[Deepin-Kernel-SIG] [linux 6.6.y] [Upstream] Sync bluetooth fixes from mainline

[opsiff]

Summary by Sourcery

Sync various upstream Bluetooth driver fixes improving Intel PCIe, USB Mediatek, and EFI handling for stability and correctness.

Bug Fixes:

• Adjust Intel PCIe RX/TX descriptor sizing and RX buffer posting to address firmware race conditions and queue handling issues.
• Fix Intel PCIe interrupt handling, RX/TX queue empty checks, and alive interrupt waiting logic to avoid timeouts and missed interrupts.
• Correct Intel EFI DSBR variable retrieval by using a fixed buffer size and validating returned data length.
• Harden USB Mediatek isochronous interface claim/release paths against NULL hdev, private data, and interface pointers, and ensure URBs/SKBs are safely freed.
• Ensure Mediatek interrupt URB allocation frees URBs when isochronous packet padding fails instead of leaking resources.
• Route specific Intel PCIe debug events through diagnostic handling instead of silently discarding them.
• Simplify Intel PCIe RX frame processing to reuse incoming SKBs and avoid unnecessary allocations and leaks.
• Remove unused HCI connection remote_id field from core Bluetooth structures.

Enhancements:

• Update Intel PCIe IRQ registration to use threaded-only (oneshot) handling for better interrupt management.
• Clarify comments and minor wording in Intel bootloader code for intermediate loader image support.

[sourcery-ai]

Reviewer's Guide

Synchronizes multiple Bluetooth driver fixes from mainline, focusing on Intel PCIe, USB Mediatek, Intel EFI handling, and HCI core cleanups, with queue sizing, interrupt handling, memory management, and robustness improvements.

Sequence diagram for updated Intel PCIe interrupt and alive handling

sequenceDiagram
    actor HostCPU
    participant btintel_pcie_send_frame
    participant gp0_wait_q
    participant btintel_pcie_irq_msix_handler
    participant btintel_pcie_msix_gp0_handler
    participant btintel_pcie_msix_tx_handle
    participant btintel_pcie_msix_rx_handle
    participant btintel_pcie_is_rxq_empty
    participant btintel_pcie_is_txackq_empty

    HostCPU->>btintel_pcie_send_frame: hci_dev_queue_skb
    btintel_pcie_send_frame->>btintel_pcie_send_frame: set data.gp0_received = false on HCI_OP_RESET or BTINTEL_HCI_OP_RESET
    btintel_pcie_send_frame->>gp0_wait_q: wait_event_timeout(gp0_wait_q, gp0_received)

    Note over btintel_pcie_irq_msix_handler,btintel_pcie_msix_gp0_handler: Alive interrupt path
    HostCPU-->>btintel_pcie_irq_msix_handler: MSIX interrupt
    btintel_pcie_irq_msix_handler->>btintel_pcie_msix_gp0_handler: btintel_pcie_msix_gp0_handler
    btintel_pcie_msix_gp0_handler->>gp0_wait_q: wake_up on alive interrupt (gp0_received = true)

    alt intr_fh has BTINTEL_PCIE_MSIX_FH_INT_CAUSES_0
        btintel_pcie_irq_msix_handler->>btintel_pcie_msix_tx_handle: btintel_pcie_msix_tx_handle
        btintel_pcie_irq_msix_handler->>btintel_pcie_is_rxq_empty: btintel_pcie_is_rxq_empty
        btintel_pcie_is_rxq_empty-->>btintel_pcie_irq_msix_handler: false when RXQ has entries
        btintel_pcie_irq_msix_handler->>btintel_pcie_msix_rx_handle: btintel_pcie_msix_rx_handle when RXQ not empty
    end

    alt intr_fh has BTINTEL_PCIE_MSIX_FH_INT_CAUSES_1
        btintel_pcie_irq_msix_handler->>btintel_pcie_msix_rx_handle: btintel_pcie_msix_rx_handle
        btintel_pcie_irq_msix_handler->>btintel_pcie_is_txackq_empty: btintel_pcie_is_txackq_empty
        btintel_pcie_is_txackq_empty-->>btintel_pcie_irq_msix_handler: false when TXACKQ has entries
        btintel_pcie_irq_msix_handler->>btintel_pcie_msix_tx_handle: btintel_pcie_msix_tx_handle when TXACKQ not empty
    end

    gp0_wait_q-->>btintel_pcie_send_frame: wakeup when gp0_received
    btintel_pcie_send_frame-->>HostCPU: return or timeout with err_tx increment

Loading

Flow diagram for Mediatek ISO interface claim and release

flowchart TD
    A[btusb_mtk_claim_iso_intf] --> B{data.hdev is NULL?}
    B -->|yes| Z[return]
    B -->|no| C[hci_get_priv]
    C --> D{btmtk_data is NULL?}
    D -->|yes| Z
    D -->|no| E{btmtk_data.isopkt_intf is NULL?}
    E -->|yes| F[bt_dev_err Can't claim NULL iso interface; return]
    E -->|no| G[usb_driver_claim_interface]

    subgraph ReleasePath
        R[btusb_mtk_release_iso_intf] --> S{hdev is NULL?}
        S -->|yes| Z2[return]
        S -->|no| T[hci_get_priv]
        T --> U{btmtk_data is NULL?}
        U -->|yes| Z2
        U -->|no| V{BTMTK_ISOPKT_OVER_INTR set?}
        V -->|no| W[clear BTMTK_ISOPKT_OVER_INTR]
        V -->|yes| X[usb_kill_anchored_urbs; clear BTMTK_ISOPKT_RUNNING]
        X --> Y{btmtk_data.isopkt_skb is non-NULL?}
        Y -->|yes| Y1[dev_kfree_skb_irq; set isopkt_skb NULL]
        Y -->|no| Y2[skip skb free]
        X --> AA{btmtk_data.isopkt_intf is non-NULL?}
        AA -->|yes| AB[usb_set_intfdata NULL; usb_driver_release_interface; set isopkt_intf NULL]
        AA -->|no| AC[skip interface release]
        AB --> W
        AC --> W
    end

Loading

File-Level Changes

Change	Details	Files
Adjust Intel PCIe Bluetooth queue sizing, RX buffer posting, and interrupt handling to fix race conditions and improve TX/RX coordination.	Change TX/RX descriptor counts to distinct, larger values and wire them through DMA layout and queue initialization Modify RX start logic to post (rxq->count - 3) buffers instead of a fixed max queue size to work around firmware race conditions Introduce helpers to check RX/TXACK queue emptiness and use them in the MSI-X handler to drive RX when TX interrupts fire and vice versa Switch MSI-X IRQ registration to use a threaded-only handler (NULL top-half) with IRQF_ONESHOT	IRQF_SHARED Drop noisy RXQ warning when no new completion descriptors are present
Rework Intel PCIe receive path to avoid unnecessary skb reallocations and fix ownership and lifetime of sk_buffs.	Remove allocation of a new skb in btintel_pcie_recv_frame and operate directly on the incoming skb Set HCI packet type on the original skb, trim to payload length, and pass it down to btintel_pcie_recv_event/hci_recv_frame which now free it Ensure on-error cleanup path frees skb if it wasn’t handed off Simplify rx_work loop to just call btintel_pcie_recv_frame without manual error logging or skb freeing	drivers/bluetooth/btintel_pcie.c
Improve Intel PCIe firmware alive interrupt handling for reset commands.	Mark gp0_received as false whenever sending HCI_OP_RESET or BTINTEL_HCI_OP_RESET Unconditionally wait for the alive interrupt after commands that change alive_intr_ctxt, rather than special-casing HCI_OP_RESET On timeout, report a more descriptive error including the timeout value and current alive context, and account the error in err_tx	drivers/bluetooth/btintel_pcie.c
Ensure Intel PCIe debug events are treated as diagnostics while still being filtered from the normal HCI stack.	For specific debug event (skb->data[2] == 0x97), call hci_recv_diag and then swallow the event by returning 0 instead of passing to the stack	drivers/bluetooth/btintel_pcie.c
Increase robustness of Mediatek USB Bluetooth ISO interface claim/release handling and error paths.	Add NULL checks for hdev and private btmtk_data before accessing ISO interface state in claim/release helpers Guard against NULL isopkt_intf when claiming; log an error if it’s NULL instead of calling into USB core Protect release path with NULL checks on isopkt_skb and isopkt_intf before freeing and releasing, and clear isopkt_intf after release Ensure alloc_mtk_intr_urb frees the allocated URB when btmtk_isopkt_pad detects an invalid packet before returning ERR_PTR(-EINVAL)	drivers/bluetooth/btusb.c drivers/bluetooth/btmtk.c
Harden Intel EFI DSBR variable reading logic and fix a minor typo in a comment.	Initialize EFI data_size to sizeof(data) and remove the preliminary buffer-size probe call Reject EFI get_variable results if status is not EFI_SUCCESS or if data_size does not match the expected structure size Fix spelling of "intermediate loader image" in a comment	drivers/bluetooth/btintel.c
Clean up HCI connection structure by removing an unused remote_id field.	Remove the remote_id member from struct hci_conn to match upstream and reduce unused state	include/net/bluetooth/hci_core.h

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[deepin-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from opsiff. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• deepin/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[sourcery-ai]

Hey - I've left some high level feedback:

• In btintel_pcie_start_rx(), consider replacing the hard-coded rxq->count - 3 offset with a named constant or macro that documents the hardware quirk, so future descriptor count changes don’t silently alter this behavior.
• Now that btintel_pcie_irq_msix_handler conditionally calls both RX and TX handlers based on queue emptiness, it may be worth adding a brief comment near the helper functions explaining the expected ordering and why cross-calling is needed, to aid future maintainers in understanding the interrupt flow.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- In btintel_pcie_start_rx(), consider replacing the hard-coded `rxq->count - 3` offset with a named constant or macro that documents the hardware quirk, so future descriptor count changes don’t silently alter this behavior.
- Now that btintel_pcie_irq_msix_handler conditionally calls both RX and TX handlers based on queue emptiness, it may be worth adding a brief comment near the helper functions explaining the expected ordering and why cross-calling is needed, to aid future maintainers in understanding the interrupt flow.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[Copilot]

Pull request overview

This PR backports a set of upstream Bluetooth fixes to the 6.6.y kernel series, primarily targeting Intel PCIe controller stability/IRQ handling and MediaTek USB robustness, plus minor EFI handling and cleanup in core structures.

Changes:

• Intel PCIe: adjust RX/TX descriptor sizing, IRQ handling (threaded-only), RX processing, and alive-interrupt sequencing/diagnostics.
• MediaTek USB: harden isochronous interface claim/release paths and fix an URB leak on error.
• Core/EFI: remove unused hci_conn::remote_id, tighten Intel EFI DSBR variable retrieval, and fix a comment typo.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
include/net/bluetooth/hci_core.h	Removes unused remote_id from struct hci_conn.
drivers/bluetooth/btusb.c	Adds NULL-safety around MediaTek ISO interface claim/release and frees resources defensively.
drivers/bluetooth/btmtk.c	Fixes URB leak on isochronous padding failure.
drivers/bluetooth/btintel.c	Makes EFI DSBR retrieval use fixed-size buffer and validates returned length; fixes comment typo.
drivers/bluetooth/btintel_pcie.h	Splits RX/TX descriptor counts and removes obsolete RX queue constant.
drivers/bluetooth/btintel_pcie.c	Updates RX posting strategy, IRQ handler behavior, diag event routing, skb reuse on RX, and alive-interrupt waiting.

Suppressed comments (1)

drivers/bluetooth/btintel_pcie.c:820

• This return statement exceeds typical kernel line-length limits and will likely trigger checkpatch warnings; split the comparison across lines for readability.

static inline bool btintel_pcie_is_txackq_empty(struct btintel_pcie_data *data)
{
	return data->ia.cr_tia[BTINTEL_PCIE_TXQ_NUM] == data->ia.cr_hia[BTINTEL_PCIE_TXQ_NUM];
}

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[opsiff]

drop

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

Suppressed comments (2)

drivers/bluetooth/btintel_pcie.c:813

• These inline helpers exceed typical kernel line-length limits; please wrap the long return expression for readability and to avoid checkpatch warnings.

static inline bool btintel_pcie_is_rxq_empty(struct btintel_pcie_data *data)
{
	return data->ia.cr_hia[BTINTEL_PCIE_RXQ_NUM] == data->ia.cr_tia[BTINTEL_PCIE_RXQ_NUM];
}

drivers/bluetooth/btintel_pcie.c:818

• This return statement is long enough to trip kernel style/line-length checks; please wrap it onto multiple lines for readability.

static inline bool btintel_pcie_is_txackq_empty(struct btintel_pcie_data *data)
{
	return data->ia.cr_tia[BTINTEL_PCIE_TXQ_NUM] == data->ia.cr_hia[BTINTEL_PCIE_TXQ_NUM];
}