/* * Driver for Atmel SAMA5D4 Watchdog Timer * * Copyright (C) 2015 Atmel Corporation * * Licensed under GPLv2. */ #include #include #include #include #include #include #include #include #include #include "at91sam9_wdt.h" /* minimum and maximum watchdog timeout, in seconds */ #define MIN_WDT_TIMEOUT 1 #define MAX_WDT_TIMEOUT 16 #define WDT_DEFAULT_TIMEOUT MAX_WDT_TIMEOUT #define WDT_SEC2TICKS(s) ((s) ? (((s) << 8) - 1) : 0) struct sama5d4_wdt { struct watchdog_device wdd; void __iomem *reg_base; u32 config; }; static int wdt_timeout = WDT_DEFAULT_TIMEOUT; static bool nowayout = WATCHDOG_NOWAYOUT; module_param(wdt_timeout, int, 0); MODULE_PARM_DESC(wdt_timeout, "Watchdog timeout in seconds. (default = " __MODULE_STRING(WDT_DEFAULT_TIMEOUT) ")"); module_param(nowayout, bool, 0); MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")"); #define wdt_read(wdt, field) \ readl_relaxed((wdt)->reg_base + (field)) #define wdt_write(wtd, field, val) \ writel_relaxed((val), (wdt)->reg_base + (field)) static int sama5d4_wdt_start(struct watchdog_device *wdd) { struct sama5d4_wdt *wdt = watchdog_get_drvdata(wdd); u32 reg; reg = wdt_read(wdt, AT91_WDT_MR); reg &= ~AT91_WDT_WDDIS; wdt_write(wdt, AT91_WDT_MR, reg); return 0; } static int sama5d4_wdt_stop(struct watchdog_device *wdd) { struct sama5d4_wdt *wdt = watchdog_get_drvdata(wdd); u32 reg; reg = wdt_read(wdt, AT91_WDT_MR); reg |= AT91_WDT_WDDIS; wdt_write(wdt, AT91_WDT_MR, reg); return 0; } static int sama5d4_wdt_ping(struct watchdog_device *wdd) { struct sama5d4_wdt *wdt = watchdog_get_drvdata(wdd); wdt_write(wdt, AT91_WDT_CR, AT91_WDT_KEY | AT91_WDT_WDRSTT); return 0; } static int sama5d4_wdt_set_timeout(struct watchdog_device *wdd, unsigned int timeout) { struct sama5d4_wdt *wdt = watchdog_get_drvdata(wdd); u32 value = WDT_SEC2TICKS(timeout); u32 reg; reg = wdt_read(wdt, AT91_WDT_MR); reg &= ~AT91_WDT_WDV; reg &= ~AT91_WDT_WDD; reg |= AT91_WDT_SET_WDV(value); reg |= AT91_WDT_SET_WDD(value); wdt_write(wdt, AT91_WDT_MR, reg); wdd->timeout = timeout; return 0; } static const struct watchdog_info sama5d4_wdt_info = { .options = WDIOF_SETTIMEOUT | WDIOF_MAGICCLOSE | WDIOF_KEEPALIVEPING, .identity = "Atmel SAMA5D4 Watchdog", }; static struct watchdog_ops sama5d4_wdt_ops = { .owner = THIS_MODULE, .start = sama5d4_wdt_start, .stop = sama5d4_wdt_stop, .ping = sama5d4_wdt_ping, .set_timeout = sama5d4_wdt_set_timeout, }; static irqreturn_t sama5d4_wdt_irq_handler(int irq, void *dev_id) { struct sama5d4_wdt *wdt = platform_get_drvdata(dev_id); if (wdt_read(wdt, AT91_WDT_SR)) { pr_crit("Atmel Watchdog Software Reset\n"); emergency_restart(); pr_crit("Reboot didn't succeed\n"); } return IRQ_HANDLED; } static int of_sama5d4_wdt_init(struct device_node *np, struct sama5d4_wdt *wdt) { const char *tmp; wdt->config = AT91_WDT_WDDIS; if (!of_property_read_string(np, "atmel,watchdog-type", &tmp) && !strcmp(tmp, "software")) wdt->config |= AT91_WDT_WDFIEN; else wdt->config |= AT91_WDT_WDRSTEN; if (of_property_read_bool(np, "atmel,idle-halt")) wdt->config |= AT91_WDT_WDIDLEHLT; if (of_property_read_bool(np, "atmel,dbg-halt")) wdt->config |= AT91_WDT_WDDBGHLT; return 0; } static int sama5d4_wdt_init(struct sama5d4_wdt *wdt) { struct watchdog_device *wdd = &wdt->wdd; u32 value = WDT_SEC2TICKS(wdd->timeout); u32 reg; /* * Because the fields WDV and WDD must not be modified when the WDDIS * bit is set, so clear the WDDIS bit before writing the WDT_MR. */ reg = wdt_read(wdt, AT91_WDT_MR); reg &= ~AT91_WDT_WDDIS; wdt_write(wdt, AT91_WDT_MR, reg); reg = wdt->config; reg |= AT91_WDT_SET_WDD(value); reg |= AT91_WDT_SET_WDV(value); wdt_write(wdt, AT91_WDT_MR, reg); return 0; } static int sama5d4_wdt_probe(struct platform_device *pdev) { struct watchdog_device *wdd; struct sama5d4_wdt *wdt; struct resource *res; void __iomem *regs; u32 irq = 0; int ret; wdt = devm_kzalloc(&pdev->dev, sizeof(*wdt), GFP_KERNEL); if (!wdt) return -ENOMEM; wdd = &wdt->wdd; wdd->timeout = wdt_timeout; wdd->info = &sama5d4_wdt_info; wdd->ops = &sama5d4_wdt_ops; wdd->min_timeout = MIN_WDT_TIMEOUT; wdd->max_timeout = MAX_WDT_TIMEOUT; watchdog_set_drvdata(wdd, wdt); res = platform_get_resource(pdev, IORESOURCE_MEM, 0); regs = devm_ioremap_resource(&pdev->dev, res); if (IS_ERR(regs)) return PTR_ERR(regs); wdt->reg_base = regs; if (pdev->dev.of_node) { irq = irq_of_parse_and_map(pdev->dev.of_node, 0); if (!irq) dev_warn(&pdev->dev, "failed to get IRQ from DT\n"); ret = of_sama5d4_wdt_init(pdev->dev.of_node, wdt); if (ret) return ret; } if ((wdt->config & AT91_WDT_WDFIEN) && irq) { ret = devm_request_irq(&pdev->dev, irq, sama5d4_wdt_irq_handler, IRQF_SHARED | IRQF_IRQPOLL | IRQF_NO_SUSPEND, pdev->name, pdev); if (ret) { dev_err(&pdev->dev, "cannot register interrupt handler\n"); return ret; } } ret = watchdog_init_timeout(wdd, wdt_timeout, &pdev->dev); if (ret) { dev_err(&pdev->dev, "unable to set timeout value\n"); return ret; } ret = sama5d4_wdt_init(wdt); if (ret) return ret; watchdog_set_nowayout(wdd, nowayout); ret = watchdog_register_device(wdd); if (ret) { dev_err(&pdev->dev, "failed to register watchdog device\n"); return ret; } platform_set_drvdata(pdev, wdt); dev_info(&pdev->dev, "initialized (timeout = %d sec, nowayout = %d)\n", wdt_timeout, nowayout); return 0; } static int sama5d4_wdt_remove(struct platform_device *pdev) { struct sama5d4_wdt *wdt = platform_get_drvdata(pdev); sama5d4_wdt_stop(&wdt->wdd); watchdog_unregister_device(&wdt->wdd); return 0; } static const struct of_device_id sama5d4_wdt_of_match[] = { { .compatible = "atmel,sama5d4-wdt", }, { } }; MODULE_DEVICE_TABLE(of, sama5d4_wdt_of_match); static struct platform_driver sama5d4_wdt_driver = { .probe = sama5d4_wdt_probe, .remove = sama5d4_wdt_remove, .driver = { .name = "sama5d4_wdt", .of_match_table = sama5d4_wdt_of_match, } }; module_platform_driver(sama5d4_wdt_driver); MODULE_AUTHOR("Atmel Corporation"); MODULE_DESCRIPTION("Atmel SAMA5D4 Watchdog Timer driver"); MODULE_LICENSE("GPL v2"); eak during percpu-atomic transition
percpu_ref_tryget() and percpu_ref_tryget_live() should return "true" IFF they acquire a reference. But the return value from atomic_long_inc_not_zero() is a long and may have high bits set, e.g. PERCPU_COUNT_BIAS, and the return value of the tryget routines is bool so the reference may actually be acquired but the routines return "false" which results in a reference leak since the caller assumes it does not need to do a corresponding percpu_ref_put(). This was seen when performing CPU hotplug during I/O, as hangs in blk_mq_freeze_queue_wait where percpu_ref_kill (blk_mq_freeze_queue_start) raced with percpu_ref_tryget (blk_mq_timeout_work). Sample stack trace: __switch_to+0x2c0/0x450 __schedule+0x2f8/0x970 schedule+0x48/0xc0 blk_mq_freeze_queue_wait+0x94/0x120 blk_mq_queue_reinit_work+0xb8/0x180 blk_mq_queue_reinit_prepare+0x84/0xa0 cpuhp_invoke_callback+0x17c/0x600 cpuhp_up_callbacks+0x58/0x150 _cpu_up+0xf0/0x1c0 do_cpu_up+0x120/0x150 cpu_subsys_online+0x64/0xe0 device_online+0xb4/0x120 online_store+0xb4/0xc0 dev_attr_store+0x68/0xa0 sysfs_kf_write+0x80/0xb0 kernfs_fop_write+0x17c/0x250 __vfs_write+0x6c/0x1e0 vfs_write+0xd0/0x270 SyS_write+0x6c/0x110 system_call+0x38/0xe0 Examination of the queue showed a single reference (no PERCPU_COUNT_BIAS, and __PERCPU_REF_DEAD, __PERCPU_REF_ATOMIC set) and no requests. However, conditions at the time of the race are count of PERCPU_COUNT_BIAS + 0 and __PERCPU_REF_DEAD and __PERCPU_REF_ATOMIC set. The fix is to make the tryget routines use an actual boolean internally instead of the atomic long result truncated to a int. Fixes: e625305b3907 percpu-refcount: make percpu_ref based on longs instead of ints Link: https://bugzilla.kernel.org/show_bug.cgi?id=190751 Signed-off-by: Douglas Miller <dougmill@linux.vnet.ibm.com> Reviewed-by: Jens Axboe <axboe@fb.com> Signed-off-by: Tejun Heo <tj@kernel.org> Fixes: e625305b3907 ("percpu-refcount: make percpu_ref based on longs instead of ints") Cc: stable@vger.kernel.org # v3.18+
Diffstat (limited to 'include/math-emu/op-8.h')