[PATCH v3 0/5] arm64: Work around C1-Pro erratum 4193714 (CVE-2026-0995)

[Catalin Marinas]

Here's version 3 of the workaround for C1-Pro erratum 4193714. Version 2 was
posted here:

https://lore.kernel.org/r/20260318191918.2653160-1-catalin.marinas@arm.com

Main changes since v2:

- Renamed the config option, cpucap and SMCCC macro to include the
  '4193714' suffix instead of 'SME_DVMSYNC'

- Pushed smp_processor_id() into sme_{set,clear}_active()

- Updated silicon-errata.rst

- Moved the CPU part definition to a separate patch

Erratum description:

Arm C1-Pro prior to r1p3 has an erratum (4193714) where a TLBI+DSB
sequence might fail to ensure the completion of all outstanding SME
(Scalable Matrix Extension) memory accesses. The DVMSync message is
acknowledged before the SME accesses have fully completed, potentially
allowing pages to be reused before all in-flight accesses are done.

The workaround consists of executing a DSB locally (via IPI)
on all affected CPUs running with SME enabled, after the TLB
invalidation. This ensures the SME accesses have completed before the
IPI is acknowledged.

This has been assigned CVE-2026-0995:

https://developer.arm.com/documentation/111823/latest/

Catalin Marinas (4):
  arm64: tlb: Introduce __tlbi_sync_s1ish_{kernel,batch}() for TLB
    maintenance
  arm64: tlb: Pass the corresponding mm to __tlbi_sync_s1ish()
  arm64: cputype: Add C1-Pro definitions
  arm64: errata: Work around early CME DVMSync acknowledgement

James Morse (1):
  KVM: arm64: Add SMC hook for SME dvmsync erratum

 Documentation/arch/arm64/silicon-errata.rst |  2 +
 arch/arm64/Kconfig                          | 12 +++
 arch/arm64/include/asm/cpucaps.h            |  2 +
 arch/arm64/include/asm/cputype.h            |  2 +
 arch/arm64/include/asm/fpsimd.h             | 21 +++++
 arch/arm64/include/asm/mmu.h                |  1 +
 arch/arm64/include/asm/tlbflush.h           | 50 ++++++++++--
 arch/arm64/kernel/cpu_errata.c              | 30 +++++++
 arch/arm64/kernel/entry-common.c            |  3 +
 arch/arm64/kernel/fpsimd.c                  | 89 +++++++++++++++++++++
 arch/arm64/kernel/process.c                 |  7 ++
 arch/arm64/kernel/sys_compat.c              |  2 +-
 arch/arm64/kvm/hyp/nvhe/mem_protect.c       | 17 ++++
 arch/arm64/tools/cpucaps                    |  1 +
 include/linux/arm-smccc.h                   |  6 ++
 15 files changed, 236 insertions(+), 9 deletions(-)