Patch "Bluetooth: Add new quirk for broken read key length on ATS2851" has been added to the 6.8-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    Bluetooth: Add new quirk for broken read key length on ATS2851

to the 6.8-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bluetooth-add-new-quirk-for-broken-read-key-length-o.patch
and it can be found in the queue-6.8 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 706aface76b3d7cef9716ad65f1f987d5da90140
Author: Vinicius Peixoto <nukelet64@xxxxxxxxx>
Date:   Mon Feb 26 22:43:26 2024 -0300

    Bluetooth: Add new quirk for broken read key length on ATS2851
    
    [ Upstream commit 48201a3b3f398be6a01f78a14b18bd5d31c47458 ]
    
    The ATS2851 controller erroneously reports support for the "Read
    Encryption Key Length" HCI command. This makes it unable to connect
    to any devices, since this command is issued by the kernel during the
    connection process in response to an "Encryption Change" HCI event.
    
    Add a new quirk (HCI_QUIRK_BROKEN_ENC_KEY_SIZE) to hint that the command
    is unsupported, preventing it from interrupting the connection process.
    
    This is the error log from btmon before this patch:
    
    > HCI Event: Encryption Change (0x08) plen 4
            Status: Success (0x00)
            Handle: 2048 Address: ...
            Encryption: Enabled with E0 (0x01)
    < HCI Command: Read Encryption Key Size (0x05|0x0008) plen 2
            Handle: 2048 Address: ...
    > HCI Event: Command Status (0x0f) plen 4
          Read Encryption Key Size (0x05|0x0008) ncmd 1
            Status: Unknown HCI Command (0x01)
    
    Signed-off-by: Vinicius Peixoto <nukelet64@xxxxxxxxx>
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 6cb87d47ad7d5..f684108dc2f1c 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -4483,6 +4483,7 @@ static int btusb_probe(struct usb_interface *intf,
 		set_bit(HCI_QUIRK_BROKEN_READ_TRANSMIT_POWER, &hdev->quirks);
 		set_bit(HCI_QUIRK_BROKEN_SET_RPA_TIMEOUT, &hdev->quirks);
 		set_bit(HCI_QUIRK_BROKEN_EXT_SCAN, &hdev->quirks);
+		set_bit(HCI_QUIRK_BROKEN_READ_ENC_KEY_SIZE, &hdev->quirks);
 	}
 
 	if (!reset)
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 03e68a8e229f5..35c5f75a3a5ee 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -339,6 +339,14 @@ enum {
 	 * during the hdev->setup vendor callback.
 	 */
 	HCI_QUIRK_BROKEN_LE_CODED,
+
+	/*
+	 * When this quirk is set, the HCI_OP_READ_ENC_KEY_SIZE command is
+	 * skipped during an HCI_EV_ENCRYPT_CHANGE event. This is required
+	 * for Actions Semiconductor ATS2851 based controllers, which erroneously
+	 * claim to support it.
+	 */
+	HCI_QUIRK_BROKEN_READ_ENC_KEY_SIZE,
 };
 
 /* HCI device flags */
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 3b63513f57ba8..3992e18f0babb 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -3679,7 +3679,8 @@ static void hci_encrypt_change_evt(struct hci_dev *hdev, void *data,
 		 * controller really supports it. If it doesn't, assume
 		 * the default size (16).
 		 */
-		if (!(hdev->commands[20] & 0x10)) {
+		if (!(hdev->commands[20] & 0x10) ||
+		    test_bit(HCI_QUIRK_BROKEN_READ_ENC_KEY_SIZE, &hdev->quirks)) {
 			conn->enc_key_size = HCI_LINK_KEY_SIZE;
 			goto notify;
 		}