RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 988256 - Segmentation fault when guest reboot after hotulnplug netkvm
Summary: Segmentation fault when guest reboot after hotulnplug netkvm
Keywords:
Status: CLOSED DUPLICATE of bug 920021
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: qemu-kvm
Version: 7.0
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: rc
: ---
Assignee: Marcel Apfelbaum
QA Contact: Virtualization Bugs
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-07-25 08:10 UTC by lijin
Modified: 2013-11-06 13:06 UTC (History)
13 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-11-06 13:06:50 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)

Description lijin 2013-07-25 08:10:26 UTC 
Description of problem:
when guest do reboot after hotulnplug netkvm,Segmentation fault occurs

Version-Release number of selected component (if applicable):
kernel-3.10.0-0.rc7.64.el7.x86_64
qemu-kvm-1.5.1-2.el7.x86_64
virtio-win-prewhql-65
seabios-1.7.2.2-2.el7.x86_64
spice-server-0.12.3-1.el7.x86_64
vgabios-0.6c-9.el7.noarch

How reproducible:
100%

Steps to Reproduce:
1.boot a win2k8-R2 guest with netkvm:
/usr/libexec/qemu-kvm  \
-drive file=win2k8R2.qcow3,if=none,cache=none,media=disk,format=qcow2,id=drive-scsi-0 \
-device ide-drive,drive=drive-scsi-0,id=blk0,bootindex=0 \
-global PIIX4_PM.disable_s3=0 -global PIIX4_PM.disable_s4=0 \
-usb -device usb-tablet \
-monitor stdio \
-chardev socket,id=aaaa,path=/tmp/tttt,server,nowait \
-mon chardev=aaaa,mode=readline \
-spice port=5900,disable-ticketing -vga qxl \
-chardev file,path=/root/console.log,id=serial1 \
-device isa-serial,chardev=serial1,id=s1 \
-cpu 'Penryn' -M pc \
-smp 4,cores=2,threads=1,sockets=2 -m 6G \
-enable-kvm \
-netdev tap,sndbuf=0,id=hostnet1,vhost=on,script=/etc/qemu-ifup,downscript=no -device virtio-net-pci,netdev=hostnet1,id=net1,mac=00:52:12:16:54:46,bus=pci.0,addr=0x7 \

2.hotunplug netkvm
(qemu) device_del net1 
(qemu) netdev_del hostnet1

3.reboot guest

Actual results:
Segmentation fault occurs

Expected results:
guest works well

Additional info:
in rhel6 host,not hit this issue
Comment 1 lijin 2013-07-25 08:11:19 UTC 
(gdb) bt
#0  0x00007f3fa72f7290 in __memcmp_sse4_1 () from /lib64/libc.so.6
#1  0x00007f3fabaacbc9 in patch_hypercalls (s=0x7f3fae26b490, s=0x7f3fae26b490)
    at /usr/src/debug/qemu-1.5.1/hw/i386/kvmvapic.c:549
#2  vapic_prepare (s=s@entry=0x7f3fae26b490) at /usr/src/debug/qemu-1.5.1/hw/i386/kvmvapic.c:614
#3  0x00007f3fabaacd0e in vapic_write (opaque=0x7f3fae26b490, addr=<optimized out>, data=<optimized out>, size=<optimized out>)
    at /usr/src/debug/qemu-1.5.1/hw/i386/kvmvapic.c:651

#4  0x00007f3fabacfc62 in access_with_adjusted_size (addr=addr@entry=0, value=value@entry=0x7f3f9ed9cb58, size=2,
    access_size_min=<optimized out>, access_size_max=<optimized out>, access=access@entry=
    0x7f3fabad0220 <memory_region_write_accessor>, opaque=opaque@entry=0x7f3fae26d7b8) at /usr/src/debug/qemu-1.5.1/memory.c:364
#5  0x00007f3fabad1137 in memory_region_iorange_write (iorange=<optimized out>, offset=0, width=2, data=32)
    at /usr/src/debug/qemu-1.5.1/memory.c:439
#6  0x00007f3fabace9dd in kvm_handle_io (count=1, size=2, direction=1, data=<optimized out>, port=126)
    at /usr/src/debug/qemu-1.5.1/kvm-all.c:1485
#7  kvm_cpu_exec (env=env@entry=0x7f3fae24d230) at /usr/src/debug/qemu-1.5.1/kvm-all.c:1634
#8  0x00007f3faba79dd5 in qemu_kvm_cpu_thread_fn (arg=0x7f3fae24d230) at /usr/src/debug/qemu-1.5.1/cpus.c:759
#9  0x00007f3fa9b02c53 in start_thread () from /lib64/libpthread.so.0
#10 0x00007f3fa728f0dd in clone () from /lib64/libc.so.6
Comment 2 guo jiang 2013-07-25 08:23:49 UTC 
win2012 hit the same issue on rhel 7 host
package version:
 kernel-3.10.0-2.el7.x86_64
 others:the same as comment #0
(gdb) bt
#0  __memcmp_sse4_1 () at ../sysdeps/x86_64/multiarch/memcmp-sse4.S:1015
#1  0x00007f391a94fbc9 in patch_hypercalls (s=0x7f391ccdb420, s=0x7f391ccdb420)
    at /usr/src/debug/qemu-1.5.1/hw/i386/kvmvapic.c:549
#2  vapic_prepare (s=s@entry=0x7f391ccdb420) at /usr/src/debug/qemu-1.5.1/hw/i386/kvmvapic.c:614
#3  0x00007f391a94fd0e in vapic_write (opaque=0x7f391ccdb420, addr=<optimized out>, data=<optimized out>, 
    size=<optimized out>) at /usr/src/debug/qemu-1.5.1/hw/i386/kvmvapic.c:651
#4  0x00007f391a972c62 in access_with_adjusted_size (addr=addr@entry=0, value=value@entry=0x7f390eb2fb58, size=2, 
    access_size_min=<optimized out>, access_size_max=<optimized out>, 
    access=access@entry=0x7f391a973220 <memory_region_write_accessor>, opaque=opaque@entry=0x7f391ccdd748)
    at /usr/src/debug/qemu-1.5.1/memory.c:364
#5  0x00007f391a974137 in memory_region_iorange_write (iorange=<optimized out>, offset=0, width=2, data=32)
    at /usr/src/debug/qemu-1.5.1/memory.c:439
#6  0x00007f391a9719dd in kvm_handle_io (count=1, size=2, direction=1, data=<optimized out>, port=126)
    at /usr/src/debug/qemu-1.5.1/kvm-all.c:1485
#7  kvm_cpu_exec (env=env@entry=0x7f391ccbd040) at /usr/src/debug/qemu-1.5.1/kvm-all.c:1634
#8  0x00007f391a91cdd5 in qemu_kvm_cpu_thread_fn (arg=0x7f391ccbd040) at /usr/src/debug/qemu-1.5.1/cpus.c:759
#9  0x00007f39189a5c53 in start_thread (arg=0x7f390eb30700) at pthread_create.c:308
#10 0x00007f39161320dd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:113
Comment 4 Hai Huang 2013-07-25 13:17:31 UTC 
Original description reports win2k8-R2 guest on rhel7 host,
Comment 1 reports win2012 hit the same issue on rhel 7 host.
Does this problem also occur with rhel7 guest?  

This would help us narrow down to whether this may be an Windows driver
issue, or in qemu.  Thank you.
Comment 5 guo jiang 2013-07-26 07:32:35 UTC 
QE reproduced this issue on rhel7 guest.

(gdb) bt
#0  __memcmp_sse4_1 () at ../sysdeps/x86_64/multiarch/memcmp-sse4.S:1015
#1  0x00007f800d613bc9 in patch_hypercalls (s=0x7f800f706be0, s=0x7f800f706be0) at /usr/src/debug/qemu-1.5.1/hw/i386/kvmvapic.c:549
#2  vapic_prepare (s=s@entry=0x7f800f706be0) at /usr/src/debug/qemu-1.5.1/hw/i386/kvmvapic.c:614
#3  0x00007f800d613d0e in vapic_write (opaque=0x7f800f706be0, addr=<optimized out>, data=<optimized out>, size=<optimized out>)
    at /usr/src/debug/qemu-1.5.1/hw/i386/kvmvapic.c:651
#4  0x00007f800d636c62 in access_with_adjusted_size (addr=addr@entry=0, value=value@entry=0x7f80017f3b58, size=2, 
    access_size_min=<optimized out>, access_size_max=<optimized out>, 
    access=access@entry=0x7f800d637220 <memory_region_write_accessor>, opaque=opaque@entry=0x7f800f708f08)
    at /usr/src/debug/qemu-1.5.1/memory.c:364
#5  0x00007f800d638137 in memory_region_iorange_write (iorange=<optimized out>, offset=0, width=2, data=32)
    at /usr/src/debug/qemu-1.5.1/memory.c:439
#6  0x00007f800d6359dd in kvm_handle_io (count=1, size=2, direction=1, data=<optimized out>, port=126)
    at /usr/src/debug/qemu-1.5.1/kvm-all.c:1485
#7  kvm_cpu_exec (env=env@entry=0x7f800f6e8800) at /usr/src/debug/qemu-1.5.1/kvm-all.c:1634
#8  0x00007f800d5e0dd5 in qemu_kvm_cpu_thread_fn (arg=0x7f800f6e8800) at /usr/src/debug/qemu-1.5.1/cpus.c:759
#9  0x00007f800b669c53 in start_thread (arg=0x7f80017f4700) at pthread_create.c:308
#10 0x00007f8008df60dd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:113
Comment 6 Hai Huang 2013-07-26 12:40:04 UTC 
segfault in patch_hypercalls  
(/usr/src/debug/qemu-1.5.1/hw/i386/kvmvapic.c:549)
Happens with various types of guests (Windows, RHEL7).

Appears to be another manisfestation of:
    https://bugzilla.redhat.com/show_bug.cgi?id=924164
Comment 7 danielgao 2013-08-31 16:23:28 UTC 
http://lists.nongnu.org/archive/html/qemu-devel/2013-08/msg04546.html
Maybe it could fix the bug.

the origin path:
http://lists.gnu.org/archive/html/qemu-devel/2012-02/msg00519.html
Comment 8 Paolo Bonzini 2013-11-06 13:06:50 UTC 

*** This bug has been marked as a duplicate of bug 920021 ***
Note You need to log in before you can comment on or make changes to this bug.