On 3/1/23 21:09, Ricardo Koller wrote: > Second, KVM does not set the VTTBR_EL2.CnP bit, so each > PE has its own TLB entry for the same page. KVM could tolerate that when > doing permission relaxation (i.e., not having changes broadcasted to all > PEs). I'm might be missing something, but it seems that we do set CnP bit, at least in v6.2 we have arch/arm64/include/asm/kvm_mmu.h static __always_inline u64 kvm_get_vttbr(struct kvm_s2_mmu *mmu) { struct kvm_vmid *vmid = &mmu->vmid; u64 vmid_field, baddr; u64 cnp = system_supports_cnp() ? VTTBR_CNP_BIT : 0; baddr = mmu->pgd_phys; vmid_field = atomic64_read(&vmid->id) << VTTBR_VMID_SHIFT; vmid_field &= VTTBR_VMID_MASK(kvm_arm_vmid_bits); return kvm_phys_to_vttbr(baddr) | vmid_field | cnp; } Cheers Vladimir