/* * xHCI host controller driver for R-Car SoCs * * Copyright (C) 2014 Renesas Electronics Corporation * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * version 2 as published by the Free Software Foundation. */ #include #include #include #include #include #include "xhci.h" #include "xhci-plat.h" #include "xhci-rcar.h" /* * - The V3 firmware is for r8a7796 (with good performance). * - The V2 firmware can be used on both r8a7795 (es1.x) and r8a7796. * - The V2 firmware is possible to use on R-Car Gen2. However, the V2 causes * performance degradation. So, this driver continues to use the V1 if R-Car * Gen2. * - The V1 firmware is impossible to use on R-Car Gen3. */ MODULE_FIRMWARE(XHCI_RCAR_FIRMWARE_NAME_V1); MODULE_FIRMWARE(XHCI_RCAR_FIRMWARE_NAME_V2); MODULE_FIRMWARE(XHCI_RCAR_FIRMWARE_NAME_V3); /*** Register Offset ***/ #define RCAR_USB3_INT_ENA 0x224 /* Interrupt Enable */ #define RCAR_USB3_DL_CTRL 0x250 /* FW Download Control & Status */ #define RCAR_USB3_FW_DATA0 0x258 /* FW Data0 */ #define RCAR_USB3_LCLK 0xa44 /* LCLK Select */ #define RCAR_USB3_CONF1 0xa48 /* USB3.0 Configuration1 */ #define RCAR_USB3_CONF2 0xa5c /* USB3.0 Configuration2 */ #define RCAR_USB3_CONF3 0xaa8 /* USB3.0 Configuration3 */ #define RCAR_USB3_RX_POL 0xab0 /* USB3.0 RX Polarity */ #define RCAR_USB3_TX_POL 0xab8 /* USB3.0 TX Polarity */ /*** Register Settings ***/ /* Interrupt Enable */ #define RCAR_USB3_INT_XHC_ENA 0x00000001 #define RCAR_USB3_INT_PME_ENA 0x00000002 #define RCAR_USB3_INT_HSE_ENA 0x00000004 #define RCAR_USB3_INT_ENA_VAL (RCAR_USB3_INT_XHC_ENA | \ RCAR_USB3_INT_PME_ENA | RCAR_USB3_INT_HSE_ENA) /* FW Download Control & Status */ #define RCAR_USB3_DL_CTRL_ENABLE 0x00000001 #define RCAR_USB3_DL_CTRL_FW_SUCCESS 0x00000010 #define RCAR_USB3_DL_CTRL_FW_SET_DATA0 0x00000100 /* LCLK Select */ #define RCAR_USB3_LCLK_ENA_VAL 0x01030001 /* USB3.0 Configuration */ #define RCAR_USB3_CONF1_VAL 0x00030204 #define RCAR_USB3_CONF2_VAL 0x00030300 #define RCAR_USB3_CONF3_VAL 0x13802007 /* USB3.0 Polarity */ #define RCAR_USB3_RX_POL_VAL BIT(21) #define RCAR_USB3_TX_POL_VAL BIT(4) static void xhci_rcar_start_gen2(struct usb_hcd *hcd) { /* LCLK Select */ writel(RCAR_USB3_LCLK_ENA_VAL, hcd->regs + RCAR_USB3_LCLK); /* USB3.0 Configuration */ writel(RCAR_USB3_CONF1_VAL, hcd->regs + RCAR_USB3_CONF1); writel(RCAR_USB3_CONF2_VAL, hcd->regs + RCAR_USB3_CONF2); writel(RCAR_USB3_CONF3_VAL, hcd->regs + RCAR_USB3_CONF3); /* USB3.0 Polarity */ writel(RCAR_USB3_RX_POL_VAL, hcd->regs + RCAR_USB3_RX_POL); writel(RCAR_USB3_TX_POL_VAL, hcd->regs + RCAR_USB3_TX_POL); } static int xhci_rcar_is_gen2(struct device *dev) { struct device_node *node = dev->of_node; return of_device_is_compatible(node, "renesas,xhci-r8a7790") || of_device_is_compatible(node, "renesas,xhci-r8a7791") || of_device_is_compatible(node, "renesas,xhci-r8a7793") || of_device_is_compatible(node, "renensas,rcar-gen2-xhci"); } static int xhci_rcar_is_gen3(struct device *dev) { struct device_node *node = dev->of_node; return of_device_is_compatible(node, "renesas,xhci-r8a7795") || of_device_is_compatible(node, "renesas,xhci-r8a7796") || of_device_is_compatible(node, "renesas,rcar-gen3-xhci"); } void xhci_rcar_start(struct usb_hcd *hcd) { u32 temp; if (hcd->regs != NULL) { /* Interrupt Enable */ temp = readl(hcd->regs + RCAR_USB3_INT_ENA); temp |= RCAR_USB3_INT_ENA_VAL; writel(temp, hcd->regs + RCAR_USB3_INT_ENA); if (xhci_rcar_is_gen2(hcd->self.controller)) xhci_rcar_start_gen2(hcd); } } static int xhci_rcar_download_firmware(struct usb_hcd *hcd) { struct device *dev = hcd->self.controller; void __iomem *regs = hcd->regs; struct xhci_plat_priv *priv = hcd_to_xhci_priv(hcd); const struct firmware *fw; int retval, index, j, time; int timeout = 10000; u32 data, val, temp; /* request R-Car USB3.0 firmware */ retval = request_firmware(&fw, priv->firmware_name, dev); if (retval) return retval; /* download R-Car USB3.0 firmware */ temp = readl(regs + RCAR_USB3_DL_CTRL); temp |= RCAR_USB3_DL_CTRL_ENABLE; writel(temp, regs + RCAR_USB3_DL_CTRL); for (index = 0; index < fw->size; index += 4) { /* to avoid reading beyond the end of the buffer */ for (data = 0, j = 3; j >= 0; j--) { if ((j + index) < fw->size) data |= fw->data[index + j] << (8 * j); } writel(data, regs + RCAR_USB3_FW_DATA0); temp = readl(regs + RCAR_USB3_DL_CTRL); temp |= RCAR_USB3_DL_CTRL_FW_SET_DATA0; writel(temp, regs + RCAR_USB3_DL_CTRL); for (time = 0; time < timeout; time++) { val = readl(regs + RCAR_USB3_DL_CTRL); if ((val & RCAR_USB3_DL_CTRL_FW_SET_DATA0) == 0) break; udelay(1); } if (time == timeout) { retval = -ETIMEDOUT; break; } } temp = readl(regs + RCAR_USB3_DL_CTRL); temp &= ~RCAR_USB3_DL_CTRL_ENABLE; writel(temp, regs + RCAR_USB3_DL_CTRL); for (time = 0; time < timeout; time++) { val = readl(regs + RCAR_USB3_DL_CTRL); if (val & RCAR_USB3_DL_CTRL_FW_SUCCESS) { retval = 0; break; } udelay(1); } if (time == timeout) retval = -ETIMEDOUT; release_firmware(fw); return retval; } /* This function needs to initialize a "phy" of usb before */ int xhci_rcar_init_quirk(struct usb_hcd *hcd) { struct xhci_hcd *xhci = hcd_to_xhci(hcd); /* If hcd->regs is NULL, we don't just call the following function */ if (!hcd->regs) return 0; /* * On R-Car Gen2 and Gen3, the AC64 bit (bit 0) of HCCPARAMS1 is set * to 1. However, these SoCs don't support 64-bit address memory * pointers. So, this driver clears the AC64 bit of xhci->hcc_params * to call dma_set_coherent_mask(dev, DMA_BIT_MASK(32)) in * xhci_gen_setup(). */ if (xhci_rcar_is_gen2(hcd->self.controller) || xhci_rcar_is_gen3(hcd->self.controller)) xhci->quirks |= XHCI_NO_64BIT_SUPPORT; return xhci_rcar_download_firmware(hcd); } emu10k1/io.c parent1b1bc42c1692e9b62756323c675a44cb1a1f9dbd (diff)
percpu-refcount: fix reference leak during percpu-atomic transition
percpu_ref_tryget() and percpu_ref_tryget_live() should return "true" IFF they acquire a reference. But the return value from atomic_long_inc_not_zero() is a long and may have high bits set, e.g. PERCPU_COUNT_BIAS, and the return value of the tryget routines is bool so the reference may actually be acquired but the routines return "false" which results in a reference leak since the caller assumes it does not need to do a corresponding percpu_ref_put(). This was seen when performing CPU hotplug during I/O, as hangs in blk_mq_freeze_queue_wait where percpu_ref_kill (blk_mq_freeze_queue_start) raced with percpu_ref_tryget (blk_mq_timeout_work). Sample stack trace: __switch_to+0x2c0/0x450 __schedule+0x2f8/0x970 schedule+0x48/0xc0 blk_mq_freeze_queue_wait+0x94/0x120 blk_mq_queue_reinit_work+0xb8/0x180 blk_mq_queue_reinit_prepare+0x84/0xa0 cpuhp_invoke_callback+0x17c/0x600 cpuhp_up_callbacks+0x58/0x150 _cpu_up+0xf0/0x1c0 do_cpu_up+0x120/0x150 cpu_subsys_online+0x64/0xe0 device_online+0xb4/0x120 online_store+0xb4/0xc0 dev_attr_store+0x68/0xa0 sysfs_kf_write+0x80/0xb0 kernfs_fop_write+0x17c/0x250 __vfs_write+0x6c/0x1e0 vfs_write+0xd0/0x270 SyS_write+0x6c/0x110 system_call+0x38/0xe0 Examination of the queue showed a single reference (no PERCPU_COUNT_BIAS, and __PERCPU_REF_DEAD, __PERCPU_REF_ATOMIC set) and no requests. However, conditions at the time of the race are count of PERCPU_COUNT_BIAS + 0 and __PERCPU_REF_DEAD and __PERCPU_REF_ATOMIC set. The fix is to make the tryget routines use an actual boolean internally instead of the atomic long result truncated to a int. Fixes: e625305b3907 percpu-refcount: make percpu_ref based on longs instead of ints Link: https://bugzilla.kernel.org/show_bug.cgi?id=190751 Signed-off-by: Douglas Miller <dougmill@linux.vnet.ibm.com> Reviewed-by: Jens Axboe <axboe@fb.com> Signed-off-by: Tejun Heo <tj@kernel.org> Fixes: e625305b3907 ("percpu-refcount: make percpu_ref based on longs instead of ints") Cc: stable@vger.kernel.org # v3.18+
Diffstat (limited to 'sound/pci/emu10k1/io.c')