Re: [Qemu-devel] [PATCHv7 3/3] virtio: add features as qdev properties

[Christoph Hellwig]

This patch causes 100% reproducible boot panics in a Linux guest using
virtio.

My qemu command line is:

/opt/qemu/bin/qemu-system-x86_64 \
        -m 1500 \
        -enable-kvm \
        -drive 
file=/dev/vg00/qemu-root,if=virtio,media=disk,cache=none,aio=threads \
        -kernel arch/x86/boot/bzImage \
        -append "root=/dev/vda console=tty0 console=ttyS0,38400n8" \
        -nographic

and the guest dmesg is:

[    2.578083] virtio-pci 0000:00:04.0: PCI INT A -> Link[LNKD] -> GSI
10 (level, high) -> IRQ 10
[    2.583111] blk_queue_max_segment_size: set to minimum 4096
[    2.584651]  vda:
[    2.585075] BUG: unable to handle kernel NULL pointer dereference at (null)
[    2.587060] IP: [<c0228448>] create_empty_buffers+0x18/0xa0
[    2.588403] *pde = 00000000 
[    2.588403] Oops: 0002 [#1] SMP 
[    2.588403] last sysfs file: 
[    2.588403] Modules linked in:
[    2.588403] 
[    2.588403] Pid: 1, comm: swapper Not tainted 2.6.33-rc3-xfs #398 /Bochs
[    2.588403] EIP: 0060:[<c0228448>] EFLAGS: 00010296 CPU: 0
[    2.588403] EIP is at create_empty_buffers+0x18/0xa0
[    2.588403] EAX: 00000000 EBX: c1d97e80 ECX: 00000001 EDX: 00010000
[    2.588403] ESI: 00000000 EDI: 00000000 EBP: f7043b08 ESP: f7043afc
[    2.588403]  DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
[    2.588403] Process swapper (pid: 1, ti=f7042000 task=f7040c70 
task.ti=f7042000)
[    2.588403] Stack:
[    2.588403]  c1d97e80 00000000 f6c02848 f7043b78 c022a42d 00000007 f7043b2c 
c0194c92
[    2.588403] <0> c022d570 c1d97e80 c0900d52 f6c02988 f7043b3c c0194fc4 
f6c02998 00010000
[    2.588403] <0> f7043b44 c019501b f7043b50 c0900d52 c1d97e80 f7043b6c 
c01d3eee 00000000
[    2.588403] Call Trace:
[    2.588403]  [<c022a42d>] ? block_read_full_page+0x2ed/0x340
[    2.588403]  [<c0194c92>] ? mark_held_locks+0x62/0x80
[    2.588403]  [<c022d570>] ? blkdev_get_block+0x0/0xd0
[    2.588403]  [<c0900d52>] ? _raw_spin_unlock_irq+0x22/0x30
[    2.588403]  [<c0194fc4>] ? trace_hardirqs_on_caller+0x134/0x180
[    2.588403]  [<c019501b>] ? trace_hardirqs_on+0xb/0x10
[    2.588403]  [<c0900d52>] ? _raw_spin_unlock_irq+0x22/0x30
[    2.588403]  [<c01d3eee>] ? add_to_page_cache_locked+0x7e/0xc0
[    2.588403]  [<c022e6ff>] ? blkdev_readpage+0xf/0x20
[    2.588403]  [<c01d4e13>] ? read_cache_page_async+0x73/0x140
[    2.588403]  [<c022e6f0>] ? blkdev_readpage+0x0/0x20
[    2.588403]  [<c01d4ef2>] ? read_cache_page+0x12/0x60
[    2.588403]  [<c0256645>] ? read_dev_sector+0x35/0x80
[    2.588403]  [<c0257661>] ? adfspart_check_ICS+0x21/0x190
[    2.588403]  [<c067a85a>] ? snprintf+0x1a/0x20
[    2.588403]  [<c025705f>] ? disk_name+0xaf/0xc0
[    2.588403]  [<c025721d>] ? rescan_partitions+0x1ad/0x4a0
[    2.588403]  [<c0257640>] ? adfspart_check_ICS+0x0/0x190
[    2.588403]  [<c066a5d4>] ? disk_get_part+0x74/0x90
[    2.588403]  [<c022ed4c>] ? __blkdev_get+0x17c/0x370
[    2.588403]  [<c0673a00>] ? kobject_put+0x20/0x50
[    2.588403]  [<c022ef4a>] ? blkdev_get+0xa/0x10
[    2.588403]  [<c025677f>] ? register_disk+0xef/0x110
[    2.588403]  [<c0669cc9>] ? add_disk+0xd9/0x130
[    2.588403]  [<c0669120>] ? exact_match+0x0/0x10
[    2.588403]  [<c06697a0>] ? exact_lock+0x0/0x20
[    2.588403]  [<c08eda09>] ? virtblk_probe+0x329/0x450
[    2.588403]  [<c06fbab0>] ? blk_done+0x0/0xc0
[    2.588403]  [<c07e1edc>] ? virtio_dev_probe+0xbc/0x100
[    2.588403]  [<c06ef339>] ? driver_probe_device+0x69/0x170
[    2.588403]  [<c0900ddd>] ? _raw_spin_unlock+0x1d/0x20
[    2.588403]  [<c06ef501>] ? __device_attach+0x41/0x50
[    2.588403]  [<c06ee8e3>] ? bus_for_each_drv+0x53/0x80
[    2.588403]  [<c06ef5ab>] ? device_attach+0x6b/0x70
[    2.588403]  [<c06ef4c0>] ? __device_attach+0x0/0x50
[    2.588403]  [<c06ee6c7>] ? bus_probe_device+0x27/0x40
[    2.588403]  [<c06ecec2>] ? device_add+0x4b2/0x600
[    2.588403]  [<c0192edd>] ? lockdep_init_map+0x3d/0x110
[    2.588403]  [<c06801a2>] ? __raw_spin_lock_init+0x32/0x60
[    2.588403]  [<c06ec5e7>] ? device_initialize+0x97/0xc0
[    2.588403]  [<c06ed022>] ? device_register+0x12/0x20
[    2.588403]  [<c07e1fc8>] ? register_virtio_device+0x68/0x90
[    2.588403]  [<c08f3c47>] ? virtio_pci_probe+0x14b/0x1b4
[    2.588403]  [<c0900ddd>] ? _raw_spin_unlock+0x1d/0x20
[    2.588403]  [<c068feae>] ? local_pci_probe+0xe/0x10
[    2.588403]  [<c06900e0>] ? pci_device_probe+0x60/0x80
[    2.588403]  [<c06ef339>] ? driver_probe_device+0x69/0x170
[    2.588403]  [<c06ef4b9>] ? __driver_attach+0x79/0x80
[    2.588403]  [<c06eeba3>] ? bus_for_each_dev+0x53/0x80
[    2.588403]  [<c06ef1e9>] ? driver_attach+0x19/0x20
[    2.588403]  [<c06ef440>] ? __driver_attach+0x0/0x80
[    2.588403]  [<c06ee517>] ? bus_add_driver+0x1f7/0x2c0
[    2.588403]  [<c0690020>] ? pci_device_remove+0x0/0x40
[    2.588403]  [<c06ef735>] ? driver_register+0x75/0x160
[    2.588403]  [<c0690324>] ? __pci_register_driver+0x54/0xc0
[    2.588403]  [<c0cd302d>] ? virtio_pci_init+0x34/0x47
[    2.588403]  [<c0cd2ff9>] ? virtio_pci_init+0x0/0x47
[    2.588403]  [<c0101033>] ? do_one_initcall+0x23/0x190
[    2.588403]  [<c01afc17>] ? init_irq_proc+0x67/0x80
[    2.588403]  [<c0ca5355>] ? kernel_init+0x130/0x189
[    2.588403]  [<c0ca5225>] ? kernel_init+0x0/0x189
[    2.588403]  [<c012f5ba>] ? kernel_thread_helper+0x6/0x1c
[    2.588403] Code: c0 31 f6 eb c1 8d b4 26 00 00 00 00 8d bc 27 00 00 00 00 
55 89 e5 57 56 89 ce 53 b9 01 00 00 00 89 c3 e8 1c ff ff ff 89 c7 66 90 <09> 30 
89 c2 8b 40 04 85 c0 75 f5 89 7a 04 8b 43 10 05 84 00 00