Skip to content

Commit 9f3248c

Browse files
kuba-mookuba-moo
committed
Merge tag 'for-net-next-2022-01-07' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next
Luiz Augusto von Dentz says: ==================== bluetooth-next pull request for net-next: - Add support for Foxconn QCA 0xe0d0 - Fix HCI init sequence on MacBook Air 8,1 and 8,2 - Fix Intel firmware loading on legacy ROM devices * tag 'for-net-next-2022-01-07' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next: Bluetooth: hci_sock: fix endian bug in hci_sock_setsockopt() Bluetooth: L2CAP: uninitialized variables in l2cap_sock_setsockopt() Bluetooth: btqca: sequential validation Bluetooth: btusb: Add support for Foxconn QCA 0xe0d0 Bluetooth: btintel: Fix broken LED quirk for legacy ROM devices Bluetooth: hci_event: Rework hci_inquiry_result_with_rssi_evt Bluetooth: btbcm: disable read tx power for MacBook Air 8,1 and 8,2 Bluetooth: hci_qca: Fix NULL vs IS_ERR_OR_NULL check in qca_serdev_probe Bluetooth: hci_bcm: Check for error irq ==================== Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Jakub Kicinski <[email protected]>
2 parents d5c8725 + b9f9dba commit 9f3248c

File tree

12 files changed

+116
-40
lines changed

12 files changed

+116
-40
lines changed

‎drivers/bluetooth/btbcm.c

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -363,6 +363,18 @@ static const struct dmi_system_id disable_broken_read_transmit_power[] = {
363363
DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,4"),
364364
},
365365
},
366+
{
367+
.matches = {
368+
DMI_MATCH(DMI_BOARD_VENDOR, "Apple Inc."),
369+
DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir8,1"),
370+
},
371+
},
372+
{
373+
.matches = {
374+
DMI_MATCH(DMI_BOARD_VENDOR, "Apple Inc."),
375+
DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir8,2"),
376+
},
377+
},
366378
{
367379
.matches = {
368380
DMI_MATCH(DMI_BOARD_VENDOR, "Apple Inc."),

‎drivers/bluetooth/btintel.c

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2355,8 +2355,15 @@ static int btintel_setup_combined(struct hci_dev *hdev)
23552355
* As a workaround, send HCI Reset command first which will reset the
23562356
* number of completed commands and allow normal command processing
23572357
* from now on.
2358+
*
2359+
* Regarding the INTEL_BROKEN_SHUTDOWN_LED flag, these devices maybe
2360+
* in the SW_RFKILL ON state as a workaround of fixing LED issue during
2361+
* the shutdown() procedure, and once the device is in SW_RFKILL ON
2362+
* state, the only way to exit out of it is sending the HCI_Reset
2363+
* command.
23582364
*/
2359-
if (btintel_test_flag(hdev, INTEL_BROKEN_INITIAL_NCMD)) {
2365+
if (btintel_test_flag(hdev, INTEL_BROKEN_INITIAL_NCMD) ||
2366+
btintel_test_flag(hdev, INTEL_BROKEN_SHUTDOWN_LED)) {
23602367
skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL,
23612368
HCI_INIT_TIMEOUT);
23622369
if (IS_ERR(skb)) {
@@ -2428,12 +2435,6 @@ static int btintel_setup_combined(struct hci_dev *hdev)
24282435
set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
24292436
&hdev->quirks);
24302437

2431-
/* These devices have an issue with LED which doesn't
2432-
* go off immediately during shutdown. Set the flag
2433-
* here to send the LED OFF command during shutdown.
2434-
*/
2435-
btintel_set_flag(hdev, INTEL_BROKEN_LED);
2436-
24372438
err = btintel_legacy_rom_setup(hdev, &ver);
24382439
break;
24392440
case 0x0b: /* SfP */
@@ -2586,9 +2587,10 @@ static int btintel_shutdown_combined(struct hci_dev *hdev)
25862587

25872588
/* Some platforms have an issue with BT LED when the interface is
25882589
* down or BT radio is turned off, which takes 5 seconds to BT LED
2589-
* goes off. This command turns off the BT LED immediately.
2590+
* goes off. As a workaround, sends HCI_Intel_SW_RFKILL to put the
2591+
* device in the RFKILL ON state which turns off the BT LED immediately.
25902592
*/
2591-
if (btintel_test_flag(hdev, INTEL_BROKEN_LED)) {
2593+
if (btintel_test_flag(hdev, INTEL_BROKEN_SHUTDOWN_LED)) {
25922594
skb = __hci_cmd_sync(hdev, 0xfc3f, 0, NULL, HCI_INIT_TIMEOUT);
25932595
if (IS_ERR(skb)) {
25942596
ret = PTR_ERR(skb);

‎drivers/bluetooth/btintel.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -150,7 +150,7 @@ enum {
150150
INTEL_FIRMWARE_FAILED,
151151
INTEL_BOOTING,
152152
INTEL_BROKEN_INITIAL_NCMD,
153-
INTEL_BROKEN_LED,
153+
INTEL_BROKEN_SHUTDOWN_LED,
154154
INTEL_ROM_LEGACY,
155155

156156
__INTEL_NUM_FLAGS,

‎drivers/bluetooth/btqca.c

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,50 @@ static int qca_read_fw_build_info(struct hci_dev *hdev)
142142
return err;
143143
}
144144

145+
static int qca_send_patch_config_cmd(struct hci_dev *hdev)
146+
{
147+
const u8 cmd[] = { EDL_PATCH_CONFIG_CMD, 0x01, 0, 0, 0 };
148+
struct sk_buff *skb;
149+
struct edl_event_hdr *edl;
150+
int err;
151+
152+
bt_dev_dbg(hdev, "QCA Patch config");
153+
154+
skb = __hci_cmd_sync_ev(hdev, EDL_PATCH_CMD_OPCODE, sizeof(cmd),
155+
cmd, HCI_EV_VENDOR, HCI_INIT_TIMEOUT);
156+
if (IS_ERR(skb)) {
157+
err = PTR_ERR(skb);
158+
bt_dev_err(hdev, "Sending QCA Patch config failed (%d)", err);
159+
return err;
160+
}
161+
162+
if (skb->len != 2) {
163+
bt_dev_err(hdev, "QCA Patch config cmd size mismatch len %d", skb->len);
164+
err = -EILSEQ;
165+
goto out;
166+
}
167+
168+
edl = (struct edl_event_hdr *)(skb->data);
169+
if (!edl) {
170+
bt_dev_err(hdev, "QCA Patch config with no header");
171+
err = -EILSEQ;
172+
goto out;
173+
}
174+
175+
if (edl->cresp != EDL_PATCH_CONFIG_RES_EVT || edl->rtype != EDL_PATCH_CONFIG_CMD) {
176+
bt_dev_err(hdev, "QCA Wrong packet received %d %d", edl->cresp,
177+
edl->rtype);
178+
err = -EIO;
179+
goto out;
180+
}
181+
182+
err = 0;
183+
184+
out:
185+
kfree_skb(skb);
186+
return err;
187+
}
188+
145189
static int qca_send_reset(struct hci_dev *hdev)
146190
{
147191
struct sk_buff *skb;
@@ -552,6 +596,9 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,
552596
*/
553597
rom_ver = ((soc_ver & 0x00000f00) >> 0x04) | (soc_ver & 0x0000000f);
554598

599+
if (soc_type == QCA_WCN6750)
600+
qca_send_patch_config_cmd(hdev);
601+
555602
/* Download rampatch file */
556603
config.type = TLV_TYPE_PATCH;
557604
if (qca_is_wcn399x(soc_type)) {

‎drivers/bluetooth/btqca.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313
#define EDL_PATCH_TLV_REQ_CMD (0x1E)
1414
#define EDL_GET_BUILD_INFO_CMD (0x20)
1515
#define EDL_NVM_ACCESS_SET_REQ_CMD (0x01)
16+
#define EDL_PATCH_CONFIG_CMD (0x28)
1617
#define MAX_SIZE_PER_TLV_SEGMENT (243)
1718
#define QCA_PRE_SHUTDOWN_CMD (0xFC08)
1819
#define QCA_DISABLE_LOGGING (0xFC17)
@@ -24,6 +25,7 @@
2425
#define EDL_CMD_EXE_STATUS_EVT (0x00)
2526
#define EDL_SET_BAUDRATE_RSP_EVT (0x92)
2627
#define EDL_NVM_ACCESS_CODE_EVT (0x0B)
28+
#define EDL_PATCH_CONFIG_RES_EVT (0x00)
2729
#define QCA_DISABLE_LOGGING_SUB_OP (0x14)
2830

2931
#define EDL_TAG_ID_HCI (17)

‎drivers/bluetooth/btusb.c

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,7 @@ static struct usb_driver btusb_driver;
6060
#define BTUSB_WIDEBAND_SPEECH 0x400000
6161
#define BTUSB_VALID_LE_STATES 0x800000
6262
#define BTUSB_QCA_WCN6855 0x1000000
63+
#define BTUSB_INTEL_BROKEN_SHUTDOWN_LED 0x2000000
6364
#define BTUSB_INTEL_BROKEN_INITIAL_NCMD 0x4000000
6465

6566
static const struct usb_device_id btusb_table[] = {
@@ -311,6 +312,9 @@ static const struct usb_device_id blacklist_table[] = {
311312
{ USB_DEVICE(0x10ab, 0x9409), .driver_info = BTUSB_QCA_WCN6855 |
312313
BTUSB_WIDEBAND_SPEECH |
313314
BTUSB_VALID_LE_STATES },
315+
{ USB_DEVICE(0x0489, 0xe0d0), .driver_info = BTUSB_QCA_WCN6855 |
316+
BTUSB_WIDEBAND_SPEECH |
317+
BTUSB_VALID_LE_STATES },
314318

315319
/* Broadcom BCM2035 */
316320
{ USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },
@@ -381,10 +385,13 @@ static const struct usb_device_id blacklist_table[] = {
381385
{ USB_DEVICE(0x8087, 0x0033), .driver_info = BTUSB_INTEL_COMBINED },
382386
{ USB_DEVICE(0x8087, 0x07da), .driver_info = BTUSB_CSR },
383387
{ USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL_COMBINED |
384-
BTUSB_INTEL_BROKEN_INITIAL_NCMD },
385-
{ USB_DEVICE(0x8087, 0x0a2a), .driver_info = BTUSB_INTEL_COMBINED },
388+
BTUSB_INTEL_BROKEN_INITIAL_NCMD |
389+
BTUSB_INTEL_BROKEN_SHUTDOWN_LED },
390+
{ USB_DEVICE(0x8087, 0x0a2a), .driver_info = BTUSB_INTEL_COMBINED |
391+
BTUSB_INTEL_BROKEN_SHUTDOWN_LED },
386392
{ USB_DEVICE(0x8087, 0x0a2b), .driver_info = BTUSB_INTEL_COMBINED },
387-
{ USB_DEVICE(0x8087, 0x0aa7), .driver_info = BTUSB_INTEL_COMBINED },
393+
{ USB_DEVICE(0x8087, 0x0aa7), .driver_info = BTUSB_INTEL_COMBINED |
394+
BTUSB_INTEL_BROKEN_SHUTDOWN_LED },
388395
{ USB_DEVICE(0x8087, 0x0aaa), .driver_info = BTUSB_INTEL_COMBINED },
389396

390397
/* Other Intel Bluetooth devices */
@@ -3732,6 +3739,9 @@ static int btusb_probe(struct usb_interface *intf,
37323739

37333740
if (id->driver_info & BTUSB_INTEL_BROKEN_INITIAL_NCMD)
37343741
btintel_set_flag(hdev, INTEL_BROKEN_INITIAL_NCMD);
3742+
3743+
if (id->driver_info & BTUSB_INTEL_BROKEN_SHUTDOWN_LED)
3744+
btintel_set_flag(hdev, INTEL_BROKEN_SHUTDOWN_LED);
37353745
}
37363746

37373747
if (id->driver_info & BTUSB_MARVELL)

‎drivers/bluetooth/hci_bcm.c

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1188,7 +1188,12 @@ static int bcm_probe(struct platform_device *pdev)
11881188
return -ENOMEM;
11891189

11901190
dev->dev = &pdev->dev;
1191-
dev->irq = platform_get_irq(pdev, 0);
1191+
1192+
ret = platform_get_irq(pdev, 0);
1193+
if (ret < 0)
1194+
return ret;
1195+
1196+
dev->irq = ret;
11921197

11931198
/* Initialize routing field to an unused value */
11941199
dev->pcm_int_params[0] = 0xff;

‎drivers/bluetooth/hci_qca.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2059,14 +2059,14 @@ static int qca_serdev_probe(struct serdev_device *serdev)
20592059

20602060
qcadev->bt_en = devm_gpiod_get_optional(&serdev->dev, "enable",
20612061
GPIOD_OUT_LOW);
2062-
if (!qcadev->bt_en && data->soc_type == QCA_WCN6750) {
2062+
if (IS_ERR_OR_NULL(qcadev->bt_en) && data->soc_type == QCA_WCN6750) {
20632063
dev_err(&serdev->dev, "failed to acquire BT_EN gpio\n");
20642064
power_ctrl_enabled = false;
20652065
}
20662066

20672067
qcadev->sw_ctrl = devm_gpiod_get_optional(&serdev->dev, "swctrl",
20682068
GPIOD_IN);
2069-
if (!qcadev->sw_ctrl && data->soc_type == QCA_WCN6750)
2069+
if (IS_ERR_OR_NULL(qcadev->sw_ctrl) && data->soc_type == QCA_WCN6750)
20702070
dev_warn(&serdev->dev, "failed to acquire SW_CTRL gpio\n");
20712071

20722072
qcadev->susclk = devm_clk_get_optional(&serdev->dev, NULL);
@@ -2088,7 +2088,7 @@ static int qca_serdev_probe(struct serdev_device *serdev)
20882088

20892089
qcadev->bt_en = devm_gpiod_get_optional(&serdev->dev, "enable",
20902090
GPIOD_OUT_LOW);
2091-
if (!qcadev->bt_en) {
2091+
if (IS_ERR_OR_NULL(qcadev->bt_en)) {
20922092
dev_warn(&serdev->dev, "failed to acquire enable gpio\n");
20932093
power_ctrl_enabled = false;
20942094
}

‎include/net/bluetooth/hci.h

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2233,11 +2233,7 @@ struct inquiry_info_rssi_pscan {
22332233
} __packed;
22342234
struct hci_ev_inquiry_result_rssi {
22352235
__u8 num;
2236-
struct inquiry_info_rssi info[];
2237-
} __packed;
2238-
struct hci_ev_inquiry_result_rssi_pscan {
2239-
__u8 num;
2240-
struct inquiry_info_rssi_pscan info[];
2236+
__u8 data[];
22412237
} __packed;
22422238

22432239
#define HCI_EV_REMOTE_EXT_FEATURES 0x23

‎net/bluetooth/hci_event.c

Lines changed: 9 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -4507,27 +4507,25 @@ static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, void *data,
45074507
static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, void *edata,
45084508
struct sk_buff *skb)
45094509
{
4510-
union {
4511-
struct hci_ev_inquiry_result_rssi *res1;
4512-
struct hci_ev_inquiry_result_rssi_pscan *res2;
4513-
} *ev = edata;
4510+
struct hci_ev_inquiry_result_rssi *ev = edata;
45144511
struct inquiry_data data;
45154512
int i;
45164513

4517-
bt_dev_dbg(hdev, "num_rsp %d", ev->res1->num);
4514+
bt_dev_dbg(hdev, "num_rsp %d", ev->num);
45184515

4519-
if (!ev->res1->num)
4516+
if (!ev->num)
45204517
return;
45214518

45224519
if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
45234520
return;
45244521

45254522
hci_dev_lock(hdev);
45264523

4527-
if (skb->len == flex_array_size(ev, res2->info, ev->res2->num)) {
4524+
if (skb->len == array_size(ev->num,
4525+
sizeof(struct inquiry_info_rssi_pscan))) {
45284526
struct inquiry_info_rssi_pscan *info;
45294527

4530-
for (i = 0; i < ev->res2->num; i++) {
4528+
for (i = 0; i < ev->num; i++) {
45314529
u32 flags;
45324530

45334531
info = hci_ev_skb_pull(hdev, skb,
@@ -4554,10 +4552,11 @@ static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, void *edata,
45544552
info->dev_class, info->rssi,
45554553
flags, NULL, 0, NULL, 0);
45564554
}
4557-
} else if (skb->len == flex_array_size(ev, res1->info, ev->res1->num)) {
4555+
} else if (skb->len == array_size(ev->num,
4556+
sizeof(struct inquiry_info_rssi))) {
45584557
struct inquiry_info_rssi *info;
45594558

4560-
for (i = 0; i < ev->res1->num; i++) {
4559+
for (i = 0; i < ev->num; i++) {
45614560
u32 flags;
45624561

45634562
info = hci_ev_skb_pull(hdev, skb,

‎net/bluetooth/hci_sock.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1911,7 +1911,8 @@ static int hci_sock_setsockopt(struct socket *sock, int level, int optname,
19111911
sockptr_t optval, unsigned int len)
19121912
{
19131913
struct sock *sk = sock->sk;
1914-
int err = 0, opt = 0;
1914+
int err = 0;
1915+
u16 opt;
19151916

19161917
BT_DBG("sk %p, opt %d", sk, optname);
19171918

@@ -1937,7 +1938,7 @@ static int hci_sock_setsockopt(struct socket *sock, int level, int optname,
19371938
goto done;
19381939
}
19391940

1940-
if (copy_from_sockptr(&opt, optval, sizeof(u16))) {
1941+
if (copy_from_sockptr(&opt, optval, sizeof(opt))) {
19411942
err = -EFAULT;
19421943
break;
19431944
}

‎net/bluetooth/l2cap_sock.c

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -904,6 +904,8 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
904904
struct l2cap_conn *conn;
905905
int len, err = 0;
906906
u32 opt;
907+
u16 mtu;
908+
u8 mode;
907909

908910
BT_DBG("sk %p", sk);
909911

@@ -1086,16 +1088,16 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
10861088
break;
10871089
}
10881090

1089-
if (copy_from_sockptr(&opt, optval, sizeof(u16))) {
1091+
if (copy_from_sockptr(&mtu, optval, sizeof(u16))) {
10901092
err = -EFAULT;
10911093
break;
10921094
}
10931095

10941096
if (chan->mode == L2CAP_MODE_EXT_FLOWCTL &&
10951097
sk->sk_state == BT_CONNECTED)
1096-
err = l2cap_chan_reconfigure(chan, opt);
1098+
err = l2cap_chan_reconfigure(chan, mtu);
10971099
else
1098-
chan->imtu = opt;
1100+
chan->imtu = mtu;
10991101

11001102
break;
11011103

@@ -1117,14 +1119,14 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
11171119
break;
11181120
}
11191121

1120-
if (copy_from_sockptr(&opt, optval, sizeof(u8))) {
1122+
if (copy_from_sockptr(&mode, optval, sizeof(u8))) {
11211123
err = -EFAULT;
11221124
break;
11231125
}
11241126

1125-
BT_DBG("opt %u", opt);
1127+
BT_DBG("mode %u", mode);
11261128

1127-
err = l2cap_set_mode(chan, opt);
1129+
err = l2cap_set_mode(chan, mode);
11281130
if (err)
11291131
break;
11301132

0 commit comments

Comments
 (0)