[Bug 1811244] Re: qemu 3.1/i386 crashes/guest hangs when MTTCG is enabled

[Thomas Huth]

The QEMU project is currently considering to move its bug tracking to another 
system. For this we need to know which bugs are still valid and which could be 
closed already. Thus we are setting older bugs to "Incomplete" now.
If you still think this bug report here is valid, then please switch the state 
back to "New" within the next 60 days, otherwise this report will be marked as 
"Expired". Or mark it as "Fix Released" if the problem has been solved with a 
newer version of QEMU already. Thank you and sorry for the inconvenience.

** Changed in: qemu
       Status: New => Incomplete

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1811244

Title:
  qemu 3.1/i386 crashes/guest hangs when MTTCG is enabled

Status in QEMU:
  Incomplete

Bug description:
  When MTTCG is enabled, QEMU 3.1.0 sometimes crashes when running the
  following command line:

  qemu-system-i386 -kernel
  /home/jermar/Kernkonzept/software/l4/.build-i386/bin/x86_gen/bootstrap
  -append bootstrap -initrd
  "/home/jermar/work/software/l4/fiasco/.build-i386/fiasco
  
-serial_esc,/home/jermar/Kernkonzept/software/l4/.build-i386/bin/x86_gen/l4f/sigma0
  ,/home/jermar/Kernkonzept/software/l4/.build-i386/bin/x86_gen/l4f/moe
  
rom/ahci.cfg,/home/jermar/Kernkonzept/software/l4/.build-i386/bin/x86_gen/l4f/ned
  ,test_env.lua ,/home/jermar/Kernkonzept/software/l4/pkg/ahci-
  driver/examples/md5sum/ahci.cfg
  ,/home/jermar/Kernkonzept/software/l4/.build-i386/bin/x86_gen/l4f/l4re
  ,/home/jermar/Kernkonzept/software/l4/pkg/ahci-
  driver/examples/md5sum/ahci.io
  ,/home/jermar/Kernkonzept/software/l4/.build-i386/bin/x86_gen/l4f/io
  ,/home/jermar/Kernkonzept/software/l4/.build-i386/bin/x86_gen/l4f
  /ahci-drv
  ,/home/jermar/Kernkonzept/software/l4/.build-i386/bin/x86_gen/l4f
  /ahci-md5-sync" -smp 4 -accel tcg,thread=multi -device ahci,id=ahci0
  -drive
  if=none,file=/home/jermar/Kernkonzept/software/l4/.build-i386/pkg
  /ahci-driver/test/examples/test_ahci.img,format=raw,id=drive-sata0-0-0
  -device ide-drive,bus=ahci0.0,drive=drive-sata0-0-0,id=sata0-0-0
  -serial stdio -nographic -monitor none

  The host is x86_64.

  The stack at the time of the crash (core dump and debug binary
  attached to the bug):

  Core was generated by `qemu-system-i386 -kernel 
/home/jermar/Kernkonzept/software/l4/.build-i386/bin/x'.
  Program terminated with signal SIGSEGV, Segmentation fault.
  #0  io_writex (env=env@entry=0x565355ca0140, 
iotlbentry=iotlbentry@entry=0x565355ca9120, mmu_idx=2, val=val@entry=0, 
addr=addr@entry=3938451632, retaddr=retaddr@entry=140487132809203, 
recheck=false, size=4)
      at 
/home/jermar/software/HelenOS/helenos.git/contrib/qemu/qemu-3.1.0/accel/tcg/cputlb.c:791
  791       if (mr->global_locking && !qemu_mutex_iothread_locked()) {
  [Current thread is 1 (Thread 0x7fc5af7fe700 (LWP 3625719))]
  Missing separate debuginfos, use: dnf debuginfo-install 
SDL2-2.0.9-1.fc29.x86_64 at-spi2-atk-2.30.0-1.fc29.x86_64 
at-spi2-core-2.30.0-2.fc29.x86_64 atk-2.30.0-1.fc29.x86_64 
bzip2-libs-1.0.6-28.fc29.x86_64 cairo4
  (gdb) bt
  #0  0x0000565354f5f365 in io_writex
      (env=env@entry=0x565355ca0140, 
iotlbentry=iotlbentry@entry=0x565355ca9120, mmu_idx=2, val=val@entry=0, 
addr=addr@entry=3938451632, retaddr=retaddr@entry=140487132809203, 
recheck=false, size=4)
      at 
/home/jermar/software/HelenOS/helenos.git/contrib/qemu/qemu-3.1.0/accel/tcg/cputlb.c:791
  #1  0x0000565354f621b2 in io_writel (recheck=<optimized out>, 
retaddr=140487132809203, addr=3938451632, val=0, index=0, mmu_idx=2, 
env=0x565355ca0140)
      at 
/home/jermar/software/HelenOS/helenos.git/contrib/qemu/qemu-3.1.0/accel/tcg/softmmu_template.h:310
  #2  0x0000565354f621b2 in helper_le_stl_mmu (env=0x565355ca0140, 
addr=<optimized out>, val=0, oi=34, retaddr=140487132809203)
      at 
/home/jermar/software/HelenOS/helenos.git/contrib/qemu/qemu-3.1.0/accel/tcg/softmmu_template.h:310
  #3  0x00007fc5b5a587f3 in code_gen_buffer ()
  #4  0x0000565354f75fd0 in cpu_tb_exec (itb=<optimized out>, 
cpu=0x7fc5b5a5aa40 <code_gen_buffer+12266006>) at 
/home/jermar/software/HelenOS/helenos.git/contrib/qemu/qemu-3.1.0/accel/tcg/cpu-exec.c:171
  #5  0x0000565354f75fd0 in cpu_loop_exec_tb (tb_exit=<synthetic pointer>, 
last_tb=<synthetic pointer>, tb=<optimized out>, cpu=0x7fc5b5a5aa40 
<code_gen_buffer+12266006>)
      at 
/home/jermar/software/HelenOS/helenos.git/contrib/qemu/qemu-3.1.0/accel/tcg/cpu-exec.c:615
  #6  0x0000565354f75fd0 in cpu_exec (cpu=cpu@entry=0x565355c97e90) at 
/home/jermar/software/HelenOS/helenos.git/contrib/qemu/qemu-3.1.0/accel/tcg/cpu-exec.c:725
  #7  0x0000565354f33b1f in tcg_cpu_exec (cpu=0x565355c97e90) at 
/home/jermar/software/HelenOS/helenos.git/contrib/qemu/qemu-3.1.0/cpus.c:1429
  #8  0x0000565354f35e83 in qemu_tcg_cpu_thread_fn (arg=0x565355c97e90) at 
/home/jermar/software/HelenOS/helenos.git/contrib/qemu/qemu-3.1.0/cpus.c:1733
  #9  0x0000565354f35e83 in qemu_tcg_cpu_thread_fn 
(arg=arg@entry=0x565355c97e90) at 
/home/jermar/software/HelenOS/helenos.git/contrib/qemu/qemu-3.1.0/cpus.c:1707
  #10 0x00005653552ec5da in qemu_thread_start (args=<optimized out>) at 
util/qemu-thread-posix.c:498
  #11 0x00007fc5b858a58e in start_thread () at /lib64/libpthread.so.0
  #12 0x00007fc5b84b96a3 in clone () at /lib64/libc.so.6

  Another symptom that occurs more often than this crash is that the
  guest hangs while waiting for another CPU to complete a cross-CPU
  call. Disabling MTTCG makes both symptoms go away.

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1811244/+subscriptions