mic: vop: Fix use-after-free on remove
[linux/fpc-iii.git] / drivers / scsi / am53c974.c
blob27c0a4a937d9c7060974dd9fb48f9aaa2cc9e0e6
1 /*
2 * AMD am53c974 driver.
3 * Copyright (c) 2014 Hannes Reinecke, SUSE Linux GmbH
4 */
6 #include <linux/kernel.h>
7 #include <linux/module.h>
8 #include <linux/init.h>
9 #include <linux/delay.h>
10 #include <linux/pci.h>
11 #include <linux/interrupt.h>
13 #include <scsi/scsi_host.h>
15 #include "esp_scsi.h"
17 #define DRV_MODULE_NAME "am53c974"
18 #define DRV_MODULE_VERSION "1.00"
20 static bool am53c974_debug;
21 static bool am53c974_fenab = true;
23 #define esp_dma_log(f, a...) \
24 do { \
25 if (am53c974_debug) \
26 shost_printk(KERN_DEBUG, esp->host, f, ##a); \
27 } while (0)
29 #define ESP_DMA_CMD 0x10
30 #define ESP_DMA_STC 0x11
31 #define ESP_DMA_SPA 0x12
32 #define ESP_DMA_WBC 0x13
33 #define ESP_DMA_WAC 0x14
34 #define ESP_DMA_STATUS 0x15
35 #define ESP_DMA_SMDLA 0x16
36 #define ESP_DMA_WMAC 0x17
38 #define ESP_DMA_CMD_IDLE 0x00
39 #define ESP_DMA_CMD_BLAST 0x01
40 #define ESP_DMA_CMD_ABORT 0x02
41 #define ESP_DMA_CMD_START 0x03
42 #define ESP_DMA_CMD_MASK 0x03
43 #define ESP_DMA_CMD_DIAG 0x04
44 #define ESP_DMA_CMD_MDL 0x10
45 #define ESP_DMA_CMD_INTE_P 0x20
46 #define ESP_DMA_CMD_INTE_D 0x40
47 #define ESP_DMA_CMD_DIR 0x80
49 #define ESP_DMA_STAT_PWDN 0x01
50 #define ESP_DMA_STAT_ERROR 0x02
51 #define ESP_DMA_STAT_ABORT 0x04
52 #define ESP_DMA_STAT_DONE 0x08
53 #define ESP_DMA_STAT_SCSIINT 0x10
54 #define ESP_DMA_STAT_BCMPLT 0x20
56 /* EEPROM is accessed with 16-bit values */
57 #define DC390_EEPROM_READ 0x80
58 #define DC390_EEPROM_LEN 0x40
61 * DC390 EEPROM
63 * 8 * 4 bytes of per-device options
64 * followed by HBA specific options
67 /* Per-device options */
68 #define DC390_EE_MODE1 0x00
69 #define DC390_EE_SPEED 0x01
71 /* HBA-specific options */
72 #define DC390_EE_ADAPT_SCSI_ID 0x40
73 #define DC390_EE_MODE2 0x41
74 #define DC390_EE_DELAY 0x42
75 #define DC390_EE_TAG_CMD_NUM 0x43
77 #define DC390_EE_MODE1_PARITY_CHK 0x01
78 #define DC390_EE_MODE1_SYNC_NEGO 0x02
79 #define DC390_EE_MODE1_EN_DISC 0x04
80 #define DC390_EE_MODE1_SEND_START 0x08
81 #define DC390_EE_MODE1_TCQ 0x10
83 #define DC390_EE_MODE2_MORE_2DRV 0x01
84 #define DC390_EE_MODE2_GREATER_1G 0x02
85 #define DC390_EE_MODE2_RST_SCSI_BUS 0x04
86 #define DC390_EE_MODE2_ACTIVE_NEGATION 0x08
87 #define DC390_EE_MODE2_NO_SEEK 0x10
88 #define DC390_EE_MODE2_LUN_CHECK 0x20
90 struct pci_esp_priv {
91 struct esp *esp;
92 u8 dma_status;
95 static void pci_esp_dma_drain(struct esp *esp);
97 static inline struct pci_esp_priv *pci_esp_get_priv(struct esp *esp)
99 return dev_get_drvdata(esp->dev);
102 static void pci_esp_write8(struct esp *esp, u8 val, unsigned long reg)
104 iowrite8(val, esp->regs + (reg * 4UL));
107 static u8 pci_esp_read8(struct esp *esp, unsigned long reg)
109 return ioread8(esp->regs + (reg * 4UL));
112 static void pci_esp_write32(struct esp *esp, u32 val, unsigned long reg)
114 return iowrite32(val, esp->regs + (reg * 4UL));
117 static int pci_esp_irq_pending(struct esp *esp)
119 struct pci_esp_priv *pep = pci_esp_get_priv(esp);
121 pep->dma_status = pci_esp_read8(esp, ESP_DMA_STATUS);
122 esp_dma_log("dma intr dreg[%02x]\n", pep->dma_status);
124 if (pep->dma_status & (ESP_DMA_STAT_ERROR |
125 ESP_DMA_STAT_ABORT |
126 ESP_DMA_STAT_DONE |
127 ESP_DMA_STAT_SCSIINT))
128 return 1;
130 return 0;
133 static void pci_esp_reset_dma(struct esp *esp)
135 /* Nothing to do ? */
138 static void pci_esp_dma_drain(struct esp *esp)
140 u8 resid;
141 int lim = 1000;
144 if ((esp->sreg & ESP_STAT_PMASK) == ESP_DOP ||
145 (esp->sreg & ESP_STAT_PMASK) == ESP_DIP)
146 /* Data-In or Data-Out, nothing to be done */
147 return;
149 while (--lim > 0) {
150 resid = pci_esp_read8(esp, ESP_FFLAGS) & ESP_FF_FBYTES;
151 if (resid <= 1)
152 break;
153 cpu_relax();
157 * When there is a residual BCMPLT will never be set
158 * (obviously). But we still have to issue the BLAST
159 * command, otherwise the data will not being transferred.
160 * But we'll never know when the BLAST operation is
161 * finished. So check for some time and give up eventually.
163 lim = 1000;
164 pci_esp_write8(esp, ESP_DMA_CMD_DIR | ESP_DMA_CMD_BLAST, ESP_DMA_CMD);
165 while (pci_esp_read8(esp, ESP_DMA_STATUS) & ESP_DMA_STAT_BCMPLT) {
166 if (--lim == 0)
167 break;
168 cpu_relax();
170 pci_esp_write8(esp, ESP_DMA_CMD_DIR | ESP_DMA_CMD_IDLE, ESP_DMA_CMD);
171 esp_dma_log("DMA blast done (%d tries, %d bytes left)\n", lim, resid);
172 /* BLAST residual handling is currently untested */
173 if (WARN_ON_ONCE(resid == 1)) {
174 struct esp_cmd_entry *ent = esp->active_cmd;
176 ent->flags |= ESP_CMD_FLAG_RESIDUAL;
180 static void pci_esp_dma_invalidate(struct esp *esp)
182 struct pci_esp_priv *pep = pci_esp_get_priv(esp);
184 esp_dma_log("invalidate DMA\n");
186 pci_esp_write8(esp, ESP_DMA_CMD_IDLE, ESP_DMA_CMD);
187 pep->dma_status = 0;
190 static int pci_esp_dma_error(struct esp *esp)
192 struct pci_esp_priv *pep = pci_esp_get_priv(esp);
194 if (pep->dma_status & ESP_DMA_STAT_ERROR) {
195 u8 dma_cmd = pci_esp_read8(esp, ESP_DMA_CMD);
197 if ((dma_cmd & ESP_DMA_CMD_MASK) == ESP_DMA_CMD_START)
198 pci_esp_write8(esp, ESP_DMA_CMD_ABORT, ESP_DMA_CMD);
200 return 1;
202 if (pep->dma_status & ESP_DMA_STAT_ABORT) {
203 pci_esp_write8(esp, ESP_DMA_CMD_IDLE, ESP_DMA_CMD);
204 pep->dma_status = pci_esp_read8(esp, ESP_DMA_CMD);
205 return 1;
207 return 0;
210 static void pci_esp_send_dma_cmd(struct esp *esp, u32 addr, u32 esp_count,
211 u32 dma_count, int write, u8 cmd)
213 struct pci_esp_priv *pep = pci_esp_get_priv(esp);
214 u32 val = 0;
216 BUG_ON(!(cmd & ESP_CMD_DMA));
218 pep->dma_status = 0;
220 /* Set DMA engine to IDLE */
221 if (write)
222 /* DMA write direction logic is inverted */
223 val |= ESP_DMA_CMD_DIR;
224 pci_esp_write8(esp, ESP_DMA_CMD_IDLE | val, ESP_DMA_CMD);
226 pci_esp_write8(esp, (esp_count >> 0) & 0xff, ESP_TCLOW);
227 pci_esp_write8(esp, (esp_count >> 8) & 0xff, ESP_TCMED);
228 if (esp->config2 & ESP_CONFIG2_FENAB)
229 pci_esp_write8(esp, (esp_count >> 16) & 0xff, ESP_TCHI);
231 pci_esp_write32(esp, esp_count, ESP_DMA_STC);
232 pci_esp_write32(esp, addr, ESP_DMA_SPA);
234 esp_dma_log("start dma addr[%x] count[%d:%d]\n",
235 addr, esp_count, dma_count);
237 scsi_esp_cmd(esp, cmd);
238 /* Send DMA Start command */
239 pci_esp_write8(esp, ESP_DMA_CMD_START | val, ESP_DMA_CMD);
242 static u32 pci_esp_dma_length_limit(struct esp *esp, u32 dma_addr, u32 dma_len)
244 int dma_limit = 16;
245 u32 base, end;
248 * If CONFIG2_FENAB is set we can
249 * handle up to 24 bit addresses
251 if (esp->config2 & ESP_CONFIG2_FENAB)
252 dma_limit = 24;
254 if (dma_len > (1U << dma_limit))
255 dma_len = (1U << dma_limit);
258 * Prevent crossing a 24-bit address boundary.
260 base = dma_addr & ((1U << 24) - 1U);
261 end = base + dma_len;
262 if (end > (1U << 24))
263 end = (1U <<24);
264 dma_len = end - base;
266 return dma_len;
269 static const struct esp_driver_ops pci_esp_ops = {
270 .esp_write8 = pci_esp_write8,
271 .esp_read8 = pci_esp_read8,
272 .irq_pending = pci_esp_irq_pending,
273 .reset_dma = pci_esp_reset_dma,
274 .dma_drain = pci_esp_dma_drain,
275 .dma_invalidate = pci_esp_dma_invalidate,
276 .send_dma_cmd = pci_esp_send_dma_cmd,
277 .dma_error = pci_esp_dma_error,
278 .dma_length_limit = pci_esp_dma_length_limit,
282 * Read DC-390 eeprom
284 static void dc390_eeprom_prepare_read(struct pci_dev *pdev, u8 cmd)
286 u8 carry_flag = 1, j = 0x80, bval;
287 int i;
289 for (i = 0; i < 9; i++) {
290 if (carry_flag) {
291 pci_write_config_byte(pdev, 0x80, 0x40);
292 bval = 0xc0;
293 } else
294 bval = 0x80;
296 udelay(160);
297 pci_write_config_byte(pdev, 0x80, bval);
298 udelay(160);
299 pci_write_config_byte(pdev, 0x80, 0);
300 udelay(160);
302 carry_flag = (cmd & j) ? 1 : 0;
303 j >>= 1;
307 static u16 dc390_eeprom_get_data(struct pci_dev *pdev)
309 int i;
310 u16 wval = 0;
311 u8 bval;
313 for (i = 0; i < 16; i++) {
314 wval <<= 1;
316 pci_write_config_byte(pdev, 0x80, 0x80);
317 udelay(160);
318 pci_write_config_byte(pdev, 0x80, 0x40);
319 udelay(160);
320 pci_read_config_byte(pdev, 0x00, &bval);
322 if (bval == 0x22)
323 wval |= 1;
326 return wval;
329 static void dc390_read_eeprom(struct pci_dev *pdev, u16 *ptr)
331 u8 cmd = DC390_EEPROM_READ, i;
333 for (i = 0; i < DC390_EEPROM_LEN; i++) {
334 pci_write_config_byte(pdev, 0xc0, 0);
335 udelay(160);
337 dc390_eeprom_prepare_read(pdev, cmd++);
338 *ptr++ = dc390_eeprom_get_data(pdev);
340 pci_write_config_byte(pdev, 0x80, 0);
341 pci_write_config_byte(pdev, 0x80, 0);
342 udelay(160);
346 static void dc390_check_eeprom(struct esp *esp)
348 struct pci_dev *pdev = to_pci_dev(esp->dev);
349 u8 EEbuf[128];
350 u16 *ptr = (u16 *)EEbuf, wval = 0;
351 int i;
353 dc390_read_eeprom(pdev, ptr);
355 for (i = 0; i < DC390_EEPROM_LEN; i++, ptr++)
356 wval += *ptr;
358 /* no Tekram EEprom found */
359 if (wval != 0x1234) {
360 dev_printk(KERN_INFO, &pdev->dev,
361 "No valid Tekram EEprom found\n");
362 return;
364 esp->scsi_id = EEbuf[DC390_EE_ADAPT_SCSI_ID];
365 esp->num_tags = 2 << EEbuf[DC390_EE_TAG_CMD_NUM];
366 if (EEbuf[DC390_EE_MODE2] & DC390_EE_MODE2_ACTIVE_NEGATION)
367 esp->config4 |= ESP_CONFIG4_RADE | ESP_CONFIG4_RAE;
370 static int pci_esp_probe_one(struct pci_dev *pdev,
371 const struct pci_device_id *id)
373 struct scsi_host_template *hostt = &scsi_esp_template;
374 int err = -ENODEV;
375 struct Scsi_Host *shost;
376 struct esp *esp;
377 struct pci_esp_priv *pep;
379 if (pci_enable_device(pdev)) {
380 dev_printk(KERN_INFO, &pdev->dev, "cannot enable device\n");
381 return -ENODEV;
384 if (dma_set_mask(&pdev->dev, DMA_BIT_MASK(32))) {
385 dev_printk(KERN_INFO, &pdev->dev,
386 "failed to set 32bit DMA mask\n");
387 goto fail_disable_device;
390 shost = scsi_host_alloc(hostt, sizeof(struct esp));
391 if (!shost) {
392 dev_printk(KERN_INFO, &pdev->dev,
393 "failed to allocate scsi host\n");
394 err = -ENOMEM;
395 goto fail_disable_device;
398 pep = kzalloc(sizeof(struct pci_esp_priv), GFP_KERNEL);
399 if (!pep) {
400 dev_printk(KERN_INFO, &pdev->dev,
401 "failed to allocate esp_priv\n");
402 err = -ENOMEM;
403 goto fail_host_alloc;
406 esp = shost_priv(shost);
407 esp->host = shost;
408 esp->dev = &pdev->dev;
409 esp->ops = &pci_esp_ops;
411 * The am53c974 HBA has a design flaw of generating
412 * spurious DMA completion interrupts when using
413 * DMA for command submission.
415 esp->flags |= ESP_FLAG_USE_FIFO;
417 * Enable CONFIG2_FENAB to allow for large DMA transfers
419 if (am53c974_fenab)
420 esp->config2 |= ESP_CONFIG2_FENAB;
422 pep->esp = esp;
424 if (pci_request_regions(pdev, DRV_MODULE_NAME)) {
425 dev_printk(KERN_ERR, &pdev->dev,
426 "pci memory selection failed\n");
427 goto fail_priv_alloc;
430 esp->regs = pci_iomap(pdev, 0, pci_resource_len(pdev, 0));
431 if (!esp->regs) {
432 dev_printk(KERN_ERR, &pdev->dev, "pci I/O map failed\n");
433 err = -EINVAL;
434 goto fail_release_regions;
436 esp->dma_regs = esp->regs;
438 pci_set_master(pdev);
440 esp->command_block = dma_alloc_coherent(&pdev->dev, 16,
441 &esp->command_block_dma, GFP_KERNEL);
442 if (!esp->command_block) {
443 dev_printk(KERN_ERR, &pdev->dev,
444 "failed to allocate command block\n");
445 err = -ENOMEM;
446 goto fail_unmap_regs;
449 pci_set_drvdata(pdev, pep);
451 err = request_irq(pdev->irq, scsi_esp_intr, IRQF_SHARED,
452 DRV_MODULE_NAME, esp);
453 if (err < 0) {
454 dev_printk(KERN_ERR, &pdev->dev, "failed to register IRQ\n");
455 goto fail_unmap_command_block;
458 esp->scsi_id = 7;
459 dc390_check_eeprom(esp);
461 shost->this_id = esp->scsi_id;
462 shost->max_id = 8;
463 shost->irq = pdev->irq;
464 shost->io_port = pci_resource_start(pdev, 0);
465 shost->n_io_port = pci_resource_len(pdev, 0);
466 shost->unique_id = shost->io_port;
467 esp->scsi_id_mask = (1 << esp->scsi_id);
468 /* Assume 40MHz clock */
469 esp->cfreq = 40000000;
471 err = scsi_esp_register(esp);
472 if (err)
473 goto fail_free_irq;
475 return 0;
477 fail_free_irq:
478 free_irq(pdev->irq, esp);
479 fail_unmap_command_block:
480 pci_set_drvdata(pdev, NULL);
481 dma_free_coherent(&pdev->dev, 16, esp->command_block,
482 esp->command_block_dma);
483 fail_unmap_regs:
484 pci_iounmap(pdev, esp->regs);
485 fail_release_regions:
486 pci_release_regions(pdev);
487 fail_priv_alloc:
488 kfree(pep);
489 fail_host_alloc:
490 scsi_host_put(shost);
491 fail_disable_device:
492 pci_disable_device(pdev);
494 return err;
497 static void pci_esp_remove_one(struct pci_dev *pdev)
499 struct pci_esp_priv *pep = pci_get_drvdata(pdev);
500 struct esp *esp = pep->esp;
502 scsi_esp_unregister(esp);
503 free_irq(pdev->irq, esp);
504 pci_set_drvdata(pdev, NULL);
505 dma_free_coherent(&pdev->dev, 16, esp->command_block,
506 esp->command_block_dma);
507 pci_iounmap(pdev, esp->regs);
508 pci_release_regions(pdev);
509 pci_disable_device(pdev);
510 kfree(pep);
512 scsi_host_put(esp->host);
515 static struct pci_device_id am53c974_pci_tbl[] = {
516 { PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_SCSI,
517 PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
520 MODULE_DEVICE_TABLE(pci, am53c974_pci_tbl);
522 static struct pci_driver am53c974_driver = {
523 .name = DRV_MODULE_NAME,
524 .id_table = am53c974_pci_tbl,
525 .probe = pci_esp_probe_one,
526 .remove = pci_esp_remove_one,
529 module_pci_driver(am53c974_driver);
531 MODULE_DESCRIPTION("AM53C974 SCSI driver");
532 MODULE_AUTHOR("Hannes Reinecke <hare@suse.de>");
533 MODULE_LICENSE("GPL");
534 MODULE_VERSION(DRV_MODULE_VERSION);
535 MODULE_ALIAS("tmscsim");
537 module_param(am53c974_debug, bool, 0644);
538 MODULE_PARM_DESC(am53c974_debug, "Enable debugging");
540 module_param(am53c974_fenab, bool, 0444);
541 MODULE_PARM_DESC(am53c974_fenab, "Enable 24-bit DMA transfer sizes");