From d8ca89f26c8a3b00253c60cbb6f4d8eb223dfe7d Mon Sep 17 00:00:00 2001 From: Baptiste Le Duc Date: Wed, 23 Sep 2026 09:03:10 +0200 Subject: [PATCH] xen/riscv: flush speculatively cached Bare-mode TLB entries in turn_on_mmu() The existing SFENCE.VMA before the satp write only orders the page table stores from setup_initial_pagetables() against subsequent implicit reads. It does not prevent the CPU from speculatively caching translations after the fence retires. According to the RISC-V Privileged specification, implementations are permitted to speculatively cache Bare-mode identity mappings. Furthermore, selecting MODE=Bare (which happens during check_pgtbl_mode_support()) requires zeroing the remaining fields of satp, causing ASID=0 to be actively used in Bare mode. Consequently, the TLB can be polluted with Bare identity mappings tagged with ASID=0. Once satp is written to enable Sv39 translation, these cached identity mappings (tagged with ASID=0) can shadow the true Sv39 translations. This would lead to translation failures since turn_on_mmu() jumps to a non-identity-mapped linker address. Fix this by adding a post-satp-write SFENCE.VMA to invalidate any stale translations (including Bare-mode identity mappings under ASID=0) before jumping to the virtual address space. Assisted-by: Claude:claude-opus-5 Signed-off-by: Baptiste Le Duc Reviewed-by: Jan Beulich Reviewed-by: Oleksii Kurochko --- xen/arch/riscv/riscv64/head.S | 1 + 1 file changed, 1 insertion(+) diff --git a/xen/arch/riscv/riscv64/head.S b/xen/arch/riscv/riscv64/head.S index 9c40512e61..7f6edc972f 100644 --- a/xen/arch/riscv/riscv64/head.S +++ b/xen/arch/riscv/riscv64/head.S @@ -98,6 +98,7 @@ FUNC(turn_on_mmu) srli t1, t1, PAGE_SHIFT or t1, t1, t0 csrw CSR_SATP, t1 + sfence.vma jr a0 END(turn_on_mmu)