[Qemu-devel] [Bug 1755479] [NEW] Cortex M:qemu abort with optimized code and icount

[Qemu-devel] [Bug 1755479] [NEW] Cortex M:qemu abort with optimized code and icount

[Antoine]

Public bug reported:

A basic program runs fine if compiled with flag -O0 with gcc, but triggers a qemu abort when compiled with -O1 and run with icount:
"qemu: fatal: IO on conditional branch instruction"

I also noticed the problem on C source like this with -O0:
"int foo = *bar; bar++;" : OK
"int foo = *bar++;" : FAIL (!!!)

Optimized binary attached to this ticket.

command line:
qemu-system-arm -M lm3s6965evb -nographic -kernel hello.bin -serial file:$(tty) -icount 4 -cpu cortex-m4
(working fine without icount)

version: 
QEMU emulator version 2.11.50 (v2.11.0-2146-gd9bbfea-dirty)

Compilation options:
./configure --target-list=arm-softmmu --disable-slirp --disable-blobs --disable-docs --disable-guest-agent --disable-gnutls --disable-nettle --disable-gcrypt --disable-sdl --disable-gtk --disable-vnc --disable-virtfs --disable-mpath --disable-xen --disable-brlapi --disable-curl --disable-bluez --disable-kvm --disable-hax --disable-hvf --disable-whpx --disable-rdma --disable-vde --disable-netmap --disable-linux-aio --disable-cap-ng --disable-attr --disable-vhost-net --disable-spice --disable-rbd --disable-libiscsi --disable-libnfs --disable-smartcard --disable-libusb --disable-live-block-migration --disable-usb-redir --disable-lzo --disable-snappy --disable-bzip2 --disable-seccomp --disable-glusterfs --disable-tpm --disable-libssh2 --disable-numa --disable-libxml2 --disable-tcmalloc --disable-jemalloc --disable-replication --disable-vhost-vsock --disable-opengl --disable-virglrenderer --disable-xfsctl --disable-qom-cast-debug --disable-vxhs --disable-crypto-afalg --disable-vhost-user --disable-capstone --disable-pie --extra-cflags=-mtune=native

I have also tested previous versions:
- stock qemu-system-arm 2.5.0 from ubuntu 16.04: OK
- git version: QEMU emulator version 2.10.0 (v2.10.2-dirty): OK
- git version: QEMU emulator version 2.10.90 (v2.11.0-rc0-dirty): FAIL

** Affects: qemu
     Importance: Undecided
         Status: New

** Attachment added: "hello.bin"
   https://bugs.launchpad.net/bugs/1755479/+attachment/5078133/+files/hello.bin

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1755479

Title:
  Cortex M:qemu abort with optimized code and icount

Status in QEMU:
  New

Bug description:
  A basic program runs fine if compiled with flag -O0 with gcc, but triggers a qemu abort when compiled with -O1 and run with icount:
  "qemu: fatal: IO on conditional branch instruction"

  I also noticed the problem on C source like this with -O0:
  "int foo = *bar; bar++;" : OK
  "int foo = *bar++;" : FAIL (!!!)

  Optimized binary attached to this ticket.

  command line:
  qemu-system-arm -M lm3s6965evb -nographic -kernel hello.bin -serial file:$(tty) -icount 4 -cpu cortex-m4
  (working fine without icount)

  version: 
  QEMU emulator version 2.11.50 (v2.11.0-2146-gd9bbfea-dirty)

  Compilation options:
  ./configure --target-list=arm-softmmu --disable-slirp --disable-blobs --disable-docs --disable-guest-agent --disable-gnutls --disable-nettle --disable-gcrypt --disable-sdl --disable-gtk --disable-vnc --disable-virtfs --disable-mpath --disable-xen --disable-brlapi --disable-curl --disable-bluez --disable-kvm --disable-hax --disable-hvf --disable-whpx --disable-rdma --disable-vde --disable-netmap --disable-linux-aio --disable-cap-ng --disable-attr --disable-vhost-net --disable-spice --disable-rbd --disable-libiscsi --disable-libnfs --disable-smartcard --disable-libusb --disable-live-block-migration --disable-usb-redir --disable-lzo --disable-snappy --disable-bzip2 --disable-seccomp --disable-glusterfs --disable-tpm --disable-libssh2 --disable-numa --disable-libxml2 --disable-tcmalloc --disable-jemalloc --disable-replication --disable-vhost-vsock --disable-opengl --disable-virglrenderer --disable-xfsctl --disable-qom-cast-debug --disable-vxhs --disable-crypto-afalg --disable-vhost-user --disable-capstone --disable-pie --extra-cflags=-mtune=native

  I have also tested previous versions:
  - stock qemu-system-arm 2.5.0 from ubuntu 16.04: OK
  - git version: QEMU emulator version 2.10.0 (v2.10.2-dirty): OK
  - git version: QEMU emulator version 2.10.90 (v2.11.0-rc0-dirty): FAIL

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1755479/+subscriptions

[Qemu-devel] [Bug 1755479] Re: Cortex M:qemu abort with optimized code and icount

[Peter Maydell]

Yes, it looks like we accidentally broke icount. This patch from the mailing list fixes it:
https://lists.gnu.org/archive/html/qemu-devel/2018-02/msg06595.html

though it hasn't been code-reviewed yet.

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1755479

Title:
  Cortex M:qemu abort with optimized code and icount

Status in QEMU:
  New

Bug description:
  A basic program runs fine if compiled with flag -O0 with gcc, but triggers a qemu abort when compiled with -O1 and run with icount:
  "qemu: fatal: IO on conditional branch instruction"

  I also noticed the problem on C source like this with -O0:
  "int foo = *bar; bar++;" : OK
  "int foo = *bar++;" : FAIL (!!!)

  Optimized binary attached to this ticket.

  command line:
  qemu-system-arm -M lm3s6965evb -nographic -kernel hello.bin -serial file:$(tty) -icount 4 -cpu cortex-m4
  (working fine without icount)

  version: 
  QEMU emulator version 2.11.50 (v2.11.0-2146-gd9bbfea-dirty)

  Compilation options:
  ./configure --target-list=arm-softmmu --disable-slirp --disable-blobs --disable-docs --disable-guest-agent --disable-gnutls --disable-nettle --disable-gcrypt --disable-sdl --disable-gtk --disable-vnc --disable-virtfs --disable-mpath --disable-xen --disable-brlapi --disable-curl --disable-bluez --disable-kvm --disable-hax --disable-hvf --disable-whpx --disable-rdma --disable-vde --disable-netmap --disable-linux-aio --disable-cap-ng --disable-attr --disable-vhost-net --disable-spice --disable-rbd --disable-libiscsi --disable-libnfs --disable-smartcard --disable-libusb --disable-live-block-migration --disable-usb-redir --disable-lzo --disable-snappy --disable-bzip2 --disable-seccomp --disable-glusterfs --disable-tpm --disable-libssh2 --disable-numa --disable-libxml2 --disable-tcmalloc --disable-jemalloc --disable-replication --disable-vhost-vsock --disable-opengl --disable-virglrenderer --disable-xfsctl --disable-qom-cast-debug --disable-vxhs --disable-crypto-afalg --disable-vhost-user --disable-capstone --disable-pie --extra-cflags=-mtune=native

  I have also tested previous versions:
  - stock qemu-system-arm 2.5.0 from ubuntu 16.04: OK
  - git version: QEMU emulator version 2.10.0 (v2.10.2-dirty): OK
  - git version: QEMU emulator version 2.10.90 (v2.11.0-rc0-dirty): FAIL

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1755479/+subscriptions

[Qemu-devel] [Bug 1755479] Re: Cortex M:qemu abort with optimized code and icount

[Antoine]

I just tested the patch and it resolves this problem. Thanks!

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1755479

Title:
  Cortex M:qemu abort with optimized code and icount

Status in QEMU:
  New

Bug description:
  A basic program runs fine if compiled with flag -O0 with gcc, but triggers a qemu abort when compiled with -O1 and run with icount:
  "qemu: fatal: IO on conditional branch instruction"

  I also noticed the problem on C source like this with -O0:
  "int foo = *bar; bar++;" : OK
  "int foo = *bar++;" : FAIL (!!!)

  Optimized binary attached to this ticket.

  command line:
  qemu-system-arm -M lm3s6965evb -nographic -kernel hello.bin -serial file:$(tty) -icount 4 -cpu cortex-m4
  (working fine without icount)

  version: 
  QEMU emulator version 2.11.50 (v2.11.0-2146-gd9bbfea-dirty)

  Compilation options:
  ./configure --target-list=arm-softmmu --disable-slirp --disable-blobs --disable-docs --disable-guest-agent --disable-gnutls --disable-nettle --disable-gcrypt --disable-sdl --disable-gtk --disable-vnc --disable-virtfs --disable-mpath --disable-xen --disable-brlapi --disable-curl --disable-bluez --disable-kvm --disable-hax --disable-hvf --disable-whpx --disable-rdma --disable-vde --disable-netmap --disable-linux-aio --disable-cap-ng --disable-attr --disable-vhost-net --disable-spice --disable-rbd --disable-libiscsi --disable-libnfs --disable-smartcard --disable-libusb --disable-live-block-migration --disable-usb-redir --disable-lzo --disable-snappy --disable-bzip2 --disable-seccomp --disable-glusterfs --disable-tpm --disable-libssh2 --disable-numa --disable-libxml2 --disable-tcmalloc --disable-jemalloc --disable-replication --disable-vhost-vsock --disable-opengl --disable-virglrenderer --disable-xfsctl --disable-qom-cast-debug --disable-vxhs --disable-crypto-afalg --disable-vhost-user --disable-capstone --disable-pie --extra-cflags=-mtune=native

  I have also tested previous versions:
  - stock qemu-system-arm 2.5.0 from ubuntu 16.04: OK
  - git version: QEMU emulator version 2.10.0 (v2.10.2-dirty): OK
  - git version: QEMU emulator version 2.10.90 (v2.11.0-rc0-dirty): FAIL

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1755479/+subscriptions

[Qemu-devel] [Bug 1755479] Re: Cortex M:qemu abort with optimized code and icount

[Peter Maydell]

** Tags added: arm

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1755479

Title:
  Cortex M:qemu abort with optimized code and icount

Status in QEMU:
  New

Bug description:
  A basic program runs fine if compiled with flag -O0 with gcc, but triggers a qemu abort when compiled with -O1 and run with icount:
  "qemu: fatal: IO on conditional branch instruction"

  I also noticed the problem on C source like this with -O0:
  "int foo = *bar; bar++;" : OK
  "int foo = *bar++;" : FAIL (!!!)

  Optimized binary attached to this ticket.

  command line:
  qemu-system-arm -M lm3s6965evb -nographic -kernel hello.bin -serial file:$(tty) -icount 4 -cpu cortex-m4
  (working fine without icount)

  version: 
  QEMU emulator version 2.11.50 (v2.11.0-2146-gd9bbfea-dirty)

  Compilation options:
  ./configure --target-list=arm-softmmu --disable-slirp --disable-blobs --disable-docs --disable-guest-agent --disable-gnutls --disable-nettle --disable-gcrypt --disable-sdl --disable-gtk --disable-vnc --disable-virtfs --disable-mpath --disable-xen --disable-brlapi --disable-curl --disable-bluez --disable-kvm --disable-hax --disable-hvf --disable-whpx --disable-rdma --disable-vde --disable-netmap --disable-linux-aio --disable-cap-ng --disable-attr --disable-vhost-net --disable-spice --disable-rbd --disable-libiscsi --disable-libnfs --disable-smartcard --disable-libusb --disable-live-block-migration --disable-usb-redir --disable-lzo --disable-snappy --disable-bzip2 --disable-seccomp --disable-glusterfs --disable-tpm --disable-libssh2 --disable-numa --disable-libxml2 --disable-tcmalloc --disable-jemalloc --disable-replication --disable-vhost-vsock --disable-opengl --disable-virglrenderer --disable-xfsctl --disable-qom-cast-debug --disable-vxhs --disable-crypto-afalg --disable-vhost-user --disable-capstone --disable-pie --extra-cflags=-mtune=native

  I have also tested previous versions:
  - stock qemu-system-arm 2.5.0 from ubuntu 16.04: OK
  - git version: QEMU emulator version 2.10.0 (v2.10.2-dirty): OK
  - git version: QEMU emulator version 2.10.90 (v2.11.0-rc0-dirty): FAIL

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1755479/+subscriptions

[Qemu-devel] [Bug 1755479] Re: Cortex M:qemu abort with optimized code and icount

[philmd]

Hey Antoine, do you mind replying to the list thread with a single line
such:

  Tested-by: Antoine Calando <acalando@free.fr>

This will help the code review and the patch will probably get merged
faster.

Thanks.

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1755479

Title:
  Cortex M:qemu abort with optimized code and icount

Status in QEMU:
  New

Bug description:
  A basic program runs fine if compiled with flag -O0 with gcc, but triggers a qemu abort when compiled with -O1 and run with icount:
  "qemu: fatal: IO on conditional branch instruction"

  I also noticed the problem on C source like this with -O0:
  "int foo = *bar; bar++;" : OK
  "int foo = *bar++;" : FAIL (!!!)

  Optimized binary attached to this ticket.

  command line:
  qemu-system-arm -M lm3s6965evb -nographic -kernel hello.bin -serial file:$(tty) -icount 4 -cpu cortex-m4
  (working fine without icount)

  version: 
  QEMU emulator version 2.11.50 (v2.11.0-2146-gd9bbfea-dirty)

  Compilation options:
  ./configure --target-list=arm-softmmu --disable-slirp --disable-blobs --disable-docs --disable-guest-agent --disable-gnutls --disable-nettle --disable-gcrypt --disable-sdl --disable-gtk --disable-vnc --disable-virtfs --disable-mpath --disable-xen --disable-brlapi --disable-curl --disable-bluez --disable-kvm --disable-hax --disable-hvf --disable-whpx --disable-rdma --disable-vde --disable-netmap --disable-linux-aio --disable-cap-ng --disable-attr --disable-vhost-net --disable-spice --disable-rbd --disable-libiscsi --disable-libnfs --disable-smartcard --disable-libusb --disable-live-block-migration --disable-usb-redir --disable-lzo --disable-snappy --disable-bzip2 --disable-seccomp --disable-glusterfs --disable-tpm --disable-libssh2 --disable-numa --disable-libxml2 --disable-tcmalloc --disable-jemalloc --disable-replication --disable-vhost-vsock --disable-opengl --disable-virglrenderer --disable-xfsctl --disable-qom-cast-debug --disable-vxhs --disable-crypto-afalg --disable-vhost-user --disable-capstone --disable-pie --extra-cflags=-mtune=native

  I have also tested previous versions:
  - stock qemu-system-arm 2.5.0 from ubuntu 16.04: OK
  - git version: QEMU emulator version 2.10.0 (v2.10.2-dirty): OK
  - git version: QEMU emulator version 2.10.90 (v2.11.0-rc0-dirty): FAIL

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1755479/+subscriptions

[Qemu-devel] [Bug 1755479] Re: Cortex M:qemu abort with optimized code and icount

[Peter Maydell]

That's not really necessary as the patch is already in Paolo's pull
request.

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1755479

Title:
  Cortex M:qemu abort with optimized code and icount

Status in QEMU:
  New

Bug description:
  A basic program runs fine if compiled with flag -O0 with gcc, but triggers a qemu abort when compiled with -O1 and run with icount:
  "qemu: fatal: IO on conditional branch instruction"

  I also noticed the problem on C source like this with -O0:
  "int foo = *bar; bar++;" : OK
  "int foo = *bar++;" : FAIL (!!!)

  Optimized binary attached to this ticket.

  command line:
  qemu-system-arm -M lm3s6965evb -nographic -kernel hello.bin -serial file:$(tty) -icount 4 -cpu cortex-m4
  (working fine without icount)

  version: 
  QEMU emulator version 2.11.50 (v2.11.0-2146-gd9bbfea-dirty)

  Compilation options:
  ./configure --target-list=arm-softmmu --disable-slirp --disable-blobs --disable-docs --disable-guest-agent --disable-gnutls --disable-nettle --disable-gcrypt --disable-sdl --disable-gtk --disable-vnc --disable-virtfs --disable-mpath --disable-xen --disable-brlapi --disable-curl --disable-bluez --disable-kvm --disable-hax --disable-hvf --disable-whpx --disable-rdma --disable-vde --disable-netmap --disable-linux-aio --disable-cap-ng --disable-attr --disable-vhost-net --disable-spice --disable-rbd --disable-libiscsi --disable-libnfs --disable-smartcard --disable-libusb --disable-live-block-migration --disable-usb-redir --disable-lzo --disable-snappy --disable-bzip2 --disable-seccomp --disable-glusterfs --disable-tpm --disable-libssh2 --disable-numa --disable-libxml2 --disable-tcmalloc --disable-jemalloc --disable-replication --disable-vhost-vsock --disable-opengl --disable-virglrenderer --disable-xfsctl --disable-qom-cast-debug --disable-vxhs --disable-crypto-afalg --disable-vhost-user --disable-capstone --disable-pie --extra-cflags=-mtune=native

  I have also tested previous versions:
  - stock qemu-system-arm 2.5.0 from ubuntu 16.04: OK
  - git version: QEMU emulator version 2.10.0 (v2.10.2-dirty): OK
  - git version: QEMU emulator version 2.10.90 (v2.11.0-rc0-dirty): FAIL

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1755479/+subscriptions

[Qemu-devel] [Bug 1755479] Re: Cortex M:qemu abort with optimized code and icount

[Peter Maydell]

This is now fixed in master (and will be in 2.12.0) with commits
0790f8686107 and 87f963be66a32453e001.

** Changed in: qemu
       Status: New => Fix Committed

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1755479

Title:
  Cortex M:qemu abort with optimized code and icount

Status in QEMU:
  Fix Committed

Bug description:
  A basic program runs fine if compiled with flag -O0 with gcc, but triggers a qemu abort when compiled with -O1 and run with icount:
  "qemu: fatal: IO on conditional branch instruction"

  I also noticed the problem on C source like this with -O0:
  "int foo = *bar; bar++;" : OK
  "int foo = *bar++;" : FAIL (!!!)

  Optimized binary attached to this ticket.

  command line:
  qemu-system-arm -M lm3s6965evb -nographic -kernel hello.bin -serial file:$(tty) -icount 4 -cpu cortex-m4
  (working fine without icount)

  version: 
  QEMU emulator version 2.11.50 (v2.11.0-2146-gd9bbfea-dirty)

  Compilation options:
  ./configure --target-list=arm-softmmu --disable-slirp --disable-blobs --disable-docs --disable-guest-agent --disable-gnutls --disable-nettle --disable-gcrypt --disable-sdl --disable-gtk --disable-vnc --disable-virtfs --disable-mpath --disable-xen --disable-brlapi --disable-curl --disable-bluez --disable-kvm --disable-hax --disable-hvf --disable-whpx --disable-rdma --disable-vde --disable-netmap --disable-linux-aio --disable-cap-ng --disable-attr --disable-vhost-net --disable-spice --disable-rbd --disable-libiscsi --disable-libnfs --disable-smartcard --disable-libusb --disable-live-block-migration --disable-usb-redir --disable-lzo --disable-snappy --disable-bzip2 --disable-seccomp --disable-glusterfs --disable-tpm --disable-libssh2 --disable-numa --disable-libxml2 --disable-tcmalloc --disable-jemalloc --disable-replication --disable-vhost-vsock --disable-opengl --disable-virglrenderer --disable-xfsctl --disable-qom-cast-debug --disable-vxhs --disable-crypto-afalg --disable-vhost-user --disable-capstone --disable-pie --extra-cflags=-mtune=native

  I have also tested previous versions:
  - stock qemu-system-arm 2.5.0 from ubuntu 16.04: OK
  - git version: QEMU emulator version 2.10.0 (v2.10.2-dirty): OK
  - git version: QEMU emulator version 2.10.90 (v2.11.0-rc0-dirty): FAIL

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1755479/+subscriptions

[Qemu-devel] [Bug 1755479] Re: Cortex M:qemu abort with optimized code and icount

[Thomas Huth]

** Changed in: qemu
       Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1755479

Title:
  Cortex M:qemu abort with optimized code and icount

Status in QEMU:
  Fix Released

Bug description:
  A basic program runs fine if compiled with flag -O0 with gcc, but triggers a qemu abort when compiled with -O1 and run with icount:
  "qemu: fatal: IO on conditional branch instruction"

  I also noticed the problem on C source like this with -O0:
  "int foo = *bar; bar++;" : OK
  "int foo = *bar++;" : FAIL (!!!)

  Optimized binary attached to this ticket.

  command line:
  qemu-system-arm -M lm3s6965evb -nographic -kernel hello.bin -serial file:$(tty) -icount 4 -cpu cortex-m4
  (working fine without icount)

  version: 
  QEMU emulator version 2.11.50 (v2.11.0-2146-gd9bbfea-dirty)

  Compilation options:
  ./configure --target-list=arm-softmmu --disable-slirp --disable-blobs --disable-docs --disable-guest-agent --disable-gnutls --disable-nettle --disable-gcrypt --disable-sdl --disable-gtk --disable-vnc --disable-virtfs --disable-mpath --disable-xen --disable-brlapi --disable-curl --disable-bluez --disable-kvm --disable-hax --disable-hvf --disable-whpx --disable-rdma --disable-vde --disable-netmap --disable-linux-aio --disable-cap-ng --disable-attr --disable-vhost-net --disable-spice --disable-rbd --disable-libiscsi --disable-libnfs --disable-smartcard --disable-libusb --disable-live-block-migration --disable-usb-redir --disable-lzo --disable-snappy --disable-bzip2 --disable-seccomp --disable-glusterfs --disable-tpm --disable-libssh2 --disable-numa --disable-libxml2 --disable-tcmalloc --disable-jemalloc --disable-replication --disable-vhost-vsock --disable-opengl --disable-virglrenderer --disable-xfsctl --disable-qom-cast-debug --disable-vxhs --disable-crypto-afalg --disable-vhost-user --disable-capstone --disable-pie --extra-cflags=-mtune=native

  I have also tested previous versions:
  - stock qemu-system-arm 2.5.0 from ubuntu 16.04: OK
  - git version: QEMU emulator version 2.10.0 (v2.10.2-dirty): OK
  - git version: QEMU emulator version 2.10.90 (v2.11.0-rc0-dirty): FAIL

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1755479/+subscriptions