f03dca0c9e
devm_regmap_init may return error which caused by like out of memory,
this will results in null pointer dereference later when reading
or writing register:
general protection fault in encx24j600_spi_probe
KASAN: null-ptr-deref in range [0x0000000000000090-0x0000000000000097]
CPU: 0 PID: 286 Comm: spi-encx24j600- Not tainted 5.15.0-rc2-00142-g9978db750e31-dirty #11 9c53a778c1306b1b02359f3c2bbedc0222cba652
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
RIP: 0010:regcache_cache_bypass drivers/base/regmap/regcache.c:540
Code: 54 41 89 f4 55 53 48 89 fb 48 83 ec 08 e8 26 94 a8 fe 48 8d bb a0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 4a 03 00 00 4c 8d ab b0 00 00 00 48 8b ab a0 00
RSP: 0018:ffffc900010476b8 EFLAGS: 00010207
RAX: dffffc0000000000 RBX: fffffffffffffff4 RCX: 0000000000000000
RDX: 0000000000000012 RSI: ffff888002de0000 RDI: 0000000000000094
RBP: ffff888013c9a000 R08: 0000000000000000 R09: fffffbfff3f9cc6a
R10: ffffc900010476e8 R11: fffffbfff3f9cc69 R12: 0000000000000001
R13: 000000000000000a R14: ffff888013c9af54 R15: ffff888013c9ad08
FS: 00007ffa984ab580(0000) GS:ffff88801fe00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055a6384136c8 CR3: 000000003bbe6003 CR4: 0000000000770ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
encx24j600_spi_probe drivers/net/ethernet/microchip/encx24j600.c:459
spi_probe drivers/spi/spi.c:397
really_probe drivers/base/dd.c:517
__driver_probe_device drivers/base/dd.c:751
driver_probe_device drivers/base/dd.c:782
__device_attach_driver drivers/base/dd.c:899
bus_for_each_drv drivers/base/bus.c:427
__device_attach drivers/base/dd.c:971
bus_probe_device drivers/base/bus.c:487
device_add drivers/base/core.c:3364
__spi_add_device drivers/spi/spi.c:599
spi_add_device drivers/spi/spi.c:641
spi_new_device drivers/spi/spi.c:717
new_device_store+0x18c/0x1f1 [spi_stub 4e02719357f1ff33f5a43d00630982840568e85e]
dev_attr_store drivers/base/core.c:2074
sysfs_kf_write fs/sysfs/file.c:139
kernfs_fop_write_iter fs/kernfs/file.c:300
new_sync_write fs/read_write.c:508 (discriminator 4)
vfs_write fs/read_write.c:594
ksys_write fs/read_write.c:648
do_syscall_64 arch/x86/entry/common.c:50
entry_SYSCALL_64_after_hwframe arch/x86/entry/entry_64.S:113
Add error check in devm_regmap_init_encx24j600 to avoid this situation.
Fixes: 04fbfce7a2
("net: Microchip encx24j600 driver")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Nanyong Sun <sunnanyong@huawei.com>
Link: https://lore.kernel.org/r/20211012125901.3623144-1-sunnanyong@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
517 lines
12 KiB
C
517 lines
12 KiB
C
// SPDX-License-Identifier: GPL-2.0-only
|
|
/*
|
|
* Register map access API - ENCX24J600 support
|
|
*
|
|
* Copyright 2015 Gridpoint
|
|
*
|
|
* Author: Jon Ringle <jringle@gridpoint.com>
|
|
*/
|
|
|
|
#include <linux/delay.h>
|
|
#include <linux/errno.h>
|
|
#include <linux/init.h>
|
|
#include <linux/module.h>
|
|
#include <linux/netdevice.h>
|
|
#include <linux/regmap.h>
|
|
#include <linux/spi/spi.h>
|
|
|
|
#include "encx24j600_hw.h"
|
|
|
|
static int encx24j600_switch_bank(struct encx24j600_context *ctx,
|
|
int bank)
|
|
{
|
|
int ret = 0;
|
|
int bank_opcode = BANK_SELECT(bank);
|
|
|
|
ret = spi_write(ctx->spi, &bank_opcode, 1);
|
|
if (ret == 0)
|
|
ctx->bank = bank;
|
|
|
|
return ret;
|
|
}
|
|
|
|
static int encx24j600_cmdn(struct encx24j600_context *ctx, u8 opcode,
|
|
const void *buf, size_t len)
|
|
{
|
|
struct spi_message m;
|
|
struct spi_transfer t[2] = { { .tx_buf = &opcode, .len = 1, },
|
|
{ .tx_buf = buf, .len = len }, };
|
|
spi_message_init(&m);
|
|
spi_message_add_tail(&t[0], &m);
|
|
spi_message_add_tail(&t[1], &m);
|
|
|
|
return spi_sync(ctx->spi, &m);
|
|
}
|
|
|
|
static void regmap_lock_mutex(void *context)
|
|
{
|
|
struct encx24j600_context *ctx = context;
|
|
|
|
mutex_lock(&ctx->mutex);
|
|
}
|
|
|
|
static void regmap_unlock_mutex(void *context)
|
|
{
|
|
struct encx24j600_context *ctx = context;
|
|
|
|
mutex_unlock(&ctx->mutex);
|
|
}
|
|
|
|
static int regmap_encx24j600_sfr_read(void *context, u8 reg, u8 *val,
|
|
size_t len)
|
|
{
|
|
struct encx24j600_context *ctx = context;
|
|
u8 banked_reg = reg & ADDR_MASK;
|
|
u8 bank = ((reg & BANK_MASK) >> BANK_SHIFT);
|
|
u8 cmd = RCRU;
|
|
int ret = 0;
|
|
int i = 0;
|
|
u8 tx_buf[2];
|
|
|
|
if (reg < 0x80) {
|
|
cmd = RCRCODE | banked_reg;
|
|
if ((banked_reg < 0x16) && (ctx->bank != bank))
|
|
ret = encx24j600_switch_bank(ctx, bank);
|
|
if (unlikely(ret))
|
|
return ret;
|
|
} else {
|
|
/* Translate registers that are more effecient using
|
|
* 3-byte SPI commands
|
|
*/
|
|
switch (reg) {
|
|
case EGPRDPT:
|
|
cmd = RGPRDPT; break;
|
|
case EGPWRPT:
|
|
cmd = RGPWRPT; break;
|
|
case ERXRDPT:
|
|
cmd = RRXRDPT; break;
|
|
case ERXWRPT:
|
|
cmd = RRXWRPT; break;
|
|
case EUDARDPT:
|
|
cmd = RUDARDPT; break;
|
|
case EUDAWRPT:
|
|
cmd = RUDAWRPT; break;
|
|
case EGPDATA:
|
|
case ERXDATA:
|
|
case EUDADATA:
|
|
default:
|
|
return -EINVAL;
|
|
}
|
|
}
|
|
|
|
tx_buf[i++] = cmd;
|
|
if (cmd == RCRU)
|
|
tx_buf[i++] = reg;
|
|
|
|
ret = spi_write_then_read(ctx->spi, tx_buf, i, val, len);
|
|
|
|
return ret;
|
|
}
|
|
|
|
static int regmap_encx24j600_sfr_update(struct encx24j600_context *ctx,
|
|
u8 reg, u8 *val, size_t len,
|
|
u8 unbanked_cmd, u8 banked_code)
|
|
{
|
|
u8 banked_reg = reg & ADDR_MASK;
|
|
u8 bank = ((reg & BANK_MASK) >> BANK_SHIFT);
|
|
u8 cmd = unbanked_cmd;
|
|
struct spi_message m;
|
|
struct spi_transfer t[3] = { { .tx_buf = &cmd, .len = sizeof(cmd), },
|
|
{ .tx_buf = ®, .len = sizeof(reg), },
|
|
{ .tx_buf = val, .len = len }, };
|
|
|
|
if (reg < 0x80) {
|
|
int ret = 0;
|
|
|
|
cmd = banked_code | banked_reg;
|
|
if ((banked_reg < 0x16) && (ctx->bank != bank))
|
|
ret = encx24j600_switch_bank(ctx, bank);
|
|
if (unlikely(ret))
|
|
return ret;
|
|
} else {
|
|
/* Translate registers that are more effecient using
|
|
* 3-byte SPI commands
|
|
*/
|
|
switch (reg) {
|
|
case EGPRDPT:
|
|
cmd = WGPRDPT; break;
|
|
case EGPWRPT:
|
|
cmd = WGPWRPT; break;
|
|
case ERXRDPT:
|
|
cmd = WRXRDPT; break;
|
|
case ERXWRPT:
|
|
cmd = WRXWRPT; break;
|
|
case EUDARDPT:
|
|
cmd = WUDARDPT; break;
|
|
case EUDAWRPT:
|
|
cmd = WUDAWRPT; break;
|
|
case EGPDATA:
|
|
case ERXDATA:
|
|
case EUDADATA:
|
|
default:
|
|
return -EINVAL;
|
|
}
|
|
}
|
|
|
|
spi_message_init(&m);
|
|
spi_message_add_tail(&t[0], &m);
|
|
|
|
if (cmd == unbanked_cmd) {
|
|
t[1].tx_buf = ®
|
|
spi_message_add_tail(&t[1], &m);
|
|
}
|
|
|
|
spi_message_add_tail(&t[2], &m);
|
|
return spi_sync(ctx->spi, &m);
|
|
}
|
|
|
|
static int regmap_encx24j600_sfr_write(void *context, u8 reg, u8 *val,
|
|
size_t len)
|
|
{
|
|
struct encx24j600_context *ctx = context;
|
|
|
|
return regmap_encx24j600_sfr_update(ctx, reg, val, len, WCRU, WCRCODE);
|
|
}
|
|
|
|
static int regmap_encx24j600_sfr_set_bits(struct encx24j600_context *ctx,
|
|
u8 reg, u8 val)
|
|
{
|
|
return regmap_encx24j600_sfr_update(ctx, reg, &val, 1, BFSU, BFSCODE);
|
|
}
|
|
|
|
static int regmap_encx24j600_sfr_clr_bits(struct encx24j600_context *ctx,
|
|
u8 reg, u8 val)
|
|
{
|
|
return regmap_encx24j600_sfr_update(ctx, reg, &val, 1, BFCU, BFCCODE);
|
|
}
|
|
|
|
static int regmap_encx24j600_reg_update_bits(void *context, unsigned int reg,
|
|
unsigned int mask,
|
|
unsigned int val)
|
|
{
|
|
struct encx24j600_context *ctx = context;
|
|
|
|
int ret = 0;
|
|
unsigned int set_mask = mask & val;
|
|
unsigned int clr_mask = mask & ~val;
|
|
|
|
if ((reg >= 0x40 && reg < 0x6c) || reg >= 0x80)
|
|
return -EINVAL;
|
|
|
|
if (set_mask & 0xff)
|
|
ret = regmap_encx24j600_sfr_set_bits(ctx, reg, set_mask);
|
|
|
|
set_mask = (set_mask & 0xff00) >> 8;
|
|
|
|
if ((set_mask & 0xff) && (ret == 0))
|
|
ret = regmap_encx24j600_sfr_set_bits(ctx, reg + 1, set_mask);
|
|
|
|
if ((clr_mask & 0xff) && (ret == 0))
|
|
ret = regmap_encx24j600_sfr_clr_bits(ctx, reg, clr_mask);
|
|
|
|
clr_mask = (clr_mask & 0xff00) >> 8;
|
|
|
|
if ((clr_mask & 0xff) && (ret == 0))
|
|
ret = regmap_encx24j600_sfr_clr_bits(ctx, reg + 1, clr_mask);
|
|
|
|
return ret;
|
|
}
|
|
|
|
int regmap_encx24j600_spi_write(void *context, u8 reg, const u8 *data,
|
|
size_t count)
|
|
{
|
|
struct encx24j600_context *ctx = context;
|
|
|
|
if (reg < 0xc0)
|
|
return encx24j600_cmdn(ctx, reg, data, count);
|
|
|
|
/* SPI 1-byte command. Ignore data */
|
|
return spi_write(ctx->spi, ®, 1);
|
|
}
|
|
EXPORT_SYMBOL_GPL(regmap_encx24j600_spi_write);
|
|
|
|
int regmap_encx24j600_spi_read(void *context, u8 reg, u8 *data, size_t count)
|
|
{
|
|
struct encx24j600_context *ctx = context;
|
|
|
|
if (reg == RBSEL && count > 1)
|
|
count = 1;
|
|
|
|
return spi_write_then_read(ctx->spi, ®, sizeof(reg), data, count);
|
|
}
|
|
EXPORT_SYMBOL_GPL(regmap_encx24j600_spi_read);
|
|
|
|
static int regmap_encx24j600_write(void *context, const void *data,
|
|
size_t len)
|
|
{
|
|
u8 *dout = (u8 *)data;
|
|
u8 reg = dout[0];
|
|
++dout;
|
|
--len;
|
|
|
|
if (reg > 0xa0)
|
|
return regmap_encx24j600_spi_write(context, reg, dout, len);
|
|
|
|
if (len > 2)
|
|
return -EINVAL;
|
|
|
|
return regmap_encx24j600_sfr_write(context, reg, dout, len);
|
|
}
|
|
|
|
static int regmap_encx24j600_read(void *context,
|
|
const void *reg_buf, size_t reg_size,
|
|
void *val, size_t val_size)
|
|
{
|
|
u8 reg = *(const u8 *)reg_buf;
|
|
|
|
if (reg_size != 1) {
|
|
pr_err("%s: reg=%02x reg_size=%zu\n", __func__, reg, reg_size);
|
|
return -EINVAL;
|
|
}
|
|
|
|
if (reg > 0xa0)
|
|
return regmap_encx24j600_spi_read(context, reg, val, val_size);
|
|
|
|
if (val_size > 2) {
|
|
pr_err("%s: reg=%02x val_size=%zu\n", __func__, reg, val_size);
|
|
return -EINVAL;
|
|
}
|
|
|
|
return regmap_encx24j600_sfr_read(context, reg, val, val_size);
|
|
}
|
|
|
|
static bool encx24j600_regmap_readable(struct device *dev, unsigned int reg)
|
|
{
|
|
if ((reg < 0x36) ||
|
|
((reg >= 0x40) && (reg < 0x4c)) ||
|
|
((reg >= 0x52) && (reg < 0x56)) ||
|
|
((reg >= 0x60) && (reg < 0x66)) ||
|
|
((reg >= 0x68) && (reg < 0x80)) ||
|
|
((reg >= 0x86) && (reg < 0x92)) ||
|
|
(reg == 0xc8))
|
|
return true;
|
|
else
|
|
return false;
|
|
}
|
|
|
|
static bool encx24j600_regmap_writeable(struct device *dev, unsigned int reg)
|
|
{
|
|
if ((reg < 0x12) ||
|
|
((reg >= 0x14) && (reg < 0x1a)) ||
|
|
((reg >= 0x1c) && (reg < 0x36)) ||
|
|
((reg >= 0x40) && (reg < 0x4c)) ||
|
|
((reg >= 0x52) && (reg < 0x56)) ||
|
|
((reg >= 0x60) && (reg < 0x68)) ||
|
|
((reg >= 0x6c) && (reg < 0x80)) ||
|
|
((reg >= 0x86) && (reg < 0x92)) ||
|
|
((reg >= 0xc0) && (reg < 0xc8)) ||
|
|
((reg >= 0xca) && (reg < 0xf0)))
|
|
return true;
|
|
else
|
|
return false;
|
|
}
|
|
|
|
static bool encx24j600_regmap_volatile(struct device *dev, unsigned int reg)
|
|
{
|
|
switch (reg) {
|
|
case ERXHEAD:
|
|
case EDMACS:
|
|
case ETXSTAT:
|
|
case ETXWIRE:
|
|
case ECON1: /* Can be modified via single byte cmds */
|
|
case ECON2: /* Can be modified via single byte cmds */
|
|
case ESTAT:
|
|
case EIR: /* Can be modified via single byte cmds */
|
|
case MIRD:
|
|
case MISTAT:
|
|
return true;
|
|
default:
|
|
break;
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
static bool encx24j600_regmap_precious(struct device *dev, unsigned int reg)
|
|
{
|
|
/* single byte cmds are precious */
|
|
if (((reg >= 0xc0) && (reg < 0xc8)) ||
|
|
((reg >= 0xca) && (reg < 0xf0)))
|
|
return true;
|
|
else
|
|
return false;
|
|
}
|
|
|
|
static int regmap_encx24j600_phy_reg_read(void *context, unsigned int reg,
|
|
unsigned int *val)
|
|
{
|
|
struct encx24j600_context *ctx = context;
|
|
int ret;
|
|
unsigned int mistat;
|
|
|
|
reg = MIREGADR_VAL | (reg & PHREG_MASK);
|
|
ret = regmap_write(ctx->regmap, MIREGADR, reg);
|
|
if (unlikely(ret))
|
|
goto err_out;
|
|
|
|
ret = regmap_write(ctx->regmap, MICMD, MIIRD);
|
|
if (unlikely(ret))
|
|
goto err_out;
|
|
|
|
usleep_range(26, 100);
|
|
while ((ret = regmap_read(ctx->regmap, MISTAT, &mistat) != 0) &&
|
|
(mistat & BUSY))
|
|
cpu_relax();
|
|
|
|
if (unlikely(ret))
|
|
goto err_out;
|
|
|
|
ret = regmap_write(ctx->regmap, MICMD, 0);
|
|
if (unlikely(ret))
|
|
goto err_out;
|
|
|
|
ret = regmap_read(ctx->regmap, MIRD, val);
|
|
|
|
err_out:
|
|
if (ret)
|
|
pr_err("%s: error %d reading reg %02x\n", __func__, ret,
|
|
reg & PHREG_MASK);
|
|
|
|
return ret;
|
|
}
|
|
|
|
static int regmap_encx24j600_phy_reg_write(void *context, unsigned int reg,
|
|
unsigned int val)
|
|
{
|
|
struct encx24j600_context *ctx = context;
|
|
int ret;
|
|
unsigned int mistat;
|
|
|
|
reg = MIREGADR_VAL | (reg & PHREG_MASK);
|
|
ret = regmap_write(ctx->regmap, MIREGADR, reg);
|
|
if (unlikely(ret))
|
|
goto err_out;
|
|
|
|
ret = regmap_write(ctx->regmap, MIWR, val);
|
|
if (unlikely(ret))
|
|
goto err_out;
|
|
|
|
usleep_range(26, 100);
|
|
while ((ret = regmap_read(ctx->regmap, MISTAT, &mistat) != 0) &&
|
|
(mistat & BUSY))
|
|
cpu_relax();
|
|
|
|
err_out:
|
|
if (ret)
|
|
pr_err("%s: error %d writing reg %02x=%04x\n", __func__, ret,
|
|
reg & PHREG_MASK, val);
|
|
|
|
return ret;
|
|
}
|
|
|
|
static bool encx24j600_phymap_readable(struct device *dev, unsigned int reg)
|
|
{
|
|
switch (reg) {
|
|
case PHCON1:
|
|
case PHSTAT1:
|
|
case PHANA:
|
|
case PHANLPA:
|
|
case PHANE:
|
|
case PHCON2:
|
|
case PHSTAT2:
|
|
case PHSTAT3:
|
|
return true;
|
|
default:
|
|
return false;
|
|
}
|
|
}
|
|
|
|
static bool encx24j600_phymap_writeable(struct device *dev, unsigned int reg)
|
|
{
|
|
switch (reg) {
|
|
case PHCON1:
|
|
case PHCON2:
|
|
case PHANA:
|
|
return true;
|
|
case PHSTAT1:
|
|
case PHSTAT2:
|
|
case PHSTAT3:
|
|
case PHANLPA:
|
|
case PHANE:
|
|
default:
|
|
return false;
|
|
}
|
|
}
|
|
|
|
static bool encx24j600_phymap_volatile(struct device *dev, unsigned int reg)
|
|
{
|
|
switch (reg) {
|
|
case PHSTAT1:
|
|
case PHSTAT2:
|
|
case PHSTAT3:
|
|
case PHANLPA:
|
|
case PHANE:
|
|
case PHCON2:
|
|
return true;
|
|
default:
|
|
return false;
|
|
}
|
|
}
|
|
|
|
static struct regmap_config regcfg = {
|
|
.name = "reg",
|
|
.reg_bits = 8,
|
|
.val_bits = 16,
|
|
.max_register = 0xee,
|
|
.reg_stride = 2,
|
|
.cache_type = REGCACHE_RBTREE,
|
|
.val_format_endian = REGMAP_ENDIAN_LITTLE,
|
|
.readable_reg = encx24j600_regmap_readable,
|
|
.writeable_reg = encx24j600_regmap_writeable,
|
|
.volatile_reg = encx24j600_regmap_volatile,
|
|
.precious_reg = encx24j600_regmap_precious,
|
|
.lock = regmap_lock_mutex,
|
|
.unlock = regmap_unlock_mutex,
|
|
};
|
|
|
|
static struct regmap_bus regmap_encx24j600 = {
|
|
.write = regmap_encx24j600_write,
|
|
.read = regmap_encx24j600_read,
|
|
.reg_update_bits = regmap_encx24j600_reg_update_bits,
|
|
};
|
|
|
|
static struct regmap_config phycfg = {
|
|
.name = "phy",
|
|
.reg_bits = 8,
|
|
.val_bits = 16,
|
|
.max_register = 0x1f,
|
|
.cache_type = REGCACHE_RBTREE,
|
|
.val_format_endian = REGMAP_ENDIAN_LITTLE,
|
|
.readable_reg = encx24j600_phymap_readable,
|
|
.writeable_reg = encx24j600_phymap_writeable,
|
|
.volatile_reg = encx24j600_phymap_volatile,
|
|
};
|
|
|
|
static struct regmap_bus phymap_encx24j600 = {
|
|
.reg_write = regmap_encx24j600_phy_reg_write,
|
|
.reg_read = regmap_encx24j600_phy_reg_read,
|
|
};
|
|
|
|
int devm_regmap_init_encx24j600(struct device *dev,
|
|
struct encx24j600_context *ctx)
|
|
{
|
|
mutex_init(&ctx->mutex);
|
|
regcfg.lock_arg = ctx;
|
|
ctx->regmap = devm_regmap_init(dev, ®map_encx24j600, ctx, ®cfg);
|
|
if (IS_ERR(ctx->regmap))
|
|
return PTR_ERR(ctx->regmap);
|
|
ctx->phymap = devm_regmap_init(dev, &phymap_encx24j600, ctx, &phycfg);
|
|
if (IS_ERR(ctx->phymap))
|
|
return PTR_ERR(ctx->phymap);
|
|
|
|
return 0;
|
|
}
|
|
EXPORT_SYMBOL_GPL(devm_regmap_init_encx24j600);
|
|
|
|
MODULE_LICENSE("GPL");
|