Bug 988256 - Segmentation fault when guest reboot after hotulnplug netkvm
Segmentation fault when guest reboot after hotulnplug netkvm
Status: CLOSED DUPLICATE of bug 920021
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: qemu-kvm (Show other bugs)
7.0
Unspecified Unspecified
high Severity high
: rc
: ---
Assigned To: Marcel Apfelbaum
Virtualization Bugs
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2013-07-25 04:10 EDT by lijin
Modified: 2013-11-06 08:06 EST (History)
13 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-11-06 08:06:50 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description lijin 2013-07-25 04:10:26 EDT
Description of problem:
when guest do reboot after hotulnplug netkvm,Segmentation fault occurs

Version-Release number of selected component (if applicable):
kernel-3.10.0-0.rc7.64.el7.x86_64
qemu-kvm-1.5.1-2.el7.x86_64
virtio-win-prewhql-65
seabios-1.7.2.2-2.el7.x86_64
spice-server-0.12.3-1.el7.x86_64
vgabios-0.6c-9.el7.noarch

How reproducible:
100%

Steps to Reproduce:
1.boot a win2k8-R2 guest with netkvm:
/usr/libexec/qemu-kvm  \
-drive file=win2k8R2.qcow3,if=none,cache=none,media=disk,format=qcow2,id=drive-scsi-0 \
-device ide-drive,drive=drive-scsi-0,id=blk0,bootindex=0 \
-global PIIX4_PM.disable_s3=0 -global PIIX4_PM.disable_s4=0 \
-usb -device usb-tablet \
-monitor stdio \
-chardev socket,id=aaaa,path=/tmp/tttt,server,nowait \
-mon chardev=aaaa,mode=readline \
-spice port=5900,disable-ticketing -vga qxl \
-chardev file,path=/root/console.log,id=serial1 \
-device isa-serial,chardev=serial1,id=s1 \
-cpu 'Penryn' -M pc \
-smp 4,cores=2,threads=1,sockets=2 -m 6G \
-enable-kvm \
-netdev tap,sndbuf=0,id=hostnet1,vhost=on,script=/etc/qemu-ifup,downscript=no -device virtio-net-pci,netdev=hostnet1,id=net1,mac=00:52:12:16:54:46,bus=pci.0,addr=0x7 \

2.hotunplug netkvm
(qemu) device_del net1 
(qemu) netdev_del hostnet1

3.reboot guest

Actual results:
Segmentation fault occurs

Expected results:
guest works well

Additional info:
in rhel6 host,not hit this issue
Comment 1 lijin 2013-07-25 04:11:19 EDT
(gdb) bt
#0  0x00007f3fa72f7290 in __memcmp_sse4_1 () from /lib64/libc.so.6
#1  0x00007f3fabaacbc9 in patch_hypercalls (s=0x7f3fae26b490, s=0x7f3fae26b490)
    at /usr/src/debug/qemu-1.5.1/hw/i386/kvmvapic.c:549
#2  vapic_prepare (s=s@entry=0x7f3fae26b490) at /usr/src/debug/qemu-1.5.1/hw/i386/kvmvapic.c:614
#3  0x00007f3fabaacd0e in vapic_write (opaque=0x7f3fae26b490, addr=<optimized out>, data=<optimized out>, size=<optimized out>)
    at /usr/src/debug/qemu-1.5.1/hw/i386/kvmvapic.c:651

#4  0x00007f3fabacfc62 in access_with_adjusted_size (addr=addr@entry=0, value=value@entry=0x7f3f9ed9cb58, size=2,
    access_size_min=<optimized out>, access_size_max=<optimized out>, access=access@entry=
    0x7f3fabad0220 <memory_region_write_accessor>, opaque=opaque@entry=0x7f3fae26d7b8) at /usr/src/debug/qemu-1.5.1/memory.c:364
#5  0x00007f3fabad1137 in memory_region_iorange_write (iorange=<optimized out>, offset=0, width=2, data=32)
    at /usr/src/debug/qemu-1.5.1/memory.c:439
#6  0x00007f3fabace9dd in kvm_handle_io (count=1, size=2, direction=1, data=<optimized out>, port=126)
    at /usr/src/debug/qemu-1.5.1/kvm-all.c:1485
#7  kvm_cpu_exec (env=env@entry=0x7f3fae24d230) at /usr/src/debug/qemu-1.5.1/kvm-all.c:1634
#8  0x00007f3faba79dd5 in qemu_kvm_cpu_thread_fn (arg=0x7f3fae24d230) at /usr/src/debug/qemu-1.5.1/cpus.c:759
#9  0x00007f3fa9b02c53 in start_thread () from /lib64/libpthread.so.0
#10 0x00007f3fa728f0dd in clone () from /lib64/libc.so.6
Comment 2 guo jiang 2013-07-25 04:23:49 EDT
win2012 hit the same issue on rhel 7 host
package version:
 kernel-3.10.0-2.el7.x86_64
 others:the same as comment #0
(gdb) bt
#0  __memcmp_sse4_1 () at ../sysdeps/x86_64/multiarch/memcmp-sse4.S:1015
#1  0x00007f391a94fbc9 in patch_hypercalls (s=0x7f391ccdb420, s=0x7f391ccdb420)
    at /usr/src/debug/qemu-1.5.1/hw/i386/kvmvapic.c:549
#2  vapic_prepare (s=s@entry=0x7f391ccdb420) at /usr/src/debug/qemu-1.5.1/hw/i386/kvmvapic.c:614
#3  0x00007f391a94fd0e in vapic_write (opaque=0x7f391ccdb420, addr=<optimized out>, data=<optimized out>, 
    size=<optimized out>) at /usr/src/debug/qemu-1.5.1/hw/i386/kvmvapic.c:651
#4  0x00007f391a972c62 in access_with_adjusted_size (addr=addr@entry=0, value=value@entry=0x7f390eb2fb58, size=2, 
    access_size_min=<optimized out>, access_size_max=<optimized out>, 
    access=access@entry=0x7f391a973220 <memory_region_write_accessor>, opaque=opaque@entry=0x7f391ccdd748)
    at /usr/src/debug/qemu-1.5.1/memory.c:364
#5  0x00007f391a974137 in memory_region_iorange_write (iorange=<optimized out>, offset=0, width=2, data=32)
    at /usr/src/debug/qemu-1.5.1/memory.c:439
#6  0x00007f391a9719dd in kvm_handle_io (count=1, size=2, direction=1, data=<optimized out>, port=126)
    at /usr/src/debug/qemu-1.5.1/kvm-all.c:1485
#7  kvm_cpu_exec (env=env@entry=0x7f391ccbd040) at /usr/src/debug/qemu-1.5.1/kvm-all.c:1634
#8  0x00007f391a91cdd5 in qemu_kvm_cpu_thread_fn (arg=0x7f391ccbd040) at /usr/src/debug/qemu-1.5.1/cpus.c:759
#9  0x00007f39189a5c53 in start_thread (arg=0x7f390eb30700) at pthread_create.c:308
#10 0x00007f39161320dd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:113
Comment 4 Hai Huang 2013-07-25 09:17:31 EDT
Original description reports win2k8-R2 guest on rhel7 host,
Comment 1 reports win2012 hit the same issue on rhel 7 host.
Does this problem also occur with rhel7 guest?  

This would help us narrow down to whether this may be an Windows driver
issue, or in qemu.  Thank you.
Comment 5 guo jiang 2013-07-26 03:32:35 EDT
QE reproduced this issue on rhel7 guest.

(gdb) bt
#0  __memcmp_sse4_1 () at ../sysdeps/x86_64/multiarch/memcmp-sse4.S:1015
#1  0x00007f800d613bc9 in patch_hypercalls (s=0x7f800f706be0, s=0x7f800f706be0) at /usr/src/debug/qemu-1.5.1/hw/i386/kvmvapic.c:549
#2  vapic_prepare (s=s@entry=0x7f800f706be0) at /usr/src/debug/qemu-1.5.1/hw/i386/kvmvapic.c:614
#3  0x00007f800d613d0e in vapic_write (opaque=0x7f800f706be0, addr=<optimized out>, data=<optimized out>, size=<optimized out>)
    at /usr/src/debug/qemu-1.5.1/hw/i386/kvmvapic.c:651
#4  0x00007f800d636c62 in access_with_adjusted_size (addr=addr@entry=0, value=value@entry=0x7f80017f3b58, size=2, 
    access_size_min=<optimized out>, access_size_max=<optimized out>, 
    access=access@entry=0x7f800d637220 <memory_region_write_accessor>, opaque=opaque@entry=0x7f800f708f08)
    at /usr/src/debug/qemu-1.5.1/memory.c:364
#5  0x00007f800d638137 in memory_region_iorange_write (iorange=<optimized out>, offset=0, width=2, data=32)
    at /usr/src/debug/qemu-1.5.1/memory.c:439
#6  0x00007f800d6359dd in kvm_handle_io (count=1, size=2, direction=1, data=<optimized out>, port=126)
    at /usr/src/debug/qemu-1.5.1/kvm-all.c:1485
#7  kvm_cpu_exec (env=env@entry=0x7f800f6e8800) at /usr/src/debug/qemu-1.5.1/kvm-all.c:1634
#8  0x00007f800d5e0dd5 in qemu_kvm_cpu_thread_fn (arg=0x7f800f6e8800) at /usr/src/debug/qemu-1.5.1/cpus.c:759
#9  0x00007f800b669c53 in start_thread (arg=0x7f80017f4700) at pthread_create.c:308
#10 0x00007f8008df60dd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:113
Comment 6 Hai Huang 2013-07-26 08:40:04 EDT
segfault in patch_hypercalls  
(/usr/src/debug/qemu-1.5.1/hw/i386/kvmvapic.c:549)
Happens with various types of guests (Windows, RHEL7).

Appears to be another manisfestation of:
    https://bugzilla.redhat.com/show_bug.cgi?id=924164
Comment 8 Paolo Bonzini 2013-11-06 08:06:50 EST

*** This bug has been marked as a duplicate of bug 920021 ***

Note You need to log in before you can comment on or make changes to this bug.