mic: vop: Fix use-after-free on remove
[linux/fpc-iii.git] / drivers / scsi / a3000.c
blobdcf435f312dd54df039b3dd5af5884173e317160
1 #include <linux/types.h>
2 #include <linux/mm.h>
3 #include <linux/ioport.h>
4 #include <linux/init.h>
5 #include <linux/slab.h>
6 #include <linux/spinlock.h>
7 #include <linux/interrupt.h>
8 #include <linux/platform_device.h>
9 #include <linux/module.h>
11 #include <asm/page.h>
12 #include <asm/pgtable.h>
13 #include <asm/amigaints.h>
14 #include <asm/amigahw.h>
16 #include "scsi.h"
17 #include "wd33c93.h"
18 #include "a3000.h"
21 struct a3000_hostdata {
22 struct WD33C93_hostdata wh;
23 struct a3000_scsiregs *regs;
26 static irqreturn_t a3000_intr(int irq, void *data)
28 struct Scsi_Host *instance = data;
29 struct a3000_hostdata *hdata = shost_priv(instance);
30 unsigned int status = hdata->regs->ISTR;
31 unsigned long flags;
33 if (!(status & ISTR_INT_P))
34 return IRQ_NONE;
35 if (status & ISTR_INTS) {
36 spin_lock_irqsave(instance->host_lock, flags);
37 wd33c93_intr(instance);
38 spin_unlock_irqrestore(instance->host_lock, flags);
39 return IRQ_HANDLED;
41 pr_warning("Non-serviced A3000 SCSI-interrupt? ISTR = %02x\n", status);
42 return IRQ_NONE;
45 static int dma_setup(struct scsi_cmnd *cmd, int dir_in)
47 struct Scsi_Host *instance = cmd->device->host;
48 struct a3000_hostdata *hdata = shost_priv(instance);
49 struct WD33C93_hostdata *wh = &hdata->wh;
50 struct a3000_scsiregs *regs = hdata->regs;
51 unsigned short cntr = CNTR_PDMD | CNTR_INTEN;
52 unsigned long addr = virt_to_bus(cmd->SCp.ptr);
55 * if the physical address has the wrong alignment, or if
56 * physical address is bad, or if it is a write and at the
57 * end of a physical memory chunk, then allocate a bounce
58 * buffer
60 if (addr & A3000_XFER_MASK) {
61 wh->dma_bounce_len = (cmd->SCp.this_residual + 511) & ~0x1ff;
62 wh->dma_bounce_buffer = kmalloc(wh->dma_bounce_len,
63 GFP_KERNEL);
65 /* can't allocate memory; use PIO */
66 if (!wh->dma_bounce_buffer) {
67 wh->dma_bounce_len = 0;
68 return 1;
71 if (!dir_in) {
72 /* copy to bounce buffer for a write */
73 memcpy(wh->dma_bounce_buffer, cmd->SCp.ptr,
74 cmd->SCp.this_residual);
77 addr = virt_to_bus(wh->dma_bounce_buffer);
80 /* setup dma direction */
81 if (!dir_in)
82 cntr |= CNTR_DDIR;
84 /* remember direction */
85 wh->dma_dir = dir_in;
87 regs->CNTR = cntr;
89 /* setup DMA *physical* address */
90 regs->ACR = addr;
92 if (dir_in) {
93 /* invalidate any cache */
94 cache_clear(addr, cmd->SCp.this_residual);
95 } else {
96 /* push any dirty cache */
97 cache_push(addr, cmd->SCp.this_residual);
100 /* start DMA */
101 mb(); /* make sure setup is completed */
102 regs->ST_DMA = 1;
103 mb(); /* make sure DMA has started before next IO */
105 /* return success */
106 return 0;
109 static void dma_stop(struct Scsi_Host *instance, struct scsi_cmnd *SCpnt,
110 int status)
112 struct a3000_hostdata *hdata = shost_priv(instance);
113 struct WD33C93_hostdata *wh = &hdata->wh;
114 struct a3000_scsiregs *regs = hdata->regs;
116 /* disable SCSI interrupts */
117 unsigned short cntr = CNTR_PDMD;
119 if (!wh->dma_dir)
120 cntr |= CNTR_DDIR;
122 regs->CNTR = cntr;
123 mb(); /* make sure CNTR is updated before next IO */
125 /* flush if we were reading */
126 if (wh->dma_dir) {
127 regs->FLUSH = 1;
128 mb(); /* don't allow prefetch */
129 while (!(regs->ISTR & ISTR_FE_FLG))
130 barrier();
131 mb(); /* no IO until FLUSH is done */
134 /* clear a possible interrupt */
135 /* I think that this CINT is only necessary if you are
136 * using the terminal count features. HM 7 Mar 1994
138 regs->CINT = 1;
140 /* stop DMA */
141 regs->SP_DMA = 1;
142 mb(); /* make sure DMA is stopped before next IO */
144 /* restore the CONTROL bits (minus the direction flag) */
145 regs->CNTR = CNTR_PDMD | CNTR_INTEN;
146 mb(); /* make sure CNTR is updated before next IO */
148 /* copy from a bounce buffer, if necessary */
149 if (status && wh->dma_bounce_buffer) {
150 if (SCpnt) {
151 if (wh->dma_dir && SCpnt)
152 memcpy(SCpnt->SCp.ptr, wh->dma_bounce_buffer,
153 SCpnt->SCp.this_residual);
154 kfree(wh->dma_bounce_buffer);
155 wh->dma_bounce_buffer = NULL;
156 wh->dma_bounce_len = 0;
157 } else {
158 kfree(wh->dma_bounce_buffer);
159 wh->dma_bounce_buffer = NULL;
160 wh->dma_bounce_len = 0;
165 static struct scsi_host_template amiga_a3000_scsi_template = {
166 .module = THIS_MODULE,
167 .name = "Amiga 3000 built-in SCSI",
168 .show_info = wd33c93_show_info,
169 .write_info = wd33c93_write_info,
170 .proc_name = "A3000",
171 .queuecommand = wd33c93_queuecommand,
172 .eh_abort_handler = wd33c93_abort,
173 .eh_host_reset_handler = wd33c93_host_reset,
174 .can_queue = CAN_QUEUE,
175 .this_id = 7,
176 .sg_tablesize = SG_ALL,
177 .cmd_per_lun = CMD_PER_LUN,
180 static int __init amiga_a3000_scsi_probe(struct platform_device *pdev)
182 struct resource *res;
183 struct Scsi_Host *instance;
184 int error;
185 struct a3000_scsiregs *regs;
186 wd33c93_regs wdregs;
187 struct a3000_hostdata *hdata;
189 res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
190 if (!res)
191 return -ENODEV;
193 if (!request_mem_region(res->start, resource_size(res), "wd33c93"))
194 return -EBUSY;
196 instance = scsi_host_alloc(&amiga_a3000_scsi_template,
197 sizeof(struct a3000_hostdata));
198 if (!instance) {
199 error = -ENOMEM;
200 goto fail_alloc;
203 instance->irq = IRQ_AMIGA_PORTS;
205 regs = ZTWO_VADDR(res->start);
206 regs->DAWR = DAWR_A3000;
208 wdregs.SASR = &regs->SASR;
209 wdregs.SCMD = &regs->SCMD;
211 hdata = shost_priv(instance);
212 hdata->wh.no_sync = 0xff;
213 hdata->wh.fast = 0;
214 hdata->wh.dma_mode = CTRL_DMA;
215 hdata->regs = regs;
217 wd33c93_init(instance, wdregs, dma_setup, dma_stop, WD33C93_FS_12_15);
218 error = request_irq(IRQ_AMIGA_PORTS, a3000_intr, IRQF_SHARED,
219 "A3000 SCSI", instance);
220 if (error)
221 goto fail_irq;
223 regs->CNTR = CNTR_PDMD | CNTR_INTEN;
225 error = scsi_add_host(instance, NULL);
226 if (error)
227 goto fail_host;
229 platform_set_drvdata(pdev, instance);
231 scsi_scan_host(instance);
232 return 0;
234 fail_host:
235 free_irq(IRQ_AMIGA_PORTS, instance);
236 fail_irq:
237 scsi_host_put(instance);
238 fail_alloc:
239 release_mem_region(res->start, resource_size(res));
240 return error;
243 static int __exit amiga_a3000_scsi_remove(struct platform_device *pdev)
245 struct Scsi_Host *instance = platform_get_drvdata(pdev);
246 struct a3000_hostdata *hdata = shost_priv(instance);
247 struct resource *res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
249 hdata->regs->CNTR = 0;
250 scsi_remove_host(instance);
251 free_irq(IRQ_AMIGA_PORTS, instance);
252 scsi_host_put(instance);
253 release_mem_region(res->start, resource_size(res));
254 return 0;
257 static struct platform_driver amiga_a3000_scsi_driver = {
258 .remove = __exit_p(amiga_a3000_scsi_remove),
259 .driver = {
260 .name = "amiga-a3000-scsi",
264 module_platform_driver_probe(amiga_a3000_scsi_driver, amiga_a3000_scsi_probe);
266 MODULE_DESCRIPTION("Amiga 3000 built-in SCSI");
267 MODULE_LICENSE("GPL");
268 MODULE_ALIAS("platform:amiga-a3000-scsi");