/* * Copyright (C) 2010, Paul Cercueil * JZ4740 Watchdog driver * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the * Free Software Foundation; either version 2 of the License, or (at your * option) any later version. * * You should have received a copy of the GNU General Public License along * with this program; if not, write to the Free Software Foundation, Inc., * 675 Mass Ave, Cambridge, MA 02139, USA. * */ #include #include #include #include #include #include #include #include #include #include #include #include #include #define JZ_REG_WDT_TIMER_DATA 0x0 #define JZ_REG_WDT_COUNTER_ENABLE 0x4 #define JZ_REG_WDT_TIMER_COUNTER 0x8 #define JZ_REG_WDT_TIMER_CONTROL 0xC #define JZ_WDT_CLOCK_PCLK 0x1 #define JZ_WDT_CLOCK_RTC 0x2 #define JZ_WDT_CLOCK_EXT 0x4 #define JZ_WDT_CLOCK_DIV_SHIFT 3 #define JZ_WDT_CLOCK_DIV_1 (0 << JZ_WDT_CLOCK_DIV_SHIFT) #define JZ_WDT_CLOCK_DIV_4 (1 << JZ_WDT_CLOCK_DIV_SHIFT) #define JZ_WDT_CLOCK_DIV_16 (2 << JZ_WDT_CLOCK_DIV_SHIFT) #define JZ_WDT_CLOCK_DIV_64 (3 << JZ_WDT_CLOCK_DIV_SHIFT) #define JZ_WDT_CLOCK_DIV_256 (4 << JZ_WDT_CLOCK_DIV_SHIFT) #define JZ_WDT_CLOCK_DIV_1024 (5 << JZ_WDT_CLOCK_DIV_SHIFT) #define DEFAULT_HEARTBEAT 5 #define MAX_HEARTBEAT 2048 static bool nowayout = WATCHDOG_NOWAYOUT; module_param(nowayout, bool, 0); MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")"); static unsigned int heartbeat = DEFAULT_HEARTBEAT; module_param(heartbeat, uint, 0); MODULE_PARM_DESC(heartbeat, "Watchdog heartbeat period in seconds from 1 to " __MODULE_STRING(MAX_HEARTBEAT) ", default " __MODULE_STRING(DEFAULT_HEARTBEAT)); struct jz4740_wdt_drvdata { struct watchdog_device wdt; void __iomem *base; struct clk *rtc_clk; }; static int jz4740_wdt_ping(struct watchdog_device *wdt_dev) { struct jz4740_wdt_drvdata *drvdata = watchdog_get_drvdata(wdt_dev); writew(0x0, drvdata->base + JZ_REG_WDT_TIMER_COUNTER); return 0; } static int jz4740_wdt_set_timeout(struct watchdog_device *wdt_dev, unsigned int new_timeout) { struct jz4740_wdt_drvdata *drvdata = watchdog_get_drvdata(wdt_dev); unsigned int rtc_clk_rate; unsigned int timeout_value; unsigned short clock_div = JZ_WDT_CLOCK_DIV_1; rtc_clk_rate = clk_get_rate(drvdata->rtc_clk); timeout_value = rtc_clk_rate * new_timeout; while (timeout_value > 0xffff) { if (clock_div == JZ_WDT_CLOCK_DIV_1024) { /* Requested timeout too high; * use highest possible value. */ timeout_value = 0xffff; break; } timeout_value >>= 2; clock_div += (1 << JZ_WDT_CLOCK_DIV_SHIFT); } writeb(0x0, drvdata->base + JZ_REG_WDT_COUNTER_ENABLE); writew(clock_div, drvdata->base + JZ_REG_WDT_TIMER_CONTROL); writew((u16)timeout_value, drvdata->base + JZ_REG_WDT_TIMER_DATA); writew(0x0, drvdata->base + JZ_REG_WDT_TIMER_COUNTER); writew(clock_div | JZ_WDT_CLOCK_RTC, drvdata->base + JZ_REG_WDT_TIMER_CONTROL); writeb(0x1, drvdata->base + JZ_REG_WDT_COUNTER_ENABLE); wdt_dev->timeout = new_timeout; return 0; } static int jz4740_wdt_start(struct watchdog_device *wdt_dev) { jz4740_timer_enable_watchdog(); jz4740_wdt_set_timeout(wdt_dev, wdt_dev->timeout); return 0; } static int jz4740_wdt_stop(struct watchdog_device *wdt_dev) { struct jz4740_wdt_drvdata *drvdata = watchdog_get_drvdata(wdt_dev); jz4740_timer_disable_watchdog(); writeb(0x0, drvdata->base + JZ_REG_WDT_COUNTER_ENABLE); return 0; } static const struct watchdog_info jz4740_wdt_info = { .options = WDIOF_SETTIMEOUT | WDIOF_KEEPALIVEPING | WDIOF_MAGICCLOSE, .identity = "jz4740 Watchdog", }; static const struct watchdog_ops jz4740_wdt_ops = { .owner = THIS_MODULE, .start = jz4740_wdt_start, .stop = jz4740_wdt_stop, .ping = jz4740_wdt_ping, .set_timeout = jz4740_wdt_set_timeout, }; #ifdef CONFIG_OF static const struct of_device_id jz4740_wdt_of_matches[] = { { .compatible = "ingenic,jz4740-watchdog", }, { /* sentinel */ } }; MODULE_DEVICE_TABLE(of, jz4740_wdt_of_matches); #endif static int jz4740_wdt_probe(struct platform_device *pdev) { struct jz4740_wdt_drvdata *drvdata; struct watchdog_device *jz4740_wdt; struct resource *res; int ret; drvdata = devm_kzalloc(&pdev->dev, sizeof(struct jz4740_wdt_drvdata), GFP_KERNEL); if (!drvdata) return -ENOMEM; if (heartbeat < 1 || heartbeat > MAX_HEARTBEAT) heartbeat = DEFAULT_HEARTBEAT; jz4740_wdt = &drvdata->wdt; jz4740_wdt->info = &jz4740_wdt_info; jz4740_wdt->ops = &jz4740_wdt_ops; jz4740_wdt->timeout = heartbeat; jz4740_wdt->min_timeout = 1; jz4740_wdt->max_timeout = MAX_HEARTBEAT; jz4740_wdt->parent = &pdev->dev; watchdog_set_nowayout(jz4740_wdt, nowayout); watchdog_set_drvdata(jz4740_wdt, drvdata); res = platform_get_resource(pdev, IORESOURCE_MEM, 0); drvdata->base = devm_ioremap_resource(&pdev->dev, res); if (IS_ERR(drvdata->base)) { ret = PTR_ERR(drvdata->base); goto err_out; } drvdata->rtc_clk = clk_get(&pdev->dev, "rtc"); if (IS_ERR(drvdata->rtc_clk)) { dev_err(&pdev->dev, "cannot find RTC clock\n"); ret = PTR_ERR(drvdata->rtc_clk); goto err_out; } ret = watchdog_register_device(&drvdata->wdt); if (ret < 0) goto err_disable_clk; platform_set_drvdata(pdev, drvdata); return 0; err_disable_clk: clk_put(drvdata->rtc_clk); err_out: return ret; } static int jz4740_wdt_remove(struct platform_device *pdev) { struct jz4740_wdt_drvdata *drvdata = platform_get_drvdata(pdev); jz4740_wdt_stop(&drvdata->wdt); watchdog_unregister_device(&drvdata->wdt); clk_put(drvdata->rtc_clk); return 0; } static struct platform_driver jz4740_wdt_driver = { .probe = jz4740_wdt_probe, .remove = jz4740_wdt_remove, .driver = { .name = "jz4740-wdt", .of_match_table = of_match_ptr(jz4740_wdt_of_matches), }, }; module_platform_driver(jz4740_wdt_driver); MODULE_AUTHOR("Paul Cercueil "); MODULE_DESCRIPTION("jz4740 Watchdog Driver"); MODULE_LICENSE("GPL"); MODULE_ALIAS("platform:jz4740-wdt"); _tryget_live() should return "true" IFF they acquire a reference. But the return value from atomic_long_inc_not_zero() is a long and may have high bits set, e.g. PERCPU_COUNT_BIAS, and the return value of the tryget routines is bool so the reference may actually be acquired but the routines return "false" which results in a reference leak since the caller assumes it does not need to do a corresponding percpu_ref_put(). This was seen when performing CPU hotplug during I/O, as hangs in blk_mq_freeze_queue_wait where percpu_ref_kill (blk_mq_freeze_queue_start) raced with percpu_ref_tryget (blk_mq_timeout_work). Sample stack trace: __switch_to+0x2c0/0x450 __schedule+0x2f8/0x970 schedule+0x48/0xc0 blk_mq_freeze_queue_wait+0x94/0x120 blk_mq_queue_reinit_work+0xb8/0x180 blk_mq_queue_reinit_prepare+0x84/0xa0 cpuhp_invoke_callback+0x17c/0x600 cpuhp_up_callbacks+0x58/0x150 _cpu_up+0xf0/0x1c0 do_cpu_up+0x120/0x150 cpu_subsys_online+0x64/0xe0 device_online+0xb4/0x120 online_store+0xb4/0xc0 dev_attr_store+0x68/0xa0 sysfs_kf_write+0x80/0xb0 kernfs_fop_write+0x17c/0x250 __vfs_write+0x6c/0x1e0 vfs_write+0xd0/0x270 SyS_write+0x6c/0x110 system_call+0x38/0xe0 Examination of the queue showed a single reference (no PERCPU_COUNT_BIAS, and __PERCPU_REF_DEAD, __PERCPU_REF_ATOMIC set) and no requests. However, conditions at the time of the race are count of PERCPU_COUNT_BIAS + 0 and __PERCPU_REF_DEAD and __PERCPU_REF_ATOMIC set. The fix is to make the tryget routines use an actual boolean internally instead of the atomic long result truncated to a int. Fixes: e625305b3907 percpu-refcount: make percpu_ref based on longs instead of ints Link: https://bugzilla.kernel.org/show_bug.cgi?id=190751 Signed-off-by: Douglas Miller <dougmill@linux.vnet.ibm.com> Reviewed-by: Jens Axboe <axboe@fb.com> Signed-off-by: Tejun Heo <tj@kernel.org> Fixes: e625305b3907 ("percpu-refcount: make percpu_ref based on longs instead of ints") Cc: stable@vger.kernel.org # v3.18+
Diffstat (limited to 'include/dt-bindings/reset/ti-syscon.h')