qemu-kvm 0.12.1.2 crashes booting Ubuntu 9.10 with "-vga std"

[Timothy Miller]

I have an Ubuntu VM that works fine without "-vga std" but crashes if I add "-vga std". This is the full command line:

qemu-system-x86_64 -vga std -drive
cache=writeback,index=0,media=disk,file=ubuntu.img -k en-us -m 2048 -smp 2 -vnc
:3102 -usbdevice tablet -enable-kvm &

I get this error:

 KVM internal error. Suberror: 1
rax 00007f789177e000 rbx 0000000000000000 rcx 0000000000000000 rdx
0000000000000000
rsi 0000000000000000 rdi 00007f789177e000 rsp 00007fff361775e8 rbp
00007fff36177600
r8 000000000000ff80 r9 0000000000200000 r10 0000000000000000 r11
00007f789100a3f0
r12 00000000004017c0 r13 00007fff36178cf0 r14 0000000000000000 r15
0000000000000000
rip 00007f789100aa7b rflags 00013206
cs 0033 (00000000/ffffffff p 1 dpl 3 db 0 s 1 type b l 1 g 1 avl 0)
ds 0000 (00000000/ffffffff p 0 dpl 0 db 0 s 0 type 0 l 0 g 0 avl 0)
es 0000 (00000000/ffffffff p 0 dpl 0 db 0 s 0 type 0 l 0 g 0 avl 0)
ss 002b (00000000/ffffffff p 1 dpl 3 db 1 s 1 type 3 l 0 g 1 avl 0)
fs 0000 (7f78917906f0/ffffffff p 0 dpl 0 db 0 s 0 type 0 l 0 g 0 avl 0)
gs 0000 (00000000/ffffffff p 0 dpl 0 db 0 s 0 type 0 l 0 g 0 avl 0)
tr 0040 (ffff880001a09440/00002087 p 1 dpl 0 db 0 s 0 type b l 0 g 0 avl 0)
ldt 0000 (00000000/ffffffff p 0 dpl 0 db 0 s 0 type 0 l 0 g 0 avl 0)
gdt ffff8800019fa000/7f
idt ffffffff818fd000/fff
cr0 80050033 cr2 2408000 cr3 379d4000 cr4 6f0 cr8 0 efer d01
emulation failure, check dmesg for details

I'm running kernel 2.6.32, and I have the kvm stuff compiled directly into the
kernel. There's nothing in dmesg about kvm at all.

Note that in the VM grub comes up, but the VM dies when I boot the kernel.

This command line works:

qemu-system-x86_64 -drive cache=writeback,index=0,media=disk,file=ubuntu.img -k
en-us -m 2048 -smp 2 -vnc :3102 -usbdevice tablet -enable-kvm &

That is, removing "-vga std" fixes the problem.

I recently added this option to both my Ubuntu and Windows XP VMs. The Windows VM still works fine. If Windows can detect that the graphics card has changed, then Ubuntu should also have no problem. That being said, I added the std option when using 0.12.1.1, so there may be a qemu regression.

I have reported this bug elsewhere: http://bugs.gentoo.org/show_bug.cgi?id=299211

[Timothy Miller (theosib)]

Clarification: Qemu doesn't quite crash. The process is still running, and I can attach a VNC client (which gives me a black screen). It's just not DOING anything. I can get into the monitor, so if there's some diagnostic thing you'd like me to enter into the monitor, please let me know.

[Theo Nolte (theo-nolte)]

since this morning (probably since i installed kernel 2.6.32-12 in host and guest) the behavior changed.
the guest does not crash any more with 'unaligned pointer error' but gets into an endless loop when loading grub, see attachment

this happens only with '-vga std' option, standard cirrus emulation works fine.

[Theo Nolte (theo-nolte)]

sorry for the wrong attachment, here is the correct one

[Dustin Kirkland  (kirkland)]

Confirmed, I'm seeing the same thing.

[Theo Nolte (theo-nolte)]

Since the last update, the behavior has changed for me and returned to the previous one.
No more boot-loop but instead unaligned pointer error, see screenshot. This happens immediately after Grub takes control (Grub loading).

Again, this happens only with '-vga std' option. Without vga-switch the virtual machine boots fine.

[Timothy Miller (theosib)]

This is still the case with version 0.12.3. Crash when booting Ubuntu (after grub), but no crash with Windows.

[Michael Kofler (michael-kofler)]

still not resolved: guest=Ubuntu 10.10, host=Fedora14

crashes with -vga std or -vga vmware

works with -vga cirrus

[Michael Kofler (michael-kofler)]

PS: qemu-kvm -version = 0.13.0

[Michael Kofler (michael-kofler)]

PPS: Ubuntu 10.10 crashes also with qemu-kvm -vga qxl -spice ...

[Claudio Matsuoka (cmatsuoka)]

Some notes of interest:

- the unaligned pointer error also seems to happen in real systems with certain ATI cards.
- rebuilding grub with mm-debug makes Ubuntu boot without unaligned/out of range pointer messages with -vga std.
- adding debug messages (with grub_printf()) to grub memalign/free functions in kern/mm.c triggers other reported behaviors including the boot loop, and more worrisomely, KVM_INTERNAL_ERROR_EMULATION.

These results obtained with stock Ubuntu 10.10 grub2 in guest (1.98+20100804-5ubuntu3) and 3.1.6-1.fc16.x86_64 host.

[Michael Tokarev (mjt+launchpad-tls)]

see also http://bugs.debian.org/616487 and http://bugs.debian.org/653068 - it appears this prob happens with grub with qxl (spice) and vmware "adaptors"

[Michael Tokarev (mjt+launchpad-tls)]

and it still happens even in version 1.0

[Claudio Matsuoka (cmatsuoka)]

It turns out that my previous attempt to reproduce the vga crash using an image generated by grub-mkrescue (which is easier to work with than dealing with a full Ubuntu image) is invalid due to bad instrumentation in the "normal" module init and a stack overflow produced similar results including the boot loop and internal emulation error. It suggests, however, that the vga problem and other grub-related crashes are also caused by memory corruption in guest.

[Michael Tokarev (mjt+launchpad-tls)]

See also LP#717445:

 https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/717445

which is exactly the same issue but reported against grub. And I tend to think more and more it is a grub bug after all, not qemu/kvm/bios bug.

[Claudio Matsuoka (cmatsuoka)]

Yes, memory corruption in guest explains the unaligned/out of range pointer error (issued when grub2 releases a block of memory, and grub uses dynamic allocation quite a lot) and the boot loop. This corruption most likely originates in the vga code fixed in revision 2470 as reported in Bug #717445. So the real issue seems to be the crash in case of memory corruption instead of handling the issue in a more graceful way (for instance, no error is displayed if qemu/virt-manager is not launched from a terminal). Regardless of the circumstances that caused the kvm internal emulation error, I believe qemu should notify and recover instead of simply crash and burn.

[Claudio Matsuoka (cmatsuoka)]

Note: this is already marked as FIXME in kvm-all.c:

    if (run->internal.suberror == KVM_INTERNAL_ERROR_EMULATION) {
        fprintf(stderr, "emulation failure\n");
        if (!kvm_arch_stop_on_emulation_error(env)) {
            cpu_dump_state(env, stderr, fprintf, CPU_DUMP_CODE);
            return EXCP_INTERRUPT;
        }
    }
    /* FIXME: Should trigger a qmp message to let management know
     * something went wrong.
     */

[Thomas Huth (th-huth)]

Triaging old bug tickets ... can you still reproduce this problem with the latest version of QEMU (v2.8)?

[Thomas Huth (th-huth)]

There hasn't been a reply to my question in the last comment within months, so I assume nobody cares about this anymore. So I'm closing this ticket now...