From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:47144 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754900AbbG3AZX (ORCPT ); Wed, 29 Jul 2015 20:25:23 -0400 Subject: Patch "Bluetooth: btusb: Fix secure send command length alignment on Intel 8260" has been added to the 4.1-stable tree To: marcel@holtmann.org, gregkh@linuxfoundation.org, johan.hedberg@intel.com, tedd.an@intel.com Cc: , From: Date: Wed, 29 Jul 2015 17:25:20 -0700 Message-ID: <1438215920212218@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled Bluetooth: btusb: Fix secure send command length alignment on Intel 8260 to the 4.1-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: bluetooth-btusb-fix-secure-send-command-length-alignment-on-intel-8260.patch and it can be found in the queue-4.1 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From e66890a96abbb746e1229c3067471be36dc49b34 Mon Sep 17 00:00:00 2001 From: Marcel Holtmann Date: Sun, 7 Jun 2015 09:47:08 +0200 Subject: Bluetooth: btusb: Fix secure send command length alignment on Intel 8260 From: Marcel Holtmann commit e66890a96abbb746e1229c3067471be36dc49b34 upstream. This patch fixes the command length alignment issue for Intel Bluetooth 8260. The length of parameters in the firmware downloading command must be multiplication of 4. If not, the command must append Intel_NOP command with extra parameters, zeros, at the end, and the firmware file is already included Intel_NOP command for alignment. This patch checks the next command and if the next command is Intel_NOP command, it reads the Intel_NOP command and send them together. For example, if the data from the firmware file looks like this: 8E FC 03 11 22 33 02 FC 03 00 00 00 Previously, btusb sends two commands: 09 FC 06 8E FC 03 11 22 33 09 FC 06 02 FC 03 00 00 00 This won't work because the length of parameters are 6 which violates the 4 byte alignment. This patch will append them together and send as one command: 09 FC 0C 8E FC 03 11 22 33 02 FC 03 00 00 00 Based on previous work from Tedd Ho-Jeong An Reported-by: Tedd Ho-Jeong An Signed-off-by: Marcel Holtmann Tested-by: Tedd Ho-Jeong An Signed-off-by: Johan Hedberg Signed-off-by: Greg Kroah-Hartman --- drivers/bluetooth/btusb.c | 34 ++++++++++++++++++++++------------ 1 file changed, 22 insertions(+), 12 deletions(-) --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -2336,6 +2336,7 @@ static int btusb_setup_intel_new(struct struct intel_boot_params *params; const struct firmware *fw; const u8 *fw_ptr; + u32 frag_len; char fwname[64]; ktime_t calltime, delta, rettime; unsigned long long duration; @@ -2542,24 +2543,33 @@ static int btusb_setup_intel_new(struct } fw_ptr = fw->data + 644; + frag_len = 0; while (fw_ptr - fw->data < fw->size) { - struct hci_command_hdr *cmd = (void *)fw_ptr; - u8 cmd_len; + struct hci_command_hdr *cmd = (void *)(fw_ptr + frag_len); - cmd_len = sizeof(*cmd) + cmd->plen; + frag_len += sizeof(*cmd) + cmd->plen; - /* Send each command from the firmware data buffer as - * a single Data fragment. + /* The paramter length of the secure send command requires + * a 4 byte alignment. It happens so that the firmware file + * contains proper Intel_NOP commands to align the fragments + * as needed. + * + * Send set of commands with 4 byte alignment from the + * firmware data buffer as a single Data fragement. */ - err = btusb_intel_secure_send(hdev, 0x01, cmd_len, fw_ptr); - if (err < 0) { - BT_ERR("%s: Failed to send firmware data (%d)", - hdev->name, err); - goto done; - } + if (!(frag_len % 4)) { + err = btusb_intel_secure_send(hdev, 0x01, frag_len, + fw_ptr); + if (err < 0) { + BT_ERR("%s: Failed to send firmware data (%d)", + hdev->name, err); + goto done; + } - fw_ptr += cmd_len; + fw_ptr += frag_len; + frag_len = 0; + } } set_bit(BTUSB_FIRMWARE_LOADED, &data->flags); Patches currently in stable-queue which might be from marcel@holtmann.org are queue-4.1/bluetooth-btusb-correct-typo-in-roper-class-1-bluetooth-dongle.patch queue-4.1/bluetooth-btusb-fix-secure-send-command-length-alignment-on-intel-8260.patch queue-4.1/bluetooth-btbcm-allow-btbcm_read_verbose_config-to-fail-on-apple.patch queue-4.1/ieee802154-fix-sockaddr_ieee802154-implicit-padding-information-leak.patch queue-4.1/bluetooth-btusb-fix-memory-leak-in-intel-setup-routine.patch queue-4.1/bluetooth-fix-race-condition-with-user-channel-and-setup-stage.patch