From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:47700) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cDoi0-0001f6-C4 for qemu-devel@nongnu.org; Mon, 05 Dec 2016 03:33:13 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cDohv-0007rP-Ss for qemu-devel@nongnu.org; Mon, 05 Dec 2016 03:33:11 -0500 Received: from mx1.redhat.com ([209.132.183.28]:57366) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1cDohv-0007qo-Kd for qemu-devel@nongnu.org; Mon, 05 Dec 2016 03:33:07 -0500 Message-ID: <1480926783.28320.9.camel@redhat.com> From: Gerd Hoffmann Date: Mon, 05 Dec 2016 09:33:03 +0100 In-Reply-To: <20161202174015.GE15373@work-vm> References: <20161202174015.GE15373@work-vm> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 Subject: Re: [Qemu-devel] Postcopy+spice crash List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: "Dr. David Alan Gilbert" Cc: qemu-devel@nongnu.org, spice-devel On Fr, 2016-12-02 at 17:44 +0000, Dr. David Alan Gilbert wrote: > Hi Gerd, > I've got a moderately repeatable crash with spice playing > a video + postcopy. Some of the time I just get a warning > (that I also get in precopy) but sometimes it turns into > a backtrace; >=20 > This is: > f24 guest playing youtube fullscreen. > migration between 2.7.0<->current head (had crash both ways) >=20 > The warning I get with precopy most of the time is: > ./x86_64-softmmu/qemu-system-x86_64:26921): Spice-Warning **: red_memsl= ots.c:94:validate_virt: virtual address out of range That is in spice-server. Which version do you run? Adding spice-devel to Cc: > virt=3D0x7f5397ed002a+0x2925ff31 slot_id=3D1 group_id=3D1 > slot=3D0x7f5397c00000-0x7f539bbfe000 delta=3D0x7f5397c00000 Base address looks sane. Size (0x2925ff31) is bogous. On a quick glance I'd blame the guest for sending corrupted commands. Strange though that it happens on migration only, so there could be a host issue too. Or a timing issue triggered by migration. Which migration phase? Do you have seamless spice migration enabled? If so: Does it still reproduce with seamless migration turned off? > The crash I've had with postcopy is: > red_dispatcher_loadvm_commands: > id 0, group 0, virt start 0, virt end ffffffffffffffff, generation 0, del= ta 0 > id 1, group 1, virt start 7fbe83c00000, virt end 7fbe87bfe000, generation= 0, delta 7fbe83c00000 > id 2, group 1, virt start 7fbe7fa00000, virt end 7fbe83a00000, generation= 0, delta 7fbe7fa00000 > (./x86_64-softmmu/qemu-system-x86_64:22376): Spice-CRITICAL **: red_memsl= ots.c:123:get_virt: slot_id 128 too big, addr=3D8000000000000000 >=20 > #0 0x00007fc0aa42f49d in read () from /lib64/libpthread.so.0 > #1 0x00007fc0a8c36c01 in spice_backtrace_gstack () from /lib64/libspice-= server.so.1 > #2 0x00007fc0a8c3e4f7 in spice_logv () from /lib64/libspice-server.so.1 > #3 0x00007fc0a8c3e655 in spice_log () from /lib64/libspice-server.so.1 > #4 0x00007fc0a8bfc6de in get_virt () from /lib64/libspice-server.so.1 > #5 0x00007fc0a8bfcb73 in red_get_data_chunks_ptr () from /lib64/libspice= -server.so.1 > #6 0x00007fc0a8bff3fa in red_get_cursor_cmd () from /lib64/libspice-serv= er.so.1 > #7 0x00007fc0a8c0fd79 in handle_dev_loadvm_commands () from /lib64/libsp= ice-server.so.1 > #8 0x00007fc0a8bf9523 in dispatcher_handle_recv_read () from /lib64/libs= pice-server.so.1 > #9 0x00007fc0a8c1d5a5 in red_worker_main () from /lib64/libspice-server.= so.1 > #10 0x00007fc0aa428dc5 in start_thread () from /lib64/libpthread.so.0 > #11 0x00007fc0a61786ed in clone () from /lib64/libc.so.6 Spice worker thread ... > red_dispatcher_loadvm_commands: > id 0, group 0, virt start 0, virt end ffffffffffffffff, generation 0, del= ta 0 > id 1, group 1, virt start 7f3b93800000, virt end 7f3b977fe000, generation= 0, delta 7f3b93800000 > id 2, group 1, virt start 7f3b8f400000, virt end 7f3b93400000, generation= 0, delta 7f3b8f400000 > (/opt/qemu/v2.7.0/bin/qemu-system-x86_64:41053): Spice-CRITICAL **: red_m= emslots.c:123:get_virt: slot_id 80 too big, addr=3D5000000000000000 ... trying to decode a invalid qxl address. > I'm using: > spice-server-devel-0.12.4-19.el7.x86_64 Ah, RHEL-7.3 host. cheers, Gerd