Hi Daniel, > Realtek ship a variety of bluetooth USB devices that identify > themselves with standard USB Bluetooth device class values, but > require a special driver to actually work. Without that driver, > you never get any scan results. > > More recently however, Realtek appear to have wisened up and simply > posted a firmware update that makes these devices comply with > normal btusb protocols. The firmware needs to be uploaded on each boot. > > Based on Realtek code from https://github.com/lwfinger/rtl8723au_bt > ('new' branch). > > This enables bluetooth support in the Gigabyte Brix GB-BXBT-2807 which > has this RTL8723BE USB device: > > T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=02 Dev#= 3 Spd=12 MxCh= 0 > D: Ver= 2.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 > P: Vendor=13d3 ProdID=3410 Rev= 2.00 > S: Manufacturer=Realtek > S: Product=Bluetooth Radio > S: SerialNumber=00e04c000001 > C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA > I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb > E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms > E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms > E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms > I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb > E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms > E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms > I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb > E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms > E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms > I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb > E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms > E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms > I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb > E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms > E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms > I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb > E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms > E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms > I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb > E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms > E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms > > There is no change to the USB descriptor after firmware update, > however the version read by HCI_OP_READ_LOCAL_VERSION changes from > 0x8723 to 0x3083. > > Signed-off-by: Daniel Drake <drake@xxxxxxxxxxxx> > --- > drivers/bluetooth/btusb.c | 438 ++++++++++++++++++++++++++++++++++++++++++++++ > 1 file changed, 438 insertions(+) > > v2: > - share main blacklist table with other devices > - epatch table parsing endian/alignment fixes > - BT_INFO message to inform user > - added missing kmalloc error check > - fixed skb leak > - style fixes > > diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c > index 6250fc2..e6e7c23 100644 > --- a/drivers/bluetooth/btusb.c > +++ b/drivers/bluetooth/btusb.c > @@ -24,6 +24,7 @@ > #include <linux/module.h> > #include <linux/usb.h> > #include <linux/firmware.h> > +#include <asm/unaligned.h> > > #include <net/bluetooth/bluetooth.h> > #include <net/bluetooth/hci_core.h> > @@ -50,6 +51,13 @@ static struct usb_driver btusb_driver; > #define BTUSB_ATH3012 0x80 > #define BTUSB_INTEL 0x100 > #define BTUSB_BCM_PATCHRAM 0x200 > +#define BTUSB_RTL8723A 0x400 > +#define BTUSB_RTL8723B 0x800 > +#define BTUSB_RTL8761AU 0x1000 > +#define BTUSB_RTL8761AW_8192EU 0x2000 > +#define BTUSB_RTL8761AU_8192EE 0x4000 > +#define BTUSB_RTL8761AU_8812AE 0x8000 > +#define BTUSB_RTL8821A 0x10000 I would propose that you add BTUSB_RTK and then or the models into it. > > static const struct usb_device_id btusb_table[] = { > /* Generic Bluetooth USB device */ > @@ -237,6 +245,22 @@ static const struct usb_device_id blacklist_table[] = { > { USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL }, > { USB_DEVICE(0x8087, 0x0a2a), .driver_info = BTUSB_INTEL }, > > + /* Realtek Bluetooth devices */ > + { USB_DEVICE(0x0bda, 0xa761), .driver_info = BTUSB_RTL8761AU }, > + { USB_DEVICE(0x0bda, 0x8760), .driver_info = BTUSB_RTL8761AU_8192EE }, > + { USB_DEVICE(0x0bda, 0xb761), .driver_info = BTUSB_RTL8761AU_8192EE }, > + { USB_DEVICE(0x0bda, 0x8761), .driver_info = BTUSB_RTL8761AU_8192EE }, > + { USB_DEVICE(0x0bda, 0x8a60), .driver_info = BTUSB_RTL8761AU_8812AE }, > + { USB_DEVICE(0x0bda, 0x818b), .driver_info = BTUSB_RTL8761AW_8192EU }, > + { USB_DEVICE(0x0bda, 0x0821), .driver_info = BTUSB_RTL8821A }, > + { USB_DEVICE(0x0bda, 0x8821), .driver_info = BTUSB_RTL8821A }, > + { USB_DEVICE(0x0bda, 0x8723), .driver_info = BTUSB_RTL8723A }, > + { USB_DEVICE(0x0bda, 0xb720), .driver_info = BTUSB_RTL8723B }, > + { USB_DEVICE(0x0bda, 0xb72a), .driver_info = BTUSB_RTL8723B }, > + { USB_DEVICE(0x0bda, 0xb728), .driver_info = BTUSB_RTL8723B }, > + { USB_DEVICE(0x0bda, 0xb723), .driver_info = BTUSB_RTL8723B }, > + { USB_DEVICE(0x13d3, 0x3410), .driver_info = BTUSB_RTL8723B }, .driver_info = BTUSB_RTK | BTUSB_RTL... The think with RTL vs RTK is now confusing me even more. So what are the official model numbers from Realtek anyway. Maybe we should start using them now and not bother carrying around some legacy from the Ethernet or WiFi drivers. There is also no generic vendor command that we can run first to get the model information? Do we really need to use USB vendor and product ids to pick the right one. I personally hate using vendor and product ids. > + > { } /* Terminating entry */ > }; > > @@ -257,6 +281,7 @@ struct btusb_data { > spinlock_t lock; > > unsigned long flags; > + unsigned long driver_info; > > struct work_struct work; > struct work_struct waker; > @@ -1382,6 +1407,411 @@ exit_mfg_deactivate: > return 0; > } > > +#define RTL_FRAG_LEN 252 > + > +struct rtk_download_cmd { > + uint8_t index; > + uint8_t data[RTL_FRAG_LEN]; > +} __packed; > + > +struct rtk_download_response { > + uint8_t status; > + uint8_t index; > +} __packed; > + > +struct rtk_eversion_evt { > + uint8_t status; > + uint8_t version; > +} __packed; > + > +struct rtk_epatch_header { > + uint8_t signature[8]; > + uint32_t fm_version; > + uint16_t num_patches; > +} __packed; > + > +static const uint8_t RTK_EPATCH_SIGNATURE[] = { > + 0x52, 0x65, 0x61, 0x6C, 0x74, 0x65, 0x63, 0x68 > +}; > + > +#define ROM_LMP_8723a 0x1200 > +#define ROM_LMP_8723b 0x8723 > +#define ROM_LMP_8821a 0x8821 > +#define ROM_LMP_8761a 0x8761 > + > +static const uint16_t project_id[] = { > + ROM_LMP_8723a, > + ROM_LMP_8723b, > + ROM_LMP_8821a, > + ROM_LMP_8761a > +}; Where is this table used now? > + > +static const struct rtk_fw_info { > + unsigned long variant; /* corresponds to .driver_info */ > + uint16_t lmp_sub; Use lmp_subver here so it matches other fields names. > + const char *fw_name; > + const char *config_name; > +} rtk_fw_table[] = { > + { BTUSB_RTL8723A, ROM_LMP_8723a, "rtl8723a_fw", "rtl8723a_config" }, > + { BTUSB_RTL8723B, ROM_LMP_8723b, "rtl8723b_fw", "rtl8723b_config" }, > + { BTUSB_RTL8761AU, ROM_LMP_8761a, "rtl8761au_fw", "rtl8761a_config" }, > + { BTUSB_RTL8761AW_8192EU, ROM_LMP_8761a, "rtl8761aw8192eu_fw", "rtl8761a_config" }, > + { BTUSB_RTL8761AU_8192EE, ROM_LMP_8761a, "rtl8761au8192ee_fw", "rtl8761a_config" }, > + { BTUSB_RTL8761AU_8812AE, ROM_LMP_8761a, "rtl8761au8812ae_fw", "rtl8761a_config" }, > + { BTUSB_RTL8821A, ROM_LMP_8821a, "rtl8821a_fw", "rtl8821a_config" }, > +}; > + > +static const struct rtk_fw_info *rtk_get_fw_info(struct hci_dev *hdev) > +{ > + struct btusb_data *data = dev_get_drvdata(&hdev->dev); > + const struct rtk_fw_info *info; > + int i; > + > + for (i = 0; i < ARRAY_SIZE(rtk_fw_table); i++) { > + info = &rtk_fw_table[i]; > + if (info->variant == data->driver_info) > + return info; > + } > + > + return NULL; > +} > + > +static int rtk_read_eversion(struct hci_dev *hdev) > +{ > + struct rtk_eversion_evt *eversion; > + struct sk_buff *skb; > + int r; > + > + /* Read RTK ROM version command */ > + skb = __hci_cmd_sync(hdev, 0xfc6d, 0, NULL, HCI_INIT_TIMEOUT); > + if (IS_ERR(skb)) { > + BT_ERR("Read ROM version failed (%ld)", PTR_ERR(skb)); > + return PTR_ERR(skb); > + } > + > + if (skb->len != sizeof(*eversion)) { > + BT_ERR("RTK version event length mismatch"); > + kfree_skb(skb); > + return -EIO; > + } > + > + eversion = (struct rtk_eversion_evt *) skb->data; > + BT_DBG("eversion status=%x version=%x", > + eversion->status, eversion->version); > + if (eversion->status) > + r = 0; > + else > + r = eversion->version; > + > + kfree_skb(skb); > + return r; > +} > + > +/* RTL8723A has a simple fw patch format */ > +static int rtk_load_firmware_8723a(const struct firmware *epatch_fw, > + const struct firmware *config_fw, > + unsigned char **_buf) > +{ > + unsigned char *buf; > + int len; > + > + if (epatch_fw->size < 8) > + return -EINVAL; > + > + /* This might look odd, but it's how the Realtek driver does it: > + * Make sure we don't match the regular epatch signature. Maybe that > + * signature is only for the newer devices. */ > + if (memcmp(epatch_fw->data, RTK_EPATCH_SIGNATURE, 8) == 0) { > + BT_ERR("8723a has EPATCH signature!"); > + return -EINVAL; > + } > + > + len = epatch_fw->size; > + if (config_fw) > + len += config_fw->size; > + > + buf = kzalloc(len, GFP_KERNEL); > + if (!buf) > + return -ENOMEM; > + > + BT_DBG("8723a direct firmware copy\n"); > + memcpy(buf, epatch_fw->data, epatch_fw->size); > + if (config_fw) > + memcpy(buf + epatch_fw->size, config_fw->data, config_fw->size); > + > + *_buf = buf; > + return len; > +} > + > +/* RTL8723B and newer have a patch format which requires some parsing */ > +static int rtk_load_firmware_8723b(const struct rtk_fw_info *fw_info, > + uint8_t eversion, > + const struct firmware *epatch_fw, > + const struct firmware *config_fw, > + unsigned char **_buf) > +{ > + const uint8_t extension_sig[] = { 0x51, 0x04, 0xfd, 0x77 }; > + struct rtk_epatch_header *epatch_info; > + u16 lmp_version = fw_info->lmp_sub; > + unsigned char *buf; > + int i, len; > + size_t min_size; > + uint8_t opcode, length, data; > + unsigned char *tmp; > + const unsigned char *fwptr; > + const unsigned char *chip_id_base, *patch_length_base, *patch_offset_base; > + u32 patch_offset = 0; > + u16 patch_length; > + > + BT_DBG("lmp_version=%x eversion=%x", lmp_version, eversion); > + > + min_size = sizeof(struct rtk_epatch_header) + sizeof(extension_sig) + 3; > + if (epatch_fw->size < min_size) > + return -EINVAL; > + > + fwptr = epatch_fw->data + epatch_fw->size - sizeof(extension_sig); > + if (memcmp(fwptr, extension_sig, sizeof(extension_sig)) != 0) { > + BT_ERR("extension section signature mismatch"); > + return -EINVAL; > + } > + > + /* At this point the vendor driver has some confusing and dangerous > + * (probably broken) code that parses instructions backwards in a > + * loop starting from the end of the file. > + * In current firmware, the loop never executes because the instruction > + * needed is right at the end of the file. > + * For now, check for the same end-of-file data that the vendor driver > + * picks up with current firmware. > + */ > + opcode = *--fwptr; > + length = *--fwptr; > + data = *--fwptr; > + BT_DBG("final instr op=%x len=%x data=%x", opcode, length, data); > + if (opcode != 0 || length != 1) { > + BT_ERR("failed to find version instruction"); > + return -EINVAL; > + } > + > + if (lmp_version != project_id[data]) { > + BT_ERR("firmware is for %x but this is a %x", > + project_id[data], lmp_version); > + return -EINVAL; > + } So here is the project_id. You need to check for an overrun of that array in case newer devices come along or they change things and not update the VID/PID. However I get the feeling we have a bunch of these information duplicated. You do know that you can add individual hdev->setup function for each different firmware loading mechanism. They do not need to be all the same. I get the feeling you are trying too hard to push it all into a single entry point. > + > + epatch_info = (struct rtk_epatch_header *) epatch_fw->data; > + if (memcmp(epatch_info->signature, RTK_EPATCH_SIGNATURE, 8) != 0) { > + BT_ERR("bad EPATCH signature"); > + return -EINVAL; > + } > + > + BT_DBG("fm_version=%x, num_patches=%d", > + epatch_info->fm_version, epatch_info->num_patches); > + > + /* After the rtk_epatch_header there is a funky patch metadata section. > + * Assuming 2 patches, the layout is: > + * ChipID1 ChipID2 PatchLength1 PatchLength2 PatchOffset1 PatchOffset2 > + * > + * Find the right patch for this chip. */ > + min_size += 8 * epatch_info->num_patches; > + if (epatch_fw->size < min_size) > + return -EINVAL; > + > + chip_id_base = epatch_fw->data + sizeof(struct rtk_epatch_header); > + patch_length_base = chip_id_base + > + (sizeof(u16) * epatch_info->num_patches); > + patch_offset_base = patch_length_base + > + (sizeof(u16) * epatch_info->num_patches); > + for (i = 0; i < epatch_info->num_patches; i++) { > + u16 chip_id = get_unaligned_le16(chip_id_base + > + (i * sizeof(u16))); > + if (chip_id == eversion + 1) { > + patch_length = get_unaligned_le16(patch_length_base + > + (i * sizeof(u16))); > + patch_offset = get_unaligned_le32(patch_offset_base + > + (i * sizeof(u32))); > + break; > + } > + } > + > + if (!patch_offset) { > + BT_ERR("didn't find patch for chip id %d", eversion); > + return -EINVAL; > + } > + > + BT_DBG("length=%x offset=%x index %d", patch_length, patch_offset, i); > + min_size = patch_offset + patch_length; > + if (epatch_fw->size < min_size) > + return -EINVAL; > + > + len = patch_length; > + if (config_fw) > + len += config_fw->size; > + > + buf = kzalloc(len, GFP_KERNEL); > + if (!buf) > + return -ENOMEM; > + > + memcpy(buf, epatch_fw->data + patch_offset, patch_length); > + tmp = buf + patch_length; > + memcpy(tmp - 4, &epatch_info->fm_version, 4); > + if (config_fw) > + memcpy(tmp, config_fw->data, config_fw->size); > + > + *_buf = buf; > + return len; > +} > + > +static int rtk_load_firmware(struct hci_dev *hdev, unsigned char **buf, > + const struct rtk_fw_info *fw_info, > + uint8_t eversion) > +{ > + struct btusb_data *data = dev_get_drvdata(&hdev->dev); > + struct usb_device *udev = interface_to_usbdev(data->intf); > + char fw_name[32]; > + const struct firmware *epatch_fw, *config_fw; > + int ret; > + > + snprintf(fw_name, sizeof(fw_name), "rtl_bt/%s.bin", > + fw_info->config_name); > + ret = request_firmware(&config_fw, fw_name, &udev->dev); > + if (ret < 0) { > + BT_DBG("optional config blob %s not found", fw_name); > + config_fw = NULL; > + } > + > + snprintf(fw_name, sizeof(fw_name), "rtl_bt/%s.bin", > + fw_info->fw_name); > + ret = request_firmware(&epatch_fw, fw_name, &udev->dev); > + if (ret < 0) { > + BT_ERR("fw blob %s not found", fw_name); > + ret = -ENOMEM; > + goto out; > + } > + > + if (fw_info->lmp_sub == ROM_LMP_8723a) > + ret = rtk_load_firmware_8723a(epatch_fw, config_fw, buf); > + else > + ret = rtk_load_firmware_8723b(fw_info, eversion, epatch_fw, > + config_fw, buf); > + > +out: > + BT_DBG("return %d", ret); > + release_firmware(config_fw); > + release_firmware(epatch_fw); > + return ret; > +} > + > +static bool rtk_fw_upload_needed(struct hci_dev *hdev, > + const struct rtk_fw_info *fw_info) > +{ > + struct hci_rp_read_local_version *resp; > + u16 lmp_version = fw_info->lmp_sub; > + struct sk_buff *skb; > + > + skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL, > + HCI_INIT_TIMEOUT); > + if (IS_ERR(skb)) { > + BT_ERR("rtk fw version read command failed (%ld)", > + PTR_ERR(skb)); > + return PTR_ERR(skb); > + } > + > + if (skb->len != sizeof(*resp)) { > + BT_ERR("rtk version event length mismatch"); > + kfree_skb(skb); > + return -EIO; > + } > + > + resp = (struct hci_rp_read_local_version *) skb->data; > + if (resp->status) { > + BT_ERR("rtk fw version event failed (%02x)", resp->status); > + kfree_skb(skb); > + return bt_to_errno(resp->status); > + } > + > + BT_INFO("%s: rtk: lmp_subver=%x vs %x, firmware upload %sneeded", > + hdev->name, resp->lmp_subver, lmp_version, > + resp->lmp_subver == lmp_version ? "" : "not "); > + > + /* Firmware upload is only needed when the running version matches the > + * one listed in the driver. If versions differ, we assume that no > + * firmware update is necessary. */ > + return resp->lmp_subver == lmp_version; > +} > + > +static int btusb_setup_rtk(struct hci_dev *hdev) > +{ > + struct rtk_download_cmd *dl_cmd; > + unsigned char *fw_blob, *pcur; > + int frag_num, frag_len; > + int fw_len, i, eversion; > + const struct rtk_fw_info *fw_info = rtk_get_fw_info(hdev); > + int ret = -EIO; > + > + BT_DBG("variant %lx", fw_info->variant); > + if (!rtk_fw_upload_needed(hdev, fw_info)) > + return 0; > + > + eversion = rtk_read_eversion(hdev); > + if (eversion < 0) > + return eversion; > + > + fw_len = rtk_load_firmware(hdev, &fw_blob, fw_info, eversion); > + if (fw_len < 0) > + return fw_len; > + > + pcur = fw_blob; > + frag_num = fw_len / RTL_FRAG_LEN + 1; > + frag_len = RTL_FRAG_LEN; > + dl_cmd = kmalloc(sizeof(struct rtk_download_cmd), GFP_KERNEL); > + if (!dl_cmd) > + return -ENOMEM; > + > + for (i = 0; i < frag_num; i++) { > + struct rtk_download_response *dl_resp; > + struct sk_buff *skb; > + > + BT_DBG("download fw (%d/%d)", i, frag_num); > + dl_cmd->index = i; > + if (i == (frag_num - 1)) { > + dl_cmd->index |= 0x80; /* data end */ > + frag_len = fw_len % RTL_FRAG_LEN; > + } > + memcpy(dl_cmd->data, pcur, frag_len); > + > + /* Send download command */ > + skb = __hci_cmd_sync(hdev, 0xfc20, frag_len + 1, dl_cmd, > + HCI_INIT_TIMEOUT); > + if (IS_ERR(skb)) { > + BT_ERR("download fw command failed (%ld)", > + PTR_ERR(skb)); > + goto out; > + } > + > + if (skb->len != sizeof(*dl_resp)) { > + BT_ERR("download fw event length mismatch"); > + kfree_skb(skb); > + goto out; > + } > + > + dl_resp = (struct rtk_download_response *) skb->data; > + if (dl_resp->status != 0) { > + kfree_skb(skb); > + goto out; > + } > + > + kfree_skb(skb); > + pcur += RTL_FRAG_LEN; > + } > + > + ret = 0; > + > +out: > + kfree(fw_blob); > + kfree(dl_cmd); > + return ret; > +} > + > static int btusb_setup_bcm_patchram(struct hci_dev *hdev) > { > struct btusb_data *data = hci_get_drvdata(hdev); > @@ -1602,6 +2032,7 @@ static int btusb_probe(struct usb_interface *intf, > > data->udev = interface_to_usbdev(intf); > data->intf = intf; > + data->driver_info = id->driver_info; Why is this one needed? > > spin_lock_init(&data->lock); > > @@ -1641,6 +2072,13 @@ static int btusb_probe(struct usb_interface *intf, > if (id->driver_info & BTUSB_INTEL) > hdev->setup = btusb_setup_intel; > > + if (id->driver_info & (BTUSB_RTL8723A | BTUSB_RTL8723B | > + BTUSB_RTL8761AU | > + BTUSB_RTL8761AW_8192EU | > + BTUSB_RTL8761AU_8192EE | > + BTUSB_RTL8761AU_8812AE | BTUSB_RTL8821A)) > + hdev->setup = btusb_setup_rtk; > + if (id->driver_info & BTUSB_RTK) hdev->setup = btusb_setup_rtk; Or something like this: if (id->driver_info & BTUSB_RTK_ABC) hdev->setup = btusb_setup_rtk_abc; if (id->driver_info & BTUSB_RTK_XYZ) hdev->setup = btusb_setup_rtk_xyz; > /* Interface numbers are hardcoded in the specification */ > data->isoc = usb_ifnum_to_if(data->udev, 1); Regards Marcel -- To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
