[PATCH V7] Bluetooth: btnxpuart: Add M.2 Bluetooth device support using pwrseq

[PATCH V7] Bluetooth: btnxpuart: Add M.2 Bluetooth device support using pwrseq

[Sherry Sun (OSS)]

From: Sherry Sun <sherry.sun@nxp.com>

Power supply to the M.2 Bluetooth device attached to the host using M.2
connector is controlled using the 'uart' pwrseq device. So add support
for getting the pwrseq device if the OF graph link is present.

Once obtained, pwrseq_power_on() is called to power up the M.2 Bluetooth
card. The power sequencer descriptor is obtained via pwrseq_get() with
the UART controller device (serdev->ctrl->dev), since the OF graph
link is defined on the UART controller node.

Also add the explicit pwrseq_put() call in all exit paths, pwrseq_put()
already calls pwrseq_power_off() internally, so no separate
pwrseq_power_off() call is needed.

Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
---
Changes in V7:
1. Seperate this Bluetooth patch from the V6 M.2 patch set so that it
can be applied directly to bluetooth-next tree, no code change.
https://lore.kernel.org/all/20260713023435.235765-1-sherry.sun@oss.nxp.com/
---
 drivers/bluetooth/btnxpuart.c | 34 ++++++++++++++++++++++++++++++----
 1 file changed, 30 insertions(+), 4 deletions(-)

diff --git a/drivers/bluetooth/btnxpuart.c b/drivers/bluetooth/btnxpuart.c
index 0bb300eef157..81a11ac05114 100644
--- a/drivers/bluetooth/btnxpuart.c
+++ b/drivers/bluetooth/btnxpuart.c
@@ -9,6 +9,8 @@
 
 #include <linux/serdev.h>
 #include <linux/of.h>
+#include <linux/of_graph.h>
+#include <linux/pwrseq/consumer.h>
 #include <linux/skbuff.h>
 #include <linux/unaligned.h>
 #include <linux/firmware.h>
@@ -211,6 +213,7 @@ struct btnxpuart_dev {
 
 	struct ps_data psdata;
 	struct btnxpuart_data *nxp_data;
+	struct pwrseq_desc *pwrseq;
 	struct reset_control *pdn;
 	struct hci_uart hu;
 };
@@ -1872,11 +1875,26 @@ static int nxp_serdev_probe(struct serdev_device *serdev)
 		return err;
 	}
 
+	if (of_graph_is_present(dev_of_node(&serdev->ctrl->dev))) {
+		struct pwrseq_desc *pwrseq;
+
+		pwrseq = pwrseq_get(&serdev->ctrl->dev, "uart");
+		if (IS_ERR(pwrseq))
+			return dev_err_probe(&serdev->dev, PTR_ERR(pwrseq),
+					     "failed to get pwrseq\n");
+
+		nxpdev->pwrseq = pwrseq;
+		err = pwrseq_power_on(pwrseq);
+		if (err)
+			goto err_pwrseq_put;
+	}
+
 	/* Initialize and register HCI device */
 	hdev = hci_alloc_dev();
 	if (!hdev) {
 		dev_err(&serdev->dev, "Can't allocate HCI device\n");
-		return -ENOMEM;
+		err = -ENOMEM;
+		goto err_pwrseq_put;
 	}
 
 	reset_control_deassert(nxpdev->pdn);
@@ -1907,13 +1925,16 @@ static int nxp_serdev_probe(struct serdev_device *serdev)
 	if (bacmp(&ba, BDADDR_ANY))
 		hci_set_quirk(hdev, HCI_QUIRK_USE_BDADDR_PROPERTY);
 
-	if (hci_register_dev(hdev) < 0) {
+	err = hci_register_dev(hdev);
+	if (err < 0) {
 		dev_err(&serdev->dev, "Can't register HCI device\n");
 		goto probe_fail;
 	}
 
-	if (ps_setup(hdev))
+	if (ps_setup(hdev)) {
+		err = -ENODEV;
 		goto probe_fail_unregister;
+	}
 
 	hci_devcd_register(hdev, nxp_coredump, nxp_coredump_hdr,
 			   nxp_coredump_notify);
@@ -1925,7 +1946,10 @@ static int nxp_serdev_probe(struct serdev_device *serdev)
 probe_fail:
 	reset_control_assert(nxpdev->pdn);
 	hci_free_dev(hdev);
-	return -ENODEV;
+err_pwrseq_put:
+	if (nxpdev->pwrseq)
+		pwrseq_put(nxpdev->pwrseq);
+	return err;
 }
 
 static void nxp_serdev_remove(struct serdev_device *serdev)
@@ -1952,6 +1976,8 @@ static void nxp_serdev_remove(struct serdev_device *serdev)
 	ps_cleanup(nxpdev);
 	hci_unregister_dev(hdev);
 	reset_control_assert(nxpdev->pdn);
+	if (nxpdev->pwrseq)
+		pwrseq_put(nxpdev->pwrseq);
 	hci_free_dev(hdev);
 }
 

base-commit: 3fe08b9796f36ef437ab9328e7dd1e5ff2d66603
-- 
2.50.1

Re: [PATCH V7] Bluetooth: btnxpuart: Add M.2 Bluetooth device support using pwrseq

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] Initialization ordering race in probe where the device is exposed to the system before synchronization primitives are fully initialized.
- [High] Teardown ordering bug leading to Use-After-Destroy of synchronization primitives during device removal.
--

--- Patch [1]: [PATCH V7] Bluetooth: btnxpuart: Add M.2 Bluetooth device support using pwrseq ---
commit aa33fbd5b00c9432b2b3b5cc158c49ae5ac11d72
Author: Sherry Sun <sherry.sun@nxp.com>

Bluetooth: btnxpuart: Add M.2 Bluetooth device support using pwrseq
    
Power supply to the M.2 Bluetooth device attached to the host using M.2
connector is controlled using the 'uart' pwrseq device. So add support
for getting the pwrseq device if the OF graph link is present.

> diff --git a/drivers/bluetooth/btnxpuart.c b/drivers/bluetooth/btnxpuart.c
> index 0bb300eef157c..81a11ac051146 100644
> --- a/drivers/bluetooth/btnxpuart.c
> +++ b/drivers/bluetooth/btnxpuart.c

[ ... ]

> @@ -1907,13 +1925,16 @@ static int nxp_serdev_probe(struct serdev_device *serdev)
>  	if (bacmp(&ba, BDADDR_ANY))
>  		hci_set_quirk(hdev, HCI_QUIRK_USE_BDADDR_PROPERTY);
>  
> -	if (hci_register_dev(hdev) < 0) {
> +	err = hci_register_dev(hdev);
> +	if (err < 0) {
>  		dev_err(&serdev->dev, "Can't register HCI device\n");
>  		goto probe_fail;
>  	}
>  
> -	if (ps_setup(hdev))
> +	if (ps_setup(hdev)) {

[Severity: High]
This isn't a bug introduced by this patch, but does this probe initialization
order expose the device to incoming traffic before its synchronization
primitives are fully set up?

In nxp_serdev_probe(), hci_register_dev() is called before ps_setup().
hci_register_dev() exposes the device and queues the power_on work which
calls hci_dev_do_open() -> btnxpuart_open() -> serdev_device_open().

Once opened, incoming UART data can trigger btnxpuart_receive_buf().
This calls ps_start_timer(), which executes mod_timer(). Because ps_setup()
(which initializes the timer via timer_setup()) hasn't executed yet, could
this cause an Oops on an uninitialized timer?

> +		err = -ENODEV;
>  		goto probe_fail_unregister;
> +	}
>  
>  	hci_devcd_register(hdev, nxp_coredump, nxp_coredump_hdr,
>  			   nxp_coredump_notify);

[ ... ]

> @@ -1952,6 +1976,8 @@ static void nxp_serdev_remove(struct serdev_device *serdev)
>  	ps_cleanup(nxpdev);
>  	hci_unregister_dev(hdev);
>  	reset_control_assert(nxpdev->pdn);

[Severity: High]
This is a pre-existing issue, but does this teardown order lead to a
use-after-destroy of the synchronization primitives?

In nxp_serdev_remove(), ps_cleanup() is called before hci_unregister_dev().
ps_cleanup() explicitly destroys psdata->ps_lock and shuts down
psdata->ps_timer.

However, the underlying UART (serdev) is not closed until
hci_unregister_dev() executes (which calls hci_dev_do_close() ->
btnxpuart_close() -> serdev_device_close()).

If UART data arrives in the window between ps_cleanup() and
hci_unregister_dev(), btnxpuart_receive_buf() will run and call
ps_start_timer(), manipulating the destroyed timer. Additionally, it can
trigger btnxpuart_tx_wakeup() -> btnxpuart_tx_work() -> ps_wakeup(), which
attempts to lock the destroyed psdata->ps_lock.

> +	if (nxpdev->pwrseq)
> +		pwrseq_put(nxpdev->pwrseq);
>  	hci_free_dev(hdev);
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260721030458.1160824-1-sherry.sun@oss.nxp.com?part=1

RE: [V7] Bluetooth: btnxpuart: Add M.2 Bluetooth device support using pwrseq

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1181 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1131272

---Test result---

Test Summary:
CheckPatch                    PASS      0.63 seconds
VerifyFixes                   PASS      2.25 seconds
VerifySignedoff               PASS      1.70 seconds
GitLint                       PASS      2.26 seconds
SubjectPrefix                 PASS      0.88 seconds
BuildKernel                   PASS      28.61 seconds
CheckAllWarning               PASS      30.39 seconds
CheckSparse                   PASS      29.95 seconds
BuildKernel32                 PASS      26.25 seconds
CheckKernelLLVM               SKIP      0.00 seconds
TestRunnerSetup               PASS      502.94 seconds
IncrementalBuild              PASS      25.15 seconds

Details
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found


https://github.com/bluez/bluetooth-next/pull/467

---
Regards,
Linux Bluetooth