Home | History | Annotate | Line # | Download | only in pcmcia
bt3c.c revision 1.10
      1 /* $NetBSD: bt3c.c,v 1.10 2007/07/23 18:08:20 plunky Exp $ */
      2 
      3 /*-
      4  * Copyright (c) 2005 Iain D. Hibbert,
      5  * All rights reserved.
      6  *
      7  * Redistribution and use in source and binary forms, with or without
      8  * modification, are permitted provided that the following conditions
      9  * are met:
     10  * 1. Redistributions of source code must retain the above copyright
     11  *    notice, this list of conditions and the following disclaimer.
     12  * 2. Redistributions in binary form must reproduce the above copyright
     13  *    notice, this list of conditions and the following disclaimer in the
     14  *    documentation and/or other materials provided with the distribution.
     15  * 3. The name of the author may not be used to endorse or promote products
     16  *    derived from this software without specific prior written permission.
     17  *
     18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
     19  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
     20  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
     21  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
     22  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
     23  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
     24  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
     25  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
     26  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
     27  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     28  */
     29 
     30 /*
     31  * Driver for the 3Com Bluetooth PC Card 3CRWB6096, written with reference to
     32  *  FreeBSD and BlueZ drivers for same, with credit for those going to:
     33  *
     34  *		Maksim Yevmenkin <m_evmenkin (at) yahoo.com>		(FreeBSD)
     35  *		Marcel Holtmann <marcel (at) holtmann.org>		(BlueZ)
     36  *		Jose Orlando Pereira <jop (at) di.uminho.pt>		(BlueZ)
     37  *		David Hinds <dahinds (at) users.sourceforge.net>	(Original Code)
     38  */
     39 
     40 /*
     41  * The CIS info from my card:
     42  *
     43  *	pcmcia1: CIS tuple chain:
     44  *	CISTPL_DEVICE type=null speed=null
     45  *	 01 03 00 00 ff
     46  *	CISTPL_VERS_1
     47  *	 15 24 05 00 33 43 4f 4d 00 33 43 52 57 42 36 30
     48  *	 2d 41 00 42 6c 75 65 74 6f 6f 74 68 20 50 43 20
     49  *	 43 61 72 64 00 ff
     50  *	CISTPL_MANFID
     51  *	 20 04 01 01 40 00
     52  *	CISTPL_FUNCID
     53  *	 21 02 02 01
     54  *	CISTPL_CONFIG
     55  *	 1a 06 05 30 20 03 17 00
     56  *	CISTPL_CFTABLE_ENTRY
     57  *	 1b 09 f0 41 18 a0 40 07 30 ff ff
     58  *	unhandled CISTPL 80
     59  *	 80 0a 02 01 40 00 2d 00 00 00 00 ff
     60  *	CISTPL_NO_LINK
     61  *	 14 00
     62  *	CISTPL_END
     63  *	 ff
     64  *	pcmcia1: CIS version PC Card Standard 5.0
     65  *	pcmcia1: CIS info: 3COM, 3CRWB60-A, Bluetooth PC Card
     66  *	pcmcia1: Manufacturer code 0x101, product 0x40
     67  *	pcmcia1: function 0: serial port, ccr addr 320 mask 17
     68  *	pcmcia1: function 0, config table entry 48: I/O card; irq mask ffff; iomask 0, iospace 0-7; rdybsy_active io8 irqlevel
     69  */
     70 
     71 #include <sys/cdefs.h>
     72 __KERNEL_RCSID(0, "$NetBSD: bt3c.c,v 1.10 2007/07/23 18:08:20 plunky Exp $");
     73 
     74 #include <sys/param.h>
     75 #include <sys/device.h>
     76 #include <sys/mbuf.h>
     77 #include <sys/systm.h>
     78 
     79 #include <machine/cpu.h>
     80 #include <machine/bus.h>
     81 #include <machine/intr.h>
     82 
     83 #include <dev/pcmcia/pcmciareg.h>
     84 #include <dev/pcmcia/pcmciavar.h>
     85 #include <dev/pcmcia/pcmciadevs.h>
     86 
     87 #include <netbt/bluetooth.h>
     88 #include <netbt/hci.h>
     89 
     90 #include <dev/firmload.h>
     91 #define BT3C_FIRMWARE_FILE	"BT3CPCC.bin"
     92 
     93 /**************************************************************************
     94  *
     95  *	bt3c autoconfig glue
     96  */
     97 
     98 struct bt3c_softc {
     99 	struct device	sc_dev;			/* required */
    100 
    101 	struct pcmcia_function *sc_pf;		/* our PCMCIA function */
    102 	struct pcmcia_io_handle sc_pcioh;	/* PCMCIA i/o space info */
    103 	int		sc_iow;			/* our i/o window */
    104 	void		*sc_powerhook;		/* power hook descriptor */
    105 	int		sc_flags;		/* flags */
    106 
    107 	struct hci_unit sc_unit;		/* Bluetooth HCI Unit */
    108 
    109 	/* hardware interrupt */
    110 	void		*sc_intr;		/* cookie */
    111 	int		sc_state;		/* receive state */
    112 	int		sc_want;		/* how much we want */
    113 	struct mbuf	*sc_rxp;		/* incoming packet */
    114 	struct mbuf	*sc_txp;		/* outgoing packet */
    115 };
    116 
    117 /* sc_state */				/* receiving */
    118 #define BT3C_RECV_PKT_TYPE	0		/* packet type */
    119 #define BT3C_RECV_ACL_HDR	1		/* acl header */
    120 #define BT3C_RECV_SCO_HDR	2		/* sco header */
    121 #define BT3C_RECV_EVENT_HDR	3		/* event header */
    122 #define BT3C_RECV_ACL_DATA	4		/* acl packet data */
    123 #define BT3C_RECV_SCO_DATA	5		/* sco packet data */
    124 #define BT3C_RECV_EVENT_DATA	6		/* event packet data */
    125 
    126 /* sc_flags */
    127 #define BT3C_SLEEPING		(1 << 0)	/* but not with the fishes */
    128 
    129 static int bt3c_match(struct device *, struct cfdata *, void *);
    130 static void bt3c_attach(struct device *, struct device *, void *);
    131 static int bt3c_detach(struct device *, int);
    132 static int bt3c_activate(struct device *, enum devact);
    133 static void bt3c_power(int, void *);
    134 
    135 CFATTACH_DECL(bt3c, sizeof(struct bt3c_softc),
    136     bt3c_match, bt3c_attach, bt3c_detach, bt3c_activate);
    137 
    138 static void bt3c_start(struct hci_unit *);
    139 static int bt3c_enable(struct hci_unit *);
    140 static void bt3c_disable(struct hci_unit *);
    141 
    142 /**************************************************************************
    143  *
    144  *	Hardware Definitions & IO routines
    145  *
    146  *	I made up the names for most of these defs since we dont have
    147  *	manufacturers recommendations, but I dont like raw numbers..
    148  *
    149  *	all hardware routines are running at IPL_TTY
    150  *
    151  */
    152 #define BT3C_ISR		0x7001		/* Interrupt Status Register */
    153 #define BT3C_ISR_RXRDY			(1<<0)	/* Device has data */
    154 #define BT3C_ISR_TXRDY			(1<<1)	/* Finished sending data */
    155 #define BT3C_ISR_ANTENNA		(1<<5)	/* Antenna position changed */
    156 
    157 #define BT3C_CSR		0x7002		/* Card Status Register */
    158 #define BT3C_CSR_ANTENNA		(1<<4)	/* Antenna position */
    159 
    160 #define BT3C_TX_COUNT		0x7005		/* Tx fifo contents */
    161 #define BT3C_TX_FIFO		0x7080		/* Transmit Fifo */
    162 #define BT3C_RX_COUNT		0x7006		/* Rx fifo contents */
    163 #define BT3C_RX_FIFO		0x7480		/* Receive Fifo */
    164 #define BT3C_FIFO_SIZE			256
    165 
    166 /* IO Registers */
    167 #define BT3C_IOR_DATA_L		0x00		/* data low byte */
    168 #define BT3C_IOR_DATA_H		0x01		/* data high byte */
    169 #define BT3C_IOR_ADDR_L		0x02		/* address low byte */
    170 #define BT3C_IOR_ADDR_H		0x03		/* address high byte */
    171 #define BT3C_IOR_CNTL		0x04		/* control byte */
    172 #define BT3C_IOR_CNTL_BOOT		(1<<6)	/* Boot Card */
    173 #define BT3C_IOR_CNTL_INTR		(1<<7)	/* Interrupt Requested */
    174 #define BT3C_IOR_LEN		0x05
    175 
    176 static inline uint16_t
    177 bt3c_get(struct bt3c_softc *sc)
    178 {
    179 	uint16_t data;
    180 
    181 	bus_space_barrier(sc->sc_pcioh.iot, sc->sc_pcioh.ioh,
    182 				0, BT3C_IOR_LEN, BUS_SPACE_BARRIER_READ);
    183 	data = bus_space_read_1(sc->sc_pcioh.iot, sc->sc_pcioh.ioh,
    184 				BT3C_IOR_DATA_L);
    185 	data |= bus_space_read_1(sc->sc_pcioh.iot, sc->sc_pcioh.ioh,
    186 				BT3C_IOR_DATA_H) << 8;
    187 
    188 	return data;
    189 }
    190 
    191 static inline void
    192 bt3c_put(struct bt3c_softc *sc, uint16_t data)
    193 {
    194 
    195 	bus_space_barrier(sc->sc_pcioh.iot, sc->sc_pcioh.ioh,
    196 			0, BT3C_IOR_LEN, BUS_SPACE_BARRIER_WRITE);
    197 	bus_space_write_1(sc->sc_pcioh.iot, sc->sc_pcioh.ioh,
    198 			BT3C_IOR_DATA_L, data & 0xff);
    199 	bus_space_write_1(sc->sc_pcioh.iot, sc->sc_pcioh.ioh,
    200 			BT3C_IOR_DATA_H, (data >> 8) & 0xff);
    201 }
    202 
    203 static inline uint8_t
    204 bt3c_read_control(struct bt3c_softc *sc)
    205 {
    206 
    207 	bus_space_barrier(sc->sc_pcioh.iot, sc->sc_pcioh.ioh,
    208 			0, BT3C_IOR_LEN, BUS_SPACE_BARRIER_READ);
    209 	return bus_space_read_1(sc->sc_pcioh.iot, sc->sc_pcioh.ioh,
    210 			BT3C_IOR_CNTL);
    211 }
    212 
    213 static inline void
    214 bt3c_write_control(struct bt3c_softc *sc, uint8_t data)
    215 {
    216 
    217 	bus_space_barrier(sc->sc_pcioh.iot, sc->sc_pcioh.ioh,
    218 			0, BT3C_IOR_LEN, BUS_SPACE_BARRIER_WRITE);
    219 	bus_space_write_1(sc->sc_pcioh.iot, sc->sc_pcioh.ioh,
    220 			BT3C_IOR_CNTL, data);
    221 }
    222 
    223 static inline void
    224 bt3c_set_address(struct bt3c_softc *sc, uint16_t addr)
    225 {
    226 
    227 	bus_space_barrier(sc->sc_pcioh.iot, sc->sc_pcioh.ioh,
    228 			0, BT3C_IOR_LEN, BUS_SPACE_BARRIER_WRITE);
    229 	bus_space_write_1(sc->sc_pcioh.iot, sc->sc_pcioh.ioh,
    230 			BT3C_IOR_ADDR_L, addr & 0xff);
    231 	bus_space_write_1(sc->sc_pcioh.iot, sc->sc_pcioh.ioh,
    232 			BT3C_IOR_ADDR_H, (addr >> 8) & 0xff);
    233 }
    234 
    235 static inline uint16_t
    236 bt3c_read(struct bt3c_softc *sc, uint16_t addr)
    237 {
    238 
    239 	bt3c_set_address(sc, addr);
    240 	return bt3c_get(sc);
    241 }
    242 
    243 static inline void
    244 bt3c_write(struct bt3c_softc *sc, uint16_t addr, uint16_t data)
    245 {
    246 
    247 	bt3c_set_address(sc, addr);
    248 	bt3c_put(sc, data);
    249 }
    250 
    251 /*
    252  * receive incoming data from device, store in mbuf chain and
    253  * pass on complete packets to bt device
    254  */
    255 static void
    256 bt3c_receive(struct bt3c_softc *sc)
    257 {
    258 	struct mbuf *m = sc->sc_rxp;
    259 	int space = 0;
    260 	uint16_t count;
    261 	uint8_t b;
    262 
    263 	/*
    264 	 * If we already started a packet, find the
    265 	 * trailing end of it.
    266 	 */
    267 	if (m) {
    268 		while (m->m_next)
    269 			m = m->m_next;
    270 
    271 		space = M_TRAILINGSPACE(m);
    272 	}
    273 
    274 	count = bt3c_read(sc, BT3C_RX_COUNT);
    275 	bt3c_set_address(sc, BT3C_RX_FIFO);
    276 
    277 	while (count > 0) {
    278 		if (space == 0) {
    279 			if (m == NULL) {
    280 				/* new packet */
    281 				MGETHDR(m, M_DONTWAIT, MT_DATA);
    282 				if (m == NULL) {
    283 					printf("%s: out of memory\n",
    284 						sc->sc_dev.dv_xname);
    285 					++sc->sc_unit.hci_stats.err_rx;
    286 					goto out;	/* (lost sync) */
    287 				}
    288 
    289 				sc->sc_rxp = m;
    290 				m->m_pkthdr.len = m->m_len = 0;
    291 				space = MHLEN;
    292 
    293 				sc->sc_state = BT3C_RECV_PKT_TYPE;
    294 				sc->sc_want = 1;
    295 			} else {
    296 				/* extend mbuf */
    297 				MGET(m->m_next, M_DONTWAIT, MT_DATA);
    298 				if (m->m_next == NULL) {
    299 					printf("%s: out of memory\n",
    300 						sc->sc_dev.dv_xname);
    301 					++sc->sc_unit.hci_stats.err_rx;
    302 					goto out;	/* (lost sync) */
    303 				}
    304 
    305 				m = m->m_next;
    306 				m->m_len = 0;
    307 				space = MLEN;
    308 
    309 				if (sc->sc_want > MINCLSIZE) {
    310 					MCLGET(m, M_DONTWAIT);
    311 					if (m->m_flags & M_EXT)
    312 						space = MCLBYTES;
    313 				}
    314 			}
    315 		}
    316 
    317 		b = bt3c_get(sc);
    318 		mtod(m, uint8_t *)[m->m_len++] = b;
    319 		count--;
    320 		space--;
    321 		sc->sc_rxp->m_pkthdr.len++;
    322 		sc->sc_unit.hci_stats.byte_rx++;
    323 
    324 		sc->sc_want--;
    325 		if (sc->sc_want > 0)
    326 			continue; /* want more */
    327 
    328 		switch (sc->sc_state) {
    329 		case BT3C_RECV_PKT_TYPE:		/* Got packet type */
    330 
    331 			switch (b) {
    332 			case HCI_ACL_DATA_PKT:
    333 				sc->sc_state = BT3C_RECV_ACL_HDR;
    334 				sc->sc_want = sizeof(hci_acldata_hdr_t) - 1;
    335 				break;
    336 
    337 			case HCI_SCO_DATA_PKT:
    338 				sc->sc_state = BT3C_RECV_SCO_HDR;
    339 				sc->sc_want = sizeof(hci_scodata_hdr_t) - 1;
    340 				break;
    341 
    342 			case HCI_EVENT_PKT:
    343 				sc->sc_state = BT3C_RECV_EVENT_HDR;
    344 				sc->sc_want = sizeof(hci_event_hdr_t) - 1;
    345 				break;
    346 
    347 			default:
    348 				printf("%s: Unknown packet type=%#x!\n",
    349 					sc->sc_dev.dv_xname, b);
    350 				++sc->sc_unit.hci_stats.err_rx;
    351 				m_freem(sc->sc_rxp);
    352 				sc->sc_rxp = NULL;
    353 				goto out;	/* (lost sync) */
    354 			}
    355 
    356 			break;
    357 
    358 		/*
    359 		 * we assume (correctly of course :) that the packet headers
    360 		 * all fit into a single pkthdr mbuf
    361 		 */
    362 		case BT3C_RECV_ACL_HDR:		/* Got ACL Header */
    363 			sc->sc_state = BT3C_RECV_ACL_DATA;
    364 			sc->sc_want = mtod(m, hci_acldata_hdr_t *)->length;
    365 			sc->sc_want = le16toh(sc->sc_want);
    366 			break;
    367 
    368 		case BT3C_RECV_SCO_HDR:		/* Got SCO Header */
    369 			sc->sc_state = BT3C_RECV_SCO_DATA;
    370 			sc->sc_want =  mtod(m, hci_scodata_hdr_t *)->length;
    371 			break;
    372 
    373 		case BT3C_RECV_EVENT_HDR:	/* Got Event Header */
    374 			sc->sc_state = BT3C_RECV_EVENT_DATA;
    375 			sc->sc_want =  mtod(m, hci_event_hdr_t *)->length;
    376 			break;
    377 
    378 		case BT3C_RECV_ACL_DATA:	/* ACL Packet Complete */
    379 			hci_input_acl(&sc->sc_unit, sc->sc_rxp);
    380 			sc->sc_unit.hci_stats.acl_rx++;
    381 			sc->sc_rxp = m = NULL;
    382 			space = 0;
    383 			break;
    384 
    385 		case BT3C_RECV_SCO_DATA:	/* SCO Packet Complete */
    386 			hci_input_sco(&sc->sc_unit, sc->sc_rxp);
    387 			sc->sc_unit.hci_stats.sco_rx++;
    388 			sc->sc_rxp = m = NULL;
    389 			space = 0;
    390 			break;
    391 
    392 		case BT3C_RECV_EVENT_DATA:	/* Event Packet Complete */
    393 			sc->sc_unit.hci_stats.evt_rx++;
    394 			hci_input_event(&sc->sc_unit, sc->sc_rxp);
    395 			sc->sc_rxp = m = NULL;
    396 			space = 0;
    397 			break;
    398 
    399 		default:
    400 			panic("%s: invalid state %d!\n",
    401 				sc->sc_dev.dv_xname, sc->sc_state);
    402 		}
    403 	}
    404 
    405 out:
    406 	bt3c_write(sc, BT3C_RX_COUNT, 0x0000);
    407 }
    408 
    409 /*
    410  * write data from current packet to Transmit FIFO.
    411  * restart when done.
    412  */
    413 static void
    414 bt3c_transmit(struct bt3c_softc *sc)
    415 {
    416 	struct mbuf *m;
    417 	int count, rlen;
    418 	uint8_t *rptr;
    419 
    420 	m = sc->sc_txp;
    421 	if (m == NULL) {
    422 		sc->sc_unit.hci_flags &= ~BTF_XMIT;
    423 		bt3c_start(&sc->sc_unit);
    424 		return;
    425 	}
    426 
    427 	count = 0;
    428 	rlen = 0;
    429 	rptr = mtod(m, uint8_t *);
    430 
    431 	bt3c_set_address(sc, BT3C_TX_FIFO);
    432 
    433 	for(;;) {
    434 		if (rlen >= m->m_len) {
    435 			m = m->m_next;
    436 			if (m == NULL) {
    437 				m = sc->sc_txp;
    438 				sc->sc_txp = NULL;
    439 
    440 				if (M_GETCTX(m, void *) == NULL)
    441 					m_freem(m);
    442 				else
    443 					hci_complete_sco(&sc->sc_unit, m);
    444 
    445 				break;
    446 			}
    447 
    448 			rlen = 0;
    449 			rptr = mtod(m, uint8_t *);
    450 			continue;
    451 		}
    452 
    453 		if (count >= BT3C_FIFO_SIZE) {
    454 			m_adj(m, rlen);
    455 			break;
    456 		}
    457 
    458 		bt3c_put(sc, *rptr++);
    459 		rlen++;
    460 		count++;
    461 	}
    462 
    463 	bt3c_write(sc, BT3C_TX_COUNT, count);
    464 	sc->sc_unit.hci_stats.byte_tx += count;
    465 }
    466 
    467 /*
    468  * interrupt routine
    469  */
    470 static int
    471 bt3c_intr(void *arg)
    472 {
    473 	struct bt3c_softc *sc = arg;
    474 	uint16_t control, isr;
    475 
    476 	control = bt3c_read_control(sc);
    477 	if (control & BT3C_IOR_CNTL_INTR) {
    478 		isr = bt3c_read(sc, BT3C_ISR);
    479 		if ((isr & 0xff) == 0x7f) {
    480 			printf("%s: bt3c_intr got strange ISR=%04x\n",
    481 				sc->sc_dev.dv_xname, isr);
    482 		} else if ((isr & 0xff) != 0xff) {
    483 
    484 			if (isr & BT3C_ISR_RXRDY)
    485 				bt3c_receive(sc);
    486 
    487 			if (isr & BT3C_ISR_TXRDY)
    488 				bt3c_transmit(sc);
    489 
    490 #ifdef DIAGNOSTIC
    491 			if (isr & BT3C_ISR_ANTENNA) {
    492 				if (bt3c_read(sc, BT3C_CSR) & BT3C_CSR_ANTENNA)
    493 					printf("%s: Antenna Out\n",
    494 						sc->sc_dev.dv_xname);
    495 				else
    496 					printf("%s: Antenna In\n",
    497 						sc->sc_dev.dv_xname);
    498 			}
    499 #endif
    500 
    501 			bt3c_write(sc, BT3C_ISR, 0x0000);
    502 			bt3c_write_control(sc, control);
    503 
    504 			return 1; /* handled */
    505 		}
    506 	}
    507 
    508 	return 0; /* not handled */
    509 }
    510 
    511 /*
    512  * load firmware for the device
    513  *
    514  * The firmware file is a plain ASCII file in the Motorola S-Record format,
    515  * with lines in the format:
    516  *
    517  *	S<Digit><Len><Address><Data1><Data2>...<DataN><Checksum>
    518  *
    519  * <Digit>:	0	header
    520  *		3	data record (4 byte address)
    521  *		7	boot record (4 byte address)
    522  *
    523  * <Len>:	1 byte, and is the number of bytes in the rest of the line
    524  * <Address>:	4 byte address (only 2 bytes are valid for bt3c I think)
    525  * <Data>:	2 byte data word to be written to the address
    526  * <Checksum>:	checksum of all bytes in the line including <Len>
    527  *
    528  * all bytes are in hexadecimal
    529  */
    530 static inline int32_t
    531 hex(const uint8_t *p, int n)
    532 {
    533 	uint32_t val = 0;
    534 
    535 	while (n > 0) {
    536 		val <<= 4;
    537 
    538 		if ('0' <= *p && *p <= '9')
    539 			val += (*p - '0');
    540 		else if ('a' <= *p && *p <= 'f')
    541 			val += (*p - 'a' + 0xa);
    542 		else if ('A' <= *p && *p <= 'F')
    543 			val += (*p - 'A' + 0xa);
    544 		else
    545 			return -1;
    546 
    547 		p++;
    548 		n--;
    549 	}
    550 
    551 	return val;
    552 }
    553 
    554 static int
    555 bt3c_load_firmware(struct bt3c_softc *sc)
    556 {
    557 	uint8_t *buf, *line, *next, *p;
    558 	int32_t addr, data;
    559 	int err, sum, len;
    560 	firmware_handle_t fh;
    561 	size_t size;
    562 
    563 	err = firmware_open(sc->sc_dev.dv_cfdata->cf_name,
    564 			    BT3C_FIRMWARE_FILE, &fh);
    565 	if (err) {
    566 		printf("%s: Cannot open firmware %s/%s\n", sc->sc_dev.dv_xname,
    567 		    sc->sc_dev.dv_cfdata->cf_name, BT3C_FIRMWARE_FILE);
    568 		return err;
    569 	}
    570 
    571 	size = (size_t)firmware_get_size(fh);
    572 #ifdef DIAGNOSTIC
    573 	if (size > 10 * 1024) {	/* sanity check */
    574 		printf("%s: firmware file seems WAY too big!\n",
    575 			sc->sc_dev.dv_xname);
    576 		firmware_close(fh);
    577 		return EFBIG;
    578 	}
    579 #endif
    580 
    581 	buf = firmware_malloc(size);
    582 	KASSERT(buf != NULL);
    583 
    584 	err = firmware_read(fh, 0, buf, size);
    585 	if (err) {
    586 		printf("%s: Firmware read failed (%d)\n",
    587 				sc->sc_dev.dv_xname, err);
    588 		goto out;
    589 	}
    590 
    591 	/* Reset */
    592 	bt3c_write(sc, 0x8040, 0x0404);
    593 	bt3c_write(sc, 0x8040, 0x0400);
    594 	DELAY(1);
    595 	bt3c_write(sc, 0x8040, 0x0404);
    596 	DELAY(17);
    597 
    598 	next = buf;
    599 	err = EFTYPE;
    600 
    601 	while (next < buf + size) {
    602 		line = next;
    603 
    604 		while (*next != '\r' && *next != '\n') {
    605 			if (next >= buf + size)
    606 				goto out;
    607 
    608 			next++;
    609 		}
    610 
    611 		/* 14 covers address and checksum minimum */
    612 		if (next - line < 14)
    613 			goto out;
    614 
    615 		if (line[0] != 'S')
    616 			goto out;
    617 
    618 		/* verify line length */
    619 		len = hex(line + 2, 2);
    620 		if (len < 0 || next - line != len * 2 + 4)
    621 			goto out;
    622 
    623 		/* checksum the line */
    624 		sum = 0;
    625 		for (p = line + 2 ; p < next ; p += 2)
    626 			sum += hex(p, 2);
    627 
    628 		if ((sum & 0xff) != 0xff)
    629 			goto out;
    630 
    631 		/* extract relevant data */
    632 		switch (line[1]) {
    633 		case '0':
    634 			/* we ignore the header */
    635 			break;
    636 
    637 		case '3':
    638 			/* find number of data words */
    639 			len = (len - 5) / 2;
    640 			if (len > 15)
    641 				goto out;
    642 
    643 			addr = hex(line + 8, 4);
    644 			if (addr < 0)
    645 				goto out;
    646 
    647 			bt3c_set_address(sc, addr);
    648 
    649 			for (p = line + 12 ; p + 4 < next ; p += 4) {
    650 				data = hex(p, 4);
    651 				if (data < 0)
    652 					goto out;
    653 
    654 				bt3c_put(sc, data);
    655 			}
    656 			break;
    657 
    658 		case '7':
    659 			/*
    660 			 * for some reason we ignore this record
    661 			 * and boot from 0x3000 which happens to
    662 			 * be the first record in the file.
    663 			 */
    664 			break;
    665 
    666 		default:
    667 			goto out;
    668 		}
    669 
    670 		/* skip to start of next line */
    671 		while (next < buf + size && (*next == '\r' || *next == '\n'))
    672 			next++;
    673 	}
    674 
    675 	err = 0;
    676 	DELAY(17);
    677 
    678 	/* Boot */
    679 	bt3c_set_address(sc, 0x3000);
    680 	bt3c_write_control(sc, (bt3c_read_control(sc) | BT3C_IOR_CNTL_BOOT));
    681 	DELAY(17);
    682 
    683 	/* Clear Registers */
    684 	bt3c_write(sc, BT3C_RX_COUNT, 0x0000);
    685 	bt3c_write(sc, BT3C_TX_COUNT, 0x0000);
    686 	bt3c_write(sc, BT3C_ISR, 0x0000);
    687 	DELAY(1000);
    688 
    689 out:
    690 	firmware_free(buf, size);
    691 	firmware_close(fh);
    692 	return err;
    693 }
    694 
    695 /**************************************************************************
    696  *
    697  *  bt device callbacks (all called at IPL_TTY)
    698  */
    699 
    700 /*
    701  * start sending on bt3c
    702  * this should be called only when BTF_XMIT is not set, and
    703  * we only send cmd packets that are clear to send
    704  */
    705 static void
    706 bt3c_start(struct hci_unit *unit)
    707 {
    708 	struct bt3c_softc *sc = unit->hci_softc;
    709 	struct mbuf *m;
    710 
    711 	KASSERT((unit->hci_flags & BTF_XMIT) == 0);
    712 	KASSERT(sc->sc_txp == NULL);
    713 
    714 	if (MBUFQ_FIRST(&unit->hci_cmdq)) {
    715 		MBUFQ_DEQUEUE(&unit->hci_cmdq, m);
    716 		unit->hci_stats.cmd_tx++;
    717 		M_SETCTX(m, NULL);
    718 		goto start;
    719 	}
    720 
    721 	if (MBUFQ_FIRST(&unit->hci_scotxq)) {
    722 		MBUFQ_DEQUEUE(&unit->hci_scotxq, m);
    723 		unit->hci_stats.sco_tx++;
    724 		goto start;
    725 	}
    726 
    727 	if (MBUFQ_FIRST(&unit->hci_acltxq)) {
    728 		MBUFQ_DEQUEUE(&unit->hci_acltxq, m);
    729 		unit->hci_stats.acl_tx++;
    730 		M_SETCTX(m, NULL);
    731 		goto start;
    732 	}
    733 
    734 	/* Nothing to send */
    735 	return;
    736 
    737 start:
    738 	sc->sc_txp = m;
    739 	unit->hci_flags |= BTF_XMIT;
    740 	bt3c_transmit(sc);
    741 }
    742 
    743 /*
    744  * enable device
    745  *	turn on card
    746  *	load firmware
    747  *	establish interrupts
    748  */
    749 static int
    750 bt3c_enable(struct hci_unit *unit)
    751 {
    752 	struct bt3c_softc *sc = unit->hci_softc;
    753 	int err;
    754 
    755 	if (unit->hci_flags & BTF_RUNNING)
    756 		return 0;
    757 
    758 	sc->sc_intr = pcmcia_intr_establish(sc->sc_pf, IPL_TTY, bt3c_intr, sc);
    759 	if (sc->sc_intr == NULL) {
    760 		err = EIO;
    761 		goto bad;
    762 	}
    763 
    764 	err = pcmcia_function_enable(sc->sc_pf);
    765 	if (err)
    766 		goto bad1;
    767 
    768 	err = bt3c_load_firmware(sc);
    769 	if (err)
    770 		goto bad2;
    771 
    772 	unit->hci_flags |= BTF_RUNNING;
    773 	unit->hci_flags &= ~BTF_XMIT;
    774 
    775 	/*
    776 	 * 3Com card will send a Command_Status packet when its
    777 	 * ready to receive commands
    778 	 */
    779 	unit->hci_num_cmd_pkts = 0;
    780 
    781 	return 0;
    782 
    783 bad2:
    784 	pcmcia_function_disable(sc->sc_pf);
    785 bad1:
    786 	pcmcia_intr_disestablish(sc->sc_pf, sc->sc_intr);
    787 	sc->sc_intr = NULL;
    788 bad:
    789 	return err;
    790 }
    791 
    792 /*
    793  * disable device
    794  *	shut down card
    795  *	disestablish interrupts
    796  *	free held packets
    797  */
    798 static void
    799 bt3c_disable(struct hci_unit *unit)
    800 {
    801 	struct bt3c_softc *sc = unit->hci_softc;
    802 
    803 	if ((unit->hci_flags & BTF_RUNNING) == 0)
    804 		return;
    805 
    806 	pcmcia_function_disable(sc->sc_pf);
    807 
    808 	if (sc->sc_intr) {
    809 		pcmcia_intr_disestablish(sc->sc_pf, sc->sc_intr);
    810 		sc->sc_intr = NULL;
    811 	}
    812 
    813 	if (sc->sc_rxp) {
    814 		m_freem(sc->sc_rxp);
    815 		sc->sc_rxp = NULL;
    816 	}
    817 
    818 	if (sc->sc_txp) {
    819 		m_freem(sc->sc_txp);
    820 		sc->sc_txp = NULL;
    821 	}
    822 
    823 	unit->hci_flags &= ~BTF_RUNNING;
    824 }
    825 
    826 /**************************************************************************
    827  *
    828  *	bt3c PCMCIA autoconfig glue
    829  */
    830 
    831 static int
    832 bt3c_match(struct device *parent, struct cfdata *match,
    833     void *aux)
    834 {
    835 	struct pcmcia_attach_args *pa = aux;
    836 
    837 	if (pa->manufacturer == PCMCIA_VENDOR_3COM &&
    838 	    pa->product == PCMCIA_PRODUCT_3COM_3CRWB6096)
    839 	    return 10;		/* 'com' also claims this, so trump them */
    840 
    841 	return 0;
    842 }
    843 
    844 static void
    845 bt3c_attach(struct device *parent, struct device *self, void *aux)
    846 {
    847 	struct bt3c_softc *sc = (struct bt3c_softc *)self;
    848 	struct pcmcia_attach_args *pa = aux;
    849 	struct pcmcia_config_entry *cfe;
    850 
    851 	sc->sc_pf = pa->pf;
    852 
    853 	/* Find a PCMCIA config entry we can use */
    854 	SIMPLEQ_FOREACH(cfe, &pa->pf->cfe_head, cfe_list) {
    855 		if (cfe->num_memspace != 0)
    856 			continue;
    857 
    858 		if (cfe->num_iospace != 1)
    859 			continue;
    860 
    861 		if (pcmcia_io_alloc(pa->pf, cfe->iospace[0].start,
    862 				cfe->iospace[0].length, 0, &sc->sc_pcioh) == 0)
    863 			break;
    864 	}
    865 
    866 	if (cfe == 0) {
    867 		aprint_error("bt3c_attach: cannot allocate io space\n");
    868 		goto no_config_entry;
    869 	}
    870 
    871 	/* Initialise it */
    872 	pcmcia_function_init(pa->pf, cfe);
    873 
    874 	/* Map in the io space */
    875 	if (pcmcia_io_map(pa->pf, PCMCIA_WIDTH_AUTO,
    876 			&sc->sc_pcioh, &sc->sc_iow)) {
    877 		aprint_error("bt3c_attach: cannot map io space\n");
    878 		goto iomap_failed;
    879 	}
    880 
    881 	/* Attach Bluetooth unit */
    882 	sc->sc_unit.hci_softc = sc;
    883 	sc->sc_unit.hci_devname = sc->sc_dev.dv_xname;
    884 	sc->sc_unit.hci_enable = bt3c_enable;
    885 	sc->sc_unit.hci_disable = bt3c_disable;
    886 	sc->sc_unit.hci_start_cmd = bt3c_start;
    887 	sc->sc_unit.hci_start_acl = bt3c_start;
    888 	sc->sc_unit.hci_start_sco = bt3c_start;
    889 	sc->sc_unit.hci_ipl = makeiplcookie(IPL_TTY);
    890 	hci_attach(&sc->sc_unit);
    891 
    892 	/* establish a power change hook */
    893 	sc->sc_powerhook = powerhook_establish(sc->sc_dev.dv_xname,
    894 	    bt3c_power, sc);
    895 	return;
    896 
    897 iomap_failed:
    898 	/* unmap io space */
    899 	pcmcia_io_free(pa->pf, &sc->sc_pcioh);
    900 
    901 no_config_entry:
    902 	sc->sc_iow = -1;
    903 }
    904 
    905 static int
    906 bt3c_detach(struct device *self, int flags)
    907 {
    908 	struct bt3c_softc *sc = (struct bt3c_softc *)self;
    909 	int err = 0;
    910 
    911 	bt3c_disable(&sc->sc_unit);
    912 
    913 	if (sc->sc_powerhook) {
    914 		powerhook_disestablish(sc->sc_powerhook);
    915 		sc->sc_powerhook = NULL;
    916 	}
    917 
    918 	hci_detach(&sc->sc_unit);
    919 
    920 	if (sc->sc_iow != -1) {
    921 		pcmcia_io_unmap(sc->sc_pf, sc->sc_iow);
    922 		pcmcia_io_free(sc->sc_pf, &sc->sc_pcioh);
    923 		sc->sc_iow = -1;
    924 	}
    925 
    926 	return err;
    927 }
    928 
    929 static int
    930 bt3c_activate(struct device *self, enum devact act)
    931 {
    932 	// struct bt3c_softc *sc = (struct bt3c_softc *)self;
    933 	int err = 0;
    934 
    935 	switch(act) {
    936 	case DVACT_ACTIVATE:
    937 		err = EOPNOTSUPP;
    938 		break;
    939 
    940 	case DVACT_DEACTIVATE:
    941 		// could notify unit somehow?
    942 		break;
    943 	}
    944 
    945 	return err;
    946 }
    947 
    948 static void
    949 bt3c_power(int why, void *arg)
    950 {
    951 	struct bt3c_softc *sc = arg;
    952 
    953 	switch(why) {
    954 	case PWR_SUSPEND:
    955 	case PWR_STANDBY:
    956 		if (sc->sc_unit.hci_flags & BTF_RUNNING) {
    957 			hci_detach(&sc->sc_unit);
    958 
    959 			sc->sc_flags |= BT3C_SLEEPING;
    960 			printf_nolog("%s: sleeping\n", sc->sc_dev.dv_xname);
    961 		}
    962 		break;
    963 
    964 	case PWR_RESUME:
    965 		if (sc->sc_flags & BT3C_SLEEPING) {
    966 			printf_nolog("%s: waking up\n", sc->sc_dev.dv_xname);
    967 			sc->sc_flags &= ~BT3C_SLEEPING;
    968 
    969 			memset(&sc->sc_unit, 0, sizeof(sc->sc_unit));
    970 			sc->sc_unit.hci_softc = sc;
    971 			sc->sc_unit.hci_devname = sc->sc_dev.dv_xname;
    972 			sc->sc_unit.hci_enable = bt3c_enable;
    973 			sc->sc_unit.hci_disable = bt3c_disable;
    974 			sc->sc_unit.hci_start_cmd = bt3c_start;
    975 			sc->sc_unit.hci_start_acl = bt3c_start;
    976 			sc->sc_unit.hci_start_sco = bt3c_start;
    977 			sc->sc_unit.hci_ipl = makeiplcookie(IPL_TTY);
    978 			hci_attach(&sc->sc_unit);
    979 		}
    980 		break;
    981 
    982 	case PWR_SOFTSUSPEND:
    983 	case PWR_SOFTSTANDBY:
    984 	case PWR_SOFTRESUME:
    985 		break;
    986 	}
    987 }
    988