From: Xuheng Li fixmap_map_slot() installs a valid PTE for the CPU's fixmap slot (or the fixblock slot) and issues a DSB ISHST before returning the slot's VA, which the caller then accesses. It does not issue an ISB. The DSB guarantees that the PTE write has completed, but without a context synchronization event the architecture does not guarantee that a later access on the same CPU uses the new entry: its translation may have been performed speculatively while the slot was still invalid, in which case the access takes a translation fault. At EL2 that fault ends in hyp_panic(). The clear side, fixmap_clear_slot(), already ends with an ISB. A litmus test of the same shape (map the slot, DSB ISHST, load through it) faulted on a Cortex-A72 in 2 out of 100M runs. Arm's herd7 model with -variant vmsa also allows the fault, and forbids it once the ISB is added. Add the missing ISB. This covers both hyp_fixmap_map() and hyp_fixblock_map(), which share fixmap_map_slot(). Fixes: aa6948f82f0b ("KVM: arm64: Add per-cpu fixmap infrastructure at EL2") Cc: stable@vger.kernel.org Signed-off-by: Xuheng Li --- arch/arm64/kvm/hyp/nvhe/mm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm64/kvm/hyp/nvhe/mm.c b/arch/arm64/kvm/hyp/nvhe/mm.c index b95d98cfe..83b74c522 100644 --- a/arch/arm64/kvm/hyp/nvhe/mm.c +++ b/arch/arm64/kvm/hyp/nvhe/mm.c @@ -316,6 +316,7 @@ static void *fixmap_map_slot(struct hyp_fixmap_slot *slot, phys_addr_t phys) pte |= kvm_phys_to_pte(phys) | KVM_PTE_VALID; WRITE_ONCE(*ptep, pte); dsb(ishst); + isb(); return (void *)slot->addr; } --- base-commit: c339f4010dea8b0d754f84ace70cd1b089878ef8 change-id: 20261028-fixmap-isb-cc9d765e37bc Best regards, -- Xuheng Li