From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugzilla@gcc.gnu.org>
Received: by sourceware.org (Postfix, from userid 48)
 id 607E43860C33; Tue, 26 Jan 2021 14:58:55 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 607E43860C33
From: "david.welch at netronome dot com" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug target/82150] Produces a branch prefetch which causes a hang
Date: Tue, 26 Jan 2021 14:58:55 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: target
X-Bugzilla-Version: 7.2.1
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: normal
X-Bugzilla-Who: david.welch at netronome dot com
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: 
Message-ID: <bug-82150-4-c5IYEcpMhj@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-82150-4@http.gcc.gnu.org/bugzilla/>
References: <bug-82150-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-BeenThere: gcc-bugs@gcc.gnu.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Gcc-bugs mailing list <gcc-bugs.gcc.gnu.org>
List-Unsubscribe: <https://gcc.gnu.org/mailman/options/gcc-bugs>,
 <mailto:gcc-bugs-request@gcc.gnu.org?subject=unsubscribe>
List-Archive: <https://gcc.gnu.org/pipermail/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-request@gcc.gnu.org?subject=help>
List-Subscribe: <https://gcc.gnu.org/mailman/listinfo/gcc-bugs>,
 <mailto:gcc-bugs-request@gcc.gnu.org?subject=subscribe>
X-List-Received-Date: Tue, 26 Jan 2021 14:58:55 -0000

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D82150

--- Comment #11 from david.welch at netronome dot com ---
I wish I had know this when I filed this ticket, there is an ARM Errata for
this issue that was issued before or in 2009.=20=20

720247: Speculative Instruction fetches can be made anywhere in the memory =
map

I have researched this bug on this core and provided a workaround that ARM =
was
not able or willing.  (put a nop after unconditional branch instructions th=
at
modify the pc like pop {r4,pc}, but not bx lr...,anything other than another
branch instruction that causes a speculative fetch).

So if you require an ARM Errata in order to fix something, there you go it
exists.

It is still present in gcc 10 (has been present all this time).  I have not
examined gcc 11 yet as it has not been formally released.

unsigned int more_fun ( unsigned int );
unsigned int fun ( void )
{
    return(more_fun(0x12344700)+1);
}

Disassembly of section .text:

00000000 <fun>:
   0:   b510            push    {r4, lr}
   2:   4802            ldr     r0, [pc, #8]    ; (c <fun+0xc>)
   4:   f7ff fffe       bl      0 <more_fun>
   8:   3001            adds    r0, #1
   a:   bd10            pop     {r4, pc}
   c:   12344700        .word   0x12344700


.thumb
.inst.n 0x4700


Disassembly of section .text:

00000000 <.text>:
   0:   4700            bx      r0

and there is the speculative execution that causes a read (that can be anyw=
here
in the address space)


arm-none-eabi-gcc --version
arm-none-eabi-gcc (GCC) 10.2.0
Copyright (C) 2020 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

One could examine everything after a branch like this for another branch as=
 a
real instruction or embedded in the top of the pool a nop may be simpler af=
ter
each of the at-risk instructions.=