7 files changed, 45 insertions, 143 deletions

diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c
index a94d75fef598..a917e3dd3666 100644
--- a/arch/arm/kernel/signal.c
+++ b/arch/arm/kernel/signal.c
@@ -139,93 +139,33 @@ struct iwmmxt_sigframe {
         unsigned long   storage[0x98/4];
 };
 
-static int page_present(struct mm_struct *mm, void __user *uptr, int wr)
-{
-        unsigned long addr = (unsigned long)uptr;
-        pgd_t *pgd = pgd_offset(mm, addr);
-        if (pgd_present(*pgd)) {
-                pmd_t *pmd = pmd_offset(pgd, addr);
-                if (pmd_present(*pmd)) {
-                        pte_t *pte = pte_offset_map(pmd, addr);
-                        return (pte_present(*pte) && (!wr || pte_write(*pte)));
-                }
-        }
-        return 0;
-}
-
-static int copy_locked(void __user *uptr, void *kptr, size_t size, int write,
-                       void (*copyfn)(void *, void __user *))
-{
-        unsigned char v, __user *userptr = uptr;
-        int err = 0;
-
-        do {
-                struct mm_struct *mm;
-
-                if (write) {
-                        __put_user_error(0, userptr, err);
-                        __put_user_error(0, userptr + size - 1, err);
-                } else {
-                        __get_user_error(v, userptr, err);
-                        __get_user_error(v, userptr + size - 1, err);
-                }
-
-                if (err)
-                        break;
-
-                mm = current->mm;
-                spin_lock(&mm->page_table_lock);
-                if (page_present(mm, userptr, write) &&
-                    page_present(mm, userptr + size - 1, write)) {
-                        copyfn(kptr, uptr);
-                } else
-                        err = 1;
-                spin_unlock(&mm->page_table_lock);
-        } while (err);
-
-        return err;
-}
-
 static int preserve_iwmmxt_context(struct iwmmxt_sigframe *frame)
 {
-        int err = 0;
+        char kbuf[sizeof(*frame) + 8];
+        struct iwmmxt_sigframe *kframe;
 
         /* the iWMMXt context must be 64 bit aligned */
-        WARN_ON((unsigned long)frame & 7);
-
-        __put_user_error(IWMMXT_MAGIC0, &frame->magic0, err);
-        __put_user_error(IWMMXT_MAGIC1, &frame->magic1, err);
-
-        /*
-         * iwmmxt_task_copy() doesn't check user permissions.
-         * Let's do a dummy write on the upper boundary to ensure
-         * access to user mem is OK all way up.
-         */
-        err |= copy_locked(&frame->storage, current_thread_info(),
-                           sizeof(frame->storage), 1, iwmmxt_task_copy);
-        return err;
+        kframe = (struct iwmmxt_sigframe *)((unsigned long)(kbuf + 8) & ~7);
+        kframe->magic0 = IWMMXT_MAGIC0;
+        kframe->magic1 = IWMMXT_MAGIC1;
+        iwmmxt_task_copy(current_thread_info(), &kframe->storage);
+        return __copy_to_user(frame, kframe, sizeof(*frame));
 }
 
 static int restore_iwmmxt_context(struct iwmmxt_sigframe *frame)
 {
-        unsigned long magic0, magic1;
-        int err = 0;
+        char kbuf[sizeof(*frame) + 8];
+        struct iwmmxt_sigframe *kframe;
 
-        /* the iWMMXt context is 64 bit aligned */
-        WARN_ON((unsigned long)frame & 7);
-
-        /*
-         * Validate iWMMXt context signature.
-         * Also, iwmmxt_task_restore() doesn't check user permissions.
-         * Let's do a dummy write on the upper boundary to ensure
-         * access to user mem is OK all way up.
-         */
-        __get_user_error(magic0, &frame->magic0, err);
-        __get_user_error(magic1, &frame->magic1, err);
-        if (!err && magic0 == IWMMXT_MAGIC0 && magic1 == IWMMXT_MAGIC1)
-                err = copy_locked(&frame->storage, current_thread_info(),
-                                  sizeof(frame->storage), 0, iwmmxt_task_restore);
-        return err;
+        /* the iWMMXt context must be 64 bit aligned */
+        kframe = (struct iwmmxt_sigframe *)((unsigned long)(kbuf + 8) & ~7);
+        if (__copy_from_user(kframe, frame, sizeof(*frame)))
+                return -1;
+        if (kframe->magic0 != IWMMXT_MAGIC0 ||
+            kframe->magic1 != IWMMXT_MAGIC1)
+                return -1;
+        iwmmxt_task_restore(current_thread_info(), &kframe->storage);
+        return 0;
 }
 
 #endif
diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
index baa09601a64e..66e5a0516f23 100644
--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -483,29 +483,33 @@ asmlinkage int arm_syscall(int no, struct pt_regs *regs)
                 unsigned long addr = regs->ARM_r2;
                 struct mm_struct *mm = current->mm;
                 pgd_t *pgd; pmd_t *pmd; pte_t *pte;
+                spinlock_t *ptl;
 
                 regs->ARM_cpsr &= ~PSR_C_BIT;
-                spin_lock(&mm->page_table_lock);
+                down_read(&mm->mmap_sem);
                 pgd = pgd_offset(mm, addr);
                 if (!pgd_present(*pgd))
                         goto bad_access;
                 pmd = pmd_offset(pgd, addr);
                 if (!pmd_present(*pmd))
                         goto bad_access;
-                pte = pte_offset_map(pmd, addr);
-                if (!pte_present(*pte) || !pte_write(*pte))
+                pte = pte_offset_map_lock(mm, pmd, addr, &ptl);
+                if (!pte_present(*pte) || !pte_write(*pte)) {
+                        pte_unmap_unlock(pte, ptl);
                         goto bad_access;
+                }
                 val = *(unsigned long *)addr;
                 val -= regs->ARM_r0;
                 if (val == 0) {
                         *(unsigned long *)addr = regs->ARM_r1;
                         regs->ARM_cpsr |= PSR_C_BIT;
                 }
-                spin_unlock(&mm->page_table_lock);
+                pte_unmap_unlock(pte, ptl);
+                up_read(&mm->mmap_sem);
                 return val;
 
                 bad_access:
-                spin_unlock(&mm->page_table_lock);
+                up_read(&mm->mmap_sem);
                 /* simulate a write access fault */
                 do_DataAbort(addr, 15 + (1 << 11), regs);
                 return -1;
diff --git a/arch/arm/mm/consistent.c b/arch/arm/mm/consistent.c
index 82f4d5e27c54..47b0b767f080 100644
--- a/arch/arm/mm/consistent.c
+++ b/arch/arm/mm/consistent.c
@@ -397,8 +397,6 @@ static int __init consistent_init(void)
         pte_t *pte;
         int ret = 0;
 
-        spin_lock(&init_mm.page_table_lock);
-
         do {
                 pgd = pgd_offset(&init_mm, CONSISTENT_BASE);
                 pmd = pmd_alloc(&init_mm, pgd, CONSISTENT_BASE);
@@ -409,7 +407,7 @@ static int __init consistent_init(void)
                 }
                 WARN_ON(!pmd_none(*pmd));
 
-                pte = pte_alloc_kernel(&init_mm, pmd, CONSISTENT_BASE);
+                pte = pte_alloc_kernel(pmd, CONSISTENT_BASE);
                 if (!pte) {
                         printk(KERN_ERR "%s: no pte tables\n", __func__);
                         ret = -ENOMEM;
@@ -419,8 +417,6 @@ static int __init consistent_init(void)
                 consistent_pte = pte;
         } while (0);
 
-        spin_unlock(&init_mm.page_table_lock);
-
         return ret;
 }
 
diff --git a/arch/arm/mm/fault-armv.c b/arch/arm/mm/fault-armv.c
index be4ab3d73c91..7fc1b35a6746 100644
--- a/arch/arm/mm/fault-armv.c
+++ b/arch/arm/mm/fault-armv.c
@@ -26,6 +26,11 @@ static unsigned long shared_pte_mask = L_PTE_CACHEABLE;
 /*
  * We take the easy way out of this problem - we make the
  * PTE uncacheable.  However, we leave the write buffer on.
+ *
+ * Note that the pte lock held when calling update_mmu_cache must also
+ * guard the pte (somewhere else in the same mm) that we modify here.
+ * Therefore those configurations which might call adjust_pte (those
+ * without CONFIG_CPU_CACHE_VIPT) cannot support split page_table_lock.
  */
 static int adjust_pte(struct vm_area_struct *vma, unsigned long address)
 {
@@ -127,7 +132,7 @@ void __flush_dcache_page(struct address_space *mapping, struct page *page);
  *  2. If we have multiple shared mappings of the same space in
  *     an object, we need to deal with the cache aliasing issues.
  *
- * Note that the page_table_lock will be held.
+ * Note that the pte lock will be held.
  */
 void update_mmu_cache(struct vm_area_struct *vma, unsigned long addr, pte_t pte)
 {
diff --git a/arch/arm/mm/ioremap.c b/arch/arm/mm/ioremap.c
index 6fb1258df1b5..0f128c28fee4 100644
--- a/arch/arm/mm/ioremap.c
+++ b/arch/arm/mm/ioremap.c
@@ -75,7 +75,7 @@ remap_area_pmd(pmd_t * pmd, unsigned long address, unsigned long size,
 
         pgprot = __pgprot(L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY | L_PTE_WRITE | flags);
         do {
-                pte_t * pte = pte_alloc_kernel(&init_mm, pmd, address);
+                pte_t * pte = pte_alloc_kernel(pmd, address);
                 if (!pte)
                         return -ENOMEM;
                 remap_area_pte(pte, address, end - address, address + phys_addr, pgprot);
@@ -97,7 +97,6 @@ remap_area_pages(unsigned long start, unsigned long phys_addr,
         phys_addr -= address;
         dir = pgd_offset(&init_mm, address);
         BUG_ON(address >= end);
-        spin_lock(&init_mm.page_table_lock);
         do {
                 pmd_t *pmd = pmd_alloc(&init_mm, dir, address);
                 if (!pmd) {
@@ -114,7 +113,6 @@ remap_area_pages(unsigned long start, unsigned long phys_addr,
                 dir++;
         } while (address && (address < end));
 
-        spin_unlock(&init_mm.page_table_lock);
         flush_cache_vmap(start, end);
         return err;
 }
diff --git a/arch/arm/mm/mm-armv.c b/arch/arm/mm/mm-armv.c
index 61bc2fa0511e..1221fdde1769 100644
--- a/arch/arm/mm/mm-armv.c
+++ b/arch/arm/mm/mm-armv.c
@@ -180,11 +180,6 @@ pgd_t *get_pgd_slow(struct mm_struct *mm)
 
         if (!vectors_high()) {
                 /*
-                 * This lock is here just to satisfy pmd_alloc and pte_lock
-                 */
-                spin_lock(&mm->page_table_lock);
-
-                /*
                  * On ARM, first page must always be allocated since it
                  * contains the machine vectors.
                  */
@@ -201,23 +196,14 @@ pgd_t *get_pgd_slow(struct mm_struct *mm)
                 set_pte(new_pte, *init_pte);
                 pte_unmap_nested(init_pte);
                 pte_unmap(new_pte);
-
-                spin_unlock(&mm->page_table_lock);
         }
 
         return new_pgd;
 
 no_pte:
-        spin_unlock(&mm->page_table_lock);
         pmd_free(new_pmd);
-        free_pages((unsigned long)new_pgd, 2);
-        return NULL;
-
 no_pmd:
-        spin_unlock(&mm->page_table_lock);
         free_pages((unsigned long)new_pgd, 2);
-        return NULL;
-
 no_pgd:
         return NULL;
 }
@@ -243,6 +229,7 @@ void free_pgd_slow(pgd_t *pgd)
         pte = pmd_page(*pmd);
         pmd_clear(pmd);
         dec_page_state(nr_page_table_pages);
+        pte_lock_deinit(pte);
         pte_free(pte);
         pmd_free(pmd);
 free:
diff --git a/arch/arm/oprofile/backtrace.c b/arch/arm/oprofile/backtrace.c
index df35c452a8bf..7c22c12618cc 100644
--- a/arch/arm/oprofile/backtrace.c
+++ b/arch/arm/oprofile/backtrace.c
@@ -49,42 +49,22 @@ static struct frame_tail* kernel_backtrace(struct frame_tail *tail)
 
 static struct frame_tail* user_backtrace(struct frame_tail *tail)
 {
-        struct frame_tail buftail;
+        struct frame_tail buftail[2];
 
-        /* hardware pte might not be valid due to dirty/accessed bit emulation
-         * so we use copy_from_user and benefit from exception fixups */
-        if (copy_from_user(&buftail, tail, sizeof(struct frame_tail)))
+        /* Also check accessibility of one struct frame_tail beyond */
+        if (!access_ok(VERIFY_READ, tail, sizeof(buftail)))
+                return NULL;
+        if (__copy_from_user_inatomic(buftail, tail, sizeof(buftail)))
                 return NULL;
 
-        oprofile_add_trace(buftail.lr);
+        oprofile_add_trace(buftail[0].lr);
 
         /* frame pointers should strictly progress back up the stack
          * (towards higher addresses) */
-        if (tail >= buftail.fp)
+        if (tail >= buftail[0].fp)
                 return NULL;
 
-        return buftail.fp-1;
-}
-
-/* Compare two addresses and see if they're on the same page */
-#define CMP_ADDR_EQUAL(x,y,offset) ((((unsigned long) x) >> PAGE_SHIFT) \
-        == ((((unsigned long) y) + offset) >> PAGE_SHIFT))
-
-/* check that the page(s) containing the frame tail are present */
-static int pages_present(struct frame_tail *tail)
-{
-        struct mm_struct * mm = current->mm;
-
-        if (!check_user_page_readable(mm, (unsigned long)tail))
-                return 0;
-
-        if (CMP_ADDR_EQUAL(tail, tail, 8))
-                return 1;
-
-        if (!check_user_page_readable(mm, ((unsigned long)tail) + 8))
-                return 0;
-
-        return 1;
+        return buftail[0].fp-1;
 }
 
 /*
@@ -118,7 +98,6 @@ static int valid_kernel_stack(struct frame_tail *tail, struct pt_regs *regs)
 void arm_backtrace(struct pt_regs * const regs, unsigned int depth)
 {
         struct frame_tail *tail;
-        unsigned long last_address = 0;
 
         tail = ((struct frame_tail *) regs->ARM_fp) - 1;
 
@@ -132,13 +111,6 @@ void arm_backtrace(struct pt_regs * const regs, unsigned int depth)
                 return;
         }
 
-        while (depth-- && tail && !((unsigned long) tail & 3)) {
-                if ((!CMP_ADDR_EQUAL(last_address, tail, 0)
-                        || !CMP_ADDR_EQUAL(last_address, tail, 8))
-                                && !pages_present(tail))
-                        return;
-                last_address = (unsigned long) tail;
+        while (depth-- && tail && !((unsigned long) tail & 3))
                 tail = user_backtrace(tail);
-        }
 }
-