xref: /src/sys/dev/pcmcia/bt3c.c

/* $NetBSD: bt3c.c,v 1.24 2024/07/05 04:31:51 rin Exp $ */

/*-
 * Copyright (c) 2005 Iain D. Hibbert,
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. The name of the author may not be used to endorse or promote products
 *    derived from this software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

/*
 * Driver for the 3Com Bluetooth PC Card 3CRWB6096, written with reference to
 *  FreeBSD and BlueZ drivers for same, with credit for those going to:
 *
 *		Maksim Yevmenkin <m_evmenkin (at) yahoo.com>		(FreeBSD)
 *		Marcel Holtmann <marcel (at) holtmann.org>		(BlueZ)
 *		Jose Orlando Pereira <jop (at) di.uminho.pt>		(BlueZ)
 *		David Hinds <dahinds (at) users.sourceforge.net>	(Original Code)
 */

/*
 * The CIS info from my card:
 *
 *	pcmcia1: CIS tuple chain:
 *	CISTPL_DEVICE type=null speed=null
 *	 01 03 00 00 ff
 *	CISTPL_VERS_1
 *	 15 24 05 00 33 43 4f 4d 00 33 43 52 57 42 36 30
 *	 2d 41 00 42 6c 75 65 74 6f 6f 74 68 20 50 43 20
 *	 43 61 72 64 00 ff
 *	CISTPL_MANFID
 *	 20 04 01 01 40 00
 *	CISTPL_FUNCID
 *	 21 02 02 01
 *	CISTPL_CONFIG
 *	 1a 06 05 30 20 03 17 00
 *	CISTPL_CFTABLE_ENTRY
 *	 1b 09 f0 41 18 a0 40 07 30 ff ff
 *	unhandled CISTPL 80
 *	 80 0a 02 01 40 00 2d 00 00 00 00 ff
 *	CISTPL_NO_LINK
 *	 14 00
 *	CISTPL_END
 *	 ff
 *	pcmcia1: CIS version PC Card Standard 5.0
 *	pcmcia1: CIS info: 3COM, 3CRWB60-A, Bluetooth PC Card
 *	pcmcia1: Manufacturer code 0x101, product 0x40
 *	pcmcia1: function 0: serial port, ccr addr 320 mask 17
 *	pcmcia1: function 0, config table entry 48: I/O card; irq mask ffff; iomask 0, iospace 0-7; rdybsy_active io8 irqlevel
 */

#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: bt3c.c,v 1.24 2024/07/05 04:31:51 rin Exp $");

#include <sys/param.h>
#include <sys/device.h>
#include <sys/mbuf.h>
#include <sys/systm.h>

#include <sys/cpu.h>
#include <sys/bus.h>
#include <sys/intr.h>

#include <dev/pcmcia/pcmciareg.h>
#include <dev/pcmcia/pcmciavar.h>
#include <dev/pcmcia/pcmciadevs.h>

#include <netbt/bluetooth.h>
#include <netbt/hci.h>

#include <dev/firmload.h>
#define BT3C_FIRMWARE_FILE	"BT3CPCC.bin"

/**************************************************************************
 *
 *	bt3c autoconfig glue
 */

struct bt3c_softc {
	device_t	sc_dev;

	struct pcmcia_function *sc_pf;		/* our PCMCIA function */
	struct pcmcia_io_handle sc_pcioh;	/* PCMCIA i/o space info */
	int		sc_iow;			/* our i/o window */
	int		sc_flags;		/* flags */

	struct hci_unit *sc_unit;		/* Bluetooth HCI Unit */
	struct bt_stats	sc_stats;		/* HCI stats */

	/* hardware interrupt */
	void		*sc_intr;		/* cookie */
	int		sc_state;		/* receive state */
	int		sc_want;		/* how much we want */
	struct mbuf	*sc_rxp;		/* incoming packet */
	struct mbuf	*sc_txp;		/* outgoing packet */

	/* transmit queues */
	MBUFQ_HEAD()	sc_cmdq;		/* commands */
	MBUFQ_HEAD()	sc_aclq;		/* ACL data */
	MBUFQ_HEAD()	sc_scoq;		/* SCO data */
};

/* sc_state */				/* receiving */
#define BT3C_RECV_PKT_TYPE	0		/* packet type */
#define BT3C_RECV_ACL_HDR	1		/* acl header */
#define BT3C_RECV_SCO_HDR	2		/* sco header */
#define BT3C_RECV_EVENT_HDR	3		/* event header */
#define BT3C_RECV_ACL_DATA	4		/* acl packet data */
#define BT3C_RECV_SCO_DATA	5		/* sco packet data */
#define BT3C_RECV_EVENT_DATA	6		/* event packet data */

/* sc_flags */
#define BT3C_XMIT		(1 << 1)	/* transmit active */
#define BT3C_ENABLED		(1 << 2)	/* enabled */

static int bt3c_match(device_t, cfdata_t, void *);
static void bt3c_attach(device_t, device_t, void *);
static int bt3c_detach(device_t, int);
static bool bt3c_suspend(device_t, const pmf_qual_t *);
static bool bt3c_resume(device_t, const pmf_qual_t *);

CFATTACH_DECL_NEW(bt3c, sizeof(struct bt3c_softc),
    bt3c_match, bt3c_attach, bt3c_detach, NULL);

static int bt3c_enable(device_t);
static void bt3c_disable(device_t);
static void bt3c_output_cmd(device_t, struct mbuf *);
static void bt3c_output_acl(device_t, struct mbuf *);
static void bt3c_output_sco(device_t, struct mbuf *);
static void bt3c_stats(device_t, struct bt_stats *, int);

static const struct hci_if bt3c_hci = {
	.enable =	bt3c_enable,
	.disable =	bt3c_disable,
	.output_cmd =	bt3c_output_cmd,
	.output_acl =	bt3c_output_acl,
	.output_sco =	bt3c_output_sco,
	.get_stats =	bt3c_stats,
	.ipl =		IPL_TTY,
};

static void bt3c_start(struct bt3c_softc *);

/**************************************************************************
 *
 *	Hardware Definitions & IO routines
 *
 *	I made up the names for most of these defs since we dont have
 *	manufacturers recommendations, but I dont like raw numbers..
 *
 *	all hardware routines are running at IPL_TTY
 *
 */
#define BT3C_ISR		0x7001		/* Interrupt Status Register */
#define BT3C_ISR_RXRDY			(1<<0)	/* Device has data */
#define BT3C_ISR_TXRDY			(1<<1)	/* Finished sending data */
#define BT3C_ISR_ANTENNA		(1<<5)	/* Antenna position changed */

#define BT3C_CSR		0x7002		/* Card Status Register */
#define BT3C_CSR_ANTENNA		(1<<4)	/* Antenna position */

#define BT3C_TX_COUNT		0x7005		/* Tx fifo contents */
#define BT3C_TX_FIFO		0x7080		/* Transmit Fifo */
#define BT3C_RX_COUNT		0x7006		/* Rx fifo contents */
#define BT3C_RX_FIFO		0x7480		/* Receive Fifo */
#define BT3C_FIFO_SIZE			256

/* IO Registers */
#define BT3C_IOR_DATA_L		0x00		/* data low byte */
#define BT3C_IOR_DATA_H		0x01		/* data high byte */
#define BT3C_IOR_ADDR_L		0x02		/* address low byte */
#define BT3C_IOR_ADDR_H		0x03		/* address high byte */
#define BT3C_IOR_CNTL		0x04		/* control byte */
#define BT3C_IOR_CNTL_BOOT		(1<<6)	/* Boot Card */
#define BT3C_IOR_CNTL_INTR		(1<<7)	/* Interrupt Requested */
#define BT3C_IOR_LEN		0x05

static inline uint16_t
bt3c_get(struct bt3c_softc *sc)
{
	uint16_t data;

	bus_space_barrier(sc->sc_pcioh.iot, sc->sc_pcioh.ioh,
				0, BT3C_IOR_LEN, BUS_SPACE_BARRIER_READ);
	data = bus_space_read_1(sc->sc_pcioh.iot, sc->sc_pcioh.ioh,
				BT3C_IOR_DATA_L);
	data |= bus_space_read_1(sc->sc_pcioh.iot, sc->sc_pcioh.ioh,
				BT3C_IOR_DATA_H) << 8;

	return data;
}

static inline void
bt3c_put(struct bt3c_softc *sc, uint16_t data)
{

	bus_space_barrier(sc->sc_pcioh.iot, sc->sc_pcioh.ioh,
			0, BT3C_IOR_LEN, BUS_SPACE_BARRIER_WRITE);
	bus_space_write_1(sc->sc_pcioh.iot, sc->sc_pcioh.ioh,
			BT3C_IOR_DATA_L, data & 0xff);
	bus_space_write_1(sc->sc_pcioh.iot, sc->sc_pcioh.ioh,
			BT3C_IOR_DATA_H, (data >> 8) & 0xff);
}

static inline uint8_t
bt3c_read_control(struct bt3c_softc *sc)
{

	bus_space_barrier(sc->sc_pcioh.iot, sc->sc_pcioh.ioh,
			0, BT3C_IOR_LEN, BUS_SPACE_BARRIER_READ);
	return bus_space_read_1(sc->sc_pcioh.iot, sc->sc_pcioh.ioh,
			BT3C_IOR_CNTL);
}

static inline void
bt3c_write_control(struct bt3c_softc *sc, uint8_t data)
{

	bus_space_barrier(sc->sc_pcioh.iot, sc->sc_pcioh.ioh,
			0, BT3C_IOR_LEN, BUS_SPACE_BARRIER_WRITE);
	bus_space_write_1(sc->sc_pcioh.iot, sc->sc_pcioh.ioh,
			BT3C_IOR_CNTL, data);
}

static inline void
bt3c_set_address(struct bt3c_softc *sc, uint16_t addr)
{

	bus_space_barrier(sc->sc_pcioh.iot, sc->sc_pcioh.ioh,
			0, BT3C_IOR_LEN, BUS_SPACE_BARRIER_WRITE);
	bus_space_write_1(sc->sc_pcioh.iot, sc->sc_pcioh.ioh,
			BT3C_IOR_ADDR_L, addr & 0xff);
	bus_space_write_1(sc->sc_pcioh.iot, sc->sc_pcioh.ioh,
			BT3C_IOR_ADDR_H, (addr >> 8) & 0xff);
}

static inline uint16_t
bt3c_read(struct bt3c_softc *sc, uint16_t addr)
{

	bt3c_set_address(sc, addr);
	return bt3c_get(sc);
}

static inline void
bt3c_write(struct bt3c_softc *sc, uint16_t addr, uint16_t data)
{

	bt3c_set_address(sc, addr);
	bt3c_put(sc, data);
}

/*
 * receive incoming data from device, store in mbuf chain and
 * pass on complete packets to bt device
 */
static void
bt3c_receive(struct bt3c_softc *sc)
{
	struct mbuf *m = sc->sc_rxp;
	int space = 0;
	uint16_t count;
	uint8_t b;

	/*
	 * If we already started a packet, find the
	 * trailing end of it.
	 */
	if (m) {
		while (m->m_next)
			m = m->m_next;

		space = M_TRAILINGSPACE(m);
	}

	count = bt3c_read(sc, BT3C_RX_COUNT);
	bt3c_set_address(sc, BT3C_RX_FIFO);

	while (count > 0) {
		if (space == 0) {
			if (m == NULL) {
				/* new packet */
				MGETHDR(m, M_DONTWAIT, MT_DATA);
				if (m == NULL) {
					aprint_error_dev(sc->sc_dev,
					    "out of memory\n");
					sc->sc_stats.err_rx++;
					goto out;	/* (lost sync) */
				}

				sc->sc_rxp = m;
				m->m_pkthdr.len = m->m_len = 0;
				space = MHLEN;

				sc->sc_state = BT3C_RECV_PKT_TYPE;
				sc->sc_want = 1;
			} else {
				/* extend mbuf */
				MGET(m->m_next, M_DONTWAIT, MT_DATA);
				if (m->m_next == NULL) {
					aprint_error_dev(sc->sc_dev,
					    "out of memory\n");
					sc->sc_stats.err_rx++;
					goto out;	/* (lost sync) */
				}

				m = m->m_next;
				m->m_len = 0;
				space = MLEN;

				if (sc->sc_want > MINCLSIZE) {
					MCLGET(m, M_DONTWAIT);
					if (m->m_flags & M_EXT)
						space = MCLBYTES;
				}
			}
		}

		b = bt3c_get(sc);
		mtod(m, uint8_t *)[m->m_len++] = b;
		count--;
		space--;
		sc->sc_rxp->m_pkthdr.len++;
		sc->sc_stats.byte_rx++;

		sc->sc_want--;
		if (sc->sc_want > 0)
			continue; /* want more */

		switch (sc->sc_state) {
		case BT3C_RECV_PKT_TYPE:		/* Got packet type */

			switch (b) {
			case HCI_ACL_DATA_PKT:
				sc->sc_state = BT3C_RECV_ACL_HDR;
				sc->sc_want = sizeof(hci_acldata_hdr_t) - 1;
				break;

			case HCI_SCO_DATA_PKT:
				sc->sc_state = BT3C_RECV_SCO_HDR;
				sc->sc_want = sizeof(hci_scodata_hdr_t) - 1;
				break;

			case HCI_EVENT_PKT:
				sc->sc_state = BT3C_RECV_EVENT_HDR;
				sc->sc_want = sizeof(hci_event_hdr_t) - 1;
				break;

			default:
				aprint_error_dev(sc->sc_dev,
				    "Unknown packet type=%#x!\n", b);
				sc->sc_stats.err_rx++;
				m_freem(sc->sc_rxp);
				sc->sc_rxp = NULL;
				goto out;	/* (lost sync) */
			}

			break;

		/*
		 * we assume (correctly of course :) that the packet headers
		 * all fit into a single pkthdr mbuf
		 */
		case BT3C_RECV_ACL_HDR:		/* Got ACL Header */
			sc->sc_state = BT3C_RECV_ACL_DATA;
			sc->sc_want = mtod(m, hci_acldata_hdr_t *)->length;
			sc->sc_want = le16toh(sc->sc_want);
			break;

		case BT3C_RECV_SCO_HDR:		/* Got SCO Header */
			sc->sc_state = BT3C_RECV_SCO_DATA;
			sc->sc_want =  mtod(m, hci_scodata_hdr_t *)->length;
			break;

		case BT3C_RECV_EVENT_HDR:	/* Got Event Header */
			sc->sc_state = BT3C_RECV_EVENT_DATA;
			sc->sc_want =  mtod(m, hci_event_hdr_t *)->length;
			break;

		case BT3C_RECV_ACL_DATA:	/* ACL Packet Complete */
			if (!hci_input_acl(sc->sc_unit, sc->sc_rxp))
				sc->sc_stats.err_rx++;

			sc->sc_stats.acl_rx++;
			sc->sc_rxp = m = NULL;
			space = 0;
			break;

		case BT3C_RECV_SCO_DATA:	/* SCO Packet Complete */
			if (!hci_input_sco(sc->sc_unit, sc->sc_rxp))
				sc->sc_stats.err_rx++;

			sc->sc_stats.sco_rx++;
			sc->sc_rxp = m = NULL;
			space = 0;
			break;

		case BT3C_RECV_EVENT_DATA:	/* Event Packet Complete */
			if (!hci_input_event(sc->sc_unit, sc->sc_rxp))
				sc->sc_stats.err_rx++;

			sc->sc_stats.evt_rx++;
			sc->sc_rxp = m = NULL;
			space = 0;
			break;

		default:
			panic("%s: invalid state %d!\n",
				device_xname(sc->sc_dev), sc->sc_state);
		}
	}

out:
	bt3c_write(sc, BT3C_RX_COUNT, 0x0000);
}

/*
 * write data from current packet to Transmit FIFO.
 * restart when done.
 */
static void
bt3c_transmit(struct bt3c_softc *sc)
{
	struct mbuf *m;
	int count, rlen;
	uint8_t *rptr;

	m = sc->sc_txp;
	if (m == NULL) {
		sc->sc_flags &= ~BT3C_XMIT;
		bt3c_start(sc);
		return;
	}

	count = 0;
	rlen = 0;
	rptr = mtod(m, uint8_t *);

	bt3c_set_address(sc, BT3C_TX_FIFO);

	for(;;) {
		if (rlen >= m->m_len) {
			m = m->m_next;
			if (m == NULL) {
				m = sc->sc_txp;
				sc->sc_txp = NULL;

				if (M_GETCTX(m, void *) == NULL)
					m_freem(m);
				else if (!hci_complete_sco(sc->sc_unit, m))
					sc->sc_stats.err_tx++;

				break;
			}

			rlen = 0;
			rptr = mtod(m, uint8_t *);
			continue;
		}

		if (count >= BT3C_FIFO_SIZE) {
			m_adj(m, rlen);
			break;
		}

		bt3c_put(sc, *rptr++);
		rlen++;
		count++;
	}

	bt3c_write(sc, BT3C_TX_COUNT, count);
	sc->sc_stats.byte_tx += count;
}

/*
 * interrupt routine
 */
static int
bt3c_intr(void *arg)
{
	struct bt3c_softc *sc = arg;
	uint16_t control, isr;

	control = bt3c_read_control(sc);
	if (control & BT3C_IOR_CNTL_INTR) {
		isr = bt3c_read(sc, BT3C_ISR);
		if ((isr & 0xff) == 0x7f) {
			aprint_error_dev(sc->sc_dev, "strange ISR=%04x\n", isr);
		} else if ((isr & 0xff) != 0xff) {

			if (isr & BT3C_ISR_RXRDY)
				bt3c_receive(sc);

			if (isr & BT3C_ISR_TXRDY)
				bt3c_transmit(sc);

#ifdef DIAGNOSTIC
			if (isr & BT3C_ISR_ANTENNA) {
				if (bt3c_read(sc, BT3C_CSR) & BT3C_CSR_ANTENNA)
					aprint_verbose_dev(sc->sc_dev,
					    "Antenna Out\n");
				else
					aprint_verbose_dev(sc->sc_dev,
					    "Antenna In\n");
			}
#endif

			bt3c_write(sc, BT3C_ISR, 0x0000);
			bt3c_write_control(sc, control);

			return 1; /* handled */
		}
	}

	return 0; /* not handled */
}

/*
 * load firmware for the device
 *
 * The firmware file is a plain ASCII file in the Motorola S-Record format,
 * with lines in the format:
 *
 *	S<Digit><Len><Address><Data1><Data2>...<DataN><Checksum>
 *
 * <Digit>:	0	header
 *		3	data record (4 byte address)
 *		7	boot record (4 byte address)
 *
 * <Len>:	1 byte, and is the number of bytes in the rest of the line
 * <Address>:	4 byte address (only 2 bytes are valid for bt3c I think)
 * <Data>:	2 byte data word to be written to the address
 * <Checksum>:	checksum of all bytes in the line including <Len>
 *
 * all bytes are in hexadecimal
 */
static inline int32_t
hex(const uint8_t *p, int n)
{
	uint32_t val = 0;

	while (n > 0) {
		val <<= 4;

		if ('0' <= *p && *p <= '9')
			val += (*p - '0');
		else if ('a' <= *p && *p <= 'f')
			val += (*p - 'a' + 0xa);
		else if ('A' <= *p && *p <= 'F')
			val += (*p - 'A' + 0xa);
		else
			return -1;

		p++;
		n--;
	}

	return val;
}

static int
bt3c_load_firmware(struct bt3c_softc *sc)
{
	uint8_t *buf, *line, *next, *p;
	int32_t addr, data;
	int err, sum, len;
	firmware_handle_t fh;
	cfdata_t cf = device_cfdata(sc->sc_dev);
	size_t size;

	err = firmware_open(cf->cf_name,
			    BT3C_FIRMWARE_FILE, &fh);
	if (err) {
		aprint_error_dev(sc->sc_dev, "Cannot open firmware %s/%s\n",
		    cf->cf_name, BT3C_FIRMWARE_FILE);
		return err;
	}

	size = (size_t)firmware_get_size(fh);
	if (size > 10 * 1024) {	/* sanity check */
		aprint_error_dev(sc->sc_dev, "insane firmware file size!\n");
		firmware_close(fh);
		return EFBIG;
	}

	buf = firmware_malloc(size);
	KASSERT(buf != NULL);

	err = firmware_read(fh, 0, buf, size);
	if (err) {
		aprint_error_dev(sc->sc_dev, "Firmware read failed (%d)\n", err);
		goto out;
	}

	/* Reset */
	bt3c_write(sc, 0x8040, 0x0404);
	bt3c_write(sc, 0x8040, 0x0400);
	DELAY(1);
	bt3c_write(sc, 0x8040, 0x0404);
	DELAY(17);

	next = buf;
	err = EFTYPE;

	while (next < buf + size) {
		line = next;

		while (*next != '\r' && *next != '\n') {
			if (next >= buf + size)
				goto out;

			next++;
		}

		/* 14 covers address and checksum minimum */
		if (next - line < 14)
			goto out;

		if (line[0] != 'S')
			goto out;

		/* verify line length */
		len = hex(line + 2, 2);
		if (len < 0 || next - line != len * 2 + 4)
			goto out;

		/* checksum the line */
		sum = 0;
		for (p = line + 2 ; p < next ; p += 2)
			sum += hex(p, 2);

		if ((sum & 0xff) != 0xff)
			goto out;

		/* extract relevant data */
		switch (line[1]) {
		case '0':
			/* we ignore the header */
			break;

		case '3':
			/* find number of data words */
			len = (len - 5) / 2;
			if (len > 15)
				goto out;

			addr = hex(line + 8, 4);
			if (addr < 0)
				goto out;

			bt3c_set_address(sc, addr);

			for (p = line + 12 ; p + 4 < next ; p += 4) {
				data = hex(p, 4);
				if (data < 0)
					goto out;

				bt3c_put(sc, data);
			}
			break;

		case '7':
			/*
			 * for some reason we ignore this record
			 * and boot from 0x3000 which happens to
			 * be the first record in the file.
			 */
			break;

		default:
			goto out;
		}

		/* skip to start of next line */
		while (next < buf + size && (*next == '\r' || *next == '\n'))
			next++;
	}

	err = 0;
	DELAY(17);

	/* Boot */
	bt3c_set_address(sc, 0x3000);
	bt3c_write_control(sc, (bt3c_read_control(sc) | BT3C_IOR_CNTL_BOOT));
	DELAY(17);

	/* Clear Registers */
	bt3c_write(sc, BT3C_RX_COUNT, 0x0000);
	bt3c_write(sc, BT3C_TX_COUNT, 0x0000);
	bt3c_write(sc, BT3C_ISR, 0x0000);
	DELAY(1000);

out:
	firmware_free(buf, size);
	firmware_close(fh);
	return err;
}

/**************************************************************************
 *
 *  bt device callbacks
 */

/*
 * start sending on bt3c
 * should be called at spltty() when BT3C_XMIT is not set
 */
static void
bt3c_start(struct bt3c_softc *sc)
{
	struct mbuf *m;

	KASSERT((sc->sc_flags & BT3C_XMIT) == 0);
	KASSERT(sc->sc_txp == NULL);

	if (MBUFQ_FIRST(&sc->sc_cmdq)) {
		MBUFQ_DEQUEUE(&sc->sc_cmdq, m);
		sc->sc_stats.cmd_tx++;
		goto start;
	}

	if (MBUFQ_FIRST(&sc->sc_scoq)) {
		MBUFQ_DEQUEUE(&sc->sc_scoq, m);
		sc->sc_stats.sco_tx++;
		goto start;
	}

	if (MBUFQ_FIRST(&sc->sc_aclq)) {
		MBUFQ_DEQUEUE(&sc->sc_aclq, m);
		sc->sc_stats.acl_tx++;
		goto start;
	}

	/* Nothing to send */
	return;

start:
	sc->sc_txp = m;
	sc->sc_flags |= BT3C_XMIT;
	bt3c_transmit(sc);
}

static void
bt3c_output_cmd(device_t self, struct mbuf *m)
{
	struct bt3c_softc *sc = device_private(self);
	int s;

	KASSERT(sc->sc_flags & BT3C_ENABLED);

	M_SETCTX(m, NULL);

	s = spltty();
	MBUFQ_ENQUEUE(&sc->sc_cmdq, m);
	if ((sc->sc_flags & BT3C_XMIT) == 0)
		bt3c_start(sc);

	splx(s);
}

static void
bt3c_output_acl(device_t self, struct mbuf *m)
{
	struct bt3c_softc *sc = device_private(self);
	int s;

	KASSERT(sc->sc_flags & BT3C_ENABLED);

	M_SETCTX(m, NULL);

	s = spltty();
	MBUFQ_ENQUEUE(&sc->sc_aclq, m);
	if ((sc->sc_flags & BT3C_XMIT) == 0)
		bt3c_start(sc);

	splx(s);
}

static void
bt3c_output_sco(device_t self, struct mbuf *m)
{
	struct bt3c_softc *sc = device_private(self);
	int s;

	KASSERT(sc->sc_flags & BT3C_ENABLED);

	s = spltty();
	MBUFQ_ENQUEUE(&sc->sc_scoq, m);
	if ((sc->sc_flags & BT3C_XMIT) == 0)
		bt3c_start(sc);

	splx(s);
}

/*
 * enable device
 *	turn on card
 *	load firmware
 *	establish interrupts
 */
static int
bt3c_enable(device_t self)
{
	struct bt3c_softc *sc = device_private(self);
	int err, s;

	if (sc->sc_flags & BT3C_ENABLED)
		return 0;

	s = spltty();

	sc->sc_intr = pcmcia_intr_establish(sc->sc_pf, IPL_TTY, bt3c_intr, sc);
	if (sc->sc_intr == NULL) {
		err = EIO;
		goto bad;
	}

	err = pcmcia_function_enable(sc->sc_pf);
	if (err)
		goto bad1;

	err = bt3c_load_firmware(sc);
	if (err)
		goto bad2;

	sc->sc_flags |= BT3C_ENABLED;
	sc->sc_flags &= ~BT3C_XMIT;

	splx(s);

	return 0;

bad2:
	pcmcia_function_disable(sc->sc_pf);
bad1:
	pcmcia_intr_disestablish(sc->sc_pf, sc->sc_intr);
	sc->sc_intr = NULL;
bad:
	splx(s);
	return err;
}

/*
 * disable device
 *	shut down card
 *	disestablish interrupts
 *	free held packets
 */
static void
bt3c_disable(device_t self)
{
	struct bt3c_softc *sc = device_private(self);
	int s;

	if ((sc->sc_flags & BT3C_ENABLED) == 0)
		return;

	s = spltty();

	pcmcia_function_disable(sc->sc_pf);

	if (sc->sc_intr) {
		pcmcia_intr_disestablish(sc->sc_pf, sc->sc_intr);
		sc->sc_intr = NULL;
	}

	m_freem(sc->sc_rxp);
	sc->sc_rxp = NULL;

	m_freem(sc->sc_txp);
	sc->sc_txp = NULL;

	MBUFQ_DRAIN(&sc->sc_cmdq);
	MBUFQ_DRAIN(&sc->sc_aclq);
	MBUFQ_DRAIN(&sc->sc_scoq);

	sc->sc_flags &= ~BT3C_ENABLED;
	splx(s);
}

void
bt3c_stats(device_t self, struct bt_stats *dest, int flush)
{
	struct bt3c_softc *sc = device_private(self);
	int s;

	s = spltty();
	memcpy(dest, &sc->sc_stats, sizeof(struct bt_stats));

	if (flush)
		memset(&sc->sc_stats, 0, sizeof(struct bt_stats));

	splx(s);
}

/**************************************************************************
 *
 *	bt3c PCMCIA autoconfig glue
 */

static int
bt3c_match(device_t parent, cfdata_t match, void *aux)
{
	struct pcmcia_attach_args *pa = aux;

	if (pa->manufacturer == PCMCIA_VENDOR_3COM &&
	    pa->product == PCMCIA_PRODUCT_3COM_3CRWB6096)
	    return 10;		/* 'com' also claims this, so trump them */

	return 0;
}

static void
bt3c_attach(device_t parent, device_t self, void *aux)
{
	struct bt3c_softc *sc = device_private(self);
	struct pcmcia_attach_args *pa = aux;
	struct pcmcia_config_entry *cfe;

	sc->sc_dev = self;
	sc->sc_pf = pa->pf;

	MBUFQ_INIT(&sc->sc_cmdq);
	MBUFQ_INIT(&sc->sc_aclq);
	MBUFQ_INIT(&sc->sc_scoq);

	/* Find a PCMCIA config entry we can use */
	SIMPLEQ_FOREACH(cfe, &pa->pf->cfe_head, cfe_list) {
		if (cfe->num_memspace != 0)
			continue;

		if (cfe->num_iospace != 1)
			continue;

		if (pcmcia_io_alloc(pa->pf, cfe->iospace[0].start,
				cfe->iospace[0].length, 0, &sc->sc_pcioh) == 0)
			break;
	}

	if (cfe == 0) {
		aprint_error_dev(self, "cannot allocate io space\n");
		goto no_config_entry;
	}

	/* Initialise it */
	pcmcia_function_init(pa->pf, cfe);

	/* Map in the io space */
	if (pcmcia_io_map(pa->pf, PCMCIA_WIDTH_AUTO,
			&sc->sc_pcioh, &sc->sc_iow)) {
		aprint_error_dev(self, "cannot map io space\n");
		goto iomap_failed;
	}

	/* Attach Bluetooth unit */
	sc->sc_unit = hci_attach_pcb(&bt3c_hci, self, BTF_POWER_UP_NOOP);
	if (sc->sc_unit == NULL)
		aprint_error_dev(self, "HCI attach failed\n");

	if (!pmf_device_register(self, bt3c_suspend, bt3c_resume))
		aprint_error_dev(self, "couldn't establish power handler\n");

	return;

iomap_failed:
	/* unmap io space */
	pcmcia_io_free(pa->pf, &sc->sc_pcioh);

no_config_entry:
	sc->sc_iow = -1;
}

static int
bt3c_detach(device_t self, int flags)
{
	struct bt3c_softc *sc = device_private(self);
	int err = 0;

	pmf_device_deregister(self);
	bt3c_disable(self);

	if (sc->sc_unit) {
		hci_detach_pcb(sc->sc_unit);
		sc->sc_unit = NULL;
	}

	if (sc->sc_iow != -1) {
		pcmcia_io_unmap(sc->sc_pf, sc->sc_iow);
		pcmcia_io_free(sc->sc_pf, &sc->sc_pcioh);
		sc->sc_iow = -1;
	}

	return err;
}

static bool
bt3c_suspend(device_t self, const pmf_qual_t *qual)
{
	struct bt3c_softc *sc = device_private(self);

	if (sc->sc_unit) {
		hci_detach_pcb(sc->sc_unit);
		sc->sc_unit = NULL;
	}

	return true;
}

static bool
bt3c_resume(device_t self, const pmf_qual_t *qual)
{
	struct bt3c_softc *sc = device_private(self);

	KASSERT(sc->sc_unit == NULL);

	sc->sc_unit = hci_attach_pcb(&bt3c_hci, self, BTF_POWER_UP_NOOP);
	if (sc->sc_unit == NULL)
		return false;

	return true;
}