I am also able to reproduce this bug. The problem is that when hvf is enabled, qemu will attempt to execute the xgetbv instruction, which isn't supported on my processor (Intel Xeon X5670).
Here is a stack trace from lldb; the behavior is 100% reproducible for me.
I am also able to reproduce this bug. The problem is that when hvf is enabled, qemu will attempt to execute the xgetbv instruction, which isn't supported on my processor (Intel Xeon X5670).
Here is a stack trace from lldb; the behavior is 100% reproducible for me.
nathan@ Nathans- Mac-Pro: ~/src/qemu/ qemu-3. 0.0/x86_ 64-softmmu x86_64" x86_64' (x86_64). nathan/ src/qemu/ qemu-3. 0.0/x86_ 64-softmmu/ qemu-system- x86_64' (x86_64) main-thread' , stop reason = EXC_BAD_INSTRUCTION (code=EXC_ I386_INVOP, subcode=0x0) x86_64` xgetbv( xcr=0) at x86_cpuid.c:34 x86_64) stopped. main-thread' , stop reason = EXC_BAD_INSTRUCTION (code=EXC_ I386_INVOP, subcode=0x0) x86_64` xgetbv( xcr=0) at x86_cpuid.c:34 x86_64` hvf_get_ supported_ cpuid(func= 13, idx=0, reg=0) at x86_cpuid.c:116 x86_64` x86_cpu_ get_supported_ feature_ word(w= FEAT_XSAVE_ COMP_LO, migratable_ only=false) at cpu.c:3498 x86_64` x86_cpu_ filter_ features( cpu=0x000000010 40a2c00) at cpu.c:4749 x86_64` x86_cpu_ realizefn( dev=0x000000010 40a2c00, errp=0x00007ffe efbfd620) at cpu.c:4834 x86_64` device_ set_realized( obj=0x000000010 40a2c00, value=true, errp=0x00007ffe efbfd7d0) at qdev.c:826 x86_64` property_ set_bool( obj=0x000000010 40a2c00, v=0x0000000101c 49a20, name="realized", opaque= 0x0000000101a99 6d0, errp=0x00007ffe efbfd7d0) at object.c:1984 x86_64` object_ property_ set(obj= 0x00000001040a2 c00, v=0x0000000101c 49a20, name="realized", errp=0x00007ffe efbfd7d0) at object.c:1176 x86_64` object_ property_ set_qobject( obj=0x000000010 40a2c00, value=0x0000000 101c49a00, name="realized", errp=0x00007ffe efbfd7d0) at qom-qobject.c:27 x86_64` object_ property_ set_bool( obj=0x000000010 40a2c00, value=true, name="realized", errp=0x00007ffe efbfd7d0) at object.c:1242 x86_64` pc_new_ cpu(typename= "qemu64- x86_64- cpu", apic_id=0, errp=0x00000001 00c44de0) at pc.c:1107 x86_64` pc_cpus_ init(pcms= 0x0000000101d63 0b0) at pc.c:1155 x86_64` pc_init1( machine= 0x0000000101d63 0b0, host_type= "i440FX- pcihost" , pci_type="i440FX") at pc_piix.c:153 x86_64` pc_init_ v3_0(machine= 0x0000000101d63 0b0) at pc_piix.c:438 x86_64` machine_ run_board_ init(machine= 0x0000000101d63 0b0) at machine.c:830 x86_64` qemu_main( argc=3, argv=0x00007ffe efbff818, envp=0x00007ffe efbff838) at vl.c:4516 x86_64` -[QemuCocoaAppC ontroller startEmulationW ithArgc: argv:]( self=0x00000001 01c16510, _cmd="startEmul ationWithArgc: argv:", argc=3, argv=0x00007ffe efbff818) at cocoa.m:1093 x86_64` -[QemuCocoaAppC ontroller applicationDidF inishLaunching: ](self= 0x0000000101c16 510, _cmd="applicati onDidFinishLaun ching:" , note=@" NSApplicationDi dFinishLaunchin gNotification" ) at cocoa.m:1045 __CFNOTIFICATIO NCENTER_ IS_CALLING_ OUT_TO_ AN_OBSERVER_ _ + 12 _CFXRegistratio nPost + 458 ___CFXNotificat ionPost_ block_invoke + 225 -[_CFXNotificat ionRegistrar find:object: observer: enumerator: ] + 1826 _CFXNotificatio nPost + 659 -[NSNotificatio nCenter postNotificatio nName:object: userInfo: ] + 66 -[NSApplication _postDidFinishN otification] + 313 -[NSApplication _sendFinishLaun chingNotificati on] + 220 -[NSApplication (NSAppleEventHa ndling) _handleAEOpenEv ent:] + 562 -[NSApplication (NSAppleEventHa ndling) _handleCoreEven t:withReplyEven t:] + 690 -[NSAppleEventM anager dispatchRawAppl eEvent: withRawReply: handlerRefCon: ] + 287 _NSAppleEventMa nagerGenericHan dler + 102 pleEvent( AEDesc const*, AEDesc*, unsigned int, unsigned char*) + 1788 tAndSendReply( AEDesc const*, AEDesc*) + 41 leEvent + 383 AEProcessAppleE vent + 55 _DPSNextEvent + 2788 -[NSApplication (NSEvent) _nextEventMatch ingEventMask: untilDate: inMode: dequeue: ] + 3044 -[NSApplication run] + 764 x86_64` main(argc= 3, argv=0x00007ffe efbff818) at cocoa.m:1537
$ lldb -- qemu-system-x86_64 --accel hvf
(lldb) target create "qemu-system-
runCurrent executable set to 'qemu-system-
(lldb) settings set -- target.run-args "--accel" "hvf"
(lldb) run
Process 27479 launched: '/Users/
Process 27479 stopped
* thread #1, queue = 'com.apple.
frame #0: 0x00000001001bca3a qemu-system-
31 {
32 uint32_t eax, edx;
33
-> 34 __asm__ volatile ("xgetbv"
35 : "=a" (eax), "=d" (edx)
36 : "c" (xcr));
37
Target 0: (qemu-system-
(lldb) bt
* thread #1, queue = 'com.apple.
* frame #0: 0x00000001001bca3a qemu-system-
frame #1: 0x00000001001bc8a6 qemu-system-
frame #2: 0x0000000100143a21 qemu-system-
frame #3: 0x000000010014367d qemu-system-
frame #4: 0x0000000100146c65 qemu-system-
frame #5: 0x000000010028a84b qemu-system-
frame #6: 0x00000001004b6d4d qemu-system-
frame #7: 0x00000001004b4ae8 qemu-system-
frame #8: 0x00000001004b8e8a qemu-system-
frame #9: 0x00000001004b5092 qemu-system-
frame #10: 0x000000010010ae20 qemu-system-
frame #11: 0x000000010010af4c qemu-system-
frame #12: 0x000000010011294e qemu-system-
frame #13: 0x0000000100112640 qemu-system-
frame #14: 0x0000000100291f25 qemu-system-
frame #15: 0x00000001001e583f qemu-system-
frame #16: 0x0000000100486459 qemu-system-
frame #17: 0x00000001004862f7 qemu-system-
frame #18: 0x00007fff4c99447c CoreFoundation`
frame #19: 0x00007fff4c99434a CoreFoundation`
frame #20: 0x00007fff4c994081 CoreFoundation`
frame #21: 0x00007fff4c952c12 CoreFoundation`
frame #22: 0x00007fff4c951ca3 CoreFoundation`
frame #23: 0x00007fff4ea7c817 Foundation`
frame #24: 0x00007fff4a041206 AppKit`
frame #25: 0x00007fff4a040e4f AppKit`
frame #26: 0x00007fff49f13ab3 AppKit`
frame #27: 0x00007fff49f136e9 AppKit`
frame #28: 0x00007fff4eabf664 Foundation`
frame #29: 0x00007fff4eabf4e2 Foundation`
frame #30: 0x00007fff4da97dd0 AE`aeDispatchAp
frame #31: 0x00007fff4da97677 AE`dispatchEven
frame #32: 0x00007fff4da97565 AE`aeProcessApp
frame #33: 0x00007fff4bc6e4a0 HIToolbox`
frame #34: 0x00007fff49f0ed32 AppKit`
frame #35: 0x00007fff4a6a4e34 AppKit`
frame #36: 0x00007fff49f03885 AppKit`
frame #37: 0x0000000100489161 qemu-system-
frame #38: 0x00007fff7493e015 libdyld.dylib`start + 1
frame #39: 0x00007fff7493e015 libdyld.dylib`start + 1
(lldb) p xcr
(uint32_t) $0 = 0