1 files changed, 75 insertions, 34 deletions

diff --git a/arch/blackfin/kernel/process.c b/arch/blackfin/kernel/process.c
index 5cc7e2e9e415..93ec07da2e51 100644
--- a/arch/blackfin/kernel/process.c
+++ b/arch/blackfin/kernel/process.c
@@ -11,6 +11,7 @@
 #include <linux/unistd.h>
 #include <linux/user.h>
 #include <linux/uaccess.h>
+#include <linux/slab.h>
 #include <linux/sched.h>
 #include <linux/tick.h>
 #include <linux/fs.h>
@@ -98,13 +99,6 @@ void cpu_idle(void)
         }
 }
 
-/* Fill in the fpu structure for a core dump.  */
-
-int dump_fpu(struct pt_regs *regs, elf_fpregset_t * fpregs)
-{
-        return 1;
-}
-
 /*
  * This gets run with P1 containing the
  * function to call, and R1 containing
@@ -215,22 +209,18 @@ copy_thread(unsigned long clone_flags,
 /*
  * sys_execve() executes a new program.
  */
-
 asmlinkage int sys_execve(char __user *name, char __user * __user *argv, char __user * __user *envp)
 {
         int error;
         char *filename;
         struct pt_regs *regs = (struct pt_regs *)((&name) + 6);
 
-        lock_kernel();
         filename = getname(name);
         error = PTR_ERR(filename);
         if (IS_ERR(filename))
-                goto out;
+                return error;
         error = do_execve(filename, argv, envp, regs);
         putname(filename);
- out:
-        unlock_kernel();
         return error;
 }
 
@@ -262,9 +252,12 @@ void finish_atomic_sections (struct pt_regs *regs)
         int __user *up0 = (int __user *)regs->p0;
 
         switch (regs->pc) {
+        default:
+                /* not in middle of an atomic step, so resume like normal */
+                return;
+
         case ATOMIC_XCHG32 + 2:
                 put_user(regs->r1, up0);
-                regs->pc = ATOMIC_XCHG32 + 4;
                 break;
 
         case ATOMIC_CAS32 + 2:
@@ -272,7 +265,6 @@ void finish_atomic_sections (struct pt_regs *regs)
                 if (regs->r0 == regs->r1)
         case ATOMIC_CAS32 + 6:
                         put_user(regs->r2, up0);
-                regs->pc = ATOMIC_CAS32 + 8;
                 break;
 
         case ATOMIC_ADD32 + 2:
@@ -280,7 +272,6 @@ void finish_atomic_sections (struct pt_regs *regs)
                 /* fall through */
         case ATOMIC_ADD32 + 4:
                 put_user(regs->r0, up0);
-                regs->pc = ATOMIC_ADD32 + 6;
                 break;
 
         case ATOMIC_SUB32 + 2:
@@ -288,7 +279,6 @@ void finish_atomic_sections (struct pt_regs *regs)
                 /* fall through */
         case ATOMIC_SUB32 + 4:
                 put_user(regs->r0, up0);
-                regs->pc = ATOMIC_SUB32 + 6;
                 break;
 
         case ATOMIC_IOR32 + 2:
@@ -296,7 +286,6 @@ void finish_atomic_sections (struct pt_regs *regs)
                 /* fall through */
         case ATOMIC_IOR32 + 4:
                 put_user(regs->r0, up0);
-                regs->pc = ATOMIC_IOR32 + 6;
                 break;
 
         case ATOMIC_AND32 + 2:
@@ -304,7 +293,6 @@ void finish_atomic_sections (struct pt_regs *regs)
                 /* fall through */
         case ATOMIC_AND32 + 4:
                 put_user(regs->r0, up0);
-                regs->pc = ATOMIC_AND32 + 6;
                 break;
 
         case ATOMIC_XOR32 + 2:
@@ -312,9 +300,15 @@ void finish_atomic_sections (struct pt_regs *regs)
                 /* fall through */
         case ATOMIC_XOR32 + 4:
                 put_user(regs->r0, up0);
-                regs->pc = ATOMIC_XOR32 + 6;
                 break;
         }
+
+        /*
+         * We've finished the atomic section, and the only thing left for
+         * userspace is to do a RTS, so we might as well handle that too
+         * since we need to update the PC anyways.
+         */
+        regs->pc = regs->rets;
 }
 
 static inline
@@ -336,12 +330,58 @@ int in_mem_const(unsigned long addr, unsigned long size,
 {
         return in_mem_const_off(addr, size, 0, const_addr, const_size);
 }
-#define IN_ASYNC(bnum, bctlnum) \
+#define ASYNC_ENABLED(bnum, bctlnum) \
 ({ \
-        (bfin_read_EBIU_AMGCTL() & 0xe) < ((bnum + 1) << 1) ? -EFAULT : \
-        bfin_read_EBIU_AMBCTL##bctlnum() & B##bnum##RDYEN ? -EFAULT : \
-        BFIN_MEM_ACCESS_CORE; \
+        (bfin_read_EBIU_AMGCTL() & 0xe) < ((bnum + 1) << 1) ? 0 : \
+        bfin_read_EBIU_AMBCTL##bctlnum() & B##bnum##RDYEN ? 0 : \
+        1; \
 })
+/*
+ * We can't read EBIU banks that aren't enabled or we end up hanging
+ * on the access to the async space.  Make sure we validate accesses
+ * that cross async banks too.
+ *      0 - found, but unusable
+ *      1 - found & usable
+ *      2 - not found
+ */
+static
+int in_async(unsigned long addr, unsigned long size)
+{
+        if (addr >= ASYNC_BANK0_BASE && addr < ASYNC_BANK0_BASE + ASYNC_BANK0_SIZE) {
+                if (!ASYNC_ENABLED(0, 0))
+                        return 0;
+                if (addr + size <= ASYNC_BANK0_BASE + ASYNC_BANK0_SIZE)
+                        return 1;
+                size -= ASYNC_BANK0_BASE + ASYNC_BANK0_SIZE - addr;
+                addr = ASYNC_BANK0_BASE + ASYNC_BANK0_SIZE;
+        }
+        if (addr >= ASYNC_BANK1_BASE && addr < ASYNC_BANK1_BASE + ASYNC_BANK1_SIZE) {
+                if (!ASYNC_ENABLED(1, 0))
+                        return 0;
+                if (addr + size <= ASYNC_BANK1_BASE + ASYNC_BANK1_SIZE)
+                        return 1;
+                size -= ASYNC_BANK1_BASE + ASYNC_BANK1_SIZE - addr;
+                addr = ASYNC_BANK1_BASE + ASYNC_BANK1_SIZE;
+        }
+        if (addr >= ASYNC_BANK2_BASE && addr < ASYNC_BANK2_BASE + ASYNC_BANK2_SIZE) {
+                if (!ASYNC_ENABLED(2, 1))
+                        return 0;
+                if (addr + size <= ASYNC_BANK2_BASE + ASYNC_BANK2_SIZE)
+                        return 1;
+                size -= ASYNC_BANK2_BASE + ASYNC_BANK2_SIZE - addr;
+                addr = ASYNC_BANK2_BASE + ASYNC_BANK2_SIZE;
+        }
+        if (addr >= ASYNC_BANK3_BASE && addr < ASYNC_BANK3_BASE + ASYNC_BANK3_SIZE) {
+                if (ASYNC_ENABLED(3, 1))
+                        return 0;
+                if (addr + size <= ASYNC_BANK3_BASE + ASYNC_BANK3_SIZE)
+                        return 1;
+                return 0;
+        }
+
+        /* not within async bounds */
+        return 2;
+}
 
 int bfin_mem_access_type(unsigned long addr, unsigned long size)
 {
@@ -378,17 +418,11 @@ int bfin_mem_access_type(unsigned long addr, unsigned long size)
         if (addr >= SYSMMR_BASE)
                 return BFIN_MEM_ACCESS_CORE_ONLY;
 
-        /* We can't read EBIU banks that aren't enabled or we end up hanging
-         * on the access to the async space.
-         */
-        if (in_mem_const(addr, size, ASYNC_BANK0_BASE, ASYNC_BANK0_SIZE))
-                return IN_ASYNC(0, 0);
-        if (in_mem_const(addr, size, ASYNC_BANK1_BASE, ASYNC_BANK1_SIZE))
-                return IN_ASYNC(1, 0);
-        if (in_mem_const(addr, size, ASYNC_BANK2_BASE, ASYNC_BANK2_SIZE))
-                return IN_ASYNC(2, 1);
-        if (in_mem_const(addr, size, ASYNC_BANK3_BASE, ASYNC_BANK3_SIZE))
-                return IN_ASYNC(3, 1);
+        switch (in_async(addr, size)) {
+        case 0: return -EFAULT;
+        case 1: return BFIN_MEM_ACCESS_CORE;
+        case 2: /* fall through */;
+        }
 
         if (in_mem_const(addr, size, BOOT_ROM_START, BOOT_ROM_LENGTH))
                 return BFIN_MEM_ACCESS_CORE;
@@ -405,6 +439,8 @@ __attribute__((l1_text))
 /* Return 1 if access to memory range is OK, 0 otherwise */
 int _access_ok(unsigned long addr, unsigned long size)
 {
+        int aret;
+
         if (size == 0)
                 return 1;
         /* Check that things do not wrap around */
@@ -454,6 +490,11 @@ int _access_ok(unsigned long addr, unsigned long size)
         if (in_mem_const(addr, size, COREB_L1_DATA_B_START, COREB_L1_DATA_B_LENGTH))
                 return 1;
 #endif
+
+        aret = in_async(addr, size);
+        if (aret < 2)
+                return aret;
+
         if (in_mem_const_off(addr, size, _ebss_l2 - _stext_l2, L2_START, L2_LENGTH))
                 return 1;