[SCSI] virtio_scsi: fix TMF use-after-free
[linux-flexiantxendom0-3.2.10.git] / drivers / spi / spi-orion.c
1 /*
2  * Marvell Orion SPI controller driver
3  *
4  * Author: Shadi Ammouri <shadi@marvell.com>
5  * Copyright (C) 2007-2008 Marvell Ltd.
6  *
7  * This program is free software; you can redistribute it and/or modify
8  * it under the terms of the GNU General Public License version 2 as
9  * published by the Free Software Foundation.
10  */
11
12 #include <linux/init.h>
13 #include <linux/interrupt.h>
14 #include <linux/delay.h>
15 #include <linux/platform_device.h>
16 #include <linux/err.h>
17 #include <linux/io.h>
18 #include <linux/spi/spi.h>
19 #include <linux/spi/orion_spi.h>
20 #include <linux/module.h>
21 #include <asm/unaligned.h>
22
23 #define DRIVER_NAME                     "orion_spi"
24
25 #define ORION_NUM_CHIPSELECTS           1 /* only one slave is supported*/
26 #define ORION_SPI_WAIT_RDY_MAX_LOOP     2000 /* in usec */
27
28 #define ORION_SPI_IF_CTRL_REG           0x00
29 #define ORION_SPI_IF_CONFIG_REG         0x04
30 #define ORION_SPI_DATA_OUT_REG          0x08
31 #define ORION_SPI_DATA_IN_REG           0x0c
32 #define ORION_SPI_INT_CAUSE_REG         0x10
33
34 #define ORION_SPI_IF_8_16_BIT_MODE      (1 << 5)
35 #define ORION_SPI_CLK_PRESCALE_MASK     0x1F
36
37 struct orion_spi {
38         struct work_struct      work;
39
40         /* Lock access to transfer list.        */
41         spinlock_t              lock;
42
43         struct list_head        msg_queue;
44         struct spi_master       *master;
45         void __iomem            *base;
46         unsigned int            max_speed;
47         unsigned int            min_speed;
48         struct orion_spi_info   *spi_info;
49 };
50
51 static struct workqueue_struct *orion_spi_wq;
52
53 static inline void __iomem *spi_reg(struct orion_spi *orion_spi, u32 reg)
54 {
55         return orion_spi->base + reg;
56 }
57
58 static inline void
59 orion_spi_setbits(struct orion_spi *orion_spi, u32 reg, u32 mask)
60 {
61         void __iomem *reg_addr = spi_reg(orion_spi, reg);
62         u32 val;
63
64         val = readl(reg_addr);
65         val |= mask;
66         writel(val, reg_addr);
67 }
68
69 static inline void
70 orion_spi_clrbits(struct orion_spi *orion_spi, u32 reg, u32 mask)
71 {
72         void __iomem *reg_addr = spi_reg(orion_spi, reg);
73         u32 val;
74
75         val = readl(reg_addr);
76         val &= ~mask;
77         writel(val, reg_addr);
78 }
79
80 static int orion_spi_set_transfer_size(struct orion_spi *orion_spi, int size)
81 {
82         if (size == 16) {
83                 orion_spi_setbits(orion_spi, ORION_SPI_IF_CONFIG_REG,
84                                   ORION_SPI_IF_8_16_BIT_MODE);
85         } else if (size == 8) {
86                 orion_spi_clrbits(orion_spi, ORION_SPI_IF_CONFIG_REG,
87                                   ORION_SPI_IF_8_16_BIT_MODE);
88         } else {
89                 pr_debug("Bad bits per word value %d (only 8 or 16 are "
90                          "allowed).\n", size);
91                 return -EINVAL;
92         }
93
94         return 0;
95 }
96
97 static int orion_spi_baudrate_set(struct spi_device *spi, unsigned int speed)
98 {
99         u32 tclk_hz;
100         u32 rate;
101         u32 prescale;
102         u32 reg;
103         struct orion_spi *orion_spi;
104
105         orion_spi = spi_master_get_devdata(spi->master);
106
107         tclk_hz = orion_spi->spi_info->tclk;
108
109         /*
110          * the supported rates are: 4,6,8...30
111          * round up as we look for equal or less speed
112          */
113         rate = DIV_ROUND_UP(tclk_hz, speed);
114         rate = roundup(rate, 2);
115
116         /* check if requested speed is too small */
117         if (rate > 30)
118                 return -EINVAL;
119
120         if (rate < 4)
121                 rate = 4;
122
123         /* Convert the rate to SPI clock divisor value. */
124         prescale = 0x10 + rate/2;
125
126         reg = readl(spi_reg(orion_spi, ORION_SPI_IF_CONFIG_REG));
127         reg = ((reg & ~ORION_SPI_CLK_PRESCALE_MASK) | prescale);
128         writel(reg, spi_reg(orion_spi, ORION_SPI_IF_CONFIG_REG));
129
130         return 0;
131 }
132
133 /*
134  * called only when no transfer is active on the bus
135  */
136 static int
137 orion_spi_setup_transfer(struct spi_device *spi, struct spi_transfer *t)
138 {
139         struct orion_spi *orion_spi;
140         unsigned int speed = spi->max_speed_hz;
141         unsigned int bits_per_word = spi->bits_per_word;
142         int     rc;
143
144         orion_spi = spi_master_get_devdata(spi->master);
145
146         if ((t != NULL) && t->speed_hz)
147                 speed = t->speed_hz;
148
149         if ((t != NULL) && t->bits_per_word)
150                 bits_per_word = t->bits_per_word;
151
152         rc = orion_spi_baudrate_set(spi, speed);
153         if (rc)
154                 return rc;
155
156         return orion_spi_set_transfer_size(orion_spi, bits_per_word);
157 }
158
159 static void orion_spi_set_cs(struct orion_spi *orion_spi, int enable)
160 {
161         if (enable)
162                 orion_spi_setbits(orion_spi, ORION_SPI_IF_CTRL_REG, 0x1);
163         else
164                 orion_spi_clrbits(orion_spi, ORION_SPI_IF_CTRL_REG, 0x1);
165 }
166
167 static inline int orion_spi_wait_till_ready(struct orion_spi *orion_spi)
168 {
169         int i;
170
171         for (i = 0; i < ORION_SPI_WAIT_RDY_MAX_LOOP; i++) {
172                 if (readl(spi_reg(orion_spi, ORION_SPI_INT_CAUSE_REG)))
173                         return 1;
174                 else
175                         udelay(1);
176         }
177
178         return -1;
179 }
180
181 static inline int
182 orion_spi_write_read_8bit(struct spi_device *spi,
183                           const u8 **tx_buf, u8 **rx_buf)
184 {
185         void __iomem *tx_reg, *rx_reg, *int_reg;
186         struct orion_spi *orion_spi;
187
188         orion_spi = spi_master_get_devdata(spi->master);
189         tx_reg = spi_reg(orion_spi, ORION_SPI_DATA_OUT_REG);
190         rx_reg = spi_reg(orion_spi, ORION_SPI_DATA_IN_REG);
191         int_reg = spi_reg(orion_spi, ORION_SPI_INT_CAUSE_REG);
192
193         /* clear the interrupt cause register */
194         writel(0x0, int_reg);
195
196         if (tx_buf && *tx_buf)
197                 writel(*(*tx_buf)++, tx_reg);
198         else
199                 writel(0, tx_reg);
200
201         if (orion_spi_wait_till_ready(orion_spi) < 0) {
202                 dev_err(&spi->dev, "TXS timed out\n");
203                 return -1;
204         }
205
206         if (rx_buf && *rx_buf)
207                 *(*rx_buf)++ = readl(rx_reg);
208
209         return 1;
210 }
211
212 static inline int
213 orion_spi_write_read_16bit(struct spi_device *spi,
214                            const u16 **tx_buf, u16 **rx_buf)
215 {
216         void __iomem *tx_reg, *rx_reg, *int_reg;
217         struct orion_spi *orion_spi;
218
219         orion_spi = spi_master_get_devdata(spi->master);
220         tx_reg = spi_reg(orion_spi, ORION_SPI_DATA_OUT_REG);
221         rx_reg = spi_reg(orion_spi, ORION_SPI_DATA_IN_REG);
222         int_reg = spi_reg(orion_spi, ORION_SPI_INT_CAUSE_REG);
223
224         /* clear the interrupt cause register */
225         writel(0x0, int_reg);
226
227         if (tx_buf && *tx_buf)
228                 writel(__cpu_to_le16(get_unaligned((*tx_buf)++)), tx_reg);
229         else
230                 writel(0, tx_reg);
231
232         if (orion_spi_wait_till_ready(orion_spi) < 0) {
233                 dev_err(&spi->dev, "TXS timed out\n");
234                 return -1;
235         }
236
237         if (rx_buf && *rx_buf)
238                 put_unaligned(__le16_to_cpu(readl(rx_reg)), (*rx_buf)++);
239
240         return 1;
241 }
242
243 static unsigned int
244 orion_spi_write_read(struct spi_device *spi, struct spi_transfer *xfer)
245 {
246         struct orion_spi *orion_spi;
247         unsigned int count;
248         int word_len;
249
250         orion_spi = spi_master_get_devdata(spi->master);
251         word_len = spi->bits_per_word;
252         count = xfer->len;
253
254         if (word_len == 8) {
255                 const u8 *tx = xfer->tx_buf;
256                 u8 *rx = xfer->rx_buf;
257
258                 do {
259                         if (orion_spi_write_read_8bit(spi, &tx, &rx) < 0)
260                                 goto out;
261                         count--;
262                 } while (count);
263         } else if (word_len == 16) {
264                 const u16 *tx = xfer->tx_buf;
265                 u16 *rx = xfer->rx_buf;
266
267                 do {
268                         if (orion_spi_write_read_16bit(spi, &tx, &rx) < 0)
269                                 goto out;
270                         count -= 2;
271                 } while (count);
272         }
273
274 out:
275         return xfer->len - count;
276 }
277
278
279 static void orion_spi_work(struct work_struct *work)
280 {
281         struct orion_spi *orion_spi =
282                 container_of(work, struct orion_spi, work);
283
284         spin_lock_irq(&orion_spi->lock);
285         while (!list_empty(&orion_spi->msg_queue)) {
286                 struct spi_message *m;
287                 struct spi_device *spi;
288                 struct spi_transfer *t = NULL;
289                 int par_override = 0;
290                 int status = 0;
291                 int cs_active = 0;
292
293                 m = container_of(orion_spi->msg_queue.next, struct spi_message,
294                                  queue);
295
296                 list_del_init(&m->queue);
297                 spin_unlock_irq(&orion_spi->lock);
298
299                 spi = m->spi;
300
301                 /* Load defaults */
302                 status = orion_spi_setup_transfer(spi, NULL);
303
304                 if (status < 0)
305                         goto msg_done;
306
307                 list_for_each_entry(t, &m->transfers, transfer_list) {
308                         if (par_override || t->speed_hz || t->bits_per_word) {
309                                 par_override = 1;
310                                 status = orion_spi_setup_transfer(spi, t);
311                                 if (status < 0)
312                                         break;
313                                 if (!t->speed_hz && !t->bits_per_word)
314                                         par_override = 0;
315                         }
316
317                         if (!cs_active) {
318                                 orion_spi_set_cs(orion_spi, 1);
319                                 cs_active = 1;
320                         }
321
322                         if (t->len)
323                                 m->actual_length +=
324                                         orion_spi_write_read(spi, t);
325
326                         if (t->delay_usecs)
327                                 udelay(t->delay_usecs);
328
329                         if (t->cs_change) {
330                                 orion_spi_set_cs(orion_spi, 0);
331                                 cs_active = 0;
332                         }
333                 }
334
335 msg_done:
336                 if (cs_active)
337                         orion_spi_set_cs(orion_spi, 0);
338
339                 m->status = status;
340                 m->complete(m->context);
341
342                 spin_lock_irq(&orion_spi->lock);
343         }
344
345         spin_unlock_irq(&orion_spi->lock);
346 }
347
348 static int __init orion_spi_reset(struct orion_spi *orion_spi)
349 {
350         /* Verify that the CS is deasserted */
351         orion_spi_set_cs(orion_spi, 0);
352
353         return 0;
354 }
355
356 static int orion_spi_setup(struct spi_device *spi)
357 {
358         struct orion_spi *orion_spi;
359
360         orion_spi = spi_master_get_devdata(spi->master);
361
362         if ((spi->max_speed_hz == 0)
363                         || (spi->max_speed_hz > orion_spi->max_speed))
364                 spi->max_speed_hz = orion_spi->max_speed;
365
366         if (spi->max_speed_hz < orion_spi->min_speed) {
367                 dev_err(&spi->dev, "setup: requested speed too low %d Hz\n",
368                         spi->max_speed_hz);
369                 return -EINVAL;
370         }
371
372         /*
373          * baudrate & width will be set orion_spi_setup_transfer
374          */
375         return 0;
376 }
377
378 static int orion_spi_transfer(struct spi_device *spi, struct spi_message *m)
379 {
380         struct orion_spi *orion_spi;
381         struct spi_transfer *t = NULL;
382         unsigned long flags;
383
384         m->actual_length = 0;
385         m->status = 0;
386
387         /* reject invalid messages and transfers */
388         if (list_empty(&m->transfers) || !m->complete)
389                 return -EINVAL;
390
391         orion_spi = spi_master_get_devdata(spi->master);
392
393         list_for_each_entry(t, &m->transfers, transfer_list) {
394                 unsigned int bits_per_word = spi->bits_per_word;
395
396                 if (t->tx_buf == NULL && t->rx_buf == NULL && t->len) {
397                         dev_err(&spi->dev,
398                                 "message rejected : "
399                                 "invalid transfer data buffers\n");
400                         goto msg_rejected;
401                 }
402
403                 if (t->bits_per_word)
404                         bits_per_word = t->bits_per_word;
405
406                 if ((bits_per_word != 8) && (bits_per_word != 16)) {
407                         dev_err(&spi->dev,
408                                 "message rejected : "
409                                 "invalid transfer bits_per_word (%d bits)\n",
410                                 bits_per_word);
411                         goto msg_rejected;
412                 }
413                 /*make sure buffer length is even when working in 16 bit mode*/
414                 if ((t->bits_per_word == 16) && (t->len & 1)) {
415                         dev_err(&spi->dev,
416                                 "message rejected : "
417                                 "odd data length (%d) while in 16 bit mode\n",
418                                 t->len);
419                         goto msg_rejected;
420                 }
421
422                 if (t->speed_hz && t->speed_hz < orion_spi->min_speed) {
423                         dev_err(&spi->dev,
424                                 "message rejected : "
425                                 "device min speed (%d Hz) exceeds "
426                                 "required transfer speed (%d Hz)\n",
427                                 orion_spi->min_speed, t->speed_hz);
428                         goto msg_rejected;
429                 }
430         }
431
432
433         spin_lock_irqsave(&orion_spi->lock, flags);
434         list_add_tail(&m->queue, &orion_spi->msg_queue);
435         queue_work(orion_spi_wq, &orion_spi->work);
436         spin_unlock_irqrestore(&orion_spi->lock, flags);
437
438         return 0;
439 msg_rejected:
440         /* Message rejected and not queued */
441         m->status = -EINVAL;
442         if (m->complete)
443                 m->complete(m->context);
444         return -EINVAL;
445 }
446
447 static int __init orion_spi_probe(struct platform_device *pdev)
448 {
449         struct spi_master *master;
450         struct orion_spi *spi;
451         struct resource *r;
452         struct orion_spi_info *spi_info;
453         int status = 0;
454
455         spi_info = pdev->dev.platform_data;
456
457         master = spi_alloc_master(&pdev->dev, sizeof *spi);
458         if (master == NULL) {
459                 dev_dbg(&pdev->dev, "master allocation failed\n");
460                 return -ENOMEM;
461         }
462
463         if (pdev->id != -1)
464                 master->bus_num = pdev->id;
465
466         /* we support only mode 0, and no options */
467         master->mode_bits = 0;
468
469         master->setup = orion_spi_setup;
470         master->transfer = orion_spi_transfer;
471         master->num_chipselect = ORION_NUM_CHIPSELECTS;
472
473         dev_set_drvdata(&pdev->dev, master);
474
475         spi = spi_master_get_devdata(master);
476         spi->master = master;
477         spi->spi_info = spi_info;
478
479         spi->max_speed = DIV_ROUND_UP(spi_info->tclk, 4);
480         spi->min_speed = DIV_ROUND_UP(spi_info->tclk, 30);
481
482         r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
483         if (r == NULL) {
484                 status = -ENODEV;
485                 goto out;
486         }
487
488         if (!request_mem_region(r->start, resource_size(r),
489                                 dev_name(&pdev->dev))) {
490                 status = -EBUSY;
491                 goto out;
492         }
493         spi->base = ioremap(r->start, SZ_1K);
494
495         INIT_WORK(&spi->work, orion_spi_work);
496
497         spin_lock_init(&spi->lock);
498         INIT_LIST_HEAD(&spi->msg_queue);
499
500         if (orion_spi_reset(spi) < 0)
501                 goto out_rel_mem;
502
503         status = spi_register_master(master);
504         if (status < 0)
505                 goto out_rel_mem;
506
507         return status;
508
509 out_rel_mem:
510         release_mem_region(r->start, resource_size(r));
511
512 out:
513         spi_master_put(master);
514         return status;
515 }
516
517
518 static int __exit orion_spi_remove(struct platform_device *pdev)
519 {
520         struct spi_master *master;
521         struct orion_spi *spi;
522         struct resource *r;
523
524         master = dev_get_drvdata(&pdev->dev);
525         spi = spi_master_get_devdata(master);
526
527         cancel_work_sync(&spi->work);
528
529         r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
530         release_mem_region(r->start, resource_size(r));
531
532         spi_unregister_master(master);
533
534         return 0;
535 }
536
537 MODULE_ALIAS("platform:" DRIVER_NAME);
538
539 static struct platform_driver orion_spi_driver = {
540         .driver = {
541                 .name   = DRIVER_NAME,
542                 .owner  = THIS_MODULE,
543         },
544         .remove         = __exit_p(orion_spi_remove),
545 };
546
547 static int __init orion_spi_init(void)
548 {
549         orion_spi_wq = create_singlethread_workqueue(
550                                 orion_spi_driver.driver.name);
551         if (orion_spi_wq == NULL)
552                 return -ENOMEM;
553
554         return platform_driver_probe(&orion_spi_driver, orion_spi_probe);
555 }
556 module_init(orion_spi_init);
557
558 static void __exit orion_spi_exit(void)
559 {
560         flush_workqueue(orion_spi_wq);
561         platform_driver_unregister(&orion_spi_driver);
562
563         destroy_workqueue(orion_spi_wq);
564 }
565 module_exit(orion_spi_exit);
566
567 MODULE_DESCRIPTION("Orion SPI driver");
568 MODULE_AUTHOR("Shadi Ammouri <shadi@marvell.com>");
569 MODULE_LICENSE("GPL");