Bug 991288 - VM has quit abnormally while iofuzz testing
VM has quit abnormally while iofuzz testing
Status: CLOSED DUPLICATE of bug 1067892
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: qemu-kvm (Show other bugs)
7.0
Unspecified Unspecified
medium Severity medium
: rc
: ---
Assigned To: Fam Zheng
Virtualization Bugs
: Reopened
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2013-08-02 01:23 EDT by CongLi
Modified: 2014-04-18 02:41 EDT (History)
9 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2014-04-18 02:41:37 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
iofuzz-autotest-debug file (63.35 KB, text/plain)
2014-03-26 05:48 EDT, CongLi
no flags Details

  None (edit)
Description CongLi 2013-08-02 01:23:00 EDT
Description of problem:
VM has quit abnormally while iofuzz testing

Version-Release number of selected component (if applicable):
kernel-3.9.0-0.55.el7.x86_64
qemu-kvm-1.5.2-1.el7.x86_64

How reproducible:
Only once

Steps to Reproduce:
1./root/staf-kvm-devel/autotest-devel/client/tests/virt/qemu/qemu \
    -S \
    -name 'vm1' \
    -chardev socket,id=qmp_id_qmpmonitor1,path=/tmp/monitor-qmpmonitor1-20130530-191349-ZMSDl1gm,server,nowait \
    -mon chardev=qmp_id_qmpmonitor1,mode=control \
    -chardev socket,id=serial_id_serial1,path=/tmp/serial-serial1-20130530-191349-ZMSDl1gm,server,nowait \
    -device isa-serial,chardev=serial_id_serial1 \
    -chardev socket,id=seabioslog_id_20130530-191349-ZMSDl1gm,path=/tmp/seabios-20130530-191349-ZMSDl1gm,server,nowait \
    -device isa-debugcon,chardev=seabioslog_id_20130530-191349-ZMSDl1gm,iobase=0x402 \
    -device ich9-usb-uhci1,id=usb1,bus=pci.0,addr=0x4 \
    -drive file='/home/staf-kvm-devel/autotest-devel/client/tests/virt/shared/data/images/RHEL-Server-7.0-64.qcow2',if=none,id=drive-ide0-0-0,media=disk,cache=none,snapshot=off,format=qcow2,aio=native \
    -device ide-drive,bus=ide.0,unit=0,drive=drive-ide0-0-0 \
    -device rtl8139,netdev=idIg594w,mac=9a:3b:3c:3d:3e:3f,bus=pci.0,addr=0x3,id='idCSLDpm' \
    -netdev tap,id=idIg594w,fd=23 \
    -m 4096 \
    -smp 4,maxcpus=4,cores=2,threads=1,sockets=2 \
    -cpu 'SandyBridge' \
    -M pc \
    -device usb-tablet,id=usb-tablet1,bus=usb1.0,port=1 \
    -vnc :0 \
    -vga cirrus \
    -rtc base=utc,clock=host,driftfix=slew  \
    -boot order=cdn,once=c,menu=off   \
    -no-kvm-pit-reinjection \
    -enable-kvm
2.
    KVM iofuzz test:
    1) Log into a guest
    2) Enumerate all IO port ranges through /proc/ioports
    3) On each port of the range:
        * Read it
        * Write 0 to it
        * Write a random value to a random port on a random order

3.

Actual results:
VM has quit abnormally during write

Expected results:
VM works well

Additional info:
1. cpuinfo
processor	: 1
vendor_id	: AuthenticAMD
cpu family	: 15
model		: 67
model name	: Dual-Core AMD Opteron(tm) Processor 1216
stepping	: 3
cpu MHz		: 1000.000
cache size	: 1024 KB
physical id	: 0
siblings	: 2
core id		: 1
cpu cores	: 2
apicid		: 1
initial apicid	: 1
fpu		: yes
fpu_exception	: yes
cpuid level	: 1
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt rdtscp lm 3dnowext 3dnow rep_good nopl extd_apicid pni cx16 lahf_lm cmp_legacy svm extapic cr8_legacy
bogomips	: 2009.13
TLB size	: 1024 4K pages
clflush size	: 64
cache_alignment	: 64
address sizes	: 40 bits physical, 48 bits virtual
power management: ts fid vid ttp tm stc
Comment 3 Hai Huang 2013-08-02 08:05:24 EDT
Most likely a duplicate of https://bugzilla.redhat.com/show_bug.cgi?id=969945.
Comment 4 Hai Huang 2014-01-03 12:41:40 EST

*** This bug has been marked as a duplicate of bug 969945 ***
Comment 5 CongLi 2014-03-26 05:35:40 EDT
Met this bug again on the following version:

kernel-3.10.0-114.el7.x86_64
qemu-kvm-rhev-1.5.3-57.el7ev.x86_64

Here are the qemu output:

3/25 12:59:13 DEBUG|   aexpect:1407| Sending command: echo -e '\0' | dd of=/dev/port seek=49172 bs=1 count=1
03/25 12:59:13 DEBUG|   aexpect:1407| Sending command: echo $?
03/25 12:59:14 DEBUG|    iofuzz:0035| outb(0xc015, 0x0)
03/25 12:59:14 DEBUG|   aexpect:1407| Sending command: echo -e '\0' | dd of=/dev/port seek=49173 bs=1 count=1
03/25 12:59:14 INFO |   aexpect:0907| [qemu output] qemu: virtio_ioport_write: unexpected address 0x15 value 0x0
03/25 12:59:14 DEBUG|   aexpect:1407| Sending command: echo $?
03/25 12:59:15 DEBUG|    iofuzz:0035| outb(0xc016, 0x0)
03/25 12:59:15 DEBUG|   aexpect:1407| Sending command: echo -e '\0' | dd of=/dev/port seek=49174 bs=1 count=1
03/25 12:59:15 DEBUG|   aexpect:1407| Sending command: echo $?
03/25 12:59:15 DEBUG|    iofuzz:0035| outb(0xc017, 0x0)
03/25 12:59:15 DEBUG|   aexpect:1407| Sending command: echo -e '\0' | dd of=/dev/port seek=49175 bs=1 count=1
03/25 12:59:15 INFO |   aexpect:0907| [qemu output] qemu: virtio_ioport_write: unexpected address 0x17 value 0x0
03/25 12:59:15 DEBUG|   aexpect:1407| Sending command: echo $?
03/25 12:59:16 DEBUG|    iofuzz:0035| outb(0xc018, 0x0)

03/25 12:59:45 DEBUG|   aexpect:1407| Sending command: echo -e '\0372' | dd of=/dev/port seek=49202 bs=1 count=1
03/25 12:59:45 INFO |   aexpect:0907| [qemu output] qemu: bad data written to virtio-scsi configuration space

As this bug dup to bz969945, and bz969945 has been 'VERIFIED', maybe they are different bugs.
So could we re-open it?

Thanks,
Cong
Comment 6 CongLi 2014-03-26 05:37:28 EDT
(In reply to CongLi from comment #5)

QEMU CML:

/home/staf-kvm-devel/autotest-devel/client/tests/virt/qemu/qemu \
    -S  \
    -name 'virt-tests-vm1'  \
    -sandbox off  \
    -M pc  \
    -nodefaults  \
    -vga cirrus  \
    -chardev socket,id=qmp_id_qmpmonitor1,path=/tmp/monitor-qmpmonitor1-20140325-125730-6svGNq1r,server,nowait \
    -mon chardev=qmp_id_qmpmonitor1,mode=control  \
    -chardev socket,id=serial_id_serial0,path=/tmp/serial-serial0-20140325-125730-6svGNq1r,server,nowait \
    -device isa-serial,chardev=serial_id_serial0  \
    -chardev socket,id=seabioslog_id_20140325-125730-6svGNq1r,path=/tmp/seabios-20140325-125730-6svGNq1r,server,nowait \
    -device isa-debugcon,chardev=seabioslog_id_20140325-125730-6svGNq1r,iobase=0x402 \
    -device ich9-usb-uhci1,id=usb1,bus=pci.0,addr=03 \
    -device virtio-scsi-pci,id=virtio_scsi_pci0,bus=pci.0,addr=04 \
    -drive id=drive_image1,if=none,cache=none,snapshot=off,aio=native,file=/home/staf-kvm-devel/autotest-devel/client/tests/virt/shared/data/images/RHEL-Server-7.0-64-virtio.raw \
    -device scsi-hd,id=image1,drive=drive_image1 \
    -device virtio-net-pci,mac=9a:27:28:29:2a:2b,id=idT5VEdz,netdev=idQUbjjt,bus=pci.0,addr=05  \
    -netdev tap,id=idQUbjjt,vhost=on  \
    -m 4096  \
    -smp 4,maxcpus=4,cores=2,threads=1,sockets=2  \
    -cpu 'Opteron_G4',+kvm_pv_unhalt \
    -device usb-tablet,id=usb-tablet1,bus=usb1.0,port=1  \
    -vnc :0  \
    -rtc base=utc,clock=host,driftfix=slew  \
    -boot order=cdn,once=c,menu=off  \
    -no-kvm-pit-reinjection \
    -enable-kvm
Comment 7 CongLi 2014-03-26 05:48:04 EDT
Created attachment 878921 [details]
iofuzz-autotest-debug file
Comment 8 Dr. David Alan Gilbert 2014-04-01 11:53:00 EDT
This is separate from the others; from comment #5

hw/scsi/virtio-scsi.c

static void virtio_scsi_set_config(VirtIODevice *vdev,
                                   const uint8_t *config)
{
    VirtIOSCSIConfig *scsiconf = (VirtIOSCSIConfig *)config;
    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(vdev);

    if ((uint32_t) ldl_raw(&scsiconf->sense_size) >= 65536 ||
        (uint32_t) ldl_raw(&scsiconf->cdb_size) >= 256) {
        error_report("bad data written to virtio-scsi configuration space");
        exit(1);
    }

    vs->sense_size = ldl_raw(&scsiconf->sense_size);
    vs->cdb_size = ldl_raw(&scsiconf->cdb_size);
}
Comment 9 Bandan Das 2014-04-04 13:43:27 EDT
(In reply to CongLi from comment #6)
> (In reply to CongLi from comment #5)
> 
Are you able to reproduce this on every run ?
Comment 10 CongLi 2014-04-07 20:37:49 EDT
(In reply to Bandan Das from comment #9)
> (In reply to CongLi from comment #6)
> > (In reply to CongLi from comment #5)
> > 
> Are you able to reproduce this on every run ?

According to the recent tests, I could say yes, can hit this issue on every run.

Thanks,
Cong
Comment 11 Fam Zheng 2014-04-18 02:41:37 EDT

*** This bug has been marked as a duplicate of bug 1067892 ***

Note You need to log in before you can comment on or make changes to this bug.