[PATCH 01/17] dmaengine: dw-edma: Fix residue burst index in tx_status()

[Koichiro Den]

dw_edma_device_tx_status() uses desc->done_burst to subtract the
completed byte count from the descriptor size. done_burst is a count of
completed bursts, not the zero-based index of the last completed burst.

Index desc->burst[] with done_burst - 1. Otherwise tx_status() reads the
next burst's cumulative transfer size, which under-reports the residue
and can become a one-past-the-end access when all bursts have completed.

While at it, return early when txstate is NULL and drop the redundant
desc check after vd2dw_edma_desc(). These are minor clean-ups since
dma_set_residue() already tolerates a NULL state, and vd2dw_edma_desc()
is only reached for a valid vdesc.

Signed-off-by: Koichiro Den <den@xxxxxxxxxxxxx>
---
@Frank, if you plan to respin 20260109-edma_ll-v2-0-5c0b27b2c664@xxxxxxx
and agree with this patch, consider folding this fix into your patch
when submitting your v3.

 drivers/dma/dw-edma/dw-edma-core.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c
index 1c8aef5e03b0..d99b6256660a 100644
--- a/drivers/dma/dw-edma/dw-edma-core.c
+++ b/drivers/dma/dw-edma/dw-edma-core.c
@@ -244,7 +244,7 @@ dw_edma_device_tx_status(struct dma_chan *dchan, dma_cookie_t cookie,
 		ret = DMA_PAUSED;
 
 	if (!txstate)
-		goto ret_residue;
+		return ret;
 
 	spin_lock_irqsave(&chan->vc.lock, flags);
 	vd = vchan_find_desc(&chan->vc, cookie);
@@ -252,12 +252,11 @@ dw_edma_device_tx_status(struct dma_chan *dchan, dma_cookie_t cookie,
 		desc = vd2dw_edma_desc(vd);
 
 		residue = desc->alloc_sz;
-		if (desc && desc->done_burst)
-			residue -= desc->burst[desc->done_burst].xfer_sz;
+		if (desc->done_burst)
+			residue -= desc->burst[desc->done_burst - 1].xfer_sz;
 	}
 	spin_unlock_irqrestore(&chan->vc.lock, flags);
 
-ret_residue:
 	dma_set_residue(txstate, residue);
 
 	return ret;
-- 
2.51.0