[PATCH 0/2] Bluetooth: Disable LL Privacy on Intel JfP (8087:0aaa)

[PATCH 0/2] Bluetooth: Disable LL Privacy on Intel JfP (8087:0aaa)

[Diego Francio]

Since LL Privacy became always-on in v6.14, the Intel 9460/9462/9560
(JfP, USB 8087:0aaa) firmware crashes with "Hardware error 0x0c" every few
minutes when BLE HID devices are paired, dropping every connection.

Patch 1 adds HCI_QUIRK_BROKEN_LL_PRIVACY, patch 2 sets it for 8087:0aaa.
Other controllers are not affected.

Tested on an Intel 9462 machine running Ubuntu 7.0.0-38: with this series
applied there was no Hardware Error in more than 4 hours with a keyboard
and a mouse connected, versus one every 3-15 minutes before. Forcing LL
Privacy off with a module parameter instead ran for 9 hours without one.
The exact HCI command that crashes the firmware was not identified (no
btmon capture of a crash).

Diego Francio (2):
  Bluetooth: Add HCI_QUIRK_BROKEN_LL_PRIVACY
  Bluetooth: btusb: Disable LL Privacy on Intel JfP (8087:0aaa)

 drivers/bluetooth/btusb_main.c   |  7 ++++++-
 include/net/bluetooth/hci.h      | 10 ++++++++++
 include/net/bluetooth/hci_core.h |  4 +++-
 3 files changed, 19 insertions(+), 2 deletions(-)

-- 
2.53.0

[PATCH 1/2] Bluetooth: Add HCI_QUIRK_BROKEN_LL_PRIVACY

[Diego Francio]

Some controllers set the LL Privacy bit in their LE features but their
firmware misbehaves once the resolving list is actually programmed.

Add a quirk that makes ll_privacy_capable() return false for such
controllers, so that the resolving list and the related commands are
never used, mirroring what le_coded_capable() does for
HCI_QUIRK_BROKEN_LE_CODED.

No functional change for controllers that do not set the quirk.

Signed-off-by: Diego Francio <dfrancio@gmail.com>
---
 include/net/bluetooth/hci.h      | 10 ++++++++++
 include/net/bluetooth/hci_core.h |  4 +++-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 1c992e8..3554abf 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -375,6 +375,16 @@ enum {
 	 */
 	HCI_QUIRK_BROKEN_READ_PAGE_SCAN_TYPE,
 
+	/* When this quirk is set, the controller is not treated as LL Privacy
+	 * capable even though it claims to support it in its LE features, so
+	 * the resolving list is never used. This is required for controllers
+	 * whose firmware crashes (Hardware Error) when the resolving list is
+	 * programmed.
+	 *
+	 * This quirk must be set before hci_register_dev is called.
+	 */
+	HCI_QUIRK_BROKEN_LL_PRIVACY,
+
 	__HCI_NUM_QUIRKS,
 };
 
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 9d5d3ab..48fcfb2 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -2066,7 +2066,9 @@ void hci_conn_del_sysfs(struct hci_conn *conn);
 #define scan_coded(dev) (((dev)->le_tx_def_phys & HCI_LE_SET_PHY_CODED) || \
 			 ((dev)->le_rx_def_phys & HCI_LE_SET_PHY_CODED))
 
-#define ll_privacy_capable(dev) ((dev)->le_features[0] & HCI_LE_LL_PRIVACY)
+#define ll_privacy_capable(dev) (((dev)->le_features[0] & HCI_LE_LL_PRIVACY) && \
+				 !hci_test_quirk((dev), \
+						 HCI_QUIRK_BROKEN_LL_PRIVACY))
 #define ll_privacy_enabled(dev) (le_enabled(dev) && ll_privacy_capable(dev))
 
 #define privacy_mode_capable(dev) (ll_privacy_capable(dev) && \
-- 
2.53.0

[PATCH 2/2] Bluetooth: btusb: Disable LL Privacy on Intel JfP (8087:0aaa)

[Diego Francio]

The Intel Jefferson Peak controller (Wireless-AC 9460/9462/9560,
USB 8087:0aaa) reports LL Privacy support, but since commit
e209e5ccc5ac ("Bluetooth: MGMT: Mark LL Privacy as stable") the kernel
uses it whenever the controller claims it. With BLE HID devices paired
(Logitech ERGO K860 and MX Vertical), the controller firmware then
crashes every few minutes:

  Bluetooth: hci0: Hardware error 0x0c
  Bluetooth: hci0: Exception info ...

The reset drops every connection, so keyboard and mouse stall and
reconnect over and over. Older firmware builds (2022.50 build 97 and a
2022.22 build) behave the same, so this is not a firmware version
regression.

Tested on an Intel 9462 (CNVi, Alder Lake PCH) laptop running mainline
builds: 6.1.190 and 6.12.70 are fine, while 6.17.12 and 7.0 crash every
3-15 minutes. With LL Privacy forced off in hci_sync.c on top of
Ubuntu 7.0.0-38, the same hardware and devices ran for 9 hours without
a single Hardware Error. With this patch applied on the same kernel, the
controller then ran for more than 4 hours with the keyboard and mouse
connected and no Hardware Error. The exact HCI command that crashes the
firmware was not identified.

Set HCI_QUIRK_BROKEN_LL_PRIVACY for this USB ID so the resolving list is
not used on it.

Fixes: e209e5ccc5ac ("Bluetooth: MGMT: Mark LL Privacy as stable")
Cc: stable@vger.kernel.org # 6.14+
Signed-off-by: Diego Francio <dfrancio@gmail.com>
---
 drivers/bluetooth/btusb_main.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btusb_main.c b/drivers/bluetooth/btusb_main.c
index 92a78a7..6a75341 100644
--- a/drivers/bluetooth/btusb_main.c
+++ b/drivers/bluetooth/btusb_main.c
@@ -70,6 +70,7 @@ static struct usb_driver btusb_driver;
 #define BTUSB_INTEL_NO_WBS_SUPPORT	BIT(26)
 #define BTUSB_ACTIONS_SEMI		BIT(27)
 #define BTUSB_BARROT			BIT(28)
+#define BTUSB_BROKEN_LL_PRIVACY		BIT(29)
 #define BTUSB_QUALCOMM			BIT(30)
 
 static const struct usb_device_id btusb_table[] = {
@@ -529,7 +530,8 @@ static const struct usb_device_id quirks_table[] = {
 	{ USB_DEVICE(0x8087, 0x0a2b), .driver_info = BTUSB_INTEL_COMBINED },
 	{ USB_DEVICE(0x8087, 0x0aa7), .driver_info = BTUSB_INTEL_COMBINED |
 						     BTUSB_INTEL_BROKEN_SHUTDOWN_LED },
-	{ USB_DEVICE(0x8087, 0x0aaa), .driver_info = BTUSB_INTEL_COMBINED },
+	{ USB_DEVICE(0x8087, 0x0aaa), .driver_info = BTUSB_INTEL_COMBINED |
+						     BTUSB_BROKEN_LL_PRIVACY },
 
 	/* Other Intel Bluetooth devices */
 	{ USB_VENDOR_AND_INTERFACE_INFO(0x8087, 0xe0, 0x01, 0x01),
@@ -4608,6 +4610,9 @@ static int btusb_probe(struct usb_interface *intf,
 			btintel_set_flag(hdev, INTEL_BROKEN_SHUTDOWN_LED);
 	}
 
+	if (id->driver_info & BTUSB_BROKEN_LL_PRIVACY)
+		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LL_PRIVACY);
+
 	if (id->driver_info & BTUSB_MARVELL)
 		hdev->set_bdaddr = btusb_set_bdaddr_marvell;
 
-- 
2.53.0

RE: Bluetooth: Disable LL Privacy on Intel JfP (8087:0aaa)

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1606 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1194809/

---Test result---

Test Summary:
CheckPatch                    PASS      1.08 seconds
VerifyFixes                   PASS      0.09 seconds
VerifySignedoff               PASS      0.09 seconds
GitLint                       PASS      0.44 seconds
SubjectPrefix                 PASS      0.17 seconds
BuildKernel                   PASS      18.84 seconds
CheckAllWarning               PASS      21.80 seconds
CheckSparse                   PASS      23.69 seconds
BuildKernel32                 PASS      19.15 seconds
CheckKernelLLVM               PASS      21.55 seconds
TestRunnerSetup               PASS      419.32 seconds
TestRunner_l2cap-tester       PASS      13.74 seconds
TestRunner_iso-tester         PASS      10.99 seconds
TestRunner_bnep-tester        PASS      2.77 seconds
TestRunner_mgmt-tester        PASS      82.56 seconds
TestRunner_rfcomm-tester      PASS      4.03 seconds
TestRunner_sco-tester         PASS      5.02 seconds
TestRunner_ioctl-tester       PASS      4.14 seconds
TestRunner_mesh-tester        PASS      5.02 seconds
TestRunner_smp-tester         PASS      3.93 seconds
TestRunner_userchan-tester    PASS      2.90 seconds
TestRunner_6lowpan-tester     PASS      4.00 seconds
IncrementalBuild              PASS      21.33 seconds



https://github.com/bluez/bluetooth-next/pull/1008

---
Regards,
Linux Bluetooth