Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Fri, 27 Aug 2021 01:04:36 +1000
From:   Nicholas Piggin <npiggin@gmail.com>
Subject: Re: [PATCH v2 1/2] powerpc/bug: Remove specific powerpc BUG_ON() and
 WARN_ON() on PPC32
To:     Segher Boessenkool <segher@kernel.crashing.org>
Cc:     Benjamin Herrenschmidt <benh@kernel.crashing.org>,
        Christophe Leroy <christophe.leroy@csgroup.eu>,
        linux-kernel@vger.kernel.org, linuxppc-dev@lists.ozlabs.org,
        Michael Ellerman <mpe@ellerman.id.au>,
        Paul Mackerras <paulus@samba.org>
References: <b286e07fb771a664b631cd07a40b09c06f26e64b.1618331881.git.christophe.leroy@csgroup.eu>
        <1628834356.pr4zgn1xf1.astroid@bobo.none>
        <20210818150653.GJ1583@gate.crashing.org>
        <1629946707.f6ptz0tgle.astroid@bobo.none>
        <20210826124901.GY1583@gate.crashing.org>
        <1629983260.5jkx2jf0y8.astroid@bobo.none>
        <20210826143708.GC1583@gate.crashing.org>
In-Reply-To: <20210826143708.GC1583@gate.crashing.org>
MIME-Version: 1.0
Message-Id: <1629989540.drlhb24t2w.astroid@bobo.none>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

Excerpts from Segher Boessenkool's message of August 27, 2021 12:37 am:
> On Thu, Aug 26, 2021 at 11:57:52PM +1000, Nicholas Piggin wrote:
>> Excerpts from Segher Boessenkool's message of August 26, 2021 10:49 pm:
>> > On Thu, Aug 26, 2021 at 01:26:14PM +1000, Nicholas Piggin wrote:
>> >> Excerpts from Segher Boessenkool's message of August 19, 2021 1:06 am=
:
>> >> > On Fri, Aug 13, 2021 at 04:08:13PM +1000, Nicholas Piggin wrote:
>> >> >> This one possibly the branches end up in predictors, whereas condi=
tional=20
>> >> >> trap is always just speculated not to hit. Branches may also have =
a
>> >> >> throughput limit on execution whereas trap could be more (1 per cy=
cle
>> >> >> vs 4 per cycle on POWER9).
>> >> >=20
>> >> > I thought only *taken* branches are just one per cycle?
>> >>=20
>> >> Taken branches are fetched by the front end at one per cycle (assumin=
g=20
>> >> they hit the BTAC), but all branches have to be executed by BR at one=
=20
>> >> per cycle
>> >=20
>> > This is not true.  (Simple) predicted not-taken conditional branches a=
re
>> > just folded out, never hit the issue queues.  And they are fetched as
>> > many together as fit in a fetch group, can complete without limits as
>> > well.
>>=20
>> No, they are all dispatched and issue to the BRU for execution. It's=20
>> trivial to construct a test of a lot of not taken branches in a row
>> and time a loop of it to see it executes at 1 cycle per branch.
>=20
> (s/dispatched/issued/)

?

>=20
> Huh, this was true on p8 already.  Sorry for my confusion.  In my
> defence, this doesn't matter for performance on "real code".
>=20
>> > Correctly predicted simple conditional branches just get their predict=
ion
>> > validated (and that is not done in the execution units).  Incorrectly
>> > predicted branches the same, but those cause a redirect and refetch.
>>=20
>> How could it validate prediction without issuing? It wouldn't know when
>> sources are ready.
>=20
> In the backend.  But that is just how it worked on older cores :-/

Okay. I don't know about older cores than POWER9. Backend would normally=20
include execution though. Only other place you could do it if you don't
issue/exec would be after it goes back in order, like completion. But
that would be horrible for mispredict penalty.

>> >> The first problem seems like the show stopper though. AFAIKS it would=
=20
>> >> need a special builtin support that does something to create the tabl=
e
>> >> entry, or a guarantee that we could put an inline asm right after the
>> >> builtin as a recognized pattern and that would give us the instructio=
n
>> >> following the trap.
>> >=20
>> > I'm not quite sure what this means.  Can't you always just put a
>> >=20
>> > bla:	asm("");
>> >=20
>> > in there, and use the address of "bla"?
>>=20
>> Not AFAIKS. Put it where?
>=20
> After wherever you want to know the address after.  You will have to
> make sure they stay together somehow.

I still don't follow.

> It is much easier to get the address of something, not the address after
> it.  If you know it is just one insn anyway, that isn't hard to handle
> either (even if prefixed insns exist).
>=20
>> > If not, you need to say a lot
>> > more about what you actually want to do :-/
>>=20
>> We need to put the address (or relative offset) of the trap instruction
>> into an entry in a different section. Basically this:
>>=20
>>    __builtin_trap();
>>    asm ("1:                               \n\t"
>>         "    .section __bug_table,\"aw\"  \n\t"
>>         "2:  .4byte 1b - 2b - 4           \n\t"
>>         "    .previous");
>>=20
>> Where the 1: label must follow immediately after the trap instruction,=20
>> and where the asm must be emitted even for the case of no-return traps=20
>> (but anything following the asm could be omitted).
>=20
> The address *after* the trap insn?  That is much much harder than the
> address *of* the trap insn.

No the address of the trap instruction, hence the -4. I have the label
after because that is the semantics I have from inline asm.

If you could give a built in that put a label at the address of the trap=20
instruction that could be used later by inline asm then that could work
too:

    __builtin_labeled_trap("1:");
    asm ("    .section __bug_table,\"aw\"  \n\t"
         "2:  .4byte 1b - 2b               \n\t"
         "    .previous");