[PATCH v9 0/6] Bluetooth: btmtk: Add MT7928 support

[Chris Lu (陸稚泓)]

Hi Luiz,

On Thu, 2026-07-02 at 18:14 +0800, Chris Lu wrote:
> This patch series adds support for MT7928 (device ID 0x7935) to the
> btmtk driver, which requires a new two-stage firmware loading process
> with CBMCU firmware.
> 
> The series is organized to fix existing issues first, then improve
> code
> quality, and finally add new functionality:
> 
> Patch 1 fixes a pre-existing security issue in
> btmtk_setup_firmware_79xx()
> by adding comprehensive firmware size validation to prevent out-of-
> bounds
> memory access with truncated or malicious firmware files.
> 
> Patch 2 fixes a pre-existing bug in btmtksdio_setup() where
> btmtk_fw_get_filename() generates the correct firmware path but is
> immediately overwritten by snprintf() with a generic legacy format,
> causing newer chips to request incorrect filenames.
> 
> Patch 3 fixes a regression introduced in commit 28b7c5a6db74
> ("Bluetooth: btmtk: Add MT6639 (MT7927) Bluetooth support") where
> SDIO devices would incorrectly log "BT HW ver: 0x0000" due to
> hardcoded dev_id=0.
> 
> Patch 4 refactors existing firmware download code by replacing magic
> numbers with a descriptive BTMTK_WMT_PKT_* enum, making the packet
> sequencing logic clearer.
> 
> Patch 5 improves BT firmware logging to provide more useful
> information
> for debugging: adds firmware filename before loading and displays
> chip ID
> as HW version instead of firmware's hwver field.
> 
> Patch 6 implements MT7928 firmware download flow, which requires
> loading
> CBMCU firmware before Bluetooth firmware. The CBMCU firmware uses a
> two-phase download sequence: Phase 1 downloads the section containing
> global descriptor and signature data, Phase 2 downloads the remaining
> firmware sections.
> 
> Tested on MT7928 hardware with successful firmware loading and
> Bluetooth functionality verification.
> 
> Changes in v9:
> - Reorder patches to group SDIO fixes together (Patch 2-3)
> - Patch 1 (was Patch 2): Fix firmware size validation in
>   btmtk_setup_firmware_79xx()
> - Patch 2 (was Patch 1): Fix firmware filename override in
>   btmtksdio_setup()
>   btmtk_fw_get_filename() result was incorrectly overwritten by
>   snprintf()
> 
> Changes in v8:
> - Add Patch 1 (now Patch 2) to fix firmware size validation in
>   btmtk_setup_firmware_79xx()
> - Add Patch 2 (now Patch 3) to fix SDIO device logging regression
>   SDIO devices were passing hardcoded 0, causing "BT HW ver: 0x0000"
> log
> 
> Changes in v7:
> - Patch 4 (was Patch 1): Extend magic number refactoring to
>   btmtk_setup_firmware() in addition to btmtk_setup_firmware_79xx()
> for
>   consistency
> - Patch 5 (was Patch 2): Fix potential buffer over-read by
>   using %.16s format specifier for hdr->datetime which is a 16-byte
>   array that may not be null-terminated
> - Patch 6 (was Patch 3): Apply same %.16s fix to CBMCU firmware
> logging
> 
> Changes in v6:
> - Fix timeout handling in btmtk_cbmcu_patch_status() to return -
> ETIMEDOUT
>   instead of success when polling exhausts retry count
> - Add integer overflow protection in btmtk_load_cbmcu_firmware()
> using
>   check_mul_overflow() and check_add_overflow()
> 
> Changes in v5:
> - Split into three patches: refactoring, logging improvement, and
>   new feature
> - Add Patch 5 (was Patch 2) to improve BT firmware logging
>   independently
> - Apply same logging improvements to CBMCU firmware in Patch 6
>   (was Patch 3)
> 
> Changes in v4:
> - Split into two patches: refactoring and new feature
> - Add BTMTK_WMT_PKT_* enum to improve code readability
> - Replace magic numbers (0xF0, 0xF1) with descriptive macros
> 
> Changes in v3:
> - Add firmware size validation with bounds checking
> - Improve error messages with context information
> 
> Changes in v2:
> - Simplified enum usage by consolidating status definitions
> 
> Chris Lu (6):
>   Bluetooth: btmtk: Add firmware size validation in
>     btmtk_setup_firmware_79xx()
>   Bluetooth: btmtksdio: Remove redundant firmware filename override
>   Bluetooth: btmtksdio: Pass hardware dev_id to mt79xx_setup()
>   Bluetooth: btmtk: Replace magic numbers with WMT packet flag enum
>   Bluetooth: btmtk: Improve BT firmware logging
>   Bluetooth: btmtk: Add MT7928 support
> 
>  drivers/bluetooth/btmtk.c     | 427
> +++++++++++++++++++++++++++++++++-
>  drivers/bluetooth/btmtk.h     |   9 +
>  drivers/bluetooth/btmtksdio.c |   9 +-
>  3 files changed, 430 insertions(+), 15 deletions(-)
> 

https://sashiko.dev/#/patchset/20260702101437.1787800-1-chris.lu%40mediatek.com
Sashiko still has one comment on my patch v9, but it states that the
potential risk is unrelated to my change on btmtksdio.c and may be an
existing issue. Regarding this comment, I lean toward addressing it in
the future, focus on MT7928 this time. I'm not sure whether you would
agree to merge the v9 changes first.

Thanks a lot!
Chris Lu