Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 952447

Summary: qemu crashes when rebooting the guest: Spice-ERROR **: red_parse_qxl.c:1009:red_get_native_drawable: unknown type 127
Product: Red Hat Enterprise Linux 6 Reporter: ShupingCui <scui>
Component: spice-serverAssignee: Uri Lublin <uril>
Status: CLOSED DUPLICATE QA Contact: Desktop QE <desktop-qa-list>
Severity: medium Docs Contact:
Priority: medium    
Version: 6.5CC: acathrow, bsarathy, cfergeau, dblechte, juzhang, marcandre.lureau, mazhang, michen, mkenneth, qzhang, virt-maint
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-06-18 22:29:30 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description ShupingCui 2013-04-16 01:57:59 UTC 
Description of problem:

qemu crashes when rebooting the guest: Spice-ERROR **: red_parse_qxl.c:1009:red_get_native_drawable: unknown type 127

Version-Release number of selected component (if applicable):

Host:
qemu-kvm-rhev-0.12.1.2-2.360.el6.x86_64
kernel-2.6.32-358.2.1.el6.x86_64
seabios-0.6.1.2-26.el6.x86_64
sgabios-bin-0-0.3.20110621svn.el6.noarch
spice-server-0.12.0-12.el6.x86_64
vgabios-0.6b-3.7.el6.noarch

Guest:
RHEL.6.4.64

How reproducible:
Only once

Steps to Reproduce:
1. boot guest with spice qxl
/usr/local/staf/test/RHEV/kvm-new/autotest/client/tests/kvm/qemu -name 'vm1' -nodefaults -chardev socket,id=qmp_monitor_id_qmpmonitor1,path=/tmp/monitor-qmpmonitor1-20130412-192541-xww9,server,nowait -mon chardev=qmp_monitor_id_qmpmonitor1,mode=control -chardev socket,id=serial_id_20130412-192541-xww9,path=/tmp/serial-20130412-192541-xww9,server,nowait -device isa-serial,chardev=serial_id_20130412-192541-xww9 -device ich9-usb-uhci1,id=usb1,bus=pci.0,addr=0x4 -drive file='/usr/local/staf/test/RHEV/kvm-new/autotest/client/tests/kvm/images/RHEL-Server-6.4-64-virtio.qcow2',if=none,id=drive-virtio-disk1,media=disk,cache=none,boot=off,snapshot=off,format=qcow2,aio=native -device virtio-blk-pci,bus=pci.0,addr=0x5,drive=drive-virtio-disk1,id=virtio-disk1 -device virtio-net-pci,netdev=idotSGWW,mac=9a:32:48:c7:37:40,id=ndev00idotSGWW,bus=pci.0,addr=0x3 -netdev tap,id=idotSGWW,vhost=on,fd=26 -m 2048 -smp 1,cores=0,threads=1,sockets=2 -cpu 'Opteron_G2' -device usb-tablet,id=usb-tablet1,bus=usb1.0,port=1 -spice port=3000,password=123456,addr=0,tls-port=3200,x509-dir=/tmp/spice_x509d,tls-channel=main,tls-channel=inputs,image-compression=auto_glz,jpeg-wan-compression=auto,zlib-glz-wan-compression=auto,streaming-video=all,agent-mouse=on,playback-compression=on,ipv4 -vga qxl -global qxl-vga.vram_size=33554432 -rtc base=utc,clock=host,driftfix=slew -M rhel6.4.0 -boot order=cdn,once=c,menu=off    -no-kvm-pit-reinjection -enable-kvm 

2. login guest and reboot
3.
  
Actual results:
qemu crashes

Expected results:
guest work well, no core dump

Additional info:

(/usr/local/staf/test/RHEV/kvm-new/autotest/client/tests/kvm/qemu:8938): Spice-ERROR **: red_parse_qxl.c:1009:red_get_native_drawable: unknown type 127
Thread 4 (Thread 0x7fc060a8c700 (LWP 8942)):
#0  0x00007fc069d0f054 in __lll_lock_wait () from /lib64/libpthread.so.0
#1  0x00007fc069d0a388 in _L_lock_854 () from /lib64/libpthread.so.0
#2  0x00007fc069d0a257 in pthread_mutex_lock () from /lib64/libpthread.so.0
#3  0x00007fc06a3d360a in kvm_main_loop_wait (env=0x7fc06c34a610, timeout=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:1874
#4  0x00007fc06a3d3c5d in kvm_main_loop_cpu (_env=0x7fc06c34a610) at /usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:2007
#5  ap_main_loop (_env=0x7fc06c34a610) at /usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:2060
#6  0x00007fc069d08851 in start_thread () from /lib64/libpthread.so.0
#7  0x00007fc067dc790d in clone () from /lib64/libc.so.6
Thread 3 (Thread 0x7fc058bc4700 (LWP 8943)):
#0  0x00007fc069d0f54d in read () from /lib64/libpthread.so.0
#1  0x00007fc068563c20 in read () at /usr/include/bits/unistd.h:45
#2  spice_backtrace_gstack () at backtrace.c:100
#3  0x00007fc06856bd50 in spice_logv (log_domain=0x7fc0685e2d6e "Spice", log_level=SPICE_LOG_LEVEL_ERROR, strloc=0x7fc0685e6b30 "red_parse_qxl.c:1009", function=0x7fc0685e6fa0 "red_get_native_drawable", format=0x7fc0685e6912 "unknown type %d", args=0x7fc058bc3850) at log.c:108
#4  0x00007fc06856be8a in spice_log (log_domain=<value optimized out>, log_level=<value optimized out>, strloc=<value optimized out>, function=<value optimized out>, format=<value optimized out>) at log.c:123
#5  0x00007fc06852e5db in red_get_native_drawable (slots=0x7fbfc81d3f18, group_id=1, red=0x7fbfc821dc00, addr=<value optimized out>, flags=0) at red_parse_qxl.c:1009
#6  red_get_drawable (slots=0x7fbfc81d3f18, group_id=1, red=0x7fbfc821dc00, addr=<value optimized out>, flags=0) at red_parse_qxl.c:1110
#7  0x00007fc06854765b in red_process_commands (worker=0x7fbfc80008c0, ring_is_empty=0x7fc058bc3bdc, max_pipe_size=50) at red_worker.c:4935
#8  0x00007fc06854aaca in red_worker_main (arg=<value optimized out>) at red_worker.c:11858
#9  0x00007fc069d08851 in start_thread () from /lib64/libpthread.so.0
#10 0x00007fc067dc790d in clone () from /lib64/libc.so.6
Thread 2 (Thread 0x7fc06262a700 (LWP 8957)):
#0  0x00007fc069d0c7bb in pthread_cond_timedwait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0
#1  0x00007fc06a3f06f7 in cond_timedwait (unused=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/posix-aio-compat.c:102
#2  aio_thread (unused=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/posix-aio-compat.c:329
#3  0x00007fc069d08851 in start_thread () from /lib64/libpthread.so.0
#4  0x00007fc067dc790d in clone () from /lib64/libc.so.6
Thread 1 (Thread 0x7fc06a323980 (LWP 8938)):
#0  0x00007fc069d0f54d in read () from /lib64/libpthread.so.0
#1  0x00007fc068529933 in read (fd=45, buf=0x7fff408448fc "\300\177", size=4, block=<value optimized out>) at /usr/include/bits/unistd.h:45
#2  read_safe (fd=45, buf=0x7fff408448fc "\300\177", size=4, block=<value optimized out>) at dispatcher.c:76
#3  0x00007fc068529b66 in dispatcher_send_message (dispatcher=0x7fc06c373698, message_type=16, payload=0x7fff40844930) at dispatcher.c:188
#4  0x00007fc06852a17c in red_dispatcher_add_memslot (qxl_worker=<value optimized out>, mem_slot=<value optimized out>) at red_dispatcher.c:393
#5  qxl_worker_add_memslot (qxl_worker=<value optimized out>, mem_slot=<value optimized out>) at red_dispatcher.c:400
#6  0x00007fc06a43f365 in qemu_spice_create_host_memslot (ssd=0x7fc06cd6cab0) at /usr/src/debug/qemu-kvm-0.12.1.2/ui/spice-display.c:333
#7  0x00007fc06a544ac9 in qxl_hard_reset (d=0x7fc06cd6c840, loadvm=0) at /usr/src/debug/qemu-kvm-0.12.1.2/hw/qxl.c:1108
#8  0x00007fc06a3ac482 in qemu_system_reset (report=true) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:3332
#9  0x00007fc06a3d0c90 in qemu_kvm_system_reset (report=true) at /usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:1978
#10 0x00007fc06a3d0e93 in kvm_main_loop () at /usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:2258
#11 0x00007fc06a3b1488 in main_loop (argc=44, argv=<value optimized out>, envp=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:4187
#12 main (argc=44, argv=<value optimized out>, envp=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:6526
Comment 2 Uri Lublin 2013-08-14 12:30:31 UTC 
This bug looks similar to bug 995931
Comment 3 RHEL Program Management 2013-10-14 03:49:00 UTC 
This request was not resolved in time for the current release.
Red Hat invites you to ask your support representative to
propose this request, if still desired, for consideration in
the next release of Red Hat Enterprise Linux.
Comment 4 Marc-Andre Lureau 2014-06-18 22:29:30 UTC 
I fully agree with Uri, it's a reboot crash in red_process_commands() probably for the same reason described in bug 995931. Imho, given that those are similar not reproducible crashes, it should be closed as dup of bug 995931.

*** This bug has been marked as a duplicate of bug 995931 ***