Bug 1340439
| Summary: | qemu-kvm crashed when set vram64_size_mb to some vaule | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | yafu <yafu> |
| Component: | qemu-kvm-rhev | Assignee: | Gerd Hoffmann <kraxel> |
| Status: | CLOSED ERRATA | QA Contact: | Guo, Zhiyi <zhguo> |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | 7.3 | CC: | chayang, dyuan, fjin, huding, jinzhao, juzhang, knoel, mrezanin, mzhan, virt-maint, zpeng |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | QEMU 2.7 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2017-08-01 23:32:13 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
It's broken for vram64_size_mb values larger than 2048 (aka 2G). Setting to low priority, I doubt this is used in practice. Fix is upstream: de1b9b85eff3dca42fe2cabe6e026cd2a2d5c769 Reproduce this issue with qemu-kvm-rhev-2.6.0-27.el7.x86_64.
qemu-cli used:
/usr/libexec/qemu-kvm -device qxl-vga,id=video0,ram_size=67108864,vram_size=67108864,vram64_size_mb=2765,vgamem_mb=16
result:
qemu crash and gdb back trace is:
(gdb) bt
#0 0x00007fa57de521d7 in raise () at /lib64/libc.so.6
#1 0x00007fa57de538c8 in abort () at /lib64/libc.so.6
#2 0x00007fa57de4b146 in __assert_fail_base () at /lib64/libc.so.6
#3 0x00007fa57de4b1f2 in () at /lib64/libc.so.6
#4 0x00007fa5886f9084 in ram_block_add (size=0)
at /usr/src/debug/qemu-2.6.0/exec.c:1343
#5 0x00007fa5886f9084 in ram_block_add (new_block=new_block@entry=0x7fa58bd971e0, errp=errp@entry=0x7fffbda776e0) at /usr/src/debug/qemu-2.6.0/exec.c:1577
#6 0x00007fa5886f9166 in qemu_ram_alloc_internal (size=size@entry=0, max_size=max_size@entry=0, resized=resized@entry=
0x0, host=host@entry=0x0, resizeable=resizeable@entry=false, mr=mr@entry=0x7fa58c1d3d10, errp=errp@entry=0x7fa5893bfd30 <error_fatal>)
at /usr/src/debug/qemu-2.6.0/exec.c:1720
#7 0x00007fa5886f9d1a in qemu_ram_alloc (size=size@entry=0, mr=mr@entry=0x7fa58c1d3d10, errp=errp@entry=0x7fa5893bfd30 <error_fatal>) at /usr/src/debug/qemu-2.6.0/exec.c:1737
#8 0x00007fa5887385b6 in memory_region_init_ram (mr=mr@entry=0x7fa58c1d3d10, owner=owner@entry=0x7fa58c1c2000, name=name@entry=0x7fa588a19f9e "qxl.vram", size=0, errp=0x7fa5893bfd30 <error_fatal>) at /usr/src/debug/qemu-2.6.0/memory.c:1315
#9 0x00007fa588866b5c in qxl_realize_common (qxl=qxl@entry=0x7fa58c1c2000, errp=errp@entry=0x7fffbda777c0) at hw/display/qxl.c:2011
#10 0x00007fa58886713e in qxl_realize_primary (dev=0x7fa58c1c2000, errp=0x7fffbda77850)
at hw/display/qxl.c:2095
#11 0x00007fa588895b8c in pci_qdev_realize (qdev=0x7fa58c1c2000, errp=0x7fffbda778e0)
at hw/pci/pci.c:1966
#12 0x00007fa588844766 in device_set_realized (obj=<optimized out>, value=<optimized out>, errp=0x7fffbda77a18) at hw/core/qdev.c:1076
#13 0x00007fa58891907e in property_set_bool (obj=0x7fa58c1c2000, v=<optimized out>, name=<optimized out>, opaque=0x7fa58b94d730, errp=0x7fffbda77a18) at qom/object.c:1861
#14 0x00007fa58891cd47 in object_property_set_qobject (obj=0x7fa58c1c2000, value=<optimized out>, name=0x7fa588a1666d "realized", errp=0x7fffbda77a18) at qom/qom-qobject.c:26
#15 0x00007fa58891abc0 in object_property_set_bool (obj=0x7fa58c1c2000, value=<optimized out>, name=0x7fa588a1666d "realized", errp=0x7fffbda77a18) at qom/object.c:1158
#16 0x00007fa5887f2f9c in qdev_device_add (opts=0x7fa589fdcb90, errp=errp@entry=0x7fffbda77af0) at qdev-monitor.c:617
#17 0x00007fa5887fcfd7 in device_init_func (opaque=<optimized out>, opts=<optimized out>,---Type <return> to continue, or q <return> to quit---
errp=<optimized out>) at vl.c:2365
#18 0x00007fa5889c50da in qemu_opts_foreach (list=<optimized out>, func=func@entry=
0x7fa5887fcfb0 <device_init_func>, opaque=opaque@entry=0x0, errp=errp@entry=0x0)
at util/qemu-option.c:1116
#19 0x00007fa5886f0ba5 in main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at vl.c:4578
Verified with qemu-kvm-rhev-2.8.0-5.el7.x86_64
No crash occur after using same qemu cli
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2017:2392 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2017:2392 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2017:2392 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2017:2392 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2017:2392 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2017:2392 |
Description of problem: qemu-kvm crashed when set vram64_size_mb to some values, such as the value in 2765-3765, but some value work fine, such as 1765,4765 . Version-Release number of selected component (if applicable): qemu-kvm-rhev-2.6.0-4.el7.x86_64 How reproducible: 100% steps to reproduce: 1.Start a guest with qxl video device and the value of vram64_size_mb to 2765: #/usr/libexec/qemu-kvm -name rhel7.1,debug-threads=on -machine pc-i440fx-rhel7.2.0,accel=kvm,usb=off -cpu Broadwell -m 1024 -realtime mlock=off -smp 1,sockets=1,cores=1,threads=1 \ -drive file=/var/lib/libvirt/images/rhel71.qcow2,format=qcow2,if=none,id=drive-virtio-disk0 -device virtio-blk-pci,scsi=off,bus=pci.0,addr=0x7,drive=drive-virtio-disk0,id=virtio-disk0,bootindex=1 \ -device qxl-vga,id=video0,ram_size=67108864,vram_size=67108864,vram64_size_mb=2765,vgamem_mb=16,bus=pci.0,addr=0xa char device redirected to /dev/pts/2 (label charserial0) qemu-kvm: /builddir/build/BUILD/qemu-2.6.0/exec.c:1351: find_ram_offset: Assertion `size != 0' failed. Aborted (core dumped) Actual results: qemu-kvm crashed Expected results: qemu-kvm should not crash Additional info: Core dump of the crashed qemu-kvm: (gdb) t a a bt Thread 4 (Thread 0x7fffe6d25700 (LWP 18287)): #0 0x00007ffff17bf6d5 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0 #1 0x0000555555989699 in qemu_cond_wait (cond=<optimized out>, mutex=mutex@entry=0x555555ef9940 <qemu_global_mutex>) at util/qemu-thread-posix.c:123 #2 0x00005555556f0f13 in qemu_kvm_wait_io_event (cpu=<optimized out>) at /usr/src/debug/qemu-2.6.0/cpus.c:1030 #3 qemu_kvm_cpu_thread_fn (arg=0x555557762000) at /usr/src/debug/qemu-2.6.0/cpus.c:1069 #4 0x00007ffff17bbdc5 in start_thread () from /lib64/libpthread.so.0 #5 0x00007fffefef91cd in clone () from /lib64/libc.so.6 Thread 3 (Thread 0x7fffe7526700 (LWP 18285)): #0 0x00007ffff17c1870 in sem_timedwait () from /lib64/libpthread.so.0 #1 0x00005555559897e7 in qemu_sem_timedwait (sem=sem@entry=0x555556bca888, ms=ms@entry=10000) at util/qemu-thread-posix.c:245 #2 0x00005555558f05fc in worker_thread (opaque=0x555556bca820) at thread-pool.c:92 #3 0x00007ffff17bbdc5 in start_thread () from /lib64/libpthread.so.0 #4 0x00007fffefef91cd in clone () from /lib64/libc.so.6 Thread 2 (Thread 0x7fffe7d27700 (LWP 18283)): #0 0x00007ffff17c296d in nanosleep () from /lib64/libpthread.so.0 #1 0x00007ffff0c5da98 in g_usleep () from /lib64/libglib-2.0.so.0 #2 0x0000555555997e4c in call_rcu_thread (opaque=<optimized out>) at util/rcu.c:245 #3 0x00007ffff17bbdc5 in start_thread () from /lib64/libpthread.so.0 #4 0x00007fffefef91cd in clone () from /lib64/libc.so.6 Thread 1 (Thread 0x7ffff7f8dc40 (LWP 18279)): #0 0x00007fffefe385f7 in raise () from /lib64/libc.so.6 #1 0x00007fffefe39ce8 in abort () from /lib64/libc.so.6 #2 0x00007fffefe31566 in __assert_fail_base () from /lib64/libc.so.6 #3 0x00007fffefe31612 in __assert_fail () from /lib64/libc.so.6 #4 0x00005555556c7e44 in find_ram_offset (size=0) at /usr/src/debug/qemu-2.6.0/exec.c:1351 #5 ram_block_add (new_block=new_block@entry=0x5555591d3600, errp=errp@entry=0x7fffffffd790) at /usr/src/debug/qemu-2.6.0/exec.c:1585 #6 0x00005555556c7f26 in qemu_ram_alloc_internal (size=size@entry=0, max_size=max_size@entry=0, resized=resized@entry=0x0, host=host@entry=0x0, resizeable=resizeable@entry=false, mr=mr@entry=0x55555919fbc0, errp=errp@entry=0x555556316b30 <error_fatal>) at /usr/src/debug/qemu-2.6.0/exec.c:1728 #7 0x00005555556c8aaa in qemu_ram_alloc (size=size@entry=0, mr=mr@entry=0x55555919fbc0, errp=errp@entry=0x555556316b30 <error_fatal>) at /usr/src/debug/qemu-2.6.0/exec.c:1745 #8 0x0000555555706f46 in memory_region_init_ram (mr=mr@entry=0x55555919fbc0, owner=owner@entry=0x55555918e000, name=name@entry=0x5555559e9676 "qxl.vram", size=0, errp=0x555556316b30 <error_fatal>) ---Type <return> to continue, or q <return> to quit--- at /usr/src/debug/qemu-2.6.0/memory.c:1315 #9 0x000055555583098c in qxl_realize_common (qxl=qxl@entry=0x55555918e000, errp=errp@entry=0x7fffffffd870) at hw/display/qxl.c:1981 #10 0x0000555555830f6e in qxl_realize_primary (dev=0x55555918e000, errp=0x7fffffffd8f0) at hw/display/qxl.c:2065 #11 0x0000555555864238 in pci_qdev_realize (qdev=0x55555918e000, errp=0x7fffffffd970) at hw/pci/pci.c:1865 #12 0x000055555580e7f0 in device_set_realized (obj=0x55555918e000, value=<optimized out>, errp=0x7fffffffdaa8) at hw/core/qdev.c:1066 #13 0x00005555558eb9fe in property_set_bool (obj=0x55555918e000, v=<optimized out>, name=<optimized out>, opaque=0x555557b5c4d0, errp=0x7fffffffdaa8) at qom/object.c:1853 #14 0x00005555558ef657 in object_property_set_qobject (obj=0x55555918e000, value=<optimized out>, name=0x5555559e5d6d "realized", errp=0x7fffffffdaa8) at qom/qom-qobject.c:26 #15 0x00005555558ed4d0 in object_property_set_bool (obj=0x55555918e000, value=<optimized out>, name=0x5555559e5d6d "realized", errp=0x7fffffffdaa8) at qom/object.c:1150 #16 0x00005555557bfbdc in qdev_device_add (opts=0x555556b34230, errp=errp@entry=0x7fffffffdb80) at qdev-monitor.c:618 #17 0x00005555557c9907 in device_init_func (opaque=<optimized out>, opts=<optimized out>, errp=<optimized out>) at vl.c:2362 #18 0x0000555555995c5a in qemu_opts_foreach (list=<optimized out>, func=func@entry=0x5555557c98e0 <device_init_func>, opaque=opaque@entry=0x0, errp=errp@entry=0x0) at util/qemu-option.c:1116 #19 0x00005555556bf900 in main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at vl.c:4552