Failed to run xvisor-next image with qemu

[zetalog]

I can use spike running current released xvisor-next image and a very old qemu (almost when RVH support is announced to be ready in the community). But when I updated qemu, I got the following error when booting xvisor-next image:

(omit opensbi logs)
Xvisor v0.3.2-2-g1329959e (Apr  6 2023 13:42:12)

INIT: host address space
INIT: vapool: base=0x0000000010000000 size=33554432
INIT: vapool: hkbase=0x000000001015F000 hksize=131072
INIT: ram: bank0 phys=0x0000000080000000 size=536870912
INIT: ram: bank0 hkbase=0x000000001017F000 hksize=16384
INIT: ram_reserve: phys=0x0000000080200000 size=913408
INIT: ram_reserve: phys=0x000000008035F000 size=376832
INIT: ram_reserve: phys=0x00000000802DF000 size=524288
INIT: vapool_reserve: virt=0x0000000010000000 size=1814528
INIT: ram_reserve: phys=0x0000000082200000 size=8192
INIT: heap management
INIT: device tree
INIT: device tree reserved-memory
INIT: ram_reserve: phys=0x0000000080000000 size=262144
INIT: DMA heap management
INIT: CPU nascent
INIT: SBI specification v0.3 detected
INIT: SBI implementation ID=0x1 Version=0x9
INIT: SBI TIME extension detected
INIT: SBI IPI extension detected
INIT: SBI RFENCE extension detected
INIT: SBI SRST extension detected
INIT: board nascent
INIT: nascent funtions
INIT: page pool
INIT: exception table
INIT: discover secondary CPUs
INIT: using SBI SMP operations
INIT: per-CPU areas
INIT: CPU hotplug
INIT: host irq subsystem
INIT: riscv-intc: registered 64 local interrupts
INIT: plic: plic@c000000: devices=96 contexts=1/2
INIT: CPU early
INIT: early_params: vmm.bootcmd="vfs mount initrd /;vfs run /boot.xscript;vfs cat /system/banner.txt"
INIT: riscv-sbi-ipi: registered IPI domain
INIT: board early
INIT: early funtions
INIT: standard I/O
INIT: clocksource manager
INIT: riscv-timer: registered clocksource @ 10000000Hz using Sstc
INIT: clockchip manager
do_error: CPU0: VCPU=(NULL) unexpected trap (error -1)
           zero=0x0000000000000000          ra=0x000000001004EC92
             sp=0x00000000100DEE10          gp=0x0000000000000000
             tp=0x00000000100DEFC0          s0=0x00000000100DEE30
             s1=0x0000000010A05280          a0=0x0000000000000001
             a1=0x000000000000001C          a2=0x00000000028F5C29
             a3=0x0000000000000000          a4=0x0000000000000001
             a5=0xFFFFFFFFFFFFFFFF          a6=0x00000000000005DB
             a7=0x0000000000000001          s2=0x0000000000000000
             s3=0x0000000010A05400          s4=0x00000000100D4350
             s5=0x0000000000000000          s6=0x0000000000000000
             s7=0x00000000100B5068          s8=0x0000000080015038
             s9=0x0000000080036CA8         s10=0x0000000000000000
            s11=0x0000000000000000          t0=0x0000000000000080
             t1=0x000000000000FF00          t2=0x0000000000FF0000
             t3=0x0000000000FF0000          t4=0x0000000000000000
             t5=0x0000000000000000          t6=0x0000000000000000
           sepc=0x000000001004EC98     sstatus=0x0000000200000120
        hstatus=0x0000000200000000     sp_exec=0x00000000100DEFC0
         scause=0x0000000000000002       stval=0x0000000014D79073
          htval=0x0000000000000000      htinst=0x0000000000000000
FATAL: do_error: please reboot ...
0x100024C8 do_error+0x9c/0xac
0x100025EA do_handle_trap+0x8c/0x1da
0x1000274C do_handle_exception+0x14/0x38
0x100003C2 _handle_hyp_exception+0x72/0xd4
FATAL: Please reset the system ...
QEMU: Terminated

My command line is:

qemu-system-riscv64 \
      -M virt \
      -cpu rv64,h=true,sstc=true \
      -m 512M \
      -nographic \
      -bios ../opensbi/build/platform/generic/firmware/fw_jump.bin \
      -kernel ./build/vmm.bin \
      -initrd ./build/disk.img \
      -append 'vmm.bootcmd="vfs mount initrd /;vfs run /boot.xscript;vfs cat /system/banner.txt"'

Is there any changes relating running RISC-V xvisor with qemu? Or something is broken in the merged upstream?

[zetalog]

Looks the emulator contains wrong sstc support:

                csr_write(CSR_STIMECMP, -1UL);
    1004ec96:   57fd                    li      a5,-1
    1004ec98:   14d79073                csrw    0x14d,a5

The piece of code is executed after testing SSTC extension.

[alistair23]

Do you mind posting any QEMU issues on the official QEMU issue tracker?

When posting plesae include images as well, that way I can easily reproduce the problem