Received: by 2002:a25:d7c1:0:0:0:0:0 with SMTP id o184csp2262728ybg; Sun, 27 Oct 2019 14:41:11 -0700 (PDT) X-Google-Smtp-Source: APXvYqx+69NkIFY2HUwwnqjb5OeE3/4PiPNvVwvV7UNDyJWQ4aIRz0Dm99BhAfj5uX/tBMmioYN0 X-Received: by 2002:aa7:d945:: with SMTP id l5mr16425565eds.279.1572212471392; Sun, 27 Oct 2019 14:41:11 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1572212471; cv=none; d=google.com; s=arc-20160816; b=ctZ1njgkN6c4ZVdLPeDw0ycuw5wUh/9IEDuDzBuu6jnclHe/5P4K9etCx2ciVVpm2M JphMTBZ2QPY3XtlZxBcNKAW5Ubq7XGRUm9j516q80XcBQY9cddovNRiPxsC343vk93Qh 6fT5rzNfREUOG1sm+zyPVSvVM3MmWug5GiwAG2Rdpxw6z2Vux1jZ3QNfv1BkRckt775+ FaWES6HKV4AGLuurN1PHP8rB9o/3YYBXIZCAybCHwQ7DlZYII/8GzfNEHXMEspyPm64P +pYUeShYfGn58xW690g29YNpRB5/yR/BqrY7+8BPNeDoDZjz9sQ6zQQ3+2xuLIAdNawA YYwA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=7Tbs56qfludAaJnmbZgtm1aB46Bn+AoFsRSywd3KrFY=; b=aI7SJGa63Y4Ugpl5YGMULNAHRPfjj3UmK11XUXwYBgI9rLDPZHx/jWuqK1ctchNbTl Ya5781TnUEPPu+MY5V6wjP95M9g7mtEoVOmxkUCm6OU25CmRkqdsm7yc4nzBAFTdA1xp Mec1HoFqariMO86S6INnLSFPM+LeIioGoARMISE2cvjeWsGdOS+owryO+jj0+sGYI6yF RNrlzk/javPBlBsF/44oNZpFefYbVjgTMF3j5GRuMII6pv/1LG58oWvZzs1qJQEGgz3f XhPNKDnti0sFF34xY01SL9vdfcOuqEDB8fRbaJwZo4cceK3dGtppkG0mzt5kMvrwKiHb P8cw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b="lCMR/Uul"; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id c13si6851687edk.4.2019.10.27.14.40.47; Sun, 27 Oct 2019 14:41:11 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b="lCMR/Uul"; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730199AbfJ0VhP (ORCPT + 99 others); Sun, 27 Oct 2019 17:37:15 -0400 Received: from mail.kernel.org ([198.145.29.99]:51522 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728871AbfJ0VFl (ORCPT ); Sun, 27 Oct 2019 17:05:41 -0400 Received: from localhost (100.50.158.77.rev.sfr.net [77.158.50.100]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id C62E42064A; Sun, 27 Oct 2019 21:05:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1572210340; bh=72AteEuiA3s92RiBZZQiHOAbe8EZUTdP1wCu560U1tM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lCMR/Uule7XIdBleX1O3YBJMvKG8rFEr14YW8eNM7xDLGi66gdCNH1mYGkzguI4YM l+iNJyaO8qv7mjgZxo+Jo3f8ZLV2eY2lAKByvBh/IzeGLVH8eLpYIspA4Wwgda1uw0 db6OGP06Tm+oZQTLI4Av44NGUIwp0gYNZqOlZ00s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Paul Burton , Dmitry Korotin , linux-mips@vger.kernel.org Subject: [PATCH 4.9 30/49] MIPS: tlbex: Fix build_restore_pagemask KScratch restore Date: Sun, 27 Oct 2019 22:01:08 +0100 Message-Id: <20191027203143.757870099@linuxfoundation.org> X-Mailer: git-send-email 2.23.0 In-Reply-To: <20191027203119.468466356@linuxfoundation.org> References: <20191027203119.468466356@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Paul Burton commit b42aa3fd5957e4daf4b69129e5ce752a2a53e7d6 upstream. build_restore_pagemask() will restore the value of register $1/$at when its restore_scratch argument is non-zero, and aims to do so by filling a branch delay slot. Commit 0b24cae4d535 ("MIPS: Add missing EHB in mtc0 -> mfc0 sequence.") added an EHB instruction (Execution Hazard Barrier) prior to restoring $1 from a KScratch register, in order to resolve a hazard that can result in stale values of the KScratch register being observed. In particular, P-class CPUs from MIPS with out of order execution pipelines such as the P5600 & P6600 are affected. Unfortunately this EHB instruction was inserted in the branch delay slot causing the MFC0 instruction which performs the restoration to no longer execute along with the branch. The result is that the $1 register isn't actually restored, ie. the TLB refill exception handler clobbers it - which is exactly the problem the EHB is meant to avoid for the P-class CPUs. Similarly build_get_pgd_vmalloc() will restore the value of $1/$at when its mode argument equals refill_scratch, and suffers from the same problem. Fix this by in both cases moving the EHB earlier in the emitted code. There's no reason it needs to immediately precede the MFC0 - it simply needs to be between the MTC0 & MFC0. This bug only affects Cavium Octeon systems which use build_fast_tlb_refill_handler(). Signed-off-by: Paul Burton Fixes: 0b24cae4d535 ("MIPS: Add missing EHB in mtc0 -> mfc0 sequence.") Cc: Dmitry Korotin Cc: stable@vger.kernel.org # v3.15+ Cc: linux-mips@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Greg Kroah-Hartman --- arch/mips/mm/tlbex.c | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-) --- a/arch/mips/mm/tlbex.c +++ b/arch/mips/mm/tlbex.c @@ -661,6 +661,13 @@ static void build_restore_pagemask(u32 * int restore_scratch) { if (restore_scratch) { + /* + * Ensure the MFC0 below observes the value written to the + * KScratch register by the prior MTC0. + */ + if (scratch_reg >= 0) + uasm_i_ehb(p); + /* Reset default page size */ if (PM_DEFAULT_MASK >> 16) { uasm_i_lui(p, tmp, PM_DEFAULT_MASK >> 16); @@ -675,12 +682,10 @@ static void build_restore_pagemask(u32 * uasm_i_mtc0(p, 0, C0_PAGEMASK); uasm_il_b(p, r, lid); } - if (scratch_reg >= 0) { - uasm_i_ehb(p); + if (scratch_reg >= 0) UASM_i_MFC0(p, 1, c0_kscratch(), scratch_reg); - } else { + else UASM_i_LW(p, 1, scratchpad_offset(0), 0); - } } else { /* Reset default page size */ if (PM_DEFAULT_MASK >> 16) { @@ -922,6 +927,10 @@ build_get_pgd_vmalloc64(u32 **p, struct } if (mode != not_refill && check_for_high_segbits) { uasm_l_large_segbits_fault(l, *p); + + if (mode == refill_scratch && scratch_reg >= 0) + uasm_i_ehb(p); + /* * We get here if we are an xsseg address, or if we are * an xuseg address above (PGDIR_SHIFT+PGDIR_BITS) boundary. @@ -938,12 +947,10 @@ build_get_pgd_vmalloc64(u32 **p, struct uasm_i_jr(p, ptr); if (mode == refill_scratch) { - if (scratch_reg >= 0) { - uasm_i_ehb(p); + if (scratch_reg >= 0) UASM_i_MFC0(p, 1, c0_kscratch(), scratch_reg); - } else { + else UASM_i_LW(p, 1, scratchpad_offset(0), 0); - } } else { uasm_i_nop(p); }