Re: [PATCH] usb: ehci-vf: take the controller index from the device tree

On 8/18/26 5:12 PM, Mehmet Fide wrote:
> From: Mehmet Fide <[email protected]>
> 
> "usb start" dies with a data abort on a Colibri VF50 and on a Colibri
> VF61, and the watchdog resets the board:
> 
>    Colibri VFxx # usb start
>    starting USB...
>    Bus usb@40034000: Port not available.
>    data abort
>    ...
>    r4 : 00000003
>    Resetting CPU ...
> 
> vf_usb_of_to_plat() takes the controller index from dev_seq(), but the
> sequence numbers of the two controllers are 2 and 3:
> 
>    Class     Seq  Probed  Driver    Name
>    usb         2  [   ]   ehci_vf   usb@40034000
>    usb         3  [   ]   ehci_vf   usb@400b4000
> 
> uclass_find_next_free_seq() starts numbering above the highest alias of
> the uclass, and fdtdec_get_alias_highest_id() matches an alias by its
> name prefix plus trailing digits, so the usbphy0 and usbphy1 aliases of
> the vf device tree count as "usb" aliases and reserve 0 and 1. The two
> controllers have no aliases of their own and end up with 2 and 3, past
> the two entries of phy_bases[] and nc_reg_bases[]. usb_oc_config() then
> loads a base address from beyond the table and writes to it, which is
> the abort above. The bounds check that would have caught this only
> exists in the non-DM ehci_hcd_init().
> 
> Follow the fsl,usbphy phandle, as ehci-mx6 does, and map the PHY node
> to the index of the driver's own table instead of trusting the sequence
> number, since the alias numbering is what goes wrong here.
> 
> Tested on a Colibri VF50 V1.2A on an Iris carrier, U-Boot 2026.07 from
> NAND: "usb start" now brings up the host controller and enumerates the
> root hub instead of resetting the board.
> 
> Signed-off-by: Mehmet Fide <[email protected]>
> ---
>   drivers/usb/host/ehci-vf.c | 17 ++++++++++++++++-
>   1 file changed, 16 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/host/ehci-vf.c b/drivers/usb/host/ehci-vf.c
> index 96d1363a76e..32fe05920d0 100644
> --- a/drivers/usb/host/ehci-vf.c
> +++ b/drivers/usb/host/ehci-vf.c
> @@ -221,8 +221,23 @@ static int vf_usb_of_to_plat(struct udevice *dev)
>   	const void *dt_blob = gd->fdt_blob;
>   	int node = dev_of_offset(dev);
>   	const char *mode;
> +	fdt_addr_t phy_addr;
> +	ofnode phy_node;
> +	int i;
>   
> -	priv->portnr = dev_seq(dev);
> +	phy_node = ofnode_parse_phandle(dev_ofnode(dev), "fsl,usbphy", 0);
> +	if (!ofnode_valid(phy_node))
> +		return -EINVAL;
> +
> +	phy_addr = ofnode_get_addr(phy_node);
> +	for (i = 0; i < ARRAY_SIZE(phy_bases); i++) {
> +		if (phy_addr == phy_bases[i])
> +			break;
> +	}
> +	if (i == ARRAY_SIZE(phy_bases))
> +		return -EINVAL;
> +
> +	priv->portnr = i;
Would it be possible to eliminate the priv->portnr and index based PHY 
handling in favor of parsing the PHY addresses from DT fully, possibly 
in a follow up patch ?

This fix looks good.