linux-kernel - [PATCHv2] Bluetooth: quirk disabling LE Read Transmit Power

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 01 Oct 2021 08:36:18 +0000
From:   Orlando Chamberlain <redecorating@...tonmail.com>
To:     redecorating@...tonmail.com
Cc:     danielwinkler@...gle.com, johan.hedberg@...el.com,
        linux-bluetooth@...r.kernel.org, linux-kernel@...r.kernel.org,
        marcel@...tmann.org, regressions@...ts.linux.dev,
        sonnysasaka@...omium.org
Subject: [PATCHv2] Bluetooth: quirk disabling LE Read Transmit Power

The LE Read Transmit Power command is Advertised on some Broadcom
controlers, but not supported. Using this command breaks Bluetooth
on the MacBookPro16,1 and iMac20,1. Added a quirk disabling LE Read
Transmit Power for these devices, based off their common chip id 150.

Link: https://lore.kernel.org/r/4970a940-211b-25d6-edab-21a815313954@protonmail.com
Signed-off-by: Orlando Chamberlain <redecorating@...tonmail.com>
---
v1->v2: Clarified quirk description

 drivers/bluetooth/btbcm.c   |  4 ++++
 include/net/bluetooth/hci.h | 11 +++++++++++
 net/bluetooth/hci_core.c    |  3 ++-
 3 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btbcm.c b/drivers/bluetooth/btbcm.c
index e4182acee488..4ecc50d93107 100644
--- a/drivers/bluetooth/btbcm.c
+++ b/drivers/bluetooth/btbcm.c
@@ -353,6 +353,10 @@ static int btbcm_read_info(struct hci_dev *hdev)
 		return PTR_ERR(skb);
 
 	bt_dev_info(hdev, "BCM: chip id %u", skb->data[1]);
+
+	if (skb->data[1] == 150)
+		set_bit(HCI_QUIRK_BROKEN_READ_TRANSMIT_POWER, &hdev->quirks);
+
 	kfree_skb(skb);
 
 	/* Read Controller Features */
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index b80415011dcd..6da9bd6b7259 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -246,6 +246,17 @@ enum {
 	 * HCI after resume.
 	 */
 	HCI_QUIRK_NO_SUSPEND_NOTIFIER,
+
+	/* When this quirk is set, LE Read Transmit Power is disabled.
+	 * This is mainly due to the fact that the HCI LE Read Transmit
+	 * Power command is advertised, but not supported; these
+	 * controllers often reply with unknown command and need a hard
+	 * reset.
+	 *
+	 * This quirk can be set before hci_register_dev is called or
+	 * during the hdev->setup vendor callback.
+	 */
+	HCI_QUIRK_BROKEN_READ_TRANSMIT_POWER,
 };
 
 /* HCI device flags */
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 8a47a3017d61..9a23fe7c8d67 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -742,7 +742,8 @@ static int hci_init3_req(struct hci_request *req, unsigned long opt)
 			hci_req_add(req, HCI_OP_LE_READ_ADV_TX_POWER, 0, NULL);
 		}
 
-		if (hdev->commands[38] & 0x80) {
+		if (hdev->commands[38] & 0x80 &&
+			!test_bit(HCI_QUIRK_BROKEN_READ_TRANSMIT_POWER, &hdev->quirks)) {
 			/* Read LE Min/Max Tx Power*/
 			hci_req_add(req, HCI_OP_LE_READ_TRANSMIT_POWER,
 				    0, NULL);
-- 
2.33.0