marvell mmp3 pxa2128 sd8787 bluetooth code analysis

本文单板mmp3 pxa2128 

我们先看下probe过程吧，然后再一个一个展开讲解

/** 
 *  @brief This function probe the card
 *  
 *  @param func    A pointer to sdio_func structure.
 *  @param id	   A pointer to structure sd_device_id	
 *  @return 	   BT_STATUS_SUCCESS/BT_STATUS_FAILURE or other error no.
 */
static int
sd_probe_card(struct sdio_func *func, const struct sdio_device_id *id)
{
    int ret = BT_STATUS_SUCCESS;
    bt_private *priv = NULL;
    struct sdio_mmc_card *card = NULL;

    ENTER();

    PRINTM(INFO, "BT: vendor=0x%x,device=0x%x,class=%d,fn=%d\n", id->vendor,
           id->device, id->class, func->num);
    card = kzalloc(sizeof(struct sdio_mmc_card), GFP_KERNEL);
    if (!card) {
        ret = -ENOMEM;
        goto done;
    }
    card->func = func;
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,27)
    /* wait for chip fully wake up */
    if (!func->enable_timeout)
        func->enable_timeout = 200;
#endif
/*
	   驱动中使用mmc_claim_host(host);来得知,当前mmc控制器是否被占用,
	   当前mmc控制器如果被占用,那么 host->claimed = 1;否则为0,如果为1,
	   那么会在for(;;)循环中调用schedule切换出自己,当占用mmc控制器的
	   操作完成之后,执行 mmc_release_host()的时候,会激活登记到等待队
	   列&host->wq中的其他程序获得mmc主控制器的物理使用权*/
    sdio_claim_host(func);
/*	mmc_io_rw_direct（）把所有参数直接传递给mmc_io_rw_direct_host（）
SDIO功能部分简单了解下就可*/
/*使能sdio功能设备*/
    ret = sdio_enable_func(func);
    if (ret) {
        sdio_disable_func(func);
        sdio_release_host(func);
        PRINTM(FATAL, "BT: sdio_enable_func() failed: ret=%d\n", ret);
        kfree(card);
        LEAVE();
        return -EIO;
    }
	/* 释放mmc控制器 */
    sdio_release_host(func);
    priv = bt_add_card(card);
    if (!priv) {
        sdio_claim_host(func);
        sdio_disable_func(func);
        sdio_release_host(func);
        ret = BT_STATUS_FAILURE;
        kfree(card);
    }
  done:
    LEAVE();
    return ret;
}

这里主要讲解download firmware

再看bt_add_card(card)函数实现：

/**
 *  @brief This function adds the card. it will probe the
 *  card, allocate the bt_priv and initialize the device. 
 *  
 *  @param card    A pointer to card
 *  @return        A pointer to bt_private structure
 */

bt_private *
bt_add_card(void *card)
{
    struct hci_dev *hdev = NULL;
    bt_private *priv = NULL;

    ENTER();

    priv = kzalloc(sizeof(bt_private), GFP_KERNEL);
    if (!priv) {
        PRINTM(FATAL, "Can not allocate priv\n");
        LEAVE();
        return NULL;
    }
    /* allocate buffer for bt_adapter */
    if (!(priv->adapter = kzalloc(sizeof(bt_adapter), GFP_KERNEL))) {
        PRINTM(FATAL, "Allocate buffer for bt_adapter failed!\n");
        goto err_kmalloc;
    }
/* 初始化发送队列，挂起队列及command队列的头*/
    bt_init_adapter(priv);

    /* Register to HCI Core */
    hdev = hci_alloc_dev();
    if (!hdev) {
        PRINTM(FATAL, "Can not allocate HCI device\n");
        goto err_kmalloc;
    }

    PRINTM(INFO, "Starting kthread...\n");
    priv->MainThread.priv = priv;
    spin_lock_init(&priv->driver_lock);
/* 通过固件产生收发事件，从固件接受数据包，并
将接受的数据包发送给kernel */
    bt_create_thread(bt_service_main_thread, &priv->MainThread,
                     "bt_main_service");

    /* wait for mainthread to up */
    while (!priv->MainThread.pid) {
        os_sched_timeout(1);
    }
    priv->bt_dev.hcidev = hdev;
    priv->bt_dev.card = card;
    hdev->driver_data = priv;
    ((struct sdio_mmc_card *) card)->priv = priv;
    priv->adapter->sd_ireg = 0;
    /* 
     * Register the device. Fillup the private data structure with
     * relevant information from the card and request for the required
     * IRQ. 
     */
    if (sbi_register_dev(priv) < 0) {
        PRINTM(FATAL, "Failed to register bt device!\n");
        goto err_registerdev;
    }
    if (bt_init_fw(priv)) {
        PRINTM(FATAL, "BT Firmware Init Failed\n");
        goto err_init_fw;
    }
    LEAVE();
    return priv;

  err_init_fw:
    PRINTM(INFO, "unregister device\n");
    sbi_unregister_dev(priv);
  err_registerdev:
    ((struct sdio_mmc_card *) card)->priv = NULL;
    /* Stop the thread servicing the interrupts */
    priv->adapter->SurpriseRemoved = TRUE;
    wake_up_interruptible(&priv->MainThread.waitQ);
    while (priv->MainThread.pid) {
        os_sched_timeout(1);
    }
  err_kmalloc:
    if (hdev)
        kfree(hdev);
    if (priv->adapter)
        bt_free_adapter(priv);
    kfree(priv);
    LEAVE();
    return NULL;
}

这段代码在sbi_register_dev(priv)后便调用了我们关注的bt_init_fw(priv)函数。

下面我们详解bt_init_fw函数过程

首先要说明下hci_dev中的几个函数指针{open;close;flush;send;destruct;ioctl}由代码bt_main.c中的sd_register_conf_dpc这个函数注册

函数实现：

/** 
 *  @brief This function initializes firmware
 *  
 *  @param priv    A pointer to bt_private structure
 *  @return 	   BT_STATUS_SUCCESS or BT_STATUS_FAILURE
 */
static int
bt_init_fw(bt_private * priv)
{
    int ret = BT_STATUS_SUCCESS;
    ENTER();
    if (fw == 0) { //fw这是个全局变量，当firmware已经初始化时将不再初始化，使能host后直接返回OK，假设尚未初始化的话，那么就执行sbi_disable_host_int函数
        sbi_enable_host_int(priv);
        goto done;
    }
    sbi_disable_host_int(priv);
    priv->fw_crc_check = fw_crc_check; //为1，进行CRC校验
    if (sbi_download_fw(priv)) {  //这里就开始download firmware了！！下面着重讲解download
        PRINTM(ERROR, "BT FW failed to be download!\n");
        ret = BT_STATUS_FAILURE;
        goto done;
    }
  done:
    LEAVE();
    return ret;
}

download firmware过程代码蛮复杂，我们慢慢分析！

    sdio_claim_host(card->func);
    if (BT_STATUS_SUCCESS == sd_verify_fw_download(priv, 1)) { //第一大事情是确实固件是否准备好接受cmd
        PRINTM(MSG, "BT: FW already downloaded!\n");
        sdio_release_host(card->func);
        sbi_enable_host_int(priv);
        if (BT_STATUS_FAILURE == sd_register_conf_dpc(priv)) { // 注册hci_dev需要的几大函数指针，上文已经提到
            PRINTM(ERROR,
                   "BT: sd_register_conf_dpc failed. Terminating download\n");
            ret = BT_STATUS_FAILURE;
        }
        goto exit;
    }

如何确认固件是否已经好的话，调用sd_read_firmware_status此函数，如下所示：

/** 
 *  @brief This function reads fwstatus registers
 *  
 *  @param priv    A pointer to bt_private structure
 *  @param dat	   A pointer to keep returned data
 *  @return 	   BT_STATUS_SUCCESS or BT_STATUS_FAILURE
 */
static int  //此函数实际被sd_verify_fw_download他调用
sd_read_firmware_status(bt_private * priv, u16 * dat)
{
    int ret = BT_STATUS_SUCCESS;
    u8 fws0;
    u8 fws1;
    struct sdio_mmc_card *card = (struct sdio_mmc_card *) priv->bt_dev.card;
    ENTER();	 // 调试信息
    fws0 = sdio_readb(card->func, CARD_FW_STATUS0_REG, &ret); //读reg FW_STATUS0
    if (ret < 0) {
        LEAVE();
        return BT_STATUS_FAILURE;
    }
    fws1 = sdio_readb(card->func, CARD_FW_STATUS1_REG, &ret); //读reg FW_STATUS1
    if (ret < 0) {
        LEAVE();
        return BT_STATUS_FAILURE;
    }
    *dat = (((u16) fws1) << 8) | fws0;
    LEAVE();
    return BT_STATUS_SUCCESS; //我们都假设成功正常返回
}

假设这个函数成功了，那么将进行sd_register_conf_dpc(前面两个函数不说了，大家应该都比较清楚了！)，这个函数的注释说用来：第一，模块组态；第二注册设备。

在把hci_dev的函数指针都填充后调用bt_send_module_cfg_cmd

    hdev->open = bt_open;
    hdev->close = bt_close;
    hdev->flush = bt_flush;
    hdev->send = bt_send_frame;
    hdev->destruct = bt_destruct;
    hdev->ioctl = bt_ioctl;

这个函数涉及到了sk_buff这个网络里面常用的结构体，同时注释里面说明了发送module cfg cmd到firmware的格式

/** 
 *  @brief This function send module cfg cmd to firmware
 *
 *  Command format:
 *  +--------+--------+--------+--------+--------+--------+--------+
 *  |     OCF OGF     | Length |                Data               |
 *  +--------+--------+--------+--------+--------+--------+--------+
 *  |     2-byte      | 1-byte |               4-byte              |
 *  +--------+--------+--------+--------+--------+--------+--------+
 *  
 *  @param priv    A pointer to bt_private structure
 *  @param subcmd  sub command 
 *  @return 	   BT_STATUS_SUCCESS or BT_STATUS_FAILURE
 */

int
bt_send_module_cfg_cmd(bt_private * priv, int subcmd)
{
    struct sk_buff *skb = NULL;
    u8 ret = BT_STATUS_SUCCESS;
    BT_CMD *pCmd;
    ENTER();
    skb = bt_skb_alloc(sizeof(BT_CMD), GFP_ATOMIC);
    if (skb == NULL) {
        PRINTM(WARN, "BT: No free skb\n");
        ret = BT_STATUS_FAILURE;
        goto exit;
    }
    pCmd = (BT_CMD *) skb->tail;  //填充sk_buff
    pCmd->ocf_ogf = (OGF << 10) | BT_CMD_MODULE_CFG_REQ;  //(0x3f << 10 | 0x5b)
    pCmd->length = 1;
    pCmd->data[0] = subcmd;  //MODULE_BRINGUP_REQ   0xf1
    bt_cb(skb)->pkt_type = MRVL_VENDOR_PKT;  // 0xfe
    skb_put(skb, sizeof(BT_CMD));
    skb->dev = (void *) priv->bt_dev.hcidev;
    skb_queue_head(&priv->adapter->tx_queue, skb); //吧skb插入tx_queue链表中
    priv->bt_dev.sendcmdflag = TRUE;
    priv->bt_dev.send_cmd_ocf = BT_CMD_MODULE_CFG_REQ; //0x5b
    priv->adapter->cmd_complete = FALSE;
    PRINTM(CMD, "Queue module cfg Command(0x%x)\n", pCmd->ocf_ogf);
    wake_up_interruptible(&priv->MainThread.waitQ);//唤醒在probe时创建的线程来处理这个skb
    /* 
       On some Android platforms certain delay is needed for HCI daemon to
       remove this module and close itself gracefully. Otherwise it hangs. This 
       10ms delay is a workaround for such platforms as the root cause has not
       been found yet. */
    mdelay(10);
    if (!os_wait_interruptible_timeout
        (priv->adapter->cmd_wait_q, priv->adapter->cmd_complete,
         WAIT_UNTIL_CMD_RESP)) {
        ret = BT_STATUS_FAILURE;
        PRINTM(MSG, "BT: module_cfg_cmd (0x%x): timeout sendcmdflag=%d\n",
               subcmd, priv->bt_dev.sendcmdflag);
    } else {
        PRINTM(CMD, "BT: module cfg Command done\n");
    }
  exit:
    LEAVE();
    return ret;
}

下面返回后到电源管理部分，主要是powermode以及suspend /resume

调用bt_enable_ps及bt_send_hscfg_cmd最后再

wake_up_interruptible(&priv->MainThread.waitQ);

然后调用ret = hci_register_dev(hdev);这个函数在hci_core.c,三个tasklet分别对应hci_cmd_task,hci_rx_task,hci_tx_task以及一个单线程工作队列。

在这个

然后调用bt_init_config(priv, init_cfg)  在bt_init.c中

调用request_firmware －＞　bt_process_init_cfg(priv, (u8 *) cfg->data, cfg->size);

－＞bt_set_mac_address(priv, bt_mac)　　在这里设置了mac，这个函数实现在bt_main.c中，这个过程也是通过sk_buff这个结构体。

最后再创建bt_proc_init(priv);用户空间文件，函数sd_register_conf_dpc就执行完毕了。

然后调用sd_download_firmware_w_helper(priv)这个函数下载firmware

/** 
 *  @brief This function downloads firmware image to the card.
 *  
 *  @param priv    	A pointer to bt_private structure
 *  @return 	   	BT_STATUS_SUCCESS/BT_STATUS_FAILURE or other error no.
 */
int
sd_download_firmware_w_helper(bt_private * priv)
{
    int ret = BT_STATUS_SUCCESS;
    int err;
    char *cur_fw_name = NULL;
    ENTER();
    cur_fw_name = fw_name;
    if (req_fw_nowait) {
#if LINUX_VERSION_CODE > KERNEL_VERSION(2,6,32)
        if ((ret = request_firmware_nowait(THIS_MODULE, FW_ACTION_HOTPLUG,
                                           cur_fw_name, priv->hotplug_device,
                                           GFP_KERNEL, priv,
                                           sd_request_fw_callback)) < 0)

//实际上下载过程就是最后一个回调函数sd_request_fw_callback了，有兴趣可仔细阅读下。
#else
        if ((ret = request_firmware_nowait(THIS_MODULE, FW_ACTION_HOTPLUG,
                                           cur_fw_name, priv->hotplug_device,
                                           priv, sd_request_fw_callback)) < 0)
#endif
            PRINTM(FATAL,
                   "BT: request_firmware_nowait() failed, error code = %#x\n",
                   ret);
    } else {
        if ((err =
             request_firmware(&priv->firmware, cur_fw_name,
                              priv->hotplug_device)) < 0) {
            PRINTM(FATAL, "BT: request_firmware() failed, error code = %#x\n",
                   err);
            ret = BT_STATUS_FAILURE;
        } else
            ret = sd_request_fw_dpc(priv->firmware, priv);
    }

    LEAVE();
    return ret;
}

这个结束了，probe也就结束了。

刚才好几个地方调用了wakeup一个waitQ，这个实际上也是probe时创建的一个线程，然后sk_buff都是通过这个线程来执行的，这个函数为：

/** 
 *  @brief This function handles the major job in bluetooth driver.
 *  it handles the event generated by firmware, rx data received
 *  from firmware and tx data sent from kernel.
 *  
 *  @param data    A pointer to bt_thread structure
 *  @return        BT_STATUS_SUCCESS
 */
static int
bt_service_main_thread(void *data)
{
    bt_thread *thread = data;
    bt_private *priv = thread->priv;
    bt_adapter *Adapter = priv->adapter;
    wait_queue_t wait;
    u8 ireg = 0;
    struct sk_buff *skb;
    ENTER();
    bt_activate_thread(thread);    // set field pid
    init_waitqueue_entry(&wait, current);  // 初始化要等待的队列wait
    current->flags |= PF_NOFREEZE;

    for (;;) {
        add_wait_queue(&thread->waitQ, &wait);   // 添加wait到等待队列waitQ中
        OS_SET_THREAD_STATE(TASK_INTERRUPTIBLE);
        if (priv->adapter->WakeupTries ||
            ((!priv->adapter->IntCounter) &&
             (!priv->bt_dev.tx_dnld_rdy ||
              skb_queue_empty(&priv->adapter->tx_queue)))) {
            PRINTM(INFO, "Main: Thread sleeping...\n");
            schedule();            // 睡眠，代码中wake_up_interruptable()函数来唤醒，这是才会继续向下执行
        }
        OS_SET_THREAD_STATE(TASK_RUNNING);  // 设置任务已经运行标志
        remove_wait_queue(&thread->waitQ, &wait);  // 清楚等待队列链表节点
        if (kthread_should_stop() || Adapter->SurpriseRemoved) {
            PRINTM(INFO, "main-thread: break from main thread: "
                   "SurpriseRemoved=0x%x\n", Adapter->SurpriseRemoved);
            break;
        }

        PRINTM(INFO, "Main: Thread waking up...\n");  // 下面就开始处理数据发送了
        if (priv->adapter->IntCounter) {
            OS_INT_DISABLE;
            Adapter->IntCounter = 0;
            OS_INT_RESTORE;
            sbi_get_int_status(priv, &ireg);
        } else if ((priv->adapter->ps_state == PS_SLEEP) &&
                   !skb_queue_empty(&priv->adapter->tx_queue)) {
            priv->adapter->WakeupTries++;
            sbi_wakeup_firmware(priv);
            continue;
        }
        if (priv->adapter->ps_state == PS_SLEEP)
            continue;
        if (priv->bt_dev.tx_dnld_rdy == TRUE) {
            if (!skb_queue_empty(&priv->adapter->tx_queue)) {
                skb = skb_dequeue(&priv->adapter->tx_queue); // 摘出要处理的数据
                if (skb) {
                    if (SendSinglePacket(priv, skb)) //这个函数就是发送数据了。
                        priv->bt_dev.hcidev->stat.err_tx++;
                    else
                        priv->bt_dev.hcidev->stat.byte_tx += skb->len;
                    kfree_skb(skb);
                }
            }
        }
    }
    bt_deactivate_thread(thread);
    LEAVE();
    return BT_STATUS_SUCCESS;
}

这里最重要的函数就是SendSinglePacket了

/** @brief This function processes a single packet 
 *  
 *  @param priv    A pointer to bt_private structure
 *  @param skb     A pointer to skb which includes TX packet
 *  @return 	   BT_STATUS_SUCCESS or BT_STATUS_FAILURE
 */
static int
SendSinglePacket(bt_private * priv, struct sk_buff *skb)
{
    int ret;
    ENTER();
    if (!skb || !skb->data)
        return BT_STATUS_FAILURE;
    if (!skb->len || ((skb->len + BT_HEADER_LEN) > BT_UPLD_SIZE)) {
        PRINTM(ERROR, "Tx Error: Bad skb length %d : %d\n", skb->len,
               BT_UPLD_SIZE);
        return BT_STATUS_FAILURE;
    }
    /* This is SDIO specific header length: byte[3][2][1], type: byte[0]
       (HCI_COMMAND = 1, ACL_DATA = 2, SCO_DATA = 3, 0xFE = Vendor) */
    skb_push(skb, BT_HEADER_LEN);
    skb->data[0] = (skb->len & 0x0000ff);
    skb->data[1] = (skb->len & 0x00ff00) >> 8;
    skb->data[2] = (skb->len & 0xff0000) >> 16;
    skb->data[3] = bt_cb(skb)->pkt_type;
    if (bt_cb(skb)->pkt_type == MRVL_VENDOR_PKT)
        PRINTM(CMD, "DNLD_CMD: ocf_ogf=0x%x len=%d\n",
               *((u16 *) & skb->data[4]), skb->len);
    ret = sbi_host_to_card(priv, skb->data, skb->len);
    LEAVE();
    return ret;
}

这个函数调用了skb_push函数，此函数会对data这个字段进行处理，linux里面代码说明为add data to the start of a buffer，它会将data指针前移4个字节，然后len字段增加4。

最后就是调用在bt_sdiommc.c文件中sbi_host_to_card函数了，这个函数会调用linux提供的sdio方面（sdio_io.c）的接口函数sdio_writesb，通过dma的方式真正发送数据。

--------------------------------------------------华丽分割线------------------------------------------------

下面我们讲解一个扫描的例子吧（这个例子虽然简单但是也是花了好几个小时才得以理解）：

首先在linux上扫描有哪些蓝牙设备，linux为我们提供了一个命令叫hcitool，我们直接调用

# hcitool scan   // 首先得把蓝牙设备up起来，如下：

# hciconfig hci0 up

# hciconfig hci0 piscan  //即可发现又可连接

#hciconfig -a   //查看是否OK

下面我们看下hcitool执行的大致过程如下：

我们看到了linux用户和内核经常使用的ioctl接口函数，然后跟踪下代码发现此ioctl世纪上是在hci_sock.c（用户接口层）这个重要代码中，如下所示，提供了一系列的接口函数

static const struct proto_ops hci_sock_ops = {
	.family		= PF_BLUETOOTH,
	.owner		= THIS_MODULE,
	.release	= hci_sock_release,
	.bind		= hci_sock_bind,
	.getname	= hci_sock_getname,
	.sendmsg	= hci_sock_sendmsg,
	.recvmsg	= hci_sock_recvmsg,
	.ioctl		= hci_sock_ioctl,
	.poll		= datagram_poll,
	.listen		= sock_no_listen,
	.shutdown	= sock_no_shutdown,
	.setsockopt	= hci_sock_setsockopt,
	.getsockopt	= hci_sock_getsockopt,
	.connect	= sock_no_connect,
	.socketpair	= sock_no_socketpair,
	.accept		= sock_no_accept,
	.mmap		= sock_no_mmap
};

我们重点关注hci_sock_ioctl这个函数，扫描的CMD上面已经看到是HCIINQUIRY这个参数，代码直接return hci_inquiry(argp);我们继续跟踪，就到了（核心层）hci_core.c代码，如下所示：

int hci_inquiry(void __user *arg)
{
	__u8 __user *ptr = arg;
	struct hci_inquiry_req ir;
	struct hci_dev *hdev;
	int err = 0, do_inquiry = 0, max_rsp;
	long timeo;
	__u8 *buf;

	if (copy_from_user(&ir, ptr, sizeof(ir)))
		return -EFAULT;

	hdev = hci_dev_get(ir.dev_id);
	if (!hdev)
		return -ENODEV;

	hci_dev_lock_bh(hdev);
	if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
				inquiry_cache_empty(hdev) ||
				ir.flags & IREQ_CACHE_FLUSH) {
		inquiry_cache_flush(hdev);
		do_inquiry = 1;
	}
	hci_dev_unlock_bh(hdev);

	timeo = ir.length * msecs_to_jiffies(2000);

	if (do_inquiry) {
		err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo);   //这个函数就是重点了！！！！！
		if (err < 0)
			goto done;
	}

	/* for unlimited number of responses we will use buffer with 255 entries */
	max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;

	/* cache_dump can't sleep. Therefore we allocate temp buffer and then
	 * copy it to the user space.
	 */
	buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
	if (!buf) {
		err = -ENOMEM;
		goto done;
	}

	hci_dev_lock_bh(hdev);
	ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
	hci_dev_unlock_bh(hdev);

	BT_DBG("num_rsp %d", ir.num_rsp);

	if (!copy_to_user(ptr, &ir, sizeof(ir))) {
		ptr += sizeof(ir);
		if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
					ir.num_rsp))
			err = -EFAULT;
	} else
		err = -EFAULT;

	kfree(buf);

done:
	hci_dev_put(hdev);
	return err;
}

上面代码中加了很多“！”的就是真正的扫描函数了hci_request， 他实际上注册了一个回调函数 hci_inq_req，然后主函数等待这个回调函数返回从而结束请求！

这个回调函数实现如下：

static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
{
	struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
	struct hci_cp_inquiry cp;

	BT_DBG("%s", hdev->name);

	if (test_bit(HCI_INQUIRY, &hdev->flags))
		return;

	/* Start Inquiry */
	memcpy(&cp.lap, &ir->lap, 3);
	cp.length  = ir->length;
	cp.num_rsp = ir->num_rsp;
	hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
}

然后就发送command了！

/* Send HCI command */
int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
{
	int len = HCI_COMMAND_HDR_SIZE + plen;
	struct hci_command_hdr *hdr;
	struct sk_buff *skb;

	BT_DBG("%s opcode 0x%x plen %d", hdev->name, opcode, plen);

	skb = bt_skb_alloc(len, GFP_ATOMIC);
	if (!skb) {
		BT_ERR("%s no memory for command", hdev->name);
		return -ENOMEM;
	}

	hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
	hdr->opcode = cpu_to_le16(opcode);
	hdr->plen   = plen;

	if (plen)
		memcpy(skb_put(skb, plen), param, plen);

	BT_DBG("skb len %d", skb->len);

	bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
	skb->dev = (void *) hdev;

	if (test_bit(HCI_INIT, &hdev->flags))
		hdev->init_last_cmd = opcode;

	skb_queue_tail(&hdev->cmd_q, skb);
	tasklet_schedule(&hdev->cmd_task);

	return 0;
}

这个函数先分配了sk_buff结构体的空间，然后检查command的类型，是cmd_taskor rx_taskor tx_task，检查发现这个cmd就是cmd_task，那么就触发tasklet我的数据来临了，请随时准备好要工作了，那么linux就马不停蹄的在最快的时间内来触发他工作，因为tasklet是在linux里面比较优先的了，当然如果想更快还有带优先级的！好了，下面就到tasklet_init注册的函数了，这几个init注册函数在hci_register_dev注册了，这个函数前面在probe bt device时已经注册过了，这里不全截了，如下：

	tasklet_init(&hdev->cmd_task, hci_cmd_task, (unsigned long) hdev);
	tasklet_init(&hdev->rx_task, hci_rx_task, (unsigned long) hdev);
	tasklet_init(&hdev->tx_task, hci_tx_task, (unsigned long) hdev);

这里我们暂时关心的是hci_cmd_task函数，如下：

static void hci_cmd_task(unsigned long arg)
{
	struct hci_dev *hdev = (struct hci_dev *) arg;
	struct sk_buff *skb;

	BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt));

	/* Send queued commands */
	if (atomic_read(&hdev->cmd_cnt)) {
		skb = skb_dequeue(&hdev->cmd_q);
		if (!skb)
			return;

		kfree_skb(hdev->sent_cmd);

		hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC);
		if (hdev->sent_cmd) {
			atomic_dec(&hdev->cmd_cnt);
			hci_send_frame(skb);
			if (test_bit(HCI_RESET, &hdev->flags))
				del_timer(&hdev->cmd_timer);
			else
				mod_timer(&hdev->cmd_timer,
				  jiffies + msecs_to_jiffies(HCI_CMD_TIMEOUT));
		} else {
			skb_queue_head(&hdev->cmd_q, skb);
			tasklet_schedule(&hdev->cmd_task);
		}
	}
}

这里面涉及很多链表操作，需要先熟悉下更好，处理前先把这个skb从链表中删除了，然后调用了hci_send_frame这个函数，如下：

static int hci_send_frame(struct sk_buff *skb)
{
	struct hci_dev *hdev = (struct hci_dev *) skb->dev;

	if (!hdev) {
		kfree_skb(skb);
		return -ENODEV;
	}

	BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);

	if (atomic_read(&hdev->promisc)) {
		/* Time stamp */
		__net_timestamp(skb);

		hci_send_to_sock(hdev, skb, NULL);
	}

	/* Get rid of skb owner, prior to sending to the driver. */
	skb_orphan(skb);

	return hdev->send(skb);
}

我们看到最后一行是个函数指针，调用了hci_dev下的send函数指针，到这里代码都在hci_core.c中，所以其实这些都是用户接口与驱动接口打交道的桥梁，也就成为核心层了。然后这个函数指针前面已经写过了，其实就是调用的是bt_main.c的bt_send_frame函数了，这个函数再次判断这个pkt_type是什么，是HCI_COMMAND_PKT还是HCI_ACLDATA_PKT还是HCI_SCODATA_PKT，然后插入链表尾部，再唤醒上文提到的工作队列wake_up_interruptible(&priv->MainThread.waitQ);就这个函数了，经过辗转反侧又回到了这个工作队列，也就是上文中的bt_service_main_thread函数了。
同样在这个函数里面先把这个skb从链表中取出并unlink掉，然后再调用SendSinglePacket，这个函数前面已经提到，我的是sdio模块，所以不同芯片都会有差异了，如下：

/** @brief This function processes a single packet 
 *  
 *  @param priv    A pointer to bt_private structure
 *  @param skb     A pointer to skb which includes TX packet
 *  @return 	   BT_STATUS_SUCCESS or BT_STATUS_FAILURE
 */
static int
SendSinglePacket(bt_private * priv, struct sk_buff *skb)
{
    int ret;
    ENTER();
    if (!skb || !skb->data)
        return BT_STATUS_FAILURE;
    if (!skb->len || ((skb->len + BT_HEADER_LEN) > BT_UPLD_SIZE)) {
        PRINTM(ERROR, "Tx Error: Bad skb length %d : %d\n", skb->len,
               BT_UPLD_SIZE);
        return BT_STATUS_FAILURE;
    }
    /* This is SDIO specific header length: byte[3][2][1], type: byte[0]
       (HCI_COMMAND = 1, ACL_DATA = 2, SCO_DATA = 3, 0xFE = Vendor) */
    skb_push(skb, BT_HEADER_LEN);
    skb->data[0] = (skb->len & 0x0000ff);
    skb->data[1] = (skb->len & 0x00ff00) >> 8;
    skb->data[2] = (skb->len & 0xff0000) >> 16;
    skb->data[3] = bt_cb(skb)->pkt_type;
    if (bt_cb(skb)->pkt_type == MRVL_VENDOR_PKT)
        PRINTM(CMD, "DNLD_CMD: ocf_ogf=0x%x len=%d\n",
               *((u16 *) & skb->data[4]), skb->len);
    ret = sbi_host_to_card(priv, skb->data, skb->len);
    LEAVE();
    return ret;
}

先加sdio头，然后再调用sbi_host_to_card函数，如下：

/**  
 *  @brief This function sends data to the card.
 *  
 *  @param priv    A pointer to bt_private structure
 *  @param payload A pointer to the data/cmd buffer
 *  @param nb	   Length of data/cmd
 *  @return 	   BT_STATUS_SUCCESS or BT_STATUS_FAILURE
 */
int
sbi_host_to_card(bt_private * priv, u8 * payload, u16 nb)
{
    struct sdio_mmc_card *card = priv->bt_dev.card;
    int ret = BT_STATUS_SUCCESS;
    int buf_block_len;
    int blksz;
    int i = 0;
    u8 *buf = NULL;
    struct hci_dev *hdev = priv->bt_dev.hcidev;
    void *tmpbuf = NULL;
    int tmpbufsz;

    ENTER();

    if (!card || !card->func) {
        PRINTM(ERROR, "BT: card or function is NULL!\n");
        LEAVE();
        return BT_STATUS_FAILURE;
    }
    buf = payload;

    /* Allocate buffer and copy payload */
    blksz = SD_BLOCK_SIZE;
    buf_block_len = (nb + blksz - 1) / blksz;
    if ((u32) payload & (DMA_ALIGNMENT - 1)) {
        tmpbufsz = buf_block_len * blksz + DMA_ALIGNMENT;
        tmpbuf = kmalloc(tmpbufsz, GFP_KERNEL);
        memset(tmpbuf, 0, tmpbufsz);
        /* Ensure 8-byte aligned CMD buffer */
        buf = (u8 *) ALIGN_ADDR(tmpbuf, DMA_ALIGNMENT);
        memcpy(buf, payload, nb);
    }
    sdio_claim_host(card->func);
#define MAX_WRITE_IOMEM_RETRY	2
    do {
        /* Transfer data to card */
        ret = sdio_writesb(card->func, priv->bt_dev.ioport, buf,
                           buf_block_len * blksz);
        if (ret < 0) {
            i++;
            PRINTM(ERROR, "BT: host_to_card, write iomem (%d) failed: %d\n", i,
                   ret);
            sdio_writeb(card->func, HOST_WO_CMD53_FINISH_HOST,
                        CONFIGURATION_REG, &ret);
            udelay(20);
            ret = BT_STATUS_FAILURE;
            if (i > MAX_WRITE_IOMEM_RETRY)
                goto exit;
        } else {
            DBG_HEXDUMP(DAT_D, "BT: SDIO Blk Wr", payload, nb);
            PRINTM(DATA, "BT: SDIO Blk Wr %s: len=%d\n", hdev->name, nb);
        }
    } while (ret == BT_STATUS_FAILURE);
    priv->bt_dev.tx_dnld_rdy = FALSE; // 此时禁止了再次来数据！这个函数和sbi_get_int_status(priv, &ireg);这个函数呼应
  exit:
    sdio_release_host(card->func);
    if (tmpbuf)
        kfree(tmpbuf);
    LEAVE();
    return ret;
}

前面一直忽略了sbi_get_int_status(priv, &ireg);这个函数，而经过跟踪发现了我一直未找到的一个数据流动问题，只看到了从kernel向card发送数据，却一直没有看到kernel从card读数据！原来如下：

/** 
 *  @brief This function checks the interrupt status and handle it accordingly.
 *  
 *  @param priv    A pointer to bt_private structure
 *  @param ireg    A pointer to variable that keeps returned value
 *  @return 	   BT_STATUS_SUCCESS 
 */
int
sbi_get_int_status(bt_private * priv, u8 * ireg)
{
    int ret = BT_STATUS_SUCCESS;
    u8 sdio_ireg = 0;
    struct sdio_mmc_card *card = priv->bt_dev.card;
    struct hci_dev *hdev = priv->bt_dev.hcidev;

    ENTER();

    *ireg = 0;
    OS_INT_DISABLE;
    sdio_ireg = priv->adapter->sd_ireg;
    priv->adapter->sd_ireg = 0;
    OS_INT_RESTORE;
    sdio_claim_host(card->func);
    PRINTM(INTR, "BT: get_int_status %s: sdio_ireg=0x%x\n", hdev->name,
           sdio_ireg);
    priv->adapter->irq_done = sdio_ireg;
    if (sdio_ireg & DN_LD_HOST_INT_STATUS) {    /* tx_done INT 这里判断是否是下载模式 */
        if (priv->bt_dev.tx_dnld_rdy) { /* tx_done already received */
            PRINTM(INFO,
                   "BT: warning: tx_done already received: tx_dnld_rdy=0x%x int status=0x%x\n",
                   priv->bt_dev.tx_dnld_rdy, sdio_ireg);
        } else {
            priv->bt_dev.tx_dnld_rdy = TRUE;
        }
    }
    if (sdio_ireg & UP_LD_HOST_INT_STATUS)
        sd_card_to_host(priv);  //这里根据中断返回的状态这里判断是否是上传模式！

    *ireg = sdio_ireg;
    ret = BT_STATUS_SUCCESS;
    sdio_release_host(card->func);
    LEAVE();
    return ret;
}

记住从kernel发送数据到card为：sbi_host_to_card

而kernel从card读数据为：sd_card_to_host

暂时而言scan过程就结束了，但是还很多具体数据内容未去分析，以及数据的返回过程都没有去分析，下面将着重去根据协议分析数据内容！见谅！

    今天再次根据printk信息看到了中断的发生情况，中断处理函数为sd_interrupt,这个函数会读中断状态寄存器HOST_INTSTATUS_REG（0x03）假设这个中断状态寄存器的内容为1的话，sbi_get_int_status这个函数中将进行判断，从而认为card要上传数据，假设内容为2的话，则是kernel要发送数据！

/** 
 *  @brief This function handles the interrupt.
 *  
 *  @param func  A pointer to sdio_func structure
 *  @return      N/A
 */
static void
sd_interrupt(struct sdio_func *func)
{
    bt_private *priv;
    struct hci_dev *hcidev;
    struct sdio_mmc_card *card;
    int ret = BT_STATUS_SUCCESS;
    u8 ireg = 0;

    ENTER();

    card = sdio_get_drvdata(func);
    if (!card || !card->priv) {
        PRINTM(INFO,
               "BT: %s: sbi_interrupt(%p) card or priv is NULL, card=%p\n",
               __FUNCTION__, func, card);
        LEAVE();
        return;
    }
    priv = card->priv;
    hcidev = priv->bt_dev.hcidev;

    ireg = sdio_readb(card->func, HOST_INTSTATUS_REG, &ret);
    if (ret) {
        PRINTM(WARN, "BT: sdio_read_ioreg: read int status register failed\n");
        goto done;
    }
    if (ireg != 0) {
        /* 
         * DN_LD_HOST_INT_STATUS and/or UP_LD_HOST_INT_STATUS
         * Clear the interrupt status register and re-enable the interrupt
         */
        PRINTM(INTR, "BT: INT %s: sdio_ireg = 0x%x\n", hcidev->name, ireg);
        priv->adapter->irq_recv = ireg;
    } else {
        PRINTM(ERROR, "BT: ERR: ireg=0\n");
    }
    OS_INT_DISABLE;
    priv->adapter->sd_ireg |= ireg;
    OS_INT_RESTORE;
    bt_interrupt(hcidev); // 这里这个函数调用了wake_up（...）
  done:
    LEAVE();
}

在设定各种状态后调用了wake_up来唤醒等待队列，如下：

/** 
 *  @brief This function handles the interrupt. it will change PS
 *  state if applicable. it will wake up main_thread to handle
 *  the interrupt event as well.
 *  
 *  @param hdev    A pointer to hci_dev structure
 *  @return        N/A
 */
void
bt_interrupt(struct hci_dev *hdev)
{
    bt_private *priv = (bt_private *) hdev->driver_data;
    ENTER();
    PRINTM(INTR, "****interrupt****\n");
    priv->adapter->ps_state = PS_AWAKE;
    if (priv->adapter->hs_state == HS_ACTIVATED) {
        PRINTM(CMD, "BT: %s: HS DEACTIVATED in ISR!\n", hdev->name);
        priv->adapter->hs_state = HS_DEACTIVATED;
    }
    priv->adapter->WakeupTries = 0;
    priv->adapter->IntCounter++;
    wake_up_interruptible(&priv->MainThread.waitQ);
    LEAVE();

}