Re: [PATCH v3] dmaengine: dw-edma: Enable HDMA 64R/W Channels

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:

New issues:
- [High] The 64-channel HDMA feature is unreachable because platform glue drivers still enforce legacy 8-channel hardcoded limits.

Pre-existing issues:
- [High] The eDMA subsystem is deregistered AFTER the hardware core is disabled and IRQs are freed, violating tear-down symmetry.
- [High] The virt-dma descriptors are never freed when a channel is released, leading to a permanent memory leak.
--

commit 20ba395bede7014c18b81804a5f6a941f3a95ebd
Author: Devendra K Verma <devendra.verma@amd.com>

dmaengine: dw-edma: Enable HDMA 64R/W Channels

As per 'Designware Cores PCI Express Controller Databook',
Section 7.1 - Overview, HDMA supports 64 Read and 64 Write
channels. Current controller driver supports up to 8 read and
write channels only. In order to utilize all the channels the
controller driver need to have the channel related structs
and variables as per the number of channels supported by IP.

> diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c
> index c2feb3adc79fa..adf1b3939f96c 100644
> --- a/drivers/dma/dw-edma/dw-edma-core.c
> +++ b/drivers/dma/dw-edma/dw-edma-core.c

[ ... ]

> @@ -1079,6 +1079,8 @@ int dw_edma_probe(struct dw_edma_chip *chip)
>  	struct dw_edma *dw;
>  	u32 wr_alloc = 0;
>  	u32 rd_alloc = 0;
> +	u16 max_wr_cnt;
> +	u16 max_rd_cnt;
>  	int i, err;
>  
>  	if (!chip)
> @@ -1094,20 +1096,25 @@ int dw_edma_probe(struct dw_edma_chip *chip)
>  
>  	dw->chip = chip;
>  
> -	if (dw->chip->mf == EDMA_MF_HDMA_NATIVE)
> +	if (dw->chip->mf == EDMA_MF_HDMA_NATIVE) {
>  		dw_hdma_v0_core_register(dw);
> -	else
> +		max_wr_cnt = HDMA_MAX_WR_CH;
> +		max_rd_cnt = HDMA_MAX_RD_CH;
> +	} else {
>  		dw_edma_v0_core_register(dw);
> +		max_wr_cnt = EDMA_MAX_WR_CH;
> +		max_rd_cnt = EDMA_MAX_RD_CH;
> +	}
>  
>  	raw_spin_lock_init(&dw->lock);
>  
>  	dw->wr_ch_cnt = min_t(u16, chip->ll_wr_cnt,
>  			      dw_edma_core_ch_count(dw, EDMA_DIR_WRITE));
> -	dw->wr_ch_cnt = min_t(u16, dw->wr_ch_cnt, EDMA_MAX_WR_CH);
> +	dw->wr_ch_cnt = min_t(u16, dw->wr_ch_cnt, max_wr_cnt);
>  
>  	dw->rd_ch_cnt = min_t(u16, chip->ll_rd_cnt,
>  			      dw_edma_core_ch_count(dw, EDMA_DIR_READ));
> -	dw->rd_ch_cnt = min_t(u16, dw->rd_ch_cnt, EDMA_MAX_RD_CH);
> +	dw->rd_ch_cnt = min_t(u16, dw->rd_ch_cnt, max_rd_cnt);
>  
>  	if (!dw->wr_ch_cnt && !dw->rd_ch_cnt)
>  		return -EINVAL;

[Severity: High]
This patch expands the eDMA core structures to support up to 64 HDMA channels.
However, does it miss updating the PCIe instantiation wrappers, rendering the
feature unusable?

In drivers/pci/controller/dwc/pcie-designware.c, dw_pcie_edma_find_channels()
performs a sanity check that explicitly rejects any configuration exceeding
EDMA_MAX_WR_CH (8), returning -EINVAL:

	if (!pci->edma.ll_wr_cnt || pci->edma.ll_wr_cnt > EDMA_MAX_WR_CH ||
	    !pci->edma.ll_rd_cnt || pci->edma.ll_rd_cnt > EDMA_MAX_RD_CH)
		return -EINVAL;

Similarly, dw_pcie_edma_irq_vector() limits IRQ indices to 16
(EDMA_MAX_WR_CH + EDMA_MAX_RD_CH).

Furthermore, in drivers/dma/dw-edma/dw-edma-pcie.c, the functions
dw_edma_pcie_get_synopsys_dma_data() and dw_edma_pcie_get_xilinx_dma_data()
use min_t to bound the hardware-reported channel count against
pdata->wr_ch_cnt (which is statically initialized to 2 or 8):

	pdata->wr_ch_cnt = min_t(u16, pdata->wr_ch_cnt,
				 FIELD_GET(DW_PCIE_SYNOPSYS_VSEC_DMA_WR_CH, val));

Will any attempt to configure an HDMA device with >8 channels be silently
truncated to 8 or fail to probe completely?


[Severity: High]
This is a pre-existing issue, but looking at dw_edma_remove(), the eDMA
subsystem is deregistered after the hardware core is disabled and IRQs are
freed. Does this violate tear-down symmetry?

In dw_edma_remove(), the driver first calls dw_edma_core_off(dw) to disable
the hardware, and then frees all IRQs using free_irq(). Only after that does
it call dma_async_device_unregister(&dw->dma) and kill the virt-dma tasklets:

	/* Disable eDMA */
	dw_edma_core_off(dw);

	/* Free irqs */
	for (i = (dw->nr_irqs - 1); i >= 0; i--)
		free_irq(chip->ops->irq_vector(dev, i), &dw->irq[i]);
	dw_edma_emul_irq_free(dw);

	/* Deregister eDMA device */
	dma_async_device_unregister(&dw->dma);

If a client still holds a reference and has an active DMA transfer or submits
a new one while the device is being removed, the transfer cannot complete
because the hardware is disabled and interrupts are freed. Can this lead to a
hung task or a DMA timeout?


[Severity: High]
This is a pre-existing issue, but does the driver leak virt-dma descriptors
permanently when a channel is released?

The virt-dma framework requires drivers to call vchan_free_chan_resources()
from their .device_free_chan_resources callback to free all pending, submitted,
and allocated descriptors. The dw_edma_free_chan_resources() function waits for
the channel to stop but fails to call vchan_free_chan_resources(&chan->vc)
or manually free the descriptors:

static void dw_edma_free_chan_resources(struct dma_chan *dchan)
{
	unsigned long timeout = jiffies + msecs_to_jiffies(5000);
	int ret;

	while (time_before(jiffies, timeout)) {
		ret = dw_edma_device_terminate_all(dchan);
		... 
	}
}

As a result, every time a client allocates descriptors and then releases the
channel, are all those descriptors permanently leaked?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260603144147.3249691-1-devendra.verma@amd.com?part=1