[PATCH bluez RFC 0/3] BlueZ: Add generic support for vendor HCI frames

[PATCH bluez RFC 0/3] BlueZ: Add generic support for vendor HCI frames

[Zijun Hu]

Kernel change link:
https://lore.kernel.org/all/20260719-support_vendor_hci-v1-1-764523a4ca3d@oss.qualcomm.com

---
Zijun Hu (3):
      doc: hci-protocol: Correct mtu to &mtu for getsockopt BT_RCVMTU
      doc: hci-protocol: Add sock option BT_RCV_VENDOR_PKT for HCI_CHANNEL_USER
      monitor: Add generic support for vendor HCI frames

 doc/btsnoop-protocol.rst |  8 ++++++++
 doc/hci-protocol.rst     | 20 +++++++++++++++++++-
 monitor/analyze.c        | 23 +++++++++++++++++++++++
 monitor/packet.c         | 26 ++++++++++++++++++++++++++
 monitor/packet.h         |  2 ++
 src/shared/btsnoop.h     |  2 ++
 6 files changed, 80 insertions(+), 1 deletion(-)
---
base-commit: efd216fe280ba5dd38d1b6084f64784bf1328731
change-id: 20260719-vendor_hci-188fc539d7a8

Best regards,
--  
Zijun Hu <zijun.hu@oss.qualcomm.com>

[PATCH bluez RFC 1/3] doc: hci-protocol: Correct mtu to &mtu for getsockopt BT_RCVMTU

[Zijun Hu]

For getsockopt(..., BT_RCVMTU, ...):
Correct its parameter from mtu to &mtu.
---
 doc/hci-protocol.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/hci-protocol.rst b/doc/hci-protocol.rst
index f28684655842..db10b35df736 100644
--- a/doc/hci-protocol.rst
+++ b/doc/hci-protocol.rst
@@ -134,7 +134,7 @@ Example:
     int err;
 
     len = sizeof(mtu);
-    err = getsockopt(sock, SOL_BLUETOOTH, BT_RCVMTU, mtu, &len);
+    err = getsockopt(sock, SOL_BLUETOOTH, BT_RCVMTU, &mtu, &len);
 
 RESOURCES
 =========

-- 
2.34.1

RE: BlueZ: Add generic support for vendor HCI frames

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1624 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1130548

---Test result---

Test Summary:
CheckPatch                    PASS      1.46 seconds
GitLint                       FAIL      1.02 seconds
BuildEll                      PASS      20.51 seconds
BluezMake                     PASS      548.95 seconds
MakeCheck                     PASS      18.66 seconds
MakeDistcheck                 PASS      159.62 seconds
CheckValgrind                 PASS      228.86 seconds
CheckSmatch                   WARNING   311.81 seconds
bluezmakeextell               PASS      102.54 seconds
IncrementalBuild              PASS      577.00 seconds
ScanBuild                     PASS      971.49 seconds

Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[bluez,RFC,2/3] doc: hci-protocol: Add sock option BT_RCV_VENDOR_PKT for HCI_CHANNEL_USER

1: T1 Title exceeds max length (89>80): "[bluez,RFC,2/3] doc: hci-protocol: Add sock option BT_RCV_VENDOR_PKT for HCI_CHANNEL_USER"
##############################
Test: CheckSmatch - WARNING
Desc: Run smatch tool with source
Output:
monitor/packet.c:2003:26: warning: Variable length array is used.monitor/packet.c: note: in included file:monitor/bt.h:3924:52: warning: array of flexible structuresmonitor/bt.h:3912:40: warning: array of flexible structures


https://github.com/bluez/bluez/pull/2332

---
Regards,
Linux Bluetooth

[PATCH bluez RFC 2/3] doc: hci-protocol: Add sock option BT_RCV_VENDOR_PKT for HCI_CHANNEL_USER

[Zijun Hu]

BT_RCV_VENDOR_PKT was introduced to support vendor HCI frame.
---
 doc/hci-protocol.rst | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/doc/hci-protocol.rst b/doc/hci-protocol.rst
index db10b35df736..91cbc5b65a78 100644
--- a/doc/hci-protocol.rst
+++ b/doc/hci-protocol.rst
@@ -136,6 +136,24 @@ Example:
     len = sizeof(mtu);
     err = getsockopt(sock, SOL_BLUETOOTH, BT_RCVMTU, &mtu, &len);
 
+BT_RCV_VENDOR_PKT (since Linux 7.3)
+-----------------------------------
+
+Enable receiving vendor HCI frames, requires hci_channel to be set to
+HCI_CHANNEL_USER.
+
+Default is disabled.
+
+Example:
+
+.. code-block::
+
+    int enable = 1;
+    int err;
+
+    err = setsockopt(fd, SOL_BLUETOOTH, BT_RCV_VENDOR_PKT, &enable,
+                                                    sizeof(enable));
+
 RESOURCES
 =========
 

-- 
2.34.1

Re: [PATCH bluez RFC 2/3] doc: hci-protocol: Add sock option BT_RCV_VENDOR_PKT for HCI_CHANNEL_USER

[Luiz Augusto von Dentz]

Hi,

On Mon, Jul 20, 2026 at 1:41 AM Zijun Hu <zijun.hu@oss.qualcomm.com> wrote:
>
> BT_RCV_VENDOR_PKT was introduced to support vendor HCI frame.
> ---
>  doc/hci-protocol.rst | 18 ++++++++++++++++++
>  1 file changed, 18 insertions(+)
>
> diff --git a/doc/hci-protocol.rst b/doc/hci-protocol.rst
> index db10b35df736..91cbc5b65a78 100644
> --- a/doc/hci-protocol.rst
> +++ b/doc/hci-protocol.rst
> @@ -136,6 +136,24 @@ Example:
>      len = sizeof(mtu);
>      err = getsockopt(sock, SOL_BLUETOOTH, BT_RCVMTU, &mtu, &len);
>
> +BT_RCV_VENDOR_PKT (since Linux 7.3)
> +-----------------------------------
> +
> +Enable receiving vendor HCI frames, requires hci_channel to be set to
> +HCI_CHANNEL_USER.
> +
> +Default is disabled.
> +
> +Example:
> +
> +.. code-block::
> +
> +    int enable = 1;
> +    int err;
> +
> +    err = setsockopt(fd, SOL_BLUETOOTH, BT_RCV_VENDOR_PKT, &enable,
> +                                                    sizeof(enable));
> +

I don't think we have any socket option with this name, besides this
should really go as an HCI packet with an H4 header set accordingly.

>  RESOURCES
>  =========
>
>
> --
> 2.34.1
>


-- 
Luiz Augusto von Dentz

Re: [PATCH bluez RFC 2/3] doc: hci-protocol: Add sock option BT_RCV_VENDOR_PKT for HCI_CHANNEL_USER

[Zijun Hu]

On 7/20/2026 10:10 PM, Luiz Augusto von Dentz wrote:
>> +-----------------------------------
>> +
>> +Enable receiving vendor HCI frames, requires hci_channel to be set to
>> +HCI_CHANNEL_USER.
>> +
>> +Default is disabled.
>> +
>> +Example:
>> +
>> +.. code-block::
>> +
>> +    int enable = 1;
>> +    int err;
>> +
>> +    err = setsockopt(fd, SOL_BLUETOOTH, BT_RCV_VENDOR_PKT, &enable,
>> +                                                    sizeof(enable));
>> +
> I don't think we have any socket option with this name, besides this
> should really go as an HCI packet with an H4 header set accordingly.

Hi Luiz,

I named it after BT_SNDMTU/BT_RCVMTU, but that may not be a good fit.
Any preferred name?
Happy to rename.

Re: [PATCH bluez RFC 2/3] doc: hci-protocol: Add sock option BT_RCV_VENDOR_PKT for HCI_CHANNEL_USER

[Luiz Augusto von Dentz]

Hi Zijun,

On Tue, Jul 21, 2026 at 5:07 AM Zijun Hu <zijun.hu@oss.qualcomm.com> wrote:
>
> On 7/20/2026 10:10 PM, Luiz Augusto von Dentz wrote:
> >> +-----------------------------------
> >> +
> >> +Enable receiving vendor HCI frames, requires hci_channel to be set to
> >> +HCI_CHANNEL_USER.
> >> +
> >> +Default is disabled.
> >> +
> >> +Example:
> >> +
> >> +.. code-block::
> >> +
> >> +    int enable = 1;
> >> +    int err;
> >> +
> >> +    err = setsockopt(fd, SOL_BLUETOOTH, BT_RCV_VENDOR_PKT, &enable,
> >> +                                                    sizeof(enable));
> >> +
> > I don't think we have any socket option with this name, besides this
> > should really go as an HCI packet with an H4 header set accordingly.
>
> Hi Luiz,
>
> I named it after BT_SNDMTU/BT_RCVMTU, but that may not be a good fit.
> Any preferred name?
> Happy to rename.

I mean we don't need it, you just prefix with packet type 0xff and the
kernel should accept it.

-- 
Luiz Augusto von Dentz

Re: [PATCH bluez RFC 2/3] doc: hci-protocol: Add sock option BT_RCV_VENDOR_PKT for HCI_CHANNEL_USER

[Zijun Hu]

On 7/21/2026 10:06 PM, Luiz Augusto von Dentz wrote:
>> Hi Luiz,
>>
>> I named it after BT_SNDMTU/BT_RCVMTU, but that may not be a good fit.
>> Any preferred name?
>> Happy to rename.
> I mean we don't need it, you just prefix with packet type 0xff and the
> kernel should accept it.

the socket option is to control if allow kernel to send vendor frame to userspace
its purpose to eliminate regression risk for existing applications

there are no regression risk in userspace to kernel TX direction.

[PATCH bluez RFC 3/3] monitor: Add generic support for vendor HCI frames

[Zijun Hu]

To show vendor HCI frames.
---
 doc/btsnoop-protocol.rst |  8 ++++++++
 monitor/analyze.c        | 23 +++++++++++++++++++++++
 monitor/packet.c         | 26 ++++++++++++++++++++++++++
 monitor/packet.h         |  2 ++
 src/shared/btsnoop.h     |  2 ++
 5 files changed, 61 insertions(+)

diff --git a/doc/btsnoop-protocol.rst b/doc/btsnoop-protocol.rst
index a875db63a9dd..81cd8fdc71ae 100644
--- a/doc/btsnoop-protocol.rst
+++ b/doc/btsnoop-protocol.rst
@@ -116,6 +116,14 @@ values match the definitions in ``src/shared/btsnoop.h``.
      - 19
      - 0x0013
      - Incoming ISO packet
+   * - BTSNOOP_OPCODE_VENDOR_TX_PKT
+     - 22
+     - 0x0016
+     - Outgoing vendor HCI packet
+   * - BTSNOOP_OPCODE_VENDOR_RX_PKT
+     - 23
+     - 0x0017
+     - Incoming vendor HCI packet
 
 New Index
 ---------
diff --git a/monitor/analyze.c b/monitor/analyze.c
index de9c23603a21..3fe96aaeddb0 100644
--- a/monitor/analyze.c
+++ b/monitor/analyze.c
@@ -45,6 +45,7 @@ struct hci_dev {
 	unsigned long num_sco;
 	unsigned long num_iso;
 	unsigned long vendor_diag;
+	unsigned long vendor_hci;
 	unsigned long system_note;
 	unsigned long user_log;
 	unsigned long ctrl_msg;
@@ -466,6 +467,7 @@ static void dev_destroy(void *data)
 	printf("  %lu SCO packets\n", dev->num_sco);
 	printf("  %lu ISO packets\n", dev->num_iso);
 	printf("  %lu vendor diagnostics\n", dev->vendor_diag);
+	printf("  %lu vendor HCI frames\n", dev->vendor_hci);
 	printf("  %lu system notes\n", dev->system_note);
 	printf("  %lu user logs\n", dev->user_log);
 	printf("  %lu control messages \n", dev->ctrl_msg);
@@ -1296,6 +1298,19 @@ static void vendor_diag(struct timeval *tv, uint16_t index,
 	dev->vendor_diag++;
 }
 
+static void vendor_hci_pkt(struct timeval *tv, uint16_t index, bool in,
+					const void *data, uint16_t size)
+{
+	struct hci_dev *dev;
+
+	dev = dev_lookup(index);
+	if (!dev)
+		return;
+
+	dev->num_hci++;
+	dev->vendor_hci++;
+}
+
 static void system_note(struct timeval *tv, uint16_t index,
 					const void *data, uint16_t size)
 {
@@ -1468,6 +1483,14 @@ void analyze_trace(const char *path)
 			num_frames++;
 			iso_pkt(&tv, index, false, buf, pktlen);
 			break;
+		case BTSNOOP_OPCODE_VENDOR_TX_PKT:
+			num_frames++;
+			vendor_hci_pkt(&tv, index, false, buf, pktlen);
+			break;
+		case BTSNOOP_OPCODE_VENDOR_RX_PKT:
+			num_frames++;
+			vendor_hci_pkt(&tv, index, true, buf, pktlen);
+			break;
 		default:
 			unknown_opcode(&tv, index, buf, pktlen);
 			break;
diff --git a/monitor/packet.c b/monitor/packet.c
index 82afef6011d2..1fd8453e2666 100644
--- a/monitor/packet.c
+++ b/monitor/packet.c
@@ -72,6 +72,7 @@
 #define COLOR_HCI_ACLDATA		COLOR_CYAN
 #define COLOR_HCI_SCODATA		COLOR_YELLOW
 #define COLOR_HCI_ISODATA		COLOR_YELLOW
+#define COLOR_VENDOR_HCI		COLOR_GREEN
 
 #define COLOR_UNKNOWN_ERROR		COLOR_WHITE_BG
 #define COLOR_UNKNOWN_FEATURE_BIT	COLOR_WHITE_BG
@@ -4528,6 +4529,12 @@ void packet_monitor(struct timeval *tv, struct ucred *cred,
 	case BTSNOOP_OPCODE_ISO_RX_PKT:
 		packet_hci_isodata(tv, cred, index, true, data, size);
 		break;
+	case BTSNOOP_OPCODE_VENDOR_TX_PKT:
+		packet_vendor_hci(tv, cred, index, false, data, size);
+		break;
+	case BTSNOOP_OPCODE_VENDOR_RX_PKT:
+		packet_vendor_hci(tv, cred, index, true, data, size);
+		break;
 	case BTSNOOP_OPCODE_OPEN_INDEX:
 		if (index < MAX_INDEX)
 			addr2str(index_list[index].bdaddr, str);
@@ -14655,6 +14662,25 @@ malformed:
 	packet_hexdump(data, size);
 }
 
+void packet_vendor_hci(struct timeval *tv, struct ucred *cred, uint16_t index,
+				bool in, const void *data, uint16_t size)
+{
+	char extra_str[16];
+
+	if (index >= MAX_INDEX) {
+		print_field("Invalid index (%d).", index);
+		return;
+	}
+
+	index_list[index].frame++;
+
+	sprintf(extra_str, "(len %d)", size);
+	print_packet(tv, cred, in ? '>' : '<', index, NULL, COLOR_VENDOR_HCI,
+				"Vendor HCI Frame", NULL, extra_str);
+
+	packet_hexdump(data, size);
+}
+
 void packet_ctrl_open(struct timeval *tv, struct ucred *cred, uint16_t index,
 					const void *data, uint16_t size)
 {
diff --git a/monitor/packet.h b/monitor/packet.h
index 73a86f64b242..57debcb94bce 100644
--- a/monitor/packet.h
+++ b/monitor/packet.h
@@ -135,6 +135,8 @@ void packet_hci_scodata(struct timeval *tv, struct ucred *cred, uint16_t index,
 				bool in, const void *data, uint16_t size);
 void packet_hci_isodata(struct timeval *tv, struct ucred *cred, uint16_t index,
 				bool in, const void *data, uint16_t size);
+void packet_vendor_hci(struct timeval *tv, struct ucred *cred, uint16_t index,
+				bool in, const void *data, uint16_t size);
 
 void packet_ctrl_open(struct timeval *tv, struct ucred *cred, uint16_t index,
 					const void *data, uint16_t size);
diff --git a/src/shared/btsnoop.h b/src/shared/btsnoop.h
index c24755d56729..efa87a8f2971 100644
--- a/src/shared/btsnoop.h
+++ b/src/shared/btsnoop.h
@@ -42,6 +42,8 @@
 #define BTSNOOP_OPCODE_CTRL_EVENT	17
 #define BTSNOOP_OPCODE_ISO_TX_PKT	18
 #define BTSNOOP_OPCODE_ISO_RX_PKT	19
+#define BTSNOOP_OPCODE_VENDOR_TX_PKT	22
+#define BTSNOOP_OPCODE_VENDOR_RX_PKT	23
 
 #define BTSNOOP_MAX_PACKET_SIZE		(1486 + 4)
 

-- 
2.34.1