drivers/bluetooth/btsdio.c: fix double-free
[ccrypt.git] / drivers / bluetooth / btsdio.c
blob58630cc1eff2f1047ed0049edcbb9c4e578d511f
1 /*
3 * Generic Bluetooth SDIO driver
5 * Copyright (C) 2007 Cambridge Silicon Radio Ltd.
6 * Copyright (C) 2007 Marcel Holtmann <marcel@holtmann.org>
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 2 of the License, or
12 * (at your option) any later version.
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
19 * You should have received a copy of the GNU General Public License
20 * along with this program; if not, write to the Free Software
21 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
25 #include <linux/kernel.h>
26 #include <linux/module.h>
27 #include <linux/init.h>
28 #include <linux/slab.h>
29 #include <linux/types.h>
30 #include <linux/sched.h>
31 #include <linux/errno.h>
32 #include <linux/skbuff.h>
34 #include <linux/mmc/sdio_ids.h>
35 #include <linux/mmc/sdio_func.h>
37 #include <net/bluetooth/bluetooth.h>
38 #include <net/bluetooth/hci_core.h>
40 #ifndef CONFIG_BT_HCIBTSDIO_DEBUG
41 #undef BT_DBG
42 #define BT_DBG(D...)
43 #endif
45 #define VERSION "0.1"
47 static const struct sdio_device_id btsdio_table[] = {
48 /* Generic Bluetooth Type-A SDIO device */
49 { SDIO_DEVICE_CLASS(SDIO_CLASS_BT_A) },
51 /* Generic Bluetooth Type-B SDIO device */
52 { SDIO_DEVICE_CLASS(SDIO_CLASS_BT_B) },
54 { } /* Terminating entry */
57 MODULE_DEVICE_TABLE(sdio, btsdio_table);
59 struct btsdio_data {
60 struct hci_dev *hdev;
61 struct sdio_func *func;
63 struct work_struct work;
65 struct sk_buff_head txq;
68 #define REG_RDAT 0x00 /* Receiver Data */
69 #define REG_TDAT 0x00 /* Transmitter Data */
70 #define REG_PC_RRT 0x10 /* Read Packet Control */
71 #define REG_PC_WRT 0x11 /* Write Packet Control */
72 #define REG_RTC_STAT 0x12 /* Retry Control Status */
73 #define REG_RTC_SET 0x12 /* Retry Control Set */
74 #define REG_INTRD 0x13 /* Interrupt Indication */
75 #define REG_CL_INTRD 0x13 /* Interrupt Clear */
76 #define REG_EN_INTRD 0x14 /* Interrupt Enable */
77 #define REG_MD_STAT 0x20 /* Bluetooth Mode Status */
79 static int btsdio_tx_packet(struct btsdio_data *data, struct sk_buff *skb)
81 int err;
83 BT_DBG("%s", data->hdev->name);
85 /* Prepend Type-A header */
86 skb_push(skb, 4);
87 skb->data[0] = (skb->len & 0x0000ff);
88 skb->data[1] = (skb->len & 0x00ff00) >> 8;
89 skb->data[2] = (skb->len & 0xff0000) >> 16;
90 skb->data[3] = bt_cb(skb)->pkt_type;
92 err = sdio_writesb(data->func, REG_TDAT, skb->data, skb->len);
93 if (err < 0) {
94 sdio_writeb(data->func, 0x01, REG_PC_WRT, NULL);
95 return err;
98 data->hdev->stat.byte_tx += skb->len;
100 kfree_skb(skb);
102 return 0;
105 static void btsdio_work(struct work_struct *work)
107 struct btsdio_data *data = container_of(work, struct btsdio_data, work);
108 struct sk_buff *skb;
109 int err;
111 BT_DBG("%s", data->hdev->name);
113 sdio_claim_host(data->func);
115 while ((skb = skb_dequeue(&data->txq))) {
116 err = btsdio_tx_packet(data, skb);
117 if (err < 0) {
118 data->hdev->stat.err_tx++;
119 skb_queue_head(&data->txq, skb);
120 break;
124 sdio_release_host(data->func);
127 static int btsdio_rx_packet(struct btsdio_data *data)
129 u8 hdr[4] __attribute__ ((aligned(4)));
130 struct sk_buff *skb;
131 int err, len;
133 BT_DBG("%s", data->hdev->name);
135 err = sdio_readsb(data->func, hdr, REG_RDAT, 4);
136 if (err < 0)
137 return err;
139 len = hdr[0] | (hdr[1] << 8) | (hdr[2] << 16);
140 if (len < 4 || len > 65543)
141 return -EILSEQ;
143 skb = bt_skb_alloc(len - 4, GFP_KERNEL);
144 if (!skb) {
145 /* Out of memory. Prepare a read retry and just
146 * return with the expectation that the next time
147 * we're called we'll have more memory. */
148 return -ENOMEM;
151 skb_put(skb, len - 4);
153 err = sdio_readsb(data->func, skb->data, REG_RDAT, len - 4);
154 if (err < 0) {
155 kfree(skb);
156 return err;
159 data->hdev->stat.byte_rx += len;
161 skb->dev = (void *) data->hdev;
162 bt_cb(skb)->pkt_type = hdr[3];
164 err = hci_recv_frame(skb);
165 if (err < 0)
166 return err;
168 sdio_writeb(data->func, 0x00, REG_PC_RRT, NULL);
170 return 0;
173 static void btsdio_interrupt(struct sdio_func *func)
175 struct btsdio_data *data = sdio_get_drvdata(func);
176 int intrd;
178 BT_DBG("%s", data->hdev->name);
180 intrd = sdio_readb(func, REG_INTRD, NULL);
181 if (intrd & 0x01) {
182 sdio_writeb(func, 0x01, REG_CL_INTRD, NULL);
184 if (btsdio_rx_packet(data) < 0) {
185 data->hdev->stat.err_rx++;
186 sdio_writeb(data->func, 0x01, REG_PC_RRT, NULL);
191 static int btsdio_open(struct hci_dev *hdev)
193 struct btsdio_data *data = hdev->driver_data;
194 int err;
196 BT_DBG("%s", hdev->name);
198 if (test_and_set_bit(HCI_RUNNING, &hdev->flags))
199 return 0;
201 sdio_claim_host(data->func);
203 err = sdio_enable_func(data->func);
204 if (err < 0) {
205 clear_bit(HCI_RUNNING, &hdev->flags);
206 goto release;
209 err = sdio_claim_irq(data->func, btsdio_interrupt);
210 if (err < 0) {
211 sdio_disable_func(data->func);
212 clear_bit(HCI_RUNNING, &hdev->flags);
213 goto release;
216 if (data->func->class == SDIO_CLASS_BT_B)
217 sdio_writeb(data->func, 0x00, REG_MD_STAT, NULL);
219 sdio_writeb(data->func, 0x01, REG_EN_INTRD, NULL);
221 release:
222 sdio_release_host(data->func);
224 return err;
227 static int btsdio_close(struct hci_dev *hdev)
229 struct btsdio_data *data = hdev->driver_data;
231 BT_DBG("%s", hdev->name);
233 if (!test_and_clear_bit(HCI_RUNNING, &hdev->flags))
234 return 0;
236 sdio_claim_host(data->func);
238 sdio_writeb(data->func, 0x00, REG_EN_INTRD, NULL);
240 sdio_release_irq(data->func);
241 sdio_disable_func(data->func);
243 sdio_release_host(data->func);
245 return 0;
248 static int btsdio_flush(struct hci_dev *hdev)
250 struct btsdio_data *data = hdev->driver_data;
252 BT_DBG("%s", hdev->name);
254 skb_queue_purge(&data->txq);
256 return 0;
259 static int btsdio_send_frame(struct sk_buff *skb)
261 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
262 struct btsdio_data *data = hdev->driver_data;
264 BT_DBG("%s", hdev->name);
266 if (!test_bit(HCI_RUNNING, &hdev->flags))
267 return -EBUSY;
269 switch (bt_cb(skb)->pkt_type) {
270 case HCI_COMMAND_PKT:
271 hdev->stat.cmd_tx++;
272 break;
274 case HCI_ACLDATA_PKT:
275 hdev->stat.acl_tx++;
276 break;
278 case HCI_SCODATA_PKT:
279 hdev->stat.sco_tx++;
280 break;
282 default:
283 return -EILSEQ;
286 skb_queue_tail(&data->txq, skb);
288 schedule_work(&data->work);
290 return 0;
293 static void btsdio_destruct(struct hci_dev *hdev)
295 struct btsdio_data *data = hdev->driver_data;
297 BT_DBG("%s", hdev->name);
299 kfree(data);
302 static int btsdio_probe(struct sdio_func *func,
303 const struct sdio_device_id *id)
305 struct btsdio_data *data;
306 struct hci_dev *hdev;
307 struct sdio_func_tuple *tuple = func->tuples;
308 int err;
310 BT_DBG("func %p id %p class 0x%04x", func, id, func->class);
312 while (tuple) {
313 BT_DBG("code 0x%x size %d", tuple->code, tuple->size);
314 tuple = tuple->next;
317 data = kzalloc(sizeof(*data), GFP_KERNEL);
318 if (!data)
319 return -ENOMEM;
321 data->func = func;
323 INIT_WORK(&data->work, btsdio_work);
325 skb_queue_head_init(&data->txq);
327 hdev = hci_alloc_dev();
328 if (!hdev) {
329 kfree(data);
330 return -ENOMEM;
333 hdev->type = HCI_SDIO;
334 hdev->driver_data = data;
336 data->hdev = hdev;
338 SET_HCIDEV_DEV(hdev, &func->dev);
340 hdev->open = btsdio_open;
341 hdev->close = btsdio_close;
342 hdev->flush = btsdio_flush;
343 hdev->send = btsdio_send_frame;
344 hdev->destruct = btsdio_destruct;
346 hdev->owner = THIS_MODULE;
348 err = hci_register_dev(hdev);
349 if (err < 0) {
350 hci_free_dev(hdev);
351 kfree(data);
352 return err;
355 sdio_set_drvdata(func, data);
357 return 0;
360 static void btsdio_remove(struct sdio_func *func)
362 struct btsdio_data *data = sdio_get_drvdata(func);
363 struct hci_dev *hdev;
365 BT_DBG("func %p", func);
367 if (!data)
368 return;
370 hdev = data->hdev;
372 sdio_set_drvdata(func, NULL);
374 hci_unregister_dev(hdev);
376 hci_free_dev(hdev);
379 static struct sdio_driver btsdio_driver = {
380 .name = "btsdio",
381 .probe = btsdio_probe,
382 .remove = btsdio_remove,
383 .id_table = btsdio_table,
386 static int __init btsdio_init(void)
388 BT_INFO("Generic Bluetooth SDIO driver ver %s", VERSION);
390 return sdio_register_driver(&btsdio_driver);
393 static void __exit btsdio_exit(void)
395 sdio_unregister_driver(&btsdio_driver);
398 module_init(btsdio_init);
399 module_exit(btsdio_exit);
401 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
402 MODULE_DESCRIPTION("Generic Bluetooth SDIO driver ver " VERSION);
403 MODULE_VERSION(VERSION);
404 MODULE_LICENSE("GPL");