38280 2010-04-28 13:32:21 -0700 Fix spanning branch instruction on Cortex-A8 with Thumb-2 JIT 2010-05-08 12:51:38 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Other All RESOLVED FIXED P2 Normal --- 1 loki webkit-unassigned barraclough commit-queue oldest_to_newest 218596 0 loki 2010-04-28 13:32:21 -0700 Cortex-A8 errata says the following: If the 32-bit Thumb-2 branch instruction spans two 4KiB regions and the target of the branch falls within the first region it is possible for the processor to incorrectly determine the branch instruction, and it is also possible in some cases for the processor to enter a deadlock state. 218599 1 54615 loki 2010-04-28 13:34:14 -0700 Created attachment 54615 Fix spanning branch instruction on Cortex-A8 with Thumb-2 JIT 218749 2 54615 barraclough 2010-04-28 18:28:55 -0700 Comment on attachment 54615 Fix spanning branch instruction on Cortex-A8 with Thumb-2 JIT > + && (instruction - 2 - reinterpret_cast<uint16_t*>(target) >= 0) > + && (instruction - 2 - reinterpret_cast<uint16_t*>(target) <= 0xffe); Hey loki, I think there is a bug in this calculation. The result of a subtraction of two uint16_t* pointers is a difference in shorts, not in bytes – so checking this against 0xffe is checking a range of ~8KiB, not ~4KiB. Rather than performing the check in terms of a difference in shorts, it is probably clearer to check the difference in terms of bytes (which I'm guessing is what you were intending to do). 'relative' already measures in the difference in bytes, so you can probably use this. Also, the name of the variable is a little confusing, since it only describes part of the check - the first line checks if the instruction is spanning two pages, the second and third lines are checking if the target is in the first page. // The instruction is spanning two pages if it ends at an address ending 0x002. bool spansTwo4K = (reinterpret_cast<intptr_t>(instruction) & 0xfff) == 0x002; // The target is in the first page if the jump branch back back by [3..0x1002] bytes. (only if spansTwo4K is true) bool targetInFirstPage = (relative >= -0x1002) && (relative < -2); bool wouldTriggerA8Errata = spansTwo4K && targetInFirstPage; ^^ I think something like this would check more accurately? r-, but nice catch on spotting this erratum! 218882 3 loki 2010-04-29 00:57:48 -0700 > I think there is a bug in this calculation. Ops, you are right. I am going to fix this. > // The instruction is spanning two pages if it ends at an address ending > 0x002. > bool spansTwo4K = (reinterpret_cast<intptr_t>(instruction) & 0xfff) == > 0x002; > // The target is in the first page if the jump branch back back by > [3..0x1002] bytes. (only if spansTwo4K is true) > bool targetInFirstPage = (relative >= -0x1002) && (relative < -2); > bool wouldTriggerA8Errata = spansTwo4K && targetInFirstPage; This looks better. Thanks. 218899 4 54682 loki 2010-04-29 01:31:35 -0700 Created attachment 54682 Fix spanning branch instruction on Cortex-A8 with Thumb-2 JIT (v2) 222932 5 54682 commit-queue 2010-05-08 12:51:32 -0700 Comment on attachment 54682 Fix spanning branch instruction on Cortex-A8 with Thumb-2 JIT (v2) Clearing flags on attachment: 54682 Committed r59037: <http://trac.webkit.org/changeset/59037> 222933 6 commit-queue 2010-05-08 12:51:38 -0700 All reviewed patches have been landed. Closing bug. 54615 2010-04-28 13:34:14 -0700 2010-04-29 01:34:29 -0700 Fix spanning branch instruction on Cortex-A8 with Thumb-2 JIT 0001-Fix-spanning-branch-instruction-on-Cortex-A8-with-Th.patch text/plain 2847 loki RnJvbSAzMjhlMzNmYTgwNGQxMDNmYWYyYWMyN2IyYmI2ZDU2ODE3MDc5MjcxIE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBHYWJvciBMb2tpIDxsb2tpQGluZi51LXN6ZWdlZC5odT4KRGF0 ZTogV2VkLCAyOCBBcHIgMjAxMCAyMjoyMToxMiArMDIwMApTdWJqZWN0OiBbUEFUQ0hdIEZpeCBz cGFubmluZyBicmFuY2ggaW5zdHJ1Y3Rpb24gb24gQ29ydGV4LUE4IHdpdGggVGh1bWItMiBKSVQK ClNpZ25lZC1vZmYtYnk6IEdhYm9yIExva2kgPGxva2lAaW5mLnUtc3plZ2VkLmh1PgotLS0KIEph dmFTY3JpcHRDb3JlL0NoYW5nZUxvZyAgICAgICAgICAgICAgICAgIHwgICAxNiArKysrKysrKysr KysrKysrCiBKYXZhU2NyaXB0Q29yZS9hc3NlbWJsZXIvQVJNdjdBc3NlbWJsZXIuaCB8ICAgMTEg KysrKysrKysrKy0KIDIgZmlsZXMgY2hhbmdlZCwgMjYgaW5zZXJ0aW9ucygrKSwgMSBkZWxldGlv bnMoLSkKCmRpZmYgLS1naXQgYS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cgYi9KYXZhU2NyaXB0 Q29yZS9DaGFuZ2VMb2cKaW5kZXggNTM0ZTBmZS4uMTlkMWQzNCAxMDA2NDQKLS0tIGEvSmF2YVNj cmlwdENvcmUvQ2hhbmdlTG9nCisrKyBiL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwpAQCAtMSwz ICsxLDIwIEBACisyMDEwLTA0LTI4ICBHYWJvciBMb2tpICA8bG9raUB3ZWJraXQub3JnPgorCisg ICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEZpeCBzcGFubmlu ZyBicmFuY2ggaW5zdHJ1Y3Rpb24gb24gQ29ydGV4LUE4IHdpdGggVGh1bWItMiBKSVQKKyAgICAg ICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTM4MjgwCisKKyAgICAg ICAgQ29ydGV4LUE4IGVycmF0YSBzYXlzOgorICAgICAgICBJZiB0aGUgMzItYml0IFRodW1iLTIg YnJhbmNoIGluc3RydWN0aW9uIHNwYW5zIHR3byA0S2lCIHJlZ2lvbnMgYW5kCisgICAgICAgIHRo ZSB0YXJnZXQgb2YgdGhlIGJyYW5jaCBmYWxscyB3aXRoaW4gdGhlIGZpcnN0IHJlZ2lvbiBpdCBp cworICAgICAgICBwb3NzaWJsZSBmb3IgdGhlIHByb2Nlc3NvciB0byBpbmNvcnJlY3RseSBkZXRl cm1pbmUgdGhlIGJyYW5jaAorICAgICAgICBpbnN0cnVjdGlvbiwgYW5kIGl0IGlzIGFsc28gcG9z c2libGUgaW4gc29tZSBjYXNlcyBmb3IgdGhlIHByb2Nlc3NvcgorICAgICAgICB0byBlbnRlciBh IGRlYWRsb2NrIHN0YXRlLgorCisgICAgICAgICogYXNzZW1ibGVyL0FSTXY3QXNzZW1ibGVyLmg6 CisgICAgICAgIChKU0M6OkFSTXY3QXNzZW1ibGVyOjpsaW5rSnVtcEFic29sdXRlKToKKwogMjAx MC0wNC0yOCAgU2ltb24gSGF1c21hbm4gIDxzaW1vbi5oYXVzbWFubkBub2tpYS5jb20+LCBLZW50 IEhhbnNlbiA8a2VudC5oYW5zZW5Abm9raWEuY29tPgogCiAgICAgICAgIFJldmlld2VkIGJ5IERh cmluIEFkbGVyLgpkaWZmIC0tZ2l0IGEvSmF2YVNjcmlwdENvcmUvYXNzZW1ibGVyL0FSTXY3QXNz ZW1ibGVyLmggYi9KYXZhU2NyaXB0Q29yZS9hc3NlbWJsZXIvQVJNdjdBc3NlbWJsZXIuaAppbmRl eCAyMTI3OWY1Li44YmZkNzI4IDEwMDY0NAotLS0gYS9KYXZhU2NyaXB0Q29yZS9hc3NlbWJsZXIv QVJNdjdBc3NlbWJsZXIuaAorKysgYi9KYXZhU2NyaXB0Q29yZS9hc3NlbWJsZXIvQVJNdjdBc3Nl bWJsZXIuaApAQCAtMTc1NCw3ICsxNzU0LDE2IEBAIHByaXZhdGU6CiAgICAgICAgICAgICB8fCAo aXNOT1BfVDEoaW5zdHJ1Y3Rpb24gLSA1KSAmJiBpc05PUF9UMihpbnN0cnVjdGlvbiAtIDQpICYm IGlzQihpbnN0cnVjdGlvbiAtIDIpKSApOwogCiAgICAgICAgIGludHB0cl90IHJlbGF0aXZlID0g cmVpbnRlcnByZXRfY2FzdDxpbnRwdHJfdD4odGFyZ2V0KSAtIChyZWludGVycHJldF9jYXN0PGlu dHB0cl90PihpbnN0cnVjdGlvbikpOwotICAgICAgICBpZiAoKChyZWxhdGl2ZSA8PCA3KSA+PiA3 KSA9PSByZWxhdGl2ZSkgeworICAgICAgICAvLyBGcm9tIENvcnRleC1BOCBlcnJhdGE6CisgICAg ICAgIC8vIElmIHRoZSAzMi1iaXQgVGh1bWItMiBicmFuY2ggaW5zdHJ1Y3Rpb24gc3BhbnMgdHdv IDRLaUIgcmVnaW9ucyBhbmQKKyAgICAgICAgLy8gdGhlIHRhcmdldCBvZiB0aGUgYnJhbmNoIGZh bGxzIHdpdGhpbiB0aGUgZmlyc3QgcmVnaW9uIGl0IGlzCisgICAgICAgIC8vIHBvc3NpYmxlIGZv ciB0aGUgcHJvY2Vzc29yIHRvIGluY29ycmVjdGx5IGRldGVybWluZSB0aGUgYnJhbmNoCisgICAg ICAgIC8vIGluc3RydWN0aW9uLCBhbmQgaXQgaXMgYWxzbyBwb3NzaWJsZSBpbiBzb21lIGNhc2Vz IGZvciB0aGUgcHJvY2Vzc29yCisgICAgICAgIC8vIHRvIGVudGVyIGEgZGVhZGxvY2sgc3RhdGUu CisgICAgICAgIGJvb2wgc3BhbnNUd280SyA9ICgocmVpbnRlcnByZXRfY2FzdDxpbnRwdHJfdD4o aW5zdHJ1Y3Rpb24pICYgMHhmZmYpID09IDB4MDAyKQorICAgICAgICAgICAgICAgICAgICAgICAg ICAmJiAoaW5zdHJ1Y3Rpb24gLSAyIC0gcmVpbnRlcnByZXRfY2FzdDx1aW50MTZfdCo+KHRhcmdl dCkgPj0gMCkKKyAgICAgICAgICAgICAgICAgICAgICAgICAgJiYgKGluc3RydWN0aW9uIC0gMiAt IHJlaW50ZXJwcmV0X2Nhc3Q8dWludDE2X3QqPih0YXJnZXQpIDw9IDB4ZmZlKTsKKyAgICAgICAg aWYgKCgocmVsYXRpdmUgPDwgNykgPj4gNykgPT0gcmVsYXRpdmUgJiYgIXNwYW5zVHdvNEspIHsK ICAgICAgICAgICAgIC8vIEFSTSBlbmNvZGluZyBmb3IgdGhlIHRvcCB0d28gYml0cyBiZWxvdyB0 aGUgc2lnbiBiaXQgaXMgJ3BlY3VsaWFyJy4KICAgICAgICAgICAgIGlmIChyZWxhdGl2ZSA+PSAw KQogICAgICAgICAgICAgICAgIHJlbGF0aXZlIF49IDB4QzAwMDAwOwotLSAKMS41LjQuMwoK 54682 2010-04-29 01:31:35 -0700 2010-05-08 12:51:32 -0700 Fix spanning branch instruction on Cortex-A8 with Thumb-2 JIT (v2) 0001-Fix-spanning-branch-instruction-on-Cortex-A8-with-Th.patch text/plain 2931 loki RnJvbSBmY2I4NzU4ZTg1MDBkNjdiMWMyNmI4ZDRlMjEwYWE1NzFjMjgwMDU2IE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBHYWJvciBMb2tpIDxsb2tpQGluZi51LXN6ZWdlZC5odT4KRGF0 ZTogVGh1LCAyOSBBcHIgMjAxMCAxMDoyMDo1NyArMDIwMApTdWJqZWN0OiBbUEFUQ0hdIEZpeCBz cGFubmluZyBicmFuY2ggaW5zdHJ1Y3Rpb24gb24gQ29ydGV4LUE4IHdpdGggVGh1bWItMiBKSVQK ClNpZ25lZC1vZmYtYnk6IEdhYm9yIExva2kgPGxva2lAaW5mLnUtc3plZ2VkLmh1PgotLS0KIEph dmFTY3JpcHRDb3JlL0NoYW5nZUxvZyAgICAgICAgICAgICAgICAgIHwgICAxNiArKysrKysrKysr KysrKysrCiBKYXZhU2NyaXB0Q29yZS9hc3NlbWJsZXIvQVJNdjdBc3NlbWJsZXIuaCB8ICAgMTUg KysrKysrKysrKysrKystCiAyIGZpbGVzIGNoYW5nZWQsIDMwIGluc2VydGlvbnMoKyksIDEgZGVs ZXRpb25zKC0pCgpkaWZmIC0tZ2l0IGEvSmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nIGIvSmF2YVNj cmlwdENvcmUvQ2hhbmdlTG9nCmluZGV4IDg4MTJjMDMuLjJmYmUxMDcgMTAwNjQ0Ci0tLSBhL0ph dmFTY3JpcHRDb3JlL0NoYW5nZUxvZworKysgYi9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAg LTEsMyArMSwxOSBAQAorMjAxMC0wNC0yOCAgR2Fib3IgTG9raSAgPGxva2lAd2Via2l0Lm9yZz4K KworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBGaXggc3Bh bm5pbmcgYnJhbmNoIGluc3RydWN0aW9uIG9uIENvcnRleC1BOCB3aXRoIFRodW1iLTIgSklUCisg ICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0zODI4MAorCisg ICAgICAgIElmIHRoZSAzMi1iaXQgVGh1bWItMiBicmFuY2ggaW5zdHJ1Y3Rpb24gc3BhbnMgdHdv IDRLaUIgcmVnaW9ucyBhbmQKKyAgICAgICAgdGhlIHRhcmdldCBvZiB0aGUgYnJhbmNoIGZhbGxz IHdpdGhpbiB0aGUgZmlyc3QgcmVnaW9uIGl0IGlzCisgICAgICAgIHBvc3NpYmxlIGZvciB0aGUg cHJvY2Vzc29yIHRvIGluY29ycmVjdGx5IGRldGVybWluZSB0aGUgYnJhbmNoCisgICAgICAgIGlu c3RydWN0aW9uLCBhbmQgaXQgaXMgYWxzbyBwb3NzaWJsZSBpbiBzb21lIGNhc2VzIGZvciB0aGUg cHJvY2Vzc29yCisgICAgICAgIHRvIGVudGVyIGEgZGVhZGxvY2sgc3RhdGUuCisKKyAgICAgICAg KiBhc3NlbWJsZXIvQVJNdjdBc3NlbWJsZXIuaDoKKyAgICAgICAgKEpTQzo6QVJNdjdBc3NlbWJs ZXI6OmxpbmtKdW1wQWJzb2x1dGUpOgorCiAyMDEwLTA0LTI5ICBLd2FuZyBZdWwgU2VvICA8c2t5 dWxAY29tcGFueTEwMC5uZXQ+CiAKICAgICAgICAgUmV2aWV3ZWQgYnkgU2ltb24gSGF1c21hbm4u CmRpZmYgLS1naXQgYS9KYXZhU2NyaXB0Q29yZS9hc3NlbWJsZXIvQVJNdjdBc3NlbWJsZXIuaCBi L0phdmFTY3JpcHRDb3JlL2Fzc2VtYmxlci9BUk12N0Fzc2VtYmxlci5oCmluZGV4IDIxMjc5ZjUu LmY5MTBkMTUgMTAwNjQ0Ci0tLSBhL0phdmFTY3JpcHRDb3JlL2Fzc2VtYmxlci9BUk12N0Fzc2Vt Ymxlci5oCisrKyBiL0phdmFTY3JpcHRDb3JlL2Fzc2VtYmxlci9BUk12N0Fzc2VtYmxlci5oCkBA IC0xNzU0LDcgKzE3NTQsMjAgQEAgcHJpdmF0ZToKICAgICAgICAgICAgIHx8IChpc05PUF9UMShp bnN0cnVjdGlvbiAtIDUpICYmIGlzTk9QX1QyKGluc3RydWN0aW9uIC0gNCkgJiYgaXNCKGluc3Ry dWN0aW9uIC0gMikpICk7CiAKICAgICAgICAgaW50cHRyX3QgcmVsYXRpdmUgPSByZWludGVycHJl dF9jYXN0PGludHB0cl90Pih0YXJnZXQpIC0gKHJlaW50ZXJwcmV0X2Nhc3Q8aW50cHRyX3Q+KGlu c3RydWN0aW9uKSk7Ci0gICAgICAgIGlmICgoKHJlbGF0aXZlIDw8IDcpID4+IDcpID09IHJlbGF0 aXZlKSB7CisKKyAgICAgICAgLy8gRnJvbSBDb3J0ZXgtQTggZXJyYXRhOgorICAgICAgICAvLyBJ ZiB0aGUgMzItYml0IFRodW1iLTIgYnJhbmNoIGluc3RydWN0aW9uIHNwYW5zIHR3byA0S2lCIHJl Z2lvbnMgYW5kCisgICAgICAgIC8vIHRoZSB0YXJnZXQgb2YgdGhlIGJyYW5jaCBmYWxscyB3aXRo aW4gdGhlIGZpcnN0IHJlZ2lvbiBpdCBpcworICAgICAgICAvLyBwb3NzaWJsZSBmb3IgdGhlIHBy b2Nlc3NvciB0byBpbmNvcnJlY3RseSBkZXRlcm1pbmUgdGhlIGJyYW5jaAorICAgICAgICAvLyBp bnN0cnVjdGlvbiwgYW5kIGl0IGlzIGFsc28gcG9zc2libGUgaW4gc29tZSBjYXNlcyBmb3IgdGhl IHByb2Nlc3NvcgorICAgICAgICAvLyB0byBlbnRlciBhIGRlYWRsb2NrIHN0YXRlLgorICAgICAg ICAvLyBUaGUgaW5zdHJ1Y3Rpb24gaXMgc3Bhbm5pbmcgdHdvIHBhZ2VzIGlmIGl0IGVuZHMgYXQg YW4gYWRkcmVzcyBlbmRpbmcgMHgwMDIKKyAgICAgICAgYm9vbCBzcGFuc1R3bzRLID0gKChyZWlu dGVycHJldF9jYXN0PGludHB0cl90PihpbnN0cnVjdGlvbikgJiAweGZmZikgPT0gMHgwMDIpOwor ICAgICAgICAvLyBUaGUgdGFyZ2V0IGlzIGluIHRoZSBmaXJzdCBwYWdlIGlmIHRoZSBqdW1wIGJy YW5jaCBiYWNrIGJ5IFszLi4weDEwMDJdIGJ5dGVzCisgICAgICAgIGJvb2wgdGFyZ2V0SW5GaXJz dFBhZ2UgPSAocmVsYXRpdmUgPj0gLTB4MTAwMikgJiYgKHJlbGF0aXZlIDwgLTIpOworICAgICAg ICBib29sIHdvdWxkVHJpZ2dlckE4RXJyYXRhID0gc3BhbnNUd280SyAmJiB0YXJnZXRJbkZpcnN0 UGFnZTsKKworICAgICAgICBpZiAoKChyZWxhdGl2ZSA8PCA3KSA+PiA3KSA9PSByZWxhdGl2ZSAm JiAhd291bGRUcmlnZ2VyQThFcnJhdGEpIHsKICAgICAgICAgICAgIC8vIEFSTSBlbmNvZGluZyBm b3IgdGhlIHRvcCB0d28gYml0cyBiZWxvdyB0aGUgc2lnbiBiaXQgaXMgJ3BlY3VsaWFyJy4KICAg ICAgICAgICAgIGlmIChyZWxhdGl2ZSA+PSAwKQogICAgICAgICAgICAgICAgIHJlbGF0aXZlIF49 IDB4QzAwMDAwOwotLSAKMS41LjQuMwoK