[PATCH] arm64: mm: Stop using the previous ASID for init_mm

[PATCH] arm64: mm: Stop using the previous ASID for init_mm

[Lai Jiangshan]

From: Lai Jiangshan <jiangshan.ljs@antgroup.com>

Switching to init_mm should prevent further accesses through the
previous address space's translations.

Commit e53f21bce4d3 ("arm64: Use the reserved TTBR0 if context switching
to the init_mm") avoided installing init_mm.pgd as a user page table.
At the time, the ASID was held in TTBR0, so installing the reserved
TTBR0 also switched to ASID 0.

Since commit 7655abb95386 ("arm64: mm: Move ASID from TTBR0 to TTBR1"),
installing the reserved TTBR0 no longer changes the active ASID.
Consequently, switching to init_mm leaves the CPU using the previous
address space's ASID. An empty page table does not prevent TLB hits
for that ASID.

This can retain access beyond the lifetime of the backing pages.
During fullmm teardown, user data pages can be freed before their
cached translations are invalidated. If those pages are subsequently
reused for kernel data, an erroneous uaccess that hits a surviving
translation can read or corrupt that data instead of faulting.

Fixes: 7655abb95386 ("arm64: mm: Move ASID from TTBR0 to TTBR1")
Signed-off-by: Lai Jiangshan <jiangshan.ljs@antgroup.com>

diff --git a/arch/arm64/include/asm/mmu_context.h b/arch/arm64/include/asm/mmu_context.h
index 803b68758152..7e56099c5fbb 100644
--- a/arch/arm64/include/asm/mmu_context.h
+++ b/arch/arm64/include/asm/mmu_context.h
@@ -235,15 +235,6 @@ enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
 
 static inline void __switch_mm(struct mm_struct *next)
 {
-	/*
-	 * init_mm.pgd does not contain any user mappings and it is always
-	 * active for kernel addresses in TTBR1. Just set the reserved TTBR0.
-	 */
-	if (next == &init_mm) {
-		cpu_set_reserved_ttbr0();
-		return;
-	}
-
 	check_and_switch_context(next);
 }
 
diff --git a/arch/arm64/mm/context.c b/arch/arm64/mm/context.c
index 0f4a28b87469..a96ebe904dd7 100644
--- a/arch/arm64/mm/context.c
+++ b/arch/arm64/mm/context.c
@@ -218,6 +218,16 @@ void check_and_switch_context(struct mm_struct *mm)
 	unsigned int cpu;
 	u64 asid, old_active_asid;
 
+	/*
+	 * init_mm.pgd contains kernel mappings, so use the reserved page
+	 * tables for TTBR0 and switch TTBR1 to ASID 0. Leave active_asids
+	 * unchanged to preserve the ASID rollover bookkeeping.
+	 */
+	if (mm == &init_mm) {
+		cpu_do_switch_mm(__pa_symbol(reserved_pg_dir), mm);
+		return;
+	}
+
 	if (system_supports_cnp())
 		cpu_set_reserved_ttbr0();
 
-- 
2.39.5 (Apple Git-154)

Re: [PATCH] arm64: mm: Stop using the previous ASID for init_mm

[Catalin Marinas]

On Tue, Oct 27, 2026 at 06:02:27PM +0800, Lai Jiangshan wrote:
> From: Lai Jiangshan <jiangshan.ljs@antgroup.com>
> 
> Switching to init_mm should prevent further accesses through the
> previous address space's translations.
> 
> Commit e53f21bce4d3 ("arm64: Use the reserved TTBR0 if context switching
> to the init_mm") avoided installing init_mm.pgd as a user page table.
> At the time, the ASID was held in TTBR0, so installing the reserved
> TTBR0 also switched to ASID 0.
> 
> Since commit 7655abb95386 ("arm64: mm: Move ASID from TTBR0 to TTBR1"),
> installing the reserved TTBR0 no longer changes the active ASID.
> Consequently, switching to init_mm leaves the CPU using the previous
> address space's ASID. An empty page table does not prevent TLB hits
> for that ASID.
> 
> This can retain access beyond the lifetime of the backing pages.
> During fullmm teardown, user data pages can be freed before their
> cached translations are invalidated. If those pages are subsequently
> reused for kernel data, an erroneous uaccess that hits a surviving
> translation can read or corrupt that data instead of faulting.
> 
> Fixes: 7655abb95386 ("arm64: mm: Move ASID from TTBR0 to TTBR1")
> Signed-off-by: Lai Jiangshan <jiangshan.ljs@antgroup.com>

Thanks for the report. I think the problem identified is real. My TLA+
model (apart from having a bug in how it modelled speculative TLB
loads), did not exercise this init_mm case. I updated it and it now
shows the problem.

We'll check your fix in the next few days.

-- 
Catalin

Re: [PATCH] arm64: mm: Stop using the previous ASID for init_mm

[Anshuman Khandual]

On Tue, Oct 27, 2026 at 06:02:27PM +0800, Lai Jiangshan wrote:
> From: Lai Jiangshan <jiangshan.ljs@antgroup.com>
> 
> Switching to init_mm should prevent further accesses through the
> previous address space's translations.
> 
> Commit e53f21bce4d3 ("arm64: Use the reserved TTBR0 if context switching
> to the init_mm") avoided installing init_mm.pgd as a user page table.
> At the time, the ASID was held in TTBR0, so installing the reserved
> TTBR0 also switched to ASID 0.
> 
> Since commit 7655abb95386 ("arm64: mm: Move ASID from TTBR0 to TTBR1"),
> installing the reserved TTBR0 no longer changes the active ASID.
> Consequently, switching to init_mm leaves the CPU using the previous
> address space's ASID. An empty page table does not prevent TLB hits
> for that ASID.
> 
> This can retain access beyond the lifetime of the backing pages.
> During fullmm teardown, user data pages can be freed before their
> cached translations are invalidated. If those pages are subsequently
> reused for kernel data, an erroneous uaccess that hits a surviving
> translation can read or corrupt that data instead of faulting.
> 
> Fixes: 7655abb95386 ("arm64: mm: Move ASID from TTBR0 to TTBR1")
> Signed-off-by: Lai Jiangshan <jiangshan.ljs@antgroup.com>
> 
> diff --git a/arch/arm64/include/asm/mmu_context.h b/arch/arm64/include/asm/mmu_context.h
> index 803b68758152..7e56099c5fbb 100644
> --- a/arch/arm64/include/asm/mmu_context.h
> +++ b/arch/arm64/include/asm/mmu_context.h
> @@ -235,15 +235,6 @@ enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
>  
>  static inline void __switch_mm(struct mm_struct *next)
>  {
> -	/*
> -	 * init_mm.pgd does not contain any user mappings and it is always
> -	 * active for kernel addresses in TTBR1. Just set the reserved TTBR0.
> -	 */
> -	if (next == &init_mm) {
> -		cpu_set_reserved_ttbr0();
> -		return;
> -	}
> -
>  	check_and_switch_context(next);
>  }
>  
> diff --git a/arch/arm64/mm/context.c b/arch/arm64/mm/context.c
> index 0f4a28b87469..a96ebe904dd7 100644
> --- a/arch/arm64/mm/context.c
> +++ b/arch/arm64/mm/context.c
> @@ -218,6 +218,16 @@ void check_and_switch_context(struct mm_struct *mm)
>  	unsigned int cpu;
>  	u64 asid, old_active_asid;
>  
> +	/*
> +	 * init_mm.pgd contains kernel mappings, so use the reserved page
> +	 * tables for TTBR0 and switch TTBR1 to ASID 0. Leave active_asids

Just curious - does TTBR1 switch to ASID 0 ? AFAICS TTBR1_EL1 gets
the ASID which is derived from the mm_struct via ASID(mm) earlier.

void cpu_do_switch_mm(phys_addr_t pgd_phys, struct mm_struct *mm)
{
	unsigned long ttbr1 = read_sysreg(ttbr1_el1);
	unsigned long asid = ASID(mm);
	unsigned long ttbr0 = phys_to_ttbr(pgd_phys);

	/* Skip CNP for the reserved ASID */
	if (system_supports_cnp() && asid)
		ttbr0 |= TTBRx_EL1_CnP;

	/* SW PAN needs a copy of the ASID in TTBR0 for entry */
	if (IS_ENABLED(CONFIG_ARM64_SW_TTBR0_PAN))
		ttbr0 |= FIELD_PREP(TTBRx_EL1_ASID_MASK, asid);

	/* Set ASID in TTBR1 since TCR.A1 is set */
	ttbr1 &= ~TTBRx_EL1_ASID_MASK;
	ttbr1 |= FIELD_PREP(TTBRx_EL1_ASID_MASK, asid);

	cpu_set_reserved_ttbr0_nosync();
	write_sysreg(ttbr1, ttbr1_el1);
	write_sysreg(ttbr0, ttbr0_el1);
	isb();
	post_ttbr_update_workaround();
}

> +	 * unchanged to preserve the ASID rollover bookkeeping.
> +	 */
> +	if (mm == &init_mm) {
> +		cpu_do_switch_mm(__pa_symbol(reserved_pg_dir), mm);
> +		return;
> +	}
> +
>  	if (system_supports_cnp())
>  		cpu_set_reserved_ttbr0();
>  
> -- 
> 2.39.5 (Apple Git-154)
> 

Re: [PATCH] arm64: mm: Stop using the previous ASID for init_mm

[Vladimir Murzin]

On 10/30/26 06:30, Anshuman Khandual wrote:
> On Tue, Oct 27, 2026 at 06:02:27PM +0800, Lai Jiangshan wrote:
>> From: Lai Jiangshan <jiangshan.ljs@antgroup.com>
>>
>> Switching to init_mm should prevent further accesses through the
>> previous address space's translations.
>>
>> Commit e53f21bce4d3 ("arm64: Use the reserved TTBR0 if context switching
>> to the init_mm") avoided installing init_mm.pgd as a user page table.
>> At the time, the ASID was held in TTBR0, so installing the reserved
>> TTBR0 also switched to ASID 0.
>>
>> Since commit 7655abb95386 ("arm64: mm: Move ASID from TTBR0 to TTBR1"),
>> installing the reserved TTBR0 no longer changes the active ASID.
>> Consequently, switching to init_mm leaves the CPU using the previous
>> address space's ASID. An empty page table does not prevent TLB hits
>> for that ASID.
>>
>> This can retain access beyond the lifetime of the backing pages.
>> During fullmm teardown, user data pages can be freed before their
>> cached translations are invalidated. If those pages are subsequently
>> reused for kernel data, an erroneous uaccess that hits a surviving
>> translation can read or corrupt that data instead of faulting.
>>
>> Fixes: 7655abb95386 ("arm64: mm: Move ASID from TTBR0 to TTBR1")
>> Signed-off-by: Lai Jiangshan <jiangshan.ljs@antgroup.com>
>>
>> diff --git a/arch/arm64/include/asm/mmu_context.h b/arch/arm64/include/asm/mmu_context.h
>> index 803b68758152..7e56099c5fbb 100644
>> --- a/arch/arm64/include/asm/mmu_context.h
>> +++ b/arch/arm64/include/asm/mmu_context.h
>> @@ -235,15 +235,6 @@ enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
>>  
>>  static inline void __switch_mm(struct mm_struct *next)
>>  {
>> -	/*
>> -	 * init_mm.pgd does not contain any user mappings and it is always
>> -	 * active for kernel addresses in TTBR1. Just set the reserved TTBR0.
>> -	 */
>> -	if (next == &init_mm) {
>> -		cpu_set_reserved_ttbr0();
>> -		return;
>> -	}
>> -
>>  	check_and_switch_context(next);
>>  }
>>  
>> diff --git a/arch/arm64/mm/context.c b/arch/arm64/mm/context.c
>> index 0f4a28b87469..a96ebe904dd7 100644
>> --- a/arch/arm64/mm/context.c
>> +++ b/arch/arm64/mm/context.c
>> @@ -218,6 +218,16 @@ void check_and_switch_context(struct mm_struct *mm)
>>  	unsigned int cpu;
>>  	u64 asid, old_active_asid;
>>  
>> +	/*
>> +	 * init_mm.pgd contains kernel mappings, so use the reserved page
>> +	 * tables for TTBR0 and switch TTBR1 to ASID 0. Leave active_asids
> Just curious - does TTBR1 switch to ASID 0 ? AFAICS TTBR1_EL1 gets
> the ASID which is derived from the mm_struct via ASID(mm) earlier.
>

AFAICS, mm in this case is init_mm, and ASID for init_mm is 0.

Cheers
Vladimir
 
> void cpu_do_switch_mm(phys_addr_t pgd_phys, struct mm_struct *mm)
> {
> 	unsigned long ttbr1 = read_sysreg(ttbr1_el1);
> 	unsigned long asid = ASID(mm);
> 	unsigned long ttbr0 = phys_to_ttbr(pgd_phys);
> 
> 	/* Skip CNP for the reserved ASID */
> 	if (system_supports_cnp() && asid)
> 		ttbr0 |= TTBRx_EL1_CnP;
> 
> 	/* SW PAN needs a copy of the ASID in TTBR0 for entry */
> 	if (IS_ENABLED(CONFIG_ARM64_SW_TTBR0_PAN))
> 		ttbr0 |= FIELD_PREP(TTBRx_EL1_ASID_MASK, asid);
> 
> 	/* Set ASID in TTBR1 since TCR.A1 is set */
> 	ttbr1 &= ~TTBRx_EL1_ASID_MASK;
> 	ttbr1 |= FIELD_PREP(TTBRx_EL1_ASID_MASK, asid);
> 
> 	cpu_set_reserved_ttbr0_nosync();
> 	write_sysreg(ttbr1, ttbr1_el1);
> 	write_sysreg(ttbr0, ttbr0_el1);
> 	isb();
> 	post_ttbr_update_workaround();
> }
> 
>> +	 * unchanged to preserve the ASID rollover bookkeeping.
>> +	 */
>> +	if (mm == &init_mm) {
>> +		cpu_do_switch_mm(__pa_symbol(reserved_pg_dir), mm);
>> +		return;
>> +	}
>> +
>>  	if (system_supports_cnp())
>>  		cpu_set_reserved_ttbr0();
>>  
>> -- 
>> 2.39.5 (Apple Git-154)
>>