[PATCH v12 0/7] Bluetooth: btmtk: Add MT7928 support

[Chris Lu <chris.lu@mediatek.com>]

This patch series adds support for MT7928 (device ID 0x7935) to the
btmtk driver, which requires a new two-stage firmware loading process
with CBMCU firmware.

The series is organized to fix existing issues first, then improve code
quality, and finally add new functionality. Patches have been reordered
in v12 to ensure dependencies are satisfied in the correct order.

Patch 1 fixes a DMA out-of-bounds access in btmtksdio_tx_packet() where
round_up() alignment causes DMA to read beyond the skb buffer, potentially
leaking kernel memory or triggering IOMMU faults. Also fixes a use-after-free
bug where sdio_hdr pointer becomes invalid after pskb_expand_head() reallocation.

Patch 2 fixes a pre-existing security issue in btmtk_setup_firmware_79xx()
by adding comprehensive firmware size validation to prevent out-of-bounds
memory access with truncated or malicious firmware files.

Patch 3 fixes a regression introduced in commit 28b7c5a6db74
("Bluetooth: btmtk: Add MT6639 (MT7927) Bluetooth support") where
SDIO devices would incorrectly pass dev_id=0 to btmtk_setup_firmware_79xx().
This prevents potential MT6639 hardware hangs and ensures correct hardware
identification in logs.

Patch 4 improves BT firmware logging to provide more useful information
for debugging: adds firmware filename before loading, displays chip ID
as HW version instead of firmware's hwver field, and uses %.16s format
specifier to prevent buffer over-read of the 16-byte datetime field.
This patch depends on Patch 3's dev_id fix to display correct hardware version.

Patch 5 fixes a pre-existing bug in btmtksdio_setup() where
btmtk_fw_get_filename() generates the correct firmware path but is
immediately overwritten by snprintf() with a generic legacy format,
causing newer chips to request incorrect filenames. This patch depends
on Patch 3's dev_id fix.

Patch 6 refactors existing firmware download code by replacing magic
numbers with a descriptive BTMTK_WMT_PKT_* enum, making the packet
sequencing logic clearer.

Patch 7 implements MT7928 firmware download flow, which requires loading
CBMCU firmware before Bluetooth firmware. The CBMCU firmware uses a
two-phase download sequence: Phase 1 downloads the section containing
global descriptor and signature data, Phase 2 downloads the remaining
firmware sections.

Tested on MT7928 hardware with successful firmware loading and
Bluetooth functionality verification.

Changes in v12:
- Swap Patch 3 and Patch 4 to fix dependency order issue:
  * Move "Pass hardware dev_id" before "Improve firmware logging"
  * Patch 4's logging improvement uses dev_id to display hardware version,
    but in v11 it would still display 0x0000 because Patch 3 (which fixes
    dev_id) came after it
  * This ensures every intermediate commit produces correct output
  Reported by AI review (Sashiko/Gemini).

Changes in v11:
- Patch 1: Fix use-after-free vulnerability in btmtksdio_tx_packet()
  After pskb_expand_head() reallocates the skb buffer, sdio_hdr pointer
  becomes invalid. Fix by reassigning sdio_hdr after reallocation.
  Reported by AI review (Sashiko/Gemini).
- Reorder patches for bisectability:
  * Move Patch 6->3 (firmware logging improvement) to prevent introducing
    buffer over-read risk in intermediate commits
  * Move Patch 3->5 and Patch 4->3 to ensure dev_id fix is applied before
    removing redundant filename override, preventing potential MT6639 hangs

Changes in v10:
- Add Patch 1 to fix DMA out-of-bounds access in btmtksdio_tx_packet()
  Discovered during v9 review - round_up() alignment can cause DMA to read
  beyond skb buffer, potentially leaking kernel memory or triggering IOMMU
  faults. Fix by expanding skb tailroom and zero-filling padding.

Changes in v9:
- Reorder patches to group SDIO fixes together (Patch 3-4)
- Patch 2 (was Patch 1 in v8): Fix firmware size validation in
  btmtk_setup_firmware_79xx()
- Patch 3 (was Patch 1, new in v9): Fix firmware filename override in
  btmtksdio_setup() where btmtk_fw_get_filename() result was incorrectly
  overwritten by snprintf()
- Patch 4 (was Patch 2 in v8): Fix SDIO device logging regression
  SDIO devices were passing hardcoded 0, causing "BT HW ver: 0x0000" log

Changes in v8:
- Split v7 Patch 1 into two separate patches:
  * Patch 1: btmtk firmware size validation
  * Patch 2: btmtksdio dev_id parameter pass-through
- Patch 3 (was v7 Patch 2): Keep BTMTK_WMT_PKT_* enum refactoring
- Patch 4 (was v7 Patch 3): Keep MT7928 support implementation

Changes in v7:
- Patch 1: Add commit 28b7c5a6db74 to Fixes tag per Luiz's feedback
- Patch 3: Keep BTMTK_WMT_PKT_* enum refactoring per Luiz's suggestion

Changes in v6:
- Patch 1: Per Luiz's feedback, add Fixes tag for commit 28b7c5a6db74
  which introduced the dev_id hardcoded 0 issue
- Patch 1: Restructure btmtk_setup_firmware_79xx() parameter comment

Changes in v5:
- Patch 1: Move btmtk_setup_firmware_79xx() dev_id documentation to
  function-level comment per Marcel's feedback

Changes in v4:
- Patch 1: Fix commit message title (remove redundant "to")
- Patch 1: Expand commit description per Marcel's suggestion
- Patch 1: Document btmtk_setup_firmware_79xx()'s dev_id parameter usage

Changes in v3:
- Patch 1: Use 'u32 dev_id' instead of 'u16 dev_id' per Marcel's feedback

Changes in v2:
- Combine MT7928 functionality into a single patch per Marcel's feedback
  (previous v1 split it into multiple patches)
- Use existing btmtk_fw_get_filename() for MT7928 firmware path
- Improve commit descriptions

Chris Lu (7):
  Bluetooth: btmtksdio: Fix DMA out-of-bounds access in TX path
  Bluetooth: btmtk: Add firmware size validation in
    btmtk_setup_firmware_79xx()
  Bluetooth: btmtksdio: Pass hardware dev_id to mt79xx_setup()
  Bluetooth: btmtk: Improve BT firmware logging
  Bluetooth: btmtksdio: Remove redundant firmware filename override
  Bluetooth: btmtk: Replace magic numbers with WMT packet flag enum
  Bluetooth: btmtk: Add MT7928 support

 drivers/bluetooth/btmtk.c     | 427 +++++++++++++++++++++++++++++++++-
 drivers/bluetooth/btmtk.h     |   9 +
 drivers/bluetooth/btmtksdio.c |  42 +++-
 3 files changed, 459 insertions(+), 19 deletions(-)

-- 
2.45.2