linux-toradex.git/drivers/dma/mediatek/mtk-uart-apdma.c, branch v6.11

Merge tag 'dmaengine-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine

2023-11-04T04:56:51+00:00

Pull dmaengine updates from Vinod Koul:

 - Big pile of __counted_by attribute annotations to several structures
   for bounds checking of flexible arrays at run-time

 - Another big pile platform remove callback returning void changes

 - Device tree device_get_match_data() usage and dropping
   of_match_device() calls

 - Minor driver updates to pxa, idxd fsl, hisi etc drivers

* tag 'dmaengine-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: (106 commits)
  dmaengine: stm32-mdma: correct desc prep when channel running
  dmaengine: dw-axi-dmac: Add support DMAX_NUM_CHANNELS > 16
  dmaengine: xilinx: xilinx_dma: Fix kernel doc about xilinx_dma_remove()
  dmaengine: mmp_tdma: drop unused variable 'of_id'
  MAINTAINERS: Add entries for NXP(Freescale) eDMA drivers
  dmaengine: xilinx: xdma: Support cyclic transfers
  dmaengine: xilinx: xdma: Prepare the introduction of cyclic transfers
  dmaengine: Drop unnecessary of_match_device() calls
  dmaengine: Use device_get_match_data()
  dmaengine: pxa_dma: Annotate struct pxad_desc_sw with __counted_by
  dmaengine: pxa_dma: Remove an erroneous BUG_ON() in pxad_free_desc()
  dmaengine: xilinx: xdma: Use resource_size() in xdma_probe()
  dmaengine: fsl-dpaa2-qdma: Remove redundant initialization owner in dpaa2_qdma_driver
  dmaengine: Remove unused declaration dma_chan_cleanup()
  dmaengine: mmp: fix Wvoid-pointer-to-enum-cast warning
  dmaengine: qcom: fix Wvoid-pointer-to-enum-cast warning
  dmaengine: fsl-edma: Remove redundant dev_err() for platform_get_irq()
  dmaengine: ep93xx_dma: Annotate struct ep93xx_dma_engine with __counted_by
  dmaengine: idxd: add wq driver name support for accel-config user tool
  dmaengine: fsl-edma: Annotate struct struct fsl_edma_engine with __counted_by
  ...

dmaengine: mediatek: Fix deadlock caused by synchronize_irq()

2023-10-04T13:56:36+00:00

The synchronize_irq(c->irq) will not return until the IRQ handler
mtk_uart_apdma_irq_handler() is completed. If the synchronize_irq()
holds a spin_lock and waits the IRQ handler to complete, but the
IRQ handler also needs the same spin_lock. The deadlock will happen.
The process is shown below:

          cpu0                        cpu1
mtk_uart_apdma_device_pause() | mtk_uart_apdma_irq_handler()
  spin_lock_irqsave()         |
                              |   spin_lock_irqsave()
  //hold the lock to wait     |
  synchronize_irq()           |

This patch reorders the synchronize_irq(c->irq) outside the spin_lock
in order to mitigate the bug.

Fixes: 9135408c3ace ("dmaengine: mediatek: Add MediaTek UART APDMA support")
Signed-off-by: Duoming Zhou 
Reviewed-by: Eugen Hristev 
Link: https://lore.kernel.org/r/20230806032511.45263-1-duoming@zju.edu.cn
Signed-off-by: Vinod Koul

dmaengine: mediatek: mtk-uart-apdma: Convert to platform remove callback returning void

2023-09-28T07:40:50+00:00

The .remove() callback for a platform driver returns an int which makes
many driver authors wrongly assume it's possible to do error handling by
returning an error code. However the value returned is ignored (apart
from emitting a warning) and this typically results in resource leaks.
To improve here there is a quest to make the remove callback return
void. In the first step of this quest all drivers are converted to
.remove_new() which already returns void. Eventually after all drivers
are converted, .remove_new() is renamed to .remove().

Trivially convert this driver from always returning zero in the remove
callback to the void returning variant.

Signed-off-by: Uwe Kleine-König 
Reviewed-by: AngeloGioacchino Del Regno 
Link: https://lore.kernel.org/r/20230919133207.1400430-25-u.kleine-koenig@pengutronix.de
Signed-off-by: Vinod Koul

dmaengine: Explicitly include correct DT includes

2023-08-01T18:21:27+00:00

The DT of_device.h and of_platform.h date back to the separate
of_platform_bus_type before it as merged into the regular platform bus.
As part of that merge prepping Arm DT support 13 years ago, they
"temporarily" include each other. They also include platform_device.h
and of.h. As a result, there's a pretty much random mix of those include
files used throughout the tree. In order to detangle these headers and
replace the implicit includes with struct declarations, users need to
explicitly include the correct includes.

Signed-off-by: Rob Herring 
Link: https://lore.kernel.org/r/20230718143138.1066177-1-robh@kernel.org
Signed-off-by: Vinod Koul

dmaengine: mediatek: drop bogus pm_runtime_set_active()

2023-07-12T16:54:01+00:00

The runtime PM state must be updated while runtime PM is disabled for
the change to take effect.

Drop the bogus pm_runtime_set_active() which left the PM state set to
suspended (as it should be or the clock would not be enabled when the
device is resumed).

Signed-off-by: Johan Hovold 
Link: https://lore.kernel.org/r/20230622075150.885-1-johan+linaro@kernel.org
Signed-off-by: Vinod Koul

dmaengine: mediatek:Fix PM usage reference leak of mtk_uart_apdma_alloc_chan_resources

2022-04-12T11:15:42+00:00

pm_runtime_get_sync will increment pm usage counter even it failed.
Forgetting to putting operation will result in reference leak here.
We fix it:
1) Replacing it with pm_runtime_resume_and_get to keep usage counter
   balanced.
2) Add putting operation before returning error.

Fixes:9135408c3ace4 ("dmaengine: mediatek: Add MediaTek UART APDMA support")
Signed-off-by: Zhang Qilong 
Link: https://lore.kernel.org/r/20220319022142.142709-1-zhangqilong3@huawei.com
Signed-off-by: Vinod Koul

dmaengine: mediatek: use GFP_NOWAIT instead of GFP_ATOMIC in prep_dma

2021-06-07T06:53:47+00:00

As recommended by the doc in:
Documentation/drivers-api/dmaengine/provider.rst

Use GFP_NOWAIT to not deplete the emergency pool.

Signed-off-by: Guillaume Ranquet 

Link: https://lore.kernel.org/r/20210513192642.29446-4-granquet@baylibre.com
Signed-off-by: Vinod Koul

dmaengine: mediatek: do not issue a new desc if one is still current

2021-06-07T06:53:47+00:00

Avoid issuing a new desc if one is still being processed as this can
lead to some desc never being marked as completed.

Signed-off-by: Guillaume Ranquet 

Link: https://lore.kernel.org/r/20210513192642.29446-3-granquet@baylibre.com
Signed-off-by: Vinod Koul

dmaengine: mediatek: free the proper desc in desc_free handler

2021-06-07T06:53:47+00:00

The desc_free handler assumed that the desc we want to free was always
 the current one associated with the channel.

This is seldom the case and this is causing use after free crashes in
 multiple places (tx/rx/terminate...).

  BUG: KASAN: use-after-free in mtk_uart_apdma_rx_handler+0x120/0x304

  Call trace:
   dump_backtrace+0x0/0x1b0
   show_stack+0x24/0x34
   dump_stack+0xe0/0x150
   print_address_description+0x8c/0x55c
   __kasan_report+0x1b8/0x218
   kasan_report+0x14/0x20
   __asan_load4+0x98/0x9c
   mtk_uart_apdma_rx_handler+0x120/0x304
   mtk_uart_apdma_irq_handler+0x50/0x80
   __handle_irq_event_percpu+0xe0/0x210
   handle_irq_event+0x8c/0x184
   handle_fasteoi_irq+0x1d8/0x3ac
   __handle_domain_irq+0xb0/0x110
   gic_handle_irq+0x50/0xb8
   el0_irq_naked+0x60/0x6c

  Allocated by task 3541:
   __kasan_kmalloc+0xf0/0x1b0
   kasan_kmalloc+0x10/0x1c
   kmem_cache_alloc_trace+0x90/0x2dc
   mtk_uart_apdma_prep_slave_sg+0x6c/0x1a0
   mtk8250_dma_rx_complete+0x220/0x2e4
   vchan_complete+0x290/0x340
   tasklet_action_common+0x220/0x298
   tasklet_action+0x28/0x34
   __do_softirq+0x158/0x35c

  Freed by task 3541:
   __kasan_slab_free+0x154/0x224
   kasan_slab_free+0x14/0x24
   slab_free_freelist_hook+0xf8/0x15c
   kfree+0xb4/0x278
   mtk_uart_apdma_desc_free+0x34/0x44
   vchan_complete+0x1bc/0x340
   tasklet_action_common+0x220/0x298
   tasklet_action+0x28/0x34
   __do_softirq+0x158/0x35c

  The buggy address belongs to the object at ffff000063606800
   which belongs to the cache kmalloc-256 of size 256
  The buggy address is located 176 bytes inside of
   256-byte region [ffff000063606800, ffff000063606900)
  The buggy address belongs to the page:
  page:fffffe00016d8180 refcount:1 mapcount:0 mapping:ffff00000302f600 index:0x0 compound_mapcount: 0
  flags: 0xffff00000010200(slab|head)
  raw: 0ffff00000010200 dead000000000100 dead000000000122 ffff00000302f600
  raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
  page dumped because: kasan: bad access detected

Signed-off-by: Guillaume Ranquet 

Link: https://lore.kernel.org/r/20210513192642.29446-2-granquet@baylibre.com
Signed-off-by: Vinod Koul

dmaengine: mediatek: simplify the return expression of mtk_uart_apdma_runtime_resume()

2020-09-18T07:02:37+00:00

Simplify the return expression.

Signed-off-by: Liu Shixin 
Link: https://lore.kernel.org/r/20200915032622.1772309-1-liushixin2@huawei.com
Signed-off-by: Vinod Koul