1/*
2 *
3 *  Driver for the 3Com Bluetooth PCMCIA card
4 *
5 *  Copyright (C) 2001-2002  Marcel Holtmann <marcel@holtmann.org>
6 *                           Jose Orlando Pereira <jop@di.uminho.pt>
7 *
8 *
9 *  This program is free software; you can redistribute it and/or modify
10 *  it under the terms of the GNU General Public License version 2 as
11 *  published by the Free Software Foundation;
12 *
13 *  Software distributed under the License is distributed on an "AS
14 *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
15 *  implied. See the License for the specific language governing
16 *  rights and limitations under the License.
17 *
18 *  The initial developer of the original code is David A. Hinds
19 *  <dahinds@users.sourceforge.net>.  Portions created by David A. Hinds
20 *  are Copyright (C) 1999 David A. Hinds.  All Rights Reserved.
21 *
22 */
23
24#include <linux/module.h>
25
26#include <linux/kernel.h>
27#include <linux/init.h>
28#include <linux/slab.h>
29#include <linux/types.h>
30#include <linux/delay.h>
31#include <linux/errno.h>
32#include <linux/ptrace.h>
33#include <linux/ioport.h>
34#include <linux/spinlock.h>
35#include <linux/moduleparam.h>
36
37#include <linux/skbuff.h>
38#include <linux/string.h>
39#include <linux/serial.h>
40#include <linux/serial_reg.h>
41#include <linux/bitops.h>
42#include <asm/io.h>
43
44#include <linux/device.h>
45#include <linux/firmware.h>
46
47#include <pcmcia/cistpl.h>
48#include <pcmcia/ciscode.h>
49#include <pcmcia/ds.h>
50#include <pcmcia/cisreg.h>
51
52#include <net/bluetooth/bluetooth.h>
53#include <net/bluetooth/hci_core.h>
54
55
56
57/* ======================== Module parameters ======================== */
58
59
60MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
61MODULE_DESCRIPTION("Bluetooth driver for the 3Com Bluetooth PCMCIA card");
62MODULE_LICENSE("GPL");
63MODULE_FIRMWARE("BT3CPCC.bin");
64
65
66
67/* ======================== Local structures ======================== */
68
69
70struct bt3c_info {
71	struct pcmcia_device *p_dev;
72
73	struct hci_dev *hdev;
74
75	spinlock_t lock;		/* For serializing operations */
76
77	struct sk_buff_head txq;
78	unsigned long tx_state;
79
80	unsigned long rx_state;
81	unsigned long rx_count;
82	struct sk_buff *rx_skb;
83};
84
85
86static int bt3c_config(struct pcmcia_device *link);
87static void bt3c_release(struct pcmcia_device *link);
88
89static void bt3c_detach(struct pcmcia_device *p_dev);
90
91
92/* Transmit states  */
93#define XMIT_SENDING  1
94#define XMIT_WAKEUP   2
95#define XMIT_WAITING  8
96
97/* Receiver states */
98#define RECV_WAIT_PACKET_TYPE   0
99#define RECV_WAIT_EVENT_HEADER  1
100#define RECV_WAIT_ACL_HEADER    2
101#define RECV_WAIT_SCO_HEADER    3
102#define RECV_WAIT_DATA          4
103
104
105
106/* ======================== Special I/O functions ======================== */
107
108
109#define DATA_L   0
110#define DATA_H   1
111#define ADDR_L   2
112#define ADDR_H   3
113#define CONTROL  4
114
115
116static inline void bt3c_address(unsigned int iobase, unsigned short addr)
117{
118	outb(addr & 0xff, iobase + ADDR_L);
119	outb((addr >> 8) & 0xff, iobase + ADDR_H);
120}
121
122
123static inline void bt3c_put(unsigned int iobase, unsigned short value)
124{
125	outb(value & 0xff, iobase + DATA_L);
126	outb((value >> 8) & 0xff, iobase + DATA_H);
127}
128
129
130static inline void bt3c_io_write(unsigned int iobase, unsigned short addr, unsigned short value)
131{
132	bt3c_address(iobase, addr);
133	bt3c_put(iobase, value);
134}
135
136
137static inline unsigned short bt3c_get(unsigned int iobase)
138{
139	unsigned short value = inb(iobase + DATA_L);
140
141	value |= inb(iobase + DATA_H) << 8;
142
143	return value;
144}
145
146
147static inline unsigned short bt3c_read(unsigned int iobase, unsigned short addr)
148{
149	bt3c_address(iobase, addr);
150
151	return bt3c_get(iobase);
152}
153
154
155
156/* ======================== Interrupt handling ======================== */
157
158
159static int bt3c_write(unsigned int iobase, int fifo_size, __u8 *buf, int len)
160{
161	int actual = 0;
162
163	bt3c_address(iobase, 0x7080);
164
165	/* Fill FIFO with current frame */
166	while (actual < len) {
167		/* Transmit next byte */
168		bt3c_put(iobase, buf[actual]);
169		actual++;
170	}
171
172	bt3c_io_write(iobase, 0x7005, actual);
173
174	return actual;
175}
176
177
178static void bt3c_write_wakeup(struct bt3c_info *info)
179{
180	if (!info) {
181		BT_ERR("Unknown device");
182		return;
183	}
184
185	if (test_and_set_bit(XMIT_SENDING, &(info->tx_state)))
186		return;
187
188	do {
189		unsigned int iobase = info->p_dev->resource[0]->start;
190		register struct sk_buff *skb;
191		int len;
192
193		if (!pcmcia_dev_present(info->p_dev))
194			break;
195
196		skb = skb_dequeue(&(info->txq));
197		if (!skb) {
198			clear_bit(XMIT_SENDING, &(info->tx_state));
199			break;
200		}
201
202		/* Send frame */
203		len = bt3c_write(iobase, 256, skb->data, skb->len);
204
205		if (len != skb->len) {
206			BT_ERR("Very strange");
207		}
208
209		kfree_skb(skb);
210
211		info->hdev->stat.byte_tx += len;
212
213	} while (0);
214}
215
216
217static void bt3c_receive(struct bt3c_info *info)
218{
219	unsigned int iobase;
220	int size = 0, avail;
221
222	if (!info) {
223		BT_ERR("Unknown device");
224		return;
225	}
226
227	iobase = info->p_dev->resource[0]->start;
228
229	avail = bt3c_read(iobase, 0x7006);
230
231	bt3c_address(iobase, 0x7480);
232	while (size < avail) {
233		size++;
234		info->hdev->stat.byte_rx++;
235
236		/* Allocate packet */
237		if (info->rx_skb == NULL) {
238			info->rx_state = RECV_WAIT_PACKET_TYPE;
239			info->rx_count = 0;
240			info->rx_skb = bt_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC);
241			if (!info->rx_skb) {
242				BT_ERR("Can't allocate mem for new packet");
243				return;
244			}
245		}
246
247
248		if (info->rx_state == RECV_WAIT_PACKET_TYPE) {
249
250			bt_cb(info->rx_skb)->pkt_type = inb(iobase + DATA_L);
251			inb(iobase + DATA_H);
252
253			switch (bt_cb(info->rx_skb)->pkt_type) {
254
255			case HCI_EVENT_PKT:
256				info->rx_state = RECV_WAIT_EVENT_HEADER;
257				info->rx_count = HCI_EVENT_HDR_SIZE;
258				break;
259
260			case HCI_ACLDATA_PKT:
261				info->rx_state = RECV_WAIT_ACL_HEADER;
262				info->rx_count = HCI_ACL_HDR_SIZE;
263				break;
264
265			case HCI_SCODATA_PKT:
266				info->rx_state = RECV_WAIT_SCO_HEADER;
267				info->rx_count = HCI_SCO_HDR_SIZE;
268				break;
269
270			default:
271				/* Unknown packet */
272				BT_ERR("Unknown HCI packet with type 0x%02x received", bt_cb(info->rx_skb)->pkt_type);
273				info->hdev->stat.err_rx++;
274				clear_bit(HCI_RUNNING, &(info->hdev->flags));
275
276				kfree_skb(info->rx_skb);
277				info->rx_skb = NULL;
278				break;
279
280			}
281
282		} else {
283
284			__u8 x = inb(iobase + DATA_L);
285
286			*skb_put(info->rx_skb, 1) = x;
287			inb(iobase + DATA_H);
288			info->rx_count--;
289
290			if (info->rx_count == 0) {
291
292				int dlen;
293				struct hci_event_hdr *eh;
294				struct hci_acl_hdr *ah;
295				struct hci_sco_hdr *sh;
296
297				switch (info->rx_state) {
298
299				case RECV_WAIT_EVENT_HEADER:
300					eh = hci_event_hdr(info->rx_skb);
301					info->rx_state = RECV_WAIT_DATA;
302					info->rx_count = eh->plen;
303					break;
304
305				case RECV_WAIT_ACL_HEADER:
306					ah = hci_acl_hdr(info->rx_skb);
307					dlen = __le16_to_cpu(ah->dlen);
308					info->rx_state = RECV_WAIT_DATA;
309					info->rx_count = dlen;
310					break;
311
312				case RECV_WAIT_SCO_HEADER:
313					sh = hci_sco_hdr(info->rx_skb);
314					info->rx_state = RECV_WAIT_DATA;
315					info->rx_count = sh->dlen;
316					break;
317
318				case RECV_WAIT_DATA:
319					hci_recv_frame(info->hdev, info->rx_skb);
320					info->rx_skb = NULL;
321					break;
322
323				}
324
325			}
326
327		}
328
329	}
330
331	bt3c_io_write(iobase, 0x7006, 0x0000);
332}
333
334
335static irqreturn_t bt3c_interrupt(int irq, void *dev_inst)
336{
337	struct bt3c_info *info = dev_inst;
338	unsigned int iobase;
339	int iir;
340	irqreturn_t r = IRQ_NONE;
341
342	if (!info || !info->hdev)
343		/* our irq handler is shared */
344		return IRQ_NONE;
345
346	iobase = info->p_dev->resource[0]->start;
347
348	spin_lock(&(info->lock));
349
350	iir = inb(iobase + CONTROL);
351	if (iir & 0x80) {
352		int stat = bt3c_read(iobase, 0x7001);
353
354		if ((stat & 0xff) == 0x7f) {
355			BT_ERR("Very strange (stat=0x%04x)", stat);
356		} else if ((stat & 0xff) != 0xff) {
357			if (stat & 0x0020) {
358				int status = bt3c_read(iobase, 0x7002) & 0x10;
359				BT_INFO("%s: Antenna %s", info->hdev->name,
360							status ? "out" : "in");
361			}
362			if (stat & 0x0001)
363				bt3c_receive(info);
364			if (stat & 0x0002) {
365				clear_bit(XMIT_SENDING, &(info->tx_state));
366				bt3c_write_wakeup(info);
367			}
368
369			bt3c_io_write(iobase, 0x7001, 0x0000);
370
371			outb(iir, iobase + CONTROL);
372		}
373		r = IRQ_HANDLED;
374	}
375
376	spin_unlock(&(info->lock));
377
378	return r;
379}
380
381
382
383/* ======================== HCI interface ======================== */
384
385
386static int bt3c_hci_flush(struct hci_dev *hdev)
387{
388	struct bt3c_info *info = hci_get_drvdata(hdev);
389
390	/* Drop TX queue */
391	skb_queue_purge(&(info->txq));
392
393	return 0;
394}
395
396
397static int bt3c_hci_open(struct hci_dev *hdev)
398{
399	set_bit(HCI_RUNNING, &(hdev->flags));
400
401	return 0;
402}
403
404
405static int bt3c_hci_close(struct hci_dev *hdev)
406{
407	if (!test_and_clear_bit(HCI_RUNNING, &(hdev->flags)))
408		return 0;
409
410	bt3c_hci_flush(hdev);
411
412	return 0;
413}
414
415
416static int bt3c_hci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
417{
418	struct bt3c_info *info = hci_get_drvdata(hdev);
419	unsigned long flags;
420
421	switch (bt_cb(skb)->pkt_type) {
422	case HCI_COMMAND_PKT:
423		hdev->stat.cmd_tx++;
424		break;
425	case HCI_ACLDATA_PKT:
426		hdev->stat.acl_tx++;
427		break;
428	case HCI_SCODATA_PKT:
429		hdev->stat.sco_tx++;
430		break;
431	};
432
433	/* Prepend skb with frame type */
434	memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1);
435	skb_queue_tail(&(info->txq), skb);
436
437	spin_lock_irqsave(&(info->lock), flags);
438
439	bt3c_write_wakeup(info);
440
441	spin_unlock_irqrestore(&(info->lock), flags);
442
443	return 0;
444}
445
446
447
448/* ======================== Card services HCI interaction ======================== */
449
450
451static int bt3c_load_firmware(struct bt3c_info *info,
452			      const unsigned char *firmware,
453			      int count)
454{
455	char *ptr = (char *) firmware;
456	char b[9];
457	unsigned int iobase, size, addr, fcs, tmp;
458	int i, err = 0;
459
460	iobase = info->p_dev->resource[0]->start;
461
462	/* Reset */
463	bt3c_io_write(iobase, 0x8040, 0x0404);
464	bt3c_io_write(iobase, 0x8040, 0x0400);
465
466	udelay(1);
467
468	bt3c_io_write(iobase, 0x8040, 0x0404);
469
470	udelay(17);
471
472	/* Load */
473	while (count) {
474		if (ptr[0] != 'S') {
475			BT_ERR("Bad address in firmware");
476			err = -EFAULT;
477			goto error;
478		}
479
480		memset(b, 0, sizeof(b));
481		memcpy(b, ptr + 2, 2);
482		size = simple_strtoul(b, NULL, 16);
483
484		memset(b, 0, sizeof(b));
485		memcpy(b, ptr + 4, 8);
486		addr = simple_strtoul(b, NULL, 16);
487
488		memset(b, 0, sizeof(b));
489		memcpy(b, ptr + (size * 2) + 2, 2);
490		fcs = simple_strtoul(b, NULL, 16);
491
492		memset(b, 0, sizeof(b));
493		for (tmp = 0, i = 0; i < size; i++) {
494			memcpy(b, ptr + (i * 2) + 2, 2);
495			tmp += simple_strtol(b, NULL, 16);
496		}
497
498		if (((tmp + fcs) & 0xff) != 0xff) {
499			BT_ERR("Checksum error in firmware");
500			err = -EILSEQ;
501			goto error;
502		}
503
504		if (ptr[1] == '3') {
505			bt3c_address(iobase, addr);
506
507			memset(b, 0, sizeof(b));
508			for (i = 0; i < (size - 4) / 2; i++) {
509				memcpy(b, ptr + (i * 4) + 12, 4);
510				tmp = simple_strtoul(b, NULL, 16);
511				bt3c_put(iobase, tmp);
512			}
513		}
514
515		ptr   += (size * 2) + 6;
516		count -= (size * 2) + 6;
517	}
518
519	udelay(17);
520
521	/* Boot */
522	bt3c_address(iobase, 0x3000);
523	outb(inb(iobase + CONTROL) | 0x40, iobase + CONTROL);
524
525error:
526	udelay(17);
527
528	/* Clear */
529	bt3c_io_write(iobase, 0x7006, 0x0000);
530	bt3c_io_write(iobase, 0x7005, 0x0000);
531	bt3c_io_write(iobase, 0x7001, 0x0000);
532
533	return err;
534}
535
536
537static int bt3c_open(struct bt3c_info *info)
538{
539	const struct firmware *firmware;
540	struct hci_dev *hdev;
541	int err;
542
543	spin_lock_init(&(info->lock));
544
545	skb_queue_head_init(&(info->txq));
546
547	info->rx_state = RECV_WAIT_PACKET_TYPE;
548	info->rx_count = 0;
549	info->rx_skb = NULL;
550
551	/* Initialize HCI device */
552	hdev = hci_alloc_dev();
553	if (!hdev) {
554		BT_ERR("Can't allocate HCI device");
555		return -ENOMEM;
556	}
557
558	info->hdev = hdev;
559
560	hdev->bus = HCI_PCCARD;
561	hci_set_drvdata(hdev, info);
562	SET_HCIDEV_DEV(hdev, &info->p_dev->dev);
563
564	hdev->open  = bt3c_hci_open;
565	hdev->close = bt3c_hci_close;
566	hdev->flush = bt3c_hci_flush;
567	hdev->send  = bt3c_hci_send_frame;
568
569	/* Load firmware */
570	err = request_firmware(&firmware, "BT3CPCC.bin", &info->p_dev->dev);
571	if (err < 0) {
572		BT_ERR("Firmware request failed");
573		goto error;
574	}
575
576	err = bt3c_load_firmware(info, firmware->data, firmware->size);
577
578	release_firmware(firmware);
579
580	if (err < 0) {
581		BT_ERR("Firmware loading failed");
582		goto error;
583	}
584
585	/* Timeout before it is safe to send the first HCI packet */
586	msleep(1000);
587
588	/* Register HCI device */
589	err = hci_register_dev(hdev);
590	if (err < 0) {
591		BT_ERR("Can't register HCI device");
592		goto error;
593	}
594
595	return 0;
596
597error:
598	info->hdev = NULL;
599	hci_free_dev(hdev);
600	return err;
601}
602
603
604static int bt3c_close(struct bt3c_info *info)
605{
606	struct hci_dev *hdev = info->hdev;
607
608	if (!hdev)
609		return -ENODEV;
610
611	bt3c_hci_close(hdev);
612
613	hci_unregister_dev(hdev);
614	hci_free_dev(hdev);
615
616	return 0;
617}
618
619static int bt3c_probe(struct pcmcia_device *link)
620{
621	struct bt3c_info *info;
622
623	/* Create new info device */
624	info = devm_kzalloc(&link->dev, sizeof(*info), GFP_KERNEL);
625	if (!info)
626		return -ENOMEM;
627
628	info->p_dev = link;
629	link->priv = info;
630
631	link->config_flags |= CONF_ENABLE_IRQ | CONF_AUTO_SET_VPP |
632		CONF_AUTO_SET_IO;
633
634	return bt3c_config(link);
635}
636
637
638static void bt3c_detach(struct pcmcia_device *link)
639{
640	bt3c_release(link);
641}
642
643static int bt3c_check_config(struct pcmcia_device *p_dev, void *priv_data)
644{
645	int *try = priv_data;
646
647	if (!try)
648		p_dev->io_lines = 16;
649
650	if ((p_dev->resource[0]->end != 8) || (p_dev->resource[0]->start == 0))
651		return -EINVAL;
652
653	p_dev->resource[0]->end = 8;
654	p_dev->resource[0]->flags &= ~IO_DATA_PATH_WIDTH;
655	p_dev->resource[0]->flags |= IO_DATA_PATH_WIDTH_8;
656
657	return pcmcia_request_io(p_dev);
658}
659
660static int bt3c_check_config_notpicky(struct pcmcia_device *p_dev,
661				      void *priv_data)
662{
663	static unsigned int base[5] = { 0x3f8, 0x2f8, 0x3e8, 0x2e8, 0x0 };
664	int j;
665
666	if (p_dev->io_lines > 3)
667		return -ENODEV;
668
669	p_dev->resource[0]->flags &= ~IO_DATA_PATH_WIDTH;
670	p_dev->resource[0]->flags |= IO_DATA_PATH_WIDTH_8;
671	p_dev->resource[0]->end = 8;
672
673	for (j = 0; j < 5; j++) {
674		p_dev->resource[0]->start = base[j];
675		p_dev->io_lines = base[j] ? 16 : 3;
676		if (!pcmcia_request_io(p_dev))
677			return 0;
678	}
679	return -ENODEV;
680}
681
682static int bt3c_config(struct pcmcia_device *link)
683{
684	struct bt3c_info *info = link->priv;
685	int i;
686	unsigned long try;
687
688	/* First pass: look for a config entry that looks normal.
689	   Two tries: without IO aliases, then with aliases */
690	for (try = 0; try < 2; try++)
691		if (!pcmcia_loop_config(link, bt3c_check_config, (void *) try))
692			goto found_port;
693
694	/* Second pass: try to find an entry that isn't picky about
695	   its base address, then try to grab any standard serial port
696	   address, and finally try to get any free port. */
697	if (!pcmcia_loop_config(link, bt3c_check_config_notpicky, NULL))
698		goto found_port;
699
700	BT_ERR("No usable port range found");
701	goto failed;
702
703found_port:
704	i = pcmcia_request_irq(link, &bt3c_interrupt);
705	if (i != 0)
706		goto failed;
707
708	i = pcmcia_enable_device(link);
709	if (i != 0)
710		goto failed;
711
712	if (bt3c_open(info) != 0)
713		goto failed;
714
715	return 0;
716
717failed:
718	bt3c_release(link);
719	return -ENODEV;
720}
721
722
723static void bt3c_release(struct pcmcia_device *link)
724{
725	struct bt3c_info *info = link->priv;
726
727	bt3c_close(info);
728
729	pcmcia_disable_device(link);
730}
731
732
733static const struct pcmcia_device_id bt3c_ids[] = {
734	PCMCIA_DEVICE_PROD_ID13("3COM", "Bluetooth PC Card", 0xefce0a31, 0xd4ce9b02),
735	PCMCIA_DEVICE_NULL
736};
737MODULE_DEVICE_TABLE(pcmcia, bt3c_ids);
738
739static struct pcmcia_driver bt3c_driver = {
740	.owner		= THIS_MODULE,
741	.name		= "bt3c_cs",
742	.probe		= bt3c_probe,
743	.remove		= bt3c_detach,
744	.id_table	= bt3c_ids,
745};
746module_pcmcia_driver(bt3c_driver);
747