* [PATCH v13 0/7] Bluetooth: btmtk: Add MT7928 support
@ 2026-07-16 11:23 Chris Lu
2026-07-16 11:23 ` [PATCH v13 1/7] Bluetooth: btmtksdio: Fix SKB handling issues in TX path Chris Lu
` (6 more replies)
0 siblings, 7 replies; 20+ messages in thread
From: Chris Lu @ 2026-07-16 11:23 UTC (permalink / raw)
To: Marcel Holtmann, Johan Hedberg, Luiz Von Dentz
Cc: Sean Wang, Will Lee, SS Wu, Steve Lee, Paul Menzel,
linux-bluetooth, linux-kernel, linux-mediatek, Chris Lu
This patch series adds support for MT7928 (device ID 0x7935) to the
btmtk driver, which requires a new two-stage firmware loading process
with CBMCU firmware.
Patch 1 fixes SKB handling issues: DMA out-of-bounds read and cloned
SKB corruption. Fix by calling skb_unshare() and expanding skb tailroom
with zero-padding.
Patch 2 adds firmware size validation with integer overflow protection
to prevent out-of-bounds access with malicious firmware files.
Patch 3 passes hardware dev_id to mt79xx_setup() to fix incorrect chip
ID logging (was hardcoded to 0).
Patch 4 removes redundant snprintf() that overrides btmtk_fw_get_filename()
result, causing newer chips to request incorrect firmware filenames.
Patch 5 improves firmware logging: adds filename log, uses chip ID as
HW version, and uses %.16s format specifier for datetime field.
Patch 6 replaces magic numbers with BTMTK_WMT_PKT_* enum for better
code readability.
Patch 7 implements MT7928 CBMCU firmware download with two-phase loading
sequence and cert_len overflow protection.
Tested on MT7928 hardware with successful firmware loading and
Bluetooth functionality verification.
Changes in v13:
- Fix cloned SKB corruption (HIGH severity) by adding skb_unshare() (Patch 1)
- Fix cert_len integer overflow (CRITICAL severity) in CBMCU firmware loading (Patch 7)
Pre-existing issues fixed in subsequent patches:
- Patch 2 introduces format string issue (%s on non-null-terminated field)
-> Fixed in Patch 5 using %.16s format specifier
- Patch 3 context has pre-existing snprintf() override (identified in v12 review)
-> Fixed in Patch 4, resolving firmware load failures on MT6639/MT7925/MT7928
This gradual improvement approach allows independent backporting of each fix.
v12 -> v13:
- Added skb_unshare() to prevent cloned SKB corruption
- Added overflow checks for cert_len calculation
- Split SDIO firmware loading fixes into two patches
Changes in v12:
- Reordered patches to fix dependency: move "Pass dev_id" before
"Improve logging" so dev_id is available when logging
Changes in v11:
- Fixed use-after-free: reassign sdio_hdr after pskb_expand_head()
- Reordered patches for bisectability
Changes in v10:
- Added Patch 1 to fix DMA out-of-bounds access
Changes in v9:
- Reordered patches to group SDIO fixes together
Changes in v8:
- Split firmware validation from dev_id pass-through into separate patches
Changes in v7:
- Added Fixes tag per feedback
Changes in v6:
- Added Fixes tag and restructured parameter comment
Changes in v5:
- Moved documentation to function-level comment
Changes in v4:
- Fixed commit message and expanded description
Changes in v3:
- Changed dev_id type from u16 to u32
Changes in v2:
- Combined MT7928 functionality into single patch
Chris Lu (7):
Bluetooth: btmtksdio: Fix SKB handling issues in TX path
Bluetooth: btmtk: Add firmware size validation in
btmtk_setup_firmware_79xx()
Bluetooth: btmtksdio: Pass hardware dev_id to mt79xx_setup()
Bluetooth: btmtksdio: Remove redundant firmware filename override
Bluetooth: btmtk: Improve BT firmware logging
Bluetooth: btmtk: Replace magic numbers with WMT packet flag enum
Bluetooth: btmtk: Add MT7928 support
drivers/bluetooth/btmtk.c | 427 +++++++++++++++++++++++++++++++++-
drivers/bluetooth/btmtk.h | 9 +
drivers/bluetooth/btmtksdio.c | 42 +++-
3 files changed, 459 insertions(+), 19 deletions(-)
--
2.45.2
^ permalink raw reply [flat|nested] 20+ messages in thread* [PATCH v13 1/7] Bluetooth: btmtksdio: Fix SKB handling issues in TX path
2026-07-16 11:23 [PATCH v13 0/7] Bluetooth: btmtk: Add MT7928 support Chris Lu
@ 2026-07-16 11:23 ` Chris Lu
2026-07-16 12:02 ` Bluetooth: btmtk: Add MT7928 support bluez.test.bot
2026-07-16 11:23 ` [PATCH v13 2/7] Bluetooth: btmtk: Add firmware size validation in btmtk_setup_firmware_79xx() Chris Lu
` (5 subsequent siblings)
6 siblings, 1 reply; 20+ messages in thread
From: Chris Lu @ 2026-07-16 11:23 UTC (permalink / raw)
To: Marcel Holtmann, Johan Hedberg, Luiz Von Dentz
Cc: Sean Wang, Will Lee, SS Wu, Steve Lee, Paul Menzel,
linux-bluetooth, linux-kernel, linux-mediatek, Chris Lu
Fix two SKB handling issues in btmtksdio_tx_packet():
1. DMA out-of-bounds read: The driver aligns transfer size to 256 bytes
using round_up(), but does not ensure the skb buffer has sufficient
tailroom, causing DMA to read beyond the buffer. Fix by expanding skb
tailroom if needed and zero-filling the padding.
2. Cloned SKB corruption: The driver modifies SKB header (via skb_push)
and tail (via skb_put_zero) without checking if the SKB is cloned.
If the Bluetooth core passes a cloned SKB (e.g., from L2CAP
retransmission queues), the driver corrupts the shared data buffer
for other subsystems. Fix by calling skb_unshare() at function entry
to ensure we have a private copy before any modifications.
Fixes: 9aebfd4a2200 ("Bluetooth: mediatek: add support for MediaTek MT7663S and MT7668S SDIO devices")
Signed-off-by: Chris Lu <chris.lu@mediatek.com>
Assisted-by: Claude:Sonnet-4.5
---
drivers/bluetooth/btmtksdio.c | 42 ++++++++++++++++++++++++++++++-----
1 file changed, 37 insertions(+), 5 deletions(-)
diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c
index 5b0fab7b89b5..8a7f2e1c4d56 100644
--- a/drivers/bluetooth/btmtksdio.c
+++ b/drivers/bluetooth/btmtksdio.c
@@ -272,9 +272,20 @@ static int btmtksdio_tx_packet(struct btmtksdio_dev *bdev,
struct sk_buff *skb)
{
struct mtkbtsdio_hdr *sdio_hdr;
+ unsigned int padded_len, pad_len;
int err;
- /* Make sure that there are enough rooms for SDIO header */
+ /* Ensure SKB is not cloned before any modification.
+ * If cloned (e.g., L2CAP retransmission queues), create a
+ * private copy to avoid corrupting shared data buffer.
+ */
+ skb = skb_unshare(skb, GFP_ATOMIC);
+ if (!skb)
+ return -ENOMEM;
+
+ /* Make sure that there are enough rooms for SDIO header.
+ * After skb_unshare(), we have exclusive ownership of the buffer.
+ */
if (unlikely(skb_headroom(skb) < sizeof(*sdio_hdr))) {
err = pskb_expand_head(skb, sizeof(*sdio_hdr), 0,
GFP_ATOMIC);
@@ -290,18 +301,39 @@ static int btmtksdio_tx_packet(struct btmtksdio_dev *bdev,
sdio_hdr->reserved = cpu_to_le16(0);
sdio_hdr->bt_type = hci_skb_pkt_type(skb);
+ /* Calculate padded length for block-aligned DMA transfer.
+ * SDIO requires transfers to be block-aligned (MTK_SDIO_BLOCK_SIZE).
+ * Pad with zeros to prevent DMA from reading beyond skb buffer.
+ */
+ padded_len = round_up(skb->len, MTK_SDIO_BLOCK_SIZE);
+ pad_len = padded_len - skb->len;
+
+ if (pad_len > 0) {
+ /* Ensure sufficient tailroom for padding */
+ if (unlikely(skb_tailroom(skb) < pad_len)) {
+ err = pskb_expand_head(skb, 0, pad_len, GFP_ATOMIC);
+ if (err < 0)
+ goto err_skb_pull;
+ /* Reassign sdio_hdr after buffer reallocation */
+ sdio_hdr = (void *)skb->data;
+ }
+
+ /* Zero-fill padding to prevent information disclosure */
+ skb_put_zero(skb, pad_len);
+ }
+
clear_bit(BTMTKSDIO_HW_TX_READY, &bdev->tx_state);
- err = sdio_writesb(bdev->func, MTK_REG_CTDR, skb->data,
- round_up(skb->len, MTK_SDIO_BLOCK_SIZE));
+ err = sdio_writesb(bdev->func, MTK_REG_CTDR, skb->data, padded_len);
if (err < 0)
- goto err_skb_pull;
+ goto err_skb_trim;
- bdev->hdev->stat.byte_tx += skb->len;
+ /* Record actual transmitted data (excluding padding) */
+ bdev->hdev->stat.byte_tx += le16_to_cpu(sdio_hdr->len);
kfree_skb(skb);
return 0;
+err_skb_trim:
+ if (pad_len > 0)
+ skb_trim(skb, skb->len - pad_len);
err_skb_pull:
skb_pull(skb, sizeof(*sdio_hdr));
+ kfree_skb(skb);
return err;
}
--
2.45.2
^ permalink raw reply related [flat|nested] 20+ messages in thread* [PATCH v13 2/7] Bluetooth: btmtk: Add firmware size validation in btmtk_setup_firmware_79xx()
2026-07-16 11:23 [PATCH v13 0/7] Bluetooth: btmtk: Add MT7928 support Chris Lu
2026-07-16 11:23 ` [PATCH v13 1/7] Bluetooth: btmtksdio: Fix SKB handling issues in TX path Chris Lu
@ 2026-07-16 11:23 ` Chris Lu
2026-07-16 11:23 ` [PATCH v13 3/7] Bluetooth: btmtksdio: Pass hardware dev_id to mt79xx_setup() Chris Lu
` (4 subsequent siblings)
6 siblings, 0 replies; 20+ messages in thread
From: Chris Lu @ 2026-07-16 11:23 UTC (permalink / raw)
To: Marcel Holtmann, Johan Hedberg, Luiz Von Dentz
Cc: Sean Wang, Will Lee, SS Wu, Steve Lee, Paul Menzel,
linux-bluetooth, linux-kernel, linux-mediatek, Chris Lu
Add firmware size validation to prevent out-of-bounds access when loading
truncated or malicious firmware files.
Add three levels of validation:
1. Minimum size check for header and global descriptor
2. Section map bounds check with integer overflow protection using
check_mul_overflow() and check_add_overflow()
3. Section data bounds check before accessing each section
This matches the validation approach used in btmtk_load_cbmcu_firmware().
Signed-off-by: Chris Lu <chris.lu@mediatek.com>
Assisted-by: Claude:Sonnet-4.5
---
drivers/bluetooth/btmtk.c | 39 +++++++++++++++++++++++++++++++++++++++
1 file changed, 39 insertions(+)
diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c
index 02a96342e964..3491060b3ae9 100644
--- a/drivers/bluetooth/btmtk.c
+++ b/drivers/bluetooth/btmtk.c
@@ -145,6 +145,7 @@ int btmtk_setup_firmware_79xx(struct hci_dev *hdev, const char *fwname,
int err, dlen, i, status;
u8 flag, first_block, retry;
u32 section_num, dl_size, section_offset;
+ size_t expected_size;
u8 cmd[64];
err = request_firmware(&fw, fwname, &hdev->dev);
@@ -153,12 +154,40 @@ int btmtk_setup_firmware_79xx(struct hci_dev *hdev, const char *fwname,
return err;
}
+ /* Validate minimum firmware size for header and global descriptor */
+ if (fw->size < MTK_FW_ROM_PATCH_HEADER_SIZE + MTK_FW_ROM_PATCH_GD_SIZE) {
+ bt_dev_err(hdev, "Firmware file too small: size=%zu, expected at least %u bytes",
+ fw->size, MTK_FW_ROM_PATCH_HEADER_SIZE + MTK_FW_ROM_PATCH_GD_SIZE);
+ err = -EINVAL;
+ goto err_release_fw;
+ }
+
fw_ptr = fw->data;
fw_bin_ptr = fw_ptr;
hdr = (struct btmtk_patch_header *)fw_ptr;
globaldesc = (struct btmtk_global_desc *)(fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE);
section_num = le32_to_cpu(globaldesc->section_num);
+ /* Check for potential integer overflow in size calculation */
+ if (check_mul_overflow((size_t)MTK_FW_ROM_PATCH_SEC_MAP_SIZE,
+ (size_t)section_num, &expected_size) ||
+ check_add_overflow(expected_size,
+ (size_t)(MTK_FW_ROM_PATCH_HEADER_SIZE +
+ MTK_FW_ROM_PATCH_GD_SIZE),
+ &expected_size)) {
+ bt_dev_err(hdev, "Firmware size calculation overflow (section_num=%u)",
+ section_num);
+ err = -EINVAL;
+ goto err_release_fw;
+ }
+
+ if (fw->size < expected_size) {
+ bt_dev_err(hdev, "Firmware truncated: size=%zu, expected=%zu (section_num=%u)",
+ fw->size, expected_size, section_num);
+ err = -EINVAL;
+ goto err_release_fw;
+ }
+
bt_dev_info(hdev, "HW/SW Version: 0x%04x%04x, Build Time: %s",
le16_to_cpu(hdr->hwver), le16_to_cpu(hdr->swver), hdr->datetime);
@@ -171,6 +200,16 @@ int btmtk_setup_firmware_79xx(struct hci_dev *hdev, const char *fwname,
section_offset = le32_to_cpu(sectionmap->secoffset);
dl_size = le32_to_cpu(sectionmap->bin_info_spec.dlsize);
+ /* Validate section boundaries to prevent out-of-bounds access */
+ if (dl_size > 0 &&
+ (section_offset > fw->size ||
+ dl_size > fw->size - section_offset)) {
+ bt_dev_err(hdev, "Section %d out of bounds: offset=%u, size=%u, fw_size=%zu",
+ i, section_offset, dl_size, fw->size);
+ err = -EINVAL;
+ goto err_release_fw;
+ }
+
/* MT6639: only download sections where dlmode byte0 == 0x01,
* matching the Windows driver behavior which skips WiFi/other
* sections that would cause the chip to hang.
--
2.45.2
^ permalink raw reply related [flat|nested] 20+ messages in thread* [PATCH v13 3/7] Bluetooth: btmtksdio: Pass hardware dev_id to mt79xx_setup()
2026-07-16 11:23 [PATCH v13 0/7] Bluetooth: btmtk: Add MT7928 support Chris Lu
2026-07-16 11:23 ` [PATCH v13 1/7] Bluetooth: btmtksdio: Fix SKB handling issues in TX path Chris Lu
2026-07-16 11:23 ` [PATCH v13 2/7] Bluetooth: btmtk: Add firmware size validation in btmtk_setup_firmware_79xx() Chris Lu
@ 2026-07-16 11:23 ` Chris Lu
2026-07-16 11:23 ` [PATCH v13 4/7] Bluetooth: btmtksdio: Remove redundant firmware filename override Chris Lu
` (3 subsequent siblings)
6 siblings, 0 replies; 20+ messages in thread
From: Chris Lu @ 2026-07-16 11:23 UTC (permalink / raw)
To: Marcel Holtmann, Johan Hedberg, Luiz Von Dentz
Cc: Sean Wang, Will Lee, SS Wu, Steve Lee, Paul Menzel,
linux-bluetooth, linux-kernel, linux-mediatek, Chris Lu
mt79xx_setup() hardcodes dev_id=0 when calling btmtk_setup_firmware_79xx(),
causing SDIO devices to log incorrect chip ID "BT HW ver: 0x0000" instead
of the actual hardware version read from register 0x70010200.
Pass the hardware dev_id to mt79xx_setup() and forward it to
btmtk_setup_firmware_79xx() to match USB driver behavior and display
correct chip identification.
Fixes: 28b7c5a6db74 ("Bluetooth: btmtk: Add MT6639 (MT7927) Bluetooth support")
Signed-off-by: Chris Lu <chris.lu@mediatek.com>
---
drivers/bluetooth/btmtksdio.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c
index feda1ea8f256..088fdfb56231 100644
--- a/drivers/bluetooth/btmtksdio.c
+++ b/drivers/bluetooth/btmtksdio.c
@@ -901,14 +901,14 @@ static int mt76xx_setup(struct hci_dev *hdev, const char *fwname)
return 0;
}
-static int mt79xx_setup(struct hci_dev *hdev, const char *fwname)
+static int mt79xx_setup(struct hci_dev *hdev, const char *fwname, u32 dev_id)
{
struct btmtksdio_dev *bdev = hci_get_drvdata(hdev);
struct btmtk_hci_wmt_params wmt_params;
u8 param = 0x1;
int err;
- err = btmtk_setup_firmware_79xx(hdev, fwname, mtk_hci_wmt_sync, 0);
+ err = btmtk_setup_firmware_79xx(hdev, fwname, mtk_hci_wmt_sync, dev_id);
if (err < 0) {
bt_dev_err(hdev, "Failed to setup 79xx firmware (%d)", err);
return err;
@@ -1167,7 +1167,7 @@ static int btmtksdio_setup(struct hci_dev *hdev)
snprintf(fwname, sizeof(fwname),
"mediatek/BT_RAM_CODE_MT%04x_1_%x_hdr.bin",
dev_id & 0xffff, (fw_version & 0xff) + 1);
- err = mt79xx_setup(hdev, fwname);
+ err = mt79xx_setup(hdev, fwname, dev_id);
if (err < 0)
return err;
--
2.45.2
^ permalink raw reply related [flat|nested] 20+ messages in thread* [PATCH v13 4/7] Bluetooth: btmtksdio: Remove redundant firmware filename override
2026-07-16 11:23 [PATCH v13 0/7] Bluetooth: btmtk: Add MT7928 support Chris Lu
` (2 preceding siblings ...)
2026-07-16 11:23 ` [PATCH v13 3/7] Bluetooth: btmtksdio: Pass hardware dev_id to mt79xx_setup() Chris Lu
@ 2026-07-16 11:23 ` Chris Lu
2026-07-16 11:23 ` [PATCH v13 5/7] Bluetooth: btmtk: Improve BT firmware logging Chris Lu
` (2 subsequent siblings)
6 siblings, 0 replies; 20+ messages in thread
From: Chris Lu @ 2026-07-16 11:23 UTC (permalink / raw)
To: Marcel Holtmann, Johan Hedberg, Luiz Von Dentz
Cc: Sean Wang, Will Lee, SS Wu, Steve Lee, Paul Menzel,
linux-bluetooth, linux-kernel, linux-mediatek, Chris Lu
btmtksdio_setup() calls btmtk_fw_get_filename() to generate the correct
firmware filename based on device ID and version, then immediately
overwrites it with snprintf() using a generic legacy format.
This redundant override causes newer chips (MT6639, MT7925, MT7928) to
request incorrect firmware filenames, leading to firmware load failures.
For example, MT6639 needs "mediatek/mt7927/BT_RAM_CODE_MT6639_2_1_hdr.bin"
but snprintf() generates "mediatek/BT_RAM_CODE_MT6639_1_1_hdr.bin".
Remove the redundant snprintf() override to use the correct filename
generated by btmtk_fw_get_filename(), matching USB driver behavior.
Fixes: 7f935b21bee4 ("Bluetooth: btmtk: apply the common btmtk_fw_get_filename")
Signed-off-by: Chris Lu <chris.lu@mediatek.com>
---
drivers/bluetooth/btmtksdio.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c
index 088fdfb56231..4a160d5131f1 100644
--- a/drivers/bluetooth/btmtksdio.c
+++ b/drivers/bluetooth/btmtksdio.c
@@ -1164,9 +1164,6 @@ static int btmtksdio_setup(struct hci_dev *hdev)
btmtk_fw_get_filename(fwname, sizeof(fwname), dev_id,
fw_version, 0);
- snprintf(fwname, sizeof(fwname),
- "mediatek/BT_RAM_CODE_MT%04x_1_%x_hdr.bin",
- dev_id & 0xffff, (fw_version & 0xff) + 1);
err = mt79xx_setup(hdev, fwname, dev_id);
if (err < 0)
return err;
--
2.45.2
^ permalink raw reply related [flat|nested] 20+ messages in thread* [PATCH v13 5/7] Bluetooth: btmtk: Improve BT firmware logging
2026-07-16 11:23 [PATCH v13 0/7] Bluetooth: btmtk: Add MT7928 support Chris Lu
` (3 preceding siblings ...)
2026-07-16 11:23 ` [PATCH v13 4/7] Bluetooth: btmtksdio: Remove redundant firmware filename override Chris Lu
@ 2026-07-16 11:23 ` Chris Lu
2026-07-16 11:23 ` [PATCH v13 6/7] Bluetooth: btmtk: Replace magic numbers with WMT packet flag enum Chris Lu
2026-07-16 11:23 ` [PATCH v13 7/7] Bluetooth: btmtk: Add MT7928 support Chris Lu
6 siblings, 0 replies; 20+ messages in thread
From: Chris Lu @ 2026-07-16 11:23 UTC (permalink / raw)
To: Marcel Holtmann, Johan Hedberg, Luiz Von Dentz
Cc: Sean Wang, Will Lee, SS Wu, Steve Lee, Paul Menzel,
linux-bluetooth, linux-kernel, linux-mediatek, Chris Lu
Improve firmware loading log messages to provide more useful information:
- Add firmware filename before loading to help identify which file
is being loaded
- Display chip ID (dev_id) as HW version instead of firmware's hwver
field, which provides more meaningful hardware identification
- Use %.16s format specifier for hdr->datetime field to prevent
potential buffer over-read, as the field is a 16-byte array that
may not be null-terminated
log output with MT7922
[ 212.878783] Bluetooth: hci1: Loading BT firmware: mediatek/BT_RAM_CODE_MT7922_1_1_hdr.bin
[ 212.889614] Bluetooth: hci1: BT HW ver: 0x7922, SW ver: 0x008a, Build Time: 20260224103448
[ 216.048877] Bluetooth: hci1: Device setup in 3096530 usecs
[ 216.048890] Bluetooth: hci1: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported.
[ 216.114179] Bluetooth: hci1: AOSP extensions version v1.00
[ 216.114220] Bluetooth: hci1: AOSP quality report is supported
[ 216.116782] Bluetooth: MGMT ver 1.23
Signed-off-by: Chris Lu <chris.lu@mediatek.com>
Assisted-by: Claude:Sonnet-4.5
---
drivers/bluetooth/btmtk.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c
index 3491060b3ae9..595e346accc3 100644
--- a/drivers/bluetooth/btmtk.c
+++ b/drivers/bluetooth/btmtk.c
@@ -148,6 +148,8 @@ int btmtk_setup_firmware_79xx(struct hci_dev *hdev, const char *fwname,
size_t expected_size;
u8 cmd[64];
+ bt_dev_info(hdev, "Loading BT firmware: %s", fwname);
+
err = request_firmware(&fw, fwname, &hdev->dev);
if (err < 0) {
bt_dev_err(hdev, "Failed to load firmware file (%d)", err);
@@ -188,8 +190,8 @@ int btmtk_setup_firmware_79xx(struct hci_dev *hdev, const char *fwname,
goto err_release_fw;
}
- bt_dev_info(hdev, "HW/SW Version: 0x%04x%04x, Build Time: %s",
- le16_to_cpu(hdr->hwver), le16_to_cpu(hdr->swver), hdr->datetime);
+ bt_dev_info(hdev, "BT HW ver: 0x%04x, SW ver: 0x%04x, Build Time: %.16s",
+ dev_id & 0xffff, le16_to_cpu(hdr->swver), hdr->datetime);
for (i = 0; i < section_num; i++) {
first_block = 1;
--
2.45.2
^ permalink raw reply related [flat|nested] 20+ messages in thread* [PATCH v13 6/7] Bluetooth: btmtk: Replace magic numbers with WMT packet flag enum
2026-07-16 11:23 [PATCH v13 0/7] Bluetooth: btmtk: Add MT7928 support Chris Lu
` (4 preceding siblings ...)
2026-07-16 11:23 ` [PATCH v13 5/7] Bluetooth: btmtk: Improve BT firmware logging Chris Lu
@ 2026-07-16 11:23 ` Chris Lu
2026-07-16 11:23 ` [PATCH v13 7/7] Bluetooth: btmtk: Add MT7928 support Chris Lu
6 siblings, 0 replies; 20+ messages in thread
From: Chris Lu @ 2026-07-16 11:23 UTC (permalink / raw)
To: Marcel Holtmann, Johan Hedberg, Luiz Von Dentz
Cc: Sean Wang, Will Lee, SS Wu, Steve Lee, Paul Menzel,
linux-bluetooth, linux-kernel, linux-mediatek, Chris Lu
Add BTMTK_WMT_PKT_* enum to represent WMT download packet sequence flags,
improving code readability. Replace magic numbers (1, 2, 3) in
btmtk_setup_firmware_79xx() and btmtk_setup_firmware() with descriptive
enum values:
- BTMTK_WMT_PKT_START (1): First packet of a sequence
- BTMTK_WMT_PKT_CONTINUE (2): Continuation packet
- BTMTK_WMT_PKT_END (3): Final packet of a sequence
Signed-off-by: Chris Lu <chris.lu@mediatek.com>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Assisted-by: Claude:Sonnet-4.5
---
drivers/bluetooth/btmtk.c | 12 ++++++------
drivers/bluetooth/btmtk.h | 6 ++++++
2 files changed, 12 insertions(+), 6 deletions(-)
diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c
index 595e346accc3..75519765bb49 100644
--- a/drivers/bluetooth/btmtk.c
+++ b/drivers/bluetooth/btmtk.c
@@ -271,12 +271,12 @@ int btmtk_setup_firmware_79xx(struct hci_dev *hdev, const char *fwname,
while (dl_size > 0) {
dlen = min_t(int, 250, dl_size);
if (first_block == 1) {
- flag = 1;
+ flag = BTMTK_WMT_PKT_START;
first_block = 0;
} else if (dl_size - dlen <= 0) {
- flag = 3;
+ flag = BTMTK_WMT_PKT_END;
} else {
- flag = 2;
+ flag = BTMTK_WMT_PKT_CONTINUE;
}
wmt_params.flag = flag;
@@ -355,7 +355,7 @@ int btmtk_setup_firmware(struct hci_dev *hdev, const char *fwname,
fw_size -= 30;
fw_ptr += 30;
- flag = 1;
+ flag = BTMTK_WMT_PKT_START;
wmt_params.op = BTMTK_WMT_PATCH_DWNLD;
wmt_params.status = NULL;
@@ -365,9 +365,9 @@ int btmtk_setup_firmware(struct hci_dev *hdev, const char *fwname,
/* Tell device the position in sequence */
if (fw_size - dlen <= 0)
- flag = 3;
+ flag = BTMTK_WMT_PKT_END;
else if (fw_size < fw->size - 30)
- flag = 2;
+ flag = BTMTK_WMT_PKT_CONTINUE;
wmt_params.flag = flag;
wmt_params.dlen = dlen;
diff --git a/drivers/bluetooth/btmtk.h b/drivers/bluetooth/btmtk.h
index c83c24897c95..51c18dde0a80 100644
--- a/drivers/bluetooth/btmtk.h
+++ b/drivers/bluetooth/btmtk.h
@@ -66,6 +66,12 @@ enum {
BTMTK_WMT_ON_PROGRESS,
};
+enum {
+ BTMTK_WMT_PKT_START = 1,
+ BTMTK_WMT_PKT_CONTINUE = 2,
+ BTMTK_WMT_PKT_END = 3,
+};
+
struct btmtk_wmt_hdr {
u8 dir;
u8 op;
--
2.45.2
^ permalink raw reply related [flat|nested] 20+ messages in thread* [PATCH v13 7/7] Bluetooth: btmtk: Add MT7928 support
2026-07-16 11:23 [PATCH v13 0/7] Bluetooth: btmtk: Add MT7928 support Chris Lu
` (5 preceding siblings ...)
2026-07-16 11:23 ` [PATCH v13 6/7] Bluetooth: btmtk: Replace magic numbers with WMT packet flag enum Chris Lu
@ 2026-07-16 11:23 ` Chris Lu
6 siblings, 0 replies; 20+ messages in thread
From: Chris Lu @ 2026-07-16 11:23 UTC (permalink / raw)
To: Marcel Holtmann, Johan Hedberg, Luiz Von Dentz
Cc: Sean Wang, Will Lee, SS Wu, Steve Lee, Paul Menzel,
linux-bluetooth, linux-kernel, linux-mediatek, Chris Lu
Add support for MT7928 (internal device ID is MT7935) which requires
additional firmware (CBMCU firmware) loading before Bluetooth firmware.
CBMCU is a new component on MT7928 to handle common part shared across
the combo chip (Wi-Fi/Bluetooth's subsystem), providing a better user
experience through improved coordination between subsystems.
Implement two-phase CBMCU firmware download: Phase 1 loads section with
type 0x5 containing global descriptor, section maps and signature data;
Phase 2 loads remaining firmware sections. Add retry mechanism for
concurrent download protection.
After CBMCU firmware loads successfully, the driver continues to load
corresponding BT firmware based on device ID through fallthrough to
case 0x7922/0x7925.
Use %.16s format specifier for hdr->datetime field in CBMCU firmware
logging to prevent potential buffer over-read, as the field is a 16-byte
array that may not be null-terminated.
The firmware(CBMCU_CODE_MT7935_1_1.bin/BT_RAM_CODE_MT7935_1_1_hdr.bin)
required for MT7928 will be scheduled for upload to linux-firmware at
a later stage.
MT7928 bring-up kernel log:
[ 6931.197167] usb 1-3: New USB device found, idVendor=0e8d, idProduct=7935, bcdDevice= 1.00
[ 6931.197212] usb 1-3: New USB device strings: Mfr=5, Product=6, SerialNumber=7
[ 6931.197237] usb 1-3: Product: Wireless_Device
[ 6931.197258] usb 1-3: Manufacturer: MediaTek Inc.
[ 6931.197279] usb 1-3: SerialNumber: 000000000
[ 6931.213478] Bluetooth: hci1: Loading CBMCU firmware: mediatek/mt7928/CBMCU_CODE_MT7935_1_1.bin
[ 6931.215214] Bluetooth: hci1: CBMCU HW ver: 0x7935, SW ver: 0x0000, Build Time: 20260601T161751+
[ 6931.623962] Bluetooth: hci1: CBMCU firmware download completed
[ 6931.643916] Bluetooth: hci1: Loading BT firmware: mediatek/mt7928/BT_RAM_CODE_MT7935_1_1_hdr.bin
[ 6931.650467] Bluetooth: hci1: BT HW ver: 0x7935, SW ver: 0x0000, Build Time: 20260527000816
[ 6935.039790] Bluetooth: hci1: Device setup in 3369644 usecs
[ 6935.039833] Bluetooth: hci1: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported.
[ 6935.160654] Bluetooth: hci1: AOSP extensions version v2.00
[ 6935.160710] Bluetooth: hci1: AOSP quality report is supported
[ 6935.162954] Bluetooth: MGMT ver 1.23
Signed-off-by: Chris Lu <chris.lu@mediatek.com>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Reviewed-by: Sean Wang <sean.wang@mediatek.com>
Assisted-by: Claude:Sonnet-4.5
---
drivers/bluetooth/btmtk.c | 370 +++++++++++++++++++++++++++++++++++++-
drivers/bluetooth/btmtk.h | 3 +
2 files changed, 372 insertions(+), 1 deletion(-)
diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c
index 75519765bb49..50d3d69f91d3 100644
--- a/drivers/bluetooth/btmtk.c
+++ b/drivers/bluetooth/btmtk.c
@@ -21,6 +21,12 @@
#define MTK_FW_ROM_PATCH_SEC_MAP_SIZE 64
#define MTK_SEC_MAP_COMMON_SIZE 12
#define MTK_SEC_MAP_NEED_SEND_SIZE 52
+#define MTK_SEC_MAP_LENGTH_SIZE 4
+#define MTK_SEC_CBMCU_DESC 0x5
+
+/* CBMCU WMT command flags */
+#define BTMTK_CBMCU_FLAG_QUERY_STATUS 0xF0
+#define BTMTK_CBMCU_FLAG_ENABLE_PATCH 0xF1
/* It is for mt79xx iso data transmission setting */
#define MTK_ISO_THRESHOLD 264
@@ -120,6 +126,11 @@ void btmtk_fw_get_filename(char *buf, size_t size, u32 dev_id, u32 fw_ver,
snprintf(buf, size,
"mediatek/mt%04x/BT_RAM_CODE_MT%04x_1_%x_hdr.bin",
dev_id & 0xffff, dev_id & 0xffff, (fw_ver & 0xff) + 1);
+ /* MT7928 */
+ else if (dev_id == 0x7935)
+ snprintf(buf, size,
+ "mediatek/mt7928/BT_RAM_CODE_MT%04x_1_1_hdr.bin",
+ dev_id & 0xffff);
else if (dev_id == 0x7961 && fw_flavor)
snprintf(buf, size,
"mediatek/BT_RAM_CODE_MT%04x_1a_%x_hdr.bin",
@@ -775,6 +786,7 @@ static int btmtk_usb_hci_wmt_sync(struct hci_dev *hdev,
status = BTMTK_WMT_ON_UNDONE;
break;
case BTMTK_WMT_PATCH_DWNLD:
+ case BTMTK_WMT_CBMCU_DWNLD:
if (wmt_evt->whdr.flag == 2)
status = BTMTK_WMT_PATCH_DONE;
else if (wmt_evt->whdr.flag == 1)
@@ -911,6 +923,351 @@ static u32 btmtk_usb_reset_done(struct hci_dev *hdev)
return val & MTK_BT_RST_DONE;
}
+static int btmtk_cbmcu_patch_status(struct hci_dev *hdev,
+ wmt_cmd_sync_func_t wmt_cmd_sync,
+ u8 *patch_status)
+{
+ struct btmtk_hci_wmt_params wmt_params;
+ int status, err, retry = 20;
+
+ do {
+ wmt_params.op = BTMTK_WMT_CBMCU_DWNLD;
+ wmt_params.flag = BTMTK_CBMCU_FLAG_QUERY_STATUS;
+ wmt_params.dlen = 0;
+ wmt_params.data = NULL;
+ wmt_params.status = &status;
+
+ err = wmt_cmd_sync(hdev, &wmt_params);
+ if (err < 0) {
+ bt_dev_err(hdev, "Failed to query CBMCU patch status (%d)", err);
+ return err;
+ }
+
+ *patch_status = (u8)status;
+
+ if (*patch_status == BTMTK_WMT_PATCH_PROGRESS) {
+ msleep(100);
+ retry--;
+ } else {
+ break;
+ }
+ } while (retry > 0);
+
+ if (*patch_status == BTMTK_WMT_PATCH_PROGRESS) {
+ bt_dev_err(hdev, "CBMCU patch status query timeout");
+ return -ETIMEDOUT;
+ }
+
+ return 0;
+}
+
+static int btmtk_query_cbmcu_section(struct hci_dev *hdev,
+ wmt_cmd_sync_func_t wmt_cmd_sync,
+ u8 cbmcu_type,
+ const u8 *section_map,
+ u32 cert_len)
+{
+ struct btmtk_hci_wmt_params wmt_params;
+ u8 cmd[64];
+ int status, err;
+
+ cmd[0] = 0;
+ cmd[1] = cbmcu_type;
+
+ if (cbmcu_type == 0)
+ put_unaligned_le32(cert_len, &cmd[2]);
+ else
+ memcpy(&cmd[2], section_map, MTK_SEC_MAP_NEED_SEND_SIZE);
+
+ wmt_params.op = BTMTK_WMT_CBMCU_DWNLD;
+ wmt_params.flag = 0;
+ wmt_params.dlen = cbmcu_type ?
+ MTK_SEC_MAP_NEED_SEND_SIZE + 2 :
+ MTK_SEC_MAP_LENGTH_SIZE + 2;
+ wmt_params.data = cmd;
+ wmt_params.status = &status;
+
+ err = wmt_cmd_sync(hdev, &wmt_params);
+ if (err < 0) {
+ bt_dev_err(hdev, "Failed to query CBMCU section (%d)", err);
+ return err;
+ }
+
+ /* Query should return UNDONE status for successful section query */
+ if (status != BTMTK_WMT_PATCH_UNDONE) {
+ bt_dev_err(hdev, "CBMCU section query status error (%d)", status);
+ return -EIO;
+ }
+
+ return 0;
+}
+
+static int btmtk_download_cbmcu_section(struct hci_dev *hdev,
+ wmt_cmd_sync_func_t wmt_cmd_sync,
+ const u8 *fw_data,
+ u32 dl_size)
+{
+ struct btmtk_hci_wmt_params wmt_params;
+ u32 sent_len, total_size = dl_size;
+ int err;
+
+ wmt_params.op = BTMTK_WMT_CBMCU_DWNLD;
+ wmt_params.status = NULL;
+
+ while (dl_size > 0) {
+ sent_len = min_t(u32, 250, dl_size);
+
+ if (dl_size == total_size)
+ wmt_params.flag = BTMTK_WMT_PKT_START;
+ else if (dl_size == sent_len)
+ wmt_params.flag = BTMTK_WMT_PKT_END;
+ else
+ wmt_params.flag = BTMTK_WMT_PKT_CONTINUE;
+
+ wmt_params.dlen = sent_len;
+ wmt_params.data = fw_data;
+
+ err = wmt_cmd_sync(hdev, &wmt_params);
+ if (err < 0) {
+ bt_dev_err(hdev, "Failed to send CBMCU section data (%d)", err);
+ return err;
+ }
+
+ dl_size -= sent_len;
+ fw_data += sent_len;
+ }
+
+ return 0;
+}
+
+static int btmtk_enable_cbmcu_patch(struct hci_dev *hdev,
+ wmt_cmd_sync_func_t wmt_cmd_sync)
+{
+ struct btmtk_hci_wmt_params wmt_params;
+ int err;
+
+ wmt_params.op = BTMTK_WMT_CBMCU_DWNLD;
+ wmt_params.flag = BTMTK_CBMCU_FLAG_ENABLE_PATCH;
+ wmt_params.dlen = 0;
+ wmt_params.data = NULL;
+ wmt_params.status = NULL;
+
+ err = wmt_cmd_sync(hdev, &wmt_params);
+ if (err < 0) {
+ bt_dev_err(hdev, "Failed to enable CBMCU patch (%d)", err);
+ return err;
+ }
+
+ return 0;
+}
+
+static int btmtk_load_cbmcu_firmware(struct hci_dev *hdev,
+ const char *fwname,
+ wmt_cmd_sync_func_t wmt_cmd_sync,
+ u32 dev_id)
+{
+ struct btmtk_patch_header *hdr;
+ struct btmtk_global_desc *globaldesc;
+ struct btmtk_section_map *sectionmap;
+ const struct firmware *fw;
+ const u8 *fw_ptr;
+ u8 *cert_buf = NULL;
+ u32 section_num, section_offset, dl_size, cert_len;
+ size_t expected_size;
+ int i, err;
+
+ err = request_firmware(&fw, fwname, &hdev->dev);
+ if (err < 0) {
+ bt_dev_err(hdev, "Failed to load CBMCU firmware file %s (%d)",
+ fwname, err);
+ return err;
+ }
+
+ if (fw->size < MTK_FW_ROM_PATCH_HEADER_SIZE + MTK_FW_ROM_PATCH_GD_SIZE) {
+ bt_dev_err(hdev, "CBMCU firmware too small: size=%zu, min=%u",
+ fw->size,
+ MTK_FW_ROM_PATCH_HEADER_SIZE + MTK_FW_ROM_PATCH_GD_SIZE);
+ err = -EINVAL;
+ goto err_release_fw;
+ }
+
+ fw_ptr = fw->data;
+ hdr = (struct btmtk_patch_header *)fw_ptr;
+ globaldesc = (struct btmtk_global_desc *)(fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE);
+ section_num = le32_to_cpu(globaldesc->section_num);
+
+ /* Check for potential integer overflow in size calculation */
+ if (check_mul_overflow((size_t)MTK_FW_ROM_PATCH_SEC_MAP_SIZE,
+ (size_t)section_num, &expected_size) ||
+ check_add_overflow(expected_size,
+ (size_t)(MTK_FW_ROM_PATCH_HEADER_SIZE +
+ MTK_FW_ROM_PATCH_GD_SIZE),
+ &expected_size)) {
+ bt_dev_err(hdev, "CBMCU firmware size calculation overflow (section_num=%u)",
+ section_num);
+ err = -EINVAL;
+ goto err_release_fw;
+ }
+
+ if (fw->size < expected_size) {
+ bt_dev_err(hdev, "CBMCU firmware truncated: size=%zu, expected=%zu (section_num=%u)",
+ fw->size, expected_size, section_num);
+ err = -EINVAL;
+ goto err_release_fw;
+ }
+
+ bt_dev_info(hdev, "CBMCU HW ver: 0x%04x, SW ver: 0x%04x, Build Time: %.16s",
+ dev_id & 0xffff, le16_to_cpu(hdr->swver), hdr->datetime);
+
+ /* Phase 1: Download section type MTK_SEC_CBMCU_DESC */
+ for (i = 0; i < section_num; i++) {
+ sectionmap = (struct btmtk_section_map *)
+ (fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE +
+ MTK_FW_ROM_PATCH_GD_SIZE +
+ MTK_FW_ROM_PATCH_SEC_MAP_SIZE * i);
+
+ /* Only process MTK_SEC_CBMCU_DESC section in Phase 1 */
+ if ((le32_to_cpu(sectionmap->sectype) & 0xFFFF) != MTK_SEC_CBMCU_DESC)
+ continue;
+
+ section_offset = le32_to_cpu(sectionmap->secoffset);
+ dl_size = le32_to_cpu(sectionmap->secsize);
+
+ if (dl_size == 0)
+ continue;
+
+ if (section_offset > fw->size ||
+ dl_size > fw->size - section_offset) {
+ bt_dev_err(hdev, "CBMCU Phase 1 section out of bounds");
+ err = -EINVAL;
+ goto err_release_fw;
+ }
+
+ cert_len = MTK_FW_ROM_PATCH_GD_SIZE +
+ MTK_FW_ROM_PATCH_SEC_MAP_SIZE * section_num +
+ dl_size;
+
+ /* Query cbmcu section */
+ err = btmtk_query_cbmcu_section(hdev, wmt_cmd_sync, 0, NULL,
+ cert_len);
+ if (err < 0)
+ goto err_release_fw;
+
+ cert_buf = kmalloc(cert_len, GFP_KERNEL);
+ if (!cert_buf) {
+ err = -ENOMEM;
+ goto err_release_fw;
+ }
+
+ /* Copy Global Descriptor + All Section Maps */
+ memcpy(cert_buf,
+ fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE,
+ MTK_FW_ROM_PATCH_GD_SIZE + MTK_FW_ROM_PATCH_SEC_MAP_SIZE * section_num);
+
+ /* Copy Phase 1 section data */
+ memcpy(cert_buf + MTK_FW_ROM_PATCH_GD_SIZE +
+ MTK_FW_ROM_PATCH_SEC_MAP_SIZE * section_num,
+ fw_ptr + section_offset,
+ dl_size);
+
+ /* Download Phase 1 section */
+ err = btmtk_download_cbmcu_section(hdev, wmt_cmd_sync,
+ cert_buf, cert_len);
+ kfree(cert_buf);
+ cert_buf = NULL;
+
+ if (err < 0) {
+ bt_dev_err(hdev, "Failed to download CBMCU Phase 1 section (%d)", err);
+ goto err_release_fw;
+ }
+
+ break;
+ }
+
+ /* Phase 2: Download other sections (type != MTK_SEC_CBMCU_DESC) */
+ for (i = 0; i < section_num; i++) {
+ sectionmap = (struct btmtk_section_map *)
+ (fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE +
+ MTK_FW_ROM_PATCH_GD_SIZE +
+ MTK_FW_ROM_PATCH_SEC_MAP_SIZE * i);
+
+ /* Skip MTK_SEC_CBMCU_DESC section in Phase 2 */
+ if ((le32_to_cpu(sectionmap->sectype) & 0xFFFF) == MTK_SEC_CBMCU_DESC)
+ continue;
+
+ section_offset = le32_to_cpu(sectionmap->secoffset);
+ dl_size = le32_to_cpu(sectionmap->bin_info_spec.dlsize);
+
+ if (dl_size == 0)
+ continue;
+
+ if (section_offset > fw->size ||
+ dl_size > fw->size - section_offset) {
+ bt_dev_err(hdev, "CBMCU Phase 2 section %d out of bounds", i);
+ err = -EINVAL;
+ goto err_release_fw;
+ }
+
+ /* Query cbmcu section */
+ err = btmtk_query_cbmcu_section(hdev, wmt_cmd_sync, 1,
+ (u8 *)§ionmap->bin_info_spec,
+ 0);
+ if (err < 0)
+ goto err_release_fw;
+
+ /* Download section data */
+ err = btmtk_download_cbmcu_section(hdev, wmt_cmd_sync,
+ fw_ptr + section_offset,
+ dl_size);
+ if (err < 0) {
+ bt_dev_err(hdev, "Failed to download CBMCU section %d (%d)", i, err);
+ goto err_release_fw;
+ }
+ }
+
+ bt_dev_info(hdev, "CBMCU firmware download completed");
+
+err_release_fw:
+ release_firmware(fw);
+ return err;
+}
+
+static int btmtk_setup_cbmcu_firmware(struct hci_dev *hdev,
+ wmt_cmd_sync_func_t wmt_cmd_sync,
+ u32 dev_id)
+{
+ char cbmcu_fwname[64];
+ u8 patch_status;
+ int err;
+
+ err = btmtk_cbmcu_patch_status(hdev, wmt_cmd_sync, &patch_status);
+ if (err < 0)
+ return err;
+
+ bt_dev_dbg(hdev, "CBMCU patch status: 0x%02x", patch_status);
+
+ if (patch_status != BTMTK_WMT_PATCH_UNDONE)
+ return 0;
+
+ snprintf(cbmcu_fwname, sizeof(cbmcu_fwname),
+ "mediatek/mt7928/CBMCU_CODE_MT%04x_1_1.bin",
+ dev_id & 0xffff);
+
+ bt_dev_info(hdev, "Loading CBMCU firmware: %s", cbmcu_fwname);
+
+ err = btmtk_load_cbmcu_firmware(hdev, cbmcu_fwname, wmt_cmd_sync, dev_id);
+ if (err < 0) {
+ bt_dev_err(hdev, "Failed to download CBMCU firmware (%d)", err);
+ return err;
+ }
+
+ err = btmtk_enable_cbmcu_patch(hdev, wmt_cmd_sync);
+ if (err < 0)
+ return err;
+
+ return 0;
+}
+
int btmtk_usb_subsys_reset(struct hci_dev *hdev, u32 dev_id)
{
u32 val;
@@ -935,7 +1292,7 @@ int btmtk_usb_subsys_reset(struct hci_dev *hdev, u32 dev_id)
if (err < 0)
return err;
msleep(100);
- } else if (dev_id == 0x7925 || dev_id == 0x6639) {
+ } else if (dev_id == 0x7925 || dev_id == 0x6639 || dev_id == 0x7935) {
err = btmtk_usb_uhw_reg_read(hdev, MTK_BT_RESET_REG_CONNV3, &val);
if (err < 0)
return err;
@@ -1420,6 +1777,15 @@ int btmtk_usb_setup(struct hci_dev *hdev)
case 0x7668:
fwname = FIRMWARE_MT7668;
break;
+ case 0x7935:
+ /* Requires CBMCU firmware before BT firmware */
+ err = btmtk_setup_cbmcu_firmware(hdev, btmtk_usb_hci_wmt_sync,
+ dev_id);
+ if (err < 0) {
+ bt_dev_err(hdev, "Failed to set up CBMCU firmware (%d)", err);
+ return err;
+ }
+ fallthrough;
case 0x7922:
case 0x7925:
/*
@@ -1637,3 +2003,5 @@ MODULE_FIRMWARE(FIRMWARE_MT7922);
MODULE_FIRMWARE(FIRMWARE_MT7961);
MODULE_FIRMWARE(FIRMWARE_MT7925);
MODULE_FIRMWARE(FIRMWARE_MT7927);
+MODULE_FIRMWARE(FIRMWARE_MT7928);
+MODULE_FIRMWARE(FIRMWARE_MT7928_CBMCU);
diff --git a/drivers/bluetooth/btmtk.h b/drivers/bluetooth/btmtk.h
index 51c18dde0a80..5fe4964b031b 100644
--- a/drivers/bluetooth/btmtk.h
+++ b/drivers/bluetooth/btmtk.h
@@ -9,6 +9,8 @@
#define FIRMWARE_MT7961 "mediatek/BT_RAM_CODE_MT7961_1_2_hdr.bin"
#define FIRMWARE_MT7925 "mediatek/mt7925/BT_RAM_CODE_MT7925_1_1_hdr.bin"
#define FIRMWARE_MT7927 "mediatek/mt7927/BT_RAM_CODE_MT6639_2_1_hdr.bin"
+#define FIRMWARE_MT7928 "mediatek/mt7928/BT_RAM_CODE_MT7935_1_1_hdr.bin"
+#define FIRMWARE_MT7928_CBMCU "mediatek/mt7928/CBMCU_CODE_MT7935_1_1.bin"
#define HCI_EV_WMT 0xe4
#define HCI_WMT_MAX_EVENT_SIZE 64
@@ -54,6 +56,7 @@ enum {
BTMTK_WMT_RST = 0x7,
BTMTK_WMT_REGISTER = 0x8,
BTMTK_WMT_SEMAPHORE = 0x17,
+ BTMTK_WMT_CBMCU_DWNLD = 0x58,
};
enum {
--
2.45.2
^ permalink raw reply related [flat|nested] 20+ messages in thread
* [PATCH v16 1/7] Bluetooth: btmtksdio: Fix SKB handling issues in TX path
@ 2026-07-17 8:39 Chris Lu
2026-07-17 10:44 ` Bluetooth: btmtk: Add MT7928 support bluez.test.bot
0 siblings, 1 reply; 20+ messages in thread
From: Chris Lu @ 2026-07-17 8:39 UTC (permalink / raw)
To: Marcel Holtmann, Johan Hedberg, Luiz Von Dentz
Cc: Sean Wang, Will Lee, SS Wu, Steve Lee, Paul Menzel,
linux-bluetooth, linux-kernel, linux-mediatek, Chris Lu, Sashiko
Fix two SKB handling issues in btmtksdio_tx_packet():
1. DMA out-of-bounds read: The driver aligns transfer size to 256 bytes
using round_up(), but does not ensure the skb buffer has sufficient
tailroom, causing DMA to read beyond the buffer. Fix by expanding skb
tailroom if needed and zero-filling the padding.
2. Cloned SKB corruption: The driver modifies SKB header (via skb_push)
and tail (via skb_put_zero) without checking if the SKB is cloned.
If the Bluetooth core passes a cloned SKB (e.g., from L2CAP
retransmission queues), the driver corrupts the shared data buffer.
Fix by calling skb_unshare() at function entry to ensure we have a
private copy. Use double-pointer parameter (struct sk_buff **pskb)
to properly update the caller's SKB pointer when skb_unshare()
allocates a new SKB, preventing use-after-free when the caller
requeues the SKB on error.
On error paths, do not free the SKB - leave it valid for the caller
to requeue, avoiding use-after-free in btmtksdio_txrx_work().
Fixes: 9aebfd4a2200 ("Bluetooth: mediatek: add support for MediaTek MT7663S and MT7668S SDIO devices")
Reported-by: Sashiko <sashiko-review@kernel.org>
Signed-off-by: Chris Lu <chris.lu@mediatek.com>
Assisted-by: Claude:Sonnet-4.5
---
drivers/bluetooth/btmtksdio.c | 65 +++++++++++++++++++++++++++++------
1 file changed, 55 insertions(+), 10 deletions(-)
diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c
index c6f80c419e90..aea7d07b49ad 100644
--- a/drivers/bluetooth/btmtksdio.c
+++ b/drivers/bluetooth/btmtksdio.c
@@ -269,17 +269,32 @@ static int mtk_hci_wmt_sync(struct hci_dev *hdev,
}
static int btmtksdio_tx_packet(struct btmtksdio_dev *bdev,
- struct sk_buff *skb)
+ struct sk_buff **pskb)
{
+ struct sk_buff *skb = *pskb;
struct mtkbtsdio_hdr *sdio_hdr;
+ unsigned int padded_len, pad_len;
int err;
- /* Make sure that there are enough rooms for SDIO header */
+ /* Ensure SKB is not cloned before any modification.
+ * If cloned (e.g., L2CAP retransmission queues), create a
+ * private copy to avoid corrupting shared data buffer.
+ */
+ skb = skb_unshare(skb, GFP_ATOMIC);
+ if (!skb) {
+ *pskb = NULL;
+ return -ENOMEM;
+ }
+ *pskb = skb;
+
+ /* Make sure that there are enough rooms for SDIO header.
+ * After skb_unshare(), we have exclusive ownership of the buffer.
+ */
if (unlikely(skb_headroom(skb) < sizeof(*sdio_hdr))) {
err = pskb_expand_head(skb, sizeof(*sdio_hdr), 0,
GFP_ATOMIC);
if (err < 0)
- return err;
+ goto err_free_skb;
}
/* Prepend MediaTek SDIO Specific Header */
@@ -290,21 +305,50 @@ static int btmtksdio_tx_packet(struct btmtksdio_dev *bdev,
sdio_hdr->reserved = cpu_to_le16(0);
sdio_hdr->bt_type = hci_skb_pkt_type(skb);
+ /* Calculate padded length for block-aligned DMA transfer.
+ * SDIO requires transfers to be block-aligned (MTK_SDIO_BLOCK_SIZE).
+ * Pad with zeros to prevent DMA from reading beyond skb buffer.
+ */
+ padded_len = round_up(skb->len, MTK_SDIO_BLOCK_SIZE);
+ pad_len = padded_len - skb->len;
+
+ if (pad_len > 0) {
+ /* Ensure sufficient tailroom for padding */
+ if (unlikely(skb_tailroom(skb) < pad_len)) {
+ err = pskb_expand_head(skb, 0, pad_len, GFP_ATOMIC);
+ if (err < 0)
+ goto err_skb_pull;
+ /* Reassign sdio_hdr after buffer reallocation */
+ sdio_hdr = (void *)skb->data;
+ }
+
+ /* Zero-fill padding to prevent information disclosure */
+ skb_put_zero(skb, pad_len);
+ }
+
clear_bit(BTMTKSDIO_HW_TX_READY, &bdev->tx_state);
- err = sdio_writesb(bdev->func, MTK_REG_CTDR, skb->data,
- round_up(skb->len, MTK_SDIO_BLOCK_SIZE));
+ err = sdio_writesb(bdev->func, MTK_REG_CTDR, skb->data, padded_len);
if (err < 0)
- goto err_skb_pull;
+ goto err_skb_trim;
- bdev->hdev->stat.byte_tx += skb->len;
+ /* Record actual transmitted data (excluding padding) */
+ bdev->hdev->stat.byte_tx += le16_to_cpu(sdio_hdr->len);
kfree_skb(skb);
+ *pskb = NULL;
return 0;
+err_skb_trim:
+ if (pad_len > 0)
+ skb_trim(skb, skb->len - pad_len);
err_skb_pull:
skb_pull(skb, sizeof(*sdio_hdr));
-
+err_free_skb:
+ /* On error, keep skb valid for caller to requeue.
+ * Do NOT free skb here - let caller handle it.
+ */
+ *pskb = skb;
return err;
}
@@ -606,10 +650,11 @@ static void btmtksdio_txrx_work(struct work_struct *work)
if (test_bit(BTMTKSDIO_HW_TX_READY, &bdev->tx_state)) {
skb = skb_dequeue(&bdev->txq);
if (skb) {
- err = btmtksdio_tx_packet(bdev, skb);
+ err = btmtksdio_tx_packet(bdev, &skb);
if (err < 0) {
bdev->hdev->stat.err_tx++;
- skb_queue_head(&bdev->txq, skb);
+ if (skb)
+ skb_queue_head(&bdev->txq, skb);
}
}
}
--
2.45.2
^ permalink raw reply related [flat|nested] 20+ messages in thread* RE: Bluetooth: btmtk: Add MT7928 support
2026-07-17 8:39 [PATCH v16 1/7] Bluetooth: btmtksdio: Fix SKB handling issues in TX path Chris Lu
@ 2026-07-17 10:44 ` bluez.test.bot
0 siblings, 0 replies; 20+ messages in thread
From: bluez.test.bot @ 2026-07-17 10:44 UTC (permalink / raw)
To: linux-bluetooth, chris.lu
[-- Attachment #1: Type: text/plain, Size: 3666 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1129429
---Test result---
Test Summary:
CheckPatch FAIL 4.29 seconds
VerifyFixes PASS 0.07 seconds
VerifySignedoff PASS 0.07 seconds
GitLint FAIL 1.45 seconds
SubjectPrefix PASS 0.44 seconds
BuildKernel PASS 27.05 seconds
CheckAllWarning PASS 30.15 seconds
CheckSparse PASS 28.77 seconds
BuildKernel32 PASS 26.82 seconds
CheckKernelLLVM SKIP 0.00 seconds
TestRunnerSetup PASS 502.67 seconds
IncrementalBuild PASS 38.23 seconds
Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
[v16,1/7] Bluetooth: btmtksdio: Fix SKB handling issues in TX path
WARNING: Reported-by: should be immediately followed by Closes: with a URL to the report
#111:
Reported-by: Sashiko <sashiko-review@kernel.org>
Signed-off-by: Chris Lu <chris.lu@mediatek.com>
total: 0 errors, 1 warnings, 103 lines checked
NOTE: For some of the reported defects, checkpatch may be able to
mechanically convert to the typical style using --fix or --fix-inplace.
/github/workspace/src/patch/14693204.patch has style problems, please review.
NOTE: Ignored message types: UNKNOWN_COMMIT_ID
NOTE: If any of the errors are false positives, please report
them to the maintainer, see CHECKPATCH in MAINTAINERS.
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[v16,2/7] Bluetooth: btmtk: Add firmware size validation in btmtk_setup_firmware_79xx()
1: T1 Title exceeds max length (87>80): "[v16,2/7] Bluetooth: btmtk: Add firmware size validation in btmtk_setup_firmware_79xx()"
[v16,5/7] Bluetooth: btmtk: Improve BT firmware logging
14: B1 Line exceeds max length (92>80): "[ 212.878783] Bluetooth: hci1: Loading BT firmware: mediatek/BT_RAM_CODE_MT7922_1_1_hdr.bin"
15: B1 Line exceeds max length (93>80): "[ 212.889614] Bluetooth: hci1: BT HW ver: 0x7922, SW ver: 0x008a, Build Time: 20260224103448"
17: B1 Line exceeds max length (115>80): "[ 216.048890] Bluetooth: hci1: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported."
[v16,7/7] Bluetooth: btmtk: Add MT7928 support
28: B1 Line exceeds max length (92>80): "[ 6931.197167] usb 1-3: New USB device found, idVendor=0e8d, idProduct=7935, bcdDevice= 1.00"
33: B1 Line exceeds max length (97>80): "[ 6931.213478] Bluetooth: hci1: Loading CBMCU firmware: mediatek/mt7928/CBMCU_CODE_MT7935_1_1.bin"
34: B1 Line exceeds max length (98>80): "[ 6931.215214] Bluetooth: hci1: CBMCU HW ver: 0x7935, SW ver: 0x0000, Build Time: 20260601T161751+"
36: B1 Line exceeds max length (99>80): "[ 6931.643916] Bluetooth: hci1: Loading BT firmware: mediatek/mt7928/BT_RAM_CODE_MT7935_1_1_hdr.bin"
37: B1 Line exceeds max length (93>80): "[ 6931.650467] Bluetooth: hci1: BT HW ver: 0x7935, SW ver: 0x0000, Build Time: 20260527000816"
39: B1 Line exceeds max length (115>80): "[ 6935.039833] Bluetooth: hci1: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported."
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found
https://github.com/bluez/bluetooth-next/pull/449
---
Regards,
Linux Bluetooth
^ permalink raw reply [flat|nested] 20+ messages in thread
* [PATCH v15 1/7] Bluetooth: btmtksdio: Fix SKB handling issues in TX path
@ 2026-07-17 7:42 Chris Lu
2026-07-17 8:52 ` Bluetooth: btmtk: Add MT7928 support bluez.test.bot
0 siblings, 1 reply; 20+ messages in thread
From: Chris Lu @ 2026-07-17 7:42 UTC (permalink / raw)
To: Marcel Holtmann, Johan Hedberg, Luiz Von Dentz
Cc: Sean Wang, Will Lee, SS Wu, Steve Lee, Paul Menzel,
linux-bluetooth, linux-kernel, linux-mediatek, Chris Lu, Sashiko
Fix two SKB handling issues in btmtksdio_tx_packet():
1. DMA out-of-bounds read: The driver aligns transfer size to 256 bytes
using round_up(), but does not ensure the skb buffer has sufficient
tailroom, causing DMA to read beyond the buffer. Fix by expanding skb
tailroom if needed and zero-filling the padding.
2. Cloned SKB corruption: The driver modifies SKB header (via skb_push)
and tail (via skb_put_zero) without checking if the SKB is cloned.
If the Bluetooth core passes a cloned SKB (e.g., from L2CAP
retransmission queues), the driver corrupts the shared data buffer
for other subsystems. Fix by calling skb_unshare() at function entry
to ensure we have a private copy before any modifications.
Fixes: 9aebfd4a2200 ("Bluetooth: mediatek: add support for MediaTek MT7663S and MT7668S SDIO devices")
Reported-by: Sashiko <sashiko-review@kernel.org>
Signed-off-by: Chris Lu <chris.lu@mediatek.com>
Assisted-by: Claude:Sonnet-4.5
---
drivers/bluetooth/btmtksdio.c | 46 +++++++++++++++++++++++++++++++----
1 file changed, 41 insertions(+), 5 deletions(-)
diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c
index c6f80c419e90..42cb0bbb720f 100644
--- a/drivers/bluetooth/btmtksdio.c
+++ b/drivers/bluetooth/btmtksdio.c
@@ -272,9 +272,20 @@ static int btmtksdio_tx_packet(struct btmtksdio_dev *bdev,
struct sk_buff *skb)
{
struct mtkbtsdio_hdr *sdio_hdr;
+ unsigned int padded_len, pad_len;
int err;
- /* Make sure that there are enough rooms for SDIO header */
+ /* Ensure SKB is not cloned before any modification.
+ * If cloned (e.g., L2CAP retransmission queues), create a
+ * private copy to avoid corrupting shared data buffer.
+ */
+ skb = skb_unshare(skb, GFP_ATOMIC);
+ if (!skb)
+ return -ENOMEM;
+
+ /* Make sure that there are enough rooms for SDIO header.
+ * After skb_unshare(), we have exclusive ownership of the buffer.
+ */
if (unlikely(skb_headroom(skb) < sizeof(*sdio_hdr))) {
err = pskb_expand_head(skb, sizeof(*sdio_hdr), 0,
GFP_ATOMIC);
@@ -290,20 +301,45 @@ static int btmtksdio_tx_packet(struct btmtksdio_dev *bdev,
sdio_hdr->reserved = cpu_to_le16(0);
sdio_hdr->bt_type = hci_skb_pkt_type(skb);
+ /* Calculate padded length for block-aligned DMA transfer.
+ * SDIO requires transfers to be block-aligned (MTK_SDIO_BLOCK_SIZE).
+ * Pad with zeros to prevent DMA from reading beyond skb buffer.
+ */
+ padded_len = round_up(skb->len, MTK_SDIO_BLOCK_SIZE);
+ pad_len = padded_len - skb->len;
+
+ if (pad_len > 0) {
+ /* Ensure sufficient tailroom for padding */
+ if (unlikely(skb_tailroom(skb) < pad_len)) {
+ err = pskb_expand_head(skb, 0, pad_len, GFP_ATOMIC);
+ if (err < 0)
+ goto err_skb_pull;
+ /* Reassign sdio_hdr after buffer reallocation */
+ sdio_hdr = (void *)skb->data;
+ }
+
+ /* Zero-fill padding to prevent information disclosure */
+ skb_put_zero(skb, pad_len);
+ }
+
clear_bit(BTMTKSDIO_HW_TX_READY, &bdev->tx_state);
- err = sdio_writesb(bdev->func, MTK_REG_CTDR, skb->data,
- round_up(skb->len, MTK_SDIO_BLOCK_SIZE));
+ err = sdio_writesb(bdev->func, MTK_REG_CTDR, skb->data, padded_len);
if (err < 0)
- goto err_skb_pull;
+ goto err_skb_trim;
- bdev->hdev->stat.byte_tx += skb->len;
+ /* Record actual transmitted data (excluding padding) */
+ bdev->hdev->stat.byte_tx += le16_to_cpu(sdio_hdr->len);
kfree_skb(skb);
return 0;
+err_skb_trim:
+ if (pad_len > 0)
+ skb_trim(skb, skb->len - pad_len);
err_skb_pull:
skb_pull(skb, sizeof(*sdio_hdr));
+ kfree_skb(skb);
return err;
}
--
2.45.2
^ permalink raw reply related [flat|nested] 20+ messages in thread* RE: Bluetooth: btmtk: Add MT7928 support
2026-07-17 7:42 [PATCH v15 1/7] Bluetooth: btmtksdio: Fix SKB handling issues in TX path Chris Lu
@ 2026-07-17 8:52 ` bluez.test.bot
0 siblings, 0 replies; 20+ messages in thread
From: bluez.test.bot @ 2026-07-17 8:52 UTC (permalink / raw)
To: linux-bluetooth, chris.lu
[-- Attachment #1: Type: text/plain, Size: 3665 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1129376
---Test result---
Test Summary:
CheckPatch FAIL 5.55 seconds
VerifyFixes PASS 0.14 seconds
VerifySignedoff PASS 0.13 seconds
GitLint FAIL 2.28 seconds
SubjectPrefix PASS 0.90 seconds
BuildKernel PASS 26.85 seconds
CheckAllWarning PASS 29.15 seconds
CheckSparse PASS 32.43 seconds
BuildKernel32 PASS 26.43 seconds
CheckKernelLLVM SKIP 0.00 seconds
TestRunnerSetup PASS 493.62 seconds
IncrementalBuild PASS 38.33 seconds
Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
[v15,1/7] Bluetooth: btmtksdio: Fix SKB handling issues in TX path
WARNING: Reported-by: should be immediately followed by Closes: with a URL to the report
#104:
Reported-by: Sashiko <sashiko-review@kernel.org>
Signed-off-by: Chris Lu <chris.lu@mediatek.com>
total: 0 errors, 1 warnings, 70 lines checked
NOTE: For some of the reported defects, checkpatch may be able to
mechanically convert to the typical style using --fix or --fix-inplace.
/github/workspace/src/patch/14693018.patch has style problems, please review.
NOTE: Ignored message types: UNKNOWN_COMMIT_ID
NOTE: If any of the errors are false positives, please report
them to the maintainer, see CHECKPATCH in MAINTAINERS.
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[v15,2/7] Bluetooth: btmtk: Add firmware size validation in btmtk_setup_firmware_79xx()
1: T1 Title exceeds max length (87>80): "[v15,2/7] Bluetooth: btmtk: Add firmware size validation in btmtk_setup_firmware_79xx()"
[v15,5/7] Bluetooth: btmtk: Improve BT firmware logging
14: B1 Line exceeds max length (92>80): "[ 212.878783] Bluetooth: hci1: Loading BT firmware: mediatek/BT_RAM_CODE_MT7922_1_1_hdr.bin"
15: B1 Line exceeds max length (93>80): "[ 212.889614] Bluetooth: hci1: BT HW ver: 0x7922, SW ver: 0x008a, Build Time: 20260224103448"
17: B1 Line exceeds max length (115>80): "[ 216.048890] Bluetooth: hci1: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported."
[v15,7/7] Bluetooth: btmtk: Add MT7928 support
28: B1 Line exceeds max length (92>80): "[ 6931.197167] usb 1-3: New USB device found, idVendor=0e8d, idProduct=7935, bcdDevice= 1.00"
33: B1 Line exceeds max length (97>80): "[ 6931.213478] Bluetooth: hci1: Loading CBMCU firmware: mediatek/mt7928/CBMCU_CODE_MT7935_1_1.bin"
34: B1 Line exceeds max length (98>80): "[ 6931.215214] Bluetooth: hci1: CBMCU HW ver: 0x7935, SW ver: 0x0000, Build Time: 20260601T161751+"
36: B1 Line exceeds max length (99>80): "[ 6931.643916] Bluetooth: hci1: Loading BT firmware: mediatek/mt7928/BT_RAM_CODE_MT7935_1_1_hdr.bin"
37: B1 Line exceeds max length (93>80): "[ 6931.650467] Bluetooth: hci1: BT HW ver: 0x7935, SW ver: 0x0000, Build Time: 20260527000816"
39: B1 Line exceeds max length (115>80): "[ 6935.039833] Bluetooth: hci1: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported."
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found
https://github.com/bluez/bluetooth-next/pull/448
---
Regards,
Linux Bluetooth
^ permalink raw reply [flat|nested] 20+ messages in thread
* [PATCH v12 1/7] Bluetooth: btmtksdio: Fix DMA out-of-bounds access in TX path
@ 2026-07-16 1:59 Chris Lu
2026-07-16 4:01 ` Bluetooth: btmtk: Add MT7928 support bluez.test.bot
0 siblings, 1 reply; 20+ messages in thread
From: Chris Lu @ 2026-07-16 1:59 UTC (permalink / raw)
To: Marcel Holtmann, Johan Hedberg, Luiz Von Dentz
Cc: Sean Wang, Will Lee, SS Wu, Steve Lee, Paul Menzel,
linux-bluetooth, linux-kernel, linux-mediatek, Chris Lu
btmtksdio_tx_packet() aligns transfer size to 256 bytes using
round_up(), but does not ensure the skb buffer has sufficient space,
causing DMA to read beyond the buffer.
Fix by expanding skb tailroom if needed and zero-filling the padding.
Fixes: 9aebfd4a2200 ("Bluetooth: mediatek: add support for MediaTek MT7663S and MT7668S SDIO devices")
Signed-off-by: Chris Lu <chris.lu@mediatek.com>
---
drivers/bluetooth/btmtksdio.c | 33 +++++++++++++++++++++++++++++----
1 file changed, 29 insertions(+), 4 deletions(-)
diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c
index 5b0fab7b89b5..feda1ea8f256 100644
--- a/drivers/bluetooth/btmtksdio.c
+++ b/drivers/bluetooth/btmtksdio.c
@@ -272,6 +272,7 @@ static int btmtksdio_tx_packet(struct btmtksdio_dev *bdev,
struct sk_buff *skb)
{
struct mtkbtsdio_hdr *sdio_hdr;
+ unsigned int padded_len, pad_len;
int err;
/* Make sure that there are enough rooms for SDIO header */
@@ -290,18 +291,42 @@ static int btmtksdio_tx_packet(struct btmtksdio_dev *bdev,
sdio_hdr->reserved = cpu_to_le16(0);
sdio_hdr->bt_type = hci_skb_pkt_type(skb);
+ /* Calculate padded length for block-aligned DMA transfer.
+ * SDIO requires transfers to be block-aligned (MTK_SDIO_BLOCK_SIZE).
+ * Pad with zeros to prevent DMA from reading beyond skb buffer.
+ */
+ padded_len = round_up(skb->len, MTK_SDIO_BLOCK_SIZE);
+ pad_len = padded_len - skb->len;
+
+ if (pad_len > 0) {
+ /* Ensure sufficient tailroom for padding */
+ if (unlikely(skb_tailroom(skb) < pad_len)) {
+ err = pskb_expand_head(skb, 0, pad_len, GFP_ATOMIC);
+ if (err < 0)
+ goto err_skb_pull;
+ /* Reassign sdio_hdr after buffer reallocation */
+ sdio_hdr = (void *)skb->data;
+ }
+
+ /* Zero-fill padding to prevent information disclosure */
+ skb_put_zero(skb, pad_len);
+ }
+
clear_bit(BTMTKSDIO_HW_TX_READY, &bdev->tx_state);
- err = sdio_writesb(bdev->func, MTK_REG_CTDR, skb->data,
- round_up(skb->len, MTK_SDIO_BLOCK_SIZE));
+ err = sdio_writesb(bdev->func, MTK_REG_CTDR, skb->data, padded_len);
if (err < 0)
- goto err_skb_pull;
+ goto err_skb_trim;
- bdev->hdev->stat.byte_tx += skb->len;
+ /* Record actual transmitted data (excluding padding) */
+ bdev->hdev->stat.byte_tx += le16_to_cpu(sdio_hdr->len);
kfree_skb(skb);
return 0;
+err_skb_trim:
+ if (pad_len > 0)
+ skb_trim(skb, skb->len - pad_len);
err_skb_pull:
skb_pull(skb, sizeof(*sdio_hdr));
--
2.45.2
^ permalink raw reply related [flat|nested] 20+ messages in thread* RE: Bluetooth: btmtk: Add MT7928 support
2026-07-16 1:59 [PATCH v12 1/7] Bluetooth: btmtksdio: Fix DMA out-of-bounds access in TX path Chris Lu
@ 2026-07-16 4:01 ` bluez.test.bot
0 siblings, 0 replies; 20+ messages in thread
From: bluez.test.bot @ 2026-07-16 4:01 UTC (permalink / raw)
To: linux-bluetooth, chris.lu
[-- Attachment #1: Type: text/plain, Size: 2866 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1128465
---Test result---
Test Summary:
CheckPatch PASS 5.23 seconds
VerifyFixes PASS 0.12 seconds
VerifySignedoff PASS 0.12 seconds
GitLint FAIL 2.08 seconds
SubjectPrefix PASS 0.76 seconds
BuildKernel PASS 27.59 seconds
CheckAllWarning PASS 30.66 seconds
CheckSparse PASS 29.66 seconds
BuildKernel32 PASS 27.08 seconds
CheckKernelLLVM SKIP 0.00 seconds
TestRunnerSetup PASS 511.83 seconds
IncrementalBuild PASS 40.27 seconds
Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[v12,2/7] Bluetooth: btmtk: Add firmware size validation in btmtk_setup_firmware_79xx()
1: T1 Title exceeds max length (87>80): "[v12,2/7] Bluetooth: btmtk: Add firmware size validation in btmtk_setup_firmware_79xx()"
[v12,4/7] Bluetooth: btmtk: Improve BT firmware logging
14: B1 Line exceeds max length (92>80): "[ 212.878783] Bluetooth: hci1: Loading BT firmware: mediatek/BT_RAM_CODE_MT7922_1_1_hdr.bin"
15: B1 Line exceeds max length (93>80): "[ 212.889614] Bluetooth: hci1: BT HW ver: 0x7922, SW ver: 0x008a, Build Time: 20260224103448"
17: B1 Line exceeds max length (115>80): "[ 216.048890] Bluetooth: hci1: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported."
[v12,7/7] Bluetooth: btmtk: Add MT7928 support
28: B1 Line exceeds max length (92>80): "[ 6931.197167] usb 1-3: New USB device found, idVendor=0e8d, idProduct=7935, bcdDevice= 1.00"
33: B1 Line exceeds max length (97>80): "[ 6931.213478] Bluetooth: hci1: Loading CBMCU firmware: mediatek/mt7928/CBMCU_CODE_MT7935_1_1.bin"
34: B1 Line exceeds max length (98>80): "[ 6931.215214] Bluetooth: hci1: CBMCU HW ver: 0x7935, SW ver: 0x0000, Build Time: 20260601T161751+"
36: B1 Line exceeds max length (99>80): "[ 6931.643916] Bluetooth: hci1: Loading BT firmware: mediatek/mt7928/BT_RAM_CODE_MT7935_1_1_hdr.bin"
37: B1 Line exceeds max length (93>80): "[ 6931.650467] Bluetooth: hci1: BT HW ver: 0x7935, SW ver: 0x0000, Build Time: 20260527000816"
39: B1 Line exceeds max length (115>80): "[ 6935.039833] Bluetooth: hci1: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported."
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found
https://github.com/bluez/bluetooth-next/pull/447
---
Regards,
Linux Bluetooth
^ permalink raw reply [flat|nested] 20+ messages in thread
* [PATCH v11 1/7] Bluetooth: btmtksdio: Fix DMA out-of-bounds access in TX path
@ 2026-07-15 11:20 Chris Lu
2026-07-15 12:19 ` Bluetooth: btmtk: Add MT7928 support bluez.test.bot
0 siblings, 1 reply; 20+ messages in thread
From: Chris Lu @ 2026-07-15 11:20 UTC (permalink / raw)
To: Marcel Holtmann, Johan Hedberg, Luiz Von Dentz
Cc: Sean Wang, Will Lee, SS Wu, Steve Lee, Paul Menzel,
linux-bluetooth, linux-kernel, linux-mediatek, Chris Lu
btmtksdio_tx_packet() aligns transfer size to 256 bytes using
round_up(), but does not ensure the skb buffer has sufficient space,
causing DMA to read beyond the buffer.
Fix by expanding skb tailroom if needed and zero-filling the padding.
Fixes: 9aebfd4a2200 ("Bluetooth: mediatek: add support for MediaTek MT7663S and MT7668S SDIO devices")
Signed-off-by: Chris Lu <chris.lu@mediatek.com>
---
drivers/bluetooth/btmtksdio.c | 33 +++++++++++++++++++++++++++++----
1 file changed, 29 insertions(+), 4 deletions(-)
diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c
index 5b0fab7b89b5..feda1ea8f256 100644
--- a/drivers/bluetooth/btmtksdio.c
+++ b/drivers/bluetooth/btmtksdio.c
@@ -272,6 +272,7 @@ static int btmtksdio_tx_packet(struct btmtksdio_dev *bdev,
struct sk_buff *skb)
{
struct mtkbtsdio_hdr *sdio_hdr;
+ unsigned int padded_len, pad_len;
int err;
/* Make sure that there are enough rooms for SDIO header */
@@ -290,18 +291,42 @@ static int btmtksdio_tx_packet(struct btmtksdio_dev *bdev,
sdio_hdr->reserved = cpu_to_le16(0);
sdio_hdr->bt_type = hci_skb_pkt_type(skb);
+ /* Calculate padded length for block-aligned DMA transfer.
+ * SDIO requires transfers to be block-aligned (MTK_SDIO_BLOCK_SIZE).
+ * Pad with zeros to prevent DMA from reading beyond skb buffer.
+ */
+ padded_len = round_up(skb->len, MTK_SDIO_BLOCK_SIZE);
+ pad_len = padded_len - skb->len;
+
+ if (pad_len > 0) {
+ /* Ensure sufficient tailroom for padding */
+ if (unlikely(skb_tailroom(skb) < pad_len)) {
+ err = pskb_expand_head(skb, 0, pad_len, GFP_ATOMIC);
+ if (err < 0)
+ goto err_skb_pull;
+ /* Reassign sdio_hdr after buffer reallocation */
+ sdio_hdr = (void *)skb->data;
+ }
+
+ /* Zero-fill padding to prevent information disclosure */
+ skb_put_zero(skb, pad_len);
+ }
+
clear_bit(BTMTKSDIO_HW_TX_READY, &bdev->tx_state);
- err = sdio_writesb(bdev->func, MTK_REG_CTDR, skb->data,
- round_up(skb->len, MTK_SDIO_BLOCK_SIZE));
+ err = sdio_writesb(bdev->func, MTK_REG_CTDR, skb->data, padded_len);
if (err < 0)
- goto err_skb_pull;
+ goto err_skb_trim;
- bdev->hdev->stat.byte_tx += skb->len;
+ /* Record actual transmitted data (excluding padding) */
+ bdev->hdev->stat.byte_tx += le16_to_cpu(sdio_hdr->len);
kfree_skb(skb);
return 0;
+err_skb_trim:
+ if (pad_len > 0)
+ skb_trim(skb, skb->len - pad_len);
err_skb_pull:
skb_pull(skb, sizeof(*sdio_hdr));
--
2.45.2
^ permalink raw reply related [flat|nested] 20+ messages in thread* RE: Bluetooth: btmtk: Add MT7928 support
2026-07-15 11:20 [PATCH v11 1/7] Bluetooth: btmtksdio: Fix DMA out-of-bounds access in TX path Chris Lu
@ 2026-07-15 12:19 ` bluez.test.bot
0 siblings, 0 replies; 20+ messages in thread
From: bluez.test.bot @ 2026-07-15 12:19 UTC (permalink / raw)
To: linux-bluetooth, chris.lu
[-- Attachment #1: Type: text/plain, Size: 2866 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1128086
---Test result---
Test Summary:
CheckPatch PASS 3.67 seconds
VerifyFixes PASS 0.07 seconds
VerifySignedoff PASS 0.15 seconds
GitLint FAIL 1.35 seconds
SubjectPrefix PASS 0.48 seconds
BuildKernel PASS 19.87 seconds
CheckAllWarning PASS 22.18 seconds
CheckSparse PASS 21.36 seconds
BuildKernel32 PASS 21.82 seconds
CheckKernelLLVM SKIP 0.00 seconds
TestRunnerSetup PASS 365.28 seconds
IncrementalBuild PASS 34.11 seconds
Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[v11,2/7] Bluetooth: btmtk: Add firmware size validation in btmtk_setup_firmware_79xx()
1: T1 Title exceeds max length (87>80): "[v11,2/7] Bluetooth: btmtk: Add firmware size validation in btmtk_setup_firmware_79xx()"
[v11,3/7] Bluetooth: btmtk: Improve BT firmware logging
14: B1 Line exceeds max length (92>80): "[ 212.878783] Bluetooth: hci1: Loading BT firmware: mediatek/BT_RAM_CODE_MT7922_1_1_hdr.bin"
15: B1 Line exceeds max length (93>80): "[ 212.889614] Bluetooth: hci1: BT HW ver: 0x7922, SW ver: 0x008a, Build Time: 20260224103448"
17: B1 Line exceeds max length (115>80): "[ 216.048890] Bluetooth: hci1: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported."
[v11,7/7] Bluetooth: btmtk: Add MT7928 support
28: B1 Line exceeds max length (92>80): "[ 6931.197167] usb 1-3: New USB device found, idVendor=0e8d, idProduct=7935, bcdDevice= 1.00"
33: B1 Line exceeds max length (97>80): "[ 6931.213478] Bluetooth: hci1: Loading CBMCU firmware: mediatek/mt7928/CBMCU_CODE_MT7935_1_1.bin"
34: B1 Line exceeds max length (98>80): "[ 6931.215214] Bluetooth: hci1: CBMCU HW ver: 0x7935, SW ver: 0x0000, Build Time: 20260601T161751+"
36: B1 Line exceeds max length (99>80): "[ 6931.643916] Bluetooth: hci1: Loading BT firmware: mediatek/mt7928/BT_RAM_CODE_MT7935_1_1_hdr.bin"
37: B1 Line exceeds max length (93>80): "[ 6931.650467] Bluetooth: hci1: BT HW ver: 0x7935, SW ver: 0x0000, Build Time: 20260527000816"
39: B1 Line exceeds max length (115>80): "[ 6935.039833] Bluetooth: hci1: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported."
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found
https://github.com/bluez/bluetooth-next/pull/443
---
Regards,
Linux Bluetooth
^ permalink raw reply [flat|nested] 20+ messages in thread
* [PATCH v10 1/7] Bluetooth: btmtksdio: Fix DMA out-of-bounds access in TX path
@ 2026-07-14 12:33 Chris Lu
2026-07-14 14:48 ` Bluetooth: btmtk: Add MT7928 support bluez.test.bot
0 siblings, 1 reply; 20+ messages in thread
From: Chris Lu @ 2026-07-14 12:33 UTC (permalink / raw)
To: Marcel Holtmann, Johan Hedberg, Luiz Von Dentz
Cc: Sean Wang, Will Lee, SS Wu, Steve Lee, Paul Menzel,
linux-bluetooth, linux-kernel, linux-mediatek, Chris Lu
btmtksdio_tx_packet() aligns transfer size to 256 bytes using
round_up(), but does not ensure the skb buffer has sufficient space,
causing DMA to read beyond the buffer.
Fix by expanding skb tailroom if needed and zero-filling the padding.
Fixes: 9aebfd4a2200 ("Bluetooth: mediatek: add support for MediaTek MT7663S and MT7668S SDIO devices")
Signed-off-by: Chris Lu <chris.lu@mediatek.com>
---
drivers/bluetooth/btmtksdio.c | 31 +++++++++++++++++++++++++++----
1 file changed, 27 insertions(+), 4 deletions(-)
diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c
index 5b0fab7b89b5..a21edefaca99 100644
--- a/drivers/bluetooth/btmtksdio.c
+++ b/drivers/bluetooth/btmtksdio.c
@@ -272,6 +272,7 @@ static int btmtksdio_tx_packet(struct btmtksdio_dev *bdev,
struct sk_buff *skb)
{
struct mtkbtsdio_hdr *sdio_hdr;
+ unsigned int padded_len, pad_len;
int err;
/* Make sure that there are enough rooms for SDIO header */
@@ -290,18 +291,40 @@ static int btmtksdio_tx_packet(struct btmtksdio_dev *bdev,
sdio_hdr->reserved = cpu_to_le16(0);
sdio_hdr->bt_type = hci_skb_pkt_type(skb);
+ /* Calculate padded length for block-aligned DMA transfer.
+ * SDIO requires transfers to be block-aligned (MTK_SDIO_BLOCK_SIZE).
+ * Pad with zeros to prevent DMA from reading beyond skb buffer.
+ */
+ padded_len = round_up(skb->len, MTK_SDIO_BLOCK_SIZE);
+ pad_len = padded_len - skb->len;
+
+ if (pad_len > 0) {
+ /* Ensure sufficient tailroom for padding */
+ if (unlikely(skb_tailroom(skb) < pad_len)) {
+ err = pskb_expand_head(skb, 0, pad_len, GFP_ATOMIC);
+ if (err < 0)
+ goto err_skb_pull;
+ }
+
+ /* Zero-fill padding to prevent information disclosure */
+ skb_put_zero(skb, pad_len);
+ }
+
clear_bit(BTMTKSDIO_HW_TX_READY, &bdev->tx_state);
- err = sdio_writesb(bdev->func, MTK_REG_CTDR, skb->data,
- round_up(skb->len, MTK_SDIO_BLOCK_SIZE));
+ err = sdio_writesb(bdev->func, MTK_REG_CTDR, skb->data, padded_len);
if (err < 0)
- goto err_skb_pull;
+ goto err_skb_trim;
- bdev->hdev->stat.byte_tx += skb->len;
+ /* Record actual transmitted data (excluding padding) */
+ bdev->hdev->stat.byte_tx += le16_to_cpu(sdio_hdr->len);
kfree_skb(skb);
return 0;
+err_skb_trim:
+ if (pad_len > 0)
+ skb_trim(skb, skb->len - pad_len);
err_skb_pull:
skb_pull(skb, sizeof(*sdio_hdr));
--
2.45.2
^ permalink raw reply related [flat|nested] 20+ messages in thread* RE: Bluetooth: btmtk: Add MT7928 support
2026-07-14 12:33 [PATCH v10 1/7] Bluetooth: btmtksdio: Fix DMA out-of-bounds access in TX path Chris Lu
@ 2026-07-14 14:48 ` bluez.test.bot
0 siblings, 0 replies; 20+ messages in thread
From: bluez.test.bot @ 2026-07-14 14:48 UTC (permalink / raw)
To: linux-bluetooth, chris.lu
[-- Attachment #1: Type: text/plain, Size: 2866 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1127419
---Test result---
Test Summary:
CheckPatch PASS 5.68 seconds
VerifyFixes PASS 0.13 seconds
VerifySignedoff PASS 0.14 seconds
GitLint FAIL 2.34 seconds
SubjectPrefix PASS 0.89 seconds
BuildKernel PASS 27.37 seconds
CheckAllWarning PASS 30.18 seconds
CheckSparse PASS 29.83 seconds
BuildKernel32 PASS 27.06 seconds
CheckKernelLLVM SKIP 0.00 seconds
TestRunnerSetup PASS 507.71 seconds
IncrementalBuild PASS 41.14 seconds
Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[v10,2/7] Bluetooth: btmtk: Add firmware size validation in btmtk_setup_firmware_79xx()
1: T1 Title exceeds max length (87>80): "[v10,2/7] Bluetooth: btmtk: Add firmware size validation in btmtk_setup_firmware_79xx()"
[v10,6/7] Bluetooth: btmtk: Improve BT firmware logging
14: B1 Line exceeds max length (92>80): "[ 212.878783] Bluetooth: hci1: Loading BT firmware: mediatek/BT_RAM_CODE_MT7922_1_1_hdr.bin"
15: B1 Line exceeds max length (93>80): "[ 212.889614] Bluetooth: hci1: BT HW ver: 0x7922, SW ver: 0x008a, Build Time: 20260224103448"
17: B1 Line exceeds max length (115>80): "[ 216.048890] Bluetooth: hci1: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported."
[v10,7/7] Bluetooth: btmtk: Add MT7928 support
28: B1 Line exceeds max length (92>80): "[ 6931.197167] usb 1-3: New USB device found, idVendor=0e8d, idProduct=7935, bcdDevice= 1.00"
33: B1 Line exceeds max length (97>80): "[ 6931.213478] Bluetooth: hci1: Loading CBMCU firmware: mediatek/mt7928/CBMCU_CODE_MT7935_1_1.bin"
34: B1 Line exceeds max length (98>80): "[ 6931.215214] Bluetooth: hci1: CBMCU HW ver: 0x7935, SW ver: 0x0000, Build Time: 20260601T161751+"
36: B1 Line exceeds max length (99>80): "[ 6931.643916] Bluetooth: hci1: Loading BT firmware: mediatek/mt7928/BT_RAM_CODE_MT7935_1_1_hdr.bin"
37: B1 Line exceeds max length (93>80): "[ 6931.650467] Bluetooth: hci1: BT HW ver: 0x7935, SW ver: 0x0000, Build Time: 20260527000816"
39: B1 Line exceeds max length (115>80): "[ 6935.039833] Bluetooth: hci1: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported."
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found
https://github.com/bluez/bluetooth-next/pull/437
---
Regards,
Linux Bluetooth
^ permalink raw reply [flat|nested] 20+ messages in thread
* [PATCH v9 1/6] Bluetooth: btmtk: Add firmware size validation in btmtk_setup_firmware_79xx()
@ 2026-07-02 10:14 Chris Lu
2026-07-02 10:51 ` Bluetooth: btmtk: Add MT7928 support bluez.test.bot
0 siblings, 1 reply; 20+ messages in thread
From: Chris Lu @ 2026-07-02 10:14 UTC (permalink / raw)
To: Marcel Holtmann, Johan Hedberg, Luiz Von Dentz
Cc: Sean Wang, Will Lee, SS Wu, Steve Lee, linux-bluetooth,
linux-kernel, linux-mediatek, Paul Menzel, Chris Lu
Add firmware size validation to prevent out-of-bounds access when loading
truncated or malicious firmware files.
Add three levels of validation:
1. Minimum size check for header and global descriptor
2. Section map bounds check with integer overflow protection using
check_mul_overflow() and check_add_overflow()
3. Section data bounds check before accessing each section
This matches the validation approach used in btmtk_load_cbmcu_firmware().
Signed-off-by: Chris Lu <chris.lu@mediatek.com>
Assisted-by: Claude:Sonnet-4.5
---
drivers/bluetooth/btmtk.c | 39 +++++++++++++++++++++++++++++++++++++++
1 file changed, 39 insertions(+)
diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c
index 02a96342e964..3491060b3ae9 100644
--- a/drivers/bluetooth/btmtk.c
+++ b/drivers/bluetooth/btmtk.c
@@ -145,6 +145,7 @@ int btmtk_setup_firmware_79xx(struct hci_dev *hdev, const char *fwname,
int err, dlen, i, status;
u8 flag, first_block, retry;
u32 section_num, dl_size, section_offset;
+ size_t expected_size;
u8 cmd[64];
err = request_firmware(&fw, fwname, &hdev->dev);
@@ -153,12 +154,40 @@ int btmtk_setup_firmware_79xx(struct hci_dev *hdev, const char *fwname,
return err;
}
+ /* Validate minimum firmware size for header and global descriptor */
+ if (fw->size < MTK_FW_ROM_PATCH_HEADER_SIZE + MTK_FW_ROM_PATCH_GD_SIZE) {
+ bt_dev_err(hdev, "Firmware file too small: size=%zu, expected at least %u bytes",
+ fw->size, MTK_FW_ROM_PATCH_HEADER_SIZE + MTK_FW_ROM_PATCH_GD_SIZE);
+ err = -EINVAL;
+ goto err_release_fw;
+ }
+
fw_ptr = fw->data;
fw_bin_ptr = fw_ptr;
hdr = (struct btmtk_patch_header *)fw_ptr;
globaldesc = (struct btmtk_global_desc *)(fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE);
section_num = le32_to_cpu(globaldesc->section_num);
+ /* Check for potential integer overflow in size calculation */
+ if (check_mul_overflow((size_t)MTK_FW_ROM_PATCH_SEC_MAP_SIZE,
+ (size_t)section_num, &expected_size) ||
+ check_add_overflow(expected_size,
+ (size_t)(MTK_FW_ROM_PATCH_HEADER_SIZE +
+ MTK_FW_ROM_PATCH_GD_SIZE),
+ &expected_size)) {
+ bt_dev_err(hdev, "Firmware size calculation overflow (section_num=%u)",
+ section_num);
+ err = -EINVAL;
+ goto err_release_fw;
+ }
+
+ if (fw->size < expected_size) {
+ bt_dev_err(hdev, "Firmware truncated: size=%zu, expected=%zu (section_num=%u)",
+ fw->size, expected_size, section_num);
+ err = -EINVAL;
+ goto err_release_fw;
+ }
+
bt_dev_info(hdev, "HW/SW Version: 0x%04x%04x, Build Time: %s",
le16_to_cpu(hdr->hwver), le16_to_cpu(hdr->swver), hdr->datetime);
@@ -171,6 +200,16 @@ int btmtk_setup_firmware_79xx(struct hci_dev *hdev, const char *fwname,
section_offset = le32_to_cpu(sectionmap->secoffset);
dl_size = le32_to_cpu(sectionmap->bin_info_spec.dlsize);
+ /* Validate section boundaries to prevent out-of-bounds access */
+ if (dl_size > 0 &&
+ (section_offset > fw->size ||
+ dl_size > fw->size - section_offset)) {
+ bt_dev_err(hdev, "Section %d out of bounds: offset=%u, size=%u, fw_size=%zu",
+ i, section_offset, dl_size, fw->size);
+ err = -EINVAL;
+ goto err_release_fw;
+ }
+
/* MT6639: only download sections where dlmode byte0 == 0x01,
* matching the Windows driver behavior which skips WiFi/other
* sections that would cause the chip to hang.
--
2.45.2
^ permalink raw reply related [flat|nested] 20+ messages in thread* RE: Bluetooth: btmtk: Add MT7928 support
2026-07-02 10:14 [PATCH v9 1/6] Bluetooth: btmtk: Add firmware size validation in btmtk_setup_firmware_79xx() Chris Lu
@ 2026-07-02 10:51 ` bluez.test.bot
0 siblings, 0 replies; 20+ messages in thread
From: bluez.test.bot @ 2026-07-02 10:51 UTC (permalink / raw)
To: linux-bluetooth, chris.lu
[-- Attachment #1: Type: text/plain, Size: 2862 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1120412
---Test result---
Test Summary:
CheckPatch PASS 3.74 seconds
VerifyFixes PASS 0.08 seconds
VerifySignedoff PASS 0.08 seconds
GitLint FAIL 1.38 seconds
SubjectPrefix PASS 0.46 seconds
BuildKernel PASS 24.66 seconds
CheckAllWarning PASS 27.56 seconds
CheckSparse PASS 26.65 seconds
BuildKernel32 PASS 27.46 seconds
CheckKernelLLVM SKIP 0.00 seconds
TestRunnerSetup PASS 458.97 seconds
IncrementalBuild PASS 32.89 seconds
Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[v9,1/6] Bluetooth: btmtk: Add firmware size validation in btmtk_setup_firmware_79xx()
1: T1 Title exceeds max length (86>80): "[v9,1/6] Bluetooth: btmtk: Add firmware size validation in btmtk_setup_firmware_79xx()"
[v9,5/6] Bluetooth: btmtk: Improve BT firmware logging
14: B1 Line exceeds max length (92>80): "[ 212.878783] Bluetooth: hci1: Loading BT firmware: mediatek/BT_RAM_CODE_MT7922_1_1_hdr.bin"
15: B1 Line exceeds max length (93>80): "[ 212.889614] Bluetooth: hci1: BT HW ver: 0x7922, SW ver: 0x008a, Build Time: 20260224103448"
17: B1 Line exceeds max length (115>80): "[ 216.048890] Bluetooth: hci1: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported."
[v9,6/6] Bluetooth: btmtk: Add MT7928 support
28: B1 Line exceeds max length (92>80): "[ 6931.197167] usb 1-3: New USB device found, idVendor=0e8d, idProduct=7935, bcdDevice= 1.00"
33: B1 Line exceeds max length (97>80): "[ 6931.213478] Bluetooth: hci1: Loading CBMCU firmware: mediatek/mt7928/CBMCU_CODE_MT7935_1_1.bin"
34: B1 Line exceeds max length (98>80): "[ 6931.215214] Bluetooth: hci1: CBMCU HW ver: 0x7935, SW ver: 0x0000, Build Time: 20260601T161751+"
36: B1 Line exceeds max length (99>80): "[ 6931.643916] Bluetooth: hci1: Loading BT firmware: mediatek/mt7928/BT_RAM_CODE_MT7935_1_1_hdr.bin"
37: B1 Line exceeds max length (93>80): "[ 6931.650467] Bluetooth: hci1: BT HW ver: 0x7935, SW ver: 0x0000, Build Time: 20260527000816"
39: B1 Line exceeds max length (115>80): "[ 6935.039833] Bluetooth: hci1: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported."
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found
https://github.com/bluez/bluetooth-next/pull/385
---
Regards,
Linux Bluetooth
^ permalink raw reply [flat|nested] 20+ messages in thread
* [PATCH v8 1/5] Bluetooth: btmtk: Add firmware size validation in btmtk_setup_firmware_79xx()
@ 2026-07-02 7:28 Chris Lu
2026-07-02 8:21 ` Bluetooth: btmtk: Add MT7928 support bluez.test.bot
0 siblings, 1 reply; 20+ messages in thread
From: Chris Lu @ 2026-07-02 7:28 UTC (permalink / raw)
To: Marcel Holtmann, Johan Hedberg, Luiz Von Dentz
Cc: Sean Wang, Will Lee, SS Wu, Steve Lee, linux-bluetooth,
linux-kernel, linux-mediatek, Paul Menzel, Chris Lu
Add firmware size validation to prevent out-of-bounds access when loading
truncated or malicious firmware files.
Add three levels of validation:
1. Minimum size check for header and global descriptor
2. Section map bounds check with integer overflow protection using
check_mul_overflow() and check_add_overflow()
3. Section data bounds check before accessing each section
This matches the validation approach used in btmtk_load_cbmcu_firmware().
Signed-off-by: Chris Lu <chris.lu@mediatek.com>
Assisted-by: Claude:Sonnet-4.5
---
drivers/bluetooth/btmtk.c | 39 +++++++++++++++++++++++++++++++++++++++
1 file changed, 39 insertions(+)
diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c
index 02a96342e964..3491060b3ae9 100644
--- a/drivers/bluetooth/btmtk.c
+++ b/drivers/bluetooth/btmtk.c
@@ -145,6 +145,7 @@ int btmtk_setup_firmware_79xx(struct hci_dev *hdev, const char *fwname,
int err, dlen, i, status;
u8 flag, first_block, retry;
u32 section_num, dl_size, section_offset;
+ size_t expected_size;
u8 cmd[64];
err = request_firmware(&fw, fwname, &hdev->dev);
@@ -153,12 +154,40 @@ int btmtk_setup_firmware_79xx(struct hci_dev *hdev, const char *fwname,
return err;
}
+ /* Validate minimum firmware size for header and global descriptor */
+ if (fw->size < MTK_FW_ROM_PATCH_HEADER_SIZE + MTK_FW_ROM_PATCH_GD_SIZE) {
+ bt_dev_err(hdev, "Firmware file too small: size=%zu, expected at least %u bytes",
+ fw->size, MTK_FW_ROM_PATCH_HEADER_SIZE + MTK_FW_ROM_PATCH_GD_SIZE);
+ err = -EINVAL;
+ goto err_release_fw;
+ }
+
fw_ptr = fw->data;
fw_bin_ptr = fw_ptr;
hdr = (struct btmtk_patch_header *)fw_ptr;
globaldesc = (struct btmtk_global_desc *)(fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE);
section_num = le32_to_cpu(globaldesc->section_num);
+ /* Check for potential integer overflow in size calculation */
+ if (check_mul_overflow((size_t)MTK_FW_ROM_PATCH_SEC_MAP_SIZE,
+ (size_t)section_num, &expected_size) ||
+ check_add_overflow(expected_size,
+ (size_t)(MTK_FW_ROM_PATCH_HEADER_SIZE +
+ MTK_FW_ROM_PATCH_GD_SIZE),
+ &expected_size)) {
+ bt_dev_err(hdev, "Firmware size calculation overflow (section_num=%u)",
+ section_num);
+ err = -EINVAL;
+ goto err_release_fw;
+ }
+
+ if (fw->size < expected_size) {
+ bt_dev_err(hdev, "Firmware truncated: size=%zu, expected=%zu (section_num=%u)",
+ fw->size, expected_size, section_num);
+ err = -EINVAL;
+ goto err_release_fw;
+ }
+
bt_dev_info(hdev, "HW/SW Version: 0x%04x%04x, Build Time: %s",
le16_to_cpu(hdr->hwver), le16_to_cpu(hdr->swver), hdr->datetime);
@@ -171,6 +200,16 @@ int btmtk_setup_firmware_79xx(struct hci_dev *hdev, const char *fwname,
section_offset = le32_to_cpu(sectionmap->secoffset);
dl_size = le32_to_cpu(sectionmap->bin_info_spec.dlsize);
+ /* Validate section boundaries to prevent out-of-bounds access */
+ if (dl_size > 0 &&
+ (section_offset > fw->size ||
+ dl_size > fw->size - section_offset)) {
+ bt_dev_err(hdev, "Section %d out of bounds: offset=%u, size=%u, fw_size=%zu",
+ i, section_offset, dl_size, fw->size);
+ err = -EINVAL;
+ goto err_release_fw;
+ }
+
/* MT6639: only download sections where dlmode byte0 == 0x01,
* matching the Windows driver behavior which skips WiFi/other
* sections that would cause the chip to hang.
--
2.45.2
^ permalink raw reply related [flat|nested] 20+ messages in thread* RE: Bluetooth: btmtk: Add MT7928 support
2026-07-02 7:28 [PATCH v8 1/5] Bluetooth: btmtk: Add firmware size validation in btmtk_setup_firmware_79xx() Chris Lu
@ 2026-07-02 8:21 ` bluez.test.bot
0 siblings, 0 replies; 20+ messages in thread
From: bluez.test.bot @ 2026-07-02 8:21 UTC (permalink / raw)
To: linux-bluetooth, chris.lu
[-- Attachment #1: Type: text/plain, Size: 2862 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1120276
---Test result---
Test Summary:
CheckPatch PASS 3.49 seconds
VerifyFixes PASS 0.09 seconds
VerifySignedoff PASS 0.08 seconds
GitLint FAIL 1.17 seconds
SubjectPrefix PASS 0.38 seconds
BuildKernel PASS 27.62 seconds
CheckAllWarning PASS 30.50 seconds
CheckSparse PASS 29.88 seconds
BuildKernel32 PASS 27.67 seconds
CheckKernelLLVM SKIP 0.00 seconds
TestRunnerSetup PASS 514.48 seconds
IncrementalBuild PASS 58.26 seconds
Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[v8,1/5] Bluetooth: btmtk: Add firmware size validation in btmtk_setup_firmware_79xx()
1: T1 Title exceeds max length (86>80): "[v8,1/5] Bluetooth: btmtk: Add firmware size validation in btmtk_setup_firmware_79xx()"
[v8,4/5] Bluetooth: btmtk: Improve BT firmware logging
14: B1 Line exceeds max length (92>80): "[ 212.878783] Bluetooth: hci1: Loading BT firmware: mediatek/BT_RAM_CODE_MT7922_1_1_hdr.bin"
15: B1 Line exceeds max length (93>80): "[ 212.889614] Bluetooth: hci1: BT HW ver: 0x7922, SW ver: 0x008a, Build Time: 20260224103448"
17: B1 Line exceeds max length (115>80): "[ 216.048890] Bluetooth: hci1: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported."
[v8,5/5] Bluetooth: btmtk: Add MT7928 support
28: B1 Line exceeds max length (92>80): "[ 6931.197167] usb 1-3: New USB device found, idVendor=0e8d, idProduct=7935, bcdDevice= 1.00"
33: B1 Line exceeds max length (97>80): "[ 6931.213478] Bluetooth: hci1: Loading CBMCU firmware: mediatek/mt7928/CBMCU_CODE_MT7935_1_1.bin"
34: B1 Line exceeds max length (98>80): "[ 6931.215214] Bluetooth: hci1: CBMCU HW ver: 0x7935, SW ver: 0x0000, Build Time: 20260601T161751+"
36: B1 Line exceeds max length (99>80): "[ 6931.643916] Bluetooth: hci1: Loading BT firmware: mediatek/mt7928/BT_RAM_CODE_MT7935_1_1_hdr.bin"
37: B1 Line exceeds max length (93>80): "[ 6931.650467] Bluetooth: hci1: BT HW ver: 0x7935, SW ver: 0x0000, Build Time: 20260527000816"
39: B1 Line exceeds max length (115>80): "[ 6935.039833] Bluetooth: hci1: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported."
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found
https://github.com/bluez/bluetooth-next/pull/384
---
Regards,
Linux Bluetooth
^ permalink raw reply [flat|nested] 20+ messages in thread
* [PATCH v7 1/3] Bluetooth: btmtk: Replace magic numbers with WMT packet flag enum
@ 2026-07-01 12:13 Chris Lu
2026-07-01 14:24 ` Bluetooth: btmtk: Add MT7928 support bluez.test.bot
0 siblings, 1 reply; 20+ messages in thread
From: Chris Lu @ 2026-07-01 12:13 UTC (permalink / raw)
To: Marcel Holtmann, Johan Hedberg, Luiz Von Dentz
Cc: Sean Wang, Will Lee, SS Wu, Steve Lee, linux-bluetooth,
linux-kernel, linux-mediatek, Paul Menzel, Chris Lu
Add BTMTK_WMT_PKT_* enum to represent WMT download packet sequence flags,
improving code readability. Replace magic numbers (1, 2, 3) in
btmtk_setup_firmware_79xx() and btmtk_setup_firmware() with descriptive
enum values:
- BTMTK_WMT_PKT_START (1): First packet of a sequence
- BTMTK_WMT_PKT_CONTINUE (2): Continuation packet
- BTMTK_WMT_PKT_END (3): Final packet of a sequence
Signed-off-by: Chris Lu <chris.lu@mediatek.com>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Assisted-by: Claude:Sonnet-4.5
---
drivers/bluetooth/btmtk.c | 12 ++++++------
drivers/bluetooth/btmtk.h | 6 ++++++
2 files changed, 12 insertions(+), 6 deletions(-)
diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c
index 02a96342e964..40c2a64aa6b7 100644
--- a/drivers/bluetooth/btmtk.c
+++ b/drivers/bluetooth/btmtk.c
@@ -230,12 +230,12 @@ int btmtk_setup_firmware_79xx(struct hci_dev *hdev, const char *fwname,
while (dl_size > 0) {
dlen = min_t(int, 250, dl_size);
if (first_block == 1) {
- flag = 1;
+ flag = BTMTK_WMT_PKT_START;
first_block = 0;
} else if (dl_size - dlen <= 0) {
- flag = 3;
+ flag = BTMTK_WMT_PKT_END;
} else {
- flag = 2;
+ flag = BTMTK_WMT_PKT_CONTINUE;
}
wmt_params.flag = flag;
@@ -314,7 +314,7 @@ int btmtk_setup_firmware(struct hci_dev *hdev, const char *fwname,
fw_size -= 30;
fw_ptr += 30;
- flag = 1;
+ flag = BTMTK_WMT_PKT_START;
wmt_params.op = BTMTK_WMT_PATCH_DWNLD;
wmt_params.status = NULL;
@@ -324,9 +324,9 @@ int btmtk_setup_firmware(struct hci_dev *hdev, const char *fwname,
/* Tell device the position in sequence */
if (fw_size - dlen <= 0)
- flag = 3;
+ flag = BTMTK_WMT_PKT_END;
else if (fw_size < fw->size - 30)
- flag = 2;
+ flag = BTMTK_WMT_PKT_CONTINUE;
wmt_params.flag = flag;
wmt_params.dlen = dlen;
diff --git a/drivers/bluetooth/btmtk.h b/drivers/bluetooth/btmtk.h
index c83c24897c95..51c18dde0a80 100644
--- a/drivers/bluetooth/btmtk.h
+++ b/drivers/bluetooth/btmtk.h
@@ -66,6 +66,12 @@ enum {
BTMTK_WMT_ON_PROGRESS,
};
+enum {
+ BTMTK_WMT_PKT_START = 1,
+ BTMTK_WMT_PKT_CONTINUE = 2,
+ BTMTK_WMT_PKT_END = 3,
+};
+
struct btmtk_wmt_hdr {
u8 dir;
u8 op;
--
2.45.2
^ permalink raw reply related [flat|nested] 20+ messages in thread* RE: Bluetooth: btmtk: Add MT7928 support
2026-07-01 12:13 [PATCH v7 1/3] Bluetooth: btmtk: Replace magic numbers with WMT packet flag enum Chris Lu
@ 2026-07-01 14:24 ` bluez.test.bot
0 siblings, 0 replies; 20+ messages in thread
From: bluez.test.bot @ 2026-07-01 14:24 UTC (permalink / raw)
To: linux-bluetooth, chris.lu
[-- Attachment #1: Type: text/plain, Size: 2645 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1119720
---Test result---
Test Summary:
CheckPatch PASS 2.40 seconds
VerifyFixes PASS 0.09 seconds
VerifySignedoff PASS 0.09 seconds
GitLint FAIL 0.73 seconds
SubjectPrefix PASS 0.25 seconds
BuildKernel PASS 27.21 seconds
CheckAllWarning PASS 29.79 seconds
CheckSparse PASS 29.10 seconds
BuildKernel32 PASS 26.45 seconds
CheckKernelLLVM SKIP 0.00 seconds
TestRunnerSetup PASS 496.96 seconds
IncrementalBuild PASS 30.21 seconds
Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[v7,2/3] Bluetooth: btmtk: Improve BT firmware logging
14: B1 Line exceeds max length (92>80): "[ 212.878783] Bluetooth: hci1: Loading BT firmware: mediatek/BT_RAM_CODE_MT7922_1_1_hdr.bin"
15: B1 Line exceeds max length (93>80): "[ 212.889614] Bluetooth: hci1: BT HW ver: 0x7922, SW ver: 0x008a, Build Time: 20260224103448"
17: B1 Line exceeds max length (115>80): "[ 216.048890] Bluetooth: hci1: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported."
[v7,3/3] Bluetooth: btmtk: Add MT7928 support
28: B1 Line exceeds max length (92>80): "[ 6931.197167] usb 1-3: New USB device found, idVendor=0e8d, idProduct=7935, bcdDevice= 1.00"
33: B1 Line exceeds max length (97>80): "[ 6931.213478] Bluetooth: hci1: Loading CBMCU firmware: mediatek/mt7928/CBMCU_CODE_MT7935_1_1.bin"
34: B1 Line exceeds max length (98>80): "[ 6931.215214] Bluetooth: hci1: CBMCU HW ver: 0x7935, SW ver: 0x0000, Build Time: 20260601T161751+"
36: B1 Line exceeds max length (99>80): "[ 6931.643916] Bluetooth: hci1: Loading BT firmware: mediatek/mt7928/BT_RAM_CODE_MT7935_1_1_hdr.bin"
37: B1 Line exceeds max length (93>80): "[ 6931.650467] Bluetooth: hci1: BT HW ver: 0x7935, SW ver: 0x0000, Build Time: 20260527000816"
39: B1 Line exceeds max length (115>80): "[ 6935.039833] Bluetooth: hci1: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported."
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found
https://github.com/bluez/bluetooth-next/pull/379
---
Regards,
Linux Bluetooth
^ permalink raw reply [flat|nested] 20+ messages in thread
* [PATCH v6 1/3] Bluetooth: btmtk: Replace magic numbers with WMT packet flag enum
@ 2026-06-30 12:35 Chris Lu
2026-06-30 13:56 ` Bluetooth: btmtk: Add MT7928 support bluez.test.bot
0 siblings, 1 reply; 20+ messages in thread
From: Chris Lu @ 2026-06-30 12:35 UTC (permalink / raw)
To: Marcel Holtmann, Johan Hedberg, Luiz Von Dentz
Cc: Sean Wang, Will Lee, SS Wu, Steve Lee, linux-bluetooth,
linux-kernel, linux-mediatek, Paul Menzel, Chris Lu
Add BTMTK_WMT_PKT_* enum to represent WMT download packet sequence flags,
improving code readability. Replace magic numbers (1, 2, 3) in
btmtk_setup_firmware_79xx() with descriptive enum values:
- BTMTK_WMT_PKT_START (1): First packet of a sequence
- BTMTK_WMT_PKT_CONTINUE (2): Continuation packet
- BTMTK_WMT_PKT_END (3): Final packet of a sequence
Signed-off-by: Chris Lu <chris.lu@mediatek.com>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
---
drivers/bluetooth/btmtk.c | 6 +++---
drivers/bluetooth/btmtk.h | 6 ++++++
2 files changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c
index 02a96342e964..21c08ee1cdbf 100644
--- a/drivers/bluetooth/btmtk.c
+++ b/drivers/bluetooth/btmtk.c
@@ -230,12 +230,12 @@ int btmtk_setup_firmware_79xx(struct hci_dev *hdev, const char *fwname,
while (dl_size > 0) {
dlen = min_t(int, 250, dl_size);
if (first_block == 1) {
- flag = 1;
+ flag = BTMTK_WMT_PKT_START;
first_block = 0;
} else if (dl_size - dlen <= 0) {
- flag = 3;
+ flag = BTMTK_WMT_PKT_END;
} else {
- flag = 2;
+ flag = BTMTK_WMT_PKT_CONTINUE;
}
wmt_params.flag = flag;
diff --git a/drivers/bluetooth/btmtk.h b/drivers/bluetooth/btmtk.h
index c83c24897c95..51c18dde0a80 100644
--- a/drivers/bluetooth/btmtk.h
+++ b/drivers/bluetooth/btmtk.h
@@ -66,6 +66,12 @@ enum {
BTMTK_WMT_ON_PROGRESS,
};
+enum {
+ BTMTK_WMT_PKT_START = 1,
+ BTMTK_WMT_PKT_CONTINUE = 2,
+ BTMTK_WMT_PKT_END = 3,
+};
+
struct btmtk_wmt_hdr {
u8 dir;
u8 op;
--
2.45.2
^ permalink raw reply related [flat|nested] 20+ messages in thread* RE: Bluetooth: btmtk: Add MT7928 support
2026-06-30 12:35 [PATCH v6 1/3] Bluetooth: btmtk: Replace magic numbers with WMT packet flag enum Chris Lu
@ 2026-06-30 13:56 ` bluez.test.bot
0 siblings, 0 replies; 20+ messages in thread
From: bluez.test.bot @ 2026-06-30 13:56 UTC (permalink / raw)
To: linux-bluetooth, chris.lu
[-- Attachment #1: Type: text/plain, Size: 2650 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1118999
---Test result---
Test Summary:
CheckPatch PASS 4.49 seconds
VerifyFixes PASS 0.31 seconds
VerifySignedoff PASS 0.29 seconds
GitLint FAIL 1.96 seconds
SubjectPrefix PASS 1.13 seconds
BuildKernel PASS 26.92 seconds
CheckAllWarning PASS 29.67 seconds
CheckSparse PASS 28.65 seconds
BuildKernel32 PASS 26.32 seconds
CheckKernelLLVM SKIP 0.00 seconds
TestRunnerSetup PASS 489.46 seconds
IncrementalBuild PASS 31.29 seconds
Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[v6,2/3] Bluetooth: btmtk: Improve BT firmware logging
11: B1 Line exceeds max length (92>80): "[ 212.878783] Bluetooth: hci1: Loading BT firmware: mediatek/BT_RAM_CODE_MT7922_1_1_hdr.bin"
12: B1 Line exceeds max length (93>80): "[ 212.889614] Bluetooth: hci1: BT HW ver: 0x7922, SW ver: 0x008a, Build Time: 20260224103448"
14: B1 Line exceeds max length (115>80): "[ 216.048890] Bluetooth: hci1: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported."
[v6,3/3] Bluetooth: btmtk: Add MT7928 support
24: B1 Line exceeds max length (92>80): "[ 159.784050] usb 1-3: New USB device found, idVendor=0e8d, idProduct=7935, bcdDevice= 1.00"
29: B1 Line exceeds max length (97>80): "[ 159.795736] Bluetooth: hci1: Loading CBMCU firmware: mediatek/mt7928/CBMCU_CODE_MT7935_1_1.bin"
30: B1 Line exceeds max length (102>80): "[ 159.807197] Bluetooth: hci1: CBMCU HW ver: 0x7935, SW ver: 0x0000, Build Time: 20260601T161751+0800"
32: B1 Line exceeds max length (99>80): "[ 160.143013] Bluetooth: hci1: Loading BT firmware: mediatek/mt7928/BT_RAM_CODE_MT7935_1_1_hdr.bin"
33: B1 Line exceeds max length (93>80): "[ 160.152775] Bluetooth: hci1: BT HW ver: 0x7935, SW ver: 0x0000, Build Time: 20260527000816"
35: B1 Line exceeds max length (115>80): "[ 163.242280] Bluetooth: hci1: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported."
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found
https://github.com/bluez/bluetooth-next/pull/376
---
Regards,
Linux Bluetooth
^ permalink raw reply [flat|nested] 20+ messages in thread
* [PATCH v5 1/3] Bluetooth: btmtk: Replace magic numbers with WMT packet flag enum
@ 2026-06-24 7:55 Chris Lu
2026-06-24 9:14 ` Bluetooth: btmtk: Add MT7928 support bluez.test.bot
0 siblings, 1 reply; 20+ messages in thread
From: Chris Lu @ 2026-06-24 7:55 UTC (permalink / raw)
To: Marcel Holtmann, Johan Hedberg, Luiz Von Dentz
Cc: Sean Wang, Will Lee, SS Wu, Steve Lee, linux-bluetooth,
linux-kernel, linux-mediatek, Chris Lu, Paul Menzel
Add BTMTK_WMT_PKT_* enum to represent WMT download packet sequence flags,
improving code readability. Replace magic numbers (1, 2, 3) in
btmtk_setup_firmware_79xx() with descriptive enum values:
- BTMTK_WMT_PKT_START (1): First packet of a sequence
- BTMTK_WMT_PKT_CONTINUE (2): Continuation packet
- BTMTK_WMT_PKT_END (3): Final packet of a sequence
Signed-off-by: Chris Lu <chris.lu@mediatek.com>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
---
drivers/bluetooth/btmtk.c | 6 +++---
drivers/bluetooth/btmtk.h | 6 ++++++
2 files changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c
index 02a96342e964..21c08ee1cdbf 100644
--- a/drivers/bluetooth/btmtk.c
+++ b/drivers/bluetooth/btmtk.c
@@ -230,12 +230,12 @@ int btmtk_setup_firmware_79xx(struct hci_dev *hdev, const char *fwname,
while (dl_size > 0) {
dlen = min_t(int, 250, dl_size);
if (first_block == 1) {
- flag = 1;
+ flag = BTMTK_WMT_PKT_START;
first_block = 0;
} else if (dl_size - dlen <= 0) {
- flag = 3;
+ flag = BTMTK_WMT_PKT_END;
} else {
- flag = 2;
+ flag = BTMTK_WMT_PKT_CONTINUE;
}
wmt_params.flag = flag;
diff --git a/drivers/bluetooth/btmtk.h b/drivers/bluetooth/btmtk.h
index c83c24897c95..51c18dde0a80 100644
--- a/drivers/bluetooth/btmtk.h
+++ b/drivers/bluetooth/btmtk.h
@@ -66,6 +66,12 @@ enum {
BTMTK_WMT_ON_PROGRESS,
};
+enum {
+ BTMTK_WMT_PKT_START = 1,
+ BTMTK_WMT_PKT_CONTINUE = 2,
+ BTMTK_WMT_PKT_END = 3,
+};
+
struct btmtk_wmt_hdr {
u8 dir;
u8 op;
--
2.45.2
^ permalink raw reply related [flat|nested] 20+ messages in thread* RE: Bluetooth: btmtk: Add MT7928 support
2026-06-24 7:55 [PATCH v5 1/3] Bluetooth: btmtk: Replace magic numbers with WMT packet flag enum Chris Lu
@ 2026-06-24 9:14 ` bluez.test.bot
0 siblings, 0 replies; 20+ messages in thread
From: bluez.test.bot @ 2026-06-24 9:14 UTC (permalink / raw)
To: linux-bluetooth, chris.lu
[-- Attachment #1: Type: text/plain, Size: 2650 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1115762
---Test result---
Test Summary:
CheckPatch PASS 4.09 seconds
VerifyFixes PASS 0.52 seconds
VerifySignedoff PASS 0.60 seconds
GitLint FAIL 1.96 seconds
SubjectPrefix PASS 0.69 seconds
BuildKernel PASS 26.78 seconds
CheckAllWarning PASS 29.55 seconds
CheckSparse PASS 28.50 seconds
BuildKernel32 PASS 25.87 seconds
CheckKernelLLVM SKIP 0.00 seconds
TestRunnerSetup PASS 568.81 seconds
IncrementalBuild PASS 31.08 seconds
Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[v5,2/3] Bluetooth: btmtk: Improve BT firmware logging
11: B1 Line exceeds max length (92>80): "[ 212.878783] Bluetooth: hci1: Loading BT firmware: mediatek/BT_RAM_CODE_MT7922_1_1_hdr.bin"
12: B1 Line exceeds max length (93>80): "[ 212.889614] Bluetooth: hci1: BT HW ver: 0x7922, SW ver: 0x008a, Build Time: 20260224103448"
14: B1 Line exceeds max length (115>80): "[ 216.048890] Bluetooth: hci1: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported."
[v5,3/3] Bluetooth: btmtk: Add MT7928 support
24: B1 Line exceeds max length (92>80): "[ 159.784050] usb 1-3: New USB device found, idVendor=0e8d, idProduct=7935, bcdDevice= 1.00"
29: B1 Line exceeds max length (97>80): "[ 159.795736] Bluetooth: hci1: Loading CBMCU firmware: mediatek/mt7928/CBMCU_CODE_MT7935_1_1.bin"
30: B1 Line exceeds max length (102>80): "[ 159.807197] Bluetooth: hci1: CBMCU HW ver: 0x7935, SW ver: 0x0000, Build Time: 20260601T161751+0800"
32: B1 Line exceeds max length (99>80): "[ 160.143013] Bluetooth: hci1: Loading BT firmware: mediatek/mt7928/BT_RAM_CODE_MT7935_1_1_hdr.bin"
33: B1 Line exceeds max length (93>80): "[ 160.152775] Bluetooth: hci1: BT HW ver: 0x7935, SW ver: 0x0000, Build Time: 20260527000816"
35: B1 Line exceeds max length (115>80): "[ 163.242280] Bluetooth: hci1: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported."
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found
https://github.com/bluez/bluetooth-next/pull/344
---
Regards,
Linux Bluetooth
^ permalink raw reply [flat|nested] 20+ messages in thread
* [PATCH v4 1/2] Bluetooth: btmtk: Replace magic numbers with WMT packet flag enum
@ 2026-06-23 3:41 Chris Lu
2026-06-23 6:23 ` Bluetooth: btmtk: Add MT7928 support bluez.test.bot
0 siblings, 1 reply; 20+ messages in thread
From: Chris Lu @ 2026-06-23 3:41 UTC (permalink / raw)
To: Marcel Holtmann, Johan Hedberg, Luiz Von Dentz
Cc: Sean Wang, Will Lee, SS Wu, Steve Lee, linux-bluetooth,
linux-kernel, linux-mediatek, Chris Lu
Add BTMTK_WMT_PKT_* enum to represent WMT download packet sequence flags,
improving code readability. Replace magic numbers (1, 2, 3) in
btmtk_setup_firmware_79xx() with descriptive enum values:
- BTMTK_WMT_PKT_START (1): First packet of a sequence
- BTMTK_WMT_PKT_CONTINUE (2): Continuation packet
- BTMTK_WMT_PKT_END (3): Final packet of a sequence
Signed-off-by: Chris Lu <chris.lu@mediatek.com>
---
drivers/bluetooth/btmtk.c | 6 +++---
drivers/bluetooth/btmtk.h | 6 ++++++
2 files changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c
index 02a96342e964..21c08ee1cdbf 100644
--- a/drivers/bluetooth/btmtk.c
+++ b/drivers/bluetooth/btmtk.c
@@ -230,12 +230,12 @@ int btmtk_setup_firmware_79xx(struct hci_dev *hdev, const char *fwname,
while (dl_size > 0) {
dlen = min_t(int, 250, dl_size);
if (first_block == 1) {
- flag = 1;
+ flag = BTMTK_WMT_PKT_START;
first_block = 0;
} else if (dl_size - dlen <= 0) {
- flag = 3;
+ flag = BTMTK_WMT_PKT_END;
} else {
- flag = 2;
+ flag = BTMTK_WMT_PKT_CONTINUE;
}
wmt_params.flag = flag;
diff --git a/drivers/bluetooth/btmtk.h b/drivers/bluetooth/btmtk.h
index c83c24897c95..51c18dde0a80 100644
--- a/drivers/bluetooth/btmtk.h
+++ b/drivers/bluetooth/btmtk.h
@@ -66,6 +66,12 @@ enum {
BTMTK_WMT_ON_PROGRESS,
};
+enum {
+ BTMTK_WMT_PKT_START = 1,
+ BTMTK_WMT_PKT_CONTINUE = 2,
+ BTMTK_WMT_PKT_END = 3,
+};
+
struct btmtk_wmt_hdr {
u8 dir;
u8 op;
--
2.45.2
^ permalink raw reply related [flat|nested] 20+ messages in thread* RE: Bluetooth: btmtk: Add MT7928 support
2026-06-23 3:41 [PATCH v4 1/2] Bluetooth: btmtk: Replace magic numbers with WMT packet flag enum Chris Lu
@ 2026-06-23 6:23 ` bluez.test.bot
0 siblings, 0 replies; 20+ messages in thread
From: bluez.test.bot @ 2026-06-23 6:23 UTC (permalink / raw)
To: linux-bluetooth, chris.lu
[-- Attachment #1: Type: text/plain, Size: 1862 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1115050
---Test result---
Test Summary:
CheckPatch PASS 3.11 seconds
VerifyFixes PASS 0.26 seconds
VerifySignedoff PASS 0.24 seconds
GitLint FAIL 1.33 seconds
SubjectPrefix PASS 0.44 seconds
BuildKernel PASS 25.14 seconds
CheckAllWarning PASS 27.49 seconds
CheckSparse PASS 26.91 seconds
BuildKernel32 PASS 24.72 seconds
CheckKernelLLVM SKIP 0.00 seconds
TestRunnerSetup PASS 530.49 seconds
IncrementalBuild PASS 27.44 seconds
Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[v4,2/2] Bluetooth: btmtk: Add MT7928 support
24: B1 Line exceeds max length (92>80): "[ 475.742336] usb 1-3: New USB device found, idVendor=0e8d, idProduct=7935, bcdDevice= 1.00"
29: B1 Line exceeds max length (91>80): "[ 475.766697] Bluetooth: hci1: CBMCU Version: 0x00000000, Build Time: 20260601T161751+0800"
31: B1 Line exceeds max length (85>80): "[ 476.190083] Bluetooth: hci1: HW/SW Version: 0x00000000, Build Time: 20260527000816"
33: B1 Line exceeds max length (115>80): "[ 479.073489] Bluetooth: hci1: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported."
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found
https://github.com/bluez/bluetooth-next/pull/338
---
Regards,
Linux Bluetooth
^ permalink raw reply [flat|nested] 20+ messages in thread
end of thread, other threads:[~2026-07-17 10:44 UTC | newest]
Thread overview: 20+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-16 11:23 [PATCH v13 0/7] Bluetooth: btmtk: Add MT7928 support Chris Lu
2026-07-16 11:23 ` [PATCH v13 1/7] Bluetooth: btmtksdio: Fix SKB handling issues in TX path Chris Lu
2026-07-16 12:02 ` Bluetooth: btmtk: Add MT7928 support bluez.test.bot
2026-07-16 11:23 ` [PATCH v13 2/7] Bluetooth: btmtk: Add firmware size validation in btmtk_setup_firmware_79xx() Chris Lu
2026-07-16 11:23 ` [PATCH v13 3/7] Bluetooth: btmtksdio: Pass hardware dev_id to mt79xx_setup() Chris Lu
2026-07-16 11:23 ` [PATCH v13 4/7] Bluetooth: btmtksdio: Remove redundant firmware filename override Chris Lu
2026-07-16 11:23 ` [PATCH v13 5/7] Bluetooth: btmtk: Improve BT firmware logging Chris Lu
2026-07-16 11:23 ` [PATCH v13 6/7] Bluetooth: btmtk: Replace magic numbers with WMT packet flag enum Chris Lu
2026-07-16 11:23 ` [PATCH v13 7/7] Bluetooth: btmtk: Add MT7928 support Chris Lu
-- strict thread matches above, loose matches on Subject: below --
2026-07-17 8:39 [PATCH v16 1/7] Bluetooth: btmtksdio: Fix SKB handling issues in TX path Chris Lu
2026-07-17 10:44 ` Bluetooth: btmtk: Add MT7928 support bluez.test.bot
2026-07-17 7:42 [PATCH v15 1/7] Bluetooth: btmtksdio: Fix SKB handling issues in TX path Chris Lu
2026-07-17 8:52 ` Bluetooth: btmtk: Add MT7928 support bluez.test.bot
2026-07-16 1:59 [PATCH v12 1/7] Bluetooth: btmtksdio: Fix DMA out-of-bounds access in TX path Chris Lu
2026-07-16 4:01 ` Bluetooth: btmtk: Add MT7928 support bluez.test.bot
2026-07-15 11:20 [PATCH v11 1/7] Bluetooth: btmtksdio: Fix DMA out-of-bounds access in TX path Chris Lu
2026-07-15 12:19 ` Bluetooth: btmtk: Add MT7928 support bluez.test.bot
2026-07-14 12:33 [PATCH v10 1/7] Bluetooth: btmtksdio: Fix DMA out-of-bounds access in TX path Chris Lu
2026-07-14 14:48 ` Bluetooth: btmtk: Add MT7928 support bluez.test.bot
2026-07-02 10:14 [PATCH v9 1/6] Bluetooth: btmtk: Add firmware size validation in btmtk_setup_firmware_79xx() Chris Lu
2026-07-02 10:51 ` Bluetooth: btmtk: Add MT7928 support bluez.test.bot
2026-07-02 7:28 [PATCH v8 1/5] Bluetooth: btmtk: Add firmware size validation in btmtk_setup_firmware_79xx() Chris Lu
2026-07-02 8:21 ` Bluetooth: btmtk: Add MT7928 support bluez.test.bot
2026-07-01 12:13 [PATCH v7 1/3] Bluetooth: btmtk: Replace magic numbers with WMT packet flag enum Chris Lu
2026-07-01 14:24 ` Bluetooth: btmtk: Add MT7928 support bluez.test.bot
2026-06-30 12:35 [PATCH v6 1/3] Bluetooth: btmtk: Replace magic numbers with WMT packet flag enum Chris Lu
2026-06-30 13:56 ` Bluetooth: btmtk: Add MT7928 support bluez.test.bot
2026-06-24 7:55 [PATCH v5 1/3] Bluetooth: btmtk: Replace magic numbers with WMT packet flag enum Chris Lu
2026-06-24 9:14 ` Bluetooth: btmtk: Add MT7928 support bluez.test.bot
2026-06-23 3:41 [PATCH v4 1/2] Bluetooth: btmtk: Replace magic numbers with WMT packet flag enum Chris Lu
2026-06-23 6:23 ` Bluetooth: btmtk: Add MT7928 support bluez.test.bot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox