Repeated VM segfault with Ubuntu 16.04 host

[RogerLeigh]

The host is Ubuntu 16.04 (amd64) with Workstation 12.1.1 build-3770994.  The guest is FreeBSD 10 or 11 but I'm not sure the specific guest OS is the cause here unless it's triggering anything in the vmware process which other systems don't.

I can power on and run the installer for either of these systems, and if I'm quick complete the install without error.  But if I leave the VM running too long, it halts with a segfault.  This can be in the installer, or after rebooting into the new system, with or without open-vm-tools being installed.  It seems like it happens after a certain time duration from the VM power on, but that might not be correct.  It's not due to any action I take in the guest--it can happen while idle and unattended, while running nothing but a root shell sitting waiting for input.

Looking at the trace in the log, it looks like it's a fault in vmware itself, maybe triggered by something sound-related.  I'm using built-in HDA audio via the ALSA driver (no PulseAudio to complicate things).  Note that I'm not doing *anything* sound-related in the guest.

Being a single user of workstation without a support contract, and the initial support period expired, I'm not sure if there's a better place to report bugs such as this.  Is there a mechanism to feed back crash reports?  Or get a copy of vmware with debug symbols to get you a better stacktrace?  As it is, the product is essentially unusable.

Thanks for any suggestions or guidance.

2016-08-05T08:53:49Z[+145.661]| mks| W115: Caught signal 11 -- tid 6135 (addr 18)

2016-08-05T08:53:49Z[+145.661]| mks| I125: SIGNAL: rip 0x7f7ec30bebd6 rsp 0x7f7ebaac9ab0 rbp 0x7f7e50000020

2016-08-05T08:53:49Z[+145.661]| mks| I125: SIGNAL: rax 0x0 rbx 0x7f7e50011ba0 rcx 0x0 rdx 0x0 rsi 0x0 rdi 0x7f7e50000020

2016-08-05T08:53:49Z[+145.661]| mks| I125:         r8 0x2 r9 0x1 r10 0x13ff r11 0x20 r12 0xf0 r13 0x7f7e50011c90 r14 0x55f3c6603370 r15 0x360

2016-08-05T08:53:49Z[+145.661]| mks| I125: SIGNAL: stack 7F7EBAAC9AB0 : 0x0000000000000011 0x0000000000020000

2016-08-05T08:53:49Z[+145.661]| mks| I125: SIGNAL: stack 7F7EBAAC9AC0 : 0x0001000100000079 0x0000000000000000

2016-08-05T08:53:49Z[+145.661]| mks| I125: SIGNAL: stack 7F7EBAAC9AD0 : 0x0000000000000000 0x0000000000000000

2016-08-05T08:53:49Z[+145.661]| mks| I125: SIGNAL: stack 7F7EBAAC9AE0 : 0x0000000000000000 0x0000000000000001

2016-08-05T08:53:49Z[+145.661]| mks| I125: SIGNAL: stack 7F7EBAAC9AF0 : 0x0000000000000000 0x0000000000000000

2016-08-05T08:53:49Z[+145.661]| mks| I125: SIGNAL: stack 7F7EBAAC9B00 : 0x0000000000000000 0x0000000000000001

2016-08-05T08:53:49Z[+145.661]| mks| I125: SIGNAL: stack 7F7EBAAC9B10 : 0x0000000000000000 0x00007f7e50011c20

2016-08-05T08:53:49Z[+145.661]| mks| I125: SIGNAL: stack 7F7EBAAC9B20 : 0x00007f7e5005ada0 0x0000000000000002

2016-08-05T08:53:49Z[+145.661]| mks| I125: Backtrace:

2016-08-05T08:53:49Z[+145.661]| mks| I125: Backtrace[0] 00007f7ebaac91f0 rip=000055f3c4d0a0ce rbx=000055f3c4d09ea0 rbp=0000000000000000 r12=00007f7ebaaca600 r13=00007f7ebaac9b30 r14=00007f7ebaac9500 r15=0000000000000010

2016-08-05T08:53:49Z[+145.661]| mks| I125: Backtrace[1] 00007f7ebaac9220 rip=000055f3c4fa5278 rbx=00007f7ebaac9b30 rbp=000000000000000b r12=00007f7ebaaca600 r13=00007f7ebaac9b30 r14=00007f7ebaac9500 r15=0000000000000010

2016-08-05T08:53:49Z[+145.661]| mks| I125: Backtrace[2] 00007f7ebaac94b0 rip=000055f3c4fa55ad rbx=000000000000000b rbp=0000000000000002 r12=00007f7ebaaca660 r13=00007f7ebaac9630 r14=00007f7ebaac9500 r15=0000000000000010

2016-08-05T08:53:49Z[+145.661]| mks| I125: Backtrace[3] 00007f7ebaac9500 rip=00007f7ec4e683d0 rbx=00007f7e50011ba0 rbp=00007f7e50000020 r12=00000000000000f0 r13=00007f7e50011c90 r14=000055f3c6603370 r15=0000000000000360

2016-08-05T08:53:49Z[+145.661]| mks| I125: Backtrace[4] 00007f7ebaac9ab0 rip=00007f7ec30bebd6 rbx=00007f7e50011ba0 rbp=00007f7e50000020 r12=00000000000000f0 r13=00007f7e50011c90 r14=000055f3c6603370 r15=0000000000000360

2016-08-05T08:53:49Z[+145.661]| mks| I125: Backtrace[5] 00007f7ebaac9b50 rip=00007f7ec30c2abc rbx=00007f7e50011c20 rbp=00007f7e5005ada0 r12=0000000000000002 r13=0000000000000001 r14=000055f3c6603370 r15=00007f7ec1a43930

2016-08-05T08:53:49Z[+145.661]| mks| I125: Backtrace[6] 00007f7ebaac9ba0 rip=00007f7e6bd5ed7f rbx=00007f7e50011c20 rbp=00007f7e5005ada0 r12=0000000000000002 r13=0000000000000001 r14=000055f3c6603370 r15=00007f7ec1a43930

2016-08-05T08:53:49Z[+145.661]| mks| I125: Backtrace[7] 00007f7ebaac9bd0 rip=00007f7e6bd4b87b rbx=00007f7e5005ada0 rbp=000055f3c6496230 r12=0000000000000000 r13=0000000000000001 r14=000055f3c6603370 r15=00007f7ec1a43930

2016-08-05T08:53:49Z[+145.661]| mks| I125: Backtrace[8] 00007f7ebaac9be0 rip=00007f7e6bd4b890 rbx=00007f7e50062960 rbp=000055f3c6496230 r12=0000000000000000 r13=0000000000000001 r14=000055f3c6603370 r15=00007f7ec1a43930

2016-08-05T08:53:49Z[+145.661]| mks| I125: Backtrace[9] 00007f7ebaac9bf0 rip=00007f7e6bd4b890 rbx=00007f7e50033cf0 rbp=000055f3c6496230 r12=0000000000000000 r13=0000000000000001 r14=000055f3c6603370 r15=00007f7ec1a43930

2016-08-05T08:53:49Z[+145.661]| mks| I125: Backtrace[10] 00007f7ebaac9c00 rip=00007f7e6bd4b890 rbx=00007f7e500119e0 rbp=000055f3c6496230 r12=0000000000000000 r13=0000000000000001 r14=000055f3c6603370 r15=00007f7ec1a43930

2016-08-05T08:53:49Z[+145.661]| mks| I125: Backtrace[11] 00007f7ebaac9c10 rip=00007f7e6bd6da68 rbx=00007f7e50062cc0 rbp=000055f3c6496230 r12=0000000000000000 r13=0000000000000001 r14=000055f3c6603370 r15=00007f7ec1a43930

2016-08-05T08:53:49Z[+145.661]| mks| I125: Backtrace[12] 00007f7ebaac9c30 rip=00007f7e6bd4b890 rbx=00007f7e50062cc0 rbp=000055f3c6496230 r12=0000000000000000 r13=0000000000000001 r14=000055f3c6603370 r15=00007f7ec1a43930

2016-08-05T08:53:49Z[+145.662]| mks| I125: Backtrace[13] 00007f7ebaac9c40 rip=00007f7e6bd6da68 rbx=00007f7e50033810 rbp=000055f3c6496230 r12=0000000000000000 r13=0000000000000001 r14=000055f3c6603370 r15=00007f7ec1a43930

2016-08-05T08:53:49Z[+145.662]| mks| I125: Backtrace[14] 00007f7ebaac9c60 rip=00007f7e6bd4b890 rbx=00007f7e50033810 rbp=000055f3c6496230 r12=0000000000000000 r13=0000000000000001 r14=000055f3c6603370 r15=00007f7ec1a43930

2016-08-05T08:53:49Z[+145.662]| mks| I125: Backtrace[15] 00007f7ebaac9c70 rip=00007f7e6bd4d555 rbx=00007f7e50033810 rbp=000055f3c6496230 r12=0000000000000000 r13=0000000000000001 r14=000055f3c6603370 r15=00007f7ec1a43930

2016-08-05T08:53:49Z[+145.662]| mks| I125: Backtrace[16] 00007f7ebaac9c90 rip=000055f3c4f8e5b7 rbx=00007f7e50028db0 rbp=000055f3c6496230 r12=0000000000000004 r13=0000000000000001 r14=000055f3c6603370 r15=00007f7ec1a43930

2016-08-05T08:53:49Z[+145.662]| mks| I125: Backtrace[17] 00007f7ebaac9ca0 rip=000055f3c4f8df8d rbx=00007f7e50028960 rbp=000055f3c6496230 r12=0000000000000004 r13=0000000000000001 r14=000055f3c6603370 r15=00007f7ec1a43930

2016-08-05T08:53:49Z[+145.663]| mks| I125: Backtrace[18] 00007f7ebaac9cb0 rip=000055f3c4b3f8eb rbx=0000000000000000 rbp=000055f3c6496230 r12=0000000000000004 r13=0000000000000001 r14=000055f3c6603370 r15=00007f7ec1a43930

2016-08-05T08:53:49Z[+145.663]| mks| I125: Backtrace[19] 00007f7ebaac9cc0 rip=000055f3c48ec46c rbx=00007f7ec1a42010 rbp=000055f3c6496230 r12=0000000000000004 r13=0000000000000001 r14=000055f3c6603370 r15=00007f7ec1a43930

2016-08-05T08:53:49Z[+145.663]| mks| I125: Backtrace[20] 00007f7ebaac9cf0 rip=000055f3c48ed837 rbx=0000000000000004 rbp=00007f7ec1a42010 r12=00000009527dfb3c r13=00000009527e030c r14=000055f3c6496230 r15=00007f7ec1a43930

2016-08-05T08:53:49Z[+145.663]| mks| I125: Backtrace[21] 00007f7ebaac9e00 rip=000055f3c4b3d081 rbx=000055f3c5a9d260 rbp=00007f7ebaac9e20 r12=00007f7eb00008c0 r13=00007ffc23a9ebcf r14=00007f7ebaaca9c0 r15=00007ffc23a9ecd0

2016-08-05T08:53:49Z[+145.663]| mks| I125: Backtrace[22] 00007f7ebaac9e20 rip=000055f3c4adbf63 rbx=000055f3c5a7c050 rbp=00007f7ebaac9e20 r12=00007f7eb00008c0 r13=00007ffc23a9ebcf r14=00007f7ebaaca9c0 r15=00007ffc23a9ecd0

2016-08-05T08:53:49Z[+145.663]| mks| I125: Backtrace[23] 00007f7ebaac9f20 rip=00007f7ec4e5e6fa rbx=0000000000000000 rbp=0000000000000000 r12=0000000000000000 r13=00007ffc23a9ebcf r14=00007f7ebaaca9c0 r15=00007ffc23a9ecd0

2016-08-05T08:53:49Z[+145.663]| mks| I125: Backtrace[24] 00007f7ebaac9fc0 rip=00007f7ec3145b5d rbx=00007f7ebaaca700 rbp=0000000000000000 r12=0000000000000000 r13=00007ffc23a9ebcf r14=00007f7ebaaca9c0 r15=00007ffc23a9ecd0

2016-08-05T08:53:49Z[+145.663]| mks| I125: Backtrace[25] 00007f7ebaac9fc8 rip=0000000000000000 rbx=00007f7ebaaca700 rbp=0000000000000000 r12=0000000000000000 r13=00007ffc23a9ebcf r14=00007f7ebaaca9c0 r15=00007ffc23a9ecd0

2016-08-05T08:53:49Z[+145.663]| mks| I125: SymBacktrace[0] 00007f7ebaac91f0 rip=000055f3c4d0a0ce in function (null) in object /usr/lib/vmware/bin/vmware-vmx loaded at 000055f3c47fa000

2016-08-05T08:53:49Z[+145.663]| mks| I125: SymBacktrace[1] 00007f7ebaac9220 rip=000055f3c4fa5278 in function (null) in object /usr/lib/vmware/bin/vmware-vmx loaded at 000055f3c47fa000

2016-08-05T08:53:49Z[+145.663]| mks| I125: SymBacktrace[2] 00007f7ebaac94b0 rip=000055f3c4fa55ad in function (null) in object /usr/lib/vmware/bin/vmware-vmx loaded at 000055f3c47fa000

2016-08-05T08:53:49Z[+145.664]| mks| I125: SymBacktrace[3] 00007f7ebaac9500 rip=00007f7ec4e683d0 in function (null) in object /lib/x86_64-linux-gnu/libpthread.so.0 loaded at 00007f7ec4e57000

2016-08-05T08:53:49Z[+145.664]| mks| I125: SymBacktrace[4] 00007f7ebaac9ab0 rip=00007f7ec30bebd6 in function (null) in object /lib/x86_64-linux-gnu/libc.so.6 loaded at 00007f7ec303f000

2016-08-05T08:53:49Z[+145.664]| mks| I125: SymBacktrace[5] 00007f7ebaac9b50 rip=00007f7ec30c2abc in function cfree in object /lib/x86_64-linux-gnu/libc.so.6 loaded at 00007f7ec303f000

2016-08-05T08:53:49Z[+145.664]| mks| I125: SymBacktrace[6] 00007f7ebaac9ba0 rip=00007f7e6bd5ed7f in function snd_pcm_munmap in object /usr/lib/x86_64-linux-gnu/libasound.so.2 loaded at 00007f7e6bcff000

2016-08-05T08:53:49Z[+145.664]| mks| I125: SymBacktrace[7] 00007f7ebaac9bd0 rip=00007f7e6bd4b87b in function snd_pcm_hw_free in object /usr/lib/x86_64-linux-gnu/libasound.so.2 loaded at 00007f7e6bcff000

2016-08-05T08:53:49Z[+145.664]| mks| I125: SymBacktrace[8] 00007f7ebaac9be0 rip=00007f7e6bd4b890 in function snd_pcm_hw_free in object /usr/lib/x86_64-linux-gnu/libasound.so.2 loaded at 00007f7e6bcff000

2016-08-05T08:53:49Z[+145.664]| mks| I125: SymBacktrace[9] 00007f7ebaac9bf0 rip=00007f7e6bd4b890 in function snd_pcm_hw_free in object /usr/lib/x86_64-linux-gnu/libasound.so.2 loaded at 00007f7e6bcff000

2016-08-05T08:53:49Z[+145.664]| mks| I125: SymBacktrace[10] 00007f7ebaac9c00 rip=00007f7e6bd4b890 in function snd_pcm_hw_free in object /usr/lib/x86_64-linux-gnu/libasound.so.2 loaded at 00007f7e6bcff000

2016-08-05T08:53:49Z[+145.664]| mks| I125: SymBacktrace[11] 00007f7ebaac9c10 rip=00007f7e6bd6da68 in function (null) in object /usr/lib/x86_64-linux-gnu/libasound.so.2 loaded at 00007f7e6bcff000

2016-08-05T08:53:49Z[+145.664]| mks| I125: SymBacktrace[12] 00007f7ebaac9c30 rip=00007f7e6bd4b890 in function snd_pcm_hw_free in object /usr/lib/x86_64-linux-gnu/libasound.so.2 loaded at 00007f7e6bcff000

2016-08-05T08:53:49Z[+145.664]| mks| I125: SymBacktrace[13] 00007f7ebaac9c40 rip=00007f7e6bd6da68 in function (null) in object /usr/lib/x86_64-linux-gnu/libasound.so.2 loaded at 00007f7e6bcff000

2016-08-05T08:53:49Z[+145.664]| mks| I125: SymBacktrace[14] 00007f7ebaac9c60 rip=00007f7e6bd4b890 in function snd_pcm_hw_free in object /usr/lib/x86_64-linux-gnu/libasound.so.2 loaded at 00007f7e6bcff000

2016-08-05T08:53:49Z[+145.664]| mks| I125: SymBacktrace[15] 00007f7ebaac9c70 rip=00007f7e6bd4d555 in function snd_pcm_close in object /usr/lib/x86_64-linux-gnu/libasound.so.2 loaded at 00007f7e6bcff000

2016-08-05T08:53:49Z[+145.664]| mks| I125: SymBacktrace[16] 00007f7ebaac9c90 rip=000055f3c4f8e5b7 in function (null) in object /usr/lib/vmware/bin/vmware-vmx loaded at 000055f3c47fa000

2016-08-05T08:53:49Z[+145.664]| mks| I125: SymBacktrace[17] 00007f7ebaac9ca0 rip=000055f3c4f8df8d in function (null) in object /usr/lib/vmware/bin/vmware-vmx loaded at 000055f3c47fa000

2016-08-05T08:53:49Z[+145.664]| mks| I125: SymBacktrace[18] 00007f7ebaac9cb0 rip=000055f3c4b3f8eb in function (null) in object /usr/lib/vmware/bin/vmware-vmx loaded at 000055f3c47fa000

2016-08-05T08:53:49Z[+145.664]| mks| I125: SymBacktrace[19] 00007f7ebaac9cc0 rip=000055f3c48ec46c in function (null) in object /usr/lib/vmware/bin/vmware-vmx loaded at 000055f3c47fa000

2016-08-05T08:53:49Z[+145.665]| mks| I125: SymBacktrace[20] 00007f7ebaac9cf0 rip=000055f3c48ed837 in function (null) in object /usr/lib/vmware/bin/vmware-vmx loaded at 000055f3c47fa000

2016-08-05T08:53:49Z[+145.665]| mks| I125: SymBacktrace[21] 00007f7ebaac9e00 rip=000055f3c4b3d081 in function (null) in object /usr/lib/vmware/bin/vmware-vmx loaded at 000055f3c47fa000

2016-08-05T08:53:49Z[+145.665]| mks| I125: SymBacktrace[22] 00007f7ebaac9e20 rip=000055f3c4adbf63 in function (null) in object /usr/lib/vmware/bin/vmware-vmx loaded at 000055f3c47fa000

2016-08-05T08:53:49Z[+145.665]| mks| I125: SymBacktrace[23] 00007f7ebaac9f20 rip=00007f7ec4e5e6fa in function (null) in object /lib/x86_64-linux-gnu/libpthread.so.0 loaded at 00007f7ec4e57000

2016-08-05T08:53:49Z[+145.665]| mks| I125: SymBacktrace[24] 00007f7ebaac9fc0 rip=00007f7ec3145b5d in function clone in object /lib/x86_64-linux-gnu/libc.so.6 loaded at 00007f7ec303f000

2016-08-05T08:53:49Z[+145.665]| mks| I125: SymBacktrace[25] 00007f7ebaac9fc8 rip=0000000000000000

2016-08-05T08:53:49Z[+145.665]| vmx| E105: PANIC: Loop on signal 11.

2016-08-05T08:53:49Z[+145.665]| vmx| W115:

2016-08-05T08:53:49Z[+145.665]| vmx| W115+ The core dump limit is set to ZERO; no core dump should be expected

2016-08-05T08:53:49Z[+145.665]| mks| E105: PANIC: Unexpected signal: 11.

2016-08-05T08:53:49Z[+145.665]| mks| E105: Panic loop

[dariusd]

Interesting.  Definitely sound-related, and more specifically, it's related to sound coming from the emulated PC speaker (which we will send through ALSA on your host, or sometimes through pulse if it's available).

I can't tell for sure why it's crashing, but you can try powering off the VM and adding to its .vmx file:

   mks.noBeep = "TRUE"

and that should silence the PC speaker emulation and hopefully will make the crashing stop.

If instead you want to try a debug build, leave the beep enabled, but go into your VM's settings, into the Options tab, choose Advanced from the list on the left-hand side, then set Gather debugging information to Full.  The virtual machine will run a bit slower, but there is a chance we'll collect and log more useful information during the crash.  I'm not sure whether we're likely to get anything more meaningful from this particular crash, but it might be worth a try anyway, if you can tolerate another crash...

Thanks,

--

Darius

[RogerLeigh]

Dear Darius,

Thanks, this does appear to mitigate the problem, and is a fine workaround for the time being.  I've not seen any faults with this, though I haven't given it more than an hour or so of testing (but the error was usually triggered after just a minute or so, so it's definitely had some effect).

If I set mks.noBeep = "TRUE" then it appears to avoid hitting the problem.  When this is disabled, the time to fault is somewhere between 2 and 5 minutes from making a beep.

I've attached the log with "full" debugging, but it unfortunately shows less information in the trace.  But the fault is in or related to libspeexdsp.so.1 as well as libasound.  May be a slightly different trigger on this occasion. But the failure point at the head of the trace looks the same.  Hope that's potentially useful for fixing this in the future.  It looks like the beeper might be a trigger--if I hit tab in the shell and have it beep, it's a minute or so later that the error occurs.  Does the audio device get closed and the resources cleaned up after a certain period of inactivity?  If so, is there potentially an error in that codepath?

Regards,

Roger

[RogerLeigh]

Actually, the 2-5 min timing is inaccurate.  I've just had it fail 22 seconds after the first beep, 95 seconds after system startup.  The time isn't as predictable as I initially thought.

[dariusd]

There are several levels of cleanup after the end of a sound.  Something could very well be going wrong in there, either within VMware Workstation itself or your ALSA libraries or speex libraries or elsewhere (we have a remarkable ability to tickle unusual codepaths...).

Could you tell us a bit more about your host's sound setup and hardware?  (Maybe include the output of "aplay -L" on the host too.)

If you could double-check and report the precise guest OS version as well, that might help with reproducing the issue here just in case the guest OS might happen to be doing something bizarre that's indirectly triggering the problem.  Your logfile shows that FreeBSD-10.3-RELEASE-amd64-disc1.iso has been attached to the VM at some point... was it installed from that?

Thanks for your patience, and apologies for the hassle this problem is causing you...

--

Darius

[RogerLeigh]

The mainboard is an ASUS SABERTOOTH R2.0 board with AMD FX-8350 CPU and onboard intel HDA sound (HDA ATI SB, ALC892).  I have attached the output of "aplay -L" and "lspci".  The aplay output also shows HDMI output, but that's from the GPU and is unused.

The host operating system is stock Ubuntu 16.04, with the asound and speex libraries provided with it, plus of course the current VMware Workstation 12.

In case this was the result of the byzantine layers of sound and other desktop stuff on Linux nowadays, I've run VMware under a "full" KDE5 desktop with all the bells and whistles except for pulseaudio.  And also under my regular i3 window manager.  The faults are seen under both environments, so I don't think there's anything pertinent there.  I could retry with pulseaudio running, but since to this day that means non-working sound, I don't know it would be very helpful.

# uname -rsv
Linux 4.4.0-31-generic #50-Ubuntu SMP Wed Jul 13 00:07:12 UTC 2016

# dpkg --get-selections | egrep "alsa|asound|speex" | cut -f 1 | xargs dpkg -s | egrep  "^(Package|Version):"  
Package: alsa-base
Version: 1.0.25+dfsg-0ubuntu5
Package: alsa-utils
Version: 1.1.0-0ubuntu5
Package: libasound2
Version: 1.1.0-0ubuntu1
Package: libasound2-data
Version: 1.1.0-0ubuntu1
Package: libasound2-dbg
Version: 1.1.0-0ubuntu1
Package: libasound2-plugins
Version: 1.1.0-0ubuntu1
Package: libspeex1
Version: 1.2~rc1.2-1ubuntu1
Package: libspeexdsp1
Version: 1.2~rc1.2-1ubuntu1

The guest operating system was FreeBSD 10.3 or FreeBSD 11.0 BETA(1-3) or Ubuntu 14.04.  I've reproduced the same segfault with all of them.  The Ubuntu log is attached; it has a slightly different stacktrace (but it's pretty much the same story as the others).  To reproduce:

• FreeBSD: Log in, type something like "ls /[tab]" and the tab completion echoes a "^G" which makes the sc terminal driver issue a speaker beep.  This is easy to do as part of the default operation which was why I was seeing the fault on FreeBSD more than other systems.  Can be reproduced with the install CD; just boot, choose shell and then tab complete; it will die a minute or so later.
• Ubuntu: "apt-get-install beep; modprobe pcspkr; beep"
• Windows 7 x64: Doesn't use the PC speaker by default unless you tweak the ioports directly, so I've not yet seen this one segfault, but it's likely I could trigger it with a little effort.
  

Both methods of reproduction result in rapid death of the guest.

[dariusd]

Thanks for all that info.  The ultimate reproducible beep case: With the VM powered off, choose VM > Power > Power On to Firmware, then, when the BIOS setup appears, press the backspace key, then the VM should beep.  And probably then crash a moment later, in your case... 

I'll do a bit more rummaging around here to try to figure out what's happening.  I might need to get in touch again and request a core file if I can't make any progress by other means.

Cheers,

--

Darius

[dariusd]

How have you disabled pulseaudio on the host?  Have you uninstalled parts of it, or just shut down its server, or something else...?  I think "stock Ubuntu 16.04" will always include pulse, unless you are doing a minimal installation or something like that...

Cheers,

--

Darius

[RogerLeigh]

To follow up to your last questions:

If I power on to firmware and hit backspace, then I do also see the crash, so this does appear to be independent of any guest OS.

Regarding pulseaudio, yes I uninstalled the "pulseaudio" server package as well as "plasma-pa" for KDE since they were broken beyond belief.  After reinstalling both, rebooting and logging back in and setting the correct outputs, I get something resembling audio output and vmware does not appear to crash from the firmware screen if I make it beep.  However... pulseaudio is as broken as ever.  Instead of a beep, I hear a train of small pulses, with an "echo" following it, repeating them at a lower volume.  And if any other audio is playing at the same time, the whole thing becomes an incoherent mess of static until vmware closes its connection a few tens of seconds later.  The lack of proper beep may be the audio data vmware is submitting is a bad waveform--it's very different than the proper beep I was getting with plain ALSA; the awful mixing is most likely pulseaudio being an unusable buggy mess as usual.  I'll have to remove it again.  The irony being, ALSA does (for me) perfect mixing of multiple processes' sound without any trouble at all, making the complex mess completely redundant.  Retaining the sane non-pulse output is certainly something I and I suspect quite a few others greatly appreciate!

[dariusd]

OK, I managed to bypass Pulse by copying /etc/pulse/client.conf to ~/.pulse/client.conf and modifying it to not automatically launch the pulseaudio daemon... that is sufficient to cause us to fall back to using ALSA.  With that configuration, I can sometimes (rarely!) trigger a segfault from a PC speaker beep, and I've obtained a core from such a crash.  I'll see if I can make anything of it...

It's been a long while since I rummaged through the ALSA code, but I recall seeing some commentary that on some ALSA hosts we've seen that we can request a playback stream at a particular sampling rate, say 44.1 kHz, and ALSA will create a stream that is actually running at a different sampling rate (say 48 kHz) with no indication that it's anything other than a 44.1 kHz stream, but it doesn't do any resampling for us...  which will lead to corrupted audio streams since we're not providing sufficient audio data... and as far as I know there is nothing we can really do about it.  Interestingly, that is supposed to be a problem with ALSA but not with Pulse, which is what I see on my Debian 8 host, but is not what you are seeing there.  Yay for Linux audio support!

Cheers,

--

Darius

[RogerLeigh]

I've recently retested this with Workstation 12.5.6 and Ubuntu 17.04, with several different guests.  I'm still getting a segfault as above.

If the ALSA support is fundamentally broken, please could it be fixed or removed, or make beeping disabled by default when using ALSA?  Having workstation segfault every time a guest OS makes a beep makes it practically unusable.  I'm still working around this by using mks.noBeep = "TRUE", but having to manually work around this defect every time I create a new VM is getting very tiresome.

I'm afraid using PulseAudio continues to be impossible; it's still quite broken on my hardware, as described above.

Many thanks,

Roger

Stack trace:

2017-06-03T14:24:19+01:00[+3.299]| vmx| W115: Caught signal 11 -- tid 152822 (addr 7FB6FC2230F0)

2017-06-03T14:24:19+01:00[+3.299]| vmx| I125: SIGNAL: rip 0x7fb3e05fc641 rsp 0x7ffe04fb8090 rbp 0x7fb3cc014870

2017-06-03T14:24:19+01:00[+3.299]| vmx| I125: SIGNAL: rax 0xcc06acc1 rbx 0x7fb3cc077df0 rcx 0xcc06acc0 rdx 0x7fb3cc077df4 rsi 0xcc06acef rdi 0x7fb3cc014870

2017-06-03T14:24:19+01:00[+3.299]| vmx| I125:         r8 0x7ffe04fb8130 r9 0x7ffe04fb80dc r10 0x30 r11 0x0 r12 0x0 r13 0x7ffe04fb80ec r14 0x30 r15 0x7ffe04fb80dc

2017-06-03T14:24:19+01:00[+3.299]| vmx| I125: SIGNAL: stack 7FFE04FB8090 : 0x00007ffe04fb91c4 0x0000000000000000

2017-06-03T14:24:19+01:00[+3.299]| vmx| I125: SIGNAL: stack 7FFE04FB80A0 : 0x00007fb3cc014870 0x00007ffe04fb91c8

2017-06-03T14:24:19+01:00[+3.299]| vmx| I125: SIGNAL: stack 7FFE04FB80B0 : 0x00000000000000cf 0x00007fb3cc077df0

2017-06-03T14:24:19+01:00[+3.300]| vmx| I125: SIGNAL: stack 7FFE04FB80C0 : 0x0000000000000000 0x00007fb3e05fc6b5

2017-06-03T14:24:19+01:00[+3.300]| vmx| I125: SIGNAL: stack 7FFE04FB80D0 : 0x00007ffe04fb91c0 0x0000000000000030

2017-06-03T14:24:19+01:00[+3.300]| vmx| I125: SIGNAL: stack 7FFE04FB80E0 : 0x00007ffe04fb91c4 0xcc06acc0e05fc606

2017-06-03T14:24:19+01:00[+3.300]| vmx| I125: SIGNAL: stack 7FFE04FB80F0 : 0x00007ffe04fb91f0 0x0000000000000000

2017-06-03T14:24:19+01:00[+3.300]| vmx| I125: SIGNAL: stack 7FFE04FB8100 : 0x00007ffe04fb9200 0x00007fb3cc077df0

2017-06-03T14:24:19+01:00[+3.300]| vmx| I125: Backtrace:

2017-06-03T14:24:19+01:00[+3.300]| vmx| I125: Backtrace[0] 00007ffe04fb77c0 rip=000055f00d47a506 rbx=000055f00d47a280 rbp=0000000000000000 r12=0000000000000000 r13=00007ffe04fb8110 r14=00007fb485dffd50 r15=0000000000000000

2017-06-03T14:24:19+01:00[+3.300]| vmx| I125: Backtrace[1] 00007ffe04fb7800 rip=000055f00d7d6718 rbx=00007ffe04fb8110 rbp=000000000000000b r12=0000000000000000 r13=00007ffe04fb8110 r14=00007fb485dffd50 r15=0000000000000000

2017-06-03T14:24:19+01:00[+3.300]| vmx| I125: Backtrace[2] 00007ffe04fb7aa0 rip=000055f00d7d6b55 rbx=000000000000000b rbp=00007ffe04fb7b00 r12=0000000000000000 r13=00007ffe04fb7c30 r14=00007fb485dffd50 r15=0000000000000000

2017-06-03T14:24:19+01:00[+3.300]| vmx| I125: Backtrace[3] 00007ffe04fb7b00 rip=00007fb4859fc670 rbx=00007fb3cc077df0 rbp=00007fb3cc014870 r12=0000000000000000 r13=00007ffe04fb80ec r14=0000000000000030 r15=00007ffe04fb80dc

2017-06-03T14:24:19+01:00[+3.300]| vmx| I125: Backtrace[4] 00007ffe04fb8090 rip=00007fb3e05fc641 rbx=00007fb3cc077df0 rbp=00007fb3cc014870 r12=0000000000000000 r13=00007ffe04fb80ec r14=0000000000000030 r15=00007ffe04fb80dc

2017-06-03T14:24:19+01:00[+3.300]| vmx| I125: Backtrace[5] 00007ffe04fb80d0 rip=00007fb3e05fc6b5 rbx=0000000000000000 rbp=00007fb3cc014870 r12=00007ffe04fb91c8 r13=00000000000000cf r14=00007fb3cc077df0 r15=0000000000000000

2017-06-03T14:24:19+01:00[+3.300]| vmx| I125: Backtrace[6] 00007ffe04fb8130 rip=00007fb3e05fd865 rbx=0000000000000000 rbp=00007ffe04fb9200 r12=00007fb3cc077df0 r13=0000000000000002 r14=00007ffe04fb83e8 r15=00007fb3cc014870

2017-06-03T14:24:19+01:00[+3.300]| vmx| I125: Backtrace[7] 00007ffe04fb9210 rip=00007fb3e05fda55 rbx=00007ffe04fb9278 rbp=00007ffe04fb927c r12=00007fb3cc07d130 r13=0000000000000001 r14=0000000000000400 r15=00007fb3cc014870

2017-06-03T14:24:19+01:00[+3.300]| vmx| I125: Backtrace[8] 00007ffe04fb9270 rip=00007fb3e083bbd9 rbx=00007fb3cc0765a0 rbp=00000000000003ac r12=0000000000000400 r13=00007fb3cc0783c0 r14=0000000000000001 r15=0000000000000c00

2017-06-03T14:24:19+01:00[+3.300]| vmx| I125: Backtrace[9] 00007ffe04fb9290 rip=00007fb3eb8d0316 rbx=00007fb3cc0765a0 rbp=00000000000003ac r12=0000000000000400 r13=00007fb3cc0783c0 r14=0000000000000001 r15=0000000000000c00

2017-06-03T14:24:19+01:00[+3.300]| vmx| I125: Backtrace[10] 00007ffe04fb92e0 rip=00007fb3eb8d072e rbx=00007fb3cc074ab0 rbp=00007fb3cc0765a0 r12=0000000000000400 r13=00007ffe04fb9300 r14=00007ffe04fb9308 r15=0000000000000b04

2017-06-03T14:24:19+01:00[+3.300]| vmx| I125: Backtrace[11] 00007ffe04fb9360 rip=00007fb3eb8d083a rbx=00007fb3cc074ab0 rbp=00007fb3cc0765a0 r12=0000000000000800 r13=00000000000003e8 r14=0000000000000eec r15=00007ffe04fb93e0

2017-06-03T14:24:19+01:00[+3.300]| vmx| I125: Backtrace[12] 00007ffe04fb9390 rip=00007fb3eb8d08e3 rbx=00000000000000dd rbp=00007fb3cc074ab0 r12=0000000000000000 r13=00007ffe04fb94a0 r14=00000000000000dd r15=00007ffe04fb93e0

2017-06-03T14:24:19+01:00[+3.300]| vmx| I125: Backtrace[13] 00007ffe04fb93b0 rip=00007fb3eb8c35a0 rbx=00007fb3cc074ab0 rbp=0000000000000000 r12=0000000000000000 r13=00007ffe04fb94a0 r14=00000000000000dd r15=00007ffe04fb93e0

2017-06-03T14:24:19+01:00[+3.300]| vmx| I125: Backtrace[14] 00007ffe04fb9430 rip=00007fb3eb8b7956 rbx=0000000000000000 rbp=00000000000000dd r12=0000000000000000 r13=00007fb3eb92b798 r14=0000000000000000 r15=00007fb3cc074ab0

2017-06-03T14:24:19+01:00[+3.300]| vmx| I125: Backtrace[15] 00007ffe04fb94a0 rip=00007fb3eb8c38fa rbx=00000000000000dd rbp=00007ffe04fb94f0 r12=00007fb3cc074ab0 r13=0000000000000000 r14=000055f013279d10 r15=000037da76986604

2017-06-03T14:24:19+01:00[+3.300]| vmx| I125: Backtrace[16] 00007ffe04fb9500 rip=000055f00d7b4858 rbx=00007fb3cc05d400 rbp=00000000000000dd r12=0000000000000002 r13=0000000000000000 r14=000055f013279d10 r15=000037da76986604

2017-06-03T14:24:19+01:00[+3.300]| vmx| I125: Backtrace[17] 00007ffe04fb9530 rip=000055f00ce7f177 rbx=000055f013288a80 rbp=00007fb4825db010 r12=0000000000000000 r13=0000000000000000 r14=000055f013279d10 r15=000037da76986604

2017-06-03T14:24:19+01:00[+3.300]| vmx| I125: Backtrace[18] 00007ffe04fb95c0 rip=000055f00ce801cf rbx=0000000000000000 rbp=0000000e4c681e6f r12=00007fb4825db010 r13=0000000e4c68169f r14=00007ffe04fb9660 r15=00007fb4825db050

2017-06-03T14:24:19+01:00[+3.300]| vmx| I125: Backtrace[19] 00007ffe04fb96d0 rip=000055f00ce839d1 rbx=000055f00e287660 rbp=000055f013279d10 r12=000055f013072f20 r13=0000000000000000 r14=000055f00e287620 r15=000055f013072f20

2017-06-03T14:24:19+01:00[+3.301]| vmx| I125: Backtrace[20] 00007ffe04fb97f0 rip=000055f00ce77fec rbx=0000000000000003 rbp=0000000000000000 r12=000055f00e0a5cf8 r13=000055f012d24540 r14=000055f00d94b6d7 r15=0000000000000000

2017-06-03T14:24:19+01:00[+3.301]| vmx| I125: Backtrace[21] 00007ffe04fb9890 rip=00007fb483bfb3f1 rbx=0000000000000000 rbp=000055f00d9145f0 r12=000055f00ce76590 r13=00007ffe04fb9960 r14=0000000000000000 r15=0000000000000000

2017-06-03T14:24:19+01:00[+3.301]| vmx| I125: Backtrace[22] 00007ffe04fb9950 rip=000055f00ce765b9 rbx=0000000000000000 rbp=0000000000000000 r12=000055f00ce76590 r13=00007ffe04fb9960 r14=0000000000000000 r15=0000000000000000

2017-06-03T14:24:19+01:00[+3.301]| vmx| I125: SymBacktrace[0] 00007ffe04fb77c0 rip=000055f00d47a506 in function (null) in object /usr/lib/vmware/bin/vmware-vmx-debug loaded at 000055f00cd83000

2017-06-03T14:24:19+01:00[+3.301]| vmx| I125: SymBacktrace[1] 00007ffe04fb7800 rip=000055f00d7d6718 in function (null) in object /usr/lib/vmware/bin/vmware-vmx-debug loaded at 000055f00cd83000

2017-06-03T14:24:19+01:00[+3.301]| vmx| I125: SymBacktrace[2] 00007ffe04fb7aa0 rip=000055f00d7d6b55 in function (null) in object /usr/lib/vmware/bin/vmware-vmx-debug loaded at 000055f00cd83000

2017-06-03T14:24:19+01:00[+3.301]| vmx| I125: SymBacktrace[3] 00007ffe04fb7b00 rip=00007fb4859fc670 in function (null) in object /lib/x86_64-linux-gnu/libpthread.so.0 loaded at 00007fb4859eb000

2017-06-03T14:24:19+01:00[+3.301]| vmx| I125: SymBacktrace[4] 00007ffe04fb8090 rip=00007fb3e05fc641 in function (null) in object /usr/lib/x86_64-linux-gnu/libspeexdsp.so.1 loaded at 00007fb3e05f3000

2017-06-03T14:24:19+01:00[+3.301]| vmx| I125: SymBacktrace[5] 00007ffe04fb80d0 rip=00007fb3e05fc6b5 in function (null) in object /usr/lib/x86_64-linux-gnu/libspeexdsp.so.1 loaded at 00007fb3e05f3000

2017-06-03T14:24:19+01:00[+3.301]| vmx| I125: SymBacktrace[6] 00007ffe04fb8130 rip=00007fb3e05fd865 in function speex_resampler_process_int in object /usr/lib/x86_64-linux-gnu/libspeexdsp.so.1 loaded at 00007fb3e05f3000

2017-06-03T14:24:19+01:00[+3.301]| vmx| I125: SymBacktrace[7] 00007ffe04fb9210 rip=00007fb3e05fda55 in function speex_resampler_process_interleaved_int in object /usr/lib/x86_64-linux-gnu/libspeexdsp.so.1 loaded at 00007fb3e05f3000

2017-06-03T14:24:19+01:00[+3.301]| vmx| I125: SymBacktrace[8] 00007ffe04fb9270 rip=00007fb3e083bbd9 in function (null) in object /usr/lib/x86_64-linux-gnu/alsa-lib/libasound_module_rate_speexrate.so loaded at 00007fb3e083b000

2017-06-03T14:24:19+01:00[+3.301]| vmx| I125: SymBacktrace[9] 00007ffe04fb9290 rip=00007fb3eb8d0316 in function (null) in object /usr/lib/x86_64-linux-gnu/libasound.so.2 loaded at 00007fb3eb863000

2017-06-03T14:24:19+01:00[+3.301]| vmx| I125: SymBacktrace[10] 00007ffe04fb92e0 rip=00007fb3eb8d072e in function (null) in object /usr/lib/x86_64-linux-gnu/libasound.so.2 loaded at 00007fb3eb863000

2017-06-03T14:24:19+01:00[+3.301]| vmx| I125: SymBacktrace[11] 00007ffe04fb9360 rip=00007fb3eb8d083a in function (null) in object /usr/lib/x86_64-linux-gnu/libasound.so.2 loaded at 00007fb3eb863000

2017-06-03T14:24:19+01:00[+3.301]| vmx| I125: SymBacktrace[12] 00007ffe04fb9390 rip=00007fb3eb8d08e3 in function (null) in object /usr/lib/x86_64-linux-gnu/libasound.so.2 loaded at 00007fb3eb863000

2017-06-03T14:24:19+01:00[+3.301]| vmx| I125: SymBacktrace[13] 00007ffe04fb93b0 rip=00007fb3eb8c35a0 in function (null) in object /usr/lib/x86_64-linux-gnu/libasound.so.2 loaded at 00007fb3eb863000

2017-06-03T14:24:19+01:00[+3.301]| vmx| I125: SymBacktrace[14] 00007ffe04fb9430 rip=00007fb3eb8b7956 in function (null) in object /usr/lib/x86_64-linux-gnu/libasound.so.2 loaded at 00007fb3eb863000

2017-06-03T14:24:19+01:00[+3.301]| vmx| I125: SymBacktrace[15] 00007ffe04fb94a0 rip=00007fb3eb8c38fa in function snd_pcm_mmap_writei in object /usr/lib/x86_64-linux-gnu/libasound.so.2 loaded at 00007fb3eb863000

2017-06-03T14:24:19+01:00[+3.301]| vmx| I125: SymBacktrace[16] 00007ffe04fb9500 rip=000055f00d7b4858 in function (null) in object /usr/lib/vmware/bin/vmware-vmx-debug loaded at 000055f00cd83000

2017-06-03T14:24:19+01:00[+3.302]| vmx| I125: SymBacktrace[17] 00007ffe04fb9530 rip=000055f00ce7f177 in function (null) in object /usr/lib/vmware/bin/vmware-vmx-debug loaded at 000055f00cd83000

2017-06-03T14:24:19+01:00[+3.302]| vmx| I125: SymBacktrace[18] 00007ffe04fb95c0 rip=000055f00ce801cf in function (null) in object /usr/lib/vmware/bin/vmware-vmx-debug loaded at 000055f00cd83000

2017-06-03T14:24:19+01:00[+3.302]| vmx| I125: SymBacktrace[19] 00007ffe04fb96d0 rip=000055f00ce839d1 in function (null) in object /usr/lib/vmware/bin/vmware-vmx-debug loaded at 000055f00cd83000

2017-06-03T14:24:19+01:00[+3.302]| vmx| I125: SymBacktrace[20] 00007ffe04fb97f0 rip=000055f00ce77fec in function main in object /usr/lib/vmware/bin/vmware-vmx-debug loaded at 000055f00cd83000

2017-06-03T14:24:19+01:00[+3.302]| vmx| I125: SymBacktrace[21] 00007ffe04fb9890 rip=00007fb483bfb3f1 in function __libc_start_main in object /lib/x86_64-linux-gnu/libc.so.6 loaded at 00007fb483bdb000

2017-06-03T14:24:19+01:00[+3.302]| vmx| I125: SymBacktrace[22] 00007ffe04fb9950 rip=000055f00ce765b9 in function (null) in object /usr/lib/vmware/bin/vmware-vmx-debug loaded at 000055f00cd83000

[dariusd]

Try putting mks.noBeep = "TRUE" into your /etc/vmware/config file – you'll need to edit that file as root, but that should apply the workaround to all VMs on that host without needing to modify each new VM.

Cheers,

--

Darius

[RogerLeigh]

Thanks, I will do.

But at the same time, has a ticket been opened for this?  I, and I'm sure others, would very much appreciate a proper fix for this in a future release of workstation.  The default segfault behaviour here is quite unacceptable.

Thanks again,

Roger

[dariusd]

Yes, there's a ticket open to have this fixed properly.

Thanks,

--

Darius