RE: [PATCH v5] Bluetooth: btrtl: Add firmware format v3 support

[Hilda Wu <hildawu@realtek.com>]

Dear Paul,

Thank you very much for the detailed review. 
Please find below our response to each of your points; the corresponding fixes will be included in the next patch version.
My responses are included inline below.

-----Original Message-----
From: Paul Menzel <pmenzel@molgen.mpg.de> 
Sent: Wednesday, June 24, 2026 4:06 PM
To: Hilda Wu <hildawu@realtek.com>
Cc: marcel@holtmann.org; luiz.dentz@gmail.com; linux-bluetooth@vger.kernel.org; linux-kernel@vger.kernel.org; alex_lu@realsil.com.cn; jason_mao <jason_mao@realsil.com.cn>; zoey_zhou <zoey_zhou@realsil.com.cn>; Max Chou <max.chou@realtek.com>; KidmanLee <kidman@realtek.com>
Subject: Re: [PATCH v5] Bluetooth: btrtl: Add firmware format v3 support


External mail : This email originated from outside the organization. Do not reply, click links, or open attachments unless you recognize the sender and know the content is safe.



Dear Hilda,


Thank you for your patch.

Am 24.06.26 um 07:33 schrieb Hilda Wu:
> Realtek updated its Bluetooth firmware format to v3.

Please name the specification document, and state whether it’s publically accessible.

The firmware format v3 is defined by an internal Realtek specification document (not publicly released).

> This patch extends the btrtl driver to recognise and parse the new v3 
> file format, including:
> - New signature string and image ID definitions
> - Extension of btrtl_device_info to store v3-specific metadata
> - Logic to extract and load firmware data out of v3 images
> - Maintains compatibility with existing v2 firmware format
>
> This is required for future Realtek Bluetooth chips that ship with
> v3 firmware.

Please add a blank line between paragraphs or do not wrap the line after the sentence.

Fixed. It will be fixed in PATCH v6.

> The RTL8922D is the first IC to use firmware format V3, so the 
> following example uses the RTL8922D's log as expected fw format v3 output:
>
> Bluetooth: btrtl_read_chip_id() hci0: RTL: chip_id status=0x00 id=0x37
> Bluetooth: btrtl_initialize() hci0: RTL: examining hci_ver=0d 
> hci_rev=000d lmp_ver=0d lmp_subver=8922

Please do not wrap the lines of the pasted lines. If you keep the timestamp in the front, `checkpatch.pl` should not complain.

Fixed, thank you for your guidance.

> Bluetooth: rtl_read_rom_version() hci0: RTL: rom_version status=0 
> version=1
> Bluetooth: btrtl_initialize() hci0: RTL: btrtl_initialize: key id 0
> Bluetooth: rtl_load_file() hci0: RTL: loading rtl_bt/rtl8922du_fw.bin
> Bluetooth: rtl_load_file() hci0: RTL: loading 
> rtl_bt/rtl8922du_config.bin
> Bluetooth: rtlbt_parse_firmware_v3() hci0: RTL: key id 0
> Bluetooth: rtlbt_parse_section_v3() hci0: RTL: image (f000:00), chip 
> id 55, cut 0x02, len 00007185
> Bluetooth: rtlbt_parse_section_v3() hci0: RTL: image version: 35fd7908
> Bluetooth: rtlbt_parse_config() hci0: RTL: config file:
> rtl_bt/rtl8922du_config_f000.bin
> Bluetooth: rtlbt_parse_section_v3() hci0: RTL: image (f002:00), chip 
> id 55, cut 0x02, len 000078f5
> Bluetooth: rtlbt_parse_section_v3() hci0: RTL: image version: 47b6874d
> Bluetooth: rtlbt_parse_config() hci0: RTL: config file:
> rtl_bt/rtl8922du_config_f002.bin
> Bluetooth: rtlbt_parse_firmware_v3() hci0: RTL: image payload total len:
> 0x0000ea7a
> Bluetooth: rtl_finalize_download() hci0: RTL: Watchdog reset status 00
> Bluetooth: rtl_finalize_download() hci0: RTL: fw version 0x47b6874d

How big in the firmware file, and how long did it take to load it?

The firmware image file (rtl8922du_fw.bin) is about 783 KB on disk and contains multiple key_id-specific image sections; after rtlbt_parse_firmware_v3() filters out sections with mismatched key_id, the actual payload downloaded to the chip in this boot is approximately 267 KB (0x40a7c bytes), and the full sequence from rtl_load_file() to rtl_finalize_download() completing takes ~483 ms.

> Signed-off-by: Alex Lu <alex_lu@realsil.com.cn>
> Signed-off-by: Zoey Zhou <zoey_zhou@realsil.com.cn>
> Signed-off-by: Hilda Wu <hildawu@realtek.com>
>
> ---
> V4 -> V5::
> - Add independent support for RTL8922D section
> - Introduce macros to improve code readability
> - Document firmware format v3 and its differences
> - Align implementation with reviewer feedback
>
> V3 -> V4:
> - Rework skb->data access and add clarifying comments
> - Fix latent issues
>
> V2 -> V3:
> - Address coccinelle warning
>
> V1 -> V2:
> - Add missing symbols
> - Resolve build warnings
> ---
>   drivers/bluetooth/btrtl.c | 698 +++++++++++++++++++++++++++++++++++++-
>   drivers/bluetooth/btrtl.h | 102 ++++++

The files get bigger. Would it be good to split the firmware handling out into a separate file?

>   drivers/bluetooth/btusb.c |   3 +
>   3 files changed, 786 insertions(+), 17 deletions(-)

For easier review, would it be possible to split out the refactoring like defining the macros FW_TYPE_V0, … and using them?

Agreed, and done. The v3 firmware parsing/download logic has been split out into a new file, drivers/bluetooth/btrtl_enh.c, to keep btrtl.c size manageable. btrtl.c uses symbol_get()/   symbol_put() on a small ops struct (rtl_enh_ops) to call into btrtl_enh.c, so v2-only builds are not forced to pull in the v3 code.

[…]


Kind regards,

Paul

In addition, a security Sashiko reported several issues in v5 . All of these have been fixed in v6 as well; details are in the v6 changelog.

We will send v6 with the above items addressed.
Thank you again for taking the time to review this.

Best regards,
Hilda