arch/arm64: Synchronize the TTBR0 write before the TLB invalidation. - #20500

Summary

mmu_write_ttbr0() writes TTBR0_EL1 and then invalidates the TLB. A write to TTBR0_EL1 takes effect only at the next context synchronization event, so until the ISB at the end of the invalidation, a table walk can still use the old table. The instruction fetches of the invalidation sequence itself do such walks. An entry that they cache after the TLBI completes stays valid, because walk cache entries are not tagged with the table base, and the kernel and every process use ASID 0.

In a kernel build, a user address of the new process is then translated through a level 0 entry of the old table, and the translation fails at level 1.

This PR adds an ISB after the write. This gives the Arm ARM sequence for a TTBR change without an ASID change: write, ISB, TLBI, DSB, ISB.

Impact

arm64 builds with CONFIG_ARCH_ADDRENV only: mmu_write_ttbr0() is called only by up_addrenv_select(). The cost is one ISB per address environment switch.

Testing

QEMU 11.0.0 with HVF (-accel hvf -cpu host) on an Apple M4, so the guest runs on real Arm cores. qemu-armv8a:knsh with CONFIG_ARCH_CHIP_QEMU_WITH_HV, and its applications on a virtio-9p share in place of semihosting, which HVF does not have. This needs #20498 and #20499.

Before this PR, every boot (5 of 5) stops when the kernel loads /system/bin/init:

qemu-system-aarch64: virtio: bogus descriptor or out of resources

up_addrenv_va_to_pa() of the first user buffer (0xc0001000) returns 0, so the descriptor has address 0. A record of each call, read with gdb after the failure, shows PAR_EL1 = 0x80b, a stage 1 translation fault at level 1. The level 0 and level 1 entries in memory are valid at that time, and they were written and invalidated before the TTBR0 switch. One more TLBI just before the AT makes the same translation succeed. A gdb breakpoint hides the failure, because the exception synchronizes the context.

A broadcast TLBI (tlbi vmalle1is, dsb ish) in place of the local one does not help. The ISB after the TTBR0 write does: 5 of 5 boots reach NSH, and ostest with POSIX fork() (#19773) exits with status 0, with CONFIG_TESTING_OSTEST_RR_RUNS=2000. With the default of 10 runs, the round robin test fails on this fast host, because each run completes within one time slice.

Under TCG, ostest on the same image exits with status 0, as before. TCG has no walk caches, so it does not show the problem.

tools/checkpatch.sh -c -u -m -g passes.