Skip to contentSkip to conversation

MIPS: c-r4k: Flush the cache error vector before writing it uncached

PATCH Superseded Imre Kaloz 2 participants 2 messages Oct 21 – Oct 22

Subsystems (2)
Stable branch MIPS

v1 of 3 Superseded Latest is v3 →

lore
Share & tools
lore

Imre Kaloz

author
#0 lore raw

PATCH 1/1 MIPS: c-r4k: Flush the cache error vector before writing it uncached

On R10000-class CPUs, a store prefetch while copying the preceding vector can leave a dirty line whose write-back overwrites the uncached cache error handler. Flush it first in r4k_cache_error_setup() with r4k_dma_cache_wback_inv(), as dma_cache_wback_inv() is a no-op on coherent systems.

Fixes e01402b115cc ("More AP / SP bits for the 34K, the Malta bits and things. Still wants a little polishing.")
Cc [email protected]
Signed-off-by Imre Kaloz <[email protected]>
---
 arch/mips/mm/c-r4k.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)
arch/mips/mm/c-r4k.c +10 -2
index d8aadd3dc057..ae31966ac65b 100644
@@ -743,8 +743,6 @@ static void r4k_flush_icache_user_range(unsigned long start, unsigned long end)
 	return __r4k_flush_icache_range(start, end, true);
 }
 
-#ifdef CONFIG_DMA_NONCOHERENT
-
 static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size)
 {
 	/* Catch bad driver code */

@@ -786,6 +784,8 @@ static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size)
 	__sync();
 }
 
+#ifdef CONFIG_DMA_NONCOHERENT
+
 static void prefetch_cache_inv(unsigned long addr, unsigned long size)
 {
 	unsigned int linesz = cpu_scache_line_size();

@@ -1684,6 +1684,14 @@ static void r4k_cache_error_setup(void)
 	extern char __weak except_vec2_generic;
 	extern char __weak except_vec2_sb1;
 
+	/*
+	 * The handler is written uncached. Copying the preceding vector
+	 * may have left a dirty cached line of it behind, through a store
+	 * prefetch or a speculative store; write it back and invalidate it
+	 * first, or its later write-back overwrites the handler.
+	 */
+	r4k_dma_cache_wback_inv(ebase + 0x100, 0x80);
+
 	switch (current_cpu_type()) {
 	case CPU_SB1:
 	case CPU_SB1A:

base-commit: 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907

#1 lore raw
Quoted 7 lines · Imre Kaloz

On R10000-class CPUs, a store prefetch while copying the preceding vector can leave a dirty line whose write-back overwrites the uncached cache error handler. Flush it first in r4k_cache_error_setup() with r4k_dma_cache_wback_inv(), as dma_cache_wback_inv() is a no-op on coherent systems.

Fixes e01402b115cc ("More AP / SP bits for the 34K, the Malta bits and things. Still wants a little polishing.")

This is surely not the right commit to pick, as that was merely code
refactoring and the issue existed before it.

Quoted 6 lines
arch/mips/mm/c-r4k.c +0 -0
index d8aadd3dc057..ae31966ac65b 100644
@@ -1684,6 +1684,14 @@ static void r4k_cache_error_setup(void)
 	extern char __weak except_vec2_generic;

arch/mips/mm/c-r4k.c static void r4k_cache_error_setup(void) · line 1694

Quoted 10 lines
arch/mips/mm/c-r4k.c +8 -0
 	extern char __weak except_vec2_sb1;
 
+	/*
+	 * The handler is written uncached. Copying the preceding vector
+	 * may have left a dirty cached line of it behind, through a store
+	 * prefetch or a speculative store; write it back and invalidate it
+	 * first, or its later write-back overwrites the handler.
+	 */
+	r4k_dma_cache_wback_inv(ebase + 0x100, 0x80);
+

Conceptually this seems right to me, however I think the call ought to be
moved into set_uncached_handler() itself. Also since you're repurposing a DMA handler, which the removal of CONFIG_DMA_NONCOHERENT wrapping makes so obvious, this asks for the function to be renamed.

Thank you for your submission overall.

Maciej