ARM: 6772/1: errata: possible fault MMU translations following an ASID switch

On the r2p* and r3p* versions of the Cortex-A9, a speculative memory
access may cause a page table walk which starts prior to an ASID switch
but completes afterwards. This can populate the micro-TLB with a stale
entry which may be hit with the new ASID.

This workaround places two dsb instructions in the mm switching code so
that no page table walks can cross the ASID switch.

Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

2 files changed, 17 insertions, 0 deletions

diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 166efa2a19cd..ec0f6589af05 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1202,6 +1202,17 @@ config ARM_ERRATA_753970
           This has the same effect as the cache sync operation: store buffer
           drain and waiting for all buffers empty.
 
+config ARM_ERRATA_754322
+        bool "ARM errata: possible faulty MMU translations following an ASID switch"
+        depends on CPU_V7
+        help
+          This option enables the workaround for the 754322 Cortex-A9 (r2p*,
+          r3p*) erratum. A speculative memory access may cause a page table walk
+          which starts prior to an ASID switch but completes afterwards. This
+          can populate the micro-TLB with a stale entry which may be hit with
+          the new ASID. This workaround places two dsb instructions in the mm
+          switching code so that no page table walks can cross the ASID switch.
+
 endmenu
 
 source "arch/arm/common/Kconfig"
diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index 8e3356239136..f7498f1a2e86 100644
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -108,10 +108,16 @@ ENTRY(cpu_v7_switch_mm)
 #ifdef CONFIG_ARM_ERRATA_430973
         mcr     p15, 0, r2, c7, c5, 6           @ flush BTAC/BTB
 #endif
+#ifdef CONFIG_ARM_ERRATA_754322
+        dsb
+#endif
         mcr     p15, 0, r2, c13, c0, 1          @ set reserved context ID
         isb
 1:      mcr     p15, 0, r0, c2, c0, 0           @ set TTB 0
         isb
+#ifdef CONFIG_ARM_ERRATA_754322
+        dsb
+#endif
         mcr     p15, 0, r1, c13, c0, 1          @ set context ID
         isb
 #endif