O3: Fix an issue with a load & branch instruction and mem dep squashing

Instructions that load an address and are control instructions can
execute down the wrong path if they were predicted correctly and then
instructions following them are squashed. If an instruction is a
memory and control op use the predicted address for the next PC instead
of just advancing the PC. Without this change NPC is used for the next
instruction, but predPC is used to verify that the branch was successful
so the wrong path is silently executed.

diff --git a/src/cpu/o3/iew_impl.hh b/src/cpu/o3/iew_impl.hh
index 23f551ee37c673bdbf411a00898e59e4e96df84a..3bdf1f28d834c7a0a2756b86343763b16a7c294e 100644 (file)
--- a/src/cpu/o3/iew_impl.hh
+++ b/src/cpu/o3/iew_impl.hh
@@ -485,8 +485,16 @@ DefaultIEW<Impl>::squashDueToMemOrder(DynInstPtr &inst, ThreadID tid)
             inst->seqNum < toCommit->squashedSeqNum[tid]) {
         toCommit->squash[tid] = true;
         toCommit->squashedSeqNum[tid] = inst->seqNum;
-        TheISA::PCState pc = inst->pcState();
-        TheISA::advancePC(pc, inst->staticInst);
+        TheISA::PCState pc;
+        if (inst->isMemRef() && inst->isIndirectCtrl()) {
+            // If an operation is a control operation as well as a memory
+            // reference we need to use the predicted PC, not the PC+N
+            // This instruction will verify misprediction based on predPC
+            pc = inst->readPredTarg();
+        } else {
+            pc = inst->pcState();
+            TheISA::advancePC(pc, inst->staticInst);
+        }
         toCommit->pc[tid] = pc;
         toCommit->mispredictInst[tid] = NULL;