What were you trying to do that didn't work?

Just launch a guest, there is a tiny probability that an assertion will occur. The problem seems only to be triggered on the Fujitsu A64fx CPU, because I am using hpe-apollo80-01-n00.khw.eng.rdu2.dc.redhat.com and zhenyzha@redhat.com used fujitsu-fx700-01-n01.khw.eng.bos2.dc.redhat.com, both are A64FX.

Please provide the package NVR for which bug is seen:

QEMU: qemu-kvm-8.2.0-2.el9.aarch64
EDK2: edk2-aarch64-20231122-2.el9.noarch
Host kernel: 5.14.0-410.el9.aarch64+64k
Guest kernel: 5.14.0-410.el9.aarch64+64k

How reproducible:

3/1000?

Steps to reproduce

1.  Launch a guest

   MALLOC_PERTURB_=1  /usr/libexec/qemu-kvm \
       -S  \
       -name 'avocado-vt-vm1'  \
       -sandbox on \
       -blockdev '{"node-name": "file_aavmf_code", "driver": "file", "filename": "/usr/share/edk2/aarch64/QEMU_EFI-silent-pflash.qcow2", "auto-read-only": true, "discard": "unmap"}' \
       -blockdev '{"node-name": "drive_aavmf_code", "driver": "qcow2", "read-only": true, "file": "file_aavmf_code"}' \
       -blockdev '{"node-name": "file_aavmf_vars", "driver": "file", "filename": "/root/avocado/data/avocado-vt/avocado-vt-vm1_rhel940-aarch64-64k-virtio-scsi_qcow2_filesystem_VARS.qcow2", "auto-read-only": true, "discard": "unmap"}' \
       -blockdev '{"node-name": "drive_aavmf_vars", "driver": "qcow2", "read-only": false, "file": "file_aavmf_vars"}' \
       -machine virt,gic-version=host,pflash0=drive_aavmf_code,pflash1=drive_aavmf_vars,memory-backend=mem-machine_mem \
       -device '{"id": "pcie-root-port-0", "driver": "pcie-root-port", "multifunction": true, "bus": "pcie.0", "addr": "0x1", "chassis": 1}' \
       -device '{"id": "pcie-pci-bridge-0", "driver": "pcie-pci-bridge", "addr": "0x0", "bus": "pcie-root-port-0"}'  \
       -nodefaults \
       -device '{"id": "pcie-root-port-1", "port": 1, "driver": "pcie-root-port", "addr": "0x1.0x1", "bus": "pcie.0", "chassis": 2}' \
       -device '{"driver": "virtio-gpu-pci", "bus": "pcie-root-port-1", "addr": "0x0"}' \
       -m 11264 \
       -object '{"size": 11811160064, "id": "mem-machine_mem", "qom-type": "memory-backend-ram"}'  \
       -smp 24,maxcpus=24,cores=12,threads=1,clusters=1,sockets=2  \
       -cpu 'host' \
       -chardev socket,id=qmp_id_qmpmonitor1,server=on,path=/var/tmp/avocado_e0b_3l2u/monitor-qmpmonitor1-20240124-041940-jb0SK6Z7,wait=off  \
       -mon chardev=qmp_id_qmpmonitor1,mode=control \
       -chardev socket,id=qmp_id_catch_monitor,server=on,path=/var/tmp/avocado_e0b_3l2u/monitor-catch_monitor-20240124-041940-jb0SK6Z7,wait=off  \
       -mon chardev=qmp_id_catch_monitor,mode=control  \
       -serial unix:'/var/tmp/avocado_e0b_3l2u/serial-serial0-20240124-041940-jb0SK6Z7',server=on,wait=off \
       -device '{"id": "pcie-root-port-2", "port": 2, "driver": "pcie-root-port", "addr": "0x1.0x2", "bus": "pcie.0", "chassis": 3}' \
       -device '{"driver": "qemu-xhci", "id": "usb1", "bus": "pcie-root-port-2", "addr": "0x0"}' \
       -device '{"driver": "usb-tablet", "id": "usb-tablet1", "bus": "usb1.0", "port": "1"}' \
       -device '{"id": "pcie-root-port-3", "port": 3, "driver": "pcie-root-port", "addr": "0x1.0x3", "bus": "pcie.0", "chassis": 4}' \
       -device '{"id": "virtio_scsi_pci0", "driver": "virtio-scsi-pci", "bus": "pcie-root-port-3", "addr": "0x0"}' \
       -blockdev '{"node-name": "file_image1", "driver": "file", "auto-read-only": true, "discard": "unmap", "aio": "threads", "filename": "/home/kvm_autotest_root/images/rhel940-aarch64-64k-virtio-scsi.qcow2", "cache": {"direct": true, "no-flush": false}}' \
       -blockdev '{"node-name": "drive_image1", "driver": "qcow2", "read-only": false, "cache": {"direct": true, "no-flush": false}, "file": "file_image1"}' \
       -device '{"driver": "scsi-hd", "id": "image1", "drive": "drive_image1", "write-cache": "on"}' \
       -device '{"id": "pcie-root-port-4", "port": 4, "driver": "pcie-root-port", "addr": "0x1.0x4", "bus": "pcie.0", "chassis": 5}' \
       -device '{"driver": "virtio-net-pci", "mac": "9a:93:fb:1e:95:e9", "rombar": 0, "id": "idB3EIUa", "netdev": "idVdoZ5B", "bus": "pcie-root-port-4", "addr": "0x0"}' \
       -netdev  '{"id": "idVdoZ5B", "type": "tap", "vhost": true, "vhostfd": "16", "fd": "12"}'  \
       -vnc :0  \
       -rtc base=utc,clock=host \
       -chardev socket,id=char_vtpm_avocado-vt-vm1_tpm0,path=/root/avocado/data/avocado-vt/swtpm/avocado-vt-vm1_tpm0_swtpm.sock \
       -tpmdev emulator,chardev=char_vtpm_avocado-vt-vm1_tpm0,id=emulator_vtpm_avocado-vt-vm1_tpm0 \
       -device '{"id": "tpm-tis-device_vtpm_avocado-vt-vm1_tpm0", "tpmdev": "emulator_vtpm_avocado-vt-vm1_tpm0", "driver": "tpm-tis-device"}' \
       -enable-kvm \
   

2.  Start the guest

   {"execute": "qmp_capabilities", "id": "NorLVxeo"}
   {"execute": "cont", "id": "xrWm53pg"}
   

Expected results

Boot guest can complete and no assertion.

Actual results

qemu-kvm: /builddir/build/BUILD/qemu-8.2.0/include/qemu/int128.h:33: uint64_t int128_get64(Int128): Assertion `r == a' failed

hpe-apollo80-01-n00 systemd-coredump[1069316]: Process 1069201 (qemu-kvm) of user 0 dumped core.

Stack trace of thread 1069207:
#0  0x0000ffffba345ee0 __pthread_kill_implementation (libc.so.6 + 0x85ee0)
#1  0x0000ffffba2ff86c raise (libc.so.6 + 0x3f86c)
#2  0x0000ffffba2e7030 abort (libc.so.6 + 0x27030)
#3  0x0000ffffba2f93f0 __assert_fail_base (libc.so.6 + 0x393f0)
#4  0x0000ffffba2f9460 __assert_fail (libc.so.6 + 0x39460)
#5  0x0000aaaacce2882c generate_memory_topology (qemu-kvm + 0x65882c)
#6  0x0000aaaacce22404 memory_region_transaction_commit (qemu-kvm + 0x652404)
#7  0x0000aaaaccac2178 pflash_mem_write_with_attrs (qemu-kvm + 0x2f2178)
#8  0x0000aaaacce23644 access_with_adjusted_size (qemu-kvm + 0x653644)
#9  0x0000aaaacce23408 memory_region_dispatch_write (qemu-kvm + 0x653408)
#10 0x0000aaaacce32808 flatview_write_continue (qemu-kvm + 0x662808)
#11 0x0000aaaacce2f7e8 flatview_write (qemu-kvm + 0x65f7e8)
#12 0x0000aaaacce2f69c address_space_write (qemu-kvm + 0x65f69c)
#13 0x0000aaaacce7bdb8 kvm_cpu_exec (qemu-kvm + 0x6abdb8)
#14 0x0000aaaacce809c8 kvm_vcpu_thread_fn (qemu-kvm + 0x6b09c8)
#15 0x0000aaaaccfdaa54 qemu_thread_start (qemu-kvm + 0x80aa54)
#16 0x0000ffffba3442c8 start_thread (libc.so.6 + 0x842c8)
#17 0x0000ffffba2ebb9c thread_start (libc.so.6 + 0x2bb9c)