1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Bluetooth support for Realtek devices 4 * 5 * Copyright (C) 2015 Endless Mobile, Inc. 6 */ 7 8 #include <linux/module.h> 9 #include <linux/firmware.h> 10 #include <asm/unaligned.h> 11 #include <linux/usb.h> 12 13 #include <net/bluetooth/bluetooth.h> 14 #include <net/bluetooth/hci_core.h> 15 16 #include "btrtl.h" 17 18 #define VERSION "0.1" 19 20 #define RTL_CHIP_8723CS_CG 3 21 #define RTL_CHIP_8723CS_VF 4 22 #define RTL_CHIP_8723CS_XX 5 23 #define RTL_EPATCH_SIGNATURE "Realtech" 24 #define RTL_EPATCH_SIGNATURE_V2 "RTBTCore" 25 #define RTL_ROM_LMP_8703B 0x8703 26 #define RTL_ROM_LMP_8723A 0x1200 27 #define RTL_ROM_LMP_8723B 0x8723 28 #define RTL_ROM_LMP_8821A 0x8821 29 #define RTL_ROM_LMP_8761A 0x8761 30 #define RTL_ROM_LMP_8822B 0x8822 31 #define RTL_ROM_LMP_8852A 0x8852 32 #define RTL_ROM_LMP_8851B 0x8851 33 #define RTL_CONFIG_MAGIC 0x8723ab55 34 35 #define RTL_VSC_OP_COREDUMP 0xfcff 36 37 #define IC_MATCH_FL_LMPSUBV (1 << 0) 38 #define IC_MATCH_FL_HCIREV (1 << 1) 39 #define IC_MATCH_FL_HCIVER (1 << 2) 40 #define IC_MATCH_FL_HCIBUS (1 << 3) 41 #define IC_MATCH_FL_CHIP_TYPE (1 << 4) 42 #define IC_INFO(lmps, hcir, hciv, bus) \ 43 .match_flags = IC_MATCH_FL_LMPSUBV | IC_MATCH_FL_HCIREV | \ 44 IC_MATCH_FL_HCIVER | IC_MATCH_FL_HCIBUS, \ 45 .lmp_subver = (lmps), \ 46 .hci_rev = (hcir), \ 47 .hci_ver = (hciv), \ 48 .hci_bus = (bus) 49 50 #define RTL_CHIP_SUBVER (&(struct rtl_vendor_cmd) {{0x10, 0x38, 0x04, 0x28, 0x80}}) 51 #define RTL_CHIP_REV (&(struct rtl_vendor_cmd) {{0x10, 0x3A, 0x04, 0x28, 0x80}}) 52 #define RTL_SEC_PROJ (&(struct rtl_vendor_cmd) {{0x10, 0xA4, 0x0D, 0x00, 0xb0}}) 53 54 #define RTL_PATCH_SNIPPETS 0x01 55 #define RTL_PATCH_DUMMY_HEADER 0x02 56 #define RTL_PATCH_SECURITY_HEADER 0x03 57 58 enum btrtl_chip_id { 59 CHIP_ID_8723A, 60 CHIP_ID_8723B, 61 CHIP_ID_8821A, 62 CHIP_ID_8761A, 63 CHIP_ID_8822B = 8, 64 CHIP_ID_8723D, 65 CHIP_ID_8821C, 66 CHIP_ID_8822C = 13, 67 CHIP_ID_8761B, 68 CHIP_ID_8852A = 18, 69 CHIP_ID_8852B = 20, 70 CHIP_ID_8852C = 25, 71 CHIP_ID_8851B = 36, 72 CHIP_ID_8852BT = 47, 73 }; 74 75 struct id_table { 76 __u16 match_flags; 77 __u16 lmp_subver; 78 __u16 hci_rev; 79 __u8 hci_ver; 80 __u8 hci_bus; 81 __u8 chip_type; 82 bool config_needed; 83 bool has_rom_version; 84 bool has_msft_ext; 85 char *fw_name; 86 char *cfg_name; 87 char *hw_info; 88 }; 89 90 struct btrtl_device_info { 91 const struct id_table *ic_info; 92 u8 rom_version; 93 u8 *fw_data; 94 int fw_len; 95 u8 *cfg_data; 96 int cfg_len; 97 bool drop_fw; 98 int project_id; 99 u8 key_id; 100 struct list_head patch_subsecs; 101 }; 102 103 static const struct id_table ic_id_table[] = { 104 /* 8723A */ 105 { IC_INFO(RTL_ROM_LMP_8723A, 0xb, 0x6, HCI_USB), 106 .config_needed = false, 107 .has_rom_version = false, 108 .fw_name = "rtl_bt/rtl8723a_fw", 109 .cfg_name = NULL, 110 .hw_info = "rtl8723au" }, 111 112 /* 8723BS */ 113 { IC_INFO(RTL_ROM_LMP_8723B, 0xb, 0x6, HCI_UART), 114 .config_needed = true, 115 .has_rom_version = true, 116 .fw_name = "rtl_bt/rtl8723bs_fw", 117 .cfg_name = "rtl_bt/rtl8723bs_config", 118 .hw_info = "rtl8723bs" }, 119 120 /* 8723B */ 121 { IC_INFO(RTL_ROM_LMP_8723B, 0xb, 0x6, HCI_USB), 122 .config_needed = false, 123 .has_rom_version = true, 124 .fw_name = "rtl_bt/rtl8723b_fw", 125 .cfg_name = "rtl_bt/rtl8723b_config", 126 .hw_info = "rtl8723bu" }, 127 128 /* 8723CS-CG */ 129 { .match_flags = IC_MATCH_FL_LMPSUBV | IC_MATCH_FL_CHIP_TYPE | 130 IC_MATCH_FL_HCIBUS, 131 .lmp_subver = RTL_ROM_LMP_8703B, 132 .chip_type = RTL_CHIP_8723CS_CG, 133 .hci_bus = HCI_UART, 134 .config_needed = true, 135 .has_rom_version = true, 136 .fw_name = "rtl_bt/rtl8723cs_cg_fw", 137 .cfg_name = "rtl_bt/rtl8723cs_cg_config", 138 .hw_info = "rtl8723cs-cg" }, 139 140 /* 8723CS-VF */ 141 { .match_flags = IC_MATCH_FL_LMPSUBV | IC_MATCH_FL_CHIP_TYPE | 142 IC_MATCH_FL_HCIBUS, 143 .lmp_subver = RTL_ROM_LMP_8703B, 144 .chip_type = RTL_CHIP_8723CS_VF, 145 .hci_bus = HCI_UART, 146 .config_needed = true, 147 .has_rom_version = true, 148 .fw_name = "rtl_bt/rtl8723cs_vf_fw", 149 .cfg_name = "rtl_bt/rtl8723cs_vf_config", 150 .hw_info = "rtl8723cs-vf" }, 151 152 /* 8723CS-XX */ 153 { .match_flags = IC_MATCH_FL_LMPSUBV | IC_MATCH_FL_CHIP_TYPE | 154 IC_MATCH_FL_HCIBUS, 155 .lmp_subver = RTL_ROM_LMP_8703B, 156 .chip_type = RTL_CHIP_8723CS_XX, 157 .hci_bus = HCI_UART, 158 .config_needed = true, 159 .has_rom_version = true, 160 .fw_name = "rtl_bt/rtl8723cs_xx_fw", 161 .cfg_name = "rtl_bt/rtl8723cs_xx_config", 162 .hw_info = "rtl8723cs" }, 163 164 /* 8723D */ 165 { IC_INFO(RTL_ROM_LMP_8723B, 0xd, 0x8, HCI_USB), 166 .config_needed = true, 167 .has_rom_version = true, 168 .fw_name = "rtl_bt/rtl8723d_fw", 169 .cfg_name = "rtl_bt/rtl8723d_config", 170 .hw_info = "rtl8723du" }, 171 172 /* 8723DS */ 173 { IC_INFO(RTL_ROM_LMP_8723B, 0xd, 0x8, HCI_UART), 174 .config_needed = true, 175 .has_rom_version = true, 176 .fw_name = "rtl_bt/rtl8723ds_fw", 177 .cfg_name = "rtl_bt/rtl8723ds_config", 178 .hw_info = "rtl8723ds" }, 179 180 /* 8821A */ 181 { IC_INFO(RTL_ROM_LMP_8821A, 0xa, 0x6, HCI_USB), 182 .config_needed = false, 183 .has_rom_version = true, 184 .fw_name = "rtl_bt/rtl8821a_fw", 185 .cfg_name = "rtl_bt/rtl8821a_config", 186 .hw_info = "rtl8821au" }, 187 188 /* 8821C */ 189 { IC_INFO(RTL_ROM_LMP_8821A, 0xc, 0x8, HCI_USB), 190 .config_needed = false, 191 .has_rom_version = true, 192 .has_msft_ext = true, 193 .fw_name = "rtl_bt/rtl8821c_fw", 194 .cfg_name = "rtl_bt/rtl8821c_config", 195 .hw_info = "rtl8821cu" }, 196 197 /* 8821CS */ 198 { IC_INFO(RTL_ROM_LMP_8821A, 0xc, 0x8, HCI_UART), 199 .config_needed = true, 200 .has_rom_version = true, 201 .has_msft_ext = true, 202 .fw_name = "rtl_bt/rtl8821cs_fw", 203 .cfg_name = "rtl_bt/rtl8821cs_config", 204 .hw_info = "rtl8821cs" }, 205 206 /* 8761A */ 207 { IC_INFO(RTL_ROM_LMP_8761A, 0xa, 0x6, HCI_USB), 208 .config_needed = false, 209 .has_rom_version = true, 210 .fw_name = "rtl_bt/rtl8761a_fw", 211 .cfg_name = "rtl_bt/rtl8761a_config", 212 .hw_info = "rtl8761au" }, 213 214 /* 8761B */ 215 { IC_INFO(RTL_ROM_LMP_8761A, 0xb, 0xa, HCI_UART), 216 .config_needed = false, 217 .has_rom_version = true, 218 .has_msft_ext = true, 219 .fw_name = "rtl_bt/rtl8761b_fw", 220 .cfg_name = "rtl_bt/rtl8761b_config", 221 .hw_info = "rtl8761btv" }, 222 223 /* 8761BU */ 224 { IC_INFO(RTL_ROM_LMP_8761A, 0xb, 0xa, HCI_USB), 225 .config_needed = false, 226 .has_rom_version = true, 227 .fw_name = "rtl_bt/rtl8761bu_fw", 228 .cfg_name = "rtl_bt/rtl8761bu_config", 229 .hw_info = "rtl8761bu" }, 230 231 /* 8822C with UART interface */ 232 { IC_INFO(RTL_ROM_LMP_8822B, 0xc, 0x8, HCI_UART), 233 .config_needed = true, 234 .has_rom_version = true, 235 .has_msft_ext = true, 236 .fw_name = "rtl_bt/rtl8822cs_fw", 237 .cfg_name = "rtl_bt/rtl8822cs_config", 238 .hw_info = "rtl8822cs" }, 239 240 /* 8822C with UART interface */ 241 { IC_INFO(RTL_ROM_LMP_8822B, 0xc, 0xa, HCI_UART), 242 .config_needed = true, 243 .has_rom_version = true, 244 .has_msft_ext = true, 245 .fw_name = "rtl_bt/rtl8822cs_fw", 246 .cfg_name = "rtl_bt/rtl8822cs_config", 247 .hw_info = "rtl8822cs" }, 248 249 /* 8822C with USB interface */ 250 { IC_INFO(RTL_ROM_LMP_8822B, 0xc, 0xa, HCI_USB), 251 .config_needed = false, 252 .has_rom_version = true, 253 .has_msft_ext = true, 254 .fw_name = "rtl_bt/rtl8822cu_fw", 255 .cfg_name = "rtl_bt/rtl8822cu_config", 256 .hw_info = "rtl8822cu" }, 257 258 /* 8822B */ 259 { IC_INFO(RTL_ROM_LMP_8822B, 0xb, 0x7, HCI_USB), 260 .config_needed = true, 261 .has_rom_version = true, 262 .has_msft_ext = true, 263 .fw_name = "rtl_bt/rtl8822b_fw", 264 .cfg_name = "rtl_bt/rtl8822b_config", 265 .hw_info = "rtl8822bu" }, 266 267 /* 8852A */ 268 { IC_INFO(RTL_ROM_LMP_8852A, 0xa, 0xb, HCI_USB), 269 .config_needed = false, 270 .has_rom_version = true, 271 .has_msft_ext = true, 272 .fw_name = "rtl_bt/rtl8852au_fw", 273 .cfg_name = "rtl_bt/rtl8852au_config", 274 .hw_info = "rtl8852au" }, 275 276 /* 8852B with UART interface */ 277 { IC_INFO(RTL_ROM_LMP_8852A, 0xb, 0xb, HCI_UART), 278 .config_needed = true, 279 .has_rom_version = true, 280 .has_msft_ext = true, 281 .fw_name = "rtl_bt/rtl8852bs_fw", 282 .cfg_name = "rtl_bt/rtl8852bs_config", 283 .hw_info = "rtl8852bs" }, 284 285 /* 8852B */ 286 { IC_INFO(RTL_ROM_LMP_8852A, 0xb, 0xb, HCI_USB), 287 .config_needed = false, 288 .has_rom_version = true, 289 .has_msft_ext = true, 290 .fw_name = "rtl_bt/rtl8852bu_fw", 291 .cfg_name = "rtl_bt/rtl8852bu_config", 292 .hw_info = "rtl8852bu" }, 293 294 /* 8852C */ 295 { IC_INFO(RTL_ROM_LMP_8852A, 0xc, 0xc, HCI_USB), 296 .config_needed = false, 297 .has_rom_version = true, 298 .has_msft_ext = true, 299 .fw_name = "rtl_bt/rtl8852cu_fw", 300 .cfg_name = "rtl_bt/rtl8852cu_config", 301 .hw_info = "rtl8852cu" }, 302 303 /* 8851B */ 304 { IC_INFO(RTL_ROM_LMP_8851B, 0xb, 0xc, HCI_USB), 305 .config_needed = false, 306 .has_rom_version = true, 307 .has_msft_ext = false, 308 .fw_name = "rtl_bt/rtl8851bu_fw", 309 .cfg_name = "rtl_bt/rtl8851bu_config", 310 .hw_info = "rtl8851bu" }, 311 312 /* 8852BT/8852BE-VT */ 313 { IC_INFO(RTL_ROM_LMP_8852A, 0x87, 0xc, HCI_USB), 314 .config_needed = false, 315 .has_rom_version = true, 316 .has_msft_ext = true, 317 .fw_name = "rtl_bt/rtl8852btu_fw", 318 .cfg_name = "rtl_bt/rtl8852btu_config", 319 .hw_info = "rtl8852btu" }, 320 }; 321 322 static const struct id_table *btrtl_match_ic(u16 lmp_subver, u16 hci_rev, 323 u8 hci_ver, u8 hci_bus, 324 u8 chip_type) 325 { 326 int i; 327 328 for (i = 0; i < ARRAY_SIZE(ic_id_table); i++) { 329 if ((ic_id_table[i].match_flags & IC_MATCH_FL_LMPSUBV) && 330 (ic_id_table[i].lmp_subver != lmp_subver)) 331 continue; 332 if ((ic_id_table[i].match_flags & IC_MATCH_FL_HCIREV) && 333 (ic_id_table[i].hci_rev != hci_rev)) 334 continue; 335 if ((ic_id_table[i].match_flags & IC_MATCH_FL_HCIVER) && 336 (ic_id_table[i].hci_ver != hci_ver)) 337 continue; 338 if ((ic_id_table[i].match_flags & IC_MATCH_FL_HCIBUS) && 339 (ic_id_table[i].hci_bus != hci_bus)) 340 continue; 341 if ((ic_id_table[i].match_flags & IC_MATCH_FL_CHIP_TYPE) && 342 (ic_id_table[i].chip_type != chip_type)) 343 continue; 344 345 break; 346 } 347 if (i >= ARRAY_SIZE(ic_id_table)) 348 return NULL; 349 350 return &ic_id_table[i]; 351 } 352 353 static struct sk_buff *btrtl_read_local_version(struct hci_dev *hdev) 354 { 355 struct sk_buff *skb; 356 357 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL, 358 HCI_INIT_TIMEOUT); 359 if (IS_ERR(skb)) { 360 rtl_dev_err(hdev, "HCI_OP_READ_LOCAL_VERSION failed (%ld)", 361 PTR_ERR(skb)); 362 return skb; 363 } 364 365 if (skb->len != sizeof(struct hci_rp_read_local_version)) { 366 rtl_dev_err(hdev, "HCI_OP_READ_LOCAL_VERSION event length mismatch"); 367 kfree_skb(skb); 368 return ERR_PTR(-EIO); 369 } 370 371 return skb; 372 } 373 374 static int rtl_read_rom_version(struct hci_dev *hdev, u8 *version) 375 { 376 struct rtl_rom_version_evt *rom_version; 377 struct sk_buff *skb; 378 379 /* Read RTL ROM version command */ 380 skb = __hci_cmd_sync(hdev, 0xfc6d, 0, NULL, HCI_INIT_TIMEOUT); 381 if (IS_ERR(skb)) { 382 rtl_dev_err(hdev, "Read ROM version failed (%ld)", 383 PTR_ERR(skb)); 384 return PTR_ERR(skb); 385 } 386 387 if (skb->len != sizeof(*rom_version)) { 388 rtl_dev_err(hdev, "version event length mismatch"); 389 kfree_skb(skb); 390 return -EIO; 391 } 392 393 rom_version = (struct rtl_rom_version_evt *)skb->data; 394 rtl_dev_info(hdev, "rom_version status=%x version=%x", 395 rom_version->status, rom_version->version); 396 397 *version = rom_version->version; 398 399 kfree_skb(skb); 400 return 0; 401 } 402 403 static int btrtl_vendor_read_reg16(struct hci_dev *hdev, 404 struct rtl_vendor_cmd *cmd, u8 *rp) 405 { 406 struct sk_buff *skb; 407 int err = 0; 408 409 skb = __hci_cmd_sync(hdev, 0xfc61, sizeof(*cmd), cmd, 410 HCI_INIT_TIMEOUT); 411 if (IS_ERR(skb)) { 412 err = PTR_ERR(skb); 413 rtl_dev_err(hdev, "RTL: Read reg16 failed (%d)", err); 414 return err; 415 } 416 417 if (skb->len != 3 || skb->data[0]) { 418 bt_dev_err(hdev, "RTL: Read reg16 length mismatch"); 419 kfree_skb(skb); 420 return -EIO; 421 } 422 423 if (rp) 424 memcpy(rp, skb->data + 1, 2); 425 426 kfree_skb(skb); 427 428 return 0; 429 } 430 431 static void *rtl_iov_pull_data(struct rtl_iovec *iov, u32 len) 432 { 433 void *data = iov->data; 434 435 if (iov->len < len) 436 return NULL; 437 438 iov->data += len; 439 iov->len -= len; 440 441 return data; 442 } 443 444 static void btrtl_insert_ordered_subsec(struct rtl_subsection *node, 445 struct btrtl_device_info *btrtl_dev) 446 { 447 struct list_head *pos; 448 struct list_head *next; 449 struct rtl_subsection *subsec; 450 451 list_for_each_safe(pos, next, &btrtl_dev->patch_subsecs) { 452 subsec = list_entry(pos, struct rtl_subsection, list); 453 if (subsec->prio >= node->prio) 454 break; 455 } 456 __list_add(&node->list, pos->prev, pos); 457 } 458 459 static int btrtl_parse_section(struct hci_dev *hdev, 460 struct btrtl_device_info *btrtl_dev, u32 opcode, 461 u8 *data, u32 len) 462 { 463 struct rtl_section_hdr *hdr; 464 struct rtl_subsection *subsec; 465 struct rtl_common_subsec *common_subsec; 466 struct rtl_sec_hdr *sec_hdr; 467 int i; 468 u8 *ptr; 469 u16 num_subsecs; 470 u32 subsec_len; 471 int rc = 0; 472 struct rtl_iovec iov = { 473 .data = data, 474 .len = len, 475 }; 476 477 hdr = rtl_iov_pull_data(&iov, sizeof(*hdr)); 478 if (!hdr) 479 return -EINVAL; 480 num_subsecs = le16_to_cpu(hdr->num); 481 482 for (i = 0; i < num_subsecs; i++) { 483 common_subsec = rtl_iov_pull_data(&iov, sizeof(*common_subsec)); 484 if (!common_subsec) 485 break; 486 subsec_len = le32_to_cpu(common_subsec->len); 487 488 rtl_dev_dbg(hdev, "subsec, eco 0x%02x, len %08x", 489 common_subsec->eco, subsec_len); 490 491 ptr = rtl_iov_pull_data(&iov, subsec_len); 492 if (!ptr) 493 break; 494 495 if (common_subsec->eco != btrtl_dev->rom_version + 1) 496 continue; 497 498 switch (opcode) { 499 case RTL_PATCH_SECURITY_HEADER: 500 sec_hdr = (void *)common_subsec; 501 if (sec_hdr->key_id != btrtl_dev->key_id) 502 continue; 503 break; 504 } 505 506 subsec = kzalloc(sizeof(*subsec), GFP_KERNEL); 507 if (!subsec) 508 return -ENOMEM; 509 subsec->opcode = opcode; 510 subsec->prio = common_subsec->prio; 511 subsec->len = subsec_len; 512 subsec->data = ptr; 513 btrtl_insert_ordered_subsec(subsec, btrtl_dev); 514 rc += subsec_len; 515 } 516 517 return rc; 518 } 519 520 static int rtlbt_parse_firmware_v2(struct hci_dev *hdev, 521 struct btrtl_device_info *btrtl_dev, 522 unsigned char **_buf) 523 { 524 struct rtl_epatch_header_v2 *hdr; 525 int rc; 526 u8 reg_val[2]; 527 u8 key_id; 528 u32 num_sections; 529 struct rtl_section *section; 530 struct rtl_subsection *entry, *tmp; 531 u32 section_len; 532 u32 opcode; 533 int len = 0; 534 int i; 535 u8 *ptr; 536 struct rtl_iovec iov = { 537 .data = btrtl_dev->fw_data, 538 .len = btrtl_dev->fw_len - 7, /* Cut the tail */ 539 }; 540 541 rc = btrtl_vendor_read_reg16(hdev, RTL_SEC_PROJ, reg_val); 542 if (rc < 0) 543 return -EIO; 544 key_id = reg_val[0]; 545 546 rtl_dev_dbg(hdev, "%s: key id %u", __func__, key_id); 547 548 btrtl_dev->key_id = key_id; 549 550 hdr = rtl_iov_pull_data(&iov, sizeof(*hdr)); 551 if (!hdr) 552 return -EINVAL; 553 num_sections = le32_to_cpu(hdr->num_sections); 554 555 rtl_dev_dbg(hdev, "FW version %08x-%08x", *((u32 *)hdr->fw_version), 556 *((u32 *)(hdr->fw_version + 4))); 557 558 for (i = 0; i < num_sections; i++) { 559 section = rtl_iov_pull_data(&iov, sizeof(*section)); 560 if (!section) 561 break; 562 section_len = le32_to_cpu(section->len); 563 opcode = le32_to_cpu(section->opcode); 564 565 rtl_dev_dbg(hdev, "opcode 0x%04x", section->opcode); 566 567 ptr = rtl_iov_pull_data(&iov, section_len); 568 if (!ptr) 569 break; 570 571 switch (opcode) { 572 case RTL_PATCH_SNIPPETS: 573 rc = btrtl_parse_section(hdev, btrtl_dev, opcode, 574 ptr, section_len); 575 break; 576 case RTL_PATCH_SECURITY_HEADER: 577 /* If key_id from chip is zero, ignore all security 578 * headers. 579 */ 580 if (!key_id) 581 break; 582 rc = btrtl_parse_section(hdev, btrtl_dev, opcode, 583 ptr, section_len); 584 break; 585 case RTL_PATCH_DUMMY_HEADER: 586 rc = btrtl_parse_section(hdev, btrtl_dev, opcode, 587 ptr, section_len); 588 break; 589 default: 590 rc = 0; 591 break; 592 } 593 if (rc < 0) { 594 rtl_dev_err(hdev, "RTL: Parse section (%u) err %d", 595 opcode, rc); 596 return rc; 597 } 598 len += rc; 599 } 600 601 if (!len) 602 return -ENODATA; 603 604 /* Allocate mem and copy all found subsecs. */ 605 ptr = kvmalloc(len, GFP_KERNEL); 606 if (!ptr) 607 return -ENOMEM; 608 609 len = 0; 610 list_for_each_entry_safe(entry, tmp, &btrtl_dev->patch_subsecs, list) { 611 rtl_dev_dbg(hdev, "RTL: opcode %08x, addr %p, len 0x%x", 612 entry->opcode, entry->data, entry->len); 613 memcpy(ptr + len, entry->data, entry->len); 614 len += entry->len; 615 } 616 617 if (!len) 618 return -EPERM; 619 620 *_buf = ptr; 621 return len; 622 } 623 624 static int rtlbt_parse_firmware(struct hci_dev *hdev, 625 struct btrtl_device_info *btrtl_dev, 626 unsigned char **_buf) 627 { 628 static const u8 extension_sig[] = { 0x51, 0x04, 0xfd, 0x77 }; 629 struct btrealtek_data *coredump_info = hci_get_priv(hdev); 630 struct rtl_epatch_header *epatch_info; 631 unsigned char *buf; 632 int i, len; 633 size_t min_size; 634 u8 opcode, length, data; 635 int project_id = -1; 636 const unsigned char *fwptr, *chip_id_base; 637 const unsigned char *patch_length_base, *patch_offset_base; 638 u32 patch_offset = 0; 639 u16 patch_length, num_patches; 640 static const struct { 641 __u16 lmp_subver; 642 __u8 id; 643 } project_id_to_lmp_subver[] = { 644 { RTL_ROM_LMP_8723A, 0 }, 645 { RTL_ROM_LMP_8723B, 1 }, 646 { RTL_ROM_LMP_8821A, 2 }, 647 { RTL_ROM_LMP_8761A, 3 }, 648 { RTL_ROM_LMP_8703B, 7 }, 649 { RTL_ROM_LMP_8822B, 8 }, 650 { RTL_ROM_LMP_8723B, 9 }, /* 8723D */ 651 { RTL_ROM_LMP_8821A, 10 }, /* 8821C */ 652 { RTL_ROM_LMP_8822B, 13 }, /* 8822C */ 653 { RTL_ROM_LMP_8761A, 14 }, /* 8761B */ 654 { RTL_ROM_LMP_8852A, 18 }, /* 8852A */ 655 { RTL_ROM_LMP_8852A, 20 }, /* 8852B */ 656 { RTL_ROM_LMP_8852A, 25 }, /* 8852C */ 657 { RTL_ROM_LMP_8851B, 36 }, /* 8851B */ 658 { RTL_ROM_LMP_8852A, 47 }, /* 8852BT */ 659 }; 660 661 if (btrtl_dev->fw_len <= 8) 662 return -EINVAL; 663 664 if (!memcmp(btrtl_dev->fw_data, RTL_EPATCH_SIGNATURE, 8)) 665 min_size = sizeof(struct rtl_epatch_header) + 666 sizeof(extension_sig) + 3; 667 else if (!memcmp(btrtl_dev->fw_data, RTL_EPATCH_SIGNATURE_V2, 8)) 668 min_size = sizeof(struct rtl_epatch_header_v2) + 669 sizeof(extension_sig) + 3; 670 else 671 return -EINVAL; 672 673 if (btrtl_dev->fw_len < min_size) 674 return -EINVAL; 675 676 fwptr = btrtl_dev->fw_data + btrtl_dev->fw_len - sizeof(extension_sig); 677 if (memcmp(fwptr, extension_sig, sizeof(extension_sig)) != 0) { 678 rtl_dev_err(hdev, "extension section signature mismatch"); 679 return -EINVAL; 680 } 681 682 /* Loop from the end of the firmware parsing instructions, until 683 * we find an instruction that identifies the "project ID" for the 684 * hardware supported by this firwmare file. 685 * Once we have that, we double-check that project_id is suitable 686 * for the hardware we are working with. 687 */ 688 while (fwptr >= btrtl_dev->fw_data + (sizeof(*epatch_info) + 3)) { 689 opcode = *--fwptr; 690 length = *--fwptr; 691 data = *--fwptr; 692 693 BT_DBG("check op=%x len=%x data=%x", opcode, length, data); 694 695 if (opcode == 0xff) /* EOF */ 696 break; 697 698 if (length == 0) { 699 rtl_dev_err(hdev, "found instruction with length 0"); 700 return -EINVAL; 701 } 702 703 if (opcode == 0 && length == 1) { 704 project_id = data; 705 break; 706 } 707 708 fwptr -= length; 709 } 710 711 if (project_id < 0) { 712 rtl_dev_err(hdev, "failed to find version instruction"); 713 return -EINVAL; 714 } 715 716 /* Find project_id in table */ 717 for (i = 0; i < ARRAY_SIZE(project_id_to_lmp_subver); i++) { 718 if (project_id == project_id_to_lmp_subver[i].id) { 719 btrtl_dev->project_id = project_id; 720 break; 721 } 722 } 723 724 if (i >= ARRAY_SIZE(project_id_to_lmp_subver)) { 725 rtl_dev_err(hdev, "unknown project id %d", project_id); 726 return -EINVAL; 727 } 728 729 if (btrtl_dev->ic_info->lmp_subver != 730 project_id_to_lmp_subver[i].lmp_subver) { 731 rtl_dev_err(hdev, "firmware is for %x but this is a %x", 732 project_id_to_lmp_subver[i].lmp_subver, 733 btrtl_dev->ic_info->lmp_subver); 734 return -EINVAL; 735 } 736 737 if (memcmp(btrtl_dev->fw_data, RTL_EPATCH_SIGNATURE, 8) != 0) { 738 if (!memcmp(btrtl_dev->fw_data, RTL_EPATCH_SIGNATURE_V2, 8)) 739 return rtlbt_parse_firmware_v2(hdev, btrtl_dev, _buf); 740 rtl_dev_err(hdev, "bad EPATCH signature"); 741 return -EINVAL; 742 } 743 744 epatch_info = (struct rtl_epatch_header *)btrtl_dev->fw_data; 745 num_patches = le16_to_cpu(epatch_info->num_patches); 746 747 BT_DBG("fw_version=%x, num_patches=%d", 748 le32_to_cpu(epatch_info->fw_version), num_patches); 749 coredump_info->rtl_dump.fw_version = le32_to_cpu(epatch_info->fw_version); 750 751 /* After the rtl_epatch_header there is a funky patch metadata section. 752 * Assuming 2 patches, the layout is: 753 * ChipID1 ChipID2 PatchLength1 PatchLength2 PatchOffset1 PatchOffset2 754 * 755 * Find the right patch for this chip. 756 */ 757 min_size += 8 * num_patches; 758 if (btrtl_dev->fw_len < min_size) 759 return -EINVAL; 760 761 chip_id_base = btrtl_dev->fw_data + sizeof(struct rtl_epatch_header); 762 patch_length_base = chip_id_base + (sizeof(u16) * num_patches); 763 patch_offset_base = patch_length_base + (sizeof(u16) * num_patches); 764 for (i = 0; i < num_patches; i++) { 765 u16 chip_id = get_unaligned_le16(chip_id_base + 766 (i * sizeof(u16))); 767 if (chip_id == btrtl_dev->rom_version + 1) { 768 patch_length = get_unaligned_le16(patch_length_base + 769 (i * sizeof(u16))); 770 patch_offset = get_unaligned_le32(patch_offset_base + 771 (i * sizeof(u32))); 772 break; 773 } 774 } 775 776 if (!patch_offset) { 777 rtl_dev_err(hdev, "didn't find patch for chip id %d", 778 btrtl_dev->rom_version); 779 return -EINVAL; 780 } 781 782 BT_DBG("length=%x offset=%x index %d", patch_length, patch_offset, i); 783 min_size = patch_offset + patch_length; 784 if (btrtl_dev->fw_len < min_size) 785 return -EINVAL; 786 787 /* Copy the firmware into a new buffer and write the version at 788 * the end. 789 */ 790 len = patch_length; 791 buf = kvmalloc(patch_length, GFP_KERNEL); 792 if (!buf) 793 return -ENOMEM; 794 795 memcpy(buf, btrtl_dev->fw_data + patch_offset, patch_length - 4); 796 memcpy(buf + patch_length - 4, &epatch_info->fw_version, 4); 797 798 *_buf = buf; 799 return len; 800 } 801 802 static int rtl_download_firmware(struct hci_dev *hdev, 803 const unsigned char *data, int fw_len) 804 { 805 struct rtl_download_cmd *dl_cmd; 806 int frag_num = fw_len / RTL_FRAG_LEN + 1; 807 int frag_len = RTL_FRAG_LEN; 808 int ret = 0; 809 int i; 810 int j = 0; 811 struct sk_buff *skb; 812 struct hci_rp_read_local_version *rp; 813 814 dl_cmd = kmalloc(sizeof(struct rtl_download_cmd), GFP_KERNEL); 815 if (!dl_cmd) 816 return -ENOMEM; 817 818 for (i = 0; i < frag_num; i++) { 819 struct sk_buff *skb; 820 821 dl_cmd->index = j++; 822 if (dl_cmd->index == 0x7f) 823 j = 1; 824 825 if (i == (frag_num - 1)) { 826 dl_cmd->index |= 0x80; /* data end */ 827 frag_len = fw_len % RTL_FRAG_LEN; 828 } 829 rtl_dev_dbg(hdev, "download fw (%d/%d). index = %d", i, 830 frag_num, dl_cmd->index); 831 memcpy(dl_cmd->data, data, frag_len); 832 833 /* Send download command */ 834 skb = __hci_cmd_sync(hdev, 0xfc20, frag_len + 1, dl_cmd, 835 HCI_INIT_TIMEOUT); 836 if (IS_ERR(skb)) { 837 rtl_dev_err(hdev, "download fw command failed (%ld)", 838 PTR_ERR(skb)); 839 ret = PTR_ERR(skb); 840 goto out; 841 } 842 843 if (skb->len != sizeof(struct rtl_download_response)) { 844 rtl_dev_err(hdev, "download fw event length mismatch"); 845 kfree_skb(skb); 846 ret = -EIO; 847 goto out; 848 } 849 850 kfree_skb(skb); 851 data += RTL_FRAG_LEN; 852 } 853 854 skb = btrtl_read_local_version(hdev); 855 if (IS_ERR(skb)) { 856 ret = PTR_ERR(skb); 857 rtl_dev_err(hdev, "read local version failed"); 858 goto out; 859 } 860 861 rp = (struct hci_rp_read_local_version *)skb->data; 862 rtl_dev_info(hdev, "fw version 0x%04x%04x", 863 __le16_to_cpu(rp->hci_rev), __le16_to_cpu(rp->lmp_subver)); 864 kfree_skb(skb); 865 866 out: 867 kfree(dl_cmd); 868 return ret; 869 } 870 871 static int rtl_load_file(struct hci_dev *hdev, const char *name, u8 **buff) 872 { 873 const struct firmware *fw; 874 int ret; 875 876 rtl_dev_info(hdev, "loading %s", name); 877 ret = request_firmware(&fw, name, &hdev->dev); 878 if (ret < 0) 879 return ret; 880 ret = fw->size; 881 *buff = kvmalloc(fw->size, GFP_KERNEL); 882 if (*buff) 883 memcpy(*buff, fw->data, ret); 884 else 885 ret = -ENOMEM; 886 887 release_firmware(fw); 888 889 return ret; 890 } 891 892 static int btrtl_setup_rtl8723a(struct hci_dev *hdev, 893 struct btrtl_device_info *btrtl_dev) 894 { 895 if (btrtl_dev->fw_len < 8) 896 return -EINVAL; 897 898 /* Check that the firmware doesn't have the epatch signature 899 * (which is only for RTL8723B and newer). 900 */ 901 if (!memcmp(btrtl_dev->fw_data, RTL_EPATCH_SIGNATURE, 8)) { 902 rtl_dev_err(hdev, "unexpected EPATCH signature!"); 903 return -EINVAL; 904 } 905 906 return rtl_download_firmware(hdev, btrtl_dev->fw_data, 907 btrtl_dev->fw_len); 908 } 909 910 static int btrtl_setup_rtl8723b(struct hci_dev *hdev, 911 struct btrtl_device_info *btrtl_dev) 912 { 913 unsigned char *fw_data = NULL; 914 int ret; 915 u8 *tbuff; 916 917 ret = rtlbt_parse_firmware(hdev, btrtl_dev, &fw_data); 918 if (ret < 0) 919 goto out; 920 921 if (btrtl_dev->cfg_len > 0) { 922 tbuff = kvzalloc(ret + btrtl_dev->cfg_len, GFP_KERNEL); 923 if (!tbuff) { 924 ret = -ENOMEM; 925 goto out; 926 } 927 928 memcpy(tbuff, fw_data, ret); 929 kvfree(fw_data); 930 931 memcpy(tbuff + ret, btrtl_dev->cfg_data, btrtl_dev->cfg_len); 932 ret += btrtl_dev->cfg_len; 933 934 fw_data = tbuff; 935 } 936 937 rtl_dev_info(hdev, "cfg_sz %d, total sz %d", btrtl_dev->cfg_len, ret); 938 939 ret = rtl_download_firmware(hdev, fw_data, ret); 940 941 out: 942 kvfree(fw_data); 943 return ret; 944 } 945 946 static void btrtl_coredump(struct hci_dev *hdev) 947 { 948 static const u8 param[] = { 0x00, 0x00 }; 949 950 __hci_cmd_send(hdev, RTL_VSC_OP_COREDUMP, sizeof(param), param); 951 } 952 953 static void btrtl_dmp_hdr(struct hci_dev *hdev, struct sk_buff *skb) 954 { 955 struct btrealtek_data *coredump_info = hci_get_priv(hdev); 956 char buf[80]; 957 958 if (coredump_info->rtl_dump.controller) 959 snprintf(buf, sizeof(buf), "Controller Name: %s\n", 960 coredump_info->rtl_dump.controller); 961 else 962 snprintf(buf, sizeof(buf), "Controller Name: Unknown\n"); 963 skb_put_data(skb, buf, strlen(buf)); 964 965 snprintf(buf, sizeof(buf), "Firmware Version: 0x%X\n", 966 coredump_info->rtl_dump.fw_version); 967 skb_put_data(skb, buf, strlen(buf)); 968 969 snprintf(buf, sizeof(buf), "Driver: %s\n", coredump_info->rtl_dump.driver_name); 970 skb_put_data(skb, buf, strlen(buf)); 971 972 snprintf(buf, sizeof(buf), "Vendor: Realtek\n"); 973 skb_put_data(skb, buf, strlen(buf)); 974 } 975 976 static void btrtl_register_devcoredump_support(struct hci_dev *hdev) 977 { 978 hci_devcd_register(hdev, btrtl_coredump, btrtl_dmp_hdr, NULL); 979 980 } 981 982 void btrtl_set_driver_name(struct hci_dev *hdev, const char *driver_name) 983 { 984 struct btrealtek_data *coredump_info = hci_get_priv(hdev); 985 986 coredump_info->rtl_dump.driver_name = driver_name; 987 } 988 EXPORT_SYMBOL_GPL(btrtl_set_driver_name); 989 990 static bool rtl_has_chip_type(u16 lmp_subver) 991 { 992 switch (lmp_subver) { 993 case RTL_ROM_LMP_8703B: 994 return true; 995 default: 996 break; 997 } 998 999 return false; 1000 } 1001 1002 static int rtl_read_chip_type(struct hci_dev *hdev, u8 *type) 1003 { 1004 struct rtl_chip_type_evt *chip_type; 1005 struct sk_buff *skb; 1006 const unsigned char cmd_buf[] = {0x00, 0x94, 0xa0, 0x00, 0xb0}; 1007 1008 /* Read RTL chip type command */ 1009 skb = __hci_cmd_sync(hdev, 0xfc61, 5, cmd_buf, HCI_INIT_TIMEOUT); 1010 if (IS_ERR(skb)) { 1011 rtl_dev_err(hdev, "Read chip type failed (%ld)", 1012 PTR_ERR(skb)); 1013 return PTR_ERR(skb); 1014 } 1015 1016 chip_type = skb_pull_data(skb, sizeof(*chip_type)); 1017 if (!chip_type) { 1018 rtl_dev_err(hdev, "RTL chip type event length mismatch"); 1019 kfree_skb(skb); 1020 return -EIO; 1021 } 1022 1023 rtl_dev_info(hdev, "chip_type status=%x type=%x", 1024 chip_type->status, chip_type->type); 1025 1026 *type = chip_type->type & 0x0f; 1027 1028 kfree_skb(skb); 1029 return 0; 1030 } 1031 1032 void btrtl_free(struct btrtl_device_info *btrtl_dev) 1033 { 1034 struct rtl_subsection *entry, *tmp; 1035 1036 kvfree(btrtl_dev->fw_data); 1037 kvfree(btrtl_dev->cfg_data); 1038 1039 list_for_each_entry_safe(entry, tmp, &btrtl_dev->patch_subsecs, list) { 1040 list_del(&entry->list); 1041 kfree(entry); 1042 } 1043 1044 kfree(btrtl_dev); 1045 } 1046 EXPORT_SYMBOL_GPL(btrtl_free); 1047 1048 struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev, 1049 const char *postfix) 1050 { 1051 struct btrealtek_data *coredump_info = hci_get_priv(hdev); 1052 struct btrtl_device_info *btrtl_dev; 1053 struct sk_buff *skb; 1054 struct hci_rp_read_local_version *resp; 1055 struct hci_command_hdr *cmd; 1056 char fw_name[40]; 1057 char cfg_name[40]; 1058 u16 hci_rev, lmp_subver; 1059 u8 hci_ver, lmp_ver, chip_type = 0; 1060 int ret; 1061 u8 reg_val[2]; 1062 1063 btrtl_dev = kzalloc(sizeof(*btrtl_dev), GFP_KERNEL); 1064 if (!btrtl_dev) { 1065 ret = -ENOMEM; 1066 goto err_alloc; 1067 } 1068 1069 INIT_LIST_HEAD(&btrtl_dev->patch_subsecs); 1070 1071 check_version: 1072 ret = btrtl_vendor_read_reg16(hdev, RTL_CHIP_SUBVER, reg_val); 1073 if (ret < 0) 1074 goto err_free; 1075 lmp_subver = get_unaligned_le16(reg_val); 1076 1077 if (lmp_subver == RTL_ROM_LMP_8822B) { 1078 ret = btrtl_vendor_read_reg16(hdev, RTL_CHIP_REV, reg_val); 1079 if (ret < 0) 1080 goto err_free; 1081 hci_rev = get_unaligned_le16(reg_val); 1082 1083 /* 8822E */ 1084 if (hci_rev == 0x000e) { 1085 hci_ver = 0x0c; 1086 lmp_ver = 0x0c; 1087 btrtl_dev->ic_info = btrtl_match_ic(lmp_subver, hci_rev, 1088 hci_ver, hdev->bus, 1089 chip_type); 1090 goto next; 1091 } 1092 } 1093 1094 skb = btrtl_read_local_version(hdev); 1095 if (IS_ERR(skb)) { 1096 ret = PTR_ERR(skb); 1097 goto err_free; 1098 } 1099 1100 resp = (struct hci_rp_read_local_version *)skb->data; 1101 1102 hci_ver = resp->hci_ver; 1103 hci_rev = le16_to_cpu(resp->hci_rev); 1104 lmp_ver = resp->lmp_ver; 1105 lmp_subver = le16_to_cpu(resp->lmp_subver); 1106 1107 kfree_skb(skb); 1108 1109 if (rtl_has_chip_type(lmp_subver)) { 1110 ret = rtl_read_chip_type(hdev, &chip_type); 1111 if (ret) 1112 goto err_free; 1113 } 1114 1115 btrtl_dev->ic_info = btrtl_match_ic(lmp_subver, hci_rev, hci_ver, 1116 hdev->bus, chip_type); 1117 1118 next: 1119 rtl_dev_info(hdev, "examining hci_ver=%02x hci_rev=%04x lmp_ver=%02x lmp_subver=%04x", 1120 hci_ver, hci_rev, 1121 lmp_ver, lmp_subver); 1122 1123 if (!btrtl_dev->ic_info && !btrtl_dev->drop_fw) 1124 btrtl_dev->drop_fw = true; 1125 else 1126 btrtl_dev->drop_fw = false; 1127 1128 if (btrtl_dev->drop_fw) { 1129 skb = bt_skb_alloc(sizeof(*cmd), GFP_KERNEL); 1130 if (!skb) 1131 goto err_free; 1132 1133 cmd = skb_put(skb, HCI_COMMAND_HDR_SIZE); 1134 cmd->opcode = cpu_to_le16(0xfc66); 1135 cmd->plen = 0; 1136 1137 hci_skb_pkt_type(skb) = HCI_COMMAND_PKT; 1138 1139 ret = hdev->send(hdev, skb); 1140 if (ret < 0) { 1141 bt_dev_err(hdev, "sending frame failed (%d)", ret); 1142 kfree_skb(skb); 1143 goto err_free; 1144 } 1145 1146 /* Ensure the above vendor command is sent to controller and 1147 * process has done. 1148 */ 1149 msleep(200); 1150 1151 goto check_version; 1152 } 1153 1154 if (!btrtl_dev->ic_info) { 1155 rtl_dev_info(hdev, "unknown IC info, lmp subver %04x, hci rev %04x, hci ver %04x", 1156 lmp_subver, hci_rev, hci_ver); 1157 return btrtl_dev; 1158 } 1159 1160 if (btrtl_dev->ic_info->has_rom_version) { 1161 ret = rtl_read_rom_version(hdev, &btrtl_dev->rom_version); 1162 if (ret) 1163 goto err_free; 1164 } 1165 1166 if (!btrtl_dev->ic_info->fw_name) { 1167 ret = -ENOMEM; 1168 goto err_free; 1169 } 1170 1171 btrtl_dev->fw_len = -EIO; 1172 if (lmp_subver == RTL_ROM_LMP_8852A && hci_rev == 0x000c) { 1173 snprintf(fw_name, sizeof(fw_name), "%s_v2.bin", 1174 btrtl_dev->ic_info->fw_name); 1175 btrtl_dev->fw_len = rtl_load_file(hdev, fw_name, 1176 &btrtl_dev->fw_data); 1177 } 1178 1179 if (btrtl_dev->fw_len < 0) { 1180 snprintf(fw_name, sizeof(fw_name), "%s.bin", 1181 btrtl_dev->ic_info->fw_name); 1182 btrtl_dev->fw_len = rtl_load_file(hdev, fw_name, 1183 &btrtl_dev->fw_data); 1184 } 1185 1186 if (btrtl_dev->fw_len < 0) { 1187 rtl_dev_err(hdev, "firmware file %s not found", 1188 btrtl_dev->ic_info->fw_name); 1189 ret = btrtl_dev->fw_len; 1190 goto err_free; 1191 } 1192 1193 if (btrtl_dev->ic_info->cfg_name) { 1194 if (postfix) { 1195 snprintf(cfg_name, sizeof(cfg_name), "%s-%s.bin", 1196 btrtl_dev->ic_info->cfg_name, postfix); 1197 } else { 1198 snprintf(cfg_name, sizeof(cfg_name), "%s.bin", 1199 btrtl_dev->ic_info->cfg_name); 1200 } 1201 btrtl_dev->cfg_len = rtl_load_file(hdev, cfg_name, 1202 &btrtl_dev->cfg_data); 1203 if (btrtl_dev->ic_info->config_needed && 1204 btrtl_dev->cfg_len <= 0) { 1205 rtl_dev_err(hdev, "mandatory config file %s not found", 1206 btrtl_dev->ic_info->cfg_name); 1207 ret = btrtl_dev->cfg_len; 1208 goto err_free; 1209 } 1210 } 1211 1212 /* The following chips supports the Microsoft vendor extension, 1213 * therefore set the corresponding VsMsftOpCode. 1214 */ 1215 if (btrtl_dev->ic_info->has_msft_ext) 1216 hci_set_msft_opcode(hdev, 0xFCF0); 1217 1218 if (btrtl_dev->ic_info) 1219 coredump_info->rtl_dump.controller = btrtl_dev->ic_info->hw_info; 1220 1221 return btrtl_dev; 1222 1223 err_free: 1224 btrtl_free(btrtl_dev); 1225 err_alloc: 1226 return ERR_PTR(ret); 1227 } 1228 EXPORT_SYMBOL_GPL(btrtl_initialize); 1229 1230 int btrtl_download_firmware(struct hci_dev *hdev, 1231 struct btrtl_device_info *btrtl_dev) 1232 { 1233 int err = 0; 1234 1235 /* Match a set of subver values that correspond to stock firmware, 1236 * which is not compatible with standard btusb. 1237 * If matched, upload an alternative firmware that does conform to 1238 * standard btusb. Once that firmware is uploaded, the subver changes 1239 * to a different value. 1240 */ 1241 if (!btrtl_dev->ic_info) { 1242 rtl_dev_info(hdev, "assuming no firmware upload needed"); 1243 err = 0; 1244 goto done; 1245 } 1246 1247 switch (btrtl_dev->ic_info->lmp_subver) { 1248 case RTL_ROM_LMP_8723A: 1249 err = btrtl_setup_rtl8723a(hdev, btrtl_dev); 1250 break; 1251 case RTL_ROM_LMP_8723B: 1252 case RTL_ROM_LMP_8821A: 1253 case RTL_ROM_LMP_8761A: 1254 case RTL_ROM_LMP_8822B: 1255 case RTL_ROM_LMP_8852A: 1256 case RTL_ROM_LMP_8703B: 1257 case RTL_ROM_LMP_8851B: 1258 err = btrtl_setup_rtl8723b(hdev, btrtl_dev); 1259 break; 1260 default: 1261 rtl_dev_info(hdev, "assuming no firmware upload needed"); 1262 break; 1263 } 1264 1265 done: 1266 btrtl_register_devcoredump_support(hdev); 1267 1268 return err; 1269 } 1270 EXPORT_SYMBOL_GPL(btrtl_download_firmware); 1271 1272 void btrtl_set_quirks(struct hci_dev *hdev, struct btrtl_device_info *btrtl_dev) 1273 { 1274 /* Enable controller to do both LE scan and BR/EDR inquiry 1275 * simultaneously. 1276 */ 1277 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 1278 1279 /* Enable central-peripheral role (able to create new connections with 1280 * an existing connection in slave role). 1281 */ 1282 /* Enable WBS supported for the specific Realtek devices. */ 1283 switch (btrtl_dev->project_id) { 1284 case CHIP_ID_8822C: 1285 case CHIP_ID_8852A: 1286 case CHIP_ID_8852B: 1287 case CHIP_ID_8852C: 1288 case CHIP_ID_8851B: 1289 case CHIP_ID_8852BT: 1290 set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks); 1291 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks); 1292 1293 /* RTL8852C needs to transmit mSBC data continuously without 1294 * the zero length of USB packets for the ALT 6 supported chips 1295 */ 1296 if (btrtl_dev->project_id == CHIP_ID_8852C) 1297 btrealtek_set_flag(hdev, REALTEK_ALT6_CONTINUOUS_TX_CHIP); 1298 1299 if (btrtl_dev->project_id == CHIP_ID_8852A || 1300 btrtl_dev->project_id == CHIP_ID_8852C) 1301 set_bit(HCI_QUIRK_USE_MSFT_EXT_ADDRESS_FILTER, &hdev->quirks); 1302 1303 hci_set_aosp_capable(hdev); 1304 break; 1305 default: 1306 rtl_dev_dbg(hdev, "Central-peripheral role not enabled."); 1307 rtl_dev_dbg(hdev, "WBS supported not enabled."); 1308 break; 1309 } 1310 1311 if (!btrtl_dev->ic_info) 1312 return; 1313 1314 switch (btrtl_dev->ic_info->lmp_subver) { 1315 case RTL_ROM_LMP_8703B: 1316 /* 8723CS reports two pages for local ext features, 1317 * but it doesn't support any features from page 2 - 1318 * it either responds with garbage or with error status 1319 */ 1320 set_bit(HCI_QUIRK_BROKEN_LOCAL_EXT_FEATURES_PAGE_2, 1321 &hdev->quirks); 1322 break; 1323 default: 1324 break; 1325 } 1326 } 1327 EXPORT_SYMBOL_GPL(btrtl_set_quirks); 1328 1329 int btrtl_setup_realtek(struct hci_dev *hdev) 1330 { 1331 struct btrtl_device_info *btrtl_dev; 1332 int ret; 1333 1334 btrtl_dev = btrtl_initialize(hdev, NULL); 1335 if (IS_ERR(btrtl_dev)) 1336 return PTR_ERR(btrtl_dev); 1337 1338 ret = btrtl_download_firmware(hdev, btrtl_dev); 1339 1340 btrtl_set_quirks(hdev, btrtl_dev); 1341 1342 btrtl_free(btrtl_dev); 1343 return ret; 1344 } 1345 EXPORT_SYMBOL_GPL(btrtl_setup_realtek); 1346 1347 int btrtl_shutdown_realtek(struct hci_dev *hdev) 1348 { 1349 struct sk_buff *skb; 1350 int ret; 1351 1352 /* According to the vendor driver, BT must be reset on close to avoid 1353 * firmware crash. 1354 */ 1355 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 1356 if (IS_ERR(skb)) { 1357 ret = PTR_ERR(skb); 1358 bt_dev_err(hdev, "HCI reset during shutdown failed"); 1359 return ret; 1360 } 1361 kfree_skb(skb); 1362 1363 return 0; 1364 } 1365 EXPORT_SYMBOL_GPL(btrtl_shutdown_realtek); 1366 1367 static unsigned int btrtl_convert_baudrate(u32 device_baudrate) 1368 { 1369 switch (device_baudrate) { 1370 case 0x0252a00a: 1371 return 230400; 1372 1373 case 0x05f75004: 1374 return 921600; 1375 1376 case 0x00005004: 1377 return 1000000; 1378 1379 case 0x04928002: 1380 case 0x01128002: 1381 return 1500000; 1382 1383 case 0x00005002: 1384 return 2000000; 1385 1386 case 0x0000b001: 1387 return 2500000; 1388 1389 case 0x04928001: 1390 return 3000000; 1391 1392 case 0x052a6001: 1393 return 3500000; 1394 1395 case 0x00005001: 1396 return 4000000; 1397 1398 case 0x0252c014: 1399 default: 1400 return 115200; 1401 } 1402 } 1403 1404 int btrtl_get_uart_settings(struct hci_dev *hdev, 1405 struct btrtl_device_info *btrtl_dev, 1406 unsigned int *controller_baudrate, 1407 u32 *device_baudrate, bool *flow_control) 1408 { 1409 struct rtl_vendor_config *config; 1410 struct rtl_vendor_config_entry *entry; 1411 int i, total_data_len; 1412 bool found = false; 1413 1414 total_data_len = btrtl_dev->cfg_len - sizeof(*config); 1415 if (total_data_len <= 0) { 1416 rtl_dev_warn(hdev, "no config loaded"); 1417 return -EINVAL; 1418 } 1419 1420 config = (struct rtl_vendor_config *)btrtl_dev->cfg_data; 1421 if (le32_to_cpu(config->signature) != RTL_CONFIG_MAGIC) { 1422 rtl_dev_err(hdev, "invalid config magic"); 1423 return -EINVAL; 1424 } 1425 1426 if (total_data_len < le16_to_cpu(config->total_len)) { 1427 rtl_dev_err(hdev, "config is too short"); 1428 return -EINVAL; 1429 } 1430 1431 for (i = 0; i < total_data_len; ) { 1432 entry = ((void *)config->entry) + i; 1433 1434 switch (le16_to_cpu(entry->offset)) { 1435 case 0xc: 1436 if (entry->len < sizeof(*device_baudrate)) { 1437 rtl_dev_err(hdev, "invalid UART config entry"); 1438 return -EINVAL; 1439 } 1440 1441 *device_baudrate = get_unaligned_le32(entry->data); 1442 *controller_baudrate = btrtl_convert_baudrate( 1443 *device_baudrate); 1444 1445 if (entry->len >= 13) 1446 *flow_control = !!(entry->data[12] & BIT(2)); 1447 else 1448 *flow_control = false; 1449 1450 found = true; 1451 break; 1452 1453 default: 1454 rtl_dev_dbg(hdev, "skipping config entry 0x%x (len %u)", 1455 le16_to_cpu(entry->offset), entry->len); 1456 break; 1457 } 1458 1459 i += sizeof(*entry) + entry->len; 1460 } 1461 1462 if (!found) { 1463 rtl_dev_err(hdev, "no UART config entry found"); 1464 return -ENOENT; 1465 } 1466 1467 rtl_dev_dbg(hdev, "device baudrate = 0x%08x", *device_baudrate); 1468 rtl_dev_dbg(hdev, "controller baudrate = %u", *controller_baudrate); 1469 rtl_dev_dbg(hdev, "flow control %d", *flow_control); 1470 1471 return 0; 1472 } 1473 EXPORT_SYMBOL_GPL(btrtl_get_uart_settings); 1474 1475 MODULE_AUTHOR("Daniel Drake <drake@endlessm.com>"); 1476 MODULE_DESCRIPTION("Bluetooth support for Realtek devices ver " VERSION); 1477 MODULE_VERSION(VERSION); 1478 MODULE_LICENSE("GPL"); 1479 MODULE_FIRMWARE("rtl_bt/rtl8723a_fw.bin"); 1480 MODULE_FIRMWARE("rtl_bt/rtl8723b_fw.bin"); 1481 MODULE_FIRMWARE("rtl_bt/rtl8723b_config.bin"); 1482 MODULE_FIRMWARE("rtl_bt/rtl8723bs_fw.bin"); 1483 MODULE_FIRMWARE("rtl_bt/rtl8723bs_config.bin"); 1484 MODULE_FIRMWARE("rtl_bt/rtl8723cs_cg_fw.bin"); 1485 MODULE_FIRMWARE("rtl_bt/rtl8723cs_cg_config.bin"); 1486 MODULE_FIRMWARE("rtl_bt/rtl8723cs_vf_fw.bin"); 1487 MODULE_FIRMWARE("rtl_bt/rtl8723cs_vf_config.bin"); 1488 MODULE_FIRMWARE("rtl_bt/rtl8723cs_xx_fw.bin"); 1489 MODULE_FIRMWARE("rtl_bt/rtl8723cs_xx_config.bin"); 1490 MODULE_FIRMWARE("rtl_bt/rtl8723d_fw.bin"); 1491 MODULE_FIRMWARE("rtl_bt/rtl8723d_config.bin"); 1492 MODULE_FIRMWARE("rtl_bt/rtl8723ds_fw.bin"); 1493 MODULE_FIRMWARE("rtl_bt/rtl8723ds_config.bin"); 1494 MODULE_FIRMWARE("rtl_bt/rtl8761a_fw.bin"); 1495 MODULE_FIRMWARE("rtl_bt/rtl8761a_config.bin"); 1496 MODULE_FIRMWARE("rtl_bt/rtl8761b_fw.bin"); 1497 MODULE_FIRMWARE("rtl_bt/rtl8761b_config.bin"); 1498 MODULE_FIRMWARE("rtl_bt/rtl8761bu_fw.bin"); 1499 MODULE_FIRMWARE("rtl_bt/rtl8761bu_config.bin"); 1500 MODULE_FIRMWARE("rtl_bt/rtl8821a_fw.bin"); 1501 MODULE_FIRMWARE("rtl_bt/rtl8821a_config.bin"); 1502 MODULE_FIRMWARE("rtl_bt/rtl8821c_fw.bin"); 1503 MODULE_FIRMWARE("rtl_bt/rtl8821c_config.bin"); 1504 MODULE_FIRMWARE("rtl_bt/rtl8821cs_fw.bin"); 1505 MODULE_FIRMWARE("rtl_bt/rtl8821cs_config.bin"); 1506 MODULE_FIRMWARE("rtl_bt/rtl8822b_fw.bin"); 1507 MODULE_FIRMWARE("rtl_bt/rtl8822b_config.bin"); 1508 MODULE_FIRMWARE("rtl_bt/rtl8822cs_fw.bin"); 1509 MODULE_FIRMWARE("rtl_bt/rtl8822cs_config.bin"); 1510 MODULE_FIRMWARE("rtl_bt/rtl8822cu_fw.bin"); 1511 MODULE_FIRMWARE("rtl_bt/rtl8822cu_config.bin"); 1512 MODULE_FIRMWARE("rtl_bt/rtl8851bu_fw.bin"); 1513 MODULE_FIRMWARE("rtl_bt/rtl8851bu_config.bin"); 1514 MODULE_FIRMWARE("rtl_bt/rtl8852au_fw.bin"); 1515 MODULE_FIRMWARE("rtl_bt/rtl8852au_config.bin"); 1516 MODULE_FIRMWARE("rtl_bt/rtl8852bs_fw.bin"); 1517 MODULE_FIRMWARE("rtl_bt/rtl8852bs_config.bin"); 1518 MODULE_FIRMWARE("rtl_bt/rtl8852bu_fw.bin"); 1519 MODULE_FIRMWARE("rtl_bt/rtl8852bu_config.bin"); 1520 MODULE_FIRMWARE("rtl_bt/rtl8852btu_fw.bin"); 1521 MODULE_FIRMWARE("rtl_bt/rtl8852btu_config.bin"); 1522 MODULE_FIRMWARE("rtl_bt/rtl8852cu_fw.bin"); 1523 MODULE_FIRMWARE("rtl_bt/rtl8852cu_fw_v2.bin"); 1524 MODULE_FIRMWARE("rtl_bt/rtl8852cu_config.bin"); 1525