staging: speakup: avoid out-of-range access in synth_add()
[firefly-linux-kernel-4.4.55.git] / drivers / staging / gdm72xx / sdio_boot.c
1 /*
2  * Copyright (c) 2012 GCT Semiconductor, Inc. All rights reserved.
3  *
4  * This software is licensed under the terms of the GNU General Public
5  * License version 2, as published by the Free Software Foundation, and
6  * may be copied, distributed, and modified under those terms.
7  *
8  * This program is distributed in the hope that it will be useful,
9  * but WITHOUT ANY WARRANTY; without even the implied warranty of
10  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11  * GNU General Public License for more details.
12  */
13
14 #include <linux/module.h>
15 #include <linux/kernel.h>
16 #include <linux/init.h>
17 #include <linux/mm.h>
18 #include <linux/uaccess.h>
19 #include <linux/fs.h>
20 #include <linux/sched.h>
21 #include <linux/slab.h>
22
23 #include <linux/mmc/core.h>
24 #include <linux/mmc/card.h>
25 #include <linux/mmc/sdio_func.h>
26
27 #include <linux/firmware.h>
28
29 #include "gdm_sdio.h"
30
31 #define TYPE_A_HEADER_SIZE      4
32 #define TYPE_A_LOOKAHEAD_SIZE   16
33 #define YMEM0_SIZE              0x8000  /* 32kbytes */
34 #define DOWNLOAD_SIZE           (YMEM0_SIZE - TYPE_A_HEADER_SIZE)
35
36 #define FW_DIR                  "gdm72xx/"
37 #define FW_KRN                  "gdmskrn.bin"
38 #define FW_RFS                  "gdmsrfs.bin"
39
40 static u8 *tx_buf;
41
42 static int ack_ready(struct sdio_func *func)
43 {
44         unsigned long start = jiffies;
45         u8 val;
46         int ret;
47
48         while ((jiffies - start) < HZ) {
49                 val = sdio_readb(func, 0x13, &ret);
50                 if (val & 0x01)
51                         return 1;
52                 schedule();
53         }
54
55         return 0;
56 }
57
58 static int download_image(struct sdio_func *func, const char *img_name)
59 {
60         int ret = 0, len, pno;
61         u8 *buf = tx_buf;
62         loff_t pos = 0;
63         int img_len;
64         const struct firmware *firm;
65
66         ret = request_firmware(&firm, img_name, &func->dev);
67         if (ret < 0) {
68                 dev_err(&func->dev,
69                         "requesting firmware %s failed with error %d\n",
70                         img_name, ret);
71                 return ret;
72         }
73
74         buf = kmalloc(DOWNLOAD_SIZE + TYPE_A_HEADER_SIZE, GFP_KERNEL);
75         if (buf == NULL) {
76                 dev_err(&func->dev, "Error: kmalloc\n");
77                 return -ENOMEM;
78         }
79
80         img_len = firm->size;
81
82         if (img_len <= 0) {
83                 ret = -1;
84                 goto out;
85         }
86
87         pno = 0;
88         while (img_len > 0) {
89                 if (img_len > DOWNLOAD_SIZE) {
90                         len = DOWNLOAD_SIZE;
91                         buf[3] = 0;
92                 } else {
93                         len = img_len; /* the last packet */
94                         buf[3] = 2;
95                 }
96
97                 buf[0] = len & 0xff;
98                 buf[1] = (len >> 8) & 0xff;
99                 buf[2] = (len >> 16) & 0xff;
100
101                 memcpy(buf+TYPE_A_HEADER_SIZE, firm->data + pos, len);
102                 ret = sdio_memcpy_toio(func, 0, buf, len + TYPE_A_HEADER_SIZE);
103                 if (ret < 0) {
104                         dev_err(&func->dev,
105                                 "send image error: packet number = %d ret = %d\n",
106                                 pno, ret);
107                         goto out;
108                 }
109
110                 if (buf[3] == 2)        /* The last packet */
111                         break;
112                 if (!ack_ready(func)) {
113                         ret = -EIO;
114                         dev_err(&func->dev, "Ack is not ready.\n");
115                         goto out;
116                 }
117                 ret = sdio_memcpy_fromio(func, buf, 0, TYPE_A_LOOKAHEAD_SIZE);
118                 if (ret < 0) {
119                         dev_err(&func->dev,
120                                 "receive ack error: packet number = %d ret = %d\n",
121                                 pno, ret);
122                         goto out;
123                 }
124                 sdio_writeb(func, 0x01, 0x13, &ret);
125                 sdio_writeb(func, 0x00, 0x10, &ret);    /* PCRRT */
126
127                 img_len -= DOWNLOAD_SIZE;
128                 pos += DOWNLOAD_SIZE;
129                 pno++;
130         }
131
132 out:
133         kfree(buf);
134         return ret;
135 }
136
137 int sdio_boot(struct sdio_func *func)
138 {
139         int ret;
140         const char *krn_name = FW_DIR FW_KRN;
141         const char *rfs_name = FW_DIR FW_RFS;
142
143         tx_buf = kmalloc(YMEM0_SIZE, GFP_KERNEL);
144         if (tx_buf == NULL) {
145                 dev_err(&func->dev, "Error: kmalloc: %s %d\n",
146                         __func__, __LINE__);
147                 return -ENOMEM;
148         }
149
150         ret = download_image(func, krn_name);
151         if (ret)
152                 goto restore_fs;
153         dev_info(&func->dev, "GCT: Kernel download success.\n");
154
155         ret = download_image(func, rfs_name);
156         if (ret)
157                 goto restore_fs;
158         dev_info(&func->dev, "GCT: Filesystem download success.\n");
159
160 restore_fs:
161         kfree(tx_buf);
162         return ret;
163 }