Re: [PATCH v4 09/10] dmaengine: dw-edma: Use burst array instead of linked list

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Multi-burst transfers in non-LL (non-Linked-List) mode will silently hang because bursts are incorrectly grouped, leading to hardware programming being bypassed.
- [High] Early termination of scatter-gather iteration leaves uninitialized bursts in the pre-allocated chunk array, leading to zero-filled descriptors being submitted to hardware.
--

--- Patch [9]: [PATCH v4 09/10] dmaengine: dw-edma: Use burst array instead of linked list ---
commit baa518039c3b11326baa6f39333dddc50d2d6b4f
Author: Frank Li <Frank.Li@nxp.com>

dmaengine: dw-edma: Use burst array instead of linked list

Creating a DMA descriptor requires at least three kzalloc() calls because
each burst is allocated as a linked-list node. Since the number of bursts
is already known when the descriptor is created, a linked list is not
necessary. Allocate a burst array when creating each chunk to simplify the
code and eliminate one kzalloc() call.

> diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c
> --- a/drivers/dma/dw-edma/dw-edma-core.c
> +++ b/drivers/dma/dw-edma/dw-edma-core.c
[ ... ]
> @@ -530,15 +456,15 @@ dw_edma_device_transfer(struct dw_edma_transfer *xfer,
>  		if (xfer->type == EDMA_XFER_SCATTER_GATHER && !sg)
>  			break;

[Severity: High]
If this loop breaks early, chunk->nburst retains the pre-allocated max
size (n) without being updated to match the actual number of populated bursts.

Will the subsequent hardware programming loop in dw_edma_core_start()
iterate up to the unadjusted chunk->nburst, inadvertently submitting
zero-filled descriptors and setting the completion flag on the wrong burst?

>  
> -		if (chunk->bursts_alloc == bursts_max) {
> -			chunk = dw_edma_alloc_chunk(desc);
> +		if (!(i % chan->ll_max)) {
> +			u32 n = min(cnt - i, chan->ll_max);
> +
> +			chunk = dw_edma_alloc_chunk(desc, n);

[Severity: High]
The previous code used bursts_max to limit chunk sizes here, restricting
non-LL mode transfers to 1 burst per chunk. This new chunk sizing logic
unconditionally allocates up to chan->ll_max.

For multi-segment non-LL transfers, will chunk->nburst now exceed 1?

If so, when dw_edma_core_start() runs:

    if (chan->non_ll) {
        if (chunk->nburst == 1)
            chan->dw->core->non_ll_start(chunk->chan, &chunk->burst[0]);
        return;
    }

Might this cause the function to silently return without starting the
hardware, permanently hanging the transfer?

>  			if (unlikely(!chunk))
>  				goto err_alloc;
>  		}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260708-edma_ll-v4-0-cc128f0afb61@nxp.com?part=9