Hide Forgot
Description of problem: Hotplug memory to a negative slot, qemu core dumped. Version-Release number of selected component (if applicable): qemu-kvm-4.0.0-5.module+el8.1.0+3622+5812d9bf kernel-4.18.0-112.el8.x86_64 How reproducible: always Steps to Reproduce: 1. Start qemu process # /usr/libexec/qemu-kvm -m 1G,maxmem=20G,slots=256 -monitor stdio 2. Hotplug memory to slot '-2' (qemu) object_add memory-backend-ram,id=mem1,size=1G (qemu) device_add pc-dimm,id=dimm1,memdev=mem1,slot=-2 Actual results: (qemu) object_add memory-backend-ram,id=mem1,size=1G (qemu) device_add pc-dimm,id=dimm1,memdev=mem1,slot=-2 Bus error (core dumped) Expected results: QEMU should print some error message instead of core dump. Additional info: Backtrace: (gdb) bt #0 0x000055608482ad17 in test_bit (addr=<optimized out>, nr=<optimized out>) at /usr/src/debug/qemu-kvm-4.0.0-5.module+el8.1.0+3622+5812d9bf.x86_64/include/qemu/bitops.h:134 #1 0x000055608482ad17 in pc_dimm_get_free_slot (errp=0x7ffd86fde7f0, max_slots=256, hint=<optimized out>) at hw/mem/pc-dimm.c:110 #2 0x000055608482ad17 in pc_dimm_pre_plug (dimm=0x556086f63160, machine=machine@entry=0x556086b70c00, legacy_align=legacy_align@entry=0x0, errp=errp@entry=0x7ffd86fde8c0) at hw/mem/pc-dimm.c:40 #3 0x0000556084720c30 in pc_memory_pre_plug (errp=0x7ffd86fde8c0, dev=0x556086f63160, hotplug_dev=<optimized out>) at /usr/src/debug/qemu-kvm-4.0.0-5.module+el8.1.0+3622+5812d9bf.x86_64/hw/i386/pc.c:2748 #4 0x0000556084720c30 in pc_machine_device_pre_plug_cb (hotplug_dev=<optimized out>, dev=0x556086f63160, errp=0x7ffd86fde8c0) at /usr/src/debug/qemu-kvm-4.0.0-5.module+el8.1.0+3622+5812d9bf.x86_64/hw/i386/pc.c:3045 #5 0x00005560847e4cf6 in device_set_realized (obj=<optimized out>, value=<optimized out>, errp=0x7ffd86fde9e8) at hw/core/qdev.c:827 #6 0x00005560848e3a5b in property_set_bool (obj=0x556086f63160, v=<optimized out>, name=<optimized out>, opaque=0x556087063020, errp=0x7ffd86fde9e8) at qom/object.c:2074 #7 0x00005560848e7f53 in object_property_set_qobject (obj=0x556086f63160, value=<optimized out>, name=0x556084a95e9d "realized", errp=0x7ffd86fde9e8) at qom/qom-qobject.c:27 #8 0x00005560848e57c9 in object_property_set_bool (obj=0x556086f63160, value=<optimized out>, name=0x556084a95e9d "realized", errp=0x7ffd86fde9e8) at qom/object.c:1332 #9 0x00005560847a2e74 in qdev_device_add (opts=opts@entry=0x556086c799b0, errp=errp@entry=0x7ffd86fdeac0) at qdev-monitor.c:642 #10 0x00005560847a335b in qmp_device_add (qdict=<optimized out>, ret_data=ret_data@entry=0x0, errp=errp@entry=0x7ffd86fdeaf0) at qdev-monitor.c:822 #11 0x00005560847ae77d in hmp_device_add (mon=<optimized out>, qdict=<optimized out>) at hmp.c:2169 #12 0x00005560846abdb9 in handle_hmp_command (mon=mon@entry=0x556086b70400, cmdline=<optimized out>, cmdline@entry=0x556086be8c00 " device_add pc-dimm,id=dimm1,memdev=mem1,slot=-2") at /usr/src/debug/qemu-kvm-4.0.0-5.module+el8.1.0+3622+5812d9bf.x86_64/monitor.c:3458 --Type <RET> for more, q to quit, c to continue without paging-- c #13 0x00005560846ad330 in monitor_command_cb (opaque=0x556086b70400, cmdline=0x556086be8c00 " device_add pc-dimm,id=dimm1,memdev=mem1,slot=-2", readline_opaque=<optimized out>) at /usr/src/debug/qemu-kvm-4.0.0-5.module+el8.1.0+3622+5812d9bf.x86_64/monitor.c:4319 #14 0x00005560849c5ee5 in readline_handle_byte (rs=0x556086be8c00, ch=<optimized out>) at util/readline.c:393 #15 0x00005560846abeb9 in monitor_read (opaque=<optimized out>, buf=<optimized out>, size=<optimized out>) at /usr/src/debug/qemu-kvm-4.0.0-5.module+el8.1.0+3622+5812d9bf.x86_64/monitor.c:4302 #16 0x000055608494cccd in fd_chr_read (chan=0x556086bc3da0, cond=<optimized out>, opaque=<optimized out>) at chardev/char-fd.c:66 #17 0x00007f5497aab67d in g_main_context_dispatch () at /lib64/libglib-2.0.so.0 #18 0x00005560849b1ec8 in glib_pollfds_poll () at util/main-loop.c:213 #19 0x00005560849b1ec8 in os_host_main_loop_wait (timeout=<optimized out>) at util/main-loop.c:236 #20 0x00005560849b1ec8 in main_loop_wait (nonblocking=<optimized out>) at util/main-loop.c:512 #21 0x00005560847a6839 in main_loop () at vl.c:1988 #22 0x000055608465b328 in main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at vl.c:4642
Strangely, QEMU would take 'slot=-1' as slot 0. # /usr/libexec/qemu-kvm -m 1G,maxmem=20G,slots=256 -monitor stdio -numa node (qemu) object_add memory-backend-ram,id=mem1,size=1G (qemu) device_add pc-dimm,id=dimm1,memdev=mem1,slot=-1 (qemu) info memory-devices Memory device [dimm]: "dimm1" addr: 0x100000000 slot: 0 node: 0 size: 1073741824 memdev: /objects/mem1 hotplugged: true hotpluggable: true
QEMU has been recently split into sub-components and as a one-time operation to avoid breakage of tools, we are setting the QEMU sub-component of this BZ to "General". Please review and change the sub-component if necessary the next time you review this BZ. Thanks