[PATCH v5 4/4] arm64: errata: Work around early CME DVMSync acknowledgement

[Will Deacon]

On Tue, Apr 07, 2026 at 11:28:44AM +0100, Catalin Marinas wrote:
> C1-Pro acknowledges DVMSync messages before completing the SME/CME
> memory accesses. Work around this by issuing an IPI to the affected CPUs
> if they are running in EL0 with SME enabled.
> 
> Note that we avoid the local DSB in the IPI handler as the kernel runs
> with SCTLR_EL1.IESB=1. This is sufficient to complete SME memory
> accesses at EL0 on taking an exception to EL1. On the return to user
> path, no barrier is necessary either. See the comment in
> sme_set_active() and the more detailed explanation in the link below.
> 
> To avoid a potential IPI flood from malicious applications (e.g.
> madvise(MADV_PAGEOUT) in a tight loop), track where a process is active
> via mm_cpumask() and only interrupt those CPUs.
> 
> Signed-off-by: Catalin Marinas <catalin.marinas at arm.com>
> Link: https://lore.kernel.org/r/ablEXwhfKyJW1i7l@J2N7QTR9R3
> Cc: Will Deacon <will at kernel.org>
> Cc: Mark Rutland <mark.rutland at arm.com>
> Cc: James Morse <james.morse at arm.com>
> Cc: Mark Brown <broonie at kernel.org>
> ---
>  Documentation/arch/arm64/silicon-errata.rst |  2 +
>  arch/arm64/Kconfig                          | 12 ++++
>  arch/arm64/include/asm/cpucaps.h            |  2 +
>  arch/arm64/include/asm/fpsimd.h             | 21 ++++++
>  arch/arm64/include/asm/tlbbatch.h           | 10 ++-
>  arch/arm64/include/asm/tlbflush.h           | 72 ++++++++++++++++++-
>  arch/arm64/kernel/cpu_errata.c              | 30 ++++++++
>  arch/arm64/kernel/entry-common.c            |  3 +
>  arch/arm64/kernel/fpsimd.c                  | 79 +++++++++++++++++++++
>  arch/arm64/kernel/process.c                 | 36 ++++++++++
>  arch/arm64/tools/cpucaps                    |  1 +
>  11 files changed, 264 insertions(+), 4 deletions(-)

[...]

> diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
> index 489554931231..4c328b7c79ba 100644
> --- a/arch/arm64/kernel/process.c
> +++ b/arch/arm64/kernel/process.c
> @@ -26,6 +26,7 @@
>  #include <linux/reboot.h>
>  #include <linux/interrupt.h>
>  #include <linux/init.h>
> +#include <linux/cpumask.h>
>  #include <linux/cpu.h>
>  #include <linux/elfcore.h>
>  #include <linux/pm.h>
> @@ -339,8 +340,41 @@ void flush_thread(void)
>  	flush_gcs();
>  }
>  
> +#ifdef CONFIG_ARM64_ERRATUM_4193714
> +
> +static void arch_dup_tlbbatch_mask(struct task_struct *dst)
> +{
> +	/*
> +	 * Clear the inherited cpumask with memset() to cover both cases where
> +	 * cpumask_var_t is a pointer or an array. It will be allocated lazily
> +	 * in sme_dvmsync_add_pending() if CPUMASK_OFFSTACK=y.
> +	 */
> +	if (alternative_has_cap_unlikely(ARM64_WORKAROUND_4193714))
> +		memset(&dst->tlb_ubc.arch.cpumask, 0,
> +		       sizeof(dst->tlb_ubc.arch.cpumask));

nit: use cpumask_clear() instead?

Will