Merge tag 'dmaengine-fix-5.2' of git://git.infradead.org/users/vkoul/slave-dma

Pull dmaengine fixes from Vinod Koul:

 - bam_dma fix for completed descriptor count

 - fix for imx-sdma remove BD_INTR for channel0 and use-after-free on
   probe error path

 - endian bug fix in jz4780 IRQ handler

* tag 'dmaengine-fix-5.2' of git://git.infradead.org/users/vkoul/slave-dma:
  dmaengine: qcom: bam_dma: Fix completed descriptors count
  dmaengine: imx-sdma: remove BD_INTR for channel0
  dmaengine: imx-sdma: fix use-after-free on probe error path
  dmaengine: jz4780: Fix an endian bug in IRQ handler

3 files changed, 35 insertions, 25 deletions

diff --git a/drivers/dma/dma-jz4780.c b/drivers/dma/dma-jz4780.c
index 263bee76ef0d..6b8c4c458e8a 100644
--- a/drivers/dma/dma-jz4780.c
+++ b/drivers/dma/dma-jz4780.c
@@ -718,12 +718,13 @@ static irqreturn_t jz4780_dma_irq_handler(int irq, void *data)
 {
         struct jz4780_dma_dev *jzdma = data;
         unsigned int nb_channels = jzdma->soc_data->nb_channels;
-        uint32_t pending, dmac;
+        unsigned long pending;
+        uint32_t dmac;
         int i;
 
         pending = jz4780_dma_ctrl_readl(jzdma, JZ_DMA_REG_DIRQP);
 
-        for_each_set_bit(i, (unsigned long *)&pending, nb_channels) {
+        for_each_set_bit(i, &pending, nb_channels) {
                 if (jz4780_dma_chan_irq(jzdma, &jzdma->chan[i]))
                         pending &= ~BIT(i);
         }
diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
index 99d9f431ae2c..4ec84a633bd3 100644
--- a/drivers/dma/imx-sdma.c
+++ b/drivers/dma/imx-sdma.c
@@ -703,7 +703,7 @@ static int sdma_load_script(struct sdma_engine *sdma, void *buf, int size,
         spin_lock_irqsave(&sdma->channel_0_lock, flags);
 
         bd0->mode.command = C0_SETPM;
-        bd0->mode.status = BD_DONE | BD_INTR | BD_WRAP | BD_EXTD;
+        bd0->mode.status = BD_DONE | BD_WRAP | BD_EXTD;
         bd0->mode.count = size / 2;
         bd0->buffer_addr = buf_phys;
         bd0->ext_buffer_addr = address;
@@ -1025,7 +1025,7 @@ static int sdma_load_context(struct sdma_channel *sdmac)
         context->gReg[7] = sdmac->watermark_level;
 
         bd0->mode.command = C0_SETDM;
-        bd0->mode.status = BD_DONE | BD_INTR | BD_WRAP | BD_EXTD;
+        bd0->mode.status = BD_DONE | BD_WRAP | BD_EXTD;
         bd0->mode.count = sizeof(*context) / 4;
         bd0->buffer_addr = sdma->context_phys;
         bd0->ext_buffer_addr = 2048 + (sizeof(*context) / 4) * channel;
@@ -2096,27 +2096,6 @@ static int sdma_probe(struct platform_device *pdev)
         if (pdata && pdata->script_addrs)
                 sdma_add_scripts(sdma, pdata->script_addrs);
 
-        if (pdata) {
-                ret = sdma_get_firmware(sdma, pdata->fw_name);
-                if (ret)
-                        dev_warn(&pdev->dev, "failed to get firmware from platform data\n");
-        } else {
-                /*
-                 * Because that device tree does not encode ROM script address,
-                 * the RAM script in firmware is mandatory for device tree
-                 * probe, otherwise it fails.
-                 */
-                ret = of_property_read_string(np, "fsl,sdma-ram-script-name",
-                                              &fw_name);
-                if (ret)
-                        dev_warn(&pdev->dev, "failed to get firmware name\n");
-                else {
-                        ret = sdma_get_firmware(sdma, fw_name);
-                        if (ret)
-                                dev_warn(&pdev->dev, "failed to get firmware from device tree\n");
-                }
-        }
-
         sdma->dma_device.dev = &pdev->dev;
 
         sdma->dma_device.device_alloc_chan_resources = sdma_alloc_chan_resources;
@@ -2161,6 +2140,33 @@ static int sdma_probe(struct platform_device *pdev)
                 of_node_put(spba_bus);
         }
 
+        /*
+         * Kick off firmware loading as the very last step:
+         * attempt to load firmware only if we're not on the error path, because
+         * the firmware callback requires a fully functional and allocated sdma
+         * instance.
+         */
+        if (pdata) {
+                ret = sdma_get_firmware(sdma, pdata->fw_name);
+                if (ret)
+                        dev_warn(&pdev->dev, "failed to get firmware from platform data\n");
+        } else {
+                /*
+                 * Because that device tree does not encode ROM script address,
+                 * the RAM script in firmware is mandatory for device tree
+                 * probe, otherwise it fails.
+                 */
+                ret = of_property_read_string(np, "fsl,sdma-ram-script-name",
+                                              &fw_name);
+                if (ret) {
+                        dev_warn(&pdev->dev, "failed to get firmware name\n");
+                } else {
+                        ret = sdma_get_firmware(sdma, fw_name);
+                        if (ret)
+                                dev_warn(&pdev->dev, "failed to get firmware from device tree\n");
+                }
+        }
+
         return 0;
 
 err_register:
diff --git a/drivers/dma/qcom/bam_dma.c b/drivers/dma/qcom/bam_dma.c
index 4b43844f6af5..8e90a405939d 100644
--- a/drivers/dma/qcom/bam_dma.c
+++ b/drivers/dma/qcom/bam_dma.c
@@ -799,6 +799,9 @@ static u32 process_channel_irqs(struct bam_device *bdev)
                 /* Number of bytes available to read */
                 avail = CIRC_CNT(offset, bchan->head, MAX_DESCRIPTORS + 1);
 
+                if (offset < bchan->head)
+                        avail--;
+
                 list_for_each_entry_safe(async_desc, tmp,
                                          &bchan->desc_list, desc_node) {
                         /* Not enough data to read */