github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-11 20:13:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Bluetooth: hci_sync: Fix not setting CE length properly

Browse Source 
Both hci_le_set_def_rate_sync() and hci_le_conn_rate_request_sync() were
leaving Min_CE_Length and Max_CE_Length set to 0x0000, but the connection
event length recommended in requests by a Peripheral has a valid range of
0x0001 to 0x7CFF (Time = N * 125 us, Time Range: 0.125 ms to 3.999875 s),
so 0x0000 cannot be used.

Set both to the minimum valid value, which is safe since the Controller
is not required to use these values:

BLUETOOTH CORE SPECIFICATION Version 6.2 | Vol 4, Part E
7.8.157. LE Connection Rate Request command
7.8.158. LE Set Default Rate Parameters command

The Min_CE_Length and Max_CE_Length parameters provide the Controller
with the expected minimum and maximum length of the connection events.
The Controller is not required to use these values.

Fixes: 2f8784cfe8 ("Bluetooth: Add support for Shorter Connection Interval (SCI) feature")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This commit is contained in:
Luiz Augusto von Dentz 2026-09-02 13:16:26 -04:00
parent 3dd1b41f96
commit 3621f78d43
1 changed files with 36 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
net/bluetooth/hci_sync.c
View File

@ -4797,6 +4797,24 @@ static int hci_le_set_def_rate_sync(struct hci_dev *hdev)
cp.cont_num = cpu_to_le16(0x0001);
cp.supv_timeout = cpu_to_le16(0x000c); /* 120 ms */
/* The connection event length recommended in requests by a Peripheral
* uses units of 125 us with a valid range of 0x0001 to 0x7CFF
* (0.125 ms to 3.999875 s), so 0x0000 cannot be used. Also note that
* the Controller is not required to use these values:
*
* BLUETOOTH CORE SPECIFICATION Version 6.2 | Vol 4, Part E
* 7.8.158. LE Set Default Rate Parameters command
*
* The Min_CE_Length and Max_CE_Length parameters provide the
* Controller with the expected minimum and maximum length of the
* connection events. The Controller is not required to use these
* values.
*
* So it is safe to just use the minimum.
*/
cp.min_ce_len = cpu_to_le16(0x0001);
cp.max_ce_len = cpu_to_le16(0x0001);
return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_DEF_RATE,
sizeof(cp), &cp, HCI_CMD_TIMEOUT);
}
@ -7467,8 +7485,24 @@ static int hci_le_conn_rate_request_sync(struct hci_dev *hdev, void *data)
cp.max_latency = cpu_to_le16(params->max_latency);
cp.cont_num = cpu_to_le16(params->cont_num);
cp.supv_timeout = cpu_to_le16(params->rate_supv_timeout);
cp.min_ce_len = cpu_to_le16(0x0000);
cp.max_ce_len = cpu_to_le16(0x0000);
/* The connection event length recommended in requests by a Peripheral
* uses units of 125 us with a valid range of 0x0001 to 0x7CFF
* (0.125 ms to 3.999875 s), so 0x0000 cannot be used. Also note that
* the Controller is not required to use these values:
*
* BLUETOOTH CORE SPECIFICATION Version 6.2 | Vol 4, Part E
* 7.8.157. LE Connection Rate Request command
*
* The Min_CE_Length and Max_CE_Length parameters provide the
* Controller with the expected minimum and maximum length of the
* connection events. The Controller is not required to use these
* values.
*
* So it is safe to just use the minimum.
*/
cp.min_ce_len = cpu_to_le16(0x0001);
cp.max_ce_len = cpu_to_le16(0x0001);
hci_dev_unlock(hdev);