arm64 kvm: revert some kpti related codes, and configure upper pagetable as global

In order to improve the performance, some kpti related codes(TCR.A1) have
been reverted, and set kernel pagetable as global.

Signed-off-by: Robin Luk <lubin.lu@antgroup.com>

3 files changed, 37 insertions, 24 deletions

diff --git a/pkg/sentry/platform/kvm/machine_arm64.go b/pkg/sentry/platform/kvm/machine_arm64.go
index 54837f20c..aa2d21748 100644
--- a/pkg/sentry/platform/kvm/machine_arm64.go
+++ b/pkg/sentry/platform/kvm/machine_arm64.go
@@ -54,7 +54,7 @@ func (m *machine) mapUpperHalf(pageTable *pagetables.PageTables) {
 		pageTable.Map(
 			usermem.Addr(ring0.KernelStartAddress|pr.virtual),
 			pr.length,
-			pagetables.MapOpts{AccessType: usermem.AnyAccess},
+			pagetables.MapOpts{AccessType: usermem.AnyAccess, Global: true},
 			pr.physical)
 
 		return true // Keep iterating.
diff --git a/pkg/sentry/platform/kvm/machine_arm64_unsafe.go b/pkg/sentry/platform/kvm/machine_arm64_unsafe.go
index 3f5be276b..67f7f88f2 100644
--- a/pkg/sentry/platform/kvm/machine_arm64_unsafe.go
+++ b/pkg/sentry/platform/kvm/machine_arm64_unsafe.go
@@ -79,7 +79,7 @@ func (c *vCPU) initArchState() error {
 	}
 
 	// tcr_el1
-	data = _TCR_TXSZ_VA48 | _TCR_CACHE_FLAGS | _TCR_SHARED | _TCR_TG_FLAGS | _TCR_ASID16 | _TCR_IPS_40BITS | _TCR_A1
+	data = _TCR_TXSZ_VA48 | _TCR_CACHE_FLAGS | _TCR_SHARED | _TCR_TG_FLAGS | _TCR_ASID16 | _TCR_IPS_40BITS
 	reg.id = _KVM_ARM64_REGS_TCR_EL1
 	if err := c.setOneRegister(&reg); err != nil {
 		return err
@@ -103,7 +103,7 @@ func (c *vCPU) initArchState() error {
 	c.SetTtbr0Kvm(uintptr(data))
 
 	// ttbr1_el1
-	data = c.machine.kernel.PageTables.TTBR1_EL1(false, 1)
+	data = c.machine.kernel.PageTables.TTBR1_EL1(false, 0)
 
 	reg.id = _KVM_ARM64_REGS_TTBR1_EL1
 	if err := c.setOneRegister(&reg); err != nil {
diff --git a/pkg/sentry/platform/ring0/entry_arm64.s b/pkg/sentry/platform/ring0/entry_arm64.s
index cf0bf3528..7529b3362 100644
--- a/pkg/sentry/platform/ring0/entry_arm64.s
+++ b/pkg/sentry/platform/ring0/entry_arm64.s
@@ -271,24 +271,20 @@
 	WORD $0xd538d092;   //MRS   TPIDR_EL1, R18
 
 // SWITCH_TO_APP_PAGETABLE sets a new pagetable for a container application.
-#define SWITCH_TO_APP_PAGETABLE(from) \
-	MRS TTBR1_EL1, R0; \
-	MOVD CPU_APP_ASID(from), R1; \
-	BFI $48, R1, $16, R0; \
-	MSR R0, TTBR1_EL1; \ // set the ASID in TTBR1_EL1 (since TCR.A1 is set)
-	ISB $15; \
-	MOVD CPU_TTBR0_APP(from), RSV_REG; \
-	MSR RSV_REG, TTBR0_EL1;
+#define SWITCH_TO_APP_PAGETABLE() \
+	MOVD CPU_APP_ASID(RSV_REG), RSV_REG_APP; \
+	MOVD CPU_TTBR0_APP(RSV_REG), RSV_REG; \
+	BFI $48, RSV_REG_APP, $16, RSV_REG; \
+	MSR RSV_REG, TTBR0_EL1; \
+	ISB $15;
 
 // SWITCH_TO_KVM_PAGETABLE sets the kvm pagetable.
-#define SWITCH_TO_KVM_PAGETABLE(from) \
-	MRS TTBR1_EL1, R0; \
-	MOVD $1, R1; \
-	BFI $48, R1, $16, R0; \
-	MSR R0, TTBR1_EL1; \
-	ISB $15; \
-	MOVD CPU_TTBR0_KVM(from), RSV_REG; \
-	MSR RSV_REG, TTBR0_EL1;
+#define SWITCH_TO_KVM_PAGETABLE() \
+	MOVD CPU_TTBR0_KVM(RSV_REG), RSV_REG; \
+	MOVD $1, RSV_REG_APP; \
+	BFI $48, RSV_REG_APP, $16, RSV_REG; \
+	MSR RSV_REG, TTBR0_EL1; \
+	ISB $15;
 
 TEXT ·EnableVFP(SB),NOSPLIT,$0
 	MOVD $FPEN_ENABLE, R0
@@ -496,7 +492,7 @@ do_exit_to_el0:
 
 	WORD $0xd538d092    //MRS   TPIDR_EL1, R18
 
-	SWITCH_TO_APP_PAGETABLE(RSV_REG)
+	SWITCH_TO_APP_PAGETABLE()
 
 	LDP 16*1(RSP), (R0, R1)
 	LDP 16*0(RSP), (RSV_REG, RSV_REG_APP)
@@ -521,10 +517,10 @@ TEXT ·kernelExitToEl1(SB),NOSPLIT,$0
 	MOVD CPU_REGISTERS+PTRACE_SP(RSV_REG), R1
 	MOVD R1, RSP
 
-	SWITCH_TO_KVM_PAGETABLE(RSV_REG)
+	REGISTERS_LOAD(RSV_REG, CPU_REGISTERS)
+	SWITCH_TO_KVM_PAGETABLE()
 	MRS TPIDR_EL1, RSV_REG
 
-	REGISTERS_LOAD(RSV_REG, CPU_REGISTERS)
 	MOVD CPU_REGISTERS+PTRACE_R9(RSV_REG), RSV_REG_APP
 
 	ERET()
@@ -532,8 +528,16 @@ TEXT ·kernelExitToEl1(SB),NOSPLIT,$0
 // Start is the CPU entrypoint.
 TEXT ·Start(SB),NOSPLIT,$0
 	// Init.
-	MOVD $SCTLR_EL1_DEFAULT, R1
-	MSR R1, SCTLR_EL1
+	WORD $0xd508871f    // __tlbi(vmalle1)
+	DSB $7          // dsb(nsh)
+
+	MOVD $1<<12, R1         // Reset mdscr_el1 and disable
+	MSR R1, MDSCR_EL1       // access to the DCC from EL0
+	ISB $15
+
+	MRS TTBR1_EL1, R1
+	MSR R1, TTBR0_EL1
+	ISB $15
 
 	MOVD $CNTKCTL_EL1_DEFAULT, R1
 	MSR R1, CNTKCTL_EL1
@@ -542,6 +546,15 @@ TEXT ·Start(SB),NOSPLIT,$0
 	ORR $0xffff000000000000, RSV_REG, RSV_REG
 	WORD $0xd518d092        //MSR R18, TPIDR_EL1
 
+	// Init.
+	MOVD $SCTLR_EL1_DEFAULT, R1 // re-enable the mmu.
+	MSR R1, SCTLR_EL1
+	ISB $15
+	WORD $0xd508751f // ic iallu
+
+	DSB $7          // dsb(nsh)
+	ISB $15
+
 	B ·kernelExitToEl1(SB)
 
 // El1_sync_invalid is the handler for an invalid EL1_sync.