From 36591cfe15177a919d780b25cce5dfb304afaaa0 Mon Sep 17 00:00:00 2001 From: Marc Zyngier Date: Thu, 1 Feb 2018 11:07:37 +0000 Subject: arm: Invalidate icache on prefetch abort outside of user mapping on Cortex-A15 ** Not yet queued for inclusion in mainline ** In order to prevent aliasing attacks on the branch predictor, invalidate the icache on Cortex-A15, which has the side effect of invalidating the BTB. This requires ACTLR[0] to be set to 1 (secure operation). Change-Id: I4bb8e3ec05853d739bebd8fb3c61657e252808c0 Signed-off-by: Marc Zyngier Signed-off-by: Will Deacon Signed-off-by: Jeetesh Burman Reviewed-on: https://git-master.nvidia.com/r/1698400 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu Tested-by: Bibek Basu --- arch/arm/include/asm/cp15.h | 1 + arch/arm/mm/fault.c | 4 ++++ 2 files changed, 5 insertions(+) diff --git a/arch/arm/include/asm/cp15.h b/arch/arm/include/asm/cp15.h index 43eddecc837d..d820fc5f043a 100644 --- a/arch/arm/include/asm/cp15.h +++ b/arch/arm/include/asm/cp15.h @@ -66,6 +66,7 @@ #define BPIALL __ACCESS_CP15(c7, 0, c5, 6) +#define ICIALLU __ACCESS_CP15(c7, 0, c5, 0) extern unsigned long cr_no_alignment; /* defined in entry-armv.S */ extern unsigned long cr_alignment; /* defined in entry-armv.S */ diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c index f18f94006fea..e8f42821a206 100644 --- a/arch/arm/mm/fault.c +++ b/arch/arm/mm/fault.c @@ -26,6 +26,7 @@ #include #include #include +#include #include "fault.h" @@ -401,6 +402,9 @@ do_pabt_page_fault(unsigned long addr, unsigned int fsr, struct pt_regs *regs) #ifdef CONFIG_HARDEN_BRANCH_PREDICTOR if (addr > TASK_SIZE) { switch (read_cpuid_part_number()) { + case ARM_CPU_PART_CORTEX_A15: + write_sysreg(0, ICIALLU); + break; } } #endif -- cgit v1.2.3