[PATCH] MIPS: ingenic: Work around stale L2 data after DMA on XBurst II

[Hunter Laux <hunterlaux@gmail.com>]

On XBurst II, with the L2-to-DDR prefetcher enabled, invalidating the
L2 with Hit CACHE operations can leave stale data there: a buffer read
after a device has written to it returns what it held before the
transfer, although it is invalidated before and after the DMA.

The RTL8821CU USB Wi-Fi driver, rtw88, shows it in its register reads,
which go through 4-byte buffers: about one read in 500 is stale with
the driver's buffers, and one in 12 when each buffer starts its own L2
line. None are with the L2-to-DDR prefetcher turned off (CCU
MSCR.DisPFB2), or with a load from an uncached address before the L2
is invalidated, which Ingenic's kernels issue: none in 20000 reads
over 4 boots.

Add that load to mips_sc_inv() under a WAR_INGENIC_L2_HIT_CACHEOP
option, on XBurst II only.

Cc: Paul Cercueil <paul@crapouillou.net>
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Hunter Laux <hunterlaux@gmail.com>
---
No XBurst II SoC is in mainline yet; this came up on the X2600, whose
support I'm preparing.
---
 arch/mips/Kconfig      | 9 +++++++++
 arch/mips/mm/sc-mips.c | 9 +++++++++
 2 files changed, 18 insertions(+)

diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index dac3ec5120..fd438b52fd 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -131,6 +131,7 @@ config MACH_INGENIC
 	select USE_OF
 	select CPU_SUPPORTS_CPUFREQ
 	select MIPS_EXTERNAL_TIMER
+	select WAR_INGENIC_L2_HIT_CACHEOP
 
 menu "Machine selection"
 
@@ -2524,6 +2525,14 @@ config WAR_R4600_V1_HIT_CACHEOP
 config WAR_R4600_V2_HIT_CACHEOP
 	bool
 
+# Ingenic XBurst II: with the L2-to-DDR prefetcher enabled, invalidating
+# the L2 with Hit CACHE operations can leave stale data there, so that a
+# buffer read after DMA returns what it held before the transfer.  A load
+# from an uncached address before the operations avoids it.  Only XBurst II
+# CPUs run it: XBurst1 shares the platform code but not the prefetcher.
+config WAR_INGENIC_L2_HIT_CACHEOP
+	bool
+
 # From TX49/H2 manual: "If the instruction (i.e. CACHE) is issued for
 # the line which this instruction itself exists, the following
 # operation is not guaranteed."
diff --git a/arch/mips/mm/sc-mips.c b/arch/mips/mm/sc-mips.c
index 06ec304ad4..41ad4905e5 100644
--- a/arch/mips/mm/sc-mips.c
+++ b/arch/mips/mm/sc-mips.c
@@ -21,6 +21,14 @@
  * MIPS32/MIPS64 L2 cache handling
  */
 
+static inline void mips_sc_hit_cacheop_war(void)
+{
+	if (IS_ENABLED(CONFIG_WAR_INGENIC_L2_HIT_CACHEOP) &&
+	    current_cpu_type() == CPU_XBURST &&
+	    (current_cpu_data.processor_id & PRID_IMP_MASK) == PRID_IMP_XBURST2)
+		__fast_iob();
+}
+
 /*
  * Writeback and invalidate the secondary cache before DMA.
  */
@@ -37,6 +45,7 @@ static void mips_sc_inv(unsigned long addr, unsigned long size)
 	unsigned long lsize = cpu_scache_line_size();
 	unsigned long almask = ~(lsize - 1);
 
+	mips_sc_hit_cacheop_war();
 	cache_op(Hit_Writeback_Inv_SD, addr & almask);
 	cache_op(Hit_Writeback_Inv_SD, (addr + size - 1) & almask);
 	blast_inv_scache_range(addr, addr + size);

---
base-commit: b3dfbde62cf1981c4638939c159dfd087b7a72e9
change-id: 20261111-mips-ingenic-l2-war-f0eb3e4735b8

Best regards,
-- 
Hunter Laux <hunterlaux@gmail.com>