[PATCH BlueZ 0/3] emulator: Fix extended advertising report types

[PATCH BlueZ 0/3] emulator: Fix extended advertising report types

[Kevin Dewald]

btdev sends the wrong Event_Type in two of the LE Extended Advertising
Reports it generates for an advertising set:

- the scan response to non-legacy scannable advertising is reported
  with Event_Type 0x0000 instead of 0x000a
- with more than one active scanner, every scanner after the first gets
  the advertisement reported as a scan response

The first patch removes le_ext_adv_type, which sits next to this code
and has been unused since advertising sets got their own struct.

I reproduced both with a small test driving an advertiser and two
scanners in-process. On master it shows:

  scannable set: scan response 0x0000, expected 0x000a
  two scanners:  scanner 1 adv 0x001b, expected 0x0013

I can send it as a unit test if that would be useful.

mgmt-tester, iso-tester and smp-tester give the same results with and
without the series, apart from LL Privacy tests that fail
intermittently on both.

Kevin Dewald (3):
  emulator: Remove unused le_ext_adv_type
  emulator: Fix extended scan response Event_Type
  emulator: Fix report type after a scan response

 emulator/btdev.c | 37 ++++++-------------------------------
 1 file changed, 6 insertions(+), 31 deletions(-)

-- 
2.54.0 (Apple Git-157)

[PATCH BlueZ 1/3] emulator: Remove unused le_ext_adv_type

[Kevin Dewald]

Nothing has read le_ext_adv_type since advertising sets got their own
struct le_ext_adv in commit 5145b1ea2e95 ("emulator/btdev: Add support
multiple instance of extended advertising"). Remove it along with
ext_legacy_adv_type, rather than fix that function's mapping of low
duty cycle directed advertising (0x04) to ADV_SCAN_IND.

Assisted-by: Claude:claude-opus-5.5
---
 emulator/btdev.c | 27 ---------------------------
 1 file changed, 27 deletions(-)

diff --git a/emulator/btdev.c b/emulator/btdev.c
index 26a8aff62..30eb183c0 100644
--- a/emulator/btdev.c
+++ b/emulator/btdev.c
@@ -269,8 +269,6 @@ struct btdev {
 	uint32_t sync_train_timeout;
 	uint8_t  sync_train_service_data;
 
-	uint16_t le_ext_adv_type;
-
 	); /* reset_group */
 
 	/* Real time length of AL array */
@@ -3773,29 +3771,6 @@ done:
 	return 0;
 }
 
-static uint16_t ext_legacy_adv_type(uint8_t type)
-{
-	switch (type) {
-	case 0x00:
-		/* Connectable undirected - ADV_IND" */
-		return 0x0013;
-	case 0x01:
-		/* Connectable directed - ADV_DIRECT_IND */
-		return 0x0015;
-	case 0x02:
-		/* Scannable undirected - ADV_SCAN_IND */
-		return 0x0012;
-	case 0x03:
-		/* Non connectable undirected - ADV_NONCONN_IND */
-		return 0x0010;
-	case 0x04:
-		/* Scan response - SCAN_RSP */
-		return 0x0012;
-	}
-
-	return 0x0000;
-}
-
 static int cmd_set_adv_params(struct btdev *dev, const void *data, uint8_t len)
 {
 	const struct bt_hci_cmd_le_set_adv_parameters *cmd = data;
@@ -3807,8 +3782,6 @@ static int cmd_set_adv_params(struct btdev *dev, const void *data, uint8_t len)
 	}
 
 	dev->le_adv_type = cmd->type;
-	/* Use Legacy PDU if the remote is using EXT Scan */
-	dev->le_ext_adv_type = ext_legacy_adv_type(cmd->type);
 	dev->le_adv_own_addr = cmd->own_addr_type;
 	dev->le_adv_direct_addr_type = cmd->direct_addr_type;
 	memcpy(dev->le_adv_direct_addr, cmd->direct_addr, 6);
-- 
2.54.0 (Apple Git-157)

[PATCH BlueZ 2/3] emulator: Fix extended scan response Event_Type

[Kevin Dewald]

The scan response to non-legacy scannable advertising was reported with
Event_Type 0x0000, since the scan response bit was masked instead of
set, so hosts saw it as a separate non-connectable advertisement.

Fixes: 32339501a125 ("emulator: Add 5.0 feature support")
Assisted-by: Claude:claude-opus-5.5
---
 emulator/btdev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/emulator/btdev.c b/emulator/btdev.c
index 30eb183c0..e11857c3b 100644
--- a/emulator/btdev.c
+++ b/emulator/btdev.c
@@ -5542,7 +5542,7 @@ static bool ext_adv_broadcast(void *user_data)
 			else if (ext_adv->type == 0x12)
 				report_type = 0x1a;
 			else if (!(ext_adv->type & 0x10))
-				report_type &= 0x08;
+				report_type |= 0x08;
 			else
 				continue;
 
-- 
2.54.0 (Apple Git-157)

[PATCH BlueZ 3/3] emulator: Fix report type after a scan response

[Kevin Dewald]

ext_adv_broadcast stored the scan response type in report_type, which
is also used for the advertising report to the next scanner, so every
active scanner after the first got the advertisement reported as a scan
response.

Fixes: 32339501a125 ("emulator: Add 5.0 feature support")
Assisted-by: Claude:claude-opus-5.5
---
 emulator/btdev.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/emulator/btdev.c b/emulator/btdev.c
index e11857c3b..e00f78288 100644
--- a/emulator/btdev.c
+++ b/emulator/btdev.c
@@ -5537,17 +5537,19 @@ static bool ext_adv_broadcast(void *user_data)
 
 		/* if scannable bit is set the send scan response */
 		if (ext_adv->type & 0x02) {
+			uint16_t rsp_type;
+
 			if (ext_adv->type == 0x13)
-				report_type = 0x1b;
+				rsp_type = 0x1b;
 			else if (ext_adv->type == 0x12)
-				report_type = 0x1a;
+				rsp_type = 0x1a;
 			else if (!(ext_adv->type & 0x10))
-				report_type |= 0x08;
+				rsp_type = report_type | 0x08;
 			else
 				continue;
 
 			send_ext_adv(btdev_list[i], btdev, ext_adv,
-							report_type, true);
+							rsp_type, true);
 		}
 	}
 
-- 
2.54.0 (Apple Git-157)

RE: emulator: Fix extended advertising report types

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1160 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1179769/

---Test result---

Test Summary:
CheckPatch                    PASS      0.94 seconds
GitLint                       PASS      1.09 seconds
BuildEll                      PASS      19.55 seconds
BluezMake                     PASS      384.09 seconds
CheckSmatch                   WARNING   292.94 seconds
bluezmakeextell               PASS      93.64 seconds
TestFunctional                PASS      1127.10 seconds
IncrementalBuild              PASS      390.07 seconds
ScanBuild                     PASS      1108.07 seconds

Details
##############################
Test: CheckSmatch - WARNING
Desc: Run smatch tool with source
Output:
emulator/btdev.c:479:29: warning: Variable length array is used.emulator/btdev.c:479:29: warning: Variable length array is used.emulator/btdev.c:479:29: warning: Variable length array is used.


https://github.com/bluez/bluez/pull/2628

---
Regards,
Linux Bluetooth

Re: [PATCH BlueZ 0/3] emulator: Fix extended advertising report types

[patchwork-bot+bluetooth]

Hello:

This series was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Mon,  5 Oct 2026 09:21:14 -0700 you wrote:
> btdev sends the wrong Event_Type in two of the LE Extended Advertising
> Reports it generates for an advertising set:
> 
> - the scan response to non-legacy scannable advertising is reported
>   with Event_Type 0x0000 instead of 0x000a
> - with more than one active scanner, every scanner after the first gets
>   the advertisement reported as a scan response
> 
> [...]

Here is the summary with links:
  - [BlueZ,1/3] emulator: Remove unused le_ext_adv_type
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=28cfa93135d4
  - [BlueZ,2/3] emulator: Fix extended scan response Event_Type
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=11f99edc26c7
  - [BlueZ,3/3] emulator: Fix report type after a scan response
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=73d7f86a117a

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html