Ask 8821C Bluetooth controller to drop old firmware

Bug #1904221 reported by Kai-Heng Feng
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
Fix Released
Medium
Unassigned
Focal
Fix Released
Medium
Unassigned
Groovy
Fix Released
Medium
Unassigned
linux-oem-5.6 (Ubuntu)
Invalid
Undecided
Unassigned
Focal
Fix Released
Medium
Unassigned
Groovy
Invalid
Undecided
Unassigned

Bug Description

[Impact]
Some platforms may keep USB power in S3/S4/S5, so Realtek 8821C retains
its firmware even with a cold boot.

[Fix]
Use vendor command to drop firmware if the version is old.

[Test case]
Use dmesg to check if new firmware is loaded.
With the patch applied, we can find new firmware is loaded.

[Where problems could occur]
There's a 200ms delay which can slow down when BT controller is opened
by userspace first time.

CVE References

Changed in linux-oem-5.6 (Ubuntu Groovy):
status: New → Invalid
Changed in linux-oem-5.6 (Ubuntu):
status: New → Invalid
Changed in linux (Ubuntu):
status: New → Confirmed
Changed in linux (Ubuntu Focal):
status: New → Confirmed
Changed in linux-oem-5.6 (Ubuntu Focal):
status: New → Confirmed
Changed in linux (Ubuntu Groovy):
status: New → Confirmed
Changed in linux (Ubuntu):
importance: Undecided → Medium
Changed in linux (Ubuntu Focal):
importance: Undecided → Medium
Changed in linux (Ubuntu Groovy):
importance: Undecided → Medium
Changed in linux-oem-5.6 (Ubuntu Focal):
importance: Undecided → Medium
Stefan Bader (smb)
Changed in linux (Ubuntu Focal):
status: Confirmed → Fix Committed
Changed in linux (Ubuntu Groovy):
status: Confirmed → Fix Committed
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-focal' to 'verification-done-focal'. If the problem still exists, change the tag 'verification-needed-focal' to 'verification-failed-focal'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: verification-needed-focal
tags: added: verification-done-focal
removed: verification-needed-focal
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-groovy' to 'verification-done-groovy'. If the problem still exists, change the tag 'verification-needed-groovy' to 'verification-failed-groovy'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: verification-needed-groovy
tags: added: verification-done-groovy
removed: verification-needed-groovy
Timo Aaltonen (tjaalton)
Changed in linux-oem-5.6 (Ubuntu Focal):
status: Confirmed → Fix Committed
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (32.1 KiB)

This bug was fixed in the package linux - 5.4.0-59.65

---------------
linux (5.4.0-59.65) focal; urgency=medium

  * focal/linux: 5.4.0-59.65 -proposed tracker (LP: #1907604)

  * focal: selftests/bpf build broken: test_map_init.skel.h: No such file or
    directory (LP: #1906866)
    - SAUCE: Revert selftests/ "bpf: Zero-fill re-used per-cpu map element"

  * Packaging resync (LP: #1786013)
    - update dkms package versions

  * memory is leaked when tasks are moved to net_prio (LP: #1886859)
    - netprio_cgroup: Fix unlimited memory leak of v2 cgroups

  * Focal update: v5.4.78 upstream stable release (LP: #1905618)
    - drm/i915/gem: Flush coherency domains on first set-domain-ioctl
    - time: Prevent undefined behaviour in timespec64_to_ns()
    - nbd: don't update block size after device is started
    - KVM: arm64: Force PTE mapping on fault resulting in a device mapping
    - PCI: qcom: Make sure PCIe is reset before init for rev 2.1.0
    - usb: dwc3: gadget: Continue to process pending requests
    - usb: dwc3: gadget: Reclaim extra TRBs after request completion
    - btrfs: tracepoints: output proper root owner for trace_find_free_extent()
    - btrfs: sysfs: init devices outside of the chunk_mutex
    - btrfs: reschedule when cloning lots of extents
    - ASoC: Intel: kbl_rt5663_max98927: Fix kabylake_ssp_fixup function
    - genirq: Let GENERIC_IRQ_IPI select IRQ_DOMAIN_HIERARCHY
    - hv_balloon: disable warning when floor reached
    - net: xfrm: fix a race condition during allocing spi
    - ASoC: codecs: wcd9335: Set digital gain range correctly
    - xfs: set xefi_discard when creating a deferred agfl free log intent item
    - netfilter: use actual socket sk rather than skb sk when routing harder
    - netfilter: nf_tables: missing validation from the abort path
    - netfilter: ipset: Update byte and packet counters regardless of whether they
      match
    - powerpc/eeh_cache: Fix a possible debugfs deadlock
    - perf trace: Fix segfault when trying to trace events by cgroup
    - perf tools: Add missing swap for ino_generation
    - ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link()
    - iommu/vt-d: Fix a bug for PDP check in prq_event_thread
    - afs: Fix warning due to unadvanced marshalling pointer
    - can: rx-offload: don't call kfree_skb() from IRQ context
    - can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ
      context
    - can: dev: __can_get_echo_skb(): fix real payload length return value for RTR
      frames
    - can: can_create_echo_skb(): fix echo skb generation: always use skb_clone()
    - can: j1939: swap addr and pgn in the send example
    - can: j1939: j1939_sk_bind(): return failure if netdev is down
    - can: ti_hecc: ti_hecc_probe(): add missed clk_disable_unprepare() in error
      path
    - can: xilinx_can: handle failure cases of pm_runtime_get_sync
    - can: peak_usb: add range checking in decode operations
    - can: peak_usb: peak_usb_get_ts_time(): fix timestamp wrapping
    - can: peak_canfd: pucan_handle_can_rx(): fix echo management when loopback is
      on
    - can: flexcan: remove FLEXCAN_QUIRK_DISABLE_MECR quirk for LS1021A
    - c...

Changed in linux (Ubuntu Focal):
status: Fix Committed → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (6.8 KiB)

This bug was fixed in the package linux - 5.8.0-34.37

---------------
linux (5.8.0-34.37) groovy; urgency=medium

  * groovy/linux: 5.8.0-34.37 -proposed tracker (LP: #1907576)

  * Packaging resync (LP: #1786013)
    - update dkms package versions

  * [Ubuntu 21.04 FEAT] mpt3sas: Request to include the patch set which supports
    topology where zoning is enabled in expander (LP: #1899802)
    - scsi: mpt3sas: Define hba_port structure
    - scsi: mpt3sas: Allocate memory for hba_port objects
    - scsi: mpt3sas: Rearrange _scsih_mark_responding_sas_device()
    - scsi: mpt3sas: Update hba_port's sas_address & phy_mask
    - scsi: mpt3sas: Get device objects using sas_address & portID
    - scsi: mpt3sas: Rename transport_del_phy_from_an_existing_port()
    - scsi: mpt3sas: Get sas_device objects using device's rphy
    - scsi: mpt3sas: Update hba_port objects after host reset
    - scsi: mpt3sas: Set valid PhysicalPort in SMPPassThrough
    - scsi: mpt3sas: Handling HBA vSES device
    - scsi: mpt3sas: Add bypass_dirty_port_flag parameter
    - scsi: mpt3sas: Handle vSES vphy object during HBA reset
    - scsi: mpt3sas: Add module parameter multipath_on_hba
    - scsi: mpt3sas: Bump driver version to 35.101.00.00

  * CVE-2020-12912
    - hwmon: (amd_energy) modify the visibility of the counters

  * Intel Tiger Lake IDs supplement (LP: #1904521)
    - mtd: spi-nor: intel-spi: Add support for Intel Tiger Lake-H SPI serial flash
    - pinctrl: tigerlake: Add support for Tiger Lake-H

  * [i915] Noise-like lines of graphics corruption when moving windows in Xorg
    sessions (LP: #1896091)
    - Revert "UBUNTU: SAUCE: drm/i915: Synchronize active and retire callbacks"

  * Fix no headset sound after S3 on Intel HDA (LP: #1904595)
    - ALSA: hda: Refactor codec PM to use direct-complete optimization
    - ALSA: hda: Separate runtime and system suspend
    - ALSA: hda: Reinstate runtime_allow() for all hda controllers

  * Ask 8821C Bluetooth controller to drop old firmware (LP: #1904221)
    - Bluetooth: btrtl: Ask 8821C to drop old firmware
    - Bluetooth: btrtl: fix incorrect skb allocation failure check

  * Use ACPI S5 for reboot (LP: #1904225)
    - PM: ACPI: reboot: Use S5 for reboot

  * Groovy update: v5.8.18 upstream stable release (LP: #1904941)
    - netfilter: nftables_offload: KASAN slab-out-of-bounds Read in
      nft_flow_rule_create
    - io_uring: don't run task work on an exiting task
    - io_uring: allow timeout/poll/files killing to take task into account
    - io_uring: move dropping of files into separate helper
    - io_uring: stash ctx task reference for SQPOLL
    - io_uring: unconditionally grab req->task
    - io_uring: return cancelation status from poll/timeout/files handlers
    - io_uring: enable task/files specific overflow flushing
    - io_uring: don't rely on weak ->files references
    - io_uring: reference ->nsproxy for file table commands
    - io_wq: Make io_wqe::lock a raw_spinlock_t
    - io-wq: fix use-after-free in io_wq_worker_running
    - io_uring: no need to call xa_destroy() on empty xarray
    - io_uring: Fix use of XArray in __io_uring_files_cancel
    - io_uring: Fix XArray usage in io_ur...

Read more...

Changed in linux (Ubuntu Groovy):
status: Fix Committed → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (23.0 KiB)

This bug was fixed in the package linux-oem-5.6 - 5.6.0-1039.43

---------------
linux-oem-5.6 (5.6.0-1039.43) focal; urgency=medium

  * focal/linux-oem-5.6: 5.6.0-1039.43 -proposed tracker (LP: #1909420)

  * Fix suspend error of SOF driver (LP: #1908713)
    - Revert "ALSA: hda: Refactor codec PM to use direct-complete optimization"

  * Packaging resync (LP: #1786013)
    - [Packaging] update variants

  * Killer 500s (QCA6390) WLAN/BT [17cb:1101] unavailable (LP: #1879633)
    - Bluetooth: btusb: Add flag to define wideband speech capability
    - Bluetooth: Support querying for WBS support through MGMT
    - Bluetooth: Enable erroneous data reporting if WBS is supported
    - Bluetooth: Increment management interface revision
    - Bluetooth: fix off by one in err_data_reporting cmd masks.
    - Bluetooth: mgmt: add mgmt_cmd_status in add_advertising
    - mac80211: add 802.11 encapsulation offloading support
    - mac80211: fix tx status for no ack cases
    - nl80211: add handling for BSS color
    - mac80211: add handling for BSS color
    - mac80211: allow setting queue_len for drivers not using wake_tx_queue
    - Bluetooth: hci_qca: Enable clocks required for BT SOC
    - Bluetooth: hci_qca: Optimized code while enabling clocks for BT SOC
    - mac80211: fix 11w when using encapsulation offloading
    - ath11k: Silence clang -Wsometimes-uninitialized in
      ath11k_update_per_peer_stats_from_txcompl
    - ath11k: drop tx_info from ath11k_sta
    - ath11k: add HE rate accounting to driver
    - ath11k: fix rcu lock protect in peer assoc confirmation
    - ath11k: fix warn-on in disassociation
    - ath11k: fix parsing PPDU_CTRL type in pktlog
    - ath11k: Fixing dangling pointer issue upon peer delete failure
    - ath11k: fix incorrect peer stats counters update
    - Bluetooth: hci_qca: Bug fixes while collecting controller memory dump
    - net: qrtr: Migrate nameservice to kernel from userspace
    - net: qrtr: Fix the local node ID as 1
    - net: qrtr: fix spelling mistake "serivce" -> "service"
    - net: qrtr: Fix error pointer vs NULL bugs
    - Bluetooth: Replace zero-length array with flexible-array member
    - Bluetooth: hci_qca: Not send vendor pre-shutdown command for QCA Rome
    - Bluetooth: btqca: Fix the NVM baudrate tag offcet for wcn3991
    - net: qrtr: Respond to HELLO message
    - net: qrtr: Fix FIXME related to qrtr_ns_init()
    - soc: qcom: Do not depend on ARCH_QCOM for QMI helpers
    - Bluetooth: hci_qca: Make bt_en and susclk not mandatory for QCA Rome
    - Bluetooth: hci_qca: Replace devm_gpiod_get() with devm_gpiod_get_optional()
    - ath11k: config reorder queue for all tids during peer setup
    - ath11k: add thermal cooling device support
    - ath11k: add thermal sensor device support
    - ath11k: Use scnprintf() for avoiding potential buffer overflow
    - ath11k: handle RX fragments
    - ath11k: enable PN offload
    - ath11k: set queue_len to 4096
    - ath11k: add WMI calls required for handling BSS color
    - ath11k: add handling for BSS color
    - ath11k: Supporting RX ring backpressure HTT event and stats handling
    - ath11k: fill channel info from rx channel
    - ath11k: dum...

Changed in linux-oem-5.6 (Ubuntu Focal):
status: Fix Committed → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package linux - 5.8.0-36.40+21.04.1

---------------
linux (5.8.0-36.40+21.04.1) hirsute; urgency=medium

  * Packaging resync (LP: #1786013)
    - update dkms package versions

  [ Ubuntu: 5.8.0-36.40 ]

  * debian/scripts/file-downloader does not handle positive failures correctly
    (LP: #1878897)
    - [Packaging] file-downloader not handling positive failures correctly

  [ Ubuntu: 5.8.0-35.39 ]

  * Packaging resync (LP: #1786013)
    - update dkms package versions
  * CVE-2021-1052 // CVE-2021-1053
    - [Packaging] NVIDIA -- Add the NVIDIA 460 driver

 -- Kleber Sacilotto de Souza <email address hidden> Thu, 07 Jan 2021 11:57:30 +0100

Changed in linux (Ubuntu):
status: Confirmed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.