Skip to contentSkip to conversation

Bluetooth: btmtk: add event filter to filter specific event

PATCH Superseded Chris Lu 3 participants 4 messages Apr 12 – Apr 16

Subsystems (2)
Bluetooth drivers Arm MediaTek

v3 of 4 Superseded Latest is v4 →

lore
Share & tools
lore

Chris Lu

author
#0 lore raw

PATCH v3 1/1 Bluetooth: btmtk: add event filter to filter specific event

Add an event filter to filter event with specific opcode to prevent BT stack from receiving unexpected event.

Event with opcode 0xfc5d is generated when MediaTek's Bluetooth enable firmware logs and is not expected to be sent to userspace.

Signed-off-by Chris Lu <[email protected]>

---
v1 -> v2 : update commit message
v2 -> v3 : add boundary check in btmtk.c in btmtk_recv_event; keep using
hci_recv_frame if CONFIG_BT_MTK wasn't defined in btmtk.h

---
 drivers/bluetooth/btmtk.c | 23 +++++++++++++++++++++++
 drivers/bluetooth/btmtk.h |  7 +++++++
 drivers/bluetooth/btusb.c |  2 ++
 3 files changed, 32 insertions(+)
drivers/bluetooth/btmtk.c +23 -0
index 55516b4602db..78e84ecbbb91 100644
@@ -1503,6 +1503,29 @@ int btmtk_usb_shutdown(struct hci_dev *hdev)
 	return 0;
 }
 EXPORT_SYMBOL_GPL(btmtk_usb_shutdown);
+
+int btmtk_recv_event(struct hci_dev *hdev, struct sk_buff *skb)
+{
+	struct hci_event_hdr *hdr = (void *)skb->data;
+	struct hci_ev_cmd_complete *ec;
+
+	if (hdr->evt == HCI_EV_CMD_COMPLETE &&
+	    skb->len >= HCI_EVENT_HDR_SIZE + sizeof(*ec)) {
+		u16 opcode;
+
+		ec = (void *)(skb->data + HCI_EVENT_HDR_SIZE);
+		opcode = __le16_to_cpu(ec->opcode);
+
+		/* Filter vendor opcode */
+		if (opcode == 0xfc5d) {
+			kfree_skb(skb);
+			return 0;
+		}
+	}
+
+	return hci_recv_frame(hdev, skb);
+}
+EXPORT_SYMBOL_GPL(btmtk_recv_event);
 #endif
 
 MODULE_AUTHOR("Sean Wang <[email protected]>");
drivers/bluetooth/btmtk.h +7 -0
index adaf385626ee..c93652508f14 100644
@@ -218,6 +218,8 @@ int btmtk_usb_suspend(struct hci_dev *hdev);
 int btmtk_usb_setup(struct hci_dev *hdev);
 
 int btmtk_usb_shutdown(struct hci_dev *hdev);
+
+int btmtk_recv_event(struct hci_dev *hdev, struct sk_buff *skb);
 #else
 
 static inline int btmtk_set_bdaddr(struct hci_dev *hdev,

@@ -296,4 +298,9 @@ static inline int btmtk_usb_shutdown(struct hci_dev *hdev)
 {
 	return -EOPNOTSUPP;
 }
+
+static inline int btmtk_recv_event(struct hci_dev *hdev, struct sk_buff *skb)
+{
+	return hci_recv_frame(hdev, skb);
+}
 #endif
drivers/bluetooth/btusb.c +2 -0
index f9d515ee9124..daf8a387e660 100644
@@ -4150,6 +4150,8 @@ static int btusb_probe(struct usb_interface *intf,
 	} else if (id->driver_info & BTUSB_MEDIATEK) {
 		/* Allocate extra space for Mediatek device */
 		priv_size += sizeof(struct btmtk_data);
+
+		data->recv_event = btmtk_recv_event;
 	}
 
 	data->recv_acl = hci_recv_frame;
Signature · 1 line
2.45.2
#1 lore raw

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1080298

---Test result---

Test Summary:

CheckPatch                    PENDING   0.38 seconds
GitLint                       PENDING   0.25 seconds
SubjectPrefix                 PASS      0.11 seconds
BuildKernel                   PASS      24.41 seconds
CheckAllWarning               PASS      26.68 seconds
CheckSparse                   PASS      25.28 seconds
BuildKernel32                 PASS      23.41 seconds
TestRunnerSetup               PASS      528.57 seconds
TestRunner_l2cap-tester       PASS      27.63 seconds
TestRunner_iso-tester         PASS      35.57 seconds
TestRunner_bnep-tester        PASS      6.29 seconds
TestRunner_mgmt-tester        FAIL      111.27 seconds
TestRunner_rfcomm-tester      PASS      9.51 seconds
TestRunner_sco-tester         FAIL      14.47 seconds
TestRunner_ioctl-tester       PASS      10.27 seconds
TestRunner_mesh-tester        FAIL      11.67 seconds
TestRunner_smp-tester         PASS      8.55 seconds
TestRunner_userchan-tester    PASS      7.14 seconds
TestRunner_6lowpan-tester     FAIL      8.74 seconds
IncrementalBuild              PENDING   0.26 seconds

Details
##############################
Test: CheckPatch - PENDING
Desc: Run checkpatch.pl script
Output:

##############################
Test: GitLint - PENDING
Desc: Run gitlint
Output:

##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner Output:
Total: 494, Passed: 489 (99.0%), Failed: 1, Not Run: 4

Failed Test Cases
Read Exp Feature - Success Failed 0.107 seconds
##############################
Test: TestRunner_sco-tester - FAIL
Desc: Run sco-tester with test-runner
Output:
WARNING: possible circular locking dependency detected
7.0.0-rc2-g937faf72cfaf #1 Not tainted
------------------------------------------------------
kworker/u5:2/117 is trying to acquire lock:
ffff888002166240 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at: sco_connect_cfm+0x358/0x8d0

but task is already holding lock:
ffff888002094c20 (&conn->lock){+.+.}-{3:3}, at: sco_connect_cfm+0x22d/0x8d0

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-> #1 (&conn->lock){+.+.}-{3:3}:

       lock_acquire+0xf7/0x2c0
       _raw_spin_lock+0x2a/0x40
       sco_sock_connect+0x4d7/0x1280
       __sys_connect+0x1a3/0x260
       __x64_sys_connect+0x6e/0xb0
       do_syscall_64+0xa0/0x570
       entry_SYSCALL_64_after_hwframe+0x74/0x7c

-> #0 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}:

       check_prev_add+0xe9/0xc70
       __lock_acquire+0x1457/0x1df0
       lock_acquire+0xf7/0x2c0
       lock_sock_nested+0x36/0xd0
       sco_connect_cfm+0x358/0x8d0
       hci_sync_conn_complete_evt+0x3d3/0x8e0
       hci_event_packet+0x74f/0xb10
       hci_rx_work+0x398/0xd00
       process_scheduled_works+0xb16/0x1ac0
       worker_thread+0x4ff/0xba0
       kthread+0x368/0x490
       ret_from_fork+0x498/0x7e0
       ret_from_fork_asm+0x19/0x30

other info that might help us debug this:

...

BUG: sleeping function called from invalid context at net/core/sock.c:3782

in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 117, name: kworker/u5:2
preempt_count: 1, expected: 0
RCU nest depth: 0, expected: 0
INFO: lockdep is turned off.

CPU: 0 UID: 0 PID: 117 Comm: kworker/u5:2 Not tainted 7.0.0-rc2-g937faf72cfaf #1 PREEMPT(lazy) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014
Workqueue: hci0 hci_rx_work
Call Trace:
 <TASK>
 dump_stack_lvl+0x49/0x60
 __might_resched+0x2ea/0x500
 lock_sock_nested+0x47/0xd0
 ? sco_connect_cfm+0x358/0x8d0
 sco_connect_cfm+0x358/0x8d0
 ? hci_debugfs_create_conn+0x190/0x210
 ? __pfx_sco_connect_cfm+0x10/0x10
 hci_sync_conn_complete_evt+0x3d3/0x8e0
 hci_event_packet+0x74f/0xb10
 ? __pfx_hci_sync_conn_complete_evt+0x10/0x10
 ? __pfx_hci_event_packet+0x10/0x10
 ? mark_held_locks+0x49/0x80
 ? lockdep_hardirqs_on_prepare+0xd4/0x180
 ? _raw_spin_unlock_irqrestore+0x2c/0x50
 hci_rx_work+0x398/0xd00
 process_scheduled_works+0xb16/0x1ac0
 ? __pfx_process_scheduled_works+0x10/0x10
 ? lock_acquire+0xf7/0x2c0
 ? lock_is_held_type+0x9b/0x110
 ? __pfx_hci_rx_work+0x10/0x10
 worker_thread+0x4ff/0xba0
 ? _raw_spin_unlock_irqrestore+0x2c/0x50
 ? __pfx_worker_thread+0x10/0x10
 kthread+0x368/0x490
 ? _raw_spin_unlock_irq+0x23/0x40
 ? __pfx_kthread+0x10/0x10
 ret_from_fork+0x498/0x7e0
 ? __pfx_ret_from_fork+0x10/0x10
 ? __switch_to+0x9e4/0xe50
 ? __switch_to_asm+0x32/0x60

...
Total: 30, Passed: 30 (100.0%), Failed: 0, Not Run: 0
##############################
Test: TestRunner_mesh-tester - FAIL
Desc: Run mesh-tester with test-runner Output:
Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0

Failed Test Cases

Mesh - Send cancel - 1                               Timed out    1.820 seconds
Mesh - Send cancel - 2                               Timed out    1.994 seconds

##############################
Test: TestRunner_6lowpan-tester - FAIL
Desc: Run 6lowpan-tester with test-runner
Output:
WARNING: possible circular locking dependency detected 7.0.0-rc2-g937faf72cfaf #1 Not tainted
------------------------------------------------------
kworker/0:1/11 is trying to acquire lock:
ffff888002780140 ((wq_completion)hci0#2){+.+.}-{0:0}, at: touch_wq_lockdep_map+0x75/0x180

but task is already holding lock:
fffffffface4d720 (rtnl_mutex){+.+.}-{4:4}, at: lowpan_unregister_netdev+0xd/0x30

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-> #4 (rtnl_mutex){+.+.}-{4:4}:

       lock_acquire+0xf7/0x2c0
       __mutex_lock+0x16b/0x1fc0
       lowpan_register_netdev+0x11/0x30
       chan_ready_cb+0x836/0xd00
       l2cap_recv_frame+0x6a06/0x8920
       l2cap_recv_acldata+0x790/0xdf0
       hci_rx_work+0x500/0xd00
       process_scheduled_works+0xb16/0x1ac0
       worker_thread+0x4ff/0xba0
       kthread+0x368/0x490
       ret_from_fork+0x498/0x7e0
       ret_from_fork_asm+0x19/0x30

-> #3 (&chan->lock#3/1){+.+.}-{4:4}:

       lock_acquire+0xf7/0x2c0
       __mutex_lock+0x16b/0x1fc0
       l2cap_chan_connect+0x74e/0x1980
       lowpan_control_write+0x523/0x660
       full_proxy_write+0x10b/0x190
       vfs_write+0x1c0/0xf60
       ksys_write+0xf1/0x1d0
       do_syscall_64+0xa0/0x570
       entry_SYSCALL_64_after_hwframe+0x74/0x7c

-> #2 (&conn->lock){+.+.}-{4:4}:
...
Total: 8, Passed: 8 (100.0%), Failed: 0, Not Run: 0
##############################
Test: IncrementalBuild - PENDING
Desc: Incremental build with the patches in the series Output:

https://github.com/bluez/bluetooth-next/pull/71

---
Regards,
Linux Bluetooth

build bot
#2 lore raw
In reply to Chris Lu
kernel test robot noticed the following build errors:

Hi Chris,

kernel test robot noticed the following build errors:

[auto build test ERROR on bluetooth/master]
[also build test ERROR on bluetooth-next/master linus/master v7.0 next-20260414] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Chris-Lu/Bluetooth-btmtk-add-event-filter-to-filter-specific-event/20260415-122458
base:   https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git master
patch link:    https://lore.kernel.org/r/20260412090242.1129701-1-chris.lu%40mediatek.com
patch subject: [PATCH v3] Bluetooth: btmtk: add event filter to filter specific event
config: x86_64-randconfig-161-20260415 (https://download.01.org/0day-ci/archive/20260416/[email protected]/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
smatch: v0.5.0-9007-gcf3ea02b
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260416/[email protected]/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <[email protected]>
| Closes: https://lore.kernel.org/oe-kbuild-all/[email protected]/

All errors (new ones prefixed by >>):

ld: drivers/bluetooth/btusb.o: in function `btusb_probe':

>> drivers/bluetooth/btusb.c:4142:(.text+0x6c1a): undefined reference to `btmtk_recv_event'

vim +4142 drivers/bluetooth/btusb.c

4023
4024 static int btusb_probe(struct usb_interface *intf,
4025 const struct usb_device_id *id)
4026 {
4027 struct usb_endpoint_descriptor *ep_desc;
4028 struct gpio_desc *reset_gpio;
4029 struct btusb_data *data;
4030 struct hci_dev *hdev;
4031 unsigned ifnum_base;
4032 int i, err, priv_size;
4033
4034 BT_DBG("intf %p id %p", intf, id);
4035
4036 if ((id->driver_info & BTUSB_IFNUM_2) &&
4037 (intf->cur_altsetting->desc.bInterfaceNumber != 0) &&
4038 (intf->cur_altsetting->desc.bInterfaceNumber != 2))
4039 return -ENODEV;
4040
4041 ifnum_base = intf->cur_altsetting->desc.bInterfaceNumber;
4042
4043 if (!id->driver_info) {
4044 const struct usb_device_id *match;
4045
4046 match = usb_match_id(intf, quirks_table);
4047 if (match)
4048 id = match;
4049 }
4050
4051 if (id->driver_info == BTUSB_IGNORE)
4052 return -ENODEV;
4053
4054 if (id->driver_info & BTUSB_ATH3012) {
4055 struct usb_device *udev = interface_to_usbdev(intf);
4056
4057 /* Old firmware would otherwise let ath3k driver load
4058 * patch and sysconfig files
4059 */
4060 if (le16_to_cpu(udev->descriptor.bcdDevice) <= 0x0001 &&
4061 !btusb_qca_need_patch(udev))
4062 return -ENODEV;
4063 }
4064
4065 data = kzalloc_obj(*data);
4066 if (!data)
4067 return -ENOMEM;
4068
4069 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
4070 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
4071
4072 if (!data->intr_ep && usb_endpoint_is_int_in(ep_desc)) {
4073 data->intr_ep = ep_desc;
4074 continue;
4075 }
4076
4077 if (!data->bulk_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
4078 data->bulk_tx_ep = ep_desc;
4079 continue;
4080 }
4081
4082 if (!data->bulk_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
4083 data->bulk_rx_ep = ep_desc;
4084 continue;
4085 }
4086 }
4087
4088 if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep) {
4089 kfree(data);
4090 return -ENODEV;
4091 }
4092
4093 if (id->driver_info & BTUSB_AMP) {
4094 data->cmdreq_type = USB_TYPE_CLASS | 0x01;
4095 data->cmdreq = 0x2b;
4096 } else {
4097 data->cmdreq_type = USB_TYPE_CLASS;
4098 data->cmdreq = 0x00;
4099 }
4100
4101 data->udev = interface_to_usbdev(intf);
4102 data->intf = intf;
4103
4104 INIT_WORK(&data->work, btusb_work);
4105 INIT_WORK(&data->waker, btusb_waker);
4106 INIT_DELAYED_WORK(&data->rx_work, btusb_rx_work);
4107
4108 skb_queue_head_init(&data->acl_q);
4109
4110 init_usb_anchor(&data->deferred);
4111 init_usb_anchor(&data->tx_anchor);
4112 spin_lock_init(&data->txlock);
4113
4114 init_usb_anchor(&data->intr_anchor);
4115 init_usb_anchor(&data->bulk_anchor);
4116 init_usb_anchor(&data->isoc_anchor);
4117 init_usb_anchor(&data->diag_anchor);
4118 init_usb_anchor(&data->ctrl_anchor);
4119 spin_lock_init(&data->rxlock);
4120
4121 priv_size = 0;
4122
4123 data->recv_event = hci_recv_frame;
4124 data->recv_bulk = btusb_recv_bulk;
4125
4126 if (id->driver_info & BTUSB_INTEL_COMBINED) {
4127 /* Allocate extra space for Intel device */
4128 priv_size += sizeof(struct btintel_data);
4129
4130 /* Override the rx handlers */
4131 data->recv_event = btintel_recv_event;
4132 data->recv_bulk = btusb_recv_bulk_intel;
4133 } else if (id->driver_info & BTUSB_REALTEK) {
4134 /* Allocate extra space for Realtek device */
4135 priv_size += sizeof(struct btrealtek_data);
4136
4137 data->recv_event = btusb_recv_event_realtek;
4138 } else if (id->driver_info & BTUSB_MEDIATEK) {
4139 /* Allocate extra space for Mediatek device */
4140 priv_size += sizeof(struct btmtk_data);
4141

> 4142			data->recv_event = btmtk_recv_event;
  4143		}
  4144	
  4145		data->recv_acl = hci_recv_frame;
  4146	
  4147		hdev = hci_alloc_dev_priv(priv_size);
  4148		if (!hdev) {
  4149			kfree(data);
  4150			return -ENOMEM;
  4151		}
  4152	
  4153		hdev->bus = HCI_USB;
  4154		hci_set_drvdata(hdev, data);
  4155	
  4156		data->hdev = hdev;
  4157	
  4158		SET_HCIDEV_DEV(hdev, &intf->dev);
  4159	
  4160		reset_gpio = gpiod_get_optional(&data->udev->dev, "reset",
  4161						GPIOD_OUT_LOW);
  4162		if (IS_ERR(reset_gpio)) {
  4163			err = PTR_ERR(reset_gpio);
  4164			goto out_free_dev;
  4165		} else if (reset_gpio) {
  4166			data->reset_gpio = reset_gpio;
  4167		}
  4168	
  4169		hdev->open    = btusb_open;
  4170		hdev->close   = btusb_close;
  4171		hdev->flush   = btusb_flush;
  4172		hdev->send    = btusb_send_frame;
  4173		hdev->notify  = btusb_notify;
  4174		hdev->wakeup  = btusb_wakeup;

4175 hdev->hci_drv = &btusb_hci_drv;
4176

Signature · 2 lines
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
build bot
#3 lore raw
In reply to Chris Lu
kernel test robot noticed the following build errors:

Hi Chris,

kernel test robot noticed the following build errors:

[auto build test ERROR on bluetooth/master]
[also build test ERROR on bluetooth-next/master linus/master v7.0 next-20260415] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Chris-Lu/Bluetooth-btmtk-add-event-filter-to-filter-specific-event/20260415-122458
base:   https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git master
patch link:    https://lore.kernel.org/r/20260412090242.1129701-1-chris.lu%40mediatek.com
patch subject: [PATCH v3] Bluetooth: btmtk: add event filter to filter specific event
config: i386-randconfig-051-20260416 (https://download.01.org/0day-ci/archive/20260416/[email protected]/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260416/[email protected]/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <[email protected]>
| Closes: https://lore.kernel.org/oe-kbuild-all/[email protected]/

All errors (new ones prefixed by >>, old ones prefixed by <<):

>> ERROR: modpost: "btmtk_recv_event" [drivers/bluetooth/btusb.ko] undefined!
Signature · 2 lines
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki