wl12xx: fix use after free
[pandora-kernel.git] / drivers / net / wireless / wl12xx / spi.c
1 /*
2  * This file is part of wl1271
3  *
4  * Copyright (C) 2008-2009 Nokia Corporation
5  *
6  * Contact: Luciano Coelho <luciano.coelho@nokia.com>
7  *
8  * This program is free software; you can redistribute it and/or
9  * modify it under the terms of the GNU General Public License
10  * version 2 as published by the Free Software Foundation.
11  *
12  * This program is distributed in the hope that it will be useful, but
13  * WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
15  * General Public License for more details.
16  *
17  * You should have received a copy of the GNU General Public License
18  * along with this program; if not, write to the Free Software
19  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
20  * 02110-1301 USA
21  *
22  */
23
24 #include <linux/irq.h>
25 #include <linux/module.h>
26 #include <linux/crc7.h>
27 #include <linux/spi/spi.h>
28 #include <linux/wl12xx.h>
29 #include <linux/slab.h>
30
31 #include "wl12xx.h"
32 #include "wl12xx_80211.h"
33 #include "io.h"
34
35 #include "reg.h"
36
37 #define WSPI_CMD_READ                 0x40000000
38 #define WSPI_CMD_WRITE                0x00000000
39 #define WSPI_CMD_FIXED                0x20000000
40 #define WSPI_CMD_BYTE_LENGTH          0x1FFE0000
41 #define WSPI_CMD_BYTE_LENGTH_OFFSET   17
42 #define WSPI_CMD_BYTE_ADDR            0x0001FFFF
43
44 #define WSPI_INIT_CMD_CRC_LEN       5
45
46 #define WSPI_INIT_CMD_START         0x00
47 #define WSPI_INIT_CMD_TX            0x40
48 /* the extra bypass bit is sampled by the TNET as '1' */
49 #define WSPI_INIT_CMD_BYPASS_BIT    0x80
50 #define WSPI_INIT_CMD_FIXEDBUSY_LEN 0x07
51 #define WSPI_INIT_CMD_EN_FIXEDBUSY  0x80
52 #define WSPI_INIT_CMD_DIS_FIXEDBUSY 0x00
53 #define WSPI_INIT_CMD_IOD           0x40
54 #define WSPI_INIT_CMD_IP            0x20
55 #define WSPI_INIT_CMD_CS            0x10
56 #define WSPI_INIT_CMD_WS            0x08
57 #define WSPI_INIT_CMD_WSPI          0x01
58 #define WSPI_INIT_CMD_END           0x01
59
60 #define WSPI_INIT_CMD_LEN           8
61
62 #define HW_ACCESS_WSPI_FIXED_BUSY_LEN \
63                 ((WL1271_BUSY_WORD_LEN - 4) / sizeof(u32))
64 #define HW_ACCESS_WSPI_INIT_CMD_MASK  0
65
66 /* HW limitation: maximum possible chunk size is 4095 bytes */
67 #define WSPI_MAX_CHUNK_SIZE    4092
68
69 #define WSPI_MAX_NUM_OF_CHUNKS (WL1271_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE)
70
71 static inline struct spi_device *wl_to_spi(struct wl1271 *wl)
72 {
73         return wl->if_priv;
74 }
75
76 static struct device *wl1271_spi_wl_to_dev(struct wl1271 *wl)
77 {
78         return &(wl_to_spi(wl)->dev);
79 }
80
81 static void wl1271_spi_disable_interrupts(struct wl1271 *wl)
82 {
83         disable_irq(wl->irq);
84 }
85
86 static void wl1271_spi_enable_interrupts(struct wl1271 *wl)
87 {
88         enable_irq(wl->irq);
89 }
90
91 static void wl1271_spi_reset(struct wl1271 *wl)
92 {
93         u8 *cmd;
94         struct spi_transfer t;
95         struct spi_message m;
96
97         cmd = kzalloc(WSPI_INIT_CMD_LEN, GFP_KERNEL);
98         if (!cmd) {
99                 wl1271_error("could not allocate cmd for spi reset");
100                 return;
101         }
102
103         memset(&t, 0, sizeof(t));
104         spi_message_init(&m);
105
106         memset(cmd, 0xff, WSPI_INIT_CMD_LEN);
107
108         t.tx_buf = cmd;
109         t.len = WSPI_INIT_CMD_LEN;
110         spi_message_add_tail(&t, &m);
111
112         spi_sync(wl_to_spi(wl), &m);
113         wl1271_dump(DEBUG_SPI, "spi reset -> ", cmd, WSPI_INIT_CMD_LEN);
114         kfree(cmd);
115 }
116
117 static void wl1271_spi_init(struct wl1271 *wl)
118 {
119         u8 crc[WSPI_INIT_CMD_CRC_LEN], *cmd;
120         struct spi_transfer t;
121         struct spi_message m;
122
123         cmd = kzalloc(WSPI_INIT_CMD_LEN, GFP_KERNEL);
124         if (!cmd) {
125                 wl1271_error("could not allocate cmd for spi init");
126                 return;
127         }
128
129         memset(crc, 0, sizeof(crc));
130         memset(&t, 0, sizeof(t));
131         spi_message_init(&m);
132
133         /*
134          * Set WSPI_INIT_COMMAND
135          * the data is being send from the MSB to LSB
136          */
137         cmd[2] = 0xff;
138         cmd[3] = 0xff;
139         cmd[1] = WSPI_INIT_CMD_START | WSPI_INIT_CMD_TX;
140         cmd[0] = 0;
141         cmd[7] = 0;
142         cmd[6] |= HW_ACCESS_WSPI_INIT_CMD_MASK << 3;
143         cmd[6] |= HW_ACCESS_WSPI_FIXED_BUSY_LEN & WSPI_INIT_CMD_FIXEDBUSY_LEN;
144
145         if (HW_ACCESS_WSPI_FIXED_BUSY_LEN == 0)
146                 cmd[5] |=  WSPI_INIT_CMD_DIS_FIXEDBUSY;
147         else
148                 cmd[5] |= WSPI_INIT_CMD_EN_FIXEDBUSY;
149
150         cmd[5] |= WSPI_INIT_CMD_IOD | WSPI_INIT_CMD_IP | WSPI_INIT_CMD_CS
151                 | WSPI_INIT_CMD_WSPI | WSPI_INIT_CMD_WS;
152
153         crc[0] = cmd[1];
154         crc[1] = cmd[0];
155         crc[2] = cmd[7];
156         crc[3] = cmd[6];
157         crc[4] = cmd[5];
158
159         cmd[4] |= crc7(0, crc, WSPI_INIT_CMD_CRC_LEN) << 1;
160         cmd[4] |= WSPI_INIT_CMD_END;
161
162         t.tx_buf = cmd;
163         t.len = WSPI_INIT_CMD_LEN;
164         spi_message_add_tail(&t, &m);
165
166         spi_sync(wl_to_spi(wl), &m);
167         wl1271_dump(DEBUG_SPI, "spi init -> ", cmd, WSPI_INIT_CMD_LEN);
168         kfree(cmd);
169 }
170
171 #define WL1271_BUSY_WORD_TIMEOUT 1000
172
173 static int wl1271_spi_read_busy(struct wl1271 *wl)
174 {
175         struct spi_transfer t[1];
176         struct spi_message m;
177         u32 *busy_buf;
178         int num_busy_bytes = 0;
179
180         /*
181          * Read further busy words from SPI until a non-busy word is
182          * encountered, then read the data itself into the buffer.
183          */
184
185         num_busy_bytes = WL1271_BUSY_WORD_TIMEOUT;
186         busy_buf = wl->buffer_busyword;
187         while (num_busy_bytes) {
188                 num_busy_bytes--;
189                 spi_message_init(&m);
190                 memset(t, 0, sizeof(t));
191                 t[0].rx_buf = busy_buf;
192                 t[0].len = sizeof(u32);
193                 t[0].cs_change = true;
194                 spi_message_add_tail(&t[0], &m);
195                 spi_sync(wl_to_spi(wl), &m);
196
197                 if (*busy_buf & 0x1)
198                         return 0;
199         }
200
201         /* The SPI bus is unresponsive, the read failed. */
202         wl1271_error("SPI read busy-word timeout!\n");
203         return -ETIMEDOUT;
204 }
205
206 static void wl1271_spi_raw_read(struct wl1271 *wl, int addr, void *buf,
207                                 size_t len, bool fixed)
208 {
209         struct spi_transfer t[2];
210         struct spi_message m;
211         u32 *busy_buf;
212         u32 *cmd;
213         u32 chunk_len;
214
215         while (len > 0) {
216                 chunk_len = min((size_t)WSPI_MAX_CHUNK_SIZE, len);
217
218                 cmd = &wl->buffer_cmd;
219                 busy_buf = wl->buffer_busyword;
220
221                 *cmd = 0;
222                 *cmd |= WSPI_CMD_READ;
223                 *cmd |= (chunk_len << WSPI_CMD_BYTE_LENGTH_OFFSET) &
224                         WSPI_CMD_BYTE_LENGTH;
225                 *cmd |= addr & WSPI_CMD_BYTE_ADDR;
226
227                 if (fixed)
228                         *cmd |= WSPI_CMD_FIXED;
229
230                 spi_message_init(&m);
231                 memset(t, 0, sizeof(t));
232
233                 t[0].tx_buf = cmd;
234                 t[0].len = 4;
235                 t[0].cs_change = true;
236                 spi_message_add_tail(&t[0], &m);
237
238                 /* Busy and non busy words read */
239                 t[1].rx_buf = busy_buf;
240                 t[1].len = WL1271_BUSY_WORD_LEN;
241                 t[1].cs_change = true;
242                 spi_message_add_tail(&t[1], &m);
243
244                 spi_sync(wl_to_spi(wl), &m);
245
246                 if (!(busy_buf[WL1271_BUSY_WORD_CNT - 1] & 0x1) &&
247                     wl1271_spi_read_busy(wl)) {
248                         memset(buf, 0, chunk_len);
249                         return;
250                 }
251
252                 spi_message_init(&m);
253                 memset(t, 0, sizeof(t));
254
255                 t[0].rx_buf = buf;
256                 t[0].len = chunk_len;
257                 t[0].cs_change = true;
258                 spi_message_add_tail(&t[0], &m);
259
260                 spi_sync(wl_to_spi(wl), &m);
261
262                 wl1271_dump(DEBUG_SPI, "spi_read cmd -> ", cmd, sizeof(*cmd));
263                 wl1271_dump(DEBUG_SPI, "spi_read buf <- ", buf, chunk_len);
264
265                 if (!fixed)
266                         addr += chunk_len;
267                 buf += chunk_len;
268                 len -= chunk_len;
269         }
270 }
271
272 static void wl1271_spi_raw_write(struct wl1271 *wl, int addr, void *buf,
273                           size_t len, bool fixed)
274 {
275         struct spi_transfer t[2 * WSPI_MAX_NUM_OF_CHUNKS];
276         struct spi_message m;
277         u32 commands[WSPI_MAX_NUM_OF_CHUNKS];
278         u32 *cmd;
279         u32 chunk_len;
280         int i;
281
282         WARN_ON(len > WL1271_AGGR_BUFFER_SIZE);
283
284         spi_message_init(&m);
285         memset(t, 0, sizeof(t));
286
287         cmd = &commands[0];
288         i = 0;
289         while (len > 0) {
290                 chunk_len = min((size_t)WSPI_MAX_CHUNK_SIZE, len);
291
292                 *cmd = 0;
293                 *cmd |= WSPI_CMD_WRITE;
294                 *cmd |= (chunk_len << WSPI_CMD_BYTE_LENGTH_OFFSET) &
295                         WSPI_CMD_BYTE_LENGTH;
296                 *cmd |= addr & WSPI_CMD_BYTE_ADDR;
297
298                 if (fixed)
299                         *cmd |= WSPI_CMD_FIXED;
300
301                 t[i].tx_buf = cmd;
302                 t[i].len = sizeof(*cmd);
303                 spi_message_add_tail(&t[i++], &m);
304
305                 t[i].tx_buf = buf;
306                 t[i].len = chunk_len;
307                 spi_message_add_tail(&t[i++], &m);
308
309                 wl1271_dump(DEBUG_SPI, "spi_write cmd -> ", cmd, sizeof(*cmd));
310                 wl1271_dump(DEBUG_SPI, "spi_write buf -> ", buf, chunk_len);
311
312                 if (!fixed)
313                         addr += chunk_len;
314                 buf += chunk_len;
315                 len -= chunk_len;
316                 cmd++;
317         }
318
319         spi_sync(wl_to_spi(wl), &m);
320 }
321
322 static irqreturn_t wl1271_irq(int irq, void *cookie)
323 {
324         struct wl1271 *wl;
325         unsigned long flags;
326
327         wl1271_debug(DEBUG_IRQ, "IRQ");
328
329         wl = cookie;
330
331         /* complete the ELP completion */
332         spin_lock_irqsave(&wl->wl_lock, flags);
333         if (wl->elp_compl) {
334                 complete(wl->elp_compl);
335                 wl->elp_compl = NULL;
336         }
337
338         if (!test_and_set_bit(WL1271_FLAG_IRQ_RUNNING, &wl->flags))
339                 ieee80211_queue_work(wl->hw, &wl->irq_work);
340         set_bit(WL1271_FLAG_IRQ_PENDING, &wl->flags);
341         spin_unlock_irqrestore(&wl->wl_lock, flags);
342
343         return IRQ_HANDLED;
344 }
345
346 static int wl1271_spi_set_power(struct wl1271 *wl, bool enable)
347 {
348         if (wl->set_power)
349                 wl->set_power(enable);
350
351         return 0;
352 }
353
354 static struct wl1271_if_operations spi_ops = {
355         .read           = wl1271_spi_raw_read,
356         .write          = wl1271_spi_raw_write,
357         .reset          = wl1271_spi_reset,
358         .init           = wl1271_spi_init,
359         .power          = wl1271_spi_set_power,
360         .dev            = wl1271_spi_wl_to_dev,
361         .enable_irq     = wl1271_spi_enable_interrupts,
362         .disable_irq    = wl1271_spi_disable_interrupts
363 };
364
365 static int __devinit wl1271_probe(struct spi_device *spi)
366 {
367         struct wl12xx_platform_data *pdata;
368         struct ieee80211_hw *hw;
369         struct wl1271 *wl;
370         int ret;
371
372         pdata = spi->dev.platform_data;
373         if (!pdata) {
374                 wl1271_error("no platform data");
375                 return -ENODEV;
376         }
377
378         hw = wl1271_alloc_hw();
379         if (IS_ERR(hw))
380                 return PTR_ERR(hw);
381
382         wl = hw->priv;
383
384         dev_set_drvdata(&spi->dev, wl);
385         wl->if_priv = spi;
386
387         wl->if_ops = &spi_ops;
388
389         /* This is the only SPI value that we need to set here, the rest
390          * comes from the board-peripherals file */
391         spi->bits_per_word = 32;
392
393         ret = spi_setup(spi);
394         if (ret < 0) {
395                 wl1271_error("spi_setup failed");
396                 goto out_free;
397         }
398
399         wl->set_power = pdata->set_power;
400         if (!wl->set_power) {
401                 wl1271_error("set power function missing in platform data");
402                 ret = -ENODEV;
403                 goto out_free;
404         }
405
406         wl->ref_clock = pdata->board_ref_clock;
407
408         wl->irq = spi->irq;
409         if (wl->irq < 0) {
410                 wl1271_error("irq missing in platform data");
411                 ret = -ENODEV;
412                 goto out_free;
413         }
414
415         ret = request_irq(wl->irq, wl1271_irq, 0, DRIVER_NAME, wl);
416         if (ret < 0) {
417                 wl1271_error("request_irq() failed: %d", ret);
418                 goto out_free;
419         }
420
421         set_irq_type(wl->irq, IRQ_TYPE_EDGE_RISING);
422
423         disable_irq(wl->irq);
424
425         ret = wl1271_init_ieee80211(wl);
426         if (ret)
427                 goto out_irq;
428
429         ret = wl1271_register_hw(wl);
430         if (ret)
431                 goto out_irq;
432
433         wl1271_notice("initialized");
434
435         return 0;
436
437  out_irq:
438         free_irq(wl->irq, wl);
439
440  out_free:
441         wl1271_free_hw(wl);
442
443         return ret;
444 }
445
446 static int __devexit wl1271_remove(struct spi_device *spi)
447 {
448         struct wl1271 *wl = dev_get_drvdata(&spi->dev);
449
450         wl1271_unregister_hw(wl);
451         free_irq(wl->irq, wl);
452         wl1271_free_hw(wl);
453
454         return 0;
455 }
456
457
458 static struct spi_driver wl1271_spi_driver = {
459         .driver = {
460                 .name           = "wl1271_spi",
461                 .bus            = &spi_bus_type,
462                 .owner          = THIS_MODULE,
463         },
464
465         .probe          = wl1271_probe,
466         .remove         = __devexit_p(wl1271_remove),
467 };
468
469 static int __init wl1271_init(void)
470 {
471         int ret;
472
473         ret = spi_register_driver(&wl1271_spi_driver);
474         if (ret < 0) {
475                 wl1271_error("failed to register spi driver: %d", ret);
476                 goto out;
477         }
478
479 out:
480         return ret;
481 }
482
483 static void __exit wl1271_exit(void)
484 {
485         spi_unregister_driver(&wl1271_spi_driver);
486
487         wl1271_notice("unloaded");
488 }
489
490 module_init(wl1271_init);
491 module_exit(wl1271_exit);
492
493 MODULE_LICENSE("GPL");
494 MODULE_AUTHOR("Luciano Coelho <luciano.coelho@nokia.com>");
495 MODULE_AUTHOR("Juuso Oikarinen <juuso.oikarinen@nokia.com>");
496 MODULE_FIRMWARE(WL1271_FW_NAME);
497 MODULE_ALIAS("spi:wl1271");