Re: [RFC PATCH bluetooth-next] Bluetooth: hci_event: Use General Bonding for ATS2851

[Luiz Augusto von Dentz]

Hi,

On Thu, Aug 20, 2026 at 10:06 AM Li Daoxun <lidaoxun25@xxxxxxxxxxxxxxxx> wrote:
>
> Actions Semiconductor ATS2851 controllers can stall BR/EDR Secure
> Simple Pairing when the host replies to an IO Capability Request with
> Dedicated Bonding.
>
> This was observed with an Actions controller at USB ID 10d7:b012,
> revision 88.91, while pairing a Sony WF-C510. After the host sent
> Dedicated Bonding, no peer IO Capability Response arrived and the local
> host disconnected after approximately 30 seconds.
>
> Sending General Bonding instead allowed the IO capability exchange to
> continue, followed by successful Simple Pairing, link key notification
> and encryption.
>
> Add a quirk that substitutes General Bonding in the HCI IO Capability
> Reply while preserving the MITM bit and the connection authentication
> state. Enable it for ATS2851 based devices.
>
> Signed-off-by: Li Daoxun <lidaoxun25@xxxxxxxxxxxxxxxx>
> ---
>  drivers/bluetooth/btusb.c   |  1 +
>  include/net/bluetooth/hci.h | 10 ++++++++++
>  net/bluetooth/hci_event.c   |  4 ++++
>  3 files changed, 15 insertions(+)
>
> diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
> index 2bae85b001..e82cb0c44c 100644
> --- a/drivers/bluetooth/btusb.c
> +++ b/drivers/bluetooth/btusb.c
> @@ -4384,6 +4384,7 @@ static int btusb_probe(struct usb_interface *intf,
>                 hci_set_quirk(hdev, HCI_QUIRK_BROKEN_READ_ENC_KEY_SIZE);
>                 hci_set_quirk(hdev, HCI_QUIRK_BROKEN_EXT_CREATE_CONN);
>                 hci_set_quirk(hdev, HCI_QUIRK_BROKEN_WRITE_AUTH_PAYLOAD_TIMEOUT);
> +               hci_set_quirk(hdev, HCI_QUIRK_BROKEN_DEDICATED_BONDING);
>         }
>
>         if (!reset)
> diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
> index 1641d879db..ee01795ea5 100644
> --- a/include/net/bluetooth/hci.h
> +++ b/include/net/bluetooth/hci.h
> @@ -320,6 +320,16 @@ enum {
>          */
>         HCI_QUIRK_BROKEN_WRITE_AUTH_PAYLOAD_TIMEOUT,
>
> +       /*
> +        * When this quirk is set, Dedicated Bonding authentication
> +        * requirements are sent to the controller as General Bonding while
> +        * preserving the MITM requirement. This is required for Actions
> +        * Semiconductor ATS2851 based controllers, which can fail to continue
> +        * the SSP IO capability exchange with some peers when Dedicated Bonding
> +        * is used.
> +        */
> +       HCI_QUIRK_BROKEN_DEDICATED_BONDING,

I don't think that works out, though; dedicated bonding is used to
persist the bonding, usually triggered with devices like the
Device.Pair() method, so I don't think we can really just switch to
general bonding and expect it to work.

>         /* When this quirk is set, MSFT extension monitor tracking by
>          * address filter is supported. Since tracking quantity of each
>          * pattern is limited, this feature supports tracking multiple
> diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
> index 2f5e21ff97..5496913d8d 100644
> --- a/net/bluetooth/hci_event.c
> +++ b/net/bluetooth/hci_event.c
> @@ -5386,6 +5386,10 @@ static void hci_io_capa_request_evt(struct hci_dev *hdev, void *data,
>                         conn->auth_type &= HCI_AT_NO_BONDING_MITM;
>
>                 cp.authentication = conn->auth_type;
> +               if (hci_test_quirk(hdev, HCI_QUIRK_BROKEN_DEDICATED_BONDING) &&
> +                   (cp.authentication & ~0x01) == HCI_AT_DEDICATED_BONDING)
> +                       cp.authentication = HCI_AT_GENERAL_BONDING |
> +                                           (cp.authentication & 0x01);
>                 cp.oob_data = bredr_oob_data_present(conn);
>
>                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
> --
> 2.43.0
>


-- 
Luiz Augusto von Dentz