1 files changed, 118 insertions, 63 deletions

diff --git a/kernel/module.c b/kernel/module.c
index f82386bd9ee9..e2564580f3f1 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -59,8 +59,6 @@
 #define CREATE_TRACE_POINTS
 #include <trace/events/module.h>
 
-EXPORT_TRACEPOINT_SYMBOL(module_get);
-
 #if 0
 #define DEBUGP printk
 #else
@@ -370,27 +368,33 @@ EXPORT_SYMBOL_GPL(find_module);
 
 #ifdef CONFIG_SMP
 
-static void *percpu_modalloc(unsigned long size, unsigned long align,
-                             const char *name)
+static inline void __percpu *mod_percpu(struct module *mod)
 {
-        void *ptr;
+        return mod->percpu;
+}
 
+static int percpu_modalloc(struct module *mod,
+                           unsigned long size, unsigned long align)
+{
         if (align > PAGE_SIZE) {
                 printk(KERN_WARNING "%s: per-cpu alignment %li > %li\n",
-                       name, align, PAGE_SIZE);
+                       mod->name, align, PAGE_SIZE);
                 align = PAGE_SIZE;
         }
 
-        ptr = __alloc_reserved_percpu(size, align);
-        if (!ptr)
+        mod->percpu = __alloc_reserved_percpu(size, align);
+        if (!mod->percpu) {
                 printk(KERN_WARNING
                        "Could not allocate %lu bytes percpu data\n", size);
-        return ptr;
+                return -ENOMEM;
+        }
+        mod->percpu_size = size;
+        return 0;
 }
 
-static void percpu_modfree(void *freeme)
+static void percpu_modfree(struct module *mod)
 {
-        free_percpu(freeme);
+        free_percpu(mod->percpu);
 }
 
 static unsigned int find_pcpusec(Elf_Ehdr *hdr,
@@ -400,24 +404,62 @@ static unsigned int find_pcpusec(Elf_Ehdr *hdr,
         return find_sec(hdr, sechdrs, secstrings, ".data.percpu");
 }
 
-static void percpu_modcopy(void *pcpudest, const void *from, unsigned long size)
+static void percpu_modcopy(struct module *mod,
+                           const void *from, unsigned long size)
 {
         int cpu;
 
         for_each_possible_cpu(cpu)
-                memcpy(pcpudest + per_cpu_offset(cpu), from, size);
+                memcpy(per_cpu_ptr(mod->percpu, cpu), from, size);
+}
+
+/**
+ * is_module_percpu_address - test whether address is from module static percpu
+ * @addr: address to test
+ *
+ * Test whether @addr belongs to module static percpu area.
+ *
+ * RETURNS:
+ * %true if @addr is from module static percpu area
+ */
+bool is_module_percpu_address(unsigned long addr)
+{
+        struct module *mod;
+        unsigned int cpu;
+
+        preempt_disable();
+
+        list_for_each_entry_rcu(mod, &modules, list) {
+                if (!mod->percpu_size)
+                        continue;
+                for_each_possible_cpu(cpu) {
+                        void *start = per_cpu_ptr(mod->percpu, cpu);
+
+                        if ((void *)addr >= start &&
+                            (void *)addr < start + mod->percpu_size) {
+                                preempt_enable();
+                                return true;
+                        }
+                }
+        }
+
+        preempt_enable();
+        return false;
 }
 
 #else /* ... !CONFIG_SMP */
 
-static inline void *percpu_modalloc(unsigned long size, unsigned long align,
-                                    const char *name)
+static inline void __percpu *mod_percpu(struct module *mod)
 {
         return NULL;
 }
-static inline void percpu_modfree(void *pcpuptr)
+static inline int percpu_modalloc(struct module *mod,
+                                  unsigned long size, unsigned long align)
+{
+        return -ENOMEM;
+}
+static inline void percpu_modfree(struct module *mod)
 {
-        BUG();
 }
 static inline unsigned int find_pcpusec(Elf_Ehdr *hdr,
                                         Elf_Shdr *sechdrs,
@@ -425,12 +467,16 @@ static inline unsigned int find_pcpusec(Elf_Ehdr *hdr,
 {
         return 0;
 }
-static inline void percpu_modcopy(void *pcpudst, const void *src,
-                                  unsigned long size)
+static inline void percpu_modcopy(struct module *mod,
+                                  const void *from, unsigned long size)
 {
         /* pcpusec should be 0, and size of that section should be 0. */
         BUG_ON(size != 0);
 }
+bool is_module_percpu_address(unsigned long addr)
+{
+        return false;
+}
 
 #endif /* CONFIG_SMP */
 
@@ -467,16 +513,22 @@ MODINFO_ATTR(srcversion);
 static char last_unloaded_module[MODULE_NAME_LEN+1];
 
 #ifdef CONFIG_MODULE_UNLOAD
+
+EXPORT_TRACEPOINT_SYMBOL(module_get);
+
 /* Init the unload section of the module. */
 static void module_unload_init(struct module *mod)
 {
         int cpu;
 
         INIT_LIST_HEAD(&mod->modules_which_use_me);
-        for_each_possible_cpu(cpu)
-                local_set(__module_ref_addr(mod, cpu), 0);
+        for_each_possible_cpu(cpu) {
+                per_cpu_ptr(mod->refptr, cpu)->incs = 0;
+                per_cpu_ptr(mod->refptr, cpu)->decs = 0;
+        }
+
         /* Hold reference count during initialization. */
-        local_set(__module_ref_addr(mod, raw_smp_processor_id()), 1);
+        __this_cpu_write(mod->refptr->incs, 1);
         /* Backwards compatibility macros put refcount during init. */
         mod->waiter = current;
 }
@@ -615,12 +667,28 @@ static int try_stop_module(struct module *mod, int flags, int *forced)
 
 unsigned int module_refcount(struct module *mod)
 {
-        unsigned int total = 0;
+        unsigned int incs = 0, decs = 0;
         int cpu;
 
         for_each_possible_cpu(cpu)
-                total += local_read(__module_ref_addr(mod, cpu));
-        return total;
+                decs += per_cpu_ptr(mod->refptr, cpu)->decs;
+        /*
+         * ensure the incs are added up after the decs.
+         * module_put ensures incs are visible before decs with smp_wmb.
+         *
+         * This 2-count scheme avoids the situation where the refcount
+         * for CPU0 is read, then CPU0 increments the module refcount,
+         * then CPU1 drops that refcount, then the refcount for CPU1 is
+         * read. We would record a decrement but not its corresponding
+         * increment so we would see a low count (disaster).
+         *
+         * Rare situation? But module_refcount can be preempted, and we
+         * might be tallying up 4096+ CPUs. So it is not impossible.
+         */
+        smp_rmb();
+        for_each_possible_cpu(cpu)
+                incs += per_cpu_ptr(mod->refptr, cpu)->incs;
+        return incs - decs;
 }
 EXPORT_SYMBOL(module_refcount);
 
@@ -656,16 +724,8 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user,
                 return -EFAULT;
         name[MODULE_NAME_LEN-1] = '\0';
 
-        /* Create stop_machine threads since free_module relies on
-         * a non-failing stop_machine call. */
-        ret = stop_machine_create();
-        if (ret)
-                return ret;
-
-        if (mutex_lock_interruptible(&module_mutex) != 0) {
-                ret = -EINTR;
-                goto out_stop;
-        }
+        if (mutex_lock_interruptible(&module_mutex) != 0)
+                return -EINTR;
 
         mod = find_module(name);
         if (!mod) {
@@ -725,8 +785,6 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user,
 
  out:
         mutex_unlock(&module_mutex);
-out_stop:
-        stop_machine_destroy();
         return ret;
 }
 
@@ -796,14 +854,15 @@ static struct module_attribute refcnt = {
 void module_put(struct module *module)
 {
         if (module) {
-                unsigned int cpu = get_cpu();
-                local_dec(__module_ref_addr(module, cpu));
-                trace_module_put(module, _RET_IP_,
-                                 local_read(__module_ref_addr(module, cpu)));
+                preempt_disable();
+                smp_wmb(); /* see comment in module_refcount */
+                __this_cpu_inc(module->refptr->decs);
+
+                trace_module_put(module, _RET_IP_);
                 /* Maybe they're waiting for us to drop reference? */
                 if (unlikely(!module_is_live(module)))
                         wake_up_process(module->waiter);
-                put_cpu();
+                preempt_enable();
         }
 }
 EXPORT_SYMBOL(module_put);
@@ -1083,6 +1142,7 @@ static void add_sect_attrs(struct module *mod, unsigned int nsect,
                 if (sattr->name == NULL)
                         goto out;
                 sect_attrs->nsections++;
+                sysfs_attr_init(&sattr->mattr.attr);
                 sattr->mattr.show = module_sect_show;
                 sattr->mattr.store = NULL;
                 sattr->mattr.attr.name = sattr->name;
@@ -1178,6 +1238,7 @@ static void add_notes_attrs(struct module *mod, unsigned int nsect,
                 if (sect_empty(&sechdrs[i]))
                         continue;
                 if (sechdrs[i].sh_type == SHT_NOTE) {
+                        sysfs_bin_attr_init(nattr);
                         nattr->attr.name = mod->sect_attrs->attrs[loaded].name;
                         nattr->attr.mode = S_IRUGO;
                         nattr->size = sechdrs[i].sh_size;
@@ -1250,6 +1311,7 @@ int module_add_modinfo_attrs(struct module *mod)
                 if (!attr->test ||
                     (attr->test && attr->test(mod))) {
                         memcpy(temp_attr, attr, sizeof(*temp_attr));
+                        sysfs_attr_init(&temp_attr->attr);
                         error = sysfs_create_file(&mod->mkobj.kobj,&temp_attr->attr);
                         ++temp_attr;
                 }
@@ -1395,11 +1457,10 @@ static void free_module(struct module *mod)
         /* This may be NULL, but that's OK */
         module_free(mod, mod->module_init);
         kfree(mod->args);
-        if (mod->percpu)
-                percpu_modfree(mod->percpu);
-#if defined(CONFIG_MODULE_UNLOAD) && defined(CONFIG_SMP)
+        percpu_modfree(mod);
+#if defined(CONFIG_MODULE_UNLOAD)
         if (mod->refptr)
-                percpu_modfree(mod->refptr);
+                free_percpu(mod->refptr);
 #endif
         /* Free lock-classes: */
         lockdep_free_key_range(mod->module_core, mod->core_size);
@@ -1515,7 +1576,7 @@ static int simplify_symbols(Elf_Shdr *sechdrs,
                 default:
                         /* Divert to percpu allocation if a percpu var. */
                         if (sym[i].st_shndx == pcpuindex)
-                                secbase = (unsigned long)mod->percpu;
+                                secbase = (unsigned long)mod_percpu(mod);
                         else
                                 secbase = sechdrs[sym[i].st_shndx].sh_addr;
                         sym[i].st_value += secbase;
@@ -1949,7 +2010,7 @@ static noinline struct module *load_module(void __user *umod,
         unsigned int modindex, versindex, infoindex, pcpuindex;
         struct module *mod;
         long err = 0;
-        void *percpu = NULL, *ptr = NULL; /* Stops spurious gcc warning */
+        void *ptr = NULL; /* Stops spurious gcc warning */
         unsigned long symoffs, stroffs, *strmap;
 
         mm_segment_t old_fs;
@@ -2089,15 +2150,11 @@ static noinline struct module *load_module(void __user *umod,
 
         if (pcpuindex) {
                 /* We have a special allocation for this section. */
-                percpu = percpu_modalloc(sechdrs[pcpuindex].sh_size,
-                                         sechdrs[pcpuindex].sh_addralign,
-                                         mod->name);
-                if (!percpu) {
-                        err = -ENOMEM;
+                err = percpu_modalloc(mod, sechdrs[pcpuindex].sh_size,
+                                      sechdrs[pcpuindex].sh_addralign);
+                if (err)
                         goto free_mod;
-                }
                 sechdrs[pcpuindex].sh_flags &= ~(unsigned long)SHF_ALLOC;
-                mod->percpu = percpu;
         }
 
         /* Determine total sizes, and put offsets in sh_entsize.  For now
@@ -2162,9 +2219,8 @@ static noinline struct module *load_module(void __user *umod,
         mod = (void *)sechdrs[modindex].sh_addr;
         kmemleak_load_module(mod, hdr, sechdrs, secstrings);
 
-#if defined(CONFIG_MODULE_UNLOAD) && defined(CONFIG_SMP)
-        mod->refptr = percpu_modalloc(sizeof(local_t), __alignof__(local_t),
-                                      mod->name);
+#if defined(CONFIG_MODULE_UNLOAD)
+        mod->refptr = alloc_percpu(struct module_ref);
         if (!mod->refptr) {
                 err = -ENOMEM;
                 goto free_init;
@@ -2313,7 +2369,7 @@ static noinline struct module *load_module(void __user *umod,
         sort_extable(mod->extable, mod->extable + mod->num_exentries);
 
         /* Finally, copy percpu area over. */
-        percpu_modcopy(mod->percpu, (void *)sechdrs[pcpuindex].sh_addr,
+        percpu_modcopy(mod, (void *)sechdrs[pcpuindex].sh_addr,
                        sechdrs[pcpuindex].sh_size);
 
         add_kallsyms(mod, sechdrs, hdr->e_shnum, symindex, strindex,
@@ -2396,8 +2452,8 @@ static noinline struct module *load_module(void __user *umod,
         kobject_put(&mod->mkobj.kobj);
  free_unload:
         module_unload_free(mod);
-#if defined(CONFIG_MODULE_UNLOAD) && defined(CONFIG_SMP)
-        percpu_modfree(mod->refptr);
+#if defined(CONFIG_MODULE_UNLOAD)
+        free_percpu(mod->refptr);
  free_init:
 #endif
         module_free(mod, mod->module_init);
@@ -2405,8 +2461,7 @@ static noinline struct module *load_module(void __user *umod,
         module_free(mod, mod->module_core);
         /* mod will be freed with core. Don't access it beyond this line! */
  free_percpu:
-        if (percpu)
-                percpu_modfree(percpu);
+        percpu_modfree(mod);
  free_mod:
         kfree(args);
         kfree(strmap);