linux-kernel - Re: [PATCH v12] Bluetooth: hci_qca: Fix SSR (SubSystem Restart) fail when BT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <c87533fc-768d-4b70-a1aa-2639e5329058@quicinc.com>
Date: Tue, 2 Dec 2025 17:08:00 +0800
From: Shuai Zhang <quic_shuaz@...cinc.com>
To: Dmitry Baryshkov <dmitry.baryshkov@....qualcomm.com>
CC: <marcel@...tmann.org>, <luiz.dentz@...il.com>,
        <linux-bluetooth@...r.kernel.org>, <stable@...r.kernel.org>,
        <linux-arm-msm@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <quic_chejiang@...cinc.com>
Subject: Re: [PATCH v12] Bluetooth: hci_qca: Fix SSR (SubSystem Restart) fail
 when BT_EN is pulled up by hw

Hi Luiz

On 9/16/2025 11:01 PM, Dmitry Baryshkov wrote:
> On Tue, Sep 16, 2025 at 10:02:59PM +0800, Shuai Zhang wrote:
>> On QCS9075 and QCA8275 platforms, the BT_EN pin is always pulled up by hw
>> and cannot be controlled by the host. As a result, in case of a firmware
>> crash, the host cannot trigger a cold reset. Instead, the BT controller
>> performs a warm restart on its own, without reloading the firmware.
>>
>> This leads to the controller remaining in IBS_WAKE state, while the host
>> expects it to be in sleep mode. The mismatch causes HCI reset commands
>> to time out. Additionally, the driver does not clear internal flags
>> QCA_SSR_TRIGGERED and QCA_IBS_DISABLED, which blocks the reset sequence.
>> If the SSR duration exceeds 2 seconds, the host may enter TX sleep mode
>> due to tx_idle_timeout, further preventing recovery. Also, memcoredump_flag
>> is not cleared, so only the first SSR generates a coredump.
>>
>> Tell driver that BT controller has undergone a proper restart sequence:
>>
>> - Clear QCA_SSR_TRIGGERED and QCA_IBS_DISABLED flags after SSR.
>> - Add a 50ms delay to allow the controller to complete its warm reset.
>> - Reset tx_idle_timer to prevent the host from entering TX sleep mode.
>> - Clear memcoredump_flag to allow multiple coredump captures.
>>
>> Apply these steps only when HCI_QUIRK_NON_PERSISTENT_SETUP is not set,
>> which indicates that BT_EN is defined in DTS and cannot be toggled.
>>
>> Refer to the comment in include/net/bluetooth/hci.h for details on
>> HCI_QUIRK_NON_PERSISTENT_SETUP.
>>
>> Changes in v12:
>> - Rewrote commit to clarify the actual issue and affected platforms.
>> - Used imperative language to describe the fix.
>> - Explained the role of HCI_QUIRK_NON_PERSISTENT_SETUP.
> 
> I'll leave having the changelog inside the commit message to the
> maintainer's discretion.
> 
> Otherwise:
> 
> 
> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@....qualcomm.com>
> 
> 

I noticed that this upstream patch has already been reviewed,
but it still seems not to have been accepted. Is there anything else I need to do?

> 
>>
>> Signed-off-by: Shuai Zhang <quic_shuaz@...cinc.com>
>> ---
>>  drivers/bluetooth/hci_qca.c | 33 +++++++++++++++++++++++++++++++++
>>  1 file changed, 33 insertions(+)
>>
> 

Thanks,
Shuai