Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1752316

Summary: qemu coredump at st_save_zombie_sampler_view when booting rhel8.1 vm with virgl enabled virtio-vga
Product: Red Hat Enterprise Linux Advanced Virtualization Reporter: Guo, Zhiyi <zhguo>
Component: virglrendererAssignee: Gerd Hoffmann <kraxel>
Status: CLOSED CURRENTRELEASE QA Contact: Guo, Zhiyi <zhguo>
Severity: high Docs Contact:
Priority: high    
Version: 8.1CC: airlied, areis, coli, jinzhao, juzhang, kraxel, marcandre.lureau, virt-maint
Target Milestone: rcKeywords: TestOnly
Target Release: ---Flags: knoel: mirror+
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-01-08 16:54:22 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1790860    
Bug Blocks:    

Description Guo, Zhiyi 2019-09-16 02:42:45 UTC
Description of problem:
qemu coredump at st_save_zombie_sampler_view when booting rhel8.1 vm with virgl enabled virtio-vga

Version-Release number of selected component (if applicable):
qemu-kvm-4.1.0-9.module+el8.1.0+4210+23b2046a.x86_64
4.18.0-144.el8.x86_64(host & VM)
mesa-dri-drivers-19.1.4-2.el8.x86_64
mesa-libEGL-19.1.4-2.el8.x86_64
mesa-libGL-19.1.4-2.el8.x86_64
virglrenderer-0.6.0-5.20180814git491d3b705.module+el8.1.0+3523+b348b848.x86_64

Host gpu used:
03:00.0 VGA compatible controller: Advanced Micro Devices, Inc. [AMD/ATI] Lexa XT [Radeon PRO WX 3100]


How reproducible:
10%

Steps to Reproduce:
1.Boot rhel8.1 vm with libvirt xml:
...
    <graphics type='spice' port='5900' autoport='yes' listen='0.0.0.0'>
      <listen type='address' address='0.0.0.0'/>
      <image compression='off'/>
    </graphics>
    <graphics type='egl-headless'>
      <gl rendernode='/dev/dri/renderD128'/>
    </graphics>
    <sound model='ich9'>
      <alias name='sound0'/>
      <address type='pci' domain='0x0000' bus='0x00' slot='0x1b' function='0x0'/>
    </sound>
    <video>
      <model type='virtio' heads='1' primary='yes'>
        <acceleration accel3d='yes'/>
      </model>
      <alias name='video0'/>
      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/>
    </video>
...
2.
3.

Actual results:
qemu crash with trace:
(gdb) bt
#0  0x00007fedf7315cff in st_save_zombie_sampler_view () from target:/usr/lib64/dri/radeonsi_dri.so
#1  0x00007fedf722e925 in st_texture_release_all_sampler_views.part () from target:/usr/lib64/dri/radeonsi_dri.so
#2  0x00007fedf722eeb9 in st_delete_texture_sampler_views () from target:/usr/lib64/dri/radeonsi_dri.so
#3  0x00007fedf721c7e7 in st_DeleteTextureObject () from target:/usr/lib64/dri/radeonsi_dri.so
#4  0x00007fedf71ec250 in _mesa_reference_texobj_ () from target:/usr/lib64/dri/radeonsi_dri.so
#5  0x00007fedf71ef08f in _mesa_update_texture_state () from target:/usr/lib64/dri/radeonsi_dri.so
#6  0x00007fedf71d4288 in _mesa_update_state_locked () from target:/usr/lib64/dri/radeonsi_dri.so
#7  0x00007fedf71d42a5 in _mesa_update_state () from target:/usr/lib64/dri/radeonsi_dri.so
#8  0x00007fedf725b285 in _mesa_valid_to_render () from target:/usr/lib64/dri/radeonsi_dri.so
#9  0x00007fedf725b3d1 in check_valid_to_render () from target:/usr/lib64/dri/radeonsi_dri.so
#10 0x00007fedf725bc3b in validate_draw_arrays.constprop () from target:/usr/lib64/dri/radeonsi_dri.so
#11 0x00007fedf73ad9e5 in _mesa_DrawArrays () from target:/usr/lib64/dri/radeonsi_dri.so
#12 0x00007ff01db94de7 in vrend_renderer_blit_gl (ctx=ctx@entry=0x557c90620220, src_res=src_res@entry=0x557c90ab9070, dst_res=dst_res@entry=0x557c90ab9070, 
    info=info@entry=0x7fffcc0dff70, has_texture_srgb_decode=<optimized out>) at vrend_blitter.c:839
#13 0x00007ff01db7a7ff in vrend_renderer_blit_int (info=0x7fffcc0dff70, dst_res=0x557c90ab9070, src_res=0x557c90ab9070, ctx=0x557c90620220) at vrend_renderer.c:7161
#14 vrend_renderer_blit (ctx=0x557c90620220, dst_handle=<optimized out>, src_handle=<optimized out>, info=info@entry=0x7fffcc0dff70) at vrend_renderer.c:7350
#15 0x00007ff01db92317 in vrend_decode_blit (length=21, ctx=0x557c90545580) at vrend_decode.c:978
#16 vrend_decode_block (ctx_id=<optimized out>, block=block@entry=0x557c91eb5900, ndw=<optimized out>) at vrend_decode.c:1381
#17 0x00007ff01db6c5a1 in virgl_renderer_submit_cmd (buffer=buffer@entry=0x557c91eb5900, ctx_id=<optimized out>, ndw=<optimized out>) at virglrenderer.c:100
#18 0x0000557c8e22114b in virgl_cmd_submit_3d (cmd=0x557c920998c0, g=0x557c91157e20)
    at /usr/src/debug/qemu-kvm-4.1.0-9.module+el8.1.0+4210+23b2046a.x86_64/hw/display/virtio-gpu-3d.c:218
#19 virtio_gpu_virgl_process_cmd (g=g@entry=0x557c91157e20, cmd=cmd@entry=0x557c920998c0)
    at /usr/src/debug/qemu-kvm-4.1.0-9.module+el8.1.0+4210+23b2046a.x86_64/hw/display/virtio-gpu-3d.c:423
#20 0x0000557c8e21eac0 in virtio_gpu_process_cmdq (g=g@entry=0x557c91157e20) at /usr/src/debug/qemu-kvm-4.1.0-9.module+el8.1.0+4210+23b2046a.x86_64/hw/display/virtio-gpu.c:817
#21 0x0000557c8e21fd42 in virtio_gpu_handle_ctrl (vq=0x7ff0098ae010, vdev=<optimized out>)
    at /usr/src/debug/qemu-kvm-4.1.0-9.module+el8.1.0+4210+23b2046a.x86_64/hw/display/virtio-gpu.c:878
#22 virtio_gpu_ctrl_bh (opaque=<optimized out>) at /usr/src/debug/qemu-kvm-4.1.0-9.module+el8.1.0+4210+23b2046a.x86_64/hw/display/virtio-gpu.c:890
#23 0x0000557c8e4f1fb6 in aio_bh_call (bh=0x557c9126ecf0) at util/async.c:117
#24 aio_bh_poll (ctx=ctx@entry=0x557c8fc39c80) at util/async.c:117
#25 0x0000557c8e4f53f4 in aio_dispatch (ctx=0x557c8fc39c80) at util/aio-posix.c:459
#26 0x0000557c8e4f1e92 in aio_ctx_dispatch (source=<optimized out>, callback=<optimized out>, user_data=<optimized out>) at util/async.c:260
#27 0x00007ff01d42e67d in g_main_context_dispatch () from target:/lib64/libglib-2.0.so.0
#28 0x0000557c8e4f44a8 in glib_pollfds_poll () at util/main-loop.c:218
#29 os_host_main_loop_wait (timeout=<optimized out>) at util/main-loop.c:241
#30 main_loop_wait (nonblocking=<optimized out>) at util/main-loop.c:517
#31 0x0000557c8e2dd2b9 in main_loop () at vl.c:1809
#32 0x0000557c8e18b923 in main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at vl.c:4506


Expected results:
No crash happen

Additional info:

Comment 1 Guo, Zhiyi 2019-09-16 03:28:49 UTC
Can also reproduce this issue with nvidia gpu, call trace looks similar as amd:
(gdb) bt
#0  0x00007f0007315cff in st_save_zombie_sampler_view () from target:/usr/lib64/dri/nouveau_dri.so
#1  0x00007f000722e925 in st_texture_release_all_sampler_views.part () from target:/usr/lib64/dri/nouveau_dri.so
#2  0x00007f000722eeb9 in st_delete_texture_sampler_views () from target:/usr/lib64/dri/nouveau_dri.so
#3  0x00007f000721c7e7 in st_DeleteTextureObject () from target:/usr/lib64/dri/nouveau_dri.so
#4  0x00007f00071ec250 in _mesa_reference_texobj_ () from target:/usr/lib64/dri/nouveau_dri.so
#5  0x00007f00071ef08f in _mesa_update_texture_state () from target:/usr/lib64/dri/nouveau_dri.so
#6  0x00007f00071d4288 in _mesa_update_state_locked () from target:/usr/lib64/dri/nouveau_dri.so
#7  0x00007f00071d42a5 in _mesa_update_state () from target:/usr/lib64/dri/nouveau_dri.so
#8  0x00007f000725b285 in _mesa_valid_to_render () from target:/usr/lib64/dri/nouveau_dri.so
#9  0x00007f000725b3d1 in check_valid_to_render () from target:/usr/lib64/dri/nouveau_dri.so
#10 0x00007f000725bc3b in validate_draw_arrays.constprop () from target:/usr/lib64/dri/nouveau_dri.so
#11 0x00007f00073ad9e5 in _mesa_DrawArrays () from target:/usr/lib64/dri/nouveau_dri.so
#12 0x00007f022db7ade7 in vrend_renderer_blit_gl (ctx=ctx@entry=0x558da112e760, src_res=src_res@entry=0x558da09348a0, dst_res=dst_res@entry=0x558da09348a0, 
    info=info@entry=0x7ffdc64684a0, has_texture_srgb_decode=<optimized out>) at vrend_blitter.c:839
#13 0x00007f022db607ff in vrend_renderer_blit_int (info=0x7ffdc64684a0, dst_res=0x558da09348a0, src_res=0x558da09348a0, ctx=0x558da112e760) at vrend_renderer.c:7161
#14 vrend_renderer_blit (ctx=0x558da112e760, dst_handle=<optimized out>, src_handle=<optimized out>, info=info@entry=0x7ffdc64684a0) at vrend_renderer.c:7350
#15 0x00007f022db78317 in vrend_decode_blit (length=21, ctx=0x558da05349a0) at vrend_decode.c:978
#16 vrend_decode_block (ctx_id=<optimized out>, block=block@entry=0x558da0a64dc0, ndw=<optimized out>) at vrend_decode.c:1381
#17 0x00007f022db525a1 in virgl_renderer_submit_cmd (buffer=buffer@entry=0x558da0a64dc0, ctx_id=<optimized out>, ndw=<optimized out>) at virglrenderer.c:100
#18 0x0000558d9e27114b in virgl_cmd_submit_3d (cmd=0x558da0ed6820, g=0x558da177c4b0)
    at /usr/src/debug/qemu-kvm-4.1.0-9.module+el8.1.0+4210+23b2046a.x86_64/hw/display/virtio-gpu-3d.c:218
#19 virtio_gpu_virgl_process_cmd (g=g@entry=0x558da177c4b0, cmd=cmd@entry=0x558da0ed6820)
    at /usr/src/debug/qemu-kvm-4.1.0-9.module+el8.1.0+4210+23b2046a.x86_64/hw/display/virtio-gpu-3d.c:423
#20 0x0000558d9e26eac0 in virtio_gpu_process_cmdq (g=g@entry=0x558da177c4b0) at /usr/src/debug/qemu-kvm-4.1.0-9.module+el8.1.0+4210+23b2046a.x86_64/hw/display/virtio-gpu.c:817
#21 0x0000558d9e26fd42 in virtio_gpu_handle_ctrl (vq=0x7f021988d010, vdev=<optimized out>)
    at /usr/src/debug/qemu-kvm-4.1.0-9.module+el8.1.0+4210+23b2046a.x86_64/hw/display/virtio-gpu.c:878
#22 virtio_gpu_ctrl_bh (opaque=<optimized out>) at /usr/src/debug/qemu-kvm-4.1.0-9.module+el8.1.0+4210+23b2046a.x86_64/hw/display/virtio-gpu.c:890
#23 0x0000558d9e541fb6 in aio_bh_call (bh=0x558da18935a0) at util/async.c:117
#24 aio_bh_poll (ctx=ctx@entry=0x558da025ec80) at util/async.c:117
#25 0x0000558d9e5453f4 in aio_dispatch (ctx=0x558da025ec80) at util/aio-posix.c:459
#26 0x0000558d9e541e92 in aio_ctx_dispatch (source=<optimized out>, callback=<optimized out>, user_data=<optimized out>) at util/async.c:260
#27 0x00007f022d41467d in g_main_context_dispatch () from target:/lib64/libglib-2.0.so.0
#28 0x0000558d9e5444a8 in glib_pollfds_poll () at util/main-loop.c:218
#29 os_host_main_loop_wait (timeout=<optimized out>) at util/main-loop.c:241
#30 main_loop_wait (nonblocking=<optimized out>) at util/main-loop.c:517
#31 0x0000558d9e32d2b9 in main_loop () at vl.c:1809
#32 0x0000558d9e1db923 in main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at vl.c:4506

Comment 2 Guo, Zhiyi 2019-09-16 03:46:24 UTC
Not quite sure this is a qemu-kvm bug since crash seems occur from mesa side(maybe Dave should have a look first)

Gerd, could you help to move to the correct component?

BR/
Zhiyi

Comment 3 Guo, Zhiyi 2019-09-16 03:57:54 UTC
This issue seems not able to reproduce with intel gpu as backend

Comment 4 Dave Airlie 2019-09-16 06:45:21 UTC
https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/278

Upstream we need to rebase to 0.8.0 release to fix this.

Comment 14 Guo, Zhiyi 2020-02-07 02:30:44 UTC
Test against qemu-kvm-4.2.0-8.module+el8.2.0+5607+dc756904.x86_64 and virglrenderer-0.8.1-1.module+el8.2.0+5515+afa04555.x86_64

No such issue happen during 20 times boot & shutdown. mark the issue as verified

Comment 16 Jeff Nelson 2021-01-08 16:54:22 UTC
Changing this TestOnly BZ as CLOSED CURRENTRELEASE. Please reopen if the issue is not resolved.