Blackfin: fix MPU page permission masks overflow when dealing with async memory

Attempting to use the MPU while doing XIP out of parallel flash hooked up
to the async memory bus would often result in random crashes as the MPU
slowly corrupted memory.

The fallout here is that the async banks gain MPU protection from user
space too.  So any accesses have to go through the mmap() interface rather
than just using hardcoded pointers.

Signed-off-by: Barry Song <barry.song@analog.com>
Signed-off-by: Mike Frysinger <vapier@gentoo.org>

2 files changed, 27 insertions, 8 deletions

diff --git a/arch/blackfin/kernel/cplb-mpu/cplbmgr.c b/arch/blackfin/kernel/cplb-mpu/cplbmgr.c
index 930c01c06813..d4cc53a0ef89 100644
--- a/arch/blackfin/kernel/cplb-mpu/cplbmgr.c
+++ b/arch/blackfin/kernel/cplb-mpu/cplbmgr.c
@@ -114,10 +114,15 @@ static noinline int dcplb_miss(unsigned int cpu)
                 d_data = L2_DMEMORY;
         } else if (addr >= physical_mem_end) {
                 if (addr >= ASYNC_BANK0_BASE && addr < ASYNC_BANK3_BASE + ASYNC_BANK3_SIZE) {
-                        addr &= ~(4 * 1024 * 1024 - 1);
-                        d_data &= ~PAGE_SIZE_4KB;
-                        d_data |= PAGE_SIZE_4MB;
-                        d_data |= CPLB_USER_RD | CPLB_USER_WR;
+                        mask = current_rwx_mask[cpu];
+                        if (mask) {
+                                int page = (addr - (ASYNC_BANK0_BASE - _ramend)) >> PAGE_SHIFT;
+                                int idx = page >> 5;
+                                int bit = 1 << (page & 31);
+
+                                if (mask[idx] & bit)
+                                        d_data |= CPLB_USER_RD;
+                        }
                 } else if (addr >= BOOT_ROM_START && addr < BOOT_ROM_START + BOOT_ROM_LENGTH
                     && (status & (FAULT_RW | FAULT_USERSUPV)) == FAULT_USERSUPV) {
                         addr &= ~(1 * 1024 * 1024 - 1);
@@ -204,10 +209,19 @@ static noinline int icplb_miss(unsigned int cpu)
                 i_data = L2_IMEMORY;
         } else if (addr >= physical_mem_end) {
                 if (addr >= ASYNC_BANK0_BASE && addr < ASYNC_BANK3_BASE + ASYNC_BANK3_SIZE) {
-                        addr &= ~(4 * 1024 * 1024 - 1);
-                        i_data &= ~PAGE_SIZE_4KB;
-                        i_data |= PAGE_SIZE_4MB;
-                        i_data |= CPLB_USER_RD;
+                        if (!(status & FAULT_USERSUPV)) {
+                                unsigned long *mask = current_rwx_mask[cpu];
+
+                                if (mask) {
+                                        int page = (addr - (ASYNC_BANK0_BASE - _ramend)) >> PAGE_SHIFT;
+                                        int idx = page >> 5;
+                                        int bit = 1 << (page & 31);
+
+                                        mask += 2 * page_mask_nelts;
+                                        if (mask[idx] & bit)
+                                                i_data |= CPLB_USER_RD;
+                                }
+                        }
                 } else if (addr >= BOOT_ROM_START && addr < BOOT_ROM_START + BOOT_ROM_LENGTH
                     && (status & FAULT_USERSUPV)) {
                         addr &= ~(1 * 1024 * 1024 - 1);
diff --git a/arch/blackfin/kernel/setup.c b/arch/blackfin/kernel/setup.c
index 69cbc1a81201..8dc7ee1ef336 100644
--- a/arch/blackfin/kernel/setup.c
+++ b/arch/blackfin/kernel/setup.c
@@ -597,7 +597,12 @@ static __init void memory_setup(void)
         }
 
 #ifdef CONFIG_MPU
+#if defined(CONFIG_ROMFS_ON_MTD) && defined(CONFIG_MTD_ROM)
+        page_mask_nelts = (((_ramend + ASYNC_BANK3_BASE + ASYNC_BANK3_SIZE -
+                                        ASYNC_BANK0_BASE) >> PAGE_SHIFT) + 31) / 32;
+#else
         page_mask_nelts = ((_ramend >> PAGE_SHIFT) + 31) / 32;
+#endif
         page_mask_order = get_order(3 * page_mask_nelts * sizeof(long));
 #endif