[PATCH v1 0/4] Bluetooth: add hardware rfkill handling and test hook

[PATCH v1 0/4] Bluetooth: add hardware rfkill handling and test hook

[Sai Teja Aluvala]

This series adds hardware rfkill handling for the Intel PCIe transport,
the Bluetooth-side notification path, and a debugfs test hook for
exercising the generic stack handling.

The resulting flow is:

  transport hardware event
    -> hci_rfkill_set_hw_state()
    -> rfkill hardware state
    -> hdev->rfkill_block work
    -> HCI_RFKILLED state and device power handling

For Intel PCIe controllers, the series adds GP2 and HW_RFKILL MSI-X
handling, IPC_CONTROL doorbell synchronization, delayed state checking,
reset/shutdown/remove lifecycle handling, and notification of the
generic HCI rfkill layer.

The debugfs hook exposes:

  /sys/kernel/debug/bluetooth/hciN/force_hw_rfkill

Writing Y or N simulates a hardware rfkill transition at the generic HCI
rfkill interface. It intentionally does not emulate the transport
driver's physical interrupt, doorbell, or register-detection logic.

Dependency:

  This series depends on the separately submitted RFKILL patch:

    [PATCH v1 0/1] rfkill: expose hardware-only block state

  That patch adds rfkill_hard_blocked() to:

    include/linux/rfkill.h
    net/rfkill/core.c

The dependency is being submitted separately to wireless-next because
include/linux/rfkill.h and net/rfkill/core.c are maintained by the
RFKILL/linux-wireless maintainers. The RFKILL patch is not duplicated in
this Bluetooth series. Once the RFKILL series is archived, its lore link
is:

  https://lore.kernel.org/linux-wireless/cover.1790752797.git.aluvala.sai.teja@intel.com/

Patches:

  1. Bluetooth: Add interface to allow stack to communicate hw rfkill events
  2. Bluetooth: hci_core: clear hdev->rfkill after destroying it
  3. Bluetooth: btintel_pcie: add HW rfkill interrupt/doorbell flow
  4. Bluetooth: hci_debugfs: add force_hw_rfkill test hook

Changes in v1:
  - Initial version.

The series has been prepared against bluetooth-next/master.

Sai Teja Aluvala (4):
  Bluetooth: Add interface to allow stack to communicate hw rfkill
    events
  Bluetooth: hci_core: clear hdev->rfkill after destroying it
  Bluetooth: btintel_pcie: add HW rfkill interrupt/doorbell flow
  Bluetooth: hci_debugfs: add force_hw_rfkill test hook

 drivers/bluetooth/btintel_pcie.c | 140 ++++++++++++++++++++++++++++++-
 drivers/bluetooth/btintel_pcie.h |  27 ++++++
 include/net/bluetooth/hci_core.h |   3 +
 net/bluetooth/hci_core.c         |  35 ++++++++
 net/bluetooth/hci_debugfs.c      | 107 +++++++++++++++++++++++
 5 files changed, 308 insertions(+), 4 deletions(-)


base-commit: fdd5964bd389936856971647fcac3442117009dc
-- 
2.53.0

[PATCH v1 1/4] Bluetooth: Add interface to allow stack to communicate hw rfkill events

[Sai Teja Aluvala]

Introduce hci_rfkill_set_hw_state() to allow drivers to notify the HCI
stack about hardware rfkill events. The helper updates the rfkill core
hardware state and schedules hdev->rfkill_block work, which applies the
resulting block state through hci_rfkill_set_block(). This lets the
stack handle hardware rfkill events through the same procedure as
software rfkill events, without blocking the calling driver context.

Serialize the helper and rfkill teardown with hdev->unregister_lock, and
reject notifications after HCI_UNREGISTER has been set. This prevents a
late driver notification from accessing the rfkill object while it is
being destroyed.

The helper is a no-op when the device has no rfkill handle registered
(rfkill_alloc() or rfkill_register() may fail and leave hdev->rfkill
NULL). The work is disabled in hci_unregister_dev() before the rfkill
handle is destroyed.

Signed-off-by: Sai Teja Aluvala <aluvala.sai.teja@intel.com>
---
 include/net/bluetooth/hci_core.h |  3 +++
 net/bluetooth/hci_core.c         | 34 ++++++++++++++++++++++++++++++++
 2 files changed, 37 insertions(+)

diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index fb85a0ccb250..c2708a447386 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -586,6 +586,7 @@ struct hci_dev {
 	struct device		dev;
 
 	struct rfkill		*rfkill;
+	struct work_struct	rfkill_block;
 
 	DECLARE_BITMAP(dev_flags, __HCI_NUM_FLAGS);
 	hci_conn_flags_t	conn_flags;
@@ -1822,6 +1823,8 @@ struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src, u8 src_type);
 
 struct hci_dev *hci_alloc_dev_priv(int sizeof_priv);
 
+void hci_rfkill_set_hw_state(struct hci_dev *hdev, bool blocked);
+
 static inline struct hci_dev *hci_alloc_dev(void)
 {
 	return hci_alloc_dev_priv(0);
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 05d1ca25f44f..ca75932acf84 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -900,6 +900,36 @@ static int hci_rfkill_set_block(void *data, bool blocked)
 	return 0;
 }
 
+void hci_rfkill_set_hw_state(struct hci_dev *hdev, bool blocked)
+{
+	mutex_lock(&hdev->unregister_lock);
+	if (hci_dev_test_flag(hdev, HCI_UNREGISTER) ||
+	    IS_ERR_OR_NULL(hdev->rfkill)) {
+		mutex_unlock(&hdev->unregister_lock);
+		return;
+	}
+
+	rfkill_set_hw_state(hdev->rfkill, blocked);
+	mutex_unlock(&hdev->unregister_lock);
+
+	/* schedule work to avoid blocking the driver context calling this api */
+	schedule_work(&hdev->rfkill_block);
+}
+EXPORT_SYMBOL(hci_rfkill_set_hw_state);
+
+static void hci_rfkill_block_work(struct work_struct *work)
+{
+	struct hci_dev *hdev = container_of(work, struct hci_dev, rfkill_block);
+
+	if (!hdev->rfkill)
+		return;
+
+	if (rfkill_blocked(hdev->rfkill))
+		hci_rfkill_set_block(hdev, true);
+	else
+		hci_rfkill_set_block(hdev, false);
+}
+
 static const struct rfkill_ops hci_rfkill_ops = {
 	.set_block = hci_rfkill_set_block,
 };
@@ -2518,6 +2548,7 @@ struct hci_dev *hci_alloc_dev_priv(int sizeof_priv)
 	INIT_LIST_HEAD(&hdev->monitored_devices);
 
 	INIT_LIST_HEAD(&hdev->local_codecs);
+	INIT_WORK(&hdev->rfkill_block, hci_rfkill_block_work);
 	INIT_WORK(&hdev->rx_work, hci_rx_work);
 	INIT_WORK(&hdev->cmd_work, hci_cmd_work);
 	INIT_WORK(&hdev->tx_work, hci_tx_work);
@@ -2683,6 +2714,7 @@ void hci_unregister_dev(struct hci_dev *hdev)
 	disable_work_sync(&hdev->tx_work);
 	disable_work_sync(&hdev->power_on);
 	disable_work_sync(&hdev->error_reset);
+	disable_work_sync(&hdev->rfkill_block);
 	disable_delayed_work_sync(&hdev->cmd_timer);
 	disable_delayed_work_sync(&hdev->ncmd_timer);
 	hci_devcd_shutdown(hdev);
@@ -2707,10 +2739,12 @@ void hci_unregister_dev(struct hci_dev *hdev)
 
 	hci_sock_dev_event(hdev, HCI_DEV_UNREG);
 
+	mutex_lock(&hdev->unregister_lock);
 	if (hdev->rfkill) {
 		rfkill_unregister(hdev->rfkill);
 		rfkill_destroy(hdev->rfkill);
 	}
+	mutex_unlock(&hdev->unregister_lock);
 
 	device_del(&hdev->dev);
 	/* Actual cleanup is deferred until hci_release_dev(). */
-- 
2.53.0

RE: Bluetooth: add hardware rfkill handling and test hook

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 13919 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1176663/

---Test result---

Test Summary:
CheckPatch                    PASS      15.83 seconds
VerifyFixes                   PASS      1.10 seconds
VerifySignedoff               PASS      0.21 seconds
GitLint                       PASS      2.35 seconds
SubjectPrefix                 PASS      5.76 seconds
BuildKernel                   FAIL      21.68 seconds
CheckAllWarning               FAIL      25.76 seconds
CheckSparse                   FAIL      26.32 seconds
BuildKernel32                 FAIL      22.21 seconds
CheckKernelLLVM               FAIL      22.33 seconds
TestRunnerSetup               FAIL      550.08 seconds
TestRunner_l2cap-tester       FAIL      9.31 seconds
TestRunner_iso-tester         FAIL      0.57 seconds
TestRunner_bnep-tester        FAIL      0.10 seconds
TestRunner_mgmt-tester        FAIL      0.10 seconds
TestRunner_rfcomm-tester      FAIL      0.10 seconds
TestRunner_sco-tester         FAIL      0.11 seconds
TestRunner_ioctl-tester       FAIL      0.11 seconds
TestRunner_mesh-tester        FAIL      0.10 seconds
TestRunner_smp-tester         FAIL      0.10 seconds
TestRunner_userchan-tester    FAIL      0.11 seconds
TestRunner_6lowpan-tester     FAIL      0.11 seconds
IncrementalBuild              FAIL      26.82 seconds

Details
##############################
Test: BuildKernel - FAIL
Desc: Build Kernel for Bluetooth
Output:

net/bluetooth/hci_debugfs.c: In function ‘force_hw_rfkill_read’:
net/bluetooth/hci_debugfs.c:351:19: error: implicit declaration of function ‘rfkill_hard_blocked’; did you mean ‘rfkill_soft_blocked’? [-Wimplicit-function-declaration]
  351 |         blocked = rfkill_hard_blocked(hdev->rfkill);
      |                   ^~~~~~~~~~~~~~~~~~~
      |                   rfkill_soft_blocked
make[4]: *** [scripts/Makefile.build:290: net/bluetooth/hci_debugfs.o] Error 1
make[4]: *** Waiting for unfinished jobs....
make[3]: *** [scripts/Makefile.build:551: net/bluetooth] Error 2
make[2]: *** [scripts/Makefile.build:551: net] Error 2
make[2]: *** Waiting for unfinished jobs....
make[1]: *** [/home/runner/work/bluetooth-next/bluetooth-next/src/src/Makefile:2229: .] Error 2
make: *** [Makefile:248: __sub-make] Error 2
##############################
Test: CheckAllWarning - FAIL
Desc: Run linux kernel with all warning enabled
Output:

net/bluetooth/hci_debugfs.c: In function ‘force_hw_rfkill_read’:
net/bluetooth/hci_debugfs.c:351:19: error: implicit declaration of function ‘rfkill_hard_blocked’; did you mean ‘rfkill_soft_blocked’? [-Wimplicit-function-declaration]
  351 |         blocked = rfkill_hard_blocked(hdev->rfkill);
      |                   ^~~~~~~~~~~~~~~~~~~
      |                   rfkill_soft_blocked
make[4]: *** [scripts/Makefile.build:290: net/bluetooth/hci_debugfs.o] Error 1
make[4]: *** Waiting for unfinished jobs....
make[3]: *** [scripts/Makefile.build:551: net/bluetooth] Error 2
make[2]: *** [scripts/Makefile.build:551: net] Error 2
make[2]: *** Waiting for unfinished jobs....
make[1]: *** [/home/runner/work/bluetooth-next/bluetooth-next/src/src/Makefile:2229: .] Error 2
make: *** [Makefile:248: __sub-make] Error 2
##############################
Test: CheckSparse - FAIL
Desc: Run sparse tool with linux kernel
Output:

net/bluetooth/hci_event.c: note: in included file (through include/net/bluetooth/hci_core.h):
./include/net/bluetooth/hci.h:2975:47: warning: array of flexible structures
./include/net/bluetooth/hci.h:3061:43: warning: array of flexible structures
drivers/bluetooth/hci_ag6xx.c:257:24: warning: restricted __le32 degrades to integer
drivers/bluetooth/hci_mrvl.c:170:23: warning: restricted __le16 degrades to integer
drivers/bluetooth/hci_mrvl.c:203:23: warning: restricted __le16 degrades to integer
net/bluetooth/hci_codec.c: note: in included file:
./include/net/bluetooth/hci_core.h:151:35: warning: array of flexible structures
net/bluetooth/sco.c: note: in included file:
./include/net/bluetooth/hci_core.h:151:35: warning: array of flexible structures
net/bluetooth/hci_debugfs.c: In function ‘force_hw_rfkill_read’:
net/bluetooth/hci_debugfs.c:351:19: error: implicit declaration of function ‘rfkill_hard_blocked’; did you mean ‘rfkill_soft_blocked’? [-Wimplicit-function-declaration]
  351 |         blocked = rfkill_hard_blocked(hdev->rfkill);
      |                   ^~~~~~~~~~~~~~~~~~~
      |                   rfkill_soft_blocked
make[4]: *** [scripts/Makefile.build:290: net/bluetooth/hci_debugfs.o] Error 1
make[4]: *** Waiting for unfinished jobs....
make[3]: *** [scripts/Makefile.build:551: net/bluetooth] Error 2
make[2]: *** [scripts/Makefile.build:551: net] Error 2
make[2]: *** Waiting for unfinished jobs....
drivers/bluetooth/virtio_bt.c:340:25: error: no generic selection for 'unsigned short virtio_cread_v'
drivers/bluetooth/virtio_bt.c:340:25: error: incompatible types in comparison expression (different base types):
drivers/bluetooth/virtio_bt.c:340:25:    bad type *
drivers/bluetooth/virtio_bt.c:340:25:    unsigned short *
drivers/bluetooth/virtio_bt.c:340:25: error: no generic selection for 'unsigned short [addressable] virtio_cread_v'
drivers/bluetooth/virtio_bt.c:343:25: error: no generic selection for 'unsigned short virtio_cread_v'
drivers/bluetooth/virtio_bt.c:343:25: error: incompatible types in comparison expression (different base types):
drivers/bluetooth/virtio_bt.c:343:25:    bad type *
drivers/bluetooth/virtio_bt.c:343:25:    unsigned short *
drivers/bluetooth/virtio_bt.c:343:25: error: no generic selection for 'unsigned short [addressable] virtio_cread_v'
drivers/bluetooth/virtio_bt.c:378:25: error: no generic selection for 'unsigned short virtio_cread_v'
drivers/bluetooth/virtio_bt.c:378:25: error: incompatible types in comparison expression (different base types):
drivers/bluetooth/virtio_bt.c:378:25:    bad type *
drivers/bluetooth/virtio_bt.c:378:25:    unsigned short *
drivers/bluetooth/virtio_bt.c:378:25: error: no generic selection for 'unsigned short [addressable] virtio_cread_v'
drivers/bluetooth/virtio_bt.c:381:25: error: no generic selection for 'unsigned short virtio_cread_v'
drivers/bluetooth/virtio_bt.c:381:25: error: incompatible types in comparison expression (different base types):
drivers/bluetooth/virtio_bt.c:381:25:    bad type *
drivers/bluetooth/virtio_bt.c:381:25:    unsigned short *
drivers/bluetooth/virtio_bt.c:381:25: error: no generic selection for 'unsigned short [addressable] virtio_cread_v'
drivers/bluetooth/hci_nokia.c:279:23: warning: incorrect type in assignment (different base types)
drivers/bluetooth/hci_nokia.c:279:23:    expected unsigned short [usertype] baud
drivers/bluetooth/hci_nokia.c:279:23:    got restricted __le16 [usertype]
drivers/bluetooth/hci_nokia.c:282:26: warning: incorrect type in assignment (different base types)
drivers/bluetooth/hci_nokia.c:282:26:    expected unsigned short [usertype] sys_clk
drivers/bluetooth/hci_nokia.c:282:26:    got restricted __le16 [usertype]
make[1]: *** [/home/runner/work/bluetooth-next/bluetooth-next/src/src/Makefile:2229: .] Error 2
make: *** [Makefile:248: __sub-make] Error 2
##############################
Test: BuildKernel32 - FAIL
Desc: Build 32bit Kernel for Bluetooth
Output:

net/bluetooth/hci_debugfs.c: In function ‘force_hw_rfkill_read’:
net/bluetooth/hci_debugfs.c:351:19: error: implicit declaration of function ‘rfkill_hard_blocked’; did you mean ‘rfkill_soft_blocked’? [-Wimplicit-function-declaration]
  351 |         blocked = rfkill_hard_blocked(hdev->rfkill);
      |                   ^~~~~~~~~~~~~~~~~~~
      |                   rfkill_soft_blocked
make[4]: *** [scripts/Makefile.build:290: net/bluetooth/hci_debugfs.o] Error 1
make[4]: *** Waiting for unfinished jobs....
make[3]: *** [scripts/Makefile.build:551: net/bluetooth] Error 2
make[2]: *** [scripts/Makefile.build:551: net] Error 2
make[2]: *** Waiting for unfinished jobs....
make[1]: *** [/home/runner/work/bluetooth-next/bluetooth-next/src/src/Makefile:2229: .] Error 2
make: *** [Makefile:248: __sub-make] Error 2
##############################
Test: CheckKernelLLVM - FAIL
Desc: Build kernel with LLVM + context analysis
Output:

net/bluetooth/hci_debugfs.c:351:12: error: call to undeclared function 'rfkill_hard_blocked'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
  351 |         blocked = rfkill_hard_blocked(hdev->rfkill);
      |                   ^
net/bluetooth/hci_debugfs.c:351:12: note: did you mean 'rfkill_soft_blocked'?
./include/linux/rfkill.h:313:20: note: 'rfkill_soft_blocked' declared here
  313 | static inline bool rfkill_soft_blocked(struct rfkill *rfkill)
      |                    ^
net/bluetooth/hci_debugfs.c:379:16: error: call to undeclared function 'rfkill_hard_blocked'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
  379 |         if (enable == rfkill_hard_blocked(hdev->rfkill)) {
      |                       ^
2 errors generated.
make[4]: *** [scripts/Makefile.build:290: net/bluetooth/hci_debugfs.o] Error 1
make[4]: *** Waiting for unfinished jobs....
make[3]: *** [scripts/Makefile.build:551: net/bluetooth] Error 2
make[2]: *** [scripts/Makefile.build:551: net] Error 2
make[2]: *** Waiting for unfinished jobs....
make[1]: *** [/home/runner/work/bluetooth-next/bluetooth-next/src/src/Makefile:2229: .] Error 2
make: *** [Makefile:248: __sub-make] Error 2
##############################
Test: TestRunnerSetup - FAIL
Desc: Setup kernel and bluez for test-runner
Output:
Kernel: 
net/bluetooth/hci_debugfs.c: In function ‘force_hw_rfkill_read’:
net/bluetooth/hci_debugfs.c:351:19: error: implicit declaration of function ‘rfkill_hard_blocked’; did you mean ‘rfkill_soft_blocked’? [-Wimplicit-function-declaration]
  351 |         blocked = rfkill_hard_blocked(hdev->rfkill);
      |                   ^~~~~~~~~~~~~~~~~~~
      |                   rfkill_soft_blocked
make[4]: *** [scripts/Makefile.build:290: net/bluetooth/hci_debugfs.o] Error 1
make[4]: *** Waiting for unfinished jobs....
make[3]: *** [scripts/Makefile.build:551: net/bluetooth] Error 2
make[2]: *** [scripts/Makefile.build:551: net] Error 2
make[2]: *** Waiting for unfinished jobs....
make[1]: *** [/home/runner/work/bluetooth-next/bluetooth-next/src/src/Makefile:2229: .] Error 2
make: *** [Makefile:248: __sub-make] Error 2
##############################
Test: TestRunner_l2cap-tester - FAIL
Desc: Run l2cap-tester with test-runner
Output:

No kernel image found
##############################
Test: TestRunner_iso-tester - FAIL
Desc: Run iso-tester with test-runner
Output:

No kernel image found
##############################
Test: TestRunner_bnep-tester - FAIL
Desc: Run bnep-tester with test-runner
Output:

No kernel image found
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:

No kernel image found
##############################
Test: TestRunner_rfcomm-tester - FAIL
Desc: Run rfcomm-tester with test-runner
Output:

No kernel image found
##############################
Test: TestRunner_sco-tester - FAIL
Desc: Run sco-tester with test-runner
Output:

No kernel image found
##############################
Test: TestRunner_ioctl-tester - FAIL
Desc: Run ioctl-tester with test-runner
Output:

No kernel image found
##############################
Test: TestRunner_mesh-tester - FAIL
Desc: Run mesh-tester with test-runner
Output:

No kernel image found
##############################
Test: TestRunner_smp-tester - FAIL
Desc: Run smp-tester with test-runner
Output:

No kernel image found
##############################
Test: TestRunner_userchan-tester - FAIL
Desc: Run userchan-tester with test-runner
Output:

No kernel image found
##############################
Test: TestRunner_6lowpan-tester - FAIL
Desc: Run 6lowpan-tester with test-runner
Output:

No kernel image found
##############################
Test: IncrementalBuild - FAIL
Desc: Incremental build with the patches in the series
Output:

net/bluetooth/hci_debugfs.c: In function ‘force_hw_rfkill_read’:
net/bluetooth/hci_debugfs.c:351:19: error: implicit declaration of function ‘rfkill_hard_blocked’; did you mean ‘rfkill_soft_blocked’? [-Wimplicit-function-declaration]
  351 |         blocked = rfkill_hard_blocked(hdev->rfkill);
      |                   ^~~~~~~~~~~~~~~~~~~
      |                   rfkill_soft_blocked
make[4]: *** [scripts/Makefile.build:290: net/bluetooth/hci_debugfs.o] Error 1
make[3]: *** [scripts/Makefile.build:551: net/bluetooth] Error 2
make[2]: *** [scripts/Makefile.build:551: net] Error 2
make[1]: *** [/home/runner/work/bluetooth-next/bluetooth-next/src/src/Makefile:2229: .] Error 2
make: *** [Makefile:248: __sub-make] Error 2
[v1,4/4] Bluetooth: hci_debugfs: add force_hw_rfkill test hook

net/bluetooth/hci_debugfs.c: In function ‘force_hw_rfkill_read’:
net/bluetooth/hci_debugfs.c:351:19: error: implicit declaration of function ‘rfkill_hard_blocked’; did you mean ‘rfkill_soft_blocked’? [-Wimplicit-function-declaration]
  351 |         blocked = rfkill_hard_blocked(hdev->rfkill);
      |                   ^~~~~~~~~~~~~~~~~~~
      |                   rfkill_soft_blocked
make[4]: *** [scripts/Makefile.build:290: net/bluetooth/hci_debugfs.o] Error 1
make[3]: *** [scripts/Makefile.build:551: net/bluetooth] Error 2
make[2]: *** [scripts/Makefile.build:551: net] Error 2
make[1]: *** [/home/runner/work/bluetooth-next/bluetooth-next/src/src/Makefile:2229: .] Error 2
make: *** [Makefile:248: __sub-make] Error 2


https://github.com/bluez/bluetooth-next/pull/844

---
Regards,
Linux Bluetooth

[PATCH v1 2/4] Bluetooth: hci_core: clear hdev->rfkill after destroying it

[Sai Teja Aluvala]

hci_unregister_dev() unregisters and destroys hdev->rfkill but leaves
the pointer set. hdev itself, including its debugfs directory, can stay
alive after this point until the last reference is dropped and
hci_release_dev() runs, so hdev->rfkill points at freed memory for that
window.

Set hdev->rfkill to NULL after rfkill_destroy() so that code which can
still reach hdev after unregistration, such as hci_rfkill_set_hw_state()
or debugfs handlers, sees that no rfkill handle exists instead of
dereferencing a stale pointer.

Signed-off-by: Sai Teja Aluvala <aluvala.sai.teja@intel.com>
---
 net/bluetooth/hci_core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index ca75932acf84..be9f4997d315 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -2743,6 +2743,7 @@ void hci_unregister_dev(struct hci_dev *hdev)
 	if (hdev->rfkill) {
 		rfkill_unregister(hdev->rfkill);
 		rfkill_destroy(hdev->rfkill);
+		hdev->rfkill = NULL;
 	}
 	mutex_unlock(&hdev->unregister_lock);
 
-- 
2.53.0

[PATCH v1 3/4] Bluetooth: btintel_pcie: add HW rfkill interrupt/doorbell flow

[Sai Teja Aluvala]

Add host-driven HW rfkill handling for Intel PCIe controllers and report
state changes to the Bluetooth stack with hci_rfkill_set_hw_state().

Enable the GP2 and HW_RFKILL MSI-X hardware causes. A HW_RFKILL
interrupt schedules a delayed worker that reads the FUNC_CTRL and
IPC_CONTROL registers to determine the HW rfkill state. On assertion,
the worker marks HW rfkill as active and reports a blocked state. On
release, it clears the IPC_CONTROL HW rfkill doorbell, waits for the
firmware GP2 acknowledgment, and reports an unblocked state only after
the acknowledgment is received. IPC_CONTROL updates are serialized with
a new ipc_lock.

After a successful setup, schedule an initial state check. That check
reports an already asserted HW rfkill state but does not report an
unblocked transition when rfkill was never asserted. The check flag is
consumed on every run so that it cannot suppress a later genuine
release.

On shutdown, cancel the worker and re-assert the doorbell if HW rfkill
is active before calling the common Intel shutdown handler. Cancel the
worker on remove, and disable it across PCIe FLR/PLDR recovery so that
it does not access registers while the device is being reset.

Signed-off-by: Sai Teja Aluvala <aluvala.sai.teja@intel.com>
---
 drivers/bluetooth/btintel_pcie.c | 140 ++++++++++++++++++++++++++++++-
 drivers/bluetooth/btintel_pcie.h |  27 ++++++
 2 files changed, 163 insertions(+), 4 deletions(-)

diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
index bcbfe2d5151a..d3c7842b3e43 100644
--- a/drivers/bluetooth/btintel_pcie.c
+++ b/drivers/bluetooth/btintel_pcie.c
@@ -2708,6 +2708,106 @@ static inline bool btintel_pcie_is_txackq_empty(struct btintel_pcie_data *data)
 	return data->ia.cr_tia[BTINTEL_PCIE_TXQ_NUM] == data->ia.cr_hia[BTINTEL_PCIE_TXQ_NUM];
 }
 
+static bool btintel_pcie_hw_rfkill_doorbell(struct btintel_pcie_data *data,
+					    bool state)
+{
+	unsigned long flags;
+	u32 reg;
+	int err;
+
+	data->rfkill_wait_done = false;
+
+	spin_lock_irqsave(&data->ipc_lock, flags);
+	reg = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_IPC_CONTROL_REG);
+	if (state)
+		reg |= BTINTEL_PCIE_CSR_IPC_CONTROL_HW_RFKILL;
+	else
+		reg &= ~BTINTEL_PCIE_CSR_IPC_CONTROL_HW_RFKILL;
+	btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_IPC_CONTROL_REG, reg);
+	spin_unlock_irqrestore(&data->ipc_lock, flags);
+
+	err = wait_event_timeout(data->rfkill_wait_q, data->rfkill_wait_done,
+				 msecs_to_jiffies(BTINTEL_PCIE_HW_RFKILL_INTERRUPT_TIMEOUT));
+	if (!err) {
+		bt_dev_err(data->hdev, "Timeout (%u ms) on alive interrupt for RFKILL",
+			   BTINTEL_PCIE_HW_RFKILL_INTERRUPT_TIMEOUT);
+		return false;
+	}
+
+	return true;
+}
+
+static void btintel_pcie_hw_rfkill_delay_work(struct work_struct *wk)
+{
+	struct btintel_pcie_data *data =
+		container_of(wk, struct btintel_pcie_data, hw_rfkill_work.work);
+	u32 func_ctrl, ipc_ctrl;
+	bool set_rfkill, first_check;
+
+	/* Consume the initial post-setup state check unconditionally so it
+	 * cannot get stuck set after the "on" branch runs, which would
+	 * otherwise cause the next genuine "off" transition to be skipped.
+	 */
+	first_check = test_and_clear_bit(BTINTEL_PCIE_HW_RFKILL_STATE_CHECK,
+					 &data->flags);
+
+	func_ctrl = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG);
+	ipc_ctrl = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_IPC_CONTROL_REG);
+
+	set_rfkill = !(func_ctrl & BTINTEL_PCIE_CSR_FUNC_CTRL_HW_RFKILL) &&
+			    !(ipc_ctrl & BTINTEL_PCIE_CSR_IPC_CONTROL_HW_RFKILL);
+	if (set_rfkill) {
+		bt_dev_dbg(data->hdev, "hw rfkill on");
+		set_bit(BTINTEL_PCIE_HWRFKILL_ON, &data->flags);
+		hci_rfkill_set_hw_state(data->hdev, true);
+	} else {
+		bt_dev_dbg(data->hdev, "hw rfkill off");
+		/* Nothing changed at the initial post-setup check, so there
+		 * is no transition to report.
+		 */
+		if (first_check)
+			return;
+
+		if (btintel_pcie_hw_rfkill_doorbell(data, false)) {
+			clear_bit(BTINTEL_PCIE_HWRFKILL_ON, &data->flags);
+			hci_rfkill_set_hw_state(data->hdev, false);
+		}
+	}
+}
+
+static void btintel_delayed_hw_rfkill(struct btintel_pcie_data *data,
+				      bool delay)
+{
+	mod_delayed_work(system_wq, &data->hw_rfkill_work,
+			 delay ? msecs_to_jiffies(BTINTEL_PCIE_HW_RFKILL_DELAY) : 0);
+}
+
+static void btintel_pcie_msix_gp2_handler(struct btintel_pcie_data *data)
+{
+	u32 reg, boot_stage_reg;
+
+	boot_stage_reg = btintel_pcie_rd_reg32(data,
+					       BTINTEL_PCIE_CSR_BOOT_STAGE_REG);
+	reg = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_IPC_STATUS_REG);
+
+	if ((reg & BTINTEL_PCIE_CSR_IPC_STATUS_HW_RFKILL) &&
+	    (boot_stage_reg & BTINTEL_PCIE_CSR_BOOT_STAGE_HW_RFKILL_STATE)) {
+		bt_dev_dbg(data->hdev,
+			   "firmware done handling HW RF-KILL SET state update");
+		data->rfkill_wait_done = true;
+	}
+
+	if (!(reg & BTINTEL_PCIE_CSR_IPC_STATUS_HW_RFKILL) &&
+	    !(boot_stage_reg & BTINTEL_PCIE_CSR_BOOT_STAGE_HW_RFKILL_STATE)) {
+		bt_dev_dbg(data->hdev,
+			   "firmware done handling HW RF-KILL CLEAR state update");
+		data->rfkill_wait_done = true;
+	}
+
+	if (data->rfkill_wait_done)
+		wake_up(&data->rfkill_wait_q);
+}
+
 static irqreturn_t btintel_pcie_irq_msix_handler(int irq, void *dev_id)
 {
 	struct msix_entry *entry = dev_id;
@@ -2738,6 +2838,8 @@ static irqreturn_t btintel_pcie_irq_msix_handler(int irq, void *dev_id)
 	if (intr_hw & BTINTEL_PCIE_MSIX_HW_INT_CAUSES_GP1)
 		btintel_pcie_msix_gp1_handler(data);
 
+	if (intr_hw & BTINTEL_PCIE_MSIX_HW_INT_CAUSES_GP2)
+		btintel_pcie_msix_gp2_handler(data);
 
 	/* For TX */
 	if (intr_fh & BTINTEL_PCIE_MSIX_FH_INT_CAUSES_0) {
@@ -2756,6 +2858,9 @@ static irqreturn_t btintel_pcie_irq_msix_handler(int irq, void *dev_id)
 	if (intr_hw & BTINTEL_PCIE_MSIX_HW_INT_CAUSES_FWTRIG)
 		btintel_pcie_msix_fw_trigger_handler(data);
 
+	if (intr_hw & BTINTEL_PCIE_MSIX_HW_INT_CAUSES_HW_RFKILL)
+		btintel_delayed_hw_rfkill(data, false);
+
 	/* This interrupt is triggered by the firmware after updating
 	 * boot_stage register and image_response register
 	 */
@@ -2829,8 +2934,10 @@ static struct btintel_pcie_causes_list causes_list[] = {
 	{ BTINTEL_PCIE_MSIX_FH_INT_CAUSES_0,	BTINTEL_PCIE_CSR_MSIX_FH_INT_MASK,	0x00 },
 	{ BTINTEL_PCIE_MSIX_FH_INT_CAUSES_1,	BTINTEL_PCIE_CSR_MSIX_FH_INT_MASK,	0x01 },
 	{ BTINTEL_PCIE_MSIX_HW_INT_CAUSES_GP0,	BTINTEL_PCIE_CSR_MSIX_HW_INT_MASK,	0x20 },
+	{ BTINTEL_PCIE_MSIX_HW_INT_CAUSES_GP2,	BTINTEL_PCIE_CSR_MSIX_HW_INT_MASK,	0x22 },
 	{ BTINTEL_PCIE_MSIX_HW_INT_CAUSES_HWEXP, BTINTEL_PCIE_CSR_MSIX_HW_INT_MASK,	0x23 },
 	{ BTINTEL_PCIE_MSIX_HW_INT_CAUSES_FWTRIG, BTINTEL_PCIE_CSR_MSIX_HW_INT_MASK,	0x25 },
+	{ BTINTEL_PCIE_MSIX_HW_INT_CAUSES_HW_RFKILL, BTINTEL_PCIE_CSR_MSIX_HW_INT_MASK,	0x27 },
 };
 
 /* This function configures the interrupt masks for both HW_INT_CAUSES and
@@ -3548,8 +3655,11 @@ static int btintel_pcie_setup(struct hci_dev *hdev)
 		btintel_pcie_start_rx(data);
 	}
 
-	if (!err)
+	if (!err) {
 		set_bit(BTINTEL_PCIE_SETUP_DONE, &data->flags);
+		set_bit(BTINTEL_PCIE_HW_RFKILL_STATE_CHECK, &data->flags);
+		btintel_delayed_hw_rfkill(data, true);
+	}
 	return err;
 }
 
@@ -3781,13 +3891,14 @@ static void btintel_pcie_reset_work(struct work_struct *wk)
 	btintel_pcie_synchronize_irqs(data);
 
 	flush_work(&data->rx_work);
-	/* Drain any in-flight dump workers and block new ones across reset.
-	 * Safe from self-deadlock: they all run on a separate wq.
+	/* Drain any in-flight dump/rfkill workers and block new ones across
+	 * reset. Safe from self-deadlock: they all run on a separate wq.
 	 */
 	disable_work_sync(&data->coredump_work);
 	disable_work_sync(&data->hwexp_work);
 	disable_work_sync(&data->fwtrigger_work);
 	disable_work_sync(&data->mbox_work);
+	disable_delayed_work_sync(&data->hw_rfkill_work);
 
 	bt_dev_dbg(data->hdev, "Release bluetooth interface");
 
@@ -3813,6 +3924,7 @@ static void btintel_pcie_reset_work(struct work_struct *wk)
 		enable_work(&data->hwexp_work);
 		enable_work(&data->fwtrigger_work);
 		enable_work(&data->mbox_work);
+		enable_delayed_work(&data->hw_rfkill_work);
 	}
 
 out:
@@ -4003,6 +4115,18 @@ static struct hci_drv btintel_pcie_hci_drv = {
 	.specific_handlers      = btintel_pcie_hci_drv_specific_handlers,
 };
 
+static int btintel_pcie_shutdown(struct hci_dev *hdev)
+{
+	struct btintel_pcie_data *data = hci_get_drvdata(hdev);
+
+	cancel_delayed_work_sync(&data->hw_rfkill_work);
+
+	if (test_bit(BTINTEL_PCIE_HWRFKILL_ON, &data->flags))
+		btintel_pcie_hw_rfkill_doorbell(data, true);
+
+	return btintel_shutdown_combined(hdev);
+}
+
 static int btintel_pcie_setup_hdev(struct btintel_pcie_data *data)
 {
 	int err;
@@ -4022,7 +4146,7 @@ static int btintel_pcie_setup_hdev(struct btintel_pcie_data *data)
 	hdev->close = btintel_pcie_close;
 	hdev->send = btintel_pcie_send_frame;
 	hdev->setup = btintel_pcie_setup;
-	hdev->shutdown = btintel_shutdown_combined;
+	hdev->shutdown = btintel_pcie_shutdown;
 	hdev->hw_error = btintel_pcie_hw_error;
 	hdev->set_diag = btintel_set_diag;
 	hdev->set_bdaddr = btintel_set_bdaddr;
@@ -4063,6 +4187,7 @@ static int btintel_pcie_probe(struct pci_dev *pdev,
 
 	spin_lock_init(&data->irq_lock);
 	spin_lock_init(&data->hci_rx_lock);
+	spin_lock_init(&data->ipc_lock);
 
 	init_waitqueue_head(&data->gp0_wait_q);
 	data->gp0_received = false;
@@ -4070,6 +4195,9 @@ static int btintel_pcie_probe(struct pci_dev *pdev,
 	init_waitqueue_head(&data->tx_wait_q);
 	data->tx_wait_done = false;
 
+	init_waitqueue_head(&data->rfkill_wait_q);
+	data->rfkill_wait_done = false;
+
 	init_waitqueue_head(&data->mbox_parse_wait_q);
 
 	data->workqueue = alloc_ordered_workqueue(KBUILD_MODNAME, WQ_HIGHPRI);
@@ -4084,6 +4212,8 @@ static int btintel_pcie_probe(struct pci_dev *pdev,
 
 	skb_queue_head_init(&data->rx_skb_q);
 	INIT_WORK(&data->rx_work, btintel_pcie_rx_work);
+	INIT_DELAYED_WORK(&data->hw_rfkill_work,
+			  btintel_pcie_hw_rfkill_delay_work);
 	INIT_WORK(&data->reset_work, btintel_pcie_reset_work);
 	INIT_WORK(&data->coredump_work, btintel_pcie_coredump_worker);
 	INIT_WORK(&data->hwexp_work, btintel_pcie_hwexp_worker);
@@ -4173,6 +4303,8 @@ static void btintel_pcie_remove(struct pci_dev *pdev)
 
 	btintel_pcie_synchronize_irqs(data);
 
+	cancel_delayed_work_sync(&data->hw_rfkill_work);
+
 	flush_work(&data->rx_work);
 
 	btintel_pcie_reset_bt(data);
diff --git a/drivers/bluetooth/btintel_pcie.h b/drivers/bluetooth/btintel_pcie.h
index 3030b4e8b750..55f08d6b621c 100644
--- a/drivers/bluetooth/btintel_pcie.h
+++ b/drivers/bluetooth/btintel_pcie.h
@@ -33,6 +33,7 @@
 #define BTINTEL_PCIE_CSR_FUNC_CTRL_MAC_INIT		(BIT(6))
 #define BTINTEL_PCIE_CSR_FUNC_CTRL_FUNC_INIT		(BIT(7))
 #define BTINTEL_PCIE_CSR_FUNC_CTRL_MAC_ACCESS_STS	(BIT(20))
+#define BTINTEL_PCIE_CSR_FUNC_CTRL_HW_RFKILL		(BIT(27))
 
 #define BTINTEL_PCIE_CSR_FUNC_CTRL_MAC_ACCESS_REQ	(BIT(21))
 
@@ -40,6 +41,12 @@
 #define BTINTEL_PCIE_CSR_FUNC_CTRL_BUS_MASTER_DISCON	(BIT(29))
 #define BTINTEL_PCIE_CSR_FUNC_CTRL_SW_RESET		(BIT(31))
 
+/* BTINTEL PCIE CSR IPC Control Register */
+#define BTINTEL_PCIE_CSR_IPC_CONTROL_HW_RFKILL		(BIT(7))
+
+/* BTINTEL PCIE CSR IPC Status Register */
+#define BTINTEL_PCIE_CSR_IPC_STATUS_HW_RFKILL		(BIT(7))
+
 /* Value for BTINTEL_PCIE_CSR_BOOT_STAGE register */
 #define BTINTEL_PCIE_CSR_BOOT_STAGE_ROM		(BIT(0))
 #define BTINTEL_PCIE_CSR_BOOT_STAGE_IML		(BIT(1))
@@ -53,6 +60,7 @@
 #define BTINTEL_PCIE_CSR_BOOT_STAGE_ALIVE		(BIT(23))
 /* Reflects live D-state. Updated by hardware on every D-state transition. */
 #define BTINTEL_PCIE_CSR_BOOT_STAGE_D3_STATE_READY	(BIT(24))
+#define BTINTEL_PCIE_CSR_BOOT_STAGE_HW_RFKILL_STATE	(BIT(25))
 
 #define BTINTEL_PCIE_CSR_DOORBELL_MBOX_READ_CONFIRM	(BIT(4))
 
@@ -135,8 +143,10 @@ enum msix_fh_int_causes {
 enum msix_hw_int_causes {
 	BTINTEL_PCIE_MSIX_HW_INT_CAUSES_GP0	= BIT(0),	/* cause 32 */
 	BTINTEL_PCIE_MSIX_HW_INT_CAUSES_GP1	= BIT(1),	/* cause 33 */
+	BTINTEL_PCIE_MSIX_HW_INT_CAUSES_GP2	= BIT(2),	/* cause 34 */
 	BTINTEL_PCIE_MSIX_HW_INT_CAUSES_HWEXP	= BIT(3),	/* cause 35 */
 	BTINTEL_PCIE_MSIX_HW_INT_CAUSES_FWTRIG	= BIT(5),	/* cause 37 */
+	BTINTEL_PCIE_MSIX_HW_INT_CAUSES_HW_RFKILL	= BIT(7),	/* cause 39 */
 };
 
 /* PCIe device states
@@ -155,6 +165,8 @@ enum {
 	BTINTEL_PCIE_COREDUMP_INPROGRESS,
 	BTINTEL_PCIE_FWTRIGGER_DUMP_INPROGRESS,
 	BTINTEL_PCIE_RECOVERY_IN_PROGRESS,
+	BTINTEL_PCIE_HWRFKILL_ON,
+	BTINTEL_PCIE_HW_RFKILL_STATE_CHECK,
 	BTINTEL_PCIE_SETUP_DONE,
 	BTINTEL_PCIE_MAIL_BOX_INTR,
 	BTINTEL_PCIE_MBOX_PARSE_PENDING,
@@ -215,6 +227,12 @@ enum btintel_pcie_mbox_msg {
 
 #define BTINTEL_PCIE_DX_TRANSITION_MAX_RETRIES	3
 
+/* HW rfkill interrupt timeout */
+#define BTINTEL_PCIE_HW_RFKILL_INTERRUPT_TIMEOUT	200
+
+/* HW rfkill check timeout */
+#define BTINTEL_PCIE_HW_RFKILL_DELAY			1000
+
 /* The number of descriptors in TX queues */
 #define BTINTEL_PCIE_TX_DESCS_COUNT	32
 
@@ -680,6 +698,7 @@ struct btintel_pcie_ini_dump_info {
  * @flags: driver state
  * @irq_lock: spinlock for MSI-X
  * @hci_rx_lock: spinlock for HCI RX flow
+ * @ipc_lock: spinlock for IPC control register read-modify-write
  * @base_addr: pci base address (from BAR)
  * @msix_entries: array of MSI-X entries
  * @msix_enabled: true if MSI-X is enabled;
@@ -696,6 +715,8 @@ struct btintel_pcie_ini_dump_info {
  * @gp0_wait_q: wait_q for gp0 interrupt
  * @tx_wait_done: condition for tx interrupt
  * @tx_wait_q: wait_q for tx interrupt
+ * @rfkill_wait_done: condition for HW rfkill GP2 interrupt
+ * @rfkill_wait_q: wait_q for HW rfkill GP2 interrupt
  * @workqueue: workqueue for RX work
  * @rx_skb_q: SKB queue for RX packet
  * @rx_work: RX work struct to process the RX packet in @rx_skb_q
@@ -723,6 +744,8 @@ struct btintel_pcie_data {
 	spinlock_t	irq_lock;
 	/* lock to serialize rx events */
 	spinlock_t	hci_rx_lock;
+	/* lock to serialize IPC control register updates */
+	spinlock_t	ipc_lock;
 
 	void __iomem	*base_addr;
 
@@ -747,9 +770,13 @@ struct btintel_pcie_data {
 	bool	tx_wait_done;
 	wait_queue_head_t	tx_wait_q;
 
+	bool	rfkill_wait_done;
+	wait_queue_head_t	rfkill_wait_q;
+
 	struct workqueue_struct	*workqueue;
 	struct sk_buff_head	rx_skb_q;
 	struct work_struct	rx_work;
+	struct delayed_work	hw_rfkill_work;
 	struct work_struct      reset_work;
 
 	struct workqueue_struct	*dump_workqueue;
-- 
2.53.0

[PATCH v1 4/4] Bluetooth: hci_debugfs: add force_hw_rfkill test hook

[Sai Teja Aluvala]

Add a force_hw_rfkill entry under /sys/kernel/debug/bluetooth/hciN/ for
HCI devices with a registered rfkill handle. Writing Y/N sets the
hardware block state through hci_rfkill_set_hw_state(), which exercises
the generic Bluetooth HW rfkill handling without requiring a transport
driver to assert its physical rfkill line. Reading returns the hardware
block state from rfkill_hard_blocked(), independently of any software
block. Writing the current state returns -EALREADY.

The read and write handlers check HCI_UNREGISTER and hdev->rfkill under
hdev->unregister_lock, so they fail with -ENODEV rather than use an
rfkill handle that is being destroyed. The entry uses custom open and
release operations that pin the debugfs file with debugfs_file_get() and
debugfs_file_put(), so hdev cannot be released while a descriptor is
open. After a successful write, the handler drops unregister_lock and
flushes hdev->rfkill_block, so the caller observes the settled
HCI_RFKILLED state without blocking the work, which may itself need that
lock.

The hook does not exercise driver-specific interrupt, doorbell or
register logic that detects the hardware event; that still requires
real hardware or transport-level emulation.

Signed-off-by: Sai Teja Aluvala <aluvala.sai.teja@intel.com>
---
 net/bluetooth/hci_debugfs.c | 107 ++++++++++++++++++++++++++++++++++++
 1 file changed, 107 insertions(+)

diff --git a/net/bluetooth/hci_debugfs.c b/net/bluetooth/hci_debugfs.c
index 2559fb6324d6..a14d2ae8cab5 100644
--- a/net/bluetooth/hci_debugfs.c
+++ b/net/bluetooth/hci_debugfs.c
@@ -20,6 +20,7 @@
 
 #include <linux/debugfs.h>
 #include <linux/kstrtox.h>
+#include <linux/rfkill.h>
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
@@ -306,6 +307,108 @@ static const struct file_operations sc_only_mode_fops = {
 	.llseek		= default_llseek,
 };
 
+static int force_hw_rfkill_open(struct inode *inode, struct file *file)
+{
+	int err;
+
+	err = debugfs_file_get(file->f_path.dentry);
+	if (err)
+		return err;
+
+	err = simple_open(inode, file);
+	if (err)
+		debugfs_file_put(file->f_path.dentry);
+
+	return err;
+}
+
+static int force_hw_rfkill_release(struct inode *inode, struct file *file)
+{
+	debugfs_file_put(file->f_path.dentry);
+
+	return 0;
+}
+
+/* Test-only hook to simulate a HW rfkill event without needing the
+ * underlying transport driver to assert its real rfkill line. It drives
+ * hci_rfkill_set_hw_state() directly, exercising the same rfkill core
+ * notification (hci_rfkill_set_block()) and power on/off handling that a
+ * genuine HW rfkill interrupt from any driver would trigger.
+ */
+static ssize_t force_hw_rfkill_read(struct file *file, char __user *user_buf,
+				     size_t count, loff_t *ppos)
+{
+	struct hci_dev *hdev = file->private_data;
+	char buf[3];
+	bool blocked;
+
+	mutex_lock(&hdev->unregister_lock);
+	if (hci_dev_test_flag(hdev, HCI_UNREGISTER) ||
+	    IS_ERR_OR_NULL(hdev->rfkill)) {
+		mutex_unlock(&hdev->unregister_lock);
+		return -ENODEV;
+	}
+	blocked = rfkill_hard_blocked(hdev->rfkill);
+	mutex_unlock(&hdev->unregister_lock);
+
+	buf[0] = blocked ? 'Y' : 'N';
+	buf[1] = '\n';
+	buf[2] = '\0';
+	return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
+}
+
+static ssize_t force_hw_rfkill_write(struct file *file,
+				      const char __user *user_buf,
+				      size_t count, loff_t *ppos)
+{
+	struct hci_dev *hdev = file->private_data;
+	bool enable;
+	int err;
+
+	err = kstrtobool_from_user(user_buf, count, &enable);
+	if (err)
+		return err;
+
+	mutex_lock(&hdev->unregister_lock);
+	if (hci_dev_test_flag(hdev, HCI_UNREGISTER) ||
+	    IS_ERR_OR_NULL(hdev->rfkill)) {
+		err = -ENODEV;
+		goto unlock;
+	}
+
+	if (enable == rfkill_hard_blocked(hdev->rfkill)) {
+		err = -EALREADY;
+		goto unlock_flush;
+	}
+
+	hci_rfkill_set_hw_state(hdev, enable);
+	err = count;
+
+unlock_flush:
+	mutex_unlock(&hdev->unregister_lock);
+
+	/* hci_rfkill_set_hw_state() updates the rfkill core state
+	 * synchronously, but applies the HCI_RFKILLED flag and resulting
+	 * power handling asynchronously via hdev->rfkill_block. Flush after
+	 * dropping unregister_lock because the work may submit a sync command
+	 * that also takes this lock.
+	 */
+	flush_work(&hdev->rfkill_block);
+	return err;
+
+unlock:
+	mutex_unlock(&hdev->unregister_lock);
+	return err;
+}
+
+static const struct file_operations force_hw_rfkill_fops = {
+	.open		= force_hw_rfkill_open,
+	.read		= force_hw_rfkill_read,
+	.write		= force_hw_rfkill_write,
+	.llseek		= default_llseek,
+	.release	= force_hw_rfkill_release,
+};
+
 DEFINE_INFO_ATTRIBUTE(hardware_info, hw_info);
 DEFINE_INFO_ATTRIBUTE(firmware_info, fw_info);
 
@@ -352,6 +455,10 @@ void hci_debugfs_create_common(struct hci_dev *hdev)
 	if (hdev->fw_info)
 		debugfs_create_file("firmware_info", 0444, hdev->debugfs,
 				    hdev, &firmware_info_fops);
+
+	if (!IS_ERR_OR_NULL(hdev->rfkill))
+		debugfs_create_file("force_hw_rfkill", 0644, hdev->debugfs,
+				    hdev, &force_hw_rfkill_fops);
 }
 
 static int inquiry_cache_show(struct seq_file *f, void *p)
-- 
2.53.0

Re: [PATCH v1 4/4] Bluetooth: hci_debugfs: add force_hw_rfkill test hook

[Luiz Augusto von Dentz]

Hi Sai,

On Wed, Sep 30, 2026 at 3:50 AM Sai Teja Aluvala
<aluvala.sai.teja@intel.com> wrote:
>
> Add a force_hw_rfkill entry under /sys/kernel/debug/bluetooth/hciN/ for
> HCI devices with a registered rfkill handle. Writing Y/N sets the
> hardware block state through hci_rfkill_set_hw_state(), which exercises
> the generic Bluetooth HW rfkill handling without requiring a transport
> driver to assert its physical rfkill line. Reading returns the hardware
> block state from rfkill_hard_blocked(), independently of any software
> block. Writing the current state returns -EALREADY.

I guess the first thing we need to ask ourselves is why we need a
dedicated entry for rfkill?

> The read and write handlers check HCI_UNREGISTER and hdev->rfkill under
> hdev->unregister_lock, so they fail with -ENODEV rather than use an
> rfkill handle that is being destroyed. The entry uses custom open and
> release operations that pin the debugfs file with debugfs_file_get() and
> debugfs_file_put(), so hdev cannot be released while a descriptor is
> open. After a successful write, the handler drops unregister_lock and
> flushes hdev->rfkill_block, so the caller observes the settled
> HCI_RFKILLED state without blocking the work, which may itself need that
> lock.
>
> The hook does not exercise driver-specific interrupt, doorbell or
> register logic that detects the hardware event; that still requires
> real hardware or transport-level emulation.
>
> Signed-off-by: Sai Teja Aluvala <aluvala.sai.teja@intel.com>
> ---
>  net/bluetooth/hci_debugfs.c | 107 ++++++++++++++++++++++++++++++++++++
>  1 file changed, 107 insertions(+)
>
> diff --git a/net/bluetooth/hci_debugfs.c b/net/bluetooth/hci_debugfs.c
> index 2559fb6324d6..a14d2ae8cab5 100644
> --- a/net/bluetooth/hci_debugfs.c
> +++ b/net/bluetooth/hci_debugfs.c
> @@ -20,6 +20,7 @@
>
>  #include <linux/debugfs.h>
>  #include <linux/kstrtox.h>
> +#include <linux/rfkill.h>
>
>  #include <net/bluetooth/bluetooth.h>
>  #include <net/bluetooth/hci_core.h>
> @@ -306,6 +307,108 @@ static const struct file_operations sc_only_mode_fops = {
>         .llseek         = default_llseek,
>  };
>
> +static int force_hw_rfkill_open(struct inode *inode, struct file *file)
> +{
> +       int err;
> +
> +       err = debugfs_file_get(file->f_path.dentry);
> +       if (err)
> +               return err;
> +
> +       err = simple_open(inode, file);
> +       if (err)
> +               debugfs_file_put(file->f_path.dentry);
> +
> +       return err;
> +}
> +
> +static int force_hw_rfkill_release(struct inode *inode, struct file *file)
> +{
> +       debugfs_file_put(file->f_path.dentry);
> +
> +       return 0;
> +}
> +
> +/* Test-only hook to simulate a HW rfkill event without needing the
> + * underlying transport driver to assert its real rfkill line. It drives
> + * hci_rfkill_set_hw_state() directly, exercising the same rfkill core
> + * notification (hci_rfkill_set_block()) and power on/off handling that a
> + * genuine HW rfkill interrupt from any driver would trigger.
> + */
> +static ssize_t force_hw_rfkill_read(struct file *file, char __user *user_buf,
> +                                    size_t count, loff_t *ppos)
> +{
> +       struct hci_dev *hdev = file->private_data;
> +       char buf[3];
> +       bool blocked;
> +
> +       mutex_lock(&hdev->unregister_lock);
> +       if (hci_dev_test_flag(hdev, HCI_UNREGISTER) ||
> +           IS_ERR_OR_NULL(hdev->rfkill)) {
> +               mutex_unlock(&hdev->unregister_lock);
> +               return -ENODEV;
> +       }
> +       blocked = rfkill_hard_blocked(hdev->rfkill);
> +       mutex_unlock(&hdev->unregister_lock);
> +
> +       buf[0] = blocked ? 'Y' : 'N';
> +       buf[1] = '\n';
> +       buf[2] = '\0';
> +       return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
> +}
> +
> +static ssize_t force_hw_rfkill_write(struct file *file,
> +                                     const char __user *user_buf,
> +                                     size_t count, loff_t *ppos)
> +{
> +       struct hci_dev *hdev = file->private_data;
> +       bool enable;
> +       int err;
> +
> +       err = kstrtobool_from_user(user_buf, count, &enable);
> +       if (err)
> +               return err;
> +
> +       mutex_lock(&hdev->unregister_lock);
> +       if (hci_dev_test_flag(hdev, HCI_UNREGISTER) ||
> +           IS_ERR_OR_NULL(hdev->rfkill)) {
> +               err = -ENODEV;
> +               goto unlock;
> +       }
> +
> +       if (enable == rfkill_hard_blocked(hdev->rfkill)) {
> +               err = -EALREADY;
> +               goto unlock_flush;
> +       }
> +
> +       hci_rfkill_set_hw_state(hdev, enable);
> +       err = count;
> +
> +unlock_flush:
> +       mutex_unlock(&hdev->unregister_lock);
> +
> +       /* hci_rfkill_set_hw_state() updates the rfkill core state
> +        * synchronously, but applies the HCI_RFKILLED flag and resulting
> +        * power handling asynchronously via hdev->rfkill_block. Flush after
> +        * dropping unregister_lock because the work may submit a sync command
> +        * that also takes this lock.
> +        */
> +       flush_work(&hdev->rfkill_block);
> +       return err;
> +
> +unlock:
> +       mutex_unlock(&hdev->unregister_lock);
> +       return err;
> +}
> +
> +static const struct file_operations force_hw_rfkill_fops = {
> +       .open           = force_hw_rfkill_open,
> +       .read           = force_hw_rfkill_read,
> +       .write          = force_hw_rfkill_write,
> +       .llseek         = default_llseek,
> +       .release        = force_hw_rfkill_release,
> +};
> +
>  DEFINE_INFO_ATTRIBUTE(hardware_info, hw_info);
>  DEFINE_INFO_ATTRIBUTE(firmware_info, fw_info);
>
> @@ -352,6 +455,10 @@ void hci_debugfs_create_common(struct hci_dev *hdev)
>         if (hdev->fw_info)
>                 debugfs_create_file("firmware_info", 0444, hdev->debugfs,
>                                     hdev, &firmware_info_fops);
> +
> +       if (!IS_ERR_OR_NULL(hdev->rfkill))
> +               debugfs_create_file("force_hw_rfkill", 0644, hdev->debugfs,
> +                                   hdev, &force_hw_rfkill_fops);
>  }
>
>  static int inquiry_cache_show(struct seq_file *f, void *p)
> --
> 2.53.0
>


-- 
Luiz Augusto von Dentz