04 Nov, 2010

1 commit

  • This patch removes the domain switching functionality via the set_fs and
    __switch_to functions on cores that have a TLS register.

    Currently, the ioremap and vmalloc areas share the same level 1 page
    tables and therefore have the same domain (DOMAIN_KERNEL). When the
    kernel domain is modified from Client to Manager (via the __set_fs or in
    the __switch_to function), the XN (eXecute Never) bit is overridden and
    newer CPUs can speculatively prefetch the ioremap'ed memory.

    Linux performs the kernel domain switching to allow user-specific
    functions (copy_to/from_user, get/put_user etc.) to access kernel
    memory. In order for these functions to work with the kernel domain set
    to Client, the patch modifies the LDRT/STRT and related instructions to
    the LDR/STR ones.

    The user pages access rights are also modified for kernel read-only
    access rather than read/write so that the copy-on-write mechanism still
    works. CPU_USE_DOMAINS gets disabled only if the hardware has a TLS register
    (CPU_32v6K is defined) since writing the TLS value to the high vectors page
    isn't possible.

    The user addresses passed to the kernel are checked by the access_ok()
    function so that they do not point to the kernel space.

    Tested-by: Anton Vorontsov
    Cc: Tony Lindgren
    Signed-off-by: Catalin Marinas
    Signed-off-by: Russell King

    Catalin Marinas
     

03 Aug, 2008

1 commit