From nobody Sat Jul 25 16:45:30 2026 Received: from mailgw01.mediatek.com (unknown [60.244.123.138]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3BBB0342C80; Thu, 16 Jul 2026 01:59:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=60.244.123.138 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784167178; cv=none; b=nWggh6AxdwkON1V6bmbZD/vYPOOOnfbUwBILaiZ6Ft4YYKxXLcx2BWqW0QB0kcb6wIttOrmkp9b+gMNXJ9OOCdnIijAGa1UtKNeJV+rAB4yvxAYxjdKFi8jCtd8c2AstwhwhXwsOxYf7SwXahR0Ca4MFG/T8r2mGG0d0L74gvDU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784167178; c=relaxed/simple; bh=8mEEu0fofAd3LjQpobHKIIP/WCU/gXmoGNsGVUQipTA=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=bpAJIyEl35BYmCAdl/lJcImnJWRZliivFdc/6bBmuT51qHSf9Hj9ImzGu2a46msghaZeilKwNIfu1O3Xlh/jeJvSD3lkxbfuW99NMCeNL1UaIDXX5WSg3JcWIn5qo3nz4Mf9QX2EFMKX2lZPphmloW5GG9BxcIhAs1XdAGvQ0K8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=mediatek.com; spf=pass smtp.mailfrom=mediatek.com; dkim=pass (1024-bit key) header.d=mediatek.com header.i=@mediatek.com header.b=Xf/9GvgJ; arc=none smtp.client-ip=60.244.123.138 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=mediatek.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=mediatek.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=mediatek.com header.i=@mediatek.com header.b="Xf/9GvgJ" X-UUID: f6806d2a80b911f1b1788b6acf885367-20260716 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=mediatek.com; s=dk; h=Content-Type:Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID:Date:Subject:CC:To:From; bh=AorHqhtqwV15STsrkbRcHwPgCy7RSx0CoHKVd3m/ihM=; b=Xf/9GvgJbgajWOwws1Qg9NZzNHVBzlB/GkQmAn14AWewzS4yK2fTO7408d0aO9dMNaJfIlm0Suyc5q7mMtR2B0Fezo8v4dnPD4xrVzSl5SH7Jm0aJv4DR0TbjaMsgefG+08RyFAv4y8+G3h+AHwXpDjsY5EbhB3hqXknEPfdUWc=; X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.17,REQID:88e70b68-e863-4cf0-bc3e-0fa672a3953a,IP:0,U RL:0,TC:0,Content:0,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION: release,TS:0 X-CID-META: VersionHash:d497b38,CLOUDID:2e302d19-ab14-4403-9336-76696324c5a8,B ulkID:nil,BulkQuantity:0,SF:81|82|102|836|865|888|898,TC:-5,Content:0|15|5 0|99|200|213,EDM:-3,IP:nil,URL:0,File:130,RT:0,Bulk:nil,QS:nil,BEC:-1,COL: 0,OSI:0,OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0,BRR:0,BRE:0,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: f6806d2a80b911f1b1788b6acf885367-20260716 Received: from mtkmbs14n1.mediatek.inc [(172.21.101.75)] by mailgw01.mediatek.com (envelope-from ) (Generic MTA with TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256/256) with ESMTP id 1510600586; Thu, 16 Jul 2026 09:59:21 +0800 Received: from mtkmbs13n1.mediatek.inc (172.21.101.193) by MTKMBS14N2.mediatek.inc (172.21.101.76) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.29; Thu, 16 Jul 2026 09:59:21 +0800 Received: from mtksitap99.mediatek.inc (10.233.130.16) by mtkmbs13n1.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.2.2562.29 via Frontend Transport; Thu, 16 Jul 2026 09:59:21 +0800 From: Chris Lu To: Marcel Holtmann , Johan Hedberg , Luiz Von Dentz CC: Sean Wang , Will Lee , SS Wu , Steve Lee , Paul Menzel , linux-bluetooth , linux-kernel , linux-mediatek , Chris Lu Subject: [PATCH v12 1/7] Bluetooth: btmtksdio: Fix DMA out-of-bounds access in TX path Date: Thu, 16 Jul 2026 09:59:13 +0800 Message-ID: <20260716015920.1886719-2-chris.lu@mediatek.com> X-Mailer: git-send-email 2.45.2 In-Reply-To: <20260716015920.1886719-1-chris.lu@mediatek.com> References: <20260716015920.1886719-1-chris.lu@mediatek.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" btmtksdio_tx_packet() aligns transfer size to 256 bytes using round_up(), but does not ensure the skb buffer has sufficient space, causing DMA to read beyond the buffer. Fix by expanding skb tailroom if needed and zero-filling the padding. Fixes: 9aebfd4a2200 ("Bluetooth: mediatek: add support for MediaTek MT7663S= and MT7668S SDIO devices") Signed-off-by: Chris Lu --- drivers/bluetooth/btmtksdio.c | 33 +++++++++++++++++++++++++++++---- 1 file changed, 29 insertions(+), 4 deletions(-) diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c index 5b0fab7b89b5..feda1ea8f256 100644 --- a/drivers/bluetooth/btmtksdio.c +++ b/drivers/bluetooth/btmtksdio.c @@ -272,6 +272,7 @@ static int btmtksdio_tx_packet(struct btmtksdio_dev *bd= ev, struct sk_buff *skb) { struct mtkbtsdio_hdr *sdio_hdr; + unsigned int padded_len, pad_len; int err; =20 /* Make sure that there are enough rooms for SDIO header */ @@ -290,18 +291,42 @@ static int btmtksdio_tx_packet(struct btmtksdio_dev *= bdev, sdio_hdr->reserved =3D cpu_to_le16(0); sdio_hdr->bt_type =3D hci_skb_pkt_type(skb); =20 + /* Calculate padded length for block-aligned DMA transfer. + * SDIO requires transfers to be block-aligned (MTK_SDIO_BLOCK_SIZE). + * Pad with zeros to prevent DMA from reading beyond skb buffer. + */ + padded_len =3D round_up(skb->len, MTK_SDIO_BLOCK_SIZE); + pad_len =3D padded_len - skb->len; + + if (pad_len > 0) { + /* Ensure sufficient tailroom for padding */ + if (unlikely(skb_tailroom(skb) < pad_len)) { + err =3D pskb_expand_head(skb, 0, pad_len, GFP_ATOMIC); + if (err < 0) + goto err_skb_pull; + /* Reassign sdio_hdr after buffer reallocation */ + sdio_hdr =3D (void *)skb->data; + } + + /* Zero-fill padding to prevent information disclosure */ + skb_put_zero(skb, pad_len); + } + clear_bit(BTMTKSDIO_HW_TX_READY, &bdev->tx_state); - err =3D sdio_writesb(bdev->func, MTK_REG_CTDR, skb->data, - round_up(skb->len, MTK_SDIO_BLOCK_SIZE)); + err =3D sdio_writesb(bdev->func, MTK_REG_CTDR, skb->data, padded_len); if (err < 0) - goto err_skb_pull; + goto err_skb_trim; =20 - bdev->hdev->stat.byte_tx +=3D skb->len; + /* Record actual transmitted data (excluding padding) */ + bdev->hdev->stat.byte_tx +=3D le16_to_cpu(sdio_hdr->len); =20 kfree_skb(skb); =20 return 0; =20 +err_skb_trim: + if (pad_len > 0) + skb_trim(skb, skb->len - pad_len); err_skb_pull: skb_pull(skb, sizeof(*sdio_hdr)); =20 --=20 2.45.2 From nobody Sat Jul 25 16:45:30 2026 Received: from mailgw02.mediatek.com (unknown [210.61.82.184]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9994A29D265; Thu, 16 Jul 2026 01:59:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=210.61.82.184 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784167172; cv=none; b=mCELWaVskUVaix+ZCGGuPJXNzyYRx+y3Pds+hhl6IpIDtGzgJquzBRQcnFCkLLlZSdGGzdobmE16S+uRdCAb35dLRBTztkvid4/CUFLBux4UChVCAghFXTXw6qCE5vjf6AFfyXTv9P7rFKoRrUbJIN1JnQnp6+d33qPF+LnV5Fo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784167172; c=relaxed/simple; bh=YKap3/vGxMXHuEqWG0FqQnF2Bd85ZflBYQrpmSS1kn0=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=m6x5AYape0xdkiFXUQg/B/MzNtmOOFNJ6FKqNUtmWrRL5KDYqHb2WneEOzzr4GohORhGPNgjxQVCfQsk/I2re2I4tL1+prYh75WQ8Mr66cBFQe3dm9jFwgKFwC7KDdMPZgarW+05folO57dcEF/unMEr3NvYQKPhXvzQosEU+MM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=mediatek.com; spf=pass smtp.mailfrom=mediatek.com; dkim=pass (1024-bit key) header.d=mediatek.com header.i=@mediatek.com header.b=UWi9vfdn; arc=none smtp.client-ip=210.61.82.184 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=mediatek.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=mediatek.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=mediatek.com header.i=@mediatek.com header.b="UWi9vfdn" X-UUID: f74036a080b911f18dc8c9802ae25ab1-20260716 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=mediatek.com; s=dk; h=Content-Type:Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID:Date:Subject:CC:To:From; bh=NrLmXw2+grSg8BDLzNZP31Z2rCqGp6CpomTh+kmD5Sk=; b=UWi9vfdnghw3GNv11YVBiruRpo0ECGCcPuflmwZKAopIb/JE7ZKPLm0pwrfk85IEa/+ITq3W12s74B8WKAE1nxHKJ5F1hOpNUYfXVUE+kKGcrG0o+qQmBbNYAT5radErzhooUX9Xb0lw7ussiwPnXtrZBatKoZS6jxfUHQ+t2TI=; X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.17,REQID:21e6f93c-74f0-4169-b5fc-ae45f10fc68b,IP:0,U RL:0,TC:0,Content:-25,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTIO N:release,TS:-25 X-CID-META: VersionHash:d497b38,CLOUDID:5b1d885f-762a-4584-baab-4eebe609beea,B ulkID:nil,BulkQuantity:0,SF:81|82|102|836|865|888|898,TC:-5,Content:0|15|5 0|99|200|213,EDM:-3,IP:nil,URL:0,File:130,RT:0,Bulk:nil,QS:nil,BEC:-1,COL: 0,OSI:0,OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0,BRR:0,BRE:0,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: f74036a080b911f18dc8c9802ae25ab1-20260716 Received: from mtkmbs11n1.mediatek.inc [(172.21.101.185)] by mailgw02.mediatek.com (envelope-from ) (Generic MTA with TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256/256) with ESMTP id 411696915; Thu, 16 Jul 2026 09:59:23 +0800 Received: from mtkmbs13n1.mediatek.inc (172.21.101.193) by MTKMBS14N2.mediatek.inc (172.21.101.76) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.29; Thu, 16 Jul 2026 09:59:21 +0800 Received: from mtksitap99.mediatek.inc (10.233.130.16) by mtkmbs13n1.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.2.2562.29 via Frontend Transport; Thu, 16 Jul 2026 09:59:21 +0800 From: Chris Lu To: Marcel Holtmann , Johan Hedberg , Luiz Von Dentz CC: Sean Wang , Will Lee , SS Wu , Steve Lee , Paul Menzel , linux-bluetooth , linux-kernel , linux-mediatek , Chris Lu Subject: [PATCH v12 2/7] Bluetooth: btmtk: Add firmware size validation in btmtk_setup_firmware_79xx() Date: Thu, 16 Jul 2026 09:59:14 +0800 Message-ID: <20260716015920.1886719-3-chris.lu@mediatek.com> X-Mailer: git-send-email 2.45.2 In-Reply-To: <20260716015920.1886719-1-chris.lu@mediatek.com> References: <20260716015920.1886719-1-chris.lu@mediatek.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Add firmware size validation to prevent out-of-bounds access when loading truncated or malicious firmware files. Add three levels of validation: 1. Minimum size check for header and global descriptor 2. Section map bounds check with integer overflow protection using check_mul_overflow() and check_add_overflow() 3. Section data bounds check before accessing each section This matches the validation approach used in btmtk_load_cbmcu_firmware(). Signed-off-by: Chris Lu Assisted-by: Claude:Sonnet-4.5 --- drivers/bluetooth/btmtk.c | 39 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c index 02a96342e964..3491060b3ae9 100644 --- a/drivers/bluetooth/btmtk.c +++ b/drivers/bluetooth/btmtk.c @@ -145,6 +145,7 @@ int btmtk_setup_firmware_79xx(struct hci_dev *hdev, con= st char *fwname, int err, dlen, i, status; u8 flag, first_block, retry; u32 section_num, dl_size, section_offset; + size_t expected_size; u8 cmd[64]; =20 err =3D request_firmware(&fw, fwname, &hdev->dev); @@ -153,12 +154,40 @@ int btmtk_setup_firmware_79xx(struct hci_dev *hdev, c= onst char *fwname, return err; } =20 + /* Validate minimum firmware size for header and global descriptor */ + if (fw->size < MTK_FW_ROM_PATCH_HEADER_SIZE + MTK_FW_ROM_PATCH_GD_SIZE) { + bt_dev_err(hdev, "Firmware file too small: size=3D%zu, expected at least= %u bytes", + fw->size, MTK_FW_ROM_PATCH_HEADER_SIZE + MTK_FW_ROM_PATCH_GD_SIZE); + err =3D -EINVAL; + goto err_release_fw; + } + fw_ptr =3D fw->data; fw_bin_ptr =3D fw_ptr; hdr =3D (struct btmtk_patch_header *)fw_ptr; globaldesc =3D (struct btmtk_global_desc *)(fw_ptr + MTK_FW_ROM_PATCH_HEA= DER_SIZE); section_num =3D le32_to_cpu(globaldesc->section_num); =20 + /* Check for potential integer overflow in size calculation */ + if (check_mul_overflow((size_t)MTK_FW_ROM_PATCH_SEC_MAP_SIZE, + (size_t)section_num, &expected_size) || + check_add_overflow(expected_size, + (size_t)(MTK_FW_ROM_PATCH_HEADER_SIZE + + MTK_FW_ROM_PATCH_GD_SIZE), + &expected_size)) { + bt_dev_err(hdev, "Firmware size calculation overflow (section_num=3D%u)", + section_num); + err =3D -EINVAL; + goto err_release_fw; + } + + if (fw->size < expected_size) { + bt_dev_err(hdev, "Firmware truncated: size=3D%zu, expected=3D%zu (sectio= n_num=3D%u)", + fw->size, expected_size, section_num); + err =3D -EINVAL; + goto err_release_fw; + } + bt_dev_info(hdev, "HW/SW Version: 0x%04x%04x, Build Time: %s", le16_to_cpu(hdr->hwver), le16_to_cpu(hdr->swver), hdr->datetime); =20 @@ -171,6 +200,16 @@ int btmtk_setup_firmware_79xx(struct hci_dev *hdev, co= nst char *fwname, section_offset =3D le32_to_cpu(sectionmap->secoffset); dl_size =3D le32_to_cpu(sectionmap->bin_info_spec.dlsize); =20 + /* Validate section boundaries to prevent out-of-bounds access */ + if (dl_size > 0 && + (section_offset > fw->size || + dl_size > fw->size - section_offset)) { + bt_dev_err(hdev, "Section %d out of bounds: offset=3D%u, size=3D%u, fw_= size=3D%zu", + i, section_offset, dl_size, fw->size); + err =3D -EINVAL; + goto err_release_fw; + } + /* MT6639: only download sections where dlmode byte0 =3D=3D 0x01, * matching the Windows driver behavior which skips WiFi/other * sections that would cause the chip to hang. --=20 2.45.2 From nobody Sat Jul 25 16:45:30 2026 Received: from mailgw01.mediatek.com (unknown [60.244.123.138]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 51D93331A5B; Thu, 16 Jul 2026 01:59:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=60.244.123.138 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784167175; cv=none; b=kLpOidKqXKd838PRnrfbJ8YoYY1gMdkhawDFjLwjw2QWVQ8inrvwW/cFOM04S/yHeH4g7Ua15bdY9dDhhwfAhue7GfFFPLLkc9yIIUkFQ4OYeUz8DiJ+YQglt/C0w3kmZ2ZMuQhClSBU3NH+D7PzzGPzoyc3phJYblxY79jy21Q= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784167175; c=relaxed/simple; bh=3d2nHyZT9JflRsqQ/GMt1q28kpYluI31HEx2nRczg+I=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=K6Sp/DgLlUXDqpZe1f0U+e9V41q8J+M7baZP+EjtisWevzRbNCC8EjVyHXCGxl/aunv5HhA+s5sL9pL4QAAMyYRphL+kp3T3mAK0rjI1213JqfJimD5YiDDEMVl79TRxd+Q/01+IS2PMS9XgJuZ3+ht7ACBeDzdE56pcDEBMN0g= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=mediatek.com; spf=pass smtp.mailfrom=mediatek.com; dkim=pass (1024-bit key) header.d=mediatek.com header.i=@mediatek.com header.b=nu5PvytG; arc=none smtp.client-ip=60.244.123.138 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=mediatek.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=mediatek.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=mediatek.com header.i=@mediatek.com header.b="nu5PvytG" X-UUID: f738e64880b911f1b1788b6acf885367-20260716 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=mediatek.com; s=dk; h=Content-Type:Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID:Date:Subject:CC:To:From; bh=sxdUfGPBVa6Aw8luxjq4cHzkvDH6P8rvTLiY6Rrhyd8=; b=nu5PvytGzrvuklGve906KK4vddQyjYBH9c9gq8Vme9yjPEsJNsJcK6j1egCv4FxFoQ2bwwtQ0mNHWdWUyJIhv9lYqBw88A9vwExc1OkdJekG5VQoleR7s7xEmS8tqXUq45FdhhBkdr4ylOT9n7GRsWqKHB47S/qxQDzs2VpjH1A=; X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.17,REQID:fbdda30f-3de6-40dd-b444-b5d5a924c9cd,IP:0,U RL:0,TC:0,Content:-25,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTIO N:release,TS:-25 X-CID-META: VersionHash:d497b38,CLOUDID:296b513f-46cf-453a-bd84-ad9fc7cb0e8c,B ulkID:nil,BulkQuantity:0,SF:81|82|102|836|865|888|898,TC:-5,Content:0|15|5 0|99|200|213,EDM:-3,IP:nil,URL:0,File:130,RT:0,Bulk:nil,QS:nil,BEC:-1,COL: 0,OSI:0,OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0,BRR:0,BRE:0,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: f738e64880b911f1b1788b6acf885367-20260716 Received: from mtkmbs09n1.mediatek.inc [(172.21.101.35)] by mailgw01.mediatek.com (envelope-from ) (Generic MTA with TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256/256) with ESMTP id 1148466690; Thu, 16 Jul 2026 09:59:23 +0800 Received: from mtkmbs13n1.mediatek.inc (172.21.101.193) by mtkmbs10n1.mediatek.inc (172.21.101.34) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.29; Thu, 16 Jul 2026 09:59:21 +0800 Received: from mtksitap99.mediatek.inc (10.233.130.16) by mtkmbs13n1.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.2.2562.29 via Frontend Transport; Thu, 16 Jul 2026 09:59:21 +0800 From: Chris Lu To: Marcel Holtmann , Johan Hedberg , Luiz Von Dentz CC: Sean Wang , Will Lee , SS Wu , Steve Lee , Paul Menzel , linux-bluetooth , linux-kernel , linux-mediatek , Chris Lu Subject: [PATCH v12 3/7] Bluetooth: btmtksdio: Pass hardware dev_id to mt79xx_setup() Date: Thu, 16 Jul 2026 09:59:15 +0800 Message-ID: <20260716015920.1886719-4-chris.lu@mediatek.com> X-Mailer: git-send-email 2.45.2 In-Reply-To: <20260716015920.1886719-1-chris.lu@mediatek.com> References: <20260716015920.1886719-1-chris.lu@mediatek.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" mt79xx_setup() hardcodes dev_id=3D0 when calling btmtk_setup_firmware_79xx(= ), causing SDIO devices to log incorrect chip ID "BT HW ver: 0x0000" instead of the actual hardware version read from register 0x70010200. Pass the hardware dev_id to mt79xx_setup() and forward it to btmtk_setup_firmware_79xx() to match USB driver behavior and display correct chip identification. Fixes: 28b7c5a6db74 ("Bluetooth: btmtk: Add MT6639 (MT7927) Bluetooth suppo= rt") Signed-off-by: Chris Lu --- drivers/bluetooth/btmtksdio.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c index feda1ea8f256..088fdfb56231 100644 --- a/drivers/bluetooth/btmtksdio.c +++ b/drivers/bluetooth/btmtksdio.c @@ -901,14 +901,14 @@ static int mt76xx_setup(struct hci_dev *hdev, const c= har *fwname) return 0; } =20 -static int mt79xx_setup(struct hci_dev *hdev, const char *fwname) +static int mt79xx_setup(struct hci_dev *hdev, const char *fwname, u32 dev_= id) { struct btmtksdio_dev *bdev =3D hci_get_drvdata(hdev); struct btmtk_hci_wmt_params wmt_params; u8 param =3D 0x1; int err; =20 - err =3D btmtk_setup_firmware_79xx(hdev, fwname, mtk_hci_wmt_sync, 0); + err =3D btmtk_setup_firmware_79xx(hdev, fwname, mtk_hci_wmt_sync, dev_id); if (err < 0) { bt_dev_err(hdev, "Failed to setup 79xx firmware (%d)", err); return err; @@ -1167,7 +1167,7 @@ static int btmtksdio_setup(struct hci_dev *hdev) snprintf(fwname, sizeof(fwname), "mediatek/BT_RAM_CODE_MT%04x_1_%x_hdr.bin", dev_id & 0xffff, (fw_version & 0xff) + 1); - err =3D mt79xx_setup(hdev, fwname); + err =3D mt79xx_setup(hdev, fwname, dev_id); if (err < 0) return err; =20 --=20 2.45.2 From nobody Sat Jul 25 16:45:30 2026 Received: from mailgw01.mediatek.com (unknown [60.244.123.138]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5A1A93451D6; Thu, 16 Jul 2026 01:59:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=60.244.123.138 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784167179; cv=none; b=ZcjqAV4a4RchGd/uu0XDSatj/auEpNQ+wZleld+KquOo43gjoFHHM631f33HAjR8yEKfQ1bobWPdN4AxtnwDlK/11QdRabR44oy5rQn4bnyJOp9mgnyMIi3xY93RqIg9eKVdrGLL7tcKB/POAQENpCb8lz3pKLeOjXo9fygw2dE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784167179; c=relaxed/simple; bh=QBN/GFMYoksAuSP2pFZSZzaAQDn07zgLVGCrcMClj4M=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=EsVthSupmFbZqNcTs0eZ0iwYwkFufeDBkw3e04GiEaGXq3qBi7cAzN2E5IemHZacoSI6OjLskcRdb0XQMMr324VmDo2rlSwm5bYJ7Q6LrsBX/nFQMlSTWBdRJe8xSTk4gYIz4j1tKZ6sXtozU/w/MznmFD82+VfezWqseXC+1Ao= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=mediatek.com; spf=pass smtp.mailfrom=mediatek.com; dkim=pass (1024-bit key) header.d=mediatek.com header.i=@mediatek.com header.b=IVIn2t1N; arc=none smtp.client-ip=60.244.123.138 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=mediatek.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=mediatek.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=mediatek.com header.i=@mediatek.com header.b="IVIn2t1N" X-UUID: f74a1d2880b911f1b1788b6acf885367-20260716 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=mediatek.com; s=dk; h=Content-Type:Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID:Date:Subject:CC:To:From; bh=FH1zPI4XK0KFGvrVm9AbaQMRRKWSN4Ihv2jsnFAkNts=; b=IVIn2t1NY/hO4sWM+VtVBw1uPAEw6sYJtRob42Wl7CzcJUvJmno8D1SA6HgkiBdVoKj6U0x7bKb4msEFWShwftSuuX/EKJlwCVRoUwIG7vAKUiTanfasHd4ZOtHZ4U2GeeYJhyfQy2uz16aPQTzkjzuZZ2kIBvNH4DSHucvDj7s=; X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.17,REQID:32e71d15-0f2b-4dee-b691-d57ddbff58a8,IP:0,U RL:0,TC:0,Content:0,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION: release,TS:0 X-CID-META: VersionHash:d497b38,CLOUDID:f5febf37-7759-43a9-ae06-f4df9d53bea1,B ulkID:nil,BulkQuantity:0,SF:81|82|102|836|865|888|898,TC:-5,Content:0|15|5 0|99|200|213,EDM:-3,IP:nil,URL:0,File:130,RT:0,Bulk:nil,QS:nil,BEC:-1,COL: 0,OSI:0,OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0,BRR:0,BRE:0,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: f74a1d2880b911f1b1788b6acf885367-20260716 Received: from mtkmbs13n2.mediatek.inc [(172.21.101.108)] by mailgw01.mediatek.com (envelope-from ) (Generic MTA with TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256/256) with ESMTP id 76673855; Thu, 16 Jul 2026 09:59:23 +0800 Received: from mtkmbs13n1.mediatek.inc (172.21.101.193) by mtkmbs13n1.mediatek.inc (172.21.101.193) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.29; Thu, 16 Jul 2026 09:59:22 +0800 Received: from mtksitap99.mediatek.inc (10.233.130.16) by mtkmbs13n1.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.2.2562.29 via Frontend Transport; Thu, 16 Jul 2026 09:59:22 +0800 From: Chris Lu To: Marcel Holtmann , Johan Hedberg , Luiz Von Dentz CC: Sean Wang , Will Lee , SS Wu , Steve Lee , Paul Menzel , linux-bluetooth , linux-kernel , linux-mediatek , Chris Lu Subject: [PATCH v12 4/7] Bluetooth: btmtk: Improve BT firmware logging Date: Thu, 16 Jul 2026 09:59:16 +0800 Message-ID: <20260716015920.1886719-5-chris.lu@mediatek.com> X-Mailer: git-send-email 2.45.2 In-Reply-To: <20260716015920.1886719-1-chris.lu@mediatek.com> References: <20260716015920.1886719-1-chris.lu@mediatek.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Improve firmware loading log messages to provide more useful information: - Add firmware filename before loading to help identify which file is being loaded - Display chip ID (dev_id) as HW version instead of firmware's hwver field, which provides more meaningful hardware identification - Use %.16s format specifier for hdr->datetime field to prevent potential buffer over-read, as the field is a 16-byte array that may not be null-terminated log output with MT7922 [ 212.878783] Bluetooth: hci1: Loading BT firmware: mediatek/BT_RAM_CODE_M= T7922_1_1_hdr.bin [ 212.889614] Bluetooth: hci1: BT HW ver: 0x7922, SW ver: 0x008a, Build Ti= me: 20260224103448 [ 216.048877] Bluetooth: hci1: Device setup in 3096530 usecs [ 216.048890] Bluetooth: hci1: HCI Enhanced Setup Synchronous Connection c= ommand is advertised, but not supported. [ 216.114179] Bluetooth: hci1: AOSP extensions version v1.00 [ 216.114220] Bluetooth: hci1: AOSP quality report is supported [ 216.116782] Bluetooth: MGMT ver 1.23 Signed-off-by: Chris Lu Assisted-by: Claude:Sonnet-4.5 --- drivers/bluetooth/btmtk.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c index 3491060b3ae9..595e346accc3 100644 --- a/drivers/bluetooth/btmtk.c +++ b/drivers/bluetooth/btmtk.c @@ -148,6 +148,8 @@ int btmtk_setup_firmware_79xx(struct hci_dev *hdev, con= st char *fwname, size_t expected_size; u8 cmd[64]; =20 + bt_dev_info(hdev, "Loading BT firmware: %s", fwname); + err =3D request_firmware(&fw, fwname, &hdev->dev); if (err < 0) { bt_dev_err(hdev, "Failed to load firmware file (%d)", err); @@ -188,8 +190,8 @@ int btmtk_setup_firmware_79xx(struct hci_dev *hdev, con= st char *fwname, goto err_release_fw; } =20 - bt_dev_info(hdev, "HW/SW Version: 0x%04x%04x, Build Time: %s", - le16_to_cpu(hdr->hwver), le16_to_cpu(hdr->swver), hdr->datetime); + bt_dev_info(hdev, "BT HW ver: 0x%04x, SW ver: 0x%04x, Build Time: %.16s", + dev_id & 0xffff, le16_to_cpu(hdr->swver), hdr->datetime); =20 for (i =3D 0; i < section_num; i++) { first_block =3D 1; --=20 2.45.2 From nobody Sat Jul 25 16:45:30 2026 Received: from mailgw01.mediatek.com (unknown [60.244.123.138]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 51CB2330668; Thu, 16 Jul 2026 01:59:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=60.244.123.138 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784167175; cv=none; b=Uv5LAr4fNKLhZVnlT96lnHPhemH6rN0VeXOms5/a1Lt3Jezv77sOD9v8JBLK/D068QkojS87k5ymYF0o4cGPhCW3GG1peasYrGCK+n8HXG5eu0FXiPjVnqKxUS30DoY6p/XXEVZL8FS29D7EzPcgXzCNhzvpn/bXOQN8U97tcq8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784167175; c=relaxed/simple; bh=//BiBQQ9/pb2D4p8oYQegRCGdVHAKxLO+GOCKtr63ZE=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=D3irhX/5ZzcBld45lBtnQX7iI0tIoyZ8GPT7MM8xiUAH9+i4W+EmEliFns01fmgsymHvvwXdPLINag5+LK/6W4PV9DGxMkbeVvWpp8WTuW48O2a2aT3ttLO8LT8qu7IeghLAFyLjzZ7h/+9s5+RQCG1FZsdSD0nXPC/Favhz8Q8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=mediatek.com; spf=pass smtp.mailfrom=mediatek.com; dkim=pass (1024-bit key) header.d=mediatek.com header.i=@mediatek.com header.b=QvXYYyjQ; arc=none smtp.client-ip=60.244.123.138 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=mediatek.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=mediatek.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=mediatek.com header.i=@mediatek.com header.b="QvXYYyjQ" X-UUID: f74b2b1e80b911f1b1788b6acf885367-20260716 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=mediatek.com; s=dk; h=Content-Type:Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID:Date:Subject:CC:To:From; bh=biHARXTi5HhbkroAZdRCCqUki4qlgbYdasCtqlgw5xw=; b=QvXYYyjQdQLN4C2pvBfoeTEBBFrZi/Ufgbx5Zn5a4zxhCOp5g6Kh6oRS5IFZrRCCT34IsZIzpCwY+Sa/t7OJIqOj3YdogYKZIYFQ1RaEjhCj1BaADV+gtcpSvsqb98zx5/J77tfpnmSQYZA7ch6pbDKev3hHsK+wFXKqq1Sh1HQ=; X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.17,REQID:1578c101-09a7-4d99-b591-580bfce3e93b,IP:0,U RL:0,TC:0,Content:-5,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION :release,TS:-5 X-CID-META: VersionHash:d497b38,CLOUDID:2d302d19-ab14-4403-9336-76696324c5a8,B ulkID:nil,BulkQuantity:0,SF:81|82|102|836|865|888|898,TC:-5,Content:0|15|5 0|99|200|213,EDM:-3,IP:nil,URL:0,File:130,RT:0,Bulk:nil,QS:nil,BEC:-1,COL: 0,OSI:0,OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0,BRR:0,BRE:0,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: f74b2b1e80b911f1b1788b6acf885367-20260716 Received: from mtkmbs13n2.mediatek.inc [(172.21.101.108)] by mailgw01.mediatek.com (envelope-from ) (Generic MTA with TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256/256) with ESMTP id 911774566; Thu, 16 Jul 2026 09:59:23 +0800 Received: from mtkmbs13n1.mediatek.inc (172.21.101.193) by mtkmbs13n1.mediatek.inc (172.21.101.193) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.29; Thu, 16 Jul 2026 09:59:22 +0800 Received: from mtksitap99.mediatek.inc (10.233.130.16) by mtkmbs13n1.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.2.2562.29 via Frontend Transport; Thu, 16 Jul 2026 09:59:22 +0800 From: Chris Lu To: Marcel Holtmann , Johan Hedberg , Luiz Von Dentz CC: Sean Wang , Will Lee , SS Wu , Steve Lee , Paul Menzel , linux-bluetooth , linux-kernel , linux-mediatek , Chris Lu Subject: [PATCH v12 5/7] Bluetooth: btmtksdio: Remove redundant firmware filename override Date: Thu, 16 Jul 2026 09:59:17 +0800 Message-ID: <20260716015920.1886719-6-chris.lu@mediatek.com> X-Mailer: git-send-email 2.45.2 In-Reply-To: <20260716015920.1886719-1-chris.lu@mediatek.com> References: <20260716015920.1886719-1-chris.lu@mediatek.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" btmtksdio_setup() calls btmtk_fw_get_filename() to generate the correct firmware filename based on chip ID, then immediately overwrites it with snprintf() using a generic legacy format. This causes newer chips that require chip-specific firmware paths (MT6639, MT7925, MT7928) to request incorrect legacy filenames, leading to firmware load failures. The USB driver (btmtkusb.c) correctly uses btmtk_fw_get_filename() without overriding the result. Match that behavior by removing the redundant snprintf() call. Fixes: 7f935b21bee4 ("Bluetooth: btmtk: apply the common btmtk_fw_get_filen= ame") Signed-off-by: Chris Lu --- drivers/bluetooth/btmtksdio.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c index 088fdfb56231..4a160d5131f1 100644 --- a/drivers/bluetooth/btmtksdio.c +++ b/drivers/bluetooth/btmtksdio.c @@ -1164,9 +1164,6 @@ static int btmtksdio_setup(struct hci_dev *hdev) btmtk_fw_get_filename(fwname, sizeof(fwname), dev_id, fw_version, 0); =20 - snprintf(fwname, sizeof(fwname), - "mediatek/BT_RAM_CODE_MT%04x_1_%x_hdr.bin", - dev_id & 0xffff, (fw_version & 0xff) + 1); err =3D mt79xx_setup(hdev, fwname, dev_id); if (err < 0) return err; --=20 2.45.2 From nobody Sat Jul 25 16:45:30 2026 Received: from mailgw01.mediatek.com (unknown [60.244.123.138]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7F6CF33AD88; Thu, 16 Jul 2026 01:59:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=60.244.123.138 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784167176; cv=none; b=uCHoIYeLff7WTu9EBV1fPIipfO3kgIyhWOMlT8xC0LAnJJxoITiQN8Lpg1lwtfL3xdOi0ZjwSSea1I8b0CrzbgpuwGnRMPRBaiw14OXaV9K2nHfM8cl5TX5SafdWumNGoXPB/AgNVismqMxwbg8i4s0Fzh3E9Q7pv15+Qg1Y+qo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784167176; c=relaxed/simple; bh=CXZw16nF47ro55YLlnkq0+5AXwVPQ0Sbw2nBULUs5fw=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=KeDPnCwW26Dv9jFrDHhH+xX+O0TG3CCpZmyXs46rt5lJJaHIs01Y0KgMbsj4qkPUdPh1HAbiGrjkwg4hNvEV7ornisrKONvj/9jIAK5UkwcIo8rddc9S9paqxJ1Io+jprpXlysYbpKnvwnIwqw4BnqTomjEDaBZT/5xJ4AYvLBA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=mediatek.com; spf=pass smtp.mailfrom=mediatek.com; dkim=pass (1024-bit key) header.d=mediatek.com header.i=@mediatek.com header.b=HjW/xrXS; arc=none smtp.client-ip=60.244.123.138 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=mediatek.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=mediatek.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=mediatek.com header.i=@mediatek.com header.b="HjW/xrXS" X-UUID: f6e966b880b911f1b1788b6acf885367-20260716 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=mediatek.com; s=dk; h=Content-Type:Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID:Date:Subject:CC:To:From; bh=nO4iw7FfBkyOHJAjjnbya3620DOrnkSFerGvpQtGq4I=; b=HjW/xrXSArkU4qrnp9+AmJIGtyxG054xAnOPEKmSfnmCezaXwfjxVbsASbepToABPZoFUWb2jHMVxdXj8867yaFFIFxFuTOMEcMD3dT8a5GZjuqqM9w01jsyIxjblUpSH0oDjUcyU8aozmQiYTvsFTUj0sMrcL9IGfKH09hknCk=; X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.17,REQID:5a8b3093-21aa-469a-9b1c-74fa28be7795,IP:0,U RL:0,TC:0,Content:0,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION: release,TS:0 X-CID-META: VersionHash:d497b38,CLOUDID:f7febf37-7759-43a9-ae06-f4df9d53bea1,B ulkID:nil,BulkQuantity:0,SF:81|82|102|836|865|888|898,TC:-5,Content:0|15|5 0|99|200|213,EDM:-3,IP:nil,URL:0,File:130,RT:0,Bulk:nil,QS:nil,BEC:-1,COL: 0,OSI:0,OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0,BRR:0,BRE:0,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: f6e966b880b911f1b1788b6acf885367-20260716 Received: from mtkmbs14n1.mediatek.inc [(172.21.101.75)] by mailgw01.mediatek.com (envelope-from ) (Generic MTA with TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256/256) with ESMTP id 1275163237; Thu, 16 Jul 2026 09:59:22 +0800 Received: from mtkmbs13n1.mediatek.inc (172.21.101.193) by mtkmbs13n2.mediatek.inc (172.21.101.108) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.29; Thu, 16 Jul 2026 09:59:22 +0800 Received: from mtksitap99.mediatek.inc (10.233.130.16) by mtkmbs13n1.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.2.2562.29 via Frontend Transport; Thu, 16 Jul 2026 09:59:22 +0800 From: Chris Lu To: Marcel Holtmann , Johan Hedberg , Luiz Von Dentz CC: Sean Wang , Will Lee , SS Wu , Steve Lee , Paul Menzel , linux-bluetooth , linux-kernel , linux-mediatek , Chris Lu Subject: [PATCH v12 6/7] Bluetooth: btmtk: Replace magic numbers with WMT packet flag enum Date: Thu, 16 Jul 2026 09:59:18 +0800 Message-ID: <20260716015920.1886719-7-chris.lu@mediatek.com> X-Mailer: git-send-email 2.45.2 In-Reply-To: <20260716015920.1886719-1-chris.lu@mediatek.com> References: <20260716015920.1886719-1-chris.lu@mediatek.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Add BTMTK_WMT_PKT_* enum to represent WMT download packet sequence flags, improving code readability. Replace magic numbers (1, 2, 3) in btmtk_setup_firmware_79xx() and btmtk_setup_firmware() with descriptive enum values: - BTMTK_WMT_PKT_START (1): First packet of a sequence - BTMTK_WMT_PKT_CONTINUE (2): Continuation packet - BTMTK_WMT_PKT_END (3): Final packet of a sequence Signed-off-by: Chris Lu Reviewed-by: Paul Menzel Assisted-by: Claude:Sonnet-4.5 --- drivers/bluetooth/btmtk.c | 12 ++++++------ drivers/bluetooth/btmtk.h | 6 ++++++ 2 files changed, 12 insertions(+), 6 deletions(-) diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c index 595e346accc3..75519765bb49 100644 --- a/drivers/bluetooth/btmtk.c +++ b/drivers/bluetooth/btmtk.c @@ -271,12 +271,12 @@ int btmtk_setup_firmware_79xx(struct hci_dev *hdev, c= onst char *fwname, while (dl_size > 0) { dlen =3D min_t(int, 250, dl_size); if (first_block =3D=3D 1) { - flag =3D 1; + flag =3D BTMTK_WMT_PKT_START; first_block =3D 0; } else if (dl_size - dlen <=3D 0) { - flag =3D 3; + flag =3D BTMTK_WMT_PKT_END; } else { - flag =3D 2; + flag =3D BTMTK_WMT_PKT_CONTINUE; } =20 wmt_params.flag =3D flag; @@ -355,7 +355,7 @@ int btmtk_setup_firmware(struct hci_dev *hdev, const ch= ar *fwname, =20 fw_size -=3D 30; fw_ptr +=3D 30; - flag =3D 1; + flag =3D BTMTK_WMT_PKT_START; =20 wmt_params.op =3D BTMTK_WMT_PATCH_DWNLD; wmt_params.status =3D NULL; @@ -365,9 +365,9 @@ int btmtk_setup_firmware(struct hci_dev *hdev, const ch= ar *fwname, =20 /* Tell device the position in sequence */ if (fw_size - dlen <=3D 0) - flag =3D 3; + flag =3D BTMTK_WMT_PKT_END; else if (fw_size < fw->size - 30) - flag =3D 2; + flag =3D BTMTK_WMT_PKT_CONTINUE; =20 wmt_params.flag =3D flag; wmt_params.dlen =3D dlen; diff --git a/drivers/bluetooth/btmtk.h b/drivers/bluetooth/btmtk.h index c83c24897c95..51c18dde0a80 100644 --- a/drivers/bluetooth/btmtk.h +++ b/drivers/bluetooth/btmtk.h @@ -66,6 +66,12 @@ enum { BTMTK_WMT_ON_PROGRESS, }; =20 +enum { + BTMTK_WMT_PKT_START =3D 1, + BTMTK_WMT_PKT_CONTINUE =3D 2, + BTMTK_WMT_PKT_END =3D 3, +}; + struct btmtk_wmt_hdr { u8 dir; u8 op; --=20 2.45.2 From nobody Sat Jul 25 16:45:30 2026 Received: from mailgw01.mediatek.com (unknown [60.244.123.138]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 51E0A331EA0; Thu, 16 Jul 2026 01:59:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=60.244.123.138 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784167176; cv=none; b=ZO6ElDufLKg9XLi1A2zczWxD9jbuHKANPavLmr/b7x6JlwWz+c0yCRgQzg/6FXq3PzXJtmVItACHX6YUtxwgauoewYrQRICS8aCMwjJGuTloGUKwqlibr8RmDHKpmCWMbuPQjB9N/eNoGkFA+D74RAsSvfuceATV47aLkDOqRPM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784167176; c=relaxed/simple; bh=gRmcT5KUwKKr//r9/GuDn2Qo1vF1CK1FC2FcA1nZLqg=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=Qg5giExd4beoSkypsPXAQDdL1vCO8AgiMPGKGe3pRPUZlh+JNwvy4P6sPXEq7rW0Kv8QJOovcDEh3H4HRwGQQyzNfL7E6jD+J39oD4S9BN1HXQ8IhDMTLU9gQuJSrLHzTi3vhUxemXr2//ZnpbYID3R8iiZqjlxmYA22/OhKI7Y= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=mediatek.com; spf=pass smtp.mailfrom=mediatek.com; dkim=pass (1024-bit key) header.d=mediatek.com header.i=@mediatek.com header.b=qxVo7cg8; arc=none smtp.client-ip=60.244.123.138 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=mediatek.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=mediatek.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=mediatek.com header.i=@mediatek.com header.b="qxVo7cg8" X-UUID: f7a644cc80b911f1b1788b6acf885367-20260716 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=mediatek.com; s=dk; h=Content-Type:Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID:Date:Subject:CC:To:From; bh=GnGJVPsfmlUVn9D4AREl/G9xRnjGeV+vH8JleMNP0lE=; b=qxVo7cg8ifv/t1x7iWPvR7TSzyzDBP2RZNbjLl0GkVXQpz6RwOe0Vl2wqqAZIiR8e5QZ/Laso1KMlTaqniwvLwAx2iqLmEHMUUyrQJJtJnolUk7OziZywrBHQDFMRung2h6HOtgkdEnzc/dGfFXo6B01Px3rXgxmCqjgc6u5jvM=; X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.17,REQID:668335db-21f4-48c2-b20f-151cbf9ca790,IP:0,U RL:0,TC:0,Content:-25,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTIO N:release,TS:-25 X-CID-META: VersionHash:d497b38,CLOUDID:531d885f-762a-4584-baab-4eebe609beea,B ulkID:nil,BulkQuantity:0,SF:81|82|102|136|836|865|888|898,TC:-5,Content:0| 15|50|99|100|102|156|200|213,EDM:-3|-100,IP:nil,URL:0,File:130,RT:0,Bulk:n il,QS:nil,BEC:-1,COL:0,OSI:0,OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0,BRR:0,BRE :0,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: f7a644cc80b911f1b1788b6acf885367-20260716 Received: from mtkmbs10n1.mediatek.inc [(172.21.101.34)] by mailgw01.mediatek.com (envelope-from ) (Generic MTA with TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256/256) with ESMTP id 1554175141; Thu, 16 Jul 2026 09:59:23 +0800 Received: from mtkmbs13n1.mediatek.inc (172.21.101.193) by MTKMBS14N1.mediatek.inc (172.21.101.75) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.29; Thu, 16 Jul 2026 09:59:22 +0800 Received: from mtksitap99.mediatek.inc (10.233.130.16) by mtkmbs13n1.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.2.2562.29 via Frontend Transport; Thu, 16 Jul 2026 09:59:22 +0800 From: Chris Lu To: Marcel Holtmann , Johan Hedberg , Luiz Von Dentz CC: Sean Wang , Will Lee , SS Wu , Steve Lee , Paul Menzel , linux-bluetooth , linux-kernel , linux-mediatek , Chris Lu Subject: [PATCH v12 7/7] Bluetooth: btmtk: Add MT7928 support Date: Thu, 16 Jul 2026 09:59:19 +0800 Message-ID: <20260716015920.1886719-8-chris.lu@mediatek.com> X-Mailer: git-send-email 2.45.2 In-Reply-To: <20260716015920.1886719-1-chris.lu@mediatek.com> References: <20260716015920.1886719-1-chris.lu@mediatek.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Add support for MT7928 (internal device ID is MT7935) which requires additional firmware (CBMCU firmware) loading before Bluetooth firmware. CBMCU is a new component on MT7928 to handle common part shared across the combo chip (Wi-Fi/Bluetooth's subsystem), providing a better user experience through improved coordination between subsystems. Implement two-phase CBMCU firmware download: Phase 1 loads section with type 0x5 containing global descriptor, section maps and signature data; Phase 2 loads remaining firmware sections. Add retry mechanism for concurrent download protection. After CBMCU firmware loads successfully, the driver continues to load corresponding BT firmware based on device ID through fallthrough to case 0x7922/0x7925. Use %.16s format specifier for hdr->datetime field in CBMCU firmware logging to prevent potential buffer over-read, as the field is a 16-byte array that may not be null-terminated. The firmware(CBMCU_CODE_MT7935_1_1.bin/BT_RAM_CODE_MT7935_1_1_hdr.bin) required for MT7928 will be scheduled for upload to linux-firmware at a later stage. MT7928 bring-up kernel log: [ 6931.197167] usb 1-3: New USB device found, idVendor=3D0e8d, idProduct=3D= 7935, bcdDevice=3D 1.00 [ 6931.197212] usb 1-3: New USB device strings: Mfr=3D5, Product=3D6, Seria= lNumber=3D7 [ 6931.197237] usb 1-3: Product: Wireless_Device [ 6931.197258] usb 1-3: Manufacturer: MediaTek Inc. [ 6931.197279] usb 1-3: SerialNumber: 000000000 [ 6931.213478] Bluetooth: hci1: Loading CBMCU firmware: mediatek/mt7928/CBM= CU_CODE_MT7935_1_1.bin [ 6931.215214] Bluetooth: hci1: CBMCU HW ver: 0x7935, SW ver: 0x0000, Build= Time: 20260601T161751+ [ 6931.623962] Bluetooth: hci1: CBMCU firmware download completed [ 6931.643916] Bluetooth: hci1: Loading BT firmware: mediatek/mt7928/BT_RAM= _CODE_MT7935_1_1_hdr.bin [ 6931.650467] Bluetooth: hci1: BT HW ver: 0x7935, SW ver: 0x0000, Build Ti= me: 20260527000816 [ 6935.039790] Bluetooth: hci1: Device setup in 3369644 usecs [ 6935.039833] Bluetooth: hci1: HCI Enhanced Setup Synchronous Connection c= ommand is advertised, but not supported. [ 6935.160654] Bluetooth: hci1: AOSP extensions version v2.00 [ 6935.160710] Bluetooth: hci1: AOSP quality report is supported [ 6935.162954] Bluetooth: MGMT ver 1.23 Signed-off-by: Chris Lu Reviewed-by: Paul Menzel Reviewed-by: Sean Wang Assisted-by: Claude:Sonnet-4.5 --- drivers/bluetooth/btmtk.c | 370 +++++++++++++++++++++++++++++++++++++- drivers/bluetooth/btmtk.h | 3 + 2 files changed, 372 insertions(+), 1 deletion(-) diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c index 75519765bb49..50d3d69f91d3 100644 --- a/drivers/bluetooth/btmtk.c +++ b/drivers/bluetooth/btmtk.c @@ -21,6 +21,12 @@ #define MTK_FW_ROM_PATCH_SEC_MAP_SIZE 64 #define MTK_SEC_MAP_COMMON_SIZE 12 #define MTK_SEC_MAP_NEED_SEND_SIZE 52 +#define MTK_SEC_MAP_LENGTH_SIZE 4 +#define MTK_SEC_CBMCU_DESC 0x5 + +/* CBMCU WMT command flags */ +#define BTMTK_CBMCU_FLAG_QUERY_STATUS 0xF0 +#define BTMTK_CBMCU_FLAG_ENABLE_PATCH 0xF1 =20 /* It is for mt79xx iso data transmission setting */ #define MTK_ISO_THRESHOLD 264 @@ -120,6 +126,11 @@ void btmtk_fw_get_filename(char *buf, size_t size, u32= dev_id, u32 fw_ver, snprintf(buf, size, "mediatek/mt%04x/BT_RAM_CODE_MT%04x_1_%x_hdr.bin", dev_id & 0xffff, dev_id & 0xffff, (fw_ver & 0xff) + 1); + /* MT7928 */ + else if (dev_id =3D=3D 0x7935) + snprintf(buf, size, + "mediatek/mt7928/BT_RAM_CODE_MT%04x_1_1_hdr.bin", + dev_id & 0xffff); else if (dev_id =3D=3D 0x7961 && fw_flavor) snprintf(buf, size, "mediatek/BT_RAM_CODE_MT%04x_1a_%x_hdr.bin", @@ -775,6 +786,7 @@ static int btmtk_usb_hci_wmt_sync(struct hci_dev *hdev, status =3D BTMTK_WMT_ON_UNDONE; break; case BTMTK_WMT_PATCH_DWNLD: + case BTMTK_WMT_CBMCU_DWNLD: if (wmt_evt->whdr.flag =3D=3D 2) status =3D BTMTK_WMT_PATCH_DONE; else if (wmt_evt->whdr.flag =3D=3D 1) @@ -911,6 +923,351 @@ static u32 btmtk_usb_reset_done(struct hci_dev *hdev) return val & MTK_BT_RST_DONE; } =20 +static int btmtk_cbmcu_patch_status(struct hci_dev *hdev, + wmt_cmd_sync_func_t wmt_cmd_sync, + u8 *patch_status) +{ + struct btmtk_hci_wmt_params wmt_params; + int status, err, retry =3D 20; + + do { + wmt_params.op =3D BTMTK_WMT_CBMCU_DWNLD; + wmt_params.flag =3D BTMTK_CBMCU_FLAG_QUERY_STATUS; + wmt_params.dlen =3D 0; + wmt_params.data =3D NULL; + wmt_params.status =3D &status; + + err =3D wmt_cmd_sync(hdev, &wmt_params); + if (err < 0) { + bt_dev_err(hdev, "Failed to query CBMCU patch status (%d)", err); + return err; + } + + *patch_status =3D (u8)status; + + if (*patch_status =3D=3D BTMTK_WMT_PATCH_PROGRESS) { + msleep(100); + retry--; + } else { + break; + } + } while (retry > 0); + + if (*patch_status =3D=3D BTMTK_WMT_PATCH_PROGRESS) { + bt_dev_err(hdev, "CBMCU patch status query timeout"); + return -ETIMEDOUT; + } + + return 0; +} + +static int btmtk_query_cbmcu_section(struct hci_dev *hdev, + wmt_cmd_sync_func_t wmt_cmd_sync, + u8 cbmcu_type, + const u8 *section_map, + u32 cert_len) +{ + struct btmtk_hci_wmt_params wmt_params; + u8 cmd[64]; + int status, err; + + cmd[0] =3D 0; + cmd[1] =3D cbmcu_type; + + if (cbmcu_type =3D=3D 0) + put_unaligned_le32(cert_len, &cmd[2]); + else + memcpy(&cmd[2], section_map, MTK_SEC_MAP_NEED_SEND_SIZE); + + wmt_params.op =3D BTMTK_WMT_CBMCU_DWNLD; + wmt_params.flag =3D 0; + wmt_params.dlen =3D cbmcu_type ? + MTK_SEC_MAP_NEED_SEND_SIZE + 2 : + MTK_SEC_MAP_LENGTH_SIZE + 2; + wmt_params.data =3D cmd; + wmt_params.status =3D &status; + + err =3D wmt_cmd_sync(hdev, &wmt_params); + if (err < 0) { + bt_dev_err(hdev, "Failed to query CBMCU section (%d)", err); + return err; + } + + /* Query should return UNDONE status for successful section query */ + if (status !=3D BTMTK_WMT_PATCH_UNDONE) { + bt_dev_err(hdev, "CBMCU section query status error (%d)", status); + return -EIO; + } + + return 0; +} + +static int btmtk_download_cbmcu_section(struct hci_dev *hdev, + wmt_cmd_sync_func_t wmt_cmd_sync, + const u8 *fw_data, + u32 dl_size) +{ + struct btmtk_hci_wmt_params wmt_params; + u32 sent_len, total_size =3D dl_size; + int err; + + wmt_params.op =3D BTMTK_WMT_CBMCU_DWNLD; + wmt_params.status =3D NULL; + + while (dl_size > 0) { + sent_len =3D min_t(u32, 250, dl_size); + + if (dl_size =3D=3D total_size) + wmt_params.flag =3D BTMTK_WMT_PKT_START; + else if (dl_size =3D=3D sent_len) + wmt_params.flag =3D BTMTK_WMT_PKT_END; + else + wmt_params.flag =3D BTMTK_WMT_PKT_CONTINUE; + + wmt_params.dlen =3D sent_len; + wmt_params.data =3D fw_data; + + err =3D wmt_cmd_sync(hdev, &wmt_params); + if (err < 0) { + bt_dev_err(hdev, "Failed to send CBMCU section data (%d)", err); + return err; + } + + dl_size -=3D sent_len; + fw_data +=3D sent_len; + } + + return 0; +} + +static int btmtk_enable_cbmcu_patch(struct hci_dev *hdev, + wmt_cmd_sync_func_t wmt_cmd_sync) +{ + struct btmtk_hci_wmt_params wmt_params; + int err; + + wmt_params.op =3D BTMTK_WMT_CBMCU_DWNLD; + wmt_params.flag =3D BTMTK_CBMCU_FLAG_ENABLE_PATCH; + wmt_params.dlen =3D 0; + wmt_params.data =3D NULL; + wmt_params.status =3D NULL; + + err =3D wmt_cmd_sync(hdev, &wmt_params); + if (err < 0) { + bt_dev_err(hdev, "Failed to enable CBMCU patch (%d)", err); + return err; + } + + return 0; +} + +static int btmtk_load_cbmcu_firmware(struct hci_dev *hdev, + const char *fwname, + wmt_cmd_sync_func_t wmt_cmd_sync, + u32 dev_id) +{ + struct btmtk_patch_header *hdr; + struct btmtk_global_desc *globaldesc; + struct btmtk_section_map *sectionmap; + const struct firmware *fw; + const u8 *fw_ptr; + u8 *cert_buf =3D NULL; + u32 section_num, section_offset, dl_size, cert_len; + size_t expected_size; + int i, err; + + err =3D request_firmware(&fw, fwname, &hdev->dev); + if (err < 0) { + bt_dev_err(hdev, "Failed to load CBMCU firmware file %s (%d)", + fwname, err); + return err; + } + + if (fw->size < MTK_FW_ROM_PATCH_HEADER_SIZE + MTK_FW_ROM_PATCH_GD_SIZE) { + bt_dev_err(hdev, "CBMCU firmware too small: size=3D%zu, min=3D%u", + fw->size, + MTK_FW_ROM_PATCH_HEADER_SIZE + MTK_FW_ROM_PATCH_GD_SIZE); + err =3D -EINVAL; + goto err_release_fw; + } + + fw_ptr =3D fw->data; + hdr =3D (struct btmtk_patch_header *)fw_ptr; + globaldesc =3D (struct btmtk_global_desc *)(fw_ptr + MTK_FW_ROM_PATCH_HEA= DER_SIZE); + section_num =3D le32_to_cpu(globaldesc->section_num); + + /* Check for potential integer overflow in size calculation */ + if (check_mul_overflow((size_t)MTK_FW_ROM_PATCH_SEC_MAP_SIZE, + (size_t)section_num, &expected_size) || + check_add_overflow(expected_size, + (size_t)(MTK_FW_ROM_PATCH_HEADER_SIZE + + MTK_FW_ROM_PATCH_GD_SIZE), + &expected_size)) { + bt_dev_err(hdev, "CBMCU firmware size calculation overflow (section_num= =3D%u)", + section_num); + err =3D -EINVAL; + goto err_release_fw; + } + + if (fw->size < expected_size) { + bt_dev_err(hdev, "CBMCU firmware truncated: size=3D%zu, expected=3D%zu (= section_num=3D%u)", + fw->size, expected_size, section_num); + err =3D -EINVAL; + goto err_release_fw; + } + + bt_dev_info(hdev, "CBMCU HW ver: 0x%04x, SW ver: 0x%04x, Build Time: %.16= s", + dev_id & 0xffff, le16_to_cpu(hdr->swver), hdr->datetime); + + /* Phase 1: Download section type MTK_SEC_CBMCU_DESC */ + for (i =3D 0; i < section_num; i++) { + sectionmap =3D (struct btmtk_section_map *) + (fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE + + MTK_FW_ROM_PATCH_GD_SIZE + + MTK_FW_ROM_PATCH_SEC_MAP_SIZE * i); + + /* Only process MTK_SEC_CBMCU_DESC section in Phase 1 */ + if ((le32_to_cpu(sectionmap->sectype) & 0xFFFF) !=3D MTK_SEC_CBMCU_DESC) + continue; + + section_offset =3D le32_to_cpu(sectionmap->secoffset); + dl_size =3D le32_to_cpu(sectionmap->secsize); + + if (dl_size =3D=3D 0) + continue; + + if (section_offset > fw->size || + dl_size > fw->size - section_offset) { + bt_dev_err(hdev, "CBMCU Phase 1 section out of bounds"); + err =3D -EINVAL; + goto err_release_fw; + } + + cert_len =3D MTK_FW_ROM_PATCH_GD_SIZE + + MTK_FW_ROM_PATCH_SEC_MAP_SIZE * section_num + + dl_size; + + /* Query cbmcu section */ + err =3D btmtk_query_cbmcu_section(hdev, wmt_cmd_sync, 0, NULL, + cert_len); + if (err < 0) + goto err_release_fw; + + cert_buf =3D kmalloc(cert_len, GFP_KERNEL); + if (!cert_buf) { + err =3D -ENOMEM; + goto err_release_fw; + } + + /* Copy Global Descriptor + All Section Maps */ + memcpy(cert_buf, + fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE, + MTK_FW_ROM_PATCH_GD_SIZE + MTK_FW_ROM_PATCH_SEC_MAP_SIZE * sectio= n_num); + + /* Copy Phase 1 section data */ + memcpy(cert_buf + MTK_FW_ROM_PATCH_GD_SIZE + + MTK_FW_ROM_PATCH_SEC_MAP_SIZE * section_num, + fw_ptr + section_offset, + dl_size); + + /* Download Phase 1 section */ + err =3D btmtk_download_cbmcu_section(hdev, wmt_cmd_sync, + cert_buf, cert_len); + kfree(cert_buf); + cert_buf =3D NULL; + + if (err < 0) { + bt_dev_err(hdev, "Failed to download CBMCU Phase 1 section (%d)", err); + goto err_release_fw; + } + + break; + } + + /* Phase 2: Download other sections (type !=3D MTK_SEC_CBMCU_DESC) */ + for (i =3D 0; i < section_num; i++) { + sectionmap =3D (struct btmtk_section_map *) + (fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE + + MTK_FW_ROM_PATCH_GD_SIZE + + MTK_FW_ROM_PATCH_SEC_MAP_SIZE * i); + + /* Skip MTK_SEC_CBMCU_DESC section in Phase 2 */ + if ((le32_to_cpu(sectionmap->sectype) & 0xFFFF) =3D=3D MTK_SEC_CBMCU_DES= C) + continue; + + section_offset =3D le32_to_cpu(sectionmap->secoffset); + dl_size =3D le32_to_cpu(sectionmap->bin_info_spec.dlsize); + + if (dl_size =3D=3D 0) + continue; + + if (section_offset > fw->size || + dl_size > fw->size - section_offset) { + bt_dev_err(hdev, "CBMCU Phase 2 section %d out of bounds", i); + err =3D -EINVAL; + goto err_release_fw; + } + + /* Query cbmcu section */ + err =3D btmtk_query_cbmcu_section(hdev, wmt_cmd_sync, 1, + (u8 *)§ionmap->bin_info_spec, + 0); + if (err < 0) + goto err_release_fw; + + /* Download section data */ + err =3D btmtk_download_cbmcu_section(hdev, wmt_cmd_sync, + fw_ptr + section_offset, + dl_size); + if (err < 0) { + bt_dev_err(hdev, "Failed to download CBMCU section %d (%d)", i, err); + goto err_release_fw; + } + } + + bt_dev_info(hdev, "CBMCU firmware download completed"); + +err_release_fw: + release_firmware(fw); + return err; +} + +static int btmtk_setup_cbmcu_firmware(struct hci_dev *hdev, + wmt_cmd_sync_func_t wmt_cmd_sync, + u32 dev_id) +{ + char cbmcu_fwname[64]; + u8 patch_status; + int err; + + err =3D btmtk_cbmcu_patch_status(hdev, wmt_cmd_sync, &patch_status); + if (err < 0) + return err; + + bt_dev_dbg(hdev, "CBMCU patch status: 0x%02x", patch_status); + + if (patch_status !=3D BTMTK_WMT_PATCH_UNDONE) + return 0; + + snprintf(cbmcu_fwname, sizeof(cbmcu_fwname), + "mediatek/mt7928/CBMCU_CODE_MT%04x_1_1.bin", + dev_id & 0xffff); + + bt_dev_info(hdev, "Loading CBMCU firmware: %s", cbmcu_fwname); + + err =3D btmtk_load_cbmcu_firmware(hdev, cbmcu_fwname, wmt_cmd_sync, dev_i= d); + if (err < 0) { + bt_dev_err(hdev, "Failed to download CBMCU firmware (%d)", err); + return err; + } + + err =3D btmtk_enable_cbmcu_patch(hdev, wmt_cmd_sync); + if (err < 0) + return err; + + return 0; +} + int btmtk_usb_subsys_reset(struct hci_dev *hdev, u32 dev_id) { u32 val; @@ -935,7 +1292,7 @@ int btmtk_usb_subsys_reset(struct hci_dev *hdev, u32 d= ev_id) if (err < 0) return err; msleep(100); - } else if (dev_id =3D=3D 0x7925 || dev_id =3D=3D 0x6639) { + } else if (dev_id =3D=3D 0x7925 || dev_id =3D=3D 0x6639 || dev_id =3D=3D = 0x7935) { err =3D btmtk_usb_uhw_reg_read(hdev, MTK_BT_RESET_REG_CONNV3, &val); if (err < 0) return err; @@ -1420,6 +1777,15 @@ int btmtk_usb_setup(struct hci_dev *hdev) case 0x7668: fwname =3D FIRMWARE_MT7668; break; + case 0x7935: + /* Requires CBMCU firmware before BT firmware */ + err =3D btmtk_setup_cbmcu_firmware(hdev, btmtk_usb_hci_wmt_sync, + dev_id); + if (err < 0) { + bt_dev_err(hdev, "Failed to set up CBMCU firmware (%d)", err); + return err; + } + fallthrough; case 0x7922: case 0x7925: /* @@ -1637,3 +2003,5 @@ MODULE_FIRMWARE(FIRMWARE_MT7922); MODULE_FIRMWARE(FIRMWARE_MT7961); MODULE_FIRMWARE(FIRMWARE_MT7925); MODULE_FIRMWARE(FIRMWARE_MT7927); +MODULE_FIRMWARE(FIRMWARE_MT7928); +MODULE_FIRMWARE(FIRMWARE_MT7928_CBMCU); diff --git a/drivers/bluetooth/btmtk.h b/drivers/bluetooth/btmtk.h index 51c18dde0a80..5fe4964b031b 100644 --- a/drivers/bluetooth/btmtk.h +++ b/drivers/bluetooth/btmtk.h @@ -9,6 +9,8 @@ #define FIRMWARE_MT7961 "mediatek/BT_RAM_CODE_MT7961_1_2_hdr.bin" #define FIRMWARE_MT7925 "mediatek/mt7925/BT_RAM_CODE_MT7925_1_1_hdr.bin" #define FIRMWARE_MT7927 "mediatek/mt7927/BT_RAM_CODE_MT6639_2_1_hdr.bin" +#define FIRMWARE_MT7928 "mediatek/mt7928/BT_RAM_CODE_MT7935_1_1_hdr.bin" +#define FIRMWARE_MT7928_CBMCU "mediatek/mt7928/CBMCU_CODE_MT7935_1_1.bin" =20 #define HCI_EV_WMT 0xe4 #define HCI_WMT_MAX_EVENT_SIZE 64 @@ -54,6 +56,7 @@ enum { BTMTK_WMT_RST =3D 0x7, BTMTK_WMT_REGISTER =3D 0x8, BTMTK_WMT_SEMAPHORE =3D 0x17, + BTMTK_WMT_CBMCU_DWNLD =3D 0x58, }; =20 enum { --=20 2.45.2