[xen staging] xen/riscv: flush speculatively cached Bare-mode TLB entries in turn_on_mmu()

[patchbot@xxxxxxx]

commit d8ca89f26c8a3b00253c60cbb6f4d8eb223dfe7d
Author:     Baptiste Le Duc <baptiste.le-duc@xxxxxxxxxx>
AuthorDate: Wed Sep 23 09:03:10 2026 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Wed Sep 23 10:01:38 2026 +0200

    xen/riscv: flush speculatively cached Bare-mode TLB entries in turn_on_mmu()
    
    The existing SFENCE.VMA before the satp write only orders the page table
    stores from setup_initial_pagetables() against subsequent implicit reads.
    It does not prevent the CPU from speculatively caching translations after
    the fence retires.
    
    According to the RISC-V Privileged specification, implementations are
    permitted to speculatively cache Bare-mode identity mappings. Furthermore,
    selecting MODE=Bare (which happens during check_pgtbl_mode_support())
    requires zeroing the remaining fields of satp, causing ASID=0 to be
    actively used in Bare mode. Consequently, the TLB can be polluted with Bare
    identity mappings tagged with ASID=0.
    
    Once satp is written to enable Sv39 translation, these cached identity
    mappings (tagged with ASID=0) can shadow the true Sv39 translations. This
    would lead to translation failures since turn_on_mmu() jumps to a
    non-identity-mapped linker address.
    
    Fix this by adding a post-satp-write SFENCE.VMA to invalidate any stale
    translations (including Bare-mode identity mappings under ASID=0) before
    jumping to the virtual address space.
    
    Assisted-by: Claude:claude-opus-5
    Signed-off-by: Baptiste Le Duc <baptiste.le-duc@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Oleksii Kurochko <oleksii.kurochko@xxxxxxxxx>
---
 xen/arch/riscv/riscv64/head.S | 1 +
 1 file changed, 1 insertion(+)

diff --git a/xen/arch/riscv/riscv64/head.S b/xen/arch/riscv/riscv64/head.S
index 9c40512e61..7f6edc972f 100644
--- a/xen/arch/riscv/riscv64/head.S
+++ b/xen/arch/riscv/riscv64/head.S
@@ -98,6 +98,7 @@ FUNC(turn_on_mmu)
         srli    t1, t1, PAGE_SHIFT
         or      t1, t1, t0
         csrw    CSR_SATP, t1
+        sfence.vma
 
         jr      a0
 END(turn_on_mmu)
--
generated by git-patchbot for /home/xen/git/xen.git#staging