linux.git/drivers/bluetooth/btmtk.c, branch v6.9

Bluetooth: btusb: mediatek: Fix double free of skb in coredump

2024-04-24T20:26:16+00:00

hci_devcd_append() would free the skb on error so the caller don't
have to free it again otherwise it would cause the double free of skb.

Fixes: 0b7015132878 ("Bluetooth: btusb: mediatek: add MediaTek devcoredump support")
Reported-by : Dan Carpenter 
Signed-off-by: Sean Wang 
Signed-off-by: Luiz Augusto von Dentz

Bluetooth: btmtk: Add MODULE_FIRMWARE() for MT7922

2024-03-06T22:27:11+00:00

Since dracut refers to the module info for defining the required
firmware files and btmtk driver doesn't provide the firmware info for
MT7922, the generate initrd misses the firmware, resulting in the
broken Bluetooth.

This patch simply adds the MODULE_FIRMWARE() for the missing entry
for covering that.

Link: https://bugzilla.suse.com/show_bug.cgi?id=1214133
Signed-off-by: Takashi Iwai 
Reviewed-by: Paul Menzel 
Reviewed-by: Matthias Brugger 
Signed-off-by: Luiz Augusto von Dentz

Bluetooth: btusb: Fix memory leak

2024-03-06T22:26:23+00:00

This checks if CONFIG_DEV_COREDUMP is enabled before attempting to clone
the skb and also make sure btmtk_process_coredump frees the skb passed
following the same logic.

Fixes: 0b7015132878 ("Bluetooth: btusb: mediatek: add MediaTek devcoredump support")
Signed-off-by: Luiz Augusto von Dentz

Bluetooth: btmtk: Fix kernel crash when processing coredump

2023-08-11T18:48:58+00:00

There may be a potential kernel crash risk if 'skb->len
- MTK_COREDUMP_END_LEN' value is less than 0 when doing
memcmp in btmtk_process_coredump().
Check the value is valid before doing memcmp.

[215.021695] Unable to handle kernel paging request at
             virtual address ffffff939fffd3c5
[215.021781] Mem abort info:
[215.021805]   ESR = 0x96000005
[215.021833]   EC = 0x25: DABT (current EL), IL = 32 bits
[215.021861]   SET = 0, FnV = 0
[215.021875]   EA = 0, S1PTW = 0
[215.021886] Data abort info:
[215.021899]   ISV = 0, ISS = 0x00000005
[215.021912]   CM = 0, WnR = 0
[215.021929] swapper pgtable: 4k pages, 39-bit VAs,
             pgdp=00000000410de000
[215.021943] [ffffff939fffd3c5] pgd=0000000000000000,
             p4d=0000000000000000, pud=0000000000000000
[215.021979] Internal error: Oops: 96000005 [#1] PREEMPT SMP
[215.022496] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.10.186#3
             (HASH:ad23 4)
[215.022511] Hardware name: MediaTek Tomato board (DT)
[215.022530] pstate: 80400009 (Nzcv daif +PAN -UAO -TCO BTYPE=--)
[215.022556] pc : __pi_memcmp+0xd0/0x1b8
[215.022579] lr : btmtk_process_coredump+0xb0/0x5f8 [btmtk]
[215.022593] sp : ffffffc010003d40
[215.022607] x29: ffffffc010003d40 x28: 0000000000000006
[215.022633] x27: ffffffda696350c0 x26: 0000000000000002
[215.022659] x25: 00000000000003ff x24: ffffff9360cca804
[215.022685] x23: 0000000000000000 x22: ffffff9365638500
[215.022710] x21: ffffff9365638700 x20: 0000000000000000
[215.022736] x19: ffffff936002e000 x18: 0000000000000000
[215.022761] x17: 0000000000000180 x16: ffffffda6881b8b4
[215.022787] x15: 0000000000000001 x14: 0000000000002d00
[215.022812] x13: 0000000000060000 x12: 0000000000000181
[215.022837] x11: 0000000000000006 x10: fffffffffffffffd
[215.022862] x9 : 0000000000000006 x8 : 0000000000000003
[215.022887] x7 : 0000000000000000 x6 : 0000000000000000
[215.022913] x5 : ffffff93656387b8 x4 : 0000000000000000
[215.022938] x3 : ffffffc010003c18 x2 : 0000000000000006
[215.022963] x1 : ffffffda09d4124a x0 : ffffff939fffd3c5
[215.022989] Call trace:
[215.023012]  __pi_memcmp+0xd0/0x1b8
[215.023053]  btusb_recv_acl_mtk+0x64/0x90 [btusb (HASH:dc6b 5)]
[215.023087]  btusb_recv_bulk+0x118/0x170 [btusb (HASH:dc6b 5)]
[215.023121]  btusb_bulk_complete+0x8c/0x148 [btusb (HASH:dc6b 5)]
[215.023144]  __usb_hcd_giveback_urb+0xbc/0x148
[215.023164]  usb_giveback_urb_bh+0xb4/0x190
[215.023184]  tasklet_action_common+0x98/0x1a0
[215.023201]  tasklet_action+0x2c/0x38
[215.023220]  __do_softirq+0xe0/0x38c
[215.023241]  invoke_softirq+0x34/0x6c
[215.023258]  irq_exit+0x6c/0xb0
[215.023279]  __handle_domain_irq+0x98/0xd4
[215.023296]  gic_handle_irq+0x5c/0x11c
[215.023313]  el1_irq+0xd0/0x180
[215.023332]  cpuidle_enter_state+0xac/0x338
[215.023349]  cpuidle_enter+0x40/0x70
[215.023366]  do_idle+0x150/0x278
[215.023384]  cpu_startup_entry+0x2c/0x58
[215.023401]  rest_init+0xdc/0xec
[215.023419]  arch_call_rest_init+0x18/0x24
[215.023435]  start_kernel+0x334/0x400
[215.023460] Code: 91002129 eb09010a 9a89810b cb0b0042 (38401403)
[215.023478] ---[ end trace 28668fd20c7a90cd ]

Fixes: 2822cd0173ad ("Bluetooth: btusb: mediatek: add MediaTek devcoredump support")
Signed-off-by: Chris Lu 
Co-developed-by: Sean Wang 
Signed-off-by: Sean Wang 
Signed-off-by: Luiz Augusto von Dentz

Bluetooth: btusb: mediatek: add MediaTek devcoredump support

2023-08-11T18:41:56+00:00

This patch implement function .coredump() and dmp_hdr() in btusb
driver for MediaTek controller.  FW core dump was triggered by FW
specific event to show something unexpected happened in the controller.

The driver would be responsible for collecting and uploading the device
core dump pieces in hci driver using core dump API. Once we finished
the whole process, the driver would reset the controller to recover the
kind of fatal error.

Co-developed-by: Chris Lu 
Signed-off-by: Chris Lu 
Co-developed-by: Sean Wang 
Signed-off-by: Sean Wang 
Signed-off-by: Jing Cai 
Signed-off-by: Luiz Augusto von Dentz

Bluetooth: btmtk: introduce btmtk reset work

2023-08-11T18:41:37+00:00

Introduce btmtk_reset_work which can be called whenever the firmware abort,
HCI command timeout, other fatal error happen.

Co-developed-by: Chris Lu 
Signed-off-by: Chris Lu 
Co-developed-by: Sean Wang 
Signed-off-by: Sean Wang 
Signed-off-by: Jing Cai 
Signed-off-by: Luiz Augusto von Dentz

Bluetooth: btmtk: add printing firmware information

2023-08-11T18:41:02+00:00

Add printing firmware information part when driver loading firmware that
user can get mediatek bluetooth information.

Co-developed-by: Sean Wang 
Signed-off-by: Sean Wang 
Signed-off-by: Chris Lu 
Signed-off-by: Luiz Augusto von Dentz

Bluetooth: btusb: Add support Mediatek MT7925

2023-08-11T18:39:39+00:00

This patch is added support Mediatek MT7925.
1. The firmware location of MT7925 will set to
/lib/firmware/mediatek/mt7925
2. Add Mediatek private data in hdev
to record the device for handle MT7925 flow.
3. Use the recoreded dev_id to condition chip reset flow.

The information in /sys/kernel/debug/usb/devices about the MT7925U
Bluetooth device is listed as the below

T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 27 Spd=480  MxCh= 0
D:  Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=0e8d ProdID=7925 Rev= 1.00
S:  Manufacturer=MediaTek Inc.
S:  Product=Wireless_Device
S:  SerialNumber=000000000
C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=100mA
A:  FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01
I:* If#= 0 Alt= 0 #EPs= 5 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=125us
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=8f(I) Atr=03(Int.) MxPS=   2 Ivl=125us
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
I:  If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  63 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  63 Ivl=1ms
I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
E:  Ad=8a(I) Atr=03(Int.) MxPS=  64 Ivl=125us
E:  Ad=0a(O) Atr=03(Int.) MxPS=  64 Ivl=125us
I:  If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
E:  Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us
E:  Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us
I:* If#= 3 Alt= 0 #EPs= 9 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
E:  Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=08(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=09(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=86(I) Atr=03(Int.) MxPS=   2 Ivl=125us

Signed-off-by: Peter Tsao 
Signed-off-by: Luiz Augusto von Dentz

Bluetooth: btmtkuart: rely on BT_MTK module

2022-03-18T16:12:07+00:00

Rely on btmtk module to reduce duplicated code

Signed-off-by: Sean Wang 
Signed-off-by: Marcel Holtmann

Bluetooth: btusb: Return error code when getting patch status failed

2021-12-07T16:05:52+00:00

If there are failure cases in getting patch status, it should return the
error code (-EIO).

Fixes: fc342c4dc4087 ("Bluetooth: btusb: Add protocol support for MediaTek MT7921U USB devices")
Co-developed-by: Sean Wang 
Signed-off-by: Sean Wang 
Signed-off-by: Mark Chen 
Signed-off-by: Marcel Holtmann