[libvirt] libvirtd crash with host cpu model qemu64

[Jim Fehlig]

I have an L1 nested VM with the following cpu

# lscpu
Architecture:          x86_64
CPU op-mode(s):        32-bit, 64-bit
Byte Order:            Little Endian
CPU(s):                2
On-line CPU(s) list:   0,1
Thread(s) per core:    1
Core(s) per socket:    1
Socket(s):             2
NUMA node(s):          1
Vendor ID:             AuthenticAMD
CPU family:            6
Model:                 2
Model name:            QEMU Virtual CPU version 0.14
Stepping:              3
CPU MHz:               3092.210
BogoMIPS:              6184.42
Virtualization:        AMD-V
Hypervisor vendor:     KVM
Virtualization type:   full
L1d cache:             64K
L1i cache:             64K
L2 cache:              512K
NUMA node0 CPU(s):     0,1
Flags:                 fpu de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov
pat pse36 clflush mmx fxsr sse sse2 syscall nx lm nopl pni cx16 popcnt
hypervisor lahf_lm svm abm sse4a 3dnowprefetch vmmcall

When starting an L2 VM with <cpu mode="host-model">, libvirtd in the L1 VM crashes

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff739bf33 in x86DataCpuid (cpuid=0x8, cpuid=0x8,
    data=data at entry=0x7fffb800ee78) at cpu/cpu_x86.c:287
287         for (i = 0; i < data->len; i++) {
(gdb) bt
f0  0x00007ffff739bf33 in x86DataCpuid (cpuid=0x8, cpuid=0x8,
    data=data at entry=0x7fffb800ee78) at cpu/cpu_x86.c:287
f1  virCPUx86DataAddCPUID (data=data at entry=0x7fffb800ee78, cpuid=0x8)
    at cpu/cpu_x86.c:355
f2  0x00007ffff739ef47 in x86Compute (host=<optimized out>, cpu=0x7fffb8000cc0,
    guest=0x7fffecca7348, message=<optimized out>) at cpu/cpu_x86.c:1580
f3  0x00007fffd2b38e53 in qemuBuildCpuModelArgStr (migrating=false,
    hasHwVirt=<synthetic pointer>, qemuCaps=0x7fffb8001040, buf=0x7fffecca7360,
    def=0x7fffc400ce20, driver=0x1c) at qemu/qemu_command.c:6283
f4  qemuBuildCpuCommandLine (cmd=cmd at entry=0x7fffb8002f60,
    driver=driver at entry=0x7fffc80882c0, def=def at entry=0x7fffc400ce20,
    qemuCaps=qemuCaps at entry=0x7fffb8001040, migrating=<optimized out>)
    at qemu/qemu_command.c:6445

In frame 2, &host_model->vendor->cpuid is passed to virCPUx86DataAddCPUID(),
but
   
(gdb) p *host_model
$23 = {name = 0x7fffb800ec50 "qemu64", vendor = 0x0, signature = 0, data = {
    len = 2, data = 0x7fffb800e720}}

With vendor = 0x0,  &host_model->vendor->cpuid evaluates to 8, which is not a
nice value to pass to virCPUx86DataAddCPUID(). I've hacked around the problem by
checking for a non-null host->vendor before calling
virCPUx86DataAddCPUID, but I get the feeling it is just that - a hack.

Comments on the attached patch, or suggestions for an alternate fix, are kindly
welcomed :-).

Regards,
Jim


-------------- next part --------------
A non-text attachment was scrubbed...
Name: cpumodel-vendor-crash-fix.patch
Type: text/x-diff
Size: 2413 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20160805/1aeb5e1f/attachment-0001.bin>