linux-kernel - Re: [PATCH v12] Bluetooth: hci_qca: Fix SSR (SubSystem Restart) fail when BT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CABBYNZJ=C3fYy=SXQyv9x-49vGSjXd-06MsQJ2N3Ps0egMRCuQ@mail.gmail.com>
Date: Tue, 2 Dec 2025 09:30:54 -0500
From: Luiz Augusto von Dentz <luiz.dentz@...il.com>
To: Shuai Zhang <quic_shuaz@...cinc.com>
Cc: Dmitry Baryshkov <dmitry.baryshkov@....qualcomm.com>, marcel@...tmann.org, 
	linux-bluetooth@...r.kernel.org, stable@...r.kernel.org, 
	linux-arm-msm@...r.kernel.org, linux-kernel@...r.kernel.org, 
	quic_chejiang@...cinc.com
Subject: Re: [PATCH v12] Bluetooth: hci_qca: Fix SSR (SubSystem Restart) fail
 when BT_EN is pulled up by hw

Hi Shuai,

On Tue, Dec 2, 2025 at 4:08 AM Shuai Zhang <quic_shuaz@...cinc.com> wrote:
>
> Hi Luiz
>
> On 9/16/2025 11:01 PM, Dmitry Baryshkov wrote:
> > On Tue, Sep 16, 2025 at 10:02:59PM +0800, Shuai Zhang wrote:
> >> On QCS9075 and QCA8275 platforms, the BT_EN pin is always pulled up by hw
> >> and cannot be controlled by the host. As a result, in case of a firmware
> >> crash, the host cannot trigger a cold reset. Instead, the BT controller
> >> performs a warm restart on its own, without reloading the firmware.
> >>
> >> This leads to the controller remaining in IBS_WAKE state, while the host
> >> expects it to be in sleep mode. The mismatch causes HCI reset commands
> >> to time out. Additionally, the driver does not clear internal flags
> >> QCA_SSR_TRIGGERED and QCA_IBS_DISABLED, which blocks the reset sequence.
> >> If the SSR duration exceeds 2 seconds, the host may enter TX sleep mode
> >> due to tx_idle_timeout, further preventing recovery. Also, memcoredump_flag
> >> is not cleared, so only the first SSR generates a coredump.
> >>
> >> Tell driver that BT controller has undergone a proper restart sequence:
> >>
> >> - Clear QCA_SSR_TRIGGERED and QCA_IBS_DISABLED flags after SSR.
> >> - Add a 50ms delay to allow the controller to complete its warm reset.
> >> - Reset tx_idle_timer to prevent the host from entering TX sleep mode.
> >> - Clear memcoredump_flag to allow multiple coredump captures.
> >>
> >> Apply these steps only when HCI_QUIRK_NON_PERSISTENT_SETUP is not set,
> >> which indicates that BT_EN is defined in DTS and cannot be toggled.
> >>
> >> Refer to the comment in include/net/bluetooth/hci.h for details on
> >> HCI_QUIRK_NON_PERSISTENT_SETUP.
> >>
> >> Changes in v12:
> >> - Rewrote commit to clarify the actual issue and affected platforms.
> >> - Used imperative language to describe the fix.
> >> - Explained the role of HCI_QUIRK_NON_PERSISTENT_SETUP.
> >
> > I'll leave having the changelog inside the commit message to the
> > maintainer's discretion.
> >
> > Otherwise:
> >
> >
> > Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@....qualcomm.com>
> >
> >
>
> I noticed that this upstream patch has already been reviewed,
> but it still seems not to have been accepted. Is there anything else I need to do?

My bad, please resend it so CI can pick it up for testing.

> >
> >>
> >> Signed-off-by: Shuai Zhang <quic_shuaz@...cinc.com>
> >> ---
> >>  drivers/bluetooth/hci_qca.c | 33 +++++++++++++++++++++++++++++++++
> >>  1 file changed, 33 insertions(+)
> >>
> >
>
> Thanks,
> Shuai



-- 
Luiz Augusto von Dentz