]> rtime.felk.cvut.cz Git - socketcan-devel.git/blob - kernel/2.6/drivers/net/can/old/ccan/ccan.c
net/can bugfix: use after free bug in can protocol drivers
[socketcan-devel.git] / kernel / 2.6 / drivers / net / can / old / ccan / ccan.c
1 /*
2  * drivers/can/c_can.c
3  *
4  * Copyright (C) 2007
5  *
6  * - Sascha Hauer, Marc Kleine-Budde, Pengutronix
7  * - Simon Kallweit, intefo AG
8  *
9  * This program is free software; you can redistribute it and/or modify
10  * it under the terms of the version 2 of the GNU General Public License
11  * as published by the Free Software Foundation
12  *
13  * This program is distributed in the hope that it will be useful,
14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16  * GNU General Public License for more details.
17  *
18  * You should have received a copy of the GNU General Public License
19  * along with this program; if not, write to the Free Software
20  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
21  */
22
23 #ifdef CONFIG_CAN_DEBUG_DEVICES
24 #define DBG(args...) printk(args)
25 #else
26 #define DBG(args...)
27 #endif
28
29 #include <linux/kernel.h>
30 #include <linux/version.h>
31 #include <linux/module.h>
32 #include <linux/interrupt.h>
33 #include <linux/delay.h>
34 #include <linux/netdevice.h>
35 #include <linux/if_arp.h>
36 #include <linux/if_ether.h>
37 #include <linux/can.h>
38 #include <linux/list.h>
39 #include <linux/delay.h>
40 #include <linux/workqueue.h>
41 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,16)
42 #include <linux/io.h>
43 #else
44 #include <asm/io.h>
45 #endif
46
47 #include <linux/can/dev.h>
48 #include <linux/can/error.h>
49 #include "ccan.h"
50
51 static u32 ccan_read_reg32(struct net_device *dev, enum c_regs reg)
52 {
53         struct ccan_priv *priv = netdev_priv(dev);
54
55         u32 val = priv->read_reg(dev, reg);
56         val |= ((u32) priv->read_reg(dev, reg + 2)) << 16;
57
58         return val;
59 }
60
61 static void ccan_write_reg32(struct net_device *dev, enum c_regs reg, u32 val)
62 {
63         struct ccan_priv *priv = netdev_priv(dev);
64
65         priv->write_reg(dev, reg, val & 0xffff);
66         priv->write_reg(dev, reg + 2, val >> 16);
67 }
68
69 static inline void ccan_object_get(struct net_device *dev,
70                                    int iface, int objno, int mask)
71 {
72         struct ccan_priv *priv = netdev_priv(dev);
73
74         priv->write_reg(dev, CAN_IF_COMM(iface), mask);
75         priv->write_reg(dev, CAN_IF_COMR(iface), objno + 1);
76         while (priv->read_reg(dev, CAN_IF_COMR(iface)) & IF_COMR_BUSY)
77                 DBG("busy\n");
78 }
79
80 static inline void ccan_object_put(struct net_device *dev,
81                                    int iface, int objno, int mask)
82 {
83         struct ccan_priv *priv = netdev_priv(dev);
84
85         priv->write_reg(dev, CAN_IF_COMM(iface), IF_COMM_WR | mask);
86         priv->write_reg(dev, CAN_IF_COMR(iface), objno + 1);
87         while (priv->read_reg(dev, CAN_IF_COMR(iface)) & IF_COMR_BUSY)
88                 DBG("busy\n");
89 }
90
91 static int ccan_write_object(struct net_device *dev,
92                              int iface, struct can_frame *frame, int objno)
93 {
94         struct ccan_priv *priv = netdev_priv(dev);
95         unsigned int val;
96
97         if (frame->can_id & CAN_EFF_FLAG)
98                 val = IF_ARB_MSGXTD | (frame->can_id & CAN_EFF_MASK);
99         else
100                 val = ((frame->can_id & CAN_SFF_MASK) << 18);
101
102         if (!(frame->can_id & CAN_RTR_FLAG))
103                 val |=  IF_ARB_TRANSMIT;
104
105         val |=  IF_ARB_MSGVAL;
106         ccan_write_reg32(dev, CAN_IF_ARB(iface), val);
107
108         memcpy(&val, &frame->data[0], 4);
109         ccan_write_reg32(dev, CAN_IF_DATAA(iface), val);
110         memcpy(&val, &frame->data[4], 4);
111         ccan_write_reg32(dev, CAN_IF_DATAB(iface), val);
112         priv->write_reg(dev, CAN_IF_MCONT(iface),
113                         IF_MCONT_TXIE | IF_MCONT_TXRQST | IF_MCONT_EOB |
114                         (frame->can_dlc & 0xf));
115
116         ccan_object_put(dev, 0, objno, IF_COMM_ALL);
117
118         return 0;
119 }
120
121 static int ccan_read_object(struct net_device *dev, int iface, int objno)
122 {
123         struct ccan_priv *priv = netdev_priv(dev);
124         unsigned int val, ctrl, data;
125         struct sk_buff *skb;
126         struct can_frame *frame;
127
128         skb = dev_alloc_skb(sizeof(struct can_frame));
129         skb->dev = dev;
130
131         ccan_object_get(dev, 0, objno, IF_COMM_ALL & ~IF_COMM_TXRQST);
132 #ifdef CCAN_DEBUG
133         priv->bufstat[objno]++;
134 #endif
135         frame = (struct can_frame *)skb_put(skb, sizeof(struct can_frame));
136
137         ctrl = priv->read_reg(dev, CAN_IF_MCONT(iface));
138
139         if (ctrl & IF_MCONT_MSGLST) {
140                 priv->can.net_stats.rx_errors++;
141                 DBG("%s: msg lost in buffer %d\n", __func__, objno);
142         }
143
144         frame->can_dlc = ctrl & 0xf;
145
146         val = ccan_read_reg32(dev, CAN_IF_ARB(iface));
147
148         data = ccan_read_reg32(dev, CAN_IF_DATAA(iface));
149         memcpy(&frame->data[0], &data, 4);
150         data = ccan_read_reg32(dev, CAN_IF_DATAB(iface));
151         memcpy(&frame->data[4], &data, 4);
152
153         if (val & IF_ARB_MSGXTD)
154                 frame->can_id = (val & CAN_EFF_MASK) | CAN_EFF_FLAG;
155         else
156                 frame->can_id = (val >> 18) & CAN_SFF_MASK;
157
158         if (val & IF_ARB_TRANSMIT)
159                 frame->can_id |= CAN_RTR_FLAG;
160
161         priv->write_reg(dev, CAN_IF_MCONT(iface), ctrl &
162                         ~(IF_MCONT_MSGLST | IF_MCONT_INTPND | IF_MCONT_NEWDAT));
163
164         ccan_object_put(dev, 0, objno, IF_COMM_CONTROL);
165
166         skb->protocol = __constant_htons(ETH_P_CAN);
167         netif_rx(skb);
168
169         priv->can.net_stats.rx_packets++;
170         priv->can.net_stats.rx_bytes += frame->can_dlc;
171
172         return 0;
173 }
174
175 static int ccan_setup_receive_object(struct net_device *dev, int iface,
176                                      int objno, unsigned int mask,
177                                      unsigned int id, unsigned int mcont)
178 {
179         struct ccan_priv *priv = netdev_priv(dev);
180
181         ccan_write_reg32(dev, CAN_IF_MASK(iface), mask);
182         ccan_write_reg32(dev, CAN_IF_ARB(iface), IF_ARB_MSGVAL | id);
183
184         priv->write_reg(dev, CAN_IF_MCONT(iface), mcont);
185
186         ccan_object_put(dev, 0, objno, IF_COMM_ALL & ~IF_COMM_TXRQST);
187
188         DBG("%s: obj no %d msgval: 0x%08x\n", __func__,
189                 objno, ccan_read_reg32(dev, CAN_MSGVAL));
190
191         return 0;
192 }
193
194 static int ccan_inval_object(struct net_device *dev, int iface, int objno)
195 {
196         struct ccan_priv *priv = netdev_priv(dev);
197
198         ccan_write_reg32(dev, CAN_IF_ARB(iface), 0);
199         priv->write_reg(dev, CAN_IF_MCONT(iface), 0);
200         ccan_object_put(dev, 0, objno, IF_COMM_ARB | IF_COMM_CONTROL);
201
202         DBG("%s: obj no %d msgval: 0x%08x\n", __func__,
203                 objno, ccan_read_reg32(dev, CAN_MSGVAL));
204
205         return 0;
206 }
207
208 static int ccan_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
209 {
210         struct ccan_priv *priv = netdev_priv(dev);
211         struct can_frame *frame = (struct can_frame *)skb->data;
212
213         spin_lock_irq(&priv->can.irq_lock);
214
215         ccan_write_object(dev, 0, frame, priv->tx_object);
216 #ifdef CCAN_DEBUG
217         priv->bufstat[priv->tx_object]++;
218 #endif
219         priv->tx_object++;
220         if (priv->tx_object > 5)
221                 netif_stop_queue(dev);
222
223         spin_unlock_irq(&priv->can.irq_lock);
224
225         priv->can.net_stats.tx_packets++;
226         priv->can.net_stats.tx_bytes += frame->can_dlc;
227
228         dev->trans_start = jiffies;
229         dev_kfree_skb(skb);
230
231         return 0;
232 }
233
234 static void ccan_tx_timeout(struct net_device *dev)
235 {
236         struct ccan_priv *priv = netdev_priv(dev);
237
238         priv->can.net_stats.tx_errors++;
239 }
240
241 static int ccan_set_bittime(struct net_device *dev, struct can_bittime *br)
242 {
243         struct ccan_priv *priv = netdev_priv(dev);
244         unsigned int reg_timing, ctrl_save;
245         u8 brp, sjw, tseg1, tseg2;
246
247         if (br->type != CAN_BITTIME_STD)
248                 return -EINVAL;
249
250         brp = br->std.brp - 1;
251         sjw = br->std.sjw - 1;
252         tseg1 = br->std.prop_seg + br->std.phase_seg1 - 1;
253         tseg2 = br->std.phase_seg2 - 1;
254
255         reg_timing = (brp & BTR_BRP_MASK) |
256                      ((sjw << BTR_SJW_SHIFT) & BTR_SJW_MASK) |
257                      ((tseg1 << BTR_TSEG1_SHIFT) & BTR_TSEG1_MASK) |
258                      ((tseg2 << BTR_TSEG2_SHIFT) & BTR_TSEG2_MASK);
259
260         DBG("%s: brp = %d sjw = %d seg1 = %d seg2 = %d\n", __func__,
261                 brp, sjw, tseg1, tseg2);
262         DBG("%s: setting BTR to %04x\n", __func__, reg_timing);
263
264         spin_lock_irq(&priv->can.irq_lock);
265
266         ctrl_save = priv->read_reg(dev, CAN_CONTROL);
267         priv->write_reg(dev, CAN_CONTROL,
268                         ctrl_save | CONTROL_CCE | CONTROL_INIT);
269         priv->write_reg(dev, CAN_BTR, reg_timing);
270         priv->write_reg(dev, CAN_CONTROL, ctrl_save);
271
272         spin_unlock_irq(&priv->can.irq_lock);
273
274         return 0;
275 }
276
277 static int ccan_set_mode(struct net_device *dev, enum can_mode mode)
278 {
279         switch (mode) {
280         case CAN_MODE_START:
281                 DBG("%s: CAN_MODE_START requested\n", __func__);
282                 break;
283         default:
284                 return -EOPNOTSUPP;
285         }
286
287         return 0;
288 }
289
290 static int ccan_get_state(struct net_device *dev, enum can_state *state)
291 {
292         struct ccan_priv *priv = netdev_priv(dev);
293         u32 reg_status;
294 #ifdef CCAN_DEBUG
295         int i;
296 #endif
297
298         reg_status = priv->read_reg(dev, CAN_STATUS);
299
300         if (reg_status & STATUS_EPASS)
301                 *state = CAN_STATE_BUS_PASSIVE;
302         else if (reg_status & STATUS_EWARN)
303                 *state = CAN_STATE_BUS_WARNING;
304         else if (reg_status & STATUS_BOFF)
305                 *state = CAN_STATE_BUS_OFF;
306         else
307                 *state = CAN_STATE_ACTIVE;
308 #ifdef CCAN_DEBUG
309         DBG("buffer statistic:\n");
310         for (i = 0; i <= MAX_OBJECT; i++)
311                 DBG("%d: %d\n", i, priv->bufstat[i]);
312 #endif
313         return 0;
314 }
315
316 static int ccan_do_status_irq(struct net_device *dev)
317 {
318         struct ccan_priv *priv = netdev_priv(dev);
319         int status, diff;
320
321         status = priv->read_reg(dev, CAN_STATUS);
322         status &= ~(STATUS_TXOK | STATUS_RXOK);
323         diff = status ^ priv->last_status;
324
325         if (diff & STATUS_EPASS) {
326                 if (status & STATUS_EPASS)
327                         dev_info(ND2D(dev), "entered error passive state\n");
328                 else
329                         dev_info(ND2D(dev), "left error passive state\n");
330         }
331         if (diff & STATUS_EWARN) {
332                 if (status & STATUS_EWARN)
333                         dev_info(ND2D(dev), "entered error warning state\n");
334                 else
335                         dev_info(ND2D(dev), "left error warning state\n");
336         }
337         if (diff & STATUS_BOFF) {
338                 if (status & STATUS_BOFF)
339                         dev_info(ND2D(dev), "entered busoff state\n");
340                 else
341                         dev_info(ND2D(dev), "left busoff state\n");
342         }
343
344         if (diff & STATUS_LEC_MASK) {
345                 switch (status & STATUS_LEC_MASK) {
346                 case LEC_STUFF_ERROR:
347                         dev_info(ND2D(dev), "suffing error\n");
348                         break;
349                 case LEC_FORM_ERROR:
350                         dev_info(ND2D(dev), "form error\n");
351                         break;
352                 case LEC_ACK_ERROR:
353                         dev_info(ND2D(dev), "ack error\n");
354                         break;
355                 case LEC_BIT1_ERROR:
356                         dev_info(ND2D(dev), "bit1 error\n");
357                         break;
358                 }
359         }
360
361         priv->write_reg(dev, CAN_STATUS, 0);
362         priv->last_status = status;
363
364         return diff ? 1 : 0;
365 }
366
367 static void ccan_do_object_irq(struct net_device *dev, u16 irqstatus)
368 {
369         struct ccan_priv *priv = netdev_priv(dev);
370         int i;
371         u32 val;
372
373         if (irqstatus > MAX_TRANSMIT_OBJECT) {
374                 val = ccan_read_reg32(dev, CAN_NEWDAT);
375                 while (val & RECEIVE_OBJECT_BITS) {
376                         for (i = MAX_TRANSMIT_OBJECT + 1; i <= MAX_OBJECT; i++)
377                                 if (val & (1<<i))
378                                         ccan_read_object(dev, 0, i);
379                         val = ccan_read_reg32(dev, CAN_NEWDAT);
380                 }
381         } else {
382                 ccan_inval_object(dev, 0, irqstatus - 1);
383                 val = ccan_read_reg32(dev, CAN_TXRQST);
384                 if (!val) {
385                         priv->tx_object = 0;
386                         netif_wake_queue(dev);
387                 }
388         }
389 }
390
391 static void do_statuspoll(struct work_struct *work)
392 {
393         struct ccan_priv *priv = container_of(((struct delayed_work *) work),
394                                               struct ccan_priv, work);
395
396         priv->write_reg(priv->dev, CAN_CONTROL,
397                         CONTROL_SIE | CONTROL_EIE | CONTROL_IE);
398 }
399
400 #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
401 static irqreturn_t ccan_isr(int irq, void *dev_id, struct pt_regs *regs)
402 #else
403 static irqreturn_t ccan_isr(int irq, void *dev_id)
404 #endif
405 {
406         struct net_device *dev = (struct net_device *) dev_id;
407         struct ccan_priv *priv = netdev_priv(dev);
408         u16 irqstatus;
409         unsigned long flags;
410
411         spin_lock_irqsave(&priv->can.irq_lock, flags);
412
413         irqstatus = priv->read_reg(dev, CAN_IR);
414         while (irqstatus) {
415                 if (irqstatus == 0x8000) {
416                         if (ccan_do_status_irq(dev)) {
417                                 /* The c_can core tends to flood us with
418                                  * interrupts when certain error states don't
419                                  * disappear. Disable interrupts and see if it's
420                                  * getting better later. This is at least the
421                                  * case on the Magnachip h7202.
422                                  */
423                                 priv->write_reg(dev, CAN_CONTROL, CONTROL_EIE |
424                                                 CONTROL_IE);
425                                 schedule_delayed_work(&priv->work, HZ / 10);
426                                 goto exit;
427                         }
428                 } else {
429                         ccan_do_object_irq(dev, irqstatus);
430                 }
431                 irqstatus = priv->read_reg(dev, CAN_IR);
432         }
433
434 exit:
435         spin_unlock_irqrestore(&priv->can.irq_lock, flags);
436
437         return IRQ_HANDLED;
438 }
439
440 static int ccan_open(struct net_device *dev)
441 {
442         struct ccan_priv *priv = netdev_priv(dev);
443
444         if (request_irq(dev->irq, &ccan_isr, 0, dev->name, dev)) {
445                 dev_err(ND2D(dev), "failed to attach interrupt\n");
446                 return -EAGAIN;
447         }
448
449         priv->write_reg(dev, CAN_CONTROL,
450                         CONTROL_EIE | CONTROL_SIE | CONTROL_IE);
451
452         netif_wake_queue(dev);
453
454         return 0;
455 }
456
457 static int ccan_stop(struct net_device *dev)
458 {
459         struct ccan_priv *priv = netdev_priv(dev);
460         unsigned long flags;
461
462         netif_stop_queue(dev);
463
464         cancel_delayed_work(&priv->work);
465         flush_scheduled_work();
466
467         /* mask all IRQs */
468         spin_lock_irqsave(&priv->can.irq_lock, flags);
469         priv->write_reg(dev, CAN_CONTROL, 0);
470         spin_unlock_irqrestore(&priv->can.irq_lock, flags);
471
472         free_irq(dev->irq, dev);
473
474         return 0;
475 }
476
477 static int ccan_chip_config(struct net_device *dev)
478 {
479         struct ccan_priv *priv = netdev_priv(dev);
480         int i;
481
482         /* setup message objects */
483         for (i = 0; i <= MAX_OBJECT; i++)
484                 ccan_inval_object(dev, 0, i);
485
486         for (i = MAX_TRANSMIT_OBJECT + 1; i < MAX_OBJECT; i++)
487                 ccan_setup_receive_object(dev, 0, i, 0, 0,
488                                           IF_MCONT_RXIE | IF_MCONT_UMASK);
489
490         ccan_setup_receive_object(dev, 0, MAX_OBJECT, 0, 0, IF_MCONT_EOB |
491                                   IF_MCONT_RXIE | IF_MCONT_UMASK);
492
493 #ifdef CCAN_DEBUG
494         for (i = 0; i <= MAX_OBJECT; i++)
495                 priv->bufstat[i] = 0;
496 #endif
497
498         return 0;
499 }
500
501 struct net_device *alloc_ccandev(int sizeof_priv)
502 {
503         struct net_device *dev;
504         struct ccan_priv *priv;
505
506         dev = alloc_candev(sizeof_priv);
507         if (!dev)
508                 return NULL;
509
510         priv = netdev_priv(dev);
511
512         dev->open = ccan_open;
513         dev->stop = ccan_stop;
514         dev->hard_start_xmit = ccan_hard_start_xmit;
515         dev->tx_timeout = ccan_tx_timeout;
516
517         priv->can.bitrate = 500000;
518
519         priv->can.do_set_bittime = ccan_set_bittime;
520         priv->can.do_get_state = ccan_get_state;
521         priv->can.do_set_mode = ccan_set_mode;
522
523         priv->dev = dev;
524         priv->tx_object = 0;
525
526         return dev;
527 }
528 EXPORT_SYMBOL(alloc_ccandev);
529
530 void free_ccandev(struct net_device *dev)
531 {
532         free_candev(dev);
533 }
534 EXPORT_SYMBOL(free_ccandev);
535
536 int register_ccandev(struct net_device *dev)
537 {
538         struct ccan_priv *priv = netdev_priv(dev);
539
540         ccan_set_mode(dev, CAN_MODE_START);
541
542         ccan_chip_config(dev);
543         INIT_DELAYED_WORK(&priv->work, do_statuspoll);
544
545         return register_netdev(dev);
546 }
547 EXPORT_SYMBOL(register_ccandev);
548
549 void unregister_ccandev(struct net_device *dev)
550 {
551         struct ccan_priv *priv = netdev_priv(dev);
552
553         ccan_set_mode(dev, CAN_MODE_START);
554
555         cancel_delayed_work(&priv->work);
556         flush_scheduled_work();
557
558         unregister_netdev(dev);
559 }
560 EXPORT_SYMBOL(unregister_ccandev);
561
562
563 MODULE_AUTHOR("Sascha Hauer <s.hauer@pengutronix.de>");
564 MODULE_AUTHOR("Simon Kallweit <simon.kallweit@intefo.ch>");
565 MODULE_LICENSE("GPL v2");
566 MODULE_DESCRIPTION("CAN port driver for C_CAN based chips");