Bug 216003

Summary: Single stepping Windows 7 bootloader results in Assertion `ret < cpu->num_ases && ret >= 0' failed.
Product: Virtualization Reporter: Eric Li (ercli)
Component: kvmAssignee: virtualization_kvm
Status: RESOLVED MOVED    
Severity: normal CC: ercli
Priority: P1    
Hardware: Intel   
OS: Linux   
Kernel Version: 5.17.6-200.fc35.x86_64 Tree: Mainline
Regression: No

Description Eric Li 2022-05-20 00:54:56 UTC
CPU model: Intel(R) Core(TM) i7-4510U CPU @ 2.00GHz
Host kernel version: 5.17.6-200.fc35.x86_64
Host kernel arch: x86_64
Guest: Windows 7 or Windows 10 BIOS mode boot loader. 32-bits.
This bug still exists if using -machine kernel_irqchip=off
This bug no longer exists if using -accel tcg

How to reproduce:

1. Install Windows 7 or Windows 10 in QEMU. Use MBR and BIOS (i.e. do not use GPT and UEFI). For example, I installed Windows on a 32G disk, and it results in around 3 partitions: 50M, 31.5G (this is C:), 450M. Only the MBR header (around 1 M) and the 50M disk is needed. For example, https://drive.google.com/uc?id=1mLvKsPSuLbeckwcdnavnQMu8QxOwvX29 can be used to reproduce this bug. Suppose Windows is installed in w.img.

2. Start QEMU
qemu-system-x86_64 --drive media=disk,file=w.img,format=raw,index=1 -s -S -enable-kvm

3. Start GDB
gdb --ex 'target remote :::1234' --ex 'hb *0x7c00' --ex c --ex 'si 10000' --ex q
This GDB command starts from the MBR header and runs 10000 instructions. When I am reproducing it, running 1000 is enough to reproduce this problem. If this problem cannot be reproduced, try to increase this number.

4. See error in QEMU:
qemu-system-x86_64: ../hw/core/cpu-sysemu.c:77: cpu_asidx_from_attrs: Assertion `ret < cpu->num_ases && ret >= 0' failed.
Aborted (core dumped)

Expected behavior: there should not be an assertion error. GDB should be able to single step a lot of instructions successfully.
Comment 1 Eric Li 2022-05-29 20:28:05 UTC
I think this is more likely a QEMU bug. I have filed https://gitlab.com/qemu-project/qemu/-/issues/1047 . I am marking this bug as resolved now.