/* * dice.h - a part of driver for Dice based devices * * Copyright (c) Clemens Ladisch * Copyright (c) 2014 Takashi Sakamoto * * Licensed under the terms of the GNU General Public License, version 2. */ #ifndef SOUND_DICE_H_INCLUDED #define SOUND_DICE_H_INCLUDED #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include "../amdtp-am824.h" #include "../iso-resources.h" #include "../lib.h" #include "dice-interface.h" /* * This module support maximum 2 pairs of tx/rx isochronous streams for * our convinience. * * In documents for ASICs called with a name of 'DICE': * - ASIC for DICE II: * - Maximum 2 tx and 4 rx are supported. * - A packet supports maximum 16 data channels. * - TCD2210/2210-E (so-called 'Dice Mini'): * - Maximum 2 tx and 2 rx are supported. * - A packet supports maximum 16 data channels. * - TCD2220/2220-E (so-called 'Dice Jr.') * - 2 tx and 2 rx are supported. * - A packet supports maximum 16 data channels. * - TCD3070-CH (so-called 'Dice III') * - Maximum 2 tx and 2 rx are supported. * - A packet supports maximum 32 data channels. * * For the above, MIDI conformant data channel is just on the first isochronous * stream. */ #define MAX_STREAMS 2 struct snd_dice { struct snd_card *card; struct fw_unit *unit; spinlock_t lock; struct mutex mutex; bool registered; struct delayed_work dwork; /* Offsets for sub-addresses */ unsigned int global_offset; unsigned int rx_offset; unsigned int tx_offset; unsigned int sync_offset; unsigned int rsrv_offset; unsigned int clock_caps; struct fw_address_handler notification_handler; int owner_generation; u32 notification_bits; /* For uapi */ int dev_lock_count; /* > 0 driver, < 0 userspace */ bool dev_lock_changed; wait_queue_head_t hwdep_wait; /* For streaming */ struct fw_iso_resources tx_resources[MAX_STREAMS]; struct fw_iso_resources rx_resources[MAX_STREAMS]; struct amdtp_stream tx_stream[MAX_STREAMS]; struct amdtp_stream rx_stream[MAX_STREAMS]; bool global_enabled; struct completion clock_accepted; unsigned int substreams_counter; bool force_two_pcms; }; enum snd_dice_addr_type { SND_DICE_ADDR_TYPE_PRIVATE, SND_DICE_ADDR_TYPE_GLOBAL, SND_DICE_ADDR_TYPE_TX, SND_DICE_ADDR_TYPE_RX, SND_DICE_ADDR_TYPE_SYNC, SND_DICE_ADDR_TYPE_RSRV, }; int snd_dice_transaction_write(struct snd_dice *dice, enum snd_dice_addr_type type, unsigned int offset, void *buf, unsigned int len); int snd_dice_transaction_read(struct snd_dice *dice, enum snd_dice_addr_type type, unsigned int offset, void *buf, unsigned int len); static inline int snd_dice_transaction_write_global(struct snd_dice *dice, unsigned int offset, void *buf, unsigned int len) { return snd_dice_transaction_write(dice, SND_DICE_ADDR_TYPE_GLOBAL, offset, buf, len); } static inline int snd_dice_transaction_read_global(struct snd_dice *dice, unsigned int offset, void *buf, unsigned int len) { return snd_dice_transaction_read(dice, SND_DICE_ADDR_TYPE_GLOBAL, offset, buf, len); } static inline int snd_dice_transaction_write_tx(struct snd_dice *dice, unsigned int offset, void *buf, unsigned int len) { return snd_dice_transaction_write(dice, SND_DICE_ADDR_TYPE_TX, offset, buf, len); } static inline int snd_dice_transaction_read_tx(struct snd_dice *dice, unsigned int offset, void *buf, unsigned int len) { return snd_dice_transaction_read(dice, SND_DICE_ADDR_TYPE_TX, offset, buf, len); } static inline int snd_dice_transaction_write_rx(struct snd_dice *dice, unsigned int offset, void *buf, unsigned int len) { return snd_dice_transaction_write(dice, SND_DICE_ADDR_TYPE_RX, offset, buf, len); } static inline int snd_dice_transaction_read_rx(struct snd_dice *dice, unsigned int offset, void *buf, unsigned int len) { return snd_dice_transaction_read(dice, SND_DICE_ADDR_TYPE_RX, offset, buf, len); } static inline int snd_dice_transaction_write_sync(struct snd_dice *dice, unsigned int offset, void *buf, unsigned int len) { return snd_dice_transaction_write(dice, SND_DICE_ADDR_TYPE_SYNC, offset, buf, len); } static inline int snd_dice_transaction_read_sync(struct snd_dice *dice, unsigned int offset, void *buf, unsigned int len) { return snd_dice_transaction_read(dice, SND_DICE_ADDR_TYPE_SYNC, offset, buf, len); } int snd_dice_transaction_get_clock_source(struct snd_dice *dice, unsigned int *source); int snd_dice_transaction_get_rate(struct snd_dice *dice, unsigned int *rate); int snd_dice_transaction_set_enable(struct snd_dice *dice); void snd_dice_transaction_clear_enable(struct snd_dice *dice); int snd_dice_transaction_init(struct snd_dice *dice); int snd_dice_transaction_reinit(struct snd_dice *dice); void snd_dice_transaction_destroy(struct snd_dice *dice); #define SND_DICE_RATES_COUNT 7 extern const unsigned int snd_dice_rates[SND_DICE_RATES_COUNT]; int snd_dice_stream_start_duplex(struct snd_dice *dice, unsigned int rate); void snd_dice_stream_stop_duplex(struct snd_dice *dice); int snd_dice_stream_init_duplex(struct snd_dice *dice); void snd_dice_stream_destroy_duplex(struct snd_dice *dice); void snd_dice_stream_update_duplex(struct snd_dice *dice); int snd_dice_stream_lock_try(struct snd_dice *dice); void snd_dice_stream_lock_release(struct snd_dice *dice); int snd_dice_create_pcm(struct snd_dice *dice); int snd_dice_create_hwdep(struct snd_dice *dice); void snd_dice_create_proc(struct snd_dice *dice); int snd_dice_create_midi(struct snd_dice *dice); #endif nds-private-remove&id=966d2b04e070bc040319aaebfec09e0144dc3341&id2=1b1bc42c1692e9b62756323c675a44cb1a1f9dbd'>diff)
percpu-refcount: fix reference leak during percpu-atomic transition
percpu_ref_tryget() and percpu_ref_tryget_live() should return "true" IFF they acquire a reference. But the return value from atomic_long_inc_not_zero() is a long and may have high bits set, e.g. PERCPU_COUNT_BIAS, and the return value of the tryget routines is bool so the reference may actually be acquired but the routines return "false" which results in a reference leak since the caller assumes it does not need to do a corresponding percpu_ref_put(). This was seen when performing CPU hotplug during I/O, as hangs in blk_mq_freeze_queue_wait where percpu_ref_kill (blk_mq_freeze_queue_start) raced with percpu_ref_tryget (blk_mq_timeout_work). Sample stack trace: __switch_to+0x2c0/0x450 __schedule+0x2f8/0x970 schedule+0x48/0xc0 blk_mq_freeze_queue_wait+0x94/0x120 blk_mq_queue_reinit_work+0xb8/0x180 blk_mq_queue_reinit_prepare+0x84/0xa0 cpuhp_invoke_callback+0x17c/0x600 cpuhp_up_callbacks+0x58/0x150 _cpu_up+0xf0/0x1c0 do_cpu_up+0x120/0x150 cpu_subsys_online+0x64/0xe0 device_online+0xb4/0x120 online_store+0xb4/0xc0 dev_attr_store+0x68/0xa0 sysfs_kf_write+0x80/0xb0 kernfs_fop_write+0x17c/0x250 __vfs_write+0x6c/0x1e0 vfs_write+0xd0/0x270 SyS_write+0x6c/0x110 system_call+0x38/0xe0 Examination of the queue showed a single reference (no PERCPU_COUNT_BIAS, and __PERCPU_REF_DEAD, __PERCPU_REF_ATOMIC set) and no requests. However, conditions at the time of the race are count of PERCPU_COUNT_BIAS + 0 and __PERCPU_REF_DEAD and __PERCPU_REF_ATOMIC set. The fix is to make the tryget routines use an actual boolean internally instead of the atomic long result truncated to a int. Fixes: e625305b3907 percpu-refcount: make percpu_ref based on longs instead of ints Link: https://bugzilla.kernel.org/show_bug.cgi?id=190751 Signed-off-by: Douglas Miller <dougmill@linux.vnet.ibm.com> Reviewed-by: Jens Axboe <axboe@fb.com> Signed-off-by: Tejun Heo <tj@kernel.org> Fixes: e625305b3907 ("percpu-refcount: make percpu_ref based on longs instead of ints") Cc: stable@vger.kernel.org # v3.18+
Diffstat (limited to 'net/ipv4/tcp_illinois.c')