ARM: mm: introduce present, faulting entries for PAGE_NONE

PROT_NONE mappings apply the page protection attributes defined by _P000
which translate to PAGE_NONE for ARM. These attributes specify an XN,
RDONLY pte that is inaccessible to userspace. However, on kernels
configured without support for domains, such a pte *is* accessible to
the kernel and can be read via get_user, allowing tasks to read
PROT_NONE pages via syscalls such as read/write over a pipe.

This patch introduces a new software pte flag, L_PTE_NONE, that is set
to identify faulting, present entries.

Signed-off-by: Will Deacon <will.deacon@arm.com>

3 files changed, 11 insertions, 0 deletions

diff --git a/arch/arm/mm/proc-macros.S b/arch/arm/mm/proc-macros.S
index b29a2265af01..eb6aa73bc8b7 100644
--- a/arch/arm/mm/proc-macros.S
+++ b/arch/arm/mm/proc-macros.S
@@ -167,6 +167,10 @@
         tst     r1, #L_PTE_YOUNG
         tstne   r1, #L_PTE_PRESENT
         moveq   r3, #0
+#ifndef CONFIG_CPU_USE_DOMAINS
+        tstne   r1, #L_PTE_NONE
+        movne   r3, #0
+#endif
 
         str     r3, [r0]
         mcr     p15, 0, r0, c7, c10, 1          @ flush_pte
diff --git a/arch/arm/mm/proc-v7-2level.S b/arch/arm/mm/proc-v7-2level.S
index e755e9f8d1b4..6d98c13ab827 100644
--- a/arch/arm/mm/proc-v7-2level.S
+++ b/arch/arm/mm/proc-v7-2level.S
@@ -101,6 +101,10 @@ ENTRY(cpu_v7_set_pte_ext)
 
         tst     r1, #L_PTE_YOUNG
         tstne   r1, #L_PTE_VALID
+#ifndef CONFIG_CPU_USE_DOMAINS
+        eorne   r1, r1, #L_PTE_NONE
+        tstne   r1, #L_PTE_NONE
+#endif
         moveq   r3, #0
 
  ARM(   str     r3, [r0, #2048]! )
diff --git a/arch/arm/mm/proc-v7-3level.S b/arch/arm/mm/proc-v7-3level.S
index d23d067e1904..7b56386f9496 100644
--- a/arch/arm/mm/proc-v7-3level.S
+++ b/arch/arm/mm/proc-v7-3level.S
@@ -67,6 +67,9 @@ ENTRY(cpu_v7_set_pte_ext)
 #ifdef CONFIG_MMU
         tst     r2, #L_PTE_VALID
         beq     1f
+        tst     r3, #1 << (57 - 32)             @ L_PTE_NONE
+        bicne   r2, #L_PTE_VALID
+        bne     1f
         tst     r3, #1 << (55 - 32)             @ L_PTE_DIRTY
         orreq   r2, #L_PTE_RDONLY
 1:      strd    r2, r3, [r0]