[Qemu-devel] [Bug Report] snapshot under a background migration

[Chai Wen]

Hi,

There is a issue that doing snapshot under a background migration could cause a 
segfault.

Steps to reproduce this issue are:
    1. dirty plenty of pages in the 1st guest
    2. run command 'migrate -d tcp:***:***' in 1st monitor to migrate the 1st 
guest to 2nd guest in background
    3. run command 'savevm' in 1st monitor
(host test env
arch: x86_64 i3-2120 CPU
qemu: master on git://git.qemu.org/qemu.git
kernel: 3.0.76)
And the corresponding stack is as below. It looks like a wrongly re-access of 
some memory.

But I am not sure whether it should be treated as a function restriction of the 
migration/savevm
than a bug. (Or it is to say we should not do snapshot when there is a 
migration processing)
Even though is is a restriction, qemu should be aware of this illegal operation 
?

And this issue is also found in stable-1.5, stable-1.6.


=====================
...
(qemu) migrate -d tcp:0:3333
(qemu) [New Thread 0x7ffff5055700 (LWP 31620)]

(qemu) savevm

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7ffff5055700 (LWP 31620)]
find_next_bit (addr=<optimized out>, size=1048576, offset=0) at util/bitops.c:47
47              tmp = *p;
(gdb) bt
#0  find_next_bit (addr=<optimized out>, size=1048576, offset=0) at 
util/bitops.c:47
#1  0x00005555557aa09a in migration_bitmap_find_and_reset_dirty 
(start=<optimized out>, mr=<optimized out>)
    at /home/chaiwen/upstream-qemu/qemu/arch_init.c:427
#2  ram_find_and_save_block (f=0x5555563729b0, last_stage=false) at 
/home/chaiwen/upstream-qemu/qemu/arch_init.c:656
#3  0x00005555557aa5c1 in ram_save_iterate (f=0x5555563729b0, opaque=<optimized 
out>) at /home/chaiwen/upstream-qemu/qemu/arch_init.c:870
#4  0x0000555555827b76 in qemu_savevm_state_iterate (f=0x5555563729b0) at 
/home/chaiwen/upstream-qemu/qemu/savevm.c:541
#5  0x000055555572692e in migration_thread (opaque=0x555555caa920 
<current_migration.29169>) at migration.c:602
#6  0x00007ffff5a177b6 in start_thread () from /lib64/libpthread.so.0
#7  0x00007ffff5772d6d in clone () from /lib64/libc.so.6
#8  0x0000000000000000 in ?? ()
(gdb) info thread
....
(gdb) thread 1
[Switching to thread 1 (Thread 0x7ffff7fbb8e0 (LWP 30987))]
#0  steal_time_msr_needed (opaque=0x5555563151a0) at 
/home/chaiwen/upstream-qemu/qemu/target-i386/machine.c:348
348     {
(gdb) bt
#0  steal_time_msr_needed (opaque=0x5555563151a0) at 
/home/chaiwen/upstream-qemu/qemu/target-i386/machine.c:348
#1  0x00005555557a7f3e in vmstate_subsection_save (opaque=<optimized out>, 
vmsd=<optimized out>, f=<optimized out>) at vmstate.c:221
#2  vmstate_save_state (f=0x555556418000, vmsd=0x555555c6d9e0 
<vmstate_x86_cpu>, opaque=0x5555563151a0) at vmstate.c:159
#3  0x0000555555827a1a in vmstate_save (se=<optimized out>, f=<optimized out>) 
at /home/chaiwen/upstream-qemu/qemu/savevm.c:447
#4  qemu_savevm_state_complete (f=0x555556418000) at 
/home/chaiwen/upstream-qemu/qemu/savevm.c:608
#5  0x0000555555827fae in qemu_savevm_state (f=<optimized out>) at 
/home/chaiwen/upstream-qemu/qemu/savevm.c:671
#6  do_savevm (mon=0x5555561a7980, qdict=<optimized out>) at 
/home/chaiwen/upstream-qemu/qemu/savevm.c:976
#7  0x0000555555824449 in handle_user_command (mon=0x5555561a7980, 
cmdline=<optimized out>)
    at /home/chaiwen/upstream-qemu/qemu/monitor.c:4159
#8  0x000055555582476b in monitor_command_cb (opaque=0x5555561a7980, 
cmdline=0x555556418a1e "\001", readline_opaque=0x0)
    at /home/chaiwen/upstream-qemu/qemu/monitor.c:5021
#9  0x00005555558d07c9 in readline_handle_byte (rs=0x55555630f410, 
ch=<optimized out>) at util/readline.c:376
#10 0x0000555555824519 in monitor_read (opaque=<optimized out>, 
buf=0x7fffffffcc60 "\r", size=1)
    at /home/chaiwen/upstream-qemu/qemu/monitor.c:5004
#11 0x0000555555755f2b in fd_chr_read (chan=<optimized out>, cond=<optimized 
out>, opaque=0x55555619a020) at qemu-char.c:848
#12 0x00007ffff732d60a in g_main_context_dispatch () from 
/usr/lib64/libglib-2.0.so.0
#13 0x0000555555725732 in glib_pollfds_poll () at main-loop.c:190
#14 os_host_main_loop_wait (timeout=<optimized out>) at main-loop.c:235
#15 main_loop_wait (nonblocking=<optimized out>) at main-loop.c:484
#16 0x00005555557a5de5 in main_loop () at vl.c:2077
#17 main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at 
vl.c:4561



-- 
Regards

Chai Wen