The QEMU project is currently considering to move its bug tracking to another
system. For this we need to know which bugs are still valid and which could be
closed already. Thus we are setting older bugs to "Incomplete" now.
If you still think this bug report here is valid, then please switch the state
back to "New" within the next 60 days, otherwise this report will be marked as
"Expired". Or mark it as "Fix Released" if the problem has been solved with a
newer version of QEMU already. Thank you and sorry for the inconvenience.
** Changed in: qemu
Status: New => Incomplete
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1811244
Title:
qemu 3.1/i386 crashes/guest hangs when MTTCG is enabled
Status in QEMU:
Incomplete
Bug description:
When MTTCG is enabled, QEMU 3.1.0 sometimes crashes when running the
following command line:
qemu-system-i386 -kernel
/home/jermar/Kernkonzept/software/l4/.build-i386/bin/x86_gen/bootstrap
-append bootstrap -initrd
"/home/jermar/work/software/l4/fiasco/.build-i386/fiasco
-serial_esc,/home/jermar/Kernkonzept/software/l4/.build-i386/bin/x86_gen/l4f/sigma0
,/home/jermar/Kernkonzept/software/l4/.build-i386/bin/x86_gen/l4f/moe
rom/ahci.cfg,/home/jermar/Kernkonzept/software/l4/.build-i386/bin/x86_gen/l4f/ned
,test_env.lua ,/home/jermar/Kernkonzept/software/l4/pkg/ahci-
driver/examples/md5sum/ahci.cfg
,/home/jermar/Kernkonzept/software/l4/.build-i386/bin/x86_gen/l4f/l4re
,/home/jermar/Kernkonzept/software/l4/pkg/ahci-
driver/examples/md5sum/ahci.io
,/home/jermar/Kernkonzept/software/l4/.build-i386/bin/x86_gen/l4f/io
,/home/jermar/Kernkonzept/software/l4/.build-i386/bin/x86_gen/l4f
/ahci-drv
,/home/jermar/Kernkonzept/software/l4/.build-i386/bin/x86_gen/l4f
/ahci-md5-sync" -smp 4 -accel tcg,thread=multi -device ahci,id=ahci0
-drive
if=none,file=/home/jermar/Kernkonzept/software/l4/.build-i386/pkg
/ahci-driver/test/examples/test_ahci.img,format=raw,id=drive-sata0-0-0
-device ide-drive,bus=ahci0.0,drive=drive-sata0-0-0,id=sata0-0-0
-serial stdio -nographic -monitor none
The host is x86_64.
The stack at the time of the crash (core dump and debug binary
attached to the bug):
Core was generated by `qemu-system-i386 -kernel
/home/jermar/Kernkonzept/software/l4/.build-i386/bin/x'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 io_writex (env=env@entry=0x565355ca0140,
iotlbentry=iotlbentry@entry=0x565355ca9120, mmu_idx=2, val=val@entry=0,
addr=addr@entry=3938451632, retaddr=retaddr@entry=140487132809203,
recheck=false, size=4)
at
/home/jermar/software/HelenOS/helenos.git/contrib/qemu/qemu-3.1.0/accel/tcg/cputlb.c:791
791 if (mr->global_locking && !qemu_mutex_iothread_locked()) {
[Current thread is 1 (Thread 0x7fc5af7fe700 (LWP 3625719))]
Missing separate debuginfos, use: dnf debuginfo-install
SDL2-2.0.9-1.fc29.x86_64 at-spi2-atk-2.30.0-1.fc29.x86_64
at-spi2-core-2.30.0-2.fc29.x86_64 atk-2.30.0-1.fc29.x86_64
bzip2-libs-1.0.6-28.fc29.x86_64 cairo4
(gdb) bt
#0 0x0000565354f5f365 in io_writex
(env=env@entry=0x565355ca0140,
iotlbentry=iotlbentry@entry=0x565355ca9120, mmu_idx=2, val=val@entry=0,
addr=addr@entry=3938451632, retaddr=retaddr@entry=140487132809203,
recheck=false, size=4)
at
/home/jermar/software/HelenOS/helenos.git/contrib/qemu/qemu-3.1.0/accel/tcg/cputlb.c:791
#1 0x0000565354f621b2 in io_writel (recheck=<optimized out>,
retaddr=140487132809203, addr=3938451632, val=0, index=0, mmu_idx=2,
env=0x565355ca0140)
at
/home/jermar/software/HelenOS/helenos.git/contrib/qemu/qemu-3.1.0/accel/tcg/softmmu_template.h:310
#2 0x0000565354f621b2 in helper_le_stl_mmu (env=0x565355ca0140,
addr=<optimized out>, val=0, oi=34, retaddr=140487132809203)
at
/home/jermar/software/HelenOS/helenos.git/contrib/qemu/qemu-3.1.0/accel/tcg/softmmu_template.h:310
#3 0x00007fc5b5a587f3 in code_gen_buffer ()
#4 0x0000565354f75fd0 in cpu_tb_exec (itb=<optimized out>,
cpu=0x7fc5b5a5aa40 <code_gen_buffer+12266006>) at
/home/jermar/software/HelenOS/helenos.git/contrib/qemu/qemu-3.1.0/accel/tcg/cpu-exec.c:171
#5 0x0000565354f75fd0 in cpu_loop_exec_tb (tb_exit=<synthetic pointer>,
last_tb=<synthetic pointer>, tb=<optimized out>, cpu=0x7fc5b5a5aa40
<code_gen_buffer+12266006>)
at
/home/jermar/software/HelenOS/helenos.git/contrib/qemu/qemu-3.1.0/accel/tcg/cpu-exec.c:615
#6 0x0000565354f75fd0 in cpu_exec (cpu=cpu@entry=0x565355c97e90) at
/home/jermar/software/HelenOS/helenos.git/contrib/qemu/qemu-3.1.0/accel/tcg/cpu-exec.c:725
#7 0x0000565354f33b1f in tcg_cpu_exec (cpu=0x565355c97e90) at
/home/jermar/software/HelenOS/helenos.git/contrib/qemu/qemu-3.1.0/cpus.c:1429
#8 0x0000565354f35e83 in qemu_tcg_cpu_thread_fn (arg=0x565355c97e90) at
/home/jermar/software/HelenOS/helenos.git/contrib/qemu/qemu-3.1.0/cpus.c:1733
#9 0x0000565354f35e83 in qemu_tcg_cpu_thread_fn
(arg=arg@entry=0x565355c97e90) at
/home/jermar/software/HelenOS/helenos.git/contrib/qemu/qemu-3.1.0/cpus.c:1707
#10 0x00005653552ec5da in qemu_thread_start (args=<optimized out>) at
util/qemu-thread-posix.c:498
#11 0x00007fc5b858a58e in start_thread () at /lib64/libpthread.so.0
#12 0x00007fc5b84b96a3 in clone () at /lib64/libc.so.6
Another symptom that occurs more often than this crash is that the
guest hangs while waiting for another CPU to complete a cross-CPU
call. Disabling MTTCG makes both symptoms go away.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1811244/+subscriptions
