From: Federico Amedeo Izzo <[email protected]> The slimbus controller register base was calculated using the controller ID and the register size, producing wrong results for ID > 1.
The expression reduces to ngd->base = ctrl->base for controller with ID = 1; but for ID > 1 the other factors produce a wrong base address. This bug caused a crash while trying to bring-up the secondary slimbus controller (ID = 3) on oneplus-enchilada with sdm845. In practice, the correct base address for each slimbus controller can be obtained from the device-tree, so there is no need for further calculations. This was validated by reading the version register from the WCN3990 slim interface on oneplus-enchilada. --- Signed-off-by: Federico Amedeo Izzo <[email protected]> --- drivers/slimbus/qcom-ngd-ctrl.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c index 80877e951849..91932f8d021b 100644 --- a/drivers/slimbus/qcom-ngd-ctrl.c +++ b/drivers/slimbus/qcom-ngd-ctrl.c @@ -1547,8 +1547,7 @@ static int of_qcom_slim_ngd_register(struct device *parent, kfree(ngd); return ret; } - ngd->base = ctrl->base + ngd->id * data->offset + - (ngd->id - 1) * data->size; + ngd->base = ctrl->base + data->offset; return 0; } --- base-commit: b9810cd75b9fb56a3425d391cba3f608502bd474 change-id: 20260709-qcom-ngd-register-base-fix-a59713a184b8 Best regards, -- Federico Amedeo Izzo <[email protected]>
