diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
index f77443229e..5dd8b6104c 100644
--- a/ArmVirtPkg/ArmVirtQemu.dsc
+++ b/ArmVirtPkg/ArmVirtQemu.dsc
@@ -31,6 +31,7 @@
   DEFINE SECURE_BOOT_ENABLE      = FALSE
   DEFINE TPM2_ENABLE             = FALSE
   DEFINE TPM2_CONFIG_ENABLE      = FALSE
+  DEFINE CAVIUM_ERRATUM_27456    = FALSE
 
   #
   # Network definition
@@ -117,7 +118,11 @@
   UefiScsiLib|MdePkg/Library/UefiScsiLib/UefiScsiLib.inf
 
 [BuildOptions]
+!if $(CAVIUM_ERRATUM_27456) == TRUE
+  GCC:*_*_AARCH64_PP_FLAGS = -DCAVIUM_ERRATUM_27456
+!else
   GCC:*_*_AARCH64_CC_XIPFLAGS ==
+!endif
 
 !include NetworkPkg/NetworkBuildOptions.dsc.inc
 
diff --git a/ArmVirtPkg/Library/ArmPlatformLibQemu/AArch64/ArmPlatformHelper.S b/ArmVirtPkg/Library/ArmPlatformLibQemu/AArch64/ArmPlatformHelper.S
index 1787d52fbf..5ac7c732f6 100644
--- a/ArmVirtPkg/Library/ArmPlatformLibQemu/AArch64/ArmPlatformHelper.S
+++ b/ArmVirtPkg/Library/ArmPlatformLibQemu/AArch64/ArmPlatformHelper.S
@@ -42,6 +42,21 @@
 
 
 ASM_FUNC(ArmPlatformPeiBootAction)
+#ifdef CAVIUM_ERRATUM_27456
+  /*
+   * On Cavium ThunderX, using non-global mappings that are executable at EL1
+   * results in I-cache corruption. So just avoid the early ID mapping there.
+   *
+   * MIDR implementor   0x43
+   * MIDR part numbers  0xA1 0xA2 (but not 0xAF)
+   */
+  mrs    x0, midr_el1            // read the MIDR into X0
+  ubfx   x1, x0, #24, #8         // grab implementor id
+  ubfx   x0, x0, #7, #9          // grab part number bits [11:3]
+  cmp    x1, #0x43               // compare implementor id
+  ccmp   x0, #0xA0 >> 3, #0, eq  // compare part# bits [11:3]
+  b.eq   0f
+#endif
   mrs    x0, CurrentEL           // check current exception level
   tbnz   x0, #3, 0f              // omit early ID map if above EL1