[Spice-devel] spice crash when do "loadvm" in qemu

[Yonit Halperin]

Hi,
can you attach the full stack trace?
Is it reproducible? Do you perform any actions in the guest for 
reproducing it?
I tried it with win7 guest and upstream/master qemu and spice, and 
couldn't reproduce it.

Cheers,
Yonit.
On 04/01/2013 04:50 AM, Liuji (Jeremy) wrote:
> Hello, everyone
>
> I found a problem about spice crash, when I do "loadvm" in qemu.
>
> Host OS: Fedora 17
> Qemu: 1.4.0
> Spice: 0.12.2
> Quest OS: WinXP
>
> 1) Use the following command to start the VM:
>      qemu-kvm -enable-kvm -name winxp -M pc-0.15 -m 1024 -smp 2 -boot c -device piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2
>      -device virtio-serial-pci,id=virtio-serial0,bus=pci.0,addr=0x5 -drive file=/home/test/winxp.qcow2,if=virtio,index=0,format=qcow2
>      -net nic,model=virtio,macaddr=52:54:00:05:11:12 -monitor stdio -chardev spicevmc,id=charchannel0,name=vdagent
>      -device virtserialport,bus=virtio-serial0.0,nr=1,chardev=charchannel0,id=channel0,name=com.redhat.spice.0 -chardev pty,id=charchannel1
>      -device virtserialport,bus=virtio-serial0.0,nr=2,chardev=charchannel1,id=channel1,name=arbitrary.virtio.serial.port.name -device usb-tablet,id=input0
>      -spice port=3001,addr=186.100.8.131,disable-ticketing,plaintext-channel=main,plaintext-channel=playback,plaintext-channel=record,image-compression=auto_glz
>      -vga qxl -global qxl-vga.vram_size=67108864 -device AC97,id=sound0,bus=pci.0,addr=0x4
> 2) Use spice client to connect the VM.
> 3) Exec the "savevm" command in the qemu monitor.
> 4) List snapshot information:
>      info snapshots
>      ID        TAG                 VM SIZE                DATE       VM CLOCK
>      1         vm-20130330181626      224M 2013-03-30 18:16:26   00:00:17.294
>
> 5) Load the snapshot. But the process crashed:
>      loadvm vm-20130330181626
>      red_dispatcher_loadvm_commands:
>      Segmentation fault (core dumped)
>
> I use the GDB to analyze the core-dump file:
>      #0  0x00007f6cbdc37a15 in spice_char_device_write_to_device (dev=0x7f6cc5248320) at char_device.c:439
>      439      sif = SPICE_CONTAINEROF(dev->sin->base.sif, SpiceCharDeviceInterface, base);
>      (gdb) p dev
>      $1 = (SpiceCharDeviceState *) 0x7f6cc5248320
>      (gdb) p dev->sin
>      $2 = (SpiceCharDeviceInstance *) 0x0
>
> I delete the "dev->sin = NULL;" in the last of "spice_char_device_reset" function. And the "loadvm" is OK.
>
> But I don't know whether this change will lead to other problems. Who can give me some advice?
>
> Best Regards,
>
> Jeremy Liu
> _______________________________________________
> Spice-devel mailing list
> Spice-devel at lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/spice-devel
>