Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[PW_SID:631489] [RFC] Bluetooth: core: Allow bind HCI socket user channel when HCI is UP. #873

Closed
wants to merge 11 commits into from
Closed

[PW_SID:631489] [RFC] Bluetooth: core: Allow bind HCI socket user channel when HCI is UP. #873

wants to merge 11 commits into from

Conversation

BluezTestBot
Copy link
Owner

This is needed for user-space to ensure that HCI init scheduled from
hci_register_dev is completed.

Function hci_register_dev queues power_on workqueue which will run
hci_power_on > hci_dev_do_open. Function hci_dev_do_open sets HCI_INIT
for some time.

It is not allowed to bind to HCI socket user channel when HCI_INIT is
set. As result, bind might fail when user-space program is run early
enough during boot.

Now, user-space program can first issue HCIDEVUP ioctl to ensure HCI
init scheduled at hci_register_dev was completed.

Signed-off-by: Vasyl Vavrychuk vasyl.vavrychuk@opensynergy.com

net/bluetooth/hci_sock.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)

linusw and others added 11 commits April 5, 2022 19:14
@linusw @holtmann
Bluetooth: btbcm: Support per-board firmware variants
fed7bac 
There are provedly different firmware variants for the different
phones using some of these chips. These were extracted from a few
Samsung phones:

37446 BCM4334B0.samsung,codina-tmo.hcd
37366 BCM4334B0.samsung,golden.hcd
37403 BCM4334B0.samsung,kyle.hcd
37366 BCM4334B0.samsung,skomer.hcd

This patch supports the above naming schedule with inserting
[.board_name] between the firmware name and ".hcd". This scheme
is the same as used by the companion BRCM wireless chips
as can be seen in
drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
or just by looking at the firmwares in linux-firmware/brcm.

Currently we only support board variants using the device
tree compatible string as board type, but other schemes are
possible.

This makes it possible to successfully load a few unique
firmware variants for some Samsung phones.

Cc: phone-devel@vger.kernel.org
Cc: Markuss Broks <markuss.broks@gmail.com>
Cc: Stephan Gerhold <stephan@gerhold.net>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
@moore-bros @holtmann
Bluetooth: mt7921s: Fix the incorrect pointer check
252e3db 
Fix the incorrect pointer check on ven_data.

Fixes: f41b91f ("Bluetooth: mt7921s: Add .btmtk_get_codec_config_data")
Co-developed-by: Yake Yang <yake.yang@mediatek.com>
Signed-off-by: Yake Yang <yake.yang@mediatek.com>
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
@holtmann
Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout
92b8aa6 
Connecting the same socket twice consecutively in sco_sock_connect()
could lead to a race condition where two sco_conn objects are created
but only one is associated with the socket. If the socket is closed
before the SCO connection is established, the timer associated with the
dangling sco_conn object won't be canceled. As the sock object is being
freed, the use-after-free problem happens when the timer callback
function sco_sock_timeout() accesses the socket. Here's the call trace:

dump_stack+0x107/0x163
? refcount_inc+0x1c/
print_address_description.constprop.0+0x1c/0x47e
? refcount_inc+0x1c/0x7b
kasan_report+0x13a/0x173
? refcount_inc+0x1c/0x7b
check_memory_region+0x132/0x139
refcount_inc+0x1c/0x7b
sco_sock_timeout+0xb2/0x1ba
process_one_work+0x739/0xbd1
? cancel_delayed_work+0x13f/0x13f
? __raw_spin_lock_init+0xf0/0xf0
? to_kthread+0x59/0x85
worker_thread+0x593/0x70e
kthread+0x346/0x35a
? drain_workqueue+0x31a/0x31a
? kthread_bind+0x4b/0x4b
ret_from_fork+0x1f/0x30

Link: https://syzkaller.appspot.com/bug?extid=2bef95d3ab4daa10155b
Reported-by: syzbot+2bef95d3ab4daa10155b@syzkaller.appspotmail.com
Fixes: e1dee2c ("Bluetooth: fix repeated calls to sco_sock_kill")
Signed-off-by: Ying Hsu <yinghsu@chromium.org>
Reviewed-by: Joseph Hwang <josephsih@chromium.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
@bgix @holtmann
Bluetooth: Keep MGMT pending queue ordered FIFO
9d5632f 
Small change to add new commands to tail of the list, and find/remove them
from the head of the list.

Signed-off-by: Brian Gix <brian.gix@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
@rikardfalkeborn @holtmann
Bluetooth: btintel: Constify static struct regmap_bus
8b55b18 
The only usage of regmap_ibt is to (after the regmap_init() macro is
expanded), pass its address to __regmap_init(), which takes a pointer to
const struct regmap_bus as input. Make it const to allow the compiler to
put it in read-only memory.

Signed-off-by: Rikard Falkeborn <rikard.falkeborn@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
@rostedt @holtmann
Bluetooth: hci_qca: Use del_timer_sync() before freeing
63dd7af 
While looking at a crash report on a timer list being corrupted, which
usually happens when a timer is freed while still active. This is
commonly triggered by code calling del_timer() instead of
del_timer_sync() just before freeing.

One possible culprit is the hci_qca driver, which does exactly that.

Eric mentioned that wake_retrans_timer could be rearmed via the work
queue, so also move the destruction of the work queue before
del_timer_sync().

Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: stable@vger.kernel.org
Fixes: 0ff252c ("Bluetooth: hciuart: Add support QCA chipset for UART")
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
@Vudentz @holtmann
Bluetooth: HCI: Add HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN quirk
c625b46 
This adds HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN quirk which can be
used to mark HCI_Enhanced_Setup_Synchronous_Connection as broken even
if its support command bit are set since some controller report it as
supported but the command don't work properly with some configurations
(e.g. BT_VOICE_TRANSPARENT/mSBC).

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
@Vudentz @holtmann
Bluetooth: Print broken quirks
fa5cd0f 
This prints warnings for controllers setting broken quirks to increase
their visibility and warn about broken controllers firmware that
probably needs updates to behave properly.

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
@Vudentz @holtmann
Bluetooth: btusb: Set HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN for QCA
38a1944 
This sets HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN for QCA controllers
since SCO appear to not work when using HCI_OP_ENHANCED_SETUP_SYNC_CONN.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=215576
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
@tedd-an @BluezTestBot
workflow: Add workflow files for ci
f049f84 
This patch adds workflow files for ci:

[schedule_work.yml]
 - The workflow file for scheduled work
 - Sync the repo with upstream repo and rebase the workflow branch
 - Review the patches in the patchwork and creates the PR if needed

[ci.yml]
 - The workflow file for CI tasks
 - Run CI tests when PR is created

Signed-off-by: Tedd Ho-Jeong An <tedd.an@intel.com>
@vvavrychuk @BluezTestBot
Bluetooth: core: Allow bind HCI socket user channel when HCI is UP.
174f6cf 
This is needed for user-space to ensure that HCI init scheduled from
hci_register_dev is completed.

Function hci_register_dev queues power_on workqueue which will run
hci_power_on > hci_dev_do_open. Function hci_dev_do_open sets HCI_INIT
for some time.

It is not allowed to bind to HCI socket user channel when HCI_INIT is
set. As result, bind might fail when user-space program is run early
enough during boot.

Now, user-space program can first issue HCIDEVUP ioctl to ensure HCI
init scheduled at hci_register_dev was completed.

Signed-off-by: Vasyl Vavrychuk <vasyl.vavrychuk@opensynergy.com>
@github-actions
Copy link

CheckPatch
Test ID: checkpatch
Desc: Run checkpatch.pl script with rule in .checkpatch.conf
Duration: 1.67 seconds
Result: FAIL
Output:

[RFC] Bluetooth: core: Allow bind HCI socket user channel when HCI is UP.\WARNING:FROM_SIGN_OFF_MISMATCH: From:/Signed-off-by: email address mismatch: 'From: Vasyl Vavrychuk <vvavrychuk@gmail.com>' != 'Signed-off-by: Vasyl Vavrychuk <vasyl.vavrychuk@opensynergy.com>'

total: 0 errors, 1 warnings, 0 checks, 10 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

/github/workspace/src/12810739.patch has style problems, please review.

NOTE: Ignored message types: UNKNOWN_COMMIT_ID

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.

@github-actions
Copy link

GitLint
Test ID: gitlint
Desc: Run gitlint with rule in .gitlint
Duration: 1.02 seconds
Result: FAIL
Output:

[RFC] Bluetooth: core: Allow bind HCI socket user channel when HCI is UP.
1: T3 Title has trailing punctuation (.): "[RFC] Bluetooth: core: Allow bind HCI socket user channel when HCI is UP."

@github-actions
Copy link

SubjectPrefix
Test ID: subjectprefix
Desc: Check subject contains "Bluetooth" prefix
Duration: 0.82 seconds
Result: PASS

@github-actions
Copy link

BuildKernel
Test ID: buildkernel
Desc: Build Kernel with minimal configuration supports Bluetooth
Duration: 30.11 seconds
Result: PASS

@github-actions
Copy link

BuildKernel32
Test ID: buildkernel32
Desc: Build 32bit Kernel with minimal configuration supports Bluetooth
Duration: 27.80 seconds
Result: PASS

@github-actions
Copy link

Incremental Build with patches
Test ID: incremental_build
Desc: Incremental build per patch in the series
Duration: 39.08 seconds
Result: PASS

@github-actions
Copy link

TestRunner: Setup
Test ID: testrunnersetup
Desc: Setup environment for running Test Runner
Duration: 471.62 seconds
Result: PASS

@github-actions
Copy link

TestRunner: l2cap-tester
Test ID: testrunnerl2cap-tester
Desc: Run test-runner with l2cap-tester
Duration: 16.22 seconds
Result: PASS
Output:

Total: 40, Passed: 40 (100.0%), Failed: 0, Not Run: 0

@github-actions
Copy link

TestRunner: bnep-tester
Test ID: testrunnerbnep-tester
Desc: Run test-runner with bnep-tester
Duration: 6.26 seconds
Result: PASS
Output:

Total: 1, Passed: 1 (100.0%), Failed: 0, Not Run: 0

@github-actions
Copy link

TestRunner: mgmt-tester
Test ID: testrunnermgmt-tester
Desc: Run test-runner with mgmt-tester
Duration: 106.06 seconds
Result: PASS
Output:

Total: 493, Passed: 493 (100.0%), Failed: 0, Not Run: 0

@github-actions
Copy link

TestRunner: rfcomm-tester
Test ID: testrunnerrfcomm-tester
Desc: Run test-runner with rfcomm-tester
Duration: 8.22 seconds
Result: PASS
Output:

Total: 10, Passed: 10 (100.0%), Failed: 0, Not Run: 0

@github-actions
Copy link

TestRunner: sco-tester
Test ID: testrunnersco-tester
Desc: Run test-runner with sco-tester
Duration: 7.99 seconds
Result: PASS
Output:

Total: 12, Passed: 12 (100.0%), Failed: 0, Not Run: 0

@github-actions
Copy link

TestRunner: smp-tester
Test ID: testrunnersmp-tester
Desc: Run test-runner with smp-tester
Duration: 7.98 seconds
Result: PASS
Output:

Total: 8, Passed: 8 (100.0%), Failed: 0, Not Run: 0

@github-actions
Copy link

TestRunner: userchan-tester
Test ID: testrunneruserchan-tester
Desc: Run test-runner with userchan-tester
Duration: 6.66 seconds
Result: FAIL
Output:

Total: 4, Passed: 3 (75.0%), Failed: 1, Not Run: 0

Failed Test Cases
User channel open - Failed                           Failed       0.082 seconds

@github-actions github-actions bot force-pushed the workflow branch 5 times, most recently from d71ac89 to a40c0f4 Compare April 12, 2022 17:49
@github-actions github-actions bot force-pushed the workflow branch 28 times, most recently from 0c4a418 to 892e5e1 Compare May 12, 2022 13:12
@BluezTestBot BluezTestBot deleted the 631489 branch May 12, 2022 13:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
9 participants
@BluezTestBot @linusw @moore-bros @bgix @rikardfalkeborn @rostedt @Vudentz @tedd-an @vvavrychuk