summaryrefslogtreecommitdiffstats
path: root/drivers/bluetooth/hci_qca.c
Commit message (Collapse)AuthorAgeFilesLines
* Bluetooth: hci_qca: Fix QCA6390 memdump failureZijun Hu2020-06-011-9/+45
| | | | | | | | | | | | | | | | | | | | QCA6390 memdump VSE sometimes come to bluetooth driver with wrong sequence number as illustrated as follows: frame # in dec: frame data in hex 1396: ff fd 01 08 74 05 00 37 8f 14 1397: ff fd 01 08 75 05 00 ff bf 38 1414: ff fd 01 08 86 05 00 fb 5e 4b 1399: ff fd 01 08 77 05 00 f3 44 0a 1400: ff fd 01 08 78 05 00 ca f7 41 it is mistook for controller missing packets, so results in page fault after overwriting memdump buffer allocated. Fixed by ignoring QCA6390 sequence number check and checking buffer space before writing. Signed-off-by: Zijun Hu <zijuhu@codeaurora.org> Tested-by: Zijun Hu <zijuhu@codeaurora.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_qca: Fix qca6390 enable failure after warm rebootZijun Hu2020-05-291-0/+33
| | | | | | | | | | | | | Warm reboot can not reset controller qca6390 due to lack of controllable power supply, so causes firmware download failure during enable. Fixed by sending VSC EDL_SOC_RESET to reset qca6390 within added device shutdown implementation. Signed-off-by: Zijun Hu <zijuhu@codeaurora.org> Tested-by: Zijun Hu <zijuhu@codeaurora.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_qca: Fix suspend/resume functionality failureZijun Hu2020-05-291-4/+6
| | | | | | | | | | | | | @dev parameter of qca_suspend()/qca_resume() represents serdev_device, but it is mistook for hci_dev and causes succedent unexpected memory access. Fix by taking @dev as serdev_device. Fixes: 41d5b25fed0 ("Bluetooth: hci_qca: add PM support") Signed-off-by: Zijun Hu <zijuhu@codeaurora.org> Reviewed-by: Matthias Kaehlcke <mka@chromium.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_qca: Fix uninitialized access to hdevAbhishek Pandit-Subedi2020-05-201-1/+2
| | | | | | | | hdev is always allocated and not only when power control is required. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Abhishek Pandit-Subedi <abhishekpandit@chromium.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_qca: Enable WBS support for wcn3991Abhishek Pandit-Subedi2020-05-181-6/+17
| | | | | | | | | | | | WCN3991 supports transparent WBS (host encoded mSBC). Add a flag to the device match data to show WBS is supported. This requires the matching firmware for WCN3991 in linux-firmware: 1a8b0dc00f77 (qca: Enable transparent WBS for WCN3991) Signed-off-by: Abhishek Pandit-Subedi <abhishekpandit@chromium.org> Reviewed-by: Matthias Kaehlcke <mka@chromium.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_qca: allow max-speed to be set for QCA9377 devicesChristian Hewitt2020-04-281-7/+9
| | | | | | | | | Move the read of max-speed from device-tree out of the qca_is_wcn399x if block so oper_speed can be set for QCA9377 devices as well. Suggested-by: Abhishek Pandit-Subedi <abhishekpandit@chromium.org> Signed-off-by: Christian Hewitt <christianshewitt@gmail.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_qca: add compatible for QCA9377Christian Hewitt2020-04-281-0/+1
| | | | | | | Add a compatible so QCA9377 devices can be defined in device-tree. Signed-off-by: Christian Hewitt <christianshewitt@gmail.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_qca: Add support for Qualcomm Bluetooth SoC QCA6390Rocky Liao2020-04-021-7/+33
| | | | | | | | This patch adds support for QCA6390, including the devicetree and acpi compatible hwid matching, and patch/nvm downloading. Signed-off-by: Rocky Liao <rjliao@codeaurora.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_qca: Replace devm_gpiod_get() with devm_gpiod_get_optional()Rocky Liao2020-03-041-8/+8
| | | | | | | | | | | This patch replaces devm_gpiod_get() with devm_gpiod_get_optional() to get bt_en and replaces devm_clk_get() with devm_clk_get_optional() to get susclk. It also uses NULL check to determine whether the resource is available or not. Fixes: 8a208b24d770 ("Bluetooth: hci_qca: Make bt_en and susclk not mandatory for QCA Rome") Signed-off-by: Rocky Liao <rjliao@codeaurora.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_qca: Make bt_en and susclk not mandatory for QCA RomeRocky Liao2020-03-041-21/+26
| | | | | | | | | | | On some platforms the bt_en pin and susclk are default on and there is no exposed resource to control them. This patch makes the bt_en and susclk not mandatory to have BT work. It also will not set the HCI_QUIRK_NON_PERSISTENT_SETUP and shutdown() callback if bt_en is not available. Signed-off-by: Rocky Liao <rjliao@codeaurora.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_qca: Not send vendor pre-shutdown command for QCA RomeRocky Liao2020-02-281-1/+3
| | | | | | | | | | QCA Rome doesn't support the pre-shutdown vendor hci command, this patch will check the soc type in qca_power_off() and only send this command for wcn399x. Fixes: ae563183b647 ("Bluetooth: hci_qca: Enable power off/on support during hci down/up for QCA Rome") Signed-off-by: Rocky Liao <rjliao@codeaurora.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_qca: Bug fixes while collecting controller memory dumpVenkata Lakshmi Narayana Gubba2020-02-181-34/+67
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch will fix the below issues 1. Discarding memory dump events if memdump state is moved to MEMDUMP_TIMEOUT. 2. Fixed race conditions between qca_hw_error() and qca_controller_memdump while free memory dump buffers using mutex lock 3. Moved timeout timer to delayed work queue 4. Injecting HW error event in a case when dumps failed to receive and HW error event is not yet received. 5. Clearing hw error and command timeout function callbacks before sending pre shutdown command. Collecting memory dump will follow any of the below sequence. Sequence 1: Receiving Memory dump events from the controller Received entire dump in stipulated time Received HW error event from the controller Controller Reset from HOST Sequence 2: Receiving Memory dump events from the controller Failed to Receive entire dump in stipulated time A Timeout schedules and if no HW error event received a fake HW error event will be injected. Controller Reset from HOST. Sequence 3: Received HW error event HOST trigger SSR by sending crash packet to controller. Received entire dump in stipulated time Controller Reset from HOST Fixes: d841502c79e3 ("Bluetooth: hci_qca: Collect controller memory dump during SSR") Reported-by: Abhishek Pandit-Subedi <abhishekpandit@chromium.org> Signed-off-by: Venkata Lakshmi Narayana Gubba <gubbaven@codeaurora.org> Reviewed-by: Abhishek Pandit-Subedi <abhishekpandit@chromium.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_qca: Optimized code while enabling clocks for BT SOCVenkata Lakshmi Narayana Gubba2020-02-051-7/+3
| | | | | | | | | | * Directly passing clock pointer to clock code without checking for NULL as clock code takes care of it * Removed the comment which was not necessary * Updated code for return in qca_regulator_enable() Signed-off-by: Venkata Lakshmi Narayana Gubba <gubbaven@codeaurora.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_qca: Enable clocks required for BT SOCVenkata Lakshmi Narayana Gubba2020-02-031-0/+16
| | | | | | | | Instead of relying on other subsytem to turn ON clocks required for BT SoC to operate, voting them from the driver. Signed-off-by: Venkata Lakshmi Narayana Gubba <gubbaven@codeaurora.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_qca: Enable power off/on support during hci down/up for QCA RomeRocky Liao2020-01-161-9/+11
| | | | | | | | | | | | This patch registers hdev->shutdown() callback and also sets HCI_QUIRK_NON_PERSISTENT_SETUP for QCA Rome. It will power-off the BT chip during hci down and power-on/initialize the chip again during hci up. As wcn399x already enabled this, this patch also removed the callback register and QUIRK setting in qca_setup() for wcn399x and uniformly do this in the probe() routine. Signed-off-by: Rocky Liao <rjliao@codeaurora.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_qca: Retry btsoc initialize when it failsRocky Liao2020-01-151-0/+19
| | | | | | | | | | | | | | This patch adds the retry of btsoc initialization when it fails. There are reports that the btsoc initialization may fail on some platforms but the repro ratio is very low. The symptoms is the firmware downloading failed due to the UART write timed out. The failure may be caused by UART, platform HW or the btsoc itself but it's very difficlut to root cause, given the repro ratio is very low. Add a retry for the btsoc initialization can work around most of the failures and make Bluetooth finally works. Signed-off-by: Rocky Liao <rjliao@codeaurora.org> Reviewed-by: Matthias Kaehlcke <mka@chromium.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_qca: Add QCA Rome power off support to the qca_power_shutdown()Rocky Liao2020-01-151-12/+16
| | | | | | | | | | | Current qca_power_shutdown() only supports wcn399x, this patch adds Rome power off support to it. For Rome it just needs to pull down the bt_en GPIO to power off it. This patch also replaces all the power off operation in qca_close() with the unified qca_power_shutdown() call. Signed-off-by: Rocky Liao <rjliao@codeaurora.org> Reviewed-by: Matthias Kaehlcke <mka@chromium.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_qca: Add qca_power_on() API to support both wcn399x and Rome ↵Rocky Liao2020-01-141-21/+33
| | | | | | | | | | | | | | power up This patch adds a unified API qca_power_on() to support both wcn399x and Rome power on. For wcn399x it calls the qca_wcn3990_init() to init the regulators, and for Rome it pulls up the bt_en GPIO to power up the btsoc. It also moves all the power up operation from hdev->open() to hdev->setup(). Signed-off-by: Rocky Liao <rjliao@codeaurora.org> Reviewed-by: Matthias Kaehlcke <mka@chromium.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_qca: Remove set but not used variable 'opcode'YueHaibing2020-01-081-2/+1
| | | | | | | | | | | | | | | Fixes gcc '-Wunused-but-set-variable' warning: drivers/bluetooth/hci_qca.c: In function 'qca_controller_memdump': drivers/bluetooth/hci_qca.c:980:6: warning: variable 'opcode' set but not used [-Wunused-but-set-variable] It is never used since commit d841502c79e3 ("Bluetooth: hci_qca: Collect controller memory dump during SSR"), so remove it. Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: YueHaibing <yuehaibing@huawei.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_qca: Use vfree() instead of kfree()Wei Yongjun2020-01-081-2/+2
| | | | | | | | | | Use vfree() instead of kfree() to free vmalloc() allocated data. Fixes: d841502c79e3 ("Bluetooth: hci_qca: Collect controller memory dump during SSR") Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com> Reviewed-by: Balakrishna Godavarthi <bgodavar@codeaurora.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_qca: Collect controller memory dump during SSRBalakrishna Godavarthi2020-01-041-5/+291
| | | | | | | | | | | | | | We will collect the ramdump of BT controller when hardware error event received before rebooting the HCI layer. Before restarting a subsystem or a process running on a subsystem, it is often required to request either a subsystem or a process to perform proper cache dump and software failure reason into a memory buffer which application processor can retrieve afterwards. SW developers can often provide initial investigation by looking into that debugging information. Signed-off-by: Balakrishna Godavarthi <bgodavar@codeaurora.org> Signed-off-by: Venkata Lakshmi Narayana Gubba <gubbaven@codeaurora.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_qca: Replace of_device_get_match_data with device_get_match_dataRocky Liao2020-01-041-1/+1
| | | | | | | | Replace of_device_get_match_data with device_get_match_data to make driver work across platforms. Signed-off-by: Rocky Liao <rjliao@codeaurora.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_qca: Add support for Qualcomm Bluetooth SoC WCN3991Balakrishna Godavarthi2019-11-091-2/+14
| | | | | | | | This patch add support for WCN3991 i.e. current values and fw download support. Signed-off-by: Balakrishna Godavarthi <bgodavar@codeaurora.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_qca: add PM supportClaire Chang2019-11-041-3/+124
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add PM suspend/resume callbacks for hci_qca driver. BT host will make sure both Rx and Tx go into sleep state in qca_suspend. Without this, Tx may still remain in awake state, which prevents BTSOC from entering deep sleep. For example, BlueZ will send Set Event Mask to device when suspending and this will wake the device Rx up. However, the Tx idle timeout on the host side is 2000 ms. If the host is suspended before its Tx idle times out, it won't send HCI_IBS_SLEEP_IND to the device and the device Rx will remain awake. We implement this by canceling relevant work in workqueue, sending HCI_IBS_SLEEP_IND to the device and then waiting HCI_IBS_SLEEP_IND sent by the device. In order to prevent the device from being awaken again after qca_suspend is called, we introduce QCA_SUSPEND flag. QCA_SUSPEND is set in the beginning of qca_suspend to indicate system is suspending and that we'd like to ignore any further wake events. With QCA_SUSPEND and spinlock, we can avoid race condition, e.g. if qca_enqueue acquires qca->hci_ibs_lock before qca_suspend calls cancel_work_sync and then qca_enqueue adds a new qca->ws_awake_device work after the previous one is cancelled. If BTSOC wants to wake the whole system up after qca_suspend is called, it will keep sending HCI_IBS_WAKE_IND and uart driver will take care of waking the system. For example, uart driver will reconfigure its Rx pin to a normal GPIO pin and enable irq wake on that pin when suspending. Once host detects Rx falling, the system will begin resuming. Then, the BT host clears QCA_SUSPEND flag in qca_resume and begins dealing with normal HCI packets. By doing so, only a few HCI_IBS_WAKE_IND packets are lost and there is no data packet loss. Signed-off-by: Claire Chang <tientzu@chromium.org> Reviewed-by: Balakrishna Godavarthi <bgodavar@codeaurora.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Revert "Bluetooth: hci_qca: Add delay for wcn3990 stability"Jeffrey Hugo2019-10-211-3/+1
| | | | | | | | | | | | This reverts commit cde9dde6e11a5ab54b6462cd46d82878926783bc. The frame reassembly errors were root caused to a transient gpio issue. The missing response was root caused to an issue with properly managing RFR in the uart driver. Addressing those root causes occurs outside of hci_qca and eliminates the need for the 50ms delay, so remove it. Signed-off-by: Jeffrey Hugo <jeffrey.l.hugo@gmail.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_qca: Split qca_power_setup()Bjorn Andersson2019-10-171-25/+36
| | | | | | | | | Split and rename qca_power_setup() in order to simplify each code path and to clarify that it is unrelated to qca_power_off() and qca_power_setup(). Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_qca: Use regulator bulk enable/disableBjorn Andersson2019-10-171-42/+13
| | | | | | | | | | | | | With the regulator_set_load() and regulator_set_voltage() out of the enable/disable code paths the code can now use the standard regulator bulk enable/disable API. By cloning num_vregs into struct qca_power there's no need to lug around a reference to the struct qca_vreg_data, which further simplifies qca_power_setup(). Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_qca: Don't vote for specific voltageBjorn Andersson2019-10-171-18/+8
| | | | | | | | | | | | | | Devices with specific voltage requirements should not request voltage from the driver, but instead rely on the system configuration to define appropriate voltages for each rail. This ensures that PMIC and board variations are accounted for, something that the 0.1V range in the hci_qca driver currently tries to address. But on the Lenovo Yoga C630 (with wcn3990) vddch0 is 3.1V, which means the driver will fail to set the voltage. Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_qca: Update regulator_set_load() usageBjorn Andersson2019-10-171-15/+18
| | | | | | | | | | | | Since the introduction of '5451781dadf8 ("regulator: core: Only count load for enabled consumers")' in v5.0, the requested load of a regulator consumer is only accounted for when said consumer is voted enabled. So there's no need to vote for load ever time the regulator is enabled or disabled. Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_qca: Add delay for wcn3990 stabilityJeffrey Hugo2019-10-171-1/+3
| | | | | | | | | | | | | On the msm8998 mtp, the response to the baudrate change command is never received. On the Lenovo Miix 630, the response to the baudrate change command is corrupted - "Frame reassembly failed (-84)". Adding a 50ms delay before re-enabling flow to receive the baudrate change command response from the wcn3990 addesses both issues, and allows bluetooth to become functional. Signed-off-by: Jeffrey Hugo <jeffrey.l.hugo@gmail.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netDavid S. Miller2019-09-151-4/+6
|\ | | | | | | | | | | Minor overlapping changes in the btusb and ixgbe drivers. Signed-off-by: David S. Miller <davem@davemloft.net>
| * Bluetooth: hci_qca: disable irqs when spinlock is acquiredHarish Bandi2019-09-041-4/+6
| | | | | | | | | | | | | | | | | | | | | | Looks like Deadlock is observed in hci_qca while performing stress and stability tests. Since same lock is getting acquired from qca_wq_awake_rx and hci_ibs_tx_idle_timeout seeing spinlock recursion, irqs should be disable while acquiring the spinlock always. Signed-off-by: Harish Bandi <c-hbandi@codeaurora.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* | Bluetooth: hci_qca: wait for Pre shutdown complete event before sending the ↵Harish Bandi2019-09-051-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Power off pulse When SoC receives pre shut down command, it share the same with other COEX shared clients. So SoC needs a short time after sending VS pre shutdown command before turning off the regulators and sending the power off pulse. Along with short delay, needs to wait for command complete event for Pre shutdown VS command Signed-off-by: Harish Bandi <c-hbandi@codeaurora.org> Reviewed-by: Balakrishna Godavarthi <bgodavar@codeaurora.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* | Bluetooth: hci_qca: Set HCI_QUIRK_SIMULTANEOUS_DISCOVERY for QCA UART RadioRocky Liao2019-09-051-0/+5
| | | | | | | | | | | | | | | | QCA UART Bluetooth controllers can do both LE scan and BR/EDR inquiry at once, need to set HCI_QUIRK_SIMULTANEOUS_DISCOVERY quirk. Signed-off-by: Rocky Liao <rjliao@codeaurora.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* | Bluetooth: hci_qca: Make structure qca_proto constantNishka Dasgupta2019-09-051-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Static structure qca_proto, of type hci_uart_proto, is used four times: as the last argument in function hci_uart_register_device(), and as the only argument to functions hci_uart_register_proto() and hci_uart_unregister_proto(). In all three of these functions, the parameter corresponding to qca_proto is declared as constant. Therefore, make qca_proto itself constant as well in order to protect it from unintended modification. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta <nishkadg.linux@gmail.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* | Bluetooth: hci_qca: Remove redundant initializations to zeroMatthias Kaehlcke2019-09-051-19/+0
|/ | | | | | | | | | The qca_data structure is allocated with kzalloc() and hence zero-initialized. Remove a bunch of unnecessary explicit initializations of struct members to zero. Signed-off-by: Matthias Kaehlcke <mka@chromium.org> Reviewed-by: Balakrishna Godavarthi <bgodavar@codeaurora.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_qca: Skip 1 error print in device_want_to_sleep()Rocky Liao2019-08-141-2/+2
| | | | | | | | Don't fall through to print error message when receive sleep indication in HCI_IBS_RX_ASLEEP state, this is allowed behavior. Signed-off-by: Rocky Liao <rjliao@codeaurora.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_qca: Send VS pre shutdown command.Harish Bandi2019-08-121-0/+3
| | | | | | | | | WCN399x chips are coex chips, it needs a VS pre shutdown command while turning off the BT. So that chip can inform BT is OFF to other active clients. Signed-off-by: Harish Bandi <c-hbandi@codeaurora.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_qca: Use kfree_skb() instead of kfree()Wei Yongjun2019-08-121-1/+1
| | | | | | | | | Use kfree_skb() instead of kfree() to free sk_buff. Fixes: 2faa3f15fa2f ("Bluetooth: hci_qca: wcn3990: Drop baudrate change vendor event") Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com> Reviewed-by: Matthias Kaehlcke <mka@chromium.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_uart: check for missing tty operationsVladis Dronov2019-07-311-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | Certain ttys operations (pty_unix98_ops) lack tiocmget() and tiocmset() functions which are called by the certain HCI UART protocols (hci_ath, hci_bcm, hci_intel, hci_mrvl, hci_qca) via hci_uart_set_flow_control() or directly. This leads to an execution at NULL and can be triggered by an unprivileged user. Fix this by adding a helper function and a check for the missing tty operations in the protocols code. This fixes CVE-2019-10207. The Fixes: lines list commits where calls to tiocm[gs]et() or hci_uart_set_flow_control() were added to the HCI UART protocols. Link: https://syzkaller.appspot.com/bug?id=1b42faa2848963564a5b1b7f8c837ea7b55ffa50 Reported-by: syzbot+79337b501d6aa974d0f6@syzkaller.appspotmail.com Cc: stable@vger.kernel.org # v2.6.36+ Fixes: b3190df62861 ("Bluetooth: Support for Atheros AR300x serial chip") Fixes: 118612fb9165 ("Bluetooth: hci_bcm: Add suspend/resume PM functions") Fixes: ff2895592f0f ("Bluetooth: hci_intel: Add Intel baudrate configuration support") Fixes: 162f812f23ba ("Bluetooth: hci_uart: Add Marvell support") Fixes: fa9ad876b8e0 ("Bluetooth: hci_qca: Add support for Qualcomm Bluetooth chip wcn3990") Signed-off-by: Vladis Dronov <vdronov@redhat.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Reviewed-by: Yu-Chen, Cho <acho@suse.com> Tested-by: Yu-Chen, Cho <acho@suse.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* Bluetooth: hci_qca: Load customized NVM based on the device propertyRocky Liao2019-07-061-1/+17
| | | | | | | | | | | | QCA BTSOC NVM is a customized firmware file and different vendors may want to have different BTSOC configuration (e.g. Configure SCO over PCM or I2S, Setting Tx power, etc.) via this file. This patch will allow vendors to download different NVM firmware file by reading a device property "firmware-name". Signed-off-by: Rocky Liao <rjliao@codeaurora.org> Tested-by: Harish Bandi <c-hbandi@codeaurora.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_qca: wcn3990: Drop baudrate change vendor eventMatthias Kaehlcke2019-07-061-1/+54
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Firmware download to the WCN3990 often fails with a 'TLV response size mismatch' error: [ 133.064659] Bluetooth: hci0: setting up wcn3990 [ 133.489150] Bluetooth: hci0: QCA controller version 0x02140201 [ 133.495245] Bluetooth: hci0: QCA Downloading qca/crbtfw21.tlv [ 133.507214] Bluetooth: hci0: QCA TLV response size mismatch [ 133.513265] Bluetooth: hci0: QCA Failed to download patch (-84) This is caused by a vendor event that corresponds to an earlier command to change the baudrate. The event is not processed in the context of the baudrate change and is later interpreted as response to the firmware download command (which is also a vendor command), but the driver detects that the event doesn't have the expected amount of associated data. More details: For the WCN3990 the vendor command for a baudrate change isn't sent as synchronous HCI command, because the controller sends the corresponding vendor event with the new baudrate. The event is received and decoded after the baudrate change of the host port. Identify the 'unused' event when it is received and don't add it to the queue of RX frames. Signed-off-by: Matthias Kaehlcke <mka@chromium.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 333Thomas Gleixner2019-06-051-14/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Based on 1 normalized pattern(s): this program is free software you can redistribute it and or modify it under the terms of the gnu general public license version 2 as published by the free software foundation this program is distributed in the hope that it will be useful but without any warranty without even the implied warranty of merchantability or fitness for a particular purpose see the gnu general public license for more details you should have received a copy of the gnu general public license along with this program if not write to the free software foundation inc 59 temple place suite 330 boston ma 02111 1307 usa extracted by the scancode license scanner the SPDX license identifier GPL-2.0-only has been chosen to replace the boilerplate/reference in 136 file(s). Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Alexios Zavras <alexios.zavras@intel.com> Reviewed-by: Allison Randal <allison@lohutok.net> Cc: linux-spdx@vger.kernel.org Link: https://lkml.kernel.org/r/20190530000436.384967451@linutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* Bluetooth: hci_qca: Rename STATE_<flags> to QCA_<flags>Matthias Kaehlcke2019-05-051-7/+8
| | | | | | | | | | | | | Rename STATE_IN_BAND_SLEEP_ENABLED to QCA_IBS_ENABLED. The constant represents a flag (multiple flags can be set at once), not a unique state of the controller or driver. Also make the flag an enum value instead of a pre-processor constant (more flags will be added to the enum group by another patch). Signed-off-by: Matthias Kaehlcke <mka@chromium.org> Reviewed-by: Balakrishna Godavarthi <bgodavar@codeaurora.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_qca: Added support for WCN3998Harish Bandi2019-05-031-14/+26
| | | | | | | | | | | Added new compatible for WCN3998 and corresponding voltage and current values to WCN3998 compatible. Changed driver code to support WCN3998 Signed-off-by: Harish Bandi <c-hbandi@codeaurora.org> Reviewed-by: Matthias Kaehlcke <mka@chromium.org> Reviewed-by: Balakrishna Godavarthi <bgodavar@codeaurora.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_qca: Fix crash with non-serdev devicesMatthias Kaehlcke2019-04-231-1/+2
| | | | | | | | | | | | | | | | | | | qca_set_baudrate() calls serdev_device_wait_until_sent() assuming that the HCI is always associated with a serdev device. This isn't true for ROME controllers instantiated through ldisc, where the call causes a crash due to a NULL pointer dereferentiation. Only call the function when we have a serdev device. The timeout for ROME devices at the end of qca_set_baudrate() is long enough to be reasonably sure that the command was sent. Fixes: fa9ad876b8e0 ("Bluetooth: hci_qca: Add support for Qualcomm Bluetooth chip wcn3990") Reported-by: Balakrishna Godavarthi <bgodavar@codeaurora.org> Reported-by: Rocky Liao <rjliao@codeaurora.org> Signed-off-by: Matthias Kaehlcke <mka@chromium.org> Reviewed-by: Rocky Liao <rjliao@codeaurora.org> Tested-by: Rocky Liao <rjliao@codeaurora.org> Reviewed-by: Balakrishna Godavarthi <bgodavar@codeaurora.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_qca: Give enough time to ROME controller to bootup.Balakrishna Godavarthi2019-04-231-0/+2
| | | | | | | | | | | | This patch enables enough time to ROME controller to bootup after we bring the enable pin out of reset. Fixes: 05ba533c5c11 ("Bluetooth: hci_qca: Add serdev support"). Signed-off-by: Balakrishna Godavarthi <bgodavar@codeaurora.org> Reviewed-by: Rocky Liao <rjliao@codeaurora.org> Tested-by: Rocky Liao <rjliao@codeaurora.org> Tested-by: Claire Chang <tientzu@chromium.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_qca: Add helper function to get the chip familyMatthias Kaehlcke2019-04-231-19/+26
| | | | | | | | | | | | | | | | Many functions obtain a 'struct qca_serdev' only to read the btsoc_type field. Add a helper function that encapsulates this. This also fixes crashes observed on platforms with ROME controllers that are instantiated through ldisc and not as serdev clients. The crashes are caused by NULL pointer dereferentiations, which stem from the driver's assumption that a QCA HCI device is always associated with a serdev device. Fixes: fa9ad876b8e0 ("Bluetooth: hci_qca: Add support for Qualcomm Bluetooth chip wcn3990") Reported-by: Balakrishna Godavarthi <bgodavar@codeaurora.org> Signed-off-by: Matthias Kaehlcke <mka@chromium.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_qca: Reduce delay after sending baudrate request for WCN3990Matthias Kaehlcke2019-03-021-8/+18
| | | | | | | | | The current 300ms delay after a baudrate change is extremely long. For WCN3990 it is sufficient to wait 10ms after the baudrate change request has been sent over the wire. Signed-off-by: Matthias Kaehlcke <mka@chromium.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_qca: Use msleep() instead of open coding itMatthias Kaehlcke2019-02-271-3/+1
| | | | | | | Call msleep() in qca_set_baudrate() instead of reimplementing it. Signed-off-by: Matthias Kaehlcke <mka@chromium.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-02 21:01:12 +0000