ARM: 7954/1: mm: remove remaining domain support from ARMv6

CPU_32v6 currently selects CPU_USE_DOMAINS if CPU_V6 and MMU. This is
because ARM 1136 r0pX CPUs lack the v6k extensions, and therefore do
not have hardware thread registers. The lack of these registers requires
the kernel to update the vectors page at each context switch in order to
write a new TLS pointer. This write must be done via the userspace
mapping, since aliasing caches can lead to expensive flushing when using
kmap. Finally, this requires the vectors page to be mapped r/w for
kernel and r/o for user, which has implications for things like put_user
which must trigger CoW appropriately when targetting user pages.

The upshot of all this is that a v6/v7 kernel makes use of domains to
segregate kernel and user memory accesses. This has the nasty
side-effect of making device mappings executable, which has been
observed to cause subtle bugs on recent cores (e.g. Cortex-A15
performing a speculative instruction fetch from the GIC and acking an
interrupt in the process).

This patch solves this problem by removing the remaining domain support
from ARMv6. A new memory type is added specifically for the vectors page
which allows that page (and only that page) to be mapped as user r/o,
kernel r/w. All other user r/o pages are mapped also as kernel r/o.
Patch co-developed with Russell King.

Cc: <stable@vger.kernel.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

1 files changed, 6 insertions, 13 deletions

diff --git a/arch/arm/mm/proc-macros.S b/arch/arm/mm/proc-macros.S
index e3c48a3fe063..ee1d80593958 100644
--- a/arch/arm/mm/proc-macros.S
+++ b/arch/arm/mm/proc-macros.S
@@ -112,13 +112,9 @@
  *  100x   1   0   1    r/o     no acc
  *  10x0   1   0   1    r/o     no acc
  *  1011   0   0   1    r/w     no acc
- *  110x   0   1   0    r/w     r/o
- *  11x0   0   1   0    r/w     r/o
- *  1111   0   1   1    r/w     r/w
- *
- * If !CONFIG_CPU_USE_DOMAINS, the following permissions are changed:
  *  110x   1   1   1    r/o     r/o
  *  11x0   1   1   1    r/o     r/o
+ *  1111   0   1   1    r/w     r/w
  */
         .macro  armv6_mt_table pfx
 \pfx\()_mt_table:
@@ -137,7 +133,7 @@
         .long   PTE_EXT_TEX(2)                                  @ L_PTE_MT_DEV_NONSHARED
         .long   0x00                                            @ unused
         .long   0x00                                            @ unused
-        .long   0x00                                            @ unused
+        .long   PTE_CACHEABLE | PTE_BUFFERABLE | PTE_EXT_APX    @ L_PTE_MT_VECTORS
         .endm
 
         .macro  armv6_set_pte_ext pfx
@@ -158,24 +154,21 @@
 
         tst     r1, #L_PTE_USER
         orrne   r3, r3, #PTE_EXT_AP1
-#ifdef CONFIG_CPU_USE_DOMAINS
-        @ allow kernel read/write access to read-only user pages
         tstne   r3, #PTE_EXT_APX
-        bicne   r3, r3, #PTE_EXT_APX | PTE_EXT_AP0
-#endif
+
+        @ user read-only -> kernel read-only
+        bicne   r3, r3, #PTE_EXT_AP0
 
         tst     r1, #L_PTE_XN
         orrne   r3, r3, #PTE_EXT_XN
 
-        orr     r3, r3, r2
+        eor     r3, r3, r2
 
         tst     r1, #L_PTE_YOUNG
         tstne   r1, #L_PTE_PRESENT
         moveq   r3, #0
-#ifndef CONFIG_CPU_USE_DOMAINS
         tstne   r1, #L_PTE_NONE
         movne   r3, #0
-#endif
 
         str     r3, [r0]
         mcr     p15, 0, r0, c7, c10, 1          @ flush_pte