* [PATCH 1/2] Bluetooth: Add HCI_QUIRK_BROKEN_LL_PRIVACY
2026-10-27 16:43 [PATCH 0/2] Bluetooth: Disable LL Privacy on Intel JfP (8087:0aaa) Diego Francio
@ 2026-10-27 16:43 ` Diego Francio
2026-10-27 21:23 ` Bluetooth: Disable LL Privacy on Intel JfP (8087:0aaa) bluez.test.bot
2026-10-27 16:43 ` [PATCH 2/2] Bluetooth: btusb: " Diego Francio
1 sibling, 1 reply; 4+ messages in thread
From: Diego Francio @ 2026-10-27 16:43 UTC (permalink / raw)
To: luiz.dentz, marcel; +Cc: linux-bluetooth
Some controllers set the LL Privacy bit in their LE features but their
firmware misbehaves once the resolving list is actually programmed.
Add a quirk that makes ll_privacy_capable() return false for such
controllers, so that the resolving list and the related commands are
never used, mirroring what le_coded_capable() does for
HCI_QUIRK_BROKEN_LE_CODED.
No functional change for controllers that do not set the quirk.
Signed-off-by: Diego Francio <dfrancio@gmail.com>
---
include/net/bluetooth/hci.h | 10 ++++++++++
include/net/bluetooth/hci_core.h | 4 +++-
2 files changed, 13 insertions(+), 1 deletion(-)
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 1c992e8..3554abf 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -375,6 +375,16 @@ enum {
*/
HCI_QUIRK_BROKEN_READ_PAGE_SCAN_TYPE,
+ /* When this quirk is set, the controller is not treated as LL Privacy
+ * capable even though it claims to support it in its LE features, so
+ * the resolving list is never used. This is required for controllers
+ * whose firmware crashes (Hardware Error) when the resolving list is
+ * programmed.
+ *
+ * This quirk must be set before hci_register_dev is called.
+ */
+ HCI_QUIRK_BROKEN_LL_PRIVACY,
+
__HCI_NUM_QUIRKS,
};
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 9d5d3ab..48fcfb2 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -2066,7 +2066,9 @@ void hci_conn_del_sysfs(struct hci_conn *conn);
#define scan_coded(dev) (((dev)->le_tx_def_phys & HCI_LE_SET_PHY_CODED) || \
((dev)->le_rx_def_phys & HCI_LE_SET_PHY_CODED))
-#define ll_privacy_capable(dev) ((dev)->le_features[0] & HCI_LE_LL_PRIVACY)
+#define ll_privacy_capable(dev) (((dev)->le_features[0] & HCI_LE_LL_PRIVACY) && \
+ !hci_test_quirk((dev), \
+ HCI_QUIRK_BROKEN_LL_PRIVACY))
#define ll_privacy_enabled(dev) (le_enabled(dev) && ll_privacy_capable(dev))
#define privacy_mode_capable(dev) (ll_privacy_capable(dev) && \
--
2.53.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* [PATCH 2/2] Bluetooth: btusb: Disable LL Privacy on Intel JfP (8087:0aaa)
2026-10-27 16:43 [PATCH 0/2] Bluetooth: Disable LL Privacy on Intel JfP (8087:0aaa) Diego Francio
2026-10-27 16:43 ` [PATCH 1/2] Bluetooth: Add HCI_QUIRK_BROKEN_LL_PRIVACY Diego Francio
@ 2026-10-27 16:43 ` Diego Francio
1 sibling, 0 replies; 4+ messages in thread
From: Diego Francio @ 2026-10-27 16:43 UTC (permalink / raw)
To: luiz.dentz, marcel; +Cc: linux-bluetooth
The Intel Jefferson Peak controller (Wireless-AC 9460/9462/9560,
USB 8087:0aaa) reports LL Privacy support, but since commit
e209e5ccc5ac ("Bluetooth: MGMT: Mark LL Privacy as stable") the kernel
uses it whenever the controller claims it. With BLE HID devices paired
(Logitech ERGO K860 and MX Vertical), the controller firmware then
crashes every few minutes:
Bluetooth: hci0: Hardware error 0x0c
Bluetooth: hci0: Exception info ...
The reset drops every connection, so keyboard and mouse stall and
reconnect over and over. Older firmware builds (2022.50 build 97 and a
2022.22 build) behave the same, so this is not a firmware version
regression.
Tested on an Intel 9462 (CNVi, Alder Lake PCH) laptop running mainline
builds: 6.1.190 and 6.12.70 are fine, while 6.17.12 and 7.0 crash every
3-15 minutes. With LL Privacy forced off in hci_sync.c on top of
Ubuntu 7.0.0-38, the same hardware and devices ran for 9 hours without
a single Hardware Error. With this patch applied on the same kernel, the
controller then ran for more than 4 hours with the keyboard and mouse
connected and no Hardware Error. The exact HCI command that crashes the
firmware was not identified.
Set HCI_QUIRK_BROKEN_LL_PRIVACY for this USB ID so the resolving list is
not used on it.
Fixes: e209e5ccc5ac ("Bluetooth: MGMT: Mark LL Privacy as stable")
Cc: stable@vger.kernel.org # 6.14+
Signed-off-by: Diego Francio <dfrancio@gmail.com>
---
drivers/bluetooth/btusb_main.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/bluetooth/btusb_main.c b/drivers/bluetooth/btusb_main.c
index 92a78a7..6a75341 100644
--- a/drivers/bluetooth/btusb_main.c
+++ b/drivers/bluetooth/btusb_main.c
@@ -70,6 +70,7 @@ static struct usb_driver btusb_driver;
#define BTUSB_INTEL_NO_WBS_SUPPORT BIT(26)
#define BTUSB_ACTIONS_SEMI BIT(27)
#define BTUSB_BARROT BIT(28)
+#define BTUSB_BROKEN_LL_PRIVACY BIT(29)
#define BTUSB_QUALCOMM BIT(30)
static const struct usb_device_id btusb_table[] = {
@@ -529,7 +530,8 @@ static const struct usb_device_id quirks_table[] = {
{ USB_DEVICE(0x8087, 0x0a2b), .driver_info = BTUSB_INTEL_COMBINED },
{ USB_DEVICE(0x8087, 0x0aa7), .driver_info = BTUSB_INTEL_COMBINED |
BTUSB_INTEL_BROKEN_SHUTDOWN_LED },
- { USB_DEVICE(0x8087, 0x0aaa), .driver_info = BTUSB_INTEL_COMBINED },
+ { USB_DEVICE(0x8087, 0x0aaa), .driver_info = BTUSB_INTEL_COMBINED |
+ BTUSB_BROKEN_LL_PRIVACY },
/* Other Intel Bluetooth devices */
{ USB_VENDOR_AND_INTERFACE_INFO(0x8087, 0xe0, 0x01, 0x01),
@@ -4608,6 +4610,9 @@ static int btusb_probe(struct usb_interface *intf,
btintel_set_flag(hdev, INTEL_BROKEN_SHUTDOWN_LED);
}
+ if (id->driver_info & BTUSB_BROKEN_LL_PRIVACY)
+ hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LL_PRIVACY);
+
if (id->driver_info & BTUSB_MARVELL)
hdev->set_bdaddr = btusb_set_bdaddr_marvell;
--
2.53.0
^ permalink raw reply related [flat|nested] 4+ messages in thread