met this problem on 

qemu-kvm-rhev-1.5.3-20.el7.x86_64

KVM internal error. Suberror: 1
emulation failure
EAX=00000200 EBX=0000aa55 ECX=00000007 EDX=00000080
ESI=00007bd0 EDI=00000800 EBP=000007be ESP=00007be0
EIP=00000684 EFL=00003202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 00000000 ffffffff 00809300
CS =0000 00000000 ffffffff 00809b00
SS =0000 00000000 ffffffff 00809300
DS =0000 00000000 ffffffff 00809300
FS =0000 00000000 ffffffff 00809300
GS =0000 00000000 ffffffff 00809300
LDT=0000 00000000 0000ffff 00008200
TR =0000 00000000 0000ffff 00008b00
GDT=     000fd808 00000037
IDT=     00000000 000003ff
CR0=00000010 CR2=00000000 CR3=00000000 CR4=00000000
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000000
Code=7c 68 01 00 68 10 00 b4 42 8a 56 00 8b f4 cd 13 9f 83 c4 10 <9e> eb 14 b8 01 02 bb 00 7c 8a 56 00 8a 76 01 8a 4e 02 8a 6e 03 cd 13 66 61 73 1c fe 4e 11


command line:
qemu \
    -S  \
    -name 'virt-tests-vm1'  \
    -sandbox on  \
    -M pc-q35-rhel7.0.0  \
    -nodefaults  \
    -vga qxl  \
    -global qxl-vga.vram_size=33554432 \
    -device intel-hda,bus=pcie.0,addr=02 \
    -device hda-duplex  \
    -monitor stdio \
    -chardev socket,id=serial_id_serial0,path=/tmp/serial-serial0-20131203-203439-mlN3V9L2,server,nowait \
    -device isa-serial,chardev=serial_id_serial0 \
    -device virtio-serial-pci,id=virtio_serial_pci0,bus=pcie.0,addr=03  \
    -chardev socket,id=devvs,path=/tmp/virtio_port-vs-20131203-203439-mlN3V9L2,server,nowait \
    -device virtserialport,chardev=devvs,name=vs,id=vs,bus=virtio_serial_pci0.0  \
    -chardev socket,id=seabioslog_id_20131203-203439-mlN3V9L2,path=/tmp/seabios-20131203-203439-mlN3V9L2,server,nowait \
    -device isa-debugcon,chardev=seabioslog_id_20131203-203439-mlN3V9L2,iobase=0x402 \
    -device nec-usb-xhci,id=usb1,bus=pcie.0,addr=04 \
    -device virtio-scsi-pci,id=virtio_scsi_pci0,bus=pcie.0,addr=05 \
    -drive id=drive_image1,if=none,cache=none,snapshot=off,aio=native,file=images/win7-64-virtio.qcow2 \
    -device scsi-hd,id=image1,drive=drive_image1 \
    -device virtio-net-pci,mac=9a:5e:5f:60:61:62,id=idRRc9Jr,netdev=idOqrsQV,bus=pcie.0,addr=06  \
    -netdev tap,id=idOqrsQV,vhost=on,script= \
    -m 4096  \
    -smp 1,maxcpus=1,cores=1,threads=1,sockets=2  \
    -cpu 'Penryn',hv_relaxed \
    -drive id=drive_cd1,if=none,snapshot=off,aio=native,media=cdrom,file=isos/ISO/Windows7/en_windows_7_ultimate_with_sp1_x64_dvd_u_677332.iso \
    -device ide-cd,id=cd1,drive=drive_cd1,bus=ide.0,unit=0 \
    -drive id=drive_winutils,if=none,snapshot=off,aio=native,media=cdrom,file=isos/windows/winutils.iso \
    -device ide-cd,id=winutils,drive=drive_winutils,bus=ide.1,unit=0 \
    -drive id=drive_virtio,if=none,snapshot=off,aio=native,media=cdrom,file=isos/windows/virtio-win.latest_prewhql.iso \
    -device ide-cd,id=virtio,drive=drive_virtio,bus=ide.2,unit=0 \
    -drive id=drive_fl,if=none,cache=none,snapshot=off,readonly=off,aio=native,file=images/win7-64/answer.vfd \
    -global isa-fdc.driveA=drive_fl \
    -device usb-tablet,id=usb-tablet1,bus=usb1.0,port=1  \
    -spice port=3000,password=123456,addr=0,tls-port=3200,x509-dir=/tmp/spice_x509d,tls-channel=main,tls-channel=inputs,image-compression=auto_glz,zlib-glz-wan-compression=auto,streaming-video=all,agent-mouse=on,playback-compression=on,ipv4  \
    -rtc base=localtime,clock=host,driftfix=slew  \
    -boot order=cdn,once=d,menu=off \
    -enable-kvm

Created attachment 838762 [details]
screen shot

Re-tested with these components below:
qemu-kvm-rhev-1.5.3-21.el7.x86_64
seabios-1.7.2.2-6.el7.x86_64
kernel-3.10.0-64.el7.x86_64

Steps same as comment 0.

Results:
qemu-kvm can not boot from guest image disk. And after quit from first NIC boot, vm attempt boot from the second NIC but hang. This time fail to see the kvm internal errors in comment 0.

Disabled 'unrestricted_guest' or using scsi will get same results as above.

If remove ahci disk, then guest would be able to boot from os image disk.

Thanks, it is a different problem.

The minimized reproducer is:
 /usr/libexec/qemu-kvm -nodefaults -m 1G -vnc :1 -vga qxl \
  -netdev tap,id=netdev0 \
  -device virtio-net-pci,netdev=netdev0 \
  -netdev tap,id=hostnet1 \
  -device rtl8139,netdev=hostnet1

After the first pxe has been loaded, I write 'menu' and select '(local)'; it fails to boot and tries the second card, which usually causes a reboot in my case. (I have seen some hangs too)

The type of cards does not matter, two different ones cause a reboot/hang on the second one.
If the cards are of the same type (eg. two virtio), the second pxe does not reboot, but it does not work either -- it want to load pxelinux.cfg/0000-00... (the sysuuid, which is suspicious) instead of pxelinux.cfg/default.

Is this the bug you are hitting?

Hi Han,

Could you have a look comment5 and update your comment?

Best Regards,
Junyi

(In reply to Radim Krčmář from comment #5)
> Thanks, it is a different problem.
> 
> The minimized reproducer is:
>  /usr/libexec/qemu-kvm -nodefaults -m 1G -vnc :1 -vga qxl \
>   -netdev tap,id=netdev0 \
>   -device virtio-net-pci,netdev=netdev0 \
>   -netdev tap,id=hostnet1 \
>   -device rtl8139,netdev=hostnet1
> 
> After the first pxe has been loaded, I write 'menu' and select '(local)'; it
> fails to boot and tries the second card, which usually causes a reboot in my
> case. (I have seen some hangs too)
> 
> The type of cards does not matter, two different ones cause a reboot/hang on
> the second one.
> If the cards are of the same type (eg. two virtio), the second pxe does not
> reboot, but it does not work either -- it want to load
> pxelinux.cfg/0000-00... (the sysuuid, which is suspicious) instead of
> pxelinux.cfg/default.
> 
> Is this the bug you are hitting?

Yes, and some points need to note:

1. If remove extra NICs(e.g. just leave virtio-net), the guest will automatic reboot endless after select '(local)'. usually, it just show 'no bootable device' and wait for handling.

2. There is a small different between virtio-scsi and virtio-blk. When using former, after first PXE done qemu-kvm process would hang during second PXE load, but the latter won't.

I hit the problem when boot guest with mul usb-storages, the CLI see attachment
Version:
Host
# uname -r
3.10.0-79.el7.x86_64
# rpm -q qemu-kvm
qemu-kvm-1.5.3-41.el7.x86_64

Results:
QEMU 1.5.3 monitor - type 'help' for more information
(qemu) xhci: xhci_kick_ep for disabled endpoint 3,1
xhci: xhci_kick_ep for disabled endpoint 3,1
xhci: xhci_kick_ep for disabled endpoint 3,1
xhci: xhci_kick_ep for disabled endpoint 3,1
xhci: xhci_kick_ep for disabled endpoint 3,1
xhci: xhci_kick_ep for disabled endpoint 3,1
xhci: xhci_kick_ep for disabled endpoint 3,1
xhci: xhci_kick_ep for disabled endpoint 3,1
xhci: xhci_kick_ep for disabled endpoint 3,12
xhci: xhci_kick_ep for disabled endpoint 3,12
xhci: xhci_kick_ep for disabled endpoint 3,12
xhci: xhci_kick_ep for disabled endpoint 3,12
xhci: xhci_kick_ep for disabled endpoint 3,12
xhci: xhci_kick_ep for disabled endpoint 3,12
xhci: xhci_kick_ep for disabled endpoint 3,12
xhci: xhci_kick_ep for disabled endpoint 3,12
xhci: xhci_kick_ep for disabled endpoint 3,20
xhci: xhci_kick_ep for disabled endpoint 3,20
xhci: xhci_kick_ep for disabled endpoint 3,20
xhci: xhci_kick_ep for disabled endpoint 3,20
xhci: xhci_kick_ep for disabled endpoint 3,20
xhci: xhci_kick_ep for disabled endpoint 3,20
xhci: xhci_kick_ep for disabled endpoint 3,20
xhci: xhci_kick_ep for disabled endpoint 3,20

(qemu) 
(qemu) info status
VM status: running
(qemu) main_channel_link: add main channel client
main_channel_handle_parsed: net test: latency 246.876000 ms, bitrate 1115634 bps (1.063951 Mbps) LOW BANDWIDTH
inputs_connect: inputs channel client create
red_dispatcher_set_cursor_peer: 
xhci: reset while running!
KVM internal error. Suberror: 1
emulation failure
EAX=000f1a38 EBX=0000008c ECX=00000010 EDX=0000002c
ESI=00006f84 EDI=40000000 EBP=3fff0000 ESP=00006f68
EIP=a20e49d6 EFL=00010002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0010 00000000 ffffffff 00c09300 DPL=0 DS   [-WA]
CS =0008 00000000 ffffffff 00c09b00 DPL=0 CS32 [-RA]
SS =0010 00000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0010 00000000 ffffffff 00c09300 DPL=0 DS   [-WA]
FS =0010 00000000 ffffffff 00c09300 DPL=0 DS   [-WA]
GS =0010 00000000 ffffffff 00c09300 DPL=0 DS   [-WA]
LDT=0000 00000000 0000ffff 00008200 DPL=0 LDT
TR =0000 00000000 0000ffff 00008b00 DPL=0 TSS32-busy
GDT=     000fd808 00000037
IDT=     000fd846 00000000
CR0=00000011 CR2=00000000 CR3=00000000 CR4=00000000
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000000
Code=00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <00> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

(qemu) info status
VM status: paused (internal-error)
(qemu)

Created attachment 856939 [details]
KVM internal error. Suberror: 1

The suberrors usually look very similar and unhelpful. (comment #2 was one of the easy ones -- opcode <9e> wasn't emulated in kvm there)

The error in comment 9 is likely different than the original one, please create a new bug for it.

And please, always mention the whole reproducer, I figured out it is:
 1) boot the guest with command from attachment 856939 [details]
 2) connect with spice
 3) send ctrl+alt+del

(Additional findings:
  qemu system_reset does not fail;
  less than 12 drives do not cause this issue)

(In reply to Radim Krčmář from comment #11)
> The suberrors usually look very similar and unhelpful. (comment #2 was one
> of the easy ones -- opcode <9e> wasn't emulated in kvm there)
> 
> The error in comment 9 is likely different than the original one, please
> create a new bug for it.
> 
> And please, always mention the whole reproducer, I figured out it is:
>  1) boot the guest with command from attachment 856939 [details]
>  2) connect with spice
>  3) send ctrl+alt+del
> 
> (Additional findings:
>   qemu system_reset does not fail;
>   less than 12 drives do not cause this issue)

Hi,Radim
  Thanks your attention.Tried on latest version, but can't hit the problem anymore. I will track the problem ,while hit  again, i will report new bug.

# uname -r
3.10.0-84.el7.x86_64
# rpm -q qemu-kvm
qemu-kvm-1.5.3-45.el7.x86_64

I can't reproduce it anymore, but because iPXE doesn't get to menu, the bug might not be fixed.  7.3 in any case.

I think it is fixed.  Can you still reproduce?

Thanks.  (Also moving to 7.4.)

The bug in Customer Portal 01695855 is not related to bug 1013310.  The internal error show that both jump into zeroed memory, but bug 1013310 needed two network cards and a PXE boot to trigger.  Customer Portal 01695855 happens when booting the Linux kernel (far later) and the resulting internal error is different.

There were actually two different bugs (different manifestations) in Customer Portal 01695855:
 1) internal error after a jump to invalid code in real mode
 2) double fault on rdmsr(MSR_GS_BASE) in long mode

Customer Portal 01695855 has a problem with just one host, so it would be good to know if they have have other hosts with the same configuration.