Single-instruction wedge

[stepleton]

Today in general chat discussion I thought I'd ask around to see if people were aware of interesting ways to get a computer to hang (or at least get stuck for a good long while) with a single instruction. This was inspired by @tomjennings 's post here which details how Novas can get stuck in an infinite loop of indirect jumps if the contents of RAM at jump destinations are set up in the right way. (I'm willing to be a bit liberal about "single instruction" and not count the code you'd need to set up the memory that allows the instruction to have this effect.)

Here's my favourite. Transputer ICs have a shift instructions but they (a) have no barrel shifter for integer ops, (b) do not range-check the shift argument, and (c) permit the shift argument to be word-size. On a 32-bit transputer, you can specify a 32-bit shift argument, which the CPU will faithfully count down as it shifts the contents of the B register one position at a time. An argument of 2^31 - 1 will keep a transputer locked up for "3 to 4 minutes" per this text.

Notes:

• HALT instructions are boring, not interesting, and don't count.
• Tight loops by jumping to the current instruction are also boring. Ideally the processor should read the instruction only once and get stuck executing it.
• Waiting on an absent peripheral could be boring but maybe there are nifty exceptions.
• If the processor has a supervisor mode or equivalent, please note whether it's required for the wedge instruction to work.
• Things that are clearly "bugs" like the Pentium F00F bug are potentially less interesting than situations where the hang is "baked in" by the ISA's design; the Nova indirect jump looping is a good example of the processor working exactly as specified but still hanging.

Here's hoping for some fun stories...

 

[Ruud]

The original 6502 and the 6510 (C64) have several illegal instructions. IIRC $FF stops the processor completely.

 

[Uniballer]

MC6800 opcodes 0x9D and 0xDD will cause the CPU to stop executing instructions and read consecutive addresses until reset (HCF = Halt & Catch Fire)

If the first instruction at the address pointed to by the SWI vector is SWI (opcode 0x3f) then the stack will write crap through all of RAM. Fun, but doesn't meet your criteria as well as HCF.

 

[syzygy]

In the 8048 series, there is the instruction,

SEL MBl - Select Bank 1 (locations 2048 - 4095) of Program Memory.

After execution and a JMP or CALL, This will set address bit A11 causing all subsequent programming fetches to, potentially, uses non-existing memory.

 

[dreNorteR]

On the 8086, there was no instruction length limit, so a 64K segment filled with nothing but prefixes would result in an infinitely long instruction that never completed fetching and couldn't be interrupted. Same on the 186, but IIRC it doesn't wrap around when fetching.

With 32-bit x86, the page fault and task switch mechanism can be used to create an endless loop, and even a Turing-complete "weird machine" that does decrement-and-branch-if-zero without executing a single instruction:

https://www.usenix.org/system/files/conference/woot13/woot13-bangert.pdf

The trick of using task switch to overwrite a GDT entry would work on the 286 too, but I think the page fault is needed to prevent a triple fault shutdown.

 

[MiaM]

The original 6502 and the 6510 (C64) have several illegal instructions. IIRC $FF stops the processor completely.

Side track fun fact: At least on the older 2 prong power connector version of the PAL VIC 20, the screen turns slightly bluer when this happens!