1 /*
2 *
3 * Driver for the 3Com Bluetooth PCMCIA card
4 *
5 * Copyright (C) 2001-2002 Marcel Holtmann <marcel@holtmann.org>
6 * Jose Orlando Pereira <jop@di.uminho.pt>
7 *
8 *
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License version 2 as
11 * published by the Free Software Foundation;
12 *
13 * Software distributed under the License is distributed on an "AS
14 * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
15 * implied. See the License for the specific language governing
16 * rights and limitations under the License.
17 *
18 * The initial developer of the original code is David A. Hinds
19 * <dahinds@users.sourceforge.net>. Portions created by David A. Hinds
20 * are Copyright (C) 1999 David A. Hinds. All Rights Reserved.
21 *
22 */
23
24 #include <linux/module.h>
25
26 #include <linux/kernel.h>
27 #include <linux/init.h>
28 #include <linux/slab.h>
29 #include <linux/types.h>
30 #include <linux/delay.h>
31 #include <linux/errno.h>
32 #include <linux/ptrace.h>
33 #include <linux/ioport.h>
34 #include <linux/spinlock.h>
35 #include <linux/moduleparam.h>
36
37 #include <linux/skbuff.h>
38 #include <linux/string.h>
39 #include <linux/serial.h>
40 #include <linux/serial_reg.h>
41 #include <linux/bitops.h>
42 #include <asm/io.h>
43
44 #include <linux/device.h>
45 #include <linux/firmware.h>
46
47 #include <pcmcia/cistpl.h>
48 #include <pcmcia/ciscode.h>
49 #include <pcmcia/ds.h>
50 #include <pcmcia/cisreg.h>
51
52 #include <net/bluetooth/bluetooth.h>
53 #include <net/bluetooth/hci_core.h>
54
55
56
57 /* ======================== Module parameters ======================== */
58
59
60 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
61 MODULE_DESCRIPTION("Bluetooth driver for the 3Com Bluetooth PCMCIA card");
62 MODULE_LICENSE("GPL");
63 MODULE_FIRMWARE("BT3CPCC.bin");
64
65
66
67 /* ======================== Local structures ======================== */
68
69
70 struct bt3c_info {
71 struct pcmcia_device *p_dev;
72
73 struct hci_dev *hdev;
74
75 spinlock_t lock; /* For serializing operations */
76
77 struct sk_buff_head txq;
78 unsigned long tx_state;
79
80 unsigned long rx_state;
81 unsigned long rx_count;
82 struct sk_buff *rx_skb;
83 };
84
85
86 static int bt3c_config(struct pcmcia_device *link);
87 static void bt3c_release(struct pcmcia_device *link);
88
89 static void bt3c_detach(struct pcmcia_device *p_dev);
90
91
92 /* Transmit states */
93 #define XMIT_SENDING 1
94 #define XMIT_WAKEUP 2
95 #define XMIT_WAITING 8
96
97 /* Receiver states */
98 #define RECV_WAIT_PACKET_TYPE 0
99 #define RECV_WAIT_EVENT_HEADER 1
100 #define RECV_WAIT_ACL_HEADER 2
101 #define RECV_WAIT_SCO_HEADER 3
102 #define RECV_WAIT_DATA 4
103
104
105
106 /* ======================== Special I/O functions ======================== */
107
108
109 #define DATA_L 0
110 #define DATA_H 1
111 #define ADDR_L 2
112 #define ADDR_H 3
113 #define CONTROL 4
114
115
bt3c_address(unsigned int iobase,unsigned short addr)116 static inline void bt3c_address(unsigned int iobase, unsigned short addr)
117 {
118 outb(addr & 0xff, iobase + ADDR_L);
119 outb((addr >> 8) & 0xff, iobase + ADDR_H);
120 }
121
122
bt3c_put(unsigned int iobase,unsigned short value)123 static inline void bt3c_put(unsigned int iobase, unsigned short value)
124 {
125 outb(value & 0xff, iobase + DATA_L);
126 outb((value >> 8) & 0xff, iobase + DATA_H);
127 }
128
129
bt3c_io_write(unsigned int iobase,unsigned short addr,unsigned short value)130 static inline void bt3c_io_write(unsigned int iobase, unsigned short addr, unsigned short value)
131 {
132 bt3c_address(iobase, addr);
133 bt3c_put(iobase, value);
134 }
135
136
bt3c_get(unsigned int iobase)137 static inline unsigned short bt3c_get(unsigned int iobase)
138 {
139 unsigned short value = inb(iobase + DATA_L);
140
141 value |= inb(iobase + DATA_H) << 8;
142
143 return value;
144 }
145
146
bt3c_read(unsigned int iobase,unsigned short addr)147 static inline unsigned short bt3c_read(unsigned int iobase, unsigned short addr)
148 {
149 bt3c_address(iobase, addr);
150
151 return bt3c_get(iobase);
152 }
153
154
155
156 /* ======================== Interrupt handling ======================== */
157
158
bt3c_write(unsigned int iobase,int fifo_size,__u8 * buf,int len)159 static int bt3c_write(unsigned int iobase, int fifo_size, __u8 *buf, int len)
160 {
161 int actual = 0;
162
163 bt3c_address(iobase, 0x7080);
164
165 /* Fill FIFO with current frame */
166 while (actual < len) {
167 /* Transmit next byte */
168 bt3c_put(iobase, buf[actual]);
169 actual++;
170 }
171
172 bt3c_io_write(iobase, 0x7005, actual);
173
174 return actual;
175 }
176
177
bt3c_write_wakeup(struct bt3c_info * info)178 static void bt3c_write_wakeup(struct bt3c_info *info)
179 {
180 if (!info) {
181 BT_ERR("Unknown device");
182 return;
183 }
184
185 if (test_and_set_bit(XMIT_SENDING, &(info->tx_state)))
186 return;
187
188 do {
189 unsigned int iobase = info->p_dev->resource[0]->start;
190 register struct sk_buff *skb;
191 int len;
192
193 if (!pcmcia_dev_present(info->p_dev))
194 break;
195
196 skb = skb_dequeue(&(info->txq));
197 if (!skb) {
198 clear_bit(XMIT_SENDING, &(info->tx_state));
199 break;
200 }
201
202 /* Send frame */
203 len = bt3c_write(iobase, 256, skb->data, skb->len);
204
205 if (len != skb->len)
206 BT_ERR("Very strange");
207
208 kfree_skb(skb);
209
210 info->hdev->stat.byte_tx += len;
211
212 } while (0);
213 }
214
215
bt3c_receive(struct bt3c_info * info)216 static void bt3c_receive(struct bt3c_info *info)
217 {
218 unsigned int iobase;
219 int size = 0, avail;
220
221 if (!info) {
222 BT_ERR("Unknown device");
223 return;
224 }
225
226 iobase = info->p_dev->resource[0]->start;
227
228 avail = bt3c_read(iobase, 0x7006);
229
230 bt3c_address(iobase, 0x7480);
231 while (size < avail) {
232 size++;
233 info->hdev->stat.byte_rx++;
234
235 /* Allocate packet */
236 if (!info->rx_skb) {
237 info->rx_state = RECV_WAIT_PACKET_TYPE;
238 info->rx_count = 0;
239 info->rx_skb = bt_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC);
240 if (!info->rx_skb) {
241 BT_ERR("Can't allocate mem for new packet");
242 return;
243 }
244 }
245
246
247 if (info->rx_state == RECV_WAIT_PACKET_TYPE) {
248
249 hci_skb_pkt_type(info->rx_skb) = inb(iobase + DATA_L);
250 inb(iobase + DATA_H);
251
252 switch (hci_skb_pkt_type(info->rx_skb)) {
253
254 case HCI_EVENT_PKT:
255 info->rx_state = RECV_WAIT_EVENT_HEADER;
256 info->rx_count = HCI_EVENT_HDR_SIZE;
257 break;
258
259 case HCI_ACLDATA_PKT:
260 info->rx_state = RECV_WAIT_ACL_HEADER;
261 info->rx_count = HCI_ACL_HDR_SIZE;
262 break;
263
264 case HCI_SCODATA_PKT:
265 info->rx_state = RECV_WAIT_SCO_HEADER;
266 info->rx_count = HCI_SCO_HDR_SIZE;
267 break;
268
269 default:
270 /* Unknown packet */
271 BT_ERR("Unknown HCI packet with type 0x%02x received",
272 hci_skb_pkt_type(info->rx_skb));
273 info->hdev->stat.err_rx++;
274
275 kfree_skb(info->rx_skb);
276 info->rx_skb = NULL;
277 break;
278
279 }
280
281 } else {
282
283 __u8 x = inb(iobase + DATA_L);
284
285 skb_put_u8(info->rx_skb, x);
286 inb(iobase + DATA_H);
287 info->rx_count--;
288
289 if (info->rx_count == 0) {
290
291 int dlen;
292 struct hci_event_hdr *eh;
293 struct hci_acl_hdr *ah;
294 struct hci_sco_hdr *sh;
295
296 switch (info->rx_state) {
297
298 case RECV_WAIT_EVENT_HEADER:
299 eh = hci_event_hdr(info->rx_skb);
300 info->rx_state = RECV_WAIT_DATA;
301 info->rx_count = eh->plen;
302 break;
303
304 case RECV_WAIT_ACL_HEADER:
305 ah = hci_acl_hdr(info->rx_skb);
306 dlen = __le16_to_cpu(ah->dlen);
307 info->rx_state = RECV_WAIT_DATA;
308 info->rx_count = dlen;
309 break;
310
311 case RECV_WAIT_SCO_HEADER:
312 sh = hci_sco_hdr(info->rx_skb);
313 info->rx_state = RECV_WAIT_DATA;
314 info->rx_count = sh->dlen;
315 break;
316
317 case RECV_WAIT_DATA:
318 hci_recv_frame(info->hdev, info->rx_skb);
319 info->rx_skb = NULL;
320 break;
321
322 }
323
324 }
325
326 }
327
328 }
329
330 bt3c_io_write(iobase, 0x7006, 0x0000);
331 }
332
333
bt3c_interrupt(int irq,void * dev_inst)334 static irqreturn_t bt3c_interrupt(int irq, void *dev_inst)
335 {
336 struct bt3c_info *info = dev_inst;
337 unsigned int iobase;
338 int iir;
339 irqreturn_t r = IRQ_NONE;
340
341 if (!info || !info->hdev)
342 /* our irq handler is shared */
343 return IRQ_NONE;
344
345 iobase = info->p_dev->resource[0]->start;
346
347 spin_lock(&(info->lock));
348
349 iir = inb(iobase + CONTROL);
350 if (iir & 0x80) {
351 int stat = bt3c_read(iobase, 0x7001);
352
353 if ((stat & 0xff) == 0x7f) {
354 BT_ERR("Very strange (stat=0x%04x)", stat);
355 } else if ((stat & 0xff) != 0xff) {
356 if (stat & 0x0020) {
357 int status = bt3c_read(iobase, 0x7002) & 0x10;
358 bt_dev_info(info->hdev, "Antenna %s",
359 status ? "out" : "in");
360 }
361 if (stat & 0x0001)
362 bt3c_receive(info);
363 if (stat & 0x0002) {
364 clear_bit(XMIT_SENDING, &(info->tx_state));
365 bt3c_write_wakeup(info);
366 }
367
368 bt3c_io_write(iobase, 0x7001, 0x0000);
369
370 outb(iir, iobase + CONTROL);
371 }
372 r = IRQ_HANDLED;
373 }
374
375 spin_unlock(&(info->lock));
376
377 return r;
378 }
379
380
381
382 /* ======================== HCI interface ======================== */
383
384
bt3c_hci_flush(struct hci_dev * hdev)385 static int bt3c_hci_flush(struct hci_dev *hdev)
386 {
387 struct bt3c_info *info = hci_get_drvdata(hdev);
388
389 /* Drop TX queue */
390 skb_queue_purge(&(info->txq));
391
392 return 0;
393 }
394
395
bt3c_hci_open(struct hci_dev * hdev)396 static int bt3c_hci_open(struct hci_dev *hdev)
397 {
398 return 0;
399 }
400
401
bt3c_hci_close(struct hci_dev * hdev)402 static int bt3c_hci_close(struct hci_dev *hdev)
403 {
404 bt3c_hci_flush(hdev);
405
406 return 0;
407 }
408
409
bt3c_hci_send_frame(struct hci_dev * hdev,struct sk_buff * skb)410 static int bt3c_hci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
411 {
412 struct bt3c_info *info = hci_get_drvdata(hdev);
413 unsigned long flags;
414
415 switch (hci_skb_pkt_type(skb)) {
416 case HCI_COMMAND_PKT:
417 hdev->stat.cmd_tx++;
418 break;
419 case HCI_ACLDATA_PKT:
420 hdev->stat.acl_tx++;
421 break;
422 case HCI_SCODATA_PKT:
423 hdev->stat.sco_tx++;
424 break;
425 }
426
427 /* Prepend skb with frame type */
428 memcpy(skb_push(skb, 1), &hci_skb_pkt_type(skb), 1);
429 skb_queue_tail(&(info->txq), skb);
430
431 spin_lock_irqsave(&(info->lock), flags);
432
433 bt3c_write_wakeup(info);
434
435 spin_unlock_irqrestore(&(info->lock), flags);
436
437 return 0;
438 }
439
440
441
442 /* ======================== Card services HCI interaction ======================== */
443
444
bt3c_load_firmware(struct bt3c_info * info,const unsigned char * firmware,int count)445 static int bt3c_load_firmware(struct bt3c_info *info,
446 const unsigned char *firmware,
447 int count)
448 {
449 char *ptr = (char *) firmware;
450 char b[9];
451 unsigned int iobase, tmp, tn;
452 unsigned long size, addr, fcs;
453 int i, err = 0;
454
455 iobase = info->p_dev->resource[0]->start;
456
457 /* Reset */
458 bt3c_io_write(iobase, 0x8040, 0x0404);
459 bt3c_io_write(iobase, 0x8040, 0x0400);
460
461 udelay(1);
462
463 bt3c_io_write(iobase, 0x8040, 0x0404);
464
465 udelay(17);
466
467 /* Load */
468 while (count) {
469 if (ptr[0] != 'S') {
470 BT_ERR("Bad address in firmware");
471 err = -EFAULT;
472 goto error;
473 }
474
475 memset(b, 0, sizeof(b));
476 memcpy(b, ptr + 2, 2);
477 if (kstrtoul(b, 16, &size) < 0)
478 return -EINVAL;
479
480 memset(b, 0, sizeof(b));
481 memcpy(b, ptr + 4, 8);
482 if (kstrtoul(b, 16, &addr) < 0)
483 return -EINVAL;
484
485 memset(b, 0, sizeof(b));
486 memcpy(b, ptr + (size * 2) + 2, 2);
487 if (kstrtoul(b, 16, &fcs) < 0)
488 return -EINVAL;
489
490 memset(b, 0, sizeof(b));
491 for (tmp = 0, i = 0; i < size; i++) {
492 memcpy(b, ptr + (i * 2) + 2, 2);
493 if (kstrtouint(b, 16, &tn))
494 return -EINVAL;
495 tmp += tn;
496 }
497
498 if (((tmp + fcs) & 0xff) != 0xff) {
499 BT_ERR("Checksum error in firmware");
500 err = -EILSEQ;
501 goto error;
502 }
503
504 if (ptr[1] == '3') {
505 bt3c_address(iobase, addr);
506
507 memset(b, 0, sizeof(b));
508 for (i = 0; i < (size - 4) / 2; i++) {
509 memcpy(b, ptr + (i * 4) + 12, 4);
510 if (kstrtouint(b, 16, &tmp))
511 return -EINVAL;
512 bt3c_put(iobase, tmp);
513 }
514 }
515
516 ptr += (size * 2) + 6;
517 count -= (size * 2) + 6;
518 }
519
520 udelay(17);
521
522 /* Boot */
523 bt3c_address(iobase, 0x3000);
524 outb(inb(iobase + CONTROL) | 0x40, iobase + CONTROL);
525
526 error:
527 udelay(17);
528
529 /* Clear */
530 bt3c_io_write(iobase, 0x7006, 0x0000);
531 bt3c_io_write(iobase, 0x7005, 0x0000);
532 bt3c_io_write(iobase, 0x7001, 0x0000);
533
534 return err;
535 }
536
537
bt3c_open(struct bt3c_info * info)538 static int bt3c_open(struct bt3c_info *info)
539 {
540 const struct firmware *firmware;
541 struct hci_dev *hdev;
542 int err;
543
544 spin_lock_init(&(info->lock));
545
546 skb_queue_head_init(&(info->txq));
547
548 info->rx_state = RECV_WAIT_PACKET_TYPE;
549 info->rx_count = 0;
550 info->rx_skb = NULL;
551
552 /* Initialize HCI device */
553 hdev = hci_alloc_dev();
554 if (!hdev) {
555 BT_ERR("Can't allocate HCI device");
556 return -ENOMEM;
557 }
558
559 info->hdev = hdev;
560
561 hdev->bus = HCI_PCCARD;
562 hci_set_drvdata(hdev, info);
563 SET_HCIDEV_DEV(hdev, &info->p_dev->dev);
564
565 hdev->open = bt3c_hci_open;
566 hdev->close = bt3c_hci_close;
567 hdev->flush = bt3c_hci_flush;
568 hdev->send = bt3c_hci_send_frame;
569
570 /* Load firmware */
571 err = request_firmware(&firmware, "BT3CPCC.bin", &info->p_dev->dev);
572 if (err < 0) {
573 BT_ERR("Firmware request failed");
574 goto error;
575 }
576
577 err = bt3c_load_firmware(info, firmware->data, firmware->size);
578
579 release_firmware(firmware);
580
581 if (err < 0) {
582 BT_ERR("Firmware loading failed");
583 goto error;
584 }
585
586 /* Timeout before it is safe to send the first HCI packet */
587 msleep(1000);
588
589 /* Register HCI device */
590 err = hci_register_dev(hdev);
591 if (err < 0) {
592 BT_ERR("Can't register HCI device");
593 goto error;
594 }
595
596 return 0;
597
598 error:
599 info->hdev = NULL;
600 hci_free_dev(hdev);
601 return err;
602 }
603
604
bt3c_close(struct bt3c_info * info)605 static int bt3c_close(struct bt3c_info *info)
606 {
607 struct hci_dev *hdev = info->hdev;
608
609 if (!hdev)
610 return -ENODEV;
611
612 bt3c_hci_close(hdev);
613
614 hci_unregister_dev(hdev);
615 hci_free_dev(hdev);
616
617 return 0;
618 }
619
bt3c_probe(struct pcmcia_device * link)620 static int bt3c_probe(struct pcmcia_device *link)
621 {
622 struct bt3c_info *info;
623
624 /* Create new info device */
625 info = devm_kzalloc(&link->dev, sizeof(*info), GFP_KERNEL);
626 if (!info)
627 return -ENOMEM;
628
629 info->p_dev = link;
630 link->priv = info;
631
632 link->config_flags |= CONF_ENABLE_IRQ | CONF_AUTO_SET_VPP |
633 CONF_AUTO_SET_IO;
634
635 return bt3c_config(link);
636 }
637
638
bt3c_detach(struct pcmcia_device * link)639 static void bt3c_detach(struct pcmcia_device *link)
640 {
641 bt3c_release(link);
642 }
643
bt3c_check_config(struct pcmcia_device * p_dev,void * priv_data)644 static int bt3c_check_config(struct pcmcia_device *p_dev, void *priv_data)
645 {
646 int *try = priv_data;
647
648 if (!try)
649 p_dev->io_lines = 16;
650
651 if ((p_dev->resource[0]->end != 8) || (p_dev->resource[0]->start == 0))
652 return -EINVAL;
653
654 p_dev->resource[0]->end = 8;
655 p_dev->resource[0]->flags &= ~IO_DATA_PATH_WIDTH;
656 p_dev->resource[0]->flags |= IO_DATA_PATH_WIDTH_8;
657
658 return pcmcia_request_io(p_dev);
659 }
660
bt3c_check_config_notpicky(struct pcmcia_device * p_dev,void * priv_data)661 static int bt3c_check_config_notpicky(struct pcmcia_device *p_dev,
662 void *priv_data)
663 {
664 static unsigned int base[5] = { 0x3f8, 0x2f8, 0x3e8, 0x2e8, 0x0 };
665 int j;
666
667 if (p_dev->io_lines > 3)
668 return -ENODEV;
669
670 p_dev->resource[0]->flags &= ~IO_DATA_PATH_WIDTH;
671 p_dev->resource[0]->flags |= IO_DATA_PATH_WIDTH_8;
672 p_dev->resource[0]->end = 8;
673
674 for (j = 0; j < 5; j++) {
675 p_dev->resource[0]->start = base[j];
676 p_dev->io_lines = base[j] ? 16 : 3;
677 if (!pcmcia_request_io(p_dev))
678 return 0;
679 }
680 return -ENODEV;
681 }
682
bt3c_config(struct pcmcia_device * link)683 static int bt3c_config(struct pcmcia_device *link)
684 {
685 struct bt3c_info *info = link->priv;
686 int i;
687 unsigned long try;
688
689 /* First pass: look for a config entry that looks normal.
690 * Two tries: without IO aliases, then with aliases
691 */
692 for (try = 0; try < 2; try++)
693 if (!pcmcia_loop_config(link, bt3c_check_config, (void *) try))
694 goto found_port;
695
696 /* Second pass: try to find an entry that isn't picky about
697 * its base address, then try to grab any standard serial port
698 * address, and finally try to get any free port.
699 */
700 if (!pcmcia_loop_config(link, bt3c_check_config_notpicky, NULL))
701 goto found_port;
702
703 BT_ERR("No usable port range found");
704 goto failed;
705
706 found_port:
707 i = pcmcia_request_irq(link, &bt3c_interrupt);
708 if (i != 0)
709 goto failed;
710
711 i = pcmcia_enable_device(link);
712 if (i != 0)
713 goto failed;
714
715 if (bt3c_open(info) != 0)
716 goto failed;
717
718 return 0;
719
720 failed:
721 bt3c_release(link);
722 return -ENODEV;
723 }
724
725
bt3c_release(struct pcmcia_device * link)726 static void bt3c_release(struct pcmcia_device *link)
727 {
728 struct bt3c_info *info = link->priv;
729
730 bt3c_close(info);
731
732 pcmcia_disable_device(link);
733 }
734
735
736 static const struct pcmcia_device_id bt3c_ids[] = {
737 PCMCIA_DEVICE_PROD_ID13("3COM", "Bluetooth PC Card", 0xefce0a31, 0xd4ce9b02),
738 PCMCIA_DEVICE_NULL
739 };
740 MODULE_DEVICE_TABLE(pcmcia, bt3c_ids);
741
742 static struct pcmcia_driver bt3c_driver = {
743 .owner = THIS_MODULE,
744 .name = "bt3c_cs",
745 .probe = bt3c_probe,
746 .remove = bt3c_detach,
747 .id_table = bt3c_ids,
748 };
749 module_pcmcia_driver(bt3c_driver);
750