Received: by 2002:a25:824b:0:0:0:0:0 with SMTP id d11csp1193495ybn; Wed, 2 Oct 2019 12:14:03 -0700 (PDT) X-Google-Smtp-Source: APXvYqyBMBn+GK9k6SCeB/FPD4Z0zSLbI6s6saWyp6mCqovOHEZBDSi63y/7zeWbei7f/0Pnjjr4 X-Received: by 2002:a50:884c:: with SMTP id c12mr5581431edc.134.1570043642992; Wed, 02 Oct 2019 12:14:02 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1570043642; cv=none; d=google.com; s=arc-20160816; b=rhk+djpGr84WJ5yyqsmqlJZx5fN72on60wmiwdnL0HUymXGff89fmGXVOM+NuvQ8Ti u44vwFZbrrjRA4uhRTK2Qy91zYR5VZ9/ia7YN4hWqTEJUrP5E1/ngv0Lj4EeNtTdVBPR rwna/empURzIrbGXajWpKOMfJZ3zswKb++QqL8avszivyuiMlqfcFrMB6j+55CgEjEG4 tet+Ba/xK/oIMmS4xQpq9F8MPggwp4CWaxCFASc9FuuG/wsBv2K7y1tB/9ACxME2pbxy /qHj6Gx7E4ywUS3P+8NwXw6JJ4IEihqeuKYt3Nlu/2BmygAUmuOoRpRHrHovylXi3zch d17w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:in-reply-to:subject:message-id:date:cc:to :from:mime-version:content-transfer-encoding:content-disposition; bh=UGp2P3SIWIP1nwpTfAFfjeYMjznucoLqnk4WWrPfMbk=; b=AgzdLBA7nflYJri0KgNyDs/2gPtxkWnewCC5dnZhbQm1rhMMXKA1kjd1esM0wftC0L E7UH4itlC8pOssJFTbdPljAcKYB00H2hAHOpqtupXQ5V2lvjYwnX2Uh42eRecXZk3+1T lKc/EDZOHUcCifPVrkhYMTpxvgFWbkK96CuyhZFRvM4cOxZslHqo4i+CheYipeH9IVV1 xCcGJWWIhttVAPbSRkRIQRoR9zSJevg9JMPPBVMUQMMq8iB5jKyrQ6274PPRwmDfJP4B GyJdDz0kd32H00tpajEAtVkzM5o51JYwMsPiCbFdTS4dn9FD204EjSFWH4iijWEPsc/b yAXw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id m1si14704eji.86.2019.10.02.12.13.38; Wed, 02 Oct 2019 12:14:02 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729913AbfJBTKq (ORCPT + 99 others); Wed, 2 Oct 2019 15:10:46 -0400 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:35834 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729310AbfJBTIQ (ORCPT ); Wed, 2 Oct 2019 15:08:16 -0400 Received: from [192.168.4.242] (helo=deadeye) by shadbolt.decadent.org.uk with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.89) (envelope-from ) id 1iFjyu-00036B-RT; Wed, 02 Oct 2019 20:08:12 +0100 Received: from ben by deadeye with local (Exim 4.92.1) (envelope-from ) id 1iFjyq-0003g3-2a; Wed, 02 Oct 2019 20:08:08 +0100 Content-Type: text/plain; charset="UTF-8" Content-Disposition: inline Content-Transfer-Encoding: 8bit MIME-Version: 1.0 From: Ben Hutchings To: linux-kernel@vger.kernel.org, stable@vger.kernel.org CC: akpm@linux-foundation.org, Denis Kirjanov , "Paul Burton" , linux-mips@vger.kernel.org, "Dmitry Korotin" Date: Wed, 02 Oct 2019 20:06:51 +0100 Message-ID: X-Mailer: LinuxStableQueue (scripts by bwh) X-Patchwork-Hint: ignore Subject: [PATCH 3.16 77/87] MIPS: Add missing EHB in mtc0 -> mfc0 sequence. In-Reply-To: X-SA-Exim-Connect-IP: 192.168.4.242 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.16.75-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: Dmitry Korotin commit 0b24cae4d535045f4c9e177aa228d4e97bad212c upstream. Add a missing EHB (Execution Hazard Barrier) in mtc0 -> mfc0 sequence. Without this execution hazard barrier it's possible for the value read back from the KScratch register to be the value from before the mtc0. Reproducible on P5600 & P6600. The hazard is documented in the MIPS Architecture Reference Manual Vol. III: MIPS32/microMIPS32 Privileged Resource Architecture (MD00088), rev 6.03 table 8.1 which includes: Producer | Consumer | Hazard ----------|----------|---------------------------- mtc0 | mfc0 | any coprocessor 0 register Signed-off-by: Dmitry Korotin [paul.burton@mips.com: - Commit message tweaks. - Add Fixes tags. - Mark for stable back to v3.15 where P5600 support was introduced.] Signed-off-by: Paul Burton Fixes: 3d8bfdd03072 ("MIPS: Use C0_KScratch (if present) to hold PGD pointer.") Fixes: 829dcc0a956a ("MIPS: Add MIPS P5600 probe support") Cc: linux-mips@vger.kernel.org [bwh: Backported to 3.16: adjust context] Signed-off-by: Ben Hutchings --- arch/mips/mm/tlbex.c | 29 ++++++++++++++++++++--------- 1 file changed, 20 insertions(+), 9 deletions(-) --- a/arch/mips/mm/tlbex.c +++ b/arch/mips/mm/tlbex.c @@ -374,6 +374,7 @@ static struct work_registers build_get_w static void build_restore_work_registers(u32 **p) { if (scratch_reg >= 0) { + uasm_i_ehb(p); UASM_i_MFC0(p, 1, c0_kscratch(), scratch_reg); return; } @@ -665,10 +666,12 @@ static void build_restore_pagemask(u32 * uasm_i_mtc0(p, 0, C0_PAGEMASK); uasm_il_b(p, r, lid); } - if (scratch_reg >= 0) + if (scratch_reg >= 0) { + uasm_i_ehb(p); UASM_i_MFC0(p, 1, c0_kscratch(), scratch_reg); - else + } else { UASM_i_LW(p, 1, scratchpad_offset(0), 0); + } } else { /* Reset default page size */ if (PM_DEFAULT_MASK >> 16) { @@ -906,10 +909,12 @@ build_get_pgd_vmalloc64(u32 **p, struct uasm_i_jr(p, ptr); if (mode == refill_scratch) { - if (scratch_reg >= 0) + if (scratch_reg >= 0) { + uasm_i_ehb(p); UASM_i_MFC0(p, 1, c0_kscratch(), scratch_reg); - else + } else { UASM_i_LW(p, 1, scratchpad_offset(0), 0); + } } else { uasm_i_nop(p); } @@ -1215,6 +1220,7 @@ build_fast_tlb_refill_handler (u32 **p, UASM_i_MTC0(p, odd, C0_ENTRYLO1); /* load it */ if (c0_scratch_reg >= 0) { + uasm_i_ehb(p); UASM_i_MFC0(p, scratch, c0_kscratch(), c0_scratch_reg); build_tlb_write_entry(p, l, r, tlb_random); uasm_l_leave(l, *p); @@ -1466,12 +1472,14 @@ static void build_setup_pgd(void) uasm_i_dinsm(&p, a0, 0, 29, 64 - 29); uasm_l_tlbl_goaround1(&l, p); UASM_i_SLL(&p, a0, a0, 11); - uasm_i_jr(&p, 31); UASM_i_MTC0(&p, a0, C0_CONTEXT); + uasm_i_jr(&p, 31); + uasm_i_ehb(&p); } else { /* PGD in c0_KScratch */ - uasm_i_jr(&p, 31); UASM_i_MTC0(&p, a0, c0_kscratch(), pgd_reg); + uasm_i_jr(&p, 31); + uasm_i_ehb(&p); } #else #ifdef CONFIG_SMP @@ -1485,13 +1493,16 @@ static void build_setup_pgd(void) UASM_i_LA_mostly(&p, a2, pgdc); UASM_i_SW(&p, a0, uasm_rel_lo(pgdc), a2); #endif /* SMP */ - uasm_i_jr(&p, 31); /* if pgd_reg is allocated, save PGD also to scratch register */ - if (pgd_reg != -1) + if (pgd_reg != -1) { UASM_i_MTC0(&p, a0, c0_kscratch(), pgd_reg); - else + uasm_i_jr(&p, 31); + uasm_i_ehb(&p); + } else { + uasm_i_jr(&p, 31); uasm_i_nop(&p); + } #endif if (p >= tlbmiss_handler_setup_pgd_end) panic("tlbmiss_handler_setup_pgd space exceeded");