ARM: 6772/1: errata: possible fault MMU translations following an ASID switch

On the r2p* and r3p* versions of the Cortex-A9, a speculative memory
access may cause a page table walk which starts prior to an ASID switch
but completes afterwards. This can populate the micro-TLB with a stale
entry which may be hit with the new ASID.

This workaround places two dsb instructions in the mm switching code so
that no page table walks can cross the ASID switch.

Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 166efa2..ec0f658 100644 (file)
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1202,6 +1202,17 @@ config ARM_ERRATA_753970
          This has the same effect as the cache sync operation: store buffer
          drain and waiting for all buffers empty.
 
+config ARM_ERRATA_754322
+       bool "ARM errata: possible faulty MMU translations following an ASID switch"
+       depends on CPU_V7
+       help
+         This option enables the workaround for the 754322 Cortex-A9 (r2p*,
+         r3p*) erratum. A speculative memory access may cause a page table walk
+         which starts prior to an ASID switch but completes afterwards. This
+         can populate the micro-TLB with a stale entry which may be hit with
+         the new ASID. This workaround places two dsb instructions in the mm
+         switching code so that no page table walks can cross the ASID switch.
+
 endmenu
 
 source "arch/arm/common/Kconfig"

diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index 8e33562..f7498f1 100644 (file)
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -107,11 +107,17 @@ ENTRY(cpu_v7_switch_mm)
        ALT_UP(orr      r0, r0, #TTB_FLAGS_UP)
 #ifdef CONFIG_ARM_ERRATA_430973
        mcr     p15, 0, r2, c7, c5, 6           @ flush BTAC/BTB
+#endif
+#ifdef CONFIG_ARM_ERRATA_754322
+       dsb
 #endif
        mcr     p15, 0, r2, c13, c0, 1          @ set reserved context ID
        isb
 1:     mcr     p15, 0, r0, c2, c0, 0           @ set TTB 0
        isb
+#ifdef CONFIG_ARM_ERRATA_754322
+       dsb
+#endif
        mcr     p15, 0, r1, c13, c0, 1          @ set context ID
        isb
 #endif