[Qemu-devel] 32-bit “qemu-system-i386 -enable-kvm” segfaults on x86_64

[Ludovic Courtès]

Hello,

(I’m reporting the issue here because for some reason the launchpad.net
login page redirects me to an “oops” page and fails to log me in.)

On a Linux 4.17 x86_64 host, “qemu-system-i386 -enable-kvm”, where
qemu-system-i386 is a 32-bit binary, crashes (it works fine without
‘-enable-kvm’):

--8<---------------cut here---------------start------------->8---
$ uname -rm
4.17.3-gnu x86_64
$ file 
/gnu/store/h22dc67wzkv0w2l3775f0xqkyr318x5j-qemu-minimal-2.12.0/bin/qemu-system-i386
 
/gnu/store/h22dc67wzkv0w2l3775f0xqkyr318x5j-qemu-minimal-2.12.0/bin/qemu-system-i386:
 ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV), dynamically 
linked, interpreter 
/gnu/store/4aka3nwppxf3z072l6vr8cxvwj3x5h9s-glibc-2.27/lib/ld-linux.so.2, for 
GNU/Linux 2.6.32, stripped
$ 
/gnu/store/h22dc67wzkv0w2l3775f0xqkyr318x5j-qemu-minimal-2.12.0/bin/qemu-system-i386
 -enable-kvm /dev/null
WARNING: Image format was not specified for '/dev/null' and probing guessed raw.
         Automatically detecting the format is dangerous for raw images, write 
operations on block 0 will be restricted.
         Specify the 'raw' format explicitly to remove the restrictions.
VNC server running on 127.0.0.1:5900
Adres-eraro(nekropsio elŝutita)
--8<---------------cut here---------------start------------->8---

I’d need debugging symbols to provide a useful backtrace, but perhaps
the strace gives useful hints:

--8<---------------cut here---------------start------------->8---
$ strace -o ,,s 
/gnu/store/h22dc67wzkv0w2l3775f0xqkyr318x5j-qemu-minimal-2.12.0/bin/qemu-system-i386
 -enable-kvm /dev/null
WARNING: Image format was not specified for '/dev/null' and probing guessed raw.
         Automatically detecting the format is dangerous for raw images, write 
operations on block 0 will be restricted.
         Specify the 'raw' format explicitly to remove the restrictions.
VNC server running on 127.0.0.1:5900
Adres-eraro
$ tail ,,s
ioctl(10, KVM_CHECK_EXTENSION, 0x4c)    = 1
ioctl(11, KVM_SET_CLOCK, 0xff9f32bc)    = 0
ioctl(16, KVM_KVMCLOCK_CTRL, 0)         = -1 EINVAL (Invalid argument)
write(15, "\1\0\0\0\0\0\0\0", 8)        = 8
futex(0x57ee400c, FUTEX_WAKE_PRIVATE, 2147483647) = 1
getpid()                                = 3064
tgkill(3064, 3068, SIGUSR1)             = 0
futex(0x57193bd8, FUTEX_WAKE_PRIVATE, 1) = 1
ppoll([{fd=4, events=POLLIN}, {fd=6, events=POLLIN}, {fd=8, events=POLLIN}, 
{fd=9, events=POLLIN}, {fd=17, events=POLLIN}], 5, {tv_sec=0, tv_nsec=0}, NULL, 
8 <unfinished ...>
+++ killed by SIGSEGV (core dumped) +++
--8<---------------cut here---------------end--------------->8---

Before investigating further, does it ring a bell?  It used to work, and
I think the main difference is the kernel version.

Thanks,
Ludo’.