1. 26 Jun, 2021 33 commits
    • Joakim Tjernlund's avatar
      Bluetooth: btrtl: rename USB fw for RTL8761 · 9fd2e294
      Joakim Tjernlund authored
      According Realteks own BT drivers firmware RTL8761B is for UART
      and RTL8761BU is for USB.
      
      Change existing 8761B to UART and add an 8761BU entry for USB
      Signed-off-by: default avatarJoakim Tjernlund <Joakim.Tjernlund@infinera.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      9fd2e294
    • Joakim Tjernlund's avatar
      Bluetooth: btusb: Add 0x0b05:0x190e Realtek 8761BU (ASUS BT500) device. · 33404381
      Joakim Tjernlund authored
      T:  Bus=01 Lev=01 Prnt=01 Port=08 Cnt=04 Dev#= 18 Spd=12   MxCh= 0
      D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
      P:  Vendor=0b05 ProdID=190e Rev= 2.00
      S:  Manufacturer=Realtek
      S:  Product=ASUS USB-BT500
      S:  SerialNumber=xxxxxxxx
      C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA
      I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
      E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
      E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
      I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
      E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
      I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
      E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
      I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
      I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
      I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
      I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
      Signed-off-by: default avatarJoakim Tjernlund <Joakim.Tjernlund@infinera.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      33404381
    • Archie Pusaka's avatar
      Bluetooth: hci_h5: Add RTL8822CS capabilities · 3011faa2
      Archie Pusaka authored
      RTL8822 chipset supports WBS, and this information is conveyed in
      btusb.c. However, the UART driver doesn't have this information just
      yet.
      Signed-off-by: default avatarArchie Pusaka <apusaka@chromium.org>
      Reviewed-by: default avatarAbhishek Pandit-Subedi <abhishekpandit@chromium.org>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      3011faa2
    • Tedd Ho-Jeong An's avatar
      Bluetooth: mgmt: Fix the command returns garbage parameter value · 02ce2c2c
      Tedd Ho-Jeong An authored
      When the Get Device Flags command fails, it returns the error status
      with the parameters filled with the garbage values. Although the
      parameters are not used, it is better to fill with zero than the random
      values.
      Signed-off-by: default avatarTedd Ho-Jeong An <tedd.an@intel.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      02ce2c2c
    • Yun-Hao Chung's avatar
      Bluetooth: disable filter dup when scan for adv monitor · c32d6246
      Yun-Hao Chung authored
      Disable duplicates filter when scanning for advertisement monitor for
      the following reasons. The scanning includes active scan and passive
      scan.
      
      For HW pattern filtering (ex. MSFT), Realtek and Qualcomm controllers
      ignore RSSI_Sampling_Period when the duplicates filter is enabled.
      
      For SW pattern filtering, when we're not doing interleaved scanning, it
      is necessary to disable duplicates filter, otherwise hosts can only
      receive one advertisement and it's impossible to know if a peer is still
      in range.
      Signed-off-by: default avatarYun-Hao Chung <howardchung@chromium.org>
      Reviewed-by: default avatarArchie Pusaka <apusaka@chromium.org>
      Reviewed-by: default avatarManish Mandlik <mmandlik@chromium.org>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      c32d6246
    • Sathish Narasimman's avatar
      Bluetooth: Translate additional address type during le_conn_comp · 79699a70
      Sathish Narasimman authored
      When using controller based address resolution, then the destination
      address type during le_conn_complete uses 0x02 & 0x03 if controller
      resolves the destination address(RPA).
      These address types need to be converted back into either 0x00 0r 0x01
      Signed-off-by: default avatarSathish Narasimman <sathish.narasimman@intel.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      79699a70
    • YueHaibing's avatar
      Bluetooth: RFCOMM: Use DEVICE_ATTR_RO macro · c615943e
      YueHaibing authored
      Use DEVICE_ATTR_RO helper instead of plain DEVICE_ATTR,
      which makes the code a bit shorter and easier to read.
      Signed-off-by: default avatarYueHaibing <yuehaibing@huawei.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      c615943e
    • Hilda Wu's avatar
      Bluetooth: btusb: Add support USB ALT 3 for WBS · e848dbd3
      Hilda Wu authored
      Because mSBC frames do not need to be aligned to the SCO packet
      boundary. Using USB ALT 3 let HCI payload >= 60 bytes, let mSBC
      data satisfy 60 Bytes avoid payload unaligned situation and fixed
      some headset no voise issue.
      
      USB Alt 3 supported also need HFP support transparent MTU in 72 Bytes.
      Signed-off-by: default avatarHilda Wu <hildawu@realtek.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      e848dbd3
    • Luiz Augusto von Dentz's avatar
      Bluetooth: L2CAP: Fix invalid access on ECRED Connection response · de895b43
      Luiz Augusto von Dentz authored
      The use of l2cap_chan_del is not safe under a loop using
      list_for_each_entry.
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      de895b43
    • Luiz Augusto von Dentz's avatar
      Bluetooth: L2CAP: Fix invalid access if ECRED Reconfigure fails · 1fa20d7d
      Luiz Augusto von Dentz authored
      The use of l2cap_chan_del is not safe under a loop using
      list_for_each_entry.
      Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      1fa20d7d
    • Szymon Janc's avatar
      Bluetooth: Remove spurious error message · 1c58e933
      Szymon Janc authored
      Even with rate limited reporting this is very spammy and since
      it is remote device that is providing bogus data there is no
      need to report this as error.
      
      Since real_len variable was used only to allow conditional error
      message it is now also removed.
      
      [72454.143336] bt_err_ratelimited: 10 callbacks suppressed
      [72454.143337] Bluetooth: hci0: advertising data len corrected
      [72454.296314] Bluetooth: hci0: advertising data len corrected
      [72454.892329] Bluetooth: hci0: advertising data len corrected
      [72455.051319] Bluetooth: hci0: advertising data len corrected
      [72455.357326] Bluetooth: hci0: advertising data len corrected
      [72455.663295] Bluetooth: hci0: advertising data len corrected
      [72455.787278] Bluetooth: hci0: advertising data len corrected
      [72455.942278] Bluetooth: hci0: advertising data len corrected
      [72456.094276] Bluetooth: hci0: advertising data len corrected
      [72456.249137] Bluetooth: hci0: advertising data len corrected
      [72459.416333] bt_err_ratelimited: 13 callbacks suppressed
      [72459.416334] Bluetooth: hci0: advertising data len corrected
      [72459.721334] Bluetooth: hci0: advertising data len corrected
      [72460.011317] Bluetooth: hci0: advertising data len corrected
      [72460.327171] Bluetooth: hci0: advertising data len corrected
      [72460.638294] Bluetooth: hci0: advertising data len corrected
      [72460.946350] Bluetooth: hci0: advertising data len corrected
      [72461.225320] Bluetooth: hci0: advertising data len corrected
      [72461.690322] Bluetooth: hci0: advertising data len corrected
      [72462.118318] Bluetooth: hci0: advertising data len corrected
      [72462.427319] Bluetooth: hci0: advertising data len corrected
      [72464.546319] bt_err_ratelimited: 7 callbacks suppressed
      [72464.546319] Bluetooth: hci0: advertising data len corrected
      [72464.857318] Bluetooth: hci0: advertising data len corrected
      [72465.163332] Bluetooth: hci0: advertising data len corrected
      [72465.278331] Bluetooth: hci0: advertising data len corrected
      [72465.432323] Bluetooth: hci0: advertising data len corrected
      [72465.891334] Bluetooth: hci0: advertising data len corrected
      [72466.045334] Bluetooth: hci0: advertising data len corrected
      [72466.197321] Bluetooth: hci0: advertising data len corrected
      [72466.340318] Bluetooth: hci0: advertising data len corrected
      [72466.498335] Bluetooth: hci0: advertising data len corrected
      [72469.803299] bt_err_ratelimited: 10 callbacks suppressed
      Signed-off-by: default avatarSzymon Janc <szymon.janc@codecoup.pl>
      Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=203753
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      1c58e933
    • Daniel Lenski's avatar
      Bluetooth: btusb: Add a new QCA_ROME device (0cf3:e500) · 0324d19c
      Daniel Lenski authored
      This patch adds the 0cf3:e500 Bluetooth device (from a QCA9377 board) as a
      QCA_ROME device.  It appears to be functionally identical to another device
      ID, also from a QCA9377 board, which was previously marked as QCA_ROME in
      0a03f98b
      ("Bluetooth: Add a new 04ca:3015 QCA_ROME device").
      
      Without this patch, the WiFi side of the QCA9377 board is slow or unusable
      when the Bluetooth side is in use.
      
      See https://askubuntu.com/a/1137852 for another report of QCA_ROME fixing
      this issue for this device ID.
      
      /sys/kernel/debug/usb/devices:
      
      T:  Bus=05 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=12   MxCh= 0
      D:  Ver= 2.01 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
      P:  Vendor=0cf3 ProdID=e500 Rev= 0.01
      C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
      I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
      E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
      E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
      I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
      I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
      I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
      I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
      I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
      I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
      Signed-off-by: default avatarDaniel Lenski <dlenski@gmail.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      0324d19c
    • Venkata Lakshmi Narayana Gubba's avatar
      dt-bindings: net: bluetooth: Add device tree bindings for QTI chip wcn6750 · 7a4cb163
      Venkata Lakshmi Narayana Gubba authored
      This patch enables regulators and gpios for the Qualcomm Bluetooth wcn6750
      controller.
      Signed-off-by: default avatarVenkata Lakshmi Narayana Gubba <gubbaven@codeaurora.org>
      Reviewed-by: default avatarRob Herring <robh@kernel.org>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      7a4cb163
    • Venkata Lakshmi Narayana Gubba's avatar
      dt-bindings: net: bluetooth: Convert Qualcomm BT binding to DT schema · d88c6de4
      Venkata Lakshmi Narayana Gubba authored
      Converted Qualcomm Bluetooth binidings to DT schema.
      Signed-off-by: default avatarVenkata Lakshmi Narayana Gubba <gubbaven@codeaurora.org>
      Reviewed-by: default avatarRob Herring <robh@kernel.org>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      d88c6de4
    • Venkata Lakshmi Narayana Gubba's avatar
      Bluetooth: btqca: Moved extracting rom version info to common place · 99fba8e3
      Venkata Lakshmi Narayana Gubba authored
      Moved extracting rom version info to common place as this code is
      common in all if else ladder in qca_uart_setup.
      Signed-off-by: default avatarVenkata Lakshmi Narayana Gubba <gubbaven@codeaurora.org>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      99fba8e3
    • Venkata Lakshmi Narayana Gubba's avatar
      Bluetooth: btqca: Add support for firmware image with mbn type for WCN6750 · ecf6b2d9
      Venkata Lakshmi Narayana Gubba authored
      1. Added support to download firmware image with mbn type for wcn6750
         as it supports mbn type image.
      2. If mbn type image is not present then check for tlv type image.
      3. Added debug logs for mbn type image.
      Signed-off-by: default avatarVenkata Lakshmi Narayana Gubba <gubbaven@codeaurora.org>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      ecf6b2d9
    • Venkata Lakshmi Narayana Gubba's avatar
      Bluetooth: hci_qca: Add support for QTI Bluetooth chip wcn6750 · d8f97da1
      Venkata Lakshmi Narayana Gubba authored
      Added regulators,GPIOs and changes required to power on/off wcn6750.
      Added support for firmware download for wcn6750.
      
      Changes done in detail:
      1. Added regulators and corresponding current values.
      2. Added sw_ctrl GPIO pin which is output from BT SoC and indicates
         status of clock supply to BT SoC.
      3. Added inline function to check if the SoC type is wcn6750.
      4. Modified the function qca_wcn3990_init() to support wcn6750 and
         renamed it to qca_regulator_init().
      Signed-off-by: default avatarVenkata Lakshmi Narayana Gubba <gubbaven@codeaurora.org>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      d8f97da1
    • Kai-Heng Feng's avatar
      Bluetooth: Shutdown controller after workqueues are flushed or cancelled · 0ea9fd00
      Kai-Heng Feng authored
      Rfkill block and unblock Intel USB Bluetooth [8087:0026] may make it
      stops working:
      [  509.691509] Bluetooth: hci0: HCI reset during shutdown failed
      [  514.897584] Bluetooth: hci0: MSFT filter_enable is already on
      [  530.044751] usb 3-10: reset full-speed USB device number 5 using xhci_hcd
      [  545.660350] usb 3-10: device descriptor read/64, error -110
      [  561.283530] usb 3-10: device descriptor read/64, error -110
      [  561.519682] usb 3-10: reset full-speed USB device number 5 using xhci_hcd
      [  566.686650] Bluetooth: hci0: unexpected event for opcode 0x0500
      [  568.752452] Bluetooth: hci0: urb 0000000096cd309b failed to resubmit (113)
      [  578.797955] Bluetooth: hci0: Failed to read MSFT supported features (-110)
      [  586.286565] Bluetooth: hci0: urb 00000000c522f633 failed to resubmit (113)
      [  596.215302] Bluetooth: hci0: Failed to read MSFT supported features (-110)
      
      Or kernel panics because other workqueues already freed skb:
      [ 2048.663763] BUG: kernel NULL pointer dereference, address: 0000000000000000
      [ 2048.663775] #PF: supervisor read access in kernel mode
      [ 2048.663779] #PF: error_code(0x0000) - not-present page
      [ 2048.663782] PGD 0 P4D 0
      [ 2048.663787] Oops: 0000 [#1] SMP NOPTI
      [ 2048.663793] CPU: 3 PID: 4491 Comm: rfkill Tainted: G        W         5.13.0-rc1-next-20210510+ #20
      [ 2048.663799] Hardware name: HP HP EliteBook 850 G8 Notebook PC/8846, BIOS T76 Ver. 01.01.04 12/02/2020
      [ 2048.663801] RIP: 0010:__skb_ext_put+0x6/0x50
      [ 2048.663814] Code: 8b 1b 48 85 db 75 db 5b 41 5c 5d c3 be 01 00 00 00 e8 de 13 c0 ff eb e7 be 02 00 00 00 e8 d2 13 c0 ff eb db 0f 1f 44 00 00 55 <8b> 07 48 89 e5 83 f8 01 74 14 b8 ff ff ff ff f0 0f c1
      07 83 f8 01
      [ 2048.663819] RSP: 0018:ffffc1d105b6fd80 EFLAGS: 00010286
      [ 2048.663824] RAX: 0000000000000000 RBX: ffff9d9ac5649000 RCX: 0000000000000000
      [ 2048.663827] RDX: ffffffffc0d1daf6 RSI: 0000000000000206 RDI: 0000000000000000
      [ 2048.663830] RBP: ffffc1d105b6fd98 R08: 0000000000000001 R09: ffff9d9ace8ceac0
      [ 2048.663834] R10: ffff9d9ace8ceac0 R11: 0000000000000001 R12: ffff9d9ac5649000
      [ 2048.663838] R13: 0000000000000000 R14: 00007ffe0354d650 R15: 0000000000000000
      [ 2048.663843] FS:  00007fe02ab19740(0000) GS:ffff9d9e5f8c0000(0000) knlGS:0000000000000000
      [ 2048.663849] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [ 2048.663853] CR2: 0000000000000000 CR3: 0000000111a52004 CR4: 0000000000770ee0
      [ 2048.663856] PKRU: 55555554
      [ 2048.663859] Call Trace:
      [ 2048.663865]  ? skb_release_head_state+0x5e/0x80
      [ 2048.663873]  kfree_skb+0x2f/0xb0
      [ 2048.663881]  btusb_shutdown_intel_new+0x36/0x60 [btusb]
      [ 2048.663905]  hci_dev_do_close+0x48c/0x5e0 [bluetooth]
      [ 2048.663954]  ? __cond_resched+0x1a/0x50
      [ 2048.663962]  hci_rfkill_set_block+0x56/0xa0 [bluetooth]
      [ 2048.664007]  rfkill_set_block+0x98/0x170
      [ 2048.664016]  rfkill_fop_write+0x136/0x1e0
      [ 2048.664022]  vfs_write+0xc7/0x260
      [ 2048.664030]  ksys_write+0xb1/0xe0
      [ 2048.664035]  ? exit_to_user_mode_prepare+0x37/0x1c0
      [ 2048.664042]  __x64_sys_write+0x1a/0x20
      [ 2048.664048]  do_syscall_64+0x40/0xb0
      [ 2048.664055]  entry_SYSCALL_64_after_hwframe+0x44/0xae
      [ 2048.664060] RIP: 0033:0x7fe02ac23c27
      [ 2048.664066] Code: 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24
      [ 2048.664070] RSP: 002b:00007ffe0354d638 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
      [ 2048.664075] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fe02ac23c27
      [ 2048.664078] RDX: 0000000000000008 RSI: 00007ffe0354d650 RDI: 0000000000000003
      [ 2048.664081] RBP: 0000000000000000 R08: 0000559b05998440 R09: 0000559b05998440
      [ 2048.664084] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
      [ 2048.664086] R13: 0000000000000000 R14: ffffffff00000000 R15: 00000000ffffffff
      
      So move the shutdown callback to a place where workqueues are either
      flushed or cancelled to resolve the issue.
      Signed-off-by: default avatarKai-Heng Feng <kai.heng.feng@canonical.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      0ea9fd00
    • Mikhail Rudenko's avatar
      Bluetooth: btbcm: Add entry for BCM43430B0 UART Bluetooth · 27f4d1f2
      Mikhail Rudenko authored
      This patch adds the device ID for the BCM43430B0 module, found e.g. in
      certain revisions of AMPAK AP6212 chip. The required firmware file is
      named 'BCM43430B0.hcd'.
      Signed-off-by: default avatarMikhail Rudenko <mike.rudenko@gmail.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      27f4d1f2
    • Connor Abbott's avatar
      Bluetooth: btqca: Don't modify firmware contents in-place · b43ca511
      Connor Abbott authored
      struct firmware::data is marked const, and when the firmware is
      compressed with xz (default at least with Fedora) it's mapped read-only
      which results in a crash:
      
      BUG: unable to handle page fault for address: ffffae57c0ca5047
      PGD 100000067 P4D 100000067 PUD 1001ce067 PMD 10165a067 PTE 8000000112bba161
      Oops: 0003 [#1] SMP NOPTI
      CPU: 3 PID: 204 Comm: kworker/u17:0 Not tainted 5.12.1-test+ #1
      Hardware name: Dell Inc. XPS 13 9310/0F7M4C, BIOS 1.2.5 12/10/2020
      Workqueue: hci0 hci_power_on [bluetooth]
      RIP: 0010:qca_download_firmware+0x27c/0x4e0 [btqca]
      Code: 1b 75 04 80 48 0c 01 0f b7 c6 8d 54 02 0c 41 39 d7 0f 8e 62 fe ff ff 48 63 c2 4c 01 e8 0f b7 38 0f b7 70 02 66 83 ff 11 75 d3 <80> 48 0c 80 41 83 fc 03 7e 6e 88 58 0d eb ce 41 0f b6 45 0e 48 8b
      RSP: 0018:ffffae57c08dfc68 EFLAGS: 00010246
      RAX: ffffae57c0ca503b RBX: 000000000000000e RCX: 0000000000000000
      RDX: 0000000000000037 RSI: 0000000000000006 RDI: 0000000000000011
      RBP: ffff978d9949e000 R08: ffff978d84ed7540 R09: ffffae57c0ca5000
      R10: 000000000010cd00 R11: 0000000000000001 R12: 0000000000000005
      R13: ffffae57c0ca5004 R14: ffff978d98ca8680 R15: 00000000000016a9
      FS:  0000000000000000(0000) GS:ffff9794ef6c0000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: ffffae57c0ca5047 CR3: 0000000113d5a004 CR4: 0000000000770ee0
      PKRU: 55555554
      Call Trace:
       qca_uart_setup+0x2cb/0x1390 [btqca]
       ? qca_read_soc_version+0x136/0x220 [btqca]
       qca_setup+0x288/0xab0 [hci_uart]
       hci_dev_do_open+0x1f3/0x780 [bluetooth]
       ? try_to_wake_up+0x1c1/0x4f0
       hci_power_on+0x3f/0x200 [bluetooth]
       process_one_work+0x1ec/0x380
       worker_thread+0x53/0x3e0
       ? process_one_work+0x380/0x380
       kthread+0x11b/0x140
       ? kthread_associate_blkcg+0xa0/0xa0
       ret_from_fork+0x1f/0x30
      Modules linked in: llc ip_set nf_tables nfnetlink snd_soc_skl_hda_dsp(+) ip6table_filter snd_soc_hdac_hdmi ip6_tables qrtr_mhi iptable_filter snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic s>
       dell_wmi_sysman(+) dell_smbios snd dcdbas mhi vfat videobuf2_vmalloc i2c_i801 videobuf2_memops videobuf2_v4l2 dell_wmi_descriptor fat wmi_bmof soundcore i2c_smbus videobuf2_common libarc4 mei_me mei hid_se>
       i2c_hid_acpi i2c_hid video pinctrl_tigerlake fuse
      CR2: ffffae57c0ca5047
      
      This also seems to fix a failure to suspend due to the firmware
      download on bootup getting interrupted by the crash:
      
      Bluetooth: hci0: SSR or FW download time out
      PM: dpm_run_callback(): acpi_subsys_suspend+0x0/0x60 returns -110
      PM: Device serial0-0 failed to suspend: error -110
      PM: Some devices failed to suspend, or early wake event detected
      
      Fixes: 83e81961 ("Bluetooth: btqca: Introduce generic QCA ROME support")
      Cc: Venkata Lakshmi Narayana Gubba <gubbaven@codeaurora.org>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarConnor Abbott <cwabbott0@gmail.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      b43ca511
    • Kiran K's avatar
      Bluetooth: Fix alt settings for incoming SCO with transparent coding format · 06d213d8
      Kiran K authored
      For incoming SCO connection with transparent coding format, alt setting
      of CVSD is getting applied instead of Transparent.
      
      Before fix:
      < HCI Command: Accept Synchron.. (0x01|0x0029) plen 21  #2196 [hci0] 321.342548
              Address: 1C:CC:D6:E2:EA:80 (Xiaomi Communications Co Ltd)
              Transmit bandwidth: 8000
              Receive bandwidth: 8000
              Max latency: 13
              Setting: 0x0003
                Input Coding: Linear
                Input Data Format: 1's complement
                Input Sample Size: 8-bit
                # of bits padding at MSB: 0
                Air Coding Format: Transparent Data
              Retransmission effort: Optimize for link quality (0x02)
              Packet type: 0x003f
                HV1 may be used
                HV2 may be used
                HV3 may be used
                EV3 may be used
                EV4 may be used
                EV5 may be used
      > HCI Event: Command Status (0x0f) plen 4               #2197 [hci0] 321.343585
            Accept Synchronous Connection Request (0x01|0x0029) ncmd 1
              Status: Success (0x00)
      > HCI Event: Synchronous Connect Comp.. (0x2c) plen 17  #2198 [hci0] 321.351666
              Status: Success (0x00)
              Handle: 257
              Address: 1C:CC:D6:E2:EA:80 (Xiaomi Communications Co Ltd)
              Link type: eSCO (0x02)
              Transmission interval: 0x0c
              Retransmission window: 0x04
              RX packet length: 60
              TX packet length: 60
              Air mode: Transparent (0x03)
      ........
      > SCO Data RX: Handle 257 flags 0x00 dlen 48            #2336 [hci0] 321.383655
      < SCO Data TX: Handle 257 flags 0x00 dlen 60            #2337 [hci0] 321.389558
      > SCO Data RX: Handle 257 flags 0x00 dlen 48            #2338 [hci0] 321.393615
      > SCO Data RX: Handle 257 flags 0x00 dlen 48            #2339 [hci0] 321.393618
      > SCO Data RX: Handle 257 flags 0x00 dlen 48            #2340 [hci0] 321.393618
      < SCO Data TX: Handle 257 flags 0x00 dlen 60            #2341 [hci0] 321.397070
      > SCO Data RX: Handle 257 flags 0x00 dlen 48            #2342 [hci0] 321.403622
      > SCO Data RX: Handle 257 flags 0x00 dlen 48            #2343 [hci0] 321.403625
      > SCO Data RX: Handle 257 flags 0x00 dlen 48            #2344 [hci0] 321.403625
      > SCO Data RX: Handle 257 flags 0x00 dlen 48            #2345 [hci0] 321.403625
      < SCO Data TX: Handle 257 flags 0x00 dlen 60            #2346 [hci0] 321.404569
      < SCO Data TX: Handle 257 flags 0x00 dlen 60            #2347 [hci0] 321.412091
      > SCO Data RX: Handle 257 flags 0x00 dlen 48            #2348 [hci0] 321.413626
      > SCO Data RX: Handle 257 flags 0x00 dlen 48            #2349 [hci0] 321.413630
      > SCO Data RX: Handle 257 flags 0x00 dlen 48            #2350 [hci0] 321.413630
      < SCO Data TX: Handle 257 flags 0x00 dlen 60            #2351 [hci0] 321.419674
      
      After fix:
      
      < HCI Command: Accept Synchronou.. (0x01|0x0029) plen 21  #309 [hci0] 49.439693
              Address: 1C:CC:D6:E2:EA:80 (Xiaomi Communications Co Ltd)
              Transmit bandwidth: 8000
              Receive bandwidth: 8000
              Max latency: 13
              Setting: 0x0003
                Input Coding: Linear
                Input Data Format: 1's complement
                Input Sample Size: 8-bit
                # of bits padding at MSB: 0
                Air Coding Format: Transparent Data
              Retransmission effort: Optimize for link quality (0x02)
              Packet type: 0x003f
                HV1 may be used
                HV2 may be used
                HV3 may be used
                EV3 may be used
                EV4 may be used
                EV5 may be used
      > HCI Event: Command Status (0x0f) plen 4                 #310 [hci0] 49.440308
            Accept Synchronous Connection Request (0x01|0x0029) ncmd 1
              Status: Success (0x00)
      > HCI Event: Synchronous Connect Complete (0x2c) plen 17  #311 [hci0] 49.449308
              Status: Success (0x00)
              Handle: 257
              Address: 1C:CC:D6:E2:EA:80 (Xiaomi Communications Co Ltd)
              Link type: eSCO (0x02)
              Transmission interval: 0x0c
              Retransmission window: 0x04
              RX packet length: 60
              TX packet length: 60
              Air mode: Transparent (0x03)
      < SCO Data TX: Handle 257 flags 0x00 dlen 60              #312 [hci0] 49.450421
      < SCO Data TX: Handle 257 flags 0x00 dlen 60              #313 [hci0] 49.457927
      > HCI Event: Max Slots Change (0x1b) plen 3               #314 [hci0] 49.460345
              Handle: 256
              Max slots: 5
      < SCO Data TX: Handle 257 flags 0x00 dlen 60              #315 [hci0] 49.465453
      > SCO Data RX: Handle 257 flags 0x00 dlen 60              #316 [hci0] 49.470502
      > SCO Data RX: Handle 257 flags 0x00 dlen 60              #317 [hci0] 49.470519
      < SCO Data TX: Handle 257 flags 0x00 dlen 60              #318 [hci0] 49.472996
      > SCO Data RX: Handle 257 flags 0x00 dlen 60              #319 [hci0] 49.480412
      < SCO Data TX: Handle 257 flags 0x00 dlen 60              #320 [hci0] 49.480492
      < SCO Data TX: Handle 257 flags 0x00 dlen 60              #321 [hci0] 49.487989
      > SCO Data RX: Handle 257 flags 0x00 dlen 60              #322 [hci0] 49.490303
      < SCO Data TX: Handle 257 flags 0x00 dlen 60              #323 [hci0] 49.495496
      > SCO Data RX: Handle 257 flags 0x00 dlen 60              #324 [hci0] 49.500304
      > SCO Data RX: Handle 257 flags 0x00 dlen 60              #325 [hci0] 49.500311
      Signed-off-by: default avatarKiran K <kiran.k@intel.com>
      Signed-off-by: default avatarLokendra Singh <lokendra.singh@intel.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      06d213d8
    • Jiapeng Chong's avatar
      Bluetooth: 6lowpan: remove unused function · b0e56db7
      Jiapeng Chong authored
      Fix the following clang warning:
      
      net/bluetooth/6lowpan.c:913:20: warning: unused function 'bdaddr_type'
      [-Wunused-function].
      
      net/bluetooth/6lowpan.c:106:35: warning: unused function
      'peer_lookup_ba' [-Wunused-function].
      Reported-by: default avatarAbaci Robot <abaci@linux.alibaba.com>
      Signed-off-by: default avatarJiapeng Chong <jiapeng.chong@linux.alibaba.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      b0e56db7
    • Manish Mandlik's avatar
      Bluetooth: Add ncmd=0 recovery handling · de75cd0d
      Manish Mandlik authored
      During command status or command complete event, the controller may set
      ncmd=0 indicating that it is not accepting any more commands. In such a
      case, host holds off sending any more commands to the controller. If the
      controller doesn't recover from such condition, host will wait forever,
      until the user decides that the Bluetooth is broken and may power cycles
      the Bluetooth.
      
      This patch triggers the hardware error to reset the controller and
      driver when it gets into such state as there is no other wat out.
      Reviewed-by: default avatarAbhishek Pandit-Subedi <abhishekpandit@chromium.org>
      Signed-off-by: default avatarManish Mandlik <mmandlik@google.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      de75cd0d
    • Pavel Skripkin's avatar
      Bluetooth: hci_qca: fix potential GPF · 59f90f13
      Pavel Skripkin authored
      In qca_power_shutdown() qcadev local variable is
      initialized by hu->serdev.dev private data, but
      hu->serdev can be NULL and there is a check for it.
      
      Since, qcadev is not used before
      
      	if (!hu->serdev)
      		return;
      
      we can move its initialization after this "if" to
      prevent GPF.
      
      Fixes: 5559904c ("Bluetooth: hci_qca: Add QCA Rome power off support to the qca_power_shutdown()")
      Cc: stable@vger.kernel.org # v5.6+
      Cc: Rocky Liao <rjliao@codeaurora.org>
      Signed-off-by: default avatarPavel Skripkin <paskripkin@gmail.com>
      Reviewed-by: default avatarJohan Hovold <johan@kernel.org>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      59f90f13
    • Yu Liu's avatar
      Bluetooth: Fix the HCI to MGMT status conversion table · 4ef36a52
      Yu Liu authored
      0x2B, 0x31 and 0x33 are reserved for future use but were not present in
      the HCI to MGMT conversion table, this caused the conversion to be
      incorrect for the HCI status code greater than 0x2A.
      Reviewed-by: default avatarMiao-chen Chou <mcchou@chromium.org>
      Signed-off-by: default avatarYu Liu <yudiliu@google.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      4ef36a52
    • Thadeu Lima de Souza Cascardo's avatar
      Bluetooth: cmtp: fix file refcount when cmtp_attach_device fails · 3cfdf8fc
      Thadeu Lima de Souza Cascardo authored
      When cmtp_attach_device fails, cmtp_add_connection returns the error value
      which leads to the caller to doing fput through sockfd_put. But
      cmtp_session kthread, which is stopped in this path will also call fput,
      leading to a potential refcount underflow or a use-after-free.
      
      Add a refcount before we signal the kthread to stop. The kthread will try
      to grab the cmtp_session_sem mutex before doing the fput, which is held
      when get_file is called, so there should be no races there.
      
      Reported-by: Ryota Shiga
      Signed-off-by: default avatarThadeu Lima de Souza Cascardo <cascardo@canonical.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      3cfdf8fc
    • Muhammad Usama Anjum's avatar
      Bluetooth: btusb: fix memory leak · 44e936d7
      Muhammad Usama Anjum authored
      If btusb_mtk_submit_wmt_recv_urb returns error, wc should be freed and
      then error should be returned to prevent memory leak.
      
      Addresses-Coverity: ("Prevent memory leak")
      Fixes: 4cbb375e997d ("Bluetooth: btusb: Fixed too many in-token issue for Mediatek Chip.")
      Signed-off-by: default avatarMuhammad Usama Anjum <musamaanjum@gmail.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      44e936d7
    • mark-yw.chen's avatar
      Bluetooth: btusb: Add support for Lite-On Mediatek Chip · 393dc5d1
      mark-yw.chen authored
      Add support for Lite-On Mediatek Chip (MT7921)
      Lite On VID = 04CA.
      
      * /sys/kernel/debug/usb/devices
      T:  Bus=01 Lev=03 Prnt=04 Port=01 Cnt=02 Dev#=  8 Spd=480  MxCh= 0
      D:  Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
      P:  Vendor=04ca ProdID=3802 Rev= 1.00
      S:  Manufacturer=MediaTek Inc.
      S:  Product=Wireless_Device
      S:  SerialNumber=000000000
      C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA
      A:  FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01
      I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=125us
      E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
      I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
      I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
      I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
      I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
      I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
      I:  If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  63 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  63 Ivl=1ms
      I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
      E:  Ad=8a(I) Atr=03(Int.) MxPS=  64 Ivl=125us
      E:  Ad=0a(O) Atr=03(Int.) MxPS=  64 Ivl=125us
      I:  If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
      E:  Ad=8a(I) Atr=03(Int.) MxPS=  64 Ivl=125us
      E:  Ad=0a(O) Atr=03(Int.) MxPS=  64 Ivl=125us
      Signed-off-by: default avatarmark-yw.chen <mark-yw.chen@mediatek.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      393dc5d1
    • mark-yw.chen's avatar
      Bluetooth: btusb: Fixed too many in-token issue for Mediatek Chip. · 8454ed9f
      mark-yw.chen authored
      This patch reduce in-token during download patch procedure.
      Don't submit urb for polling event before sending hci command.
      Signed-off-by: default avatarmark-yw.chen <mark-yw.chen@mediatek.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      8454ed9f
    • Colin Ian King's avatar
      Bluetooth: virtio_bt: add missing null pointer check on alloc_skb call return · 1cb027f2
      Colin Ian King authored
      The call to alloc_skb with the GFP_KERNEL flag can return a null sk_buff
      pointer, so add a null check to avoid any null pointer deference issues.
      
      Addresses-Coverity: ("Dereference null return value")
      Fixes: afd2daa2 ("Bluetooth: Add support for virtio transport driver")
      Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      1cb027f2
    • Yu Liu's avatar
      Bluetooth: Return whether a connection is outbound · 1c6ed31b
      Yu Liu authored
      When an MGMT_EV_DEVICE_CONNECTED event is reported back to the user
      space we will set the flags to tell if the established connection is
      outbound or not. This is useful for the user space to log better metrics
      and error messages.
      Reviewed-by: default avatarMiao-chen Chou <mcchou@chromium.org>
      Reviewed-by: default avatarAlain Michaud <alainm@chromium.org>
      Signed-off-by: default avatarYu Liu <yudiliu@google.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      1c6ed31b
    • Qiheng Lin's avatar
      Bluetooth: use flexible-array member instead of zero-length array · 07d85dbe
      Qiheng Lin authored
      Fix the following coccicheck warning:
      
      net/bluetooth/msft.c:37:6-13: WARNING use flexible-array member instead
      net/bluetooth/msft.c:42:6-10: WARNING use flexible-array member instead
      net/bluetooth/msft.c:52:6-10: WARNING use flexible-array member instead
      Signed-off-by: default avatarQiheng Lin <linqiheng@huawei.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      07d85dbe
    • Kai Ye's avatar
      Bluetooth: 6lowpan: delete unneeded variable initialization · c469c9c9
      Kai Ye authored
      Delete unneeded variable initialization.
      Signed-off-by: default avatarKai Ye <yekai13@huawei.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      c469c9c9
  2. 25 Jun, 2021 7 commits