linux-kernel - [PATCH v2] Bluetooth: btrtl: fix rtl_dump.fw

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20250814095739.38343-1-liujiajia@kylinos.cn>
Date: Thu, 14 Aug 2025 17:57:39 +0800
From: Jiajia Liu <liujiajia@...inos.cn>
To: pmenzel@...gen.mpg.de,
	Marcel Holtmann <marcel@...tmann.org>,
	Luiz Augusto von Dentz <luiz.dentz@...il.com>
Cc: alex_lu@...lsil.com.cn,
	hildawu@...ltek.com,
	linux-bluetooth@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Jiajia Liu <liujiajia@...inos.cn>
Subject: [PATCH v2] Bluetooth: btrtl: fix rtl_dump.fw_version for firmware v2

rtl_dump.fw_version is not set for firmware v2. Since
rtl_epatch_header_v2.fw_version seems to be different with the
release version, set it to the fw version read after downloading
firmware.

For latest RTL8852B FW from commit c1a6a1a2 ("rtl_bt: Update RTL8852B
BT USB FW to 0x098B_154B") in linux-firmware, the release version
is 0x098B_154B corresponding to $(hci_rev)_$(lmp_subver) and at
file offset 0x16aee.

 $ hexdump -C rtl_bt/rtl8852bu_fw.bin | grep '4b 15'
 00016ae0  99 66 4e d2 bc 93 07 07  2d b1 bf 4b 15 8b 4b 15
 $ hexdump -C rtl_bt/rtl8852bu_fw.bin | grep '8b 09'
 00016af0  8b 09 08 00 00 00 00 00  00 00 ff 02 01 01 14 01

rtl_epatch_header_v2.fw_version is 0134ff2b-00019cfe at file offset 8.

 $ hexdump -n 16 -C rtl_bt/rtl8852bu_fw.bin
 00000000  52 54 42 54 43 6f 72 65  2b ff 34 01 fe 9c 01 00  |RTBTCore+.4.....|

Tested with RTL8852BE BT (0bda:b85c) and the following script.

  #!/bin/bash

  set -ex

  echo 1 | tee /sys/class/bluetooth/hci*/device/coredump > /dev/null

  sleep 1
  cat /sys/class/devcoredump/devcd*/data | grep --binary-file=text 'Firmware Version: 0x98B154B'

  echo 0 | tee /sys/class/devcoredump/devcd*/data > /dev/null

Signed-off-by: Jiajia Liu <liujiajia@...inos.cn>
---
Changes in v2:
 - Commit message
   - More about FW release version
   - Add test script

 drivers/bluetooth/btrtl.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c
index 6abd962502e3..6ad3ba7901e9 100644
--- a/drivers/bluetooth/btrtl.c
+++ b/drivers/bluetooth/btrtl.c
@@ -822,6 +822,7 @@ static int rtl_download_firmware(struct hci_dev *hdev,
 	int j = 0;
 	struct sk_buff *skb;
 	struct hci_rp_read_local_version *rp;
+	struct btrealtek_data *coredump_info = hci_get_priv(hdev);
 
 	dl_cmd = kmalloc(sizeof(*dl_cmd), GFP_KERNEL);
 	if (!dl_cmd)
@@ -873,6 +874,9 @@ static int rtl_download_firmware(struct hci_dev *hdev,
 	rp = (struct hci_rp_read_local_version *)skb->data;
 	rtl_dev_info(hdev, "fw version 0x%04x%04x",
 		     __le16_to_cpu(rp->hci_rev), __le16_to_cpu(rp->lmp_subver));
+	if (coredump_info->rtl_dump.fw_version == 0)
+		coredump_info->rtl_dump.fw_version =
+			__le16_to_cpu(rp->hci_rev) << 16 | __le16_to_cpu(rp->lmp_subver);
 	kfree_skb(skb);
 
 out:
-- 
2.50.1