sh-eth.c writes to non-existent register on RZ/A1

Daniel Palmer daniel at
Sun Jul 3 03:38:18 PDT 2016

Not sure if this is the right list or not. Please CC me as I'm not subscribed.

I've been working on getting Linux running on the GR Peach board
It has the Renesas RZ/A1H chip and it's ethernet controller is supported by
There seem to be a few different controllers that are roughly the same
and used in Renesas chips that are supported by the driver and there
are a few tables to handle differing locations for the registers.
There also seem to be controllers that have a "tsu" and some that

The controller in the RZ/A1 has a tsu but is missing one of the
registers that is called "TSU_POST1" in the tables for other chips.
This register doesn't exist according to the hardware manual for the

The problem is that the sh_eth driver doesn't handle that and in
sh_eth_tsu_enable_cam_entry_post() uses the offset table for the RZ/A1
which doesn't have an offset to TSU_POST1 to find the register and
then writes outside of the memory range that has been mapped and
crashes the kernel.

Commenting out the register write stops the kernel crashing and the
ethernet seems to work.

There is a function in sh_eth.c called sh_eth_is_rz_fast_ether() that
seems to be for working around slight differences with this version of
the controller and I considered submitting a patch with the contents
of sh_eth_tsu_enable_cam_entry_post() wrapped with if(sh_eth_is...)
but I have next to no knowledge of how the hardware actually works so
I'm looking for someone that does to chime in.



More information about the linux-arm mailing list