NetBSD Problem Report #59887

From www@netbsd.org  Sun Jan  4 12:48:38 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 7505B1A923C
	for <gnats-bugs@gnats.NetBSD.org>; Sun,  4 Jan 2026 12:48:38 +0000 (UTC)
Message-Id: <20260104124837.415DC1A923D@mollari.NetBSD.org>
Date: Sun,  4 Jan 2026 12:48:37 +0000 (UTC)
From: nia@pkgsrc.org
Reply-To: nia@pkgsrc.org
To: gnats-bugs@NetBSD.org
Subject: nvmm: running startx on an i386 guest kills the vm
X-Send-Pr-Version: www-1.0

>Number:         59887
>Category:       port-amd64
>Synopsis:       nvmm: running startx on an i386 guest kills the vm
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    port-amd64-maintainer
>State:          feedback
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Jan 04 12:50:00 +0000 2026
>Closed-Date:    
>Last-Modified:  Sun Jan 04 22:00:02 +0000 2026
>Originator:     nia
>Release:        
>Organization:
The NetBSD Foundation
>Environment:
NetBSD siphon 11.99.4 NetBSD 11.99.4 (SIPHON) #0: Sun Dec  7 01:27:19 CET 2025  nia@siphon:/encrypt/obj/sys/arch/amd64/compile/SIPHON amd64
>Description:
qemu crashes with the following:

qemu-system-i386: NVMM: Mem Assist Failed [gpa=0xa0000]
qemu-system-i386: NVMM: Failed to execute a VCPU.
[1]   Abort trap (core dumped) qemu-system-i386 -m 1g -machine q35,accel=nvmm...
>How-To-Repeat:
the command line is as follows:

qemu-system-i386 -m 1g \
	-machine q35,accel=nvmm \
	-cpu host,+invtsc \
	-smp cpus=1,maxcpus=1 \
	-display sdl \
	-object rng-random,filename=/dev/urandom,id=viornd0 \
	-device virtio-rng-pci,rng=viornd0 \
	-netdev user,id=vioif0 -device virtio-net-pci,netdev=vioif0 \
	-audiodev oss,id=oss,out.dev=/dev/audio,in.dev=/dev/audio \
	-device ac97,audiodev=oss \
	-device virtio-blk-pci,drive=hd0 \
	-drive file=netbsd-11.qcow2,if=none,id=hd0 \
	$*

>Fix:

>Release-Note:

>Audit-Trail:

State-Changed-From-To: open->feedback
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Sun, 04 Jan 2026 14:33:35 +0000
State-Changed-Why:
1. Exactly what version of qemu are you using?

   pkg_info -I qemu

2. When did this start happening?

3. Does it happen if you use `-machine pc,accel=nvmm' instead of
   `-machine q35,accel=nvmm'?

4. Does it happen if you use `-machine pc,smm=on,accel=nvmm'?

The guest physical address here, 0xa0000, is exactly the start of the
VGA resource MMIO range (https://wiki.osdev.org/VGA_Hardware).  There
is an upstream bug in qemu with access to VGA resources with SMM
(System Management Mode) disabled in the guest with `-machine smm=off':

https://gitlab.com/qemu-project/qemu/-/issues/2608

This manifested for us -- because NVMM doesn't support SMM and so
`accel=nvm' implies `smm=off' -- as:

PR pkg/59721: qemu VM's blackscreen over VNC wth -machine q35

I proposed a workaround upstream a few months ago, tested it myself,
and got no feedback upstream.  A few days ago I committed the patch to
pkgsrc, so it will apply to qemu>=10.1.3nb1 and no earlier.  I wonder
whether it makes a difference here.


From: nia <nia@NetBSD.org>
To: gnats-bugs@netbsd.org
Cc: 
Subject: Re: port-amd64/59887 (nvmm: running startx on an i386 guest kills
 the vm)
Date: Sun, 4 Jan 2026 21:59:39 +0000

 On Sun, Jan 04, 2026 at 02:33:36PM +0000, riastradh@NetBSD.org wrote:
 > 1. Exactly what version of qemu are you using?
 > 
 >    pkg_info -I qemu
 > 

 qemu-7.2.22

 > 3. Does it happen if you use `-machine pc,accel=nvmm' instead of
 >    `-machine q35,accel=nvmm'?

 Exactly the same.

 > 4. Does it happen if you use `-machine pc,smm=on,accel=nvmm'?
 > 

 qemu-system-i386: System Management Mode not supported by this hypervisor.

>Unformatted:

Home	PR Database Search