Re: rtl_bt: RTL8852BU rom_version 3 has no matching in rtl8852bu_fw.bin

["Veysi Özgün" <veysiiozgun@gmail.com>]

Hi Hilda, all,

Thanks for confirming that eco 4 firmware is planned. I have the same
controller (0bda:b853, rom_version 3) and got it working with the patch
from the Windows driver. Along the way I found something that may matter
for the Linux release: for this ROM revision, the Windows driver sends an
extra vendor command before each patch segment. The current btrtl
download path never sends it.

Hardware / software
-------------------
  Machine   : Lenovo LOQ 15ARP10E (83S0)
  BT        : 0bda:b853, hci_rev 0x000b, lmp_subver 0x8852, rom_version 3
  Wi-Fi     : RTL8852BE (rtw89_8852be), works fine
  Kernel    : 7.1.5 (Kali), BlueZ 5.87
  Windows   : Realtek driver 18.4032.0.3008 (rtkbtfilter.inf),
              patch file rtl8852bd_mp_chip_new.dat

What Windows sends (USBPcap capture of a radio off/on cycle)
------------------------------------------------------------
  HCI_Read_Local_Version
  for each of the 3 segments:
    0xfc62 plen 9: 21 | le32 0x801200cc | le32 <segment addr>  -> status 0
    0xfc20 fragments of 252 bytes, index 1..0x7f then wraps to 1,
      index restarts at 1 for every segment,
      no 0x80 flag at the end of a segment
  then one 0xfc20 with index 0x80 and no data -> status 0

  segment addr    size
  0x8010f720      61552
  0x8010e990        568
  0x801084e0       2900

Afterwards Read_Local_Version returns hci_rev 0x3c91 and lmp_subver 0x950e.

The fragments are byte-identical to the payload of each BTNIC003 entry
(chip_id 0x14, eco 4). In each entry, the two addresses are at +0x3df and
+0x3e7, the payload length is at +0x400, and the payload starts at +0x408.
The first segment has the same layout as the eco 1/2 subsections in
rtl8852bu_fw.bin (code starts with f8630f62 and ends with the 07072db1
trailer).

What does NOT work
------------------
1. Adding the eco 4 payload as an extra RTBTCore subsection and loading it
   through the existing v2 path (without 0xfc62). The controller stops
   responding in the middle of the download ("command 0xfc20 tx timeout",
   "download fw command failed (-110)"). After that, even 0xfc61 times out
   and usbcore keeps resetting the device. Only a full power-off recovers it.

2. Loading the patch from userspace (libusb) with the Windows sequence
   before btusb binds. The patch itself is accepted (lmp_subver becomes
   0x950e), but then btrtl_initialize() finds no ic_info for 0x950e, sets
   drop_fw, sends 0xfc66 and the controller goes back to ROM.

What works
----------
I added a small path to btrtl_setup_rtl8723b() for
8852A-id / hci_rev 0xb / USB / rom_version 3. It uses request_firmware() on
the BTNIC003 file and replays the sequence above. With it, the controller
comes up with its real BD_ADDR, registers with mgmt and scans normally.
This is only a proof of concept and not meant for merging (it parses the
vendor Windows file). I'm happy to share the diff and the pcapng if they
help.

Question
--------
Will the upcoming eco 4 firmware work with the existing RTBTCore download
path, or does this ROM revision also need 0xfc62 (or similar) on the
driver side? Either way, I can test pre-release firmware or driver patches
on this hardware.

Thanks,
Veysi Özgün