RFC riscv: support EIC770X/JH7110 noncoherent devices with XPbmtUC

SoCs with pre-Svpbmt Sifive cores, e.g., Starfive JH7110 and ESWIN EIC770X both have non cache-coherent peripherals. On JH7110[1], video subsystem (GPU/VOUT/VPU/ISP) is routed to the sys port, making them not cache-coherent. On EIC770X, all peripherals are routed to the sys port, and none is cache-coherent. Instead of Svpbmt, these SoCs map system memory twice -- the conventional cached region (through front port), and the uncached alias (through sys port) at different base addresses. The uncached alias implicitly applies the uncacheable PMA. Drivers working with noncoherent devices can utilize the uncache alias to map DMA buffers, without doing explicit cache flushes.

This feature is not an ISA standard, and the cache/uncache base can be configured by the SoC vendor. To expose it properly, introduce a Sifive "errata", namely "XPbmtUC", to model the setup as a customized version of Svpbmt. It choses a single, artificial bit in PTE at runtime for cache/uncache control, effectively offsetting the PPN by power-of-2. On JH7110, it aligns perfectly with the HW: it maps the cached region at 0x40000000, and the uncached alias at 0x4_40000000. Chosing bit 32 (PPN bit 34) as the UC bit matches HW exactly.

Starfive JH7110 (Sifive U74 core) memory map:

          [0x0,   0x40000000) Low MMIO

[0x40000000, 0x2_40000000) Cached Mem
[0x4_40000000, 0x6_40000000) Uncached Mem (UC+)
[0x9_00000000, 0x9_d0000000) High MMIO

On EIC770X, the aliased UC region is put to a offset not power-of-2. There can also be 2 NUMA node (dual-die) with 2 separate memory regions and their UC alias counterparts are offsetted differently. We detect if the firmware has the capability to re-arrange the memory map, using G-stage pagetable, making the the offsets power-of-2 again.

            [0x0,     0x20000000) Core Internal
     [0x20000000,     0x40000000) Core Internal (Die 1)
     [0x40000000,     0x60000000) Low MMIO
     [0x60000000,     0x80000000) Low MMIO (Die 1)
     [0x80000000,  0x10_80000000) Cached Mem
  [0x20_00000000,  0x30_00000000) Cached Mem (Die 1)
  [0x80_00000000,  0xa0_00000000) High MMIO
  [0xa0_00000000,  0xc0_00000000) High MMIO (Die 1)
  [0xc0_00000000,  0xd0_00000000) Uncached Mem <----------.
  [0xe0_00000000,  0xf0_00000000) Uncached Mem (Die 1) <--+--.
with firmware/hypervisor re-mapping:                      |  |
------------------------------------                      |  |
 [0x100_80000000, 0x110_80000000) Mem UC+ ----------------'  |

[0x120_00000000, 0x130_00000000) Mem UC+ (Die 1) -----------'

The "XPbmtUC" alternative PTE format is the cleanest solution I can think of to solve the non-coherent device enablement w/o Svpbmt from kernel side. Drivers can do explicit cache flushes to workaround the problem, but a. it pushes the burden of cache flushes to driver code, and we don't want to complicate them if it's already written with the cache coherent assumption in mind. b. complex drivers like GPU could allow user-space to mmap DMA pages, but userspace can't flush caches due to the lack of Zicbom on these SoCs. I'm aware there's an ongoing series[2] that Samuel sent for physical memory aliases, which is essentially a superset of my patch. I don't mean to step ahead of him, but try to find a middle ground if the community still worries about his change touching too many areas. My change is very minimal and local. It's fairly easy to remove, too.

----------------------------------------
Notes about PoC firmware implementation on EIC7700X[3]:

The OpenSBI is augmented to provide a very thin layer hypervisor, where it runs the entire host OS in VS-mode, and provide the aforementioned remapping. I remap UC+ memory to 2^40+ to make the 2-stage translation efficient, where I can utilize Sv39x4 G-stage scheme to map the entire physical address space at bottom-half, and the uncache counterparts to system memory at top-half. I also make use of the largest page in Sv39 -- 1GB page, to map everything, keeping the G-stage page-table minimal, only 16KB in size, while also minimizing TLB misses. A very slight, unavoidable, slow down is with the external interrupt delivery. Due to the lack of AIA in EIC770X, all device irq now needs to trap to M mode first, before forwarding to VS mode. The overhead of running KVM in such setup is yet unknown, and may well be noticeable. All HS-qualified instructions will trap to M mode, which is costly. The NACL extension, if implemented, will alleviate it, but there's also the extra cost of flushing G/VS-stage TLBs. I'm analyzing it in parallel.

Use [4] if you have a Hifive Premier P550 to try it out.

[1] https://github.com/starfive-tech/JH7100_Docs/blob/main/JH7100%20Cache%20Coherence%20V1.0.pdf
[2] https://lore.kernel.org/all/[email protected]/
[3] https://github.com/ganboing/opensbi/tree/eic77x-vspt-physalias-wip
[4] https://github.com/ganboing/linux-eic77/tree/ganboing-xpbmt-uc-v2-eic77-clk-v15

---
v2:
- Move the core logic to Sifive errata to address Conor's comments

v1: https://lore.kernel.org/linux-riscv/[email protected]

Bo Gan (3):
riscv: alternatives: support auipc+load pair
riscv: errata: sifive: support auipc/load pair in patched alternatives
riscv: errata: sifive: Add an "errata" to simulate Svpbmt on cores
without

 arch/riscv/Kconfig.errata                    | 13 ++++
 arch/riscv/errata/sifive/errata.c            | 80 +++++++++++++++++++-
 arch/riscv/include/asm/errata_list.h         | 19 ++++-
 arch/riscv/include/asm/errata_list_vendors.h |  3 +-
 arch/riscv/include/asm/insn.h                |  8 ++
 arch/riscv/include/asm/pgtable-64.h          |  9 ++-
 arch/riscv/kernel/alternative.c              | 11 +--
 7 files changed, 132 insertions(+), 11 deletions(-)

2.34.1