/* * * BlueZ - Bluetooth protocol stack for Linux * * Copyright (C) 2005-2010 Marcel Holtmann * Copyright (C) 2013-2014 Realtek Semiconductor Corp. * * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA * */ #ifdef HAVE_CONFIG_H #include #endif #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #define Config_Android 0 /*1 for android; 0 for Linux*/ #if Config_Android //for Android #include #include #include #else //for Linux #include #include #include #include #include #endif #include "hciattach.h" #define BAUDRATE_4BYTES #define RTK_VERSION "2.3" #if __BYTE_ORDER == __LITTLE_ENDIAN #define cpu_to_le16(d) (d) #define cpu_to_le32(d) (d) #define le16_to_cpu(d) (d) #define le32_to_cpu(d) (d) #elif __BYTE_ORDER == __BIG_ENDIAN #define cpu_to_le16(d) bswap_16(d) #define cpu_to_le32(d) bswap_32(d) #define le16_to_cpu(d) bswap_16(d) #define le32_to_cpu(d) bswap_32(d) #else #error "Unknown byte order" #endif /* log related */ #define LOG_STR "Realtek Bluetooth" #define DBG_ON 1 #define RS_DBG(fmt, arg...) \ do { \ if (DBG_ON) \ fprintf(stderr, "%s: " fmt "\n", LOG_STR, ##arg); \ } while (0) #define RS_ERR(fmt, arg...) \ do { \ fprintf(stderr, "%s ERROR: " fmt "\n", LOG_STR, ##arg);\ perror("reason: "); \ } while (0) #define RS_DUMP(buffer, len) \ do { \ fprintf(stderr, "%s: ", LOG_STR); \ for (int i = 0; i < len; i++) { \ if (i && !(i % 16)) { \ fprintf(stderr, "\n"); \ fprintf(stderr, "%s: ", LOG_STR); \ } \ fprintf(stderr, "%02x ", buffer[i]); \ } \ fprintf(stderr, "\n"); \ } while (0) struct sk_buff { uint32_t max_len; uint32_t data_len; uint8_t data[0]; }; /* Skb helpers */ struct bt_skb_cb { uint8_t pkt_type; uint8_t incoming; uint16_t expect; uint8_t tx_seq; uint8_t retries; uint8_t sar; uint16_t channel; }; typedef struct { uint8_t index; uint8_t data[252]; } __attribute__ ((packed)) download_vendor_patch_cp; struct hci_command_hdr { uint16_t opcode; /* OCF & OGF */ uint8_t plen; } __attribute__ ((packed)); struct hci_event_hdr { uint8_t evt; uint8_t plen; } __attribute__ ((packed)); struct hci_ev_cmd_complete { uint8_t ncmd; uint16_t opcode; } __attribute__ ((packed)); #define HCI_COMMAND_HDR_SIZE 3 #define HCI_EVENT_HDR_SIZE 2 #define HCI_CMD_READ_BD_ADDR 0x1009 #define HCI_VENDOR_CHANGE_BDRATE 0xfc17 #define HCI_VENDOR_READ_RTK_ROM_VERISION 0xfc6d #define HCI_VENDOR_READ_LMP_VERISION 0x1001 #define HCI_VENDOR_READ_CHIP_TYPE 0xfc61 #define ROM_LMP_8723a 0x1200 #define RTK_VENDOR_CONFIG_MAGIC 0x8723ab55 #define bt_cb(skb) ((struct bt_skb_cb *)((skb)->cb)) #if Config_Android #define FIRMWARE_DIRECTORY "/system/vendor/etc/firmware" #define BT_CONFIG_DIRECTORY "/system/vendor/etc/firmware" #else #define FIRMWARE_DIRECTORY "/system/vendor/etc/firmware" #define BT_CONFIG_DIRECTORY "/system/vendor/etc/firmware" #endif #define BT_ADDR_DIR "/data/misc/bluetooth/" #define BT_ADDR_FILE "/data/misc/bluetooth/btmac.txt" #define PATCH_DATA_FIELD_MAX_SIZE 252 #define READ_DATA_SIZE 16 /* HCI data types */ #define H5_ACK_PKT 0x00 #define HCI_COMMAND_PKT 0x01 #define HCI_ACLDATA_PKT 0x02 #define HCI_SCODATA_PKT 0x03 #define HCI_EVENT_PKT 0x04 #define H5_VDRSPEC_PKT 0x0E #define H5_LINK_CTL_PKT 0x0F #define HCI_VERSION_MASK_10 (1<<0) // Bluetooth Core Spec 1.0b #define HCI_VERSION_MASK_11 (1<<1) // Bluetooth Core Spec 1.1 #define HCI_VERSION_MASK_12 (1<<2) // Bluetooth Core Spec 1.2 #define HCI_VERSION_MASK_20 (1<<3) // Bluetooth Core Spec 2.0+EDR #define HCI_VERSION_MASK_21 (1<<4) // Bluetooth Core Spec 2.1+EDR #define HCI_VERSION_MASK_30 (1<<5) // Bluetooth Core Spec 3.0+HS #define HCI_VERSION_MASK_40 (1<<6) // Bluetooth Core Spec 4.0 #define HCI_VERSION_MASK_41 (1<<7) // Bluetooth Core Spec 4.1 #define HCI_VERSION_MASK_42 (1<<8) // Bluetooth Core Spec 4.2 #define HCI_VERSION_MASK_ALL (0xFFFFFFFF) #define HCI_REVISION_MASK_ALL (0xFFFFFFFF) #define LMP_SUBVERSION_NONE (0x0) #define CHIPTYPE_NONE (0x1F) // Chip Type's range: 0x0 ~ 0xF #define CHIP_TYPE_MASK_ALL (0xFFFFFFFF) #define PROJECT_ID_MASK_ALL (0xFFFFFFFF) // temp used for unknow project id for a new chip #define CONFIG_MAC_OFFSET_GEN_1_2 (0x3C) // MAC's OFFSET in config/efuse for realtek generation 1~2 bluetooth chip #define CONFIG_MAC_OFFSET_GEN_3PLUS (0x44) // MAC's OFFSET in config/efuse for rtk generation 3+ bluetooth chip #define CONFIG_MAC_OFFSET_GEN_4PLUS (0x30) // MAC's OFFSET in config/efuse for rtk generation 4+ bluetooth chip #define PATCH_OPTIONAL_MATCH_FLAG_CHIPTYPE (0x1) #define MAX_PATCH_SIZE_24K (1024*24) // 24K #define MAX_PATCH_SIZE_40K (1024*40) // 40K struct rtk_bt_vendor_config_entry { uint16_t offset; uint8_t entry_len; uint8_t entry_data[0]; } __attribute__ ((packed)); struct rtk_bt_vendor_config { uint32_t signature; uint16_t data_len; struct rtk_bt_vendor_config_entry entry[0]; } __attribute__ ((packed)); struct rtk_epatch_entry { uint16_t chipID; uint16_t patch_length; uint32_t start_offset; } __attribute__ ((packed)); struct rtk_epatch { uint8_t signature[8]; uint32_t fm_version; uint16_t number_of_total_patch; struct rtk_epatch_entry entry[0]; } __attribute__ ((packed)); typedef enum _RTK_ROM_VERSION_CMD_STATE { cmd_not_send, cmd_has_sent, event_received } RTK_ROM_VERSION_CMD_STATE; #pragma pack(1) #if __BYTE_ORDER == __LITTLE_ENDIAN typedef struct _H5_PKT_HEADER { uint8_t SeqNumber:3; uint8_t AckNumber:3; uint8_t DicPresent:1; /* Data Integrity Check Present */ uint8_t ReliablePkt:1; uint16_t PktType:4; uint16_t PayloadLen:12; uint8_t HdrChecksum; } H5_PKT_HEADER; #else typedef struct _H5_PKT_HEADER { uint8_t ReliablePkt:1; uint8_t DicPresent:1; /* Data Integrity Check Present */ uint8_t AckNumber:3; uint8_t SeqNumber:3; uint16_t PayloadLen:12; uint16_t PktType:4; uint8_t HdrChecksum; } H5_PKT_HEADER; #endif typedef enum _H5_RX_STATE { H5_W4_PKT_DELIMITER, H5_W4_PKT_START, H5_W4_HDR, H5_W4_DATA, H5_W4_CRC } H5_RX_STATE; typedef enum _H5_RX_ESC_STATE { H5_ESCSTATE_NOESC, H5_ESCSTATE_ESC } H5_RX_ESC_STATE; typedef enum _H5_LINK_STATE { H5_SYNC, H5_CONFIG, H5_INIT, H5_PATCH, H5_ACTIVE } H5_LINK_STATE; typedef enum _PATCH_PROTOCOL { PATCH_PROTOCAL_H4, PATCH_PROTOCAL_H5 } PATCH_PROTOCOL; struct rtk_h5_struct { uint8_t rxseq_txack; /* rxseq == txack. expected rx SeqNumber */ uint8_t rxack; /* Last packet sent by us that the peer ack'ed */ uint8_t use_crc; uint8_t is_txack_req; /* txack required? Do we need to send ack's to the peer? */ /* Reliable packet sequence number - used to assign seq to each rel pkt. */ uint8_t msgq_txseq; /* next pkt seq */ uint16_t message_crc; uint32_t rx_count; /* expected pkts to recv */ H5_RX_STATE rx_state; H5_RX_ESC_STATE rx_esc_state; H5_LINK_STATE link_estab_state; struct sk_buff *rx_skb; struct sk_buff *host_last_cmd; }; struct patch_struct { int nTxIndex; /* current sending pkt number */ int nTotal; /* total pkt number */ int nRxIndex; /* ack index from board */ int nNeedRetry; /* if no response from board */ }; typedef struct { uint16_t lmp_subversion; uint32_t hci_version_mask; uint32_t hci_revision_mask; uint32_t chip_type_mask; uint32_t project_id_mask; char *patch_name; char *config_name; uint16_t mac_offset; uint32_t max_patch_size; } patch_info; /* h/w config control block */ typedef struct { uint32_t max_patch_size; uint32_t baudrate; uint16_t lmp_subversion; uint16_t lmp_subversion_default; uint16_t lmp_sub_current; uint8_t state; /* Hardware configuration state */ uint8_t eversion; uint32_t project_id_mask; uint8_t hci_version; uint8_t hci_revision; uint8_t chip_type; } bt_hw_cfg_cb_t; static patch_info patch_table[] = { /* lmp_subv hci_version_mask hci_revision_mask chip_type_mask project_id_mask fw name config name mac offset max_patch_size */ {0x1200, HCI_VERSION_MASK_ALL, HCI_REVISION_MASK_ALL, CHIP_TYPE_MASK_ALL, 1<<0, "rtl8723as_fw", "rtl8723as_config", CONFIG_MAC_OFFSET_GEN_1_2, MAX_PATCH_SIZE_24K}, //Rtl8723AS #ifdef RTL_8723BS_BT_USED {0x8723, ~(HCI_VERSION_MASK_21), ~(1<<0xd), CHIP_TYPE_MASK_ALL, 1<<1, "rtl8723bs_fw", "rtl8723bs_config", CONFIG_MAC_OFFSET_GEN_1_2, MAX_PATCH_SIZE_24K}, //Rtl8723BS #else {0x8723, ~(HCI_VERSION_MASK_21), ~(1<<0xd), CHIP_TYPE_MASK_ALL, 1<<1, "rtl8723bs_VQ0_fw", "rtl8723bs_VQ0_config", CONFIG_MAC_OFFSET_GEN_1_2, MAX_PATCH_SIZE_24K}, //Rtl8723BS_VQ0 #endif {0x8821, HCI_VERSION_MASK_ALL, ~(1<<0xc), CHIP_TYPE_MASK_ALL, 1<<2, "rtl8821as_fw", "rtl8821as_config", CONFIG_MAC_OFFSET_GEN_1_2, MAX_PATCH_SIZE_24K}, //Rtl8821AS /* {0x8761, HCI_VERSION_MASK_ALL, HCI_REVISION_MASK_ALL, CHIP_TYPE_MASK_ALL, 1<<3, "rtl8761at_fw", "rtl8761at_config", CONFIG_MAC_OFFSET_GEN_1_2, MAX_PATCH_SIZE_24K}, //Rtl8761AW */ {0x8761, HCI_VERSION_MASK_ALL, ~(1<<0xb), CHIP_TYPE_MASK_ALL, 1<<3, "rtl8761at_fw", "rtl8761at_config", CONFIG_MAC_OFFSET_GEN_1_2, MAX_PATCH_SIZE_24K}, //Rtl8761AW {0x8761, HCI_VERSION_MASK_ALL, (1<<0xb), CHIP_TYPE_MASK_ALL, 1<<14, "rtl8761bt_fw", "rtl8761bt_config", CONFIG_MAC_OFFSET_GEN_4PLUS, MAX_PATCH_SIZE_40K}, //Rtl8761BW {0x8723, HCI_VERSION_MASK_21, HCI_REVISION_MASK_ALL, CHIP_TYPE_MASK_ALL, 1<<4, "rtl8703as_fw", "rtl8703as_config", CONFIG_MAC_OFFSET_GEN_1_2, MAX_PATCH_SIZE_24K}, //Rtl8703AS {0x8703, HCI_VERSION_MASK_ALL, HCI_REVISION_MASK_ALL, 1<<7, 1<<6, "rtl8703bs_fw", "rtl8703bs_config", CONFIG_MAC_OFFSET_GEN_3PLUS, MAX_PATCH_SIZE_24K}, //Rtl8703BS {0x8703, HCI_VERSION_MASK_ALL, HCI_REVISION_MASK_ALL, 1<<5, 1<<7, "rtl8723cs_xx_fw", "rtl8723cs_xx_config", CONFIG_MAC_OFFSET_GEN_3PLUS, MAX_PATCH_SIZE_24K}, //rtl8723cs_xx {0x8703, HCI_VERSION_MASK_ALL, HCI_REVISION_MASK_ALL, 1<<3, 1<<7, "rtl8723cs_cg_fw", "rtl8723cs_cg_config", CONFIG_MAC_OFFSET_GEN_3PLUS, MAX_PATCH_SIZE_24K}, //rtl8723cs_cg {0x8703, HCI_VERSION_MASK_ALL, HCI_REVISION_MASK_ALL, 1<<4, 1<<7, "rtl8723cs_vf_fw", "rtl8723cs_vf_config", CONFIG_MAC_OFFSET_GEN_3PLUS, MAX_PATCH_SIZE_24K}, //rtl8723cs_vf /* {0x8822, HCI_VERSION_MASK_ALL, HCI_REVISION_MASK_ALL, CHIP_TYPE_MASK_ALL, 1<<8, "rtl8822bs_fw", "rtl8822bs_config", CONFIG_MAC_OFFSET_GEN_3PLUS, MAX_PATCH_SIZE_24K}, //Rtl8822BS */ {0x8822, HCI_VERSION_MASK_ALL, ~(1<<0xc), CHIP_TYPE_MASK_ALL, 1<<8, "rtl8822bs_fw", "rtl8822bs_config", CONFIG_MAC_OFFSET_GEN_3PLUS, MAX_PATCH_SIZE_24K}, //Rtl8822BS {0x8822, HCI_VERSION_MASK_ALL, (1<<0xc), CHIP_TYPE_MASK_ALL, 1<<13, "rtl8822cs_fw", "rtl8822cs_config", CONFIG_MAC_OFFSET_GEN_4PLUS, MAX_PATCH_SIZE_40K}, //Rtl8822CS {0x8723, HCI_VERSION_MASK_ALL, (1<<0xd), ~(1<<7), 1<<9, "rtl8723ds_fw", "rtl8723ds_config", CONFIG_MAC_OFFSET_GEN_3PLUS, MAX_PATCH_SIZE_40K}, //Rtl8723ds {0x8723, HCI_VERSION_MASK_ALL, (1<<0xd), 1<<7, 1<<9, "rtl8703cs_fw", "rtl8703cs_config", CONFIG_MAC_OFFSET_GEN_3PLUS, MAX_PATCH_SIZE_40K}, //Rtl8703cs {0x8821, HCI_VERSION_MASK_ALL, (1<<0xc), CHIP_TYPE_MASK_ALL, 1<<10, "rtl8821cs_fw", "rtl8821cs_config", CONFIG_MAC_OFFSET_GEN_3PLUS, MAX_PATCH_SIZE_40K}, //RTL8821CS /* todo: RTL8703CS */ {LMP_SUBVERSION_NONE, HCI_VERSION_MASK_ALL, HCI_REVISION_MASK_ALL, CHIP_TYPE_MASK_ALL, PROJECT_ID_MASK_ALL, "rtl_none_fw", "rtl_none_config", CONFIG_MAC_OFFSET_GEN_1_2, MAX_PATCH_SIZE_24K} }; static bt_hw_cfg_cb_t hw_cfg_cb; static uint8_t gEVersion; static RTK_ROM_VERSION_CMD_STATE gRom_version_cmd_state; static RTK_ROM_VERSION_CMD_STATE ghci_version_cmd_state; static RTK_ROM_VERSION_CMD_STATE gchip_type_cmd_state; static int gHwFlowControlEnable; static int gFinalSpeed; /* signature: Realtech */ static const uint8_t RTK_EPATCH_SIGNATURE[8] = {0x52, 0x65, 0x61, 0x6C, 0x74, 0x65, 0x63, 0x68}; /* Extension Section IGNATURE:0x77FD0451 */ static const uint8_t Extension_Section_SIGNATURE[4] = {0x51, 0x04, 0xFD, 0x77}; static int serial_fd; static int h5_max_retries = 40; static struct rtk_h5_struct rtk_h5; static struct patch_struct rtk_patch; /* bite reverse in bytes 00000001 -> 10000000 00000100 -> 00100000 */ static const uint8_t byte_rev_table[256] = { 0x00, 0x80, 0x40, 0xc0, 0x20, 0xa0, 0x60, 0xe0, 0x10, 0x90, 0x50, 0xd0, 0x30, 0xb0, 0x70, 0xf0, 0x08, 0x88, 0x48, 0xc8, 0x28, 0xa8, 0x68, 0xe8, 0x18, 0x98, 0x58, 0xd8, 0x38, 0xb8, 0x78, 0xf8, 0x04, 0x84, 0x44, 0xc4, 0x24, 0xa4, 0x64, 0xe4, 0x14, 0x94, 0x54, 0xd4, 0x34, 0xb4, 0x74, 0xf4, 0x0c, 0x8c, 0x4c, 0xcc, 0x2c, 0xac, 0x6c, 0xec, 0x1c, 0x9c, 0x5c, 0xdc, 0x3c, 0xbc, 0x7c, 0xfc, 0x02, 0x82, 0x42, 0xc2, 0x22, 0xa2, 0x62, 0xe2, 0x12, 0x92, 0x52, 0xd2, 0x32, 0xb2, 0x72, 0xf2, 0x0a, 0x8a, 0x4a, 0xca, 0x2a, 0xaa, 0x6a, 0xea, 0x1a, 0x9a, 0x5a, 0xda, 0x3a, 0xba, 0x7a, 0xfa, 0x06, 0x86, 0x46, 0xc6, 0x26, 0xa6, 0x66, 0xe6, 0x16, 0x96, 0x56, 0xd6, 0x36, 0xb6, 0x76, 0xf6, 0x0e, 0x8e, 0x4e, 0xce, 0x2e, 0xae, 0x6e, 0xee, 0x1e, 0x9e, 0x5e, 0xde, 0x3e, 0xbe, 0x7e, 0xfe, 0x01, 0x81, 0x41, 0xc1, 0x21, 0xa1, 0x61, 0xe1, 0x11, 0x91, 0x51, 0xd1, 0x31, 0xb1, 0x71, 0xf1, 0x09, 0x89, 0x49, 0xc9, 0x29, 0xa9, 0x69, 0xe9, 0x19, 0x99, 0x59, 0xd9, 0x39, 0xb9, 0x79, 0xf9, 0x05, 0x85, 0x45, 0xc5, 0x25, 0xa5, 0x65, 0xe5, 0x15, 0x95, 0x55, 0xd5, 0x35, 0xb5, 0x75, 0xf5, 0x0d, 0x8d, 0x4d, 0xcd, 0x2d, 0xad, 0x6d, 0xed, 0x1d, 0x9d, 0x5d, 0xdd, 0x3d, 0xbd, 0x7d, 0xfd, 0x03, 0x83, 0x43, 0xc3, 0x23, 0xa3, 0x63, 0xe3, 0x13, 0x93, 0x53, 0xd3, 0x33, 0xb3, 0x73, 0xf3, 0x0b, 0x8b, 0x4b, 0xcb, 0x2b, 0xab, 0x6b, 0xeb, 0x1b, 0x9b, 0x5b, 0xdb, 0x3b, 0xbb, 0x7b, 0xfb, 0x07, 0x87, 0x47, 0xc7, 0x27, 0xa7, 0x67, 0xe7, 0x17, 0x97, 0x57, 0xd7, 0x37, 0xb7, 0x77, 0xf7, 0x0f, 0x8f, 0x4f, 0xcf, 0x2f, 0xaf, 0x6f, 0xef, 0x1f, 0x9f, 0x5f, 0xdf, 0x3f, 0xbf, 0x7f, 0xff, }; /* reverse bit */ static __inline uint8_t bit_rev8(uint8_t byte) { return byte_rev_table[byte]; } /* reverse bit */ static __inline uint16_t bit_rev16(uint16_t x) { return (bit_rev8(x & 0xff) << 8) | bit_rev8(x >> 8); } static const uint16_t crc_table[] = { 0x0000, 0x1081, 0x2102, 0x3183, 0x4204, 0x5285, 0x6306, 0x7387, 0x8408, 0x9489, 0xa50a, 0xb58b, 0xc60c, 0xd68d, 0xe70e, 0xf78f }; /** * Malloc the socket buffer * * @param skb socket buffer * @return the point to the malloc buffer */ static __inline struct sk_buff *skb_alloc(uint32_t len) { struct sk_buff *skb = NULL; skb = malloc(len + 8); if (skb) { skb->max_len = len; skb->data_len = 0; memset(skb->data, 0, len); } else { RS_ERR("Allocate skb fails!!!"); skb = NULL; } return skb; } /** * Free the socket buffer * * @param skb socket buffer */ static __inline void skb_free(struct sk_buff *skb) { free(skb); return; } /** * Increase the date length in sk_buffer by len, * and return the increased header pointer * * @param skb socket buffer * @param len length want to increase * @return the pointer to increased header */ static uint8_t *skb_put(struct sk_buff *skb, uint32_t len) { uint32_t old_len = skb->data_len; if ((skb->data_len + len) > (skb->max_len)) { RS_ERR("Buffer too small"); return NULL; } skb->data_len += len; return (skb->data + old_len); } /** * decrease data length in sk_buffer by to len by cut the tail * * @warning len should be less than skb->len * * @param skb socket buffer * @param len length want to be changed */ static void skb_trim(struct sk_buff *skb, int len) { if (skb->data_len > len) { skb->data_len = len; } else { RS_ERR("Error: skb->data_len(%ld) < len(%d)", (long int)skb->data_len, len); } } /** * Decrease the data length in sk_buffer by len, * and move the content forward to the header. * the data in header will be removed. * * @param skb socket buffer * @param len length of data * @return new data */ static uint8_t *skb_pull(struct sk_buff *skb, uint32_t len) { skb->data_len -= len; char *buf; buf = malloc(skb->data_len); if (!buf) { RS_ERR("Unable to allocate file buffer"); exit(1); } memcpy(buf, skb->data+len, skb->data_len); memcpy(skb->data, buf, skb->data_len); free(buf); return skb->data; } /** * Add "d" into crc scope, caculate the new crc value * * @param crc crc data * @param d one byte data */ static void h5_crc_update(uint16_t *crc, uint8_t d) { uint16_t reg = *crc; reg = (reg >> 4) ^ crc_table[(reg ^ d) & 0x000f]; reg = (reg >> 4) ^ crc_table[(reg ^ (d >> 4)) & 0x000f]; *crc = reg; } struct __una_u16 { uint16_t x; }; static __inline uint16_t __get_unaligned_cpu16(const void *p) { const struct __una_u16 *ptr = (const struct __una_u16 *)p; return ptr->x; } static __inline uint16_t get_unaligned_be16(const void *p) { return __get_unaligned_cpu16((const uint8_t *)p); } /** * Get crc data. * * @param h5 realtek h5 struct * @return crc data */ static uint16_t h5_get_crc(struct rtk_h5_struct *h5) { uint16_t crc = 0; uint8_t *data = h5->rx_skb->data + h5->rx_skb->data_len - 2; crc = data[1] + (data[0] << 8); return crc; } /** * Just add 0xc0 at the end of skb, * we can also use this to add 0xc0 at start while there is no data in skb * * @param skb socket buffer */ static void h5_slip_msgdelim(struct sk_buff *skb) { const char pkt_delim = 0xc0; memcpy(skb_put(skb, 1), &pkt_delim, 1); } /** * Slip ecode one byte in h5 proto, as follows: * 0xc0 -> 0xdb, 0xdc * 0xdb -> 0xdb, 0xdd * 0x11 -> 0xdb, 0xde * 0x13 -> 0xdb, 0xdf * others will not change * * @param skb socket buffer * @c pure data in the one byte */ static void h5_slip_one_byte(struct sk_buff *skb, uint8_t c) { const int8_t esc_c0[2] = { 0xdb, 0xdc }; const int8_t esc_db[2] = { 0xdb, 0xdd }; const int8_t esc_11[2] = { 0xdb, 0xde }; const int8_t esc_13[2] = { 0xdb, 0xdf }; switch (c) { case 0xc0: memcpy(skb_put(skb, 2), &esc_c0, 2); break; case 0xdb: memcpy(skb_put(skb, 2), &esc_db, 2); break; case 0x11: memcpy(skb_put(skb, 2), &esc_11, 2); break; case 0x13: memcpy(skb_put(skb, 2), &esc_13, 2); break; default: memcpy(skb_put(skb, 1), &c, 1); } } /** * Decode one byte in h5 proto, as follows: * 0xdb, 0xdc -> 0xc0 * 0xdb, 0xdd -> 0xdb * 0xdb, 0xde -> 0x11 * 0xdb, 0xdf -> 0x13 * others will not change * * @param h5 realtek h5 struct * @byte pure data in the one byte */ static void h5_unslip_one_byte(struct rtk_h5_struct *h5, char byte) { const uint8_t c0 = 0xc0, db = 0xdb; const uint8_t oof1 = 0x11, oof2 = 0x13; //RS_DBG("HCI 3wire h5_unslip_one_byte"); if (H5_ESCSTATE_NOESC == h5->rx_esc_state) { if (0xdb == byte) { h5->rx_esc_state = H5_ESCSTATE_ESC; } else { memcpy(skb_put(h5->rx_skb, 1), &byte, 1); //Check Pkt Header's CRC enable bit if ((h5->rx_skb->data[0] & 0x40) != 0 && h5->rx_state != H5_W4_CRC) { h5_crc_update(&h5->message_crc, byte); } h5->rx_count--; } } else if (H5_ESCSTATE_ESC == h5->rx_esc_state) { switch (byte) { case 0xdc: memcpy(skb_put(h5->rx_skb, 1), &c0, 1); if ((h5->rx_skb->data[0] & 0x40) != 0 && h5->rx_state != H5_W4_CRC) h5_crc_update(&h5->message_crc, 0xc0); h5->rx_esc_state = H5_ESCSTATE_NOESC; h5->rx_count--; break; case 0xdd: memcpy(skb_put(h5->rx_skb, 1), &db, 1); if ((h5->rx_skb->data[0] & 0x40) != 0 && h5->rx_state != H5_W4_CRC) h5_crc_update(&h5->message_crc, 0xdb); h5->rx_esc_state = H5_ESCSTATE_NOESC; h5->rx_count--; break; case 0xde: memcpy(skb_put(h5->rx_skb, 1), &oof1, 1); if ((h5->rx_skb->data[0] & 0x40) != 0 && h5->rx_state != H5_W4_CRC) h5_crc_update(&h5->message_crc, oof1); h5->rx_esc_state = H5_ESCSTATE_NOESC; h5->rx_count--; break; case 0xdf: memcpy(skb_put(h5->rx_skb, 1), &oof2, 1); if ((h5->rx_skb->data[0] & 0x40) != 0 && h5->rx_state != H5_W4_CRC) h5_crc_update(&h5->message_crc, oof2); h5->rx_esc_state = H5_ESCSTATE_NOESC; h5->rx_count--; break; default: RS_ERR("Error: Invalid byte %02x after esc byte", byte); skb_free(h5->rx_skb); h5->rx_skb = NULL; h5->rx_state = H5_W4_PKT_DELIMITER; h5->rx_count = 0; break; } } } /** * Prepare h5 packet, packet format as follow: * | LSB 4 octets | 0 ~ 4095 | 2 MSB * |packet header | payload | data integrity check | * * pakcket header fromat is show below: * | LSB 3 bits | 3 bits | 1 bits | 1 bits | * | 4 bits | 12 bits | 8 bits MSB * |sequence number | acknowledgement number | data integrity check present | reliable packet | * |packet type | payload length | header checksum * * @param h5 realtek h5 struct * @param data pure data * @param len the length of data * @param pkt_type packet type * @return socket buff after prepare in h5 proto */ static struct sk_buff *h5_prepare_pkt(struct rtk_h5_struct *h5, uint8_t *data, int32_t len, int32_t pkt_type) { struct sk_buff *nskb; uint8_t hdr[4]; uint16_t h5_txmsg_crc = 0xffff; int rel, i; switch (pkt_type) { case HCI_ACLDATA_PKT: case HCI_COMMAND_PKT: case HCI_EVENT_PKT: rel = 1; /* reliable */ break; case H5_ACK_PKT: case H5_VDRSPEC_PKT: case H5_LINK_CTL_PKT: rel = 0; /* unreliable */ break; default: RS_ERR("Unknown packet type"); return NULL; } /* Max len of packet: (original len +4(h5 hdr) + 2(crc)) * 2 * (because bytes 0xc0 and 0xdb are escaped, worst case is * when the packet is all made of 0xc0 and 0xdb :)) * + 2 (0xc0 delimiters at start and end). */ nskb = skb_alloc((len + 6) * 2 + 2); if (!nskb) return NULL; /* Add SLIP start byte: 0xc0 */ h5_slip_msgdelim(nskb); /* set AckNumber in SlipHeader */ hdr[0] = h5->rxseq_txack << 3; h5->is_txack_req = 0; if (rel) { /* set reliable pkt bit and SeqNumber */ hdr[0] |= 0x80 + h5->msgq_txseq; ++(h5->msgq_txseq); h5->msgq_txseq = (h5->msgq_txseq) & 0x07; } /* set DicPresent bit */ if (h5->use_crc) hdr[0] |= 0x40; /* set packet type and payload length */ hdr[1] = ((len << 4) & 0xff) | pkt_type; hdr[2] = (uint8_t)(len >> 4); /* set checksum */ hdr[3] = ~(hdr[0] + hdr[1] + hdr[2]); /* Put h5 header */ for (i = 0; i < 4; i++) { h5_slip_one_byte(nskb, hdr[i]); if (h5->use_crc) h5_crc_update(&h5_txmsg_crc, hdr[i]); } /* Put payload */ for (i = 0; i < len; i++) { h5_slip_one_byte(nskb, data[i]); if (h5->use_crc) h5_crc_update(&h5_txmsg_crc, data[i]); } /* Put CRC */ if (h5->use_crc) { h5_txmsg_crc = bit_rev16(h5_txmsg_crc); h5_slip_one_byte(nskb, (uint8_t) ((h5_txmsg_crc >> 8) & 0x00ff)); h5_slip_one_byte(nskb, (uint8_t) (h5_txmsg_crc & 0x00ff)); } /* Add SLIP end byte: 0xc0 */ h5_slip_msgdelim(nskb); return nskb; } /** * Removed controller acked packet from Host's unacked lists * * @param h5 realtek h5 struct */ static void h5_remove_acked_pkt(struct rtk_h5_struct *h5) { int pkts_to_be_removed = 0; int seqno = 0; int i = 0; seqno = h5->msgq_txseq; while (pkts_to_be_removed) { if (h5->rxack == seqno) break; pkts_to_be_removed--; seqno = (seqno - 1) & 0x07; } if (h5->rxack != seqno) { RS_DBG("Peer acked invalid packet"); } i = 0; for (i = 0; i < 5; ++i) { if (i >= pkts_to_be_removed) break; i++; } if (i != pkts_to_be_removed) RS_DBG("Removed only (%d) out of (%d) pkts", i, pkts_to_be_removed); } /** * Realtek send pure ack, send a packet only with an ack * * @param fd uart file descriptor * */ static void rtk_send_pure_ack_down(int fd) { struct sk_buff *nskb = h5_prepare_pkt(&rtk_h5, NULL, 0, H5_ACK_PKT); write(fd, nskb->data, nskb->data_len); skb_free(nskb); return; } /** * Parse hci event command complete, pull the cmd complete event header * * @param skb socket buffer * */ static void hci_event_cmd_complete(struct sk_buff *skb) { struct hci_ev_cmd_complete *ev = NULL; uint16_t opcode = 0; uint8_t status = 0; /* omit length check */ /* pull hdr */ skb_pull(skb, HCI_EVENT_HDR_SIZE); ev = (struct hci_ev_cmd_complete *)skb->data; opcode = le16_to_cpu(ev->opcode); RS_DBG("receive hci command complete event with command: %x", opcode); if (DBG_ON) { RS_DBG("Dump event data with event header (header size %d):", sizeof(struct hci_ev_cmd_complete)); RS_DUMP(skb->data, skb->data_len); } /* pull command complete event header */ skb_pull(skb, sizeof(struct hci_ev_cmd_complete)); switch (opcode) { case HCI_VENDOR_CHANGE_BDRATE: status = skb->data[0]; RS_DBG("Change BD Rate with status:%x", status); skb_free(rtk_h5.host_last_cmd); rtk_h5.host_last_cmd = NULL; rtk_h5.link_estab_state = H5_PATCH; break; case HCI_CMD_READ_BD_ADDR: status = skb->data[0]; RS_DBG("Read BD Address with Status:%x", status); if (!status) { RS_DBG("BD Address: %8x%8x", *(int *)&skb->data[1], *(int *)&skb->data[5]); } break; case HCI_VENDOR_READ_LMP_VERISION: ghci_version_cmd_state = event_received; status = skb->data[0]; RS_DBG("Read RTK LMP version with Status:%x", status); if (0 == status) { hw_cfg_cb.hci_version = *(uint8_t *)(&skb->data[1]); hw_cfg_cb.hci_revision = *(uint8_t *)(&skb->data[2]); hw_cfg_cb.lmp_subversion = le16_to_cpu(*(uint16_t *)(&skb->data[7])); } else { RS_ERR("READ_RTK_ROM_VERISION return status error!"); /* Need to do more */ } skb_free(rtk_h5.host_last_cmd); rtk_h5.host_last_cmd = NULL; break; case HCI_VENDOR_READ_CHIP_TYPE: gchip_type_cmd_state = event_received; status = skb->data[0]; RS_DBG("Read RTK CHIP TYPE with Status:%x", status); if (0 == status) { hw_cfg_cb.chip_type = *(uint8_t *)(&skb->data[1]); } else { RS_ERR("READ_RTK_CHIP_TYPE return status error!"); } skb_free(rtk_h5.host_last_cmd); rtk_h5.host_last_cmd = NULL; break; case HCI_VENDOR_READ_RTK_ROM_VERISION: gRom_version_cmd_state = event_received; status = skb->data[0]; RS_DBG("Read RTK rom version with Status:%x", status); if (0 == status) gEVersion = skb->data[1]; else if (1 == status) gEVersion = 0; else { gEVersion = 0; RS_ERR("READ_RTK_ROM_VERISION return status error!"); /* Need to do more */ } skb_free(rtk_h5.host_last_cmd); rtk_h5.host_last_cmd = NULL; break; } } /** * Check if it's a hci frame, if it is, complete it with response or parse the cmd complete event * * @param skb socket buffer * */ static void hci_recv_frame(struct sk_buff *skb) { char h5sync[2] = {0x01, 0x7E}, h5syncresp[2] = {0x02, 0x7D}, h5_sync_resp_pkt[0x8] = {0xc0, 0x00, 0x2F, 0x00, 0xD0, 0x02, 0x7D, 0xc0}, h5_conf_resp_pkt_to_Ctrl[0x8] = {0xc0, 0x00, 0x2F, 0x00, 0xD0, 0x04, 0x7B, 0xc0}, h5conf[3] = {0x03, 0xFC, 0x10}, h5confresp[3] = {0x04, 0x7B, 0x10}, cmd_complete_evt_code = 0xe; if (rtk_h5.link_estab_state == H5_SYNC) { /* sync */ if (!memcmp(skb->data, h5sync, 2)) { RS_DBG("Get Sync Pkt\n"); write(serial_fd, &h5_sync_resp_pkt, 0x8); } else if (!memcmp(skb->data, h5syncresp, 2)) { RS_DBG("Get Sync Resp Pkt\n"); rtk_h5.link_estab_state = H5_CONFIG; } skb_free(skb); } else if (rtk_h5.link_estab_state == H5_CONFIG) { /* config */ if (!memcmp(skb->data, h5sync, 0x2)) { write(serial_fd, &h5_sync_resp_pkt, 0x8); RS_DBG("Get SYNC pkt-active mode\n"); } else if (!memcmp(skb->data, h5conf, 0x2)) { write(serial_fd, &h5_conf_resp_pkt_to_Ctrl, 0x8); RS_DBG("Get CONFG pkt-active mode\n"); } else if (!memcmp(skb->data, h5confresp, 0x2)) { RS_DBG("Get CONFG resp pkt-active mode\n"); rtk_h5.link_estab_state = H5_INIT;//H5_PATCH; //rtk_send_pure_ack_down(serial_fd); } else { RS_DBG("H5_CONFIG receive event\n"); rtk_send_pure_ack_down(serial_fd); } skb_free(skb); } else if (rtk_h5.link_estab_state == H5_INIT) { if (skb->data[0] == cmd_complete_evt_code) { hci_event_cmd_complete(skb); } rtk_send_pure_ack_down(serial_fd); usleep(10000); rtk_send_pure_ack_down(serial_fd); usleep(10000); rtk_send_pure_ack_down(serial_fd); skb_free(skb); } else if (rtk_h5.link_estab_state == H5_PATCH) { /* patch */ rtk_patch.nRxIndex = skb->data[6]; if (rtk_patch.nRxIndex & 0x80) rtk_patch.nRxIndex &= ~0x80; RS_DBG("rtk_patch.nRxIndex %d\n", rtk_patch.nRxIndex); if (rtk_patch.nRxIndex == rtk_patch.nTotal) rtk_h5.link_estab_state = H5_ACTIVE; skb_free(skb); } else { RS_ERR("receive packets in active state"); skb_free(skb); } } /** * after rx data is parsed, and we got a rx frame saved in h5->rx_skb, * this routinue is called. * things todo in this function: * 1. check if it's a hci frame, if it is, complete it with response or ack * 2. see the ack number, free acked frame in queue * 3. reset h5->rx_state, set rx_skb to null. * * @param h5 realtek h5 struct * */ static void h5_complete_rx_pkt(struct rtk_h5_struct *h5) { int pass_up = 1; uint16_t *valuep, value_t; H5_PKT_HEADER *h5_hdr = NULL; /* 1 is offset of uint16_t in H5_PKT_HEADER */ valuep = (uint16_t *)(h5->rx_skb->data+1); value_t = le16_to_cpu(*valuep); *valuep = value_t; h5_hdr = (H5_PKT_HEADER *)(h5->rx_skb->data); if (h5_hdr->ReliablePkt) { RS_DBG("Received reliable seqno %u from card", h5->rxseq_txack); h5->rxseq_txack = h5_hdr->SeqNumber + 1; h5->rxseq_txack %= 8; h5->is_txack_req = 1; /* send down an empty ack if needed. */ } h5->rxack = h5_hdr->AckNumber; switch (h5_hdr->PktType) { case HCI_ACLDATA_PKT: case HCI_EVENT_PKT: case HCI_SCODATA_PKT: case HCI_COMMAND_PKT: case H5_LINK_CTL_PKT: pass_up = 1; break; default: pass_up = 0; } h5_remove_acked_pkt(h5); /* decide if we need to pass up. */ if (pass_up) { /* remove h5 header and send packet to hci */ skb_pull(h5->rx_skb, sizeof(H5_PKT_HEADER)); hci_recv_frame(h5->rx_skb); /* should skb be freed here? */ } else { /* free skb buffer */ skb_free(h5->rx_skb); } h5->rx_state = H5_W4_PKT_DELIMITER; h5->rx_skb = NULL; } /** * Parse the receive data in h5 proto. * * @param h5 realtek h5 struct * @param data point to data received before parse * @param count num of data * @return reserved count */ static int h5_recv(struct rtk_h5_struct *h5, void *data, int count) { char *ptr; ptr = (char *)data; while (count) { if (h5->rx_count) { if (*ptr == 0xc0) { RS_ERR("short h5 packet"); skb_free(h5->rx_skb); h5->rx_state = H5_W4_PKT_START; h5->rx_count = 0; } else { h5_unslip_one_byte(h5, *ptr); } ptr++; count--; continue; } switch (h5->rx_state) { case H5_W4_HDR: /* check header checksum. see Core Spec V4 "3-wire uart" page 67 */ if ((0xff & (uint8_t) ~(h5->rx_skb->data[0] + h5->rx_skb->data[1] + h5->rx_skb->data[2])) != h5->rx_skb->data[3]) { RS_ERR("h5 hdr checksum error!!!"); skb_free(h5->rx_skb); h5->rx_state = H5_W4_PKT_DELIMITER; h5->rx_count = 0; continue; } if (h5->rx_skb->data[0] & 0x80 /* reliable pkt */ && (h5->rx_skb->data[0] & 0x07) != h5->rxseq_txack) { RS_ERR("Out-of-order packet arrived, got(%d)expected(%u)", h5->rx_skb->data[0] & 0x07, h5->rxseq_txack); h5->is_txack_req = 1; skb_free(h5->rx_skb); h5->rx_state = H5_W4_PKT_DELIMITER; h5->rx_count = 0; if (rtk_patch.nTxIndex == rtk_patch.nTotal) { /* depend on weather remote will reset ack numb or not!!!!!!!!!!!!!!!special */ rtk_h5.rxseq_txack = h5->rx_skb->data[0] & 0x07; } continue; } h5->rx_state = H5_W4_DATA; /* payload length: May be 0 */ h5->rx_count = (h5->rx_skb->data[1] >> 4) + (h5->rx_skb->data[2] << 4); continue; case H5_W4_DATA: if (h5->rx_skb->data[0] & 0x40) { /* pkt with crc */ h5->rx_state = H5_W4_CRC; h5->rx_count = 2; } else { h5_complete_rx_pkt(h5); /* Send ACK */ } continue; case H5_W4_CRC: if (bit_rev16(h5->message_crc) != h5_get_crc(h5)) { RS_ERR("Checksum failed, computed(%04x)received(%04x)", bit_rev16(h5->message_crc), h5_get_crc(h5)); skb_free(h5->rx_skb); h5->rx_state = H5_W4_PKT_DELIMITER; h5->rx_count = 0; continue; } skb_trim(h5->rx_skb, h5->rx_skb->data_len - 2); h5_complete_rx_pkt(h5); continue; case H5_W4_PKT_DELIMITER: switch (*ptr) { case 0xc0: h5->rx_state = H5_W4_PKT_START; break; default: break; } ptr++; count--; break; case H5_W4_PKT_START: switch (*ptr) { case 0xc0: ptr++; count--; break; default: h5->rx_state = H5_W4_HDR; h5->rx_count = 4; h5->rx_esc_state = H5_ESCSTATE_NOESC; h5->message_crc = 0xffff; /* Do not increment ptr or decrement count * Allocate packet. Max len of a H5 pkt= * 0xFFF (payload) +4 (header) +2 (crc) */ h5->rx_skb = skb_alloc(0x1005); if (!h5->rx_skb) { h5->rx_state = H5_W4_PKT_DELIMITER; h5->rx_count = 0; return 0; } break; } break; } } return count; } /** * Read data to buf from uart. * * @param fd uart file descriptor * @param buf point to the addr where read data stored * @param count num of data want to read * @return num of data successfully read */ static int read_check(int fd, void *buf, int count) { int res; do { res = read(fd, buf, count); if (res != -1) { buf = (uint8_t *)buf + res; count -= res; return res; } } while (count && (errno == 0 || errno == EINTR)); return res; } /** * Retry to sync when timeout in h5 proto, max retry times is 10. * * @warning Each time to retry, the time for timeout will be set as 1s. * * @param sig signaction for timeout * */ static void h5_tshy_sig_alarm(int sig) { uint8_t h5sync[2] = {0x01, 0x7E}; static int retries; struct itimerval value; if (retries < h5_max_retries) { retries++; struct sk_buff *nskb = h5_prepare_pkt(&rtk_h5, h5sync, sizeof(h5sync), H5_LINK_CTL_PKT); int len = write(serial_fd, nskb->data, nskb->data_len); RS_DBG("3-wire sync pattern resend : %d, len: %d\n", retries, len); skb_free(nskb); /* retry per 250ms */ value.it_value.tv_sec = 0; value.it_value.tv_usec = 250000; value.it_interval.tv_sec = 0; value.it_interval.tv_usec = 250000; setitimer(ITIMER_REAL, &value, NULL); return; } tcflush(serial_fd, TCIOFLUSH); RS_ERR("H5 sync timed out\n"); exit(1); } /** * Retry to config when timeout in h5 proto, max retry times is 10. * * @warning Each time to retry, the time for timeout will be set as 1s. * * @param sig signaction for timeout * */ static void h5_tconf_sig_alarm(int sig) { uint8_t h5conf[3] = {0x03, 0xFC, 0x14}; static int retries; struct itimerval value; if (retries < h5_max_retries) { retries++; struct sk_buff *nskb = h5_prepare_pkt(&rtk_h5, h5conf, 3, H5_LINK_CTL_PKT); int len = write(serial_fd, nskb->data, nskb->data_len); RS_DBG("3-wire config pattern resend : %d , len: %d", retries, len); skb_free(nskb); /* retry per 250ms */ value.it_value.tv_sec = 0; value.it_value.tv_usec = 250000; value.it_interval.tv_sec = 0; value.it_interval.tv_usec = 250000; setitimer(ITIMER_REAL, &value, NULL); return; } tcflush(serial_fd, TCIOFLUSH); RS_ERR("H5 config timed out\n"); exit(1); } /** * Retry to init when timeout in h5 proto, max retry times is 10. * * @warning Each time to retry, the time for timeout will be set as 1s. * * @param sig signaction for timeout * */ static void h5_tinit_sig_alarm(int sig) { static int retries; if (retries < h5_max_retries) { retries++; if (rtk_h5.host_last_cmd) { int len = write(serial_fd, rtk_h5.host_last_cmd->data, rtk_h5.host_last_cmd->data_len); RS_DBG("3-wire change baudrate re send:%d, len:%d", retries, len); alarm(1); return; } else { RS_DBG("3-wire init timeout without last command stored\n"); } } tcflush(serial_fd, TCIOFLUSH); RS_ERR("H5 init process timed out"); exit(1); } /** * Retry to download patch when timeout in h5 proto, max retry times is 10. * * @warning Each time to retry, the time for timeout will be set as 3s. * * @param sig signaction for timeout * */ static void h5_tpatch_sig_alarm(int sig) { static int retries; if (retries < h5_max_retries) { RS_DBG("patch timerout, retry:\n"); if (rtk_h5.host_last_cmd) { write(serial_fd, rtk_h5.host_last_cmd->data, rtk_h5.host_last_cmd->data_len); RS_DBG("3-wire download patch re send:%d", retries); } retries++; alarm(3); return; } RS_ERR("H5 patch timed out\n"); exit(1); } /** * Download patch using hci. For h5 proto, not recv reply for 2s will timeout. * Call h5_tpatch_sig_alarm for retry. * * @param dd uart file descriptor * @param index current index * @param data point to the config file * @param len current buf length * @return #0 on success * */ static int hci_download_patch(int dd, int index, uint8_t *data, int len, struct termios *ti) { uint8_t hcipatch[256] = {0x20, 0xfc, 00}; char bytes[READ_DATA_SIZE]; int retlen; struct sigaction sa; sa.sa_handler = h5_tpatch_sig_alarm; sigaction(SIGALRM, &sa, NULL); alarm(2); download_vendor_patch_cp cp; memset(&cp, 0, sizeof(cp)); cp.index = index; if (data != NULL) { memcpy(cp.data, data, len); } int nValue = rtk_patch.nTotal|0x80; if (index == nValue) { rtk_patch.nTxIndex = rtk_patch.nTotal; } else { rtk_patch.nTxIndex = index; } hcipatch[2] = len+1; memcpy(hcipatch+3, &cp, len+1); struct sk_buff *nskb = h5_prepare_pkt(&rtk_h5, hcipatch, len+4, HCI_COMMAND_PKT); /* data: len + head: 4 */ if (rtk_h5.host_last_cmd) { skb_free(rtk_h5.host_last_cmd); rtk_h5.host_last_cmd = NULL; } rtk_h5.host_last_cmd = nskb; len = write(dd, nskb->data, nskb->data_len); RS_DBG("hci_download_patch nTxIndex:%d nRxIndex: %d\n", rtk_patch.nTxIndex, rtk_patch.nRxIndex); if (index & 0x80) { RS_DBG("Hw Flow Control enable after last command sent before last event recv ! "); if (tcsetattr(dd, TCSADRAIN, ti) < 0) { RS_ERR("Can't set port settings"); return -1; } } while (rtk_patch.nRxIndex != rtk_patch.nTxIndex) { /* receive data and wait last pkt */ retlen = read_check(dd, &bytes, READ_DATA_SIZE); if (retlen == -1) { perror("read fail"); return -1; } h5_recv(&rtk_h5, &bytes, retlen); } alarm(0); return 0; } /** * Download h4 patch * * @param dd uart file descriptor * @param index current index * @param data point to the config file * @param len current buf length * @return ret_index * */ static int hci_download_patch_h4(int dd, int index, uint8_t *data, int len) { char bytes[257] = {0}; char buf[257] = {0x01, 0x20, 0xfc, 00}; RS_DBG("dd:%d, index:%d, len:%d", dd, index, len); if (NULL != data) { memcpy(&buf[5], data, len); } int cur_index = index; int ret_Index = -1; /* Set data struct. */ buf[3] = len + 1; /* add index */ buf[4] = cur_index; size_t total_len = len + 5; /* write */ uint16_t w_len; w_len = write(dd, buf, total_len); RS_DBG("h4 write success with len: %d.\n", w_len); uint16_t res; res = read(dd, bytes, 8); if (DBG_ON) { RS_DBG("h4 read success with len: %d.\n", res); int i = 0; for (i = 0; i < 8; i++) { fprintf(stderr, "byte[%d] = 0x%x\n", i, bytes[i]); } } uint8_t rstatus; if ((0x04 == bytes[0]) && (0x20 == bytes[4]) && (0xfc == bytes[5])) { ret_Index = bytes[7]; rstatus = bytes[6]; RS_DBG("---->ret_Index:%d, ----->rstatus:%d\n", ret_Index, rstatus); if (0x00 != rstatus) { RS_ERR("---->read event status is wrong.\n"); return -1; } } else { RS_ERR("==========>Didn't read curret data.\n"); return -1; } return ret_Index; } /** * Realtek change speed with h4 proto. Using vendor specified command packet to achieve this. * * @warning before write, need to wait 1s for device up * * @param fd uart file descriptor * @param baudrate the speed want to change * @return #0 on success */ static int rtk_vendor_change_speed_h4(int fd, uint32_t baudrate) { char bytes[257]; uint8_t cmd[8] = {0}; cmd[0] = 1; /* cmd */ cmd[1] = 0x17; /* ocf */ cmd[2] = 0xfc; /* ogf, vendor specified */ cmd[3] = 4; /* length */ #ifdef BAUDRATE_4BYTES memcpy((uint16_t *)&cmd[4], &baudrate, 4); #else memcpy((uint16_t *)&cmd[4], &baudrate, 2); cmd[6] = 0; cmd[7] = 0; #endif /* wait for a while for device to up, just h4 need it */ sleep(1); if (write(fd, cmd, 8) != 8) { RS_ERR("H4 change uart speed error when writing vendor command"); return -1; } RS_DBG("H4 Change uart Baudrate after write "); int res; res = read(fd, bytes, sizeof(bytes)); if (DBG_ON) { RS_DBG("Realtek Receving H4 change uart speed event:%x", res); RS_DUMP(bytes, res); } if ((0x04 == bytes[0]) && (0x17 == bytes[4]) && (0xfc == bytes[5])) { RS_DBG("H4 change uart speed success, receving status:%x", bytes[6]); if (bytes[6] == 0) return 0; } return -1; } /** * Parse realtek Bluetooth config file. * The config file if begin with vendor magic: RTK_VENDOR_CONFIG_MAGIC(8723ab55) * bt_addr is followed by 0x3c offset, it will be changed by bt_addr param * proto, baudrate and flow control is followed by 0xc offset, * * @param config_buf point to config file content * @param filelen length of config file * @param bt_addr where bt addr is stored * @return baudrate in config file * */ static uint32_t rtk_parse_config_file(uint8_t *config_buf, size_t filelen, char bt_addr[6]) { struct rtk_bt_vendor_config *config = (struct rtk_bt_vendor_config *) config_buf; uint16_t config_len = le16_to_cpu(config->data_len), temp = 0; struct rtk_bt_vendor_config_entry *entry = config->entry; uint16_t i; uint32_t baudrate = 0; if (le32_to_cpu(config->signature) != RTK_VENDOR_CONFIG_MAGIC) { RS_ERR("config signature magic number(%x) is not set to RTK_VENDOR_CONFIG_MAGIC", (int)config->signature); return 0; } if (config_len != filelen - sizeof(struct rtk_bt_vendor_config)) { RS_ERR("config len(%x) is not right(%x)", config_len, filelen-sizeof(struct rtk_bt_vendor_config)); return 0; } for (i = 0; i < config_len;) { switch (le16_to_cpu(entry->offset)) { case 0x3c: { int j = 0; for (j = 0; j < entry->entry_len; j++) entry->entry_data[j] = bt_addr[entry->entry_len - 1 - j]; } break; case 0xc: #ifdef BAUDRATE_4BYTES baudrate = *(uint32_t *)entry->entry_data; #else baudrate = *(uint16_t *)entry->entry_data; #endif gHwFlowControlEnable = 0; if (entry->entry_len >= 12) { //0ffset 0x18 - 0xc gHwFlowControlEnable = (entry->entry_data[12] & 0x4) ? 1:0; //0x18 byte bit2 } RS_DBG("config baud rate to :%x, hwflowcontrol:%x, %x", (int)baudrate, entry->entry_data[12], gHwFlowControlEnable); break; default: RS_DBG("config offset(%x),length(%x)", entry->offset, entry->entry_len); break; } temp = entry->entry_len + sizeof(struct rtk_bt_vendor_config_entry); i += temp; entry = (struct rtk_bt_vendor_config_entry *)((uint8_t *)entry + temp); } return baudrate; } /** * get random realtek Bluetooth addr. * * @param bt_addr where bt addr is stored * */ static void rtk_get_ram_addr(char bt_addr[0]) { srand(time(NULL)+getpid()+getpid()*987654+rand()); uint32_t addr = rand(); memcpy(bt_addr, &addr, sizeof(uint8_t)); } /** * Write the random bt addr to the file /data/misc/bluetooth/btmac.txt. * * @param bt_addr where bt addr is stored * */ static void rtk_write_btmac2file(char bt_addr[6]) { int fd; mkdir(BT_ADDR_DIR, 0777); fd = open(BT_ADDR_FILE, O_CREAT|O_RDWR|O_TRUNC, 0666); if (fd > 0) { chmod(BT_ADDR_FILE, 0666); char addr[18] = {0}; addr[17] = '\0'; sprintf(addr, "%2x:%2x:%2x:%2x:%2x:%2x", bt_addr[0], bt_addr[1], bt_addr[2], bt_addr[3], bt_addr[4], bt_addr[5]); write(fd, addr, strlen(addr)); close(fd); } else { RS_ERR("open file error:%s\n", BT_ADDR_FILE); } } /** * Get realtek Bluetooth config file. The bt addr arg is stored in /data/btmac.txt, if there is not this file, * change to /data/misc/bluetooth/btmac.txt. If both of them are not found, using * random bt addr. * * The config file is rtk8723_bt_config whose bt addr will be changed by the one read previous * * @param config_buf point to the content of realtek Bluetooth config file * @param config_baud_rate the baudrate set in the config file * @return file_len the length of config file */ static int rtk_get_bt_config(uint8_t **config_buf, uint32_t *config_baud_rate, patch_info *info) { char bt_config_file_name[PATH_MAX] = {0}; char bt_addr[6] = {0x00, 0xe0, 0x4c, 0x88, 0x88, 0x88}; struct stat st; size_t filelen; int fd; FILE *file = NULL; int i = 0; sprintf(bt_config_file_name, "%s/%s", BT_CONFIG_DIRECTORY, "btmac.txt"); RS_DBG("BT mac addr file: %s", bt_config_file_name); if (stat(bt_config_file_name, &st) < 0) { RS_ERR("can't access bt bt_mac_addr file:%s, try use another path", bt_config_file_name); sprintf(bt_config_file_name, BT_ADDR_FILE); if (stat(bt_config_file_name, &st) < 0) { RS_ERR("can't access bt bt_mac_addr file:%s, try use ramdom BT Addr", bt_config_file_name); for (i = 0; i < 6; i++) rtk_get_ram_addr(&bt_addr[i]); rtk_write_btmac2file(bt_addr); goto GET_CONFIG; } } filelen = st.st_size; file = fopen(bt_config_file_name, "rb"); if (file == NULL) { RS_ERR("Can't open bt btaddr file, just use preset BT Addr"); } else { fscanf(file, "%2x:%2x:%2x:%2x:%2x:%2x", (int *)&bt_addr[0], (uint32_t *)&bt_addr[1], (uint32_t *)&bt_addr[2], (uint32_t *)&bt_addr[3], (uint32_t *)&bt_addr[4], (uint32_t *)&bt_addr[5]); /* do not set bt_add[0] to zero */ /* reserve LAP addr from 0x9e8b00 to 0x9e8b3f, change to 0x008b */ if (0x9e == bt_addr[3] && 0x8b == bt_addr[4] && (bt_addr[5] <= 0x3f)) { /* get random value */ bt_addr[3] = 0x00; } RS_DBG("BT MAC IS : %02X:%02X:%02X:%02X:%02X:%02X", bt_addr[0], bt_addr[1], bt_addr[2], bt_addr[3], bt_addr[4], bt_addr[5]); } GET_CONFIG: if (info != NULL) { sprintf(bt_config_file_name, "%s/%s", BT_CONFIG_DIRECTORY, info->config_name); } else { sprintf(bt_config_file_name, "%s/%s", BT_CONFIG_DIRECTORY, "rtlbt_config"); } RS_DBG("Final bt config file: %s", bt_config_file_name); if (stat(bt_config_file_name, &st) < 0) { RS_ERR("Can't access firmware, errno:%d", errno); return -1; } filelen = st.st_size; fd = open(bt_config_file_name, O_RDONLY); if (fd < 0) { perror("Can't open bt config file"); return -1; } *config_buf = malloc(filelen); if (*config_buf == NULL) { RS_DBG("malloc buffer for config file fail(%x)\n", filelen); close(fd); return -1; } /* we may need to parse this config file. */ /* for easy debug, only get need data. */ if (read(fd, *config_buf, filelen) < (ssize_t)filelen) { perror("Can't load bt config file"); free(*config_buf); *config_buf = NULL; close(fd); return -1; } *config_baud_rate = rtk_parse_config_file(*config_buf, filelen, bt_addr); RS_DBG("Get config baud rate(4 bytes) from config file:%x", (int)*config_baud_rate); close(fd); return filelen; } /** * Realtek change speed with h5 proto. Using vendor specified command packet to achieve this. * * @warning it will waiting 2s for reply. * * @param fd uart file descriptor * @param baudrate the speed want to change * */ static int rtk_vendor_change_speed_h5(int fd, uint32_t baudrate) { struct sk_buff *cmd_change_bdrate = NULL; uint8_t cmd[7] = {0}; int retlen; char bytes[READ_DATA_SIZE]; struct sigaction sa; sa.sa_handler = h5_tinit_sig_alarm; sigaction(SIGALRM, &sa, NULL); cmd[0] = 0x17; /* ocf */ cmd[1] = 0xfc; /* ogf, vendor specified */ cmd[2] = 4; /* length */ #ifdef BAUDRATE_4BYTES memcpy((uint16_t *)&cmd[3], &baudrate, 4); #else memcpy((uint16_t *)&cmd[3], &baudrate, 2); cmd[5] = 0; cmd[6] = 0; #endif if (DBG_ON) { RS_DUMP(cmd, 7); RS_DBG("change speed command ready baudrate=%d n", baudrate); } cmd_change_bdrate = h5_prepare_pkt(&rtk_h5, cmd, 7, HCI_COMMAND_PKT); if (!cmd_change_bdrate) { RS_ERR("Prepare command packet for change speed fail"); return -1; } rtk_h5.host_last_cmd = cmd_change_bdrate; alarm(1); write(fd, cmd_change_bdrate->data, cmd_change_bdrate->data_len); while (rtk_h5.link_estab_state == H5_INIT) { retlen = read_check(fd, &bytes, READ_DATA_SIZE); if (retlen == -1) { perror("read fail"); return -1; } /* add pure ack check */ h5_recv(&rtk_h5, &bytes, retlen); } alarm(0); return 0; } /** * Init realtek Bluetooth h5 proto. h5 proto is added by realtek in the right kernel. * Generally there are two steps: h5 sync and h5 config * * @param fd uart file descriptor * @param ti termios struct * */ static int rtk_init_h5(int fd, struct termios *ti) { char bytes[READ_DATA_SIZE]; struct sigaction sa; int retlen; struct itimerval value; /* set even parity here */ ti->c_cflag |= PARENB; ti->c_cflag &= ~(PARODD); if (tcsetattr(fd, TCSANOW, ti) < 0) { RS_ERR("Can't set port settings"); return -1; } alarm(0); serial_fd = fd; memset(&sa, 0, sizeof(sa)); sa.sa_flags = SA_NOCLDSTOP; sa.sa_handler = h5_tshy_sig_alarm; sigaction(SIGALRM, &sa, NULL); /* h5 sync */ h5_tshy_sig_alarm(0); memset(&rtk_h5, 0, sizeof(rtk_h5)); rtk_h5.link_estab_state = H5_SYNC; while (rtk_h5.link_estab_state == H5_SYNC) { retlen = read_check(fd, &bytes, READ_DATA_SIZE); if (retlen == -1) { RS_ERR("H5 Read Sync Response Failed"); /* retry per 250ms */ value.it_value.tv_sec = 0; value.it_value.tv_usec = 0; value.it_interval.tv_sec = 0; value.it_interval.tv_usec = 0; setitimer(ITIMER_REAL, &value, NULL); return -1; } h5_recv(&rtk_h5, &bytes, retlen); } /* retry per 250ms */ value.it_value.tv_sec = 0; value.it_value.tv_usec = 0; value.it_interval.tv_sec = 0; value.it_interval.tv_usec = 0; setitimer(ITIMER_REAL, &value, NULL); /* h5 config */ sa.sa_handler = h5_tconf_sig_alarm; sigaction(SIGALRM, &sa, NULL); h5_tconf_sig_alarm(0); while (rtk_h5.link_estab_state == H5_CONFIG) { retlen = read_check(fd, &bytes, READ_DATA_SIZE); if (retlen == -1) { RS_ERR("H5 Read Config Response Failed"); /* retry per 250ms */ value.it_value.tv_sec = 0; value.it_value.tv_usec = 0; value.it_interval.tv_sec = 0; value.it_interval.tv_usec = 0; setitimer(ITIMER_REAL, &value, NULL); return -1; } h5_recv(&rtk_h5, &bytes, retlen); } /* retry per 250ms */ value.it_value.tv_sec = 0; value.it_value.tv_usec = 0; value.it_interval.tv_sec = 0; value.it_interval.tv_usec = 0; setitimer(ITIMER_REAL, &value, NULL); rtk_send_pure_ack_down(fd); RS_DBG("H5 init finished\n"); return 0; } /** * Download realtek firmware and config file from uart with the proto. * Parse the content to serval packets follow the proto and then write the packets from uart * * @param fd uart file descriptor * @param buf addr where stor the content of firmware and config file * @param filesize length of buf * @param is_sent_changerate if baudrate need to be changed * @param proto realtek Bluetooth protocol, shall be either HCI_UART_H4 or HCI_UART_3WIRE * */ static void rtk_download_fw_config(int fd, uint8_t *buf, size_t filesize, int is_sent_changerate, int proto, struct termios *ti) { uint8_t iCurIndex = 0; uint8_t iCurLen = 0; uint8_t iEndIndex = 0; uint8_t iLastPacketLen = 0; uint8_t iAdditionPkt = 0; uint8_t iTotalIndex = 0; uint8_t iCmdSentNum = 0; /* the number of CMDs which have been sent */ uint8_t *bufpatch; iEndIndex = (uint8_t)((filesize-1)/PATCH_DATA_FIELD_MAX_SIZE); iLastPacketLen = (filesize)%PATCH_DATA_FIELD_MAX_SIZE; if (is_sent_changerate) iCmdSentNum++; if (gRom_version_cmd_state >= cmd_has_sent) iCmdSentNum++; if (ghci_version_cmd_state >= cmd_has_sent) iCmdSentNum++; if (gchip_type_cmd_state >= cmd_has_sent) iCmdSentNum++; iAdditionPkt = (iEndIndex+1+iCmdSentNum)%8?(8-(iEndIndex+1+iCmdSentNum)%8):0; iTotalIndex = iAdditionPkt + iEndIndex; rtk_patch.nTotal = iTotalIndex; /* init TotalIndex */ RS_DBG("iEndIndex:%d iLastPacketLen:%d iAdditionpkt:%d\n", iEndIndex, iLastPacketLen, iAdditionPkt); if (iLastPacketLen == 0) iLastPacketLen = PATCH_DATA_FIELD_MAX_SIZE; bufpatch = buf; int i; for (i = 0; i <= iTotalIndex; i++) { if (iCurIndex < iEndIndex) { iCurIndex = iCurIndex&0x7F; iCurLen = PATCH_DATA_FIELD_MAX_SIZE; } else if (iCurIndex == iEndIndex) { /* send last data packet */ if (iCurIndex == iTotalIndex) iCurIndex = iCurIndex | 0x80; else iCurIndex = iCurIndex&0x7F; iCurLen = iLastPacketLen; } else if (iCurIndex < iTotalIndex) { iCurIndex = iCurIndex&0x7F; bufpatch = NULL; iCurLen = 0; } else { /* send end packet */ bufpatch = NULL; iCurLen = 0; iCurIndex = iCurIndex|0x80; } if (iCurIndex & 0x80) RS_DBG("Send FW last command"); if (proto == HCI_UART_H4) { iCurIndex = hci_download_patch_h4(fd, iCurIndex, bufpatch, iCurLen); if ((iCurIndex != i) && (i != rtk_patch.nTotal)) { /* check index but ignore last pkt */ RS_DBG("index mismatch i:%d iCurIndex:%d, patch fail\n", i, iCurIndex); return; } } else if (proto == HCI_UART_3WIRE) hci_download_patch(fd, iCurIndex, bufpatch, iCurLen, ti); if (iCurIndex < iEndIndex) { bufpatch += PATCH_DATA_FIELD_MAX_SIZE; } iCurIndex++; } /* set last ack packet down */ if (proto == HCI_UART_3WIRE) { rtk_send_pure_ack_down(fd); } } /** * Get realtek Bluetooth firmaware file. The content will be saved in *fw_buf which is malloc here. * The length malloc here will be lager than length of firmware file if there is a config file. * The content of config file will copy to the tail of *fw_buf in rtk_config. * * @param fw_buf point to the addr where stored the content of firmware. * @param addi_len length of config file. * @return length of *fw_buf. * */ static int rtk_get_bt_firmware(uint8_t **fw_buf, size_t addi_len, patch_info *info) { char filename[PATH_MAX] = {0}; struct stat st; int fd = -1; size_t fwsize, buf_size; if (info != NULL) { sprintf(filename, "%s/%s", FIRMWARE_DIRECTORY, info->patch_name); } else { sprintf(filename, "%s/%s", FIRMWARE_DIRECTORY, "rtlbt_fw"); } RS_DBG("Final bt firmware file: %s", filename); if (stat(filename, &st) < 0) { RS_ERR("Can't access firmware, errno:%d", errno); return -1; } fwsize = st.st_size; buf_size = fwsize + addi_len; fd = open(filename, O_RDONLY); if (fd < 0) { RS_ERR("Can't open firmware, errno:%d", errno); return -1; } *fw_buf = malloc(buf_size); if (!(*fw_buf)) { RS_ERR("Can't alloc memory for fw&config, errno:%d", errno); close(fd); return -1; } if (read(fd, *fw_buf, fwsize) < (ssize_t) fwsize) { free(*fw_buf); *fw_buf = NULL; close(fd); return -1; } RS_DBG("Load FW OK"); close(fd); return buf_size; } /* These two function(rtk<-->uart speed transfer) need check Host uart speed at first!!!! IMPORTANT * add more speed if neccessary */ typedef struct _baudrate_ex { uint32_t rtk_speed; int uart_speed; } baudrate_ex; #ifdef BAUDRATE_4BYTES static baudrate_ex baudrates[] = { {0x00006004, 921600}, {0x05F75004, 921600}, // RTL8723BS {0x00004003, 1500000}, {0x04928002, 1500000}, // RTL8723BS {0x00005002, 2000000}, // same as RTL8723AS {0x00008001, 3000000}, {0x00009001, 3000000}, // Lory add new, t169 and t9e use 0x00009001. {0x06DD8001, 3000000}, // RTL8723BS, Baudrate: 2920000 {0x036D8001, 3000000}, // RTL8723BS, Baudrate: 2929999 {0x06B58001, 3000000}, // RTL8723BS, Baudrate: 2940000 {0x02B58001, 3000000}, // RTL8723BS, Baudrate: 2945000 {0x02D58001, 3000000}, // RTL8723BS, Baudrate: 2950000 {0x05558001, 3000000}, // RTL8723BS, Baudrate: 2960000 {0x02AA8001, 3000000}, // RTL8723BS, Baudrate: 2969999 {0x052A8001, 3000000}, // RTL8723BS, Baudrate: 2980000 {0x04928001, 3000000}, // RTL8723BS, Baudrate: 2998000 {0x00007001, 3500000}, {0x052A6001, 3500000}, // RTL8723BS {0x00005001, 4000000}, // same as RTL8723AS {0x05AD9005, 547000}, {0x0252C00A, 230400}, {0x0000701d, 115200}, {0x0252C002, 115200}, // RTL8723BS {0x0252C014, 115200} // RTL8723BS }; #else static baudrate_ex baudrates[] = { {0x7001, 3500000}, {0x6004, 921600}, {0x4003, 1500000}, {0x5001, 4000000}, {0x5002, 2000000}, {0x8001, 3000000}, {0x9001, 3000000}, {0x701d, 115200} }; #endif /** * Change realtek Bluetooth speed to uart speed. It is matching in the struct baudrates: * * @code * baudrate_ex baudrates[] = * { * {0x7001, 3500000}, * {0x6004, 921600}, * {0x4003, 1500000}, * {0x5001, 4000000}, * {0x5002, 2000000}, * {0x8001, 3000000}, * {0x701d, 115200} * }; * @endcode * * If there is no match in baudrates, uart speed will be set as #115200. * * @param rtk_speed realtek Bluetooth speed * @param uart_speed uart speed * */ static void rtk_speed_to_uart_speed(uint32_t rtk_speed, uint32_t *uart_speed) { *uart_speed = 115200; int i; for (i = 0; i < sizeof(baudrates)/sizeof(baudrate_ex); i++) { if (baudrates[i].rtk_speed == le32_to_cpu(rtk_speed)) { *uart_speed = baudrates[i].uart_speed; return; } } return; } /** * Change uart speed to realtek Bluetooth speed. It is matching in the struct baudrates: * * @code * baudrate_ex baudrates[] = * { * {0x7001, 3500000}, * {0x6004, 921600}, * {0x4003, 1500000}, * {0x5001, 4000000}, * {0x5002, 2000000}, * {0x8001, 3000000}, * {0x701d, 115200} * }; * @endcode * * If there is no match in baudrates, realtek Bluetooth speed will be set as #0x701D. * * @param uart_speed uart speed * @param rtk_speed realtek Bluetooth speed * */ static inline void uart_speed_to_rtk_speed(int uart_speed, uint32_t *rtk_speed) { *rtk_speed = 0x701D; int i; for (i = 0; i < sizeof(baudrates) / sizeof(baudrate_ex); i++) { if (baudrates[i].uart_speed == uart_speed) { *rtk_speed = baudrates[i].rtk_speed; return; } } return; } static void rtk_get_eversion_timeout(int sig) { static int retries; RS_DBG("RTK get HCI_VENDOR_READ_RTK_ROM_VERISION_Command\n"); if (retries < h5_max_retries) { RS_DBG("patch timerout, retry:\n"); if (rtk_h5.host_last_cmd) { write(serial_fd, rtk_h5.host_last_cmd->data, rtk_h5.host_last_cmd->data_len); RS_DBG("3-wire download patch re send:%d", retries); } retries++; alarm(3); return; } tcflush(serial_fd, TCIOFLUSH); RS_ERR("rtk get eversion cmd complete event timed out\n"); exit(1); } /** * Send vendor cmd to get eversion: 0xfc6d * If Rom code does not support this cmd, use default. */ static void rtk_get_eversion(int dd) { char bytes[READ_DATA_SIZE]; int retlen; struct sigaction sa; /* send HCI_VENDOR_READ_RTK_ROM_VERISION Command */ uint8_t read_rom_patch_cmd[3] = {0x6d, 0xfc, 0x00}; struct sk_buff *nskb = h5_prepare_pkt(&rtk_h5, read_rom_patch_cmd, 3, HCI_COMMAND_PKT); /* data: len+head: 4 */ if (rtk_h5.host_last_cmd) { skb_free(rtk_h5.host_last_cmd); rtk_h5.host_last_cmd = NULL; } rtk_h5.host_last_cmd = nskb; write(dd, nskb->data, nskb->data_len); gRom_version_cmd_state = cmd_has_sent; RS_DBG("RTK send HCI_VENDOR_READ_RTK_ROM_VERISION_Command\n"); alarm(0); memset(&sa, 0, sizeof(sa)); sa.sa_flags = SA_NOCLDSTOP; sa.sa_handler = rtk_get_eversion_timeout; sigaction(SIGALRM, &sa, NULL); alarm(3); while (gRom_version_cmd_state != event_received) { retlen = read_check(dd, &bytes, READ_DATA_SIZE); if (retlen == -1) { perror("read fail"); return; } h5_recv(&rtk_h5, &bytes, retlen); } alarm(0); return; } static void rtk_get_lmp_version_timeout(int sig) { static int retries; RS_DBG("RTK get HCI_VENDOR_READ_RTK_LMP_VERISION_Command\n"); if (retries < h5_max_retries) { RS_DBG("patch timerout, retry:\n"); if (rtk_h5.host_last_cmd) { write(serial_fd, rtk_h5.host_last_cmd->data, rtk_h5.host_last_cmd->data_len); RS_DBG("3-wire download patch re send:%d", retries); } retries++; alarm(3); return; } tcflush(serial_fd, TCIOFLUSH); RS_ERR("rtk get lmp version cmd complete event timed out\n"); exit(1); } static void rtk_get_lmp_version(int dd) { char bytes[READ_DATA_SIZE]; int retlen; struct sigaction sa; /* send HCI_VENDOR_READ_RTK_ROM_VERISION_Command */ uint8_t read_rom_patch_cmd[3] = {0x01, 0x10, 00}; struct sk_buff *nskb = h5_prepare_pkt(&rtk_h5, read_rom_patch_cmd, 3, HCI_COMMAND_PKT); /* data: len+head: 4 */ if (rtk_h5.host_last_cmd) { skb_free(rtk_h5.host_last_cmd); rtk_h5.host_last_cmd = NULL; } rtk_h5.host_last_cmd = nskb; write(dd, nskb->data, nskb->data_len); ghci_version_cmd_state = cmd_has_sent; RS_DBG("RTK send HCI_VENDOR_READ_RTK_ROM_VERISION_Command\n"); alarm(0); memset(&sa, 0, sizeof(sa)); sa.sa_flags = SA_NOCLDSTOP; sa.sa_handler = rtk_get_lmp_version_timeout; sigaction(SIGALRM, &sa, NULL); alarm(3); while (ghci_version_cmd_state != event_received) { retlen = read_check(dd, &bytes, READ_DATA_SIZE); if (retlen == -1) { perror("read fail"); return; } h5_recv(&rtk_h5, &bytes, retlen); } alarm(0); return; } static void rtk_get_chip_type(int dd) { char bytes[READ_DATA_SIZE]; int retlen; struct sigaction sa; uint8_t read_rom_patch_cmd[8] = {0x61, 0xfc, 0x05, 0x00, 0x94, 0xa0, 0x00, 0xb0}; struct sk_buff *nskb = h5_prepare_pkt(&rtk_h5, read_rom_patch_cmd, 8, HCI_COMMAND_PKT); /* data: len+head: 4 */ if (rtk_h5.host_last_cmd) { skb_free(rtk_h5.host_last_cmd); rtk_h5.host_last_cmd = NULL; } rtk_h5.host_last_cmd = nskb; write(dd, nskb->data, nskb->data_len); gchip_type_cmd_state = cmd_has_sent; RS_DBG("RTK send HCI_VENDOR_READ_CHIP_TYPE Command"); alarm(0); memset(&sa, 0, sizeof(sa)); sa.sa_flags = SA_NOCLDSTOP; sa.sa_handler = rtk_get_lmp_version_timeout; sigaction(SIGALRM, &sa, NULL); alarm(3); while (gchip_type_cmd_state != event_received) { retlen = read_check(dd, &bytes, READ_DATA_SIZE); if (retlen == -1) { perror("read fail"); return; } h5_recv(&rtk_h5, &bytes, retlen); } alarm(0); return; } static int check_match_state(bt_hw_cfg_cb_t *cfg, uint32_t mask) { patch_info *patch_entry; int res = 0; for (patch_entry = patch_table; patch_entry->lmp_subversion != LMP_SUBVERSION_NONE; patch_entry++) { if (patch_entry->lmp_subversion != cfg->lmp_subversion) continue; if ((patch_entry->hci_version_mask != HCI_VERSION_MASK_ALL) && ((patch_entry->hci_version_mask & (1 << cfg->hci_version)) == 0)) continue; if ((patch_entry->hci_revision_mask != HCI_REVISION_MASK_ALL) && ((patch_entry->hci_revision_mask & (1 << cfg->hci_revision)) == 0)) continue; if ((mask & PATCH_OPTIONAL_MATCH_FLAG_CHIPTYPE) && (patch_entry->chip_type_mask != CHIP_TYPE_MASK_ALL) && ((patch_entry->chip_type_mask & (1 << cfg->chip_type)) == 0)) continue; res++; } RS_DBG("check_match_state return %d(cfg->lmp_subversion:0x%x cfg->hci_vesion:0x%x cfg->hci_revision:0x%x cfg->chip_type:0x%x mask:%08x)", res, cfg->lmp_subversion, cfg->hci_version, cfg->hci_revision, cfg->chip_type, mask); return res; } static patch_info *get_patch_entry(bt_hw_cfg_cb_t *cfg) { patch_info *patch_entry; RS_DBG("get_patch_entry(lmp_subversion:0x%x hci_vesion:0x%x cfg->hci_revision:0x%x chip_type:0x%x)", cfg->lmp_subversion, cfg->hci_version, cfg->hci_revision, cfg->chip_type); for (patch_entry = patch_table; patch_entry->lmp_subversion != LMP_SUBVERSION_NONE; patch_entry++) { if (patch_entry->lmp_subversion != cfg->lmp_subversion) continue; if ((patch_entry->hci_version_mask != HCI_VERSION_MASK_ALL) && ((patch_entry->hci_version_mask & (1 << cfg->hci_version)) == 0)) continue; if ((patch_entry->hci_revision_mask != HCI_REVISION_MASK_ALL) && ((patch_entry->hci_revision_mask & (1<hci_revision)) == 0)) continue; if ((patch_entry->chip_type_mask != CHIP_TYPE_MASK_ALL) && ((patch_entry->chip_type_mask & (1<chip_type)) == 0)) continue; break; } RS_DBG("get_patch_entry return(patch_name:%s config_name:%s mac_offset:0x%x)", patch_entry->patch_name, patch_entry->config_name, patch_entry->mac_offset); return patch_entry; } /** * Config realtek Bluetooth. The configuration parameter is get from config file and fw. * * @warning maybe only one of config file and fw file exists. The bt_addr arg is stored in "/data/btmac.txt" * or "/data/misc/bluetoothd/bt_mac/btmac.txt", * * @param fd uart file descriptor * @param proto realtek Bluetooth protocol, shall be either HCI_UART_H4 or HCI_UART_3WIRE * @param speed init_speed in uart struct * @param ti termios struct * @returns #0 on success */ static int rtk_config(int fd, int proto, int speed, struct termios *ti) { int config_len = -1, buf_len = -1, final_speed = 0; uint8_t *config_file_buf = NULL; uint8_t *buf = NULL; uint32_t baudrate = 0; uint8_t *epatch_buf = NULL; struct rtk_epatch *epatch_info = NULL; struct rtk_epatch_entry current_entry; uint8_t need_download_fw = 1; patch_info *prtk_patch_file_info = NULL; current_entry.start_offset = 0; current_entry.patch_length = 0; current_entry.chipID = 0; /* * 1. if both config file and fw exists, use it and change rate according to config file * 2. if config file not exists while fw does, not change baudrate and only download fw * 3. if fw doesnot exist, only change rate to 3.25M or from config file if it exist. This case is only for early debug before any efuse is setting. */ /* Get version from ROM */ rtk_get_lmp_version(fd); if (check_match_state(&hw_cfg_cb, 0) > 1) { rtk_get_chip_type(fd); RS_DBG("lmp_subversion = 0x%x, hci_version = 0x%x, hci_revision = 0x%x, chip_type = 0x%x", hw_cfg_cb.lmp_subversion, hw_cfg_cb.hci_version, hw_cfg_cb.hci_revision, hw_cfg_cb.chip_type); } prtk_patch_file_info = get_patch_entry(&hw_cfg_cb); if (prtk_patch_file_info == NULL) { RS_ERR("lmp_version is %x, no matched project found!", hw_cfg_cb.lmp_subversion); need_download_fw = 0; goto FETCH_DONE; } config_len = rtk_get_bt_config(&config_file_buf, &baudrate, prtk_patch_file_info); if (config_len < 0) { RS_ERR("Get Config file error, just use efuse settings"); config_len = 0; } buf_len = rtk_get_bt_firmware(&epatch_buf, config_len, prtk_patch_file_info); if (buf_len < 0) { RS_ERR("Get BT firmware error, continue without bt firmware"); goto FETCH_DONE; } if (hw_cfg_cb.lmp_subversion == ROM_LMP_8723a) { if (memcmp(epatch_buf, RTK_EPATCH_SIGNATURE, 8) == 0) { RS_ERR("8723as Check signature error!"); need_download_fw = 0; goto FETCH_DONE; } buf = malloc(buf_len); if (!buf) { RS_ERR("Can't alloc memory for fw&config, errno:%d", errno); buf_len = -1; goto FETCH_DONE; } RS_DBG("8723as, fw copy direct"); memcpy(buf, epatch_buf, buf_len); } else { /* Get version from ROM */ rtk_get_eversion(fd); /* gEVersion is set. */ RS_DBG("gEVersion=%d", gEVersion); /* check Extension Section Field */ if (memcmp(epatch_buf + buf_len - config_len - 4, Extension_Section_SIGNATURE, 4) != 0) { RS_ERR("Check Extension_Section_SIGNATURE error! do not download fw"); need_download_fw = 0; goto FETCH_DONE; } if (memcmp(epatch_buf, RTK_EPATCH_SIGNATURE, 8) != 0) { RS_DBG("Check signature error!"); need_download_fw = 0; goto FETCH_DONE; } int i = 0; uint32_t value_t = 0; epatch_info = (struct rtk_epatch *)epatch_buf; value_t = le32_to_cpu(epatch_info->fm_version); epatch_info->fm_version = (uint32_t)value_t; value_t = le16_to_cpu(epatch_info->number_of_total_patch); epatch_info->number_of_total_patch = (uint16_t)value_t; RS_DBG("fm_version = 0x%x", epatch_info->fm_version); RS_DBG("number_of_total_patch = %d", epatch_info->number_of_total_patch); /* get right epatch entry */ for (i = 0; i < epatch_info->number_of_total_patch; i++) { if (le16_to_cpu(*(uint16_t *)(epatch_buf + 14 + 2 * i)) == gEVersion + 1) { current_entry.chipID = gEVersion + 1; current_entry.patch_length = le16_to_cpu(*(uint16_t *)(epatch_buf + 14 + 2 * epatch_info->number_of_total_patch + 2 * i)); current_entry.start_offset = le32_to_cpu(*(uint32_t *)(epatch_buf + 14 + 4 * epatch_info->number_of_total_patch + 4 * i)); break; } } RS_DBG("chipID = %d", current_entry.chipID); RS_DBG("patch_length = 0x%x", current_entry.patch_length); RS_DBG("start_offset = 0x%x", current_entry.start_offset); /* get right version patch: buf, buf_len */ buf_len = current_entry.patch_length + config_len; RS_DBG("buf_len = 0x%x", buf_len); buf = malloc(buf_len); if (!buf) { RS_ERR("Can't alloc memory for multi fw&config, errno:%d", errno); buf_len = -1; goto FETCH_DONE; } memcpy(buf, &epatch_buf[current_entry.start_offset], current_entry.patch_length); value_t = cpu_to_le32(epatch_info->fm_version); epatch_info->fm_version = (uint32_t)value_t; memcpy(&buf[current_entry.patch_length-4], &epatch_info->fm_version, 4); value_t = cpu_to_le32(epatch_info->fm_version); epatch_info->fm_version = value_t; } if (config_len) { memcpy(&buf[buf_len - config_len], config_file_buf, config_len); } FETCH_DONE: free(epatch_buf); epatch_buf = NULL; if (config_file_buf) free(config_file_buf); RS_DBG("Fw:%s exists, config file:%s exists", (buf_len > 0) ? "" : "not", (config_len > 0) ? "" : "not"); if ((buf_len > 0) && (config_len == 0)) { rtk_h5.link_estab_state = H5_PATCH; goto DOWNLOAD_FW; } /* change baudrate if needed */ if (baudrate == 0) { uart_speed_to_rtk_speed(speed, &baudrate); RS_DBG("Since no config file to set uart baudrate, so use user input parameters:%x, %x", (int)speed, (uint32_t)baudrate); } else rtk_speed_to_uart_speed(baudrate, (uint32_t *)&gFinalSpeed); if (proto == HCI_UART_3WIRE) rtk_vendor_change_speed_h5(fd, baudrate); else rtk_vendor_change_speed_h4(fd, baudrate); usleep(50000); final_speed = gFinalSpeed ? gFinalSpeed : speed; RS_DBG("final_speed %d\n", final_speed); if (set_speed(fd, ti, final_speed) < 0) { RS_ERR("Can't set baud rate:%x, %x, %x", final_speed, gFinalSpeed, speed); return -1; } if (gHwFlowControlEnable) { RS_DBG("Hw Flow Control enable"); ti->c_cflag |= CRTSCTS; } else { RS_DBG("Hw Flow Control disable"); ti->c_cflag &= ~CRTSCTS; } RS_DBG("Hw Flow Control do not enable before download fw! "); /* wait for while for controller to setup */ usleep(10000); DOWNLOAD_FW: if (buf && (buf_len > 0) && (need_download_fw)) { /* baudrate 0 means no change baudrate send */ memset(&rtk_patch, 0, sizeof(rtk_patch)); rtk_patch.nRxIndex = -1; rtk_download_fw_config(fd, buf, buf_len, baudrate, proto, ti); free(buf); } RS_DBG("Init Process finished"); return 0; } /** * Init uart by realtek Bluetooth. * * @param fd uart file descriptor * @param proto realtek Bluetooth protocol, shall be either HCI_UART_H4 or HCI_UART_3WIRE * @param speed init_speed in uart struct * @param ti termios struct * @returns #0 on success, depend on rtk_config */ int rtk_init(int fd, int proto, int speed, struct termios *ti) { RS_DBG("Realtek hciattach version %s \n", RTK_VERSION); if (proto == HCI_UART_3WIRE) { /*h4 will do nothing for init */ rtk_init_h5(fd, ti); } return rtk_config(fd, proto, speed, ti); } /** * Post uart by realtek Bluetooth. If gFinalSpeed is set, set uart speed with it. * * @param fd uart file descriptor * @param proto realtek Bluetooth protocol, shall be either HCI_UART_H4 or HCI_UART_3WIRE * @param ti termios struct * @returns #0 on success. */ int rtk_post(int fd, int proto, struct termios *ti) { if (gFinalSpeed) { return set_speed(fd, ti, gFinalSpeed); } return 0; }