Bug 748810

Hi Dor,

1) Can this bug and bug 736631 be moved to 6.3?
2) This bug was just recently discovered; Have these screen dumps after vm is stopped been added only recently to the auto tests?
3) can these screen dumps be disabled during the auto tests?

Thanks,
Yonit.

Patches posted.

Reproduced on qemu-kvm-0.12.1.2-2.223.el6.x86_64:

steps:
------
1.boot guest with "-vga qxl"
2.in qemu monitor
(qemu) stop
handle_dev_stop: stop
(qemu) screendump /root/sd1
handle_dev_update: ASSERT worker->running failed
...
/usr/lib64/libspice-server.so.1(+0xbe685)[0x7f8d7b9d6685]
/usr/lib64/libspice-server.so.1(+0x353f2)[0x7f8d7b94d3f2]
/usr/lib64/libspice-server.so.1(+0x1aa33)[0x7f8d7b932a33]
/usr/lib64/libspice-server.so.1(+0x33f0c)[0x7f8d7b94bf0c]
/lib64/libpthread.so.0(+0x3bf5a077f1)[0x7f8d7cc057f1]
/lib64/libc.so.6(clone+0x6d)[0x7f8d7a55a70d]
Aborted (core dumped)


Failed on qemu-kvm-0.12.1.2-2.230.el6.x86_64:

(qemu) stop
handle_dev_stop: stop
(qemu) screendump /root/sd1
handle_dev_update: ASSERT worker->running failed
Thread 17 (Thread 0x7fa6678d2700 (LWP 12988)):
#0  0x00007fa66ea5675b in pthread_cond_timedwait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0
#1  0x00007fa66f12ae07 in cond_timedwait (unused=<value optimized out>) at posix-aio-compat.c:102
#2  aio_thread (unused=<value optimized out>) at posix-aio-compat.c:329
#3  0x00007fa66ea527f1 in start_thread () from /lib64/libpthread.so.0
#4  0x00007fa66c3a770d in clone () from /lib64/libc.so.6
Thread 16 (Thread 0x7fa665d34700 (LWP 12989)):
#0  0x00007fa66c2f597d in sigtimedwait () from /lib64/libc.so.6
#1  0x00007fa66f1138b6 in kvm_main_loop_wait (env=0x7fa670c91fd0, timeout=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:1858
#2  0x00007fa66f113eed in kvm_main_loop_cpu (_env=0x7fa670c91fd0) at /usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:1994
#3  ap_main_loop (_env=0x7fa670c91fd0) at /usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:2041
#4  0x00007fa66ea527f1 in start_thread () from /lib64/libpthread.so.0
#5  0x00007fa66c3a770d in clone () from /lib64/libc.so.6
Thread 15 (Thread 0x7fa665333700 (LWP 12990)):
#0  0x00007fa66c2f597d in sigtimedwait () from /lib64/libc.so.6
#1  0x00007fa66f1138b6 in kvm_main_loop_wait (env=0x7fa670cab010, timeout=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:1858
#2  0x00007fa66f113eed in kvm_main_loop_cpu (_env=0x7fa670cab010) at /usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:1994
#3  ap_main_loop (_env=0x7fa670cab010) at /usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:2041
#4  0x00007fa66ea527f1 in start_thread () from /lib64/libpthread.so.0
#5  0x00007fa66c3a770d in clone () from /lib64/libc.so.6
Thread 14 (Thread 0x7fa657fff700 (LWP 12991)):
#0  0x00007fa66c2f597d in sigtimedwait () from /lib64/libc.so.6
#1  0x00007fa66f1138b6 in kvm_main_loop_wait (env=0x7fa670cb8eb0, timeout=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:1858
#2  0x00007fa66f113eed in kvm_main_loop_cpu (_env=0x7fa670cb8eb0) at /usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:1994
#3  ap_main_loop (_env=0x7fa670cb8eb0) at /usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:2041
#4  0x00007fa66ea527f1 in start_thread () from /lib64/libpthread.so.0
#5  0x00007fa66c3a770d in clone () from /lib64/libc.so.6
Thread 13 (Thread 0x7fa6575fe700 (LWP 12992)):
#0  0x00007fa66c2f597d in sigtimedwait () from /lib64/libc.so.6
#1  0x00007fa66f1138b6 in kvm_main_loop_wait (env=0x7fa670cc6d50, timeout=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:1858
#2  0x00007fa66f113eed in kvm_main_loop_cpu (_env=0x7fa670cc6d50) at /usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:1994
#3  ap_main_loop (_env=0x7fa670cc6d50) at /usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:2041
#4  0x00007fa66ea527f1 in start_thread () from /lib64/libpthread.so.0
#5  0x00007fa66c3a770d in clone () from /lib64/libc.so.6
Thread 12 (Thread 0x7fa655bfc700 (LWP 12993)):
#0  0x00007fa66ea594ed in read () from /lib64/libpthread.so.0
#1  0x00007fa66d823570 in read () at /usr/include/bits/unistd.h:45
#2  spice_backtrace_gstack () at backtrace.c:97
#3  0x00007fa66d8236c5 in spice_backtrace () at backtrace.c:128
#4  0x00007fa66d79a3f2 in handle_dev_update (opaque=0x7fa655a246c0, payload=<value optimized out>) at red_worker.c:10291
#5  0x00007fa66d77fa33 in dispatcher_handle_single_read (dispatcher=0x7fa6720f2568) at dispatcher.c:120
#6  dispatcher_handle_recv_read (dispatcher=0x7fa6720f2568) at dispatcher.c:143
#7  0x00007fa66d798f0c in red_worker_main (arg=<value optimized out>) at red_worker.c:11192
#8  0x00007fa66ea527f1 in start_thread () from /lib64/libpthread.so.0
#9  0x00007fa66c3a770d in clone () from /lib64/libc.so.6
Thread 11 (Thread 0x7fa53f9fc700 (LWP 12997)):
#0  0x00007fa66ea5675b in pthread_cond_timedwait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0
#1  0x00007fa66f12ae07 in cond_timedwait (unused=<value optimized out>) at posix-aio-compat.c:102
#2  aio_thread (unused=<value optimized out>) at posix-aio-compat.c:329
#3  0x00007fa66ea527f1 in start_thread () from /lib64/libpthread.so.0
#4  0x00007fa66c3a770d in clone () from /lib64/libc.so.6
Thread 10 (Thread 0x7fa53effb700 (LWP 12998)):
#0  0x00007fa66ea5675b in pthread_cond_timedwait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0
#1  0x00007fa66f12ae07 in cond_timedwait (unused=<value optimized out>) at posix-aio-compat.c:102
#2  aio_thread (unused=<value optimized out>) at posix-aio-compat.c:329
#3  0x00007fa66ea527f1 in start_thread () from /lib64/libpthread.so.0
#4  0x00007fa66c3a770d in clone () from /lib64/libc.so.6
Thread 9 (Thread 0x7fa53e5fa700 (LWP 12999)):
#0  0x00007fa66ea5675b in pthread_cond_timedwait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0
#1  0x00007fa66f12ae07 in cond_timedwait (unused=<value optimized out>) at posix-aio-compat.c:102
#2  aio_thread (unused=<value optimized out>) at posix-aio-compat.c:329
#3  0x00007fa66ea527f1 in start_thread () from /lib64/libpthread.so.0
#4  0x00007fa66c3a770d in clone () from /lib64/libc.so.6
Thread 8 (Thread 0x7fa53dbf9700 (LWP 13000)):
#0  0x00007fa66ea5675b in pthread_cond_timedwait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0
#1  0x00007fa66f12ae07 in cond_timedwait (unused=<value optimized out>) at posix-aio-compat.c:102
#2  aio_thread (unused=<value optimized out>) at posix-aio-compat.c:329
#3  0x00007fa66ea527f1 in start_thread () from /lib64/libpthread.so.0
#4  0x00007fa66c3a770d in clone () from /lib64/libc.so.6
Thread 7 (Thread 0x7fa53d1f8700 (LWP 13001)):
#0  0x00007fa66ea5675b in pthread_cond_timedwait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0
#1  0x00007fa66f12ae07 in cond_timedwait (unused=<value optimized out>) at posix-aio-compat.c:102
#2  aio_thread (unused=<value optimized out>) at posix-aio-compat.c:329
#3  0x00007fa66ea527f1 in start_thread () from /lib64/libpthread.so.0
#4  0x00007fa66c3a770d in clone () from /lib64/libc.so.6
Thread 6 (Thread 0x7fa53c7f7700 (LWP 13002)):
#0  0x00007fa66ea5675b in pthread_cond_timedwait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0
#1  0x00007fa66f12ae07 in cond_timedwait (unused=<value optimized out>) at posix-aio-compat.c:102
#2  aio_thread (unused=<value optimized out>) at posix-aio-compat.c:329
#3  0x00007fa66ea527f1 in start_thread () from /lib64/libpthread.so.0
#4  0x00007fa66c3a770d in clone () from /lib64/libc.so.6
Thread 5 (Thread 0x7fa53bdf6700 (LWP 13003)):
#0  0x00007fa66ea5675b in pthread_cond_timedwait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0
#1  0x00007fa66f12ae07 in cond_timedwait (unused=<value optimized out>) at posix-aio-compat.c:102
#2  aio_thread (unused=<value optimized out>) at posix-aio-compat.c:329 out>) at /usr/include/bits/unistd.h:45
#2  read_safe (fd=21, buf=0x7fff98d39f1c, size=4, block=<value optimized out>) at dispatcher.c:57
#3  0x00007fa66d77f8e6 in dispatcher_send_message (dispatcher=0x7fa6720f2568, message_type=1, payload=0x7fff98d39f50) at dispatcher.c:169
#4  0x00007fa66d7800bf in red_dispatcher_update_area (qxl_worker=<value optimized out>, surface_id=<value optimized out>, qxl_area=<value optimized out>, qxl_dirty_rects=<value optimized out>, num_dirty_rects=<value optimized out>, clear_dirty_region=<value optimized out>) at red_dispatcher.c:299
#5  qxl_worker_update_area (qxl_worker=<value optimized out>, surface_id=<value optimized out>, qxl_area=<value optimized out>, qxl_dirty_rects=<value optimized out>, num_dirty_rects=<value optimized out>, clear_dirty_region=<value optimized out>) at red_dispatcher.c:341
#6  0x00007fa66f272396 in qxl_render_update (qxl=0x7fa6720df840) at /usr/src/debug/qemu-kvm-0.12.1.2/hw/qxl-render.c:134
#7  0x00007fa66f27070a in qxl_hw_screen_dump (opaque=0x7fa6720df840, filename=0x7fa671206fe0 "/root/sd1") at /usr/src/debug/qemu-kvm-0.12.1.2/hw/qxl.c:1485
#8  0x00007fa66f1529ed in vga_hw_screen_dump (filename=<value optimized out>) at console.c:182
#9  0x00007fa66f0f78ab in do_screen_dump (mon=<value optimized out>, qdict=<value optimized out>, ret_data=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/monitor.c:1309
#10 0x00007fa66f0f7f90 in monitor_call_handler (mon=<value optimized out>, cmd=0x7fa66f5b0ed8, params=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/monitor.c:4106
#11 0x00007fa66f0fd190 in handle_user_command (mon=0x7fa670d1a010, cmdline=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/monitor.c:4143
#12 0x00007fa66f0fd2ca in monitor_command_cb (mon=0x7fa670d1a010, cmdline=<value optimized out>, opaque=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/monitor.c:4698
#13 0x00007fa66f15237d in readline_handle_byte (rs=0x7fa672148270, ch=<value optimized out>) at readline.c:369
#14 0x00007fa66f0fd4f0 in monitor_read (opaque=<value optimized out>, buf=0x7fff98d3a330 "\r", size=1) at /usr/src/debug/qemu-kvm-0.12.1.2/monitor.c:4684
#15 0x00007fa66f164fab in qemu_chr_read (opaque=0x7fa670afc600) at qemu-char.c:170
#16 fd_chr_read (opaque=0x7fa670afc600) at qemu-char.c:669
#17 0x00007fa66f0f17d0 in main_loop_wait (timeout=1000) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:4018
#18 0x00007fa66f11118a in kvm_main_loop () at /usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:2225
#19 0x00007fa66f0f340c in main_loop (argc=20, argv=<value optimized out>, envp=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:4228
#20 main (argc=20, argv=<value optimized out>, envp=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:6489
/usr/lib64/libspice-server.so.1(+0xbe685)[0x7fa66d823685]
/usr/lib64/libspice-server.so.1(+0x353f2)[0x7fa66d79a3f2]
/usr/lib64/libspice-server.so.1(+0x1aa33)[0x7fa66d77fa33]
/usr/lib64/libspice-server.so.1(+0x33f0c)[0x7fa66d798f0c]
/lib64/libpthread.so.0(+0x3bf5a077f1)[0x7fa66ea527f1]
/lib64/libc.so.6(clone+0x6d)[0x7fa66c3a770d]
Aborted (core dumped)

Hi Shaolong,

Can you please try this:

http://brewweb.devel.redhat.com/brew/taskinfo?taskID=4052823
 - qemu-kvm-0.12.1.2-2.231.el6.alon.bz748810.1

It includes the last patch that Gerd sent to qemu-devel (not to rhvirt yet):

http://patchwork.ozlabs.org/patch/141398/
[v2] qxl: don't render stuff when the vm is stopped.

Alon

(In reply to comment #13)
> Hi Shaolong,
> 
> Can you please try this:
> 
> http://brewweb.devel.redhat.com/brew/taskinfo?taskID=4052823
>  - qemu-kvm-0.12.1.2-2.231.el6.alon.bz748810.1

Hi Alon,

It works well.

Incremental fix posted.

Verify this on qemu-kvm-0.12.1.2-2.238.el6.x86_64:

With the same steps in comment 12, no crash, after resume, guest works well, verified.

Hi Gerd,
This issue also happend in qemu-kvm-0.12.1.2-2.209.el6_2.5

do you plan to fix it in z stream

Thanks & Regards
Suqin

    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Cause:
Run a guest, stop it and try to get a screen dump.

Consequence:
Qemu-kvm crashes with segmentation fault.

Fix:
Fix QXL driver to use shared buffer.

Result:
qemu-kvm doesn't crash

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0746.html