2 files changed, 60 insertions, 14 deletions

diff --git a/arch/sh/include/asm/fixmap.h b/arch/sh/include/asm/fixmap.h
index 76c5a3099cb8..5ac1e40a511c 100644
--- a/arch/sh/include/asm/fixmap.h
+++ b/arch/sh/include/asm/fixmap.h
@@ -46,9 +46,15 @@
  * fix-mapped?
  */
 enum fixed_addresses {
+        /*
+         * The FIX_CMAP entries are used by kmap_coherent() to get virtual
+         * addresses which are of a known color, and so their values are
+         * important. __fix_to_virt(FIX_CMAP_END - n) must give an address
+         * which is the same color as a page (n<<PAGE_SHIFT).
+         */
 #define FIX_N_COLOURS 8
         FIX_CMAP_BEGIN,
-        FIX_CMAP_END = FIX_CMAP_BEGIN + (FIX_N_COLOURS * NR_CPUS),
+        FIX_CMAP_END = FIX_CMAP_BEGIN + (FIX_N_COLOURS * NR_CPUS) - 1,
         FIX_UNCACHED,
 #ifdef CONFIG_HIGHMEM
         FIX_KMAP_BEGIN, /* reserved pte's for temporary kernel mappings */
diff --git a/arch/sh/mm/cache.c b/arch/sh/mm/cache.c
index e9415d3ea94a..997c7e42b1e1 100644
--- a/arch/sh/mm/cache.c
+++ b/arch/sh/mm/cache.c
@@ -46,6 +46,18 @@ static inline void cacheop_on_each_cpu(void (*func) (void *info), void *info,
         preempt_enable();
 }
 
+/*
+ * copy_to_user_page
+ * @vma: vm_area_struct holding the pages
+ * @page: struct page
+ * @vaddr: user space address
+ * @dst: address of page in kernel space (possibly from kmap)
+ * @src: source address in kernel logical memory
+ * @len: length of data in bytes (may be less than PAGE_SIZE)
+ *
+ * Copy data into the address space of a process other than the current
+ * process (eg for ptrace).
+ */
 void copy_to_user_page(struct vm_area_struct *vma, struct page *page,
                        unsigned long vaddr, void *dst, const void *src,
                        unsigned long len)
@@ -81,28 +93,49 @@ void copy_from_user_page(struct vm_area_struct *vma, struct page *page,
         }
 }
 
+/*
+ * copy_user_highpage
+ * @to: destination page
+ * @from: source page
+ * @vaddr: address of pages in user address space
+ * @vma: vm_area_struct holding the pages
+ *
+ * This is used in COW implementation to copy data from page @from to
+ * page @to. @from was previousl mapped at @vaddr, and @to will be.
+ * As this is used only in the COW implementation, this means that the
+ * source is unmodified, and so we don't have to worry about cache
+ * aliasing on that side.
+ */
+#ifdef CONFIG_HIGHMEM
+/*
+ * If we ever have a real highmem system, this code will need fixing
+ * (as will clear_user/clear_user_highmem), because the kmap potentitally
+ * creates another alias risk.
+ */
+#error This code is broken with real HIGHMEM
+#endif
 void copy_user_highpage(struct page *to, struct page *from,
                         unsigned long vaddr, struct vm_area_struct *vma)
 {
         void *vfrom, *vto;
 
         vto = kmap_atomic(to, KM_USER1);
+        vfrom = kmap_atomic(from, KM_USER0);
+
+        if (pages_do_alias((unsigned long)vto, vaddr & PAGE_MASK))
+                __flush_invalidate_region(vto, PAGE_SIZE);
 
         if (boot_cpu_data.dcache.n_aliases && page_mapped(from) &&
             !test_bit(PG_dcache_dirty, &from->flags)) {
-                vfrom = kmap_coherent(from, vaddr);
+                void *vto_coloured = kmap_coherent(to, vaddr);
+                copy_page(vto_coloured, vfrom);
+                kunmap_coherent(vto_coloured);
+        } else
                 copy_page(vto, vfrom);
-                kunmap_coherent(vfrom);
-        } else {
-                vfrom = kmap_atomic(from, KM_USER0);
-                copy_page(vto, vfrom);
-                kunmap_atomic(vfrom, KM_USER0);
-        }
-
-        if (pages_do_alias((unsigned long)vto, vaddr & PAGE_MASK))
-                __flush_purge_region(vto, PAGE_SIZE);
 
+        kunmap_atomic(vfrom, KM_USER0);
         kunmap_atomic(vto, KM_USER1);
+
         /* Make sure this page is cleared on other CPU's too before using it */
         smp_wmb();
 }
@@ -112,10 +145,17 @@ void clear_user_highpage(struct page *page, unsigned long vaddr)
 {
         void *kaddr = kmap_atomic(page, KM_USER0);
 
-        clear_page(kaddr);
+        if (pages_do_alias((unsigned long)kaddr, vaddr & PAGE_MASK)) {
+                void *vto;
 
-        if (pages_do_alias((unsigned long)kaddr, vaddr & PAGE_MASK))
-                __flush_purge_region(kaddr, PAGE_SIZE);
+                /* Kernel alias may have modified data in the cache. */
+                __flush_invalidate_region(kaddr, PAGE_SIZE);
+
+                vto = kmap_coherent(page, vaddr);
+                clear_page(vto);
+                kunmap_coherent(vto);
+        } else
+                clear_page(kaddr);
 
         kunmap_atomic(kaddr, KM_USER0);
 }