HVF Illegal instruction: 4, High Sierra, v2.12-rc0

[Erik Kristian Sverre Uri]

I've built v2.12.0-rc0 on MacOS using homebrew. I'm running 10.13.3 on a 5,1 Mac Pro with a X5690 processor.

When I run 'qemu-system-x86_64 -M accel=hvf', I get a crash "Illegal instruction: 4".

[Erik Kristian Sverre Uri (eksu)]

Process: qemu-system-x86_64 [6330]
Path: /Users/USER/*/qemu-system-x86_64
Identifier: qemu-system-x86_64
Version: 0
Code Type: X86-64 (Native)
Parent Process: bash [1558]
Responsible: qemu-system-x86_64 [6330]
User ID: 501

Date/Time: 2018-03-31 13:46:58.355 -0700
OS Version: Mac OS X 10.13.4 (17E199)
Report Version: 12
Anonymous UUID: 28693BB0-7F66-6066-026C-DDE857D912F6

Time Awake Since Boot: 1800 seconds

System Integrity Protection: disabled

Crashed Thread: 0 Dispatch queue: com.apple.main-thread

Exception Type: EXC_BAD_INSTRUCTION (SIGILL)
Exception Codes: 0x0000000000000001, 0x0000000000000000
Exception Note: EXC_CORPSE_NOTIFY

Termination Signal: Illegal instruction: 4
Termination Reason: Namespace SIGNAL, Code 0x4
Terminating Process: exc handler [0]

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0 qemu-system-x86_64 0x000000010d8acafc hvf_get_supported_cpuid + 300 (x86_cpuid.c:102)
1 qemu-system-x86_64 0x000000010d8453e8 x86_cpu_expand_features + 200 (cpu.c:2408)
2 qemu-system-x86_64 0x000000010d847770 x86_cpu_realizefn + 288 (cpu.c:3669)
3 qemu-system-x86_64 0x000000010d92fa73 device_set_realized + 899 (qdev.c:917)
4 qemu-system-x86_64 0x000000010da6e123 property_set_bool + 99
5 qemu-system-x86_64 0x000000010da6f410 object_property_set_qobject + 48 (qom-qobject.c:28)
6 qemu-system-x86_64 0x000000010da6ca71 object_property_set_bool + 49 (qobject.h:81)
7 qemu-system-x86_64 0x000000010d824baf pc_cpus_init + 415 (pc.c:1104)
8 qemu-system-x86_64 0x000000010d829c6d pc_init1 + 349 (pc_piix.c:157)
9 qemu-system-x86_64 0x000000010d8cb234 qemu_main + 17476 (vl.c:1275)
10 qemu-system-x86_64 0x000000010da6723e -[QemuCocoaAppController startEmulationWithArgc:argv:] + 30 (cocoa.m:1017)
11 com.apple.CoreFoundation 0x00007fff5294561c __CFNOTIFICATIONCENTER_IS_CALLING_OUT_TO_AN_OBSERVER__ + 12
12 com.apple.CoreFoundation 0x00007fff529454ea _CFXRegistrationPost + 458
13 com.apple.CoreFoundation 0x00007fff52945221 ___CFXNotificationPost_block_invoke + 225
14 com.apple.CoreFoundation 0x00007fff52903d72 -[_CFXNotificationRegistrar find:object:observer:enumerator:] + 1826
15 com.apple.CoreFoundation 0x00007fff52902e03 _CFXNotificationPost + 659
16 com.apple.Foundation 0x00007fff54a1f8c7 -[NSNotificationCenter postNotificationName:object:userInfo:] + 66
17 com.apple.AppKit 0x00007fff4fff3206 -[NSApplication _postDidFinishNotification] + 313
18 com.apple.AppKit 0x00007fff4fff2e4f -[NSApplication _sendFinishLaunchingNotification] + 220
19 com.apple.AppKit 0x00007fff4fec5ab3 -[NSApplication(NSAppleEventHandling) _handleAEOpenEvent:] + 562
20 com.apple.AppKit 0x00007fff4fec56e9 -[NSApplication(NSAppleEventHandling) _handleCoreEvent:withReplyEvent:] + 690
21 com.apple.Foundation 0x00007fff54a62714 -[NSAppleEvent...

[Erik Kristian Sverre Uri (eksu)]

Disregard the above log; that was from a September 2017 build.

On RC1:

Process: qemu-system-x86_64 [6567]
Path: /usr/local/bin/qemu-system-x86_64
Identifier: qemu-system-x86_64
Version: 0
Code Type: X86-64 (Native)
Parent Process: bash [1558]
Responsible: qemu-system-x86_64 [6567]
User ID: 501

Date/Time: 2018-03-31 13:53:57.851 -0700
OS Version: Mac OS X 10.13.4 (17E199)
Report Version: 12
Anonymous UUID: 28693BB0-7F66-6066-026C-DDE857D912F6

Time Awake Since Boot: 2200 seconds

System Integrity Protection: disabled

Crashed Thread: 0 Dispatch queue: com.apple.main-thread

Exception Type: EXC_BAD_INSTRUCTION (SIGILL)
Exception Codes: 0x0000000000000001, 0x0000000000000000
Exception Note: EXC_CORPSE_NOTIFY

Termination Signal: Illegal instruction: 4
Termination Reason: Namespace SIGNAL, Code 0x4
Terminating Process: exc handler [0]

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0 qemu-system-x86_64 0x000000010524165b 0x105134000 + 1103451
1 qemu-system-x86_64 0x00000001051e2481 0x105134000 + 713857
2 qemu-system-x86_64 0x00000001051e2170 0x105134000 + 713072
3 qemu-system-x86_64 0x00000001051e3e2a 0x105134000 + 720426
4 qemu-system-x86_64 0x00000001052b625a 0x105134000 + 1581658
5 qemu-system-x86_64 0x00000001053e5606 0x105134000 + 2823686
6 qemu-system-x86_64 0x00000001053e65bb 0x105134000 + 2827707
7 qemu-system-x86_64 0x00000001053e4126 0x105134000 + 2818342
8 qemu-system-x86_64 0x00000001051c35fc 0x105134000 + 587260
9 qemu-system-x86_64 0x00000001051c36e6 0x105134000 + 587494
10 qemu-system-x86_64 0x00000001051c8040 0x105134000 + 606272
11 qemu-system-x86_64 0x000000010525a462 0x105134000 + 1205346
12 qemu-system-x86_64 0x00000001053c8e28 0x105134000 + 2706984
13 com.apple.CoreFoundation 0x00007fff5294561c __CFNOTIFICATIONCENTER_IS_CALLING_OUT_TO_AN_OBSERVER__ + 12
14 com.apple.CoreFoundation 0x00007fff529454ea _CFXRegistrationPost + 458
15 com.apple.CoreFoundation 0x00007fff52945221 ___CFXNotificationPost_block_invoke + 225
16 com.apple.CoreFoundation 0x00007fff52903d72 -[_CFXNotificationRegistrar find:object:observer:enumerator:] + 1826
17 com.apple.CoreFoundation 0x00007fff52902e03 _CFXNotificationPost + 659
18 com.apple.Foundation 0x00007fff54a1f8c7 -[NSNotificationCenter postNotificationName:object:userInfo:] + 66
19 com.apple.AppKit 0x00007fff4fff3206 -[NSApplication _postDidFinishNotification] + 313
20 com.apple.AppKit 0x00007fff4fff2e4f -[NSApplication _sendFinishLaunchingNotification] + 220
21 com.apple.AppKit 0x00007fff4fec5ab3 -[NSApplication(NSAppleEventHandling) _handleAEOpenEvent:] + 562
22 com.apple.AppKit 0x00007fff4fec56e9 -[NSApplication(NSAppleEventHandling) _handleCoreEvent:withReplyEvent:] + 690
23 com.apple.Foundation 0x00007fff54a62714 -[NSAp...

[Nathan Wallace (nathanwaffles)]

I am also able to reproduce this bug. The problem is that when hvf is enabled, qemu will attempt to execute the xgetbv instruction, which isn't supported on my processor (Intel Xeon X5670).

Here is a stack trace from lldb; the behavior is 100% reproducible for me.

nathan@Nathans-Mac-Pro:~/src/qemu/qemu-3.0.0/x86_64-softmmu
$ lldb -- qemu-system-x86_64 --accel hvf
(lldb) target create "qemu-system-x86_64"
runCurrent executable set to 'qemu-system-x86_64' (x86_64).
(lldb) settings set -- target.run-args "--accel" "hvf"
(lldb) run
Process 27479 launched: '/Users/nathan/src/qemu/qemu-3.0.0/x86_64-softmmu/qemu-system-x86_64' (x86_64)
Process 27479 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_INSTRUCTION (code=EXC_I386_INVOP, subcode=0x0)
    frame #0: 0x00000001001bca3a qemu-system-x86_64`xgetbv(xcr=0) at x86_cpuid.c:34
   31 {
   32 uint32_t eax, edx;
   33
-> 34 __asm__ volatile ("xgetbv"
   35 : "=a" (eax), "=d" (edx)
   36 : "c" (xcr));
   37
Target 0: (qemu-system-x86_64) stopped.
(lldb) bt
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_INSTRUCTION (code=EXC_I386_INVOP, subcode=0x0)
  * frame #0: 0x00000001001bca3a qemu-system-x86_64`xgetbv(xcr=0) at x86_cpuid.c:34
    frame #1: 0x00000001001bc8a6 qemu-system-x86_64`hvf_get_supported_cpuid(func=13, idx=0, reg=0) at x86_cpuid.c:116
    frame #2: 0x0000000100143a21 qemu-system-x86_64`x86_cpu_get_supported_feature_word(w=FEAT_XSAVE_COMP_LO, migratable_only=false) at cpu.c:3498
    frame #3: 0x000000010014367d qemu-system-x86_64`x86_cpu_filter_features(cpu=0x00000001040a2c00) at cpu.c:4749
    frame #4: 0x0000000100146c65 qemu-system-x86_64`x86_cpu_realizefn(dev=0x00000001040a2c00, errp=0x00007ffeefbfd620) at cpu.c:4834
    frame #5: 0x000000010028a84b qemu-system-x86_64`device_set_realized(obj=0x00000001040a2c00, value=true, errp=0x00007ffeefbfd7d0) at qdev.c:826
    frame #6: 0x00000001004b6d4d qemu-system-x86_64`property_set_bool(obj=0x00000001040a2c00, v=0x0000000101c49a20, name="realized", opaque=0x0000000101a996d0, errp=0x00007ffeefbfd7d0) at object.c:1984
    frame #7: 0x00000001004b4ae8 qemu-system-x86_64`object_property_set(obj=0x00000001040a2c00, v=0x0000000101c49a20, name="realized", errp=0x00007ffeefbfd7d0) at object.c:1176
    frame #8: 0x00000001004b8e8a qemu-system-x86_64`object_property_set_qobject(obj=0x00000001040a2c00, value=0x0000000101c49a00, name="realized", errp=0x00007ffeefbfd7d0) at qom-qobject.c:27
    frame #9: 0x00000001004b5092 qemu-system-x86_64`object_property_set_bool(obj=0x00000001040a2c00, value=true, name="realized", errp=0x00007ffeefbfd7d0) at object.c:1242
    frame #10: 0x000000010010ae20 qemu-system-x86_64`pc_new_cpu(typename="qemu64-x86_64-cpu", apic_id=0, errp=0x0000000100c44de0) at pc.c:1107
    frame #11: 0x000000010010af4c qemu-system-x86_64`pc_cpus_init(pcms=0x0000000101d630b0) at pc.c:1155
    frame #12: 0x000000010011294e qemu-system-x86_64`pc_init1(machine=0x0000000101d630b0, host_type="i440FX-pcihost", pci_type="i440FX") at pc_piix.c:153
    frame #13: 0x0000000100112640 qemu-system-x86_64`pc_init_v3_0(machine=0x0000000101d630b0) at ...

[MIke Pestorich (mmpestorich)]

According to the response here: https://<email address hidden>/msg572220.html

...the call to xgetbv should be guarded against processors that don't support the instruction. The attached patch seems to work for me but must admit I am way out of my depth here (I understand nothing about cpu architecture, features, etc...) and have not tested on anything but my old MacBook Pro (15-inch, Mid 2010) / MacBookPro6,2. All that I can say is that for this machine the call to xgetbv is not made and everything seems to work. I have no idea if this is correct for other machines/processors or if it correctly detects support of this call...

[Thomas Huth (th-huth)]

Looking through old bug tickets ... Did you ever send your patch to the qemu-devel mailing list? See https://wiki.qemu.org/Contribute/SubmitAPatch for more information

[Thomas Huth (th-huth)]

Looks like this should have been fixed here:
https://gitlab.com/qemu-project/qemu/-/commit/118f2aadbc66aaae4e8d52