Re: [PATCH] arm64: mm: Stop using the previous ASID for init_mm

[Vladimir Murzin <vladimir.murzin@arm.com>]

On 10/30/26 06:30, Anshuman Khandual wrote:
> On Tue, Oct 27, 2026 at 06:02:27PM +0800, Lai Jiangshan wrote:
>> From: Lai Jiangshan <jiangshan.ljs@antgroup.com>
>>
>> Switching to init_mm should prevent further accesses through the
>> previous address space's translations.
>>
>> Commit e53f21bce4d3 ("arm64: Use the reserved TTBR0 if context switching
>> to the init_mm") avoided installing init_mm.pgd as a user page table.
>> At the time, the ASID was held in TTBR0, so installing the reserved
>> TTBR0 also switched to ASID 0.
>>
>> Since commit 7655abb95386 ("arm64: mm: Move ASID from TTBR0 to TTBR1"),
>> installing the reserved TTBR0 no longer changes the active ASID.
>> Consequently, switching to init_mm leaves the CPU using the previous
>> address space's ASID. An empty page table does not prevent TLB hits
>> for that ASID.
>>
>> This can retain access beyond the lifetime of the backing pages.
>> During fullmm teardown, user data pages can be freed before their
>> cached translations are invalidated. If those pages are subsequently
>> reused for kernel data, an erroneous uaccess that hits a surviving
>> translation can read or corrupt that data instead of faulting.
>>
>> Fixes: 7655abb95386 ("arm64: mm: Move ASID from TTBR0 to TTBR1")
>> Signed-off-by: Lai Jiangshan <jiangshan.ljs@antgroup.com>
>>
>> diff --git a/arch/arm64/include/asm/mmu_context.h b/arch/arm64/include/asm/mmu_context.h
>> index 803b68758152..7e56099c5fbb 100644
>> --- a/arch/arm64/include/asm/mmu_context.h
>> +++ b/arch/arm64/include/asm/mmu_context.h
>> @@ -235,15 +235,6 @@ enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
>>  
>>  static inline void __switch_mm(struct mm_struct *next)
>>  {
>> -	/*
>> -	 * init_mm.pgd does not contain any user mappings and it is always
>> -	 * active for kernel addresses in TTBR1. Just set the reserved TTBR0.
>> -	 */
>> -	if (next == &init_mm) {
>> -		cpu_set_reserved_ttbr0();
>> -		return;
>> -	}
>> -
>>  	check_and_switch_context(next);
>>  }
>>  
>> diff --git a/arch/arm64/mm/context.c b/arch/arm64/mm/context.c
>> index 0f4a28b87469..a96ebe904dd7 100644
>> --- a/arch/arm64/mm/context.c
>> +++ b/arch/arm64/mm/context.c
>> @@ -218,6 +218,16 @@ void check_and_switch_context(struct mm_struct *mm)
>>  	unsigned int cpu;
>>  	u64 asid, old_active_asid;
>>  
>> +	/*
>> +	 * init_mm.pgd contains kernel mappings, so use the reserved page
>> +	 * tables for TTBR0 and switch TTBR1 to ASID 0. Leave active_asids
> Just curious - does TTBR1 switch to ASID 0 ? AFAICS TTBR1_EL1 gets
> the ASID which is derived from the mm_struct via ASID(mm) earlier.
>

AFAICS, mm in this case is init_mm, and ASID for init_mm is 0.

Cheers
Vladimir
 
> void cpu_do_switch_mm(phys_addr_t pgd_phys, struct mm_struct *mm)
> {
> 	unsigned long ttbr1 = read_sysreg(ttbr1_el1);
> 	unsigned long asid = ASID(mm);
> 	unsigned long ttbr0 = phys_to_ttbr(pgd_phys);
> 
> 	/* Skip CNP for the reserved ASID */
> 	if (system_supports_cnp() && asid)
> 		ttbr0 |= TTBRx_EL1_CnP;
> 
> 	/* SW PAN needs a copy of the ASID in TTBR0 for entry */
> 	if (IS_ENABLED(CONFIG_ARM64_SW_TTBR0_PAN))
> 		ttbr0 |= FIELD_PREP(TTBRx_EL1_ASID_MASK, asid);
> 
> 	/* Set ASID in TTBR1 since TCR.A1 is set */
> 	ttbr1 &= ~TTBRx_EL1_ASID_MASK;
> 	ttbr1 |= FIELD_PREP(TTBRx_EL1_ASID_MASK, asid);
> 
> 	cpu_set_reserved_ttbr0_nosync();
> 	write_sysreg(ttbr1, ttbr1_el1);
> 	write_sysreg(ttbr0, ttbr0_el1);
> 	isb();
> 	post_ttbr_update_workaround();
> }
> 
>> +	 * unchanged to preserve the ASID rollover bookkeeping.
>> +	 */
>> +	if (mm == &init_mm) {
>> +		cpu_do_switch_mm(__pa_symbol(reserved_pg_dir), mm);
>> +		return;
>> +	}
>> +
>>  	if (system_supports_cnp())
>>  		cpu_set_reserved_ttbr0();
>>  
>> -- 
>> 2.39.5 (Apple Git-154)
>>