public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug target/41900]  New: call *%esp shouldn't be generated because of CPU errata
@ 2009-11-01 23:05 mikulas at artax dot karlin dot mff dot cuni dot cz
  2009-11-02  9:37 ` [Bug target/41900] " ubizjak at gmail dot com
                   ` (7 more replies)
  0 siblings, 8 replies; 9+ messages in thread
From: mikulas at artax dot karlin dot mff dot cuni dot cz @ 2009-11-01 23:05 UTC (permalink / raw)
  To: gcc-bugs

Hi

Intel P6 family of processors (Pentium Pro, 2, 3) have a bug in call *%esp
instruction. The instruction should put current EIP to stack, decrement ESP by
4 and jump to a value of ESP before the decrement. P6 processors will jump to
the address after the decrement (so the will execute return address as code).
See Pentium Pro errata 70, Pentium 2 errata A33, Pentium 3 errata E17.

Gcc generates call *%esp for this example, when compiled with -O2
-fomit-frame-pointer -mpreferred-stack-boundary=2:
int main()
{
        volatile unsigned code = 0x000000c3;
        ((void (*)(void))&code)();
        return 0;
}

The code crashes when executed on P6 processor and executes correctly on other
processors.

GCC shouldn't allow direct %esp register for call instruction. (addressing
using %esp is fine).

---

Note: this bug comes from a piece of code used to call an arbitrary interrupt.
I coded it as this. The "call *%esp" bug looks weird but is not an artifical
example, it comes from a real code that was written and used.

static void INTR(unsigned int_no)
{
        volatile unsigned code = 0xc300cd | (int_no << 8);
        ((void (*)(void))&code)();
}


-- 
           Summary: call *%esp shouldn't be generated because of CPU errata
           Product: gcc
           Version: 4.4.2
            Status: UNCONFIRMED
          Severity: minor
          Priority: P3
         Component: target
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: mikulas at artax dot karlin dot mff dot cuni dot cz
 GCC build triplet: i486-linux-gnu
  GCC host triplet: i486-linux-gnu
GCC target triplet: i486-linux-gnu


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=41900


^ permalink raw reply	[flat|nested] 9+ messages in thread
end of thread, other threads:[~2009-11-13 19:52 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2009-11-01 23:05 [Bug target/41900] New: call *%esp shouldn't be generated because of CPU errata mikulas at artax dot karlin dot mff dot cuni dot cz
2009-11-02  9:37 ` [Bug target/41900] " ubizjak at gmail dot com
2009-11-03  7:53 ` uros at gcc dot gnu dot org
2009-11-04 14:15 ` uros at gcc dot gnu dot org
2009-11-05  8:01 ` uros at gcc dot gnu dot org
2009-11-05  8:06 ` ubizjak at gmail dot com
2009-11-13 18:34 ` uros at gcc dot gnu dot org
2009-11-13 19:13 ` uros at gcc dot gnu dot org
2009-11-13 19:52 ` uros at gcc dot gnu dot org

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).