[Bug 296730] No mitigation for Cortex-A53 843419?

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D296730

            Bug ID: 296730
           Summary: No mitigation for Cortex-A53 843419?
           Product: Base System
           Version: 15.1-STABLE
          Hardware: arm64
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: arm
          Assignee: [email protected]
          Reporter: [email protected]

I have recently upgraded Raspberry Pi 3B to 15.1 p1 (used freebsd-upgrade, =
was
running 15.0 before). Immediately after upgrade I noticed random SIGSEGV in
seemingly random binaries. Witnessed problems with both base system (e.g. t=
op,
inetd) and packages (zsh, isc-dhcpd). SIGSEGV is not deterministic - may run
for quite some time before failing. Noticed that holding spacebar in top (to
force frequent refres) reliably produced fault after a short time. Analyzed
cores for top and zsh and both crashed at the same location:

#0  0x000045001a93c004 in __get_locale () at
/usr/src/lib/libc/stdio/vsprintf.c:52

In a live gdb session after SIGSEGV:

(gdb) p $_siginfo
$3 =3D {si_signo =3D 11, si_errno =3D 0, si_code =3D 2, si_pid =3D 0, si_ui=
d =3D 0,
si_status =3D 0,
  si_addr =3D 0x4057d220, si_value =3D {sival_int =3D 0, sival_ptr =3D 0x0}=
, _reason =3D
{_fault =3D {
      si_trapno =3D 36}, _timer =3D {si_timerid =3D 36, si_overrun =3D 0}, =
_mesgq =3D
{si_mqd =3D 36},
    _poll =3D {si_band =3D 36}, __spare__ =3D {__spare1__ =3D 36, __spare2_=
_ =3D {0, 0,
0, 0, 0, 0, 0}}}}

Fault address si_addr =3D 0x4057d220

Data access triggered fault, not code location:
(gdb) p/x $pc
$4 =3D 0x404b8004

Surrounding code:
(gdb) x/6i $pc-12
   0x404b7ff8 <vsprintf+152>:   adrp    x9, 0x4057c000
   0x404b7ffc <vsprintf+156>:   stur    q0, [sp, #104]
   0x404b8000 <vsprintf+160>:   cmp     x10, #0x0
=3D> 0x404b8004 <vsprintf+164>:   ldr     x9, [x9, #544]
   0x404b8008 <vsprintf+168>:   ccmp    w8, #0x0, #0x4, ne      // ne =3D a=
ny
   0x404b800c <vsprintf+172>:   mov     w8, #0xffff                     //
#65535

Registers
(gdb) info registers
[skip]
x9             0x4057c000          1079492608
[skip]

"ldr     x9, [x9, #544]" was supposed to read from 0x4057c000+0x220 but fau=
lt
is at 0x4057d220 - exactly 0x1000 more.

I suppose I'm being hit by Cortex-A53 erratum 843419 (A load or store might
access an incorrect address - see
https://developer.arm.com/documentation/epm048406/latest). My CPU revision =
is
r0p4 which is affected and I think assembly code matches description of the
defect:

I must admit I'm not 100% sure I fully understand conditions described in t=
he
errata document but I think the code above may match one of affected
instruction sequences.

I have rebuilt world with `LDFLAGS+=3D     -Wl,--fix-cortex-a53-843419` and
installed libc from that build. I no longer observe SIGSEGV.

Would it be correct to assume that 15.1 Release was built without 843419
mitigation? If so was this intentional? I can see
https://www.freebsd.org/releases/15.1R/hardware/ lists "Raspberry Pi 3" as
supported so it is probably not intentional as frankly 15.1 release build is
barely usable on Pi 3B. Would you please consider adding
`--fix-cortex-a53-843419` to release build for arm64?

Here's what I did:

% cat /etc/make.conf
.if ${MACHINE_ARCH} =3D=3D "aarch64"
CFLAGS+=3D        ${MACHINE_ARCH:Maarch64:S/^aarch64$/-mfix-cortex-a53-8357=
69/}
CXXFLAGS+=3D      ${MACHINE_ARCH:Maarch64:S/^aarch64$/-mfix-cortex-a53-8357=
69/}
LDFLAGS+=3D=20=20=20=20=20=20
${MACHINE_ARCH:Maarch64:S/^aarch64$/-Wl,--fix-cortex-a53-843419/}
.endif

Did it this way because of 32-bit compatibility libraries where
--fix-cortex-a53-843419 is not supported. This was on amd64 box used to
cross-build the world for arm64 (make -j$(sysctl -n hw.ncpu) TARGET=3Darm64
TARGET_ARCH=3Daarch64 buildworld).

I haven't checked but the same problem may also be affecting packages.

--=20
You are receiving this mail because:
You are the assignee for the bug.=