Add the arm64 table attributes and use them

[andrew]

Summary

Add the table page table attributes on arm64 and use them to add
restrictions to the block and page entries below them. This ensures
we are unable to increase the permissions in these last level entries
without also changing them in the upper levels.

Use the attributes to ensure the kernel can't execute from userspace
memory and vice versa, userspace has no access to read or write kernel
memory, and that the DMAP region is non-executable.

[markj]

sys/arm64/arm64/pmap.c

1885

1888

I would suggest adding a note to the effect that this is done for bootstrap L0 entries in locore. And maybe we should assert it in pmap_bootstrap().

[kib]

Where are bits 59/60 described in the ARMARM?

[alc]

sys/arm64/include/pte.h

41

[andrew]

In D32081#725184, @kib wrote:

Where are bits 59/60 described in the ARMARM?

The bits are defined as UXNTable and PXNTable in D5.3.3 Memory attribute fields in the VMSAv8-64 translation table format descriptors under the Next-level attributes in stage 1 VMSAv8-64 Table descriptors header (at least in G.b). This also points to Hierarchical control of instruction fetching in D5.4.6 Access permissions for instruction execution.

[andrew]

Update from feedback

[alc]

sys/arm64/arm64/pmap.c

1877

A stylistic suggestion: Use l0e instead of l0. A few lines later, in the same function, we use the same variable name, l0, as a pointer instead of a value. In general, I'd like to suggest that going forward new or revised code use names of the form l0p or l0e.