- 28 Oct, 2021 1 commit
-
-
Archie Pusaka authored
If we remove one instance of adv using Set Extended Adv Enable, there is a possibility of issue occurs when processing the Command Complete event. Especially, the adv_info might not be found since we already remove it in hci_req_clear_adv_instance() -> hci_remove_adv_instance(). If that's the case, we will mistakenly proceed to remove all adv instances instead of just one single instance. This patch fixes the issue by checking the content of the HCI command instead of checking whether the adv_info is found. Signed-off-by:
Archie Pusaka <apusaka@chromium.org> Reviewed-by:
Sonny Sasaka <sonnysasaka@chromium.org> Signed-off-by:
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
-
- 25 Oct, 2021 13 commits
-
-
Sean Wang authored
add MT7921s Bluetooth support Co-developed-by:
Mark-yw Chen <mark-yw.chen@mediatek.com> Signed-off-by:
Sean Wang <sean.wang@mediatek.com> Signed-off-by:
Marcel Holtmann <marcel@holtmann.org>
-
Sean Wang authored
The MT7961 SDIO identifier for MediaTek Bluetooth devices were being referred in the MediaTek Bluetooth driver. Co-developed-by:
-
Mark-yw Chen authored
Each packet should be sent out until the device emits the TX_EMPTY signal to the host, that is firmware people suggested to add to meet the actual firmware behavior and that is compatible among all the devices. Co-developed-by:
-
Sean Wang authored
That is a preliminary patch to introduce mt7921s support. Use the register CRPLR to read packet length to make all the devices share the common logic. Co-developed-by:
-
Sean Wang authored
That is a preliminary patch to introduce mt7921s support. Update register CSDIOCSR operation that is suggested from the vendor driver and is compatible to the all devices. Co-developed-by:
-
Sean Wang authored
btmtksdio belongs to WIFI/BT combo chip that would serve two radios in one sdio_irq so that we have to move interrupt service to worker to ensure ISR as short as possible. The worker would serve the both Tx and Rx in a batch to effectively reduce many interrupts to the host and to avoid excessive sdio lock contention between various context (even from WiFi driver) and help to be more efficient to complete command/event transation. Co-developed-by:
-
Sean Wang authored
That is a preliminary patch to introduce mt7921s support. Explicitly set WHISR as write-1-clear method to all devices that is the expected behavior the driver rely on. Co-developed-by:
-
Sean Wang authored
add .set_bdaddr support Signed-off-by:
-
Sean Wang authored
Rely on btmtk module to reduce duplicated code Signed-off-by:
-
Sean Wang authored
Add BT_MTK module that is a preliminary patch to introduce mt7921s support to share the logic betweem btusb and btmtksdio. Signed-off-by:
-
Paul Cercueil authored
The entry "brcm,bcm4330-bt" was listed twice in the table. Signed-off-by:
Paul Cercueil <paul@crapouillou.net> Signed-off-by:
-
Johan Hovold authored
Add the missing bulk-out endpoint sanity check to probe() to avoid division by zero in bfusb_send_frame() in case a malicious device has broken descriptors (or when doing descriptor fuzz testing). Note that USB core will reject URBs submitted for endpoints with zero wMaxPacketSize but that drivers doing packet-size calculations still need to handle this (cf. commit 2548288b ("USB: Fix: Don't skip endpoint descriptors with maxpacket=0")). Cc: stable@vger.kernel.org Signed-off-by:
Johan Hovold <johan@kernel.org> Signed-off-by:
-
Wang Hai authored
I got a kernel BUG report when doing fault injection test: ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:45! ... RIP: 0010:__list_del_entry_valid.cold+0x12/0x4d ... Call Trace: proto_unregister+0x83/0x220 cmtp_cleanup_sockets+0x37/0x40 [cmtp] cmtp_exit+0xe/0x1f [cmtp] do_syscall_64+0x35/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xae If cmtp_init_sockets() in cmtp_init() fails, cmtp_init() still returns success. This will cause a kernel bug when accessing uncreated ctmp related data when the module exits. Fixes: 1da177e4 ("Linux-2.6.12-rc2") Reported-by:
Hulk Robot <hulkci@huawei.com> Signed-off-by:
Wang Hai <wanghai38@huawei.com> Signed-off-by:
-
- 22 Oct, 2021 1 commit
-
-
Luiz Augusto von Dentz authored
msft_opcode shall be use a vendor ogf (0x3f) but the check was swifting the bits in the wrong order due to a missing parantesis over val & 0xffff, but since the code already checks for values over 0xffff it shall not be necessary to perform that operation it now just removes which makes it work properly when setting opcodes like 0xfce1. Fixes: b8f5482c ("Bluetooth: vhci: Add support for setting msft_opcode and aosp_capable") Signed-off-by:
-
- 20 Oct, 2021 2 commits
-
-
Kyle Copperfield authored
BCM4345 and BCM43455 devices soldered onto the PCB (non-removable), use an UART connection for Bluetooth, such as in the Pinebook Pro, and the advertised btsdio support as an SDIO function is ignored. Reviewed-by:
Dragan Simic <dragan.simic@gmail.com> Signed-off-by:
Kyle Copperfield <kmcopper@danwin1210.me> Signed-off-by:
-
Soenke Huster authored
On the reception of packets with an invalid packet type, the memory of the allocated socket buffers is never freed. Add a default case that frees these to avoid a memory leak. Fixes: afd2daa2 ("Bluetooth: Add support for virtio transport driver") Signed-off-by:
Soenke Huster <soenke.huster@eknoes.de> Signed-off-by:
-
- 14 Oct, 2021 1 commit
-
-
Luiz Augusto von Dentz authored
This adds a debugfs entries to set msft_opcode and aosp_capable enabling vhci to emulate controllers with MSFT/AOSP extension support. Signed-off-by:
-
- 13 Oct, 2021 5 commits
-
-
Mark-YW.Chen authored
Driver should free `usb->setup_packet` to avoid the leak. $ cat /sys/kernel/debug/kmemleak unreferenced object 0xffffffa564a58080 (size 128): backtrace: [<000000007eb8dd70>] kmem_cache_alloc_trace+0x22c/0x384 [<000000008a44191d>] btusb_mtk_hci_wmt_sync+0x1ec/0x994 [btusb] [<00000000ca7189a3>] btusb_mtk_setup+0x6b8/0x13cc [btusb] [<00000000c6105069>] hci_dev_do_open+0x290/0x974 [bluetooth] [<00000000a583f8b8>] hci_power_on+0xdc/0x3cc [bluetooth] [<000000005d80e687>] process_one_work+0x514/0xc80 [<00000000f4d57637>] worker_thread+0x818/0xd0c [<00000000dc7bdb55>] kthread+0x2f8/0x3b8 [<00000000f9999513>] ret_from_fork+0x10/0x30 Fixes: a1c49c43 ("Bluetooth: btusb: Add protocol support for MediaTek MT7668U USB devices") Signed-off-by: -
Wei Yongjun authored
Fault injection test reported memory leak of hci device as follows: unreferenced object 0xffff88800b858000 (size 8192): comm "kworker/0:2", pid 167, jiffies 4294955747 (age 557.148s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 ad 4e ad de .............N.. backtrace: [<0000000070eb1059>] kmem_cache_alloc_trace mm/slub.c:3208 [<00000000015eb521>] hci_alloc_dev_priv include/linux/slab.h:591 [<00000000dcfc1e21>] bpa10x_probe include/net/bluetooth/hci_core.h:1240 [<000000005d3028c7>] usb_probe_interface drivers/usb/core/driver.c:397 [<00000000cbac9243>] really_probe drivers/base/dd.c:517 [<0000000024cab3f0>] __driver_probe_device drivers/base/dd.c:751 [<00000000202135cb>] driver_probe_device drivers/base/dd.c:782 [<000000000761f2bc>] __device_attach_driver drivers/base/dd.c:899 [<00000000f7d63134>] bus_for_each_drv drivers/base/bus.c:427 [<00000000c9551f0b>] __device_attach drivers/base/dd.c:971 [<000000007f79bd16>] bus_probe_device drivers/base/bus.c:487 [<000000007bb8b95a>] device_add drivers/base/core.c:3364 [<000000009564d9ea>] usb_set_configuration drivers/usb/core/message.c:2171 [<00000000e4657087>] usb_generic_driver_probe drivers/usb/core/generic.c:239 [<0000000071ede518>] usb_probe_device drivers/usb/core/driver.c:294 [<00000000cbac9243>] really_probe drivers/base/dd.c:517 hci_alloc_dev() do not init the device's flag. And hci_free_dev() using put_device() to free the memory allocated for this device, but it calls just put_device(dev) only in case of HCI_UNREGISTER flag is set, So any error handing before hci_register_dev() success will cause memory leak. To avoid this behaviour we can using kfree() to release dev before hci_register_dev() success. Signed-off-by:Wei Yongjun <weiyongjun1@huawei.com> Signed-off-by:
-
Kiran K authored
Intel Read Verision(TLV) data is parsed into a local structure variable and it contains a field for bd address. Bd address is returned only in bootloader mode and hence bd address in TLV structure needs to be validated only if controller is present in boot loader mode. Signed-off-by:
Kiran K <kiran.k@intel.com> Reviewed-by:
Tedd Ho-Jeong An <tedd.an@intel.com> Signed-off-by:
-
Wei Yongjun authored
Fault injection test report debugfs entry leak as follows: debugfs: Directory 'hci0' with parent 'bluetooth' already present! When register_pm_notifier() failed in hci_register_dev(), the debugfs create by debugfs_create_dir() do not removed in the error handing path. Add the remove debugfs code to fix it. Signed-off-by:
-
David Yang authored
The coccinelle check report: "./drivers/bluetooth/btusb.c:2239:36-42: ERROR: application of sizeof to pointer". Using the real size to fix it. Fixes: 5a87679f ("Bluetooth: btusb: Support public address configuration for MediaTek Chip.") Reported-by:
Zeal Robot <zealci@zte.com.cn> Signed-off-by:
David Yang <davidcomponentone@gmail.com> Signed-off-by:
-
- 12 Oct, 2021 2 commits
-
-
Luiz Augusto von Dentz authored
In order to group sockets being connected using L2CAP_MODE_EXT_FLOWCTL the pid is used but sk_peer_pid was not being initialized as it is currently only done for af_unix. Fixes: b48596d1 ("Bluetooth: L2CAP: Add get_peer_pid callback") Signed-off-by:
-
Nguyen Dinh Phi authored
The receive path may take the socket right before hci_sock_release(), but it may enqueue the packets to the socket queues after the call to skb_queue_purge(), therefore the socket can be destroyed without clear its queues completely. Moving these skb_queue_purge() to the hci_sock_destruct() will fix this issue, because nothing is referencing the socket at this point. Signed-off-by:
Nguyen Dinh Phi <phind.uet@gmail.com> Reported-by: syzbot+4c4ffd1e1094dae61035@syzkaller.appspotmail.com Signed-off-by:
-
- 07 Oct, 2021 3 commits
-
-
Tedd Ho-Jeong An authored
This patch fixes the controller index in the Experimental Features Changed event for the offload_codec and the quality_report features to use the actual hdev index instead of non-controller index(0xffff) so the client can receive the event and know which controller the event is for. Fixes: ad933151 ("Bluetooth: Add offload feature under experimental flag") Fixes: ae7d925b ("Bluetooth: Support the quality report events") Signed-off-by:
-
Tedd Ho-Jeong An authored
This patch sets the wakeup state of the vhci driver when the force_wakeup is updated. Fixes: 60edfad4 ("Bluetooth: hci_vhci: Add force_prevent_wake entry") Signed-off-by:
-
Kiran K authored
Read codec capabilities only if HCI_READ_LOCAL_CODEC_CAPABILITIES command is supported. If capablities are not supported, then cache codec data without caps. Signed-off-by:
-
- 06 Oct, 2021 2 commits
-
-
Luiz Augusto von Dentz authored
When SUSPEND_DISCONNECTING bit is set that means Disconnect is pending but the code was evaluating if the list is empty before calling hci_conn_del which does the actual cleanup and remove the connection from the list thus the bit is never cleared causing the suspend procedure to always timeout when there are connections to be disconnected: Suspend/Resume - Success 5 (Pairing - Legacy) - waiting done Set the system into Suspend via force_suspend = mgmt-tester: Suspend/Resume - Success 5 (Pairing -.. 17:03:13.200458 = mgmt-tester: Set the system into Suspend via force_suspend 17:03:13.205812 < HCI Command: Write Scan E.. (0x03|0x001a) plen 1 #122 [hci0] 17:03:13.213561 Scan enable: No Scans (0x00) > HCI Event: Command Complete (0x0e) plen 4 #123 [hci0] 17:03:13.214710 Write Scan Enable (0x03|0x001a) ncmd 1 Status: Success (0x00) < HCI Command: Disconnect (0x01|0x0006) plen 3 #124 [hci0] 17:03:13.215830 Handle: 42 Reason: Remote Device Terminated due to Power Off (0x15) > HCI Event: Command Status (0x0f) plen 4 #125 [hci0] 17:03:13.216602 Disconnect (0x01|0x0006) ncmd 1 Status: Success (0x00) > HCI Event: Disconnect Complete (0x05) plen 4 #126 [hci0] 17:03:13.217342 Status: Success (0x00) Handle: 42 Reason: Remote Device Terminated due to Power Off (0x15) @ MGMT Event: Device Disconn.. (0x000c) plen 8 {0x0002} [hci0] 17:03:13.217688 BR/EDR Address: 00:AA:01:01:00:00 (Intel Corporation) Reason: Connection terminated by local host for suspend (0x05) @ MGMT Event: Device Disconn.. (0x000c) plen 8 {0x0001} [hci0] 17:03:13.217688 BR/EDR Address: 00:AA:01:01:00:00 (Intel Corporation) Reason: Connection terminated by local host for suspend (0x05) Suspend/Resume - Success 5 (Pairing - Legacy) - test timed out = mgmt-tester: Suspend/Resume - Success 5 (Pairing -.. 17:03:13.939317 Suspend/Resume - Success 5 (Pairing - Legacy) - teardown = mgmt-tester: Suspend/Resume - Success 5 (Pairing -.. 17:03:13.947267 [ 13.284291] Bluetooth: hci0: Timed out waiting for suspend events [ 13.287324] Bluetooth: hci0: Suspend timeout bit: 6 Signed-off-by: -
Luiz Augusto von Dentz authored
Defer calls to hci_{suspend,resume}_dev to work so it doesn't block the processing of the events. Signed-off-by:
-
- 05 Oct, 2021 10 commits
-
-
Jakub Kicinski authored
Merge tag 'for-net-next-2021-10-01' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next Luiz Augusto von Dentz says: ==================== bluetooth-next pull request for net-next: - Add support for MediaTek MT7922 and MT7921 - Enable support for AOSP extention in Qualcomm WCN399x and Realtek 8822C/8852A. - Add initial support for link quality and audio/codec offload. - Rework of sockets sendmsg to avoid locking issues. - Add vhci suspend/resume emulation. ==================== Link: https://lore.kernel.org/r/20211001230850.3635543-1-luiz.dentz@gmail.comSigned-off-by:
Jakub Kicinski <kuba@kernel.org>
-
Jakub Kicinski authored
Convert usb drivers from memcpy(... dev->addr_len) to eth_hw_addr_set(): @@ expression dev, np; @@ - memcpy(dev->dev_addr, np, dev->addr_len) + eth_hw_addr_set(dev, np) Manually checked these are either usbnet or pure etherdevs. Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Jakub Kicinski authored
Convert all Ethernet drivers from memcpy(... dev->addr_len) to eth_hw_addr_set(): @@ expression dev, np; @@ - memcpy(dev->dev_addr, np, dev->addr_len) + eth_hw_addr_set(dev, np) In theory addr_len may not be ETH_ALEN, but we don't expect non-Ethernet devices to live under this directory, and only the following cases of setting addr_len exist: - cxgb4 for mgmt device, and the drivers which set it to ETH_ALEN: s2io, mlx4, vxge. Signed-off-by:
-
David S. Miller authored
Jakub Kicinski says: ==================== mlx4: prep for constant dev->dev_addr This patch converts mlx4 for dev->dev_addr being const. It converts to use of common helpers but also removes some seemingly unnecessary idiosyncrasies. Please review. ==================== Signed-off-by: -
Jakub Kicinski authored
netdev->dev_addr will become const soon. Make sure all functions which pass it around mark appropriate args as const. Signed-off-by:
Tariq Toukan <tariqt@nvidia.com> Signed-off-by:
-
Jakub Kicinski authored
mlx4_en_u64_to_mac() takes the dev->dev_addr pointer and writes to it byte by byte. It also clears the two bytes _after_ ETH_ALEN which seems unnecessary. dev->addr_len is set to ETH_ALEN just before the call. Signed-off-by:
-
Jakub Kicinski authored
mlx4_u64_to_mac() predates the common helper but doesn't make the argument constant. Signed-off-by:
-
Jakub Kicinski authored
mlx4_mac_to_u64() predates and opencodes ether_addr_to_u64(). It doesn't make the argument constant so it'll be problematic when dev->dev_addr becomes a const. Convert to the generic helper. Signed-off-by:
-
Florian Westphal authored
No users in tree since commit a3498436 ("netns: restrict uevents"), so remove this functionality. Cc: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by:
Florian Westphal <fw@strlen.de> Signed-off-by:
-
git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linuxDavid S. Miller authored
Saeed Mahameed says: ==================== mlx5-updates-2021-10-04 Misc updates for mlx5 driver 1) Add TX max rate support for MQPRIO channel mode 2) Trivial TC action and modify header refactoring 3) TC support for accept action in fdb offloads 4) Allow single IRQ for PCI functions 5) Bridge offload: Pop PVID VLAN header on egress miss Vlad Buslov says: ================= With current architecture of mlx5 bridge offload it is possible for a packet to match in ingress table by source MAC (resulting VLAN header push in case of port with configured PVID) and then miss in egress table when destination MAC is not in FDB. Due to the lack of hardware learning in NICs, this, in turn, results packet going to software data path with PVID VLAN already added by hardware. This doesn't break software bridge since it accepts either untagged packets or packets with any provisioned VLAN on ports with PVID, but can break ingress TC, if affected part of Ethernet header is matched by classifier. Improve compatibility with software TC by restoring the packet header on egress miss. Effectively, this change implements atomicity of mlx5 bridge offload implementation - packet is either modified and redirected to destination port or appears unmodified in software. ================= ================= Signed-off-by:
-
