/* * Driver for SMSC USB4604 USB HSIC 4-port 2.0 hub controller driver * Based on usb3503 driver * * Copyright (c) 2012-2013 Dongjin Kim (tobetter@gmail.com) * Copyright (c) 2016 Linaro Ltd. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. */ #include #include #include #include #include enum usb4604_mode { USB4604_MODE_UNKNOWN, USB4604_MODE_HUB, USB4604_MODE_STANDBY, }; struct usb4604 { enum usb4604_mode mode; struct device *dev; struct gpio_desc *gpio_reset; }; static void usb4604_reset(struct usb4604 *hub, int state) { gpiod_set_value_cansleep(hub->gpio_reset, state); /* Wait for i2c logic to come up */ if (state) msleep(250); } static int usb4604_connect(struct usb4604 *hub) { struct device *dev = hub->dev; struct i2c_client *client = to_i2c_client(dev); int err; u8 connect_cmd[] = { 0xaa, 0x55, 0x00 }; usb4604_reset(hub, 1); err = i2c_master_send(client, connect_cmd, ARRAY_SIZE(connect_cmd)); if (err < 0) { usb4604_reset(hub, 0); return err; } hub->mode = USB4604_MODE_HUB; dev_dbg(dev, "switched to HUB mode\n"); return 0; } static int usb4604_switch_mode(struct usb4604 *hub, enum usb4604_mode mode) { struct device *dev = hub->dev; int err = 0; switch (mode) { case USB4604_MODE_HUB: err = usb4604_connect(hub); break; case USB4604_MODE_STANDBY: usb4604_reset(hub, 0); dev_dbg(dev, "switched to STANDBY mode\n"); break; default: dev_err(dev, "unknown mode is requested\n"); err = -EINVAL; break; } return err; } static int usb4604_probe(struct usb4604 *hub) { struct device *dev = hub->dev; struct device_node *np = dev->of_node; struct gpio_desc *gpio; u32 mode = USB4604_MODE_HUB; gpio = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW); if (IS_ERR(gpio)) return PTR_ERR(gpio); hub->gpio_reset = gpio; if (of_property_read_u32(np, "initial-mode", &hub->mode)) hub->mode = mode; return usb4604_switch_mode(hub, hub->mode); } static int usb4604_i2c_probe(struct i2c_client *i2c, const struct i2c_device_id *id) { struct usb4604 *hub; hub = devm_kzalloc(&i2c->dev, sizeof(*hub), GFP_KERNEL); if (!hub) return -ENOMEM; i2c_set_clientdata(i2c, hub); hub->dev = &i2c->dev; return usb4604_probe(hub); } #ifdef CONFIG_PM_SLEEP static int usb4604_i2c_suspend(struct device *dev) { struct i2c_client *client = to_i2c_client(dev); struct usb4604 *hub = i2c_get_clientdata(client); usb4604_switch_mode(hub, USB4604_MODE_STANDBY); return 0; } static int usb4604_i2c_resume(struct device *dev) { struct i2c_client *client = to_i2c_client(dev); struct usb4604 *hub = i2c_get_clientdata(client); usb4604_switch_mode(hub, hub->mode); return 0; } #endif static SIMPLE_DEV_PM_OPS(usb4604_i2c_pm_ops, usb4604_i2c_suspend, usb4604_i2c_resume); static const struct i2c_device_id usb4604_id[] = { { "usb4604", 0 }, { } }; MODULE_DEVICE_TABLE(i2c, usb4604_id); #ifdef CONFIG_OF static const struct of_device_id usb4604_of_match[] = { { .compatible = "smsc,usb4604" }, {} }; MODULE_DEVICE_TABLE(of, usb4604_of_match); #endif static struct i2c_driver usb4604_i2c_driver = { .driver = { .name = "usb4604", .pm = &usb4604_i2c_pm_ops, .of_match_table = of_match_ptr(usb4604_of_match), }, .probe = usb4604_i2c_probe, .id_table = usb4604_id, }; module_i2c_driver(usb4604_i2c_driver); MODULE_DESCRIPTION("USB4604 USB HUB driver"); MODULE_LICENSE("GPL v2"); >space:mode:
authorDouglas Miller <dougmill@linux.vnet.ibm.com>2017-01-28 06:42:20 -0600
committerTejun Heo <tj@kernel.org>2017-01-28 07:49:42 -0500
commit966d2b04e070bc040319aaebfec09e0144dc3341 (patch)
tree4b96156e3d1dd4dfd6039b7c219c9dc4616da52d /sound/pci/trident/Makefile
parent1b1bc42c1692e9b62756323c675a44cb1a1f9dbd (diff)
percpu-refcount: fix reference leak during percpu-atomic transition
percpu_ref_tryget() and percpu_ref_tryget_live() should return "true" IFF they acquire a reference. But the return value from atomic_long_inc_not_zero() is a long and may have high bits set, e.g. PERCPU_COUNT_BIAS, and the return value of the tryget routines is bool so the reference may actually be acquired but the routines return "false" which results in a reference leak since the caller assumes it does not need to do a corresponding percpu_ref_put(). This was seen when performing CPU hotplug during I/O, as hangs in blk_mq_freeze_queue_wait where percpu_ref_kill (blk_mq_freeze_queue_start) raced with percpu_ref_tryget (blk_mq_timeout_work). Sample stack trace: __switch_to+0x2c0/0x450 __schedule+0x2f8/0x970 schedule+0x48/0xc0 blk_mq_freeze_queue_wait+0x94/0x120 blk_mq_queue_reinit_work+0xb8/0x180 blk_mq_queue_reinit_prepare+0x84/0xa0 cpuhp_invoke_callback+0x17c/0x600 cpuhp_up_callbacks+0x58/0x150 _cpu_up+0xf0/0x1c0 do_cpu_up+0x120/0x150 cpu_subsys_online+0x64/0xe0 device_online+0xb4/0x120 online_store+0xb4/0xc0 dev_attr_store+0x68/0xa0 sysfs_kf_write+0x80/0xb0 kernfs_fop_write+0x17c/0x250 __vfs_write+0x6c/0x1e0 vfs_write+0xd0/0x270 SyS_write+0x6c/0x110 system_call+0x38/0xe0 Examination of the queue showed a single reference (no PERCPU_COUNT_BIAS, and __PERCPU_REF_DEAD, __PERCPU_REF_ATOMIC set) and no requests. However, conditions at the time of the race are count of PERCPU_COUNT_BIAS + 0 and __PERCPU_REF_DEAD and __PERCPU_REF_ATOMIC set. The fix is to make the tryget routines use an actual boolean internally instead of the atomic long result truncated to a int. Fixes: e625305b3907 percpu-refcount: make percpu_ref based on longs instead of ints Link: https://bugzilla.kernel.org/show_bug.cgi?id=190751 Signed-off-by: Douglas Miller <dougmill@linux.vnet.ibm.com> Reviewed-by: Jens Axboe <axboe@fb.com> Signed-off-by: Tejun Heo <tj@kernel.org> Fixes: e625305b3907 ("percpu-refcount: make percpu_ref based on longs instead of ints") Cc: stable@vger.kernel.org # v3.18+
Diffstat (limited to 'sound/pci/trident/Makefile')