1 /* 2 * 3 * Driver for the 3Com Bluetooth PCMCIA card 4 * 5 * Copyright (C) 2001-2002 Marcel Holtmann <marcel@holtmann.org> 6 * Jose Orlando Pereira <jop@di.uminho.pt> 7 * 8 * 9 * This program is free software; you can redistribute it and/or modify 10 * it under the terms of the GNU General Public License version 2 as 11 * published by the Free Software Foundation; 12 * 13 * Software distributed under the License is distributed on an "AS 14 * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or 15 * implied. See the License for the specific language governing 16 * rights and limitations under the License. 17 * 18 * The initial developer of the original code is David A. Hinds 19 * <dahinds@users.sourceforge.net>. Portions created by David A. Hinds 20 * are Copyright (C) 1999 David A. Hinds. All Rights Reserved. 21 * 22 */ 23 24 #include <linux/module.h> 25 26 #include <linux/kernel.h> 27 #include <linux/init.h> 28 #include <linux/slab.h> 29 #include <linux/types.h> 30 #include <linux/delay.h> 31 #include <linux/errno.h> 32 #include <linux/ptrace.h> 33 #include <linux/ioport.h> 34 #include <linux/spinlock.h> 35 #include <linux/moduleparam.h> 36 37 #include <linux/skbuff.h> 38 #include <linux/string.h> 39 #include <linux/serial.h> 40 #include <linux/serial_reg.h> 41 #include <linux/bitops.h> 42 #include <asm/io.h> 43 44 #include <linux/device.h> 45 #include <linux/firmware.h> 46 47 #include <pcmcia/cistpl.h> 48 #include <pcmcia/ciscode.h> 49 #include <pcmcia/ds.h> 50 #include <pcmcia/cisreg.h> 51 52 #include <net/bluetooth/bluetooth.h> 53 #include <net/bluetooth/hci_core.h> 54 55 56 57 /* ======================== Module parameters ======================== */ 58 59 60 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>"); 61 MODULE_DESCRIPTION("Bluetooth driver for the 3Com Bluetooth PCMCIA card"); 62 MODULE_LICENSE("GPL"); 63 MODULE_FIRMWARE("BT3CPCC.bin"); 64 65 66 67 /* ======================== Local structures ======================== */ 68 69 70 struct bt3c_info { 71 struct pcmcia_device *p_dev; 72 73 struct hci_dev *hdev; 74 75 spinlock_t lock; /* For serializing operations */ 76 77 struct sk_buff_head txq; 78 unsigned long tx_state; 79 80 unsigned long rx_state; 81 unsigned long rx_count; 82 struct sk_buff *rx_skb; 83 }; 84 85 86 static int bt3c_config(struct pcmcia_device *link); 87 static void bt3c_release(struct pcmcia_device *link); 88 89 static void bt3c_detach(struct pcmcia_device *p_dev); 90 91 92 /* Transmit states */ 93 #define XMIT_SENDING 1 94 #define XMIT_WAKEUP 2 95 #define XMIT_WAITING 8 96 97 /* Receiver states */ 98 #define RECV_WAIT_PACKET_TYPE 0 99 #define RECV_WAIT_EVENT_HEADER 1 100 #define RECV_WAIT_ACL_HEADER 2 101 #define RECV_WAIT_SCO_HEADER 3 102 #define RECV_WAIT_DATA 4 103 104 105 106 /* ======================== Special I/O functions ======================== */ 107 108 109 #define DATA_L 0 110 #define DATA_H 1 111 #define ADDR_L 2 112 #define ADDR_H 3 113 #define CONTROL 4 114 115 116 static inline void bt3c_address(unsigned int iobase, unsigned short addr) 117 { 118 outb(addr & 0xff, iobase + ADDR_L); 119 outb((addr >> 8) & 0xff, iobase + ADDR_H); 120 } 121 122 123 static inline void bt3c_put(unsigned int iobase, unsigned short value) 124 { 125 outb(value & 0xff, iobase + DATA_L); 126 outb((value >> 8) & 0xff, iobase + DATA_H); 127 } 128 129 130 static inline void bt3c_io_write(unsigned int iobase, unsigned short addr, unsigned short value) 131 { 132 bt3c_address(iobase, addr); 133 bt3c_put(iobase, value); 134 } 135 136 137 static inline unsigned short bt3c_get(unsigned int iobase) 138 { 139 unsigned short value = inb(iobase + DATA_L); 140 141 value |= inb(iobase + DATA_H) << 8; 142 143 return value; 144 } 145 146 147 static inline unsigned short bt3c_read(unsigned int iobase, unsigned short addr) 148 { 149 bt3c_address(iobase, addr); 150 151 return bt3c_get(iobase); 152 } 153 154 155 156 /* ======================== Interrupt handling ======================== */ 157 158 159 static int bt3c_write(unsigned int iobase, int fifo_size, __u8 *buf, int len) 160 { 161 int actual = 0; 162 163 bt3c_address(iobase, 0x7080); 164 165 /* Fill FIFO with current frame */ 166 while (actual < len) { 167 /* Transmit next byte */ 168 bt3c_put(iobase, buf[actual]); 169 actual++; 170 } 171 172 bt3c_io_write(iobase, 0x7005, actual); 173 174 return actual; 175 } 176 177 178 static void bt3c_write_wakeup(struct bt3c_info *info) 179 { 180 if (!info) { 181 BT_ERR("Unknown device"); 182 return; 183 } 184 185 if (test_and_set_bit(XMIT_SENDING, &(info->tx_state))) 186 return; 187 188 do { 189 unsigned int iobase = info->p_dev->resource[0]->start; 190 register struct sk_buff *skb; 191 int len; 192 193 if (!pcmcia_dev_present(info->p_dev)) 194 break; 195 196 skb = skb_dequeue(&(info->txq)); 197 if (!skb) { 198 clear_bit(XMIT_SENDING, &(info->tx_state)); 199 break; 200 } 201 202 /* Send frame */ 203 len = bt3c_write(iobase, 256, skb->data, skb->len); 204 205 if (len != skb->len) 206 BT_ERR("Very strange"); 207 208 kfree_skb(skb); 209 210 info->hdev->stat.byte_tx += len; 211 212 } while (0); 213 } 214 215 216 static void bt3c_receive(struct bt3c_info *info) 217 { 218 unsigned int iobase; 219 int size = 0, avail; 220 221 if (!info) { 222 BT_ERR("Unknown device"); 223 return; 224 } 225 226 iobase = info->p_dev->resource[0]->start; 227 228 avail = bt3c_read(iobase, 0x7006); 229 230 bt3c_address(iobase, 0x7480); 231 while (size < avail) { 232 size++; 233 info->hdev->stat.byte_rx++; 234 235 /* Allocate packet */ 236 if (!info->rx_skb) { 237 info->rx_state = RECV_WAIT_PACKET_TYPE; 238 info->rx_count = 0; 239 info->rx_skb = bt_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC); 240 if (!info->rx_skb) { 241 BT_ERR("Can't allocate mem for new packet"); 242 return; 243 } 244 } 245 246 247 if (info->rx_state == RECV_WAIT_PACKET_TYPE) { 248 249 bt_cb(info->rx_skb)->pkt_type = inb(iobase + DATA_L); 250 inb(iobase + DATA_H); 251 252 switch (bt_cb(info->rx_skb)->pkt_type) { 253 254 case HCI_EVENT_PKT: 255 info->rx_state = RECV_WAIT_EVENT_HEADER; 256 info->rx_count = HCI_EVENT_HDR_SIZE; 257 break; 258 259 case HCI_ACLDATA_PKT: 260 info->rx_state = RECV_WAIT_ACL_HEADER; 261 info->rx_count = HCI_ACL_HDR_SIZE; 262 break; 263 264 case HCI_SCODATA_PKT: 265 info->rx_state = RECV_WAIT_SCO_HEADER; 266 info->rx_count = HCI_SCO_HDR_SIZE; 267 break; 268 269 default: 270 /* Unknown packet */ 271 BT_ERR("Unknown HCI packet with type 0x%02x received", bt_cb(info->rx_skb)->pkt_type); 272 info->hdev->stat.err_rx++; 273 274 kfree_skb(info->rx_skb); 275 info->rx_skb = NULL; 276 break; 277 278 } 279 280 } else { 281 282 __u8 x = inb(iobase + DATA_L); 283 284 *skb_put(info->rx_skb, 1) = x; 285 inb(iobase + DATA_H); 286 info->rx_count--; 287 288 if (info->rx_count == 0) { 289 290 int dlen; 291 struct hci_event_hdr *eh; 292 struct hci_acl_hdr *ah; 293 struct hci_sco_hdr *sh; 294 295 switch (info->rx_state) { 296 297 case RECV_WAIT_EVENT_HEADER: 298 eh = hci_event_hdr(info->rx_skb); 299 info->rx_state = RECV_WAIT_DATA; 300 info->rx_count = eh->plen; 301 break; 302 303 case RECV_WAIT_ACL_HEADER: 304 ah = hci_acl_hdr(info->rx_skb); 305 dlen = __le16_to_cpu(ah->dlen); 306 info->rx_state = RECV_WAIT_DATA; 307 info->rx_count = dlen; 308 break; 309 310 case RECV_WAIT_SCO_HEADER: 311 sh = hci_sco_hdr(info->rx_skb); 312 info->rx_state = RECV_WAIT_DATA; 313 info->rx_count = sh->dlen; 314 break; 315 316 case RECV_WAIT_DATA: 317 hci_recv_frame(info->hdev, info->rx_skb); 318 info->rx_skb = NULL; 319 break; 320 321 } 322 323 } 324 325 } 326 327 } 328 329 bt3c_io_write(iobase, 0x7006, 0x0000); 330 } 331 332 333 static irqreturn_t bt3c_interrupt(int irq, void *dev_inst) 334 { 335 struct bt3c_info *info = dev_inst; 336 unsigned int iobase; 337 int iir; 338 irqreturn_t r = IRQ_NONE; 339 340 if (!info || !info->hdev) 341 /* our irq handler is shared */ 342 return IRQ_NONE; 343 344 iobase = info->p_dev->resource[0]->start; 345 346 spin_lock(&(info->lock)); 347 348 iir = inb(iobase + CONTROL); 349 if (iir & 0x80) { 350 int stat = bt3c_read(iobase, 0x7001); 351 352 if ((stat & 0xff) == 0x7f) { 353 BT_ERR("Very strange (stat=0x%04x)", stat); 354 } else if ((stat & 0xff) != 0xff) { 355 if (stat & 0x0020) { 356 int status = bt3c_read(iobase, 0x7002) & 0x10; 357 BT_INFO("%s: Antenna %s", info->hdev->name, 358 status ? "out" : "in"); 359 } 360 if (stat & 0x0001) 361 bt3c_receive(info); 362 if (stat & 0x0002) { 363 clear_bit(XMIT_SENDING, &(info->tx_state)); 364 bt3c_write_wakeup(info); 365 } 366 367 bt3c_io_write(iobase, 0x7001, 0x0000); 368 369 outb(iir, iobase + CONTROL); 370 } 371 r = IRQ_HANDLED; 372 } 373 374 spin_unlock(&(info->lock)); 375 376 return r; 377 } 378 379 380 381 /* ======================== HCI interface ======================== */ 382 383 384 static int bt3c_hci_flush(struct hci_dev *hdev) 385 { 386 struct bt3c_info *info = hci_get_drvdata(hdev); 387 388 /* Drop TX queue */ 389 skb_queue_purge(&(info->txq)); 390 391 return 0; 392 } 393 394 395 static int bt3c_hci_open(struct hci_dev *hdev) 396 { 397 return 0; 398 } 399 400 401 static int bt3c_hci_close(struct hci_dev *hdev) 402 { 403 bt3c_hci_flush(hdev); 404 405 return 0; 406 } 407 408 409 static int bt3c_hci_send_frame(struct hci_dev *hdev, struct sk_buff *skb) 410 { 411 struct bt3c_info *info = hci_get_drvdata(hdev); 412 unsigned long flags; 413 414 switch (bt_cb(skb)->pkt_type) { 415 case HCI_COMMAND_PKT: 416 hdev->stat.cmd_tx++; 417 break; 418 case HCI_ACLDATA_PKT: 419 hdev->stat.acl_tx++; 420 break; 421 case HCI_SCODATA_PKT: 422 hdev->stat.sco_tx++; 423 break; 424 } 425 426 /* Prepend skb with frame type */ 427 memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1); 428 skb_queue_tail(&(info->txq), skb); 429 430 spin_lock_irqsave(&(info->lock), flags); 431 432 bt3c_write_wakeup(info); 433 434 spin_unlock_irqrestore(&(info->lock), flags); 435 436 return 0; 437 } 438 439 440 441 /* ======================== Card services HCI interaction ======================== */ 442 443 444 static int bt3c_load_firmware(struct bt3c_info *info, 445 const unsigned char *firmware, 446 int count) 447 { 448 char *ptr = (char *) firmware; 449 char b[9]; 450 unsigned int iobase, tmp; 451 unsigned long size, addr, fcs; 452 int i, err = 0; 453 454 iobase = info->p_dev->resource[0]->start; 455 456 /* Reset */ 457 bt3c_io_write(iobase, 0x8040, 0x0404); 458 bt3c_io_write(iobase, 0x8040, 0x0400); 459 460 udelay(1); 461 462 bt3c_io_write(iobase, 0x8040, 0x0404); 463 464 udelay(17); 465 466 /* Load */ 467 while (count) { 468 if (ptr[0] != 'S') { 469 BT_ERR("Bad address in firmware"); 470 err = -EFAULT; 471 goto error; 472 } 473 474 memset(b, 0, sizeof(b)); 475 memcpy(b, ptr + 2, 2); 476 if (kstrtoul(b, 16, &size) < 0) 477 return -EINVAL; 478 479 memset(b, 0, sizeof(b)); 480 memcpy(b, ptr + 4, 8); 481 if (kstrtoul(b, 16, &addr) < 0) 482 return -EINVAL; 483 484 memset(b, 0, sizeof(b)); 485 memcpy(b, ptr + (size * 2) + 2, 2); 486 if (kstrtoul(b, 16, &fcs) < 0) 487 return -EINVAL; 488 489 memset(b, 0, sizeof(b)); 490 for (tmp = 0, i = 0; i < size; i++) { 491 memcpy(b, ptr + (i * 2) + 2, 2); 492 tmp += simple_strtol(b, NULL, 16); 493 } 494 495 if (((tmp + fcs) & 0xff) != 0xff) { 496 BT_ERR("Checksum error in firmware"); 497 err = -EILSEQ; 498 goto error; 499 } 500 501 if (ptr[1] == '3') { 502 bt3c_address(iobase, addr); 503 504 memset(b, 0, sizeof(b)); 505 for (i = 0; i < (size - 4) / 2; i++) { 506 memcpy(b, ptr + (i * 4) + 12, 4); 507 tmp = simple_strtoul(b, NULL, 16); 508 bt3c_put(iobase, tmp); 509 } 510 } 511 512 ptr += (size * 2) + 6; 513 count -= (size * 2) + 6; 514 } 515 516 udelay(17); 517 518 /* Boot */ 519 bt3c_address(iobase, 0x3000); 520 outb(inb(iobase + CONTROL) | 0x40, iobase + CONTROL); 521 522 error: 523 udelay(17); 524 525 /* Clear */ 526 bt3c_io_write(iobase, 0x7006, 0x0000); 527 bt3c_io_write(iobase, 0x7005, 0x0000); 528 bt3c_io_write(iobase, 0x7001, 0x0000); 529 530 return err; 531 } 532 533 534 static int bt3c_open(struct bt3c_info *info) 535 { 536 const struct firmware *firmware; 537 struct hci_dev *hdev; 538 int err; 539 540 spin_lock_init(&(info->lock)); 541 542 skb_queue_head_init(&(info->txq)); 543 544 info->rx_state = RECV_WAIT_PACKET_TYPE; 545 info->rx_count = 0; 546 info->rx_skb = NULL; 547 548 /* Initialize HCI device */ 549 hdev = hci_alloc_dev(); 550 if (!hdev) { 551 BT_ERR("Can't allocate HCI device"); 552 return -ENOMEM; 553 } 554 555 info->hdev = hdev; 556 557 hdev->bus = HCI_PCCARD; 558 hci_set_drvdata(hdev, info); 559 SET_HCIDEV_DEV(hdev, &info->p_dev->dev); 560 561 hdev->open = bt3c_hci_open; 562 hdev->close = bt3c_hci_close; 563 hdev->flush = bt3c_hci_flush; 564 hdev->send = bt3c_hci_send_frame; 565 566 /* Load firmware */ 567 err = request_firmware(&firmware, "BT3CPCC.bin", &info->p_dev->dev); 568 if (err < 0) { 569 BT_ERR("Firmware request failed"); 570 goto error; 571 } 572 573 err = bt3c_load_firmware(info, firmware->data, firmware->size); 574 575 release_firmware(firmware); 576 577 if (err < 0) { 578 BT_ERR("Firmware loading failed"); 579 goto error; 580 } 581 582 /* Timeout before it is safe to send the first HCI packet */ 583 msleep(1000); 584 585 /* Register HCI device */ 586 err = hci_register_dev(hdev); 587 if (err < 0) { 588 BT_ERR("Can't register HCI device"); 589 goto error; 590 } 591 592 return 0; 593 594 error: 595 info->hdev = NULL; 596 hci_free_dev(hdev); 597 return err; 598 } 599 600 601 static int bt3c_close(struct bt3c_info *info) 602 { 603 struct hci_dev *hdev = info->hdev; 604 605 if (!hdev) 606 return -ENODEV; 607 608 bt3c_hci_close(hdev); 609 610 hci_unregister_dev(hdev); 611 hci_free_dev(hdev); 612 613 return 0; 614 } 615 616 static int bt3c_probe(struct pcmcia_device *link) 617 { 618 struct bt3c_info *info; 619 620 /* Create new info device */ 621 info = devm_kzalloc(&link->dev, sizeof(*info), GFP_KERNEL); 622 if (!info) 623 return -ENOMEM; 624 625 info->p_dev = link; 626 link->priv = info; 627 628 link->config_flags |= CONF_ENABLE_IRQ | CONF_AUTO_SET_VPP | 629 CONF_AUTO_SET_IO; 630 631 return bt3c_config(link); 632 } 633 634 635 static void bt3c_detach(struct pcmcia_device *link) 636 { 637 bt3c_release(link); 638 } 639 640 static int bt3c_check_config(struct pcmcia_device *p_dev, void *priv_data) 641 { 642 int *try = priv_data; 643 644 if (!try) 645 p_dev->io_lines = 16; 646 647 if ((p_dev->resource[0]->end != 8) || (p_dev->resource[0]->start == 0)) 648 return -EINVAL; 649 650 p_dev->resource[0]->end = 8; 651 p_dev->resource[0]->flags &= ~IO_DATA_PATH_WIDTH; 652 p_dev->resource[0]->flags |= IO_DATA_PATH_WIDTH_8; 653 654 return pcmcia_request_io(p_dev); 655 } 656 657 static int bt3c_check_config_notpicky(struct pcmcia_device *p_dev, 658 void *priv_data) 659 { 660 static unsigned int base[5] = { 0x3f8, 0x2f8, 0x3e8, 0x2e8, 0x0 }; 661 int j; 662 663 if (p_dev->io_lines > 3) 664 return -ENODEV; 665 666 p_dev->resource[0]->flags &= ~IO_DATA_PATH_WIDTH; 667 p_dev->resource[0]->flags |= IO_DATA_PATH_WIDTH_8; 668 p_dev->resource[0]->end = 8; 669 670 for (j = 0; j < 5; j++) { 671 p_dev->resource[0]->start = base[j]; 672 p_dev->io_lines = base[j] ? 16 : 3; 673 if (!pcmcia_request_io(p_dev)) 674 return 0; 675 } 676 return -ENODEV; 677 } 678 679 static int bt3c_config(struct pcmcia_device *link) 680 { 681 struct bt3c_info *info = link->priv; 682 int i; 683 unsigned long try; 684 685 /* First pass: look for a config entry that looks normal. 686 Two tries: without IO aliases, then with aliases */ 687 for (try = 0; try < 2; try++) 688 if (!pcmcia_loop_config(link, bt3c_check_config, (void *) try)) 689 goto found_port; 690 691 /* Second pass: try to find an entry that isn't picky about 692 its base address, then try to grab any standard serial port 693 address, and finally try to get any free port. */ 694 if (!pcmcia_loop_config(link, bt3c_check_config_notpicky, NULL)) 695 goto found_port; 696 697 BT_ERR("No usable port range found"); 698 goto failed; 699 700 found_port: 701 i = pcmcia_request_irq(link, &bt3c_interrupt); 702 if (i != 0) 703 goto failed; 704 705 i = pcmcia_enable_device(link); 706 if (i != 0) 707 goto failed; 708 709 if (bt3c_open(info) != 0) 710 goto failed; 711 712 return 0; 713 714 failed: 715 bt3c_release(link); 716 return -ENODEV; 717 } 718 719 720 static void bt3c_release(struct pcmcia_device *link) 721 { 722 struct bt3c_info *info = link->priv; 723 724 bt3c_close(info); 725 726 pcmcia_disable_device(link); 727 } 728 729 730 static const struct pcmcia_device_id bt3c_ids[] = { 731 PCMCIA_DEVICE_PROD_ID13("3COM", "Bluetooth PC Card", 0xefce0a31, 0xd4ce9b02), 732 PCMCIA_DEVICE_NULL 733 }; 734 MODULE_DEVICE_TABLE(pcmcia, bt3c_ids); 735 736 static struct pcmcia_driver bt3c_driver = { 737 .owner = THIS_MODULE, 738 .name = "bt3c_cs", 739 .probe = bt3c_probe, 740 .remove = bt3c_detach, 741 .id_table = bt3c_ids, 742 }; 743 module_pcmcia_driver(bt3c_driver); 744