[Qemu-devel] qemu segfauls with spiceport chardev and isa-serial

[Martin Kletzander]

Hello,

current HEAD (2f61120c10da9128357510debc8e66880cd2bfdc) segfaults when
I'm trying to do the following:

I add this to qemu's command-line:

 -chardev spiceport,id=charserial0,name=org.qemu.console.serial.0 \
 -device isa-serial,chardev=charserial0,id=serial0

and then use spicy to connect to that machine.  That spits out the
following error:

 GSpice-Message: main channel: opened
 port 0x7f74182366e0 org.qemu.console.serial.0: opened
 
 (spicy:32386): GSpice-WARNING **: incomplete link header (-104/16)
 
 (spicy:32386): GSpice-WARNING **: incomplete link header (-104/16)
 GSpice-Message: main channel: closed

I can see that the console works when the window flashes, so there was
some communication done (Im running the kernel inside with
"console=tty0 console=ttyS0,115200n8" as suggested here:

http://lists.freedesktop.org/archives/spice-devel/2014-January/015919.html

The full command-line with backtrace of all the threads (with
abort()-ing thread being thread #1 follows.  Let me know if I can help
anyhow.

Thanks,
Martin

Command-line:

qemu-system-x86_64 -name rhel7 -S -machine \
pc-i440fx-1.7,accel=kvm,usb=off,dump-guest-core=off -cpu SandyBridge \
-m 4101 -realtime mlock=off -smp 1,sockets=1,cores=1,threads=1 -uuid \
f49fa544-f21d-4267-8958-d82570644f39 -no-user-config -nodefaults \
-chardev \
socket,id=charmonitor,path=/var/lib/libvirt/qemu/rhel7.monitor,server,nowait \
-mon chardev=charmonitor,id=monitor,mode=control -rtc base=utc \
-no-shutdown -boot strict=on -device \
piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 -device \
virtio-serial-pci,id=virtio-serial0,bus=pci.0,addr=0x6 -drive \
if=none,id=drive-ide0-0-0,readonly=on,format=raw -device \
ide-cd,bus=ide.0,unit=0,drive=drive-ide0-0-0,id=ide0-0-0 -drive \
file=/home/nert/.config/libvirt/images/rhel7.img,if=none,id=drive-virtio-disk0,format=qcow2
 \
-device \
virtio-blk-pci,scsi=off,bus=pci.0,addr=0x4,drive=drive-virtio-disk0,id=virtio-disk0,bootindex=1
 \
-netdev tap,fd=20,id=hostnet0,vhost=on,vhostfd=21 -device \
virtio-net-pci,netdev=hostnet0,id=net0,mac=52:54:00:42:be:45,bus=pci.0,addr=0x3 
\
-chardev spiceport,id=charserial0,name=org.qemu.console.serial.0 \
-device isa-serial,chardev=charserial0,id=serial0 -device \
usb-tablet,id=input0 -vnc 127.0.0.1:0 -spice \
port=5901,tls-port=5902,addr=127.0.0.1,disable-ticketing,x509-dir=/etc/pki/libvirt-spice,seamless-migration=on
 \
-device \
qxl-vga,id=video0,ram_size=67108864,vram_size=67108864,bus=pci.0,addr=0x2 \
-device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x5

Backtrace:

Thread 6 (Thread 0x7fed0e1fc700 (LWP 32347)):
#0  sem_timedwait () at 
../nptl/sysdeps/unix/sysv/linux/x86_64/sem_timedwait.S:101
#1  0x00007fee3de7096f in qemu_sem_timedwait (address@hidden, address@hidden)
    at util/qemu-thread-posix.c:243
#2  0x00007fee3dd2b38c in worker_thread (opaque=0x7fee3faa4dd0) at 
thread-pool.c:97
#3  0x00007fee3886a3a5 in start_thread (arg=0x7fed0e1fc700) at 
pthread_create.c:309
#4  0x00007fee345b2a3d in clone () at 
../sysdeps/unix/sysv/linux/x86_64/clone.S:111

Thread 5 (Thread 0x7fed0f9ff700 (LWP 32028)):
#0  pthread_cond_wait () at 
../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:185
#1  0x00007fee3de7075b in qemu_cond_wait (address@hidden, address@hidden)
    at util/qemu-thread-posix.c:121
#2  0x00007fee3dd4d1d3 in vnc_worker_thread_loop (address@hidden) at 
ui/vnc-jobs.c:222
#3  0x00007fee3dd4d680 in vnc_worker_thread (arg=0x7fee3fd12370) at 
ui/vnc-jobs.c:318
#4  0x00007fee3886a3a5 in start_thread (arg=0x7fed0f9ff700) at 
pthread_create.c:309
#5  0x00007fee345b2a3d in clone () at 
../sysdeps/unix/sysv/linux/x86_64/clone.S:111

Thread 4 (Thread 0x7fecd77fe700 (LWP 32346)):
#0  sem_timedwait () at 
../nptl/sysdeps/unix/sysv/linux/x86_64/sem_timedwait.S:101
#1  0x00007fee3de7096f in qemu_sem_timedwait (address@hidden, address@hidden)
    at util/qemu-thread-posix.c:243
#2  0x00007fee3dd2b38c in worker_thread (opaque=0x7fee3faa4dd0) at 
thread-pool.c:97
#3  0x00007fee3886a3a5 in start_thread (arg=0x7fecd77fe700) at 
pthread_create.c:309
#4  0x00007fee345b2a3d in clone () at 
../sysdeps/unix/sysv/linux/x86_64/clone.S:111

Thread 3 (Thread 0x7fee271a7700 (LWP 32025)):
#0  0x00007fee345a9917 in ioctl () at ../sysdeps/unix/syscall-template.S:81
#1  0x00007fee3ddbda11 in kvm_vcpu_ioctl (address@hidden, address@hidden)
    at /home/nert/dev/work/qemu/upstream/kvm-all.c:1774
#2  0x00007fee3ddbdb07 in kvm_cpu_exec (address@hidden)
    at /home/nert/dev/work/qemu/upstream/kvm-all.c:1659
#3  0x00007fee3dd60562 in qemu_kvm_cpu_thread_fn (arg=0x7fee3fc086f0) at 
/home/nert/dev/work/qemu/upstream/cpus.c:874
#4  0x00007fee3886a3a5 in start_thread (arg=0x7fee271a7700) at 
pthread_create.c:309
#5  0x00007fee345b2a3d in clone () at 
../sysdeps/unix/sysv/linux/x86_64/clone.S:111

Thread 2 (Thread 0x7fee24fff700 (LWP 32027)):
#0  0x00007fee345a7ead in poll () at ../sysdeps/unix/syscall-template.S:81
#1  0x00007fee3528ba81 in poll (__timeout=<optimized out>, __nfds=20, 
__fds=0x7fee1c0008f8)
    at /usr/include/bits/poll2.h:46
#2  red_worker_main (arg=<optimized out>) at red_worker.c:12245
#3  0x00007fee3886a3a5 in start_thread (arg=0x7fee24fff700) at 
pthread_create.c:309
#4  0x00007fee345b2a3d in clone () at 
../sysdeps/unix/sysv/linux/x86_64/clone.S:111

Thread 1 (Thread 0x7fee3da66980 (LWP 32022)):
#0  0x00007fee344f1f4e in __GI_raise (address@hidden) at 
../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1  0x00007fee344f369f in __GI_abort () at abort.c:89
#2  0x00007fee3de72baa in fifo8_pop (address@hidden) at util/fifo8.c:45
#3  0x00007fee3dc0c110 in serial_xmit (chan=<optimized out>, cond=<optimized 
out>, opaque=0x7fee3fc286a0)
    at hw/char/serial.c:228
#4  0x00007fee3d1a8957 in g_main_dispatch (context=0x7fee3fa49470)
    at /var/tmp/portage/dev-libs/glib-2.38.2/work/glib-2.38.2/glib/gmain.c:3066
#5  g_main_context_dispatch (address@hidden)
    at /var/tmp/portage/dev-libs/glib-2.38.2/work/glib-2.38.2/glib/gmain.c:3642
#6  0x00007fee3dccdde7 in glib_pollfds_poll () at main-loop.c:189
#7  os_host_main_loop_wait (timeout=<optimized out>) at main-loop.c:234
#8  main_loop_wait (nonblocking=<optimized out>) at main-loop.c:483
#9  0x00007fee3db61501 in main_loop () at vl.c:2018
#10 main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at 
vl.c:4410

signature.asc
Description: Digital signature