#980946 qemu-system-x86: qemu VM with vga virtio fails spice assertion at reboot, sometimes

Package:
qemu-system-x86
Source:
qemu
Description:
QEMU full system emulation binaries (x86)
Submitter:
Bernhard Übelacker
Date:
2025-08-11 08:45:02 UTC
Severity:
normal
#980946#5
Date:
2021-01-24 18:45:17 UTC
From:
To:
Dear Maintainer,
I was playing around with a qemu VM with a virtio vga to see
how far I could get with accelerated graphics inside a VM.
I was watching the VM via remote-viewer.

But on several reboots of the VM I received this message:

     qemu-system-x86_64: Spice: red-qxl.c:706:spice_qxl_gl_scanout: condition `qxl_state->gl_draw_cookie == GL_DRAW_COOKIE_INVALID' failed

Then the VM aborts in spice_logv.

I attached then a debugger before that point and got the
following stack where we reach that assert.
(The spice_backtrace function did output nothing.)

Below is the used command of qemu and remote-viewer.

When I tried to reboot without a remote-viewer attached I
did not receive that assert on a few reboots.

Kind regards,
Bernhard






(gdb) bt
#0  spice_backtrace () at backtrace.c:126
#1  0x00007fc8b87d2653 in spice_logv (log_domain=0x7fc8b8838291 "Spice", args=0x7fffff080ba0, format=0x7fc8b8839160 "condition `%s' failed", function=0x7fc8b8842010 <__FUNCTION__.6> "spice_qxl_gl_scanout", strloc=0x7fc8b8841eaf "red-qxl.c:706", log_level=G_LOG_LEVEL_CRITICAL, log_domain=0x7fc8b8838291 "Spice") at log.c:55
#2  spice_log (log_level=log_level@entry=G_LOG_LEVEL_CRITICAL, strloc=strloc@entry=0x7fc8b8841eaf "red-qxl.c:706", function=function@entry=0x7fc8b8842010 <__FUNCTION__.6> "spice_qxl_gl_scanout", format=format@entry=0x7fc8b8839160 "condition `%s' failed") at log.c:69
#3  0x00007fc8b87a0861 in spice_qxl_gl_scanout (qxl=qxl@entry=0x55aed2cbf0e8, fd=fd@entry=-1, width=width@entry=0, height=height@entry=0, stride=stride@entry=0, format=format@entry=0, y_0_top=0) at red-qxl.c:706
#4  0x000055aed05643ac in qemu_spice_gl_scanout_disable (dcl=0x55aed2cbf0a8) at ../../ui/spice-display.c:919
#5  0x000055aed04ea4d1 in virtio_gpu_virgl_reset (g=g@entry=0x55aed25eee40) at ../../hw/display/virtio-gpu-3d.c:601
#6  0x000055aed063cac8 in virtio_gpu_reset (vdev=0x55aed25eee40) at ../../hw/display/virtio-gpu.c:1154
#7  0x000055aed07ddcf2 in virtio_reset (opaque=0x55aed25eee40) at ../../hw/virtio/virtio.c:2001
#8  0x000055aed05dafa7 in virtio_bus_reset (bus=bus@entry=0x55aed25de108) at ../../hw/virtio/virtio-bus.c:95
#9  0x000055aed06b1b50 in virtio_pci_reset (qdev=<optimized out>) at ../../hw/virtio/virtio-pci.c:1870
#10 0x000055aed05e5a1f in virtio_vga_base_reset (dev=0x55aed25d6000) at ../../hw/display/virtio-vga.c:164
#11 0x000055aed0934be2 in resettable_phase_hold (obj=0x55aed25d6000, opaque=<optimized out>, type=<optimized out>) at ../../hw/core/resettable.c:182
#12 0x000055aed092faa4 in bus_reset_child_foreach (obj=<optimized out>, cb=0x55aed0934b00 <resettable_phase_hold>, opaque=0x0, type=RESET_TYPE_COLD) at ../../hw/core/bus.c:97
#13 0x000055aed0934b9c in resettable_child_foreach (type=RESET_TYPE_COLD, opaque=0x0, cb=0x55aed0934b00 <resettable_phase_hold>, obj=0x55aed2199e40, rc=0x55aed17343f0) at ../../hw/core/resettable.c:96
#14 resettable_phase_hold (obj=0x55aed2199e40, opaque=<optimized out>, type=RESET_TYPE_COLD) at ../../hw/core/resettable.c:173
#15 0x000055aed093215b in device_reset_child_foreach (obj=<optimized out>, cb=0x55aed0934b00 <resettable_phase_hold>, opaque=0x0, type=RESET_TYPE_COLD) at ../../hw/core/qdev.c:376
#16 0x000055aed0934b9c in resettable_child_foreach (type=RESET_TYPE_COLD, opaque=0x0, cb=0x55aed0934b00 <resettable_phase_hold>, obj=0x55aed2198dd0, rc=0x55aed16f3db0) at ../../hw/core/resettable.c:96
#17 resettable_phase_hold (obj=0x55aed2198dd0, opaque=<optimized out>, type=RESET_TYPE_COLD) at ../../hw/core/resettable.c:173
#18 0x000055aed092faa4 in bus_reset_child_foreach (obj=<optimized out>, cb=0x55aed0934b00 <resettable_phase_hold>, opaque=0x0, type=RESET_TYPE_COLD) at ../../hw/core/bus.c:97
#19 0x000055aed0934b9c in resettable_child_foreach (type=RESET_TYPE_COLD, opaque=0x0, cb=0x55aed0934b00 <resettable_phase_hold>, obj=0x55aed189a720, rc=0x55aed17f1710) at ../../hw/core/resettable.c:96
#20 resettable_phase_hold (obj=obj@entry=0x55aed189a720, opaque=opaque@entry=0x0, type=type@entry=RESET_TYPE_COLD) at ../../hw/core/resettable.c:173
#21 0x000055aed0934f21 in resettable_assert_reset (obj=obj@entry=0x55aed189a720, type=type@entry=RESET_TYPE_COLD) at ../../hw/core/resettable.c:60
#22 0x000055aed09354d0 in resettable_reset (type=RESET_TYPE_COLD, obj=0x55aed189a720) at ../../hw/core/resettable.c:45
#23 resettable_cold_reset_fn (opaque=0x55aed189a720) at ../../hw/core/resettable.c:269
#24 0x000055aed093450d in qemu_devices_reset () at ../../hw/core/reset.c:69
#25 0x000055aed06edf8b in pc_machine_reset (machine=<optimized out>) at ../../hw/i386/pc.c:1615
#26 0x000055aed0864e4d in qemu_system_reset (reason=reason@entry=SHUTDOWN_CAUSE_GUEST_RESET) at ../../softmmu/vl.c:1405
#27 0x000055aed0865039 in main_loop_should_exit () at ../../softmmu/vl.c:1640
#28 0x000055aed086574c in qemu_main_loop () at ../../softmmu/vl.c:1674
#29 0x000055aed04bf29e in main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at ../../softmmu/main.c:50
(gdb)

(gdb) print qxl_state
$1 = (QXLState *) 0x55aed34b96f0
(gdb) print *qxl_state
$2 = {qxl_worker = {minor_version = 3, major_version = 3, wakeup = 0x7fc8b879fb00 <qxl_worker_wakeup>, oom = 0x7fc8b879fb60 <qxl_worker_oom>, start = 0x7fc8b879fce0 <qxl_worker_start>, stop = 0x7fc8b879fd30 <qxl_worker_stop>, update_area = 0x7fc8b879fa20 <qxl_worker_update_area>, add_memslot = 0x7fc8b879fbc0 <qxl_worker_add_memslot>, del_memslot = 0x7fc8b879f7f0 <qxl_worker_del_memslot>, reset_memslots = 0x7fc8b879f840 <qxl_worker_reset_memslots>, destroy_surfaces = 0x7fc8b879f890 <qxl_worker_destroy_surfaces>, destroy_primary_surface = 0x7fc8b879fa90 <qxl_worker_destroy_primary_surface>, create_primary_surface = 0x7fc8b879fcd0 <qxl_worker_create_primary_surface>, reset_image_cache = 0x7fc8b879f8e0 <qxl_worker_reset_image_cache>, reset_cursor = 0x7fc8b879f930 <qxl_worker_reset_cursor>, destroy_surface_wait = 0x7fc8b879f980 <qxl_worker_destroy_surface_wait>, loadvm_commands = 0x7fc8b879f9d0 <qxl_worker_loadvm_commands>}, qxl = 0x55aed2cbf0e8, dispatcher = 0x55aed18e98a0, pending = 0, primary_active = 0, x_res = 0, y_res = 0, use_hardware_cursor = 0, max_monitors = 1, reds = 0x55aed18a5210, worker = 0x55aed34b9980, device_address = "pci/0000/02.0", '\000' <repeats 242 times>, device_display_ids = {0 <repeats 16 times>}, monitors_count = 1, running = true, scanout_mutex = pthread_mutex_t = {Type = Normal, Status = Not acquired, Robust = No, Shared = No, Protocol = None}, scanout = {drm_dma_buf_fd = 56, width = 1024, height = 768, stride = 4096, drm_fourcc_format = 875708993, flags = 1}, gl_draw_cookie = 94209348023888}
(gdb) print qxl_state->gl_draw_cookie
$3 = 94209348023888
(gdb) print/x qxl_state->gl_draw_cookie
$4 = 0x55aed2b93650
(gdb)

(gdb) info thread
   Id   Target Id                                             Frame
* 1    Thread 0x7fc8b598a480 (LWP 3656449) "qemu-system-x86" spice_backtrace () at backtrace.c:126
   2    Thread 0x7fc8b5644700 (LWP 3656450) "qemu-system-x86" 0x00007fc8b7367c61 in __GI___clock_nanosleep (clock_id=clock_id@entry=0, flags=flags@entry=0, req=0x7fc8b56435f0, rem=0x7fc8b5643600) at ../sysdeps/unix/sysv/linux/clock_nanosleep.c:48
   3    Thread 0x7fc8b4875700 (LWP 3656455) "qemu-syste:cs0"  futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed1927a48) at ../sysdeps/nptl/futex-internal.h:186
   4    Thread 0x7fc8a3fff700 (LWP 3656456) "qemu-sy:disk$0"  futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed17c9cc8) at ../sysdeps/nptl/futex-internal.h:186
   5    Thread 0x7fc8a37fe700 (LWP 3656457) "qemu-sy:disk$1"  futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed17c9cc8) at ../sysdeps/nptl/futex-internal.h:186
   6    Thread 0x7fc8a2ffd700 (LWP 3656458) "qemu-sy:disk$2"  futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed17c9cc8) at ../sysdeps/nptl/futex-internal.h:186
   7    Thread 0x7fc8a27fc700 (LWP 3656459) "qemu-sy:disk$3"  futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed17c9cc8) at ../sysdeps/nptl/futex-internal.h:186
   8    Thread 0x7fc8a1ffb700 (LWP 3656460) "qemu-syste:sh0"  futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed192c264) at ../sysdeps/nptl/futex-internal.h:186
   9    Thread 0x7fc8a17fa700 (LWP 3656461) "qemu-syste:sh1"  futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed192c264) at ../sysdeps/nptl/futex-internal.h:186
   10   Thread 0x7fc8a0ff9700 (LWP 3656462) "qemu-syste:sh2"  futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed192c264) at ../sysdeps/nptl/futex-internal.h:186
   11   Thread 0x7fc88bfff700 (LWP 3656463) "qemu-syste:sh3"  futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed192c264) at ../sysdeps/nptl/futex-internal.h:186
   12   Thread 0x7fc88b7fe700 (LWP 3656464) "qemu-syste:sh4"  futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed192c264) at ../sysdeps/nptl/futex-internal.h:186
   13   Thread 0x7fc88affd700 (LWP 3656465) "qemu-syste:sh5"  futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed192c264) at ../sysdeps/nptl/futex-internal.h:186
   14   Thread 0x7fc88a7fc700 (LWP 3656466) "qemu-syste:sh6"  futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed192c260) at ../sysdeps/nptl/futex-internal.h:186
   15   Thread 0x7fc889ffb700 (LWP 3656467) "qemu-syste:sh7"  futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed192c260) at ../sysdeps/nptl/futex-internal.h:186
   16   Thread 0x7fc8897fa700 (LWP 3656468) "qemu-syste:sh8"  futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed192c260) at ../sysdeps/nptl/futex-internal.h:186
   17   Thread 0x7fc888ff9700 (LWP 3656469) "qemu-syste:sh9"  futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed192c260) at ../sysdeps/nptl/futex-internal.h:186
   18   Thread 0x7fc867fff700 (LWP 3656470) "qemu-syste:sh10" futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed192c260) at ../sysdeps/nptl/futex-internal.h:186
   19   Thread 0x7fc8677fe700 (LWP 3656471) "qemu-syste:sh11" futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed192c264) at ../sysdeps/nptl/futex-internal.h:186
   20   Thread 0x7fc866ffd700 (LWP 3656472) "qemu-sys:shlo0"  futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed192c968) at ../sysdeps/nptl/futex-internal.h:186
   21   Thread 0x7fc8667fc700 (LWP 3656473) "qemu-sys:shlo1"  futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed192c968) at ../sysdeps/nptl/futex-internal.h:186
   22   Thread 0x7fc865ffb700 (LWP 3656474) "qemu-sys:shlo2"  futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed192c968) at ../sysdeps/nptl/futex-internal.h:186
   23   Thread 0x7fc8657fa700 (LWP 3656475) "qemu-sys:shlo3"  futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed192c968) at ../sysdeps/nptl/futex-internal.h:186
   24   Thread 0x7fc864ff9700 (LWP 3656476) "qemu-sys:shlo4"  futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed192c968) at ../sysdeps/nptl/futex-internal.h:186
   25   Thread 0x7fc847fff700 (LWP 3656477) "qemu-sys:gdrv0"  futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed19e5e50) at ../sysdeps/nptl/futex-internal.h:186
   27   Thread 0x7fc846ffd700 (LWP 3656481) "qemu-system-x86" futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed1ded85c) at ../sysdeps/nptl/futex-internal.h:186
   28   Thread 0x7fc8467fc700 (LWP 3656482) "qemu-system-x86" futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed1e3e728) at ../sysdeps/nptl/futex-internal.h:186
   29   Thread 0x7fc845ffb700 (LWP 3656483) "qemu-system-x86" futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed1e64d5c) at ../sysdeps/nptl/futex-internal.h:186
   30   Thread 0x7fc8457fa700 (LWP 3656484) "qemu-system-x86" futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed1e8bcfc) at ../sysdeps/nptl/futex-internal.h:186
   31   Thread 0x7fc844ff9700 (LWP 3656485) "qemu-system-x86" futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed1eb24ec) at ../sysdeps/nptl/futex-internal.h:186
   32   Thread 0x7fc773dff700 (LWP 3656486) "qemu-system-x86" futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed1ed8dac) at ../sysdeps/nptl/futex-internal.h:186
   33   Thread 0x7fc7735fe700 (LWP 3656487) "qemu-system-x86" futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed1eff66c) at ../sysdeps/nptl/futex-internal.h:186
   34   Thread 0x7fc772dfd700 (LWP 3656488) "qemu-system-x86" futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed1f25f2c) at ../sysdeps/nptl/futex-internal.h:186
   35   Thread 0x7fc7725fc700 (LWP 3656489) "qemu-system-x86" futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed1f4c7ec) at ../sysdeps/nptl/futex-internal.h:186
   36   Thread 0x7fc771dfb700 (LWP 3656490) "qemu-system-x86" futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed1f73be8) at ../sysdeps/nptl/futex-internal.h:186
   37   Thread 0x7fc7715fa700 (LWP 3656491) "qemu-system-x86" futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed1f9a4a8) at ../sysdeps/nptl/futex-internal.h:186
   38   Thread 0x7fc770df9700 (LWP 3656492) "qemu-system-x86" futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed1fc0efc) at ../sysdeps/nptl/futex-internal.h:186
   39   Thread 0x7fc743fff700 (LWP 3656493) "qemu-system-x86" futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed1fe777c) at ../sysdeps/nptl/futex-internal.h:186
   40   Thread 0x7fc7437fe700 (LWP 3656494) "qemu-system-x86" futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed200e038) at ../sysdeps/nptl/futex-internal.h:186
   41   Thread 0x7fc742ffd700 (LWP 3656495) "qemu-system-x86" futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed20348f8) at ../sysdeps/nptl/futex-internal.h:186
   42   Thread 0x7fc7427fc700 (LWP 3656496) "qemu-system-x86" futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed205b5b8) at ../sysdeps/nptl/futex-internal.h:186
   43   Thread 0x7fc7415ff700 (LWP 3656498) "SPICE Worker"    0x00007fc8b73953ff in __GI___poll (fds=0x55aed21bcfd0, nfds=4, timeout=2147483647) at ../sysdeps/unix/sysv/linux/poll.c:29
   425  Thread 0x7fc6d7fff700 (LWP 3677640) "qemu-system-x86" futex_abstimed_wait_cancelable (private=0, abstime=0x7fc6d7ffe5d0, clockid=-671095456, expected=0, futex_word=0x55aed17f38c8) at ../sysdeps/nptl/futex-internal.h:323
   426  Thread 0x7fc6df0b0700 (LWP 3677674) "qemu-system-x86" futex_abstimed_wait_cancelable (private=0, abstime=0x7fc6df0af5d0, clockid=-552929952, expected=0, futex_word=0x55aed17f38c8) at ../sysdeps/nptl/futex-internal.h:323
   430  Thread 0x7fc6d2aaa700 (LWP 3677688) "qemu-system-x86" futex_abstimed_wait_cancelable (private=0, abstime=0x7fc6d2aa95d0, clockid=-760572576, expected=0, futex_word=0x55aed17f38c8) at ../sysdeps/nptl/futex-internal.h:323
   432  Thread 0x7fc6e06c6700 (LWP 3677690) "qemu-system-x86" futex_abstimed_wait_cancelable (private=0, abstime=0x7fc6e06c55d0, clockid=-529771168, expected=0, futex_word=0x55aed17f38c8) at ../sysdeps/nptl/futex-internal.h:323
   433  Thread 0x7fc6ddea5700 (LWP 3677691) "qemu-system-x86" futex_abstimed_wait_cancelable (private=0, abstime=0x7fc6ddea45d0, clockid=-571849376, expected=0, futex_word=0x55aed17f38cc) at ../sysdeps/nptl/futex-internal.h:323
   434  Thread 0x7fc708a5e700 (LWP 3677702) "qemu-sys:gdrv0"  futex_wait_cancelable (private=0, expected=0, futex_word=0x55aed2ecb4b0) at ../sysdeps/nptl/futex-internal.h:186
(gdb)

(gdb) thread 43
[Switching to thread 43 (Thread 0x7fc7415ff700 (LWP 3656498))]
#0  0x00007fc8b73953ff in __GI___poll (fds=0x55aed21bcfd0, nfds=4, timeout=2147483647) at ../sysdeps/unix/sysv/linux/poll.c:29
29      ../sysdeps/unix/sysv/linux/poll.c: Datei oder Verzeichnis nicht gefunden.
(gdb) bt
#0  0x00007fc8b73953ff in __GI___poll (fds=0x55aed21bcfd0, nfds=4, timeout=2147483647) at ../sysdeps/unix/sysv/linux/poll.c:29
#1  0x00007fc8b79c8f7e in  () at /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#2  0x00007fc8b79c92db in g_main_loop_run () at /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#3  0x00007fc8b87b0fe7 in red_worker_main (arg=0x55aed34b9980) at red-worker.c:1131
#4  0x00007fc8b746fea7 in start_thread (arg=<optimized out>) at pthread_create.c:477
#5  0x00007fc8b739fdef in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
(gdb)







/usr/bin/qemu-system-x86_64 -m 3G -enable-kvm -smp 16 -monitor stdio -vga virtio -spice unix,addr=/tmp/spice.sock,disable-ticketing,gl=on -usb -device usb-tablet -drive file=system.img,format=raw,cache=writeback,discard=unmap,detect-zeroes=unmap -drive file=daten.img,format=raw,cache=writeback -device e1000,netdev=net0 -netdev user,id=net0,hostfwd=tcp:127.0.254.63:2222-:22,hostfwd=tcp:127.0.254.63:3389-:3389,hostfwd=tcp:127.0.254.63:4445-:445,hostfwd=tcp:127.0.254.63:8080-:80,hostfwd=tcp:127.0.254.63:5900-:5900,hostfwd=tcp:127.0.254.63:5901-:5901,tftp=/home/bernhard/data/pxeboot,bootfile=/boot/grub/i386-pc/core.0 -device qemu-xhci -device intel-hda -device hda-duplex -device virtio-rng-pci -boot c -no-shutdown -snapshot

remote-viewer spice+unix:///tmp/spice.sock

#980946#10
Date:
2025-08-11 08:43:35 UTC
From:
To:
Version: 1:7.2+dfsg-1
Hi!

It looks like this issue has been fixed quite some time ago.
I'm closing this bug report with bookworm qemu version.
Feel free to reopen this report if you think it is incorrect.

Thanks,

/mjt