ARM errata: Possible cache data corruption with hit-under-miss enabled
diff mbox

Message ID 1312785148-32531-1-git-send-email-siarhei.siamashka@gmail.com
State New, archived
Headers show

Commit Message

Siarhei Siamashka Aug. 8, 2011, 6:32 a.m. UTC
From: Catalin Marinas <catalin.marinas@arm.com>

This patch is a workaround for the 364296 ARM1136 r0pX erratum (possible
cache data corruption with hit-under-miss enabled). It sets the
undocumented bit 31 in the auxiliary control register and the FI bit in
the control register, thus disabling hit-under-miss without putting the
processor into full low interrupt latency mode.

Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Tested-by: Siarhei Siamashka <siarhei.siamashka@gmail.com>
---
 arch/arm/Kconfig      |   12 ++++++++++++
 arch/arm/mm/proc-v6.S |   16 ++++++++++++++++
 2 files changed, 28 insertions(+), 0 deletions(-)

Comments

Catalin Marinas Aug. 8, 2011, 10:02 a.m. UTC | #1
On Mon, Aug 08, 2011 at 07:32:28AM +0100, Siarhei Siamashka wrote:
> From: Catalin Marinas <catalin.marinas@arm.com>
> 
> This patch is a workaround for the 364296 ARM1136 r0pX erratum (possible
> cache data corruption with hit-under-miss enabled). It sets the
> undocumented bit 31 in the auxiliary control register and the FI bit in
> the control register, thus disabling hit-under-miss without putting the
> processor into full low interrupt latency mode.
> 
> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
> Tested-by: Siarhei Siamashka <siarhei.siamashka@gmail.com>

I haven't pushed this workaround in the past as I wasn't sure there is
production hardware affected. I recall you mentioned Nokia N800, do you
know which CPU revision does this have?

The erratum description states that only r0p2 is affected, though the
patch doesn't test for this revision (needs some improvement).
Siarhei Siamashka Aug. 8, 2011, 11:43 a.m. UTC | #2
On Mon, Aug 8, 2011 at 1:02 PM, Catalin Marinas <catalin.marinas@arm.com> wrote:
> On Mon, Aug 08, 2011 at 07:32:28AM +0100, Siarhei Siamashka wrote:
>> From: Catalin Marinas <catalin.marinas@arm.com>
>>
>> This patch is a workaround for the 364296 ARM1136 r0pX erratum (possible
>> cache data corruption with hit-under-miss enabled). It sets the
>> undocumented bit 31 in the auxiliary control register and the FI bit in
>> the control register, thus disabling hit-under-miss without putting the
>> processor into full low interrupt latency mode.
>>
>> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
>> Tested-by: Siarhei Siamashka <siarhei.siamashka@gmail.com>
>
> I haven't pushed this workaround in the past as I wasn't sure there is
> production hardware affected. I recall you mentioned Nokia N800, do you
> know which CPU revision does this have?

[    0.000000] CPU: ARMv6-compatible processor [4107b362] revision 2
(ARMv6TEJ), cr=00e5387f
[    0.000000] CPU: VIPT aliasing data cache, unknown instruction
cache
[    0.000000] Machine: Nokia N810
[    0.000000] Memory policy: ECC disabled, Data cache writeback
[    0.000000] OMAP2420

# cat /proc/cpuinfo
Processor       : ARMv6-compatible processor rev 2 (v6l)
BogoMIPS        : 213.72
Features        : swp half thumb fastmult vfp edsp java
CPU implementer : 0x41
CPU architecture: 6TEJ
CPU variant     : 0x0
CPU part        : 0xb36
CPU revision    : 2

Hardware        : Nokia N810
Revision        : 0000
Serial          : 0000000000000000

> The erratum description states that only r0p2 is affected, though the
> patch doesn't test for this revision (needs some improvement).

Agreed. If only r0p2 is affected and not r0pX, then it surely makes
sense to update the patch to check MIDR for the exact match without
masking out revision. Especially considering that this workaround
cripples software prefetch and makes PLD instruction useless, hurting
performance on certain workloads.

I have a reproducible testcase (just running gcc natively on Nokia
N810 to compile glib), which fails without the workaround and starts
to work fine with it, so my guess is that the problem is not extremely
difficult to trigger. The maemo kernel based on 2.6.21 and shipped
with Nokia N800/N810 has this erratum workarounded and the users of
the official firmware are not affected. But apparently there are some
mainline kernel users too:
    http://bu3sch.de/cms/hacking/n810-openwrt.html

Would you be so kind to update the patch? Or should I do it myself?
Also are there any other issues which might need to be addressed on
this hardware (I don't have the errata list for ARM1136)?
Catalin Marinas Aug. 8, 2011, 1:26 p.m. UTC | #3
On Mon, Aug 08, 2011 at 12:43:00PM +0100, Siarhei Siamashka wrote:
> On Mon, Aug 8, 2011 at 1:02 PM, Catalin Marinas <catalin.marinas@arm.com> wrote:
> > On Mon, Aug 08, 2011 at 07:32:28AM +0100, Siarhei Siamashka wrote:
> >> From: Catalin Marinas <catalin.marinas@arm.com>
> >>
> >> This patch is a workaround for the 364296 ARM1136 r0pX erratum (possible
> >> cache data corruption with hit-under-miss enabled). It sets the
> >> undocumented bit 31 in the auxiliary control register and the FI bit in
> >> the control register, thus disabling hit-under-miss without putting the
> >> processor into full low interrupt latency mode.
> >>
> >> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
> >> Tested-by: Siarhei Siamashka <siarhei.siamashka@gmail.com>
> >
> > I haven't pushed this workaround in the past as I wasn't sure there is
> > production hardware affected. I recall you mentioned Nokia N800, do you
> > know which CPU revision does this have?
> 
> [    0.000000] CPU: ARMv6-compatible processor [4107b362] revision 2
> (ARMv6TEJ), cr=00e5387f
> [    0.000000] CPU: VIPT aliasing data cache, unknown instruction
> cache
> [    0.000000] Machine: Nokia N810
> [    0.000000] Memory policy: ECC disabled, Data cache writeback
> [    0.000000] OMAP2420
> 
> # cat /proc/cpuinfo
> Processor       : ARMv6-compatible processor rev 2 (v6l)
> BogoMIPS        : 213.72
> Features        : swp half thumb fastmult vfp edsp java
> CPU implementer : 0x41
> CPU architecture: 6TEJ
> CPU variant     : 0x0
> CPU part        : 0xb36
> CPU revision    : 2
> 
> Hardware        : Nokia N810
> Revision        : 0000
> Serial          : 0000000000000000
...
> Would you be so kind to update the patch?

OK, I'll update it and post the patch in the next day or so.
Siarhei Siamashka Aug. 9, 2011, 10:06 p.m. UTC | #4
On Mon, Aug 8, 2011 at 4:26 PM, Catalin Marinas <catalin.marinas@arm.com> wrote:
> On Mon, Aug 08, 2011 at 12:43:00PM +0100, Siarhei Siamashka wrote:
>> On Mon, Aug 8, 2011 at 1:02 PM, Catalin Marinas <catalin.marinas@arm.com> wrote:
>> > On Mon, Aug 08, 2011 at 07:32:28AM +0100, Siarhei Siamashka wrote:
>> >> From: Catalin Marinas <catalin.marinas@arm.com>
>> >>
>> >> This patch is a workaround for the 364296 ARM1136 r0pX erratum (possible
>> >> cache data corruption with hit-under-miss enabled). It sets the
>> >> undocumented bit 31 in the auxiliary control register and the FI bit in
>> >> the control register, thus disabling hit-under-miss without putting the
>> >> processor into full low interrupt latency mode.
>> >>
>> >> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
>> >> Tested-by: Siarhei Siamashka <siarhei.siamashka@gmail.com>
>> >
>> > I haven't pushed this workaround in the past as I wasn't sure there is
>> > production hardware affected. I recall you mentioned Nokia N800, do you
>> > know which CPU revision does this have?
>>
>> [    0.000000] CPU: ARMv6-compatible processor [4107b362] revision 2
>> (ARMv6TEJ), cr=00e5387f
>> [    0.000000] CPU: VIPT aliasing data cache, unknown instruction
>> cache
>> [    0.000000] Machine: Nokia N810
>> [    0.000000] Memory policy: ECC disabled, Data cache writeback
>> [    0.000000] OMAP2420
>>
>> # cat /proc/cpuinfo
>> Processor       : ARMv6-compatible processor rev 2 (v6l)
>> BogoMIPS        : 213.72
>> Features        : swp half thumb fastmult vfp edsp java
>> CPU implementer : 0x41
>> CPU architecture: 6TEJ
>> CPU variant     : 0x0
>> CPU part        : 0xb36
>> CPU revision    : 2
>>
>> Hardware        : Nokia N810
>> Revision        : 0000
>> Serial          : 0000000000000000
> ...
>> Would you be so kind to update the patch?
>
> OK, I'll update it and post the patch in the next day or so.

Thanks a lot. I'll be sure to test it and respond to confirm that it
works fine (or not).

Patch
diff mbox

diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 9c26ba7..0c3a56c 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1115,6 +1115,18 @@  config ARM_ERRATA_743622
 	  visible impact on the overall performance or power consumption of the
 	  processor.
 
+config ARM_ERRATA_364296
+	bool "ARM errata: Possible cache data corruption with hit-under-miss enabled"
+	depends on CPU_V6 && !SMP
+	help
+	  This options enables the workaround for the 364296 ARM1136
+	  r0pX erratum (possible cache data corruption with
+	  hit-under-miss enabled). It sets the undocumented bit 31 in
+	  the auxiliary control register and the FI bit in the control
+	  register, thus disabling hit-under-miss without putting the
+	  processor into full low interrupt latency mode. ARM11MPCore
+	  is not affected.
+
 endmenu
 
 source "arch/arm/common/Kconfig"
diff --git a/arch/arm/mm/proc-v6.S b/arch/arm/mm/proc-v6.S
index 22aac85..1b675b1 100644
--- a/arch/arm/mm/proc-v6.S
+++ b/arch/arm/mm/proc-v6.S
@@ -180,6 +180,22 @@  __v6_setup:
 	mrc	p15, 0, r0, c1, c0, 0		@ read control register
 	bic	r0, r0, r5			@ clear bits them
 	orr	r0, r0, r6			@ set them
+#ifdef CONFIG_ARM_ERRATA_364296
+	/* Workaround for the 364296 ARM1136 r0pX erratum (possible cache data
+	 * corruption with hit-under-miss enabled). The conditional code below
+	 * (setting the undocumented bit 31 in the auxiliary control register
+	 * and the FI bit in the control register) disables hit-under-miss
+	 * without putting the processor into full low interrupt latency mode.
+	 */
+	ldr	r6, =0x4107b360			@ id for ARM1136 r0pX
+	mrc	p15, 0, r5, c0, c0, 0		@ get processor id
+	bic	r5, r5, #0xf			@ mask out part bits [3:0]
+	teq	r5, r6				@ check for the faulty core
+	mrceq	p15, 0, r5, c1, c0, 1		@ load aux control reg
+	orreq	r5, r5, #(1 << 31)		@ set the undocumented bit 31
+	mcreq	p15, 0, r5, c1, c0, 1		@ write aux control reg
+	orreq	r0, r0, #(1 << 21)		@ low interrupt latency configuration
+#endif
 	mov	pc, lr				@ return to head.S:__ret
 
 	/*