Virtualbox Crashes in r600_dri.so Mesa Graphics Driver When Running Ubuntu Guest With Guest Additions Installed

[marete]

On installing guest additions on a Ubuntu 14.10 guest and rebooting, the guest and virtualbox crash immediately _after_ the _login_ screen (i.e. after entering the password and Unity starts setting itself up). Subsequently, every reboot crashes at the same point and only un-installation of the guest additions can work around the problem.

The crash is always reproducible. Debugging details including a coredump, stack trace and register information will be found attached to this bug report.

The system in question is running the 64 bit version of Virtualbox 4.3.20 (4.3.20-96996~Ubuntu~raring) on a 64 bit Ubuntu 14.04 system running kernel 3.8.1.

The system runs the free Radeon drivers. The card is an AMD Radeon Evergreen (REDWOOD) PCI ID: 1002:68c1 (Dell Mobility Radeon HD 5650).

I am using this PPA for the MESA drivers: ​https://launchpad.net/~oibaf/+archive/ubuntu/graphics-drivers but the crash is reproducible with the stock Ubuntu 14.04 MESA drivers and has been for a while (see the next paragraph).

I have been seeing this problem over the last several (I'd say 3 or 4) iterations of Virtualbox as well as the last 2 iterations of the OS (Currently Ubuntu 14.04 but previously 12.04), and across a wide range of kernels.

Further debugging information (including a Stack Trace e.t.c.) is attached but here are the basics:

• The crash occurs due to Signal 11 in r600_dri.so
• Summary Segv Analysis:

  Segfault happened at: 0x7f3ef00ed1bd <_mesa_MultiModeDrawArraysIBM+93>:        
  mov    (%r15,%rbx,1),%esi
   PC (0x7f3ef00ed1bd) ok
   source "(%r15,%rbx,1)" (0x00000030) not located in a known VMA region (needed r
  eadable region)!
   destination "%esi" ok
   Stack memory exhausted (SP below stack segment)
  SegvReason: reading NULL VMA
  

• The kernel has the following traps message in its log after the crash:

  ShCrOpenGL[24186]: segfault at 30 ip 00007ff0902eb1bd sp 00007ff0918afa80 error 4 in r600_dri.so[7ff09016e000+7b8000]
  

Exactly the same crash occurs with the most recent Guest Additions "test build" (Guest Additions, revision 97191), but with the same (un-updated) version of Virtualbox.

See attached files for further debugging information.

[marete]

Stacktrace of the faulting thread.

[marete]

The top of the stacktrace for the faulting thread

[marete]

Stacktrace of all running threads

[marete]

Register Contents

[marete]

Output of glxinfo(1)

[marete]

Xorg server log

[marete]

Output of lspci -v

[marete]

MESA packages installed on the system

[marete]

GDB Disassembly of faulting code

[marete]

Alas, the core dump when compressed with "xz -9" comes to > 6M, quite a bit larger than the 512KB you allow for an attachment. Let me know if there is a work-around.

[Frank Mehnert]

If you send me the core dump (frank _dot_ mehnert _at_ oracle _dot_ com) then I would have a look at the core dump and try to find out where it crashes. However, in particular with such host graphics driver problems often we don't get satisfying results.

As an alternative you could also try to install virtualbox + virtualbox-dbg from the Ubuntu 14.10 repository (AFAIK this is currently version 4.3.18), try to reproduce the crash and post the backtrace here. It might be required to add some more -dbg packages to get a reasonable backtrace. You even might be able to debug this problem yourself.

Still, if you don't know how to continue, just send me the core dump.

[marete]

I will try and reproduce and debug the crash using 4.3.18 in Ubuntu 14.10, as suggested. If I am not successful, I will send you the coredump which is still on my machine. Thanks.

[marete]

I couldn't install the Ubuntu 14.10 packages due to dependency problems. However, I have managed to install a debug version of 4.3.20 from source, and I can reproduce the guest crash (an abort), which occurs just as Xorg is starting, when 3D acceleration is enabled and the guest additions are installed. But there is no core dumped and no trap logged by the kernel in this case (no signal raised).

So my question is, how do I debug an abort (of a guest) that causes no core to be dumped? How can I run the guest in GDB in such a way so that to get a stack trace at the point of the abort? As I said, I am working with a debug build.

Thanks.

[Michael Thayer]

Did you disable hardening when you built VirtualBox <1>? If so you should be able to start a machine in gdb using the command line (in the build directory)

$ gdb --args ./VirtualBox --startvm <machine name or UUID>

<1> https://www.virtualbox.org/wiki/Linux%20build%20instructions

[marete]

Yes, I followed the instructions in the link and disabled hardening. Will try that and report back.

[marete]

Thanks. I now have a very nice stack trace and other information while running under GDB. Let me try debug the issue and will come back here with the results (the trouble is that I know nothing about the OpenGL API, but will try).