On Wed, Feb 25, 2026 at 05:30:33PM +0900, Koichiro Den wrote:
> On Fri, Jan 09, 2026 at 10:28:24AM -0500, Frank Li wrote:
> > dw_edma_channel_setup() calculates ll_max based on the size of the
> > ll_region, but the value is later overwritten with -1, preventing the
> > code from ever reaching the calculated ll_max.
> >
> > Typically ll_max is around 170 for a 4 KB page and four DMA R/W channels.
> > It is uncommon for a single DMA request to reach this limit, so the issue
> > has not been observed in practice. However, if it occurs, the driver may
> > overwrite adjacent memory before reporting an error.
> >
> > Remove the incorrect assignment so the calculated ll_max is honored
> >
> > Fixes: 31fb8c1ff962d ("dmaengine: dw-edma: Improve the linked list and data
> > blocks definition")
> > Signed-off-by: Frank Li <[email protected]>
> > ---
> > drivers/dma/dw-edma/dw-edma-core.c | 1 -
> > 1 file changed, 1 deletion(-)
> >
> > diff --git a/drivers/dma/dw-edma/dw-edma-core.c
> > b/drivers/dma/dw-edma/dw-edma-core.c
> > index
> > c6b014949afe82f10362711fc8a956fe60a72835..b154bdd7f2897d9a28df698a425afc1b1c93698b
> > 100644
> > --- a/drivers/dma/dw-edma/dw-edma-core.c
> > +++ b/drivers/dma/dw-edma/dw-edma-core.c
> > @@ -770,7 +770,6 @@ static int dw_edma_channel_setup(struct dw_edma *dw,
> > u32 wr_alloc, u32 rd_alloc)
> > chan->ll_max = (chip->ll_region_wr[chan->id].sz /
> > EDMA_LL_SZ);
> > else
> > chan->ll_max = (chip->ll_region_rd[chan->id].sz /
> > EDMA_LL_SZ);
> > - chan->ll_max -= 1;
>
> Just curious: wasn't this to reserve one slot for the final link element?
when calculate avaible entry, always use chan-ll_max -1. ll_max indicate
memory size, final link element actually occupted a space.
Frank
>
> Best regards,
> Koichiro
>
> >
> > dev_vdbg(dev, "L. List:\tChannel %s[%u] max_cnt=%u\n",
> > str_write_read(chan->dir == EDMA_DIR_WRITE),
> >
> > --
> > 2.34.1
> >
