Bug 997772 - Spice-CRITICAL **: red_memslots.c:94:validate_virt: virtual address out of range
Spice-CRITICAL **: red_memslots.c:94:validate_virt: virtual address out of range
Status: CLOSED WONTFIX
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: qemu-kvm (Show other bugs)
6.5
Unspecified Unspecified
medium Severity medium
: rc
: ---
Assigned To: Gerd Hoffmann
Virtualization Bugs
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2013-08-16 04:01 EDT by Chao Yang
Modified: 2014-06-09 22:16 EDT (History)
12 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2014-03-27 05:43:09 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Chao Yang 2013-08-16 04:01:52 EDT
Description of problem:
Installed a windows 7 x86_64 guest in rhevm, it got crashed while keeping reboot in a loop.

Version-Release number of selected component (if applicable):
qemu-kvm-rhev-0.12.1.2-2.390.el6.x86_64
spice-server-0.12.4-2.el6.x86_64

How reproducible:
1/1

Steps to Reproduce:
1. install a windows 7 x86_64 guest with spice protocol
2. connect to graphic server through clicking 'Console' button 
3. keep rebooting guest

Actual results:
It got crashed.
There are a lot of messages like:

((null):7440): SpiceWorker-Warning **: red_worker.c:1287:validate_surface: failed on 12
((null):7440): SpiceWorker-Warning **: red_worker.c:1288:validate_surface: condition `!worker->surfaces[surface_id].context.canvas' reached
((null):7440): SpiceWorker-Warning **: red_worker.c:157:rendering_incorrect: rendering incorrect from now on: get_drawable
((null):7440): SpiceWorker-Warning **: red_worker.c:157:rendering_incorrect: rendering incorrect from now on: failed to get_drawable

And finally it crashed on:

id 0, group 0, virt start 0, virt end ffffffffffffffff, generation 0, delta 0
((null):7440): Spice-CRITICAL **: red_memslots.c:94:validate_virt: virtual address out of range
    virt=0x1b01c08+0xbf slot_id=1 group_id=1
    slot=0x0-0x0 delta=0x0
qemu-kvm: /builddir/build/BUILD/qemu-kvm-0.12.1.2/hw/qxl.c:1061: qxl_check_state: Assertion `!spice_display_running || ((&ram->cmd_ring)->cons == (&ram->cmd_ring)->prod)' failed.
2013-08-16 06:06:52.398+0000: shutting down


Expected results:


Additional info:
Comment 2 Gerd Hoffmann 2013-08-27 02:48:04 EDT
Does it happen with RHEL-6.4 too?
What is the guest driver version?
Comment 3 Chao Yang 2013-08-27 04:17:42 EDT
(In reply to Gerd Hoffmann from comment #2)
> Does it happen with RHEL-6.4 too?
I didn't try yet

> What is the guest driver version?

DriverVer = 10/15/2012,6.1.0.10016
Comment 4 Gerd Hoffmann 2013-08-27 04:53:28 EDT
(In reply to chayang from comment #3)
> (In reply to Gerd Hoffmann from comment #2)
> > Does it happen with RHEL-6.4 too?
> I didn't try yet

Please try.  How many reboots took it ti trigger it?

> > What is the guest driver version?
> 
> DriverVer = 10/15/2012,6.1.0.10016

Which guest-tools-iso version is this?
Comment 5 Chao Yang 2013-08-27 06:20:46 EDT
(In reply to Gerd Hoffmann from comment #4)
> (In reply to chayang from comment #3)
> > (In reply to Gerd Hoffmann from comment #2)
> > > Does it happen with RHEL-6.4 too?
> > I didn't try yet
> 
> Please try.  How many reboots took it ti trigger it?
> 
I remember it took about 10 minutes, I didn't count the NO. of iterations.
I'll try to test again with a rhel guest

> > > What is the guest driver version?
> > 
> > DriverVer = 10/15/2012,6.1.0.10016
> 
> Which guest-tools-iso version is this?
I installed qxl driver provided by virtio-win-1.6.4-1.el6_4.noarch
Comment 6 Gerd Hoffmann 2013-08-30 01:55:00 EDT
Hmm.  Let the reboot loop run overnignt, 170 reboots until now, didn't reproduce.

Also note that it isn't clear from the logs above whenever qemu or the qxl guest driver is at fault here.
Comment 7 Chao Yang 2013-08-30 03:03:18 EDT
(In reply to Gerd Hoffmann from comment #6)
> Hmm.  Let the reboot loop run overnignt, 170 reboots until now, didn't
> reproduce.
> 
> Also note that it isn't clear from the logs above whenever qemu or the qxl
> guest driver is at fault here.

Is there any env variable I could set to record useful log in case that I have a chance to reproduce this issue if it is not easily reproducible? And I will try to fresh install a new one to retest.
Comment 8 Gerd Hoffmann 2013-08-30 03:19:34 EDT
(In reply to chayang from comment #7)
> Is there any env variable I could set to record useful log in case that I
> have a chance to reproduce this issue if it is not easily reproducible? And
> I will try to fresh install a new one to retest.

qxl has a bunch of tracepoints which can be enabled to see the host-side activities of the qxl device.

There is also a cmdlog property to make qemu log the commands the guest is sending to stderr.  Try '-global qxl-vga.cmdlog=1' to enable it.

Maybe spice-server has logging capabilities too, Alon?
Comment 9 Alon Levy 2013-09-01 03:29:00 EDT
SPICE_DEBUG_LEVEL=5

see (for the future) http://cgit.freedesktop.org/spice/spice-common/tree/common/log.h#n41

You can set this in libvirt by adding a qemu specific namespace to the xml definition and adding an entry to set this environment variable:

Example taken from http://www.libvirt.org/drvqemu.html

<domain type='qemu' xmlns:qemu='http://libvirt.org/schemas/domain/qemu/1.0'>
  ...
  <qemu:commandline>
    <qemu:env name='SPICE_DEBUG_LEVEL' value='5'/>
  </qemu:commandline>
</domain>
Comment 10 Chao Yang 2013-09-09 23:39:13 EDT
I cannot reproduce this bug with qemu-kvm instances directly.
Comment 11 Gerd Hoffmann 2013-09-10 01:51:10 EDT
Reducing priority as it doesn't reproduce.
Comment 15 juzhang 2014-06-09 22:16:47 EDT
Remove needinfo since this bz has been closed.

Note You need to log in before you can comment on or make changes to this bug.