Windows XP SP3 blue screen (VBoxGuest.sys)

[Francesco Bucciantini]

After updating from VirtualBox 5.1 to 5.2, I updated the Guest Additions in safe mode, rebooted and logged in my Virtual Machine (Windows XP SP3 Professional with the Microsoft Extended Support). The login was fine, but I noticed that some programs were misbehaving like Team Viewer and everything was kinda laggy (not smooth). I turned the virtual machine off and on again, logged, same. I did some tests with Advanced Chromium (updated Chromium builds for XP) and Firefox 52 ERS and both were kinda slow. I then tried to open Aspera Connect and it worked fine. Avast was working fine. Disabling it and doing a fresh install of it didn't solve the issue, though. I then left my computer open during the night to download files from a TV Studio using Aspera (these master files were fine and virus free, for the records). Then I woke up, I went to work and I found out that my Virtual Machine had a blue screen caused by VBoxGuest.sys.

Host: Fedora Workstation 26, updated constantly. CPU: Intel i7 6700HQ 4c/8th RAM: 16 GB DDR4 (8x2) GPU: NVIDIA 950M 4GB GDDR5 Hard Drive Host: Toshiba 1TB Sata III

Guest: Windows XP Professional SP3 x86 + Microsoft Premium Support + PAE CPU: 8 cores (I know VBox works with cores and not with thread, in fact I shouldn't assign threads to the virtual machine, 'cause timing would be terrible, but I do it anyway 'cause benchmarks shows that it slightly increase performances. Anyway, limiting it to 4core didn't solve the issue). RAM: 6 GB (read correctly as 6) Hard Drive: Seagate SSHD 1TB Sata III (XP is installed on a Physical SSHD and I use it with the raw disk function. I also have no intention of migrating it into a virtual machine file. It's an install I've been working on flawlessly as programmer since 2001, which has been cloned several times to several different hard drives. It's like my baby).

Screenshot and VBox log file in attachment. Thank you in advance.

[Francesco Bucciantini]

Virtualbox 5.2 log

[Francesco Bucciantini]

Screenshot of the blue-screen

[Francesco Bucciantini]

I upgraded to the developer snapshot: VBoxGuestAdditions_5.2.1-118468.iso and Oracle_VM_VirtualBox_Extension_Pack-5.2.1-118468.vbox-extpack but it doesn't seem to help...

[Socratis]

00:00:05.501681 Guest OS type: 'WindowsXP'
00:00:06.149670 RamSize <integer> = 0x0000000177000000 (6 291 456 000, 6 000 MB, 5.8 GB)

A 32-bit guest can never see more than ~3.5 GB. Drop the memory down, you're hurting your host. I don't speak Italian (only 3 months in university), but if I'm not mistaken, the error code has to do with memory issues. It even directs you to go to the BIOS and simplify your setup.

00:00:06.149667 NumCPUs <integer> = 0x0000000000000008 (8)
00:00:06.592582 CPUM: Physical host cores: 4

You're not assigning 4 out of 4, you're assigning 8 out of 4. This time you're not simply hurting your host, you're killing it. And no, I don't want to go into this debate, yet again. If you're interested in the deeper analysis of why this is a really, really bad idea, check our the comment from Ramshankar in a ​recent post in the forums.

00:00:05.505415 File system of '/usr/share/virtualbox/VBoxGuestAdditions.iso' (DVD) is ext4

You should always eject the GAs CD after you're done with the GAs installation. Otherwise you may run into trouble if you upgrade VirtualBox.

00:00:05.506710 File system of '/root/Windows XP Professional.vmdk' is ext4

Any good excuse for running VirtualBox as "root"? You know you're not supposed to be running almost anything as root, unless there is a really good reason, right? And VirtualBox does *not* need to be run as root, it's borderline dangerous.

00:00:06.149908 [/Devices/sb16/] (level 2)

Windows XP does not have support for the Sound Blaster sound card out of the box. Why did you choose that one, despite not being suggested in the template?

Other than that, the log doesn't show a smoking gun. Maybe it was a one time thing? Does it happen all the time? Does it happen if you downgrade?

[Francesco Bucciantini]

32bit OS are able to see up to 64GB of RAM with PAE activated, but are not able to allocate more than 2GB of RAM per process due to 32bit limitation, though.

[Francesco Bucciantini]

I followed your suggestion anyway and I reduced RAM to 4GB, reduced assigned cores to 4 out of 4, reverted audio to AC97 from SoundBlaster and removed the Guest Additions CD. As to the sound, I used AC97 at the very beginning, but I noticed that it stopped from time to time and it stuttered, so I changed to SoundBlaster but it was the same. Later on, I found out it was due to Pulse Audio and VirtualBox had no fault. I changed it to ALSA and the problem disappeared. I left SoundBlaster out of pure laziness. I reverted it back to AC97 now, though.

I booted Windows XP up with these changes, and it seems that it's still unresponsive with certain programs.

[Francesco Bucciantini]

Oh, almost forgot, I didn't answer to the last question. It doesn't happen when I downgrade Virtualbox. In order to test whether programs were really misbehaving or not, I tried to run a script using Avisynth (a frameserver) which appears to be working in VirtualBox 5.1 and not in VirtualBox 5.2. In VirtualBox 5.2 it ends up with "Windows error 0xC000001D", but it works in VirtualBox 5.1.

The script is very simple and the filter that is making the whole frameserver crash is Dither Tool.

videoop=FFVideoSource("OPtextlessvideo.mkv", fpsnum=24000, fpsden=1001) audioop=FFAudioSource("OPaudiodolby.mka") AudioDub(videoop, audioop) Opening=last

videoed=FFVideoSource("EDtextlessvideo.mkv", fpsnum=24000, fpsden=1001) audioed=FFAudioSource("EDaudiodolby.mka") AudioDub(videoed, audioed) Ending=last

videoep=FFVideoSource("bahamutep1.mkv", fpsnum=24000, fpsden=1001) audioep=FFAudioSource("bahamutep1audiodolby.mka") AudioDub(videoep, audioep)

trim(0, 3307)++Opening++trim(3308, 31530)++Ending

Dither_convert_8_to_16() ly = debicubicy(1280,720,lsb_inout=true) lu = utoy().dither_resize16(1280,720,kernel="spline64",invks=true,invkstaps=3,src_left=0.25,u=1,v=1) lv = vtoy().dither_resize16(1280,720,kernel="spline64",invks=true,invkstaps=3,src_left=0.25,u=1,v=1) ytouv(lu,lv,ly) f3kdb(range=15, Y=80, Cb=60, Cr=60, grainY=0, grainC=0, sample_mode=2, blur_first=true, dynamic_grain=false, opt=-1, mt=true, keep_tv_range=false, input_depth=16, output_depth=8)

The detailed error is: An instruction not supported by the CPU was executed in module 'dither'. Using the debug mode, this is the error:

VirtualDub FilterMod crash report -- build 40087 (release)

---

Disassembly: 13d47e20: 13508d adc edx, [eax-73h] 13d47e23: 4d dec ebp 13d47e24: f4 hlt 13d47e25: e8e1c40100 call 13d6430b 13d47e2a: 689818da13 push 13da1898 13d47e2f: 8d45f4 lea eax, [ebp-0ch] 13d47e32: c745f430d0d813 mov dword ptr [ebp-0ch], 13d8d030 13d47e39: 50 push eax 13d47e3a: e8acd80100 call 13d656eb 13d47e3f: cc int 3 13d47e40: 55 push ebp 13d47e41: 8bec mov ebp, esp 13d47e43: 83ec10 sub esp, 10h 13d47e46: 56 push esi 13d47e47: 8bf2 mov esi, edx 13d47e49: 8b550c mov edx, [ebp+0ch] 13d47e4c: 8bc2 mov eax, edx 13d47e4e: c1ee02 shr esi, 02h 13d47e51: 83e0f0 and eax, 0f0h 13d47e54: 2bd0 sub edx, eax 13d47e56: 8945f4 mov [ebp-0ch], eax 13d47e59: 837d1000 cmp dword ptr [ebp+10h], 00h 13d47e5d: 57 push edi 13d47e5e: 89550c mov [ebp+0ch], edx 13d47e61: 0f8eeb000000 jle 13d47f52 13d47e67: 8b7d18 mov edi, [ebp+18h] 13d47e6a: 8d14b500000000 lea edx, [esi*4+00000000] 13d47e71: 8b751c mov esi, [ebp+1ch] 13d47e74: 8955f0 mov [ebp-10h], edx 13d47e77: 8b45f4 mov eax, [ebp-0ch] 13d47e7a: 8bd7 mov edx, edi 13d47e7c: 8955fc mov [ebp-04h], edx 13d47e7f: 8975f8 mov [ebp-08h], esi 13d47e82: 85c0 test eax, eax 13d47e84: 7e6c jle 13d47ef2 13d47e86: 48 dec eax 13d47e87: 8bf7 mov esi, edi 13d47e89: 8b7df8 mov edi, [ebp-08h] 13d47e8c: 8bd1 mov edx, ecx 13d47e8e: c1e804 shr eax, 04h 13d47e91: 40 inc eax 13d47e92: eb0c jmp 13d47ea0 13d47e94: 8da42400000000 lea esp, [esp+00] 13d47e9b: eb03 jmp 13d47ea0 13d47e9d: 8d4900 lea ecx, [ecx+00h] 13d47ea0: c4e2 les esp, edx <-- FAULT 13d47ea2: 7d30 jge 13d47ed4 13d47ea4: 06 push es 13d47ea5: c4e2 les esp, edx 13d47ea7: 7d30 jge 13d47ed9 13d47ea9: 0fc5fd71 pextrw ebp, mm7, 71h 13d47ead: f0 lock 13d47eae: 08c5 or ch, al 13d47eb0: fd std 13d47eb1: ebc9 jmp 13d47e7c 13d47eb3: c4e2 les esp, edx 13d47eb5: 7d33 jge 13d47eea 13d47eb7: c1c5fc rol ebp, 0fch 13d47eba: 5b pop ebx 13d47ebb: c0c5fc rol ch, 0fch 13d47ebe: 2902 sub [edx], eax 13d47ec0: c4e3 les esp, ebx 13d47ec2: 7d19 jge 13d47edd 13d47ec4: c801c4e2 enter c401, 0e2h 13d47ec8: 7d33 jge 13d47efd 13d47eca: c0c5fc rol ch, 0fch 13d47ecd: 5b pop ebx 13d47ece: c083c6108d5240 rol byte ptr [ebx+528d10c6], 40h 13d47ed5: 83c710 add edi, 10h 13d47ed8: c5fc lds edi, esp 13d47eda: 2942e0 sub [edx-20h], eax 13d47edd: 48 dec eax 13d47ede: 75c0 jnz 13d47ea0 13d47ee0: 8b45f4 mov eax, [ebp-0ch] 13d47ee3: 8975fc mov [ebp-04h], esi 13d47ee6: 8b751c mov esi, [ebp+1ch] 13d47ee9: 8b55fc mov edx, [ebp-04h] 13d47eec: 897df8 mov [ebp-08h], edi 13d47eef: 8b7d18 mov edi, [ebp+18h] 13d47ef2: 837d0c00 cmp dword ptr [ebp+0ch], 00h 13d47ef6: 7e42 jle 13d47f3a 13d47ef8: 837d0c08 cmp dword ptr [ebp+0ch], 08h 13d47efc: 8b75f8 mov esi, [ebp-08h] 13d47eff: c4e2 les esp, edx 13d47f01: 7d30 jge 13d47f33 13d47f03: 02c5 add al, ch 13d47f05: fd std 13d47f06: 71f0 jno 13d47ef8 13d47f08: 08c4 or ah, al 13d47f0a: e27d loop 13d47f89 13d47f0c: 300e xor [esi], cl 13d47f0e: 8b751c mov esi, [ebp+1ch] 13d47f11: c5fd lds edi, ebp 13d47f13: ebc9 jmp 13d47ede 13d47f15: c4e2 les esp, edx 13d47f17: 7d33 jge 13d47f4c 13d47f19: c1c5fc rol ebp, 0fch 13d47f1c: 5b pop ebx 13d47f1d: c0c5fc rol ch, 0fch

Built on Anton3 on Sat Jul 15 11:46:46 2017 using compiler version 1500

Windows 5.1 (Windows XP x86 build 2600) [Service Pack 3] Memory status: virtual free 1526M/2048M, commit limit 7830M, physical total 4000M

EAX = 0000000c EBX = 0014f0d8 ECX = 106b94a0 EDX = 106b94a0 EBP = 1c2dfde8 ESI = 152d0020 EDI = 1534e920 ESP = 1c2dfdd0 EIP = 13d47ea0 EFLAGS = 00010207 FPUCW = ffff027f FPUTW = ffffffff

Crash reason: Illegal instruction

Crash context: An instruction not supported by the CPU was executed in module 'dither'.

Pointer dumps:

EBX 0014f0d8: 13d94c94 0014f0d8 13da887c 13d94c8c 13d94c7c 13d94cb4 000001a1 1081a900 ECX 106b94a0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 EDX 106b94a0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 ESI 152d0020: 82828282 82828282 82828282 82828282 82828282 82828282 83828382 83838382 EDI 1534e920: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 ESP 1c2dfdd0: 00000010 0012eb34 00000340 000000c0 1534e920 152d0020 1c2dfe18 13d47920

1c2dfdf0: 000003c0 00000003 000000ed 152d0020 152d0020 1534e920 13d52a72 00010000 1c2dfe10: 00000001 106b9478 1c2dfe88 13d4f4db 106b94a0 00000340 00000002 00000010 1c2dfe30: 00000001 1534e920 000003c0 000000c3 000000ed 00000000 00000000 0014f0d8

EBP 1c2dfde8: 1c2dfe18 13d47920 000003c0 00000003 000000ed 152d0020 152d0020 1534e920

1c2dfe08: 13d52a72 00010000 00000001 106b9478 1c2dfe88 13d4f4db 106b94a0 00000340 1c2dfe28: 00000002 00000010 00000001 1534e920 000003c0 000000c3 000000ed 00000000 1c2dfe48: 00000000 0014f0d8 106b9468 13d4fb9e 0b7ae978 00000001 00000000 00000000

Thread call stack: 13d47ea0: dither!_AvisynthPluginInit2@4 [13d10000+d020+2ae80] 13d47920: dither!_AvisynthPluginInit2@4 [13d10000+d020+2a900] 13d52a72: dither!_AvisynthPluginInit2@4 [13d10000+d020+35a52] 13d4f4db: dither!_AvisynthPluginInit2@4 [13d10000+d020+324bb] 13d4fb9e: dither!_AvisynthPluginInit2@4 [13d10000+d020+32b7e] 13d4dc2a: dither!_AvisynthPluginInit2@4 [13d10000+d020+30c0a] 13d4ebe1: dither!_AvisynthPluginInit2@4 [13d10000+d020+31bc1] 0ff73c1c: avstp!00003c1c 0ff791c5: avstp!avstp_wait_completion [0ff70000+40e0+50e5] 0ff72306: avstp!00002306 0ff7595a: avstp!avstp_wait_completion [0ff70000+40e0+187a] 0ff75a82: avstp!avstp_wait_completion [0ff70000+40e0+19a2] 7c80b849: kernel32!GetModuleFileNameA [7c800000+b68f+1ba]

-- End of report

[Francesco Bucciantini]

This is the log file of the program crashing and misbehaving in VirtualBox 5.2. I'm gonna attach another log, the one of VirtualBox 5.1 doing the exact same task smootly.

[Francesco Bucciantini]

When I downgraded to VirtualBox 5.1.26, I kept VirtualBox 5.2 Guest Additions and it misbehaved exactly the same way. Then, I downgraded the guest additions as well to VirtualBox 5.1.26 and everything was working again.

[Francesco Bucciantini]

Avisynth, with Dither Tool and Virtual Dub working flawlessly in VirtualBox 5.1.26

[Francesco Bucciantini]

Log Files of Avisynth, with Dither Tool and Virtual Dub working flawlessly in VirtualBox 5.1.26

[Socratis]

Just one quick note, I didn't have time to go through your logs...

I don't know what version of XP you have (besides the Italian :) ), but I've never seen a default XP installation cross the 3.5 GB limit. And yes, I do have PAE/NX enabled in the VM settings, and I did specifically enable the "/pae" option in the "C:\boot.ini". Niente.

[Francesco Bucciantini]

It's normal. When it was first introduced, PAE was unlocked for every version of Windows, including XP. With PAE the page frame number field was expanded from 20 to 24 bits. The size of the "byte offset" from the address being translated is still 12 bits, though, so the total physical address size increases from 32 bits to 36 bits: from 20+12 to 24+12. This increased the physical memory addressable by the CPU from 4 GB to 64 GB and the OS programs still work at 32bit thanks to the HAL (hardware abstraction layer). Unfortunately, though, many manufacturers didn't officially support PAE for their home tier products and this led to many incompatibies with the normal 32bit drivers, especially with system with a large amount of RAM, so Microsoft decided to artificially limit PAE to ~3.5 GB to prevent these issues in some version of Windows, leaving other version unlocked, like Windows Server. My version of Windows XP Professional is unlocked and also gets updates from Microsoft with the paid Extended support renewed every year, but a normal version of Windows XP doesn't.

[Socratis]

Thank youy FranceBB for the keywords (HAL, custom) that led me to more information about this. It seems that there are custom patches out there that fix the issue by replacing the HAL, and actually do an analysis of the whole behavior. See: ​http://vm1.duckdns.org/Public/Windows_XP_SP3_Remove_PAE_Limit/Windows_XP_Remove_PAE_Limit.htm

Couldn't make it work, but on the other hand I tried a total of 2 minutes. My XP VM has 768 MB of RAM, way more that it ever needed ;)

[Pilot]

On Windows 7 also get error like:

00:21:14.868508 PDMR3Reset: after 11 ms, 1 loops: 2 async tasks - ahci/0, piix3ide/0 00:21:21.250822 ERROR [COM]: aRC=VBOX_E_IPRT_ERROR (0x80bb0005) aIID={76eed314-3c72-4bbb-95cf-5eb4947a4041} aComponent={DisplayWrap} aText={Could not take a screenshot (VERR_NOT_SUPPORTED)}, pres erve=false aResultDetail=0 00:21:21.250862 PDMR3Reset: after 6394 ms, 3 loops: 1 async tasks - ahci/0 00:21:31.250743 ERROR [COM]: aRC=VBOX_E_IPRT_ERROR (0x80bb0005) aIID={76eed314-3c72-4bbb-95cf-5eb4947a4041} aComponent={DisplayWrap} aText={Could not take a screenshot (VERR_NOT_SUPPORTED)}, pres erve=false aResultDetail=0 00:21:31.250782 PDMR3Reset: after 16394 ms, 4 loops: 1 async tasks - ahci/0 00:21:41.249519 ERROR [COM]: aRC=VBOX_E_IPRT_ERROR (0x80bb0005) aIID={76eed314-3c72-4bbb-95cf-5eb4947a4041} aComponent={DisplayWrap} aText={Could not take a screenshot (VERR_NOT_SUPPORTED)}, pres erve=false aResultDetail=0 00:21:41.249558 PDMR3Reset: after 26392 ms, 5 loops: 1 async tasks - ahci/0 00:21:51.250735 ERROR [COM]: aRC=VBOX_E_IPRT_ERROR (0x80bb0005) aIID={76eed314-3c72-4bbb-95cf-5eb4947a4041} aComponent={DisplayWrap} aText={Could not take a screenshot (VERR_NOT_SUPPORTED)}, pres erve=false aResultDetail=0 00:21:51.250775 PDMR3Reset: after 36394 ms, 6 loops: 1 async tasks - ahci/0 00:22:01.251867 ERROR [COM]: aRC=VBOX_E_IPRT_ERROR (0x80bb0005) aIID={76eed314-3c72-4bbb-95cf-5eb4947a4041} aComponent={DisplayWrap} aText={Could not take a screenshot (VERR_NOT_SUPPORTED)}, pres erve=false aResultDetail=0 00:22:01.251918 PDMR3Reset: after 46395 ms, 7 loops: 1 async tasks - ahci/0 00:22:11.251326 ERROR [COM]: aRC=VBOX_E_IPRT_ERROR (0x80bb0005) aIID={76eed314-3c72-4bbb-95cf-5eb4947a4041} aComponent={DisplayWrap} aText={Could not take a screenshot (VERR_NOT_SUPPORTED)}, pres erve=false aResultDetail=0

(get BlueScreen)

VirtualBox VM 5.2.0 r118415 freebsd.amd64 (Oct 26 2017 00:33:46) release log 00:00:01.109939 Log opened 2017-10-27T11:40:24.077370000Z 00:00:01.109940 Build Type: release 00:00:01.109954 OS Product: FreeBSD 00:00:01.109958 OS Release: 11.1-RELEASE-p1 00:00:01.109962 OS Version: FreeBSD 11.1-RELEASE-p1 #36 r322620: Thu Aug 17 21:20:27 MSK 2017 root@…:/usr/obj/usr/src/sys/BROTHER 00:00:01.109984 Host RAM: 16350MB (15.9GB) total, 12880MB (12.5GB) available 00:00:01.109989 Executable: /usr/local/lib/virtualbox/VirtualBox 00:00:01.109990 Process ID: 14976 00:00:01.109993 Package type: BSD_64BITS_GENERIC (OSE) 00:00:01.112770 Installed Extension Packs: 00:00:01.112779 VNC (Version: 5.2.0 r118415; VRDE Module: VBoxVNC) 00:00:01.113729 Console: Machine state changed to 'Starting' 00:00:01.113955 Qt version: 5.7.1 00:00:01.113965 X11 Window Manager code: 0 00:00:01.122418 GUI: UIMediumEnumerator: Medium-enumeration finished! 00:00:01.128976 VRDE: loaded version 3 of the server. 00:00:01.133804 X Server details: vendor: The X.Org Foundation, release: 11804000, protocol version: 11.0, display string: :0.0 00:00:01.133827 Using XKB for keycode to scan code conversion 00:00:01.137246 SUP: Loaded VMMR0.r0 (/usr/local/lib/virtualbox/VMMR0.r0) at 0xXXXXXXXXXXXXXXXX - ModuleInit at XXXXXXXXXXXXXXXX and ModuleTerm at XXXXXXXXXXXXXXXX 00:00:01.137280 SUP: VMMR0EntryEx located at XXXXXXXXXXXXXXXX and VMMR0EntryFast at XXXXXXXXXXXXXXXX 00:00:01.141753 Guest OS type: 'Windows7_64'

[Pilot]

VirtualBox VM 5.2.0 r118415

[Socratis]

Replying to Pilot:

On Windows 7 also get error like:

00:21:14.868508 PDMR3Reset: after    11 ms, 1 loops: 2 async tasks - ahci/0, piix3ide/0
00:21:21.250822 ERROR [COM]: aRC=VBOX_E_IPRT_ERROR (0x80bb0005) aIID={76eed314-3c72-4bbb-95cf-5eb4947a4041} aComponent={DisplayWrap} aText={Could not take a screenshot (VERR_NOT_SUPPORTED)}, preserve=false aResultDetail=0

That's not an actual error, it's normal procedure about the thumbnail. Nothing to worry about... It's the following part that gets me a little bit worried:

VirtualBox VM 5.2.0 r118415 freebsd.amd64 (Oct 26 2017 00:33:46) release log
00:00:01.109993 Package type: BSD_64BITS_GENERIC (OSE)

That's the FreeBSD port of VirtualBox, a.k.a. a fork. Not the same as the official VirtualBox. Just saying...