linux-next: manual merge of the bluetooth tree with the net tree

linux-next: manual merge of the bluetooth tree with the net tree

[Mark Brown]

Hi all,

Today's linux-next merge of the bluetooth tree got conflicts in:

  net/bluetooth/hci_sysfs.c
  net/bluetooth/hci_core.c
  include/net/bluetooth/hci_core.h

between commit:

  e04480920d1e ("Bluetooth: defer cleanup of resources in hci_unregister_dev()")

from the net tree and commit:

  58ce6d5b271a ("Bluetooth: defer cleanup of resources in hci_unregister_dev()")

from the bluetooth tree.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

diff --cc include/net/bluetooth/hci_core.h
index db4312e44d47,a7d06d7da602..000000000000
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
diff --cc net/bluetooth/hci_core.c
index e1a545c8a69f,cb2e9e513907..000000000000
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
diff --cc net/bluetooth/hci_sysfs.c
index b69d88b88d2e,ebf282d1eb2b..000000000000
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c

linux-next: manual merge of the bluetooth tree with the net tree

[broonie]

Hi all,

Today's linux-next merge of the bluetooth tree got a conflict in:

  net/bluetooth/mgmt.c

between commit:

  23b72814da1a0 ("Bluetooth: MGMT: Fix Get Device Flags")

from the net tree and commit:

  529d4492aed7c ("Bluetooth: MGMT: Fix Get Device Flags")

from the bluetooth tree.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

diff --cc net/bluetooth/mgmt.c
index 72e6595a71cc0,a92e7e485feba..0000000000000
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c

linux-next: manual merge of the bluetooth tree with the net tree

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 833 bytes --]

Hi all,

Today's linux-next merge of the bluetooth tree got a conflict in:

  net/bluetooth/hci_core.c

between commit:

  f1a8f402f13f ("Bluetooth: L2CAP: Fix deadlock")

from the net tree and commits:

  6851d11d389c ("Bluetooth: Fix double free in hci_req_sync_complete")
  7b256038ca7c ("Bluetooth: Fix usage of __hci_cmd_sync_status")

from the bluetooth tree.

I fixed it up (I basically used the latter where they conflicted) and
can carry the fix as necessary. This is now fixed as far as linux-next
is concerned, but any non trivial conflicts should be mentioned to your
upstream maintainer when your tree is submitted for merging.  You may
also want to consider cooperating with the maintainer of the
conflicting tree to minimise any particularly complex conflicts.

-- 
Cheers,
Stephen Rothwell

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

linux-next: manual merge of the bluetooth tree with the net tree

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 1180 bytes --]

Hi all,

Today's linux-next merge of the bluetooth tree got conflicts in:

  net/bluetooth/mgmt.c
  net/bluetooth/mgmt_util.c
  net/bluetooth/mgmt_util.h

between commit:

  302a1f674c00d ("Bluetooth: MGMT: Fix possible UAFs")

from the net tree and commit:

  3b3eb857d5ab6 ("Bluetooth: MGMT: Fix possible UAFs")

from the bluetooth tree.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

diff --cc net/bluetooth/mgmt.c
index 225140fcb3d6c,ee7068fb9fb59..0000000000000
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
diff --cc net/bluetooth/mgmt_util.c
index aa7b5585cb268,258c22d38809a..0000000000000
--- a/net/bluetooth/mgmt_util.c
+++ b/net/bluetooth/mgmt_util.c
diff --cc net/bluetooth/mgmt_util.h
index bcba8c9d89528,e94738d992900..0000000000000
--- a/net/bluetooth/mgmt_util.h
+++ b/net/bluetooth/mgmt_util.h

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

linux-next: manual merge of the bluetooth tree with the net tree

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 7535 bytes --]

Hi all,

Today's linux-next merge of the bluetooth tree got a conflict in:

  drivers/bluetooth/hci_qca.c

between commit:

  5c4e9a8b18457 ("Bluetooth: hci_qca: Cleanup on all setup failures")

from the net tree and commits:

  facc2350b0df6 ("Bluetooth: hci_qca: Cleanup on all setup failures")
  88b5c728a785c ("Bluetooth: hci_qca: Fix confusing shutdown() and power_off() naming")

from the bluetooth tree.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

diff --combined drivers/bluetooth/hci_qca.c
index bb9f002aa85e9,6928820380b80..0000000000000
--- a/drivers/bluetooth/hci_qca.c
+++ b/drivers/bluetooth/hci_qca.c
@@@ -236,8 -236,7 +236,7 @@@ struct qca_serdev 
  
  static int qca_regulator_enable(struct qca_serdev *qcadev);
  static void qca_regulator_disable(struct qca_serdev *qcadev);
- static void qca_power_shutdown(struct hci_uart *hu);
- static int qca_power_off(struct hci_dev *hdev);
+ static void qca_power_off(struct hci_uart *hu);
  static void qca_controller_memdump(struct work_struct *work);
  static void qca_dmp_hdr(struct hci_dev *hdev, struct sk_buff *skb);
  
@@@ -585,7 -584,7 +584,7 @@@ static int qca_open(struct hci_uart *hu
  	if (!hci_uart_has_flow_control(hu))
  		return -EOPNOTSUPP;
  
 -	qca = kzalloc(sizeof(*qca), GFP_KERNEL);
 +	qca = kzalloc_obj(*qca);
  	if (!qca)
  		return -ENOMEM;
  
@@@ -723,6 -722,10 +722,10 @@@ static int qca_close(struct hci_uart *h
  
  	BT_DBG("hu %p qca close", hu);
  
+ 	/* BT core skips qca_hci_shutdown() which calls qca_power_off() on rmmod */
+ 	if (!test_bit(QCA_BT_OFF, &qca->flags))
+ 		qca_power_off(hu);
+ 
  	serial_clock_vote(HCI_IBS_VOTE_STATS_UPDATE, hu);
  
  	skb_queue_purge(&qca->tx_wait_q);
@@@ -1057,7 -1060,7 +1060,7 @@@ static void qca_controller_memdump(stru
  		}
  
  		if (!qca_memdump) {
 -			qca_memdump = kzalloc(sizeof(*qca_memdump), GFP_ATOMIC);
 +			qca_memdump = kzalloc_obj(*qca_memdump, GFP_ATOMIC);
  			if (!qca_memdump) {
  				mutex_unlock(&qca->hci_memdump_lock);
  				return;
@@@ -1850,6 -1853,7 +1853,7 @@@ static int qca_power_on(struct hci_dev 
  		return 0;
  
  	switch (soc_type) {
+ 	case QCA_QCA6390:
  	case QCA_WCN3950:
  	case QCA_WCN3988:
  	case QCA_WCN3990:
@@@ -1858,7 -1862,6 +1862,6 @@@
  	case QCA_WCN6750:
  	case QCA_WCN6855:
  	case QCA_WCN7850:
- 	case QCA_QCA6390:
  		ret = qca_regulator_init(hu);
  		break;
  
@@@ -2047,7 -2050,7 +2050,7 @@@ retry
  
  out:
  	if (ret) {
- 		qca_power_shutdown(hu);
+ 		qca_power_off(hu);
  
  		if (retries < MAX_INIT_RETRIES) {
  			bt_dev_warn(hdev, "Retry BT power ON:%d", retries);
@@@ -2096,6 -2099,18 +2099,18 @@@ static const struct hci_uart_proto qca_
  	.dequeue	= qca_dequeue,
  };
  
+ static const struct qca_device_data qca_soc_data_qca2066 __maybe_unused = {
+ 	.soc_type = QCA_QCA2066,
+ 	.num_vregs = 0,
+ 	.capabilities = QCA_CAP_WIDEBAND_SPEECH | QCA_CAP_VALID_LE_STATES |
+ 			QCA_CAP_HFP_HW_OFFLOAD,
+ };
+ 
+ static const struct qca_device_data qca_soc_data_qca6390 __maybe_unused = {
+ 	.soc_type = QCA_QCA6390,
+ 	.num_vregs = 0,
+ };
+ 
  static const struct qca_device_data qca_soc_data_wcn3950 __maybe_unused = {
  	.soc_type = QCA_WCN3950,
  	.vregs = (struct qca_vreg []) {
@@@ -2152,18 -2167,6 +2167,6 @@@ static const struct qca_device_data qca
  	.num_vregs = 4,
  };
  
- static const struct qca_device_data qca_soc_data_qca2066 __maybe_unused = {
- 	.soc_type = QCA_QCA2066,
- 	.num_vregs = 0,
- 	.capabilities = QCA_CAP_WIDEBAND_SPEECH | QCA_CAP_VALID_LE_STATES |
- 			QCA_CAP_HFP_HW_OFFLOAD,
- };
- 
- static const struct qca_device_data qca_soc_data_qca6390 __maybe_unused = {
- 	.soc_type = QCA_QCA6390,
- 	.num_vregs = 0,
- };
- 
  static const struct qca_device_data qca_soc_data_wcn6750 __maybe_unused = {
  	.soc_type = QCA_WCN6750,
  	.vregs = (struct qca_vreg []) {
@@@ -2211,7 -2214,7 +2214,7 @@@ static const struct qca_device_data qca
  			QCA_CAP_HFP_HW_OFFLOAD,
  };
  
- static void qca_power_shutdown(struct hci_uart *hu)
+ static void qca_power_off(struct hci_uart *hu)
  {
  	struct qca_serdev *qcadev;
  	struct qca_data *qca = hu->priv;
@@@ -2261,7 -2264,7 +2264,7 @@@
  		qca_regulator_disable(qcadev);
  		if (qcadev->sw_ctrl) {
  			sw_ctrl_state = gpiod_get_value_cansleep(qcadev->sw_ctrl);
- 			bt_dev_dbg(hu->hdev, "SW_CTRL is %d", sw_ctrl_state);
+ 			BT_DBG("SW_CTRL is %d", sw_ctrl_state);
  		}
  		break;
  
@@@ -2272,7 -2275,7 +2275,7 @@@
  	set_bit(QCA_BT_OFF, &qca->flags);
  }
  
- static int qca_power_off(struct hci_dev *hdev)
+ static int qca_hci_shutdown(struct hci_dev *hdev)
  {
  	struct hci_uart *hu = hci_get_drvdata(hdev);
  	struct qca_data *qca = hu->priv;
@@@ -2291,7 -2294,7 +2294,7 @@@
  		usleep_range(8000, 10000);
  	}
  
- 	qca_power_shutdown(hu);
+ 	qca_power_off(hu);
  	return 0;
  }
  
@@@ -2402,6 -2405,7 +2405,7 @@@ static int qca_serdev_probe(struct serd
  		qcadev->btsoc_type = QCA_ROME;
  
  	switch (qcadev->btsoc_type) {
+ 	case QCA_QCA6390:
  	case QCA_WCN3950:
  	case QCA_WCN3988:
  	case QCA_WCN3990:
@@@ -2410,7 -2414,6 +2414,6 @@@
  	case QCA_WCN6750:
  	case QCA_WCN6855:
  	case QCA_WCN7850:
- 	case QCA_QCA6390:
  		qcadev->bt_power = devm_kzalloc(&serdev->dev,
  						sizeof(struct qca_power),
  						GFP_KERNEL);
@@@ -2422,9 -2425,9 +2425,9 @@@
  	}
  
  	switch (qcadev->btsoc_type) {
+ 	case QCA_WCN6750:
  	case QCA_WCN6855:
  	case QCA_WCN7850:
- 	case QCA_WCN6750:
  		if (!device_property_present(&serdev->dev, "enable-gpios")) {
  			/*
  			 * Backward compatibility with old DT sources. If the
@@@ -2530,7 -2533,7 +2533,7 @@@
  
  	if (power_ctrl_enabled) {
  		hci_set_quirk(hdev, HCI_QUIRK_NON_PERSISTENT_SETUP);
- 		hdev->shutdown = qca_power_off;
+ 		hdev->shutdown = qca_hci_shutdown;
  	}
  
  	if (data) {
@@@ -2565,7 -2568,7 +2568,7 @@@ static void qca_serdev_remove(struct se
  	case QCA_WCN6855:
  	case QCA_WCN7850:
  		if (power->vregs_on)
- 			qca_power_shutdown(&qcadev->serdev_hu);
+ 			qca_power_off(&qcadev->serdev_hu);
  		break;
  	default:
  		break;
@@@ -2574,10 -2577,11 +2577,10 @@@
  	hci_uart_unregister_device(&qcadev->serdev_hu);
  }
  
 -static void qca_serdev_shutdown(struct device *dev)
 +static void qca_serdev_shutdown(struct serdev_device *serdev)
  {
  	int ret;
  	int timeout = msecs_to_jiffies(CMD_TRANS_TIMEOUT_MS);
 -	struct serdev_device *serdev = to_serdev_device(dev);
  	struct qca_serdev *qcadev = serdev_device_get_drvdata(serdev);
  	struct hci_uart *hu = &qcadev->serdev_hu;
  	struct hci_dev *hdev = hu->hdev;
@@@ -2799,11 -2803,11 +2802,11 @@@ static void hciqca_coredump(struct devi
  static struct serdev_device_driver qca_serdev_driver = {
  	.probe = qca_serdev_probe,
  	.remove = qca_serdev_remove,
 +	.shutdown = qca_serdev_shutdown,
  	.driver = {
  		.name = "hci_uart_qca",
  		.of_match_table = of_match_ptr(qca_bluetooth_of_match),
  		.acpi_match_table = ACPI_PTR(qca_bluetooth_acpi_match),
 -		.shutdown = qca_serdev_shutdown,
  		.pm = &qca_pm_ops,
  #ifdef CONFIG_DEV_COREDUMP
  		.coredump = hciqca_coredump,

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

linux-next: manual merge of the bluetooth tree with the net tree

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 2004 bytes --]

Hi all,

Today's linux-next merge of the bluetooth tree got a conflict in:

  net/bluetooth/l2cap_core.c

between commit:

  e1d9a66889867 ("Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU")

from the net tree and commits:

  b65e87418bb37 ("Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU")
  cb75c9a0505b8 ("Bluetooth: L2CAP: CoC: Disconnect if received packet size exceeds MPS")

from the bluetooth tree.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

I note that the bluetooth tree does not seem to have merged up v7.0-rcX
at all.

diff --combined net/bluetooth/l2cap_core.c
index 5deb6c4f1e41d,475fdf1908cb8..0000000000000
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@@ -442,7 -442,7 +442,7 @@@ struct l2cap_chan *l2cap_chan_create(vo
  {
  	struct l2cap_chan *chan;
  
 -	chan = kzalloc(sizeof(*chan), GFP_ATOMIC);
 +	chan = kzalloc_obj(*chan, GFP_ATOMIC);
  	if (!chan)
  		return NULL;
  
@@@ -6675,6 -6675,13 +6675,13 @@@ static int l2cap_ecred_data_rcv(struct 
  		return -ENOBUFS;
  	}
  
+ 	if (skb->len > chan->mps) {
+ 		BT_ERR("Too big LE L2CAP MPS: len %u > %u", skb->len,
+ 		       chan->mps);
+ 		l2cap_send_disconn_req(chan, ECONNRESET);
+ 		return -ENOBUFS;
+ 	}
+ 
  	chan->rx_credits--;
  	BT_DBG("chan %p: rx_credits %u -> %u",
  	       chan, chan->rx_credits + 1, chan->rx_credits);
@@@ -6958,7 -6965,7 +6965,7 @@@ static struct l2cap_conn *l2cap_conn_ad
  	if (!hchan)
  		return NULL;
  
 -	conn = kzalloc(sizeof(*conn), GFP_KERNEL);
 +	conn = kzalloc_obj(*conn);
  	if (!conn) {
  		hci_chan_del(hchan);
  		return NULL;

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

linux-next: manual merge of the bluetooth tree with the net tree

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 2623 bytes --]

Hi all,

Today's linux-next merge of the bluetooth tree got a conflict in:

  net/bluetooth/l2cap_core.c

between commit:

  e1d9a66889867 ("Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU")

from the net tree and commits:

  fa768fce4aae7 ("Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU")
  ef20d3012d9e4 ("Bluetooth: L2CAP: CoC: Disconnect if received packet size exceeds MPS")
  013598897448b ("Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU")

from the bluetooth tree.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

diff --combined net/bluetooth/l2cap_core.c
index 5deb6c4f1e41d,ead51dc0f3f12..0000000000000
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@@ -5081,14 -5081,14 +5081,14 @@@ static inline int l2cap_ecred_conn_req(
  	cmd_len -= sizeof(*req);
  	num_scid = cmd_len / sizeof(u16);
  
- 	/* Always respond with the same number of scids as in the request */
- 	rsp_len = cmd_len;
- 
  	if (num_scid > L2CAP_ECRED_MAX_CID) {
  		result = L2CAP_CR_LE_INVALID_PARAMS;
  		goto response;
  	}
  
+ 	/* Always respond with the same number of scids as in the request */
+ 	rsp_len = cmd_len;
+ 
  	mtu  = __le16_to_cpu(req->mtu);
  	mps  = __le16_to_cpu(req->mps);
  
@@@ -6675,6 -6675,13 +6675,13 @@@ static int l2cap_ecred_data_rcv(struct 
  		return -ENOBUFS;
  	}
  
+ 	if (skb->len > chan->mps) {
+ 		BT_ERR("Too big LE L2CAP MPS: len %u > %u", skb->len,
+ 		       chan->mps);
+ 		l2cap_send_disconn_req(chan, ECONNRESET);
+ 		return -ENOBUFS;
+ 	}
+ 
  	chan->rx_credits--;
  	BT_DBG("chan %p: rx_credits %u -> %u",
  	       chan, chan->rx_credits + 1, chan->rx_credits);
@@@ -6690,6 -6697,11 +6697,11 @@@
  	if (!chan->sdu) {
  		u16 sdu_len;
  
+ 		if (!pskb_may_pull(skb, L2CAP_SDULEN_SIZE)) {
+ 			err = -EINVAL;
+ 			goto failed;
+ 		}
+ 
  		sdu_len = get_unaligned_le16(skb->data);
  		skb_pull(skb, L2CAP_SDULEN_SIZE);
  
@@@ -6698,7 -6710,7 +6710,7 @@@
  
  		if (sdu_len > chan->imtu) {
  			BT_ERR("Too big LE L2CAP SDU length: len %u > %u",
- 			       skb->len, sdu_len);
+ 			       sdu_len, chan->imtu);
  			l2cap_send_disconn_req(chan, ECONNRESET);
  			err = -EMSGSIZE;
  			goto failed;

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

linux-next: manual merge of the bluetooth tree with the net tree

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 1585 bytes --]

Hi all,

Today's linux-next merge of the bluetooth tree got a conflict in:

  net/bluetooth/mgmt.c

between commits:

  d3f7d17960ed5 ("Bluetooth: MGMT: validate Add Extended Advertising Data length")
  de23fb62259aa ("Bluetooth: MGMT: validate advertising TLV before type checks")
  149324fc762c2 ("Bluetooth: MGMT: Fix backward compatibility with userspace")

from the net tree and commits:

  8f5b6b4b198ed ("Bluetooth: MGMT: validate Add Extended Advertising Data length")
  899a200a76486 ("Bluetooth: MGMT: validate advertising TLV before type checks")

from the bluetooth tree.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

diff --combined net/bluetooth/mgmt.c
index f4aa814a03975,027b266ccc747..0000000000000
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@@ -9114,9 -9114,8 +9114,9 @@@ static int add_ext_adv_data(struct soc
  
  	BT_DBG("%s", hdev->name);
  
 -	expected_len = struct_size(cp, data, cp->adv_data_len + cp->scan_rsp_len);
 -	if (expected_len != data_len)
 +	expected_len = struct_size(cp, data, cp->adv_data_len +
 +				   cp->scan_rsp_len);
 +	if (expected_len > data_len)
  		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
  				       MGMT_STATUS_INVALID_PARAMS);
  

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

linux-next: manual merge of the bluetooth tree with the net tree

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 12730 bytes --]

Hi all,

Today's linux-next merge of the bluetooth tree got a conflict in:

  drivers/bluetooth/btintel_pcie.c

between commit:

  9c36951474d8e ("Bluetooth: btintel_pcie: Refactor FLR to use device_reprobe()")

from the net tree and commit:

  603b91aeb20a2 ("Bluetooth: btintel_pcie: Refactor FLR to use device_reprobe()")

from the bluetooth tree.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

diff --combined drivers/bluetooth/btintel_pcie.c
index 2b7231be5973d,013568197a397..0000000000000
--- a/drivers/bluetooth/btintel_pcie.c
+++ b/drivers/bluetooth/btintel_pcie.c
@@@ -1446,72 -1446,134 +1446,134 @@@ exit_on_error
  	return err;
  }
  
+ /* Queue a coredump dump_traces() pass.
+  *
+  * Returns true if a new coredump was queued, false if one was already
+  * in-flight (the BTINTEL_PCIE_COREDUMP_INPROGRESS bit serves as the
+  * single-writer guard for the @coredump_work item) or the workqueue is
+  * disabled (reset / remove in progress).
+  *
+  * Always queue this AFTER any companion event-reader work (hwexp /
+  * fwtrigger) so that, on the ordered @dump_workqueue, the event reader
+  * runs first and populates dmp_hdr.event_type / event_id before
+  * dump_traces consumes them.
+  */
+ static bool btintel_pcie_queue_coredump(struct btintel_pcie_data *data,
+ 					u16 trigger_reason)
+ {
+ 	if (test_and_set_bit(BTINTEL_PCIE_COREDUMP_INPROGRESS, &data->flags))
+ 		return false;
+ 
+ 	data->dmp_hdr.trigger_reason = trigger_reason;
+ 
+ 	if (queue_work(data->dump_workqueue, &data->coredump_work))
+ 		return true;
+ 
+ 	/* Workqueue is disabled (reset/remove drained it). Release the
+ 	 * guard so a later trigger, after re-probe, can succeed.
+ 	 */
+ 	clear_bit(BTINTEL_PCIE_COREDUMP_INPROGRESS, &data->flags);
+ 	return false;
+ }
+ 
  static void btintel_pcie_msix_fw_trigger_handler(struct btintel_pcie_data *data)
  {
  	bt_dev_dbg(data->hdev, "Received firmware smart trigger cause");
  
- 	if (test_and_set_bit(BTINTEL_PCIE_FWTRIGGER_DUMP_INPROGRESS, &data->flags))
+ 	/* Per-work guard: deduplicate concurrent FW-trigger interrupts.
+ 	 * Cleared at the tail of btintel_pcie_fwtrigger_worker().
+ 	 */
+ 	if (test_and_set_bit(BTINTEL_PCIE_FWTRIGGER_DUMP_INPROGRESS,
+ 			     &data->flags))
  		return;
  
- 	/* Trigger device core dump when there is FW assert */
- 	if (!test_and_set_bit(BTINTEL_PCIE_COREDUMP_INPROGRESS, &data->flags))
- 		data->dmp_hdr.trigger_reason = BTINTEL_PCIE_TRIGGER_REASON_FW_ASSERT;
+ 	if (!queue_work(data->dump_workqueue, &data->fwtrigger_work)) {
+ 		clear_bit(BTINTEL_PCIE_FWTRIGGER_DUMP_INPROGRESS, &data->flags);
+ 		return;
+ 	}
  
- 	queue_work(data->coredump_workqueue, &data->coredump_work);
+ 	/* Queue coredump after the fwtrigger event reader so dmp_hdr.event_*
+ 	 * is populated before dump_traces consumes it.
+ 	 */
+ 	btintel_pcie_queue_coredump(data, BTINTEL_PCIE_TRIGGER_REASON_FW_ASSERT);
  }
  
  static void btintel_pcie_msix_hw_exp_handler(struct btintel_pcie_data *data)
  {
  	bt_dev_err(data->hdev, "Received hw exception interrupt");
  
+ 	/* CORE_HALTED is the single-writer guard for this handler. It is
+ 	 * set once on first HW exception and cleared only by re-probe
+ 	 * (data is reallocated), so it also serializes hwexp_work
+ 	 * scheduling without needing a separate bit.
+ 	 */
  	if (test_and_set_bit(BTINTEL_PCIE_CORE_HALTED, &data->flags))
  		return;
  
- 	if (test_and_set_bit(BTINTEL_PCIE_HWEXP_INPROGRESS, &data->flags))
- 		return;
+ 	/* Queue companion coredump first so it is appended after hwexp_work
+ 	 * on the ordered @dump_workqueue (preserves the original
+ 	 * coredump-then-hwexp ordering).
+ 	 */
+ 	btintel_pcie_queue_coredump(data, BTINTEL_PCIE_TRIGGER_REASON_FW_ASSERT);
  
- 	/* Trigger device core dump when there is HW  exception */
- 	if (!test_and_set_bit(BTINTEL_PCIE_COREDUMP_INPROGRESS, &data->flags))
- 		data->dmp_hdr.trigger_reason = BTINTEL_PCIE_TRIGGER_REASON_FW_ASSERT;
- 
- 	queue_work(data->coredump_workqueue, &data->coredump_work);
+ 	queue_work(data->dump_workqueue, &data->hwexp_work);
  }
  
  static void btintel_pcie_coredump_worker(struct work_struct *work)
  {
  	struct btintel_pcie_data *data = container_of(work,
  					struct btintel_pcie_data, coredump_work);
- 	int err;
  
  	/* hdev is NULL until setup_hdev() succeeds, and is cleared on
  	 * teardown after disable_work_sync() drains us; bail in that case.
  	 */
+ 	if (!data->hdev)
+ 		goto out;
+ 
+ 	btintel_pcie_dump_traces(data->hdev);
+ out:
+ 	/* Release guard last so a new trigger can run only after this
+ 	 * pass has fully completed (including dev_coredumpv()).
+ 	 */
+ 	clear_bit(BTINTEL_PCIE_COREDUMP_INPROGRESS, &data->flags);
+ }
+ 
+ static void btintel_pcie_hwexp_worker(struct work_struct *work)
+ {
+ 	struct btintel_pcie_data *data = container_of(work,
+ 					struct btintel_pcie_data, hwexp_work);
+ 
  	if (!data->hdev)
  		return;
  
- 	if (test_bit(BTINTEL_PCIE_FWTRIGGER_DUMP_INPROGRESS, &data->flags)) {
- 		err = btintel_pcie_dump_fwtrigger_event(data);
- 		if (err)
- 			bt_dev_warn(data->hdev, "failed to log fwtrigger event");
- 		clear_bit(BTINTEL_PCIE_FWTRIGGER_DUMP_INPROGRESS, &data->flags);
- 	}
+ 	/* Unlike usb products, controller will not send hardware exception
+ 	 * event on exception. Instead controller writes the hardware event
+ 	 * to device memory along with optional debug events, raises MSIX
+ 	 * and halts. Driver shall read the exception event from device
+ 	 * memory and passes it to the stack for further processing.
+ 	 *
+ 	 * Re-entry is gated by BTINTEL_PCIE_CORE_HALTED in the IRQ
+ 	 * handler, which is only cleared by re-probe; no per-work bit
+ 	 * is needed here.
+ 	 */
+ 	btintel_pcie_read_hwexp(data);
+ }
  
- 	if (test_bit(BTINTEL_PCIE_COREDUMP_INPROGRESS, &data->flags)) {
- 		btintel_pcie_dump_traces(data->hdev);
- 		clear_bit(BTINTEL_PCIE_COREDUMP_INPROGRESS, &data->flags);
- 	}
+ static void btintel_pcie_fwtrigger_worker(struct work_struct *work)
+ {
+ 	struct btintel_pcie_data *data = container_of(work,
+ 					struct btintel_pcie_data, fwtrigger_work);
+ 	int err;
  
- 	if (test_bit(BTINTEL_PCIE_HWEXP_INPROGRESS, &data->flags)) {
- 		/* Unlike usb products, controller will not send hardware
- 		 * exception event on exception. Instead controller writes the
- 		 * hardware event to device memory along with optional debug
- 		 * events, raises MSIX and halts. Driver shall read the
- 		 * exception event from device memory and passes it stack for
- 		 * further processing.
- 		 */
- 		btintel_pcie_read_hwexp(data);
- 		clear_bit(BTINTEL_PCIE_HWEXP_INPROGRESS, &data->flags);
- 	}
+ 	if (!data->hdev)
+ 		goto out;
+ 
+ 	err = btintel_pcie_dump_fwtrigger_event(data);
+ 	if (err)
+ 		bt_dev_warn(data->hdev, "failed to log fwtrigger event");
+ out:
+ 	/* Release guard last; matches set in fw_trigger handler. */
+ 	clear_bit(BTINTEL_PCIE_FWTRIGGER_DUMP_INPROGRESS, &data->flags);
  }
  
  static void btintel_pcie_rx_work(struct work_struct *work)
@@@ -2650,20 -2712,22 +2712,22 @@@ static void btintel_pcie_reset_work(str
  	btintel_pcie_synchronize_irqs(data);
  
  	flush_work(&data->rx_work);
- 	/* Drain any in-flight coredump and block new ones across reset.
- 	 * Safe from self-deadlock: coredump_work runs on a separate wq.
+ 	/* Drain any in-flight dump workers and block new ones across reset.
+ 	 * Safe from self-deadlock: they all run on a separate wq.
  	 */
  	disable_work_sync(&data->coredump_work);
+ 	disable_work_sync(&data->hwexp_work);
+ 	disable_work_sync(&data->fwtrigger_work);
  
  	bt_dev_dbg(data->hdev, "Release bluetooth interface");
  
  	/* Both reset paths follow the same contract: on success they
  	 * destroy 'data' via device_reprobe() (a fresh probe re-INIT_WORKs
- 	 * the coredump_work with disable count 0), so enable_work() must
+ 	 * the dump workers with disable count 0), so enable_work() must
  	 * NOT be called on the success path. Only the FLR path can fail
  	 * with 'data' still alive, in which case we balance the
- 	 * disable_work_sync() above so a later successful reset is not
- 	 * permanently blocked.
+ 	 * disable_work_sync() calls above so a later successful reset is
+ 	 * not permanently blocked.
  	 *
  	 * pci_lock_rescan_remove() (held above) serializes against PCI
  	 * device addition/removal (hotplug), so no device can be added to
@@@ -2674,8 -2738,11 +2738,8 @@@
  		goto out;
  	}
  
 -	if (btintel_pcie_perform_flr(data)) {
 +	if (btintel_pcie_perform_flr(data))
  		enable_work(&data->coredump_work);
 -		enable_work(&data->hwexp_work);
 -		enable_work(&data->fwtrigger_work);
 -	}
  
  out:
  	pci_dev_put(pdev);
@@@ -2869,8 -2936,8 +2933,8 @@@ static int btintel_pcie_probe(struct pc
  	if (!data->workqueue)
  		return -ENOMEM;
  
- 	data->coredump_workqueue = alloc_ordered_workqueue(KBUILD_MODNAME "_cd", 0);
- 	if (!data->coredump_workqueue) {
+ 	data->dump_workqueue = alloc_ordered_workqueue(KBUILD_MODNAME "_cd", 0);
+ 	if (!data->dump_workqueue) {
  		destroy_workqueue(data->workqueue);
  		return -ENOMEM;
  	}
@@@ -2879,6 -2946,8 +2943,8 @@@
  	INIT_WORK(&data->rx_work, btintel_pcie_rx_work);
  	INIT_WORK(&data->reset_work, btintel_pcie_reset_work);
  	INIT_WORK(&data->coredump_work, btintel_pcie_coredump_worker);
+ 	INIT_WORK(&data->hwexp_work, btintel_pcie_hwexp_worker);
+ 	INIT_WORK(&data->fwtrigger_work, btintel_pcie_fwtrigger_worker);
  
  	data->boot_stage_cache = 0x00;
  	data->img_resp_cache = 0x00;
@@@ -2921,7 -2990,7 +2987,7 @@@ exit_error
  	/* reset device before exit */
  	btintel_pcie_reset_bt(data);
  
- 	destroy_workqueue(data->coredump_workqueue);
+ 	destroy_workqueue(data->dump_workqueue);
  
  	pci_clear_master(pdev);
  
@@@ -2940,12 -3009,14 +3006,14 @@@ static void btintel_pcie_remove(struct 
  		return;
  	}
  
- 	/* Permanently block coredump triggers and drain the worker before
- 	 * tearing down. Must run before cancel_work_sync(&reset_work) so
- 	 * the disable counter stays >= 1 even after reset_work()'s
+ 	/* Permanently block all dump triggers and drain the workers before
+ 	 * tearing down. Must run before disable_work_sync(&reset_work) so
+ 	 * the disable counters stay >= 1 even after reset_work()'s
  	 * balanced enable_work() (counter 2 -> 1, never reaching 0).
  	 */
  	disable_work_sync(&data->coredump_work);
+ 	disable_work_sync(&data->hwexp_work);
+ 	disable_work_sync(&data->fwtrigger_work);
  
  	/* Cancel pending reset work. Skip only when remove() is called from
  	 * within the reset work itself (PLDR device_reprobe path) to avoid
@@@ -2973,7 -3044,7 +3041,7 @@@
  
  	btintel_pcie_release_hdev(data);
  
- 	destroy_workqueue(data->coredump_workqueue);
+ 	destroy_workqueue(data->dump_workqueue);
  	destroy_workqueue(data->workqueue);
  
  	btintel_pcie_free(data);
@@@ -2992,16 -3063,8 +3060,8 @@@ static void btintel_pcie_coredump(struc
  	if (!data)
  		return;
  
- 	if (test_and_set_bit(BTINTEL_PCIE_COREDUMP_INPROGRESS, &data->flags))
- 		return;
- 
- 	data->dmp_hdr.trigger_reason  = BTINTEL_PCIE_TRIGGER_REASON_USER_TRIGGER;
- 	/* queue_work() returns false if the work is disabled (reset or
- 	 * remove in progress); clear the in-progress bit so a later
- 	 * trigger can succeed once the work is re-enabled.
- 	 */
- 	if (!queue_work(data->coredump_workqueue, &data->coredump_work))
- 		clear_bit(BTINTEL_PCIE_COREDUMP_INPROGRESS, &data->flags);
+ 	btintel_pcie_queue_coredump(data,
+ 				    BTINTEL_PCIE_TRIGGER_REASON_USER_TRIGGER);
  }
  #endif
  
@@@ -3138,12 -3201,8 +3198,8 @@@ static int btintel_pcie_resume(struct d
  	if (btintel_pcie_in_error(data) ||
  			btintel_pcie_in_device_halt(data)) {
  		bt_dev_err(data->hdev, "Controller in error state for D0 entry");
- 		if (!test_and_set_bit(BTINTEL_PCIE_COREDUMP_INPROGRESS,
- 				      &data->flags)) {
- 			data->dmp_hdr.trigger_reason =
- 				BTINTEL_PCIE_TRIGGER_REASON_FW_ASSERT;
- 			queue_work(data->coredump_workqueue, &data->coredump_work);
- 		}
+ 		btintel_pcie_queue_coredump(data,
+ 					    BTINTEL_PCIE_TRIGGER_REASON_FW_ASSERT);
  		set_bit(BTINTEL_PCIE_CORE_HALTED, &data->flags);
  		btintel_pcie_reset(data->hdev);
  	}

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

linux-next: manual merge of the bluetooth tree with the net tree

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 12554 bytes --]

Hi all,

Today's linux-next merge of the bluetooth tree got a conflict in:

  drivers/bluetooth/btusb.c

between commit:

  df541cd485ff8 ("Bluetooth: btusb: validate Realtek vendor event length")

from the net tree and commits:

  891916abe16fc ("Bluetooth: btusb: validate Realtek vendor event length")
  90ae39404c94e ("Bluetooth: btusb: QCA: Replace HCI_VENDOR_PKT usages with HCI_EV_VENDOR")
  6f55ad8fb0acd ("Bluetooth: btusb: Realtek: Replace HCI_VENDOR_PKT usage with HCI_EV_VENDOR")

from the bluetooth tree.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

diff --combined drivers/bluetooth/btusb.c
index 8f7ed469cac68,4d59b28ab30f2..0000000000000
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@@ -297,6 -297,8 +297,8 @@@ static const struct usb_device_id quirk
  						     BTUSB_WIDEBAND_SPEECH },
  	{ USB_DEVICE(0x13d3, 0x3501), .driver_info = BTUSB_QCA_ROME |
  						     BTUSB_WIDEBAND_SPEECH },
+ 	{ USB_DEVICE(0x13d3, 0x3503), .driver_info = BTUSB_QCA_ROME |
+ 						     BTUSB_WIDEBAND_SPEECH },
  
  	/* QCA WCN6855 chipset */
  	{ USB_DEVICE(0x0489, 0xe0c7), .driver_info = BTUSB_QCA_WCN6855 |
@@@ -679,6 -681,8 +681,8 @@@
  	{ USB_DEVICE(0x13d3, 0x3606), .driver_info = BTUSB_MEDIATEK |
  						     BTUSB_WIDEBAND_SPEECH },
  	/* MediaTek MT7902 Bluetooth devices */
+ 	{ USB_DEVICE(0x0489, 0xe156), .driver_info = BTUSB_MEDIATEK |
+ 						     BTUSB_WIDEBAND_SPEECH },
  	{ USB_DEVICE(0x0e8d, 0x1ede), .driver_info = BTUSB_MEDIATEK |
  						     BTUSB_WIDEBAND_SPEECH },
  	{ USB_DEVICE(0x13d3, 0x3579), .driver_info = BTUSB_MEDIATEK |
@@@ -796,6 -800,8 +800,8 @@@
  						     BTUSB_WIDEBAND_SPEECH },
  	{ USB_DEVICE(0x13d3, 0x3613), .driver_info = BTUSB_MEDIATEK |
  						     BTUSB_WIDEBAND_SPEECH },
+ 	{ USB_DEVICE(0x13d3, 0x3625), .driver_info = BTUSB_MEDIATEK |
+ 						     BTUSB_WIDEBAND_SPEECH },
  	{ USB_DEVICE(0x13d3, 0x3627), .driver_info = BTUSB_MEDIATEK |
  						     BTUSB_WIDEBAND_SPEECH },
  	{ USB_DEVICE(0x13d3, 0x3628), .driver_info = BTUSB_MEDIATEK |
@@@ -850,6 -856,12 +856,12 @@@
  	{ USB_DEVICE(0x37ad, 0x0600), .driver_info = BTUSB_REALTEK |
  						     BTUSB_WIDEBAND_SPEECH },
  
+ 	/* Additional Realtek 8761CU Bluetooth devices */
+ 	{ USB_DEVICE(0x0b05, 0x1bef), .driver_info = BTUSB_REALTEK |
+ 						     BTUSB_WIDEBAND_SPEECH },
+ 	{ USB_DEVICE(0x0b05, 0x1d70), .driver_info = BTUSB_REALTEK |
+ 						     BTUSB_WIDEBAND_SPEECH },
+ 
  	/* Additional Realtek 8821AE Bluetooth devices */
  	{ USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK },
  	{ USB_DEVICE(0x13d3, 0x3414), .driver_info = BTUSB_REALTEK },
@@@ -882,6 -894,8 +894,8 @@@
  						     BTUSB_WIDEBAND_SPEECH },
  	{ USB_DEVICE(0x0bda, 0xc123), .driver_info = BTUSB_REALTEK |
  						     BTUSB_WIDEBAND_SPEECH },
+ 	{ USB_DEVICE(0x1357, 0xc123), .driver_info = BTUSB_REALTEK |
+ 						     BTUSB_WIDEBAND_SPEECH },
  	{ USB_DEVICE(0x0cb5, 0xc547), .driver_info = BTUSB_REALTEK |
  						     BTUSB_WIDEBAND_SPEECH },
  
@@@ -937,6 -951,10 +951,10 @@@ struct qca_dump_info 
  	u16 ram_dump_seqno;
  };
  
+ struct btqca_data {
+ 	struct qca_dump_info qca_dump;
+ };
+ 
  #define BTUSB_MAX_ISOC_FRAMES	10
  
  #define BTUSB_INTR_RUNNING	0
@@@ -1010,6 -1028,7 +1028,7 @@@ struct btusb_data 
  	bool usb_alt6_packet_flow;
  	int isoc_altsetting;
  	int suspend_count;
+ 	const struct usb_device_id *match_id;
  
  	int (*recv_event)(struct hci_dev *hdev, struct sk_buff *skb);
  	int (*recv_acl)(struct hci_dev *hdev, struct sk_buff *skb);
@@@ -1022,8 -1041,6 +1041,6 @@@
  	int (*disconnect)(struct hci_dev *hdev);
  
  	int oob_wake_irq;   /* irq for out-of-band wake-on-bt */
- 
- 	struct qca_dump_info qca_dump;
  };
  
  static void btusb_reset(struct hci_dev *hdev)
@@@ -2783,7 -2800,7 +2800,7 @@@ static int btusb_setup_realtek(struct h
  static int btusb_recv_event_realtek(struct hci_dev *hdev, struct sk_buff *skb)
  {
  	if (skb->len >= HCI_EVENT_HDR_SIZE + 1 &&
- 	    skb->data[0] == HCI_VENDOR_PKT &&
+ 	    skb->data[0] == HCI_EV_VENDOR &&
  	    skb->data[2] == RTK_SUB_EVENT_CODE_COREDUMP) {
  		struct rtk_dev_coredump_hdr hdr = {
  			.code = RTK_DEVCOREDUMP_CODE_MEMDUMP,
@@@ -3072,14 -3089,15 +3089,15 @@@ static int btusb_set_bdaddr_ath3012(str
  static int btusb_set_bdaddr_wcn6855(struct hci_dev *hdev,
  				const bdaddr_t *bdaddr)
  {
+ 	bdaddr_t bdaddr_swapped;
  	struct sk_buff *skb;
- 	u8 buf[6];
  	long ret;
  
- 	memcpy(buf, bdaddr, sizeof(bdaddr_t));
+ 	baswap(&bdaddr_swapped, bdaddr);
  
- 	skb = __hci_cmd_sync_ev(hdev, 0xfc14, sizeof(buf), buf,
- 				HCI_EV_CMD_COMPLETE, HCI_INIT_TIMEOUT);
+ 	skb = __hci_cmd_sync_ev(hdev, 0xfc14, sizeof(bdaddr_swapped),
+ 				&bdaddr_swapped, HCI_EV_CMD_COMPLETE,
+ 				HCI_INIT_TIMEOUT);
  	if (IS_ERR(skb)) {
  		ret = PTR_ERR(skb);
  		bt_dev_err(hdev, "Change address command failed (%ld)", ret);
@@@ -3115,14 -3133,15 +3133,15 @@@ struct qca_dump_hdr 
  static void btusb_dump_hdr_qca(struct hci_dev *hdev, struct sk_buff *skb)
  {
  	char buf[128];
- 	struct btusb_data *btdata = hci_get_drvdata(hdev);
+ 	struct btqca_data *btqca_data = hci_get_priv(hdev);
+ 	struct qca_dump_info *qca_dump_ptr = &btqca_data->qca_dump;
  
  	snprintf(buf, sizeof(buf), "Controller Name: 0x%x\n",
- 			btdata->qca_dump.controller_id);
+ 			qca_dump_ptr->controller_id);
  	skb_put_data(skb, buf, strlen(buf));
  
  	snprintf(buf, sizeof(buf), "Firmware Version: 0x%x\n",
- 			btdata->qca_dump.fw_version);
+ 			qca_dump_ptr->fw_version);
  	skb_put_data(skb, buf, strlen(buf));
  
  	snprintf(buf, sizeof(buf), "Driver: %s\nVendor: qca\n",
@@@ -3130,7 -3149,7 +3149,7 @@@
  	skb_put_data(skb, buf, strlen(buf));
  
  	snprintf(buf, sizeof(buf), "VID: 0x%x\nPID:0x%x\n",
- 			btdata->qca_dump.id_vendor, btdata->qca_dump.id_product);
+ 			qca_dump_ptr->id_vendor, qca_dump_ptr->id_product);
  	skb_put_data(skb, buf, strlen(buf));
  
  	snprintf(buf, sizeof(buf), "Lmp Subversion: 0x%x\n",
@@@ -3159,6 -3178,8 +3178,8 @@@ static int handle_dump_pkt_qca(struct h
  
  	struct qca_dump_hdr *dump_hdr;
  	struct btusb_data *btdata = hci_get_drvdata(hdev);
+ 	struct btqca_data *btqca_data = hci_get_priv(hdev);
+ 	struct qca_dump_info *qca_dump_ptr = &btqca_data->qca_dump;
  	struct usb_device *udev = btdata->udev;
  
  	pkt_type = hci_skb_pkt_type(skb);
@@@ -3186,8 -3207,8 +3207,8 @@@
  			goto out;
  		}
  
- 		btdata->qca_dump.ram_dump_size = dump_size;
- 		btdata->qca_dump.ram_dump_seqno = 0;
+ 		qca_dump_ptr->ram_dump_size = dump_size;
+ 		qca_dump_ptr->ram_dump_seqno = 0;
  
  		skb_pull(skb, offsetof(struct qca_dump_hdr, data0));
  
@@@ -3199,29 -3220,29 +3220,29 @@@
  		skb_pull(skb, offsetof(struct qca_dump_hdr, data));
  	}
  
- 	if (!btdata->qca_dump.ram_dump_size) {
+ 	if (!qca_dump_ptr->ram_dump_size) {
  		ret = -EINVAL;
  		bt_dev_err(hdev, "memdump is not active");
  		goto out;
  	}
  
- 	if ((seqno > btdata->qca_dump.ram_dump_seqno + 1) && (seqno != QCA_LAST_SEQUENCE_NUM)) {
- 		dump_size = QCA_MEMDUMP_PKT_SIZE * (seqno - btdata->qca_dump.ram_dump_seqno - 1);
+ 	if ((seqno > qca_dump_ptr->ram_dump_seqno + 1) && seqno != QCA_LAST_SEQUENCE_NUM) {
+ 		dump_size = QCA_MEMDUMP_PKT_SIZE * (seqno - qca_dump_ptr->ram_dump_seqno - 1);
  		hci_devcd_append_pattern(hdev, 0x0, dump_size);
  		bt_dev_err(hdev,
  			   "expected memdump seqno(%u) is not received(%u)\n",
- 			   btdata->qca_dump.ram_dump_seqno, seqno);
- 		btdata->qca_dump.ram_dump_seqno = seqno;
+ 			   qca_dump_ptr->ram_dump_seqno, seqno);
+ 		qca_dump_ptr->ram_dump_seqno = seqno;
  		kfree_skb(skb);
  		return ret;
  	}
  
  	hci_devcd_append(hdev, skb);
- 	btdata->qca_dump.ram_dump_seqno++;
+ 	qca_dump_ptr->ram_dump_seqno++;
  	if (seqno == QCA_LAST_SEQUENCE_NUM) {
  		bt_dev_info(hdev,
  				"memdump done: pkts(%u), total(%u)\n",
- 				btdata->qca_dump.ram_dump_seqno, btdata->qca_dump.ram_dump_size);
+ 				qca_dump_ptr->ram_dump_seqno, qca_dump_ptr->ram_dump_size);
  
  		hci_devcd_complete(hdev);
  		goto out;
@@@ -3229,10 -3250,10 +3250,10 @@@
  	return ret;
  
  out:
- 	if (btdata->qca_dump.ram_dump_size)
+ 	if (qca_dump_ptr->ram_dump_size)
  		usb_enable_autosuspend(udev);
- 	btdata->qca_dump.ram_dump_size = 0;
- 	btdata->qca_dump.ram_dump_seqno = 0;
+ 	qca_dump_ptr->ram_dump_size = 0;
+ 	qca_dump_ptr->ram_dump_seqno = 0;
  	clear_bit(BTUSB_HW_SSR_ACTIVE, &btdata->flags);
  
  	if (ret < 0)
@@@ -3257,7 -3278,7 +3278,7 @@@ static bool acl_pkt_is_dump_qca(struct 
  		goto out;
  
  	event_hdr = skb_pull_data(clone, sizeof(*event_hdr));
- 	if (!event_hdr || (event_hdr->evt != HCI_VENDOR_PKT))
+ 	if (!event_hdr || event_hdr->evt != HCI_EV_VENDOR)
  		goto out;
  
  	dump_hdr = skb_pull_data(clone, sizeof(*dump_hdr));
@@@ -3283,7 -3304,7 +3304,7 @@@ static bool evt_pkt_is_dump_qca(struct 
  		return false;
  
  	event_hdr = skb_pull_data(clone, sizeof(*event_hdr));
- 	if (!event_hdr || (event_hdr->evt != HCI_VENDOR_PKT))
+ 	if (!event_hdr || event_hdr->evt != HCI_EV_VENDOR)
  		goto out;
  
  	dump_hdr = skb_pull_data(clone, sizeof(*dump_hdr));
@@@ -3707,8 -3728,12 +3728,12 @@@ static int btusb_setup_qca(struct hci_d
  	if (err < 0)
  		return err;
  
- 	btdata->qca_dump.fw_version = le32_to_cpu(ver.patch_version);
- 	btdata->qca_dump.controller_id = le32_to_cpu(ver.rom_version);
+ 	if (btdata->match_id->driver_info & BTUSB_QCA_WCN6855) {
+ 		struct btqca_data *btqca_data = hci_get_priv(hdev);
+ 
+ 		btqca_data->qca_dump.fw_version = le32_to_cpu(ver.patch_version);
+ 		btqca_data->qca_dump.controller_id = le32_to_cpu(ver.rom_version);
+ 	}
  
  	if (!(status & QCA_SYSCFG_UPDATED)) {
  		err = btusb_setup_qca_load_nvm(hdev, &ver, info);
@@@ -3889,16 -3914,13 +3914,13 @@@ static bool btusb_wakeup(struct hci_de
  
  static int btusb_shutdown_qca(struct hci_dev *hdev)
  {
- 	struct sk_buff *skb;
+ 	int err;
  
- 	skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
- 	if (IS_ERR(skb)) {
+ 	err = __hci_reset_sync(hdev);
+ 	if (err)
  		bt_dev_err(hdev, "HCI reset during shutdown failed");
- 		return PTR_ERR(skb);
- 	}
- 	kfree_skb(skb);
  
- 	return 0;
+ 	return err;
  }
  
  static ssize_t force_poll_sync_read(struct file *file, char __user *user_buf,
@@@ -4082,7 -4104,7 +4104,7 @@@ static int btusb_probe(struct usb_inter
  	struct btusb_data *data;
  	struct hci_dev *hdev;
  	unsigned ifnum_base;
- 	int err, priv_size;
+ 	int err, priv_size = 0;
  
  	BT_DBG("intf %p id %p", intf, id);
  
@@@ -4101,7 -4123,7 +4123,7 @@@
  			id = match;
  	}
  
- 	if (id->driver_info == BTUSB_IGNORE)
+ 	if (id->driver_info & BTUSB_IGNORE)
  		return -ENODEV;
  
  	if (id->driver_info & BTUSB_ATH3012) {
@@@ -4119,6 -4141,7 +4141,7 @@@
  	if (!data)
  		return -ENOMEM;
  
+ 	data->match_id = id;
  	err = usb_find_common_endpoints(intf->cur_altsetting, &data->bulk_rx_ep,
  					&data->bulk_tx_ep, &data->intr_ep, NULL);
  	if (err)
@@@ -4152,8 -4175,6 +4175,6 @@@
  	init_usb_anchor(&data->ctrl_anchor);
  	spin_lock_init(&data->rxlock);
  
- 	priv_size = 0;
- 
  	data->recv_event = hci_recv_frame;
  	data->recv_bulk = btusb_recv_bulk;
  
@@@ -4172,6 -4193,9 +4193,9 @@@
  	} else if (id->driver_info & BTUSB_MEDIATEK) {
  		/* Allocate extra space for Mediatek device */
  		priv_size += sizeof(struct btmtk_data);
+ 	} else if (id->driver_info & BTUSB_QCA_WCN6855) {
+ 		/* Allocate extra space for QCA WCN6855 device */
+ 		priv_size += sizeof(struct btqca_data);
  	}
  
  	data->recv_acl = hci_recv_frame;
@@@ -4314,8 -4338,10 +4338,10 @@@
  	}
  
  	if (id->driver_info & BTUSB_QCA_WCN6855) {
- 		data->qca_dump.id_vendor = id->idVendor;
- 		data->qca_dump.id_product = id->idProduct;
+ 		struct btqca_data *btqca_data = hci_get_priv(hdev);
+ 
+ 		btqca_data->qca_dump.id_vendor = id->idVendor;
+ 		btqca_data->qca_dump.id_product = id->idProduct;
  		data->recv_event = btusb_recv_evt_qca;
  		data->recv_acl = btusb_recv_acl_qca;
  		hci_devcd_register(hdev, btusb_coredump_qca, btusb_dump_hdr_qca, NULL);

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]