20 08:01:11 UTC
Hi David,

Should we fix this in RHEL6?

Bests,

Comment 5 David Gibson 2015-05-06 02:14:44 UTC
Patch was merged upstream and incorporated downstream in the qemu-2.3.0 rebase.

Comment 6 Xu Han 2015-06-23 08:01:36 UTC
Tested this issue with qemu-kvm-rhev-2.3.0-2 both on x86_64 and ppc64le host.

The watchdog timer did not fire immediately, but not fire on time either.

Details:
# modprobe -r i6300esb; modprobe i6300esb heartbeat=2046
# dmesg | grep -i i6300
...
[   35.981953] i6300esb: initialized (0xffffc900003ba000). heartbeat=2046 sec (nowayout=0)

# cat wd.py
import time

wd = open('/dev/watchdog', 'rw')
wd.close()

for i in range(1, 2049):
    time.sleep(1)
    print i

# python wd.py
1
2
...
257
258   <- watchdog fired (VM paused)

Comment 8 Shaolong Hu 2015-07-23 09:20:19 UTC
Hi David,

Do you think comment 6 is a problem?

Comment 9 David Gibson 2015-07-24 01:04:09 UTC
Comment 6 looks like a real bug, but a different and less serious one from this one.

I think we can still verify this, and file comment 6 as a new bug.

Comment 10 Shaolong Hu 2015-07-29 08:00:06 UTC
As comment 9, set verified and file new one:

Bug 1247893 - qemu's i6300esb watchdog does not fire on time with large heartbeat like 2046

Comment 12 errata-xmlrpc 2015-12-04 16:32:07 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-2546.html


Note You need to log in before you can comment on or make changes to this bug.