[PATCH] MIPS: c-r4k: Flush the cache error vector before writing it uncached

[Imre Kaloz]

On R10000-class CPUs, a store prefetch while copying the preceding
vector can leave a dirty line whose write-back overwrites the uncached
cache error handler. Flush it first in r4k_cache_error_setup() with
r4k_dma_cache_wback_inv(), as dma_cache_wback_inv() is a no-op on
coherent systems.

Fixes: e01402b115cc ("More AP / SP bits for the 34K, the Malta bits and things.  Still wants a little polishing.")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Imre Kaloz <kaloz@xxxxxxxxxx>
---
 arch/mips/mm/c-r4k.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c
index d8aadd3dc057..ae31966ac65b 100644
--- a/arch/mips/mm/c-r4k.c
+++ b/arch/mips/mm/c-r4k.c
@@ -743,8 +743,6 @@ static void r4k_flush_icache_user_range(unsigned long start, unsigned long end)
 	return __r4k_flush_icache_range(start, end, true);
 }
 
-#ifdef CONFIG_DMA_NONCOHERENT
-
 static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size)
 {
 	/* Catch bad driver code */
@@ -786,6 +784,8 @@ static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size)
 	__sync();
 }
 
+#ifdef CONFIG_DMA_NONCOHERENT
+
 static void prefetch_cache_inv(unsigned long addr, unsigned long size)
 {
 	unsigned int linesz = cpu_scache_line_size();
@@ -1684,6 +1684,14 @@ static void r4k_cache_error_setup(void)
 	extern char __weak except_vec2_generic;
 	extern char __weak except_vec2_sb1;
 
+	/*
+	 * The handler is written uncached. Copying the preceding vector
+	 * may have left a dirty cached line of it behind, through a store
+	 * prefetch or a speculative store; write it back and invalidate it
+	 * first, or its later write-back overwrites the handler.
+	 */
+	r4k_dma_cache_wback_inv(ebase + 0x100, 0x80);
+
 	switch (current_cpu_type()) {
 	case CPU_SB1:
 	case CPU_SB1A:

base-commit: 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907