ARM: 6772/1: errata: possible fault MMU translations following an ASID switch

On the r2p* and r3p* versions of the Cortex-A9, a speculative memory
access may cause a page table walk which starts prior to an ASID switch
but completes afterwards. This can populate the micro-TLB with a stale
entry which may be hit with the new ASID.

This workaround places two dsb instructions in the mm switching code so
that no page table walks can cross the ASID switch.

Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 166efa2a19cd96eb05ad5b4b599708c9a68c1d70..ec0f6589af05e3ae4b838e5361e22c5a4ef81ae7 100644 (file)
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1202,6 +1202,17 @@ config ARM_ERRATA_753970
          This has the same effect as the cache sync operation: store buffer
          drain and waiting for all buffers empty.
 
+config ARM_ERRATA_754322
+       bool "ARM errata: possible faulty MMU translations following an ASID switch"
+       depends on CPU_V7
+       help
+         This option enables the workaround for the 754322 Cortex-A9 (r2p*,
+         r3p*) erratum. A speculative memory access may cause a page table walk
+         which starts prior to an ASID switch but completes afterwards. This
+         can populate the micro-TLB with a stale entry which may be hit with
+         the new ASID. This workaround places two dsb instructions in the mm
+         switching code so that no page table walks can cross the ASID switch.
+
 endmenu
 
 source "arch/arm/common/Kconfig"

diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index 8e3356239136a2423095b24b466858100b00c31d..f7498f1a2e86865a5c648dc8c85ed74d15decd3c 100644 (file)
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -107,11 +107,17 @@ ENTRY(cpu_v7_switch_mm)
        ALT_UP(orr      r0, r0, #TTB_FLAGS_UP)
 #ifdef CONFIG_ARM_ERRATA_430973
        mcr     p15, 0, r2, c7, c5, 6           @ flush BTAC/BTB
+#endif
+#ifdef CONFIG_ARM_ERRATA_754322
+       dsb
 #endif
        mcr     p15, 0, r2, c13, c0, 1          @ set reserved context ID
        isb
 1:     mcr     p15, 0, r0, c2, c0, 0           @ set TTB 0
        isb
+#ifdef CONFIG_ARM_ERRATA_754322
+       dsb
+#endif
        mcr     p15, 0, r1, c13, c0, 1          @ set context ID
        isb
 #endif