MMX emulation is missing on HVF Acceleration

[Rob Maskell]

Robs-MacBook-Pro-2:~ robmaskell$ qemu-system-x86_64 --version
QEMU emulator version 3.0.0

Host: MacOS - 10.13.6
  Model Name: MacBook Pro
  Model Identifier: MacBookPro14,3
  Processor Name: Intel Core i7
  Processor Speed: 2.8 GHz
  Number of Processors: 1
  Total Number of Cores: 4
  L2 Cache (per Core): 256 KB
  L3 Cache: 6 MB
  Memory: 16 GB

Guest OS: Elementary Linux Loki 0.4.1, patched up to date

Command used to start QEMU:

qemu-system-x86_64 \
  -name ElementaryLokiDev \
  -machine pc,accel=hvf \
  -cpu max \
  -smp cpus=2,sockets=2,cores=1,threads=1,maxcpus=2 \
  -numa node,nodeid=0 \
  -numa cpu,node-id=0,socket-id=0 -numa cpu,node-id=0,socket-id=1 \
  -m 8G \
  -vga vmware \
  -hda e4.qcow2

Symptoms: Started without the -smp / -numa commands to install the OS, then added -smp / -numa and the machine boots and lscpu reports extra cpu as expected. Restart VM and it hangs on startup. Remove -smp / -numa and machine starts again.

[Roman Bolshakov (roolebo)]

I've had issues with multiple vcpus previously.

But I've tried that recently and it worked fine with the fix: https://lists.gnu.org/archive/html/qemu-devel/2018-10/msg03864.html.

And I've checked your command, no issues.

Could you please try to install qemu from my tap and check if it's gone?

brew tap roolebo/virt
brew install roolebo/virt/qemu --HEAD

[Rob Maskell (romell)]

Thanks for replying Roman, I switched to your tap but even before that I'm not struggling to get the machines to boot even without the smp/numa lines... vga std flashes a lot then hangs with a black screen and a blinking cursor whereas vga vmware quite unexpectedly.

Command to start QEMU:

qemu-system-x86_64 \
  -name Elementary4Dev \
  -machine pc,accel=hvf \
  -cpu max \
  -m 8G \
  -vga vmware \
  -drive file=elem4.qcow2,format=qcow2,media=disk -boot d \
  -cdrom ../VMImages/elementaryos-0.4.1-stable.20180214.iso

I tried the Elementary 0.4.1 and the new just released 5.0 and I get this... also tried cpu host but no luck. It's weird as single cpu was working the other day but stopped working on QEMU 3.0 before I switched to your tap.

Process: qemu-system-x86_64 [716]
Path: /usr/local/bin/qemu-system-x86_64
Identifier: qemu-system-x86_64
Version: 0
Code Type: X86-64 (Native)
Parent Process: ??? [713]
Responsible: qemu-system-x86_64 [716]
User ID: 501

Date/Time: 2018-10-20 20:58:31.473 +0100
OS Version: Mac OS X 10.13.6 (17G65)
Report Version: 12
Bridge OS Version: 3.0 (14Y664)
Anonymous UUID: A83DA3FD-C7C9-DAD6-4F7D-E36F1E90F993

Time Awake Since Boot: 1200 seconds

System Integrity Protection: enabled

Crashed Thread: 5

Exception Type: EXC_CRASH (SIGABRT)
Exception Codes: 0x0000000000000000, 0x0000000000000000
Exception Note: EXC_CORPSE_NOTIFY

Application Specific Information:
abort() called

Thread 0:: Dispatch queue: com.apple.main-thread
0 libsystem_kernel.dylib 0x00007fff65ad5cf2 __select + 10
1 libglib-2.0.0.dylib 0x00000001036ae359 g_poll + 407
2 qemu-system-x86_64 0x0000000102d53bb6 0x1029a8000 + 3849142
3 qemu-system-x86_64 0x0000000102af1c3e 0x1029a8000 + 1350718
4 qemu-system-x86_64 0x0000000102aef736 0x1029a8000 + 1341238
5 qemu-system-x86_64 0x0000000102c684ee 0x1029a8000 + 2884846
6 com.apple.CoreFoundation 0x00007fff3db57edc __CFNOTIFICATIONCENTER_IS_CALLING_OUT_TO_AN_OBSERVER__ + 12
7 com.apple.CoreFoundation 0x00007fff3db57daa _CFXRegistrationPost + 458
8 com.apple.CoreFoundation 0x00007fff3db57ae1 ___CFXNotificationPost_block_invoke + 225
9 com.apple.CoreFoundation 0x00007fff3db15880 -[_CFXNotificationRegistrar find:object:observer:enumerator:] + 1664
10 com.apple.CoreFoundation 0x00007fff3db149b7 _CFXNotificationPost + 599
11 com.apple.Foundation 0x00007fff3fc248c7 -[NSNotificationCenter postNotificationName:object:userInfo:] + 66
12 com.apple.AppKit 0x00007fff3b210206 -[NSApplication _postDidFinishNotification] + 313
13 com.apple.AppKit 0x00007fff3b20fe4f -[NSApplication _sendFinishLaunchingNotification] + 220
14 com.apple.AppKit 0x00007fff3b0e2ab3 -[NSApplication(NSAppleEventHandling) _handleAEOpenEvent:] + 562
15 com.apple.AppKit 0x00007fff3b0e26e9 -[NSApplication(NSAppleEventHandling) _handleCoreEvent:withReplyEvent:] + 690
16 com.apple.Foundation 0x00...

[Rob Maskell (romell)]

Also seeing quite a few of these errors

Unimplemented handler (7f7a56978294) for 0 (f 7f)
Unimplemented handler (7f2eaa6c8849) for 0 (f 7f)
Unimplemented handler (7f82f92a9294) for 0 (f 7f)
Unimplemented handler (7f04702f2294) for 0 (f 7f)

[Roman Bolshakov (roolebo)]

I have tried to run the OS and I can confirm that some instructions that require VMEXIT are not implemented. In your case that's 0F7F or MOVQ (mem from mmxreg) from MMX. In my case that's 0F11 or MOVUPS(xmmreg1 to mem) from SSE.

I'd recommend you to run -cpu host,-mmx,-sse for a while, but the kernel of the OS explicitly complains that it won't run on CPUs without SSE support.

[Rob Maskell (romell)]

Thanks for helping Roman, so I take it my options at this point are wait for VMEXIT to be implemented or try to find a linux distro that doesn't require SSE?

[Roman Bolshakov (roolebo)]

Considering the fact that both Ubuntu and Elementary require SSE to boot, I'd wait to get decoding fixed. I wrote a test kernel module that reliably reproduces your issue on qemu edu device. Whenever QEMU prints Unimplemented handler Instruction pointer only moves two bytes further, instead of the instruction length. That corrupts code execution as the next instruction after unimplemented handler is decoded from the wrong address.

[Rob Maskell (romell)]

Still an issue on 3.1.0 and now Mojave

[Matt Haggard (mhaggard)]

Adding a ditto to this.

== Command and output ==

$ qemu-system-x86_64 -m 2G -hda mydisk.vdi -accel hvf -vga std
qemu-system-x86_64: warning: host doesn't support requested feature: CPUID.80000001H:ECX.svm [bit 2]
Unimplemented handler (7fe3aac905e8) for 0 (f 11)

This is for a customized Ubuntu install.

== Symptoms ==

Guest window repeatedly alternates between the desktop, then flickers to terminal with the following text:

/dev/sda4: recovering journal
/dev/sda4: clean, 93356/1264800 files, 1076062/5056592 blocks
[ OK ] Started xrdp session manager.
[ OK ] Started OpenBSD Secure Shell server.
[ OK ] Started Terminate Plymouth Boot Screen.
[ OK ] Started Hold until boot process finishes up.

== Host system ==

- macOS 10.14.6
- Bluetooth mouse and keyboard

Also, the workaround of using -cpu host,-mmx,-sse doesn't work (the guest appears to never even boot).

[Thomas Huth (th-huth)]

The QEMU project is currently considering to move its bug tracking to another system. For this we need to know which bugs are still valid and which could be closed already. Thus we are setting older bugs to "Incomplete" now.
If you still think this bug report here is valid, then please switch the state back to "New" within the next 60 days, otherwise this report will be marked as "Expired". Or mark it as "Fix Released" if the problem has been solved with a newer version of QEMU already. Thank you and sorry for the inconvenience.

[Thomas Huth (th-huth)]

This is an automated cleanup. This bug report has been moved to QEMU's
new bug tracker on gitlab.com and thus gets marked as 'expired' now.
Please continue with the discussion here:

 https://gitlab.com/qemu-project/qemu/-/issues/155