* [bluez/bluez] 2128e1: shared/util: Add decoding support for HIDS 1.1 UUIDs
From: Luiz Augusto von Dentz @ 2026-05-01 14:04 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/master
Home: https://github.com/bluez/bluez
Commit: 2128e1c73ff0c0dffc4869b52a8664cac7560455
https://github.com/bluez/bluez/commit/2128e1c73ff0c0dffc4869b52a8664cac7560455
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: 2026-04-30 (Thu, 30 Apr 2026)
Changed paths:
M src/shared/util.c
Log Message:
-----------
shared/util: Add decoding support for HIDS 1.1 UUIDs
This adds support for HIDS 1.1 SCI UUIDs:
HID SCI Mode(0x2c39)
HID SCI Information(0x2c3a)
Commit: 31e4fb1498f47dfbf18b414acbbbeac26dcda366
https://github.com/bluez/bluez/commit/31e4fb1498f47dfbf18b414acbbbeac26dcda366
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: 2026-04-30 (Thu, 30 Apr 2026)
Changed paths:
M monitor/att.c
M src/main.conf
Log Message:
-----------
monitor: Add decoding support for HIDS 1.1 flags and attributes
This adds support for HIDS 1.1 SCI flags and attributes:
> LE-ACL: Handle 2048 flags 0x02 dlen 9
ATT: Read Response (0x0b) len 4
Handle: 0x0021 Type: HID Information (0x2a4a)
Value[4]:
11 01 00 0f ....
bcdHID: 0x0111
bCountryCode: 0x00
Flags: 0x0f
RemoteWake (0x01)
NormallyConnectable (0x02)
SCI Supported (0x04)
SCI Low Power Mode Supported (0x08)
< LE-ACL: Handle 2048 flags 0x00 dlen 7
ATT: Read Request (0x0a) len 2
Handle: 0x003d Type: HID SCI Information (0x2c3a)
> LE-ACL: Handle 2048 flags 0x02 dlen 19
ATT: Read Response (0x0b) len 14
Handle: 0x003d Type: HID SCI Information (0x2c3a)
Value[14]:
08 02 0a 00 14 00 0a 00 08 00 08 00 08 00 ..............
Minimum Supported Connection Interval: 1.000 ms (0x08)
Number of Supported Subgroups: 2
Minimum Connection Interval[0]: 1.250 ms (0x000a)
Maximum Connection Interval[0]: 2.500 ms (0x0014)
Connection Interval Stride[0]: 1.250 ms (0x000a)
Minimum Connection Interval[1]: 1.000 ms (0x0008)
Maximum Connection Interval[1]: 1.000 ms (0x0008)
Connection Interval Stride[1]: 1.000 ms (0x0008)
< LE-ACL: Handle 2048 flags 0x00 dlen 7
ATT: Read Request (0x0a) len 2
Handle: 0x003f Type: HID SCI Mode (0x2c39)
> LE-ACL: Handle 2048 flags 0x02 dlen 6
ATT: Read Response (0x0b) len 1
Handle: 0x003f Type: HID SCI Mode (0x2c39)
Value[1]:
00 .
Mode: None (0x00)
Compare: https://github.com/bluez/bluez/compare/d01616f0c276...31e4fb1498f4
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* Re: [PATCH v2 7/7] arm64: dts: qcom: milos-fairphone-fp6: Enable WiFi
From: Luca Weiss @ 2026-05-01 9:20 UTC (permalink / raw)
To: Konrad Dybcio, Dmitry Baryshkov, Luca Weiss, Jeff Johnson,
Baochen Qiang
Cc: Bjorn Andersson, Konrad Dybcio, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Alexander Koskovich, Liam Girdwood, Mark Brown,
Bartosz Golaszewski, Marcel Holtmann, Luiz Augusto von Dentz,
Balakrishna Godavarthi, Rocky Liao, Johannes Berg, Jeff Johnson,
~postmarketos/upstreaming, phone-devel, linux-arm-msm,
linux-kernel, devicetree, linux-bluetooth, linux-wireless, ath11k
In-Reply-To: <2514523f-a43f-4470-a69b-3d5175d10385@oss.qualcomm.com>
Hi Konrad,
On Tue Apr 7, 2026 at 3:16 PM CEST, Konrad Dybcio wrote:
> On 4/3/26 9:35 PM, Dmitry Baryshkov wrote:
>> On Fri, Apr 03, 2026 at 03:52:53PM +0200, Luca Weiss wrote:
>>> Configure and enable the WiFi node, and add the required pinctrl to
>>> provide the sleep clock from the PMK8550 (PMK7635) to WCN6755.
>>>
>>> Thanks to Alexander Koskovich for helping with the bringup, adding
>>> the missing pinctrl to make the WPSS stop crashing.
>>>
>>> Link: https://lore.kernel.org/linux-arm-msm/DBF7OWAWQ94M.FSCP4DPF8ZJY@fairphone.com/
>>> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
>>> Signed-off-by: Luca Weiss <luca.weiss@fairphone.com>
>>> ---
>>> arch/arm64/boot/dts/qcom/milos-fairphone-fp6.dts | 19 ++++++++++++++++++-
>>> 1 file changed, 18 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/arch/arm64/boot/dts/qcom/milos-fairphone-fp6.dts b/arch/arm64/boot/dts/qcom/milos-fairphone-fp6.dts
>>> index db72418b7195..d8ac495ca7c8 100644
>>> --- a/arch/arm64/boot/dts/qcom/milos-fairphone-fp6.dts
>>> +++ b/arch/arm64/boot/dts/qcom/milos-fairphone-fp6.dts
>>> @@ -242,7 +242,7 @@ wcn6750-pmu {
>>>
>>> clocks = <&rpmhcc RPMH_RF_CLK1>;
>>>
>>> - pinctrl-0 = <&bluetooth_enable_default>;
>>> + pinctrl-0 = <&bluetooth_enable_default>, <&pmk8550_sleep_clk_default>;
>>> pinctrl-names = "default";
>>>
>>> regulators {
>>> @@ -766,6 +766,17 @@ &pmiv0104_eusb2_repeater {
>>> qcom,tune-usb2-preem = /bits/ 8 <0x6>;
>>> };
>>>
>>> +&pmk8550_gpios {
>>> + pmk8550_sleep_clk_default: sleep-clk-default-state {
>>> + pins = "gpio5";
>>> + function = "func1";
>>> + input-disable;
>>> + output-enable;
>>
>> Hmm, if it's a sleep_clk, should it not be handled via the power
>> sequencer?
>
> If you mean that it may be needed to toggle it with specific timings,
> possibly.. seems that WCN6855 has a "xo-clk" GPIO defined. I requested
> access to some docs that I think should have the answer, hopefully should
> get it soon.
Did you manage to get anything there yet?
Regards
Luca
> Or maybe +Jeff/Baochen could answer faster?
>
> Konrad
^ permalink raw reply
* [Bug 221339] AX200 -19 errors on boot after firmware 20260313-1.1
From: bugzilla-daemon @ 2026-05-01 5:36 UTC (permalink / raw)
To: linux-bluetooth
In-Reply-To: <bug-221339-62941@https.bugzilla.kernel.org/>
https://bugzilla.kernel.org/show_bug.cgi?id=221339
pallaswept@proton.me changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution|--- |CODE_FIX
--- Comment #14 from pallaswept@proton.me ---
Thank you that's done the trick!
I hope it's correct process to resolve this.
--
You may reply to this email to add a comment.
You are receiving this mail because:
You are the assignee for the bug.
^ permalink raw reply
* RE: [BlueZ,v1,1/2] shared/util: Add decoding support for HIDS 1.1 UUIDs
From: bluez.test.bot @ 2026-04-30 20:54 UTC (permalink / raw)
To: linux-bluetooth, luiz.dentz
In-Reply-To: <20260430195114.608794-1-luiz.dentz@gmail.com>
[-- Attachment #1: Type: text/plain, Size: 988 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1088308
---Test result---
Test Summary:
CheckPatch PASS 1.05 seconds
GitLint PASS 0.69 seconds
BuildEll PASS 20.14 seconds
BluezMake PASS 607.90 seconds
MakeCheck PASS 0.97 seconds
MakeDistcheck PASS 235.19 seconds
CheckValgrind PASS 202.81 seconds
CheckSmatch PASS 324.87 seconds
bluezmakeextell PASS 165.53 seconds
IncrementalBuild PASS 615.26 seconds
ScanBuild PASS 926.13 seconds
https://github.com/bluez/bluez/pull/2089
---
Regards,
Linux Bluetooth
^ permalink raw reply
* RE: [v2] arm64: dts: monaco-arduino-monza: Add Bluetooth UART node
From: bluez.test.bot @ 2026-04-30 20:19 UTC (permalink / raw)
To: linux-bluetooth, shuai.zhang
In-Reply-To: <20260429103537.1282497-1-shuai.zhang@oss.qualcomm.com>
[-- Attachment #1: Type: text/plain, Size: 4236 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1087406
---Test result---
Test Summary:
CheckPatch PASS 0.61 seconds
GitLint FAIL 0.20 seconds
SubjectPrefix FAIL 0.07 seconds
BuildKernel PASS 26.26 seconds
CheckAllWarning PASS 28.76 seconds
CheckSparse PASS 27.28 seconds
BuildKernel32 PASS 25.34 seconds
TestRunnerSetup PASS 568.74 seconds
TestRunner_l2cap-tester FAIL 6.77 seconds
TestRunner_iso-tester PASS 295.76 seconds
TestRunner_bnep-tester FAIL 6.74 seconds
TestRunner_mgmt-tester FAIL 9.03 seconds
TestRunner_rfcomm-tester PASS 28.98 seconds
TestRunner_sco-tester PASS 68.04 seconds
TestRunner_ioctl-tester FAIL 37.50 seconds
TestRunner_mesh-tester PASS 27.03 seconds
TestRunner_smp-tester PASS 6.63 seconds
TestRunner_userchan-tester FAIL 6.70 seconds
TestRunner_6lowpan-tester PASS 22.95 seconds
IncrementalBuild PASS 24.54 seconds
Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[v2] arm64: dts: monaco-arduino-monza: Add Bluetooth UART node
WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
41: B1 Line exceeds max length (164>80): "- Document that the QCA2066 Bluetooth chip is powered by a board-level, hardware-provided 3.3 V supply, and that the GPIO is used only to enable the Bluetooth chip."
42: B1 Line exceeds max length (92>80): "- Add the required sleep clock to satisfy the qcom,qca2066-bt DT binding and run dtbs_check."
46: B1 Line exceeds max length (83>80): " https://lore.kernel.org/all/20260428025652.662502-1-shuai.zhang@oss.qualcomm.com/"
##############################
Test: SubjectPrefix - FAIL
Desc: Check subject contains "Bluetooth" prefix
Output:
"Bluetooth: " prefix is not specified in the subject
##############################
Test: TestRunner_l2cap-tester - FAIL
Desc: Run l2cap-tester with test-runner
Output:
No test result found
##############################
Test: TestRunner_bnep-tester - FAIL
Desc: Run bnep-tester with test-runner
Output:
No test result found
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
No test result found
##############################
Test: TestRunner_ioctl-tester - FAIL
Desc: Run ioctl-tester with test-runner
Output:
Total: 28, Passed: 0 (0.0%), Failed: 11, Not Run: 17
Failed Test Cases
Device List Timed out -30.821 seconds
Device Info Timed out -6.175 seconds
Reset Stat Timed out -6.179 seconds
Set Link Mode - ACCEPT Timed out -6.182 seconds
Set Pkt Type - DM Timed out -14.368 seconds
Set Pkt Type - DH Timed out -14.371 seconds
Set Pkt Type - HV Timed out -14.374 seconds
Set Pkt Type - 2-DH Timed out -14.378 seconds
Set Pkt Type - 2-DH Timed out -14.381 seconds
Set Pkt Type - ALL Timed out -14.384 seconds
Set ACL MTU - 1 Timed out -14.387 seconds
##############################
Test: TestRunner_userchan-tester - FAIL
Desc: Run userchan-tester with test-runner
Output:
No test result found
https://github.com/bluez/bluetooth-next/pull/139
---
Regards,
Linux Bluetooth
^ permalink raw reply
* RE: Fixes/improvements for the PCI M.2 power sequencing driver
From: bluez.test.bot @ 2026-04-30 20:18 UTC (permalink / raw)
To: linux-bluetooth, manivannan.sadhasivam
In-Reply-To: <20260422-pwrseq-m2-bt-v1-1-720d02545a64@oss.qualcomm.com>
[-- Attachment #1: Type: text/plain, Size: 7788 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1084240
---Test result---
Test Summary:
CheckPatch PASS 10.21 seconds
GitLint FAIL 3.79 seconds
SubjectPrefix FAIL 1.77 seconds
BuildKernel PASS 25.35 seconds
CheckAllWarning PASS 28.26 seconds
CheckSparse PASS 27.92 seconds
BuildKernel32 PASS 25.29 seconds
TestRunnerSetup PASS 522.56 seconds
TestRunner_l2cap-tester FAIL 6.63 seconds
TestRunner_iso-tester PASS 295.69 seconds
TestRunner_bnep-tester FAIL 6.52 seconds
TestRunner_mgmt-tester FAIL 8.69 seconds
TestRunner_rfcomm-tester PASS 28.93 seconds
TestRunner_sco-tester PASS 68.09 seconds
TestRunner_ioctl-tester FAIL 35.27 seconds
TestRunner_mesh-tester PASS 26.96 seconds
TestRunner_smp-tester PASS 6.58 seconds
TestRunner_userchan-tester FAIL 6.58 seconds
TestRunner_6lowpan-tester PASS 22.91 seconds
IncrementalBuild PASS 46.87 seconds
Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[01/12] power: sequencing: Introduce an API to check whether the pwrseq is fixed or controllable
WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
1: T1 Title exceeds max length (96>80): "[01/12] power: sequencing: Introduce an API to check whether the pwrseq is fixed or controllable"
[02/12] power: sequencing: pcie-m2: Add support for 'is_fixed()' callback to 'uart' target
WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
1: T1 Title exceeds max length (90>80): "[02/12] power: sequencing: pcie-m2: Add support for 'is_fixed()' callback to 'uart' target"
[03/12] power: sequencing: qcom-wcn: Add support for 'is_fixed()' callback to 'bluetooth' target
WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
1: T1 Title exceeds max length (96>80): "[03/12] power: sequencing: qcom-wcn: Add support for 'is_fixed()' callback to 'bluetooth' target"
[05/12] power: sequencing: pcie-m2: Allow creating serdev for multiple PCI devices
WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
1: T1 Title exceeds max length (82>80): "[05/12] power: sequencing: pcie-m2: Allow creating serdev for multiple PCI devices"
[07/12] power: sequencing: pcie-m2: Create serdev for PCI devices present before probe
WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
1: T1 Title exceeds max length (86>80): "[07/12] power: sequencing: pcie-m2: Create serdev for PCI devices present before probe"
[08/12] power: sequencing: pcie-m2: Create BT node based on the pci_device_id[] table
WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
1: T1 Title exceeds max length (85>80): "[08/12] power: sequencing: pcie-m2: Create BT node based on the pci_device_id[] table"
[12/12] Bluetooth: hci_qca: Fix the broken BT_EN GPIO detection for Qcom WCN devices
WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
1: T1 Title exceeds max length (84>80): "[12/12] Bluetooth: hci_qca: Fix the broken BT_EN GPIO detection for Qcom WCN devices"
##############################
Test: SubjectPrefix - FAIL
Desc: Check subject contains "Bluetooth" prefix
Output:
"Bluetooth: " prefix is not specified in the subject
"Bluetooth: " prefix is not specified in the subject
"Bluetooth: " prefix is not specified in the subject
"Bluetooth: " prefix is not specified in the subject
"Bluetooth: " prefix is not specified in the subject
"Bluetooth: " prefix is not specified in the subject
"Bluetooth: " prefix is not specified in the subject
"Bluetooth: " prefix is not specified in the subject
##############################
Test: TestRunner_l2cap-tester - FAIL
Desc: Run l2cap-tester with test-runner
Output:
No test result found
##############################
Test: TestRunner_bnep-tester - FAIL
Desc: Run bnep-tester with test-runner
Output:
No test result found
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
No test result found
##############################
Test: TestRunner_ioctl-tester - FAIL
Desc: Run ioctl-tester with test-runner
Output:
Total: 28, Passed: 0 (0.0%), Failed: 11, Not Run: 17
Failed Test Cases
Device List Timed out -28.814 seconds
Device Info Timed out -6.189 seconds
Reset Stat Timed out -6.192 seconds
Set Link Mode - ACCEPT Timed out -6.195 seconds
Set Pkt Type - DM Timed out -14.382 seconds
Set Pkt Type - DH Timed out -14.387 seconds
Set Pkt Type - HV Timed out -14.390 seconds
Set Pkt Type - 2-DH Timed out -14.393 seconds
Set Pkt Type - 2-DH Timed out -14.396 seconds
Set Pkt Type - ALL Timed out -14.399 seconds
Set ACL MTU - 1 Timed out -14.401 seconds
##############################
Test: TestRunner_userchan-tester - FAIL
Desc: Run userchan-tester with test-runner
Output:
No test result found
https://github.com/bluez/bluetooth-next/pull/137
---
Regards,
Linux Bluetooth
^ permalink raw reply
* RE: [v1] arm64: dts: monac-arduino-monza: Add Bluetooth UART node
From: bluez.test.bot @ 2026-04-30 20:18 UTC (permalink / raw)
To: linux-bluetooth, shuai.zhang
In-Reply-To: <20260428025652.662502-1-shuai.zhang@oss.qualcomm.com>
[-- Attachment #1: Type: text/plain, Size: 3265 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1086526
---Test result---
Test Summary:
CheckPatch PASS 0.71 seconds
GitLint PASS 0.29 seconds
SubjectPrefix FAIL 0.11 seconds
BuildKernel PASS 28.03 seconds
CheckAllWarning PASS 27.20 seconds
CheckSparse PASS 25.80 seconds
BuildKernel32 PASS 24.04 seconds
TestRunnerSetup PASS 519.97 seconds
TestRunner_l2cap-tester FAIL 6.63 seconds
TestRunner_iso-tester PASS 295.81 seconds
TestRunner_bnep-tester FAIL 6.66 seconds
TestRunner_mgmt-tester FAIL 8.83 seconds
TestRunner_rfcomm-tester PASS 29.08 seconds
TestRunner_sco-tester PASS 68.28 seconds
TestRunner_ioctl-tester FAIL 37.35 seconds
TestRunner_mesh-tester PASS 27.08 seconds
TestRunner_smp-tester PASS 6.63 seconds
TestRunner_userchan-tester FAIL 6.65 seconds
TestRunner_6lowpan-tester PASS 22.89 seconds
IncrementalBuild PASS 23.77 seconds
Details
##############################
Test: SubjectPrefix - FAIL
Desc: Check subject contains "Bluetooth" prefix
Output:
"Bluetooth: " prefix is not specified in the subject
##############################
Test: TestRunner_l2cap-tester - FAIL
Desc: Run l2cap-tester with test-runner
Output:
No test result found
##############################
Test: TestRunner_bnep-tester - FAIL
Desc: Run bnep-tester with test-runner
Output:
No test result found
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
No test result found
##############################
Test: TestRunner_ioctl-tester - FAIL
Desc: Run ioctl-tester with test-runner
Output:
Total: 28, Passed: 0 (0.0%), Failed: 11, Not Run: 17
Failed Test Cases
Device List Timed out -30.845 seconds
Device Info Timed out -6.203 seconds
Reset Stat Timed out -6.207 seconds
Set Link Mode - ACCEPT Timed out -6.209 seconds
Set Pkt Type - DM Timed out -14.393 seconds
Set Pkt Type - DH Timed out -14.397 seconds
Set Pkt Type - HV Timed out -14.399 seconds
Set Pkt Type - 2-DH Timed out -14.402 seconds
Set Pkt Type - 2-DH Timed out -14.404 seconds
Set Pkt Type - ALL Timed out -14.407 seconds
Set ACL MTU - 1 Timed out -14.409 seconds
##############################
Test: TestRunner_userchan-tester - FAIL
Desc: Run userchan-tester with test-runner
Output:
No test result found
https://github.com/bluez/bluetooth-next/pull/138
---
Regards,
Linux Bluetooth
^ permalink raw reply
* [bluez/bluez]
From: BluezTestBot @ 2026-04-30 20:02 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/1087435
Home: https://github.com/bluez/bluez
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* [bluez/bluez] 9b90a4: shared/util: Add decoding support for HIDS 1.1 UUIDs
From: Luiz Augusto von Dentz @ 2026-04-30 20:02 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/1088308
Home: https://github.com/bluez/bluez
Commit: 9b90a414b90a52815f2e73f4020722e668fb1afc
https://github.com/bluez/bluez/commit/9b90a414b90a52815f2e73f4020722e668fb1afc
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: 2026-04-30 (Thu, 30 Apr 2026)
Changed paths:
M src/shared/util.c
Log Message:
-----------
shared/util: Add decoding support for HIDS 1.1 UUIDs
This adds support for HIDS 1.1 SCI UUIDs:
HID SCI Mode(0x2c39)
HID SCI Information(0x2c3a)
Commit: 3bcc24e47bf1b2323f94d1ea9dee3de294e963aa
https://github.com/bluez/bluez/commit/3bcc24e47bf1b2323f94d1ea9dee3de294e963aa
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: 2026-04-30 (Thu, 30 Apr 2026)
Changed paths:
M monitor/att.c
M src/main.conf
Log Message:
-----------
monitor: Add decoding support for HIDS 1.1 flags and attributes
This adds support for HIDS 1.1 SCI flags and attributes:
> LE-ACL: Handle 2048 flags 0x02 dlen 9
ATT: Read Response (0x0b) len 4
Handle: 0x0021 Type: HID Information (0x2a4a)
Value[4]:
11 01 00 0f ....
bcdHID: 0x0111
bCountryCode: 0x00
Flags: 0x0f
RemoteWake (0x01)
NormallyConnectable (0x02)
SCI Supported (0x04)
SCI Low Power Mode Supported (0x08)
< LE-ACL: Handle 2048 flags 0x00 dlen 7
ATT: Read Request (0x0a) len 2
Handle: 0x003d Type: HID SCI Information (0x2c3a)
> LE-ACL: Handle 2048 flags 0x02 dlen 19
ATT: Read Response (0x0b) len 14
Handle: 0x003d Type: HID SCI Information (0x2c3a)
Value[14]:
08 02 0a 00 14 00 0a 00 08 00 08 00 08 00 ..............
Minimum Supported Connection Interval: 1.000 ms (0x08)
Number of Supported Subgroups: 2
Minimum Connection Interval[0]: 1.250 ms (0x000a)
Maximum Connection Interval[0]: 2.500 ms (0x0014)
Connection Interval Stride[0]: 1.250 ms (0x000a)
Minimum Connection Interval[1]: 1.000 ms (0x0008)
Maximum Connection Interval[1]: 1.000 ms (0x0008)
Connection Interval Stride[1]: 1.000 ms (0x0008)
< LE-ACL: Handle 2048 flags 0x00 dlen 7
ATT: Read Request (0x0a) len 2
Handle: 0x003f Type: HID SCI Mode (0x2c39)
> LE-ACL: Handle 2048 flags 0x02 dlen 6
ATT: Read Response (0x0b) len 1
Handle: 0x003f Type: HID SCI Mode (0x2c39)
Value[1]:
00 .
Mode: None (0x00)
Compare: https://github.com/bluez/bluez/compare/9b90a414b90a%5E...3bcc24e47bf1
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* [PATCH BlueZ v1 2/2] monitor: Add decoding support for HIDS 1.1 flags and attributes
From: Luiz Augusto von Dentz @ 2026-04-30 19:51 UTC (permalink / raw)
To: linux-bluetooth
In-Reply-To: <20260430195114.608794-1-luiz.dentz@gmail.com>
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This adds support for HIDS 1.1 SCI flags and attributes:
> LE-ACL: Handle 2048 flags 0x02 dlen 9
ATT: Read Response (0x0b) len 4
Handle: 0x0021 Type: HID Information (0x2a4a)
Value[4]:
11 01 00 0f ....
bcdHID: 0x0111
bCountryCode: 0x00
Flags: 0x0f
RemoteWake (0x01)
NormallyConnectable (0x02)
SCI Supported (0x04)
SCI Low Power Mode Supported (0x08)
< LE-ACL: Handle 2048 flags 0x00 dlen 7
ATT: Read Request (0x0a) len 2
Handle: 0x003d Type: HID SCI Information (0x2c3a)
> LE-ACL: Handle 2048 flags 0x02 dlen 19
ATT: Read Response (0x0b) len 14
Handle: 0x003d Type: HID SCI Information (0x2c3a)
Value[14]:
08 02 0a 00 14 00 0a 00 08 00 08 00 08 00 ..............
Minimum Supported Connection Interval: 1.000 ms (0x08)
Number of Supported Subgroups: 2
Minimum Connection Interval[0]: 1.250 ms (0x000a)
Maximum Connection Interval[0]: 2.500 ms (0x0014)
Connection Interval Stride[0]: 1.250 ms (0x000a)
Minimum Connection Interval[1]: 1.000 ms (0x0008)
Maximum Connection Interval[1]: 1.000 ms (0x0008)
Connection Interval Stride[1]: 1.000 ms (0x0008)
< LE-ACL: Handle 2048 flags 0x00 dlen 7
ATT: Read Request (0x0a) len 2
Handle: 0x003f Type: HID SCI Mode (0x2c39)
> LE-ACL: Handle 2048 flags 0x02 dlen 6
ATT: Read Response (0x0b) len 1
Handle: 0x003f Type: HID SCI Mode (0x2c39)
Value[1]:
00 .
Mode: None (0x00)
---
monitor/att.c | 115 ++++++++++++++++++++++++++++++++++++++++++++++++--
src/main.conf | 2 +-
2 files changed, 113 insertions(+), 4 deletions(-)
diff --git a/monitor/att.c b/monitor/att.c
index e8e0d499a826..03d46634fe17 100644
--- a/monitor/att.c
+++ b/monitor/att.c
@@ -4522,8 +4522,10 @@ static void ras_data_overwritten_notify(const struct l2cap_frame *frame)
ras_data_overwritten_notify)
static const struct bitfield_data hog_info_flags[] = {
- { 0, "RemoteWake (0x01)" },
- { 1, "NormallyConnectable (0x02)" },
+ { 0, "RemoteWake (0x01)" },
+ { 1, "NormallyConnectable (0x02)" },
+ { 2, "SCI Supported (0x04)" },
+ { 3, "SCI Low Power Mode Supported (0x08)" },
{ }
};
@@ -4598,9 +4600,116 @@ done:
print_hex_field(" Data", frame->data, frame->size);
}
+static void print_sci_mode(const struct l2cap_frame *frame)
+{
+ uint8_t mode;
+
+ if (!l2cap_frame_get_u8((void *)frame, &mode)) {
+ print_text(COLOR_ERROR, " Mode: invalid size");
+ goto done;
+ }
+
+ switch (mode) {
+ case 0x00:
+ print_field(" Mode: None (0x00)");
+ break;
+ case 0x02:
+ print_field(" Mode: SCI Default Mode (0x02)");
+ break;
+ case 0x03:
+ print_field(" Mode: SCI Fast Mode (0x03)");
+ break;
+ case 0x04:
+ print_field(" Mode: SCI Low Power Mode (0x04)");
+ break;
+ case 0x05:
+ print_field(" Mode: SCI Full Range Mode (0x04)");
+ break;
+ default:
+ print_field(" Mode: Reserved (0x%2.2x)", mode);
+ break;
+ }
+
+done:
+ if (frame->size)
+ print_hex_field(" Data", frame->data, frame->size);
+}
+
+static void hog_sci_mode_read(const struct l2cap_frame *frame)
+{
+ print_sci_mode(frame);
+}
+
+static void hog_sci_mode_notify(const struct l2cap_frame *frame)
+{
+ print_sci_mode(frame);
+}
+
+static void hog_sci_info_read(const struct l2cap_frame *frame)
+{
+ uint8_t min_conn_interval;
+ uint8_t num_grps;
+ uint8_t i;
+
+ if (!l2cap_frame_get_u8((void *)frame, &min_conn_interval)) {
+ print_text(COLOR_ERROR, " Minimum Supported Connection "
+ "Interval: invalid size");
+ goto done;
+ }
+
+ print_field(" Minimum Supported Connection Interval: %.3f ms "
+ "(0x%2.2x) ", min_conn_interval * 0.125, min_conn_interval);
+
+ if (!l2cap_frame_get_u8((void *)frame, &num_grps)) {
+ print_text(COLOR_ERROR, " Number of Supported Subgroups: "
+ "invalid size");
+ goto done;
+ }
+
+ print_field(" Number of Supported Subgroups: %d", num_grps);
+
+ for (i = 0; i < num_grps; i++) {
+ uint16_t min, max, stride;
+
+ if (!l2cap_frame_get_le16((void *)frame, &min)) {
+ print_text(COLOR_ERROR, " group[%u]: Minimum "
+ "Connection Interval: invalid size",
+ i);
+ goto done;
+ }
+
+ if (!l2cap_frame_get_le16((void *)frame, &max)) {
+ print_text(COLOR_ERROR, " group[%u]: Maximum "
+ "Connection Interval: invalid size",
+ i);
+ goto done;
+ }
+
+ if (!l2cap_frame_get_le16((void *)frame, &stride)) {
+ print_text(COLOR_ERROR, " group[%u]: Connection "
+ "Interval Stride: invalid size",
+ i);
+ goto done;
+ }
+
+ print_field(" Minimum Connection Interval[%u]: %.3f ms "
+ "(0x%4.4x)", i, min * 0.125, min);
+ print_field(" Maximum Connection Interval[%u]: %.3f ms "
+ "(0x%4.4x)", i, max * 0.125, max);
+ print_field(" Connection Interval Stride[%u]: %.3f ms "
+ "(0x%4.4x)", i, stride * 0.125, stride);
+ }
+
+done:
+ if (frame->size)
+ print_hex_field(" Data", frame->data, frame->size);
+}
+
#define HIDS \
GATT_HANDLER(0x2a4a, hog_info_read, NULL, NULL), \
- GATT_HANDLER(0x2a4c, NULL, hog_cp_write, NULL)
+ GATT_HANDLER(0x2a4c, NULL, hog_cp_write, NULL), \
+ GATT_HANDLER(0x2c39, hog_sci_mode_read, NULL, hog_sci_mode_notify), \
+ GATT_HANDLER(0x2c3a, hog_sci_info_read, NULL, NULL)
#define GATT_HANDLER(_uuid, _read, _write, _notify) \
{ \
diff --git a/src/main.conf b/src/main.conf
index 5846ef92d98d..39584e225c38 100644
--- a/src/main.conf
+++ b/src/main.conf
@@ -289,7 +289,7 @@
# Export claimed services by plugins
# Possible values: no, read-only, read-write
# Default: read-only
-#ExportClaimedServices = read-only
+ExportClaimedServices = read-write
# Security level:
# Sets security level of ATT channel, setting security anything other than
--
2.53.0
^ permalink raw reply related
* [PATCH BlueZ v1 1/2] shared/util: Add decoding support for HIDS 1.1 UUIDs
From: Luiz Augusto von Dentz @ 2026-04-30 19:51 UTC (permalink / raw)
To: linux-bluetooth
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This adds support for HIDS 1.1 SCI UUIDs:
HID SCI Mode(0x2c39)
HID SCI Information(0x2c3a)
---
src/shared/util.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/src/shared/util.c b/src/shared/util.c
index 07e718bca0a8..62dd1369b70d 100644
--- a/src/shared/util.c
+++ b/src/shared/util.c
@@ -1164,6 +1164,8 @@ static const struct {
{ 0x2c17, "RAS Control Point" },
{ 0x2c18, "RAS Ranging Data Ready" },
{ 0x2c19, "RAS Ranging Data Overwritten" },
+ { 0x2c39, "HID SCI Mode" },
+ { 0x2c3a, "HID SCI Information" },
/* vendor defined */
{ 0xfeff, "GN Netcom" },
{ 0xfefe, "GN ReSound A/S" },
--
2.53.0
^ permalink raw reply related
* [bluez/bluez] d01616: gatt-client: Fix use-after-free caused by reentran...
From: BluezTestBot @ 2026-04-30 19:45 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/master
Home: https://github.com/bluez/bluez
Commit: d01616f0c276a441dad8afe4e8f7bb261b26ba0a
https://github.com/bluez/bluez/commit/d01616f0c276a441dad8afe4e8f7bb261b26ba0a
Author: Jinwang Li <jinwang.li@oss.qualcomm.com>
Date: 2026-04-30 (Thu, 30 Apr 2026)
Changed paths:
M src/gatt-client.c
Log Message:
-----------
gatt-client: Fix use-after-free caused by reentrant client teardown
btd_gatt_client_service_removed() can be called reentrantly via
bt_gatt_client_unref() after the services queue has already been freed,
resulting in a use-after-free.
Reset client->ready to false before destroying the services queue to
prevent reentrant calls from dereferencing freed memory.
This was found with the following backtrace:
#0 match_service_handle ()
#1 queue_remove_if ()
#2 queue_remove_all ()
#3 btd_gatt_client_service_removed ()
#4 gatt_service_removed ()
#5 handle_notify ()
#6 queue_foreach ()
#7 notify_service_changed ()
#8 gatt_db_service_destroy ()
#9 queue_remove_all ()
#10 gatt_db_clear_range ()
#11 service_changed_failure ()
#12 discovery_op_unref ()
#13 bt_gatt_request_unref ()
#14 bt_gatt_client_cancel_all ()
#15 bt_gatt_client_free ()
#16 bt_gatt_client_unref ()
#17 bt_gatt_client_free ()
#18 bt_gatt_client_unref ()
#19 btd_gatt_client_destroy ()
#20 device_free ()
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* Re: [PATCH v1] gatt-client: Fix use-after-free caused by reentrant client teardown
From: patchwork-bot+bluetooth @ 2026-04-30 19:00 UTC (permalink / raw)
To: Jinwang Li
Cc: linux-bluetooth, cheng.jiang, quic_chezhou, wei.deng, shuai.zhang,
mengshi.wu
In-Reply-To: <20260429114806.2337081-1-jinwang.li@oss.qualcomm.com>
Hello:
This patch was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:
On Wed, 29 Apr 2026 19:48:06 +0800 you wrote:
> btd_gatt_client_service_removed() can be called reentrantly via
> bt_gatt_client_unref() after the services queue has already been freed,
> resulting in a use-after-free.
>
> Reset client->ready to false before destroying the services queue to
> prevent reentrant calls from dereferencing freed memory.
>
> [...]
Here is the summary with links:
- [v1] gatt-client: Fix use-after-free caused by reentrant client teardown
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=d01616f0c276
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net-deletions] net: remove ISDN subsystem and Bluetooth CMTP
From: patchwork-bot+bluetooth @ 2026-04-30 17:55 UTC (permalink / raw)
To: Jakub Kicinski
Cc: davem, netdev, edumazet, pabeni, andrew+netdev, horms, corbet,
skhan, marcel, luiz.dentz, mchehab+huawei, jani.nikula, gregkh,
demarchi, rdunlap, justonli, ivecera, jonathan.cameron, kees,
marco.crivellari, ferr.lambarginio, nihaal, mingo, tglx, linmq006,
linux-doc, linux-bluetooth
In-Reply-To: <20260421022108.1299678-1-kuba@kernel.org>
Hello:
This patch was applied to bluetooth/bluetooth-next.git (master)
by Jakub Kicinski <kuba@kernel.org>:
On Mon, 20 Apr 2026 19:21:07 -0700 you wrote:
> Remove the ISDN (mISDN, CAPI) subsystem and Bluetooth CMTP protocol
> from the kernel tree.
>
> ISDN is a pretty old technology and it's unclear whether anyone still
> uses it. I went over the last few years of git history and all the
> commits are either tree-wide conversions or syzbot/static analyzer
> fixes.
>
> [...]
Here is the summary with links:
- [net-deletions] net: remove ISDN subsystem and Bluetooth CMTP
https://git.kernel.org/bluetooth/bluetooth-next/c/4f10f1dfb235
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [GIT PULL] bluetooth-next 2026-04-13
From: patchwork-bot+bluetooth @ 2026-04-30 17:55 UTC (permalink / raw)
To: Luiz Augusto von Dentz; +Cc: davem, kuba, linux-bluetooth, netdev
In-Reply-To: <20260413132247.320961-1-luiz.dentz@gmail.com>
Hello:
This pull request was applied to bluetooth/bluetooth-next.git (master)
by Jakub Kicinski <kuba@kernel.org>:
On Mon, 13 Apr 2026 09:22:47 -0400 you wrote:
> The following changes since commit 42f9b4c6ef19e71d2c7d9bfd3c5037d4fe434ad7:
>
> tools: ynl: tests: fix leading space on Makefile target (2026-04-09 20:41:40 -0700)
>
> are available in the Git repository at:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git tags/for-net-next-2026-04-13
>
> [...]
Here is the summary with links:
- [GIT,PULL] bluetooth-next 2026-04-13
https://git.kernel.org/bluetooth/bluetooth-next/c/e9dc62f25ba6
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH v2 0/7] Enable Bluetooth and WiFi on Fairphone (Gen. 6)
From: patchwork-bot+bluetooth @ 2026-04-30 17:55 UTC (permalink / raw)
To: Luca Weiss
Cc: andersson, konradybcio, robh, krzk+dt, conor+dt, AKoskovich,
lgirdwood, broonie, brgl, marcel, luiz.dentz, quic_bgodavar,
quic_rjliao, johannes, jjohnson, ~postmarketos/upstreaming,
phone-devel, linux-arm-msm, linux-kernel, devicetree,
linux-bluetooth, linux-wireless, ath11k, dmitry.baryshkov
In-Reply-To: <20260403-milos-fp6-bt-wifi-v2-0-393322b27c5f@fairphone.com>
Hello:
This series was applied to bluetooth/bluetooth-next.git (master)
by Mark Brown <broonie@kernel.org>:
On Fri, 03 Apr 2026 15:52:46 +0200 you wrote:
> Add the required bits to enable Bluetooth and WiFi on the Milos
> SoC-based Fairphone (Gen. 6) smartphone.
>
> Signed-off-by: Luca Weiss <luca.weiss@fairphone.com>
> ---
> Changes in v2:
> - Drop applied pd-mapper patch
> - Add compatibles for wcn6755 with fallback to wcn6750 (wifi & bt)
> - Rebase on linux-next
> - Pick up one tag (discard the rest due to addition of wcn6755
> compatibles)
> - Link to v1: https://lore.kernel.org/r/20260116-milos-fp6-bt-wifi-v1-0-27b4fbb77e9c@fairphone.com
>
> [...]
Here is the summary with links:
- [v2,1/7] regulator: dt-bindings: qcom,qca6390-pmu: Document WCN6755 PMU
https://git.kernel.org/bluetooth/bluetooth-next/c/b043657c35e5
- [v2,2/7] dt-bindings: bluetooth: qcom,wcn6750-bt: Document WCN6755 Bluetooth
(no matching commit)
- [v2,3/7] dt-bindings: net: wireless: ath11k: Document WCN6755 WiFi
(no matching commit)
- [v2,4/7] arm64: dts: qcom: milos: Split up uart11 pinctrl
(no matching commit)
- [v2,5/7] arm64: dts: qcom: milos: Add WCN6755 WiFi node
(no matching commit)
- [v2,6/7] arm64: dts: qcom: milos-fairphone-fp6: Enable Bluetooth
(no matching commit)
- [v2,7/7] arm64: dts: qcom: milos-fairphone-fp6: Enable WiFi
(no matching commit)
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH] Bluetooth: l2cap: fix UAF race in l2cap_sock_cleanup_listen
From: Luiz Augusto von Dentz @ 2026-04-30 17:17 UTC (permalink / raw)
To: Safa Karakuş
Cc: linux-bluetooth@vger.kernel.org, marcel@holtmann.org,
stable@vger.kernel.org
In-Reply-To: <AS8P250MB079109F82C16BEDC4F9FE584EB372@AS8P250MB0791.EURP250.PROD.OUTLOOK.COM>
Hi Safa,
On Tue, Apr 28, 2026 at 7:30 PM Safa Karakuş <safa.karakus@secunnix.com> wrote:
>
> l2cap_sock_cleanup_listen() dequeues child sockets via
> bt_accept_dequeue() without holding a reference on the returned sk.
> A concurrent HCI disconnect can trigger l2cap_conn_del() on CPU1
> which, while holding chan->lock, calls:
>
> teardown_cb -> sock_set_flag(sk, SOCK_ZAPPED)
> close_cb -> l2cap_sock_kill(sk) -> sock_put(sk) -> kfree(sk)
>
> all before CPU0 has a chance to acquire chan->lock. CPU0 then calls
> l2cap_chan_lock() on the now-freed sk's chan (already safe because
> l2cap_chan_hold() was called first) but subsequently passes the freed
> sk pointer to l2cap_sock_kill(), causing a use-after-free read on
> sk->sk_flags and sk->sk_socket.
>
> Fix by calling sock_hold() immediately after bt_accept_dequeue() to
> prevent kfree(sk) from racing with our traversal. After acquiring
> chan->lock, check SOCK_DEAD: if l2cap_conn_del() already invoked
> l2cap_sock_kill() (which sets SOCK_DEAD), skip the duplicate call to
> avoid a double sock_put(). Drop the extra reference with sock_put()
> at the end of each loop iteration.
>
> Fixes: 15f02b910562 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode")
> Cc: stable@vger.kernel.org
> Signed-off-by: Safa Karakus<safa.karakus@secunnix.com>
> ---
> net/bluetooth/l2cap_sock.c | 18 ++++++++++++++++--
> 1 file changed, 16 insertions(+), 2 deletions(-)
>
> diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
> index 71e8c1b45..4475d3377 100644
> --- a/net/bluetooth/l2cap_sock.c
> +++ b/net/bluetooth/l2cap_sock.c
> @@ -1477,7 +1477,15 @@ static void l2cap_sock_cleanup_listen(struct sock *parent)
>
> /* Close not yet accepted channels */
> while ((sk = bt_accept_dequeue(parent, NULL))) {
> - struct l2cap_chan *chan = l2cap_pi(sk)->chan;
> + struct l2cap_chan *chan;
> +
> + /* Hold sk across the chan->lock acquisition window.
> + * A concurrent l2cap_conn_del() can call l2cap_sock_kill(sk)
> + * -> kfree(sk) inside chan->lock before we acquire it,
> + * leaving a dangling pointer.
> + */
> + sock_hold(sk);
> + chan = l2cap_pi(sk)->chan;
>
> BT_DBG("child chan %p state %s", chan,
> state_to_string(chan->state));
> @@ -1487,10 +1495,16 @@ static void l2cap_sock_cleanup_listen(struct sock *parent)
>
> __clear_chan_timer(chan);
> l2cap_chan_close(chan, ECONNRESET);
> - l2cap_sock_kill(sk);
> + /* l2cap_conn_del() may have already called l2cap_sock_kill()
> + * (setting SOCK_DEAD); skip the duplicate to avoid a
> + * double sock_put().
> + */
> + if (!sock_flag(sk, SOCK_DEAD))
> + l2cap_sock_kill(sk);
>
> l2cap_chan_unlock(chan);
> l2cap_chan_put(chan);
> + sock_put(sk);
> }
> }
>
> --
> 2.34.1
sashiko flags 2 critical flaws with these changes:
https://sashiko.dev/#/patchset/AS8P250MB079109F82C16BEDC4F9FE584EB372%40AS8P250MB0791.EURP250.PROD.OUTLOOK.COM
--
Luiz Augusto von Dentz
^ permalink raw reply
* RE: [v1] bluetooth: btintel: Add Bluetooth SAR revision 2 support
From: bluez.test.bot @ 2026-04-30 17:15 UTC (permalink / raw)
To: linux-bluetooth, kiran.k
In-Reply-To: <20260430165123.1070214-1-kiran.k@intel.com>
[-- Attachment #1: Type: text/plain, Size: 1057 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1088244
---Test result---
Test Summary:
CheckPatch PASS 1.08 seconds
GitLint PASS 0.33 seconds
SubjectPrefix FAIL 0.13 seconds
BuildKernel PASS 26.51 seconds
CheckAllWarning PASS 28.79 seconds
CheckSparse PASS 27.30 seconds
BuildKernel32 PASS 25.28 seconds
TestRunnerSetup PASS 572.34 seconds
IncrementalBuild PASS 26.13 seconds
Details
##############################
Test: SubjectPrefix - FAIL
Desc: Check subject contains "Bluetooth" prefix
Output:
"Bluetooth: " prefix is not specified in the subject
https://github.com/bluez/bluetooth-next/pull/136
---
Regards,
Linux Bluetooth
^ permalink raw reply
* Re: [PATCH v1] bluetooth: btintel: Add Bluetooth SAR revision 2 support
From: Paul Menzel @ 2026-04-30 17:11 UTC (permalink / raw)
To: Kiran K
Cc: linux-bluetooth, ravishankar.srivatsa, chethan.tumkur.narayan,
ravindra
In-Reply-To: <20260430165123.1070214-1-kiran.k@intel.com>
Dear Kiran,
Thank you for the patch.
Am 30.04.26 um 18:51 schrieb Kiran K:
> BRDS revision 2 introduces per-chain (Chain A and Chain B) TX power
> limits across five sub-bands (2.4G, 5.2G, 5.8/5.9G, 6G-low, 6G-high),
> replacing the single-chain per-modulation model of revisions 0 and 1.
>
> - Add btintel_set_sar_rev2() which sends the full Rev2 DDC sequence:
> 0x019e inc-power-mode enable flag (1 byte)
> 0x0311 2.4 GHz sub-band limits (2 bytes)
> 0x0312 5.2 GHz sub-band limits (2 bytes)
> 0x0313 5.8/5.9 GHz sub-band limits (2 bytes)
> 0x0314 5.8/5.9 GHz sub-band limits again (2 bytes, duplicate FW reg)
> 0x0315 6 GHz low sub-band limits (2 bytes)
> 0x0316 6 GHz high sub-band limits (2 bytes)
> followed by the SAR-init-complete command (0xfe25).
Please detail how to test it, and please also paste the new debug messages.
> Signed-off-by: Ravindra <ravindra@intel.com>
> Signed-off-by: Kiran K <kiran.k@intel.com>
> ---
> drivers/bluetooth/btintel.c | 154 +++++++++++++++++++++++++++++++++++-
> drivers/bluetooth/btintel.h | 18 +++++
> 2 files changed, 171 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c
> index 5e9cac090bd8..97d897623c94 100644
> --- a/drivers/bluetooth/btintel.c
> +++ b/drivers/bluetooth/btintel.c
> @@ -51,6 +51,7 @@ enum {
> #define BTINTEL_BT_DOMAIN 0x12
> #define BTINTEL_SAR_LEGACY 0
> #define BTINTEL_SAR_INC_PWR 1
> +#define BTINTEL_SAR_REV2 2
> #define BTINTEL_SAR_INC_PWR_SUPPORTED 0
>
> #define CMD_WRITE_BOOT_PARAMS 0xfc0e
> @@ -3104,6 +3105,111 @@ static int btintel_set_mutual_sar(struct hci_dev *hdev, struct btintel_sar_inc_p
> return 0;
> }
>
> +/* btintel_send_sar_rev2_band - send DDC command for one Rev2 sub-band
> + *
> + * Each DDC 0x0311-0x0316 carries 2 bytes: [ChainA_value, ChainB_value].
> + * cmd->len = 4 (2 id + 2 data)
> + * HCI total = 5 bytes (1 len + 4)
> + */
> +static int btintel_send_sar_rev2_band(struct hci_dev *hdev,
> + struct btintel_cp_ddc_write *cmd,
> + u16 id, u8 chain_a, u8 chain_b)
> +{
> + cmd->len = 4;
> + cmd->id = cpu_to_le16(id);
> + cmd->data[0] = chain_a;
> + cmd->data[1] = chain_b;
> + return btintel_send_sar_ddc(hdev, cmd, 5);
> +}
> +
> +static int btintel_set_sar_rev2(struct hci_dev *hdev,
> + struct btintel_sar_rev2 *sar)
> +{
> + struct btintel_cp_ddc_write *cmd;
> + struct sk_buff *skb;
> + u8 buffer[64];
> + bool enable;
> + int ret;
> +
> + cmd = (void *)buffer;
> +
> + /* DDC 0x019e: enable/disable increased power mode SAR (1 byte) */
> + cmd->len = 3;
> + cmd->id = cpu_to_le16(0x019e);
> + cmd->data[0] = (sar->inc_power_mode == BTINTEL_SAR_INC_PWR_SUPPORTED) ?
> + 0x01 : 0x00;
> + ret = btintel_send_sar_ddc(hdev, cmd, 4);
> + if (ret)
> + return ret;
> +
> + /* DDC 0x0311-0x0316: per sub-band ChainA + ChainB limits */
> + ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0311,
> + sar->chain_a.subband_2g4,
> + sar->chain_b.subband_2g4);
> + if (ret)
> + return ret;
> +
> + ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0312,
> + sar->chain_a.subband_5g2,
> + sar->chain_b.subband_5g2);
> + if (ret)
> + return ret;
> +
> + /* 0x0313 and 0x0314 both carry the 5G8/5G9 value */
> + ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0313,
> + sar->chain_a.subband_5g8_5g9,
> + sar->chain_b.subband_5g8_5g9);
> + if (ret)
> + return ret;
> +
> + ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0314,
> + sar->chain_a.subband_5g8_5g9,
> + sar->chain_b.subband_5g8_5g9);
> + if (ret)
> + return ret;
> +
> + ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0315,
> + sar->chain_a.subband_6g1,
> + sar->chain_b.subband_6g1);
> + if (ret)
> + return ret;
> +
> + ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0316,
> + sar->chain_a.subband_6g3,
> + sar->chain_b.subband_6g3);
> + if (ret)
> + return ret;
> +
> + /* Notify firmware that SAR initialisation is complete */
> + enable = true;
> + skb = __hci_cmd_sync(hdev, 0xfe25, 1, &enable, HCI_CMD_TIMEOUT);
> + if (IS_ERR(skb)) {
> + bt_dev_warn(hdev, "Failed to send Intel SAR Rev2 Enable (%ld)",
> + PTR_ERR(skb));
> + return PTR_ERR(skb);
> + }
> +
> + kfree_skb(skb);
> + return 0;
> +}
> +
> +static int btintel_sar_rev2_send_to_device(struct hci_dev *hdev,
> + struct btintel_sar_rev2 *sar,
> + struct intel_version_tlv *ver)
> +{
> + u16 cnvi = ver->cnvi_top & 0xfff;
> + u16 cnvr = ver->cnvr_top & 0xfff;
> +
> + if (cnvi < BTINTEL_CNVI_BLAZARI || cnvr != BTINTEL_CNVR_WHP2) {
> + bt_dev_dbg(hdev, "BT SAR Rev2 not supported on this platform (cnvi=0x%x cnvr=0x%x)",
> + cnvi, cnvr);
> + return -EOPNOTSUPP;
> + }
> +
> + bt_dev_info(hdev, "Applying Bluetooth SAR Rev2");
> + return btintel_set_sar_rev2(hdev, sar);
> +}
> +
> static int btintel_sar_send_to_device(struct hci_dev *hdev, struct btintel_sar_inc_pwr *sar,
> struct intel_version_tlv *ver)
> {
> @@ -3130,6 +3236,7 @@ static int btintel_acpi_set_sar(struct hci_dev *hdev, struct intel_version_tlv *
> {
> union acpi_object *bt_pkg, *buffer = NULL;
> struct btintel_sar_inc_pwr sar;
> + struct btintel_sar_rev2 sar_rev2;
> acpi_status status;
> u8 revision;
> int ret;
> @@ -3150,14 +3257,59 @@ static int btintel_acpi_set_sar(struct hci_dev *hdev, struct intel_version_tlv *
> goto error;
> }
>
> + if (buffer->package.elements[0].type != ACPI_TYPE_INTEGER) {
> + bt_dev_warn(hdev, "BT_SAR: unexpected ACPI type for revision field");
> + ret = -EINVAL;
> + goto error;
> + }
> +
> revision = buffer->package.elements[0].integer.value;
>
> - if (revision > BTINTEL_SAR_INC_PWR) {
> + if (revision > BTINTEL_SAR_REV2) {
> bt_dev_dbg(hdev, "BT_SAR: revision: 0x%2.2x not supported", revision);
> ret = -EOPNOTSUPP;
> goto error;
> }
>
> + if (revision == BTINTEL_SAR_REV2 && bt_pkg->package.count == 13) {
> + memset(&sar_rev2, 0, sizeof(sar_rev2));
> + sar_rev2.revision = revision;
> + sar_rev2.bt_sar_bios = bt_pkg->package.elements[1].integer.value;
> + sar_rev2.inc_power_mode = bt_pkg->package.elements[2].integer.value;
> +
> + sar_rev2.chain_a.subband_2g4 = bt_pkg->package.elements[3].integer.value;
> + sar_rev2.chain_a.subband_5g2 = bt_pkg->package.elements[4].integer.value;
> + sar_rev2.chain_a.subband_5g8_5g9 = bt_pkg->package.elements[5].integer.value;
> + sar_rev2.chain_a.subband_6g1 = bt_pkg->package.elements[6].integer.value;
> + sar_rev2.chain_a.subband_6g3 = bt_pkg->package.elements[7].integer.value;
> +
> + sar_rev2.chain_b.subband_2g4 = bt_pkg->package.elements[8].integer.value;
> + sar_rev2.chain_b.subband_5g2 = bt_pkg->package.elements[9].integer.value;
> + sar_rev2.chain_b.subband_5g8_5g9 = bt_pkg->package.elements[10].integer.value;
> + sar_rev2.chain_b.subband_6g1 = bt_pkg->package.elements[11].integer.value;
> + sar_rev2.chain_b.subband_6g3 = bt_pkg->package.elements[12].integer.value;
gemini/gemini-3.1-pro-preview has a comment [1]:
> Is it safe to assume elements 1 through 12 are all of type ACPI_TYPE_INTEGER
> here?
> I see an explicit type check was added just above for the revision field
> at buffer->package.elements[0], but elements 1 through 12 in bt_pkg are
> accessed without similar validation.
> If the ACPI table provides a string or buffer for any of these elements, could
> the kernel incorrectly read overlapping union fields (such as string lengths or
> pointers) as integers and send corrupted sub-band limits to the firmware?
> +
> + bt_dev_dbg(hdev, "BT SAR Rev2: revision=%u bt_sar_bios=%u inc_power_mode=%u",
> + sar_rev2.revision, sar_rev2.bt_sar_bios, sar_rev2.inc_power_mode);
> + bt_dev_dbg(hdev, "BT SAR Rev2 Chain A: 2g4=%u 5g2=%u 5g8_5g9=%u 6g1=%u 6g3=%u",
> + sar_rev2.chain_a.subband_2g4, sar_rev2.chain_a.subband_5g2,
> + sar_rev2.chain_a.subband_5g8_5g9, sar_rev2.chain_a.subband_6g1,
> + sar_rev2.chain_a.subband_6g3);
> + bt_dev_dbg(hdev, "BT SAR Rev2 Chain B: 2g4=%u 5g2=%u 5g8_5g9=%u 6g1=%u 6g3=%u",
> + sar_rev2.chain_b.subband_2g4, sar_rev2.chain_b.subband_5g2,
> + sar_rev2.chain_b.subband_5g8_5g9, sar_rev2.chain_b.subband_6g1,
> + sar_rev2.chain_b.subband_6g3);
> +
> + if (sar_rev2.bt_sar_bios != 1) {
> + bt_dev_info(hdev, "Bluetooth SAR Rev2 is not enabled");
> + ret = -EOPNOTSUPP;
> + goto error;
> + }
> +
> + ret = btintel_sar_rev2_send_to_device(hdev, &sar_rev2, ver);
> + goto error;
> + }
> +
> memset(&sar, 0, sizeof(sar));
>
> if (revision == BTINTEL_SAR_LEGACY && bt_pkg->package.count == 8) {
> diff --git a/drivers/bluetooth/btintel.h b/drivers/bluetooth/btintel.h
> index 70d812ad36a2..3b5a228ca3c0 100644
> --- a/drivers/bluetooth/btintel.h
> +++ b/drivers/bluetooth/btintel.h
> @@ -64,6 +64,7 @@ struct intel_tlv {
>
> /* CNVR */
> #define BTINTEL_CNVR_FMP2 0x910
> +#define BTINTEL_CNVR_WHP2 0xA10 /* Whale Peak2 - Panther Lake */
>
> #define BTINTEL_IMG_BOOTLOADER 0x01 /* Bootloader image */
> #define BTINTEL_IMG_IML 0x02 /* Intermediate image */
> @@ -202,6 +203,23 @@ struct btintel_sar_inc_pwr {
> u8 le_lr;
> };
>
> +/* Bluetooth SAR feature (BRDS), Revision 2 - per-chain sub-band power limits */
> +struct btintel_sar_band_limits {
> + u8 subband_2g4;
> + u8 subband_5g2;
> + u8 subband_5g8_5g9;
> + u8 subband_6g1;
> + u8 subband_6g3;
> +};
> +
> +struct btintel_sar_rev2 {
> + u8 revision;
> + u32 bt_sar_bios; /* 1: BIOS-managed SAR enabled */
> + u32 inc_power_mode; /* 0: supported, 1: disabled */
> + struct btintel_sar_band_limits chain_a;
> + struct btintel_sar_band_limits chain_b;
> +};
> +
> #define INTEL_HW_PLATFORM(cnvx_bt) ((u8)(((cnvx_bt) & 0x0000ff00) >> 8))
> #define INTEL_HW_VARIANT(cnvx_bt) ((u8)(((cnvx_bt) & 0x003f0000) >> 16))
> #define INTEL_CNVX_TOP_TYPE(cnvx_top) ((cnvx_top) & 0x00000fff)
[1]:
https://sashiko.dev/#/patchset/20260430165123.1070214-1-kiran.k%40intel.com
^ permalink raw reply
* RE: [RFC,BlueZ,1/3] shared/hci: Add BPF filter for registered events
From: bluez.test.bot @ 2026-04-30 16:48 UTC (permalink / raw)
To: linux-bluetooth, luiz.dentz
In-Reply-To: <20260430155038.426968-1-luiz.dentz@gmail.com>
[-- Attachment #1: Type: text/plain, Size: 3813 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1088223
---Test result---
Test Summary:
CheckPatch FAIL 1.10 seconds
GitLint PASS 0.61 seconds
BuildEll PASS 19.80 seconds
BluezMake PASS 643.54 seconds
CheckSmatch PASS 346.70 seconds
bluezmakeextell PASS 179.12 seconds
IncrementalBuild PASS 693.44 seconds
ScanBuild PASS 995.59 seconds
Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
[RFC,BlueZ,1/3] shared/hci: Add BPF filter for registered events
WARNING:BAD_SIGN_OFF: Non-standard signature: Assisted-by:
#106:
Assisted-by: Claude:claude-opus-4.6
ERROR:BAD_SIGN_OFF: Unrecognized email address: 'Claude:claude-opus-4.6'
#106:
Assisted-by: Claude:claude-opus-4.6
/github/workspace/src/patch/14549670.patch total: 1 errors, 1 warnings, 108 lines checked
NOTE: For some of the reported defects, checkpatch may be able to
mechanically convert to the typical style using --fix or --fix-inplace.
/github/workspace/src/patch/14549670.patch has style problems, please review.
NOTE: Ignored message types: COMMIT_MESSAGE COMPLEX_MACRO CONST_STRUCT FILE_PATH_CHANGES MISSING_SIGN_OFF PREFER_PACKED SPDX_LICENSE_TAG SPLIT_STRING SSCANF_TO_KSTRTO
NOTE: If any of the errors are false positives, please report
them to the maintainer, see CHECKPATCH in MAINTAINERS.
[RFC,BlueZ,2/3] shared/hci: Add bt_hci_register_subevent for LE Meta events
WARNING:BAD_SIGN_OFF: Non-standard signature: Assisted-by:
#111:
Assisted-by: Claude:claude-opus-4.6
ERROR:BAD_SIGN_OFF: Unrecognized email address: 'Claude:claude-opus-4.6'
#111:
Assisted-by: Claude:claude-opus-4.6
WARNING:LONG_LINE_COMMENT: line length of 88 exceeds 80 columns
#234: FILE: src/shared/hci.c:635:
+ /* Without subevents: 3 (defaults) + evt_count + reject + accept = evt_count + 5
/github/workspace/src/patch/14549671.patch total: 1 errors, 2 warnings, 316 lines checked
NOTE: For some of the reported defects, checkpatch may be able to
mechanically convert to the typical style using --fix or --fix-inplace.
/github/workspace/src/patch/14549671.patch has style problems, please review.
NOTE: Ignored message types: COMMIT_MESSAGE COMPLEX_MACRO CONST_STRUCT FILE_PATH_CHANGES MISSING_SIGN_OFF PREFER_PACKED SPDX_LICENSE_TAG SPLIT_STRING SSCANF_TO_KSTRTO
NOTE: If any of the errors are false positives, please report
them to the maintainer, see CHECKPATCH in MAINTAINERS.
[RFC,BlueZ,3/3] ranging/rap_hci: Use bt_hci_register_subevent for LE CS events
WARNING:BAD_SIGN_OFF: Non-standard signature: Assisted-by:
#109:
Assisted-by: Claude:claude-opus-4.6
ERROR:BAD_SIGN_OFF: Unrecognized email address: 'Claude:claude-opus-4.6'
#109:
Assisted-by: Claude:claude-opus-4.6
/github/workspace/src/patch/14549672.patch total: 1 errors, 1 warnings, 269 lines checked
NOTE: For some of the reported defects, checkpatch may be able to
mechanically convert to the typical style using --fix or --fix-inplace.
/github/workspace/src/patch/14549672.patch has style problems, please review.
NOTE: Ignored message types: COMMIT_MESSAGE COMPLEX_MACRO CONST_STRUCT FILE_PATH_CHANGES MISSING_SIGN_OFF PREFER_PACKED SPDX_LICENSE_TAG SPLIT_STRING SSCANF_TO_KSTRTO
NOTE: If any of the errors are false positives, please report
them to the maintainer, see CHECKPATCH in MAINTAINERS.
https://github.com/bluez/bluez/pull/2087
---
Regards,
Linux Bluetooth
^ permalink raw reply
* [BUG?] bluetooth LE ISO sockets never get freed because of SOCK_DEAD confusion?
From: Jann Horn @ 2026-04-30 16:47 UTC (permalink / raw)
To: Marcel Holtmann, Luiz Augusto von Dentz, linux-bluetooth
Cc: kernel list, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, Network Development
I can't figure out how to release a bluetooth LE ISO socket such that
it gets freed.
ISO sockets are placed on the iso_sk_list, which holds references to
its entries. The only place in which an ISO socket can be removed from
this list is iso_sock_kill(), which calls bt_sock_unlink(&iso_sk_list,
sk).
But iso_sock_kill() bails out immediately if either sk->sk_socket is
still set, or SOCK_DEAD is set. This means that if anything other than
iso_sock_kill() sets SOCK_DEAD, the socket can never be freed.
When I call close() on an ISO socket returned by accept(), the
behavior I observe is:
sock_close
__sock_release
iso_sock_release
iso_sock_close
iso_sock_kill
[bails out because sk->sk_socket is still non-NULL]
sock_orphan
sk_set_flag(sk, SOCK_DEAD)
sk_set_socket(sk, NULL)
iso_sock_kill
[bails out because SOCK_DEAD is now set]
Am I missing something, or can ISO sockets (once they have been
accepted) never be freed?
^ permalink raw reply
* [PATCH v1] bluetooth: btintel: Add Bluetooth SAR revision 2 support
From: Kiran K @ 2026-04-30 16:51 UTC (permalink / raw)
To: linux-bluetooth
Cc: ravishankar.srivatsa, chethan.tumkur.narayan, ravindra, Kiran K
BRDS revision 2 introduces per-chain (Chain A and Chain B) TX power
limits across five sub-bands (2.4G, 5.2G, 5.8/5.9G, 6G-low, 6G-high),
replacing the single-chain per-modulation model of revisions 0 and 1.
- Add btintel_set_sar_rev2() which sends the full Rev2 DDC sequence:
0x019e inc-power-mode enable flag (1 byte)
0x0311 2.4 GHz sub-band limits (2 bytes)
0x0312 5.2 GHz sub-band limits (2 bytes)
0x0313 5.8/5.9 GHz sub-band limits (2 bytes)
0x0314 5.8/5.9 GHz sub-band limits again (2 bytes, duplicate FW reg)
0x0315 6 GHz low sub-band limits (2 bytes)
0x0316 6 GHz high sub-band limits (2 bytes)
followed by the SAR-init-complete command (0xfe25).
Signed-off-by: Ravindra <ravindra@intel.com>
Signed-off-by: Kiran K <kiran.k@intel.com>
---
drivers/bluetooth/btintel.c | 154 +++++++++++++++++++++++++++++++++++-
drivers/bluetooth/btintel.h | 18 +++++
2 files changed, 171 insertions(+), 1 deletion(-)
diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c
index 5e9cac090bd8..97d897623c94 100644
--- a/drivers/bluetooth/btintel.c
+++ b/drivers/bluetooth/btintel.c
@@ -51,6 +51,7 @@ enum {
#define BTINTEL_BT_DOMAIN 0x12
#define BTINTEL_SAR_LEGACY 0
#define BTINTEL_SAR_INC_PWR 1
+#define BTINTEL_SAR_REV2 2
#define BTINTEL_SAR_INC_PWR_SUPPORTED 0
#define CMD_WRITE_BOOT_PARAMS 0xfc0e
@@ -3104,6 +3105,111 @@ static int btintel_set_mutual_sar(struct hci_dev *hdev, struct btintel_sar_inc_p
return 0;
}
+/* btintel_send_sar_rev2_band - send DDC command for one Rev2 sub-band
+ *
+ * Each DDC 0x0311-0x0316 carries 2 bytes: [ChainA_value, ChainB_value].
+ * cmd->len = 4 (2 id + 2 data)
+ * HCI total = 5 bytes (1 len + 4)
+ */
+static int btintel_send_sar_rev2_band(struct hci_dev *hdev,
+ struct btintel_cp_ddc_write *cmd,
+ u16 id, u8 chain_a, u8 chain_b)
+{
+ cmd->len = 4;
+ cmd->id = cpu_to_le16(id);
+ cmd->data[0] = chain_a;
+ cmd->data[1] = chain_b;
+ return btintel_send_sar_ddc(hdev, cmd, 5);
+}
+
+static int btintel_set_sar_rev2(struct hci_dev *hdev,
+ struct btintel_sar_rev2 *sar)
+{
+ struct btintel_cp_ddc_write *cmd;
+ struct sk_buff *skb;
+ u8 buffer[64];
+ bool enable;
+ int ret;
+
+ cmd = (void *)buffer;
+
+ /* DDC 0x019e: enable/disable increased power mode SAR (1 byte) */
+ cmd->len = 3;
+ cmd->id = cpu_to_le16(0x019e);
+ cmd->data[0] = (sar->inc_power_mode == BTINTEL_SAR_INC_PWR_SUPPORTED) ?
+ 0x01 : 0x00;
+ ret = btintel_send_sar_ddc(hdev, cmd, 4);
+ if (ret)
+ return ret;
+
+ /* DDC 0x0311-0x0316: per sub-band ChainA + ChainB limits */
+ ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0311,
+ sar->chain_a.subband_2g4,
+ sar->chain_b.subband_2g4);
+ if (ret)
+ return ret;
+
+ ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0312,
+ sar->chain_a.subband_5g2,
+ sar->chain_b.subband_5g2);
+ if (ret)
+ return ret;
+
+ /* 0x0313 and 0x0314 both carry the 5G8/5G9 value */
+ ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0313,
+ sar->chain_a.subband_5g8_5g9,
+ sar->chain_b.subband_5g8_5g9);
+ if (ret)
+ return ret;
+
+ ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0314,
+ sar->chain_a.subband_5g8_5g9,
+ sar->chain_b.subband_5g8_5g9);
+ if (ret)
+ return ret;
+
+ ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0315,
+ sar->chain_a.subband_6g1,
+ sar->chain_b.subband_6g1);
+ if (ret)
+ return ret;
+
+ ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0316,
+ sar->chain_a.subband_6g3,
+ sar->chain_b.subband_6g3);
+ if (ret)
+ return ret;
+
+ /* Notify firmware that SAR initialisation is complete */
+ enable = true;
+ skb = __hci_cmd_sync(hdev, 0xfe25, 1, &enable, HCI_CMD_TIMEOUT);
+ if (IS_ERR(skb)) {
+ bt_dev_warn(hdev, "Failed to send Intel SAR Rev2 Enable (%ld)",
+ PTR_ERR(skb));
+ return PTR_ERR(skb);
+ }
+
+ kfree_skb(skb);
+ return 0;
+}
+
+static int btintel_sar_rev2_send_to_device(struct hci_dev *hdev,
+ struct btintel_sar_rev2 *sar,
+ struct intel_version_tlv *ver)
+{
+ u16 cnvi = ver->cnvi_top & 0xfff;
+ u16 cnvr = ver->cnvr_top & 0xfff;
+
+ if (cnvi < BTINTEL_CNVI_BLAZARI || cnvr != BTINTEL_CNVR_WHP2) {
+ bt_dev_dbg(hdev, "BT SAR Rev2 not supported on this platform (cnvi=0x%x cnvr=0x%x)",
+ cnvi, cnvr);
+ return -EOPNOTSUPP;
+ }
+
+ bt_dev_info(hdev, "Applying Bluetooth SAR Rev2");
+ return btintel_set_sar_rev2(hdev, sar);
+}
+
static int btintel_sar_send_to_device(struct hci_dev *hdev, struct btintel_sar_inc_pwr *sar,
struct intel_version_tlv *ver)
{
@@ -3130,6 +3236,7 @@ static int btintel_acpi_set_sar(struct hci_dev *hdev, struct intel_version_tlv *
{
union acpi_object *bt_pkg, *buffer = NULL;
struct btintel_sar_inc_pwr sar;
+ struct btintel_sar_rev2 sar_rev2;
acpi_status status;
u8 revision;
int ret;
@@ -3150,14 +3257,59 @@ static int btintel_acpi_set_sar(struct hci_dev *hdev, struct intel_version_tlv *
goto error;
}
+ if (buffer->package.elements[0].type != ACPI_TYPE_INTEGER) {
+ bt_dev_warn(hdev, "BT_SAR: unexpected ACPI type for revision field");
+ ret = -EINVAL;
+ goto error;
+ }
+
revision = buffer->package.elements[0].integer.value;
- if (revision > BTINTEL_SAR_INC_PWR) {
+ if (revision > BTINTEL_SAR_REV2) {
bt_dev_dbg(hdev, "BT_SAR: revision: 0x%2.2x not supported", revision);
ret = -EOPNOTSUPP;
goto error;
}
+ if (revision == BTINTEL_SAR_REV2 && bt_pkg->package.count == 13) {
+ memset(&sar_rev2, 0, sizeof(sar_rev2));
+ sar_rev2.revision = revision;
+ sar_rev2.bt_sar_bios = bt_pkg->package.elements[1].integer.value;
+ sar_rev2.inc_power_mode = bt_pkg->package.elements[2].integer.value;
+
+ sar_rev2.chain_a.subband_2g4 = bt_pkg->package.elements[3].integer.value;
+ sar_rev2.chain_a.subband_5g2 = bt_pkg->package.elements[4].integer.value;
+ sar_rev2.chain_a.subband_5g8_5g9 = bt_pkg->package.elements[5].integer.value;
+ sar_rev2.chain_a.subband_6g1 = bt_pkg->package.elements[6].integer.value;
+ sar_rev2.chain_a.subband_6g3 = bt_pkg->package.elements[7].integer.value;
+
+ sar_rev2.chain_b.subband_2g4 = bt_pkg->package.elements[8].integer.value;
+ sar_rev2.chain_b.subband_5g2 = bt_pkg->package.elements[9].integer.value;
+ sar_rev2.chain_b.subband_5g8_5g9 = bt_pkg->package.elements[10].integer.value;
+ sar_rev2.chain_b.subband_6g1 = bt_pkg->package.elements[11].integer.value;
+ sar_rev2.chain_b.subband_6g3 = bt_pkg->package.elements[12].integer.value;
+
+ bt_dev_dbg(hdev, "BT SAR Rev2: revision=%u bt_sar_bios=%u inc_power_mode=%u",
+ sar_rev2.revision, sar_rev2.bt_sar_bios, sar_rev2.inc_power_mode);
+ bt_dev_dbg(hdev, "BT SAR Rev2 Chain A: 2g4=%u 5g2=%u 5g8_5g9=%u 6g1=%u 6g3=%u",
+ sar_rev2.chain_a.subband_2g4, sar_rev2.chain_a.subband_5g2,
+ sar_rev2.chain_a.subband_5g8_5g9, sar_rev2.chain_a.subband_6g1,
+ sar_rev2.chain_a.subband_6g3);
+ bt_dev_dbg(hdev, "BT SAR Rev2 Chain B: 2g4=%u 5g2=%u 5g8_5g9=%u 6g1=%u 6g3=%u",
+ sar_rev2.chain_b.subband_2g4, sar_rev2.chain_b.subband_5g2,
+ sar_rev2.chain_b.subband_5g8_5g9, sar_rev2.chain_b.subband_6g1,
+ sar_rev2.chain_b.subband_6g3);
+
+ if (sar_rev2.bt_sar_bios != 1) {
+ bt_dev_info(hdev, "Bluetooth SAR Rev2 is not enabled");
+ ret = -EOPNOTSUPP;
+ goto error;
+ }
+
+ ret = btintel_sar_rev2_send_to_device(hdev, &sar_rev2, ver);
+ goto error;
+ }
+
memset(&sar, 0, sizeof(sar));
if (revision == BTINTEL_SAR_LEGACY && bt_pkg->package.count == 8) {
diff --git a/drivers/bluetooth/btintel.h b/drivers/bluetooth/btintel.h
index 70d812ad36a2..3b5a228ca3c0 100644
--- a/drivers/bluetooth/btintel.h
+++ b/drivers/bluetooth/btintel.h
@@ -64,6 +64,7 @@ struct intel_tlv {
/* CNVR */
#define BTINTEL_CNVR_FMP2 0x910
+#define BTINTEL_CNVR_WHP2 0xA10 /* Whale Peak2 - Panther Lake */
#define BTINTEL_IMG_BOOTLOADER 0x01 /* Bootloader image */
#define BTINTEL_IMG_IML 0x02 /* Intermediate image */
@@ -202,6 +203,23 @@ struct btintel_sar_inc_pwr {
u8 le_lr;
};
+/* Bluetooth SAR feature (BRDS), Revision 2 - per-chain sub-band power limits */
+struct btintel_sar_band_limits {
+ u8 subband_2g4;
+ u8 subband_5g2;
+ u8 subband_5g8_5g9;
+ u8 subband_6g1;
+ u8 subband_6g3;
+};
+
+struct btintel_sar_rev2 {
+ u8 revision;
+ u32 bt_sar_bios; /* 1: BIOS-managed SAR enabled */
+ u32 inc_power_mode; /* 0: supported, 1: disabled */
+ struct btintel_sar_band_limits chain_a;
+ struct btintel_sar_band_limits chain_b;
+};
+
#define INTEL_HW_PLATFORM(cnvx_bt) ((u8)(((cnvx_bt) & 0x0000ff00) >> 8))
#define INTEL_HW_VARIANT(cnvx_bt) ((u8)(((cnvx_bt) & 0x003f0000) >> 16))
#define INTEL_CNVX_TOP_TYPE(cnvx_top) ((cnvx_top) & 0x00000fff)
--
2.53.0
^ permalink raw reply related
* [bluez/bluez]
From: BluezTestBot @ 2026-04-30 15:59 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/1087948
Home: https://github.com/bluez/bluez
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* [bluez/bluez] 88fd81: shared/hci: Add BPF filter for registered events
From: Luiz Augusto von Dentz @ 2026-04-30 15:59 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/1088223
Home: https://github.com/bluez/bluez
Commit: 88fd81c365dee91d3eaf97945282539636baf809
https://github.com/bluez/bluez/commit/88fd81c365dee91d3eaf97945282539636baf809
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: 2026-04-30 (Thu, 30 Apr 2026)
Changed paths:
M src/shared/hci.c
Log Message:
-----------
shared/hci: Add BPF filter for registered events
Implement a BPF socket filter in bt_hci_register/bt_hci_unregister that
uses setsockopt(SO_ATTACH_FILTER) to only accept HCI events that have
been registered, plus BT_HCI_EVT_CMD_COMPLETE and BT_HCI_EVT_CMD_STATUS
which are always needed for command response processing.
The filter is rebuilt each time an event is registered or unregistered,
and only applies to non-stream (raw socket) connections.
Assisted-by: Claude:claude-opus-4.6
Commit: 576c56e190179d7cbecfa5b879705a79e847debf
https://github.com/bluez/bluez/commit/576c56e190179d7cbecfa5b879705a79e847debf
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: 2026-04-30 (Thu, 30 Apr 2026)
Changed paths:
M src/shared/hci.c
M src/shared/hci.h
Log Message:
-----------
shared/hci: Add bt_hci_register_subevent for LE Meta events
Add bt_hci_register_subevent/bt_hci_unregister_subevent API that allows
registering for specific LE Meta Event subevents. The BPF filter is
extended to accept BT_HCI_EVT_LE_META_EVENT packets and then check the
subevent byte (offset 4) against registered subevents.
Since bt_hci_register_subevent is only used with BT_HCI_EVT_LE_META_EVENT,
the event parameter is omitted. The subevent list reuses struct evt where
evt->event stores the subevent code.
Assisted-by: Claude:claude-opus-4.6
Commit: e6772a47c743ba2a3a84480dbd06b94346cfa74a
https://github.com/bluez/bluez/commit/e6772a47c743ba2a3a84480dbd06b94346cfa74a
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: 2026-04-30 (Thu, 30 Apr 2026)
Changed paths:
M profiles/ranging/rap_hci.c
Log Message:
-----------
ranging/rap_hci: Use bt_hci_register_subevent for LE CS events
Replace the single BT_HCI_EVT_LE_META_EVENT registration and subevent
dispatch table with individual bt_hci_register_subevent calls for each
CS subevent. This enables BPF filtering at the socket level for each
specific subevent and removes the manual subevent dispatch logic.
Event IDs are stored in a struct queue for flexible management.
Assisted-by: Claude:claude-opus-4.6
Compare: https://github.com/bluez/bluez/compare/88fd81c365de%5E...e6772a47c743
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* [RFC PATCH BlueZ 3/3] ranging/rap_hci: Use bt_hci_register_subevent for LE CS events
From: Luiz Augusto von Dentz @ 2026-04-30 15:50 UTC (permalink / raw)
To: linux-bluetooth
In-Reply-To: <20260430155038.426968-1-luiz.dentz@gmail.com>
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Replace the single BT_HCI_EVT_LE_META_EVENT registration and subevent
dispatch table with individual bt_hci_register_subevent calls for each
CS subevent. This enables BPF filtering at the socket level for each
specific subevent and removes the manual subevent dispatch logic.
Event IDs are stored in a struct queue for flexible management.
Assisted-by: Claude:claude-opus-4.6
---
profiles/ranging/rap_hci.c | 193 ++++++++++++++-----------------------
1 file changed, 71 insertions(+), 122 deletions(-)
diff --git a/profiles/ranging/rap_hci.c b/profiles/ranging/rap_hci.c
index 08ddc077ce94..8e65e5ef87bd 100644
--- a/profiles/ranging/rap_hci.c
+++ b/profiles/ranging/rap_hci.c
@@ -61,7 +61,7 @@ struct cs_state_machine {
enum cs_state old_state;
struct bt_hci *hci;
struct bt_rap *rap;
- unsigned int event_id;
+ struct queue *event_ids;
bool initiator;
bool procedure_active;
struct bt_rap_hci_cs_options cs_opt; /* Per-instance CS options */
@@ -302,7 +302,7 @@ static void rap_send_hci_def_settings_command(struct cs_state_machine *sm,
error("Failed to send default settings cmd");
}
-static void rap_rd_rmt_supp_cap_cmplt_evt(const uint8_t *data, uint8_t size,
+static void rap_rd_rmt_supp_cap_cmplt_evt(const void *data, uint8_t size,
void *user_data)
{
struct cs_state_machine *sm = user_data;
@@ -348,7 +348,7 @@ static void rap_rd_rmt_supp_cap_cmplt_evt(const uint8_t *data, uint8_t size,
cs_set_state(sm, CS_STATE_INIT);
}
-static void rap_cs_config_cmplt_evt(const uint8_t *data, uint8_t size,
+static void rap_cs_config_cmplt_evt(const void *data, uint8_t size,
void *user_data)
{
struct cs_state_machine *sm = user_data;
@@ -439,7 +439,7 @@ static void rap_cs_config_cmplt_evt(const uint8_t *data, uint8_t size,
bt_rap_hci_cs_config_complete_callback(size, &rap_ev, sm->rap);
}
-static void rap_cs_sec_enable_cmplt_evt(const uint8_t *data, uint8_t size,
+static void rap_cs_sec_enable_cmplt_evt(const void *data, uint8_t size,
void *user_data)
{
struct cs_state_machine *sm = user_data;
@@ -500,7 +500,7 @@ static void rap_cs_sec_enable_cmplt_evt(const uint8_t *data, uint8_t size,
bt_rap_hci_cs_sec_enable_complete_callback(size, &rap_ev, sm->rap);
}
-static void rap_cs_proc_enable_cmplt_evt(const uint8_t *data, uint8_t size,
+static void rap_cs_proc_enable_cmplt_evt(const void *data, uint8_t size,
void *user_data)
{
struct cs_state_machine *sm = user_data;
@@ -800,7 +800,7 @@ static void parse_cs_step(struct iovec *iov, struct cs_step_data *step,
}
}
-static void rap_cs_subevt_result_evt(const uint8_t *data, uint8_t size,
+static void rap_cs_subevt_result_evt(const void *data, uint8_t size,
void *user_data)
{
struct cs_state_machine *sm = (struct cs_state_machine *) user_data;
@@ -910,7 +910,7 @@ send_event:
free(rap_ev);
}
-static void rap_cs_subevt_result_cont_evt(const uint8_t *data, uint8_t size,
+static void rap_cs_subevt_result_cont_evt(const void *data, uint8_t size,
void *user_data)
{
struct cs_state_machine *sm = (struct cs_state_machine *) user_data;
@@ -1009,113 +1009,12 @@ send_event:
}
/* Subevent handler function type */
-typedef void (*subevent_handler_t)(const uint8_t *data, uint8_t size,
- void *user_data);
-/* Subevent table entry */
-struct subevent_entry {
- uint8_t opcode;
- uint8_t min_len;
- uint8_t max_len;
- subevent_handler_t handler;
- const char *name;
-};
-
-/* Macro to define HCI event entries
- * Note: min_len excludes the subevent byte since it's stripped before dispatch
- */
-#define HCI_EVT(_opcode, _struct, _handler, _name) \
- { \
- .opcode = _opcode, \
- .min_len = sizeof(_struct), \
- .max_len = 0xFF, \
- .handler = _handler, \
- .name = _name \
- }
-
-/* Subevent dispatch table */
-static const struct subevent_entry subevent_table[] = {
- HCI_EVT(BT_HCI_EVT_LE_CS_RD_REM_SUPP_CAP_COMPLETE,
- struct bt_hci_evt_le_cs_rd_rem_supp_cap_complete,
- rap_rd_rmt_supp_cap_cmplt_evt,
- "CS Read Remote Supported Capabilities Complete"),
- HCI_EVT(BT_HCI_EVT_LE_CS_CONFIG_COMPLETE,
- struct bt_hci_evt_le_cs_config_complete,
- rap_cs_config_cmplt_evt,
- "CS Config Complete"),
- HCI_EVT(BT_HCI_EVT_LE_CS_SEC_ENABLE_COMPLETE,
- struct bt_hci_evt_le_cs_sec_enable_complete,
- rap_cs_sec_enable_cmplt_evt,
- "CS Security Enable Complete"),
- HCI_EVT(BT_HCI_EVT_LE_CS_PROC_ENABLE_COMPLETE,
- struct bt_hci_evt_le_cs_proc_enable_complete,
- rap_cs_proc_enable_cmplt_evt,
- "CS Procedure Enable Complete"),
- HCI_EVT(BT_HCI_EVT_LE_CS_SUBEVENT_RESULT,
- struct bt_hci_evt_le_cs_subevent_result,
- rap_cs_subevt_result_evt,
- "CS Subevent Result"),
- HCI_EVT(BT_HCI_EVT_LE_CS_SUBEVENT_RESULT_CONTINUE,
- struct bt_hci_evt_le_cs_subevent_result_continue,
- rap_cs_subevt_result_cont_evt,
- "CS Subevent Result Continue")
-};
-
-#undef HCI_EVT
-
-#define SUBEVENT_TABLE_SIZE ARRAY_SIZE(subevent_table)
-
-/* HCI Event Registration */
-static void rap_handle_hci_events(const void *data, uint8_t size,
- void *user_data)
+static void unregister_event_id(void *data, void *user_data)
{
- struct iovec iov;
- uint8_t subevent;
- const struct subevent_entry *entry = NULL;
- size_t i;
+ struct bt_hci *hci = user_data;
- /* Initialize iovec with the event data */
- iov.iov_base = (void *) data;
- iov.iov_len = size;
-
- /* Pull the subevent code */
- if (!util_iov_pull_u8(&iov, &subevent)) {
- DBG("Failed to parse subevent code");
- return;
- }
-
- /* Find the subevent in the table */
- for (i = 0; i < SUBEVENT_TABLE_SIZE; i++) {
- if (subevent_table[i].opcode == subevent) {
- entry = &subevent_table[i];
- break;
- }
- }
-
- /* Check if subevent is supported */
- if (!entry) {
- DBG("Unknown subevent: 0x%02X", subevent);
- return;
- }
-
- /* Validate payload length */
- if (iov.iov_len < entry->min_len) {
- DBG("%s: payload too short (%zu < %u)",
- entry->name, iov.iov_len, entry->min_len);
- return;
- }
-
- if (entry->max_len != 0xFF && iov.iov_len > entry->max_len) {
- DBG("%s: payload too long (%zu > %u)",
- entry->name, iov.iov_len, entry->max_len);
- return;
- }
-
- /* Call the handler */
- DBG("Handling %s (opcode=0x%02X, len=%zu)",
- entry->name, subevent, iov.iov_len);
-
- entry->handler(iov.iov_base, iov.iov_len, user_data);
+ bt_hci_unregister_subevent(hci, PTR_TO_UINT(data));
}
void *bt_rap_attach_hci(struct bt_rap *rap, struct bt_hci *hci,
@@ -1123,6 +1022,7 @@ void *bt_rap_attach_hci(struct bt_rap *rap, struct bt_hci *hci,
int8_t max_tx_power)
{
struct cs_state_machine *sm;
+ unsigned int id;
if (!rap || !hci) {
error("rap or hci null");
@@ -1140,22 +1040,68 @@ void *bt_rap_attach_hci(struct bt_rap *rap, struct bt_hci *hci,
cs_state_machine_init(sm, rap, hci, role, cs_sync_ant_sel,
max_tx_power);
- sm->event_id = bt_hci_register(hci, BT_HCI_EVT_LE_META_EVENT,
- rap_handle_hci_events, sm, NULL);
+ sm->event_ids = queue_new();
- DBG("bt_hci_register done, event_id : %d", sm->event_id);
+ /* Register each LE Meta subevent individually */
+ id = bt_hci_register_subevent(hci,
+ BT_HCI_EVT_LE_CS_RD_REM_SUPP_CAP_COMPLETE,
+ rap_rd_rmt_supp_cap_cmplt_evt, sm, NULL);
+ if (!id)
+ goto fail;
- if (!sm->event_id) {
- error("Failed to register hci le meta events");
- error("event_id=0x%02X", sm->event_id);
- free(sm);
- return NULL;
- }
+ queue_push_tail(sm->event_ids, UINT_TO_PTR(id));
+
+ id = bt_hci_register_subevent(hci,
+ BT_HCI_EVT_LE_CS_CONFIG_COMPLETE,
+ rap_cs_config_cmplt_evt, sm, NULL);
+ if (!id)
+ goto fail;
+
+ queue_push_tail(sm->event_ids, UINT_TO_PTR(id));
+
+ id = bt_hci_register_subevent(hci,
+ BT_HCI_EVT_LE_CS_SEC_ENABLE_COMPLETE,
+ rap_cs_sec_enable_cmplt_evt, sm, NULL);
+ if (!id)
+ goto fail;
+
+ queue_push_tail(sm->event_ids, UINT_TO_PTR(id));
+
+ id = bt_hci_register_subevent(hci,
+ BT_HCI_EVT_LE_CS_PROC_ENABLE_COMPLETE,
+ rap_cs_proc_enable_cmplt_evt, sm, NULL);
+ if (!id)
+ goto fail;
+
+ queue_push_tail(sm->event_ids, UINT_TO_PTR(id));
+
+ id = bt_hci_register_subevent(hci,
+ BT_HCI_EVT_LE_CS_SUBEVENT_RESULT,
+ rap_cs_subevt_result_evt, sm, NULL);
+ if (!id)
+ goto fail;
+
+ queue_push_tail(sm->event_ids, UINT_TO_PTR(id));
+
+ id = bt_hci_register_subevent(hci,
+ BT_HCI_EVT_LE_CS_SUBEVENT_RESULT_CONTINUE,
+ rap_cs_subevt_result_cont_evt, sm, NULL);
+ if (!id)
+ goto fail;
+
+ queue_push_tail(sm->event_ids, UINT_TO_PTR(id));
DBG("CS options: role=%u, cs_sync_ant_sel=%u, max_tx_power=%d",
role, cs_sync_ant_sel, max_tx_power);
return sm;
+
+fail:
+ error("Failed to register hci le meta subevents");
+ queue_foreach(sm->event_ids, unregister_event_id, hci);
+ queue_destroy(sm->event_ids, NULL);
+ free(sm);
+ return NULL;
}
bool bt_rap_set_conn_handle(void *hci_sm, struct bt_rap *rap, uint16_t handle,
@@ -1204,8 +1150,11 @@ void bt_rap_detach_hci(struct bt_rap *rap, void *hci_sm)
/* Cleanup the per-instance state machine */
if (sm) {
/* Unregister HCI events */
- if (sm->event_id && sm->hci)
- bt_hci_unregister(sm->hci, sm->event_id);
+ if (sm->hci)
+ queue_foreach(sm->event_ids, unregister_event_id,
+ sm->hci);
+
+ queue_destroy(sm->event_ids, NULL);
/* Clean up per-instance connection mappings */
remove_rap_mappings(sm);
--
2.53.0
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox