Skip to content

Commit ee7e178

Browse files
kuba-mookuba-moo
committed
Merge tag 'for-net-next-2023-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next
Luiz Augusto von Dentz says: ==================== pull-request: bluetooth-next - Add new PID/VID 0489:e0f2 for MT7921 - Add VID:PID 13d3:3529 for Realtek RTL8821CE - Add CIS feature bits to controller information - Set Per Platform Antenna Gain(PPAG) for Intel controllers * tag 'for-net-next-2023-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next: Bluetooth: btintel: Set Per Platform Antenna Gain(PPAG) Bluetooth: Make sure LE create conn cancel is sent when timeout Bluetooth: Free potentially unfreed SCO connection Bluetooth: hci_qca: get wakeup status from serdev device handle Bluetooth: L2CAP: Fix potential user-after-free Bluetooth: MGMT: add CIS feature bits to controller information Bluetooth: hci_conn: Refactor hci_bind_bis() since it always succeeds Bluetooth: HCI: Replace zero-length arrays with flexible-array members Bluetooth: qca: Fix sparse warnings Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE Bluetooth: btusb: Add new PID/VID 0489:e0f2 for MT7921 Bluetooth: Fix issue with Actions Semi ATS2851 based devices ==================== Link: https://lore.kernel.org/r/20230209234922.3756173-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2 parents de42873 + c585a92 commit ee7e178

File tree

10 files changed

+188
-41
lines changed

10 files changed

+188
-41
lines changed

‎drivers/bluetooth/btintel.c‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
#include <linux/module.h>
1010
#include <linux/firmware.h>
1111
#include <linux/regmap.h>
12+
#include <linux/acpi.h>
1213
#include <asm/unaligned.h>
1314

1415
#include <net/bluetooth/bluetooth.h>
@@ -24,6 +25,9 @@
2425
#define ECDSA_OFFSET 644
2526
#define ECDSA_HEADER_LEN 320
2627

28+
#define BTINTEL_PPAG_NAME "PPAG"
29+
#define BTINTEL_PPAG_PREFIX "\\_SB_.PCI0.XHCI.RHUB"
30+
2731
#define CMD_WRITE_BOOT_PARAMS 0xfc0e
2832
struct cmd_write_boot_params {
2933
__le32 boot_addr;
@@ -1278,6 +1282,63 @@ static int btintel_read_debug_features(struct hci_dev *hdev,
12781282
return 0;
12791283
}
12801284

1285+
static acpi_status btintel_ppag_callback(acpi_handle handle, u32 lvl, void *data,
1286+
void **ret)
1287+
{
1288+
acpi_status status;
1289+
size_t len;
1290+
struct btintel_ppag *ppag = data;
1291+
union acpi_object *p, *elements;
1292+
struct acpi_buffer string = {ACPI_ALLOCATE_BUFFER, NULL};
1293+
struct acpi_buffer buffer = {ACPI_ALLOCATE_BUFFER, NULL};
1294+
struct hci_dev *hdev = ppag->hdev;
1295+
1296+
status = acpi_get_name(handle, ACPI_FULL_PATHNAME, &string);
1297+
if (ACPI_FAILURE(status)) {
1298+
bt_dev_warn(hdev, "ACPI Failure: %s", acpi_format_exception(status));
1299+
return status;
1300+
}
1301+
1302+
if (strncmp(BTINTEL_PPAG_PREFIX, string.pointer,
1303+
strlen(BTINTEL_PPAG_PREFIX))) {
1304+
kfree(string.pointer);
1305+
return AE_OK;
1306+
}
1307+
1308+
len = strlen(string.pointer);
1309+
if (strncmp((char *)string.pointer + len - 4, BTINTEL_PPAG_NAME, 4)) {
1310+
kfree(string.pointer);
1311+
return AE_OK;
1312+
}
1313+
kfree(string.pointer);
1314+
1315+
status = acpi_evaluate_object(handle, NULL, NULL, &buffer);
1316+
if (ACPI_FAILURE(status)) {
1317+
bt_dev_warn(hdev, "ACPI Failure: %s", acpi_format_exception(status));
1318+
return status;
1319+
}
1320+
1321+
p = buffer.pointer;
1322+
ppag = (struct btintel_ppag *)data;
1323+
1324+
if (p->type != ACPI_TYPE_PACKAGE || p->package.count != 2) {
1325+
kfree(buffer.pointer);
1326+
bt_dev_warn(hdev, "Invalid object type: %d or package count: %d",
1327+
p->type, p->package.count);
1328+
return AE_ERROR;
1329+
}
1330+
1331+
elements = p->package.elements;
1332+
1333+
/* PPAG table is located at element[1] */
1334+
p = &elements[1];
1335+
1336+
ppag->domain = (u32)p->package.elements[0].integer.value;
1337+
ppag->mode = (u32)p->package.elements[1].integer.value;
1338+
kfree(buffer.pointer);
1339+
return AE_CTRL_TERMINATE;
1340+
}
1341+
12811342
static int btintel_set_debug_features(struct hci_dev *hdev,
12821343
const struct intel_debug_features *features)
12831344
{
@@ -2251,6 +2312,58 @@ static int btintel_configure_offload(struct hci_dev *hdev)
22512312
return err;
22522313
}
22532314

2315+
static void btintel_set_ppag(struct hci_dev *hdev, struct intel_version_tlv *ver)
2316+
{
2317+
acpi_status status;
2318+
struct btintel_ppag ppag;
2319+
struct sk_buff *skb;
2320+
struct btintel_loc_aware_reg ppag_cmd;
2321+
2322+
/* PPAG is not supported if CRF is HrP2, Jfp2, JfP1 */
2323+
switch (ver->cnvr_top & 0xFFF) {
2324+
case 0x504: /* Hrp2 */
2325+
case 0x202: /* Jfp2 */
2326+
case 0x201: /* Jfp1 */
2327+
return;
2328+
}
2329+
2330+
memset(&ppag, 0, sizeof(ppag));
2331+
2332+
ppag.hdev = hdev;
2333+
status = acpi_walk_namespace(ACPI_TYPE_ANY, ACPI_ROOT_OBJECT,
2334+
ACPI_UINT32_MAX, NULL,
2335+
btintel_ppag_callback, &ppag, NULL);
2336+
2337+
if (ACPI_FAILURE(status)) {
2338+
/* Do not log warning message if ACPI entry is not found */
2339+
if (status == AE_NOT_FOUND)
2340+
return;
2341+
bt_dev_warn(hdev, "PPAG: ACPI Failure: %s", acpi_format_exception(status));
2342+
return;
2343+
}
2344+
2345+
if (ppag.domain != 0x12) {
2346+
bt_dev_warn(hdev, "PPAG-BT Domain disabled");
2347+
return;
2348+
}
2349+
2350+
/* PPAG mode, BIT0 = 0 Disabled, BIT0 = 1 Enabled */
2351+
if (!(ppag.mode & BIT(0))) {
2352+
bt_dev_dbg(hdev, "PPAG disabled");
2353+
return;
2354+
}
2355+
2356+
ppag_cmd.mcc = cpu_to_le32(0);
2357+
ppag_cmd.sel = cpu_to_le32(0); /* 0 - Enable , 1 - Disable, 2 - Testing mode */
2358+
ppag_cmd.delta = cpu_to_le32(0);
2359+
skb = __hci_cmd_sync(hdev, 0xfe19, sizeof(ppag_cmd), &ppag_cmd, HCI_CMD_TIMEOUT);
2360+
if (IS_ERR(skb)) {
2361+
bt_dev_warn(hdev, "Failed to send PPAG Enable (%ld)", PTR_ERR(skb));
2362+
return;
2363+
}
2364+
kfree_skb(skb);
2365+
}
2366+
22542367
static int btintel_bootloader_setup_tlv(struct hci_dev *hdev,
22552368
struct intel_version_tlv *ver)
22562369
{
@@ -2297,6 +2410,9 @@ static int btintel_bootloader_setup_tlv(struct hci_dev *hdev,
22972410

22982411
hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT);
22992412

2413+
/* Set PPAG feature */
2414+
btintel_set_ppag(hdev, ver);
2415+
23002416
/* Read the Intel version information after loading the FW */
23012417
err = btintel_read_version_tlv(hdev, &new_ver);
23022418
if (err)

‎drivers/bluetooth/btintel.h‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -137,6 +137,19 @@ struct intel_offload_use_cases {
137137
__u8 preset[8];
138138
} __packed;
139139

140+
/* structure to store the PPAG data read from ACPI table */
141+
struct btintel_ppag {
142+
u32 domain;
143+
u32 mode;
144+
struct hci_dev *hdev;
145+
};
146+
147+
struct btintel_loc_aware_reg {
148+
__le32 mcc;
149+
__le32 sel;
150+
__le32 delta;
151+
} __packed;
152+
140153
#define INTEL_HW_PLATFORM(cnvx_bt) ((u8)(((cnvx_bt) & 0x0000ff00) >> 8))
141154
#define INTEL_HW_VARIANT(cnvx_bt) ((u8)(((cnvx_bt) & 0x003f0000) >> 16))
142155
#define INTEL_CNVX_TOP_TYPE(cnvx_top) ((cnvx_top) & 0x00000fff)

‎drivers/bluetooth/btusb.c‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,7 @@ static struct usb_driver btusb_driver;
6464
#define BTUSB_INTEL_BROKEN_SHUTDOWN_LED BIT(24)
6565
#define BTUSB_INTEL_BROKEN_INITIAL_NCMD BIT(25)
6666
#define BTUSB_INTEL_NO_WBS_SUPPORT BIT(26)
67+
#define BTUSB_ACTIONS_SEMI BIT(27)
6768

6869
static const struct usb_device_id btusb_table[] = {
6970
/* Generic Bluetooth USB device */
@@ -492,6 +493,10 @@ static const struct usb_device_id blacklist_table[] = {
492493
{ USB_VENDOR_AND_INTERFACE_INFO(0x8087, 0xe0, 0x01, 0x01),
493494
.driver_info = BTUSB_IGNORE },
494495

496+
/* Realtek 8821CE Bluetooth devices */
497+
{ USB_DEVICE(0x13d3, 0x3529), .driver_info = BTUSB_REALTEK |
498+
BTUSB_WIDEBAND_SPEECH },
499+
495500
/* Realtek 8822CE Bluetooth devices */
496501
{ USB_DEVICE(0x0bda, 0xb00c), .driver_info = BTUSB_REALTEK |
497502
BTUSB_WIDEBAND_SPEECH },
@@ -566,6 +571,9 @@ static const struct usb_device_id blacklist_table[] = {
566571
{ USB_DEVICE(0x0489, 0xe0e0), .driver_info = BTUSB_MEDIATEK |
567572
BTUSB_WIDEBAND_SPEECH |
568573
BTUSB_VALID_LE_STATES },
574+
{ USB_DEVICE(0x0489, 0xe0f2), .driver_info = BTUSB_MEDIATEK |
575+
BTUSB_WIDEBAND_SPEECH |
576+
BTUSB_VALID_LE_STATES },
569577
{ USB_DEVICE(0x04ca, 0x3802), .driver_info = BTUSB_MEDIATEK |
570578
BTUSB_WIDEBAND_SPEECH |
571579
BTUSB_VALID_LE_STATES },
@@ -677,6 +685,9 @@ static const struct usb_device_id blacklist_table[] = {
677685
{ USB_DEVICE(0x0cb5, 0xc547), .driver_info = BTUSB_REALTEK |
678686
BTUSB_WIDEBAND_SPEECH },
679687

688+
/* Actions Semiconductor ATS2851 based devices */
689+
{ USB_DEVICE(0x10d7, 0xb012), .driver_info = BTUSB_ACTIONS_SEMI },
690+
680691
/* Silicon Wave based devices */
681692
{ USB_DEVICE(0x0c10, 0x0000), .driver_info = BTUSB_SWAVE },
682693

@@ -4098,6 +4109,11 @@ static int btusb_probe(struct usb_interface *intf,
40984109
set_bit(BTUSB_USE_ALT3_FOR_WBS, &data->flags);
40994110
}
41004111

4112+
if (id->driver_info & BTUSB_ACTIONS_SEMI) {
4113+
/* Support is advertised, but not implemented */
4114+
set_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks);
4115+
}
4116+
41014117
if (!reset)
41024118
set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
41034119

‎drivers/bluetooth/hci_qca.c‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -128,13 +128,13 @@ struct qca_memdump_event_hdr {
128128
__u8 evt;
129129
__u8 plen;
130130
__u16 opcode;
131-
__u16 seq_no;
131+
__le16 seq_no;
132132
__u8 reserved;
133133
} __packed;
134134

135135

136136
struct qca_dump_size {
137-
u32 dump_size;
137+
__le32 dump_size;
138138
} __packed;
139139

140140
struct qca_data {
@@ -1588,10 +1588,11 @@ static bool qca_wakeup(struct hci_dev *hdev)
15881588
struct hci_uart *hu = hci_get_drvdata(hdev);
15891589
bool wakeup;
15901590

1591-
/* UART driver handles the interrupt from BT SoC.So we need to use
1592-
* device handle of UART driver to get the status of device may wakeup.
1591+
/* BT SoC attached through the serial bus is handled by the serdev driver.
1592+
* So we need to use the device handle of the serdev driver to get the
1593+
* status of device may wakeup.
15931594
*/
1594-
wakeup = device_may_wakeup(hu->serdev->ctrl->dev.parent);
1595+
wakeup = device_may_wakeup(&hu->serdev->ctrl->dev);
15951596
bt_dev_dbg(hu->hdev, "wakeup status : %d", wakeup);
15961597

15971598
return wakeup;

‎include/net/bluetooth/hci.h‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2156,7 +2156,7 @@ struct hci_cp_le_big_create_sync {
21562156
__u8 mse;
21572157
__le16 timeout;
21582158
__u8 num_bis;
2159-
__u8 bis[0];
2159+
__u8 bis[];
21602160
} __packed;
21612161

21622162
#define HCI_OP_LE_BIG_TERM_SYNC 0x206c
@@ -2174,7 +2174,7 @@ struct hci_cp_le_setup_iso_path {
21742174
__le16 codec_vid;
21752175
__u8 delay[3];
21762176
__u8 codec_cfg_len;
2177-
__u8 codec_cfg[0];
2177+
__u8 codec_cfg[];
21782178
} __packed;
21792179

21802180
struct hci_rp_le_setup_iso_path {

‎include/net/bluetooth/mgmt.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,8 @@ struct mgmt_rp_read_index_list {
109109
#define MGMT_SETTING_STATIC_ADDRESS 0x00008000
110110
#define MGMT_SETTING_PHY_CONFIGURATION 0x00010000
111111
#define MGMT_SETTING_WIDEBAND_SPEECH 0x00020000
112+
#define MGMT_SETTING_CIS_CENTRAL 0x00040000
113+
#define MGMT_SETTING_CIS_PERIPHERAL 0x00080000
112114

113115
#define MGMT_OP_READ_INFO 0x0004
114116
#define MGMT_READ_INFO_SIZE 0

‎net/bluetooth/hci_conn.c‎

Lines changed: 13 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1061,8 +1061,15 @@ int hci_conn_del(struct hci_conn *conn)
10611061

10621062
if (conn->type == ACL_LINK) {
10631063
struct hci_conn *sco = conn->link;
1064-
if (sco)
1064+
if (sco) {
10651065
sco->link = NULL;
1066+
/* Due to race, SCO connection might be not established
1067+
* yet at this point. Delete it now, otherwise it is
1068+
* possible for it to be stuck and can't be deleted.
1069+
*/
1070+
if (sco->handle == HCI_CONN_HANDLE_UNSET)
1071+
hci_conn_del(sco);
1072+
}
10661073

10671074
/* Unacked frames */
10681075
hdev->acl_cnt += conn->sent;
@@ -1243,6 +1250,8 @@ static void create_le_conn_complete(struct hci_dev *hdev, void *data, int err)
12431250
if (conn != hci_lookup_le_connect(hdev))
12441251
goto done;
12451252

1253+
/* Flush to make sure we send create conn cancel command if needed */
1254+
flush_delayed_work(&conn->le_conn_timeout);
12461255
hci_conn_failed(conn, bt_status(err));
12471256

12481257
done:
@@ -1981,16 +1990,14 @@ static void hci_iso_qos_setup(struct hci_dev *hdev, struct hci_conn *conn,
19811990
qos->latency = conn->le_conn_latency;
19821991
}
19831992

1984-
static struct hci_conn *hci_bind_bis(struct hci_conn *conn,
1985-
struct bt_iso_qos *qos)
1993+
static void hci_bind_bis(struct hci_conn *conn,
1994+
struct bt_iso_qos *qos)
19861995
{
19871996
/* Update LINK PHYs according to QoS preference */
19881997
conn->le_tx_phy = qos->out.phy;
19891998
conn->le_tx_phy = qos->out.phy;
19901999
conn->iso_qos = *qos;
19912000
conn->state = BT_BOUND;
1992-
1993-
return conn;
19942001
}
19952002

19962003
static int create_big_sync(struct hci_dev *hdev, void *data)
@@ -2119,11 +2126,7 @@ struct hci_conn *hci_connect_bis(struct hci_dev *hdev, bdaddr_t *dst,
21192126
if (IS_ERR(conn))
21202127
return conn;
21212128

2122-
conn = hci_bind_bis(conn, qos);
2123-
if (!conn) {
2124-
hci_conn_drop(conn);
2125-
return ERR_PTR(-ENOMEM);
2126-
}
2129+
hci_bind_bis(conn, qos);
21272130

21282131
/* Add Basic Announcement into Peridic Adv Data if BASE is set */
21292132
if (base_len && base) {

‎net/bluetooth/l2cap_core.c‎

Lines changed: 0 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -2683,14 +2683,6 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
26832683
if (IS_ERR(skb))
26842684
return PTR_ERR(skb);
26852685

2686-
/* Channel lock is released before requesting new skb and then
2687-
* reacquired thus we need to recheck channel state.
2688-
*/
2689-
if (chan->state != BT_CONNECTED) {
2690-
kfree_skb(skb);
2691-
return -ENOTCONN;
2692-
}
2693-
26942686
l2cap_do_send(chan, skb);
26952687
return len;
26962688
}
@@ -2735,14 +2727,6 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
27352727
if (IS_ERR(skb))
27362728
return PTR_ERR(skb);
27372729

2738-
/* Channel lock is released before requesting new skb and then
2739-
* reacquired thus we need to recheck channel state.
2740-
*/
2741-
if (chan->state != BT_CONNECTED) {
2742-
kfree_skb(skb);
2743-
return -ENOTCONN;
2744-
}
2745-
27462730
l2cap_do_send(chan, skb);
27472731
err = len;
27482732
break;
@@ -2763,14 +2747,6 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
27632747
*/
27642748
err = l2cap_segment_sdu(chan, &seg_queue, msg, len);
27652749

2766-
/* The channel could have been closed while segmenting,
2767-
* check that it is still connected.
2768-
*/
2769-
if (chan->state != BT_CONNECTED) {
2770-
__skb_queue_purge(&seg_queue);
2771-
err = -ENOTCONN;
2772-
}
2773-
27742750
if (err)
27752751
break;
27762752

‎net/bluetooth/l2cap_sock.c‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1624,6 +1624,14 @@ static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,
16241624
if (!skb)
16251625
return ERR_PTR(err);
16261626

1627+
/* Channel lock is released before requesting new skb and then
1628+
* reacquired thus we need to recheck channel state.
1629+
*/
1630+
if (chan->state != BT_CONNECTED) {
1631+
kfree_skb(skb);
1632+
return ERR_PTR(-ENOTCONN);
1633+
}
1634+
16271635
skb->priority = sk->sk_priority;
16281636

16291637
bt_cb(skb)->l2cap.chan = chan;

0 commit comments

Comments
 (0)