commit 98f5f932254b88ce828bc8e4d1642d14e5854caa upstream.

The leak was found when opening/closing a serial port a great number of
time, increasing kmalloc-32 in slabinfo.

Each time the port was opened, dma_request_slave_channel() was called.
Then, in at_dma_xlate(), atslave was allocated with devm_kzalloc() and
never freed. (Well, it was free at module unload, but that's not what we
want).
So, here, kzalloc is more suited for the job since it has to be freed in
atc_free_chan_resources().

Cc: stable@vger.kernel.org
Fixes: bbe89c8e ("at_hdmac: move to generic DMA binding")
Reported-by: NMario Forner <m.forner@be4energy.com>
Suggested-by: NAlexandre Belloni <alexandre.belloni@bootlin.com>
Acked-by: NAlexandre Belloni <alexandre.belloni@bootlin.com>
Acked-by: NLudovic Desroches <ludovic.desroches@microchip.com>
Signed-off-by: NRichard Genoud <richard.genoud@gmail.com>
Signed-off-by: NVinod Koul <vkoul@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

We should get drvdata from struct device directly. Going via
platform_device is an unneeded step back and forth.
Signed-off-by: NWolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: NVinod Koul <vkoul@kernel.org>

_xt_ is being dereferenced before it is null checked, hence there is a
potential null pointer dereference.

Fix this by moving the pointer dereference after _xt_ has been null
checked.

This issue was detected with the help of Coccinelle.

Fixes: 4483320e ("dmaengine: Use Pointer xt after NULL check.")
Signed-off-by: NGustavo A. R. Silva <garsilva@embeddedor.com>
Acked-by: NLudovic Desroches <ludovic.desroches@microchip.com>
Signed-off-by: NVinod Koul <vinod.koul@intel.com>

There are no in kernel consumers for DMA_SG op. Removing operation,
dead code, and test code in dmatest.
Signed-off-by: NDave Jiang <dave.jiang@intel.com>
Reviewed-by: NLinus Walleij <linus.walleij@linaro.org>
Cc: Gary Hook <gary.hook@amd.com>
Cc: Ludovic Desroches <ludovic.desroches@microchip.com>
Cc: Kedareswara rao Appana <appana.durga.rao@xilinx.com>
Cc: Li Yang <leoyang.li@nxp.com>
Cc: Michal Simek <michal.simek@xilinx.com>
Signed-off-by: NVinod Koul <vinod.koul@intel.com>

Replace dma_pool_alloc & memset with dma_pool_zalloc.
Signed-off-by: NVinod Koul <vinod.koul@intel.com>

This is in preperation of moving to a callback that provides results to the
callback for the transaction. The conversion will maintain current behavior
and the driver must convert to new callback mechanism at a later time in
order to receive results.
Signed-off-by: NDave Jiang <dave.jiang@intel.com>
Reviewed-by: NLars-Peter Clausen <lars@metafoo.de>
Cc: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: NVinod Koul <vinod.koul@intel.com>

dma_addr_t may be defined as 32 or 64 bit depending on configuration,
so it cannot be printed using the normal format strings, as
gcc correctly warns:

drivers/dma/at_hdmac.c: In function 'atc_prep_dma_interleaved':
drivers/dma/at_hdmac.c:731:28: warning: format '%x' expects argument of type 'unsigned int', but argument 4 has type 'dma_addr_t {aka long long unsigned int}' [-Wformat=]

This changes the format strings to use the special "%pad" format
string that prints a dma_addr_t, and changes the arguments so we
pass the address by reference as required.
Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Acked-by: NNicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: NVinod Koul <vinod.koul@intel.com>

Just like memset support, the HDMAC might be used to do a memset over a
discontiguous memory area.

In such a case, we'll just build up a chain of memset descriptors over the
contiguous chunks of memory to set, in order to allow such a support.
Signed-off-by: NMaxime Ripard <maxime.ripard@free-electrons.com>
Acked-by: NNicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: NVinod Koul <vinod.koul@intel.com>

The memset and scatter gathered memset are going to use some common logic
to create their descriptors.

Move that logic into a function of its own so that we can share it with the
future memset_sg callback.
Signed-off-by: NMaxime Ripard <maxime.ripard@free-electrons.com>
Acked-by: NNicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: NVinod Koul <vinod.koul@intel.com>

Just like for the XDMAC, the SoCs that embed the HDMAC don't have any kind
of GPU, and need to accelerate a few framebuffer-related operations through
their DMA controller.

However, unlike the XDMAC, the HDMAC doesn't have the memset capability
built-in. That can be easily emulated though, by doing a transfer with a
fixed address on the variable that holds the value we want to set.
Signed-off-by: NMaxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: NVinod Koul <vinod.koul@intel.com>

As claimed by the programmer datasheet and confirmed by the IP designer,
the Block Transfer Size (BTSIZE) bitfield of the Channel x Control A
Register (CTRLAx) always refers to a number of Source Width (SRC_WIDTH)
transfers.

Both the SRC_WIDTH and BTSIZE bitfields can be extacted from the CTRLAx
register to compute the DMA residue. So the 'tx_width' field is useless
and can be removed from the struct at_desc.

Before this patch, atc_prep_slave_sg() was not consistent: BTSIZE was
correctly initialized according to the SRC_WIDTH but 'tx_width' was always
set to reg_width, which was incorrect for MEM_TO_DEV transfers. It led to
bad DMA residue when 'tx_width' != SRC_WIDTH.

Also the 'tx_width' field was mostly set only in the first and last
descriptors. Depending on the kind of DMA transfer, this field remained
uninitialized for intermediate descriptors. The accurate DMA residue was
computed only when the currently processed descriptor was the first or the
last of the chain. This algorithm was a little bit odd. An accurate DMA
residue can always be computed using the SRC_WIDTH and BTSIZE bitfields
in the CTRLAx register.

Finally, the test to check whether the currently processed descriptor is
the last of the chain was wrong: for cyclic transfer, last_desc->lli.dscr
is NOT equal to zero, since set_desc_eol() is never called, but logically
equal to first_desc->txd.phys. This bug has a side effect on the
drivers/tty/serial/atmel_serial.c driver, which uses cyclic DMA transfer
to receive data. Since the DMA residue was wrong each time the DMA
transfer reaches the second (and last) period of the transfer, no more
data were received by the USART driver till the cyclic DMA transfer loops
back to the first period.
Signed-off-by: NCyrille Pitchen <cyrille.pitchen@atmel.com>
Acked-by: NTorsten Fleischer <torfl6749@gmail.com>
Tested-by: NJirí Prchal <jiri.prchal@aksignal.cz>
Acked-by: NNicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: NVinod Koul <vinod.koul@intel.com>

Removing static analysis error:-
Possible null pointer dereference: xt

Because currently xt is dereferenced before NULL check,
Thus Use it after NULL Check.
Signed-off-by: NManinder Singh <maninder1.s@samsung.com>
Reviewed-by: NVaneet Narang <v.narang@samsung.com>
Acked-by: NNicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: NVinod Koul <vinod.koul@intel.com>

The AT91 HDMAC controller supports interleaved transfers through what's
called the Picture-in-Picture mode, which allows to transfer a squared
portion of a framebuffer.

This means that this interleaved transfer only supports interleaved
transfers which have a transfer size and ICGs that are fixed across all the
chunks.

While this is a quite drastic restriction of the interleaved transfers
compared to what the dmaengine API allows, this is still useful, and our
driver will only reject transfers that do not conform to this.
Signed-off-by: NMaxime Ripard <maxime.ripard@free-electrons.com>
Acked-by: NLudovic Desroches <ludovic.desroches@atmel.com>
Signed-off-by: NVinod Koul <vinod.koul@intel.com>

This patch fixes the following issues regarding to the calculation of the
residue:

1. The residue is always calculated for the current transfer even if the
cookie is associated to a pending transfer.

2. For scatter/gather DMA the calculation of the residue for the current
transfer doesn't include the bytes of the child descriptors that are already
transferred.
It only calculates the difference between the transfer's total length minus
the number of bytes that are already transferred for the current child
descriptor.
For example: There is a scatter/gather DMA transfer with a total length of
1 MByte. Getting the residue several times while the transfer is running shows
something like that:

1: residue = 975584
2: residue = 1002766
3: residue = 992627
4: residue = 983767
5: residue = 985694
6: residue = 1008094
7: residue = 1009741
8: residue = 1011195

3. The driver stores the residue but never resets it when starting a new
transfer.
For example: If there are two subsequent DMA transfers. The first one with
a total length of 1 MByte and the second one with a total length of 1 kByte.
Getting the residue for both transfers shows something like that:

transfer 1: residue = 975584
transfer 2: residue = 1048380

Changes from V1:
   * Fixed coding style of the multi-line comments.
   * Improved accuracy of the residue calculation when the transfer for the
     first descriptor is active.

Changes from V2:
   * Member 'tx_width' of 'struct at_desc' restored, because the transfer width
     can't be derived from the source width when using "slave_sg".
     The transfer width is needed for the calculation of the residue if either
     the transfer of the first or the last descriptor is in progress.
     In the case of a "memory_to_memory_sg" transfer (part of this patch
     series) the transfer width of both descriptors may differ. Thus it is
     required to additionally set 'tx_width' of the last descriptor.
   * Added functions for multiply used calculations.
Signed-off-by: NTorsten Fleischer <torfl6749@gmail.com>
Acked-by: NNicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: NVinod Koul <vinod.koul@intel.com>

This patch adds support for memory to memory scatter-gather transfers.

Changes from V1:
   * Fixed coding style of the multi-line comments.

Changes from V2:
   * Added setup of 'desc->tx_width' that is needed to calculate the
     residue.
Signed-off-by: NTorsten Fleischer <torfl6749@gmail.com>
Acked-by: NNicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: NVinod Koul <vinod.koul@intel.com>

Declare slave capabilities to suppress "this driver doesn't support generic
slave capabilities reporting" warning.
Signed-off-by: NLudovic Desroches <ludovic.desroches@atmel.com>
Acked-by: NMaxime Ripard <maxime.ripard@free-electrons.com>
Acked-by: NNicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: NVinod Koul <vinod.koul@intel.com>

Split the device_control callback of the Atmel HDMAC driver to make use
of the newly introduced callbacks, that will eventually be used to retrieve
slave capabilities.
Signed-off-by: NMaxime Ripard <maxime.ripard@free-electrons.com>
Acked-by: NNicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: NVinod Koul <vinod.koul@intel.com>

Found using smatch:
drivers/dma/at_hdmac.c:299 atc_get_bytes_left() warn: unsigned
'atchan->remain_desc' is never less than zero.
Signed-off-by: NAlexandre Belloni <alexandre.belloni@free-electrons.com>
Signed-off-by: NVinod Koul <vinod.koul@intel.com>

The argument is always set to NULL and never used. Remove it.
Signed-off-by: NLaurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: NVinod Koul <vinod.koul@intel.com>

As discussed in [1] the tasklet_disable is not a proper function for teardown.
We need to ensure irq is disabled, followed by ensuring that don't schedule any
more tasklets and then its safe to use tasklet_kill().

Here in at_hdmac driver we use free_irq() before tasklet_kill(). The free_irq()
will ensure that the irq is disabled and also wait till all scheduled interrupts
are executed by invoking synchronize_irq(). So we need to only do tasklet_kill()
after invoking free_irq()

[1]: http://lwn.net/Articles/588457/Reported-by: NThomas Gleixner <tglx@linutronix.de>
Acked-by: NNicolas Ferre <nicolas.ferre@atmel.com>
Reviewed-by: NThomas Gleixner <tglx@linutronix.de>
Signed-off-by: NVinod Koul <vinod.koul@intel.com>

Remove support for DMA unmapping from drivers as it is no longer
needed (DMA core code is now handling it).

Cc: Vinod Koul <vinod.koul@intel.com>
Cc: Tomasz Figa <t.figa@samsung.com>
Cc: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: NBartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: NKyungmin Park <kyungmin.park@samsung.com>
[djbw: fix up chan2parent() unused warning in drivers/dma/dw/core.c]
Signed-off-by: NDan Williams <dan.j.williams@intel.com>

Add a hook for a common dma unmap implementation to enable removal of
the per driver custom unmap code.  (A reworked version of Bartlomiej
Zolnierkiewicz's patches to remove the custom callbacks and the size
increase of dma_async_tx_descriptor for drivers that don't care about
raid).

Cc: Vinod Koul <vinod.koul@intel.com>
Cc: Tomasz Figa <t.figa@samsung.com>
Cc: Dave Jiang <dave.jiang@intel.com>
[bzolnier: prepare pl330 driver for adding missing unmap while at it]
Signed-off-by: NBartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: NKyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: NDan Williams <dan.j.williams@intel.com>

Acked-by: NDan Williams <dan.j.williams@intel.com>
Acked-by: NLinus Walleij <linus.walleij@linaro.org>
Acked-by: NNicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: NVinod Koul <vinod.koul@intel.com>

Replace clk_enable/disable with clk_prepare_enable/disable_unprepare to
avoid common clk framework warnings.
Signed-off-by: NBoris BREZILLON <b.brezillon@overkiz.com>
[nicolas.ferre@atmel.com: remove return code checking in at_dma_resume_noirq()]
Signed-off-by: NNicolas Ferre <nicolas.ferre@atmel.com>

Correct coding style following the patch:
7c407d3e54dcc0c79119553c8d5ef176c1d5bc3a (DMA: AT91:
Get residual bytes in dma buffer).
Signed-off-by: NNicolas Ferre <nicolas.ferre@atmel.com>

Since patch 7c407d3e54dcc0c79119553c8d5ef176c1d5bc3a (DMA: AT91:
Get residual bytes in dma buffer), the function
atc_cleanup_descriptors() is not used anymore. We remove it to prevent
warnings.
Reported-by: NArnd Bergmann <arnd@arndb.de>
Signed-off-by: NNicolas Ferre <nicolas.ferre@atmel.com>
Acked-by: NArnd Bergmann <arnd@arndb.de>

For most devices the FIFO configuration is the same i.e. when half FIFO size is
available/filled, a source/destination request is serviced. But USART devices
have to do it when there is enough space/data available to perform a single
AHB access so the ASAP configuration.
Acked-by: NNicolas Ferre <nicolas.ferre@atmel.com>
Acked-by: NJean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
Signed-off-by: NLudovic Desroches <ludovic.desroches@atmel.com>
Signed-off-by: NNicolas Ferre <nicolas.ferre@atmel.com>

The driver core clears the driver data to NULL after device_release
or on probe failure, since commit 0998d063
(device-core: Ensure drvdata = NULL when no driver is bound).
Thus, it is not needed to manually clear the device driver data to NULL.
Signed-off-by: NJingoo Han <jg1.han@samsung.com>
Acked-by: NNicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: NVinod Koul <vinod.koul@intel.com>

Add support for returning the residue for current transfer cookie by
reading the transfered buffer size(BTSIZE) in CTRLA register.

For a single buffer cookie, the descriptor length minus BTSIZE
can get the residue.

For a lli cookie, remain_desc will record remain descriptor length
when last descriptor finish, the remain_desc minus BTSIZE can get the
current residue.

If the cookie has completed successfully, the residue will be zero.
If the cookie is in progress, it will be the number of bytes yet to be transferred.
If get residue error, the cookie will be turn into error status.

Check dma fifo to see if data remain, let issue pending finish remain work if there is.
Signed-off-by: NElen Song <elen.song@atmel.com>
Signed-off-by: NVinod Koul <vinod.koul@intel.com>

In one dma transfer, the data transfer width can be configured and it is limited by source or destination peripheral width,
tx_width will save the transfer width, but for memcpy, either source or destination transfer width is taken as tx_width.
Signed-off-by: NElen Song <elen.song@atmel.com>
Signed-off-by: NVinod Koul <vinod.koul@intel.com>

No modification in CFG register configuration, just rearrange
bits directives to group logically and make it more readable.
Signed-off-by: NNicolas Ferre <nicolas.ferre@atmel.com>
Acked-by: NJean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
Signed-off-by: NVinod Koul <vinod.koul@intel.com>

Peripheral handshaking identification numbers can be bigger than 15, so new
fields have been created in the CFG register.
Add macros to take this modification into account and use them in
at_dma_xlate() function.
Signed-off-by: NNicolas Ferre <nicolas.ferre@atmel.com>
Acked-by: NJean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
Signed-off-by: NVinod Koul <vinod.koul@intel.com>

Signed-off-by: NNicolas Ferre <nicolas.ferre@atmel.com>
Acked-by: NJean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
Signed-off-by: NVinod Koul <vinod.koul@intel.com>

Update at_hdmac driver to support generic DMA device tree binding. Devices
can still request channel with dma_request_channel() then it doesn't break
DMA for non DT boards.
Signed-off-by: NLudovic Desroches <ludovic.desroches@atmel.com>
Acked-by: NNicolas Ferre <nicolas.ferre@atmel.com>
Acked-by: NJean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
Acked-by: NArnd Bergmann <arnd@arndb.de>
Signed-off-by: NVinod Koul <vinod.koul@intel.com>

The BUG_ON() directive is triggered probably due to a latency
modification following inclusion of commit c10d7367 ("softirq:
reduce latencies").  This condition has not been met before 3.9-rc1 and
doesn't trigger without this patch.

We now make sure that DMA channel is idle before calling
atc_complete_all() which makes the BUG_ON() "protection" useless.
Signed-off-by: NLudovic Desroches <ludovic.desroches@atmel.com>
Signed-off-by: NNicolas Ferre <nicolas.ferre@atmel.com>
Acked-by: NVinod Koul <vinod.koul@intel.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Removing the annotation with __exit and referencing with __exit_p()
present in dma driver module remove hooks.

Part of the __devexit and __devexit_p() purge.
Signed-off-by: NMaxin B. John <maxin.john@enea.com>
Acked-by: NLinus Walleij <linus.walleij@linaro.org>
Signed-off-by: NVinod Koul <vinod.koul@intel.com>

dma_transfer_direction is a normal enum. It means we can't usually use the
values as bit fields. Let's adjust this check and move it above the usage of
the direction parameter, due to the nature of the following usage of it.
Signed-off-by: NAndy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: NViresh Kumar <viresh.kumar@linaro.org>
Acked-by: NNicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: NVinod Koul <vinod.koul@intel.com>

Change the parameter list of device_prep_dma_cyclic() so the DMA drivers
can receive the flags coming from clients.
This feature can be used during audio operation to disable all audio
related interrupts when the DMA_PREP_INTERRUPT is cleared from the flags.
Signed-off-by: NPeter Ujfalusi <peter.ujfalusi@ti.com>
Acked-by: NNicolas Ferre <nicolas.ferre@atmel.com>
Acked-by: NShawn Guo <shawn.guo@linaro.org>
Acked-by: NVinod Koul <vinod.koul@linux.intel.com>
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>

Avoid the construction of a malformed DMA request sent to
the DMA controller.
Log message is for debug only because this condition is unlikely to
append and may only trigger at driver development time.
Signed-off-by: NNicolas Ferre <nicolas.ferre@atmel.com>
Cc: Stable <stable@vger.kernel.org> [2.6.31+]
Signed-off-by: NVinod Koul <vinod.koul@linux.intel.com>

s/dma_memcpy/slave_sg/ and it is sg length that we are
talking about.
Signed-off-by: NNicolas Ferre <nicolas.ferre@atmel.com>
Cc: Stable <stable@vger.kernel.org> [2.6.31+]
Signed-off-by: NVinod Koul <vinod.koul@linux.intel.com>