id = 1603
title = "Regression in v8.0.0-rc1: `Abort trap: 6` during `hvf/x86_emu.c:exec_mov()` (`-cpu host` + UEFI)"
state = "closed"
created_at = "2023-04-14T08:18:08.223Z"
closed_at = "2024-11-29T15:45:05.319Z"
labels = ["accel: HVF", "hostos: macOS", "target: i386"]
url = "https://gitlab.com/qemu-project/qemu/-/issues/1603"
host-os = "macOS 13.3.1"
host-arch = "x86_64` (`Intel(R) Core(TM) i7-1068NG7 CPU @ 2.30GHz`, MacBook Pro 2020)"
qemu-version = "QEMU emulator version 7.2.94 (v7.0.0-8004-g7dbd6f8a27)` (i.e., v8.0.0-rc4)"
guest-os = "Just starting UEFI is enough to hit this issue."
guest-arch = "x86_64"
description = """`qemu-system-x86_64 -accel hvf -cpu host -drive <UEFI>` crashes."""
reproduce = """```console
$ qemu-system-x86_64 -accel hvf -cpu host -drive if=pflash,format=raw,readonly=on,file=/usr/local/share/qemu/edk2-x86_64-code.fd 
vmx_read_mem: mmu_gva_to_gpa ffc00000 failed
Abort trap: 6
```"""
additional = """This is a regression in v8.0.0-rc1.

- v8.0.0-rc0: works
- v8.0.0-rc1: crashes
- ...
- v8.0.0-rc4: crashes


Backtrace:
```console
$ lldb /usr/local/bin/qemu-system-x86_64 
(lldb) target create "/usr/local/bin/qemu-system-x86_64"
Current executable set to '/usr/local/bin/qemu-system-x86_64' (x86_64).
(lldb) process handle SIGUSR2 -s false -p true
NAME         PASS     STOP     NOTIFY
===========  =======  =======  =======
SIGUSR2      true     false    not set
(lldb) run  -accel hvf -cpu host -drive if=pflash,format=raw,readonly=on,file=/usr/local/share/qemu/edk2-x86_64-code.fd
Process 17627 launched: '/usr/local/bin/qemu-system-x86_64' (x86_64)
Process 17627 stopped and restarted: thread 1 received signal: SIGUSR2
Process 17627 stopped and restarted: thread 1 received signal: SIGUSR2
Process 17627 stopped and restarted: thread 1 received signal: SIGUSR2
Process 17627 stopped and restarted: thread 1 received signal: SIGUSR2
Process 17627 stopped and restarted: thread 1 received signal: SIGUSR2
Process 17627 stopped and restarted: thread 1 received signal: SIGUSR2
Process 17627 stopped and restarted: thread 1 received signal: SIGUSR2
Process 17627 stopped and restarted: thread 1 received signal: SIGUSR2
Process 17627 stopped and restarted: thread 1 received signal: SIGUSR2
Process 17627 stopped and restarted: thread 1 received signal: SIGUSR2
Process 17627 stopped and restarted: thread 1 received signal: SIGUSR2
Process 17627 stopped and restarted: thread 1 received signal: SIGUSR2
Process 17627 stopped and restarted: thread 1 received signal: SIGUSR2
Process 17627 stopped and restarted: thread 1 received signal: SIGUSR2
Process 17627 stopped and restarted: thread 1 received signal: SIGUSR2
Process 17627 stopped and restarted: thread 1 received signal: SIGUSR2
2023-04-14 17:16:22.879194+0900 qemu-system-x86_64[17627:1529741] [Window] Warning: Window NSWindow 0x10391def0 ordered front from a non-active application and may order beneath the active application's windows.
vmx_read_mem: mmu_gva_to_gpa ffc00000 failed
Process 17627 stopped
* thread #4, stop reason = signal SIGABRT
    frame #0: 0x00007ff8121331f2 libsystem_kernel.dylib`__pthread_kill + 10
libsystem_kernel.dylib`:
->  0x7ff8121331f2 <+10>: jae    0x7ff8121331fc            ; <+20>
    0x7ff8121331f4 <+12>: movq   %rax, %rdi
    0x7ff8121331f7 <+15>: jmp    0x7ff81212ccdb            ; cerror_nocancel
    0x7ff8121331fc <+20>: retq   
Target 0: (qemu-system-x86_64) stopped.
(lldb) bt
* thread #4, stop reason = signal SIGABRT
  * frame #0: 0x00007ff8121331f2 libsystem_kernel.dylib`__pthread_kill + 10
    frame #1: 0x00007ff81216aee6 libsystem_pthread.dylib`pthread_kill + 263
    frame #2: 0x00007ff812091b45 libsystem_c.dylib`abort + 123
    frame #3: 0x0000000100223608 qemu-system-x86_64`vmx_read_mem + 201
    frame #4: 0x000000010021fa5b qemu-system-x86_64`read_val_ext + 65
    frame #5: 0x000000010021fc02 qemu-system-x86_64`fetch_operands + 197
    frame #6: 0x0000000100220f8b qemu-system-x86_64`exec_mov + 31
    frame #7: 0x0000000100220f01 qemu-system-x86_64`exec_instruction + 48
    frame #8: 0x000000010021c81f qemu-system-x86_64`hvf_vcpu_exec + 4144
    frame #9: 0x000000010033fa53 qemu-system-x86_64`hvf_cpu_thread_fn + 270
    frame #10: 0x0000000100492e49 qemu-system-x86_64`qemu_thread_start + 130
    frame #11: 0x00007ff81216b1d3 libsystem_pthread.dylib`_pthread_start + 125
    frame #12: 0x00007ff812166bd3 libsystem_pthread.dylib`thread_start + 15
(lldb) 
```"""