p54spi: fix potential null deref in p54spi.c
[safe/jmp/linux-2.6] / drivers / net / wireless / p54 / p54spi.c
1 /*
2  * Copyright (C) 2008 Christian Lamparter <chunkeey@web.de>
3  * Copyright 2008       Johannes Berg <johannes@sipsolutions.net>
4  *
5  * This driver is a port from stlc45xx:
6  *      Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies).
7  *
8  * This program is free software; you can redistribute it and/or
9  * modify it under the terms of the GNU General Public License
10  * version 2 as published by the Free Software Foundation.
11  *
12  * This program is distributed in the hope that it will be useful, but
13  * WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
15  * General Public License for more details.
16  *
17  * You should have received a copy of the GNU General Public License
18  * along with this program; if not, write to the Free Software
19  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
20  * 02110-1301 USA
21  */
22
23 #include <linux/module.h>
24 #include <linux/platform_device.h>
25 #include <linux/interrupt.h>
26 #include <linux/firmware.h>
27 #include <linux/delay.h>
28 #include <linux/irq.h>
29 #include <linux/spi/spi.h>
30 #include <linux/etherdevice.h>
31 #include <linux/gpio.h>
32
33 #include "p54spi.h"
34 #include "p54spi_eeprom.h"
35 #include "p54.h"
36
37 #include "p54common.h"
38
39 MODULE_FIRMWARE("3826.arm");
40 MODULE_ALIAS("stlc45xx");
41
42 /*
43  * gpios should be handled in board files and provided via platform data,
44  * but because it's currently impossible for p54spi to have a header file
45  * in include/linux, let's use module paramaters for now
46  */
47
48 static int p54spi_gpio_power = 97;
49 module_param(p54spi_gpio_power, int, 0444);
50 MODULE_PARM_DESC(p54spi_gpio_power, "gpio number for power line");
51
52 static int p54spi_gpio_irq = 87;
53 module_param(p54spi_gpio_irq, int, 0444);
54 MODULE_PARM_DESC(p54spi_gpio_irq, "gpio number for irq line");
55
56 static void p54spi_spi_read(struct p54s_priv *priv, u8 address,
57                               void *buf, size_t len)
58 {
59         struct spi_transfer t[2];
60         struct spi_message m;
61         __le16 addr;
62
63         /* We first push the address */
64         addr = cpu_to_le16(address << 8 | SPI_ADRS_READ_BIT_15);
65
66         spi_message_init(&m);
67         memset(t, 0, sizeof(t));
68
69         t[0].tx_buf = &addr;
70         t[0].len = sizeof(addr);
71         spi_message_add_tail(&t[0], &m);
72
73         t[1].rx_buf = buf;
74         t[1].len = len;
75         spi_message_add_tail(&t[1], &m);
76
77         spi_sync(priv->spi, &m);
78 }
79
80
81 static void p54spi_spi_write(struct p54s_priv *priv, u8 address,
82                              const void *buf, size_t len)
83 {
84         struct spi_transfer t[3];
85         struct spi_message m;
86         __le16 addr;
87
88         /* We first push the address */
89         addr = cpu_to_le16(address << 8);
90
91         spi_message_init(&m);
92         memset(t, 0, sizeof(t));
93
94         t[0].tx_buf = &addr;
95         t[0].len = sizeof(addr);
96         spi_message_add_tail(&t[0], &m);
97
98         t[1].tx_buf = buf;
99         t[1].len = len & ~1;
100         spi_message_add_tail(&t[1], &m);
101
102         if (len % 2) {
103                 __le16 last_word;
104                 last_word = cpu_to_le16(((u8 *)buf)[len - 1]);
105
106                 t[2].tx_buf = &last_word;
107                 t[2].len = sizeof(last_word);
108                 spi_message_add_tail(&t[2], &m);
109         }
110
111         spi_sync(priv->spi, &m);
112 }
113
114 static u16 p54spi_read16(struct p54s_priv *priv, u8 addr)
115 {
116         __le16 val;
117
118         p54spi_spi_read(priv, addr, &val, sizeof(val));
119
120         return le16_to_cpu(val);
121 }
122
123 static u32 p54spi_read32(struct p54s_priv *priv, u8 addr)
124 {
125         __le32 val;
126
127         p54spi_spi_read(priv, addr, &val, sizeof(val));
128
129         return le32_to_cpu(val);
130 }
131
132 static inline void p54spi_write16(struct p54s_priv *priv, u8 addr, __le16 val)
133 {
134         p54spi_spi_write(priv, addr, &val, sizeof(val));
135 }
136
137 static inline void p54spi_write32(struct p54s_priv *priv, u8 addr, __le32 val)
138 {
139         p54spi_spi_write(priv, addr, &val, sizeof(val));
140 }
141
142 struct p54spi_spi_reg {
143         u16 address;            /* __le16 ? */
144         u16 length;
145         char *name;
146 };
147
148 static const struct p54spi_spi_reg p54spi_registers_array[] =
149 {
150         { SPI_ADRS_ARM_INTERRUPTS,      32, "ARM_INT     " },
151         { SPI_ADRS_ARM_INT_EN,          32, "ARM_INT_ENA " },
152         { SPI_ADRS_HOST_INTERRUPTS,     32, "HOST_INT    " },
153         { SPI_ADRS_HOST_INT_EN,         32, "HOST_INT_ENA" },
154         { SPI_ADRS_HOST_INT_ACK,        32, "HOST_INT_ACK" },
155         { SPI_ADRS_GEN_PURP_1,          32, "GP1_COMM    " },
156         { SPI_ADRS_GEN_PURP_2,          32, "GP2_COMM    " },
157         { SPI_ADRS_DEV_CTRL_STAT,       32, "DEV_CTRL_STA" },
158         { SPI_ADRS_DMA_DATA,            16, "DMA_DATA    " },
159         { SPI_ADRS_DMA_WRITE_CTRL,      16, "DMA_WR_CTRL " },
160         { SPI_ADRS_DMA_WRITE_LEN,       16, "DMA_WR_LEN  " },
161         { SPI_ADRS_DMA_WRITE_BASE,      32, "DMA_WR_BASE " },
162         { SPI_ADRS_DMA_READ_CTRL,       16, "DMA_RD_CTRL " },
163         { SPI_ADRS_DMA_READ_LEN,        16, "DMA_RD_LEN  " },
164         { SPI_ADRS_DMA_WRITE_BASE,      32, "DMA_RD_BASE " }
165 };
166
167 static int p54spi_wait_bit(struct p54s_priv *priv, u16 reg, __le32 bits)
168 {
169         int i;
170
171         for (i = 0; i < 2000; i++) {
172                 __le32 buffer = p54spi_read32(priv, reg);
173                 if ((buffer & bits) == bits)
174                         return 1;
175         }
176         return 0;
177 }
178
179 static int p54spi_spi_write_dma(struct p54s_priv *priv, __le32 base,
180                                 const void *buf, size_t len)
181 {
182         if (!p54spi_wait_bit(priv, SPI_ADRS_DMA_WRITE_CTRL,
183                              cpu_to_le32(HOST_ALLOWED))) {
184                 dev_err(&priv->spi->dev, "spi_write_dma not allowed "
185                         "to DMA write.\n");
186                 return -EAGAIN;
187         }
188
189         p54spi_write16(priv, SPI_ADRS_DMA_WRITE_CTRL,
190                        cpu_to_le16(SPI_DMA_WRITE_CTRL_ENABLE));
191
192         p54spi_write16(priv, SPI_ADRS_DMA_WRITE_LEN, cpu_to_le16(len));
193         p54spi_write32(priv, SPI_ADRS_DMA_WRITE_BASE, base);
194         p54spi_spi_write(priv, SPI_ADRS_DMA_DATA, buf, len);
195         return 0;
196 }
197
198 static int p54spi_request_firmware(struct ieee80211_hw *dev)
199 {
200         struct p54s_priv *priv = dev->priv;
201         int ret;
202
203         /* FIXME: should driver use it's own struct device? */
204         ret = request_firmware(&priv->firmware, "3826.arm", &priv->spi->dev);
205
206         if (ret < 0) {
207                 dev_err(&priv->spi->dev, "request_firmware() failed: %d", ret);
208                 return ret;
209         }
210
211         ret = p54_parse_firmware(dev, priv->firmware);
212         if (ret) {
213                 release_firmware(priv->firmware);
214                 return ret;
215         }
216
217         return 0;
218 }
219
220 static int p54spi_request_eeprom(struct ieee80211_hw *dev)
221 {
222         struct p54s_priv *priv = dev->priv;
223         const struct firmware *eeprom;
224         int ret;
225
226         /*
227          * allow users to customize their eeprom.
228          */
229
230         ret = request_firmware(&eeprom, "3826.eeprom", &priv->spi->dev);
231         if (ret < 0) {
232                 dev_info(&priv->spi->dev, "loading default eeprom...\n");
233                 ret = p54_parse_eeprom(dev, (void *) p54spi_eeprom,
234                                        sizeof(p54spi_eeprom));
235         } else {
236                 dev_info(&priv->spi->dev, "loading user eeprom...\n");
237                 ret = p54_parse_eeprom(dev, (void *) eeprom->data,
238                                        (int)eeprom->size);
239                 release_firmware(eeprom);
240         }
241         return ret;
242 }
243
244 static int p54spi_upload_firmware(struct ieee80211_hw *dev)
245 {
246         struct p54s_priv *priv = dev->priv;
247         unsigned long fw_len, _fw_len;
248         unsigned int offset = 0;
249         int err = 0;
250         u8 *fw;
251
252         fw_len = priv->firmware->size;
253         fw = kmemdup(priv->firmware->data, fw_len, GFP_KERNEL);
254         if (!fw)
255                 return -ENOMEM;
256
257         /* stop the device */
258         p54spi_write16(priv, SPI_ADRS_DEV_CTRL_STAT, cpu_to_le16(
259                        SPI_CTRL_STAT_HOST_OVERRIDE | SPI_CTRL_STAT_HOST_RESET |
260                        SPI_CTRL_STAT_START_HALTED));
261
262         msleep(TARGET_BOOT_SLEEP);
263
264         p54spi_write16(priv, SPI_ADRS_DEV_CTRL_STAT, cpu_to_le16(
265                        SPI_CTRL_STAT_HOST_OVERRIDE |
266                        SPI_CTRL_STAT_START_HALTED));
267
268         msleep(TARGET_BOOT_SLEEP);
269
270         while (fw_len > 0) {
271                 _fw_len = min_t(long, fw_len, SPI_MAX_PACKET_SIZE);
272
273                 err = p54spi_spi_write_dma(priv, cpu_to_le32(
274                                            ISL38XX_DEV_FIRMWARE_ADDR + offset),
275                                            (fw + offset), _fw_len);
276                 if (err < 0)
277                         goto out;
278
279                 fw_len -= _fw_len;
280                 offset += _fw_len;
281         }
282
283         BUG_ON(fw_len != 0);
284
285         /* enable host interrupts */
286         p54spi_write32(priv, SPI_ADRS_HOST_INT_EN,
287                        cpu_to_le32(SPI_HOST_INTS_DEFAULT));
288
289         /* boot the device */
290         p54spi_write16(priv, SPI_ADRS_DEV_CTRL_STAT, cpu_to_le16(
291                        SPI_CTRL_STAT_HOST_OVERRIDE | SPI_CTRL_STAT_HOST_RESET |
292                        SPI_CTRL_STAT_RAM_BOOT));
293
294         msleep(TARGET_BOOT_SLEEP);
295
296         p54spi_write16(priv, SPI_ADRS_DEV_CTRL_STAT, cpu_to_le16(
297                        SPI_CTRL_STAT_HOST_OVERRIDE | SPI_CTRL_STAT_RAM_BOOT));
298         msleep(TARGET_BOOT_SLEEP);
299
300 out:
301         kfree(fw);
302         return err;
303 }
304
305 static void p54spi_power_off(struct p54s_priv *priv)
306 {
307         disable_irq(gpio_to_irq(p54spi_gpio_irq));
308         gpio_set_value(p54spi_gpio_power, 0);
309 }
310
311 static void p54spi_power_on(struct p54s_priv *priv)
312 {
313         gpio_set_value(p54spi_gpio_power, 1);
314         enable_irq(gpio_to_irq(p54spi_gpio_irq));
315
316         /*
317          * need to wait a while before device can be accessed, the lenght
318          * is just a guess
319          */
320         msleep(10);
321 }
322
323 static inline void p54spi_int_ack(struct p54s_priv *priv, u32 val)
324 {
325         p54spi_write32(priv, SPI_ADRS_HOST_INT_ACK, cpu_to_le32(val));
326 }
327
328 static int p54spi_wakeup(struct p54s_priv *priv)
329 {
330         /* wake the chip */
331         p54spi_write32(priv, SPI_ADRS_ARM_INTERRUPTS,
332                        cpu_to_le32(SPI_TARGET_INT_WAKEUP));
333
334         /* And wait for the READY interrupt */
335         if (!p54spi_wait_bit(priv, SPI_ADRS_HOST_INTERRUPTS,
336                              cpu_to_le32(SPI_HOST_INT_READY))) {
337                 dev_err(&priv->spi->dev, "INT_READY timeout\n");
338                 return -EBUSY;
339         }
340
341         p54spi_int_ack(priv, SPI_HOST_INT_READY);
342         return 0;
343 }
344
345 static inline void p54spi_sleep(struct p54s_priv *priv)
346 {
347         p54spi_write32(priv, SPI_ADRS_ARM_INTERRUPTS,
348                        cpu_to_le32(SPI_TARGET_INT_SLEEP));
349 }
350
351 static void p54spi_int_ready(struct p54s_priv *priv)
352 {
353         p54spi_write32(priv, SPI_ADRS_HOST_INT_EN, cpu_to_le32(
354                        SPI_HOST_INT_UPDATE | SPI_HOST_INT_SW_UPDATE));
355
356         switch (priv->fw_state) {
357         case FW_STATE_BOOTING:
358                 priv->fw_state = FW_STATE_READY;
359                 complete(&priv->fw_comp);
360                 break;
361         case FW_STATE_RESETTING:
362                 priv->fw_state = FW_STATE_READY;
363                 /* TODO: reinitialize state */
364                 break;
365         default:
366                 break;
367         }
368 }
369
370 static int p54spi_rx(struct p54s_priv *priv)
371 {
372         struct sk_buff *skb;
373         u16 len;
374         u16 rx_head[2];
375 #define READAHEAD_SZ (sizeof(rx_head)-sizeof(u16))
376
377         if (p54spi_wakeup(priv) < 0)
378                 return -EBUSY;
379
380         /* Read data size and first data word in one SPI transaction
381          * This is workaround for firmware/DMA bug,
382          * when first data word gets lost under high load.
383          */
384         p54spi_spi_read(priv, SPI_ADRS_DMA_DATA, rx_head, sizeof(rx_head));
385         len = rx_head[0];
386
387         if (len == 0) {
388                 p54spi_sleep(priv);
389                 dev_err(&priv->spi->dev, "rx request of zero bytes\n");
390                 return 0;
391         }
392
393         /* Firmware may insert up to 4 padding bytes after the lmac header,
394          * but it does not amend the size of SPI data transfer.
395          * Such packets has correct data size in header, thus referencing
396          * past the end of allocated skb. Reserve extra 4 bytes for this case */
397         skb = dev_alloc_skb(len + 4);
398         if (!skb) {
399                 p54spi_sleep(priv);
400                 dev_err(&priv->spi->dev, "could not alloc skb");
401                 return -ENOMEM;
402         }
403
404         if (len <= READAHEAD_SZ) {
405                 memcpy(skb_put(skb, len), rx_head + 1, len);
406         } else {
407                 memcpy(skb_put(skb, READAHEAD_SZ), rx_head + 1, READAHEAD_SZ);
408                 p54spi_spi_read(priv, SPI_ADRS_DMA_DATA,
409                                 skb_put(skb, len - READAHEAD_SZ),
410                                 len - READAHEAD_SZ);
411         }
412         p54spi_sleep(priv);
413         /* Put additional bytes to compensate for the possible
414          * alignment-caused truncation */
415         skb_put(skb, 4);
416
417         if (p54_rx(priv->hw, skb) == 0)
418                 dev_kfree_skb(skb);
419
420         return 0;
421 }
422
423
424 static irqreturn_t p54spi_interrupt(int irq, void *config)
425 {
426         struct spi_device *spi = config;
427         struct p54s_priv *priv = dev_get_drvdata(&spi->dev);
428
429         queue_work(priv->hw->workqueue, &priv->work);
430
431         return IRQ_HANDLED;
432 }
433
434 static int p54spi_tx_frame(struct p54s_priv *priv, struct sk_buff *skb)
435 {
436         struct p54_hdr *hdr = (struct p54_hdr *) skb->data;
437         int ret = 0;
438
439         if (p54spi_wakeup(priv) < 0)
440                 return -EBUSY;
441
442         ret = p54spi_spi_write_dma(priv, hdr->req_id, skb->data, skb->len);
443         if (ret < 0)
444                 goto out;
445
446         if (!p54spi_wait_bit(priv, SPI_ADRS_HOST_INTERRUPTS,
447                              cpu_to_le32(SPI_HOST_INT_WR_READY))) {
448                 dev_err(&priv->spi->dev, "WR_READY timeout\n");
449                 ret = -EAGAIN;
450                 goto out;
451         }
452
453         p54spi_int_ack(priv, SPI_HOST_INT_WR_READY);
454
455         if (FREE_AFTER_TX(skb))
456                 p54_free_skb(priv->hw, skb);
457 out:
458         p54spi_sleep(priv);
459         return ret;
460 }
461
462 static int p54spi_wq_tx(struct p54s_priv *priv)
463 {
464         struct p54s_tx_info *entry;
465         struct sk_buff *skb;
466         struct ieee80211_tx_info *info;
467         struct p54_tx_info *minfo;
468         struct p54s_tx_info *dinfo;
469         unsigned long flags;
470         int ret = 0;
471
472         spin_lock_irqsave(&priv->tx_lock, flags);
473
474         while (!list_empty(&priv->tx_pending)) {
475                 entry = list_entry(priv->tx_pending.next,
476                                    struct p54s_tx_info, tx_list);
477
478                 list_del_init(&entry->tx_list);
479
480                 spin_unlock_irqrestore(&priv->tx_lock, flags);
481
482                 dinfo = container_of((void *) entry, struct p54s_tx_info,
483                                      tx_list);
484                 minfo = container_of((void *) dinfo, struct p54_tx_info,
485                                      data);
486                 info = container_of((void *) minfo, struct ieee80211_tx_info,
487                                     rate_driver_data);
488                 skb = container_of((void *) info, struct sk_buff, cb);
489
490                 ret = p54spi_tx_frame(priv, skb);
491
492                 if (ret < 0) {
493                         p54_free_skb(priv->hw, skb);
494                         return ret;
495                 }
496
497                 spin_lock_irqsave(&priv->tx_lock, flags);
498         }
499         spin_unlock_irqrestore(&priv->tx_lock, flags);
500         return ret;
501 }
502
503 static void p54spi_op_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
504 {
505         struct p54s_priv *priv = dev->priv;
506         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
507         struct p54_tx_info *mi = (struct p54_tx_info *) info->rate_driver_data;
508         struct p54s_tx_info *di = (struct p54s_tx_info *) mi->data;
509         unsigned long flags;
510
511         BUILD_BUG_ON(sizeof(*di) > sizeof((mi->data)));
512
513         spin_lock_irqsave(&priv->tx_lock, flags);
514         list_add_tail(&di->tx_list, &priv->tx_pending);
515         spin_unlock_irqrestore(&priv->tx_lock, flags);
516
517         queue_work(priv->hw->workqueue, &priv->work);
518 }
519
520 static void p54spi_work(struct work_struct *work)
521 {
522         struct p54s_priv *priv = container_of(work, struct p54s_priv, work);
523         u32 ints;
524         int ret;
525
526         mutex_lock(&priv->mutex);
527
528         if (priv->fw_state == FW_STATE_OFF)
529                 goto out;
530
531         ints = p54spi_read32(priv, SPI_ADRS_HOST_INTERRUPTS);
532
533         if (ints & SPI_HOST_INT_READY) {
534                 p54spi_int_ready(priv);
535                 p54spi_int_ack(priv, SPI_HOST_INT_READY);
536         }
537
538         if (priv->fw_state != FW_STATE_READY)
539                 goto out;
540
541         if (ints & SPI_HOST_INT_UPDATE) {
542                 p54spi_int_ack(priv, SPI_HOST_INT_UPDATE);
543                 ret = p54spi_rx(priv);
544                 if (ret < 0)
545                         goto out;
546         }
547         if (ints & SPI_HOST_INT_SW_UPDATE) {
548                 p54spi_int_ack(priv, SPI_HOST_INT_SW_UPDATE);
549                 ret = p54spi_rx(priv);
550                 if (ret < 0)
551                         goto out;
552         }
553
554         ret = p54spi_wq_tx(priv);
555 out:
556         mutex_unlock(&priv->mutex);
557 }
558
559 static int p54spi_op_start(struct ieee80211_hw *dev)
560 {
561         struct p54s_priv *priv = dev->priv;
562         unsigned long timeout;
563         int ret = 0;
564
565         if (mutex_lock_interruptible(&priv->mutex)) {
566                 ret = -EINTR;
567                 goto out;
568         }
569
570         priv->fw_state = FW_STATE_BOOTING;
571
572         p54spi_power_on(priv);
573
574         ret = p54spi_upload_firmware(dev);
575         if (ret < 0) {
576                 p54spi_power_off(priv);
577                 goto out_unlock;
578         }
579
580         mutex_unlock(&priv->mutex);
581
582         timeout = msecs_to_jiffies(2000);
583         timeout = wait_for_completion_interruptible_timeout(&priv->fw_comp,
584                                                             timeout);
585         if (!timeout) {
586                 dev_err(&priv->spi->dev, "firmware boot failed");
587                 p54spi_power_off(priv);
588                 ret = -1;
589                 goto out;
590         }
591
592         if (mutex_lock_interruptible(&priv->mutex)) {
593                 ret = -EINTR;
594                 p54spi_power_off(priv);
595                 goto out;
596         }
597
598         WARN_ON(priv->fw_state != FW_STATE_READY);
599
600 out_unlock:
601         mutex_unlock(&priv->mutex);
602
603 out:
604         return ret;
605 }
606
607 static void p54spi_op_stop(struct ieee80211_hw *dev)
608 {
609         struct p54s_priv *priv = dev->priv;
610         unsigned long flags;
611
612         if (mutex_lock_interruptible(&priv->mutex)) {
613                 /* FIXME: how to handle this error? */
614                 return;
615         }
616
617         WARN_ON(priv->fw_state != FW_STATE_READY);
618
619         cancel_work_sync(&priv->work);
620
621         p54spi_power_off(priv);
622         spin_lock_irqsave(&priv->tx_lock, flags);
623         INIT_LIST_HEAD(&priv->tx_pending);
624         spin_unlock_irqrestore(&priv->tx_lock, flags);
625
626         priv->fw_state = FW_STATE_OFF;
627         mutex_unlock(&priv->mutex);
628 }
629
630 static int __devinit p54spi_probe(struct spi_device *spi)
631 {
632         struct p54s_priv *priv = NULL;
633         struct ieee80211_hw *hw;
634         int ret = -EINVAL;
635
636         hw = p54_init_common(sizeof(*priv));
637         if (!hw) {
638                 dev_err(&spi->dev, "could not alloc ieee80211_hw");
639                 return -ENOMEM;
640         }
641
642         priv = hw->priv;
643         priv->hw = hw;
644         dev_set_drvdata(&spi->dev, priv);
645         priv->spi = spi;
646
647         spi->bits_per_word = 16;
648         spi->max_speed_hz = 24000000;
649
650         ret = spi_setup(spi);
651         if (ret < 0) {
652                 dev_err(&priv->spi->dev, "spi_setup failed");
653                 goto err_free_common;
654         }
655
656         ret = gpio_request(p54spi_gpio_power, "p54spi power");
657         if (ret < 0) {
658                 dev_err(&priv->spi->dev, "power GPIO request failed: %d", ret);
659                 goto err_free_common;
660         }
661
662         ret = gpio_request(p54spi_gpio_irq, "p54spi irq");
663         if (ret < 0) {
664                 dev_err(&priv->spi->dev, "irq GPIO request failed: %d", ret);
665                 goto err_free_common;
666         }
667
668         gpio_direction_output(p54spi_gpio_power, 0);
669         gpio_direction_input(p54spi_gpio_irq);
670
671         ret = request_irq(gpio_to_irq(p54spi_gpio_irq),
672                           p54spi_interrupt, IRQF_DISABLED, "p54spi",
673                           priv->spi);
674         if (ret < 0) {
675                 dev_err(&priv->spi->dev, "request_irq() failed");
676                 goto err_free_common;
677         }
678
679         set_irq_type(gpio_to_irq(p54spi_gpio_irq),
680                      IRQ_TYPE_EDGE_RISING);
681
682         disable_irq(gpio_to_irq(p54spi_gpio_irq));
683
684         INIT_WORK(&priv->work, p54spi_work);
685         init_completion(&priv->fw_comp);
686         INIT_LIST_HEAD(&priv->tx_pending);
687         mutex_init(&priv->mutex);
688         SET_IEEE80211_DEV(hw, &spi->dev);
689         priv->common.open = p54spi_op_start;
690         priv->common.stop = p54spi_op_stop;
691         priv->common.tx = p54spi_op_tx;
692
693         ret = p54spi_request_firmware(hw);
694         if (ret < 0)
695                 goto err_free_common;
696
697         ret = p54spi_request_eeprom(hw);
698         if (ret)
699                 goto err_free_common;
700
701         ret = p54_register_common(hw, &priv->spi->dev);
702         if (ret)
703                 goto err_free_common;
704
705         return 0;
706
707 err_free_common:
708         p54_free_common(priv->hw);
709         return ret;
710 }
711
712 static int __devexit p54spi_remove(struct spi_device *spi)
713 {
714         struct p54s_priv *priv = dev_get_drvdata(&spi->dev);
715
716         ieee80211_unregister_hw(priv->hw);
717
718         free_irq(gpio_to_irq(p54spi_gpio_irq), spi);
719
720         gpio_free(p54spi_gpio_power);
721         gpio_free(p54spi_gpio_irq);
722         release_firmware(priv->firmware);
723
724         mutex_destroy(&priv->mutex);
725
726         p54_free_common(priv->hw);
727         ieee80211_free_hw(priv->hw);
728
729         return 0;
730 }
731
732
733 static struct spi_driver p54spi_driver = {
734         .driver = {
735                 /* use cx3110x name because board-n800.c uses that for the
736                  * SPI port */
737                 .name           = "cx3110x",
738                 .bus            = &spi_bus_type,
739                 .owner          = THIS_MODULE,
740         },
741
742         .probe          = p54spi_probe,
743         .remove         = __devexit_p(p54spi_remove),
744 };
745
746 static int __init p54spi_init(void)
747 {
748         int ret;
749
750         ret = spi_register_driver(&p54spi_driver);
751         if (ret < 0) {
752                 printk(KERN_ERR "failed to register SPI driver: %d", ret);
753                 goto out;
754         }
755
756 out:
757         return ret;
758 }
759
760 static void __exit p54spi_exit(void)
761 {
762         spi_unregister_driver(&p54spi_driver);
763 }
764
765 module_init(p54spi_init);
766 module_exit(p54spi_exit);
767
768 MODULE_LICENSE("GPL");
769 MODULE_AUTHOR("Christian Lamparter <chunkeey@web.de>");