Bug 923653

Created attachment 713163 [details]
debug info

Guest=RHEL.6.4.64

Cmd:
/home/autotest/autotest-devel/client/tests/kvm/qemu 
    -S 
    -name 'vm1' 
    -nodefaults 
    -chardev socket,id=qmp_id_qmpmonitor1,path=/tmp/monitor-qmpmonitor1-20130319-232118-nwJe57cS,server,nowait 
    -mon chardev=qmp_id_qmpmonitor1,mode=control 
    -chardev socket,id=serial_id_serial1,path=/tmp/serial-serial1-20130319-232118-nwJe57cS,server,nowait 
    -device isa-serial,chardev=serial_id_serial1 
    -chardev socket,id=seabioslog_id_20130319-232118-nwJe57cS,path=/tmp/seabios-20130319-232118-nwJe57cS,server,nowa

    -device isa-debugcon,chardev=seabioslog_id_20130319-232118-nwJe57cS,iobase=0x402 
    -device ich9-usb-uhci1,id=usb1,bus=pci.0,addr=0x4 
    -drive file='/home/autotest/autotest-devel/client/tests/kvm/images/RHEL-Server-6.4-64-virtio.qcow2',if=none,id=drive-virtio-disk1,media=disk,cache=unsafe,boot=off,snapshot=off,format=qcow2,aio=native
afe,boot=off,snapshot=off,format=qcow2,aio=native 
    -device virtio-blk-pci,bus=pci.0,addr=0x5,drive=drive-virtio-disk1,id=virtio-disk1 
    -device virtio-net-pci,netdev=idr3YiKW,mac=9a:ff:00:01:02:03,bus=pci.0,addr=0x3,id='id4WXlml' 
    -netdev tap,id=idr3YiKW,vhost=on,fd=23 
    -m 4096 
    -smp 4,maxcpus=4,cores=2,threads=1,sockets=2 
    -cpu 'SandyBridge' 
    -M pc 
    -device usb-tablet,id=usb-tablet1,bus=usb1.0,port=1 
    -vnc :0 
    -vga cirrus 
    -rtc base=utc,clock=host,driftfix=slew  
    -boot order=cdn,once=c,menu=off   
    -no-kvm-pit-reinjection 
    -enable-kvm

Created attachment 716292 [details]
host cpu info

reproduced this bug on kernel-3.9.0-0.rc6.51.el7.x86_64(host), qemu-kvm-1.4.0-2.el7.x86_64;

steps below:

/usr/libexec/qemu-kvm -name RHEL6.4 \
 -M pc \
-enable-kvm \
-m 4096 -smp 4,sockets=4,cores=1,threads=1 \
-uuid 34f07c2c-0290-2c5a-de2c-711eb2a3266f  \
-nodefaults \
-rtc base=utc \
-boot order=dc,menu=on \
-drive file=/home/kvm_autotest_root/images/RHEL-Server-7.0-64-virtio.qcow2,if=none,id=virtio-disk0,format=qcow2,serial=0x101213,cache=unsafe,aio=native,werror=stop,rerror=stop \
 -device ide-hd,drive=virtio-disk0 \
-vga qxl \
-global qxl-vga.ram_size=67108864 \
-global qxl-vga.vram_size=67108864 \
-monitor stdio \
-spice port=5909,addr=10.66.5.96,disable-ticketing  \
-chardev socket,id=qmp_id_qmpmonitor1,path=/tmp/monitor-qmpmonitor1-20130428-132443-r0PcFHRY,server,nowait \
-mon chardev=qmp_id_qmpmonitor1,mode=control \
-chardev socket,id=serial_id_serial1,path=/tmp/serial-serial1-20130428-132443-r0PcFHRY,server,nowait \
-device isa-serial,chardev=serial_id_serial1 \
-chardev socket,id=seabioslog_id_20130428-132443-r0PcFHRY,path=/tmp/seabios-20130428-132443-r0PcFHRY,server,nowait \
-device isa-debugcon,chardev=seabioslog_id_20130428-132443-r0PcFHRY,iobase=0x402 

2. run below script on host:
#/bin/bash
set -x
header='{"execute": "qmp_capabilities"}\n'
echo -e $header'{"execute": "system_reset"}' > /tmp/system_reset
while  :;do 
`sleep $((RANDOM % 4 + 13))`
nc -U /tmp/monitor-qmpmonitor1-20130428-132443-r0PcFHRY < /tmp/system_reset
done

3.wait qemu report error

result: KVM internal error. Suberror: 1 emulation failure

detials please see attachment qemu-error.log

Created attachment 741075 [details]
qemu-error.log

Created attachment 741077 [details]
qemu-error.log

I've been trying to reproduce this on a i5-4670T with both host and guest running kernel-3.9.0-0.55.el7.x86_64, and with qemu-kvm-1.4.0-3.el7.x86_64. The guest has been resetting over and over most the day, but still no luck.

Unlike suberror 1, suberror 3 gives a bit more information

 KVM internal error. Suberror: 3
 extra data[0]: 80000b0e
 extra data[1]: 31

extra data[0] tells that the the event vm-exit occured because of a page fault.
extra data[1] contains EPT misconfiguration exit reason.

EPT misconfiguration is used for MMIO, and we even have an explanation why the internal error occured
  /*
   * Note:
   * Do not try to fix EXIT_REASON_EPT_MISCONFIG if it caused by
   * delivery event since it indicates guest is accessing MMIO.
   * The vm-exit can be triggered again after return to guest that
   * will cause infinite loop.
   */
We might be "accessing MMIO" by accident as we had suberror 1 too ...

RIP+CS is suspicious and you don't see zeroed registers in this context, so a race comes into mind.  Reproducer would help to get an idea.

Please preserve the reproducer and reopen this bz if you happen to hit it again.