kernel-ark/drivers/usb/host/ehci-ath79.c
Gabor Juhos c27d5368ef USB: ehci-ath79: fix a NULL pointer dereference
Loading the ehci-hcd module on the ath79 platform causes
a NULL pointer dereference:

CPU 0 Unable to handle kernel paging request at virtual address 00000000, epc == c0252928, ra == c00de968
Oops[#1]:
Cpu 0
$ 0   : 00000000 00000070 00000001 00000000
$ 4   : 802cf870 0000117e ffffffff 8019c7bc
$ 8   : 0000000a 00000002 00000001 fffffffb
$12   : 8026ef20 0000000f ffffff80 802dad3c
$16   : 8077a2d4 8077a200 c00f3484 8019ed84
$20   : c00f0000 00000003 000000a0 80262c2c
$24   : 00000002 80079da0
$28   : 80788000 80789c80 80262b14 c00de968
Hi    : 00000000
Lo    : b61f0000
epc   : c0252928 __mod_vermagic5+0xc260/0xc7e8 [ehci_hcd]
    Not tainted
ra    : c00de968 usb_add_hcd+0x2a4/0x858 [usbcore]
Status: 1000c003    KERNEL EXL IE
Cause : 00800008
BadVA : 00000000
PrId  : 00019374 (MIPS 24Kc)
Modules linked in: ehci_hcd(+) pppoe pppox ipt_REJECT xt_TCPMSS ipt_LOG
xt_comment xt_multiport xt_mac xt_limit iptable_mangle iptable_filte
r ip_tables xt_tcpudp x_tables ppp_async ppp_generic slhc ath mac80211
usbcore nls_base input_polldev crc_ccitt cfg80211 compat input_core a
rc4 aes_generic crypto_algapi
Process insmod (pid: 379, threadinfo=80788000, task=80ca2180,
tls=77fe52d0)
Stack : c0253184 80c57d80 80789cac 8077a200 00000001 8019edc0 807fa800 8077a200
        8077a290 c00f3484 8019ed84 c00f0000 00000003 000000a0 80262c2c c00de968
        802d0000 800878cc c0253228 c02528e4 c0253184 80c57d80 80bf6800 80ca2180
        8007b75c 00000000 8077a200 802cf830 802d0000 00000003 fffffff4 00000015
        00000348 00000124 800b189c c024bb4c c0255000 801a27e8 c0253228 c02528e4
        ...
Call Trace:
[<c0252928>] __mod_vermagic5+0xc260/0xc7e8 [ehci_hcd]

It is caused by:

  commit c430131a02
  Author: Jan Andersson <jan@gaisler.com>
  Date:   Tue May 3 20:11:57 2011 +0200

      USB: EHCI: Support controllers with big endian capability regs

      The two first HC capability registers (CAPLENGTH and HCIVERSION)
      are defined as one 8-bit and one 16-bit register. Most HC
      implementations have selected to treat these registers as part
      of a 32-bit register, giving the same layout for both big and
      small endian systems.

      This patch adds a new quirk, big_endian_capbase, to support
      controllers with big endian register interfaces that treat
      HCIVERSION and CAPLENGTH as individual registers.

      Signed-off-by: Jan Andersson <jan@gaisler.com>
      Acked-by: Alan Stern <stern@rowland.harvard.edu>
      Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

The reading of the HC capability register has been moved by that
commit to a place where the ehci->caps field is not initialized
yet. This patch moves the reading of the register back to the
original place.

Acked-by: Jan Andersson <jan@gaisler.com>
Cc: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-06-27 13:46:44 -07:00

205 lines
4.4 KiB
C

/*
* Bus Glue for Atheros AR7XXX/AR9XXX built-in EHCI controller.
*
* Copyright (C) 2008-2011 Gabor Juhos <juhosg@openwrt.org>
* Copyright (C) 2008 Imre Kaloz <kaloz@openwrt.org>
*
* Parts of this file are based on Atheros' 2.6.15 BSP
* Copyright (C) 2007 Atheros Communications, Inc.
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 as published
* by the Free Software Foundation.
*/
#include <linux/platform_device.h>
enum {
EHCI_ATH79_IP_V1 = 0,
EHCI_ATH79_IP_V2,
};
static const struct platform_device_id ehci_ath79_id_table[] = {
{
.name = "ar71xx-ehci",
.driver_data = EHCI_ATH79_IP_V1,
},
{
.name = "ar724x-ehci",
.driver_data = EHCI_ATH79_IP_V2,
},
{
.name = "ar913x-ehci",
.driver_data = EHCI_ATH79_IP_V2,
},
{
/* terminating entry */
},
};
MODULE_DEVICE_TABLE(platform, ehci_ath79_id_table);
static int ehci_ath79_init(struct usb_hcd *hcd)
{
struct ehci_hcd *ehci = hcd_to_ehci(hcd);
struct platform_device *pdev = to_platform_device(hcd->self.controller);
const struct platform_device_id *id;
int ret;
id = platform_get_device_id(pdev);
if (!id) {
dev_err(hcd->self.controller, "missing device id\n");
return -EINVAL;
}
switch (id->driver_data) {
case EHCI_ATH79_IP_V1:
ehci->has_synopsys_hc_bug = 1;
ehci->caps = hcd->regs;
ehci->regs = hcd->regs +
HC_LENGTH(ehci,
ehci_readl(ehci, &ehci->caps->hc_capbase));
break;
case EHCI_ATH79_IP_V2:
hcd->has_tt = 1;
ehci->caps = hcd->regs + 0x100;
ehci->regs = hcd->regs + 0x100 +
HC_LENGTH(ehci,
ehci_readl(ehci, &ehci->caps->hc_capbase));
break;
default:
BUG();
}
dbg_hcs_params(ehci, "reset");
dbg_hcc_params(ehci, "reset");
ehci->hcs_params = ehci_readl(ehci, &ehci->caps->hcs_params);
ehci->sbrn = 0x20;
ehci_reset(ehci);
ret = ehci_init(hcd);
if (ret)
return ret;
ehci_port_power(ehci, 0);
return 0;
}
static const struct hc_driver ehci_ath79_hc_driver = {
.description = hcd_name,
.product_desc = "Atheros built-in EHCI controller",
.hcd_priv_size = sizeof(struct ehci_hcd),
.irq = ehci_irq,
.flags = HCD_MEMORY | HCD_USB2,
.reset = ehci_ath79_init,
.start = ehci_run,
.stop = ehci_stop,
.shutdown = ehci_shutdown,
.urb_enqueue = ehci_urb_enqueue,
.urb_dequeue = ehci_urb_dequeue,
.endpoint_disable = ehci_endpoint_disable,
.endpoint_reset = ehci_endpoint_reset,
.get_frame_number = ehci_get_frame,
.hub_status_data = ehci_hub_status_data,
.hub_control = ehci_hub_control,
.relinquish_port = ehci_relinquish_port,
.port_handed_over = ehci_port_handed_over,
.clear_tt_buffer_complete = ehci_clear_tt_buffer_complete,
};
static int ehci_ath79_probe(struct platform_device *pdev)
{
struct usb_hcd *hcd;
struct resource *res;
int irq;
int ret;
if (usb_disabled())
return -ENODEV;
res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
if (!res) {
dev_dbg(&pdev->dev, "no IRQ specified\n");
return -ENODEV;
}
irq = res->start;
res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
if (!res) {
dev_dbg(&pdev->dev, "no base address specified\n");
return -ENODEV;
}
hcd = usb_create_hcd(&ehci_ath79_hc_driver, &pdev->dev,
dev_name(&pdev->dev));
if (!hcd)
return -ENOMEM;
hcd->rsrc_start = res->start;
hcd->rsrc_len = res->end - res->start + 1;
if (!request_mem_region(hcd->rsrc_start, hcd->rsrc_len, hcd_name)) {
dev_dbg(&pdev->dev, "controller already in use\n");
ret = -EBUSY;
goto err_put_hcd;
}
hcd->regs = ioremap(hcd->rsrc_start, hcd->rsrc_len);
if (!hcd->regs) {
dev_dbg(&pdev->dev, "error mapping memory\n");
ret = -EFAULT;
goto err_release_region;
}
ret = usb_add_hcd(hcd, irq, IRQF_DISABLED | IRQF_SHARED);
if (ret)
goto err_iounmap;
return 0;
err_iounmap:
iounmap(hcd->regs);
err_release_region:
release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
err_put_hcd:
usb_put_hcd(hcd);
return ret;
}
static int ehci_ath79_remove(struct platform_device *pdev)
{
struct usb_hcd *hcd = platform_get_drvdata(pdev);
usb_remove_hcd(hcd);
iounmap(hcd->regs);
release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
usb_put_hcd(hcd);
return 0;
}
static struct platform_driver ehci_ath79_driver = {
.probe = ehci_ath79_probe,
.remove = ehci_ath79_remove,
.id_table = ehci_ath79_id_table,
.driver = {
.owner = THIS_MODULE,
.name = "ath79-ehci",
}
};
MODULE_ALIAS(PLATFORM_MODULE_PREFIX "ath79-ehci");