linux-kernel - Re: [PATCH] Bluetooth: hci_bcm: Handle specific unknown packets after firmware loading

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 05 Dec 2018 22:24:39 +0100
From:   Paweł Chmiel <pawel.mikolaj.chmiel@...il.com>
To:     Marcel Holtmann <marcel@...tmann.org>
Cc:     Johan Hedberg <johan.hedberg@...il.com>,
        Bluez mailing list <linux-bluetooth@...r.kernel.org>,
        linux-kernel@...r.kernel.org, Jonathan Bakker <xc-racer2@...e.ca>
Subject: Re: [PATCH] Bluetooth: hci_bcm: Handle specific unknown packets after firmware loading

Dnia środa, 5 grudnia 2018 22:02:30 CET Marcel Holtmann pisze:
> Hi Pawel,
> 
> > The Broadcom controller on aries S5PV210 boards sends out a couple of
> > unknown packets after the firmware is loaded.  This will cause
> > logging of errors such as:
> > 	Bluetooth: hci0: Frame reassembly failed (-84)
> > 
> > This is probably also the case with other boards, as there are related
> > Android userspace patches for custom ROMs such as
> > https://review.lineageos.org/#/c/LineageOS/android_system_bt/+/142721/
> > Since this appears to be intended behaviour, treated them as diagnostic
> > packets.
> > 
> > Note that this is another variant of commit 01d5e44ace8a 
> > ("Bluetooth: hci_bcm: Handle empty packet after firmware loading")
> > 
> > Signed-off-by: Jonathan Bakker <xc-racer2@...e.ca>
> > Signed-off-by: Paweł Chmiel <pawel.mikolaj.chmiel@...il.com>
> > ---
> > drivers/bluetooth/hci_bcm.c | 32 +++++++++++++++++++++++++++-----
> > 1 file changed, 27 insertions(+), 5 deletions(-)
> > 
> > diff --git a/drivers/bluetooth/hci_bcm.c b/drivers/bluetooth/hci_bcm.c
> > index ddbd8c6a0ceb..ae271836dc26 100644
> > --- a/drivers/bluetooth/hci_bcm.c
> > +++ b/drivers/bluetooth/hci_bcm.c
> > @@ -51,6 +51,12 @@
> > #define BCM_LM_DIAG_PKT 0x07
> > #define BCM_LM_DIAG_SIZE 63
> > 
> > +#define BCM_UNKNOWN_PKT 0x31
> > +#define BCM_UNKNOWN_SIZE 0
> > +
> > +#define BCM_UNKNOWN2_PKT 0x34
> > +#define BCM_UNKNOWN2_SIZE 0
> > +
> 
> lets use BCM_TYPE49_ and BCM_TYPE52_
> 
> > #define BCM_AUTOSUSPEND_DELAY	5000 /* default autosleep delay */
> > 
> > /**
> > @@ -561,12 +567,28 @@ static int bcm_setup(struct hci_uart *hu)
> > 	.lsize = 0, \
> > 	.maxlen = BCM_NULL_SIZE
> > 
> > +#define BCM_RECV_UNKNOWN \
> > +	.type = BCM_UNKNOWN_PKT, \
> > +	.hlen = BCM_UNKNOWN_SIZE, \
> > +	.loff = 0, \
> > +	.lsize = 0, \
> > +	.maxlen = BCM_UNKNOWN_SIZE
> > +
> > +#define BCM_RECV_UNKNOWN2 \
> > +	.type = BCM_UNKNOWN2_PKT, \
> > +	.hlen = BCM_UNKNOWN2_SIZE, \
> > +	.loff = 0, \
> > +	.lsize = 0, \
> > +	.maxlen = BCM_UNKNOWN2_SIZE
> 
> Same here, BCM_RECV_TYPE49 and BCM_RECV_TYPE52.
> 
> > +
> > static const struct h4_recv_pkt bcm_recv_pkts[] = {
> > -	{ H4_RECV_ACL,      .recv = hci_recv_frame },
> > -	{ H4_RECV_SCO,      .recv = hci_recv_frame },
> > -	{ H4_RECV_EVENT,    .recv = hci_recv_frame },
> > -	{ BCM_RECV_LM_DIAG, .recv = hci_recv_diag  },
> > -	{ BCM_RECV_NULL,    .recv = hci_recv_diag  },
> > +	{ H4_RECV_ACL,       .recv = hci_recv_frame },
> > +	{ H4_RECV_SCO,       .recv = hci_recv_frame },
> > +	{ H4_RECV_EVENT,     .recv = hci_recv_frame },
> > +	{ BCM_RECV_LM_DIAG,  .recv = hci_recv_diag  },
> > +	{ BCM_RECV_NULL,     .recv = hci_recv_diag  },
> > +	{ BCM_RECV_UNKNOWN,  .recv = hci_recv_diag  },
> > +	{ BCM_RECV_UNKNOWN2, .recv = hci_recv_diag  },
> > };
> > 
> > static int bcm_recv(struct hci_uart *hu, const void *data, int count)
> 
> Regards
> 
> Marcel
> 
Hi
Fixed in v2 version of patch.

Thanks for review.