From: Catalin Marinas <catalin.marinas@arm.com>
Date: Mon, 20 Apr 2026 12:12:35 +0000 (+0100)
Subject: Merge branch 'for-next/c1-pro-erratum-4193714' into for-next/core
X-Git-Url: http://git.ipfire.org/index.cgi?a=commitdiff_plain;h=858fbd7248bd84b2899fb2c29bc7bc2634296edf;p=thirdparty%2Flinux.git

Merge branch 'for-next/c1-pro-erratum-4193714' into for-next/core

* for-next/c1-pro-erratum-4193714:
  : Work around C1-Pro erratum 4193714 (CVE-2026-0995)
  arm64: errata: Work around early CME DVMSync acknowledgement
  arm64: cputype: Add C1-Pro definitions
  arm64: tlb: Pass the corresponding mm to __tlbi_sync_s1ish()
  arm64: tlb: Introduce __tlbi_sync_s1ish_{kernel,batch}() for TLB maintenance
---

858fbd7248bd84b2899fb2c29bc7bc2634296edf
diff --cc arch/arm64/include/asm/tlbflush.h
index 47fa4d39a4619,4aae42b830490..c0bf5b3980411
--- a/arch/arm64/include/asm/tlbflush.h
+++ b/arch/arm64/include/asm/tlbflush.h
@@@ -526,41 -579,17 +605,41 @@@ static __always_inline void __do_flush_
  		return;
  	}
  
 -	dsb(ishst);
 +	if (!(flags & TLBF_NOBROADCAST))
 +		dsb(ishst);
 +	else
 +		dsb(nshst);
 +
  	asid = ASID(mm);
  
 -	if (last_level)
 -		__flush_tlb_range_op(vale1is, start, pages, stride, asid,
 -				     tlb_level, true, lpa2_is_enabled());
 -	else
 -		__flush_tlb_range_op(vae1is, start, pages, stride, asid,
 -				     tlb_level, true, lpa2_is_enabled());
 +	switch (flags & (TLBF_NOWALKCACHE | TLBF_NOBROADCAST)) {
 +	case TLBF_NONE:
 +		__flush_s1_tlb_range_op(vae1is, start, pages, stride,
 +					asid, tlb_level);
 +		break;
 +	case TLBF_NOWALKCACHE:
 +		__flush_s1_tlb_range_op(vale1is, start, pages, stride,
 +					asid, tlb_level);
 +		break;
 +	case TLBF_NOBROADCAST:
 +		/* Combination unused */
 +		BUG();
 +		break;
 +	case TLBF_NOWALKCACHE | TLBF_NOBROADCAST:
 +		__flush_s1_tlb_range_op(vale1, start, pages, stride,
 +					asid, tlb_level);
 +		break;
 +	}
 +
 +	if (!(flags & TLBF_NONOTIFY))
 +		mmu_notifier_arch_invalidate_secondary_tlbs(mm, start, end);
  
 -	mmu_notifier_arch_invalidate_secondary_tlbs(mm, start, end);
 +	if (!(flags & TLBF_NOSYNC)) {
 +		if (!(flags & TLBF_NOBROADCAST))
- 			__tlbi_sync_s1ish();
++			__tlbi_sync_s1ish(mm);
 +		else
 +			dsb(nsh);
 +	}
  }
  
  static inline void __flush_tlb_range(struct vm_area_struct *vma,
@@@ -616,9 -645,9 +695,9 @@@ static inline void flush_tlb_kernel_ran
  	}
  
  	dsb(ishst);
 -	__flush_tlb_range_op(vaale1is, start, pages, stride, 0,
 -			     TLBI_TTL_UNKNOWN, false, lpa2_is_enabled());
 +	__flush_s1_tlb_range_op(vaale1is, start, pages, stride, 0,
 +				TLBI_TTL_UNKNOWN);
- 	__tlbi_sync_s1ish();
+ 	__tlbi_sync_s1ish_kernel();
  	isb();
  }
  
@@@ -639,10 -668,8 +718,11 @@@ static inline void __flush_tlb_kernel_p
  static inline void arch_tlbbatch_add_pending(struct arch_tlbflush_unmap_batch *batch,
  		struct mm_struct *mm, unsigned long start, unsigned long end)
  {
 -	__flush_tlb_range_nosync(mm, start, end, PAGE_SIZE, true, 3);
 +	struct vm_area_struct vma = { .vm_mm = mm, .vm_flags = 0 };
 +
 +	__flush_tlb_range(&vma, start, end, PAGE_SIZE, 3,
 +			  TLBF_NOWALKCACHE | TLBF_NOSYNC);
+ 	sme_dvmsync_add_pending(batch, mm);
  }
  
  static inline bool __pte_flags_need_flush(ptdesc_t oldval, ptdesc_t newval)
diff --cc arch/arm64/kernel/sys_compat.c
index 7e9860143add8,03fde2677d5be..0451f96c2c3ff
--- a/arch/arm64/kernel/sys_compat.c
+++ b/arch/arm64/kernel/sys_compat.c
@@@ -36,8 -36,8 +36,8 @@@ __do_compat_cache_op(unsigned long star
  			 * The workaround requires an inner-shareable tlbi.
  			 * We pick the reserved-ASID to minimise the impact.
  			 */
 -			__tlbi(aside1is, __TLBI_VADDR(0, 0));
 +			__tlbi(aside1is, 0UL);
- 			__tlbi_sync_s1ish();
+ 			__tlbi_sync_s1ish(current->mm);
  		}
  
  		ret = caches_clean_inval_user_pou(start, start + chunk);