KVM oops linux-2.6.28/arch/x86/kvm/mmu.c:560

Bug #351367 reported by Michael Robinson
This bug report is a duplicate of:  Bug #361819: Frequent random KVM host kernel OOPS . Edit Remove
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
New
Undecided
Unassigned

Bug Description

Binary package hint: linux-image-2.6.28-11-generic

Current Jaunty amd64.

For no apparent reason, KVM guests (both Windows XP 32-bit and Ubuntu Intrepid 64-bit guests) oops the host kernel, about once every two days in normal use.

kern.log:

Mar 30 12:38:17 aethereal kernel: [56354.830384] kvm: 9652: cpu0 unhandled rdmsr
: 0xc0010117
Mar 30 12:38:17 aethereal kernel: [56354.830480] kvm: 9652: cpu0 unhandled wrmsr
: 0xc0010117 data 0
Mar 30 12:38:17 aethereal kernel: [56354.830609] kvm: 9652: cpu0 unhandled rdmsr
: 0xc0010117
Mar 30 12:38:17 aethereal kernel: [56354.830704] kvm: 9652: cpu0 unhandled wrmsr
: 0xc0010117 data 0
Mar 30 12:38:44 aethereal kernel: [56381.421267] rmap_remove: ffff88011a44d800 e
1e7f8dca5de47e4 0->BUG
Mar 30 12:38:44 aethereal kernel: [56381.421305] ------------[ cut here ]-------
-----
Mar 30 12:38:44 aethereal kernel: [56381.421307] kernel BUG at /build/buildd/lin
ux-2.6.28/arch/x86/kvm/mmu.c:560!
Mar 30 12:38:44 aethereal kernel: [56381.421309] invalid opcode: 0000 [#1] SMP
Mar 30 12:38:44 aethereal kernel: [56381.421312] last sysfs file: /sys/devices/p
ci0000:00/0000:00:1c.1/0000:0c:00.0/rfkill/rfkill0/state
Mar 30 12:38:44 aethereal kernel: [56381.421315] Dumping ftrace buffer:
Mar 30 12:38:44 aethereal kernel: [56381.421317] (ftrace buffer empty)
Mar 30 12:38:44 aethereal kernel: [56381.421319] CPU 0
Mar 30 12:38:44 aethereal kernel: [56381.421320] Modules linked in: binfmt_misc
i915 drm ppdev bridge stp bnep input_polldev kvm_intel kvm snd_hwdep sbp2 lp par
port snd_hda_intel snd_pcm_oss snd_mixer_oss arc4 snd_pcm ecb snd_seq_dummy snd_
seq_oss iwlagn iwlcore pata_pcmcia snd_seq_midi snd_rawmidi snd_seq_midi_event l
ed_class snd_seq snd_timer snd_seq_device mac80211 pcmcia snd soundcore psmouse
yenta_socket rsrc_nonstatic pcmcia_core snd_page_alloc cfg80211 serio_raw pcspkr
 iTCO_wdt iTCO_vendor_support joydev dcdbas btusb sha256_generic aes_x86_64 aes_
generic cbc dm_crypt fbcon tileblit font bitblit softcursor squashfs unionfs nls
_iso8859_1 nls_cp437 vfat fat usbhid usb_storage ohci1394 ieee1394 tg3 intel_agp
 video output
Mar 30 12:38:44 aethereal kernel: [56381.421360] Pid: 9653, comm: kvm Tainted: G
        W 2.6.28-11-generic #38-Ubuntu
Mar 30 12:38:44 aethereal kernel: [56381.421362] RIP: 0010:[<ffffffffa03dbcbe>]
 [<ffffffffa03dbcbe>] rmap_remove+0x21e/0x230 [kvm]
Mar 30 12:38:44 aethereal kernel: [56381.421376] RSP: 0018:ffff88006c3119c8 EFL
AGS: 00010292
Mar 30 12:38:44 aethereal kernel: [56381.421378] RAX: 0000000000000048 RBX: 0000
007f8dca5de4 RCX: 0000000000000001
Mar 30 12:38:44 aethereal kernel: [56381.421380] RDX: ffff8800a75bf000 RSI: 0000000000000086 RDI: 0000000000000292
Mar 30 12:38:44 aethereal kernel: [56381.421381] RBP: ffff88006c3119e8 R08: 0000000000000006 R09: 0000000000000000
Mar 30 12:38:44 aethereal kernel: [56381.421383] R10: ffff88006c311876 R11: ffff88006c311868 R12: ffff88011a44d800
Mar 30 12:38:44 aethereal kernel: [56381.421385] R13: ffff880016f20780 R14: ffff880071904000 R15: 0000000000000000
Mar 30 12:38:44 aethereal kernel: [56381.421387] FS: 00007f5868497950(0000) GS:ffffffff80aa3000(0000) knlGS:0000000000000000
Mar 30 12:38:44 aethereal kernel: [56381.421389] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
Mar 30 12:38:44 aethereal kernel: [56381.421390] CR2: 00007f8cf33dc8d8 CR3: 00000000564e7000 CR4: 00000000000026a0
Mar 30 12:38:44 aethereal kernel: [56381.421392] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
Mar 30 12:38:44 aethereal kernel: [56381.421394] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Mar 30 12:38:44 aethereal kernel: [56381.421396] Process kvm (pid: 9653, threadinfo ffff88006c310000, task ffff8800bdc82cc0)
Mar 30 12:38:44 aethereal kernel: [56381.421397] Stack:
Mar 30 12:38:44 aethereal kernel: [56381.421398] ffff88011a44d800 0000000000000100 ffff880016f20780 ffff880071904000
Mar 30 12:38:44 aethereal kernel: [56381.421401] ffff88006c311a48 ffffffffa03dc0e8 ffffffffa03dc3d0 ffff880071904000
Mar 30 12:38:44 aethereal kernel: [56381.421405] ffff880000000000 000000000001ea0e 000000000007b4b1 ffff88006c311ab8
Mar 30 12:38:44 aethereal kernel: [56381.421408] Call Trace:
Mar 30 12:38:44 aethereal kernel: [56381.421410] [<ffffffffa03dc0e8>] kvm_mmu_zap_page+0x278/0x320 [kvm]
Mar 30 12:38:44 aethereal kernel: [56381.421419] [<ffffffffa03dc3d0>] ? mmu_zap_fn+0x0/0x30 [kvm]
Mar 30 12:38:44 aethereal kernel: [56381.421427] [<ffffffffa03dc3eb>] mmu_zap_fn+0x1b/0x30 [kvm]
Mar 30 12:38:44 aethereal kernel: [56381.421435] [<ffffffffa03db5e5>] mmu_unsync_walk+0xd5/0x140 [kvm]
Mar 30 12:38:44 aethereal kernel: [56381.421443] [<ffffffffa03dbebf>] kvm_mmu_zap_page+0x4f/0x320 [kvm]
Mar 30 12:38:44 aethereal kernel: [56381.421451] [<ffffffffa03dc3d0>] ? mmu_zap_fn+0x0/0x30 [kvm]
Mar 30 12:38:44 aethereal kernel: [56381.421459] [<ffffffffa03df381>] kvm_mmu_pte_write+0x191/0x4f0 [kvm]
Mar 30 12:38:44 aethereal kernel: [56381.421468] [<ffffffffa03d1c08>] ? kvm_write_guest+0x48/0x90 [kvm]
Mar 30 12:38:44 aethereal kernel: [56381.421476] [<ffffffffa03d5447>] emulator_write_phys+0x47/0x70 [kvm]
Mar 30 12:38:44 aethereal kernel: [56381.421485] [<ffffffffa03dc2c1>] kvm_pv_mmu_op_one+0x131/0x1a0 [kvm]
Mar 30 12:38:44 aethereal kernel: [56381.421493] [<ffffffffa03dc3a5>] kvm_pv_mmu_op+0x75/0xa0 [kvm]
Mar 30 12:38:44 aethereal kernel: [56381.421501] [<ffffffffa03d9b3d>] kvm_emulate_hypercall+0x19d/0x1f0 [kvm]
Mar 30 12:38:44 aethereal kernel: [56381.421509] [<ffffffffa0401cdf>] ? handle_exception+0x2ef/0x360 [kvm_intel]
Mar 30 12:38:44 aethereal kernel: [56381.421515] [<ffffffffa04013a9>] handle_vmcall+0x19/0x30 [kvm_intel]
Mar 30 12:38:44 aethereal kernel: [56381.421519] [<ffffffffa0400ca5>] kvm_handle_exit+0xb5/0x1d0 [kvm_intel]
Mar 30 12:38:44 aethereal kernel: [56381.421523] [<ffffffffa03d4978>] vcpu_enter_guest+0x1f8/0x400 [kvm]
Mar 30 12:38:44 aethereal kernel: [56381.421531] [<ffffffffa03d6c4b>] ? __vcpu_run+0x6b/0x2d0 [kvm]
Mar 30 12:38:44 aethereal kernel: [56381.421539] [<ffffffffa03d6c49>] __vcpu_run+0x69/0x2d0 [kvm]
Mar 30 12:38:44 aethereal kernel: [56381.421547] [<ffffffffa03da90a>] kvm_arch_vcpu_ioctl_run+0x8a/0x1f0 [kvm]
Mar 30 12:38:44 aethereal kernel: [56381.421555] [<ffffffffa03cf582>] kvm_vcpu_ioctl+0x2e2/0x5a0 [kvm]
Mar 30 12:38:44 aethereal kernel: [56381.421563] [<ffffffff8041c1c5>] ? rb_erase+0xe5/0x170
Mar 30 12:38:44 aethereal kernel: [56381.421568] [<ffffffff80210529>] ? __switch_to+0x109/0x490
Mar 30 12:38:44 aethereal kernel: [56381.421573] [<ffffffff802f62d1>] vfs_ioctl+0x31/0xa0
Mar 30 12:38:44 aethereal kernel: [56381.421577] [<ffffffff8069c97c>] ? thread_return+0x37/0x36b
Mar 30 12:38:44 aethereal kernel: [56381.421581] [<ffffffff802f6685>] do_vfs_ioctl+0x75/0x230
Mar 30 12:38:44 aethereal kernel: [56381.421584] [<ffffffff802f68d9>] sys_ioctl+0x99/0xa0
Mar 30 12:38:44 aethereal kernel: [56381.421586] [<ffffffff8069f3f9>] ? do_device_not_available+0x9/0x10
Mar 30 12:38:44 aethereal kernel: [56381.421590] [<ffffffff8021253a>] system_call_fastpath+0x16/0x1b
Mar 30 12:38:44 aethereal kernel: [56381.421592] Code: 8b 14 24 4c 89 e6 48 c7 c7 b0 aa 3e a0 31 c0 e8 48 06 2c e0 0f 0b eb fe 49 8b 14 24 4c 89 e6 48 c7 c7 90aa 3e a0 e8 31 06 2c e0 <0f> 0b eb fe 48 8b 07 49 89 00 eb 8d 66 0f 1f 44 00 0055 48 89
Mar 30 12:38:44 aethereal kernel: [56381.421619] RIP [<ffffffffa03dbcbe>] rmap_remove+0x21e/0x230 [kvm]
Mar 30 12:38:44 aethereal kernel: [56381.421627] RSP <ffff88006c3119c8>
Mar 30 12:38:44 aethereal kernel: [56381.421630] ---[ end trace c84fe884e3d5c1e5 ]---

Revision history for this message
Michael Robinson (robinson-netrinsics) wrote :

After rebooting from the previously reported oops, I restarted all my guests, etc., as before, and observed the following behavior:

1. A rect from the SDL window of a Windows XP guest appeared in the middle of the backing store of a Java window (disappeared when the window was resized, but otherwise followed the window around).
2. The JVM eventually crashed with a memory error.
3. All the plasma components (kde desktop) crashed and failed to restart (requiring a reboot from a text console).

It seems to me these are all potential symptoms of KVM scribbling over allocated system memory, which, if true, could potentially lead to catastrophic data loss.

FYI.

Revision history for this message
Michael Robinson (robinson-netrinsics) wrote :

On further experience, it appears that the Java window behavior mentioned above is due to a graphics layer bug in the JVM, not related to KVM.

Revision history for this message
Michael Robinson (robinson-netrinsics) wrote :
Download full text (5.5 KiB)

Here's another one:
Apr 2 20:50:27 aethereal kernel: [91025.400730] kvm: 15182: cpu0 unhandled wrms
r: 0xc0010117 data 0
Apr 2 20:50:27 aethereal kernel: [91025.400809] kvm: 15182: cpu0 unhandled rdms
r: 0xc0010117
Apr 2 20:50:27 aethereal kernel: [91025.400878] kvm: 15182: cpu0 unhandled wrms
r: 0xc0010117 data 0
Apr 2 20:50:27 aethereal kernel: [91025.400960] kvm: 15182: cpu0 unhandled rdms
r: 0xc0010117
Apr 2 20:50:27 aethereal kernel: [91025.402454] kvm: 15182: cpu0 unhandled wrms
r: 0xc0010117 data 0
Apr 2 20:50:27 aethereal kernel: [91025.958373] general protection fault: 0000
[#3] SMP
Apr 2 20:50:27 aethereal kernel: [91025.958381] last sysfs file: /sys/devices/p
ci0000:00/0000:00:1c.1/0000:0c:00.0/rfkill/rfkill0/state
Apr 2 20:50:27 aethereal kernel: [91025.958385] CPU 0
Apr 2 20:50:27 aethereal kernel: [91025.958388] Modules linked in: ppp_async cr
c_ccitt binfmt_misc i915 drm ppdev bridge stp bnep input_polldev kvm_intel kvm s
nd_hwdep sbp2 lp parport snd_hda_intel snd_pcm_oss snd_mixer_oss arc4 snd_pcm ec
b snd_seq_dummy pata_pcmcia snd_seq_oss iwlagn iwlcore snd_seq_midi snd_rawmidi
snd_seq_midi_event snd_seq led_class pcmcia snd_timer snd_seq_device mac80211 sn
d yenta_socket soundcore psmouse rsrc_nonstatic pcmcia_core snd_page_alloc cfg80
211 serio_raw pcspkr dcdbas btusb iTCO_wdt iTCO_vendor_support joydev sha256_gen
eric aes_x86_64 aes_generic cbc dm_crypt fbcon tileblit font bitblit softcursor
squashfs unionfs nls_iso8859_1 nls_cp437 vfat fat usbhid usb_storage ohci1394 ie
ee1394 tg3 video output intel_agp
Apr 2 20:50:27 aethereal kernel: [91025.958469] Pid: 15183, comm: kvm Tainted:
G D W 2.6.28-11-generic #38-Ubuntu
Apr 2 20:50:27 aethereal kernel: [91025.958472] RIP: 0010:[<ffffffff8041c2db>]
 [<ffffffff8041c2db>] rb_next+0x2b/0x60
Apr 2 20:50:27 aethereal kernel: [91025.958483] RSP: 0018:ffff88010d8e3c08 EFL
AGS: 00010202
Apr 2 20:50:27 aethereal kernel: [91025.958486] RAX: 39eac016a66d81b9 RBX: ffff
c200060b1000 RCX: ffff88011dd61b18
Apr 2 20:50:27 aethereal kernel: [91025.958489] RDX: 39eac016a66d81b9 RSI: ffff88007f6fc499 RDI: ffff88011dd61b18
Apr 2 20:50:27 aethereal kernel: [91025.958493] RBP: ffff88010d8e3c08 R08: 00000000ffffffff R09: 000000000000013e
Apr 2 20:50:27 aethereal kernel: [91025.958496] R10: 0000000000000000 R11: 0000000000000246 R12: ffffc20000000000
Apr 2 20:50:27 aethereal kernel: [91025.958499] R13: ffffffffffffffff R14: ffffe1ffffffffff R15: 0000000000002000
Apr 2 20:50:27 aethereal kernel: [91025.958503] FS: 00007fb3eb971950(0000) GS:ffffffff80aa3000(0000) knlGS:0000000000000000
Apr 2 20:50:27 aethereal kernel: [91025.958507] CS: 0010 DS: 002b ES: 002b CR0: 000000008005003b
Apr 2 20:50:27 aethereal kernel: [91025.958510] CR2: 0000000003e59000 CR3: 000000010d10c000 CR4: 00000000000026a0
Apr 2 20:50:27 aethereal kernel: [91025.958514] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
Apr 2 20:50:27 aethereal kernel: [91025.958517] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Apr 2 20:50:27 aethereal kernel: [91025.958521] Process kvm (pid: 15183, threadinfo ffff88010d8e2000, task ffff880081769660)
Apr 2 20:50:27 aethereal kernel:...

Read more...

Revision history for this message
Michael Robinson (robinson-netrinsics) wrote :
Download full text (7.2 KiB)

And another:
Apr 4 23:20:40 aethereal kernel: [41416.180518] kvm: 5987: cpu0 unhandled rdmsr
: 0xc0010117
Apr 4 23:20:40 aethereal kernel: [41416.180575] kvm: 5987: cpu0 unhandled wrmsr
: 0xc0010117 data 0
Apr 4 23:20:40 aethereal kernel: [41416.180649] kvm: 5987: cpu0 unhandled rdmsr
: 0xc0010117
Apr 4 23:21:08 aethereal kernel: [41443.436700] __ratelimit: 3501 callbacks suppressed
Apr 4 23:21:08 aethereal kernel: [41443.436704] kvm: 27319: cpu0 unhandled wrmsr: 0xc0010117 data 0
Apr 4 23:37:16 aethereal kernel: [42411.704410] rmap_remove: ffff880119bcb000 2d7d9a6c65342fe1 0->BUG
Apr 4 23:37:16 aethereal kernel: [42411.704478] ------------[ cut here ]------------
Apr 4 23:37:16 aethereal kernel: [42411.704483] kernel BUG at /build/buildd/linux-2.6.28/arch/x86/kvm/mmu.c:560!
Apr 4 23:37:16 aethereal kernel: [42411.704489] invalid opcode: 0000 [#1] SMP
Apr 4 23:37:16 aethereal kernel: [42411.704497] last sysfs file: /sys/devices/pci0000:00/0000:00:1c.1/0000:0c:00.0/rfkill/rfkill0/state
Apr 4 23:37:16 aethereal kernel: [42411.704503] Dumping ftrace buffer:
Apr 4 23:37:16 aethereal kernel: [42411.704509] (ftrace buffer empty)
Apr 4 23:37:16 aethereal kernel: [42411.704512] CPU 0
Apr 4 23:37:16 aethereal kernel: [42411.704517] Modules linked in: binfmt_misci915 drm ppdev bridge stp bnep input_polldev kvm_intel kvm snd_hwdep sbp2 lp parport snd_hda_intel arc4 ecb snd_pcm_oss snd_mixer_oss snd_pcm iwlagn iwlcore snd_seq_dummy pata_pcmcia snd_seq_oss snd_seq_midi led_class snd_rawmidi snd_seq_midi_event snd_seq snd_timer snd_seq_device mac80211 psmouse pcmcia snd soundcoreserio_raw pcspkr yenta_socket rsrc_nonstatic pcmcia_core iTCO_wdt iTCO_vendor_support joydev dcdbas btusb snd_page_alloc cfg80211 sha256_generic aes_x86_64 aes_generic cbc dm_crypt fbcon tileblit font bitblit softcursor squashfs unionfs nls_iso8859_1 nls_cp437 vfat fat usbhid usb_storage ohci1394 ieee1394 tg3 video output intel_agp
Apr 4 23:37:16 aethereal kernel: [42411.704635] Pid: 27320, comm: kvm Not tainted 2.6.28-11-generic #39-Ubuntu
Apr 4 23:37:16 aethereal kernel: [42411.704640] RIP: 0010:[<ffffffffa03e1cbe>] [<ffffffffa03e1cbe>] rmap_remove+0x21e/0x230 [kvm]
Apr 4 23:37:16 aethereal kernel: [42411.704673] RSP: 0018:ffff88011e539ba8 EFLAGS: 00010296
Apr 4 23:37:16 aethereal kernel: [42411.704678] RAX: 0000000000000048 RBX: 000000d9a6c65342 RCX: 0000000000000001
Apr 4 23:37:16 aethereal kernel: [42411.704683] RDX: ffff8800a75bf000 RSI: 0000000000000086 RDI: 0000000000000296
Apr 4 23:37:16 aethereal kernel: [42411.704689] RBP: ffff88011e539bc8 R08: 0000000000000006 R09: 0000000000000000
Apr 4 23:37:16 aethereal kernel: [42411.704694] R10: ffff88011e539a56 R11: ffff88011e539a48 R12: ffff880119bcb000
Apr 4 23:37:16 aethereal kernel: [42411.704698] R13: ffff88004e15aa00 R14: ffff88011b5b8000 R15: ffff88011e539c18
Apr 4 23:37:16 aethereal kernel: [42411.704705] FS: 00007f6016d84950(0000) GS:ffffffff80aa3000(0000) knlGS:0000000000000000
Apr 4 23:37:16 aethereal kernel: [42411.704710] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
Apr 4 23:37:16 aethereal kernel: [42411.704715] CR2: 000000007c80ddf5 CR3: 000000010246b000 CR4: 00000000000026a0
Apr ...

Read more...

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.