7 files changed, 188 insertions, 78 deletions

diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 7a638aa3545b..f8f45ec0ed46 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -835,7 +835,7 @@ config DEBUG_RT_MUTEXES
 
 config RT_MUTEX_TESTER
         bool "Built-in scriptable tester for rt-mutexes"
-        depends on DEBUG_KERNEL && RT_MUTEXES
+        depends on DEBUG_KERNEL && RT_MUTEXES && BROKEN
         help
           This option enables a rt-mutex tester.
 
@@ -1131,20 +1131,6 @@ config PROVE_RCU_REPEATEDLY
 
          Say N if you are unsure.
 
-config PROVE_RCU_DELAY
-        bool "RCU debugging: preemptible RCU race provocation"
-        depends on DEBUG_KERNEL && PREEMPT_RCU
-        default n
-        help
-         There is a class of races that involve an unlikely preemption
-         of __rcu_read_unlock() just after ->rcu_read_lock_nesting has
-         been set to INT_MIN.  This feature inserts a delay at that
-         point to increase the probability of these races.
-
-         Say Y to increase probability of preemption of __rcu_read_unlock().
-
-         Say N if you are unsure.
-
 config SPARSE_RCU_POINTER
         bool "RCU debugging: sparse-based checks for pointer usage"
         default n
@@ -1649,6 +1635,19 @@ config TEST_BPF
 
           If unsure, say N.
 
+config TEST_FIRMWARE
+        tristate "Test firmware loading via userspace interface"
+        default n
+        depends on FW_LOADER
+        help
+          This builds the "test_firmware" module that creates a userspace
+          interface for testing firmware loading. This can be used to
+          control the triggering of firmware loading without needing an
+          actual firmware-using device. The contents can be rechecked by
+          userspace.
+
+          If unsure, say N.
+
 source "samples/Kconfig"
 
 source "lib/Kconfig.kgdb"
diff --git a/lib/Makefile b/lib/Makefile
index ba967a19edba..230b4b1456d6 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -34,6 +34,7 @@ obj-$(CONFIG_TEST_KSTRTOX) += test-kstrtox.o
 obj-$(CONFIG_TEST_MODULE) += test_module.o
 obj-$(CONFIG_TEST_USER_COPY) += test_user_copy.o
 obj-$(CONFIG_TEST_BPF) += test_bpf.o
+obj-$(CONFIG_TEST_FIRMWARE) += test_firmware.o
 
 ifeq ($(CONFIG_DEBUG_KOBJECT),y)
 CFLAGS_kobject.o += -DDEBUG
diff --git a/lib/cpumask.c b/lib/cpumask.c
index c101230658eb..b6513a9f2892 100644
--- a/lib/cpumask.c
+++ b/lib/cpumask.c
@@ -191,7 +191,7 @@ int cpumask_set_cpu_local_first(int i, int numa_node, cpumask_t *dstp)
 
         i %= num_online_cpus();
 
-        if (!cpumask_of_node(numa_node)) {
+        if (numa_node == -1 || !cpumask_of_node(numa_node)) {
                 /* Use all online cpu's for non numa aware system */
                 cpumask_copy(mask, cpu_online_mask);
         } else {
diff --git a/lib/devres.c b/lib/devres.c
index f562bf6ff71d..6a4aee8a3a7e 100644
--- a/lib/devres.c
+++ b/lib/devres.c
@@ -142,34 +142,6 @@ void __iomem *devm_ioremap_resource(struct device *dev, struct resource *res)
 }
 EXPORT_SYMBOL(devm_ioremap_resource);
 
-/**
- * devm_request_and_ioremap() - Check, request region, and ioremap resource
- * @dev: Generic device to handle the resource for
- * @res: resource to be handled
- *
- * Takes all necessary steps to ioremap a mem resource. Uses managed device, so
- * everything is undone on driver detach. Checks arguments, so you can feed
- * it the result from e.g. platform_get_resource() directly. Returns the
- * remapped pointer or NULL on error. Usage example:
- *
- *      res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
- *      base = devm_request_and_ioremap(&pdev->dev, res);
- *      if (!base)
- *              return -EADDRNOTAVAIL;
- */
-void __iomem *devm_request_and_ioremap(struct device *dev,
-                                       struct resource *res)
-{
-        void __iomem *dest_ptr;
-
-        dest_ptr = devm_ioremap_resource(dev, res);
-        if (IS_ERR(dest_ptr))
-                return NULL;
-
-        return dest_ptr;
-}
-EXPORT_SYMBOL(devm_request_and_ioremap);
-
 #ifdef CONFIG_HAS_IOPORT_MAP
 /*
  * Generic iomap devres
diff --git a/lib/lockref.c b/lib/lockref.c
index f07a40d33871..d2233de9a86e 100644
--- a/lib/lockref.c
+++ b/lib/lockref.c
@@ -1,6 +1,5 @@
 #include <linux/export.h>
 #include <linux/lockref.h>
-#include <linux/mutex.h>
 
 #if USE_CMPXCHG_LOCKREF
 
@@ -29,7 +28,7 @@
                 if (likely(old.lock_count == prev.lock_count)) {                \
                         SUCCESS;                                                \
                 }                                                               \
-                arch_mutex_cpu_relax();                                         \
+                cpu_relax_lowlatency();                                         \
         }                                                                       \
 } while (0)
 
diff --git a/lib/percpu-refcount.c b/lib/percpu-refcount.c
index 963b7034a51b..fe5a3342e960 100644
--- a/lib/percpu-refcount.c
+++ b/lib/percpu-refcount.c
@@ -31,6 +31,11 @@
 
 #define PCPU_COUNT_BIAS         (1U << 31)
 
+static unsigned __percpu *pcpu_count_ptr(struct percpu_ref *ref)
+{
+        return (unsigned __percpu *)(ref->pcpu_count_ptr & ~PCPU_REF_DEAD);
+}
+
 /**
  * percpu_ref_init - initialize a percpu refcount
  * @ref: percpu_ref to initialize
@@ -46,8 +51,8 @@ int percpu_ref_init(struct percpu_ref *ref, percpu_ref_func_t *release)
 {
         atomic_set(&ref->count, 1 + PCPU_COUNT_BIAS);
 
-        ref->pcpu_count = alloc_percpu(unsigned);
-        if (!ref->pcpu_count)
+        ref->pcpu_count_ptr = (unsigned long)alloc_percpu(unsigned);
+        if (!ref->pcpu_count_ptr)
                 return -ENOMEM;
 
         ref->release = release;
@@ -56,53 +61,71 @@ int percpu_ref_init(struct percpu_ref *ref, percpu_ref_func_t *release)
 EXPORT_SYMBOL_GPL(percpu_ref_init);
 
 /**
- * percpu_ref_cancel_init - cancel percpu_ref_init()
- * @ref: percpu_ref to cancel init for
+ * percpu_ref_reinit - re-initialize a percpu refcount
+ * @ref: perpcu_ref to re-initialize
  *
- * Once a percpu_ref is initialized, its destruction is initiated by
- * percpu_ref_kill() and completes asynchronously, which can be painful to
- * do when destroying a half-constructed object in init failure path.
+ * Re-initialize @ref so that it's in the same state as when it finished
+ * percpu_ref_init().  @ref must have been initialized successfully, killed
+ * and reached 0 but not exited.
  *
- * This function destroys @ref without invoking @ref->release and the
- * memory area containing it can be freed immediately on return.  To
- * prevent accidental misuse, it's required that @ref has finished
- * percpu_ref_init(), whether successful or not, but never used.
- *
- * The weird name and usage restriction are to prevent people from using
- * this function by mistake for normal shutdown instead of
- * percpu_ref_kill().
+ * Note that percpu_ref_tryget[_live]() are safe to perform on @ref while
+ * this function is in progress.
  */
-void percpu_ref_cancel_init(struct percpu_ref *ref)
+void percpu_ref_reinit(struct percpu_ref *ref)
 {
-        unsigned __percpu *pcpu_count = ref->pcpu_count;
+        unsigned __percpu *pcpu_count = pcpu_count_ptr(ref);
         int cpu;
 
-        WARN_ON_ONCE(atomic_read(&ref->count) != 1 + PCPU_COUNT_BIAS);
+        BUG_ON(!pcpu_count);
+        WARN_ON(!percpu_ref_is_zero(ref));
+
+        atomic_set(&ref->count, 1 + PCPU_COUNT_BIAS);
+
+        /*
+         * Restore per-cpu operation.  smp_store_release() is paired with
+         * smp_read_barrier_depends() in __pcpu_ref_alive() and guarantees
+         * that the zeroing is visible to all percpu accesses which can see
+         * the following PCPU_REF_DEAD clearing.
+         */
+        for_each_possible_cpu(cpu)
+                *per_cpu_ptr(pcpu_count, cpu) = 0;
+
+        smp_store_release(&ref->pcpu_count_ptr,
+                          ref->pcpu_count_ptr & ~PCPU_REF_DEAD);
+}
+EXPORT_SYMBOL_GPL(percpu_ref_reinit);
+
+/**
+ * percpu_ref_exit - undo percpu_ref_init()
+ * @ref: percpu_ref to exit
+ *
+ * This function exits @ref.  The caller is responsible for ensuring that
+ * @ref is no longer in active use.  The usual places to invoke this
+ * function from are the @ref->release() callback or in init failure path
+ * where percpu_ref_init() succeeded but other parts of the initialization
+ * of the embedding object failed.
+ */
+void percpu_ref_exit(struct percpu_ref *ref)
+{
+        unsigned __percpu *pcpu_count = pcpu_count_ptr(ref);
 
         if (pcpu_count) {
-                for_each_possible_cpu(cpu)
-                        WARN_ON_ONCE(*per_cpu_ptr(pcpu_count, cpu));
-                free_percpu(ref->pcpu_count);
+                free_percpu(pcpu_count);
+                ref->pcpu_count_ptr = PCPU_REF_DEAD;
         }
 }
-EXPORT_SYMBOL_GPL(percpu_ref_cancel_init);
+EXPORT_SYMBOL_GPL(percpu_ref_exit);
 
 static void percpu_ref_kill_rcu(struct rcu_head *rcu)
 {
         struct percpu_ref *ref = container_of(rcu, struct percpu_ref, rcu);
-        unsigned __percpu *pcpu_count = ref->pcpu_count;
+        unsigned __percpu *pcpu_count = pcpu_count_ptr(ref);
         unsigned count = 0;
         int cpu;
 
-        /* Mask out PCPU_REF_DEAD */
-        pcpu_count = (unsigned __percpu *)
-                (((unsigned long) pcpu_count) & ~PCPU_STATUS_MASK);
-
         for_each_possible_cpu(cpu)
                 count += *per_cpu_ptr(pcpu_count, cpu);
 
-        free_percpu(pcpu_count);
-
         pr_debug("global %i pcpu %i", atomic_read(&ref->count), (int) count);
 
         /*
@@ -152,11 +175,10 @@ static void percpu_ref_kill_rcu(struct rcu_head *rcu)
 void percpu_ref_kill_and_confirm(struct percpu_ref *ref,
                                  percpu_ref_func_t *confirm_kill)
 {
-        WARN_ONCE(REF_STATUS(ref->pcpu_count) == PCPU_REF_DEAD,
+        WARN_ONCE(ref->pcpu_count_ptr & PCPU_REF_DEAD,
                   "percpu_ref_kill() called more than once!\n");
 
-        ref->pcpu_count = (unsigned __percpu *)
-                (((unsigned long) ref->pcpu_count)|PCPU_REF_DEAD);
+        ref->pcpu_count_ptr |= PCPU_REF_DEAD;
         ref->confirm_kill = confirm_kill;
 
         call_rcu_sched(&ref->rcu, percpu_ref_kill_rcu);
diff --git a/lib/test_firmware.c b/lib/test_firmware.c
new file mode 100644
index 000000000000..86374c1c49a4
--- /dev/null
+++ b/lib/test_firmware.c
@@ -0,0 +1,117 @@
+/*
+ * This module provides an interface to trigger and test firmware loading.
+ *
+ * It is designed to be used for basic evaluation of the firmware loading
+ * subsystem (for example when validating firmware verification). It lacks
+ * any extra dependencies, and will not normally be loaded by the system
+ * unless explicitly requested by name.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/printk.h>
+#include <linux/firmware.h>
+#include <linux/device.h>
+#include <linux/fs.h>
+#include <linux/miscdevice.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
+
+static DEFINE_MUTEX(test_fw_mutex);
+static const struct firmware *test_firmware;
+
+static ssize_t test_fw_misc_read(struct file *f, char __user *buf,
+                                 size_t size, loff_t *offset)
+{
+        ssize_t rc = 0;
+
+        mutex_lock(&test_fw_mutex);
+        if (test_firmware)
+                rc = simple_read_from_buffer(buf, size, offset,
+                                             test_firmware->data,
+                                             test_firmware->size);
+        mutex_unlock(&test_fw_mutex);
+        return rc;
+}
+
+static const struct file_operations test_fw_fops = {
+        .owner          = THIS_MODULE,
+        .read           = test_fw_misc_read,
+};
+
+static struct miscdevice test_fw_misc_device = {
+        .minor          = MISC_DYNAMIC_MINOR,
+        .name           = "test_firmware",
+        .fops           = &test_fw_fops,
+};
+
+static ssize_t trigger_request_store(struct device *dev,
+                                     struct device_attribute *attr,
+                                     const char *buf, size_t count)
+{
+        int rc;
+        char *name;
+
+        name = kzalloc(count + 1, GFP_KERNEL);
+        if (!name)
+                return -ENOSPC;
+        memcpy(name, buf, count);
+
+        pr_info("loading '%s'\n", name);
+
+        mutex_lock(&test_fw_mutex);
+        release_firmware(test_firmware);
+        test_firmware = NULL;
+        rc = request_firmware(&test_firmware, name, dev);
+        if (rc)
+                pr_info("load of '%s' failed: %d\n", name, rc);
+        pr_info("loaded: %zu\n", test_firmware ? test_firmware->size : 0);
+        mutex_unlock(&test_fw_mutex);
+
+        kfree(name);
+
+        return count;
+}
+static DEVICE_ATTR_WO(trigger_request);
+
+static int __init test_firmware_init(void)
+{
+        int rc;
+
+        rc = misc_register(&test_fw_misc_device);
+        if (rc) {
+                pr_err("could not register misc device: %d\n", rc);
+                return rc;
+        }
+        rc = device_create_file(test_fw_misc_device.this_device,
+                                &dev_attr_trigger_request);
+        if (rc) {
+                pr_err("could not create sysfs interface: %d\n", rc);
+                goto dereg;
+        }
+
+        pr_warn("interface ready\n");
+
+        return 0;
+dereg:
+        misc_deregister(&test_fw_misc_device);
+        return rc;
+}
+
+module_init(test_firmware_init);
+
+static void __exit test_firmware_exit(void)
+{
+        release_firmware(test_firmware);
+        device_remove_file(test_fw_misc_device.this_device,
+                           &dev_attr_trigger_request);
+        misc_deregister(&test_fw_misc_device);
+        pr_warn("removed interface\n");
+}
+
+module_exit(test_firmware_exit);
+
+MODULE_AUTHOR("Kees Cook <keescook@chromium.org>");
+MODULE_LICENSE("GPL");