From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752605AbdLULQw (ORCPT ); Thu, 21 Dec 2017 06:16:52 -0500 Received: from 9pmail.ess.barracuda.com ([64.235.150.224]:46238 "EHLO 9pmail.ess.barracuda.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751511AbdLULQt (ORCPT ); Thu, 21 Dec 2017 06:16:49 -0500 From: Matt Redfearn To: Ralf Baechle , James Hogan CC: , Matt Redfearn , "stable # v4 . 9+" , Huacai Chen , , Paul Burton Subject: [PATCH 1/3] MIPS: c-r4k: instruction_hazard should immediately follow cache op Date: Thu, 21 Dec 2017 11:16:02 +0000 Message-ID: <1513854965-3880-1-git-send-email-matt.redfearn@mips.com> X-Mailer: git-send-email 2.7.4 MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [10.150.130.83] X-BESS-ID: 1513854995-298555-26276-33723-1 X-BESS-VER: 2017.16-r1712182224 X-BESS-Apparent-Source-IP: 12.201.5.28 X-BESS-Outbound-Spam-Score: 0.00 X-BESS-Outbound-Spam-Report: Code version 3.2, rules version 3.2.2.188217 Rule breakdown below pts rule name description ---- ---------------------- -------------------------------- 0.00 BSF_BESS_OUTBOUND META: BESS Outbound X-BESS-Outbound-Spam-Status: SCORE=0.00 using account:ESS59374 scores of KILL_LEVEL=7.0 tests=BSF_BESS_OUTBOUND X-BESS-BRTS-Status: 1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org During ftrace initialisation, placeholder instructions in the prologue of every kernel function not marked "notrace" are replaced with nops. After the instructions are written (to the dcache), flush_icache_range() is used to ensure that the icache will be updated with these replaced instructions. Currently there is an instruction_hazard guard at the end of __r4k_flush_icache_range, since a hazard can be created if the CPU has already begun fetching the instructions that have have been replaced. The placement, however, ignores the calls to preempt_enable(), both in __r4k_flush_icache_range and r4k_on_each_cpu. When CONFIG_PREEMPT is enabled, these expand out to at least calls to preempt_count_sub(). The lack of an instruction hazard between icache invalidate and the execution of preempt_count_sub, in rare circumstances, was observed to cause weird crashes on Ci40, where the CPU would end up taking a kernel unaligned access exception from the middle of do_ade(), which it somehow reached from preempt_count_sub without executing the start of do_ade. Since the instruction hazard exists immediately after the dcache is written back and icache invalidated, place the instruction_hazard() within __local_r4k_flush_icache_range. The one at the end of __r4k_flush_icache_range is too late, since all of the functions in the call path of preempt_enable have already been executed, so remove it. This fixes the crashes during ftrace initialisation on Ci40. Signed-off-by: Matt Redfearn Cc: stable # v4.9+ --- arch/mips/mm/c-r4k.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c index 6f534b209971..ce7a54223504 100644 --- a/arch/mips/mm/c-r4k.c +++ b/arch/mips/mm/c-r4k.c @@ -760,6 +760,8 @@ static inline void __local_r4k_flush_icache_range(unsigned long start, break; } } + /* Hazard to force new i-fetch */ + instruction_hazard(); } static inline void local_r4k_flush_icache_range(unsigned long start, @@ -817,7 +819,6 @@ static void __r4k_flush_icache_range(unsigned long start, unsigned long end, } r4k_on_each_cpu(args.type, local_r4k_flush_icache_range_ipi, &args); preempt_enable(); - instruction_hazard(); } static void r4k_flush_icache_range(unsigned long start, unsigned long end) -- 2.7.4