12.10 guest crash on login when using 12.04 qemu-kvm with cirrus driver

[Jamie Strandboge]

On a 12.10 amd64 host with the 12.04 LTS qemu-kvm package (due to bug #1040033) using the cirrus (ie, the default qemu-kvm driver) with an up to date 12.10 guest (machine='pc-1.0'), lightdm starts fine. If I proceed to login, X crashes. If I upgrade qemu-kvm to 1.1~rc+dfsg-1ubuntu10, I am able to login fine.

I don't know why the crash file wasn't uploaded. That said, this happens every time and is easy to reproduce.

(EE) BUG: triggered 'if (inSignalContext)'
(EE) BUG: ../../os/log.c:472 in LogVMessageVerb()
(EE) Warning: attempting to log data in a signal unsafe manner while in signal context. Please update to check inSignalContext and/or use LogMessageVerbSigSafe() or ErrorFSigSafe(). The offending log format message is:
VMWARE(0): vmmouse enable absolute mode

(EE)
(EE) Backtrace:
(EE) 0: /usr/bin/X (xorg_backtrace+0x36) [0x7f98382b88c6]
(EE) 1: /usr/bin/X (LogVMessageVerb+0x8c) [0x7f98382c3acc]
(EE) 2: /usr/bin/X (xf86Msg+0x8f) [0x7f98381b034f]
(EE) 3: /usr/lib/xorg/modules/input/vmmouse_drv.so (0x7f9834521000+0x191f) [0x7f983452291f]
(EE) 4: /usr/bin/X (0x7f9838110000+0x93637) [0x7f98381a3637]
(EE) 5: /usr/bin/X (0x7f9838110000+0xbcca8) [0x7f98381ccca8]
(EE) 6: /lib/x86_64-linux-gnu/libpthread.so.0 (0x7f9837436000+0xfcb0) [0x7f9837445cb0]
(EE) 7: /lib/x86_64-linux-gnu/libc.so.6 (__select+0x13) [0x7f98361876e3]
(EE) 8: /usr/bin/X (WaitForSomething+0x190) [0x7f98382b5cf0]
(EE) 9: /usr/bin/X (0x7f9838110000+0x55791) [0x7f9838165791]
(EE) 10: /usr/bin/X (0x7f9838110000+0x4455a) [0x7f983815455a]
(EE) 11: /lib/x86_64-linux-gnu/libc.so.6 (__libc_start_main+0xed) [0x7f98360bd76d]
(EE) 12: /usr/bin/X (0x7f9838110000+0x4489d) [0x7f983815489d]
(EE)
[ 17.571] (II) XKB: reuse xkmfile /var/lib/xkb/server-B2FC13ED4E00C26DC4C5E2885151412D28B2D8F8.xkm
[ 19.355] (EE)
[ 19.355] (EE) Backtrace:
[ 19.355] (EE) 0: /usr/bin/X (xorg_backtrace+0x36) [0x7f98382b88c6]
[ 19.356] (EE) 1: /usr/bin/X (0x7f9838110000+0x1ac6f9) [0x7f98382bc6f9]
[ 19.356] (EE) 2: /lib/x86_64-linux-gnu/libpthread.so.0 (0x7f9837436000+0xfcb0) [0x7f9837445cb0]
[ 19.356] (EE) 3: /lib/x86_64-linux-gnu/libc.so.6 (0x7f983609c000+0x911ae) [0x7f983612d1ae]
[ 19.356] (EE) 4: /usr/lib/xorg/modules/drivers/cirrus_drv.so (cirRefreshArea+0xbe) [0x7f9834f45ebe]
[ 19.356] (EE) 5: /usr/lib/xorg/modules/libshadowfb.so (0x7f9833cc7000+0x3af3) [0x7f9833ccaaf3]
[ 19.356] (EE) 6: /usr/bin/X (0x7f9838110000+0x519fb) [0x7f98381619fb]
[ 19.356] (EE) 7: /usr/bin/X (0x7f9838110000+0x55a41) [0x7f9838165a41]
[ 19.356] (EE) 8: /usr/bin/X (0x7f9838110000+0x4455a) [0x7f983815455a]
[ 19.356] (EE) 9: /lib/x86_64-linux-gnu/libc.so.6 (__libc_start_main+0xed) [0x7f98360bd76d]
[ 19.356] (EE) 10: /usr/bin/X (0x7f9838110000+0x4489d) [0x7f983815489d]
[ 19.356] (EE)
[ 19.356] (EE) Segmentation fault at address 0x7f9834cb7ee4
[ 19.356]
Fatal server error:
[ 19.356] Caught signal 11 (Segmentation fault). Server aborting

ProblemType: Bug
DistroRelease: Ubuntu 12.10
Package: xorg 1:7.7+1ubuntu3
ProcVersionSignature: User Name 3.5.0-13.14-generic 3.5.3
Uname: Linux 3.5.0-13-generic x86_64
ApportVersion: 2.5.1-0ubuntu4
Architecture: amd64
CurrentDmesg: [ 3.509976] init: plymouth-upstart-bridge main process (467) killed by TERM signal
Date: Tue Sep 4 09:20:41 2012
DistUpgraded: Fresh install
DistroCodename: quantal
DistroVariant: ubuntu
GraphicsCard:
 Cirrus Logic GD 5446 [1013:00b8] (prog-if 00 [VGA controller])
   Subsystem: Red Hat, Inc Device [1af4:1100]
InstallationMedia: Ubuntu 12.10 "Quantal Quetzal" - Alpha amd64 (20120727.1)
Lsusb: Bus 001 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
MachineType: Bochs Bochs
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-3.5.0-13-generic root=UUID=864d1ea6-19be-4372-9f05-94f7633a6f7c ro quiet splash vt.handoff=7
SourcePackage: xorg
UpgradeStatus: No upgrade log present (probably fresh install)
dmi.bios.date: 01/01/2007
dmi.bios.vendor: Bochs
dmi.bios.version: Bochs
dmi.chassis.type: 1
dmi.chassis.vendor: Bochs
dmi.modalias: dmi:bvnBochs:bvrBochs:bd01/01/2007:svnBochs:pnBochs:pvr:cvnBochs:ct1:cvr:
dmi.product.name: Bochs
dmi.sys.vendor: Bochs
version.compiz: compiz 1:0.9.8.0-0ubuntu1
version.ia32-libs: ia32-libs N/A
version.libdrm2: libdrm2 2.4.38-0ubuntu2
version.libgl1-mesa-dri: libgl1-mesa-dri 9.0~git20120821.c1114c61-0ubuntu2
version.libgl1-mesa-dri-experimental: libgl1-mesa-dri-experimental N/A
version.libgl1-mesa-glx: libgl1-mesa-glx 9.0~git20120821.c1114c61-0ubuntu2
version.xserver-xorg-core: xserver-xorg-core 2:1.12.99.905-0ubuntu3
version.xserver-xorg-input-evdev: xserver-xorg-input-evdev 1:2.7.3-0ubuntu1
version.xserver-xorg-video-ati: xserver-xorg-video-ati 1:6.99.99~git20120713.6ef1ad6a-0ubuntu1
version.xserver-xorg-video-intel: xserver-xorg-video-intel 2:2.20.3-0ubuntu1
version.xserver-xorg-video-nouveau: xserver-xorg-video-nouveau 1:1.0.1-4~ubuntu1

[Jamie Strandboge (jdstrand)]

I'm going to add a qemu-kvm task as well. While X shouldn't crash, there might be a problem with the cirrus functionality.

[Serge Hallyn (serge-hallyn)]

Haven't tested this, but will mark it confirmed. Hopefully we can just fix bug 1040033!

[Jamie Strandboge (jdstrand)]

Serge, regarding fixing bug #1040033, indeed. :) However I'm quite sure that LTS users will not be able to test/use 12.10 if this bug isn't fixed in SRU for qemu-kvm or Xorg in 12.10 is fixed.

[Bryce Harrington (bryce)]

Please collect a full backtrace on this crash - see http://wiki.ubuntu.com/X/Backtracing for guidance.

[Serge Hallyn (serge-hallyn)]

I can reproduce this with vnc, but not with SDL.

[Serge Hallyn (serge-hallyn)]

Here is a tarball with a few crashfiles from /var/run. I'm pretty sure the compiz one is unrelated (that it happened when I logged in over SDL instead of over VNC) The others are two pairs of crash files from two attempts to log in over vnc.

[Serge Hallyn (serge-hallyn)]

The colord crash happens every time I log in over vnc, even when I start dwm instead of unity.

The xorg crash only happens with unity. Just installed -dbgsym in the hopes of getting a backrace.

[Serge Hallyn (serge-hallyn)]

NATURALLY once -dbgsym is installed this becomes much harder to reproduce, implying this is a timing related bug.

Unfortunately unpacking a previous /var/run/_usr_bin_Xorg.0.crash file and running 'sudo gdb /usr/bin/X CoreDump' doesn't give any sort of backtrace.

[Serge Hallyn (serge-hallyn)]

(by 'doesn't give any sort of backtrace' of course I mean that it has none of the needed debug symbols for the related libraries)

[Serge Hallyn (serge-hallyn)]

root@serge-virtual-machine:~# apport-retrace --gdb --sandbox system --cache=yyy _usr_bin_Xorg.0.crash
Installing extra package xserver-xorg-core to get ExecutablePath
GNU gdb (GDB) 7.5-ubuntu
Copyright (C) 2012 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Reading symbols from /tmp/tmpZjTrRt/usr/bin/Xorg...Reading symbols from /tmp/tmpZjTrRt/usr/lib/debug/usr/bin/Xorg...done.
done.
[New LWP 1682]
warning: Can't read pathname for load map: Input/output error.
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
warning: the debug information found in "/tmp/tmpZjTrRt/usr/lib/debug/usr/lib/libXfont.so.1.4.1" does not match "/tmp/tmpZjTrRt/usr/lib/libXfont.so.1" (CRC mismatch).

Core was generated by `/usr/bin/X :0 -core -auth /var/run/lightdm/root/:0 -nolisten tcp vt7 -novtswitc'.
Program terminated with signal 6, Aborted.
#0 0x00007f965e2cf405 in __GI_raise (sig=<optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
64 ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) where
#0 0x00007f965e2cf405 in __GI_raise (sig=<optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1 0x00007f965e2d2b6b in __GI_abort () at abort.c:91
#2 0x00007f96604bb99e in OsAbort () at ../../os/utils.c:1266
#3 0x00007f96603a2c4c in ddxGiveUp (error=EXIT_ERR_ABORT) at ../../../../hw/xfree86/common/xf86Init.c:1084
#4 0x00007f96604c0932 in AbortServer () at ../../os/log.c:632
#5 0x00007f96604c117d in FatalError (f=f@entry=0x7f96604ea2c8 "Caught signal %d (%s). Server aborting\n") at ../../os/log.c:773
#6 0x00007f96604b974e in OsSigHandler (sip=<optimized out>, signo=11, unused=<optimized out>) at ../../os/osinit.c:146
#7 OsSigHandler (signo=11, sip=<optimized out>, unused=<optimized out>) at ../../os/osinit.c:107
#8 <signal handler called>
#9 __memcpy_sse2 () at ../sysdeps/x86_64/multiarch/../memcpy.S:72
#10 0x00007f965d142ebe in memcpy (__len=3, __src=0x7f965ceb4ee4, __dest=0x7f965ba78ed4 <_mesa_DummyProgram+25652>)
    at /usr/include/x86_64-linux-gnu/bits/string3.h:52
#11 cirRefreshArea (pScrn=<optimized out>, num=<optimized out>, pbox=0x7fffa55f8900) at ../../src/cir_shadow.c:36
#12 0x00007f965bec7af3 in ShadowCopyArea (pSrc=0x7f9662c421b0, pDst=0x7f9662bfcfe0, pGC=0x7f9662b38e60, srcx=<optimized out>, srcy=<optimized out>,
    width=<optimized out>, height=1, dstx=0, dsty=0) at ../../../../hw/xfree86/shadowfb/shadow.c:618
#13 0x00007f966035e9fb in ProcCopyArea (client=0x7f9662b184e0) at ../../dix/dispatch.c:1622
#14 0x00007f9660362a41 in Dispatch () at ../../dix/dispatch.c:428
#15 0x00007f966035155a in main (argc=9, argv=0x7fffa55f8b78, envp=<optimized out>) at ../../dix/main.c:295

[Serge Hallyn (serge-hallyn)]

Hi Bryce,

is what I pasted above sufficient to be helpful?

[Didier Roche-Tolomelli (didrocks)]

Bryce, I've assigned that one to you, please punce back if you think it's not fixable for quantal

[Didier Roche-Tolomelli (didrocks)]

Leaving it to the rls-q-incoming bug as the task quantal task was added and then deleted by error, and can't add a quantal task again (bug #1051918)

[Jamie Strandboge (jdstrand)]

I unmarked this as a dupe of 1053702. That bug is about using vmware, not qemu-kvm.

[Maarten Lankhorst (mlankhorst)]

Is this still a problem then? the symptons looked exactly the same, and as if it should be fixed by the same patch..

[Bryce Harrington (bryce)]

The stack trace matches the trace for bug #1043513. Probably dupes.

[Serge Hallyn (serge-hallyn)]

Given comment #16, marking this invalid for qemu-kvm.

[Timo Aaltonen (tjaalton)]

Jamie: they both use the vmmouse driver, so this bug should be fixed by the upload to fix bug 1053702.

[Jamie Strandboge (jdstrand)]

Ok, there is conflicting information in #18 and #20. I can say that things seem to be working ok now (I have xserver-xorg-input-vmmouse 1:12.9.0-0ubuntu3 in the guest) after downgrading qemu-kvm to what is in precise. I am going to mark this as fixed released.