[PATCH] MIPS: ingenic: Work around stale L2 data after DMA on XBurst II

[PATCH] MIPS: ingenic: Work around stale L2 data after DMA on XBurst II

[Hunter Laux]

On XBurst II, with the L2-to-DDR prefetcher enabled, invalidating the
L2 with Hit CACHE operations can leave stale data there: a buffer read
after a device has written to it returns what it held before the
transfer, although it is invalidated before and after the DMA.

The RTL8821CU USB Wi-Fi driver, rtw88, shows it in its register reads,
which go through 4-byte buffers: about one read in 500 is stale with
the driver's buffers, and one in 12 when each buffer starts its own L2
line. None are with the L2-to-DDR prefetcher turned off (CCU
MSCR.DisPFB2), or with a load from an uncached address before the L2
is invalidated, which Ingenic's kernels issue: none in 20000 reads
over 4 boots.

Add that load to mips_sc_inv() under a WAR_INGENIC_L2_HIT_CACHEOP
option, on XBurst II only.

Cc: Paul Cercueil <paul@crapouillou.net>
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Hunter Laux <hunterlaux@gmail.com>
---
No XBurst II SoC is in mainline yet; this came up on the X2600, whose
support I'm preparing.
---
 arch/mips/Kconfig      | 9 +++++++++
 arch/mips/mm/sc-mips.c | 9 +++++++++
 2 files changed, 18 insertions(+)

diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index dac3ec5120..fd438b52fd 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -131,6 +131,7 @@ config MACH_INGENIC
 	select USE_OF
 	select CPU_SUPPORTS_CPUFREQ
 	select MIPS_EXTERNAL_TIMER
+	select WAR_INGENIC_L2_HIT_CACHEOP
 
 menu "Machine selection"
 
@@ -2524,6 +2525,14 @@ config WAR_R4600_V1_HIT_CACHEOP
 config WAR_R4600_V2_HIT_CACHEOP
 	bool
 
+# Ingenic XBurst II: with the L2-to-DDR prefetcher enabled, invalidating
+# the L2 with Hit CACHE operations can leave stale data there, so that a
+# buffer read after DMA returns what it held before the transfer.  A load
+# from an uncached address before the operations avoids it.  Only XBurst II
+# CPUs run it: XBurst1 shares the platform code but not the prefetcher.
+config WAR_INGENIC_L2_HIT_CACHEOP
+	bool
+
 # From TX49/H2 manual: "If the instruction (i.e. CACHE) is issued for
 # the line which this instruction itself exists, the following
 # operation is not guaranteed."
diff --git a/arch/mips/mm/sc-mips.c b/arch/mips/mm/sc-mips.c
index 06ec304ad4..41ad4905e5 100644
--- a/arch/mips/mm/sc-mips.c
+++ b/arch/mips/mm/sc-mips.c
@@ -21,6 +21,14 @@
  * MIPS32/MIPS64 L2 cache handling
  */
 
+static inline void mips_sc_hit_cacheop_war(void)
+{
+	if (IS_ENABLED(CONFIG_WAR_INGENIC_L2_HIT_CACHEOP) &&
+	    current_cpu_type() == CPU_XBURST &&
+	    (current_cpu_data.processor_id & PRID_IMP_MASK) == PRID_IMP_XBURST2)
+		__fast_iob();
+}
+
 /*
  * Writeback and invalidate the secondary cache before DMA.
  */
@@ -37,6 +45,7 @@ static void mips_sc_inv(unsigned long addr, unsigned long size)
 	unsigned long lsize = cpu_scache_line_size();
 	unsigned long almask = ~(lsize - 1);
 
+	mips_sc_hit_cacheop_war();
 	cache_op(Hit_Writeback_Inv_SD, addr & almask);
 	cache_op(Hit_Writeback_Inv_SD, (addr + size - 1) & almask);
 	blast_inv_scache_range(addr, addr + size);

---
base-commit: b3dfbde62cf1981c4638939c159dfd087b7a72e9
change-id: 20261111-mips-ingenic-l2-war-f0eb3e4735b8

Best regards,
-- 
Hunter Laux <hunterlaux@gmail.com>

Re: [PATCH] MIPS: ingenic: Work around stale L2 data after DMA on XBurst II

[H. Nikolaus Schaller]

Hi Hunter,

> Am 11.11.2026 um 21:47 schrieb Hunter Laux <hunterlaux@gmail.com>:
> 
> No XBurst II SoC is in mainline yet; this came up on the X2600, whose
> support I'm preparing.

Well we are also preparing x2600 support...

Maybe the individuals and teams working on the XBurst devices should coordinate somehow
to avoid double work and potentially incompatible fragments?

E.g. by describing which hardware is available, which topics/code patches are in the queue etc.

Maybe for me:
- LX16 board with X1600
- LX20 board with X2000
- LX26 board with X2600 (isn't running stable for unknown reasons and
                        sometimes damages the µSD contents but your
                        patch didn't help to solve)

In queue:
- fixes to build a generic kernel that is differentiated to hardware by different device tree binaries
- full CGU support for x1600, x2000, x2600 including jz4730 and fixes for jz4780
- full dtsi for x1600, x2000, x2600, jz4730
- TCU and OST fixes
- x1600: USB/OTG/PHY
- and more peripheral driver fixes for x2600: USB/OTG/PHY, sdhci, irqchip, pinctrl

Public kernel repository and (almost) latest code:
- https://github.com/goldelico/letux-kernel/tree/letux-7.4-rc2

BR and thanks,
Nikolaus

Re: [PATCH] MIPS: ingenic: Work around stale L2 data after DMA on XBurst II

[Hunter Laux]

Hi Nikolaus,

On Thu, Nov 12, 2026 at 11:24 +0100, H. Nikolaus Schaller wrote:
> - LX26 board with X2600 (isn't running stable for unknown reasons and
>                         sometimes damages the µSD contents but your
>                         patch didn't help to solve)

I don't know that the stale L2 data is behind your instability or µSD
problem. A quick way to rule it in or out, independent of the patch,
is to turn the prefetcher off (MSCR.DisPFB2):

  devmem 0x12200060 32 $(( $(devmem 0x12200060) | 2 ))

With it off I saw no stale reads here.

> Maybe the individuals and teams working on the XBurst devices should
> coordinate somehow to avoid double work and potentially incompatible
> fragments?

Agreed. I'll follow up off-list with what I have for the X2600.
What I have working on my board is here, on top of v7.3.3:

  https://github.com/jolting/linux/tree/ad5x-7.3.3-rc1

The patches I send upstream are cherry-picked from it.

I don't have any dev boards. My X2600 is in a Flashforge Adventurer 5X
3D printer, which is quite cheap, and its mainboard is also sold on its
own as a replacement part. A few of the printers make an X2600 test lab
that doubles as a print farm.

Hunter