Hi,
I met a qemu core dump issue when starting a VM with cpu feature
"pmu=on" on an arm server.
The commands to start the machine is:
./qemu-system-aarch64 \
-cpu host,pmu=on -M virt,accel=kvm,gic-version=3 -nographic
-m 2048M \
-kernel ./Image \
-initrd /boot/initrd.img-5.6.0-rc2+ \
-append "root=/dev/vda rw console=ttyAMA0" -nodefaults -serial stdio\
-drive if=none,file=./xenial.rootfs.ext4,id=hd0,format=raw \
-device virtio-blk-device,drive=hd0
And here is the stack dump:
Core was generated by `./qemu-system-aarch64 -cpu host,pmu=on -M
virt,accel=kvm,gic-version=3 -nograph'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 kvm_ioctl (s=0x0, type=type@entry=44547) at
/root/Downloads/qemu-git/accel/kvm/kvm-all.c:2509
2509 ret = ioctl(s->fd, type, arg);
[Current thread is 1 (Thread 0xffffa5108010 (LWP 22057))]
(gdb) bt
#0 0x0000aaaadc432950 in kvm_ioctl (s=0x0, type=type@entry=44547) at
/root/Downloads/qemu-git/accel/kvm/kvm-all.c:2509
#1 0x0000aaaadc432adc in kvm_check_extension (s=<optimized out>,
extension=extension@entry=126) at
/root/Downloads/qemu-git/accel/kvm/kvm-all.c:866
#2 0x0000aaaadc541ff0 in kvm_arm_pmu_supported (cpu=<optimized out>)
at /root/Downloads/qemu-git/target/arm/kvm.c:212
#3 0x0000aaaadc53a08c in arm_set_pmu (obj=<optimized out>,
value=<optimized out>, errp=0xfffff2fba6b0) at
/root/Downloads/qemu-git/target/arm/cpu.c:1113
#4 0x0000aaaadc88facc in property_set_bool (obj=0xaaab0b61a0f0,
v=<optimized out>, name=<optimized out>, opaque=0xaaab0b627690,
errp=0xfffff2fba6b0)
at /root/Downloads/qemu-git/qom/object.c:2162
#5 0x0000aaaadc892af4 in object_property_parse
(obj=obj@entry=0xaaab0b61a0f0, string=<optimized out>,
name=0xaaab0b527d00 "pmu", errp=errp@entry=0xfffff2fba6b0)
at /root/Downloads/qemu-git/qom/object.c:1552
#6 0x0000aaaadc892bbc in object_apply_global_props
(obj=0xaaab0b61a0f0, props=0xaaab0b473a60, errp=0xaaaadd003930
<error_fatal>)
at /root/Downloads/qemu-git/qom/object.c:410
#7 0x0000aaaadc891a64 in object_post_init_with_type
(ti=0xaaab0b20e9f0, obj=0xaaab0b61a0f0) at
/root/Downloads/qemu-git/qom/object.c:383
#8 0x0000aaaadc891a64 in object_initialize_with_type
(data=data@entry=0xaaab0b61a0f0, size=<optimized out>,
type=type@entry=0xaaab0b212a40)
at /root/Downloads/qemu-git/qom/object.c:517
#9 0x0000aaaadc891ba4 in object_new_with_type (type=0xaaab0b212a40)
at /root/Downloads/qemu-git/qom/object.c:681
#10 0x0000aaaadc4bfd10 in machvirt_init (machine=0xaaaadd003930
<error_fatal>) at /root/Downloads/qemu-git/hw/arm/virt.c:1804
#11 0x0000aaaadc69ec5c in machine_run_board_init
(machine=0xaaab0b47e950) at
/root/Downloads/qemu-git/hw/core/machine.c:1132
#12 0x0000aaaadc51f50c in qemu_init (argc=<optimized out>,
argv=<optimized out>, envp=<optimized out>) at
/root/Downloads/qemu-git/softmmu/vl.c:4347
#13 0x0000aaaadc3d2abc in main (argc=<optimized out>, argv=<optimized
out>, envp=<optimized out>) at
/root/Downloads/qemu-git/softmmu/main.c:48
(gdb)
The root cause is in the arm_get_pmu() operation which was introduced
in ae502508f83.
After deleting the KVM feature probe operation in this function, the
issue can be fixed.
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 3801e25b79..ff18db8fd4 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -1110,10 +1110,6 @@ static void arm_set_pmu(Object *obj, bool
value, Error **errp)
ARMCPU *cpu = ARM_CPU(obj);
if (value) {
- if (kvm_enabled() && !kvm_arm_pmu_supported(CPU(cpu))) {
- error_setg(errp, "'pmu' feature not supported by KVM on
this host");
- return;
- }
set_feature(&cpu->env, ARM_FEATURE_PMU);
} else {
unset_feature(&cpu->env, ARM_FEATURE_PMU);
According to the Qemu document(docs/system/arm/cpu-features.rst), the
pmu is turned on by default when using KVM mode on a V8 host machine,
which means the pmu=on is redundant when starting a VM with PMU support.
target/arm/kvm64.c
672 /*
673 * We can assume any KVM supporting CPU is at least a v8
674 * with VFPv4+Neon; this in turn implies most of the other
675 * feature bits.
676 */
677 features |= 1ULL << ARM_FEATURE_V8;
678 features |= 1ULL << ARM_FEATURE_NEON;
679 features |= 1ULL << ARM_FEATURE_AARCH64;
680 features |= 1ULL << ARM_FEATURE_PMU;
681 features |= 1ULL << ARM_FEATURE_GENERIC_TIMER;
But I think we need a better way to handle this when "pmu=on" is
present in the command line, not just trigger a core dump(qemu binary
was built from the current master branch).
Any comments?
Regards,
Haibo
