1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Bluetooth support for Realtek devices 4 * 5 * Copyright (C) 2015 Endless Mobile, Inc. 6 */ 7 8 #include <linux/module.h> 9 #include <linux/firmware.h> 10 #include <asm/unaligned.h> 11 #include <linux/usb.h> 12 13 #include <net/bluetooth/bluetooth.h> 14 #include <net/bluetooth/hci_core.h> 15 16 #include "btrtl.h" 17 18 #define VERSION "0.1" 19 20 #define RTL_CHIP_8723CS_CG 3 21 #define RTL_CHIP_8723CS_VF 4 22 #define RTL_CHIP_8723CS_XX 5 23 #define RTL_EPATCH_SIGNATURE "Realtech" 24 #define RTL_EPATCH_SIGNATURE_V2 "RTBTCore" 25 #define RTL_ROM_LMP_8703B 0x8703 26 #define RTL_ROM_LMP_8723A 0x1200 27 #define RTL_ROM_LMP_8723B 0x8723 28 #define RTL_ROM_LMP_8821A 0x8821 29 #define RTL_ROM_LMP_8761A 0x8761 30 #define RTL_ROM_LMP_8822B 0x8822 31 #define RTL_ROM_LMP_8852A 0x8852 32 #define RTL_CONFIG_MAGIC 0x8723ab55 33 34 #define IC_MATCH_FL_LMPSUBV (1 << 0) 35 #define IC_MATCH_FL_HCIREV (1 << 1) 36 #define IC_MATCH_FL_HCIVER (1 << 2) 37 #define IC_MATCH_FL_HCIBUS (1 << 3) 38 #define IC_MATCH_FL_CHIP_TYPE (1 << 4) 39 #define IC_INFO(lmps, hcir, hciv, bus) \ 40 .match_flags = IC_MATCH_FL_LMPSUBV | IC_MATCH_FL_HCIREV | \ 41 IC_MATCH_FL_HCIVER | IC_MATCH_FL_HCIBUS, \ 42 .lmp_subver = (lmps), \ 43 .hci_rev = (hcir), \ 44 .hci_ver = (hciv), \ 45 .hci_bus = (bus) 46 47 #define RTL_CHIP_SUBVER (&(struct rtl_vendor_cmd) {{0x10, 0x38, 0x04, 0x28, 0x80}}) 48 #define RTL_CHIP_REV (&(struct rtl_vendor_cmd) {{0x10, 0x3A, 0x04, 0x28, 0x80}}) 49 #define RTL_SEC_PROJ (&(struct rtl_vendor_cmd) {{0x10, 0xA4, 0x0D, 0x00, 0xb0}}) 50 51 #define RTL_PATCH_SNIPPETS 0x01 52 #define RTL_PATCH_DUMMY_HEADER 0x02 53 #define RTL_PATCH_SECURITY_HEADER 0x03 54 55 enum btrtl_chip_id { 56 CHIP_ID_8723A, 57 CHIP_ID_8723B, 58 CHIP_ID_8821A, 59 CHIP_ID_8761A, 60 CHIP_ID_8822B = 8, 61 CHIP_ID_8723D, 62 CHIP_ID_8821C, 63 CHIP_ID_8822C = 13, 64 CHIP_ID_8761B, 65 CHIP_ID_8852A = 18, 66 CHIP_ID_8852B = 20, 67 CHIP_ID_8852C = 25, 68 }; 69 70 struct id_table { 71 __u16 match_flags; 72 __u16 lmp_subver; 73 __u16 hci_rev; 74 __u8 hci_ver; 75 __u8 hci_bus; 76 __u8 chip_type; 77 bool config_needed; 78 bool has_rom_version; 79 bool has_msft_ext; 80 char *fw_name; 81 char *cfg_name; 82 }; 83 84 struct btrtl_device_info { 85 const struct id_table *ic_info; 86 u8 rom_version; 87 u8 *fw_data; 88 int fw_len; 89 u8 *cfg_data; 90 int cfg_len; 91 bool drop_fw; 92 int project_id; 93 u8 key_id; 94 struct list_head patch_subsecs; 95 }; 96 97 static const struct id_table ic_id_table[] = { 98 /* 8723A */ 99 { IC_INFO(RTL_ROM_LMP_8723A, 0xb, 0x6, HCI_USB), 100 .config_needed = false, 101 .has_rom_version = false, 102 .fw_name = "rtl_bt/rtl8723a_fw.bin", 103 .cfg_name = NULL }, 104 105 /* 8723BS */ 106 { IC_INFO(RTL_ROM_LMP_8723B, 0xb, 0x6, HCI_UART), 107 .config_needed = true, 108 .has_rom_version = true, 109 .fw_name = "rtl_bt/rtl8723bs_fw.bin", 110 .cfg_name = "rtl_bt/rtl8723bs_config" }, 111 112 /* 8723B */ 113 { IC_INFO(RTL_ROM_LMP_8723B, 0xb, 0x6, HCI_USB), 114 .config_needed = false, 115 .has_rom_version = true, 116 .fw_name = "rtl_bt/rtl8723b_fw.bin", 117 .cfg_name = "rtl_bt/rtl8723b_config" }, 118 119 /* 8723CS-CG */ 120 { .match_flags = IC_MATCH_FL_LMPSUBV | IC_MATCH_FL_CHIP_TYPE | 121 IC_MATCH_FL_HCIBUS, 122 .lmp_subver = RTL_ROM_LMP_8703B, 123 .chip_type = RTL_CHIP_8723CS_CG, 124 .hci_bus = HCI_UART, 125 .config_needed = true, 126 .has_rom_version = true, 127 .fw_name = "rtl_bt/rtl8723cs_cg_fw.bin", 128 .cfg_name = "rtl_bt/rtl8723cs_cg_config" }, 129 130 /* 8723CS-VF */ 131 { .match_flags = IC_MATCH_FL_LMPSUBV | IC_MATCH_FL_CHIP_TYPE | 132 IC_MATCH_FL_HCIBUS, 133 .lmp_subver = RTL_ROM_LMP_8703B, 134 .chip_type = RTL_CHIP_8723CS_VF, 135 .hci_bus = HCI_UART, 136 .config_needed = true, 137 .has_rom_version = true, 138 .fw_name = "rtl_bt/rtl8723cs_vf_fw.bin", 139 .cfg_name = "rtl_bt/rtl8723cs_vf_config" }, 140 141 /* 8723CS-XX */ 142 { .match_flags = IC_MATCH_FL_LMPSUBV | IC_MATCH_FL_CHIP_TYPE | 143 IC_MATCH_FL_HCIBUS, 144 .lmp_subver = RTL_ROM_LMP_8703B, 145 .chip_type = RTL_CHIP_8723CS_XX, 146 .hci_bus = HCI_UART, 147 .config_needed = true, 148 .has_rom_version = true, 149 .fw_name = "rtl_bt/rtl8723cs_xx_fw.bin", 150 .cfg_name = "rtl_bt/rtl8723cs_xx_config" }, 151 152 /* 8723D */ 153 { IC_INFO(RTL_ROM_LMP_8723B, 0xd, 0x8, HCI_USB), 154 .config_needed = true, 155 .has_rom_version = true, 156 .fw_name = "rtl_bt/rtl8723d_fw.bin", 157 .cfg_name = "rtl_bt/rtl8723d_config" }, 158 159 /* 8723DS */ 160 { IC_INFO(RTL_ROM_LMP_8723B, 0xd, 0x8, HCI_UART), 161 .config_needed = true, 162 .has_rom_version = true, 163 .fw_name = "rtl_bt/rtl8723ds_fw.bin", 164 .cfg_name = "rtl_bt/rtl8723ds_config" }, 165 166 /* 8821A */ 167 { IC_INFO(RTL_ROM_LMP_8821A, 0xa, 0x6, HCI_USB), 168 .config_needed = false, 169 .has_rom_version = true, 170 .fw_name = "rtl_bt/rtl8821a_fw.bin", 171 .cfg_name = "rtl_bt/rtl8821a_config" }, 172 173 /* 8821C */ 174 { IC_INFO(RTL_ROM_LMP_8821A, 0xc, 0x8, HCI_USB), 175 .config_needed = false, 176 .has_rom_version = true, 177 .has_msft_ext = true, 178 .fw_name = "rtl_bt/rtl8821c_fw.bin", 179 .cfg_name = "rtl_bt/rtl8821c_config" }, 180 181 /* 8821CS */ 182 { IC_INFO(RTL_ROM_LMP_8821A, 0xc, 0x8, HCI_UART), 183 .config_needed = true, 184 .has_rom_version = true, 185 .has_msft_ext = true, 186 .fw_name = "rtl_bt/rtl8821cs_fw.bin", 187 .cfg_name = "rtl_bt/rtl8821cs_config" }, 188 189 /* 8761A */ 190 { IC_INFO(RTL_ROM_LMP_8761A, 0xa, 0x6, HCI_USB), 191 .config_needed = false, 192 .has_rom_version = true, 193 .fw_name = "rtl_bt/rtl8761a_fw.bin", 194 .cfg_name = "rtl_bt/rtl8761a_config" }, 195 196 /* 8761B */ 197 { IC_INFO(RTL_ROM_LMP_8761A, 0xb, 0xa, HCI_UART), 198 .config_needed = false, 199 .has_rom_version = true, 200 .has_msft_ext = true, 201 .fw_name = "rtl_bt/rtl8761b_fw.bin", 202 .cfg_name = "rtl_bt/rtl8761b_config" }, 203 204 /* 8761BU */ 205 { IC_INFO(RTL_ROM_LMP_8761A, 0xb, 0xa, HCI_USB), 206 .config_needed = false, 207 .has_rom_version = true, 208 .fw_name = "rtl_bt/rtl8761bu_fw.bin", 209 .cfg_name = "rtl_bt/rtl8761bu_config" }, 210 211 /* 8822C with UART interface */ 212 { IC_INFO(RTL_ROM_LMP_8822B, 0xc, 0x8, HCI_UART), 213 .config_needed = true, 214 .has_rom_version = true, 215 .has_msft_ext = true, 216 .fw_name = "rtl_bt/rtl8822cs_fw.bin", 217 .cfg_name = "rtl_bt/rtl8822cs_config" }, 218 219 /* 8822C with UART interface */ 220 { IC_INFO(RTL_ROM_LMP_8822B, 0xc, 0xa, HCI_UART), 221 .config_needed = true, 222 .has_rom_version = true, 223 .has_msft_ext = true, 224 .fw_name = "rtl_bt/rtl8822cs_fw.bin", 225 .cfg_name = "rtl_bt/rtl8822cs_config" }, 226 227 /* 8822C with USB interface */ 228 { IC_INFO(RTL_ROM_LMP_8822B, 0xc, 0xa, HCI_USB), 229 .config_needed = false, 230 .has_rom_version = true, 231 .has_msft_ext = true, 232 .fw_name = "rtl_bt/rtl8822cu_fw.bin", 233 .cfg_name = "rtl_bt/rtl8822cu_config" }, 234 235 /* 8822B */ 236 { IC_INFO(RTL_ROM_LMP_8822B, 0xb, 0x7, HCI_USB), 237 .config_needed = true, 238 .has_rom_version = true, 239 .has_msft_ext = true, 240 .fw_name = "rtl_bt/rtl8822b_fw.bin", 241 .cfg_name = "rtl_bt/rtl8822b_config" }, 242 243 /* 8852A */ 244 { IC_INFO(RTL_ROM_LMP_8852A, 0xa, 0xb, HCI_USB), 245 .config_needed = false, 246 .has_rom_version = true, 247 .has_msft_ext = true, 248 .fw_name = "rtl_bt/rtl8852au_fw.bin", 249 .cfg_name = "rtl_bt/rtl8852au_config" }, 250 251 /* 8852B with UART interface */ 252 { IC_INFO(RTL_ROM_LMP_8852A, 0xb, 0xb, HCI_UART), 253 .config_needed = true, 254 .has_rom_version = true, 255 .has_msft_ext = true, 256 .fw_name = "rtl_bt/rtl8852bs_fw.bin", 257 .cfg_name = "rtl_bt/rtl8852bs_config" }, 258 259 /* 8852B */ 260 { IC_INFO(RTL_ROM_LMP_8852A, 0xb, 0xb, HCI_USB), 261 .config_needed = false, 262 .has_rom_version = true, 263 .has_msft_ext = true, 264 .fw_name = "rtl_bt/rtl8852bu_fw.bin", 265 .cfg_name = "rtl_bt/rtl8852bu_config" }, 266 267 /* 8852C */ 268 { IC_INFO(RTL_ROM_LMP_8852A, 0xc, 0xc, HCI_USB), 269 .config_needed = false, 270 .has_rom_version = true, 271 .has_msft_ext = true, 272 .fw_name = "rtl_bt/rtl8852cu_fw.bin", 273 .cfg_name = "rtl_bt/rtl8852cu_config" }, 274 }; 275 276 static const struct id_table *btrtl_match_ic(u16 lmp_subver, u16 hci_rev, 277 u8 hci_ver, u8 hci_bus, 278 u8 chip_type) 279 { 280 int i; 281 282 for (i = 0; i < ARRAY_SIZE(ic_id_table); i++) { 283 if ((ic_id_table[i].match_flags & IC_MATCH_FL_LMPSUBV) && 284 (ic_id_table[i].lmp_subver != lmp_subver)) 285 continue; 286 if ((ic_id_table[i].match_flags & IC_MATCH_FL_HCIREV) && 287 (ic_id_table[i].hci_rev != hci_rev)) 288 continue; 289 if ((ic_id_table[i].match_flags & IC_MATCH_FL_HCIVER) && 290 (ic_id_table[i].hci_ver != hci_ver)) 291 continue; 292 if ((ic_id_table[i].match_flags & IC_MATCH_FL_HCIBUS) && 293 (ic_id_table[i].hci_bus != hci_bus)) 294 continue; 295 if ((ic_id_table[i].match_flags & IC_MATCH_FL_CHIP_TYPE) && 296 (ic_id_table[i].chip_type != chip_type)) 297 continue; 298 299 break; 300 } 301 if (i >= ARRAY_SIZE(ic_id_table)) 302 return NULL; 303 304 return &ic_id_table[i]; 305 } 306 307 static struct sk_buff *btrtl_read_local_version(struct hci_dev *hdev) 308 { 309 struct sk_buff *skb; 310 311 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL, 312 HCI_INIT_TIMEOUT); 313 if (IS_ERR(skb)) { 314 rtl_dev_err(hdev, "HCI_OP_READ_LOCAL_VERSION failed (%ld)", 315 PTR_ERR(skb)); 316 return skb; 317 } 318 319 if (skb->len != sizeof(struct hci_rp_read_local_version)) { 320 rtl_dev_err(hdev, "HCI_OP_READ_LOCAL_VERSION event length mismatch"); 321 kfree_skb(skb); 322 return ERR_PTR(-EIO); 323 } 324 325 return skb; 326 } 327 328 static int rtl_read_rom_version(struct hci_dev *hdev, u8 *version) 329 { 330 struct rtl_rom_version_evt *rom_version; 331 struct sk_buff *skb; 332 333 /* Read RTL ROM version command */ 334 skb = __hci_cmd_sync(hdev, 0xfc6d, 0, NULL, HCI_INIT_TIMEOUT); 335 if (IS_ERR(skb)) { 336 rtl_dev_err(hdev, "Read ROM version failed (%ld)", 337 PTR_ERR(skb)); 338 return PTR_ERR(skb); 339 } 340 341 if (skb->len != sizeof(*rom_version)) { 342 rtl_dev_err(hdev, "version event length mismatch"); 343 kfree_skb(skb); 344 return -EIO; 345 } 346 347 rom_version = (struct rtl_rom_version_evt *)skb->data; 348 rtl_dev_info(hdev, "rom_version status=%x version=%x", 349 rom_version->status, rom_version->version); 350 351 *version = rom_version->version; 352 353 kfree_skb(skb); 354 return 0; 355 } 356 357 static int btrtl_vendor_read_reg16(struct hci_dev *hdev, 358 struct rtl_vendor_cmd *cmd, u8 *rp) 359 { 360 struct sk_buff *skb; 361 int err = 0; 362 363 skb = __hci_cmd_sync(hdev, 0xfc61, sizeof(*cmd), cmd, 364 HCI_INIT_TIMEOUT); 365 if (IS_ERR(skb)) { 366 err = PTR_ERR(skb); 367 rtl_dev_err(hdev, "RTL: Read reg16 failed (%d)", err); 368 return err; 369 } 370 371 if (skb->len != 3 || skb->data[0]) { 372 bt_dev_err(hdev, "RTL: Read reg16 length mismatch"); 373 kfree_skb(skb); 374 return -EIO; 375 } 376 377 if (rp) 378 memcpy(rp, skb->data + 1, 2); 379 380 kfree_skb(skb); 381 382 return 0; 383 } 384 385 static void *rtl_iov_pull_data(struct rtl_iovec *iov, u32 len) 386 { 387 void *data = iov->data; 388 389 if (iov->len < len) 390 return NULL; 391 392 iov->data += len; 393 iov->len -= len; 394 395 return data; 396 } 397 398 static void btrtl_insert_ordered_subsec(struct rtl_subsection *node, 399 struct btrtl_device_info *btrtl_dev) 400 { 401 struct list_head *pos; 402 struct list_head *next; 403 struct rtl_subsection *subsec; 404 405 list_for_each_safe(pos, next, &btrtl_dev->patch_subsecs) { 406 subsec = list_entry(pos, struct rtl_subsection, list); 407 if (subsec->prio >= node->prio) 408 break; 409 } 410 __list_add(&node->list, pos->prev, pos); 411 } 412 413 static int btrtl_parse_section(struct hci_dev *hdev, 414 struct btrtl_device_info *btrtl_dev, u32 opcode, 415 u8 *data, u32 len) 416 { 417 struct rtl_section_hdr *hdr; 418 struct rtl_subsection *subsec; 419 struct rtl_common_subsec *common_subsec; 420 struct rtl_sec_hdr *sec_hdr; 421 int i; 422 u8 *ptr; 423 u16 num_subsecs; 424 u32 subsec_len; 425 int rc = 0; 426 struct rtl_iovec iov = { 427 .data = data, 428 .len = len, 429 }; 430 431 hdr = rtl_iov_pull_data(&iov, sizeof(*hdr)); 432 if (!hdr) 433 return -EINVAL; 434 num_subsecs = le16_to_cpu(hdr->num); 435 436 for (i = 0; i < num_subsecs; i++) { 437 common_subsec = rtl_iov_pull_data(&iov, sizeof(*common_subsec)); 438 if (!common_subsec) 439 break; 440 subsec_len = le32_to_cpu(common_subsec->len); 441 442 rtl_dev_dbg(hdev, "subsec, eco 0x%02x, len %08x", 443 common_subsec->eco, subsec_len); 444 445 ptr = rtl_iov_pull_data(&iov, subsec_len); 446 if (!ptr) 447 break; 448 449 if (common_subsec->eco != btrtl_dev->rom_version + 1) 450 continue; 451 452 switch (opcode) { 453 case RTL_PATCH_SECURITY_HEADER: 454 sec_hdr = (void *)common_subsec; 455 if (sec_hdr->key_id != btrtl_dev->key_id) 456 continue; 457 break; 458 } 459 460 subsec = kzalloc(sizeof(*subsec), GFP_KERNEL); 461 if (!subsec) 462 return -ENOMEM; 463 subsec->opcode = opcode; 464 subsec->prio = common_subsec->prio; 465 subsec->len = subsec_len; 466 subsec->data = ptr; 467 btrtl_insert_ordered_subsec(subsec, btrtl_dev); 468 rc += subsec_len; 469 } 470 471 return rc; 472 } 473 474 static int rtlbt_parse_firmware_v2(struct hci_dev *hdev, 475 struct btrtl_device_info *btrtl_dev, 476 unsigned char **_buf) 477 { 478 struct rtl_epatch_header_v2 *hdr; 479 int rc; 480 u8 reg_val[2]; 481 u8 key_id; 482 u32 num_sections; 483 struct rtl_section *section; 484 struct rtl_subsection *entry, *tmp; 485 u32 section_len; 486 u32 opcode; 487 int len = 0; 488 int i; 489 u8 *ptr; 490 struct rtl_iovec iov = { 491 .data = btrtl_dev->fw_data, 492 .len = btrtl_dev->fw_len - 7, /* Cut the tail */ 493 }; 494 495 rc = btrtl_vendor_read_reg16(hdev, RTL_SEC_PROJ, reg_val); 496 if (rc < 0) 497 return -EIO; 498 key_id = reg_val[0]; 499 500 rtl_dev_dbg(hdev, "%s: key id %u", __func__, key_id); 501 502 btrtl_dev->key_id = key_id; 503 504 hdr = rtl_iov_pull_data(&iov, sizeof(*hdr)); 505 if (!hdr) 506 return -EINVAL; 507 num_sections = le32_to_cpu(hdr->num_sections); 508 509 rtl_dev_dbg(hdev, "FW version %08x-%08x", *((u32 *)hdr->fw_version), 510 *((u32 *)(hdr->fw_version + 4))); 511 512 for (i = 0; i < num_sections; i++) { 513 section = rtl_iov_pull_data(&iov, sizeof(*section)); 514 if (!section) 515 break; 516 section_len = le32_to_cpu(section->len); 517 opcode = le32_to_cpu(section->opcode); 518 519 rtl_dev_dbg(hdev, "opcode 0x%04x", section->opcode); 520 521 ptr = rtl_iov_pull_data(&iov, section_len); 522 if (!ptr) 523 break; 524 525 switch (opcode) { 526 case RTL_PATCH_SNIPPETS: 527 rc = btrtl_parse_section(hdev, btrtl_dev, opcode, 528 ptr, section_len); 529 break; 530 case RTL_PATCH_SECURITY_HEADER: 531 /* If key_id from chip is zero, ignore all security 532 * headers. 533 */ 534 if (!key_id) 535 break; 536 rc = btrtl_parse_section(hdev, btrtl_dev, opcode, 537 ptr, section_len); 538 break; 539 case RTL_PATCH_DUMMY_HEADER: 540 rc = btrtl_parse_section(hdev, btrtl_dev, opcode, 541 ptr, section_len); 542 break; 543 default: 544 rc = 0; 545 break; 546 } 547 if (rc < 0) { 548 rtl_dev_err(hdev, "RTL: Parse section (%u) err %d", 549 opcode, rc); 550 return rc; 551 } 552 len += rc; 553 } 554 555 if (!len) 556 return -ENODATA; 557 558 /* Allocate mem and copy all found subsecs. */ 559 ptr = kvmalloc(len, GFP_KERNEL); 560 if (!ptr) 561 return -ENOMEM; 562 563 len = 0; 564 list_for_each_entry_safe(entry, tmp, &btrtl_dev->patch_subsecs, list) { 565 rtl_dev_dbg(hdev, "RTL: opcode %08x, addr %p, len 0x%x", 566 entry->opcode, entry->data, entry->len); 567 memcpy(ptr + len, entry->data, entry->len); 568 len += entry->len; 569 } 570 571 if (!len) 572 return -EPERM; 573 574 *_buf = ptr; 575 return len; 576 } 577 578 static int rtlbt_parse_firmware(struct hci_dev *hdev, 579 struct btrtl_device_info *btrtl_dev, 580 unsigned char **_buf) 581 { 582 static const u8 extension_sig[] = { 0x51, 0x04, 0xfd, 0x77 }; 583 struct rtl_epatch_header *epatch_info; 584 unsigned char *buf; 585 int i, len; 586 size_t min_size; 587 u8 opcode, length, data; 588 int project_id = -1; 589 const unsigned char *fwptr, *chip_id_base; 590 const unsigned char *patch_length_base, *patch_offset_base; 591 u32 patch_offset = 0; 592 u16 patch_length, num_patches; 593 static const struct { 594 __u16 lmp_subver; 595 __u8 id; 596 } project_id_to_lmp_subver[] = { 597 { RTL_ROM_LMP_8723A, 0 }, 598 { RTL_ROM_LMP_8723B, 1 }, 599 { RTL_ROM_LMP_8821A, 2 }, 600 { RTL_ROM_LMP_8761A, 3 }, 601 { RTL_ROM_LMP_8703B, 7 }, 602 { RTL_ROM_LMP_8822B, 8 }, 603 { RTL_ROM_LMP_8723B, 9 }, /* 8723D */ 604 { RTL_ROM_LMP_8821A, 10 }, /* 8821C */ 605 { RTL_ROM_LMP_8822B, 13 }, /* 8822C */ 606 { RTL_ROM_LMP_8761A, 14 }, /* 8761B */ 607 { RTL_ROM_LMP_8852A, 18 }, /* 8852A */ 608 { RTL_ROM_LMP_8852A, 20 }, /* 8852B */ 609 { RTL_ROM_LMP_8852A, 25 }, /* 8852C */ 610 }; 611 612 if (btrtl_dev->fw_len <= 8) 613 return -EINVAL; 614 615 if (!memcmp(btrtl_dev->fw_data, RTL_EPATCH_SIGNATURE, 8)) 616 min_size = sizeof(struct rtl_epatch_header) + 617 sizeof(extension_sig) + 3; 618 else if (!memcmp(btrtl_dev->fw_data, RTL_EPATCH_SIGNATURE_V2, 8)) 619 min_size = sizeof(struct rtl_epatch_header_v2) + 620 sizeof(extension_sig) + 3; 621 else 622 return -EINVAL; 623 624 if (btrtl_dev->fw_len < min_size) 625 return -EINVAL; 626 627 fwptr = btrtl_dev->fw_data + btrtl_dev->fw_len - sizeof(extension_sig); 628 if (memcmp(fwptr, extension_sig, sizeof(extension_sig)) != 0) { 629 rtl_dev_err(hdev, "extension section signature mismatch"); 630 return -EINVAL; 631 } 632 633 /* Loop from the end of the firmware parsing instructions, until 634 * we find an instruction that identifies the "project ID" for the 635 * hardware supported by this firwmare file. 636 * Once we have that, we double-check that project_id is suitable 637 * for the hardware we are working with. 638 */ 639 while (fwptr >= btrtl_dev->fw_data + (sizeof(*epatch_info) + 3)) { 640 opcode = *--fwptr; 641 length = *--fwptr; 642 data = *--fwptr; 643 644 BT_DBG("check op=%x len=%x data=%x", opcode, length, data); 645 646 if (opcode == 0xff) /* EOF */ 647 break; 648 649 if (length == 0) { 650 rtl_dev_err(hdev, "found instruction with length 0"); 651 return -EINVAL; 652 } 653 654 if (opcode == 0 && length == 1) { 655 project_id = data; 656 break; 657 } 658 659 fwptr -= length; 660 } 661 662 if (project_id < 0) { 663 rtl_dev_err(hdev, "failed to find version instruction"); 664 return -EINVAL; 665 } 666 667 /* Find project_id in table */ 668 for (i = 0; i < ARRAY_SIZE(project_id_to_lmp_subver); i++) { 669 if (project_id == project_id_to_lmp_subver[i].id) { 670 btrtl_dev->project_id = project_id; 671 break; 672 } 673 } 674 675 if (i >= ARRAY_SIZE(project_id_to_lmp_subver)) { 676 rtl_dev_err(hdev, "unknown project id %d", project_id); 677 return -EINVAL; 678 } 679 680 if (btrtl_dev->ic_info->lmp_subver != 681 project_id_to_lmp_subver[i].lmp_subver) { 682 rtl_dev_err(hdev, "firmware is for %x but this is a %x", 683 project_id_to_lmp_subver[i].lmp_subver, 684 btrtl_dev->ic_info->lmp_subver); 685 return -EINVAL; 686 } 687 688 if (memcmp(btrtl_dev->fw_data, RTL_EPATCH_SIGNATURE, 8) != 0) { 689 if (!memcmp(btrtl_dev->fw_data, RTL_EPATCH_SIGNATURE_V2, 8)) 690 return rtlbt_parse_firmware_v2(hdev, btrtl_dev, _buf); 691 rtl_dev_err(hdev, "bad EPATCH signature"); 692 return -EINVAL; 693 } 694 695 epatch_info = (struct rtl_epatch_header *)btrtl_dev->fw_data; 696 num_patches = le16_to_cpu(epatch_info->num_patches); 697 BT_DBG("fw_version=%x, num_patches=%d", 698 le32_to_cpu(epatch_info->fw_version), num_patches); 699 700 /* After the rtl_epatch_header there is a funky patch metadata section. 701 * Assuming 2 patches, the layout is: 702 * ChipID1 ChipID2 PatchLength1 PatchLength2 PatchOffset1 PatchOffset2 703 * 704 * Find the right patch for this chip. 705 */ 706 min_size += 8 * num_patches; 707 if (btrtl_dev->fw_len < min_size) 708 return -EINVAL; 709 710 chip_id_base = btrtl_dev->fw_data + sizeof(struct rtl_epatch_header); 711 patch_length_base = chip_id_base + (sizeof(u16) * num_patches); 712 patch_offset_base = patch_length_base + (sizeof(u16) * num_patches); 713 for (i = 0; i < num_patches; i++) { 714 u16 chip_id = get_unaligned_le16(chip_id_base + 715 (i * sizeof(u16))); 716 if (chip_id == btrtl_dev->rom_version + 1) { 717 patch_length = get_unaligned_le16(patch_length_base + 718 (i * sizeof(u16))); 719 patch_offset = get_unaligned_le32(patch_offset_base + 720 (i * sizeof(u32))); 721 break; 722 } 723 } 724 725 if (!patch_offset) { 726 rtl_dev_err(hdev, "didn't find patch for chip id %d", 727 btrtl_dev->rom_version); 728 return -EINVAL; 729 } 730 731 BT_DBG("length=%x offset=%x index %d", patch_length, patch_offset, i); 732 min_size = patch_offset + patch_length; 733 if (btrtl_dev->fw_len < min_size) 734 return -EINVAL; 735 736 /* Copy the firmware into a new buffer and write the version at 737 * the end. 738 */ 739 len = patch_length; 740 buf = kvmalloc(patch_length, GFP_KERNEL); 741 if (!buf) 742 return -ENOMEM; 743 744 memcpy(buf, btrtl_dev->fw_data + patch_offset, patch_length - 4); 745 memcpy(buf + patch_length - 4, &epatch_info->fw_version, 4); 746 747 *_buf = buf; 748 return len; 749 } 750 751 static int rtl_download_firmware(struct hci_dev *hdev, 752 const unsigned char *data, int fw_len) 753 { 754 struct rtl_download_cmd *dl_cmd; 755 int frag_num = fw_len / RTL_FRAG_LEN + 1; 756 int frag_len = RTL_FRAG_LEN; 757 int ret = 0; 758 int i; 759 int j = 0; 760 struct sk_buff *skb; 761 struct hci_rp_read_local_version *rp; 762 763 dl_cmd = kmalloc(sizeof(struct rtl_download_cmd), GFP_KERNEL); 764 if (!dl_cmd) 765 return -ENOMEM; 766 767 for (i = 0; i < frag_num; i++) { 768 struct sk_buff *skb; 769 770 dl_cmd->index = j++; 771 if (dl_cmd->index == 0x7f) 772 j = 1; 773 774 if (i == (frag_num - 1)) { 775 dl_cmd->index |= 0x80; /* data end */ 776 frag_len = fw_len % RTL_FRAG_LEN; 777 } 778 rtl_dev_dbg(hdev, "download fw (%d/%d). index = %d", i, 779 frag_num, dl_cmd->index); 780 memcpy(dl_cmd->data, data, frag_len); 781 782 /* Send download command */ 783 skb = __hci_cmd_sync(hdev, 0xfc20, frag_len + 1, dl_cmd, 784 HCI_INIT_TIMEOUT); 785 if (IS_ERR(skb)) { 786 rtl_dev_err(hdev, "download fw command failed (%ld)", 787 PTR_ERR(skb)); 788 ret = PTR_ERR(skb); 789 goto out; 790 } 791 792 if (skb->len != sizeof(struct rtl_download_response)) { 793 rtl_dev_err(hdev, "download fw event length mismatch"); 794 kfree_skb(skb); 795 ret = -EIO; 796 goto out; 797 } 798 799 kfree_skb(skb); 800 data += RTL_FRAG_LEN; 801 } 802 803 skb = btrtl_read_local_version(hdev); 804 if (IS_ERR(skb)) { 805 ret = PTR_ERR(skb); 806 rtl_dev_err(hdev, "read local version failed"); 807 goto out; 808 } 809 810 rp = (struct hci_rp_read_local_version *)skb->data; 811 rtl_dev_info(hdev, "fw version 0x%04x%04x", 812 __le16_to_cpu(rp->hci_rev), __le16_to_cpu(rp->lmp_subver)); 813 kfree_skb(skb); 814 815 out: 816 kfree(dl_cmd); 817 return ret; 818 } 819 820 static int rtl_load_file(struct hci_dev *hdev, const char *name, u8 **buff) 821 { 822 const struct firmware *fw; 823 int ret; 824 825 rtl_dev_info(hdev, "loading %s", name); 826 ret = request_firmware(&fw, name, &hdev->dev); 827 if (ret < 0) 828 return ret; 829 ret = fw->size; 830 *buff = kvmalloc(fw->size, GFP_KERNEL); 831 if (*buff) 832 memcpy(*buff, fw->data, ret); 833 else 834 ret = -ENOMEM; 835 836 release_firmware(fw); 837 838 return ret; 839 } 840 841 static int btrtl_setup_rtl8723a(struct hci_dev *hdev, 842 struct btrtl_device_info *btrtl_dev) 843 { 844 if (btrtl_dev->fw_len < 8) 845 return -EINVAL; 846 847 /* Check that the firmware doesn't have the epatch signature 848 * (which is only for RTL8723B and newer). 849 */ 850 if (!memcmp(btrtl_dev->fw_data, RTL_EPATCH_SIGNATURE, 8)) { 851 rtl_dev_err(hdev, "unexpected EPATCH signature!"); 852 return -EINVAL; 853 } 854 855 return rtl_download_firmware(hdev, btrtl_dev->fw_data, 856 btrtl_dev->fw_len); 857 } 858 859 static int btrtl_setup_rtl8723b(struct hci_dev *hdev, 860 struct btrtl_device_info *btrtl_dev) 861 { 862 unsigned char *fw_data = NULL; 863 int ret; 864 u8 *tbuff; 865 866 ret = rtlbt_parse_firmware(hdev, btrtl_dev, &fw_data); 867 if (ret < 0) 868 goto out; 869 870 if (btrtl_dev->cfg_len > 0) { 871 tbuff = kvzalloc(ret + btrtl_dev->cfg_len, GFP_KERNEL); 872 if (!tbuff) { 873 ret = -ENOMEM; 874 goto out; 875 } 876 877 memcpy(tbuff, fw_data, ret); 878 kvfree(fw_data); 879 880 memcpy(tbuff + ret, btrtl_dev->cfg_data, btrtl_dev->cfg_len); 881 ret += btrtl_dev->cfg_len; 882 883 fw_data = tbuff; 884 } 885 886 rtl_dev_info(hdev, "cfg_sz %d, total sz %d", btrtl_dev->cfg_len, ret); 887 888 ret = rtl_download_firmware(hdev, fw_data, ret); 889 890 out: 891 kvfree(fw_data); 892 return ret; 893 } 894 895 static bool rtl_has_chip_type(u16 lmp_subver) 896 { 897 switch (lmp_subver) { 898 case RTL_ROM_LMP_8703B: 899 return true; 900 default: 901 break; 902 } 903 904 return false; 905 } 906 907 static int rtl_read_chip_type(struct hci_dev *hdev, u8 *type) 908 { 909 struct rtl_chip_type_evt *chip_type; 910 struct sk_buff *skb; 911 const unsigned char cmd_buf[] = {0x00, 0x94, 0xa0, 0x00, 0xb0}; 912 913 /* Read RTL chip type command */ 914 skb = __hci_cmd_sync(hdev, 0xfc61, 5, cmd_buf, HCI_INIT_TIMEOUT); 915 if (IS_ERR(skb)) { 916 rtl_dev_err(hdev, "Read chip type failed (%ld)", 917 PTR_ERR(skb)); 918 return PTR_ERR(skb); 919 } 920 921 chip_type = skb_pull_data(skb, sizeof(*chip_type)); 922 if (!chip_type) { 923 rtl_dev_err(hdev, "RTL chip type event length mismatch"); 924 kfree_skb(skb); 925 return -EIO; 926 } 927 928 rtl_dev_info(hdev, "chip_type status=%x type=%x", 929 chip_type->status, chip_type->type); 930 931 *type = chip_type->type & 0x0f; 932 933 kfree_skb(skb); 934 return 0; 935 } 936 937 void btrtl_free(struct btrtl_device_info *btrtl_dev) 938 { 939 struct rtl_subsection *entry, *tmp; 940 941 kvfree(btrtl_dev->fw_data); 942 kvfree(btrtl_dev->cfg_data); 943 944 list_for_each_entry_safe(entry, tmp, &btrtl_dev->patch_subsecs, list) { 945 list_del(&entry->list); 946 kfree(entry); 947 } 948 949 kfree(btrtl_dev); 950 } 951 EXPORT_SYMBOL_GPL(btrtl_free); 952 953 struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev, 954 const char *postfix) 955 { 956 struct btrtl_device_info *btrtl_dev; 957 struct sk_buff *skb; 958 struct hci_rp_read_local_version *resp; 959 char cfg_name[40]; 960 u16 hci_rev, lmp_subver; 961 u8 hci_ver, lmp_ver, chip_type = 0; 962 int ret; 963 u16 opcode; 964 u8 cmd[2]; 965 u8 reg_val[2]; 966 967 btrtl_dev = kzalloc(sizeof(*btrtl_dev), GFP_KERNEL); 968 if (!btrtl_dev) { 969 ret = -ENOMEM; 970 goto err_alloc; 971 } 972 973 INIT_LIST_HEAD(&btrtl_dev->patch_subsecs); 974 975 check_version: 976 ret = btrtl_vendor_read_reg16(hdev, RTL_CHIP_SUBVER, reg_val); 977 if (ret < 0) 978 goto err_free; 979 lmp_subver = get_unaligned_le16(reg_val); 980 981 if (lmp_subver == RTL_ROM_LMP_8822B) { 982 ret = btrtl_vendor_read_reg16(hdev, RTL_CHIP_REV, reg_val); 983 if (ret < 0) 984 goto err_free; 985 hci_rev = get_unaligned_le16(reg_val); 986 987 /* 8822E */ 988 if (hci_rev == 0x000e) { 989 hci_ver = 0x0c; 990 lmp_ver = 0x0c; 991 btrtl_dev->ic_info = btrtl_match_ic(lmp_subver, hci_rev, 992 hci_ver, hdev->bus, 993 chip_type); 994 goto next; 995 } 996 } 997 998 skb = btrtl_read_local_version(hdev); 999 if (IS_ERR(skb)) { 1000 ret = PTR_ERR(skb); 1001 goto err_free; 1002 } 1003 1004 resp = (struct hci_rp_read_local_version *)skb->data; 1005 1006 hci_ver = resp->hci_ver; 1007 hci_rev = le16_to_cpu(resp->hci_rev); 1008 lmp_ver = resp->lmp_ver; 1009 lmp_subver = le16_to_cpu(resp->lmp_subver); 1010 1011 kfree_skb(skb); 1012 1013 if (rtl_has_chip_type(lmp_subver)) { 1014 ret = rtl_read_chip_type(hdev, &chip_type); 1015 if (ret) 1016 goto err_free; 1017 } 1018 1019 btrtl_dev->ic_info = btrtl_match_ic(lmp_subver, hci_rev, hci_ver, 1020 hdev->bus, chip_type); 1021 1022 next: 1023 rtl_dev_info(hdev, "examining hci_ver=%02x hci_rev=%04x lmp_ver=%02x lmp_subver=%04x", 1024 hci_ver, hci_rev, 1025 lmp_ver, lmp_subver); 1026 1027 if (!btrtl_dev->ic_info && !btrtl_dev->drop_fw) 1028 btrtl_dev->drop_fw = true; 1029 else 1030 btrtl_dev->drop_fw = false; 1031 1032 if (btrtl_dev->drop_fw) { 1033 opcode = hci_opcode_pack(0x3f, 0x66); 1034 cmd[0] = opcode & 0xff; 1035 cmd[1] = opcode >> 8; 1036 1037 skb = bt_skb_alloc(sizeof(cmd), GFP_KERNEL); 1038 if (!skb) 1039 goto err_free; 1040 1041 skb_put_data(skb, cmd, sizeof(cmd)); 1042 hci_skb_pkt_type(skb) = HCI_COMMAND_PKT; 1043 1044 ret = hdev->send(hdev, skb); 1045 if (ret < 0) { 1046 bt_dev_err(hdev, "sending frame failed (%d)", ret); 1047 kfree_skb(skb); 1048 goto err_free; 1049 } 1050 1051 /* Ensure the above vendor command is sent to controller and 1052 * process has done. 1053 */ 1054 msleep(200); 1055 1056 goto check_version; 1057 } 1058 1059 if (!btrtl_dev->ic_info) { 1060 rtl_dev_info(hdev, "unknown IC info, lmp subver %04x, hci rev %04x, hci ver %04x", 1061 lmp_subver, hci_rev, hci_ver); 1062 return btrtl_dev; 1063 } 1064 1065 if (btrtl_dev->ic_info->has_rom_version) { 1066 ret = rtl_read_rom_version(hdev, &btrtl_dev->rom_version); 1067 if (ret) 1068 goto err_free; 1069 } 1070 1071 btrtl_dev->fw_len = rtl_load_file(hdev, btrtl_dev->ic_info->fw_name, 1072 &btrtl_dev->fw_data); 1073 if (btrtl_dev->fw_len < 0) { 1074 rtl_dev_err(hdev, "firmware file %s not found", 1075 btrtl_dev->ic_info->fw_name); 1076 ret = btrtl_dev->fw_len; 1077 goto err_free; 1078 } 1079 1080 if (btrtl_dev->ic_info->cfg_name) { 1081 if (postfix) { 1082 snprintf(cfg_name, sizeof(cfg_name), "%s-%s.bin", 1083 btrtl_dev->ic_info->cfg_name, postfix); 1084 } else { 1085 snprintf(cfg_name, sizeof(cfg_name), "%s.bin", 1086 btrtl_dev->ic_info->cfg_name); 1087 } 1088 btrtl_dev->cfg_len = rtl_load_file(hdev, cfg_name, 1089 &btrtl_dev->cfg_data); 1090 if (btrtl_dev->ic_info->config_needed && 1091 btrtl_dev->cfg_len <= 0) { 1092 rtl_dev_err(hdev, "mandatory config file %s not found", 1093 btrtl_dev->ic_info->cfg_name); 1094 ret = btrtl_dev->cfg_len; 1095 goto err_free; 1096 } 1097 } 1098 1099 /* The following chips supports the Microsoft vendor extension, 1100 * therefore set the corresponding VsMsftOpCode. 1101 */ 1102 if (btrtl_dev->ic_info->has_msft_ext) 1103 hci_set_msft_opcode(hdev, 0xFCF0); 1104 1105 return btrtl_dev; 1106 1107 err_free: 1108 btrtl_free(btrtl_dev); 1109 err_alloc: 1110 return ERR_PTR(ret); 1111 } 1112 EXPORT_SYMBOL_GPL(btrtl_initialize); 1113 1114 int btrtl_download_firmware(struct hci_dev *hdev, 1115 struct btrtl_device_info *btrtl_dev) 1116 { 1117 /* Match a set of subver values that correspond to stock firmware, 1118 * which is not compatible with standard btusb. 1119 * If matched, upload an alternative firmware that does conform to 1120 * standard btusb. Once that firmware is uploaded, the subver changes 1121 * to a different value. 1122 */ 1123 if (!btrtl_dev->ic_info) { 1124 rtl_dev_info(hdev, "assuming no firmware upload needed"); 1125 return 0; 1126 } 1127 1128 switch (btrtl_dev->ic_info->lmp_subver) { 1129 case RTL_ROM_LMP_8723A: 1130 return btrtl_setup_rtl8723a(hdev, btrtl_dev); 1131 case RTL_ROM_LMP_8723B: 1132 case RTL_ROM_LMP_8821A: 1133 case RTL_ROM_LMP_8761A: 1134 case RTL_ROM_LMP_8822B: 1135 case RTL_ROM_LMP_8852A: 1136 case RTL_ROM_LMP_8703B: 1137 return btrtl_setup_rtl8723b(hdev, btrtl_dev); 1138 default: 1139 rtl_dev_info(hdev, "assuming no firmware upload needed"); 1140 return 0; 1141 } 1142 } 1143 EXPORT_SYMBOL_GPL(btrtl_download_firmware); 1144 1145 void btrtl_set_quirks(struct hci_dev *hdev, struct btrtl_device_info *btrtl_dev) 1146 { 1147 /* Enable controller to do both LE scan and BR/EDR inquiry 1148 * simultaneously. 1149 */ 1150 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 1151 1152 /* Enable central-peripheral role (able to create new connections with 1153 * an existing connection in slave role). 1154 */ 1155 /* Enable WBS supported for the specific Realtek devices. */ 1156 switch (btrtl_dev->project_id) { 1157 case CHIP_ID_8822C: 1158 case CHIP_ID_8852A: 1159 case CHIP_ID_8852B: 1160 case CHIP_ID_8852C: 1161 set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks); 1162 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks); 1163 1164 /* RTL8852C needs to transmit mSBC data continuously without 1165 * the zero length of USB packets for the ALT 6 supported chips 1166 */ 1167 if (btrtl_dev->project_id == CHIP_ID_8852C) 1168 btrealtek_set_flag(hdev, REALTEK_ALT6_CONTINUOUS_TX_CHIP); 1169 1170 hci_set_aosp_capable(hdev); 1171 break; 1172 default: 1173 rtl_dev_dbg(hdev, "Central-peripheral role not enabled."); 1174 rtl_dev_dbg(hdev, "WBS supported not enabled."); 1175 break; 1176 } 1177 1178 if (!btrtl_dev->ic_info) 1179 return; 1180 1181 switch (btrtl_dev->ic_info->lmp_subver) { 1182 case RTL_ROM_LMP_8703B: 1183 /* 8723CS reports two pages for local ext features, 1184 * but it doesn't support any features from page 2 - 1185 * it either responds with garbage or with error status 1186 */ 1187 set_bit(HCI_QUIRK_BROKEN_LOCAL_EXT_FEATURES_PAGE_2, 1188 &hdev->quirks); 1189 break; 1190 default: 1191 break; 1192 } 1193 } 1194 EXPORT_SYMBOL_GPL(btrtl_set_quirks); 1195 1196 int btrtl_setup_realtek(struct hci_dev *hdev) 1197 { 1198 struct btrtl_device_info *btrtl_dev; 1199 int ret; 1200 1201 btrtl_dev = btrtl_initialize(hdev, NULL); 1202 if (IS_ERR(btrtl_dev)) 1203 return PTR_ERR(btrtl_dev); 1204 1205 ret = btrtl_download_firmware(hdev, btrtl_dev); 1206 1207 btrtl_set_quirks(hdev, btrtl_dev); 1208 1209 btrtl_free(btrtl_dev); 1210 return ret; 1211 } 1212 EXPORT_SYMBOL_GPL(btrtl_setup_realtek); 1213 1214 int btrtl_shutdown_realtek(struct hci_dev *hdev) 1215 { 1216 struct sk_buff *skb; 1217 int ret; 1218 1219 /* According to the vendor driver, BT must be reset on close to avoid 1220 * firmware crash. 1221 */ 1222 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 1223 if (IS_ERR(skb)) { 1224 ret = PTR_ERR(skb); 1225 bt_dev_err(hdev, "HCI reset during shutdown failed"); 1226 return ret; 1227 } 1228 kfree_skb(skb); 1229 1230 return 0; 1231 } 1232 EXPORT_SYMBOL_GPL(btrtl_shutdown_realtek); 1233 1234 static unsigned int btrtl_convert_baudrate(u32 device_baudrate) 1235 { 1236 switch (device_baudrate) { 1237 case 0x0252a00a: 1238 return 230400; 1239 1240 case 0x05f75004: 1241 return 921600; 1242 1243 case 0x00005004: 1244 return 1000000; 1245 1246 case 0x04928002: 1247 case 0x01128002: 1248 return 1500000; 1249 1250 case 0x00005002: 1251 return 2000000; 1252 1253 case 0x0000b001: 1254 return 2500000; 1255 1256 case 0x04928001: 1257 return 3000000; 1258 1259 case 0x052a6001: 1260 return 3500000; 1261 1262 case 0x00005001: 1263 return 4000000; 1264 1265 case 0x0252c014: 1266 default: 1267 return 115200; 1268 } 1269 } 1270 1271 int btrtl_get_uart_settings(struct hci_dev *hdev, 1272 struct btrtl_device_info *btrtl_dev, 1273 unsigned int *controller_baudrate, 1274 u32 *device_baudrate, bool *flow_control) 1275 { 1276 struct rtl_vendor_config *config; 1277 struct rtl_vendor_config_entry *entry; 1278 int i, total_data_len; 1279 bool found = false; 1280 1281 total_data_len = btrtl_dev->cfg_len - sizeof(*config); 1282 if (total_data_len <= 0) { 1283 rtl_dev_warn(hdev, "no config loaded"); 1284 return -EINVAL; 1285 } 1286 1287 config = (struct rtl_vendor_config *)btrtl_dev->cfg_data; 1288 if (le32_to_cpu(config->signature) != RTL_CONFIG_MAGIC) { 1289 rtl_dev_err(hdev, "invalid config magic"); 1290 return -EINVAL; 1291 } 1292 1293 if (total_data_len < le16_to_cpu(config->total_len)) { 1294 rtl_dev_err(hdev, "config is too short"); 1295 return -EINVAL; 1296 } 1297 1298 for (i = 0; i < total_data_len; ) { 1299 entry = ((void *)config->entry) + i; 1300 1301 switch (le16_to_cpu(entry->offset)) { 1302 case 0xc: 1303 if (entry->len < sizeof(*device_baudrate)) { 1304 rtl_dev_err(hdev, "invalid UART config entry"); 1305 return -EINVAL; 1306 } 1307 1308 *device_baudrate = get_unaligned_le32(entry->data); 1309 *controller_baudrate = btrtl_convert_baudrate( 1310 *device_baudrate); 1311 1312 if (entry->len >= 13) 1313 *flow_control = !!(entry->data[12] & BIT(2)); 1314 else 1315 *flow_control = false; 1316 1317 found = true; 1318 break; 1319 1320 default: 1321 rtl_dev_dbg(hdev, "skipping config entry 0x%x (len %u)", 1322 le16_to_cpu(entry->offset), entry->len); 1323 break; 1324 } 1325 1326 i += sizeof(*entry) + entry->len; 1327 } 1328 1329 if (!found) { 1330 rtl_dev_err(hdev, "no UART config entry found"); 1331 return -ENOENT; 1332 } 1333 1334 rtl_dev_dbg(hdev, "device baudrate = 0x%08x", *device_baudrate); 1335 rtl_dev_dbg(hdev, "controller baudrate = %u", *controller_baudrate); 1336 rtl_dev_dbg(hdev, "flow control %d", *flow_control); 1337 1338 return 0; 1339 } 1340 EXPORT_SYMBOL_GPL(btrtl_get_uart_settings); 1341 1342 MODULE_AUTHOR("Daniel Drake <[email protected]>"); 1343 MODULE_DESCRIPTION("Bluetooth support for Realtek devices ver " VERSION); 1344 MODULE_VERSION(VERSION); 1345 MODULE_LICENSE("GPL"); 1346 MODULE_FIRMWARE("rtl_bt/rtl8723a_fw.bin"); 1347 MODULE_FIRMWARE("rtl_bt/rtl8723b_fw.bin"); 1348 MODULE_FIRMWARE("rtl_bt/rtl8723b_config.bin"); 1349 MODULE_FIRMWARE("rtl_bt/rtl8723bs_fw.bin"); 1350 MODULE_FIRMWARE("rtl_bt/rtl8723bs_config.bin"); 1351 MODULE_FIRMWARE("rtl_bt/rtl8723cs_cg_fw.bin"); 1352 MODULE_FIRMWARE("rtl_bt/rtl8723cs_cg_config.bin"); 1353 MODULE_FIRMWARE("rtl_bt/rtl8723cs_vf_fw.bin"); 1354 MODULE_FIRMWARE("rtl_bt/rtl8723cs_vf_config.bin"); 1355 MODULE_FIRMWARE("rtl_bt/rtl8723cs_xx_fw.bin"); 1356 MODULE_FIRMWARE("rtl_bt/rtl8723cs_xx_config.bin"); 1357 MODULE_FIRMWARE("rtl_bt/rtl8723ds_fw.bin"); 1358 MODULE_FIRMWARE("rtl_bt/rtl8723ds_config.bin"); 1359 MODULE_FIRMWARE("rtl_bt/rtl8761a_fw.bin"); 1360 MODULE_FIRMWARE("rtl_bt/rtl8761a_config.bin"); 1361 MODULE_FIRMWARE("rtl_bt/rtl8821a_fw.bin"); 1362 MODULE_FIRMWARE("rtl_bt/rtl8821a_config.bin"); 1363 MODULE_FIRMWARE("rtl_bt/rtl8822b_fw.bin"); 1364 MODULE_FIRMWARE("rtl_bt/rtl8822b_config.bin"); 1365 MODULE_FIRMWARE("rtl_bt/rtl8852au_fw.bin"); 1366 MODULE_FIRMWARE("rtl_bt/rtl8852au_config.bin"); 1367 MODULE_FIRMWARE("rtl_bt/rtl8852bs_fw.bin"); 1368 MODULE_FIRMWARE("rtl_bt/rtl8852bs_config.bin"); 1369 MODULE_FIRMWARE("rtl_bt/rtl8852bu_fw.bin"); 1370 MODULE_FIRMWARE("rtl_bt/rtl8852bu_config.bin"); 1371 MODULE_FIRMWARE("rtl_bt/rtl8852cu_fw.bin"); 1372 MODULE_FIRMWARE("rtl_bt/rtl8852cu_config.bin"); 1373