[mirror_ubuntu-bionic-kernel.git] / drivers / bluetooth / btrtl.c

/*
 *  Bluetooth support for Realtek devices
 *
 *  Copyright (C) 2015 Endless Mobile, Inc.
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 2 of the License, or
 *  (at your option) any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 */

#include <linux/module.h>
#include <linux/firmware.h>
#include <asm/unaligned.h>
#include <linux/usb.h>

#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>

#include "btrtl.h"

#define VERSION "0.1"

#define RTL_EPATCH_SIGNATURE	"Realtech"
#define RTL_ROM_LMP_3499	0x3499
#define RTL_ROM_LMP_8723A	0x1200
#define RTL_ROM_LMP_8723B	0x8723
#define RTL_ROM_LMP_8821A	0x8821
#define RTL_ROM_LMP_8761A	0x8761
#define RTL_ROM_LMP_8822B	0x8822

#define IC_MATCH_FL_LMPSUBV	(1 << 0)
#define IC_MATCH_FL_HCIREV	(1 << 1)
#define IC_INFO(lmps, hcir) \
	.match_flags = IC_MATCH_FL_LMPSUBV | IC_MATCH_FL_HCIREV, \
	.lmp_subver = (lmps), \
	.hci_rev = (hcir)

struct id_table {
	__u16 match_flags;
	__u16 lmp_subver;
	__u16 hci_rev;
	bool config_needed;
	char *fw_name;
	char *cfg_name;
};

static const struct id_table ic_id_table[] = {
	/* 8723B */
	{ IC_INFO(RTL_ROM_LMP_8723B, 0xb),
	  .config_needed = false,
	  .fw_name  = "rtl_bt/rtl8723b_fw.bin",
	  .cfg_name = "rtl_bt/rtl8723b_config.bin" },

	/* 8723D */
	{ IC_INFO(RTL_ROM_LMP_8723B, 0xd),
	  .config_needed = true,
	  .fw_name  = "rtl_bt/rtl8723d_fw.bin",
	  .cfg_name = "rtl_bt/rtl8723d_config.bin" },

	/* 8821A */
	{ IC_INFO(RTL_ROM_LMP_8821A, 0xa),
	  .config_needed = false,
	  .fw_name  = "rtl_bt/rtl8821a_fw.bin",
	  .cfg_name = "rtl_bt/rtl8821a_config.bin" },

	/* 8821C */
	{ IC_INFO(RTL_ROM_LMP_8821A, 0xc),
	  .config_needed = false,
	  .fw_name  = "rtl_bt/rtl8821c_fw.bin",
	  .cfg_name = "rtl_bt/rtl8821c_config.bin" },

	/* 8761A */
	{ IC_MATCH_FL_LMPSUBV, RTL_ROM_LMP_8761A, 0x0,
	  .config_needed = false,
	  .fw_name  = "rtl_bt/rtl8761a_fw.bin",
	  .cfg_name = "rtl_bt/rtl8761a_config.bin" },

	/* 8822B */
	{ IC_INFO(RTL_ROM_LMP_8822B, 0xb),
	  .config_needed = true,
	  .fw_name  = "rtl_bt/rtl8822b_fw.bin",
	  .cfg_name = "rtl_bt/rtl8822b_config.bin" },
	};

static int rtl_read_rom_version(struct hci_dev *hdev, u8 *version)
{
	struct rtl_rom_version_evt *rom_version;
	struct sk_buff *skb;

	/* Read RTL ROM version command */
	skb = __hci_cmd_sync(hdev, 0xfc6d, 0, NULL, HCI_INIT_TIMEOUT);
	if (IS_ERR(skb)) {
		BT_ERR("%s: Read ROM version failed (%ld)",
		       hdev->name, PTR_ERR(skb));
		return PTR_ERR(skb);
	}

	if (skb->len != sizeof(*rom_version)) {
		BT_ERR("%s: RTL version event length mismatch", hdev->name);
		kfree_skb(skb);
		return -EIO;
	}

	rom_version = (struct rtl_rom_version_evt *)skb->data;
	bt_dev_info(hdev, "rom_version status=%x version=%x",
		    rom_version->status, rom_version->version);

	*version = rom_version->version;

	kfree_skb(skb);
	return 0;
}

static int rtlbt_parse_firmware(struct hci_dev *hdev, u16 lmp_subver,
				const struct firmware *fw,
				unsigned char **_buf)
{
	const u8 extension_sig[] = { 0x51, 0x04, 0xfd, 0x77 };
	struct rtl_epatch_header *epatch_info;
	unsigned char *buf;
	int i, ret, len;
	size_t min_size;
	u8 opcode, length, data, rom_version = 0;
	int project_id = -1;
	const unsigned char *fwptr, *chip_id_base;
	const unsigned char *patch_length_base, *patch_offset_base;
	u32 patch_offset = 0;
	u16 patch_length, num_patches;
	static const struct {
		__u16 lmp_subver;
		__u8 id;
	} project_id_to_lmp_subver[] = {
		{ RTL_ROM_LMP_8723A, 0 },
		{ RTL_ROM_LMP_8723B, 1 },
		{ RTL_ROM_LMP_8821A, 2 },
		{ RTL_ROM_LMP_8761A, 3 },
		{ RTL_ROM_LMP_8822B, 8 },
		{ RTL_ROM_LMP_8723B, 9 },	/* 8723D */
		{ RTL_ROM_LMP_8821A, 10 },	/* 8821C */
	};

	ret = rtl_read_rom_version(hdev, &rom_version);
	if (ret)
		return ret;

	min_size = sizeof(struct rtl_epatch_header) + sizeof(extension_sig) + 3;
	if (fw->size < min_size)
		return -EINVAL;

	fwptr = fw->data + fw->size - sizeof(extension_sig);
	if (memcmp(fwptr, extension_sig, sizeof(extension_sig)) != 0) {
		BT_ERR("%s: extension section signature mismatch", hdev->name);
		return -EINVAL;
	}

	/* Loop from the end of the firmware parsing instructions, until
	 * we find an instruction that identifies the "project ID" for the
	 * hardware supported by this firwmare file.
	 * Once we have that, we double-check that that project_id is suitable
	 * for the hardware we are working with.
	 */
	while (fwptr >= fw->data + (sizeof(struct rtl_epatch_header) + 3)) {
		opcode = *--fwptr;
		length = *--fwptr;
		data = *--fwptr;

		BT_DBG("check op=%x len=%x data=%x", opcode, length, data);

		if (opcode == 0xff) /* EOF */
			break;

		if (length == 0) {
			BT_ERR("%s: found instruction with length 0",
			       hdev->name);
			return -EINVAL;
		}

		if (opcode == 0 && length == 1) {
			project_id = data;
			break;
		}

		fwptr -= length;
	}

	if (project_id < 0) {
		BT_ERR("%s: failed to find version instruction", hdev->name);
		return -EINVAL;
	}

	/* Find project_id in table */
	for (i = 0; i < ARRAY_SIZE(project_id_to_lmp_subver); i++) {
		if (project_id == project_id_to_lmp_subver[i].id)
			break;
	}

	if (i >= ARRAY_SIZE(project_id_to_lmp_subver)) {
		BT_ERR("%s: unknown project id %d", hdev->name, project_id);
		return -EINVAL;
	}

	if (lmp_subver != project_id_to_lmp_subver[i].lmp_subver) {
		BT_ERR("%s: firmware is for %x but this is a %x", hdev->name,
		       project_id_to_lmp_subver[i].lmp_subver, lmp_subver);
		return -EINVAL;
	}

	epatch_info = (struct rtl_epatch_header *)fw->data;
	if (memcmp(epatch_info->signature, RTL_EPATCH_SIGNATURE, 8) != 0) {
		BT_ERR("%s: bad EPATCH signature", hdev->name);
		return -EINVAL;
	}

	num_patches = le16_to_cpu(epatch_info->num_patches);
	BT_DBG("fw_version=%x, num_patches=%d",
	       le32_to_cpu(epatch_info->fw_version), num_patches);

	/* After the rtl_epatch_header there is a funky patch metadata section.
	 * Assuming 2 patches, the layout is:
	 * ChipID1 ChipID2 PatchLength1 PatchLength2 PatchOffset1 PatchOffset2
	 *
	 * Find the right patch for this chip.
	 */
	min_size += 8 * num_patches;
	if (fw->size < min_size)
		return -EINVAL;

	chip_id_base = fw->data + sizeof(struct rtl_epatch_header);
	patch_length_base = chip_id_base + (sizeof(u16) * num_patches);
	patch_offset_base = patch_length_base + (sizeof(u16) * num_patches);
	for (i = 0; i < num_patches; i++) {
		u16 chip_id = get_unaligned_le16(chip_id_base +
						 (i * sizeof(u16)));
		if (chip_id == rom_version + 1) {
			patch_length = get_unaligned_le16(patch_length_base +
							  (i * sizeof(u16)));
			patch_offset = get_unaligned_le32(patch_offset_base +
							  (i * sizeof(u32)));
			break;
		}
	}

	if (!patch_offset) {
		BT_ERR("%s: didn't find patch for chip id %d",
		       hdev->name, rom_version);
		return -EINVAL;
	}

	BT_DBG("length=%x offset=%x index %d", patch_length, patch_offset, i);
	min_size = patch_offset + patch_length;
	if (fw->size < min_size)
		return -EINVAL;

	/* Copy the firmware into a new buffer and write the version at
	 * the end.
	 */
	len = patch_length;
	buf = kmemdup(fw->data + patch_offset, patch_length, GFP_KERNEL);
	if (!buf)
		return -ENOMEM;

	memcpy(buf + patch_length - 4, &epatch_info->fw_version, 4);

	*_buf = buf;
	return len;
}

static int rtl_download_firmware(struct hci_dev *hdev,
				 const unsigned char *data, int fw_len)
{
	struct rtl_download_cmd *dl_cmd;
	int frag_num = fw_len / RTL_FRAG_LEN + 1;
	int frag_len = RTL_FRAG_LEN;
	int ret = 0;
	int i;

	dl_cmd = kmalloc(sizeof(struct rtl_download_cmd), GFP_KERNEL);
	if (!dl_cmd)
		return -ENOMEM;

	for (i = 0; i < frag_num; i++) {
		struct sk_buff *skb;

		BT_DBG("download fw (%d/%d)", i, frag_num);

		dl_cmd->index = i;
		if (i == (frag_num - 1)) {
			dl_cmd->index |= 0x80; /* data end */
			frag_len = fw_len % RTL_FRAG_LEN;
		}
		memcpy(dl_cmd->data, data, frag_len);

		/* Send download command */
		skb = __hci_cmd_sync(hdev, 0xfc20, frag_len + 1, dl_cmd,
				     HCI_INIT_TIMEOUT);
		if (IS_ERR(skb)) {
			BT_ERR("%s: download fw command failed (%ld)",
			       hdev->name, PTR_ERR(skb));
			ret = -PTR_ERR(skb);
			goto out;
		}

		if (skb->len != sizeof(struct rtl_download_response)) {
			BT_ERR("%s: download fw event length mismatch",
			       hdev->name);
			kfree_skb(skb);
			ret = -EIO;
			goto out;
		}

		kfree_skb(skb);
		data += RTL_FRAG_LEN;
	}

out:
	kfree(dl_cmd);
	return ret;
}

static int rtl_load_config(struct hci_dev *hdev, const char *name, u8 **buff)
{
	const struct firmware *fw;
	int ret;

	bt_dev_info(hdev, "rtl: loading %s", name);
	ret = request_firmware(&fw, name, &hdev->dev);
	if (ret < 0)
		return ret;
	ret = fw->size;
	*buff = kmemdup(fw->data, ret, GFP_KERNEL);
	if (!*buff)
		ret = -ENOMEM;

	release_firmware(fw);

	return ret;
}

static int btrtl_setup_rtl8723a(struct hci_dev *hdev)
{
	const struct firmware *fw;
	int ret;

	bt_dev_info(hdev, "rtl: loading rtl_bt/rtl8723a_fw.bin");
	ret = request_firmware(&fw, "rtl_bt/rtl8723a_fw.bin", &hdev->dev);
	if (ret < 0) {
		BT_ERR("%s: Failed to load rtl_bt/rtl8723a_fw.bin", hdev->name);
		return ret;
	}

	if (fw->size < 8) {
		ret = -EINVAL;
		goto out;
	}

	/* Check that the firmware doesn't have the epatch signature
	 * (which is only for RTL8723B and newer).
	 */
	if (!memcmp(fw->data, RTL_EPATCH_SIGNATURE, 8)) {
		BT_ERR("%s: unexpected EPATCH signature!", hdev->name);
		ret = -EINVAL;
		goto out;
	}

	ret = rtl_download_firmware(hdev, fw->data, fw->size);

out:
	release_firmware(fw);
	return ret;
}

static int btrtl_setup_rtl8723b(struct hci_dev *hdev, u16 hci_rev,
				u16 lmp_subver)
{
	unsigned char *fw_data = NULL;
	const struct firmware *fw;
	int ret;
	int cfg_sz;
	u8 *cfg_buff = NULL;
	u8 *tbuff;
	char *cfg_name = NULL;
	char *fw_name = NULL;
	int i;

	for (i = 0; i < ARRAY_SIZE(ic_id_table); i++) {
		if ((ic_id_table[i].match_flags & IC_MATCH_FL_LMPSUBV) &&
		    (ic_id_table[i].lmp_subver != lmp_subver))
			continue;
		if ((ic_id_table[i].match_flags & IC_MATCH_FL_HCIREV) &&
		    (ic_id_table[i].hci_rev != hci_rev))
			continue;

		break;
	}

	if (i >= ARRAY_SIZE(ic_id_table)) {
		BT_ERR("%s: unknown IC info, lmp subver %04x, hci rev %04x",
		       hdev->name, lmp_subver, hci_rev);
		return -EINVAL;
	}

	cfg_name = ic_id_table[i].cfg_name;

	if (cfg_name) {
		cfg_sz = rtl_load_config(hdev, cfg_name, &cfg_buff);
		if (cfg_sz < 0) {
			cfg_sz = 0;
			if (ic_id_table[i].config_needed)
				BT_ERR("Necessary config file %s not found\n",
				       cfg_name);
		}
	} else
		cfg_sz = 0;

	fw_name = ic_id_table[i].fw_name;
	bt_dev_info(hdev, "rtl: loading %s", fw_name);
	ret = request_firmware(&fw, fw_name, &hdev->dev);
	if (ret < 0) {
		BT_ERR("%s: Failed to load %s", hdev->name, fw_name);
		goto err_req_fw;
	}

	ret = rtlbt_parse_firmware(hdev, lmp_subver, fw, &fw_data);
	if (ret < 0)
		goto out;

	if (cfg_sz) {
		tbuff = kzalloc(ret + cfg_sz, GFP_KERNEL);
		if (!tbuff) {
			ret = -ENOMEM;
			goto out;
		}

		memcpy(tbuff, fw_data, ret);
		kfree(fw_data);

		memcpy(tbuff + ret, cfg_buff, cfg_sz);
		ret += cfg_sz;

		fw_data = tbuff;
	}

	bt_dev_info(hdev, "cfg_sz %d, total size %d", cfg_sz, ret);

	ret = rtl_download_firmware(hdev, fw_data, ret);

out:
	release_firmware(fw);
	kfree(fw_data);
err_req_fw:
	if (cfg_sz)
		kfree(cfg_buff);
	return ret;
}

static struct sk_buff *btrtl_read_local_version(struct hci_dev *hdev)
{
	struct sk_buff *skb;

	skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
			     HCI_INIT_TIMEOUT);
	if (IS_ERR(skb)) {
		BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION failed (%ld)",
		       hdev->name, PTR_ERR(skb));
		return skb;
	}

	if (skb->len != sizeof(struct hci_rp_read_local_version)) {
		BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION event length mismatch",
		       hdev->name);
		kfree_skb(skb);
		return ERR_PTR(-EIO);
	}

	return skb;
}

int btrtl_setup_realtek(struct hci_dev *hdev)
{
	struct sk_buff *skb;
	struct hci_rp_read_local_version *resp;
	u16 hci_rev, lmp_subver;

	skb = btrtl_read_local_version(hdev);
	if (IS_ERR(skb))
		return -PTR_ERR(skb);

	resp = (struct hci_rp_read_local_version *)skb->data;
	bt_dev_info(hdev, "rtl: examining hci_ver=%02x hci_rev=%04x "
		    "lmp_ver=%02x lmp_subver=%04x",
		    resp->hci_ver, resp->hci_rev,
		    resp->lmp_ver, resp->lmp_subver);

	hci_rev = le16_to_cpu(resp->hci_rev);
	lmp_subver = le16_to_cpu(resp->lmp_subver);
	kfree_skb(skb);

	/* Match a set of subver values that correspond to stock firmware,
	 * which is not compatible with standard btusb.
	 * If matched, upload an alternative firmware that does conform to
	 * standard btusb. Once that firmware is uploaded, the subver changes
	 * to a different value.
	 */
	switch (lmp_subver) {
	case RTL_ROM_LMP_8723A:
	case RTL_ROM_LMP_3499:
		return btrtl_setup_rtl8723a(hdev);
	case RTL_ROM_LMP_8723B:
	case RTL_ROM_LMP_8821A:
	case RTL_ROM_LMP_8761A:
	case RTL_ROM_LMP_8822B:
		return btrtl_setup_rtl8723b(hdev, hci_rev, lmp_subver);
	default:
		bt_dev_info(hdev, "rtl: assuming no firmware upload needed");
		return 0;
	}
}
EXPORT_SYMBOL_GPL(btrtl_setup_realtek);

MODULE_AUTHOR("Daniel Drake <drake@endlessm.com>");
MODULE_DESCRIPTION("Bluetooth support for Realtek devices ver " VERSION);
MODULE_VERSION(VERSION);
MODULE_LICENSE("GPL");
Commit	Line	Data
db33c77d CC	1	/*
	2	* Bluetooth support for Realtek devices
	3	*
	4	* Copyright (C) 2015 Endless Mobile, Inc.
	5	*
	6	* This program is free software; you can redistribute it and/or modify
	7	* it under the terms of the GNU General Public License as published by
	8	* the Free Software Foundation; either version 2 of the License, or
	9	* (at your option) any later version.
	10	*
	11	* This program is distributed in the hope that it will be useful,
	12	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	13	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	14	* GNU General Public License for more details.
	15	*
	16	*/
	17
	18	#include <linux/module.h>
	19	#include <linux/firmware.h>
	20	#include <asm/unaligned.h>
	21	#include <linux/usb.h>
	22
	23	#include <net/bluetooth/bluetooth.h>
	24	#include <net/bluetooth/hci_core.h>
	25
	26	#include "btrtl.h"
	27
	28	#define VERSION "0.1"
	29
	30	#define RTL_EPATCH_SIGNATURE "Realtech"
	31	#define RTL_ROM_LMP_3499 0x3499
	32	#define RTL_ROM_LMP_8723A 0x1200
	33	#define RTL_ROM_LMP_8723B 0x8723
	34	#define RTL_ROM_LMP_8821A 0x8821
	35	#define RTL_ROM_LMP_8761A 0x8761
1110a2db	36	#define RTL_ROM_LMP_8822B 0x8822
db33c77d	37
320c7bdc AL	38	#define IC_MATCH_FL_LMPSUBV (1 << 0)
	39	#define IC_MATCH_FL_HCIREV (1 << 1)
	40	#define IC_INFO(lmps, hcir) \
	41	.match_flags = IC_MATCH_FL_LMPSUBV \| IC_MATCH_FL_HCIREV, \
	42	.lmp_subver = (lmps), \
	43	.hci_rev = (hcir)
	44
	45	struct id_table {
	46	__u16 match_flags;
	47	__u16 lmp_subver;
	48	__u16 hci_rev;
	49	bool config_needed;
	50	char *fw_name;
	51	char *cfg_name;
	52	};
	53
	54	static const struct id_table ic_id_table[] = {
	55	/* 8723B */
	56	{ IC_INFO(RTL_ROM_LMP_8723B, 0xb),
	57	.config_needed = false,
	58	.fw_name = "rtl_bt/rtl8723b_fw.bin",
	59	.cfg_name = "rtl_bt/rtl8723b_config.bin" },
	60
	61	/* 8723D */
	62	{ IC_INFO(RTL_ROM_LMP_8723B, 0xd),
	63	.config_needed = true,
	64	.fw_name = "rtl_bt/rtl8723d_fw.bin",
	65	.cfg_name = "rtl_bt/rtl8723d_config.bin" },
	66
	67	/* 8821A */
	68	{ IC_INFO(RTL_ROM_LMP_8821A, 0xa),
	69	.config_needed = false,
	70	.fw_name = "rtl_bt/rtl8821a_fw.bin",
	71	.cfg_name = "rtl_bt/rtl8821a_config.bin" },
	72
	73	/* 8821C */
	74	{ IC_INFO(RTL_ROM_LMP_8821A, 0xc),
	75	.config_needed = false,
	76	.fw_name = "rtl_bt/rtl8821c_fw.bin",
	77	.cfg_name = "rtl_bt/rtl8821c_config.bin" },
	78
	79	/* 8761A */
	80	{ IC_MATCH_FL_LMPSUBV, RTL_ROM_LMP_8761A, 0x0,
	81	.config_needed = false,
	82	.fw_name = "rtl_bt/rtl8761a_fw.bin",
	83	.cfg_name = "rtl_bt/rtl8761a_config.bin" },
	84
	85	/* 8822B */
	86	{ IC_INFO(RTL_ROM_LMP_8822B, 0xb),
	87	.config_needed = true,
	88	.fw_name = "rtl_bt/rtl8822b_fw.bin",
	89	.cfg_name = "rtl_bt/rtl8822b_config.bin" },
	90	};
	91
db33c77d CC	92	static int rtl_read_rom_version(struct hci_dev hdev, u8 version)
	93	{
	94	struct rtl_rom_version_evt *rom_version;
	95	struct sk_buff *skb;
	96
	97	/* Read RTL ROM version command */
	98	skb = __hci_cmd_sync(hdev, 0xfc6d, 0, NULL, HCI_INIT_TIMEOUT);
	99	if (IS_ERR(skb)) {
	100	BT_ERR("%s: Read ROM version failed (%ld)",
	101	hdev->name, PTR_ERR(skb));
	102	return PTR_ERR(skb);
	103	}
	104
	105	if (skb->len != sizeof(*rom_version)) {
	106	BT_ERR("%s: RTL version event length mismatch", hdev->name);
	107	kfree_skb(skb);
	108	return -EIO;
	109	}
	110
	111	rom_version = (struct rtl_rom_version_evt *)skb->data;
2064ee33 MH	112	bt_dev_info(hdev, "rom_version status=%x version=%x",
2064ee33 MH	113	rom_version->status, rom_version->version);
db33c77d CC	114
	115	*version = rom_version->version;
	116
	117	kfree_skb(skb);
	118	return 0;
	119	}
	120
320c7bdc AL	121	static int rtlbt_parse_firmware(struct hci_dev *hdev, u16 lmp_subver,
	122	const struct firmware *fw,
	123	unsigned char **_buf)
db33c77d CC	124	{
	125	const u8 extension_sig[] = { 0x51, 0x04, 0xfd, 0x77 };
	126	struct rtl_epatch_header *epatch_info;
	127	unsigned char *buf;
	128	int i, ret, len;
	129	size_t min_size;
	130	u8 opcode, length, data, rom_version = 0;
	131	int project_id = -1;
	132	const unsigned char fwptr, chip_id_base;
	133	const unsigned char patch_length_base, patch_offset_base;
	134	u32 patch_offset = 0;
	135	u16 patch_length, num_patches;
1110a2db LF	136	static const struct {
	137	__u16 lmp_subver;
	138	__u8 id;
	139	} project_id_to_lmp_subver[] = {
	140	{ RTL_ROM_LMP_8723A, 0 },
	141	{ RTL_ROM_LMP_8723B, 1 },
	142	{ RTL_ROM_LMP_8821A, 2 },
	143	{ RTL_ROM_LMP_8761A, 3 },
	144	{ RTL_ROM_LMP_8822B, 8 },
320c7bdc AL	145	{ RTL_ROM_LMP_8723B, 9 }, /* 8723D */
320c7bdc AL	146	{ RTL_ROM_LMP_8821A, 10 }, /* 8821C */
db33c77d CC	147	};
	148
	149	ret = rtl_read_rom_version(hdev, &rom_version);
	150	if (ret)
	151	return ret;
	152
	153	min_size = sizeof(struct rtl_epatch_header) + sizeof(extension_sig) + 3;
	154	if (fw->size < min_size)
	155	return -EINVAL;
	156
	157	fwptr = fw->data + fw->size - sizeof(extension_sig);
	158	if (memcmp(fwptr, extension_sig, sizeof(extension_sig)) != 0) {
	159	BT_ERR("%s: extension section signature mismatch", hdev->name);
	160	return -EINVAL;
	161	}
	162
	163	/* Loop from the end of the firmware parsing instructions, until
	164	* we find an instruction that identifies the "project ID" for the
	165	* hardware supported by this firwmare file.
	166	* Once we have that, we double-check that that project_id is suitable
	167	* for the hardware we are working with.
	168	*/
	169	while (fwptr >= fw->data + (sizeof(struct rtl_epatch_header) + 3)) {
	170	opcode = *--fwptr;
	171	length = *--fwptr;
	172	data = *--fwptr;
	173
	174	BT_DBG("check op=%x len=%x data=%x", opcode, length, data);
	175
	176	if (opcode == 0xff) /* EOF */
	177	break;
	178
	179	if (length == 0) {
	180	BT_ERR("%s: found instruction with length 0",
	181	hdev->name);
	182	return -EINVAL;
	183	}
	184
	185	if (opcode == 0 && length == 1) {
	186	project_id = data;
	187	break;
	188	}
	189
	190	fwptr -= length;
	191	}
	192
	193	if (project_id < 0) {
	194	BT_ERR("%s: failed to find version instruction", hdev->name);
	195	return -EINVAL;
	196	}
	197
1110a2db LF	198	/* Find project_id in table */
	199	for (i = 0; i < ARRAY_SIZE(project_id_to_lmp_subver); i++) {
	200	if (project_id == project_id_to_lmp_subver[i].id)
	201	break;
	202	}
	203
	204	if (i >= ARRAY_SIZE(project_id_to_lmp_subver)) {
db33c77d CC	205	BT_ERR("%s: unknown project id %d", hdev->name, project_id);
	206	return -EINVAL;
	207	}
	208
1110a2db	209	if (lmp_subver != project_id_to_lmp_subver[i].lmp_subver) {
db33c77d	210	BT_ERR("%s: firmware is for %x but this is a %x", hdev->name,
1110a2db	211	project_id_to_lmp_subver[i].lmp_subver, lmp_subver);
db33c77d CC	212	return -EINVAL;
	213	}
	214
	215	epatch_info = (struct rtl_epatch_header *)fw->data;
	216	if (memcmp(epatch_info->signature, RTL_EPATCH_SIGNATURE, 8) != 0) {
	217	BT_ERR("%s: bad EPATCH signature", hdev->name);
	218	return -EINVAL;
	219	}
	220
	221	num_patches = le16_to_cpu(epatch_info->num_patches);
	222	BT_DBG("fw_version=%x, num_patches=%d",
	223	le32_to_cpu(epatch_info->fw_version), num_patches);
	224
	225	/* After the rtl_epatch_header there is a funky patch metadata section.
	226	* Assuming 2 patches, the layout is:
	227	* ChipID1 ChipID2 PatchLength1 PatchLength2 PatchOffset1 PatchOffset2
	228	*
	229	* Find the right patch for this chip.
	230	*/
	231	min_size += 8 * num_patches;
	232	if (fw->size < min_size)
	233	return -EINVAL;
	234
	235	chip_id_base = fw->data + sizeof(struct rtl_epatch_header);
	236	patch_length_base = chip_id_base + (sizeof(u16) * num_patches);
	237	patch_offset_base = patch_length_base + (sizeof(u16) * num_patches);
	238	for (i = 0; i < num_patches; i++) {
	239	u16 chip_id = get_unaligned_le16(chip_id_base +
	240	(i * sizeof(u16)));
	241	if (chip_id == rom_version + 1) {
	242	patch_length = get_unaligned_le16(patch_length_base +
	243	(i * sizeof(u16)));
	244	patch_offset = get_unaligned_le32(patch_offset_base +
	245	(i * sizeof(u32)));
	246	break;
	247	}
	248	}
	249
	250	if (!patch_offset) {
	251	BT_ERR("%s: didn't find patch for chip id %d",
	252	hdev->name, rom_version);
	253	return -EINVAL;
	254	}
	255
	256	BT_DBG("length=%x offset=%x index %d", patch_length, patch_offset, i);
	257	min_size = patch_offset + patch_length;
	258	if (fw->size < min_size)
	259	return -EINVAL;
	260
	261	/* Copy the firmware into a new buffer and write the version at
	262	* the end.
	263	*/
	264	len = patch_length;
	265	buf = kmemdup(fw->data + patch_offset, patch_length, GFP_KERNEL);
	266	if (!buf)
	267	return -ENOMEM;
	268
	269	memcpy(buf + patch_length - 4, &epatch_info->fw_version, 4);
	270
	271	*_buf = buf;
	272	return len;
	273	}
	274
	275	static int rtl_download_firmware(struct hci_dev *hdev,
276	const unsigned char *data, int fw_len)
277	{
278	struct rtl_download_cmd *dl_cmd;
279	int frag_num = fw_len / RTL_FRAG_LEN + 1;
280	int frag_len = RTL_FRAG_LEN;
281	int ret = 0;
282	int i;
283
284	dl_cmd = kmalloc(sizeof(struct rtl_download_cmd), GFP_KERNEL);
285	if (!dl_cmd)
286	return -ENOMEM;
287
288	for (i = 0; i < frag_num; i++) {
289	struct sk_buff *skb;
290
291	BT_DBG("download fw (%d/%d)", i, frag_num);
292
293	dl_cmd->index = i;
294	if (i == (frag_num - 1)) {
295	dl_cmd->index \|= 0x80; /* data end */
296	frag_len = fw_len % RTL_FRAG_LEN;
297	}
298	memcpy(dl_cmd->data, data, frag_len);
299
300	/* Send download command */
301	skb = __hci_cmd_sync(hdev, 0xfc20, frag_len + 1, dl_cmd,
302	HCI_INIT_TIMEOUT);
303	if (IS_ERR(skb)) {
304	BT_ERR("%s: download fw command failed (%ld)",
305	hdev->name, PTR_ERR(skb));
306	ret = -PTR_ERR(skb);
307	goto out;
308	}
309
310	if (skb->len != sizeof(struct rtl_download_response)) {
311	BT_ERR("%s: download fw event length mismatch",
312	hdev->name);
313	kfree_skb(skb);
314	ret = -EIO;
315	goto out;
316	}
317
318	kfree_skb(skb);
319	data += RTL_FRAG_LEN;
320	}
321
322	out:
323	kfree(dl_cmd);
324	return ret;
325	}
326
1110a2db LF	327	static int rtl_load_config(struct hci_dev hdev, const char name, u8 **buff)
	328	{
	329	const struct firmware *fw;
	330	int ret;
	331
2064ee33	332	bt_dev_info(hdev, "rtl: loading %s", name);
1110a2db	333	ret = request_firmware(&fw, name, &hdev->dev);
abed84a0	334	if (ret < 0)
1110a2db	335	return ret;
1110a2db LF	336	ret = fw->size;
1110a2db LF	337	*buff = kmemdup(fw->data, ret, GFP_KERNEL);
c3327bde DC	338	if (!*buff)
c3327bde DC	339	ret = -ENOMEM;
1110a2db LF	340
	341	release_firmware(fw);
	342
	343	return ret;
	344	}
	345
db33c77d CC	346	static int btrtl_setup_rtl8723a(struct hci_dev *hdev)
	347	{
	348	const struct firmware *fw;
	349	int ret;
	350
2064ee33	351	bt_dev_info(hdev, "rtl: loading rtl_bt/rtl8723a_fw.bin");
db33c77d CC	352	ret = request_firmware(&fw, "rtl_bt/rtl8723a_fw.bin", &hdev->dev);
	353	if (ret < 0) {
	354	BT_ERR("%s: Failed to load rtl_bt/rtl8723a_fw.bin", hdev->name);
	355	return ret;
	356	}
	357
	358	if (fw->size < 8) {
	359	ret = -EINVAL;
	360	goto out;
	361	}
	362
	363	/* Check that the firmware doesn't have the epatch signature
	364	* (which is only for RTL8723B and newer).
	365	*/
	366	if (!memcmp(fw->data, RTL_EPATCH_SIGNATURE, 8)) {
	367	BT_ERR("%s: unexpected EPATCH signature!", hdev->name);
	368	ret = -EINVAL;
	369	goto out;
	370	}
	371
	372	ret = rtl_download_firmware(hdev, fw->data, fw->size);
	373
	374	out:
	375	release_firmware(fw);
	376	return ret;
	377	}
	378
320c7bdc AL	379	static int btrtl_setup_rtl8723b(struct hci_dev *hdev, u16 hci_rev,
320c7bdc AL	380	u16 lmp_subver)
db33c77d CC	381	{
	382	unsigned char *fw_data = NULL;
	383	const struct firmware *fw;
	384	int ret;
1110a2db LF	385	int cfg_sz;
	386	u8 *cfg_buff = NULL;
	387	u8 *tbuff;
	388	char *cfg_name = NULL;
320c7bdc AL	389	char *fw_name = NULL;
	390	int i;
	391
	392	for (i = 0; i < ARRAY_SIZE(ic_id_table); i++) {
	393	if ((ic_id_table[i].match_flags & IC_MATCH_FL_LMPSUBV) &&
	394	(ic_id_table[i].lmp_subver != lmp_subver))
	395	continue;
	396	if ((ic_id_table[i].match_flags & IC_MATCH_FL_HCIREV) &&
	397	(ic_id_table[i].hci_rev != hci_rev))
	398	continue;
1110a2db	399
1110a2db LF	400	break;
	401	}
	402
320c7bdc AL	403	if (i >= ARRAY_SIZE(ic_id_table)) {
	404	BT_ERR("%s: unknown IC info, lmp subver %04x, hci rev %04x",
	405	hdev->name, lmp_subver, hci_rev);
	406	return -EINVAL;
	407	}
	408
	409	cfg_name = ic_id_table[i].cfg_name;
	410
1110a2db LF	411	if (cfg_name) {
1110a2db LF	412	cfg_sz = rtl_load_config(hdev, cfg_name, &cfg_buff);
abed84a0	413	if (cfg_sz < 0) {
1110a2db	414	cfg_sz = 0;
320c7bdc	415	if (ic_id_table[i].config_needed)
abed84a0 LF	416	BT_ERR("Necessary config file %s not found\n",
	417	cfg_name);
	418	}
1110a2db LF	419	} else
1110a2db LF	420	cfg_sz = 0;
db33c77d	421
320c7bdc	422	fw_name = ic_id_table[i].fw_name;
2064ee33	423	bt_dev_info(hdev, "rtl: loading %s", fw_name);
db33c77d CC	424	ret = request_firmware(&fw, fw_name, &hdev->dev);
	425	if (ret < 0) {
	426	BT_ERR("%s: Failed to load %s", hdev->name, fw_name);
1110a2db	427	goto err_req_fw;
db33c77d CC	428	}
db33c77d CC	429
320c7bdc	430	ret = rtlbt_parse_firmware(hdev, lmp_subver, fw, &fw_data);
db33c77d CC	431	if (ret < 0)
	432	goto out;
	433
1110a2db LF	434	if (cfg_sz) {
	435	tbuff = kzalloc(ret + cfg_sz, GFP_KERNEL);
	436	if (!tbuff) {
	437	ret = -ENOMEM;
	438	goto out;
	439	}
	440
	441	memcpy(tbuff, fw_data, ret);
	442	kfree(fw_data);
	443
	444	memcpy(tbuff + ret, cfg_buff, cfg_sz);
	445	ret += cfg_sz;
	446
	447	fw_data = tbuff;
	448	}
	449
2064ee33	450	bt_dev_info(hdev, "cfg_sz %d, total size %d", cfg_sz, ret);
1110a2db	451
db33c77d	452	ret = rtl_download_firmware(hdev, fw_data, ret);
db33c77d CC	453
	454	out:
	455	release_firmware(fw);
1110a2db LF	456	kfree(fw_data);
	457	err_req_fw:
	458	if (cfg_sz)
	459	kfree(cfg_buff);
db33c77d CC	460	return ret;
	461	}
	462
	463	static struct sk_buff btrtl_read_local_version(struct hci_dev hdev)
	464	{
	465	struct sk_buff *skb;
	466
	467	skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
	468	HCI_INIT_TIMEOUT);
	469	if (IS_ERR(skb)) {
	470	BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION failed (%ld)",
	471	hdev->name, PTR_ERR(skb));
	472	return skb;
	473	}
	474
	475	if (skb->len != sizeof(struct hci_rp_read_local_version)) {
	476	BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION event length mismatch",
	477	hdev->name);
	478	kfree_skb(skb);
	479	return ERR_PTR(-EIO);
	480	}
	481
	482	return skb;
	483	}
	484
	485	int btrtl_setup_realtek(struct hci_dev *hdev)
	486	{
	487	struct sk_buff *skb;
	488	struct hci_rp_read_local_version *resp;
320c7bdc	489	u16 hci_rev, lmp_subver;
db33c77d CC	490
	491	skb = btrtl_read_local_version(hdev);
	492	if (IS_ERR(skb))
	493	return -PTR_ERR(skb);
	494
	495	resp = (struct hci_rp_read_local_version *)skb->data;
2064ee33 MH	496	bt_dev_info(hdev, "rtl: examining hci_ver=%02x hci_rev=%04x "
	497	"lmp_ver=%02x lmp_subver=%04x",
	498	resp->hci_ver, resp->hci_rev,
	499	resp->lmp_ver, resp->lmp_subver);
db33c77d	500
320c7bdc	501	hci_rev = le16_to_cpu(resp->hci_rev);
db33c77d CC	502	lmp_subver = le16_to_cpu(resp->lmp_subver);
	503	kfree_skb(skb);
	504
	505	/* Match a set of subver values that correspond to stock firmware,
	506	* which is not compatible with standard btusb.
	507	* If matched, upload an alternative firmware that does conform to
	508	* standard btusb. Once that firmware is uploaded, the subver changes
	509	* to a different value.
	510	*/
	511	switch (lmp_subver) {
	512	case RTL_ROM_LMP_8723A:
	513	case RTL_ROM_LMP_3499:
	514	return btrtl_setup_rtl8723a(hdev);
	515	case RTL_ROM_LMP_8723B:
db33c77d	516	case RTL_ROM_LMP_8821A:
db33c77d	517	case RTL_ROM_LMP_8761A:
1110a2db	518	case RTL_ROM_LMP_8822B:
320c7bdc	519	return btrtl_setup_rtl8723b(hdev, hci_rev, lmp_subver);
db33c77d	520	default:
2064ee33	521	bt_dev_info(hdev, "rtl: assuming no firmware upload needed");
db33c77d CC	522	return 0;
	523	}
	524	}
	525	EXPORT_SYMBOL_GPL(btrtl_setup_realtek);
	526
	527	MODULE_AUTHOR("Daniel Drake <drake@endlessm.com>");
	528	MODULE_DESCRIPTION("Bluetooth support for Realtek devices ver " VERSION);
	529	MODULE_VERSION(VERSION);
	530	MODULE_LICENSE("GPL");