1 /*
2  * Driver for Microchip MRF24J40 802.15.4 Wireless-PAN Networking controller
3  *
4  * Copyright (C) 2012 Alan Ott <alan@signal11.us>
5  *                    Signal 11 Software
6  *
7  * This program is free software; you can redistribute it and/or modify
8  * it under the terms of the GNU General Public License as published by
9  * the Free Software Foundation; either version 2 of the License, or
10  * (at your option) any later version.
11  *
12  * This program is distributed in the hope that it will be useful,
13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15  * GNU General Public License for more details.
16  *
17  * You should have received a copy of the GNU General Public License
18  * along with this program; if not, write to the Free Software
19  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
20  */
21 
22 #include <linux/spi/spi.h>
23 #include <linux/interrupt.h>
24 #include <linux/module.h>
25 #include <net/wpan-phy.h>
26 #include <net/mac802154.h>
27 #include <net/ieee802154.h>
28 
29 /* MRF24J40 Short Address Registers */
30 #define REG_RXMCR    0x00  /* Receive MAC control */
31 #define REG_PANIDL   0x01  /* PAN ID (low) */
32 #define REG_PANIDH   0x02  /* PAN ID (high) */
33 #define REG_SADRL    0x03  /* Short address (low) */
34 #define REG_SADRH    0x04  /* Short address (high) */
35 #define REG_EADR0    0x05  /* Long address (low) (high is EADR7) */
36 #define REG_TXMCR    0x11  /* Transmit MAC control */
37 #define REG_PACON0   0x16  /* Power Amplifier Control */
38 #define REG_PACON1   0x17  /* Power Amplifier Control */
39 #define REG_PACON2   0x18  /* Power Amplifier Control */
40 #define REG_TXNCON   0x1B  /* Transmit Normal FIFO Control */
41 #define REG_TXSTAT   0x24  /* TX MAC Status Register */
42 #define REG_SOFTRST  0x2A  /* Soft Reset */
43 #define REG_TXSTBL   0x2E  /* TX Stabilization */
44 #define REG_INTSTAT  0x31  /* Interrupt Status */
45 #define REG_INTCON   0x32  /* Interrupt Control */
46 #define REG_RFCTL    0x36  /* RF Control Mode Register */
47 #define REG_BBREG1   0x39  /* Baseband Registers */
48 #define REG_BBREG2   0x3A  /* */
49 #define REG_BBREG6   0x3E  /* */
50 #define REG_CCAEDTH  0x3F  /* Energy Detection Threshold */
51 
52 /* MRF24J40 Long Address Registers */
53 #define REG_RFCON0     0x200  /* RF Control Registers */
54 #define REG_RFCON1     0x201
55 #define REG_RFCON2     0x202
56 #define REG_RFCON3     0x203
57 #define REG_RFCON5     0x205
58 #define REG_RFCON6     0x206
59 #define REG_RFCON7     0x207
60 #define REG_RFCON8     0x208
61 #define REG_RSSI       0x210
62 #define REG_SLPCON0    0x211  /* Sleep Clock Control Registers */
63 #define REG_SLPCON1    0x220
64 #define REG_WAKETIMEL  0x222  /* Wake-up Time Match Value Low */
65 #define REG_WAKETIMEH  0x223  /* Wake-up Time Match Value High */
66 #define REG_RX_FIFO    0x300  /* Receive FIFO */
67 
68 /* Device configuration: Only channels 11-26 on page 0 are supported. */
69 #define MRF24J40_CHAN_MIN 11
70 #define MRF24J40_CHAN_MAX 26
71 #define CHANNEL_MASK (((u32)1 << (MRF24J40_CHAN_MAX + 1)) \
72 		      - ((u32)1 << MRF24J40_CHAN_MIN))
73 
74 #define TX_FIFO_SIZE 128 /* From datasheet */
75 #define RX_FIFO_SIZE 144 /* From datasheet */
76 #define SET_CHANNEL_DELAY_US 192 /* From datasheet */
77 
78 /* Device Private Data */
79 struct mrf24j40 {
80 	struct spi_device *spi;
81 	struct ieee802154_dev *dev;
82 
83 	struct mutex buffer_mutex; /* only used to protect buf */
84 	struct completion tx_complete;
85 	u8 *buf; /* 3 bytes. Used for SPI single-register transfers. */
86 };
87 
88 /* Read/Write SPI Commands for Short and Long Address registers. */
89 #define MRF24J40_READSHORT(reg) ((reg) << 1)
90 #define MRF24J40_WRITESHORT(reg) ((reg) << 1 | 1)
91 #define MRF24J40_READLONG(reg) (1 << 15 | (reg) << 5)
92 #define MRF24J40_WRITELONG(reg) (1 << 15 | (reg) << 5 | 1 << 4)
93 
94 /* The datasheet indicates the theoretical maximum for SCK to be 10MHz */
95 #define MAX_SPI_SPEED_HZ 10000000
96 
97 #define printdev(X) (&X->spi->dev)
98 
99 static int write_short_reg(struct mrf24j40 *devrec, u8 reg, u8 value)
100 {
101 	int ret;
102 	struct spi_message msg;
103 	struct spi_transfer xfer = {
104 		.len = 2,
105 		.tx_buf = devrec->buf,
106 		.rx_buf = devrec->buf,
107 	};
108 
109 	spi_message_init(&msg);
110 	spi_message_add_tail(&xfer, &msg);
111 
112 	mutex_lock(&devrec->buffer_mutex);
113 	devrec->buf[0] = MRF24J40_WRITESHORT(reg);
114 	devrec->buf[1] = value;
115 
116 	ret = spi_sync(devrec->spi, &msg);
117 	if (ret)
118 		dev_err(printdev(devrec),
119 			"SPI write Failed for short register 0x%hhx\n", reg);
120 
121 	mutex_unlock(&devrec->buffer_mutex);
122 	return ret;
123 }
124 
125 static int read_short_reg(struct mrf24j40 *devrec, u8 reg, u8 *val)
126 {
127 	int ret = -1;
128 	struct spi_message msg;
129 	struct spi_transfer xfer = {
130 		.len = 2,
131 		.tx_buf = devrec->buf,
132 		.rx_buf = devrec->buf,
133 	};
134 
135 	spi_message_init(&msg);
136 	spi_message_add_tail(&xfer, &msg);
137 
138 	mutex_lock(&devrec->buffer_mutex);
139 	devrec->buf[0] = MRF24J40_READSHORT(reg);
140 	devrec->buf[1] = 0;
141 
142 	ret = spi_sync(devrec->spi, &msg);
143 	if (ret)
144 		dev_err(printdev(devrec),
145 			"SPI read Failed for short register 0x%hhx\n", reg);
146 	else
147 		*val = devrec->buf[1];
148 
149 	mutex_unlock(&devrec->buffer_mutex);
150 	return ret;
151 }
152 
153 static int read_long_reg(struct mrf24j40 *devrec, u16 reg, u8 *value)
154 {
155 	int ret;
156 	u16 cmd;
157 	struct spi_message msg;
158 	struct spi_transfer xfer = {
159 		.len = 3,
160 		.tx_buf = devrec->buf,
161 		.rx_buf = devrec->buf,
162 	};
163 
164 	spi_message_init(&msg);
165 	spi_message_add_tail(&xfer, &msg);
166 
167 	cmd = MRF24J40_READLONG(reg);
168 	mutex_lock(&devrec->buffer_mutex);
169 	devrec->buf[0] = cmd >> 8 & 0xff;
170 	devrec->buf[1] = cmd & 0xff;
171 	devrec->buf[2] = 0;
172 
173 	ret = spi_sync(devrec->spi, &msg);
174 	if (ret)
175 		dev_err(printdev(devrec),
176 			"SPI read Failed for long register 0x%hx\n", reg);
177 	else
178 		*value = devrec->buf[2];
179 
180 	mutex_unlock(&devrec->buffer_mutex);
181 	return ret;
182 }
183 
184 static int write_long_reg(struct mrf24j40 *devrec, u16 reg, u8 val)
185 {
186 	int ret;
187 	u16 cmd;
188 	struct spi_message msg;
189 	struct spi_transfer xfer = {
190 		.len = 3,
191 		.tx_buf = devrec->buf,
192 		.rx_buf = devrec->buf,
193 	};
194 
195 	spi_message_init(&msg);
196 	spi_message_add_tail(&xfer, &msg);
197 
198 	cmd = MRF24J40_WRITELONG(reg);
199 	mutex_lock(&devrec->buffer_mutex);
200 	devrec->buf[0] = cmd >> 8 & 0xff;
201 	devrec->buf[1] = cmd & 0xff;
202 	devrec->buf[2] = val;
203 
204 	ret = spi_sync(devrec->spi, &msg);
205 	if (ret)
206 		dev_err(printdev(devrec),
207 			"SPI write Failed for long register 0x%hx\n", reg);
208 
209 	mutex_unlock(&devrec->buffer_mutex);
210 	return ret;
211 }
212 
213 /* This function relies on an undocumented write method. Once a write command
214    and address is set, as many bytes of data as desired can be clocked into
215    the device. The datasheet only shows setting one byte at a time. */
216 static int write_tx_buf(struct mrf24j40 *devrec, u16 reg,
217 			const u8 *data, size_t length)
218 {
219 	int ret;
220 	u16 cmd;
221 	u8 lengths[2];
222 	struct spi_message msg;
223 	struct spi_transfer addr_xfer = {
224 		.len = 2,
225 		.tx_buf = devrec->buf,
226 	};
227 	struct spi_transfer lengths_xfer = {
228 		.len = 2,
229 		.tx_buf = &lengths, /* TODO: Is DMA really required for SPI? */
230 	};
231 	struct spi_transfer data_xfer = {
232 		.len = length,
233 		.tx_buf = data,
234 	};
235 
236 	/* Range check the length. 2 bytes are used for the length fields.*/
237 	if (length > TX_FIFO_SIZE-2) {
238 		dev_err(printdev(devrec), "write_tx_buf() was passed too large a buffer. Performing short write.\n");
239 		length = TX_FIFO_SIZE-2;
240 	}
241 
242 	spi_message_init(&msg);
243 	spi_message_add_tail(&addr_xfer, &msg);
244 	spi_message_add_tail(&lengths_xfer, &msg);
245 	spi_message_add_tail(&data_xfer, &msg);
246 
247 	cmd = MRF24J40_WRITELONG(reg);
248 	mutex_lock(&devrec->buffer_mutex);
249 	devrec->buf[0] = cmd >> 8 & 0xff;
250 	devrec->buf[1] = cmd & 0xff;
251 	lengths[0] = 0x0; /* Header Length. Set to 0 for now. TODO */
252 	lengths[1] = length; /* Total length */
253 
254 	ret = spi_sync(devrec->spi, &msg);
255 	if (ret)
256 		dev_err(printdev(devrec), "SPI write Failed for TX buf\n");
257 
258 	mutex_unlock(&devrec->buffer_mutex);
259 	return ret;
260 }
261 
262 static int mrf24j40_read_rx_buf(struct mrf24j40 *devrec,
263 				u8 *data, u8 *len, u8 *lqi)
264 {
265 	u8 rx_len;
266 	u8 addr[2];
267 	u8 lqi_rssi[2];
268 	u16 cmd;
269 	int ret;
270 	struct spi_message msg;
271 	struct spi_transfer addr_xfer = {
272 		.len = 2,
273 		.tx_buf = &addr,
274 	};
275 	struct spi_transfer data_xfer = {
276 		.len = 0x0, /* set below */
277 		.rx_buf = data,
278 	};
279 	struct spi_transfer status_xfer = {
280 		.len = 2,
281 		.rx_buf = &lqi_rssi,
282 	};
283 
284 	/* Get the length of the data in the RX FIFO. The length in this
285 	 * register exclues the 1-byte length field at the beginning. */
286 	ret = read_long_reg(devrec, REG_RX_FIFO, &rx_len);
287 	if (ret)
288 		goto out;
289 
290 	/* Range check the RX FIFO length, accounting for the one-byte
291 	 * length field at the begining. */
292 	if (rx_len > RX_FIFO_SIZE-1) {
293 		dev_err(printdev(devrec), "Invalid length read from device. Performing short read.\n");
294 		rx_len = RX_FIFO_SIZE-1;
295 	}
296 
297 	if (rx_len > *len) {
298 		/* Passed in buffer wasn't big enough. Should never happen. */
299 		dev_err(printdev(devrec), "Buffer not big enough. Performing short read\n");
300 		rx_len = *len;
301 	}
302 
303 	/* Set up the commands to read the data. */
304 	cmd = MRF24J40_READLONG(REG_RX_FIFO+1);
305 	addr[0] = cmd >> 8 & 0xff;
306 	addr[1] = cmd & 0xff;
307 	data_xfer.len = rx_len;
308 
309 	spi_message_init(&msg);
310 	spi_message_add_tail(&addr_xfer, &msg);
311 	spi_message_add_tail(&data_xfer, &msg);
312 	spi_message_add_tail(&status_xfer, &msg);
313 
314 	ret = spi_sync(devrec->spi, &msg);
315 	if (ret) {
316 		dev_err(printdev(devrec), "SPI RX Buffer Read Failed.\n");
317 		goto out;
318 	}
319 
320 	*lqi = lqi_rssi[0];
321 	*len = rx_len;
322 
323 #ifdef DEBUG
324 	print_hex_dump(KERN_DEBUG, "mrf24j40 rx: ",
325 		DUMP_PREFIX_OFFSET, 16, 1, data, *len, 0);
326 	printk(KERN_DEBUG "mrf24j40 rx: lqi: %02hhx rssi: %02hhx\n",
327 		lqi_rssi[0], lqi_rssi[1]);
328 #endif
329 
330 out:
331 	return ret;
332 }
333 
334 static int mrf24j40_tx(struct ieee802154_dev *dev, struct sk_buff *skb)
335 {
336 	struct mrf24j40 *devrec = dev->priv;
337 	u8 val;
338 	int ret = 0;
339 
340 	dev_dbg(printdev(devrec), "tx packet of %d bytes\n", skb->len);
341 
342 	ret = write_tx_buf(devrec, 0x000, skb->data, skb->len);
343 	if (ret)
344 		goto err;
345 
346 	reinit_completion(&devrec->tx_complete);
347 
348 	/* Set TXNTRIG bit of TXNCON to send packet */
349 	ret = read_short_reg(devrec, REG_TXNCON, &val);
350 	if (ret)
351 		goto err;
352 	val |= 0x1;
353 	/* Set TXNACKREQ if the ACK bit is set in the packet. */
354 	if (skb->data[0] & IEEE802154_FC_ACK_REQ)
355 		val |= 0x4;
356 	write_short_reg(devrec, REG_TXNCON, val);
357 
358 	/* Wait for the device to send the TX complete interrupt. */
359 	ret = wait_for_completion_interruptible_timeout(
360 						&devrec->tx_complete,
361 						5 * HZ);
362 	if (ret == -ERESTARTSYS)
363 		goto err;
364 	if (ret == 0) {
365 		dev_warn(printdev(devrec), "Timeout waiting for TX interrupt\n");
366 		ret = -ETIMEDOUT;
367 		goto err;
368 	}
369 
370 	/* Check for send error from the device. */
371 	ret = read_short_reg(devrec, REG_TXSTAT, &val);
372 	if (ret)
373 		goto err;
374 	if (val & 0x1) {
375 		dev_dbg(printdev(devrec), "Error Sending. Retry count exceeded\n");
376 		ret = -ECOMM; /* TODO: Better error code ? */
377 	} else
378 		dev_dbg(printdev(devrec), "Packet Sent\n");
379 
380 err:
381 
382 	return ret;
383 }
384 
385 static int mrf24j40_ed(struct ieee802154_dev *dev, u8 *level)
386 {
387 	/* TODO: */
388 	printk(KERN_WARNING "mrf24j40: ed not implemented\n");
389 	*level = 0;
390 	return 0;
391 }
392 
393 static int mrf24j40_start(struct ieee802154_dev *dev)
394 {
395 	struct mrf24j40 *devrec = dev->priv;
396 	u8 val;
397 	int ret;
398 
399 	dev_dbg(printdev(devrec), "start\n");
400 
401 	ret = read_short_reg(devrec, REG_INTCON, &val);
402 	if (ret)
403 		return ret;
404 	val &= ~(0x1|0x8); /* Clear TXNIE and RXIE. Enable interrupts */
405 	write_short_reg(devrec, REG_INTCON, val);
406 
407 	return 0;
408 }
409 
410 static void mrf24j40_stop(struct ieee802154_dev *dev)
411 {
412 	struct mrf24j40 *devrec = dev->priv;
413 	u8 val;
414 	int ret;
415 	dev_dbg(printdev(devrec), "stop\n");
416 
417 	ret = read_short_reg(devrec, REG_INTCON, &val);
418 	if (ret)
419 		return;
420 	val |= 0x1|0x8; /* Set TXNIE and RXIE. Disable Interrupts */
421 	write_short_reg(devrec, REG_INTCON, val);
422 
423 	return;
424 }
425 
426 static int mrf24j40_set_channel(struct ieee802154_dev *dev,
427 				int page, int channel)
428 {
429 	struct mrf24j40 *devrec = dev->priv;
430 	u8 val;
431 	int ret;
432 
433 	dev_dbg(printdev(devrec), "Set Channel %d\n", channel);
434 
435 	WARN_ON(page != 0);
436 	WARN_ON(channel < MRF24J40_CHAN_MIN);
437 	WARN_ON(channel > MRF24J40_CHAN_MAX);
438 
439 	/* Set Channel TODO */
440 	val = (channel-11) << 4 | 0x03;
441 	write_long_reg(devrec, REG_RFCON0, val);
442 
443 	/* RF Reset */
444 	ret = read_short_reg(devrec, REG_RFCTL, &val);
445 	if (ret)
446 		return ret;
447 	val |= 0x04;
448 	write_short_reg(devrec, REG_RFCTL, val);
449 	val &= ~0x04;
450 	write_short_reg(devrec, REG_RFCTL, val);
451 
452 	udelay(SET_CHANNEL_DELAY_US); /* per datasheet */
453 
454 	return 0;
455 }
456 
457 static int mrf24j40_filter(struct ieee802154_dev *dev,
458 			   struct ieee802154_hw_addr_filt *filt,
459 			   unsigned long changed)
460 {
461 	struct mrf24j40 *devrec = dev->priv;
462 
463 	dev_dbg(printdev(devrec), "filter\n");
464 
465 	if (changed & IEEE802515_AFILT_SADDR_CHANGED) {
466 		/* Short Addr */
467 		u8 addrh, addrl;
468 		addrh = filt->short_addr >> 8 & 0xff;
469 		addrl = filt->short_addr & 0xff;
470 
471 		write_short_reg(devrec, REG_SADRH, addrh);
472 		write_short_reg(devrec, REG_SADRL, addrl);
473 		dev_dbg(printdev(devrec),
474 			"Set short addr to %04hx\n", filt->short_addr);
475 	}
476 
477 	if (changed & IEEE802515_AFILT_IEEEADDR_CHANGED) {
478 		/* Device Address */
479 		int i;
480 		for (i = 0; i < 8; i++)
481 			write_short_reg(devrec, REG_EADR0+i,
482 					filt->ieee_addr[7-i]);
483 
484 #ifdef DEBUG
485 		printk(KERN_DEBUG "Set long addr to: ");
486 		for (i = 0; i < 8; i++)
487 			printk("%02hhx ", filt->ieee_addr[i]);
488 		printk(KERN_DEBUG "\n");
489 #endif
490 	}
491 
492 	if (changed & IEEE802515_AFILT_PANID_CHANGED) {
493 		/* PAN ID */
494 		u8 panidl, panidh;
495 		panidh = filt->pan_id >> 8 & 0xff;
496 		panidl = filt->pan_id & 0xff;
497 		write_short_reg(devrec, REG_PANIDH, panidh);
498 		write_short_reg(devrec, REG_PANIDL, panidl);
499 
500 		dev_dbg(printdev(devrec), "Set PANID to %04hx\n", filt->pan_id);
501 	}
502 
503 	if (changed & IEEE802515_AFILT_PANC_CHANGED) {
504 		/* Pan Coordinator */
505 		u8 val;
506 		int ret;
507 
508 		ret = read_short_reg(devrec, REG_RXMCR, &val);
509 		if (ret)
510 			return ret;
511 		if (filt->pan_coord)
512 			val |= 0x8;
513 		else
514 			val &= ~0x8;
515 		write_short_reg(devrec, REG_RXMCR, val);
516 
517 		/* REG_SLOTTED is maintained as default (unslotted/CSMA-CA).
518 		 * REG_ORDER is maintained as default (no beacon/superframe).
519 		 */
520 
521 		dev_dbg(printdev(devrec), "Set Pan Coord to %s\n",
522 					filt->pan_coord ? "on" : "off");
523 	}
524 
525 	return 0;
526 }
527 
528 static int mrf24j40_handle_rx(struct mrf24j40 *devrec)
529 {
530 	u8 len = RX_FIFO_SIZE;
531 	u8 lqi = 0;
532 	u8 val;
533 	int ret = 0;
534 	struct sk_buff *skb;
535 
536 	/* Turn off reception of packets off the air. This prevents the
537 	 * device from overwriting the buffer while we're reading it. */
538 	ret = read_short_reg(devrec, REG_BBREG1, &val);
539 	if (ret)
540 		goto out;
541 	val |= 4; /* SET RXDECINV */
542 	write_short_reg(devrec, REG_BBREG1, val);
543 
544 	skb = alloc_skb(len, GFP_KERNEL);
545 	if (!skb) {
546 		ret = -ENOMEM;
547 		goto out;
548 	}
549 
550 	ret = mrf24j40_read_rx_buf(devrec, skb_put(skb, len), &len, &lqi);
551 	if (ret < 0) {
552 		dev_err(printdev(devrec), "Failure reading RX FIFO\n");
553 		kfree_skb(skb);
554 		ret = -EINVAL;
555 		goto out;
556 	}
557 
558 	/* Cut off the checksum */
559 	skb_trim(skb, len-2);
560 
561 	/* TODO: Other drivers call ieee20154_rx_irqsafe() here (eg: cc2040,
562 	 * also from a workqueue).  I think irqsafe is not necessary here.
563 	 * Can someone confirm? */
564 	ieee802154_rx_irqsafe(devrec->dev, skb, lqi);
565 
566 	dev_dbg(printdev(devrec), "RX Handled\n");
567 
568 out:
569 	/* Turn back on reception of packets off the air. */
570 	ret = read_short_reg(devrec, REG_BBREG1, &val);
571 	if (ret)
572 		return ret;
573 	val &= ~0x4; /* Clear RXDECINV */
574 	write_short_reg(devrec, REG_BBREG1, val);
575 
576 	return ret;
577 }
578 
579 static struct ieee802154_ops mrf24j40_ops = {
580 	.owner = THIS_MODULE,
581 	.xmit = mrf24j40_tx,
582 	.ed = mrf24j40_ed,
583 	.start = mrf24j40_start,
584 	.stop = mrf24j40_stop,
585 	.set_channel = mrf24j40_set_channel,
586 	.set_hw_addr_filt = mrf24j40_filter,
587 };
588 
589 static irqreturn_t mrf24j40_isr(int irq, void *data)
590 {
591 	struct mrf24j40 *devrec = data;
592 	u8 intstat;
593 	int ret;
594 
595 	/* Read the interrupt status */
596 	ret = read_short_reg(devrec, REG_INTSTAT, &intstat);
597 	if (ret)
598 		goto out;
599 
600 	/* Check for TX complete */
601 	if (intstat & 0x1)
602 		complete(&devrec->tx_complete);
603 
604 	/* Check for Rx */
605 	if (intstat & 0x8)
606 		mrf24j40_handle_rx(devrec);
607 
608 out:
609 	return IRQ_HANDLED;
610 }
611 
612 static int mrf24j40_probe(struct spi_device *spi)
613 {
614 	int ret = -ENOMEM;
615 	u8 val;
616 	struct mrf24j40 *devrec;
617 
618 	printk(KERN_INFO "mrf24j40: probe(). IRQ: %d\n", spi->irq);
619 
620 	devrec = kzalloc(sizeof(struct mrf24j40), GFP_KERNEL);
621 	if (!devrec)
622 		goto err_devrec;
623 	devrec->buf = kzalloc(3, GFP_KERNEL);
624 	if (!devrec->buf)
625 		goto err_buf;
626 
627 	spi->mode = SPI_MODE_0; /* TODO: Is this appropriate for right here? */
628 	if (spi->max_speed_hz > MAX_SPI_SPEED_HZ)
629 		spi->max_speed_hz = MAX_SPI_SPEED_HZ;
630 
631 	mutex_init(&devrec->buffer_mutex);
632 	init_completion(&devrec->tx_complete);
633 	devrec->spi = spi;
634 	spi_set_drvdata(spi, devrec);
635 
636 	/* Register with the 802154 subsystem */
637 
638 	devrec->dev = ieee802154_alloc_device(0, &mrf24j40_ops);
639 	if (!devrec->dev)
640 		goto err_alloc_dev;
641 
642 	devrec->dev->priv = devrec;
643 	devrec->dev->parent = &devrec->spi->dev;
644 	devrec->dev->phy->channels_supported[0] = CHANNEL_MASK;
645 	devrec->dev->flags = IEEE802154_HW_OMIT_CKSUM|IEEE802154_HW_AACK;
646 
647 	dev_dbg(printdev(devrec), "registered mrf24j40\n");
648 	ret = ieee802154_register_device(devrec->dev);
649 	if (ret)
650 		goto err_register_device;
651 
652 	/* Initialize the device.
653 		From datasheet section 3.2: Initialization. */
654 	write_short_reg(devrec, REG_SOFTRST, 0x07);
655 	write_short_reg(devrec, REG_PACON2, 0x98);
656 	write_short_reg(devrec, REG_TXSTBL, 0x95);
657 	write_long_reg(devrec, REG_RFCON0, 0x03);
658 	write_long_reg(devrec, REG_RFCON1, 0x01);
659 	write_long_reg(devrec, REG_RFCON2, 0x80);
660 	write_long_reg(devrec, REG_RFCON6, 0x90);
661 	write_long_reg(devrec, REG_RFCON7, 0x80);
662 	write_long_reg(devrec, REG_RFCON8, 0x10);
663 	write_long_reg(devrec, REG_SLPCON1, 0x21);
664 	write_short_reg(devrec, REG_BBREG2, 0x80);
665 	write_short_reg(devrec, REG_CCAEDTH, 0x60);
666 	write_short_reg(devrec, REG_BBREG6, 0x40);
667 	write_short_reg(devrec, REG_RFCTL, 0x04);
668 	write_short_reg(devrec, REG_RFCTL, 0x0);
669 	udelay(192);
670 
671 	/* Set RX Mode. RXMCR<1:0>: 0x0 normal, 0x1 promisc, 0x2 error */
672 	ret = read_short_reg(devrec, REG_RXMCR, &val);
673 	if (ret)
674 		goto err_read_reg;
675 	val &= ~0x3; /* Clear RX mode (normal) */
676 	write_short_reg(devrec, REG_RXMCR, val);
677 
678 	ret = request_threaded_irq(spi->irq,
679 				   NULL,
680 				   mrf24j40_isr,
681 				   IRQF_TRIGGER_LOW|IRQF_ONESHOT,
682 				   dev_name(&spi->dev),
683 				   devrec);
684 
685 	if (ret) {
686 		dev_err(printdev(devrec), "Unable to get IRQ");
687 		goto err_irq;
688 	}
689 
690 	return 0;
691 
692 err_irq:
693 err_read_reg:
694 	ieee802154_unregister_device(devrec->dev);
695 err_register_device:
696 	ieee802154_free_device(devrec->dev);
697 err_alloc_dev:
698 	kfree(devrec->buf);
699 err_buf:
700 	kfree(devrec);
701 err_devrec:
702 	return ret;
703 }
704 
705 static int mrf24j40_remove(struct spi_device *spi)
706 {
707 	struct mrf24j40 *devrec = spi_get_drvdata(spi);
708 
709 	dev_dbg(printdev(devrec), "remove\n");
710 
711 	free_irq(spi->irq, devrec);
712 	ieee802154_unregister_device(devrec->dev);
713 	ieee802154_free_device(devrec->dev);
714 	/* TODO: Will ieee802154_free_device() wait until ->xmit() is
715 	 * complete? */
716 
717 	/* Clean up the SPI stuff. */
718 	spi_set_drvdata(spi, NULL);
719 	kfree(devrec->buf);
720 	kfree(devrec);
721 	return 0;
722 }
723 
724 static const struct spi_device_id mrf24j40_ids[] = {
725 	{ "mrf24j40", 0 },
726 	{ "mrf24j40ma", 0 },
727 	{ },
728 };
729 MODULE_DEVICE_TABLE(spi, mrf24j40_ids);
730 
731 static struct spi_driver mrf24j40_driver = {
732 	.driver = {
733 		.name = "mrf24j40",
734 		.bus = &spi_bus_type,
735 		.owner = THIS_MODULE,
736 	},
737 	.id_table = mrf24j40_ids,
738 	.probe = mrf24j40_probe,
739 	.remove = mrf24j40_remove,
740 };
741 
742 module_spi_driver(mrf24j40_driver);
743 
744 MODULE_LICENSE("GPL");
745 MODULE_AUTHOR("Alan Ott");
746 MODULE_DESCRIPTION("MRF24J40 SPI 802.15.4 Controller Driver");
747