linux-kernel - Re: [PATCH v12] Bluetooth: hci_qca: Fix SSR (SubSystem Restart) fail when BT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <e0b97cf5-9812-4afb-8d76-96650997fb65@quicinc.com>
Date: Wed, 3 Dec 2025 12:04:27 +0800
From: Shuai Zhang <quic_shuaz@...cinc.com>
To: Luiz Augusto von Dentz <luiz.dentz@...il.com>
CC: Dmitry Baryshkov <dmitry.baryshkov@....qualcomm.com>,
        <marcel@...tmann.org>, <linux-bluetooth@...r.kernel.org>,
        <stable@...r.kernel.org>, <linux-arm-msm@...r.kernel.org>,
        <linux-kernel@...r.kernel.org>, <quic_chejiang@...cinc.com>
Subject: Re: [PATCH v12] Bluetooth: hci_qca: Fix SSR (SubSystem Restart) fail
 when BT_EN is pulled up by hw

Hi Luiz

On 12/2/2025 10:30 PM, Luiz Augusto von Dentz wrote:
> Hi Shuai,
> 
> On Tue, Dec 2, 2025 at 4:08 AM Shuai Zhang <quic_shuaz@...cinc.com> wrote:
>>
>> Hi Luiz
>>
>> On 9/16/2025 11:01 PM, Dmitry Baryshkov wrote:
>>> On Tue, Sep 16, 2025 at 10:02:59PM +0800, Shuai Zhang wrote:
>>>> On QCS9075 and QCA8275 platforms, the BT_EN pin is always pulled up by hw
>>>> and cannot be controlled by the host. As a result, in case of a firmware
>>>> crash, the host cannot trigger a cold reset. Instead, the BT controller
>>>> performs a warm restart on its own, without reloading the firmware.
>>>>
>>>> This leads to the controller remaining in IBS_WAKE state, while the host
>>>> expects it to be in sleep mode. The mismatch causes HCI reset commands
>>>> to time out. Additionally, the driver does not clear internal flags
>>>> QCA_SSR_TRIGGERED and QCA_IBS_DISABLED, which blocks the reset sequence.
>>>> If the SSR duration exceeds 2 seconds, the host may enter TX sleep mode
>>>> due to tx_idle_timeout, further preventing recovery. Also, memcoredump_flag
>>>> is not cleared, so only the first SSR generates a coredump.
>>>>
>>>> Tell driver that BT controller has undergone a proper restart sequence:
>>>>
>>>> - Clear QCA_SSR_TRIGGERED and QCA_IBS_DISABLED flags after SSR.
>>>> - Add a 50ms delay to allow the controller to complete its warm reset.
>>>> - Reset tx_idle_timer to prevent the host from entering TX sleep mode.
>>>> - Clear memcoredump_flag to allow multiple coredump captures.
>>>>
>>>> Apply these steps only when HCI_QUIRK_NON_PERSISTENT_SETUP is not set,
>>>> which indicates that BT_EN is defined in DTS and cannot be toggled.
>>>>
>>>> Refer to the comment in include/net/bluetooth/hci.h for details on
>>>> HCI_QUIRK_NON_PERSISTENT_SETUP.
>>>>
>>>> Changes in v12:
>>>> - Rewrote commit to clarify the actual issue and affected platforms.
>>>> - Used imperative language to describe the fix.
>>>> - Explained the role of HCI_QUIRK_NON_PERSISTENT_SETUP.
>>>
>>> I'll leave having the changelog inside the commit message to the
>>> maintainer's discretion.
>>>
>>> Otherwise:
>>>
>>>
>>> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@....qualcomm.com>
>>>
>>>
>>
>> I noticed that this upstream patch has already been reviewed,
>> but it still seems not to have been accepted. Is there anything else I need to do?
> 
> My bad, please resend it so CI can pick it up for testing.
> 

I have resubmitted a new patch, please help review it.

>>>
>>>>
>>>> Signed-off-by: Shuai Zhang <quic_shuaz@...cinc.com>
>>>> ---
>>>>  drivers/bluetooth/hci_qca.c | 33 +++++++++++++++++++++++++++++++++
>>>>  1 file changed, 33 insertions(+)
>>>>
>>>
>>
>> Thanks,
>> Shuai
> 
> 

Thanks,
Shuai

>