5 files changed, 160 insertions, 37 deletions

diff --git a/arch/s390/mm/cmm.c b/arch/s390/mm/cmm.c
index 607f50ead1fd..f93a056869bc 100644
--- a/arch/s390/mm/cmm.c
+++ b/arch/s390/mm/cmm.c
@@ -245,7 +245,7 @@ cmm_set_timeout(long nr, long seconds)
         cmm_set_timer();
 }
 
-static inline int
+static int
 cmm_skip_blanks(char *cp, char **endp)
 {
         char *str;
@@ -414,7 +414,7 @@ cmm_smsg_target(char *from, char *msg)
 }
 #endif
 
-struct ctl_table_header *cmm_sysctl_header;
+static struct ctl_table_header *cmm_sysctl_header;
 
 static int
 cmm_init (void)
diff --git a/arch/s390/mm/extmem.c b/arch/s390/mm/extmem.c
index 775bf19e742b..394980b05e6f 100644
--- a/arch/s390/mm/extmem.c
+++ b/arch/s390/mm/extmem.c
@@ -15,6 +15,7 @@
 #include <linux/module.h>
 #include <linux/bootmem.h>
 #include <linux/ctype.h>
+#include <linux/ioport.h>
 #include <asm/page.h>
 #include <asm/pgtable.h>
 #include <asm/ebcdic.h>
@@ -70,6 +71,7 @@ struct qin64 {
 struct dcss_segment {
         struct list_head list;
         char dcss_name[8];
+        char res_name[15];
         unsigned long start_addr;
         unsigned long end;
         atomic_t ref_count;
@@ -77,6 +79,7 @@ struct dcss_segment {
         unsigned int vm_segtype;
         struct qrange range[6];
         int segcnt;
+        struct resource *res;
 };
 
 static DEFINE_MUTEX(dcss_lock);
@@ -88,7 +91,7 @@ static char *segtype_string[] = { "SW", "EW", "SR", "ER", "SN", "EN", "SC",
  * Create the 8 bytes, ebcdic VM segment name from
  * an ascii name.
  */
-static void inline
+static void
 dcss_mkname(char *name, char *dcss_name)
 {
         int i;
@@ -303,6 +306,29 @@ __segment_load (char *name, int do_nonshared, unsigned long *addr, unsigned long
                 goto out_free;
         }
 
+        seg->res = kzalloc(sizeof(struct resource), GFP_KERNEL);
+        if (seg->res == NULL) {
+                rc = -ENOMEM;
+                goto out_shared;
+        }
+        seg->res->flags = IORESOURCE_BUSY | IORESOURCE_MEM;
+        seg->res->start = seg->start_addr;
+        seg->res->end = seg->end;
+        memcpy(&seg->res_name, seg->dcss_name, 8);
+        EBCASC(seg->res_name, 8);
+        seg->res_name[8] = '\0';
+        strncat(seg->res_name, " (DCSS)", 7);
+        seg->res->name = seg->res_name;
+        rc = seg->vm_segtype;
+        if (rc == SEG_TYPE_SC ||
+            ((rc == SEG_TYPE_SR || rc == SEG_TYPE_ER) && !do_nonshared))
+                seg->res->flags |= IORESOURCE_READONLY;
+        if (request_resource(&iomem_resource, seg->res)) {
+                rc = -EBUSY;
+                kfree(seg->res);
+                goto out_shared;
+        }
+
         if (do_nonshared)
                 dcss_command = DCSS_LOADNSR;
         else
@@ -316,12 +342,11 @@ __segment_load (char *name, int do_nonshared, unsigned long *addr, unsigned long
                 rc = dcss_diag_translate_rc (seg->end);
                 dcss_diag(DCSS_PURGESEG, seg->dcss_name,
                                 &seg->start_addr, &seg->end);
-                goto out_shared;
+                goto out_resource;
         }
         seg->do_nonshared = do_nonshared;
         atomic_set(&seg->ref_count, 1);
         list_add(&seg->list, &dcss_list);
-        rc = seg->vm_segtype;
         *addr = seg->start_addr;
         *end  = seg->end;
         if (do_nonshared)
@@ -329,12 +354,16 @@ __segment_load (char *name, int do_nonshared, unsigned long *addr, unsigned long
                                 "type %s in non-shared mode\n", name,
                                 (void*)seg->start_addr, (void*)seg->end,
                                 segtype_string[seg->vm_segtype]);
-        else
+        else {
                 PRINT_INFO ("segment_load: loaded segment %s range %p .. %p "
                                 "type %s in shared mode\n", name,
                                 (void*)seg->start_addr, (void*)seg->end,
                                 segtype_string[seg->vm_segtype]);
+        }
         goto out;
+ out_resource:
+        release_resource(seg->res);
+        kfree(seg->res);
  out_shared:
         remove_shared_memory(seg->start_addr, seg->end - seg->start_addr + 1);
  out_free:
@@ -401,6 +430,7 @@ segment_load (char *name, int do_nonshared, unsigned long *addr,
  * -ENOENT  : no such segment (segment gone!)
  * -EAGAIN  : segment is in use by other exploiters, try later
  * -EINVAL  : no segment with the given name is currently loaded - name invalid
+ * -EBUSY   : segment can temporarily not be used (overlaps with dcss)
  * 0        : operation succeeded
  */
 int
@@ -428,12 +458,24 @@ segment_modify_shared (char *name, int do_nonshared)
                 rc = -EAGAIN;
                 goto out_unlock;
         }
-        dcss_diag(DCSS_PURGESEG, seg->dcss_name,
-                  &dummy, &dummy);
-        if (do_nonshared)
+        release_resource(seg->res);
+        if (do_nonshared) {
                 dcss_command = DCSS_LOADNSR;
-        else
-        dcss_command = DCSS_LOADNOLY;
+                seg->res->flags &= ~IORESOURCE_READONLY;
+        } else {
+                dcss_command = DCSS_LOADNOLY;
+                if (seg->vm_segtype == SEG_TYPE_SR ||
+                    seg->vm_segtype == SEG_TYPE_ER)
+                        seg->res->flags |= IORESOURCE_READONLY;
+        }
+        if (request_resource(&iomem_resource, seg->res)) {
+                PRINT_WARN("segment_modify_shared: could not reload segment %s"
+                           " - overlapping resources\n", name);
+                rc = -EBUSY;
+                kfree(seg->res);
+                goto out_del;
+        }
+        dcss_diag(DCSS_PURGESEG, seg->dcss_name, &dummy, &dummy);
         diag_cc = dcss_diag(dcss_command, seg->dcss_name,
                         &seg->start_addr, &seg->end);
         if (diag_cc > 1) {
@@ -446,9 +488,9 @@ segment_modify_shared (char *name, int do_nonshared)
         rc = 0;
         goto out_unlock;
  out_del:
+        remove_shared_memory(seg->start_addr, seg->end - seg->start_addr + 1);
         list_del(&seg->list);
-        dcss_diag(DCSS_PURGESEG, seg->dcss_name,
-                  &dummy, &dummy);
+        dcss_diag(DCSS_PURGESEG, seg->dcss_name, &dummy, &dummy);
         kfree(seg);
  out_unlock:
         mutex_unlock(&dcss_lock);
@@ -478,6 +520,8 @@ segment_unload(char *name)
         }
         if (atomic_dec_return(&seg->ref_count) != 0)
                 goto out_unlock;
+        release_resource(seg->res);
+        kfree(seg->res);
         remove_shared_memory(seg->start_addr, seg->end - seg->start_addr + 1);
         list_del(&seg->list);
         dcss_diag(DCSS_PURGESEG, seg->dcss_name, &dummy, &dummy);
diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c
index cd85e34d8703..9ff143e87746 100644
--- a/arch/s390/mm/fault.c
+++ b/arch/s390/mm/fault.c
@@ -52,7 +52,7 @@ extern int sysctl_userprocess_debug;
 extern void die(const char *,struct pt_regs *,long);
 
 #ifdef CONFIG_KPROBES
-ATOMIC_NOTIFIER_HEAD(notify_page_fault_chain);
+static ATOMIC_NOTIFIER_HEAD(notify_page_fault_chain);
 int register_page_fault_notifier(struct notifier_block *nb)
 {
         return atomic_notifier_chain_register(&notify_page_fault_chain, nb);
@@ -137,7 +137,9 @@ static int __check_access_register(struct pt_regs *regs, int error_code)
 
 /*
  * Check which address space the address belongs to.
- * Returns 1 for user space and 0 for kernel space.
+ * May return 1 or 2 for user space and 0 for kernel space.
+ * Returns 2 for user space in primary addressing mode with
+ * CONFIG_S390_EXEC_PROTECT on and kernel parameter noexec=on.
  */
 static inline int check_user_space(struct pt_regs *regs, int error_code)
 {
@@ -154,7 +156,7 @@ static inline int check_user_space(struct pt_regs *regs, int error_code)
                 return __check_access_register(regs, error_code);
         if (descriptor == 2)
                 return current->thread.mm_segment.ar4;
-        return descriptor != 0;
+        return ((descriptor != 0) ^ (switch_amode)) << s390_noexec;
 }
 
 /*
@@ -183,6 +185,77 @@ static void do_sigsegv(struct pt_regs *regs, unsigned long error_code,
         force_sig_info(SIGSEGV, &si, current);
 }
 
+#ifdef CONFIG_S390_EXEC_PROTECT
+extern long sys_sigreturn(struct pt_regs *regs);
+extern long sys_rt_sigreturn(struct pt_regs *regs);
+extern long sys32_sigreturn(struct pt_regs *regs);
+extern long sys32_rt_sigreturn(struct pt_regs *regs);
+
+static inline void do_sigreturn(struct mm_struct *mm, struct pt_regs *regs,
+                                int rt)
+{
+        up_read(&mm->mmap_sem);
+        clear_tsk_thread_flag(current, TIF_SINGLE_STEP);
+#ifdef CONFIG_COMPAT
+        if (test_tsk_thread_flag(current, TIF_31BIT)) {
+                if (rt)
+                        sys32_rt_sigreturn(regs);
+                else
+                        sys32_sigreturn(regs);
+                return;
+        }
+#endif /* CONFIG_COMPAT */
+        if (rt)
+                sys_rt_sigreturn(regs);
+        else
+                sys_sigreturn(regs);
+        return;
+}
+
+static int signal_return(struct mm_struct *mm, struct pt_regs *regs,
+                         unsigned long address, unsigned long error_code)
+{
+        pgd_t *pgd;
+        pmd_t *pmd;
+        pte_t *pte;
+        u16 *instruction;
+        unsigned long pfn, uaddr = regs->psw.addr;
+
+        spin_lock(&mm->page_table_lock);
+        pgd = pgd_offset(mm, uaddr);
+        if (pgd_none(*pgd) || unlikely(pgd_bad(*pgd)))
+                goto out_fault;
+        pmd = pmd_offset(pgd, uaddr);
+        if (pmd_none(*pmd) || unlikely(pmd_bad(*pmd)))
+                goto out_fault;
+        pte = pte_offset_map(pmd_offset(pgd_offset(mm, uaddr), uaddr), uaddr);
+        if (!pte || !pte_present(*pte))
+                goto out_fault;
+        pfn = pte_pfn(*pte);
+        if (!pfn_valid(pfn))
+                goto out_fault;
+        spin_unlock(&mm->page_table_lock);
+
+        instruction = (u16 *) ((pfn << PAGE_SHIFT) + (uaddr & (PAGE_SIZE-1)));
+        if (*instruction == 0x0a77)
+                do_sigreturn(mm, regs, 0);
+        else if (*instruction == 0x0aad)
+                do_sigreturn(mm, regs, 1);
+        else {
+                printk("- XXX - do_exception: task = %s, primary, NO EXEC "
+                       "-> SIGSEGV\n", current->comm);
+                up_read(&mm->mmap_sem);
+                current->thread.prot_addr = address;
+                current->thread.trap_no = error_code;
+                do_sigsegv(regs, error_code, SEGV_MAPERR, address);
+        }
+        return 0;
+out_fault:
+        spin_unlock(&mm->page_table_lock);
+        return -EFAULT;
+}
+#endif /* CONFIG_S390_EXEC_PROTECT */
+
 /*
  * This routine handles page faults.  It determines the address,
  * and the problem, and then passes it off to one of the appropriate
@@ -260,6 +333,17 @@ do_exception(struct pt_regs *regs, unsigned long error_code, int is_protection)
         vma = find_vma(mm, address);
         if (!vma)
                 goto bad_area;
+
+#ifdef CONFIG_S390_EXEC_PROTECT
+        if (unlikely((user_address == 2) && !(vma->vm_flags & VM_EXEC)))
+                if (!signal_return(mm, regs, address, error_code))
+                        /*
+                         * signal_return() has done an up_read(&mm->mmap_sem)
+                         * if it returns 0.
+                         */
+                        return;
+#endif
+
         if (vma->vm_start <= address) 
                 goto good_area;
         if (!(vma->vm_flags & VM_GROWSDOWN))
@@ -452,8 +536,7 @@ void pfault_fini(void)
                 : : "a" (&refbk), "m" (refbk) : "cc");
 }
 
-asmlinkage void
-pfault_interrupt(__u16 error_code)
+static void pfault_interrupt(__u16 error_code)
 {
         struct task_struct *tsk;
         __u16 subcode;
diff --git a/arch/s390/mm/init.c b/arch/s390/mm/init.c
index 4bb21be3b007..b3e7c45efb63 100644
--- a/arch/s390/mm/init.c
+++ b/arch/s390/mm/init.c
@@ -25,7 +25,7 @@
 #include <linux/bootmem.h>
 #include <linux/pfn.h>
 #include <linux/poison.h>
-
+#include <linux/initrd.h>
 #include <asm/processor.h>
 #include <asm/system.h>
 #include <asm/uaccess.h>
@@ -95,20 +95,18 @@ static void __init setup_ro_region(void)
         pte_t new_pte;
         unsigned long address, end;
 
-        address = ((unsigned long)&__start_rodata) & PAGE_MASK;
-        end = PFN_ALIGN((unsigned long)&__end_rodata);
+        address = ((unsigned long)&_stext) & PAGE_MASK;
+        end = PFN_ALIGN((unsigned long)&_eshared);
 
         for (; address < end; address += PAGE_SIZE) {
                 pgd = pgd_offset_k(address);
                 pmd = pmd_offset(pgd, address);
                 pte = pte_offset_kernel(pmd, address);
                 new_pte = mk_pte_phys(address, __pgprot(_PAGE_RO));
-                set_pte(pte, new_pte);
+                *pte = new_pte;
         }
 }
 
-extern void vmem_map_init(void);
-
 /*
  * paging_init() sets up the page tables
  */
@@ -125,11 +123,11 @@ void __init paging_init(void)
 #ifdef CONFIG_64BIT
         pgdir_k = (__pa(swapper_pg_dir) & PAGE_MASK) | _KERN_REGION_TABLE;
         for (i = 0; i < PTRS_PER_PGD; i++)
-                pgd_clear(pg_dir + i);
+                pgd_clear_kernel(pg_dir + i);
 #else
         pgdir_k = (__pa(swapper_pg_dir) & PAGE_MASK) | _KERNSEG_TABLE;
         for (i = 0; i < PTRS_PER_PGD; i++)
-                pmd_clear((pmd_t *)(pg_dir + i));
+                pmd_clear_kernel((pmd_t *)(pg_dir + i));
 #endif
         vmem_map_init();
         setup_ro_region();
@@ -174,10 +172,8 @@ void __init mem_init(void)
                 datasize >>10,
                 initsize >> 10);
         printk("Write protected kernel read-only data: %#lx - %#lx\n",
-               (unsigned long)&__start_rodata,
-               PFN_ALIGN((unsigned long)&__end_rodata) - 1);
-        printk("Virtual memmap size: %ldk\n",
-               (max_pfn * sizeof(struct page)) >> 10);
+               (unsigned long)&_stext,
+               PFN_ALIGN((unsigned long)&_eshared) - 1);
 }
 
 void free_initmem(void)
diff --git a/arch/s390/mm/vmem.c b/arch/s390/mm/vmem.c
index cd3d93e8c211..92a565190028 100644
--- a/arch/s390/mm/vmem.c
+++ b/arch/s390/mm/vmem.c
@@ -82,7 +82,7 @@ static inline pmd_t *vmem_pmd_alloc(void)
         if (!pmd)
                 return NULL;
         for (i = 0; i < PTRS_PER_PMD; i++)
-                pmd_clear(pmd + i);
+                pmd_clear_kernel(pmd + i);
         return pmd;
 }
 
@@ -97,7 +97,7 @@ static inline pte_t *vmem_pte_alloc(void)
                 return NULL;
         pte_val(empty_pte) = _PAGE_TYPE_EMPTY;
         for (i = 0; i < PTRS_PER_PTE; i++)
-                set_pte(pte + i, empty_pte);
+                pte[i] = empty_pte;
         return pte;
 }
 
@@ -119,7 +119,7 @@ static int vmem_add_range(unsigned long start, unsigned long size)
                         pm_dir = vmem_pmd_alloc();
                         if (!pm_dir)
                                 goto out;
-                        pgd_populate(&init_mm, pg_dir, pm_dir);
+                        pgd_populate_kernel(&init_mm, pg_dir, pm_dir);
                 }
 
                 pm_dir = pmd_offset(pg_dir, address);
@@ -132,7 +132,7 @@ static int vmem_add_range(unsigned long start, unsigned long size)
 
                 pt_dir = pte_offset_kernel(pm_dir, address);
                 pte = pfn_pte(address >> PAGE_SHIFT, PAGE_KERNEL);
-                set_pte(pt_dir, pte);
+                *pt_dir = pte;
         }
         ret = 0;
 out:
@@ -161,7 +161,7 @@ static void vmem_remove_range(unsigned long start, unsigned long size)
                 if (pmd_none(*pm_dir))
                         continue;
                 pt_dir = pte_offset_kernel(pm_dir, address);
-                set_pte(pt_dir, pte);
+                *pt_dir = pte;
         }
         flush_tlb_kernel_range(start, start + size);
 }
@@ -191,7 +191,7 @@ static int vmem_add_mem_map(unsigned long start, unsigned long size)
                         pm_dir = vmem_pmd_alloc();
                         if (!pm_dir)
                                 goto out;
-                        pgd_populate(&init_mm, pg_dir, pm_dir);
+                        pgd_populate_kernel(&init_mm, pg_dir, pm_dir);
                 }
 
                 pm_dir = pmd_offset(pg_dir, address);
@@ -210,7 +210,7 @@ static int vmem_add_mem_map(unsigned long start, unsigned long size)
                         if (!new_page)
                                 goto out;
                         pte = pfn_pte(new_page >> PAGE_SHIFT, PAGE_KERNEL);
-                        set_pte(pt_dir, pte);
+                        *pt_dir = pte;
                 }
         }
         ret = 0;