From: Zijun Hu <quic_zijuhu@quicinc.com>
To: <luiz.dentz@gmail.com>, <luiz.von.dentz@intel.com>,
<marcel@holtmann.org>
Cc: <quic_zijuhu@quicinc.com>, <linux-bluetooth@vger.kernel.org>,
<wt@penguintechs.org>, <regressions@lists.linux.dev>,
<pmenzel@molgen.mpg.de>, <krzysztof.kozlowski@linaro.org>,
<lk_sii@163.com>, <stable@vger.kernel.org>
Subject: [PATCH v2] Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot
Date: Thu, 16 May 2024 21:31:34 +0800 [thread overview]
Message-ID: <1715866294-1549-1-git-send-email-quic_zijuhu@quicinc.com> (raw)
Commit 272970be3dab ("Bluetooth: hci_qca: Fix driver shutdown on closed
serdev") will cause below regression issue:
BT can't be enabled after below steps:
cold boot -> enable BT -> disable BT -> warm reboot -> BT enable failure
if property enable-gpios is not configured within DT|ACPI for QCA6390.
The commit is to fix a use-after-free issue within qca_serdev_shutdown()
by adding condition to avoid the serdev is flushed or wrote after closed
but also introduces this regression issue regarding above steps since the
VSC is not sent to reset controller during warm reboot.
Fixed by sending the VSC to reset controller within qca_serdev_shutdown()
once BT was ever enabled, and the use-after-free issue is also fixed by
this change since the serdev is still opened before it is flushed or wrote.
Verified by the reported machine Dell XPS 13 9310 laptop over below two
kernel commits:
commit e00fc2700a3f ("Bluetooth: btusb: Fix triggering coredump
implementation for QCA") of bluetooth-next tree.
commit b23d98d46d28 ("Bluetooth: btusb: Fix triggering coredump
implementation for QCA") of linus mainline tree.
Fixes: 272970be3dab ("Bluetooth: hci_qca: Fix driver shutdown on closed serdev")
Cc: stable@vger.kernel.org
Reported-by: Wren Turkal <wt@penguintechs.org>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218726
Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
Tested-by: Wren Turkal <wt@penguintechs.org>
---
V1 -> V2: Add comments and more commit messages
V1 discussion link:
https://lore.kernel.org/linux-bluetooth/d553edef-c1a4-4d52-a892-715549d31ebe@163.com/T/#t
drivers/bluetooth/hci_qca.c | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
index 0c9c9ee56592..9a0bc86f9aac 100644
--- a/drivers/bluetooth/hci_qca.c
+++ b/drivers/bluetooth/hci_qca.c
@@ -2450,15 +2450,27 @@ static void qca_serdev_shutdown(struct device *dev)
struct qca_serdev *qcadev = serdev_device_get_drvdata(serdev);
struct hci_uart *hu = &qcadev->serdev_hu;
struct hci_dev *hdev = hu->hdev;
- struct qca_data *qca = hu->priv;
const u8 ibs_wake_cmd[] = { 0xFD };
const u8 edl_reset_soc_cmd[] = { 0x01, 0x00, 0xFC, 0x01, 0x05 };
if (qcadev->btsoc_type == QCA_QCA6390) {
- if (test_bit(QCA_BT_OFF, &qca->flags) ||
- !test_bit(HCI_RUNNING, &hdev->flags))
+ /* The purpose of sending the VSC is to reset SOC into a initial
+ * state and the state will ensure next hdev->setup() success.
+ * if HCI_QUIRK_NON_PERSISTENT_SETUP is set, it means that
+ * hdev->setup() can do its job regardless of SoC state, so
+ * don't need to send the VSC.
+ * if HCI_SETUP is set, it means that hdev->setup() was never
+ * invoked and the SOC is already in the initial state, so
+ * don't also need to send the VSC.
+ */
+ if (test_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks) ||
+ hci_dev_test_flag(hdev, HCI_SETUP))
return;
+ /* The serdev must be in open state when conrol logic arrives
+ * here, so also fix the use-after-free issue caused by that
+ * the serdev is flushed or wrote after it is closed.
+ */
serdev_device_write_flush(serdev);
ret = serdev_device_write_buf(serdev, ibs_wake_cmd,
sizeof(ibs_wake_cmd));
--
2.7.4
next reply other threads:[~2024-05-16 13:32 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-05-16 13:31 Zijun Hu [this message]
2024-05-16 14:55 ` [PATCH v2] Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot Lk Sii
2024-05-16 15:55 ` Luiz Augusto von Dentz
2024-05-21 14:50 ` Lk Sii
2024-05-21 15:48 ` Luiz Augusto von Dentz
2024-05-21 16:00 ` Krzysztof Kozlowski
2024-05-22 13:31 ` Lk Sii
2024-05-22 14:25 ` Luiz Augusto von Dentz
2024-05-22 23:25 ` Lk Sii
2024-05-23 0:17 ` Lk Sii
2024-05-30 13:33 ` Lk Sii
2024-06-03 19:27 ` Luiz Augusto von Dentz
2024-06-04 13:23 ` Lk Sii
2024-05-21 16:02 ` Krzysztof Kozlowski
2024-06-04 14:25 ` Lk Sii
2024-06-04 15:18 ` Krzysztof Kozlowski
2024-06-05 1:49 ` Lk Sii
2024-06-05 7:14 ` Krzysztof Kozlowski
2024-06-06 12:54 ` Lk Sii
2024-06-10 13:17 ` Lk Sii
2024-06-10 13:24 ` Krzysztof Kozlowski
2024-06-10 14:02 ` Luiz Augusto von Dentz
2024-06-10 14:19 ` Krzysztof Kozlowski
2024-05-21 19:26 ` Dmitry Baryshkov
2024-06-10 15:50 ` patchwork-bot+bluetooth
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1715866294-1549-1-git-send-email-quic_zijuhu@quicinc.com \
--to=quic_zijuhu@quicinc.com \
--cc=krzysztof.kozlowski@linaro.org \
--cc=linux-bluetooth@vger.kernel.org \
--cc=lk_sii@163.com \
--cc=luiz.dentz@gmail.com \
--cc=luiz.von.dentz@intel.com \
--cc=marcel@holtmann.org \
--cc=pmenzel@molgen.mpg.de \
--cc=regressions@lists.linux.dev \
--cc=stable@vger.kernel.org \
--cc=wt@penguintechs.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).