Bluetooth: btrtl: Avoid loading the config file on security chips

For chips with security enabled, it's only possible to load firmware
with a valid signature pattern.
If key_id is not zero, it indicates a security chip, and the driver will
not load the config file.

- Example log for a security chip.

Bluetooth: hci0: RTL: examining hci_ver=0c hci_rev=000a
  lmp_ver=0c lmp_subver=8922
Bluetooth: hci0: RTL: rom_version status=0 version=1
Bluetooth: hci0: RTL: btrtl_initialize: key id 1
Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_fw.bin
Bluetooth: hci0: RTL: cfg_sz 0, total sz 71301
Bluetooth: hci0: RTL: fw version 0x41c0c905

- Example log for a normal chip.

Bluetooth: hci0: RTL: examining hci_ver=0c hci_rev=000a
  lmp_ver=0c lmp_subver=8922
Bluetooth: hci0: RTL: rom_version status=0 version=1
Bluetooth: hci0: RTL: btrtl_initialize: key id 0
Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_fw.bin
Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_config.bin
Bluetooth: hci0: RTL: cfg_sz 6, total sz 71307
Bluetooth: hci0: RTL: fw version 0x41c0c905

Tested-by: Hilda Wu <hildawu@realtek.com>
Signed-off-by: Nial Ni <niall_ni@realsil.com.cn>
Signed-off-by: Max Chou <max.chou@realtek.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c
index 1d4a7887abccfb306dc4a3ac469bfca1e6d2d7b8..52794db2739bfc2956abc2150b7e838e621c7fca 100644 (file)
--- a/drivers/bluetooth/btrtl.c
+++ b/drivers/bluetooth/btrtl.c
@@ -50,7 +50,7 @@
 
 #define        RTL_CHIP_SUBVER (&(struct rtl_vendor_cmd) {{0x10, 0x38, 0x04, 0x28, 0x80}})
 #define        RTL_CHIP_REV    (&(struct rtl_vendor_cmd) {{0x10, 0x3A, 0x04, 0x28, 0x80}})
-#define        RTL_SEC_PROJ    (&(struct rtl_vendor_cmd) {{0x10, 0xA4, 0x0D, 0x00, 0xb0}})
+#define        RTL_SEC_PROJ    (&(struct rtl_vendor_cmd) {{0x10, 0xA4, 0xAD, 0x00, 0xb0}})
 
 #define RTL_PATCH_SNIPPETS             0x01
 #define RTL_PATCH_DUMMY_HEADER         0x02
@@ -534,7 +534,6 @@ static int rtlbt_parse_firmware_v2(struct hci_dev *hdev,
 {
        struct rtl_epatch_header_v2 *hdr;
        int rc;
-       u8 reg_val[2];
        u8 key_id;
        u32 num_sections;
        struct rtl_section *section;
@@ -549,14 +548,7 @@ static int rtlbt_parse_firmware_v2(struct hci_dev *hdev,
                .len  = btrtl_dev->fw_len - 7, /* Cut the tail */
        };
 
-       rc = btrtl_vendor_read_reg16(hdev, RTL_SEC_PROJ, reg_val);
-       if (rc < 0)
-               return -EIO;
-       key_id = reg_val[0];
-
-       rtl_dev_dbg(hdev, "%s: key id %u", __func__, key_id);
-
-       btrtl_dev->key_id = key_id;
+       key_id = btrtl_dev->key_id;
 
        hdr = rtl_iov_pull_data(&iov, sizeof(*hdr));
        if (!hdr)
@@ -1070,6 +1062,8 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev,
        u16 hci_rev, lmp_subver;
        u8 hci_ver, lmp_ver, chip_type = 0;
        int ret;
+       int rc;
+       u8 key_id;
        u8 reg_val[2];
 
        btrtl_dev = kzalloc(sizeof(*btrtl_dev), GFP_KERNEL);
@@ -1180,6 +1174,14 @@ next:
                goto err_free;
        }
 
+       rc = btrtl_vendor_read_reg16(hdev, RTL_SEC_PROJ, reg_val);
+       if (rc < 0)
+               goto err_free;
+
+       key_id = reg_val[0];
+       btrtl_dev->key_id = key_id;
+       rtl_dev_info(hdev, "%s: key id %u", __func__, key_id);
+
        btrtl_dev->fw_len = -EIO;
        if (lmp_subver == RTL_ROM_LMP_8852A && hci_rev == 0x000c) {
                snprintf(fw_name, sizeof(fw_name), "%s_v2.bin",
@@ -1202,7 +1204,7 @@ next:
                goto err_free;
        }
 
-       if (btrtl_dev->ic_info->cfg_name) {
+       if (btrtl_dev->ic_info->cfg_name && !btrtl_dev->key_id) {
                if (postfix) {
                        snprintf(cfg_name, sizeof(cfg_name), "%s-%s.bin",
                                 btrtl_dev->ic_info->cfg_name, postfix);