Commit cd8dbd9e authored by Max Chou's avatar Max Chou Committed by Luiz Augusto von Dentz
Browse files

Bluetooth: btrtl: Avoid loading the config file on security chips 



For chips with security enabled, it's only possible to load firmware
with a valid signature pattern.
If key_id is not zero, it indicates a security chip, and the driver will
not load the config file.

- Example log for a security chip.

Bluetooth: hci0: RTL: examining hci_ver=0c hci_rev=000a
  lmp_ver=0c lmp_subver=8922
Bluetooth: hci0: RTL: rom_version status=0 version=1
Bluetooth: hci0: RTL: btrtl_initialize: key id 1
Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_fw.bin
Bluetooth: hci0: RTL: cfg_sz 0, total sz 71301
Bluetooth: hci0: RTL: fw version 0x41c0c905

- Example log for a normal chip.

Bluetooth: hci0: RTL: examining hci_ver=0c hci_rev=000a
  lmp_ver=0c lmp_subver=8922
Bluetooth: hci0: RTL: rom_version status=0 version=1
Bluetooth: hci0: RTL: btrtl_initialize: key id 0
Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_fw.bin
Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_config.bin
Bluetooth: hci0: RTL: cfg_sz 6, total sz 71307
Bluetooth: hci0: RTL: fw version 0x41c0c905

Tested-by: default avatarHilda Wu <hildawu@realtek.com>
Signed-off-by: default avatarNial Ni <niall_ni@realsil.com.cn>
Signed-off-by: default avatarMax Chou <max.chou@realtek.com>
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
parent 485e0626

drivers/bluetooth/btrtl.c

+13 −11
Original line number Diff line number Diff line
@@ -50,7 +50,7 @@ 


#define	RTL_CHIP_SUBVER (&(struct rtl_vendor_cmd) {{0x10, 0x38, 0x04, 0x28, 0x80}})

#define	RTL_CHIP_REV    (&(struct rtl_vendor_cmd) {{0x10, 0x3A, 0x04, 0x28, 0x80}})

#define	RTL_SEC_PROJ    (&(struct rtl_vendor_cmd) {{0x10, 0xA4, 0x0D, 0x00, 0xb0}})

#define	RTL_SEC_PROJ    (&(struct rtl_vendor_cmd) {{0x10, 0xA4, 0xAD, 0x00, 0xb0}})



#define RTL_PATCH_SNIPPETS		0x01

#define RTL_PATCH_DUMMY_HEADER		0x02
@@ -534,7 +534,6 @@ static int rtlbt_parse_firmware_v2(struct hci_dev *hdev, 
{

	struct rtl_epatch_header_v2 *hdr;

	int rc;

	u8 reg_val[2];

	u8 key_id;

	u32 num_sections;

	struct rtl_section *section;
@@ -549,14 +548,7 @@ static int rtlbt_parse_firmware_v2(struct hci_dev *hdev, 
		.len  = btrtl_dev->fw_len - 7, /* Cut the tail */

	};



	rc = btrtl_vendor_read_reg16(hdev, RTL_SEC_PROJ, reg_val);

	if (rc < 0)

		return -EIO;

	key_id = reg_val[0];



	rtl_dev_dbg(hdev, "%s: key id %u", __func__, key_id);



	btrtl_dev->key_id = key_id;

	key_id = btrtl_dev->key_id;



	hdr = rtl_iov_pull_data(&iov, sizeof(*hdr));

	if (!hdr)
@@ -1070,6 +1062,8 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev, 
	u16 hci_rev, lmp_subver;

	u8 hci_ver, lmp_ver, chip_type = 0;

	int ret;

	int rc;

	u8 key_id;

	u8 reg_val[2];



	btrtl_dev = kzalloc(sizeof(*btrtl_dev), GFP_KERNEL);
@@ -1180,6 +1174,14 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev, 
		goto err_free;

	}



	rc = btrtl_vendor_read_reg16(hdev, RTL_SEC_PROJ, reg_val);

	if (rc < 0)

		goto err_free;



	key_id = reg_val[0];

	btrtl_dev->key_id = key_id;

	rtl_dev_info(hdev, "%s: key id %u", __func__, key_id);



	btrtl_dev->fw_len = -EIO;

	if (lmp_subver == RTL_ROM_LMP_8852A && hci_rev == 0x000c) {

		snprintf(fw_name, sizeof(fw_name), "%s_v2.bin",
@@ -1202,7 +1204,7 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev, 
		goto err_free;

	}



	if (btrtl_dev->ic_info->cfg_name) {

	if (btrtl_dev->ic_info->cfg_name && !btrtl_dev->key_id) {

		if (postfix) {

			snprintf(cfg_name, sizeof(cfg_name), "%s-%s.bin",

				 btrtl_dev->ic_info->cfg_name, postfix);