bin/55583: NVMM dumps core on some code that otherwise runs under qemu without NVMM

[rnestort%tx.rr.com@localhost]

>Number:         55583
>Category:       bin
>Synopsis:       NVMM dumps core on some code that otherwise runs under qemu without NVMM
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Aug 17 20:45:00 +0000 2020
>Originator:     Bob Nestor
>Release:        NetBSD-9.99.70
>Organization:
>Environment:
NetBSD 9.99.70 NetBSD 9.99.70 (GENERIC) #0: Fri Aug 14 03:54:46 UTC 2020  mkrepro%mkrepro.NetBSD.org@localhost:/usr/src/sys/arch/amd64/compile/GENERIC amd64

>Description:
Attempting to boot a small bootable disk image with qemu that was constructed from files contained in the rEFInd CD dumps core if the NVMM accelerator is specified.  Without it the disk image boots fine.

The rEFInd CD was downloaded from
 http://sourceforge.net/projects/refind/files/0.12.0/refind-cd-0.12.0.zip

The small bootable disk image was created with
#!/bin/sh
cwd=`pwd`
vndconfig -c vnd0 refind-cd-0.12.0.iso
mount -t cd9660 /dev/vnd0a /media
rm -fr refind.dsk /tmp/refind
mkdir -p -m 0755 /tmp/refind/EFI/boot /tmp/refind/EFI/refind
cp /media/refind/refind_x64.efi /tmp/refind/EFI/boot/bootx64.efi
cp -r /media/refind/* /tmp/refind/EFI/refind/
echo 'fs0:\EFI\refind\refind_x64.efi' >/tmp/refind/startup.nsh
cd /tmp/refind/EFI/refind
cp refind.conf-sample refind.conf
rm -fr bootaa64.efi drivers_aa64 bootia32.efi drivers_ia32 refind_aa64.efi
rm -fr refind_ia32.efi tools_aa64 tools_ia32
cd ${cwd}
umount /media
vndconfig -u vnd0
makefs -M 1m -m 4m -B 1234   -t msdos -o F=16,c=1 refind.dsk /tmp/refind

Then used with qemu:
#!/bin/sh
vars="/tmp/OVMF_${1}.fd"
if [ "`uname`" = "Linux" ]; then
    accel="-enable-kvm -accel kvm -vga qxl"
else
#    accel="-accel nvmm -vga cirrus"
    accel="-vga cirrus"
fi
if [ ! -f ${vars} ]; then
    dd if=/dev/zero of=${vars} count=4 bs=1024
fi
ovmf=edk2/usr/share/edk2-ovmf/x64/OVMF_CODE.fd
#ovmf=/usr/pkg/share/ovmf/OVMFX64.efi
qemu-system-x86_64 -m 4096 -machine q35 ${accel} -boot menu=on \
    -device qemu-xhci -device usb-tablet -device usb-mouse -smbios type=2 \
    -drive if=pflash,format=raw,readonly,file=${ovmf} \
    -drive if=pflash,format=raw,file=${vars} \
    -device ich9-ahci,id=sata \
    -device ide-hd,bus=sata.0,drive=disk \
    -drive id=disk,if=none,media=disk,format=raw,file=${disk} 

Note: A newer verison of the OVMF file allows the disk to boot up when NVMM isn't used as an accelerator. However, the problem can easily be
reproduced using the current version of OVMF found in pkgsrc.
>How-To-Repeat:
Toggle the use of "-accel nvmm" in the qemu command line
>Fix:
Unknown, however when running the same test in Linux Mint similar results are seen with and without the use of KVM.  So this might be an issue in qemu rather than nvmm or kvm.  Unfortunately I'm not knowledgeable enough to determine where the problem lies.