/* * Driver for the NXP ISP1760 chip * * Copyright 2014 Laurent Pinchart * Copyright 2007 Sebastian Siewior * * Contacts: * Sebastian Siewior * Laurent Pinchart * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * version 2 as published by the Free Software Foundation. */ #include #include #include #include #include #include #include #include "isp1760-core.h" #include "isp1760-hcd.h" #include "isp1760-regs.h" #include "isp1760-udc.h" static void isp1760_init_core(struct isp1760_device *isp) { u32 otgctrl; u32 hwmode; /* Low-level chip reset */ if (isp->rst_gpio) { gpiod_set_value_cansleep(isp->rst_gpio, 1); mdelay(50); gpiod_set_value_cansleep(isp->rst_gpio, 0); } /* * Reset the host controller, including the CPU interface * configuration. */ isp1760_write32(isp->regs, HC_RESET_REG, SW_RESET_RESET_ALL); msleep(100); /* Setup HW Mode Control: This assumes a level active-low interrupt */ hwmode = HW_DATA_BUS_32BIT; if (isp->devflags & ISP1760_FLAG_BUS_WIDTH_16) hwmode &= ~HW_DATA_BUS_32BIT; if (isp->devflags & ISP1760_FLAG_ANALOG_OC) hwmode |= HW_ANA_DIGI_OC; if (isp->devflags & ISP1760_FLAG_DACK_POL_HIGH) hwmode |= HW_DACK_POL_HIGH; if (isp->devflags & ISP1760_FLAG_DREQ_POL_HIGH) hwmode |= HW_DREQ_POL_HIGH; if (isp->devflags & ISP1760_FLAG_INTR_POL_HIGH) hwmode |= HW_INTR_HIGH_ACT; if (isp->devflags & ISP1760_FLAG_INTR_EDGE_TRIG) hwmode |= HW_INTR_EDGE_TRIG; /* * The ISP1761 has a dedicated DC IRQ line but supports sharing the HC * IRQ line for both the host and device controllers. Hardcode IRQ * sharing for now and disable the DC interrupts globally to avoid * spurious interrupts during HCD registration. */ if (isp->devflags & ISP1760_FLAG_ISP1761) { isp1760_write32(isp->regs, DC_MODE, 0); hwmode |= HW_COMN_IRQ; } /* * We have to set this first in case we're in 16-bit mode. * Write it twice to ensure correct upper bits if switching * to 16-bit mode. */ isp1760_write32(isp->regs, HC_HW_MODE_CTRL, hwmode); isp1760_write32(isp->regs, HC_HW_MODE_CTRL, hwmode); /* * PORT 1 Control register of the ISP1760 is the OTG control register * on ISP1761. * * TODO: Really support OTG. For now we configure port 1 in device mode * when OTG is requested. */ if ((isp->devflags & ISP1760_FLAG_ISP1761) && (isp->devflags & ISP1760_FLAG_OTG_EN)) otgctrl = ((HW_DM_PULLDOWN | HW_DP_PULLDOWN) << 16) | HW_OTG_DISABLE; else otgctrl = (HW_SW_SEL_HC_DC << 16) | (HW_VBUS_DRV | HW_SEL_CP_EXT); isp1760_write32(isp->regs, HC_PORT1_CTRL, otgctrl); dev_info(isp->dev, "bus width: %u, oc: %s\n", isp->devflags & ISP1760_FLAG_BUS_WIDTH_16 ? 16 : 32, isp->devflags & ISP1760_FLAG_ANALOG_OC ? "analog" : "digital"); } void isp1760_set_pullup(struct isp1760_device *isp, bool enable) { isp1760_write32(isp->regs, HW_OTG_CTRL_SET, enable ? HW_DP_PULLUP : HW_DP_PULLUP << 16); } int isp1760_register(struct resource *mem, int irq, unsigned long irqflags, struct device *dev, unsigned int devflags) { struct isp1760_device *isp; bool udc_disabled = !(devflags & ISP1760_FLAG_ISP1761); int ret; /* * If neither the HCD not the UDC is enabled return an error, as no * device would be registered. */ if ((!IS_ENABLED(CONFIG_USB_ISP1760_HCD) || usb_disabled()) && (!IS_ENABLED(CONFIG_USB_ISP1761_UDC) || udc_disabled)) return -ENODEV; /* prevent usb-core allocating DMA pages */ dev->dma_mask = NULL; isp = devm_kzalloc(dev, sizeof(*isp), GFP_KERNEL); if (!isp) return -ENOMEM; isp->dev = dev; isp->devflags = devflags; isp->rst_gpio = devm_gpiod_get_optional(dev, NULL, GPIOD_OUT_HIGH); if (IS_ERR(isp->rst_gpio)) return PTR_ERR(isp->rst_gpio); isp->regs = devm_ioremap_resource(dev, mem); if (IS_ERR(isp->regs)) return PTR_ERR(isp->regs); isp1760_init_core(isp); if (IS_ENABLED(CONFIG_USB_ISP1760_HCD) && !usb_disabled()) { ret = isp1760_hcd_register(&isp->hcd, isp->regs, mem, irq, irqflags | IRQF_SHARED, dev); if (ret < 0) return ret; } if (IS_ENABLED(CONFIG_USB_ISP1761_UDC) && !udc_disabled) { ret = isp1760_udc_register(isp, irq, irqflags); if (ret < 0) { isp1760_hcd_unregister(&isp->hcd); return ret; } } dev_set_drvdata(dev, isp); return 0; } void isp1760_unregister(struct device *dev) { struct isp1760_device *isp = dev_get_drvdata(dev); isp1760_udc_unregister(isp); isp1760_hcd_unregister(&isp->hcd); } MODULE_DESCRIPTION("Driver for the ISP1760 USB-controller from NXP"); MODULE_AUTHOR("Sebastian Siewior "); MODULE_LICENSE("GPL v2"); linux/net-next.git/commit/net/bluetooth/a2mp.h?id=966d2b04e070bc040319aaebfec09e0144dc3341'>966d2b04e070bc040319aaebfec09e0144dc3341 (patch) tree4b96156e3d1dd4dfd6039b7c219c9dc4616da52d /net/bluetooth/a2mp.h parent1b1bc42c1692e9b62756323c675a44cb1a1f9dbd (diff)
percpu-refcount: fix reference leak during percpu-atomic transition
percpu_ref_tryget() and percpu_ref_tryget_live() should return "true" IFF they acquire a reference. But the return value from atomic_long_inc_not_zero() is a long and may have high bits set, e.g. PERCPU_COUNT_BIAS, and the return value of the tryget routines is bool so the reference may actually be acquired but the routines return "false" which results in a reference leak since the caller assumes it does not need to do a corresponding percpu_ref_put(). This was seen when performing CPU hotplug during I/O, as hangs in blk_mq_freeze_queue_wait where percpu_ref_kill (blk_mq_freeze_queue_start) raced with percpu_ref_tryget (blk_mq_timeout_work). Sample stack trace: __switch_to+0x2c0/0x450 __schedule+0x2f8/0x970 schedule+0x48/0xc0 blk_mq_freeze_queue_wait+0x94/0x120 blk_mq_queue_reinit_work+0xb8/0x180 blk_mq_queue_reinit_prepare+0x84/0xa0 cpuhp_invoke_callback+0x17c/0x600 cpuhp_up_callbacks+0x58/0x150 _cpu_up+0xf0/0x1c0 do_cpu_up+0x120/0x150 cpu_subsys_online+0x64/0xe0 device_online+0xb4/0x120 online_store+0xb4/0xc0 dev_attr_store+0x68/0xa0 sysfs_kf_write+0x80/0xb0 kernfs_fop_write+0x17c/0x250 __vfs_write+0x6c/0x1e0 vfs_write+0xd0/0x270 SyS_write+0x6c/0x110 system_call+0x38/0xe0 Examination of the queue showed a single reference (no PERCPU_COUNT_BIAS, and __PERCPU_REF_DEAD, __PERCPU_REF_ATOMIC set) and no requests. However, conditions at the time of the race are count of PERCPU_COUNT_BIAS + 0 and __PERCPU_REF_DEAD and __PERCPU_REF_ATOMIC set. The fix is to make the tryget routines use an actual boolean internally instead of the atomic long result truncated to a int. Fixes: e625305b3907 percpu-refcount: make percpu_ref based on longs instead of ints Link: https://bugzilla.kernel.org/show_bug.cgi?id=190751 Signed-off-by: Douglas Miller <dougmill@linux.vnet.ibm.com> Reviewed-by: Jens Axboe <axboe@fb.com> Signed-off-by: Tejun Heo <tj@kernel.org> Fixes: e625305b3907 ("percpu-refcount: make percpu_ref based on longs instead of ints") Cc: stable@vger.kernel.org # v3.18+
Diffstat (limited to 'net/bluetooth/a2mp.h')