1. 12 Mar, 2019 4 commits
  2. 25 Feb, 2019 12 commits
  3. 19 Feb, 2019 1 commit
  4. 11 Feb, 2019 2 commits
  5. 04 Feb, 2019 8 commits
    • Scott Wood's avatar
      dmaengine: fsldma: Add 64-bit I/O accessors for powerpc64 · 6175f6a7
      Scott Wood authored
      Otherwise 64-bit PPC builds fail with undefined references
      to these accessors.
      
      Cc: Peng Ma <peng.ma@nxp.com>
      Cc: Wen He <wen.he_1@nxp.com>
      Fixes: 68997fff94afa (" dmaengine: fsldma: Adding macro FSL_DMA_IN/OUT implement for ARM platform")
      Signed-off-by: default avatarScott Wood <oss@buserror.net>
      Signed-off-by: default avatarVinod Koul <vkoul@kernel.org>
      6175f6a7
    • Lukas Wunner's avatar
      dmaengine: bcm2835: Drop outdated comment on supported transactions · 37c22cab
      Lukas Wunner authored
      Remove an outdated comment claiming the driver only supports cyclic
      transactions.  The driver has been supporting other transaction types
      for more than two years.
      Signed-off-by: default avatarLukas Wunner <lukas@wunner.de>
      Cc: Frank Pavlic <f.pavlic@kunbus.de>
      Cc: Martin Sperl <kernel@martin.sperl.org>
      Cc: Florian Meier <florian.meier@koalo.de>
      Tested-by: default avatarStefan Wahren <stefan.wahren@i2se.com>
      Acked-by: default avatarFlorian Kauer <florian.kauer@koalo.de>
      Signed-off-by: default avatarVinod Koul <vkoul@kernel.org>
      37c22cab
    • Lukas Wunner's avatar
      dmaengine: bcm2835: Drop gratuitous list deletion · efdffc1a
      Lukas Wunner authored
      The BCM2835 DMA driver deletes a channel from a list upon termination
      without having added it to a list first.  Moreover that operation is
      protected by a spinlock which isn't taken anywhere else.  These appear
      to be remnants of an older version of the driver which accidentally
      got mainlined.  Remove the dead code.
      Signed-off-by: default avatarLukas Wunner <lukas@wunner.de>
      Cc: Frank Pavlic <f.pavlic@kunbus.de>
      Cc: Martin Sperl <kernel@martin.sperl.org>
      Cc: Florian Meier <florian.meier@koalo.de>
      Tested-by: default avatarStefan Wahren <stefan.wahren@i2se.com>
      Acked-by: default avatarFlorian Kauer <florian.kauer@koalo.de>
      Signed-off-by: default avatarVinod Koul <vkoul@kernel.org>
      efdffc1a
    • Lukas Wunner's avatar
      dmaengine: bcm2835: Enforce control block alignment · 603fe86b
      Lukas Wunner authored
      Per section 4.2.1.1 of the BCM2835 ARM Peripherals spec, control blocks
      "must start at a 256 bit aligned address":
      https://www.raspberrypi.org/app/uploads/2012/02/BCM2835-ARM-Peripherals.pdf
      
      This rule is currently satisfied only by accident because struct
      bcm2835_dma_cb has a size of 256 bit and the DMA pool API happens to
      allocate blocks consecutively.  It seems safer to be explicit and tell
      the DMA pool allocator about the required alignment.
      Signed-off-by: default avatarLukas Wunner <lukas@wunner.de>
      Cc: Frank Pavlic <f.pavlic@kunbus.de>
      Cc: Martin Sperl <kernel@martin.sperl.org>
      Cc: Florian Meier <florian.meier@koalo.de>
      Tested-by: default avatarStefan Wahren <stefan.wahren@i2se.com>
      Acked-by: default avatarFlorian Kauer <florian.kauer@koalo.de>
      Signed-off-by: default avatarVinod Koul <vkoul@kernel.org>
      603fe86b
    • Lukas Wunner's avatar
      dmaengine: bcm2835: Return void from abort of transactions · 3e05ada0
      Lukas Wunner authored
      bcm2835_dma_abort() returns an int but bcm2835_dma_terminate_all() (its
      sole caller) does not evaluate the return value. Change the return type
      to void.
      Signed-off-by: default avatarLukas Wunner <lukas@wunner.de>
      Cc: Frank Pavlic <f.pavlic@kunbus.de>
      Cc: Martin Sperl <kernel@martin.sperl.org>
      Cc: Florian Meier <florian.meier@koalo.de>
      Tested-by: default avatarStefan Wahren <stefan.wahren@i2se.com>
      Acked-by: default avatarFlorian Kauer <florian.kauer@koalo.de>
      Signed-off-by: default avatarVinod Koul <vkoul@kernel.org>
      3e05ada0
    • Lukas Wunner's avatar
      dmaengine: bcm2835: Fix abort of transactions · 9e528c79
      Lukas Wunner authored
      There are multiple issues with bcm2835_dma_abort() (which is called on
      termination of a transaction):
      
      * The algorithm to abort the transaction first pauses the channel by
        clearing the ACTIVE flag in the CS register, then waits for the PAUSED
        flag to clear.  Page 49 of the spec documents the latter as follows:
      
        "Indicates if the DMA is currently paused and not transferring data.
         This will occur if the active bit has been cleared [...]"
         https://www.raspberrypi.org/app/uploads/2012/02/BCM2835-ARM-Peripherals.pdf
      
        So the function is entering an infinite loop because it is waiting for
        PAUSED to clear which is always set due to the function having cleared
        the ACTIVE flag.  The only thing that's saving it from itself is the
        upper bound of 10000 loop iterations.
      
        The code comment says that the intention is to "wait for any current
        AXI transfer to complete", so the author probably wanted to check the
        WAITING_FOR_OUTSTANDING_WRITES flag instead.  Amend the function
        accordingly.
      
      * The CS register is only read at the beginning of the function.  It
        needs to be read again after pausing the channel and before checking
        for outstanding writes, otherwise writes which were issued between
        the register read at the beginning of the function and pausing the
        channel may not be waited for.
      
      * The function seeks to abort the transfer by writing 0 to the NEXTCONBK
        register and setting the ABORT and ACTIVE flags.  Thereby, the 0 in
        NEXTCONBK is sought to be loaded into the CONBLK_AD register.  However
        experimentation has shown this approach to not work:  The CONBLK_AD
        register remains the same as before and the CS register contains
        0x00000030 (PAUSED | DREQ_STOPS_DMA).  In other words, the control
        block is not aborted but merely paused and it will be resumed once the
        next DMA transaction is started.  That is absolutely not the desired
        behavior.
      
        A simpler approach is to set the channel's RESET flag instead.  This
        reliably zeroes the NEXTCONBK as well as the CS register.  It requires
        less code and only a single MMIO write.  This is also what popular
        user space DMA drivers do, e.g.:
        https://github.com/metachris/RPIO/blob/master/source/c_pwm/pwm.c
      
        Note that the spec is contradictory whether the NEXTCONBK register
        is writeable at all.  On the one hand, page 41 claims:
      
        "The value loaded into the NEXTCONBK register can be overwritten so
        that the linked list of Control Block data structures can be
        dynamically altered. However it is only safe to do this when the DMA
        is paused."
      
        On the other hand, page 40 specifies:
      
        "Only three registers in each channel's register set are directly
        writeable (CS, CONBLK_AD and DEBUG). The other registers (TI,
        SOURCE_AD, DEST_AD, TXFR_LEN, STRIDE & NEXTCONBK), are automatically
        loaded from a Control Block data structure held in external memory."
      
      Fixes: 96286b57 ("dmaengine: Add support for BCM2835")
      Signed-off-by: default avatarLukas Wunner <lukas@wunner.de>
      Cc: stable@vger.kernel.org # v3.14+
      Cc: Frank Pavlic <f.pavlic@kunbus.de>
      Cc: Martin Sperl <kernel@martin.sperl.org>
      Cc: Florian Meier <florian.meier@koalo.de>
      Cc: Clive Messer <clive.m.messer@gmail.com>
      Cc: Matthias Reichl <hias@horus.com>
      Tested-by: default avatarStefan Wahren <stefan.wahren@i2se.com>
      Acked-by: default avatarFlorian Kauer <florian.kauer@koalo.de>
      Signed-off-by: default avatarVinod Koul <vkoul@kernel.org>
      9e528c79
    • Lukas Wunner's avatar
      dmaengine: bcm2835: Fix interrupt race on RT · f7da7782
      Lukas Wunner authored
      If IRQ handlers are threaded (either because CONFIG_PREEMPT_RT_BASE is
      enabled or "threadirqs" was passed on the command line) and if system
      load is sufficiently high that wakeup latency of IRQ threads degrades,
      SPI DMA transactions on the BCM2835 occasionally break like this:
      
      ks8851 spi0.0: SPI transfer timed out
      bcm2835-dma 3f007000.dma: DMA transfer could not be terminated
      ks8851 spi0.0 eth2: ks8851_rdfifo: spi_sync() failed
      
      The root cause is an assumption made by the DMA driver which is
      documented in a code comment in bcm2835_dma_terminate_all():
      
      /*
       * Stop DMA activity: we assume the callback will not be called
       * after bcm_dma_abort() returns (even if it does, it will see
       * c->desc is NULL and exit.)
       */
      
      That assumption falls apart if the IRQ handler bcm2835_dma_callback() is
      threaded: A client may terminate a descriptor and issue a new one
      before the IRQ handler had a chance to run. In fact the IRQ handler may
      miss an *arbitrary* number of descriptors. The result is the following
      race condition:
      
      1. A descriptor finishes, its interrupt is deferred to the IRQ thread.
      2. A client calls dma_terminate_async() which sets channel->desc = NULL.
      3. The client issues a new descriptor. Because channel->desc is NULL,
         bcm2835_dma_issue_pending() immediately starts the descriptor.
      4. Finally the IRQ thread runs and writes BCM2835_DMA_INT to the CS
         register to acknowledge the interrupt. This clears the ACTIVE flag,
         so the newly issued descriptor is paused in the middle of the
         transaction. Because channel->desc is not NULL, the IRQ thread
         finalizes the descriptor and tries to start the next one.
      
      I see two possible solutions: The first is to call synchronize_irq()
      in bcm2835_dma_issue_pending() to wait until the IRQ thread has
      finished before issuing a new descriptor. The downside of this approach
      is unnecessary latency if clients desire rapidly terminating and
      re-issuing descriptors and don't have any use for an IRQ callback.
      (The SPI TX DMA channel is a case in point.)
      
      A better alternative is to make the IRQ thread recognize that it has
      missed descriptors and avoid finalizing the newly issued descriptor.
      So first of all, set the ACTIVE flag when acknowledging the interrupt.
      This keeps a newly issued descriptor running.
      
      If the descriptor was finished, the channel remains idle despite the
      ACTIVE flag being set. However the ACTIVE flag can then no longer be
      used to check whether the channel is idle, so instead check whether
      the register containing the current control block address is zero
      and finalize the current descriptor only if so.
      
      That way, there is no impact on latency and throughput if the client
      doesn't care for the interrupt: Only minimal additional overhead is
      introduced for non-cyclic descriptors as one further MMIO read is
      necessary per interrupt to check for idleness of the channel. Cyclic
      descriptors are sped up slightly by removing one MMIO write per
      interrupt.
      
      Fixes: 96286b57 ("dmaengine: Add support for BCM2835")
      Signed-off-by: default avatarLukas Wunner <lukas@wunner.de>
      Cc: stable@vger.kernel.org # v3.14+
      Cc: Frank Pavlic <f.pavlic@kunbus.de>
      Cc: Martin Sperl <kernel@martin.sperl.org>
      Cc: Florian Meier <florian.meier@koalo.de>
      Cc: Clive Messer <clive.m.messer@gmail.com>
      Cc: Matthias Reichl <hias@horus.com>
      Tested-by: default avatarStefan Wahren <stefan.wahren@i2se.com>
      Acked-by: default avatarFlorian Kauer <florian.kauer@koalo.de>
      Signed-off-by: default avatarVinod Koul <vkoul@kernel.org>
      f7da7782
    • Laurentiu Tudor's avatar
      dmaengine: fsl-edma: dma map slave device address · 0fa89f97
      Laurentiu Tudor authored
      This mapping needs to be created in order for slave dma transfers
      to work on systems with SMMU. The implementation mostly mimics the
      one in pl330 dma driver, authored by Robin Murphy.
      Signed-off-by: default avatarLaurentiu Tudor <laurentiu.tudor@nxp.com>
      Suggested-by: default avatarRobin Murphy <robin.murphy@arm.com>
      Tested-by: default avatarAngelo Dureghello <angelo@sysam.it>
      Signed-off-by: default avatarVinod Koul <vkoul@kernel.org>
      0fa89f97
  6. 20 Jan, 2019 9 commits
    • Andy Duan's avatar
      dmaengine: imx-sdma: pass ->dev to dma_alloc_coherent() API · ceaf5226
      Andy Duan authored
      Pass ->dev to dma_alloc_coherent() API. We need this
      because dma_alloc_coherent() makes use of dev parameter
      and receiving NULL will result in a crash.
      Signed-off-by: default avatarAndy Duan <fugang.duan@nxp.com>
      Signed-off-by: default avatarDaniel Baluta <daniel.baluta@nxp.com>
      Reviewed-by: default avatarRobin Gong <yibin.gong@nxp.com>
      Signed-off-by: default avatarVinod Koul <vkoul@kernel.org>
      ceaf5226
    • Vinod Koul's avatar
      dmaengine: imx-dma: change return of 'imxdma_sg_next' to void · 452fd6dc
      Vinod Koul authored
      The return value of function 'imxdma_sg_next' is not checked anywhere,
      so make it void return type.
      Signed-off-by: default avatarVinod Koul <vkoul@kernel.org>
      452fd6dc
    • Vinod Koul's avatar
      dmaengine: imx-dma: change variable 'now' type to size_t · da5035f3
      Vinod Koul authored
      now is used to keep size and it is better to change the variable
      type to size_t
      Signed-off-by: default avatarVinod Koul <vkoul@kernel.org>
      da5035f3
    • Anders Roxell's avatar
      dmaengine: imx-dma: fix warning comparison of distinct pointer types · 9227ab56
      Anders Roxell authored
      The warning got introduced by commit 930507c1 ("arm64: add basic
      Kconfig symbols for i.MX8"). Since it got enabled for arm64. The warning
      haven't been seen before since size_t was 'unsigned int' when built on
      arm32.
      
      ../drivers/dma/imx-dma.c: In function ‘imxdma_sg_next’:
      ../include/linux/kernel.h:846:29: warning: comparison of distinct pointer types lacks a cast
         (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1)))
                                   ^~
      ../include/linux/kernel.h:860:4: note: in expansion of macro ‘__typecheck’
         (__typecheck(x, y) && __no_side_effects(x, y))
          ^~~~~~~~~~~
      ../include/linux/kernel.h:870:24: note: in expansion of macro ‘__safe_cmp’
        __builtin_choose_expr(__safe_cmp(x, y), \
                              ^~~~~~~~~~
      ../include/linux/kernel.h:879:19: note: in expansion of macro ‘__careful_cmp’
       #define min(x, y) __careful_cmp(x, y, <)
                         ^~~~~~~~~~~~~
      ../drivers/dma/imx-dma.c:288:8: note: in expansion of macro ‘min’
        now = min(d->len, sg_dma_len(sg));
              ^~~
      
      Rework so that we use min_t and pass in the size_t that returns the
      minimum of two values, using the specified type.
      Signed-off-by: default avatarAnders Roxell <anders.roxell@linaro.org>
      Acked-by: default avatarOlof Johansson <olof@lixom.net>
      Reviewed-by: default avatarFabio Estevam <festevam@gmail.com>
      Signed-off-by: default avatarVinod Koul <vkoul@kernel.org>
      9227ab56
    • Gustavo A. R. Silva's avatar
      dmaengine: axi-dmac: Use struct_size() in kzalloc() · 48b02a85
      Gustavo A. R. Silva authored
      One of the more common cases of allocation size calculations is finding the
      size of a structure that has a zero-sized array at the end, along with memory
      for some number of elements for that array. For example:
      
      struct foo {
          int stuff;
          void *entry[];
      };
      
      instance = kzalloc(sizeof(struct foo) + sizeof(void *) * count, GFP_KERNEL);
      
      Instead of leaving these open-coded and prone to type mistakes, we can now
      use the new struct_size() helper:
      
      instance = kzalloc(struct_size(instance, entry, count), GFP_KERNEL);
      
      This code was detected with the help of Coccinelle.
      Signed-off-by: default avatarGustavo A. R. Silva <gustavo@embeddedor.com>
      Signed-off-by: default avatarVinod Koul <vkoul@kernel.org>
      48b02a85
    • Gustavo A. R. Silva's avatar
      dmaengine: timb_dma: Use struct_size() in kzalloc() · 3c215fd8
      Gustavo A. R. Silva authored
      One of the more common cases of allocation size calculations is finding the
      size of a structure that has a zero-sized array at the end, along with memory
      for some number of elements for that array. For example:
      
      struct foo {
          int stuff;
          void *entry[];
      };
      
      instance = kzalloc(sizeof(struct foo) + sizeof(void *) * count, GFP_KERNEL);
      
      Instead of leaving these open-coded and prone to type mistakes, we can now
      use the new struct_size() helper:
      
      instance = kzalloc(struct_size(instance, entry, count), GFP_KERNEL);
      
      This code was detected with the help of Coccinelle.
      Signed-off-by: default avatarGustavo A. R. Silva <gustavo@embeddedor.com>
      Signed-off-by: default avatarVinod Koul <vkoul@kernel.org>
      3c215fd8
    • Vinod Koul's avatar
      Merge branch 'topic/qcom' into for-linus · 73bf95f5
      Vinod Koul authored
      73bf95f5
    • Shunyong Yang's avatar
      dmaengine: qcom_hidma: assign channel cookie correctly · 546c0547
      Shunyong Yang authored
      When dma_cookie_complete() is called in hidma_process_completed(),
      dma_cookie_status() will return DMA_COMPLETE in hidma_tx_status(). Then,
      hidma_txn_is_success() will be called to use channel cookie
      mchan->last_success to do additional DMA status check. Current code
      assigns mchan->last_success after dma_cookie_complete(). This causes
      a race condition of dma_cookie_status() returns DMA_COMPLETE before
      mchan->last_success is assigned correctly. The race will cause
      hidma_tx_status() return DMA_ERROR but the transaction is actually a
      success. Moreover, in async_tx case, it will cause a timeout panic
      in async_tx_quiesce().
      
       Kernel panic - not syncing: async_tx_quiesce: DMA error waiting for
       transaction
       ...
       Call trace:
       [<ffff000008089994>] dump_backtrace+0x0/0x1f4
       [<ffff000008089bac>] show_stack+0x24/0x2c
       [<ffff00000891e198>] dump_stack+0x84/0xa8
       [<ffff0000080da544>] panic+0x12c/0x29c
       [<ffff0000045d0334>] async_tx_quiesce+0xa4/0xc8 [async_tx]
       [<ffff0000045d03c8>] async_trigger_callback+0x70/0x1c0 [async_tx]
       [<ffff0000048b7d74>] raid_run_ops+0x86c/0x1540 [raid456]
       [<ffff0000048bd084>] handle_stripe+0x5e8/0x1c7c [raid456]
       [<ffff0000048be9ec>] handle_active_stripes.isra.45+0x2d4/0x550 [raid456]
       [<ffff0000048beff4>] raid5d+0x38c/0x5d0 [raid456]
       [<ffff000008736538>] md_thread+0x108/0x168
       [<ffff0000080fb1cc>] kthread+0x10c/0x138
       [<ffff000008084d34>] ret_from_fork+0x10/0x18
      
      Cc: Joey Zheng <yu.zheng@hxt-semitech.com>
      Reviewed-by: default avatarSinan Kaya <okaya@kernel.org>
      Signed-off-by: default avatarShunyong Yang <shunyong.yang@hxt-semitech.com>
      Signed-off-by: default avatarVinod Koul <vkoul@kernel.org>
      546c0547
    • Shunyong Yang's avatar
      dmaengine: qcom_hidma: initialize tx flags in hidma_prep_dma_* · 875aac8a
      Shunyong Yang authored
      In async_tx_test_ack(), it uses flags in struct dma_async_tx_descriptor
      to check the ACK status. As hidma reuses the descriptor in a free list
      when hidma_prep_dma_*(memcpy/memset) is called, the flag will keep ACKed
      if the descriptor has been used before. This will cause a BUG_ON in
      async_tx_quiesce().
      
        kernel BUG at crypto/async_tx/async_tx.c:282!
        Internal error: Oops - BUG: 0 1 SMP
        ...
        task: ffff8017dd3ec000 task.stack: ffff8017dd3e8000
        PC is at async_tx_quiesce+0x54/0x78 [async_tx]
        LR is at async_trigger_callback+0x98/0x110 [async_tx]
      
      This patch initializes flags in dma_async_tx_descriptor by the flags
      passed from the caller when hidma_prep_dma_*(memcpy/memset) is called.
      
      Cc: Joey Zheng <yu.zheng@hxt-semitech.com>
      Reviewed-by: default avatarSinan Kaya <okaya@kernel.org>
      Signed-off-by: default avatarShunyong Yang <shunyong.yang@hxt-semitech.com>
      Signed-off-by: default avatarVinod Koul <vkoul@kernel.org>
      875aac8a
  7. 08 Jan, 2019 2 commits
  8. 07 Jan, 2019 2 commits
    • Gustavo A. R. Silva's avatar
      dmaengine: fsl-edma: use struct_size() in kzalloc() · de1fa4f6
      Gustavo A. R. Silva authored
      One of the more common cases of allocation size calculations is finding the
      size of a structure that has a zero-sized array at the end, along with memory
      for some number of elements for that array. For example:
      
      struct foo {
          int stuff;
          void *entry[];
      };
      
      instance = kzalloc(sizeof(struct foo) + sizeof(void *) * count, GFP_KERNEL);
      
      Instead of leaving these open-coded and prone to type mistakes, we can now
      use the new struct_size() helper:
      
      instance = kzalloc(struct_size(instance, entry, count), GFP_KERNEL);
      
      This code was detected with the help of Coccinelle.
      Signed-off-by: default avatarGustavo A. R. Silva <gustavo@embeddedor.com>
      Tested-by: default avatarAngelo Dureghello <angelo@sysam.it>
      Signed-off-by: default avatarVinod Koul <vkoul@kernel.org>
      de1fa4f6
    • Gustavo A. R. Silva's avatar
      dmaengine: qcom: bam_dma: use struct_size() in kzalloc() · edd3c389
      Gustavo A. R. Silva authored
      One of the more common cases of allocation size calculations is finding the
      size of a structure that has a zero-sized array at the end, along with memory
      for some number of elements for that array. For example:
      
      struct foo {
          int stuff;
          void *entry[];
      };
      
      instance = kzalloc(sizeof(struct foo) + sizeof(void *) * count, GFP_KERNEL);
      
      Instead of leaving these open-coded and prone to type mistakes, we can now
      use the new struct_size() helper:
      
      instance = kzalloc(struct_size(instance, entry, count), GFP_KERNEL);
      
      This code was detected with the help of Coccinelle.
      Signed-off-by: default avatarGustavo A. R. Silva <gustavo@embeddedor.com>
      Signed-off-by: default avatarVinod Koul <vkoul@kernel.org>
      edd3c389