[PATCH 0/2] dmaengine: dw-axi-dmac: Fix burst length encoding and LLI dump

[PATCH 0/2] dmaengine: dw-axi-dmac: Fix burst length encoding and LLI dump

[Jia Wang]

The first patch converts the configured AXI burst length from a beat count
to the ARLEN/AWLEN encoding when constructing hardware descriptors. Without
this conversion, a 256-beat burst overflows the 8-bit hardware fields and
may cause DMA transfer errors.

The second patch bounds the error-path LLI dump by the number of
descriptors in the current transaction. This prevents an original DMA error
from being followed by an out-of-bounds access and kernel panic while
dumping LLIs.

The series was tested with dmatest on all eight channels using
snps,axi-max-burst-len = <256>. All channels completed without errors.

Signed-off-by: Jia Wang <wangjia@ultrarisc.com>
---
Jia Wang (2):
      dmaengine: dw-axi-dmac: Fix AXI burst length encoding
      dmaengine: dw-axi-dmac: Fix LLI dump out-of-bounds access

 drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)
---
base-commit: 1b78070aaef63512688aebfbc82365ef9d6660f1
change-id: 20260827-dma-fix-c2b27795ce12

Best regards,
--  
Jia Wang <wangjia@ultrarisc.com>

[PATCH 1/2] dmaengine: dw-axi-dmac: Fix AXI burst length encoding

[Jia Wang]

The snps,axi-max-burst-len property describes the number of beats in an
AXI burst, while the ARLEN and AWLEN fields encode that value minus one.

The driver keeps axi_rw_burst_len as the actual burst length so that
dma_device.max_burst reports the correct value. However, it also programs
that unencoded value directly into the hardware fields. A value of 256
therefore overflows the 8-bit fields and can cause AXI decode errors.

Subtract one only when constructing hardware descriptors, while keeping
the actual value for dma_device.max_burst.

Fixes: c454d16a7d5a ("dmaengine: dw-axi-dmac: Burst length settings")
Signed-off-by: Jia Wang <wangjia@ultrarisc.com>
---
 drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
index eebed2474210..742e08cfab43 100644
--- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
+++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
@@ -706,7 +706,7 @@ static int dw_axi_dma_set_hw_desc(struct axi_dma_chan *chan,
 	ctlhi = CH_CTL_H_LLI_VALID;
 
 	if (chan->chip->dw->hdata->restrict_axi_burst_len) {
-		burst_len = chan->chip->dw->hdata->axi_rw_burst_len;
+		burst_len = chan->chip->dw->hdata->axi_rw_burst_len - 1;
 		ctlhi |= CH_CTL_H_ARLEN_EN | CH_CTL_H_AWLEN_EN |
 			 burst_len << CH_CTL_H_ARLEN_POS |
 			 burst_len << CH_CTL_H_AWLEN_POS;
@@ -975,7 +975,7 @@ dma_chan_prep_dma_memcpy(struct dma_chan *dchan, dma_addr_t dst_adr,
 
 		reg = CH_CTL_H_LLI_VALID;
 		if (chan->chip->dw->hdata->restrict_axi_burst_len) {
-			u32 burst_len = chan->chip->dw->hdata->axi_rw_burst_len;
+			u32 burst_len = chan->chip->dw->hdata->axi_rw_burst_len - 1;
 
 			reg |= (CH_CTL_H_ARLEN_EN |
 				burst_len << CH_CTL_H_ARLEN_POS |

-- 
2.34.1

Re: [PATCH 1/2] dmaengine: dw-axi-dmac: Fix AXI burst length encoding

[Frank Li]

On Fri, Aug 28, 2026 at 08:48:26AM +0800, Jia Wang wrote:
> The snps,axi-max-burst-len property describes the number of beats in an
> AXI burst, while the ARLEN and AWLEN fields encode that value minus one.
>
> The driver keeps axi_rw_burst_len as the actual burst length so that
> dma_device.max_burst reports the correct value. However, it also programs
> that unencoded value directly into the hardware fields. A value of 256
> therefore overflows the 8-bit fields and can cause AXI decode errors.
>
> Subtract one only when constructing hardware descriptors, while keeping
> the actual value for dma_device.max_burst.
>
> Fixes: c454d16a7d5a ("dmaengine: dw-axi-dmac: Burst length settings")
> Signed-off-by: Jia Wang <wangjia@ultrarisc.com>
> ---

suggest switch to use FIELD_PREP() later

Reviewed-by: Frank Li <Frank.Li@nxp.com>

>  drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
> index eebed2474210..742e08cfab43 100644
> --- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
> +++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
> @@ -706,7 +706,7 @@ static int dw_axi_dma_set_hw_desc(struct axi_dma_chan *chan,
>  	ctlhi = CH_CTL_H_LLI_VALID;
>
>  	if (chan->chip->dw->hdata->restrict_axi_burst_len) {
> -		burst_len = chan->chip->dw->hdata->axi_rw_burst_len;
> +		burst_len = chan->chip->dw->hdata->axi_rw_burst_len - 1;
>  		ctlhi |= CH_CTL_H_ARLEN_EN | CH_CTL_H_AWLEN_EN |
>  			 burst_len << CH_CTL_H_ARLEN_POS |
>  			 burst_len << CH_CTL_H_AWLEN_POS;
> @@ -975,7 +975,7 @@ dma_chan_prep_dma_memcpy(struct dma_chan *dchan, dma_addr_t dst_adr,
>
>  		reg = CH_CTL_H_LLI_VALID;
>  		if (chan->chip->dw->hdata->restrict_axi_burst_len) {
> -			u32 burst_len = chan->chip->dw->hdata->axi_rw_burst_len;
> +			u32 burst_len = chan->chip->dw->hdata->axi_rw_burst_len - 1;
>
>  			reg |= (CH_CTL_H_ARLEN_EN |
>  				burst_len << CH_CTL_H_ARLEN_POS |
>
> --
> 2.34.1
>

Re: [PATCH 1/2] dmaengine: dw-axi-dmac: Fix AXI burst length encoding

[Jia Wang]

On 2026-08-28 14:32 -0500, Frank Li wrote:
> On Fri, Aug 28, 2026 at 08:48:26AM +0800, Jia Wang wrote:
> > The snps,axi-max-burst-len property describes the number of beats in an
> > AXI burst, while the ARLEN and AWLEN fields encode that value minus one.
> >
> > The driver keeps axi_rw_burst_len as the actual burst length so that
> > dma_device.max_burst reports the correct value. However, it also programs
> > that unencoded value directly into the hardware fields. A value of 256
> > therefore overflows the 8-bit fields and can cause AXI decode errors.
> >
> > Subtract one only when constructing hardware descriptors, while keeping
> > the actual value for dma_device.max_burst.
> >
> > Fixes: c454d16a7d5a ("dmaengine: dw-axi-dmac: Burst length settings")
> > Signed-off-by: Jia Wang <wangjia@ultrarisc.com>
> > ---
> 
> suggest switch to use FIELD_PREP() later
>
> Reviewed-by: Frank Li <Frank.Li@nxp.com>
> 

Thanks, I will add a separate cleanup patch in v2 to convert these
register fields to GENMASK() and FIELD_PREP().

Best regards,
Jia Wang

> >  drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
> > index eebed2474210..742e08cfab43 100644
> > --- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
> > +++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
> > @@ -706,7 +706,7 @@ static int dw_axi_dma_set_hw_desc(struct axi_dma_chan *chan,
> >  	ctlhi = CH_CTL_H_LLI_VALID;
> >
> >  	if (chan->chip->dw->hdata->restrict_axi_burst_len) {
> > -		burst_len = chan->chip->dw->hdata->axi_rw_burst_len;
> > +		burst_len = chan->chip->dw->hdata->axi_rw_burst_len - 1;
> >  		ctlhi |= CH_CTL_H_ARLEN_EN | CH_CTL_H_AWLEN_EN |
> >  			 burst_len << CH_CTL_H_ARLEN_POS |
> >  			 burst_len << CH_CTL_H_AWLEN_POS;
> > @@ -975,7 +975,7 @@ dma_chan_prep_dma_memcpy(struct dma_chan *dchan, dma_addr_t dst_adr,
> >
> >  		reg = CH_CTL_H_LLI_VALID;
> >  		if (chan->chip->dw->hdata->restrict_axi_burst_len) {
> > -			u32 burst_len = chan->chip->dw->hdata->axi_rw_burst_len;
> > +			u32 burst_len = chan->chip->dw->hdata->axi_rw_burst_len - 1;
> >
> >  			reg |= (CH_CTL_H_ARLEN_EN |
> >  				burst_len << CH_CTL_H_ARLEN_POS |
> >
> > --
> > 2.34.1
> >
> 

[PATCH 2/2] dmaengine: dw-axi-dmac: Fix LLI dump out-of-bounds access

[Jia Wang]

axi_chan_list_dump_lli() uses the channel-wide descs_allocated count to
walk the hw_desc[] array of a single transaction. If multiple
transactions have allocated LLIs, the channel count can exceed the
transaction-local nr_hw_descs and make the DMA error path read past the
end of hw_desc[].

Use the descriptor-local nr_hw_descs count when dumping LLIs.

Fixes: ef6fb2d6f1ab ("dmaengine: dw-axi-dmac: simplify descriptor management")
Signed-off-by: Jia Wang <wangjia@ultrarisc.com>
---
 drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
index 742e08cfab43..858004b5a846 100644
--- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
+++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
@@ -1052,10 +1052,9 @@ static void axi_chan_dump_lli(struct axi_dma_chan *chan,
 static void axi_chan_list_dump_lli(struct axi_dma_chan *chan,
 				   struct axi_dma_desc *desc_head)
 {
-	int count = atomic_read(&chan->descs_allocated);
 	int i;
 
-	for (i = 0; i < count; i++)
+	for (i = 0; i < desc_head->nr_hw_descs; i++)
 		axi_chan_dump_lli(chan, &desc_head->hw_desc[i]);
 }
 

-- 
2.34.1

Re: [PATCH 2/2] dmaengine: dw-axi-dmac: Fix LLI dump out-of-bounds access

[Andy Shevchenko]

On Fri, Aug 28, 2026 at 08:48:27AM +0800, Jia Wang wrote:
> axi_chan_list_dump_lli() uses the channel-wide descs_allocated count to
> walk the hw_desc[] array of a single transaction. If multiple
> transactions have allocated LLIs, the channel count can exceed the
> transaction-local nr_hw_descs and make the DMA error path read past the
> end of hw_desc[].
> 
> Use the descriptor-local nr_hw_descs count when dumping LLIs.

...

>  {
> -	int count = atomic_read(&chan->descs_allocated);
>  	int i;
>  
> -	for (i = 0; i < count; i++)
> +	for (i = 0; i < desc_head->nr_hw_descs; i++)

While at it,

	for (unsigned int i = 0; i < desc_head->nr_hw_descs; i++)

and drop that 'int i;' as well.

>  		axi_chan_dump_lli(chan, &desc_head->hw_desc[i]);
>  }

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH 2/2] dmaengine: dw-axi-dmac: Fix LLI dump out-of-bounds access

[Jia Wang]

On 2026-08-28 10:01 +0300, Andy Shevchenko wrote:
> On Fri, Aug 28, 2026 at 08:48:27AM +0800, Jia Wang wrote:
> > axi_chan_list_dump_lli() uses the channel-wide descs_allocated count to
> > walk the hw_desc[] array of a single transaction. If multiple
> > transactions have allocated LLIs, the channel count can exceed the
> > transaction-local nr_hw_descs and make the DMA error path read past the
> > end of hw_desc[].
> > 
> > Use the descriptor-local nr_hw_descs count when dumping LLIs.
> 
> ...
> 
> >  {
> > -	int count = atomic_read(&chan->descs_allocated);
> >  	int i;
> >  
> > -	for (i = 0; i < count; i++)
> > +	for (i = 0; i < desc_head->nr_hw_descs; i++)
> 
> While at it,
> 
> 	for (unsigned int i = 0; i < desc_head->nr_hw_descs; i++)
> 
> and drop that 'int i;' as well.
> 

Will update it in v2, thanks.

> >  		axi_chan_dump_lli(chan, &desc_head->hw_desc[i]);
> >  }
> 
> -- 
> With Best Regards,
> Andy Shevchenko
> 
> 
> 

Best regards,
Jia Wang