floating point exception when Windows NT 4 guest uses its cirrus driver

[James Cave]

Binary package hint: qemu-kvm

The emulation for the Cirrus Logic adapter in QEMU seems to be broken; when Windows NT 4 tries to test the display using the "cirrus compatible display adapter" driver, QEMU dies with the error "Floating point exception."

Ubuntu Version: 9.10
qemu-kvm version: 0.11.0-0ubuntu6.3
KVM: not installed
Guest OS: Windows NT 4.0 SP1
QEMU command line: qemu -m 96 -soundhw all -net nic -net user -localtime -cdrom WindowsNT4.iso nt_ii.hdd

Steps to reproduce:
1. Start to install Windows NT in QEMU.
2. Proceed until Setup shows the Display properties dialog; confirm that Windows has detected a "cirrus compatible display adapter".
3. Click the "Test" button.

Expected behavior: NT displays a test pattern, allows confirmation of display properties, and finishes setup installation
Actual behavior: QEMU closes; the terminal output is "Floating point exception"

ProblemType: Bug
Architecture: i386
Date: Wed Dec 23 18:59:50 2009
DistroRelease: Ubuntu 9.10
InstallationMedia: Kubuntu 9.10 "Karmic Koala" - Release i386 (20091028.5)
KvmCmdLine: Error: command ['ps', '-C', 'kvm', '-F'] failed with exit code 1: UID PID PPID C SZ RSS PSR STIME TTY TIME CMD
MachineType: Gateway 510 2900626
NonfreeKernelModules: nvidia
Package: qemu-kvm 0.11.0-0ubuntu6.3
ProcCmdLine: BOOT_IMAGE=/boot/vmlinuz-2.6.31-16-generic root=UUID=fd77d0ce-f928-4e98-bcc8-d61215dff616 ro quiet splash
ProcEnviron:
 LANG=en_US.UTF-8
 SHELL=/bin/bash
ProcVersionSignature: Ubuntu 2.6.31-16.53-generic
SourcePackage: qemu-kvm
Uname: Linux 2.6.31-16-generic i686
XsessionErrors:
 (polkit-gnome-authentication-agent-1:1616): GLib-CRITICAL **: g_once_init_leave: assertion `initialization_value != 0' failed
 (xfce4-cpugraph-plugin:1660): Gtk-CRITICAL **: gtk_container_set_border_width: assertion `GTK_IS_CONTAINER (container)' failed
 (<unknown>:2333): Gdk-CRITICAL **: gdk_window_get_origin: assertion `GDK_IS_WINDOW (window)' failed
 (<unknown>:2333): Gdk-CRITICAL **: gdk_window_get_origin: assertion `GDK_IS_WINDOW (window)' failed
dmi.bios.date: 04/22/2004
dmi.bios.vendor: Intel Corp.
dmi.bios.version: BF86510A.15A.0066.P13.0404221042
dmi.board.name: D865PELC
dmi.board.vendor: Intel Corporation
dmi.board.version: AAC66359-401
dmi.chassis.asset.tag: 0
dmi.chassis.type: 3
dmi.chassis.vendor: Gateway
dmi.chassis.version: FOX51A01 1ohrCdmaw
dmi.modalias: dmi:bvnIntelCorp.:bvrBF86510A.15A.0066.P13.0404221042:bd04/22/2004:svnGateway:pn5102900626:pvr4000947:rvnIntelCorporation:rnD865PELC:rvrAAC66359-401:cvnGateway:ct3:cvrFOX51A011ohrCdmaw:
dmi.product.name: 510 2900626
dmi.product.version: 4000947
dmi.sys.vendor: Gateway

[Mario Klebsch (mario-klebsch)]

I am also facing this problem. :-(

I used gdb to trace it down. In hw/cirrus_vga.c the exception is hit in cirrus_do_copy:

Program received signal SIGFPE, Arithmetic exception.
[Switching to Thread 0xb7dbeb90 (LWP 31952)]
0x080aaa85 in cirrus_do_copy (s=0x87474d4, dst=480000, src=0, w=2, h=9)
    at /var/tmp/portage/app-emulation/qemu-kvm-0.12.1.2/work/qemu-kvm-0.12.1.2/hw/cirrus_vga.c:687
687 sx = (src % ABS(s->cirrus_blt_srcpitch)) / depth;
(gdb) print s->cirrus_blt_srcpitch
$1 = 0
(gdb) print s->vga.gr[0x26]
$16 = 0 '\000'
(gdb) print s->vga.gr[0x27]
$17 = 0 '\000'

Perhaps the registers are not properly initialized. I #defined DEBUG_BITBLT and got the following output:

rop=0x0e mode=0x00 modeext=0x00 w=2 h=9 dpitch=1 spitch=0 daddr=0x00075300 saddr=0x00000000 writemask=0x00

There is only one line of output, so it seems to be the first BLITBLT operation, that failes. This really could be a bad initial register value. Unfortunately, I have no knowledge on the cirrus chip, so I cannot fix this problem.

I hope, someone else can figure out a way to fix this.

73, Mario

[Chuck Short (zulcss)]

Thanks for the bug report. Ill report this bug upstream.
Regards
chuck

[Dustin Kirkland  (kirkland)]

Can anyone reproduce this bug with Lucid's qemu-kvm 0.12.3 ?

[Dustin Kirkland  (kirkland)]

Anthony,

Does the gdb output above help triage this bug down to the faulty location in the upstream source?

[Dustin Kirkland  (kirkland)]

Marking incomplete. Please confirm this bug if you can reproduce this on Lucid's kvm. Thanks!

[Josef Hopfgartner (josef-netzagentur)]

Ubuntu 10.4 Lucid, right now after a fresh apt-get upgrade

root@virtual02:~# uname -a
Linux virtual02 2.6.32-16-server #25-Ubuntu SMP Tue Mar 9 17:40:50 UTC 2010 x86_64 GNU/Linux

Same problem on Windows NT4 SP6a Server:
- i configure windows nt display settings
- windows needs it's installation cd
- it checks all graphics drivers found on cd
- reboot
- after reboot it seems to habe cirrus running with 256 colours
- then it want's me to run the test
- now the following

dmesg shows up the following:
[340423.822669] kvm[26918] trap divide error ip:46045a sp:7f8bb7b7cbe0 error:0 in qemu-system-x86_64[400000+246000]

after the next powerup of the nt-guest it won't come up again, kvm simply exits again
[340569.828161] kvm[27580] trap divide error ip:46045a sp:7f4a07382be0 error:0 in qemu-system-x86_64[400000+246000]

[Michael Tokarev (mjt+launchpad-tls)]

This bug is present in kvm-0.11 and is fixed in 0.12. JFYI.