Subject: Re: [PATCH] KVM: arm64: Work around C1-Pro erratum 4193714 for protected guests

From: Catalin Marinas <[email-masked]>
Date: Wed, 6 May 2026 13:40:39 +0100

On Wed, May 06, 2026 at 12:06:03PM +0100, Vincent Donnefort wrote:
> On Thu, Apr 30, 2026 at 04:59:11PM +0100, Catalin Marinas wrote:
> > From: James Morse <[email-masked]>
> > 
> > C1-Pro cores with SME have an erratum where TLBI+DSB does not complete
> > all outstanding SME accesses. Instead a DSB needs to be executed on the
> > affected CPUs. The implication is pages cannot be unmapped from the
> > host Stage 2 then provided to the guest. Host SME accesses may occur
> > after this point.
> > 
> > This erratum breaks pKVM's guarantees, and the workaround is hard to
> > implement as EL2 and EL1 share a security state meaning EL1 can mask
> > IPIs sent by EL2, leading to interrupt blackouts.
> > 
> > Instead, do this in EL3. This has the advantage of a separate security
> > state, meaning lower EL cannot mask the IPI. It is also simpler for EL3
> > to know about CPUs that are off or in PSCI's CPU_SUSPEND.
> > 
> > Add the needed hook to host_stage2_set_owner_metadata_locked(). This
> > covers the cases where the host loses access to a page:
> > 
> >   __pkvm_host_donate_guest()
> >   __pkvm_guest_unshare_host()
> >   host_stage2_set_owner_locked() when owner_id == PKVM_ID_HYP
> > 
> > Signed-off-by: James Morse <[email-masked]>
> > [[email-masked]: move the hook to host_stage2_set_owner_metadata_locked()]
> > [[email-masked]: use hyp_smccc_1_1_smc()]
> > Signed-off-by: Catalin Marinas <[email-masked]>
> > Cc: Mark Rutland <[email-masked]>
> > Cc: Marc Zyngier <[email-masked]>
> > Cc: Oliver Upton <[email-masked]>
> > Cc: Will Deacon <[email-masked]>
> > Cc: Vincent Donnefort <[email-masked]>
> > Cc: Lorenzo Pieralisi <[email-masked]>
> > Cc: Sudeep Holla <[email-masked]>
> > ---
> 
> Reviewed-by: Vincent Donnefort <[email-masked]>

Thanks Vincent. Would you mind having a look at v2 as well:

https://lore.kernel.org/r/[email-masked]

The only addition is not initialising pKVM if the firmware doesn't
implement the SMC handler.

-- 
Catalin