Specify SFENCE/HFENCE requirements when changing PBMTE (#1111)

1 files changed, 19 insertions, 0 deletions

diff --git a/src/hypervisor.adoc b/src/hypervisor.adoc
index 01d1376..efa769c 100644
--- a/src/hypervisor.adoc
+++ b/src/hypervisor.adoc
@@ -1635,6 +1635,7 @@ VS-stage address translation, a nonzero guest physical address written
 to `mtval2`/`htval` shall correspond to the exact virtual address
 written to `mtval`/`stval`.
 
+[[hyp-mm-fences]]
 ==== Memory-Management Fences
 
 The behavior of the SFENCE.VMA instruction is affected by the current
@@ -1672,6 +1673,24 @@ address-translation cache entries that have cached PMP settings
 corresponding to the final translated supervisor physical address. An
 HFENCE.VVMA instruction is not required.
 
+Similarly, if the setting of the PBMTE bit in `menvcfg` is changed, an
+HFENCE.GVMA instruction with _rs1_=`x0` and _rs2_=`x0` suffices to synchronize
+with respect to the altered interpretation of G-stage and VS-stage PTEs' PBMT
+fields.
+
+By contrast, if the PBMTE bit in `henvcfg` is changed, executing an
+HFENCE.VVMA with _rs1_=`x0` and _rs2_=`x0` suffices to synchronize with
+respect to the altered interpretation of VS-stage PTEs' PBMT fields for the
+currently active VMID.
+
+NOTE: No mechanism is provided to atomically change `vsatp` and `hgatp`
+together.  Hence, to prevent speculative execution causing one guest's
+VS-stage translations to be cached under another guest's VMID, world-switch
+code should zero `vsatp`, then swap `hgatp`, then finally write the new
+`vstap` value.  Similarly, if `henvcfg`.PBMTE need be world-switched, it
+should be switched after zeroing `vsatp` but before writing the new `vsatp`
+value, obviating the need to execute an HFENCE.VVMA instruction.
+
 === Traps
 
 ==== Trap Cause Codes