drivers/bluetooth/btrtl.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *  Bluetooth support for Realtek devices
   4  *
   5  *  Copyright (C) 2015 Endless Mobile, Inc.
   6  */
   7
   8 #include <linux/module.h>
   9 #include <linux/firmware.h>
  10 #include <asm/unaligned.h>
  11 #include <linux/usb.h>
  12
  13 #include <net/bluetooth/bluetooth.h>
  14 #include <net/bluetooth/hci_core.h>
  15
  16 #include "btrtl.h"
  17
  18 #define VERSION "0.1"
  19
  20 #define RTL_EPATCH_SIGNATURE    "Realtech"
  21 #define RTL_ROM_LMP_3499        0x3499
  22 #define RTL_ROM_LMP_8723A       0x1200
  23 #define RTL_ROM_LMP_8723B       0x8723
  24 #define RTL_ROM_LMP_8723D       0x8873
  25 #define RTL_ROM_LMP_8821A       0x8821
  26 #define RTL_ROM_LMP_8761A       0x8761
  27 #define RTL_ROM_LMP_8822B       0x8822
  28 #define RTL_CONFIG_MAGIC        0x8723ab55
  29
  30 #define IC_MATCH_FL_LMPSUBV     (1 << 0)
  31 #define IC_MATCH_FL_HCIREV      (1 << 1)
  32 #define IC_MATCH_FL_HCIVER      (1 << 2)
  33 #define IC_MATCH_FL_HCIBUS      (1 << 3)
  34 #define IC_INFO(lmps, hcir) \
  35         .match_flags = IC_MATCH_FL_LMPSUBV | IC_MATCH_FL_HCIREV, \
  36         .lmp_subver = (lmps), \
  37         .hci_rev = (hcir)
  38
  39 struct id_table {
  40         __u16 match_flags;
  41         __u16 lmp_subver;
  42         __u16 hci_rev;
  43         __u8 hci_ver;
  44         __u8 hci_bus;
  45         bool config_needed;
  46         bool has_rom_version;
  47         char *fw_name;
  48         char *cfg_name;
  49 };
  50
  51 struct btrtl_device_info {
  52         const struct id_table *ic_info;
  53         u8 rom_version;
  54         u8 *fw_data;
  55         int fw_len;
  56         u8 *cfg_data;
  57         int cfg_len;
  58 };
  59
  60 static const struct id_table ic_id_table[] = {
  61         { IC_MATCH_FL_LMPSUBV, RTL_ROM_LMP_8723A, 0x0,
  62           .config_needed = false,
  63           .has_rom_version = false,
  64           .fw_name = "rtl_bt/rtl8723a_fw.bin",
  65           .cfg_name = NULL },
  66
  67         { IC_MATCH_FL_LMPSUBV, RTL_ROM_LMP_3499, 0x0,
  68           .config_needed = false,
  69           .has_rom_version = false,
  70           .fw_name = "rtl_bt/rtl8723a_fw.bin",
  71           .cfg_name = NULL },
  72
  73         /* 8723BS */
  74         { .match_flags = IC_MATCH_FL_LMPSUBV | IC_MATCH_FL_HCIREV |
  75                          IC_MATCH_FL_HCIVER | IC_MATCH_FL_HCIBUS,
  76           .lmp_subver = RTL_ROM_LMP_8723B,
  77           .hci_rev = 0xb,
  78           .hci_ver = 6,
  79           .hci_bus = HCI_UART,
  80           .config_needed = true,
  81           .has_rom_version = true,
  82           .fw_name  = "rtl_bt/rtl8723bs_fw.bin",
  83           .cfg_name = "rtl_bt/rtl8723bs_config" },
  84
  85         /* 8723B */
  86         { IC_INFO(RTL_ROM_LMP_8723B, 0xb),
  87           .config_needed = false,
  88           .has_rom_version = true,
  89           .fw_name  = "rtl_bt/rtl8723b_fw.bin",
  90           .cfg_name = "rtl_bt/rtl8723b_config" },
  91
  92         /* 8723D */
  93         { IC_INFO(RTL_ROM_LMP_8723B, 0xd),
  94           .config_needed = true,
  95           .has_rom_version = true,
  96           .fw_name  = "rtl_bt/rtl8723d_fw.bin",
  97           .cfg_name = "rtl_bt/rtl8723d_config" },
  98
  99         /* 8723DS */
 100         { .match_flags = IC_MATCH_FL_LMPSUBV | IC_MATCH_FL_HCIREV |
 101                          IC_MATCH_FL_HCIVER | IC_MATCH_FL_HCIBUS,
 102           .lmp_subver = RTL_ROM_LMP_8723B,
 103           .hci_rev = 0xd,
 104           .hci_ver = 8,
 105           .hci_bus = HCI_UART,
 106           .config_needed = true,
 107           .has_rom_version = true,
 108           .fw_name  = "rtl_bt/rtl8723ds_fw.bin",
 109           .cfg_name = "rtl_bt/rtl8723ds_config" },
 110
 111         /* 8723DU */
 112         { IC_INFO(RTL_ROM_LMP_8723D, 0x826C),
 113           .config_needed = true,
 114           .has_rom_version = true,
 115           .fw_name  = "rtl_bt/rtl8723d_fw.bin",
 116           .cfg_name = "rtl_bt/rtl8723d_config" },
 117
 118         /* 8821A */
 119         { IC_INFO(RTL_ROM_LMP_8821A, 0xa),
 120           .config_needed = false,
 121           .has_rom_version = true,
 122           .fw_name  = "rtl_bt/rtl8821a_fw.bin",
 123           .cfg_name = "rtl_bt/rtl8821a_config" },
 124
 125         /* 8821C */
 126         { IC_INFO(RTL_ROM_LMP_8821A, 0xc),
 127           .config_needed = false,
 128           .has_rom_version = true,
 129           .fw_name  = "rtl_bt/rtl8821c_fw.bin",
 130           .cfg_name = "rtl_bt/rtl8821c_config" },
 131
 132         /* 8761A */
 133         { IC_MATCH_FL_LMPSUBV, RTL_ROM_LMP_8761A, 0x0,
 134           .config_needed = false,
 135           .has_rom_version = true,
 136           .fw_name  = "rtl_bt/rtl8761a_fw.bin",
 137           .cfg_name = "rtl_bt/rtl8761a_config" },
 138
 139         /* 8822C with UART interface */
 140         { .match_flags = IC_MATCH_FL_LMPSUBV | IC_MATCH_FL_HCIREV |
 141                          IC_MATCH_FL_HCIBUS,
 142           .lmp_subver = RTL_ROM_LMP_8822B,
 143           .hci_rev = 0x000c,
 144           .hci_ver = 0x0a,
 145           .hci_bus = HCI_UART,
 146           .config_needed = true,
 147           .has_rom_version = true,
 148           .fw_name  = "rtl_bt/rtl8822cs_fw.bin",
 149           .cfg_name = "rtl_bt/rtl8822cs_config" },
 150
 151         /* 8822C with USB interface */
 152         { IC_INFO(RTL_ROM_LMP_8822B, 0xc),
 153           .config_needed = false,
 154           .has_rom_version = true,
 155           .fw_name  = "rtl_bt/rtl8822cu_fw.bin",
 156           .cfg_name = "rtl_bt/rtl8822cu_config" },
 157
 158         /* 8822B */
 159         { IC_INFO(RTL_ROM_LMP_8822B, 0xb),
 160           .config_needed = true,
 161           .has_rom_version = true,
 162           .fw_name  = "rtl_bt/rtl8822b_fw.bin",
 163           .cfg_name = "rtl_bt/rtl8822b_config" },
 164         };
 165
 166 static const struct id_table *btrtl_match_ic(u16 lmp_subver, u16 hci_rev,
 167                                              u8 hci_ver, u8 hci_bus)
 168 {
 169         int i;
 170
 171         for (i = 0; i < ARRAY_SIZE(ic_id_table); i++) {
 172                 if ((ic_id_table[i].match_flags & IC_MATCH_FL_LMPSUBV) &&
 173                     (ic_id_table[i].lmp_subver != lmp_subver))
 174                         continue;
 175                 if ((ic_id_table[i].match_flags & IC_MATCH_FL_HCIREV) &&
 176                     (ic_id_table[i].hci_rev != hci_rev))
 177                         continue;
 178                 if ((ic_id_table[i].match_flags & IC_MATCH_FL_HCIVER) &&
 179                     (ic_id_table[i].hci_ver != hci_ver))
 180                         continue;
 181                 if ((ic_id_table[i].match_flags & IC_MATCH_FL_HCIBUS) &&
 182                     (ic_id_table[i].hci_bus != hci_bus))
 183                         continue;
 184
 185                 break;
 186         }
 187         if (i >= ARRAY_SIZE(ic_id_table))
 188                 return NULL;
 189
 190         return &ic_id_table[i];
 191 }
 192
 193 static struct sk_buff *btrtl_read_local_version(struct hci_dev *hdev)
 194 {
 195         struct sk_buff *skb;
 196
 197         skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
 198                              HCI_INIT_TIMEOUT);
 199         if (IS_ERR(skb)) {
 200                 rtl_dev_err(hdev, "HCI_OP_READ_LOCAL_VERSION failed (%ld)",
 201                             PTR_ERR(skb));
 202                 return skb;
 203         }
 204
 205         if (skb->len != sizeof(struct hci_rp_read_local_version)) {
 206                 rtl_dev_err(hdev, "HCI_OP_READ_LOCAL_VERSION event length mismatch");
 207                 kfree_skb(skb);
 208                 return ERR_PTR(-EIO);
 209         }
 210
 211         return skb;
 212 }
 213
 214 static int rtl_read_rom_version(struct hci_dev *hdev, u8 *version)
 215 {
 216         struct rtl_rom_version_evt *rom_version;
 217         struct sk_buff *skb;
 218
 219         /* Read RTL ROM version command */
 220         skb = __hci_cmd_sync(hdev, 0xfc6d, 0, NULL, HCI_INIT_TIMEOUT);
 221         if (IS_ERR(skb)) {
 222                 rtl_dev_err(hdev, "Read ROM version failed (%ld)",
 223                             PTR_ERR(skb));
 224                 return PTR_ERR(skb);
 225         }
 226
 227         if (skb->len != sizeof(*rom_version)) {
 228                 rtl_dev_err(hdev, "version event length mismatch");
 229                 kfree_skb(skb);
 230                 return -EIO;
 231         }
 232
 233         rom_version = (struct rtl_rom_version_evt *)skb->data;
 234         rtl_dev_info(hdev, "rom_version status=%x version=%x",
 235                      rom_version->status, rom_version->version);
 236
 237         *version = rom_version->version;
 238
 239         kfree_skb(skb);
 240         return 0;
 241 }
 242
 243 static int rtlbt_parse_firmware(struct hci_dev *hdev,
 244                                 struct btrtl_device_info *btrtl_dev,
 245                                 unsigned char **_buf)
 246 {
 247         static const u8 extension_sig[] = { 0x51, 0x04, 0xfd, 0x77 };
 248         struct rtl_epatch_header *epatch_info;
 249         unsigned char *buf;
 250         int i, len;
 251         size_t min_size;
 252         u8 opcode, length, data;
 253         int project_id = -1;
 254         const unsigned char *fwptr, *chip_id_base;
 255         const unsigned char *patch_length_base, *patch_offset_base;
 256         u32 patch_offset = 0;
 257         u16 patch_length, num_patches;
 258         static const struct {
 259                 __u16 lmp_subver;
 260                 __u8 id;
 261         } project_id_to_lmp_subver[] = {
 262                 { RTL_ROM_LMP_8723A, 0 },
 263                 { RTL_ROM_LMP_8723B, 1 },
 264                 { RTL_ROM_LMP_8821A, 2 },
 265                 { RTL_ROM_LMP_8761A, 3 },
 266                 { RTL_ROM_LMP_8822B, 8 },
 267                 { RTL_ROM_LMP_8723B, 9 },       /* 8723D */
 268                 { RTL_ROM_LMP_8821A, 10 },      /* 8821C */
 269                 { RTL_ROM_LMP_8822B, 13 },      /* 8822C */
 270         };
 271
 272         min_size = sizeof(struct rtl_epatch_header) + sizeof(extension_sig) + 3;
 273         if (btrtl_dev->fw_len < min_size)
 274                 return -EINVAL;
 275
 276         fwptr = btrtl_dev->fw_data + btrtl_dev->fw_len - sizeof(extension_sig);
 277         if (memcmp(fwptr, extension_sig, sizeof(extension_sig)) != 0) {
 278                 rtl_dev_err(hdev, "extension section signature mismatch");
 279                 return -EINVAL;
 280         }
 281
 282         /* Loop from the end of the firmware parsing instructions, until
 283          * we find an instruction that identifies the "project ID" for the
 284          * hardware supported by this firwmare file.
 285          * Once we have that, we double-check that that project_id is suitable
 286          * for the hardware we are working with.
 287          */
 288         while (fwptr >= btrtl_dev->fw_data + (sizeof(*epatch_info) + 3)) {
 289                 opcode = *--fwptr;
 290                 length = *--fwptr;
 291                 data = *--fwptr;
 292
 293                 BT_DBG("check op=%x len=%x data=%x", opcode, length, data);
 294
 295                 if (opcode == 0xff) /* EOF */
 296                         break;
 297
 298                 if (length == 0) {
 299                         rtl_dev_err(hdev, "found instruction with length 0");
 300                         return -EINVAL;
 301                 }
 302
 303                 if (opcode == 0 && length == 1) {
 304                         project_id = data;
 305                         break;
 306                 }
 307
 308                 fwptr -= length;
 309         }
 310
 311         if (project_id < 0) {
 312                 rtl_dev_err(hdev, "failed to find version instruction");
 313                 return -EINVAL;
 314         }
 315
 316         /* Find project_id in table */
 317         for (i = 0; i < ARRAY_SIZE(project_id_to_lmp_subver); i++) {
 318                 if (project_id == project_id_to_lmp_subver[i].id)
 319                         break;
 320         }
 321
 322         if (i >= ARRAY_SIZE(project_id_to_lmp_subver)) {
 323                 rtl_dev_err(hdev, "unknown project id %d", project_id);
 324                 return -EINVAL;
 325         }
 326
 327         if (btrtl_dev->ic_info->lmp_subver !=
 328                                 project_id_to_lmp_subver[i].lmp_subver) {
 329                 rtl_dev_err(hdev, "firmware is for %x but this is a %x",
 330                             project_id_to_lmp_subver[i].lmp_subver,
 331                             btrtl_dev->ic_info->lmp_subver);
 332                 return -EINVAL;
 333         }
 334
 335         epatch_info = (struct rtl_epatch_header *)btrtl_dev->fw_data;
 336         if (memcmp(epatch_info->signature, RTL_EPATCH_SIGNATURE, 8) != 0) {
 337                 rtl_dev_err(hdev, "bad EPATCH signature");
 338                 return -EINVAL;
 339         }
 340
 341         num_patches = le16_to_cpu(epatch_info->num_patches);
 342         BT_DBG("fw_version=%x, num_patches=%d",
 343                le32_to_cpu(epatch_info->fw_version), num_patches);
 344
 345         /* After the rtl_epatch_header there is a funky patch metadata section.
 346          * Assuming 2 patches, the layout is:
 347          * ChipID1 ChipID2 PatchLength1 PatchLength2 PatchOffset1 PatchOffset2
 348          *
 349          * Find the right patch for this chip.
 350          */
 351         min_size += 8 * num_patches;
 352         if (btrtl_dev->fw_len < min_size)
 353                 return -EINVAL;
 354
 355         chip_id_base = btrtl_dev->fw_data + sizeof(struct rtl_epatch_header);
 356         patch_length_base = chip_id_base + (sizeof(u16) * num_patches);
 357         patch_offset_base = patch_length_base + (sizeof(u16) * num_patches);
 358         for (i = 0; i < num_patches; i++) {
 359                 u16 chip_id = get_unaligned_le16(chip_id_base +
 360                                                  (i * sizeof(u16)));
 361                 if (chip_id == btrtl_dev->rom_version + 1) {
 362                         patch_length = get_unaligned_le16(patch_length_base +
 363                                                           (i * sizeof(u16)));
 364                         patch_offset = get_unaligned_le32(patch_offset_base +
 365                                                           (i * sizeof(u32)));
 366                         break;
 367                 }
 368         }
 369
 370         if (!patch_offset) {
 371                 rtl_dev_err(hdev, "didn't find patch for chip id %d",
 372                             btrtl_dev->rom_version);
 373                 return -EINVAL;
 374         }
 375
 376         BT_DBG("length=%x offset=%x index %d", patch_length, patch_offset, i);
 377         min_size = patch_offset + patch_length;
 378         if (btrtl_dev->fw_len < min_size)
 379                 return -EINVAL;
 380
 381         /* Copy the firmware into a new buffer and write the version at
 382          * the end.
 383          */
 384         len = patch_length;
 385         buf = kvmalloc(patch_length, GFP_KERNEL);
 386         if (!buf)
 387                 return -ENOMEM;
 388
 389         memcpy(buf, btrtl_dev->fw_data + patch_offset, patch_length - 4);
 390         memcpy(buf + patch_length - 4, &epatch_info->fw_version, 4);
 391
 392         *_buf = buf;
 393         return len;
 394 }
 395
 396 static int rtl_download_firmware(struct hci_dev *hdev,
 397                                  const unsigned char *data, int fw_len)
 398 {
 399         struct rtl_download_cmd *dl_cmd;
 400         int frag_num = fw_len / RTL_FRAG_LEN + 1;
 401         int frag_len = RTL_FRAG_LEN;
 402         int ret = 0;
 403         int i;
 404         struct sk_buff *skb;
 405         struct hci_rp_read_local_version *rp;
 406
 407         dl_cmd = kmalloc(sizeof(struct rtl_download_cmd), GFP_KERNEL);
 408         if (!dl_cmd)
 409                 return -ENOMEM;
 410
 411         for (i = 0; i < frag_num; i++) {
 412                 struct sk_buff *skb;
 413
 414                 BT_DBG("download fw (%d/%d)", i, frag_num);
 415
 416                 if (i > 0x7f)
 417                         dl_cmd->index = (i & 0x7f) + 1;
 418                 else
 419                         dl_cmd->index = i;
 420
 421                 if (i == (frag_num - 1)) {
 422                         dl_cmd->index |= 0x80; /* data end */
 423                         frag_len = fw_len % RTL_FRAG_LEN;
 424                 }
 425                 memcpy(dl_cmd->data, data, frag_len);
 426
 427                 /* Send download command */
 428                 skb = __hci_cmd_sync(hdev, 0xfc20, frag_len + 1, dl_cmd,
 429                                      HCI_INIT_TIMEOUT);
 430                 if (IS_ERR(skb)) {
 431                         rtl_dev_err(hdev, "download fw command failed (%ld)",
 432                                     PTR_ERR(skb));
 433                         ret = PTR_ERR(skb);
 434                         goto out;
 435                 }
 436
 437                 if (skb->len != sizeof(struct rtl_download_response)) {
 438                         rtl_dev_err(hdev, "download fw event length mismatch");
 439                         kfree_skb(skb);
 440                         ret = -EIO;
 441                         goto out;
 442                 }
 443
 444                 kfree_skb(skb);
 445                 data += RTL_FRAG_LEN;
 446         }
 447
 448         skb = btrtl_read_local_version(hdev);
 449         if (IS_ERR(skb)) {
 450                 ret = PTR_ERR(skb);
 451                 rtl_dev_err(hdev, "read local version failed");
 452                 goto out;
 453         }
 454
 455         rp = (struct hci_rp_read_local_version *)skb->data;
 456         rtl_dev_info(hdev, "fw version 0x%04x%04x",
 457                      __le16_to_cpu(rp->hci_rev), __le16_to_cpu(rp->lmp_subver));
 458         kfree_skb(skb);
 459
 460 out:
 461         kfree(dl_cmd);
 462         return ret;
 463 }
 464
 465 static int rtl_load_file(struct hci_dev *hdev, const char *name, u8 **buff)
 466 {
 467         const struct firmware *fw;
 468         int ret;
 469
 470         rtl_dev_info(hdev, "loading %s", name);
 471         ret = request_firmware(&fw, name, &hdev->dev);
 472         if (ret < 0)
 473                 return ret;
 474         ret = fw->size;
 475         *buff = kvmalloc(fw->size, GFP_KERNEL);
 476         if (*buff)
 477                 memcpy(*buff, fw->data, ret);
 478         else
 479                 ret = -ENOMEM;
 480
 481         release_firmware(fw);
 482
 483         return ret;
 484 }
 485
 486 static int btrtl_setup_rtl8723a(struct hci_dev *hdev,
 487                                 struct btrtl_device_info *btrtl_dev)
 488 {
 489         if (btrtl_dev->fw_len < 8)
 490                 return -EINVAL;
 491
 492         /* Check that the firmware doesn't have the epatch signature
 493          * (which is only for RTL8723B and newer).
 494          */
 495         if (!memcmp(btrtl_dev->fw_data, RTL_EPATCH_SIGNATURE, 8)) {
 496                 rtl_dev_err(hdev, "unexpected EPATCH signature!");
 497                 return -EINVAL;
 498         }
 499
 500         return rtl_download_firmware(hdev, btrtl_dev->fw_data,
 501                                      btrtl_dev->fw_len);
 502 }
 503
 504 static int btrtl_setup_rtl8723b(struct hci_dev *hdev,
 505                                 struct btrtl_device_info *btrtl_dev)
 506 {
 507         unsigned char *fw_data = NULL;
 508         int ret;
 509         u8 *tbuff;
 510
 511         ret = rtlbt_parse_firmware(hdev, btrtl_dev, &fw_data);
 512         if (ret < 0)
 513                 goto out;
 514
 515         if (btrtl_dev->cfg_len > 0) {
 516                 tbuff = kvzalloc(ret + btrtl_dev->cfg_len, GFP_KERNEL);
 517                 if (!tbuff) {
 518                         ret = -ENOMEM;
 519                         goto out;
 520                 }
 521
 522                 memcpy(tbuff, fw_data, ret);
 523                 kvfree(fw_data);
 524
 525                 memcpy(tbuff + ret, btrtl_dev->cfg_data, btrtl_dev->cfg_len);
 526                 ret += btrtl_dev->cfg_len;
 527
 528                 fw_data = tbuff;
 529         }
 530
 531         rtl_dev_info(hdev, "cfg_sz %d, total sz %d", btrtl_dev->cfg_len, ret);
 532
 533         ret = rtl_download_firmware(hdev, fw_data, ret);
 534
 535 out:
 536         kvfree(fw_data);
 537         return ret;
 538 }
 539
 540 void btrtl_free(struct btrtl_device_info *btrtl_dev)
 541 {
 542         kvfree(btrtl_dev->fw_data);
 543         kvfree(btrtl_dev->cfg_data);
 544         kfree(btrtl_dev);
 545 }
 546 EXPORT_SYMBOL_GPL(btrtl_free);
 547
 548 struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev,
 549                                            const char *postfix)
 550 {
 551         struct btrtl_device_info *btrtl_dev;
 552         struct sk_buff *skb;
 553         struct hci_rp_read_local_version *resp;
 554         char cfg_name[40];
 555         u16 hci_rev, lmp_subver;
 556         u8 hci_ver;
 557         int ret;
 558
 559         btrtl_dev = kzalloc(sizeof(*btrtl_dev), GFP_KERNEL);
 560         if (!btrtl_dev) {
 561                 ret = -ENOMEM;
 562                 goto err_alloc;
 563         }
 564
 565         skb = btrtl_read_local_version(hdev);
 566         if (IS_ERR(skb)) {
 567                 ret = PTR_ERR(skb);
 568                 goto err_free;
 569         }
 570
 571         resp = (struct hci_rp_read_local_version *)skb->data;
 572         rtl_dev_info(hdev, "examining hci_ver=%02x hci_rev=%04x lmp_ver=%02x lmp_subver=%04x",
 573                      resp->hci_ver, resp->hci_rev,
 574                      resp->lmp_ver, resp->lmp_subver);
 575
 576         hci_ver = resp->hci_ver;
 577         hci_rev = le16_to_cpu(resp->hci_rev);
 578         lmp_subver = le16_to_cpu(resp->lmp_subver);
 579         kfree_skb(skb);
 580
 581         btrtl_dev->ic_info = btrtl_match_ic(lmp_subver, hci_rev, hci_ver,
 582                                             hdev->bus);
 583
 584         if (!btrtl_dev->ic_info) {
 585                 rtl_dev_info(hdev, "unknown IC info, lmp subver %04x, hci rev %04x, hci ver %04x",
 586                             lmp_subver, hci_rev, hci_ver);
 587                 return btrtl_dev;
 588         }
 589
 590         if (btrtl_dev->ic_info->has_rom_version) {
 591                 ret = rtl_read_rom_version(hdev, &btrtl_dev->rom_version);
 592                 if (ret)
 593                         goto err_free;
 594         }
 595
 596         btrtl_dev->fw_len = rtl_load_file(hdev, btrtl_dev->ic_info->fw_name,
 597                                           &btrtl_dev->fw_data);
 598         if (btrtl_dev->fw_len < 0) {
 599                 rtl_dev_err(hdev, "firmware file %s not found",
 600                             btrtl_dev->ic_info->fw_name);
 601                 ret = btrtl_dev->fw_len;
 602                 goto err_free;
 603         }
 604
 605         if (btrtl_dev->ic_info->cfg_name) {
 606                 if (postfix) {
 607                         snprintf(cfg_name, sizeof(cfg_name), "%s-%s.bin",
 608                                  btrtl_dev->ic_info->cfg_name, postfix);
 609                 } else {
 610                         snprintf(cfg_name, sizeof(cfg_name), "%s.bin",
 611                                  btrtl_dev->ic_info->cfg_name);
 612                 }
 613                 btrtl_dev->cfg_len = rtl_load_file(hdev, cfg_name,
 614                                                    &btrtl_dev->cfg_data);
 615                 if (btrtl_dev->ic_info->config_needed &&
 616                     btrtl_dev->cfg_len <= 0) {
 617                         rtl_dev_err(hdev, "mandatory config file %s not found",
 618                                     btrtl_dev->ic_info->cfg_name);
 619                         ret = btrtl_dev->cfg_len;
 620                         goto err_free;
 621                 }
 622         }
 623
 624         return btrtl_dev;
 625
 626 err_free:
 627         btrtl_free(btrtl_dev);
 628 err_alloc:
 629         return ERR_PTR(ret);
 630 }
 631 EXPORT_SYMBOL_GPL(btrtl_initialize);
 632
 633 int btrtl_download_firmware(struct hci_dev *hdev,
 634                             struct btrtl_device_info *btrtl_dev)
 635 {
 636         /* Match a set of subver values that correspond to stock firmware,
 637          * which is not compatible with standard btusb.
 638          * If matched, upload an alternative firmware that does conform to
 639          * standard btusb. Once that firmware is uploaded, the subver changes
 640          * to a different value.
 641          */
 642         if (!btrtl_dev->ic_info) {
 643                 rtl_dev_info(hdev, "assuming no firmware upload needed");
 644                 return 0;
 645         }
 646
 647         switch (btrtl_dev->ic_info->lmp_subver) {
 648         case RTL_ROM_LMP_8723A:
 649         case RTL_ROM_LMP_3499:
 650                 return btrtl_setup_rtl8723a(hdev, btrtl_dev);
 651         case RTL_ROM_LMP_8723B:
 652         case RTL_ROM_LMP_8821A:
 653         case RTL_ROM_LMP_8761A:
 654         case RTL_ROM_LMP_8822B:
 655                 return btrtl_setup_rtl8723b(hdev, btrtl_dev);
 656         default:
 657                 rtl_dev_info(hdev, "assuming no firmware upload needed");
 658                 return 0;
 659         }
 660 }
 661 EXPORT_SYMBOL_GPL(btrtl_download_firmware);
 662
 663 int btrtl_setup_realtek(struct hci_dev *hdev)
 664 {
 665         struct btrtl_device_info *btrtl_dev;
 666         int ret;
 667
 668         btrtl_dev = btrtl_initialize(hdev, NULL);
 669         if (IS_ERR(btrtl_dev))
 670                 return PTR_ERR(btrtl_dev);
 671
 672         ret = btrtl_download_firmware(hdev, btrtl_dev);
 673
 674         btrtl_free(btrtl_dev);
 675
 676         /* Enable controller to do both LE scan and BR/EDR inquiry
 677          * simultaneously.
 678          */
 679         set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
 680
 681         return ret;
 682 }
 683 EXPORT_SYMBOL_GPL(btrtl_setup_realtek);
 684
 685 int btrtl_shutdown_realtek(struct hci_dev *hdev)
 686 {
 687         struct sk_buff *skb;
 688         int ret;
 689
 690         /* According to the vendor driver, BT must be reset on close to avoid
 691          * firmware crash.
 692          */
 693         skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
 694         if (IS_ERR(skb)) {
 695                 ret = PTR_ERR(skb);
 696                 bt_dev_err(hdev, "HCI reset during shutdown failed");
 697                 return ret;
 698         }
 699         kfree_skb(skb);
 700
 701         return 0;
 702 }
 703 EXPORT_SYMBOL_GPL(btrtl_shutdown_realtek);
 704
 705 static unsigned int btrtl_convert_baudrate(u32 device_baudrate)
 706 {
 707         switch (device_baudrate) {
 708         case 0x0252a00a:
 709                 return 230400;
 710
 711         case 0x05f75004:
 712                 return 921600;
 713
 714         case 0x00005004:
 715                 return 1000000;
 716
 717         case 0x04928002:
 718         case 0x01128002:
 719                 return 1500000;
 720
 721         case 0x00005002:
 722                 return 2000000;
 723
 724         case 0x0000b001:
 725                 return 2500000;
 726
 727         case 0x04928001:
 728                 return 3000000;
 729
 730         case 0x052a6001:
 731                 return 3500000;
 732
 733         case 0x00005001:
 734                 return 4000000;
 735
 736         case 0x0252c014:
 737         default:
 738                 return 115200;
 739         }
 740 }
 741
 742 int btrtl_get_uart_settings(struct hci_dev *hdev,
 743                             struct btrtl_device_info *btrtl_dev,
 744                             unsigned int *controller_baudrate,
 745                             u32 *device_baudrate, bool *flow_control)
 746 {
 747         struct rtl_vendor_config *config;
 748         struct rtl_vendor_config_entry *entry;
 749         int i, total_data_len;
 750         bool found = false;
 751
 752         total_data_len = btrtl_dev->cfg_len - sizeof(*config);
 753         if (total_data_len <= 0) {
 754                 rtl_dev_warn(hdev, "no config loaded");
 755                 return -EINVAL;
 756         }
 757
 758         config = (struct rtl_vendor_config *)btrtl_dev->cfg_data;
 759         if (le32_to_cpu(config->signature) != RTL_CONFIG_MAGIC) {
 760                 rtl_dev_err(hdev, "invalid config magic");
 761                 return -EINVAL;
 762         }
 763
 764         if (total_data_len < le16_to_cpu(config->total_len)) {
 765                 rtl_dev_err(hdev, "config is too short");
 766                 return -EINVAL;
 767         }
 768
 769         for (i = 0; i < total_data_len; ) {
 770                 entry = ((void *)config->entry) + i;
 771
 772                 switch (le16_to_cpu(entry->offset)) {
 773                 case 0xc:
 774                         if (entry->len < sizeof(*device_baudrate)) {
 775                                 rtl_dev_err(hdev, "invalid UART config entry");
 776                                 return -EINVAL;
 777                         }
 778
 779                         *device_baudrate = get_unaligned_le32(entry->data);
 780                         *controller_baudrate = btrtl_convert_baudrate(
 781                                                         *device_baudrate);
 782
 783                         if (entry->len >= 13)
 784                                 *flow_control = !!(entry->data[12] & BIT(2));
 785                         else
 786                                 *flow_control = false;
 787
 788                         found = true;
 789                         break;
 790
 791                 default:
 792                         rtl_dev_dbg(hdev, "skipping config entry 0x%x (len %u)",
 793                                    le16_to_cpu(entry->offset), entry->len);
 794                         break;
 795                 }
 796
 797                 i += sizeof(*entry) + entry->len;
 798         }
 799
 800         if (!found) {
 801                 rtl_dev_err(hdev, "no UART config entry found");
 802                 return -ENOENT;
 803         }
 804
 805         rtl_dev_dbg(hdev, "device baudrate = 0x%08x", *device_baudrate);
 806         rtl_dev_dbg(hdev, "controller baudrate = %u", *controller_baudrate);
 807         rtl_dev_dbg(hdev, "flow control %d", *flow_control);
 808
 809         return 0;
 810 }
 811 EXPORT_SYMBOL_GPL(btrtl_get_uart_settings);
 812
 813 MODULE_AUTHOR("Daniel Drake <drake@endlessm.com>");
 814 MODULE_DESCRIPTION("Bluetooth support for Realtek devices ver " VERSION);
 815 MODULE_VERSION(VERSION);
 816 MODULE_LICENSE("GPL");
 817 MODULE_FIRMWARE("rtl_bt/rtl8723a_fw.bin");
 818 MODULE_FIRMWARE("rtl_bt/rtl8723b_fw.bin");
 819 MODULE_FIRMWARE("rtl_bt/rtl8723b_config.bin");
 820 MODULE_FIRMWARE("rtl_bt/rtl8723bs_fw.bin");
 821 MODULE_FIRMWARE("rtl_bt/rtl8723bs_config.bin");
 822 MODULE_FIRMWARE("rtl_bt/rtl8723ds_fw.bin");
 823 MODULE_FIRMWARE("rtl_bt/rtl8723ds_config.bin");
 824 MODULE_FIRMWARE("rtl_bt/rtl8761a_fw.bin");
 825 MODULE_FIRMWARE("rtl_bt/rtl8761a_config.bin");
 826 MODULE_FIRMWARE("rtl_bt/rtl8821a_fw.bin");
 827 MODULE_FIRMWARE("rtl_bt/rtl8821a_config.bin");
 828 MODULE_FIRMWARE("rtl_bt/rtl8822b_fw.bin");
 829 MODULE_FIRMWARE("rtl_bt/rtl8822b_config.bin");