1 files changed, 109 insertions, 19 deletions

diff --git a/mm/memory.c b/mm/memory.c
index 4126dd16778c..d5d1653d60a6 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1360,6 +1360,56 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
         return i;
 }
 
+/**
+ * get_user_pages() - pin user pages in memory
+ * @tsk:        task_struct of target task
+ * @mm:         mm_struct of target mm
+ * @start:      starting user address
+ * @len:        number of pages from start to pin
+ * @write:      whether pages will be written to by the caller
+ * @force:      whether to force write access even if user mapping is
+ *              readonly. This will result in the page being COWed even
+ *              in MAP_SHARED mappings. You do not want this.
+ * @pages:      array that receives pointers to the pages pinned.
+ *              Should be at least nr_pages long. Or NULL, if caller
+ *              only intends to ensure the pages are faulted in.
+ * @vmas:       array of pointers to vmas corresponding to each page.
+ *              Or NULL if the caller does not require them.
+ *
+ * Returns number of pages pinned. This may be fewer than the number
+ * requested. If len is 0 or negative, returns 0. If no pages
+ * were pinned, returns -errno. Each page returned must be released
+ * with a put_page() call when it is finished with. vmas will only
+ * remain valid while mmap_sem is held.
+ *
+ * Must be called with mmap_sem held for read or write.
+ *
+ * get_user_pages walks a process's page tables and takes a reference to
+ * each struct page that each user address corresponds to at a given
+ * instant. That is, it takes the page that would be accessed if a user
+ * thread accesses the given user virtual address at that instant.
+ *
+ * This does not guarantee that the page exists in the user mappings when
+ * get_user_pages returns, and there may even be a completely different
+ * page there in some cases (eg. if mmapped pagecache has been invalidated
+ * and subsequently re faulted). However it does guarantee that the page
+ * won't be freed completely. And mostly callers simply care that the page
+ * contains data that was valid *at some point in time*. Typically, an IO
+ * or similar operation cannot guarantee anything stronger anyway because
+ * locks can't be held over the syscall boundary.
+ *
+ * If write=0, the page must not be written to. If the page is written to,
+ * set_page_dirty (or set_page_dirty_lock, as appropriate) must be called
+ * after the page is finished with, and before put_page is called.
+ *
+ * get_user_pages is typically used for fewer-copy IO operations, to get a
+ * handle on the memory by some means other than accesses via the user virtual
+ * addresses. The pages may be submitted for DMA to devices or accessed via
+ * their kernel linear mapping (via the kmap APIs). Care should be taken to
+ * use the correct cache flushing APIs.
+ *
+ * See also get_user_pages_fast, for performance critical applications.
+ */
 int get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
                 unsigned long start, int len, int write, int force,
                 struct page **pages, struct vm_area_struct **vmas)
@@ -3053,22 +3103,13 @@ int in_gate_area_no_task(unsigned long addr)
 
 #endif  /* __HAVE_ARCH_GATE_AREA */
 
-#ifdef CONFIG_HAVE_IOREMAP_PROT
-int follow_phys(struct vm_area_struct *vma,
-                unsigned long address, unsigned int flags,
-                unsigned long *prot, resource_size_t *phys)
+static int follow_pte(struct mm_struct *mm, unsigned long address,
+                pte_t **ptepp, spinlock_t **ptlp)
 {
         pgd_t *pgd;
         pud_t *pud;
         pmd_t *pmd;
-        pte_t *ptep, pte;
-        spinlock_t *ptl;
-        resource_size_t phys_addr = 0;
-        struct mm_struct *mm = vma->vm_mm;
-        int ret = -EINVAL;
-
-        if (!(vma->vm_flags & (VM_IO | VM_PFNMAP)))
-                goto out;
+        pte_t *ptep;
 
         pgd = pgd_offset(mm, address);
         if (pgd_none(*pgd) || unlikely(pgd_bad(*pgd)))
@@ -3086,22 +3127,71 @@ int follow_phys(struct vm_area_struct *vma,
         if (pmd_huge(*pmd))
                 goto out;
 
-        ptep = pte_offset_map_lock(mm, pmd, address, &ptl);
+        ptep = pte_offset_map_lock(mm, pmd, address, ptlp);
         if (!ptep)
                 goto out;
+        if (!pte_present(*ptep))
+                goto unlock;
+        *ptepp = ptep;
+        return 0;
+unlock:
+        pte_unmap_unlock(ptep, *ptlp);
+out:
+        return -EINVAL;
+}
 
+/**
+ * follow_pfn - look up PFN at a user virtual address
+ * @vma: memory mapping
+ * @address: user virtual address
+ * @pfn: location to store found PFN
+ *
+ * Only IO mappings and raw PFN mappings are allowed.
+ *
+ * Returns zero and the pfn at @pfn on success, -ve otherwise.
+ */
+int follow_pfn(struct vm_area_struct *vma, unsigned long address,
+        unsigned long *pfn)
+{
+        int ret = -EINVAL;
+        spinlock_t *ptl;
+        pte_t *ptep;
+
+        if (!(vma->vm_flags & (VM_IO | VM_PFNMAP)))
+                return ret;
+
+        ret = follow_pte(vma->vm_mm, address, &ptep, &ptl);
+        if (ret)
+                return ret;
+        *pfn = pte_pfn(*ptep);
+        pte_unmap_unlock(ptep, ptl);
+        return 0;
+}
+EXPORT_SYMBOL(follow_pfn);
+
+#ifdef CONFIG_HAVE_IOREMAP_PROT
+int follow_phys(struct vm_area_struct *vma,
+                unsigned long address, unsigned int flags,
+                unsigned long *prot, resource_size_t *phys)
+{
+        int ret = -EINVAL;
+        pte_t *ptep, pte;
+        spinlock_t *ptl;
+
+        if (!(vma->vm_flags & (VM_IO | VM_PFNMAP)))
+                goto out;
+
+        if (follow_pte(vma->vm_mm, address, &ptep, &ptl))
+                goto out;
         pte = *ptep;
-        if (!pte_present(pte))
-                goto unlock;
+
         if ((flags & FOLL_WRITE) && !pte_write(pte))
                 goto unlock;
-        phys_addr = pte_pfn(pte);
-        phys_addr <<= PAGE_SHIFT; /* Shift here to avoid overflow on PAE */
 
         *prot = pgprot_val(pte_pgprot(pte));
-        *phys = phys_addr;
-        ret = 0;
+        *phys = (resource_size_t)pte_pfn(pte) << PAGE_SHIFT;
 
+        ret = 0;
 unlock:
         pte_unmap_unlock(ptep, ptl);
 out: