tjh.dev
Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 * Bluetooth support for Realtek devices
4 *
5 * Copyright (C) 2015 Endless Mobile, Inc.
6 */
7
8#include <linux/module.h>
9#include <linux/firmware.h>
10#include <asm/unaligned.h>
11#include <linux/usb.h>
12
13#include <net/bluetooth/bluetooth.h>
14#include <net/bluetooth/hci_core.h>
15
16#include "btrtl.h"
17
18#define VERSION "0.1"
19
20#define RTL_CHIP_8723CS_CG 3
21#define RTL_CHIP_8723CS_VF 4
22#define RTL_CHIP_8723CS_XX 5
23#define RTL_EPATCH_SIGNATURE "Realtech"
24#define RTL_EPATCH_SIGNATURE_V2 "RTBTCore"
25#define RTL_ROM_LMP_8703B 0x8703
26#define RTL_ROM_LMP_8723A 0x1200
27#define RTL_ROM_LMP_8723B 0x8723
28#define RTL_ROM_LMP_8821A 0x8821
29#define RTL_ROM_LMP_8761A 0x8761
30#define RTL_ROM_LMP_8822B 0x8822
31#define RTL_ROM_LMP_8852A 0x8852
32#define RTL_ROM_LMP_8851B 0x8851
33#define RTL_CONFIG_MAGIC 0x8723ab55
34
35#define IC_MATCH_FL_LMPSUBV (1 << 0)
36#define IC_MATCH_FL_HCIREV (1 << 1)
37#define IC_MATCH_FL_HCIVER (1 << 2)
38#define IC_MATCH_FL_HCIBUS (1 << 3)
39#define IC_MATCH_FL_CHIP_TYPE (1 << 4)
40#define IC_INFO(lmps, hcir, hciv, bus) \
41 .match_flags = IC_MATCH_FL_LMPSUBV | IC_MATCH_FL_HCIREV | \
42 IC_MATCH_FL_HCIVER | IC_MATCH_FL_HCIBUS, \
43 .lmp_subver = (lmps), \
44 .hci_rev = (hcir), \
45 .hci_ver = (hciv), \
46 .hci_bus = (bus)
47
48#define RTL_CHIP_SUBVER (&(struct rtl_vendor_cmd) {{0x10, 0x38, 0x04, 0x28, 0x80}})
49#define RTL_CHIP_REV (&(struct rtl_vendor_cmd) {{0x10, 0x3A, 0x04, 0x28, 0x80}})
50#define RTL_SEC_PROJ (&(struct rtl_vendor_cmd) {{0x10, 0xA4, 0x0D, 0x00, 0xb0}})
51
52#define RTL_PATCH_SNIPPETS 0x01
53#define RTL_PATCH_DUMMY_HEADER 0x02
54#define RTL_PATCH_SECURITY_HEADER 0x03
55
56enum btrtl_chip_id {
57 CHIP_ID_8723A,
58 CHIP_ID_8723B,
59 CHIP_ID_8821A,
60 CHIP_ID_8761A,
61 CHIP_ID_8822B = 8,
62 CHIP_ID_8723D,
63 CHIP_ID_8821C,
64 CHIP_ID_8822C = 13,
65 CHIP_ID_8761B,
66 CHIP_ID_8852A = 18,
67 CHIP_ID_8852B = 20,
68 CHIP_ID_8852C = 25,
69 CHIP_ID_8851B = 36,
70};
71
72struct id_table {
73 __u16 match_flags;
74 __u16 lmp_subver;
75 __u16 hci_rev;
76 __u8 hci_ver;
77 __u8 hci_bus;
78 __u8 chip_type;
79 bool config_needed;
80 bool has_rom_version;
81 bool has_msft_ext;
82 char *fw_name;
83 char *cfg_name;
84};
85
86struct btrtl_device_info {
87 const struct id_table *ic_info;
88 u8 rom_version;
89 u8 *fw_data;
90 int fw_len;
91 u8 *cfg_data;
92 int cfg_len;
93 bool drop_fw;
94 int project_id;
95 u8 key_id;
96 struct list_head patch_subsecs;
97};
98
99static const struct id_table ic_id_table[] = {
100 /* 8723A */
101 { IC_INFO(RTL_ROM_LMP_8723A, 0xb, 0x6, HCI_USB),
102 .config_needed = false,
103 .has_rom_version = false,
104 .fw_name = "rtl_bt/rtl8723a_fw.bin",
105 .cfg_name = NULL },
106
107 /* 8723BS */
108 { IC_INFO(RTL_ROM_LMP_8723B, 0xb, 0x6, HCI_UART),
109 .config_needed = true,
110 .has_rom_version = true,
111 .fw_name = "rtl_bt/rtl8723bs_fw.bin",
112 .cfg_name = "rtl_bt/rtl8723bs_config" },
113
114 /* 8723B */
115 { IC_INFO(RTL_ROM_LMP_8723B, 0xb, 0x6, HCI_USB),
116 .config_needed = false,
117 .has_rom_version = true,
118 .fw_name = "rtl_bt/rtl8723b_fw.bin",
119 .cfg_name = "rtl_bt/rtl8723b_config" },
120
121 /* 8723CS-CG */
122 { .match_flags = IC_MATCH_FL_LMPSUBV | IC_MATCH_FL_CHIP_TYPE |
123 IC_MATCH_FL_HCIBUS,
124 .lmp_subver = RTL_ROM_LMP_8703B,
125 .chip_type = RTL_CHIP_8723CS_CG,
126 .hci_bus = HCI_UART,
127 .config_needed = true,
128 .has_rom_version = true,
129 .fw_name = "rtl_bt/rtl8723cs_cg_fw.bin",
130 .cfg_name = "rtl_bt/rtl8723cs_cg_config" },
131
132 /* 8723CS-VF */
133 { .match_flags = IC_MATCH_FL_LMPSUBV | IC_MATCH_FL_CHIP_TYPE |
134 IC_MATCH_FL_HCIBUS,
135 .lmp_subver = RTL_ROM_LMP_8703B,
136 .chip_type = RTL_CHIP_8723CS_VF,
137 .hci_bus = HCI_UART,
138 .config_needed = true,
139 .has_rom_version = true,
140 .fw_name = "rtl_bt/rtl8723cs_vf_fw.bin",
141 .cfg_name = "rtl_bt/rtl8723cs_vf_config" },
142
143 /* 8723CS-XX */
144 { .match_flags = IC_MATCH_FL_LMPSUBV | IC_MATCH_FL_CHIP_TYPE |
145 IC_MATCH_FL_HCIBUS,
146 .lmp_subver = RTL_ROM_LMP_8703B,
147 .chip_type = RTL_CHIP_8723CS_XX,
148 .hci_bus = HCI_UART,
149 .config_needed = true,
150 .has_rom_version = true,
151 .fw_name = "rtl_bt/rtl8723cs_xx_fw.bin",
152 .cfg_name = "rtl_bt/rtl8723cs_xx_config" },
153
154 /* 8723D */
155 { IC_INFO(RTL_ROM_LMP_8723B, 0xd, 0x8, HCI_USB),
156 .config_needed = true,
157 .has_rom_version = true,
158 .fw_name = "rtl_bt/rtl8723d_fw.bin",
159 .cfg_name = "rtl_bt/rtl8723d_config" },
160
161 /* 8723DS */
162 { IC_INFO(RTL_ROM_LMP_8723B, 0xd, 0x8, HCI_UART),
163 .config_needed = true,
164 .has_rom_version = true,
165 .fw_name = "rtl_bt/rtl8723ds_fw.bin",
166 .cfg_name = "rtl_bt/rtl8723ds_config" },
167
168 /* 8821A */
169 { IC_INFO(RTL_ROM_LMP_8821A, 0xa, 0x6, HCI_USB),
170 .config_needed = false,
171 .has_rom_version = true,
172 .fw_name = "rtl_bt/rtl8821a_fw.bin",
173 .cfg_name = "rtl_bt/rtl8821a_config" },
174
175 /* 8821C */
176 { IC_INFO(RTL_ROM_LMP_8821A, 0xc, 0x8, HCI_USB),
177 .config_needed = false,
178 .has_rom_version = true,
179 .has_msft_ext = true,
180 .fw_name = "rtl_bt/rtl8821c_fw.bin",
181 .cfg_name = "rtl_bt/rtl8821c_config" },
182
183 /* 8821CS */
184 { IC_INFO(RTL_ROM_LMP_8821A, 0xc, 0x8, HCI_UART),
185 .config_needed = true,
186 .has_rom_version = true,
187 .has_msft_ext = true,
188 .fw_name = "rtl_bt/rtl8821cs_fw.bin",
189 .cfg_name = "rtl_bt/rtl8821cs_config" },
190
191 /* 8761A */
192 { IC_INFO(RTL_ROM_LMP_8761A, 0xa, 0x6, HCI_USB),
193 .config_needed = false,
194 .has_rom_version = true,
195 .fw_name = "rtl_bt/rtl8761a_fw.bin",
196 .cfg_name = "rtl_bt/rtl8761a_config" },
197
198 /* 8761B */
199 { IC_INFO(RTL_ROM_LMP_8761A, 0xb, 0xa, HCI_UART),
200 .config_needed = false,
201 .has_rom_version = true,
202 .has_msft_ext = true,
203 .fw_name = "rtl_bt/rtl8761b_fw.bin",
204 .cfg_name = "rtl_bt/rtl8761b_config" },
205
206 /* 8761BU */
207 { IC_INFO(RTL_ROM_LMP_8761A, 0xb, 0xa, HCI_USB),
208 .config_needed = false,
209 .has_rom_version = true,
210 .fw_name = "rtl_bt/rtl8761bu_fw.bin",
211 .cfg_name = "rtl_bt/rtl8761bu_config" },
212
213 /* 8822C with UART interface */
214 { IC_INFO(RTL_ROM_LMP_8822B, 0xc, 0x8, HCI_UART),
215 .config_needed = true,
216 .has_rom_version = true,
217 .has_msft_ext = true,
218 .fw_name = "rtl_bt/rtl8822cs_fw.bin",
219 .cfg_name = "rtl_bt/rtl8822cs_config" },
220
221 /* 8822C with UART interface */
222 { IC_INFO(RTL_ROM_LMP_8822B, 0xc, 0xa, HCI_UART),
223 .config_needed = true,
224 .has_rom_version = true,
225 .has_msft_ext = true,
226 .fw_name = "rtl_bt/rtl8822cs_fw.bin",
227 .cfg_name = "rtl_bt/rtl8822cs_config" },
228
229 /* 8822C with USB interface */
230 { IC_INFO(RTL_ROM_LMP_8822B, 0xc, 0xa, HCI_USB),
231 .config_needed = false,
232 .has_rom_version = true,
233 .has_msft_ext = true,
234 .fw_name = "rtl_bt/rtl8822cu_fw.bin",
235 .cfg_name = "rtl_bt/rtl8822cu_config" },
236
237 /* 8822B */
238 { IC_INFO(RTL_ROM_LMP_8822B, 0xb, 0x7, HCI_USB),
239 .config_needed = true,
240 .has_rom_version = true,
241 .has_msft_ext = true,
242 .fw_name = "rtl_bt/rtl8822b_fw.bin",
243 .cfg_name = "rtl_bt/rtl8822b_config" },
244
245 /* 8852A */
246 { IC_INFO(RTL_ROM_LMP_8852A, 0xa, 0xb, HCI_USB),
247 .config_needed = false,
248 .has_rom_version = true,
249 .has_msft_ext = true,
250 .fw_name = "rtl_bt/rtl8852au_fw.bin",
251 .cfg_name = "rtl_bt/rtl8852au_config" },
252
253 /* 8852B with UART interface */
254 { IC_INFO(RTL_ROM_LMP_8852A, 0xb, 0xb, HCI_UART),
255 .config_needed = true,
256 .has_rom_version = true,
257 .has_msft_ext = true,
258 .fw_name = "rtl_bt/rtl8852bs_fw.bin",
259 .cfg_name = "rtl_bt/rtl8852bs_config" },
260
261 /* 8852B */
262 { IC_INFO(RTL_ROM_LMP_8852A, 0xb, 0xb, HCI_USB),
263 .config_needed = false,
264 .has_rom_version = true,
265 .has_msft_ext = true,
266 .fw_name = "rtl_bt/rtl8852bu_fw.bin",
267 .cfg_name = "rtl_bt/rtl8852bu_config" },
268
269 /* 8852C */
270 { IC_INFO(RTL_ROM_LMP_8852A, 0xc, 0xc, HCI_USB),
271 .config_needed = false,
272 .has_rom_version = true,
273 .has_msft_ext = true,
274 .fw_name = "rtl_bt/rtl8852cu_fw.bin",
275 .cfg_name = "rtl_bt/rtl8852cu_config" },
276
277 /* 8851B */
278 { IC_INFO(RTL_ROM_LMP_8851B, 0xb, 0xc, HCI_USB),
279 .config_needed = false,
280 .has_rom_version = true,
281 .has_msft_ext = false,
282 .fw_name = "rtl_bt/rtl8851bu_fw.bin",
283 .cfg_name = "rtl_bt/rtl8851bu_config" },
284 };
285
286static const struct id_table *btrtl_match_ic(u16 lmp_subver, u16 hci_rev,
287 u8 hci_ver, u8 hci_bus,
288 u8 chip_type)
289{
290 int i;
291
292 for (i = 0; i < ARRAY_SIZE(ic_id_table); i++) {
293 if ((ic_id_table[i].match_flags & IC_MATCH_FL_LMPSUBV) &&
294 (ic_id_table[i].lmp_subver != lmp_subver))
295 continue;
296 if ((ic_id_table[i].match_flags & IC_MATCH_FL_HCIREV) &&
297 (ic_id_table[i].hci_rev != hci_rev))
298 continue;
299 if ((ic_id_table[i].match_flags & IC_MATCH_FL_HCIVER) &&
300 (ic_id_table[i].hci_ver != hci_ver))
301 continue;
302 if ((ic_id_table[i].match_flags & IC_MATCH_FL_HCIBUS) &&
303 (ic_id_table[i].hci_bus != hci_bus))
304 continue;
305 if ((ic_id_table[i].match_flags & IC_MATCH_FL_CHIP_TYPE) &&
306 (ic_id_table[i].chip_type != chip_type))
307 continue;
308
309 break;
310 }
311 if (i >= ARRAY_SIZE(ic_id_table))
312 return NULL;
313
314 return &ic_id_table[i];
315}
316
317static struct sk_buff *btrtl_read_local_version(struct hci_dev *hdev)
318{
319 struct sk_buff *skb;
320
321 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
322 HCI_INIT_TIMEOUT);
323 if (IS_ERR(skb)) {
324 rtl_dev_err(hdev, "HCI_OP_READ_LOCAL_VERSION failed (%ld)",
325 PTR_ERR(skb));
326 return skb;
327 }
328
329 if (skb->len != sizeof(struct hci_rp_read_local_version)) {
330 rtl_dev_err(hdev, "HCI_OP_READ_LOCAL_VERSION event length mismatch");
331 kfree_skb(skb);
332 return ERR_PTR(-EIO);
333 }
334
335 return skb;
336}
337
338static int rtl_read_rom_version(struct hci_dev *hdev, u8 *version)
339{
340 struct rtl_rom_version_evt *rom_version;
341 struct sk_buff *skb;
342
343 /* Read RTL ROM version command */
344 skb = __hci_cmd_sync(hdev, 0xfc6d, 0, NULL, HCI_INIT_TIMEOUT);
345 if (IS_ERR(skb)) {
346 rtl_dev_err(hdev, "Read ROM version failed (%ld)",
347 PTR_ERR(skb));
348 return PTR_ERR(skb);
349 }
350
351 if (skb->len != sizeof(*rom_version)) {
352 rtl_dev_err(hdev, "version event length mismatch");
353 kfree_skb(skb);
354 return -EIO;
355 }
356
357 rom_version = (struct rtl_rom_version_evt *)skb->data;
358 rtl_dev_info(hdev, "rom_version status=%x version=%x",
359 rom_version->status, rom_version->version);
360
361 *version = rom_version->version;
362
363 kfree_skb(skb);
364 return 0;
365}
366
367static int btrtl_vendor_read_reg16(struct hci_dev *hdev,
368 struct rtl_vendor_cmd *cmd, u8 *rp)
369{
370 struct sk_buff *skb;
371 int err = 0;
372
373 skb = __hci_cmd_sync(hdev, 0xfc61, sizeof(*cmd), cmd,
374 HCI_INIT_TIMEOUT);
375 if (IS_ERR(skb)) {
376 err = PTR_ERR(skb);
377 rtl_dev_err(hdev, "RTL: Read reg16 failed (%d)", err);
378 return err;
379 }
380
381 if (skb->len != 3 || skb->data[0]) {
382 bt_dev_err(hdev, "RTL: Read reg16 length mismatch");
383 kfree_skb(skb);
384 return -EIO;
385 }
386
387 if (rp)
388 memcpy(rp, skb->data + 1, 2);
389
390 kfree_skb(skb);
391
392 return 0;
393}
394
395static void *rtl_iov_pull_data(struct rtl_iovec *iov, u32 len)
396{
397 void *data = iov->data;
398
399 if (iov->len < len)
400 return NULL;
401
402 iov->data += len;
403 iov->len -= len;
404
405 return data;
406}
407
408static void btrtl_insert_ordered_subsec(struct rtl_subsection *node,
409 struct btrtl_device_info *btrtl_dev)
410{
411 struct list_head *pos;
412 struct list_head *next;
413 struct rtl_subsection *subsec;
414
415 list_for_each_safe(pos, next, &btrtl_dev->patch_subsecs) {
416 subsec = list_entry(pos, struct rtl_subsection, list);
417 if (subsec->prio >= node->prio)
418 break;
419 }
420 __list_add(&node->list, pos->prev, pos);
421}
422
423static int btrtl_parse_section(struct hci_dev *hdev,
424 struct btrtl_device_info *btrtl_dev, u32 opcode,
425 u8 *data, u32 len)
426{
427 struct rtl_section_hdr *hdr;
428 struct rtl_subsection *subsec;
429 struct rtl_common_subsec *common_subsec;
430 struct rtl_sec_hdr *sec_hdr;
431 int i;
432 u8 *ptr;
433 u16 num_subsecs;
434 u32 subsec_len;
435 int rc = 0;
436 struct rtl_iovec iov = {
437 .data = data,
438 .len = len,
439 };
440
441 hdr = rtl_iov_pull_data(&iov, sizeof(*hdr));
442 if (!hdr)
443 return -EINVAL;
444 num_subsecs = le16_to_cpu(hdr->num);
445
446 for (i = 0; i < num_subsecs; i++) {
447 common_subsec = rtl_iov_pull_data(&iov, sizeof(*common_subsec));
448 if (!common_subsec)
449 break;
450 subsec_len = le32_to_cpu(common_subsec->len);
451
452 rtl_dev_dbg(hdev, "subsec, eco 0x%02x, len %08x",
453 common_subsec->eco, subsec_len);
454
455 ptr = rtl_iov_pull_data(&iov, subsec_len);
456 if (!ptr)
457 break;
458
459 if (common_subsec->eco != btrtl_dev->rom_version + 1)
460 continue;
461
462 switch (opcode) {
463 case RTL_PATCH_SECURITY_HEADER:
464 sec_hdr = (void *)common_subsec;
465 if (sec_hdr->key_id != btrtl_dev->key_id)
466 continue;
467 break;
468 }
469
470 subsec = kzalloc(sizeof(*subsec), GFP_KERNEL);
471 if (!subsec)
472 return -ENOMEM;
473 subsec->opcode = opcode;
474 subsec->prio = common_subsec->prio;
475 subsec->len = subsec_len;
476 subsec->data = ptr;
477 btrtl_insert_ordered_subsec(subsec, btrtl_dev);
478 rc += subsec_len;
479 }
480
481 return rc;
482}
483
484static int rtlbt_parse_firmware_v2(struct hci_dev *hdev,
485 struct btrtl_device_info *btrtl_dev,
486 unsigned char **_buf)
487{
488 struct rtl_epatch_header_v2 *hdr;
489 int rc;
490 u8 reg_val[2];
491 u8 key_id;
492 u32 num_sections;
493 struct rtl_section *section;
494 struct rtl_subsection *entry, *tmp;
495 u32 section_len;
496 u32 opcode;
497 int len = 0;
498 int i;
499 u8 *ptr;
500 struct rtl_iovec iov = {
501 .data = btrtl_dev->fw_data,
502 .len = btrtl_dev->fw_len - 7, /* Cut the tail */
503 };
504
505 rc = btrtl_vendor_read_reg16(hdev, RTL_SEC_PROJ, reg_val);
506 if (rc < 0)
507 return -EIO;
508 key_id = reg_val[0];
509
510 rtl_dev_dbg(hdev, "%s: key id %u", __func__, key_id);
511
512 btrtl_dev->key_id = key_id;
513
514 hdr = rtl_iov_pull_data(&iov, sizeof(*hdr));
515 if (!hdr)
516 return -EINVAL;
517 num_sections = le32_to_cpu(hdr->num_sections);
518
519 rtl_dev_dbg(hdev, "FW version %08x-%08x", *((u32 *)hdr->fw_version),
520 *((u32 *)(hdr->fw_version + 4)));
521
522 for (i = 0; i < num_sections; i++) {
523 section = rtl_iov_pull_data(&iov, sizeof(*section));
524 if (!section)
525 break;
526 section_len = le32_to_cpu(section->len);
527 opcode = le32_to_cpu(section->opcode);
528
529 rtl_dev_dbg(hdev, "opcode 0x%04x", section->opcode);
530
531 ptr = rtl_iov_pull_data(&iov, section_len);
532 if (!ptr)
533 break;
534
535 switch (opcode) {
536 case RTL_PATCH_SNIPPETS:
537 rc = btrtl_parse_section(hdev, btrtl_dev, opcode,
538 ptr, section_len);
539 break;
540 case RTL_PATCH_SECURITY_HEADER:
541 /* If key_id from chip is zero, ignore all security
542 * headers.
543 */
544 if (!key_id)
545 break;
546 rc = btrtl_parse_section(hdev, btrtl_dev, opcode,
547 ptr, section_len);
548 break;
549 case RTL_PATCH_DUMMY_HEADER:
550 rc = btrtl_parse_section(hdev, btrtl_dev, opcode,
551 ptr, section_len);
552 break;
553 default:
554 rc = 0;
555 break;
556 }
557 if (rc < 0) {
558 rtl_dev_err(hdev, "RTL: Parse section (%u) err %d",
559 opcode, rc);
560 return rc;
561 }
562 len += rc;
563 }
564
565 if (!len)
566 return -ENODATA;
567
568 /* Allocate mem and copy all found subsecs. */
569 ptr = kvmalloc(len, GFP_KERNEL);
570 if (!ptr)
571 return -ENOMEM;
572
573 len = 0;
574 list_for_each_entry_safe(entry, tmp, &btrtl_dev->patch_subsecs, list) {
575 rtl_dev_dbg(hdev, "RTL: opcode %08x, addr %p, len 0x%x",
576 entry->opcode, entry->data, entry->len);
577 memcpy(ptr + len, entry->data, entry->len);
578 len += entry->len;
579 }
580
581 if (!len)
582 return -EPERM;
583
584 *_buf = ptr;
585 return len;
586}
587
588static int rtlbt_parse_firmware(struct hci_dev *hdev,
589 struct btrtl_device_info *btrtl_dev,
590 unsigned char **_buf)
591{
592 static const u8 extension_sig[] = { 0x51, 0x04, 0xfd, 0x77 };
593 struct rtl_epatch_header *epatch_info;
594 unsigned char *buf;
595 int i, len;
596 size_t min_size;
597 u8 opcode, length, data;
598 int project_id = -1;
599 const unsigned char *fwptr, *chip_id_base;
600 const unsigned char *patch_length_base, *patch_offset_base;
601 u32 patch_offset = 0;
602 u16 patch_length, num_patches;
603 static const struct {
604 __u16 lmp_subver;
605 __u8 id;
606 } project_id_to_lmp_subver[] = {
607 { RTL_ROM_LMP_8723A, 0 },
608 { RTL_ROM_LMP_8723B, 1 },
609 { RTL_ROM_LMP_8821A, 2 },
610 { RTL_ROM_LMP_8761A, 3 },
611 { RTL_ROM_LMP_8703B, 7 },
612 { RTL_ROM_LMP_8822B, 8 },
613 { RTL_ROM_LMP_8723B, 9 }, /* 8723D */
614 { RTL_ROM_LMP_8821A, 10 }, /* 8821C */
615 { RTL_ROM_LMP_8822B, 13 }, /* 8822C */
616 { RTL_ROM_LMP_8761A, 14 }, /* 8761B */
617 { RTL_ROM_LMP_8852A, 18 }, /* 8852A */
618 { RTL_ROM_LMP_8852A, 20 }, /* 8852B */
619 { RTL_ROM_LMP_8852A, 25 }, /* 8852C */
620 { RTL_ROM_LMP_8851B, 36 }, /* 8851B */
621 };
622
623 if (btrtl_dev->fw_len <= 8)
624 return -EINVAL;
625
626 if (!memcmp(btrtl_dev->fw_data, RTL_EPATCH_SIGNATURE, 8))
627 min_size = sizeof(struct rtl_epatch_header) +
628 sizeof(extension_sig) + 3;
629 else if (!memcmp(btrtl_dev->fw_data, RTL_EPATCH_SIGNATURE_V2, 8))
630 min_size = sizeof(struct rtl_epatch_header_v2) +
631 sizeof(extension_sig) + 3;
632 else
633 return -EINVAL;
634
635 if (btrtl_dev->fw_len < min_size)
636 return -EINVAL;
637
638 fwptr = btrtl_dev->fw_data + btrtl_dev->fw_len - sizeof(extension_sig);
639 if (memcmp(fwptr, extension_sig, sizeof(extension_sig)) != 0) {
640 rtl_dev_err(hdev, "extension section signature mismatch");
641 return -EINVAL;
642 }
643
644 /* Loop from the end of the firmware parsing instructions, until
645 * we find an instruction that identifies the "project ID" for the
646 * hardware supported by this firwmare file.
647 * Once we have that, we double-check that project_id is suitable
648 * for the hardware we are working with.
649 */
650 while (fwptr >= btrtl_dev->fw_data + (sizeof(*epatch_info) + 3)) {
651 opcode = *--fwptr;
652 length = *--fwptr;
653 data = *--fwptr;
654
655 BT_DBG("check op=%x len=%x data=%x", opcode, length, data);
656
657 if (opcode == 0xff) /* EOF */
658 break;
659
660 if (length == 0) {
661 rtl_dev_err(hdev, "found instruction with length 0");
662 return -EINVAL;
663 }
664
665 if (opcode == 0 && length == 1) {
666 project_id = data;
667 break;
668 }
669
670 fwptr -= length;
671 }
672
673 if (project_id < 0) {
674 rtl_dev_err(hdev, "failed to find version instruction");
675 return -EINVAL;
676 }
677
678 /* Find project_id in table */
679 for (i = 0; i < ARRAY_SIZE(project_id_to_lmp_subver); i++) {
680 if (project_id == project_id_to_lmp_subver[i].id) {
681 btrtl_dev->project_id = project_id;
682 break;
683 }
684 }
685
686 if (i >= ARRAY_SIZE(project_id_to_lmp_subver)) {
687 rtl_dev_err(hdev, "unknown project id %d", project_id);
688 return -EINVAL;
689 }
690
691 if (btrtl_dev->ic_info->lmp_subver !=
692 project_id_to_lmp_subver[i].lmp_subver) {
693 rtl_dev_err(hdev, "firmware is for %x but this is a %x",
694 project_id_to_lmp_subver[i].lmp_subver,
695 btrtl_dev->ic_info->lmp_subver);
696 return -EINVAL;
697 }
698
699 if (memcmp(btrtl_dev->fw_data, RTL_EPATCH_SIGNATURE, 8) != 0) {
700 if (!memcmp(btrtl_dev->fw_data, RTL_EPATCH_SIGNATURE_V2, 8))
701 return rtlbt_parse_firmware_v2(hdev, btrtl_dev, _buf);
702 rtl_dev_err(hdev, "bad EPATCH signature");
703 return -EINVAL;
704 }
705
706 epatch_info = (struct rtl_epatch_header *)btrtl_dev->fw_data;
707 num_patches = le16_to_cpu(epatch_info->num_patches);
708 BT_DBG("fw_version=%x, num_patches=%d",
709 le32_to_cpu(epatch_info->fw_version), num_patches);
710
711 /* After the rtl_epatch_header there is a funky patch metadata section.
712 * Assuming 2 patches, the layout is:
713 * ChipID1 ChipID2 PatchLength1 PatchLength2 PatchOffset1 PatchOffset2
714 *
715 * Find the right patch for this chip.
716 */
717 min_size += 8 * num_patches;
718 if (btrtl_dev->fw_len < min_size)
719 return -EINVAL;
720
721 chip_id_base = btrtl_dev->fw_data + sizeof(struct rtl_epatch_header);
722 patch_length_base = chip_id_base + (sizeof(u16) * num_patches);
723 patch_offset_base = patch_length_base + (sizeof(u16) * num_patches);
724 for (i = 0; i < num_patches; i++) {
725 u16 chip_id = get_unaligned_le16(chip_id_base +
726 (i * sizeof(u16)));
727 if (chip_id == btrtl_dev->rom_version + 1) {
728 patch_length = get_unaligned_le16(patch_length_base +
729 (i * sizeof(u16)));
730 patch_offset = get_unaligned_le32(patch_offset_base +
731 (i * sizeof(u32)));
732 break;
733 }
734 }
735
736 if (!patch_offset) {
737 rtl_dev_err(hdev, "didn't find patch for chip id %d",
738 btrtl_dev->rom_version);
739 return -EINVAL;
740 }
741
742 BT_DBG("length=%x offset=%x index %d", patch_length, patch_offset, i);
743 min_size = patch_offset + patch_length;
744 if (btrtl_dev->fw_len < min_size)
745 return -EINVAL;
746
747 /* Copy the firmware into a new buffer and write the version at
748 * the end.
749 */
750 len = patch_length;
751 buf = kvmalloc(patch_length, GFP_KERNEL);
752 if (!buf)
753 return -ENOMEM;
754
755 memcpy(buf, btrtl_dev->fw_data + patch_offset, patch_length - 4);
756 memcpy(buf + patch_length - 4, &epatch_info->fw_version, 4);
757
758 *_buf = buf;
759 return len;
760}
761
762static int rtl_download_firmware(struct hci_dev *hdev,
763 const unsigned char *data, int fw_len)
764{
765 struct rtl_download_cmd *dl_cmd;
766 int frag_num = fw_len / RTL_FRAG_LEN + 1;
767 int frag_len = RTL_FRAG_LEN;
768 int ret = 0;
769 int i;
770 int j = 0;
771 struct sk_buff *skb;
772 struct hci_rp_read_local_version *rp;
773
774 dl_cmd = kmalloc(sizeof(struct rtl_download_cmd), GFP_KERNEL);
775 if (!dl_cmd)
776 return -ENOMEM;
777
778 for (i = 0; i < frag_num; i++) {
779 struct sk_buff *skb;
780
781 dl_cmd->index = j++;
782 if (dl_cmd->index == 0x7f)
783 j = 1;
784
785 if (i == (frag_num - 1)) {
786 dl_cmd->index |= 0x80; /* data end */
787 frag_len = fw_len % RTL_FRAG_LEN;
788 }
789 rtl_dev_dbg(hdev, "download fw (%d/%d). index = %d", i,
790 frag_num, dl_cmd->index);
791 memcpy(dl_cmd->data, data, frag_len);
792
793 /* Send download command */
794 skb = __hci_cmd_sync(hdev, 0xfc20, frag_len + 1, dl_cmd,
795 HCI_INIT_TIMEOUT);
796 if (IS_ERR(skb)) {
797 rtl_dev_err(hdev, "download fw command failed (%ld)",
798 PTR_ERR(skb));
799 ret = PTR_ERR(skb);
800 goto out;
801 }
802
803 if (skb->len != sizeof(struct rtl_download_response)) {
804 rtl_dev_err(hdev, "download fw event length mismatch");
805 kfree_skb(skb);
806 ret = -EIO;
807 goto out;
808 }
809
810 kfree_skb(skb);
811 data += RTL_FRAG_LEN;
812 }
813
814 skb = btrtl_read_local_version(hdev);
815 if (IS_ERR(skb)) {
816 ret = PTR_ERR(skb);
817 rtl_dev_err(hdev, "read local version failed");
818 goto out;
819 }
820
821 rp = (struct hci_rp_read_local_version *)skb->data;
822 rtl_dev_info(hdev, "fw version 0x%04x%04x",
823 __le16_to_cpu(rp->hci_rev), __le16_to_cpu(rp->lmp_subver));
824 kfree_skb(skb);
825
826out:
827 kfree(dl_cmd);
828 return ret;
829}
830
831static int rtl_load_file(struct hci_dev *hdev, const char *name, u8 **buff)
832{
833 const struct firmware *fw;
834 int ret;
835
836 rtl_dev_info(hdev, "loading %s", name);
837 ret = request_firmware(&fw, name, &hdev->dev);
838 if (ret < 0)
839 return ret;
840 ret = fw->size;
841 *buff = kvmalloc(fw->size, GFP_KERNEL);
842 if (*buff)
843 memcpy(*buff, fw->data, ret);
844 else
845 ret = -ENOMEM;
846
847 release_firmware(fw);
848
849 return ret;
850}
851
852static int btrtl_setup_rtl8723a(struct hci_dev *hdev,
853 struct btrtl_device_info *btrtl_dev)
854{
855 if (btrtl_dev->fw_len < 8)
856 return -EINVAL;
857
858 /* Check that the firmware doesn't have the epatch signature
859 * (which is only for RTL8723B and newer).
860 */
861 if (!memcmp(btrtl_dev->fw_data, RTL_EPATCH_SIGNATURE, 8)) {
862 rtl_dev_err(hdev, "unexpected EPATCH signature!");
863 return -EINVAL;
864 }
865
866 return rtl_download_firmware(hdev, btrtl_dev->fw_data,
867 btrtl_dev->fw_len);
868}
869
870static int btrtl_setup_rtl8723b(struct hci_dev *hdev,
871 struct btrtl_device_info *btrtl_dev)
872{
873 unsigned char *fw_data = NULL;
874 int ret;
875 u8 *tbuff;
876
877 ret = rtlbt_parse_firmware(hdev, btrtl_dev, &fw_data);
878 if (ret < 0)
879 goto out;
880
881 if (btrtl_dev->cfg_len > 0) {
882 tbuff = kvzalloc(ret + btrtl_dev->cfg_len, GFP_KERNEL);
883 if (!tbuff) {
884 ret = -ENOMEM;
885 goto out;
886 }
887
888 memcpy(tbuff, fw_data, ret);
889 kvfree(fw_data);
890
891 memcpy(tbuff + ret, btrtl_dev->cfg_data, btrtl_dev->cfg_len);
892 ret += btrtl_dev->cfg_len;
893
894 fw_data = tbuff;
895 }
896
897 rtl_dev_info(hdev, "cfg_sz %d, total sz %d", btrtl_dev->cfg_len, ret);
898
899 ret = rtl_download_firmware(hdev, fw_data, ret);
900
901out:
902 kvfree(fw_data);
903 return ret;
904}
905
906static bool rtl_has_chip_type(u16 lmp_subver)
907{
908 switch (lmp_subver) {
909 case RTL_ROM_LMP_8703B:
910 return true;
911 default:
912 break;
913 }
914
915 return false;
916}
917
918static int rtl_read_chip_type(struct hci_dev *hdev, u8 *type)
919{
920 struct rtl_chip_type_evt *chip_type;
921 struct sk_buff *skb;
922 const unsigned char cmd_buf[] = {0x00, 0x94, 0xa0, 0x00, 0xb0};
923
924 /* Read RTL chip type command */
925 skb = __hci_cmd_sync(hdev, 0xfc61, 5, cmd_buf, HCI_INIT_TIMEOUT);
926 if (IS_ERR(skb)) {
927 rtl_dev_err(hdev, "Read chip type failed (%ld)",
928 PTR_ERR(skb));
929 return PTR_ERR(skb);
930 }
931
932 chip_type = skb_pull_data(skb, sizeof(*chip_type));
933 if (!chip_type) {
934 rtl_dev_err(hdev, "RTL chip type event length mismatch");
935 kfree_skb(skb);
936 return -EIO;
937 }
938
939 rtl_dev_info(hdev, "chip_type status=%x type=%x",
940 chip_type->status, chip_type->type);
941
942 *type = chip_type->type & 0x0f;
943
944 kfree_skb(skb);
945 return 0;
946}
947
948void btrtl_free(struct btrtl_device_info *btrtl_dev)
949{
950 struct rtl_subsection *entry, *tmp;
951
952 kvfree(btrtl_dev->fw_data);
953 kvfree(btrtl_dev->cfg_data);
954
955 list_for_each_entry_safe(entry, tmp, &btrtl_dev->patch_subsecs, list) {
956 list_del(&entry->list);
957 kfree(entry);
958 }
959
960 kfree(btrtl_dev);
961}
962EXPORT_SYMBOL_GPL(btrtl_free);
963
964struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev,
965 const char *postfix)
966{
967 struct btrtl_device_info *btrtl_dev;
968 struct sk_buff *skb;
969 struct hci_rp_read_local_version *resp;
970 char cfg_name[40];
971 u16 hci_rev, lmp_subver;
972 u8 hci_ver, lmp_ver, chip_type = 0;
973 int ret;
974 u16 opcode;
975 u8 cmd[2];
976 u8 reg_val[2];
977
978 btrtl_dev = kzalloc(sizeof(*btrtl_dev), GFP_KERNEL);
979 if (!btrtl_dev) {
980 ret = -ENOMEM;
981 goto err_alloc;
982 }
983
984 INIT_LIST_HEAD(&btrtl_dev->patch_subsecs);
985
986check_version:
987 ret = btrtl_vendor_read_reg16(hdev, RTL_CHIP_SUBVER, reg_val);
988 if (ret < 0)
989 goto err_free;
990 lmp_subver = get_unaligned_le16(reg_val);
991
992 if (lmp_subver == RTL_ROM_LMP_8822B) {
993 ret = btrtl_vendor_read_reg16(hdev, RTL_CHIP_REV, reg_val);
994 if (ret < 0)
995 goto err_free;
996 hci_rev = get_unaligned_le16(reg_val);
997
998 /* 8822E */
999 if (hci_rev == 0x000e) {
1000 hci_ver = 0x0c;
1001 lmp_ver = 0x0c;
1002 btrtl_dev->ic_info = btrtl_match_ic(lmp_subver, hci_rev,
1003 hci_ver, hdev->bus,
1004 chip_type);
1005 goto next;
1006 }
1007 }
1008
1009 skb = btrtl_read_local_version(hdev);
1010 if (IS_ERR(skb)) {
1011 ret = PTR_ERR(skb);
1012 goto err_free;
1013 }
1014
1015 resp = (struct hci_rp_read_local_version *)skb->data;
1016
1017 hci_ver = resp->hci_ver;
1018 hci_rev = le16_to_cpu(resp->hci_rev);
1019 lmp_ver = resp->lmp_ver;
1020 lmp_subver = le16_to_cpu(resp->lmp_subver);
1021
1022 kfree_skb(skb);
1023
1024 if (rtl_has_chip_type(lmp_subver)) {
1025 ret = rtl_read_chip_type(hdev, &chip_type);
1026 if (ret)
1027 goto err_free;
1028 }
1029
1030 btrtl_dev->ic_info = btrtl_match_ic(lmp_subver, hci_rev, hci_ver,
1031 hdev->bus, chip_type);
1032
1033next:
1034 rtl_dev_info(hdev, "examining hci_ver=%02x hci_rev=%04x lmp_ver=%02x lmp_subver=%04x",
1035 hci_ver, hci_rev,
1036 lmp_ver, lmp_subver);
1037
1038 if (!btrtl_dev->ic_info && !btrtl_dev->drop_fw)
1039 btrtl_dev->drop_fw = true;
1040 else
1041 btrtl_dev->drop_fw = false;
1042
1043 if (btrtl_dev->drop_fw) {
1044 opcode = hci_opcode_pack(0x3f, 0x66);
1045 cmd[0] = opcode & 0xff;
1046 cmd[1] = opcode >> 8;
1047
1048 skb = bt_skb_alloc(sizeof(cmd), GFP_KERNEL);
1049 if (!skb)
1050 goto err_free;
1051
1052 skb_put_data(skb, cmd, sizeof(cmd));
1053 hci_skb_pkt_type(skb) = HCI_COMMAND_PKT;
1054
1055 ret = hdev->send(hdev, skb);
1056 if (ret < 0) {
1057 bt_dev_err(hdev, "sending frame failed (%d)", ret);
1058 kfree_skb(skb);
1059 goto err_free;
1060 }
1061
1062 /* Ensure the above vendor command is sent to controller and
1063 * process has done.
1064 */
1065 msleep(200);
1066
1067 goto check_version;
1068 }
1069
1070 if (!btrtl_dev->ic_info) {
1071 rtl_dev_info(hdev, "unknown IC info, lmp subver %04x, hci rev %04x, hci ver %04x",
1072 lmp_subver, hci_rev, hci_ver);
1073 return btrtl_dev;
1074 }
1075
1076 if (btrtl_dev->ic_info->has_rom_version) {
1077 ret = rtl_read_rom_version(hdev, &btrtl_dev->rom_version);
1078 if (ret)
1079 goto err_free;
1080 }
1081
1082 btrtl_dev->fw_len = rtl_load_file(hdev, btrtl_dev->ic_info->fw_name,
1083 &btrtl_dev->fw_data);
1084 if (btrtl_dev->fw_len < 0) {
1085 rtl_dev_err(hdev, "firmware file %s not found",
1086 btrtl_dev->ic_info->fw_name);
1087 ret = btrtl_dev->fw_len;
1088 goto err_free;
1089 }
1090
1091 if (btrtl_dev->ic_info->cfg_name) {
1092 if (postfix) {
1093 snprintf(cfg_name, sizeof(cfg_name), "%s-%s.bin",
1094 btrtl_dev->ic_info->cfg_name, postfix);
1095 } else {
1096 snprintf(cfg_name, sizeof(cfg_name), "%s.bin",
1097 btrtl_dev->ic_info->cfg_name);
1098 }
1099 btrtl_dev->cfg_len = rtl_load_file(hdev, cfg_name,
1100 &btrtl_dev->cfg_data);
1101 if (btrtl_dev->ic_info->config_needed &&
1102 btrtl_dev->cfg_len <= 0) {
1103 rtl_dev_err(hdev, "mandatory config file %s not found",
1104 btrtl_dev->ic_info->cfg_name);
1105 ret = btrtl_dev->cfg_len;
1106 goto err_free;
1107 }
1108 }
1109
1110 /* The following chips supports the Microsoft vendor extension,
1111 * therefore set the corresponding VsMsftOpCode.
1112 */
1113 if (btrtl_dev->ic_info->has_msft_ext)
1114 hci_set_msft_opcode(hdev, 0xFCF0);
1115
1116 return btrtl_dev;
1117
1118err_free:
1119 btrtl_free(btrtl_dev);
1120err_alloc:
1121 return ERR_PTR(ret);
1122}
1123EXPORT_SYMBOL_GPL(btrtl_initialize);
1124
1125int btrtl_download_firmware(struct hci_dev *hdev,
1126 struct btrtl_device_info *btrtl_dev)
1127{
1128 /* Match a set of subver values that correspond to stock firmware,
1129 * which is not compatible with standard btusb.
1130 * If matched, upload an alternative firmware that does conform to
1131 * standard btusb. Once that firmware is uploaded, the subver changes
1132 * to a different value.
1133 */
1134 if (!btrtl_dev->ic_info) {
1135 rtl_dev_info(hdev, "assuming no firmware upload needed");
1136 return 0;
1137 }
1138
1139 switch (btrtl_dev->ic_info->lmp_subver) {
1140 case RTL_ROM_LMP_8723A:
1141 return btrtl_setup_rtl8723a(hdev, btrtl_dev);
1142 case RTL_ROM_LMP_8723B:
1143 case RTL_ROM_LMP_8821A:
1144 case RTL_ROM_LMP_8761A:
1145 case RTL_ROM_LMP_8822B:
1146 case RTL_ROM_LMP_8852A:
1147 case RTL_ROM_LMP_8703B:
1148 case RTL_ROM_LMP_8851B:
1149 return btrtl_setup_rtl8723b(hdev, btrtl_dev);
1150 default:
1151 rtl_dev_info(hdev, "assuming no firmware upload needed");
1152 return 0;
1153 }
1154}
1155EXPORT_SYMBOL_GPL(btrtl_download_firmware);
1156
1157void btrtl_set_quirks(struct hci_dev *hdev, struct btrtl_device_info *btrtl_dev)
1158{
1159 /* Enable controller to do both LE scan and BR/EDR inquiry
1160 * simultaneously.
1161 */
1162 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
1163
1164 /* Enable central-peripheral role (able to create new connections with
1165 * an existing connection in slave role).
1166 */
1167 /* Enable WBS supported for the specific Realtek devices. */
1168 switch (btrtl_dev->project_id) {
1169 case CHIP_ID_8822C:
1170 case CHIP_ID_8852A:
1171 case CHIP_ID_8852B:
1172 case CHIP_ID_8852C:
1173 case CHIP_ID_8851B:
1174 set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks);
1175 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks);
1176
1177 /* RTL8852C needs to transmit mSBC data continuously without
1178 * the zero length of USB packets for the ALT 6 supported chips
1179 */
1180 if (btrtl_dev->project_id == CHIP_ID_8852C)
1181 btrealtek_set_flag(hdev, REALTEK_ALT6_CONTINUOUS_TX_CHIP);
1182
1183 hci_set_aosp_capable(hdev);
1184 break;
1185 default:
1186 rtl_dev_dbg(hdev, "Central-peripheral role not enabled.");
1187 rtl_dev_dbg(hdev, "WBS supported not enabled.");
1188 break;
1189 }
1190
1191 if (!btrtl_dev->ic_info)
1192 return;
1193
1194 switch (btrtl_dev->ic_info->lmp_subver) {
1195 case RTL_ROM_LMP_8703B:
1196 /* 8723CS reports two pages for local ext features,
1197 * but it doesn't support any features from page 2 -
1198 * it either responds with garbage or with error status
1199 */
1200 set_bit(HCI_QUIRK_BROKEN_LOCAL_EXT_FEATURES_PAGE_2,
1201 &hdev->quirks);
1202 break;
1203 default:
1204 break;
1205 }
1206}
1207EXPORT_SYMBOL_GPL(btrtl_set_quirks);
1208
1209int btrtl_setup_realtek(struct hci_dev *hdev)
1210{
1211 struct btrtl_device_info *btrtl_dev;
1212 int ret;
1213
1214 btrtl_dev = btrtl_initialize(hdev, NULL);
1215 if (IS_ERR(btrtl_dev))
1216 return PTR_ERR(btrtl_dev);
1217
1218 ret = btrtl_download_firmware(hdev, btrtl_dev);
1219
1220 btrtl_set_quirks(hdev, btrtl_dev);
1221
1222 btrtl_free(btrtl_dev);
1223 return ret;
1224}
1225EXPORT_SYMBOL_GPL(btrtl_setup_realtek);
1226
1227int btrtl_shutdown_realtek(struct hci_dev *hdev)
1228{
1229 struct sk_buff *skb;
1230 int ret;
1231
1232 /* According to the vendor driver, BT must be reset on close to avoid
1233 * firmware crash.
1234 */
1235 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
1236 if (IS_ERR(skb)) {
1237 ret = PTR_ERR(skb);
1238 bt_dev_err(hdev, "HCI reset during shutdown failed");
1239 return ret;
1240 }
1241 kfree_skb(skb);
1242
1243 return 0;
1244}
1245EXPORT_SYMBOL_GPL(btrtl_shutdown_realtek);
1246
1247static unsigned int btrtl_convert_baudrate(u32 device_baudrate)
1248{
1249 switch (device_baudrate) {
1250 case 0x0252a00a:
1251 return 230400;
1252
1253 case 0x05f75004:
1254 return 921600;
1255
1256 case 0x00005004:
1257 return 1000000;
1258
1259 case 0x04928002:
1260 case 0x01128002:
1261 return 1500000;
1262
1263 case 0x00005002:
1264 return 2000000;
1265
1266 case 0x0000b001:
1267 return 2500000;
1268
1269 case 0x04928001:
1270 return 3000000;
1271
1272 case 0x052a6001:
1273 return 3500000;
1274
1275 case 0x00005001:
1276 return 4000000;
1277
1278 case 0x0252c014:
1279 default:
1280 return 115200;
1281 }
1282}
1283
1284int btrtl_get_uart_settings(struct hci_dev *hdev,
1285 struct btrtl_device_info *btrtl_dev,
1286 unsigned int *controller_baudrate,
1287 u32 *device_baudrate, bool *flow_control)
1288{
1289 struct rtl_vendor_config *config;
1290 struct rtl_vendor_config_entry *entry;
1291 int i, total_data_len;
1292 bool found = false;
1293
1294 total_data_len = btrtl_dev->cfg_len - sizeof(*config);
1295 if (total_data_len <= 0) {
1296 rtl_dev_warn(hdev, "no config loaded");
1297 return -EINVAL;
1298 }
1299
1300 config = (struct rtl_vendor_config *)btrtl_dev->cfg_data;
1301 if (le32_to_cpu(config->signature) != RTL_CONFIG_MAGIC) {
1302 rtl_dev_err(hdev, "invalid config magic");
1303 return -EINVAL;
1304 }
1305
1306 if (total_data_len < le16_to_cpu(config->total_len)) {
1307 rtl_dev_err(hdev, "config is too short");
1308 return -EINVAL;
1309 }
1310
1311 for (i = 0; i < total_data_len; ) {
1312 entry = ((void *)config->entry) + i;
1313
1314 switch (le16_to_cpu(entry->offset)) {
1315 case 0xc:
1316 if (entry->len < sizeof(*device_baudrate)) {
1317 rtl_dev_err(hdev, "invalid UART config entry");
1318 return -EINVAL;
1319 }
1320
1321 *device_baudrate = get_unaligned_le32(entry->data);
1322 *controller_baudrate = btrtl_convert_baudrate(
1323 *device_baudrate);
1324
1325 if (entry->len >= 13)
1326 *flow_control = !!(entry->data[12] & BIT(2));
1327 else
1328 *flow_control = false;
1329
1330 found = true;
1331 break;
1332
1333 default:
1334 rtl_dev_dbg(hdev, "skipping config entry 0x%x (len %u)",
1335 le16_to_cpu(entry->offset), entry->len);
1336 break;
1337 }
1338
1339 i += sizeof(*entry) + entry->len;
1340 }
1341
1342 if (!found) {
1343 rtl_dev_err(hdev, "no UART config entry found");
1344 return -ENOENT;
1345 }
1346
1347 rtl_dev_dbg(hdev, "device baudrate = 0x%08x", *device_baudrate);
1348 rtl_dev_dbg(hdev, "controller baudrate = %u", *controller_baudrate);
1349 rtl_dev_dbg(hdev, "flow control %d", *flow_control);
1350
1351 return 0;
1352}
1353EXPORT_SYMBOL_GPL(btrtl_get_uart_settings);
1354
1355MODULE_AUTHOR("Daniel Drake <drake@endlessm.com>");
1356MODULE_DESCRIPTION("Bluetooth support for Realtek devices ver " VERSION);
1357MODULE_VERSION(VERSION);
1358MODULE_LICENSE("GPL");
1359MODULE_FIRMWARE("rtl_bt/rtl8723a_fw.bin");
1360MODULE_FIRMWARE("rtl_bt/rtl8723b_fw.bin");
1361MODULE_FIRMWARE("rtl_bt/rtl8723b_config.bin");
1362MODULE_FIRMWARE("rtl_bt/rtl8723bs_fw.bin");
1363MODULE_FIRMWARE("rtl_bt/rtl8723bs_config.bin");
1364MODULE_FIRMWARE("rtl_bt/rtl8723cs_cg_fw.bin");
1365MODULE_FIRMWARE("rtl_bt/rtl8723cs_cg_config.bin");
1366MODULE_FIRMWARE("rtl_bt/rtl8723cs_vf_fw.bin");
1367MODULE_FIRMWARE("rtl_bt/rtl8723cs_vf_config.bin");
1368MODULE_FIRMWARE("rtl_bt/rtl8723cs_xx_fw.bin");
1369MODULE_FIRMWARE("rtl_bt/rtl8723cs_xx_config.bin");
1370MODULE_FIRMWARE("rtl_bt/rtl8723ds_fw.bin");
1371MODULE_FIRMWARE("rtl_bt/rtl8723ds_config.bin");
1372MODULE_FIRMWARE("rtl_bt/rtl8761a_fw.bin");
1373MODULE_FIRMWARE("rtl_bt/rtl8761a_config.bin");
1374MODULE_FIRMWARE("rtl_bt/rtl8821a_fw.bin");
1375MODULE_FIRMWARE("rtl_bt/rtl8821a_config.bin");
1376MODULE_FIRMWARE("rtl_bt/rtl8822b_fw.bin");
1377MODULE_FIRMWARE("rtl_bt/rtl8822b_config.bin");
1378MODULE_FIRMWARE("rtl_bt/rtl8852au_fw.bin");
1379MODULE_FIRMWARE("rtl_bt/rtl8852au_config.bin");
1380MODULE_FIRMWARE("rtl_bt/rtl8852bs_fw.bin");
1381MODULE_FIRMWARE("rtl_bt/rtl8852bs_config.bin");
1382MODULE_FIRMWARE("rtl_bt/rtl8852bu_fw.bin");
1383MODULE_FIRMWARE("rtl_bt/rtl8852bu_config.bin");
1384MODULE_FIRMWARE("rtl_bt/rtl8852cu_fw.bin");
1385MODULE_FIRMWARE("rtl_bt/rtl8852cu_config.bin");
1386MODULE_FIRMWARE("rtl_bt/rtl8851bu_fw.bin");
1387MODULE_FIRMWARE("rtl_bt/rtl8851bu_config.bin");