V4 core speculative execution?

--0016e6d9a0f56ebdf70467868e2e
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

I am having a problem with code that works on 68K and V3 Coldfires not
working on V4. I find it hard to believe, but it looks like the V4 core
partially executes code that is branched around. Here is a distilled example
of the sort of code that fails, not pretty but I think it is valid C: -

typedef void (*f_ty)(void);         // a function pointer

// A union of an integer and a pointer, initialised to an integer that is
not a valid address
union {
    int x;
    f_ty  f;
} p = { 0x55555555 };

// This is the sort of sequence that fails
{
       dword d = p.x;
        f_ty f = p.f;
        if(d != 0x55555555)
             f();
 }

This compiles to: -

     movea.l  _p,a0
     cmpa.l  #0x55555555
     beq.s    skip
     jsr       (a0)
skip

So a0 should contain all 5's, which is not a valid address in my map, but
the branch should prevent it being used as an address. What actually
happends seems to depend on the code alignment, etc.

It can simply run past the code OK.

It can give an XLB interrupt with 55555554 in the address capture register.

It can lock up the processor. When I hit break in my BDM debugger the PC is
a couple of instructions past this block.

If I set a breakpoint anywhere in the program the code runs OK, regardless
of whether the breakpoint is triggered.

So it looks like the core sometimes does a pre-fetch on 55555555, even
though it will not be executed. My questions are: -

Is this a known bug/feature in the V4 core?
Why does it sometimes lock the processor rather than giving an XLB
interrupt.
Why does having a breakpoint active make it work?
Is that a workaround or do I have to find all the places in my code that
this could happen an insert NOPs or something. A complete nightmare because
I have a whole state machien architecture that relies on being able to
contain addresses and some flags in the same 32 bit value!

Chris

--0016e6d9a0f56ebdf70467868e2e
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

I am having a problem with code that works on 68K and V3 Coldfires not work=
ing on V4. I find it hard to believe, but it looks like the V4 core partial=
ly executes code that is branched around. Here is a distilled example of th=
e sort of code that fails, not pretty but I think it is valid C: -<br>

<br>typedef void (*f_ty)(void);=A0=A0=A0=A0=A0=A0=A0=A0 // a function point=
er<br><br>// A union of an integer and a pointer, initialised to an integer=
 that is not a valid address <br>union {<br>=A0=A0=A0 int x;<br>=A0=A0=A0 f=
_ty=A0 f;<br>} p =3D { 0x55555555 }; <br>

<br>// This is the sort of sequence that fails<br> {<br>=A0=A0=A0=A0=A0=A0 =
dword d =3D p.x;<br>=A0=A0=A0=A0=A0=A0=A0 f_ty f =3D p.f;<br>=A0=A0=A0=A0=
=A0=A0=A0 if(d !=3D 0x55555555)<br>=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 f()=
;<br>=A0}<br><br>This compiles to: -<br><br>=A0=A0=A0=A0 movea.l=A0 _p,a0<b=
r>=A0=A0=A0=A0 cmpa.l=A0 #0x55555555<br>
=A0=A0=A0=A0 beq.s=A0=A0=A0 skip<br>=A0=A0=A0=A0 jsr=A0=A0=A0=A0=A0=A0 (a0)=
<br>skip<br><br>So a0 should contain all 5&#39;s, which is not a valid addr=
ess in my map, but the branch should prevent it being used as an address. W=
hat actually happends seems to depend on the code alignment, etc.<br>
<br>It can simply run past the code OK.<br><br>It can give an XLB interrupt=
 with 55555554 in the address capture register.<br><br>It can lock up the p=
rocessor. When I hit break in my BDM debugger the PC is a couple of instruc=
tions past this block.<br>
<br>If I set a breakpoint anywhere in the program the code runs OK, regardl=
ess of whether the breakpoint is triggered.<br><br>So it looks like the cor=
e sometimes does a pre-fetch on 55555555, even though it will not be execut=
ed. My questions are: -<br>
<br>Is this a known bug/feature in the V4 core? <br>Why does it sometimes l=
ock the processor rather than giving an XLB interrupt.<br>Why does having a=
 breakpoint active make it work?<br>Is that a workaround or do I have to fi=
nd all the places in my code that this could happen an insert NOPs or somet=
hing. A complete nightmare because I have a whole state machien architectur=
e that relies on being able to contain addresses and some flags in the same=
 32 bit value!<br>
<br>Chris<br><br><br>

[email protected]=09Send a post to the list.
[email protected]=09Join the list.
[email protected]=09Join the list in digest mode.
[email protected]=09Leave the list.
--0016e6d9a0f56ebdf70467868e2e--