Merge branch 'fix/dualcore_branch_predictor_cache_race' into 'master'

fix(spi_flash): disable branch prediction on the parked core during flash ops

See merge request espressif/esp-idf!50871

components/esp_hw_support/mspi/mspi_timing_tuning/mspi_timing_tuning.c

@@ -23,6 +23,7 @@
 #include "hal/cache_hal.h"
 #endif
 #include "esp_private/cache_utils.h"
+#include "esp_cpu.h"
 #include "esp_private/mspi_timing_tuning.h"
 #include "esp_private/mspi_timing_config.h"
 #include "esp_private/mspi_timing_by_mspi_delay.h"
@@ -646,8 +647,21 @@ static void restore_cache(uint32_t cpuid, uint32_t saved_state)
 }
 #else // ESP_TEE_BUILD
 
-#define disable_cache(cpuid, saved_state) spi_flash_disable_cache(cpuid, saved_state)
-#define restore_cache(cpuid, saved_state) spi_flash_restore_cache(cpuid, saved_state)
+static void disable_cache(uint32_t cpuid, uint32_t *saved_state)
+{
+#if SOC_BRANCH_PREDICTOR_SUPPORTED
+    esp_cpu_branch_prediction_disable();
+#endif
+    spi_flash_disable_cache(cpuid, saved_state);
+}
+
+static void restore_cache(uint32_t cpuid, uint32_t saved_state)
+{
+    spi_flash_restore_cache(cpuid, saved_state);
+#if SOC_BRANCH_PREDICTOR_SUPPORTED
+    esp_cpu_branch_prediction_enable();
+#endif
+}
 
 #endif
 

components/esp_hw_support/sleep_cache.c

@@ -31,6 +31,9 @@ void sleep_cache_suspend(void)
         // If the access to external memory hits in the cache, it will not trigger a cache error. So in order to
         // fully check the access to external memory, writeback & invalidate is needed here.
         Cache_WriteBack_Invalidate_All(CACHE_MAP_MASK);
+#endif
+#if SOC_BRANCH_PREDICTOR_SUPPORTED
+        esp_cpu_branch_prediction_disable();
 #endif
         spi_flash_disable_cache(esp_cpu_get_core_id(), &s_cache_state);
     }
@@ -43,6 +46,9 @@ void sleep_cache_resume(void)
     assert(s_cache_suspend_cnt >= 0 && DRAM_STR("cache resume doesn't match suspend ops"));
     if (s_cache_suspend_cnt == 0) {
         spi_flash_restore_cache(esp_cpu_get_core_id(), s_cache_state);
+#if SOC_BRANCH_PREDICTOR_SUPPORTED
+        esp_cpu_branch_prediction_enable();
+#endif
     }
 }
 

components/esp_rom/patches/esp_rom_spiflash.c

@@ -13,9 +13,6 @@
 #include "soc/spi_mem_reg.h"
 #endif
 
-#if SOC_BRANCH_PREDICTOR_SUPPORTED
-#include "riscv/rv_utils.h"
-#endif
 #include "esp_rom_spiflash.h"
 
 #define SPI_IDX   1
@@ -800,10 +797,6 @@ void esp_rom_spiflash_cache_mode_config(esp_rom_spiflash_read_mode_t mode, const
 extern void rom_spi_flash_disable_cache(uint32_t cpuid, uint32_t *saved_state);
 void spi_flash_disable_cache(uint32_t cpuid, uint32_t *saved_state)
 {
-#if SOC_BRANCH_PREDICTOR_SUPPORTED
-    //branch predictor will start cache request as well
-    rv_utils_dis_branch_predictor();
-#endif
     rom_spi_flash_disable_cache(cpuid, saved_state);
 }
 
@@ -811,8 +804,5 @@ extern void rom_spi_flash_restore_cache(uint32_t cpuid, uint32_t saved_state);
 void spi_flash_restore_cache(uint32_t cpuid, uint32_t saved_state)
 {
     rom_spi_flash_restore_cache(cpuid, saved_state);
-#if SOC_BRANCH_PREDICTOR_SUPPORTED
-    rv_utils_en_branch_predictor();
-#endif
 }
 #endif

components/esp_system/port/arch/riscv/esp_ipc_isr_routines.c

@@ -7,6 +7,7 @@
 #include "stdint.h"
 #include "soc/interrupt_reg.h"
 #include "soc/soc_caps.h"
+#include "esp_cpu.h"
 #include "esp_ipc_isr.h"
 #include "esp_private/esp_ipc_isr.h"
 #include "esp_private/esp_system_attr.h"
@@ -46,6 +47,15 @@ void ESP_SYSTEM_IRAM_ATTR esp_ipc_isr_record_interrupted_context(void)
 
 void ESP_SYSTEM_IRAM_ATTR esp_ipc_isr_waiting_for_finish_cmd(void* arg)
 {
+#if SOC_BRANCH_PREDICTOR_SUPPORTED
+    /* The branch predictor keeps issuing speculative instruction fetches while
+     * this core spins here. Callers of esp_ipc_isr_stall_other_cpu() may
+     * suspend the external memory cache during the stall (e.g. sleep flows
+     * powering down flash), in which case a speculative fetch into cached
+     * address space raises a cache access-fail interrupt. Keep the predictor
+     * disabled until the stall is released. */
+    esp_cpu_branch_prediction_disable();
+#endif
     esp_ipc_isr_stall_fl = 1;
     while (esp_ipc_isr_stall_args.cmd == ESP_IPC_ISR_CMD_RESET_STATE) {
         if (esp_ipc_isr_stall_args.func != NULL) {
@@ -53,4 +63,7 @@ void ESP_SYSTEM_IRAM_ATTR esp_ipc_isr_waiting_for_finish_cmd(void* arg)
             esp_ipc_isr_stall_args.func = NULL;
         }
     }
+#if SOC_BRANCH_PREDICTOR_SUPPORTED
+    esp_cpu_branch_prediction_enable();
+#endif
 }

components/esp_system/port/panic_handler.c

@@ -126,6 +126,15 @@ static void frame_to_panic_info(void *frame, panic_info_t *info, bool pseudo_exc
 FORCE_INLINE_ATTR __attribute__((__noreturn__))
 void busy_wait(void)
 {
+#if SOC_BRANCH_PREDICTOR_SUPPORTED
+    /* This core parks here while the offending core handles the panic, which
+     * may include flash accesses with the cache suspended (e.g. writing a core
+     * dump). Stop the branch predictor so its speculative fetches cannot latch
+     * spurious cache access-fail errors that would corrupt the cache error
+     * status of the panic being reported. This core never resumes, so the
+     * predictor is not re-enabled. */
+    esp_cpu_branch_prediction_disable();
+#endif
     ESP_INFINITE_LOOP();
 }
 #endif // !CONFIG_ESP_SYSTEM_SINGLE_CORE_MODE

components/spi_flash/cache_utils.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -30,6 +30,7 @@
 #include "esp_private/esp_ipc.h"
 #endif
 #include "esp_attr.h"
+#include "esp_cpu.h"
 #include "esp_memory_utils.h"
 #include "esp_intr_alloc.h"
 #include "esp_private/esp_cache_private.h"
@@ -87,6 +88,13 @@ void IRAM_ATTR spi_flash_op_block_func(void *arg)
     // Restore interrupts that aren't located in IRAM
     esp_intr_noniram_disable();
     uint32_t cpuid = (uint32_t) arg;
+#if SOC_BRANCH_PREDICTOR_SUPPORTED
+    /* The branch predictor issues speculative cache requests while this core
+     * spins in IRAM. The flash-op core is about to suspend the (shared) cache,
+     * so speculative fetches into flash would raise a cache access-fail on
+     * this core. */
+    esp_cpu_branch_prediction_disable();
+#endif
     // s_flash_op_complete flag is cleared on *this* CPU, otherwise the other
     // CPU may reset the flag back to false before IPC task has a chance to check it
     // (if it is preempted by an ISR taking non-trivial amount of time)
@@ -97,6 +105,9 @@ void IRAM_ATTR spi_flash_op_block_func(void *arg)
     }
     // Flash operation is complete, re-enable cache
     spi_flash_restore_cache(cpuid, s_flash_op_cache_state[cpuid]);
+#if SOC_BRANCH_PREDICTOR_SUPPORTED
+    esp_cpu_branch_prediction_enable();
+#endif
     // Restore interrupts that aren't located in IRAM
     esp_intr_noniram_enable();
 #if ( ( CONFIG_FREERTOS_SMP ) && ( !CONFIG_FREERTOS_UNICORE ) )
@@ -169,6 +180,9 @@ void IRAM_ATTR spi_flash_disable_interrupts_caches_and_other_cpu(void)
 
     // Kill interrupts that aren't located in IRAM
     esp_intr_noniram_disable();
+#if SOC_BRANCH_PREDICTOR_SUPPORTED
+    esp_cpu_branch_prediction_disable();
+#endif
     // This CPU executes this routine, with non-IRAM interrupts and the scheduler
     // disabled. The other CPU is spinning in the spi_flash_op_block_func task, also
     // with non-iram interrupts and the scheduler disabled. None of these CPUs will
@@ -205,6 +219,9 @@ void IRAM_ATTR spi_flash_enable_interrupts_caches_and_other_cpu(void)
         s_flash_op_complete = true;
     }
 
+#if SOC_BRANCH_PREDICTOR_SUPPORTED
+    esp_cpu_branch_prediction_enable();
+#endif
     // Re-enable non-iram interrupts
     esp_intr_noniram_enable();
 
@@ -231,6 +248,12 @@ void IRAM_ATTR spi_flash_disable_interrupts_caches_and_other_cpu_no_os(void)
     const uint32_t cpuid = xPortGetCoreID();
     const uint32_t other_cpuid = (cpuid == 0) ? 1 : 0;
 
+#if SOC_BRANCH_PREDICTOR_SUPPORTED
+    /* Disable BP before the first disable_cache(): on shared-cache chips that
+     * call suspends external memory for all cores, so speculative fetches must
+     * already be stopped. */
+    esp_cpu_branch_prediction_disable();
+#endif
     // do not care about other CPU, it was halted upon entering panic handler
     spi_flash_disable_cache(other_cpuid, &s_flash_op_cache_state[other_cpuid]);
     // Kill interrupts that aren't located in IRAM
@@ -245,6 +268,9 @@ void IRAM_ATTR spi_flash_enable_interrupts_caches_no_os(void)
 
     // Re-enable cache on this CPU
     spi_flash_restore_cache(cpuid, s_flash_op_cache_state[cpuid]);
+#if SOC_BRANCH_PREDICTOR_SUPPORTED
+    esp_cpu_branch_prediction_enable();
+#endif
     // Re-enable non-iram interrupts
     esp_intr_noniram_enable();
 }
@@ -284,12 +310,18 @@ void IRAM_ATTR spi_flash_disable_interrupts_caches_and_other_cpu(void)
 {
     spi_flash_op_lock();
     esp_intr_noniram_disable();
+#if SOC_BRANCH_PREDICTOR_SUPPORTED
+    esp_cpu_branch_prediction_disable();
+#endif
     spi_flash_disable_cache(0, &s_flash_op_cache_state[0]);
 }
 
 void IRAM_ATTR spi_flash_enable_interrupts_caches_and_other_cpu(void)
 {
     spi_flash_restore_cache(0, s_flash_op_cache_state[0]);
+#if SOC_BRANCH_PREDICTOR_SUPPORTED
+    esp_cpu_branch_prediction_enable();
+#endif
     esp_intr_noniram_enable();
     spi_flash_op_unlock();
 }
@@ -298,6 +330,9 @@ void IRAM_ATTR spi_flash_disable_interrupts_caches_and_other_cpu_no_os(void)
 {
     // Kill interrupts that aren't located in IRAM
     esp_intr_noniram_disable();
+#if SOC_BRANCH_PREDICTOR_SUPPORTED
+    esp_cpu_branch_prediction_disable();
+#endif
     // Disable cache on this CPU as well
     spi_flash_disable_cache(0, &s_flash_op_cache_state[0]);
 }
@@ -306,6 +341,9 @@ void IRAM_ATTR spi_flash_enable_interrupts_caches_no_os(void)
 {
     // Re-enable cache on this CPU
     spi_flash_restore_cache(0, s_flash_op_cache_state[0]);
+#if SOC_BRANCH_PREDICTOR_SUPPORTED
+    esp_cpu_branch_prediction_enable();
+#endif
     // Re-enable non-iram interrupts
     esp_intr_noniram_enable();
 }
@@ -328,19 +366,12 @@ void IRAM_ATTR spi_flash_enable_cache(uint32_t cpuid)
 #if !CONFIG_SPI_FLASH_ROM_IMPL
 void IRAM_ATTR spi_flash_disable_cache(uint32_t cpuid, uint32_t *saved_state)
 {
-#if SOC_BRANCH_PREDICTOR_SUPPORTED
-    //branch predictor will start cache request as well
-    esp_cpu_branch_prediction_disable();
-#endif
     esp_cache_suspend_ext_mem_cache();
 }
 
 void IRAM_ATTR spi_flash_restore_cache(uint32_t cpuid, uint32_t saved_state)
 {
     esp_cache_resume_ext_mem_cache();
-#if SOC_BRANCH_PREDICTOR_SUPPORTED
-    esp_cpu_branch_prediction_enable();
-#endif
 }
 
 bool IRAM_ATTR spi_flash_cache_enabled(void)

components/spi_flash/include/esp_private/cache_utils.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -97,7 +97,11 @@ bool spi_flash_cache_enabled(void);
 void spi_flash_enable_cache(uint32_t cpuid);
 
 /**
- * @brief Suspend the Cache access to external memory, will disable branch predictor if supported.
+ * @brief Suspend the Cache access to external memory.
+ *
+ * @note Callers must disable branch prediction around this window when
+ *       SOC_BRANCH_PREDICTOR_SUPPORTED, otherwise speculative fetches can
+ *       raise cache access-fail errors while the cache is suspended.
  *
  * @param cpuid       the core number to enable the cache for, meaning less on shared cache.
  * @param saved_state Cache status hold by hal (Used only on ROM impl. in idf, this param unused)
@@ -105,7 +109,10 @@ void spi_flash_enable_cache(uint32_t cpuid);
 void spi_flash_disable_cache(uint32_t cpuid, uint32_t *saved_state);
 
 /**
- * @brief Resume the Cache access to external memory, will enable branch predictor if supported.
+ * @brief Resume the Cache access to external memory.
+ *
+ * @note Callers that disabled branch prediction for the suspend window must
+ *       re-enable it after this call when SOC_BRANCH_PREDICTOR_SUPPORTED.
  *
  * @param cpuid       the core number to enable the cache for, meaning less on shared cache.
  * @param saved_state Cache status hold by hal (Used only on ROM impl. in idf, this param unused)