Assertion `no_aa32 || ({ ARMCPU *cpu_ = (cpu); isar_feature_arm_div(&cpu_->isar); })' failed

[Laszlo Ersek (Red Hat)]

The following assertion:

    assert(no_aa32 || cpu_isar_feature(arm_div, cpu));

introduced in commit 0f8d06f16c9d ("target/arm: Conditionalize some
asserts on aarch32 support", 2018-11-02), fails for me. I intended to
launch a 32-bit ARM guest (with KVM acceleration) on my AArch64 host
(APM Mustang A3).

Libvirt generated the following QEMU command line:

> LC_ALL=C \
> PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin \
> QEMU_AUDIO_DRV=none \
> /opt/qemu-installed-optimized/bin/qemu-system-aarch64 \
> -name guest=f28.32bit,debug-threads=on \
> -S \
> -object secret,id=masterKey0,format=raw,file=/var/lib/libvirt/qemu/domain-2-f28.32bit/master-key.aes \
> -machine virt-4.1,accel=kvm,usb=off,dump-guest-core=off,gic-version=2 \
> -cpu host,aarch64=off \
> -drive file=/root/QEMU_EFI.fd.padded,if=pflash,format=raw,unit=0,readonly=on \
> -drive file=/var/lib/libvirt/qemu/nvram/f28.32bit_VARS.fd,if=pflash,format=raw,unit=1 \
> -m 8192 \
> -realtime mlock=off \
> -smp 8,sockets=8,cores=1,threads=1 \
> -uuid d525042e-1b37-4058-86ca-c6a2086e8485 \
> -no-user-config \
> -nodefaults \
> -chardev socket,id=charmonitor,fd=27,server,nowait \
> -mon chardev=charmonitor,id=monitor,mode=control \
> -rtc base=utc \
> -no-shutdown \
> -boot strict=on \
> -device pcie-root-port,port=0x8,chassis=1,id=pci.1,bus=pcie.0,multifunction=on,addr=0x1 \
> -device pcie-root-port,port=0x9,chassis=2,id=pci.2,bus=pcie.0,addr=0x1.0x1 \
> -device pcie-root-port,port=0xa,chassis=3,id=pci.3,bus=pcie.0,addr=0x1.0x2 \
> -device pcie-root-port,port=0xb,chassis=4,id=pci.4,bus=pcie.0,addr=0x1.0x3 \
> -device pcie-root-port,port=0xc,chassis=5,id=pci.5,bus=pcie.0,addr=0x1.0x4 \
> -device pcie-root-port,port=0xd,chassis=6,id=pci.6,bus=pcie.0,addr=0x1.0x5 \
> -device qemu-xhci,id=usb,bus=pci.1,addr=0x0 \
> -device virtio-scsi-pci,id=scsi0,bus=pci.2,addr=0x0 \
> -device virtio-serial-pci,id=virtio-serial0,bus=pci.3,addr=0x0 \
> -drive file=/var/lib/libvirt/images/f28.32bit.root.qcow2,format=qcow2,if=none,id=drive-scsi0-0-0-0,werror=enospc,cache=writeback,discard=unmap \
> -device scsi-hd,bus=scsi0.0,channel=0,scsi-id=0,lun=0,drive=drive-scsi0-0-0-0,id=scsi0-0-0-0,bootindex=1,write-cache=on \
> -drive file=/var/lib/libvirt/images/f28.32bit.home.qcow2,format=qcow2,if=none,id=drive-scsi0-0-0-1,werror=enospc,cache=writeback,discard=unmap \
> -device scsi-hd,bus=scsi0.0,channel=0,scsi-id=0,lun=1,drive=drive-scsi0-0-0-1,id=scsi0-0-0-1,write-cache=on \
> -netdev tap,fd=29,id=hostnet0,vhost=on,vhostfd=30 \
> -device virtio-net-pci,netdev=hostnet0,id=net0,mac=52:54:00:6f:d1:c8,bus=pci.4,addr=0x0,romfile= \
> -chardev pty,id=charserial0 \
> -serial chardev:charserial0 \
> -chardev socket,id=charchannel0,fd=31,server,nowait \
> -device virtserialport,bus=virtio-serial0.0,nr=1,chardev=charchannel0,id=channel0,name=org.qemu.guest_agent.0 \
> -device usb-tablet,id=input0,bus=usb.0,port=1 \
> -device usb-kbd,id=input1,bus=usb.0,port=2 \
> -vnc 127.0.0.1:0 \
> -device virtio-gpu-pci,id=video0,max_outputs=1,bus=pci.5,addr=0x0 \
> -object rng-random,id=objrng0,filename=/dev/urandom \
> -device virtio-rng-pci,rng=objrng0,id=rng0,max-bytes=1048576,period=1000,bus=pci.6,addr=0x0 \
> -msg timestamp=on

and then I got:

> qemu-system-aarch64: /root/src/upstream/qemu/target/arm/cpu.c:986:
> arm_cpu_realizefn: Assertion `no_aa32 || ({ ARMCPU *cpu_ = (cpu);
> isar_feature_arm_div(&cpu_->isar); })' failed.

QEMU was built at commit 8dc7fd56dd4f ("Merge remote-tracking branch
'remotes/philmd-gitlab/tags/fw_cfg-20190523-pull-request' into staging",
2019-05-23).

(Originally reported on the mailing list in the following thread:
<http://<email address hidden>>.)

[Peter Maydell (pmaydell)]

This happens because:
 * the host kernel is older than 4.15 and does not expose ID registers to userspace via the KVM_GET_ONE_REG ioctl
 * our fallback set of ID register values in target/arm/kvm64.c kvm_arm_get_host_cpu_features() is extremely minimalist
 * the consistency checks on ID register values in arm_cpu_realizefn() are made unconditionally, rather than only if we're using TCG

https://patchwork.ozlabs.org/patch/1133724/ is a fix for this which takes the approach of only asserting if we're using TCG, since that's really the case we're guarding for problems with and the only one that's a bug in QEMU (as opposed to an issue with the host kernel or host CPU).

[Peter Maydell (pmaydell)]

Fix for this is in git and will be in 4.1.0.

[Thomas Huth (th-huth)]

https://git.qemu.org/?p=qemu.git;a=commitdiff;h=8f4821d77e465bc