[PATCH 2/2] Bluetooth: btusb: Disable LL Privacy on Intel JfP (8087:0aaa)

[Diego Francio <dfrancio@gmail.com>]

The Intel Jefferson Peak controller (Wireless-AC 9460/9462/9560,
USB 8087:0aaa) reports LL Privacy support, but since commit
e209e5ccc5ac ("Bluetooth: MGMT: Mark LL Privacy as stable") the kernel
uses it whenever the controller claims it. With BLE HID devices paired
(Logitech ERGO K860 and MX Vertical), the controller firmware then
crashes every few minutes:

  Bluetooth: hci0: Hardware error 0x0c
  Bluetooth: hci0: Exception info ...

The reset drops every connection, so keyboard and mouse stall and
reconnect over and over. Older firmware builds (2022.50 build 97 and a
2022.22 build) behave the same, so this is not a firmware version
regression.

Tested on an Intel 9462 (CNVi, Alder Lake PCH) laptop running mainline
builds: 6.1.190 and 6.12.70 are fine, while 6.17.12 and 7.0 crash every
3-15 minutes. With LL Privacy forced off in hci_sync.c on top of
Ubuntu 7.0.0-38, the same hardware and devices ran for 9 hours without
a single Hardware Error. With this patch applied on the same kernel, the
controller then ran for more than 4 hours with the keyboard and mouse
connected and no Hardware Error. The exact HCI command that crashes the
firmware was not identified.

Set HCI_QUIRK_BROKEN_LL_PRIVACY for this USB ID so the resolving list is
not used on it.

Fixes: e209e5ccc5ac ("Bluetooth: MGMT: Mark LL Privacy as stable")
Cc: stable@vger.kernel.org # 6.14+
Signed-off-by: Diego Francio <dfrancio@gmail.com>
---
 drivers/bluetooth/btusb_main.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btusb_main.c b/drivers/bluetooth/btusb_main.c
index 92a78a7..6a75341 100644
--- a/drivers/bluetooth/btusb_main.c
+++ b/drivers/bluetooth/btusb_main.c
@@ -70,6 +70,7 @@ static struct usb_driver btusb_driver;
 #define BTUSB_INTEL_NO_WBS_SUPPORT	BIT(26)
 #define BTUSB_ACTIONS_SEMI		BIT(27)
 #define BTUSB_BARROT			BIT(28)
+#define BTUSB_BROKEN_LL_PRIVACY		BIT(29)
 #define BTUSB_QUALCOMM			BIT(30)
 
 static const struct usb_device_id btusb_table[] = {
@@ -529,7 +530,8 @@ static const struct usb_device_id quirks_table[] = {
 	{ USB_DEVICE(0x8087, 0x0a2b), .driver_info = BTUSB_INTEL_COMBINED },
 	{ USB_DEVICE(0x8087, 0x0aa7), .driver_info = BTUSB_INTEL_COMBINED |
 						     BTUSB_INTEL_BROKEN_SHUTDOWN_LED },
-	{ USB_DEVICE(0x8087, 0x0aaa), .driver_info = BTUSB_INTEL_COMBINED },
+	{ USB_DEVICE(0x8087, 0x0aaa), .driver_info = BTUSB_INTEL_COMBINED |
+						     BTUSB_BROKEN_LL_PRIVACY },
 
 	/* Other Intel Bluetooth devices */
 	{ USB_VENDOR_AND_INTERFACE_INFO(0x8087, 0xe0, 0x01, 0x01),
@@ -4608,6 +4610,9 @@ static int btusb_probe(struct usb_interface *intf,
 			btintel_set_flag(hdev, INTEL_BROKEN_SHUTDOWN_LED);
 	}
 
+	if (id->driver_info & BTUSB_BROKEN_LL_PRIVACY)
+		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LL_PRIVACY);
+
 	if (id->driver_info & BTUSB_MARVELL)
 		hdev->set_bdaddr = btusb_set_bdaddr_marvell;
 
-- 
2.53.0