in btmtksdio.c [355:450]
static int btmtksdio_rx_packet(struct btmtksdio_dev *bdev, u16 rx_size)
{
const struct h4_recv_pkt *pkts = mtk_recv_pkts;
int pkts_count = ARRAY_SIZE(mtk_recv_pkts);
struct mtkbtsdio_hdr *sdio_hdr;
int err, i, pad_size;
struct sk_buff *skb;
u16 dlen;
if (rx_size < sizeof(*sdio_hdr))
return -EILSEQ;
/* A SDIO packet is exactly containing a Bluetooth packet */
skb = bt_skb_alloc(rx_size, GFP_KERNEL);
if (!skb)
return -ENOMEM;
skb_put(skb, rx_size);
err = sdio_readsb(bdev->func, skb->data, MTK_REG_CRDR, rx_size);
if (err < 0)
goto err_kfree_skb;
sdio_hdr = (void *)skb->data;
/* We assume the default error as -EILSEQ simply to make the error path
* be cleaner.
*/
err = -EILSEQ;
if (rx_size != le16_to_cpu(sdio_hdr->len)) {
bt_dev_err(bdev->hdev, "Rx size in sdio header is mismatched ");
goto err_kfree_skb;
}
hci_skb_pkt_type(skb) = sdio_hdr->bt_type;
/* Remove MediaTek SDIO header */
skb_pull(skb, sizeof(*sdio_hdr));
/* We have to dig into the packet to get payload size and then know how
* many padding bytes at the tail, these padding bytes should be removed
* before the packet is indicated to the core layer.
*/
for (i = 0; i < pkts_count; i++) {
if (sdio_hdr->bt_type == (&pkts[i])->type)
break;
}
if (i >= pkts_count) {
bt_dev_err(bdev->hdev, "Invalid bt type 0x%02x",
sdio_hdr->bt_type);
goto err_kfree_skb;
}
/* Remaining bytes cannot hold a header*/
if (skb->len < (&pkts[i])->hlen) {
bt_dev_err(bdev->hdev, "The size of bt header is mismatched");
goto err_kfree_skb;
}
switch ((&pkts[i])->lsize) {
case 1:
dlen = skb->data[(&pkts[i])->loff];
break;
case 2:
dlen = get_unaligned_le16(skb->data +
(&pkts[i])->loff);
break;
default:
goto err_kfree_skb;
}
pad_size = skb->len - (&pkts[i])->hlen - dlen;
/* Remaining bytes cannot hold a payload */
if (pad_size < 0) {
bt_dev_err(bdev->hdev, "The size of bt payload is mismatched");
goto err_kfree_skb;
}
/* Remove padding bytes */
skb_trim(skb, skb->len - pad_size);
/* Complete frame */
(&pkts[i])->recv(bdev->hdev, skb);
bdev->hdev->stat.byte_rx += rx_size;
return 0;
err_kfree_skb:
kfree_skb(skb);
return err;
}