kern/59721: qemu VM's blackscreen over VNC wth -machine q35

[roy%marples.name@localhost]

>Number:         59721
>Category:       kern
>Synopsis:       qemu VM's blackscreen over VNC wth -machine q35
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Oct 24 02:50:01 +0000 2025
>Originator:     Roy
>Release:        11.99.3
>Organization:
It Doesn't Work Dot Com
>Environment:
NetBSD cube 11.99.3 NetBSD 11.99.3 (GENERIC) #0: Fri Oct 24 00:41:11 BST 2025  roy@cube:/home/roy/src/obj/sys/arch/amd64/compile/GENERIC amd64
>Description:
Starting a QEMU VM with -machine q35 and -accel nvmm results in a black screen over VNC. Network probes (aka no DHCP request) show the VM isn't functioning.

$ doas cpuctl identify 0
cpu0: highest basic info 00000010
cpu0: highest extended info 80000020
cpu0: "AMD Ryzen 9 3900X 12-Core Processor            "
cpu0: AMD Family 17h (686-class), 3792.86 MHz
cpu0: family 0x17 model 0x71 stepping 0 (id 0x870f10)
cpu0: features 0x178bfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE>
cpu0: features 0x178bfbff<MCA,CMOV,PAT,PSE36,CLFSH,MMX,FXSR,SSE,SSE2,HTT>
cpu0: features1 0x7ef8320b<SSE3,PCLMULQDQ,MONITOR,SSSE3,FMA,CX16,SSE41,SSE42>
cpu0: features1 0x7ef8320b<X2APIC,MOVBE,POPCNT,AES,XSAVE,OSXSAVE,AVX,F16C>
cpu0: features1 0x7ef8320b<RDRAND>
cpu0: features2 0x2fd3fbff<SYSCALL/SYSRET,NOX,MMXX,MMX,FXSR,FFXSR,P1GB,RDTSCP>
cpu0: features2 0x2fd3fbff<LONG>
cpu0: features3 0x75c237ff<LAHF,CMPLEGACY,SVM,EAPIC,ALTMOVCR0,LZCNT,SSE4A>
cpu0: features3 0x75c237ff<MISALIGNSSE,3DNOWPREFETCH,OSVW,IBS,SKINIT,WDT,TCE>
cpu0: features3 0x75c237ff<TopoExt,PCExtC,PCExtNB,DBExt,L2IPERFC,MWAITX>
cpu0: features3 0x75c237ff<AddrMaskExt>
cpu0: features5 0x219c91a9<FSGSBASE,BMI1,AVX2,SMEP,BMI2,QM,PQE,RDSEED,ADX,SMAP>
cpu0: features5 0x219c91a9<CLFLUSHOPT,CLWB,SHA>
cpu0: features6 0x400004<UMIP,MAWAU=0,RDPID>
cpu0: xsave features 0x207<x87,SSE,AVX,PKRU>
cpu0: xsave instructions 0xf<XSAVEOPT,XSAVEC,XGETBV,XSAVES>
cpu0: xsave area size: current 832, maximum 896, xgetbv enabled
cpu0: enabled xsave 0x7<x87,SSE,AVX>
cpu0: I-cache: 32KB 64B/line 8-way, D-cache: 32KB 64B/line 8-way
cpu0: L2 cache: 512KB 64B/line 8-way
cpu0: L3 cache: 16MB 64B/line 16-way
cpu0: ITLB: 64 4KB entries fully associative, 64 2MB entries fully associative, 64 1GB entries fully associative
cpu0: DTLB: 64 4KB entries fully associative, 64 2MB entries fully associative, 64 1GB entries fully associative
cpu0: L2 ITLB: 1024 4KB entries 8-way, 1024 2MB entries 8-way
cpu0: L2 DTLB: 2048 4KB entries 8-way, 2048 2MB entries 4-way
cpu0: Initial APIC ID 0
cpu0: Cluster/Package ID 0
cpu0: Core ID 0
cpu0: SMT ID 0
cpu0: MONITOR/MWAIT extensions 0x3<EMX,IBE>
cpu0: monitor-line size 64
cpu0: C0 substates 1
cpu0: C1 substates 1
cpu0: DSPM-eax 0x4<ARAT>
cpu0: DSPM-ecx 0x1<HWF,NTDC=0>
cpu0: SEF highest subleaf 00000000
cpu0: Power Management features: 0x6799<TS,TTP,HTC,HWP,ITSC,CPB,EffFreq,CONNSTBY,RAPL>
cpu0: AMD Extended features 0x10cb657<CLZERO,IRPERF,XSAVEERPTR,RDPRU,MBE>
cpu0: AMD Extended features 0x10cb657<WBNOINVD,B10,IBPB,INT_WBINVD,STIBP>
cpu0: AMD Extended features 0x10cb657<PREFER_IBRS,IBRS_SAMEMODE,SSBD>
cpu0: RAS features 0x1b<OVFL_RECOV,SUCCOR,MCAX>
cpu0: SVM Rev. 1
cpu0: SVM NASID 32768
cpu0: SVM features 0x13bcff<NP,LbrVirt,SVML,NRIPS,TSCRate,VMCBCleanBits>
cpu0: SVM features 0x13bcff<FlushByASID,DecodeAssist,PauseFilter,B11>
cpu0: SVM features 0x13bcff<PFThreshold,AVIC,V_VMSAVE_VMLOAD,VGIF,GMET>
cpu0: SVM features 0x13bcff<SPEC_CTRL>
cpu0: IBS features 0x3ff<IBSFFV,FetchSam,OpSam,RdWrOpCnt,OpCnt,BrnTrgt>
cpu0: IBS features 0x3ff<OpCntExt,RipInvalidChk,OpBrnFuse,IbsFetchCtlExtd>
cpu0: Encrypted Memory features 0x1000f<SME,SEV,PageFlushMsr,SEV-ES,VTE>
cpu0: UCode version: 0x8701030
$
>How-To-Repeat:
Here's the shell output trying to start a netbsd vm on a netbsd host.

+ qemu-system-x86_64 -machine q35 -drive file=netbsd.qcow2,if=none,id=disk1 -device virtio-blk-pci,drive=disk1 -object rng-random,id=rng1,filename=/dev/urandom -device virtio-rng-pci,rng=rng1 -netdev tap,ifname=tap0,id=net0,script=no,downscript=/home/roy/qemu/qctrl-tapdown -device 'virtio-net-pci,netdev=net0,mac=52:54:00:73:78:00' -netdev tap,ifname=tap1,id=net1,script=no,downscript=/home/roy/qemu/qctrl-tapdown -device 'virtio-net-pci,netdev=net1,mac=52:54:00:73:78:01' -pidfile /home/roy/qemu/run/qemu-netbsd.pid -daemonize -m 4G -smp cpus=2 -vnc ':0'
>Fix:
1) Don't use -machine q35
2) Don't use NVMM
3) Use DragonflyBSD as the host with NVMM and it's peachy

The problem with 1) is that timings go out of whack which renders testing DHCP clients and servers useless.
The problem with 2) is that it's dog slow
The problem with 3) is that it's not NetBSD.