1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Bluetooth support for Realtek devices
4 *
5 * Copyright (C) 2015 Endless Mobile, Inc.
6 */
7
8 #include <linux/module.h>
9 #include <linux/firmware.h>
10 #include <linux/unaligned.h>
11 #include <linux/usb.h>
12
13 #include <net/bluetooth/bluetooth.h>
14 #include <net/bluetooth/hci_core.h>
15
16 #include "btrtl.h"
17
18 #define VERSION "0.1"
19
20 #define RTL_CHIP_8723CS_CG 3
21 #define RTL_CHIP_8723CS_VF 4
22 #define RTL_CHIP_8723CS_XX 5
23 #define RTL_EPATCH_SIGNATURE "Realtech"
24 #define RTL_EPATCH_SIGNATURE_V2 "RTBTCore"
25 #define RTL_ROM_LMP_8703B 0x8703
26 #define RTL_ROM_LMP_8723A 0x1200
27 #define RTL_ROM_LMP_8723B 0x8723
28 #define RTL_ROM_LMP_8821A 0x8821
29 #define RTL_ROM_LMP_8761A 0x8761
30 #define RTL_ROM_LMP_8822B 0x8822
31 #define RTL_ROM_LMP_8852A 0x8852
32 #define RTL_ROM_LMP_8851B 0x8851
33 #define RTL_ROM_LMP_8922A 0x8922
34 #define RTL_CONFIG_MAGIC 0x8723ab55
35
36 #define RTL_VSC_OP_COREDUMP 0xfcff
37
38 #define IC_MATCH_FL_LMPSUBV (1 << 0)
39 #define IC_MATCH_FL_HCIREV (1 << 1)
40 #define IC_MATCH_FL_HCIVER (1 << 2)
41 #define IC_MATCH_FL_HCIBUS (1 << 3)
42 #define IC_MATCH_FL_CHIP_TYPE (1 << 4)
43 #define IC_INFO(lmps, hcir, hciv, bus) \
44 .match_flags = IC_MATCH_FL_LMPSUBV | IC_MATCH_FL_HCIREV | \
45 IC_MATCH_FL_HCIVER | IC_MATCH_FL_HCIBUS, \
46 .lmp_subver = (lmps), \
47 .hci_rev = (hcir), \
48 .hci_ver = (hciv), \
49 .hci_bus = (bus)
50
51 #define RTL_CHIP_SUBVER (&(struct rtl_vendor_cmd) {{0x10, 0x38, 0x04, 0x28, 0x80}})
52 #define RTL_CHIP_REV (&(struct rtl_vendor_cmd) {{0x10, 0x3A, 0x04, 0x28, 0x80}})
53 #define RTL_SEC_PROJ (&(struct rtl_vendor_cmd) {{0x10, 0xA4, 0xAD, 0x00, 0xb0}})
54
55 #define RTL_PATCH_SNIPPETS 0x01
56 #define RTL_PATCH_DUMMY_HEADER 0x02
57 #define RTL_PATCH_SECURITY_HEADER 0x03
58
59 enum btrtl_chip_id {
60 CHIP_ID_8723A,
61 CHIP_ID_8723B,
62 CHIP_ID_8821A,
63 CHIP_ID_8761A,
64 CHIP_ID_8822B = 8,
65 CHIP_ID_8723D,
66 CHIP_ID_8821C,
67 CHIP_ID_8822C = 13,
68 CHIP_ID_8761B,
69 CHIP_ID_8852A = 18,
70 CHIP_ID_8852B = 20,
71 CHIP_ID_8852C = 25,
72 CHIP_ID_8851B = 36,
73 CHIP_ID_8922A = 44,
74 CHIP_ID_8852BT = 47,
75 CHIP_ID_8761C = 51,
76 };
77
78 struct id_table {
79 __u16 match_flags;
80 __u16 lmp_subver;
81 __u16 hci_rev;
82 __u8 hci_ver;
83 __u8 hci_bus;
84 __u8 chip_type;
85 bool config_needed;
86 bool has_rom_version;
87 bool has_msft_ext;
88 char *fw_name;
89 char *cfg_name;
90 char *hw_info;
91 };
92
93 struct btrtl_device_info {
94 const struct id_table *ic_info;
95 u8 rom_version;
96 u8 *fw_data;
97 int fw_len;
98 u8 *cfg_data;
99 int cfg_len;
100 bool drop_fw;
101 int project_id;
102 u8 key_id;
103 struct list_head patch_subsecs;
104 };
105
106 static const struct id_table ic_id_table[] = {
107 /* 8723A */
108 { IC_INFO(RTL_ROM_LMP_8723A, 0xb, 0x6, HCI_USB),
109 .config_needed = false,
110 .has_rom_version = false,
111 .fw_name = "rtl_bt/rtl8723a_fw",
112 .cfg_name = NULL,
113 .hw_info = "rtl8723au" },
114
115 /* 8723BS */
116 { IC_INFO(RTL_ROM_LMP_8723B, 0xb, 0x6, HCI_UART),
117 .config_needed = true,
118 .has_rom_version = true,
119 .fw_name = "rtl_bt/rtl8723bs_fw",
120 .cfg_name = "rtl_bt/rtl8723bs_config",
121 .hw_info = "rtl8723bs" },
122
123 /* 8723B */
124 { IC_INFO(RTL_ROM_LMP_8723B, 0xb, 0x6, HCI_USB),
125 .config_needed = false,
126 .has_rom_version = true,
127 .fw_name = "rtl_bt/rtl8723b_fw",
128 .cfg_name = "rtl_bt/rtl8723b_config",
129 .hw_info = "rtl8723bu" },
130
131 /* 8723CS-CG */
132 { .match_flags = IC_MATCH_FL_LMPSUBV | IC_MATCH_FL_CHIP_TYPE |
133 IC_MATCH_FL_HCIBUS,
134 .lmp_subver = RTL_ROM_LMP_8703B,
135 .chip_type = RTL_CHIP_8723CS_CG,
136 .hci_bus = HCI_UART,
137 .config_needed = true,
138 .has_rom_version = true,
139 .fw_name = "rtl_bt/rtl8723cs_cg_fw",
140 .cfg_name = "rtl_bt/rtl8723cs_cg_config",
141 .hw_info = "rtl8723cs-cg" },
142
143 /* 8723CS-VF */
144 { .match_flags = IC_MATCH_FL_LMPSUBV | IC_MATCH_FL_CHIP_TYPE |
145 IC_MATCH_FL_HCIBUS,
146 .lmp_subver = RTL_ROM_LMP_8703B,
147 .chip_type = RTL_CHIP_8723CS_VF,
148 .hci_bus = HCI_UART,
149 .config_needed = true,
150 .has_rom_version = true,
151 .fw_name = "rtl_bt/rtl8723cs_vf_fw",
152 .cfg_name = "rtl_bt/rtl8723cs_vf_config",
153 .hw_info = "rtl8723cs-vf" },
154
155 /* 8723CS-XX */
156 { .match_flags = IC_MATCH_FL_LMPSUBV | IC_MATCH_FL_CHIP_TYPE |
157 IC_MATCH_FL_HCIBUS,
158 .lmp_subver = RTL_ROM_LMP_8703B,
159 .chip_type = RTL_CHIP_8723CS_XX,
160 .hci_bus = HCI_UART,
161 .config_needed = true,
162 .has_rom_version = true,
163 .fw_name = "rtl_bt/rtl8723cs_xx_fw",
164 .cfg_name = "rtl_bt/rtl8723cs_xx_config",
165 .hw_info = "rtl8723cs" },
166
167 /* 8723D */
168 { IC_INFO(RTL_ROM_LMP_8723B, 0xd, 0x8, HCI_USB),
169 .config_needed = true,
170 .has_rom_version = true,
171 .fw_name = "rtl_bt/rtl8723d_fw",
172 .cfg_name = "rtl_bt/rtl8723d_config",
173 .hw_info = "rtl8723du" },
174
175 /* 8723DS */
176 { IC_INFO(RTL_ROM_LMP_8723B, 0xd, 0x8, HCI_UART),
177 .config_needed = true,
178 .has_rom_version = true,
179 .fw_name = "rtl_bt/rtl8723ds_fw",
180 .cfg_name = "rtl_bt/rtl8723ds_config",
181 .hw_info = "rtl8723ds" },
182
183 /* 8821A */
184 { IC_INFO(RTL_ROM_LMP_8821A, 0xa, 0x6, HCI_USB),
185 .config_needed = false,
186 .has_rom_version = true,
187 .fw_name = "rtl_bt/rtl8821a_fw",
188 .cfg_name = "rtl_bt/rtl8821a_config",
189 .hw_info = "rtl8821au" },
190
191 /* 8821C */
192 { IC_INFO(RTL_ROM_LMP_8821A, 0xc, 0x8, HCI_USB),
193 .config_needed = false,
194 .has_rom_version = true,
195 .has_msft_ext = true,
196 .fw_name = "rtl_bt/rtl8821c_fw",
197 .cfg_name = "rtl_bt/rtl8821c_config",
198 .hw_info = "rtl8821cu" },
199
200 /* 8821CS */
201 { IC_INFO(RTL_ROM_LMP_8821A, 0xc, 0x8, HCI_UART),
202 .config_needed = true,
203 .has_rom_version = true,
204 .has_msft_ext = true,
205 .fw_name = "rtl_bt/rtl8821cs_fw",
206 .cfg_name = "rtl_bt/rtl8821cs_config",
207 .hw_info = "rtl8821cs" },
208
209 /* 8761A */
210 { IC_INFO(RTL_ROM_LMP_8761A, 0xa, 0x6, HCI_USB),
211 .config_needed = false,
212 .has_rom_version = true,
213 .fw_name = "rtl_bt/rtl8761a_fw",
214 .cfg_name = "rtl_bt/rtl8761a_config",
215 .hw_info = "rtl8761au" },
216
217 /* 8761B */
218 { IC_INFO(RTL_ROM_LMP_8761A, 0xb, 0xa, HCI_UART),
219 .config_needed = false,
220 .has_rom_version = true,
221 .has_msft_ext = true,
222 .fw_name = "rtl_bt/rtl8761b_fw",
223 .cfg_name = "rtl_bt/rtl8761b_config",
224 .hw_info = "rtl8761btv" },
225
226 /* 8761BU */
227 { IC_INFO(RTL_ROM_LMP_8761A, 0xb, 0xa, HCI_USB),
228 .config_needed = false,
229 .has_rom_version = true,
230 .fw_name = "rtl_bt/rtl8761bu_fw",
231 .cfg_name = "rtl_bt/rtl8761bu_config",
232 .hw_info = "rtl8761bu" },
233
234 /* 8761CU */
235 { IC_INFO(RTL_ROM_LMP_8761A, 0x0e, 0, HCI_USB),
236 .config_needed = false,
237 .has_rom_version = true,
238 .fw_name = "rtl_bt/rtl8761cu_fw",
239 .cfg_name = "rtl_bt/rtl8761cu_config",
240 .hw_info = "rtl8761cu" },
241
242 /* 8822C with UART interface */
243 { IC_INFO(RTL_ROM_LMP_8822B, 0xc, 0x8, HCI_UART),
244 .config_needed = true,
245 .has_rom_version = true,
246 .has_msft_ext = true,
247 .fw_name = "rtl_bt/rtl8822cs_fw",
248 .cfg_name = "rtl_bt/rtl8822cs_config",
249 .hw_info = "rtl8822cs" },
250
251 /* 8822C with UART interface */
252 { IC_INFO(RTL_ROM_LMP_8822B, 0xc, 0xa, HCI_UART),
253 .config_needed = true,
254 .has_rom_version = true,
255 .has_msft_ext = true,
256 .fw_name = "rtl_bt/rtl8822cs_fw",
257 .cfg_name = "rtl_bt/rtl8822cs_config",
258 .hw_info = "rtl8822cs" },
259
260 /* 8822C with USB interface */
261 { IC_INFO(RTL_ROM_LMP_8822B, 0xc, 0xa, HCI_USB),
262 .config_needed = false,
263 .has_rom_version = true,
264 .has_msft_ext = true,
265 .fw_name = "rtl_bt/rtl8822cu_fw",
266 .cfg_name = "rtl_bt/rtl8822cu_config",
267 .hw_info = "rtl8822cu" },
268
269 /* 8822B */
270 { IC_INFO(RTL_ROM_LMP_8822B, 0xb, 0x7, HCI_USB),
271 .config_needed = true,
272 .has_rom_version = true,
273 .has_msft_ext = true,
274 .fw_name = "rtl_bt/rtl8822b_fw",
275 .cfg_name = "rtl_bt/rtl8822b_config",
276 .hw_info = "rtl8822bu" },
277
278 /* 8852A */
279 { IC_INFO(RTL_ROM_LMP_8852A, 0xa, 0xb, HCI_USB),
280 .config_needed = false,
281 .has_rom_version = true,
282 .has_msft_ext = true,
283 .fw_name = "rtl_bt/rtl8852au_fw",
284 .cfg_name = "rtl_bt/rtl8852au_config",
285 .hw_info = "rtl8852au" },
286
287 /* 8852B with UART interface */
288 { IC_INFO(RTL_ROM_LMP_8852A, 0xb, 0xb, HCI_UART),
289 .config_needed = true,
290 .has_rom_version = true,
291 .has_msft_ext = true,
292 .fw_name = "rtl_bt/rtl8852bs_fw",
293 .cfg_name = "rtl_bt/rtl8852bs_config",
294 .hw_info = "rtl8852bs" },
295
296 /* 8852B */
297 { IC_INFO(RTL_ROM_LMP_8852A, 0xb, 0xb, HCI_USB),
298 .config_needed = false,
299 .has_rom_version = true,
300 .has_msft_ext = true,
301 .fw_name = "rtl_bt/rtl8852bu_fw",
302 .cfg_name = "rtl_bt/rtl8852bu_config",
303 .hw_info = "rtl8852bu" },
304
305 /* 8852C */
306 { IC_INFO(RTL_ROM_LMP_8852A, 0xc, 0xc, HCI_USB),
307 .config_needed = false,
308 .has_rom_version = true,
309 .has_msft_ext = true,
310 .fw_name = "rtl_bt/rtl8852cu_fw",
311 .cfg_name = "rtl_bt/rtl8852cu_config",
312 .hw_info = "rtl8852cu" },
313
314 /* 8851B */
315 { IC_INFO(RTL_ROM_LMP_8851B, 0xb, 0xc, HCI_USB),
316 .config_needed = false,
317 .has_rom_version = true,
318 .has_msft_ext = false,
319 .fw_name = "rtl_bt/rtl8851bu_fw",
320 .cfg_name = "rtl_bt/rtl8851bu_config",
321 .hw_info = "rtl8851bu" },
322
323 /* 8922A */
324 { IC_INFO(RTL_ROM_LMP_8922A, 0xa, 0xc, HCI_USB),
325 .config_needed = false,
326 .has_rom_version = true,
327 .has_msft_ext = true,
328 .fw_name = "rtl_bt/rtl8922au_fw",
329 .cfg_name = "rtl_bt/rtl8922au_config",
330 .hw_info = "rtl8922au" },
331
332 /* 8852BT/8852BE-VT */
333 { IC_INFO(RTL_ROM_LMP_8852A, 0x87, 0xc, HCI_USB),
334 .config_needed = false,
335 .has_rom_version = true,
336 .has_msft_ext = true,
337 .fw_name = "rtl_bt/rtl8852btu_fw",
338 .cfg_name = "rtl_bt/rtl8852btu_config",
339 .hw_info = "rtl8852btu" },
340 };
341
btrtl_match_ic(u16 lmp_subver,u16 hci_rev,u8 hci_ver,u8 hci_bus,u8 chip_type)342 static const struct id_table *btrtl_match_ic(u16 lmp_subver, u16 hci_rev,
343 u8 hci_ver, u8 hci_bus,
344 u8 chip_type)
345 {
346 int i;
347
348 for (i = 0; i < ARRAY_SIZE(ic_id_table); i++) {
349 if ((ic_id_table[i].match_flags & IC_MATCH_FL_LMPSUBV) &&
350 (ic_id_table[i].lmp_subver != lmp_subver))
351 continue;
352 if ((ic_id_table[i].match_flags & IC_MATCH_FL_HCIREV) &&
353 (ic_id_table[i].hci_rev != hci_rev))
354 continue;
355 if ((ic_id_table[i].match_flags & IC_MATCH_FL_HCIVER) &&
356 (ic_id_table[i].hci_ver != hci_ver) &&
357 (ic_id_table[i].hci_ver != 0))
358 continue;
359 if ((ic_id_table[i].match_flags & IC_MATCH_FL_HCIBUS) &&
360 (ic_id_table[i].hci_bus != hci_bus))
361 continue;
362 if ((ic_id_table[i].match_flags & IC_MATCH_FL_CHIP_TYPE) &&
363 (ic_id_table[i].chip_type != chip_type))
364 continue;
365
366 break;
367 }
368 if (i >= ARRAY_SIZE(ic_id_table))
369 return NULL;
370
371 return &ic_id_table[i];
372 }
373
btrtl_read_local_version(struct hci_dev * hdev)374 static struct sk_buff *btrtl_read_local_version(struct hci_dev *hdev)
375 {
376 struct sk_buff *skb;
377
378 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
379 HCI_INIT_TIMEOUT);
380 if (IS_ERR(skb)) {
381 rtl_dev_err(hdev, "HCI_OP_READ_LOCAL_VERSION failed (%ld)",
382 PTR_ERR(skb));
383 return skb;
384 }
385
386 if (skb->len != sizeof(struct hci_rp_read_local_version)) {
387 rtl_dev_err(hdev, "HCI_OP_READ_LOCAL_VERSION event length mismatch");
388 kfree_skb(skb);
389 return ERR_PTR(-EIO);
390 }
391
392 return skb;
393 }
394
rtl_read_rom_version(struct hci_dev * hdev,u8 * version)395 static int rtl_read_rom_version(struct hci_dev *hdev, u8 *version)
396 {
397 struct rtl_rom_version_evt *rom_version;
398 struct sk_buff *skb;
399
400 /* Read RTL ROM version command */
401 skb = __hci_cmd_sync(hdev, 0xfc6d, 0, NULL, HCI_INIT_TIMEOUT);
402 if (IS_ERR(skb)) {
403 rtl_dev_err(hdev, "Read ROM version failed (%ld)",
404 PTR_ERR(skb));
405 return PTR_ERR(skb);
406 }
407
408 if (skb->len != sizeof(*rom_version)) {
409 rtl_dev_err(hdev, "version event length mismatch");
410 kfree_skb(skb);
411 return -EIO;
412 }
413
414 rom_version = (struct rtl_rom_version_evt *)skb->data;
415 rtl_dev_info(hdev, "rom_version status=%x version=%x",
416 rom_version->status, rom_version->version);
417
418 *version = rom_version->version;
419
420 kfree_skb(skb);
421 return 0;
422 }
423
btrtl_vendor_read_reg16(struct hci_dev * hdev,struct rtl_vendor_cmd * cmd,u8 * rp)424 static int btrtl_vendor_read_reg16(struct hci_dev *hdev,
425 struct rtl_vendor_cmd *cmd, u8 *rp)
426 {
427 struct sk_buff *skb;
428 int err = 0;
429
430 skb = __hci_cmd_sync(hdev, 0xfc61, sizeof(*cmd), cmd,
431 HCI_INIT_TIMEOUT);
432 if (IS_ERR(skb)) {
433 err = PTR_ERR(skb);
434 rtl_dev_err(hdev, "RTL: Read reg16 failed (%d)", err);
435 return err;
436 }
437
438 if (skb->len != 3 || skb->data[0]) {
439 bt_dev_err(hdev, "RTL: Read reg16 length mismatch");
440 kfree_skb(skb);
441 return -EIO;
442 }
443
444 if (rp)
445 memcpy(rp, skb->data + 1, 2);
446
447 kfree_skb(skb);
448
449 return 0;
450 }
451
rtl_iov_pull_data(struct rtl_iovec * iov,u32 len)452 static void *rtl_iov_pull_data(struct rtl_iovec *iov, u32 len)
453 {
454 void *data = iov->data;
455
456 if (iov->len < len)
457 return NULL;
458
459 iov->data += len;
460 iov->len -= len;
461
462 return data;
463 }
464
btrtl_insert_ordered_subsec(struct rtl_subsection * node,struct btrtl_device_info * btrtl_dev)465 static void btrtl_insert_ordered_subsec(struct rtl_subsection *node,
466 struct btrtl_device_info *btrtl_dev)
467 {
468 struct list_head *pos;
469 struct list_head *next;
470 struct rtl_subsection *subsec;
471
472 list_for_each_safe(pos, next, &btrtl_dev->patch_subsecs) {
473 subsec = list_entry(pos, struct rtl_subsection, list);
474 if (subsec->prio >= node->prio)
475 break;
476 }
477 __list_add(&node->list, pos->prev, pos);
478 }
479
btrtl_parse_section(struct hci_dev * hdev,struct btrtl_device_info * btrtl_dev,u32 opcode,u8 * data,u32 len)480 static int btrtl_parse_section(struct hci_dev *hdev,
481 struct btrtl_device_info *btrtl_dev, u32 opcode,
482 u8 *data, u32 len)
483 {
484 struct rtl_section_hdr *hdr;
485 struct rtl_subsection *subsec;
486 struct rtl_common_subsec *common_subsec;
487 struct rtl_sec_hdr *sec_hdr;
488 int i;
489 u8 *ptr;
490 u16 num_subsecs;
491 u32 subsec_len;
492 int rc = 0;
493 struct rtl_iovec iov = {
494 .data = data,
495 .len = len,
496 };
497
498 hdr = rtl_iov_pull_data(&iov, sizeof(*hdr));
499 if (!hdr)
500 return -EINVAL;
501 num_subsecs = le16_to_cpu(hdr->num);
502
503 for (i = 0; i < num_subsecs; i++) {
504 common_subsec = rtl_iov_pull_data(&iov, sizeof(*common_subsec));
505 if (!common_subsec)
506 break;
507 subsec_len = le32_to_cpu(common_subsec->len);
508
509 rtl_dev_dbg(hdev, "subsec, eco 0x%02x, len %08x",
510 common_subsec->eco, subsec_len);
511
512 ptr = rtl_iov_pull_data(&iov, subsec_len);
513 if (!ptr)
514 break;
515
516 if (common_subsec->eco != btrtl_dev->rom_version + 1)
517 continue;
518
519 switch (opcode) {
520 case RTL_PATCH_SECURITY_HEADER:
521 sec_hdr = (void *)common_subsec;
522 if (sec_hdr->key_id != btrtl_dev->key_id)
523 continue;
524 break;
525 }
526
527 subsec = kzalloc_obj(*subsec);
528 if (!subsec)
529 return -ENOMEM;
530 subsec->opcode = opcode;
531 subsec->prio = common_subsec->prio;
532 subsec->len = subsec_len;
533 subsec->data = ptr;
534 btrtl_insert_ordered_subsec(subsec, btrtl_dev);
535 rc += subsec_len;
536 }
537
538 return rc;
539 }
540
rtlbt_parse_firmware_v2(struct hci_dev * hdev,struct btrtl_device_info * btrtl_dev,unsigned char ** _buf)541 static int rtlbt_parse_firmware_v2(struct hci_dev *hdev,
542 struct btrtl_device_info *btrtl_dev,
543 unsigned char **_buf)
544 {
545 struct rtl_epatch_header_v2 *hdr;
546 int rc;
547 u8 key_id;
548 u32 num_sections;
549 struct rtl_section *section;
550 struct rtl_subsection *entry, *tmp;
551 u32 section_len;
552 u32 opcode;
553 int len = 0;
554 int i;
555 u8 *ptr;
556 struct rtl_iovec iov = {
557 .data = btrtl_dev->fw_data,
558 .len = btrtl_dev->fw_len - 7, /* Cut the tail */
559 };
560
561 key_id = btrtl_dev->key_id;
562
563 hdr = rtl_iov_pull_data(&iov, sizeof(*hdr));
564 if (!hdr)
565 return -EINVAL;
566 num_sections = le32_to_cpu(hdr->num_sections);
567
568 rtl_dev_dbg(hdev, "FW version %08x-%08x", *((u32 *)hdr->fw_version),
569 *((u32 *)(hdr->fw_version + 4)));
570
571 for (i = 0; i < num_sections; i++) {
572 section = rtl_iov_pull_data(&iov, sizeof(*section));
573 if (!section)
574 break;
575 section_len = le32_to_cpu(section->len);
576 opcode = le32_to_cpu(section->opcode);
577
578 rtl_dev_dbg(hdev, "opcode 0x%04x", section->opcode);
579
580 ptr = rtl_iov_pull_data(&iov, section_len);
581 if (!ptr)
582 break;
583
584 switch (opcode) {
585 case RTL_PATCH_SNIPPETS:
586 rc = btrtl_parse_section(hdev, btrtl_dev, opcode,
587 ptr, section_len);
588 break;
589 case RTL_PATCH_SECURITY_HEADER:
590 /* If key_id from chip is zero, ignore all security
591 * headers.
592 */
593 if (!key_id)
594 break;
595 rc = btrtl_parse_section(hdev, btrtl_dev, opcode,
596 ptr, section_len);
597 break;
598 case RTL_PATCH_DUMMY_HEADER:
599 rc = btrtl_parse_section(hdev, btrtl_dev, opcode,
600 ptr, section_len);
601 break;
602 default:
603 rc = 0;
604 break;
605 }
606 if (rc < 0) {
607 rtl_dev_err(hdev, "RTL: Parse section (%u) err %d",
608 opcode, rc);
609 return rc;
610 }
611 len += rc;
612 }
613
614 if (!len)
615 return -ENODATA;
616
617 /* Allocate mem and copy all found subsecs. */
618 ptr = kvmalloc(len, GFP_KERNEL);
619 if (!ptr)
620 return -ENOMEM;
621
622 len = 0;
623 list_for_each_entry_safe(entry, tmp, &btrtl_dev->patch_subsecs, list) {
624 rtl_dev_dbg(hdev, "RTL: opcode %08x, addr %p, len 0x%x",
625 entry->opcode, entry->data, entry->len);
626 memcpy(ptr + len, entry->data, entry->len);
627 len += entry->len;
628 }
629
630 if (!len) {
631 kvfree(ptr);
632 return -EPERM;
633 }
634
635 *_buf = ptr;
636 return len;
637 }
638
rtlbt_parse_firmware(struct hci_dev * hdev,struct btrtl_device_info * btrtl_dev,unsigned char ** _buf)639 static int rtlbt_parse_firmware(struct hci_dev *hdev,
640 struct btrtl_device_info *btrtl_dev,
641 unsigned char **_buf)
642 {
643 static const u8 extension_sig[] = { 0x51, 0x04, 0xfd, 0x77 };
644 struct btrealtek_data *coredump_info = hci_get_priv(hdev);
645 struct rtl_epatch_header *epatch_info;
646 unsigned char *buf;
647 int i, len;
648 size_t min_size;
649 u8 opcode, length, data;
650 int project_id = -1;
651 const unsigned char *fwptr, *chip_id_base;
652 const unsigned char *patch_length_base, *patch_offset_base;
653 u32 patch_offset = 0;
654 u16 patch_length, num_patches;
655 static const struct {
656 __u16 lmp_subver;
657 __u8 id;
658 } project_id_to_lmp_subver[] = {
659 { RTL_ROM_LMP_8723A, 0 },
660 { RTL_ROM_LMP_8723B, 1 },
661 { RTL_ROM_LMP_8821A, 2 },
662 { RTL_ROM_LMP_8761A, 3 },
663 { RTL_ROM_LMP_8703B, 7 },
664 { RTL_ROM_LMP_8822B, 8 },
665 { RTL_ROM_LMP_8723B, 9 }, /* 8723D */
666 { RTL_ROM_LMP_8821A, 10 }, /* 8821C */
667 { RTL_ROM_LMP_8822B, 13 }, /* 8822C */
668 { RTL_ROM_LMP_8761A, 14 }, /* 8761B */
669 { RTL_ROM_LMP_8852A, 18 }, /* 8852A */
670 { RTL_ROM_LMP_8852A, 20 }, /* 8852B */
671 { RTL_ROM_LMP_8852A, 25 }, /* 8852C */
672 { RTL_ROM_LMP_8851B, 36 }, /* 8851B */
673 { RTL_ROM_LMP_8922A, 44 }, /* 8922A */
674 { RTL_ROM_LMP_8852A, 47 }, /* 8852BT */
675 { RTL_ROM_LMP_8761A, 51 }, /* 8761C */
676 };
677
678 if (btrtl_dev->fw_len <= 8)
679 return -EINVAL;
680
681 if (!memcmp(btrtl_dev->fw_data, RTL_EPATCH_SIGNATURE, 8))
682 min_size = sizeof(struct rtl_epatch_header) +
683 sizeof(extension_sig) + 3;
684 else if (!memcmp(btrtl_dev->fw_data, RTL_EPATCH_SIGNATURE_V2, 8))
685 min_size = sizeof(struct rtl_epatch_header_v2) +
686 sizeof(extension_sig) + 3;
687 else
688 return -EINVAL;
689
690 if (btrtl_dev->fw_len < min_size)
691 return -EINVAL;
692
693 fwptr = btrtl_dev->fw_data + btrtl_dev->fw_len - sizeof(extension_sig);
694 if (memcmp(fwptr, extension_sig, sizeof(extension_sig)) != 0) {
695 rtl_dev_err(hdev, "extension section signature mismatch");
696 return -EINVAL;
697 }
698
699 /* Loop from the end of the firmware parsing instructions, until
700 * we find an instruction that identifies the "project ID" for the
701 * hardware supported by this firmware file.
702 * Once we have that, we double-check that project_id is suitable
703 * for the hardware we are working with.
704 */
705 while (fwptr >= btrtl_dev->fw_data + (sizeof(*epatch_info) + 3)) {
706 opcode = *--fwptr;
707 length = *--fwptr;
708 data = *--fwptr;
709
710 BT_DBG("check op=%x len=%x data=%x", opcode, length, data);
711
712 if (opcode == 0xff) /* EOF */
713 break;
714
715 if (length == 0) {
716 rtl_dev_err(hdev, "found instruction with length 0");
717 return -EINVAL;
718 }
719
720 if (opcode == 0 && length == 1) {
721 project_id = data;
722 break;
723 }
724
725 fwptr -= length;
726 }
727
728 if (project_id < 0) {
729 rtl_dev_err(hdev, "failed to find version instruction");
730 return -EINVAL;
731 }
732
733 /* Find project_id in table */
734 for (i = 0; i < ARRAY_SIZE(project_id_to_lmp_subver); i++) {
735 if (project_id == project_id_to_lmp_subver[i].id) {
736 btrtl_dev->project_id = project_id;
737 break;
738 }
739 }
740
741 if (i >= ARRAY_SIZE(project_id_to_lmp_subver)) {
742 rtl_dev_err(hdev, "unknown project id %d", project_id);
743 return -EINVAL;
744 }
745
746 if (btrtl_dev->ic_info->lmp_subver !=
747 project_id_to_lmp_subver[i].lmp_subver) {
748 rtl_dev_err(hdev, "firmware is for %x but this is a %x",
749 project_id_to_lmp_subver[i].lmp_subver,
750 btrtl_dev->ic_info->lmp_subver);
751 return -EINVAL;
752 }
753
754 if (memcmp(btrtl_dev->fw_data, RTL_EPATCH_SIGNATURE, 8) != 0) {
755 if (!memcmp(btrtl_dev->fw_data, RTL_EPATCH_SIGNATURE_V2, 8))
756 return rtlbt_parse_firmware_v2(hdev, btrtl_dev, _buf);
757 rtl_dev_err(hdev, "bad EPATCH signature");
758 return -EINVAL;
759 }
760
761 epatch_info = (struct rtl_epatch_header *)btrtl_dev->fw_data;
762 num_patches = le16_to_cpu(epatch_info->num_patches);
763
764 BT_DBG("fw_version=%x, num_patches=%d",
765 le32_to_cpu(epatch_info->fw_version), num_patches);
766 coredump_info->rtl_dump.fw_version = le32_to_cpu(epatch_info->fw_version);
767
768 /* After the rtl_epatch_header there is a funky patch metadata section.
769 * Assuming 2 patches, the layout is:
770 * ChipID1 ChipID2 PatchLength1 PatchLength2 PatchOffset1 PatchOffset2
771 *
772 * Find the right patch for this chip.
773 */
774 min_size += 8 * num_patches;
775 if (btrtl_dev->fw_len < min_size)
776 return -EINVAL;
777
778 chip_id_base = btrtl_dev->fw_data + sizeof(struct rtl_epatch_header);
779 patch_length_base = chip_id_base + (sizeof(u16) * num_patches);
780 patch_offset_base = patch_length_base + (sizeof(u16) * num_patches);
781 for (i = 0; i < num_patches; i++) {
782 u16 chip_id = get_unaligned_le16(chip_id_base +
783 (i * sizeof(u16)));
784 if (chip_id == btrtl_dev->rom_version + 1) {
785 patch_length = get_unaligned_le16(patch_length_base +
786 (i * sizeof(u16)));
787 patch_offset = get_unaligned_le32(patch_offset_base +
788 (i * sizeof(u32)));
789 break;
790 }
791 }
792
793 if (!patch_offset) {
794 rtl_dev_err(hdev, "didn't find patch for chip id %d",
795 btrtl_dev->rom_version);
796 return -EINVAL;
797 }
798
799 BT_DBG("length=%x offset=%x index %d", patch_length, patch_offset, i);
800 if (patch_length < sizeof(epatch_info->fw_version) ||
801 patch_offset > btrtl_dev->fw_len ||
802 patch_length > btrtl_dev->fw_len - patch_offset)
803 return -EINVAL;
804
805 /* Copy the firmware into a new buffer and write the version at
806 * the end.
807 */
808 len = patch_length;
809 buf = kvmalloc(patch_length, GFP_KERNEL);
810 if (!buf)
811 return -ENOMEM;
812
813 memcpy(buf, btrtl_dev->fw_data + patch_offset, patch_length - 4);
814 memcpy(buf + patch_length - 4, &epatch_info->fw_version, 4);
815
816 *_buf = buf;
817 return len;
818 }
819
rtl_download_firmware(struct hci_dev * hdev,const unsigned char * data,int fw_len)820 static int rtl_download_firmware(struct hci_dev *hdev,
821 const unsigned char *data, int fw_len)
822 {
823 struct rtl_download_cmd *dl_cmd;
824 int frag_num = fw_len / RTL_FRAG_LEN + 1;
825 int frag_len = RTL_FRAG_LEN;
826 int ret = 0;
827 int i;
828 int j = 0;
829 struct sk_buff *skb;
830 struct hci_rp_read_local_version *rp;
831
832 dl_cmd = kmalloc_obj(*dl_cmd);
833 if (!dl_cmd)
834 return -ENOMEM;
835
836 for (i = 0; i < frag_num; i++) {
837 struct sk_buff *skb;
838
839 dl_cmd->index = j++;
840 if (dl_cmd->index == 0x7f)
841 j = 1;
842
843 if (i == (frag_num - 1)) {
844 dl_cmd->index |= 0x80; /* data end */
845 frag_len = fw_len % RTL_FRAG_LEN;
846 }
847 rtl_dev_dbg(hdev, "download fw (%d/%d). index = %d", i,
848 frag_num, dl_cmd->index);
849 memcpy(dl_cmd->data, data, frag_len);
850
851 /* Send download command */
852 skb = __hci_cmd_sync(hdev, 0xfc20, frag_len + 1, dl_cmd,
853 HCI_INIT_TIMEOUT);
854 if (IS_ERR(skb)) {
855 rtl_dev_err(hdev, "download fw command failed (%ld)",
856 PTR_ERR(skb));
857 ret = PTR_ERR(skb);
858 goto out;
859 }
860
861 if (skb->len != sizeof(struct rtl_download_response)) {
862 rtl_dev_err(hdev, "download fw event length mismatch");
863 kfree_skb(skb);
864 ret = -EIO;
865 goto out;
866 }
867
868 kfree_skb(skb);
869 data += RTL_FRAG_LEN;
870 }
871
872 skb = btrtl_read_local_version(hdev);
873 if (IS_ERR(skb)) {
874 ret = PTR_ERR(skb);
875 rtl_dev_err(hdev, "read local version failed");
876 goto out;
877 }
878
879 rp = (struct hci_rp_read_local_version *)skb->data;
880 rtl_dev_info(hdev, "fw version 0x%04x%04x",
881 __le16_to_cpu(rp->hci_rev), __le16_to_cpu(rp->lmp_subver));
882 kfree_skb(skb);
883
884 out:
885 kfree(dl_cmd);
886 return ret;
887 }
888
rtl_load_file(struct hci_dev * hdev,const char * name,u8 ** buff)889 static int rtl_load_file(struct hci_dev *hdev, const char *name, u8 **buff)
890 {
891 const struct firmware *fw;
892 int ret;
893
894 rtl_dev_info(hdev, "loading %s", name);
895 ret = request_firmware(&fw, name, &hdev->dev);
896 if (ret < 0)
897 return ret;
898 ret = fw->size;
899 *buff = kvmemdup(fw->data, fw->size, GFP_KERNEL);
900 if (!*buff)
901 ret = -ENOMEM;
902
903 release_firmware(fw);
904
905 return ret;
906 }
907
btrtl_setup_rtl8723a(struct hci_dev * hdev,struct btrtl_device_info * btrtl_dev)908 static int btrtl_setup_rtl8723a(struct hci_dev *hdev,
909 struct btrtl_device_info *btrtl_dev)
910 {
911 if (btrtl_dev->fw_len < 8)
912 return -EINVAL;
913
914 /* Check that the firmware doesn't have the epatch signature
915 * (which is only for RTL8723B and newer).
916 */
917 if (!memcmp(btrtl_dev->fw_data, RTL_EPATCH_SIGNATURE, 8)) {
918 rtl_dev_err(hdev, "unexpected EPATCH signature!");
919 return -EINVAL;
920 }
921
922 return rtl_download_firmware(hdev, btrtl_dev->fw_data,
923 btrtl_dev->fw_len);
924 }
925
btrtl_setup_rtl8723b(struct hci_dev * hdev,struct btrtl_device_info * btrtl_dev)926 static int btrtl_setup_rtl8723b(struct hci_dev *hdev,
927 struct btrtl_device_info *btrtl_dev)
928 {
929 unsigned char *fw_data = NULL;
930 int ret;
931 u8 *tbuff;
932
933 ret = rtlbt_parse_firmware(hdev, btrtl_dev, &fw_data);
934 if (ret < 0)
935 goto out;
936
937 if (btrtl_dev->cfg_len > 0) {
938 tbuff = kvzalloc(ret + btrtl_dev->cfg_len, GFP_KERNEL);
939 if (!tbuff) {
940 ret = -ENOMEM;
941 goto out;
942 }
943
944 memcpy(tbuff, fw_data, ret);
945 kvfree(fw_data);
946
947 memcpy(tbuff + ret, btrtl_dev->cfg_data, btrtl_dev->cfg_len);
948 ret += btrtl_dev->cfg_len;
949
950 fw_data = tbuff;
951 }
952
953 rtl_dev_info(hdev, "cfg_sz %d, total sz %d", btrtl_dev->cfg_len, ret);
954
955 ret = rtl_download_firmware(hdev, fw_data, ret);
956
957 out:
958 kvfree(fw_data);
959 return ret;
960 }
961
btrtl_coredump(struct hci_dev * hdev)962 static void btrtl_coredump(struct hci_dev *hdev)
963 {
964 static const u8 param[] = { 0x00, 0x00 };
965
966 __hci_cmd_send(hdev, RTL_VSC_OP_COREDUMP, sizeof(param), param);
967 }
968
btrtl_dmp_hdr(struct hci_dev * hdev,struct sk_buff * skb)969 static void btrtl_dmp_hdr(struct hci_dev *hdev, struct sk_buff *skb)
970 {
971 struct btrealtek_data *coredump_info = hci_get_priv(hdev);
972 char buf[80];
973
974 if (coredump_info->rtl_dump.controller)
975 snprintf(buf, sizeof(buf), "Controller Name: %s\n",
976 coredump_info->rtl_dump.controller);
977 else
978 snprintf(buf, sizeof(buf), "Controller Name: Unknown\n");
979 skb_put_data(skb, buf, strlen(buf));
980
981 snprintf(buf, sizeof(buf), "Firmware Version: 0x%X\n",
982 coredump_info->rtl_dump.fw_version);
983 skb_put_data(skb, buf, strlen(buf));
984
985 snprintf(buf, sizeof(buf), "Driver: %s\n", coredump_info->rtl_dump.driver_name);
986 skb_put_data(skb, buf, strlen(buf));
987
988 snprintf(buf, sizeof(buf), "Vendor: Realtek\n");
989 skb_put_data(skb, buf, strlen(buf));
990 }
991
btrtl_register_devcoredump_support(struct hci_dev * hdev)992 static void btrtl_register_devcoredump_support(struct hci_dev *hdev)
993 {
994 hci_devcd_register(hdev, btrtl_coredump, btrtl_dmp_hdr, NULL);
995
996 }
997
btrtl_set_driver_name(struct hci_dev * hdev,const char * driver_name)998 void btrtl_set_driver_name(struct hci_dev *hdev, const char *driver_name)
999 {
1000 struct btrealtek_data *coredump_info = hci_get_priv(hdev);
1001
1002 coredump_info->rtl_dump.driver_name = driver_name;
1003 }
1004 EXPORT_SYMBOL_GPL(btrtl_set_driver_name);
1005
rtl_has_chip_type(u16 lmp_subver)1006 static bool rtl_has_chip_type(u16 lmp_subver)
1007 {
1008 switch (lmp_subver) {
1009 case RTL_ROM_LMP_8703B:
1010 return true;
1011 default:
1012 break;
1013 }
1014
1015 return false;
1016 }
1017
rtl_read_chip_type(struct hci_dev * hdev,u8 * type)1018 static int rtl_read_chip_type(struct hci_dev *hdev, u8 *type)
1019 {
1020 struct rtl_chip_type_evt *chip_type;
1021 struct sk_buff *skb;
1022 const unsigned char cmd_buf[] = {0x00, 0x94, 0xa0, 0x00, 0xb0};
1023
1024 /* Read RTL chip type command */
1025 skb = __hci_cmd_sync(hdev, 0xfc61, 5, cmd_buf, HCI_INIT_TIMEOUT);
1026 if (IS_ERR(skb)) {
1027 rtl_dev_err(hdev, "Read chip type failed (%ld)",
1028 PTR_ERR(skb));
1029 return PTR_ERR(skb);
1030 }
1031
1032 chip_type = skb_pull_data(skb, sizeof(*chip_type));
1033 if (!chip_type) {
1034 rtl_dev_err(hdev, "RTL chip type event length mismatch");
1035 kfree_skb(skb);
1036 return -EIO;
1037 }
1038
1039 rtl_dev_info(hdev, "chip_type status=%x type=%x",
1040 chip_type->status, chip_type->type);
1041
1042 *type = chip_type->type & 0x0f;
1043
1044 kfree_skb(skb);
1045 return 0;
1046 }
1047
btrtl_free(struct btrtl_device_info * btrtl_dev)1048 void btrtl_free(struct btrtl_device_info *btrtl_dev)
1049 {
1050 struct rtl_subsection *entry, *tmp;
1051
1052 kvfree(btrtl_dev->fw_data);
1053 kvfree(btrtl_dev->cfg_data);
1054
1055 list_for_each_entry_safe(entry, tmp, &btrtl_dev->patch_subsecs, list) {
1056 list_del(&entry->list);
1057 kfree(entry);
1058 }
1059
1060 kfree(btrtl_dev);
1061 }
1062 EXPORT_SYMBOL_GPL(btrtl_free);
1063
btrtl_initialize(struct hci_dev * hdev,const char * postfix)1064 struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev,
1065 const char *postfix)
1066 {
1067 struct btrealtek_data *coredump_info = hci_get_priv(hdev);
1068 struct btrtl_device_info *btrtl_dev;
1069 struct sk_buff *skb;
1070 struct hci_rp_read_local_version *resp;
1071 struct hci_command_hdr *cmd;
1072 char fw_name[40];
1073 char cfg_name[40];
1074 u16 hci_rev, lmp_subver;
1075 u8 hci_ver, lmp_ver, chip_type = 0;
1076 int ret;
1077 int rc;
1078 u8 key_id;
1079 u8 reg_val[2];
1080
1081 btrtl_dev = kzalloc_obj(*btrtl_dev);
1082 if (!btrtl_dev) {
1083 ret = -ENOMEM;
1084 goto err_alloc;
1085 }
1086
1087 INIT_LIST_HEAD(&btrtl_dev->patch_subsecs);
1088
1089 check_version:
1090 ret = btrtl_vendor_read_reg16(hdev, RTL_CHIP_SUBVER, reg_val);
1091 if (ret < 0)
1092 goto err_free;
1093 lmp_subver = get_unaligned_le16(reg_val);
1094
1095 if (lmp_subver == RTL_ROM_LMP_8822B) {
1096 ret = btrtl_vendor_read_reg16(hdev, RTL_CHIP_REV, reg_val);
1097 if (ret < 0)
1098 goto err_free;
1099 hci_rev = get_unaligned_le16(reg_val);
1100
1101 /* 8822E */
1102 if (hci_rev == 0x000e) {
1103 hci_ver = 0x0c;
1104 lmp_ver = 0x0c;
1105 btrtl_dev->ic_info = btrtl_match_ic(lmp_subver, hci_rev,
1106 hci_ver, hdev->bus,
1107 chip_type);
1108 goto next;
1109 }
1110 }
1111
1112 skb = btrtl_read_local_version(hdev);
1113 if (IS_ERR(skb)) {
1114 ret = PTR_ERR(skb);
1115 goto err_free;
1116 }
1117
1118 resp = (struct hci_rp_read_local_version *)skb->data;
1119
1120 hci_ver = resp->hci_ver;
1121 hci_rev = le16_to_cpu(resp->hci_rev);
1122 lmp_ver = resp->lmp_ver;
1123 lmp_subver = le16_to_cpu(resp->lmp_subver);
1124
1125 kfree_skb(skb);
1126
1127 if (rtl_has_chip_type(lmp_subver)) {
1128 ret = rtl_read_chip_type(hdev, &chip_type);
1129 if (ret)
1130 goto err_free;
1131 }
1132
1133 btrtl_dev->ic_info = btrtl_match_ic(lmp_subver, hci_rev, hci_ver,
1134 hdev->bus, chip_type);
1135
1136 next:
1137 rtl_dev_info(hdev, "examining hci_ver=%02x hci_rev=%04x lmp_ver=%02x lmp_subver=%04x",
1138 hci_ver, hci_rev,
1139 lmp_ver, lmp_subver);
1140
1141 if (!btrtl_dev->ic_info && !btrtl_dev->drop_fw)
1142 btrtl_dev->drop_fw = true;
1143 else
1144 btrtl_dev->drop_fw = false;
1145
1146 if (btrtl_dev->drop_fw) {
1147 skb = bt_skb_alloc(sizeof(*cmd), GFP_KERNEL);
1148 if (!skb)
1149 goto err_free;
1150
1151 cmd = skb_put(skb, HCI_COMMAND_HDR_SIZE);
1152 cmd->opcode = cpu_to_le16(0xfc66);
1153 cmd->plen = 0;
1154
1155 hci_skb_pkt_type(skb) = HCI_COMMAND_PKT;
1156
1157 ret = hdev->send(hdev, skb);
1158 if (ret < 0) {
1159 bt_dev_err(hdev, "sending frame failed (%d)", ret);
1160 kfree_skb(skb);
1161 goto err_free;
1162 }
1163
1164 /* Ensure the above vendor command is sent to controller and
1165 * process has done.
1166 */
1167 msleep(200);
1168
1169 goto check_version;
1170 }
1171
1172 if (!btrtl_dev->ic_info) {
1173 rtl_dev_info(hdev, "unknown IC info, lmp subver %04x, hci rev %04x, hci ver %04x",
1174 lmp_subver, hci_rev, hci_ver);
1175 return btrtl_dev;
1176 }
1177
1178 if (btrtl_dev->ic_info->has_rom_version) {
1179 ret = rtl_read_rom_version(hdev, &btrtl_dev->rom_version);
1180 if (ret)
1181 goto err_free;
1182 }
1183
1184 if (!btrtl_dev->ic_info->fw_name) {
1185 ret = -ENOMEM;
1186 goto err_free;
1187 }
1188
1189 rc = btrtl_vendor_read_reg16(hdev, RTL_SEC_PROJ, reg_val);
1190 if (rc < 0)
1191 goto err_free;
1192
1193 key_id = reg_val[0];
1194 btrtl_dev->key_id = key_id;
1195 rtl_dev_info(hdev, "%s: key id %u", __func__, key_id);
1196
1197 btrtl_dev->fw_len = -EIO;
1198 if (lmp_subver == RTL_ROM_LMP_8852A && hci_rev == 0x000c) {
1199 snprintf(fw_name, sizeof(fw_name), "%s_v2.bin",
1200 btrtl_dev->ic_info->fw_name);
1201 btrtl_dev->fw_len = rtl_load_file(hdev, fw_name,
1202 &btrtl_dev->fw_data);
1203 }
1204
1205 if (btrtl_dev->fw_len < 0) {
1206 snprintf(fw_name, sizeof(fw_name), "%s.bin",
1207 btrtl_dev->ic_info->fw_name);
1208 btrtl_dev->fw_len = rtl_load_file(hdev, fw_name,
1209 &btrtl_dev->fw_data);
1210 }
1211
1212 if (btrtl_dev->fw_len < 0) {
1213 rtl_dev_err(hdev, "firmware file %s not found",
1214 btrtl_dev->ic_info->fw_name);
1215 ret = btrtl_dev->fw_len;
1216 goto err_free;
1217 }
1218
1219 if (btrtl_dev->ic_info->cfg_name && !btrtl_dev->key_id) {
1220 if (postfix) {
1221 snprintf(cfg_name, sizeof(cfg_name), "%s-%s.bin",
1222 btrtl_dev->ic_info->cfg_name, postfix);
1223 } else {
1224 snprintf(cfg_name, sizeof(cfg_name), "%s.bin",
1225 btrtl_dev->ic_info->cfg_name);
1226 }
1227 btrtl_dev->cfg_len = rtl_load_file(hdev, cfg_name,
1228 &btrtl_dev->cfg_data);
1229 if (btrtl_dev->ic_info->config_needed &&
1230 btrtl_dev->cfg_len <= 0) {
1231 rtl_dev_err(hdev, "mandatory config file %s not found",
1232 btrtl_dev->ic_info->cfg_name);
1233 ret = btrtl_dev->cfg_len;
1234 if (!ret)
1235 ret = -EINVAL;
1236 goto err_free;
1237 }
1238 }
1239
1240 /* The following chips supports the Microsoft vendor extension,
1241 * therefore set the corresponding VsMsftOpCode.
1242 */
1243 if (btrtl_dev->ic_info->has_msft_ext)
1244 hci_set_msft_opcode(hdev, 0xFCF0);
1245
1246 if (btrtl_dev->ic_info)
1247 coredump_info->rtl_dump.controller = btrtl_dev->ic_info->hw_info;
1248
1249 return btrtl_dev;
1250
1251 err_free:
1252 btrtl_free(btrtl_dev);
1253 err_alloc:
1254 return ERR_PTR(ret);
1255 }
1256 EXPORT_SYMBOL_GPL(btrtl_initialize);
1257
btrtl_download_firmware(struct hci_dev * hdev,struct btrtl_device_info * btrtl_dev)1258 int btrtl_download_firmware(struct hci_dev *hdev,
1259 struct btrtl_device_info *btrtl_dev)
1260 {
1261 int err = 0;
1262
1263 /* Match a set of subver values that correspond to stock firmware,
1264 * which is not compatible with standard btusb.
1265 * If matched, upload an alternative firmware that does conform to
1266 * standard btusb. Once that firmware is uploaded, the subver changes
1267 * to a different value.
1268 */
1269 if (!btrtl_dev->ic_info) {
1270 rtl_dev_info(hdev, "assuming no firmware upload needed");
1271 err = 0;
1272 goto done;
1273 }
1274
1275 switch (btrtl_dev->ic_info->lmp_subver) {
1276 case RTL_ROM_LMP_8723A:
1277 err = btrtl_setup_rtl8723a(hdev, btrtl_dev);
1278 break;
1279 case RTL_ROM_LMP_8723B:
1280 case RTL_ROM_LMP_8821A:
1281 case RTL_ROM_LMP_8761A:
1282 case RTL_ROM_LMP_8822B:
1283 case RTL_ROM_LMP_8852A:
1284 case RTL_ROM_LMP_8703B:
1285 case RTL_ROM_LMP_8851B:
1286 case RTL_ROM_LMP_8922A:
1287 err = btrtl_setup_rtl8723b(hdev, btrtl_dev);
1288 break;
1289 default:
1290 rtl_dev_info(hdev, "assuming no firmware upload needed");
1291 break;
1292 }
1293
1294 done:
1295 btrtl_register_devcoredump_support(hdev);
1296
1297 return err;
1298 }
1299 EXPORT_SYMBOL_GPL(btrtl_download_firmware);
1300
btrtl_set_quirks(struct hci_dev * hdev,struct btrtl_device_info * btrtl_dev)1301 void btrtl_set_quirks(struct hci_dev *hdev, struct btrtl_device_info *btrtl_dev)
1302 {
1303 /* Enable controller to do both LE scan and BR/EDR inquiry
1304 * simultaneously.
1305 */
1306 hci_set_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY);
1307
1308 /* Enable central-peripheral role (able to create new connections with
1309 * an existing connection in slave role).
1310 */
1311 /* Enable WBS supported for the specific Realtek devices. */
1312 switch (btrtl_dev->project_id) {
1313 case CHIP_ID_8822C:
1314 case CHIP_ID_8852A:
1315 case CHIP_ID_8852B:
1316 case CHIP_ID_8852C:
1317 case CHIP_ID_8851B:
1318 case CHIP_ID_8922A:
1319 case CHIP_ID_8852BT:
1320 case CHIP_ID_8761C:
1321 hci_set_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED);
1322
1323 /* RTL8852C needs to transmit mSBC data continuously without
1324 * the zero length of USB packets for the ALT 6 supported chips
1325 */
1326 if (btrtl_dev->project_id == CHIP_ID_8852C)
1327 btrealtek_set_flag(hdev, REALTEK_ALT6_CONTINUOUS_TX_CHIP);
1328
1329 if (btrtl_dev->project_id == CHIP_ID_8852A ||
1330 btrtl_dev->project_id == CHIP_ID_8852B ||
1331 btrtl_dev->project_id == CHIP_ID_8852C)
1332 hci_set_quirk(hdev,
1333 HCI_QUIRK_USE_MSFT_EXT_ADDRESS_FILTER);
1334
1335 hci_set_aosp_capable(hdev);
1336 break;
1337 default:
1338 rtl_dev_dbg(hdev, "Central-peripheral role not enabled.");
1339 rtl_dev_dbg(hdev, "WBS supported not enabled.");
1340 break;
1341 }
1342
1343 if (!btrtl_dev->ic_info)
1344 return;
1345
1346 switch (btrtl_dev->project_id) {
1347 case CHIP_ID_8761B:
1348 /* RTL8761B/BU reports HCI version 5.1 but does not support
1349 * the LE Extended Scan commands (Opcode 0x2042), causing
1350 * repeated -EBUSY failures when BlueZ attempts extended
1351 * scanning while a connection is active.
1352 */
1353 hci_set_quirk(hdev, HCI_QUIRK_BROKEN_EXT_SCAN);
1354 break;
1355 default:
1356 break;
1357 }
1358
1359 switch (btrtl_dev->ic_info->lmp_subver) {
1360 case RTL_ROM_LMP_8703B:
1361 /* 8723CS reports two pages for local ext features,
1362 * but it doesn't support any features from page 2 -
1363 * it either responds with garbage or with error status
1364 */
1365 hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LOCAL_EXT_FEATURES_PAGE_2);
1366 break;
1367 default:
1368 break;
1369 }
1370 }
1371 EXPORT_SYMBOL_GPL(btrtl_set_quirks);
1372
btrtl_setup_realtek(struct hci_dev * hdev)1373 int btrtl_setup_realtek(struct hci_dev *hdev)
1374 {
1375 struct btrtl_device_info *btrtl_dev;
1376 int ret;
1377
1378 btrtl_dev = btrtl_initialize(hdev, NULL);
1379 if (IS_ERR(btrtl_dev))
1380 return PTR_ERR(btrtl_dev);
1381
1382 ret = btrtl_download_firmware(hdev, btrtl_dev);
1383
1384 btrtl_set_quirks(hdev, btrtl_dev);
1385
1386 if (btrtl_dev->ic_info) {
1387 hci_set_hw_info(hdev,
1388 "RTL lmp_subver=%u hci_rev=%u hci_ver=%u hci_bus=%u",
1389 btrtl_dev->ic_info->lmp_subver,
1390 btrtl_dev->ic_info->hci_rev,
1391 btrtl_dev->ic_info->hci_ver,
1392 btrtl_dev->ic_info->hci_bus);
1393 }
1394
1395 btrtl_free(btrtl_dev);
1396 return ret;
1397 }
1398 EXPORT_SYMBOL_GPL(btrtl_setup_realtek);
1399
btrtl_shutdown_realtek(struct hci_dev * hdev)1400 int btrtl_shutdown_realtek(struct hci_dev *hdev)
1401 {
1402 struct sk_buff *skb;
1403 int ret;
1404
1405 /* According to the vendor driver, BT must be reset on close to avoid
1406 * firmware crash.
1407 */
1408 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_CMD_TIMEOUT);
1409 if (IS_ERR(skb)) {
1410 ret = PTR_ERR(skb);
1411 bt_dev_err(hdev, "HCI reset during shutdown failed");
1412 return ret;
1413 }
1414 kfree_skb(skb);
1415
1416 return 0;
1417 }
1418 EXPORT_SYMBOL_GPL(btrtl_shutdown_realtek);
1419
btrtl_convert_baudrate(u32 device_baudrate)1420 static unsigned int btrtl_convert_baudrate(u32 device_baudrate)
1421 {
1422 switch (device_baudrate) {
1423 case 0x0252a00a:
1424 return 230400;
1425
1426 case 0x05f75004:
1427 return 921600;
1428
1429 case 0x00005004:
1430 return 1000000;
1431
1432 case 0x04928002:
1433 case 0x01128002:
1434 return 1500000;
1435
1436 case 0x00005002:
1437 return 2000000;
1438
1439 case 0x0000b001:
1440 return 2500000;
1441
1442 case 0x04928001:
1443 return 3000000;
1444
1445 case 0x052a6001:
1446 return 3500000;
1447
1448 case 0x00005001:
1449 return 4000000;
1450
1451 case 0x0252c014:
1452 default:
1453 return 115200;
1454 }
1455 }
1456
btrtl_get_uart_settings(struct hci_dev * hdev,struct btrtl_device_info * btrtl_dev,unsigned int * controller_baudrate,u32 * device_baudrate,bool * flow_control)1457 int btrtl_get_uart_settings(struct hci_dev *hdev,
1458 struct btrtl_device_info *btrtl_dev,
1459 unsigned int *controller_baudrate,
1460 u32 *device_baudrate, bool *flow_control)
1461 {
1462 struct rtl_vendor_config *config;
1463 struct rtl_vendor_config_entry *entry;
1464 int i, total_data_len;
1465 bool found = false;
1466
1467 total_data_len = btrtl_dev->cfg_len - sizeof(*config);
1468 if (total_data_len <= 0) {
1469 rtl_dev_warn(hdev, "no config loaded");
1470 return -EINVAL;
1471 }
1472
1473 config = (struct rtl_vendor_config *)btrtl_dev->cfg_data;
1474 if (le32_to_cpu(config->signature) != RTL_CONFIG_MAGIC) {
1475 rtl_dev_err(hdev, "invalid config magic");
1476 return -EINVAL;
1477 }
1478
1479 if (total_data_len < le16_to_cpu(config->total_len)) {
1480 rtl_dev_err(hdev, "config is too short");
1481 return -EINVAL;
1482 }
1483
1484 for (i = 0; i < total_data_len; ) {
1485 entry = ((void *)config->entry) + i;
1486
1487 switch (le16_to_cpu(entry->offset)) {
1488 case 0xc:
1489 if (entry->len < sizeof(*device_baudrate)) {
1490 rtl_dev_err(hdev, "invalid UART config entry");
1491 return -EINVAL;
1492 }
1493
1494 *device_baudrate = get_unaligned_le32(entry->data);
1495 *controller_baudrate = btrtl_convert_baudrate(
1496 *device_baudrate);
1497
1498 if (entry->len >= 13)
1499 *flow_control = !!(entry->data[12] & BIT(2));
1500 else
1501 *flow_control = false;
1502
1503 found = true;
1504 break;
1505
1506 default:
1507 rtl_dev_dbg(hdev, "skipping config entry 0x%x (len %u)",
1508 le16_to_cpu(entry->offset), entry->len);
1509 break;
1510 }
1511
1512 i += sizeof(*entry) + entry->len;
1513 }
1514
1515 if (!found) {
1516 rtl_dev_err(hdev, "no UART config entry found");
1517 return -ENOENT;
1518 }
1519
1520 rtl_dev_dbg(hdev, "device baudrate = 0x%08x", *device_baudrate);
1521 rtl_dev_dbg(hdev, "controller baudrate = %u", *controller_baudrate);
1522 rtl_dev_dbg(hdev, "flow control %d", *flow_control);
1523
1524 return 0;
1525 }
1526 EXPORT_SYMBOL_GPL(btrtl_get_uart_settings);
1527
1528 MODULE_AUTHOR("Daniel Drake <drake@endlessm.com>");
1529 MODULE_DESCRIPTION("Bluetooth support for Realtek devices ver " VERSION);
1530 MODULE_VERSION(VERSION);
1531 MODULE_LICENSE("GPL");
1532 MODULE_FIRMWARE("rtl_bt/rtl8723a_fw.bin");
1533 MODULE_FIRMWARE("rtl_bt/rtl8723b_fw.bin");
1534 MODULE_FIRMWARE("rtl_bt/rtl8723b_config.bin");
1535 MODULE_FIRMWARE("rtl_bt/rtl8723bs_fw.bin");
1536 MODULE_FIRMWARE("rtl_bt/rtl8723bs_config.bin");
1537 MODULE_FIRMWARE("rtl_bt/rtl8723cs_cg_fw.bin");
1538 MODULE_FIRMWARE("rtl_bt/rtl8723cs_cg_config.bin");
1539 MODULE_FIRMWARE("rtl_bt/rtl8723cs_vf_fw.bin");
1540 MODULE_FIRMWARE("rtl_bt/rtl8723cs_vf_config.bin");
1541 MODULE_FIRMWARE("rtl_bt/rtl8723cs_xx_fw.bin");
1542 MODULE_FIRMWARE("rtl_bt/rtl8723cs_xx_config.bin");
1543 MODULE_FIRMWARE("rtl_bt/rtl8723d_fw.bin");
1544 MODULE_FIRMWARE("rtl_bt/rtl8723d_config.bin");
1545 MODULE_FIRMWARE("rtl_bt/rtl8723ds_fw.bin");
1546 MODULE_FIRMWARE("rtl_bt/rtl8723ds_config.bin");
1547 MODULE_FIRMWARE("rtl_bt/rtl8761a_fw.bin");
1548 MODULE_FIRMWARE("rtl_bt/rtl8761a_config.bin");
1549 MODULE_FIRMWARE("rtl_bt/rtl8761b_fw.bin");
1550 MODULE_FIRMWARE("rtl_bt/rtl8761b_config.bin");
1551 MODULE_FIRMWARE("rtl_bt/rtl8761bu_fw.bin");
1552 MODULE_FIRMWARE("rtl_bt/rtl8761bu_config.bin");
1553 MODULE_FIRMWARE("rtl_bt/rtl8761cu_fw.bin");
1554 MODULE_FIRMWARE("rtl_bt/rtl8761cu_config.bin");
1555 MODULE_FIRMWARE("rtl_bt/rtl8821a_fw.bin");
1556 MODULE_FIRMWARE("rtl_bt/rtl8821a_config.bin");
1557 MODULE_FIRMWARE("rtl_bt/rtl8821c_fw.bin");
1558 MODULE_FIRMWARE("rtl_bt/rtl8821c_config.bin");
1559 MODULE_FIRMWARE("rtl_bt/rtl8821cs_fw.bin");
1560 MODULE_FIRMWARE("rtl_bt/rtl8821cs_config.bin");
1561 MODULE_FIRMWARE("rtl_bt/rtl8822b_fw.bin");
1562 MODULE_FIRMWARE("rtl_bt/rtl8822b_config.bin");
1563 MODULE_FIRMWARE("rtl_bt/rtl8822cs_fw.bin");
1564 MODULE_FIRMWARE("rtl_bt/rtl8822cs_config.bin");
1565 MODULE_FIRMWARE("rtl_bt/rtl8822cu_fw.bin");
1566 MODULE_FIRMWARE("rtl_bt/rtl8822cu_config.bin");
1567 MODULE_FIRMWARE("rtl_bt/rtl8851bu_fw.bin");
1568 MODULE_FIRMWARE("rtl_bt/rtl8851bu_config.bin");
1569 MODULE_FIRMWARE("rtl_bt/rtl8852au_fw.bin");
1570 MODULE_FIRMWARE("rtl_bt/rtl8852au_config.bin");
1571 MODULE_FIRMWARE("rtl_bt/rtl8852bs_fw.bin");
1572 MODULE_FIRMWARE("rtl_bt/rtl8852bs_config.bin");
1573 MODULE_FIRMWARE("rtl_bt/rtl8852bu_fw.bin");
1574 MODULE_FIRMWARE("rtl_bt/rtl8852bu_config.bin");
1575 MODULE_FIRMWARE("rtl_bt/rtl8852btu_fw.bin");
1576 MODULE_FIRMWARE("rtl_bt/rtl8852btu_config.bin");
1577 MODULE_FIRMWARE("rtl_bt/rtl8852cu_fw.bin");
1578 MODULE_FIRMWARE("rtl_bt/rtl8852cu_fw_v2.bin");
1579 MODULE_FIRMWARE("rtl_bt/rtl8852cu_config.bin");
1580 MODULE_FIRMWARE("rtl_bt/rtl8922au_fw.bin");
1581 MODULE_FIRMWARE("rtl_bt/rtl8922au_config.bin");
1582