[PATCH bluetooth-next] Bluetooth: hci_event: strip Broadcom vendor bits from legacy adv report type

[PATCH bluetooth-next] Bluetooth: hci_event: strip Broadcom vendor bits from legacy adv report type

[Ton Sharp]

Broadcom controllers running ROM firmware on Apple T2 Macs (where no
RAM patchram exists, e.g. BCM4364B3 on MacBookPro16,1) set vendor bits
0x10/0x20/0x80 in the legacy LE Advertising Report Event_Type.

As a result, directed advertisements (ADV_DIRECT_IND) arrive as
0x81/0x91/0xa1 instead of 0x01. Because process_adv_report() drops any
legacy report with type > LE_ADV_SCAN_RSP (0x04) as an unknown advertising
packet type, bonded LE peripherals (such as Apple Magic Mouse/Keyboard)
and Chrome passkey proximity scans fail to discover or reliably reconnect
to the host.

The valid legacy type is always located in the low nibble. Mask the type
field for Broadcom controllers (manufacturer 15) when it is out of range.
Valid legacy reports (0x00-0x04) remain untouched, low nibbles >= 5 remain
out of range and will continue to be dropped, and controllers from other
manufacturers are unaffected.

The fix is based on the initial t2linux patch from Jose Miguel Ochoa.

Link: https://lore.kernel.org/r/3352A23E-EA42-4366-BBAA-459CEAE6F51B@live.com
Suggested-by: Jose Miguel Ochoa <josemiguelo.ochoa@gmail.com>
Signed-off-by: Ton Sharp <66ton99@gmail.com>
---
 net/bluetooth/hci_event.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index c055d16cfb8e..a03a33bca095 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -6593,6 +6593,17 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, void *data,
 
 		hci_store_wake_reason(hdev, &info->bdaddr, info->bdaddr_type);
 
+		/* Broadcom ROM firmware (BCM4364B3 on Apple T2 Macs, no
+		 * patchram) sets vendor bits in the legacy Event_Type.
+		 */
+		if (hdev->manufacturer == 15 && info->type > LE_ADV_SCAN_RSP) {
+			/* 0x0f masks out upper vendor bits (0x10, 0x20, 0x80),
+			 * extracting the standard legacy advertising type
+			 * (0x00-0x04) stored in the low nibble (bits 0-3).
+			 */
+			info->type &= 0x0f;
+		}
+
 		if (info->length <= max_adv_len(hdev)) {
 			rssi = info->data[info->length];
 			process_adv_report(hdev, info->type, &info->bdaddr,
-- 
2.52.0

RE: [bluetooth-next] Bluetooth: hci_event: strip Broadcom vendor bits from legacy adv report type

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 2123 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1186421/

---Test result---

Test Summary:
CheckPatch                    PASS      0.69 seconds
VerifyFixes                   PASS      8.86 seconds
VerifySignedoff               PASS      0.11 seconds
GitLint                       FAIL      0.28 seconds
SubjectPrefix                 PASS      0.09 seconds
BuildKernel                   PASS      30.14 seconds
CheckAllWarning               PASS      34.43 seconds
CheckSparse                   WARNING   37.06 seconds
BuildKernel32                 PASS      29.94 seconds
CheckKernelLLVM               PASS      35.93 seconds
TestRunnerSetup               PASS      724.13 seconds
TestRunner_l2cap-tester       PASS      12.96 seconds
TestRunner_iso-tester         PASS      12.83 seconds
TestRunner_bnep-tester        PASS      3.14 seconds
TestRunner_mgmt-tester        PASS      87.62 seconds
TestRunner_rfcomm-tester      PASS      5.62 seconds
TestRunner_sco-tester         PASS      5.64 seconds
TestRunner_ioctl-tester       PASS      4.67 seconds
TestRunner_mesh-tester        PASS      5.54 seconds
TestRunner_smp-tester         PASS      4.31 seconds
TestRunner_userchan-tester    PASS      3.17 seconds
TestRunner_6lowpan-tester     PASS      4.43 seconds
IncrementalBuild              PASS      28.85 seconds

Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[bluetooth-next] Bluetooth: hci_event: strip Broadcom vendor bits from legacy adv report type

1: T1 Title exceeds max length (93>80): "[bluetooth-next] Bluetooth: hci_event: strip Broadcom vendor bits from legacy adv report type"
##############################
Test: CheckSparse - WARNING
Desc: Run sparse tool with linux kernel
Output:
net/bluetooth/hci_event.c: note: in included file (through include/net/bluetooth/hci_core.h):


https://github.com/bluez/bluetooth-next/pull/946

---
Regards,
Linux Bluetooth

Re: [PATCH bluetooth-next] Bluetooth: hci_event: strip Broadcom vendor bits from legacy adv report type

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Thu, 15 Oct 2026 14:49:01 +0300 you wrote:
> Broadcom controllers running ROM firmware on Apple T2 Macs (where no
> RAM patchram exists, e.g. BCM4364B3 on MacBookPro16,1) set vendor bits
> 0x10/0x20/0x80 in the legacy LE Advertising Report Event_Type.
> 
> As a result, directed advertisements (ADV_DIRECT_IND) arrive as
> 0x81/0x91/0xa1 instead of 0x01. Because process_adv_report() drops any
> legacy report with type > LE_ADV_SCAN_RSP (0x04) as an unknown advertising
> packet type, bonded LE peripherals (such as Apple Magic Mouse/Keyboard)
> and Chrome passkey proximity scans fail to discover or reliably reconnect
> to the host.
> 
> [...]

Here is the summary with links:
  - [bluetooth-next] Bluetooth: hci_event: strip Broadcom vendor bits from legacy adv report type
    https://git.kernel.org/bluetooth/bluetooth-next/c/e3bb245b2daf

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html