19 files changed, 71 insertions, 96 deletions

diff --git a/arch/um/Kconfig b/arch/um/Kconfig
index 3b5f47c46907..563301fe5df8 100644
--- a/arch/um/Kconfig
+++ b/arch/um/Kconfig
@@ -7,7 +7,6 @@ config UML
         bool
         default y
 
-# XXX: does UM have a mmu/swap?
 config MMU
         bool
         default y
@@ -36,12 +35,6 @@ config IRQ_RELEASE_METHOD
         bool
         default y
 
-menu "Host processor type and features"
-
-source "arch/i386/Kconfig.cpu"
-
-endmenu
-
 menu "UML-specific options"
 
 config MODE_TT
@@ -209,7 +202,8 @@ config MAGIC_SYSRQ
 config SMP
         bool "Symmetric multi-processing support (EXPERIMENTAL)"
         default n
-        depends on (MODE_TT && EXPERIMENTAL && !SMP_BROKEN) || (BROKEN && SMP_BROKEN)
+        #SMP_BROKEN is for x86_64.
+        depends on MODE_TT && EXPERIMENTAL && (!SMP_BROKEN || (BROKEN && SMP_BROKEN))
         help
         This option enables UML SMP support.
         It is NOT related to having a real SMP box. Not directly, at least.
diff --git a/arch/um/Kconfig.i386 b/arch/um/Kconfig.i386
index 5d92cacd56c6..c71b39a677aa 100644
--- a/arch/um/Kconfig.i386
+++ b/arch/um/Kconfig.i386
@@ -1,3 +1,9 @@
+menu "Host processor type and features"
+
+source "arch/i386/Kconfig.cpu"
+
+endmenu
+
 config UML_X86
         bool
         default y
@@ -42,7 +48,3 @@ config ARCH_HAS_SC_SIGNALS
 config ARCH_REUSE_HOST_VSYSCALL_AREA
         bool
         default y
-
-config X86_CMPXCHG
-        bool
-        default y
diff --git a/arch/um/Makefile-i386 b/arch/um/Makefile-i386
index 1f7dcb064aee..7a0e04e34bf9 100644
--- a/arch/um/Makefile-i386
+++ b/arch/um/Makefile-i386
@@ -35,4 +35,3 @@ cflags-y += $(call cc-option,-mpreferred-stack-boundary=2)
 
 CFLAGS += $(cflags-y)
 USER_CFLAGS += $(cflags-y)
-
diff --git a/arch/um/drivers/chan_kern.c b/arch/um/drivers/chan_kern.c
index 16e7dc89f61d..5b58fad45290 100644
--- a/arch/um/drivers/chan_kern.c
+++ b/arch/um/drivers/chan_kern.c
@@ -89,8 +89,7 @@ static int not_configged_write(int fd, const char *buf, int len, void *data)
         return(-EIO);
 }
 
-static int not_configged_console_write(int fd, const char *buf, int len,
-                                       void *data)
+static int not_configged_console_write(int fd, const char *buf, int len)
 {
         my_puts("Using a channel type which is configured out of "
                "UML\n");
@@ -299,7 +298,7 @@ int console_write_chan(struct list_head *chans, const char *buf, int len)
                 chan = list_entry(ele, struct chan, list);
                 if(!chan->output || (chan->ops->console_write == NULL))
                         continue;
-                n = chan->ops->console_write(chan->fd, buf, len, chan->data);
+                n = chan->ops->console_write(chan->fd, buf, len);
                 if(chan->primary) ret = n;
         }
         return(ret);
diff --git a/arch/um/drivers/chan_user.c b/arch/um/drivers/chan_user.c
index 1c55d5802489..5d50d4a44abf 100644
--- a/arch/um/drivers/chan_user.c
+++ b/arch/um/drivers/chan_user.c
@@ -20,7 +20,7 @@
 #include "choose-mode.h"
 #include "mode.h"
 
-int generic_console_write(int fd, const char *buf, int n, void *unused)
+int generic_console_write(int fd, const char *buf, int n)
 {
         struct termios save, new;
         int err;
diff --git a/arch/um/drivers/daemon_user.c b/arch/um/drivers/daemon_user.c
index c1b03f7c1daa..1bb085b2824d 100644
--- a/arch/um/drivers/daemon_user.c
+++ b/arch/um/drivers/daemon_user.c
@@ -98,7 +98,7 @@ static int connect_to_switch(struct daemon_data *pri)
                 printk("daemon_open : control setup request failed, err = %d\n",
                        -n);
                 err = -ENOTCONN;
-                goto out;               
+                goto out_free;
         }
 
         n = os_read_file(pri->control, sun, sizeof(*sun));
@@ -106,12 +106,14 @@ static int connect_to_switch(struct daemon_data *pri)
                 printk("daemon_open : read of data socket failed, err = %d\n",
                        -n);
                 err = -ENOTCONN;
-                goto out_close;         
+                goto out_free;
         }
 
         pri->data_addr = sun;
         return(fd);
 
+ out_free:
+        kfree(sun);
  out_close:
         os_close_file(fd);
  out:
diff --git a/arch/um/drivers/fd.c b/arch/um/drivers/fd.c
index f0b888f66e05..3296e86a03a5 100644
--- a/arch/um/drivers/fd.c
+++ b/arch/um/drivers/fd.c
@@ -76,13 +76,6 @@ static void fd_close(int fd, void *d)
         }
 }
 
-static int fd_console_write(int fd, const char *buf, int n, void *d)
-{
-        struct fd_chan *data = d;
-
-        return(generic_console_write(fd, buf, n, &data->tt));
-}
-
 struct chan_ops fd_ops = {
         .type           = "fd",
         .init           = fd_init,
@@ -90,7 +83,7 @@ struct chan_ops fd_ops = {
         .close          = fd_close,
         .read           = generic_read,
         .write          = generic_write,
-        .console_write  = fd_console_write,
+        .console_write  = generic_console_write,
         .window_size    = generic_window_size,
         .free           = generic_free,
         .winch          = 1,
diff --git a/arch/um/drivers/mcast_user.c b/arch/um/drivers/mcast_user.c
index 5db136e2651c..afe85bfa66e0 100644
--- a/arch/um/drivers/mcast_user.c
+++ b/arch/um/drivers/mcast_user.c
@@ -54,7 +54,7 @@ static int mcast_open(void *data)
         struct mcast_data *pri = data;
         struct sockaddr_in *sin = pri->mcast_addr;
         struct ip_mreq mreq;
-        int fd, yes = 1, err = 0;
+        int fd, yes = 1, err = -EINVAL;
 
 
         if ((sin->sin_addr.s_addr == 0) || (sin->sin_port == 0))
@@ -63,40 +63,40 @@ static int mcast_open(void *data)
         fd = socket(AF_INET, SOCK_DGRAM, 0);
 
         if (fd < 0){
+                err = -errno;
                 printk("mcast_open : data socket failed, errno = %d\n", 
                        errno);
-                err = -errno;
                 goto out;
         }
 
         if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &yes, sizeof(yes)) < 0) {
+                err = -errno;
                 printk("mcast_open: SO_REUSEADDR failed, errno = %d\n",
                         errno);
-                err = -errno;
                 goto out_close;
         }
 
         /* set ttl according to config */
         if (setsockopt(fd, SOL_IP, IP_MULTICAST_TTL, &pri->ttl,
                        sizeof(pri->ttl)) < 0) {
+                err = -errno;
                 printk("mcast_open: IP_MULTICAST_TTL failed, error = %d\n",
                         errno);
-                err = -errno;
                 goto out_close;
         }
 
         /* set LOOP, so data does get fed back to local sockets */
         if (setsockopt(fd, SOL_IP, IP_MULTICAST_LOOP, &yes, sizeof(yes)) < 0) {
+                err = -errno;
                 printk("mcast_open: IP_MULTICAST_LOOP failed, error = %d\n",
                         errno);
-                err = -errno;
                 goto out_close;
         }
 
         /* bind socket to mcast address */
         if (bind(fd, (struct sockaddr *) sin, sizeof(*sin)) < 0) {
-                printk("mcast_open : data bind failed, errno = %d\n", errno);
                 err = -errno;
+                printk("mcast_open : data bind failed, errno = %d\n", errno);
                 goto out_close;
         }               
         
@@ -105,22 +105,22 @@ static int mcast_open(void *data)
         mreq.imr_interface.s_addr = 0;
         if (setsockopt(fd, SOL_IP, IP_ADD_MEMBERSHIP, 
                        &mreq, sizeof(mreq)) < 0) {
+                err = -errno;
                 printk("mcast_open: IP_ADD_MEMBERSHIP failed, error = %d\n",
                         errno);
                 printk("There appears not to be a multicast-capable network "
                        "interface on the host.\n");
                 printk("eth0 should be configured in order to use the "
                        "multicast transport.\n");
-                err = -errno;
-                goto out_close;
+                goto out_close;
         }
 
         return fd;
 
  out_close:
-        os_close_file(fd);
+        os_close_file(fd);
  out:
-        return err;
+        return err;
 }
 
 static void mcast_close(int fd, void *data)
diff --git a/arch/um/drivers/port_user.c b/arch/um/drivers/port_user.c
index ed4a1a6c5d83..c43e8bb32502 100644
--- a/arch/um/drivers/port_user.c
+++ b/arch/um/drivers/port_user.c
@@ -100,13 +100,6 @@ static void port_close(int fd, void *d)
         os_close_file(fd);
 }
 
-static int port_console_write(int fd, const char *buf, int n, void *d)
-{
-        struct port_chan *data = d;
-
-        return(generic_console_write(fd, buf, n, &data->tt));
-}
-
 struct chan_ops port_ops = {
         .type           = "port",
         .init           = port_init,
@@ -114,7 +107,7 @@ struct chan_ops port_ops = {
         .close          = port_close,
         .read           = generic_read,
         .write          = generic_write,
-        .console_write  = port_console_write,
+        .console_write  = generic_console_write,
         .window_size    = generic_window_size,
         .free           = port_free,
         .winch          = 1,
diff --git a/arch/um/drivers/pty.c b/arch/um/drivers/pty.c
index 0306a1b215b7..1c555c38de4d 100644
--- a/arch/um/drivers/pty.c
+++ b/arch/um/drivers/pty.c
@@ -118,13 +118,6 @@ static int pty_open(int input, int output, int primary, void *d,
         return(fd);
 }
 
-static int pty_console_write(int fd, const char *buf, int n, void *d)
-{
-        struct pty_chan *data = d;
-
-        return(generic_console_write(fd, buf, n, &data->tt));
-}
-
 struct chan_ops pty_ops = {
         .type           = "pty",
         .init           = pty_chan_init,
@@ -132,7 +125,7 @@ struct chan_ops pty_ops = {
         .close          = generic_close,
         .read           = generic_read,
         .write          = generic_write,
-        .console_write  = pty_console_write,
+        .console_write  = generic_console_write,
         .window_size    = generic_window_size,
         .free           = generic_free,
         .winch          = 0,
@@ -145,7 +138,7 @@ struct chan_ops pts_ops = {
         .close          = generic_close,
         .read           = generic_read,
         .write          = generic_write,
-        .console_write  = pty_console_write,
+        .console_write  = generic_console_write,
         .window_size    = generic_window_size,
         .free           = generic_free,
         .winch          = 0,
diff --git a/arch/um/drivers/tty.c b/arch/um/drivers/tty.c
index 6fbb670ee274..94c9265a4f2c 100644
--- a/arch/um/drivers/tty.c
+++ b/arch/um/drivers/tty.c
@@ -60,13 +60,6 @@ static int tty_open(int input, int output, int primary, void *d,
         return(fd);
 }
 
-static int tty_console_write(int fd, const char *buf, int n, void *d)
-{
-        struct tty_chan *data = d;
-
-        return(generic_console_write(fd, buf, n, &data->tt));
-}
-
 struct chan_ops tty_ops = {
         .type           = "tty",
         .init           = tty_chan_init,
@@ -74,7 +67,7 @@ struct chan_ops tty_ops = {
         .close          = generic_close,
         .read           = generic_read,
         .write          = generic_write,
-        .console_write  = tty_console_write,
+        .console_write  = generic_console_write,
         .window_size    = generic_window_size,
         .free           = generic_free,
         .winch          = 0,
diff --git a/arch/um/drivers/xterm.c b/arch/um/drivers/xterm.c
index b530f1a6540d..aaa636661043 100644
--- a/arch/um/drivers/xterm.c
+++ b/arch/um/drivers/xterm.c
@@ -194,13 +194,6 @@ static void xterm_free(void *d)
         free(d);
 }
 
-static int xterm_console_write(int fd, const char *buf, int n, void *d)
-{
-        struct xterm_chan *data = d;
-
-        return(generic_console_write(fd, buf, n, &data->tt));
-}
-
 struct chan_ops xterm_ops = {
         .type           = "xterm",
         .init           = xterm_init,
@@ -208,7 +201,7 @@ struct chan_ops xterm_ops = {
         .close          = xterm_close,
         .read           = generic_read,
         .write          = generic_write,
-        .console_write  = xterm_console_write,
+        .console_write  = generic_console_write,
         .window_size    = generic_window_size,
         .free           = xterm_free,
         .winch          = 1,
diff --git a/arch/um/include/chan_user.h b/arch/um/include/chan_user.h
index f77d9aa4c164..659bb3cac32f 100644
--- a/arch/um/include/chan_user.h
+++ b/arch/um/include/chan_user.h
@@ -25,7 +25,7 @@ struct chan_ops {
         void (*close)(int, void *);
         int (*read)(int, char *, void *);
         int (*write)(int, const char *, int, void *);
-        int (*console_write)(int, const char *, int, void *);
+        int (*console_write)(int, const char *, int);
         int (*window_size)(int, void *, unsigned short *, unsigned short *);
         void (*free)(void *);
         int winch;
@@ -37,7 +37,7 @@ extern struct chan_ops fd_ops, null_ops, port_ops, pts_ops, pty_ops, tty_ops,
 extern void generic_close(int fd, void *unused);
 extern int generic_read(int fd, char *c_out, void *unused);
 extern int generic_write(int fd, const char *buf, int n, void *unused);
-extern int generic_console_write(int fd, const char *buf, int n, void *state);
+extern int generic_console_write(int fd, const char *buf, int n);
 extern int generic_window_size(int fd, void *unused, unsigned short *rows_out,
                                unsigned short *cols_out);
 extern void generic_free(void *data);
diff --git a/arch/um/include/um_uaccess.h b/arch/um/include/um_uaccess.h
index 84c0868cd561..f8760a3f43b0 100644
--- a/arch/um/include/um_uaccess.h
+++ b/arch/um/include/um_uaccess.h
@@ -17,8 +17,25 @@
 #include "uaccess-skas.h"
 #endif
 
+#define __under_task_size(addr, size) \
+        (((unsigned long) (addr) < TASK_SIZE) && \
+         (((unsigned long) (addr) + (size)) < TASK_SIZE))
+
+#define __access_ok_vsyscall(type, addr, size) \
+         ((type == VERIFY_READ) && \
+          ((unsigned long) (addr) >= FIXADDR_USER_START) && \
+          ((unsigned long) (addr) + (size) <= FIXADDR_USER_END) && \
+          ((unsigned long) (addr) + (size) >= (unsigned long)(addr)))
+
+#define __addr_range_nowrap(addr, size) \
+        ((unsigned long) (addr) <= ((unsigned long) (addr) + (size)))
+
 #define access_ok(type, addr, size) \
-        CHOOSE_MODE_PROC(access_ok_tt, access_ok_skas, type, addr, size)
+        (__addr_range_nowrap(addr, size) && \
+         (__under_task_size(addr, size) || \
+          __access_ok_vsyscall(type, addr, size) || \
+          segment_eq(get_fs(), KERNEL_DS) || \
+          CHOOSE_MODE_PROC(access_ok_tt, access_ok_skas, type, addr, size)))
 
 static inline int copy_from_user(void *to, const void __user *from, int n)
 {
diff --git a/arch/um/kernel/skas/include/uaccess-skas.h b/arch/um/kernel/skas/include/uaccess-skas.h
index 7da0c2def0ef..f611f83ad4ff 100644
--- a/arch/um/kernel/skas/include/uaccess-skas.h
+++ b/arch/um/kernel/skas/include/uaccess-skas.h
@@ -9,14 +9,8 @@
 #include "asm/errno.h"
 #include "asm/fixmap.h"
 
-#define access_ok_skas(type, addr, size) \
-        ((segment_eq(get_fs(), KERNEL_DS)) || \
-         (((unsigned long) (addr) < TASK_SIZE) && \
-          ((unsigned long) (addr) + (size) <= TASK_SIZE)) || \
-         ((type == VERIFY_READ ) && \
-          ((unsigned long) (addr) >= FIXADDR_USER_START) && \
-          ((unsigned long) (addr) + (size) <= FIXADDR_USER_END) && \
-          ((unsigned long) (addr) + (size) >= (unsigned long)(addr))))
+/* No SKAS-specific checking. */
+#define access_ok_skas(type, addr, size) 0
 
 extern int copy_from_user_skas(void *to, const void __user *from, int n);
 extern int copy_to_user_skas(void __user *to, const void *from, int n);
diff --git a/arch/um/kernel/skas/uaccess.c b/arch/um/kernel/skas/uaccess.c
index 75195281081e..a5a47528dec7 100644
--- a/arch/um/kernel/skas/uaccess.c
+++ b/arch/um/kernel/skas/uaccess.c
@@ -143,7 +143,7 @@ int copy_from_user_skas(void *to, const void __user *from, int n)
                 return(0);
         }
 
-        return(access_ok_skas(VERIFY_READ, from, n) ?
+        return(access_ok(VERIFY_READ, from, n) ?
                buffer_op((unsigned long) from, n, 0, copy_chunk_from_user, &to):
                n);
 }
@@ -164,7 +164,7 @@ int copy_to_user_skas(void __user *to, const void *from, int n)
                 return(0);
         }
 
-        return(access_ok_skas(VERIFY_WRITE, to, n) ?
+        return(access_ok(VERIFY_WRITE, to, n) ?
                buffer_op((unsigned long) to, n, 1, copy_chunk_to_user, &from) :
                n);
 }
@@ -193,7 +193,7 @@ int strncpy_from_user_skas(char *dst, const char __user *src, int count)
                 return(strnlen(dst, count));
         }
 
-        if(!access_ok_skas(VERIFY_READ, src, 1))
+        if(!access_ok(VERIFY_READ, src, 1))
                 return(-EFAULT);
 
         n = buffer_op((unsigned long) src, count, 0, strncpy_chunk_from_user,
@@ -221,7 +221,7 @@ int clear_user_skas(void __user *mem, int len)
                 return(0);
         }
 
-        return(access_ok_skas(VERIFY_WRITE, mem, len) ?
+        return(access_ok(VERIFY_WRITE, mem, len) ?
                buffer_op((unsigned long) mem, len, 1, clear_chunk, NULL) : len);
 }
 
diff --git a/arch/um/kernel/trap_kern.c b/arch/um/kernel/trap_kern.c
index 95c8f8733baf..0d4c10a73607 100644
--- a/arch/um/kernel/trap_kern.c
+++ b/arch/um/kernel/trap_kern.c
@@ -95,7 +95,16 @@ survive:
                 pte = pte_offset_kernel(pmd, address);
         } while(!pte_present(*pte));
         err = 0;
+        /* The below warning was added in place of
+         *      pte_mkyoung(); if (is_write) pte_mkdirty();
+         * If it's triggered, we'd see normally a hang here (a clean pte is
+         * marked read-only to emulate the dirty bit).
+         * However, the generic code can mark a PTE writable but clean on a
+         * concurrent read fault, triggering this harmlessly. So comment it out.
+         */
+#if 0
         WARN_ON(!pte_young(*pte) || (is_write && !pte_dirty(*pte)));
+#endif
         flush_tlb_page(vma, address);
 out:
         up_read(&mm->mmap_sem);
diff --git a/arch/um/kernel/tt/include/uaccess-tt.h b/arch/um/kernel/tt/include/uaccess-tt.h
index dc2ebfa8c54f..b9bfe9c481c4 100644
--- a/arch/um/kernel/tt/include/uaccess-tt.h
+++ b/arch/um/kernel/tt/include/uaccess-tt.h
@@ -19,19 +19,13 @@
 extern unsigned long end_vm;
 extern unsigned long uml_physmem;
 
-#define under_task_size(addr, size) \
-        (((unsigned long) (addr) < TASK_SIZE) && \
-         (((unsigned long) (addr) + (size)) < TASK_SIZE))
-
 #define is_stack(addr, size) \
         (((unsigned long) (addr) < STACK_TOP) && \
          ((unsigned long) (addr) >= STACK_TOP - ABOVE_KMEM) && \
          (((unsigned long) (addr) + (size)) <= STACK_TOP))
 
 #define access_ok_tt(type, addr, size) \
-        ((type == VERIFY_READ) || (segment_eq(get_fs(), KERNEL_DS)) || \
-         (((unsigned long) (addr) <= ((unsigned long) (addr) + (size))) && \
-          (under_task_size(addr, size) || is_stack(addr, size))))
+        (is_stack(addr, size))
 
 extern unsigned long get_fault_addr(void);
 
diff --git a/arch/um/kernel/tt/uaccess.c b/arch/um/kernel/tt/uaccess.c
index a72aa632972f..1cb60726567e 100644
--- a/arch/um/kernel/tt/uaccess.c
+++ b/arch/um/kernel/tt/uaccess.c
@@ -8,7 +8,7 @@
 
 int copy_from_user_tt(void *to, const void __user *from, int n)
 {
-        if(!access_ok_tt(VERIFY_READ, from, n))
+        if(!access_ok(VERIFY_READ, from, n))
                 return(n);
 
         return(__do_copy_from_user(to, from, n, &current->thread.fault_addr,
@@ -17,7 +17,7 @@ int copy_from_user_tt(void *to, const void __user *from, int n)
 
 int copy_to_user_tt(void __user *to, const void *from, int n)
 {
-        if(!access_ok_tt(VERIFY_WRITE, to, n))
+        if(!access_ok(VERIFY_WRITE, to, n))
                 return(n);
 
         return(__do_copy_to_user(to, from, n, &current->thread.fault_addr,
@@ -28,7 +28,7 @@ int strncpy_from_user_tt(char *dst, const char __user *src, int count)
 {
         int n;
 
-        if(!access_ok_tt(VERIFY_READ, src, 1))
+        if(!access_ok(VERIFY_READ, src, 1))
                 return(-EFAULT);
 
         n = __do_strncpy_from_user(dst, src, count,
@@ -47,7 +47,7 @@ int __clear_user_tt(void __user *mem, int len)
 
 int clear_user_tt(void __user *mem, int len)
 {
-        if(!access_ok_tt(VERIFY_WRITE, mem, len))
+        if(!access_ok(VERIFY_WRITE, mem, len))
                 return(len);
 
         return(__do_clear_user(mem, len, &current->thread.fault_addr,