drivers/bluetooth/btrtl.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *  Bluetooth support for Realtek devices
   4  *
   5  *  Copyright (C) 2015 Endless Mobile, Inc.
   6  */
   7
   8 #include <linux/module.h>
   9 #include <linux/firmware.h>
  10 #include <asm/unaligned.h>
  11 #include <linux/usb.h>
  12
  13 #include <net/bluetooth/bluetooth.h>
  14 #include <net/bluetooth/hci_core.h>
  15
  16 #include "btrtl.h"
  17
  18 #define VERSION "0.1"
  19
  20 #define RTL_CHIP_8723CS_CG      3
  21 #define RTL_CHIP_8723CS_VF      4
  22 #define RTL_CHIP_8723CS_XX      5
  23 #define RTL_EPATCH_SIGNATURE    "Realtech"
  24 #define RTL_EPATCH_SIGNATURE_V2 "RTBTCore"
  25 #define RTL_ROM_LMP_8703B       0x8703
  26 #define RTL_ROM_LMP_8723A       0x1200
  27 #define RTL_ROM_LMP_8723B       0x8723
  28 #define RTL_ROM_LMP_8821A       0x8821
  29 #define RTL_ROM_LMP_8761A       0x8761
  30 #define RTL_ROM_LMP_8822B       0x8822
  31 #define RTL_ROM_LMP_8852A       0x8852
  32 #define RTL_ROM_LMP_8851B       0x8851
  33 #define RTL_CONFIG_MAGIC        0x8723ab55
  34
  35 #define RTL_VSC_OP_COREDUMP     0xfcff
  36
  37 #define IC_MATCH_FL_LMPSUBV     (1 << 0)
  38 #define IC_MATCH_FL_HCIREV      (1 << 1)
  39 #define IC_MATCH_FL_HCIVER      (1 << 2)
  40 #define IC_MATCH_FL_HCIBUS      (1 << 3)
  41 #define IC_MATCH_FL_CHIP_TYPE   (1 << 4)
  42 #define IC_INFO(lmps, hcir, hciv, bus) \
  43         .match_flags = IC_MATCH_FL_LMPSUBV | IC_MATCH_FL_HCIREV | \
  44                        IC_MATCH_FL_HCIVER | IC_MATCH_FL_HCIBUS, \
  45         .lmp_subver = (lmps), \
  46         .hci_rev = (hcir), \
  47         .hci_ver = (hciv), \
  48         .hci_bus = (bus)
  49
  50 #define RTL_CHIP_SUBVER (&(struct rtl_vendor_cmd) {{0x10, 0x38, 0x04, 0x28, 0x80}})
  51 #define RTL_CHIP_REV    (&(struct rtl_vendor_cmd) {{0x10, 0x3A, 0x04, 0x28, 0x80}})
  52 #define RTL_SEC_PROJ    (&(struct rtl_vendor_cmd) {{0x10, 0xA4, 0x0D, 0x00, 0xb0}})
  53
  54 #define RTL_PATCH_SNIPPETS              0x01
  55 #define RTL_PATCH_DUMMY_HEADER          0x02
  56 #define RTL_PATCH_SECURITY_HEADER       0x03
  57
  58 enum btrtl_chip_id {
  59         CHIP_ID_8723A,
  60         CHIP_ID_8723B,
  61         CHIP_ID_8821A,
  62         CHIP_ID_8761A,
  63         CHIP_ID_8822B = 8,
  64         CHIP_ID_8723D,
  65         CHIP_ID_8821C,
  66         CHIP_ID_8822C = 13,
  67         CHIP_ID_8761B,
  68         CHIP_ID_8852A = 18,
  69         CHIP_ID_8852B = 20,
  70         CHIP_ID_8852C = 25,
  71         CHIP_ID_8851B = 36,
  72 };
  73
  74 struct id_table {
  75         __u16 match_flags;
  76         __u16 lmp_subver;
  77         __u16 hci_rev;
  78         __u8 hci_ver;
  79         __u8 hci_bus;
  80         __u8 chip_type;
  81         bool config_needed;
  82         bool has_rom_version;
  83         bool has_msft_ext;
  84         char *fw_name;
  85         char *cfg_name;
  86         char *hw_info;
  87 };
  88
  89 struct btrtl_device_info {
  90         const struct id_table *ic_info;
  91         u8 rom_version;
  92         u8 *fw_data;
  93         int fw_len;
  94         u8 *cfg_data;
  95         int cfg_len;
  96         bool drop_fw;
  97         int project_id;
  98         u8 key_id;
  99         struct list_head patch_subsecs;
 100 };
 101
 102 static const struct id_table ic_id_table[] = {
 103         /* 8723A */
 104         { IC_INFO(RTL_ROM_LMP_8723A, 0xb, 0x6, HCI_USB),
 105           .config_needed = false,
 106           .has_rom_version = false,
 107           .fw_name = "rtl_bt/rtl8723a_fw",
 108           .cfg_name = NULL,
 109           .hw_info = "rtl8723au" },
 110
 111         /* 8723BS */
 112         { IC_INFO(RTL_ROM_LMP_8723B, 0xb, 0x6, HCI_UART),
 113           .config_needed = true,
 114           .has_rom_version = true,
 115           .fw_name  = "rtl_bt/rtl8723bs_fw",
 116           .cfg_name = "rtl_bt/rtl8723bs_config",
 117           .hw_info  = "rtl8723bs" },
 118
 119         /* 8723B */
 120         { IC_INFO(RTL_ROM_LMP_8723B, 0xb, 0x6, HCI_USB),
 121           .config_needed = false,
 122           .has_rom_version = true,
 123           .fw_name  = "rtl_bt/rtl8723b_fw",
 124           .cfg_name = "rtl_bt/rtl8723b_config",
 125           .hw_info  = "rtl8723bu" },
 126
 127         /* 8723CS-CG */
 128         { .match_flags = IC_MATCH_FL_LMPSUBV | IC_MATCH_FL_CHIP_TYPE |
 129                          IC_MATCH_FL_HCIBUS,
 130           .lmp_subver = RTL_ROM_LMP_8703B,
 131           .chip_type = RTL_CHIP_8723CS_CG,
 132           .hci_bus = HCI_UART,
 133           .config_needed = true,
 134           .has_rom_version = true,
 135           .fw_name  = "rtl_bt/rtl8723cs_cg_fw",
 136           .cfg_name = "rtl_bt/rtl8723cs_cg_config",
 137           .hw_info  = "rtl8723cs-cg" },
 138
 139         /* 8723CS-VF */
 140         { .match_flags = IC_MATCH_FL_LMPSUBV | IC_MATCH_FL_CHIP_TYPE |
 141                          IC_MATCH_FL_HCIBUS,
 142           .lmp_subver = RTL_ROM_LMP_8703B,
 143           .chip_type = RTL_CHIP_8723CS_VF,
 144           .hci_bus = HCI_UART,
 145           .config_needed = true,
 146           .has_rom_version = true,
 147           .fw_name  = "rtl_bt/rtl8723cs_vf_fw",
 148           .cfg_name = "rtl_bt/rtl8723cs_vf_config",
 149           .hw_info  = "rtl8723cs-vf" },
 150
 151         /* 8723CS-XX */
 152         { .match_flags = IC_MATCH_FL_LMPSUBV | IC_MATCH_FL_CHIP_TYPE |
 153                          IC_MATCH_FL_HCIBUS,
 154           .lmp_subver = RTL_ROM_LMP_8703B,
 155           .chip_type = RTL_CHIP_8723CS_XX,
 156           .hci_bus = HCI_UART,
 157           .config_needed = true,
 158           .has_rom_version = true,
 159           .fw_name  = "rtl_bt/rtl8723cs_xx_fw",
 160           .cfg_name = "rtl_bt/rtl8723cs_xx_config",
 161           .hw_info  = "rtl8723cs" },
 162
 163         /* 8723D */
 164         { IC_INFO(RTL_ROM_LMP_8723B, 0xd, 0x8, HCI_USB),
 165           .config_needed = true,
 166           .has_rom_version = true,
 167           .fw_name  = "rtl_bt/rtl8723d_fw",
 168           .cfg_name = "rtl_bt/rtl8723d_config",
 169           .hw_info  = "rtl8723du" },
 170
 171         /* 8723DS */
 172         { IC_INFO(RTL_ROM_LMP_8723B, 0xd, 0x8, HCI_UART),
 173           .config_needed = true,
 174           .has_rom_version = true,
 175           .fw_name  = "rtl_bt/rtl8723ds_fw",
 176           .cfg_name = "rtl_bt/rtl8723ds_config",
 177           .hw_info  = "rtl8723ds" },
 178
 179         /* 8821A */
 180         { IC_INFO(RTL_ROM_LMP_8821A, 0xa, 0x6, HCI_USB),
 181           .config_needed = false,
 182           .has_rom_version = true,
 183           .fw_name  = "rtl_bt/rtl8821a_fw",
 184           .cfg_name = "rtl_bt/rtl8821a_config",
 185           .hw_info  = "rtl8821au" },
 186
 187         /* 8821C */
 188         { IC_INFO(RTL_ROM_LMP_8821A, 0xc, 0x8, HCI_USB),
 189           .config_needed = false,
 190           .has_rom_version = true,
 191           .has_msft_ext = true,
 192           .fw_name  = "rtl_bt/rtl8821c_fw",
 193           .cfg_name = "rtl_bt/rtl8821c_config",
 194           .hw_info  = "rtl8821cu" },
 195
 196         /* 8821CS */
 197         { IC_INFO(RTL_ROM_LMP_8821A, 0xc, 0x8, HCI_UART),
 198           .config_needed = true,
 199           .has_rom_version = true,
 200           .has_msft_ext = true,
 201           .fw_name  = "rtl_bt/rtl8821cs_fw",
 202           .cfg_name = "rtl_bt/rtl8821cs_config",
 203           .hw_info  = "rtl8821cs" },
 204
 205         /* 8761A */
 206         { IC_INFO(RTL_ROM_LMP_8761A, 0xa, 0x6, HCI_USB),
 207           .config_needed = false,
 208           .has_rom_version = true,
 209           .fw_name  = "rtl_bt/rtl8761a_fw",
 210           .cfg_name = "rtl_bt/rtl8761a_config",
 211           .hw_info  = "rtl8761au" },
 212
 213         /* 8761B */
 214         { IC_INFO(RTL_ROM_LMP_8761A, 0xb, 0xa, HCI_UART),
 215           .config_needed = false,
 216           .has_rom_version = true,
 217           .has_msft_ext = true,
 218           .fw_name  = "rtl_bt/rtl8761b_fw",
 219           .cfg_name = "rtl_bt/rtl8761b_config",
 220           .hw_info  = "rtl8761btv" },
 221
 222         /* 8761BU */
 223         { IC_INFO(RTL_ROM_LMP_8761A, 0xb, 0xa, HCI_USB),
 224           .config_needed = false,
 225           .has_rom_version = true,
 226           .fw_name  = "rtl_bt/rtl8761bu_fw",
 227           .cfg_name = "rtl_bt/rtl8761bu_config",
 228           .hw_info  = "rtl8761bu" },
 229
 230         /* 8822C with UART interface */
 231         { IC_INFO(RTL_ROM_LMP_8822B, 0xc, 0x8, HCI_UART),
 232           .config_needed = true,
 233           .has_rom_version = true,
 234           .has_msft_ext = true,
 235           .fw_name  = "rtl_bt/rtl8822cs_fw",
 236           .cfg_name = "rtl_bt/rtl8822cs_config",
 237           .hw_info  = "rtl8822cs" },
 238
 239         /* 8822C with UART interface */
 240         { IC_INFO(RTL_ROM_LMP_8822B, 0xc, 0xa, HCI_UART),
 241           .config_needed = true,
 242           .has_rom_version = true,
 243           .has_msft_ext = true,
 244           .fw_name  = "rtl_bt/rtl8822cs_fw",
 245           .cfg_name = "rtl_bt/rtl8822cs_config",
 246           .hw_info  = "rtl8822cs" },
 247
 248         /* 8822C with USB interface */
 249         { IC_INFO(RTL_ROM_LMP_8822B, 0xc, 0xa, HCI_USB),
 250           .config_needed = false,
 251           .has_rom_version = true,
 252           .has_msft_ext = true,
 253           .fw_name  = "rtl_bt/rtl8822cu_fw",
 254           .cfg_name = "rtl_bt/rtl8822cu_config",
 255           .hw_info  = "rtl8822cu" },
 256
 257         /* 8822B */
 258         { IC_INFO(RTL_ROM_LMP_8822B, 0xb, 0x7, HCI_USB),
 259           .config_needed = true,
 260           .has_rom_version = true,
 261           .has_msft_ext = true,
 262           .fw_name  = "rtl_bt/rtl8822b_fw",
 263           .cfg_name = "rtl_bt/rtl8822b_config",
 264           .hw_info  = "rtl8822bu" },
 265
 266         /* 8852A */
 267         { IC_INFO(RTL_ROM_LMP_8852A, 0xa, 0xb, HCI_USB),
 268           .config_needed = false,
 269           .has_rom_version = true,
 270           .has_msft_ext = true,
 271           .fw_name  = "rtl_bt/rtl8852au_fw",
 272           .cfg_name = "rtl_bt/rtl8852au_config",
 273           .hw_info  = "rtl8852au" },
 274
 275         /* 8852B with UART interface */
 276         { IC_INFO(RTL_ROM_LMP_8852A, 0xb, 0xb, HCI_UART),
 277           .config_needed = true,
 278           .has_rom_version = true,
 279           .has_msft_ext = true,
 280           .fw_name  = "rtl_bt/rtl8852bs_fw",
 281           .cfg_name = "rtl_bt/rtl8852bs_config",
 282           .hw_info  = "rtl8852bs" },
 283
 284         /* 8852B */
 285         { IC_INFO(RTL_ROM_LMP_8852A, 0xb, 0xb, HCI_USB),
 286           .config_needed = false,
 287           .has_rom_version = true,
 288           .has_msft_ext = true,
 289           .fw_name  = "rtl_bt/rtl8852bu_fw",
 290           .cfg_name = "rtl_bt/rtl8852bu_config",
 291           .hw_info  = "rtl8852bu" },
 292
 293         /* 8852C */
 294         { IC_INFO(RTL_ROM_LMP_8852A, 0xc, 0xc, HCI_USB),
 295           .config_needed = false,
 296           .has_rom_version = true,
 297           .has_msft_ext = true,
 298           .fw_name  = "rtl_bt/rtl8852cu_fw",
 299           .cfg_name = "rtl_bt/rtl8852cu_config",
 300           .hw_info  = "rtl8852cu" },
 301
 302         /* 8851B */
 303         { IC_INFO(RTL_ROM_LMP_8851B, 0xb, 0xc, HCI_USB),
 304           .config_needed = false,
 305           .has_rom_version = true,
 306           .has_msft_ext = false,
 307           .fw_name  = "rtl_bt/rtl8851bu_fw",
 308           .cfg_name = "rtl_bt/rtl8851bu_config",
 309           .hw_info  = "rtl8851bu" },
 310         };
 311
 312 static const struct id_table *btrtl_match_ic(u16 lmp_subver, u16 hci_rev,
 313                                              u8 hci_ver, u8 hci_bus,
 314                                              u8 chip_type)
 315 {
 316         int i;
 317
 318         for (i = 0; i < ARRAY_SIZE(ic_id_table); i++) {
 319                 if ((ic_id_table[i].match_flags & IC_MATCH_FL_LMPSUBV) &&
 320                     (ic_id_table[i].lmp_subver != lmp_subver))
 321                         continue;
 322                 if ((ic_id_table[i].match_flags & IC_MATCH_FL_HCIREV) &&
 323                     (ic_id_table[i].hci_rev != hci_rev))
 324                         continue;
 325                 if ((ic_id_table[i].match_flags & IC_MATCH_FL_HCIVER) &&
 326                     (ic_id_table[i].hci_ver != hci_ver))
 327                         continue;
 328                 if ((ic_id_table[i].match_flags & IC_MATCH_FL_HCIBUS) &&
 329                     (ic_id_table[i].hci_bus != hci_bus))
 330                         continue;
 331                 if ((ic_id_table[i].match_flags & IC_MATCH_FL_CHIP_TYPE) &&
 332                     (ic_id_table[i].chip_type != chip_type))
 333                         continue;
 334
 335                 break;
 336         }
 337         if (i >= ARRAY_SIZE(ic_id_table))
 338                 return NULL;
 339
 340         return &ic_id_table[i];
 341 }
 342
 343 static struct sk_buff *btrtl_read_local_version(struct hci_dev *hdev)
 344 {
 345         struct sk_buff *skb;
 346
 347         skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
 348                              HCI_INIT_TIMEOUT);
 349         if (IS_ERR(skb)) {
 350                 rtl_dev_err(hdev, "HCI_OP_READ_LOCAL_VERSION failed (%ld)",
 351                             PTR_ERR(skb));
 352                 return skb;
 353         }
 354
 355         if (skb->len != sizeof(struct hci_rp_read_local_version)) {
 356                 rtl_dev_err(hdev, "HCI_OP_READ_LOCAL_VERSION event length mismatch");
 357                 kfree_skb(skb);
 358                 return ERR_PTR(-EIO);
 359         }
 360
 361         return skb;
 362 }
 363
 364 static int rtl_read_rom_version(struct hci_dev *hdev, u8 *version)
 365 {
 366         struct rtl_rom_version_evt *rom_version;
 367         struct sk_buff *skb;
 368
 369         /* Read RTL ROM version command */
 370         skb = __hci_cmd_sync(hdev, 0xfc6d, 0, NULL, HCI_INIT_TIMEOUT);
 371         if (IS_ERR(skb)) {
 372                 rtl_dev_err(hdev, "Read ROM version failed (%ld)",
 373                             PTR_ERR(skb));
 374                 return PTR_ERR(skb);
 375         }
 376
 377         if (skb->len != sizeof(*rom_version)) {
 378                 rtl_dev_err(hdev, "version event length mismatch");
 379                 kfree_skb(skb);
 380                 return -EIO;
 381         }
 382
 383         rom_version = (struct rtl_rom_version_evt *)skb->data;
 384         rtl_dev_info(hdev, "rom_version status=%x version=%x",
 385                      rom_version->status, rom_version->version);
 386
 387         *version = rom_version->version;
 388
 389         kfree_skb(skb);
 390         return 0;
 391 }
 392
 393 static int btrtl_vendor_read_reg16(struct hci_dev *hdev,
 394                                    struct rtl_vendor_cmd *cmd, u8 *rp)
 395 {
 396         struct sk_buff *skb;
 397         int err = 0;
 398
 399         skb = __hci_cmd_sync(hdev, 0xfc61, sizeof(*cmd), cmd,
 400                              HCI_INIT_TIMEOUT);
 401         if (IS_ERR(skb)) {
 402                 err = PTR_ERR(skb);
 403                 rtl_dev_err(hdev, "RTL: Read reg16 failed (%d)", err);
 404                 return err;
 405         }
 406
 407         if (skb->len != 3 || skb->data[0]) {
 408                 bt_dev_err(hdev, "RTL: Read reg16 length mismatch");
 409                 kfree_skb(skb);
 410                 return -EIO;
 411         }
 412
 413         if (rp)
 414                 memcpy(rp, skb->data + 1, 2);
 415
 416         kfree_skb(skb);
 417
 418         return 0;
 419 }
 420
 421 static void *rtl_iov_pull_data(struct rtl_iovec *iov, u32 len)
 422 {
 423         void *data = iov->data;
 424
 425         if (iov->len < len)
 426                 return NULL;
 427
 428         iov->data += len;
 429         iov->len  -= len;
 430
 431         return data;
 432 }
 433
 434 static void btrtl_insert_ordered_subsec(struct rtl_subsection *node,
 435                                         struct btrtl_device_info *btrtl_dev)
 436 {
 437         struct list_head *pos;
 438         struct list_head *next;
 439         struct rtl_subsection *subsec;
 440
 441         list_for_each_safe(pos, next, &btrtl_dev->patch_subsecs) {
 442                 subsec = list_entry(pos, struct rtl_subsection, list);
 443                 if (subsec->prio >= node->prio)
 444                         break;
 445         }
 446         __list_add(&node->list, pos->prev, pos);
 447 }
 448
 449 static int btrtl_parse_section(struct hci_dev *hdev,
 450                                struct btrtl_device_info *btrtl_dev, u32 opcode,
 451                                u8 *data, u32 len)
 452 {
 453         struct rtl_section_hdr *hdr;
 454         struct rtl_subsection *subsec;
 455         struct rtl_common_subsec *common_subsec;
 456         struct rtl_sec_hdr *sec_hdr;
 457         int i;
 458         u8 *ptr;
 459         u16 num_subsecs;
 460         u32 subsec_len;
 461         int rc = 0;
 462         struct rtl_iovec iov = {
 463                 .data = data,
 464                 .len  = len,
 465         };
 466
 467         hdr = rtl_iov_pull_data(&iov, sizeof(*hdr));
 468         if (!hdr)
 469                 return -EINVAL;
 470         num_subsecs = le16_to_cpu(hdr->num);
 471
 472         for (i = 0; i < num_subsecs; i++) {
 473                 common_subsec = rtl_iov_pull_data(&iov, sizeof(*common_subsec));
 474                 if (!common_subsec)
 475                         break;
 476                 subsec_len = le32_to_cpu(common_subsec->len);
 477
 478                 rtl_dev_dbg(hdev, "subsec, eco 0x%02x, len %08x",
 479                             common_subsec->eco, subsec_len);
 480
 481                 ptr = rtl_iov_pull_data(&iov, subsec_len);
 482                 if (!ptr)
 483                         break;
 484
 485                 if (common_subsec->eco != btrtl_dev->rom_version + 1)
 486                         continue;
 487
 488                 switch (opcode) {
 489                 case RTL_PATCH_SECURITY_HEADER:
 490                         sec_hdr = (void *)common_subsec;
 491                         if (sec_hdr->key_id != btrtl_dev->key_id)
 492                                 continue;
 493                         break;
 494                 }
 495
 496                 subsec = kzalloc(sizeof(*subsec), GFP_KERNEL);
 497                 if (!subsec)
 498                         return -ENOMEM;
 499                 subsec->opcode = opcode;
 500                 subsec->prio = common_subsec->prio;
 501                 subsec->len  = subsec_len;
 502                 subsec->data = ptr;
 503                 btrtl_insert_ordered_subsec(subsec, btrtl_dev);
 504                 rc  += subsec_len;
 505         }
 506
 507         return rc;
 508 }
 509
 510 static int rtlbt_parse_firmware_v2(struct hci_dev *hdev,
 511                                    struct btrtl_device_info *btrtl_dev,
 512                                    unsigned char **_buf)
 513 {
 514         struct rtl_epatch_header_v2 *hdr;
 515         int rc;
 516         u8 reg_val[2];
 517         u8 key_id;
 518         u32 num_sections;
 519         struct rtl_section *section;
 520         struct rtl_subsection *entry, *tmp;
 521         u32 section_len;
 522         u32 opcode;
 523         int len = 0;
 524         int i;
 525         u8 *ptr;
 526         struct rtl_iovec iov = {
 527                 .data = btrtl_dev->fw_data,
 528                 .len  = btrtl_dev->fw_len - 7, /* Cut the tail */
 529         };
 530
 531         rc = btrtl_vendor_read_reg16(hdev, RTL_SEC_PROJ, reg_val);
 532         if (rc < 0)
 533                 return -EIO;
 534         key_id = reg_val[0];
 535
 536         rtl_dev_dbg(hdev, "%s: key id %u", __func__, key_id);
 537
 538         btrtl_dev->key_id = key_id;
 539
 540         hdr = rtl_iov_pull_data(&iov, sizeof(*hdr));
 541         if (!hdr)
 542                 return -EINVAL;
 543         num_sections = le32_to_cpu(hdr->num_sections);
 544
 545         rtl_dev_dbg(hdev, "FW version %08x-%08x", *((u32 *)hdr->fw_version),
 546                     *((u32 *)(hdr->fw_version + 4)));
 547
 548         for (i = 0; i < num_sections; i++) {
 549                 section = rtl_iov_pull_data(&iov, sizeof(*section));
 550                 if (!section)
 551                         break;
 552                 section_len = le32_to_cpu(section->len);
 553                 opcode      = le32_to_cpu(section->opcode);
 554
 555                 rtl_dev_dbg(hdev, "opcode 0x%04x", section->opcode);
 556
 557                 ptr = rtl_iov_pull_data(&iov, section_len);
 558                 if (!ptr)
 559                         break;
 560
 561                 switch (opcode) {
 562                 case RTL_PATCH_SNIPPETS:
 563                         rc = btrtl_parse_section(hdev, btrtl_dev, opcode,
 564                                                  ptr, section_len);
 565                         break;
 566                 case RTL_PATCH_SECURITY_HEADER:
 567                         /* If key_id from chip is zero, ignore all security
 568                          * headers.
 569                          */
 570                         if (!key_id)
 571                                 break;
 572                         rc = btrtl_parse_section(hdev, btrtl_dev, opcode,
 573                                                  ptr, section_len);
 574                         break;
 575                 case RTL_PATCH_DUMMY_HEADER:
 576                         rc = btrtl_parse_section(hdev, btrtl_dev, opcode,
 577                                                  ptr, section_len);
 578                         break;
 579                 default:
 580                         rc = 0;
 581                         break;
 582                 }
 583                 if (rc < 0) {
 584                         rtl_dev_err(hdev, "RTL: Parse section (%u) err %d",
 585                                     opcode, rc);
 586                         return rc;
 587                 }
 588                 len += rc;
 589         }
 590
 591         if (!len)
 592                 return -ENODATA;
 593
 594         /* Allocate mem and copy all found subsecs. */
 595         ptr = kvmalloc(len, GFP_KERNEL);
 596         if (!ptr)
 597                 return -ENOMEM;
 598
 599         len = 0;
 600         list_for_each_entry_safe(entry, tmp, &btrtl_dev->patch_subsecs, list) {
 601                 rtl_dev_dbg(hdev, "RTL: opcode %08x, addr %p, len 0x%x",
 602                             entry->opcode, entry->data, entry->len);
 603                 memcpy(ptr + len, entry->data, entry->len);
 604                 len += entry->len;
 605         }
 606
 607         if (!len)
 608                 return -EPERM;
 609
 610         *_buf = ptr;
 611         return len;
 612 }
 613
 614 static int rtlbt_parse_firmware(struct hci_dev *hdev,
 615                                 struct btrtl_device_info *btrtl_dev,
 616                                 unsigned char **_buf)
 617 {
 618         static const u8 extension_sig[] = { 0x51, 0x04, 0xfd, 0x77 };
 619         struct btrealtek_data *coredump_info = hci_get_priv(hdev);
 620         struct rtl_epatch_header *epatch_info;
 621         unsigned char *buf;
 622         int i, len;
 623         size_t min_size;
 624         u8 opcode, length, data;
 625         int project_id = -1;
 626         const unsigned char *fwptr, *chip_id_base;
 627         const unsigned char *patch_length_base, *patch_offset_base;
 628         u32 patch_offset = 0;
 629         u16 patch_length, num_patches;
 630         static const struct {
 631                 __u16 lmp_subver;
 632                 __u8 id;
 633         } project_id_to_lmp_subver[] = {
 634                 { RTL_ROM_LMP_8723A, 0 },
 635                 { RTL_ROM_LMP_8723B, 1 },
 636                 { RTL_ROM_LMP_8821A, 2 },
 637                 { RTL_ROM_LMP_8761A, 3 },
 638                 { RTL_ROM_LMP_8703B, 7 },
 639                 { RTL_ROM_LMP_8822B, 8 },
 640                 { RTL_ROM_LMP_8723B, 9 },       /* 8723D */
 641                 { RTL_ROM_LMP_8821A, 10 },      /* 8821C */
 642                 { RTL_ROM_LMP_8822B, 13 },      /* 8822C */
 643                 { RTL_ROM_LMP_8761A, 14 },      /* 8761B */
 644                 { RTL_ROM_LMP_8852A, 18 },      /* 8852A */
 645                 { RTL_ROM_LMP_8852A, 20 },      /* 8852B */
 646                 { RTL_ROM_LMP_8852A, 25 },      /* 8852C */
 647                 { RTL_ROM_LMP_8851B, 36 },      /* 8851B */
 648         };
 649
 650         if (btrtl_dev->fw_len <= 8)
 651                 return -EINVAL;
 652
 653         if (!memcmp(btrtl_dev->fw_data, RTL_EPATCH_SIGNATURE, 8))
 654                 min_size = sizeof(struct rtl_epatch_header) +
 655                                 sizeof(extension_sig) + 3;
 656         else if (!memcmp(btrtl_dev->fw_data, RTL_EPATCH_SIGNATURE_V2, 8))
 657                 min_size = sizeof(struct rtl_epatch_header_v2) +
 658                                 sizeof(extension_sig) + 3;
 659         else
 660                 return -EINVAL;
 661
 662         if (btrtl_dev->fw_len < min_size)
 663                 return -EINVAL;
 664
 665         fwptr = btrtl_dev->fw_data + btrtl_dev->fw_len - sizeof(extension_sig);
 666         if (memcmp(fwptr, extension_sig, sizeof(extension_sig)) != 0) {
 667                 rtl_dev_err(hdev, "extension section signature mismatch");
 668                 return -EINVAL;
 669         }
 670
 671         /* Loop from the end of the firmware parsing instructions, until
 672          * we find an instruction that identifies the "project ID" for the
 673          * hardware supported by this firwmare file.
 674          * Once we have that, we double-check that project_id is suitable
 675          * for the hardware we are working with.
 676          */
 677         while (fwptr >= btrtl_dev->fw_data + (sizeof(*epatch_info) + 3)) {
 678                 opcode = *--fwptr;
 679                 length = *--fwptr;
 680                 data = *--fwptr;
 681
 682                 BT_DBG("check op=%x len=%x data=%x", opcode, length, data);
 683
 684                 if (opcode == 0xff) /* EOF */
 685                         break;
 686
 687                 if (length == 0) {
 688                         rtl_dev_err(hdev, "found instruction with length 0");
 689                         return -EINVAL;
 690                 }
 691
 692                 if (opcode == 0 && length == 1) {
 693                         project_id = data;
 694                         break;
 695                 }
 696
 697                 fwptr -= length;
 698         }
 699
 700         if (project_id < 0) {
 701                 rtl_dev_err(hdev, "failed to find version instruction");
 702                 return -EINVAL;
 703         }
 704
 705         /* Find project_id in table */
 706         for (i = 0; i < ARRAY_SIZE(project_id_to_lmp_subver); i++) {
 707                 if (project_id == project_id_to_lmp_subver[i].id) {
 708                         btrtl_dev->project_id = project_id;
 709                         break;
 710                 }
 711         }
 712
 713         if (i >= ARRAY_SIZE(project_id_to_lmp_subver)) {
 714                 rtl_dev_err(hdev, "unknown project id %d", project_id);
 715                 return -EINVAL;
 716         }
 717
 718         if (btrtl_dev->ic_info->lmp_subver !=
 719                                 project_id_to_lmp_subver[i].lmp_subver) {
 720                 rtl_dev_err(hdev, "firmware is for %x but this is a %x",
 721                             project_id_to_lmp_subver[i].lmp_subver,
 722                             btrtl_dev->ic_info->lmp_subver);
 723                 return -EINVAL;
 724         }
 725
 726         if (memcmp(btrtl_dev->fw_data, RTL_EPATCH_SIGNATURE, 8) != 0) {
 727                 if (!memcmp(btrtl_dev->fw_data, RTL_EPATCH_SIGNATURE_V2, 8))
 728                         return rtlbt_parse_firmware_v2(hdev, btrtl_dev, _buf);
 729                 rtl_dev_err(hdev, "bad EPATCH signature");
 730                 return -EINVAL;
 731         }
 732
 733         epatch_info = (struct rtl_epatch_header *)btrtl_dev->fw_data;
 734         num_patches = le16_to_cpu(epatch_info->num_patches);
 735
 736         BT_DBG("fw_version=%x, num_patches=%d",
 737                le32_to_cpu(epatch_info->fw_version), num_patches);
 738         coredump_info->rtl_dump.fw_version = le32_to_cpu(epatch_info->fw_version);
 739
 740         /* After the rtl_epatch_header there is a funky patch metadata section.
 741          * Assuming 2 patches, the layout is:
 742          * ChipID1 ChipID2 PatchLength1 PatchLength2 PatchOffset1 PatchOffset2
 743          *
 744          * Find the right patch for this chip.
 745          */
 746         min_size += 8 * num_patches;
 747         if (btrtl_dev->fw_len < min_size)
 748                 return -EINVAL;
 749
 750         chip_id_base = btrtl_dev->fw_data + sizeof(struct rtl_epatch_header);
 751         patch_length_base = chip_id_base + (sizeof(u16) * num_patches);
 752         patch_offset_base = patch_length_base + (sizeof(u16) * num_patches);
 753         for (i = 0; i < num_patches; i++) {
 754                 u16 chip_id = get_unaligned_le16(chip_id_base +
 755                                                  (i * sizeof(u16)));
 756                 if (chip_id == btrtl_dev->rom_version + 1) {
 757                         patch_length = get_unaligned_le16(patch_length_base +
 758                                                           (i * sizeof(u16)));
 759                         patch_offset = get_unaligned_le32(patch_offset_base +
 760                                                           (i * sizeof(u32)));
 761                         break;
 762                 }
 763         }
 764
 765         if (!patch_offset) {
 766                 rtl_dev_err(hdev, "didn't find patch for chip id %d",
 767                             btrtl_dev->rom_version);
 768                 return -EINVAL;
 769         }
 770
 771         BT_DBG("length=%x offset=%x index %d", patch_length, patch_offset, i);
 772         min_size = patch_offset + patch_length;
 773         if (btrtl_dev->fw_len < min_size)
 774                 return -EINVAL;
 775
 776         /* Copy the firmware into a new buffer and write the version at
 777          * the end.
 778          */
 779         len = patch_length;
 780         buf = kvmalloc(patch_length, GFP_KERNEL);
 781         if (!buf)
 782                 return -ENOMEM;
 783
 784         memcpy(buf, btrtl_dev->fw_data + patch_offset, patch_length - 4);
 785         memcpy(buf + patch_length - 4, &epatch_info->fw_version, 4);
 786
 787         *_buf = buf;
 788         return len;
 789 }
 790
 791 static int rtl_download_firmware(struct hci_dev *hdev,
 792                                  const unsigned char *data, int fw_len)
 793 {
 794         struct rtl_download_cmd *dl_cmd;
 795         int frag_num = fw_len / RTL_FRAG_LEN + 1;
 796         int frag_len = RTL_FRAG_LEN;
 797         int ret = 0;
 798         int i;
 799         int j = 0;
 800         struct sk_buff *skb;
 801         struct hci_rp_read_local_version *rp;
 802
 803         dl_cmd = kmalloc(sizeof(struct rtl_download_cmd), GFP_KERNEL);
 804         if (!dl_cmd)
 805                 return -ENOMEM;
 806
 807         for (i = 0; i < frag_num; i++) {
 808                 struct sk_buff *skb;
 809
 810                 dl_cmd->index = j++;
 811                 if (dl_cmd->index == 0x7f)
 812                         j = 1;
 813
 814                 if (i == (frag_num - 1)) {
 815                         dl_cmd->index |= 0x80; /* data end */
 816                         frag_len = fw_len % RTL_FRAG_LEN;
 817                 }
 818                 rtl_dev_dbg(hdev, "download fw (%d/%d). index = %d", i,
 819                                 frag_num, dl_cmd->index);
 820                 memcpy(dl_cmd->data, data, frag_len);
 821
 822                 /* Send download command */
 823                 skb = __hci_cmd_sync(hdev, 0xfc20, frag_len + 1, dl_cmd,
 824                                      HCI_INIT_TIMEOUT);
 825                 if (IS_ERR(skb)) {
 826                         rtl_dev_err(hdev, "download fw command failed (%ld)",
 827                                     PTR_ERR(skb));
 828                         ret = PTR_ERR(skb);
 829                         goto out;
 830                 }
 831
 832                 if (skb->len != sizeof(struct rtl_download_response)) {
 833                         rtl_dev_err(hdev, "download fw event length mismatch");
 834                         kfree_skb(skb);
 835                         ret = -EIO;
 836                         goto out;
 837                 }
 838
 839                 kfree_skb(skb);
 840                 data += RTL_FRAG_LEN;
 841         }
 842
 843         skb = btrtl_read_local_version(hdev);
 844         if (IS_ERR(skb)) {
 845                 ret = PTR_ERR(skb);
 846                 rtl_dev_err(hdev, "read local version failed");
 847                 goto out;
 848         }
 849
 850         rp = (struct hci_rp_read_local_version *)skb->data;
 851         rtl_dev_info(hdev, "fw version 0x%04x%04x",
 852                      __le16_to_cpu(rp->hci_rev), __le16_to_cpu(rp->lmp_subver));
 853         kfree_skb(skb);
 854
 855 out:
 856         kfree(dl_cmd);
 857         return ret;
 858 }
 859
 860 static int rtl_load_file(struct hci_dev *hdev, const char *name, u8 **buff)
 861 {
 862         const struct firmware *fw;
 863         int ret;
 864
 865         rtl_dev_info(hdev, "loading %s", name);
 866         ret = request_firmware(&fw, name, &hdev->dev);
 867         if (ret < 0)
 868                 return ret;
 869         ret = fw->size;
 870         *buff = kvmalloc(fw->size, GFP_KERNEL);
 871         if (*buff)
 872                 memcpy(*buff, fw->data, ret);
 873         else
 874                 ret = -ENOMEM;
 875
 876         release_firmware(fw);
 877
 878         return ret;
 879 }
 880
 881 static int btrtl_setup_rtl8723a(struct hci_dev *hdev,
 882                                 struct btrtl_device_info *btrtl_dev)
 883 {
 884         if (btrtl_dev->fw_len < 8)
 885                 return -EINVAL;
 886
 887         /* Check that the firmware doesn't have the epatch signature
 888          * (which is only for RTL8723B and newer).
 889          */
 890         if (!memcmp(btrtl_dev->fw_data, RTL_EPATCH_SIGNATURE, 8)) {
 891                 rtl_dev_err(hdev, "unexpected EPATCH signature!");
 892                 return -EINVAL;
 893         }
 894
 895         return rtl_download_firmware(hdev, btrtl_dev->fw_data,
 896                                      btrtl_dev->fw_len);
 897 }
 898
 899 static int btrtl_setup_rtl8723b(struct hci_dev *hdev,
 900                                 struct btrtl_device_info *btrtl_dev)
 901 {
 902         unsigned char *fw_data = NULL;
 903         int ret;
 904         u8 *tbuff;
 905
 906         ret = rtlbt_parse_firmware(hdev, btrtl_dev, &fw_data);
 907         if (ret < 0)
 908                 goto out;
 909
 910         if (btrtl_dev->cfg_len > 0) {
 911                 tbuff = kvzalloc(ret + btrtl_dev->cfg_len, GFP_KERNEL);
 912                 if (!tbuff) {
 913                         ret = -ENOMEM;
 914                         goto out;
 915                 }
 916
 917                 memcpy(tbuff, fw_data, ret);
 918                 kvfree(fw_data);
 919
 920                 memcpy(tbuff + ret, btrtl_dev->cfg_data, btrtl_dev->cfg_len);
 921                 ret += btrtl_dev->cfg_len;
 922
 923                 fw_data = tbuff;
 924         }
 925
 926         rtl_dev_info(hdev, "cfg_sz %d, total sz %d", btrtl_dev->cfg_len, ret);
 927
 928         ret = rtl_download_firmware(hdev, fw_data, ret);
 929
 930 out:
 931         kvfree(fw_data);
 932         return ret;
 933 }
 934
 935 static void btrtl_coredump(struct hci_dev *hdev)
 936 {
 937         static const u8 param[] = { 0x00, 0x00 };
 938
 939         __hci_cmd_send(hdev, RTL_VSC_OP_COREDUMP, sizeof(param), param);
 940 }
 941
 942 static void btrtl_dmp_hdr(struct hci_dev *hdev, struct sk_buff *skb)
 943 {
 944         struct btrealtek_data *coredump_info = hci_get_priv(hdev);
 945         char buf[80];
 946
 947         if (coredump_info->rtl_dump.controller)
 948                 snprintf(buf, sizeof(buf), "Controller Name: %s\n",
 949                          coredump_info->rtl_dump.controller);
 950         else
 951                 snprintf(buf, sizeof(buf), "Controller Name: Unknown\n");
 952         skb_put_data(skb, buf, strlen(buf));
 953
 954         snprintf(buf, sizeof(buf), "Firmware Version: 0x%X\n",
 955                  coredump_info->rtl_dump.fw_version);
 956         skb_put_data(skb, buf, strlen(buf));
 957
 958         snprintf(buf, sizeof(buf), "Driver: %s\n", coredump_info->rtl_dump.driver_name);
 959         skb_put_data(skb, buf, strlen(buf));
 960
 961         snprintf(buf, sizeof(buf), "Vendor: Realtek\n");
 962         skb_put_data(skb, buf, strlen(buf));
 963 }
 964
 965 static void btrtl_register_devcoredump_support(struct hci_dev *hdev)
 966 {
 967         hci_devcd_register(hdev, btrtl_coredump, btrtl_dmp_hdr, NULL);
 968
 969 }
 970
 971 void btrtl_set_driver_name(struct hci_dev *hdev, const char *driver_name)
 972 {
 973         struct btrealtek_data *coredump_info = hci_get_priv(hdev);
 974
 975         coredump_info->rtl_dump.driver_name = driver_name;
 976 }
 977 EXPORT_SYMBOL_GPL(btrtl_set_driver_name);
 978
 979 static bool rtl_has_chip_type(u16 lmp_subver)
 980 {
 981         switch (lmp_subver) {
 982         case RTL_ROM_LMP_8703B:
 983                 return true;
 984         default:
 985                 break;
 986         }
 987
 988         return  false;
 989 }
 990
 991 static int rtl_read_chip_type(struct hci_dev *hdev, u8 *type)
 992 {
 993         struct rtl_chip_type_evt *chip_type;
 994         struct sk_buff *skb;
 995         const unsigned char cmd_buf[] = {0x00, 0x94, 0xa0, 0x00, 0xb0};
 996
 997         /* Read RTL chip type command */
 998         skb = __hci_cmd_sync(hdev, 0xfc61, 5, cmd_buf, HCI_INIT_TIMEOUT);
 999         if (IS_ERR(skb)) {
1000                 rtl_dev_err(hdev, "Read chip type failed (%ld)",
1001                             PTR_ERR(skb));
1002                 return PTR_ERR(skb);
1003         }
1004
1005         chip_type = skb_pull_data(skb, sizeof(*chip_type));
1006         if (!chip_type) {
1007                 rtl_dev_err(hdev, "RTL chip type event length mismatch");
1008                 kfree_skb(skb);
1009                 return -EIO;
1010         }
1011
1012         rtl_dev_info(hdev, "chip_type status=%x type=%x",
1013                      chip_type->status, chip_type->type);
1014
1015         *type = chip_type->type & 0x0f;
1016
1017         kfree_skb(skb);
1018         return 0;
1019 }
1020
1021 void btrtl_free(struct btrtl_device_info *btrtl_dev)
1022 {
1023         struct rtl_subsection *entry, *tmp;
1024
1025         kvfree(btrtl_dev->fw_data);
1026         kvfree(btrtl_dev->cfg_data);
1027
1028         list_for_each_entry_safe(entry, tmp, &btrtl_dev->patch_subsecs, list) {
1029                 list_del(&entry->list);
1030                 kfree(entry);
1031         }
1032
1033         kfree(btrtl_dev);
1034 }
1035 EXPORT_SYMBOL_GPL(btrtl_free);
1036
1037 struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev,
1038                                            const char *postfix)
1039 {
1040         struct btrealtek_data *coredump_info = hci_get_priv(hdev);
1041         struct btrtl_device_info *btrtl_dev;
1042         struct sk_buff *skb;
1043         struct hci_rp_read_local_version *resp;
1044         struct hci_command_hdr *cmd;
1045         char fw_name[40];
1046         char cfg_name[40];
1047         u16 hci_rev, lmp_subver;
1048         u8 hci_ver, lmp_ver, chip_type = 0;
1049         int ret;
1050         u8 reg_val[2];
1051
1052         btrtl_dev = kzalloc(sizeof(*btrtl_dev), GFP_KERNEL);
1053         if (!btrtl_dev) {
1054                 ret = -ENOMEM;
1055                 goto err_alloc;
1056         }
1057
1058         INIT_LIST_HEAD(&btrtl_dev->patch_subsecs);
1059
1060 check_version:
1061         ret = btrtl_vendor_read_reg16(hdev, RTL_CHIP_SUBVER, reg_val);
1062         if (ret < 0)
1063                 goto err_free;
1064         lmp_subver = get_unaligned_le16(reg_val);
1065
1066         if (lmp_subver == RTL_ROM_LMP_8822B) {
1067                 ret = btrtl_vendor_read_reg16(hdev, RTL_CHIP_REV, reg_val);
1068                 if (ret < 0)
1069                         goto err_free;
1070                 hci_rev = get_unaligned_le16(reg_val);
1071
1072                 /* 8822E */
1073                 if (hci_rev == 0x000e) {
1074                         hci_ver = 0x0c;
1075                         lmp_ver = 0x0c;
1076                         btrtl_dev->ic_info = btrtl_match_ic(lmp_subver, hci_rev,
1077                                                             hci_ver, hdev->bus,
1078                                                             chip_type);
1079                         goto next;
1080                 }
1081         }
1082
1083         skb = btrtl_read_local_version(hdev);
1084         if (IS_ERR(skb)) {
1085                 ret = PTR_ERR(skb);
1086                 goto err_free;
1087         }
1088
1089         resp = (struct hci_rp_read_local_version *)skb->data;
1090
1091         hci_ver    = resp->hci_ver;
1092         hci_rev    = le16_to_cpu(resp->hci_rev);
1093         lmp_ver    = resp->lmp_ver;
1094         lmp_subver = le16_to_cpu(resp->lmp_subver);
1095
1096         kfree_skb(skb);
1097
1098         if (rtl_has_chip_type(lmp_subver)) {
1099                 ret = rtl_read_chip_type(hdev, &chip_type);
1100                 if (ret)
1101                         goto err_free;
1102         }
1103
1104         btrtl_dev->ic_info = btrtl_match_ic(lmp_subver, hci_rev, hci_ver,
1105                                             hdev->bus, chip_type);
1106
1107 next:
1108         rtl_dev_info(hdev, "examining hci_ver=%02x hci_rev=%04x lmp_ver=%02x lmp_subver=%04x",
1109                      hci_ver, hci_rev,
1110                      lmp_ver, lmp_subver);
1111
1112         if (!btrtl_dev->ic_info && !btrtl_dev->drop_fw)
1113                 btrtl_dev->drop_fw = true;
1114         else
1115                 btrtl_dev->drop_fw = false;
1116
1117         if (btrtl_dev->drop_fw) {
1118                 skb = bt_skb_alloc(sizeof(*cmd), GFP_KERNEL);
1119                 if (!skb)
1120                         goto err_free;
1121
1122                 cmd = skb_put(skb, HCI_COMMAND_HDR_SIZE);
1123                 cmd->opcode = cpu_to_le16(0xfc66);
1124                 cmd->plen = 0;
1125
1126                 hci_skb_pkt_type(skb) = HCI_COMMAND_PKT;
1127
1128                 ret = hdev->send(hdev, skb);
1129                 if (ret < 0) {
1130                         bt_dev_err(hdev, "sending frame failed (%d)", ret);
1131                         kfree_skb(skb);
1132                         goto err_free;
1133                 }
1134
1135                 /* Ensure the above vendor command is sent to controller and
1136                  * process has done.
1137                  */
1138                 msleep(200);
1139
1140                 goto check_version;
1141         }
1142
1143         if (!btrtl_dev->ic_info) {
1144                 rtl_dev_info(hdev, "unknown IC info, lmp subver %04x, hci rev %04x, hci ver %04x",
1145                             lmp_subver, hci_rev, hci_ver);
1146                 return btrtl_dev;
1147         }
1148
1149         if (btrtl_dev->ic_info->has_rom_version) {
1150                 ret = rtl_read_rom_version(hdev, &btrtl_dev->rom_version);
1151                 if (ret)
1152                         goto err_free;
1153         }
1154
1155         if (!btrtl_dev->ic_info->fw_name) {
1156                 ret = -ENOMEM;
1157                 goto err_free;
1158         }
1159
1160         btrtl_dev->fw_len = -EIO;
1161         if (lmp_subver == RTL_ROM_LMP_8852A && hci_rev == 0x000c) {
1162                 snprintf(fw_name, sizeof(fw_name), "%s_v2.bin",
1163                                 btrtl_dev->ic_info->fw_name);
1164                 btrtl_dev->fw_len = rtl_load_file(hdev, fw_name,
1165                                 &btrtl_dev->fw_data);
1166         }
1167
1168         if (btrtl_dev->fw_len < 0) {
1169                 snprintf(fw_name, sizeof(fw_name), "%s.bin",
1170                                 btrtl_dev->ic_info->fw_name);
1171                 btrtl_dev->fw_len = rtl_load_file(hdev, fw_name,
1172                                 &btrtl_dev->fw_data);
1173         }
1174
1175         if (btrtl_dev->fw_len < 0) {
1176                 rtl_dev_err(hdev, "firmware file %s not found",
1177                             btrtl_dev->ic_info->fw_name);
1178                 ret = btrtl_dev->fw_len;
1179                 goto err_free;
1180         }
1181
1182         if (btrtl_dev->ic_info->cfg_name) {
1183                 if (postfix) {
1184                         snprintf(cfg_name, sizeof(cfg_name), "%s-%s.bin",
1185                                  btrtl_dev->ic_info->cfg_name, postfix);
1186                 } else {
1187                         snprintf(cfg_name, sizeof(cfg_name), "%s.bin",
1188                                  btrtl_dev->ic_info->cfg_name);
1189                 }
1190                 btrtl_dev->cfg_len = rtl_load_file(hdev, cfg_name,
1191                                                    &btrtl_dev->cfg_data);
1192                 if (btrtl_dev->ic_info->config_needed &&
1193                     btrtl_dev->cfg_len <= 0) {
1194                         rtl_dev_err(hdev, "mandatory config file %s not found",
1195                                     btrtl_dev->ic_info->cfg_name);
1196                         ret = btrtl_dev->cfg_len;
1197                         goto err_free;
1198                 }
1199         }
1200
1201         /* The following chips supports the Microsoft vendor extension,
1202          * therefore set the corresponding VsMsftOpCode.
1203          */
1204         if (btrtl_dev->ic_info->has_msft_ext)
1205                 hci_set_msft_opcode(hdev, 0xFCF0);
1206
1207         if (btrtl_dev->ic_info)
1208                 coredump_info->rtl_dump.controller = btrtl_dev->ic_info->hw_info;
1209
1210         return btrtl_dev;
1211
1212 err_free:
1213         btrtl_free(btrtl_dev);
1214 err_alloc:
1215         return ERR_PTR(ret);
1216 }
1217 EXPORT_SYMBOL_GPL(btrtl_initialize);
1218
1219 int btrtl_download_firmware(struct hci_dev *hdev,
1220                             struct btrtl_device_info *btrtl_dev)
1221 {
1222         int err = 0;
1223
1224         /* Match a set of subver values that correspond to stock firmware,
1225          * which is not compatible with standard btusb.
1226          * If matched, upload an alternative firmware that does conform to
1227          * standard btusb. Once that firmware is uploaded, the subver changes
1228          * to a different value.
1229          */
1230         if (!btrtl_dev->ic_info) {
1231                 rtl_dev_info(hdev, "assuming no firmware upload needed");
1232                 err = 0;
1233                 goto done;
1234         }
1235
1236         switch (btrtl_dev->ic_info->lmp_subver) {
1237         case RTL_ROM_LMP_8723A:
1238                 err = btrtl_setup_rtl8723a(hdev, btrtl_dev);
1239                 break;
1240         case RTL_ROM_LMP_8723B:
1241         case RTL_ROM_LMP_8821A:
1242         case RTL_ROM_LMP_8761A:
1243         case RTL_ROM_LMP_8822B:
1244         case RTL_ROM_LMP_8852A:
1245         case RTL_ROM_LMP_8703B:
1246         case RTL_ROM_LMP_8851B:
1247                 err = btrtl_setup_rtl8723b(hdev, btrtl_dev);
1248                 break;
1249         default:
1250                 rtl_dev_info(hdev, "assuming no firmware upload needed");
1251                 break;
1252         }
1253
1254 done:
1255         btrtl_register_devcoredump_support(hdev);
1256
1257         return err;
1258 }
1259 EXPORT_SYMBOL_GPL(btrtl_download_firmware);
1260
1261 void btrtl_set_quirks(struct hci_dev *hdev, struct btrtl_device_info *btrtl_dev)
1262 {
1263         /* Enable controller to do both LE scan and BR/EDR inquiry
1264          * simultaneously.
1265          */
1266         set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
1267
1268         /* Enable central-peripheral role (able to create new connections with
1269          * an existing connection in slave role).
1270          */
1271         /* Enable WBS supported for the specific Realtek devices. */
1272         switch (btrtl_dev->project_id) {
1273         case CHIP_ID_8822C:
1274         case CHIP_ID_8852A:
1275         case CHIP_ID_8852B:
1276         case CHIP_ID_8852C:
1277         case CHIP_ID_8851B:
1278                 set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks);
1279                 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks);
1280
1281                 /* RTL8852C needs to transmit mSBC data continuously without
1282                  * the zero length of USB packets for the ALT 6 supported chips
1283                  */
1284                 if (btrtl_dev->project_id == CHIP_ID_8852C)
1285                         btrealtek_set_flag(hdev, REALTEK_ALT6_CONTINUOUS_TX_CHIP);
1286
1287                 if (btrtl_dev->project_id == CHIP_ID_8852A ||
1288                     btrtl_dev->project_id == CHIP_ID_8852C)
1289                         set_bit(HCI_QUIRK_USE_MSFT_EXT_ADDRESS_FILTER, &hdev->quirks);
1290
1291                 hci_set_aosp_capable(hdev);
1292                 break;
1293         default:
1294                 rtl_dev_dbg(hdev, "Central-peripheral role not enabled.");
1295                 rtl_dev_dbg(hdev, "WBS supported not enabled.");
1296                 break;
1297         }
1298
1299         if (!btrtl_dev->ic_info)
1300                 return;
1301
1302         switch (btrtl_dev->ic_info->lmp_subver) {
1303         case RTL_ROM_LMP_8703B:
1304                 /* 8723CS reports two pages for local ext features,
1305                  * but it doesn't support any features from page 2 -
1306                  * it either responds with garbage or with error status
1307                  */
1308                 set_bit(HCI_QUIRK_BROKEN_LOCAL_EXT_FEATURES_PAGE_2,
1309                         &hdev->quirks);
1310                 break;
1311         default:
1312                 break;
1313         }
1314 }
1315 EXPORT_SYMBOL_GPL(btrtl_set_quirks);
1316
1317 int btrtl_setup_realtek(struct hci_dev *hdev)
1318 {
1319         struct btrtl_device_info *btrtl_dev;
1320         int ret;
1321
1322         btrtl_dev = btrtl_initialize(hdev, NULL);
1323         if (IS_ERR(btrtl_dev))
1324                 return PTR_ERR(btrtl_dev);
1325
1326         ret = btrtl_download_firmware(hdev, btrtl_dev);
1327
1328         btrtl_set_quirks(hdev, btrtl_dev);
1329
1330         btrtl_free(btrtl_dev);
1331         return ret;
1332 }
1333 EXPORT_SYMBOL_GPL(btrtl_setup_realtek);
1334
1335 int btrtl_shutdown_realtek(struct hci_dev *hdev)
1336 {
1337         struct sk_buff *skb;
1338         int ret;
1339
1340         /* According to the vendor driver, BT must be reset on close to avoid
1341          * firmware crash.
1342          */
1343         skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
1344         if (IS_ERR(skb)) {
1345                 ret = PTR_ERR(skb);
1346                 bt_dev_err(hdev, "HCI reset during shutdown failed");
1347                 return ret;
1348         }
1349         kfree_skb(skb);
1350
1351         return 0;
1352 }
1353 EXPORT_SYMBOL_GPL(btrtl_shutdown_realtek);
1354
1355 static unsigned int btrtl_convert_baudrate(u32 device_baudrate)
1356 {
1357         switch (device_baudrate) {
1358         case 0x0252a00a:
1359                 return 230400;
1360
1361         case 0x05f75004:
1362                 return 921600;
1363
1364         case 0x00005004:
1365                 return 1000000;
1366
1367         case 0x04928002:
1368         case 0x01128002:
1369                 return 1500000;
1370
1371         case 0x00005002:
1372                 return 2000000;
1373
1374         case 0x0000b001:
1375                 return 2500000;
1376
1377         case 0x04928001:
1378                 return 3000000;
1379
1380         case 0x052a6001:
1381                 return 3500000;
1382
1383         case 0x00005001:
1384                 return 4000000;
1385
1386         case 0x0252c014:
1387         default:
1388                 return 115200;
1389         }
1390 }
1391
1392 int btrtl_get_uart_settings(struct hci_dev *hdev,
1393                             struct btrtl_device_info *btrtl_dev,
1394                             unsigned int *controller_baudrate,
1395                             u32 *device_baudrate, bool *flow_control)
1396 {
1397         struct rtl_vendor_config *config;
1398         struct rtl_vendor_config_entry *entry;
1399         int i, total_data_len;
1400         bool found = false;
1401
1402         total_data_len = btrtl_dev->cfg_len - sizeof(*config);
1403         if (total_data_len <= 0) {
1404                 rtl_dev_warn(hdev, "no config loaded");
1405                 return -EINVAL;
1406         }
1407
1408         config = (struct rtl_vendor_config *)btrtl_dev->cfg_data;
1409         if (le32_to_cpu(config->signature) != RTL_CONFIG_MAGIC) {
1410                 rtl_dev_err(hdev, "invalid config magic");
1411                 return -EINVAL;
1412         }
1413
1414         if (total_data_len < le16_to_cpu(config->total_len)) {
1415                 rtl_dev_err(hdev, "config is too short");
1416                 return -EINVAL;
1417         }
1418
1419         for (i = 0; i < total_data_len; ) {
1420                 entry = ((void *)config->entry) + i;
1421
1422                 switch (le16_to_cpu(entry->offset)) {
1423                 case 0xc:
1424                         if (entry->len < sizeof(*device_baudrate)) {
1425                                 rtl_dev_err(hdev, "invalid UART config entry");
1426                                 return -EINVAL;
1427                         }
1428
1429                         *device_baudrate = get_unaligned_le32(entry->data);
1430                         *controller_baudrate = btrtl_convert_baudrate(
1431                                                         *device_baudrate);
1432
1433                         if (entry->len >= 13)
1434                                 *flow_control = !!(entry->data[12] & BIT(2));
1435                         else
1436                                 *flow_control = false;
1437
1438                         found = true;
1439                         break;
1440
1441                 default:
1442                         rtl_dev_dbg(hdev, "skipping config entry 0x%x (len %u)",
1443                                    le16_to_cpu(entry->offset), entry->len);
1444                         break;
1445                 }
1446
1447                 i += sizeof(*entry) + entry->len;
1448         }
1449
1450         if (!found) {
1451                 rtl_dev_err(hdev, "no UART config entry found");
1452                 return -ENOENT;
1453         }
1454
1455         rtl_dev_dbg(hdev, "device baudrate = 0x%08x", *device_baudrate);
1456         rtl_dev_dbg(hdev, "controller baudrate = %u", *controller_baudrate);
1457         rtl_dev_dbg(hdev, "flow control %d", *flow_control);
1458
1459         return 0;
1460 }
1461 EXPORT_SYMBOL_GPL(btrtl_get_uart_settings);
1462
1463 MODULE_AUTHOR("Daniel Drake <drake@endlessm.com>");
1464 MODULE_DESCRIPTION("Bluetooth support for Realtek devices ver " VERSION);
1465 MODULE_VERSION(VERSION);
1466 MODULE_LICENSE("GPL");
1467 MODULE_FIRMWARE("rtl_bt/rtl8723a_fw.bin");
1468 MODULE_FIRMWARE("rtl_bt/rtl8723b_fw.bin");
1469 MODULE_FIRMWARE("rtl_bt/rtl8723b_config.bin");
1470 MODULE_FIRMWARE("rtl_bt/rtl8723bs_fw.bin");
1471 MODULE_FIRMWARE("rtl_bt/rtl8723bs_config.bin");
1472 MODULE_FIRMWARE("rtl_bt/rtl8723cs_cg_fw.bin");
1473 MODULE_FIRMWARE("rtl_bt/rtl8723cs_cg_config.bin");
1474 MODULE_FIRMWARE("rtl_bt/rtl8723cs_vf_fw.bin");
1475 MODULE_FIRMWARE("rtl_bt/rtl8723cs_vf_config.bin");
1476 MODULE_FIRMWARE("rtl_bt/rtl8723cs_xx_fw.bin");
1477 MODULE_FIRMWARE("rtl_bt/rtl8723cs_xx_config.bin");
1478 MODULE_FIRMWARE("rtl_bt/rtl8723d_fw.bin");
1479 MODULE_FIRMWARE("rtl_bt/rtl8723d_config.bin");
1480 MODULE_FIRMWARE("rtl_bt/rtl8723ds_fw.bin");
1481 MODULE_FIRMWARE("rtl_bt/rtl8723ds_config.bin");
1482 MODULE_FIRMWARE("rtl_bt/rtl8761a_fw.bin");
1483 MODULE_FIRMWARE("rtl_bt/rtl8761a_config.bin");
1484 MODULE_FIRMWARE("rtl_bt/rtl8761b_fw.bin");
1485 MODULE_FIRMWARE("rtl_bt/rtl8761b_config.bin");
1486 MODULE_FIRMWARE("rtl_bt/rtl8761bu_fw.bin");
1487 MODULE_FIRMWARE("rtl_bt/rtl8761bu_config.bin");
1488 MODULE_FIRMWARE("rtl_bt/rtl8821a_fw.bin");
1489 MODULE_FIRMWARE("rtl_bt/rtl8821a_config.bin");
1490 MODULE_FIRMWARE("rtl_bt/rtl8821c_fw.bin");
1491 MODULE_FIRMWARE("rtl_bt/rtl8821c_config.bin");
1492 MODULE_FIRMWARE("rtl_bt/rtl8821cs_fw.bin");
1493 MODULE_FIRMWARE("rtl_bt/rtl8821cs_config.bin");
1494 MODULE_FIRMWARE("rtl_bt/rtl8822b_fw.bin");
1495 MODULE_FIRMWARE("rtl_bt/rtl8822b_config.bin");
1496 MODULE_FIRMWARE("rtl_bt/rtl8822cs_fw.bin");
1497 MODULE_FIRMWARE("rtl_bt/rtl8822cs_config.bin");
1498 MODULE_FIRMWARE("rtl_bt/rtl8822cu_fw.bin");
1499 MODULE_FIRMWARE("rtl_bt/rtl8822cu_config.bin");
1500 MODULE_FIRMWARE("rtl_bt/rtl8851bu_fw.bin");
1501 MODULE_FIRMWARE("rtl_bt/rtl8851bu_config.bin");
1502 MODULE_FIRMWARE("rtl_bt/rtl8852au_fw.bin");
1503 MODULE_FIRMWARE("rtl_bt/rtl8852au_config.bin");
1504 MODULE_FIRMWARE("rtl_bt/rtl8852bs_fw.bin");
1505 MODULE_FIRMWARE("rtl_bt/rtl8852bs_config.bin");
1506 MODULE_FIRMWARE("rtl_bt/rtl8852bu_fw.bin");
1507 MODULE_FIRMWARE("rtl_bt/rtl8852bu_config.bin");
1508 MODULE_FIRMWARE("rtl_bt/rtl8852cu_fw.bin");
1509 MODULE_FIRMWARE("rtl_bt/rtl8852cu_fw_v2.bin");
1510 MODULE_FIRMWARE("rtl_bt/rtl8852cu_config.bin");