MMX emulation is missing on HVF Acceleration

Bug #1798451 reported by Rob Maskell
This bug affects 2 people
Affects Status Importance Assigned to Milestone

Bug Description

Robs-MacBook-Pro-2:~ robmaskell$ qemu-system-x86_64 --version
QEMU emulator version 3.0.0

Host: MacOS - 10.13.6
  Model Name: MacBook Pro
  Model Identifier: MacBookPro14,3
  Processor Name: Intel Core i7
  Processor Speed: 2.8 GHz
  Number of Processors: 1
  Total Number of Cores: 4
  L2 Cache (per Core): 256 KB
  L3 Cache: 6 MB
  Memory: 16 GB

Guest OS: Elementary Linux Loki 0.4.1, patched up to date

Command used to start QEMU:

qemu-system-x86_64 \
  -name ElementaryLokiDev \
  -machine pc,accel=hvf \
  -cpu max \
  -smp cpus=2,sockets=2,cores=1,threads=1,maxcpus=2 \
  -numa node,nodeid=0 \
  -numa cpu,node-id=0,socket-id=0 -numa cpu,node-id=0,socket-id=1 \
  -m 8G \
  -vga vmware \
  -hda e4.qcow2

Symptoms: Started without the -smp / -numa commands to install the OS, then added -smp / -numa and the machine boots and lscpu reports extra cpu as expected. Restart VM and it hangs on startup. Remove -smp / -numa and machine starts again.

Revision history for this message
Roman Bolshakov (roolebo) wrote :

I've had issues with multiple vcpus previously.

But I've tried that recently and it worked fine with the fix:

And I've checked your command, no issues.

Could you please try to install qemu from my tap and check if it's gone?

brew tap roolebo/virt
brew install roolebo/virt/qemu --HEAD

Revision history for this message
Rob Maskell (romell) wrote :
Download full text (57.5 KiB)

Thanks for replying Roman, I switched to your tap but even before that I'm not struggling to get the machines to boot even without the smp/numa lines... vga std flashes a lot then hangs with a black screen and a blinking cursor whereas vga vmware quite unexpectedly.

Command to start QEMU:

qemu-system-x86_64 \
  -name Elementary4Dev \
  -machine pc,accel=hvf \
  -cpu max \
  -m 8G \
  -vga vmware \
  -drive file=elem4.qcow2,format=qcow2,media=disk -boot d \
  -cdrom ../VMImages/elementaryos-0.4.1-stable.20180214.iso

I tried the Elementary 0.4.1 and the new just released 5.0 and I get this... also tried cpu host but no luck. It's weird as single cpu was working the other day but stopped working on QEMU 3.0 before I switched to your tap.

Process: qemu-system-x86_64 [716]
Path: /usr/local/bin/qemu-system-x86_64
Identifier: qemu-system-x86_64
Version: 0
Code Type: X86-64 (Native)
Parent Process: ??? [713]
Responsible: qemu-system-x86_64 [716]
User ID: 501

Date/Time: 2018-10-20 20:58:31.473 +0100
OS Version: Mac OS X 10.13.6 (17G65)
Report Version: 12
Bridge OS Version: 3.0 (14Y664)
Anonymous UUID: A83DA3FD-C7C9-DAD6-4F7D-E36F1E90F993

Time Awake Since Boot: 1200 seconds

System Integrity Protection: enabled

Crashed Thread: 5

Exception Type: EXC_CRASH (SIGABRT)
Exception Codes: 0x0000000000000000, 0x0000000000000000

Application Specific Information:
abort() called

Thread 0:: Dispatch queue:
0 libsystem_kernel.dylib 0x00007fff65ad5cf2 __select + 10
1 libglib-2.0.0.dylib 0x00000001036ae359 g_poll + 407
2 qemu-system-x86_64 0x0000000102d53bb6 0x1029a8000 + 3849142
3 qemu-system-x86_64 0x0000000102af1c3e 0x1029a8000 + 1350718
4 qemu-system-x86_64 0x0000000102aef736 0x1029a8000 + 1341238
5 qemu-system-x86_64 0x0000000102c684ee 0x1029a8000 + 2884846
7 0x00007fff3db57daa _CFXRegistrationPost + 458
8 0x00007fff3db57ae1 ___CFXNotificationPost_block_invoke + 225
9 0x00007fff3db15880 -[_CFXNotificationRegistrar find:object:observer:enumerator:] + 1664
10 0x00007fff3db149b7 _CFXNotificationPost + 599
11 0x00007fff3fc248c7 -[NSNotificationCenter postNotificationName:object:userInfo:] + 66
12 0x00007fff3b210206 -[NSApplication _postDidFinishNotification] + 313
13 0x00007fff3b20fe4f -[NSApplication _sendFinishLaunchingNotification] + 220
14 0x00007fff3b0e2ab3 -[NSApplication(NSAppleEventHandling) _handleAEOpenEvent:] + 562
15 0x00007fff3b0e26e9 -[NSApplication(NSAppleEventHandling) _handleCoreEvent:withReplyEvent:] + 690
16 0x00...

Revision history for this message
Rob Maskell (romell) wrote :

Also seeing quite a few of these errors

Unimplemented handler (7f7a56978294) for 0 (f 7f)
Unimplemented handler (7f2eaa6c8849) for 0 (f 7f)
Unimplemented handler (7f82f92a9294) for 0 (f 7f)
Unimplemented handler (7f04702f2294) for 0 (f 7f)

Revision history for this message
Roman Bolshakov (roolebo) wrote :

I have tried to run the OS and I can confirm that some instructions that require VMEXIT are not implemented. In your case that's 0F7F or MOVQ (mem from mmxreg) from MMX. In my case that's 0F11 or MOVUPS(xmmreg1 to mem) from SSE.

I'd recommend you to run -cpu host,-mmx,-sse for a while, but the kernel of the OS explicitly complains that it won't run on CPUs without SSE support.

Revision history for this message
Rob Maskell (romell) wrote :

Thanks for helping Roman, so I take it my options at this point are wait for VMEXIT to be implemented or try to find a linux distro that doesn't require SSE?

Revision history for this message
Roman Bolshakov (roolebo) wrote :

Considering the fact that both Ubuntu and Elementary require SSE to boot, I'd wait to get decoding fixed. I wrote a test kernel module that reliably reproduces your issue on qemu edu device. Whenever QEMU prints Unimplemented handler Instruction pointer only moves two bytes further, instead of the instruction length. That corrupts code execution as the next instruction after unimplemented handler is decoded from the wrong address.

description: updated
tags: added: hvf x86
summary: - HVF linux on OSX hangs 2nd time started after adding socket
+ MMX emulation is missing on HVF Acceleration
Revision history for this message
Rob Maskell (romell) wrote :

Still an issue on 3.1.0 and now Mojave

Revision history for this message
Matt Haggard (mhaggard) wrote :

Adding a ditto to this.

== Command and output ==

$ qemu-system-x86_64 -m 2G -hda mydisk.vdi -accel hvf -vga std
qemu-system-x86_64: warning: host doesn't support requested feature: CPUID.80000001H:ECX.svm [bit 2]
Unimplemented handler (7fe3aac905e8) for 0 (f 11)

This is for a customized Ubuntu install.

== Symptoms ==

Guest window repeatedly alternates between the desktop, then flickers to terminal with the following text:

/dev/sda4: recovering journal
/dev/sda4: clean, 93356/1264800 files, 1076062/5056592 blocks
[ OK ] Started xrdp session manager.
[ OK ] Started OpenBSD Secure Shell server.
[ OK ] Started Terminate Plymouth Boot Screen.
[ OK ] Started Hold until boot process finishes up.

== Host system ==

- macOS 10.14.6
- Bluetooth mouse and keyboard

Also, the workaround of using -cpu host,-mmx,-sse doesn't work (the guest appears to never even boot).

Revision history for this message
Thomas Huth (th-huth) wrote :

The QEMU project is currently considering to move its bug tracking to another system. For this we need to know which bugs are still valid and which could be closed already. Thus we are setting older bugs to "Incomplete" now.
If you still think this bug report here is valid, then please switch the state back to "New" within the next 60 days, otherwise this report will be marked as "Expired". Or mark it as "Fix Released" if the problem has been solved with a newer version of QEMU already. Thank you and sorry for the inconvenience.

Changed in qemu:
status: New → Incomplete
Rob Maskell (romell)
Changed in qemu:
status: Incomplete → New
Revision history for this message
Thomas Huth (th-huth) wrote : Moved bug report

This is an automated cleanup. This bug report has been moved to QEMU's
new bug tracker on and thus gets marked as 'expired' now.
Please continue with the discussion here:

Changed in qemu:
status: New → Expired
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.