c13c92acfa
commit e47301b06d upstream.
Fix the below Oops when trying to modprobe wlcore_spi.
The oops occurs because the wl1271_power_{off,on}()
function doesn't check the power() function pointer.
[ 23.401447] Unable to handle kernel NULL pointer dereference at
virtual address 00000000
[ 23.409954] pgd = c0004000
[ 23.412922] [00000000] *pgd=00000000
[ 23.416693] Internal error: Oops: 80000007 [#1] SMP ARM
[ 23.422168] Modules linked in: wl12xx wlcore mac80211 cfg80211
musb_dsps musb_hdrc usbcore usb_common snd_soc_simple_card evdev joydev
omap_rng wlcore_spi snd_soc_tlv320aic23_i2c rng_core snd_soc_tlv320aic23
c_can_platform c_can can_dev snd_soc_davinci_mcasp snd_soc_edma
snd_soc_omap omap_wdt musb_am335x cpufreq_dt thermal_sys hwmon
[ 23.453253] CPU: 0 PID: 36 Comm: kworker/0:2 Not tainted
4.2.0-00002-g951efee-dirty #233
[ 23.461720] Hardware name: Generic AM33XX (Flattened Device Tree)
[ 23.468123] Workqueue: events request_firmware_work_func
[ 23.473690] task: de32efc0 ti: de4ee000 task.ti: de4ee000
[ 23.479341] PC is at 0x0
[ 23.482112] LR is at wl12xx_set_power_on+0x28/0x124 [wlcore]
[ 23.488074] pc : [<00000000>] lr : [<bf2581f0>] psr: 60000013
[ 23.488074] sp : de4efe50 ip : 00000002 fp : 00000000
[ 23.500162] r10: de7cdd00 r9 : dc848800 r8 : bf27af00
[ 23.505663] r7 : bf27a1a8 r6 : dcbd8a80 r5 : dce0e2e0 r4 :
dce0d2e0
[ 23.512536] r3 : 00000000 r2 : 00000000 r1 : 00000001 r0 :
dc848810
[ 23.519412] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM
Segment kernel
[ 23.527109] Control: 10c5387d Table: 9cb78019 DAC: 00000015
[ 23.533160] Process kworker/0:2 (pid: 36, stack limit = 0xde4ee218)
[ 23.539760] Stack: (0xde4efe50 to 0xde4f0000)
[...]
[ 23.665030] [<bf2581f0>] (wl12xx_set_power_on [wlcore]) from
[<bf25f7ac>] (wlcore_nvs_cb+0x118/0xa4c [wlcore])
[ 23.675604] [<bf25f7ac>] (wlcore_nvs_cb [wlcore]) from [<c04387ec>]
(request_firmware_work_func+0x30/0x58)
[ 23.685784] [<c04387ec>] (request_firmware_work_func) from
[<c0058e2c>] (process_one_work+0x1b4/0x4b4)
[ 23.695591] [<c0058e2c>] (process_one_work) from [<c0059168>]
(worker_thread+0x3c/0x4a4)
[ 23.704124] [<c0059168>] (worker_thread) from [<c005ee68>]
(kthread+0xd4/0xf0)
[ 23.711747] [<c005ee68>] (kthread) from [<c000f598>]
(ret_from_fork+0x14/0x3c)
[ 23.719357] Code: bad PC value
[ 23.722760] ---[ end trace 981be8510db9b3a9 ]---
Prevent oops by validationg power() pointer value before
calling the function.
Signed-off-by: Uri Mashiach <uri.mashiach@compulab.co.il>
Acked-by: Igor Grinberg <grinberg@compulab.co.il>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
243 lines
6.4 KiB
C
243 lines
6.4 KiB
C
/*
|
|
* This file is part of wl1271
|
|
*
|
|
* Copyright (C) 1998-2009 Texas Instruments. All rights reserved.
|
|
* Copyright (C) 2008-2010 Nokia Corporation
|
|
*
|
|
* Contact: Luciano Coelho <luciano.coelho@nokia.com>
|
|
*
|
|
* This program is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU General Public License
|
|
* version 2 as published by the Free Software Foundation.
|
|
*
|
|
* This program is distributed in the hope that it will be useful, but
|
|
* WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
* General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program; if not, write to the Free Software
|
|
* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
|
|
* 02110-1301 USA
|
|
*
|
|
*/
|
|
|
|
#ifndef __IO_H__
|
|
#define __IO_H__
|
|
|
|
#include <linux/irqreturn.h>
|
|
|
|
#define HW_ACCESS_MEMORY_MAX_RANGE 0x1FFC0
|
|
|
|
#define HW_PARTITION_REGISTERS_ADDR 0x1FFC0
|
|
#define HW_PART0_SIZE_ADDR (HW_PARTITION_REGISTERS_ADDR)
|
|
#define HW_PART0_START_ADDR (HW_PARTITION_REGISTERS_ADDR + 4)
|
|
#define HW_PART1_SIZE_ADDR (HW_PARTITION_REGISTERS_ADDR + 8)
|
|
#define HW_PART1_START_ADDR (HW_PARTITION_REGISTERS_ADDR + 12)
|
|
#define HW_PART2_SIZE_ADDR (HW_PARTITION_REGISTERS_ADDR + 16)
|
|
#define HW_PART2_START_ADDR (HW_PARTITION_REGISTERS_ADDR + 20)
|
|
#define HW_PART3_START_ADDR (HW_PARTITION_REGISTERS_ADDR + 24)
|
|
|
|
#define HW_ACCESS_REGISTER_SIZE 4
|
|
|
|
#define HW_ACCESS_PRAM_MAX_RANGE 0x3c000
|
|
|
|
struct wl1271;
|
|
|
|
void wlcore_disable_interrupts(struct wl1271 *wl);
|
|
void wlcore_disable_interrupts_nosync(struct wl1271 *wl);
|
|
void wlcore_enable_interrupts(struct wl1271 *wl);
|
|
void wlcore_synchronize_interrupts(struct wl1271 *wl);
|
|
|
|
void wl1271_io_reset(struct wl1271 *wl);
|
|
void wl1271_io_init(struct wl1271 *wl);
|
|
int wlcore_translate_addr(struct wl1271 *wl, int addr);
|
|
|
|
/* Raw target IO, address is not translated */
|
|
static inline int __must_check wlcore_raw_write(struct wl1271 *wl, int addr,
|
|
void *buf, size_t len,
|
|
bool fixed)
|
|
{
|
|
int ret;
|
|
|
|
if (test_bit(WL1271_FLAG_IO_FAILED, &wl->flags) ||
|
|
WARN_ON((test_bit(WL1271_FLAG_IN_ELP, &wl->flags) &&
|
|
addr != HW_ACCESS_ELP_CTRL_REG)))
|
|
return -EIO;
|
|
|
|
ret = wl->if_ops->write(wl->dev, addr, buf, len, fixed);
|
|
if (ret && wl->state != WLCORE_STATE_OFF)
|
|
set_bit(WL1271_FLAG_IO_FAILED, &wl->flags);
|
|
|
|
return ret;
|
|
}
|
|
|
|
static inline int __must_check wlcore_raw_read(struct wl1271 *wl, int addr,
|
|
void *buf, size_t len,
|
|
bool fixed)
|
|
{
|
|
int ret;
|
|
|
|
if (test_bit(WL1271_FLAG_IO_FAILED, &wl->flags) ||
|
|
WARN_ON((test_bit(WL1271_FLAG_IN_ELP, &wl->flags) &&
|
|
addr != HW_ACCESS_ELP_CTRL_REG)))
|
|
return -EIO;
|
|
|
|
ret = wl->if_ops->read(wl->dev, addr, buf, len, fixed);
|
|
if (ret && wl->state != WLCORE_STATE_OFF)
|
|
set_bit(WL1271_FLAG_IO_FAILED, &wl->flags);
|
|
|
|
return ret;
|
|
}
|
|
|
|
static inline int __must_check wlcore_raw_read_data(struct wl1271 *wl, int reg,
|
|
void *buf, size_t len,
|
|
bool fixed)
|
|
{
|
|
return wlcore_raw_read(wl, wl->rtable[reg], buf, len, fixed);
|
|
}
|
|
|
|
static inline int __must_check wlcore_raw_write_data(struct wl1271 *wl, int reg,
|
|
void *buf, size_t len,
|
|
bool fixed)
|
|
{
|
|
return wlcore_raw_write(wl, wl->rtable[reg], buf, len, fixed);
|
|
}
|
|
|
|
static inline int __must_check wlcore_raw_read32(struct wl1271 *wl, int addr,
|
|
u32 *val)
|
|
{
|
|
int ret;
|
|
|
|
ret = wlcore_raw_read(wl, addr, wl->buffer_32,
|
|
sizeof(*wl->buffer_32), false);
|
|
if (ret < 0)
|
|
return ret;
|
|
|
|
if (val)
|
|
*val = le32_to_cpu(*wl->buffer_32);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static inline int __must_check wlcore_raw_write32(struct wl1271 *wl, int addr,
|
|
u32 val)
|
|
{
|
|
*wl->buffer_32 = cpu_to_le32(val);
|
|
return wlcore_raw_write(wl, addr, wl->buffer_32,
|
|
sizeof(*wl->buffer_32), false);
|
|
}
|
|
|
|
static inline int __must_check wlcore_read(struct wl1271 *wl, int addr,
|
|
void *buf, size_t len, bool fixed)
|
|
{
|
|
int physical;
|
|
|
|
physical = wlcore_translate_addr(wl, addr);
|
|
|
|
return wlcore_raw_read(wl, physical, buf, len, fixed);
|
|
}
|
|
|
|
static inline int __must_check wlcore_write(struct wl1271 *wl, int addr,
|
|
void *buf, size_t len, bool fixed)
|
|
{
|
|
int physical;
|
|
|
|
physical = wlcore_translate_addr(wl, addr);
|
|
|
|
return wlcore_raw_write(wl, physical, buf, len, fixed);
|
|
}
|
|
|
|
static inline int __must_check wlcore_write_data(struct wl1271 *wl, int reg,
|
|
void *buf, size_t len,
|
|
bool fixed)
|
|
{
|
|
return wlcore_write(wl, wl->rtable[reg], buf, len, fixed);
|
|
}
|
|
|
|
static inline int __must_check wlcore_read_data(struct wl1271 *wl, int reg,
|
|
void *buf, size_t len,
|
|
bool fixed)
|
|
{
|
|
return wlcore_read(wl, wl->rtable[reg], buf, len, fixed);
|
|
}
|
|
|
|
static inline int __must_check wlcore_read_hwaddr(struct wl1271 *wl, int hwaddr,
|
|
void *buf, size_t len,
|
|
bool fixed)
|
|
{
|
|
int physical;
|
|
int addr;
|
|
|
|
/* Convert from FW internal address which is chip arch dependent */
|
|
addr = wl->ops->convert_hwaddr(wl, hwaddr);
|
|
|
|
physical = wlcore_translate_addr(wl, addr);
|
|
|
|
return wlcore_raw_read(wl, physical, buf, len, fixed);
|
|
}
|
|
|
|
static inline int __must_check wlcore_read32(struct wl1271 *wl, int addr,
|
|
u32 *val)
|
|
{
|
|
return wlcore_raw_read32(wl, wlcore_translate_addr(wl, addr), val);
|
|
}
|
|
|
|
static inline int __must_check wlcore_write32(struct wl1271 *wl, int addr,
|
|
u32 val)
|
|
{
|
|
return wlcore_raw_write32(wl, wlcore_translate_addr(wl, addr), val);
|
|
}
|
|
|
|
static inline int __must_check wlcore_read_reg(struct wl1271 *wl, int reg,
|
|
u32 *val)
|
|
{
|
|
return wlcore_raw_read32(wl,
|
|
wlcore_translate_addr(wl, wl->rtable[reg]),
|
|
val);
|
|
}
|
|
|
|
static inline int __must_check wlcore_write_reg(struct wl1271 *wl, int reg,
|
|
u32 val)
|
|
{
|
|
return wlcore_raw_write32(wl,
|
|
wlcore_translate_addr(wl, wl->rtable[reg]),
|
|
val);
|
|
}
|
|
|
|
static inline void wl1271_power_off(struct wl1271 *wl)
|
|
{
|
|
int ret = 0;
|
|
|
|
if (!test_bit(WL1271_FLAG_GPIO_POWER, &wl->flags))
|
|
return;
|
|
|
|
if (wl->if_ops->power)
|
|
ret = wl->if_ops->power(wl->dev, false);
|
|
if (!ret)
|
|
clear_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
|
|
}
|
|
|
|
static inline int wl1271_power_on(struct wl1271 *wl)
|
|
{
|
|
int ret = 0;
|
|
|
|
if (wl->if_ops->power)
|
|
ret = wl->if_ops->power(wl->dev, true);
|
|
if (ret == 0)
|
|
set_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
|
|
|
|
return ret;
|
|
}
|
|
|
|
int wlcore_set_partition(struct wl1271 *wl,
|
|
const struct wlcore_partition_set *p);
|
|
|
|
bool wl1271_set_block_size(struct wl1271 *wl);
|
|
|
|
/* Functions from wl1271_main.c */
|
|
|
|
int wl1271_tx_dummy_packet(struct wl1271 *wl);
|
|
|
|
#endif
|