1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
|
graphic: 0.969
permissions: 0.961
debug: 0.960
user-level: 0.954
performance: 0.953
mistranslation: 0.953
semantic: 0.941
ppc: 0.937
socket: 0.936
virtual: 0.933
risc-v: 0.931
hypervisor: 0.930
device: 0.928
PID: 0.925
boot: 0.923
architecture: 0.913
vnc: 0.912
peripherals: 0.911
register: 0.904
assembly: 0.894
i386: 0.889
KVM: 0.888
TCG: 0.887
VMM: 0.884
x86: 0.875
network: 0.856
kernel: 0.855
arm: 0.833
files: 0.831
qemu-system-i386/x86_64 crash with 1 MB guest RAM
When launching qemu-system-i386 or qemu-system-x86_64 with 1 MB of RAM allocated to the guest (-m 1) and no guest image specified, QEMU will crash while trying to "execute code outside of RAM or ROM" after approximately 10 minutes. I discovered this while using QEMU 2.5.0, but I verified that it also occurs with 2.5.1.1 and the latest source available in git (2.6.50, commit d6550e9ed2e1a60d889dfb721de00d9a4e3bafbe). I built all of these different versions of QEMU on the same 64-bit Ubuntu 14.04.3 host using the distro's default GCC 4.8.4.
Two observations:
1. This only occurs when allocating 1 MB of RAM to the guest. When I allocate 2 MB, this does not happen. I tried running both i386/x86_64 QEMUs for hours with 2 MB and didn't observe this crash.
2. This may be a SeaBIOS bug, as there is no guest code to execute. After enabling the SeaBIOS debug at the ISA 0x402 port and redirecting it to stdio, the last SeaBIOS state transition reported ("Booting from ROM... Booting from c980:0361") occurs immediately at QEMU startup with no further logging messages seen prior to the crash ten minutes later. My captured SeaBIOS debug output is here: http://pastebin.com/GXm2L44E
To reproduce, use the following command lines:
./i386-softmmu/qemu-system-i386 -display none -m 1 -monitor stdio
./x86_64-softmmu/qemu-system-x86_64 -display none -m 1 -monitor stdio
For both 32/64-bit QEMUs, the output is the same. After running for about 10 minutes (I've seen it take between 7m 15s (v2.5.1.1) to 10m 25s (v2.6.50) of runtime to occur by using the "time" command), the following output is shown:
--- OUTPUT BEGINS ---
e1000: Reading register at offset: 0x00002410. It is not fully implemented.
e1000: Reading register at offset: 0x00002410. It is not fully implemented.
e1000: Reading register at offset: 0x00002410. It is not fully implemented.
e1000: Reading register at offset: 0x00002410. It is not fully implemented.
e1000: Reading register at offset: 0x00002418. It is not fully implemented.
e1000: Reading register at offset: 0x00002418. It is not fully implemented.
e1000: Reading register at offset: 0x00002418. It is not fully implemented.
e1000: Reading register at offset: 0x00002418. It is not fully implemented.
e1000: Reading register at offset: 0x00002420. It is not fully implemented.
e1000: Reading register at offset: 0x00002420. It is not fully implemented.
e1000: Reading register at offset: 0x00002420. It is not fully implemented.
e1000: Reading register at offset: 0x00002420. It is not fully implemented.
e1000: Reading register at offset: 0x00002428. It is not fully implemented.
e1000: Reading register at offset: 0x00002428. It is not fully implemented.
e1000: Reading register at offset: 0x00002428. It is not fully implemented.
e1000: Reading register at offset: 0x00002428. It is not fully implemented.
e1000: Reading register at offset: 0x00002430. It is not fully implemented.
e1000: Reading register at offset: 0x00002430. It is not fully implemented.
e1000: Reading register at offset: 0x00002430. It is not fully implemented.
e1000: Reading register at offset: 0x00002430. It is not fully implemented.
e1000: Reading register at offset: 0x00003410. It is not fully implemented.
e1000: Reading register at offset: 0x00003410. It is not fully implemented.
e1000: Reading register at offset: 0x00003410. It is not fully implemented.
e1000: Reading register at offset: 0x00003410. It is not fully implemented.
e1000: Reading register at offset: 0x00003418. It is not fully implemented.
e1000: Reading register at offset: 0x00003418. It is not fully implemented.
e1000: Reading register at offset: 0x00003418. It is not fully implemented.
e1000: Reading register at offset: 0x00003418. It is not fully implemented.
e1000: Reading register at offset: 0x00003420. It is not fully implemented.
e1000: Reading register at offset: 0x00003420. It is not fully implemented.
e1000: Reading register at offset: 0x00003420. It is not fully implemented.
e1000: Reading register at offset: 0x00003420. It is not fully implemented.
e1000: Reading register at offset: 0x00003428. It is not fully implemented.
e1000: Reading register at offset: 0x00003428. It is not fully implemented.
e1000: Reading register at offset: 0x00003428. It is not fully implemented.
e1000: Reading register at offset: 0x00003428. It is not fully implemented.
e1000: Reading register at offset: 0x00003430. It is not fully implemented.
e1000: Reading register at offset: 0x00003430. It is not fully implemented.
e1000: Reading register at offset: 0x00003430. It is not fully implemented.
e1000: Reading register at offset: 0x00003430. It is not fully implemented.
e1000: Reading register at offset: 0x00010000. It is not fully implemented.
e1000: Reading register at offset: 0x00010000. It is not fully implemented.
e1000: Reading register at offset: 0x00010000. It is not fully implemented.
e1000: Reading register at offset: 0x00010000. It is not fully implemented.
qemu: fatal: Trying to execute code outside RAM or ROM at 0x000a0063
EAX=00100000 EBX=00000018 ECX=00002c06 EDX=0009cde0
ESI=000caa20 EDI=00100000 EBP=ffffffff ESP=00007bcc
EIP=000038e3 EFL=00000046 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 00000000 ffffffff 00cf9300
CS =9c78 0009c780 ffffffff 008f9b00
SS =0000 00000000 ffffffff 008f9300
DS =9cf3 0009cf30 ffffffff 00cf9300
FS =0000 00000000 ffffffff 00cf9300
GS =0000 00000000 ffffffff 00cf9300
LDT=0000 00000000 0000ffff 00008200
TR =0000 00000000 0000ffff 00008b00
GDT= 00000000 00000000
IDT= 00000000 000003ff
CR0=00000010 CR2=00000000 CR3=00000000 CR4=00000000
DR0=00000000 DR1=00000000 DR2=00000000 DR3=00000000
DR6=ffff0ff0 DR7=00000400
CCS=000000c2 CCD=00002c06 CCO=CLR
EFER=0000000000000000
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00000000000000000000000000000000 XMM01=00000000000000000000000000000000
XMM02=00000000000000000000000000000000 XMM03=00000000000000000000000000000000
XMM04=00000000000000000000000000000000 XMM05=00000000000000000000000000000000
XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000
--- OUTPUT ENDS ---
I forgot to mention that I configured QEMU with the following options prior to building it for these tests:
./configure --target-list=i386-softmmu,x86_64-softmmu --enable-debug --extra-cflags="-g -Wno-error"
I was modifying QEMU 2.5.0 for some of my own testing, and the extra-cflags options come from that. They should have no impact on the reproduction test detailed above if you wish to reproduce my build.
The QEMU project is currently considering to move its bug tracking to
another system. For this we need to know which bugs are still valid
and which could be closed already. Thus we are setting older bugs to
"Incomplete" now.
If you still think this bug report here is valid, then please switch
the state back to "New" within the next 60 days, otherwise this report
will be marked as "Expired". Or please mark it as "Fix Released" if
the problem has been solved with a newer version of QEMU already.
Thank you and sorry for the inconvenience.
[Expired for QEMU because there has been no activity for 60 days.]
|