[PATCH v3 0/4] Bluetooth: Advertising sets on a single-set controller

[PATCH v3 0/4] Bluetooth: Advertising sets on a single-set controller

[Weihong Guan]

When the controller supports a single advertising set,
hci_add_adv_instance() gives instance 1 handle 0x00, the handle Global
Advertising uses too. The parameters, data and enable commands already
use adv->handle; these patches cover what still takes the instance
number for the handle: setting the set's random address, removing the
set, and the Advertising Set Terminated event (with a helper to free an
instance already found).

Changes in v3, addressing Luiz's review of v2's patch 3:

 - Patch 3 (new): hci_free_adv_instance() frees an instance already
   found; hci_remove_adv_instance() looks it up and calls it, so its
   other callers are unchanged.
 - Patch 4 (v2's patch 3): on an error, the instance found is freed
   with hci_free_adv_instance() rather than looked up again by
   hci_remove_adv_instance().
 - Shorter titles for patches 1 and 4 (GitLint).

Changes in v2, addressing the review at
https://sashiko.dev/#/patchset/20261023132421.1889022-1-weihong.guan%40gmail.com
(I hadn't seen it, sorry):

 - The instance is looked up, and adv->handle read, with hdev->lock held.
 - Patch 1: hci_cc_le_set_adv_set_random_addr() records the address of
   the instance numbered as the handle and leaves handle 0x00 alone, so
   instance 1's address on handle 0x00 went unrecorded. It is now
   recorded in hci_set_adv_set_random_addr_sync() when the instance and
   its handle differ.
 - Patch 2: hci_cc_le_remove_adv_set() looked up instance 0 for handle
   0x00 and left instance 1 in hdev->adv_instances. The completion can't
   tell instance 1 from instance 0, which MGMT's Set Advertising also
   removes on handle 0x00, so instance 1 is removed in
   hci_remove_ext_adv_instance_sync() once the command succeeds.
 - Patch 2: while Global Advertising is on it owns handle 0x00, and the
   controller would refuse to remove an enabled set, so only the instance
   is removed then.
 - Patch 3 (new; patch 4 in v3): the Advertising Set Terminated event
   finds the instance owning handle 0x00, the one enabled on it as
   hci_le_ext_adv_set_enabled() tracks, for the connection's responder
   address (which SMP checks), the instance re-enabled after the
   disconnection, and the removal on an error.

Tested again with v3 on a Raspberry Pi 5 (rpi-7.4.y, 7.4-rc2, with
net/bluetooth and include/net/bluetooth from bluetooth-next and these
patches) with a controller reporting one advertising set (LE Read
Number of Supported Advertising Sets = 1), btmgmt and btmon:

  - A non-connectable instance (a random address) starts: its address
    goes to handle 0x00 and the set advertises from it.
  - Removing it sends LE Remove Advertising Set for handle 0x00; the
    instance leaves the list (Read Advertising Features: none) and
    Advertising Removed goes out.
  - An instance with a timeout (btmgmt add-adv -t 2): the controller
    ends the set with Advertising Set Terminated, Advertising Timeout
    (0x3c), for handle 0x00; instance 1 is freed as found (patch 4), no
    LE Remove Advertising Set is sent, and Advertising Removed goes out
    for instance 1.
  - With Global Advertising on, removing instance 1 sends no LE Remove
    Advertising Set, the instance still leaves the list, and the set
    keeps advertising for Global Advertising.
  - A connectable instance from a random static address
    (force_static_address) on handle 0x00: Advertising Set Terminated
    for handle 0x00, LE Secure Connections pairing completes (DHKey
    Check both ways, so the responder address is the one advertised),
    and after the disconnection instance 1 advertises again.

Built with W=1; checkpatch clean but for the Assisted-by tag.

v2: https://lore.kernel.org/linux-bluetooth/20261111010940.728149-1-weihong.guan@gmail.com/
v1: https://lore.kernel.org/linux-bluetooth/20261023132421.1889022-1-weihong.guan@gmail.com/

Weihong Guan (4):
  Bluetooth: hci_sync: Set random address on the set's handle
  Bluetooth: hci_sync: Remove an advertising set by its handle
  Bluetooth: hci_core: Add hci_free_adv_instance()
  Bluetooth: hci_event: Find the owner of a terminated adv set

 include/net/bluetooth/hci_core.h |  1 +
 net/bluetooth/hci_core.c         | 24 +++++---
 net/bluetooth/hci_event.c        | 42 ++++++++++----
 net/bluetooth/hci_sync.c         | 94 +++++++++++++++++++++++++++++---
 4 files changed, 132 insertions(+), 29 deletions(-)


base-commit: def8a484b8883cd21d44a2a45702dcced9bf2627
-- 
2.47.3

[PATCH v3 1/4] Bluetooth: hci_sync: Set random address on the set's handle

[Weihong Guan]

When the controller supports a single advertising set,
hci_add_adv_instance() gives instance 1 handle 0x00, and the parameters,
data and enable commands for an instance use adv->handle. LE Set
Advertising Set Random Address, from hci_set_adv_set_random_addr_sync(),
still sends the instance number, 0x01, a set the controller doesn't
have, so an instance using a random address, such as a non-connectable
one, never starts:

  $ btmgmt add-adv -d 0A09434841445654455354 1
  Add Advertising failed with status 0x0d (Invalid Parameters)

  < HCI Command: LE Set Extended Advertising Parameters  Handle: 0x00
  < HCI Command: LE Set Extended Advertising Data        Handle: 0x00
  < HCI Command: LE Set Advertising Set Random Address
        Advertising handle: 0x01

Send the instance's handle, looked up with hdev->lock held.

hci_cc_le_set_adv_set_random_addr() records the address in the instance
numbered as the handle and leaves handle 0x00 alone, as that handle's
address is hdev->random_addr for instance 0. Instance 1's address on
handle 0x00 would then go unrecorded, and its RPA timer never start, so
record it in hci_set_adv_set_random_addr_sync() once the command
succeeds, as the completion does for the other handles.

Fixes: e77f43d531af ("Bluetooth: hci_core: Fix not handling hdev->le_num_of_adv_sets=1")
Assisted-by: Claude:claude-opus-5.5
Signed-off-by: Weihong Guan <weihong.guan@gmail.com>
---
 net/bluetooth/hci_sync.c | 39 ++++++++++++++++++++++++++++++++++++---
 1 file changed, 36 insertions(+), 3 deletions(-)

diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index 9213e3ef9..320c5ba0d 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -1258,6 +1258,8 @@ static int hci_set_adv_set_random_addr_sync(struct hci_dev *hdev, u8 instance,
 					    bdaddr_t *random_addr)
 {
 	struct hci_cp_le_set_adv_set_rand_addr cp;
+	struct adv_info *adv;
+	u8 handle = instance;
 	int err;
 
 	if (!instance) {
@@ -1269,15 +1271,46 @@ static int hci_set_adv_set_random_addr_sync(struct hci_dev *hdev, u8 instance,
 		err = hci_set_random_addr_sync(hdev, random_addr);
 		if (err)
 			return err;
+	} else {
+		hci_dev_lock(hdev);
+		adv = hci_find_adv_instance(hdev, instance);
+		if (adv)
+			handle = adv->handle;
+		hci_dev_unlock(hdev);
 	}
 
 	memset(&cp, 0, sizeof(cp));
 
-	cp.handle = instance;
+	cp.handle = handle;
 	bacpy(&cp.bdaddr, random_addr);
 
-	return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_ADV_SET_RAND_ADDR,
-				     sizeof(cp), &cp, HCI_CMD_TIMEOUT);
+	err = __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_ADV_SET_RAND_ADDR,
+				    sizeof(cp), &cp, HCI_CMD_TIMEOUT);
+	if (err || handle == instance)
+		return err;
+
+	/* hci_cc_le_set_adv_set_random_addr() records the address of the
+	 * instance numbered as the handle, and leaves handle 0x00 to
+	 * hdev->random_addr, so record it here for an instance using another
+	 * handle: instance 1 on handle 0x00, on a controller supporting a
+	 * single advertising set.
+	 */
+	hci_dev_lock(hdev);
+
+	adv = hci_find_adv_instance(hdev, instance);
+	if (adv) {
+		bacpy(&adv->random_addr, random_addr);
+		if (!bacmp(&hdev->rpa, random_addr)) {
+			adv->rpa_expired = false;
+			queue_delayed_work(hdev->workqueue,
+					   &adv->rpa_expired_cb,
+					   secs_to_jiffies(hdev->rpa_timeout));
+		}
+	}
+
+	hci_dev_unlock(hdev);
+
+	return 0;
 }
 
 static int
-- 
2.47.3

RE: Bluetooth: Advertising sets on a single-set controller

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 4889 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1208570/

---Test result---

Test Summary:
CheckPatch                    FAIL      8.49 seconds
VerifyFixes                   PASS      6.43 seconds
VerifySignedoff               PASS      1.36 seconds
GitLint                       PASS      14.44 seconds
SubjectPrefix                 PASS      17.47 seconds
BuildKernel                   PASS      23.98 seconds
CheckAllWarning               PASS      27.11 seconds
CheckSparse                   WARNING   29.23 seconds
BuildKernel32                 PASS      24.75 seconds
CheckKernelLLVM               PASS      26.34 seconds
TestRunnerSetup               PASS      559.69 seconds
TestRunner_l2cap-tester       PASS      13.34 seconds
TestRunner_iso-tester         PASS      9.70 seconds
TestRunner_bnep-tester        PASS      2.91 seconds
TestRunner_mgmt-tester        PASS      84.50 seconds
TestRunner_rfcomm-tester      PASS      4.18 seconds
TestRunner_sco-tester         PASS      5.20 seconds
TestRunner_ioctl-tester       PASS      4.35 seconds
TestRunner_mesh-tester        PASS      5.23 seconds
TestRunner_smp-tester         PASS      4.05 seconds
TestRunner_userchan-tester    PASS      3.02 seconds
TestRunner_6lowpan-tester     PASS      4.19 seconds
IncrementalBuild              PASS      43.26 seconds

Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
[v3,1/4] Bluetooth: hci_sync: Set random address on the set's handle
WARNING: Non-standard signature: Assisted-by:
#147: 
Assisted-by: Claude:claude-opus-5.5

ERROR: Unrecognized email address: 'Claude:claude-opus-5.5'
#147: 
Assisted-by: Claude:claude-opus-5.5

total: 1 errors, 1 warnings, 0 checks, 57 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

/home/runner/work/bluetooth-next/bluetooth-next/src/patch/14973062.patch has style problems, please review.

NOTE: Ignored message types: UNKNOWN_COMMIT_ID

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.


[v3,2/4] Bluetooth: hci_sync: Remove an advertising set by its handle
WARNING: Non-standard signature: Assisted-by:
#151: 
Assisted-by: Claude:claude-opus-5.5

ERROR: Unrecognized email address: 'Claude:claude-opus-5.5'
#151: 
Assisted-by: Claude:claude-opus-5.5

total: 1 errors, 1 warnings, 0 checks, 68 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

/home/runner/work/bluetooth-next/bluetooth-next/src/patch/14973063.patch has style problems, please review.

NOTE: Ignored message types: UNKNOWN_COMMIT_ID

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.


[v3,3/4] Bluetooth: hci_core: Add hci_free_adv_instance()
WARNING: Non-standard signature: Assisted-by:
#130: 
Assisted-by: Claude:claude-opus-5.5

ERROR: Unrecognized email address: 'Claude:claude-opus-5.5'
#130: 
Assisted-by: Claude:claude-opus-5.5

total: 1 errors, 1 warnings, 0 checks, 45 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

/home/runner/work/bluetooth-next/bluetooth-next/src/patch/14973064.patch has style problems, please review.

NOTE: Ignored message types: UNKNOWN_COMMIT_ID

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.


[v3,4/4] Bluetooth: hci_event: Find the owner of a terminated adv set
WARNING: Non-standard signature: Assisted-by:
#144: 
Assisted-by: Claude:claude-opus-5.5

ERROR: Unrecognized email address: 'Claude:claude-opus-5.5'
#144: 
Assisted-by: Claude:claude-opus-5.5

total: 1 errors, 1 warnings, 0 checks, 74 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

/home/runner/work/bluetooth-next/bluetooth-next/src/patch/14973065.patch has style problems, please review.

NOTE: Ignored message types: UNKNOWN_COMMIT_ID

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.


##############################
Test: CheckSparse - WARNING
Desc: Run sparse tool with linux kernel
Output:
net/bluetooth/hci_event.c: note: in included file (through include/net/bluetooth/hci_core.h):


https://github.com/bluez/bluetooth-next/pull/1113

---
Regards,
Linux Bluetooth

[PATCH v3 2/4] Bluetooth: hci_sync: Remove an advertising set by its handle

[Weihong Guan]

When the controller supports a single advertising set,
hci_add_adv_instance() gives instance 1 handle 0x00, but
hci_remove_ext_adv_instance_sync() sends the instance number as the
handle of LE Remove Advertising Set, so removing instance 1 fails:

  $ btmgmt rm-adv 1
  Remove Advertising failed with status 0x03 (Failed)

  < HCI Command: LE Remove Advertising Set  Handle: 1
  > HCI Event: Command Complete
        Status: Unknown Advertising Identifier (0x42)

Send the instance's handle, looked up with hdev->lock held. Two more
things follow from the instance and the handle differing:

 - hci_cc_le_remove_adv_set() removes the instance numbered as the
   handle it sent, which for handle 0x00 is instance 0, so instance 1
   would stay in hdev->adv_instances with its RPA timer running, and no
   MGMT_EV_ADVERTISING_REMOVED. The completion can't tell instance 1
   from instance 0, which the MGMT Set Advertising path removes on the
   same handle, so remove instance 1 in
   hci_remove_ext_adv_instance_sync() once the command succeeds.

 - While Global Advertising is on, it owns handle 0x00
   (adv_overridden_by_global()), and the set may be enabled for it, so
   the controller would refuse to remove it, with Command Disallowed.
   Remove only the instance then, leaving the set to Global
   Advertising.

Fixes: e77f43d531af ("Bluetooth: hci_core: Fix not handling hdev->le_num_of_adv_sets=1")
Assisted-by: Claude:claude-opus-5.5
Signed-off-by: Weihong Guan <weihong.guan@gmail.com>
---
 net/bluetooth/hci_sync.c | 55 +++++++++++++++++++++++++++++++++++-----
 1 file changed, 49 insertions(+), 6 deletions(-)

diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index 320c5ba0d..d4a4f49df 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -2110,6 +2110,9 @@ int hci_enable_advertising(struct hci_dev *hdev)
 int hci_remove_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance,
 				     struct sock *sk)
 {
+	struct adv_info *adv = NULL;
+	u8 handle = instance;
+	bool global = false;
 	int err;
 
 	if (!ext_adv_capable(hdev))
@@ -2119,13 +2122,53 @@ int hci_remove_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance,
 	if (err)
 		return err;
 
-	/* If request specifies an instance that doesn't exist, fail */
-	if (instance > 0 && !hci_find_adv_instance(hdev, instance))
-		return -EINVAL;
+	if (instance) {
+		hci_dev_lock(hdev);
+
+		adv = hci_find_adv_instance(hdev, instance);
+		if (adv) {
+			handle = adv->handle;
+
+			/* An instance sharing handle 0x00 with Global
+			 * Advertising doesn't own the set while Global
+			 * Advertising is on, and the set may still be enabled
+			 * for it, which the controller would refuse to remove.
+			 */
+			global = !handle &&
+				 (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
+				  hci_dev_test_flag(hdev, HCI_LE_ADV_0));
+		}
+
+		hci_dev_unlock(hdev);
+
+		/* If request specifies an instance that doesn't exist, fail */
+		if (!adv)
+			return -EINVAL;
+	}
+
+	if (!global) {
+		err = __hci_cmd_sync_status_sk(hdev, HCI_OP_LE_REMOVE_ADV_SET,
+					       sizeof(handle), &handle, 0,
+					       HCI_CMD_TIMEOUT, sk);
+		if (err)
+			return err;
+	}
+
+	/* hci_cc_le_remove_adv_set() removes the instance numbered as the
+	 * handle it sent, so remove here an instance using another handle:
+	 * instance 1 on handle 0x00, on a controller supporting a single
+	 * advertising set. The completion can't tell it from instance 0.
+	 */
+	if (handle != instance) {
+		hci_dev_lock(hdev);
+
+		if (!hci_remove_adv_instance(hdev, instance))
+			mgmt_advertising_removed(sk, hdev, instance);
 
-	return __hci_cmd_sync_status_sk(hdev, HCI_OP_LE_REMOVE_ADV_SET,
-					sizeof(instance), &instance, 0,
-					HCI_CMD_TIMEOUT, sk);
+		hci_dev_unlock(hdev);
+	}
+
+	return 0;
 }
 
 int hci_le_terminate_big_sync(struct hci_dev *hdev, u8 handle, u8 reason)
-- 
2.47.3

[PATCH v3 3/4] Bluetooth: hci_core: Add hci_free_adv_instance()

[Weihong Guan]

hci_remove_adv_instance() looks the instance up by its number and then
frees it. A caller that already holds the instance, found some other
way, has to look it up again by number to remove it.

Split the freeing into hci_free_adv_instance(), which takes the
instance itself, and have hci_remove_adv_instance() call it after the
lookup. No functional change.

Suggested-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Assisted-by: Claude:claude-opus-5.5
Signed-off-by: Weihong Guan <weihong.guan@gmail.com>
---
 include/net/bluetooth/hci_core.h |  1 +
 net/bluetooth/hci_core.c         | 24 +++++++++++++++---------
 2 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 97ba716c0..c3d75ad92 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -1976,6 +1976,7 @@ struct adv_info *hci_add_per_instance(struct hci_dev *hdev, u8 instance, u8 sid,
 int hci_set_adv_instance_data(struct hci_dev *hdev, u8 instance,
 			 u16 adv_data_len, u8 *adv_data,
 			 u16 scan_rsp_len, u8 *scan_rsp_data);
+void hci_free_adv_instance(struct hci_dev *hdev, struct adv_info *adv_instance);
 int hci_remove_adv_instance(struct hci_dev *hdev, u8 instance);
 void hci_adv_instances_set_rpa_expired(struct hci_dev *hdev, bool rpa_expired);
 u32 hci_adv_instance_flags(struct hci_dev *hdev, u8 instance);
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index bfc5bdebc..8677c553b 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1705,17 +1705,11 @@ struct adv_info *hci_get_next_instance(struct hci_dev *hdev, u8 instance)
 }
 
 /* This function requires the caller holds hdev->lock */
-int hci_remove_adv_instance(struct hci_dev *hdev, u8 instance)
+void hci_free_adv_instance(struct hci_dev *hdev, struct adv_info *adv_instance)
 {
-	struct adv_info *adv_instance;
+	BT_DBG("%s removing %dMR", hdev->name, adv_instance->instance);
 
-	adv_instance = hci_find_adv_instance(hdev, instance);
-	if (!adv_instance)
-		return -ENOENT;
-
-	BT_DBG("%s removing %dMR", hdev->name, instance);
-
-	if (hdev->cur_adv_instance == instance) {
+	if (hdev->cur_adv_instance == adv_instance->instance) {
 		if (hdev->adv_instance_timeout) {
 			cancel_delayed_work(&hdev->adv_instance_expire);
 			hdev->adv_instance_timeout = false;
@@ -1729,6 +1723,18 @@ int hci_remove_adv_instance(struct hci_dev *hdev, u8 instance)
 	kfree(adv_instance);
 
 	hdev->adv_instance_cnt--;
+}
+
+/* This function requires the caller holds hdev->lock */
+int hci_remove_adv_instance(struct hci_dev *hdev, u8 instance)
+{
+	struct adv_info *adv_instance;
+
+	adv_instance = hci_find_adv_instance(hdev, instance);
+	if (!adv_instance)
+		return -ENOENT;
+
+	hci_free_adv_instance(hdev, adv_instance);
 
 	return 0;
 }
-- 
2.47.3

[PATCH v3 4/4] Bluetooth: hci_event: Find the owner of a terminated adv set

[Weihong Guan]

hci_le_ext_adv_term_evt() looks the instance up by the event's handle,
but when the controller supports a single advertising set,
hci_add_adv_instance() gives instance 1 handle 0x00, which is also the
handle of Global Advertising. For instance 1 the event then finds no
instance, and:

 - a connection from it gets hdev->random_addr as its responder
   address, rather than the instance's random address, which SMP then
   checks against;
 - the connection stores handle 0x00 in conn->adv_instance, which is
   later restored as hdev->cur_adv_instance, so after the disconnection
   instance 0 is re-enabled rather than instance 1;
 - when the set terminates with an error, instance 0 is removed rather
   than instance 1, so instance 1 stays with no
   MGMT_EV_ADVERTISING_REMOVED.

Find the instance owning the set: for handle 0x00 the instance enabled
on it, as hci_le_ext_adv_set_enabled() tracks, and use its instance
number and random address. On an error, free the instance found with
hci_free_adv_instance() rather than looking it up again. Global
Advertising, and any other handle, are handled as before.

Fixes: e77f43d531af ("Bluetooth: hci_core: Fix not handling hdev->le_num_of_adv_sets=1")
Assisted-by: Claude:claude-opus-5.5
Signed-off-by: Weihong Guan <weihong.guan@gmail.com>
---
 net/bluetooth/hci_event.c | 42 +++++++++++++++++++++++++++++----------
 1 file changed, 31 insertions(+), 11 deletions(-)

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index f0ce124bb..9bec2a328 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -6179,6 +6179,26 @@ static void hci_le_pa_sync_lost_evt(struct hci_dev *hdev, void *data,
 	hci_dev_unlock(hdev);
 }
 
+/* The instance advertising on the set identified by handle. Handle 0x00 may
+ * be shared by Global Advertising and an instance, e.g. instance 1 when the
+ * controller supports a single advertising set, in which case the instance
+ * enabled on it, if any, owns the set (see hci_le_ext_adv_set_enabled()).
+ */
+static struct adv_info *hci_le_ext_adv_owner(struct hci_dev *hdev, u8 handle)
+{
+	struct adv_info *adv;
+
+	if (handle)
+		return hci_find_adv_instance(hdev, handle);
+
+	list_for_each_entry(adv, &hdev->adv_instances, list) {
+		if (!adv->handle && adv->enabled)
+			return adv;
+	}
+
+	return NULL;
+}
+
 static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, void *data,
 				    struct sk_buff *skb)
 {
@@ -6202,15 +6222,18 @@ static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, void *data,
 
 	hci_dev_lock(hdev);
 
-	adv = hci_find_adv_instance(hdev, ev->handle);
+	adv = hci_le_ext_adv_owner(hdev, ev->handle);
 
 	if (ev->status) {
+		u8 instance;
+
 		if (!adv)
 			goto unlock;
 
 		/* Remove advertising as it has been terminated */
-		hci_remove_adv_instance(hdev, ev->handle);
-		mgmt_advertising_removed(NULL, hdev, ev->handle);
+		instance = adv->instance;
+		hci_free_adv_instance(hdev, adv);
+		mgmt_advertising_removed(NULL, hdev, instance);
 
 		list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) {
 			if (adv->enabled)
@@ -6227,22 +6250,19 @@ static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, void *data,
 
 	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->conn_handle));
 	if (conn) {
-		/* Store handle in the connection so the correct advertising
-		 * instance can be re-enabled when disconnected.
+		/* Store the instance in the connection so the correct
+		 * advertising instance can be re-enabled when disconnected.
 		 */
-		conn->adv_instance = ev->handle;
+		conn->adv_instance = adv ? adv->instance : ev->handle;
 
 		if (hdev->adv_addr_type != ADDR_LE_DEV_RANDOM ||
 		    bacmp(&conn->resp_addr, BDADDR_ANY))
 			goto unlock;
 
-		if (!ev->handle) {
-			bacpy(&conn->resp_addr, &hdev->random_addr);
-			goto unlock;
-		}
-
 		if (adv)
 			bacpy(&conn->resp_addr, &adv->random_addr);
+		else if (!ev->handle)
+			bacpy(&conn->resp_addr, &hdev->random_addr);
 	}
 
 unlock:
-- 
2.47.3

Re: [PATCH v3 0/4] Bluetooth: Advertising sets on a single-set controller

[patchwork-bot+bluetooth]

Hello:

This series was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Wed, 11 Nov 2026 16:51:29 +0000 you wrote:
> When the controller supports a single advertising set,
> hci_add_adv_instance() gives instance 1 handle 0x00, the handle Global
> Advertising uses too. The parameters, data and enable commands already
> use adv->handle; these patches cover what still takes the instance
> number for the handle: setting the set's random address, removing the
> set, and the Advertising Set Terminated event (with a helper to free an
> instance already found).
> 
> [...]

Here is the summary with links:
  - [v3,1/4] Bluetooth: hci_sync: Set random address on the set's handle
    https://git.kernel.org/bluetooth/bluetooth-next/c/daf949c968d4
  - [v3,2/4] Bluetooth: hci_sync: Remove an advertising set by its handle
    https://git.kernel.org/bluetooth/bluetooth-next/c/e7e877bf658a
  - [v3,3/4] Bluetooth: hci_core: Add hci_free_adv_instance()
    https://git.kernel.org/bluetooth/bluetooth-next/c/8b1eff978e66
  - [v3,4/4] Bluetooth: hci_event: Find the owner of a terminated adv set
    https://git.kernel.org/bluetooth/bluetooth-next/c/4dce35adafb5

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html